diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
index 70993d2ccb96..b8d4c0a91631 100644
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.0.0115";
+  version = "9.0.0135";
 
   src = fetchFromGitHub {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    sha256 = "sha256-McotjgjN+ze1jdaAxkdJGTqIIIuOlHENriHdMrYSf5w=";
+    sha256 = "sha256-xAIfGNJIPO9XoSbAQTRa36Tjln3y+oWQk0lADCnL25g=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/kde/messagelib.nix b/pkgs/applications/kde/messagelib.nix
index 6709a1f072a5..3273716ca673 100644
--- a/pkgs/applications/kde/messagelib.nix
+++ b/pkgs/applications/kde/messagelib.nix
@@ -1,5 +1,6 @@
 {
   mkDerivation, lib, kdepimTeam,
+  cmake_3_23,
   extra-cmake-modules, kdoctools,
   akonadi, akonadi-mime, akonadi-notes, akonadi-search, gpgme, grantlee,
   grantleetheme, karchive, kcodecs, kconfig, kconfigwidgets, kcontacts,
@@ -14,7 +15,7 @@ mkDerivation {
     license = with lib.licenses; [ gpl2 lgpl21 fdl12 ];
     maintainers = kdepimTeam;
   };
-  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
+  nativeBuildInputs = [ (extra-cmake-modules.override { cmake = cmake_3_23; }) kdoctools ];
   buildInputs = [
     akonadi-notes akonadi-search gpgme grantlee grantleetheme karchive kcodecs
     kconfig kconfigwidgets kiconthemes kio kjobwidgets kldap
diff --git a/pkgs/applications/networking/instant-messengers/matrix-commander/default.nix b/pkgs/applications/networking/instant-messengers/matrix-commander/default.nix
index 85c3dc86ea0f..87148b0af974 100644
--- a/pkgs/applications/networking/instant-messengers/matrix-commander/default.nix
+++ b/pkgs/applications/networking/instant-messengers/matrix-commander/default.nix
@@ -36,11 +36,6 @@ buildPythonApplication rec {
       -e '/asyncio/d' \
       -e '/datetime/d' \
       setup.cfg requirements.txt
-
-    # Dependencies not correctly detected
-    sed -i \
-      -e '/dbus-python/d' \
-      setup.cfg requirements.txt
   '';
 
   propagatedBuildInputs = [
diff --git a/pkgs/applications/networking/sync/rsync/default.nix b/pkgs/applications/networking/sync/rsync/default.nix
index f47c9c75367d..5e0ddc69a46c 100644
--- a/pkgs/applications/networking/sync/rsync/default.nix
+++ b/pkgs/applications/networking/sync/rsync/default.nix
@@ -53,14 +53,9 @@ stdenv.mkDerivation rec {
     # disable the included zlib explicitly as it otherwise still compiles and
     # links them even.
     "--with-included-zlib=no"
-  ]
-  # Work around issue with cross-compilation:
-  #     configure.sh: error: cannot run test program while cross compiling
-  # Remove once 3.2.4 or more recent is released.
-  # The following PR should fix the cross-compilation issue.
-  # Test using `nix-build -A pkgsCross.aarch64-multiplatform.rsync`.
-  # https://github.com/WayneD/rsync/commit/b7fab6f285ff0ff3816b109a8c3131b6ded0b484
-  ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) "--enable-simd=no";
+  ];
+
+  enableParallelBuilding = true;
 
   passthru.tests = { inherit (nixosTests) rsyncd; };
 
diff --git a/pkgs/applications/terminal-emulators/terminator/default.nix b/pkgs/applications/terminal-emulators/terminator/default.nix
index 04d4af0ccaf0..0f1dd5ddd064 100644
--- a/pkgs/applications/terminal-emulators/terminator/default.nix
+++ b/pkgs/applications/terminal-emulators/terminator/default.nix
@@ -50,9 +50,6 @@ python3.pkgs.buildPythonApplication rec {
 
   postPatch = ''
     patchShebangs tests po
-    # dbus-python is correctly passed in propagatedBuildInputs, but for some reason setup.py complains.
-    # The wrapped terminator has the correct path added, so ignore this.
-    substituteInPlace setup.py --replace "'dbus-python'," ""
   '';
 
   doCheck = false;
diff --git a/pkgs/development/compilers/go/1.18.nix b/pkgs/development/compilers/go/1.18.nix
index 489ed133c611..394c5f92723a 100644
--- a/pkgs/development/compilers/go/1.18.nix
+++ b/pkgs/development/compilers/go/1.18.nix
@@ -1,6 +1,5 @@
 { lib
 , stdenv
-, fetchpatch
 , fetchurl
 , tzdata
 , iana-etc
@@ -56,11 +55,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.18.4";
+  version = "1.18.5";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${version}.src.tar.gz";
-    sha256 = "sha256-RSWqaw487LV4RfQGCnB1qvyat1K7e2tM+KIS1DB44eQ=";
+    sha256 = "sha256-mSDTMGoaxTbN0seW1ss8VLxVnCJvw8w5wy8eC9f1DSo=";
   };
 
   strictDeps = true;
@@ -168,11 +167,7 @@ stdenv.mkDerivation rec {
     touch $TMPDIR/group $TMPDIR/hosts $TMPDIR/passwd
   '';
 
-  patches = let
-    fetchBase64Patch = args: (fetchpatch args).overrideAttrs (o: {
-      postFetch = "mv $out p; base64 -d p > $out; " + o.postFetch;
-    });
-  in [
+  patches = [
     ./remove-tools-1.11.patch
     ./ssl-cert-file-1.16.patch
     ./remove-test-pie-1.15.patch
@@ -182,12 +177,6 @@ stdenv.mkDerivation rec {
     ./skip-nohup-tests.patch
     ./skip-cgo-tests-1.15.patch
     ./go_no_vendor_checks-1.16.patch
-
-    # https://go-review.googlesource.com/c/go/+/417615/
-    (fetchBase64Patch {
-      url = "https://go-review.googlesource.com/changes/go~417615/revisions/3/patch";
-      sha256 = "sha256-Gu5eZUwGGch7et75A/BNynbs4VlQUBClVUxjxPkdjOs=";
-    })
   ];
 
   postPatch = ''
diff --git a/pkgs/development/interpreters/perl/default.nix b/pkgs/development/interpreters/perl/default.nix
index f14c69811430..0a9c53e11c5f 100644
--- a/pkgs/development/interpreters/perl/default.nix
+++ b/pkgs/development/interpreters/perl/default.nix
@@ -198,14 +198,14 @@ let
       priority = 6; # in `buildEnv' (including the one inside `perl.withPackages') the library files will have priority over files in `perl`
     };
   } // optionalAttrs (stdenv.buildPlatform != stdenv.hostPlatform) rec {
-    crossVersion = "31dac3e264a7f1f53dbf49570771123ebd514055"; # May 03, 2022
+    crossVersion = "c876045741f5159318085d2737b0090f35a842ca"; # June 5, 2022
 
     perl-cross-src = fetchFromGitHub {
       name = "perl-cross-unstable-${crossVersion}";
       owner = "arsv";
       repo = "perl-cross";
       rev = crossVersion;
-      sha256 = "sha256-5hLUP34WwTFRsG0o8zSJm8WM3WfBAhHeYrrQF2MtMKc=";
+      sha256 = "sha256-m9UCoTQgXBxSgk9Q1Zv6wl3Qnd0aZm/jEPXkcMKti8U=";
     };
 
     depsBuildBuild = [ buildPackages.stdenv.cc makeWrapper ];
@@ -222,14 +222,6 @@ let
     setupHook = ./setup-hook-cross.sh;
   });
 in {
-  # Maint version
-  perl532 = common {
-    perl = pkgs.perl532;
-    buildPerl = buildPackages.perl532;
-    version = "5.32.1";
-    sha256 = "0b7brakq9xs4vavhg391as50nbhzryc7fy5i65r81bnq3j897dh3";
-  };
-
   # Maint version
   perl534 = common {
     perl = pkgs.perl534;
@@ -238,11 +230,19 @@ in {
     sha256 = "sha256-NXlRpJGwuhzjYRJjki/ux4zNWB3dwkpEawM+JazyQqE=";
   };
 
+  # Maint version
+  perl536 = common {
+    perl = pkgs.perl536;
+    buildPerl = buildPackages.perl536;
+    version = "5.36.0";
+    sha256 = "sha256-4mCFr4rDlvYq3YpTPDoOqMhJfYNvBok0esWr17ek4Ao=";
+  };
+
   # the latest Devel version
   perldevel = common {
     perl = pkgs.perldevel;
     buildPerl = buildPackages.perldevel;
-    version = "5.35.9";
-    sha256 = "sha256-/nmSCIIXHXoC68DxFM9b5GM2AKU4WlLbfWLgduanL7U=";
+    version = "5.37.0";
+    sha256 = "sha256-8RQO6gtH+WmghqzRafbqAH1MhKv/vJCcvysi7/+T9XI=";
   };
 }
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 49f7061df3db..f0a07a855f8a 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -140,10 +140,10 @@ with pkgs;
       sourceVersion = {
         major = "3";
         minor = "10";
-        patch = "5";
+        patch = "6";
         suffix = "";
       };
-      sha256 = "sha256-hDfv1bEG7wp1qr+/I9iAYlEgpzqGoireTS4uaNe3RIY=";
+      sha256 = "sha256-95X/h9EdSwx8M7yIUbDChkjYpFg6ohAKmMIrQya20/M=";
     };
   };
 
diff --git a/pkgs/development/libraries/SDL/default.nix b/pkgs/development/libraries/SDL/default.nix
index 059ba65b25c4..3a2a048a860e 100644
--- a/pkgs/development/libraries/SDL/default.nix
+++ b/pkgs/development/libraries/SDL/default.nix
@@ -104,6 +104,11 @@ stdenv.mkDerivation rec {
       url = "https://github.com/libsdl-org/SDL-1.2/commit/7933032ad4d57c24f2230db29f67eb7d21bb5654.patch";
       sha256 = "1by16firaxyr0hjvn35whsgcmq6bl0nwhnpjf75grjzsw9qvwyia";
     })
+    (fetchpatch {
+      name = "CVE-2022-34568.patch";
+      url = "https://github.com/libsdl-org/SDL-1.2/commit/d7e00208738a0bc6af302723fe64908ac35b777b.patch";
+      sha256 = "sha256-fuxXsqZW94/C8CKu9LakppCU4zHupj66O2MngQ4BO9o=";
+    })
   ];
 
   postInstall = ''
diff --git a/pkgs/development/libraries/cairo/default.nix b/pkgs/development/libraries/cairo/default.nix
index 9a18d173f1d3..f922a7ed2e9f 100644
--- a/pkgs/development/libraries/cairo/default.nix
+++ b/pkgs/development/libraries/cairo/default.nix
@@ -62,6 +62,15 @@ in stdenv.mkDerivation rec {
       url = "https://gitlab.freedesktop.org/cairo/cairo/-/commit/e22d7212acb454daccc088619ee147af03883974.diff";
       sha256 = "sha256-8G98nsPz3MLEWPDX9F0jKgXC4hC4NNdFQLSpmW3ay2s=";
     })
+
+    # Fix unexpected color addition on grayscale images (usually text).
+    # Upstream fix: https://gitlab.freedesktop.org/cairo/cairo/-/merge_requests/114
+    # Can be removed after 1.18 release
+    (fetchpatch {
+      name = "fix-grayscale-anialias.patch";
+      url = "https://gitlab.freedesktop.org/cairo/cairo/-/commit/4f4d89506f58a64b4829b1bb239bab9e46d63727.diff";
+      sha256 = "sha256-mbTg67e7APfdELsuMAgXdY3xokWbGtHF7VDD5UyYqKM=";
+    })
   ];
 
   outputs = [ "out" "dev" "devdoc" ];
diff --git a/pkgs/development/libraries/dbus/default.nix b/pkgs/development/libraries/dbus/default.nix
index 4e41384847d4..075f2a67b70e 100644
--- a/pkgs/development/libraries/dbus/default.nix
+++ b/pkgs/development/libraries/dbus/default.nix
@@ -5,7 +5,7 @@
 , pkg-config
 , expat
 , enableSystemd ? stdenv.isLinux && !stdenv.hostPlatform.isStatic
-, systemd
+, systemdMinimal
 , audit
 , libapparmor
 , dbus
@@ -75,7 +75,7 @@ stdenv.mkDerivation rec {
       libX11
       libICE
       libSM
-    ]) ++ lib.optional enableSystemd systemd
+    ]) ++ lib.optional enableSystemd systemdMinimal
     ++ lib.optionals stdenv.isLinux [ audit libapparmor ];
   # ToDo: optional selinux?
 
