diff --git a/doc/builders/packages/citrix.section.md b/doc/builders/packages/citrix.section.md
index 4721f7e90f7a..bcf0924249bc 100644
--- a/doc/builders/packages/citrix.section.md
+++ b/doc/builders/packages/citrix.section.md
@@ -4,7 +4,7 @@ The [Citrix Workspace App](https://www.citrix.com/products/workspace-app/) is a
 
 ## Basic usage {#sec-citrix-base}
 
-The tarball archive needs to be downloaded manually, as the license agreements of the vendor for [Citrix Workspace](https://www.citrix.de/downloads/workspace-app/linux/workspace-app-for-linux-latest.html) needs to be accepted first. Then run `nix-prefetch-url file://$PWD/linuxx64-$version.tar.gz`. With the archive available in the store, the package can be built and installed with Nix.
+The tarball archive needs to be downloaded manually, as the license agreements of the vendor for [Citrix Workspace](https://www.citrix.com/downloads/workspace-app/linux/workspace-app-for-linux-latest.html) needs to be accepted first. Then run `nix-prefetch-url file://$PWD/linuxx64-$version.tar.gz`. With the archive available in the store, the package can be built and installed with Nix.
 
 ## Citrix Self-service {#sec-citrix-selfservice}
 
@@ -19,7 +19,7 @@ $ selfservice
 
 ## Custom certificates {#sec-citrix-custom-certs}
 
-The `Citrix Workspace App` in `nixpkgs` trusts several certificates [from the Mozilla database](https://curl.haxx.se/docs/caextract.html) by default. However, several companies using Citrix might require their own corporate certificate. On distros with imperative packaging, these certs can be stored easily in [`$ICAROOT`](https://developer-docs.citrix.com/projects/receiver-for-linux-command-reference/en/13.7/), however this directory is a store path in `nixpkgs`. In order to work around this issue, the package provides a simple mechanism to add custom certificates without rebuilding the entire package using `symlinkJoin`:
+The `Citrix Workspace App` in `nixpkgs` trusts several certificates [from the Mozilla database](https://curl.haxx.se/docs/caextract.html) by default. However, several companies using Citrix might require their own corporate certificate. On distros with imperative packaging, these certs can be stored easily in [`$ICAROOT`](https://citrix.github.io/receiver-for-linux-command-reference/), however this directory is a store path in `nixpkgs`. In order to work around this issue, the package provides a simple mechanism to add custom certificates without rebuilding the entire package using `symlinkJoin`:
 
 ```nix
 with import <nixpkgs> { config.allowUnfree = true; };
diff --git a/doc/builders/packages/ibus.section.md b/doc/builders/packages/ibus.section.md
index 1b09d3fbbab9..ec78cd0c9a96 100644
--- a/doc/builders/packages/ibus.section.md
+++ b/doc/builders/packages/ibus.section.md
@@ -4,7 +4,7 @@ This package is an ibus-based completion method to speed up typing.
 
 ## Activating the engine {#sec-ibus-typing-booster-activate}
 
-IBus needs to be configured accordingly to activate `typing-booster`. The configuration depends on the desktop manager in use. For detailed instructions, please refer to the [upstream docs](https://mike-fabian.github.io/ibus-typing-booster/documentation.html).
+IBus needs to be configured accordingly to activate `typing-booster`. The configuration depends on the desktop manager in use. For detailed instructions, please refer to the [upstream docs](https://mike-fabian.github.io/ibus-typing-booster/).
 
 On NixOS, you need to explicitly enable `ibus` with given engines before customizing your desktop to use `typing-booster`. This can be achieved using the `ibus` module:
 
diff --git a/doc/languages-frameworks/dotnet.section.md b/doc/languages-frameworks/dotnet.section.md
index bfb193b1f021..30a12d4e8ffa 100644
--- a/doc/languages-frameworks/dotnet.section.md
+++ b/doc/languages-frameworks/dotnet.section.md
@@ -28,13 +28,13 @@ mkShell {
   packages = [
     (with dotnetCorePackages; combinePackages [
       sdk_3_1
-      sdk_5_0
+      sdk_6_0
     ])
   ];
 }
 ```
 
-This will produce a dotnet installation that has the dotnet 3.1, 3.0, and 2.1 sdk. The first sdk listed will have it's cli utility present in the resulting environment. Example info output:
+This will produce a dotnet installation that has the dotnet 3.1 6.0 sdk. The first sdk listed will have it's cli utility present in the resulting environment. Example info output:
 
 ```ShellSession
 $ dotnet --info
@@ -120,7 +120,7 @@ in buildDotnetModule rec {
   projectReferences = [ referencedProject ]; # `referencedProject` must contain `nupkg` in the folder structure.
 
   dotnet-sdk = dotnetCorePackages.sdk_3_1;
-  dotnet-runtime = dotnetCorePackages.net_5_0;
+  dotnet-runtime = dotnetCorePackages.net_6_0;
 
   executables = [ "foo" ]; # This wraps "$out/lib/$pname/foo" to `$out/bin/foo`.
   executables = []; # Don't install any executables.
diff --git a/doc/languages-frameworks/gnome.section.md b/doc/languages-frameworks/gnome.section.md
index d5996cce13cf..0d4865b7af1c 100644
--- a/doc/languages-frameworks/gnome.section.md
+++ b/doc/languages-frameworks/gnome.section.md
@@ -34,7 +34,7 @@ To allow software to use various virtual file systems, `gvfs` package can be als
 
 ### GdkPixbuf loaders {#ssec-gnome-gdk-pixbuf-loaders}
 
-GTK applications typically use [GdkPixbuf](https://developer.gnome.org/gdk-pixbuf/stable/) to load images. But `gdk-pixbuf` package only supports basic bitmap formats like JPEG, PNG or TIFF, requiring to use third-party loader modules for other formats. This is especially painful since GTK itself includes SVG icons, which cannot be rendered without a loader provided by `librsvg`.
+GTK applications typically use [GdkPixbuf](https://gitlab.gnome.org/GNOME/gdk-pixbuf/) to load images. But `gdk-pixbuf` package only supports basic bitmap formats like JPEG, PNG or TIFF, requiring to use third-party loader modules for other formats. This is especially painful since GTK itself includes SVG icons, which cannot be rendered without a loader provided by `librsvg`.
 
 Unlike other libraries mentioned in this section, GdkPixbuf only supports a single value in its controlling environment variable `GDK_PIXBUF_MODULE_FILE`. It is supposed to point to a cache file containing information about the available loaders. Each loader package will contain a `lib/gdk-pixbuf-2.0/2.10.0/loaders.cache` file describing the default loaders in `gdk-pixbuf` package plus the loader contained in the package itself. If you want to use multiple third-party loaders, you will need to create your own cache file manually. Fortunately, this is pretty rare as [not many loaders exist](https://gitlab.gnome.org/federico/gdk-pixbuf-survey/blob/master/src/modules.md).
 
@@ -70,7 +70,7 @@ Also make sure that `icon-theme.cache` is installed for each theme provided by t
 
 ### GTK Themes {#ssec-gnome-themes}
 
-Previously, a GTK theme needed to be in `XDG_DATA_DIRS`. This is no longer necessary for most programs since GTK incorporated Adwaita theme. Some programs (for example, those designed for [elementary HIG](https://elementary.io/docs/human-interface-guidelines#human-interface-guidelines)) might require a special theme like `pantheon.elementary-gtk-theme`.
+Previously, a GTK theme needed to be in `XDG_DATA_DIRS`. This is no longer necessary for most programs since GTK incorporated Adwaita theme. Some programs (for example, those designed for [elementary HIG](https://docs.elementary.io/hig)) might require a special theme like `pantheon.elementary-gtk-theme`.
 
 ### GObject introspection typelibs {#ssec-gnome-typelibs}
 
diff --git a/lib/licenses.nix b/lib/licenses.nix
index e88054134a3d..f22d1401410b 100644
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@@ -715,7 +715,12 @@ in mkLicense lset) ({
 
   ncsa = {
     spdxId = "NCSA";
-    fullName  = "University of Illinois/NCSA Open Source License";
+    fullName = "University of Illinois/NCSA Open Source License";
+  };
+
+  nlpl = {
+    spdxId = "NLPL";
+    fullName = "No Limit Public License";
   };
 
   nposl3 = {
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 0b52521ce4c5..5ef4df5db992 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -12269,6 +12269,12 @@
     githubId = 710906;
     name = "Roel van Dijk";
   };
+  roman = {
+    email = "open-source@roman-gonzalez.info";
+    github = "roman";
+    githubId = 7335;
+    name = "Roman Gonzalez";
+  };
   romildo = {
     email = "malaquias@gmail.com";
     github = "romildo";
diff --git a/maintainers/scripts/luarocks-packages.csv b/maintainers/scripts/luarocks-packages.csv
index d6d2a9da0687..b8f8bf6ef488 100644
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@@ -65,6 +65,7 @@ luaevent,,,,,,
 luaexpat,,,,1.4.1-1,,arobyn flosse
 luaffi,,,http://luarocks.org/dev,,,
 luafilesystem,,,,1.8.0-1,,flosse
+lualdap,,,,,,aanderse
 lualogging,,,,,,
 luaossl,,,,,5.1,
 luaposix,,,,34.1.1-1,,vyp lblasc
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
index 8613bf8b03ba..aa58c2a354d5 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
@@ -61,6 +61,13 @@
           <link linkend="opt-services.printing.cups-pdf.enable">services.printing.cups-pdf</link>.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://www.magicbug.co.uk/cloudlog/">Cloudlog</link>,
+          a web-based Amateur Radio logging application. Available as
+          <link linkend="opt-services.cloudlog.enable">services.cloudlog</link>.
+        </para>
+      </listitem>
       <listitem>
         <para>
           <link xlink:href="https://github.com/junegunn/fzf">fzf</link>,
@@ -372,6 +379,13 @@
           <literal>freetype</literal> and others.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          .NET 5.0 was removed due to being end-of-life, use a newer,
+          supported .NET version -
+          https://dotnet.microsoft.com/en-us/platform/support/policy/dotnet-core
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
   <section xml:id="sec-release-23.05-notable-changes">
diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index b950691c2405..13ff807b79c0 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -24,6 +24,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [cups-pdf-to-pdf](https://github.com/alexivkin/CUPS-PDF-to-PDF), a pdf-generating cups backend based on [cups-pdf](https://www.cups-pdf.de/). Available as [services.printing.cups-pdf](#opt-services.printing.cups-pdf.enable).
 
+- [Cloudlog](https://www.magicbug.co.uk/cloudlog/), a web-based Amateur Radio logging application. Available as [services.cloudlog](#opt-services.cloudlog.enable).
+
 - [fzf](https://github.com/junegunn/fzf), a command line fuzzyfinder. Available as [programs.fzf](#opt-programs.fzf.fuzzyCompletion).
 
 - [gmediarender](https://github.com/hzeller/gmrender-resurrect), a simple, headless UPnP/DLNA renderer.  Available as [services.gmediarender](options.html#opt-services.gmediarender.enable).
@@ -91,6 +93,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - Deprecated `xlibsWrapper` transitional package has been removed in favour of direct use of its constitutents: `xorg.libX11`, `freetype` and others.
 
+- .NET 5.0 was removed due to being end-of-life, use a newer, supported .NET version - https://dotnet.microsoft.com/en-us/platform/support/policy/dotnet-core
+
 ## Other Notable Changes {#sec-release-23.05-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/nixos/modules/config/no-x-libs.nix b/nixos/modules/config/no-x-libs.nix
index a1257bbdaf60..9542de9fa1f6 100644
--- a/nixos/modules/config/no-x-libs.nix
+++ b/nixos/modules/config/no-x-libs.nix
@@ -59,6 +59,9 @@ with lib;
       pinentry = super.pinentry.override { enabledFlavors = [ "curses" "tty" "emacs" ]; withLibsecret = false; };
       qemu = super.qemu.override { gtkSupport = false; spiceSupport = false; sdlSupport = false; };
       qrencode = super.qrencode.overrideAttrs (_: { doCheck = false; });
+      qt5 = super.qt5.overrideScope' (self: super: {
+        qtbase = super.qtbase.override { withGtk3 = false; };
+      });
       stoken = super.stoken.override { withGTK3 = false; };
       # translateManpages -> perlPackages.po4a -> texlive-combined-basic -> texlive-core-big -> libX11
       util-linux = super.util-linux.override { translateManpages = false; };
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index e1c174a00f99..66bd185da549 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1119,6 +1119,7 @@
   ./services/web-apps/bookstack.nix
   ./services/web-apps/calibre-web.nix
   ./services/web-apps/changedetection-io.nix
+  ./services/web-apps/cloudlog.nix
   ./services/web-apps/code-server.nix
   ./services/web-apps/convos.nix
   ./services/web-apps/dex.nix
diff --git a/nixos/modules/services/web-apps/cloudlog.nix b/nixos/modules/services/web-apps/cloudlog.nix
new file mode 100644
index 000000000000..ffd1085bde65
--- /dev/null
+++ b/nixos/modules/services/web-apps/cloudlog.nix
@@ -0,0 +1,502 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.services.cloudlog;
+  dbFile = let
+    password = if cfg.database.createLocally
+               then "''"
+               else "trim(file_get_contents('${cfg.database.passwordFile}'))";
+  in pkgs.writeText "database.php" ''
+    <?php
+    defined('BASEPATH') OR exit('No direct script access allowed');
+    $active_group = 'default';
+    $query_builder = TRUE;
+    $db['default'] = array(
+      'dsn' => "",
+      'hostname' => '${cfg.database.host}',
+      'username' => '${cfg.database.user}',
+      'password' => ${password},
+      'database' => '${cfg.database.name}',
+      'dbdriver' => 'mysqli',
+      'dbprefix' => "",
+      'pconnect' => TRUE,
+      'db_debug' => (ENVIRONMENT !== 'production'),
+      'cache_on' => FALSE,
+      'cachedir' => "",
+      'char_set' => 'utf8mb4',
+      'dbcollat' => 'utf8mb4_general_ci',
+      'swap_pre' => "",
+      'encrypt' => FALSE,
+      'compress' => FALSE,
+      'stricton' => FALSE,
+      'failover' => array(),
+      'save_queries' => TRUE
+    );
+  '';
+  configFile = pkgs.writeText "config.php" ''
+    ${strings.fileContents "${pkgs.cloudlog}/install/config/config.php"}
+    $config['datadir'] = "${cfg.dataDir}/";
+    $config['base_url'] = "${cfg.baseUrl}";
+    ${cfg.extraConfig}
+  '';
+  package = pkgs.stdenv.mkDerivation rec {
+    pname = "cloudlog";
+    version = src.version;
+    src = pkgs.cloudlog;
+    installPhase = ''
+      mkdir -p $out
+      cp -r * $out/
+
+      ln -s ${configFile} $out/application/config/config.php
+      ln -s ${dbFile} $out/application/config/database.php
+
+      # link writable directories
+      for directory in updates uploads backup logbook; do
+        rm -rf $out/$directory
+        ln -s ${cfg.dataDir}/$directory $out/$directory
+      done
+
+      # link writable asset files
+      for asset in dok sota wwff; do
+        rm -rf $out/assets/json/$asset.txt
+        ln -s ${cfg.dataDir}/assets/json/$asset.txt $out/assets/json/$asset.txt
+      done
+    '';
+  };
+in
+{
+  options.services.cloudlog = with types; {
+    enable = mkEnableOption (mdDoc "Whether to enable Cloudlog.");
+    dataDir = mkOption {
+      type = str;
+      default = "/var/lib/cloudlog";
+      description = mdDoc "Cloudlog data directory.";
+    };
+    baseUrl = mkOption {
+      type = str;
+      default = "http://localhost";
+      description = mdDoc "Cloudlog base URL";
+    };
+    user = mkOption {
+      type = str;
+      default = "cloudlog";
+      description = mdDoc "User account under which Cloudlog runs.";
+    };
+    database = {
+      createLocally = mkOption {
+        type = types.bool;
+        default = true;
+        description = lib.mdDoc "Create the database and database user locally.";
+      };
+      host = mkOption {
+        type = str;
+        description = mdDoc "MySQL database host";
+        default = "localhost";
+      };
+      name = mkOption {
+        type = str;
+        description = mdDoc "MySQL database name.";
+        default = "cloudlog";
+      };
+      user = mkOption {
+        type = str;
+        description = mdDoc "MySQL user name.";
+        default = "cloudlog";
+      };
+      passwordFile = mkOption {
+        type = nullOr str;
+        description = mdDoc "MySQL user password file.";
+        default = null;
+      };
+    };
+    poolConfig = mkOption {
+      type = attrsOf (oneOf [ str int bool ]);
+      default = {
+        "pm" = "dynamic";
+        "pm.max_children" = 32;
+        "pm.start_servers" = 2;
+        "pm.min_spare_servers" = 2;
+        "pm.max_spare_servers" = 4;
+        "pm.max_requests" = 500;
+      };
+      description = mdDoc ''
+        Options for Cloudlog's PHP-FPM pool.
+      '';
+    };
+    virtualHost = mkOption {
+      type = nullOr str;
+      default = "localhost";
+      description = mdDoc ''
+        Name of the nginx virtualhost to use and setup. If null, do not setup
+         any virtualhost.
+      '';
+    };
+    extraConfig = mkOption {
+      description = mdDoc ''
+       Any additional text to be appended to the config.php
+       configuration file. This is a PHP script. For configuration
+       settings, see <https://github.com/magicbug/Cloudlog/wiki/Cloudlog.php-Configuration-File>.
+      '';
+      default = "";
+      type = str;
+      example = ''
+        $config['show_time'] = TRUE;
+      '';
+    };
+    upload-lotw = {
+      enable = mkOption {
+        type = bool;
+        default = true;
+        description = mdDoc ''
+          Whether to periodically upload logs to LoTW. If enabled, a systemd
+          timer will run the log upload task as specified by the interval
+           option.
+        '';
+      };
+      interval = mkOption {
+        type = str;
+        default = "daily";
+        description = mdDoc ''
+          Specification (in the format described by systemd.time(7)) of the
+          time at which the LoTW upload will occur.
+        '';
+      };
+    };
+    upload-clublog = {
+      enable = mkOption {
+        type = bool;
+        default = true;
+        description = mdDoc ''
+          Whether to periodically upload logs to Clublog. If enabled, a systemd
+          timer will run the log upload task as specified by the interval option.
+        '';
+      };
+      interval = mkOption {
+        type = str;
+        default = "daily";
+        description = mdDoc ''
+          Specification (in the format described by systemd.time(7)) of the time
+          at which the Clublog upload will occur.
+        '';
+      };
+    };
+    update-lotw-users = {
+      enable = mkOption {
+        type = bool;
+        default = true;
+        description = mdDoc ''
+          Whether to periodically update the list of LoTW users. If enabled, a
+          systemd timer will run the update task as specified by the interval
+          option.
+        '';
+      };
+      interval = mkOption {
+        type = str;
+        default = "weekly";
+        description = mdDoc ''
+          Specification (in the format described by systemd.time(7)) of the
+          time at which the LoTW user update will occur.
+        '';
+      };
+    };
+    update-dok = {
+      enable = mkOption {
+        type = bool;
+        default = true;
+        description = mdDoc ''
+          Whether to periodically update the DOK resource file. If enabled, a
+          systemd timer will run the update task as specified by the interval option.
+        '';
+      };
+      interval = mkOption {
+        type = str;
+        default = "monthly";
+        description = mdDoc ''
+          Specification (in the format described by systemd.time(7)) of the
+          time at which the DOK update will occur.
+        '';
+      };
+    };
+    update-clublog-scp = {
+      enable = mkOption {
+        type = bool;
+        default = true;
+        description = mdDoc ''
+          Whether to periodically update the Clublog SCP database. If enabled,
+          a systemd timer will run the update task as specified by the interval
+          option.
+        '';
+      };
+      interval = mkOption {
+        type = str;
+        default = "monthly";
+        description = mdDoc ''
+          Specification (in the format described by systemd.time(7)) of the time
+          at which the Clublog SCP update will occur.
+        '';
+      };
+    };
+    update-wwff = {
+      enable = mkOption {
+        type = bool;
+        default = true;
+        description = mdDoc ''
+          Whether to periodically update the WWFF database. If enabled, a
+          systemd timer will run the update task as specified by the interval
+          option.
+        '';
+      };
+      interval = mkOption {
+        type = str;
+        default = "monthly";
+        description = mdDoc ''
+          Specification (in the format described by systemd.time(7)) of the time
+          at which the WWFF update will occur.
+        '';
+      };
+    };
+    upload-qrz = {
+      enable = mkOption {
+        type = bool;
+        default = true;
+        description = mdDoc ''
+          Whether to periodically upload logs to QRZ. If enabled, a systemd
+          timer will run the update task as specified by the interval option.
+        '';
+      };
+      interval = mkOption {
+        type = str;
+        default = "daily";
+        description = mdDoc ''
+          Specification (in the format described by systemd.time(7)) of the
+          time at which the QRZ upload will occur.
+        '';
+      };
+    };
+    update-sota = {
+      enable = mkOption {
+        type = bool;
+        default = true;
+        description = mdDoc ''
+          Whether to periodically update the SOTA database. If enabled, a
+          systemd timer will run the update task as specified by the interval option.
+        '';
+      };
+      interval = mkOption {
+        type = str;
+        default = "monthly";
+        description = mdDoc ''
+          Specification (in the format described by systemd.time(7)) of the time
+          at which the SOTA update will occur.
+        '';
+      };
+    };
+  };
+  config = mkIf cfg.enable {
+
+    assertions = [
+      {
+        assertion = cfg.database.createLocally -> cfg.database.passwordFile == null;
+        message = "services.cloudlog.database.passwordFile cannot be specified if services.cloudlog.database.createLocally is set to true.";
+      }
+    ];
+
+    services.phpfpm = {
+      pools.cloudlog = {
+        inherit (cfg) user;
+        group = config.services.nginx.group;
+        settings =  {
+          "listen.owner" = config.services.nginx.user;
+          "listen.group" = config.services.nginx.group;
+        } // cfg.poolConfig;
+      };
+    };
+
+    services.nginx = mkIf (cfg.virtualHost != null) {
+      enable = true;
+      virtualHosts = {
+        "${cfg.virtualHost}" = {
+          root = "${package}";
+          locations."/".tryFiles = "$uri /index.php$is_args$args";
+          locations."~ ^/index.php(/|$)".extraConfig = ''
+              include ${config.services.nginx.package}/conf/fastcgi_params;
+              include ${pkgs.nginx}/conf/fastcgi.conf;
+              fastcgi_split_path_info ^(.+\.php)(.+)$;
+              fastcgi_pass unix:${config.services.phpfpm.pools.cloudlog.socket};
+              fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+            '';
+        };
+      };
+    };
+
+    services.mysql = mkIf cfg.database.createLocally {
+      enable = true;
+      ensureDatabases = [ cfg.database.name ];
+      ensureUsers = [{
+        name = cfg.database.user;
+        ensurePermissions = {
+          "${cfg.database.name}.*" = "ALL PRIVILEGES";
+        };
+      }];
+    };
+
+    systemd = {
+      services = {
+        cloudlog-setup-database = mkIf cfg.database.createLocally {
+          description = "Set up cloudlog database";
+          serviceConfig = {
+            Type = "oneshot";
+            RemainAfterExit = true;
+          };
+          wantedBy = [ "phpfpm-cloudlog.service" ];
+          after = [ "mysql.service" ];
+          script = let
+            mysql = "${config.services.mysql.package}/bin/mysql";
+          in ''
+            if [ ! -f ${cfg.dataDir}/.dbexists ]; then
+              ${mysql} ${cfg.database.name} < ${pkgs.cloudlog}/install/assets/install.sql
+              touch ${cfg.dataDir}/.dbexists
+            fi
+        '';
+        };
+        cloudlog-upload-lotw = {
+          description = "Upload QSOs to LoTW if certs have been provided";
+          enable = cfg.upload-lotw.enable;
+          script = "${pkgs.curl}/bin/curl -s ${cfg.baseUrl}/lotw/lotw_upload";
+        };
+        cloudlog-update-lotw-users = {
+          description = "Update LOTW Users Database";
+          enable = cfg.update-lotw-users.enable;
+          script = "${pkgs.curl}/bin/curl -s ${cfg.baseUrl}/lotw/load_users";
+        };
+        cloudlog-update-dok = {
+          description = "Update DOK File for autocomplete";
+          enable = cfg.update-dok.enable;
+          script = "${pkgs.curl}/bin/curl -s ${cfg.baseUrl}/update/update_dok";
+        };
+        cloudlog-update-clublog-scp = {
+          description = "Update Clublog SCP Database File";
+          enable = cfg.update-clublog-scp.enable;
+          script = "${pkgs.curl}/bin/curl -s ${cfg.baseUrl}/update/update_clublog_scp";
+        };
+        cloudlog-update-wwff = {
+          description = "Update WWFF File for autocomplete";
+          enable = cfg.update-wwff.enable;
+          script = "${pkgs.curl}/bin/curl -s ${cfg.baseUrl}/update/update_wwff";
+        };
+        cloudlog-upload-qrz = {
+          description = "Upload QSOs to QRZ Logbook";
+          enable = cfg.upload-qrz.enable;
+          script = "${pkgs.curl}/bin/curl -s ${cfg.baseUrl}/qrz/upload";
+        };
+        cloudlog-update-sota = {
+          description = "Update SOTA File for autocomplete";
+          enable = cfg.update-sota.enable;
+          script = "${pkgs.curl}/bin/curl -s ${cfg.baseUrl}/update/update_sota";
+        };
+      };
+      timers = {
+        cloudlog-upload-lotw = {
+          enable = cfg.upload-lotw.enable;
+          wantedBy = [ "timers.target" ];
+          partOf = [ "cloudlog-upload-lotw.service" ];
+          after = [ "phpfpm-cloudlog.service" ];
+          timerConfig = {
+            OnCalendar = cfg.upload-lotw.interval;
+            Persistent = true;
+          };
+        };
+        cloudlog-upload-clublog = {
+          enable = cfg.upload-clublog.enable;
+          wantedBy = [ "timers.target" ];
+          partOf = [ "cloudlog-upload-clublog.service" ];
+          after = [ "phpfpm-cloudlog.service" ];
+          timerConfig = {
+            OnCalendar = cfg.upload-clublog.interval;
+            Persistent = true;
+          };
+        };
+        cloudlog-update-lotw-users = {
+          enable = cfg.update-lotw-users.enable;
+          wantedBy = [ "timers.target" ];
+          partOf = [ "cloudlog-update-lotw-users.service" ];
+          after = [ "phpfpm-cloudlog.service" ];
+          timerConfig = {
+            OnCalendar = cfg.update-lotw-users.interval;
+            Persistent = true;
+          };
+        };
+        cloudlog-update-dok = {
+          enable = cfg.update-dok.enable;
+          wantedBy = [ "timers.target" ];
+          partOf = [ "cloudlog-update-dok.service" ];
+          after = [ "phpfpm-cloudlog.service" ];
+          timerConfig = {
+            OnCalendar = cfg.update-dok.interval;
+            Persistent = true;
+          };
+        };
+        cloudlog-update-clublog-scp = {
+          enable = cfg.update-clublog-scp.enable;
+          wantedBy = [ "timers.target" ];
+          partOf = [ "cloudlog-update-clublog-scp.service" ];
+          after = [ "phpfpm-cloudlog.service" ];
+          timerConfig = {
+            OnCalendar = cfg.update-clublog-scp.interval;
+            Persistent = true;
+          };
+        };
+        cloudlog-update-wwff =  {
+          enable = cfg.update-wwff.enable;
+          wantedBy = [ "timers.target" ];
+          partOf = [ "cloudlog-update-wwff.service" ];
+          after = [ "phpfpm-cloudlog.service" ];
+          timerConfig = {
+            OnCalendar = cfg.update-wwff.interval;
+            Persistent = true;
+          };
+        };
+        cloudlog-upload-qrz = {
+          enable = cfg.upload-qrz.enable;
+          wantedBy = [ "timers.target" ];
+          partOf = [ "cloudlog-upload-qrz.service" ];
+          after = [ "phpfpm-cloudlog.service" ];
+          timerConfig = {
+            OnCalendar = cfg.upload-qrz.interval;
+            Persistent = true;
+          };
+        };
+        cloudlog-update-sota = {
+          enable = cfg.update-sota.enable;
+          wantedBy = [ "timers.target" ];
+          partOf = [ "cloudlog-update-sota.service" ];
+          after = [ "phpfpm-cloudlog.service" ];
+          timerConfig = {
+            OnCalendar = cfg.update-sota.interval;
+            Persistent = true;
+          };
+        };
+      };
+      tmpfiles.rules = let
+        group = config.services.nginx.group;
+      in [
+        "d ${cfg.dataDir}                0750 ${cfg.user} ${group} - -"
+        "d ${cfg.dataDir}/updates        0750 ${cfg.user} ${group} - -"
+        "d ${cfg.dataDir}/uploads        0750 ${cfg.user} ${group} - -"
+        "d ${cfg.dataDir}/backup         0750 ${cfg.user} ${group} - -"
+        "d ${cfg.dataDir}/logbook        0750 ${cfg.user} ${group} - -"
+        "d ${cfg.dataDir}/assets/json    0750 ${cfg.user} ${group} - -"
+        "d ${cfg.dataDir}/assets/qslcard 0750 ${cfg.user} ${group} - -"
+      ];
+    };
+
+    users.users."${cfg.user}" = {
+      isSystemUser = true;
+      group = config.services.nginx.group;
+    };
+  };
+
+  meta.maintainers = with maintainers; [ melling ];
+}
diff --git a/nixos/modules/system/boot/systemd/initrd.nix b/nixos/modules/system/boot/systemd/initrd.nix
index d30f61146e18..620d76aef20d 100644
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@@ -343,9 +343,11 @@ in {
     system.build = { inherit initialRamdisk; };
 
     boot.initrd.availableKernelModules = [
-      "autofs4"           # systemd needs this for some features
-      "tpm-tis" "tpm-crb" # systemd-cryptenroll
-    ];
+      # systemd needs this for some features
+      "autofs4"
+      # systemd-cryptenroll
+      "tpm-tis"
+    ] ++ lib.optional (pkgs.stdenv.hostPlatform.system != "riscv64-linux") "tpm-crb";
 
     boot.initrd.systemd = {
       initrdBin = [pkgs.bash pkgs.coreutils cfg.package.kmod cfg.package] ++ config.system.fsPackages;
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 9bf85cd0b97d..b839d539c9f5 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -131,6 +131,7 @@ in {
   clickhouse = handleTest ./clickhouse.nix {};
   cloud-init = handleTest ./cloud-init.nix {};
   cloud-init-hostname = handleTest ./cloud-init-hostname.nix {};
+  cloudlog = handleTest ./cloudlog.nix {};
   cntr = handleTestOn ["aarch64-linux" "x86_64-linux"] ./cntr.nix {};
   cockroachdb = handleTestOn ["x86_64-linux"] ./cockroachdb.nix {};
   collectd = handleTest ./collectd.nix {};
diff --git a/nixos/tests/cloudlog.nix b/nixos/tests/cloudlog.nix
new file mode 100644
index 000000000000..c99951c1b22c
--- /dev/null
+++ b/nixos/tests/cloudlog.nix
@@ -0,0 +1,18 @@
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "cloudlog";
+  meta = {
+    maintainers = with pkgs.lib.maintainers; [ melling ];
+  };
+  nodes = {
+    machine = {
+      services.mysql.package = pkgs.mariadb;
+      services.cloudlog.enable = true;
+    };
+  };
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("phpfpm-cloudlog")
+    machine.wait_for_open_port(80);
+    machine.wait_until_succeeds("curl -s -L --fail http://localhost | grep 'Login - Cloudlog'")
+  '';
+})
diff --git a/pkgs/applications/blockchains/polkadot/default.nix b/pkgs/applications/blockchains/polkadot/default.nix
index 1f5636dd41c3..883514b7da5b 100644
--- a/pkgs/applications/blockchains/polkadot/default.nix
+++ b/pkgs/applications/blockchains/polkadot/default.nix
@@ -3,20 +3,22 @@
 , lib
 , llvmPackages
 , protobuf
+, rocksdb
 , rustPlatform
 , stdenv
 , writeShellScriptBin
 , Security
+, SystemConfiguration
 }:
 rustPlatform.buildRustPackage rec {
   pname = "polkadot";
-  version = "0.9.36";
+  version = "0.9.37";
 
   src = fetchFromGitHub {
     owner = "paritytech";
     repo = "polkadot";
     rev = "v${version}";
-    sha256 = "sha256-HzQFlnn+SPasI0g0DYDCRoFCMVyxlUmEQAobvzRnAW4=";
+    hash = "sha256-/mgJNjliPUmMkhT/1oiX9+BJHfY3SMsKfFv9HCyWRQQ=";
 
     # the build process of polkadot requires a .git folder in order to determine
     # the git commit hash that is being built and add it to the version string.
@@ -32,9 +34,9 @@ rustPlatform.buildRustPackage rec {
     '';
   };
 
-  cargoSha256 = "sha256-P31GW/1HiaZLF6e8Fq1YnH1ZLhiOhURm8st9a4KRlJU=";
+  cargoHash = "sha256-o+APFYKgA3zjQSGrkpnyf5LEBBqvZtcfWlzCk6nL02A=";
 
-  buildInputs = lib.optionals stdenv.isDarwin [ Security ];
+  buildInputs = lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];
 
   nativeBuildInputs = [ rustPlatform.bindgenHook ];
 
@@ -44,6 +46,7 @@ rustPlatform.buildRustPackage rec {
   '';
 
   PROTOC = "${protobuf}/bin/protoc";
+  ROCKSDB_LIB_DIR = "${rocksdb}/lib";
 
   # NOTE: We don't build the WASM runtimes since this would require a more
   # complicated rust environment setup and this is only needed for developer
diff --git a/pkgs/applications/editors/android-studio/default.nix b/pkgs/applications/editors/android-studio/default.nix
index 70d146db3218..494a02f3041f 100644
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -10,16 +10,16 @@ let
     inherit tiling_wm;
   };
   stableVersion = {
-    version = "2021.3.1.17"; # "Android Studio Dolphin (2021.3.1)"
-    sha256Hash = "sha256-ia2wzg/6RreJTnv+2xQrH11SxDwXHmpsualaSfd3Vso=";
+    version = "2022.1.1.19"; # "Android Studio Electric Eel (2022.1.1)"
+    sha256Hash = "luxE6a2C86JB28ezuIZV49TyE314S1RcNXQnCQamjUA=";
   };
   betaVersion = {
-    version = "2022.1.1.12"; # "Android Studio Electric Eel (2022.1.1) Beta 2"
-    sha256Hash = "8iSFPH0PTQkzV1t8bEq7CBtOU8pzdnD/PrpVcgPnO6Q=";
+    version = "2022.2.1.12"; # "Android Studio Flamingo (2022.2.1) Beta 1"
+    sha256Hash = "tIgmX9KiRInIupgIXWgg4dMf8bTwkVopOxAO5O1PUAc=";
   };
   latestVersion = { # canary & dev
-    version = "2022.2.1.2"; # "Android Studio Flamingo (2022.2.1) Canary 2"
-    sha256Hash = "hlHlgyl9If2LH4aExpElx0rqmWeoFX+qx4w6RRb5e8U=";
+    version = "2022.3.1.1"; # "Android Studio Girrafe (2022.3.1) Canary 1"
+    sha256Hash = "I7Zc4DDByUB6XOnk7v+91ccpNI7eX/T4d3vH60ih8ec=";
   };
 in {
   # Attributes are named by their corresponding release channels
diff --git a/pkgs/applications/editors/nano/default.nix b/pkgs/applications/editors/nano/default.nix
index 69c7f3eb7af3..bd8049699514 100644
--- a/pkgs/applications/editors/nano/default.nix
+++ b/pkgs/applications/editors/nano/default.nix
@@ -14,11 +14,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "nano";
-  version = "7.1";
+  version = "7.2";
 
   src = fetchurl {
     url = "mirror://gnu/nano/${pname}-${version}.tar.xz";
-    sha256 = "V7p1Hpt1GfD23e5QUgLjh8dd3kQMH3qhuTEMw4FAaDY=";
+    sha256 = "hvNEJ2i9KHPOxpP4PN+AtLRErTzBR2C3Q2FHT8h6RSY=";
   };
 
   nativeBuildInputs = [ texinfo ] ++ lib.optional enableNls gettext;
diff --git a/pkgs/applications/editors/standardnotes/src.json b/pkgs/applications/editors/standardnotes/src.json
index d8fa27e34a08..0697497d43db 100644
--- a/pkgs/applications/editors/standardnotes/src.json
+++ b/pkgs/applications/editors/standardnotes/src.json
@@ -1,17 +1,13 @@
 {
-  "version": "3.129.0",
+  "version": "3.139.0",
   "appimage": {
     "x86_64-linux": {
-      "url": "https://github.com/standardnotes/app/releases/download/%40standardnotes/desktop%403.129.0/standard-notes-3.129.0-linux-x86_64.AppImage",
-      "hash": "sha512-JLO2jX9Us6BjqmTZIkVyxy2pqFM/eFGpwi6vXicMOgDB0UsgEMTK+Ww+9g+vJ1KbFRFmlt187qkdSNcevQPt7w=="
+      "url": "https://github.com/standardnotes/app/releases/download/%40standardnotes/desktop%403.139.0/standard-notes-3.139.0-linux-x86_64.AppImage",
+      "hash": "sha512-0s/tQmP5PINoQB7FOhR5wYuBvynKHpM9uMNmkJs77z84rY+WXOdZRjki6ZeG60niNXr8rUSLOBffy4jyLka6tg=="
     },
     "aarch64-linux": {
-      "url": "https://github.com/standardnotes/app/releases/download/%40standardnotes/desktop%403.129.0/standard-notes-3.129.0-linux-arm64.AppImage",
-      "hash": "sha512-LGUSRqMrJ+hVHyi/bjI/NkWRVsmY0Kh/wRY9RNJXm0C3dKQSFV8ca4GeY9+VCuJEecR4LGnWp4agS5jPybPP6w=="
-    },
-    "i686-linux": {
-      "url": "https://github.com/standardnotes/app/releases/download/%40standardnotes/desktop%403.129.0/standard-notes-3.129.0-linux-i386.AppImage",
-      "hash": "sha512-XbQ4hn3QJ61hDC12cK95zsUowbyXPYArHZoRDx5trQ30phtQxtz6nV+pL00m4S9kYeEhsAwk1wXlRq9Ylbz2IA=="
+      "url": "https://github.com/standardnotes/app/releases/download/%40standardnotes/desktop%403.139.0/standard-notes-3.139.0-linux-arm64.AppImage",
+      "hash": "sha512-LralbOiIVQCtQTqmhTtKttdtMz4M14drPFZ00LPFcwzQviLdU2C/od3NUxf5H5piGgqt5TJlgMCOcLIiyoNKFA=="
     }
   }
 }
diff --git a/pkgs/applications/editors/standardnotes/update.nix b/pkgs/applications/editors/standardnotes/update.nix
index 5b8794e9a44e..7b5f6616602b 100644
--- a/pkgs/applications/editors/standardnotes/update.nix
+++ b/pkgs/applications/editors/standardnotes/update.nix
@@ -50,6 +50,5 @@ writeScript "update-standardnotes" ''
 
   updatePlatform x86_64-linux linux-x86_64
   updatePlatform aarch64-linux linux-arm64
-  updatePlatform i686-linux linux-i386
   setJsonKey .version "$newVersion"
 ''
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index dc3131a4b135..61988c9741be 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -756,8 +756,13 @@ let
           version = "2.2.6";
           sha256 = "sha256-1yZeyLrXuubhKzobWcd00F/CdU824uJDTkB6qlHkJlQ=";
         };
-        meta = {
-          license = lib.licenses.mit;
+        meta = with lib; {
+          changelog = "https://marketplace.visualstudio.com/items/dbaeumer.vscode-eslint/changelog";
+          description = "Integrates ESLint JavaScript into VS Code.";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=dbaeumer.vscode-eslint";
+          homepage = "https://github.com/Microsoft/vscode-eslint";
+          license = licenses.mit;
+          maintainers = with maintainers; [ datafoo ];
         };
       };
 
diff --git a/pkgs/applications/emulators/zsnes/2.x.nix b/pkgs/applications/emulators/zsnes/2.x.nix
new file mode 100644
index 000000000000..fdb4ad9fa139
--- /dev/null
+++ b/pkgs/applications/emulators/zsnes/2.x.nix
@@ -0,0 +1,63 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, SDL
+, libGL
+, libGLU
+, libpng
+, nasm
+, pkg-config
+, zlib
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "zsnes2";
+  version = "2.0.10";
+
+  src = fetchFromGitHub {
+    owner = "xyproto";
+    repo = "zsnes";
+    rev = finalAttrs.version;
+    hash = "sha256-QFPl3I2nFWMmgQRGxrlt4Vh5N4SygvBLjeFiQpgRr8o=";
+  };
+
+  nativeBuildInputs = [
+    nasm
+    pkg-config
+  ];
+
+  buildInputs = [
+    SDL
+    libGL
+    libGLU
+    libpng
+    zlib
+  ];
+
+  dontConfigure = true;
+
+  NIX_CFLAGS_COMPILE = [
+    # Until upstream fixes the issues...
+    "-Wp,-D_FORTIFY_SOURCE=0"
+  ];
+
+  installFlags = [
+    "PREFIX=${placeholder "out"}"
+  ];
+
+  postInstall = ''
+    install -Dm644 linux/zsnes.desktop $out/share/applications/zsnes.desktop
+    install -Dm644 icons/16x16x32.png $out/share/icons/hicolor/16x16/apps/zsnes.png
+    install -Dm644 icons/32x32x32.png $out/share/icons/hicolor/32x32/apps/zsnes.png
+    install -Dm644 icons/48x48x32.png $out/share/icons/hicolor/48x48/apps/zsnes.png
+    install -Dm644 icons/64x64x32.png $out/share/icons/hicolor/64x64/apps/zsnes.png
+  '';
+
+  meta = {
+    homepage = "https://github.com/xyproto/zsnes";
+    description = "A maintained fork of zsnes";
+    license = lib.licenses.gpl2Plus;
+    maintainers = [ lib.maintainers.AndersonTorres ];
+    platforms = lib.intersectLists lib.platforms.linux lib.platforms.x86;
+  };
+})
diff --git a/pkgs/applications/file-managers/doublecmd/default.nix b/pkgs/applications/file-managers/doublecmd/default.nix
index dc5f334de5b6..ca2839709ba3 100644
--- a/pkgs/applications/file-managers/doublecmd/default.nix
+++ b/pkgs/applications/file-managers/doublecmd/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "doublecmd";
-  version = "1.0.9";
+  version = "1.0.10";
 
   src = fetchFromGitHub {
     owner = "doublecmd";
     repo = "doublecmd";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ruZNHvHBRXRM4h0R571jvasW8rYawq4cn7Hnd9riMnk=";
+    hash = "sha256-S30/exZsw9Rs/l5Sml/q7dqUIcS55ZxbLFYv+M9Jr6o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/graphics/potreeconverter/default.nix b/pkgs/applications/graphics/potreeconverter/default.nix
new file mode 100644
index 000000000000..07fae1140812
--- /dev/null
+++ b/pkgs/applications/graphics/potreeconverter/default.nix
@@ -0,0 +1,58 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, boost
+, tbb
+, makeWrapper
+}:
+
+stdenv.mkDerivation rec {
+  pname = "PotreeConverter";
+  version = "unstable-2022-08-04";
+
+  src = fetchFromGitHub {
+    owner = "potree";
+    repo = "PotreeConverter";
+    rev = "758bbac98a662de5e57d2280675e11cc76241688";
+    sha256 = "sha256-pDdV2/edYhhBWs153hSy1evI3cXD0Xq9nrEsw3JNcH4=";
+  };
+
+  buildInputs = [
+    boost
+    tbb
+  ];
+
+  nativeBuildInputs = [
+    makeWrapper
+    cmake
+  ];
+
+  patchPhase = ''
+    substituteInPlace ./CMakeLists.txt \
+      --replace "find_package(TBB REQUIRED)" ""
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/{bin,lib}
+    mv liblaszip.so $out/lib
+    mv PotreeConverter $out/bin
+    ln -s $out/bin/PotreeConverter $out/bin/potreeconverter
+
+    # Create an empty wrapper, since PotreeConverter segfaults if called via
+    # $PATH rather than absolute path. An empty wrapper forces an absolute path
+    # on each invocation
+    wrapProgram $out/bin/PotreeConverter
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Create multi res point cloud to use with potree";
+    homepage = "https://github.com/potree/PotreeConverter";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ matthewcroughan ];
+    platforms = with platforms; linux;
+  };
+}
diff --git a/pkgs/applications/misc/blender/default.nix b/pkgs/applications/misc/blender/default.nix
index 9724ad953673..429097842630 100644
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@@ -16,7 +16,6 @@
 , embree, gmp, libharu
 }:
 
-with lib;
 let
   python = python310Packages.python;
   optix = fetchzip {
@@ -38,7 +37,7 @@ stdenv.mkDerivation rec {
   patches = lib.optional stdenv.isDarwin ./darwin.patch;
 
   nativeBuildInputs = [ cmake makeWrapper python310Packages.wrapPython llvmPackages.llvm.dev ]
-    ++ optionals cudaSupport [ addOpenGLRunpath ];
+    ++ lib.optionals cudaSupport [ addOpenGLRunpath ];
   buildInputs =
     [ boost ffmpeg gettext glew ilmbase
       freetype libjpeg libpng libsamplerate libsndfile libtiff libwebp
@@ -63,10 +62,10 @@ stdenv.mkDerivation rec {
     else [
       llvmPackages.openmp SDL Cocoa CoreGraphics ForceFeedback OpenAL OpenGL
     ])
-    ++ optional jackaudioSupport libjack2
-    ++ optional cudaSupport cudaPackages.cudatoolkit
-    ++ optional colladaSupport opencollada
-    ++ optional spaceNavSupport libspnav;
+    ++ lib.optional jackaudioSupport libjack2
+    ++ lib.optional cudaSupport cudaPackages.cudatoolkit
+    ++ lib.optional colladaSupport opencollada
+    ++ lib.optional spaceNavSupport libspnav;
   pythonPath = with python310Packages; [ numpy requests ];
 
   postPatch = ''
@@ -118,16 +117,16 @@ stdenv.mkDerivation rec {
       "-DWITH_IMAGE_OPENJPEG=ON"
       "-DWITH_OPENCOLLADA=${if colladaSupport then "ON" else "OFF"}"
     ]
-    ++ optionals stdenv.isDarwin [
+    ++ lib.optionals stdenv.isDarwin [
       "-DWITH_CYCLES_OSL=OFF" # requires LLVM
       "-DWITH_OPENVDB=OFF" # OpenVDB currently doesn't build on darwin
 
       "-DLIBDIR=/does-not-exist"
     ]
     # Clang doesn't support "-export-dynamic"
-    ++ optional stdenv.cc.isClang "-DPYTHON_LINKFLAGS="
-    ++ optional jackaudioSupport "-DWITH_JACK=ON"
-    ++ optionals cudaSupport [
+    ++ lib.optional stdenv.cc.isClang "-DPYTHON_LINKFLAGS="
+    ++ lib.optional jackaudioSupport "-DWITH_JACK=ON"
+    ++ lib.optionals cudaSupport [
       "-DWITH_CYCLES_CUDA_BINARIES=ON"
       "-DWITH_CYCLES_DEVICE_OPTIX=ON"
       "-DOPTIX_ROOT_DIR=${optix}"
@@ -137,7 +136,7 @@ stdenv.mkDerivation rec {
 
   # Since some dependencies are built with gcc 6, we need gcc 6's
   # libstdc++ in our RPATH. Sigh.
-  NIX_LDFLAGS = optionalString cudaSupport "-rpath ${stdenv.cc.cc.lib}/lib";
+  NIX_LDFLAGS = lib.optionalString cudaSupport "-rpath ${stdenv.cc.cc.lib}/lib";
 
   blenderExecutable =
     placeholder "out" + (if stdenv.isDarwin then "/Applications/Blender.app/Contents/MacOS/Blender" else "/bin/blender");
@@ -154,7 +153,7 @@ stdenv.mkDerivation rec {
 
   # Set RUNPATH so that libcuda and libnvrtc in /run/opengl-driver(-32)/lib can be
   # found. See the explanation in libglvnd.
-  postFixup = optionalString cudaSupport ''
+  postFixup = lib.optionalString cudaSupport ''
     for program in $out/bin/blender $out/bin/.blender-wrapped; do
       isELF "$program" || continue
       addOpenGLRunpath "$program"
diff --git a/pkgs/applications/misc/electrum/update.nix b/pkgs/applications/misc/electrum/update.nix
index 247fabe3891f..7a0fb8fd3eb6 100644
--- a/pkgs/applications/misc/electrum/update.nix
+++ b/pkgs/applications/misc/electrum/update.nix
@@ -10,8 +10,6 @@
 , nix
 }:
 
-with lib;
-
 let
   downloadPageUrl = "https://download.electrum.org";
 
@@ -23,7 +21,7 @@ writeScript "update-electrum" ''
 
 set -eu -o pipefail
 
-export PATH=${makeBinPath [
+export PATH=${lib.makeBinPath [
   common-updater-scripts
   coreutils
   curl
@@ -50,7 +48,7 @@ sigFile=$srcFile.asc
 export GNUPGHOME=$PWD/gnupg
 mkdir -m 700 -p "$GNUPGHOME"
 
-gpg --batch --recv-keys ${concatStringsSep " " (map (x: "'${x}'") signingKeys)}
+gpg --batch --recv-keys ${lib.concatStringsSep " " (map (x: "'${x}'") signingKeys)}
 gpg --batch --verify "$sigFile" "$srcFile"
 
 sha256=$(nix-prefetch-url --type sha256 "file://$PWD/$srcFile")
diff --git a/pkgs/applications/misc/elogind/default.nix b/pkgs/applications/misc/elogind/default.nix
index 7ff20b16d79a..56f8be698f32 100644
--- a/pkgs/applications/misc/elogind/default.nix
+++ b/pkgs/applications/misc/elogind/default.nix
@@ -25,8 +25,6 @@
 , enableSystemd ? false
 }:
 
-with lib;
-
 stdenv.mkDerivation rec {
   pname = "elogind";
   version = "246.10";
@@ -72,7 +70,7 @@ stdenv.mkDerivation rec {
     "-Dsysconfdir=${placeholder "out"}/etc"
   ];
 
-  meta = {
+  meta = with lib; {
     homepage = "https://github.com/elogind/elogind";
     description = ''The systemd project's "logind", extracted to a standalone package'';
     platforms = platforms.linux; # probably more
diff --git a/pkgs/applications/misc/gammu/default.nix b/pkgs/applications/misc/gammu/default.nix
index 8a33ba3ea3ac..78d5e010213c 100644
--- a/pkgs/applications/misc/gammu/default.nix
+++ b/pkgs/applications/misc/gammu/default.nix
@@ -4,8 +4,6 @@
 , postgresSupport ? false, postgresql ? null
 }:
 
-with lib;
-
 stdenv.mkDerivation rec {
   pname = "gammu";
   version = "1.42.0";
@@ -31,10 +29,10 @@ stdenv.mkDerivation rec {
   strictDeps = true;
 
   buildInputs = [ bash bluez libusb1 curl gettext sqlite libiconv ]
-  ++ optionals dbiSupport [ libdbi libdbiDrivers ]
-  ++ optionals postgresSupport [ postgresql ];
+  ++ lib.optionals dbiSupport [ libdbi libdbiDrivers ]
+  ++ lib.optionals postgresSupport [ postgresql ];
 
-  meta = {
+  meta = with lib; {
     homepage = "https://wammu.eu/gammu/";
     description = "Command line utility and library to control mobile phones";
     license = licenses.gpl2;
diff --git a/pkgs/applications/misc/get_iplayer/default.nix b/pkgs/applications/misc/get_iplayer/default.nix
index f2692243db6b..2f244e20e155 100644
--- a/pkgs/applications/misc/get_iplayer/default.nix
+++ b/pkgs/applications/misc/get_iplayer/default.nix
@@ -1,7 +1,5 @@
 { lib, fetchFromGitHub, atomicparsley, flvstreamer, ffmpeg, makeWrapper, perl, perlPackages, rtmpdump}:
 
-with lib;
-
 perlPackages.buildPerlPackage rec {
   pname = "get_iplayer";
   version = "3.27";
@@ -26,11 +24,11 @@ perlPackages.buildPerlPackage rec {
   installPhase = ''
     mkdir -p $out/bin $out/share/man/man1
     cp get_iplayer $out/bin
-    wrapProgram $out/bin/get_iplayer --suffix PATH : ${makeBinPath [ atomicparsley ffmpeg flvstreamer rtmpdump ]} --prefix PERL5LIB : $PERL5LIB
+    wrapProgram $out/bin/get_iplayer --suffix PATH : ${lib.makeBinPath [ atomicparsley ffmpeg flvstreamer rtmpdump ]} --prefix PERL5LIB : $PERL5LIB
     cp get_iplayer.1 $out/share/man/man1
   '';
 
-  meta = {
+  meta = with lib; {
     description = "Downloads TV and radio from BBC iPlayer";
     license = licenses.gpl3Plus;
     homepage = "https://squarepenguin.co.uk/";
diff --git a/pkgs/applications/misc/k2pdfopt/default.nix b/pkgs/applications/misc/k2pdfopt/default.nix
index b001b50c4012..0bb01c38712f 100644
--- a/pkgs/applications/misc/k2pdfopt/default.nix
+++ b/pkgs/applications/misc/k2pdfopt/default.nix
@@ -8,8 +8,6 @@
 , enableTesseract ? true, leptonica, tesseract4
 }:
 
-with lib;
-
 # k2pdfopt is a pain to package. It requires modified versions of mupdf,
 # leptonica, and tesseract.  Instead of shipping patches for these upstream
 # packages, k2pdfopt includes just the modified source files for these
@@ -140,12 +138,12 @@ in stdenv.mkDerivation rec {
     };
   in
     [ zlib libpng ] ++
-    optional enableGSL gsl ++
-    optional enableGhostScript ghostscript ++
-    optional enableMuPDF mupdf_modded ++
-    optional enableDJVU djvulibre ++
-    optional enableGOCR gocr ++
-    optionals enableTesseract [ leptonica_modded tesseract_modded ];
+    lib.optional enableGSL gsl ++
+    lib.optional enableGhostScript ghostscript ++
+    lib.optional enableMuPDF mupdf_modded ++
+    lib.optional enableDJVU djvulibre ++
+    lib.optional enableGOCR gocr ++
+    lib.optionals enableTesseract [ leptonica_modded tesseract_modded ];
 
   dontUseCmakeBuildDir = true;
 
@@ -157,7 +155,7 @@ in stdenv.mkDerivation rec {
     install -D -m 755 k2pdfopt $out/bin/k2pdfopt
   '';
 
-  preFixup = optionalString enableTesseract ''
+  preFixup = lib.optionalString enableTesseract ''
     wrapProgram $out/bin/k2pdfopt --set-default TESSDATA_PREFIX ${tesseract4}/share/tessdata
   '';
 
diff --git a/pkgs/applications/misc/kanboard/default.nix b/pkgs/applications/misc/kanboard/default.nix
index be28d1185d24..69092b3acd5b 100644
--- a/pkgs/applications/misc/kanboard/default.nix
+++ b/pkgs/applications/misc/kanboard/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "kanboard";
-  version = "1.2.25";
+  version = "1.2.26";
 
   src = fetchFromGitHub {
     owner = "kanboard";
     repo = "kanboard";
     rev = "v${version}";
-    sha256 = "sha256-yBUvePVbNDLYL1d6cNrLBn6+/p1agVzSx29JB3EZ5Fk=";
+    sha256 = "sha256-/Unxl9Vh9pEWjO89sSviGGPFzUwxdb1mbOfpTFTyRL0=";
   };
 
   dontBuild = true;
diff --git a/pkgs/applications/misc/keepassx/community.nix b/pkgs/applications/misc/keepassx/community.nix
index 2cdaf78c0281..bf386c116d48 100644
--- a/pkgs/applications/misc/keepassx/community.nix
+++ b/pkgs/applications/misc/keepassx/community.nix
@@ -37,8 +37,6 @@
 , nixosTests
 }:
 
-with lib;
-
 stdenv.mkDerivation rec {
   pname = "keepassxc";
   version = "2.7.4";
@@ -50,13 +48,13 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-amedKK9nplLVJTldeabN3/c+g/QesrdH+qx+rba2/4s=";
   };
 
-  NIX_CFLAGS_COMPILE = optionalString stdenv.cc.isClang [
+  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang [
     "-Wno-old-style-cast"
     "-Wno-error"
     "-D__BIG_ENDIAN__=${if stdenv.isBigEndian then "1" else "0"}"
   ];
 
-  NIX_LDFLAGS = optionalString stdenv.isDarwin "-rpath ${libargon2}/lib";
+  NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-rpath ${libargon2}/lib";
 
   patches = [
     ./darwin.patch
@@ -67,13 +65,13 @@ stdenv.mkDerivation rec {
     "-DWITH_GUI_TESTS=ON"
     "-DWITH_XC_UPDATECHECK=OFF"
   ]
-  ++ (optional (!withKeePassX11) "-DWITH_XC_X11=OFF")
-  ++ (optional (withKeePassFDOSecrets && stdenv.isLinux) "-DWITH_XC_FDOSECRETS=ON")
-  ++ (optional (withKeePassYubiKey && stdenv.isLinux) "-DWITH_XC_YUBIKEY=ON")
-  ++ (optional withKeePassBrowser "-DWITH_XC_BROWSER=ON")
-  ++ (optional withKeePassKeeShare "-DWITH_XC_KEESHARE=ON")
-  ++ (optional withKeePassNetworking "-DWITH_XC_NETWORKING=ON")
-  ++ (optional withKeePassSSHAgent "-DWITH_XC_SSHAGENT=ON");
+  ++ (lib.optional (!withKeePassX11) "-DWITH_XC_X11=OFF")
+  ++ (lib.optional (withKeePassFDOSecrets && stdenv.isLinux) "-DWITH_XC_FDOSECRETS=ON")
+  ++ (lib.optional (withKeePassYubiKey && stdenv.isLinux) "-DWITH_XC_YUBIKEY=ON")
+  ++ (lib.optional withKeePassBrowser "-DWITH_XC_BROWSER=ON")
+  ++ (lib.optional withKeePassKeeShare "-DWITH_XC_KEESHARE=ON")
+  ++ (lib.optional withKeePassNetworking "-DWITH_XC_NETWORKING=ON")
+  ++ (lib.optional withKeePassSSHAgent "-DWITH_XC_SSHAGENT=ON");
 
   doCheck = true;
   checkPhase = ''
@@ -112,14 +110,14 @@ stdenv.mkDerivation rec {
     readline
     zlib
   ]
-  ++ optional (stdenv.isDarwin && withKeePassTouchID) darwin.apple_sdk.frameworks.LocalAuthentication
-  ++ optional stdenv.isDarwin qtmacextras
-  ++ optional stdenv.isLinux libusb1
-  ++ optional withKeePassX11 qtx11extras;
+  ++ lib.optional (stdenv.isDarwin && withKeePassTouchID) darwin.apple_sdk.frameworks.LocalAuthentication
+  ++ lib.optional stdenv.isDarwin qtmacextras
+  ++ lib.optional stdenv.isLinux libusb1
+  ++ lib.optional withKeePassX11 qtx11extras;
 
   passthru.tests = nixosTests.keepassxc;
 
-  meta = {
+  meta = with lib; {
     description = "Offline password manager with many features.";
     longDescription = ''
       A community fork of KeePassX, which is itself a port of KeePass Password Safe.
