diff --git a/lib/attrsets.nix b/lib/attrsets.nix
index 5575e9577029..de88763854d6 100644
--- a/lib/attrsets.nix
+++ b/lib/attrsets.nix
@@ -622,6 +622,20 @@ rec {
   dontRecurseIntoAttrs =
     attrs: attrs // { recurseForDerivations = false; };
 
+  /* `unionOfDisjoint x y` is equal to `x // y // z` where the
+     attrnames in `z` are the intersection of the attrnames in `x` and
+     `y`, and all values `assert` with an error message.  This
+      operator is commutative, unlike (//). */
+  unionOfDisjoint = x: y:
+    let
+      intersection = builtins.intersectAttrs x y;
+      collisions = lib.concatStringsSep " " (builtins.attrNames intersection);
+      mask = builtins.mapAttrs (name: value: builtins.throw
+        "unionOfDisjoint: collision on ${name}; complete list: ${collisions}")
+        intersection;
+    in
+      (x // y) // mask;
+
   /*** deprecated stuff ***/
 
   zipWithNames = zipAttrsWithNames;
diff --git a/maintainers/scripts/nix-generate-from-cpan.nix b/maintainers/scripts/nix-generate-from-cpan.nix
index fecca7f0c737..9f9833d40607 100644
--- a/maintainers/scripts/nix-generate-from-cpan.nix
+++ b/maintainers/scripts/nix-generate-from-cpan.nix
@@ -3,8 +3,10 @@
 stdenv.mkDerivation {
   name = "nix-generate-from-cpan-3";
 
+  nativeBuildInputs = [ makeWrapper ];
+
   buildInputs = with perlPackages; [
-    makeWrapper perl GetoptLongDescriptive CPANPLUS Readonly LogLog4perl
+    perl GetoptLongDescriptive CPANPLUS Readonly LogLog4perl
   ];
 
   phases = [ "installPhase" ];
diff --git a/nixos/modules/config/pulseaudio.nix b/nixos/modules/config/pulseaudio.nix
index 3e969991f8fd..80ff6c1aabf7 100644
--- a/nixos/modules/config/pulseaudio.nix
+++ b/nixos/modules/config/pulseaudio.nix
@@ -102,7 +102,7 @@ in {
           each user that tries to use the sound system. The server runs
           with user privileges. If true, one system-wide PulseAudio
           server is launched on boot, running as the user "pulse", and
-          only users in the "audio" group will have access to the server.
+          only users in the "pulse-access" group will have access to the server.
           Please read the PulseAudio documentation for more details.
 
           Don't enable this option unless you know what you are doing.
@@ -310,6 +310,7 @@ in {
       };
 
       users.groups.pulse.gid = gid;
+      users.groups.pulse-access = {};
 
       systemd.services.pulseaudio = {
         description = "PulseAudio System-Wide Server";
diff --git a/nixos/modules/hardware/video/uvcvideo/uvcdynctrl-udev-rules.nix b/nixos/modules/hardware/video/uvcvideo/uvcdynctrl-udev-rules.nix
index a808429c9996..8dadbd53b989 100644
--- a/nixos/modules/hardware/video/uvcvideo/uvcdynctrl-udev-rules.nix
+++ b/nixos/modules/hardware/video/uvcvideo/uvcdynctrl-udev-rules.nix
@@ -23,8 +23,10 @@ in
 runCommand "uvcdynctrl-udev-rules-${version}"
 {
   inherit dataPath;
-  buildInputs = [
+  nativeBuildInputs = [
     makeWrapper
+  ];
+  buildInputs = [
     libwebcam
   ];
   dontPatchELF = true;
diff --git a/nixos/modules/programs/mininet.nix b/nixos/modules/programs/mininet.nix
index 0b7e82cc5bd7..02272729d233 100644
--- a/nixos/modules/programs/mininet.nix
+++ b/nixos/modules/programs/mininet.nix
@@ -14,7 +14,7 @@ let
   pyEnv = pkgs.python.withPackages(ps: [ ps.mininet-python ]);
 
   mnexecWrapped = pkgs.runCommand "mnexec-wrapper"
-    { buildInputs = [ pkgs.makeWrapper pkgs.pythonPackages.wrapPython ]; }
+    { nativeBuildInputs = [ pkgs.makeWrapper pkgs.pythonPackages.wrapPython ]; }
     ''
       makeWrapper ${pkgs.mininet}/bin/mnexec \
         $out/bin/mnexec \
diff --git a/nixos/modules/services/audio/mopidy.nix b/nixos/modules/services/audio/mopidy.nix
index 50ee9a824515..40e8679f53d7 100644
--- a/nixos/modules/services/audio/mopidy.nix
+++ b/nixos/modules/services/audio/mopidy.nix
@@ -14,7 +14,7 @@ let
     name = "mopidy-with-extensions-${mopidy.version}";
     paths = closePropagation cfg.extensionPackages;
     pathsToLink = [ "/${mopidyPackages.python.sitePackages}" ];
-    buildInputs = [ makeWrapper ];
+    nativeBuildInputs = [ makeWrapper ];
     postBuild = ''
       makeWrapper ${mopidy}/bin/mopidy $out/bin/mopidy \
         --prefix PYTHONPATH : $out/${mopidyPackages.python.sitePackages}
diff --git a/nixos/modules/services/backup/borgbackup.nix b/nixos/modules/services/backup/borgbackup.nix
index f02e15f2b988..7b29eb41e72a 100644
--- a/nixos/modules/services/backup/borgbackup.nix
+++ b/nixos/modules/services/backup/borgbackup.nix
@@ -116,7 +116,7 @@ let
       original, name, set ? {}
     }:
     pkgs.runCommand "${name}-wrapper" {
-      buildInputs = [ pkgs.makeWrapper ];
+      nativeBuildInputs = [ pkgs.makeWrapper ];
     } (with lib; ''
       makeWrapper "${original}" "$out/bin/${name}" \
         ${concatStringsSep " \\\n " (mapAttrsToList (name: value: ''--set ${name} "${value}"'') set)}
diff --git a/nixos/modules/services/continuous-integration/hydra/default.nix b/nixos/modules/services/continuous-integration/hydra/default.nix
index 8b5c1228c523..711479575042 100644
--- a/nixos/modules/services/continuous-integration/hydra/default.nix
+++ b/nixos/modules/services/continuous-integration/hydra/default.nix
@@ -42,7 +42,7 @@ let
     makeWrapperArgs = concatStringsSep " " (mapAttrsToList (key: value: "--set \"${key}\" \"${value}\"") hydraEnv);
   in pkgs.buildEnv rec {
     name = "hydra-env";
-    buildInputs = [ pkgs.makeWrapper ];
+    nativeBuildInputs = [ pkgs.makeWrapper ];
     paths = [ cfg.package ];
 
     postBuild = ''
diff --git a/nixos/modules/services/misc/etebase-server.nix b/nixos/modules/services/misc/etebase-server.nix
index 76c7c6596c85..c3723d188146 100644
--- a/nixos/modules/services/misc/etebase-server.nix
+++ b/nixos/modules/services/misc/etebase-server.nix
@@ -162,7 +162,7 @@ in
 
     environment.systemPackages = with pkgs; [
       (runCommand "etebase-server" {
-        buildInputs = [ makeWrapper ];
+        nativeBuildInputs = [ makeWrapper ];
       } ''
         makeWrapper ${pythonEnv}/bin/etebase-server \
           $out/bin/etebase-server \
diff --git a/nixos/modules/services/misc/gitlab.nix b/nixos/modules/services/misc/gitlab.nix
index 772693cb624e..4988517a9b66 100644
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@@ -205,7 +205,7 @@ let
 
   gitlab-rake = pkgs.stdenv.mkDerivation {
     name = "gitlab-rake";
-    buildInputs = [ pkgs.makeWrapper ];
+    nativeBuildInputs = [ pkgs.makeWrapper ];
     dontBuild = true;
     dontUnpack = true;
     installPhase = ''
@@ -220,7 +220,7 @@ let
 
   gitlab-rails = pkgs.stdenv.mkDerivation {
     name = "gitlab-rails";
-    buildInputs = [ pkgs.makeWrapper ];
+    nativeBuildInputs = [ pkgs.makeWrapper ];
     dontBuild = true;
     dontUnpack = true;
     installPhase = ''
diff --git a/nixos/modules/services/networking/knot.nix b/nixos/modules/services/networking/knot.nix
index de238112826c..ee7ea83456d4 100644
--- a/nixos/modules/services/networking/knot.nix
+++ b/nixos/modules/services/networking/knot.nix
@@ -18,7 +18,7 @@ let
 
   knot-cli-wrappers = pkgs.stdenv.mkDerivation {
     name = "knot-cli-wrappers";
-    buildInputs = [ pkgs.makeWrapper ];
+    nativeBuildInputs = [ pkgs.makeWrapper ];
     buildCommand = ''
       mkdir -p $out/bin
       makeWrapper ${cfg.package}/bin/knotc "$out/bin/knotc" \
diff --git a/nixos/modules/services/networking/pptpd.nix b/nixos/modules/services/networking/pptpd.nix
index 2f206e813a57..703dda99803e 100644
--- a/nixos/modules/services/networking/pptpd.nix
+++ b/nixos/modules/services/networking/pptpd.nix
@@ -82,7 +82,7 @@ with lib;
       ppp-pptpd-wrapped = pkgs.stdenv.mkDerivation {
         name         = "ppp-pptpd-wrapped";
         phases       = [ "installPhase" ];
-        buildInputs  = with pkgs; [ makeWrapper ];
+        nativeBuildInputs  = with pkgs; [ makeWrapper ];
         installPhase = ''
           mkdir -p $out/bin
           makeWrapper ${pkgs.ppp}/bin/pppd $out/bin/pppd \
diff --git a/nixos/modules/services/networking/tinc.nix b/nixos/modules/services/networking/tinc.nix
index 1f93d82f96eb..09b23a60a4af 100644
--- a/nixos/modules/services/networking/tinc.nix
+++ b/nixos/modules/services/networking/tinc.nix
@@ -410,7 +410,7 @@ in
     environment.systemPackages = let
       cli-wrappers = pkgs.stdenv.mkDerivation {
         name = "tinc-cli-wrappers";
-        buildInputs = [ pkgs.makeWrapper ];
+        nativeBuildInputs = [ pkgs.makeWrapper ];
         buildCommand = ''
           mkdir -p $out/bin
           ${concatStringsSep "\n" (mapAttrsToList (network: data:
diff --git a/nixos/modules/services/networking/xl2tpd.nix b/nixos/modules/services/networking/xl2tpd.nix
index 8f710bca322f..7d2595707612 100644
--- a/nixos/modules/services/networking/xl2tpd.nix
+++ b/nixos/modules/services/networking/xl2tpd.nix
@@ -84,7 +84,7 @@ with lib;
       xl2tpd-ppp-wrapped = pkgs.stdenv.mkDerivation {
         name         = "xl2tpd-ppp-wrapped";
         phases       = [ "installPhase" ];
-        buildInputs  = with pkgs; [ makeWrapper ];
+        nativeBuildInputs  = with pkgs; [ makeWrapper ];
         installPhase = ''
           mkdir -p $out/bin
 
diff --git a/nixos/modules/services/web-apps/mediawiki.nix b/nixos/modules/services/web-apps/mediawiki.nix
index a32db718848a..e332847f5a28 100644
--- a/nixos/modules/services/web-apps/mediawiki.nix
+++ b/nixos/modules/services/web-apps/mediawiki.nix
@@ -35,7 +35,7 @@ let
   };
 
   mediawikiScripts = pkgs.runCommand "mediawiki-scripts" {
-    buildInputs = [ pkgs.makeWrapper ];
+    nativeBuildInputs = [ pkgs.makeWrapper ];
     preferLocalBuild = true;
   } ''
     mkdir -p $out/bin
diff --git a/nixos/modules/virtualisation/azure-agent.nix b/nixos/modules/virtualisation/azure-agent.nix
index 31047c4ddc0e..abe6455a1a69 100644
--- a/nixos/modules/virtualisation/azure-agent.nix
+++ b/nixos/modules/virtualisation/azure-agent.nix
@@ -17,7 +17,7 @@ let
 
     patches = [ ./azure-agent-entropy.patch ];
 
-    buildInputs = [ makeWrapper python pythonPackages.wrapPython ];
+    nativeBuildInputs = [ makeWrapper python pythonPackages.wrapPython ];
     runtimeDeps = [ findutils gnugrep gawk coreutils openssl openssh
                     nettools # for hostname
                     procps # for pidof
diff --git a/nixos/tests/hydra/common.nix b/nixos/tests/hydra/common.nix
index fdf2b2c6f6dc..2bce03418e1f 100644
--- a/nixos/tests/hydra/common.nix
+++ b/nixos/tests/hydra/common.nix
@@ -16,7 +16,7 @@
     createTrivialProject = pkgs.stdenv.mkDerivation {
       name = "create-trivial-project";
       dontUnpack = true;
-      buildInputs = [ pkgs.makeWrapper ];
+      nativeBuildInputs = [ pkgs.makeWrapper ];
       installPhase = "install -m755 -D ${./create-trivial-project.sh} $out/bin/create-trivial-project.sh";
       postFixup = ''
         wrapProgram "$out/bin/create-trivial-project.sh" --prefix PATH ":" ${pkgs.lib.makeBinPath [ pkgs.curl ]} --set EXPR_PATH ${trivialJob}
diff --git a/nixos/tests/kubernetes/base.nix b/nixos/tests/kubernetes/base.nix
index d4410beb937e..714ac3098c0d 100644
--- a/nixos/tests/kubernetes/base.nix
+++ b/nixos/tests/kubernetes/base.nix
@@ -18,7 +18,7 @@ let
         ${master.ip}  api.${domain}
         ${concatMapStringsSep "\n" (machineName: "${machines.${machineName}.ip}  ${machineName}.${domain}") (attrNames machines)}
       '';
-      wrapKubectl = with pkgs; runCommand "wrap-kubectl" { buildInputs = [ makeWrapper ]; } ''
+      wrapKubectl = with pkgs; runCommand "wrap-kubectl" { nativeBuildInputs = [ makeWrapper ]; } ''
         mkdir -p $out/bin
         makeWrapper ${pkgs.kubernetes}/bin/kubectl $out/bin/kubectl --set KUBECONFIG "/etc/kubernetes/cluster-admin.kubeconfig"
       '';
diff --git a/nixos/tests/pulseaudio.nix b/nixos/tests/pulseaudio.nix
index cfdc61bc6c2b..dc8e33ccd559 100644
--- a/nixos/tests/pulseaudio.nix
+++ b/nixos/tests/pulseaudio.nix
@@ -1,10 +1,10 @@
 let
-  mkTest = { systemWide ? false }:
+  mkTest = { systemWide ? false , fullVersion ? false }:
     import ./make-test-python.nix ({ pkgs, lib, ... }:
       let
         testFile = pkgs.fetchurl {
           url =
-            "https://file-examples-com.github.io/uploads/2017/11/file_example_MP3_700KB.mp3";
+            "https://file-examples.com/storage/fe5947fd2362fc197a3c2df/2017/11/file_example_MP3_700KB.mp3";
           hash = "sha256-+iggJW8s0/LfA/okfXsB550/55Q0Sq3OoIzuBrzOPJQ=";
         };
 
@@ -22,7 +22,7 @@ let
           testPlay32 = { inherit (pkgs.pkgsi686Linux) sox alsa-utils; };
         };
       in {
-        name = "pulseaudio${lib.optionalString systemWide "-systemWide"}";
+        name = "pulseaudio${lib.optionalString fullVersion "Full"}${lib.optionalString systemWide "-systemWide"}";
         meta = with pkgs.lib.maintainers; {
           maintainers = [ synthetica ] ++ pkgs.pulseaudio.meta.maintainers;
         };
@@ -35,12 +35,14 @@ let
               enable = true;
               support32Bit = true;
               inherit systemWide;
+            } // lib.optionalAttrs fullVersion {
+              package = pkgs.pulseaudioFull;
             };
 
             environment.systemPackages = [ testers.testPlay pkgs.pavucontrol ]
               ++ lib.optional pkgs.stdenv.isx86_64 testers.testPlay32;
           } // lib.optionalAttrs systemWide {
-            users.users.alice.extraGroups = [ "audio" ];
+            users.users.alice.extraGroups = [ "pulse-access" ];
             systemd.services.pulseaudio.wantedBy = [ "multi-user.target" ];
           };
 
@@ -58,14 +60,21 @@ let
           ''}
           machine.screenshot("testPlay")
 
+          ${lib.optionalString (!systemWide) ''
+            machine.send_chars("pacmd info && touch /tmp/pacmd_success\n")
+            machine.wait_for_file("/tmp/pacmd_success")
+          ''}
+
           # Pavucontrol only loads when Pulseaudio is running. If it isn't, the
-          # text "Playback" (one of the tabs) will never show.
+          # text "Dummy Output" (sound device name) will never show.
           machine.send_chars("pavucontrol\n")
-          machine.wait_for_text("Playback")
+          machine.wait_for_text("Dummy Output")
           machine.screenshot("Pavucontrol")
         '';
       });
 in builtins.mapAttrs (key: val: mkTest val) {
-  user = { systemWide = false; };
-  system = { systemWide = true; };
+  user = { systemWide = false; fullVersion = false; };
+  system = { systemWide = true; fullVersion = false; };
+  userFull = { systemWide = false; fullVersion = true; };
+  systemFull = { systemWide = true; fullVersion = true; };
 }
diff --git a/pkgs/applications/audio/aumix/default.nix b/pkgs/applications/audio/aumix/default.nix
index 2603e88fcbdb..6127cb7e6929 100644
--- a/pkgs/applications/audio/aumix/default.nix
+++ b/pkgs/applications/audio/aumix/default.nix
@@ -28,8 +28,12 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  nativeBuildInputs = lib.optionals gtkGUI [ pkg-config ];
+
   buildInputs = [ gettext ncurses ]
-    ++ lib.optionals gtkGUI [ pkg-config gtk2 ];
+    ++ lib.optionals gtkGUI [ gtk2 ];
+
+  configureFlags = lib.optionals (!gtkGUI) ["--without-gtk"];
 
   meta = with lib; {
     description = "Audio mixer for X and the console";
diff --git a/pkgs/applications/audio/calf/default.nix b/pkgs/applications/audio/calf/default.nix
index bdcbf024e606..4ab651e3fb84 100644
--- a/pkgs/applications/audio/calf/default.nix
+++ b/pkgs/applications/audio/calf/default.nix
@@ -12,9 +12,10 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     cairo expat fftwSinglePrec fluidsynth glib gtk2 libjack2 ladspaH
-    libglade lv2 pkg-config
+    libglade lv2
   ];
 
   meta = with lib; {
diff --git a/pkgs/applications/audio/flac/default.nix b/pkgs/applications/audio/flac/default.nix
index 621804840bf0..c9e3b946dd19 100644
--- a/pkgs/applications/audio/flac/default.nix
+++ b/pkgs/applications/audio/flac/default.nix
@@ -2,11 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "flac";
-  version = "1.3.4";
+  version = "1.4.1";
 
   src = fetchurl {
     url = "http://downloads.xiph.org/releases/flac/${pname}-${version}.tar.xz";
-    sha256 = "0dz7am8kbc97a6afml1h4yp085274prg8j7csryds8m3fmz61w4g";
+    # Official checksum is published at https://github.com/xiph/flac/releases/tag/${version}
+    sha256 = "91303c3e5dfde52c3e94e75976c0ab3ee14ced278ab8f60033a3a12db9209ae6";
   };
 
   buildInputs = [ libogg ];
@@ -20,5 +21,6 @@ stdenv.mkDerivation rec {
     description = "Library and tools for encoding and decoding the FLAC lossless audio file format";
     platforms = platforms.all;
     license = licenses.bsd3;
+    maintainers = with maintainers; [ ruuda ];
   };
 }
diff --git a/pkgs/applications/audio/grandorgue/default.nix b/pkgs/applications/audio/grandorgue/default.nix
index 30c6e57188ab..954a2265312e 100644
--- a/pkgs/applications/audio/grandorgue/default.nix
+++ b/pkgs/applications/audio/grandorgue/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake pkg-config ];
 
-  buildInputs = [ pkg-config fftwFloat alsa-lib zlib wavpack wxGTK31 udev ]
+  buildInputs = [ fftwFloat alsa-lib zlib wavpack wxGTK31 udev ]
     ++ lib.optional jackaudioSupport libjack2;
 
   cmakeFlags = lib.optional (!jackaudioSupport) [
diff --git a/pkgs/applications/audio/ltc-tools/default.nix b/pkgs/applications/audio/ltc-tools/default.nix
index c8c87959727c..935581050744 100644
--- a/pkgs/applications/audio/ltc-tools/default.nix
+++ b/pkgs/applications/audio/ltc-tools/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0vp25b970r1hv5ndzs4di63rgwnl31jfaj3jz5dka276kx34q4al";
   };
 
-  buildInputs = [ pkg-config libltc libsndfile jack2 ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ libltc libsndfile jack2 ];
 
   makeFlags = [ "PREFIX=$(out)" ];
 
diff --git a/pkgs/applications/audio/meterbridge/default.nix b/pkgs/applications/audio/meterbridge/default.nix
index a825eaa4e38c..675189f6d131 100644
--- a/pkgs/applications/audio/meterbridge/default.nix
+++ b/pkgs/applications/audio/meterbridge/default.nix
@@ -12,8 +12,9 @@ stdenv.mkDerivation rec {
 
   patches = [ ./buf_rect.patch ./fix_build_with_gcc-5.patch];
 
+  nativeBuildInputs = [ pkg-config ];
   buildInputs =
-    [ pkg-config SDL SDL_image libjack2
+    [ SDL SDL_image libjack2
     ];
 
   meta = with lib; {
diff --git a/pkgs/applications/audio/mod-arpeggiator-lv2/default.nix b/pkgs/applications/audio/mod-arpeggiator-lv2/default.nix
index 3896545dc41c..a628e38469f5 100644
--- a/pkgs/applications/audio/mod-arpeggiator-lv2/default.nix
+++ b/pkgs/applications/audio/mod-arpeggiator-lv2/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-1KiWMTVTTf1/iR4AzJ1Oe0mOrWN5edsZN0tQMidgnRA=";
   };
 
-  buildInputs = [ lv2 pkg-config ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ lv2 ];
 
   makeFlags = [ "PREFIX=$(out)" ];
 
diff --git a/pkgs/applications/audio/opusfile/default.nix b/pkgs/applications/audio/opusfile/default.nix
index a6683904cb1d..f86595361b65 100644
--- a/pkgs/applications/audio/opusfile/default.nix
+++ b/pkgs/applications/audio/opusfile/default.nix
@@ -11,6 +11,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl libogg ];
   propagatedBuildInputs = [ libopus ];
+  outputs = [ "out" "dev" ];
   patches = [ ./include-multistream.patch ]
     # fixes problem with openssl 1.1 dependency
     # see https://github.com/xiph/opusfile/issues/13
diff --git a/pkgs/applications/audio/patchage/default.nix b/pkgs/applications/audio/patchage/default.nix
index a8a5bed0e073..99bbdf693a9c 100644
--- a/pkgs/applications/audio/patchage/default.nix
+++ b/pkgs/applications/audio/patchage/default.nix
@@ -25,6 +25,7 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     alsa-lib
     boost
@@ -33,7 +34,6 @@ stdenv.mkDerivation rec {
     glibmm
     gtkmm2
     libjack2
-    pkg-config
     python3
     wafHook
   ];
diff --git a/pkgs/applications/audio/spotify-tui/default.nix b/pkgs/applications/audio/spotify-tui/default.nix
index 2b1d114964bf..3011b712fe25 100644
--- a/pkgs/applications/audio/spotify-tui/default.nix
+++ b/pkgs/applications/audio/spotify-tui/default.nix
@@ -1,4 +1,17 @@
-{ lib, stdenv, fetchFromGitHub, fetchCrate, rustPlatform, installShellFiles, pkg-config, openssl, python3, libxcb, AppKit, Security }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchCrate
+, fetchpatch
+, rustPlatform
+, installShellFiles
+, pkg-config
+, openssl
+, python3
+, libxcb
+, AppKit
+, Security
+}:
 
 rustPlatform.buildRustPackage rec {
   pname = "spotify-tui";
@@ -8,14 +21,30 @@ rustPlatform.buildRustPackage rec {
     owner = "Rigellute";
     repo = "spotify-tui";
     rev = "v${version}";
-    sha256 = "sha256-L5gg6tjQuYoAC89XfKE38KCFONwSAwfNoFEUPH4jNAI=";
+    hash = "sha256-L5gg6tjQuYoAC89XfKE38KCFONwSAwfNoFEUPH4jNAI=";
   };
 
-  # Use patched rspotify
   cargoPatches = [
+    # Use patched rspotify
     ./Cargo.lock.patch
+
+    # Needed so that the patch below it applies.
+    (fetchpatch {
+      name = "update-dirs.patch";
+      url = "https://github.com/Rigellute/spotify-tui/commit/3881defc1ed0bcf79df1aef4836b857f64be657c.patch";
+      hash = "sha256-OGqiYLFojMwR3RgKbddXxPDiAdzPySnscVVsVmTT7t4=";
+    })
+
+    # https://github.com/Rigellute/spotify-tui/pull/990
+    (fetchpatch {
+      name = "update-socket2-for-rust-1.64.patch";
+      url = "https://github.com/Rigellute/spotify-tui/commit/14df9419cf72da13f3b55654686a95647ea9dfea.patch";
+      hash = "sha256-craY6UwmHDdxih3nZBdPkNJtQ6wvVgf09Ovqdxi0JZo=";
+    })
   ];
+
   patches = [
+    # Use patched rspotify
     ./Cargo.toml.patch
   ];
 
@@ -44,7 +73,7 @@ rustPlatform.buildRustPackage rec {
     ln -s ${rspotify} ./rspotify-${rspotify.version}
   '';
 
-  cargoSha256 = "sha256-S8zuVYcyYvrwggIvlpxNydhoN9kx6xLBwYJSHcbEK40=";
+  cargoHash = "sha256-aZJ6Q/rvqrv+wvQw2eKFPnSROhI5vXPvr5pu1hwtZKA=";
 
   nativeBuildInputs = [ installShellFiles ] ++ lib.optionals stdenv.isLinux [ pkg-config python3 ];
   buildInputs = [ ]
diff --git a/pkgs/applications/audio/transcode/default.nix b/pkgs/applications/audio/transcode/default.nix
index 112d84a08b11..da149db07537 100644
--- a/pkgs/applications/audio/transcode/default.nix
+++ b/pkgs/applications/audio/transcode/default.nix
@@ -9,8 +9,9 @@ stdenv.mkDerivation rec {
     sha256 = "1e4e72d8e0dd62a80b8dd90699f5ca64c9b0cb37a5c9325c184166a9654f0a92";
   };
 
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = [ flac lame zlib libjpeg libvorbis libtheora libxml2 lzo
-                  libdvdread pkg-config x264 libmpeg2 xvidcore ];
+                  libdvdread x264 libmpeg2 xvidcore ];
   configureFlags = [
     "--disable-ffmpeg" "--disable-libavcodec" "--disable-libavformat"
     "--enable-lzo" "--enable-ogg" "--enable-vorbis" "--enable-theora" "--enable-libxml2"
diff --git a/pkgs/applications/audio/xsynth-dssi/default.nix b/pkgs/applications/audio/xsynth-dssi/default.nix
index 61d49d110a9e..87305027e4c4 100644
--- a/pkgs/applications/audio/xsynth-dssi/default.nix
+++ b/pkgs/applications/audio/xsynth-dssi/default.nix
@@ -10,9 +10,9 @@ stdenv.mkDerivation  rec {
     sha256 = "00nwv2pqjbmxqdc6xdm0cljq6z05lv4y6bibmhz1kih9lm0lklnk";
   };
 
-  nativeBuildInputs = [ autoconf automake  ];
+  nativeBuildInputs = [ autoconf automake pkg-config ];
   buildInputs = [ alsa-lib dssi gtk2 libjack2 ladspaH
-    ladspaPlugins liblo pkg-config ];
+    ladspaPlugins liblo ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/applications/blockchains/zcash/default.nix b/pkgs/applications/blockchains/zcash/default.nix
index 20520037a60c..c4d007f29077 100644
--- a/pkgs/applications/blockchains/zcash/default.nix
+++ b/pkgs/applications/blockchains/zcash/default.nix
@@ -40,7 +40,7 @@ rustPlatform.buildRustPackage.override { inherit stdenv; } rec {
   postPatch = ''
     # Have to do this here instead of in preConfigure because
     # cargoDepsCopy gets unset after postPatch.
-    configureFlagsArray+=("RUST_VENDORED_SOURCES=$NIX_BUILD_TOP/$cargoDepsCopy")
+    configureFlagsArray+=("RUST_VENDORED_SOURCES=$cargoDepsCopy")
   '';
 
   CXXFLAGS = [
diff --git a/pkgs/applications/editors/leafpad/default.nix b/pkgs/applications/editors/leafpad/default.nix
index 2f53df97d325..0376e3af6bfb 100644
--- a/pkgs/applications/editors/leafpad/default.nix
+++ b/pkgs/applications/editors/leafpad/default.nix
@@ -8,8 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0b0az2wvqgvam7w0ns1j8xp2llslm1rx6h7zcsy06a7j0yp257cm";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ intltool gtk2 ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ gtk2 ];
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/applications/editors/vscode/extensions/vscode-lldb/default.nix b/pkgs/applications/editors/vscode/extensions/vscode-lldb/default.nix
index d5961f0c9eba..9eba40330b96 100644
--- a/pkgs/applications/editors/vscode/extensions/vscode-lldb/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/vscode-lldb/default.nix
@@ -45,7 +45,8 @@ let
     inherit (stdenv.hostPlatform) system;
   }).nodeDependencies.override (old: {
     inherit src version;
-    buildInputs = [pkg-config libsecret];
+    nativeBuildInputs = [ pkg-config ];
+    buildInputs = [libsecret];
     dontNpmInstall = true;
   }));
 
diff --git a/pkgs/applications/emulators/np2kai/default.nix b/pkgs/applications/emulators/np2kai/default.nix
index dd5e53967c01..cf55085b78a1 100644
--- a/pkgs/applications/emulators/np2kai/default.nix
+++ b/pkgs/applications/emulators/np2kai/default.nix
@@ -124,7 +124,7 @@ stdenv.mkDerivation rec {
 
   configurePhase = ''
     export GIT_VERSION=${builtins.substring 0 7 src.rev}
-    buildFlags="$buildFlags ''${enableParallelBuilding:+-j$NIX_BUILD_CORES -l$NIX_BUILD_CORES}"
+    buildFlags="$buildFlags ''${enableParallelBuilding:+-j$NIX_BUILD_CORES"
   '' + optionalString enableX11 ''
     cd x11
     substituteInPlace Makefile.am \
diff --git a/pkgs/applications/file-managers/spacefm/default.nix b/pkgs/applications/file-managers/spacefm/default.nix
index 433109cd86af..334228f98ead 100644
--- a/pkgs/applications/file-managers/spacefm/default.nix
+++ b/pkgs/applications/file-managers/spacefm/default.nix
@@ -45,9 +45,9 @@ stdenv.mkDerivation rec {
     gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "${shared-mime-info}/share")
   '';
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config intltool ];
   buildInputs = [
-    gtk3 udev desktop-file-utils shared-mime-info intltool
+    gtk3 udev desktop-file-utils shared-mime-info
     wrapGAppsHook ffmpegthumbnailer jmtpfs lsof udisks2
   ] ++ (if ifuseSupport then [ ifuse ] else []);
   # Introduced because ifuse doesn't build due to CVEs in libplist
diff --git a/pkgs/applications/file-managers/xfe/default.nix b/pkgs/applications/file-managers/xfe/default.nix
index d59b936608c8..c861c695598e 100644
--- a/pkgs/applications/file-managers/xfe/default.nix
+++ b/pkgs/applications/file-managers/xfe/default.nix
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1v1v0vcbnm30kpyd3rj8f56yh7lfnwy7nbs9785wi229b29fiqx1";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ fox gettext xlibsWrapper gcc intltool file libpng ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ fox gettext xlibsWrapper gcc file libpng ];
 
   preConfigure = ''
     sed -i s,/usr/share/xfe,$out/share/xfe, src/xfedefs.h
diff --git a/pkgs/applications/gis/spatialite-gui/default.nix b/pkgs/applications/gis/spatialite-gui/default.nix
index 541d0da8d734..3fc5b08beb17 100644
--- a/pkgs/applications/gis/spatialite-gui/default.nix
+++ b/pkgs/applications/gis/spatialite-gui/default.nix
@@ -21,6 +21,7 @@
 , virtualpg
 , wxGTK
 , wxmac
+, xz
 , zstd
 , Carbon
 , Cocoa
@@ -56,6 +57,7 @@ stdenv.mkDerivation rec {
     proj
     sqlite
     virtualpg
+    xz
     zstd
   ] ++ lib.optional stdenv.isLinux wxGTK
     ++ lib.optionals stdenv.isDarwin [ Carbon Cocoa IOKit wxmac ];
diff --git a/pkgs/applications/graphics/gpicview/default.nix b/pkgs/applications/graphics/gpicview/default.nix
index ae1e64297bd5..06c3b03ae533 100644
--- a/pkgs/applications/graphics/gpicview/default.nix
+++ b/pkgs/applications/graphics/gpicview/default.nix
@@ -16,9 +16,9 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config intltool ];
 
-  buildInputs = [ intltool gtk2 ];
+  buildInputs = [ gtk2 ];
 
   meta = with lib; {
     description = "A simple and fast image viewer for X";
diff --git a/pkgs/applications/graphics/synfigstudio/default.nix b/pkgs/applications/graphics/synfigstudio/default.nix
index a77a0313223b..c87a71fdf6c7 100644
--- a/pkgs/applications/graphics/synfigstudio/default.nix
+++ b/pkgs/applications/graphics/synfigstudio/default.nix
@@ -114,7 +114,6 @@ stdenv.mkDerivation {
     gtk3
     gtkmm3
     imagemagick
-    intltool
     libjack2
     libsigcxx
     libxmlxx
diff --git a/pkgs/applications/graphics/xaos/default.nix b/pkgs/applications/graphics/xaos/default.nix
index 15c2d468fb4f..2ba96fda3f0b 100644
--- a/pkgs/applications/graphics/xaos/default.nix
+++ b/pkgs/applications/graphics/xaos/default.nix
@@ -12,9 +12,10 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
+  nativeBuildInputs = [ intltool ];
   buildInputs = [
     aalib gsl libpng libX11 xorgproto libXext
-    libXt zlib gettext intltool perl
+    libXt zlib gettext perl
   ];
 
   preConfigure = ''
diff --git a/pkgs/applications/misc/gv/default.nix b/pkgs/applications/misc/gv/default.nix
index 851f2d80c976..d5aa1ac88179 100644
--- a/pkgs/applications/misc/gv/default.nix
+++ b/pkgs/applications/misc/gv/default.nix
@@ -13,11 +13,11 @@ stdenv.mkDerivation rec {
     "--enable-SIGCHLD-fallback"
   ];
 
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     Xaw3d
     ghostscriptX
     perl
-    pkg-config
   ] ++ lib.optionals stdenv.isDarwin [
     libiconv
   ];
diff --git a/pkgs/applications/misc/gxmessage/default.nix b/pkgs/applications/misc/gxmessage/default.nix
index f7c5714f1262..fb172eb22b01 100644
--- a/pkgs/applications/misc/gxmessage/default.nix
+++ b/pkgs/applications/misc/gxmessage/default.nix
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "db4e1655fc58f31e5770a17dfca4e6c89028ad8b2c8e043febc87a0beedeef05";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ intltool gtk3 texinfo ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ gtk3 texinfo ];
 
   meta = {
     description = "A GTK enabled dropin replacement for xmessage";
diff --git a/pkgs/applications/misc/mdzk/default.nix b/pkgs/applications/misc/mdzk/default.nix
index 3144f59476b5..98bcda9943fc 100644
--- a/pkgs/applications/misc/mdzk/default.nix
+++ b/pkgs/applications/misc/mdzk/default.nix
@@ -8,10 +8,15 @@ rustPlatform.buildRustPackage rec {
     owner = "mdzk-rs";
     repo = "mdzk";
     rev = version;
-    sha256 = "sha256-V//tVcIzhCh03VjwMC+R2ynaOFm+dp6qxa0oqBfvGUs=";
+    hash = "sha256-V//tVcIzhCh03VjwMC+R2ynaOFm+dp6qxa0oqBfvGUs=";
   };
 
-  cargoSha256 = "sha256-2lPckUhnyfHaVWXzZXKliolDZiPtNl9UBZIKs6tUaNQ=";
+  cargoPatches = [
+    # Remove when new version of mdzk is released.
+    ./update-mdbook-for-rust-1.64.patch
+  ];
+
+  cargoHash = "sha256-5zGUBvmf68tCk5jGrNn+ukgYbiKzrlmZvWrYgoJf2zk=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
 
diff --git a/pkgs/applications/misc/mdzk/update-mdbook-for-rust-1.64.patch b/pkgs/applications/misc/mdzk/update-mdbook-for-rust-1.64.patch
new file mode 100644
index 000000000000..79b7240b96f8
--- /dev/null
+++ b/pkgs/applications/misc/mdzk/update-mdbook-for-rust-1.64.patch
@@ -0,0 +1,246 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index ae63793..4068e02 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -162,12 +162,46 @@ dependencies = [
+  "ansi_term",
+  "atty",
+  "bitflags",
+- "strsim",
+- "textwrap",
++ "strsim 0.8.0",
++ "textwrap 0.11.0",
+  "unicode-width",
+  "vec_map",
+ ]
+ 
++[[package]]
++name = "clap"
++version = "3.2.2"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "8e538f9ee5aa3b3963f09a997035f883677966ed50fce0292611927ce6f6d8c6"
++dependencies = [
++ "atty",
++ "bitflags",
++ "clap_lex",
++ "indexmap",
++ "lazy_static",
++ "strsim 0.10.0",
++ "termcolor",
++ "textwrap 0.15.1",
++]
++
++[[package]]
++name = "clap_complete"
++version = "3.2.5"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "3f7a2e0a962c45ce25afce14220bc24f9dade0a1787f185cecf96bfba7847cd8"
++dependencies = [
++ "clap 3.2.2",
++]
++
++[[package]]
++name = "clap_lex"
++version = "0.2.4"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "2850f2f5a82cbf437dd5af4d49848fbdfc27c157c3d010345776f952765261c5"
++dependencies = [
++ "os_str_bytes",
++]
++
+ [[package]]
+ name = "cpufeatures"
+ version = "0.2.1"
+@@ -222,9 +256,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "env_logger"
+-version = "0.7.1"
++version = "0.9.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "44533bbbb3bb3c1fa17d9f2e4e38bbbaf8396ba82193c4cb1b6445d711445d36"
++checksum = "c90bf5f19754d10198ccb95b70664fc925bd1fc090a0fd9a6ebc54acc8cd6272"
+ dependencies = [
+  "atty",
+  "humantime",
+@@ -385,15 +419,6 @@ dependencies = [
+  "version_check",
+ ]
+ 
+-[[package]]
+-name = "getopts"
+-version = "0.2.21"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "14dbbfd5c71d70241ecf9e6f13737f7b5ce823821063188d7e46c41d371eebd5"
+-dependencies = [
+- "unicode-width",
+-]
+-
+ [[package]]
+ name = "getrandom"
+ version = "0.1.16"
+@@ -471,7 +496,7 @@ dependencies = [
+  "log",
+  "pest",
+  "pest_derive",
+- "quick-error 2.0.1",
++ "quick-error",
+  "serde",
+  "serde_json",
+ ]
+@@ -575,12 +600,9 @@ checksum = "6456b8a6c8f33fee7d958fcd1b60d55b11940a79e63ae87013e6d22e26034440"
+ 
+ [[package]]
+ name = "humantime"
+-version = "1.3.0"
++version = "2.1.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "df004cfca50ef23c36850aaaa59ad52cc70d0e90243c3c7737a4dd32dc7a3c4f"
+-dependencies = [
+- "quick-error 1.2.3",
+-]
++checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
+ 
+ [[package]]
+ name = "hyper"
+@@ -822,13 +844,14 @@ checksum = "a3e378b66a060d48947b590737b30a1be76706c8dd7b8ba0f2fe3989c68a853f"
+ 
+ [[package]]
+ name = "mdbook"
+-version = "0.4.15"
++version = "0.4.21"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "241f10687eb3b4e0634b3b4e423f97c5f1efbd69dc9522e24a8b94583eeec3c6"
++checksum = "23f3e133c6d515528745ffd3b9f0c7d975ae039f0b6abb099f2168daa2afb4f9"
+ dependencies = [
+  "anyhow",
+  "chrono",
+- "clap",
++ "clap 3.2.2",
++ "clap_complete",
+  "env_logger",
+  "handlebars",
+  "lazy_static",
+@@ -838,7 +861,6 @@ dependencies = [
+  "pulldown-cmark",
+  "regex",
+  "serde",
+- "serde_derive",
+  "serde_json",
+  "shlex",
+  "tempfile",
+@@ -1062,6 +1084,12 @@ dependencies = [
+  "winapi 0.3.9",
+ ]
+ 
++[[package]]
++name = "os_str_bytes"
++version = "6.3.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "9ff7415e9ae3fff1225851df9e0d9e4e5479f947619774677a63572e55e80eff"
++
+ [[package]]
+ name = "parking_lot"
+ version = "0.11.2"
+@@ -1258,17 +1286,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "34f197a544b0c9ab3ae46c359a7ec9cbbb5c7bf97054266fecb7ead794a181d6"
+ dependencies = [
+  "bitflags",
+- "getopts",
+  "memchr",
+  "unicase",
+ ]
+ 
+-[[package]]
+-name = "quick-error"
+-version = "1.2.3"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
+-
+ [[package]]
+ name = "quick-error"
+ version = "2.0.1"
+@@ -1386,9 +1407,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "regex"
+-version = "1.5.4"
++version = "1.6.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "d07a8629359eb56f1e2fb1652bb04212c072a87ba68546a04065d525673ac461"
++checksum = "4c4eb3267174b8c6c2f654116623910a0fef09c4753f8dd83db29c48a0df988b"
+ dependencies = [
+  "aho-corasick",
+  "memchr",
+@@ -1403,9 +1424,9 @@ checksum = "6c230d73fb8d8c1b9c0b3135c5142a8acee3a0558fb8db5cf1cb65f8d7862132"
+ 
+ [[package]]
+ name = "regex-syntax"
+-version = "0.6.25"
++version = "0.6.27"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "f497285884f3fcff424ffc933e56d7cbca511def0c9831a7f9b5f6153e3cc89b"
++checksum = "a3f87b73ce11b1619a3c6332f45341e0047173771e8b8b73f87bfeefb7b56244"
+ 
+ [[package]]
+ name = "remove_dir_all"
+@@ -1577,13 +1598,19 @@ version = "0.8.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "8ea5119cdb4c55b55d432abb513a0429384878c15dde60cc77b1c99de1a95a6a"
+ 
++[[package]]
++name = "strsim"
++version = "0.10.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
++
+ [[package]]
+ name = "structopt"
+ version = "0.3.26"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "0c6b5c64445ba8094a6ab0c3cd2ad323e07171012d9c98b0b15651daf1787a10"
+ dependencies = [
+- "clap",
++ "clap 2.33.3",
+  "lazy_static",
+  "structopt-derive",
+ ]
+@@ -1673,6 +1700,12 @@ dependencies = [
+  "unicode-width",
+ ]
+ 
++[[package]]
++name = "textwrap"
++version = "0.15.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "949517c0cf1bf4ee812e2e07e08ab448e3ae0d23472aee8a06c985f0c8815b16"
++
+ [[package]]
+ name = "thiserror"
+ version = "1.0.30"
+diff --git a/Cargo.toml b/Cargo.toml
+index dfeeb45..8b1e4e5 100644
+--- a/Cargo.toml
++++ b/Cargo.toml
+@@ -38,7 +38,7 @@ handlebars = "4.2.1"
+ ignore = "0.4.18"
+ lazy_static = "1.4.0"
+ lazy-regex = "2.2.2"
+-mdbook = { version = "0.4.15", default-features = false }
++mdbook = { version = "0.4.21", default-features = false }
+ notify = "4.0.17"
+ pest = "2.1.3"
+ pest_derive = "2.1.0"
+diff --git a/src/renderer/mdzk_renderer.rs b/src/renderer/mdzk_renderer.rs
+index 55b2423..f8480ca 100644
+--- a/src/renderer/mdzk_renderer.rs
++++ b/src/renderer/mdzk_renderer.rs
+@@ -92,7 +92,7 @@ impl Renderer for HtmlMdzk {
+             "description",
+             json!(ctx.config.book.description.clone().unwrap_or_default()),
+         );
+-        if let Some(ref livereload) = html_config.livereload_url {
++        if let Some(ref livereload) = html_config.live_reload_endpoint {
+             data.insert("livereload", json!(livereload));
+         }
+         data.insert("fold_enable", json!(html_config.fold.enable));
diff --git a/pkgs/applications/misc/pcmanx-gtk2/default.nix b/pkgs/applications/misc/pcmanx-gtk2/default.nix
index dffbd2079aea..2e75791e3082 100644
--- a/pkgs/applications/misc/pcmanx-gtk2/default.nix
+++ b/pkgs/applications/misc/pcmanx-gtk2/default.nix
@@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0fbwd149wny67rfhczz4cbh713a1qnswjiz7b6c2bxfcwh51f9rc";
   };
 
-  nativeBuildInputs = [ pkg-config automake autoconf ];
-  buildInputs = [ gtk2 libXft intltool libtool ];
+  nativeBuildInputs = [ pkg-config automake autoconf intltool ];
+  buildInputs = [ gtk2 libXft libtool ];
 
   preConfigure = ''
     ./autogen.sh
diff --git a/pkgs/applications/misc/udevil/default.nix b/pkgs/applications/misc/udevil/default.nix
index 536d800001b2..9c50b189cc15 100644
--- a/pkgs/applications/misc/udevil/default.nix
+++ b/pkgs/applications/misc/udevil/default.nix
@@ -20,11 +20,10 @@ stdenv.mkDerivation rec {
     sha256 = "0nd44r8rbxifx4x4m24z5aji1c6k1fhw8cmf5s43wd5qys0bcdad";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config intltool ];
 
   buildInputs = [
     glib
-    intltool
     udev
   ];
 
diff --git a/pkgs/applications/misc/xpad/default.nix b/pkgs/applications/misc/xpad/default.nix
index dbb5eb42e1d9..2a14cbe24fb5 100644
--- a/pkgs/applications/misc/xpad/default.nix
+++ b/pkgs/applications/misc/xpad/default.nix
@@ -11,9 +11,9 @@ stdenv.mkDerivation rec {
     sha256 = "1qpmlwn0bcw1q73ag0l0fdnlzmwawfvsy4g9y5b0vyrc58lcp5d3";
   };
 
-  nativeBuildInputs = [ autoreconfHook pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ autoreconfHook pkg-config wrapGAppsHook intltool ];
 
-  buildInputs = [ glib intltool gtk3 gtksourceview ];
+  buildInputs = [ glib gtk3 gtksourceview ];
 
   meta = with lib; {
     description = "A sticky note application for jotting down things to remember";
diff --git a/pkgs/applications/misc/xxkb/default.nix b/pkgs/applications/misc/xxkb/default.nix
index d6514e58517e..5e76e3a14d53 100644
--- a/pkgs/applications/misc/xxkb/default.nix
+++ b/pkgs/applications/misc/xxkb/default.nix
@@ -23,14 +23,14 @@ stdenv.mkDerivation rec {
     sha256 = "0hl1i38z9xnbgfjkaz04vv1n8xbgfg88g5z8fyzyb2hxv2z37anf";
   };
 
-  nativeBuildInputs = [ imake gccmakedep ];
+  nativeBuildInputs = [ imake gccmakedep pkg-config ];
 
   buildInputs = [
     libX11
     libXt
     libXext
     libXpm
-  ] ++ lib.optionals svgSupport [ librsvg glib gdk-pixbuf pkg-config ];
+  ] ++ lib.optionals svgSupport [ librsvg glib gdk-pixbuf ];
 
   outputs = [ "out" "man" ];
 
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index b22a334b64f3..afee9cf4f61b 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -325,7 +325,7 @@ let
 
     buildPhase = let
       buildCommand = target: ''
-        ninja -C "${buildPath}" -j$NIX_BUILD_CORES -l$NIX_BUILD_CORES "${target}"
+        ninja -C "${buildPath}" -j$NIX_BUILD_CORES "${target}"
         (
           source chrome/installer/linux/common/installer.include
           PACKAGE=$packageName
diff --git a/pkgs/applications/networking/ids/snort/default.nix b/pkgs/applications/networking/ids/snort/default.nix
index 938626806cae..46394c107dec 100644
--- a/pkgs/applications/networking/ids/snort/default.nix
+++ b/pkgs/applications/networking/ids/snort/default.nix
@@ -12,8 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "0xrc7crchflfrk4x5dq5zx22zkmgcrbkww5r1pvkc3cyyr18cc6h";
   };
 
-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ pkg-config luajit openssl libpcap pcre libdnet daq zlib flex bison libtirpc ];
+  nativeBuildInputs = [ makeWrapper pkg-config ];
+  buildInputs = [ luajit openssl libpcap pcre libdnet daq zlib flex bison libtirpc ];
 