@@ -94,7 +94,7 @@ stdenv.mkDerivation rec {
     "--with-systemduserunitdir=${placeholder "out"}/etc/systemd/user"
   ] ++ lib.optional (!x11Support) "--without-x"
   ++ lib.optionals stdenv.isLinux [ "--enable-apparmor" "--enable-libaudit" ]
-  ++ lib.optionals enableSystemd [ "SYSTEMCTL=${systemd}/bin/systemctl" ];
+  ++ lib.optionals enableSystemd [ "SYSTEMCTL=${systemdMinimal}/bin/systemctl" ];
 
   NIX_CFLAGS_LINK = lib.optionalString (!stdenv.isDarwin) "-Wl,--as-needed";
 
diff --git a/pkgs/development/libraries/freeglut/default.nix b/pkgs/development/libraries/freeglut/default.nix
index 0e81e2188af3..21b2d117558b 100644
--- a/pkgs/development/libraries/freeglut/default.nix
+++ b/pkgs/development/libraries/freeglut/default.nix
@@ -1,23 +1,14 @@
-{ lib, stdenv, fetchurl, fetchpatch, libXi, libXrandr, libXxf86vm, libGL, libGLU, xlibsWrapper, cmake }:
+{ lib, stdenv, fetchurl, libXi, libXrandr, libXxf86vm, libGL, libGLU, xlibsWrapper, cmake }:
 
 stdenv.mkDerivation rec {
   pname = "freeglut";
-  version = "3.2.1";
+  version = "3.2.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/freeglut/freeglut-${version}.tar.gz";
-    sha256 = "0s6sk49q8ijgbsrrryb7dzqx2fa744jhx1wck5cz5jia2010w06l";
+    sha256 = "sha256-xZRKCC3wu6lrV1bd2x910M1yzie1OVxsHd6Fwv8pelA=";
   };
 
-  patches = [
-    (fetchpatch {
-      # upstream build fix against -fno-common compilers like >=gcc-10
-      url = "https://github.com/dcnieho/FreeGLUT/commit/b9998bbc1e1c329f6bf69c24606a2be7a4973b8c.patch";
-      sha256 = "0j43vrnm22mz3r3c43szgcnil19cx9vcydzky9gwzqlyacr51swd";
-      stripLen = 2;
-    })
-  ];
-
   outputs = [ "out" "dev" ];
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/libass/default.nix b/pkgs/development/libraries/libass/default.nix
index 15e0396142f4..118238f5f5a9 100644
--- a/pkgs/development/libraries/libass/default.nix
+++ b/pkgs/development/libraries/libass/default.nix
@@ -11,11 +11,11 @@ assert fontconfigSupport -> fontconfig != null;
 with lib;
 stdenv.mkDerivation rec {
   pname = "libass";
-  version = "0.15.2";
+  version = "0.16.0";
 
   src = fetchurl {
     url = "https://github.com/libass/libass/releases/download/${version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-G+LfnESFpX14uxjAqO0Ve8h6Wo3UjGYZYcYlyxEoMv0=";
+    sha256 = "sha256-Xb3p4iM5EZz47tWe6mxiOgdG71qQtonmigkBCQeOPAg=";
   };
 
   configureFlags = [
diff --git a/pkgs/development/libraries/libdrm/cross-build-nm-path.patch b/pkgs/development/libraries/libdrm/cross-build-nm-path.patch
deleted file mode 100644
index 547ef0d09691..000000000000
--- a/pkgs/development/libraries/libdrm/cross-build-nm-path.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 9e05fece7918edce9c6aa5a1f1ea375108e5b2be Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
-Date: Fri, 2 Aug 2019 10:26:37 +0100
-Subject: [PATCH] meson: support for custom nm path
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-When cross-compiling target toolchains i.e. binutils are often
-prefixed by its target architecture. This patch gives the user
-to option to specify the nm used during the build process.
-
-Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
----
- meson.build       | 2 +-
- meson_options.txt | 6 ++++++
- 2 files changed, 7 insertions(+), 1 deletion(-)
-
-diff --git a/meson.build b/meson.build
---- meson.build.orig	2020-06-18 11:13:57.716321962 +0200
-+++ meson.build	2020-06-18 11:19:50.456861311 +0200
-@@ -45,7 +45,7 @@
- cc = meson.get_compiler('c')
-
- symbols_check = find_program('symbols-check.py')
--prog_nm = find_program('nm')
-+prog_nm = find_program(get_option('nm-path'))
-
- # Check for atomics
- intel_atomics = false
-diff --git a/meson_options.txt b/meson_options.txt
-index 8af33f1c..b4f46a52 100644
---- a/meson_options.txt
-+++ b/meson_options.txt
-@@ -141,3 +141,9 @@ option(
-   value : false,
-   description : 'Enable support for using udev instead of mknod.',
- )
-+option(
-+  'nm-path',
-+  type : 'string',
-+  description : 'path to nm',
-+  value : 'nm'
-+)
--- 
-2.22.0
-
diff --git a/pkgs/development/libraries/libdrm/default.nix b/pkgs/development/libraries/libdrm/default.nix
index ec12f1031cf5..e49a903730b9 100644
--- a/pkgs/development/libraries/libdrm/default.nix
+++ b/pkgs/development/libraries/libdrm/default.nix
@@ -18,10 +18,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ libpthreadstubs libpciaccess ]
     ++ lib.optional withValgrind valgrind-light;
 
-  patches = [ ./cross-build-nm-path.patch ];
-
   mesonFlags = [
-    "-Dnm-path=${stdenv.cc.targetPrefix}nm"
     "-Dinstall-test-programs=true"
     "-Domap=true"
   ] ++ lib.optionals stdenv.hostPlatform.isAarch [
diff --git a/pkgs/development/libraries/libdvdread/default.nix b/pkgs/development/libraries/libdvdread/default.nix
index ac94dcbcb8f7..f07af1fa575b 100644
--- a/pkgs/development/libraries/libdvdread/default.nix
+++ b/pkgs/development/libraries/libdvdread/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libdvdread";
-  version = "6.1.2";
+  version = "6.1.3";
 
   src = fetchurl {
     url = "http://get.videolan.org/libdvdread/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-zBkPVTdYztdXGFnjAfgCy0gh8WTQK/rP0yDBSk4Np2M=";
+    sha256 = "sha256-zjVFSZeiCMvlDpEjLw5z+xrDRxllgToTuHMKjxihU2k=";
   };
 
   buildInputs = [libdvdcss];
diff --git a/pkgs/development/libraries/libfido2/default.nix b/pkgs/development/libraries/libfido2/default.nix
index e5d6d1c7c679..d7c034b9e98b 100644
--- a/pkgs/development/libraries/libfido2/default.nix
+++ b/pkgs/development/libraries/libfido2/default.nix
@@ -8,23 +8,26 @@
 , openssl
 , udev
 , zlib
+, pcsclite
 }:
 
 stdenv.mkDerivation rec {
   pname = "libfido2";
-  version = "1.10.0";
+  version = "1.11.0";
 
   # releases on https://developers.yubico.com/libfido2/Releases/ are signed
   src = fetchurl {
     url = "https://developers.yubico.com/${pname}/Releases/${pname}-${version}.tar.gz";
-    sha256 = "sha256-Um79PVavcGwF0J89IfGO47CxWsDB9cXaGsvCfCcwuZs=";
+    sha256 = "sha256-CDDFhT47RAmalxZuDOxUpltUt/qqwHBxhy93uOTXswI=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
 
-  buildInputs = [ libcbor openssl zlib ]
+  buildInputs = [ libcbor zlib ]
     ++ lib.optionals stdenv.isDarwin [ hidapi ]
-    ++ lib.optionals stdenv.isLinux [ udev ];
+    ++ lib.optionals stdenv.isLinux [ udev pcsclite ];
+
+  propagatedBuildInputs = [ openssl ];
 
   cmakeFlags = [
     "-DUDEV_RULES_DIR=${placeholder "out"}/etc/udev/rules.d"
@@ -33,6 +36,7 @@ stdenv.mkDerivation rec {
     "-DUSE_HIDAPI=1"
   ] ++ lib.optionals stdenv.isLinux [
     "-DNFC_LINUX=1"
+    "-DUSE_PCSC=1"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/libtiff/aarch64-darwin.nix b/pkgs/development/libraries/libtiff/aarch64-darwin.nix
deleted file mode 100644
index 521db8ff7993..000000000000
--- a/pkgs/development/libraries/libtiff/aarch64-darwin.nix
+++ /dev/null
@@ -1,51 +0,0 @@
-{ lib, stdenv
-, fetchurl
-
-, pkg-config
-, cmake
-
-, libdeflate
-, libjpeg
-, xz
-, zlib
-}:
-
-stdenv.mkDerivation rec {
-  pname = "libtiff";
-  version = "4.2.0";
-
-  src = fetchurl {
-    url = "https://download.osgeo.org/libtiff/tiff-${version}.tar.gz";
-    sha256 = "1jrkjv0xya9radddn8idxvs2gqzp3l2b1s8knlizmn7ad3jq817b";
-  };
-
-  # FreeImage needs this patch
-  patches = [ ./headers-cmake.patch ];
-
-  outputs = [ "bin" "dev" "dev_private" "out" "man" "doc" ];
-
-  postFixup = ''
-    moveToOutput include/tif_dir.h $dev_private
-    moveToOutput include/tif_config.h $dev_private
-    moveToOutput include/tiffiop.h $dev_private
-  '';
-
-  nativeBuildInputs = [ cmake pkg-config ];
-
-  propagatedBuildInputs = [ libjpeg xz zlib ]; #TODO: opengl support (bogus configure detection)
-
-  buildInputs = [ libdeflate ]; # TODO: move all propagatedBuildInputs to buildInputs.
-
-  enableParallelBuilding = true;
-
-  doInstallCheck = true;
-  installCheckTarget = "test";
-
-  meta = with lib; {
-    description = "Library and utilities for working with the TIFF image file format";
-    homepage = "https://libtiff.gitlab.io/libtiff";
-    changelog = "https://libtiff.gitlab.io/libtiff/v${version}.html";
-    license = licenses.libtiff;
-    platforms = platforms.unix;
-  };
-}
diff --git a/pkgs/development/libraries/libtiff/default.nix b/pkgs/development/libraries/libtiff/default.nix
index 4c7ea02d8aa4..7f6d11d9e715 100644
--- a/pkgs/development/libraries/libtiff/default.nix
+++ b/pkgs/development/libraries/libtiff/default.nix
@@ -21,8 +21,6 @@
 , imlib
 }:
 