diff --git a/pkgs/applications/misc/lukesmithxyz-bible/kjv.nix b/pkgs/applications/misc/kjv/lukesmithxyz-kjv.nix
similarity index 100%
rename from pkgs/applications/misc/lukesmithxyz-bible/kjv.nix
rename to pkgs/applications/misc/kjv/lukesmithxyz-kjv.nix
diff --git a/pkgs/applications/misc/madonctl/default.nix b/pkgs/applications/misc/madonctl/default.nix
index 141bdac87da7..b9a1c0fd5371 100644
--- a/pkgs/applications/misc/madonctl/default.nix
+++ b/pkgs/applications/misc/madonctl/default.nix
@@ -8,10 +8,10 @@ buildGoModule rec {
     owner = "McKael";
     repo = "madonctl";
     rev = "v${version}";
-    sha256 = "sha256-mo185EKjLkiujAKcAFM1XqkXWvcfYbnv+r3dF9ywaf8=";
+    hash = "sha256-mo185EKjLkiujAKcAFM1XqkXWvcfYbnv+r3dF9ywaf8=";
   };
 
-  vendorSha256 = null;
+  vendorHash = null;
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/applications/misc/metadata-cleaner/default.nix b/pkgs/applications/misc/metadata-cleaner/default.nix
index 39849f6827e4..efa10faf2a0f 100644
--- a/pkgs/applications/misc/metadata-cleaner/default.nix
+++ b/pkgs/applications/misc/metadata-cleaner/default.nix
@@ -18,7 +18,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "metadata-cleaner";
-  version = "2.3.1";
+  version = "2.4.0";
 
   format = "other";
 
@@ -26,7 +26,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "rmnvgr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-nH2BsfXFwBdu7/YH2OuG90HxYgiuqKJqMC4p0PRlgPw=";
+    hash = "sha256-/Zi82ri61cQHt1D8DjeVHTSeEn9ubQJD931kP0ffiOs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/osmium-tool/default.nix b/pkgs/applications/misc/osmium-tool/default.nix
index a2f2a676aba1..00d157eb25fb 100644
--- a/pkgs/applications/misc/osmium-tool/default.nix
+++ b/pkgs/applications/misc/osmium-tool/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "osmium-tool";
-  version = "1.14.0";
+  version = "1.15.0";
 
   src = fetchFromGitHub {
     owner = "osmcode";
     repo = "osmium-tool";
     rev = "v${version}";
-    sha256 = "sha256-xedunFzar44o+b/45isXWacDcC81wWkxgGwnpLPH/n0=";
+    sha256 = "sha256-xV/1LFby0L/o648XEQQ9gS9/eHssWhMIG7R1E8bfIDU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/pokemon-colorscripts-mac/default.nix b/pkgs/applications/misc/pokemon-colorscripts-mac/default.nix
index c795e7f76345..62c6ed0f4a42 100644
--- a/pkgs/applications/misc/pokemon-colorscripts-mac/default.nix
+++ b/pkgs/applications/misc/pokemon-colorscripts-mac/default.nix
@@ -6,7 +6,7 @@
 
 stdenv.mkDerivation rec {
   pname = "pokemon-colorscripts-mac";
-  version = "stable=2021-08-10";
+  version = "stable-2021-08-10";
 
   src = fetchFromGitHub {
     owner = "nuke-dash";
diff --git a/pkgs/applications/misc/pomodoro/default.nix b/pkgs/applications/misc/pomodoro/default.nix
new file mode 100644
index 000000000000..d180c8e436e7
--- /dev/null
+++ b/pkgs/applications/misc/pomodoro/default.nix
@@ -0,0 +1,25 @@
+{ lib, stdenv, fetchFromGitHub, rustPlatform, Foundation }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "pomodoro";
+  version = "unstable-2021-06-18";
+
+  src = fetchFromGitHub {
+    owner = "SanderJSA";
+    repo = "Pomodoro";
+    rev = "c833b9551ed0b09e311cdb369cc8226c5b9cac6a";
+    sha256 = "sha256-ZA1q1YVJcdSUF9NTikyT3vrRnqbsu5plzRI2gMu+qnQ=";
+  };
+
+  cargoSha256 = "sha256-6ZhWStZebXSwrej36DXifrsrmR1SWW3PwGUX0hqPwE4=";
+  buildInputs = lib.optionals stdenv.isDarwin [ Foundation ];
+
+  meta = with lib; {
+    description = "A simple CLI pomodoro timer using desktop notifications written in Rust";
+    homepage = "https://github.com/SanderJSA/Pomodoro";
+    license = licenses.mit;
+    maintainers = with maintainers; [ annaaurora ];
+    # error: redefinition of module 'ObjectiveC'
+    broken = stdenv.isDarwin;
+  };
+}
diff --git a/pkgs/applications/misc/river-tag-overlay/default.nix b/pkgs/applications/misc/river-tag-overlay/default.nix
new file mode 100644
index 000000000000..4aa2a3c59a97
--- /dev/null
+++ b/pkgs/applications/misc/river-tag-overlay/default.nix
@@ -0,0 +1,30 @@
+{ lib, stdenv, fetchFromSourcehut, nixos, wayland, pixman, pkg-config }:
+
+stdenv.mkDerivation rec {
+  pname = "river-tag-overlay";
+  version = "1.0.0";
+
+  src = fetchFromSourcehut {
+    owner = "~leon_plickat";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-hLyXdLi/ldvwPJ1oQQsH5wgflQJuXu6vhYw/qdKAV9E=";
+  };
+
+  buildInputs = [ pixman wayland ];
+  nativeBuildInputs = [ pkg-config ];
+
+  makeFlags = [
+    "DESTDIR=${placeholder "out"}"
+    "PREFIX="
+  ];
+
+  meta = with lib; {
+    description = "A pop-up showing tag status";
+    homepage = "https://sr.ht/~leon_plickat/river-tag-overlay";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ edrex ];
+    platforms = platforms.linux;
+    broken = stdenv.isAarch64;
+  };
+}
diff --git a/pkgs/applications/misc/rm-improved/default.nix b/pkgs/applications/misc/rm-improved/default.nix
index c35fa3dc887b..be5fb6344494 100644
--- a/pkgs/applications/misc/rm-improved/default.nix
+++ b/pkgs/applications/misc/rm-improved/default.nix
@@ -1,7 +1,5 @@
 { fetchFromGitHub, rustPlatform, lib }:
 
-with lib;
-
 rustPlatform.buildRustPackage rec {
   pname = "rm-improved";
   version = "0.13.0";
@@ -15,7 +13,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "0d065xia4mwdhxkiqfg7pic6scfzipzmsvvx7l6l97w62lzpiqx3";
   };
 
-  meta = {
+  meta = with lib; {
     description = "Replacement for rm with focus on safety, ergonomics and performance";
     homepage = "https://github.com/nivekuil/rip";
     maintainers = with maintainers; [ nils-degroot ];
diff --git a/pkgs/applications/misc/slstatus/default.nix b/pkgs/applications/misc/slstatus/default.nix
index 5badb7f1b35a..9c96cb2444b1 100644
--- a/pkgs/applications/misc/slstatus/default.nix
+++ b/pkgs/applications/misc/slstatus/default.nix
@@ -1,7 +1,5 @@
 { lib, stdenv, fetchgit, pkg-config, writeText, libX11, conf ? null, patches ? [] }:
 
-with lib;
-
 stdenv.mkDerivation rec {
   pname = "slstatus";
   version = "unstable-2019-02-16";
@@ -12,8 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "0kayyhpmppybhwndxgabw48wsk9v8x9xdb05xrly9szkw3jbvgw4";
   };
 
-  configFile = optionalString (conf!=null) (writeText "config.def.h" conf);
-  preBuild = optionalString (conf!=null) "cp ${configFile} config.def.h";
+  configFile = lib.optionalString (conf!=null) (writeText "config.def.h" conf);
+  preBuild = lib.optionalString (conf!=null) "cp ${configFile} config.def.h";
 
   inherit patches;
 
@@ -24,7 +22,7 @@ stdenv.mkDerivation rec {
 
   installFlags = [ "PREFIX=$(out)" ];
 
-  meta = {
+  meta = with lib; {
     homepage = "https://tools.suckless.org/slstatus/";
     description = "status monitor for window managers that use WM_NAME like dwm";
     license = licenses.isc;
diff --git a/pkgs/applications/misc/veracrypt/default.nix b/pkgs/applications/misc/veracrypt/default.nix
index 2897bb996c84..9f36d6bfa37f 100644
--- a/pkgs/applications/misc/veracrypt/default.nix
+++ b/pkgs/applications/misc/veracrypt/default.nix
@@ -14,14 +14,12 @@
 , btrfs-progs
 }:
 
-with lib;
-
 stdenv.mkDerivation rec {
   pname = "veracrypt";
   version = "1.25.9";
 
   src = fetchurl {
-    url = "https://launchpad.net/${pname}/trunk/${toLower version}/+download/VeraCrypt_${version}_Source.tar.bz2";
+    url = "https://launchpad.net/${pname}/trunk/${lib.toLower version}/+download/VeraCrypt_${version}_Source.tar.bz2";
     sha256 = "sha256-drbhgYS8IaQdKUn/Y9ch1JBUpxbO/zpL13tcNRC3lK8=";
   };
 
@@ -54,7 +52,7 @@ stdenv.mkDerivation rec {
       --replace "Icon=veracrypt" "Icon=veracrypt.xpm"
   '';
 
-  meta = {
+  meta = with lib; {
     description = "Free Open-Source filesystem on-the-fly encryption";
     homepage = "https://www.veracrypt.fr/";
     license = with licenses; [ asl20 /* and */ unfree /* TrueCrypt License version 3.0 */ ];
diff --git a/pkgs/applications/misc/xsuspender/default.nix b/pkgs/applications/misc/xsuspender/default.nix
index d6790759bab4..b47bbef0188f 100644
--- a/pkgs/applications/misc/xsuspender/default.nix
+++ b/pkgs/applications/misc/xsuspender/default.nix
@@ -1,8 +1,6 @@
 { lib, stdenv, fetchFromGitHub, cmake, makeWrapper, pkg-config
 , glib, libwnck, procps }:
 
-with lib;
-
 stdenv.mkDerivation rec {
   pname = "xsuspender";
   version = "1.3";
@@ -21,10 +19,10 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     wrapProgram $out/bin/xsuspender \
-      --prefix PATH : "${makeBinPath [ procps ]}"
+      --prefix PATH : "${lib.makeBinPath [ procps ]}"
   '';
 
-  meta = {
+  meta = with lib; {
     description = "Auto-suspend inactive X11 applications";
     homepage = "https://kernc.github.io/xsuspender/";
     license = licenses.wtfpl;
diff --git a/pkgs/applications/misc/zathura/core/default.nix b/pkgs/applications/misc/zathura/core/default.nix
index 29140b04dd99..84015ba4a3fc 100644
--- a/pkgs/applications/misc/zathura/core/default.nix
+++ b/pkgs/applications/misc/zathura/core/default.nix
@@ -6,8 +6,6 @@
 , gtk-mac-integration
 }:
 
-with lib;
-
 stdenv.mkDerivation rec {
   pname = "zathura";
   version = "0.5.2";
@@ -28,7 +26,7 @@ stdenv.mkDerivation rec {
     "-Dsynctex=enabled"
     # Make sure tests are enabled for doCheck
     "-Dtests=enabled"
-  ] ++ optional (!stdenv.isLinux) "-Dseccomp=disabled";
+  ] ++ lib.optional (!stdenv.isLinux) "-Dseccomp=disabled";
 
   nativeBuildInputs = [
     meson ninja pkg-config desktop-file-utils python3.pkgs.sphinx
@@ -38,12 +36,12 @@ stdenv.mkDerivation rec {
   buildInputs = [
     gtk girara libintl sqlite glib file librsvg
     texlive.bin.core
-  ] ++ optional stdenv.isLinux libseccomp
-    ++ optional stdenv.isDarwin gtk-mac-integration;
+  ] ++ lib.optional stdenv.isLinux libseccomp
+    ++ lib.optional stdenv.isDarwin gtk-mac-integration;
 
   doCheck = !stdenv.isDarwin;
 
-  meta = {
+  meta = with lib; {
     homepage = "https://git.pwmt.org/pwmt/zathura";
     description = "A core component for zathura PDF viewer";
     license = licenses.zlib;
diff --git a/pkgs/applications/networking/appgate-sdp/default.nix b/pkgs/applications/networking/appgate-sdp/default.nix
index c50e672d0753..f776c2c0388d 100644
--- a/pkgs/applications/networking/appgate-sdp/default.nix
+++ b/pkgs/applications/networking/appgate-sdp/default.nix
@@ -38,7 +38,7 @@
 , xorg
 , zlib
 }:
-with lib;
+
 let
   deps = [
     alsa-lib
@@ -89,7 +89,7 @@ stdenv.mkDerivation rec {
   version = "6.0.3";
 
   src = fetchurl {
-    url = "https://bin.appgate-sdp.com/${versions.majorMinor version}/client/appgate-sdp_${version}_amd64.deb";
+    url = "https://bin.appgate-sdp.com/${lib.versions.majorMinor version}/client/appgate-sdp_${version}_amd64.deb";
     sha256 = "sha256-UDyVPoQM78CKVWXgr08An77QTiFVmRNHwQPGaj1jAIM=";
   };
 
@@ -134,16 +134,16 @@ stdenv.mkDerivation rec {
         --replace "/etc/appgate.conf" "$out/etc/appgate.conf"
 
     wrapProgram $out/opt/appgate/service/createdump \
-        --set LD_LIBRARY_PATH "${makeLibraryPath [ stdenv.cc.cc ]}"
+        --set LD_LIBRARY_PATH "${lib.makeLibraryPath [ stdenv.cc.cc ]}"
 
     wrapProgram $out/opt/appgate/appgate-driver \
-        --prefix PATH : ${makeBinPath [ iproute2 networkmanager dnsmasq ]} \
+        --prefix PATH : ${lib.makeBinPath [ iproute2 networkmanager dnsmasq ]} \
         --set LD_LIBRARY_PATH $out/opt/appgate/service
 
     # make xdg-open overrideable at runtime
     makeWrapper $out/opt/appgate/Appgate $out/bin/appgate \
-        --suffix PATH : ${makeBinPath [ xdg-utils ]} \
-        --set LD_LIBRARY_PATH $out/opt/appgate:${makeLibraryPath deps}
+        --suffix PATH : ${lib.makeBinPath [ xdg-utils ]} \
+        --set LD_LIBRARY_PATH $out/opt/appgate:${lib.makeLibraryPath deps}
 
     wrapProgram $out/opt/appgate/linux/set_dns --set PYTHONPATH $PYTHONPATH
   '';
diff --git a/pkgs/applications/networking/browsers/chromium/browser.nix b/pkgs/applications/networking/browsers/chromium/browser.nix
index ca52cf94d8c6..2f39e82f3b24 100644
--- a/pkgs/applications/networking/browsers/chromium/browser.nix
+++ b/pkgs/applications/networking/browsers/chromium/browser.nix
@@ -3,8 +3,6 @@
 , enableWideVine, ungoogled
 }:
 
-with lib;
-
 mkChromiumDerivation (base: rec {
   name = "chromium-browser";
   packageName = "chromium";
@@ -76,7 +74,7 @@ mkChromiumDerivation (base: rec {
 
   meta = {
     description = "An open source web browser from Google"
-      + optionalString ungoogled ", with dependencies on Google web services removed";
+      + lib.optionalString ungoogled ", with dependencies on Google web services removed";
     longDescription = ''
       Chromium is an open source web browser from Google that aims to build a
       safer, faster, and more stable way for all Internet users to experience
@@ -86,11 +84,11 @@ mkChromiumDerivation (base: rec {
     homepage = if ungoogled
       then "https://github.com/Eloston/ungoogled-chromium"
       else "https://www.chromium.org/";
-    maintainers = with maintainers; if ungoogled
+    maintainers = with lib.maintainers; if ungoogled
       then [ squalus primeos michaeladler ]
       else [ primeos thefloweringash ];
-    license = if enableWideVine then licenses.unfree else licenses.bsd3;
-    platforms = platforms.linux;
+    license = if enableWideVine then lib.licenses.unfree else lib.licenses.bsd3;
+    platforms = lib.platforms.linux;
     mainProgram = "chromium";
     hydraPlatforms = if (channel == "stable" || channel == "ungoogled-chromium")
       then ["aarch64-linux" "x86_64-linux"]
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 23b47c84555f..413db2cf985c 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -51,8 +51,6 @@
 
 buildFun:
 
-with lib;
-
 let
   python3WithPackages = python3.withPackages(ps: with ps; [
     ply jinja2 setuptools
@@ -75,16 +73,16 @@ let
     let
       # Serialize Nix types into GN types according to this document:
       # https://source.chromium.org/gn/gn/+/master:docs/language.md
-      mkGnString = value: "\"${escape ["\"" "$" "\\"] value}\"";
+      mkGnString = value: "\"${lib.escape ["\"" "$" "\\"] value}\"";
       sanitize = value:
         if value == true then "true"
         else if value == false then "false"
-        else if isList value then "[${concatMapStringsSep ", " sanitize value}]"
-        else if isInt value then toString value
-        else if isString value then mkGnString value
+        else if lib.isList value then "[${lib.concatMapStringsSep ", " sanitize value}]"
+        else if lib.isInt value then toString value
+        else if lib.isString value then mkGnString value
         else throw "Unsupported type for GN value `${value}'.";
       toFlag = key: value: "${key}=${sanitize value}";
-    in attrs: concatStringsSep " " (attrValues (mapAttrs toFlag attrs));
+    in attrs: lib.concatStringsSep " " (lib.attrValues (lib.mapAttrs toFlag attrs));
 
   # https://source.chromium.org/chromium/chromium/src/+/master:build/linux/unbundle/replace_gn_files.py
   gnSystemLibraries = [
@@ -151,9 +149,9 @@ let
       libdrm wayland mesa.drivers libxkbcommon
       curl
       libepoxy
-    ] ++ optional systemdSupport systemd
-      ++ optionals cupsSupport [ libgcrypt cups ]
-      ++ optional pulseSupport libpulseaudio;
+    ] ++ lib.optional systemdSupport systemd
+      ++ lib.optionals cupsSupport [ libgcrypt cups ]
+      ++ lib.optional pulseSupport libpulseaudio;
 
     patches = [
       # Optional patch to use SOURCE_DATE_EPOCH in compute_build_timestamp.py (should be upstreamed):
@@ -237,10 +235,10 @@ let
       # Allow building against system libraries in official builds
       sed -i 's/OFFICIAL_BUILD/GOOGLE_CHROME_BUILD/' tools/generate_shim_headers/generate_shim_headers.py
 
-    '' + optionalString stdenv.isAarch64 ''
+    '' + lib.optionalString stdenv.isAarch64 ''
       substituteInPlace build/toolchain/linux/BUILD.gn \
         --replace 'toolprefix = "aarch64-linux-gnu-"' 'toolprefix = ""'
-    '' + optionalString ungoogled ''
+    '' + lib.optionalString ungoogled ''
       ${ungoogler}/utils/prune_binaries.py . ${ungoogler}/pruning.list || echo "some errors"
       ${ungoogler}/utils/patches.py . ${ungoogler}/patches
       ${ungoogler}/utils/domain_substitution.py apply -r ${ungoogler}/domain_regex.list -f ${ungoogler}/domain_substitution.list -c ./ungoogled-domsubcache.tar.gz .
@@ -300,15 +298,15 @@ let
       # as well to avoid incompatibilities (if this continues to be a problem
       # from time to time):
       use_system_libwayland = true;
-    } // optionalAttrs proprietaryCodecs {
+    } // lib.optionalAttrs proprietaryCodecs {
       # enable support for the H.264 codec
       proprietary_codecs = true;
       enable_hangout_services_extension = true;
       ffmpeg_branding = "Chrome";
-    } // optionalAttrs pulseSupport {
+    } // lib.optionalAttrs pulseSupport {
       use_pulseaudio = true;
       link_pulseaudio = true;
-    } // optionalAttrs ungoogled (importTOML ./ungoogled-flags.toml)
+    } // lib.optionalAttrs ungoogled (lib.importTOML ./ungoogled-flags.toml)
     // (extraAttrs.gnFlags or {}));
 
     configurePhase = ''
@@ -317,7 +315,7 @@ let
       # This is to ensure expansion of $out.
       libExecPath="${libExecPath}"
       ${python3}/bin/python3 build/linux/unbundle/replace_gn_files.py --system-libraries ${toString gnSystemLibraries}
-      ${gnChromium}/bin/gn gen --args=${escapeShellArg gnFlags} out/Release | tee gn-gen-outputs.txt
+      ${gnChromium}/bin/gn gen --args=${lib.escapeShellArg gnFlags} out/Release | tee gn-gen-outputs.txt
 
       # Fail if `gn gen` contains a WARNING.
       grep -o WARNING gn-gen-outputs.txt && echo "Found gn WARNING, exiting nix build" && exit 1
@@ -342,7 +340,7 @@ let
       '';
       targets = extraAttrs.buildTargets or [];
       commands = map buildCommand targets;
-    in concatStringsSep "\n" commands;
+    in lib.concatStringsSep "\n" commands;
 
     postFixup = ''
       # Make sure that libGLESv2 is found by dlopen (if using EGL).
diff --git a/pkgs/applications/networking/browsers/google-chrome/default.nix b/pkgs/applications/networking/browsers/google-chrome/default.nix
index 82d6107d119e..01cd54cf8ee2 100644
--- a/pkgs/applications/networking/browsers/google-chrome/default.nix
+++ b/pkgs/applications/networking/browsers/google-chrome/default.nix
@@ -47,8 +47,6 @@
 , addOpenGLRunpath
 }:
 
-with lib;
-
 let
   opusWithCustomModes = libopus.override {
     withCustomModes = true;
@@ -68,8 +66,8 @@ let
     bzip2 libcap at-spi2-atk at-spi2-core
     libkrb5 libdrm libglvnd mesa coreutils
     libxkbcommon pipewire wayland
-  ] ++ optional pulseSupport libpulseaudio
-    ++ optional libvaSupport libva
+  ] ++ lib.optional pulseSupport libpulseaudio
+    ++ lib.optional libvaSupport libva
     ++ [ gtk3 ];
 
   suffix = if channel != "stable" then "-" + channel else "";
@@ -99,8 +97,8 @@ in stdenv.mkDerivation {
     tar xf data.tar.xz
   '';
 
-  rpath = makeLibraryPath deps + ":" + makeSearchPathOutput "lib" "lib64" deps;
-  binpath = makeBinPath deps;
+  rpath = lib.makeLibraryPath deps + ":" + lib.makeSearchPathOutput "lib" "lib64" deps;
+  binpath = lib.makeBinPath deps;
 
   installPhase = ''
     runHook preInstall
@@ -149,7 +147,7 @@ in stdenv.mkDerivation {
       --prefix XDG_DATA_DIRS   : "$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH:${addOpenGLRunpath.driverLink}/share" \
       --set CHROME_WRAPPER  "google-chrome-$dist" \
       --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
-      --add-flags ${escapeShellArg commandLineArgs}
+      --add-flags ${lib.escapeShellArg commandLineArgs}
 
     for elf in $out/share/google/$appname/{chrome,chrome-sandbox,${crashpadHandlerBinary},nacl_helper}; do
       patchelf --set-rpath $rpath $elf
@@ -159,7 +157,7 @@ in stdenv.mkDerivation {
     runHook postInstall
   '';
 
-  meta = {
+  meta = with lib; {
     description = "A freeware web browser developed by Google";
     homepage = "https://www.google.com/chrome/browser/";
     license = licenses.unfree;
diff --git a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
index 56bf61aa03bf..43865f051ba2 100644
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@@ -53,10 +53,8 @@
 , extraPrefs ? ""
 }:
 
-with lib;
-
 let
-  libPath = makeLibraryPath libPkgs;
+  libPath = lib.makeLibraryPath libPkgs;
 
   libPkgs = [
     atk
@@ -78,13 +76,13 @@ let
     stdenv.cc.libc
     zlib
   ]
-  ++ optionals pulseaudioSupport [ libpulseaudio ]
-  ++ optionals mediaSupport [
+  ++ lib.optionals pulseaudioSupport [ libpulseaudio ]
+  ++ lib.optionals mediaSupport [
     ffmpeg
   ];
 
   # Library search path for the fte transport
-  fteLibPath = makeLibraryPath [ stdenv.cc.cc gmp ];
+  fteLibPath = lib.makeLibraryPath [ stdenv.cc.cc gmp ];
 
   # Upstream source
   version = "11.5.8";
@@ -156,7 +154,7 @@ stdenv.mkDerivation rec {
     libPath=${libPath}:$TBB_IN_STORE:$TBB_IN_STORE/TorBrowser/Tor
 
     # apulse uses a non-standard library path.  For now special-case it.
-    ${optionalString (audioSupport && !pulseaudioSupport) ''
+    ${lib.optionalString (audioSupport && !pulseaudioSupport) ''
       libPath=${apulse}/lib/apulse:$libPath
     ''}
 
@@ -224,7 +222,7 @@ stdenv.mkDerivation rec {
       clearPref("security.sandbox.content.write_path_whitelist");
     ''}
 
-    ${optionalString (extraPrefs != "") ''
+    ${lib.optionalString (extraPrefs != "") ''
       ${extraPrefs}
     ''}
     EOF
@@ -251,14 +249,14 @@ stdenv.mkDerivation rec {
     GeoIPv6File $TBB_IN_STORE/TorBrowser/Data/Tor/geoip6
     EOF
 
-    WRAPPER_LD_PRELOAD=${optionalString useHardenedMalloc
+    WRAPPER_LD_PRELOAD=${lib.optionalString useHardenedMalloc
       "${graphene-hardened-malloc}/lib/libhardened_malloc.so"}
 
-    WRAPPER_XDG_DATA_DIRS=${concatMapStringsSep ":" (x: "${x}/share") [
+    WRAPPER_XDG_DATA_DIRS=${lib.concatMapStringsSep ":" (x: "${x}/share") [
       gnome.adwaita-icon-theme
       shared-mime-info
     ]}
-    WRAPPER_XDG_DATA_DIRS+=":"${concatMapStringsSep ":" (x: "${x}/share/gsettings-schemas/${x.name}") [
+    WRAPPER_XDG_DATA_DIRS+=":"${lib.concatMapStringsSep ":" (x: "${x}/share/gsettings-schemas/${x.name}") [
       glib
       gsettings-desktop-schemas
       gtk3
@@ -270,7 +268,7 @@ stdenv.mkDerivation rec {
     #! ${runtimeShell}
     set -o errexit -o nounset
 
-    PATH=${makeBinPath [ coreutils ]}
+    PATH=${lib.makeBinPath [ coreutils ]}
     export LC_ALL=C
     export LOCALE_ARCHIVE=${glibcLocales}/lib/locale/locale-archive
 
@@ -317,7 +315,7 @@ stdenv.mkDerivation rec {
     : "\''${XDG_RUNTIME_DIR:=/run/user/\$(id -u)}"
     : "\''${XDG_CONFIG_HOME:=\$REAL_HOME/.config}"
 
-    ${optionalString pulseaudioSupport ''
+    ${lib.optionalString pulseaudioSupport ''
       # Figure out some envvars for pulseaudio
       : "\''${PULSE_SERVER:=\$XDG_RUNTIME_DIR/pulse/native}"
       : "\''${PULSE_COOKIE:=\$XDG_CONFIG_HOME/pulse/cookie}"
diff --git a/pkgs/applications/networking/cluster/k3s/default.nix b/pkgs/applications/networking/cluster/k3s/default.nix
index 445992104585..02a65328cfd8 100644
--- a/pkgs/applications/networking/cluster/k3s/default.nix
+++ b/pkgs/applications/networking/cluster/k3s/default.nix
@@ -25,8 +25,6 @@
 , pkgsBuildBuild
 }:
 
-with lib;
-
 # k3s is a kinda weird derivation. One of the main points of k3s is the
 # simplicity of it being one binary that can perform several tasks.
 # However, when you have a good package manager (like nix), that doesn't
@@ -73,7 +71,7 @@ let
   # run `grep github.com/kubernetes-sigs/cri-tools go.mod | head -n1 | awk '{print $4}'` in the k3s repo at the tag
   criCtlVersion = "1.26.0-rc.0-k3s1";
 
-  baseMeta = {
+  baseMeta = with lib; {
     description = "A lightweight Kubernetes distribution";
     license = licenses.asl20;
     homepage = "https://k3s.io";
diff --git a/pkgs/applications/networking/cluster/spark/default.nix b/pkgs/applications/networking/cluster/spark/default.nix
index e30a1214c3ae..3312f957023a 100644
--- a/pkgs/applications/networking/cluster/spark/default.nix
+++ b/pkgs/applications/networking/cluster/spark/default.nix
@@ -12,8 +12,6 @@
 , R
 }:
 
-with lib;
-
 let
   spark = { pname, version, sha256, extraMeta ? {} }:
     stdenv.mkDerivation rec {
@@ -26,7 +24,7 @@ let
       nativeBuildInputs = [ makeWrapper ];
       buildInputs = [ jdk python3Packages.python ]
         ++ extraPythonPackages
-        ++ optional RSupport R;
+        ++ lib.optional RSupport R;
 
       untarDir = "${pname}-${version}";
       installPhase = ''
@@ -38,12 +36,12 @@ let
         cat > $out/lib/${untarDir}/conf/spark-env.sh <<- EOF
         export JAVA_HOME="${jdk}"
         export SPARK_HOME="$out/lib/${untarDir}"
-      '' + optionalString hadoopSupport ''
+      '' + lib.optionalString hadoopSupport ''
         export SPARK_DIST_CLASSPATH=$(${hadoop}/bin/hadoop classpath)
       '' + ''
         export PYSPARK_PYTHON="${python3Packages.python}/bin/${python3Packages.python.executable}"
         export PYTHONPATH="\$PYTHONPATH:$PYTHONPATH"
-        ${optionalString RSupport ''
+        ${lib.optionalString RSupport ''
           export SPARKR_R_SHELL="${R}/bin/R"
           export PATH="\$PATH:${R}/bin"''}
         EOF
@@ -64,10 +62,10 @@ let
       meta = {
         description = "Apache Spark is a fast and general engine for large-scale data processing";
         homepage = "https://spark.apache.org/";
-        sourceProvenance = with sourceTypes; [ binaryBytecode ];
+        sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
         license = lib.licenses.asl20;
         platforms = lib.platforms.all;
-        maintainers = with maintainers; [ thoughtpolice offline kamilchm illustris ];
+        maintainers = with lib.maintainers; [ thoughtpolice offline kamilchm illustris ];
       } // extraMeta;
     };
 in
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 1f4ce103d858..81d6f0e90494 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -442,22 +442,22 @@
     "vendorHash": "sha256-aVbJT31IIgW0GYzwVX7kT4j7E+dadSbnttThh2lzGyE="
   },
   "google": {
-    "hash": "sha256-/UgxXHucsrt960zLQiPruqJLxjFriTrNKjeI1gNEWys=",
+    "hash": "sha256-R104jYttXER/Pzd3ePHh9ZOvpcziuVQK0JcFqdbWtG0=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google",
     "owner": "hashicorp",
     "proxyVendor": true,
     "repo": "terraform-provider-google",
-    "rev": "v4.49.0",
+    "rev": "v4.50.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-oModEw/gaQCDHLf+2EKf1O1HQSGWnqEReXowE6F7W0o="
   },
   "google-beta": {
-    "hash": "sha256-EGwErLYIL0OEIZJQgQizJqqAsZwn1ewPOqAEyg4tC7Q=",
+    "hash": "sha256-OrotSvDNK7PC6nyHEAvmTOYgdYFiHEE8YwfWcOAbPsk=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
     "owner": "hashicorp",
     "proxyVendor": true,
     "repo": "terraform-provider-google-beta",
-    "rev": "v4.49.0",
+    "rev": "v4.50.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-oModEw/gaQCDHLf+2EKf1O1HQSGWnqEReXowE6F7W0o="
   },
@@ -643,11 +643,11 @@
     "vendorHash": "sha256-lXQHo66b9X0jZhoF+5Ix5qewQGyI82VPJ7gGzc2CHao="
   },
   "kubernetes": {
-    "hash": "sha256-aKGcKmnlYxNS7SrFW2SouRQUXYy339qHrDtQMXGD4DE=",
+    "hash": "sha256-mjxFKCUmXg9CPz/ZZWPr1F8DSUadNroEEwvJgwHYk5s=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/kubernetes",
     "owner": "hashicorp",
     "repo": "terraform-provider-kubernetes",
-    "rev": "v2.16.1",
+    "rev": "v2.17.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -816,11 +816,11 @@
     "vendorHash": "sha256-LRIfxQGwG988HE5fftGl6JmBG7tTknvmgpm4Fu1NbWI="
   },
   "oci": {
-    "hash": "sha256-nky2PxHA9TznFh6IGrx3UvOuwrGPnQID04qlDQ4/rm4=",
+    "hash": "sha256-EewM1/7zzmJ5KL+/KqstFg6rQT8YpvMULScYeD2ClUQ=",
     "homepage": "https://registry.terraform.io/providers/oracle/oci",
     "owner": "oracle",
     "repo": "terraform-provider-oci",
-    "rev": "v4.104.0",
+    "rev": "v4.104.2",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
diff --git a/pkgs/applications/networking/droopy/default.nix b/pkgs/applications/networking/droopy/default.nix
index e6dca02dace7..47298fb4dbc2 100644
--- a/pkgs/applications/networking/droopy/default.nix
+++ b/pkgs/applications/networking/droopy/default.nix
@@ -1,7 +1,5 @@
 { stdenv, lib, fetchFromGitHub, wrapPython, fetchpatch }:
 
-with lib;
-
 stdenv.mkDerivation {
   pname = "droopy";
   version = "20160830";
@@ -32,7 +30,7 @@ stdenv.mkDerivation {
     wrapPythonPrograms
   '';
 
-  meta = {
+  meta = with lib; {
     description = "Mini Web server that let others upload files to your computer";
     homepage = "http://stackp.online.fr/droopy";
     license = licenses.bsd3;
diff --git a/pkgs/applications/networking/ftp/filezilla/default.nix b/pkgs/applications/networking/ftp/filezilla/default.nix
index 49f2aaa37e9c..287e83ffa050 100644
--- a/pkgs/applications/networking/ftp/filezilla/default.nix
+++ b/pkgs/applications/networking/ftp/filezilla/default.nix
@@ -19,11 +19,11 @@
 
 stdenv.mkDerivation rec {
   pname = "filezilla";
-  version = "3.61.0";
+  version = "3.62.2";
 
   src = fetchurl {
     url = "https://download.filezilla-project.org/client/FileZilla_${version}_src.tar.bz2";
-    hash = "sha256-Cv7w5NolICaHsy7Wsf/NhELVs1vc0W308Cuy6pLimfc=";
+    hash = "sha256-p2cJY1yg6kdPaR9sYLGRM0rzB57xksB8NGUEuqtzjBI=";
   };
 
   configureFlags = [
diff --git a/pkgs/applications/networking/instant-messengers/bitlbee-discord/default.nix b/pkgs/applications/networking/instant-messengers/bitlbee-discord/default.nix
index 4450eefa6eb0..6badb7cda760 100644
--- a/pkgs/applications/networking/instant-messengers/bitlbee-discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/bitlbee-discord/default.nix
@@ -1,6 +1,5 @@
 { lib, fetchFromGitHub, stdenv, bitlbee, autoreconfHook, pkg-config, glib }:
 
-with lib;
 stdenv.mkDerivation rec {
   pname = "bitlbee-discord";
   version = "0.4.3";
@@ -21,7 +20,7 @@ stdenv.mkDerivation rec {
     ./autogen.sh
   '';
 
-  meta = {
+  meta = with lib; {
     description = "Bitlbee plugin for Discord";
 
     homepage = "https://github.com/sm00th/bitlbee-discord";
diff --git a/pkgs/applications/networking/instant-messengers/bitlbee-mastodon/default.nix b/pkgs/applications/networking/instant-messengers/bitlbee-mastodon/default.nix
index abd50868e030..3e09a6aa25b8 100644
--- a/pkgs/applications/networking/instant-messengers/bitlbee-mastodon/default.nix
+++ b/pkgs/applications/networking/instant-messengers/bitlbee-mastodon/default.nix
@@ -1,6 +1,5 @@
 { lib, fetchgit, stdenv, bitlbee, autoreconfHook, pkg-config, glib }:
 
-with lib;
 stdenv.mkDerivation rec {
   pname = "bitlbee-mastodon";
   version = "1.4.5";
@@ -19,7 +18,7 @@ stdenv.mkDerivation rec {
     export BITLBEE_DATADIR=$out/share/bitlbee
   '';
 
-  meta = {
+  meta = with lib; {
     description = "Bitlbee plugin for Mastodon";
     homepage = "https://alexschroeder.ch/cgit/bitlbee-mastodon/about";
     license = licenses.gpl2Plus;
diff --git a/pkgs/applications/networking/instant-messengers/bitlbee-steam/default.nix b/pkgs/applications/networking/instant-messengers/bitlbee-steam/default.nix
index 580af6e2e0ce..441963f57ddf 100644
--- a/pkgs/applications/networking/instant-messengers/bitlbee-steam/default.nix
+++ b/pkgs/applications/networking/instant-messengers/bitlbee-steam/default.nix
@@ -1,6 +1,5 @@
 { lib, fetchFromGitHub, stdenv, bitlbee, autoconf, automake, libtool, pkg-config, libgcrypt }:
 
-with lib;
 stdenv.mkDerivation rec {
   version = "1.4.2";
   pname = "bitlbee-steam";
@@ -20,7 +19,7 @@ stdenv.mkDerivation rec {
     ./autogen.sh
   '';
 
-  meta = {
+  meta = with lib; {
     description = "Steam protocol plugin for BitlBee";
 
     homepage = "https://github.com/jgeboski/bitlbee-steam";
diff --git a/pkgs/applications/networking/instant-messengers/bitlbee/default.nix b/pkgs/applications/networking/instant-messengers/bitlbee/default.nix
index de8c4dc1026e..99ce3f8811ef 100644
--- a/pkgs/applications/networking/instant-messengers/bitlbee/default.nix
+++ b/pkgs/applications/networking/instant-messengers/bitlbee/default.nix
@@ -3,7 +3,6 @@
 , enablePam ? false, pam ? null
 }:
 
-with lib;
 stdenv.mkDerivation rec {
   pname = "bitlbee";
   version = "3.6";
@@ -13,11 +12,11 @@ stdenv.mkDerivation rec {
     sha256 = "0zhhcbcr59sx9h4maf8zamzv2waya7sbsl7w74gbyilvy93dw5cz";
   };
 
-  nativeBuildInputs = [ pkg-config ] ++ optional doCheck check;
+  nativeBuildInputs = [ pkg-config ] ++ lib.optional doCheck check;
 
   buildInputs = [ gnutls libotr python3 ]
-    ++ optional enableLibPurple pidgin
-    ++ optional enablePam pam;
+    ++ lib.optional enableLibPurple pidgin
+    ++ lib.optional enablePam pam;
 
   propagatedBuildInputs = [ glib ];
 
@@ -25,8 +24,8 @@ stdenv.mkDerivation rec {
     "--otr=1"
     "--ssl=gnutls"
     "--pidfile=/var/lib/bitlbee/bitlbee.pid"
-  ] ++ optional enableLibPurple "--purple=1"
-    ++ optional enablePam "--pam=1";
+  ] ++ lib.optional enableLibPurple "--purple=1"
+    ++ lib.optional enablePam "--pam=1";
 
   patches = [
     # This should be dropped once the issue is fixed upstream.
@@ -46,7 +45,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  meta = {
+  meta = with lib; {
     description = "IRC instant messaging gateway";
 
     longDescription = ''
diff --git a/pkgs/applications/networking/instant-messengers/bitlbee/plugins.nix b/pkgs/applications/networking/instant-messengers/bitlbee/plugins.nix
index 997882bbc8bb..f750f7f9d602 100644
--- a/pkgs/applications/networking/instant-messengers/bitlbee/plugins.nix
+++ b/pkgs/applications/networking/instant-messengers/bitlbee/plugins.nix
@@ -1,7 +1,5 @@
 { lib, runCommandLocal, bitlbee }:
 
-with lib;
-
 plugins: runCommandLocal "bitlbee-plugins" {
   inherit plugins;
   buildInputs = [ bitlbee plugins ];
diff --git a/pkgs/applications/networking/instant-messengers/ratox/default.nix b/pkgs/applications/networking/instant-messengers/ratox/default.nix
index 58cd952edbbc..5dcb22050763 100644
--- a/pkgs/applications/networking/instant-messengers/ratox/default.nix
+++ b/pkgs/applications/networking/instant-messengers/ratox/default.nix
@@ -1,10 +1,8 @@
 { lib, stdenv, fetchgit, libtoxcore
 , conf ? null }:
 
-with lib;
-
 let
-  configFile = optionalString (conf!=null) (builtins.toFile "config.h" conf);
+  configFile = lib.optionalString (conf!=null) (builtins.toFile "config.h" conf);
 
 in stdenv.mkDerivation {
   pname = "ratox";
@@ -22,12 +20,12 @@ in stdenv.mkDerivation {
     substituteInPlace config.mk \
       --replace '-lsodium -lopus -lvpx ' ""
 
-    ${optionalString (conf!=null) "cp ${configFile} config.def.h"}
+    ${lib.optionalString (conf!=null) "cp ${configFile} config.def.h"}
   '';
 
   makeFlags = [ "PREFIX=$(out)" ];
 
-  meta = {
+  meta = with lib; {
     description = "FIFO based tox client";
     homepage = "http://ratox.2f30.org/";
     license = licenses.isc;
diff --git a/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix b/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix
index 58c6501a1ffb..6e3a9e54f0db 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix
@@ -65,8 +65,6 @@
 , MetalKit
 }:
 
-with lib;
-
 let
   tg_owt = callPackage ./tg_owt.nix {
     abseil-cpp = abseil-cpp.override {
@@ -99,14 +97,14 @@ stdenv.mkDerivation rec {
     ./shortcuts-binary-path.patch
   ];
 
-  postPatch = optionalString stdenv.isLinux ''
+  postPatch = lib.optionalString stdenv.isLinux ''
     substituteInPlace Telegram/ThirdParty/libtgvoip/os/linux/AudioInputALSA.cpp \
       --replace '"libasound.so.2"' '"${alsa-lib}/lib/libasound.so.2"'
     substituteInPlace Telegram/ThirdParty/libtgvoip/os/linux/AudioOutputALSA.cpp \
       --replace '"libasound.so.2"' '"${alsa-lib}/lib/libasound.so.2"'
     substituteInPlace Telegram/ThirdParty/libtgvoip/os/linux/AudioPulse.cpp \
       --replace '"libpulse.so.0"' '"${libpulseaudio}/lib/libpulse.so.0"'
-  '' + optionalString stdenv.isDarwin ''
+  '' + lib.optionalString stdenv.isDarwin ''
     sed -i "13i#import <CoreAudio/CoreAudio.h>" Telegram/lib_webrtc/webrtc/mac/webrtc_media_devices_mac.mm
     substituteInPlace Telegram/CMakeLists.txt \
       --replace 'COMMAND iconutil' 'COMMAND png2icns' \
@@ -122,7 +120,7 @@ stdenv.mkDerivation rec {
     python3
     wrapQtAppsHook
     removeReferencesTo
-  ] ++ optionals stdenv.isLinux [
+  ] ++ lib.optionals stdenv.isLinux [
     # to build bundled libdispatch
     clang
     extra-cmake-modules
@@ -143,7 +141,7 @@ stdenv.mkDerivation rec {
     rnnoise
     tg_owt
     microsoft_gsl
-  ] ++ optionals stdenv.isLinux [
+  ] ++ lib.optionals stdenv.isLinux [
     kwayland
     alsa-lib
     libpulseaudio
@@ -151,7 +149,7 @@ stdenv.mkDerivation rec {
     glibmm
     jemalloc
     wayland
-  ] ++ optionals stdenv.isDarwin [
+  ] ++ lib.optionals stdenv.isDarwin [
     Cocoa
     CoreFoundation
     CoreServices
@@ -192,7 +190,7 @@ stdenv.mkDerivation rec {
     "-DDESKTOP_APP_QT6=OFF"
   ];
 
-  installPhase = optionalString stdenv.isDarwin ''
+  installPhase = lib.optionalString stdenv.isDarwin ''
     mkdir -p $out/Applications
     cp -r Kotatogram.app $out/Applications
     ln -s $out/Applications/Kotatogram.app/Contents/MacOS $out/bin
@@ -209,7 +207,7 @@ stdenv.mkDerivation rec {
     inherit tg_owt;
   };
 
-  meta = {
+  meta = with lib; {
     description = "Kotatogram – experimental Telegram Desktop fork";
     longDescription = ''
       Unofficial desktop client for the Telegram messenger, based on Telegram Desktop.