   NIX_CFLAGS_COMPILE = [ "-I${libtirpc.dev}/include/tirpc" ];
 
diff --git a/pkgs/applications/networking/instant-messengers/fractal/default.nix b/pkgs/applications/networking/instant-messengers/fractal/default.nix
index 3b5349d65ffe..bfc322fea6cf 100644
--- a/pkgs/applications/networking/instant-messengers/fractal/default.nix
+++ b/pkgs/applications/networking/instant-messengers/fractal/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
     owner = "GNOME";
     repo = "fractal";
     rev = version;
-    sha256 = "DSNVd9YvI7Dd3s3+M0+wE594tmL1yPNMnD1W9wLhSuw=";
+    hash = "sha256-To6lr2I+JVrxvuK++2gLWntFGnEBm+B6KTRuOvjASek=";
   };
 
   patches = [
@@ -40,14 +40,17 @@ stdenv.mkDerivation rec {
     # fractal-gtk/res/meson.build:5:0: ERROR: Function does not take positional arguments.
     (fetchpatch {
       url = "https://gitlab.gnome.org/GNOME/fractal/-/commit/6fa1a23596d65d94aa889efe725174e6cd2903f0.patch";
-      sha256 = "3OzU9XL2V1VNOkvL1j677K3HNoBqPMQudQDmiDxYfAc=";
+      hash = "sha256-3OzU9XL2V1VNOkvL1j677K3HNoBqPMQudQDmiDxYfAc=";
     })
+
+    # This is in fractal v4.4.1b1+ so can be removed when fractal is updated.
+    ./update-socket2-for-rust-1.64.diff
   ];
 
   cargoDeps = rustPlatform.fetchCargoTarball {
-    inherit src;
+    inherit src patches;
     name = "${pname}-${version}";
-    hash = "sha256-xim5sOzeXJjRXbTOg2Gk/LHU0LioiyMK5nSr1LwMPjc=";
+    hash = "sha256-d99zSaxp22YyLP3Wckgcm7wlz7nFrLJDHq2xPJmZFf0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/instant-messengers/fractal/update-socket2-for-rust-1.64.diff b/pkgs/applications/networking/instant-messengers/fractal/update-socket2-for-rust-1.64.diff
new file mode 100644
index 000000000000..04e6f2cc1cb9
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/fractal/update-socket2-for-rust-1.64.diff
@@ -0,0 +1,195 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index c0b5e5e2..3009f183 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -1,5 +1,7 @@
+ # This file is automatically @generated by Cargo.
+ # It is not intended for manual editing.
++version = 3
++
+ [[package]]
+ name = "addr2line"
+ version = "0.13.0"
+@@ -169,7 +171,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "46254cf2fdcdf1badb5934448c1bcbe046a56537b3987d96c51a7afc5d03f293"
+ dependencies = [
+  "addr2line",
+- "cfg-if",
++ "cfg-if 0.1.10",
+  "libc",
+  "miniz_oxide",
+  "object",
+@@ -326,6 +328,12 @@ version = "0.1.10"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "4785bdd1c96b2a846b2bd7cc02e86b6b3dbf14e7e53446c4f54c92a361040822"
+ 
++[[package]]
++name = "cfg-if"
++version = "1.0.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
++
+ [[package]]
+ name = "chrono"
+ version = "0.4.13"
+@@ -407,7 +415,7 @@ version = "1.2.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "ba125de2af0df55319f41944744ad91c71113bf74a4646efff39afe1f6842db1"
+ dependencies = [
+- "cfg-if",
++ "cfg-if 0.1.10",
+ ]
+ 
+ [[package]]
+@@ -417,7 +425,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "c3c7c73a2d1e9fc0886a08b93e98eb643461230d5f1925e4036204d5f2e261a8"
+ dependencies = [
+  "autocfg 1.0.0",
+- "cfg-if",
++ "cfg-if 0.1.10",
+  "lazy_static",
+ ]
+ 
+@@ -455,7 +463,7 @@ version = "2.0.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "551a778172a450d7fc12e629ca3b0428d00f6afa9a43da1b630d54604e97371c"
+ dependencies = [
+- "cfg-if",
++ "cfg-if 0.1.10",
+  "dirs-sys",
+ ]
+ 
+@@ -465,7 +473,7 @@ version = "2.0.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "13aea89a5c93364a98e9b37b2fa237effbb694d5cfe01c5b70941f7eb087d5e3"
+ dependencies = [
+- "cfg-if",
++ "cfg-if 0.1.10",
+  "dirs-sys",
+ ]
+ 
+@@ -506,7 +514,7 @@ version = "0.8.23"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "e8ac63f94732332f44fe654443c46f6375d1939684c17b0afb6cb56b0456e171"
+ dependencies = [
+- "cfg-if",
++ "cfg-if 0.1.10",
+ ]
+ 
+ [[package]]
+@@ -549,7 +557,7 @@ version = "1.0.16"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "68c90b0fc46cf89d227cc78b40e494ff81287a92dd07631e5af0d06fe3cf885e"
+ dependencies = [
+- "cfg-if",
++ "cfg-if 0.1.10",
+  "crc32fast",
+  "libc",
+  "miniz_oxide",
+@@ -842,7 +850,7 @@ version = "0.1.14"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "7abc8dd8451921606d809ba32e95b6111925cd2906060d2dcc29c070220503eb"
+ dependencies = [
+- "cfg-if",
++ "cfg-if 0.1.10",
+  "libc",
+  "wasi",
+ ]
+@@ -979,7 +987,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "ce8664a114cd6ec16bece783d5eee59496919915b1f6884400ba4a953274a163"
+ dependencies = [
+  "bitflags",
+- "cfg-if",
++ "cfg-if 0.1.10",
+  "futures-channel",
+  "futures-core",
+  "futures-util",
+@@ -1543,7 +1551,7 @@ version = "0.4.11"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "4fabed175da42fed1fa0746b0ea71f412aa9d35e76e95e59b192c64b9dc2bf8b"
+ dependencies = [
+- "cfg-if",
++ "cfg-if 0.1.10",
+ ]
+ 
+ [[package]]
+@@ -1648,7 +1656,7 @@ version = "0.6.22"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "fce347092656428bc8eaf6201042cb551b8d67855af7374542a92a0fbfcac430"
+ dependencies = [
+- "cfg-if",
++ "cfg-if 0.1.10",
+  "fuchsia-zircon",
+  "fuchsia-zircon-sys",
+  "iovec",
+@@ -1703,7 +1711,7 @@ version = "0.2.34"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "2ba7c918ac76704fb42afcbbb43891e72731f3dcca3bef2a19786297baf14af7"
+ dependencies = [
+- "cfg-if",
++ "cfg-if 0.1.10",
+  "libc",
+  "winapi 0.3.9",
+ ]
+@@ -1826,7 +1834,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "8d575eff3665419f9b83678ff2815858ad9d11567e082f5ac1814baba4e2bcb4"
+ dependencies = [
+  "bitflags",
+- "cfg-if",
++ "cfg-if 0.1.10",
+  "foreign-types",
+  "lazy_static",
+  "libc",
+@@ -2523,13 +2531,12 @@ checksum = "c111b5bd5695e56cffe5129854aa230b39c93a305372fdbb2668ca2394eea9f8"
+ 
+ [[package]]
+ name = "socket2"
+-version = "0.3.12"
++version = "0.3.19"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "03088793f677dce356f3ccc2edb1b314ad191ab702a5de3faf49304f7e104918"
++checksum = "122e570113d28d773067fab24266b66753f6ea915758651696b6e35e49f88d6e"
+ dependencies = [
+- "cfg-if",
++ "cfg-if 1.0.0",
+  "libc",
+- "redox_syscall",
+  "winapi 0.3.9",
+ ]
+ 
+@@ -2678,7 +2685,7 @@ version = "3.1.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "7a6e24d9338a0a5be79593e2fa15a648add6138caa803e2d5bc782c371732ca9"
+ dependencies = [
+- "cfg-if",
++ "cfg-if 0.1.10",
+  "libc",
+  "rand 0.7.3",
+  "redox_syscall",
+@@ -2818,7 +2825,7 @@ version = "0.1.18"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "f0aae59226cf195d8e74d4b34beae1859257efb4e5fed3f147d2dc2c7d372178"
+ dependencies = [
+- "cfg-if",
++ "cfg-if 0.1.10",
+  "log",
+  "tracing-core",
+ ]
+@@ -2998,7 +3005,7 @@ version = "0.2.67"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "f0563a9a4b071746dd5aedbc3a28c6fe9be4586fb3fbadb67c400d4f53c6b16c"
+ dependencies = [
+- "cfg-if",
++ "cfg-if 0.1.10",
+  "serde",
+  "serde_json",
+  "wasm-bindgen-macro",
+@@ -3025,7 +3032,7 @@ version = "0.4.17"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "95f8d235a77f880bcef268d379810ea6c0af2eacfa90b1ad5af731776e0c4699"
+ dependencies = [
+- "cfg-if",
++ "cfg-if 0.1.10",
+  "js-sys",
+  "wasm-bindgen",
+  "web-sys",
diff --git a/pkgs/applications/networking/instant-messengers/pidgin-plugins/otr/default.nix b/pkgs/applications/networking/instant-messengers/pidgin-plugins/otr/default.nix
index 52204d5c79c0..aa871df5e8af 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin-plugins/otr/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin-plugins/otr/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
 
   postInstall = "ln -s \$out/lib/pidgin \$out/share/pidgin-otr";
 
-  buildInputs = [ libotr pidgin intltool ];
+  nativeBuildInputs = [ intltool ];
+  buildInputs = [ libotr pidgin ];
 
   meta = with lib; {
     homepage = "https://otr.cypherpunks.ca/";
diff --git a/pkgs/applications/networking/instant-messengers/pidgin-plugins/pidgin-indicator/default.nix b/pkgs/applications/networking/instant-messengers/pidgin-plugins/pidgin-indicator/default.nix
index 9afdee8cda16..70cb3a9028df 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin-plugins/pidgin-indicator/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin-plugins/pidgin-indicator/default.nix
@@ -20,8 +20,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-CdA/aUu+CmCRbVBKpJGydicqFQa/rEsLWS3MBKlH2/M=";
   };
 
-  nativeBuildInputs = [ autoreconfHook ];
-  buildInputs = [ glib intltool libappindicator-gtk2 libtool pidgin ];
+  nativeBuildInputs = [ autoreconfHook intltool ];
+  buildInputs = [ glib libappindicator-gtk2 libtool pidgin ];
 
   meta = with lib; {
     description = "An AppIndicator and KStatusNotifierItem Plugin for Pidgin";
diff --git a/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-plugin-pack/default.nix b/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-plugin-pack/default.nix
index f393a17c1bc6..7c076cb37241 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-plugin-pack/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-plugin-pack/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0g5hmy7fwgjq59j52h9yps28jsjjrfkd4r18gyx6hfd3g3kzbg1b";
   };
 
-  buildInputs = [ pidgin intltool python2 ];
+  nativeBuildInputs = [ intltool ];
+  buildInputs = [ pidgin python2 ];
 
   meta = with lib; {
     homepage = "https://bitbucket.org/rekkanoryo/purple-plugin-pack";
diff --git a/pkgs/applications/networking/instant-messengers/pidgin/default.nix b/pkgs/applications/networking/instant-messengers/pidgin/default.nix
index 84f8f327cad9..15e830b76870 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin/default.nix
@@ -16,7 +16,7 @@ let unwrapped = stdenv.mkDerivation rec {
     sha256 = "sha256-RUsbkovGvLsYM1OvMPv95VlfIkWjQjoaRubJei3yKBA=";
   };
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper intltool ];
 
   NIX_CFLAGS_COMPILE = "-I${gst_all_1.gst-plugins-base.dev}/include/gstreamer-1.0";
 
@@ -27,7 +27,7 @@ let unwrapped = stdenv.mkDerivation rec {
     gst_all_1.gstreamer gst_all_1.gst-plugins-base gst_all_1.gst-plugins-good
     libxml2 nss nspr
     libXScrnSaver python-with-dbus
-    avahi dbus dbus-glib intltool libidn
+    avahi dbus dbus-glib libidn
     libICE libXext libSM cyrus_sasl
     libgnt ncurses # optional: build finch - the console UI
   ]
diff --git a/pkgs/applications/networking/seahub/default.nix b/pkgs/applications/networking/seahub/default.nix
index 98d873097a53..70cb96ed1364 100644
--- a/pkgs/applications/networking/seahub/default.nix
+++ b/pkgs/applications/networking/seahub/default.nix
@@ -21,6 +21,7 @@ in
 python.pkgs.buildPythonApplication rec {
   pname = "seahub";
   version = "9.0.6";
+  format = "other";
 
   src = fetchFromGitHub {
     owner = "haiwen";
@@ -29,8 +30,6 @@ python.pkgs.buildPythonApplication rec {
     sha256 = "sha256-GHvJlm5DVt3IVJnqJu8YobNNqbjdPd08s4DCdQQRQds=";
   };
 
-  format = "other";
-
   dontBuild = true;
 
   doCheck = false; # disabled because it requires a ccnet environment
diff --git a/pkgs/applications/networking/sync/lsyncd/default.nix b/pkgs/applications/networking/sync/lsyncd/default.nix
index 7690bf6ee540..3e52d664d526 100644
--- a/pkgs/applications/networking/sync/lsyncd/default.nix
+++ b/pkgs/applications/networking/sync/lsyncd/default.nix
@@ -31,10 +31,10 @@ stdenv.mkDerivation rec {
 
   dontUseCmakeBuildDir = true;
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [
     rsync
-    lua pkg-config
+    lua
     asciidoc libxml2 docbook_xml_dtd_45 docbook_xsl libxslt
   ];
 
diff --git a/pkgs/applications/office/gnucash/default.nix b/pkgs/applications/office/gnucash/default.nix
index 251c77951321..9e5294c4b00d 100644
--- a/pkgs/applications/office/gnucash/default.nix
+++ b/pkgs/applications/office/gnucash/default.nix
@@ -39,6 +39,7 @@ stdenv.mkDerivation rec {
     gettext
     makeWrapper
     wrapGAppsHook
+    pkg-config
   ];
 
   buildInputs = [
@@ -55,7 +56,6 @@ stdenv.mkDerivation rec {
     libofx
     libxml2
     libxslt
-    pkg-config
     swig
     webkitgtk
   ]
diff --git a/pkgs/applications/office/grisbi/default.nix b/pkgs/applications/office/grisbi/default.nix
index ff0d75711cf0..81f97b116b05 100644
--- a/pkgs/applications/office/grisbi/default.nix
+++ b/pkgs/applications/office/grisbi/default.nix
@@ -19,12 +19,11 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-vTrbq/xLTfwF7/YtKzZFiiSw8A0HzzWin2ry8gPHej8=";
   };
 
-  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook intltool ];
   buildInputs = [
     gtk
     libgsf
     libofx
-    intltool
     libsoup
     gnome.adwaita-icon-theme
   ];
diff --git a/pkgs/applications/office/homebank/default.nix b/pkgs/applications/office/homebank/default.nix
index 2a00811a449b..17a9cbb59244 100644
--- a/pkgs/applications/office/homebank/default.nix
+++ b/pkgs/applications/office/homebank/default.nix
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-Rg6OjHLkwVIDnXqzqPXA8DxqSdrh2T6V/gLBND8vx9o=";
   };
 
-  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
-  buildInputs = [ gtk libofx intltool libsoup gnome.adwaita-icon-theme ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook intltool ];
+  buildInputs = [ gtk libofx libsoup gnome.adwaita-icon-theme ];
 
   meta = with lib; {
     description = "Free, easy, personal accounting for everyone";
diff --git a/pkgs/applications/office/libreoffice/default.nix b/pkgs/applications/office/libreoffice/default.nix
index c4435ca62698..43a1571b46eb 100644
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@@ -555,7 +555,6 @@ in
     openssl
     pam
     perl
-    pkg-config
     poppler
     python3
     sane-backends
diff --git a/pkgs/applications/radio/rtl-ais/default.nix b/pkgs/applications/radio/rtl-ais/default.nix
index c244868f65d8..407c18c1a0ad 100644
--- a/pkgs/applications/radio/rtl-ais/default.nix
+++ b/pkgs/applications/radio/rtl-ais/default.nix
@@ -3,7 +3,8 @@
 stdenv.mkDerivation {
   pname = "rtl-ais";
   version = "0.8.1";
-  buildInputs = [ pkg-config rtl-sdr libusb1 ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ rtl-sdr libusb1 ];
 
   src = fetchFromGitHub {
     owner = "dgiardini";
diff --git a/pkgs/applications/radio/unixcw/default.nix b/pkgs/applications/radio/unixcw/default.nix
index 0d352609cf0d..3fd066ec7b7b 100644
--- a/pkgs/applications/radio/unixcw/default.nix
+++ b/pkgs/applications/radio/unixcw/default.nix
@@ -10,7 +10,8 @@ mkDerivation rec {
   patches = [
     ./remove-use-of-dlopen.patch
   ];
-  buildInputs = [ libpulseaudio alsa-lib pkg-config qtbase ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ libpulseaudio alsa-lib qtbase ];
   CFLAGS   ="-lasound -lpulse-simple";
 
   meta = with lib; {
diff --git a/pkgs/applications/radio/xlog/default.nix b/pkgs/applications/radio/xlog/default.nix
index 59af9a94d96b..d47bd418f513 100644
--- a/pkgs/applications/radio/xlog/default.nix
+++ b/pkgs/applications/radio/xlog/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
   # glib-2.62 deprecations
   NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
-  buildInputs = [ glib pkg-config gtk2 hamlib ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ glib gtk2 hamlib ];
 
   meta = with lib; {
     description = "An amateur radio logging program";
diff --git a/pkgs/applications/science/biology/vcftools/default.nix b/pkgs/applications/science/biology/vcftools/default.nix
index 9f88079627e0..a4ec84d4d506 100755
--- a/pkgs/applications/science/biology/vcftools/default.nix
+++ b/pkgs/applications/science/biology/vcftools/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0msb09d2cnm8rlpg8bsc1lhjddvp3kf3i9dsj1qs4qgsdlzhxkyx";
   };
 
-  buildInputs = [ autoreconfHook pkg-config zlib perl ];
+  nativeBuildInputs = [ pkg-config autoreconfHook ];
+  buildInputs = [ zlib perl ];
 
   meta = with lib; {
     description = "A set of tools written in Perl and C++ for working with VCF files, such as those generated by the 1000 Genomes Project";
diff --git a/pkgs/applications/science/geometry/drgeo/default.nix b/pkgs/applications/science/geometry/drgeo/default.nix
index 59d7315ef413..0cc8bcb0fb38 100644
--- a/pkgs/applications/science/geometry/drgeo/default.nix
+++ b/pkgs/applications/science/geometry/drgeo/default.nix
@@ -13,8 +13,9 @@ stdenv.mkDerivation rec {
   };
   patches = [ ./struct.patch ];
 
+  nativeBuildInputs = [ pkg-config intltool ];
   buildInputs = [libglade gtk2 guile libxml2
-    perl intltool libtool pkg-config];
+    perl libtool ];
 
   prebuild = ''
     cp drgeo.desktop.in drgeo.desktop
diff --git a/pkgs/applications/science/math/R/default.nix b/pkgs/applications/science/math/R/default.nix
index 74f27fa534e2..1c8c565528e9 100644
--- a/pkgs/applications/science/math/R/default.nix
+++ b/pkgs/applications/science/math/R/default.nix
@@ -23,10 +23,11 @@ stdenv.mkDerivation rec {
 
   dontUseImakeConfigure = true;
 
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     bzip2 gfortran libX11 libXmu libXt libXt libjpeg libpng libtiff ncurses
     pango pcre2 perl readline texLive xz zlib less texinfo graphviz icu
-    pkg-config bison imake which blas lapack curl tcl tk jdk
+    bison imake which blas lapack curl tcl tk jdk
   ] ++ lib.optionals stdenv.isDarwin [ Cocoa Foundation libobjc libcxx ];
 
   patches = [
diff --git a/pkgs/applications/science/math/sage/sage-with-env.nix b/pkgs/applications/science/math/sage/sage-with-env.nix
index 23069f335b8f..7632b851773c 100644
--- a/pkgs/applications/science/math/sage/sage-with-env.nix
+++ b/pkgs/applications/science/math/sage/sage-with-env.nix
@@ -28,9 +28,9 @@ assert (!blas.isILP64) && (!lapack.isILP64);
 # executable sage. No tests are run yet and no documentation is built.
 
 let
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     pythonEnv # for patchShebangs
-    pkg-config
     blas lapack
     singular
     three
@@ -72,7 +72,7 @@ let
       []
     );
 
-  allInputs = lib.remove null (buildInputs ++ pythonEnv.extraLibs ++ [ makeWrapper ]);
+  allInputs = lib.remove null (nativeBuildInputs ++ buildInputs ++ pythonEnv.extraLibs ++ [ makeWrapper ]);
   transitiveDeps = lib.unique (builtins.concatLists (map transitiveClosure allInputs ));
   # fix differences between spkg and sage names
   # (could patch sage instead, but this is more lightweight and also works for packages depending on sage)
@@ -91,7 +91,7 @@ stdenv.mkDerivation rec {
   pname = "sage-with-env";
   src = sage-env.lib.src;
 
-  inherit buildInputs;
+  inherit nativeBuildInputs buildInputs;
 
   configurePhase = "#do nothing";
 
diff --git a/pkgs/applications/terminal-emulators/mrxvt/default.nix b/pkgs/applications/terminal-emulators/mrxvt/default.nix
index 006616bd944c..b05872b11e4d 100644
--- a/pkgs/applications/terminal-emulators/mrxvt/default.nix
+++ b/pkgs/applications/terminal-emulators/mrxvt/default.nix
@@ -22,7 +22,8 @@ stdenv.mkDerivation rec {
     sha256 = "1mqhmnlz32lvld9rc6c1hyz7gjw4anwf39yhbsjkikcgj1das0zl";
   };
 
-  buildInputs = [ libX11 libXft libXi xorgproto libSM libICE freetype pkg-config which ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ libX11 libXft libXi xorgproto libSM libICE freetype which ];
 
   configureFlags = [
     "--with-x"
diff --git a/pkgs/applications/terminal-emulators/rxvt-unicode/default.nix b/pkgs/applications/terminal-emulators/rxvt-unicode/default.nix
index 0eccceb5a4f6..ede0638e7a04 100644
--- a/pkgs/applications/terminal-emulators/rxvt-unicode/default.nix
+++ b/pkgs/applications/terminal-emulators/rxvt-unicode/default.nix
@@ -44,9 +44,10 @@ stdenv.mkDerivation {
     sha256 = "0badnkjsn3zps24r5iggj8k5v4f00npc77wqg92pcn1q5z8r677y";
   };
 
+  nativeBuildInputs = [ pkg-config ];
   buildInputs =
     [ libX11 libXt libXft ncurses  # required to build the terminfo file
-      fontconfig freetype pkg-config libXrender
+      fontconfig freetype libXrender
       libptytty
     ] ++ optional perlSupport perl
       ++ optional gdkPixbufSupport gdk-pixbuf;
diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index 95327f31ddcd..9b2c755b1091 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -74,7 +74,7 @@ stdenv.mkDerivation (finalAttrs: {
     done
   '';
 
-  nativeBuildInputs = [ gettext perlPackages.perl makeWrapper ]
+  nativeBuildInputs = [ gettext perlPackages.perl makeWrapper pkg-config ]
     ++ lib.optionals withManual [ asciidoc texinfo xmlto docbook2x
          docbook_xsl docbook_xml_dtd_45 libxslt ];
   buildInputs = [ curl openssl zlib expat cpio libiconv bash ]
@@ -82,7 +82,7 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optionals guiSupport [tcl tk]
     ++ lib.optionals withpcre2 [ pcre2 ]
     ++ lib.optionals stdenv.isDarwin [ Security CoreServices ]
-    ++ lib.optionals withLibsecret [ pkg-config glib libsecret ];
+    ++ lib.optionals withLibsecret [ glib libsecret ];
 
   # required to support pthread_cancel()
   NIX_LDFLAGS = lib.optionalString (stdenv.cc.isGNU && stdenv.hostPlatform.libc == "glibc") "-lgcc_s"
@@ -252,7 +252,7 @@ stdenv.mkDerivation (finalAttrs: {
       '')
 
    + lib.optionalString withManual ''# Install man pages
-       make -j $NIX_BUILD_CORES -l $NIX_BUILD_CORES PERL_PATH="${buildPackages.perl}/bin/perl" cmd-list.made install install-html \
+       make -j $NIX_BUILD_CORES PERL_PATH="${buildPackages.perl}/bin/perl" cmd-list.made install install-html \
          -C Documentation ''
 
    + (if guiSupport then ''
diff --git a/pkgs/applications/video/byzanz/default.nix b/pkgs/applications/video/byzanz/default.nix
index 5e60bb7fd908..d7ad9846306a 100644
--- a/pkgs/applications/video/byzanz/default.nix
+++ b/pkgs/applications/video/byzanz/default.nix
@@ -34,12 +34,11 @@ stdenv.mkDerivation {
     "-Wno-error=incompatible-pointer-types"
   ];
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config intltool ];
   buildInputs = [
     which
     gnome.gnome-common
     glib
-    intltool
     libtool
     cairo
     gtk3
diff --git a/pkgs/applications/virtualization/xen/generic.nix b/pkgs/applications/virtualization/xen/generic.nix
index cde71d2b87fa..234d72e46828 100644
--- a/pkgs/applications/virtualization/xen/generic.nix
+++ b/pkgs/applications/virtualization/xen/generic.nix
@@ -66,9 +66,9 @@ stdenv.mkDerivation (rec {
 
   hardeningDisable = [ "stackprotector" "fortify" "pic" ];
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config cmake ];
   buildInputs = [
-    cmake which
+    which
 
     # Xen
     bison bzip2 checkpolicy dev86 figlet flex gettext glib acpica-tools libaio
diff --git a/pkgs/applications/window-managers/fbpanel/default.nix b/pkgs/applications/window-managers/fbpanel/default.nix
index 33a313eb8eec..6dc22a664d3d 100644
--- a/pkgs/applications/window-managers/fbpanel/default.nix
+++ b/pkgs/applications/window-managers/fbpanel/default.nix
@@ -9,8 +9,9 @@ stdenv.mkDerivation rec {
     url = "mirror://sourceforge/fbpanel/${pname}-${version}.tbz2";
     sha256 = "e14542cc81ea06e64dd4708546f5fd3f5e01884c3e4617885c7ef22af8cf3965";
   };
+  nativeBuildInputs = [ pkg-config ];
   buildInputs =
-    [ pkg-config libX11 libXmu libXpm gtk2 libpng libjpeg libtiff librsvg gdk-pixbuf gdk-pixbuf-xlib.dev ];
+    [ libX11 libXmu libXpm gtk2 libpng libjpeg libtiff librsvg gdk-pixbuf gdk-pixbuf-xlib.dev ];
 
   preConfigure = "patchShebangs .";
 
diff --git a/pkgs/build-support/cc-wrapper/cc-wrapper.sh b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
index 83b6817798f2..78759f2cfbbc 100644
--- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@@ -122,6 +122,31 @@ fi
 
 if [[ "$isCxx" = 1 ]]; then
     if [[ "$cxxInclude" = 1 ]]; then
+        #
+        # The motivation for this comment is to explain the reason for appending
+        # the C++ stdlib to NIX_CFLAGS_COMPILE, which I initially thought should
+        # change and later realized it shouldn't in:
+        #
+        #   https://github.com/NixOS/nixpkgs/pull/185569#issuecomment-1234959249
+        #
+        # NIX_CFLAGS_COMPILE contains dependencies added using "-isystem", and
+        # NIX_CXXSTDLIB_COMPILE adds the C++ stdlib using "-isystem". Appending
+        # NIX_CXXSTDLIB_COMPILE to NIX_CLAGS_COMPILE emulates this part of the
+        # include lookup order from GCC/Clang:
+        #
+        # > 4. Directories specified with -isystem options are scanned in
+        # >    left-to-right order.
+        # > 5. Standard system directories are scanned.
+        # > 6. Directories specified with -idirafter options are scanned
+        # >    in left-to-right order.
+        #
+        # NIX_CXX_STDLIB_COMPILE acts as the "standard system directories" that
+        # are otherwise missing from CC in nixpkgs, so should be added last.
+        #
+        # This means that the C standard library should never be present inside
+        # NIX_CFLAGS_COMPILE, because it MUST come after the C++ stdlib. It is
+        # added automatically by cc-wrapper later using "-idirafter".
+        #
         NIX_CFLAGS_COMPILE_@suffixSalt@+=" $NIX_CXXSTDLIB_COMPILE_@suffixSalt@"
     fi
     if [[ "$cxxLibrary" = 1 ]]; then
diff --git a/pkgs/build-support/rust/build-rust-package/default.nix b/pkgs/build-support/rust/build-rust-package/default.nix
index 84700ff29af0..812831c2959c 100644
--- a/pkgs/build-support/rust/build-rust-package/default.nix
+++ b/pkgs/build-support/rust/build-rust-package/default.nix
@@ -124,7 +124,6 @@ stdenv.mkDerivation ((removeAttrs args [ "depsExtraArgs" "cargoUpdateHook" "carg
   ];
 
   buildInputs = buildInputs
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ libiconv ]
     ++ lib.optionals stdenv.hostPlatform.isMinGW [ windows.pthreads ];
 
   patches = cargoPatches ++ patches;
diff --git a/pkgs/build-support/rust/hooks/cargo-setup-hook.sh b/pkgs/build-support/rust/hooks/cargo-setup-hook.sh
index 842e66b5170e..b85796e2a41b 100644
--- a/pkgs/build-support/rust/hooks/cargo-setup-hook.sh
+++ b/pkgs/build-support/rust/hooks/cargo-setup-hook.sh
@@ -7,23 +7,23 @@ cargoSetupPostUnpackHook() {
     # this for us automatically.
     if [ -z $cargoVendorDir ]; then
         unpackFile "$cargoDeps"
-        export cargoDepsCopy=$(stripHash $cargoDeps)
+        export cargoDepsCopy="$(realpath "$(stripHash $cargoDeps)")"
     else
-      cargoDepsCopy="$sourceRoot/${cargoRoot:+$cargoRoot/}${cargoVendorDir}"
+        cargoDepsCopy="$(realpath "$(pwd)/$sourceRoot/${cargoRoot:+$cargoRoot/}${cargoVendorDir}")"
     fi
 
     if [ ! -d .cargo ]; then
         mkdir .cargo
     fi
 
-    config="$(pwd)/$cargoDepsCopy/.cargo/config";
+    config="$cargoDepsCopy/.cargo/config";
     if [[ ! -e $config ]]; then
       config=@defaultConfig@
     fi;
 
     tmp_config=$(mktemp)
     substitute $config $tmp_config \
-      --subst-var-by vendor "$(pwd)/$cargoDepsCopy"
+      --subst-var-by vendor "$cargoDepsCopy"
     cat ${tmp_config} >> .cargo/config
 
     cat >> .cargo/config <<'EOF'
@@ -39,8 +39,8 @@ EOF
 cargoSetupPostPatchHook() {
     echo "Executing cargoSetupPostPatchHook"
 
-    cargoDepsLockfile="$NIX_BUILD_TOP/$cargoDepsCopy/Cargo.lock"
-    srcLockfile="$NIX_BUILD_TOP/$sourceRoot/${cargoRoot:+$cargoRoot/}/Cargo.lock"
+    cargoDepsLockfile="$cargoDepsCopy/Cargo.lock"
+    srcLockfile="$(pwd)/${cargoRoot:+$cargoRoot/}Cargo.lock"
 
     echo "Validating consistency between $srcLockfile and $cargoDepsLockfile"
     if ! @diff@ $srcLockfile $cargoDepsLockfile; then
diff --git a/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix b/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix
index 9f52a05f61ca..c9b03b75cd03 100644
--- a/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix
+++ b/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix
@@ -16,12 +16,14 @@ makeSetupHook {
 
   substitutions = {
     cc = "${cc}/bin/${cc.targetPrefix}cc ${lib.escapeShellArgs (map (s: "-fsanitize=${s}") sanitizers)}";
+  };
 
+  passthru = {
     # Extract the function call used to create a binary wrapper from its embedded docstring
-    passthru.extractCmd = writeShellScript "extract-binary-wrapper-cmd" ''
+    extractCmd = writeShellScript "extract-binary-wrapper-cmd" ''
       strings -dw "$1" | sed -n '/^makeCWrapper/,/^$/ p'
     '';
 
-    passthru.tests = tests.makeBinaryWrapper;
+    tests = tests.makeBinaryWrapper;
   };
 } ./make-binary-wrapper.sh
diff --git a/pkgs/build-support/setup-hooks/postgresql-test-hook/default.nix b/pkgs/build-support/setup-hooks/postgresql-test-hook/default.nix
index d0031c93c10c..e9e77b0bbe6f 100644
--- a/pkgs/build-support/setup-hooks/postgresql-test-hook/default.nix
+++ b/pkgs/build-support/setup-hooks/postgresql-test-hook/default.nix
@@ -1,9 +1,8 @@
 { callPackage, makeSetupHook }:
 
-(makeSetupHook {
+makeSetupHook {
   name = "postgresql-test-hook";
-} ./postgresql-test-hook.sh).overrideAttrs (o: {
   passthru.tests = {
     simple = callPackage ./test.nix { };
   };
-})
+} ./postgresql-test-hook.sh
diff --git a/pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix b/pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix
index d7699b2557fc..5ef613838856 100644
--- a/pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix
+++ b/pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix
@@ -13,6 +13,7 @@
 }:
 
 makeSetupHook {
+  name = "wrap-gapps-hook";
   deps = lib.optionals (!stdenv.isDarwin) [
     # It is highly probable that a program will use GSettings,
     # at minimum through GTK file chooser dialogue.
@@ -36,8 +37,8 @@ makeSetupHook {
     # We use the wrapProgram function.
     makeWrapper
   ];
-  substitutions = {
-    passthru.tests = let
+  passthru = {
+    tests = let
       sample-project = ./tests/sample-project;
 
       testLib = callPackage ./tests/lib.nix { };
diff --git a/pkgs/build-support/trivial-builders.nix b/pkgs/build-support/trivial-builders.nix
index e73cb9c5decb..a8c291b82324 100644
--- a/pkgs/build-support/trivial-builders.nix
+++ b/pkgs/build-support/trivial-builders.nix
@@ -1,5 +1,12 @@
 { lib, stdenv, stdenvNoCC, lndir, runtimeShell, shellcheck }:
 
+let
+  inherit (lib)
+    optionalAttrs
+    warn
+    ;
+in
+
 rec {
 
   /* Run the shell command `buildCommand' to produce a store path named
@@ -525,12 +532,25 @@ rec {
    *                 substitutions = { bash = "${pkgs.bash}/bin/bash"; };
    *                 meta.platforms = lib.platforms.linux;
    *               } ./myscript.sh;
+   *
+   * # setup hook with a package test
+   * myhellohookTested = makeSetupHook {
+   *                 deps = [ hello ];
+   *                 substitutions = { bash = "${pkgs.bash}/bin/bash"; };
+   *                 meta.platforms = lib.platforms.linux;
+   *                 passthru.tests.greeting = callPackage ./test { };
+   *               } ./myscript.sh;
    */
-  makeSetupHook = { name ? "hook", deps ? [], substitutions ? {}, meta ? {} }: script:
+  makeSetupHook = { name ? "hook", deps ? [], substitutions ? {}, meta ? {}, passthru ? {} }: script:
     runCommand name
       (substitutions // {
         inherit meta;
         strictDeps = true;
+        # TODO 2023-01, no backport: simplify to inherit passthru;
+        passthru = passthru
+          // optionalAttrs (substitutions?passthru)
+            (warn "makeSetupHook (name = ${lib.strings.escapeNixString name}): `substitutions.passthru` is deprecated. Please set `passthru` directly."
+              substitutions.passthru);
       })
       (''
         mkdir -p $out/nix-support
diff --git a/pkgs/data/icons/tango-icon-theme/default.nix b/pkgs/data/icons/tango-icon-theme/default.nix
index 9e6b0666a118..18676018eff4 100644
--- a/pkgs/data/icons/tango-icon-theme/default.nix
+++ b/pkgs/data/icons/tango-icon-theme/default.nix
@@ -13,8 +13,8 @@ stdenv.mkDerivation rec {
 
   patches = [ ./rsvg-convert.patch ];
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ intltool iconnamingutils imagemagick librsvg ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ iconnamingutils imagemagick librsvg ];
   propagatedBuildInputs = [ gnome-icon-theme hicolor-icon-theme ];
   # still missing parent icon themes: cristalsvg
 
diff --git a/pkgs/data/misc/cacert/default.nix b/pkgs/data/misc/cacert/default.nix
index 0ed4f95f8cf0..a4739edea12f 100644
--- a/pkgs/data/misc/cacert/default.nix
+++ b/pkgs/data/misc/cacert/default.nix
@@ -20,7 +20,7 @@ let
   blocklist = writeText "cacert-blocklist.txt" (lib.concatStringsSep "\n" blacklist);
   extraCertificatesBundle = writeText "cacert-extra-certificates-bundle.crt" (lib.concatStringsSep "\n\n" extraCertificateStrings);
 
-  srcVersion = "3.80";
+  srcVersion = "3.83";
   version = if nssOverride != null then nssOverride.version else srcVersion;
   meta = with lib; {
     homepage = "https://curl.haxx.se/docs/caextract.html";
@@ -35,7 +35,7 @@ let
 
     src = if nssOverride != null then nssOverride.src else fetchurl {
       url = "mirror://mozilla/security/nss/releases/NSS_${lib.replaceStrings ["."] ["_"] version}_RTM/src/nss-${version}.tar.gz";
-      sha256 = "sha256-wL8f0sfimmsCswliK6r8RD7skMiTS7FV2ku5iYh4S2o=";
+      sha256 = "sha256-qyPqZ/lkCQuLc8gKZ0CCVxw25fTrqSBXrGSMnB3vASg=";
     };
 
     dontBuild = true;
diff --git a/pkgs/data/misc/ddccontrol-db/default.nix b/pkgs/data/misc/ddccontrol-db/default.nix
index efec5c73ba2e..3d91a4e7e727 100644
--- a/pkgs/data/misc/ddccontrol-db/default.nix
+++ b/pkgs/data/misc/ddccontrol-db/default.nix
@@ -21,11 +21,10 @@ stdenv.mkDerivation rec {
     ./autogen.sh
   '';
 
-  nativeBuildInputs = [ autoconf automake ];
+  nativeBuildInputs = [ autoconf automake intltool ];
   buildInputs =
     [
       libtool
-      intltool
     ];
 
   meta = with lib; {
diff --git a/pkgs/data/misc/iana-etc/default.nix b/pkgs/data/misc/iana-etc/default.nix
index 6f90669b8192..19331f458def 100644
--- a/pkgs/data/misc/iana-etc/default.nix
+++ b/pkgs/data/misc/iana-etc/default.nix
@@ -2,10 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "iana-etc";
-  version = "20220520";
+  version = "20220915";
+
   src = fetchzip {
     url = "https://github.com/Mic92/iana-etc/releases/download/${version}/iana-etc-${version}.tar.gz";
-    sha256 = "sha256-LSrfNb4fUJEGSPJ+StlAbTE9LbOPDrRJLKTDSkuyoZQ=";
+    sha256 = "sha256-gBaM5YEK2XA42S7ELwjQChie/wYgo6n8dt2WEg3Pdns=";
   };
 
   installPhase = ''
diff --git a/pkgs/data/misc/media-player-info/default.nix b/pkgs/data/misc/media-player-info/default.nix
index 56e4ace41f4d..652298d1656d 100644
--- a/pkgs/data/misc/media-player-info/default.nix
+++ b/pkgs/data/misc/media-player-info/default.nix
@@ -1,31 +1,28 @@
 { lib, stdenv, fetchurl, pkg-config, python3, udev, systemd }:
 
-let
-  name = "media-player-info-24";
-in
+stdenv.mkDerivation rec {
+  pname = "media-player-info";
+  version = "24";
 
-  stdenv.mkDerivation {
-    inherit name;
+  src = fetchurl {
+    url = "https://www.freedesktop.org/software/media-player-info/${pname}-${version}.tar.gz";
+    sha256 = "0d0i7av8v369hzvlynwlrbickv1brlzsmiky80lrjgjh1gdldkz6";
+  };
 
-    src = fetchurl {
-      url = "https://www.freedesktop.org/software/media-player-info/${name}.tar.gz";
-      sha256 = "0d0i7av8v369hzvlynwlrbickv1brlzsmiky80lrjgjh1gdldkz6";
-    };
+  buildInputs = [ udev systemd ];
+  nativeBuildInputs = [ pkg-config python3 ];
 
-    buildInputs = [ udev systemd ];
-    nativeBuildInputs = [ pkg-config python3 ];
+  postPatch = ''
+    patchShebangs ./tools
+  '';
 
-    postPatch = ''
-      patchShebangs ./tools
-    '';
+  configureFlags = [ "--with-udevdir=${placeholder "out"}/lib/udev" ];
 
-    configureFlags = [ "--with-udevdir=${placeholder "out"}/lib/udev" ];
-
-    meta = with lib; {
-      description = "A repository of data files describing media player capabilities";
-      homepage = "https://www.freedesktop.org/wiki/Software/media-player-info/";
-      license = licenses.bsd3;
-      maintainers = with maintainers; [ ttuegel ];
-      platforms = with platforms; linux;
-    };
-  }
+  meta = with lib; {
+    description = "A repository of data files describing media player capabilities";
+    homepage = "https://www.freedesktop.org/wiki/Software/media-player-info/";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ ttuegel ];
+    platforms = with platforms; linux;
+  };
+}
diff --git a/pkgs/data/misc/tzdata/default.nix b/pkgs/data/misc/tzdata/default.nix
index 1a6cba44ef87..41004243a557 100644
--- a/pkgs/data/misc/tzdata/default.nix
+++ b/pkgs/data/misc/tzdata/default.nix
@@ -2,16 +2,16 @@
 
 stdenv.mkDerivation rec {
   pname = "tzdata";
-  version = "2022c";
+  version = "2022d";
 
   srcs = [
     (fetchurl {
       url = "https://data.iana.org/time-zones/releases/tzdata${version}.tar.gz";
-      hash = "sha256-aXT040i/IyMnS1bf+edQAkfjFZ6qS0hd+gzWbnXBS/4=";
+      hash = "sha256-bs2+4n+kPc+knz1P2Lsd/vVMkNoavNgsmrzy3E8yHeA=";
     })
     (fetchurl {
       url = "https://data.iana.org/time-zones/releases/tzcode${version}.tar.gz";
-      hash = "sha256-Pnzh82IMwEgZB8fgdNaZEHkyhb/+DKMx7xptGuPqkMw=";
+      hash = "sha256-1kS6D5OImTdOqMtVTjX7SvoPe9e3FsYXd80AUAuHWeA=";
     })
   ];
 
diff --git a/pkgs/desktops/cinnamon/cinnamon-common/default.nix b/pkgs/desktops/cinnamon/cinnamon-common/default.nix
index 9f4e7f9468bd..7ddcada83b51 100644
--- a/pkgs/desktops/cinnamon/cinnamon-common/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-common/default.nix
@@ -102,7 +102,6 @@ stdenv.mkDerivation rec {
     libXdamage
     muffin
     networkmanager
-    pkg-config
     polkit
     libxml2
     libgnomekbd
@@ -134,6 +133,7 @@ stdenv.mkDerivation rec {
     gtk-doc
     perl
     python3.pkgs.wrapPython
+    pkg-config
   ];
 
   # use locales from cinnamon-translations (not using --localedir because datadir is used)
diff --git a/pkgs/desktops/gnome-2/desktop/gtksourceview/default.nix b/pkgs/desktops/gnome-2/desktop/gtksourceview/default.nix
index 34dfaa85b2f3..df63449c2f61 100644
--- a/pkgs/desktops/gnome-2/desktop/gtksourceview/default.nix
+++ b/pkgs/desktops/gnome-2/desktop/gtksourceview/default.nix
@@ -26,13 +26,13 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config intltool ] ++ lib.optionals stdenv.isDarwin [ autoreconfHook ];
   buildInputs = [
     atk cairo glib gtk2
-    pango libxml2Python perl intltool
+    pango libxml2Python perl
     gettext
   ] ++ optionals stdenv.isDarwin [
-    autoreconfHook gnome-common gtk-mac-integration-gtk2
+    gnome-common gtk-mac-integration-gtk2
   ];
 
   preConfigure = optionalString stdenv.isDarwin ''
diff --git a/pkgs/desktops/gnome-2/platform/gtkhtml/4.x.nix b/pkgs/desktops/gnome-2/platform/gtkhtml/4.x.nix
index 580d0a8cc829..72422cf41c35 100644
--- a/pkgs/desktops/gnome-2/platform/gtkhtml/4.x.nix
+++ b/pkgs/desktops/gnome-2/platform/gtkhtml/4.x.nix
@@ -25,6 +25,6 @@ stdenv.mkDerivation rec {
   ];
 
   propagatedBuildInputs = [ gsettings-desktop-schemas gtk3 gnome-icon-theme GConf ];
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ intltool enchant isocodes autoreconfHook ];
+  nativeBuildInputs = [ pkg-config autoreconfHook intltool ];
+  buildInputs = [ enchant isocodes ];
 }
diff --git a/pkgs/desktops/gnome-2/platform/gtkhtml/default.nix b/pkgs/desktops/gnome-2/platform/gtkhtml/default.nix
index 4f4e0503f819..206494e70224 100644
--- a/pkgs/desktops/gnome-2/platform/gtkhtml/default.nix
+++ b/pkgs/desktops/gnome-2/platform/gtkhtml/default.nix
@@ -14,8 +14,8 @@ stdenv.mkDerivation rec {
   #http://www.mail-archive.com/debian-bugs-rc@lists.debian.org/msg250091.html
   patches = [ ./01_remove-disable-deprecated.patch ];
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ gtk2 intltool GConf enchant isocodes gnome-icon-theme ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ gtk2 GConf enchant isocodes gnome-icon-theme ];
 
   NIX_LDFLAGS = "-lgthread-2.0";
 }
diff --git a/pkgs/desktops/gnome-2/platform/libgnome/default.nix b/pkgs/desktops/gnome-2/platform/libgnome/default.nix
index 2c70338a9005..56145980a5d2 100644
--- a/pkgs/desktops/gnome-2/platform/libgnome/default.nix
+++ b/pkgs/desktops/gnome-2/platform/libgnome/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" ];
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ popt zlib intltool GConf gnome_vfs libcanberra-gtk2 libtool ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ popt zlib GConf gnome_vfs libcanberra-gtk2 libtool ];
   propagatedBuildInputs = [ glib libbonobo libogg ];
 }
diff --git a/pkgs/desktops/gnome-2/platform/libgnomecups/default.nix b/pkgs/desktops/gnome-2/platform/libgnomecups/default.nix
index 42de8c2471a3..8d6bcce60205 100644
--- a/pkgs/desktops/gnome-2/platform/libgnomecups/default.nix
+++ b/pkgs/desktops/gnome-2/platform/libgnomecups/default.nix
@@ -13,8 +13,8 @@ stdenv.mkDerivation rec {
 
   patches = [ ./glib.patch ./cups_1.6.patch ];
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ gtk2 gettext intltool libart_lgpl ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ gtk2 gettext libart_lgpl ];
 
   propagatedBuildInputs = [ libxml2 ];
 }
diff --git a/pkgs/desktops/gnome-2/platform/libgnomeprint/default.nix b/pkgs/desktops/gnome-2/platform/libgnomeprint/default.nix
index bb2e435f422d..5f7a254c8fbd 100644
--- a/pkgs/desktops/gnome-2/platform/libgnomeprint/default.nix
+++ b/pkgs/desktops/gnome-2/platform/libgnomeprint/default.nix
@@ -19,8 +19,8 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ gtk2 gettext intltool libart_lgpl libgnomecups bison flex ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ gtk2 gettext libart_lgpl libgnomecups bison flex ];
 
   propagatedBuildInputs = [ libxml2 ];
 
diff --git a/pkgs/desktops/gnome-2/platform/libgnomeprintui/default.nix b/pkgs/desktops/gnome-2/platform/libgnomeprintui/default.nix
index a95ee70bca10..f8a647a5b5a5 100644
--- a/pkgs/desktops/gnome-2/platform/libgnomeprintui/default.nix
+++ b/pkgs/desktops/gnome-2/platform/libgnomeprintui/default.nix
@@ -9,6 +9,6 @@ stdenv.mkDerivation rec {
     sha256 = "0spl8vinb5n6n1krnfnr61dwaxidg67h8j94z9p59k2xdsvfashm";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ gtk2 gettext intltool libgnomecanvas libgnomeprint gnome-icon-theme];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ gtk2 gettext libgnomecanvas libgnomeprint gnome-icon-theme];
 }
diff --git a/pkgs/desktops/gnome/devtools/gnome-devel-docs/default.nix b/pkgs/desktops/gnome/devtools/gnome-devel-docs/default.nix
index ca9b8f7fb81a..e2f556c48694 100644
--- a/pkgs/desktops/gnome/devtools/gnome-devel-docs/default.nix
+++ b/pkgs/desktops/gnome/devtools/gnome-devel-docs/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
     updateScript = gnome.updateScript { packageName = "gnome-devel-docs"; attrPath = "gnome.gnome-devel-docs"; };
   };
 
-  buildInputs = [ intltool itstool libxml2 ];
+  nativeBuildInputs = [ intltool ];
+  buildInputs = [ itstool libxml2 ];
 
   meta = with lib; {
     homepage = "https://github.com/GNOME/gnome-devel-docs";
diff --git a/pkgs/desktops/gnome/misc/gtkhtml/default.nix b/pkgs/desktops/gnome/misc/gtkhtml/default.nix
index 88fb31c4333b..f4454e15bb9e 100644
--- a/pkgs/desktops/gnome/misc/gtkhtml/default.nix
+++ b/pkgs/desktops/gnome/misc/gtkhtml/default.nix
@@ -14,8 +14,8 @@ stdenv.mkDerivation rec {
     updateScript = gnome.updateScript { packageName = "gtkhtml"; attrPath = "gnome.gtkhtml"; };
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ gtk3 intltool gnome.adwaita-icon-theme
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ gtk3 gnome.adwaita-icon-theme
                   gsettings-desktop-schemas ];
 
   propagatedBuildInputs = [ enchant isocodes ];
diff --git a/pkgs/desktops/lxde/core/lxmenu-data/default.nix b/pkgs/desktops/lxde/core/lxmenu-data/default.nix
index e52445aa0b04..fc00c4cdad1e 100644
--- a/pkgs/desktops/lxde/core/lxmenu-data/default.nix
+++ b/pkgs/desktops/lxde/core/lxmenu-data/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "9fe3218d2ef50b91190162f4f923d6524c364849f87bcda8b4ed8eb59b80bab8";
   };
 
