diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index dc8ff516e389..86e643f424f7 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -244,6 +244,8 @@ In addition to numerous new and upgraded packages, this release has the followin
   [upstream's release notes](https://github.com/iputils/iputils/releases/tag/20221126)
   for more details and available replacements.
 
+- The ppp plugin `rp-pppoe.so` has been renamed to `pppoe.so` in ppp 2.4.9. Starting from ppp 2.5.0, there is no longer a alias for backwards compatiblity. Configurations that use this plugin must be updated accordingly from `plugin rp-pppoe.so` to `plugin pppoe.so`. See [upstream change](https://github.com/ppp-project/ppp/commit/610a7bd76eb1f99f22317541b35001b1e24877ed).
+
 - [services.xserver.videoDrivers](options.html#opt-services.xserver.videoDrivers) now defaults to the `modesetting` driver over device-specific ones. The `radeon`, `amdgpu` and `nouveau` drivers are still available, but effectively unmaintained and not recommended for use.
 
 - To enable the HTTP3 (QUIC) protocol for a nginx virtual host, set the `quic` attribute on it to true, e.g. `services.nginx.virtualHosts.<name>.quic = true;`.
diff --git a/nixos/tests/pppd.nix b/nixos/tests/pppd.nix
index e714a6c21a6c..d599f918036f 100644
--- a/nixos/tests/pppd.nix
+++ b/nixos/tests/pppd.nix
@@ -28,7 +28,7 @@ import ./make-test-python.nix (
             "ppp/pppoe-server-options".text = ''
               lcp-echo-interval 10
               lcp-echo-failure 2
-              plugin rp-pppoe.so
+              plugin pppoe.so
               require-chap
               nobsdcomp
               noccp
@@ -43,7 +43,7 @@ import ./make-test-python.nix (
           enable = true;
           peers.test = {
             config = ''
-              plugin rp-pppoe.so eth1
+              plugin pppoe.so eth1
               name "flynn"
               noipdefault
               persist
diff --git a/pkgs/applications/audio/fluidsynth/default.nix b/pkgs/applications/audio/fluidsynth/default.nix
index a49b683363b8..41ee34847a84 100644
--- a/pkgs/applications/audio/fluidsynth/default.nix
+++ b/pkgs/applications/audio/fluidsynth/default.nix
@@ -14,6 +14,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-BSJu3jB7b5G2ThXBUHUNnBGl55EXe3nIzdBdgfOWDSM=";
   };
 
+  outputs = [ "out" "dev" "man" ];
+
   nativeBuildInputs = [ buildPackages.stdenv.cc pkg-config cmake ];
 
   buildInputs = [ glib libsndfile libjack2 ]
diff --git a/pkgs/applications/audio/mpg123/default.nix b/pkgs/applications/audio/mpg123/default.nix
index 1e97b7badb48..348dcfb5986f 100644
--- a/pkgs/applications/audio/mpg123/default.nix
+++ b/pkgs/applications/audio/mpg123/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     hash = "sha256-HKd9Omml/4RbegU294P+5VThBBE5prl49q/hT1gUrRo=";
   };
 
-  outputs = [ "out" ] ++ lib.optional withConplay "conplay";
+  outputs = [ "out" "dev" "man" ] ++ lib.optional withConplay "conplay";
 
   nativeBuildInputs = lib.optionals (!libOnly) (
     lib.optionals withConplay [ makeWrapper ]
diff --git a/pkgs/applications/editors/neovim/default.nix b/pkgs/applications/editors/neovim/default.nix
index fb850c7ca366..823bc29b8843 100644
--- a/pkgs/applications/editors/neovim/default.nix
+++ b/pkgs/applications/editors/neovim/default.nix
@@ -125,6 +125,8 @@ in
       export VIMRUNTIME=$PWD/runtime
     '';
 
+    separateDebugInfo = true;
+
     meta = with lib; {
       description = "Vim text editor fork focused on extensibility and agility";
       longDescription = ''
diff --git a/pkgs/applications/version-management/git/default.nix b/pkgs/applications/version-management/git/default.nix
index 8cb1faf97fe9..e3dd18e80c26 100644
--- a/pkgs/applications/version-management/git/default.nix
+++ b/pkgs/applications/version-management/git/default.nix
@@ -28,7 +28,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.40.0";
+  version = "2.40.1";
   svn = subversionClient.override { perlBindings = perlSupport; };
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
 in
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    hash = "sha256-sXpZj79Ycp7xO1d0ZeuTstSE3xIBUYtwi1BE/2I79G0=";
+    hash = "sha256-SJO4uY7vyf3EsOfKJJ40AAT6p4BKQz0XQp4xHh/vIdI=";
   };
 
   outputs = [ "out" ] ++ lib.optional withManual "doc";
diff --git a/pkgs/build-support/setup-hooks/separate-debug-info.sh b/pkgs/build-support/setup-hooks/separate-debug-info.sh
index ca651b4393a1..334db4cfcd9c 100644
--- a/pkgs/build-support/setup-hooks/separate-debug-info.sh
+++ b/pkgs/build-support/setup-hooks/separate-debug-info.sh
@@ -36,10 +36,14 @@ _separateDebugInfo() {
         # architecture than we're building for.  (This happens with
         # firmware blobs in QEMU.)
         (
+            if [ -f "$dst/${id:0:2}/${id:2}.debug" ]
+            then
+                echo "separate-debug-info: warning: multiple files with build id $id found, overwriting"
+            fi
             $OBJCOPY --only-keep-debug "$i" "$dst/${id:0:2}/${id:2}.debug"
 
             # Also a create a symlink <original-name>.debug.
             ln -sfn ".build-id/${id:0:2}/${id:2}.debug" "$dst/../$(basename "$i")"
         ) || rmdir -p "$dst/${id:0:2}"
-    done < <(find "$prefix" -type f -print0)
+    done < <(find "$prefix" -type f -print0 | sort -z)
 }
diff --git a/pkgs/data/misc/mobile-broadband-provider-info/default.nix b/pkgs/data/misc/mobile-broadband-provider-info/default.nix
index 104ec58f718f..4113b3500188 100644
--- a/pkgs/data/misc/mobile-broadband-provider-info/default.nix
+++ b/pkgs/data/misc/mobile-broadband-provider-info/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mobile-broadband-provider-info";
-  version = "20221107";
+  version = "20230416";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-2TOSVmw0epbu2V2oxmpdoN2U9BFc+zowX/JoLGTP2BA=";
+    sha256 = "sha256-4+FAqi23abKZ0d+GqJDpSKuZ1NOIMTAsRS0ft/hWiuw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome/misc/geary/default.nix b/pkgs/desktops/gnome/misc/geary/default.nix
index e2b333430619..37a5cf2cace5 100644
--- a/pkgs/desktops/gnome/misc/geary/default.nix
+++ b/pkgs/desktops/gnome/misc/geary/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch2
 , pkg-config
 , gtk3
 , vala
@@ -54,6 +55,19 @@ stdenv.mkDerivation rec {
     sha256 = "SJFm+H3Z0pAR9eW3lpTyWItHP34ZHFnOkBPIyODjY+c=";
   };
 
+  patches = [
+    # Fix build with Vala 0.56.7 & 0.57+
+    # https://hydra.nixos.org/build/217892787
+    (fetchpatch2 {
+      url = "https://gitlab.gnome.org/GNOME/geary/-/commit/4a7ca820b1d3d6130fedf254dc5b4cd7efb58f2c.patch";
+      sha256 = "L63TMOkxTYu8jxX+IIc9owoa1TBmaeGXgW+8gfMtFw4=";
+    })
+    (fetchpatch2 {
+      url = "https://gitlab.gnome.org/GNOME/geary/-/commit/10f9c133a2ad515127d65f3bba13a0d91b75f4af.patch";
+      sha256 = "0yohy+FZyHW4MkImLQYNlcZyMekH7mXvO2yEuAm3fXw=";
+    })
+  ];
+
   nativeBuildInputs = [
     appstream-glib
     desktop-file-utils
diff --git a/pkgs/development/compilers/llvm/15/clang/default.nix b/pkgs/development/compilers/llvm/15/clang/default.nix
index 4963d0ecce60..894db1a4975f 100644
--- a/pkgs/development/compilers/llvm/15/clang/default.nix
+++ b/pkgs/development/compilers/llvm/15/clang/default.nix
@@ -36,9 +36,14 @@ let
       "-DSPHINX_OUTPUT_MAN=ON"
       "-DSPHINX_OUTPUT_HTML=OFF"
       "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-    ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    ] ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
       "-DLLVM_TABLEGEN_EXE=${buildLlvmTools.llvm}/bin/llvm-tblgen"
       "-DCLANG_TABLEGEN=${buildLlvmTools.libclang.dev}/bin/clang-tblgen"
+      # Added in LLVM15:
+      # `clang-tidy-confusable-chars-gen`: https://github.com/llvm/llvm-project/commit/c3574ef739fbfcc59d405985a3a4fa6f4619ecdb
+      # `clang-pseudo-gen`: https://github.com/llvm/llvm-project/commit/cd2292ef824591cc34cc299910a3098545c840c7
+      "-DCLANG_TIDY_CONFUSABLE_CHARS_GEN=${buildLlvmTools.libclang.dev}/bin/clang-tidy-confusable-chars-gen"
+      "-DCLANG_PSEUDO_GEN=${buildLlvmTools.libclang.dev}/bin/clang-pseudo-gen"
     ];
 
     patches = [
@@ -60,6 +65,12 @@ let
 
     outputs = [ "out" "lib" "dev" "python" ];
 
+    env = lib.optionalAttrs (stdenv.buildPlatform != stdenv.hostPlatform) {
+      # The following warning is triggered with (at least) gcc >=
+      # 12, but appears to occur only for cross compiles.
+      NIX_CFLAGS_COMPILE = "-Wno-maybe-uninitialized";
+    };
+
     postInstall = ''
       ln -sv $out/bin/clang $out/bin/cpp
 
@@ -80,7 +91,7 @@ let
       patchShebangs $python/bin
 
       mkdir -p $dev/bin
-      cp bin/clang-tblgen $dev/bin
+      cp bin/{clang-tblgen,clang-tidy-confusable-chars-gen,clang-pseudo-gen} $dev/bin
     '';
 
     passthru = {
diff --git a/pkgs/development/compilers/llvm/git/clang/default.nix b/pkgs/development/compilers/llvm/git/clang/default.nix
index 4963d0ecce60..894db1a4975f 100644
--- a/pkgs/development/compilers/llvm/git/clang/default.nix
+++ b/pkgs/development/compilers/llvm/git/clang/default.nix
@@ -36,9 +36,14 @@ let
       "-DSPHINX_OUTPUT_MAN=ON"
       "-DSPHINX_OUTPUT_HTML=OFF"
       "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-    ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    ] ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
       "-DLLVM_TABLEGEN_EXE=${buildLlvmTools.llvm}/bin/llvm-tblgen"
       "-DCLANG_TABLEGEN=${buildLlvmTools.libclang.dev}/bin/clang-tblgen"
+      # Added in LLVM15:
+      # `clang-tidy-confusable-chars-gen`: https://github.com/llvm/llvm-project/commit/c3574ef739fbfcc59d405985a3a4fa6f4619ecdb
+      # `clang-pseudo-gen`: https://github.com/llvm/llvm-project/commit/cd2292ef824591cc34cc299910a3098545c840c7
+      "-DCLANG_TIDY_CONFUSABLE_CHARS_GEN=${buildLlvmTools.libclang.dev}/bin/clang-tidy-confusable-chars-gen"
+      "-DCLANG_PSEUDO_GEN=${buildLlvmTools.libclang.dev}/bin/clang-pseudo-gen"
     ];
 
     patches = [
@@ -60,6 +65,12 @@ let
 
     outputs = [ "out" "lib" "dev" "python" ];
 
+    env = lib.optionalAttrs (stdenv.buildPlatform != stdenv.hostPlatform) {
+      # The following warning is triggered with (at least) gcc >=
+      # 12, but appears to occur only for cross compiles.
+      NIX_CFLAGS_COMPILE = "-Wno-maybe-uninitialized";
+    };
+
     postInstall = ''
       ln -sv $out/bin/clang $out/bin/cpp
 