diff --git a/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/with-webkit.nix b/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/with-webkit.nix
index 435268cdf623..73c71d294c84 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/with-webkit.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/with-webkit.nix
@@ -1,7 +1,5 @@
 { stdenv, lib, kotatogram-desktop, glib-networking, webkitgtk, makeWrapper }:
 
-with lib;
-
 stdenv.mkDerivation {
   pname = "${kotatogram-desktop.pname}-with-webkit";
   version = kotatogram-desktop.version;
@@ -15,9 +13,9 @@ stdenv.mkDerivation {
     mkdir -p $out/bin
     makeWrapper ${kotatogram-desktop}/bin/kotatogram-desktop $out/bin/kotatogram-desktop \
       --prefix GIO_EXTRA_MODULES : ${glib-networking}/lib/gio/modules \
-      --prefix LD_LIBRARY_PATH : ${makeLibraryPath [ webkitgtk ]}
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ webkitgtk ]}
   '';
   meta = kotatogram-desktop.meta // {
-    platforms = platforms.linux;
+    platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/applications/networking/instant-messengers/wavebox/default.nix b/pkgs/applications/networking/instant-messengers/wavebox/default.nix
index cf6410def0d1..1190a35c69a1 100644
--- a/pkgs/applications/networking/instant-messengers/wavebox/default.nix
+++ b/pkgs/applications/networking/instant-messengers/wavebox/default.nix
@@ -3,8 +3,6 @@
 , xorg
 }:
 
-with lib;
-
 let
   bits = "x86_64";
 
@@ -19,7 +17,7 @@ let
     categories = [ "Network" ];
   };
 
-  tarball = "Wavebox_${replaceStrings ["."] ["_"] (toString version)}_linux_${bits}.tar.gz";
+  tarball = "Wavebox_${lib.replaceStrings ["."] ["_"] (toString version)}_linux_${bits}.tar.gz";
 
 in stdenv.mkDerivation {
   pname = "wavebox";
@@ -40,7 +38,7 @@ in stdenv.mkDerivation {
     alsa-lib gtk3 nss
   ];
 
-  runtimeDependencies = [ (getLib udev) libnotify ];
+  runtimeDependencies = [ (lib.getLib udev) libnotify ];
 
   installPhase = ''
     mkdir -p $out/bin $out/opt/wavebox
diff --git a/pkgs/applications/networking/irc/convos/default.nix b/pkgs/applications/networking/irc/convos/default.nix
index 051a872151a7..186f1a74020b 100644
--- a/pkgs/applications/networking/irc/convos/default.nix
+++ b/pkgs/applications/networking/irc/convos/default.nix
@@ -2,8 +2,6 @@
 , nixosTests
 }:
 
-with lib;
-
 perlPackages.buildPerlPackage rec {
   pname = "convos";
   version = "7.02";
@@ -16,7 +14,7 @@ perlPackages.buildPerlPackage rec {
   };
 
   nativeBuildInputs = [ makeWrapper ]
-    ++ optionals stdenv.isDarwin [ shortenPerlShebang ];
+    ++ lib.optionals stdenv.isDarwin [ shortenPerlShebang ];
 
   buildInputs = with perlPackages; [
     CryptPassphrase CryptPassphraseArgon2 CryptPassphraseBcrypt
@@ -79,7 +77,7 @@ perlPackages.buildPerlPackage rec {
     ln -s $AUTO_SHARE_PATH/public/asset $out/asset
     cp -vR templates $out/templates
     cp cpanfile $out/cpanfile
-  '' + optionalString stdenv.isDarwin ''
+  '' + lib.optionalString stdenv.isDarwin ''
     shortenPerlShebang $out/bin/convos
   '' + ''
     wrapProgram $out/bin/convos --set MOJO_HOME $out
@@ -91,6 +89,6 @@ perlPackages.buildPerlPackage rec {
     homepage = "https://convos.chat";
     description = "Convos is the simplest way to use IRC in your browser";
     license = lib.licenses.artistic2;
-    maintainers = with maintainers; [ sgo ];
+    maintainers = with lib.maintainers; [ sgo ];
   };
 }
diff --git a/pkgs/applications/networking/mailreaders/claws-mail/default.nix b/pkgs/applications/networking/mailreaders/claws-mail/default.nix
index f896cc43867c..bc5b692501ac 100644
--- a/pkgs/applications/networking/mailreaders/claws-mail/default.nix
+++ b/pkgs/applications/networking/mailreaders/claws-mail/default.nix
@@ -52,8 +52,6 @@
 , enablePluginVcalendar ? true, libical
 }:
 
-with lib;
-
 let
   pythonPkgs = with python3.pkgs; [ python3 wrapPython pygobject3 ];
 
@@ -130,7 +128,7 @@ in stdenv.mkDerivation rec {
 
   buildInputs =
     [ curl gsettings-desktop-schemas glib-networking gtk3 ]
-    ++ concatMap (f: optionals f.enabled f.deps) (filter (f: f ? deps) features)
+    ++ lib.concatMap (f: lib.optionals f.enabled f.deps) (lib.filter (f: f ? deps) features)
   ;
 
   configureFlags =
@@ -141,7 +139,7 @@ in stdenv.mkDerivation rec {
 
       "--disable-gdata-plugin" # Complains about missing libgdata, even when provided
     ] ++
-    (map (feature: map (flag: strings.enableFeature feature.enabled flag) feature.flags) features);
+    (map (feature: map (flag: lib.strings.enableFeature feature.enabled flag) feature.flags) features);
 
   enableParallelBuilding = true;
 
@@ -155,7 +153,7 @@ in stdenv.mkDerivation rec {
     cp claws-mail.desktop $out/share/applications
   '';
 
-  meta = {
+  meta = with lib; {
     description = "The user-friendly, lightweight, and fast email client";
     homepage = "https://www.claws-mail.org/";
     license = licenses.gpl3Plus;
diff --git a/pkgs/applications/networking/mailreaders/sylpheed/default.nix b/pkgs/applications/networking/mailreaders/sylpheed/default.nix
index 1e2d5c031d64..90b7dbd28d4c 100644
--- a/pkgs/applications/networking/mailreaders/sylpheed/default.nix
+++ b/pkgs/applications/networking/mailreaders/sylpheed/default.nix
@@ -4,8 +4,6 @@
 assert gpgSupport -> gpgme != null;
 assert sslSupport -> openssl != null;
 
-with lib;
-
 stdenv.mkDerivation rec {
   pname = "sylpheed";
   version = "3.7.0";
@@ -33,17 +31,17 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [ gtk2 ]
-    ++ optionals gpgSupport [ gpgme ]
-    ++ optionals sslSupport [ openssl ]
-    ++ optionals stdenv.isDarwin [ Foundation ];
+    ++ lib.optionals gpgSupport [ gpgme ]
+    ++ lib.optionals sslSupport [ openssl ]
+    ++ lib.optionals stdenv.isDarwin [ Foundation ];
 
-  configureFlags = optional gpgSupport "--enable-gpgme"
-    ++ optional sslSupport "--enable-ssl";
+  configureFlags = lib.optional gpgSupport "--enable-gpgme"
+    ++ lib.optional sslSupport "--enable-ssl";
 
   # Undefined symbols for architecture arm64: "_OBJC_CLASS_$_NSAutoreleasePool"
   NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-framework Foundation";
 
-  meta = {
+  meta = with lib; {
     homepage = "https://sylpheed.sraoss.jp/en/";
     description = "Lightweight and user-friendly e-mail client";
     maintainers = with maintainers; [ eelco ];
diff --git a/pkgs/applications/networking/p2p/qbittorrent/default.nix b/pkgs/applications/networking/p2p/qbittorrent/default.nix
index 76fc70b3bad0..319a5e7f0dc8 100644
--- a/pkgs/applications/networking/p2p/qbittorrent/default.nix
+++ b/pkgs/applications/networking/p2p/qbittorrent/default.nix
@@ -9,7 +9,6 @@
 assert guiSupport -> (dbus != null);
 assert trackerSearch -> (python3 != null);
 
-with lib;
 mkDerivation rec {
   pname = "qbittorrent";
   version = "4.4.5";
@@ -27,8 +26,8 @@ mkDerivation rec {
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [ boost libtorrent-rasterbar qtbase qttools qtsvg ]
-    ++ optional guiSupport dbus # D(esktop)-Bus depends on GUI support
-    ++ optional trackerSearch python3;
+    ++ lib.optional guiSupport dbus # D(esktop)-Bus depends on GUI support
+    ++ lib.optional trackerSearch python3;
 
   # Otherwise qm_gen.pri assumes lrelease-qt5, which does not exist.
   QMAKE_LRELEASE = "lrelease";
@@ -36,11 +35,11 @@ mkDerivation rec {
   configureFlags = [
     "--with-boost-libdir=${boost.out}/lib"
     "--with-boost=${boost.dev}" ]
-    ++ optionals (!guiSupport) [ "--disable-gui" "--enable-systemd" ] # Also place qbittorrent-nox systemd service files
-    ++ optional (!webuiSupport) "--disable-webui"
-    ++ optional debugSupport "--enable-debug";
+    ++ lib.optionals (!guiSupport) [ "--disable-gui" "--enable-systemd" ] # Also place qbittorrent-nox systemd service files
+    ++ lib.optional (!webuiSupport) "--disable-webui"
+    ++ lib.optional debugSupport "--enable-debug";
 
-  qtWrapperArgs = optional trackerSearch "--prefix PATH : ${makeBinPath [ python3 ]}";
+  qtWrapperArgs = lib.optional trackerSearch "--prefix PATH : ${lib.makeBinPath [ python3 ]}";
 
   postInstall = lib.optionalString stdenv.isDarwin ''
     mkdir -p $out/{Applications,bin}
@@ -48,7 +47,7 @@ mkDerivation rec {
     makeWrapper $out/{Applications/qbittorrent.app/Contents/MacOS,bin}/qbittorrent
   '';
 
-  meta = {
+  meta = with lib; {
     description = "Featureful free software BitTorrent client";
     homepage    = "https://www.qbittorrent.org/";
     changelog   = "https://github.com/qbittorrent/qBittorrent/blob/release-${version}/Changelog";
diff --git a/pkgs/applications/networking/sniffers/wireshark/default.nix b/pkgs/applications/networking/sniffers/wireshark/default.nix
index fbb8842393f5..452263f0742f 100644
--- a/pkgs/applications/networking/sniffers/wireshark/default.nix
+++ b/pkgs/applications/networking/sniffers/wireshark/default.nix
@@ -8,8 +8,6 @@
 
 assert withQt  -> qt5  != null;
 
-with lib;
-
 let
   version = "4.0.2";
   variant = if withQt then "qt" else "cli";
@@ -39,17 +37,17 @@ in stdenv.mkDerivation {
   NIX_CFLAGS_COMPILE = [ "-DQT_NO_DEBUG" ];
 
   nativeBuildInputs = [ asciidoctor bison cmake flex makeWrapper pkg-config python3 perl ]
-    ++ optionals withQt [ qt5.wrapQtAppsHook wrapGAppsHook ];
+    ++ lib.optionals withQt [ qt5.wrapQtAppsHook wrapGAppsHook ];
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
 
   buildInputs = [
     gettext pcre2 libpcap lua5 libssh nghttp2 openssl libgcrypt
     libgpg-error gnutls geoip c-ares glib zlib
-  ] ++ optionals withQt  (with qt5; [ qtbase qtmultimedia qtsvg qttools ])
-    ++ optionals stdenv.isLinux  [ libcap libnl ]
-    ++ optionals stdenv.isDarwin [ SystemConfiguration ApplicationServices gmp ]
-    ++ optionals (withQt && stdenv.isDarwin) (with qt5; [ qtmacextras ]);
+  ] ++ lib.optionals withQt  (with qt5; [ qtbase qtmultimedia qtsvg qttools ])
+    ++ lib.optionals stdenv.isLinux  [ libcap libnl ]
+    ++ lib.optionals stdenv.isDarwin [ SystemConfiguration ApplicationServices gmp ]
+    ++ lib.optionals (withQt && stdenv.isDarwin) (with qt5; [ qtmacextras ]);
 
   strictDeps = true;
 
@@ -72,7 +70,7 @@ in stdenv.mkDerivation {
             install_name_tool -change "$dylib" "$out/lib/$dylib" "$f"
         done
     done
-  '' else optionalString withQt ''
+  '' else lib.optionalString withQt ''
     pwd
     install -Dm644 -t $out/share/applications ../resources/freedesktop/org.wireshark.Wireshark.desktop
 
diff --git a/pkgs/applications/networking/znc/default.nix b/pkgs/applications/networking/znc/default.nix
index f73bb1c4bf73..667533871993 100644
--- a/pkgs/applications/networking/znc/default.nix
+++ b/pkgs/applications/networking/znc/default.nix
@@ -9,8 +9,6 @@
 , withDebug ? false
 }:
 
-with lib;
-
 stdenv.mkDerivation rec {
   pname = "znc";
   version = "1.8.2";
@@ -23,12 +21,12 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [ openssl ]
-    ++ optional withPerl perl
-    ++ optional withPython python3
-    ++ optional withTcl tcl
-    ++ optional withCyrus cyrus_sasl
-    ++ optional withUnicode icu
-    ++ optional withZlib zlib;
+    ++ lib.optional withPerl perl
+    ++ lib.optional withPython python3
+    ++ lib.optional withTcl tcl
+    ++ lib.optional withCyrus cyrus_sasl
+    ++ lib.optional withUnicode icu
+    ++ lib.optional withZlib zlib;
 
   configureFlags = [
     (lib.enableFeature withPerl "perl")
@@ -36,8 +34,8 @@ stdenv.mkDerivation rec {
     (lib.enableFeature withTcl "tcl")
     (lib.withFeatureAs withTcl "tcl" "${tcl}/lib")
     (lib.enableFeature withCyrus "cyrus")
-  ] ++ optionals (!withIPv6) [ "--disable-ipv6" ]
-    ++ optionals withDebug [ "--enable-debug" ];
+  ] ++ lib.optionals (!withIPv6) [ "--disable-ipv6" ]
+    ++ lib.optionals withDebug [ "--enable-debug" ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/applications/radio/cloudlog/default.nix b/pkgs/applications/radio/cloudlog/default.nix
new file mode 100644
index 000000000000..dd117fd9d451
--- /dev/null
+++ b/pkgs/applications/radio/cloudlog/default.nix
@@ -0,0 +1,43 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, nixosTests
+, php}:
+
+stdenvNoCC.mkDerivation rec {
+  name = "cloudlog";
+  version = "2.3";
+
+  src = fetchFromGitHub {
+    owner = "magicbug";
+    repo = "Cloudlog";
+    rev = version;
+    sha256 = "sha256-IepCeV/mYy/GEzRTXf67LYQQaN5Rj5Z77KaF2l30r60=";
+  };
+
+  postPath = ''
+    substituteInPlace index.php \
+      --replace "define('ENVIRONMENT', 'development');" "define('ENVIRONMENT', 'production');"
+  '';
+
+  installPhase = ''
+    mkdir $out/
+    cp -R ./* $out
+  '';
+
+  passthru.tests = {
+    inherit (nixosTests) cloudlog;
+  };
+
+  meta = with lib; {
+    description = ''
+      Web based amateur radio logging application built using PHP & MySQL
+      supports general station logging tasks from HF to Microwave with
+      supporting applications to support CAT control.
+    '';
+    license = licenses.mit;
+    homepage = "https://www.magicbug.co.uk/cloudlog";
+    platforms = php.meta.platforms;
+    maintainers = with maintainers; [ melling ];
+  };
+}
diff --git a/pkgs/applications/radio/gridtracker/default.nix b/pkgs/applications/radio/gridtracker/default.nix
index 0e6216cdda42..cfb1f367ad80 100644
--- a/pkgs/applications/radio/gridtracker/default.nix
+++ b/pkgs/applications/radio/gridtracker/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gridtracker";
-  version = "1.22.1226";
+  version = "1.23.0110";
 
   src = fetchFromGitLab {
     owner = "gridtracker.org";
     repo = "gridtracker";
     rev = "v${version}";
-    sha256 = "sha256-/Noc2aqHBjphX6RDqxQBI/OOKZgEnOndn0daBt1edXM=";
+    sha256 = "sha256-yQWdBNt7maYTzroB+P1hsGIeivkP+soR3/b847HLYZY=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/radio/sdrangel/default.nix b/pkgs/applications/radio/sdrangel/default.nix
index cac4144f544c..fa3f566b3f0c 100644
--- a/pkgs/applications/radio/sdrangel/default.nix
+++ b/pkgs/applications/radio/sdrangel/default.nix
@@ -42,13 +42,13 @@
 
 mkDerivation rec {
   pname = "sdrangel";
-  version = "7.8.5";
+  version = "7.8.6";
 
   src = fetchFromGitHub {
     owner = "f4exb";
     repo = "sdrangel";
     rev = "v${version}";
-    sha256 = "sha256-m5b51rR2l4EdF2kMogHIi1ojoy3UwuU0Q3pfB1ev300=";
+    sha256 = "sha256-tLU2OHFf1PPNRr1t3MWWCKnvILp1DW0k4TAxrXWI2X4=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/applications/science/misc/openmvg/default.nix b/pkgs/applications/science/misc/openmvg/default.nix
index 1e20e5896363..1c173b75238c 100644
--- a/pkgs/applications/science/misc/openmvg/default.nix
+++ b/pkgs/applications/science/misc/openmvg/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, cmake
+{ lib, stdenv, fetchFromGitHub, pkg-config, cmake, cereal, openmp
 , libjpeg ? null
 , zlib ? null
 , libpng ? null
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
-  buildInputs = [ libjpeg zlib libpng eigen libtiff ];
+  buildInputs = [ libjpeg zlib libpng eigen libtiff cereal openmp ];
 
   nativeBuildInputs = [ cmake pkg-config ];
 
@@ -45,6 +45,6 @@ stdenv.mkDerivation rec {
     homepage = "https://openmvg.readthedocs.io/en/latest/";
     license = lib.licenses.mpl20;
     platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [ mdaiter ];
+    maintainers = with lib.maintainers; [ mdaiter bouk ];
   };
 }
diff --git a/pkgs/applications/system/monitor/default.nix b/pkgs/applications/system/monitor/default.nix
index 84596f6d9382..db7a37e2be34 100644
--- a/pkgs/applications/system/monitor/default.nix
+++ b/pkgs/applications/system/monitor/default.nix
@@ -8,9 +8,11 @@
 , pkg-config
 , pantheon
 , python3
+, curl
 , gettext
 , glib
 , gtk3
+, json-glib
 , libwnck
 , libgee
 , libgtop
@@ -25,13 +27,13 @@
 
 stdenv.mkDerivation rec {
   pname = "monitor";
-  version = "0.14.0";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "stsdc";
     repo = "monitor";
     rev = version;
-    sha256 = "sha256-dw1FR9nU8MY6LBL3sF942azeSgKmCntXCk4+nhMb4Wo=";
+    sha256 = "sha256-w4c9rVO54mrjUX2iRxUQ7PHqE+8D+BqBgHMK2X9nI0g=";
     fetchSubmodules = true;
   };
 
@@ -46,8 +48,10 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
+    curl
     glib
     gtk3
+    json-glib
     pantheon.granite
     pantheon.wingpanel
     libgee
@@ -72,6 +76,11 @@ stdenv.mkDerivation rec {
   postPatch = ''
     chmod +x meson/post_install.py
     patchShebangs meson/post_install.py
+
+    # Alternatively, using pkg-config here should just work.
+    substituteInPlace meson.build --replace \
+      "meson.get_compiler('c').find_library('libcurl', dirs: vapidir)" \
+      "meson.get_compiler('c').find_library('libcurl', dirs: '${curl.out}/lib')"
   '';
 
   passthru = {
diff --git a/pkgs/applications/version-management/git-cliff/default.nix b/pkgs/applications/version-management/git-cliff/default.nix
index 278208c48bff..be92ac0a29d4 100644
--- a/pkgs/applications/version-management/git-cliff/default.nix
+++ b/pkgs/applications/version-management/git-cliff/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "git-cliff";
-  version = "1.1.1";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = "git-cliff";
     rev = "v${version}";
-    hash = "sha256-GCHwpOfjti9PETy3cHFHBFBot6YcSSFTBCd3zEtpP3U=";
+    hash = "sha256-QYldwxQYod5qkNC3soiKoCLDFR4UaLxdGkVufn1JIeE=";
   };
 
-  cargoHash = "sha256-76HWkfct9weA64yvY5G/l96mjNpuKjPYHFZ5Ctz43Us=";
+  cargoHash = "sha256-jwDJb9Hl0PegCufmaj1Q3h5itgt26E4dwmcyCxZ+4FM=";
 
   # attempts to run the program on .git in src which is not deterministic
   doCheck = false;
diff --git a/pkgs/applications/video/mythtv/default.nix b/pkgs/applications/video/mythtv/default.nix
index 0df8cf6a7249..7ea9a532a725 100644
--- a/pkgs/applications/video/mythtv/default.nix
+++ b/pkgs/applications/video/mythtv/default.nix
@@ -1,7 +1,8 @@
 { lib, mkDerivation, fetchFromGitHub, fetchpatch, which, qtbase, qtwebkit, qtscript
 , libpulseaudio, fftwSinglePrec , lame, zlib, libGLU, libGL, alsa-lib, freetype
 , perl, pkg-config , libsamplerate, libbluray, lzo, libX11, libXv, libXrandr, libXvMC, libXinerama, libXxf86vm
-, libXmu , yasm, libuuid, taglib, libtool, autoconf, automake, file, exiv2, linuxHeaders, soundtouch, libzip
+, libXmu , yasm, libuuid, taglib, libtool, autoconf, automake, file, exiv2, linuxHeaders
+, soundtouch, libzip, libhdhomerun
 , withWebKit ? false
 }:
 
@@ -35,6 +36,7 @@ mkDerivation rec {
     freetype qtbase qtscript lame zlib libGLU libGL
     perl libsamplerate libbluray lzo alsa-lib libpulseaudio fftwSinglePrec libX11 libXv libXrandr libXvMC
     libXmu libXinerama libXxf86vm libXmu libuuid taglib exiv2 soundtouch libzip
+    libhdhomerun
   ] ++ lib.optional withWebKit qtwebkit;
   nativeBuildInputs = [ pkg-config which yasm libtool autoconf automake file ];
 
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-move-transition.nix b/pkgs/applications/video/obs-studio/plugins/obs-move-transition.nix
index 7af053e5c18f..0f8eddaebd17 100644
--- a/pkgs/applications/video/obs-studio/plugins/obs-move-transition.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-move-transition.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "obs-move-transition";
-  version = "2.7.1";
+  version = "2.8.0";
 
   src = fetchFromGitHub {
     owner = "exeldro";
     repo = "obs-move-transition";
     rev = version;
-    sha256 = "sha256-zWHQ01iNTlqSAKcmsDCUZPXmmBIpqY/ZDftD5J6kp80=";
+    sha256 = "sha256-v4mAv4dqurM2S4/vM1APge0xoMLnOaigGU15vjNxxSo=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/build-support/build-bazel-package/default.nix b/pkgs/build-support/build-bazel-package/default.nix
index 14f7ac38d3ff..d1cd502e7e4b 100644
--- a/pkgs/build-support/build-bazel-package/default.nix
+++ b/pkgs/build-support/build-bazel-package/default.nix
@@ -1,16 +1,11 @@
 { stdenv
-, bazel
 , cacert
 , lib
 }:
 
-let
-  bazelPkg = bazel;
-in
-
 args@{
   name ? "${args.pname}-${args.version}"
-, bazel ? bazelPkg
+, bazel
 , bazelFlags ? []
 , bazelBuildFlags ? []
 , bazelTestFlags ? []
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 06aabf2a6f3e..55be5f3a9d0a 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -372,11 +372,11 @@ stdenv.mkDerivation {
         echo "-isystem $dir" >> $out/nix-support/libcxx-cxxflags
       done
     ''
-    + optionalString (libcxx.isLLVM or false) (''
+    + optionalString (libcxx.isLLVM or false) ''
       echo "-isystem ${lib.getDev libcxx}/include/c++/v1" >> $out/nix-support/libcxx-cxxflags
       echo "-stdlib=libc++" >> $out/nix-support/libcxx-ldflags
-      echo "-lc++abi" >> $out/nix-support/libcxx-ldflags
-    '')
+      echo "-l${libcxx.cxxabi.libName}" >> $out/nix-support/libcxx-ldflags
+    ''
 
     ##
     ## Initial CFLAGS
diff --git a/pkgs/data/fonts/aileron/default.nix b/pkgs/data/fonts/aileron/default.nix
index 4961a5e7449d..5ae83519278b 100644
--- a/pkgs/data/fonts/aileron/default.nix
+++ b/pkgs/data/fonts/aileron/default.nix
@@ -1,27 +1,32 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
 let
   majorVersion = "0";
   minorVersion = "102";
-  pname = "aileron";
 in
+stdenvNoCC.mkDerivation (self: {
+  pname = "aileron";
+  version = "${majorVersion}.${minorVersion}";
 
-fetchzip {
-  name = "${pname}-font-${majorVersion}.${minorVersion}";
+  src = fetchzip {
+    url = "https://dotcolon.net/download/fonts/${self.pname}_${majorVersion}${minorVersion}.zip";
+    hash = "sha256-Ht48gwJZrn0djo1yl6jHZ4+0b710FVwStiC1Zk5YXME=";
+    stripRoot = false;
+  };
 
-  url = "http://dotcolon.net/DL/font/${pname}.zip";
-  sha256 = "04xnzdy9plzd2p02yq367h37m5ygx0w8cpkdv39cc3754ljlsxim";
+  installPhase = ''
+    runHook preInstall
 
-  postFetch = ''
-    mkdir -p $out/share/fonts/opentype/${pname}
-    unzip -j $downloadedFile \*.otf  -d $out/share/fonts/opentype/${pname}
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
   '';
 
   meta = with lib; {
-    homepage = "http://dotcolon.net/font/${pname}/";
+    homepage = "http://dotcolon.net/font/${self.pname}/";
     description = "A helvetica font in nine weights";
     platforms = platforms.all;
-    maintainers = with maintainers; [ leenaars ];
+    maintainers = with maintainers; [ leenaars minijackson ];
     license = licenses.cc0;
   };
-}
+})
diff --git a/pkgs/data/fonts/alkalami/default.nix b/pkgs/data/fonts/alkalami/default.nix
index b0b2876f5a6a..60e31e88c2df 100644
--- a/pkgs/data/fonts/alkalami/default.nix
+++ b/pkgs/data/fonts/alkalami/default.nix
@@ -1,19 +1,23 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-fetchzip rec {
+stdenvNoCC.mkDerivation rec {
   pname = "alkalami";
   version = "2.000";
 
-  url = "https://software.sil.org/downloads/r/alkalami/Alkalami-${version}.zip";
+  src = fetchzip {
+    url = "https://software.sil.org/downloads/r/alkalami/Alkalami-${version}.zip";
+    hash = "sha256-rT0HzTFbooHr+l5BQ9GVYKxxNk7TESdkOQfWBeVpwYI=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  postFetch = ''
-    rm -rf $out/web $out/manifest.json
     mkdir -p $out/share/{doc/${pname},fonts/truetype}
-    mv $out/*.ttf $out/share/fonts/truetype/
-    mv $out/*.txt $out/documentation $out/share/doc/${pname}/
-  '';
+    mv *.ttf $out/share/fonts/truetype/
+    mv *.txt documentation $out/share/doc/${pname}/
 
-  sha256 = "sha256-GjX3YOItLKSMlRjUbBgGp2D7QS/pOJQYuQJzW+iqBNo=";
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "https://software.sil.org/alkalami/";
diff --git a/pkgs/data/fonts/amiri/default.nix b/pkgs/data/fonts/amiri/default.nix
index 87185e8469fd..bfd7c60bf531 100644
--- a/pkgs/data/fonts/amiri/default.nix
+++ b/pkgs/data/fonts/amiri/default.nix
@@ -1,20 +1,23 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "amiri";
   version = "1.000";
 
-in fetchzip rec {
-  name = "Amiri-${version}";
+  src = fetchzip {
+    url = "https://github.com/alif-type/amiri/releases/download/${version}/Amiri-${version}.zip";
+    hash = "sha256-WXxKLYIIKe01WWZrI1aLOv65wRgn7aqHl6Codf4foVw=";
+  };
 
-  url = "https://github.com/alif-type/amiri/releases/download/${version}/${name}.zip";
+  installPhase = ''
+    runHook preInstall
 
-  sha256 = "sha256-hG6m/zsGoGF5/xhHz9EHVL9Sg9dlQqfXpQ/lqNyI1vU=";
-
-  postFetch = ''
     mkdir -p $out/share/fonts/truetype
-    mv $out/*.ttf $out/share/fonts/truetype/
-    mkdir -p $out/share/doc/${name}
-    mv $out/{*.html,*.txt,*.md} $out/share/doc/${name}/
+    mv *.ttf $out/share/fonts/truetype/
+    mkdir -p $out/share/doc/${pname}-${version}
+    mv {*.html,*.txt,*.md} $out/share/doc/${pname}-${version}/
+
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/data/fonts/ankacoder/condensed.nix b/pkgs/data/fonts/ankacoder/condensed.nix
index 655c780129d8..676c3cf85602 100644
--- a/pkgs/data/fonts/ankacoder/condensed.nix
+++ b/pkgs/data/fonts/ankacoder/condensed.nix
@@ -1,17 +1,23 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let version = "1.100"; in
-fetchzip {
-  name = "ankacoder-condensed-${version}";
-  url = "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/anka-coder-fonts/AnkaCoderCondensed.${version}.zip";
+stdenvNoCC.mkDerivation rec {
+  pname = "ankacoder-condensed";
+  version = "1.100";
+
+  src = fetchzip {
+    url = "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/anka-coder-fonts/AnkaCoderCondensed.${version}.zip";
+    stripRoot = false;
+    hash = "sha256-NHrkV4Sb7i+DC4e4lToEYzah3pI+sKyYf2rGbhWj7iY=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  postFetch = ''
-    unzip $downloadedFile
     mkdir -p $out/share/fonts/truetype
     cp *.ttf $out/share/fonts/truetype
-  '';
 
-  sha256 = "0i80zpr2y9368rg2i6x8jv0g7d03kdyr5h7w9yz7pjd7i9xd8439";
+    runHook postInstall
+  '';
 
   meta = with lib; {
     description = "Anka/Coder Condensed font";
diff --git a/pkgs/data/fonts/anonymous-pro/default.nix b/pkgs/data/fonts/anonymous-pro/default.nix
index cb6ec6d89445..f498e2780b3c 100644
--- a/pkgs/data/fonts/anonymous-pro/default.nix
+++ b/pkgs/data/fonts/anonymous-pro/default.nix
@@ -1,17 +1,22 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "anonymouspro";
   version = "1.002";
-in fetchzip rec {
-  name = "anonymousPro-${version}";
 
-  url = "http://www.marksimonson.com/assets/content/fonts/AnonymousPro-${version}.zip";
-  postFetch = ''
-    mkdir -p $out/share/{doc,fonts}
-    unzip -j $downloadedFile \*.ttf                           -d $out/share/fonts/truetype
-    unzip -j $downloadedFile \*.txt                           -d "$out/share/doc/${name}"
+  src = fetchzip {
+    url = "https://www.marksimonson.com/assets/content/fonts/AnonymousPro-${lib.replaceStrings ["."] ["_"] version}.zip";
+    hash = "sha256-FhyzV4By8XKN9EyukAknzml/7lUuV6Evnt6Ht3H6TUU=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 *.ttf -t $out/share/fonts/truetype
+    install -Dm644 *.txt -t $out/share/doc/${pname}-${version}
+
+    runHook postInstall
   '';
-  sha256 = "05rgzag38qc77b31sm5i2vwwrxbrvwzfsqh3slv11skx36pz337f";
 
   meta = with lib; {
     homepage = "https://www.marksimonson.com/fonts/view/anonymous-pro";
diff --git a/pkgs/data/fonts/arphic/default.nix b/pkgs/data/fonts/arphic/default.nix
index 02e2a2de417b..ed55855e4347 100644
--- a/pkgs/data/fonts/arphic/default.nix
+++ b/pkgs/data/fonts/arphic/default.nix
@@ -1,22 +1,33 @@
-{ lib, fetchzip, mkfontscale, mkfontdir }:
+{ lib, stdenvNoCC, fetchurl, mkfontdir, mkfontscale }:
 
 let
   version = "0.2.20080216.2";
-in {
-  arphic-ukai = fetchzip {
-    name = "arphic-ukai-${version}";
+in
+{
+  arphic-ukai = stdenvNoCC.mkDerivation rec {
+    pname = "arphic-ukai";
+    inherit version;
 
-    url = "mirror://ubuntu/pool/main/f/fonts-arphic-ukai/fonts-arphic-ukai_${version}.orig.tar.bz2";
+    src = fetchurl {
+      url = "mirror://ubuntu/pool/main/f/fonts-${pname}/fonts-${pname}_${version}.orig.tar.bz2";
+      hash = "sha256-tJaNc1GfT4dH6FVI+4XSG2Zdob8bqQCnxJmXbmqK49I=";
+    };
+
+    nativeBuildInputs = [
+      mkfontscale
+      mkfontdir
+    ];
+
+    installPhase = ''
+      runHook preInstall
 
-    postFetch = ''
-      tar -xjvf $downloadedFile --strip-components=1
       install -D -v ukai.ttc $out/share/fonts/truetype/arphic-ukai.ttc
       cd $out/share/fonts
-      ${mkfontdir}/bin/mkfontdir
-      ${mkfontscale}/bin/mkfontscale
-    '';
+      mkfontdir
+      mkfontscale
 
-    sha256 = "0xi5ycm7ydzpn7cqxv1kcj9vd70nr9wn8v27hmibyjc25y2qdmzl";
+      runHook postInstall
+    '';
 
     meta = with lib; {
       description = "CJK Unicode font Kai style";
@@ -28,20 +39,30 @@ in {
     };
   };
 
-  arphic-uming = fetchzip {
-    name = "arphic-uming-${version}";
+  arphic-uming = stdenvNoCC.mkDerivation rec {
+    pname = "arphic-uming";
+    inherit version;
 
-    url = "mirror://ubuntu/pool/main/f/fonts-arphic-uming/fonts-arphic-uming_${version}.orig.tar.bz2";
+    src = fetchurl {
+      url = "mirror://ubuntu/pool/main/f/fonts-${pname}/fonts-${pname}_${version}.orig.tar.bz2";
+      hash = "sha256-48GeBOp6VltKz/bx5CSAhNLhB1LjBb991sdugIYNwds=";
+    };
+
+    nativeBuildInputs = [
+      mkfontscale
+      mkfontdir
+    ];
+
+    installPhase = ''
+      runHook preInstall
 
-    postFetch = ''
-      tar -xjvf $downloadedFile --strip-components=1
       install -D -v uming.ttc $out/share/fonts/truetype/arphic-uming.ttc
       cd $out/share/fonts
-      ${mkfontdir}/bin/mkfontdir
-      ${mkfontscale}/bin/mkfontscale
-    '';
+      mkfontdir
+      mkfontscale
 
-    sha256 = "16jybvj1cxamm682caj6nsm6l5c60x9mgchp1l2izrw2rvc8x38d";
+      runHook postInstall
+    '';
 
     meta = with lib; {
       description = "CJK Unicode font Ming style";
diff --git a/pkgs/data/fonts/baekmuk-ttf/default.nix b/pkgs/data/fonts/baekmuk-ttf/default.nix
index 92f7401b32da..3777f69fa567 100644
--- a/pkgs/data/fonts/baekmuk-ttf/default.nix
+++ b/pkgs/data/fonts/baekmuk-ttf/default.nix
@@ -1,15 +1,22 @@
-{ fetchzip }:
+{ lib, stdenvNoCC, fetchurl }:
 
-fetchzip rec {
-  name = "baekmuk-ttf-2.2";
+stdenvNoCC.mkDerivation rec {
+  pname = "baekmuk-ttf";
+  version = "2.2";
+
+  src = fetchurl {
+    url = "http://kldp.net/baekmuk/release/865-${pname}-${version}.tar.gz";
+    hash = "sha256-CKt9/7VdWIfMlCzjcPXjO3VqVfu06vC5DyRAcOjVGII=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  url = "http://kldp.net/baekmuk/release/865-${name}.tar.gz";
-  postFetch = ''
-    tar -xzvf $downloadedFile --strip-components=1
     install -m444 -Dt $out/share/fonts        ttf/*.ttf
-    install -m444 -Dt $out/share/doc/${name}  COPYRIGHT*
+    install -m444 -Dt $out/share/doc/${pname}-${version}  COPYRIGHT*
+
+    runHook postInstall
   '';
-  sha256 = "1jgsvack1l14q8lbcv4qhgbswi30mf045k37rl772hzcmx0r206g";
 
   meta = {
     description = "Korean font";
@@ -17,4 +24,3 @@ fetchzip rec {
     license = "BSD-like";
   };
 }
-
diff --git a/pkgs/data/fonts/bakoma-ttf/default.nix b/pkgs/data/fonts/bakoma-ttf/default.nix
index a8c01b41e676..1d305674e6aa 100644
--- a/pkgs/data/fonts/bakoma-ttf/default.nix
+++ b/pkgs/data/fonts/bakoma-ttf/default.nix
@@ -1,17 +1,23 @@
-{ fetchzip }:
+{ lib, stdenvNoCC, fetchurl }:
 
-fetchzip {
-  name = "bakoma-ttf";
+stdenvNoCC.mkDerivation rec {
+  pname = "bakoma-ttf";
+  version = "2.2";
 
-  url = "http://tarballs.nixos.org/sha256/1j1y3cq6ys30m734axc0brdm2q9n2as4h32jws15r7w5fwr991km";
+  src = fetchurl {
+    name = "${pname}.tar.bz2";
+    url = "http://tarballs.nixos.org/sha256/1j1y3cq6ys30m734axc0brdm2q9n2as4h32jws15r7w5fwr991km";
+    hash = "sha256-dYaUMneFn1yC5lIMSLQSNmFRW16AdUXGqWBobzAbPsg=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  postFetch = ''
-    tar xjvf $downloadedFile --strip-components=1
     mkdir -p $out/share/fonts/truetype
     cp ttf/*.ttf $out/share/fonts/truetype
-  '';
 
-  sha256 = "0g7i723n00cqx2va05z1h6v3a2ar69gqw4hy6pjj7m0ml906rngc";
+    runHook postInstall
+  '';
 
   meta = {
     description = "TrueType versions of the Computer Modern and AMS TeX Fonts";
diff --git a/pkgs/data/fonts/caladea/default.nix b/pkgs/data/fonts/caladea/default.nix
index 14a8de1b0d9e..bd00e807309a 100644
--- a/pkgs/data/fonts/caladea/default.nix
+++ b/pkgs/data/fonts/caladea/default.nix
@@ -1,19 +1,24 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchurl }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "caladea";
   version = "20130214";
-in fetchzip {
-  name = "caladea-${version}";
 
-  url = "https://commondatastorage.googleapis.com/chromeos-localmirror/distfiles/crosextrafonts-${version}.tar.gz";
-  postFetch = ''
-    tar -xzvf $downloadedFile --strip-components=1
+  src = fetchurl {
+    url = "https://commondatastorage.googleapis.com/chromeos-localmirror/distfiles/crosextrafonts-${version}.tar.gz";
+    hash = "sha256-xI0cL9YTycBslZw02nuDiAWeJAjSuxmEXcPtNfduTQk=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/etc/fonts/conf.d
     mkdir -p $out/share/fonts/truetype
     cp -v *.ttf $out/share/fonts/truetype
     cp -v ${./cambria-alias.conf} $out/etc/fonts/conf.d/30-cambria.conf
+
+    runHook postInstall
   '';
-  sha256 = "0kwm42ggr8kvcn3554cpmv90xzam1sdncx7x3zs3bzp88mxrnv1z";
 
   meta = with lib; {
     # This font doesn't appear to have any official web site but this
@@ -27,7 +32,7 @@ in fetchzip {
     '';
     license = licenses.asl20;
     platforms = platforms.all;
-    maintainers = [maintainers.rycee];
+    maintainers = [ maintainers.rycee ];
 
     # Reduce the priority of this package. The intent is that if you
     # also install the `vista-fonts` package, then you probably will
diff --git a/pkgs/data/fonts/camingo-code/default.nix b/pkgs/data/fonts/camingo-code/default.nix
index 626ff9f1c0a2..c852303021d0 100644
--- a/pkgs/data/fonts/camingo-code/default.nix
+++ b/pkgs/data/fonts/camingo-code/default.nix
@@ -1,19 +1,22 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "camingo-code";
   version = "1.0";
-in fetchzip rec {
-  name = "camingo-code-${version}";
 
-  url = "https://github.com/chrissimpkins/codeface/releases/download/font-collection/codeface-fonts.zip";
-  postFetch = ''
-    install -Dm644 $out/camingo-code/*.ttf -t $out/share/fonts/truetype
-    install -Dm644 $out/camingo-code/*.txt -t $out/share/doc/${name}
-    shopt -s extglob dotglob
-    rm -rf $out/!(share)
-    shopt -u extglob dotglob
+  src = fetchzip {
+    url = "https://github.com/chrissimpkins/codeface/releases/download/font-collection/codeface-fonts.zip";
+    hash = "sha256-oo5pWDq6h0bmyGvfF9Bkh7WyjKX4dG8uclfIsWLhDw8=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 camingo-code/*.ttf -t $out/share/fonts/truetype
+    install -Dm644 camingo-code/*.txt -t $out/share/doc/${pname}-${version}
+
+    runHook postInstall
   '';
-  sha256 = "sha256-/vDNuR034stmiCZ9jUH5DlTQJn0WccLY5treoziXOJo=";
 
   meta = with lib; {
     homepage = "https://www.myfonts.com/fonts/jan-fromm/camingo-code/";
diff --git a/pkgs/data/fonts/cardo/default.nix b/pkgs/data/fonts/cardo/default.nix
index 21763365de30..c862ea7ce889 100644
--- a/pkgs/data/fonts/cardo/default.nix
+++ b/pkgs/data/fonts/cardo/default.nix
@@ -1,20 +1,22 @@
-{ fetchzip, lib }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation {
+  pname = "cardo";
   version = "1.04";
-in
-fetchzip {
-  name = "cardo-${version}";
 
-  url = "http://scholarsfonts.net/cardo104.zip";
+  src = fetchzip {
+    url = "https://scholarsfonts.net/cardo104.zip";
+    stripRoot = false;
+    hash = "sha256-NU6/H5f0JBlVo3L3uUcl7IvNxPMXD8UQY9k5o2YA5Vo=";
+  };
 
-  hash = "sha256-eBK6+VQpreWA7jIneNXOcKFcT+cJzhoQ9XXyq93SZ8M=";
-  stripRoot = false;
+  installPhase = ''
+    runHook preInstall
 
-  postFetch = ''
     mkdir -p $out/share/fonts/truetype
-    mv $out/*.ttf $out/share/fonts/truetype
-    rm $out/*.pdf
+    mv *.ttf $out/share/fonts/truetype
+
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/data/fonts/carlito/default.nix b/pkgs/data/fonts/carlito/default.nix
index 0ecd3f85c693..283eb21a175f 100644
--- a/pkgs/data/fonts/carlito/default.nix
+++ b/pkgs/data/fonts/carlito/default.nix
@@ -1,18 +1,18 @@
-{ lib, fetchzip, stdenvNoCC }:
+{ lib, fetchurl, stdenvNoCC }:
 
 stdenvNoCC.mkDerivation rec {
   pname = "carlito";
   version = "20130920";
 
-  src = fetchzip {
+  src = fetchurl {
     url = "https://commondatastorage.googleapis.com/chromeos-localmirror/distfiles/crosextrafonts-carlito-${version}.tar.gz";
-    sha256 = "sha256-OGDO5WoF7OmiRdLRRrIXMzg276Pgeq1L3Offcl0W2jg=";
+    sha256 = "sha256-S9ErbLwyHBzxbaduLFhcklzpVqCAZ65vbGTv9sz9r1o=";
   };
 
   installPhase = ''
     mkdir -p $out/etc/fonts/conf.d
     mkdir -p $out/share/fonts/truetype
-    cp -v $src/*.ttf $out/share/fonts/truetype
+    cp -v *.ttf $out/share/fonts/truetype
     cp -v ${./calibri-alias.conf} $out/etc/fonts/conf.d/30-calibri.conf
   '';
 
@@ -28,7 +28,7 @@ stdenvNoCC.mkDerivation rec {
     '';
     license = licenses.ofl;
     platforms = platforms.all;
-    maintainers = [maintainers.rycee];
+    maintainers = [ maintainers.rycee ];
 
     # Reduce the priority of this package. The intent is that if you
     # also install the `vista-fonts` package, then you probably will
diff --git a/pkgs/data/fonts/cm-unicode/default.nix b/pkgs/data/fonts/cm-unicode/default.nix
index 3248813c3cb0..fc59baa5f9d2 100644
--- a/pkgs/data/fonts/cm-unicode/default.nix
+++ b/pkgs/data/fonts/cm-unicode/default.nix
@@ -1,19 +1,22 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchurl }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "cm-unicode";
   version = "0.7.0";
-in fetchzip rec {
-  name = "cm-unicode-${version}";
 
-  url = "mirror://sourceforge/cm-unicode/cm-unicode/${version}/${name}-otf.tar.xz";
+  src = fetchurl {
+    url = "mirror://sourceforge/cm-unicode/cm-unicode/${version}/${pname}-${version}-otf.tar.xz";
+    hash = "sha256-VIp+vk1IYbEHW15wMrfGVOPqg1zBZDpgFx+jlypOHCg=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  postFetch = ''
-    tar -xJvf $downloadedFile --strip-components=1
     install -m444 -Dt $out/share/fonts/opentype *.otf
-    install -m444 -Dt $out/share/doc/${name}    README FontLog.txt
-  '';
+    install -m444 -Dt $out/share/doc/${pname}-${version}    README FontLog.txt
 
-  sha256 = "1rzz7yhqq3lljyqxbg46jfzfd09qgpgx865lijr4sgc94riy1ypn";
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "https://cm-unicode.sourceforge.io/";
diff --git a/pkgs/data/fonts/cooper-hewitt/default.nix b/pkgs/data/fonts/cooper-hewitt/default.nix
index 48c7bc873428..5a3bb59c2519 100644
--- a/pkgs/data/fonts/cooper-hewitt/default.nix
+++ b/pkgs/data/fonts/cooper-hewitt/default.nix
@@ -1,18 +1,22 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-fetchzip rec {
+stdenvNoCC.mkDerivation rec {
   pname = "cooper-hewitt";
   version = "unstable-2014-06-09";
 
-  url = "https://web.archive.org/web/20221004145117/https://www.cooperhewitt.org/wp-content/uploads/fonts/CooperHewitt-OTF-public.zip";
+  src = fetchzip {
+    url = "https://web.archive.org/web/20221004145117/https://www.cooperhewitt.org/wp-content/uploads/fonts/CooperHewitt-OTF-public.zip";
+    hash = "sha256-bTlEXQeYNNspvnNdvQhJn6CNBrcSKYWuNWF/N6+3Vb0=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  postFetch = ''
     mkdir -p $out/share/fonts/opentype
-    mv $out/*.otf $out/share/fonts/opentype
-    find $out -maxdepth 1 ! -type d -exec rm {} +
-  '';
+    mv *.otf $out/share/fonts/opentype
 
-  sha256 = "01iwqmjvqkc6fmc2r0486vk06s6f51n9wxzl1pf9z48n0igj4gqd";
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "https://www.cooperhewitt.org/open-source-at-cooper-hewitt/cooper-hewitt-the-typeface-by-chester-jenkins/";
diff --git a/pkgs/data/fonts/crimson-pro/default.nix b/pkgs/data/fonts/crimson-pro/default.nix
index d07f5c94937a..29066b5ec3c3 100644
--- a/pkgs/data/fonts/crimson-pro/default.nix
+++ b/pkgs/data/fonts/crimson-pro/default.nix
@@ -13,8 +13,6 @@ stdenv.mkDerivation {
     hash = "sha256-3zFB1AMcC7eNEVA2Mx1OE8rLN9zPzexZ3FtER9wH5ss=";
   };
 
-  dontBuild = true;
-
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/data/fonts/crimson/default.nix b/pkgs/data/fonts/crimson/default.nix
index 9400ef06cf9a..1868c897bd53 100644
--- a/pkgs/data/fonts/crimson/default.nix
+++ b/pkgs/data/fonts/crimson/default.nix
@@ -1,25 +1,30 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchFromGitHub }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "crimson";
   version = "2014.10";
-in fetchzip rec {
-  name = "crimson-${version}";
 
-  url = "https://github.com/skosch/Crimson/archive/fonts-october2014.tar.gz";
+  src = fetchFromGitHub {
+    owner = "skosch";
+    repo = "Crimson";
+    rev = "fonts-october2014";
+    hash = "sha256-Wp9L77q93TRmrAr0P4iH9gm0tqFY0X/xSsuFcd19aAE=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  postFetch = ''
-    tar -xzvf $downloadedFile --strip-components=1
     install -m444 -Dt $out/share/fonts/opentype "Desktop Fonts/OTF/"*.otf
-    install -m444 -Dt $out/share/doc/${name}    README.md
-  '';
+    install -m444 -Dt $out/share/doc/${pname}-${version}    README.md
 
-  sha256 = "0mg65f0ydyfmb43jqr1f34njpd10w8npw15cbb7z0nxmy4nkl842";
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "https://github.com/skosch/Crimson";
     description = "A font family inspired by beautiful oldstyle typefaces";
     license = licenses.ofl;
     platforms = platforms.all;
-    maintainers = [maintainers.rycee];
+    maintainers = [ maintainers.rycee ];
   };
 }
diff --git a/pkgs/data/fonts/culmus/default.nix b/pkgs/data/fonts/culmus/default.nix
index 00c472d7fe34..28a7f4385a01 100644
--- a/pkgs/data/fonts/culmus/default.nix
+++ b/pkgs/data/fonts/culmus/default.nix
@@ -1,12 +1,17 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchurl }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "culmus";
   version = "0.133";
-in fetchzip {
-  name = "culmus-${version}";
-  url = "mirror://sourceforge/culmus/culmus/${version}/culmus-${version}.tar.gz";
-  postFetch = ''
-    tar xf $downloadedFile --strip=1
+
+  src = fetchurl {
+    url = "mirror://sourceforge/${pname}/${pname}/${version}/${pname}-${version}.tar.gz";
+    hash = "sha256-wMaHN0LQdUT2us8q1S65yzkpdNVkJ5ONwd+8g5nGTQU=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/share/fonts/{truetype,type1}
     cp -v *.pfa $out/share/fonts/type1/
     cp -v *.afm $out/share/fonts/type1/
@@ -14,8 +19,9 @@ in fetchzip {
     cp -v *.ttf $out/share/fonts/truetype/
     cp -v *.otf $out/share/fonts/truetype/
     cp -v fonts.scale-ttf $out/share/fonts/truetype/fonts.scale
+
+    runHook postInstall
   '';
-  sha256 = "0zqqjcrqmbd4389hqz2dwymkkcxjrq9ylyriiv3gbmzl6l1ffk3g";
 
   meta = {
     description = "Culmus Hebrew fonts";
diff --git a/pkgs/data/fonts/dm-sans/default.nix b/pkgs/data/fonts/dm-sans/default.nix
index f7b556fe538d..c2d8f33eff69 100644
--- a/pkgs/data/fonts/dm-sans/default.nix
+++ b/pkgs/data/fonts/dm-sans/default.nix
@@ -1,15 +1,22 @@
-{ lib, fetchzip }:
-let version = "1.002"; in
-fetchzip {
-  inherit version;
-  pname = "dm-sans";
-  url = "https://github.com/googlefonts/dm-fonts/releases/download/v${version}/DeepMindSans_v${version}.zip";
-  stripRoot = false;
-  hash = "sha256-zyS0gz7CGn39HCiyeN5cAP63v9nG6jffGSsI1vr84EQ=";
+{ lib, stdenvNoCC, fetchzip }:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "dm-sans";
+  version = "1.002";
+
+  src = fetchzip {
+    url = "https://github.com/googlefonts/dm-fonts/releases/download/v${version}/DeepMindSans_v${version}.zip";
+    stripRoot = false;
+    hash = "sha256-RSHHxiCac18qqF+hW5M3BbBcra4AQpNLLlUmhiWj9f8=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  postFetch = ''
     mkdir -p $out/share/fonts/truetype
-    mv $out/*.ttf $out/share/fonts/truetype
+    mv *.ttf $out/share/fonts/truetype
+
+    runHook postInstall
   '';
 
   meta = {
diff --git a/pkgs/data/fonts/dotcolon-fonts/default.nix b/pkgs/data/fonts/dotcolon-fonts/default.nix
new file mode 100644
index 000000000000..fcd439ce30c7
--- /dev/null
+++ b/pkgs/data/fonts/dotcolon-fonts/default.nix
@@ -0,0 +1,49 @@
+{ lib
+, symlinkJoin
+, aileron
+, vegur
+, f5_6
+, tenderness
+, medio
+, ferrum
+, seshat
+, penna
+, eunomia
+, route159
+, f1_8
+, nacelle
+, melete
+, fa_1
+}:
+
+symlinkJoin {
+  name = "dotcolon-fonts";
+
+  paths = [
+    aileron
+    vegur
+    f5_6
+    tenderness
+    medio
+    ferrum
+    seshat
+    penna
+    eunomia
+    route159
+    f1_8
+    nacelle
+    melete
+    fa_1
+  ];
+
+  meta = {
+    description = "Font Collection by Sora Sagano";
+
+    homepage = "https://dotcolon.net/";
+
+    license = with lib.licenses; [ cc0 ofl ];
+
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ minijackson ];
+  };
+}
diff --git a/pkgs/data/fonts/efont-unicode/default.nix b/pkgs/data/fonts/efont-unicode/default.nix
index f4ea61cbc9eb..e45bdab7a4d8 100644
--- a/pkgs/data/fonts/efont-unicode/default.nix
+++ b/pkgs/data/fonts/efont-unicode/default.nix
@@ -1,12 +1,12 @@
-{ lib, stdenv, fetchzip, libfaketime, xorg }:
+{ lib, stdenv, fetchurl, libfaketime, xorg }:
 
 stdenv.mkDerivation rec {
   pname = "efont-unicode";
   version = "0.4.2";
 
-  src = fetchzip {
+  src = fetchurl {
     url = "http://openlab.ring.gr.jp/efont/dist/unicode-bdf/${pname}-bdf-${version}.tar.bz2";
-    sha256 = "0bib3jgikq8s1m96imw4mlgbl5cbq1bs5sqig74s2l2cdfx3jaqc";
+    sha256 = "sha256-fT7SsYlV3dCQrf0IZfiNI1grj3ngDgr8IkWdg+f9m3M=";
   };
 
   nativeBuildInputs = with xorg;
diff --git a/pkgs/data/fonts/eunomia/default.nix b/pkgs/data/fonts/eunomia/default.nix
index 272649582c35..a09a0ad0d782 100644
--- a/pkgs/data/fonts/eunomia/default.nix
+++ b/pkgs/data/fonts/eunomia/default.nix
@@ -1,27 +1,32 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
 let
   majorVersion = "0";
   minorVersion = "200";
-  pname = "eunomia";
 in
+stdenvNoCC.mkDerivation (self: {
+  pname = "eunomia";
+  version = "${majorVersion}.${minorVersion}";
 
-fetchzip {
-  name = "${pname}-font-${majorVersion}.${minorVersion}";
+  src = fetchzip {
+    url = "https://dotcolon.net/download/fonts/${self.pname}_${majorVersion}${minorVersion}.zip";
+    hash = "sha256-Rd2EakaTWjzoEV00tHTgg/bXgJUFfPjCyQUWi7QhFG4=";
+    stripRoot = false;
+  };
 
-  url = "http://dotcolon.net/DL/font/${pname}_${majorVersion}${minorVersion}.zip";
-  sha256 = "0lpmczs1d4p9dy4s0dnvv7bl5cd0f6yzyasfrkxij5s86glps38b";
+  installPhase = ''
+    runHook preInstall
 
-  postFetch = ''
-    mkdir -p $out/share/fonts/opentype/${pname}
-    unzip -j $downloadedFile \*.otf  -d $out/share/fonts/opentype/${pname}
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
   '';
 
   meta = with lib; {
     homepage = "http://dotcolon.net/font/eunomia/";
     description = "A futuristic decorative font";