-  buildInputs = [ intltool ];
+  nativeBuildInputs = [ intltool ];
 
   meta = {
     homepage = "https://lxde.org/";
diff --git a/pkgs/development/compilers/gerbil/gerbil-crypto.nix b/pkgs/development/compilers/gerbil/gerbil-crypto.nix
index 12f4726f1c62..38943471a376 100644
--- a/pkgs/development/compilers/gerbil/gerbil-crypto.nix
+++ b/pkgs/development/compilers/gerbil/gerbil-crypto.nix
@@ -7,7 +7,8 @@ gerbil-support.gerbilPackage {
   gerbil-package = "clan/crypto";
   gerbil = gerbil-unstable;
   gerbilInputs = [gerbil-support.gerbilPackages-unstable.gerbil-utils];
-  buildInputs = [pkgs.secp256k1 pkgs.pkg-config];
+  nativeBuildInputs = [ pkgs.pkg-config ];
+  buildInputs = [pkgs.secp256k1 ];
   gambit-params = gambit-support.unstable-params;
   version-path = "version";
   softwareName = "Gerbil-crypto";
diff --git a/pkgs/development/compilers/gerbil/gerbil-support.nix b/pkgs/development/compilers/gerbil/gerbil-support.nix
index 9cb9954544c7..f51076fd5d4d 100644
--- a/pkgs/development/compilers/gerbil/gerbil-support.nix
+++ b/pkgs/development/compilers/gerbil/gerbil-support.nix
@@ -24,12 +24,13 @@ rec {
     gerbil ? pkgs.gerbil-unstable,
     gambit-params ? pkgs.gambit-support.stable-params,
     gerbilInputs ? [],
+    nativeBuildInputs ? [],
     buildInputs ? [],
     buildScript ? "./build.ss",
     softwareName ? ""} :
     let buildInputs_ = buildInputs; in
     gccStdenv.mkDerivation rec {
-      inherit src meta pname version;
+      inherit src meta pname version nativeBuildInputs;
       passthru = { inherit gerbil-package version-path ;};
       buildInputs = [ gerbil ] ++ gerbilInputs ++ buildInputs_;
       postPatch = ''
diff --git a/pkgs/development/compilers/polyml/5.6.nix b/pkgs/development/compilers/polyml/5.6.nix
index 4354ce7e2d67..bcd52380701a 100644
--- a/pkgs/development/compilers/polyml/5.6.nix
+++ b/pkgs/development/compilers/polyml/5.6.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation {
     })
   ];
 
-  buildInputs = lib.optional stdenv.isDarwin autoreconfHook;
+  nativeBuildInputs = lib.optional stdenv.isDarwin autoreconfHook;
 
   src = fetchurl {
     url = "mirror://sourceforge/polyml/polyml.${version}.tar.gz";
diff --git a/pkgs/development/compilers/rust/1_63.nix b/pkgs/development/compilers/rust/1_64.nix
similarity index 56%
rename from pkgs/development/compilers/rust/1_63.nix
rename to pkgs/development/compilers/rust/1_64.nix
index a33576f9426c..f93123fcd70a 100644
--- a/pkgs/development/compilers/rust/1_63.nix
+++ b/pkgs/development/compilers/rust/1_64.nix
@@ -20,8 +20,8 @@
 } @ args:
 
 import ./default.nix {
-  rustcVersion = "1.63.0";
-  rustcSha256 = "1l4rrbzhxv88pnfq94nbyb9m6lfnjwixma3mwjkmvvs2aqlq158z";
+  rustcVersion = "1.64.0";
+  rustcSha256 = "sha256-s82fSB4aKQG/bzgI0wxpzE6oDZPEzE4u1SJYsYA4EgU=";
 
   llvmSharedForBuild = pkgsBuildBuild.llvmPackages_14.libllvm.override { enableSharedLibraries = true; };
   llvmSharedForHost = pkgsBuildHost.llvmPackages_14.libllvm.override { enableSharedLibraries = true; };
@@ -37,25 +37,25 @@ import ./default.nix {
 
   # Note: the version MUST be one version prior to the version we're
   # building
-  bootstrapVersion = "1.62.1";
+  bootstrapVersion = "1.63.0";
 
   # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
   bootstrapHashes = {
-    i686-unknown-linux-gnu = "1669163ffe01e252ffb62da7d84949378fc274931a65ac827d54059a5ffc542c";
-    x86_64-unknown-linux-gnu = "dd7d82b8fa8eae59729e1c31fe59a9de6ee61d08ab40ce016185653beebe04d2";
-    x86_64-unknown-linux-musl = "32bee487074b105e2582cddce35934a6019eec74bae3f9300fdc3edfcf5b66d4";
-    arm-unknown-linux-gnueabihf = "5c735e8174d394936d7b499c2d147ddadf3c4d77e652d1e0b0a72d9d09f81ea4";
-    armv7-unknown-linux-gnueabihf = "26fa731385f1a71211ba8e3c94f3bb3b1a82bde89f8d4dcf75b4b463b57b0f88";
-    aarch64-unknown-linux-gnu = "1311fa8204f895d054c23a3481de3b158a5cd3b3a6338761fee9cdf4dbf075a5";
-    aarch64-unknown-linux-musl = "73bbab4d8a9e3c416035d40406e656ab37e785df35fa069a33af52e931a24b12";
-    x86_64-apple-darwin = "0a04dcf2b521239826f3eaa66d77169d91e68087ccc3107b54e8aba7c02c9adf";
-    aarch64-apple-darwin = "6d1671ea31b05cab5e2587cc2b295b3e7232b0135f0977355618e2a01933ff0a";
-    powerpc64le-unknown-linux-gnu = "1d3248e1a673cda87cf443cd4334ff5fb53e6f87c72d3587b07e5c0cb507f3ae";
-    riscv64gc-unknown-linux-gnu = "fd378d0bf866689e8111aba0e2b020da87f32f70fb11d98a575d42dc05978c2a";
-    mips64el-unknown-linux-gnuabi64 = "b7c47dd94728161aa96762fb7bc51b6ab0feba7c5215d06eaea5b78649815a96";
+    i686-unknown-linux-gnu = "6ac6ca18f119e099749d67c6dc25ce3f70542b43cc05062d5138fc1052e44c54";
+    x86_64-unknown-linux-gnu = "536bcf16807a4ff49b7b29af6e573a2f1821055bfad72c275c60e56edc693984";
+    x86_64-unknown-linux-musl = "4516f1fa2a0d9ec9176cc734e5faaa0a3d439bd49f75553a484b6c3c6d7905ab";
+    arm-unknown-linux-gnueabihf = "8847d8482e1d5ec962e092a63c95618dc7e17a079a9bf58bec1da39cac0ba4ce";
+    armv7-unknown-linux-gnueabihf = "d9227bf6d93f49889c698d35adc7ab3e042988740b9d9d9c81fb54fc0f854474";
+    aarch64-unknown-linux-gnu = "26745b57500da293a8147122a5998926301350a610c164f053107cbe026d3a51";
+    aarch64-unknown-linux-musl = "8fee65f2bd7e010259763939cbef8ed0794773ec8959c5ef90273cf39dcba180";
+    x86_64-apple-darwin = "37f76a45b8616e764c2663850758ce822c730e96af60168a46b818f528c1467d";
+    aarch64-apple-darwin = "25c3f43459da9b8683292999c3522d88980b0ca3244fe830f5a87a8092aac5a6";
+    powerpc64le-unknown-linux-gnu = "781662048caa48b78540c2fb22f0aa7c06d6d8e81aede0f6ef900c11428056cf";
+    riscv64gc-unknown-linux-gnu = "a7f398b45229c5cca833f75421c32897174e365fbbdf78e19b87612736c918aa";
+    mips64el-unknown-linux-gnuabi64 = "19f04c576c9d6b171acba65cfe44edcbcf6134a75a853d2f1538fdb2128ec654";
   };
 
-  selectRustPackage = pkgs: pkgs.rust_1_63;
+  selectRustPackage = pkgs: pkgs.rust_1_64;
 
   rustcPatches = [
   ];
diff --git a/pkgs/development/compilers/rust/cargo.nix b/pkgs/development/compilers/rust/cargo.nix
index 01b219714382..6a4d01de5ef4 100644
--- a/pkgs/development/compilers/rust/cargo.nix
+++ b/pkgs/development/compilers/rust/cargo.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, pkgsHostHost
 , file, curl, pkg-config, python3, openssl, cmake, zlib
 , installShellFiles, makeWrapper, cacert, rustPlatform, rustc
-, CoreFoundation, Security
+, libiconv, CoreFoundation, Security
 }:
 
 rustPlatform.buildRustPackage {
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage {
     (lib.getDev pkgsHostHost.curl)
   ];
   buildInputs = [ cacert file curl python3 openssl zlib ]
-    ++ lib.optionals stdenv.isDarwin [ CoreFoundation Security ];
+    ++ lib.optionals stdenv.isDarwin [ libiconv CoreFoundation Security ];
 
   # cargo uses git-rs which is made for a version of libgit2 from recent master that
   # is not compatible with the current version in nixpkgs.
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index 94b7171c02d3..e3c20bebd499 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -109,6 +109,9 @@ in stdenv.mkDerivation rec {
     "${setTarget}.musl-root=${pkgsBuildTarget.targetPackages.stdenv.cc.libc}"
   ] ++ optionals (rust.IsNoStdTarget stdenv.targetPlatform) [
     "--disable-docs"
+  ] ++ optionals (stdenv.isDarwin && stdenv.isx86_64) [
+    # https://github.com/rust-lang/rust/issues/92173
+    "--set rust.jemalloc"
   ];
 
   # The bootstrap.py will generated a Makefile that then executes the build.
@@ -135,6 +138,10 @@ in stdenv.mkDerivation rec {
 
     # Useful debugging parameter
     # export VERBOSE=1
+  '' + lib.optionalString (stdenv.isDarwin && stdenv.isx86_64) ''
+    # See https://github.com/jemalloc/jemalloc/issues/1997
+    # Using a value of 48 should work on both emulated and native x86_64-darwin.
+    export JEMALLOC_SYS_WITH_LG_VADDR=48
   '';
 
   # rustc unfortunately needs cmake to compile llvm-rt but doesn't
@@ -147,9 +154,11 @@ in stdenv.mkDerivation rec {
   ];
 
   buildInputs = [ openssl ]
-    ++ optionals stdenv.isDarwin [ libiconv Security ]
+    ++ optionals stdenv.isDarwin [ Security ]
     ++ optional (!withBundledLLVM) llvmShared;
 
+  depsTargetTargetPropagated = optionals stdenv.isDarwin [ libiconv ];
+
   outputs = [ "out" "man" "doc" ];
   setOutputFlags = false;
 
diff --git a/pkgs/development/embedded/blackmagic/helper.sh b/pkgs/development/embedded/blackmagic/helper.sh
index bae57f633cfb..9185253b39d4 100755
--- a/pkgs/development/embedded/blackmagic/helper.sh
+++ b/pkgs/development/embedded/blackmagic/helper.sh
@@ -11,7 +11,7 @@ out=${out:-/tmp}
 ################################################################################
 export CFLAGS=$NIX_CFLAGS_COMPILE
 export MAKEFLAGS="\
-  ${enableParallelBuilding:+-j${NIX_BUILD_CORES} -l${NIX_BUILD_CORES}}"
+  ${enableParallelBuilding:+-j${NIX_BUILD_CORES}}"
 
 ################################################################################
 PRODUCTS="blackmagic.bin blackmagic.hex blackmagic_dfu.bin blackmagic_dfu.hex"
diff --git a/pkgs/development/interpreters/io/default.nix b/pkgs/development/interpreters/io/default.nix
index 9f6ecb2516ed..0777fb8d48ba 100644
--- a/pkgs/development/interpreters/io/default.nix
+++ b/pkgs/development/interpreters/io/default.nix
@@ -24,13 +24,14 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [
     cmake
+    pkg-config
   ];
 
   buildInputs = [
     zlib sqlite gmp libffi cairo ncurses freetype
     libGLU libGL libpng libtiff libjpeg readline libsndfile libxml2
     freeglut libsamplerate pcre libevent libedit yajl
-    pkg-config glfw openssl libpthreadstubs libXdmcp
+    glfw openssl libpthreadstubs libXdmcp
     libmemcached python3
   ];
 
diff --git a/pkgs/development/interpreters/qnial/default.nix b/pkgs/development/interpreters/qnial/default.nix
index 1173315192e1..74360daa8766 100644
--- a/pkgs/development/interpreters/qnial/default.nix
+++ b/pkgs/development/interpreters/qnial/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
     owner = "vrthra";
   };
 
-  nativeBuildInputs = [ makeWrapper unzip ];
+  nativeBuildInputs = [ makeWrapper unzip pkg-config ];
 
   preConfigure = ''
     cd build;
@@ -25,7 +25,6 @@ stdenv.mkDerivation {
   '';
 
   buildInputs = [
-     pkg-config
      ncurses
   ];
 
diff --git a/pkgs/development/libraries/SDL2/default.nix b/pkgs/development/libraries/SDL2/default.nix
index f73c5746cb71..9900d8874b25 100644
--- a/pkgs/development/libraries/SDL2/default.nix
+++ b/pkgs/development/libraries/SDL2/default.nix
@@ -59,13 +59,13 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "SDL2";
-  version = "2.0.22";
+  version = "2.24.0";
 
   src = fetchurl {
     url = "https://www.libsdl.org/release/${pname}-${version}.tar.gz";
-    sha256 = "sha256-/ny/MSeILj/HJZp1oMtYViAnLFF0XThSq53YeWBpfy4=";
+    sha256 = "sha256-keTDSxdo+S05mweOFxRIxq8Yyv2nQ5h+0gZKKJVNbZc=";
   };
-  dontDisableStatic = withStatic;
+  dontDisableStatic = if withStatic then 1 else 0;
   outputs = [ "out" "dev" ];
   outputBin = "dev"; # sdl-config
 
diff --git a/pkgs/development/libraries/SDL2/find-headers.patch b/pkgs/development/libraries/SDL2/find-headers.patch
index 4792679deb11..8739da91eac1 100644
--- a/pkgs/development/libraries/SDL2/find-headers.patch
+++ b/pkgs/development/libraries/SDL2/find-headers.patch
@@ -1,22 +1,23 @@
 diff --git a/sdl2-config.cmake.in b/sdl2-config.cmake.in
-index c570511fa..ca694f595 100644
+index db864aab9..b94e16043 100644
 --- a/sdl2-config.cmake.in
 +++ b/sdl2-config.cmake.in
-@@ -7,7 +7,8 @@ set(includedir "@includedir@")
- set(SDL2_PREFIX "${prefix}")
- set(SDL2_EXEC_PREFIX "${exec_prefix}")
- set(SDL2_LIBDIR "${libdir}")
--set(SDL2_INCLUDE_DIRS "${includedir}/SDL2")
-+set(SDL2_INCLUDE_DIRS "${includedir}/SDL2" $ENV{SDL2_PATH})
+@@ -26,7 +26,9 @@ set_and_check(SDL2_EXEC_PREFIX    "${exec_prefix}")
+ set_and_check(SDL2_BINDIR         "${bindir}")
+ set_and_check(SDL2_INCLUDE_DIR    "${includedir}/SDL2")
+ set_and_check(SDL2_LIBDIR         "${libdir}")
+-set(SDL2_INCLUDE_DIRS             "${includedir};${SDL2_INCLUDE_DIR}")
++
++set(SDL2_INCLUDE_DIRS "${includedir};${SDL2_INCLUDE_DIR}" $ENV{SDL2_PATH})
 +separate_arguments(SDL2_INCLUDE_DIRS)
- set(SDL2_LIBRARIES "-L${SDL2_LIBDIR} @SDL_RLD_FLAGS@ @SDL_LIBS@")
- string(STRIP "${SDL2_LIBRARIES}" SDL2_LIBRARIES)
  
+ set(SDL2_LIBRARIES SDL2::SDL2)
+ set(SDL2_STATIC_LIBRARIES SDL2::SDL2-static)
 diff --git a/sdl2-config.in b/sdl2-config.in
-index 5a2aed292..7c55f0a28 100644
+index f6eca7668..c0cd94590 100644
 --- a/sdl2-config.in
 +++ b/sdl2-config.in
-@@ -42,7 +42,11 @@ while test $# -gt 0; do
+@@ -46,7 +46,11 @@ while test $# -gt 0; do
        echo @SDL_VERSION@
        ;;
      --cflags)
@@ -29,6 +30,3 @@ index 5a2aed292..7c55f0a28 100644
        ;;
  @ENABLE_SHARED_TRUE@    --libs)
  @ENABLE_SHARED_TRUE@      echo -L@libdir@ @SDL_RLD_FLAGS@ @SDL_LIBS@
--- 
-2.33.1
-
diff --git a/pkgs/development/libraries/SDL2_mixer/default.nix b/pkgs/development/libraries/SDL2_mixer/default.nix
index 2d1ef9853819..7e562dddf0fd 100644
--- a/pkgs/development/libraries/SDL2_mixer/default.nix
+++ b/pkgs/development/libraries/SDL2_mixer/default.nix
@@ -47,6 +47,8 @@ stdenv.mkDerivation rec {
     timidity
   ];
 
+  outputs = [ "out" "dev" ];
+
   # fix default path to timidity.cfg so MIDI files could be played
   postPatch = ''
     substituteInPlace timidity/options.h \
diff --git a/pkgs/development/libraries/allegro/5.nix b/pkgs/development/libraries/allegro/5.nix
index 6bb1a70b8650..0ff8f0ea7fc0 100644
--- a/pkgs/development/libraries/allegro/5.nix
+++ b/pkgs/development/libraries/allegro/5.nix
@@ -18,14 +18,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-uNcaeTelFNfg+YjPYc7nK4TrFDxJsEuPhsF8x1cvIYQ=";
   };
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [
     texinfo libXext xorgproto libX11 libXpm libXt libXcursor
     alsa-lib zlib libpng libvorbis libXxf86dga libXxf86misc
     libXxf86vm openal libGLU libGL
     libjpeg flac
     libXi libXfixes
-    enet libtheora freetype physfs libopus pkg-config gtk3 pcre libXdmcp
+    enet libtheora freetype physfs libopus gtk3 pcre libXdmcp
     libpulseaudio libpthreadstubs
   ];
 
diff --git a/pkgs/development/libraries/apr-util/default.nix b/pkgs/development/libraries/apr-util/default.nix
index b9756e0e1a1a..6f38bfa0d076 100644
--- a/pkgs/development/libraries/apr-util/default.nix
+++ b/pkgs/development/libraries/apr-util/default.nix
@@ -26,8 +26,7 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "dev" ];
   outputBin = "dev";
 
-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = optional stdenv.isFreeBSD autoreconfHook;
+  nativeBuildInputs = [ makeWrapper ] ++ optional stdenv.isFreeBSD autoreconfHook;
 
   configureFlags = [ "--with-apr=${apr.dev}" "--with-expat=${expat.dev}" ]
     ++ optional (!stdenv.isCygwin) "--with-crypto"
diff --git a/pkgs/development/libraries/dssi/default.nix b/pkgs/development/libraries/dssi/default.nix
index 4f7891910a7d..697ff1a857b3 100644
--- a/pkgs/development/libraries/dssi/default.nix
+++ b/pkgs/development/libraries/dssi/default.nix
@@ -11,10 +11,10 @@ stdenv.mkDerivation rec {
     sha256 = "0kl1hzhb7cykzkrqcqgq1dk4xcgrcxv0jja251aq4z4l783jpj7j";
   };
 
-  nativeBuildInputs = [ autoconf automake ];
+  nativeBuildInputs = [ autoconf automake pkg-config ];
   buildInputs =
     [ ladspaH libjack2 liblo alsa-lib qt4 libX11 libsndfile libSM
-      libsamplerate libtool xorgproto libICE pkg-config
+      libsamplerate libtool xorgproto libICE
     ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/expat/default.nix b/pkgs/development/libraries/expat/default.nix
index f20abe0bfc35..71841e0cfbc2 100644
--- a/pkgs/development/libraries/expat/default.nix
+++ b/pkgs/development/libraries/expat/default.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "expat";
-  version = "2.4.8";
+  version = "2.4.9";
 
   src = fetchurl {
     url = "https://github.com/libexpat/libexpat/releases/download/R_${lib.replaceStrings ["."] ["_"] version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-95uPkEt0nj4NIK/q3s+CScVbLjLU67CJrjeN9HncryU=";
+    sha256 = "sha256-bowHKP5cfNP5OmrM5DBGxeRzbHtLaOAy6TUNqg78A1Q=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/ffmpeg/4.nix b/pkgs/development/libraries/ffmpeg/4.nix
index 9e7dcfd751cb..b518b7527ac0 100644
--- a/pkgs/development/libraries/ffmpeg/4.nix
+++ b/pkgs/development/libraries/ffmpeg/4.nix
@@ -1,4 +1,4 @@
-{ callPackage
+{ callPackage, fetchpatch
 # Darwin frameworks
 , Cocoa, CoreMedia, VideoToolbox
 , stdenv, lib
@@ -10,4 +10,11 @@ callPackage ./generic.nix (rec {
   branch = version;
   sha256 = "sha256-+YpIJSDEdQdSGpB5FNqp77wThOBZG1r8PaGKqJfeKUg=";
   darwinFrameworks = [ Cocoa CoreMedia VideoToolbox ];
+  patches = [
+    #  sdl2 recently changed their versioning
+    (fetchpatch {
+      url = "https://git.videolan.org/?p=ffmpeg.git;a=patch;h=e5163b1d34381a3319214a902ef1df923dd2eeba";
+      hash = "sha256-nLhP2+34cj5EgpnUrePZp60nYAxmbhZAEDfay4pBVk0=";
+    })
+  ];
 } // args)
diff --git a/pkgs/development/libraries/frame/default.nix b/pkgs/development/libraries/frame/default.nix
index e96aa9394da9..f0b37b7e633c 100644
--- a/pkgs/development/libraries/frame/default.nix
+++ b/pkgs/development/libraries/frame/default.nix
@@ -9,8 +9,9 @@ stdenv.mkDerivation rec {
     sha256 = "bc2a20cd3ac1e61fe0461bd3ee8cb250dbcc1fa511fad0686d267744e9c78f3a";
   };
 
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = [
-    stdenv pkg-config
+    stdenv
   ] ++ lib.optionals enableX11 [xorg.xorgserver xorg.libX11 xorg.libXext xorg.libXi];
 
   configureFlags = lib.optional enableX11 "--with-x11";
diff --git a/pkgs/development/libraries/ggz_base_libs/default.nix b/pkgs/development/libraries/ggz_base_libs/default.nix
index 687b74fdb3ad..162a64eeb5da 100644
--- a/pkgs/development/libraries/ggz_base_libs/default.nix
+++ b/pkgs/development/libraries/ggz_base_libs/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1cw1vg0fbj36zyggnzidx9cbjwfc1yr4zqmsipxnvns7xa2awbdk";
   };
 
-  buildInputs = [ intltool openssl expat libgcrypt ];
+  nativeBuildInputs = [ intltool ];
+  buildInputs = [ openssl expat libgcrypt ];
 
   patchPhase = ''
     substituteInPlace configure \
diff --git a/pkgs/development/libraries/glew/1.10.nix b/pkgs/development/libraries/glew/1.10.nix
index ab2e740cd864..dadab6e610ff 100644
--- a/pkgs/development/libraries/glew/1.10.nix
+++ b/pkgs/development/libraries/glew/1.10.nix
@@ -16,6 +16,8 @@ stdenv.mkDerivation rec {
   buildInputs = if stdenv.isDarwin then [ AGL ] else [ xlibsWrapper libXmu libXi ];
   propagatedBuildInputs = if stdenv.isDarwin then [ OpenGL ] else [ libGLU ]; # GL/glew.h includes GL/glu.h
 
+  outputs = [ "out" "dev" ];
+
   patchPhase = ''
     sed -i 's|lib64|lib|' config/Makefile.linux
     ${optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
@@ -32,8 +34,8 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     mkdir -pv $out/share/doc/glew
-    mkdir -p $out/lib/pkgconfig
-    cp glew*.pc $out/lib/pkgconfig
+    mkdir -p $dev/lib/pkgconfig
+    cp glew*.pc $dev/lib/pkgconfig
     cp -r README.txt LICENSE.txt doc $out/share/doc/glew
   '';
 
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index 942231ebb3ea..c6da42738c6a 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -96,6 +96,8 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://gitlab.gnome.org/qyliss/glib/-/commit/339a06d66685107280ca6bdca5da5d96b8222fb5.patch";
       sha256 = "sha256-/NdFkuiJvyass3jTDEJPeciA2Lwe53IUd3kAnKAvTaw=";
     })
+    # https://gitlab.gnome.org/GNOME/glib/-/merge_requests/2867
+    ./tests-skip-shared-libs-if-default_library-static.patch
 
     ./skip-timer-test.patch
   ];
diff --git a/pkgs/development/libraries/glib/tests-skip-shared-libs-if-default_library-static.patch b/pkgs/development/libraries/glib/tests-skip-shared-libs-if-default_library-static.patch
new file mode 100644
index 000000000000..681e361896e4
--- /dev/null
+++ b/pkgs/development/libraries/glib/tests-skip-shared-libs-if-default_library-static.patch
@@ -0,0 +1,141 @@
+From b804e4b82cd8e85631112d935543c62ef56783e5 Mon Sep 17 00:00:00 2001
+From: Alyssa Ross <hi@alyssa.is>
+Date: Tue, 23 Aug 2022 13:13:44 +0000
+Subject: [PATCH] tests: skip shared libs if default_library=static
+
+Otherwise, the build will fail when the toolchain is static-only, even
+with -Ddefault_library=static.  I talked to a Meson developer in their
+IRC channel, who told me that the correct fix was to ensure that
+shared_library is only used if default_library != static.
+
+Part-of: https://gitlab.gnome.org/GNOME/glib/-/merge_requests/2867
+[Backported to 2.72.3]
+---
+ gio/tests/meson.build  | 43 +++++++++++++++++++++++-------------------
+ glib/tests/meson.build |  2 +-
+ tests/meson.build      | 30 +++++++++++++++--------------
+ 3 files changed, 41 insertions(+), 34 deletions(-)
+
+diff --git a/gio/tests/meson.build b/gio/tests/meson.build
+index 3ed23a5f2..7b1aba80d 100644
+--- a/gio/tests/meson.build
++++ b/gio/tests/meson.build
+@@ -203,7 +203,7 @@ if host_machine.system() != 'windows'
+   }
+ 
+   # LD_PRELOAD modules don't work so well with AddressSanitizer
+-  if have_rtld_next and get_option('b_sanitize') == 'none'
++  if have_rtld_next and get_option('default_library') != 'static' and get_option('b_sanitize') == 'none'
+     gio_tests += {
+       'gsocketclient-slow' : {
+         'depends' : [
+@@ -607,24 +607,26 @@ if not meson.is_cross_build() or meson.has_exe_wrapper()
+ 
+   compiler_type = '--compiler=@0@'.format(cc.get_id())
+ 
+-  plugin_resources_c = custom_target('plugin-resources.c',
+-    input : 'test4.gresource.xml',
+-    output : 'plugin-resources.c',
+-    command : [glib_compile_resources,
+-               compiler_type,
+-               '--target=@OUTPUT@',
+-               '--sourcedir=' + meson.current_source_dir(),
+-               '--internal',
+-               '--generate-source',
+-               '--c-name', '_g_plugin',
+-               '@INPUT@'])
++  if get_option('default_library') != 'static'
++    plugin_resources_c = custom_target('plugin-resources.c',
++      input : 'test4.gresource.xml',
++      output : 'plugin-resources.c',
++      command : [glib_compile_resources,
++                 compiler_type,
++                 '--target=@OUTPUT@',
++                 '--sourcedir=' + meson.current_source_dir(),
++                 '--internal',
++                 '--generate-source',
++                 '--c-name', '_g_plugin',
++                 '@INPUT@'])
+ 
+-  shared_module('resourceplugin', 'resourceplugin.c', plugin_resources_c,
+-    link_args : export_dynamic_ldflags,
+-    dependencies : common_gio_tests_deps,
+-    install_dir : installed_tests_execdir,
+-    install : installed_tests_enabled
+-  )
++    shared_module('resourceplugin', 'resourceplugin.c', plugin_resources_c,
++      link_args : export_dynamic_ldflags,
++      dependencies : common_gio_tests_deps,
++      install_dir : installed_tests_execdir,
++      install : installed_tests_enabled
++    )
++  endif
+ 
+   # referenced by test2.gresource.xml
+   big_test_resource = custom_target(
+@@ -917,4 +919,7 @@ if installed_tests_enabled
+ endif
+ 
+ subdir('services')
+-subdir('modules')
++
++if get_option('default_library') != 'static'
++  subdir('modules')
++endif
+diff --git a/glib/tests/meson.build b/glib/tests/meson.build
+index 301158e0f..6203ff45e 100644
+--- a/glib/tests/meson.build
++++ b/glib/tests/meson.build
+@@ -172,7 +172,7 @@ else
+     'include' : {},
+     'unix' : {},
+   }
+-  if have_rtld_next
++  if have_rtld_next and get_option('default_library') != 'static'
+     glib_tests += {
+       'gutils-user-database' : {
+         'depends' : [
+diff --git a/tests/meson.build b/tests/meson.build
+index c95fa1d00..25144c941 100644
+--- a/tests/meson.build
++++ b/tests/meson.build
+@@ -72,20 +72,22 @@ if ['darwin', 'ios'].contains(host_machine.system())
+   module_suffix = 'so'
+ endif
+ 
+-foreach module : ['moduletestplugin_a', 'moduletestplugin_b']
+-  shared_module(module + '_plugin', 'lib@0@.c'.format(module),
+-    dependencies : [libglib_dep, libgmodule_dep],
+-    install_dir : installed_tests_execdir,
+-    install : installed_tests_enabled,
+-    name_suffix : module_suffix
+-  )
+-  shared_library(module + '_library', 'lib@0@.c'.format(module),
+-    dependencies : [libglib_dep, libgmodule_dep],
+-    install_dir : installed_tests_execdir,
+-    install : installed_tests_enabled,
+-    name_suffix : module_suffix
+-  )
+-endforeach
++if get_option('default_library') != 'static'
++  foreach module : ['moduletestplugin_a', 'moduletestplugin_b']
++    shared_module(module + '_plugin', 'lib@0@.c'.format(module),
++      dependencies : [libglib_dep, libgmodule_dep],
++      install_dir : installed_tests_execdir,
++      install : installed_tests_enabled,
++      name_suffix : module_suffix
++    )
++    shared_library(module + '_library', 'lib@0@.c'.format(module),
++      dependencies : [libglib_dep, libgmodule_dep],
++      install_dir : installed_tests_execdir,
++      install : installed_tests_enabled,
++      name_suffix : module_suffix
++    )
++  endforeach
++endif
+ 
+ common_c_args = test_cargs + ['-DGLIB_DISABLE_DEPRECATION_WARNINGS']
+ common_deps = [libm, thread_dep, libglib_dep]
+-- 
+2.37.1
+
diff --git a/pkgs/development/libraries/glibc/default.nix b/pkgs/development/libraries/glibc/default.nix
index ec57ef27e946..728b97d2f5f4 100644
--- a/pkgs/development/libraries/glibc/default.nix
+++ b/pkgs/development/libraries/glibc/default.nix
@@ -81,7 +81,7 @@ callPackage ./common.nix { inherit stdenv; } {
 
     postInstall = (if stdenv.hostPlatform == stdenv.buildPlatform then ''
       echo SUPPORTED-LOCALES=C.UTF-8/UTF-8 > ../glibc-2*/localedata/SUPPORTED
-      make -j''${NIX_BUILD_CORES:-1} -l''${NIX_BUILD_CORES:-1} localedata/install-locales
+      make -j''${NIX_BUILD_CORES:-1} localedata/install-locales
     '' else lib.optionalString stdenv.buildPlatform.isLinux ''
       # This is based on http://www.linuxfromscratch.org/lfs/view/development/chapter06/glibc.html
       # Instead of using their patch to build a build-native localedef,
diff --git a/pkgs/development/libraries/gnutls/default.nix b/pkgs/development/libraries/gnutls/default.nix
index 226b91b0ce54..d04fda98c7fe 100644
--- a/pkgs/development/libraries/gnutls/default.nix
+++ b/pkgs/development/libraries/gnutls/default.nix
@@ -22,11 +22,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gnutls";
-  version = "3.7.7";
+  version = "3.7.8";
 
   src = fetchurl {
     url = "mirror://gnupg/gnutls/v${lib.versions.majorMinor version}/gnutls-${version}.tar.xz";
-    sha256 = "sha256-vpFD0NWOq2TbqbdxFKqvrFKbbA1+gd5r3xybWQJ9IQY=";
+    sha256 = "sha256-xYrTmvBnDv5qiu5eOosjMaEgBBi2S3xRl3+zltRhcRQ=";
   };
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix
index b378c81c89f4..e9f324b24533 100644
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, substituteAll
 , meson
 , ninja
 , gettext
@@ -19,6 +20,7 @@
 , libkate
 , lrdf
 , ladspaH
+, lcms2
 , libnice
 , webrtc-audio-processing
 , webrtc-audio-processing_1
@@ -77,6 +79,7 @@
 , mjpegtools
 , libGLU
 , libGL
+, addOpenGLRunpath
 , libintl
 , game-music-emu
 , openssl
@@ -108,6 +111,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-ehHBO1XdHSOG3ZAiGeQcv83ajh4Ko+c4GGyVB0s12k8=";
   };
 
+  patches = [
+    # Add fallback paths for nvidia userspace libraries
+    (substituteAll {
+      src = ./fix-paths.patch;
+      inherit (addOpenGLRunpath) driverLink;
+    })
+  ];
+
   nativeBuildInputs = [
     meson
     ninja
@@ -126,6 +137,7 @@ stdenv.mkDerivation rec {
     gst-plugins-base
     orc
     json-glib
+    lcms2
     ldacbt
     libass
     libkate
diff --git a/pkgs/development/libraries/gstreamer/bad/fix-paths.patch b/pkgs/development/libraries/gstreamer/bad/fix-paths.patch
new file mode 100644
index 000000000000..dfb8f5462c45
--- /dev/null
+++ b/pkgs/development/libraries/gstreamer/bad/fix-paths.patch
@@ -0,0 +1,48 @@
+diff --git a/sys/nvcodec/gstcudaloader.c b/sys/nvcodec/gstcudaloader.c
+index 4223ba1fbd..ca8bb5ceb1 100644
+--- a/sys/nvcodec/gstcudaloader.c
++++ b/sys/nvcodec/gstcudaloader.c
+@@ -135,6 +135,11 @@ gst_cuda_load_library (void)
+     return TRUE;
+ 
+   module = g_module_open (filename, G_MODULE_BIND_LAZY);
++
++  if (module == NULL) {
++    module = g_module_open("@driverLink@/lib/" CUDA_LIBNAME, G_MODULE_BIND_LAZY);
++  }
++
+   if (module == NULL) {
+     GST_WARNING ("Could not open library %s, %s", filename, g_module_error ());
+     return FALSE;
+diff --git a/sys/nvcodec/gstcuvidloader.c b/sys/nvcodec/gstcuvidloader.c
+index 3c7505ca36..eeb376fa80 100644
+--- a/sys/nvcodec/gstcuvidloader.c
++++ b/sys/nvcodec/gstcuvidloader.c
+@@ -85,6 +85,11 @@ gst_cuvid_load_library (guint api_major_ver, guint api_minor_ver)
+     return TRUE;
+ 
+   module = g_module_open (filename, G_MODULE_BIND_LAZY);
++
++  if (module == NULL) {
++    module = g_module_open ("@driverLink@/lib/" NVCUVID_LIBNAME, G_MODULE_BIND_LAZY);
++  }
++
+   if (module == NULL) {
+     GST_WARNING ("Could not open library %s, %s", filename, g_module_error ());
+     return FALSE;
+diff --git a/sys/nvcodec/gstnvenc.c b/sys/nvcodec/gstnvenc.c
+index 19637671ad..39858ccdee 100644
+--- a/sys/nvcodec/gstnvenc.c
++++ b/sys/nvcodec/gstnvenc.c
+@@ -874,6 +874,11 @@ gst_nvenc_load_library (guint * api_major_ver, guint * api_minor_ver)
+   };
+ 
+   module = g_module_open (NVENC_LIBRARY_NAME, G_MODULE_BIND_LAZY);
++
++  if (module == NULL) {
++    module = g_module_open ("@driverLink@/lib/" NVENC_LIBRARY_NAME, G_MODULE_BIND_LAZY);
++  }
++
+   if (module == NULL) {
+     GST_WARNING ("Could not open library %s, %s",
+         NVENC_LIBRARY_NAME, g_module_error ());
diff --git a/pkgs/development/libraries/gtk-engines/default.nix b/pkgs/development/libraries/gtk-engines/default.nix
index e553efa5f252..d722143b210e 100644
--- a/pkgs/development/libraries/gtk-engines/default.nix
+++ b/pkgs/development/libraries/gtk-engines/default.nix
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "1db65pb0j0mijmswrvpgkdabilqd23x22d95hp5kwxvcramq1dhm";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ intltool gtk2 ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ gtk2 ];
 
   meta = {
     description = "Theme engines for GTK 2";
diff --git a/pkgs/development/libraries/gtkspell/default.nix b/pkgs/development/libraries/gtkspell/default.nix
index aca6ccdcccbc..6f48ba4e2668 100644
--- a/pkgs/development/libraries/gtkspell/default.nix
+++ b/pkgs/development/libraries/gtkspell/default.nix
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "00hdv28bp72kg1mq2jdz1sdw2b8mb9iclsp7jdqwpck705bdriwg";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [aspell gtk2 enchant intltool];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [aspell gtk2 enchant];
 
   meta = with lib; {
     description = "Word-processor-style highlighting and replacement of misspelled words";
diff --git a/pkgs/development/libraries/imlib2/default.nix b/pkgs/development/libraries/imlib2/default.nix
index 38370814b5ac..66092f436509 100644
--- a/pkgs/development/libraries/imlib2/default.nix
+++ b/pkgs/development/libraries/imlib2/default.nix
@@ -6,9 +6,9 @@
 , libid3tag, librsvg, libheif
 , freetype , bzip2, pkg-config
 , x11Support ? true
+, webpSupport ? true
 , svgSupport ? false
 , heifSupport ? false
-, webpSupport ? false
 , jxlSupport ? false
 , psSupport ? false
 
diff --git a/pkgs/development/libraries/kerberos/krb5.nix b/pkgs/development/libraries/kerberos/krb5.nix
index 7397824f9a76..a7197f9ff984 100644
--- a/pkgs/development/libraries/kerberos/krb5.nix
+++ b/pkgs/development/libraries/kerberos/krb5.nix
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
   buildPhase = lib.optionalString libOnly ''
     runHook preBuild
 
-    MAKE="make -j $NIX_BUILD_CORES -l $NIX_BUILD_CORES"
+    MAKE="make -j $NIX_BUILD_CORES"
     for folder in $libFolders; do
       $MAKE -C $folder
     done
diff --git a/pkgs/development/libraries/libdrm/default.nix b/pkgs/development/libraries/libdrm/default.nix
index e49a903730b9..72ecdc51ab13 100644
--- a/pkgs/development/libraries/libdrm/default.nix
+++ b/pkgs/development/libraries/libdrm/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libdrm";
-  version = "2.4.112";
+  version = "2.4.113";
 
   src = fetchurl {
     url = "https://dri.freedesktop.org/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1zr0hi7k5s7my4q9hyj6ryzg89zyjx24zbqfv3c5rcq9pl87gc00";
+    sha256 = "sha256-f9frKWf2O+tGBvItUOJ32ZNIDQXvdd2Iqb2OZ3Mj5eE=";
   };
 
   outputs = [ "out" "dev" "bin" ];
@@ -20,10 +20,11 @@ stdenv.mkDerivation rec {
 
   mesonFlags = [
     "-Dinstall-test-programs=true"
-    "-Domap=true"
+    "-Domap=enabled"
+    "-Dcairo-tests=disabled"
   ] ++ lib.optionals stdenv.hostPlatform.isAarch [
-    "-Dtegra=true"
-    "-Detnaviv=true"
+    "-Dtegra=enabled"
+    "-Detnaviv=enabled"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/liberfa/default.nix b/pkgs/development/libraries/liberfa/default.nix
index 8edc3d7b5a52..b59d3aab4a33 100644
--- a/pkgs/development/libraries/liberfa/default.nix
+++ b/pkgs/development/libraries/liberfa/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
   pname = "erfa";
   version = "2.0.0";
 
-  buildInputs = [ autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook ];
 
   src = fetchFromGitHub {
     owner = "liberfa";
diff --git a/pkgs/development/libraries/libextractor/default.nix b/pkgs/development/libraries/libextractor/default.nix
index 7251e5b645be..29762e231f2d 100644
--- a/pkgs/development/libraries/libextractor/default.nix
+++ b/pkgs/development/libraries/libextractor/default.nix
@@ -45,10 +45,11 @@ stdenv.mkDerivation rec {
            -e "s|pexe[[:blank:]]*=.*$|pexe = strdup(\"$out/lib/\");|g"
     '';
 
+  nativeBuildInputs = [ pkg-config ];
+
   buildInputs =
    [ libtool gettext zlib bzip2 flac libvorbis exiv2
      libgsf rpm
-     pkg-config
    ] ++ lib.optionals gstreamerSupport
           ([ gst_all_1.gstreamer ] ++ gstPlugins gst_all_1)
      ++ lib.optionals gtkSupport [ glib gtk3 ]
diff --git a/pkgs/development/libraries/libffi/default.nix b/pkgs/development/libraries/libffi/default.nix
index 4c3e00150abf..2904e6e45671 100644
--- a/pkgs/development/libraries/libffi/default.nix
+++ b/pkgs/development/libraries/libffi/default.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libffi";
-  version = "3.4.2";
+  version = "3.4.3";
 
   src = fetchurl {
     url = "https://github.com/libffi/libffi/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "081nx7wpzds168jbr59m34n6s3lyiq6r8zggvqxvlslsc4hvf3sl";
+    sha256 = "sha256-RBbdkrauj8tbEEIecRxNPLMSA9d1Iad9hdAQIxHmw7g=";
   };
 
   # Note: this package is used for bootstrapping fetchurl, and thus
@@ -21,7 +21,6 @@ stdenv.mkDerivation rec {
   # cgit) that are needed here should be included directly in Nixpkgs as
   # files.
   patches = [
-    ./libffi-powerpc64.patch
   ];
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/libffi/libffi-powerpc64.patch b/pkgs/development/libraries/libffi/libffi-powerpc64.patch
deleted file mode 100644
index 5748ac084982..000000000000
--- a/pkgs/development/libraries/libffi/libffi-powerpc64.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-https://github.com/libffi/libffi/issues/668
---- a/src/powerpc/linux64.S
-+++ b/src/powerpc/linux64.S
-@@ -29,6 +29,8 @@
- #include <fficonfig.h>
- #include <ffi.h>
- 
-+	.machine altivec
-+
- #ifdef POWERPC64
- 	.hidden	ffi_call_LINUX64
- 	.globl	ffi_call_LINUX64
---- a/src/powerpc/linux64_closure.S
-+++ b/src/powerpc/linux64_closure.S
-@@ -30,6 +30,8 @@
- 
- 	.file	"linux64_closure.S"
- 
-+	.machine altivec
-+
- #ifdef POWERPC64
- 	FFI_HIDDEN (ffi_closure_LINUX64)
- 	.globl  ffi_closure_LINUX64
diff --git a/pkgs/development/libraries/libfido2/default.nix b/pkgs/development/libraries/libfido2/default.nix
index d7c034b9e98b..bd4d21fe1b90 100644
--- a/pkgs/development/libraries/libfido2/default.nix
+++ b/pkgs/development/libraries/libfido2/default.nix
@@ -29,6 +29,8 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ openssl ];
 
+  outputs = [ "out" "dev" "man" ];
+
   cmakeFlags = [
     "-DUDEV_RULES_DIR=${placeholder "out"}/etc/udev/rules.d"
     "-DCMAKE_INSTALL_LIBDIR=lib"
diff --git a/pkgs/development/libraries/libinklevel/default.nix b/pkgs/development/libraries/libinklevel/default.nix
index dffbcdd69d10..f9c711df7043 100644
--- a/pkgs/development/libraries/libinklevel/default.nix
+++ b/pkgs/development/libraries/libinklevel/default.nix
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-J0cEaC5v4naO4GGUzdfV55kB7KzA+q+v64i5y5Xbp9Q=";
   };
 
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = [
-    pkg-config
     libusb1
   ];
 
diff --git a/pkgs/development/libraries/libmikmod/default.nix b/pkgs/development/libraries/libmikmod/default.nix
index c7a00e7372dd..29f64116b7a8 100644
--- a/pkgs/development/libraries/libmikmod/default.nix
+++ b/pkgs/development/libraries/libmikmod/default.nix
@@ -18,8 +18,14 @@ in stdenv.mkDerivation rec {
   propagatedBuildInputs =
     optional stdenv.isLinux libpulseaudio;
 
+  outputs = [ "out" "dev" "man" ];
+
   NIX_LDFLAGS = optionalString stdenv.isLinux "-lasound";
 
+  postInstall = ''
+    moveToOutput bin/libmikmod-config "$dev"
+  '';
+
   meta = with lib; {
     description = "A library for playing tracker music module files";
     homepage    = "https://mikmod.shlomifish.org/";
diff --git a/pkgs/development/libraries/libmx/default.nix b/pkgs/development/libraries/libmx/default.nix
index be4cdd62f6e1..6cff9e3f03aa 100644
--- a/pkgs/development/libraries/libmx/default.nix
+++ b/pkgs/development/libraries/libmx/default.nix
@@ -33,10 +33,9 @@ stdenv.mkDerivation rec {
 
   configureScript = "sh autogen.sh";
 
-  nativeBuildInputs = [ pkg-config automake autoconf ];
+  nativeBuildInputs = [ pkg-config automake autoconf intltool ];
   buildInputs = [
     libtool
-    intltool
     gobject-introspection glib
     gtk2 gtk-doc clutter clutter-gtk
   ];
diff --git a/pkgs/development/libraries/libpfm/default.nix b/pkgs/development/libraries/libpfm/default.nix
index 20c4c0a1c6e2..3006efe9b293 100644
--- a/pkgs/development/libraries/libpfm/default.nix
+++ b/pkgs/development/libraries/libpfm/default.nix
@@ -3,12 +3,12 @@
 }:
 
 stdenv.mkDerivation (rec {
-  version = "4.11.0";
+  version = "4.12.0";
   pname = "libpfm";
 
   src = fetchurl {
     url = "mirror://sourceforge/perfmon2/libpfm4/${pname}-${version}.tar.gz";
-    sha256 = "1k7yp6xfsglp2b6271r622sjinlbys0dk24n9iiv656y5f3zi9ax";
+    sha256 = "sha256-SwwfU/OaYVJbab6/UyxoBAwbmE11RKiuCESxPNkeHuQ=";
   };
 
   makeFlags = [
diff --git a/pkgs/development/libraries/libpipeline/default.nix b/pkgs/development/libraries/libpipeline/default.nix
index 9e2c83427762..f682d394c159 100644
--- a/pkgs/development/libraries/libpipeline/default.nix
+++ b/pkgs/development/libraries/libpipeline/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libpipeline";
-  version = "1.5.4";
+  version = "1.5.6";
 
   src = fetchurl {
     url = "mirror://savannah/libpipeline/libpipeline-${version}.tar.gz";
-    sha256 = "sha256-23hb3boKN+8UtO+Cri0YuIJOaYPfuZEDGTheKN8/Gpw=";
+    sha256 = "sha256-YPu559w5hSjl86d2r1e7KMo/5dnwzYqWGsbOv+bpt5c=";
   };
 
   patches = lib.optionals stdenv.isDarwin [ ./fix-on-osx.patch ];
diff --git a/pkgs/development/libraries/libspectre/default.nix b/pkgs/development/libraries/libspectre/default.nix
index 81e661a94214..2d916fa9a939 100644
--- a/pkgs/development/libraries/libspectre/default.nix
+++ b/pkgs/development/libraries/libspectre/default.nix
@@ -11,9 +11,11 @@ stdenv.mkDerivation rec {
 
   patches = [ ./libspectre-0.2.7-gs918.patch ];
 
+  nativeBuildInputs = [ pkg-config ];
+
   buildInputs = [
     # Need `libgs.so'.
-    pkg-config ghostscript cairo /*for tests*/
+    ghostscript cairo /*for tests*/
   ];
 
   doCheck = true;
diff --git a/pkgs/development/libraries/libspng/default.nix b/pkgs/development/libraries/libspng/default.nix
index dba098b4468a..077b414a665d 100644
--- a/pkgs/development/libraries/libspng/default.nix
+++ b/pkgs/development/libraries/libspng/default.nix
@@ -38,13 +38,13 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    pkg-config
     zlib
   ];
 
   nativeBuildInputs = [
     ninja
     meson
+    pkg-config
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/libwnck/2.nix b/pkgs/development/libraries/libwnck/2.nix
index fd7d80574a7d..a1f54006beb5 100644
--- a/pkgs/development/libraries/libwnck/2.nix
+++ b/pkgs/development/libraries/libwnck/2.nix
@@ -12,8 +12,8 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "dev" "devdoc" ];
   outputBin = "dev";
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ gtk2 intltool xorg.libX11 xorg.libXres ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ gtk2 xorg.libX11 xorg.libXres ];
   # ?another optional: startup-notification
 
   configureFlags = [ "--disable-introspection" ]; # not needed anywhere AFAIK
diff --git a/pkgs/development/libraries/mlt/qt-5.nix b/pkgs/development/libraries/mlt/qt-5.nix
index 9b312a2d5ef1..dad94c29d724 100644
--- a/pkgs/development/libraries/mlt/qt-5.nix
+++ b/pkgs/development/libraries/mlt/qt-5.nix
@@ -45,7 +45,6 @@ mkDerivation rec {
     libvorbis
     libxml2
     movit
-    pkg-config
     qtbase
     qtsvg
     sox
@@ -56,7 +55,7 @@ mkDerivation rec {
     ladspaPlugins
   ];
 