-#FIXME: fix aarch64-darwin build and get rid of ./aarch64-darwin.nix
-
 stdenv.mkDerivation rec {
   pname = "libtiff";
   version = "4.4.0";
@@ -38,6 +36,11 @@ stdenv.mkDerivation rec {
     # libc++abi 11 has an `#include <version>`, this picks up files name
     # `version` in the project's include paths
     ./rename-version.patch
+    (fetchpatch {
+      name = "CVE-2022-34526.patch";
+      url = "https://gitlab.com/libtiff/libtiff/-/commit/275735d0354e39c0ac1dc3c0db2120d6f31d1990.patch";
+      sha256 = "sha256-faKsdJjvQwNdkAKjYm4vubvZvnULt9zz4l53zBFr67s=";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/development/libraries/libtiff/headers-cmake.patch b/pkgs/development/libraries/libtiff/headers-cmake.patch
deleted file mode 100644
index 5a00502ef281..000000000000
--- a/pkgs/development/libraries/libtiff/headers-cmake.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff -ruN a/libtiff/CMakeLists.txt b/libtiff/CMakeLists.txt
---- a/libtiff/CMakeLists.txt	2019-05-31 13:05:22.849705817 +0000
-+++ b/libtiff/CMakeLists.txt	2020-11-27 21:50:03.527831837 +0000
-@@ -42,6 +42,9 @@
-   libtiffxx.map)
- 
- set(tiff_HEADERS
-+  tiffiop.h
-+  ${CMAKE_CURRENT_BINARY_DIR}/tif_config.h
-+  tif_dir.h
-   tiff.h
-   tiffio.h
-   tiffvers.h)
diff --git a/pkgs/development/libraries/libwebp/default.nix b/pkgs/development/libraries/libwebp/default.nix
index 65dcd3587af1..e96f442e64cd 100644
--- a/pkgs/development/libraries/libwebp/default.nix
+++ b/pkgs/development/libraries/libwebp/default.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libwebp";
-  version = "1.2.2";
+  version = "1.2.3";
 
   src = fetchFromGitHub {
     owner  = "webmproject";
     repo   = pname;
     rev    = "v${version}";
-    hash   = "sha256-WF2HZPS7mbotk+d1oLM/JC5l/FWfkrk+T3Z6EW9oYEI=";
+    hash   = "sha256-t27d+eJR4iTHSLlI3J7RqHgsWACThjsI9O6R2Zb9F1g=";
   };
 
   prePatch = "patchShebangs .";
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index d2c3128004fd..48df1b0149c1 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -81,19 +81,11 @@ self = stdenv.mkDerivation {
   postPatch = ''
     patchShebangs .
 
-    substituteInPlace meson.build --replace \
-      "find_program('pkg-config')" \
-      "find_program('${buildPackages.pkg-config.targetPrefix}pkg-config')"
-
     # The drirc.d directory cannot be installed to $drivers as that would cause a cyclic dependency:
     substituteInPlace src/util/xmlconfig.c --replace \
       'DATADIR "/drirc.d"' '"${placeholder "out"}/share/drirc.d"'
     substituteInPlace src/util/meson.build --replace \
       "get_option('datadir')" "'${placeholder "out"}/share'"
-  '' + lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
-    substituteInPlace meson.build --replace \
-      "find_program('nm')" \
-      "find_program('${stdenv.cc.targetPrefix}nm')"
   '';
 
   outputs = [ "out" "dev" "drivers" ]
diff --git a/pkgs/development/libraries/nspr/default.nix b/pkgs/development/libraries/nspr/default.nix
index f3c5ac668cff..44d172dba859 100644
--- a/pkgs/development/libraries/nspr/default.nix
+++ b/pkgs/development/libraries/nspr/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "nspr";
-  version = "4.34";
+  version = "4.34.1";
 
   src = fetchurl {
     url = "mirror://mozilla/nspr/releases/v${version}/src/nspr-${version}.tar.gz";
-    sha256 = "177rxcf3lglabs7sgwcvf72ww4v56qa71lc495wl13sxs4f03vxy";
+    hash = "sha256-xbg1TEi2Mrj0wZcGKBRsDgwMqPMscxXX1XNsAC4Dd08=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/openal-soft/default.nix b/pkgs/development/libraries/openal-soft/default.nix
index 368b1b911eb5..fa1d5af48042 100644
--- a/pkgs/development/libraries/openal-soft/default.nix
+++ b/pkgs/development/libraries/openal-soft/default.nix
@@ -29,8 +29,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake pkg-config ];
 
-  buildInputs = lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) stdenv.cc.libc
-    ++ lib.optional alsaSupport alsa-lib
+  buildInputs = lib.optional alsaSupport alsa-lib
     ++ lib.optional dbusSupport dbus
     ++ lib.optional pipewireSupport pipewire
     ++ lib.optional pulseSupport libpulseaudio
@@ -40,6 +39,9 @@ stdenv.mkDerivation rec {
     # Automatically links dependencies without having to rely on dlopen, thus
     # removes the need for NIX_LDFLAGS.
     "-DALSOFT_DLOPEN=OFF"
+  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
+    # https://github.com/NixOS/nixpkgs/issues/183774
+    "-DOSS_INCLUDE_DIR=${stdenv.cc.libc}/include"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/openh264/default.nix b/pkgs/development/libraries/openh264/default.nix
index 42ae370cd901..e85589af0c1a 100644
--- a/pkgs/development/libraries/openh264/default.nix
+++ b/pkgs/development/libraries/openh264/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openh264";
-  version = "2.2.0";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     owner = "cisco";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-l64xP39Uaislqh4D7oSxJiQGhXkklol4LgS9BVPbaGk=";
+    sha256 = "sha256-OSTsU2E4UWiwBqq3NqD0lj8uqVXeyd3MJ/gre6W2Jvs=";
   };
 
   nativeBuildInputs = [ nasm ];
diff --git a/pkgs/development/libraries/polkit/default.nix b/pkgs/development/libraries/polkit/default.nix
index 78daac0ba1c2..163e3bb9965c 100644
--- a/pkgs/development/libraries/polkit/default.nix
+++ b/pkgs/development/libraries/polkit/default.nix
@@ -22,7 +22,7 @@
 , gtk-doc
 , coreutils
 , useSystemd ? stdenv.isLinux
-, systemd
+, systemdMinimal
 , elogind
 # A few tests currently fail on musl (polkitunixusertest, polkitunixgrouptest, polkitidentitytest segfault).
 # Not yet investigated; it may be due to the "Make netgroup support optional"
@@ -106,7 +106,7 @@ stdenv.mkDerivation rec {
     duktape
   ] ++ lib.optionals stdenv.isLinux [
     # On Linux, fall back to elogind when systemd support is off.
-    (if useSystemd then systemd else elogind)
+    (if useSystemd then systemdMinimal else elogind)
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/libraries/wayland/add-placeholder-for-nm.patch b/pkgs/development/libraries/wayland/add-placeholder-for-nm.patch
deleted file mode 100644
index dbc63028b45b..000000000000
--- a/pkgs/development/libraries/wayland/add-placeholder-for-nm.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/egl/meson.build b/egl/meson.build
-index b3cbdf3..cdc15ca 100644
---- a/egl/meson.build
-+++ b/egl/meson.build
-@@ -11,7 +11,7 @@ wayland_egl = library(
-
- executable('wayland-egl-abi-check', 'wayland-egl-abi-check.c')
-
--nm_path = find_program('nm').full_path()
-+nm_path = find_program('@nm@').full_path()
-
- test(
-        'wayland-egl symbols check',
diff --git a/pkgs/development/libraries/wayland/default.nix b/pkgs/development/libraries/wayland/default.nix
index ac434b795aef..c9d0a7ad3b7c 100644
--- a/pkgs/development/libraries/wayland/default.nix
+++ b/pkgs/development/libraries/wayland/default.nix
@@ -36,13 +36,6 @@ stdenv.mkDerivation rec {
     sha256 = "1b0ixya9bfw5c9jx8mzlr7yqnlyvd3jv5z8wln9scdv8q5zlvikd";
   };
 
-  patches = [
-    (substituteAll {
-      src = ./add-placeholder-for-nm.patch;
-      nm = "${stdenv.cc.targetPrefix}nm";
-    })
-  ];
-
   postPatch = lib.optionalString withDocumentation ''
     patchShebangs doc/doxygen/gen-doxygen.py
   '' + lib.optionalString stdenv.hostPlatform.isStatic ''
diff --git a/pkgs/development/python-modules/attrs/default.nix b/pkgs/development/python-modules/attrs/default.nix
index 4b10f4203e8b..44b61fcba725 100644
--- a/pkgs/development/python-modules/attrs/default.nix
+++ b/pkgs/development/python-modules/attrs/default.nix
@@ -2,15 +2,17 @@
 , callPackage
 , buildPythonPackage
 , fetchPypi
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "attrs";
-  version = "21.4.0";
+  version = "22.1.0";
+  disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-YmuoI0IR25joad92IwoTfExAoS1yRFxF1fW3FvB24v0=";
+    hash = "sha256-Ka3CZlRH5RkdDnxWj954sh+WctNEKB0MbhqwhUKbIrY=";
   };
 
   outputs = [
@@ -38,7 +40,7 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Python attributes without boilerplate";
-    homepage = "https://github.com/hynek/attrs";
+    homepage = "https://github.com/python-attrs/attrs";
     license = licenses.mit;
     maintainers = with maintainers; [ ];
   };
diff --git a/pkgs/development/python-modules/cattrs/default.nix b/pkgs/development/python-modules/cattrs/default.nix
index a6355e198849..6584f5f15df1 100644
--- a/pkgs/development/python-modules/cattrs/default.nix
+++ b/pkgs/development/python-modules/cattrs/default.nix
@@ -2,6 +2,7 @@
 , attrs
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , exceptiongroup
 , hypothesis
 , immutables
@@ -32,6 +33,14 @@ buildPythonPackage rec {
     hash = "sha256-C8uIsewpgJfB1yYckWTwF5K32+2AAOrxFKB9I18RENg=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/python-attrs/cattrs/commit/290d162a589acf10ea63b825b7b283e23ca7698a.diff";
+      excludes = [ "poetry.lock" ];
+      hash = "sha256-n6c3qVg9umGKAxeTALq3QTJgO9DIj3SY0ZHhtsDeW94=";
+    })
+  ];
+
   nativeBuildInputs = [
     poetry-core
   ];
diff --git a/pkgs/development/python-modules/dbus/default.nix b/pkgs/development/python-modules/dbus/default.nix
index 9d88bb4a9f17..81052c62caed 100644
--- a/pkgs/development/python-modules/dbus/default.nix
+++ b/pkgs/development/python-modules/dbus/default.nix
@@ -35,6 +35,10 @@ buildPythonPackage rec {
   doCheck = isPy3k;
   checkInputs = [ dbus.out pygobject3 ];
 