     platforms = platforms.all;
-    maintainers = with maintainers; [ leenaars ];
+    maintainers = with maintainers; [ leenaars minijackson ];
     license = licenses.ofl;
   };
-}
+})
diff --git a/pkgs/data/fonts/f1_8/default.nix b/pkgs/data/fonts/f1_8/default.nix
new file mode 100644
index 000000000000..5898fe1eabaf
--- /dev/null
+++ b/pkgs/data/fonts/f1_8/default.nix
@@ -0,0 +1,33 @@
+{ lib, stdenvNoCC, fetchzip }:
+
+let
+  majorVersion = "1";
+  minorVersion = "101";
+in
+stdenvNoCC.mkDerivation (self: {
+  pname = "f1_8";
+  version = "${majorVersion}.${minorVersion}";
+
+  src = fetchzip {
+    url = "https://note.com/api/v2/attachments/download/d83b2c4ec63d7826acaa76725d261ff4";
+    hash = "sha256-pe1G8WeFAo+KYjjsNwn0JmtXFn9QugE1SeGwaqnl1F0=";
+    stripRoot = false;
+    extension = "zip";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "http://dotcolon.net/font/${self.pname}/";
+    description = "A weighted decorative font";
+    platforms = platforms.all;
+    maintainers = with maintainers; [ minijackson ];
+    license = licenses.ofl;
+  };
+})
diff --git a/pkgs/data/fonts/f5_6/default.nix b/pkgs/data/fonts/f5_6/default.nix
index 112111faa3d7..a37ee591ef48 100644
--- a/pkgs/data/fonts/f5_6/default.nix
+++ b/pkgs/data/fonts/f5_6/default.nix
@@ -1,27 +1,32 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
 let
   majorVersion = "0";
   minorVersion = "110";
-  pname = "f5_6";
 in
+stdenvNoCC.mkDerivation (self: {
+  pname = "f5_6";
+  version = "${majorVersion}.${minorVersion}";
 
-fetchzip {
-  name = "${pname}-font-${majorVersion}.${minorVersion}";
+  src = fetchzip {
+    url = "https://dotcolon.net/download/fonts/${self.pname}_${majorVersion}${minorVersion}.zip";
+    hash = "sha256-FeCU+mzR0iO5tixI72XUnhvpGj+WRfKyT3mhBtud3uE=";
+    stripRoot = false;
+  };
 
-  url = "http://dotcolon.net/DL/font/${pname}_${majorVersion}${minorVersion}.zip";
-  sha256 = "04p6lccd26rhjbpq3ddxi5vkk3lk8lqbpnk8lakjzixp3fgdqpp4";
+  installPhase = ''
+    runHook preInstall
 
-  postFetch = ''
-    mkdir -p $out/share/fonts/opentype/${pname}
-    unzip -j $downloadedFile \*.otf  -d $out/share/fonts/opentype/${pname}
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
   '';
 
   meta = with lib; {
-    homepage = "http://dotcolon.net/font/${pname}/";
+    homepage = "http://dotcolon.net/font/${self.pname}/";
     description = "A weighted decorative font";
     platforms = platforms.all;
-    maintainers = with maintainers; [ leenaars ];
+    maintainers = with maintainers; [ leenaars minijackson ];
     license = licenses.ofl;
   };
-}
+})
diff --git a/pkgs/data/fonts/fa_1/default.nix b/pkgs/data/fonts/fa_1/default.nix
new file mode 100644
index 000000000000..4e8ab3cbaa83
--- /dev/null
+++ b/pkgs/data/fonts/fa_1/default.nix
@@ -0,0 +1,32 @@
+{ lib, stdenvNoCC, fetchzip }:
+
+let
+  majorVersion = "0";
+  minorVersion = "100";
+in
+stdenvNoCC.mkDerivation (self: {
+  pname = "fa_1";
+  version = "${majorVersion}.${minorVersion}";
+
+  src = fetchzip {
+    url = "https://dotcolon.net/download/fonts/${self.pname}_${majorVersion}${minorVersion}.zip";
+    hash = "sha256-BPJ+wZMYXY/yg5oEgBc5YnswA6A7w6V0gdv+cac0qdc=";
+    stripRoot = false;
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "http://dotcolon.net/font/${self.pname}/";
+    description = "A weighted decorative font";
+    platforms = platforms.all;
+    maintainers = with maintainers; [ minijackson ];
+    license = licenses.ofl;
+  };
+})
diff --git a/pkgs/data/fonts/fantasque-sans-mono/default.nix b/pkgs/data/fonts/fantasque-sans-mono/default.nix
index e8068d7faead..d4d60d95bc94 100644
--- a/pkgs/data/fonts/fantasque-sans-mono/default.nix
+++ b/pkgs/data/fonts/fantasque-sans-mono/default.nix
@@ -1,22 +1,24 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "fantasque-sans-mono";
   version = "1.8.0";
-in
 
-fetchzip rec {
-  name = "fantasque-sans-mono-${version}";
+  src = fetchzip {
+    url = "https://github.com/belluzj/fantasque-sans/releases/download/v${version}/FantasqueSansMono-Normal.zip";
+    stripRoot = false;
+    hash = "sha256-MNXZoDPi24xXHXGVADH16a3vZmFhwX0Htz02+46hWFc=";
+  };
 
-  url = "https://github.com/belluzj/fantasque-sans/releases/download/v${version}/FantasqueSansMono-Normal.zip";
+  installPhase = ''
+    runHook preInstall
 
-  postFetch = ''
-    mkdir -p $out/share/{doc,fonts}
-    unzip -j $downloadedFile \*.otf    -d $out/share/fonts/opentype
-    unzip -j $downloadedFile README.md -d $out/share/doc/${name}
+    install -Dm644 OTF/*.otf -t $out/share/fonts/opentype
+    install -Dm644 README.md -t $out/share/doc/${pname}-${version}
+
+    runHook postInstall
   '';
 
-  sha256 = "07y2w6xzkbaj6vr95fvvnmwq1pw9jib4z02xf8937dx812yic9ni";
-
   meta = with lib; {
     homepage = "https://github.com/belluzj/fantasque-sans";
     description = "A font family with a great monospaced variant for programmers";
diff --git a/pkgs/data/fonts/ferrum/default.nix b/pkgs/data/fonts/ferrum/default.nix
index 3f122d22daf5..33b3813cca38 100644
--- a/pkgs/data/fonts/ferrum/default.nix
+++ b/pkgs/data/fonts/ferrum/default.nix
@@ -1,27 +1,32 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
 let
   majorVersion = "0";
   minorVersion = "200";
-  pname = "ferrum";
 in
+stdenvNoCC.mkDerivation (self: {
+  pname = "ferrum";
+  version = "${majorVersion}.${minorVersion}";
 
-fetchzip {
-  name = "${pname}-font-${majorVersion}.${minorVersion}";
+  src = fetchzip {
+    url = "https://dotcolon.net/download/fonts/${self.pname}_${majorVersion}${minorVersion}.zip";
+    hash = "sha256-NDJwgFWZgyhMkGRWlY55l2omEw6ju3e3dHCEsWNzQIc=";
+    stripRoot = false;
+  };
 
-  url = "http://dotcolon.net/DL/font/${pname}.zip";
-  sha256 = "1w1b3ch7ik4264f05lxms01ls0aargvlx770a9szm682dfmizn8w";
+  installPhase = ''
+    runHook preInstall
 
-  postFetch = ''
-    mkdir -p $out/share/fonts/opentype/${pname}
-    unzip -j $downloadedFile \*.otf  -d $out/share/fonts/opentype/${pname}
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
   '';
 
   meta = with lib; {
-    homepage = "http://dotcolon.net/font/${pname}/";
+    homepage = "http://dotcolon.net/font/${self.pname}/";
     description = "A decorative font";
     platforms = platforms.all;
-    maintainers = with maintainers; [ leenaars ];
+    maintainers = with maintainers; [ leenaars minijackson ];
     license = licenses.cc0;
   };
-}
+})
diff --git a/pkgs/data/fonts/fira-go/default.nix b/pkgs/data/fonts/fira-go/default.nix
index 2d5952523a60..a850d7d2e97c 100644
--- a/pkgs/data/fonts/fira-go/default.nix
+++ b/pkgs/data/fonts/fira-go/default.nix
@@ -1,25 +1,23 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation {
   pname = "fira-go";
   version = "1.001";
-  user = "bBoxType";
-  repo = "FiraGo";
-  rev = "9882ba0851f88ab904dc237f250db1d45641f45d";
-in
-fetchzip {
-  name = "${pname}-${version}";
 
-  url = "https://github.com/${user}/${repo}/archive/${rev}.zip";
+  src = fetchzip {
+    url = "https://github.com/bBoxType/FiraGo/archive/9882ba0851f88ab904dc237f250db1d45641f45d.zip";
+    hash = "sha256-WwgPg7OLrXBjR6oHG5061RO3HeNkj2Izs6ktwIxVw9o=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  postFetch = ''
     mkdir -p $out/share/fonts/opentype
-    mv $out/Fonts/FiraGO_OTF_1001/{Roman,Italic}/*.otf \
+    mv Fonts/FiraGO_OTF_1001/{Roman,Italic}/*.otf \
       $out/share/fonts/opentype
-    rm -r $out/{Fonts,'Technical Report PDF',OFL.txt,README.md,*.pdf}
-  '';
 
-  sha256 = "sha256-MDGRba1eao/yVzSuncJ/nvCG8cpdrI4roVPI1G9qCbU=";
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "https://bboxtype.com/typefaces/FiraGO";
diff --git a/pkgs/data/fonts/garamond-libre/default.nix b/pkgs/data/fonts/garamond-libre/default.nix
index 202ae2ce41f1..bd16afaf1895 100644
--- a/pkgs/data/fonts/garamond-libre/default.nix
+++ b/pkgs/data/fonts/garamond-libre/default.nix
@@ -1,21 +1,23 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-fetchzip rec {
+stdenvNoCC.mkDerivation rec {
   pname = "garamond-libre";
   version = "1.4";
 
-  url = "https://github.com/dbenjaminmiller/garamond-libre/releases/download/${version}/garamond-libre_${version}.zip";
-  stripRoot = false;
+  src = fetchzip {
+    url = "https://github.com/dbenjaminmiller/garamond-libre/releases/download/${version}/garamond-libre_${version}.zip";
+    stripRoot = false;
+    hash = "sha256-cD/JMICtb6MPIUcWs2VOTHnb/05ma0/KKtPyR4oJlIc=";
+  };
 
-  postFetch = ''
-    install -Dm644 $out/*.otf -t $out/share/fonts/opentype
-    shopt -s extglob dotglob
-    rm -rf $out/!(share)
-    shopt -u extglob dotglob
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 *.otf -t $out/share/fonts/opentype
+
+    runHook postInstall
   '';
 
-  sha256 = "6WiuUe3CHXXL/0G7wURvSIgWPQ4isl50e3OBQ+ui0U4=";
-
   meta = with lib; {
     homepage = "https://github.com/dbenjaminmiller/garamond-libre";
     description = "Garamond Libre font family";
diff --git a/pkgs/data/fonts/go-font/default.nix b/pkgs/data/fonts/go-font/default.nix
index 45041bb805d9..63d62ec2e82e 100644
--- a/pkgs/data/fonts/go-font/default.nix
+++ b/pkgs/data/fonts/go-font/default.nix
@@ -1,22 +1,26 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "go-font";
   version = "2.010";
-  rev = "41969df76e82aeec85fa3821b1e24955ea993001";
-in (fetchzip {
-  name = "go-font-${version}";
-  url = "https://go.googlesource.com/image/+archive/${rev}/font/gofont/ttfs.tar.gz";
-  stripRoot = false;
 
-  postFetch = ''
+  src = fetchzip {
+    url = "https://go.googlesource.com/image/+archive/41969df76e82aeec85fa3821b1e24955ea993001/font/gofont/ttfs.tar.gz";
+    stripRoot = false;
+    hash = "sha256-rdzt51wY4b7HEr7W/0Ar/FB0zMyf+nKLsOT+CRSEP3o=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/share/fonts/truetype
     mkdir -p $out/share/doc/go-font
-    mv $out/*.ttf $out/share/fonts/truetype
-    mv $out/README $out/share/doc/go-font/LICENSE
+    mv *.ttf $out/share/fonts/truetype
+    mv README $out/share/doc/go-font/LICENSE
+
+    runHook postInstall
   '';
 
-  sha256 = "175jwq16qjnd2k923n9gcbjizchy7yv4n41dm691sjwrhbl0b13x";
-}) // {
   meta = with lib; {
     homepage = "https://blog.golang.org/go-fonts";
     description = "The Go font family";
@@ -24,6 +28,5 @@ in (fetchzip {
     license = licenses.bsd3;
     maintainers = with maintainers; [ sternenseemann ];
     platforms = lib.platforms.all;
-    hydraPlatforms = [];
   };
 }
diff --git a/pkgs/data/fonts/gyre/default.nix b/pkgs/data/fonts/gyre/default.nix
index 63633ffcda72..254766d1de28 100644
--- a/pkgs/data/fonts/gyre/default.nix
+++ b/pkgs/data/fonts/gyre/default.nix
@@ -1,15 +1,23 @@
-# when changing this expression convert it from 'fetchzip' to 'stdenvNoCC.mkDerivation'
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
-  baseName = "gyre-fonts";
+stdenvNoCC.mkDerivation rec {
+  pname = "gyre-fonts";
   version = "2.005";
-in (fetchzip {
-  name="${baseName}-${version}";
 
-  url = "http://www.gust.org.pl/projects/e-foundry/tex-gyre/whole/tg-${version}otf.zip";
+  src = fetchzip {
+    url = "http://www.gust.org.pl/projects/e-foundry/tex-gyre/whole/tg-${version}otf.zip";
+    stripRoot = false;
+    hash = "sha256-+6IufuFf+IoLXoZEPlfHUNgRhKrQNBEZ1OwPD9/uOjg=";
+  };
 
-  sha256 = "17amdpahs6kn7hk3dqxpff1s095cg1caxzij3mxjbbxp8zy0l111";
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/fonts/truetype
+    cp *.otf $out/share/fonts/truetype
+
+    runHook postInstall
+  '';
 
   meta = {
     description = "OpenType fonts from the Gyre project, suitable for use with (La)TeX";
@@ -25,9 +33,4 @@ in (fetchzip {
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ bergey ];
   };
-}).overrideAttrs (_: {
-  postFetch = ''
-    mkdir -p $out/share/fonts
-    unzip -j $downloadedFile \*.otf -d $out/share/fonts/truetype
-  '';
-})
+}
diff --git a/pkgs/data/fonts/hackgen/default.nix b/pkgs/data/fonts/hackgen/default.nix
index b60ccb87fbb7..24c3b7af374f 100644
--- a/pkgs/data/fonts/hackgen/default.nix
+++ b/pkgs/data/fonts/hackgen/default.nix
@@ -1,18 +1,20 @@
-{ lib
-, fetchzip
-}:
+{ lib, stdenvNoCC, fetchzip }:
 
-fetchzip rec {
+stdenvNoCC.mkDerivation rec {
   pname = "hackgen-font";
   version = "2.8.0";
 
-  url = "https://github.com/yuru7/HackGen/releases/download/v${version}/HackGen_v${version}.zip";
-  sha256 = "sha256-TLqns6ulovHRKoLHxxwKpj6SqfCq5UDVBf7gUASCGK4=";
-  postFetch = ''
-    install -Dm644 $out/*.ttf -t $out/share/fonts/hackgen
-    shopt -s extglob dotglob
-    rm -rf $out/!(share)
-    shopt -u extglob dotglob
+  src = fetchzip {
+    url = "https://github.com/yuru7/HackGen/releases/download/v${version}/HackGen_v${version}.zip";
+    hash = "sha256-vKbiM3QUryey0m6oilO0lT6+efkCTLCwdtPF7PinkmU=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 *.ttf -t $out/share/fonts/hackgen
+
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/data/fonts/hackgen/nerdfont.nix b/pkgs/data/fonts/hackgen/nerdfont.nix
index f563a2eb479b..54bec95c59ce 100644
--- a/pkgs/data/fonts/hackgen/nerdfont.nix
+++ b/pkgs/data/fonts/hackgen/nerdfont.nix
@@ -1,18 +1,20 @@
-{ lib
-, fetchzip
-}:
+{ lib, stdenvNoCC, fetchzip }:
 
-fetchzip rec {
+stdenvNoCC.mkDerivation rec {
   pname = "hackgen-nf-font";
   version = "2.8.0";
 
-  url = "https://github.com/yuru7/HackGen/releases/download/v${version}/HackGen_NF_v${version}.zip";
-  sha256 = "sha256-xRFedeavEJY9OZg+gePF5ImpLTYdbSba5Wr9k0ivpkE=";
-  postFetch = ''
-    install -Dm644 $out/*.ttf -t $out/share/fonts/hackgen-nf
-    shopt -s extglob dotglob
-    rm -rf $out/!(share)
-    shopt -u extglob dotglob
+  src = fetchzip {
+    url = "https://github.com/yuru7/HackGen/releases/download/v${version}/HackGen_NF_v${version}.zip";
+    hash = "sha256-RLEq5IoA3gk/IzabV8wdJYj8yMpbWQVz+Qunef6oNOs=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 *.ttf -t $out/share/fonts/hackgen-nf
+
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/data/fonts/hannom/default.nix b/pkgs/data/fonts/hannom/default.nix
index 72ba87fb17f9..d91de86c532b 100644
--- a/pkgs/data/fonts/hannom/default.nix
+++ b/pkgs/data/fonts/hannom/default.nix
@@ -10,8 +10,6 @@ stdenvNoCC.mkDerivation rec {
     hash = "sha256-Oh8V72tYvVA6Sk0f9UTIkRQYjdUbEB/fmCSaRYfyoP8=";
   };
 
-  dontBuild = true;
-
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/data/fonts/helvetica-neue-lt-std/default.nix b/pkgs/data/fonts/helvetica-neue-lt-std/default.nix
index 7e69ff70d625..61dc6ba14e29 100644
--- a/pkgs/data/fonts/helvetica-neue-lt-std/default.nix
+++ b/pkgs/data/fonts/helvetica-neue-lt-std/default.nix
@@ -1,24 +1,23 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation {
+  name = "helvetica-neue-lt-std";
   version = "2014.08.16"; # date of most recent file in distribution
-in fetchzip {
-  name = "helvetica-neue-lt-std-${version}";
 
-  url = "https://web.archive.org/web/20190823153624/http://ephifonts.com/downloads/helvetica-neue-lt-std.zip";
+  src = fetchzip {
+    url = "https://web.archive.org/web/20190823153624/http://ephifonts.com/downloads/helvetica-neue-lt-std.zip";
+    stripRoot = false;
+    hash = "sha256-ytoTTrnwN1lMw/gTxS4DRAq+tV5WzB2xHP4vVxLZ1ZI=";
+  };
 
-  stripRoot = false;
+  installPhase = ''
+    runHook preInstall
 
-  postFetch = ''
-    mkdir -p $out/share/fonts
-    install -Dm644 $out/'Helvetica Neue LT Std'/*.otf -t $out/share/fonts/opentype
-    shopt -s extglob dotglob
-    rm -rf $out/!(share)
-    shopt -u extglob dotglob
+    install -Dm644 'Helvetica Neue LT Std'/*.otf -t $out/share/fonts/opentype
+
+    runHook postInstall
   '';
 
-  sha256 = "sha256-gM/QXrKI2xrrCBYt4R+Fk5Tj0AIkrnCP/pwgh0A/MyI=";
-
   meta = with lib; {
     homepage = "https://web.archive.org/web/20190926040940/http://www.ephifonts.com/free-helvetica-font-helvetica-neue-lt-std.html";
     description = "Helvetica Neue LT Std font";
diff --git a/pkgs/data/fonts/hermit/default.nix b/pkgs/data/fonts/hermit/default.nix
index 999a8995b46e..3ff770522d9e 100644
--- a/pkgs/data/fonts/hermit/default.nix
+++ b/pkgs/data/fonts/hermit/default.nix
@@ -1,21 +1,22 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
   pname = "hermit";
   version = "2.0";
-in fetchzip rec {
-  name = "${pname}-${version}";
 
-  url = "https://pcaro.es/d/otf-${name}.tar.gz";
+  src = fetchzip {
+    url = "https://pcaro.es/d/otf-${pname}-${version}.tar.gz";
+    stripRoot = false;
+    hash = "sha256-RYXZ2yJ8BIxsgeEwhXz7g0NnWG3kMPZoJaOLMUQyWWQ=";
+  };
 
-  stripRoot = false;
-  postFetch = ''
-    install -m444 -Dt $out/share/fonts/opentype $out/*.otf
-    shopt -s extglob dotglob
-    rm -rf $out/!(share)
-    shopt -u extglob dotglob
+  installPhase = ''
+    runHook preInstall
+
+    install -m444 -Dt $out/share/fonts/opentype *.otf
+
+    runHook postInstall
   '';
-  sha256 = "127hnpxicqya7v1wmzxxqafq3aj1n33i4j5ncflbw6gj5g3bizwl";
 
   meta = with lib; {
     description = "monospace font designed to be clear, pragmatic and very readable";
@@ -25,4 +26,3 @@ in fetchzip rec {
     platforms = platforms.all;
   };
 }
-
diff --git a/pkgs/data/fonts/julia-mono/default.nix b/pkgs/data/fonts/julia-mono/default.nix
index 66e91df010d6..47b1afd36fd9 100644
--- a/pkgs/data/fonts/julia-mono/default.nix
+++ b/pkgs/data/fonts/julia-mono/default.nix
@@ -1,20 +1,22 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "JuliaMono-ttf";
   version = "0.046";
 
-in
-fetchzip {
-  name = "JuliaMono-ttf-${version}";
-  url = "https://github.com/cormullion/juliamono/releases/download/v${version}/JuliaMono-ttf.tar.gz";
-  sha256 = "sha256-+Ro517m1unQskQFhsT6oiz19aov87/tT1jlP/XB7kFU=";
+  src = fetchzip {
+    url = "https://github.com/cormullion/juliamono/releases/download/v${version}/${pname}.tar.gz";
+    stripRoot = false;
+    hash = "sha256-mq37L3bhUhdjB8z3I9i8+wyLrMSsu/nZrZXOuqE3JlU=";
+  };
 
-  stripRoot = false;
+  installPhase = ''
+    runHook preInstall
 
-  postFetch = ''
     mkdir -p $out/share/fonts/truetype
-    mv $out/*.ttf $out/share/fonts/truetype
-    rm $out/LICENSE
+    mv *.ttf $out/share/fonts/truetype
+
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/data/fonts/kacst/default.nix b/pkgs/data/fonts/kacst/default.nix
index 38f85d2ad0fc..aa5ed8b547da 100644
--- a/pkgs/data/fonts/kacst/default.nix
+++ b/pkgs/data/fonts/kacst/default.nix
@@ -1,16 +1,21 @@
-{ fetchzip, lib }:
+{ lib, stdenvNoCC, fetchurl }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "kacst";
   version = "2.01";
-in
-fetchzip {
-  name = "kacst-${version}";
-  url = "mirror://debian/pool/main/f/fonts-kacst/fonts-kacst_${version}+mry.orig.tar.bz2";
-  sha256 = "sha256-pIO58CXfmKYRKYJ1oI+tjTwlKBRnkZ/CpIM2Xa0CDA4=";
 
-  postFetch = ''
+  src = fetchurl {
+    url = "mirror://debian/pool/main/f/fonts-${pname}/fonts-${pname}_${version}+mry.orig.tar.bz2";
+    hash = "sha256-byiZzpYiMU6kJs+NSISfHPFzAnJtc8toNIbV/fKiMzg=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/share/fonts
-    tar xjf $downloadedFile --strip-components=1 -C $out/share/fonts
+    cp -R kacst $out/share/fonts
+
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/data/fonts/khmeros/default.nix b/pkgs/data/fonts/khmeros/default.nix
index 28db0d00981d..5df7c3637be8 100644
--- a/pkgs/data/fonts/khmeros/default.nix
+++ b/pkgs/data/fonts/khmeros/default.nix
@@ -1,20 +1,21 @@
-{ fetchzip, lib }:
+{ lib, stdenvNoCC, fetchurl }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "khmeros";
   version = "5.0";
-in
-fetchzip {
-  name = "khmeros-${version}";
-  url = "mirror://debian/pool/main/f/fonts-khmeros/fonts-khmeros_${version}.orig.tar.xz";
-  sha256 = "sha256-pS+7RQbGwlBxdCfSVxHmARCAkZrZttwYNlV/CrxqI+w=";
 
-  postFetch = ''
-    unpackDir="$TMPDIR/unpack"
-    mkdir "$unpackDir"
-    cd "$unpackDir"
-    tar xf "$downloadedFile" --strip-components=1
+  src = fetchurl {
+    url = "mirror://debian/pool/main/f/fonts-${pname}/fonts-${pname}_${version}.orig.tar.xz";
+    hash = "sha256-gBcM9YHSuhbxvwfQTvywH/5kN921GOyvGtkROcmcBiw=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/share/fonts
     cp *.ttf $out/share/fonts
+
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/data/fonts/lao/default.nix b/pkgs/data/fonts/lao/default.nix
index abe359410b3a..d7d5d3ddd4b1 100644
--- a/pkgs/data/fonts/lao/default.nix
+++ b/pkgs/data/fonts/lao/default.nix
@@ -1,16 +1,21 @@
-{ fetchzip, lib }:
+{ lib, stdenvNoCC, fetchurl }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "lao";
   version = "0.0.20060226";
-in
-fetchzip {
-  name = "lao-${version}";
-  url = "mirror://debian/pool/main/f/fonts-lao/fonts-lao_${version}.orig.tar.xz";
-  sha256 = "sha256-Ti3DNOgLR5VBJ1mSe8M+qs4UYbCR7qOPgqxRfmHa+jY=";
 
-  postFetch = ''
+  src = fetchurl {
+    url = "mirror://debian/pool/main/f/fonts-${pname}/fonts-${pname}_${version}.orig.tar.xz";
+    hash = "sha256-DlgdyfhxxzVkNIL+NGsQ+PRlNkCuG3v2OahkIEYx60o=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/share/fonts
-    tar xf $downloadedFile --strip-components=1 -C $out/share/fonts fonts-lao-${version}/Phetsarath_OT.ttf
+    cp Phetsarath_OT.ttf $out/share/fonts
+
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/data/fonts/lklug-sinhala/default.nix b/pkgs/data/fonts/lklug-sinhala/default.nix
index 45f907f1cf07..817dbbb25312 100644
--- a/pkgs/data/fonts/lklug-sinhala/default.nix
+++ b/pkgs/data/fonts/lklug-sinhala/default.nix
@@ -1,16 +1,21 @@
-{ fetchzip, lib }:
+{ lib, stdenvNoCC, fetchurl }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "lklug-sinhala";
   version = "0.6";
-in
-fetchzip {
-  name = "lklug-sinhala-${version}";
-  url = "mirror://debian/pool/main/f/fonts-lklug-sinhala/fonts-lklug-sinhala_${version}.orig.tar.xz";
-  sha256 = "sha256-Fy+QnAajA4yLf/I1vOQll5pRd0ZLfLe8UXq4XMC9qNc=";
 
-  postFetch = ''
-    mkdir -p $out/share/fonts
-    tar xf $downloadedFile --strip-components=1 -C $out/share/fonts fonts-lklug-sinhala-${version}/lklug.ttf
+  src = fetchurl {
+    url = "mirror://debian/pool/main/f/fonts-${pname}/fonts-${pname}_${version}.orig.tar.xz";
+    hash = "sha256-oPCCa01PMQcCK5fEILgXjrGzoDg+UvxkqK6AgeQaKio=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/fonts/truetype
+    cp *.ttf $out/share/fonts/truetype
+
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/data/fonts/lmodern/default.nix b/pkgs/data/fonts/lmodern/default.nix
index af0e70331351..85aa7060ea05 100644
--- a/pkgs/data/fonts/lmodern/default.nix
+++ b/pkgs/data/fonts/lmodern/default.nix
@@ -1,26 +1,27 @@
-{ fetchzip }:
+{ lib, stdenvNoCC, fetchurl }:
 
-fetchzip {
-  name = "lmodern-2.005";
+stdenvNoCC.mkDerivation rec {
+  pname = "lmodern";
+  version = "2.005";
 
-  url = "mirror://debian/pool/main/l/lmodern/lmodern_2.005.orig.tar.gz";
+  src = fetchurl {
+    url = "mirror://debian/pool/main/l/${pname}/${pname}_${version}.orig.tar.gz";
+    hash = "sha256-xlUuZt6rjW0pX4t6PKWAHkkv3PisGCj7ZwatZPAUNxk=";
+  };
 
-  postFetch = ''
-    tar xzvf $downloadedFile
+  installPhase = ''
+    runHook preInstall
 
     mkdir -p $out/texmf-dist/
     mkdir -p $out/share/fonts/
 
-    cp -r lmodern-2.005/* $out/texmf-dist/
-    cp -r lmodern-2.005/fonts/{opentype,type1} $out/share/fonts/
+    cp -r * $out/texmf-dist/
+    cp -r fonts/{opentype,type1} $out/share/fonts/
 
-    ln -s -r $out/texmf* $out/share/
+    runHook postInstall
   '';
 
-  sha256 = "sha256-ySdKUt8o5FqmpdnYSzbGJ1f9t8VmKYXqPt53e1/E/FA=";
-
   meta = {
     description = "Latin Modern font";
   };
 }
-
diff --git a/pkgs/data/fonts/luculent/default.nix b/pkgs/data/fonts/luculent/default.nix
index 9d61931db365..1347af957e46 100644
--- a/pkgs/data/fonts/luculent/default.nix
+++ b/pkgs/data/fonts/luculent/default.nix
@@ -1,17 +1,22 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchurl }:
 
-let version = "2.0.0"; in
-fetchzip {
-  name = "luculent-${version}";
-  url =  "http://www.eastfarthing.com/luculent/luculent.tar.xz";
+stdenvNoCC.mkDerivation rec {
+  pname = "luculent";
+  version = "2.0.0";
+
+  src = fetchurl {
+    url = "http://www.eastfarthing.com/${pname}/${pname}.tar.xz";
+    hash = "sha256-6NxLnTBnvHmTUTFa2wW0AuKPEbCqzaWQyiFVnF0sBqU=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  postFetch = ''
-    tar -xJf $downloadedFile --strip-components=1
     mkdir -p $out/share/fonts/truetype
     cp *.ttf $out/share/fonts/truetype
-  '';
 
-  sha256 = "1m3g64galwna1xjxb1fczmfplm6c1fn3ra1ln7f0vkm0ah5m4lbv";
+    runHook postInstall
+  '';
 
   meta = with lib; {
     description = "luculent font";
diff --git a/pkgs/data/fonts/lxgw-wenkai/default.nix b/pkgs/data/fonts/lxgw-wenkai/default.nix
index bb36d9a920a5..c16a5f774922 100644
--- a/pkgs/data/fonts/lxgw-wenkai/default.nix
+++ b/pkgs/data/fonts/lxgw-wenkai/default.nix
@@ -1,22 +1,23 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchurl }:
 
-fetchzip rec {
+stdenvNoCC.mkDerivation rec {
   pname = "lxgw-wenkai";
-  version = "1.245.1";
+  version = "1.250";
 
-  url = "https://github.com/lxgw/LxgwWenKai/releases/download/v${version}/lxgw-wenkai-v${version}.tar.gz";
+  src = fetchurl {
+    url = "https://github.com/lxgw/LxgwWenKai/releases/download/v${version}/${pname}-v${version}.tar.gz";
+    hash = "sha256-Nkd0xXYCnR0NZAk/JCxy+zOlxIxD52Px4F9o2L9mgRE=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  postFetch = ''
     mkdir -p $out/share/fonts/truetype
-    mv $out/*.ttf $out/share/fonts/truetype
+    mv *.ttf $out/share/fonts/truetype
 
-    shopt -s extglob dotglob
-    rm -rf $out/!(share)
-    shopt -u extglob dotglob
+    runHook postInstall
   '';
 
-  hash = "sha256-4RQ+aqAZPQH3t6v2KvrNWgYT3J3uMuY34XTuvyLEOeI=";
-
   meta = with lib; {
     homepage = "https://lxgw.github.io/";
     description = "An open-source Chinese font derived from Fontworks' Klee One";
diff --git a/pkgs/data/fonts/marathi-cursive/default.nix b/pkgs/data/fonts/marathi-cursive/default.nix
index 8c228fd91a75..b8dd5492a56f 100644
--- a/pkgs/data/fonts/marathi-cursive/default.nix
+++ b/pkgs/data/fonts/marathi-cursive/default.nix
@@ -1,19 +1,22 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchurl }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "marathi-cursive";
   version = "2.0";
-in fetchzip rec {
-  name = "marathi-cursive-${version}";
 
-  url = "https://github.com/MihailJP/MarathiCursive/releases/download/v${version}/MarathiCursive-${version}.tar.xz";
+  src = fetchurl {
+    url = "https://github.com/MihailJP/MarathiCursive/releases/download/v${version}/MarathiCursive-${version}.tar.xz";
+    hash = "sha256-JE9T3UMSYn/JfEWuWHikDJIlt4nZl6GzY98v3vG6di4=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  postFetch = ''
-    tar -xJf $downloadedFile --strip-components=1
     install -m444 -Dt $out/share/fonts/marathi-cursive *.otf *.ttf
-    install -m444 -Dt $out/share/doc/${name} README *.txt
-  '';
+    install -m444 -Dt $out/share/doc/${pname}-${version} README *.txt
 
-  sha256 = "17pj60ajnjghxhxka8a046mz6vfwr79wnby7xd6pg5hgncin2hgg";
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "https://github.com/MihailJP/MarathiCursive";
diff --git a/pkgs/data/fonts/material-design-icons/default.nix b/pkgs/data/fonts/material-design-icons/default.nix
index fdd85f66e408..49d52ebb7799 100644
--- a/pkgs/data/fonts/material-design-icons/default.nix
+++ b/pkgs/data/fonts/material-design-icons/default.nix
@@ -4,8 +4,6 @@ stdenvNoCC.mkDerivation rec {
   pname = "material-design-icons";
   version = "7.1.96";
 
-  dontBuild = true;
-
   src = fetchFromGitHub {
     owner = "Templarian";
     repo = "MaterialDesign-Webfont";
diff --git a/pkgs/data/fonts/medio/default.nix b/pkgs/data/fonts/medio/default.nix
index c94046f085f9..240b6fbeead8 100644
--- a/pkgs/data/fonts/medio/default.nix
+++ b/pkgs/data/fonts/medio/default.nix
@@ -1,24 +1,29 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
 let
   majorVersion = "0";
   minorVersion = "200";
-  pname = "medio";
 in
+stdenvNoCC.mkDerivation (self: {
+  pname = "medio";
+  version = "${majorVersion}.${minorVersion}";
 
-fetchzip {
-  name = "${pname}-font-${majorVersion}.${minorVersion}";
+  src = fetchzip {
+    url = "https://dotcolon.net/download/fonts/${self.pname}_${majorVersion}${minorVersion}.zip";
+    hash = "sha256-S+CcwD4zGVk7cIFD6K4NnpE/0mrJq4RnDJC576rhcLQ=";
+    stripRoot = false;
+  };
 
-  url = "http://dotcolon.net/DL/font/${pname}.zip";
-  sha256 = "0gxcmhjlsh2pzsmj78vw4v935ax7hfk533ddlhfhfma52zyxyh7x";
+  installPhase = ''
+    runHook preInstall
 
-  postFetch = ''
-    mkdir -p $out/share/fonts/opentype/${pname}
-    unzip -j $downloadedFile \*.otf  -d $out/share/fonts/opentype/${pname}
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
   '';
 
   meta = with lib; {
-    homepage = "http://dotcolon.net/font/${pname}/";
+    homepage = "http://dotcolon.net/font/${self.pname}/";
     description = "Serif font designed by Sora Sagano";
     longDescription = ''
       Medio is a serif font designed by Sora Sagano, based roughly
@@ -26,7 +31,7 @@ fetchzip {
       but with hairline serifs in the style of a Didone.
     '';
     platforms = platforms.all;
-    maintainers = with maintainers; [ leenaars ];
+    maintainers = with maintainers; [ leenaars minijackson ];
     license = licenses.cc0;
   };
-}
+})
diff --git a/pkgs/data/fonts/melete/default.nix b/pkgs/data/fonts/melete/default.nix
new file mode 100644
index 000000000000..cae6bcaf4eaf
--- /dev/null
+++ b/pkgs/data/fonts/melete/default.nix
@@ -0,0 +1,32 @@
+{ lib, stdenvNoCC, fetchzip }:
+
+let
+  majorVersion = "0";
+  minorVersion = "200";
+in
+stdenvNoCC.mkDerivation (self: {
+  pname = "melete";
+  version = "${majorVersion}.${minorVersion}";
+
+  src = fetchzip {
+    url = "https://dotcolon.net/download/fonts/${self.pname}_${majorVersion}${minorVersion}.zip";
+    hash = "sha256-y1xtNM1Oy92gOvbr9J71XNxb1JeTzOgxKms3G2YHK00=";
+    stripRoot = false;
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "http://dotcolon.net/font/${self.pname}/";
+    description = "A headline typeface that could be used as a movie title";
+    platforms = platforms.all;
+    maintainers = with maintainers; [ minijackson ];
+    license = licenses.ofl;
+  };
+})
diff --git a/pkgs/data/fonts/nacelle/default.nix b/pkgs/data/fonts/nacelle/default.nix
new file mode 100644
index 000000000000..007de90b75ac
--- /dev/null
+++ b/pkgs/data/fonts/nacelle/default.nix
@@ -0,0 +1,32 @@
+{ lib, stdenvNoCC, fetchzip }:
+
+let
+  majorVersion = "1";
+  minorVersion = "00";
+in
+stdenvNoCC.mkDerivation (self: {
+  pname = "nacelle";
+  version = "${majorVersion}.${minorVersion}";
+
+  src = fetchzip {
+    url = "https://dotcolon.net/download/fonts/${self.pname}_${majorVersion}${minorVersion}.zip";
+    hash = "sha256-e4QsPiyfWEAYHWdwR3CkGc2UzuA3hZPYYlWtIubY0Oo=";
+    stripRoot = false;
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "http://dotcolon.net/font/${self.pname}/";
+    description = "A improved version of the Aileron font";
+    platforms = platforms.all;
+    maintainers = with maintainers; [ minijackson ];
+    license = licenses.ofl;
+  };
+})
diff --git a/pkgs/data/fonts/nanum/default.nix b/pkgs/data/fonts/nanum/default.nix
index 1aac2c53d821..8f432edf4196 100644
--- a/pkgs/data/fonts/nanum/default.nix
+++ b/pkgs/data/fonts/nanum/default.nix
@@ -1,20 +1,21 @@
-{ fetchzip, lib }:
+{ lib, stdenvNoCC, fetchurl }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "nanum";
   version = "20170925";
-in
-fetchzip {
-  name = "nanum-${version}";
-  url = "mirror://ubuntu/pool/universe/f/fonts-nanum/fonts-nanum_${version}.orig.tar.xz";
-  sha256 = "sha256-lSTeQEuMmlQxiQqrx9tNScifE8nMOUDJF3lCfoAFIJk=";
 
-  postFetch = ''
-    unpackDir="$TMPDIR/unpack"
-    mkdir "$unpackDir"
-    cd "$unpackDir"
-    tar xf "$downloadedFile" --strip-components=1
+  src = fetchurl {
+    url = "mirror://ubuntu/pool/universe/f/fonts-${pname}/fonts-${pname}_${version}.orig.tar.xz";
+    hash = "sha256-GlVXH9YUU3wHMkNoz5miBv7N2oUEbwUXlcVoElQ9++4=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/share/fonts
     cp *.ttf $out/share/fonts
+
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/data/fonts/oldsindhi/default.nix b/pkgs/data/fonts/oldsindhi/default.nix
index e0e783fd80a5..88692d914564 100644
--- a/pkgs/data/fonts/oldsindhi/default.nix
+++ b/pkgs/data/fonts/oldsindhi/default.nix
@@ -1,25 +1,28 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchurl }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "oldsindhi";
   version = "1.0";
-in fetchzip rec {
-  name = "oldsindhi-${version}";
 
-  url = "https://github.com/MihailJP/oldsindhi/releases/download/v${version}/OldSindhi-${version}.tar.xz";
+  src = fetchurl {
+    url = "https://github.com/MihailJP/${pname}/releases/download/v${version}/OldSindhi-${version}.tar.xz";
+    hash = "sha256-jOcl+mo6CJ9Lnn3nAUiXXHCJssovVgLoPrbGxj4uzQs=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  postFetch = ''
-    tar -xJf $downloadedFile --strip-components=1
     install -m444 -Dt $out/share/fonts/truetype *.ttf
-    install -m444 -Dt $out/share/doc/${name} README *.txt
-  '';
+    install -m444 -Dt $out/share/doc/${pname}-${version} README *.txt
 
-  sha256 = "03c483vbrwz2fpdfbys42fmik9788zxfmjmc4fgq4s2d0mraa0j1";
+    runHook postInstall
+  '';
 
   meta = with lib; {
     homepage = "https://github.com/MihailJP/oldsindhi";
     description = "Free Sindhi Khudabadi font";
     maintainers = with maintainers; [ mathnerd314 ];
-    license = with licenses; [mit ofl];
+    license = with licenses; [ mit ofl ];
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/data/fonts/penna/default.nix b/pkgs/data/fonts/penna/default.nix
index 784f9d2573ef..893262f66e56 100644
--- a/pkgs/data/fonts/penna/default.nix
+++ b/pkgs/data/fonts/penna/default.nix
@@ -1,24 +1,29 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
 let
   majorVersion = "0";
-  minorVersion = "10";
-  pname = "penna";
+  minorVersion = "100";
 in
+stdenvNoCC.mkDerivation (self: {
+  pname = "penna";
+  version = "${majorVersion}.${minorVersion}";
 
-fetchzip {
-  name = "${pname}-font-${majorVersion}.${minorVersion}";
+  src = fetchzip {
+    url = "https://dotcolon.net/download/fonts/${self.pname}_${majorVersion}${minorVersion}.zip";
+    hash = "sha256-fmCJnEaoUGdW9JK3J7JSm5D4qOMRW7qVKPgVE7uCH5w=";
+    stripRoot = false;
+  };
 
-  url = "http://dotcolon.net/DL/font/${pname}.zip";
-  sha256 = "0hk15yndm56l6rbdykpkry2flffx0567mgjcqcnsx1iyzwwla5km";
+  installPhase = ''
+    runHook preInstall
 
-  postFetch = ''
-    mkdir -p $out/share/fonts/opentype/${pname}
-    unzip -j $downloadedFile \*.otf  -d $out/share/fonts/opentype/${pname}
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
   '';
 
   meta = with lib; {
-    homepage = "http://dotcolon.net/font/${pname}/";
+    homepage = "http://dotcolon.net/font/${self.pname}/";
     description = "Geometric sans serif designed by Sora Sagano";
     longDescription = ''
      Penna is a geometric sans serif designed by Sora Sagano,
@@ -26,7 +31,7 @@ fetchzip {
      with a small x-height.
     '';
     platforms = platforms.all;
-    maintainers = with maintainers; [ leenaars ];
+    maintainers = with maintainers; [ leenaars minijackson ];
     license = licenses.cc0;
   };
-}
+})
diff --git a/pkgs/data/fonts/route159/default.nix b/pkgs/data/fonts/route159/default.nix
index cbc89c550b3c..4d0bf9941b44 100644
--- a/pkgs/data/fonts/route159/default.nix
+++ b/pkgs/data/fonts/route159/default.nix
@@ -1,27 +1,32 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
 let
   majorVersion = "1";
   minorVersion = "10";
-  pname = "route159";
 in
+stdenvNoCC.mkDerivation (self: {
+  pname = "route159";
+  version = "${majorVersion}.${minorVersion}";
 
-fetchzip {
-  name = "${pname}-font-${majorVersion}.${minorVersion}";
+  src = fetchzip {
+    url = "https://dotcolon.net/download/fonts/${self.pname}_${majorVersion}${minorVersion}.zip";
+    hash = "sha256-1InyBW1LGbp/IU/ql9mvT14W3MTxJdWThFwRH6VHpTU=";
+    stripRoot = false;
+  };
 
-  url = "http://dotcolon.net/DL/font/${pname}_${majorVersion}${minorVersion}.zip";
-  sha256 = "1nv5csg73arvvwpac7ylh4j9n0s3qp79rbv2s4jvs2bf6gqhsq7h";
+  installPhase = ''
+    runHook preInstall
 
-  postFetch = ''
-    mkdir -p $out/share/fonts/opentype/${pname}
-    unzip -j $downloadedFile \*.otf  -d $out/share/fonts/opentype/${pname}
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
   '';
 
   meta = with lib; {
-    homepage = "http://dotcolon.net/font/${pname}/";
+    homepage = "http://dotcolon.net/font/${self.pname}/";
     description = "A weighted sans serif font";
     platforms = platforms.all;
-    maintainers = with maintainers; [ leenaars ];
+    maintainers = with maintainers; [ leenaars minijackson ];
     license = licenses.ofl;
   };
-}
+})
diff --git a/pkgs/data/fonts/seshat/default.nix b/pkgs/data/fonts/seshat/default.nix
index 71483a04cbb7..7ed7abd5fb17 100644
--- a/pkgs/data/fonts/seshat/default.nix
+++ b/pkgs/data/fonts/seshat/default.nix
@@ -1,24 +1,29 @@
-{ lib,  fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
 let
   majorVersion = "0";
   minorVersion = "100";
-  pname = "seshat";
 in
+stdenvNoCC.mkDerivation (self: {
+  pname = "seshat";
+  version = "${majorVersion}.${minorVersion}";
 
-fetchzip {
-  name = "${pname}-font-${majorVersion}.${minorVersion}";
+  src = fetchzip {
+    url = "https://dotcolon.net/download/fonts/${self.pname}_${majorVersion}${minorVersion}.zip";
+    hash = "sha256-XgprDhzAbcTzZw2QOwpCnzusYheYmSlM+ApU+Y0wO2Q=";
+    stripRoot = false;
+  };
 
-  url = "http://dotcolon.net/DL/font/${pname}.zip";
-  sha256 = "1zzgc2d0jrris92p3irmxjhdq8aj99alz0z7dlz25qf37lcilrir";
+  installPhase = ''
+    runHook preInstall
 
-  postFetch = ''
-    mkdir -p $out/share/fonts/opentype/${pname}
-    unzip -j $downloadedFile \*.otf  -d $out/share/fonts/opentype/${pname}
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
   '';
 
   meta = with lib; {
-    homepage = "http://dotcolon.net/font/${pname}/";
+    homepage = "http://dotcolon.net/font/${self.pname}/";
     description = "Roman body font designed for main text by Sora Sagano";
     longDescription = ''
       Seshat is a Roman body font designed for the main text. By
@@ -31,7 +36,7 @@ fetchzip {
       It incorporates symbols and ligatures used in the European region.
     '';
     platforms = platforms.all;
-    maintainers = with maintainers; [ leenaars ];
+    maintainers = with maintainers; [ leenaars minijackson ];
     license = licenses.cc0;
   };
-}
+})
diff --git a/pkgs/data/fonts/takao/default.nix b/pkgs/data/fonts/takao/default.nix
index dcbce858e011..353287d4d77b 100644
--- a/pkgs/data/fonts/takao/default.nix
+++ b/pkgs/data/fonts/takao/default.nix
@@ -1,20 +1,21 @@
-{ fetchzip, lib }:
+{ lib, stdenvNoCC, fetchurl }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "takao";
   version = "00303.01";
-in
-fetchzip {
-  name = "takao-${version}";
-  url = "mirror://ubuntu/pool/universe/f/fonts-takao/fonts-takao_${version}.orig.tar.gz";
-  sha256 = "sha256-TlPq3iIv8vHlxYu5dkX/Lf6ediYKQaQ5uMbFvypQM/w=";
 
-  postFetch = ''
-    unpackDir="$TMPDIR/unpack"
-    mkdir "$unpackDir"
-    cd "$unpackDir"
-    tar xf "$downloadedFile" --strip-components=1
+  src = fetchurl {
+    url = "mirror://ubuntu/pool/universe/f/fonts-${pname}/fonts-${pname}_${version}.orig.tar.gz";
+    hash = "sha256-0wjHNv1yStp0q9D0WfwjgUYoUKcCrXA5jFO8PEVgq5k=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/share/fonts
     cp *.ttf $out/share/fonts
+
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/data/fonts/tenderness/default.nix b/pkgs/data/fonts/tenderness/default.nix
index 09ea566e7382..40b284c2549f 100644
--- a/pkgs/data/fonts/tenderness/default.nix
+++ b/pkgs/data/fonts/tenderness/default.nix
@@ -1,27 +1,32 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
 let
   majorVersion = "0";
   minorVersion = "601";
-  pname = "tenderness";
 in
+stdenvNoCC.mkDerivation (self: {
+  pname = "tenderness";
+  version = "${majorVersion}.${minorVersion}";
 
-fetchzip {
-  name = "${pname}-font-${majorVersion}.${minorVersion}";
+  src = fetchzip {
+    url = "https://dotcolon.net/download/fonts/${self.pname}_${majorVersion}${minorVersion}.zip";
+    hash = "sha256-bwJKW+rY7/r2pBCSA6HYlaRMsI/U8UdW2vV4tmYuJww=";
+    stripRoot = false;
+  };
 
-  url = "http://dotcolon.net/DL/font/${pname}_${majorVersion}${minorVersion}.zip";
-  sha256 = "0d88l5mzq0k63zsmb8d5w3hfqxy04vpv4j0j8nmj1xv6kikhhybh";
+  installPhase = ''
+    runHook preInstall
 
-  postFetch = ''
-    mkdir -p $out/share/fonts/opentype/${pname}
-    unzip -j $downloadedFile \*.otf  -d $out/share/fonts/opentype/${pname}
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
   '';
 
   meta = with lib; {
-    homepage = "http://dotcolon.net/font/${pname}/";
+    homepage = "http://dotcolon.net/font/${self.pname}/";
     description = "Serif font designed by Sora Sagano with old-style figures";
     platforms = platforms.all;
-    maintainers = with maintainers; [ leenaars ];
+    maintainers = with maintainers; [ leenaars minijackson ];
     license = licenses.ofl;
   };
-}
+})
diff --git a/pkgs/data/fonts/tibetan-machine/default.nix b/pkgs/data/fonts/tibetan-machine/default.nix
index 67393a9c4ab9..4731bfcd365d 100644
--- a/pkgs/data/fonts/tibetan-machine/default.nix
+++ b/pkgs/data/fonts/tibetan-machine/default.nix
@@ -1,16 +1,21 @@
-{ fetchzip, lib }:
+{ lib, stdenvNoCC, fetchurl }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "tibetan-machine";
   version = "1.901b";
-in
-fetchzip {
-  name = "tibetan-machine-${version}";
-  url = "mirror://debian/pool/main/f/fonts-tibetan-machine/fonts-tibetan-machine_${version}.orig.tar.bz2";
-  sha256 = "sha256-A+RgpFLsP4iTzl0PMRHaNzWGbDR5Qa38lRegNJ96ULo=";
 
-  postFetch = ''
+  src = fetchurl {
+    url = "mirror://debian/pool/main/f/fonts-${pname}/fonts-${pname}_${version}.orig.tar.bz2";
+    hash = "sha256-c/1Sgv7xKHpsJGjY9ZY2qOJHShGHL1robvphFNJOt5w=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/share/fonts
-    tar xf $downloadedFile --strip-components=1 -C $out/share/fonts ttf-tmuni-${version}/TibMachUni-${version}.ttf
+    cp *.ttf $out/share/fonts
+
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/data/fonts/ttf-bitstream-vera/default.nix b/pkgs/data/fonts/ttf-bitstream-vera/default.nix
index 95e4ce2a52ab..e71888969f61 100644
--- a/pkgs/data/fonts/ttf-bitstream-vera/default.nix
+++ b/pkgs/data/fonts/ttf-bitstream-vera/default.nix
@@ -1,20 +1,21 @@
-{ lib, fetchzip }:
-let
+{ lib, stdenvNoCC, fetchurl }:
+
+stdenvNoCC.mkDerivation rec {
   pname = "ttf-bitstream-vera";
   version = "1.10";
-in
-fetchzip rec {
-  name = "${pname}-${version}";
 
-  url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${name}.tar.bz2";
+  src = fetchurl {
+    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
+    hash = "sha256-21sn33u7MYA269t1rNPpjxvW62YI+3CmfUeM0kPReNw=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  postFetch = ''
-    tar -xjf $downloadedFile --strip-components=1
     install -m444 -Dt $out/share/fonts/truetype *.ttf
+
+    runHook postInstall
   '';
 
-  sha256 = "179hal4yi3367jg8rsvqx6h2w4s0kn9zzrv8c47sslyg28g39s4m";
-
-  meta = {
-  };
+  meta = { };
 }
diff --git a/pkgs/data/fonts/u001/default.nix b/pkgs/data/fonts/u001/default.nix
index fc2f3a486369..c50e972a4d69 100644
--- a/pkgs/data/fonts/u001/default.nix
+++ b/pkgs/data/fonts/u001/default.nix
@@ -10,8 +10,6 @@ stdenvNoCC.mkDerivation rec {
     stripRoot = false;
   };
 
-  dontBuild = true;
-
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/data/fonts/unfonts-core/default.nix b/pkgs/data/fonts/unfonts-core/default.nix
index 7f01d5531e15..5756a948f698 100644
--- a/pkgs/data/fonts/unfonts-core/default.nix
+++ b/pkgs/data/fonts/unfonts-core/default.nix
@@ -1,16 +1,20 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchurl }:
 
-let
+stdenvNoCC.mkDerivation rec {
   pname = "unfonts-core";
   version = "1.0.2-080608";
-in fetchzip {
-  name = "${pname}-${version}";
-  url = "https://kldp.net/unfonts/release/2607-un-fonts-core-${version}.tar.gz";
-  hash = "sha256-k9C7d/SbVLWFzRnDWpOIMtY6cAEIcaLcbxQAqjwuWds=";
 
-  postFetch = ''
-    tar -xzf $downloadedFile --strip-components=1
+  src = fetchurl {
+    url = "https://kldp.net/unfonts/release/2607-un-fonts-core-${version}.tar.gz";
+    hash = "sha256-OwpydPmqt+jw8ZOMAacOFYF2bVG0lLoUVoPzesVXkY4=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
     install -m444 -Dt $out/share/fonts/truetype *.ttf
+
+    runHook postInstall
   '';
 
   meta = with lib; {
@@ -20,7 +24,7 @@ in fetchzip {
       The Un-fonts come from the HLaTeX as type1 fonts in 1998 by Koaunghi Un, he made type1 fonts to use with Korean TeX (HLaTeX) in the late 1990's and released it under the GPL license.
 
       They were converted to TrueType with the FontForge (PfaEdit) by Won-kyu Park in 2003.
-          '';
+    '';
     license = licenses.gpl2;
     platforms = platforms.all;
     maintainers = [ maintainers.ehmry ];
diff --git a/pkgs/data/fonts/vdrsymbols/default.nix b/pkgs/data/fonts/vdrsymbols/default.nix
index 4b280df56441..5df82b31cfe5 100644
--- a/pkgs/data/fonts/vdrsymbols/default.nix
+++ b/pkgs/data/fonts/vdrsymbols/default.nix
@@ -1,15 +1,20 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchurl }:
 
-fetchzip {
-  name = "vdrsymbols-20100612";
+stdenvNoCC.mkDerivation rec {
+  pname = "vdrsymbols";
+  version = "20100612";
 
-  url = "http://andreas.vdr-developer.org/fonts/download/vdrsymbols-ttf-20100612.tgz";
+  src = fetchurl {
+    url = "http://andreas.vdr-developer.org/fonts/download/${pname}-ttf-${version}.tgz";
+    hash = "sha256-YxB+JcDkta5are+OQyP/WKDL0vllgn0m26bU9mQ3C/Q=";
+  };
 
-  sha256 = "0wpxns8zqic98c84j18dr4zmj092v07yq07vwwgzblr0rw9n6gzr";
+  installPhase = ''
+    runHook preInstall
 
-  postFetch = ''
-    tar xvzf "$downloadedFile"
-    install -Dm444 -t "$out/share/fonts/truetype" */*.ttf
+    install -Dm444 -t "$out/share/fonts/truetype" *.ttf
+
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/data/fonts/vegur/default.nix b/pkgs/data/fonts/vegur/default.nix
index 2f03dac3914b..effaf74be7db 100644
--- a/pkgs/data/fonts/vegur/default.nix
+++ b/pkgs/data/fonts/vegur/default.nix
@@ -1,26 +1,32 @@
-{ lib, buildPackages, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:
 
 let
-  version = "0.701";
-in fetchzip {
-  name = "vegur-font-${version}";
+  majorVersion = "0";
+  minorVersion = "701";
+in
+stdenvNoCC.mkDerivation (self: {
+  pname = "vegur";
+  version = "${majorVersion}.${minorVersion}";
 
-  # Upstream doesn't version their URLs.