-  nativeBuildInputs = [ cmake which ];
+  nativeBuildInputs = [ cmake which pkg-config ];
 
   outputs = [ "out" "dev" ];
 
diff --git a/pkgs/development/libraries/ogre/default.nix b/pkgs/development/libraries/ogre/default.nix
index e93dfdfb144e..2017d5435ea4 100644
--- a/pkgs/development/libraries/ogre/default.nix
+++ b/pkgs/development/libraries/ogre/default.nix
@@ -57,7 +57,6 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake unzip pkg-config ];
   buildInputs =
     [
-      cmake
       libGLU
       libGL
       freetype
diff --git a/pkgs/development/libraries/openal-soft/default.nix b/pkgs/development/libraries/openal-soft/default.nix
index b9471d681937..8164a4264e6e 100644
--- a/pkgs/development/libraries/openal-soft/default.nix
+++ b/pkgs/development/libraries/openal-soft/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config
+{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, removeReferencesTo
 , alsaSupport ? !stdenv.isDarwin, alsa-lib
 , dbusSupport ? !stdenv.isDarwin, dbus
 , pipewireSupport ? !stdenv.isDarwin, pipewire
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
 
   strictDeps = true;
 
-  nativeBuildInputs = [ cmake pkg-config ];
+  nativeBuildInputs = [ cmake pkg-config removeReferencesTo ];
 
   buildInputs = lib.optional alsaSupport alsa-lib
     ++ lib.optional dbusSupport dbus
@@ -46,6 +46,10 @@ stdenv.mkDerivation rec {
     "-DOSS_INCLUDE_DIR=${stdenv.cc.libc}/include"
   ];
 
+  postInstall = lib.optional pipewireSupport ''
+    remove-references-to -t ${pipewire.dev} $(readlink -f $out/lib/*.so)
+  '';
+
   meta = with lib; {
     description = "OpenAL alternative";
     homepage = "https://openal-soft.org/";
diff --git a/pkgs/development/libraries/opencl-headers/default.nix b/pkgs/development/libraries/opencl-headers/default.nix
index 879a916d3ea6..273cdea6f8c9 100644
--- a/pkgs/development/libraries/opencl-headers/default.nix
+++ b/pkgs/development/libraries/opencl-headers/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "opencl-headers";
-  version = "2021.06.30";
+  version = "2022.09.23";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "OpenCL-Headers";
     rev = "v${version}";
-    sha256 = "sha256-MdKC48f1zhVAcHrqzrgT9iaYrHXurV8vDt+GnDroO9s=";
+    sha256 = "sha256-kBXkevcapVfpFmI5C77DwULrC8zjcoto+veb49Ksixk=";
   };
 
   installPhase = ''
diff --git a/pkgs/development/libraries/openh264/default.nix b/pkgs/development/libraries/openh264/default.nix
index e85589af0c1a..479ffbc78eee 100644
--- a/pkgs/development/libraries/openh264/default.nix
+++ b/pkgs/development/libraries/openh264/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openh264";
-  version = "2.3.0";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "cisco";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-OSTsU2E4UWiwBqq3NqD0lj8uqVXeyd3MJ/gre6W2Jvs=";
+    sha256 = "sha256-L5u0xkoza3G1ZHdtJH7ayVOgcVbPWYp7MC3lJd7LsSY=";
   };
 
   nativeBuildInputs = [ nasm ];
diff --git a/pkgs/development/libraries/openjpeg/default.nix b/pkgs/development/libraries/openjpeg/default.nix
index b26738c9ea15..8dd2415433a6 100644
--- a/pkgs/development/libraries/openjpeg/default.nix
+++ b/pkgs/development/libraries/openjpeg/default.nix
@@ -1,75 +1,64 @@
 { lib, stdenv, fetchFromGitHub, fetchpatch, cmake, pkg-config
-, libpng, libtiff, lcms2, jpylyzer
-, mj2Support ? true # MJ2 executables
-, jpwlLibSupport ? true # JPWL library & executables
+, libdeflate, libpng, libtiff, zlib, lcms2, jpylyzer
 , jpipLibSupport ? false # JPIP library & executables
-, jpipServerSupport ? false, curl ? null, fcgi ? null # JPIP Server
-#, opjViewerSupport ? false, wxGTK ? null # OPJViewer executable
+, jpipServerSupport ? false, curl, fcgi # JPIP Server
+, opjViewerSupport ? false, wxGTK # OPJViewer executable
 , openjpegJarSupport ? false # Openjpeg jar (Java)
-, jp3dSupport ? true # # JP3D comp
-, thirdPartySupport ? false # Third party libraries - OFF: only build when found, ON: always build
-, testsSupport ? true
-, jdk ? null
+, jdk
+, poppler
 }:
 
-assert jpipServerSupport -> jpipLibSupport && curl != null && fcgi != null;
-#assert opjViewerSupport -> (wxGTK != null);
-assert (openjpegJarSupport || jpipLibSupport) -> jdk != null;
-
 let
-  inherit (lib) optional optionals;
   mkFlag = optSet: flag: "-D${flag}=${if optSet then "ON" else "OFF"}";
 in
 
 stdenv.mkDerivation rec {
   pname = "openjpeg";
-  version = "2.4.0"; # don't forget to change passthru.incDir
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "uclouvain";
     repo = "openjpeg";
     rev = "v${version}";
-    sha256 = "143dvy5g6v6129lzvl0r8mrgva2fppkn0zl099qmi9yi9l9h7yyf";
+    sha256 = "sha256-/0o3Fl6/jx5zu854TCqMyOz/8mnEyEC9lpZ6ij/tbHc=";
   };
 
+  outputs = [ "out" "dev" ];
+
   patches = [
-    ./fix-cmake-config-includedir.patch
+    # modernise cmake files, also fixes them for multiple outputs
     (fetchpatch {
-      url = "https://patch-diff.githubusercontent.com/raw/uclouvain/openjpeg/pull/1321.patch";
-      sha256 = "1cjpr76nf9g65nqkfnxnjzi3bv7ifbxpc74kxxibh58pzjlp6al8";
+      url = "https://github.com/uclouvain/openjpeg/pull/1424.patch";
+      sha256 = "sha256-CxVRt1u4HVOMUjWiZ2plmZC29t/zshCpSY+N4Wlrlvg=";
+    })
+    # fix cmake files cross compilation
+    (fetchpatch {
+      url = "https://github.com/uclouvain/openjpeg/commit/c6ceb84c221b5094f1e8a4c0c247dee3fb5074e8.patch";
+      sha256 = "sha256-gBUtmO/7RwSWEl7rc8HGr8gNtvNFdhjEwm0Dd51p5O8=";
     })
   ];
 
-  outputs = [ "out" "dev" ];
-
   cmakeFlags = [
     "-DCMAKE_INSTALL_NAME_DIR=\${CMAKE_INSTALL_PREFIX}/lib"
     "-DBUILD_SHARED_LIBS=ON"
     "-DBUILD_CODEC=ON"
-    (mkFlag mj2Support "BUILD_MJ2")
-    (mkFlag jpwlLibSupport "BUILD_JPWL")
+    "-DBUILD_THIRDPARTY=OFF"
     (mkFlag jpipLibSupport "BUILD_JPIP")
     (mkFlag jpipServerSupport "BUILD_JPIP_SERVER")
-    #(mkFlag opjViewerSupport "BUILD_VIEWER")
-    "-DBUILD_VIEWER=OFF"
+    (mkFlag opjViewerSupport "BUILD_VIEWER")
     (mkFlag openjpegJarSupport "BUILD_JAVA")
-    (mkFlag jp3dSupport "BUILD_JP3D")
-    (mkFlag thirdPartySupport "BUILD_THIRDPARTY")
-    (mkFlag testsSupport "BUILD_TESTING")
-    "-DOPENJPEG_INSTALL_INCLUDE_DIR=${placeholder "dev"}/include/${passthru.incDir}"
-    "-DOPENJPEG_INSTALL_PACKAGE_DIR=${placeholder "dev"}/lib/${passthru.incDir}"
+    (mkFlag doCheck "BUILD_TESTING")
   ];
 
   nativeBuildInputs = [ cmake pkg-config ];
 
-  buildInputs = [ ]
-    ++ optionals jpipServerSupport [ curl fcgi ]
-    #++ optional opjViewerSupport wxGTK
-    ++ optional (openjpegJarSupport || jpipLibSupport) jdk;
+  buildInputs = [ libdeflate libpng libtiff zlib lcms2 ]
+    ++ lib.optionals jpipServerSupport [ curl fcgi ]
+    ++ lib.optional opjViewerSupport wxGTK
+    ++ lib.optional (openjpegJarSupport || jpipLibSupport) jdk;
 
-  propagatedBuildInputs = [ libpng libtiff lcms2 ];
+  doCheck = (!stdenv.isAarch64 && !stdenv.hostPlatform.isPower64); # tests fail on aarch64-linux and powerpc64
 
-  doCheck = (testsSupport && !stdenv.isAarch64 && !stdenv.hostPlatform.isPower64); # tests fail on aarch64-linux and powerpc64
   checkPhase = ''
     substituteInPlace ../tools/ctest_scripts/travis-ci.cmake \
       --replace "JPYLYZER_EXECUTABLE=" "JPYLYZER_EXECUTABLE=\"${jpylyzer}/bin/jpylyzer\" # "
@@ -77,7 +66,10 @@ stdenv.mkDerivation rec {
   '';
 
   passthru = {
-    incDir = "openjpeg-2.4";
+    incDir = "openjpeg-${lib.versions.majorMinor version}";
+    tests = {
+      inherit poppler;
+    };
   };
 
   meta = with lib; {
@@ -86,5 +78,7 @@ stdenv.mkDerivation rec {
     license = licenses.bsd2;
     maintainers = with maintainers; [ codyopel ];
     platforms = platforms.all;
+    # opj viewer fails to compile with lots of errors, jar requires openjpeg library already compiled and installed
+    broken = (opjViewerSupport || openjpegJarSupport);
   };
 }
diff --git a/pkgs/development/libraries/openjpeg/fix-cmake-config-includedir.patch b/pkgs/development/libraries/openjpeg/fix-cmake-config-includedir.patch
deleted file mode 100644
index 21306400dd46..000000000000
--- a/pkgs/development/libraries/openjpeg/fix-cmake-config-includedir.patch
+++ /dev/null
@@ -1,44 +0,0 @@
---- a/src/lib/openjp2/libopenjp2.pc.cmake.in
-+++ b/src/lib/openjp2/libopenjp2.pc.cmake.in
-@@ -3,7 +3,7 @@
- mandir=${prefix}/@OPENJPEG_INSTALL_MAN_DIR@
- docdir=${prefix}/@OPENJPEG_INSTALL_DOC_DIR@
- libdir=${prefix}/@OPENJPEG_INSTALL_LIB_DIR@
--includedir=${prefix}/@OPENJPEG_INSTALL_INCLUDE_DIR@
-+includedir=@OPENJPEG_INSTALL_INCLUDE_DIR@
- 
- Name: openjp2
- Description: JPEG2000 library (Part 1 and 2)
---- a/src/lib/openjp3d/libopenjp3d.pc.cmake.in
-+++ b/src/lib/openjp3d/libopenjp3d.pc.cmake.in
-@@ -3,7 +3,7 @@
- mandir=${prefix}/@OPENJPEG_INSTALL_MAN_DIR@
- docdir=${prefix}/@OPENJPEG_INSTALL_DOC_DIR@
- libdir=${prefix}/@OPENJPEG_INSTALL_LIB_DIR@
--includedir=${prefix}/@OPENJPEG_INSTALL_INCLUDE_DIR@
-+includedir=@OPENJPEG_INSTALL_INCLUDE_DIR@
- 
- Name: openjp3d
- Description: JPEG2000 Extensions for three-dimensional data (Part 10)
---- a/src/lib/openjpip/libopenjpip.pc.cmake.in
-+++ b/src/lib/openjpip/libopenjpip.pc.cmake.in
-@@ -3,7 +3,7 @@
- mandir=${prefix}/@OPENJPEG_INSTALL_MAN_DIR@
- docdir=${prefix}/@OPENJPEG_INSTALL_DOC_DIR@
- libdir=${prefix}/@OPENJPEG_INSTALL_LIB_DIR@
--includedir=${prefix}/@OPENJPEG_INSTALL_INCLUDE_DIR@
-+includedir=@OPENJPEG_INSTALL_INCLUDE_DIR@
- 
- Name: openjpip
- Description: JPEG2000 Interactivity tools, APIs and protocols (Part 9)
---- a/src/lib/openjpwl/libopenjpwl.pc.cmake.in
-+++ b/src/lib/openjpwl/libopenjpwl.pc.cmake.in
-@@ -3,7 +3,7 @@
- mandir=${prefix}/@OPENJPEG_INSTALL_MAN_DIR@
- docdir=${prefix}/@OPENJPEG_INSTALL_DOC_DIR@
- libdir=${prefix}/@OPENJPEG_INSTALL_LIB_DIR@
--includedir=${prefix}/@OPENJPEG_INSTALL_INCLUDE_DIR@
-+includedir=@OPENJPEG_INSTALL_INCLUDE_DIR@
- 
- Name: openjpwl
- Description: JPEG2000 Wireless library (Part 11)
diff --git a/pkgs/development/libraries/plasma-wayland-protocols/default.nix b/pkgs/development/libraries/plasma-wayland-protocols/default.nix
index 3f0980046d59..74e4f6c5100d 100644
--- a/pkgs/development/libraries/plasma-wayland-protocols/default.nix
+++ b/pkgs/development/libraries/plasma-wayland-protocols/default.nix
@@ -7,11 +7,11 @@
 
 mkDerivation rec {
   pname = "plasma-wayland-protocols";
-  version = "1.8.0";
+  version = "1.9.0";
 
   src = fetchurl {
     url = "mirror://kde/stable/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-XQ+gyaC0SAAeCEJSQfI1/PuiW7xizkPAUK0dgI1X3Xo=";
+    sha256 = "sha256-pCdbmoVHFvpe2cK6LWl98rB0n8RaKK2WXmjQqjbF1Mg=";
   };
 
   nativeBuildInputs = [ extra-cmake-modules ];
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
index 37685b07d344..033331c474ab 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
+++ b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
@@ -1,207 +1,207 @@
 {
   "qt3d": {
     "url": "https://invent.kde.org/qt/qt/qt3d.git",
-    "rev": "3cc801c4ae41ff3f155258c4bf7e21bb5b3f6a3d",
-    "sha256": "0ia17cn59100n4qkxc1bdn36knqpdqy1dx06la4qlhvm6hzb7wpj"
+    "rev": "fe5fca853c09c7e03a2ff66dac21584e3307984d",
+    "sha256": "0z8vkr3a20sb428m5kizgj33fkrznqzhwc0mh1rdqivlcsfp4kfi"
   },
   "qtactiveqt": {
     "url": "https://invent.kde.org/qt/qt/qtactiveqt.git",
-    "rev": "a4211b21b09a1b98020522bc058e0ee2d6ed2e1d",
-    "sha256": "1gdnqhx75iwja50nhvdb8fxbdcpw18pc6xpd105kj4j62f73j1hq"
+    "rev": "ccc9a61d10404a4999dec61fdb513aa50f265cc3",
+    "sha256": "1l4h721shvc5cy5n2ykj0bhi5bgn3c8w1dmiwxh45rnb6qz971da"
   },
   "qtandroidextras": {
     "url": "https://invent.kde.org/qt/qt/qtandroidextras.git",
-    "rev": "45ce7b075b5dd19744b9446aa9e8ceb1d099d8b9",
-    "sha256": "15b7258mjdxbqpgr9bjhysagznnx97l2948c15xjpb77sc8l0wlh"
+    "rev": "1d9324ce38ce5100d827942eda67fe634753655b",
+    "sha256": "1k00pibnadgjnvv42kfq5pynr0gljv35hri6k5gfswqw347dr6f8"
   },
   "qtbase": {
     "url": "https://invent.kde.org/qt/qt/qtbase.git",
-    "rev": "aa0c6db334cf6f0887f42cbd82e4af258126bdc5",
-    "sha256": "0gxlqkag06fd7jbk7kjcjxxa3wxm27fa9vdd4hzq5gkq5y1hslaw"
+    "rev": "e44097b63d17ba3178a637df7fac51ddc51cb48b",
+    "sha256": "071q48qnszwqkmdpf14nqzbyqs62apfjhm0640fggv5ydgrbqw6j"
   },
   "qtcharts": {
     "url": "https://invent.kde.org/qt/qt/qtcharts.git",
-    "rev": "9a569795f0c3f41ec093e4aa5842a463e2755edb",
-    "sha256": "12w48q59xcr0l1s941pnsp5s8xk5knis9c1cry6kvybiq51hl77n"
+    "rev": "841083c263f16f8acb81e4915bf24bbed0461c9a",
+    "sha256": "1iic9q8qj6bz6qznfr0jdjdi3a72lb433d0k711cfz2np2i8ajz1"
   },
   "qtconnectivity": {
     "url": "https://invent.kde.org/qt/qt/qtconnectivity.git",
-    "rev": "42c25efeaa409f711af1bd9a8144b445741ee114",
-    "sha256": "0bj28j5ksr95bj9vmqcahvx3a5bc8kd9kkd6q8nsg7ak0bm0cm2p"
+    "rev": "01e8b04b121712ea0a2b2793ce13f4dd5e9cfcf8",
+    "sha256": "1mgm4dpsw7k79znw0h72h614i0lvivvbp8w67np2nqp411wghgaa"
   },
   "qtdatavis3d": {
     "url": "https://invent.kde.org/qt/qt/qtdatavis3d.git",
-    "rev": "a32c95d27224c6c9e41d6080ea54bc937c5d1455",
-    "sha256": "105cdvz8y48lhyn1s5w8ckcd0vk2gq7aqnmndiq45k1c8nikn2ry"
+    "rev": "502612c72a2cd3b3b0c4cff926e7764d74106d33",
+    "sha256": "0g9y0gi78v256zv70dl3fbpwr4ihs2i99pis3x4m3br5w1p7lknq"
   },
   "qtdeclarative": {
     "url": "https://invent.kde.org/qt/qt/qtdeclarative.git",
-    "rev": "c47f3d7b227c9bc86ca1702ae3291a62c2116cfa",
-    "sha256": "0izk3zxbf1h1k88qvq8p6yaza9pkm19w4f491mbazs87qwfh3dni"
+    "rev": "b3aaf1482c48bbc0ca4f7c7934597c055afe4b6a",
+    "sha256": "12ia5zr7ajlfxjsdc4qhwjcyyc7vwr4ihs244v40y8ym2p0hm02l"
   },
   "qtdoc": {
     "url": "https://invent.kde.org/qt/qt/qtdoc.git",
-    "rev": "a2a7f0f219ccedf1ecb2bc06760ef5439262aacd",
-    "sha256": "1s2jbwq83zfqg7d0mq4v60nvpg4zfa47xqgh7sglgk1s922jyj76"
+    "rev": "032bc4f434e1a914dfc29651533d491160d06add",
+    "sha256": "1r2az30pv2kvj6hif6ngmc8b2nf0rwv2rgss5mf9ks85kglvmy51"
   },
   "qtgamepad": {
     "url": "https://invent.kde.org/qt/qt/qtgamepad.git",
-    "rev": "5107ddf28177112cdbf505f92bb4191a91e6521a",
-    "sha256": "1fyyyljhl8h4rgik3i8gi2xg5r05xd2vf4qgn4ybf3yafjsra9am"
+    "rev": "0a2d4651362810600d2ff7272772d5908bb8714b",
+    "sha256": "1qzfyarc910rg308lydaniwbr49a6wl0hwh74a5w223bl9qqi5mj"
   },
   "qtgraphicaleffects": {
     "url": "https://invent.kde.org/qt/qt/qtgraphicaleffects.git",
-    "rev": "c25898224cd957491d10dbe48f2f0be66f2955de",
-    "sha256": "1cr3hykl79yr7x06hjfx9g6nq2wmb3q5hszby83hbzpf166h8zjf"
+    "rev": "e6e1e58ec28fd0f2e6426e6962cc4ccddb493349",
+    "sha256": "1780flyc57bvicvgp071590kmhgm4nfrfys2b0adbmnkwb3fm3ij"
   },
   "qtimageformats": {
     "url": "https://invent.kde.org/qt/qt/qtimageformats.git",
-    "rev": "0ee52083683c9fcd996118ef62d9e60b5431a520",
-    "sha256": "0ainvxp2sw13dx44j8waa89bni8ylxkykr6mwncsspi7da9dqxq2"
+    "rev": "9044695f4b1acdd7ec24e7b01f6a6ca61f982a75",
+    "sha256": "1rzshk2s4prglwcvr2wfr7qk0m3x3gq0d2wk741ifl7gb5nidsd5"
   },
   "qtlocation": {
     "url": "https://invent.kde.org/qt/qt/qtlocation.git",
-    "rev": "73db91329ae48f685fa3fdae1c3c63b0976dc751",
-    "sha256": "0l8amd9fsn8agxgvxmij59i12504bmzbvyc1rz6nqhcpib4z5w7l"
+    "rev": "ebdf5b38da6e3fe0a183702bcca395c589c459ed",
+    "sha256": "17igx94c3qx0ahpnkpxip4db4413q3hcr19hcs0j4wc03vkcmafr"
   },
   "qtlottie": {
     "url": "https://invent.kde.org/qt/qt/qtlottie.git",
-    "rev": "4b3d1e824fdde2c835041464a9f85feaed0b313d",
-    "sha256": "02g7znswwki86723d3p23n0hwdi6brch9whx526l92sfx308z380"
+    "rev": "d40b67401afe7156b03c62c9a4d517b07555fe64",
+    "sha256": "1w9qcx7aczkf03qwm2jzjlj9k0qb8j0x4lfrj4lw7pwggb16f6p0"
   },
   "qtmacextras": {
     "url": "https://invent.kde.org/qt/qt/qtmacextras.git",
-    "rev": "166cb4d6166cab60a66a074c848f6ed725e6755c",
-    "sha256": "09f34v5x4z3y58z6b4hriqclrf9mjncxyl4h9ph0cicam66575ms"
+    "rev": "c9bf2516187331033f0860976497eab0828cf25e",
+    "sha256": "0242gbj3rmkx4s1jzrb3kz07pl06xcfy0aqyb5xanzkg4sllrsaw"
   },
   "qtmultimedia": {
     "url": "https://invent.kde.org/qt/qt/qtmultimedia.git",
-    "rev": "16d9ea642bf7b9592a6c53321cc7ee9d9a3ed03f",
-    "sha256": "1xi2shsg0apk7rk7ccrbnjsg9j6p8svgs1pbml48ci57i36dgzfv"
+    "rev": "76f84c545429a1b988b79f971734ef4bc3e6643f",
+    "sha256": "1i1ca3n9i1rwpsxda2xm9ap3ys7a5jazbgzcwnwjb4qsxvjss6gz"
   },
   "qtnetworkauth": {
     "url": "https://invent.kde.org/qt/qt/qtnetworkauth.git",
-    "rev": "9e698881cb07ebf04319f5cfa7b065c8bc2c1afb",
-    "sha256": "0207z0mv6nfgw7vhh43sx7r8z4cmvilh31x1x24d7nxj9rggnm1b"
+    "rev": "01315e31c5164c896a524175854c4b6df17fe166",
+    "sha256": "03vpynmkcb58x13mxjsjl07kh3jymcf295z5vybssqimyijlfw0m"
   },
   "qtpurchasing": {
     "url": "https://invent.kde.org/qt/qt/qtpurchasing.git",
-    "rev": "87021fd1e50f0aa3589a2412cfa665a6d27cc740",
-    "sha256": "184mpjc0vnrmxl7z0x2c1xj2adrdx12l5swpzh51q1wb45j1lvna"
+    "rev": "fa07915d5b7c5ba16f2e8ba32a9066fe7eed0cb1",
+    "sha256": "1khpg9dfd0bgmqffzi4f2sgm8hnwzq9fqfg32y857mbc85f346bv"
   },
   "qtquick3d": {
     "url": "https://invent.kde.org/qt/qt/qtquick3d.git",
-    "rev": "1a8736a5834492aa8b7fc2dbc59a1eb4420a7330",
-    "sha256": "1byn9g46jd4krij0h1x7lfn7ac5v4rican0lppngm065is4c6c7p"
+    "rev": "5cf67a0a93026ffd41d2ea5a11b289f46a518376",
+    "sha256": "13yjb9y69by7jqw7l2qvmpi8835x7j0vxcy2slkjjw2msrj0mq2y"
   },
   "qtquickcontrols": {
     "url": "https://invent.kde.org/qt/qt/qtquickcontrols.git",
-    "rev": "4fb4e5942bfa1f92f1c759f182aa504ad52e8e3b",
-    "sha256": "1qkamv5p97p0lp7968cdjz4ah8mfqmrq23dikqvkwnirl3bffd83"
+    "rev": "e62b8b6d2f45a79652238b33f4bbe23023004ae7",
+    "sha256": "0598ckgkmqayq0c4c5fq6fyi098m74249qvz98m61bkk5629s24c"
   },
   "qtquickcontrols2": {
     "url": "https://invent.kde.org/qt/qt/qtquickcontrols2.git",
-    "rev": "59cc1cc5b3719713598a1f426d82a9d895b5dccb",
-    "sha256": "0i1k520080h0q85hifs5axnn4dysmvwhrsm0kxq28qgdpqjzkli6"
+    "rev": "74e8db97fdb9b55c4b4614b83f4bf17e00df55e9",
+    "sha256": "1f8hjsy3qyljyrpdjvwgq6a6ixlxyz3xjn32irzxx9vfxlp54wxf"
   },
   "qtquicktimeline": {
     "url": "https://invent.kde.org/qt/qt/qtquicktimeline.git",
-    "rev": "2da3c0efd5016bdba26b80789773238c2886fdf6",
-    "sha256": "0lmyw4cxgj5kcisd2pbcpl1zynj2rfa3nsfl1n2mcz6ca650ibys"
+    "rev": "87ad61716a7cba5a070d8a7b1756c8b2b48d5d53",
+    "sha256": "02rhr3qk2k3g8ydv7w3pkkk4vdlq0jbmsbp78k1difadsxhnw563"
   },
   "qtremoteobjects": {
     "url": "https://invent.kde.org/qt/qt/qtremoteobjects.git",
-    "rev": "89407ff20e4f76314887e2f3625f5126910031ac",
-    "sha256": "1qimf60hz1962l5wpdh33y6xz3h8zcnf5yj5b1i0gfyzg0c2ki5n"
+    "rev": "aa705010da0f658b78c1155babce7091ae44529a",
+    "sha256": "1lkrxjk11qwanr7l84hqxlgk9y4shgznnxhlmfkp61ysnqladilx"
   },
   "qtscript": {
     "url": "https://invent.kde.org/qt/qt/qtscript.git",
-    "rev": "5cec94b2c1503f106f4ef4778d016410ebb86211",
-    "sha256": "1xdri98cw7m78k9kfb53cgh8wyz98q3i623jhhcv01rvy1zsf8m1"
+    "rev": "197f10dad6213ec4bb2e1a8305f19ec7475a6266",
+    "sha256": "1hksdl3ran5nv0q0idrdq78nk2qqmszq911fgxwfhifqakdqxyvp"
   },
   "qtscxml": {
     "url": "https://invent.kde.org/qt/qt/qtscxml.git",
-    "rev": "bb5d10f926c51aa462a56ffb331afd4f9607855c",
-    "sha256": "0wkwkzfv5hxkhrpmy0knlxf9c7qkals5s9c0bw71k9dz8n24d7j8"
+    "rev": "631fd7bcc34802b7650c2b1dc73691463954d982",
+    "sha256": "17r19f5s2lmj6avic2sx2hm1xlcl3gnnmigvjla6gc1wr71wbgaw"
   },
   "qtsensors": {
     "url": "https://invent.kde.org/qt/qt/qtsensors.git",
-    "rev": "bce4b6231229e953c3961f3d9858e58555a55d56",
-    "sha256": "15b2scai53d10c8bv6kv4k9lc3z9bixr4364yw2pkm71mwir90ga"
+    "rev": "35eb5ac7eaef4745a38958c3ca780d7baa2e4f30",
+    "sha256": "0c6p495rmfw741xp8vfjxkac3d144id0gjccgshp8xh4syld52q9"
   },
   "qtserialbus": {
     "url": "https://invent.kde.org/qt/qt/qtserialbus.git",
-    "rev": "b6e22f07fb529736c9362d81de7f5c632bd1f439",
-    "sha256": "039kd0yk1am9s1yr39p7gwirjl3126arqf9r01xn5kcs4viizh1k"
+    "rev": "f9f7eee60adac72fcf6617d164e3bf61222bb5c5",
+    "sha256": "1ixnagxhxd54y9kn27jmhgb41zg5dzxywvai3gg7jh0v7gxr8pxp"
   },
   "qtserialport": {
     "url": "https://invent.kde.org/qt/qt/qtserialport.git",
-    "rev": "112fcd80658a52e6a2822ec79a7d724d0ad003cf",
-    "sha256": "1px0mm301401ha0qx5blhmcmbb17bd71q1smcdlxnl8a704n4nry"
+    "rev": "c9abfcd5d88cb43c2a7c1d5ddecbff4cdd320694",
+    "sha256": "180ypj7k36c64vgq5028hxh22vfc9bk8s4vczc1dzri8sw8pnpmm"
   },
   "qtspeech": {
     "url": "https://invent.kde.org/qt/qt/qtspeech.git",
-    "rev": "e76b23ad707077647cdb4282cf35a71776efa0f0",
-    "sha256": "0lnvbcx5rflx50wpbhxy7f15ax7cs4l7h44i8y9bb04njqswh0pa"
+    "rev": "d1273416f25a15a6edf6ea56a07602cd7d99fe48",
+    "sha256": "00ikp6zv96g253msfrcvxavpyw9lv2ia5pjsysmxb4vikrk7j8vr"
   },
   "qtsvg": {
     "url": "https://invent.kde.org/qt/qt/qtsvg.git",
-    "rev": "68de925ddc20dfb8900be4fa47fa5a5916836cc8",
-    "sha256": "0b0d70w2ycxac81dqd1yhswcn37055ra3jfqn5srk8wsbdhpjl1c"
+    "rev": "a9752b00a03438de8e5b080073816e12409404b7",
+    "sha256": "1m3bg2xb1sa0r3dv5jljk8hsj3gw71qqzk9bsa7j2jn50inb2fh5"
   },
   "qttools": {
     "url": "https://invent.kde.org/qt/qt/qttools.git",
-    "rev": "672ba9d902be3634a9fef80be65227aece9e0aed",
-    "sha256": "05rzr6hlipzcm0vs9k721y25hzhv916hv48gr0pbrfzljyvp2yhx"
+    "rev": "32912a06aadfc3dcbc34e0a668ce2c78351eee6e",
+    "sha256": "096gdp349n94d9y5zy9k3k1xrf5g7lbla3j1cm4dala8rrnachg5"
   },
   "qttranslations": {
     "url": "https://invent.kde.org/qt/qt/qttranslations.git",
-    "rev": "0e92fc4f19928387c341533ef3d259efaa752c0f",
-    "sha256": "0vwkf72gpn42g54lhcbgaxbx9awpzi4a0602yhssad0v3a6zrl11"
+    "rev": "d4db9d8a4893a70e7ba3a6d5fe62f24f9ce745ca",
+    "sha256": "0srprryw0fr13d3wqpdjbcc9n6mcq1cwsdd5mdilqr7bz375qz8d"
   },
   "qtvirtualkeyboard": {
     "url": "https://invent.kde.org/qt/qt/qtvirtualkeyboard.git",
-    "rev": "766c1b7acbdc9ff4e35f6eb341fd446b1c20b811",
-    "sha256": "0bdg98h5z0lwl61860iam6ixcvgis996qj8as739wn9y6k2sv904"
+    "rev": "9fbb837b55887bec5d73fad142c853ef68db35b3",
+    "sha256": "12769162183qyxgr5p1bx2p2wlnkqg3fgz86ya9g4iznx0nagx19"
   },
   "qtwayland": {
     "url": "https://invent.kde.org/qt/qt/qtwayland.git",
-    "rev": "64fa557eb30fc1219bec50a45107ea1a983411ed",
-    "sha256": "14p20mv2dwc3i0qhssl7sqa0bnk14mg0kaq7ai65fqkx5b8qn5xr"
+    "rev": "8faf74a7966b520f0ac3eb4d88235f8ec63b31b8",
+    "sha256": "1khbpg9wds1gg6z7nj58hflzhy2gjaiy3v6pa930hb1r8sisp154"
   },
   "qtwebchannel": {
     "url": "https://invent.kde.org/qt/qt/qtwebchannel.git",
-    "rev": "da9b7b0e059447dceb828bc02d40e30d26b012f2",
-    "sha256": "0kyzzz17d7s9ln6j4ply6hl3y8wky5wslpabbmwsy2952g1y3l99"
+    "rev": "fb1ca87aa1a12048199d2aabe9015b7222d2b773",
+    "sha256": "1rsx3zf0xnvayanxwpr5yniiyw2a8bwifhrkw2gzdczdyasxdfw7"
   },
   "qtwebglplugin": {
     "url": "https://invent.kde.org/qt/qt/qtwebglplugin.git",
-    "rev": "8feafc4b8e9af78175e2814523ef4f11e445fc93",
-    "sha256": "0ck9091bhgvhnwilfjrk9pjlf184bmhia9b92av0sg0m7yrg5wqd"
+    "rev": "68a322c391c2eb92876fce42b9fc23ad2f3a1ecb",
+    "sha256": "0rd1zr39nckqlxmmgxf4zhkrh8vb3098z33ajsizz9ld5ylwkyw7"
   },
   "qtwebsockets": {
     "url": "https://invent.kde.org/qt/qt/qtwebsockets.git",
-    "rev": "e5be9ba432929049da8f4788400c170bf71672da",
-    "sha256": "1jq11rhd0k880gabh839gs474psfc0j20sy65l1l7w1cffwi1zk2"
+    "rev": "a066371747a7eb9de9b1ae38fbc41b2059080802",
+    "sha256": "0cjy399xx15z2y00bvh7jn8m8wjpx65gwg4gwrn3r2zpdw8aqqrb"
   },
   "qtwebview": {
     "url": "https://invent.kde.org/qt/qt/qtwebview.git",
-    "rev": "429096eb954672d3727a3e8cc83832bc79cf7967",
-    "sha256": "0c0q3dcxz00y8wml141xk3lx91mzg4mg5qlka2k1j49cn1az6lx3"
+    "rev": "87577dde04ed219bda776dabca86176149736331",
+    "sha256": "070s9ml8ixbmd7a7b49mnc0fya4wy3mx174n50acb99mmi7ar6z3"
   },
   "qtwinextras": {
     "url": "https://invent.kde.org/qt/qt/qtwinextras.git",
-    "rev": "b41efc2b32a19da9fe369e243dcf3a2a31f7cde6",
-    "sha256": "1prsv3z51sbq9q8v1xj4v312hai6ampdcfnik28rdh7c9mpnq99m"
+    "rev": "a2ef397d1833c7417138a14ae23c880ae434d8a6",
+    "sha256": "1jqx03wwklqak8sjjlgmi55r2l07ylsfdar1j9kb0zn1krh7d9mw"
   },
   "qtx11extras": {
     "url": "https://invent.kde.org/qt/qt/qtx11extras.git",
-    "rev": "0dfaf36ec6f642a0fd583ce1cc33a31eb6b3328e",
-    "sha256": "13fzpipgvlxs9qw128hpnaxr8j4xi8v2fmyy39y1ghf66sfln1zn"
+    "rev": "982f20eb585d77e5b5c721e05a466d7161f7f2d1",
+    "sha256": "0zl4bdxvdx2kfjwkd0rxvh70580g6idrgj4m3pyyw7z2jbzawpv3"
   },
   "qtxmlpatterns": {
     "url": "https://invent.kde.org/qt/qt/qtxmlpatterns.git",
-    "rev": "a8edba5ad50d669aead4ddb769f171cba892d676",
-    "sha256": "1342b7qljjqpiq3xjwy0vblq8wqcqyp9s3751ja40n7ishhxd2yj"
+    "rev": "30e6c84fe2752cde8b53aff9d38c2095cd7c8761",
+    "sha256": "04i1282hyqqspdlvny1dz5006svq84rpqvnvlvsas83vxzhr1g1k"
   }
 }
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs.nix b/pkgs/development/libraries/qt-5/5.15/srcs.nix
index 5ca033816181..8c40a49ac0a7 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs.nix
+++ b/pkgs/development/libraries/qt-5/5.15/srcs.nix
@@ -1,10 +1,8 @@
 { lib, fetchgit, fetchFromGitHub }:
 
 let
-  version = "5.15.5";
-  overrides = {
-    qtscript.version = "5.15.4";
-  };
+  version = "5.15.6";
+  overrides = {};
 
   mk = name: args:
     let
diff --git a/pkgs/development/libraries/science/math/cliquer/default.nix b/pkgs/development/libraries/science/math/cliquer/default.nix
index fd89ede1efb9..55a1b9dcb4c9 100644
--- a/pkgs/development/libraries/science/math/cliquer/default.nix
+++ b/pkgs/development/libraries/science/math/cliquer/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  buildInputs = [
+  nativeBuildInputs = [
     autoreconfHook
   ];
 
diff --git a/pkgs/development/libraries/science/math/openblas/default.nix b/pkgs/development/libraries/science/math/openblas/default.nix
index 6718262c2a38..69e529234f01 100644
--- a/pkgs/development/libraries/science/math/openblas/default.nix
+++ b/pkgs/development/libraries/science/math/openblas/default.nix
@@ -136,7 +136,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "openblas";
-  version = "0.3.20";
+  version = "0.3.21";
 
   outputs = [ "out" "dev" ];
 
@@ -144,9 +144,14 @@ stdenv.mkDerivation rec {
     owner = "xianyi";
     repo = "OpenBLAS";
     rev = "v${version}";
-    sha256 = "sha256-FLPVcepf7tv/es+4kur9Op7o3iVAAayuYN4hY/P4mmQ=";
+    sha256 = "sha256-F6cXPqQai4kA5zrsa8E0Q7dD9zZHlwZ+B16EOGNXoXs=";
   };
 
+  postPatch = ''
+    # cc1: error: invalid feature modifier 'sve2' in '-march=armv8.5-a+sve+sve2+bf16'
+    substituteInPlace Makefile.arm64 --replace "+sve2+bf16" ""
+  '';
+
   inherit blas64;
 
   # Some hardening features are disabled due to sporadic failures in
diff --git a/pkgs/development/libraries/sentry-native/default.nix b/pkgs/development/libraries/sentry-native/default.nix
index eafc773ef206..83f84d4d4fd3 100644
--- a/pkgs/development/libraries/sentry-native/default.nix
+++ b/pkgs/development/libraries/sentry-native/default.nix
@@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-whbzoKIYLwj4yoFaT3frghJd/WzfpolSAuZzQRtnP5E=";
   };
 
-  nativeBuildInputs = [ cmake ];
-  buildInputs = [ curl breakpad pkg-config ];
+  nativeBuildInputs = [ cmake pkg-config ];
+  buildInputs = [ curl breakpad ];
   cmakeFlags = [
     "-DCMAKE_BUILD_TYPE=RelWithDebInfo"
     "-DSENTRY_BREAKPAD_SYSTEM=On"
diff --git a/pkgs/development/libraries/smpeg/default.nix b/pkgs/development/libraries/smpeg/default.nix
index 8b54cb37a32c..5c72d653278d 100644
--- a/pkgs/development/libraries/smpeg/default.nix
+++ b/pkgs/development/libraries/smpeg/default.nix
@@ -24,6 +24,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ SDL gtk2 libGLU libGL ];
 
+  outputs = [ "out" "dev" ];
+
   preConfigure = ''
     touch NEWS AUTHORS ChangeLog
     sh autogen.sh
@@ -35,9 +37,11 @@ stdenv.mkDerivation rec {
     -e 's,"SDL_audio.h",<SDL/SDL_audio.h>,' \
     -e 's,"SDL_thread.h",<SDL/SDL_thread.h>,' \
     -e 's,"SDL_types.h",<SDL/SDL_types.h>,' \
-      $out/include/smpeg/*.h
+      $dev/include/smpeg/*.h
 
-    wrapProgram $out/bin/smpeg-config \
+    moveToOutput bin/smpeg-config "$dev"
+
+    wrapProgram $dev/bin/smpeg-config \
       --prefix PATH ":" "${pkg-config}/bin" \
       --prefix PKG_CONFIG_PATH ":" "${lib.getDev SDL}/lib/pkgconfig"
   '';
diff --git a/pkgs/development/libraries/smpeg2/default.nix b/pkgs/development/libraries/smpeg2/default.nix
index 48281ba04ec1..24dd9c9dc400 100644
--- a/pkgs/development/libraries/smpeg2/default.nix
+++ b/pkgs/development/libraries/smpeg2/default.nix
@@ -24,12 +24,15 @@ stdenv.mkDerivation rec {
   buildInputs = [ SDL2 ]
     ++ lib.optional stdenv.isDarwin darwin.libobjc;
 
+  outputs = [ "out" "dev" "man" ];
+
   preConfigure = ''
     sh autogen.sh
   '';
 
   postInstall = ''
-    wrapProgram $out/bin/smpeg2-config \
+    moveToOutput bin/smpeg2-config "$dev"
+    wrapProgram $dev/bin/smpeg2-config \
       --prefix PATH ":" "${pkg-config}/bin" \
       --prefix PKG_CONFIG_PATH ":" "${SDL2.dev}/lib/pkgconfig"
   '';
diff --git a/pkgs/development/libraries/srt/default.nix b/pkgs/development/libraries/srt/default.nix
index c74780148a1b..2e1a96eebbde 100644
--- a/pkgs/development/libraries/srt/default.nix
+++ b/pkgs/development/libraries/srt/default.nix
@@ -4,13 +4,13 @@
 with lib;
 stdenv.mkDerivation rec {
   pname = "srt";
-  version = "1.4.4";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "Haivision";
     repo = "srt";
     rev = "v${version}";
-    sha256 = "sha256-OfcMHH+MSOGY9pxpXt19EIGdP4FJFssSv/lENX+iIf8=";
+    sha256 = "sha256-qVvoHtROtJjrUd+YpjN/0I6KmiH7c24+pQ4xYTUGPXk=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/unicap/default.nix b/pkgs/development/libraries/unicap/default.nix
index 17e91f7e2365..f26365fa8e63 100644
--- a/pkgs/development/libraries/unicap/default.nix
+++ b/pkgs/development/libraries/unicap/default.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "05zcnnm4dfc6idihfi0fq5xka6x86zi89wip2ca19yz768sd33s9";
   };
 
-  buildInputs = [ libusb-compat-0_1 libraw1394 dcraw intltool perl v4l-utils ];
+  nativeBuildInputs = [ intltool ];
+  buildInputs = [ libusb-compat-0_1 libraw1394 dcraw perl v4l-utils ];
 
   patches = [
     # Debian has a patch that fixes the build.
diff --git a/pkgs/development/libraries/vapoursynth-mvtools/default.nix b/pkgs/development/libraries/vapoursynth-mvtools/default.nix
index 76ce9a36c713..54d9bad1644f 100644
--- a/pkgs/development/libraries/vapoursynth-mvtools/default.nix
+++ b/pkgs/development/libraries/vapoursynth-mvtools/default.nix
@@ -13,9 +13,8 @@ stdenv.mkDerivation rec {
     sha256 = "0lngkvxnzn82rz558nvl96rvclrck07ja1pny7wcfixp9b68ppkn";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config autoreconfHook ];
   buildInputs = [
-    autoreconfHook
     nasm vapoursynth fftwFloat
   ];
 
diff --git a/pkgs/development/libraries/volume-key/default.nix b/pkgs/development/libraries/volume-key/default.nix
index ce2f7c20d3cb..cc0049ef756c 100644
--- a/pkgs/development/libraries/volume-key/default.nix
+++ b/pkgs/development/libraries/volume-key/default.nix
@@ -16,9 +16,9 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "man" "dev" "py" ];
 
-  nativeBuildInputs = [ autoconf automake libtool pkg-config gettext swig ];
+  nativeBuildInputs = [ autoconf automake libtool pkg-config gettext swig autoreconfHook ];
 
-  buildInputs = [ autoreconfHook glib cryptsetup nss util-linux gpgme ncurses ];
+  buildInputs = [ glib cryptsetup nss util-linux gpgme ncurses ];
 
   configureFlags = [
     "--with-gpgme-prefix=${gpgme.dev}"
diff --git a/pkgs/development/libraries/vte/2.90.nix b/pkgs/development/libraries/vte/2.90.nix
index dfb76069c3b2..59f1a2cd673a 100644
--- a/pkgs/development/libraries/vte/2.90.nix
+++ b/pkgs/development/libraries/vte/2.90.nix
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "54e5b07be3c0f7b158302f54ee79d4de1cb002f4259b6642b79b1e0e314a959c";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ gobject-introspection intltool glib gtk3 ncurses ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ gobject-introspection glib gtk3 ncurses ];
 
   configureFlags = [ "--enable-introspection" ];
 
diff --git a/pkgs/development/libraries/xcb-util-cursor/HEAD.nix b/pkgs/development/libraries/xcb-util-cursor/HEAD.nix
index 92796b4116c4..4ac58c3f3d0a 100644
--- a/pkgs/development/libraries/xcb-util-cursor/HEAD.nix
+++ b/pkgs/development/libraries/xcb-util-cursor/HEAD.nix
@@ -21,13 +21,12 @@ stdenv.mkDerivation {
 
   outputs = [ "out" "dev" ];
 
-  nativeBuildInputs = [ autoconf automake ];
+  nativeBuildInputs = [ autoconf automake pkg-config ];
   buildInputs = [
     gnum4
     gperf
     libtool
     libxcb
-    pkg-config
     xorg.utilmacros
     xorg.xcbutilimage
     xorg.xcbutilrenderutil
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index e5d5e1118553..1ff2101b1462 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -427,7 +427,8 @@ with prev;
 
   luv = prev.luaLib.overrideLuarocks prev.luv (drv: {
 
-    buildInputs = [ pkg-config libuv ];
+    nativeBuildInputs = [ pkg-config ];
+    buildInputs = [ libuv ];
 
     # Use system libuv instead of building local and statically linking
     extraVariables = {
diff --git a/pkgs/development/ocaml-modules/gsl/default.nix b/pkgs/development/ocaml-modules/gsl/default.nix
index eacdda27f435..4588d0c04b04 100644
--- a/pkgs/development/ocaml-modules/gsl/default.nix
+++ b/pkgs/development/ocaml-modules/gsl/default.nix
@@ -13,7 +13,8 @@ buildDunePackage rec {
     sha256 = "1mpzcgbrha2l8iikqbmn32668v2mnnsykxg5n5jgs0qnskn2nvrn";
   };
 
-  buildInputs = [ dune-configurator gsl pkg-config ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ dune-configurator gsl ];
   propagatedBuildInputs = lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Accelerate ];
 
   meta = with lib; {
diff --git a/pkgs/development/perl-modules/Po4a/default.nix b/pkgs/development/perl-modules/Po4a/default.nix
index 119414907856..3689122805e2 100644
--- a/pkgs/development/perl-modules/Po4a/default.nix
+++ b/pkgs/development/perl-modules/Po4a/default.nix
@@ -1,5 +1,7 @@
 { stdenv, lib, fetchurl, docbook_xsl, docbook_xsl_ns, gettext, libxslt, glibcLocales, docbook_xml_dtd_412, docbook_sgml_dtd_41, texlive, opensp
-, perl, buildPerlPackage, ModuleBuild, TextWrapI18N, LocaleGettext, TermReadKey, SGMLSpm, UnicodeLineBreak, PodParser, YAMLTiny }:
+, perl, buildPerlPackage, ModuleBuild, TextWrapI18N, LocaleGettext, TermReadKey, SGMLSpm, UnicodeLineBreak, PodParser, YAMLTiny
+, fetchpatch
+}:
 
 buildPerlPackage rec {
   pname = "po4a";
@@ -8,6 +10,14 @@ buildPerlPackage rec {
     url = "https://github.com/mquinson/po4a/releases/download/v${version}/po4a-${version}.tar.gz";
     sha256 = "0eb510a66f59de68cf7a205342036cc9fc08b39334b91f1456421a5f3359e68b";
   };
+  patches = [
+    (fetchpatch {
+      # make devdoc output reproducible
+      # https://github.com/mquinson/po4a/pull/387
+      url = "https://github.com/mquinson/po4a/commit/df7433b58f6570558d44b6aac885c2a8f7862e51.patch";
+      sha256 = "9MVkYiItR2P3PBCUc4OhEOUHQuLqTWUYtYlZ3L8miC8=";
+    })
+  ];
   nativeBuildInputs = [ docbook_xsl docbook_xsl_ns ModuleBuild ];
   propagatedBuildInputs = lib.optional (!stdenv.hostPlatform.isMusl) TextWrapI18N ++ [ LocaleGettext SGMLSpm UnicodeLineBreak PodParser YAMLTiny ];
   # TODO: TermReadKey was temporarily removed from propagatedBuildInputs to unfreeze the build
diff --git a/pkgs/development/python-modules/adal/default.nix b/pkgs/development/python-modules/adal/default.nix
index 45c256b6647b..e944248db17a 100644
--- a/pkgs/development/python-modules/adal/default.nix
+++ b/pkgs/development/python-modules/adal/default.nix
@@ -20,6 +20,10 @@ buildPythonPackage rec {
     hash = "sha256-HE8/P0aohoZNeMdcQVKdz6M31FMrjsd7oVytiaD0idI=";
   };
 