+  postInstall = ''
+    cp -r dbus_python.egg-info $out/${python.sitePackages}/
+  '';
+
   meta = with lib; {
     description = "Python DBus bindings";
     license = licenses.mit;
diff --git a/pkgs/development/python-modules/django/3.nix b/pkgs/development/python-modules/django/3.nix
index c620761dde25..204857b925f4 100644
--- a/pkgs/development/python-modules/django/3.nix
+++ b/pkgs/development/python-modules/django/3.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "django";
-  version = "3.2.14";
+  version = "3.2.15";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "Django";
     inherit version;
-    sha256 = "sha256-Z3GCuotbKFpOBy86wXzu5q/xtc53/Rc8xbai09wCL88=";
+    hash = "sha256-9xk0sagi8UqGyayWNAU2iSec0ErmnLat5KWUcbiGWCs=";
   };
 
   patches = lib.optional withGdal
diff --git a/pkgs/development/python-modules/eventlet/default.nix b/pkgs/development/python-modules/eventlet/default.nix
index 446f825fd3bf..977f5e236a25 100644
--- a/pkgs/development/python-modules/eventlet/default.nix
+++ b/pkgs/development/python-modules/eventlet/default.nix
@@ -51,6 +51,7 @@ buildPythonPackage rec {
   disabledTests = [
     # Tests requires network access
     "test_017_ssl_zeroreturnerror"
+    "test_018b_http_10_keepalive_framing"
     "test_getaddrinfo"
     "test_hosts_no_network"
     "test_leakage_from_tracebacks"
diff --git a/pkgs/development/python-modules/hatchling/default.nix b/pkgs/development/python-modules/hatchling/default.nix
index 684703e6b780..eedebeff3108 100644
--- a/pkgs/development/python-modules/hatchling/default.nix
+++ b/pkgs/development/python-modules/hatchling/default.nix
@@ -20,7 +20,7 @@
 
 let
   pname = "hatchling";
-  version = "1.5.0";
+  version = "1.6.0";
 in
 buildPythonPackage {
   inherit pname version;
@@ -28,7 +28,7 @@ buildPythonPackage {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-nKQJpBFAzGYhZGgLeK3NO6d7I6lFmEvZlw0R/jjoajg=";
+    sha256 = "sha256-vW6FBd5RGsQhf/UJJ/bRhFSUYI5AHmOmK4MMMfthNUQ=";
   };
 
   # listed in backend/src/hatchling/ouroboros.py
diff --git a/pkgs/development/python-modules/ipython/default.nix b/pkgs/development/python-modules/ipython/default.nix
index b5e99fe4a7da..b6c193d05f05 100644
--- a/pkgs/development/python-modules/ipython/default.nix
+++ b/pkgs/development/python-modules/ipython/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , pythonOlder
 
 # Build dependencies
@@ -36,6 +37,17 @@ buildPythonPackage rec {
     sha256 = "f2db3a10254241d9b447232cec8b424847f338d9d36f9a577a6192c332a46abd";
   };
 
+  patches = [
+    (fetchpatch {
+      # The original URL might not be very stable, so let's prefer a copy.
+      urls = [
+        "https://raw.githubusercontent.com/bmwiedemann/openSUSE/9b35e4405a44aa737dda623a7dabe5384172744c/packages/p/python-ipython/ipython-pr13714-xxlimited.patch"
+        "https://github.com/ipython/ipython/pull/13714.diff"
+      ];
+      sha256 = "XPOcBo3p8mzMnP0iydns9hX8qCQXTmRgRD0TM+FESCI=";
+    })
+  ];
+
   nativeBuildInputs = [
     setuptools
   ];
diff --git a/pkgs/development/python-modules/jsonschema/default.nix b/pkgs/development/python-modules/jsonschema/default.nix
index 944f35b96422..cde909e79b83 100644
--- a/pkgs/development/python-modules/jsonschema/default.nix
+++ b/pkgs/development/python-modules/jsonschema/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "jsonschema";
-  version = "4.7.2";
+  version = "4.9.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-c3ZPRh1h65egV8kpNoYQoTTR0f/9hYrP6Ihk7pTx8dM=";
+    sha256 = "sha256-QIxMjtDe3jsmj3pEF4T3QgY4CwT5PrLVN8e++z3zCZ8=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/loguru/default.nix b/pkgs/development/python-modules/loguru/default.nix
index 1a7982026bcd..9c0d88df644d 100644
--- a/pkgs/development/python-modules/loguru/default.nix
+++ b/pkgs/development/python-modules/loguru/default.nix
@@ -21,6 +21,14 @@ buildPythonPackage rec {
     sha256 = "sha256-BmvQZ1jQpRPpg2/ZxrWnW/s/02hB9LmWvGC1R6MJ1Bw=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "fix-test-repr-infinite-recursion.patch";
+      url = "https://github.com/Delgan/loguru/commit/4fe21f66991abeb1905e24c3bc3c634543d959a2.patch";
+      hash = "sha256-NUOkgUS28TOazO0txMinFtaKwsi/J1Y7kqjjvMRCnR8=";
+    })
+  ];
+
   propagatedBuildInputs = lib.optionals (pythonOlder "3.7") [
     aiocontextvars
   ];
diff --git a/pkgs/development/python-modules/python-dbusmock/default.nix b/pkgs/development/python-modules/python-dbusmock/default.nix
index 1be846aa2ae8..cc8181e7325c 100644
--- a/pkgs/development/python-modules/python-dbusmock/default.nix
+++ b/pkgs/development/python-modules/python-dbusmock/default.nix
@@ -8,24 +8,27 @@
 , bluez
 , networkmanager
 , setuptools-scm
+, runCommand
 }:
 
-buildPythonPackage rec {
+let
+  # Cannot just add it to path in preCheck since that attribute will be passed to
+  # mkDerivation even with doCheck = false, causing a dependency cycle.
+  pbap-client = runCommand "pbap-client" { } ''
+    mkdir -p "$out/bin"
+    ln -s "${bluez.test}/test/pbap-client" "$out/bin/pbap-client"
+  '';
+in buildPythonPackage rec {
   pname = "python-dbusmock";
-  version = "0.28.3";
+  version = "0.28.4";
 
   src = fetchFromGitHub {
     owner = "martinpitt";
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-LV94F2f0Ir2Ayzk2YLL76TqeUuC0f7e+bH3vC/xKgfU=";
+    sha256 = "sha256-gsGg9zHVyDTCVZmFUI8qqXDt0ui+o3hPwjRlsYUmShg=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace '"dbus-python"' ""
-  '';
-
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
   nativeBuildInputs = [
@@ -40,7 +43,7 @@ buildPythonPackage rec {
     dbus
     pygobject3
     bluez
-    (lib.getOutput "test" bluez)
+    pbap-client
     networkmanager
     nose
   ];
@@ -68,7 +71,6 @@ buildPythonPackage rec {
     # "test_networkmanager"
   ];
 
-
   checkPhase = ''
     runHook preCheck
     nosetests -v
diff --git a/pkgs/development/python-modules/swspotify/default.nix b/pkgs/development/python-modules/swspotify/default.nix
index 1e1a9fd9cea4..e2627660006b 100644
--- a/pkgs/development/python-modules/swspotify/default.nix
+++ b/pkgs/development/python-modules/swspotify/default.nix
@@ -35,12 +35,6 @@ buildPythonPackage rec {
     requests
   ];
 
-  postPatch = ''
-    # Detection of the  platform doesn't always works with 1.2.3
-    substituteInPlace pyproject.toml \
-      --replace 'dbus-python = {version = "^1.2.16", platform = "linux"}' ""
-  '';
-
   # Tests want to use Dbus
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/urllib3/default.nix b/pkgs/development/python-modules/urllib3/default.nix
index ba10224e92ce..3cdbdd3a111b 100644
--- a/pkgs/development/python-modules/urllib3/default.nix
+++ b/pkgs/development/python-modules/urllib3/default.nix
@@ -20,12 +20,12 @@
 
 buildPythonPackage rec {
   pname = "urllib3";
-  version = "1.26.10";
+  version = "1.26.11";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-h5uk0eiWVNl2nOExIeD5QxDqMujS+M9Ye3fAi7zbMNY=";
+    hash = "sha256-6m6PshCxnZUPq5O2DJAJImxjoogIvIOG4FMB4liDrAo=";
   };
 
   # FIXME: remove backwards compatbility hack
diff --git a/pkgs/development/python-modules/uvloop/default.nix b/pkgs/development/python-modules/uvloop/default.nix
index 3e877ea1a8e0..da17c78a5eb9 100644
--- a/pkgs/development/python-modules/uvloop/default.nix
+++ b/pkgs/development/python-modules/uvloop/default.nix
@@ -48,7 +48,6 @@ buildPythonPackage rec {
     # Depend on pyopenssl
     "--deselect tests/test_tcp.py::Test_UV_TCPSSL::test_flush_before_shutdown"
     "--deselect tests/test_tcp.py::Test_UV_TCPSSL::test_renegotiation"
-  ] ++ lib.optionals stdenv.hostPlatform.isAarch [
     # test gets stuck in epoll_pwait on hydras aarch64 builders
     # https://github.com/MagicStack/uvloop/issues/412
     "--deselect tests/test_tcp.py::Test_AIO_TCPSSL::test_remote_shutdown_receives_trailing_data"
diff --git a/pkgs/development/python2-modules/attrs/default.nix b/pkgs/development/python2-modules/attrs/default.nix
new file mode 100644
index 000000000000..4b10f4203e8b
--- /dev/null
+++ b/pkgs/development/python2-modules/attrs/default.nix
@@ -0,0 +1,45 @@
+{ lib
+, callPackage
+, buildPythonPackage
+, fetchPypi
+}:
+
+buildPythonPackage rec {
+  pname = "attrs";
+  version = "21.4.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-YmuoI0IR25joad92IwoTfExAoS1yRFxF1fW3FvB24v0=";
+  };
+
+  outputs = [
+    "out"
+    "testout"
+  ];
+
+  postInstall = ''
+    # Install tests as the tests output.
+    mkdir $testout
+    cp -R tests $testout/tests
+  '';
+
+  pythonImportsCheck = [
+    "attr"
+  ];
+
+  # pytest depends on attrs, so we can't do this out-of-the-box.
+  # Instead, we do this as a passthru.tests test.
+  doCheck = false;
+
+  passthru.tests = {
+    pytest = callPackage ./tests.nix { };
+  };
+
+  meta = with lib; {
+    description = "Python attributes without boilerplate";
+    homepage = "https://github.com/hynek/attrs";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ];
+  };
+}
diff --git a/pkgs/development/tools/analysis/rr/default.nix b/pkgs/development/tools/analysis/rr/default.nix
index a667de3d5cb7..f459468de20a 100644
--- a/pkgs/development/tools/analysis/rr/default.nix
+++ b/pkgs/development/tools/analysis/rr/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, cmake, libpfm, zlib, pkg-config, python3Packages, which, procps, gdb, capnproto }:
 
 stdenv.mkDerivation rec {
-  version = "5.5.0";
+  version = "5.6.0";
   pname = "rr";
 