@@ -80,7 +91,7 @@ let
       patchShebangs $python/bin
 
       mkdir -p $dev/bin
-      cp bin/clang-tblgen $dev/bin
+      cp bin/{clang-tblgen,clang-tidy-confusable-chars-gen,clang-pseudo-gen} $dev/bin
     '';
 
     passthru = {
diff --git a/pkgs/development/compilers/rust/1_68.nix b/pkgs/development/compilers/rust/1_68.nix
deleted file mode 100644
index 54c9c4a9f1ad..000000000000
--- a/pkgs/development/compilers/rust/1_68.nix
+++ /dev/null
@@ -1,73 +0,0 @@
-# New rust versions should first go to staging.
-# Things to check after updating:
-# 1. Rustc should produce rust binaries on x86_64-linux, aarch64-linux and x86_64-darwin:
-#    i.e. nix-shell -p fd or @GrahamcOfBorg build fd on github
-#    This testing can be also done by other volunteers as part of the pull
-#    request review, in case platforms cannot be covered.
-# 2. The LLVM version used for building should match with rust upstream.
-#    Check the version number in the src/llvm-project git submodule in:
-#    https://github.com/rust-lang/rust/blob/<version-tag>/.gitmodules
-# 3. Firefox and Thunderbird should still build on x86_64-linux.
-
-{ stdenv, lib
-, buildPackages
-, newScope, callPackage
-, CoreFoundation, Security, SystemConfiguration
-, pkgsBuildTarget, pkgsBuildBuild, pkgsBuildHost
-, makeRustPlatform
-, llvmPackages_11
-, llvmPackages_15, llvm_15
-, fetchpatch
-} @ args:
-
-import ./default.nix {
-  rustcVersion = "1.68.2";
-  rustcSha256 = "sha256-kzOcI/fNTQxF21jhi0xuFtYHD0J3qtnSSS0jKUvzLpY=";
-
-  llvmSharedForBuild = pkgsBuildBuild.llvmPackages_15.libllvm.override { enableSharedLibraries = true; };
-  llvmSharedForHost = pkgsBuildHost.llvmPackages_15.libllvm.override { enableSharedLibraries = true; };
-  llvmSharedForTarget = pkgsBuildTarget.llvmPackages_15.libllvm.override { enableSharedLibraries = true; };
-
-  llvmBootstrapForDarwin = llvmPackages_11;
-
-  # For use at runtime
-  llvmShared = llvm_15.override { enableSharedLibraries = true; };
-
-  # Expose llvmPackages used for rustc from rustc via passthru for LTO in Firefox
-  llvmPackages = llvmPackages_15;
-
-  # Note: the version MUST be one version prior to the version we're
-  # building
-  bootstrapVersion = "1.67.1";
-
-  # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
-  bootstrapHashes = {
-    i686-unknown-linux-gnu = "4fe2128cfc32687e4717da4c6cb21aa563c36802c8e695cd3537a45efc5b8729";
-    x86_64-unknown-linux-gnu = "652a8966436c4e97b127721d9130810e1cdc8dfdf526fad68c9c1f6281bd02a3";
-    x86_64-unknown-linux-musl = "6fdc9379f662f8e9edd2d23e0a3ebcda502cc9f9a381b7c7d5fa38c326a82ad1";
-    arm-unknown-linux-gnueabihf = "eb919ef62a084797c148574abe39f2fb1e52d20b004041090811a6d479eb6503";
-    armv7-unknown-linux-gnueabihf = "09614988feb6310f64eaadf609c92dba5da5ebdbb5531b43a2b18d5336296b67";
-    aarch64-unknown-linux-gnu = "8edee248eed4b17c09b3d7b0096944b7e5992dd1119a28429c0b6b4d39a9613c";
-    aarch64-unknown-linux-musl = "05d03936493c19483eec4dc63d03f9e7a13f356d1147d1b8d7fc5dbfe508b4ed";
-    x86_64-apple-darwin = "020702c9564f53e18ac880db77c2f6b660a24ea372e4fda3f0c1ef2f8b9c74b9";
-    aarch64-apple-darwin = "8b07560267ec85703a5a9397a1746170fd7013e29fcfb9ffb8daa9bbf1e3211a";
-    powerpc64le-unknown-linux-gnu = "1d4d8b75c72362bb6e02bf56b53af9287806c4ef08187b8d166af0557a7c0096";
-    riscv64gc-unknown-linux-gnu = "a1a33154aeb5498c0c24a2ba77ec63e31a40df5e0861c0afda8d5867289c5984";
-    mips64el-unknown-linux-gnuabi64 = "6d70fe81e4f52ce5d87bcf95b60587f43f68e6730d2def7872646a9c561017ca";
-  };
-
-  selectRustPackage = pkgs: pkgs.rust_1_68;
-
-  rustcPatches = [
-    # Fixes ICE.
-    # https://github.com/rust-lang/rust/pull/107688
-    (fetchpatch {
-      name = "re-erased-regions-are-local.patch";
-      url = "https://github.com/rust-lang/rust/commit/9d110847ab7f6aef56a8cd20cb6cea4fbcc51cd9.patch";
-      excludes = [ "*tests/*" ];
-      hash = "sha256-EZH5K1BEOOfi97xZr1xEHFP4jjvJ1+xqtRMvxBoL8pU=";
-    })
-  ];
-}
-
-(builtins.removeAttrs args [ "fetchpatch" "pkgsBuildHost" "llvmPackages_11" "llvmPackages_15" "llvm_15"])
diff --git a/pkgs/development/compilers/rust/1_69.nix b/pkgs/development/compilers/rust/1_69.nix
new file mode 100644
index 000000000000..5f2e2e9acdc4
--- /dev/null
+++ b/pkgs/development/compilers/rust/1_69.nix
@@ -0,0 +1,63 @@
+# New rust versions should first go to staging.
+# Things to check after updating:
+# 1. Rustc should produce rust binaries on x86_64-linux, aarch64-linux and x86_64-darwin:
+#    i.e. nix-shell -p fd or @GrahamcOfBorg build fd on github
+#    This testing can be also done by other volunteers as part of the pull
+#    request review, in case platforms cannot be covered.
+# 2. The LLVM version used for building should match with rust upstream.
+#    Check the version number in the src/llvm-project git submodule in:
+#    https://github.com/rust-lang/rust/blob/<version-tag>/.gitmodules
+# 3. Firefox and Thunderbird should still build on x86_64-linux.
+
+{ stdenv, lib
+, buildPackages
+, newScope, callPackage
+, CoreFoundation, Security, SystemConfiguration
+, pkgsBuildTarget, pkgsBuildBuild, pkgsBuildHost
+, makeRustPlatform
+, llvmPackages_11
+, llvmPackages_15, llvm_15
+} @ args:
+
+import ./default.nix {
+  rustcVersion = "1.69.0";
+  rustcSha256 = "sha256-+wWXGGetbMq703ICefWpS5n2ECSSMYe1a7XEVfo89g8=";
+
+  llvmSharedForBuild = pkgsBuildBuild.llvmPackages_15.libllvm.override { enableSharedLibraries = true; };
+  llvmSharedForHost = pkgsBuildHost.llvmPackages_15.libllvm.override { enableSharedLibraries = true; };
+  llvmSharedForTarget = pkgsBuildTarget.llvmPackages_15.libllvm.override { enableSharedLibraries = true; };
+
+  llvmBootstrapForDarwin = llvmPackages_11;
+
+  # For use at runtime
+  llvmShared = llvm_15.override { enableSharedLibraries = true; };
+
+  # Expose llvmPackages used for rustc from rustc via passthru for LTO in Firefox
+  llvmPackages = llvmPackages_15;
+
+  # Note: the version MUST be one version prior to the version we're
+  # building
+  bootstrapVersion = "1.68.2";
+
+  # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
+  bootstrapHashes = {
+    i686-unknown-linux-gnu = "a85e1aa0831e8bd31dc8ba3e042b6dea69b4d45fd5d1111bf6fd2cc9d58dd619";
+    x86_64-unknown-linux-gnu = "df7c7466ef35556e855c0d35af7ff08e133040400452eb3427c53202b6731926";
+    x86_64-unknown-linux-musl = "bd02cbdedb4b7f2169a68dc8410e8436fab3734a3a30cab81ab21661d70c6ddd";
+    arm-unknown-linux-gnueabihf = "a5847f9bcbb1fb4183656b1b01e191d8e48c7bc8346ec6831318b697a2f305c6";
+    armv7-unknown-linux-gnueabihf = "f87e4b063b5f916b4a5057e5f544f819cee9ab5da3fe1a977cddb2170e7ba0d7";
+    aarch64-unknown-linux-gnu = "b24d0df852490d80791a228f18c2b75f24b1e6437e6e745f85364edab245f7fa";
+    aarch64-unknown-linux-musl = "e6615e72aaa3e3c9c42c35139ab253a9b738a4eab719e3e306e25026c1aa93e5";
+    x86_64-apple-darwin = "632540d3d83758cb048dc45fcfbc0b29f6f170161a3051be22b0a2962a566fb9";
+    aarch64-apple-darwin = "ab4c6add94686a0392953c588c2b61d4c03f51e855232d161dc492f286e34202";
+    powerpc64le-unknown-linux-gnu = "cf95658277d71bb8ae3a0fbc53099cc1397ed40e0953c026f41cde4a9619efca";
+    riscv64gc-unknown-linux-gnu = "befcf2d53e35ae3fe0d609d1e056bdc814bd36ce54028b8d6b8b9e38c0afcaa5";
+    mips64el-unknown-linux-gnuabi64 = "ee85bbfdc2fb831f067fda19881e6427c8c86571ebff16c1bd219d850969ef0a";
+  };
+
+  selectRustPackage = pkgs: pkgs.rust_1_69;
+
+  rustcPatches = [ ];
+}
+
+(builtins.removeAttrs args [ "pkgsBuildHost" "llvmPackages_11" "llvmPackages_15" "llvm_15"])
diff --git a/pkgs/development/compilers/rust/cargo-auditable-cargo-wrapper.nix b/pkgs/development/compilers/rust/cargo-auditable-cargo-wrapper.nix
index b50097d5e66b..cc4aed0262ff 100644
--- a/pkgs/development/compilers/rust/cargo-auditable-cargo-wrapper.nix
+++ b/pkgs/development/compilers/rust/cargo-auditable-cargo-wrapper.nix
@@ -1,10 +1,13 @@
-{ lib, writeShellScriptBin, cargo, cargo-auditable }:
+{ lib, runCommand, makeBinaryWrapper, cargo, cargo-auditable }:
 
-(writeShellScriptBin "cargo" ''
-  export PATH="${lib.makeBinPath [ cargo cargo-auditable ]}:$PATH"
-  CARGO_AUDITABLE_IGNORE_UNSUPPORTED=1 exec cargo auditable "$@"
-'') // {
+runCommand "auditable-${cargo.name}" {
+  nativeBuildInputs = [ makeBinaryWrapper ];
   meta = cargo-auditable.meta // {
     mainProgram = "cargo";
   };
-}
+} ''
+  mkdir -p $out/bin
+  makeWrapper ${cargo}/bin/cargo $out/bin/cargo \
+    --set CARGO_AUDITABLE_IGNORE_UNSUPPORTED 1 \
+    --prefix PATH : ${lib.makeBinPath [ cargo cargo-auditable ]}
+''
diff --git a/pkgs/development/compilers/vala/default.nix b/pkgs/development/compilers/vala/default.nix
index 3a97fd2eda6a..9588e718b3e6 100644
--- a/pkgs/development/compilers/vala/default.nix
+++ b/pkgs/development/compilers/vala/default.nix
@@ -103,8 +103,8 @@ in rec {
   };
 
   vala_0_56 = generic {
-    version = "0.56.6";
-    sha256 = "BQ6EHL/iuOfQ+zUMlQa9dVe+HNhqkMiWdl8aCaGHABM=";
+    version = "0.56.7";
+    sha256 = "PTnHWW1fqa6L/q5HZmn4EfcFe397kwhHiie2hEPYsAM=";
   };
 
   vala = vala_0_56;
diff --git a/pkgs/development/interpreters/tcl/8.6.nix b/pkgs/development/interpreters/tcl/8.6.nix
index 03fcb8317792..0edd47e83d6c 100644
--- a/pkgs/development/interpreters/tcl/8.6.nix
+++ b/pkgs/development/interpreters/tcl/8.6.nix
@@ -2,12 +2,12 @@
 
 callPackage ./generic.nix (args // rec {
   release = "8.6";
-  version = "${release}.11";
+  version = "${release}.13";
 
   # Note: when updating, the hash in pkgs/development/libraries/tk/8.6.nix must also be updated!
 
   src = fetchurl {
     url = "mirror://sourceforge/tcl/tcl${version}-src.tar.gz";
-    sha256 = "0n4211j80mxr6ql0xx52rig8r885rcbminfpjdb2qrw6hmk8c14c";
+    sha256 = "sha256-Q6H650EvYf8R3iz9BdKM/Dpzdi81SkF8YjcKVOLK8GY=";
   };
 })
diff --git a/pkgs/development/libraries/SDL2/default.nix b/pkgs/development/libraries/SDL2/default.nix
index c017948dd0ce..8160554a0609 100644
--- a/pkgs/development/libraries/SDL2/default.nix
+++ b/pkgs/development/libraries/SDL2/default.nix
@@ -55,11 +55,11 @@
 
 stdenv.mkDerivation rec {
   pname = "SDL2";
-  version = "2.26.4";
+  version = "2.26.5";
 
   src = fetchurl {
     url = "https://www.libsdl.org/release/${pname}-${version}.tar.gz";
-    sha256 = "sha256-Gg9oZJj7dorZ8/gLOQN6fQBurAk6rTnLTrzIMqiIcjE=";
+    sha256 = "sha256-rY/qPaG+ZMg8RbHTY6a0uo/WD1veOyPsc4VXCexeq/c=";
   };
   dontDisableStatic = if withStatic then 1 else 0;
   outputs = [ "out" "dev" ];
@@ -170,6 +170,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A cross-platform multimedia library";
     homepage = "http://www.libsdl.org/";
+    changelog = "https://github.com/libsdl-org/SDL/releases/tag/release-${version}";
     license = licenses.zlib;
     platforms = platforms.all;
     maintainers = with maintainers; [ cpages ];
diff --git a/pkgs/development/libraries/SDL2_net/default.nix b/pkgs/development/libraries/SDL2_net/default.nix
index 5239f3c6546e..b07d860cf0c3 100644
--- a/pkgs/development/libraries/SDL2_net/default.nix
+++ b/pkgs/development/libraries/SDL2_net/default.nix
@@ -9,6 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-TkqJGYgxYnGXT/TpWF7R73KaEj0iwIvUcxKRedyFf+s=";
   };
 
+  outputs = [ "out" "dev" ];
+
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = lib.optional stdenv.isDarwin darwin.libobjc;
diff --git a/pkgs/development/libraries/audio/libmysofa/default.nix b/pkgs/development/libraries/audio/libmysofa/default.nix
index 616802202146..a5ecbdcfccce 100644
--- a/pkgs/development/libraries/audio/libmysofa/default.nix
+++ b/pkgs/development/libraries/audio/libmysofa/default.nix
@@ -11,6 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-QEfkeofsVxB9gyISL/P7bvnbcBuG7Q3A4UoAyQAXxgE=";
   };
 