-  # http://dotcolon.net/font/vegur/ → http://dotcolon.net/DL/font/vegur.zip
-  url = "http://download.opensuse.org/repositories/M17N:/fonts/SLE_12_SP3/src/dotcolon-vegur-fonts-0.701-1.4.src.rpm";
+  src = fetchzip {
+    url = "https://dotcolon.net/download/fonts/${self.pname}_${majorVersion}${minorVersion}.zip";
+    hash = "sha256-sGb3mEb3g15ZiVCxEfAanly8zMUopLOOjw8W4qbXLPA=";
+    stripRoot = false;
+  };
 
-  postFetch = ''
-    ${buildPackages.rpmextract}/bin/rpmextract $downloadedFile
-    unzip vegur.zip
-    install -m444 -Dt $out/share/fonts/Vegur *.otf
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
   '';
-  sha256 = "0iisi2scq72lyj7pc1f36fhfjnm676n5byl4zaavhbxpdrbc6d1v";
 
   meta = with lib; {
     homepage = "http://dotcolon.net/font/vegur/";
     description = "A humanist sans serif font";
     platforms = platforms.all;
-    maintainers = [ maintainers.samueldr ];
+    maintainers = with maintainers; [ minijackson samueldr ];
     license = licenses.cc0;
   };
-}
+})
diff --git a/pkgs/data/fonts/wqy-microhei/default.nix b/pkgs/data/fonts/wqy-microhei/default.nix
index f7d3b0333c5e..7c410e7d00e7 100644
--- a/pkgs/data/fonts/wqy-microhei/default.nix
+++ b/pkgs/data/fonts/wqy-microhei/default.nix
@@ -1,16 +1,21 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchurl }:
 
-fetchzip rec {
-  name = "wqy-microhei-0.2.0-beta";
+stdenvNoCC.mkDerivation rec {
+  pname = "wqy-microhei";
+  version = "0.2.0";
 
-  url = "mirror://sourceforge/wqy/${name}.tar.gz";
+  src = fetchurl {
+    url = "mirror://sourceforge/wqy/${pname}-${version}-beta.tar.gz";
+    hash = "sha256-KAKsgCOqNqZupudEWFTjoHjTd///QhaTQb0jeHH3IT4=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  postFetch = ''
-    tar -xzf $downloadedFile --strip-components=1
     install -Dm644 wqy-microhei.ttc $out/share/fonts/wqy-microhei.ttc
-  '';
 
-  sha256 = "0i5jh7mkp371fxqmsvn7say075r641yl4hq26isjyrqvb8cv92a9";
+    runHook postInstall
+  '';
 
   meta = {
     description = "A (mainly) Chinese Unicode font";
@@ -20,4 +25,3 @@ fetchzip rec {
     platforms = lib.platforms.all;
   };
 }
-
diff --git a/pkgs/data/fonts/wqy-zenhei/default.nix b/pkgs/data/fonts/wqy-zenhei/default.nix
index 5d461d0f5b00..a5106b5e6b18 100644
--- a/pkgs/data/fonts/wqy-zenhei/default.nix
+++ b/pkgs/data/fonts/wqy-zenhei/default.nix
@@ -1,19 +1,22 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchurl }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "wqy-zenhei";
   version = "0.9.45";
-in fetchzip rec {
-  name = "wqy-zenhei-${version}";
 
-  url = "mirror://sourceforge/wqy/${name}.tar.gz";
+  src = fetchurl {
+    url = "mirror://sourceforge/wqy/${pname}-${version}.tar.gz";
+    hash = "sha256-5LfjBkdb+UJ9F1dXjw5FKJMMhMROqj8WfUxC8RDuddY=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  postFetch = ''
-    tar -xzf $downloadedFile --strip-components=1
     mkdir -p $out/share/fonts
     install -m644 *.ttc $out/share/fonts/
-  '';
 
-  sha256 = "0hbjq6afcd63nsyjzrjf8fmm7pn70jcly7fjzjw23v36ffi0g255";
+    runHook postInstall
+  '';
 
   meta = {
     description = "A (mainly) Chinese Unicode font";
diff --git a/pkgs/desktops/mate/marco/default.nix b/pkgs/desktops/mate/marco/default.nix
index 27e41079243d..0012e2501c41 100644
--- a/pkgs/desktops/mate/marco/default.nix
+++ b/pkgs/desktops/mate/marco/default.nix
@@ -9,6 +9,7 @@
 , libgtop
 , libXdamage
 , libXpresent
+, libXres
 , libstartup_notification
 , gnome
 , glib
@@ -20,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "marco";
-  version = "1.26.0";
+  version = "1.26.1";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "01avxrg2fc6grfrp6hl8b0im4scy9xf6011swfrhli87ig6hhg7n";
+    sha256 = "tPpVUL+J1Pnv9a5ufWFQ42YaItUw1q3cZ1e86N0qXT0=";
   };
 
   nativeBuildInputs = [
@@ -40,6 +41,7 @@ stdenv.mkDerivation rec {
     libgtop
     libXdamage
     libXpresent
+    libXres
     libstartup_notification
     gtk3
     gnome.zenity
diff --git a/pkgs/development/beam-modules/elixir-ls/pin.json b/pkgs/development/beam-modules/elixir-ls/pin.json
index bd206eb1d1a2..79909f98b7de 100644
--- a/pkgs/development/beam-modules/elixir-ls/pin.json
+++ b/pkgs/development/beam-modules/elixir-ls/pin.json
@@ -1,5 +1,5 @@
 {
-  "version": "0.12.0",
-  "sha256": "sha256-ZieKL98EUT3RbZ1UZkhrnXjg3N0RATKB69F8D7IWnJ8=",
-  "depsSha256": "sha256-Otm8koWrDYxodfliIe+q4U+39eStR5umEKnQQmOOGeA="
+  "version": "0.13.0",
+  "sha256": "sha256-eUAlnEKhoJ3j2Ii2EBL620jv3aGeMJcWoMMG+vWIdm4=",
+  "depsSha256": "sha256-fAt9BpEE9truGWpor0BttVd9aNZlgQ6UTorIEcJ82wM="
 }
diff --git a/pkgs/development/compilers/dotnet/default.nix b/pkgs/development/compilers/dotnet/default.nix
index c2cb6eb37823..fddcbcea466b 100644
--- a/pkgs/development/compilers/dotnet/default.nix
+++ b/pkgs/development/compilers/dotnet/default.nix
@@ -28,7 +28,6 @@ let
 
   ## Files in versions/ are generated automatically by update.sh ##
   dotnet_3_1 = import ./versions/3.1.nix (buildAttrs // { icu = icu70; });
-  dotnet_5_0 = import ./versions/5.0.nix (buildAttrs // { inherit icu; });
   dotnet_6_0 = import ./versions/6.0.nix (buildAttrs // { inherit icu; });
   dotnet_7_0 = import ./versions/7.0.nix (buildAttrs // { inherit icu; });
 in
@@ -38,7 +37,8 @@ rec {
   combinePackages = attrs: callPackage (import ./combine-packages.nix attrs) {};
 
   # EOL
-  sdk_2_1 = throw "Dotnet SDK 2.1 is EOL, please use 3.1 (LTS), 5.0 (Current) or 6.0 (LTS)";
-  sdk_2_2 = throw "Dotnet SDK 2.2 is EOL, please use 3.1 (LTS), 5.0 (Current) or 6.0 (LTS)";
-  sdk_3_0 = throw "Dotnet SDK 3.0 is EOL, please use 3.1 (LTS), 5.0 (Current) or 6.0 (LTS)";
-} // dotnet_3_1 // dotnet_5_0 // dotnet_6_0 // dotnet_7_0
+  sdk_2_1 = throw "Dotnet SDK 2.1 is EOL, please use 6.0 (LTS) or 7.0 (Current)";
+  sdk_2_2 = throw "Dotnet SDK 2.2 is EOL, please use 6.0 (LTS) or 7.0 (Current)";
+  sdk_3_0 = throw "Dotnet SDK 3.0 is EOL, please use 6.0 (LTS) or 7.0 (Current)";
+  sdk_5_0 = throw "Dotnet SDK 5.0 is EOL, please use 6.0 (LTS) or 7.0 (Current)";
+} // dotnet_3_1 // dotnet_6_0 // dotnet_7_0
diff --git a/pkgs/development/compilers/dotnet/versions/5.0.nix b/pkgs/development/compilers/dotnet/versions/5.0.nix
deleted file mode 100644
index 64da95920d5a..000000000000
--- a/pkgs/development/compilers/dotnet/versions/5.0.nix
+++ /dev/null
@@ -1,137 +0,0 @@
-{ buildAspNetCore, buildNetRuntime, buildNetSdk, icu }:
-
-# v5.0 (eol)
-{
-  aspnetcore_5_0 = buildAspNetCore {
-    inherit icu;
-    version = "5.0.17";
-    srcs = {
-      x86_64-linux = {
-        url     = "https://download.visualstudio.microsoft.com/download/pr/a2b96f83-e22a-4fa6-a10e-709b3effac9a/0d6ade6c0ceebc8ef7dbf2b1a6d86f17/aspnetcore-runtime-5.0.17-linux-x64.tar.gz";
-        sha512  = "d8e87804e9e86273c6512785bd5a6f0e834ff3f4bbebc11c4fcdf16ab4fdfabd0d981a756955267c1aa9bbeec596de3728ce9b2e6415d2d80daef0d999a5df6d";
-      };
-      aarch64-linux = {
-        url     = "https://download.visualstudio.microsoft.com/download/pr/6eb8aee2-cbea-4c4f-9bb9-ea6229ec229b/d6c438e5071c359ad995134f0a33e731/aspnetcore-runtime-5.0.17-linux-arm64.tar.gz";
-        sha512  = "ac1a9d89f1b730dfdca9c2e48373ef21f8f9316014eefbe6b11516f8195d3b3efc4e482883774b74ea2ff1cb77174a2cb471bd1157ab5b7d71621e3026c38e9b";
-      };
-      x86_64-darwin = {
-        url     = "https://download.visualstudio.microsoft.com/download/pr/25e4817f-6fd0-46dc-be0d-d819445bac5c/a8fa228c872df683741c8a79745f8fb3/aspnetcore-runtime-5.0.17-osx-x64.tar.gz";
-        sha512  = "bb0c43c723090fa2d8a0255e6fc8c004ebe7baf2d5d56e22ad2e6336a67fe415333d451e459c8857c0ccb5819d998232c9617bf45f222559d4b8891b0af41f20";
-      };
-    };
-  };
-
-  runtime_5_0 = buildNetRuntime {
-    inherit icu;
-    version = "5.0.17";
-    srcs = {
-      x86_64-linux = {
-        url     = "https://download.visualstudio.microsoft.com/download/pr/e77438f6-865f-45e0-9a52-3e4b04aa609f/024a880ed4bfbfd3b9f222fec0b6aaff/dotnet-runtime-5.0.17-linux-x64.tar.gz";
-        sha512  = "a9c4784930a977abbc42aff1337dda06ec588c1ec4769a59f9fcab4d5df4fc9efe65f8e61e5433db078f67a94ea2dfe870c32c482a50d4c16283ffacacff4261";
-      };
-      aarch64-linux = {
-        url     = "https://download.visualstudio.microsoft.com/download/pr/6690730f-cf10-40f1-9d4d-4c0d002f22d0/e117133858f190c169873200b8d7b9d7/dotnet-runtime-5.0.17-linux-arm64.tar.gz";
-        sha512  = "99cb11871924d3abedcc9c8079c54bc0c550203c7cbe4e349ed70d4355f40e4620b68d90b797e6461d898c06bed6953580e2cd4ad01483e5de107ca5a3409610";
-      };
-      x86_64-darwin = {
-        url     = "https://download.visualstudio.microsoft.com/download/pr/39326cf0-dc7f-42a3-9f7a-fe30c75c7a7f/33cbce552148e13d47120fe4502f5b5e/dotnet-runtime-5.0.17-osx-x64.tar.gz";
-        sha512  = "31add512418640f98bc9511509db2049a2674c7725169d26be89218a02ac7972e03e5d6be5a3d45a0dfa764e6eade503a8f4957b7b198ec6ad412e423d95f1b9";
-      };
-    };
-  };
-
-  sdk_5_0 = buildNetSdk {
-    inherit icu;
-    version = "5.0.408";
-    srcs = {
-      x86_64-linux = {
-        url     = "https://download.visualstudio.microsoft.com/download/pr/904da7d0-ff02-49db-bd6b-5ea615cbdfc5/966690e36643662dcc65e3ca2423041e/dotnet-sdk-5.0.408-linux-x64.tar.gz";
-        sha512  = "abbf22c420df2d8398d1616efa3d31e1b8f96130697746c45ad68668676d12e65ec3b4dd75f28a5dc7607da58b6e369693c0e658def15ce2431303c28e99db55";
-      };
-      aarch64-linux = {
-        url     = "https://download.visualstudio.microsoft.com/download/pr/d4b71fac-a2fd-4516-ac58-100fb09d796a/e79d6c2a8040b59bf49c0d167ae70a7b/dotnet-sdk-5.0.408-linux-arm64.tar.gz";
-        sha512  = "50f23d7aca91051d8b7c37f1a76b1eb51e6fe73e017d98558d757a6b9699e4237d401ce81515c1601b8c21eb62fee4e0b4f0bbed8967eefa3ceba75fc242f01b";
-      };
-      x86_64-darwin = {
-        url     = "https://download.visualstudio.microsoft.com/download/pr/4aeecc7c-7ffa-418f-9362-cf5eb3ed0396/055d5e6064a9fdecd7d906f5f262373d/dotnet-sdk-5.0.408-osx-x64.tar.gz";
-        sha512  = "3fdd4deac2809b00c0f669d5488000ac1b9a47dee6ab7b31167d7cec4759a10ee347fd4f52090a40684e5ecc1e1f57eb99c558e561edfd1436a2f77fc1c1a0b2";
-      };
-    };
-    packages = { fetchNuGet }: [
-      (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-arm"; version = "5.0.17"; sha256 = "0mfawgcc23r44a1r7ynafxwga6jzn0f0z5ys03qssrvlcdsb376x"; })
-      (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-arm64"; version = "5.0.17"; sha256 = "183xgqzlwd5lhacxdwcjl8vcq7r7xypv0hddps9k32mmmwf83d8h"; })
-      (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"; version = "5.0.17"; sha256 = "0i5pp1smjkyhiyhcbkyc3cxz0sx9204bfml8wsdy7bxznbh2gkmw"; })
-      (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-musl-x64"; version = "5.0.17"; sha256 = "1fmd9jq2nzy63hjh4sa6zl636wpgwr3r8ahzln5w14m9k87lfdbk"; })
-      (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-x64"; version = "5.0.17"; sha256 = "066fwdlssbv556zd9w1x87x1j8j4kafj9rxyy0692bssdb4gcyc8"; })
-      (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.osx-x64"; version = "5.0.17"; sha256 = "1qvvqf8mmzzc7a7fhx324dprnbxhknr3qxspb2xhsn3yyg44xn2d"; })
-      (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.win-arm"; version = "5.0.17"; sha256 = "1gzf2gv4z9bn1cr1kpqpf1jf7m0p0wd1pxq5ndylq6bw353yglk1"; })
-      (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.win-arm64"; version = "5.0.17"; sha256 = "1lml70ln9bfjrfjf3jbxfzd5kgd4cp4h7v052md5ja364g7lalsy"; })
-      (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.win-x64"; version = "5.0.17"; sha256 = "0j90fri15c05lw96xybgvqkysfm7g8grhkrg25g75vhi6ni2ricj"; })
-      (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.win-x86"; version = "5.0.17"; sha256 = "1bdb887xvgxsmphys83zp9skn848p1r8viclc8p29w1rby4wi19i"; })
-      (fetchNuGet { pname = "Microsoft.NETCore.App.Host.linux-arm"; version = "5.0.17"; sha256 = "0y90p765sj54clf2bwrka99w73g8b9550b4qvyilqggzydl1c1hk"; })
-      (fetchNuGet { pname = "Microsoft.NETCore.App.Host.linux-arm64"; version = "5.0.17"; sha256 = "07v7vyqm556xr1ypkazfp6gh6drgf20zkwbhkpja8bwdcr6lphbb"; })
-      (fetchNuGet { pname = "Microsoft.NETCore.App.Host.linux-musl-arm64"; version = "5.0.17"; sha256 = "0sbzlzhazh31s63hw9553hk9j56fxssncmfgidiyh0dg73aacrsp"; })
-      (fetchNuGet { pname = "Microsoft.NETCore.App.Host.linux-musl-x64"; version = "5.0.17"; sha256 = "1qxphvlr882rvmj71y2imnf6r3hh4ln2n138qjyv1z129dp2g4y1"; })
-      (fetchNuGet { pname = "Microsoft.NETCore.App.Host.linux-x64"; version = "5.0.17"; sha256 = "1lc2jhr4ikffi5ylyf8f6ya6k0hdj0wp1l0017grrwd4m5ajj4vv"; })
-      (fetchNuGet { pname = "Microsoft.NETCore.App.Host.osx-x64"; version = "5.0.17"; sha256 = "02g5w41ivrw3n6cy3l3ixhcl8bw1fsv4bzs2m34k9h5fqmliaf3c"; })
-      (fetchNuGet { pname = "Microsoft.NETCore.App.Host.win-arm"; version = "5.0.17"; sha256 = "07rfkxpf6rp8x0lybl8hx40mk09w5gjrr9djkjcp8lvjgzidnxq9"; })
-      (fetchNuGet { pname = "Microsoft.NETCore.App.Host.win-arm64"; version = "5.0.17"; sha256 = "1i7wka56n3akr96jrkj37jx98bwxfzhpx5705930v50izligd08x"; })
-      (fetchNuGet { pname = "Microsoft.NETCore.App.Host.win-x64"; version = "5.0.17"; sha256 = "15f1kqlpp1d05dhg3dfya32vvzbpj6c7gxds947f10jb0hqlnhdj"; })
-      (fetchNuGet { pname = "Microsoft.NETCore.App.Host.win-x86"; version = "5.0.17"; sha256 = "1j1334zxv815ksdnllnbwwsbwnimjlpknjmqy1riy2zpswxlfkz6"; })
-      (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-arm"; version = "5.0.17"; sha256 = "0mmgd6nacx4fzf0w02ch0qxa43vrv6wfspykxsy2bkpvrnvr8xr9"; })
-      (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-arm64"; version = "5.0.17"; sha256 = "16whaq82pj6fqa0vam3a0va9ly843aa1z12hza040vn6252kk9fq"; })
-      (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-musl-arm64"; version = "5.0.17"; sha256 = "1zavnwqvn2f7lhb880wgv02anrvqsh6l34w72knwd31irggph08l"; })
-      (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-musl-x64"; version = "5.0.17"; sha256 = "173r2srcbad2prrw3l914scmdks3mghxgszvlwypdjnv0f2szgvv"; })
-      (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-x64"; version = "5.0.17"; sha256 = "0jgcfs3jc98jfyaaamssznckbpnaygplk8pjsp6dswpansz5bnnq"; })
-      (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.osx-x64"; version = "5.0.17"; sha256 = "1ph5kx18syinp8bpzw80bgq3njl65gwzws727xcmxnysgm7snmjp"; })
-      (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.win-arm"; version = "5.0.17"; sha256 = "0m4jhn70parwnl18fql0sk9sf14y8cf08xw6x2cm5bfhnc9jvjny"; })
-      (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.win-arm64"; version = "5.0.17"; sha256 = "1af20jkv73767b4fy18s2dvjncaca1ny0csyr7wbhvqfs59y3n1x"; })
-      (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.win-x64"; version = "5.0.17"; sha256 = "0llhsi03wyp2yjqy0snywqgwjgam91i4nsf5lc9kaxkk5h6vj1a0"; })
-      (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.win-x86"; version = "5.0.17"; sha256 = "0xvprbjwd3fymddvavsy7wk5q2hp45hdi10qz4rdbmns23vqkzmf"; })
-      (fetchNuGet { pname = "Microsoft.NETCore.DotNetAppHost"; version = "5.0.17"; sha256 = "0vhvxpba3i9ffp4gp56l3rnlhq9yg07n3dv5qi89zb90vgyqjh1p"; })
-      (fetchNuGet { pname = "Microsoft.NETCore.DotNetHost"; version = "5.0.17"; sha256 = "074c9byxwmndfdavxn103220f5gklaaxc9wj7zpb5v3yr3ads30f"; })
-      (fetchNuGet { pname = "Microsoft.NETCore.DotNetHostPolicy"; version = "5.0.17"; sha256 = "03jkkpsy2zjfp722fa2fcnpk2g6jzy0bn9vip5c39k78y5pz29x6"; })
-      (fetchNuGet { pname = "Microsoft.NETCore.DotNetHostResolver"; version = "5.0.17"; sha256 = "1ih6c104skp9q17i2dnsma45l6nv5c62vv2i1988dcjw2v0sl98m"; })
-      (fetchNuGet { pname = "runtime.linux-arm64.Microsoft.NETCore.DotNetAppHost"; version = "5.0.17"; sha256 = "0gwsxd1l0n32xnw0lyjixj2634iyygdb8pd7chydsr3qk8njxnpk"; })
-      (fetchNuGet { pname = "runtime.linux-arm64.Microsoft.NETCore.DotNetHost"; version = "5.0.17"; sha256 = "0x5dhn1jkwqnd0cki1vi97rhyfac6w79hvh9dxvnkn2k04sbps8q"; })
-      (fetchNuGet { pname = "runtime.linux-arm64.Microsoft.NETCore.DotNetHostPolicy"; version = "5.0.17"; sha256 = "1ipx3qn78z6gi415c4fa9wgy8k75aifbml6ys1c9ghl6yxbv0fd0"; })
-      (fetchNuGet { pname = "runtime.linux-arm64.Microsoft.NETCore.DotNetHostResolver"; version = "5.0.17"; sha256 = "1wgbx648yndl0hh8vx6sflfwjyr5pfhi7vj7v19l6vxnrr1096w7"; })
-      (fetchNuGet { pname = "runtime.linux-arm.Microsoft.NETCore.DotNetAppHost"; version = "5.0.17"; sha256 = "17jc8jc2dk1g8996jpq3k0g6c5inijivxkbz0grxrgr5jbyiv19y"; })
-      (fetchNuGet { pname = "runtime.linux-arm.Microsoft.NETCore.DotNetHost"; version = "5.0.17"; sha256 = "0ydn40qn6cs6f20byvmc9j008s6csxjbh6jh5w4q995vipcmcpcj"; })
-      (fetchNuGet { pname = "runtime.linux-arm.Microsoft.NETCore.DotNetHostPolicy"; version = "5.0.17"; sha256 = "0bw08wlf96vcyix850y8jips1glrz2cbj647af4d7gggw8p3wwzw"; })
-      (fetchNuGet { pname = "runtime.linux-arm.Microsoft.NETCore.DotNetHostResolver"; version = "5.0.17"; sha256 = "0xsqyw848scwcz09pgc719776q712xabx4xv47srzij34p2pq7np"; })
-      (fetchNuGet { pname = "runtime.linux-musl-arm64.Microsoft.NETCore.DotNetAppHost"; version = "5.0.17"; sha256 = "00b0vipypjai4l8icr74kjhglxx2xlc3nw3vyiwisg52l9zyby66"; })
-      (fetchNuGet { pname = "runtime.linux-musl-arm64.Microsoft.NETCore.DotNetHost"; version = "5.0.17"; sha256 = "1cdgd4p5zr1mzz9hlb5mj946zfa1vn9wya5y2bhqn9y4ak831wzp"; })
-      (fetchNuGet { pname = "runtime.linux-musl-arm64.Microsoft.NETCore.DotNetHostPolicy"; version = "5.0.17"; sha256 = "17v8m4fxm4q40z49a2h4lw9dawg6pwfv4s2dskzc23ggcjgr6dp1"; })
-      (fetchNuGet { pname = "runtime.linux-musl-arm64.Microsoft.NETCore.DotNetHostResolver"; version = "5.0.17"; sha256 = "1fbqi92prqmvxx0rx7vhl10l665jmmhb2ng5jndimggydb0ckpqh"; })
-      (fetchNuGet { pname = "runtime.linux-musl-x64.Microsoft.NETCore.DotNetAppHost"; version = "5.0.17"; sha256 = "1rijxkzzk65xs9z2ygs13h0rhw1cli5vwshmvs1gfnwhhn8ic0gx"; })
-      (fetchNuGet { pname = "runtime.linux-musl-x64.Microsoft.NETCore.DotNetHost"; version = "5.0.17"; sha256 = "02mxvpm2zs5jvawigvxlnrw6si4zwj6qlcas99m9xdmm8yqq22cm"; })
-      (fetchNuGet { pname = "runtime.linux-musl-x64.Microsoft.NETCore.DotNetHostPolicy"; version = "5.0.17"; sha256 = "0c1lcl3yy88vdfw12c7h0ww596qfjd5f8l2mn7mlqs6i3f864bkg"; })
-      (fetchNuGet { pname = "runtime.linux-musl-x64.Microsoft.NETCore.DotNetHostResolver"; version = "5.0.17"; sha256 = "0w0wg9ah7vngvpyds67l6qhizpkdf2r6m6cqyyvv3s5dw5l8rxin"; })
-      (fetchNuGet { pname = "runtime.linux-x64.Microsoft.NETCore.DotNetAppHost"; version = "5.0.17"; sha256 = "17yy7605vkfz0f4h58005gdfg6fnjxlcnq0vg0hrxsgbdqmd7p1i"; })
-      (fetchNuGet { pname = "runtime.linux-x64.Microsoft.NETCore.DotNetHost"; version = "5.0.17"; sha256 = "0av25fgkdl7zvn44wp8gqx2xl2mdlv1f9cgxzp7xk5yq8f7ynxpq"; })
-      (fetchNuGet { pname = "runtime.linux-x64.Microsoft.NETCore.DotNetHostPolicy"; version = "5.0.17"; sha256 = "1smhmdfq0jlv1gq18hdaj0y9yzkvqzmki19c0b3j5b76yxxxpbwz"; })
-      (fetchNuGet { pname = "runtime.linux-x64.Microsoft.NETCore.DotNetHostResolver"; version = "5.0.17"; sha256 = "0n0cdb9zpdb4h4v6r265pqmqg8c94ydywvna6jp1c6qhqlr0qk39"; })
-      (fetchNuGet { pname = "runtime.osx-x64.Microsoft.NETCore.DotNetAppHost"; version = "5.0.17"; sha256 = "1s2n2sx29c8rx549zizj8yrddjl98a7vwvxw56y0jvvbwphr9gz4"; })
-      (fetchNuGet { pname = "runtime.osx-x64.Microsoft.NETCore.DotNetHost"; version = "5.0.17"; sha256 = "19m66yvv0hnmyrmx2l4drbls0fcib75fxq2csdx6p8gd54bnrsh3"; })
-      (fetchNuGet { pname = "runtime.osx-x64.Microsoft.NETCore.DotNetHostPolicy"; version = "5.0.17"; sha256 = "0bcnlsxcrvhybcjbb9879njx0c4z76y7djx4643g1rpjnkcrj9ww"; })
-      (fetchNuGet { pname = "runtime.osx-x64.Microsoft.NETCore.DotNetHostResolver"; version = "5.0.17"; sha256 = "1bf95h2f0dmpmv7z7961zia5vaqvmjq3wkf6iil9jxv4z674624w"; })
-      (fetchNuGet { pname = "runtime.win-arm64.Microsoft.NETCore.DotNetAppHost"; version = "5.0.17"; sha256 = "02q593q09mwwh23m86048vc7b7an7pqch5nd86d4hxzkamnpnpsa"; })
-      (fetchNuGet { pname = "runtime.win-arm64.Microsoft.NETCore.DotNetHost"; version = "5.0.17"; sha256 = "16vzxywfj88gjcwfnmcb6b50ld8dp46i4pqiwwcy7yz15xgdhbm2"; })
-      (fetchNuGet { pname = "runtime.win-arm64.Microsoft.NETCore.DotNetHostPolicy"; version = "5.0.17"; sha256 = "1ix5lg2j5ihdfp9j3jdxc042g4syjzc4bafid465j52h6znsm6wm"; })
-      (fetchNuGet { pname = "runtime.win-arm64.Microsoft.NETCore.DotNetHostResolver"; version = "5.0.17"; sha256 = "0w30v8r26cg427n5glm9nz6r10baalkqq5icqqxkq71hmh8fsjqb"; })
-      (fetchNuGet { pname = "runtime.win-arm.Microsoft.NETCore.DotNetAppHost"; version = "5.0.17"; sha256 = "168iq4hdp6bhdpgqa1mir1bygmh2ggwkys1r82d6kpl2lzbxjy28"; })
-      (fetchNuGet { pname = "runtime.win-arm.Microsoft.NETCore.DotNetHost"; version = "5.0.17"; sha256 = "18jpw2wbrb1b941729lb7hiq4yfq2z53pcxwz4mpgawnr58y0562"; })
-      (fetchNuGet { pname = "runtime.win-arm.Microsoft.NETCore.DotNetHostPolicy"; version = "5.0.17"; sha256 = "0ig464fcsj2jr0p02f6slifwf1m0408g95npm0vccf5ww1nbgkpi"; })
-      (fetchNuGet { pname = "runtime.win-arm.Microsoft.NETCore.DotNetHostResolver"; version = "5.0.17"; sha256 = "0qj5avmjrvabxzimprg4m54k3p6zkwrhbpv0byc8c9gbi47s323j"; })
-      (fetchNuGet { pname = "runtime.win-x64.Microsoft.NETCore.DotNetAppHost"; version = "5.0.17"; sha256 = "05ghz164lpff7n8mrxs7jm2h8n3clsg4w953zrag3k5ry9j36m9c"; })
-      (fetchNuGet { pname = "runtime.win-x64.Microsoft.NETCore.DotNetHost"; version = "5.0.17"; sha256 = "0azgs542mbg69jlc81529i2z5m728w8sc2i9m5dx15hvxqqqcjiz"; })
-      (fetchNuGet { pname = "runtime.win-x64.Microsoft.NETCore.DotNetHostPolicy"; version = "5.0.17"; sha256 = "12n1kcgcv5z8hkvjqfk0n705kcipbai4sgcwiimi52xpaf34xw8m"; })
-      (fetchNuGet { pname = "runtime.win-x64.Microsoft.NETCore.DotNetHostResolver"; version = "5.0.17"; sha256 = "0b1s2m0a7xcdzfz22x6k7v5hkca90azdjk6pw7wwdnvszwq26nxp"; })
-      (fetchNuGet { pname = "runtime.win-x86.Microsoft.NETCore.DotNetAppHost"; version = "5.0.17"; sha256 = "1sjpq07swgj0isdgyh6p2yb254qb9781lv44xfhj6nz7mx2yhdh1"; })
-      (fetchNuGet { pname = "runtime.win-x86.Microsoft.NETCore.DotNetHost"; version = "5.0.17"; sha256 = "1gnzrqdp26d7pwwz29gm4qb09n2zsb767qkhbwkifcsyxlwi6m0f"; })
-      (fetchNuGet { pname = "runtime.win-x86.Microsoft.NETCore.DotNetHostPolicy"; version = "5.0.17"; sha256 = "089jww13gaf7x7yd9d3qkyx9iq8abcp3r147hd9nblh561c9bzbg"; })
-      (fetchNuGet { pname = "runtime.win-x86.Microsoft.NETCore.DotNetHostResolver"; version = "5.0.17"; sha256 = "1nycl1rayk0fhaakpj6q9rfp2lv3dpl7pziavmd9kcfryz952ff5"; })
-    ];
-  };
-}
diff --git a/pkgs/development/compilers/go-jsonnet/default.nix b/pkgs/development/compilers/go-jsonnet/default.nix
index 388059f2fc40..0df621fdb64f 100644
--- a/pkgs/development/compilers/go-jsonnet/default.nix
+++ b/pkgs/development/compilers/go-jsonnet/default.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
     hash = "sha256-FgQYnas0qkIedRAA8ApZXLzEylg6PS6+8zzl7j+yOeI=";
   };
 
-  vendorSha256 = "sha256-j1fTOUpLx34TgzW94A/BctLrg9XoTtb3cBizhVJoEEI=";
+  vendorHash = "sha256-j1fTOUpLx34TgzW94A/BctLrg9XoTtb3cBizhVJoEEI=";
 
   patches = [
     # See https://github.com/google/go-jsonnet/issues/653.
diff --git a/pkgs/development/compilers/llvm/10/default.nix b/pkgs/development/compilers/llvm/10/default.nix
index 259733ec74ff..f4120cb91cac 100644
--- a/pkgs/development/compilers/llvm/10/default.nix
+++ b/pkgs/development/compilers/llvm/10/default.nix
@@ -110,7 +110,7 @@ let
       cc = tools.clang-unwrapped;
       libcxx = targetLlvmLibraries.libcxx;
       extraPackages = [
-        targetLlvmLibraries.libcxxabi
+        libcxx.cxxabi
         targetLlvmLibraries.compiler-rt
       ];
       extraBuildCommands = mkExtraBuildCommands cc;
@@ -147,7 +147,7 @@ let
       libcxx = targetLlvmLibraries.libcxx;
       bintools = bintools';
       extraPackages = [
-        targetLlvmLibraries.libcxxabi
+        libcxx.cxxabi
         targetLlvmLibraries.compiler-rt
       ] ++ lib.optionals (!stdenv.targetPlatform.isWasm) [
         targetLlvmLibraries.libunwind
@@ -157,7 +157,7 @@ let
         echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm) ''
         echo "--unwindlib=libunwind" >> $out/nix-support/cc-cflags
-      '' + lib.optionalString (!stdenv.targetPlatform.isWasm && !stdenv.targetPlatform.isFreeBSD && stdenv.targetPlatform.useLLVM or false) ''
+      '' + lib.optionalString (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false) ''
         echo "-lunwind" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString stdenv.targetPlatform.isWasm ''
         echo "-fno-exceptions" >> $out/nix-support/cc-cflags
diff --git a/pkgs/development/compilers/llvm/10/libcxx/default.nix b/pkgs/development/compilers/llvm/10/libcxx/default.nix
index 0c0f535f7433..cc029ea657cd 100644
--- a/pkgs/development/compilers/llvm/10/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/10/libcxx/default.nix
@@ -1,7 +1,11 @@
-{ lib, stdenv, llvm_meta, fetch, cmake, python3, libcxxabi, fixDarwinDylibNames, version
+{ lib, stdenv, llvm_meta, fetch, cmake, python3, fixDarwinDylibNames, version
+, cxxabi ? if stdenv.hostPlatform.isFreeBSD then libcxxrt else libcxxabi
+, libcxxabi, libcxxrt
 , enableShared ? !stdenv.hostPlatform.isStatic
 }:
 
+assert stdenv.isDarwin -> cxxabi.pname == "libcxxabi";
+
 stdenv.mkDerivation {
   pname = "libcxx";
   inherit version;
@@ -37,13 +41,13 @@ stdenv.mkDerivation {
     ++ lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) python3
     ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
 
-  buildInputs = [ libcxxabi ];
+  buildInputs = [ cxxabi ];
 
   cmakeFlags = [
-    "-DLIBCXX_LIBCXXABI_LIB_PATH=${libcxxabi}/lib"
     "-DLIBCXX_LIBCPPABI_VERSION=2"
-    "-DLIBCXX_CXX_ABI=libcxxabi"
+    "-DLIBCXX_CXX_ABI=${cxxabi.pname}"
   ] ++ lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) "-DLIBCXX_HAS_MUSL_LIBC=1"
+    ++ lib.optional (cxxabi.pname == "libcxxabi") "-DLIBCXX_LIBCXXABI_LIB_PATH=${cxxabi}/lib"
     ++ lib.optional (stdenv.hostPlatform.useLLVM or false) "-DLIBCXX_USE_COMPILER_RT=ON"
     ++ lib.optionals stdenv.hostPlatform.isWasm [
       "-DLIBCXX_ENABLE_THREADS=OFF"
@@ -60,13 +64,14 @@ stdenv.mkDerivation {
       abiName=$(echo "$baseName" | sed -e 's/libc++/libc++abi/')
 
       for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
-        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${libcxxabi}/lib/$abiName $file
+        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${cxxabi}/lib/$abiName $file
       done
     done
   '';
 
   passthru = {
     isLLVM = true;
+    inherit cxxabi;
   };
 
   meta = llvm_meta // {
diff --git a/pkgs/development/compilers/llvm/10/libcxxabi/default.nix b/pkgs/development/compilers/llvm/10/libcxxabi/default.nix
index d62422fc9a12..d59191dfd724 100644
--- a/pkgs/development/compilers/llvm/10/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/10/libcxxabi/default.nix
@@ -67,6 +67,10 @@ stdenv.mkDerivation {
     install -m 644 ../include/${if stdenv.isDarwin then "*" else "cxxabi.h"} "$dev/include"
   '';
 
+  passthru = {
+    libName = "c++abi";
+  };
+
   meta = llvm_meta // {
     homepage = "https://libcxxabi.llvm.org/";
     description = "Provides C++ standard library support";
diff --git a/pkgs/development/compilers/llvm/11/default.nix b/pkgs/development/compilers/llvm/11/default.nix
index 4138a36c3912..c950beef0e8d 100644
--- a/pkgs/development/compilers/llvm/11/default.nix
+++ b/pkgs/development/compilers/llvm/11/default.nix
@@ -125,7 +125,7 @@ let
       cc = tools.clang-unwrapped;
       libcxx = targetLlvmLibraries.libcxx;
       extraPackages = [
-        targetLlvmLibraries.libcxxabi
+        libcxx.cxxabi
         targetLlvmLibraries.compiler-rt
       ];
       extraBuildCommands = mkExtraBuildCommands cc;
@@ -162,7 +162,7 @@ let
       libcxx = targetLlvmLibraries.libcxx;
       bintools = bintools';
       extraPackages = [
-        targetLlvmLibraries.libcxxabi
+        libcxx.cxxabi
         targetLlvmLibraries.compiler-rt
       ] ++ lib.optionals (!stdenv.targetPlatform.isWasm) [
         targetLlvmLibraries.libunwind
@@ -172,7 +172,7 @@ let
         echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm) ''
         echo "--unwindlib=libunwind" >> $out/nix-support/cc-cflags
-      '' + lib.optionalString (!stdenv.targetPlatform.isWasm && !stdenv.targetPlatform.isFreeBSD && stdenv.targetPlatform.useLLVM or false) ''
+      '' + lib.optionalString (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false) ''
         echo "-lunwind" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString stdenv.targetPlatform.isWasm ''
         echo "-fno-exceptions" >> $out/nix-support/cc-cflags
diff --git a/pkgs/development/compilers/llvm/11/libcxx/default.nix b/pkgs/development/compilers/llvm/11/libcxx/default.nix
index 237bbd4e0610..3e77e03b124b 100644
--- a/pkgs/development/compilers/llvm/11/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/11/libcxx/default.nix
@@ -1,7 +1,11 @@
-{ lib, stdenv, llvm_meta, fetch, fetchpatch, cmake, python3, libcxxabi, llvm, fixDarwinDylibNames, version
+{ lib, stdenv, llvm_meta, fetch, fetchpatch, cmake, python3, llvm, fixDarwinDylibNames, version
+, cxxabi ? if stdenv.hostPlatform.isFreeBSD then libcxxrt else libcxxabi
+, libcxxabi, libcxxrt
 , enableShared ? !stdenv.hostPlatform.isStatic
 }:
 
+assert stdenv.isDarwin -> cxxabi.pname == "libcxxabi";
+
 stdenv.mkDerivation {
   pname = "libcxx";
   inherit version;
@@ -42,10 +46,10 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ cmake python3 ]
     ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
 
-  buildInputs = [ libcxxabi ];
+  buildInputs = [ cxxabi ];
 
   cmakeFlags = [
-    "-DLIBCXX_CXX_ABI=libcxxabi"
+    "-DLIBCXX_CXX_ABI=${cxxabi.pname}"
   ] ++ lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) "-DLIBCXX_HAS_MUSL_LIBC=1"
     ++ lib.optional (stdenv.hostPlatform.useLLVM or false) "-DLIBCXX_USE_COMPILER_RT=ON"
     ++ lib.optionals stdenv.hostPlatform.isWasm [
@@ -76,13 +80,14 @@ stdenv.mkDerivation {
       abiName=$(echo "$baseName" | sed -e 's/libc++/libc++abi/')
 
       for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
-        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${libcxxabi}/lib/$abiName $file
+        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${cxxabi}/lib/$abiName $file
       done
     done
   '';
 
   passthru = {
     isLLVM = true;
+    inherit cxxabi;
   };
 
   meta = llvm_meta // {
diff --git a/pkgs/development/compilers/llvm/11/libcxxabi/default.nix b/pkgs/development/compilers/llvm/11/libcxxabi/default.nix
index ed0efe28a170..77f7e1411885 100644
--- a/pkgs/development/compilers/llvm/11/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/11/libcxxabi/default.nix
@@ -71,6 +71,10 @@ stdenv.mkDerivation {
     install -m 644 ../include/${if stdenv.isDarwin then "*" else "cxxabi.h"} "$dev/include"
   '';
 
+  passthru = {
+    libName = "c++abi";
+  };
+
   meta = llvm_meta // {
     homepage = "https://libcxxabi.llvm.org/";
     description = "Provides C++ standard library support";
diff --git a/pkgs/development/compilers/llvm/12/default.nix b/pkgs/development/compilers/llvm/12/default.nix
index 013d320c80cc..da3beccbe325 100644
--- a/pkgs/development/compilers/llvm/12/default.nix
+++ b/pkgs/development/compilers/llvm/12/default.nix
@@ -113,7 +113,7 @@ let
       cc = tools.clang-unwrapped;
       libcxx = targetLlvmLibraries.libcxx;
       extraPackages = [
-        targetLlvmLibraries.libcxxabi
+        libcxx.cxxabi
         targetLlvmLibraries.compiler-rt
       ];
       extraBuildCommands = mkExtraBuildCommands cc;
@@ -154,7 +154,7 @@ let
       libcxx = targetLlvmLibraries.libcxx;
       bintools = bintools';
       extraPackages = [
-        targetLlvmLibraries.libcxxabi
+        libcxx.cxxabi
         targetLlvmLibraries.compiler-rt
       ] ++ lib.optionals (!stdenv.targetPlatform.isWasm) [
         targetLlvmLibraries.libunwind
@@ -164,7 +164,7 @@ let
         echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm) ''
         echo "--unwindlib=libunwind" >> $out/nix-support/cc-cflags
-      '' + lib.optionalString (!stdenv.targetPlatform.isWasm && !stdenv.targetPlatform.isFreeBSD && stdenv.targetPlatform.useLLVM or false) ''
+      '' + lib.optionalString (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false) ''
         echo "-lunwind" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString stdenv.targetPlatform.isWasm ''
         echo "-fno-exceptions" >> $out/nix-support/cc-cflags
diff --git a/pkgs/development/compilers/llvm/12/libcxx/default.nix b/pkgs/development/compilers/llvm/12/libcxx/default.nix
index ef90eedb38c9..40bff3c1168b 100644
--- a/pkgs/development/compilers/llvm/12/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/12/libcxx/default.nix
@@ -1,7 +1,11 @@
-{ lib, stdenv, llvm_meta, fetch, cmake, python3, libcxxabi, llvm, fixDarwinDylibNames, version
+{ lib, stdenv, llvm_meta, fetch, cmake, python3, llvm, fixDarwinDylibNames, version
+, cxxabi ? if stdenv.hostPlatform.isFreeBSD then libcxxrt else libcxxabi
+, libcxxabi, libcxxrt
 , enableShared ? !stdenv.hostPlatform.isStatic
 }:
 
+assert stdenv.isDarwin -> cxxabi.pname == "libcxxabi";
+
 stdenv.mkDerivation {
   pname = "libcxx";
   inherit version;
@@ -30,10 +34,10 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ cmake python3 ]
     ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
 
-  buildInputs = [ libcxxabi ];
+  buildInputs = [ cxxabi ];
 
   cmakeFlags = [
-    "-DLIBCXX_CXX_ABI=libcxxabi"
+    "-DLIBCXX_CXX_ABI=${cxxabi.pname}"
   ] ++ lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) "-DLIBCXX_HAS_MUSL_LIBC=1"
     ++ lib.optional (stdenv.hostPlatform.useLLVM or false) "-DLIBCXX_USE_COMPILER_RT=ON"
     ++ lib.optionals stdenv.hostPlatform.isWasm [
@@ -51,13 +55,14 @@ stdenv.mkDerivation {
       abiName=$(echo "$baseName" | sed -e 's/libc++/libc++abi/')
 
       for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
-        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${libcxxabi}/lib/$abiName $file
+        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${cxxabi}/lib/$abiName $file
       done
     done
   '';
 
   passthru = {
     isLLVM = true;
+    inherit cxxabi;
   };
 
   meta = llvm_meta // {
diff --git a/pkgs/development/compilers/llvm/12/libcxxabi/default.nix b/pkgs/development/compilers/llvm/12/libcxxabi/default.nix
index 41c559a52ee8..bab39a5272c8 100644
--- a/pkgs/development/compilers/llvm/12/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/12/libcxxabi/default.nix
@@ -69,6 +69,10 @@ stdenv.mkDerivation {
     install -m 644 ../include/${if stdenv.isDarwin then "*" else "cxxabi.h"} "$dev/include"
   '';
 
+  passthru = {
+    libName = "c++abi";
+  };
+
   meta = llvm_meta // {
     homepage = "https://libcxxabi.llvm.org/";
     description = "Provides C++ standard library support";
diff --git a/pkgs/development/compilers/llvm/13/default.nix b/pkgs/development/compilers/llvm/13/default.nix
index 40fc5eaa6711..3fc459eb7f04 100644
--- a/pkgs/development/compilers/llvm/13/default.nix
+++ b/pkgs/development/compilers/llvm/13/default.nix
@@ -114,7 +114,7 @@ let
       cc = tools.clang-unwrapped;
       libcxx = targetLlvmLibraries.libcxx;
       extraPackages = [
-        targetLlvmLibraries.libcxxabi
+        libcxx.cxxabi
         targetLlvmLibraries.compiler-rt
       ];
       extraBuildCommands = mkExtraBuildCommands cc;
@@ -154,7 +154,7 @@ let
       libcxx = targetLlvmLibraries.libcxx;
       bintools = bintools';
       extraPackages = [
-        targetLlvmLibraries.libcxxabi
+        libcxx.cxxabi
         targetLlvmLibraries.compiler-rt
       ] ++ lib.optionals (!stdenv.targetPlatform.isWasm) [
         targetLlvmLibraries.libunwind
@@ -164,7 +164,7 @@ let
         echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm) ''
         echo "--unwindlib=libunwind" >> $out/nix-support/cc-cflags
-      '' + lib.optionalString (!stdenv.targetPlatform.isWasm && !stdenv.targetPlatform.isFreeBSD && stdenv.targetPlatform.useLLVM or false) ''
+      '' + lib.optionalString (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false) ''
         echo "-lunwind" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString stdenv.targetPlatform.isWasm ''
         echo "-fno-exceptions" >> $out/nix-support/cc-cflags
diff --git a/pkgs/development/compilers/llvm/13/libcxx/default.nix b/pkgs/development/compilers/llvm/13/libcxx/default.nix
index f6b76901de3f..b18c9da18ffd 100644
--- a/pkgs/development/compilers/llvm/13/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/13/libcxx/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv, llvm_meta, src, cmake, python3, fixDarwinDylibNames, version
-, libcxxabi
+, cxxabi ? if stdenv.hostPlatform.isFreeBSD then libcxxrt else libcxxabi
+, libcxxabi, libcxxrt
 , enableShared ? !stdenv.hostPlatform.isStatic
 
 # If headersOnly is true, the resulting package would only include the headers.
@@ -10,6 +11,8 @@
 , headersOnly ? false
 }:
 
+assert stdenv.isDarwin -> cxxabi.pname == "libcxxabi";
+
 stdenv.mkDerivation rec {
   pname = if headersOnly then "cxx-headers" else "libcxx";
   inherit version;
@@ -32,9 +35,9 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake python3 ]
     ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
 
-  buildInputs = lib.optionals (!headersOnly) [ libcxxabi ];
+  buildInputs = lib.optionals (!headersOnly) [ cxxabi ];
 
-  cmakeFlags = [ "-DLIBCXX_CXX_ABI=libcxxabi" ]
+  cmakeFlags = [ "-DLIBCXX_CXX_ABI=${cxxabi.pname}" ]
     ++ lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) "-DLIBCXX_HAS_MUSL_LIBC=1"
     ++ lib.optional (stdenv.hostPlatform.useLLVM or false) "-DLIBCXX_USE_COMPILER_RT=ON"
     ++ lib.optionals stdenv.hostPlatform.isWasm [
@@ -55,7 +58,7 @@ stdenv.mkDerivation rec {
       abiName=$(echo "$baseName" | sed -e 's/libc++/libc++abi/')
 
       for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
-        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${libcxxabi}/lib/$abiName $file
+        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${cxxabi}/lib/$abiName $file
       done
     done
   '';
@@ -71,6 +74,7 @@ stdenv.mkDerivation rec {
 
   passthru = {
     isLLVM = true;
+    inherit cxxabi;
   };
 
   meta = llvm_meta // {
diff --git a/pkgs/development/compilers/llvm/13/libcxxabi/default.nix b/pkgs/development/compilers/llvm/13/libcxxabi/default.nix
index bced2ccb789f..06137ab06734 100644
--- a/pkgs/development/compilers/llvm/13/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/13/libcxxabi/default.nix
@@ -66,6 +66,10 @@ stdenv.mkDerivation rec {
     install -m 644 ../include/${if stdenv.isDarwin then "*" else "cxxabi.h"} "$dev/include"
   '';
 
+  passthru = {
+    libName = "c++abi";
+  };
+
   meta = llvm_meta // {
     homepage = "https://libcxxabi.llvm.org/";
     description = "Provides C++ standard library support";
diff --git a/pkgs/development/compilers/llvm/14/default.nix b/pkgs/development/compilers/llvm/14/default.nix
index 8965388ae691..5d14c2f5f933 100644
--- a/pkgs/development/compilers/llvm/14/default.nix
+++ b/pkgs/development/compilers/llvm/14/default.nix
@@ -114,7 +114,7 @@ let
       cc = tools.clang-unwrapped;
       libcxx = targetLlvmLibraries.libcxx;
       extraPackages = [
-        targetLlvmLibraries.libcxxabi
+        libcxx.cxxabi
         targetLlvmLibraries.compiler-rt
       ];
       extraBuildCommands = mkExtraBuildCommands cc;
@@ -154,7 +154,7 @@ let
       libcxx = targetLlvmLibraries.libcxx;
       bintools = bintools';
       extraPackages = [
-        targetLlvmLibraries.libcxxabi
+        libcxx.cxxabi
         targetLlvmLibraries.compiler-rt
       ] ++ lib.optionals (!stdenv.targetPlatform.isWasm) [
         targetLlvmLibraries.libunwind
@@ -167,7 +167,7 @@ let
         ]
         ++ lib.optional (!stdenv.targetPlatform.isWasm) "--unwindlib=libunwind"
         ++ lib.optional
-          (!stdenv.targetPlatform.isWasm && !stdenv.targetPlatform.isFreeBSD && stdenv.targetPlatform.useLLVM or false)
+          (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false)
           "-lunwind"
         ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
     };
diff --git a/pkgs/development/compilers/llvm/14/libcxx/default.nix b/pkgs/development/compilers/llvm/14/libcxx/default.nix
index c623d41f92f6..3e42a8b1e43c 100644
--- a/pkgs/development/compilers/llvm/14/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/14/libcxx/default.nix
@@ -1,7 +1,8 @@
 { lib, stdenv, llvm_meta
 , monorepoSrc, runCommand
 , cmake, python3, fixDarwinDylibNames, version
-, libcxxabi
+, cxxabi ? if stdenv.hostPlatform.isFreeBSD then libcxxrt else libcxxabi
+, libcxxabi, libcxxrt
 , enableShared ? !stdenv.hostPlatform.isStatic
 