+  postPatch = ''
+    sed -i '/cryptography/d' setup.py
+  '';
+
   propagatedBuildInputs = [
     pyjwt
     python-dateutil
diff --git a/pkgs/development/python-modules/apache-airflow/default.nix b/pkgs/development/python-modules/apache-airflow/default.nix
index 8b752f39e621..091020c76327 100644
--- a/pkgs/development/python-modules/apache-airflow/default.nix
+++ b/pkgs/development/python-modules/apache-airflow/default.nix
@@ -225,6 +225,7 @@ buildPythonPackage rec {
   postPatch = ''
     substituteInPlace setup.cfg \
       --replace "colorlog>=4.0.2, <5.0" "colorlog" \
+      --replace "flask-login>=0.6.2" "flask-login" \
       --replace "pathspec~=0.9.0" "pathspec"
   '' + lib.optionalString stdenv.isDarwin ''
     # Fix failing test on Hydra
diff --git a/pkgs/development/python-modules/auth0-python/default.nix b/pkgs/development/python-modules/auth0-python/default.nix
index fe52973c2cd7..caa24743d3a9 100644
--- a/pkgs/development/python-modules/auth0-python/default.nix
+++ b/pkgs/development/python-modules/auth0-python/default.nix
@@ -26,7 +26,8 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     requests
     pyjwt
-  ];
+  ]
+  ++ pyjwt.optional-dependencies.crypto;
 
   checkInputs = [
     aiohttp
diff --git a/pkgs/development/python-modules/django-allauth/default.nix b/pkgs/development/python-modules/django-allauth/default.nix
index 6db3cbefedb8..0cc201169d80 100644
--- a/pkgs/development/python-modules/django-allauth/default.nix
+++ b/pkgs/development/python-modules/django-allauth/default.nix
@@ -6,6 +6,7 @@
 , pythonOlder
 , requests
 , requests-oauthlib
+, pyjwt
 }:
 
 buildPythonPackage rec {
@@ -30,9 +31,11 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     django
     python3-openid
+    pyjwt
     requests
     requests-oauthlib
-  ];
+  ]
+  ++ pyjwt.optional-dependencies.crypto;
 
   checkPhase = ''
     # test is out of date
diff --git a/pkgs/development/python-modules/django/3.nix b/pkgs/development/python-modules/django/3.nix
index d90277961800..f881ed5221ae 100644
--- a/pkgs/development/python-modules/django/3.nix
+++ b/pkgs/development/python-modules/django/3.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "django";
-  version = "3.2.15";
+  version = "3.2.16";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "Django";
     inherit version;
-    hash = "sha256-9xk0sagi8UqGyayWNAU2iSec0ErmnLat5KWUcbiGWCs=";
+    hash = "sha256-OtwoUSQkRySjlPqbmDnMjNEW+vfRWVVMQ+zaqM3wuU0=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/drf-jwt/default.nix b/pkgs/development/python-modules/drf-jwt/default.nix
index 1b2292b46b7a..6ae583c98e06 100644
--- a/pkgs/development/python-modules/drf-jwt/default.nix
+++ b/pkgs/development/python-modules/drf-jwt/default.nix
@@ -19,7 +19,8 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     pyjwt
     djangorestframework
-  ];
+  ]
+  ++ pyjwt.optional-dependencies.crypto;
 
   # requires setting up a django instance
   doCheck = false;
diff --git a/pkgs/development/python-modules/eth-keys/default.nix b/pkgs/development/python-modules/eth-keys/default.nix
index 903d9bf95018..00029b7df05f 100644
--- a/pkgs/development/python-modules/eth-keys/default.nix
+++ b/pkgs/development/python-modules/eth-keys/default.nix
@@ -49,6 +49,7 @@ buildPythonPackage rec {
     "test_native_to_coincurve_recover"
     "test_public_key_compression_is_equal"
     "test_public_key_decompression_is_equal"
+    "test_signatures_with_high_s"
   ];
 
   pythonImportsCheck = [ "eth_keys" ];
diff --git a/pkgs/development/python-modules/flask-jwt-extended/default.nix b/pkgs/development/python-modules/flask-jwt-extended/default.nix
index 3764cc36cb0f..464894e9cfdd 100644
--- a/pkgs/development/python-modules/flask-jwt-extended/default.nix
+++ b/pkgs/development/python-modules/flask-jwt-extended/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, cryptography
 , flask
 , pyjwt
 , pytestCheckHook
@@ -29,9 +30,14 @@ buildPythonPackage rec {
     werkzeug
   ];
 
+  passthru.optional-dependencies.asymmetric_crypto = [
+    cryptography
+  ];
+
   checkInputs = [
     pytestCheckHook
-  ];
+  ]
+  ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
 
   pythonImportsCheck = [
     "flask_jwt_extended"
diff --git a/pkgs/development/python-modules/gidgethub/default.nix b/pkgs/development/python-modules/gidgethub/default.nix
index 5b8e4b239762..dfe1c186f493 100644
--- a/pkgs/development/python-modules/gidgethub/default.nix
+++ b/pkgs/development/python-modules/gidgethub/default.nix
@@ -27,7 +27,8 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     uritemplate
     pyjwt
-  ];
+  ]
+  ++ pyjwt.optional-dependencies.crypto;
 
   checkInputs = [
     pytestCheckHook
diff --git a/pkgs/development/python-modules/github3_py/default.nix b/pkgs/development/python-modules/github3_py/default.nix
index 08786916bd99..a5c930ba9eb0 100644
--- a/pkgs/development/python-modules/github3_py/default.nix
+++ b/pkgs/development/python-modules/github3_py/default.nix
@@ -28,7 +28,8 @@ buildPythonPackage rec {
     uritemplate
     python-dateutil
     pyjwt
-  ];
+  ]
+  ++ pyjwt.optional-dependencies.crypto;
 
   checkInputs = [
     pytestCheckHook
diff --git a/pkgs/development/python-modules/msal/default.nix b/pkgs/development/python-modules/msal/default.nix
index 8b8b9d0f874e..b00a7703cf05 100644
--- a/pkgs/development/python-modules/msal/default.nix
+++ b/pkgs/development/python-modules/msal/default.nix
@@ -21,12 +21,8 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     pyjwt
     requests
-  ];
-
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "PyJWT[crypto]>=1.0.0,<3" "PyJWT"
-  '';
+  ]
+  ++ pyjwt.optional-dependencies.crypto;
 
   # Tests assume Network Connectivity:
   # https://github.com/AzureAD/microsoft-authentication-library-for-python/blob/e2958961e8ec16d0af4199f60c36c3f913497e48/tests/test_authority.py#L73
diff --git a/pkgs/development/python-modules/psutil/default.nix b/pkgs/development/python-modules/psutil/default.nix
index 3815a64eec60..088541552ec2 100644
--- a/pkgs/development/python-modules/psutil/default.nix
+++ b/pkgs/development/python-modules/psutil/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, buildPythonPackage, fetchPypi, isPy27, python
-, IOKit
+, CoreFoundation, IOKit
 , pytestCheckHook
 , mock
 , unittest2
@@ -41,7 +41,10 @@ buildPythonPackage rec {
     "cpu_freq"
   ];
 
-  buildInputs = lib.optionals stdenv.isDarwin [ IOKit ];
+  buildInputs =
+    # workaround for https://github.com/NixOS/nixpkgs/issues/146760
+    lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [ CoreFoundation ] ++
+    lib.optionals stdenv.isDarwin [ IOKit ];
 
   pythonImportsCheck = [ "psutil" ];
 
diff --git a/pkgs/development/python-modules/pybind11/default.nix b/pkgs/development/python-modules/pybind11/default.nix
index 327a44690da3..241953cda3ed 100644
--- a/pkgs/development/python-modules/pybind11/default.nix
+++ b/pkgs/development/python-modules/pybind11/default.nix
@@ -41,7 +41,7 @@ buildPythonPackage rec {
 
   postBuild = ''
     # build tests
-    make -j $NIX_BUILD_CORES -l $NIX_BUILD_CORES
+    make -j $NIX_BUILD_CORES
   '';
 
   postInstall = ''
diff --git a/pkgs/development/python-modules/pyjwt/default.nix b/pkgs/development/python-modules/pyjwt/default.nix
index 500f46b02408..54df7457a35c 100644
--- a/pkgs/development/python-modules/pyjwt/default.nix
+++ b/pkgs/development/python-modules/pyjwt/default.nix
@@ -2,28 +2,49 @@
 , buildPythonPackage
 , fetchPypi
 , cryptography
+, types-cryptography
 , pytestCheckHook
 , pythonOlder
+, sphinxHook
+, sphinx-rtd-theme
+, zope_interface
 }:
 
 buildPythonPackage rec {
   pname = "pyjwt";
-  version = "2.4.0";
-  disabled = pythonOlder "3.6";
+  version = "2.5.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "PyJWT";
     inherit version;
-    sha256 = "sha256-1CkIIIxpmzuXPL6wGpabpqlsgh7vscW/5MOQwB1nq7o=";
+    sha256 = "sha256-53q4lICQXYaZhEKsV4jzUzP6hfZQR6U0rcOO3zyI/Ds=";
   };
 
-  propagatedBuildInputs = [
+  postPatch = ''
+    sed -i '/types-cryptography/d' setup.cfg
+  '';
+
+  outputs = [
+    "out"
+    "doc"
+  ];
+
+  nativeBuildInputs = [
+    sphinxHook
+    sphinx-rtd-theme
+    zope_interface
+  ];
+
+  passthru.optional-dependencies.crypto = [
     cryptography
   ];
 
   checkInputs = [
     pytestCheckHook
-  ];
+  ] ++ (lib.flatten (lib.attrValues passthru.optional-dependencies));
 
   pythonImportsCheck = [ "jwt" ];
 
diff --git a/pkgs/development/python-modules/setuptools-rust/default.nix b/pkgs/development/python-modules/setuptools-rust/default.nix
index 0afa482960c6..1ad0095e0096 100644
--- a/pkgs/development/python-modules/setuptools-rust/default.nix
+++ b/pkgs/development/python-modules/setuptools-rust/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "setuptools-rust";
-  version = "1.5.1";
+  version = "1.5.2";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-DgXkVmRdWUKcsQITcK7ec8B2DpNgu/2q77W87VMOudc=";
+    sha256 = "sha256-2NrMsU3A6uG2tus+zveWdb03tAZTafecNTk91cVWUsc=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/social-auth-core/default.nix b/pkgs/development/python-modules/social-auth-core/default.nix
index b00e5044c64f..6427208420f2 100644
--- a/pkgs/development/python-modules/social-auth-core/default.nix
+++ b/pkgs/development/python-modules/social-auth-core/default.nix
@@ -56,9 +56,7 @@ buildPythonPackage rec {
   checkInputs = [
     pytestCheckHook
     httpretty
-  ] ++ passthru.optional-dependencies.openidconnect
-  ++ passthru.optional-dependencies.saml
-  ++ passthru.optional-dependencies.azuread;
+  ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
 
   # Disable checking the code coverage
   prePatch = ''
diff --git a/pkgs/development/python-modules/twilio/default.nix b/pkgs/development/python-modules/twilio/default.nix
index 619daa6ae9b8..5e07b694e6d4 100644
--- a/pkgs/development/python-modules/twilio/default.nix
+++ b/pkgs/development/python-modules/twilio/default.nix
@@ -1,5 +1,6 @@
 { lib
 , buildPythonPackage
+, cryptography
 , django
 , fetchFromGitHub
 , mock
@@ -32,6 +33,7 @@ buildPythonPackage rec {
   ];
 
   checkInputs = [
+    cryptography
     django
     mock
     multidict
diff --git a/pkgs/development/ruby-modules/gem-config/default.nix b/pkgs/development/ruby-modules/gem-config/default.nix
index 9d8f5045c7f1..12c24cd99a92 100644
--- a/pkgs/development/ruby-modules/gem-config/default.nix
+++ b/pkgs/development/ruby-modules/gem-config/default.nix
@@ -604,7 +604,8 @@ in
   };
 
   ruby-libvirt = attrs: {
-    buildInputs = [ libvirt pkg-config ];
+    nativeBuildInputs = [ pkg-config ];
+    buildInputs = [ libvirt ];
     buildFlags = [
       "--with-libvirt-include=${libvirt}/include"
       "--with-libvirt-lib=${libvirt}/lib"
diff --git a/pkgs/development/tools/build-managers/cmake/default.nix b/pkgs/development/tools/build-managers/cmake/default.nix
index 722c8b63034b..d64b3bbe1a88 100644
--- a/pkgs/development/tools/build-managers/cmake/default.nix
+++ b/pkgs/development/tools/build-managers/cmake/default.nix
@@ -37,11 +37,11 @@ stdenv.mkDerivation rec {
     + lib.optionalString isBootstrap "-boot"
     + lib.optionalString cursesUI "-cursesUI"
     + lib.optionalString qt5UI "-qt5UI";
-  version = "3.24.1";
+  version = "3.24.2";
 
   src = fetchurl {
     url = "https://cmake.org/files/v${lib.versions.majorMinor version}/cmake-${version}.tar.gz";
-    sha256 = "sha256-STHid6TbGoBfE7qnATp3V6DL/lt5MogpJccGHZ0fqCs=";
+    sha256 = "sha256-DZAg8G893xf7U33CKOGlbJJ+5Qa0hvVf4twZ9pvwyNs=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/build-managers/meson/setup-hook.sh b/pkgs/development/tools/build-managers/meson/setup-hook.sh
index 3d946fcffd52..ded9c3c63b84 100644
--- a/pkgs/development/tools/build-managers/meson/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/meson/setup-hook.sh
@@ -20,7 +20,7 @@ mesonConfigurePhase() {
 
     echo "meson flags: $mesonFlags ${mesonFlagsArray[@]}"
 
-    meson build $mesonFlags "${mesonFlagsArray[@]}"
+    meson setup build $mesonFlags "${mesonFlagsArray[@]}"
     cd build
 
     if ! [[ -v enableParallelBuilding ]]; then
diff --git a/pkgs/development/tools/build-managers/ninja/default.nix b/pkgs/development/tools/build-managers/ninja/default.nix
index ffa582b56187..f80f0289dbe8 100644
--- a/pkgs/development/tools/build-managers/ninja/default.nix
+++ b/pkgs/development/tools/build-managers/ninja/default.nix
@@ -1,6 +1,16 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, python3, buildDocs ? true, asciidoc, docbook_xml_dtd_45, docbook_xsl, libxslt, re2c }:
-
-with lib;
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, asciidoc
+, docbook_xml_dtd_45
+, docbook_xsl
+, installShellFiles
+, libxslt
+, python3
+, re2c
+, buildDocs ? true
+}:
 
 stdenv.mkDerivation rec {
   pname = "ninja";
@@ -10,30 +20,51 @@ stdenv.mkDerivation rec {
     owner = "ninja-build";
     repo = "ninja";
     rev = "v${version}";
-    sha256 = "sha256-LvV/Fi2ARXBkfyA1paCRmLUwCh/rTyz+tGMg2/qEepI=";
+    hash = "sha256-LvV/Fi2ARXBkfyA1paCRmLUwCh/rTyz+tGMg2/qEepI=";
   };
 
-  nativeBuildInputs = [ python3 re2c ] ++ optionals buildDocs [ asciidoc docbook_xml_dtd_45 docbook_xsl libxslt.bin ];
+  nativeBuildInputs = [
+    python3
+    re2c
+    installShellFiles
+  ]
+  ++ lib.optionals buildDocs [
+    asciidoc
+    docbook_xml_dtd_45
+    docbook_xsl
+    libxslt.bin
+  ];
 
   buildPhase = ''
+    runHook preBuild
+
     python configure.py --bootstrap
-  '' + optionalString buildDocs ''
+  '' + lib.optionalString buildDocs ''
     # "./ninja -vn manual" output copied here to support cross compilation.
     asciidoc -b docbook -d book -o build/manual.xml doc/manual.asciidoc
     xsltproc --nonet doc/docbook.xsl build/manual.xml > doc/manual.html
+  '' + ''
+
+    runHook postBuild
   '';
 
   installPhase = ''
+    runHook preInstall
+
     install -Dm555 -t $out/bin ninja
-    install -Dm444 misc/bash-completion $out/share/bash-completion/completions/ninja
-    install -Dm444 misc/zsh-completion $out/share/zsh/site-functions/_ninja
-  '' + optionalString buildDocs ''
+    installShellCompletion --name ninja \
+      --bash misc/bash-completion \
+      --zsh misc/zsh-completion
+  '' + lib.optionalString buildDocs ''
     install -Dm444 -t $out/share/doc/ninja doc/manual.asciidoc doc/manual.html
+  '' + ''
+
+    runHook postInstall
   '';
 
   setupHook = ./setup-hook.sh;
 
-  meta = {
+  meta = with lib; {
     description = "Small build system with a focus on speed";
     longDescription = ''
       Ninja is a small build system with a focus on speed. It differs from
diff --git a/pkgs/development/tools/build-managers/ninja/setup-hook.sh b/pkgs/development/tools/build-managers/ninja/setup-hook.sh
index 63fa7d8f16f7..ecaa8b88c1aa 100644
--- a/pkgs/development/tools/build-managers/ninja/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/ninja/setup-hook.sh
@@ -9,7 +9,7 @@ ninjaBuildPhase() {
     fi
 
     local flagsArray=(
-        -j$buildCores -l$NIX_BUILD_CORES
+        -j$buildCores
         $ninjaFlags "${ninjaFlagsArray[@]}"
     )
 
@@ -19,29 +19,6 @@ ninjaBuildPhase() {
     runHook postBuild
 }
 
-if [ -z "${dontUseNinjaBuild-}" -a -z "${buildPhase-}" ]; then
-    buildPhase=ninjaBuildPhase
-fi
-
-ninjaInstallPhase() {
-    runHook preInstall
-
-    # shellcheck disable=SC2086
-    local flagsArray=(
-        $ninjaFlags "${ninjaFlagsArray[@]}"
-        ${installTargets:-install}
-    )
-
-    echoCmd 'install flags' "${flagsArray[@]}"
-    TERM=dumb ninja "${flagsArray[@]}"
-
-    runHook postInstall
-}
-
-if [ -z "${dontUseNinjaInstall-}" -a -z "${installPhase-}" ]; then
-    installPhase=ninjaInstallPhase
-fi
-
 ninjaCheckPhase() {
     runHook preCheck
 
@@ -61,7 +38,7 @@ ninjaCheckPhase() {
         fi
 
         local flagsArray=(
-            -j$buildCores -l$NIX_BUILD_CORES
+            -j$buildCores
             $ninjaFlags "${ninjaFlagsArray[@]}"
             $checkTarget
         )
@@ -73,6 +50,29 @@ ninjaCheckPhase() {
     runHook postCheck
 }
 
+ninjaInstallPhase() {
+    runHook preInstall
+
+    # shellcheck disable=SC2086
+    local flagsArray=(
+        $ninjaFlags "${ninjaFlagsArray[@]}"
+        ${installTargets:-install}
+    )
+
+    echoCmd 'install flags' "${flagsArray[@]}"
+    TERM=dumb ninja "${flagsArray[@]}"
+
+    runHook postInstall
+}
+
+if [ -z "${dontUseNinjaBuild-}" -a -z "${buildPhase-}" ]; then
+    buildPhase=ninjaBuildPhase
+fi
+
 if [ -z "${dontUseNinjaCheck-}" -a -z "${checkPhase-}" ]; then
     checkPhase=ninjaCheckPhase
 fi
+
+if [ -z "${dontUseNinjaInstall-}" -a -z "${installPhase-}" ]; then
+    installPhase=ninjaInstallPhase
+fi
diff --git a/pkgs/development/tools/fundoc/default.nix b/pkgs/development/tools/fundoc/default.nix
index f7a81a27701f..dfeab3a6efd7 100644
--- a/pkgs/development/tools/fundoc/default.nix
+++ b/pkgs/development/tools/fundoc/default.nix
@@ -1,4 +1,4 @@
-{ lib, rustPlatform, fetchFromGitHub }:
+{ lib, rustPlatform, fetchFromGitHub, fetchpatch }:
 
 rustPlatform.buildRustPackage rec {
   pname = "fundoc";
@@ -8,10 +8,19 @@ rustPlatform.buildRustPackage rec {
     owner = "csssr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-qmsr4bhErpMzS71NhLep0EWimZb/S3aEhMbeBNa5y8E=";
+    hash = "sha256-qmsr4bhErpMzS71NhLep0EWimZb/S3aEhMbeBNa5y8E=";
   };
 
-  cargoSha256 = "sha256-G2KRjkccS/rfrb7BtotbG6L4WaVnfwY1UEXLnVBLSzM=";
+  cargoPatches = [
+    # https://github.com/CSSSR/fundoc/pull/36
+    (fetchpatch {
+      name = "update-dependencies-for-rust-1.64.patch";
+      url = "https://github.com/CSSSR/fundoc/commit/9e0c5f747088467b70bd385fcb8888950351143f.patch";
+      hash = "sha256-JUTwMdxxt+2jst9DyqgkblZodBSYJzaDtjiLRQ8mJFU=";
+    })
+  ];
+
+  cargoHash = "sha256-1gKxFznoGYGme0UicP73FQt8CnI9IeyHJxLgRcLffm0=";
 
   meta = with lib; {
     description = "Language agnostic documentation generator";
diff --git a/pkgs/development/tools/mdk/default.nix b/pkgs/development/tools/mdk/default.nix
index 9c92764fdaf5..30ae23e85a8d 100644
--- a/pkgs/development/tools/mdk/default.nix
+++ b/pkgs/development/tools/mdk/default.nix
@@ -7,8 +7,8 @@ stdenv.mkDerivation rec {
     url = "mirror://gnu/gnu/mdk/v${version}/mdk-${version}.tar.gz";
     sha256 = "0bhk3c82kyp8167h71vdpbcr852h5blpnwggcswqqwvvykbms7lb";
   };
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ intltool glib ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ glib ];
   postInstall = ''
     mkdir -p $out/share/emacs/site-lisp/
     cp -v ./misc/*.el $out/share/emacs/site-lisp
diff --git a/pkgs/development/tools/memray/default.nix b/pkgs/development/tools/memray/default.nix
index 405e7e7b9b07..4dc94dcf5d5a 100644
--- a/pkgs/development/tools/memray/default.nix
+++ b/pkgs/development/tools/memray/default.nix
@@ -18,10 +18,11 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-zHdgVpe92OiwLC4jHVtT3oC+WnB30e5U3ZOHnmuo+Ao=";
   };
 
+  nativeBuildInputs = [ pkg-config ];
+
   buildInputs = [
     libunwind
     lz4
-    pkg-config
   ] ++ (with python3.pkgs; [
     cython
   ]);
diff --git a/pkgs/development/tools/misc/distcc/default.nix b/pkgs/development/tools/misc/distcc/default.nix
index b20d172a403d..27ff1b5e69dd 100644
--- a/pkgs/development/tools/misc/distcc/default.nix
+++ b/pkgs/development/tools/misc/distcc/default.nix
@@ -17,8 +17,8 @@ let
       sha256 = "0zjba1090awxkmgifr9jnjkxf41zhzc4f6mrnbayn3v6s77ca9x4";
     };
 
-  nativeBuildInputs = [ pkg-config autoconf automake ];
-    buildInputs = [popt avahi pkg-config python3 gtk3 which procps libiberty_static];
+    nativeBuildInputs = [ pkg-config autoconf automake ];
+    buildInputs = [popt avahi python3 gtk3 which procps libiberty_static];
     preConfigure =
     ''
       export CPATH=$(ls -d ${gcc.cc}/lib/gcc/*/${gcc.cc.version}/plugin/include)
diff --git a/pkgs/development/tools/misc/lttng-ust/generic.nix b/pkgs/development/tools/misc/lttng-ust/generic.nix
index e6e67352c859..56ad3b19e520 100644
--- a/pkgs/development/tools/misc/lttng-ust/generic.nix
+++ b/pkgs/development/tools/misc/lttng-ust/generic.nix
@@ -22,6 +22,8 @@ stdenv.mkDerivation rec {
     inherit sha256;
   };
 
+  outputs = [ "bin" "out" "dev" "devdoc" ];
+
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ numactl python3 ];
 
@@ -29,6 +31,8 @@ stdenv.mkDerivation rec {
     patchShebangs .
   '';
 
+  configureFlags = [ "--disable-examples" ];
+
   propagatedBuildInputs = [ liburcu ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/tools/parsing/tree-sitter/default.nix b/pkgs/development/tools/parsing/tree-sitter/default.nix
index 0db37008ae71..11af21a6e48b 100644
--- a/pkgs/development/tools/parsing/tree-sitter/default.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/default.nix
@@ -30,9 +30,9 @@ let
   # 2) nix-build -A tree-sitter.updater.update-all-grammars
   # 3) OPTIONAL: Set GITHUB_TOKEN env variable to avoid api rate limit
   # 4) run the ./result script that is output by that (it updates ./grammars)
-  version = "0.20.6";
-  sha256 = "sha256-zaxy8VCfJKK8NtfuFFojmmP5a19FP1zO/eB5q1EoQPw=";
-  cargoSha256 = "sha256-sOOhzm2nz+HC6dvT+8hj/wh19o+OB2zQ6Uz+H89txSA=";
+  version = "0.20.7";
+  sha256 = "sha256-5ILiN5EfJ7WpeYBiXynfcLucdp8zmxVOj4gLkaFQYts=";
+  cargoSha256 = "sha256-V4frCaU5QzTx3ujdaplw7vNkosbzyXHQvE+T7ntVOtU=";
 
   src = fetchFromGitHub {
     owner = "tree-sitter";
diff --git a/pkgs/development/tools/rust/cargo-bisect-rustc/0001-dynamically-patchelf-binaries.patch b/pkgs/development/tools/rust/cargo-bisect-rustc/0001-dynamically-patchelf-binaries.patch
index 6a4967e96054..3df226835ab9 100644
--- a/pkgs/development/tools/rust/cargo-bisect-rustc/0001-dynamically-patchelf-binaries.patch
+++ b/pkgs/development/tools/rust/cargo-bisect-rustc/0001-dynamically-patchelf-binaries.patch
@@ -1,22 +1,22 @@
 diff --git a/src/toolchains.rs b/src/toolchains.rs
-index 4d85e7c..b1353c6 100644
+index 53a7ddb..795a711 100644
 --- a/src/toolchains.rs
 +++ b/src/toolchains.rs
-@@ -259,6 +259,8 @@ impl Toolchain {
-             .map_err(InstallError::Download)?;
+@@ -206,6 +206,8 @@ impl Toolchain {
+             })?;
          }
-
+ 
 +        nix_patchelf(tmpdir.path().to_path_buf())
 +            .expect("failed to patch toolchain for NixOS");
-         fs::rename(tmpdir.into_path(), dest).map_err(InstallError::Move)?;
-
-         Ok(())
-@@ -557,3 +559,42 @@ pub(crate) fn download_tarball(
+         fs::rename(tmpdir.into_path(), dest).map_err(InstallError::Move)
+     }
+ 
+@@ -533,3 +535,42 @@ fn download_tarball(
+         res => res,
      }
-     download_tar_gz(client, name, &format!("{}.gz", url,), strip_prefix, dest)
  }
 +
-+fn nix_patchelf(mut toolchain_path: PathBuf) -> Result<(), Error> {
++fn nix_patchelf(mut toolchain_path: PathBuf) -> io::Result<()> {
 +    toolchain_path.push("bin");
 +
 +    for entry in toolchain_path.read_dir()? {
diff --git a/pkgs/development/tools/rust/cargo-bisect-rustc/default.nix b/pkgs/development/tools/rust/cargo-bisect-rustc/default.nix
index 107241896edc..6aea40cf0e73 100644
--- a/pkgs/development/tools/rust/cargo-bisect-rustc/default.nix
+++ b/pkgs/development/tools/rust/cargo-bisect-rustc/default.nix
@@ -12,13 +12,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-bisect-rustc";
-  version = "0.6.3";
+  version = "0.6.4";
 
   src = fetchFromGitHub {
     owner = "rust-lang";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-TRcHeA4pOzODyzkQCGkdAWy3Bt2ltrOcpCMDu6n4k3k=";
+    hash = "sha256-dJpdAg+A7TYm6bGq73aA15hIymbJ56ScyygQLiEboak=";
   };
 
   patches =
@@ -46,7 +46,12 @@ rustPlatform.buildRustPackage rec {
     Security
   ];
 
-  cargoSha256 = "sha256-3I5V/JOxxy1+Cwkq9tuHMgHQ0eCfzAViJ4Gl+l8RHlE=";
+  cargoHash = "sha256-Y/CQcIgdG8dCvPF5bmJDySmgzRi6lFU/aJxkyUjYlAM=";
+
+  checkFlags = [
+    "--skip cli_tests"    # https://github.com/rust-lang/cargo-bisect-rustc/issues/226
+    "--skip test_github"  # requires internet
+  ];
 
   meta = with lib; {
     description = "Bisects rustc, either nightlies or CI artifacts";
diff --git a/pkgs/games/asc/default.nix b/pkgs/games/asc/default.nix
index a6a1129acad7..46f8231680bd 100644
--- a/pkgs/games/asc/default.nix
+++ b/pkgs/games/asc/default.nix
@@ -16,9 +16,11 @@ stdenv.mkDerivation rec {
   NIX_CFLAGS_COMPILE = "-fpermissive -Wno-error=narrowing -std=c++11"; # I'm too lazy to catch all gcc47-related problems
   hardeningDisable = [ "format" ];
 
+  nativeBuildInputs = [ pkg-config ];
+
   buildInputs = [
     SDL SDL_image SDL_mixer SDL_sound libsigcxx physfs boost expat
-    freetype libjpeg wxGTK lua perl pkg-config zlib zip bzip2 libpng
+    freetype libjpeg wxGTK lua perl zlib zip bzip2 libpng
     libtiff fluidsynth libmikmod flac libvorbis libogg
   ];
 
diff --git a/pkgs/games/eduke32/default.nix b/pkgs/games/eduke32/default.nix
index 4eb46e0ac155..ec65db97ce43 100644
--- a/pkgs/games/eduke32/default.nix
+++ b/pkgs/games/eduke32/default.nix
@@ -58,7 +58,7 @@ in stdenv.mkDerivation rec {
     done
   '';
 
-  NIX_CFLAGS_COMPILE = "-I${SDL2.dev}/include/SDL2 -I${SDL2_mixer}/include/SDL2";
+  NIX_CFLAGS_COMPILE = "-I${lib.getDev SDL2}/include/SDL2 -I${lib.getDev SDL2_mixer}/include/SDL2";
 
   makeFlags = [
     "SDLCONFIG=${SDL2}/bin/sdl2-config"
diff --git a/pkgs/games/extremetuxracer/default.nix b/pkgs/games/extremetuxracer/default.nix
index 416a3ac913ea..71887c8b47dc 100644
--- a/pkgs/games/extremetuxracer/default.nix
+++ b/pkgs/games/extremetuxracer/default.nix
@@ -13,11 +13,12 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-HIdJZeniSVM78VwI2rxh5gwFuz/VeJF4gBF/+KkQzU4=";
   };
 
+  nativeBuildInputs = [ pkg-config intltool ];
   buildInputs = [
     libGLU libGL libX11 xorgproto tcl freeglut freetype
     sfml libXi
     libXmu libXext libXt libSM libICE
-    libpng pkg-config gettext intltool
+    libpng gettext
   ];
 
   configureFlags = [ "--with-tcl=${tcl}/lib" ];
diff --git a/pkgs/games/freedink/default.nix b/pkgs/games/freedink/default.nix
index b48d7e52cf39..ecdcbb7dce69 100644
--- a/pkgs/games/freedink/default.nix
+++ b/pkgs/games/freedink/default.nix
@@ -25,9 +25,11 @@ in stdenv.mkDerivation rec {
     sha256 = "19xximbcm6506kvpf3s0q96697kmzca3yrjdr6dgphklp33zqsqr";
   };
 
+  nativeBuildInputs = [ pkg-config intltool ];
+
   buildInputs = [
     SDL SDL_mixer SDL_image SDL_ttf SDL_gfx
-    pkg-config intltool fontconfig libzip zip zlib
+    fontconfig libzip zip zlib
   ];
 
   preConfigure = ''
diff --git a/pkgs/games/iortcw/sp.nix b/pkgs/games/iortcw/sp.nix
index d9faa177c17d..ba8a4dd10bd3 100644
--- a/pkgs/games/iortcw/sp.nix
+++ b/pkgs/games/iortcw/sp.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
 
   NIX_CFLAGS_COMPILE = [
     "-I${SDL2.dev}/include/SDL2"
-    "-I${opusfile}/include/opus"
+    "-I${opusfile.dev}/include/opus"
   ];
   NIX_CFLAGS_LINK = [ "-lSDL2" ];
 
diff --git a/pkgs/games/ivan/default.nix b/pkgs/games/ivan/default.nix
index 53e1b3cf00e1..80dc182127d1 100644
--- a/pkgs/games/ivan/default.nix
+++ b/pkgs/games/ivan/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   cmakeFlags = ["-DCMAKE_CXX_FLAGS=-DWIZARD"];
 
   # Help CMake find SDL_mixer.h
-  NIX_CFLAGS_COMPILE = "-I${SDL2_mixer}/include/SDL2";
+  NIX_CFLAGS_COMPILE = "-I${lib.getDev SDL2_mixer}/include/SDL2";
 
   # Create "ivan.desktop" file
   ivanDesktop = makeDesktopItem {
diff --git a/pkgs/games/srb2/default.nix b/pkgs/games/srb2/default.nix
index 57488bdb8b16..26bc4eae96c9 100644
--- a/pkgs/games/srb2/default.nix
+++ b/pkgs/games/srb2/default.nix
@@ -60,8 +60,8 @@ in stdenv.mkDerivation rec {
     "-DSRB2_ASSET_DIRECTORY=/build/source/assets"
     "-DGME_INCLUDE_DIR=${game-music-emu}/include"
     "-DOPENMPT_INCLUDE_DIR=${libopenmpt.dev}/include"
-    "-DSDL2_MIXER_INCLUDE_DIR=${SDL2_mixer}/include/SDL2"
-    "-DSDL2_INCLUDE_DIR=${SDL2.dev}/include/SDL2"
+    "-DSDL2_MIXER_INCLUDE_DIR=${lib.getDev SDL2_mixer}/include/SDL2"
+    "-DSDL2_INCLUDE_DIR=${lib.getDev SDL2}/include/SDL2"
   ];
 
   patches = [
diff --git a/pkgs/games/srb2kart/default.nix b/pkgs/games/srb2kart/default.nix
index e5a29aa56549..cb68125addaa 100644
--- a/pkgs/games/srb2kart/default.nix
+++ b/pkgs/games/srb2kart/default.nix
@@ -52,8 +52,8 @@ in stdenv.mkDerivation rec {
   cmakeFlags = [
     #"-DSRB2_ASSET_DIRECTORY=/build/source/assets"
     "-DGME_INCLUDE_DIR=${game-music-emu}/include"
-    "-DSDL2_MIXER_INCLUDE_DIR=${SDL2_mixer}/include/SDL2"
-    "-DSDL2_INCLUDE_DIR=${SDL2.dev}/include/SDL2"
+    "-DSDL2_MIXER_INCLUDE_DIR=${lib.getDev SDL2_mixer}/include/SDL2"
+    "-DSDL2_INCLUDE_DIR=${lib.getDev SDL2}/include/SDL2"
   ];
 
   patches = [
diff --git a/pkgs/games/uhexen2/default.nix b/pkgs/games/uhexen2/default.nix
index c76dd9ec2524..b9bde8d3e43a 100644
--- a/pkgs/games/uhexen2/default.nix
+++ b/pkgs/games/uhexen2/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     runHook preBuild
     for makefile in "''${makeFiles[@]}"; do
           local flagsArray=(
-            -j$NIX_BUILD_CORES -l$NIX_BUILD_CORES
+            -j$NIX_BUILD_CORES
             SHELL=$SHELL
             $makeFlags "''${makeFlagsArray[@]}"
             $buildFlags "''${buildFlagsArray[@]}"
diff --git a/pkgs/games/xboard/default.nix b/pkgs/games/xboard/default.nix
index eefbb90114ff..af75ec79e730 100644
--- a/pkgs/games/xboard/default.nix
+++ b/pkgs/games/xboard/default.nix
@@ -39,6 +39,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     libX11
     xorgproto
@@ -51,7 +52,6 @@ stdenv.mkDerivation rec {
     gnuchess
     texinfo
     libXpm
-    pkg-config
     librsvg
     cairo
     pango
diff --git a/pkgs/games/xonotic/default.nix b/pkgs/games/xonotic/default.nix
index 8865e8f992de..d29e43850fbd 100644
--- a/pkgs/games/xonotic/default.nix
+++ b/pkgs/games/xonotic/default.nix
@@ -83,14 +83,14 @@ let
     '';
 
     buildPhase = (lib.optionalString withDedicated ''
-      make -j $NIX_BUILD_CORES -l $NIX_BUILD_CORES sv-${target}
+      make -j $NIX_BUILD_CORES sv-${target}
     '' + lib.optionalString withGLX ''
-      make -j $NIX_BUILD_CORES -l $NIX_BUILD_CORES cl-${target}
+      make -j $NIX_BUILD_CORES cl-${target}
     '' + lib.optionalString withSDL ''
-      make -j $NIX_BUILD_CORES -l $NIX_BUILD_CORES sdl-${target}
+      make -j $NIX_BUILD_CORES sdl-${target}
     '') + ''
       pushd ../d0_blind_id
-      make -j $NIX_BUILD_CORES -l $NIX_BUILD_CORES
+      make -j $NIX_BUILD_CORES
       popd
     '';
 
diff --git a/pkgs/misc/cliscord/default.nix b/pkgs/misc/cliscord/default.nix
index 8ce0da14ce4d..1f8de323efe3 100644
--- a/pkgs/misc/cliscord/default.nix
+++ b/pkgs/misc/cliscord/default.nix
@@ -1,21 +1,29 @@
-{ lib, stdenv, rustPlatform, openssl, pkg-config, fetchFromGitHub, Security }:
+{ lib
+, stdenv
+, rustPlatform
+, openssl
+, pkg-config
+, fetchFromGitHub
+, fetchpatch
+, Security
+}:
 
 rustPlatform.buildRustPackage rec {
   pname = "cliscord";
-  version = "unstable-2020-12-08";
+  version = "unstable-2022-10-07";
 
   src = fetchFromGitHub {
     owner = "somebody1234";
     repo = pname;
-    rev = "b02fbe5516fd7f153d0b0e3c7d5d11e2ab651b43";
-    sha256 = "sha256-hzZozgOkw8kFppuHiX9TQxHhxKRv8utWWbhEOIzKDLo=";
+    rev = "d62317d55c07ece8c9d042dcd74b62e58c9bfaeb";
+    hash = "sha256-dmR49yyErahOUxR9pGW1oYy8Wq5SWOprK317u+JPBv4=";
   };
 
   buildInputs = [ openssl ] ++ lib.optional stdenv.isDarwin Security;
 
   nativeBuildInputs = [ pkg-config ];
 
-  cargoSha256 = "12zfwdssyv0j83bff6s4376d99pv7z8ya8q8adwmf5ayvgmj4xz4";
+  cargoHash = "sha256-Z8ras6W4BnAWjHe6rPd1X1d3US5gq7CxnBAkW//OTsg=";
 
   meta = with lib; {
     description = "Simple command-line tool to send text and files to discord";
diff --git a/pkgs/misc/cups/drivers/canon/default.nix b/pkgs/misc/cups/drivers/canon/default.nix
index 07b81ce9bc28..12e4f5cac966 100644
--- a/pkgs/misc/cups/drivers/canon/default.nix
+++ b/pkgs/misc/cups/drivers/canon/default.nix
@@ -44,7 +44,7 @@ let
     sha256 = "sha256:069z6ijmql62mcdyxnzc9mf0dxa6z1107cd0ab4i1adk8kr3d75k";
   };
 
-  buildInputs = [ cups zlib jbigkit glib gtk3 pkg-config gnome2.libglade libxml2 gdk-pixbuf pango cairo atk ];
+  buildInputs = [ cups zlib jbigkit glib gtk3 gnome2.libglade libxml2 gdk-pixbuf pango cairo atk ];
 in
 stdenv.mkDerivation rec {
   pname = "canon-cups-ufr2";
@@ -72,7 +72,7 @@ stdenv.mkDerivation rec {
     )
   '';
 
-  nativeBuildInputs = [ makeWrapper unzip autoconf automake libtool_1_5 ];
+  nativeBuildInputs = [ makeWrapper unzip autoconf automake libtool_1_5 pkg-config ];
 
   inherit buildInputs;
 
diff --git a/pkgs/misc/screensavers/alock/default.nix b/pkgs/misc/screensavers/alock/default.nix
index 87c81531122a..74155f43c2b8 100644
--- a/pkgs/misc/screensavers/alock/default.nix
+++ b/pkgs/misc/screensavers/alock/default.nix
@@ -21,9 +21,9 @@ stdenv.mkDerivation rec {
     "--enable-imlib2"
   ];
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config autoreconfHook ];
   buildInputs = [
-    autoreconfHook libX11
+    libX11
     pam libgcrypt libXrender imlib2
   ];
 
diff --git a/pkgs/misc/stabber/default.nix b/pkgs/misc/stabber/default.nix
index eb0d6a4109d0..478cbda3dc00 100644
--- a/pkgs/misc/stabber/default.nix
+++ b/pkgs/misc/stabber/default.nix
@@ -19,7 +19,8 @@ stdenv.mkDerivation {
     mkdir m4
   '';
 
-  buildInputs = [ autoreconfHook pkg-config glib expat libmicrohttpd ];
+  nativeBuildInputs = [ pkg-config autoreconfHook ];
+  buildInputs = [ glib expat libmicrohttpd ];
 
   meta = {
     description = "Stubbed XMPP Server";
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix
index 05340642f8d0..b7666fe31cdb 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix
@@ -168,7 +168,7 @@ in rec {
   bareFrameworks = (
     lib.mapAttrs framework (import ./frameworks.nix {
       inherit frameworks libs;
-      inherit (pkgs.darwin.apple_sdk_11_0) libnetwork Libsystem;
+      inherit (pkgs.darwin.apple_sdk_11_0) libnetwork;
       libobjc = pkgs.darwin.apple_sdk_11_0.objc4;
     })
   ) // (
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
index b29a36177a82..4565f698d26c 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
@@ -50,7 +50,9 @@ let
     libcharset = callPackage ./libcharset.nix {};
     libunwind = callPackage ./libunwind.nix {};
     libnetwork = callPackage ./libnetwork.nix {};
-    objc4 = callPackage ./libobjc.nix {};
+    # Avoid introducing a new objc4 if stdenv already has one, to prevent
+    # conflicting LLVM modules.
+    objc4 = if stdenv ? objc4 then stdenv.objc4 else callPackage ./libobjc.nix {};
 
     # questionable aliases
     configd = pkgs.darwin.apple_sdk.frameworks.SystemConfiguration;
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix
index e9121b021164..dc4ab1955b50 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix
@@ -1,4 +1,4 @@
-{ frameworks, libs, libobjc, Libsystem, libnetwork }: with frameworks; with libs;
+{ frameworks, libs, libobjc, libnetwork }: with frameworks; with libs;
 {
   AGL                              = { inherit Carbon OpenGL; };
   AVFoundation                     = { inherit ApplicationServices AVFCapture AVFCore CoreGraphics simd UniformTypeIdentifiers; };
@@ -89,9 +89,7 @@
   IOBluetooth                      = { inherit CoreBluetooth IOKit; };
   IOBluetoothUI                    = { inherit IOBluetooth; };
   IOKit                            = {};
-  # `IOSurface` should depend on `Libsystem` (in place of `xpc`) but this currently causes build
-  # issues due to incompatibility issues between `Libsystem` and `libcxx`.
-  IOSurface                        = { inherit IOKit xpc; };
+  IOSurface                        = { inherit IOKit; };
   IOUSBHost                        = {};
   IdentityLookup                   = {};
   ImageCaptureCore                 = {};
diff --git a/pkgs/os-specific/darwin/libtapi/default.nix b/pkgs/os-specific/darwin/libtapi/default.nix
index da0710740973..eba61a15ccb9 100644
--- a/pkgs/os-specific/darwin/libtapi/default.nix
+++ b/pkgs/os-specific/darwin/libtapi/default.nix
@@ -40,12 +40,15 @@ stdenv.mkDerivation {
         let
           nativeCC = pkgsBuildBuild.stdenv.cc;
           nativeBintools = nativeCC.bintools.bintools;
+          nativeLibcxxabi = lib.getLib pkgsBuildBuild.libcxxabi;
           nativeToolchainFlags = [
             "-DCMAKE_C_COMPILER=${nativeCC}/bin/${nativeCC.targetPrefix}cc"
             "-DCMAKE_CXX_COMPILER=${nativeCC}/bin/${nativeCC.targetPrefix}c++"
             "-DCMAKE_AR=${nativeBintools}/bin/${nativeBintools.targetPrefix}ar"
             "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
             "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
+            "-DCMAKE_EXE_LINKER_FLAGS=-L${nativeLibcxxabi}/lib"
+            "-DCMAKE_SHARED_LINKER_FLAGS=-L${nativeLibcxxabi}/lib"
           ];
         in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list=${lib.concatStringsSep ";" nativeToolchainFlags}"
       )
diff --git a/pkgs/os-specific/linux/ell/default.nix b/pkgs/os-specific/linux/ell/default.nix
index 67d8f107ce38..2fce9d6f0d7b 100644
--- a/pkgs/os-specific/linux/ell/default.nix
+++ b/pkgs/os-specific/linux/ell/default.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation rec {
   pname = "ell";
-  version = "0.52";
+  version = "0.53";
 
   outputs = [ "out" "dev" ];
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/libs/ell/ell.git";
     rev = version;
-    sha256 = "sha256-JnkNWWdr0CSlwME619BBWkvelFZoZpzmAR53nm2bSqM=";
+    sha256 = "sha256-txtXPWmLfZLBsK3s94W5LyA81mTHStpP3nkq6KW33Mk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/iwd/default.nix b/pkgs/os-specific/linux/iwd/default.nix
index dfd5f5724ef8..b62b6946e425 100644
--- a/pkgs/os-specific/linux/iwd/default.nix
+++ b/pkgs/os-specific/linux/iwd/default.nix
@@ -12,12 +12,12 @@
 
 stdenv.mkDerivation rec {
   pname = "iwd";
-  version = "1.29";
+  version = "1.30";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/network/wireless/iwd.git";
     rev = version;
-    sha256 = "sha256-W2MOK6aIa1whkj13OeuibNjL/2LWt7TO8h4JeoUrZnQ=";
+    sha256 = "sha256-9uyYXxnxRqWvzrw3QXCOT/ZubQ8/nrB+b60jKn1hAJk=";
   };
 
   outputs = [ "out" "man" "doc" ]
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 97bf388d46a6..3a71563593ef 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -481,6 +481,7 @@ let
       DEBUG_LIST                       = yes;
       # Detect writes to read-only module pages
       DEBUG_SET_MODULE_RONX            = whenOlder "4.11" (option yes);
+      HARDENED_USERCOPY                = yes;
       RANDOMIZE_BASE                   = option yes;
       STRICT_DEVMEM                    = mkDefault yes; # Filter access to /dev/mem
       IO_STRICT_DEVMEM                 = mkDefault yes;
diff --git a/pkgs/os-specific/linux/libcap/default.nix b/pkgs/os-specific/linux/libcap/default.nix
index 0577107fd026..75ba8710449d 100644
--- a/pkgs/os-specific/linux/libcap/default.nix
+++ b/pkgs/os-specific/linux/libcap/default.nix
@@ -7,11 +7,11 @@ assert usePam -> pam != null;
 
 stdenv.mkDerivation rec {
   pname = "libcap";
-  version = "2.65";
+  version = "2.66";
 
   src = fetchurl {
     url = "mirror://kernel/linux/libs/security/linux-privs/libcap2/${pname}-${version}.tar.xz";
-    sha256 = "sha256-c+NQAgzDH+FTYIedGThP+jOVqCXwZfz2vaOlzfllvr0=";
+    sha256 = "sha256-FcQO3tswA9cKKD/lh6NrfRnIs7VU4z+GEpwFmku0ZrI=";
   };
 
   outputs = [ "out" "dev" "lib" "man" "doc" ]
diff --git a/pkgs/os-specific/linux/libpsm2/default.nix b/pkgs/os-specific/linux/libpsm2/default.nix
index ebfe492f7364..43c9bf74e3fa 100644
--- a/pkgs/os-specific/linux/libpsm2/default.nix
+++ b/pkgs/os-specific/linux/libpsm2/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  buildInputs = [ numactl pkg-config ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ numactl ];
 
   makeFlags = [
     # Disable blanket -Werror to avoid build failures
diff --git a/pkgs/os-specific/linux/lightum/default.nix b/pkgs/os-specific/linux/lightum/default.nix
index 95b766aec05b..e9925b95bcd6 100644
--- a/pkgs/os-specific/linux/lightum/default.nix
+++ b/pkgs/os-specific/linux/lightum/default.nix
@@ -11,13 +11,14 @@ stdenv.mkDerivation {
     sha256 = "sha256-dzWUVY2srgk6BM6jZ7FF+snxnPopz3fx9nq+mVkmogc=";
   };
 
+  nativeBuildInputs = [ pkg-config ];
+
   buildInputs = [
     dbus
     glib
     libX11
     libXScrnSaver
     libXext
-    pkg-config
     systemd
   ];
 
diff --git a/pkgs/os-specific/linux/pam_usb/default.nix b/pkgs/os-specific/linux/pam_usb/default.nix
index ebd45246ae8d..1264894ad0c9 100644
--- a/pkgs/os-specific/linux/pam_usb/default.nix
+++ b/pkgs/os-specific/linux/pam_usb/default.nix
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     # pam_usb dependencies
-    dbus libxml2 pam pmount pkg-config
+    dbus libxml2 pam pmount
     # pam_usb's tools dependencies
     python
     # cElementTree is included with python 2.5 and later.
diff --git a/pkgs/os-specific/linux/pmount/default.nix b/pkgs/os-specific/linux/pmount/default.nix
index 0f65e0278cab..8267a2d4a7f9 100644
--- a/pkgs/os-specific/linux/pmount/default.nix
+++ b/pkgs/os-specific/linux/pmount/default.nix
@@ -16,7 +16,8 @@ stdenv.mkDerivation rec {
     sha256 = "db38fc290b710e8e9e9d442da2fb627d41e13b3ee80326c15cc2595ba00ea036";
   };
 