+  outputs = [ "out" "dev" ];
+
   nativeBuildInputs = [ cmake ];
   buildInputs = [ zlib ];
 
diff --git a/pkgs/development/libraries/audio/libopenmpt/default.nix b/pkgs/development/libraries/audio/libopenmpt/default.nix
index b53fec3f9e63..ec8c36c657fe 100644
--- a/pkgs/development/libraries/audio/libopenmpt/default.nix
+++ b/pkgs/development/libraries/audio/libopenmpt/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libopenmpt";
-  version = "0.6.9";
+  version = "0.6.10";
 
   outputs = [ "out" "dev" "bin" ];
 
   src = fetchurl {
     url = "https://lib.openmpt.org/files/libopenmpt/src/libopenmpt-${version}+release.autotools.tar.gz";
-    sha256 = "R56XWrt9wPqcrUG90x8lXXjUPgcmVGIIBY08P897blo=";
+    sha256 = "wlvo3A2sI87AJUh+WPGV5NFPfZSu3dX+RrIcBPHOJ3Q=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/avahi/default.nix b/pkgs/development/libraries/avahi/default.nix
index 2d2fd4f57716..ac97871d9ca1 100644
--- a/pkgs/development/libraries/avahi/default.nix
+++ b/pkgs/development/libraries/avahi/default.nix
@@ -31,6 +31,8 @@ stdenv.mkDerivation rec {
     sha256 = "1npdixwxxn3s9q1f365x9n9rc5xgfz39hxf23faqvlrklgbhj0q6";
   };
 
+  outputs = [ "out" "dev" "man" ];
+
   patches = [
     # CVE-2021-36217 / CVE-2021-3502
     (fetchpatch {
@@ -115,7 +117,7 @@ stdenv.mkDerivation rec {
   postInstall =
     # Maintain compat for mdnsresponder
     lib.optionalString withLibdnssdCompat ''
-      ln -s avahi-compat-libdns_sd/dns_sd.h "$out/include/dns_sd.h"
+      ln -s avahi-compat-libdns_sd/dns_sd.h "$dev/include/dns_sd.h"
     '';
 
   passthru.tests = {
diff --git a/pkgs/development/libraries/egl-wayland/default.nix b/pkgs/development/libraries/egl-wayland/default.nix
index e6468abf4edc..d3ff8a8af0fd 100644
--- a/pkgs/development/libraries/egl-wayland/default.nix
+++ b/pkgs/development/libraries/egl-wayland/default.nix
@@ -1,6 +1,8 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
+, eglexternalplatform
 , pkg-config
 , meson
 , ninja
@@ -12,35 +14,7 @@
 , wayland-protocols
 }:
 
-let
-  eglexternalplatform = stdenv.mkDerivation {
-    pname = "eglexternalplatform";
-    version = "1.1";
-
-    src = fetchFromGitHub {
-      owner = "Nvidia";
-      repo = "eglexternalplatform";
-      rev = "7c8f8e2218e46b1a4aa9538520919747f1184d86";
-      sha256 = "0lr5s2xa1zn220ghmbsiwgmx77l156wk54c7hybia0xpr9yr2nhb";
-    };
-
-    installPhase = ''
-      mkdir -p "$out/include/"
-      cp interface/eglexternalplatform.h "$out/include/"
-      cp interface/eglexternalplatformversion.h "$out/include/"
-
-      substituteInPlace eglexternalplatform.pc \
-        --replace "/usr/include/EGL" "$out/include"
-      mkdir -p "$out/share/pkgconfig"
-      cp eglexternalplatform.pc "$out/share/pkgconfig/"
-    '';
-
-    meta = with lib; {
-      license = licenses.mit;
-    };
-  };
-
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "egl-wayland";
   version = "1.1.11";
 
@@ -53,6 +27,21 @@ in stdenv.mkDerivation rec {
     sha256 = "sha256-xb0d8spr4GoGZl/8C8BoPMPN7PAlzuQV11tEJbOQQ4U=";
   };
 
+  patches = [
+    # remove after next update
+    # https://github.com/NVIDIA/egl-wayland/pull/79
+    (fetchpatch {
+      url = "https://github.com/NVIDIA/egl-wayland/commit/13737c6af4c0a7cfef5ec9013a4382bbeb7b495c.patch";
+      hash = "sha256-EEqI6iJb+uv0HkhnauYNxSzny4YapTm73PLgK8A9Km8=";
+    })
+  ];
+
+  postPatch = ''
+    # Declares an includedir but doesn't install any headers
+    # CMake's `pkg_check_modules(NAME wayland-eglstream IMPORTED_TARGET)` considers this an error
+    sed -i -e '/includedir/d' wayland-eglstream.pc.in
+  '';
+
   depsBuildBuild = [
     pkg-config
   ];
@@ -65,7 +54,6 @@ in stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    eglexternalplatform
     libGL
     libX11
     libdrm
@@ -73,12 +61,9 @@ in stdenv.mkDerivation rec {
     wayland-protocols
   ];
 
-  postFixup = ''
-    # Doubled prefix in pc file after postbuild hook replaces includedir prefix variable with dev output path
-    substituteInPlace $dev/lib/pkgconfig/wayland-eglstream.pc \
-      --replace "=$dev/$dev" "=$dev" \
-      --replace "Requires:" "Requires.private:"
-  '';
+  propagatedBuildInputs = [
+    eglexternalplatform
+  ];
 
   meta = with lib; {
     description = "The EGLStream-based Wayland external platform";
diff --git a/pkgs/development/libraries/eglexternalplatform/default.nix b/pkgs/development/libraries/eglexternalplatform/default.nix
new file mode 100644
index 000000000000..2845faa9d088
--- /dev/null
+++ b/pkgs/development/libraries/eglexternalplatform/default.nix
@@ -0,0 +1,40 @@
+{ stdenvNoCC
+, lib
+, fetchFromGitHub
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "eglexternalplatform";
+  version = "1.1";
+
+  src = fetchFromGitHub {
+    owner = "Nvidia";
+    repo = "eglexternalplatform";
+    rev = "7c8f8e2218e46b1a4aa9538520919747f1184d86";
+    sha256 = "0lr5s2xa1zn220ghmbsiwgmx77l156wk54c7hybia0xpr9yr2nhb";
+  };
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/include/
+    cp interface/* $out/include/
+
+    substituteInPlace eglexternalplatform.pc \
+      --replace "/usr/include/EGL" "$out/include"
+    install -Dm644 {.,$out/share/pkgconfig}/eglexternalplatform.pc
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "The EGL External Platform interface";
+    homepage = "https://github.com/NVIDIA/eglexternalplatform";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ hedning ];
+  };
+}
diff --git a/pkgs/development/libraries/fdk-aac/default.nix b/pkgs/development/libraries/fdk-aac/default.nix
index a94c204c2f78..84513d20a57a 100644
--- a/pkgs/development/libraries/fdk-aac/default.nix
+++ b/pkgs/development/libraries/fdk-aac/default.nix
@@ -13,6 +13,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-yehjDPnUM/POrXSQahUg0iI/ibzT+pJUhhAXRAuOsi8=";
   };
 
+  outputs = [ "out" "dev" ];
+
   configureFlags = lib.optional exampleSupport "--enable-example";
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/ffmpeg/5.nix b/pkgs/development/libraries/ffmpeg/5.nix
index 7ff9b1fc2e4c..0aa176bb8d24 100644
--- a/pkgs/development/libraries/ffmpeg/5.nix
+++ b/pkgs/development/libraries/ffmpeg/5.nix
@@ -1,4 +1,4 @@
 import ./generic.nix rec {
-  version = "5.1.2";
-  sha256 = "sha256-4jcfwIE0/DgP7ibwkrSm/aPiHIMFn34JNcXkCMx4ceI=";
+  version = "5.1.3";
+  sha256 = "sha256-twfJvANLQGO7TiyHPMPqApfHLFUlOGZTTIIGEnjyvuE=";
 }
diff --git a/pkgs/development/libraries/fribidi/default.nix b/pkgs/development/libraries/fribidi/default.nix
index 25600c9f6eb8..0c8c4c23be5a 100644
--- a/pkgs/development/libraries/fribidi/default.nix
+++ b/pkgs/development/libraries/fribidi/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   pname = "fribidi";
   version = "1.0.12";
 
-  outputs = [ "out" "devdoc" ];
+  outputs = [ "out" "dev" "devdoc" ];
 
   # NOTE: Only URL tarball has "Have pre-generated man pages: true", which works-around upstream usage of some rare ancient `c2man` fossil application.
   src = fetchurl {
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index d52ea735f8f0..2f50ed4b259d 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -56,11 +56,11 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "glib";
-  version = "2.76.1";
+  version = "2.76.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${lib.versions.majorMinor finalAttrs.version}/glib-${finalAttrs.version}.tar.xz";
-    sha256 = "Q9wPahJpWPW0VBNsQ5jqtCAknBYXGnaXhEhuJfL9oZ8=";
+    sha256 = "JPOEeFex2GdM2wOJo27ewPE8ZmzTznJ+zTQOudqKyp4=";
   };
 
   patches = lib.optionals stdenv.isDarwin [
diff --git a/pkgs/development/libraries/gpgme/default.nix b/pkgs/development/libraries/gpgme/default.nix
index 9571613ab8ef..bab58c887e5e 100644
--- a/pkgs/development/libraries/gpgme/default.nix
+++ b/pkgs/development/libraries/gpgme/default.nix
@@ -26,11 +26,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "gpgme";
-  version = "1.19.0";
+  version = "1.20.0";
 
   src = fetchurl {
     url = "mirror://gnupg/gpgme/${pname}-${version}.tar.bz2";
-    hash = "sha256-y1hJTcQV+6nusSuCZVCtMZDckuJlxbsq4aIckoQc/Tg=";
+    hash = "sha256-JaV4Wl2jVmiQAUQJJrlOln0C4TxJ63dD417wzyLkJ1A=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/intel-media-driver/default.nix b/pkgs/development/libraries/intel-media-driver/default.nix
index 17cdeb50b6b2..4ed72f4acd11 100644
--- a/pkgs/development/libraries/intel-media-driver/default.nix
+++ b/pkgs/development/libraries/intel-media-driver/default.nix
@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-media-driver";
-  version = "22.6.4";
+  version = "23.1.6";
 
   outputs = [ "out" "dev" ];
 
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     owner = "intel";
     repo = "media-driver";
     rev = "intel-media-${version}";
-    sha256 = "sha256-0Il51cWqgJwtsnsltHey5Sp+7RYUpqo4GtTRzrzw09A=";
+    sha256 = "sha256-Z1xBU+4SdwknXpYUS8EwEURNIsg2+R/U0CcW3FW325M=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/kde-frameworks/extra-cmake-modules/setup-hook.sh b/pkgs/development/libraries/kde-frameworks/extra-cmake-modules/setup-hook.sh
index ac077b73d6a6..8d86ab1d54ad 100644
--- a/pkgs/development/libraries/kde-frameworks/extra-cmake-modules/setup-hook.sh
+++ b/pkgs/development/libraries/kde-frameworks/extra-cmake-modules/setup-hook.sh
@@ -42,6 +42,10 @@ ecmPostHook() {
     cmakeFlags+=" -DKDE_INSTALL_CONFDIR=${!outputBin}/etc/xdg"
     cmakeFlags+=" -DKDE_INSTALL_AUTOSTARTDIR=${!outputBin}/etc/xdg/autostart"
 
+    if [ "$(uname)" = "Darwin" ]; then
+        cmakeFlags+=" -DKDE_INSTALL_BUNDLEDIR=${!outputBin}/Applications/KDE"
+    fi
+
     if [ -n "${qtPluginPrefix-}" ]; then
         cmakeFlags+=" -DKDE_INSTALL_QTPLUGINDIR=${!outputBin}/$qtPluginPrefix"
         cmakeFlags+=" -DKDE_INSTALL_PLUGINDIR=${!outputBin}/$qtPluginPrefix"
diff --git a/pkgs/development/libraries/libcanberra/default.nix b/pkgs/development/libraries/libcanberra/default.nix
index 6cdadeac296d..cda60e4d215f 100644
--- a/pkgs/development/libraries/libcanberra/default.nix
+++ b/pkgs/development/libraries/libcanberra/default.nix
@@ -13,6 +13,8 @@ stdenv.mkDerivation rec {
     sha256 = "0wps39h8rx2b00vyvkia5j40fkak3dpipp1kzilqla0cgvk73dn2";
   };
 
+  outputs = [ "out" "dev" ];
+
   strictDeps = true;
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [
diff --git a/pkgs/development/libraries/libdecor/default.nix b/pkgs/development/libraries/libdecor/default.nix
index 64fc11f500f0..c3641e843f57 100644
--- a/pkgs/development/libraries/libdecor/default.nix
+++ b/pkgs/development/libraries/libdecor/default.nix
@@ -7,29 +7,31 @@
 , wayland
 , wayland-protocols
 , wayland-scanner
-, egl-wayland
 , cairo
 , dbus
 , pango
-, libxkbcommon
 }:
 
 stdenv.mkDerivation rec {
   pname = "libdecor";
-  version = "0.1.0";
+  version = "0.1.1";
 
   src = fetchFromGitLab {
-    domain = "gitlab.gnome.org";
-    owner = "jadahl";
+    domain = "gitlab.freedesktop.org";
+    owner = "libdecor";
     repo = "libdecor";
     rev = "${version}";
-    sha256 = "0qdg3r7k086wzszr969s0ljlqdvfqm31zpl8p5h397bw076zr6p2";
+    hash = "sha256-8b6qCqOSDDbhYwAeAaUyI71tSopTkGtCJaxZaJw1vQQ=";
   };
 
   outputs = [ "out" "dev" ];
 
   strictDeps = true;
 