   src = fetchFromGitHub {
     owner = "mozilla";
     repo = "rr";
     rev = version;
-    sha256 = "sha256-ZZhkmDWGNWejwXZEcFO9p9NG1dopK7kXRj7OrkJCPR0=";
+    sha256 = "H39HPkAQGubXVQV3jCpH4Pz+7Q9n03PrS70utk7Tt2k=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/build-managers/cmake/3_23.nix b/pkgs/development/tools/build-managers/cmake/3_23.nix
new file mode 100644
index 000000000000..863d82d8aaed
--- /dev/null
+++ b/pkgs/development/tools/build-managers/cmake/3_23.nix
@@ -0,0 +1,168 @@
+{ lib
+, stdenv
+, buildPackages
+, bzip2
+, curlMinimal
+, expat
+, fetchurl
+, libarchive
+, libuv
+, ncurses
+, openssl
+, pkg-config
+, qtbase
+, rhash
+, sphinx
+, texinfo
+, wrapQtAppsHook
+, xz
+, zlib
+, SystemConfiguration
+, ps ? null
+, isBootstrap ? false
+, useOpenSSL ? !isBootstrap
+, useSharedLibraries ? (!isBootstrap && !stdenv.isCygwin)
+, uiToolkits ? [] # can contain "ncurses" and/or "qt5"
+, buildDocs ? !(isBootstrap || (uiToolkits == []))
+}:
+
+let
+  cursesUI = lib.elem "ncurses" uiToolkits;
+  qt5UI = lib.elem "qt5" uiToolkits;
+in
+# Accepts only "ncurses" and "qt5" as possible uiToolkits
+assert lib.subtractLists [ "ncurses" "qt5" ] uiToolkits == [];
+stdenv.mkDerivation rec {
+  pname = "cmake"
+    + lib.optionalString isBootstrap "-boot"
+    + lib.optionalString cursesUI "-cursesUI"
+    + lib.optionalString qt5UI "-qt5UI";
+  version = "3.23.3";
+
+  src = fetchurl {
+    url = "https://cmake.org/files/v${lib.versions.majorMinor version}/cmake-${version}.tar.gz";
+    sha256 = "sha256-Bv768K2UmJcktW9zMJPCYj9vhDVuW+uVWVf5zj7iiAk=";
+  };
+
+  patches = [
+    # Don't search in non-Nix locations such as /usr, but do search in our libc.
+    ./001-search-path.diff
+    # Don't depend on frameworks.
+    ./002-application-services.diff
+    # Derived from https://github.com/libuv/libuv/commit/1a5d4f08238dd532c3718e210078de1186a5920d
+    ./003-libuv-application-services.diff
+  ]
+  ++ lib.optional stdenv.isCygwin ./004-cygwin.diff
+  # Derived from https://github.com/curl/curl/commit/31f631a142d855f069242f3e0c643beec25d1b51
+  ++ lib.optional (stdenv.isDarwin && isBootstrap) ./005-remove-systemconfiguration-dep.diff
+  # On Darwin, always set CMAKE_SHARED_LIBRARY_RUNTIME_C_FLAG.
+  ++ lib.optional stdenv.isDarwin ./006-darwin-always-set-runtime-c-flag.diff;
+
+  outputs = [ "out" ] ++ lib.optionals buildDocs [ "man" "info" ];
+  setOutputFlags = false;
+
+  setupHook = ./setup-hook.sh;
+
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+
+  nativeBuildInputs = [
+    pkg-config
+    setupHook
+  ]
+  ++ lib.optionals buildDocs [ texinfo ]
+  ++ lib.optionals qt5UI [ wrapQtAppsHook ];
+
+  buildInputs = lib.optionals useSharedLibraries [
+    bzip2
+    curlMinimal
+    expat
+    libarchive
+    xz
+    zlib
+    libuv
+    rhash
+  ]
+  ++ lib.optional useOpenSSL openssl
+  ++ lib.optional cursesUI ncurses
+  ++ lib.optional qt5UI qtbase
+  ++ lib.optional (stdenv.isDarwin && !isBootstrap) SystemConfiguration;
+
+  propagatedBuildInputs = lib.optional stdenv.isDarwin ps;
+
+  preConfigure = ''
+    fixCmakeFiles .
+    substituteInPlace Modules/Platform/UnixPaths.cmake \
+      --subst-var-by libc_bin ${lib.getBin stdenv.cc.libc} \
+      --subst-var-by libc_dev ${lib.getDev stdenv.cc.libc} \
+      --subst-var-by libc_lib ${lib.getLib stdenv.cc.libc}
+    # CC_FOR_BUILD and CXX_FOR_BUILD are used to bootstrap cmake
+    configureFlags="--parallel=''${NIX_BUILD_CORES:-1} CC=$CC_FOR_BUILD CXX=$CXX_FOR_BUILD $configureFlags"
+  '';
+
+  configureFlags = [
+    "CXXFLAGS=-Wno-elaborated-enum-base"
+    "--docdir=share/doc/${pname}${version}"
+  ] ++ (if useSharedLibraries
+        then [ "--no-system-jsoncpp" "--system-libs" ]
+        else [ "--no-system-libs" ]) # FIXME: cleanup
+  ++ lib.optional qt5UI "--qt-gui"
+  ++ lib.optionals buildDocs [
+    "--sphinx-build=${sphinx}/bin/sphinx-build"
+    "--sphinx-info"
+    "--sphinx-man"
+  ]
+  # Workaround https://gitlab.kitware.com/cmake/cmake/-/issues/20568
+  ++ lib.optionals stdenv.hostPlatform.is32bit [
+    "CFLAGS=-D_FILE_OFFSET_BITS=64"
+    "CXXFLAGS=-D_FILE_OFFSET_BITS=64"
+  ]
+  ++ [
+    "--"
+    # We should set the proper `CMAKE_SYSTEM_NAME`.
+    # http://www.cmake.org/Wiki/CMake_Cross_Compiling
+    #
+    # Unfortunately cmake seems to expect absolute paths for ar, ranlib, and
+    # strip. Otherwise they are taken to be relative to the source root of the
+    # package being built.
+    "-DCMAKE_CXX_COMPILER=${stdenv.cc.targetPrefix}c++"
+    "-DCMAKE_C_COMPILER=${stdenv.cc.targetPrefix}cc"
+    "-DCMAKE_AR=${lib.getBin stdenv.cc.bintools.bintools}/bin/${stdenv.cc.targetPrefix}ar"
+    "-DCMAKE_RANLIB=${lib.getBin stdenv.cc.bintools.bintools}/bin/${stdenv.cc.targetPrefix}ranlib"
+    "-DCMAKE_STRIP=${lib.getBin stdenv.cc.bintools.bintools}/bin/${stdenv.cc.targetPrefix}strip"
+
+    "-DCMAKE_USE_OPENSSL=${if useOpenSSL then "ON" else "OFF"}"
+    # Avoid depending on frameworks.
+    "-DBUILD_CursesDialog=${if cursesUI then "ON" else "OFF"}"
+  ];
+
+  # make install attempts to use the just-built cmake
+  preInstall = lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
+    sed -i 's|bin/cmake|${buildPackages.cmakeMinimal}/bin/cmake|g' Makefile
+  '';
+
+  dontUseCmakeConfigure = true;
+  enableParallelBuilding = true;
+
+  # This isn't an autoconf configure script; triples are passed via
+  # CMAKE_SYSTEM_NAME, etc.
+  configurePlatforms = [ ];
+
+  doCheck = false; # fails
+
+  meta = with lib; {
+    homepage = "https://cmake.org/";
+    description = "Cross-platform, open-source build system generator";
+    longDescription = ''
+      CMake is an open-source, cross-platform family of tools designed to build,
+      test and package software. CMake is used to control the software
+      compilation process using simple platform and compiler independent
+      configuration files, and generate native makefiles and workspaces that can
+      be used in the compiler environment of your choice.
+    '';
+    changelog = "https://cmake.org/cmake/help/v${lib.versions.majorMinor version}/release/${lib.versions.majorMinor version}.html";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ ttuegel lnl7 AndersonTorres ];
+    platforms = platforms.all;
+    broken = (qt5UI && stdenv.isDarwin);
+  };
+}
diff --git a/pkgs/development/tools/build-managers/cmake/default.nix b/pkgs/development/tools/build-managers/cmake/default.nix
index 7752db352fd3..0bdc6514cf7e 100644
--- a/pkgs/development/tools/build-managers/cmake/default.nix
+++ b/pkgs/development/tools/build-managers/cmake/default.nix
@@ -37,11 +37,11 @@ stdenv.mkDerivation rec {
     + lib.optionalString isBootstrap "-boot"
     + lib.optionalString cursesUI "-cursesUI"
     + lib.optionalString qt5UI "-qt5UI";
-  version = "3.23.2";
+  version = "3.24.0";
 
   src = fetchurl {
     url = "https://cmake.org/files/v${lib.versions.majorMinor version}/cmake-${version}.tar.gz";
-    sha256 = "sha256-8xa0AFNGb5pBat+YHv2kGxYMqFnpf2pIS0R+opn/Jqo=";
+    sha256 = "sha256-wrYffN7LFXbK0l+Rio9CuGhdiKgy/UtiueD6MukVplg=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/build-managers/cmake/setup-hook.sh b/pkgs/development/tools/build-managers/cmake/setup-hook.sh
index 50f23f1bb7b1..1d25887754ad 100755
--- a/pkgs/development/tools/build-managers/cmake/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/cmake/setup-hook.sh
@@ -15,6 +15,9 @@ fixCmakeFiles() {
 cmakeConfigurePhase() {
     runHook preConfigure
 
+    # default to CMake defaults if unset
+    : ${cmakeBuildDir:=build}
+
     export CTEST_OUTPUT_ON_FAILURE=1
     if [ -n "${enableParallelChecking-1}" ]; then
         export CTEST_PARALLEL_LEVEL=$NIX_BUILD_CORES
@@ -25,9 +28,11 @@ cmakeConfigurePhase() {
     fi
 
     if [ -z "${dontUseCmakeBuildDir-}" ]; then
-        mkdir -p build
-        cd build
-        cmakeDir=${cmakeDir:-..}
+        mkdir -p "$cmakeBuildDir"
+        cd "$cmakeBuildDir"
+        : ${cmakeDir:=..}
+    else
+        : ${cmakeDir:=.}
     fi
 
     if [ -z "${dontAddPrefix-}" ]; then
@@ -118,7 +123,7 @@ cmakeConfigurePhase() {
 
     echo "cmake flags: $cmakeFlags ${cmakeFlagsArray[@]}"
 
-    cmake ${cmakeDir:-.} $cmakeFlags "${cmakeFlagsArray[@]}"
+    cmake "$cmakeDir" $cmakeFlags "${cmakeFlagsArray[@]}"
 
     if ! [[ -v enableParallelBuilding ]]; then
         enableParallelBuilding=1
diff --git a/pkgs/development/tools/build-managers/meson/default.nix b/pkgs/development/tools/build-managers/meson/default.nix
index f62bb22314de..5a9164d426a9 100644
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@@ -29,6 +29,14 @@ python3.pkgs.buildPythonApplication rec {
     # https://github.com/mesonbuild/meson/pull/6827
     ./more-env-vars.patch
 