-  buildInputs = [ intltool util-linux ];
+  nativeBuildInputs = [ intltool util-linux ];
+  buildInputs = [ util-linux ];
 
   configureFlags = [
     "--with-media-dir=${mediaDir}"
diff --git a/pkgs/os-specific/linux/trace-cmd/default.nix b/pkgs/os-specific/linux/trace-cmd/default.nix
index d27aaa1f137a..0aff1bdd789d 100644
--- a/pkgs/os-specific/linux/trace-cmd/default.nix
+++ b/pkgs/os-specific/linux/trace-cmd/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
   # because the Makefile would not print warnings about too old
   # libraries (see "warning:" in the Makefile)
   postBuild = ''
-    make libs doc -j$NIX_BUILD_CORES -l$NIX_BUILD_CORES
+    make libs doc -j$NIX_BUILD_CORES
   '';
 
   installTargets = [
diff --git a/pkgs/os-specific/linux/xf86-video-nested/default.nix b/pkgs/os-specific/linux/xf86-video-nested/default.nix
index bba646e583b8..4092e3797c2f 100644
--- a/pkgs/os-specific/linux/xf86-video-nested/default.nix
+++ b/pkgs/os-specific/linux/xf86-video-nested/default.nix
@@ -12,9 +12,11 @@ stdenv.mkDerivation {
     sha256 = "133rd2kvr2q2wmwpx82bb93qbi8wm8qp1vlmbhgc7aslz0j4cqqv";
   };
 
+  nativeBuildInputs = [ pkg-config autoreconfHook ];
+
   buildInputs =
-    [ autoreconfHook xorgproto libX11 libXext pixman
-      pkg-config utilmacros xorgserver
+    [ xorgproto libX11 libXext pixman
+      utilmacros xorgserver
     ];
 
   hardeningDisable = [ "fortify" ];
diff --git a/pkgs/servers/geospatial/martin/default.nix b/pkgs/servers/geospatial/martin/default.nix
index 78eaeb7ce8b1..b225591a5adc 100644
--- a/pkgs/servers/geospatial/martin/default.nix
+++ b/pkgs/servers/geospatial/martin/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, rustPlatform, fetchFromGitHub, Security }:
+{ lib, stdenv, rustPlatform, fetchFromGitHub, fetchpatch, Security }:
 
 rustPlatform.buildRustPackage rec {
   pname = "martin";
@@ -8,12 +8,17 @@ rustPlatform.buildRustPackage rec {
     owner = "urbica";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1i9zhmjkgid4s90n52wqmrl3lwswcaxd6d47ssycgjl1nv0jla4k";
+    hash = "sha256-kygqwbaByse81oc007piXHM6aK6Yi2JB0qTFN2WFP8U=";
   };
 
-  cargoSha256 = "1jgl8s6h4pqhn189swrhn896kw1rkmqpf7dq52ry2rdci80g02nq";
+  cargoPatches = [
+    # Remove after a new release, tracked by https://github.com/maplibre/martin/issues/410.
+    ./update-socket2-for-rust-1.64.patch
+  ];
 
-  buildInputs = with stdenv; lib.optional isDarwin Security;
+  cargoHash = "sha256-oevyr1P0uzHbpWCYQ1raqA42HI2KLl2IYcm1D2PeKOo=";
+
+  buildInputs = lib.optional stdenv.isDarwin Security;
 
   doCheck = false;
 
diff --git a/pkgs/servers/geospatial/martin/update-socket2-for-rust-1.64.patch b/pkgs/servers/geospatial/martin/update-socket2-for-rust-1.64.patch
new file mode 100644
index 000000000000..c70261a3076c
--- /dev/null
+++ b/pkgs/servers/geospatial/martin/update-socket2-for-rust-1.64.patch
@@ -0,0 +1,358 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index 8c90ecb..13c3149 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -305,7 +305,7 @@ name = "atty"
+ version = "0.2.13"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ dependencies = [
+- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
++ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
+  "winapi 0.3.8 (registry+https://github.com/rust-lang/crates.io-index)",
+ ]
+ 
+@@ -343,7 +343,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ dependencies = [
+  "backtrace-sys 0.1.32 (registry+https://github.com/rust-lang/crates.io-index)",
+  "cfg-if 0.1.10 (registry+https://github.com/rust-lang/crates.io-index)",
+- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
++ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
+  "rustc-demangle 0.1.16 (registry+https://github.com/rust-lang/crates.io-index)",
+ ]
+ 
+@@ -353,7 +353,7 @@ version = "0.1.32"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ dependencies = [
+  "cc 1.0.46 (registry+https://github.com/rust-lang/crates.io-index)",
+- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
++ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
+ ]
+ 
+ [[package]]
+@@ -393,7 +393,7 @@ version = "0.3.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ dependencies = [
+  "cc 1.0.46 (registry+https://github.com/rust-lang/crates.io-index)",
+- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
++ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
+ ]
+ 
+ [[package]]
+@@ -402,7 +402,7 @@ version = "0.3.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ dependencies = [
+  "brotli-sys 0.3.2 (registry+https://github.com/rust-lang/crates.io-index)",
+- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
++ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
+ ]
+ 
+ [[package]]
+@@ -458,12 +458,17 @@ name = "cfg-if"
+ version = "0.1.10"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ 
++[[package]]
++name = "cfg-if"
++version = "1.0.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++
+ [[package]]
+ name = "chrono"
+ version = "0.4.9"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ dependencies = [
+- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
++ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
+  "num-integer 0.1.41 (registry+https://github.com/rust-lang/crates.io-index)",
+  "num-traits 0.2.8 (registry+https://github.com/rust-lang/crates.io-index)",
+  "time 0.1.42 (registry+https://github.com/rust-lang/crates.io-index)",
+@@ -734,7 +739,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ dependencies = [
+  "cfg-if 0.1.10 (registry+https://github.com/rust-lang/crates.io-index)",
+  "crc32fast 1.2.0 (registry+https://github.com/rust-lang/crates.io-index)",
+- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
++ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
+  "miniz-sys 0.1.12 (registry+https://github.com/rust-lang/crates.io-index)",
+  "miniz_oxide 0.3.3 (registry+https://github.com/rust-lang/crates.io-index)",
+ ]
+@@ -782,7 +787,7 @@ version = "0.1.13"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ dependencies = [
+  "cfg-if 0.1.10 (registry+https://github.com/rust-lang/crates.io-index)",
+- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
++ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
+  "wasi 0.7.0 (registry+https://github.com/rust-lang/crates.io-index)",
+ ]
+ 
+@@ -832,7 +837,7 @@ name = "hostname"
+ version = "0.1.5"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ dependencies = [
+- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
++ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
+  "winutil 0.1.1 (registry+https://github.com/rust-lang/crates.io-index)",
+ ]
+ 
+@@ -892,7 +897,7 @@ name = "iovec"
+ version = "0.1.4"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ dependencies = [
+- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
++ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
+ ]
+ 
+ [[package]]
+@@ -900,7 +905,7 @@ name = "ipconfig"
+ version = "0.2.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ dependencies = [
+- "socket2 0.3.11 (registry+https://github.com/rust-lang/crates.io-index)",
++ "socket2 0.3.19 (registry+https://github.com/rust-lang/crates.io-index)",
+  "widestring 0.4.0 (registry+https://github.com/rust-lang/crates.io-index)",
+  "winapi 0.3.8 (registry+https://github.com/rust-lang/crates.io-index)",
+  "winreg 0.6.2 (registry+https://github.com/rust-lang/crates.io-index)",
+@@ -940,7 +945,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ 
+ [[package]]
+ name = "libc"
+-version = "0.2.65"
++version = "0.2.134"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ 
+ [[package]]
+@@ -1019,7 +1024,7 @@ name = "memchr"
+ version = "1.0.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ dependencies = [
+- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
++ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
+ ]
+ 
+ [[package]]
+@@ -1027,7 +1032,7 @@ name = "memchr"
+ version = "2.2.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ dependencies = [
+- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
++ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
+ ]
+ 
+ [[package]]
+@@ -1049,7 +1054,7 @@ version = "0.1.12"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ dependencies = [
+  "cc 1.0.46 (registry+https://github.com/rust-lang/crates.io-index)",
+- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
++ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
+ ]
+ 
+ [[package]]
+@@ -1069,7 +1074,7 @@ dependencies = [
+  "fuchsia-zircon-sys 0.3.3 (registry+https://github.com/rust-lang/crates.io-index)",
+  "iovec 0.1.4 (registry+https://github.com/rust-lang/crates.io-index)",
+  "kernel32-sys 0.2.2 (registry+https://github.com/rust-lang/crates.io-index)",
+- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
++ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
+  "log 0.4.8 (registry+https://github.com/rust-lang/crates.io-index)",
+  "miow 0.2.1 (registry+https://github.com/rust-lang/crates.io-index)",
+  "net2 0.2.33 (registry+https://github.com/rust-lang/crates.io-index)",
+@@ -1083,7 +1088,7 @@ version = "0.6.7"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ dependencies = [
+  "iovec 0.1.4 (registry+https://github.com/rust-lang/crates.io-index)",
+- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
++ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
+  "mio 0.6.19 (registry+https://github.com/rust-lang/crates.io-index)",
+ ]
+ 
+@@ -1104,7 +1109,7 @@ version = "0.2.33"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ dependencies = [
+  "cfg-if 0.1.10 (registry+https://github.com/rust-lang/crates.io-index)",
+- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
++ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
+  "winapi 0.3.8 (registry+https://github.com/rust-lang/crates.io-index)",
+ ]
+ 
+@@ -1135,7 +1140,7 @@ name = "num_cpus"
+ version = "1.10.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ dependencies = [
+- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
++ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
+ ]
+ 
+ [[package]]
+@@ -1165,7 +1170,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ dependencies = [
+  "cfg-if 0.1.10 (registry+https://github.com/rust-lang/crates.io-index)",
+  "cloudabi 0.0.3 (registry+https://github.com/rust-lang/crates.io-index)",
+- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
++ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
+  "rand 0.6.5 (registry+https://github.com/rust-lang/crates.io-index)",
+  "redox_syscall 0.1.56 (registry+https://github.com/rust-lang/crates.io-index)",
+  "rustc_version 0.2.3 (registry+https://github.com/rust-lang/crates.io-index)",
+@@ -1180,7 +1185,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ dependencies = [
+  "cfg-if 0.1.10 (registry+https://github.com/rust-lang/crates.io-index)",
+  "cloudabi 0.0.3 (registry+https://github.com/rust-lang/crates.io-index)",
+- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
++ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
+  "redox_syscall 0.1.56 (registry+https://github.com/rust-lang/crates.io-index)",
+  "rustc_version 0.2.3 (registry+https://github.com/rust-lang/crates.io-index)",
+  "smallvec 0.6.10 (registry+https://github.com/rust-lang/crates.io-index)",
+@@ -1223,7 +1228,7 @@ dependencies = [
+  "log 0.4.8 (registry+https://github.com/rust-lang/crates.io-index)",
+  "postgres-protocol 0.3.2 (registry+https://github.com/rust-lang/crates.io-index)",
+  "postgres-shared 0.4.2 (registry+https://github.com/rust-lang/crates.io-index)",
+- "socket2 0.3.11 (registry+https://github.com/rust-lang/crates.io-index)",
++ "socket2 0.3.19 (registry+https://github.com/rust-lang/crates.io-index)",
+ ]
+ 
+ [[package]]
+@@ -1325,7 +1330,7 @@ name = "rand"
+ version = "0.3.23"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ dependencies = [
+- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
++ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
+  "rand 0.4.6 (registry+https://github.com/rust-lang/crates.io-index)",
+ ]
+ 
+@@ -1335,7 +1340,7 @@ version = "0.4.6"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ dependencies = [
+  "fuchsia-cprng 0.1.1 (registry+https://github.com/rust-lang/crates.io-index)",
+- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
++ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
+  "rand_core 0.3.1 (registry+https://github.com/rust-lang/crates.io-index)",
+  "rdrand 0.4.0 (registry+https://github.com/rust-lang/crates.io-index)",
+  "winapi 0.3.8 (registry+https://github.com/rust-lang/crates.io-index)",
+@@ -1347,7 +1352,7 @@ version = "0.6.5"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ dependencies = [
+  "autocfg 0.1.7 (registry+https://github.com/rust-lang/crates.io-index)",
+- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
++ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
+  "rand_chacha 0.1.1 (registry+https://github.com/rust-lang/crates.io-index)",
+  "rand_core 0.4.2 (registry+https://github.com/rust-lang/crates.io-index)",
+  "rand_hc 0.1.0 (registry+https://github.com/rust-lang/crates.io-index)",
+@@ -1365,7 +1370,7 @@ version = "0.7.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ dependencies = [
+  "getrandom 0.1.13 (registry+https://github.com/rust-lang/crates.io-index)",
+- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
++ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
+  "rand_chacha 0.2.1 (registry+https://github.com/rust-lang/crates.io-index)",
+  "rand_core 0.5.1 (registry+https://github.com/rust-lang/crates.io-index)",
+  "rand_hc 0.2.0 (registry+https://github.com/rust-lang/crates.io-index)",
+@@ -1439,7 +1444,7 @@ name = "rand_jitter"
+ version = "0.1.4"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ dependencies = [
+- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
++ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
+  "rand_core 0.4.2 (registry+https://github.com/rust-lang/crates.io-index)",
+  "winapi 0.3.8 (registry+https://github.com/rust-lang/crates.io-index)",
+ ]
+@@ -1451,7 +1456,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ dependencies = [
+  "cloudabi 0.0.3 (registry+https://github.com/rust-lang/crates.io-index)",
+  "fuchsia-cprng 0.1.1 (registry+https://github.com/rust-lang/crates.io-index)",
+- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
++ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
+  "rand_core 0.4.2 (registry+https://github.com/rust-lang/crates.io-index)",
+  "rdrand 0.4.0 (registry+https://github.com/rust-lang/crates.io-index)",
+  "winapi 0.3.8 (registry+https://github.com/rust-lang/crates.io-index)",
+@@ -1687,7 +1692,7 @@ name = "signal-hook"
+ version = "0.1.10"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ dependencies = [
+- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
++ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
+  "signal-hook-registry 1.1.1 (registry+https://github.com/rust-lang/crates.io-index)",
+ ]
+ 
+@@ -1697,7 +1702,7 @@ version = "1.1.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ dependencies = [
+  "arc-swap 0.4.3 (registry+https://github.com/rust-lang/crates.io-index)",
+- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
++ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
+ ]
+ 
+ [[package]]
+@@ -1717,12 +1722,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ 
+ [[package]]
+ name = "socket2"
+-version = "0.3.11"
++version = "0.3.19"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ dependencies = [
+- "cfg-if 0.1.10 (registry+https://github.com/rust-lang/crates.io-index)",
+- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
+- "redox_syscall 0.1.56 (registry+https://github.com/rust-lang/crates.io-index)",
++ "cfg-if 1.0.0 (registry+https://github.com/rust-lang/crates.io-index)",
++ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
+  "winapi 0.3.8 (registry+https://github.com/rust-lang/crates.io-index)",
+ ]
+ 
+@@ -1825,7 +1829,7 @@ name = "time"
+ version = "0.1.42"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ dependencies = [
+- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
++ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
+  "redox_syscall 0.1.56 (registry+https://github.com/rust-lang/crates.io-index)",
+  "winapi 0.3.8 (registry+https://github.com/rust-lang/crates.io-index)",
+ ]
+@@ -1901,7 +1905,7 @@ version = "0.2.7"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ dependencies = [
+  "futures 0.1.29 (registry+https://github.com/rust-lang/crates.io-index)",
+- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
++ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
+  "mio 0.6.19 (registry+https://github.com/rust-lang/crates.io-index)",
+  "mio-uds 0.6.7 (registry+https://github.com/rust-lang/crates.io-index)",
+  "signal-hook 0.1.10 (registry+https://github.com/rust-lang/crates.io-index)",
+@@ -1972,7 +1976,7 @@ dependencies = [
+  "log 0.4.8 (registry+https://github.com/rust-lang/crates.io-index)",
+  "rand 0.6.5 (registry+https://github.com/rust-lang/crates.io-index)",
+  "smallvec 0.6.10 (registry+https://github.com/rust-lang/crates.io-index)",
+- "socket2 0.3.11 (registry+https://github.com/rust-lang/crates.io-index)",
++ "socket2 0.3.19 (registry+https://github.com/rust-lang/crates.io-index)",
+  "tokio-executor 0.1.8 (registry+https://github.com/rust-lang/crates.io-index)",
+  "tokio-io 0.1.12 (registry+https://github.com/rust-lang/crates.io-index)",
+  "tokio-reactor 0.1.10 (registry+https://github.com/rust-lang/crates.io-index)",
+@@ -2200,6 +2204,7 @@ dependencies = [
+ "checksum cast 0.2.2 (registry+https://github.com/rust-lang/crates.io-index)" = "926013f2860c46252efceabb19f4a6b308197505082c609025aa6706c011d427"
+ "checksum cc 1.0.46 (registry+https://github.com/rust-lang/crates.io-index)" = "0213d356d3c4ea2c18c40b037c3be23cd639825c18f25ee670ac7813beeef99c"
+ "checksum cfg-if 0.1.10 (registry+https://github.com/rust-lang/crates.io-index)" = "4785bdd1c96b2a846b2bd7cc02e86b6b3dbf14e7e53446c4f54c92a361040822"
++"checksum cfg-if 1.0.0 (registry+https://github.com/rust-lang/crates.io-index)" = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+ "checksum chrono 0.4.9 (registry+https://github.com/rust-lang/crates.io-index)" = "e8493056968583b0193c1bb04d6f7684586f3726992d6c573261941a895dbd68"
+ "checksum clap 2.33.0 (registry+https://github.com/rust-lang/crates.io-index)" = "5067f5bb2d80ef5d68b4c87db81601f0b75bca627bc2ef76b141d7b846a3c6d9"
+ "checksum cloudabi 0.0.3 (registry+https://github.com/rust-lang/crates.io-index)" = "ddfc5b9aa5d4507acaf872de71051dfd0e309860e88966e1051e462a077aac4f"
+@@ -2256,7 +2261,7 @@ dependencies = [
+ "checksum kernel32-sys 0.2.2 (registry+https://github.com/rust-lang/crates.io-index)" = "7507624b29483431c0ba2d82aece8ca6cdba9382bff4ddd0f7490560c056098d"
+ "checksum language-tags 0.2.2 (registry+https://github.com/rust-lang/crates.io-index)" = "a91d884b6667cd606bb5a69aa0c99ba811a115fc68915e7056ec08a46e93199a"
+ "checksum lazy_static 1.4.0 (registry+https://github.com/rust-lang/crates.io-index)" = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+-"checksum libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)" = "1a31a0627fdf1f6a39ec0dd577e101440b7db22672c0901fe00a9a6fbb5c24e8"
++"checksum libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)" = "329c933548736bc49fd575ee68c89e8be4d260064184389a5b77517cddd99ffb"
+ "checksum linked-hash-map 0.5.2 (registry+https://github.com/rust-lang/crates.io-index)" = "ae91b68aebc4ddb91978b11a1b02ddd8602a05ec19002801c5666000e05e0f83"
+ "checksum lock_api 0.2.0 (registry+https://github.com/rust-lang/crates.io-index)" = "ed946d4529956a20f2d63ebe1b69996d5a2137c91913fe3ebbeff957f5bca7ff"
+ "checksum lock_api 0.3.1 (registry+https://github.com/rust-lang/crates.io-index)" = "f8912e782533a93a167888781b836336a6ca5da6175c05944c86cf28c31104dc"
+@@ -2344,7 +2349,7 @@ dependencies = [
+ "checksum siphasher 0.2.3 (registry+https://github.com/rust-lang/crates.io-index)" = "0b8de496cf83d4ed58b6be86c3a275b8602f6ffe98d3024a869e124147a9a3ac"
+ "checksum slab 0.4.2 (registry+https://github.com/rust-lang/crates.io-index)" = "c111b5bd5695e56cffe5129854aa230b39c93a305372fdbb2668ca2394eea9f8"
+ "checksum smallvec 0.6.10 (registry+https://github.com/rust-lang/crates.io-index)" = "ab606a9c5e214920bb66c458cd7be8ef094f813f20fe77a54cc7dbfff220d4b7"
+-"checksum socket2 0.3.11 (registry+https://github.com/rust-lang/crates.io-index)" = "e8b74de517221a2cb01a53349cf54182acdc31a074727d3079068448c0676d85"
++"checksum socket2 0.3.19 (registry+https://github.com/rust-lang/crates.io-index)" = "122e570113d28d773067fab24266b66753f6ea915758651696b6e35e49f88d6e"
+ "checksum string 0.2.1 (registry+https://github.com/rust-lang/crates.io-index)" = "d24114bfcceb867ca7f71a0d3fe45d45619ec47a6fbfa98cb14e14250bfa5d6d"
+ "checksum stringprep 0.1.2 (registry+https://github.com/rust-lang/crates.io-index)" = "8ee348cb74b87454fff4b551cbf727025810a004f88aeacae7f85b87f4e9a1c1"
+ "checksum strsim 0.9.2 (registry+https://github.com/rust-lang/crates.io-index)" = "032c03039aae92b350aad2e3779c352e104d919cb192ba2fabbd7b831ce4f0f6"
+@@ -2393,3 +2398,4 @@ dependencies = [
+ "checksum winutil 0.1.1 (registry+https://github.com/rust-lang/crates.io-index)" = "7daf138b6b14196e3830a588acf1e86966c694d3e8fb026fb105b8b5dca07e6e"
+ "checksum ws2_32-sys 0.2.1 (registry+https://github.com/rust-lang/crates.io-index)" = "d59cefebd0c892fa2dd6de581e937301d8552cb44489cdff035c6187cb63fa5e"
+ "checksum yaml-rust 0.4.3 (registry+https://github.com/rust-lang/crates.io-index)" = "65923dd1784f44da1d2c3dbbc5e822045628c590ba72123e1c73d3c230c4434d"
++
diff --git a/pkgs/servers/matrix-conduit/default.nix b/pkgs/servers/matrix-conduit/default.nix
index 9f6e68bf64a7..de6ce56072c9 100644
--- a/pkgs/servers/matrix-conduit/default.nix
+++ b/pkgs/servers/matrix-conduit/default.nix
@@ -15,10 +15,10 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [
     rustPlatform.bindgenHook
+    pkg-config
   ];
 
   buildInputs = [
-    pkg-config
     rocksdb
   ];
 
diff --git a/pkgs/servers/monitoring/alerta/default.nix b/pkgs/servers/monitoring/alerta/default.nix
index c3758c26b253..795ae560f0be 100644
--- a/pkgs/servers/monitoring/alerta/default.nix
+++ b/pkgs/servers/monitoring/alerta/default.nix
@@ -14,6 +14,7 @@ python3.pkgs.buildPythonApplication rec {
   propagatedBuildInputs = with python3.pkgs; [
     bcrypt
     blinker
+    cryptography
     flask
     flask-compress
     flask-cors
diff --git a/pkgs/servers/pulseaudio/default.nix b/pkgs/servers/pulseaudio/default.nix
index c54cba96d103..6b09105ef20a 100644
--- a/pkgs/servers/pulseaudio/default.nix
+++ b/pkgs/servers/pulseaudio/default.nix
@@ -116,6 +116,11 @@ stdenv.mkDerivation rec {
     "-Dsysconfdir=/etc"
     "-Dsysconfdir_install=${placeholder "out"}/etc"
     "-Dudevrulesdir=${placeholder "out"}/lib/udev/rules.d"
+
+    # pulseaudio complains if its binary is moved after installation;
+    # this is needed so that wrapGApp can operate *without*
+    # renaming the unwrapped binaries (see below)
+    "--bindir=${placeholder "out"}/.bin-unwrapped"
   ]
   ++ lib.optional (stdenv.isLinux && useSystemd) "-Dsystemduserunitdir=${placeholder "out"}/lib/systemd/user"
   ++ lib.optionals stdenv.isDarwin [
@@ -133,11 +138,11 @@ stdenv.mkDerivation rec {
   postInstall = lib.optionalString libOnly ''
     find $out/share -maxdepth 1 -mindepth 1 ! -name "vala" -prune -exec rm -r {} \;
     find $out/share/vala -maxdepth 1 -mindepth 1 ! -name "vapi" -prune -exec rm -r {} \;
-    rm -r $out/{bin,etc,lib/pulse-*}
+    rm -r $out/{.bin-unwrapped,etc,lib/pulse-*}
   ''
     + ''
     moveToOutput lib/cmake "$dev"
-    rm -f $out/bin/qpaeq # this is packaged by the "qpaeq" package now, because of missing deps
+    rm -f $out/.bin-unwrapped/qpaeq # this is packaged by the "qpaeq" package now, because of missing deps
   '';
 
   preFixup = lib.optionalString (stdenv.isLinux  && (stdenv.hostPlatform == stdenv.buildPlatform)) ''
@@ -151,6 +156,15 @@ stdenv.mkDerivation rec {
       ln -s "''$file" "''${file%.dylib}.so"
       ln -s "''$file" "$out/lib/pulseaudio/''$(basename ''$file .dylib).so"
     done
+  ''
+  # put symlinks to binaries in `$prefix/bin`;
+  # then wrapGApp will *rename these symlinks* instead of
+  # the original binaries in `$prefix/.bin-unwrapped` (see above);
+  # when pulseaudio is looking for its own binary (it does!),
+  # it will be happy to find it in its original installation location
+  + lib.optionalString (!libOnly) ''
+    mkdir -p $out/bin
+    ln -st $out/bin $out/.bin-unwrapped/*
   '';
 
   meta = {
diff --git a/pkgs/servers/web-apps/lemmy/ui.nix b/pkgs/servers/web-apps/lemmy/ui.nix
index 82aa67a45d45..24e7b87f5c70 100644
--- a/pkgs/servers/web-apps/lemmy/ui.nix
+++ b/pkgs/servers/web-apps/lemmy/ui.nix
@@ -14,8 +14,8 @@ let
 
   pkgConfig = {
     node-sass = {
-      nativeBuildInputs = [ ];
-      buildInputs = [ libsass pkg-config python3 ];
+      nativeBuildInputs = [ pkg-config ];
+      buildInputs = [ libsass python3 ];
       postInstall = ''
         LIBSASS_EXT=auto yarn --offline run build
         rm build/config.gypi
diff --git a/pkgs/servers/web-apps/sogo/default.nix b/pkgs/servers/web-apps/sogo/default.nix
index 94672ffe6f10..286883722f64 100644
--- a/pkgs/servers/web-apps/sogo/default.nix
+++ b/pkgs/servers/web-apps/sogo/default.nix
@@ -14,8 +14,8 @@ gnustep.stdenv.mkDerivation rec {
     hash = "sha256-3Xy0y1sdixy4gXhzhP9mfWeaDmOVJty+X95xCyxayPE=";
   };
 
-  nativeBuildInputs = [ gnustep.make makeWrapper python3 ];
-  buildInputs = [ gnustep.base sope openssl libmemcached curl libsodium libytnef libzip pkg-config openldap oath-toolkit ]
+  nativeBuildInputs = [ gnustep.make makeWrapper python3 pkg-config ];
+  buildInputs = [ gnustep.base sope openssl libmemcached curl libsodium libytnef libzip openldap oath-toolkit ]
     ++ lib.optional enableActiveSync libwbxml;
 
   patches = lib.optional enableActiveSync ./enable-activesync.patch;
diff --git a/pkgs/servers/x11/quartz-wm/default.nix b/pkgs/servers/x11/quartz-wm/default.nix
index 9beb0553395e..2d132b389be6 100644
--- a/pkgs/servers/x11/quartz-wm/default.nix
+++ b/pkgs/servers/x11/quartz-wm/default.nix
@@ -12,6 +12,7 @@ in stdenv.mkDerivation {
     ./no_title_crash.patch
     ./extern-patch.patch
   ];
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     xorg.libXinerama
     xorg.libAppleWM
@@ -19,7 +20,6 @@ in stdenv.mkDerivation {
     xorg.libXrandr
     xorg.libXext
     pixman
-    pkg-config
     AppKit Xplugin Foundation
   ];
   meta = with lib; {
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index ff56f1de0226..9a7cd9aa9dee 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -698,6 +698,11 @@ rec {
         libc = pkgs.darwin.Libsystem;
         shellPackage = pkgs.bash;
         inherit bootstrapTools;
+      } // lib.optionalAttrs useAppleSDKLibs {
+        # This objc4 will be propagated to all builds using the final stdenv,
+        # and we shouldn't mix different builds, because they would be
+        # conflicting LLVM modules. Export it here so we can grab it later.
+        inherit (pkgs.darwin) objc4;
       };
 
       allowedRequisites = (with pkgs; [
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index f0fcb30451dd..62f9121d73d6 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -1100,7 +1100,7 @@ buildPhase() {
         # Old bash empty array hack
         # shellcheck disable=SC2086
         local flagsArray=(
-            ${enableParallelBuilding:+-j${NIX_BUILD_CORES} -l${NIX_BUILD_CORES}}
+            ${enableParallelBuilding:+-j${NIX_BUILD_CORES}}
             SHELL=$SHELL
             $makeFlags "${makeFlagsArray[@]}"
             $buildFlags "${buildFlagsArray[@]}"
@@ -1139,7 +1139,7 @@ checkPhase() {
         # Old bash empty array hack
         # shellcheck disable=SC2086
         local flagsArray=(
-            ${enableParallelChecking:+-j${NIX_BUILD_CORES} -l${NIX_BUILD_CORES}}
+            ${enableParallelChecking:+-j${NIX_BUILD_CORES}}
             SHELL=$SHELL
             $makeFlags "${makeFlagsArray[@]}"
             ${checkFlags:-VERBOSE=y} "${checkFlagsArray[@]}"
@@ -1273,7 +1273,7 @@ installCheckPhase() {
         # Old bash empty array hack
         # shellcheck disable=SC2086
         local flagsArray=(
-            ${enableParallelChecking:+-j${NIX_BUILD_CORES} -l${NIX_BUILD_CORES}}
+            ${enableParallelChecking:+-j${NIX_BUILD_CORES}}
             SHELL=$SHELL
             $makeFlags "${makeFlagsArray[@]}"
             $installCheckFlags "${installCheckFlagsArray[@]}"
diff --git a/pkgs/tools/X11/xnee/default.nix b/pkgs/tools/X11/xnee/default.nix
index d2236dfe354e..c16da204f2f4 100644
--- a/pkgs/tools/X11/xnee/default.nix
+++ b/pkgs/tools/X11/xnee/default.nix
@@ -33,9 +33,10 @@ stdenv.mkDerivation rec {
         --replace 'LIBSEMA="CCC"' 'LIBSEMA=""'
     '';
 
+  nativeBuildInputs = [ pkg-config ];
   buildInputs =
     [ libX11 xorgproto libXext libXtst gtk2
-      libXi pkg-config
+      libXi
       texinfo
     ];
 
diff --git a/pkgs/tools/admin/tigervnc/default.nix b/pkgs/tools/admin/tigervnc/default.nix
index 549096ec0e43..724301854b40 100644
--- a/pkgs/tools/admin/tigervnc/default.nix
+++ b/pkgs/tools/admin/tigervnc/default.nix
@@ -92,7 +92,7 @@ stdenv.mkDerivation rec {
         --with-xkb-path=${xkeyboard_config}/share/X11/xkb \
         --with-xkb-bin-directory=${xorg.xkbcomp}/bin \
         --with-xkb-output=$out/share/X11/xkb/compiled
-    make TIGERVNC_SRC=$src TIGERVNC_BUILDDIR=`pwd`/../.. -j$NIX_BUILD_CORES -l$NIX_BUILD_CORES
+    make TIGERVNC_SRC=$src TIGERVNC_BUILDDIR=`pwd`/../.. -j$NIX_BUILD_CORES
     popd
   '' + lib.optionalString stdenv.isDarwin ''
     make dmg
diff --git a/pkgs/tools/audio/midimonster/default.nix b/pkgs/tools/audio/midimonster/default.nix
index 3792d997aa00..841704427c2b 100644
--- a/pkgs/tools/audio/midimonster/default.nix
+++ b/pkgs/tools/audio/midimonster/default.nix
@@ -19,7 +19,8 @@ stdenv.mkDerivation rec {
   pname = "midimonster";
   version = "0.6.0";
 
-  buildInputs = [pkg-config gnumake gcc lua5_4 openssl jack1 python3 alsa-lib ncurses libevdev];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [gnumake gcc lua5_4 openssl jack1 python3 alsa-lib ncurses libevdev];
 
   src = fetchFromGitHub {
     repo = "midimonster";
diff --git a/pkgs/tools/audio/mpdcron/default.nix b/pkgs/tools/audio/mpdcron/default.nix
index 94ba5a56d032..924181608af4 100644
--- a/pkgs/tools/audio/mpdcron/default.nix
+++ b/pkgs/tools/audio/mpdcron/default.nix
@@ -31,10 +31,9 @@ in stdenv.mkDerivation {
     sha256 = "0vdksf6lcgmizqr5mqp0bbci259k0dj7gpmhx32md41jlmw5skaw";
   };
 
-  nativeBuildInputs = [ autoconf automake ];
+  nativeBuildInputs = [ autoconf automake pkg-config ];
   buildInputs = [
     libtool
-    pkg-config
     glib
     libdaemon
     pandoc
diff --git a/pkgs/tools/backup/dump/default.nix b/pkgs/tools/backup/dump/default.nix
index 75a449a1276a..f9e1b68ac395 100644
--- a/pkgs/tools/backup/dump/default.nix
+++ b/pkgs/tools/backup/dump/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-0CGs3k+77T2T662YFCL2cfSNZrKeyI196DZC7Pv/T9A=";
   };
 
-  buildInputs = [ e2fsprogs pkg-config ncurses readline ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ e2fsprogs ncurses readline ];
 
   meta = with lib; {
     homepage = "https://dump.sourceforge.io/";
diff --git a/pkgs/tools/compression/gzip/default.nix b/pkgs/tools/compression/gzip/default.nix
index bd28ca63e80a..771188a98cd9 100644
--- a/pkgs/tools/compression/gzip/default.nix
+++ b/pkgs/tools/compression/gzip/default.nix
@@ -24,7 +24,14 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ xz.bin ];
 
-  makeFlags = [ "SHELL=/bin/sh" "GREP=grep" ];
+  makeFlags = [
+    "SHELL=/bin/sh"
+    "GREP=grep"
+    # gzip 1.12 doesn't build `zless` unless it can find `less`, but we
+    # can avoid having `less` as a build input if we just override these.
+    "ZLESS_MAN=zless.1"
+    "ZLESS_PROG=zless"
+  ];
 
   # Many gzip executables are shell scripts that depend upon other gzip
   # executables being in $PATH.  Rather than try to re-write all the
diff --git a/pkgs/tools/compression/lz4/default.nix b/pkgs/tools/compression/lz4/default.nix
index 579ee9b2094c..584b000a3e29 100644
--- a/pkgs/tools/compression/lz4/default.nix
+++ b/pkgs/tools/compression/lz4/default.nix
@@ -14,12 +14,10 @@ stdenv.mkDerivation rec {
     owner = pname;
   };
 
-  patches = lib.optionals (!enableShared) [
-    # This patch is already part of the `dev` branch.
-    # Remove when upgrading to the next version.
-    (fetchpatch {
-      name = "lz4-fix-BUILD_SHARED=no.patch";
-      url = "https://github.com/lz4/lz4/commit/5ccbd38277989ae6a728171d59ae03bad6f2f4d5.patch";
+  patches = [
+    (fetchpatch { # https://github.com/lz4/lz4/pull/1162
+      name = "build-shared-no.patch";
+      url = "https://github.com/lz4/lz4/commit/851ef4b23c7cbf4ceb2ba1099666a8b5ec4fa195.patch";
       sha256 = "sha256-P+/uz3m7EAmHgXF/1Vncc0uKKxNVq6HNIsElx0rGxpw=";
     })
   ];
diff --git a/pkgs/tools/filesystems/httpfs/default.nix b/pkgs/tools/filesystems/httpfs/default.nix
index 61843e4c65be..24233a8441d3 100644
--- a/pkgs/tools/filesystems/httpfs/default.nix
+++ b/pkgs/tools/filesystems/httpfs/default.nix
@@ -10,8 +10,9 @@ stdenv.mkDerivation rec {
     sha256 = "1h8ggvhw30n2r6w11n1s458ypggdqx6ldwd61ma4yd7binrlpjq1";
   };
 
+  nativeBuildInputs = [ pkg-config ];
   buildInputs =
-    [ pkg-config fuse openssl
+    [ fuse openssl
       asciidoc docbook_xml_dtd_45 docbook_xsl libxml2 libxslt
     ];
 
diff --git a/pkgs/tools/graphics/s2png/default.nix b/pkgs/tools/graphics/s2png/default.nix
index c11248809440..d3f8b74512a8 100644
--- a/pkgs/tools/graphics/s2png/default.nix
+++ b/pkgs/tools/graphics/s2png/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0y3crfm0jqprgxamlly713cka2x1bp6z63p1lw9wh4wc37kpira6";
   };
 
-  buildInputs = [ diffutils gd pkg-config ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ diffutils gd ];
   installFlags = [ "prefix=" "DESTDIR=$(out)" ];
 
   meta = {
diff --git a/pkgs/tools/inputmethods/m17n-lib/default.nix b/pkgs/tools/inputmethods/m17n-lib/default.nix
index cc290ab0eca9..ff3b0afad25d 100644
--- a/pkgs/tools/inputmethods/m17n-lib/default.nix
+++ b/pkgs/tools/inputmethods/m17n-lib/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, m17n_db, autoreconfHook, pkg-config }:
+{ lib, stdenv, fetchurl, fetchpatch, m17n_db, autoreconfHook, pkg-config }:
 stdenv.mkDerivation rec {
   pname = "m17n-lib";
   version = "1.8.0";
@@ -8,6 +8,17 @@ stdenv.mkDerivation rec {
     sha256 = "0jp61y09xqj10mclpip48qlfhniw8gwy8b28cbzxy8hq8pkwmfkq";
   };
 
+  patches = [
+    (fetchpatch {
+      # Patch pending upstream inclusion:
+      #   https://savannah.nongnu.org/bugs/index.php?61377
+      name = "parallel-build.patch";
+      url = "https://savannah.nongnu.org/bugs/download.php?file_id=53704";
+      hash = "sha256-1smKSIFVRJZSwCv0NiUsnndxKcPnJ/wqzH8+ka6nfNM=";
+      excludes = [ "src/ChangeLog" ];
+    })
+  ];
+
   strictDeps = true;
 
   # reconf needed to sucesfully cross-compile
@@ -17,10 +28,7 @@ stdenv.mkDerivation rec {
     m17n_db
   ];
 
-  # Fails parallel build due to missing intra-package depends:
-  #   https://savannah.nongnu.org/bugs/index.php?61377
-  #     make[2]: *** No rule to make target '../src/libm17n-core.la', needed by 'libm17n.la'.  Stop.
-  enableParallelBuilding = false;
+  enableParallelBuilding = true;
 
   meta = {
     homepage = "https://www.nongnu.org/m17n/";
diff --git a/pkgs/tools/misc/cpuminer/default.nix b/pkgs/tools/misc/cpuminer/default.nix
index 27bf0ec5374b..eb7a73e469c7 100644
--- a/pkgs/tools/misc/cpuminer/default.nix
+++ b/pkgs/tools/misc/cpuminer/default.nix
@@ -19,7 +19,8 @@ stdenv.mkDerivation rec {
 
   patchPhase = if stdenv.cc.isClang then "${perl}/bin/perl ./nomacro.pl" else null;
 
-  buildInputs = [ curl jansson autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ curl jansson ];
 
   configureFlags = [ "CFLAGS=-O3" ];
 
diff --git a/pkgs/tools/misc/expect/default.nix b/pkgs/tools/misc/expect/default.nix
index 5a792c040b39..45f45e89e82d 100644
--- a/pkgs/tools/misc/expect/default.nix
+++ b/pkgs/tools/misc/expect/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, buildPackages, fetchurl, tcl, makeWrapper, autoreconfHook, fetchpatch }:
+{ lib, stdenv, buildPackages, fetchurl, tcl, makeWrapper, autoreconfHook, fetchpatch, substituteAll }:
 
 tcl.mkTclDerivation rec {
   pname = "expect";
@@ -14,6 +14,10 @@ tcl.mkTclDerivation rec {
       url = "https://raw.githubusercontent.com/buildroot/buildroot/c05e6aa361a4049eabd8b21eb64a34899ef83fc7/package/expect/0001-enable-cross-compilation.patch";
       sha256 = "1jwx2l1slidvcpahxbyqs942l81jd62rzbxliyd9lwysk38c8b6b";
     })
+    (substituteAll {
+      src = ./fix-cross-compilation.patch;
+      tcl = "${buildPackages.tcl}/bin/tclsh";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/tools/misc/expect/fix-cross-compilation.patch b/pkgs/tools/misc/expect/fix-cross-compilation.patch
new file mode 100644
index 000000000000..8edc4bea39d6
--- /dev/null
+++ b/pkgs/tools/misc/expect/fix-cross-compilation.patch
@@ -0,0 +1,11 @@
+--- a/Makefile.in	2022-09-07 21:46:37.090519258 +0200
++++ b/Makefile.in	2022-09-07 21:46:21.462592279 +0200
+@@ -380,7 +380,7 @@
+ 	cp $(DIST_ROOT)/$(PKG_DIR).tar.gz $(top_builddir)
+ 
+ $(SCRIPTS):
+-	$(TCLSH) $(srcdir)/fixline1 $(SHORT_BINDIR) < $(srcdir)/example/$@ > $@
++	@tcl@ $(srcdir)/fixline1 $(SHORT_BINDIR) < $(srcdir)/example/$@ > $@
+ 
+ ## We cannot use TCL_LIBS below (after TCL_LIB_SPEC) because its
+ ## expansion references the contents of LIBS, which contains linker
diff --git a/pkgs/tools/misc/notify-desktop/default.nix b/pkgs/tools/misc/notify-desktop/default.nix
index c906443b07ca..22b5035da514 100644
--- a/pkgs/tools/misc/notify-desktop/default.nix
+++ b/pkgs/tools/misc/notify-desktop/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation {
     sha256 = "1brcvl2fx0yzxj9mc8hzfl32zdka1f1bxpzsclcsjplyakyinr1a";
   };
 
-  buildInputs = [ dbus pkg-config ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ dbus ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/tools/misc/popsicle/default.nix b/pkgs/tools/misc/popsicle/default.nix
index e9369270fcd0..bae9465c7cb8 100644
--- a/pkgs/tools/misc/popsicle/default.nix
+++ b/pkgs/tools/misc/popsicle/default.nix
@@ -49,7 +49,7 @@ rustPlatform.buildRustPackage.override { stdenv = stdenv; } rec {
   postPatch = ''
     # Have to do this here instead of in preConfigure because
     # cargoDepsCopy gets unset after postPatch.
-    configureFlagsArray+=("RUST_VENDORED_SOURCES=$NIX_BUILD_TOP/$cargoDepsCopy")
+    configureFlagsArray+=("RUST_VENDORED_SOURCES=$cargoDepsCopy")
   '';
 
   makeFlags = [
diff --git a/pkgs/tools/misc/vector/default.nix b/pkgs/tools/misc/vector/default.nix
index 767369123010..ebf2f082db02 100644
--- a/pkgs/tools/misc/vector/default.nix
+++ b/pkgs/tools/misc/vector/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchFromGitHub
+, fetchpatch
 , rustPlatform
 , pkg-config
 , llvmPackages
@@ -40,10 +41,28 @@ rustPlatform.buildRustPackage {
     owner = "vectordotdev";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-RfKg14r3B5Jx2vIa4gpJs5vXRqSXKOXKRFmmQmzQorQ=";
+    hash = "sha256-RfKg14r3B5Jx2vIa4gpJs5vXRqSXKOXKRFmmQmzQorQ=";
   };
 
-  cargoSha256 = "sha256-l2rrT2SeeH4bYYlzSiFASNBxtg4TBm1dRA4cFRfvpkk=";
+  patches = [
+    (fetchpatch {
+      name = "rust-1.64-part1.patch";
+      url = "https://github.com/vectordotdev/vector/commit/e7437df97711b6a660a3532fe5026244472a900f.patch";
+      hash = "sha256-EyheI3nngt72+ZZNNsjp3KV1CuRb9CZ7wUCHt0twFVs=";
+    })
+    (fetchpatch {
+      name = "rust-1.64-part2.patch";
+      url = "https://github.com/vectordotdev/vector/commit/e80c7afaf7601cf936c7c3468bd7b4b230ef6149.patch";
+      hash = "sha256-pHcq7XLn+9PKs0DnBTK5FawN5KSF8BuJf7sBO9u5Gb8=";
+      excludes = [
+        # There are too many conflicts to easily resolve patching this file, but
+        # the changes here do not block compilation.
+        "lib/lookup/src/lookup_v2/owned.rs"
+      ];
+    })
+  ];
+
+  cargoHash = "sha256-l2rrT2SeeH4bYYlzSiFASNBxtg4TBm1dRA4cFRfvpkk=";
   nativeBuildInputs = [ pkg-config cmake perl ];
   buildInputs = [ oniguruma openssl protobuf rdkafka zstd ]
     ++ lib.optionals stdenv.isDarwin [ Security libiconv coreutils CoreServices ];
@@ -111,3 +130,4 @@ rustPlatform.buildRustPackage {
     platforms = with platforms; all;
   };
 }
+
diff --git a/pkgs/tools/networking/bandwhich/default.nix b/pkgs/tools/networking/bandwhich/default.nix
index 07483f24e226..b4903bdf0222 100644
--- a/pkgs/tools/networking/bandwhich/default.nix
+++ b/pkgs/tools/networking/bandwhich/default.nix
@@ -8,22 +8,28 @@ rustPlatform.buildRustPackage rec {
     owner = "imsnif";
     repo = pname;
     rev = version;
-    sha256 = "014blvrv0kk4gzga86mbk7gd5dl1szajfi972da3lrfznck1w24n";
+    hash = "sha256-lggeJrPfZTpUEydFJ9XXgbbS3pmrGqTef2ROsPOmiwQ=";
   };
 
-  cargoSha256 = "sha256-Vrd5DIfhUSb3BONaUG8RypmVF+HWrlM0TodlWjOLa/c=";
+  cargoHash = "sha256-kGRsF+THNQahEoD3vY+XcPrr9cHjchtg86tMvcIdHPk=";
 
   buildInputs = lib.optional stdenv.isDarwin Security;
 
   # 10 passed; 47 failed https://hydra.nixos.org/build/148943783/nixlog/1
   doCheck = !stdenv.isDarwin;
 
-  # FIXME: remove when the linked-hash-map dependency is bumped upstream
   cargoPatches = [
+    # FIXME: remove when the linked-hash-map dependency is bumped upstream
+    # https://github.com/imsnif/bandwhich/pull/222/
     (fetchpatch {
-      url = "https://github.com/imsnif/bandwhich/pull/222/commits/be06905de2c4fb91afc22d50bf3cfe5a1e8003f5.patch";
-      sha256 = "sha256-FyZ7jUXK7ebXq7q/lvRSe7YdPnpYWKZE3WrSKLMjJeA=";
+      name = "update-linked-hash-map.patch";
+      url = "https://github.com/imsnif/bandwhich/commit/be06905de2c4fb91afc22d50bf3cfe5a1e8003f5.patch";
+      hash = "sha256-FyZ7jUXK7ebXq7q/lvRSe7YdPnpYWKZE3WrSKLMjJeA=";
     })
+
+    # Tweaked https://github.com/imsnif/bandwhich/pull/245 so that it merges
+    # cleanly with the earlier patch.
+    ./update-socket2-for-rust-1.64.diff
   ];
 
   meta = with lib; {
diff --git a/pkgs/tools/networking/bandwhich/update-socket2-for-rust-1.64.diff b/pkgs/tools/networking/bandwhich/update-socket2-for-rust-1.64.diff
new file mode 100644
index 000000000000..99921205e048
--- /dev/null
+++ b/pkgs/tools/networking/bandwhich/update-socket2-for-rust-1.64.diff
@@ -0,0 +1,160 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index bcaf9da..7d9c97e 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -76,7 +76,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "924c76597f0d9ca25d762c25a4d369d51267536465dc5064bdf0eb073ed477ea"
+ dependencies = [
+  "backtrace-sys",
+- "cfg-if",
++ "cfg-if 0.1.9",
+  "libc",
+  "rustc-demangle",
+ ]
+@@ -238,6 +238,12 @@ version = "0.1.9"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "b486ce3ccf7ffd79fdeb678eac06a9e6c09fc88d33836340becb8fffe87c5e33"
+ 
++[[package]]
++name = "cfg-if"
++version = "1.0.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
++
+ [[package]]
+ name = "chrono"
+ version = "0.4.9"
+@@ -357,7 +363,7 @@ version = "1.2.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "ba125de2af0df55319f41944744ad91c71113bf74a4646efff39afe1f6842db1"
+ dependencies = [
+- "cfg-if",
++ "cfg-if 0.1.9",
+ ]
+ 
+ [[package]]
+@@ -388,7 +394,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "058ed274caafc1f60c4997b5fc07bf7dc7cca454af7c6e81edffe5f33f70dace"
+ dependencies = [
+  "autocfg 1.0.1",
+- "cfg-if",
++ "cfg-if 0.1.9",
+  "crossbeam-utils",
+  "lazy_static",
+  "maybe-uninit",
+@@ -403,7 +409,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "c3c7c73a2d1e9fc0886a08b93e98eb643461230d5f1925e4036204d5f2e261a8"
+ dependencies = [
+  "autocfg 1.0.1",
+- "cfg-if",
++ "cfg-if 0.1.9",
+  "lazy_static",
+ ]
+ 
+@@ -528,7 +534,7 @@ version = "1.0.17"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "766d0e77a2c1502169d4a93ff3b8c15a71fd946cd0126309752104e5f3c46d94"
+ dependencies = [
+- "cfg-if",
++ "cfg-if 0.1.9",
+  "crc32fast",
+  "libc",
+  "miniz_oxide",
+@@ -683,7 +689,7 @@ version = "0.1.13"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "e7db7ca94ed4cd01190ceee0d8a8052f08a247aa1b469a7f68c6a3b71afcf407"
+ dependencies = [
+- "cfg-if",
++ "cfg-if 0.1.9",
+  "libc",
+  "wasi",
+ ]
+@@ -894,7 +900,7 @@ version = "0.4.8"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "14b6052be84e6b71ab17edffc2eeabf5c2c3ae1fdb464aae35ac50c67a44e1f7"
+ dependencies = [
+- "cfg-if",
++ "cfg-if 0.1.9",
+ ]
+ 
+ [[package]]
+@@ -960,7 +966,7 @@ version = "0.6.21"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "302dec22bcf6bae6dfb69c647187f4b4d0fb6f535521f7bc022430ce8e12008f"
+ dependencies = [
+- "cfg-if",
++ "cfg-if 0.1.9",
+  "fuchsia-zircon",
+  "fuchsia-zircon-sys",
+  "iovec",
+@@ -1033,7 +1039,7 @@ version = "0.2.33"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "42550d9fb7b6684a6d404d9fa7250c2eb2646df731d1c06afc06dcee9e1bcf88"
+ dependencies = [
+- "cfg-if",
++ "cfg-if 0.1.9",
+  "libc",
+  "winapi 0.3.8",
+ ]
+@@ -1120,7 +1126,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "8d575eff3665419f9b83678ff2815858ad9d11567e082f5ac1814baba4e2bcb4"
+ dependencies = [
+  "bitflags 1.2.1",
+- "cfg-if",
++ "cfg-if 0.1.9",
+  "foreign-types",
+  "lazy_static",
+  "libc",
+@@ -1176,7 +1182,7 @@ version = "0.7.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "d58c7c768d4ba344e3e8d72518ac13e259d7c7ade24167003b8488e10b6740a3"
+ dependencies = [
+- "cfg-if",
++ "cfg-if 0.1.9",
+  "cloudabi",
+  "libc",
+  "redox_syscall",
+@@ -1840,13 +1846,12 @@ checksum = "4ecf3b85f68e8abaa7555aa5abdb1153079387e60b718283d732f03897fcfc86"
+ 
+ [[package]]
+ name = "socket2"
+-version = "0.3.11"
++version = "0.3.19"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "e8b74de517221a2cb01a53349cf54182acdc31a074727d3079068448c0676d85"
++checksum = "122e570113d28d773067fab24266b66753f6ea915758651696b6e35e49f88d6e"
+ dependencies = [
+- "cfg-if",
++ "cfg-if 1.0.0",
+  "libc",
+- "redox_syscall",
+  "winapi 0.3.8",
+ ]
+ 
+@@ -1990,7 +1995,7 @@ version = "0.15.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "13816d558f404113dfdf855ed982f160cf697b3e573a68b2b798062032182212"
+ dependencies = [
+- "cfg-if",
++ "cfg-if 0.1.9",
+  "doc-comment",
+  "libc",
+  "ntapi",
+@@ -2005,7 +2010,7 @@ version = "3.1.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "7a6e24d9338a0a5be79593e2fa15a648add6138caa803e2d5bc782c371732ca9"
+ dependencies = [
+- "cfg-if",
++ "cfg-if 0.1.9",
+  "libc",
+  "rand 0.7.2",
+  "redox_syscall",
+@@ -2121,7 +2126,7 @@ version = "0.18.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "72d7df08b45f4d6d124cdae3c303f9908159a17b39e633e524349e91bc798d32"
+ dependencies = [
+- "cfg-if",
++ "cfg-if 0.1.9",
+  "failure",
+  "futures",
+  "ipconfig",
diff --git a/pkgs/tools/networking/mozwire/default.nix b/pkgs/tools/networking/mozwire/default.nix
index afccd8376d8f..f8d615b525ef 100644
--- a/pkgs/tools/networking/mozwire/default.nix
+++ b/pkgs/tools/networking/mozwire/default.nix
@@ -1,19 +1,24 @@
-{ rustPlatform, lib, stdenv, fetchFromGitHub, Security }:
+{ rustPlatform
+, lib
+, stdenv
+, fetchFromGitHub
+, Security
+}:
 
 rustPlatform.buildRustPackage rec {
   pname = "MozWire";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "NilsIrl";
     repo = pname;
     rev = "v${version}";
-    sha256 = "01bj3c34x9ywxygsz4rdyw5gc9cz8x6zzl5fd7db8qy8bx2lhlr9";
+    hash = "sha256-vC8HmwJCHMKQUsYBwRmr88tmZxPKNvI6hxlcjG2AV3Q=";
   };
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security ];
 