+  mesonFlags = [
+    (lib.mesonBool "demo" false)
+  ];
+
   nativeBuildInputs = [
     meson
     ninja
@@ -40,15 +42,13 @@ stdenv.mkDerivation rec {
   buildInputs = [
     wayland
     wayland-protocols
-    egl-wayland
     cairo
     dbus
     pango
-    libxkbcommon
   ];
 
   meta = with lib; {
-    homepage = "https://gitlab.gnome.org/jadahl/libdecor";
+    homepage = "https://gitlab.freedesktop.org/libdecor/libdecor";
     description = "Client-side decorations library for Wayland clients";
     license = licenses.mit;
     platforms = platforms.linux;
diff --git a/pkgs/development/libraries/libfreeaptx/default.nix b/pkgs/development/libraries/libfreeaptx/default.nix
index 648b6fac0dfc..cfc120244521 100644
--- a/pkgs/development/libraries/libfreeaptx/default.nix
+++ b/pkgs/development/libraries/libfreeaptx/default.nix
@@ -11,6 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-eEUhOrKqb2hHWanY+knpY9FBEnjkkFTB+x6BZgMBpbo=";
   };
 
+  outputs = [ "out" "dev" ];
+
   postPatch = lib.optionalString stdenv.isDarwin ''
     substituteInPlace Makefile \
       --replace '-soname' '-install_name' \
diff --git a/pkgs/development/libraries/libgcrypt/default.nix b/pkgs/development/libraries/libgcrypt/default.nix
index 56594620963c..fe2f428986d7 100644
--- a/pkgs/development/libraries/libgcrypt/default.nix
+++ b/pkgs/development/libraries/libgcrypt/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , gettext
 , libgpg-error
 , enableCapabilities ? false, libcap
@@ -15,13 +16,21 @@ assert enableCapabilities -> stdenv.isLinux;
 
 stdenv.mkDerivation rec {
   pname = "libgcrypt";
-  version = "1.10.1";
+  version = "1.10.2";
 
   src = fetchurl {
     url = "mirror://gnupg/libgcrypt/${pname}-${version}.tar.bz2";
-    hash = "sha256-7xSuVGsAhM2EJZ9hpV4Ho4w7U6/A9Ua//O8vAbr/6d4=";
+    hash = "sha256-O5wCoAS2jCVq3ZlwHeALODrMzPNxd+DWxYKJZkzODAM=";
   };
 
+  patches = lib.optionals (!stdenv.isLinux) [ # not everywhere to avoid rebuild for now
+    (fetchpatch {
+      name = "getrandom-conditionalize.patch";
+      url = "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commitdiff_plain;h=d41177937cea4aa1e9042ebcd195a349c40e8071";
+      hash = "sha256-CgQjNtC1qLe5LicIc8rESc6Z1u4fk7ErMUVcG/2G9gM=";
+    })
+  ];
+
   outputs = [ "out" "dev" "info" ];
   outputBin = "dev";
 
diff --git a/pkgs/development/libraries/libgit2/default.nix b/pkgs/development/libraries/libgit2/default.nix
index f5b0ff72ff0d..3d7b6ff9e012 100644
--- a/pkgs/development/libraries/libgit2/default.nix
+++ b/pkgs/development/libraries/libgit2/default.nix
@@ -19,14 +19,14 @@
 
 stdenv.mkDerivation rec {
   pname = "libgit2";
-  version = "1.6.3";
+  version = "1.6.4";
   # also check the following packages for updates: python3Packages.pygit2 and libgit2-glib
 
   src = fetchFromGitHub {
     owner = "libgit2";
     repo = "libgit2";
     rev = "v${version}";
-    hash = "sha256-MiEw5UbmcPfW0SlqLdYEnBdOp29YIVdKXE588uUjqck=";
+    hash = "sha256-lW3mokVKsbknVj2xsxEbeZH4IdKZ0aIgGutzenS0Eh0=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/libgpg-error/default.nix b/pkgs/development/libraries/libgpg-error/default.nix
index d8c5d87b1656..fa3dc1b95b09 100644
--- a/pkgs/development/libraries/libgpg-error/default.nix
+++ b/pkgs/development/libraries/libgpg-error/default.nix
@@ -17,11 +17,11 @@
   };
 in stdenv.mkDerivation (rec {
   pname = "libgpg-error";
-  version = "1.46";
+  version = "1.47";
 
   src = fetchurl {
     url = "mirror://gnupg/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-t+EaZCRrvl7zd0jeQ7JFq9cs/NU8muXn/FylnxyBJo0=";
+    sha256 = "sha256-njxnCWa5bsx0bCjCxBlUHjvLeH0ac5MPXl9eG8u7m9s=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/libmad/default.nix b/pkgs/development/libraries/libmad/default.nix
index 65da1d39eca0..b9096fce9ef0 100644
--- a/pkgs/development/libraries/libmad/default.nix
+++ b/pkgs/development/libraries/libmad/default.nix
@@ -23,6 +23,8 @@ stdenv.mkDerivation rec {
     sha256 = "14460zhacxhswnzb36qfpd1f2wbk10qvksvm6wyq5hpvdgnw7ymv";
   };
 
+  outputs = [ "out" "dev" ];
+
   patches = [
     (fetchpatch {
       url = "https://github.com/openwrt/packages/raw/openwrt-19.07/libs/libmad/patches/001-mips_removal_h_constraint.patch";
diff --git a/pkgs/development/libraries/libqmi/default.nix b/pkgs/development/libraries/libqmi/default.nix
index 1a314563d4b8..e2c7fcea1953 100644
--- a/pkgs/development/libraries/libqmi/default.nix
+++ b/pkgs/development/libraries/libqmi/default.nix
@@ -12,10 +12,14 @@
 , help2man
 , glib
 , python3
+, mesonEmulatorHook
 , libgudev
 , bash-completion
 , libmbim
 , libqrtr-glib
+, buildPackages
+, withIntrospection ? stdenv.hostPlatform.emulatorAvailable buildPackages
+, withMan ? stdenv.buildPlatform.canExecute stdenv.hostPlatform
 }:
 
 stdenv.mkDerivation rec {
@@ -23,7 +27,7 @@ stdenv.mkDerivation rec {
   version = "1.32.2";
 
   outputs = [ "out" "dev" ]
-    ++ lib.optionals (stdenv.buildPlatform == stdenv.hostPlatform) [ "devdoc" ];
+    ++ lib.optional withIntrospection "devdoc";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
@@ -46,31 +50,38 @@ stdenv.mkDerivation rec {
     meson
     ninja
     pkg-config
-    gobject-introspection
     python3
-  ] ++ lib.optionals (stdenv.buildPlatform == stdenv.hostPlatform) [
+  ] ++ lib.optionals withMan [
+    help2man
+  ] ++ lib.optionals withIntrospection [
+    gobject-introspection
     gtk-doc
     docbook-xsl-nons
     docbook_xml_dtd_43
-    help2man
+  ] ++ lib.optionals (withIntrospection && !stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+    mesonEmulatorHook
   ];
 
   buildInputs = [
-    libgudev
     bash-completion
     libmbim
+  ] ++ lib.optionals withIntrospection [
+    libgudev
   ];
 
   propagatedBuildInputs = [
     glib
+  ] ++ lib.optionals withIntrospection [
     libqrtr-glib
   ];
 
   mesonFlags = [
     "-Dudevdir=${placeholder "out"}/lib/udev"
-    (lib.mesonBool "gtk_doc" (stdenv.buildPlatform == stdenv.hostPlatform))
-    (lib.mesonBool "introspection" (stdenv.buildPlatform == stdenv.hostPlatform))
-    (lib.mesonBool "man" (stdenv.buildPlatform == stdenv.hostPlatform))
+    (lib.mesonBool "gtk_doc" withIntrospection)
+    (lib.mesonBool "introspection" withIntrospection)
+    (lib.mesonBool "man" withMan)
+    (lib.mesonBool "qrtr" withIntrospection)
+    (lib.mesonBool "udev" withIntrospection)
   ];
 
   doCheck = true;
diff --git a/pkgs/development/libraries/libsoup/3.x.nix b/pkgs/development/libraries/libsoup/3.x.nix
index e0db4e702728..5219f59e929d 100644
--- a/pkgs/development/libraries/libsoup/3.x.nix
+++ b/pkgs/development/libraries/libsoup/3.x.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libsoup";
-  version = "3.4.0";
+  version = "3.4.1";
 
   outputs = [ "out" "dev" ] ++ lib.optional withIntrospection "devdoc";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-I+//ascPLB6HNQfaxSZJ7sAywVl6SulRdizjEjeJrMk=";
+    sha256 = "sha256-UwuGexsWbLm8onUPHRXlGHMYtdlI77gdWJmvPXVhRQQ=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/libspatialaudio/default.nix b/pkgs/development/libraries/libspatialaudio/default.nix
index c8d29a87a03d..a97a46f357a6 100644
--- a/pkgs/development/libraries/libspatialaudio/default.nix
+++ b/pkgs/development/libraries/libspatialaudio/default.nix
@@ -14,6 +14,11 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake ];
   buildInputs = [ libmysofa zlib ];
 
+  postFixup = ''
+    substituteInPlace "''${!outputDev}/lib/pkgconfig/spatialaudio.pc" \
+      --replace '-L${lib.getDev libmysofa}' '-L${lib.getLib libmysofa}'
+  '';
+
   meta = with lib; {
     description =
       "Ambisonic encoding / decoding and binauralization library in C++";
diff --git a/pkgs/development/libraries/liburcu/default.nix b/pkgs/development/libraries/liburcu/default.nix
index 22e2c2a248a9..722a1534e92c 100644
--- a/pkgs/development/libraries/liburcu/default.nix
+++ b/pkgs/development/libraries/liburcu/default.nix
@@ -9,6 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-ykO/Jh1NOSz/IN+uRAg2YDvwCfziT9ybJpfYN6IjnU8=";
   };
 
+  outputs = [ "out" "dev" "doc" ];
+
   nativeCheckInputs = [ perl ];
 
   preCheck = "patchShebangs tests/unit";
diff --git a/pkgs/development/libraries/libuv/default.nix b/pkgs/development/libraries/libuv/default.nix
index 8a86bc46d4da..495d760f0b61 100644
--- a/pkgs/development/libraries/libuv/default.nix
+++ b/pkgs/development/libraries/libuv/default.nix
@@ -11,6 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-K6v+00basjI32ON27ZjC5spQi/zWCcslDwQwyosq2iY=";
   };
 
+  outputs = [ "out" "dev" ];
+
   patches = [
     # Fix tests for statically linked variant upstream PR is
     # https://github.com/libuv/libuv/pull/3735
@@ -74,6 +76,10 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  # separateDebugInfo breaks static build
+  # https://github.com/NixOS/nixpkgs/issues/219466
+  separateDebugInfo = !stdenv.hostPlatform.isStatic;
+
   doCheck = true;
 
   # Some of the tests use localhost networking.
diff --git a/pkgs/development/libraries/libva/default.nix b/pkgs/development/libraries/libva/default.nix
index 906e56c3da4b..d7a7f43e7e80 100644
--- a/pkgs/development/libraries/libva/default.nix
+++ b/pkgs/development/libraries/libva/default.nix
@@ -6,7 +6,6 @@
 # for passthru.tests
 , intel-compute-runtime
 , intel-media-driver
-, ffmpeg
 , mpv
 , vaapiIntel
 , vlc
@@ -14,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libva" + lib.optionalString minimal "-minimal";
-  version = "2.17.0";
+  version = "2.18.0";
 
   src = fetchFromGitHub {
     owner  = "intel";
     repo   = "libva";
     rev    = version;
-    sha256 = "sha256-Vw62xgWzaaWKQWIZDYpVpOgEUQGUNToImEAo6lwiFFU=";
+    sha256 = "sha256-VD+CTF0QLfzrUr4uFiyDlZux3MqsyyuJF/cXuhOFzwo=";
   };
 
   outputs = [ "dev" "out" ];
diff --git a/pkgs/development/libraries/libva/utils.nix b/pkgs/development/libraries/libva/utils.nix
index a46af497a55d..52a3c5f1fb9b 100644
--- a/pkgs/development/libraries/libva/utils.nix
+++ b/pkgs/development/libraries/libva/utils.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libva-utils";
-  version = "2.17.1";
+  version = "2.18.0";
 
   src = fetchFromGitHub {
     owner  = "intel";
     repo   = "libva-utils";
     rev    = version;
-    sha256 = "sha256-xsKOoDVt6L3L+6uBrKo/pyeHvQ4GgH312WKesT8XVLs=";
+    sha256 = "sha256-Dg9OcDKqgJf+RYiTYuL2pviNsK4R5cDCAHCYonlp+d8=";
   };
 
   nativeBuildInputs = [ meson ninja pkg-config ];
diff --git a/pkgs/development/libraries/mesa/generic.nix b/pkgs/development/libraries/mesa/generic.nix
index 0d959560e5da..ea7c1cb8b7b5 100644
--- a/pkgs/development/libraries/mesa/generic.nix
+++ b/pkgs/development/libraries/mesa/generic.nix
@@ -145,6 +145,11 @@ self = stdenv.mkDerivation {
       "get_option('datadir')" "'${placeholder "out"}/share'"
     substituteInPlace src/amd/vulkan/meson.build --replace \
       "get_option('datadir')" "'${placeholder "out"}/share'"
+  ''
+  # TODO: can be removed >= 23.0.4 (most likely)
+  # https://gitlab.freedesktop.org/mesa/mesa/-/commit/035aa34ed5eb418339c0e2d2
+  + ''
+    sed '/--size_t-is-usize/d' -i src/gallium/frontends/rusticl/meson.build
   '';
 
   outputs = [ "out" "dev" "drivers" ]
diff --git a/pkgs/development/libraries/tk/8.6.nix b/pkgs/development/libraries/tk/8.6.nix
index c4825d2ccf9d..3e3d8ad54011 100644
--- a/pkgs/development/libraries/tk/8.6.nix
+++ b/pkgs/development/libraries/tk/8.6.nix
@@ -10,20 +10,8 @@
 callPackage ./generic.nix (args // {
 
   src = fetchurl {
-    url = "mirror://sourceforge/tcl/tk${tcl.version}.1-src.tar.gz"; # TODO: remove '.1' for v8.6.10 or v8.7.x
-    sha256 = "1gh9k7l76qg9l0sb78ijw9xz4xl1af47aqbdifb6mjpf3cbsnv00";
+    url = "mirror://sourceforge/tcl/tk${tcl.version}-src.tar.gz";
+    sha256 = "sha256-LmX6BpojNlRAo8VsVWuGc7XjKig4ANjZslfj9YTOBnU=";
   };
 