+    # Use more binutils variables, so we don't have to define them in stdenv.
+    # pr has been merged
+    # https://github.com/mesonbuild/meson/pull/10640
+    (fetchpatch {
+      url = "https://github.com/mesonbuild/meson/commit/8a8ab9a8e0c2cefb6faa0734e52803c74790576c.patch";
+      sha256 = "sha256-BdBf1NB4SZLFyFRDzD0p//XUgUeAHpo6XXUtsHdCgKE=";
+    })
+
     # Unlike libtool, vanilla Meson does not pass any information
     # about the path library will be installed to to g-ir-scanner,
     # breaking the GIR when path other than ${!outputLib}/lib is used.
diff --git a/pkgs/development/tools/misc/patchelf/default.nix b/pkgs/development/tools/misc/patchelf/default.nix
index 855ae40fc5fb..7ce8b93e613e 100644
--- a/pkgs/development/tools/misc/patchelf/default.nix
+++ b/pkgs/development/tools/misc/patchelf/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "patchelf";
-  version = "0.14.5";
+  version = "0.15.0";
 
   src = fetchurl {
     url = "https://github.com/NixOS/${pname}/releases/download/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-uaRvKYkyLrifpPYjfiCDbFe0VapDoyVF6gk7Qx2YL1w=";
+    sha256 = "sha256-9ANtPuTY4ijewb7/8PbkbYpA6eVw4AaOOdd+YuLIvcI=";
   };
 
   strictDeps = true;
diff --git a/pkgs/os-specific/linux/bluez/default.nix b/pkgs/os-specific/linux/bluez/default.nix
index 3805f99e0a55..d09ef77fb0d8 100644
--- a/pkgs/os-specific/linux/bluez/default.nix
+++ b/pkgs/os-specific/linux/bluez/default.nix
@@ -12,7 +12,7 @@
 , pkg-config
 , python3
 , readline
-, systemd
+, systemdMinimal
 , udev
 , withExperimental ? false
 }: let
@@ -48,7 +48,7 @@ in stdenv.mkDerivation rec {
     python3.pkgs.wrapPython
   ];
 
-  outputs = [ "out" "dev" ] ++ lib.optional doCheck "test";
+  outputs = [ "out" "dev" "test" ];
 
   patches = [
     # https://github.com/bluez/bluez/commit/0905a06410d4a5189f0be81e25eb3c3e8a2199c5
@@ -63,7 +63,7 @@ in stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace tools/hid2hci.rules \
-      --replace /sbin/udevadm ${systemd}/bin/udevadm \
+      --replace /sbin/udevadm ${systemdMinimal}/bin/udevadm \
       --replace "hid2hci " "$out/lib/udev/hid2hci "
     # Disable some tests:
     # - test-mesh-crypto depends on the following kernel settings:
@@ -107,7 +107,7 @@ in stdenv.mkDerivation rec {
 
   doCheck = stdenv.hostPlatform.isx86_64;
 
-  postInstall = lib.optionalString doCheck ''
+  postInstall = ''
     mkdir -p $test/{bin,test}
     cp -a test $test
     pushd $test/test
diff --git a/pkgs/os-specific/linux/ell/default.nix b/pkgs/os-specific/linux/ell/default.nix
index da2488bd75da..67d8f107ce38 100644
--- a/pkgs/os-specific/linux/ell/default.nix
+++ b/pkgs/os-specific/linux/ell/default.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation rec {
   pname = "ell";
-  version = "0.51";
+  version = "0.52";
 
   outputs = [ "out" "dev" ];
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/libs/ell/ell.git";
     rev = version;
-    sha256 = "sha256-UGc6msj+V3U7IzquD4+KDLWt1vUxdV2Qm9Y0FOmsqtc=";
+    sha256 = "sha256-JnkNWWdr0CSlwME619BBWkvelFZoZpzmAR53nm2bSqM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/iwd/default.nix b/pkgs/os-specific/linux/iwd/default.nix
index f83d96d787cf..dfd5f5724ef8 100644
--- a/pkgs/os-specific/linux/iwd/default.nix
+++ b/pkgs/os-specific/linux/iwd/default.nix
@@ -12,12 +12,12 @@
 
 stdenv.mkDerivation rec {
   pname = "iwd";
-  version = "1.28";
+  version = "1.29";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/network/wireless/iwd.git";
     rev = version;
-    sha256 = "sha256-UAhgmXTbCgxja8nniexr6+jkzHIOMn9k1Cp8oMuskk0=";
+    sha256 = "sha256-W2MOK6aIa1whkj13OeuibNjL/2LWt7TO8h4JeoUrZnQ=";
   };
 
   outputs = [ "out" "man" "doc" ]
diff --git a/pkgs/os-specific/linux/kernel-headers/default.nix b/pkgs/os-specific/linux/kernel-headers/default.nix
index 5b2fb62cb95e..daa8c1ae2019 100644
--- a/pkgs/os-specific/linux/kernel-headers/default.nix
+++ b/pkgs/os-specific/linux/kernel-headers/default.nix
@@ -84,18 +84,15 @@ let
 in {
   inherit makeLinuxHeaders;
 
-  linuxHeaders = let version = "5.18"; in
+  linuxHeaders = let version = "5.19"; in
     makeLinuxHeaders {
       inherit version;
       src = fetchurl {
         url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-        sha256 = "1vjwhl4s8qxfg1aabn8xnpjza3qzrjcp5450h9qpjvl999lg3wsi";
+        sha256 = "1a05a3hw4w3k530mxhns96xw7hag743xw5w967yazqcykdbhq97z";
       };
       patches = [
          ./no-relocs.patch # for building x86 kernel headers on non-ELF platforms
-
-         # 5.19 backport. Can be removed on update.
-         ./restore-__bitwise__.patch
       ];
     };
 }
diff --git a/pkgs/os-specific/linux/kernel-headers/restore-__bitwise__.patch b/pkgs/os-specific/linux/kernel-headers/restore-__bitwise__.patch
deleted file mode 100644
index 67d2af8fc3bb..000000000000
--- a/pkgs/os-specific/linux/kernel-headers/restore-__bitwise__.patch
+++ /dev/null
@@ -1,15 +0,0 @@
-https://github.com/torvalds/linux/commit/caa28984163cb63ea0be4cb8dbf05defdc7303f9
-
-Fixes openiscsi build.
---- a/include/uapi/linux/types.h
-+++ b/include/uapi/linux/types.h
-@@ -26,6 +26,9 @@
- #define __bitwise
- #endif
- 
-+/* The kernel doesn't use this legacy form, but user space does */
-+#define __bitwise__ __bitwise
-+
- typedef __u16 __bitwise __le16;
- typedef __u16 __bitwise __be16;
- typedef __u32 __bitwise __le32;
diff --git a/pkgs/os-specific/linux/libcap/default.nix b/pkgs/os-specific/linux/libcap/default.nix
index 1fa887dd2a3c..0577107fd026 100644
--- a/pkgs/os-specific/linux/libcap/default.nix
+++ b/pkgs/os-specific/linux/libcap/default.nix
@@ -7,11 +7,11 @@ assert usePam -> pam != null;
 
 stdenv.mkDerivation rec {
   pname = "libcap";
-  version = "2.63";
+  version = "2.65";
 
   src = fetchurl {
     url = "mirror://kernel/linux/libs/security/linux-privs/libcap2/${pname}-${version}.tar.xz";
-    sha256 = "sha256-DGN7j0T8fYYneH6c9X8VrAbB3cy1PkH+7FSWvjRm938=";
+    sha256 = "sha256-c+NQAgzDH+FTYIedGThP+jOVqCXwZfz2vaOlzfllvr0=";
   };
 
   outputs = [ "out" "dev" "lib" "man" "doc" ]
diff --git a/pkgs/os-specific/linux/libnl/default.nix b/pkgs/os-specific/linux/libnl/default.nix
index d6604f9e15b9..08a55134e773 100644
--- a/pkgs/os-specific/linux/libnl/default.nix
+++ b/pkgs/os-specific/linux/libnl/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libnl";
-  version = "3.5.0";
+  version = "3.7.0";
 
   src = fetchFromGitHub {
     repo = "libnl";
     owner = "thom311";
     rev = "libnl${lib.replaceStrings ["."] ["_"] version}";
-    sha256 = "1ak30jcx52gl5yz1691qq0b76ldbcp2z6vsvdr2mrrwqiplqbcs2";
+    sha256 = "sha256-Ty9NdWKWB29MTRfG5OJlSE0mSTN3Wy+sR4KtuExXcB4=";
   };
 
   outputs = [ "bin" "dev" "out" "man" ] ++ lib.optional pythonSupport "py";
diff --git a/pkgs/os-specific/windows/mingw-w64/default.nix b/pkgs/os-specific/windows/mingw-w64/default.nix
index 38293e65f70f..569b149868ff 100644
--- a/pkgs/os-specific/windows/mingw-w64/default.nix
+++ b/pkgs/os-specific/windows/mingw-w64/default.nix
@@ -21,7 +21,6 @@ in stdenv.mkDerivation {
   enableParallelBuilding = true;
 
   buildInputs = [ windows.mingw_w64_headers ];
-  dontStrip = true;
   hardeningDisable = [ "stackprotector" "fortify" ];
 
   meta = {
diff --git a/pkgs/servers/gpm/default.nix b/pkgs/servers/gpm/default.nix
index 66c6607e6472..76358404e970 100644
--- a/pkgs/servers/gpm/default.nix
+++ b/pkgs/servers/gpm/default.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--sysconfdir=/etc"
     "--localstatedir=/var"
-    (if ncurses == null then "--without-curses" else "--with-curses")
+    (if withNcurses then "--with-curses" else "--without-curses")
   ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/servers/http/unit/default.nix b/pkgs/servers/http/unit/default.nix
index 3483623db2e3..c1174383c95f 100644
--- a/pkgs/servers/http/unit/default.nix
+++ b/pkgs/servers/http/unit/default.nix
@@ -3,8 +3,8 @@
 , withPython3 ? true, python3, ncurses
 , withPHP80 ? false, php80
 , withPHP81 ? true, php81
-, withPerl532 ? false, perl532
-, withPerl534 ? true, perl534
+, withPerl534 ? false, perl534
+, withPerl536 ? true, perl536
 , withPerldevel ? false, perldevel
 , withRuby_2_7 ? true, ruby_2_7
 , withRuby_3_0 ? false, ruby_3_0
@@ -46,8 +46,8 @@ in stdenv.mkDerivation rec {
     ++ optionals withPython3 [ python3 ncurses ]
     ++ optional withPHP80 php80-unit
     ++ optional withPHP81 php81-unit
-    ++ optional withPerl532 perl532
     ++ optional withPerl534 perl534
+    ++ optional withPerl536 perl536
     ++ optional withPerldevel perldevel
     ++ optional withRuby_2_7 ruby_2_7
     ++ optional withRuby_3_0 ruby_3_0
@@ -71,8 +71,8 @@ in stdenv.mkDerivation rec {
     ${optionalString withPython3    "./configure python --module=python3  --config=python3-config  --lib-path=${python3}/lib"}
     ${optionalString withPHP80      "./configure php    --module=php80    --config=${php80-unit.unwrapped.dev}/bin/php-config --lib-path=${php80-unit}/lib"}
     ${optionalString withPHP81      "./configure php    --module=php81    --config=${php81-unit.unwrapped.dev}/bin/php-config --lib-path=${php81-unit}/lib"}
-    ${optionalString withPerl532    "./configure perl   --module=perl532  --perl=${perl532}/bin/perl"}
     ${optionalString withPerl534    "./configure perl   --module=perl534  --perl=${perl534}/bin/perl"}
+    ${optionalString withPerl536    "./configure perl   --module=perl536  --perl=${perl536}/bin/perl"}
     ${optionalString withPerldevel  "./configure perl   --module=perldev  --perl=${perldevel}/bin/perl"}
     ${optionalString withRuby_2_7   "./configure ruby   --module=ruby27   --ruby=${ruby_2_7}/bin/ruby"}
     ${optionalString withRuby_3_0   "./configure ruby   --module=ruby30   --ruby=${ruby_3_0}/bin/ruby"}
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 73030e7d941e..78cbad190a6e 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -384,7 +384,7 @@ else let
 
           crossFile = builtins.toFile "cross-file.conf" ''
             [properties]
-            needs_exe_wrapper = true
+            needs_exe_wrapper = ${lib.boolToString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform)}
 