-  cargoSha256 = "0q27p2hyw6c1fh5x8kwsrw8a1hk6z90z0z3w86ga8ryz53xg4vdi";
+  cargoHash = "sha256-9qXoMugmL6B9vC/yrMJxZ5p792ZJmrTzk/khRVTkHf4=";
 
   meta = with lib; {
     description = "MozillaVPN configuration manager giving Linux, macOS users (among others), access to MozillaVPN";
diff --git a/pkgs/tools/networking/nss-mdns/default.nix b/pkgs/tools/networking/nss-mdns/default.nix
index 238c0c364f9a..f2af99a922fd 100644
--- a/pkgs/tools/networking/nss-mdns/default.nix
+++ b/pkgs/tools/networking/nss-mdns/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     hash = "sha256-iRaf9/gu9VkGi1VbGpxvC5q+0M8ivezCz/oAKEg5V1M=";
   };
 
-  buildInputs = [ autoreconfHook pkg-config ];
+  nativeBuildInputs = [ autoreconfHook pkg-config ];
   # Note: Although `nss-mdns' works by talking to `avahi-daemon', it
   # doesn't depend on the Avahi libraries.  Instead, it contains
   # hand-written D-Bus code to talk to the Avahi daemon.
diff --git a/pkgs/tools/networking/ofono/default.nix b/pkgs/tools/networking/ofono/default.nix
index 80e37782154c..3733998c10b1 100644
--- a/pkgs/tools/networking/ofono/default.nix
+++ b/pkgs/tools/networking/ofono/default.nix
@@ -12,14 +12,14 @@
 
 stdenv.mkDerivation rec {
   pname = "ofono";
-  version = "1.34";
+  version = "2.0";
 
   outputs = [ "out" "dev" ];
 
   src = fetchgit {
     url = "git://git.kernel.org/pub/scm/network/ofono/ofono.git";
     rev = version;
-    sha256 = "sha256-mqltc+/RmQO8awP+J7p9fCVhNsEYA3SgxeV5Gkr1srg=";
+    sha256 = "sha256-T8rfReruvHGQCN9IDGIrFCoNjFKKMnUGPKzxo2HTZFQ=";
   };
 
   patches = [
diff --git a/pkgs/tools/networking/sipsak/default.nix b/pkgs/tools/networking/sipsak/default.nix
index 668dc18f8ace..89a7d706ccdc 100644
--- a/pkgs/tools/networking/sipsak/default.nix
+++ b/pkgs/tools/networking/sipsak/default.nix
@@ -4,8 +4,8 @@ stdenv.mkDerivation rec {
   pname = "sipsak";
   version = "4.1.2.1";
 
+  nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [
-    autoreconfHook
     openssl
     c-ares
   ];
diff --git a/pkgs/tools/networking/tdns-cli/default.nix b/pkgs/tools/networking/tdns-cli/default.nix
index 10dda6568fc3..006e7161b19d 100644
--- a/pkgs/tools/networking/tdns-cli/default.nix
+++ b/pkgs/tools/networking/tdns-cli/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tdns-cli";
-  version = "0.0.5";
+  version = "unstable-2021-02-19";
 
   src = fetchFromGitHub {
     owner = "rotty";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "0nn036in5j1h0vxkwif0lf7fn900zy4f4kxlzy6qdx3jakgmxvwh";
+    rev = "9a5455fe8a52f3f14dc55ef81511b479c8cd70ea";
+    hash = "sha256-BGxkqlKg81izq4eOBEZFJ/MPb3UCSOo8ZTYTjtjierk=";
   };
 
-  cargoSha256 = "sha256-O4n38dla2WgZ4949Ata6AYbZF9LMnXDyuFNoXRrTN7I=";
+  cargoHash = "sha256-uRny+l/LaQPjF5AnbxgKFLdjuAxcez1BqsL4g54KAwU=";
 
   meta = with lib; {
     description = "DNS tool that aims to replace dig and nsupdate";
diff --git a/pkgs/tools/networking/unbound/default.nix b/pkgs/tools/networking/unbound/default.nix
index 189cc14ff1ba..25fcc1bcc397 100644
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@@ -48,20 +48,20 @@
 
 stdenv.mkDerivation rec {
   pname = "unbound";
-  version = "1.16.2";
+  version = "1.16.3";
 
   src = fetchurl {
     url = "https://nlnetlabs.nl/downloads/unbound/unbound-${version}.tar.gz";
-    hash = "sha256-LjLyg4IMJMUcod2K/s/bdHxzhaE3q+hlyZ20sldANYE=";
+    hash = "sha256-6gxmZeLDMlt2nqwd/M1g/hgo1fz2YmUAOezLP2ftso4=";
   };
 
   outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB
 
-  nativeBuildInputs = [ makeWrapper ]
+  nativeBuildInputs = [ makeWrapper pkg-config ]
     ++ lib.optionals withPythonModule [ swig ];
 
   buildInputs = [ openssl nettle expat libevent ]
-    ++ lib.optionals withSystemd [ pkg-config systemd ]
+    ++ lib.optionals withSystemd [ systemd ]
     ++ lib.optionals withDoH [ libnghttp2 ]
     ++ lib.optionals withPythonModule [ python ];
 
diff --git a/pkgs/tools/security/chrome-token-signing/default.nix b/pkgs/tools/security/chrome-token-signing/default.nix
index 18104aa7710d..8081c7ef6eb5 100644
--- a/pkgs/tools/security/chrome-token-signing/default.nix
+++ b/pkgs/tools/security/chrome-token-signing/default.nix
@@ -11,7 +11,8 @@ mkDerivation rec {
     sha256 = "sha256-wKy/RVR7jx5AkMJgHXsuV+jlzyfH5nDRggcIUgh2ML4=";
   };
 
-  buildInputs = [ qmake pcsclite pkg-config ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ qmake pcsclite ];
   dontUseQmakeConfigure = true;
 
   patchPhase = ''
diff --git a/pkgs/tools/security/ecryptfs/default.nix b/pkgs/tools/security/ecryptfs/default.nix
index cd90342738ed..777aaea41ec2 100644
--- a/pkgs/tools/security/ecryptfs/default.nix
+++ b/pkgs/tools/security/ecryptfs/default.nix
@@ -35,11 +35,11 @@ stdenv.mkDerivation rec {
 
   configureFlags = lib.optionals (!enablePython) [ "--disable-pywrap" ];
 
-  nativeBuildInputs = [ pkg-config makeWrapper ]
+  nativeBuildInputs = [ pkg-config makeWrapper intltool ]
   # if python2 support is requested, it is needed at builtime as well as runtime.
   ++ lib.optionals (enablePython) [ python2 ]
   ;
-  buildInputs = [ perl nss nspr pam intltool ]
+  buildInputs = [ perl nss nspr pam ]
   ++ lib.optionals (enablePython) [ python2 ]
   ;
   propagatedBuildInputs = [ coreutils gettext cryptsetup lvm2 rsync keyutils which ];
diff --git a/pkgs/tools/security/fpm2/default.nix b/pkgs/tools/security/fpm2/default.nix
index 15d5a5adcffb..69e6c7f02817 100644
--- a/pkgs/tools/security/fpm2/default.nix
+++ b/pkgs/tools/security/fpm2/default.nix
@@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1lfzja3vzd6l6hfvw8gvg4qkl5iy6gra5pa8gjlps9l63k2bjfhz";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ gnupg gtk3 libxml2 intltool nettle ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ gnupg gtk3 libxml2 nettle ];
 
   meta = with lib; {
     description = "GTK2 port from Figaro's Password Manager originally developed by John Conneely, with some new enhancements";
diff --git a/pkgs/tools/security/gnupg-pkcs11-scd/default.nix b/pkgs/tools/security/gnupg-pkcs11-scd/default.nix
index 1e46df40f85f..22c11b3f2b1f 100644
--- a/pkgs/tools/security/gnupg-pkcs11-scd/default.nix
+++ b/pkgs/tools/security/gnupg-pkcs11-scd/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-Kb8p53gPkhxtOhH2COKwSDwbtRDFr6hHMJAkndV8Ukk=";
   };
 
-  buildInputs = [ pkcs11helper pkg-config openssl ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ pkcs11helper openssl ];
 
   configureFlags = [
     "--with-libgpg-error-prefix=${libgpg-error.dev}"
diff --git a/pkgs/tools/security/metasploit/shell.nix b/pkgs/tools/security/metasploit/shell.nix
index e4bae57b6866..ccd510f63af2 100644
--- a/pkgs/tools/security/metasploit/shell.nix
+++ b/pkgs/tools/security/metasploit/shell.nix
@@ -2,6 +2,7 @@
 with import <nixpkgs> {};
 stdenv.mkDerivation {
   name = "env";
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     bundix
     git
@@ -9,7 +10,6 @@ stdenv.mkDerivation {
     libpcap
     libxml2
     libxslt
-    pkg-config
     postgresql
     ruby.devEnv
     sqlite
diff --git a/pkgs/tools/security/onioncircuits/default.nix b/pkgs/tools/security/onioncircuits/default.nix
index 329de10ff6bb..249762781e7d 100644
--- a/pkgs/tools/security/onioncircuits/default.nix
+++ b/pkgs/tools/security/onioncircuits/default.nix
@@ -11,7 +11,7 @@ python3.pkgs.buildPythonApplication rec {
   };
 
   nativeBuildInputs = [ intltool ];
-  buildInputs = [ intltool gtk3 gobject-introspection ];
+  buildInputs = [ gtk3 gobject-introspection ];
   propagatedBuildInputs =  with python3.pkgs; [ stem distutils_extra pygobject3 ];
 
   postFixup = ''
diff --git a/pkgs/tools/security/tracee/default.nix b/pkgs/tools/security/tracee/default.nix
index 48d102e619d4..7d93e6d76f7d 100644
--- a/pkgs/tools/security/tracee/default.nix
+++ b/pkgs/tools/security/tracee/default.nix
@@ -63,7 +63,7 @@ buildGoModule rec {
 
   buildPhase = ''
     runHook preBuild
-    make $makeFlags ''${enableParallelBuilding:+-j$NIX_BUILD_CORES -l$NIX_BUILD_CORES}
+    make $makeFlags ''${enableParallelBuilding:+-j$NIX_BUILD_CORES
     runHook postBuild
   '';
 
diff --git a/pkgs/tools/system/gdmap/default.nix b/pkgs/tools/system/gdmap/default.nix
index 5fc242d533b8..eedb0f07d13a 100644
--- a/pkgs/tools/system/gdmap/default.nix
+++ b/pkgs/tools/system/gdmap/default.nix
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0nr8l88cg19zj585hczj8v73yh21k7j13xivhlzl8jdk0j0cj052";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ gtk2 libxml2 intltool gettext ];
+  nativeBuildInputs = [ pkg-config intltool ];
+  buildInputs = [ gtk2 libxml2 gettext ];
 
   patches = [ ./get_sensitive.patch ./set_flags.patch ];
 
diff --git a/pkgs/tools/text/mdbook-admonish/default.nix b/pkgs/tools/text/mdbook-admonish/default.nix
index 2809eee1fb4a..c7303fc2fd84 100644
--- a/pkgs/tools/text/mdbook-admonish/default.nix
+++ b/pkgs/tools/text/mdbook-admonish/default.nix
@@ -1,15 +1,26 @@
-{ lib, stdenv, fetchCrate, rustPlatform, CoreServices }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, rustPlatform, CoreServices }:
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook-admonish";
   version = "1.7.0";
 
-  src = fetchCrate {
-    inherit pname version;
-    sha256 = "sha256-QvFHpAsQ+S7q/Ye0YEf0phZcVvAs1a80Hd3eIGZBsrI=";
+  src = fetchFromGitHub {
+    owner = "tommilligan";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-AGOq05NevkRU8qHsJIWd2WfZ4i7w/wexf6c0fUAaoLg=";
   };
 
-  cargoSha256 = "sha256-v7MGJlDm5nvydjFAZZS94afZY2OVUjJQ9eXYaY9JxBs=";
+  cargoPatches = [
+    # https://github.com/tommilligan/mdbook-admonish/pull/33
+    (fetchpatch {
+      name = "update-mdbook-for-rust-1.64.patch";
+      url = "https://github.com/tommilligan/mdbook-admonish/commit/650123645b18a3f8ed170738c7c1813315095ed9.patch";
+      hash = "sha256-8LMk+Dgz9k0g9fbGGC0X2byyJtfDDgvdGxO06mD6GDI=";
+    })
+  ];
+
+  cargoHash = "sha256-5PWfze00/mWmzYqP5M1pAPt+SuknpU9dc0B7RSikuTE=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
 
diff --git a/pkgs/tools/text/mdbook-graphviz/default.nix b/pkgs/tools/text/mdbook-graphviz/default.nix
index 353c2b99ee91..ec683072e1a7 100644
--- a/pkgs/tools/text/mdbook-graphviz/default.nix
+++ b/pkgs/tools/text/mdbook-graphviz/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, rustPlatform, CoreServices, graphviz }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, rustPlatform, CoreServices, graphviz }:
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook-graphviz";
@@ -8,10 +8,15 @@ rustPlatform.buildRustPackage rec {
     owner = "dylanowen";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-HTHGb23wc10iAWXX/TNMXjTLWm+OSf1WWW1+/aQRcsk=";
+    hash = "sha256-HTHGb23wc10iAWXX/TNMXjTLWm+OSf1WWW1+/aQRcsk=";
   };
 
-  cargoSha256 = "sha256-7z/4brKY9vpic8mv1b4P/8DE+VyColYnPPoPmY9891M=";
+  cargoPatches = [
+    # Remove when updating mdbook-graphviz past 0.1.4.
+    ./update-mdbook-for-rust-1.64.patch
+  ];
+
+  cargoHash = "sha256-keDyfXooPU/GOx56OTq5psDohfZ0E478bnWn0bbC29o=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
 
diff --git a/pkgs/tools/text/mdbook-graphviz/update-mdbook-for-rust-1.64.patch b/pkgs/tools/text/mdbook-graphviz/update-mdbook-for-rust-1.64.patch
new file mode 100644
index 000000000000..58f52cf00dc4
--- /dev/null
+++ b/pkgs/tools/text/mdbook-graphviz/update-mdbook-for-rust-1.64.patch
@@ -0,0 +1,369 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index 292fb1f..ce66190 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -26,15 +26,6 @@ dependencies = [
+  "url",
+ ]
+ 
+-[[package]]
+-name = "ansi_term"
+-version = "0.12.1"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "d52a9bb7ec0cf484c551830a7ce27bd20d67eac647e1befb56b0be4ee39a55d2"
+-dependencies = [
+- "winapi 0.3.9",
+-]
+-
+ [[package]]
+ name = "anyhow"
+ version = "1.0.52"
+@@ -156,32 +147,36 @@ dependencies = [
+ 
+ [[package]]
+ name = "clap"
+-version = "2.34.0"
++version = "3.2.22"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "a0610544180c38b88101fecf2dd634b174a62eef6946f84dfc6a7127512b381c"
++checksum = "86447ad904c7fb335a790c9d7fe3d0d971dc523b8ccd1561a520de9a85302750"
+ dependencies = [
+- "ansi_term",
+  "atty",
+  "bitflags",
+- "strsim 0.8.0",
+- "textwrap 0.11.0",
+- "unicode-width",
+- "vec_map",
++ "clap_lex",
++ "indexmap",
++ "once_cell",
++ "strsim",
++ "termcolor",
++ "textwrap",
+ ]
+ 
+ [[package]]
+-name = "clap"
+-version = "3.0.4"
++name = "clap_complete"
++version = "3.2.5"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "d01c9347757e131122b19cd19a05c85805b68c2352a97b623efdc3c295290299"
++checksum = "3f7a2e0a962c45ce25afce14220bc24f9dade0a1787f185cecf96bfba7847cd8"
++dependencies = [
++ "clap",
++]
++
++[[package]]
++name = "clap_lex"
++version = "0.2.4"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "2850f2f5a82cbf437dd5af4d49848fbdfc27c157c3d010345776f952765261c5"
+ dependencies = [
+- "atty",
+- "bitflags",
+- "indexmap",
+  "os_str_bytes",
+- "strsim 0.10.0",
+- "termcolor",
+- "textwrap 0.14.2",
+ ]
+ 
+ [[package]]
+@@ -213,24 +208,21 @@ dependencies = [
+ 
+ [[package]]
+ name = "elasticlunr-rs"
+-version = "2.3.14"
++version = "3.0.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "60eee99ae400fb1c4521ea3bd678994cb66572754d240449368e8ecd40281569"
++checksum = "b94d9c8df0fe6879ca12e7633fdfe467c503722cc981fc463703472d2b876448"
+ dependencies = [
+- "lazy_static",
+  "regex",
+  "serde",
+  "serde_derive",
+  "serde_json",
+- "strum",
+- "strum_macros",
+ ]
+ 
+ [[package]]
+ name = "env_logger"
+-version = "0.7.1"
++version = "0.9.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "44533bbbb3bb3c1fa17d9f2e4e38bbbaf8396ba82193c4cb1b6445d711445d36"
++checksum = "c90bf5f19754d10198ccb95b70664fc925bd1fc090a0fd9a6ebc54acc8cd6272"
+ dependencies = [
+  "atty",
+  "humantime",
+@@ -465,7 +457,7 @@ dependencies = [
+  "log",
+  "pest",
+  "pest_derive",
+- "quick-error 2.0.1",
++ "quick-error",
+  "serde",
+  "serde_json",
+ ]
+@@ -501,15 +493,6 @@ dependencies = [
+  "http",
+ ]
+ 
+-[[package]]
+-name = "heck"
+-version = "0.3.3"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "6d621efb26863f0e9924c6ac577e8275e5e6b77455db64ffa6c65c904e9e132c"
+-dependencies = [
+- "unicode-segmentation",
+-]
+-
+ [[package]]
+ name = "hermit-abi"
+ version = "0.1.19"
+@@ -569,12 +552,9 @@ checksum = "c4a1e36c821dbe04574f602848a19f742f4fb3c98d40449f11bcad18d6b17421"
+ 
+ [[package]]
+ name = "humantime"
+-version = "1.3.0"
++version = "2.1.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "df004cfca50ef23c36850aaaa59ad52cc70d0e90243c3c7737a4dd32dc7a3c4f"
+-dependencies = [
+- "quick-error 1.2.3",
+-]
++checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
+ 
+ [[package]]
+ name = "hyper"
+@@ -763,14 +743,15 @@ checksum = "a3e378b66a060d48947b590737b30a1be76706c8dd7b8ba0f2fe3989c68a853f"
+ 
+ [[package]]
+ name = "mdbook"
+-version = "0.4.15"
++version = "0.4.21"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "241f10687eb3b4e0634b3b4e423f97c5f1efbd69dc9522e24a8b94583eeec3c6"
++checksum = "23f3e133c6d515528745ffd3b9f0c7d975ae039f0b6abb099f2168daa2afb4f9"
+ dependencies = [
+  "ammonia",
+  "anyhow",
+  "chrono",
+- "clap 2.34.0",
++ "clap",
++ "clap_complete",
+  "elasticlunr-rs",
+  "env_logger",
+  "futures-util",
+@@ -784,7 +765,6 @@ dependencies = [
+  "pulldown-cmark",
+  "regex",
+  "serde",
+- "serde_derive",
+  "serde_json",
+  "shlex",
+  "tempfile",
+@@ -798,7 +778,7 @@ dependencies = [
+ name = "mdbook-graphviz"
+ version = "0.1.4"
+ dependencies = [
+- "clap 3.0.4",
++ "clap",
+  "lazy_static",
+  "mdbook",
+  "pulldown-cmark",
+@@ -810,9 +790,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "memchr"
+-version = "2.4.1"
++version = "2.5.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "308cc39be01b73d0d18f82a0e7b2a3df85245f84af96fdddc5d202d27e47b86a"
++checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
+ 
+ [[package]]
+ name = "mime"
+@@ -968,6 +948,12 @@ dependencies = [
+  "libc",
+ ]
+ 
++[[package]]
++name = "once_cell"
++version = "1.15.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "e82dad04139b71a90c080c8463fe0dc7902db5192d939bd0950f074d014339e1"
++
+ [[package]]
+ name = "opaque-debug"
+ version = "0.2.3"
+@@ -995,9 +981,6 @@ name = "os_str_bytes"
+ version = "6.0.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "8e22443d1643a904602595ba1cd8f7d896afe56d26712531c5ff73a15b2fbf64"
+-dependencies = [
+- "memchr",
+-]
+ 
+ [[package]]
+ name = "parking_lot"
+@@ -1166,9 +1149,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "pulldown-cmark"
+-version = "0.9.0"
++version = "0.9.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "acd16514d1af5f7a71f909a44ef253cdb712a376d7ebc8ae4a471a9be9743548"
++checksum = "2d9cc634bc78768157b5cbfe988ffcd1dcba95cd2b2f03a88316c08c6d00ed63"
+ dependencies = [
+  "bitflags",
+  "getopts",
+@@ -1185,12 +1168,6 @@ dependencies = [
+  "pulldown-cmark",
+ ]
+ 
+-[[package]]
+-name = "quick-error"
+-version = "1.2.3"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
+-
+ [[package]]
+ name = "quick-error"
+ version = "2.0.1"
+@@ -1308,9 +1285,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "regex"
+-version = "1.5.4"
++version = "1.6.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "d07a8629359eb56f1e2fb1652bb04212c072a87ba68546a04065d525673ac461"
++checksum = "4c4eb3267174b8c6c2f654116623910a0fef09c4753f8dd83db29c48a0df988b"
+ dependencies = [
+  "aho-corasick",
+  "memchr",
+@@ -1325,9 +1302,9 @@ checksum = "6c230d73fb8d8c1b9c0b3135c5142a8acee3a0558fb8db5cf1cb65f8d7862132"
+ 
+ [[package]]
+ name = "regex-syntax"
+-version = "0.6.25"
++version = "0.6.27"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "f497285884f3fcff424ffc933e56d7cbca511def0c9831a7f9b5f6153e3cc89b"
++checksum = "a3f87b73ce11b1619a3c6332f45341e0047173771e8b8b73f87bfeefb7b56244"
+ 
+ [[package]]
+ name = "remove_dir_all"
+@@ -1370,6 +1347,9 @@ name = "serde"
+ version = "1.0.133"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "97565067517b60e2d1ea8b268e59ce036de907ac523ad83a0475da04e818989a"
++dependencies = [
++ "serde_derive",
++]
+ 
+ [[package]]
+ name = "serde_derive"
+@@ -1490,36 +1470,12 @@ dependencies = [
+  "quote",
+ ]
+ 
+-[[package]]
+-name = "strsim"
+-version = "0.8.0"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "8ea5119cdb4c55b55d432abb513a0429384878c15dde60cc77b1c99de1a95a6a"
+-
+ [[package]]
+ name = "strsim"
+ version = "0.10.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
+ 
+-[[package]]
+-name = "strum"
+-version = "0.21.0"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "aaf86bbcfd1fa9670b7a129f64fc0c9fcbbfe4f1bc4210e9e98fe71ffc12cde2"
+-
+-[[package]]
+-name = "strum_macros"
+-version = "0.21.1"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "d06aaeeee809dbc59eb4556183dd927df67db1540de5be8d3ec0b6636358a5ec"
+-dependencies = [
+- "heck",
+- "proc-macro2",
+- "quote",
+- "syn",
+-]
+-
+ [[package]]
+ name = "syn"
+ version = "1.0.84"
+@@ -1567,18 +1523,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "textwrap"
+-version = "0.11.0"
++version = "0.15.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "d326610f408c7a4eb6f51c37c330e496b08506c9457c9d34287ecc38809fb060"
+-dependencies = [
+- "unicode-width",
+-]
+-
+-[[package]]
+-name = "textwrap"
+-version = "0.14.2"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "0066c8d12af8b5acd21e00547c3797fde4e8677254a7ee429176ccebbe93dd80"
++checksum = "949517c0cf1bf4ee812e2e07e08ab448e3ae0d23472aee8a06c985f0c8815b16"
+ 
+ [[package]]
+ name = "thiserror"
+@@ -1793,12 +1740,6 @@ dependencies = [
+  "tinyvec",
+ ]
+ 
+-[[package]]
+-name = "unicode-segmentation"
+-version = "1.8.0"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "8895849a949e7845e06bd6dc1aa51731a103c42707010a5b591c0038fb73385b"
+-
+ [[package]]
+ name = "unicode-width"
+ version = "0.1.9"
+@@ -1829,12 +1770,6 @@ version = "0.7.6"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
+ 
+-[[package]]
+-name = "vec_map"
+-version = "0.8.2"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "f1bddf1187be692e79c5ffeab891132dfb0f236ed36a43c7ed39f1165ee20191"
+-
+ [[package]]
+ name = "version_check"
+ version = "0.9.4"
+diff --git a/Cargo.toml b/Cargo.toml
+index 18b4b0e..3a88235 100644
+--- a/Cargo.toml
++++ b/Cargo.toml
+@@ -12,7 +12,7 @@ edition = "2018"
+ # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+ 
+ [dependencies]
+-mdbook = "^0.4.15"
++mdbook = "^0.4.21"
+ clap = "3.0"
+ serde_json = "1.0"
+ pulldown-cmark = "0.9"
diff --git a/pkgs/tools/text/mdbook-katex/default.nix b/pkgs/tools/text/mdbook-katex/default.nix
index a97e7ca89483..5291b9e9f821 100644
--- a/pkgs/tools/text/mdbook-katex/default.nix
+++ b/pkgs/tools/text/mdbook-katex/default.nix
@@ -8,10 +8,15 @@ rustPlatform.buildRustPackage rec {
     owner = "lzanini";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-5PzXX7icRxcHpzjp3x/9ssn2o0444uHrzBn1Ds1DEPM=";
+    hash = "sha256-5PzXX7icRxcHpzjp3x/9ssn2o0444uHrzBn1Ds1DEPM=";
   };
 
-  cargoSha256 = "sha256-tqdpIBlKiyYSWFPYTnzVeDML2GM+mukbOHS3sNYUgdc=";
+  cargoPatches = [
+    # Remove when https://github.com/lzanini/mdbook-katex/pull/35 is in a new release.
+    ./update-mdbook-for-rust-1.64.patch
+  ];
+
+  cargoHash = "sha256-lrEirKkGf9/8yLyLSON54UaeQ3Xtl7g7ezUc7e1KVHw=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
 