-  patches = [ ./different-prefix-with-tcl.patch ] ++ lib.optionals stdenv.isDarwin [
-    ./Fix-bad-install_name-for-libtk8.6.dylib.patch
-    # Define MODULE_SCOPE before including tkPort.h
-    # https://core.tcl-lang.org/tk/info/dba9f5ce3b
-    (fetchpatch {
-      name = "module_scope.patch";
-      url = "https://core.tcl-lang.org/tk/vpatch?from=ef6c6960c53ea30c&to=9b8aa74eebed509a";
-      extraPrefix = "";
-      sha256 = "0crhf4zrzdpc1jdgyv6l6mxqgmny12r3i39y1i0j8q3pbqkd04bv";
-    })
-  ];
-
 })
diff --git a/pkgs/development/libraries/tk/Fix-bad-install_name-for-libtk8.6.dylib.patch b/pkgs/development/libraries/tk/Fix-bad-install_name-for-libtk8.6.dylib.patch
deleted file mode 100644
index 528a75e1c91f..000000000000
--- a/pkgs/development/libraries/tk/Fix-bad-install_name-for-libtk8.6.dylib.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From f90278dac42135acd55200b7d2153f44d72fec53 Mon Sep 17 00:00:00 2001
-From: Josef Knedl <josef.kemetmueller@aon.at>
-Date: Wed, 24 Feb 2016 00:37:40 +0100
-Subject: [PATCH] Fix bad install_name for libtk8.6.dylib
-
-This follows: https://trac.macports.org/ticket/37395
-and https://trac.macports.org/changeset/100816
-Alternative would be to use Quartz build instead:
-https://sourceforge.net/p/tktoolkit/bugs/3048/
----
- unix/Makefile.in | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/unix/Makefile.in b/unix/Makefile.in
-index f21fdbb..1b89256 100644
---- a/unix/Makefile.in
-+++ b/unix/Makefile.in
-@@ -283,7 +283,7 @@ CC_SEARCH_FLAGS	= @CC_SEARCH_FLAGS@
- LD_SEARCH_FLAGS	= @LD_SEARCH_FLAGS@
- 
- # support for embedded libraries on Darwin / Mac OS X
--DYLIB_INSTALL_DIR	= ${LIB_RUNTIME_DIR}
-+DYLIB_INSTALL_DIR	= $(libdir)
- 
- # support for building the Aqua resource file
- TK_RSRC_FILE		= @TK_RSRC_FILE@
--- 
-2.7.1
-
diff --git a/pkgs/development/libraries/tk/different-prefix-with-tcl.patch b/pkgs/development/libraries/tk/different-prefix-with-tcl.patch
deleted file mode 100644
index aee46e149b1a..000000000000
--- a/pkgs/development/libraries/tk/different-prefix-with-tcl.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-diff --git a/generic/tkWindow.c b/generic/tkWindow.c
-index b5cbbab..96b5501 100644
---- a/generic/tkWindow.c
-+++ b/generic/tkWindow.c
-@@ -988,6 +988,7 @@ TkCreateMainWindow(
- 
-     Tcl_SetVar2(interp, "tk_patchLevel", NULL, TK_PATCH_LEVEL, TCL_GLOBAL_ONLY);
-     Tcl_SetVar2(interp, "tk_version",    NULL, TK_VERSION,     TCL_GLOBAL_ONLY);
-+    Tcl_SetVar2(interp, "tk_library",    NULL, TK_LIBRARY,     TCL_GLOBAL_ONLY);
- 
-     tsdPtr->numMainWindows++;
-     return tkwin;
-diff --git a/unix/Makefile.in b/unix/Makefile.in
-index f21fdbb..c61b0df 100644
---- a/unix/Makefile.in
-+++ b/unix/Makefile.in
-@@ -1029,7 +1029,7 @@ tkVisual.o: $(GENERIC_DIR)/tkVisual.c
- 	$(CC) -c $(CC_SWITCHES) $(GENERIC_DIR)/tkVisual.c
- 
- tkWindow.o: $(GENERIC_DIR)/tkWindow.c
--	$(CC) -c $(CC_SWITCHES) $(GENERIC_DIR)/tkWindow.c
-+	$(CC) -c $(CC_SWITCHES) -DTK_LIBRARY=\"${TK_LIBRARY}\" $(GENERIC_DIR)/tkWindow.c
- 
- tkButton.o: $(GENERIC_DIR)/tkButton.c
- 	$(CC) -c $(CC_SWITCHES) $(GENERIC_DIR)/tkButton.c
diff --git a/pkgs/development/libraries/tk/generic.nix b/pkgs/development/libraries/tk/generic.nix
index 08eaad07b121..ab973c957aed 100644
--- a/pkgs/development/libraries/tk/generic.nix
+++ b/pkgs/development/libraries/tk/generic.nix
@@ -21,6 +21,10 @@ tcl.mkTclDerivation {
     for file in $(find library/demos/. -type f ! -name "*.*"); do
       substituteInPlace $file --replace "exec wish" "exec $out/bin/wish"
     done
+  ''
+  + lib.optionalString (stdenv.isDarwin && lib.versionOlder stdenv.targetPlatform.darwinMinVersion "11") ''
+    substituteInPlace unix/configure* \
+      --replace " -framework UniformTypeIdentifiers" ""
   '';
 
   postInstall = ''
diff --git a/pkgs/development/libraries/tpm2-tss/default.nix b/pkgs/development/libraries/tpm2-tss/default.nix
index 61cd2e0b489b..ec17a2d515a0 100644
--- a/pkgs/development/libraries/tpm2-tss/default.nix
+++ b/pkgs/development/libraries/tpm2-tss/default.nix
@@ -24,6 +24,8 @@ stdenv.mkDerivation rec {
     sha256 = "1jijxnvjcsgz5yw4i9fj7ycdnnz90r3l0zicpwinswrw47ac3yy5";
   };
 
+  outputs = [ "out" "man" "dev" ];
+
   nativeBuildInputs = [
     autoreconfHook autoconf-archive pkg-config doxygen perl
     shadow
diff --git a/pkgs/development/libraries/vulkan-headers/default.nix b/pkgs/development/libraries/vulkan-headers/default.nix
index 68373413b30f..91bd1a634630 100644
--- a/pkgs/development/libraries/vulkan-headers/default.nix
+++ b/pkgs/development/libraries/vulkan-headers/default.nix
@@ -1,15 +1,15 @@
 { lib, stdenv, fetchFromGitHub, cmake }:
 stdenv.mkDerivation rec {
   pname = "vulkan-headers";
-  version = "1.3.243.0";
+  version = "1.3.249";
 
   nativeBuildInputs = [ cmake ];
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Headers";
-    rev = "sdk-${version}";
-    hash = "sha256-iitEA/x9QpbQrYTcV0OzBgnY6bQFhIm+mVq1ryIQ3+0=";
+    rev = "v${version}";
+    hash = "sha256-PLqF9lO7vWvgRZvXLmOcNhTgkB+3TXUa0eoALwDc5Ws=";
   };
 
   passthru.updateScript = ./update.sh;
diff --git a/pkgs/development/libraries/vulkan-loader/default.nix b/pkgs/development/libraries/vulkan-loader/default.nix
index 7cad0a38779e..d6af2ceabb28 100644
--- a/pkgs/development/libraries/vulkan-loader/default.nix
+++ b/pkgs/development/libraries/vulkan-loader/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-loader";
-  version = "1.3.243.0";
+  version = "1.3.249";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Loader";
-    rev = "sdk-${version}";
-    hash = "sha256-DqgIg0jZxzhoyYrATDQMoNN/Pav9deKdltB7L0XDqPE=";
+    rev = "v${version}";
+    hash = "sha256-v4GEZEcQP3+oiT66sgysIZ2PdLSidyYjecb3TmcHG2Y=";
   };
 
   patches = [ ./fix-pkgconfig.patch ];
diff --git a/pkgs/development/libraries/wavpack/default.nix b/pkgs/development/libraries/wavpack/default.nix
index 2836faf6bc79..01b29e012dfc 100644
--- a/pkgs/development/libraries/wavpack/default.nix
+++ b/pkgs/development/libraries/wavpack/default.nix
@@ -19,6 +19,8 @@ stdenv.mkDerivation rec {
     hash = "sha256-4QDtLywu0PT+YsMV26M74bL2P7p4s1tk8ZBQtQcubaU=";
   };
 
+  outputs = [ "out" "dev" "doc" "man" ];
+
   meta = with lib; {
     description = "Hybrid audio compression format";
     homepage    = "https://www.wavpack.com/";
diff --git a/pkgs/development/libraries/wayland/default.nix b/pkgs/development/libraries/wayland/default.nix
index a7f0df16b263..355baa4b8faa 100644
--- a/pkgs/development/libraries/wayland/default.nix
+++ b/pkgs/development/libraries/wayland/default.nix
@@ -34,11 +34,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "wayland";
-  version = "1.21.0";
+  version = "1.22.0";
 
   src = fetchurl {
     url = "https://gitlab.freedesktop.org/wayland/wayland/-/releases/${version}/downloads/${pname}-${version}.tar.xz";
-    sha256 = "1b0ixya9bfw5c9jx8mzlr7yqnlyvd3jv5z8wln9scdv8q5zlvikd";
+    hash = "sha256-FUCvHqaYpHHC2OnSiDMsfg/TYMjx0Sk267fny8JCWEI=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/fastapi/default.nix b/pkgs/development/python-modules/fastapi/default.nix
index fec7d7b6a6dd..cee29c5eba63 100644
--- a/pkgs/development/python-modules/fastapi/default.nix
+++ b/pkgs/development/python-modules/fastapi/default.nix
@@ -61,7 +61,9 @@ buildPythonPackage rec {
     pytest-asyncio
     sqlalchemy
     trio
-  ] ++ passlib.optional-dependencies.bcrypt;
+  ]
+  ++ passlib.optional-dependencies.bcrypt
+  ++ pydantic.optional-dependencies.email;
 
   pytestFlagsArray = [
     # ignoring deprecation warnings to avoid test failure from
diff --git a/pkgs/development/python-modules/pydantic-scim/default.nix b/pkgs/development/python-modules/pydantic-scim/default.nix
new file mode 100644
index 000000000000..06a08cb445af
--- /dev/null
+++ b/pkgs/development/python-modules/pydantic-scim/default.nix
@@ -0,0 +1,48 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pydantic
+, setuptools-scm
+}:
+
+buildPythonPackage rec {
+  pname = "pydantic-scim";
+  version = "0.0.7";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "chalk-ai";
+    repo = "pydantic-scim";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-F+uj7kSz6iSb0Vg00VfJ5GcxghooNDKa75S/ZgU7WgI=";
+  };
+
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace 'version=get_version(),' 'version="${version}",'
+  '';
+
+  propagatedBuildInputs = [
+    pydantic
+  ] ++ pydantic.optional-dependencies.email;
+
+  pythonImportsCheck = [
+    "pydanticscim"
+  ];
+
+  # no tests
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Pydantic types for SCIM";
+    homepage = "https://github.com/chalk-ai/pydantic-scim";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ hexa ];
+  };
+}
diff --git a/pkgs/development/python-modules/pydantic/default.nix b/pkgs/development/python-modules/pydantic/default.nix
index 2de8e95d8b20..3674c0d74974 100644
--- a/pkgs/development/python-modules/pydantic/default.nix
+++ b/pkgs/development/python-modules/pydantic/default.nix
@@ -31,7 +31,8 @@
 
 buildPythonPackage rec {
   pname = "pydantic";
-  version = "1.10.5";
+  version = "1.10.7";
+  format = "setuptools";
 
   outputs = [
     "out"
@@ -45,7 +46,7 @@ buildPythonPackage rec {
     owner = "samuelcolvin";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-hcjnFqHTQiCIJh7L9JfpHHTm8GEZ+Vac6HO59cbEpWM=";
+    hash = "sha256-7X7rlHJ5Q01CuB9FZzoUfyfwx6AMXtE1BV5t+LnZKIM=";
   };
 
   postPatch = ''
@@ -75,16 +76,23 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     devtools
-    email-validator
     pyupgrade
-    python-dotenv
     typing-extensions
   ];
 