 # If headersOnly is true, the resulting package would only include the headers.
@@ -16,6 +17,8 @@ let
   basename = "libcxx";
 in
 
+assert stdenv.isDarwin -> cxxabi.pname == "libcxxabi";
+
 stdenv.mkDerivation rec {
   pname = basename + lib.optionalString headersOnly "-headers";
   inherit version;
@@ -48,9 +51,9 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake python3 ]
     ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
 
-  buildInputs = lib.optionals (!headersOnly) [ libcxxabi ];
+  buildInputs = lib.optionals (!headersOnly) [ cxxabi ];
 
-  cmakeFlags = [ "-DLIBCXX_CXX_ABI=libcxxabi" ]
+  cmakeFlags = [ "-DLIBCXX_CXX_ABI=${cxxabi.pname}" ]
     ++ lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) "-DLIBCXX_HAS_MUSL_LIBC=1"
     ++ lib.optional (stdenv.hostPlatform.useLLVM or false) "-DLIBCXX_USE_COMPILER_RT=ON"
     ++ lib.optionals stdenv.hostPlatform.isWasm [
@@ -71,13 +74,14 @@ stdenv.mkDerivation rec {
       abiName=$(echo "$baseName" | sed -e 's/libc++/libc++abi/')
 
       for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
-        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${libcxxabi}/lib/$abiName $file
+        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${cxxabi}/lib/$abiName $file
       done
     done
   '';
 
   passthru = {
     isLLVM = true;
+    inherit cxxabi;
   };
 
   meta = llvm_meta // {
diff --git a/pkgs/development/compilers/llvm/14/libcxxabi/default.nix b/pkgs/development/compilers/llvm/14/libcxxabi/default.nix
index 3be2f964abcd..30cc34a8c0e6 100644
--- a/pkgs/development/compilers/llvm/14/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/14/libcxxabi/default.nix
@@ -85,6 +85,10 @@ stdenv.mkDerivation rec {
       ln -s libc++abi.so.1.0 $out/lib/libc++abi.so.1
     '';
 
+  passthru = {
+    libName = "c++abi";
+  };
+
   meta = llvm_meta // {
     homepage = "https://libcxxabi.llvm.org/";
     description = "Provides C++ standard library support";
diff --git a/pkgs/development/compilers/llvm/5/default.nix b/pkgs/development/compilers/llvm/5/default.nix
index 0dc4151f236a..3cfc89dac75f 100644
--- a/pkgs/development/compilers/llvm/5/default.nix
+++ b/pkgs/development/compilers/llvm/5/default.nix
@@ -86,7 +86,7 @@ let
       cc = tools.clang-unwrapped;
       libcxx = targetLlvmLibraries.libcxx;
       extraPackages = [
-        targetLlvmLibraries.libcxxabi
+        libcxx.cxxabi
         targetLlvmLibraries.compiler-rt
       ];
       extraBuildCommands = mkExtraBuildCommands cc;
diff --git a/pkgs/development/compilers/llvm/5/libcxx/default.nix b/pkgs/development/compilers/llvm/5/libcxx/default.nix
index a5a86fcab4d0..073787e92db6 100644
--- a/pkgs/development/compilers/llvm/5/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/5/libcxx/default.nix
@@ -1,4 +1,9 @@
-{ lib, stdenv, llvm_meta, fetch, cmake, python3, libcxxabi, fixDarwinDylibNames, version }:
+{ lib, stdenv, llvm_meta, fetch, cmake, python3, fixDarwinDylibNames, version
+, cxxabi ? if stdenv.hostPlatform.isFreeBSD then libcxxrt else libcxxabi
+, libcxxabi, libcxxrt
+}:
+
+assert stdenv.isDarwin -> cxxabi.pname == "libcxxabi";
 
 stdenv.mkDerivation {
   pname = "libcxx";
@@ -33,13 +38,13 @@ stdenv.mkDerivation {
     ++ lib.optional stdenv.hostPlatform.isMusl python3
     ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
 
-  buildInputs = [ libcxxabi ];
+  buildInputs = [ cxxabi ];
 
   cmakeFlags = [
-    "-DLIBCXX_LIBCXXABI_LIB_PATH=${libcxxabi}/lib"
     "-DLIBCXX_LIBCPPABI_VERSION=2"
-    "-DLIBCXX_CXX_ABI=libcxxabi"
-  ] ++ lib.optional stdenv.hostPlatform.isMusl "-DLIBCXX_HAS_MUSL_LIBC=1";
+    "-DLIBCXX_CXX_ABI=${cxxabi.pname}"
+  ] ++ lib.optional stdenv.hostPlatform.isMusl "-DLIBCXX_HAS_MUSL_LIBC=1"
+    ++ lib.optional (cxxabi.pname == "libcxxabi") "-DLIBCXX_LIBCXXABI_LIB_PATH=${cxxabi}/lib";
 
   preInstall = lib.optionalString (stdenv.isDarwin) ''
     for file in lib/*.dylib; do
@@ -50,13 +55,14 @@ stdenv.mkDerivation {
       abiName=$(echo "$baseName" | sed -e 's/libc++/libc++abi/')
 
       for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
-        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${libcxxabi}/lib/$abiName $file
+        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${cxxabi}/lib/$abiName $file
       done
     done
   '';
 
   passthru = {
     isLLVM = true;
+    inherit cxxabi;
   };
 
   meta = llvm_meta // {
diff --git a/pkgs/development/compilers/llvm/5/libcxxabi/default.nix b/pkgs/development/compilers/llvm/5/libcxxabi/default.nix
index 97077ac77112..cc2ac1beaf0c 100644
--- a/pkgs/development/compilers/llvm/5/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/5/libcxxabi/default.nix
@@ -52,6 +52,10 @@ stdenv.mkDerivation {
     install -m 644 ../include/${if stdenv.isDarwin then "*" else "cxxabi.h"} "$dev/include"
   '';
 
+  passthru = {
+    libName = "c++abi";
+  };
+
   meta = llvm_meta // {
     homepage = "https://libcxxabi.llvm.org/";
     description = "Provides C++ standard library support";
diff --git a/pkgs/development/compilers/llvm/6/default.nix b/pkgs/development/compilers/llvm/6/default.nix
index 55a9adf8a638..a0c4ba727185 100644
--- a/pkgs/development/compilers/llvm/6/default.nix
+++ b/pkgs/development/compilers/llvm/6/default.nix
@@ -87,7 +87,7 @@ let
       cc = tools.clang-unwrapped;
       libcxx = targetLlvmLibraries.libcxx;
       extraPackages = [
-        targetLlvmLibraries.libcxxabi
+        libcxx.cxxabi
         targetLlvmLibraries.compiler-rt
       ];
       extraBuildCommands = mkExtraBuildCommands cc;
diff --git a/pkgs/development/compilers/llvm/6/libcxx/default.nix b/pkgs/development/compilers/llvm/6/libcxx/default.nix
index a6e723753ef8..0fc31d43cfa1 100644
--- a/pkgs/development/compilers/llvm/6/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/6/libcxx/default.nix
@@ -1,4 +1,9 @@
-{ lib, stdenv, llvm_meta, fetch, cmake, python3, libcxxabi, fixDarwinDylibNames, version }:
+{ lib, stdenv, llvm_meta, fetch, cmake, python3, fixDarwinDylibNames, version
+, cxxabi ? if stdenv.hostPlatform.isFreeBSD then libcxxrt else libcxxabi
+, libcxxabi, libcxxrt
+}:
+
+assert stdenv.isDarwin -> cxxabi.pname == "libcxxabi";
 
 stdenv.mkDerivation {
   pname = "libcxx";
@@ -39,13 +44,13 @@ stdenv.mkDerivation {
     ++ lib.optional stdenv.hostPlatform.isMusl python3
     ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
 
-  buildInputs = [ libcxxabi ];
+  buildInputs = [ cxxabi ];
 
   cmakeFlags = [
-    "-DLIBCXX_LIBCXXABI_LIB_PATH=${libcxxabi}/lib"
     "-DLIBCXX_LIBCPPABI_VERSION=2"
-    "-DLIBCXX_CXX_ABI=libcxxabi"
-  ] ++ lib.optional stdenv.hostPlatform.isMusl "-DLIBCXX_HAS_MUSL_LIBC=1";
+    "-DLIBCXX_CXX_ABI=${cxxabi.pname}"
+  ] ++ lib.optional stdenv.hostPlatform.isMusl "-DLIBCXX_HAS_MUSL_LIBC=1"
+    ++ lib.optional (cxxabi.pname == "libcxxabi") "-DLIBCXX_LIBCXXABI_LIB_PATH=${cxxabi}/lib";
 
   preInstall = lib.optionalString (stdenv.isDarwin) ''
     for file in lib/*.dylib; do
@@ -56,13 +61,14 @@ stdenv.mkDerivation {
       abiName=$(echo "$baseName" | sed -e 's/libc++/libc++abi/')
 
       for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
-        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${libcxxabi}/lib/$abiName $file
+        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${cxxabi}/lib/$abiName $file
       done
     done
   '';
 
   passthru = {
     isLLVM = true;
+    inherit cxxabi;
   };
 
   meta = llvm_meta // {
diff --git a/pkgs/development/compilers/llvm/6/libcxxabi/default.nix b/pkgs/development/compilers/llvm/6/libcxxabi/default.nix
index aea126b31d9f..0821dbdae06d 100644
--- a/pkgs/development/compilers/llvm/6/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/6/libcxxabi/default.nix
@@ -52,6 +52,10 @@ stdenv.mkDerivation {
     install -m 644 ../include/${if stdenv.isDarwin then "*" else "cxxabi.h"} "$dev/include"
   '';
 
+  passthru = {
+    libName = "c++abi";
+  };
+
   meta = llvm_meta // {
     homepage = "https://libcxxabi.llvm.org/";
     description = "Provides C++ standard library support";
diff --git a/pkgs/development/compilers/llvm/7/default.nix b/pkgs/development/compilers/llvm/7/default.nix
index d6dfd4dcdde2..7ddd14b60d3d 100644
--- a/pkgs/development/compilers/llvm/7/default.nix
+++ b/pkgs/development/compilers/llvm/7/default.nix
@@ -117,7 +117,7 @@ let
       cc = tools.clang-unwrapped;
       libcxx = targetLlvmLibraries.libcxx;
       extraPackages = [
-        targetLlvmLibraries.libcxxabi
+        libcxx.cxxabi
         targetLlvmLibraries.compiler-rt
       ];
       extraBuildCommands = mkExtraBuildCommands cc;
@@ -154,7 +154,7 @@ let
       libcxx = targetLlvmLibraries.libcxx;
       bintools = bintools';
       extraPackages = [
-        targetLlvmLibraries.libcxxabi
+        libcxx.cxxabi
         targetLlvmLibraries.compiler-rt
       ] ++ lib.optionals (!stdenv.targetPlatform.isWasm) [
         targetLlvmLibraries.libunwind
@@ -164,7 +164,7 @@ let
         echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm) ''
         echo "--unwindlib=libunwind" >> $out/nix-support/cc-cflags
-      '' + lib.optionalString (!stdenv.targetPlatform.isWasm && !stdenv.targetPlatform.isFreeBSD && stdenv.targetPlatform.useLLVM or false) ''
+      '' + lib.optionalString (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false) ''
         echo "-lunwind" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString stdenv.targetPlatform.isWasm ''
         echo "-fno-exceptions" >> $out/nix-support/cc-cflags
diff --git a/pkgs/development/compilers/llvm/7/libcxx/default.nix b/pkgs/development/compilers/llvm/7/libcxx/default.nix
index 145f0df8837c..3834e17fb8dd 100644
--- a/pkgs/development/compilers/llvm/7/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/7/libcxx/default.nix
@@ -1,7 +1,11 @@
-{ lib, stdenv, llvm_meta, fetch, cmake, python3, libcxxabi, fixDarwinDylibNames, version
+{ lib, stdenv, llvm_meta, fetch, cmake, python3, fixDarwinDylibNames, version
+, cxxabi ? if stdenv.hostPlatform.isFreeBSD then libcxxrt else libcxxabi
+, libcxxabi, libcxxrt
 , enableShared ? !stdenv.hostPlatform.isStatic
 }:
 
+assert stdenv.isDarwin -> cxxabi.pname == "libcxxabi";
+
 stdenv.mkDerivation {
   pname = "libcxx";
   inherit version;
@@ -42,13 +46,13 @@ stdenv.mkDerivation {
     ++ lib.optional stdenv.hostPlatform.isMusl python3
     ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
 
-  buildInputs = [ libcxxabi ];
+  buildInputs = [ cxxabi ];
 
   cmakeFlags = [
-    "-DLIBCXX_LIBCXXABI_LIB_PATH=${libcxxabi}/lib"
     "-DLIBCXX_LIBCPPABI_VERSION=2"
-    "-DLIBCXX_CXX_ABI=libcxxabi"
+    "-DLIBCXX_CXX_ABI=${cxxabi.pname}"
   ] ++ lib.optional stdenv.hostPlatform.isMusl "-DLIBCXX_HAS_MUSL_LIBC=1"
+    ++ lib.optional (cxxabi.pname == "libcxxabi") "-DLIBCXX_LIBCXXABI_LIB_PATH=${cxxabi}/lib"
     ++ lib.optional (stdenv.hostPlatform.useLLVM or false) "-DLIBCXX_USE_COMPILER_RT=ON"
     ++ lib.optional (!enableShared) "-DLIBCXX_ENABLE_SHARED=OFF" ;
 
@@ -61,13 +65,14 @@ stdenv.mkDerivation {
       abiName=$(echo "$baseName" | sed -e 's/libc++/libc++abi/')
 
       for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
-        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${libcxxabi}/lib/$abiName $file
+        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${cxxabi}/lib/$abiName $file
       done
     done
   '';
 
   passthru = {
     isLLVM = true;
+    inherit cxxabi;
   };
 
   meta = llvm_meta // {
diff --git a/pkgs/development/compilers/llvm/7/libcxxabi/default.nix b/pkgs/development/compilers/llvm/7/libcxxabi/default.nix
index d6f90634cd0b..c33c61361e2a 100644
--- a/pkgs/development/compilers/llvm/7/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/7/libcxxabi/default.nix
@@ -71,6 +71,10 @@ stdenv.mkDerivation {
     install -m 644 ../include/${if stdenv.isDarwin then "*" else "cxxabi.h"} "$dev/include"
   '';
 
+  passthru = {
+    libName = "c++abi";
+  };
+
   meta = llvm_meta // {
     homepage = "https://libcxxabi.llvm.org/";
     description = "Provides C++ standard library support";
diff --git a/pkgs/development/compilers/llvm/8/default.nix b/pkgs/development/compilers/llvm/8/default.nix
index b4f1cbf76c8f..29a2ee7ddc1e 100644
--- a/pkgs/development/compilers/llvm/8/default.nix
+++ b/pkgs/development/compilers/llvm/8/default.nix
@@ -118,7 +118,7 @@ let
       cc = tools.clang-unwrapped;
       libcxx = targetLlvmLibraries.libcxx;
       extraPackages = [
-        targetLlvmLibraries.libcxxabi
+        libcxx.cxxabi
         targetLlvmLibraries.compiler-rt
       ];
       extraBuildCommands = mkExtraBuildCommands cc;
@@ -155,7 +155,7 @@ let
       libcxx = targetLlvmLibraries.libcxx;
       bintools = bintools';
       extraPackages = [
-        targetLlvmLibraries.libcxxabi
+        libcxx.cxxabi
         targetLlvmLibraries.compiler-rt
       ] ++ lib.optionals (!stdenv.targetPlatform.isWasm) [
         targetLlvmLibraries.libunwind
@@ -165,7 +165,7 @@ let
         echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm) ''
         echo "--unwindlib=libunwind" >> $out/nix-support/cc-cflags
-      '' + lib.optionalString (!stdenv.targetPlatform.isWasm && !stdenv.targetPlatform.isFreeBSD && stdenv.targetPlatform.useLLVM or false) ''
+      '' + lib.optionalString (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false) ''
         echo "-lunwind" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString stdenv.targetPlatform.isWasm ''
         echo "-fno-exceptions" >> $out/nix-support/cc-cflags
diff --git a/pkgs/development/compilers/llvm/8/libcxx/default.nix b/pkgs/development/compilers/llvm/8/libcxx/default.nix
index 4a078ac9cda3..967d4b748dbe 100644
--- a/pkgs/development/compilers/llvm/8/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/8/libcxx/default.nix
@@ -1,7 +1,11 @@
-{ lib, stdenv, llvm_meta, fetch, cmake, python3, libcxxabi, fixDarwinDylibNames, version
+{ lib, stdenv, llvm_meta, fetch, cmake, python3, fixDarwinDylibNames, version
+, cxxabi ? if stdenv.hostPlatform.isFreeBSD then libcxxrt else libcxxabi
+, libcxxabi, libcxxrt
 , enableShared ? !stdenv.hostPlatform.isStatic
 }:
 
+assert stdenv.isDarwin -> cxxabi.pname == "libcxxabi";
+
 stdenv.mkDerivation {
   pname = "libcxx";
   inherit version;
@@ -41,13 +45,13 @@ stdenv.mkDerivation {
     ++ lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) python3
     ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
 
-  buildInputs = [ libcxxabi ];
+  buildInputs = [ cxxabi ];
 
   cmakeFlags = [
-    "-DLIBCXX_LIBCXXABI_LIB_PATH=${libcxxabi}/lib"
     "-DLIBCXX_LIBCPPABI_VERSION=2"
-    "-DLIBCXX_CXX_ABI=libcxxabi"
+    "-DLIBCXX_CXX_ABI=${cxxabi.pname}"
   ] ++ lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) "-DLIBCXX_HAS_MUSL_LIBC=1"
+    ++ lib.optional (cxxabi.pname == "libcxxabi") "-DLIBCXX_LIBCXXABI_LIB_PATH=${cxxabi}/lib"
     ++ lib.optional (stdenv.hostPlatform.useLLVM or false) "-DLIBCXX_USE_COMPILER_RT=ON"
     ++ lib.optionals stdenv.hostPlatform.isWasm [
       "-DLIBCXX_ENABLE_THREADS=OFF"
@@ -64,13 +68,14 @@ stdenv.mkDerivation {
       abiName=$(echo "$baseName" | sed -e 's/libc++/libc++abi/')
 
       for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
-        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${libcxxabi}/lib/$abiName $file
+        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${cxxabi}/lib/$abiName $file
       done
     done
   '';
 
   passthru = {
     isLLVM = true;
+    inherit cxxabi;
   };
 
   meta = llvm_meta // {
diff --git a/pkgs/development/compilers/llvm/8/libcxxabi/default.nix b/pkgs/development/compilers/llvm/8/libcxxabi/default.nix
index ab2d46f40a47..ebf8a5c702ee 100644
--- a/pkgs/development/compilers/llvm/8/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/8/libcxxabi/default.nix
@@ -67,6 +67,10 @@ stdenv.mkDerivation {
     install -m 644 ../include/${if stdenv.isDarwin then "*" else "cxxabi.h"} "$dev/include"
   '';
 
+  passthru = {
+    libName = "c++abi";
+  };
+
   meta = llvm_meta // {
     homepage = "https://libcxxabi.llvm.org/";
     description = "Provides C++ standard library support";
diff --git a/pkgs/development/compilers/llvm/9/default.nix b/pkgs/development/compilers/llvm/9/default.nix
index 329d4bee4bb1..e2191a81e795 100644
--- a/pkgs/development/compilers/llvm/9/default.nix
+++ b/pkgs/development/compilers/llvm/9/default.nix
@@ -118,7 +118,7 @@ let
       cc = tools.clang-unwrapped;
       libcxx = targetLlvmLibraries.libcxx;
       extraPackages = [
-        targetLlvmLibraries.libcxxabi
+        libcxx.cxxabi
         targetLlvmLibraries.compiler-rt
       ];
       extraBuildCommands = mkExtraBuildCommands cc;
@@ -155,7 +155,7 @@ let
       libcxx = targetLlvmLibraries.libcxx;
       bintools = bintools';
       extraPackages = [
-        targetLlvmLibraries.libcxxabi
+        libcxx.cxxabi
         targetLlvmLibraries.compiler-rt
       ] ++ lib.optionals (!stdenv.targetPlatform.isWasm) [
         targetLlvmLibraries.libunwind
@@ -165,7 +165,7 @@ let
         echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm) ''
         echo "--unwindlib=libunwind" >> $out/nix-support/cc-cflags
-      '' + lib.optionalString (!stdenv.targetPlatform.isWasm && !stdenv.targetPlatform.isFreeBSD && stdenv.targetPlatform.useLLVM or false) ''
+      '' + lib.optionalString (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false) ''
         echo "-lunwind" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString stdenv.targetPlatform.isWasm ''
         echo "-fno-exceptions" >> $out/nix-support/cc-cflags
diff --git a/pkgs/development/compilers/llvm/9/libcxx/default.nix b/pkgs/development/compilers/llvm/9/libcxx/default.nix
index 65441c359d60..ec09998ed37d 100644
--- a/pkgs/development/compilers/llvm/9/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/9/libcxx/default.nix
@@ -1,7 +1,11 @@
-{ lib, stdenv, llvm_meta, fetch, cmake, python3, libcxxabi, fixDarwinDylibNames, version
+{ lib, stdenv, llvm_meta, fetch, cmake, python3, fixDarwinDylibNames, version
+, cxxabi ? if stdenv.hostPlatform.isFreeBSD then libcxxrt else libcxxabi
+, libcxxabi, libcxxrt
 , enableShared ? !stdenv.hostPlatform.isStatic
 }:
 
+assert stdenv.isDarwin -> cxxabi.pname == "libcxxabi";
+
 stdenv.mkDerivation {
   pname = "libcxx";
   inherit version;
@@ -37,13 +41,13 @@ stdenv.mkDerivation {
     ++ lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) python3
     ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
 
-  buildInputs = [ libcxxabi ];
+  buildInputs = [ cxxabi ];
 
   cmakeFlags = [
-    "-DLIBCXX_LIBCXXABI_LIB_PATH=${libcxxabi}/lib"
     "-DLIBCXX_LIBCPPABI_VERSION=2"
-    "-DLIBCXX_CXX_ABI=libcxxabi"
+    "-DLIBCXX_CXX_ABI=${cxxabi.pname}"
   ] ++ lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) "-DLIBCXX_HAS_MUSL_LIBC=1"
+    ++ lib.optional (cxxabi.pname == "libcxxabi") "-DLIBCXX_LIBCXXABI_LIB_PATH=${cxxabi}/lib"
     ++ lib.optional (stdenv.hostPlatform.useLLVM or false) "-DLIBCXX_USE_COMPILER_RT=ON"
     ++ lib.optionals stdenv.hostPlatform.isWasm [
       "-DLIBCXX_ENABLE_THREADS=OFF"
@@ -60,13 +64,14 @@ stdenv.mkDerivation {
       abiName=$(echo "$baseName" | sed -e 's/libc++/libc++abi/')
 
       for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
-        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${libcxxabi}/lib/$abiName $file
+        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${cxxabi}/lib/$abiName $file
       done
     done
   '';
 
   passthru = {
     isLLVM = true;
+    inherit cxxabi;
   };
 
   meta = llvm_meta // {
diff --git a/pkgs/development/compilers/llvm/9/libcxxabi/default.nix b/pkgs/development/compilers/llvm/9/libcxxabi/default.nix
index cfd1c32abd00..f19bfb157ce9 100644
--- a/pkgs/development/compilers/llvm/9/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/9/libcxxabi/default.nix
@@ -67,6 +67,10 @@ stdenv.mkDerivation {
     install -m 644 ../include/${if stdenv.isDarwin then "*" else "cxxabi.h"} "$dev/include"
   '';
 
+  passthru = {
+    libName = "c++abi";
+  };
+
   meta = llvm_meta // {
     homepage = "https://libcxxabi.llvm.org/";
     description = "Provides C++ standard library support";
diff --git a/pkgs/development/compilers/llvm/git/default.nix b/pkgs/development/compilers/llvm/git/default.nix
index 7c48d2042f0d..ffbce74a4822 100644
--- a/pkgs/development/compilers/llvm/git/default.nix
+++ b/pkgs/development/compilers/llvm/git/default.nix
@@ -113,7 +113,7 @@ let
       cc = tools.clang-unwrapped;
       libcxx = targetLlvmLibraries.libcxx;
       extraPackages = [
-        targetLlvmLibraries.libcxxabi
+        libcxx.cxxabi
         targetLlvmLibraries.compiler-rt
       ];
       extraBuildCommands = mkExtraBuildCommands cc;
@@ -153,7 +153,7 @@ let
       libcxx = targetLlvmLibraries.libcxx;
       bintools = bintools';
       extraPackages = [
-        targetLlvmLibraries.libcxxabi
+        libcxx.cxxabi
         targetLlvmLibraries.compiler-rt
       ] ++ lib.optionals (!stdenv.targetPlatform.isWasm) [
         targetLlvmLibraries.libunwind
@@ -166,7 +166,7 @@ let
         ]
         ++ lib.optional (!stdenv.targetPlatform.isWasm) "--unwindlib=libunwind"
         ++ lib.optional
-          (!stdenv.targetPlatform.isWasm && !stdenv.targetPlatform.isFreeBSD && stdenv.targetPlatform.useLLVM or false)
+          (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false)
           "-lunwind"
         ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
     };
diff --git a/pkgs/development/compilers/llvm/git/libcxx/default.nix b/pkgs/development/compilers/llvm/git/libcxx/default.nix
index 95e32041037a..a29edb0658d3 100644
--- a/pkgs/development/compilers/llvm/git/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/git/libcxx/default.nix
@@ -1,7 +1,8 @@
 { lib, stdenv, llvm_meta
 , monorepoSrc, runCommand
 , cmake, python3, fixDarwinDylibNames, version
-, libcxxabi
+, cxxabi ? if stdenv.hostPlatform.isFreeBSD then libcxxrt else libcxxabi
+, libcxxabi, libcxxrt
 , enableShared ? !stdenv.hostPlatform.isStatic
 
 # If headersOnly is true, the resulting package would only include the headers.
@@ -16,6 +17,8 @@ let
   basename = "libcxx";
 in
 
+assert stdenv.isDarwin -> cxxabi.pname == "libcxxabi";
+
 stdenv.mkDerivation rec {
   pname = basename + lib.optionalString headersOnly "-headers";
   inherit version;
@@ -59,12 +62,12 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake python3 ]
     ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
 
-  buildInputs = lib.optionals (!headersOnly) [ libcxxabi ];
+  buildInputs = lib.optionals (!headersOnly) [ cxxabi ];
 
   cmakeFlags = [
     "-DLLVM_ENABLE_RUNTIMES=libcxx"
-    "-DLIBCXX_CXX_ABI=${lib.optionalString (!headersOnly) "system-"}libcxxabi"
-  ] ++ lib.optional (!headersOnly) "-DLIBCXX_CXX_ABI_INCLUDE_PATHS=${libcxxabi.dev}/include/c++/v1"
+    "-DLIBCXX_CXX_ABI=${lib.optionalString (!headersOnly) "system-"}${cxxabi.pname}"
+  ] ++ lib.optional (!headersOnly && cxxabi.pname == "libcxxabi") "-DLIBCXX_CXX_ABI_INCLUDE_PATHS=${cxxabi.dev}/include/c++/v1"
     ++ lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) "-DLIBCXX_HAS_MUSL_LIBC=1"
     ++ lib.optional (stdenv.hostPlatform.useLLVM or false) "-DLIBCXX_USE_COMPILER_RT=ON"
     ++ lib.optionals stdenv.hostPlatform.isWasm [
@@ -85,13 +88,14 @@ stdenv.mkDerivation rec {
       abiName=$(echo "$baseName" | sed -e 's/libc++/libc++abi/')
 
       for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
-        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${libcxxabi}/lib/$abiName $file
+        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${cxxabi}/lib/$abiName $file
       done
     done
   '';
 
   passthru = {
     isLLVM = true;
+    inherit cxxabi;
   };
 
   meta = llvm_meta // {
diff --git a/pkgs/development/compilers/llvm/git/libcxxabi/default.nix b/pkgs/development/compilers/llvm/git/libcxxabi/default.nix
index 804acd6c7451..3d5f875637fd 100644
--- a/pkgs/development/compilers/llvm/git/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/git/libcxxabi/default.nix
@@ -95,6 +95,10 @@ stdenv.mkDerivation rec {
     install -m 644 ../../${pname}/include/${if stdenv.isDarwin then "*" else "cxxabi.h"} "$dev/include"
   '';
 
+  passthru = {
+    libName = "c++abi";
+  };
+
   meta = llvm_meta // {
     homepage = "https://libcxxabi.llvm.org/";
     description = "Provides C++ standard library support";
diff --git a/pkgs/development/compilers/zulu/8.nix b/pkgs/development/compilers/zulu/8.nix
index e23dbdbd6c1b..9780dac344b1 100644
--- a/pkgs/development/compilers/zulu/8.nix
+++ b/pkgs/development/compilers/zulu/8.nix
@@ -21,11 +21,11 @@
 }:
 
 let
-  version = "8.48.0.53";
-  openjdk = "8.0.265";
+  version = "8.68.0.19";
+  openjdk = "8.0.362";
 
-  sha256_linux = "ed32513524b32a83b3b388831c69d1884df5675bd5069c6d1485fd1a060be209";
-  sha256_darwin = "36f189bfbd0255195848835819377474ba9c1c868e3c204633c451c96e21f30a";
+  sha256_linux = "sha256-jNty0iJoXG+sp7v2fGCrwZWCSZfQ4tkYe8ERixQMKL0=";
+  sha256_darwin = "sha256-3/P3puM6a7tCHP5eZM6IzbdPrqnhY1dTa7QWss9M08M=";
 
   platform = if stdenv.isDarwin then "macosx" else "linux";
   hash = if stdenv.isDarwin then sha256_darwin else sha256_linux;
diff --git a/pkgs/development/compilers/zulu/default.nix b/pkgs/development/compilers/zulu/default.nix
index 03dff2348a29..b4338738f892 100644
--- a/pkgs/development/compilers/zulu/default.nix
+++ b/pkgs/development/compilers/zulu/default.nix
@@ -22,12 +22,12 @@
 }:
 
 let
-  version = "11.52.13";
-  openjdk = "11.0.13";
+  version = "11.62.17";
+  openjdk = "11.0.18";
 
-  sha256_x64_linux = "77a126669b26b3a89e0117b0f28cddfcd24fcd7699b2c1d35f921487148b9a9f";
-  sha256_x64_darwin = "a96f9f859350f977319ebb5c2a999c182ab6b99b24c60e19d97c54367868a63e";
-  sha256_aarch64_darwin = "dmzfergSUVz39T30PT/6ZtT8JNqv5lzdX7zUsXsFGJg=";
+  sha256_x64_linux = "sha256-b65oEbDzrrsUw+WaX94USBz/QS74yiMiGZPxqzMmmqs=";
+  sha256_x64_darwin = "sha256-nRRWTWiog8bRblmmPIPE5YibA34St3ZrJpZN91qEDUg=";
+  sha256_aarch64_darwin = "sha256-TBTrBxOfGo6MV+Md49P3sDfqVG1e+NraqfVbw9WTppk=";
 
   platform = if stdenv.isDarwin then "macosx" else "linux";
   hash = if stdenv.isAarch64 && stdenv.isDarwin then sha256_aarch64_darwin else if stdenv.isDarwin then sha256_x64_darwin else sha256_x64_linux;
diff --git a/pkgs/development/coq-modules/Cheerios/default.nix b/pkgs/development/coq-modules/Cheerios/default.nix
index 7ded64ec572e..5a7ec31f50c1 100644
--- a/pkgs/development/coq-modules/Cheerios/default.nix
+++ b/pkgs/development/coq-modules/Cheerios/default.nix
@@ -1,10 +1,10 @@
 { lib, mkCoqDerivation, coq, StructTact, version ? null }:
 
-with lib; mkCoqDerivation {
+mkCoqDerivation {
   pname   = "cheerios";
   owner   = "uwplse";
   inherit version;
-  defaultVersion = if versions.range "8.6" "8.16" coq.version then "20200201" else null;
+  defaultVersion = if lib.versions.range "8.6" "8.16" coq.version then "20200201" else null;
   release."20200201".rev    = "9c7f66e57b91f706d70afa8ed99d64ed98ab367d";
   release."20200201".sha256 = "1h55s6lk47bk0lv5ralh81z55h799jbl9mhizmqwqzy57y8wqgs1";
 
diff --git a/pkgs/development/coq-modules/CoLoR/default.nix b/pkgs/development/coq-modules/CoLoR/default.nix
index 9dabae0bdbca..a926f6d8092d 100644
--- a/pkgs/development/coq-modules/CoLoR/default.nix
+++ b/pkgs/development/coq-modules/CoLoR/default.nix
@@ -1,10 +1,10 @@
 { lib, mkCoqDerivation, coq, bignums, version ? null }:
 
-with lib; mkCoqDerivation {
+mkCoqDerivation {
   pname = "color";
   owner = "fblanqui";
   inherit version;
-  defaultVersion = with versions; switch coq.version [
+  defaultVersion = with lib.versions; lib.switch coq.version [
     {case = range "8.12" "8.16"; out = "1.8.2"; }
     {case = range "8.10" "8.11"; out = "1.7.0"; }
     {case = range "8.8"  "8.9";  out = "1.6.0"; }
@@ -26,6 +26,6 @@ with lib; mkCoqDerivation {
   meta = {
     homepage = "https://github.com/fblanqui/color";
     description = "CoLoR is a library of formal mathematical definitions and proofs of theorems on rewriting theory and termination whose correctness has been mechanically checked by the Coq proof assistant.";
-    maintainers = with maintainers; [ jpas jwiegley ];
+    maintainers = with lib.maintainers; [ jpas jwiegley ];
   };
 }
diff --git a/pkgs/development/coq-modules/HoTT/default.nix b/pkgs/development/coq-modules/HoTT/default.nix
index 7b9ded1e399a..a0761dfb5193 100644
--- a/pkgs/development/coq-modules/HoTT/default.nix
+++ b/pkgs/development/coq-modules/HoTT/default.nix
@@ -1,11 +1,11 @@
 { lib, mkCoqDerivation, autoconf, automake, coq, version ? null }:
 
-with lib; mkCoqDerivation {
+mkCoqDerivation {
   pname = "HoTT";
   repo = "Coq-HoTT";
   owner = "HoTT";
   inherit version;
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
     { case = range "8.14" "8.16"; out = coq.coq-version; }
   ] null;
   releaseRev = v: "V${v}";
@@ -20,6 +20,6 @@ with lib; mkCoqDerivation {
   meta = {
     homepage = "https://homotopytypetheory.org/";
     description = "Homotopy type theory";
-    maintainers = with maintainers; [ siddharthist ];
+    maintainers = with lib.maintainers; [ siddharthist ];
   };
 }
diff --git a/pkgs/development/coq-modules/ITree/default.nix b/pkgs/development/coq-modules/ITree/default.nix
index 23922dcce428..e0a9e1f6bfc4 100644
--- a/pkgs/development/coq-modules/ITree/default.nix
+++ b/pkgs/development/coq-modules/ITree/default.nix
@@ -1,10 +1,10 @@
 { lib, mkCoqDerivation, coq, version ? null , paco, coq-ext-lib }:
 
-with lib; mkCoqDerivation rec {
+mkCoqDerivation rec {
   pname = "InteractionTrees";
   owner = "DeepSpec";
   inherit version;
-  defaultVersion = with versions; switch coq.version [
+  defaultVersion = with lib.versions; lib.switch coq.version [
     { case = range "8.10" "8.16";  out = "4.0.0"; }
   ] null;
   release."4.0.0".sha256 = "0h5rhndl8syc24hxq1gch86kj7mpmgr89bxp2hmf28fd7028ijsm";
@@ -12,6 +12,6 @@ with lib; mkCoqDerivation rec {
   propagatedBuildInputs = [ coq-ext-lib paco ];
   meta = {
     description = "A Library for Representing Recursive and Impure Programs in Coq";
-    maintainers = with maintainers; [ larsr ];
+    maintainers = with lib.maintainers; [ larsr ];
   };
 }
diff --git a/pkgs/development/coq-modules/LibHyps/default.nix b/pkgs/development/coq-modules/LibHyps/default.nix
index 1a9eb9cec059..b0997e857b09 100644
--- a/pkgs/development/coq-modules/LibHyps/default.nix
+++ b/pkgs/development/coq-modules/LibHyps/default.nix
@@ -1,11 +1,10 @@
 { lib, mkCoqDerivation, coq, version ? null }:
 
-with lib;
 mkCoqDerivation {
   pname = "LibHyps";
   owner = "Matafou";
   inherit version;
-  defaultVersion = if (versions.range "8.11" "8.16") coq.version then "2.0.4.1" else null;
+  defaultVersion = if (lib.versions.range "8.11" "8.16") coq.version then "2.0.4.1" else null;
   release = {
     "2.0.4.1".sha256 = "09p89701zhrfdmqlpxw3mziw8yylj1w1skb4b0xpbdwd1vsn4k3h";
   };
@@ -16,6 +15,6 @@ mkCoqDerivation {
 
   meta = {
     description = "Hypotheses manipulation library";
-    license = licenses.mit;
+    license = lib.licenses.mit;
   };
 }
diff --git a/pkgs/development/coq-modules/StructTact/default.nix b/pkgs/development/coq-modules/StructTact/default.nix
index 3fb8a42cfb56..778ab142654d 100644
--- a/pkgs/development/coq-modules/StructTact/default.nix
+++ b/pkgs/development/coq-modules/StructTact/default.nix
@@ -1,10 +1,10 @@
 { lib, mkCoqDerivation, coq, version ? null }:
 
-with lib; mkCoqDerivation {
+mkCoqDerivation {
   pname = "StructTact";
   owner = "uwplse";
   inherit version;
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
     { case = range "8.6" "8.16"; out = "20210328"; }
     { case = range "8.5" "8.13"; out = "20181102"; }
   ] null;
diff --git a/pkgs/development/coq-modules/VST/default.nix b/pkgs/development/coq-modules/VST/default.nix
index 8a4243a87043..72d88dec6f1d 100644
--- a/pkgs/development/coq-modules/VST/default.nix
+++ b/pkgs/development/coq-modules/VST/default.nix
@@ -1,7 +1,5 @@
 { lib, mkCoqDerivation, coq, compcert, ITree, version ? null }:
 
-with lib;
-
 # A few modules that are not built and installed by default
 #  but that may be useful to some users.
 # They depend on ITree.
@@ -11,7 +9,7 @@ let extra_floyd_files = [
   "powerlater.v"
   ]
   # floyd/printf.v is broken in VST 2.9
-  ++ optional (!versions.isGe "8.13" coq.coq-version) "printf.v"
+  ++ lib.optional (!lib.versions.isGe "8.13" coq.coq-version) "printf.v"
   ++ [
   "quickprogram.v"
   ];
@@ -24,7 +22,7 @@ mkCoqDerivation {
   owner = "PrincetonUniversity";
   repo = "VST";
   inherit version;
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
     { case = range "8.15" "8.16"; out = "2.11.1"; }
     { case = range "8.14" "8.16"; out = "2.10"; }
     { case = range "8.13" "8.15"; out = "2.9"; }
diff --git a/pkgs/development/coq-modules/Velisarios/default.nix b/pkgs/development/coq-modules/Velisarios/default.nix
index 08322fb7fc40..62eb9c389abb 100644
--- a/pkgs/development/coq-modules/Velisarios/default.nix
+++ b/pkgs/development/coq-modules/Velisarios/default.nix
@@ -1,10 +1,10 @@
 { lib, mkCoqDerivation, coq, version ? null }:
 
-with lib; mkCoqDerivation {
+mkCoqDerivation {
   pname = "Velisarios";
   owner = "vrahli";
   inherit version;
-  defaultVersion = if versions.range "8.6" "8.8" coq.coq-version then "20180221" else null;
+  defaultVersion = if lib.versions.range "8.6" "8.8" coq.coq-version then "20180221" else null;
 
   release."20180221".rev    = "e1eee1f10d5d46331a560bd8565ac101229d0d6b";
   release."20180221".sha256 = "0l9885nxy0n955fj1gnijlxl55lyxiv9yjfmz8hmfrn9hl8vv1m2";
diff --git a/pkgs/development/coq-modules/Verdi/default.nix b/pkgs/development/coq-modules/Verdi/default.nix
index 80b964b39042..6dec34a095d7 100644
--- a/pkgs/development/coq-modules/Verdi/default.nix
+++ b/pkgs/development/coq-modules/Verdi/default.nix
@@ -1,11 +1,11 @@
 { lib, mkCoqDerivation, coq, Cheerios, InfSeqExt, ssreflect, version ? null }:
 
 
-with lib; mkCoqDerivation {
+mkCoqDerivation {
   pname = "verdi";
   owner = "uwplse";
   inherit version;
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
     { case = range "8.7" "8.16"; out = "20211026"; }
     { case = range "8.7" "8.14"; out = "20210524"; }
     { case = range "8.7" "8.13"; out = "20200131"; }
diff --git a/pkgs/development/coq-modules/aac-tactics/default.nix b/pkgs/development/coq-modules/aac-tactics/default.nix
index 90ddf3e524ff..180b7b88fced 100644
--- a/pkgs/development/coq-modules/aac-tactics/default.nix
+++ b/pkgs/development/coq-modules/aac-tactics/default.nix
@@ -1,5 +1,4 @@
 { lib, mkCoqDerivation, coq, version ? null }:
-with lib;
 
 mkCoqDerivation {
   pname = "aac-tactics";
@@ -21,7 +20,7 @@ mkCoqDerivation {
   release."8.5.0".sha256 = "sha256-7yNxJn6CH5xS5w/zsXfcZYORa6e5/qS9v8PUq2o02h4=";
 
   inherit version;
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
     { case = "8.16"; out = "8.16.0"; }
     { case = "8.15"; out = "8.15.1"; }
     { case = "8.14"; out = "8.14.1"; }
@@ -37,7 +36,7 @@ mkCoqDerivation {
 
   mlPlugin = true;
 
-  meta = {
+  meta = with lib; {
     description = "Coq plugin providing tactics for rewriting universally quantified equations";
     longDescription = ''
       This Coq plugin provides tactics for rewriting universally quantified
diff --git a/pkgs/development/coq-modules/addition-chains/default.nix b/pkgs/development/coq-modules/addition-chains/default.nix
index 63ba0e805072..f40bdbf1899c 100644
--- a/pkgs/development/coq-modules/addition-chains/default.nix
+++ b/pkgs/development/coq-modules/addition-chains/default.nix
@@ -1,6 +1,5 @@
 { lib, mkCoqDerivation, coq, mathcomp-ssreflect, mathcomp-algebra, mathcomp-fingroup, paramcoq
 , version ? null }:
-with lib;
 
 mkCoqDerivation {
   pname = "addition-chains";
@@ -12,7 +11,7 @@ mkCoqDerivation {
   releaseRev = (v: "v${v}");
 
   inherit version;
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
     { case = range "8.13" "8.16"; out = "0.6"; }
     { case = range "8.11" "8.12"; out = "0.4"; }
   ] null;
@@ -21,7 +20,7 @@ mkCoqDerivation {
 
   useDune = true;
 
-  meta = {
+  meta = with lib; {
     description = "Exponentiation algorithms following addition chains";
     longDescription = ''
       Addition chains are algorithms for computations of the p-th
diff --git a/pkgs/development/coq-modules/autosubst/default.nix b/pkgs/development/coq-modules/autosubst/default.nix
index 5a7331c22206..72768777c1b5 100644
--- a/pkgs/development/coq-modules/autosubst/default.nix
+++ b/pkgs/development/coq-modules/autosubst/default.nix
@@ -1,5 +1,4 @@
 { lib, mkCoqDerivation, coq, mathcomp-ssreflect, version ? null }:
-with lib;
 
 mkCoqDerivation {
   pname = "autosubst";
@@ -8,13 +7,13 @@ mkCoqDerivation {
   release."1.7".sha256 = "sha256-qoyteQ5W2Noxf12uACOVeHhPLvgmTzrvEo6Ts+FKTGI=";
 
   inherit version;
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
     { case = range "8.10" "8.16"; out = "1.7"; }
   ] null;
 
   propagatedBuildInputs = [ mathcomp-ssreflect ];
 
-  meta = {
+  meta = with lib; {
     homepage = "https://www.ps.uni-saarland.de/autosubst/";
     description = "Automation for de Bruijn syntax and substitution in Coq";
     maintainers = with maintainers; [ siraben jwiegley ];
diff --git a/pkgs/development/coq-modules/bignums/default.nix b/pkgs/development/coq-modules/bignums/default.nix
index f2e64ab2f61b..c62e20a5a2e7 100644
--- a/pkgs/development/coq-modules/bignums/default.nix
+++ b/pkgs/development/coq-modules/bignums/default.nix
@@ -1,11 +1,11 @@
 { lib, mkCoqDerivation, coq, version ? null }:
 
-with lib; mkCoqDerivation {
+mkCoqDerivation {
   pname = "bignums";
   owner = "coq";
   displayVersion = { bignums = ""; };
   inherit version;
-  defaultVersion = if versions.isGe "8.6" coq.coq-version
+  defaultVersion = if lib.versions.isGe "8.6" coq.coq-version
     then "${coq.coq-version}.0" else null;
 
   release."8.17.0".sha256 = "sha256-MXYjqN86+3O4hT2ql62U83T5H03E/8ysH8erpvC/oyw=";
@@ -25,5 +25,5 @@ with lib; mkCoqDerivation {
 
   mlPlugin = true;
 
-  meta = { license = licenses.lgpl2; };
+  meta = { license = lib.licenses.lgpl2; };
 }
diff --git a/pkgs/development/coq-modules/category-theory/default.nix b/pkgs/development/coq-modules/category-theory/default.nix
index 97feac90c3bd..ed214533b03f 100644
--- a/pkgs/development/coq-modules/category-theory/default.nix
+++ b/pkgs/development/coq-modules/category-theory/default.nix
@@ -1,6 +1,6 @@
 { lib, mkCoqDerivation, coq, ssreflect, equations, version ? null }:
 
-with lib; mkCoqDerivation {
+mkCoqDerivation {
 
   pname = "category-theory";
   owner = "jwiegley";
@@ -16,7 +16,7 @@ with lib; mkCoqDerivation {
   release."20180709".sha256 = "0f2nr8dgn1ab7hr7jrdmr1zla9g9h8216q4yf4wnff9qkln8sbbs";
 
   inherit version;
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
     { case = range "8.14" "8.16"; out = "1.0.0"; }
     { case = range "8.10" "8.15"; out = "20211213"; }
     { case = range "8.8" "8.9"; out = "20190414"; }
@@ -28,6 +28,6 @@ with lib; mkCoqDerivation {
 
   meta = {
     description = "A formalization of category theory in Coq for personal study and practical work";
-    maintainers = with maintainers; [ jwiegley ];
+    maintainers = with lib.maintainers; [ jwiegley ];
   };
 }
diff --git a/pkgs/development/coq-modules/ceres/default.nix b/pkgs/development/coq-modules/ceres/default.nix
index 375eb6c75bb0..75d57936ff5f 100644
--- a/pkgs/development/coq-modules/ceres/default.nix
+++ b/pkgs/development/coq-modules/ceres/default.nix
@@ -1,6 +1,5 @@
 { lib, mkCoqDerivation, coq, version ? null }:
 
-with lib;
 mkCoqDerivation {
 
   pname = "ceres";
@@ -8,10 +7,10 @@ mkCoqDerivation {
   owner = "Lysxia";
 
   inherit version;
-  defaultVersion = if versions.range "8.8" "8.16" coq.version then "0.4.0" else null;
+  defaultVersion = if lib.versions.range "8.8" "8.16" coq.version then "0.4.0" else null;
   release."0.4.0".sha256 = "sha256:0zwp3pn6fdj0qdig734zdczrls886al06mxqhhabms0jvvqijmbi";
 
-  meta = {
+  meta = with lib; {
     description = "Library for serialization to S-expressions";
     license = licenses.mit;
     maintainers = with maintainers; [ Zimmi48 ];
diff --git a/pkgs/development/coq-modules/compcert/default.nix b/pkgs/development/coq-modules/compcert/default.nix
index fb6527989d8e..fb33f92bcc2a 100644
--- a/pkgs/development/coq-modules/compcert/default.nix
+++ b/pkgs/development/coq-modules/compcert/default.nix
@@ -5,8 +5,6 @@
 , version ? null
 }:
 
-with lib;
-
 let compcert = mkCoqDerivation rec {
 
   pname = "compcert";
@@ -15,7 +13,7 @@ let compcert = mkCoqDerivation rec {
   inherit version;
   releaseRev = v: "v${v}";
 
-  defaultVersion =  with versions; switch coq.version [
+  defaultVersion =  with lib.versions; lib.switch coq.version [
       { case = range "8.14" "8.16"; out = "3.11"; }
       { case = isEq "8.13"        ; out = "3.10"; }
       { case = isEq "8.12"       ; out = "3.9"; }
@@ -84,7 +82,7 @@ let compcert = mkCoqDerivation rec {
 }; in
 compcert.overrideAttrs (o:
   {
-    patches = with versions; switch [ coq.version o.version ] [
+    patches = with lib.versions; lib.switch [ coq.version o.version ] [
       { cases = [ (range "8.12.2" "8.13.2") "3.8" ];
         out = [
           # Support for Coq 8.12.2
diff --git a/pkgs/development/coq-modules/contribs/default.nix b/pkgs/development/coq-modules/contribs/default.nix
index cb6dedca3551..2d10f683cc36 100644
--- a/pkgs/development/coq-modules/contribs/default.nix
+++ b/pkgs/development/coq-modules/contribs/default.nix
@@ -1,16 +1,16 @@
 { lib, mkCoqDerivation, coq, callPackage }:
 
-with lib; let mkContrib = pname: coqs: param:
+  let mkContrib = pname: coqs: param:
   let contribVersion = {version ? null}: mkCoqDerivation ({
       inherit pname version;
       owner = "coq-contribs";
       mlPlugin = true;
-    } // optionalAttrs (builtins.elem coq.coq-version coqs) ({
+    } // lib.optionalAttrs (builtins.elem coq.coq-version coqs) ({
       defaultVersion = param.version;
       release = { "${param.version}" = { inherit (param) rev sha256; }; };
     } // (removeAttrs param [ "version" "rev" "sha256" ]))
   ); in
-  makeOverridable contribVersion {} ; in
+  lib.makeOverridable contribVersion {} ; in
 {
   aac-tactics = mkContrib "aac-tactics" [ "8.7" "8.8" ] {
     "8.7" = {
diff --git a/pkgs/development/coq-modules/coq-bits/default.nix b/pkgs/development/coq-modules/coq-bits/default.nix
index a2ef7e09a7d6..16a26d9fa32e 100644
--- a/pkgs/development/coq-modules/coq-bits/default.nix
+++ b/pkgs/development/coq-modules/coq-bits/default.nix
@@ -1,10 +1,10 @@
 { lib, mkCoqDerivation, coq, mathcomp-algebra, version ? null }:
 
-with lib; mkCoqDerivation {
+mkCoqDerivation {
   pname = "coq-bits";
   repo = "bits";
   inherit version;
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
     { case = range "8.10" "8.16"; out = "1.1.0"; }
     { case = range "8.7"  "8.15"; out = "1.0.0"; }
   ] null;
@@ -14,7 +14,7 @@ with lib; mkCoqDerivation {
 
   propagatedBuildInputs = [ mathcomp-algebra ];
 
-  meta = {
+  meta = with lib; {
     description = "A formalization of bitset operations in Coq";
     license = licenses.asl20;
     maintainers = with maintainers; [ ptival ];
diff --git a/pkgs/development/coq-modules/coq-ext-lib/default.nix b/pkgs/development/coq-modules/coq-ext-lib/default.nix
index b6f124b3f0fb..d555e55389b1 100644
--- a/pkgs/development/coq-modules/coq-ext-lib/default.nix
+++ b/pkgs/development/coq-modules/coq-ext-lib/default.nix
@@ -1,10 +1,10 @@
 { lib, mkCoqDerivation, coq, version ? null }:
 
-with lib; mkCoqDerivation rec {
+mkCoqDerivation rec {
   pname = "coq-ext-lib";
   owner = "coq-ext-lib";
   inherit version;
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
     { case = range "8.11" "8.16"; out = "0.11.7"; }
     { case = range "8.8" "8.16"; out = "0.11.6"; }
     { case = range "8.8" "8.14"; out = "0.11.4"; }
@@ -30,6 +30,6 @@ with lib; mkCoqDerivation rec {
 
   meta = {
     description = "A collection of theories and plugins that may be useful in other Coq developments";
-    maintainers = with maintainers; [ jwiegley ptival ];
+    maintainers = with lib.maintainers; [ jwiegley ptival ];
   };
 }
diff --git a/pkgs/development/coq-modules/coq-haskell/default.nix b/pkgs/development/coq-modules/coq-haskell/default.nix
index 7caf754ae50a..028b4c5025eb 100644
--- a/pkgs/development/coq-modules/coq-haskell/default.nix
+++ b/pkgs/development/coq-modules/coq-haskell/default.nix
@@ -1,11 +1,11 @@
 { lib, mkCoqDerivation, coq, ssreflect, version ? null }:
 
-with lib; mkCoqDerivation {
+mkCoqDerivation {
 
   pname = "coq-haskell";
   owner = "jwiegley";
   inherit version;
-  defaultVersion = if versions.range "8.5" "8.8" coq.coq-version then "20171215" else null;
+  defaultVersion = if lib.versions.range "8.5" "8.8" coq.coq-version then "20171215" else null;
   release."20171215".rev    = "e2cf8b270c2efa3b56fab1ef6acc376c2c3de968";
   release."20171215".sha256 = "09dq1vvshhlhgjccrhqgbhnq2hrys15xryfszqq11rzpgvl2zgdv";
 
@@ -16,6 +16,6 @@ with lib; mkCoqDerivation {
 
   meta = {
     description = "A library for formalizing Haskell types and functions in Coq";
-    maintainers = with maintainers; [ jwiegley ];
+    maintainers = with lib.maintainers; [ jwiegley ];
   };
 }
diff --git a/pkgs/development/coq-modules/coq-record-update/default.nix b/pkgs/development/coq-modules/coq-record-update/default.nix
index 77c42fb48d4e..a0b27dda845f 100644
--- a/pkgs/development/coq-modules/coq-record-update/default.nix
+++ b/pkgs/development/coq-modules/coq-record-update/default.nix
@@ -1,10 +1,10 @@
 { lib, mkCoqDerivation, coq, version ? null }:
 
-with lib; mkCoqDerivation rec {
+ mkCoqDerivation rec {
   pname = "coq-record-update";
   owner = "tchajed";
   inherit version;
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
     { case = range "8.10" "8.16";  out = "0.3.1"; }
   ] null;
   release."0.3.1".sha256 = "sha256-DyGxO2tqmYZZluXN6Oy5Tw6fuLMyuyxonj8CCToWKkk=";
@@ -13,6 +13,6 @@ with lib; mkCoqDerivation rec {
   buildFlags = [ "NO_TEST=1" ];
   meta = {
     description = "Library to create Coq record update functions";
-    maintainers = with maintainers; [ ineol ];
+    maintainers = with lib.maintainers; [ ineol ];
   };
 }
diff --git a/pkgs/development/coq-modules/coqeal/default.nix b/pkgs/development/coq-modules/coqeal/default.nix
index d3a8e366a0a4..1ccbf9e82a0f 100644
--- a/pkgs/development/coq-modules/coqeal/default.nix
+++ b/pkgs/development/coq-modules/coqeal/default.nix
@@ -2,14 +2,12 @@
   mathcomp-real-closed,
   lib, version ? null }:
 
-with lib;
-
 (mkCoqDerivation {
 
   pname = "CoqEAL";
 
   inherit version;
-  defaultVersion = with versions; switch [ coq.version mathcomp.version ]  [
+  defaultVersion = with lib.versions; lib.switch [ coq.version mathcomp.version ]  [
       { cases = [ (range "8.13" "8.16") (isGe "1.13.0") ]; out = "1.1.1"; }
       { cases = [ (range "8.10" "8.15") (isGe "1.12.0") ]; out = "1.1.0"; }
       { cases = [ (isGe "8.10") (range "1.11.0" "1.12.0") ]; out = "1.0.5"; }
@@ -28,9 +26,9 @@ with lib;
 
   meta = {
     description = "CoqEAL - The Coq Effective Algebra Library";
-    license = licenses.mit;
+    license = lib.licenses.mit;
   };
 }).overrideAttrs (o: {
   propagatedBuildInputs = o.propagatedBuildInputs
-  ++ optional (versions.isGe "1.1" o.version || o.version == "dev") mathcomp-real-closed;
+  ++ lib.optional (lib.versions.isGe "1.1" o.version || o.version == "dev") mathcomp-real-closed;
 })
diff --git a/pkgs/development/coq-modules/coqhammer/default.nix b/pkgs/development/coq-modules/coqhammer/default.nix
index 853e77990b6e..e5e23247f141 100644
--- a/pkgs/development/coq-modules/coqhammer/default.nix
+++ b/pkgs/development/coq-modules/coqhammer/default.nix
@@ -1,10 +1,10 @@
 { lib, mkCoqDerivation, coq, version ? null }:
 
-with lib; mkCoqDerivation {
+mkCoqDerivation {
   inherit version;
   pname = "coqhammer";
   owner = "lukaszcz";
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
     { case = "8.15"; out = "1.3.2-coq8.15"; }
     { case = "8.14"; out = "1.3.2-coq8.14"; }
     { case = "8.13"; out = "1.3.2-coq8.13"; }
@@ -57,7 +57,7 @@ with lib; mkCoqDerivation {
 
   mlPlugin = true;
 
-  meta = {
+  meta = with lib; {
     homepage = "http://cl-informatik.uibk.ac.at/cek/coqhammer/";
     description = "Automation for Dependent Type Theory";
     license = licenses.lgpl21;
diff --git a/pkgs/development/coq-modules/coqide/default.nix b/pkgs/development/coq-modules/coqide/default.nix
index 4e1f9e5f6662..a11bfb2c0db7 100644
--- a/pkgs/development/coq-modules/coqide/default.nix
+++ b/pkgs/development/coq-modules/coqide/default.nix
@@ -8,14 +8,14 @@
 , coq
 , version ? null }:
 
-with lib; mkCoqDerivation rec {
+mkCoqDerivation rec {
   pname = "coqide";
   inherit version;
 
   inherit (coq) src;
   release."${coq.version}" = {};
 
-  defaultVersion = if versions.isGe "8.14" coq.version then coq.version else null;
+  defaultVersion = if lib.versions.isGe "8.14" coq.version then coq.version else null;
 
   preConfigure = ''
     patchShebangs dev/tools/
diff --git a/pkgs/development/coq-modules/coqprime/default.nix b/pkgs/development/coq-modules/coqprime/default.nix
index ac05af587253..cfba685e35fb 100644
--- a/pkgs/development/coq-modules/coqprime/default.nix
+++ b/pkgs/development/coq-modules/coqprime/default.nix
@@ -1,11 +1,11 @@
 { which, lib, mkCoqDerivation, coq, bignums, version ? null }:
 
-with lib; mkCoqDerivation {
+mkCoqDerivation {
 
   pname = "coqprime";
   owner = "thery";
   inherit version;
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
     { case = range "8.12" "8.16"; out = "8.15"; }
     { case = range "8.10" "8.11"; out = "8.10"; }
     { case = range "8.8"  "8.9";  out = "8.8"; }
diff --git a/pkgs/development/coq-modules/coqtail-math/default.nix b/pkgs/development/coq-modules/coqtail-math/default.nix
index a4f7ca405f71..b43cadb918e3 100644
--- a/pkgs/development/coq-modules/coqtail-math/default.nix
+++ b/pkgs/development/coq-modules/coqtail-math/default.nix
@@ -1,12 +1,10 @@
 { lib, mkCoqDerivation, coq, version ? null }:
 
-with lib;
-
 mkCoqDerivation {
   pname = "coqtail-math";
   owner = "coq-community";
   inherit version;
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
     { case = range "8.11" "8.15"; out = "8.14"; }
     { case = range "8.11" "8.13"; out = "20201124"; }
   ] null;
@@ -15,7 +13,7 @@ mkCoqDerivation {
   release."20201124".rev    = "5c22c3d7dcd8cf4c47cf84a281780f5915488e9e";
   release."20201124".sha256 = "sha256-wd+Lh7dpAD4zfpyKuztDmSFEZo5ZiFrR8ti2jUCVvoQ=";
   mlPlugin = true;
-  meta = {
+  meta = with lib; {
     license = licenses.lgpl3Only;
     maintainers = [ maintainers.siraben ];
   };
diff --git a/pkgs/development/coq-modules/coquelicot/default.nix b/pkgs/development/coq-modules/coquelicot/default.nix
index 09327f2ff76c..b6e2df653bec 100644
--- a/pkgs/development/coq-modules/coquelicot/default.nix
+++ b/pkgs/development/coq-modules/coquelicot/default.nix
@@ -1,12 +1,12 @@
 { lib, mkCoqDerivation, autoconf,
   coq, ssreflect, version ? null }:
 
-with lib; mkCoqDerivation {
+mkCoqDerivation {
   pname = "coquelicot";
   owner = "coquelicot";
   domain = "gitlab.inria.fr";
   inherit version;
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
     { case = range "8.8" "8.16"; out = "3.2.0"; }
     { case = range "8.8" "8.13"; out = "3.1.0"; }
     { case = range "8.5" "8.9";  out = "3.0.2"; }
@@ -20,7 +20,7 @@ with lib; mkCoqDerivation {
   propagatedBuildInputs = [ ssreflect ];
   useMelquiondRemake.logpath = "Coquelicot";
 
-  meta = {
+  meta =  with lib; {
     homepage = "http://coquelicot.saclay.inria.fr/";
     description = "A Coq library for Reals";
     license = licenses.lgpl3;
diff --git a/pkgs/development/coq-modules/corn/default.nix b/pkgs/development/coq-modules/corn/default.nix
index d019d4b4e55f..84bca53931cc 100644
--- a/pkgs/development/coq-modules/corn/default.nix
+++ b/pkgs/development/coq-modules/corn/default.nix
@@ -1,9 +1,9 @@
 { lib, mkCoqDerivation, coq, bignums, math-classes, version ? null }:
 
-with lib; mkCoqDerivation rec {
+mkCoqDerivation rec {
   pname = "corn";
   inherit version;
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
     { case = "8.6"; out = "8.8.1"; }
     { case = (range "8.11" "8.16"); out = "8.16.0"; }
     { case = (range "8.7"  "8.15"); out = "8.13.0"; }
@@ -21,7 +21,7 @@ with lib; mkCoqDerivation rec {
 
   propagatedBuildInputs = [ bignums math-classes ];
 
-  meta = {
+  meta =  with lib; {
     homepage = "http://c-corn.github.io/";
     license = licenses.gpl2;
     description = "A Coq library for constructive analysis";
diff --git a/pkgs/development/coq-modules/deriving/default.nix b/pkgs/development/coq-modules/deriving/default.nix
index f08e86ccc4f8..06e80f118bc0 100644
--- a/pkgs/development/coq-modules/deriving/default.nix
+++ b/pkgs/development/coq-modules/deriving/default.nix
@@ -1,14 +1,13 @@
 { lib, mkCoqDerivation, coq, version ? null
 , ssreflect
 }:
-with lib;
 
 mkCoqDerivation {
   pname = "deriving";
   owner = "arthuraa";
 
   inherit version;
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
     { case = range "8.11" "8.16"; out = "0.1.0"; }
   ] null;
 
@@ -20,7 +19,7 @@ mkCoqDerivation {
 
   mlPlugin = true;
 
-  meta = {
+  meta = with lib; {
     description = "Generic instances of MathComp classes";
     license = licenses.mit;
     maintainers = [ maintainers.vbgl ];
diff --git a/pkgs/development/coq-modules/dpdgraph/default.nix b/pkgs/development/coq-modules/dpdgraph/default.nix
index e24729465578..da26b0774d41 100644
--- a/pkgs/development/coq-modules/dpdgraph/default.nix
+++ b/pkgs/development/coq-modules/dpdgraph/default.nix
@@ -1,14 +1,13 @@
 { lib, mkCoqDerivation, autoreconfHook, coq, version ? null }:
 
-with lib;
-let hasWarning = versionAtLeast coq.ocamlPackages.ocaml.version "4.08"; in
+let hasWarning = lib.versionAtLeast coq.ocamlPackages.ocaml.version "4.08"; in
 
 mkCoqDerivation {
   pname = "dpdgraph";
   owner = "Karmaki";
   repo = "coq-dpdgraph";
   inherit version;
-  defaultVersion = switch coq.coq-version [
+  defaultVersion = lib.switch coq.coq-version [
     { case = "8.16"; out = "1.0+8.16"; }
     { case = "8.15"; out = "1.0+8.15"; }
     { case = "8.14"; out = "1.0+8.14"; }
@@ -47,11 +46,11 @@ mkCoqDerivation {
 
   # dpd_compute.ml uses deprecated Pervasives.compare
   # Versions prior to 0.6.5 do not have the WARN_ERR build flag
-  preConfigure = optionalString hasWarning ''
+  preConfigure = lib.optionalString hasWarning ''
     substituteInPlace Makefile.in --replace "-warn-error +a " ""
   '';
 
-  buildFlags = optional hasWarning "WARN_ERR=";
+  buildFlags = lib.optional hasWarning "WARN_ERR=";
 
   preInstall = ''
     mkdir -p $out/bin
@@ -59,7 +58,7 @@ mkCoqDerivation {
 
   extraInstallFlags = [ "BINDIR=$(out)/bin" ];
 
-  meta = {
+  meta = with lib; {
     description = "Build dependency graphs between Coq objects";
     license = licenses.lgpl21;
     maintainers = with maintainers; [ vbgl ];
diff --git a/pkgs/development/coq-modules/equations/default.nix b/pkgs/development/coq-modules/equations/default.nix
index ffe72ad330bc..5f38c4bbae24 100644
--- a/pkgs/development/coq-modules/equations/default.nix
+++ b/pkgs/development/coq-modules/equations/default.nix
@@ -1,11 +1,11 @@
 { lib, mkCoqDerivation, coq, version ? null }:
 
-with lib; (mkCoqDerivation {
+(mkCoqDerivation {
   pname = "equations";
   owner = "mattam82";
   repo = "Coq-Equations";
   inherit version;
-  defaultVersion = switch coq.coq-version [
+  defaultVersion = lib.switch coq.coq-version [
     { case = "8.16"; out = "1.3+8.16"; }
     { case = "8.15"; out = "1.3+8.15"; }
     { case = "8.14"; out = "1.3+8.14"; }
@@ -57,11 +57,11 @@ with lib; (mkCoqDerivation {
 
   mlPlugin = true;
 
-  meta = {
+  meta = with lib; {
     homepage = "https://mattam82.github.io/Coq-Equations/";
     description = "A plugin for Coq to add dependent pattern-matching";
     maintainers = with maintainers; [ jwiegley ];
   };
 }).overrideAttrs (o: {
-  preBuild = "coq_makefile -f _CoqProject -o Makefile${optionalString (versionAtLeast o.version "1.2.1" || o.version == "dev") ".coq"}";
+  preBuild = "coq_makefile -f _CoqProject -o Makefile${lib.optionalString (lib.versionAtLeast o.version "1.2.1" || o.version == "dev") ".coq"}";
 })
diff --git a/pkgs/development/coq-modules/extructures/default.nix b/pkgs/development/coq-modules/extructures/default.nix
index 2a038ff0c11a..b6345d7b0ac3 100644
--- a/pkgs/development/coq-modules/extructures/default.nix
+++ b/pkgs/development/coq-modules/extructures/default.nix
@@ -2,14 +2,13 @@
 , ssreflect
 , deriving
 }:
-with lib;
 
 (mkCoqDerivation {
   pname = "extructures";
   owner = "arthuraa";
 
   inherit version;
-  defaultVersion = with versions; switch [coq.coq-version ssreflect.version] [
+  defaultVersion = with lib.versions; lib.switch [coq.coq-version ssreflect.version] [
     { cases = [(range "8.11" "8.16") (isGe "1.12.0") ]; out = "0.3.1"; }
     { cases = [(range "8.11" "8.14") (isLe "1.12.0") ]; out = "0.3.0"; }
     { cases = [(range "8.10" "8.12") (isLe "1.12.0") ]; out = "0.2.2"; }
@@ -23,7 +22,7 @@ with lib;
 
   propagatedBuildInputs = [ ssreflect ];
 
-  meta = {
+  meta = with lib; {
     description = "Finite data structures with extensional reasoning";
     license = licenses.mit;
     maintainers = [ maintainers.vbgl ];
@@ -31,5 +30,5 @@ with lib;
 
 }).overrideAttrs (o: {
   propagatedBuildInputs = o.propagatedBuildInputs
-  ++ optional (versionAtLeast o.version "0.3.0") deriving;
+  ++ lib.optional (lib.versionAtLeast o.version "0.3.0") deriving;
 })
diff --git a/pkgs/development/coq-modules/fiat/HEAD.nix b/pkgs/development/coq-modules/fiat/HEAD.nix
index d94dc03b6377..0a6375907e89 100644
--- a/pkgs/development/coq-modules/fiat/HEAD.nix
+++ b/pkgs/development/coq-modules/fiat/HEAD.nix
@@ -1,6 +1,6 @@
 {lib, mkCoqDerivation, coq, python27, version ? null }:
 
-with lib; mkCoqDerivation rec {
+mkCoqDerivation rec {
   pname = "fiat";
   owner = "mit-plv";
   repo = "fiat";
@@ -29,6 +29,6 @@ with lib; mkCoqDerivation rec {
   meta = {
     homepage = "http://plv.csail.mit.edu/fiat/";
     description = "A library for the Coq proof assistant for synthesizing efficient correct-by-construction programs from declarative specifications";
-    maintainers = with maintainers; [ jwiegley ];
+    maintainers = with lib.maintainers; [ jwiegley ];
   };
 }
diff --git a/pkgs/development/coq-modules/flocq/default.nix b/pkgs/development/coq-modules/flocq/default.nix
index ed973996feea..cf39c8211b78 100644
--- a/pkgs/development/coq-modules/flocq/default.nix
+++ b/pkgs/development/coq-modules/flocq/default.nix
@@ -1,12 +1,12 @@
 { lib, bash, autoconf, automake,
   mkCoqDerivation, coq, version ? null }:
 
-with lib; mkCoqDerivation {
+mkCoqDerivation {
   pname = "flocq";
   owner = "flocq";
   domain = "gitlab.inria.fr";
   inherit version;
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
     { case = range "8.14" "8.16"; out = "4.1.0"; }
     { case = range "8.7" "8.15"; out = "3.4.3"; }
     { case = range "8.5" "8.8"; out = "2.6.1"; }
@@ -22,7 +22,7 @@ with lib; mkCoqDerivation {
   mlPlugin = true;
   useMelquiondRemake.logpath = "Flocq";
 
-  meta = {
+  meta = with lib; {
     description = "A floating-point formalization for the Coq system";
     license = licenses.lgpl3;
     maintainers = with maintainers; [ jwiegley ];
diff --git a/pkgs/development/coq-modules/fourcolor/default.nix b/pkgs/development/coq-modules/fourcolor/default.nix
index 3615f5513a39..6548da52b9f7 100644
--- a/pkgs/development/coq-modules/fourcolor/default.nix
+++ b/pkgs/development/coq-modules/fourcolor/default.nix
@@ -1,5 +1,4 @@
 { lib, mkCoqDerivation, coq, mathcomp, version ? null }:
-with lib;
 
 mkCoqDerivation {
   pname = "fourcolor";
@@ -12,15 +11,15 @@ mkCoqDerivation {
   release."1.2.5".sha256 = "sha256-3qOPNCRjGK2UdHGMSqElpIXhAPVCklpeQgZwf9AFals=";
 
   inherit version;
-  defaultVersion = with versions; switch [ coq.version mathcomp.version ] [
+  defaultVersion = with lib.versions; lib.switch [ coq.version mathcomp.version ] [
     { cases = [ (isGe "8.11") (isGe "1.12") ]; out = "1.2.5"; }
     { cases = [ (isGe "8.11") (range "1.11" "1.14") ]; out = "1.2.4"; }
-    { cases = [ (isLe "8.13") (pred.inter (isGe "1.11.0") (isLt "1.13")) ]; out = "1.2.3"; }
+    { cases = [ (isLe "8.13") (lib.pred.inter (isGe "1.11.0") (isLt "1.13")) ]; out = "1.2.3"; }
   ] null;
 
   propagatedBuildInputs = [ mathcomp.algebra mathcomp.ssreflect mathcomp.fingroup ];
 
-  meta = {
+  meta =  with lib; {
     description = "Formal proof of the Four Color Theorem ";
     maintainers = with maintainers; [ siraben ];
     license = licenses.cecill-b;
diff --git a/pkgs/development/coq-modules/gaia-hydras/default.nix b/pkgs/development/coq-modules/gaia-hydras/default.nix
index 5377600caba4..4f9e7a12e048 100644
--- a/pkgs/development/coq-modules/gaia-hydras/default.nix
+++ b/pkgs/development/coq-modules/gaia-hydras/default.nix
@@ -1,7 +1,7 @@
 { lib, mkCoqDerivation, coq, hydra-battles, gaia,
   mathcomp-zify, mathcomp, version ? null }:
 
-with lib; mkCoqDerivation rec {
+mkCoqDerivation rec {
   pname = "gaia-hydras";
   repo = "hydra-battles";
 
@@ -10,7 +10,7 @@ with lib; mkCoqDerivation rec {
   releaseRev = (v: "v${v}");
 
   inherit version;
-  defaultVersion = with versions; switch [coq.coq-version mathcomp.version] [
+  defaultVersion = with lib.versions; lib.switch [coq.coq-version mathcomp.version] [
     { cases = [ (range "8.14" "8.16") (isGe "1.12.0") ]; out = "0.6"; }
     { cases = [ (range "8.13" "8.14") (isGe "1.12.0") ]; out = "0.5"; }
   ] null;
@@ -23,7 +23,7 @@ with lib; mkCoqDerivation rec {
 
   useDune = true;
 
-  meta = {
+  meta = with lib; {
     description = "Comparison between ordinals in Gaia and Hydra battles";
     longDescription = ''
       The Gaia and Hydra battles projects develop different notions of ordinals.