             [host_machine]
             system = '${stdenv.targetPlatform.parsed.kernel.name}'
diff --git a/pkgs/tools/networking/unbound/default.nix b/pkgs/tools/networking/unbound/default.nix
index 16530909c002..189cc14ff1ba 100644
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@@ -48,11 +48,11 @@
 
 stdenv.mkDerivation rec {
   pname = "unbound";
-  version = "1.16.0";
+  version = "1.16.2";
 
   src = fetchurl {
     url = "https://nlnetlabs.nl/downloads/unbound/unbound-${version}.tar.gz";
-    hash = "sha256-ZwFTTJOOsBliZgEZHtxtAS/FNMCdJBjVuSgn2wy+SKU=";
+    hash = "sha256-LjLyg4IMJMUcod2K/s/bdHxzhaE3q+hlyZ20sldANYE=";
   };
 
   outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB
@@ -156,7 +156,7 @@ stdenv.mkDerivation rec {
     description = "Validating, recursive, and caching DNS resolver";
     license = licenses.bsd3;
     homepage = "https://www.unbound.net";
-    maintainers = with maintainers; [ fpletz globin ];
+    maintainers = with maintainers; [ ajs124 ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/tools/security/gnupg/23.nix b/pkgs/tools/security/gnupg/23.nix
index 13364f5498a8..b93e533e6fd8 100644
--- a/pkgs/tools/security/gnupg/23.nix
+++ b/pkgs/tools/security/gnupg/23.nix
@@ -1,33 +1,28 @@
 { fetchurl, fetchpatch, lib, stdenv, pkg-config, libgcrypt, libassuan, libksba
 , libgpg-error, libiconv, npth, gettext, texinfo, buildPackages
-
-# Each of the dependencies below are optional.
-# Gnupg can be built without them at the cost of reduced functionality.
 , guiSupport ? stdenv.isDarwin, enableMinimal ? false
-, adns ? null, bzip2 ? null , gnutls ? null , libusb1 ? null , openldap ? null
-, tpm2-tss ? null
-, pcsclite ? null , pinentry ? null , readline ? null , sqlite ? null , zlib ? null
+, adns, bzip2, gnutls, libusb1, openldap
+, tpm2-tss, pcsclite, pinentry, readline, sqlite, zlib
 }:
 
-with lib;
-
-assert guiSupport -> pinentry != null && enableMinimal == false;
+assert guiSupport -> enableMinimal == false;
 
 stdenv.mkDerivation rec {
   pname = "gnupg";
-  version = "2.3.6";
+  version = "2.3.7";
 
   src = fetchurl {
     url = "mirror://gnupg/gnupg/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-Iff+L8XC8hQYSrBQl37HqOME5Yv64qsJj+xp+Pq9qcE=";
+    sha256 = "sha256-7hY6X7nsmf/BsY5l+u+NCGgAxXE9FaZyq1fTeZ2oNmk=";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ pkg-config texinfo ];
   buildInputs = [
     libgcrypt libassuan libksba libiconv npth gettext
+  ] ++ lib.optionals (!enableMinimal) ([
     readline libusb1 gnutls adns openldap zlib bzip2 sqlite
-  ] ++ optional (!stdenv.isDarwin) tpm2-tss ;
+  ] ++ lib.optional (!stdenv.isDarwin) tpm2-tss);
 
   patches = [
     ./fix-libusb-include-path.patch
@@ -35,15 +30,12 @@ stdenv.mkDerivation rec {
     ./allow-import-of-previously-known-keys-even-without-UI.patch
     ./accept-subkeys-with-a-good-revocation-but-no-self-sig.patch
 
-    # Patch from upstream 34c649b36013, https://dev.gnupg.org/T6027
-    ./CVE-2022-34903-g10-fix-garbled-status-messages-in-NOTATION_DATA.patch
-
     # Patch for DoS vuln from https://seclists.org/oss-sec/2022/q3/27
     ./v3-0001-Disallow-compressed-signatures-and-certificates.patch
   ];
   postPatch = ''
     sed -i 's,\(hkps\|https\)://keyserver.ubuntu.com,hkps://keys.openpgp.org,g' configure configure.ac doc/dirmngr.texi doc/gnupg.info-1
-  '' + lib.optionalString (stdenv.isLinux && pcsclite != null) ''
+  '' + lib.optionalString (stdenv.isLinux && (!enableMinimal)) ''
     sed -i 's,"libpcsclite\.so[^"]*","${lib.getLib pcsclite}/lib/libpcsclite.so",g' scd/scdaemon.c
   '';
 
@@ -54,8 +46,8 @@ stdenv.mkDerivation rec {
     "--with-libassuan-prefix=${libassuan.dev}"
     "--with-ksba-prefix=${libksba.dev}"
     "--with-npth-prefix=${npth}"
-  ] ++ optional guiSupport "--with-pinentry-pgm=${pinentry}/${pinentryBinaryPath}"
-  ++ optional ( (!stdenv.isDarwin) && (tpm2-tss != null) ) "--with-tss=intel";
+  ] ++ lib.optional guiSupport "--with-pinentry-pgm=${pinentry}/${pinentryBinaryPath}"
+  ++ lib.optional ((!stdenv.isDarwin) && (!enableMinimal)) "--with-tss=intel";
   postInstall = if enableMinimal
   then ''
     rm -r $out/{libexec,sbin,share}
diff --git a/pkgs/tools/security/gnupg/CVE-2022-34903-g10-fix-garbled-status-messages-in-NOTATION_DATA.patch b/pkgs/tools/security/gnupg/CVE-2022-34903-g10-fix-garbled-status-messages-in-NOTATION_DATA.patch
deleted file mode 100644
index 4383475a1c83..000000000000
--- a/pkgs/tools/security/gnupg/CVE-2022-34903-g10-fix-garbled-status-messages-in-NOTATION_DATA.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-commit 34c649b3601383cd11dbc76221747ec16fd68e1b
-Author: Werner Koch <wk@gnupg.org>
-Date:   2022-06-14 11:33:27 +0200
-
-    g10: Fix garbled status messages in NOTATION_DATA
-    
-    * g10/cpr.c (write_status_text_and_buffer): Fix off-by-one
-    --
-    
-    Depending on the escaping and line wrapping the computed remaining
-    buffer length could be wrong.  Fixed by always using a break to
-    terminate the escape detection loop.  Might have happened for all
-    status lines which may wrap.
-    
-    GnuPG-bug-id: T6027
-
-diff --git a/g10/cpr.c b/g10/cpr.c
-index 9bfdd3c34..fa8005d6f 100644
---- a/g10/cpr.c
-+++ b/g10/cpr.c
-@@ -372,20 +372,15 @@ write_status_text_and_buffer (int no, const char *string,
-             }
-           first = 0;
-         }
--      for (esc=0, s=buffer, n=len; n && !esc; s++, n--)
-+      for (esc=0, s=buffer, n=len; n; s++, n--)
-         {
-           if (*s == '%' || *(const byte*)s <= lower_limit
-               || *(const byte*)s == 127 )
-             esc = 1;
-           if (wrap && ++count > wrap)
--            {
--              dowrap=1;
--              break;
--            }
--        }
--      if (esc)
--        {
--          s--; n++;
-+            dowrap=1;
-+          if (esc || dowrap)
-+            break;
-         }
-       if (s != buffer)
-         es_fwrite (buffer, s-buffer, 1, statusfp);
diff --git a/pkgs/tools/security/pcsclite/default.nix b/pkgs/tools/security/pcsclite/default.nix
index bcc7163bec2f..e5f26bca5612 100644
--- a/pkgs/tools/security/pcsclite/default.nix
+++ b/pkgs/tools/security/pcsclite/default.nix
@@ -8,7 +8,7 @@
 , python3
 , dbus
 , polkit
-, systemd
+, systemdMinimal
 , IOKit
 }:
 
@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook autoconf-archive pkg-config perl ];
 
   buildInputs = [ python3 ]
-    ++ lib.optionals stdenv.isLinux [ dbus polkit systemd ]
+    ++ lib.optionals stdenv.isLinux [ dbus polkit systemdMinimal ]
     ++ lib.optionals stdenv.isDarwin [ IOKit ];
 
   meta = with lib; {
diff --git a/pkgs/tools/text/groff/default.nix b/pkgs/tools/text/groff/default.nix
index 100c2b439075..a38251557c09 100644
--- a/pkgs/tools/text/groff/default.nix
+++ b/pkgs/tools/text/groff/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, fetchpatch, perl
-, ghostscript #for postscript and html output
-, psutils, netpbm #for html output
+, enableGhostscript ? false, ghostscript # for postscript and html output
+, enableHtml ? false, psutils, netpbm # for html output
 , buildPackages
 , autoreconfHook
 , pkg-config
@@ -38,11 +38,9 @@ stdenv.mkDerivation rec {
     # BASH_PROG gets replaced with a path to the build bash which doesn't get automatically patched by patchShebangs
     substituteInPlace contrib/gdiffmk/gdiffmk.sh \
       --replace "@BASH_PROG@" "/bin/sh"
-  '' + lib.optionalString (psutils != null) ''
-    substituteInPlace src/preproc/html/pre-html.cpp \
-      --replace "psselect" "${psutils}/bin/psselect"
-  '' + lib.optionalString (netpbm != null) ''
+  '' + lib.optionalString enableHtml ''
     substituteInPlace src/preproc/html/pre-html.cpp \
+      --replace "psselect" "${psutils}/bin/psselect" \
       --replace "pnmcut" "${lib.getBin netpbm}/bin/pnmcut" \
       --replace "pnmcrop" "${lib.getBin netpbm}/bin/pnmcrop" \
       --replace "pnmtopng" "${lib.getBin netpbm}/bin/pnmtopng"
@@ -53,8 +51,10 @@ stdenv.mkDerivation rec {
   '';
 
   strictDeps = true;
-  buildInputs = [ ghostscript psutils netpbm perl bash ];
   nativeBuildInputs = [ autoreconfHook pkg-config texinfo ];
+  buildInputs = [ perl bash ]
+    ++ lib.optionals enableGhostscript [ ghostscript ]
+    ++ lib.optionals enableHtml [ psutils netpbm ];
 
   # Builds running without a chroot environment may detect the presence
   # of /usr/X11 in the host system, leading to an impure build of the
@@ -64,7 +64,7 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--without-x"
     "ac_cv_path_PERL=${buildPackages.perl}/bin/perl"
-  ] ++ lib.optionals (ghostscript != null) [
+  ] ++ lib.optionals enableGhostscript [
     "--with-gs=${ghostscript}/bin/gs"
   ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
     "gl_cv_func_signbit=yes"
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ebf8e345abcf..41aa7226032d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7036,11 +7036,7 @@ with pkgs;
 
   grive2 = callPackage ../tools/filesystems/grive2 { };
 