+  passthru.optional-dependencies = {
+    dotenv = [
+      python-dotenv
+    ];
+    email = [
+      email-validator
+    ];
+  };
+
   nativeCheckInputs = [
     pytest-mock
     pytestCheckHook
-  ];
+  ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
 
   pytestFlagsArray = [
     # https://github.com/pydantic/pydantic/issues/4817
diff --git a/pkgs/development/python-modules/pygit2/default.nix b/pkgs/development/python-modules/pygit2/default.nix
index a9b9ed15b6ba..ba8b2577986a 100644
--- a/pkgs/development/python-modules/pygit2/default.nix
+++ b/pkgs/development/python-modules/pygit2/default.nix
@@ -6,7 +6,7 @@
 , cffi
 , fetchPypi
 , isPyPy
-, libgit2_1_5
+, libgit2
 , pycparser
 , pytestCheckHook
 , pythonOlder
@@ -14,22 +14,22 @@
 
 buildPythonPackage rec {
   pname = "pygit2";
-  version = "1.11.1";
+  version = "1.12.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-eT9YP9M2IPCsODdtsPV3aO8pIribRZ51saxEA3frZOw=";
+    hash = "sha256-6UQNCGZeNSeJiZOVkKU/N6k46tpPlEaESTCqLuMNc74=";
   };
 
   preConfigure = lib.optionalString stdenv.isDarwin ''
-    export DYLD_LIBRARY_PATH="${libgit2_1_5}/lib"
+    export DYLD_LIBRARY_PATH="${libgit2}/lib"
   '';
 
   buildInputs = [
-    libgit2_1_5
+    libgit2
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyqt/5.x.nix b/pkgs/development/python-modules/pyqt/5.x.nix
index 70fb1ef8a85d..f43038fac296 100644
--- a/pkgs/development/python-modules/pyqt/5.x.nix
+++ b/pkgs/development/python-modules/pyqt/5.x.nix
@@ -55,6 +55,17 @@ buildPythonPackage rec {
     EOF
   '';
 
+  enableParallelBuilding = true;
+  # HACK: paralellize compilation of make calls within pyqt's setup.py
+  # pkgs/stdenv/generic/setup.sh doesn't set this for us because
+  # make gets called by python code and not its build phase
+  # format=pyproject means the pip-build-hook hook gets used to build this project
+  # pkgs/development/interpreters/python/hooks/pip-build-hook.sh
+  # does not use the enableParallelBuilding flag
+  postUnpack = ''
+    export MAKEFLAGS+="''${enableParallelBuilding:+-j$NIX_BUILD_CORES}"
+  '';
+
   outputs = [ "out" "dev" ];
 
   dontWrapQtApps = true;
@@ -117,7 +128,7 @@ buildPythonPackage rec {
     ++ lib.optional withWebSockets "PyQt5.QtWebSockets"
     ++ lib.optional withWebKit "PyQt5.QtWebKit"
     ++ lib.optional withMultimedia "PyQt5.QtMultimedia"
-    ++ lib.optional withConnectivity "PyQt5.QtConnectivity"
+    ++ lib.optional withConnectivity "PyQt5.QtBluetooth"
     ++ lib.optional withLocation "PyQt5.QtPositioning"
   ;
 
diff --git a/pkgs/development/python-modules/pyqt/6.x.nix b/pkgs/development/python-modules/pyqt/6.x.nix
index cac7d2915035..d24d3f362eb3 100644
--- a/pkgs/development/python-modules/pyqt/6.x.nix
+++ b/pkgs/development/python-modules/pyqt/6.x.nix
@@ -61,7 +61,7 @@ buildPythonPackage rec {
   # pkgs/development/interpreters/python/hooks/pip-build-hook.sh
   # does not use the enableParallelBuilding flag
   postUnpack = ''
-    export MAKEFLAGS+=" -j$NIX_BUILD_CORES"
+    export MAKEFLAGS+="''${enableParallelBuilding:+-j$NIX_BUILD_CORES}"
   '';
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/python-modules/transmission-rpc/default.nix b/pkgs/development/python-modules/transmission-rpc/default.nix
index 8ee18654ebed..937ff9b07d89 100644
--- a/pkgs/development/python-modules/transmission-rpc/default.nix
+++ b/pkgs/development/python-modules/transmission-rpc/default.nix
@@ -1,13 +1,13 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, fetchPypi
 , poetry-core
-, pydantic
 , pytestCheckHook
 , pythonOlder
+, python-dotenv
 , pytz
 , requests
+, typing-extensions
 , yarl
 }:
 
@@ -30,11 +30,12 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
-    pydantic
     requests
+    typing-extensions
   ];
 
   nativeCheckInputs = [
+    python-dotenv
     pytz
     pytestCheckHook
     yarl
diff --git a/pkgs/development/python-modules/watchdog/default.nix b/pkgs/development/python-modules/watchdog/default.nix
index 97dcc6c71776..4e4f491e23ae 100644
--- a/pkgs/development/python-modules/watchdog/default.nix
+++ b/pkgs/development/python-modules/watchdog/default.nix
@@ -14,16 +14,18 @@
 
 buildPythonPackage rec {
   pname = "watchdog";
-  version = "2.3.0";
+  version = "3.0.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-nTnv/mkJvomLo+coap6bF6ap9zT7Hvnd4+m7aHFfyjk=";
+    hash = "sha256-TZijIFldp6fFoY/EjLYzwuc82nj5PKwu9C1Cv2CaM/k=";
   };
 
+  # force kqueue on x86_64-darwin, because our api version does
+  # not support fsevents
   patches = lib.optionals (stdenv.isDarwin && !stdenv.isAarch64) [
     ./force-kqueue.patch
   ];
@@ -60,6 +62,7 @@ buildPythonPackage rec {
   ] ++ lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [
     # FileCreationEvent != FileDeletionEvent
     "--deselect=tests/test_emitter.py::test_separate_consecutive_moves"
+    "--deselect=tests/test_observers_polling.py::test___init__"
     # segfaults
     "--deselect=tests/test_delayed_queue.py::test_delayed_get"
     "--deselect=tests/test_emitter.py::test_delete"
@@ -86,9 +89,10 @@ buildPythonPackage rec {
   disabledTestPaths = [
     # tests timeout easily
     "tests/test_inotify_buffer.py"
-  ] ++ lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
+  ] ++ lib.optionals (stdenv.isDarwin) [
     # segfaults the testsuite
     "tests/test_emitter.py"
+    # unsupported on x86_64-darwin
     "tests/test_fsevents.py"
   ];
 
diff --git a/pkgs/development/python-modules/watchdog/force-kqueue.patch b/pkgs/development/python-modules/watchdog/force-kqueue.patch
index de222d891214..d4a0f4e6a00e 100644
--- a/pkgs/development/python-modules/watchdog/force-kqueue.patch
+++ b/pkgs/development/python-modules/watchdog/force-kqueue.patch
@@ -1,159 +1,26 @@
 diff --git a/setup.py b/setup.py
-index 072dfc8..64732bb 100644
+index 337e4be..55ef9a6 100644
 --- a/setup.py
 +++ b/setup.py
-@@ -39,7 +39,7 @@ _apple_devices = ('appletv', 'iphone', 'ipod', 'ipad', 'watch')
- is_macos = sys.platform == 'darwin' and not machine().lower().startswith(_apple_devices)
+@@ -38,7 +38,7 @@ _apple_devices = ("appletv", "iphone", "ipod", "ipad", "watch")
+ is_macos = sys.platform == "darwin" and not machine().lower().startswith(_apple_devices)
  
  ext_modules = []
--if is_macos or os.getenv('FORCE_MACOS_MACHINE', '0') == '1':
+-if is_macos or os.getenv("FORCE_MACOS_MACHINE", "0") == "1":
 +if False:
      ext_modules = [
          Extension(
-             name='_watchdog_fsevents',
-diff --git a/tests/test_emitter.py b/tests/test_emitter.py
-index bec052c..242fbea 100644
---- a/tests/test_emitter.py
-+++ b/tests/test_emitter.py
-@@ -42,13 +42,11 @@ if platform.is_linux():
-         InotifyEmitter as Emitter,
-         InotifyFullEmitter,
-     )
--elif platform.is_darwin():
+             name="_watchdog_fsevents",
+diff --git a/tests/utils.py b/tests/utils.py
+index 00dcf40..9fbc42a 100644
+--- a/tests/utils.py
++++ b/tests/utils.py
+@@ -15,8 +15,6 @@ Emitter: Type[EventEmitter]
+ if sys.platform.startswith("linux"):
+     from watchdog.observers.inotify import InotifyEmitter as Emitter
+     from watchdog.observers.inotify import InotifyFullEmitter
+-elif sys.platform.startswith("darwin"):
 -    from watchdog.observers.fsevents import FSEventsEmitter as Emitter
- elif platform.is_windows():
-     from watchdog.observers.read_directory_changes import (
-         WindowsApiEmitter as Emitter
-     )
--elif platform.is_bsd():
-+elif platform.is_bsd() or platform.is_darwin():
-     from watchdog.observers.kqueue import (
-         KqueueEmitter as Emitter
-     )
-@@ -57,12 +55,6 @@ logging.basicConfig(level=logging.DEBUG)
- logger = logging.getLogger(__name__)
- 
- 
--if platform.is_darwin():
--    # enable more verbose logs
--    fsevents_logger = logging.getLogger("fsevents")
--    fsevents_logger.setLevel(logging.DEBUG)
--
--
- @pytest.fixture(autouse=True)
- def setup_teardown(tmpdir):
-     global p, emitter, event_queue
-@@ -85,9 +77,6 @@ def start_watching(path=None, use_full_emitter=False, recursive=True):
-     else:
-         emitter = Emitter(event_queue, ObservedWatch(path, recursive=recursive))
- 
--    if platform.is_darwin():
--        emitter.suppress_history = True
--
-     emitter.start()
- 
- 
-@@ -345,7 +334,7 @@ def test_separate_consecutive_moves():
-     if platform.is_windows():
-         expected_events = [a_deleted, d_created]
- 
--    if platform.is_bsd():
-+    if platform.is_bsd() or platform.is_darwin():
-         # Due to the way kqueue works, we can't really order
-         # 'Created' and 'Deleted' events in time, so creation queues first
-         expected_events = [d_created, a_deleted, dir_modif, dir_modif]
-@@ -355,7 +344,7 @@ def test_separate_consecutive_moves():
- 
- 
- @pytest.mark.flaky(max_runs=5, min_passes=1, rerun_filter=rerun_filter)
--@pytest.mark.skipif(platform.is_bsd(), reason="BSD create another set of events for this test")
-+@pytest.mark.skipif(platform.is_bsd() or platform.is_darwin(), reason="BSD create another set of events for this test")
- def test_delete_self():
-     mkdir(p('dir1'))
-     start_watching(p('dir1'))
-@@ -365,7 +354,7 @@ def test_delete_self():
-     assert not emitter.is_alive()
- 
- 
--@pytest.mark.skipif(platform.is_windows() or platform.is_bsd(),
-+@pytest.mark.skipif(platform.is_windows() or platform.is_bsd() or platform.is_darwin(),
-                     reason="Windows|BSD create another set of events for this test")
- def test_fast_subdirectory_creation_deletion():
-     root_dir = p('dir1')
-@@ -429,7 +418,7 @@ def test_recursive_on():
-         assert event.src_path == p('dir1', 'dir2', 'dir3')
-         assert isinstance(event, DirModifiedEvent)
- 
--        if not platform.is_bsd():
-+        if not (platform.is_bsd() or platform.is_darwin()):
-             event = event_queue.get(timeout=5)[0]
-             assert event.src_path == p('dir1', 'dir2', 'dir3', 'a')
-             assert isinstance(event, FileModifiedEvent)
-@@ -452,26 +441,6 @@ def test_recursive_off():
-         if platform.is_linux():
-             expect_event(FileClosedEvent(p('b')))
- 
--    # currently limiting these additional events to macOS only, see https://github.com/gorakhargosh/watchdog/pull/779
--    if platform.is_darwin():
--        mkdir(p('dir1', 'dir2'))
--        with pytest.raises(Empty):
--            event_queue.get(timeout=5)
--        mkfile(p('dir1', 'dir2', 'somefile'))
--        with pytest.raises(Empty):
--            event_queue.get(timeout=5)
--
--        mkdir(p('dir3'))
--        expect_event(DirModifiedEvent(p()))  # the contents of the parent directory changed
--
--        mv(p('dir1', 'dir2', 'somefile'), p('somefile'))
--        expect_event(FileMovedEvent(p('dir1', 'dir2', 'somefile'), p('somefile')))
--        expect_event(DirModifiedEvent(p()))
--
--        mv(p('dir1', 'dir2'), p('dir2'))
--        expect_event(DirMovedEvent(p('dir1', 'dir2'), p('dir2')))
--        expect_event(DirModifiedEvent(p()))
--
- 
- @pytest.mark.skipif(platform.is_windows(),
-                     reason="Windows create another set of events for this test")
-@@ -493,7 +462,7 @@ def test_renaming_top_level_directory():
- 
-     expect_event(DirMovedEvent(p('a', 'b'), p('a2', 'b')))
- 
--    if platform.is_bsd():
-+    if platform.is_bsd() or platform.is_darwin():
-         expect_event(DirModifiedEvent(p()))
- 
-     open(p('a2', 'b', 'c'), 'a').close()
-@@ -584,7 +553,7 @@ def test_move_nested_subdirectories():
-     expect_event(DirMovedEvent(p('dir1', 'dir2', 'dir3'), p('dir2', 'dir3')))
-     expect_event(FileMovedEvent(p('dir1', 'dir2', 'dir3', 'a'), p('dir2', 'dir3', 'a')))
- 
--    if platform.is_bsd():
-+    if platform.is_bsd() or platform.is_darwin():
-         event = event_queue.get(timeout=5)[0]
-         assert p(event.src_path) == p()
-         assert isinstance(event, DirModifiedEvent)
-@@ -643,7 +612,7 @@ def test_move_nested_subdirectories_on_windows():
- 
- 
- @pytest.mark.flaky(max_runs=5, min_passes=1, rerun_filter=rerun_filter)
--@pytest.mark.skipif(platform.is_bsd(), reason="BSD create another set of events for this test")
-+@pytest.mark.skipif(platform.is_bsd() or platform.is_darwin(), reason="BSD create another set of events for this test")
- def test_file_lifecyle():
-     start_watching()
- 
-diff --git a/tests/test_fsevents.py b/tests/test_fsevents.py
-index 4a4fabf..49886a1 100644
---- a/tests/test_fsevents.py
-+++ b/tests/test_fsevents.py
-@@ -3,8 +3,7 @@
- import pytest
- from watchdog.utils import platform
- 
--if not platform.is_darwin():  # noqa
--    pytest.skip("macOS only.", allow_module_level=True)
-+pytest.skip("doesn't work with Nix yet", allow_module_level=True)
- 
- import logging
- import os
+ elif sys.platform.startswith("win"):
+     from watchdog.observers.read_directory_changes import WindowsApiEmitter as Emitter
+ elif sys.platform.startswith(("dragonfly", "freebsd", "netbsd", "openbsd", "bsd")):
diff --git a/pkgs/development/tools/build-managers/meson/default.nix b/pkgs/development/tools/build-managers/meson/default.nix
index 8ddc38beb5ec..fb0c5d45fb9e 100644
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@@ -17,11 +17,11 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "meson";
-  version = "1.0.0";
+  version = "1.1.0";
 