diff --git a/pkgs/tools/text/mdbook-katex/update-mdbook-for-rust-1.64.patch b/pkgs/tools/text/mdbook-katex/update-mdbook-for-rust-1.64.patch
new file mode 100644
index 000000000000..ee90a3076702
--- /dev/null
+++ b/pkgs/tools/text/mdbook-katex/update-mdbook-for-rust-1.64.patch
@@ -0,0 +1,1417 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index 3ff0894..ffef44f 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -1,10 +1,12 @@
+ # This file is automatically @generated by Cargo.
+ # It is not intended for manual editing.
++version = 3
++
+ [[package]]
+ name = "aho-corasick"
+-version = "0.7.15"
++version = "0.7.19"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "7404febffaa47dac81aa44dba71523c9d069b1bdc50a77db41195149e17f68e5"
++checksum = "b4f55bd91a0978cbfd91c457a164bab8b4001c833b7f323132c0a4e1922dd44e"
+ dependencies = [
+  "memchr",
+ ]
+@@ -52,9 +54,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "autocfg"
+-version = "1.0.1"
++version = "1.1.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "cdb031dd78e28731d87d56cc8ffef4a8f36ca26c38fe2de700543e627f8a464a"
++checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+ 
+ [[package]]
+ name = "base64"
+@@ -62,11 +64,17 @@ version = "0.12.3"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "3441f0f7b02788e948e47f457ca01f1d7e6d92c693bc132c22b087d3141c03ff"
+ 
++[[package]]
++name = "base64"
++version = "0.13.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "904dfeac50f3cdaba28fc6f57fdcddb75f49ed61346676a78c4ffe55877802fd"
++
+ [[package]]
+ name = "bitflags"
+-version = "1.2.1"
++version = "1.3.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "cf1de2fe8c75bc145a2f577add951f8134889b4795d47466a54a5c846d691693"
++checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+ 
+ [[package]]
+ name = "block-buffer"
+@@ -82,9 +90,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "block-buffer"
+-version = "0.9.0"
++version = "0.10.3"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "4152116fd6e9dadb291ae18fc1ec3575ed6d84c29642d97890f4b4a3417297e4"
++checksum = "69cce20737498f97b993470a6e536b8523f0af7892a4f928cceb1ac5e52ebe7e"
+ dependencies = [
+  "generic-array 0.14.4",
+ ]
+@@ -98,6 +106,17 @@ dependencies = [
+  "byte-tools",
+ ]
+ 
++[[package]]
++name = "bstr"
++version = "0.2.17"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "ba3569f383e8f1598449f1a423e72e99569137b47740b1da11ef19af3d5c3223"
++dependencies = [
++ "lazy_static",
++ "memchr",
++ "regex-automata",
++]
++
+ [[package]]
+ name = "byte-tools"
+ version = "0.3.1"
+@@ -116,6 +135,12 @@ version = "0.5.6"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "0e4cec68f03f32e44924783795810fa50a7035d8c8ebe78580ad7e6c703fba38"
+ 
++[[package]]
++name = "bytes"
++version = "1.2.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "ec8a7b6a70fde80372154c65702f00a0f56f3e1c36abbc6c440484be248856db"
++
+ [[package]]
+ name = "cc"
+ version = "1.0.62"
+@@ -157,11 +182,45 @@ dependencies = [
+  "atty",
+  "bitflags",
+  "strsim 0.8.0",
+- "textwrap",
++ "textwrap 0.11.0",
+  "unicode-width",
+  "vec_map",
+ ]
+ 
++[[package]]
++name = "clap"
++version = "3.2.22"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "86447ad904c7fb335a790c9d7fe3d0d971dc523b8ccd1561a520de9a85302750"
++dependencies = [
++ "atty",
++ "bitflags",
++ "clap_lex",
++ "indexmap",
++ "once_cell",
++ "strsim 0.10.0",
++ "termcolor",
++ "textwrap 0.15.1",
++]
++
++[[package]]
++name = "clap_complete"
++version = "3.2.5"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "3f7a2e0a962c45ce25afce14220bc24f9dade0a1787f185cecf96bfba7847cd8"
++dependencies = [
++ "clap 3.2.22",
++]
++
++[[package]]
++name = "clap_lex"
++version = "0.2.4"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "2850f2f5a82cbf437dd5af4d49848fbdfc27c157c3d010345776f952765261c5"
++dependencies = [
++ "os_str_bytes",
++]
++
+ [[package]]
+ name = "copy_dir"
+ version = "0.1.2"
+@@ -172,10 +231,23 @@ dependencies = [
+ ]
+ 
+ [[package]]
+-name = "cpuid-bool"
+-version = "0.1.2"
++name = "cpufeatures"
++version = "0.2.5"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "28d997bd5e24a5928dd43e46dc529867e207907fe0b239c3477d924f7f2ca320"
++dependencies = [
++ "libc",
++]
++
++[[package]]
++name = "crypto-common"
++version = "0.1.6"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "8aebca1129a03dc6dc2b127edd729435bbc4a37e1d5f4d7513165089ceb02634"
++checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
++dependencies = [
++ "generic-array 0.14.4",
++ "typenum",
++]
+ 
+ [[package]]
+ name = "darling"
+@@ -248,39 +320,31 @@ dependencies = [
+ 
+ [[package]]
+ name = "digest"
+-version = "0.9.0"
++version = "0.10.5"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "d3dd60d1080a57a05ab032377049e0591415d2b31afd7028356dbf3cc6dcb066"
++checksum = "adfbc57365a37acbd2ebf2b64d7e69bb766e2fea813521ed536f5d0520dcf86c"
+ dependencies = [
+- "generic-array 0.14.4",
++ "block-buffer 0.10.3",
++ "crypto-common",
+ ]
+ 
+-[[package]]
+-name = "dtoa"
+-version = "0.4.6"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "134951f4028bdadb9b84baf4232681efbf277da25144b9b0ad65df75946c422b"
+-
+ [[package]]
+ name = "elasticlunr-rs"
+-version = "2.3.9"
++version = "3.0.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "35622eb004c8f0c5e7e2032815f3314a93df0db30a1ce5c94e62c1ecc81e22b9"
++checksum = "b94d9c8df0fe6879ca12e7633fdfe467c503722cc981fc463703472d2b876448"
+ dependencies = [
+- "lazy_static",
+  "regex",
+  "serde",
+  "serde_derive",
+  "serde_json",
+- "strum",
+- "strum_macros",
+ ]
+ 
+ [[package]]
+ name = "env_logger"
+-version = "0.7.1"
++version = "0.9.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "44533bbbb3bb3c1fa17d9f2e4e38bbbaf8396ba82193c4cb1b6445d711445d36"
++checksum = "c90bf5f19754d10198ccb95b70664fc925bd1fc090a0fd9a6ebc54acc8cd6272"
+ dependencies = [
+  "atty",
+  "humantime",
+@@ -368,25 +432,11 @@ dependencies = [
+  "new_debug_unreachable",
+ ]
+ 
+-[[package]]
+-name = "futures"
+-version = "0.3.8"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "9b3b0c040a1fe6529d30b3c5944b280c7f0dcb2930d2c3062bca967b602583d0"
+-dependencies = [
+- "futures-channel",
+- "futures-core",
+- "futures-io",
+- "futures-sink",
+- "futures-task",
+- "futures-util",
+-]
+-
+ [[package]]
+ name = "futures-channel"
+-version = "0.3.8"
++version = "0.3.24"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "4b7109687aa4e177ef6fe84553af6280ef2778bdb7783ba44c9dc3399110fe64"
++checksum = "30bdd20c28fadd505d0fd6712cdfcb0d4b5648baf45faef7f852afb2399bb050"
+ dependencies = [
+  "futures-core",
+  "futures-sink",
+@@ -394,23 +444,16 @@ dependencies = [
+ 
+ [[package]]
+ name = "futures-core"
+-version = "0.3.8"
++version = "0.3.24"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "847ce131b72ffb13b6109a221da9ad97a64cbe48feb1028356b836b47b8f1748"
+-
+-[[package]]
+-name = "futures-io"
+-version = "0.3.8"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "611834ce18aaa1bd13c4b374f5d653e1027cf99b6b502584ff8c9a64413b30bb"
++checksum = "4e5aa3de05362c3fb88de6531e6296e85cde7739cccad4b9dfeeb7f6ebce56bf"
+ 
+ [[package]]
+ name = "futures-macro"
+-version = "0.3.8"
++version = "0.3.24"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "77408a692f1f97bcc61dc001d752e00643408fbc922e4d634c655df50d595556"
++checksum = "42cd15d1c7456c04dbdf7e88bcd69760d74f3a798d6444e16974b505b0e62f17"
+ dependencies = [
+- "proc-macro-hack",
+  "proc-macro2",
+  "quote",
+  "syn",
+@@ -418,33 +461,28 @@ dependencies = [
+ 
+ [[package]]
+ name = "futures-sink"
+-version = "0.3.8"
++version = "0.3.24"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "f878195a49cee50e006b02b93cf7e0a95a38ac7b776b4c4d9cc1207cd20fcb3d"
++checksum = "21b20ba5a92e727ba30e72834706623d94ac93a725410b6a6b6fbc1b07f7ba56"
+ 
+ [[package]]
+ name = "futures-task"
+-version = "0.3.8"
++version = "0.3.24"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "7c554eb5bf48b2426c4771ab68c6b14468b6e76cc90996f528c3338d761a4d0d"
+-dependencies = [
+- "once_cell",
+-]
++checksum = "a6508c467c73851293f390476d4491cf4d227dbabcd4170f3bb6044959b294f1"
+ 
+ [[package]]
+ name = "futures-util"
+-version = "0.3.8"
++version = "0.3.24"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "d304cff4a7b99cfb7986f7d43fbe93d175e72e704a8860787cc95e9ffd85cbd2"
++checksum = "44fb6cb1be61cc1d2e43b262516aafcf63b241cffdb1d3fa115f91d9c7b09c90"
+ dependencies = [
+  "futures-core",
+  "futures-macro",
+  "futures-sink",
+  "futures-task",
+- "pin-project 1.0.1",
++ "pin-project-lite",
+  "pin-utils",
+- "proc-macro-hack",
+- "proc-macro-nested",
+  "slab",
+ ]
+ 
+@@ -468,23 +506,25 @@ dependencies = [
+ ]
+ 
+ [[package]]
+-name = "getopts"
+-version = "0.2.21"
++name = "getrandom"
++version = "0.1.15"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "14dbbfd5c71d70241ecf9e6f13737f7b5ce823821063188d7e46c41d371eebd5"
++checksum = "fc587bc0ec293155d5bfa6b9891ec18a1e330c234f896ea47fbada4cadbe47e6"
+ dependencies = [
+- "unicode-width",
++ "cfg-if 0.1.10",
++ "libc",
++ "wasi 0.9.0+wasi-snapshot-preview1",
+ ]
+ 
+ [[package]]
+ name = "getrandom"
+-version = "0.1.15"
++version = "0.2.7"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "fc587bc0ec293155d5bfa6b9891ec18a1e330c234f896ea47fbada4cadbe47e6"
++checksum = "4eb1a864a501629691edf6c15a593b7a51eebaa1e8468e9ddc623de7c9b58ec6"
+ dependencies = [
+- "cfg-if 0.1.10",
++ "cfg-if 1.0.0",
+  "libc",
+- "wasi 0.9.0+wasi-snapshot-preview1",
++ "wasi 0.11.0+wasi-snapshot-preview1",
+ ]
+ 
+ [[package]]
+@@ -504,11 +544,11 @@ checksum = "9b919933a397b79c37e33b77bb2aa3dc8eb6e165ad809e58ff75bc7db2e34574"
+ 
+ [[package]]
+ name = "h2"
+-version = "0.2.7"
++version = "0.3.14"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "5e4728fd124914ad25e99e3d15a9361a879f6620f63cb56bbb08f95abb97a535"
++checksum = "5ca32592cf21ac7ccab1825cd87f6c9b3d9022c44d086172ed0966bec8af30be"
+ dependencies = [
+- "bytes",
++ "bytes 1.2.1",
+  "fnv",
+  "futures-core",
+  "futures-sink",
+@@ -519,21 +559,20 @@ dependencies = [
+  "tokio",
+  "tokio-util",
+  "tracing",
+- "tracing-futures",
+ ]
+ 
+ [[package]]
+ name = "handlebars"
+-version = "3.5.1"
++version = "4.3.5"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "2764f9796c0ddca4b82c07f25dd2cb3db30b9a8f47940e78e1c883d9e95c3db9"
++checksum = "433e4ab33f1213cdc25b5fa45c76881240cfe79284cf2b395e8b9e312a30a2fd"
+ dependencies = [
+  "log",
+  "pest",
+  "pest_derive",
+- "quick-error 2.0.0",
+  "serde",
+  "serde_json",
++ "thiserror",
+ ]
+ 
+ [[package]]
+@@ -548,9 +587,9 @@ version = "0.3.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "ed18eb2459bf1a09ad2d6b1547840c3e5e62882fa09b9a6a20b1de8e3228848f"
+ dependencies = [
+- "base64",
++ "base64 0.12.3",
+  "bitflags",
+- "bytes",
++ "bytes 0.5.6",
+  "headers-core",
+  "http",
+  "mime",
+@@ -567,15 +606,6 @@ dependencies = [
+  "http",
+ ]
+ 
+-[[package]]
+-name = "heck"
+-version = "0.3.1"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "20564e78d53d2bb135c343b3f47714a56af2061f1c928fdb541dc7b9fdd94205"
+-dependencies = [
+- "unicode-segmentation",
+-]
+-
+ [[package]]
+ name = "hermit-abi"
+ version = "0.1.17"
+@@ -605,19 +635,20 @@ version = "0.2.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "28d569972648b2c512421b5f2a405ad6ac9666547189d0c5477a3f200f3e02f9"
+ dependencies = [
+- "bytes",
++ "bytes 0.5.6",
+  "fnv",
+- "itoa",
++ "itoa 0.4.6",
+ ]
+ 
+ [[package]]
+ name = "http-body"
+-version = "0.3.1"
++version = "0.4.5"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "13d5ff830006f7646652e057693569bfe0d51760c0085a071769d142a205111b"
++checksum = "d5f38f16d184e36f2408a55281cd658ecbd3ca05cce6d6510a176eca393e26d1"
+ dependencies = [
+- "bytes",
++ "bytes 1.2.1",
+  "http",
++ "pin-project-lite",
+ ]
+ 
+ [[package]]
+@@ -634,20 +665,17 @@ checksum = "494b4d60369511e7dea41cf646832512a94e542f68bb9c49e54518e0f468eb47"
+ 
+ [[package]]
+ name = "humantime"
+-version = "1.3.0"
++version = "2.1.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "df004cfca50ef23c36850aaaa59ad52cc70d0e90243c3c7737a4dd32dc7a3c4f"
+-dependencies = [
+- "quick-error 1.2.3",
+-]
++checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
+ 
+ [[package]]
+ name = "hyper"
+-version = "0.13.9"
++version = "0.14.5"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "f6ad767baac13b44d4529fcf58ba2cd0995e36e7b435bc5b039de6f47e880dbf"
++checksum = "8bf09f61b52cfcf4c00de50df88ae423d6c02354e385a86341133b5338630ad1"
+ dependencies = [
+- "bytes",
++ "bytes 1.2.1",
+  "futures-channel",
+  "futures-core",
+  "futures-util",
+@@ -656,8 +684,8 @@ dependencies = [
+  "http-body",
+  "httparse",
+  "httpdate",
+- "itoa",
+- "pin-project 1.0.1",
++ "itoa 0.4.6",
++ "pin-project",
+  "socket2",
+  "tokio",
+  "tower-service",
+@@ -712,15 +740,6 @@ dependencies = [
+  "libc",
+ ]
+ 
+-[[package]]
+-name = "input_buffer"
+-version = "0.3.1"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "19a8a95243d5a0398cae618ec29477c6e3cb631152be5c19481f80bc71559754"
+-dependencies = [
+- "bytes",
+-]
+-
+ [[package]]
+ name = "iovec"
+ version = "0.1.4"
+@@ -736,6 +755,12 @@ version = "0.4.6"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "dc6f3ad7b9d11a0c00842ff8de1b60ee58661048eb8049ed33c73594f359d7e6"
+ 
++[[package]]
++name = "itoa"
++version = "1.0.3"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "6c8af84674fe1f223a982c933a0ee1086ac4d4052aa0fb8060c12c6ad838e754"
++
+ [[package]]
+ name = "katex"
+ version = "0.3.2"
+@@ -771,9 +796,9 @@ checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
+ 
+ [[package]]
+ name = "libc"
+-version = "0.2.80"
++version = "0.2.134"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "4d58d1b70b004888f764dfbf6a26a3b0342a1632d33968e4a179d8011c760614"
++checksum = "329c933548736bc49fd575ee68c89e8be4d260064184389a5b77517cddd99ffb"
+ 
+ [[package]]
+ name = "libquickjs-sys"
+@@ -843,14 +868,15 @@ checksum = "7ffc5c5338469d4d3ea17d269fa8ea3512ad247247c30bd2df69e68309ed0a08"
+ 
+ [[package]]
+ name = "mdbook"
+-version = "0.4.4"
++version = "0.4.21"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "714a3ac362b9b32eef9468ecfe604cb8e2204d50793602e9d49fee44781230e7"
++checksum = "23f3e133c6d515528745ffd3b9f0c7d975ae039f0b6abb099f2168daa2afb4f9"
+ dependencies = [
+  "ammonia",
+  "anyhow",
+  "chrono",
+- "clap",
++ "clap 3.2.22",
++ "clap_complete",
+  "elasticlunr-rs",
+  "env_logger",
+  "futures-util",
+@@ -860,16 +886,16 @@ dependencies = [
+  "log",
+  "memchr",
+  "notify",
+- "open",
++ "opener",
+  "pulldown-cmark",
+  "regex",
+  "serde",
+- "serde_derive",
+  "serde_json",
+  "shlex",
+  "tempfile",
+  "tokio",
+  "toml",
++ "topological-sort",
+  "warp",
+ ]
+ 
+@@ -877,7 +903,7 @@ dependencies = [
+ name = "mdbook-katex"
+ version = "0.2.10"
+ dependencies = [
+- "clap",
++ "clap 2.33.3",
+  "katex",
+  "mdbook",
+  "serde_json",
+@@ -886,9 +912,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "memchr"
+-version = "2.3.4"
++version = "2.5.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "0ee1c47aaa256ecabcaea351eae4a9b01ef39ed810004e298d2511ed284b1525"
++checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
+ 
+ [[package]]
+ name = "mime"
+@@ -925,6 +951,18 @@ dependencies = [
+  "winapi 0.2.8",
+ ]
+ 
++[[package]]
++name = "mio"
++version = "0.8.4"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "57ee1c23c7c63b0c9250c339ffdc69255f110b298b901b9f6c82547b7b87caaf"
++dependencies = [
++ "libc",
++ "log",
++ "wasi 0.11.0+wasi-snapshot-preview1",
++ "windows-sys",
++]
++
+ [[package]]
+ name = "mio-extras"
+ version = "2.0.6"
+@@ -933,7 +971,7 @@ checksum = "52403fe290012ce777c4626790c8951324a2b9e3316b3143779c72b029742f19"
+ dependencies = [
+  "lazycell",
+  "log",
+- "mio",
++ "mio 0.6.22",
+  "slab",
+ ]
+ 
+@@ -978,7 +1016,7 @@ dependencies = [
+  "fsevent-sys",
+  "inotify",
+  "libc",
+- "mio",
++ "mio 0.6.22",
+  "mio-extras",
+  "walkdir 2.3.1",
+  "winapi 0.3.9",
+@@ -1004,32 +1042,43 @@ dependencies = [
+ ]
+ 
+ [[package]]
+-name = "once_cell"
+-version = "1.5.2"
++name = "num_cpus"
++version = "1.13.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "13bd41f508810a131401606d54ac32a467c97172d74ba7662562ebba5ad07fa0"
++checksum = "19e64526ebdee182341572e50e9ad03965aa510cd94427a4549448f285e957a1"
++dependencies = [
++ "hermit-abi",
++ "libc",
++]
+ 
+ [[package]]
+-name = "opaque-debug"
+-version = "0.2.3"
++name = "once_cell"
++version = "1.15.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "2839e79665f131bdb5782e51f2c6c9599c133c6098982a54c794358bf432529c"
++checksum = "e82dad04139b71a90c080c8463fe0dc7902db5192d939bd0950f074d014339e1"
+ 
+ [[package]]
+ name = "opaque-debug"
+-version = "0.3.0"
++version = "0.2.3"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "624a8340c38c1b80fd549087862da4ba43e08858af025b236e509b6649fc13d5"
++checksum = "2839e79665f131bdb5782e51f2c6c9599c133c6098982a54c794358bf432529c"
+ 
+ [[package]]
+-name = "open"
+-version = "1.4.0"
++name = "opener"
++version = "0.5.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "7c283bf0114efea9e42f1a60edea9859e8c47528eae09d01df4b29c1e489cc48"
++checksum = "4ea3ebcd72a54701f56345f16785a6d3ac2df7e986d273eb4395c0b01db17952"
+ dependencies = [
++ "bstr",
+  "winapi 0.3.9",
+ ]
+ 
++[[package]]
++name = "os_str_bytes"
++version = "6.3.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "9ff7415e9ae3fff1225851df9e0d9e4e5479f947619774677a63572e55e80eff"
++
+ [[package]]
+ name = "percent-encoding"
+ version = "2.1.0"
+@@ -1105,7 +1154,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "17367f0cc86f2d25802b2c26ee58a7b23faeccf78a396094c13dced0d0182526"
+ dependencies = [
+  "phf_shared",
+- "rand",
++ "rand 0.7.3",
+ ]
+ 
+ [[package]]
+@@ -1117,33 +1166,13 @@ dependencies = [
+  "siphasher",
+ ]
+ 
+-[[package]]
+-name = "pin-project"
+-version = "0.4.27"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "2ffbc8e94b38ea3d2d8ba92aea2983b503cd75d0888d75b86bb37970b5698e15"
+-dependencies = [
+- "pin-project-internal 0.4.27",
+-]
+-
+ [[package]]
+ name = "pin-project"
+ version = "1.0.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "ee41d838744f60d959d7074e3afb6b35c7456d0f61cad38a24e35e6553f73841"
+ dependencies = [
+- "pin-project-internal 1.0.1",
+-]
+-
+-[[package]]
+-name = "pin-project-internal"
+-version = "0.4.27"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "65ad2ae56b6abe3a1ee25f15ee605bacadb9a764edaba9c2bf4103800d4a1895"
+-dependencies = [
+- "proc-macro2",
+- "quote",
+- "syn",
++ "pin-project-internal",
+ ]
+ 
+ [[package]]
+@@ -1159,9 +1188,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "pin-project-lite"
+-version = "0.1.11"
++version = "0.2.9"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "c917123afa01924fc84bb20c4c03f004d9c38e5127e3c039bbf7f4b9c76a2f6b"
++checksum = "e0a7ae3ac2f1173085d398531c705756c94a4c56843785df85a60c1a0afac116"
+ 
+ [[package]]
+ name = "pin-utils"
+@@ -1181,18 +1210,6 @@ version = "0.1.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"
+ 
+-[[package]]
+-name = "proc-macro-hack"
+-version = "0.5.19"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "dbf0c48bc1d91375ae5c3cd81e3722dff1abcf81a30960240640d223f59fe0e5"
+-
+-[[package]]
+-name = "proc-macro-nested"
+-version = "0.1.6"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "eba180dafb9038b050a4c280019bbedf9f2467b61e5d892dcad585bb57aadc5a"
+-
+ [[package]]
+ name = "proc-macro2"
+ version = "1.0.24"
+@@ -1204,28 +1221,15 @@ dependencies = [
+ 
+ [[package]]
+ name = "pulldown-cmark"
+-version = "0.7.2"
++version = "0.9.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "ca36dea94d187597e104a5c8e4b07576a8a45aa5db48a65e12940d3eb7461f55"
++checksum = "2d9cc634bc78768157b5cbfe988ffcd1dcba95cd2b2f03a88316c08c6d00ed63"
+ dependencies = [
+  "bitflags",
+- "getopts",
+  "memchr",
+  "unicase",
+ ]
+ 
+-[[package]]
+-name = "quick-error"
+-version = "1.2.3"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
+-
+-[[package]]
+-name = "quick-error"
+-version = "2.0.0"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "3ac73b1112776fc109b2e61909bc46c7e1bf0d7f690ffb1676553acce16d5cda"
+-
+ [[package]]
+ name = "quick-js"
+ version = "0.4.0"
+@@ -1251,14 +1255,25 @@ version = "0.7.3"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "6a6b1679d49b24bbfe0c803429aa1874472f50d9b363131f0e89fc356b544d03"
+ dependencies = [
+- "getrandom",
++ "getrandom 0.1.15",
+  "libc",
+- "rand_chacha",
+- "rand_core",
++ "rand_chacha 0.2.2",
++ "rand_core 0.5.1",
+  "rand_hc",
+  "rand_pcg",
+ ]
+ 
++[[package]]
++name = "rand"
++version = "0.8.5"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
++dependencies = [
++ "libc",
++ "rand_chacha 0.3.1",
++ "rand_core 0.6.4",
++]
++
+ [[package]]
+ name = "rand_chacha"
+ version = "0.2.2"
+@@ -1266,7 +1281,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "f4c8ed856279c9737206bf725bf36935d8666ead7aa69b52be55af369d193402"
+ dependencies = [
+  "ppv-lite86",
+- "rand_core",
++ "rand_core 0.5.1",
++]
++
++[[package]]
++name = "rand_chacha"
++version = "0.3.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
++dependencies = [
++ "ppv-lite86",
++ "rand_core 0.6.4",
+ ]
+ 
+ [[package]]
+@@ -1275,7 +1300,16 @@ version = "0.5.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "90bde5296fc891b0cef12a6d03ddccc162ce7b2aff54160af9338f8d40df6d19"
+ dependencies = [
+- "getrandom",
++ "getrandom 0.1.15",
++]
++
++[[package]]
++name = "rand_core"
++version = "0.6.4"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
++dependencies = [
++ "getrandom 0.2.7",
+ ]
+ 
+ [[package]]
+@@ -1284,7 +1318,7 @@ version = "0.2.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "ca3129af7b92a17112d59ad498c6f81eaf463253766b90396d39ea7a39d6613c"
+ dependencies = [
+- "rand_core",
++ "rand_core 0.5.1",
+ ]
+ 
+ [[package]]
+@@ -1293,7 +1327,7 @@ version = "0.2.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "16abd0c1b639e9eb4d7c50c0b8100b0d0f849be2349829c740fe8e6eb4816429"
+ dependencies = [
+- "rand_core",
++ "rand_core 0.5.1",
+ ]
+ 
+ [[package]]
+@@ -1304,21 +1338,26 @@ checksum = "41cc0f7e4d5d4544e8861606a285bb08d3e70712ccc7d2b84d7c0ccfaf4b05ce"
+ 
+ [[package]]
+ name = "regex"
+-version = "1.4.2"
++version = "1.6.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "38cf2c13ed4745de91a5eb834e11c00bcc3709e773173b2ce4c56c9fbde04b9c"
++checksum = "4c4eb3267174b8c6c2f654116623910a0fef09c4753f8dd83db29c48a0df988b"
+ dependencies = [
+  "aho-corasick",
+  "memchr",
+  "regex-syntax",
+- "thread_local",
+ ]
+ 
++[[package]]
++name = "regex-automata"
++version = "0.1.10"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "6c230d73fb8d8c1b9c0b3135c5142a8acee3a0558fb8db5cf1cb65f8d7862132"
++
+ [[package]]
+ name = "regex-syntax"
+-version = "0.6.21"
++version = "0.6.27"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "3b181ba2dcf07aaccad5448e8ead58db5b742cf85dfe035e2227f137a539a189"
++checksum = "a3f87b73ce11b1619a3c6332f45341e0047173771e8b8b73f87bfeefb7b56244"
+ 
+ [[package]]
+ name = "remove_dir_all"
+@@ -1329,6 +1368,15 @@ dependencies = [
+  "winapi 0.3.9",
+ ]
+ 
++[[package]]
++name = "rustls-pemfile"
++version = "0.2.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "5eebeaeb360c87bfb72e84abdb3447159c0eaececf1bef2aecd65a8be949d1c9"
++dependencies = [
++ "base64 0.13.0",
++]
++
+ [[package]]
+ name = "ryu"
+ version = "1.0.5"
+@@ -1355,6 +1403,9 @@ name = "serde"
+ version = "1.0.117"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "b88fa983de7720629c9387e9f517353ed404164b1e482c970a90c1a4aaf7dc1a"
++dependencies = [
++ "serde_derive",
++]
+ 
+ [[package]]
+ name = "serde_derive"
+@@ -1373,21 +1424,21 @@ version = "1.0.59"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "dcac07dbffa1c65e7f816ab9eba78eb142c6d44410f4eeba1e26e4f5dfa56b95"
+ dependencies = [
+- "itoa",
++ "itoa 0.4.6",
+  "ryu",
+  "serde",
+ ]
+ 
+ [[package]]
+ name = "serde_urlencoded"
+-version = "0.6.1"
++version = "0.7.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "9ec5d77e2d4c73717816afac02670d5c4f534ea95ed430442cad02e7a6e32c97"
++checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+ dependencies = [
+- "dtoa",
+- "itoa",
++ "form_urlencoded",
++ "itoa 1.0.3",
++ "ryu",
+  "serde",
+- "url",
+ ]
+ 
+ [[package]]
+@@ -1399,27 +1450,25 @@ dependencies = [
+  "block-buffer 0.7.3",
+  "digest 0.8.1",
+  "fake-simd",
+- "opaque-debug 0.2.3",
++ "opaque-debug",
+ ]
+ 
+ [[package]]
+ name = "sha-1"
+-version = "0.9.2"
++version = "0.10.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "ce3cdf1b5e620a498ee6f2a171885ac7e22f0e12089ec4b3d22b84921792507c"
++checksum = "028f48d513f9678cda28f6e4064755b3fbb2af6acd672f2c209b62323f7aea0f"
+ dependencies = [
+- "block-buffer 0.9.0",
+  "cfg-if 1.0.0",
+- "cpuid-bool",
+- "digest 0.9.0",
+- "opaque-debug 0.3.0",
++ "cpufeatures",
++ "digest 0.10.5",
+ ]
+ 
+ [[package]]
+ name = "shlex"
+-version = "0.1.1"
++version = "1.1.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "7fdf1b9db47230893d76faad238fd6097fd6d6a9245cd7a4d90dbd639536bbd2"
++checksum = "43b2853a4d09f215c24cc5489c992ce46052d359b5109343cbafbf26bc62f8a3"
+ 
+ [[package]]
+ name = "siphasher"
+@@ -1435,13 +1484,11 @@ checksum = "c111b5bd5695e56cffe5129854aa230b39c93a305372fdbb2668ca2394eea9f8"
+ 
+ [[package]]
+ name = "socket2"
+-version = "0.3.16"
++version = "0.4.7"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "7fd8b795c389288baa5f355489c65e71fd48a02104600d15c4cfbc561e9e429d"
++checksum = "02e2d2db9033d13a1567121ddd7a095ee144db4e1ca1b1bda3419bc0da294ebd"
+ dependencies = [
+- "cfg-if 0.1.10",
+  "libc",
+- "redox_syscall",
+  "winapi 0.3.9",
+ ]
+ 
+@@ -1483,28 +1530,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "6446ced80d6c486436db5c078dde11a9f73d42b57fb273121e160b84f63d894c"
+ 
+ [[package]]
+-name = "strum"
+-version = "0.18.0"
++name = "strsim"
++version = "0.10.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "57bd81eb48f4c437cadc685403cad539345bf703d78e63707418431cecd4522b"
+-
+-[[package]]
+-name = "strum_macros"
+-version = "0.18.0"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "87c85aa3f8ea653bfd3ddf25f7ee357ee4d204731f6aa9ad04002306f6e2774c"
+-dependencies = [
+- "heck",
+- "proc-macro2",
+- "quote",
+- "syn",
+-]
++checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
+ 
+ [[package]]
+ name = "syn"
+-version = "1.0.48"
++version = "1.0.67"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "cc371affeffc477f42a221a1e4297aedcea33d47d19b61455588bd9d8f6b19ac"
++checksum = "6498a9efc342871f91cc2d0d694c674368b4ceb40f62b65a7a08c3792935e702"
+ dependencies = [
+  "proc-macro2",
+  "quote",
+@@ -1519,7 +1554,7 @@ checksum = "7a6e24d9338a0a5be79593e2fa15a648add6138caa803e2d5bc782c371732ca9"
+ dependencies = [
+  "cfg-if 0.1.10",
+  "libc",
+- "rand",
++ "rand 0.7.3",
+  "redox_syscall",
+  "remove_dir_all",
+  "winapi 0.3.9",
+@@ -1538,9 +1573,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "termcolor"
+-version = "1.1.0"
++version = "1.1.3"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "bb6bfa289a4d7c5766392812c0a1f4c1ba45afa1ad47803c11e1f407d846d75f"
++checksum = "bab24d30b911b2376f3a13cc2cd443142f0c81dda04c118693e35b3835757755"
+ dependencies = [
+  "winapi-util",
+ ]
+@@ -1554,35 +1589,32 @@ dependencies = [
+  "unicode-width",
+ ]
+ 
++[[package]]
++name = "textwrap"
++version = "0.15.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "949517c0cf1bf4ee812e2e07e08ab448e3ae0d23472aee8a06c985f0c8815b16"
++
+ [[package]]
+ name = "thiserror"
+-version = "1.0.22"
++version = "1.0.37"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "0e9ae34b84616eedaaf1e9dd6026dbe00dcafa92aa0c8077cb69df1fcfe5e53e"
++checksum = "10deb33631e3c9018b9baf9dcbbc4f737320d2b576bac10f6aefa048fa407e3e"
+ dependencies = [
+  "thiserror-impl",
+ ]
+ 
+ [[package]]
+ name = "thiserror-impl"
+-version = "1.0.22"
++version = "1.0.37"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "9ba20f23e85b10754cd195504aebf6a27e2e6cbe28c17778a0c930724628dd56"
++checksum = "982d17546b47146b28f7c22e3d08465f6b8903d0ea13c1660d9d84a6e7adcdbb"
+ dependencies = [
+  "proc-macro2",
+  "quote",
+  "syn",
+ ]
+ 
+-[[package]]
+-name = "thread_local"
+-version = "1.0.1"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "d40c6d1b69745a6ec6fb1ca717914848da4b44ae29d9b3080cbee91d72a69b14"
+-dependencies = [
+- "lazy_static",
+-]
+-
+ [[package]]
+ name = "time"
+ version = "0.1.44"
+@@ -1611,58 +1643,68 @@ checksum = "cda74da7e1a664f795bb1f8a87ec406fb89a02522cf6e50620d016add6dbbf5c"
+ 
+ [[package]]
+ name = "tokio"
+-version = "0.2.23"
++version = "1.21.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "a6d7ad61edd59bfcc7e80dababf0f4aed2e6d5e0ba1659356ae889752dfc12ff"
++checksum = "a9e03c497dc955702ba729190dc4aac6f2a0ce97f913e5b1b5912fc5039d9099"
+ dependencies = [
+- "bytes",
+- "fnv",
+- "futures-core",
+- "iovec",
+- "lazy_static",
++ "autocfg",
++ "bytes 1.2.1",
++ "libc",
+  "memchr",
+- "mio",
++ "mio 0.8.4",
++ "num_cpus",
+  "pin-project-lite",
+- "slab",
++ "socket2",
+  "tokio-macros",
++ "winapi 0.3.9",
+ ]
+ 
+ [[package]]
+ name = "tokio-macros"
+-version = "0.2.6"
++version = "1.8.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "e44da00bfc73a25f814cd8d7e57a68a5c31b74b3152a0a1d1f590c97ed06265a"
++checksum = "9724f9a975fb987ef7a3cd9be0350edcbe130698af5b8f7a631e23d42d052484"
+ dependencies = [
+  "proc-macro2",
+  "quote",
+  "syn",
+ ]
+ 
++[[package]]
++name = "tokio-stream"
++version = "0.1.10"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "f6edf2d6bc038a43d31353570e27270603f4648d18f5ed10c0e179abe43255af"
++dependencies = [
++ "futures-core",
++ "pin-project-lite",
++ "tokio",
++]
++
+ [[package]]
+ name = "tokio-tungstenite"
+-version = "0.11.0"
++version = "0.17.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "6d9e878ad426ca286e4dcae09cbd4e1973a7f8987d97570e2469703dd7f5720c"
++checksum = "f714dd15bead90401d77e04243611caec13726c2408afd5b31901dfcdcb3b181"
+ dependencies = [
+  "futures-util",
+  "log",
+- "pin-project 0.4.27",
+  "tokio",
+  "tungstenite",
+ ]
+ 
+ [[package]]
+ name = "tokio-util"
+-version = "0.3.1"
++version = "0.7.4"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "be8242891f2b6cbef26a2d7e8605133c2c554cd35b3e4948ea892d6d68436499"
++checksum = "0bb2e075f03b3d66d8d8785356224ba688d2906a371015e225beeb65ca92c740"
+ dependencies = [
+- "bytes",
++ "bytes 1.2.1",
+  "futures-core",
+  "futures-sink",
+- "log",
+  "pin-project-lite",
+  "tokio",
++ "tracing",
+ ]
+ 
+ [[package]]
+@@ -1674,6 +1716,12 @@ dependencies = [
+  "serde",
+ ]
+ 
++[[package]]
++name = "topological-sort"
++version = "0.1.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "aa7c7f42dea4b1b99439786f5633aeb9c14c1b53f75e282803c2ec2ad545873c"
++
+ [[package]]
+ name = "tower-service"
+ version = "0.3.0"
+@@ -1682,11 +1730,11 @@ checksum = "e987b6bf443f4b5b3b6f38704195592cca41c5bb7aedd3c3693c7081f8289860"
+ 
+ [[package]]
+ name = "tracing"
+-version = "0.1.21"
++version = "0.1.35"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "b0987850db3733619253fe60e17cb59b82d37c7e6c0236bb81e4d6b87c879f27"
++checksum = "a400e31aa60b9d44a52a8ee0343b5b18566b03a8321e0d321f695cf56e940160"
+ dependencies = [
+- "cfg-if 0.1.10",
++ "cfg-if 1.0.0",
+  "log",
+  "pin-project-lite",
+  "tracing-core",
+@@ -1694,21 +1742,11 @@ dependencies = [
+ 
+ [[package]]
+ name = "tracing-core"
+-version = "0.1.17"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "f50de3927f93d202783f4513cda820ab47ef17f624b03c096e86ef00c67e6b5f"
+-dependencies = [
+- "lazy_static",
+-]
+-
+-[[package]]
+-name = "tracing-futures"
+-version = "0.2.4"
++version = "0.1.29"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "ab7bb6f14721aa00656086e9335d363c5c8747bae02ebe32ea2c7dece5689b4c"
++checksum = "5aeea4303076558a00714b823f9ad67d58a3bbda1df83d8827d21193156e22f7"
+ dependencies = [
+- "pin-project 0.4.27",
+- "tracing",
++ "once_cell",
+ ]
+ 
+ [[package]]
+@@ -1719,28 +1757,28 @@ checksum = "59547bce71d9c38b83d9c0e92b6066c4253371f15005def0c30d9657f50c7642"
+ 
+ [[package]]
+ name = "tungstenite"
+-version = "0.11.1"
++version = "0.17.3"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "f0308d80d86700c5878b9ef6321f020f29b1bb9d5ff3cab25e75e23f3a492a23"
++checksum = "e27992fd6a8c29ee7eef28fc78349aa244134e10ad447ce3b9f0ac0ed0fa4ce0"
+ dependencies = [
+- "base64",
++ "base64 0.13.0",
+  "byteorder",
+- "bytes",
++ "bytes 1.2.1",
+  "http",
+  "httparse",
+- "input_buffer",
+  "log",
+- "rand",
+- "sha-1 0.9.2",
++ "rand 0.8.5",
++ "sha-1 0.10.0",
++ "thiserror",
+  "url",
+  "utf-8",
+ ]
+ 
+ [[package]]
+ name = "typenum"
+-version = "1.12.0"
++version = "1.15.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "373c8a200f9e67a0c95e62a4f52fbf80c23b4381c05a17845531982fa99e6b33"
++checksum = "dcf81ac59edc17cc8697ff311e8f5ef2d99fcbd9817b34cec66f90b6c3dfd987"
+ 
+ [[package]]
+ name = "ucd-trie"
+@@ -1775,12 +1813,6 @@ dependencies = [
+  "tinyvec",
+ ]
+ 
+-[[package]]
+-name = "unicode-segmentation"
+-version = "1.7.0"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "db8716a166f290ff49dabc18b44aa407cb7c6dbe1aa0971b44b8a24b0ca35aae"
+-
+ [[package]]
+ name = "unicode-width"
+ version = "0.1.8"
+@@ -1805,12 +1837,6 @@ dependencies = [
+  "percent-encoding",
+ ]
+ 
+-[[package]]
+-name = "urlencoding"
+-version = "1.1.1"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "c9232eb53352b4442e40d7900465dfc534e8cb2dc8f18656fcb2ac16112b5593"
+-
+ [[package]]
+ name = "utf-8"
+ version = "0.7.5"
+@@ -1862,29 +1888,32 @@ dependencies = [
+ 
+ [[package]]
+ name = "warp"
+-version = "0.2.5"
++version = "0.3.3"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "f41be6df54c97904af01aa23e613d4521eed7ab23537cede692d4058f6449407"
++checksum = "ed7b8be92646fc3d18b06147664ebc5f48d222686cb11a8755e561a735aacc6d"
+ dependencies = [
+- "bytes",
+- "futures",
++ "bytes 1.2.1",
++ "futures-channel",
++ "futures-util",
+  "headers",
+  "http",
+  "hyper",
+  "log",
+  "mime",
+  "mime_guess",
+- "pin-project 0.4.27",
++ "percent-encoding",
++ "pin-project",
++ "rustls-pemfile",
+  "scoped-tls",
+  "serde",
+  "serde_json",
+  "serde_urlencoded",
+  "tokio",
++ "tokio-stream",
+  "tokio-tungstenite",
++ "tokio-util",
+  "tower-service",
+  "tracing",
+- "tracing-futures",
+- "urlencoding",
+ ]
+ 
+ [[package]]
+@@ -1899,6 +1928,12 @@ version = "0.10.0+wasi-snapshot-preview1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "1a143597ca7c7793eff794def352d41792a93c481eb1042423ff7ff72ba2c31f"
+ 
++[[package]]
++name = "wasi"
++version = "0.11.0+wasi-snapshot-preview1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
++
+ [[package]]
+ name = "winapi"
+ version = "0.2.8"
+@@ -1942,6 +1977,49 @@ version = "0.4.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+ 
++[[package]]
++name = "windows-sys"
++version = "0.36.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "ea04155a16a59f9eab786fe12a4a450e75cdb175f9e0d80da1e17db09f55b8d2"
++dependencies = [
++ "windows_aarch64_msvc",
++ "windows_i686_gnu",
++ "windows_i686_msvc",
++ "windows_x86_64_gnu",
++ "windows_x86_64_msvc",
++]
++
++[[package]]
++name = "windows_aarch64_msvc"
++version = "0.36.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "9bb8c3fd39ade2d67e9874ac4f3db21f0d710bee00fe7cab16949ec184eeaa47"
++
++[[package]]
++name = "windows_i686_gnu"
++version = "0.36.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "180e6ccf01daf4c426b846dfc66db1fc518f074baa793aa7d9b9aaeffad6a3b6"
++
++[[package]]
++name = "windows_i686_msvc"
++version = "0.36.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "e2e7917148b2812d1eeafaeb22a97e4813dfa60a3f8f78ebe204bcc88f12f024"
++
++[[package]]
++name = "windows_x86_64_gnu"
++version = "0.36.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "4dcd171b8776c41b97521e5da127a2d86ad280114807d0b2ab1e462bc764d9e1"
++
++[[package]]
++name = "windows_x86_64_msvc"
++version = "0.36.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "c811ca4a8c853ef420abd8592ba53ddbbac90410fab6903b3e79972a631f7680"
++
+ [[package]]
+ name = "ws2_32-sys"
+ version = "0.2.1"
+diff --git a/Cargo.toml b/Cargo.toml
+index 16efef1..e750ee2 100644
+--- a/Cargo.toml
++++ b/Cargo.toml
+@@ -10,6 +10,6 @@ readme = "README.md"
+ [dependencies]
+ katex = "0.3.2"
+ clap = "2.33.3"
+-mdbook = "0.4.4"
++mdbook = "0.4.21"
+ serde_json = "1.0.59"
+ toml = "0.5.7"
diff --git a/pkgs/tools/text/mdbook-man/default.nix b/pkgs/tools/text/mdbook-man/default.nix
index 7783be1ccac2..541e27eb7e06 100644
--- a/pkgs/tools/text/mdbook-man/default.nix
+++ b/pkgs/tools/text/mdbook-man/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook-man";
-  version = "unstable-2021-08-26";
+  version = "unstable-2022-11-05";
 
   src = fetchFromGitHub {
     owner = "vv9k";
     repo = pname;
-    rev = "419c91db0fcfcce65a6006ed9ec8415a8b705186";
-    sha256 = "sha256-NOPyDPQms/YJzjkXjVAFR60gLK4zqOuFSdRvFkZRRxQ=";
+    rev = "b9537dfbb241d7456835ed7e9d27ab8c8184e5f6";
+    hash = "sha256-ssAk60jnwYzAjseL26/3FaDv1vBAylgdE+vLhWZ8It4=";
   };
 
-  cargoSha256 = "sha256-NyeB2vI9Za5T1SKrjqwTi8LXX7A+M+2r/n1u2qtnK5g=";
+  cargoHash = "sha256-cR86eFhP9Swh+Ff8FNbAfWpWMkliOAyPwDQ6lRvU+nk=";
 
   meta = with lib; {
     description = "Generate manual pages from mdBooks";
diff --git a/pkgs/tools/text/mdbook-mermaid/default.nix b/pkgs/tools/text/mdbook-mermaid/default.nix
index bf666d36cb6d..1977fcd4efe8 100644
--- a/pkgs/tools/text/mdbook-mermaid/default.nix
+++ b/pkgs/tools/text/mdbook-mermaid/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, rustPlatform, CoreServices }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, rustPlatform, CoreServices }:
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook-mermaid";
@@ -8,10 +8,19 @@ rustPlatform.buildRustPackage rec {
     owner = "badboy";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-zXgXgcMF7MOa9Vx3rhv9aavqRCfMcyRLtaWEvYlyaTs=";
+    hash = "sha256-zXgXgcMF7MOa9Vx3rhv9aavqRCfMcyRLtaWEvYlyaTs=";
   };
 
-  cargoSha256 = "sha256-sV/1caeXq/he92cvAajDL7pZJNiXCzf/DDXKnPKU4XQ=";
+  cargoPatches = [
+    # https://github.com/badboy/mdbook-mermaid/pull/23
+    (fetchpatch {
+      name = "update-mdbook-for-rust-1.64.patch";
+      url = "https://github.com/badboy/mdbook-mermaid/commit/5a3432d1b28ef9a065dd37aa77b82a3593358793.patch";
+      hash = "sha256-NkCxGmRdwJ+jdkgxp5gWfGpgpLpEpKUd44LyPx0kyEE=";
+    })
+  ];
+
+  cargoHash = "sha256-IkMBnBuobrJzR6+030/Wfbu2ZCjvFnjBV+6sSWdiNUw=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
 
diff --git a/pkgs/tools/text/mdbook-open-on-gh/default.nix b/pkgs/tools/text/mdbook-open-on-gh/default.nix
index 09b0db3866be..f334645ba5a4 100644
--- a/pkgs/tools/text/mdbook-open-on-gh/default.nix
+++ b/pkgs/tools/text/mdbook-open-on-gh/default.nix
@@ -1,4 +1,4 @@
-{ lib, rustPlatform, fetchFromGitHub }:
+{ lib, rustPlatform, fetchFromGitHub, fetchpatch }:
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook-open-on-gh";
@@ -8,10 +8,19 @@ rustPlatform.buildRustPackage rec {
     owner = "badboy";
     repo = pname;
     rev = "2.2.0";
-    sha256 = "sha256-x7ESuXoF5dYnJZpgDyYliVixCG4w/VX/Vhm3VqxsiEI=";
+    hash = "sha256-x7ESuXoF5dYnJZpgDyYliVixCG4w/VX/Vhm3VqxsiEI=";
   };
 
-  cargoSha256 = "sha256-FVcCzL0jJ827HHS/9G597QjNFY3HLNYHCPWcepEulD0=";
+  cargoPatches = [
+    # https://github.com/badboy/mdbook-open-on-gh/pull/7
+    (fetchpatch {
+      name = "update-mdbook-for-rust-1.64.patch";
+      url = "https://github.com/badboy/mdbook-open-on-gh/commit/bd20601bfcec144c9302b1ba1a1aff4b95b334d9.patch";
+      hash = "sha256-3Df9Q3sqCpZzqCN9fi+wdeWjLUW4XdywIS3QUjsDE9g=";
+    })
+  ];
+
+  cargoHash = "sha256-N0RwengTWk4luPIecIxzbFReGi+PtE77FJalPq1CdbA=";
 
   meta = with lib; {
     description = "mdbook preprocessor to add a open-on-github link on every page";
diff --git a/pkgs/tools/text/mdbook-pdf/default.nix b/pkgs/tools/text/mdbook-pdf/default.nix
index 8c21f50b1d7e..ca24909ed1d5 100644
--- a/pkgs/tools/text/mdbook-pdf/default.nix
+++ b/pkgs/tools/text/mdbook-pdf/default.nix
@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook-pdf";
-  version = "0.1.2";
+  version = "0.1.3";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "1ibmn8x9kyfd058hsyah2ggyzpahzf2w2qjn6rs9qv8mr3bvc0pv";
+    sha256 = "sha256-zFeEmIv3DIYKmhVYO9cJwRQbSP8yELaJjVjP7hYegco=";
   };
 
-  cargoSha256 = "0k47a5yqnjjc599vgk39ijy6fm62rr8xarvz37g0c7fx9cljhihz";
+  cargoHash = "sha256-pB7NEloeow4TE1Y1EMUZzeCJ/f4DnCS+sQlyN49gqzA=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/tools/text/mdbook-plantuml/default.nix b/pkgs/tools/text/mdbook-plantuml/default.nix
index 0b26bee09538..e57bd1a45225 100644
--- a/pkgs/tools/text/mdbook-plantuml/default.nix
+++ b/pkgs/tools/text/mdbook-plantuml/default.nix
@@ -1,18 +1,36 @@
-{ lib, fetchFromGitHub, stdenv, rustPlatform, darwin, pkg-config, openssl
-, libiconv, CoreServices }:
+{ lib
+, fetchFromGitHub
+, fetchpatch
+, stdenv
+, rustPlatform
+, darwin
+, pkg-config
+, openssl
+, libiconv
+, CoreServices
+}:
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook-plantuml";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "sytsereitsma";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1m53sp3k387injn6mwk2c6rkzw16b12m4j7q0p69fdb3fiqbkign";
+    hash = "sha256-26epwn6j/ZeMAphiFsrLjS0KIewvElr7V3p/EDr4Uqk=";
   };
 
-  cargoSha256 = "0xi14k86ym3rfz6901lmj444y814m7vp90bwsyjmcph3hdv6mjp0";
+  cargoPatches = [
+    # https://github.com/sytsereitsma/mdbook-plantuml/pull/60
+    (fetchpatch {
+      name = "update-mdbook-for-rust-1.64.patch";
+      url = "https://github.com/sytsereitsma/mdbook-plantuml/commit/a1c7fdaff65fbbcc086006f6d180b27e180739e7.patch";
+      hash = "sha256-KXFQxogR6SaoX8snsSYMA8gn1FrQVKMl5l8khxB09WE=";
+    })
+  ];
+
+  cargoHash = "sha256-3HlnhRexfFcAuk1RoatWORMJvYRrnoEft5ys6j3t9S0=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/tools/typesetting/asciidoc/default.nix b/pkgs/tools/typesetting/asciidoc/default.nix
index cf6e0bdb3d42..4cfecfccdbce 100644
--- a/pkgs/tools/typesetting/asciidoc/default.nix
+++ b/pkgs/tools/typesetting/asciidoc/default.nix
@@ -218,7 +218,7 @@ in python3.pkgs.buildPythonApplication rec {
     # cannot find their neighbours (e.g. pdflatex doesn't find mktextfm).
     # We can remove PATH= when those impurities are fixed.
     # TODO: Is this still necessary when using texlive?
-    sed -e "s|^ENV =.*|ENV = dict(XML_CATALOG_FILES='${docbook_xml_dtd_45}/xml/dtd/docbook/catalog.xml ${docbook_xsl_ns}/xml/xsl/docbook/catalog.xml ${docbook_xsl}/xml/xsl/docbook/catalog.xml', PATH='${lib.makeBinPath [ texlive coreutils gnused ]}')|" \
+    sed -e "s|^ENV =.*|ENV = dict(XML_CATALOG_FILES='${docbook_xml_dtd_45}/xml/dtd/docbook/catalog.xml ${docbook_xsl_ns}/xml/xsl/docbook/catalog.xml ${docbook_xsl}/xml/xsl/docbook/catalog.xml', PATH='${lib.makeBinPath [ texlive coreutils gnused ]}', **(dict(filter(lambda v: v[0] == 'SOURCE_DATE_EPOCH', os.environ.items()))))|" \
         -e "s|^ASCIIDOC =.*|ASCIIDOC = '$out/bin/asciidoc'|" \
         -e "s|^XSLTPROC =.*|XSLTPROC = '${libxslt.bin}/bin/xsltproc'|" \
         -e "s|^DBLATEX =.*|DBLATEX = '${dblatexFull}/bin/dblatex'|" \
@@ -229,7 +229,7 @@ in python3.pkgs.buildPythonApplication rec {
         -e "s|^EPUBCHECK =.*|EPUBCHECK = '${epubcheck}/bin/epubcheck'|" \
         -i asciidoc/a2x.py
   '' else ''
-    sed -e "s|^ENV =.*|ENV = dict(XML_CATALOG_FILES='${docbook_xml_dtd_45}/xml/dtd/docbook/catalog.xml ${docbook_xsl_ns}/xml/xsl/docbook/catalog.xml ${docbook_xsl}/xml/xsl/docbook/catalog.xml')|" \
+    sed -e "s|^ENV =.*|ENV = dict(XML_CATALOG_FILES='${docbook_xml_dtd_45}/xml/dtd/docbook/catalog.xml ${docbook_xsl_ns}/xml/xsl/docbook/catalog.xml ${docbook_xsl}/xml/xsl/docbook/catalog.xml', **(dict(filter(lambda v: v[0] == 'SOURCE_DATE_EPOCH', os.environ.items()))))|" \
         -e "s|^XSLTPROC =.*|XSLTPROC = '${libxslt.bin}/bin/xsltproc'|" \
         -e "s|^XMLLINT =.*|XMLLINT = '${libxml2.bin}/bin/xmllint'|" \
         -i asciidoc/a2x.py
diff --git a/pkgs/tools/typesetting/tex/texlive/bin.nix b/pkgs/tools/typesetting/tex/texlive/bin.nix
index 8da3df2773f0..94ed0b87362a 100644
--- a/pkgs/tools/typesetting/tex/texlive/bin.nix
+++ b/pkgs/tools/typesetting/tex/texlive/bin.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch
+{ lib, stdenv, fetchurl, fetchpatch, buildPackages
 , texlive
 , zlib, libiconv, libpng, libX11
 , freetype, gd, libXaw, icu, ghostscript, libXpm, libXmu, libXext
@@ -77,7 +77,13 @@ core = stdenv.mkDerivation rec {
 
   outputs = [ "out" "doc" ];
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    pkg-config
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    # configure: error: tangle was not found but is required when cross-compiling.
+    texlive.bin.core
+  ];
+
   buildInputs = [
     /*teckit*/ zziplib mpfr gmp
     pixman gd freetype libpng libpaper zlib
@@ -94,7 +100,10 @@ core = stdenv.mkDerivation rec {
   '';
   configureScript = "../configure";
 
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+
   configureFlags = common.configureFlags
+    ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [ "BUILDCC=${buildPackages.stdenv.cc.targetPrefix}cc" ]
     ++ [ "--without-x" ] # disable xdvik and xpdfopen
     ++ map (what: "--disable-${what}") [
       "chktex"
@@ -113,7 +122,7 @@ core = stdenv.mkDerivation rec {
 
   # TODO: perhaps improve texmf.cnf search locations
   postInstall = /* links format -> engine will be regenerated in texlive.combine */ ''
-    PATH="$out/bin:$PATH" ${texlinks}/bin/texlinks --cnffile "$out/share/texmf-dist/web2c/fmtutil.cnf" --unlink "$out/bin"
+    PATH="$out/bin:$PATH" ${buildPackages.texlive.bin.texlinks}/bin/texlinks --cnffile "$out/share/texmf-dist/web2c/fmtutil.cnf" --unlink "$out/bin"
   '' + /* a few texmf-dist files are useful; take the rest from pkgs */ ''
     mv "$out/share/texmf-dist/web2c/texmf.cnf" .
     rm -r "$out/share/texmf-dist"
@@ -202,7 +211,7 @@ core-big = stdenv.mkDerivation { #TODO: upmendex
         if [[ "$path" =~ "libs/pplib" ]]; then
           # TODO: revert for texlive 2022
           # ../../../texk/web2c/luatexdir/luamd5/md5lib.c:197:10: fatal error: 'utilsha.h' file not found
-          make ''${enableParallelBuilding:+-j''${NIX_BUILD_CORES} -l''${NIX_BUILD_CORES}}
+          make ''${enableParallelBuilding:+-j''${NIX_BUILD_CORES}}
         fi
       )
     done
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3b3ec2e56b52..78408aa0d6bd 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -187,7 +187,9 @@ with pkgs;
     meta.platforms = lib.platforms.linux;
   } ../build-support/setup-hooks/auto-patchelf.sh;
 
-  appflowy = callPackage ../applications/office/appflowy { };
+  appflowy = callPackage ../applications/office/appflowy {
+    openssl = openssl_1_1;
+  };
 
   appimageTools = callPackage ../build-support/appimage {
     buildFHSUserEnv = buildFHSUserEnvBubblewrap;
@@ -934,7 +936,9 @@ with pkgs;
     { deps = [ dieHook ];
       substitutions = {
         shell = targetPackages.runtimeShell;
-        passthru.tests = tests.makeWrapper;
+      };
+      passthru = {
+        tests = tests.makeWrapper;
       };
     }
     ../build-support/setup-hooks/make-wrapper.sh;
@@ -2219,7 +2223,10 @@ with pkgs;
 
   brewtarget = libsForQt514.callPackage ../applications/misc/brewtarget { } ;
 
-  stdenvBootstrapTools = if stdenv.hostPlatform.isDarwin then
+  # Derivation's result is not used by nixpkgs. Useful for validation for
+  # regressions of bootstrapTools on hydra and on ofborg. Example:
+  #     pkgsCross.aarch64-multiplatform.freshBootstrapTools.build
+  freshBootstrapTools = if stdenv.hostPlatform.isDarwin then
     callPackage ../stdenv/darwin/make-bootstrap-tools.nix {
       localSystem = stdenv.buildPlatform;
       crossSystem =
@@ -2227,7 +2234,7 @@ with pkgs;
     }
   else if stdenv.hostPlatform.isLinux then
     callPackage ../stdenv/linux/make-bootstrap-tools.nix {}
-  else throw "stdenvBootstrapTools: unknown hostPlatform ${stdenv.hostPlatform.config}";
+  else throw "freshBootstrapTools: unknown hostPlatform ${stdenv.hostPlatform.config}";
 
   boxes = callPackage ../tools/text/boxes { };
 
@@ -14683,11 +14690,11 @@ with pkgs;
     inherit (darwin) apple_sdk;
   };
 
-  rust_1_63 = callPackage ../development/compilers/rust/1_63.nix {
+  rust_1_64 = callPackage ../development/compilers/rust/1_64.nix {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security SystemConfiguration;
     llvm_14 = llvmPackages_14.libllvm;
   };
-  rust = rust_1_63;
+  rust = rust_1_64;
 
   mrustc = callPackage ../development/compilers/mrustc { };
   mrustc-minicargo = callPackage ../development/compilers/mrustc/minicargo.nix { };
@@ -14696,8 +14703,8 @@ with pkgs;
     openssl = openssl_1_1;
   };
 
-  rustPackages_1_63 = rust_1_63.packages.stable;
-  rustPackages = rustPackages_1_63;
+  rustPackages_1_64 = rust_1_64.packages.stable;
+  rustPackages = rustPackages_1_64;
 
   inherit (rustPackages) cargo clippy rustc rustPlatform;
 
@@ -24664,7 +24671,9 @@ with pkgs;
 
   iwd = callPackage ../os-specific/linux/iwd { };
 
-  jfbview = callPackage ../os-specific/linux/jfbview { };
+  jfbview = callPackage ../os-specific/linux/jfbview {
+    imlib2 = imlib2Full;
+  };
   jfbpdf = jfbview.override {
     imageSupport = false;
   };
@@ -28202,7 +28211,9 @@ with pkgs;
 
   fdupes = callPackage ../tools/misc/fdupes { };
 
-  feh = callPackage ../applications/graphics/feh { };
+  feh = callPackage ../applications/graphics/feh {
+    imlib2 = imlib2Full;
+  };
 
   feishu = callPackage ../applications/networking/instant-messengers/feishu {};
 
@@ -30896,7 +30907,9 @@ with pkgs;
 
   pqiv = callPackage ../applications/graphics/pqiv { };
 
-  qiv = callPackage ../applications/graphics/qiv { };
+  qiv = callPackage ../applications/graphics/qiv {
+    imlib2 = imlib2Full;
+  };
 
   premid = callPackage ../applications/misc/premid { };
 
@@ -31444,9 +31457,13 @@ with pkgs;
 
   swingsane = callPackage ../applications/graphics/swingsane { };
 
-  sxiv = callPackage ../applications/graphics/sxiv { };
+  sxiv = callPackage ../applications/graphics/sxiv {
+    imlib2 = imlib2Full;
+  };
 
-  nsxiv = callPackage ../applications/graphics/nsxiv { };
+  nsxiv = callPackage ../applications/graphics/nsxiv {
+    imlib2 = imlib2Full;
+  };
 
   resilio-sync = callPackage ../applications/networking/resilio-sync { };
 
diff --git a/pkgs/top-level/emscripten-packages.nix b/pkgs/top-level/emscripten-packages.nix
index 9a6b18809502..d5f820d0d60b 100644
--- a/pkgs/top-level/emscripten-packages.nix
+++ b/pkgs/top-level/emscripten-packages.nix
@@ -50,7 +50,7 @@ rec {
   }).overrideDerivation
     (old: {
       propagatedBuildInputs = [ zlib ];
-      buildInputs = old.buildInputs ++ [ pkg-config ];
+      nativeBuildInputs = (old.nativeBuildInputs or []) ++ [ pkg-config ];
 
       # just override it with nothing so it does not fail
       autoreconfPhase = "echo autoreconfPhase not used...";
@@ -87,7 +87,7 @@ rec {
     pname = "xmlmirror";
     version = "unstable-2016-06-05";
 
-    buildInputs = [ pkg-config libtool gnumake libxml2 nodejs openjdk json_c ];
+    buildInputs = [ libtool gnumake libxml2 nodejs openjdk json_c ];
     nativeBuildInputs = [ pkg-config zlib autoconf automake ];
 
     src = pkgs.fetchgit {
@@ -140,7 +140,7 @@ rec {
     stdenv = pkgs.emscriptenStdenv;
   }).overrideDerivation
     (old: {
-      buildInputs = old.buildInputs ++ [ pkg-config ];
+      nativeBuildInputs = (old.nativeBuildInputs or []) ++ [ pkg-config ];
       # we need to reset this setting!
       NIX_CFLAGS_COMPILE="";
       dontStrip = true;
diff --git a/pkgs/top-level/java-packages.nix b/pkgs/top-level/java-packages.nix
index 302b301b115e..ba69287fa8dc 100644
--- a/pkgs/top-level/java-packages.nix
+++ b/pkgs/top-level/java-packages.nix
@@ -45,7 +45,11 @@ in {
     mkBootstrap = adoptopenjdk: path: args:
       /* adoptopenjdk not available for i686, so fall back to our old builds for bootstrapping */
       if   adoptopenjdk.jdk-hotspot.meta.available
-      then adoptopenjdk.jdk-hotspot
+      then
+        # only linux has the gtkSupport option
+        if stdenv.isLinux
+        then adoptopenjdk.jdk-hotspot.override { gtkSupport = false; }
+        else adoptopenjdk.jdk-hotspot
       else callPackage path args;
 
     mkOpenjdk = path-linux: path-darwin: args:
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 73a753bae296..538488115928 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -13873,7 +13873,8 @@ let
       url = "mirror://cpan/authors/id/L/LK/LKUNDRAK/Log-Journald-0.30.tar.gz";
       hash = "sha256-VZks+aHh+4M/QoMAUlv6fPftRrg+xBT4KgkXibN9CKM=";
     };
-    buildInputs = [ pkgs.pkg-config pkgs.systemd ];
+    nativeBuildInputs = [ pkgs.pkg-config ];
+    buildInputs = [ pkgs.systemd ];
     postPatch = ''
       substituteInPlace Build.PL \
         --replace "libsystemd-journal" "libsystemd"
@@ -20936,7 +20937,8 @@ let
       url = "mirror://cpan/authors/id/L/LK/LKUNDRAK/RPM2-1.4.tar.gz";
       hash = "sha256-XstCqmkyTm9AiKv64HMTkG5aq/L0bxIE8/HeWRVbtjY=";
     };
-    buildInputs = [ pkgs.pkg-config pkgs.rpm ];
+    nativeBuildInputs = [ pkgs.pkg-config ];
+    buildInputs = [ pkgs.rpm ];
     doCheck = false; # Tries to open /var/lib/rpm
     meta = {
       description = "Perl bindings for the RPM Package Manager API";
@@ -27229,7 +27231,8 @@ let
       url = "mirror://cpan/authors/id/S/SH/SHLOMIF/XML-LibXSLT-1.99.tar.gz";
       hash = "sha256-En4XqHf7YeR7nouHv42q0xM5pioAEh+XUdUitDiw9/A=";
     };
-    buildInputs = [ pkgs.pkg-config pkgs.zlib pkgs.libxml2 pkgs.libxslt ];
+    nativeBuildInputs = [ pkgs.pkg-config ];
+    buildInputs = [ pkgs.zlib pkgs.libxml2 pkgs.libxslt ];
     propagatedBuildInputs = [ XMLLibXML ];
     meta = {
       description = "Interface to the GNOME libxslt library";
@@ -27805,7 +27808,8 @@ let
 
     makeMakerFlags = "--prefix-openssl=${pkgs.openssl_1_1.dev}";
 
-    buildInputs = [ DevelChecklib ModuleInstall ModuleInstallXSUtil TestFatal pkgs.ldns pkgs.libidn2 pkgs.openssl_1_1 pkgs.pkg-config ];
+    nativeBuildInputs = [ pkgs.pkg-config ];
+    buildInputs = [ DevelChecklib ModuleInstall ModuleInstallXSUtil TestFatal pkgs.ldns pkgs.libidn2 pkgs.openssl_1_1 ];
     meta = {
       description = "Perl wrapper for the ldns DNS library";
       license = with lib.licenses; [ bsd3 ];
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index fd7f1b993c8a..2b0dc1d3fbee 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7411,7 +7411,7 @@ in {
   psd-tools = callPackage ../development/python-modules/psd-tools { };
 
   psutil = callPackage ../development/python-modules/psutil {
-    inherit (pkgs.darwin.apple_sdk.frameworks) IOKit;
+    inherit (pkgs.darwin.apple_sdk.frameworks) CoreFoundation IOKit;
   };
 
   psutil-home-assistant = callPackage ../development/python-modules/psutil-home-assistant { };
diff --git a/pkgs/top-level/release.nix b/pkgs/top-level/release.nix
index bac3d1b1171d..61116328b29f 100644
--- a/pkgs/top-level/release.nix
+++ b/pkgs/top-level/release.nix
@@ -30,7 +30,7 @@ let
     "aarch64"
   ] (arch: builtins.elem "${arch}-darwin" systemsWithAnySupport);
 
-  jobs =
+  nonPackageJobs =
     { tarball = import ./make-tarball.nix { inherit pkgs nixpkgs officialRelease supportedSystems; };
 
       metrics = import ./metrics.nix { inherit pkgs nixpkgs; };
@@ -167,7 +167,9 @@ let
           (system: {
             inherit
               (import ../stdenv/linux/make-bootstrap-tools.nix {
-                localSystem = { inherit system; };
+                pkgs = import ../.. {
+                  localSystem = { inherit system; };
+                };
               })
               dist test;
           })
@@ -175,7 +177,9 @@ let
         // optionalAttrs supportDarwin.x86_64 {
           x86_64-darwin =
             let
-              bootstrap = import ../stdenv/darwin/make-bootstrap-tools.nix { system = "x86_64-darwin"; };
+              bootstrap = import ../stdenv/darwin/make-bootstrap-tools.nix {
+                localSystem = { system = "x86_64-darwin"; };
+              };
             in {
               # Lightweight distribution and test
               inherit (bootstrap) dist test;
@@ -186,14 +190,25 @@ let
           # Cross compiled bootstrap tools
           aarch64-darwin =
             let
-              bootstrap = import ../stdenv/darwin/make-bootstrap-tools.nix { system = "x86_64-darwin"; crossSystem = "aarch64-darwin"; };
+              bootstrap = import ../stdenv/darwin/make-bootstrap-tools.nix {
+                localSystem = { system = "x86_64-darwin"; };
+                crossSystem = { system = "aarch64-darwin"; };
+              };
             in {
               # Distribution only for now
               inherit (bootstrap) dist;
             };
           };
 
-    } // (mapTestOn ((packagePlatforms pkgs) // {
+       };
+
+  # Do not allow attribute collision between jobs inserted in
+  # 'nonPackageAttrs' and jobs pulled in from 'pkgs'.
+  # Conflicts usually cause silent job drops like in
+  #   https://github.com/NixOS/nixpkgs/pull/182058
+  jobs = lib.attrsets.unionOfDisjoint
+    nonPackageJobs
+    (mapTestOn ((packagePlatforms pkgs) // {
       haskell.compiler = packagePlatforms pkgs.haskell.compiler;
       haskellPackages = packagePlatforms pkgs.haskellPackages;
       idrisPackages = packagePlatforms pkgs.idrisPackages;