-  groff = callPackage ../tools/text/groff {
-    ghostscript = null;
-    psutils = null;
-    netpbm = null;
-  };
+  groff = callPackage ../tools/text/groff { };
 
   gromit-mpx = callPackage ../tools/graphics/gromit-mpx {
     gtk = gtk3;
@@ -15784,6 +15780,11 @@ with pkgs;
     inherit (libsForQt5) qtbase wrapQtAppsHook;
   };
 
+  cmake_3_23 = callPackage ../development/tools/build-managers/cmake/3_23.nix {
+    inherit (darwin.apple_sdk.frameworks) SystemConfiguration;
+    inherit (libsForQt5) qtbase wrapQtAppsHook;
+  };
+
   cmakeMinimal = callPackage ../development/tools/build-managers/cmake {
     isBootstrap = true;
     qtbase = null;
@@ -19835,9 +19836,7 @@ with pkgs;
 
   libtifiles2 = callPackage ../development/libraries/libtifiles2 { };
 
-  libtiff = if stdenv.isDarwin && stdenv.isAarch64
-    then callPackage ../development/libraries/libtiff/aarch64-darwin.nix { }
-    else callPackage ../development/libraries/libtiff { };
+  libtiff = callPackage ../development/libraries/libtiff { };
 
   libtiger = callPackage ../development/libraries/libtiger { };
 
@@ -22158,14 +22157,14 @@ with pkgs;
   ### DEVELOPMENT / PERL MODULES
 
   perlInterpreters = callPackages ../development/interpreters/perl {};
-  inherit (perlInterpreters) perl532 perl534 perldevel;
+  inherit (perlInterpreters) perl534 perl536 perldevel;
 
-  perl532Packages = recurseIntoAttrs perl532.pkgs;
   perl534Packages = recurseIntoAttrs perl534.pkgs;
+  perl536Packages = recurseIntoAttrs perl536.pkgs;
   perldevelPackages = perldevel.pkgs;
 
-  perl = perl534;
-  perlPackages = perl534Packages;
+  perl = perl536;
+  perlPackages = perl536Packages;
 
   ack = perlPackages.ack;
 
@@ -23798,14 +23797,14 @@ with pkgs;
   gomplate = callPackage ../development/tools/gomplate { };
 
   gpm = callPackage ../servers/gpm {
-    ncurses = null;  # Keep curses disabled for lack of value
+    withNcurses = false; # Keep curses disabled for lack of value
 
     # latest 6.8 mysteriously fails to parse '@headings single':
     #   https://lists.gnu.org/archive/html/bug-texinfo/2021-09/msg00011.html
     texinfo = buildPackages.texinfo6_7;
   };
 
-  gpm-ncurses = gpm.override { inherit ncurses; };
+  gpm-ncurses = gpm.override { withNcurses = true; };
 
   gpu-switch = callPackage ../os-specific/linux/gpu-switch { };
 
@@ -24570,16 +24569,6 @@ with pkgs;
     gnupg = callPackage ../tools/security/gnupg/23.nix {
       enableMinimal = true;
       guiSupport = false;
-      pcsclite = null;
-      sqlite = null;
-      pinentry = null;
-      adns = null;
-      gnutls = null;
-      libusb1 = null;
-      openldap = null;
-      readline = null;
-      zlib = null;
-      bzip2 = null;
     };
   };
   systemdMinimal = systemd.override {
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 272cbeb38e66..39cd70147d4b 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -1549,10 +1549,10 @@ let
 
   BKeywords = buildPerlPackage rec {
     pname = "B-Keywords";
-    version = "1.22";
+    version = "1.24";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/R/RU/RURBAN/B-Keywords-${version}.tar.gz";
-      sha256 = "0i2ksp0w9wv1qc22hrdl3k48cww64syhmv8zf6x0kgyd4081hr56";
+      url = "mirror://cpan/authors/id/R/RU/RURBAN/B-Keywords-1.24.tar.gz";
+      sha256 = "sha256-pc9rsoXQbRfO4id4O3I7snQhP9QVOl3uMR0kDhFpYG4=";
     };
     meta = {
       description = "Lists of reserved barewords and symbol names";
@@ -4178,10 +4178,10 @@ let
 
   CpanelJSONXS = buildPerlPackage {
     pname = "Cpanel-JSON-XS";
-    version = "4.25";
+    version = "4.31";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/R/RU/RURBAN/Cpanel-JSON-XS-4.25.tar.gz";
-      sha256 = "061940vyj9y3rzwq47z2a3f5i5rfpa90ccz7fgz228zr7njkvfpr";
+      url = "mirror://cpan/authors/id/R/RU/RURBAN/Cpanel-JSON-XS-4.31.tar.gz";
+      sha256 = "sha256-AqZ6zuPeJKcow5ZIaADiojVZGlQ9B5REmtOI/j1c/yk=";
     };
     meta = {
       description = "CPanel fork of JSON::XS, fast and correct serializing";
@@ -5046,10 +5046,10 @@ let
 
   CryptX = buildPerlPackage {
     pname = "CryptX";
-    version = "0.069";
+    version = "0.076";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/M/MI/MIK/CryptX-0.069.tar.gz";
-      sha256 = "b5503a35046a973174234a823dba63403b080957c4a370d60d66aa7c7587d850";
+      url = "mirror://cpan/authors/id/M/MI/MIK/CryptX-0.076.tar.gz";
+      sha256 = "sha256-u4SsASQ4x87NtRpab/+08f7jsOrgAi6WzrwuFnUiYhw=";
     };
     meta = {
       description = "Crypto toolkit";
@@ -6450,18 +6450,11 @@ let
 
   DBIxClass = buildPerlPackage {
     pname = "DBIx-Class";
-    version = "0.082842";
+    version = "0.082843";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/R/RI/RIBASUSHI/DBIx-Class-0.082842.tar.gz";
-      sha256 = "1rh7idjjbibc1zmiaaarask434lh0lx7f2xyfwmy37k9fa0xcpmh";
+      url = "mirror://cpan/authors/id/R/RI/RIBASUSHI/DBIx-Class-0.082843.tar.gz";
+      sha256 = "sha256-NB4Lbssp2MSRdKbAnXxtvzhym6QBXuf9cDYKT/7h8lE=";
     };
-    patches = [
-      # https://github.com/Perl5/DBIx-Class/pull/141
-      (fetchpatch {
-        url = "https://github.com/Perl5/DBIx-Class/commit/fb896701d23fa4da622b5b1b2afbbba3da2dd8f3.patch";
-        sha256 = "sha256-MSbV9UfHu90NCdC5IFwuy/vpSDw4atfellYh7Ydvkm4=";
-      })
-    ];
     buildInputs = [ DBDSQLite TestDeep TestException TestWarn ];
     propagatedBuildInputs = [ ClassAccessorGrouped ClassC3Componentised ConfigAny ContextPreserve DBI DataDumperConcise DataPage DevelGlobalDestruction ModuleFind PathClass SQLAbstractClassic ScopeGuard SubName namespaceclean ];
     meta = {
@@ -7740,10 +7733,10 @@ let
 
   Encode = buildPerlPackage {
     pname = "Encode";
-    version = "3.08";
+    version = "3.19";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/D/DA/DANKOGAI/Encode-3.08.tar.gz";
-      sha256 = "0nvvs5a7sz2x38isr5na31fa6ja85cpvmbn07qx0l50ss00ks1pd";
+      url = "mirror://cpan/authors/id/D/DA/DANKOGAI/Encode-3.19.tar.gz";
+      sha256 = "sha256-kWP4SO72nk1MyIODl/CGH9nqft4AERfb2WlPjZUFLvU=";
     };
     meta = {
       description = "Character encodings in Perl";
@@ -19834,10 +19827,10 @@ let
 
   ScopeUpper = buildPerlPackage {
     pname = "Scope-Upper";
-    version = "0.32";
+    version = "0.33";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/V/VP/VPIT/Scope-Upper-0.32.tar.gz";
-      sha256 = "ccaff3251c092f2af8b5ad840b76655c4bc4ccf504ff7bde233811822a40abcf";
+      url = "mirror://cpan/authors/id/V/VP/VPIT/Scope-Upper-0.33.tar.gz";
+      sha256 = "sha256-XzO+Aa1o/L7G74HusDs1EaL18HUq1RPZk6TBOl+xpkg=";
     };
     meta = {
       description = "Act on upper scopes";
@@ -19878,10 +19871,10 @@ let
 
   SerealDecoder = buildPerlPackage {
     pname = "Sereal-Decoder";
-    version = "4.018";
+    version = "4.025";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/Y/YV/YVES/Sereal-Decoder-4.018.tar.gz";
-      sha256 = "0wfdixpm3p94mnng474l0nh9mjiy8q8hbrbh2af4vwn2hmazr91f";
+      url = "mirror://cpan/authors/id/Y/YV/YVES/Sereal-Decoder-4.025.tar.gz";
+      sha256 = "sha256-jg47mprxp3i33iFQb6MHl/sbUg3NAC8/KebctSRG3qU=";
     };
     buildInputs = [ TestDeep TestDifferences TestLongString TestWarn ];
     preBuild = "ls";
@@ -19895,10 +19888,10 @@ let
 
   SerealEncoder = buildPerlPackage {
     pname = "Sereal-Encoder";
-    version = "4.018";
+    version = "4.025";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/Y/YV/YVES/Sereal-Encoder-4.018.tar.gz";
-      sha256 = "0z9dbkr8ggjqb5g1sikxhy1a359bg08gs3vfg9icqm6xx4gjsv6p";
+      url = "mirror://cpan/authors/id/Y/YV/YVES/Sereal-Encoder-4.025.tar.gz";
+      sha256 = "sha256-D9UbpggwJmUNCFJnWCYRc8GKuCNMVSb6x+25GtnGAm4=";
     };
     buildInputs = [ SerealDecoder TestDeep TestDifferences TestLongString TestWarn ];
     meta = {
@@ -19911,10 +19904,10 @@ let
 
   Sereal = buildPerlPackage {
     pname = "Sereal";
-    version = "4.018";
+    version = "4.025";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/Y/YV/YVES/Sereal-4.018.tar.gz";
-      sha256 = "0pqygrl88jp2w73jd9cw4k22fhvh5vcwqbiwl9wpxm67ql95cwwa";
+      url = "mirror://cpan/authors/id/Y/YV/YVES/Sereal-4.025.tar.gz";
+      sha256 = "sha256-C+X+VStQtnhjk+Q+qczldzpItf80o6zyopWqdgmgYrk=";
     };
     buildInputs = [ TestDeep TestLongString TestWarn ];
     propagatedBuildInputs = [ SerealDecoder SerealEncoder ];
diff --git a/pkgs/top-level/python2-packages.nix b/pkgs/top-level/python2-packages.nix
index 717c16785704..f0faf2b1cd1f 100644
--- a/pkgs/top-level/python2-packages.nix
+++ b/pkgs/top-level/python2-packages.nix
@@ -5,6 +5,7 @@
 self: super:
 
 with self; with super; {
+  attrs = callPackage ../development/python2-modules/attrs { };
 
   bootstrapped-pip = callPackage ../development/python2-modules/bootstrapped-pip { };