   src = python3.pkgs.fetchPypi {
     inherit pname version;
-    hash = "sha256-qlCkukVXwl59SERqv96FeVfc31g4X/++Zwug6O+szgU=";
+    hash = "sha256-2WFsRM1sU2if+PBfxpWKaT8uF8NHKo2vg87lXav/gp8=";
   };
 
   patches = [
@@ -72,13 +72,6 @@ python3.pkgs.buildPythonApplication rec {
         "docs/yaml/objects/dep.yaml"
       ];
     })
-
-    # tests: avoid unexpected failure when cmake is not installed
-    # https://github.com/mesonbuild/meson/pull/11321
-    (fetchpatch {
-      url = "https://github.com/mesonbuild/meson/commit/a38ad3039d0680f3ac34a6dc487776c79c48acf3.patch";
-      hash = "sha256-9YaXwc+F3Pw4BjuOXqva4MD6DAxX1k5WLbn0xzwuEmw=";
-    })
   ];
 
   setupHook = ./setup-hook.sh;
diff --git a/pkgs/development/tools/rust/bindgen/unwrapped.nix b/pkgs/development/tools/rust/bindgen/unwrapped.nix
index 7a99c448ba7d..7e1d1a1336c1 100644
--- a/pkgs/development/tools/rust/bindgen/unwrapped.nix
+++ b/pkgs/development/tools/rust/bindgen/unwrapped.nix
@@ -7,15 +7,15 @@ let
   rustfmt-nightly = rustfmt.override { asNightly = true; };
 in rustPlatform.buildRustPackage rec {
   pname = "rust-bindgen-unwrapped";
-  version = "0.64.0";
+  version = "0.65.1";
 
   src = fetchCrate {
     pname = "bindgen-cli";
     inherit version;
-    sha256 = "JfR4NDrU86npU+zJ80YKhCn2+hNirzL+0mzLyDHJQjU=";
+    sha256 = "9JJXQQSbCxTh3fIbVSrc6WAYGivwomkoB8ZIquUNr9o=";
   };
 
-  cargoSha256 = "e1Dqv3lA8WeVF/bxBedntk2nCWk9pUs6LkgP3svNI0w=";
+  cargoSha256 = "Kz6Y+4F9Yu5oKYI9LgZKLh0AkQTwerPS4A758TZrkoc=";
 
   buildInputs = [ clang.cc.lib ];
 
diff --git a/pkgs/development/tools/rust/maturin/default.nix b/pkgs/development/tools/rust/maturin/default.nix
index 8198a8b413c3..8e4a75cbf9bc 100644
--- a/pkgs/development/tools/rust/maturin/default.nix
+++ b/pkgs/development/tools/rust/maturin/default.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "maturin";
-  version = "0.14.16";
+  version = "0.14.17";
 
   src = fetchFromGitHub {
     owner = "PyO3";
     repo = "maturin";
     rev = "v${version}";
-    hash = "sha256-I7hZctfBsynO6Aii20nIEbhaJVeOlUsJr8W5sgBCTaU=";
+    hash = "sha256-Qvk9Pde1xmQ/lqU6KCda+F6UV7b414TDswP5Cwrh4jc=";
   };
 
-  cargoHash = "sha256-m5rXNnVuVrhyWVJP7wpVFY4eflrTZs314UBhf2JC6D8=";
+  cargoHash = "sha256-mPpM8jVDA9TbdNR1AdAzVP6sd2glUpDKhyVaaCcQzKE=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/os-specific/linux/firmware/fwupd/default.nix b/pkgs/os-specific/linux/firmware/fwupd/default.nix
index 2264e212ec67..f54ed9816897 100644
--- a/pkgs/os-specific/linux/firmware/fwupd/default.nix
+++ b/pkgs/os-specific/linux/firmware/fwupd/default.nix
@@ -297,16 +297,6 @@ stdenv.mkDerivation (finalAttrs: {
     LD_PRELOAD=${libredirect}/lib/libredirect.so
   '';
 
-  preInstall = ''
-    # We have pkexec on PATH so Meson will try to use it when installation fails
-    # due to being unable to write to e.g. /etc.
-    # Let’s pretend we already ran pkexec –
-    # the pkexec on PATH would complain it lacks setuid bit,
-    # obscuring the underlying error.
-    # https://github.com/mesonbuild/meson/blob/492cc9bf95d573e037155b588dc5110ded4d9a35/mesonbuild/minstall.py#L558
-    export PKEXEC_UID=-1
-  '';
-
   postInstall = ''
     # These files have weird licenses so they are shipped separately.
     cp --recursive --dereference "${test-firmware}/installed-tests/tests" "$installedTests/libexec/installed-tests/fwupd"
diff --git a/pkgs/os-specific/linux/hwdata/default.nix b/pkgs/os-specific/linux/hwdata/default.nix
index 9c2dab70384f..da382581ed53 100644
--- a/pkgs/os-specific/linux/hwdata/default.nix
+++ b/pkgs/os-specific/linux/hwdata/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hwdata";
-  version = "0.368";
+  version = "0.369";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${version}";
-    sha256 = "sha256-+9UyF4tcy5cJPjbyQ2RuWVJkBsZut+YX2ncUJIqIQZo=";
+    sha256 = "sha256-0AyWRir2pT4wBf2/06zVDIUWru8oGaIHoKXVz/3CiSc=";
   };
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/kbd/default.nix b/pkgs/os-specific/linux/kbd/default.nix
index c58a1b8db07e..f4290352c93d 100644
--- a/pkgs/os-specific/linux/kbd/default.nix
+++ b/pkgs/os-specific/linux/kbd/default.nix
@@ -23,6 +23,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-zN9FI4emOAlz0pJzY+nLuTn6IGiRWm+Tf/nSRSICRoM=";
   };
 
+  outputs = [ "out" "dev" ];
+
   configureFlags = [
     "--enable-optional-progs"
     "--enable-libkeymap"
diff --git a/pkgs/os-specific/linux/kexec-tools/default.nix b/pkgs/os-specific/linux/kexec-tools/default.nix
index e10f3e4defb8..2df5c0454ddc 100644
--- a/pkgs/os-specific/linux/kexec-tools/default.nix
+++ b/pkgs/os-specific/linux/kexec-tools/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "kexec-tools";
-  version = "2.0.25";
+  version = "2.0.26";
 
   src = fetchurl {
     urls = [
       "mirror://kernel/linux/utils/kernel/kexec/${pname}-${version}.tar.xz"
       "http://horms.net/projects/kexec/kexec-tools/${pname}-${version}.tar.xz"
     ];
-    sha256 = "sha256-fOLl3vOOwE95/rEH0CJD3VhvvGhWnszwL0S606E+wH0=";
+    sha256 = "sha256-f+NqBkEBzVxRXkGyvjk9zjyoitzlnW7maOCvfAxFcM0=";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/lvm2/2_03.nix b/pkgs/os-specific/linux/lvm2/2_03.nix
index 4cc62ae1b900..e054d3dbfc9c 100644
--- a/pkgs/os-specific/linux/lvm2/2_03.nix
+++ b/pkgs/os-specific/linux/lvm2/2_03.nix
@@ -1,4 +1,4 @@
 import ./common.nix {
-  version = "2.03.20";
-  hash = "sha256-kKGHmzZ1rql4RUNYHM0hKMJl7GesBGsYVucG/Ar1w8c=";
+  version = "2.03.21";
+  hash = "sha256-HiYZIdYhmYrcN5YMYV3nhMYUXH9zeoC3gfMQj77Gen4=";
 }
diff --git a/pkgs/os-specific/linux/power-profiles-daemon/default.nix b/pkgs/os-specific/linux/power-profiles-daemon/default.nix
index 393583e08642..648442ad7578 100644
--- a/pkgs/os-specific/linux/power-profiles-daemon/default.nix
+++ b/pkgs/os-specific/linux/power-profiles-daemon/default.nix
@@ -104,16 +104,6 @@ stdenv.mkDerivation rec {
       tests/unittest_inspector.py
   '';
 
-  preInstall = ''
-    # We have pkexec on PATH so Meson will try to use it when installation fails
-    # due to being unable to write to e.g. /etc.
-    # Let’s pretend we already ran pkexec –
-    # the pkexec on PATH would complain it lacks setuid bit,
-    # obscuring the underlying error.
-    # https://github.com/mesonbuild/meson/blob/492cc9bf95d573e037155b588dc5110ded4d9a35/mesonbuild/minstall.py#L558
-    export PKEXEC_UID=-1
-  '';
-
   postCheck = ''
     # Do not contaminate the wrapper with test dependencies.
     unset GI_TYPELIB_PATH
diff --git a/pkgs/servers/mir/default.nix b/pkgs/servers/mir/default.nix
index b187a1d64245..45c9efc7b2ca 100644
--- a/pkgs/servers/mir/default.nix
+++ b/pkgs/servers/mir/default.nix
@@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchFromGitHub
-, fetchpatch
 , gitUpdater
 , cmake
 , pkg-config
@@ -49,26 +48,15 @@ in
 
 stdenv.mkDerivation rec {
   pname = "mir";
-  version = "2.12.1";
+  version = "2.13.0";
 
   src = fetchFromGitHub {
     owner = "MirServer";
     repo = "mir";
     rev = "v${version}";
-    hash = "sha256-c9lFlzoxj45Xx5FYd0O/arVCV9ilArzj5GrPuJigJ4E=";
+    hash = "sha256-Ip8p4mjcgmZQJTU4MNvWkTTtSJc+cCL3x1mMDFlZrVY=";
   };
 
-  patches = [
-    # Fixes various path concatenation problems and missing GNUInstallDirs variable uses that affect
-    # install locations and generated pkg-config files
-    # Remove when a version > 2.12.1 has the fixes
-    (fetchpatch {
-      name = "0001-mir-Better-install-path-concatenations-and-more-GNUInstallDirs-variables.patch";
-      url = "https://github.com/MirServer/mir/commit/58c4ca628748278b1eb7a3721ad9a0c3590e28f2.patch";
-      hash = "sha256-+FNVlApaVzA94cy4awulLwTtggD07xACbvjII/RxyRM=";
-    })
-  ];
-
   postPatch = ''
     # Fix scripts that get run in tests
     patchShebangs tools/detect_fd_leaks.bash tests/acceptance-tests/wayland-generator/test_wayland_generator.sh.in
diff --git a/pkgs/tools/misc/file/default.nix b/pkgs/tools/misc/file/default.nix
index 35ea4e992d88..45f5ed90577f 100644
--- a/pkgs/tools/misc/file/default.nix
+++ b/pkgs/tools/misc/file/default.nix
@@ -17,6 +17,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-N1HH+6jbyDHLjXzIr/IQNUWbjOUVXviwiAon0ChHXzs=";
   };
 
+  outputs = [ "out" "dev" "man" ];
+
   patches = [
     # Backport fix to identification for pyzip files.
     # Needed for strip-nondeterminism.
diff --git a/pkgs/tools/misc/timidity/default.nix b/pkgs/tools/misc/timidity/default.nix
index 1f0e68bb9c07..d9750b438256 100644
--- a/pkgs/tools/misc/timidity/default.nix
+++ b/pkgs/tools/misc/timidity/default.nix
@@ -42,8 +42,6 @@ stdenv.mkDerivation rec {
     "AR=${stdenv.cc.targetPrefix}ar"
   ];
 