diff --git a/pkgs/development/coq-modules/gaia/default.nix b/pkgs/development/coq-modules/gaia/default.nix
index d4fa4a1da309..a2994dcc9b34 100644
--- a/pkgs/development/coq-modules/gaia/default.nix
+++ b/pkgs/development/coq-modules/gaia/default.nix
@@ -1,6 +1,6 @@
 { lib, mkCoqDerivation, coq, mathcomp, version ? null }:
 
-with lib; mkCoqDerivation {
+mkCoqDerivation {
   pname = "gaia";
 
   release."1.11".sha256 = "sha256:0gwb0blf37sv9gb0qpn34dab71zdcx7jsnqm3j9p58qw65cgsqn5";
@@ -11,7 +11,7 @@ with lib; mkCoqDerivation {
   releaseRev = (v: "v${v}");
 
   inherit version;
-  defaultVersion = with versions; switch [ coq.version mathcomp.version ] [
+  defaultVersion = with lib.versions; lib.switch [ coq.version mathcomp.version ] [
     { cases = [ (range "8.10" "8.16") (isGe "1.12.0") ]; out = "1.15"; }
     { cases = [ (range "8.10" "8.12") "1.11.0" ]; out = "1.11"; }
   ] null;
@@ -19,7 +19,7 @@ with lib; mkCoqDerivation {
   propagatedBuildInputs =
     [ mathcomp.ssreflect mathcomp.algebra mathcomp.fingroup ];
 
-  meta = {
+  meta = with lib; {
     description = "Implementation of books from Bourbaki's Elements of Mathematics in Coq";
     maintainers = with maintainers; [ Zimmi48 ];
     license = licenses.mit;
diff --git a/pkgs/development/coq-modules/gappalib/default.nix b/pkgs/development/coq-modules/gappalib/default.nix
index 52e69e90d135..5a4b4b2a4d01 100644
--- a/pkgs/development/coq-modules/gappalib/default.nix
+++ b/pkgs/development/coq-modules/gappalib/default.nix
@@ -1,12 +1,12 @@
 { which, lib, mkCoqDerivation, autoconf, coq, flocq, version ? null }:
 
-with lib; mkCoqDerivation {
+mkCoqDerivation {
   pname = "gappalib";
   repo = "coq";
   owner = "gappa";
   domain = "gitlab.inria.fr";
   inherit version;
-  defaultVersion = if versions.range "8.8" "8.16" coq.coq-version then "1.5.2" else null;
+  defaultVersion = if lib.versions.range "8.8" "8.16" coq.coq-version then "1.5.2" else null;
   release."1.5.2".sha256 = "sha256-A021Bhqz5r2CZBayfjIiWrCIfUlejcQAfbTmOaf6QTM=";
   release."1.5.1".sha256 = "1806bq1z6q5rq2ma7d5kfbqfyfr755hjg0dq7b2llry8fx9cxjsg";
   release."1.5.0".sha256 = "1i1c0gakffxqqqqw064cbvc243yl325hxd50jmczr6mk18igk41n";
@@ -19,7 +19,7 @@ with lib; mkCoqDerivation {
   propagatedBuildInputs = [ flocq ];
   useMelquiondRemake.logpath = "Gappa";
 
-  meta = {
+  meta = with lib; {
     description = "Coq support library for Gappa";
     license = licenses.lgpl21;
     maintainers = [ maintainers.vbgl ];
diff --git a/pkgs/development/coq-modules/goedel/default.nix b/pkgs/development/coq-modules/goedel/default.nix
index 19efb786addf..1b16f8c3948a 100644
--- a/pkgs/development/coq-modules/goedel/default.nix
+++ b/pkgs/development/coq-modules/goedel/default.nix
@@ -1,5 +1,4 @@
 { lib, mkCoqDerivation, coq, hydra-battles, pocklington, version ? null }:
-with lib;
 
 mkCoqDerivation {
   pname = "goedel";
@@ -11,13 +10,13 @@ mkCoqDerivation {
   release."8.13.0".sha256 = "0sqqkmj6wsk4xmhrnqkhcsbsrqjzn2gnk67nqzgrmjpw5danz8y5";
 
   inherit version;
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
     { case = range "8.11" "8.16"; out = "8.13.0"; }
   ] null;
 
   propagatedBuildInputs = [ hydra-battles pocklington ];
 
-  meta = {
+  meta = with lib; {
     description = "The Gödel-Rosser 1st incompleteness theorem in Coq";
     maintainers = with maintainers; [ siraben ];
     license = licenses.mit;
diff --git a/pkgs/development/coq-modules/graph-theory/default.nix b/pkgs/development/coq-modules/graph-theory/default.nix
index c2fca0a16a71..cbd919c7aa61 100644
--- a/pkgs/development/coq-modules/graph-theory/default.nix
+++ b/pkgs/development/coq-modules/graph-theory/default.nix
@@ -1,8 +1,6 @@
 { lib, mkCoqDerivation, coq, mathcomp-algebra, mathcomp-finmap, mathcomp-fingroup
 , hierarchy-builder, version ? null }:
 
-with lib;
-
 mkCoqDerivation {
   pname = "graph-theory";
 
@@ -11,13 +9,13 @@ mkCoqDerivation {
   releaseRev = v: "v${v}";
 
   inherit version;
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
     { case = range "8.13" "8.16"; out = "0.9"; }
   ] null;
 
   propagatedBuildInputs = [ mathcomp-algebra mathcomp-finmap mathcomp-fingroup hierarchy-builder ];
 
-  meta = {
+  meta = with lib; {
     description = "Library of formalized graph theory results in Coq";
     longDescription = ''
       A library of formalized graph theory results, including various
diff --git a/pkgs/development/coq-modules/heq/default.nix b/pkgs/development/coq-modules/heq/default.nix
index c3a815eb5c87..fc96b2abf98c 100644
--- a/pkgs/development/coq-modules/heq/default.nix
+++ b/pkgs/development/coq-modules/heq/default.nix
@@ -5,13 +5,13 @@ let fetcher = {rev, repo, owner, sha256, domain, ...}:
     url = "https://${domain}/${owner}/${repo}/download/${repo}-${rev}.zip";
     inherit sha256;
    }; in
-with lib; mkCoqDerivation {
+mkCoqDerivation {
   pname = "heq";
   repo = "Heq";
   owner = "gil.hur";
   domain = "sf.snu.ac.kr";
   inherit version fetcher;
-  defaultVersion = if versions.isLt "8.8" coq.coq-version then "0.92" else null;
+  defaultVersion = if lib.versions.isLt "8.8" coq.coq-version then "0.92" else null;
   release."0.92".sha256 = "0cf8y6728n81wwlbpq3vi7l2dbzi7759klypld4gpsjjp1y1fj74";
 
   mlPlugin = true;
@@ -22,6 +22,6 @@ with lib; mkCoqDerivation {
   meta = {
     homepage = "https://ropas.snu.ac.kr/~gil.hur/Heq/";
     description = "Heq : a Coq library for Heterogeneous Equality";
-    maintainers = with maintainers; [ jwiegley ];
+    maintainers = with lib.maintainers; [ jwiegley ];
   };
 }
diff --git a/pkgs/development/coq-modules/hierarchy-builder/default.nix b/pkgs/development/coq-modules/hierarchy-builder/default.nix
index 4f319587de93..9bcc07387b1e 100644
--- a/pkgs/development/coq-modules/hierarchy-builder/default.nix
+++ b/pkgs/development/coq-modules/hierarchy-builder/default.nix
@@ -1,10 +1,10 @@
 { lib, mkCoqDerivation, coq, coq-elpi, version ? null }:
 
-with lib; let hb = mkCoqDerivation {
+let hb = mkCoqDerivation {
   pname = "hierarchy-builder";
   owner = "math-comp";
   inherit version;
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
     { case = range "8.15" "8.16"; out = "1.4.0"; }
     { case = range "8.13" "8.14"; out = "1.2.0"; }
     { case = range "8.12" "8.13"; out = "1.1.0"; }
@@ -25,16 +25,16 @@ with lib; let hb = mkCoqDerivation {
 
   extraInstallFlags = [ "VFILES=structures.v" ];
 
-  meta = {
+  meta = with lib; {
     description = "High level commands to declare a hierarchy based on packed classes";
     maintainers = with maintainers; [ cohencyril siraben ];
     license = licenses.mit;
   };
 }; in
 hb.overrideAttrs (o:
-  optionalAttrs (versions.isGe "1.2.0" o.version || o.version == "dev")
+  lib.optionalAttrs (lib.versions.isGe "1.2.0" o.version || o.version == "dev")
     { buildPhase = "make build"; }
   //
-  optionalAttrs (versions.isGe "1.1.0" o.version || o.version == "dev")
+  lib.optionalAttrs (lib.versions.isGe "1.1.0" o.version || o.version == "dev")
   { installFlags = [ "DESTDIR=$(out)" ] ++ o.installFlags; }
 )
diff --git a/pkgs/development/coq-modules/hydra-battles/default.nix b/pkgs/development/coq-modules/hydra-battles/default.nix
index 2729f7c21391..06798c5fcc29 100644
--- a/pkgs/development/coq-modules/hydra-battles/default.nix
+++ b/pkgs/development/coq-modules/hydra-battles/default.nix
@@ -1,5 +1,4 @@
 { lib, mkCoqDerivation, coq, equations, LibHyps, version ? null }:
-with lib;
 
 (mkCoqDerivation {
   pname = "hydra-battles";
@@ -11,14 +10,14 @@ with lib;
   releaseRev = (v: "v${v}");
 
   inherit version;
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
     { case = range "8.13" "8.16"; out = "0.6"; }
     { case = range "8.11" "8.12"; out = "0.4"; }
   ] null;
 
   useDune = true;
 
-  meta = {
+  meta = with lib; {
     description = "Exploration of some properties of Kirby and Paris' hydra battles, with the help of Coq";
     longDescription = ''
       An exploration of some properties of Kirby and Paris' hydra
@@ -33,5 +32,5 @@ with lib;
   };
 }).overrideAttrs(o:
   let inherit (o) version; in {
-    propagatedBuildInputs = [ equations ] ++ optional (versions.isGe "0.6" version || version == "dev") LibHyps;
+    propagatedBuildInputs = [ equations ] ++ lib.optional (lib.versions.isGe "0.6" version || version == "dev") LibHyps;
   })
diff --git a/pkgs/development/coq-modules/iris/default.nix b/pkgs/development/coq-modules/iris/default.nix
index a2a59e1ab22c..f72dd69f3617 100644
--- a/pkgs/development/coq-modules/iris/default.nix
+++ b/pkgs/development/coq-modules/iris/default.nix
@@ -1,11 +1,11 @@
 { lib, mkCoqDerivation, coq, stdpp, version ? null }:
 
-with lib; mkCoqDerivation rec {
+mkCoqDerivation rec {
   pname = "iris";
   domain = "gitlab.mpi-sws.org";
   owner = "iris";
   inherit version;
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
     { case = range "8.13" "8.16"; out = "4.0.0"; }
     { case = range "8.12" "8.14"; out = "3.5.0"; }
     { case = range "8.11" "8.13"; out = "3.4.0"; }
@@ -26,7 +26,7 @@ with lib; mkCoqDerivation rec {
     fi
   '';
 
-  meta = {
+  meta = with lib; {
     description = "The Coq development of the Iris Project";
     license = licenses.bsd3;
     maintainers = [ maintainers.vbgl ];
diff --git a/pkgs/development/coq-modules/itauto/default.nix b/pkgs/development/coq-modules/itauto/default.nix
index 1ffa37ec6c32..e2dfe98cf989 100644
--- a/pkgs/development/coq-modules/itauto/default.nix
+++ b/pkgs/development/coq-modules/itauto/default.nix
@@ -1,5 +1,4 @@
 { lib, mkCoqDerivation, coq, version ? null }:
-with lib;
 
 mkCoqDerivation rec {
   pname = "itauto";
@@ -11,7 +10,7 @@ mkCoqDerivation rec {
   release."8.14.0".sha256 = "sha256:1k6pqhv4dwpkwg81f2rlfg40wh070ks1gy9r0ravm2zhsbxqcfc9";
   release."8.13+no".sha256 = "sha256-gXoxtLcHPoyjJkt7WqvzfCMCQlh6kL2KtCGe3N6RC/A=";
   inherit version;
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
     { case = isEq "8.16"; out = "8.16.0"; }
     { case = isEq "8.15"; out = "8.15.0"; }
     { case = isEq "8.14"; out = "8.14.0"; }
@@ -22,7 +21,7 @@ mkCoqDerivation rec {
   nativeBuildInputs = (with coq.ocamlPackages; [ ocamlbuild ]);
   enableParallelBuilding = false;
 
-  meta = {
+  meta =  with lib; {
     description = "A reflexive SAT solver parameterised by a leaf tactic and Nelson-Oppen support";
     maintainers = with maintainers; [ siraben ];
     license = licenses.gpl3Plus;
diff --git a/pkgs/development/coq-modules/ltac2/default.nix b/pkgs/development/coq-modules/ltac2/default.nix
index c938a7ad0279..da2818429600 100644
--- a/pkgs/development/coq-modules/ltac2/default.nix
+++ b/pkgs/development/coq-modules/ltac2/default.nix
@@ -1,10 +1,10 @@
 { lib, mkCoqDerivation, which, coq, version ? null }:
 
-with lib; mkCoqDerivation {
+mkCoqDerivation {
   pname = "ltac2";
   owner = "coq";
   inherit version;
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
     { case = "8.10"; out = "0.3"; }
     { case = "8.9";  out = "0.2"; }
     { case = "8.8";  out = "0.1"; }
@@ -19,7 +19,7 @@ with lib; mkCoqDerivation {
 
   mlPlugin = true;
 
-  meta = {
+  meta = with lib; {
     description = "A robust and expressive tactic language for Coq";
     maintainers = [ maintainers.vbgl ];
     license = licenses.lgpl21;
diff --git a/pkgs/development/coq-modules/math-classes/default.nix b/pkgs/development/coq-modules/math-classes/default.nix
index da708f87e477..d40dacd39380 100644
--- a/pkgs/development/coq-modules/math-classes/default.nix
+++ b/pkgs/development/coq-modules/math-classes/default.nix
@@ -1,10 +1,10 @@
 { lib, mkCoqDerivation, coq, bignums, version ? null }:
 
-with lib; mkCoqDerivation {
+mkCoqDerivation {
 
   pname = "math-classes";
   inherit version;
-  defaultVersion = if versions.range "8.6" "8.16" coq.coq-version then "8.15.0" else null;
+  defaultVersion = if lib.versions.range "8.6" "8.16" coq.coq-version then "8.15.0" else null;
   release."8.12.0".sha256 = "14nd6a08zncrl5yg2gzk0xf4iinwq4hxnsgm4fyv07ydbkxfb425";
   release."8.13.0".sha256 = "1ln7ziivfbxzbdvlhbvyg3v30jgblncmwcsam6gg3d1zz6r7cbby";
   release."8.15.0".sha256 = "10w1hm537k6jx8a8vghq1yx12rsa0sjk2ipv3scgir71ln30hllw";
@@ -14,6 +14,6 @@ with lib; mkCoqDerivation {
   meta = {
     homepage = "https://math-classes.github.io";
     description = "A library of abstract interfaces for mathematical structures in Coq.";
-    maintainers = with maintainers; [ siddharthist jwiegley ];
+    maintainers = with lib.maintainers; [ siddharthist jwiegley ];
   };
 }
diff --git a/pkgs/development/coq-modules/mathcomp-abel/default.nix b/pkgs/development/coq-modules/mathcomp-abel/default.nix
index 43228252b55f..bae9266d4de1 100644
--- a/pkgs/development/coq-modules/mathcomp-abel/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-abel/default.nix
@@ -7,7 +7,7 @@ mkCoqDerivation {
   owner = "math-comp";
 
   inherit version;
-  defaultVersion = with lib; with versions; switch [ coq.version mathcomp.version ]  [
+  defaultVersion = with lib; with versions; lib.switch [ coq.version mathcomp.version ]  [
       { cases = [ (range "8.10" "8.16") (range "1.12.0" "1.15.0") ]; out = "1.2.1"; }
       { cases = [ (range "8.10" "8.15") (range "1.12.0" "1.14.0") ]; out = "1.2.0"; }
       { cases = [ (range "8.10" "8.14") (range "1.11.0" "1.12.0") ]; out = "1.1.2"; }
diff --git a/pkgs/development/coq-modules/mathcomp-algebra-tactics/default.nix b/pkgs/development/coq-modules/mathcomp-algebra-tactics/default.nix
index f4ae2afd3868..af37096a4fb1 100644
--- a/pkgs/development/coq-modules/mathcomp-algebra-tactics/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-algebra-tactics/default.nix
@@ -1,14 +1,14 @@
 { lib, mkCoqDerivation, coq, mathcomp-algebra,
   coq-elpi, mathcomp-zify, version ? null }:
 
-with lib; mkCoqDerivation {
+mkCoqDerivation {
   namePrefix = [ "coq" "mathcomp" ];
   pname = "algebra-tactics";
   owner = "math-comp";
   inherit version;
 
-  defaultVersion = with versions;
-     switch [ coq.coq-version mathcomp-algebra.version ] [
+  defaultVersion = with lib.versions;
+     lib.switch [ coq.coq-version mathcomp-algebra.version ] [
        { cases = [ (range "8.13" "8.16") (isGe "1.12") ]; out = "1.0.0"; }
      ] null;
 
@@ -18,6 +18,6 @@ with lib; mkCoqDerivation {
 
   meta = {
     description = "Ring and field tactics for Mathematical Components";
-    maintainers = with maintainers; [ cohencyril ];
+    maintainers = with lib.maintainers; [ cohencyril ];
   };
 }
diff --git a/pkgs/development/coq-modules/mathcomp-analysis/default.nix b/pkgs/development/coq-modules/mathcomp-analysis/default.nix
index a42b551d1845..3e67675b5efb 100644
--- a/pkgs/development/coq-modules/mathcomp-analysis/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-analysis/default.nix
@@ -21,7 +21,7 @@ let
   release."0.3.1".sha256 = "1iad288yvrjv8ahl9v18vfblgqb1l5z6ax644w49w9hwxs93f2k8";
   release."0.2.3".sha256 = "0p9mr8g1qma6h10qf7014dv98ln90dfkwn76ynagpww7qap8s966";
 
-  defaultVersion = with versions; switch [ coq.version mathcomp.version ]  [
+  defaultVersion = with versions; lib.switch [ coq.version mathcomp.version ]  [
       { cases = [ (isGe "8.14") (isGe "1.13.0") ];               out = "0.5.3"; }
       { cases = [ (isGe "8.14") (range "1.13" "1.15") ];         out = "0.5.2"; }
       { cases = [ (isGe "8.13") (range "1.13" "1.14") ];         out = "0.5.1"; }
@@ -40,7 +40,7 @@ let
       classical-deps = [ mathcomp.algebra mathcomp-finmap hierarchy-builder ];
       analysis-deps = [ mathcomp.field mathcomp-bigenough ];
       intra-deps = if package == "single" then []
-        else map mathcomp_ (head (splitList (pred.equal package) packages));
+        else map mathcomp_ (head (splitList (lib.pred.equal package) packages));
       pkgpath = if package == "single" then "."
         else if package == "analysis" then "theories" else "${package}";
       pname = if package == "single" then "mathcomp-analysis-single"
diff --git a/pkgs/development/coq-modules/mathcomp-bigenough/default.nix b/pkgs/development/coq-modules/mathcomp-bigenough/default.nix
index 7804a61c9306..a4e4a1ecbb5c 100644
--- a/pkgs/development/coq-modules/mathcomp-bigenough/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-bigenough/default.nix
@@ -1,6 +1,6 @@
 { coq, mkCoqDerivation, mathcomp, lib, version ? null }:
 
-with lib; mkCoqDerivation {
+mkCoqDerivation {
 
   namePrefix = [ "coq" "mathcomp" ];
   pname = "bigenough";
@@ -11,7 +11,7 @@ with lib; mkCoqDerivation {
     "1.0.1".sha256 = "sha256:02f4dv4rz72liciwxb2k7acwx6lgqz4381mqyq5854p3nbyn06aw";
   };
   inherit version;
-  defaultVersion = with versions; switch coq.version [
+  defaultVersion = with lib.versions; lib.switch coq.version [
     { case = range "8.10" "8.16"; out = "1.0.1"; }
     { case = range "8.5"  "8.14"; out = "1.0.0"; }
   ] null;
@@ -20,6 +20,6 @@ with lib; mkCoqDerivation {
 
   meta = {
     description = "A small library to do epsilon - N reasonning";
-    license = licenses.cecill-b;
+    license = lib.licenses.cecill-b;
   };
 }
diff --git a/pkgs/development/coq-modules/mathcomp-finmap/default.nix b/pkgs/development/coq-modules/mathcomp-finmap/default.nix
index 8c29208c3f63..551d33c9fadf 100644
--- a/pkgs/development/coq-modules/mathcomp-finmap/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-finmap/default.nix
@@ -1,12 +1,12 @@
 { coq, mkCoqDerivation, mathcomp, lib, version ? null }:
 
-with lib; mkCoqDerivation {
+mkCoqDerivation {
 
   namePrefix = [ "coq" "mathcomp" ];
   pname = "finmap";
   owner = "math-comp";
   inherit version;
-  defaultVersion = with versions; switch [ coq.version mathcomp.version ]  [
+  defaultVersion = with lib.versions; lib.switch [ coq.version mathcomp.version ]  [
       { cases = [ (range "8.13" "8.16")  (isGe "1.12") ];         out = "1.5.2"; }
       { cases = [ (isGe "8.10")          (isGe "1.11") ];         out = "1.5.1"; }
       { cases = [ (range "8.7" "8.11")   "1.11.0" ];              out = "1.5.0"; }
@@ -33,6 +33,6 @@ with lib; mkCoqDerivation {
 
   meta = {
     description = "A finset and finmap library";
-    license = licenses.cecill-b;
+    license = lib.licenses.cecill-b;
   };
 }
diff --git a/pkgs/development/coq-modules/mathcomp-real-closed/default.nix b/pkgs/development/coq-modules/mathcomp-real-closed/default.nix
index aef912c6151c..b114a3f290d3 100644
--- a/pkgs/development/coq-modules/mathcomp-real-closed/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-real-closed/default.nix
@@ -1,7 +1,7 @@
 { coq, mkCoqDerivation, mathcomp, mathcomp-bigenough,
   lib, version ? null }:
 
-with lib; mkCoqDerivation {
+mkCoqDerivation {
 
   namePrefix = [ "coq" "mathcomp" ];
   pname = "real-closed";
@@ -17,7 +17,7 @@ with lib; mkCoqDerivation {
     "1.0.1".sha256 = "0j81gkjbza5vg89v4n9z598mfdbql416963rj4b8fzm7dp2r4rxg";
   };
 
-  defaultVersion = with versions; switch [ coq.version mathcomp.version ]  [
+  defaultVersion = with lib.versions; lib.switch [ coq.version mathcomp.version ]  [
       { cases = [ (isGe "8.13")  (isGe "1.12.0") ]; out = "1.1.3"; }
       { cases = [ (isGe "8.10")  (isGe "1.12.0") ]; out = "1.1.2"; }
       { cases = [ (isGe "8.7")   "1.11.0" ]; out = "1.1.1"; }
@@ -37,6 +37,6 @@ with lib; mkCoqDerivation {
 
   meta = {
     description = "Mathematical Components Library on real closed fields";
-    license = licenses.cecill-c;
+    license = lib.licenses.cecill-c;
   };
 }
diff --git a/pkgs/development/coq-modules/mathcomp-tarjan/default.nix b/pkgs/development/coq-modules/mathcomp-tarjan/default.nix
index 706ee0686922..19ecfcc384de 100644
--- a/pkgs/development/coq-modules/mathcomp-tarjan/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-tarjan/default.nix
@@ -1,14 +1,15 @@
 { coq, mkCoqDerivation, mathcomp-ssreflect, mathcomp-fingroup,
   lib, version ? null }@args:
-with lib; mkCoqDerivation {
+
+mkCoqDerivation {
 
   namePrefix = [ "coq" "mathcomp" ];
   pname = "tarjan";
   owner = "math-comp";
 
   inherit version;
-  defaultVersion = with versions;
-    switch [ coq.version mathcomp-ssreflect.version ] [{
+  defaultVersion = with lib.versions;
+    lib.switch [ coq.version mathcomp-ssreflect.version ] [{
       cases = [ (range "8.10" "8.16") (isGe "1.12.0") ]; out = "1.0.0";
   }] null;
   release."1.0.0".sha256 = "sha256:0r459r0makshzwlygw6kd4lpvdjc43b3x5y9aa8x77f2z5gymjq1";
@@ -17,6 +18,6 @@ with lib; mkCoqDerivation {
 
   meta = {
     description = "Proofs of Tarjan and Kosaraju connected components algorithms";
-    license = licenses.cecill-b;
+    license = lib.licenses.cecill-b;
   };
 }
diff --git a/pkgs/development/coq-modules/mathcomp-word/default.nix b/pkgs/development/coq-modules/mathcomp-word/default.nix
index 5f34434b50f9..090cc4567c3b 100644
--- a/pkgs/development/coq-modules/mathcomp-word/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-word/default.nix
@@ -1,6 +1,5 @@
 { coq, mkCoqDerivation, mathcomp, lib, version ? null }:
 
-with lib;
 mkCoqDerivation {
   namePrefix = [ "coq" "mathcomp" ];
   pname = "word";
@@ -15,13 +14,13 @@ mkCoqDerivation {
   release."1.0".sha256 = "sha256:0703m97rnivcbc7vvbd9rl2dxs6l8n52cbykynw61c6w9rhxspcg";
 
   inherit version;
-  defaultVersion = with versions; switch [ coq.version mathcomp.version ] [
+  defaultVersion = with lib.versions; lib.switch [ coq.version mathcomp.version ] [
     { cases = [ (range "8.12" "8.16") (isGe "1.12") ]; out = "2.0"; }
   ] null;
 
   propagatedBuildInputs = [ mathcomp.algebra mathcomp.ssreflect mathcomp.fingroup ];
 
-  meta = {
+  meta = with lib; {
     description = "Yet Another Coq Library on Machine Words";
     maintainers = [ maintainers.vbgl ];
     license = licenses.mit;
diff --git a/pkgs/development/coq-modules/mathcomp-zify/default.nix b/pkgs/development/coq-modules/mathcomp-zify/default.nix
index 1ac1d928738b..86dd239ebf73 100644
--- a/pkgs/development/coq-modules/mathcomp-zify/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-zify/default.nix
@@ -1,14 +1,14 @@
 { lib, mkCoqDerivation, coq, mathcomp-algebra, mathcomp-ssreflect,  mathcomp-fingroup, version ? null }:
 
-with lib; mkCoqDerivation rec {
+mkCoqDerivation rec {
   namePrefix = [ "coq" "mathcomp" ];
   pname = "zify";
   repo = "mczify";
   owner = "math-comp";
   inherit version;
 
-  defaultVersion = with versions;
-     switch [ coq.coq-version mathcomp-algebra.version ] [
+  defaultVersion = with lib.versions;
+     lib.switch [ coq.coq-version mathcomp-algebra.version ] [
        { cases = [ (range "8.13" "8.16") (isGe "1.12") ]; out = "1.1.0+1.12+8.13"; }
      ] null;
 
@@ -19,6 +19,6 @@ with lib; mkCoqDerivation rec {
 
   meta = {
     description = "Micromega tactics for Mathematical Components";
-    maintainers = with maintainers; [ cohencyril ];
+    maintainers = with lib.maintainers; [ cohencyril ];
   };
 }
diff --git a/pkgs/development/coq-modules/mathcomp/default.nix b/pkgs/development/coq-modules/mathcomp/default.nix
index 7be30844eb05..031536b7a6ef 100644
--- a/pkgs/development/coq-modules/mathcomp/default.nix
+++ b/pkgs/development/coq-modules/mathcomp/default.nix
@@ -18,7 +18,7 @@ let
   repo  = "math-comp";
   owner = "math-comp";
   withDoc = single && (args.withDoc or false);
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with versions; lib.switch coq.coq-version [
       { case = range "8.14" "8.16"; out = "1.15.0"; }
       { case = range "8.11" "8.15"; out = "1.14.0"; }
       { case = range "8.11" "8.15"; out = "1.13.0"; }
@@ -50,7 +50,7 @@ let
 
   mathcomp_ = package: let
       mathcomp-deps = if package == "single" then []
-        else map mathcomp_ (head (splitList (pred.equal package) packages));
+        else map mathcomp_ (head (splitList (lib.pred.equal package) packages));
       pkgpath = if package == "single" then "mathcomp" else "mathcomp/${package}";
       pname = if package == "single" then "mathcomp" else "mathcomp-${package}";
       pkgallMake = ''
diff --git a/pkgs/development/coq-modules/metacoq/default.nix b/pkgs/development/coq-modules/metacoq/default.nix
index ab036add60bb..9a22d82dd400 100644
--- a/pkgs/development/coq-modules/metacoq/default.nix
+++ b/pkgs/development/coq-modules/metacoq/default.nix
@@ -5,7 +5,7 @@ with builtins // lib;
 let
   repo  = "metacoq";
   owner = "MetaCoq";
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with versions; lib.switch coq.coq-version [
       { case = "8.11"; out = "1.0-beta2-8.11"; }
       { case = "8.12"; out = "1.0-beta2-8.12"; }
       # Do not provide 8.13 because it does not compile with equations 1.3 provided by default (only 1.2.3)
@@ -34,7 +34,7 @@ let
 
   metacoq_ = package: let
       metacoq-deps = if package == "single" then []
-        else map metacoq_ (head (splitList (pred.equal package) packages));
+        else map metacoq_ (head (splitList (lib.pred.equal package) packages));
       pkgpath = if package == "single" then "./" else "./${package}";
       pname = if package == "all" then "metacoq" else "metacoq-${package}";
       pkgallMake = ''
diff --git a/pkgs/development/coq-modules/metalib/default.nix b/pkgs/development/coq-modules/metalib/default.nix
index 6072f9995c06..82d2a16f77ff 100644
--- a/pkgs/development/coq-modules/metalib/default.nix
+++ b/pkgs/development/coq-modules/metalib/default.nix
@@ -1,10 +1,10 @@
 { lib, mkCoqDerivation, coq, version ? null }:
 
-with lib; mkCoqDerivation {
+mkCoqDerivation {
   pname = "metalib";
   owner = "plclub";
   inherit version;
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
     { case = range "8.14" "8.16"; out = "8.15"; }
     { case = range "8.10" "8.13"; out = "8.10"; }
   ] null;
@@ -14,7 +14,7 @@ with lib; mkCoqDerivation {
 
   sourceRoot = "source/Metalib";
 
-  meta = {
+  meta = with lib; {
     license = licenses.mit;
     maintainers = [ maintainers.jwiegley ];
   };
diff --git a/pkgs/development/coq-modules/multinomials/default.nix b/pkgs/development/coq-modules/multinomials/default.nix
index 57f4a381b204..19c6015ce928 100644
--- a/pkgs/development/coq-modules/multinomials/default.nix
+++ b/pkgs/development/coq-modules/multinomials/default.nix
@@ -1,6 +1,6 @@
 { coq, mkCoqDerivation, mathcomp, mathcomp-finmap, mathcomp-bigenough,
   lib, version ? null, useDune ? false }@args:
-with lib; mkCoqDerivation {
+ mkCoqDerivation {
 
   namePrefix = [ "coq" "mathcomp" ];
   pname = "multinomials";
@@ -8,7 +8,7 @@ with lib; mkCoqDerivation {
   owner = "math-comp";
 
   inherit version;
-  defaultVersion =  with versions; switch [ coq.version mathcomp.version ] [
+  defaultVersion =  with lib.versions; lib.switch [ coq.version mathcomp.version ] [
       { cases = [ (isGe "8.10") (isGe "1.12.0") ];      out = "1.5.5"; }
       { cases = [ (range "8.10" "8.12") "1.12.0" ];             out = "1.5.3"; }
       { cases = [ (range "8.7" "8.12")  "1.11.0" ];             out = "1.5.2"; }
@@ -31,7 +31,7 @@ with lib; mkCoqDerivation {
     "1.0".sha256   = "1qmbxp1h81cy3imh627pznmng0kvv37k4hrwi2faa101s6bcx55m";
   };
 
-  useDuneifVersion = v: versions.isGe "1.5.3" v || v == "dev";
+  useDuneifVersion = v: lib.versions.isGe "1.5.3" v || v == "dev";
 
   preConfigure = ''
     patchShebangs configure || true
@@ -42,7 +42,7 @@ with lib; mkCoqDerivation {
 
   meta = {
     description = "A Coq/SSReflect Library for Monoidal Rings and Multinomials";
-    license = licenses.cecill-c;
+    license = lib.licenses.cecill-c;
   };
 }
-// optionalAttrs (args?useDune) { inherit useDune; }
+// lib.optionalAttrs (args?useDune) { inherit useDune; }
diff --git a/pkgs/development/coq-modules/odd-order/default.nix b/pkgs/development/coq-modules/odd-order/default.nix
index 066976e8b4b7..b6770aa633de 100644
--- a/pkgs/development/coq-modules/odd-order/default.nix
+++ b/pkgs/development/coq-modules/odd-order/default.nix
@@ -1,5 +1,4 @@
 { lib, mkCoqDerivation, mathcomp, version ? null }:
-with lib;
 
 mkCoqDerivation {
   pname = "odd-order";
@@ -11,7 +10,7 @@ mkCoqDerivation {
   releaseRev = v: "mathcomp-odd-order.${v}";
 
   inherit version;
-  defaultVersion = with versions; switch mathcomp.character.version [
+  defaultVersion = with lib.versions; lib.switch mathcomp.character.version [
     { case = (range "1.13.0" "1.15.0"); out = "1.14.0"; }
     { case = (range "1.12.0" "1.14.0"); out = "1.13.0"; }
     { case = (range "1.10.0" "1.12.0"); out = "1.12.0"; }
@@ -27,7 +26,7 @@ mkCoqDerivation {
     mathcomp.all
   ];
 
-  meta = {
+  meta = with lib; {
     description = "Formal proof of the Odd Order Theorem";
     maintainers = with maintainers; [ siraben ];
     license = licenses.cecill-b;
diff --git a/pkgs/development/coq-modules/paco/default.nix b/pkgs/development/coq-modules/paco/default.nix
index ea0988ef6073..e9163c16132c 100644
--- a/pkgs/development/coq-modules/paco/default.nix
+++ b/pkgs/development/coq-modules/paco/default.nix
@@ -1,10 +1,10 @@
 { lib, mkCoqDerivation, coq, version ? null }:
 
-with lib; mkCoqDerivation {
+mkCoqDerivation {
   pname = "paco";
   owner = "snu-sf";
   inherit version;
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
     { case = range "8.12" "8.16"; out = "4.1.2"; }
     { case = range "8.9" "8.13"; out = "4.1.1"; }
     { case = range "8.6" "8.13"; out = "4.0.2"; }
@@ -27,6 +27,6 @@ with lib; mkCoqDerivation {
   meta = {
     homepage = "https://plv.mpi-sws.org/paco/";
     description = "A Coq library implementing parameterized coinduction";
-    maintainers = with maintainers; [ jwiegley ptival ];
+    maintainers = with lib.maintainers; [ jwiegley ptival ];
   };
 }
diff --git a/pkgs/development/coq-modules/paramcoq/default.nix b/pkgs/development/coq-modules/paramcoq/default.nix
index e03f44320cf9..cc4966affcfd 100644
--- a/pkgs/development/coq-modules/paramcoq/default.nix
+++ b/pkgs/development/coq-modules/paramcoq/default.nix
@@ -1,9 +1,9 @@
 { lib, mkCoqDerivation, coq, version ? null }:
 
-with lib; mkCoqDerivation {
+mkCoqDerivation {
   pname = "paramcoq";
   inherit version;
-  defaultVersion = with versions; switch coq.version [
+  defaultVersion = with lib.versions; lib.switch coq.version [
     { case = range "8.10" "8.16"; out = "1.1.3+coq${coq.coq-version}"; }
     { case = range "8.7"  "8.13"; out = "1.1.2+coq${coq.coq-version}"; }
   ] null;
@@ -24,7 +24,7 @@ with lib; mkCoqDerivation {
   release."1.1.2+coq8.7".sha256  = "09n0ky7ldb24by7yf5j3hv410h85x50ksilf7qacl7xglj4gy5hj";
   releaseRev = v: "v${v}";
   mlPlugin = true;
-  meta = {
+  meta = with lib; {
     description = "Coq plugin for parametricity";
     license = licenses.mit;
     maintainers = [ maintainers.vbgl ];
diff --git a/pkgs/development/coq-modules/parsec/default.nix b/pkgs/development/coq-modules/parsec/default.nix
index f764267d77e0..8a30fbeb961a 100644
--- a/pkgs/development/coq-modules/parsec/default.nix
+++ b/pkgs/development/coq-modules/parsec/default.nix
@@ -1,6 +1,5 @@
 { lib, mkCoqDerivation, coq, ceres, coq-ext-lib, version ? null }:
 
-with lib;
 mkCoqDerivation {
 
   pname = "parsec";
@@ -11,14 +10,14 @@ mkCoqDerivation {
   releaseRev = (v: "v${v}");
 
   inherit version;
-  defaultVersion = with versions; switch coq.version [
+  defaultVersion = with lib.versions; lib.switch coq.version [
     { case = range "8.12" "8.16"; out = "0.1.1"; }
     { case = range "8.12" "8.13"; out = "0.1.0"; }
   ] null;
   release."0.1.1".sha256 = "sha256:1c0l18s68pzd4c8i3jimh2yz0pqm4g38pca4bm7fr18r8xmqf189";
   release."0.1.0".sha256 = "sha256:01avfcqirz2b9wjzi9iywbhz9szybpnnj3672dgkfsimyg9jgnsr";
 
-  meta = {
+  meta = with lib; {
     description = "Library for serialization to S-expressions";
     license = licenses.bsd3;
     maintainers = with maintainers; [ Zimmi48 ];
diff --git a/pkgs/development/coq-modules/pocklington/default.nix b/pkgs/development/coq-modules/pocklington/default.nix
index 111bffeca2c9..a9e0d43a5a7a 100644
--- a/pkgs/development/coq-modules/pocklington/default.nix
+++ b/pkgs/development/coq-modules/pocklington/default.nix
@@ -1,5 +1,4 @@
 { lib, mkCoqDerivation, coq, version ? null }:
-with lib;
 
 mkCoqDerivation {
   pname = "pocklington";
@@ -9,11 +8,11 @@ mkCoqDerivation {
   release."8.12.0".sha256 = "sha256-0xBrw9+4g14niYdNqp0nx00fPJoSSnaDSDEaIVpPfjs=";
 
   inherit version;
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
     { case = isGe "8.7"; out = "8.12.0"; }
   ] null;
 
-  meta = {
+  meta = with lib; {
     description = "Pocklington's criterion for primality in Coq";
     maintainers = with maintainers; [ siraben ];
     license = licenses.mit;
diff --git a/pkgs/development/coq-modules/reglang/default.nix b/pkgs/development/coq-modules/reglang/default.nix
index 2d83cbfd883f..44e938e16dbd 100644
--- a/pkgs/development/coq-modules/reglang/default.nix
+++ b/pkgs/development/coq-modules/reglang/default.nix
@@ -1,5 +1,4 @@
 { lib, mkCoqDerivation, coq, ssreflect, version ? null }:
-with lib;
 
 mkCoqDerivation {
   pname = "reglang";
@@ -9,14 +8,14 @@ mkCoqDerivation {
   release."1.1.2".sha256 = "sha256-SEnMilLNxh6a3oiDNGLaBr8quQ/nO2T9Fwdf/1il2Yk=";
 
   inherit version;
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
     { case = range "8.10" "8.16"; out = "1.1.2"; }
   ] null;
 
 
   propagatedBuildInputs = [ ssreflect ];
 
-  meta = {
+  meta = with lib; {
     description = "Regular Language Representations in Coq";
     maintainers = with maintainers; [ siraben ];
     license = licenses.cecill-b;
diff --git a/pkgs/development/coq-modules/relation-algebra/default.nix b/pkgs/development/coq-modules/relation-algebra/default.nix
index d2124d56f3f5..c8fb6982b84e 100644
--- a/pkgs/development/coq-modules/relation-algebra/default.nix
+++ b/pkgs/development/coq-modules/relation-algebra/default.nix
@@ -1,12 +1,11 @@
 { lib, mkCoqDerivation, coq, aac-tactics, mathcomp, version ? null }:
-with lib;
 
 mkCoqDerivation {
   pname = "relation-algebra";
   owner = "damien-pous";
 
   releaseRev = v:
-    if versions.isGe "1.7.6" v
+    if lib.versions.isGe "1.7.6" v
     then "v.${v}"
     else "v${v}";
 
@@ -20,7 +19,7 @@ mkCoqDerivation {
   release."1.7.1".sha256 = "sha256-WWVMcR6z8rT4wzZPb8SlaVWGe7NC8gScPqawd7bltQA=";
 
   inherit version;
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
     { case = isEq "8.16"; out = "1.7.8"; }
     { case = isEq "8.15"; out = "1.7.7"; }
     { case = isEq "8.14"; out = "1.7.6"; }
@@ -35,7 +34,7 @@ mkCoqDerivation {
 
   propagatedBuildInputs = [ aac-tactics mathcomp.ssreflect ];
 
-  meta = {
+  meta = with lib; {
     description = "Relation algebra library for Coq";
     maintainers = with maintainers; [ siraben ];
     license = licenses.gpl3Plus;
diff --git a/pkgs/development/coq-modules/semantics/default.nix b/pkgs/development/coq-modules/semantics/default.nix
index ecbef5b92fea..468be219d0d7 100644
--- a/pkgs/development/coq-modules/semantics/default.nix
+++ b/pkgs/development/coq-modules/semantics/default.nix
@@ -1,5 +1,4 @@
 { lib, mkCoqDerivation, coq, version ? null }:
-with lib;
 
 mkCoqDerivation rec {
   pname = "semantics";
@@ -15,7 +14,7 @@ mkCoqDerivation rec {
   release."8.6.0".sha256 = "sha256-GltkGQ3tJqUPAbdDkqqvKLLhMOap50XvGaCkjshiNdY=";
 
   inherit version;
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
     { case = range "8.10" "8.16"; out = "8.14.0"; }
     { case = "8.9"; out = "8.9.0"; }
     { case = "8.8"; out = "8.8.0"; }
@@ -34,7 +33,7 @@ mkCoqDerivation rec {
     done
   '';
 
-  meta = {
+  meta = with lib; {
     description = "A survey of programming language semantics styles in Coq";
     longDescription = ''
       A survey of semantics styles in Coq, from natural semantics through
diff --git a/pkgs/development/coq-modules/serapi/default.nix b/pkgs/development/coq-modules/serapi/default.nix
index e3ec9bfdc39a..27641f4f5a99 100644
--- a/pkgs/development/coq-modules/serapi/default.nix
+++ b/pkgs/development/coq-modules/serapi/default.nix
@@ -17,7 +17,7 @@ in
   inherit version release;
 
   defaultVersion =  with versions;
-    switch coq.version [
+    lib.switch coq.version [
       { case = isEq "8.16"; out = "8.16.0+0.16.0"; }
       { case = isEq "8.15"; out = "8.15.0+0.15.0"; }
       { case = isEq "8.14"; out = "8.14.0+0.14.0"; }
diff --git a/pkgs/development/coq-modules/simple-io/default.nix b/pkgs/development/coq-modules/simple-io/default.nix
index f9fe909d8caa..509ce57c5cff 100644
--- a/pkgs/development/coq-modules/simple-io/default.nix
+++ b/pkgs/development/coq-modules/simple-io/default.nix
@@ -1,11 +1,11 @@
 { lib, callPackage, mkCoqDerivation, coq, coq-ext-lib, version ? null }:
 
-with lib; mkCoqDerivation {
+mkCoqDerivation {
   pname = "simple-io";
   owner = "Lysxia";
   repo = "coq-simple-io";
   inherit version;
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
     { case = range "8.11" "8.16"; out = "1.7.0"; }
     { case = range "8.7"  "8.13"; out = "1.3.0"; }
   ] null;
@@ -21,7 +21,7 @@ with lib; mkCoqDerivation {
 
   passthru.tests.HelloWorld = callPackage ./test.nix {};
 
-  meta = {
+  meta = with lib; {
     description = "Purely functional IO for Coq";
     license = licenses.mit;
     maintainers = [ maintainers.vbgl ];
diff --git a/pkgs/development/coq-modules/smpl/default.nix b/pkgs/development/coq-modules/smpl/default.nix
index f03065cf0450..2ba755dd42d0 100644
--- a/pkgs/development/coq-modules/smpl/default.nix
+++ b/pkgs/development/coq-modules/smpl/default.nix
@@ -1,5 +1,4 @@
 { lib, mkCoqDerivation, coq, version ? null }:
-with lib;
 
 mkCoqDerivation {
   pname = "smpl";
@@ -13,7 +12,7 @@ mkCoqDerivation {
   releaseRev = v: "v${v}";
 
   inherit version;
-  defaultVersion = with versions; switch coq.version [
+  defaultVersion = with lib.versions; lib.switch coq.version [
     { case = isEq "8.15"; out = "8.15"; }
     { case = isEq "8.14"; out = "8.14"; }
     { case = "8.13.2"; out = "8.13"; }
@@ -23,7 +22,7 @@ mkCoqDerivation {
 
   mlPlugin = true;
 
-  meta = {
+  meta = with lib; {
     description = "A Coq plugin providing an extensible tactic similar to first";
     maintainers = with maintainers; [ siraben ];
     license = licenses.mit;
diff --git a/pkgs/development/coq-modules/smtcoq/default.nix b/pkgs/development/coq-modules/smtcoq/default.nix
index 89a6abd2b1ac..49c4348b9af5 100644
--- a/pkgs/development/coq-modules/smtcoq/default.nix
+++ b/pkgs/development/coq-modules/smtcoq/default.nix
@@ -1,5 +1,4 @@
 { lib, stdenv, gcc10StdenvCompat, pkgs, mkCoqDerivation, coq, trakt, veriT, zchaff, fetchurl, version ? null }:
-with lib;
 
 let
   # version of veriT that works with SMTCoq
@@ -23,7 +22,7 @@ mkCoqDerivation {
   release."2021-09-17".sha256 = "sha256-bF7ES+tXraaAJwVEwAMx3CUESpNlAUerQjr4d2eaGJQ=";
 
   inherit version;
-  defaultVersion = with versions; switch coq.version [
+  defaultVersion = with lib.versions; lib.switch coq.version [
     { case = isEq "8.13"; out = "2021-09-17"; }
   ] null;
 
@@ -34,7 +33,7 @@ mkCoqDerivation {
   # This is meant to ease future troubleshooting of cvc4 build failures
   passthru = { inherit cvc4; };
 
-  meta = {
+  meta = with lib; {
     description = "Communication between Coq and SAT/SMT solvers ";
     maintainers = with maintainers; [ siraben ];
     license = licenses.cecill-b;
diff --git a/pkgs/development/coq-modules/stdpp/default.nix b/pkgs/development/coq-modules/stdpp/default.nix
index 19b72c4e948c..d20b63732141 100644
--- a/pkgs/development/coq-modules/stdpp/default.nix
+++ b/pkgs/development/coq-modules/stdpp/default.nix
@@ -1,11 +1,11 @@
 { lib, mkCoqDerivation, coq, version ? null }:
 
-with lib; mkCoqDerivation rec {
+mkCoqDerivation rec {
   pname = "stdpp";
   inherit version;
   domain = "gitlab.mpi-sws.org";
   owner = "iris";
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
     { case = range "8.13" "8.16"; out = "1.8.0"; }
     { case = range "8.12" "8.14"; out = "1.6.0"; }
     { case = range "8.11" "8.13"; out = "1.5.0"; }
@@ -24,7 +24,7 @@ with lib; mkCoqDerivation rec {
     fi
   '';
 
-  meta = {
+  meta = with lib; {
     description = "An extended “Standard Library” for Coq";
     license = licenses.bsd3;
     maintainers = [ maintainers.vbgl ];
diff --git a/pkgs/development/coq-modules/tlc/default.nix b/pkgs/development/coq-modules/tlc/default.nix
index 79d3ce2d7a04..8ded1abeb146 100644
--- a/pkgs/development/coq-modules/tlc/default.nix
+++ b/pkgs/development/coq-modules/tlc/default.nix
@@ -1,11 +1,11 @@
 { lib, mkCoqDerivation, coq, version ? null }:
 
-with lib; (mkCoqDerivation {
+(mkCoqDerivation {
   pname = "tlc";
   owner = "charguer";
   inherit version;
   displayVersion = { tlc = false; };
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
     { case = range "8.13" "8.16"; out = "20211215"; }
     { case = range "8.12" "8.13"; out = "20210316"; }
     { case = range "8.10" "8.12"; out = "20200328"; }
@@ -16,14 +16,14 @@ with lib; (mkCoqDerivation {
   release."20200328".sha256 = "16vzild9gni8zhgb3qhmka47f8zagdh03k6nssif7drpim8233lx";
   release."20181116".sha256 = "032lrbkxqm9d3fhf6nv1kq2z0mqd3czv3ijlbsjwnfh12xck4vpl";
 
-  meta = {
+  meta = with lib; {
     homepage = "http://www.chargueraud.org/softs/tlc/";
     description = "A non-constructive library for Coq";
     license = licenses.free;
     maintainers = [ maintainers.vbgl ];
   };
 }).overrideAttrs (x:
-  if versionAtLeast x.version "20210316"
+  if lib.versionAtLeast x.version "20210316"
   then {}
   else {
     installFlags = [ "CONTRIB=$(out)/lib/coq/${coq.coq-version}/user-contrib" ];
diff --git a/pkgs/development/coq-modules/topology/default.nix b/pkgs/development/coq-modules/topology/default.nix
index 71849c50ae9e..de73fbadbf05 100644
--- a/pkgs/development/coq-modules/topology/default.nix
+++ b/pkgs/development/coq-modules/topology/default.nix
@@ -1,5 +1,4 @@
 { lib, mkCoqDerivation, coq, mathcomp, zorns-lemma, version ? null }:
-with lib;
 
 mkCoqDerivation rec {
   pname = "topology";