-  NIX_LDFLAGS = "-ljack -L${libjack2}/lib";
-
   instruments = fetchurl {
     url = "http://www.csee.umbc.edu/pub/midia/instruments.tar.gz";
     sha256 = "0lsh9l8l5h46z0y8ybsjd4pf6c22n33jsjvapfv3rjlfnasnqw67";
diff --git a/pkgs/tools/networking/networkmanager/default.nix b/pkgs/tools/networking/networkmanager/default.nix
index 61165f6c000c..a5cdc383f9ad 100644
--- a/pkgs/tools/networking/networkmanager/default.nix
+++ b/pkgs/tools/networking/networkmanager/default.nix
@@ -126,6 +126,12 @@ stdenv.mkDerivation rec {
     # Meson does not support using different directories during build and
     # for installation like Autotools did with flags passed to make install.
     ./fix-install-paths.patch
+
+    # Support for building with ppp 2.5.0
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/commit/5df19f5b26c5921a401e63fb329e844a02d6b1f2.diff";
+      hash = "sha256-BDm0P2U4HENAtq7OowWVDxqALNbG0nr9k/CLdE61Sck=";
+    })
   ];
 
   buildInputs = [
diff --git a/pkgs/tools/networking/ppp/default.nix b/pkgs/tools/networking/ppp/default.nix
index eee0dfd03068..9364d10b1171 100644
--- a/pkgs/tools/networking/ppp/default.nix
+++ b/pkgs/tools/networking/ppp/default.nix
@@ -1,9 +1,10 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, substituteAll
 , libpcap
 , libxcrypt
+, pkg-config
+, autoreconfHook
 , openssl
 , bash
 , nixosTests
@@ -11,27 +12,25 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "2.4.9";
+  version = "2.5.0";
   pname = "ppp";
 
   src = fetchFromGitHub {
     owner = "ppp-project";
     repo = pname;
-    rev = "${pname}-${version}";
-    sha256 = "sha256-8+nbqRNfKPLDx+wmuKSkv+BSeG72hKJI4dNqypqeEK4=";
+    rev = "ppp-${version}";
+    sha256 = "sha256-J7udiLiJiJ1PzNxD+XYAUPXZ+ABGXt2U3hSFUWJXe94=";
   };
 
-  patches = [
-    (substituteAll {
-      src = ./nix-purity.patch;
-      glibc = stdenv.cc.libc.dev or stdenv.cc.libc;
-      openssl_dev = openssl.dev;
-      openssl_lib = lib.getLib openssl;
-    })
-    # Without nonpriv.patch, pppd --version doesn't work when not run as root.
-    ./nonpriv.patch
+  configureFlags = [
+    "--with-openssl=${openssl.dev}"
+    "--sysconfdir=/etc"
   ];
 
+  nativeBuildInputs = [
+    pkg-config
+    autoreconfHook
+  ];
   buildInputs = [
     libpcap
     libxcrypt
@@ -39,17 +38,6 @@ stdenv.mkDerivation rec {
     bash
   ];
 
-  # This can be removed when ppp 2.5.0 is released:
-  # https://github.com/ppp-project/ppp/commit/509f04959ad891d7f981f035ed461d51bd1f74b0
-  propagatedBuildInputs = lib.optional stdenv.hostPlatform.isMusl (writeTextDir "include/net/ppp_defs.h" ''
-    #ifndef _NET_PPP_DEFS_H
-    #define _NET_PPP_DEFS_H 1
-
-    #include <linux/ppp_defs.h>
-
-    #endif /* net/ppp_defs.h */
-  '');
-
   postPatch = ''
     for file in $(find -name Makefile.linux); do
       substituteInPlace "$file" --replace '-m 4550' '-m 550'
@@ -65,20 +53,15 @@ stdenv.mkDerivation rec {
 
   NIX_LDFLAGS = "-lcrypt";
 
-  # This can probably be removed if version > 2.4.9, as IPX support
-  # has been removed upstream[1].  Just check whether pkgsMusl.ppp
-  # still builds.
-  #
-  # [1]: https://github.com/ppp-project/ppp/commit/c2881a6b71a36d28a89166e82820dc5e711fd775
-  env.NIX_CFLAGS_COMPILE =
-    lib.optionalString stdenv.hostPlatform.isMusl "-UIPX_CHANGE";
+  installFlags = [
+    "sysconfdir=$(out)/etc"
+  ];
 
-  installPhase = ''
-    runHook preInstall
+  preInstall = ''
     mkdir -p $out/bin
-    make install
+  '';
+  postInstall = ''
     install -D -m 755 scripts/{pon,poff,plog} $out/bin
-    runHook postInstall
   '';
 
   postFixup = ''
diff --git a/pkgs/tools/networking/ppp/nix-purity.patch b/pkgs/tools/networking/ppp/nix-purity.patch
deleted file mode 100644
index 1673376f9b6f..000000000000
--- a/pkgs/tools/networking/ppp/nix-purity.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux
-index 22837c5..6f6fff5 100644
---- a/pppd/Makefile.linux
-+++ b/pppd/Makefile.linux
-@@ -111,8 +111,8 @@ endif
- 
- # EAP SRP-SHA1
- ifdef USE_SRP
--CFLAGS	+= -DUSE_SRP -DOPENSSL -I/usr/local/ssl/include
--LIBS	+= -lsrp -L/usr/local/ssl/lib
-+CFLAGS	+= -DUSE_SRP -DOPENSSL -I@openssl_dev@/include/openssl
-+LIBS	+= -lsrp -L@openssl_lib@/lib
- NEEDCRYPTOLIB = y
- TARGETS	+= srp-entry
- EXTRAINSTALL = $(INSTALL) -c -m 555 srp-entry $(BINDIR)/srp-entry
-@@ -143,7 +143,7 @@ CFLAGS   += -DHAS_SHADOW
- #LIBS     += -lshadow $(LIBS)
- endif
- 
--ifeq ($(shell echo '\#include <crypt.h>' | $(CC) -E - >/dev/null 2>&1 && echo yes),yes)
-+ifneq ($(wildcard @glibc@/include/crypt.h),)
- CFLAGS  += -DHAVE_CRYPT_H=1
- LIBS	+= -lcrypt
- endif
-@@ -155,7 +155,7 @@ endif
- 
- ifdef NEEDDES
- ifndef USE_CRYPT
--CFLAGS   += -I$(shell $(CC) --print-sysroot)/usr/include/openssl
-+CFLAGS   += -I@openssl_dev@/include/openssl
- NEEDCRYPTOLIB = y
- else
- CFLAGS   += -DUSE_CRYPT=1
diff --git a/pkgs/tools/networking/ppp/nonpriv.patch b/pkgs/tools/networking/ppp/nonpriv.patch
deleted file mode 100644
index df6faaf8383d..000000000000
--- a/pkgs/tools/networking/ppp/nonpriv.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/pppd/main.c b/pppd/main.c
-index 014d614..6661d33 100644
---- a/pppd/main.c
-+++ b/pppd/main.c
-@@ -334,7 +334,7 @@ main(argc, argv)
-     umask(umask(0777) | 022);
- 
-     uid = getuid();
--    privileged = uid == 0;
-+    privileged = (uid == 0) || (geteuid() != 0);
-     slprintf(numbuf, sizeof(numbuf), "%d", uid);
-     script_setenv("ORIG_UID", numbuf, 0);
- 
diff --git a/pkgs/tools/networking/pptpd/default.nix b/pkgs/tools/networking/pptpd/default.nix
index c7bd929b1812..3c24d2ac0715 100644
--- a/pkgs/tools/networking/pptpd/default.nix
+++ b/pkgs/tools/networking/pptpd/default.nix
@@ -9,6 +9,10 @@ stdenv.mkDerivation rec {
     sha256 = "1h06gyxj51ba6kbbnf6hyivwjia0i6gsmjz8kyggaany8a58pkcg";
   };
 
+  patches = [
+    ./ppp-2.5.0-compat.patch
+  ];
+
   buildInputs = [ ppp ];
 
   postPatch = ''
diff --git a/pkgs/tools/networking/pptpd/ppp-2.5.0-compat.patch b/pkgs/tools/networking/pptpd/ppp-2.5.0-compat.patch
new file mode 100644
index 000000000000..33c4a828067e
--- /dev/null
+++ b/pkgs/tools/networking/pptpd/ppp-2.5.0-compat.patch
@@ -0,0 +1,59 @@
+diff --git a/plugins/pptpd-logwtmp.c b/plugins/pptpd-logwtmp.c
+index ac5ecc2..9745177 100644
+--- a/plugins/pptpd-logwtmp.c
++++ b/plugins/pptpd-logwtmp.c
+@@ -12,9 +12,18 @@
+ #include <unistd.h>
+ #include <utmp.h>
+ #include <string.h>
++
++#define HAVE_STDARG_H 1
++#define HAVE_STDBOOL_H 1
++#define HAVE_STDDEF_H 1
+ #include <pppd/pppd.h>
++#include <pppd/options.h>
++#include <linux/ppp_defs.h>
++#include <linux/limits.h>
++
++int debug = 0;
+ 
+-char pppd_version[] = VERSION;
++char pppd_version[] = PPPD_VERSION;
+ 
+ static char pptpd_original_ip[PATH_MAX+1];
+ static bool pptpd_logwtmp_strip_domain = 0;
+@@ -42,25 +51,27 @@ static char *reduce(char *user)
+ 
+ static void ip_up(void *opaque, int arg)
+ {
++  char peer_authname[MAXNAMELEN];
++  ppp_peer_authname(peer_authname, MAXNAMELEN);
+   char *user = reduce(peer_authname);
+   if (debug)
+-    notice("pptpd-logwtmp.so ip-up %s %s %s", ifname, user, 
++    notice("pptpd-logwtmp.so ip-up %s %s %s", ppp_ifname(), user, 
+ 	   pptpd_original_ip);
+-  logwtmp(ifname, user, pptpd_original_ip);
++  logwtmp(ppp_ifname(), user, pptpd_original_ip);
+ }
+ 
+ static void ip_down(void *opaque, int arg)
+ {
+   if (debug) 
+-    notice("pptpd-logwtmp.so ip-down %s", ifname);
+-  logwtmp(ifname, "", "");
++    notice("pptpd-logwtmp.so ip-down %s", ppp_ifname());
++  logwtmp(ppp_ifname(), "", "");
+ }
+ 
+ void plugin_init(void)
+ {
+-  add_options(options);
+-  add_notifier(&ip_up_notifier, ip_up, NULL);
+-  add_notifier(&ip_down_notifier, ip_down, NULL);
++  ppp_add_options(options);
++  ppp_add_notify(NF_IP_UP, ip_up, NULL);
++  ppp_add_notify(NF_IP_DOWN, ip_down, NULL);
+   if (debug) 
+     notice("pptpd-logwtmp: $Version$");
+ }
diff --git a/pkgs/tools/networking/sstp/default.nix b/pkgs/tools/networking/sstp/default.nix
index a4f6d7772c6f..b93d6cbd9cfb 100644
--- a/pkgs/tools/networking/sstp/default.nix
+++ b/pkgs/tools/networking/sstp/default.nix
@@ -1,12 +1,14 @@
-{ lib, stdenv, fetchurl, pkg-config, ppp, libevent, openssl }:
+{ lib, stdenv, fetchFromGitLab, pkg-config, ppp, libevent, openssl, autoreconfHook }:
 
 stdenv.mkDerivation rec {
   pname = "sstp-client";
-  version = "1.0.18";
+  version = "unstable-2023-03-25";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/sstp-client/sstp-client/sstp-client-${version}.tar.gz";
-    sha256 = "sha256-2Hn081q36uh0hu3Ei1D5mpr2X162+0QnmTyleLsODcg=";
+  src = fetchFromGitLab {
+    owner = "sstp-project";
+    repo = pname;
+    rev = "3f7835df9ac5e84729903ca536cf65e4a7b04c6c";
+    hash = "sha256-8VF5thSABqf5SXEDCa+0dyDt7kVrQcs6deWLlYWM8dg=";
   };
 
   postPatch = ''
@@ -20,7 +22,7 @@ stdenv.mkDerivation rec {
     "--with-pppd-plugin-dir=$(out)/lib/pppd"
   ];
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config autoreconfHook ];
 
   buildInputs = [ libevent openssl ppp ];
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index acea2323d310..e61f6c1237d8 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -16068,11 +16068,11 @@ with pkgs;
     inherit (darwin) apple_sdk;
   };
 
-  rust_1_68 = callPackage ../development/compilers/rust/1_68.nix {
+  rust_1_69 = callPackage ../development/compilers/rust/1_69.nix {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security SystemConfiguration;
     llvm_15 = llvmPackages_15.libllvm;
   };
-  rust = rust_1_68;
+  rust = rust_1_69;
 
   mrustc = callPackage ../development/compilers/mrustc { };
   mrustc-minicargo = callPackage ../development/compilers/mrustc/minicargo.nix { };
@@ -16080,8 +16080,8 @@ with pkgs;
     openssl = openssl_1_1;
   };
 
-  rustPackages_1_68 = rust_1_68.packages.stable;
-  rustPackages = rustPackages_1_68;
+  rustPackages_1_69 = rust_1_69.packages.stable;
+  rustPackages = rustPackages_1_69;
 
   inherit (rustPackages) cargo cargo-auditable cargo-auditable-cargo-wrapper clippy rustc rustPlatform;
 
@@ -19960,6 +19960,8 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Accelerate CoreGraphics CoreVideo;
   };
 
+  eglexternalplatform = callPackage ../development/libraries/eglexternalplatform { };
+
   egl-wayland = callPackage ../development/libraries/egl-wayland { };
 
   elastix = callPackage ../development/libraries/science/biology/elastix {
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 7d7bc0412d94..d4bb65978a7d 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -8185,6 +8185,8 @@ self: super: with self; {
 
   pydantic = callPackage ../development/python-modules/pydantic { };
 
+  pydantic-scim = callPackage ../development/python-modules/pydantic-scim { };
+
   pydash = callPackage ../development/python-modules/pydash { };
 
   pydata-google-auth = callPackage ../development/python-modules/pydata-google-auth { };