@@ -15,7 +14,7 @@ mkCoqDerivation rec {
   release."8.6.0".sha256 = "sha256-eu/dBEFo3y6vnXlJljUD4hds6+qgAPQVvsuspyGHcj8=";
 
   inherit version;
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
     { case = range "8.10" "8.16"; out = "9.0.0"; }
     { case = "8.9"; out = "8.9.0"; }
     { case = "8.8"; out = "8.8.0"; }
@@ -25,9 +24,9 @@ mkCoqDerivation rec {
 
   propagatedBuildInputs = [ zorns-lemma ];
 
-  useDuneifVersion = versions.isGe "9.0";
+  useDuneifVersion = lib.versions.isGe "9.0";
 
-  meta = {
+  meta = with lib; {
     description = "General topology in Coq";
     longDescription = ''
       This library develops some of the basic concepts and results of
diff --git a/pkgs/development/coq-modules/trakt/default.nix b/pkgs/development/coq-modules/trakt/default.nix
index f10e69cc4e90..8bc7581489c3 100644
--- a/pkgs/development/coq-modules/trakt/default.nix
+++ b/pkgs/development/coq-modules/trakt/default.nix
@@ -1,5 +1,4 @@
 { lib, mkCoqDerivation, coq, coq-elpi, version ? null }:
-with lib;
 
 mkCoqDerivation {
   pname = "trakt";
@@ -9,13 +8,13 @@ mkCoqDerivation {
   release."1.0".sha256 = "sha256-Qhw5fWFYxUFO2kIWWz/og+4fuy9aYG27szfNk3IglhY=";
 
   inherit version;
-  defaultVersion = with versions; switch [ coq.version ] [
+  defaultVersion = with lib.versions; lib.switch [ coq.version ] [
     { cases = [ (range "8.13" "8.16") ]; out = "1.0"; }
   ] null;
 
   propagatedBuildInputs = [ coq-elpi ];
 
-  meta = {
+  meta = with lib; {
     description = "A generic goal preprocessing tool for proof automation tactics in Coq";
     maintainers = with maintainers; [ siraben ];
     license = licenses.cecill-b;
diff --git a/pkgs/development/coq-modules/zorns-lemma/default.nix b/pkgs/development/coq-modules/zorns-lemma/default.nix
index dedb58b59356..19696bd81d4f 100644
--- a/pkgs/development/coq-modules/zorns-lemma/default.nix
+++ b/pkgs/development/coq-modules/zorns-lemma/default.nix
@@ -1,5 +1,4 @@
 { lib, mkCoqDerivation, coq, version ? null }:
-with lib;
 
 (mkCoqDerivation {
   pname = "zorns-lemma";
@@ -16,7 +15,7 @@ with lib;
   release."8.5.0".sha256 = "sha256-mH/v02ObMjbVPYx2H+Jhz+Xp0XRKN67iMAdA1VNFzso=";
 
   inherit version;
-  defaultVersion = with versions; switch coq.coq-version [
+  defaultVersion = with lib.versions; lib.switch coq.coq-version [
     { case = range "8.10" "8.16"; out = "9.0.0"; }
     { case = "8.9"; out = "8.9.0"; }
     { case = "8.8"; out = "8.8.0"; }
@@ -25,9 +24,9 @@ with lib;
     { case = "8.5"; out = "8.5.0"; }
   ] null;
 
-  useDuneifVersion = versions.isGe "9.0";
+  useDuneifVersion = lib.versions.isGe "9.0";
 
-  meta = {
+  meta = with lib; {
     description = "Development of basic set theory";
     longDescription = ''
       This Coq library develops some basic set theory.  The main
@@ -37,4 +36,4 @@ with lib;
     maintainers = with maintainers; [ siraben ];
     license = licenses.lgpl21Plus;
   };
-}).overrideAttrs({version, ...}: if versions.isGe "9.0" version then { repo =  "topology"; } else {})
+}).overrideAttrs({version, ...}: if lib.versions.isGe "9.0" version then { repo =  "topology"; } else {})
diff --git a/pkgs/development/libraries/exempi/default.nix b/pkgs/development/libraries/exempi/default.nix
index 3586a674904b..d17ca4ea751e 100644
--- a/pkgs/development/libraries/exempi/default.nix
+++ b/pkgs/development/libraries/exempi/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, expat, zlib, boost, libiconv, darwin }:
+{ lib, stdenv, fetchurl, expat, zlib, boost, libiconv, darwin }:
 
 stdenv.mkDerivation rec {
   pname = "exempi";
@@ -21,9 +21,11 @@ stdenv.mkDerivation rec {
   doCheck = stdenv.isLinux && stdenv.is64bit;
   dontDisableStatic = doCheck;
 
+  enableParallelBuilding = true;
+
   meta = with lib; {
     description = "An implementation of XMP (Adobe's Extensible Metadata Platform)";
-    homepage = "https://libopenraw.freedesktop.org/wiki/Exempi/";
+    homepage = "https://libopenraw.freedesktop.org/exempi/";
     platforms = platforms.linux ++ platforms.darwin;
     license = licenses.bsd3;
   };
diff --git a/pkgs/development/libraries/intel-media-sdk/default.nix b/pkgs/development/libraries/intel-media-sdk/default.nix
index 13725d5a812a..5e6f628aa68e 100644
--- a/pkgs/development/libraries/intel-media-sdk/default.nix
+++ b/pkgs/development/libraries/intel-media-sdk/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-media-sdk";
-  version = "22.5.4";
+  version = "22.6.5";
 
   src = fetchFromGitHub {
     owner = "Intel-Media-SDK";
     repo = "MediaSDK";
     rev = "intel-mediasdk-${version}";
-    sha256 = "sha256-f9b0+BWUlekMM0huPdJ5Ms4tYr/ipgfLiQ310FQKAXA=";
+    sha256 = "sha256-W+lDqGZAenhRZ7tf4qfDNik/3rFNDM0DGSK/CdNRb8g=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/development/libraries/libcxxrt/default.nix b/pkgs/development/libraries/libcxxrt/default.nix
new file mode 100644
index 000000000000..e981945ccbd3
--- /dev/null
+++ b/pkgs/development/libraries/libcxxrt/default.nix
@@ -0,0 +1,34 @@
+{ lib, stdenv, fetchFromGitHub, cmake, unstableGitUpdater }:
+
+stdenv.mkDerivation {
+  pname = "libcxxrt";
+  version = "unstable-2022-08-08";
+
+  src = fetchFromGitHub {
+    owner = "libcxxrt";
+    repo = "libcxxrt";
+    rev = "a0f7f5c139a7daf71de0de201b6c405d852b1dc1";
+    sha256 = "6ErOhlD6pOudbTkFTlI2hjBuYT3QuzEiL33/mLnw1aI=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  installPhase = ''
+    mkdir -p $out/include $out/lib
+    cp ../src/cxxabi.h $out/include
+    cp lib/libcxxrt${stdenv.hostPlatform.extensions.library} $out/lib
+  '';
+
+  passthru = {
+    libName = "cxxrt";
+    updateScript = unstableGitUpdater { };
+  };
+
+  meta = with lib; {
+    homepage = "https://github.com/libcxxrt/libcxxrt";
+    description = "Implementation of the Code Sourcery C++ ABI";
+    maintainers = with maintainers; [ qyliss ];
+    platforms = platforms.all;
+    license = licenses.bsd2;
+  };
+}
diff --git a/pkgs/development/libraries/libdiscid/default.nix b/pkgs/development/libraries/libdiscid/default.nix
index 3021aced93f6..7a073b143b93 100644
--- a/pkgs/development/libraries/libdiscid/default.nix
+++ b/pkgs/development/libraries/libdiscid/default.nix
@@ -20,6 +20,6 @@ stdenv.mkDerivation rec {
     homepage = "http://musicbrainz.org/doc/libdiscid";
     maintainers = with maintainers; [ ehmry ];
     license = licenses.lgpl21;
-    platforms = platforms.linux ++ platforms.darwin;
+    platforms = platforms.all;
   };
 }
diff --git a/pkgs/development/libraries/libomxil-bellagio/default.nix b/pkgs/development/libraries/libomxil-bellagio/default.nix
index e49473b79ede..67d9ec29b207 100644
--- a/pkgs/development/libraries/libomxil-bellagio/default.nix
+++ b/pkgs/development/libraries/libomxil-bellagio/default.nix
@@ -23,14 +23,14 @@ stdenv.mkDerivation rec {
 
   doCheck = false; # fails
 
-  # Fix for #40213, probably permanent, because upstream doesn't seem to be
-  # developed anymore. Alternatively, gcc7Stdenv could be used.
-  NIX_CFLAGS_COMPILE = "-Wno-error=array-bounds -Wno-error=stringop-overflow=8";
+  NIX_CFLAGS_COMPILE =
+    if stdenv.cc.isGNU then "-Wno-error=array-bounds -Wno-error=stringop-overflow=8"
+    else "-Wno-error=absolute-value -Wno-error=enum-conversion -Wno-error=logical-not-parentheses -Wno-error=non-literal-null-conversion";
 
   meta = with lib; {
-    homepage = "https://sourceforge.net/projects/omxil/";
+    homepage = "https://omxil.sourceforge.net/";
     description = "An opensource implementation of the Khronos OpenMAX Integration Layer API to access multimedia components";
-    license = licenses.lgpl21;
+    license = licenses.lgpl21Plus;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/development/libraries/libsv/default.nix b/pkgs/development/libraries/libsv/default.nix
new file mode 100644
index 000000000000..fb319bf30f34
--- /dev/null
+++ b/pkgs/development/libraries/libsv/default.nix
@@ -0,0 +1,23 @@
+{ lib, stdenv, fetchFromGitHub, cmake }:
+
+stdenv.mkDerivation rec {
+  pname = "libsv";
+  version = "1.1";
+
+  src = fetchFromGitHub {
+    owner = "uael";
+    repo = "sv";
+    rev = "v${version}";
+    sha256 = "sha256-icvGQi6FNSZXNGs2oLiUKu6rrVsWcXh1r91kycGjnwY=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  meta = with lib; {
+    description = "Public domain cross-platform semantic versioning in C99";
+    homepage = "https://github.com/uael/sv";
+    license = licenses.unlicense;
+    maintainers = with maintainers; [ candyc1oud ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/development/libraries/mdds/default.nix b/pkgs/development/libraries/mdds/default.nix
index 23059b91e7c0..edce9518c3c5 100644
--- a/pkgs/development/libraries/mdds/default.nix
+++ b/pkgs/development/libraries/mdds/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mdds";
-  version = "2.0.3";
+  version = "2.1.0";
 
   src = fetchFromGitLab {
     owner = "mdds";
     repo = "mdds";
     rev = finalAttrs.version;
-    hash = "sha256-Y9uBJKM34UTEj/3c1w69QHhvwFcMNlAohEco0O0B+xI=";
+    hash = "sha256-RZ2wGwle4raWlogc5X+VEeriPGS0Nqs7CWGENFEotvs=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/development/libraries/ntirpc/default.nix b/pkgs/development/libraries/ntirpc/default.nix
index 66002df49052..4526814c3780 100644
--- a/pkgs/development/libraries/ntirpc/default.nix
+++ b/pkgs/development/libraries/ntirpc/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ntirpc";
-  version = "4.2";
+  version = "4.3";
 
   src = fetchFromGitHub {
     owner = "nfs-ganesha";
     repo = "ntirpc";
     rev = "v${version}";
-    sha256 = "sha256-rVv5TLxirtmoRJl0+RupbkvzChuSMSGi3NTa0dchZSU=";
+    sha256 = "sha256-P9+t9dTiEKjloulypWPJ4sXWWemq9zPUH/Kctvq1SUQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/raft-canonical/default.nix b/pkgs/development/libraries/raft-canonical/default.nix
index 72da2a34e752..0fc885033e64 100644
--- a/pkgs/development/libraries/raft-canonical/default.nix
+++ b/pkgs/development/libraries/raft-canonical/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "raft-canonical";
-  version = "0.11.2";
+  version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = "canonical";
     repo = "raft";
-    rev = "v${version}";
-    sha256 = "050dwy34jh8dihfwfm0r1by2i3sy9crapipp9idw32idm79y4izb";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-qDLAEhknY+BB83OC6tfi7w/ZY/K492J5ZglLNUoBwbc=";
   };
 
   nativeBuildInputs = [ autoreconfHook file pkg-config ];
@@ -16,13 +16,13 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  # Ignore broken test, likely not causing huge breakage
-  # (https://github.com/canonical/raft/issues/292)
-  postPatch = ''
-    substituteInPlace test/integration/test_uv_tcp_connect.c --replace \
-      "TEST(tcp_connect, closeDuringHandshake, setUp, tearDownDeps, 0, NULL)" \
-      "TEST(tcp_connect, closeDuringHandshake, setUp, tearDownDeps, MUNIT_TEST_OPTION_TODO, NULL)"
-  '';
+  patches = [
+    # network tests either hang indefinitely, or fail outright
+    ./disable-net-tests.patch
+
+    # missing dir check is flaky
+    ./disable-missing-dir-test.patch
+  ];
 
   preConfigure = ''
     substituteInPlace configure --replace /usr/bin/ " "
@@ -46,6 +46,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/canonical/raft";
     license = licenses.asl20;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ wucke13 ];
+    maintainers = with maintainers; [ wucke13 adamcstephens ];
   };
 }
diff --git a/pkgs/development/libraries/raft-canonical/disable-missing-dir-test.patch b/pkgs/development/libraries/raft-canonical/disable-missing-dir-test.patch
new file mode 100644
index 000000000000..ddfec9b22e14
--- /dev/null
+++ b/pkgs/development/libraries/raft-canonical/disable-missing-dir-test.patch
@@ -0,0 +1,23 @@
+diff --git a/test/unit/test_uv_fs.c b/test/unit/test_uv_fs.c
+index 638c39c..c8758d2 100644
+--- a/test/unit/test_uv_fs.c
++++ b/test/unit/test_uv_fs.c
+@@ -40,18 +40,6 @@ TEST(UvFsCheckDir, exists, DirSetUp, DirTearDown, 0, NULL)
+     return MUNIT_OK;
+ }
+ 
+-/* If the directory doesn't exist, it an error is returned. */
+-TEST(UvFsCheckDir, doesNotExist, DirSetUp, DirTearDown, 0, NULL)
+-{
+-    const char *parent = data;
+-    char errmsg[RAFT_ERRMSG_BUF_SIZE];
+-    char dir[128];
+-    sprintf(errmsg, "%s/sub", parent);
+-    sprintf(errmsg, "directory '%s' does not exist", dir);
+-    CHECK_DIR_ERROR(dir, RAFT_NOTFOUND, errmsg);
+-    return MUNIT_OK;
+-}
+-
+ /* If the process can't access the directory, an error is returned. */
+ TEST(UvFsCheckDir, permissionDenied, NULL, NULL, 0, NULL)
+ {
diff --git a/pkgs/development/libraries/raft-canonical/disable-net-tests.patch b/pkgs/development/libraries/raft-canonical/disable-net-tests.patch
new file mode 100644
index 000000000000..7c8be29feafd
--- /dev/null
+++ b/pkgs/development/libraries/raft-canonical/disable-net-tests.patch
@@ -0,0 +1,16 @@
+diff --git a/Makefile.am b/Makefile.am
+index 2137932..93abdb6 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -198,11 +198,7 @@ test_integration_uv_SOURCES = \
+   test/integration/test_uv_bootstrap.c \
+   test/integration/test_uv_load.c \
+   test/integration/test_uv_recover.c \
+-  test/integration/test_uv_recv.c \
+-  test/integration/test_uv_send.c \
+   test/integration/test_uv_set_term.c \
+-  test/integration/test_uv_tcp_connect.c \
+-  test/integration/test_uv_tcp_listen.c \
+   test/integration/test_uv_snapshot_put.c \
+   test/integration/test_uv_truncate.c \
+   test/integration/test_uv_work.c
diff --git a/pkgs/development/libraries/vxl/default.nix b/pkgs/development/libraries/vxl/default.nix
index 8fed0e47e43f..098dc64cf154 100644
--- a/pkgs/development/libraries/vxl/default.nix
+++ b/pkgs/development/libraries/vxl/default.nix
@@ -1,13 +1,13 @@
 { lib, stdenv, fetchFromGitHub, unzip, cmake, libtiff, expat, zlib, libpng, libjpeg }:
 stdenv.mkDerivation rec {
   pname = "vxl";
-  version = "3.3.2";
+  version = "3.5.0";
 
   src = fetchFromGitHub {
     owner = "vxl";
     repo = "vxl";
     rev = "v${version}";
-    sha256 = "0qmqrijl14xlsbd77jk9ygg44h3lqzpswia6yif1iia6smqccjsr";
+    sha256 = "sha256-4kMpIrywEZzt0JH95LHeDLrDneii0R/Uw9GsWkvED+E=";
   };
 
   nativeBuildInputs = [ cmake unzip ];
diff --git a/pkgs/development/libraries/zziplib/default.nix b/pkgs/development/libraries/zziplib/default.nix
index 90758db16edd..c4c20f207a41 100644
--- a/pkgs/development/libraries/zziplib/default.nix
+++ b/pkgs/development/libraries/zziplib/default.nix
@@ -76,6 +76,6 @@ stdenv.mkDerivation rec {
     '';
     license = with licenses; [ lgpl2Plus mpl11 ];
     maintainers = with maintainers; [ AndersonTorres ];
-    platforms = python3.meta.platforms;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index d33ff9907a9a..31891967df4f 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -2019,6 +2019,40 @@ buildLuarocksPackage {
   };
 }) {};
 
+lualdap = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
+, fetchgit, lua
+}:
+buildLuarocksPackage {
+  pname = "lualdap";
+  version = "1.3.0-1";
+  knownRockspec = (fetchurl {
+    url    = "mirror://luarocks/lualdap-1.3.0-1.rockspec";
+    sha256 = "0b51sm0fz4kiim20w538v31k9g20wq3msxdkh17drkr60ab25sc8";
+  }).outPath;
+  src = fetchgit ( removeAttrs (builtins.fromJSON ''{
+  "url": "https://github.com/lualdap/lualdap",
+  "rev": "be380f5d98f779c813a4fb4ae1400262366fc8d4",
+  "date": "2021-06-05T15:49:42+02:00",
+  "path": "/nix/store/99sy73yz6sidqhkl0kwdsd7r853aw38n-lualdap",
+  "sha256": "133d8br5f24z03ni38m0czrqfz0mr0ksdrc1g73rawpmiqarpps8",
+  "fetchLFS": false,
+  "fetchSubmodules": true,
+  "deepClone": false,
+  "leaveDotGit": false
+}
+ '') ["date" "path"]) ;
+
+  disabled = with lua; (luaOlder "5.1");
+  propagatedBuildInputs = [ lua ];
+
+  meta = {
+    homepage = "https://lualdap.github.io/lualdap/";
+    description = "A Lua interface to the OpenLDAP library";
+    maintainers = with lib.maintainers; [ aanderse ];
+    license.fullName = "MIT";
+  };
+}) {};
+
 lualogging = callPackage({ buildLuarocksPackage, luaOlder, luaAtLeast
 , fetchgit, luasocket
 }:
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index 6488ed507a66..419842a09677 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -27,6 +27,7 @@
 , mariadb
 , mpfr
 , neovim-unwrapped
+, openldap
 , openssl
 , pcre
 , pkg-config
@@ -329,6 +330,12 @@ with prev;
     disabled = luaOlder "5.1" || luaAtLeast "5.4" || isLuaJIT;
   });
 
+  lualdap = prev.luaLib.overrideLuarocks prev.lualdap (drv: {
+    externalDeps = [
+      { name = "LDAP"; dep = openldap; }
+    ];
+  });
+
   luaossl = prev.luaLib.overrideLuarocks prev.luaossl (drv: {
     externalDeps = [
       { name = "CRYPTO"; dep = openssl; }
diff --git a/pkgs/development/nim-packages/asynctools/default.nix b/pkgs/development/nim-packages/asynctools/default.nix
new file mode 100644
index 000000000000..54893d00a980
--- /dev/null
+++ b/pkgs/development/nim-packages/asynctools/default.nix
@@ -0,0 +1,20 @@
+{ lib, buildNimPackage, fetchFromGitHub, astpatternmatching }:
+
+buildNimPackage rec {
+  pname = "asynctools";
+  version = "unstable-2021-07-06";
+
+  src = fetchFromGitHub {
+    owner = "cheatfate";
+    repo = "asynctools";
+    rev = "84ced6d002789567f2396c75800ffd6dff2866f7";
+    hash = "sha256-mrO+WeSzCBclqC2UNCY+IIv7Gs8EdTDaTeSgXy3TgNM=";
+  };
+
+  meta = with lib; {
+    description = "Various asynchronous tools for Nim language";
+    homepage = "https://github.com/cheatfate/asynctools";
+    license = licenses.mit;
+    maintainers = [ maintainers.marsam ];
+  };
+}
diff --git a/pkgs/development/ocaml-modules/carton/carton-find-getconf.patch b/pkgs/development/ocaml-modules/carton/carton-find-getconf.patch
new file mode 100644
index 000000000000..8c7176ee16c8
--- /dev/null
+++ b/pkgs/development/ocaml-modules/carton/carton-find-getconf.patch
@@ -0,0 +1,13 @@
+diff --git a/bin/fiber/fiber.ml b/bin/fiber/fiber.ml
+index 188a92cc9..6087a8687 100644
+--- a/bin/fiber/fiber.ml
++++ b/bin/fiber/fiber.ml
+@@ -129,7 +129,7 @@ let worker pool =
+ 
+ let get_concurrency () =
+   try
+-    let ic = Unix.open_process_in "getconf _NPROCESSORS_ONLN" in
++    let ic = Unix.open_process_in "@getconf@/bin/getconf _NPROCESSORS_ONLN" in
+     let close () = ignore (Unix.close_process_in ic) in
+     let sc = Scanf.Scanning.from_channel ic in
+     try
diff --git a/pkgs/development/ocaml-modules/carton/default.nix b/pkgs/development/ocaml-modules/carton/default.nix
index ae58d206c04c..b075ea53021a 100644
--- a/pkgs/development/ocaml-modules/carton/default.nix
+++ b/pkgs/development/ocaml-modules/carton/default.nix
@@ -3,6 +3,7 @@
 , checkseum, logs, psq, fmt
 , result, rresult, fpath, base64, bos, digestif, alcotest
 , crowbar, alcotest-lwt, lwt, findlib, mirage-flow, cmdliner, hxd
+, getconf, substituteAll
 }:
 
 buildDunePackage rec {
@@ -16,6 +17,13 @@ buildDunePackage rec {
     sha256 = "sha256-NAm4Xq7L0Dgynr8cKZQ356M4GR6D19LbCRxvnSlIf1U=";
   };
 
+  patches = [
+    (substituteAll {
+      src = ./carton-find-getconf.patch;
+      getconf = "${getconf}";
+    })
+  ];
+
   # remove changelogs for mimic and the git* packages
   postPatch = ''
     rm CHANGES.md
diff --git a/pkgs/development/ocaml-modules/paf/cohttp.nix b/pkgs/development/ocaml-modules/paf/cohttp.nix
index df84083ccb3d..97396769fd05 100644
--- a/pkgs/development/ocaml-modules/paf/cohttp.nix
+++ b/pkgs/development/ocaml-modules/paf/cohttp.nix
@@ -47,6 +47,8 @@ buildDunePackage {
     astring
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   meta = paf.meta // {
     description = "A CoHTTP client with its HTTP/AF implementation";
   };
diff --git a/pkgs/development/ocaml-modules/paf/default.nix b/pkgs/development/ocaml-modules/paf/default.nix
index acd16434f6ee..d172e73e13b2 100644
--- a/pkgs/development/ocaml-modules/paf/default.nix
+++ b/pkgs/development/ocaml-modules/paf/default.nix
@@ -61,6 +61,8 @@ buildDunePackage rec {
     alcotest-lwt
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   meta = {
     description = "HTTP/AF and MirageOS";
     license = lib.licenses.mit;
diff --git a/pkgs/development/python-modules/aio-geojson-client/default.nix b/pkgs/development/python-modules/aio-geojson-client/default.nix
index ce133a5f015d..ad0a641c35f5 100644
--- a/pkgs/development/python-modules/aio-geojson-client/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-client/default.nix
@@ -3,7 +3,6 @@
 , aresponses
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , geojson
 , haversine
 , mock
@@ -14,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "aio-geojson-client";
-  version = "0.17";
+  version = "0.18";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -23,18 +22,9 @@ buildPythonPackage rec {
     owner = "exxamalte";
     repo = "python-aio-geojson-client";
     rev = "refs/tags/v${version}";
-    hash = "sha256-5GiQgtbvYeleovFbXO2vlr2XPsDIWZiElM64O+urMcY=";
+    hash = "sha256-nvfy1XLiMjyCiQo/YuzRbDtxGmAUAiq8UJwS/SkN3oM=";
   };
 
-  patches = [
-    # Remove asynctest, https://github.com/exxamalte/python-aio-geojson-client/pull/35
-    (fetchpatch {
-      name = "remove-asynctest.patch";
-      url = "https://github.com/exxamalte/python-aio-geojson-client/commit/bf617d9898a99b026b43b28bd87bb6479f518c0a.patch";
-      hash = "sha256-uomH3LCaklfGURDs8SsnvNyHkubbe+5dleLEjW+I+M4=";
-    })
-  ];
-
   propagatedBuildInputs = [
     aiohttp
     geojson
diff --git a/pkgs/development/python-modules/aio-geojson-generic-client/default.nix b/pkgs/development/python-modules/aio-geojson-generic-client/default.nix
index 1e8666de68b7..534e8441e77a 100644
--- a/pkgs/development/python-modules/aio-geojson-generic-client/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-generic-client/default.nix
@@ -21,7 +21,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "exxamalte";
     repo = "python-aio-geojson-generic-client";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-6Gc3SRRQiISBZnCg7a+rCQHR4NQipBHmG5gWZZXIsxY=";
   };
 
@@ -45,6 +45,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python library for accessing GeoJSON feeds";
     homepage = "https://github.com/exxamalte/python-aio-geojson-generic-client";
+    changelog = "https://github.com/exxamalte/python-aio-geojson-generic-client/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ asl20 ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/aio-geojson-geonetnz-quakes/default.nix b/pkgs/development/python-modules/aio-geojson-geonetnz-quakes/default.nix
index 53c72319af26..90645327c046 100644
--- a/pkgs/development/python-modules/aio-geojson-geonetnz-quakes/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-geonetnz-quakes/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "aio-geojson-geonetnz-quakes";
-  version = "0.14";
+  version = "0.15";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,8 +20,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "exxamalte";
     repo = "python-aio-geojson-geonetnz-quakes";
-    rev = "v${version}";
-    hash = "sha256-T3vQodb0/3YEjsyHLSI8DBKK75J8hvsaBqyQI7GkT3U=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-/EPPEGLtiZBorZMnVg0NqwnHCbCXyZzz4449MzAYQx8=";
   };
 
   propagatedBuildInputs = [
@@ -42,7 +42,8 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Python module for accessing the GeoNet NZ Quakes GeoJSON feeds";
-    homepage = "https://github.com/exxamalte/pythonaio-geojson-geonetnz-quakes";
+    homepage = "https://github.com/exxamalte/python-aio-geojson-geonetnz-quakes";
+    changelog = "https://github.com/exxamalte/python-aio-geojson-geonetnz-quakes/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ asl20 ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/aio-geojson-geonetnz-volcano/default.nix b/pkgs/development/python-modules/aio-geojson-geonetnz-volcano/default.nix
index ad213243925d..3b61a49a4e5f 100644
--- a/pkgs/development/python-modules/aio-geojson-geonetnz-volcano/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-geonetnz-volcano/default.nix
@@ -5,7 +5,6 @@
 , mock
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , pytest-asyncio
 , pytestCheckHook
 , pytz
@@ -14,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "aio-geojson-geonetnz-volcano";
-  version = "0.7";
+  version = "0.8";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -23,18 +22,9 @@ buildPythonPackage rec {
     owner = "exxamalte";
     repo = "python-aio-geojson-geonetnz-volcano";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-2iVUHMk4ydmGmmGS6lJV5pvxJHyP9bRSeh/dOXbquE0=";
+    sha256 = "sha256-wJVFjy6QgYb6GX9pZTylYFvCRWmD2lAFZKnodsa8Yqo=";
   };
 
-  patches = [
-    # Remove asynctest, https://github.com/exxamalte/python-aio-geojson-geonetnz-volcano/pull/18
-    (fetchpatch {
-      name = "remove-asynctest.patch";
-      url = "https://github.com/exxamalte/python-aio-geojson-geonetnz-volcano/commit/d04a488130375c78efa541fd63a5d88bd6b0fd49.patch";
-      hash = "sha256-ArG8CovJckzzNebd03WeU5i/jPqy2HRVBL3ICk5nZ5Y=";
-    })
-  ];
-
   propagatedBuildInputs = [
     aio-geojson-client
     aiohttp
diff --git a/pkgs/development/python-modules/aio-geojson-nsw-rfs-incidents/default.nix b/pkgs/development/python-modules/aio-geojson-nsw-rfs-incidents/default.nix
index 00ebe2c1f8fb..b7c205179fd7 100644
--- a/pkgs/development/python-modules/aio-geojson-nsw-rfs-incidents/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-nsw-rfs-incidents/default.nix
@@ -2,7 +2,6 @@
 , aio-geojson-client
 , aiohttp
 , aresponses
-, asynctest
 , buildPythonPackage
 , fetchFromGitHub
 , pytest-asyncio
@@ -13,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "aio-geojson-nsw-rfs-incidents";
-  version = "0.5";
+  version = "0.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -21,8 +20,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "exxamalte";
     repo = "python-aio-geojson-nsw-rfs-incidents";
-    rev = "v${version}";
-    sha256 = "sha256-rWlt4MYnuY+CzszFVDniWBnqpQW3WldSEl00ns3ko3U=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-pn0r5iLpNnK3xmAhq/oX90hdiHgFDuwDQqfAzkp5jmw=";
   };
 
   propagatedBuildInputs = [
@@ -33,7 +32,6 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     aresponses
-    asynctest
     pytest-asyncio
     pytestCheckHook
   ];
@@ -45,6 +43,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python module for accessing the NSW Rural Fire Service incidents feeds";
     homepage = "https://github.com/exxamalte/python-aio-geojson-nsw-rfs-incidents";
+    changelog = "https://github.com/exxamalte/python-aio-geojson-geonetnz-quakes/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ asl20 ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/aio-geojson-usgs-earthquakes/default.nix b/pkgs/development/python-modules/aio-geojson-usgs-earthquakes/default.nix
index 025e0c356847..04ffcf6b384d 100644
--- a/pkgs/development/python-modules/aio-geojson-usgs-earthquakes/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-usgs-earthquakes/default.nix
@@ -21,7 +21,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "exxamalte";
     repo = "python-aio-geojson-usgs-earthquakes";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-Hb0/BdK/jjxlPl9WJJpFdOCzZpZDCguXoGreGIyN8oo=";
   };
 
@@ -45,6 +45,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python module for accessing the U.S. Geological Survey Earthquake Hazards Program feeds";
     homepage = "https://github.com/exxamalte/python-aio-geojson-usgs-earthquakes";
+    changelog = "https://github.com/exxamalte/python-aio-geojson-usgs-earthquakes/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ asl20 ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/aioecowitt/default.nix b/pkgs/development/python-modules/aioecowitt/default.nix
index 71e7c67fc403..4a5abb7fe94e 100644
--- a/pkgs/development/python-modules/aioecowitt/default.nix
+++ b/pkgs/development/python-modules/aioecowitt/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "aioecowitt";
-  version = "2022.11.0";
+  version = "2023.01.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "home-assistant-libs";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-v+O4J3GZZelF3H3BbL7LVRZEIH01WrDNnmOOWG4rVT0=";
+    hash = "sha256-xOoKrGBkMEdpeiU1r27xlZp5s5sGJzvD7Ats+w6KR/o=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/aioshelly/default.nix b/pkgs/development/python-modules/aioshelly/default.nix
index 511b1c5f84c3..00ae13cd91fa 100644
--- a/pkgs/development/python-modules/aioshelly/default.nix
+++ b/pkgs/development/python-modules/aioshelly/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "aioshelly";
-  version = "5.2.1";
+  version = "5.3.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "home-assistant-libs";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-rz8r+FieBQAZKxZR741CffuEyGcLe6ghdEKFGfeD6vg=";
+    hash = "sha256-tsjHs1v5Yth5XToznCdAWoe70Lhxqh6Mq/MHKSYYg14=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/boschshcpy/default.nix b/pkgs/development/python-modules/boschshcpy/default.nix
index 4ed9de7d17f4..4f17d17c0d52 100644
--- a/pkgs/development/python-modules/boschshcpy/default.nix
+++ b/pkgs/development/python-modules/boschshcpy/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "boschshcpy";
-  version = "0.2.43";
+  version = "0.2.48";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "tschamm";
     repo = pname;
     rev = version;
-    sha256 = "sha256-qxJ1yt8KI3ekza1KNfRRBtpPLNC/X0q7ITPhZkS1hPM=";
+    sha256 = "sha256-EPS9kqlognIoMnpgmFl32FVT1ahyliizLzGfgE3N24Y=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/cometblue-lite/default.nix b/pkgs/development/python-modules/cometblue-lite/default.nix
index eea0b8dac04d..89af6333ae90 100644
--- a/pkgs/development/python-modules/cometblue-lite/default.nix
+++ b/pkgs/development/python-modules/cometblue-lite/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "cometblue-lite";
-  version = "0.5.3";
+  version = "0.7.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -16,8 +16,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "neffs";
     repo = "python-cometblue_lite";
-    rev = version;
-    hash = "sha256-KRWS2nqMFlF+IcBSmnQH3ptp6yxRQjAFY6aY0D7eZBs=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-Cjd7PdZ2/neRr1jStDY5iJaGMJ/srnFmCea8aLNan6g=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/dbus-fast/default.nix b/pkgs/development/python-modules/dbus-fast/default.nix
index 91acd24477bd..b8f2fffe0e1a 100644
--- a/pkgs/development/python-modules/dbus-fast/default.nix
+++ b/pkgs/development/python-modules/dbus-fast/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dbus-fast";
-  version = "1.83.1";
+  version = "1.84.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-hfO4dbMA6efQPwP0Bp/5IDb7mLHf1NuTuiJjhHivG6I=";
+    hash = "sha256-AdfrzN7ufvy77tKjnHPNo+jHoHRw9fXtdUdYvdnMAjs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/django_silk/default.nix b/pkgs/development/python-modules/django_silk/default.nix
index e0790ad00d25..8a53a9d1d58f 100644
--- a/pkgs/development/python-modules/django_silk/default.nix
+++ b/pkgs/development/python-modules/django_silk/default.nix
@@ -26,7 +26,7 @@
 
 buildPythonPackage rec {
   pname = "django-silk";
-  version = "5.0.2";
+  version = "5.0.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -35,7 +35,7 @@ buildPythonPackage rec {
     owner = "jazzband";
     repo = "django-silk";
     rev = "refs/tags/${version}";
-    hash = "sha256-LzcbRZ9NLTkDTZ2eW+uXYqPbWDSdLZAJcYdD8JLuiDc=";
+    hash = "sha256-91FcOqAYZK7/RCKgXjbQEPUQ2cZRFi7NzVLQF+MMDRI=";
   };
 
   # "test_time_taken" tests aren't suitable for reproducible execution, but Django's
@@ -95,6 +95,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Silky smooth profiling for the Django Framework";
     homepage = "https://github.com/jazzband/django-silk";
+    changelog = "https://github.com/jazzband/django-silk/blob/${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ ris ];
   };
diff --git a/pkgs/development/python-modules/garminconnect/default.nix b/pkgs/development/python-modules/garminconnect/default.nix
index 6d9db5a901c5..9a4303b1dd5e 100644
--- a/pkgs/development/python-modules/garminconnect/default.nix
+++ b/pkgs/development/python-modules/garminconnect/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "garminconnect";
-  version = "0.1.50";
+  version = "0.1.51";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "cyberjunky";
     repo = "python-garminconnect";
     rev = "refs/tags/${version}";
-    hash = "sha256-M9FH8xbNo5NF2PktiG4SpZl4tjH7H937Rbqhe6VV+Bk=";
+    hash = "sha256-SEolk0bbq3vNNMFz5B/qELaiCFCZFXJD4zTH8hBUX+Y=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/gehomesdk/default.nix b/pkgs/development/python-modules/gehomesdk/default.nix
index d1a9f146db79..7c83f0623073 100644
--- a/pkgs/development/python-modules/gehomesdk/default.nix
+++ b/pkgs/development/python-modules/gehomesdk/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "gehomesdk";
-  version = "0.5.7";
+  version = "0.5.8";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-FmCoryNX1DnqMlGalad5iWO2ZRZwXgWgARQMYlJ6yVo=";
+    hash = "sha256-x83CmOAZFaIDv4bzO01YZxVPVM/cwUpJtKdCWOxH/O4=";
   };
 
   propagatedBuildInputs = [
@@ -44,6 +44,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python SDK for GE smart appliances";
     homepage = "https://github.com/simbaja/gehome";
+    changelog = "https://github.com/simbaja/gehome/blob/master/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/geojson-client/default.nix b/pkgs/development/python-modules/geojson-client/default.nix
index 931c7c2917e0..f315d99d8dd8 100644
--- a/pkgs/development/python-modules/geojson-client/default.nix
+++ b/pkgs/development/python-modules/geojson-client/default.nix
@@ -19,8 +19,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "exxamalte";
     repo = "python-geojson-client";
-    rev = "v${version}";
-    sha256 = "sha256-nzM5P1ww6yWM3e2v3hRw0ECoYmRPhTs0Q7Wwicl+IpU=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-nzM5P1ww6yWM3e2v3hRw0ECoYmRPhTs0Q7Wwicl+IpU=";
   };
 
   propagatedBuildInputs = [
@@ -41,6 +41,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python module for convenient access to GeoJSON feeds";
     homepage = "https://github.com/exxamalte/python-geojson-client";
+    changelog = "https://github.com/exxamalte/python-geojson-client/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ asl20 ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-error-reporting/default.nix b/pkgs/development/python-modules/google-cloud-error-reporting/default.nix
index e0b495b92af6..5a062f4a85c2 100644
--- a/pkgs/development/python-modules/google-cloud-error-reporting/default.nix
+++ b/pkgs/development/python-modules/google-cloud-error-reporting/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-error-reporting";
-  version = "1.8.0";
+  version = "1.8.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-XFOgoe6xphHyp/zbd+RR+9dXebMcU7/c2ETFGy+lg3U=";
+    hash = "sha256-Xl+Jc05daQZPh4xggf/JYYlJ5Lx6LafqWhMcVdk/r6o=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-iot/default.nix b/pkgs/development/python-modules/google-cloud-iot/default.nix
index a6d4a1cc9ac8..f3fdc38124aa 100644
--- a/pkgs/development/python-modules/google-cloud-iot/default.nix
+++ b/pkgs/development/python-modules/google-cloud-iot/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-iot";
-  version = "2.8.0";
+  version = "2.8.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-YckGLp3A4rngs/KXOg3/AE4RyboUIoy0NGf44unn/ns=";
+    hash = "sha256-Rh23HbHv1FVmiZtyofv0bktv7tZWN3IS5jQawzbFfRk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-pubsub/default.nix b/pkgs/development/python-modules/google-cloud-pubsub/default.nix
index c3e2f26c92cd..26446cc412e5 100644
--- a/pkgs/development/python-modules/google-cloud-pubsub/default.nix
+++ b/pkgs/development/python-modules/google-cloud-pubsub/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-pubsub";
-  version = "2.13.12";
+  version = "2.14.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-/qa/3RKWC0SDgDeax/CwiZtSc9Nxm1cHJAKT6si2ecw=";
+    hash = "sha256-4nFPB7dQRYvq9bB7Zw6ntgWO4VXAIcmH0LjmpAvzRG8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-secret-manager/default.nix b/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
index 9b043f7e0056..169e3496e779 100644
--- a/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
+++ b/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-secret-manager";
-  version = "2.15.0";
+  version = "2.15.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-KYKs/yUUKmgWxNp+EhD1Wcim/9dajatdl0QW0bZKByg=";
+    hash = "sha256-0ubTvpHT6HfCg5lfdbzAnP77oWPZw2N78qZs6tGim6M=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-tasks/default.nix b/pkgs/development/python-modules/google-cloud-tasks/default.nix
index f391b68aacaa..8751b583729b 100644
--- a/pkgs/development/python-modules/google-cloud-tasks/default.nix
+++ b/pkgs/development/python-modules/google-cloud-tasks/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-tasks";
-  version = "2.12.0";
+  version = "2.12.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-8dhYoj3/EXwMZLRduwskoAn7NSjA4N8xhIw8UbAAhnY=";
+    hash = "sha256-2kRj5zlAPVO2U3EzN+opz5OBtwEru5RqGOXGqLUPaUA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-texttospeech/default.nix b/pkgs/development/python-modules/google-cloud-texttospeech/default.nix
index e086137a0220..3b67f04f6733 100644
--- a/pkgs/development/python-modules/google-cloud-texttospeech/default.nix
+++ b/pkgs/development/python-modules/google-cloud-texttospeech/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-texttospeech";
-  version = "2.14.0";
+  version = "2.14.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-q4OD37ryZqg40L89BNZdLCNeC1QPwVhUaT4S5tO88Jk=";
+    hash = "sha256-3XFvKnaK1nUCz9mbmSXFH/1uFr6TtBCr7v/arBkL/oE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/griffe/default.nix b/pkgs/development/python-modules/griffe/default.nix
index 17e2c06b8d3d..692b2fe6d8e6 100644
--- a/pkgs/development/python-modules/griffe/default.nix
+++ b/pkgs/development/python-modules/griffe/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "griffe";
-  version = "0.25.3";
+  version = "0.25.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "mkdocstrings";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-t36uWIREn01/+dIYP5HYlkSPPjgoZoYbJYnFo3Y6qSw=";
+    hash = "sha256-AZZhwHtVhdHkztzr/Hdi63VC5CjK2Vz8h8zizmSUdNY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/hassil/default.nix b/pkgs/development/python-modules/hassil/default.nix
index c2491134ff4a..52425fe3a614 100644
--- a/pkgs/development/python-modules/hassil/default.nix
+++ b/pkgs/development/python-modules/hassil/default.nix
@@ -16,7 +16,7 @@
 
 let
   pname = "hassil";
-  version = "0.2.4";
+  version = "0.2.5";
 in
 buildPythonPackage {
   inherit pname version;
@@ -24,7 +24,7 @@ buildPythonPackage {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-lgGo3zK1GN3MEOinXuvT5nCc8LBCxAHiW0CZfS8Yy7Y=";
+    hash = "sha256-/KEYTY3Y/KKP/r2OBf3R/jE7Sp/hNygC/Gdzk9XIf/0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/identify/default.nix b/pkgs/development/python-modules/identify/default.nix
index 2488ad04956b..00b6e6ba9aba 100644
--- a/pkgs/development/python-modules/identify/default.nix
+++ b/pkgs/development/python-modules/identify/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "identify";
-  version = "2.5.13";
+  version = "2.5.15";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "pre-commit";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-8QkDAVHjVEqicntSMb98JitmR5toOTGhgEk7cH3xSFI=";
+    sha256 = "sha256-5M51eWdER9/K15H2yUQjvXMjzYNwx9BLIKSW/ToDU5g=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/lupupy/default.nix b/pkgs/development/python-modules/lupupy/default.nix
index ef17ba8f40e3..9f2e31fbc7df 100644
--- a/pkgs/development/python-modules/lupupy/default.nix
+++ b/pkgs/development/python-modules/lupupy/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "lupupy";
-  version = "0.2.4";
+  version = "0.2.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-11BdMhUhxbzkSrBEFdqpjkgcOcCZG498ylEHIMbomW4=";
+    hash = "sha256-SxhGUwcZjaRNCS5dB2hh5uctFGHWuKnM48CcIz6VMh8=";
   };
 
   propagatedBuildInputs = [
@@ -35,6 +35,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python module to control Lupusec alarm control panels";
     homepage = "https://github.com/majuss/lupupy";
+    changelog = "https://github.com/majuss/lupupy/releases/tag/v${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/mkdocstrings/default.nix b/pkgs/development/python-modules/mkdocstrings/default.nix
index 8eca00e712f0..4d367c809d44 100644
--- a/pkgs/development/python-modules/mkdocstrings/default.nix
+++ b/pkgs/development/python-modules/mkdocstrings/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "mkdocstrings";
-  version = "0.19.1";
+  version = "0.20.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -22,10 +22,16 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "mkdocstrings";
     repo = pname;
-    rev = version;
-    sha256 = "sha256-VCWUV+3vXmKbAXImAqY/K4vsA64gHBg83VkxbJua/ao=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-eFHcwbYEIwVWvDJWlmeUvEdqp3NYAF8SgdHJGw6bEMc=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace 'dynamic = ["version"]' 'version = "${version}"' \
+      --replace 'license = "ISC"' 'license = {text = "ISC"}'
+  '';
+
   nativeBuildInputs = [
     pdm-pep517
   ];
@@ -43,12 +49,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'dynamic = ["version"]' 'version = "${version}"' \
-      --replace 'license = "ISC"' 'license = {text = "ISC"}'
-  '';
-
   pythonImportsCheck = [
     "mkdocstrings"
   ];
@@ -58,6 +58,11 @@ buildPythonPackage rec {
     "tests/test_extension.py"
   ];
 
+  disabledTests = [
+    # Not all requirements are available
+    "test_disabling_plugin"
+  ];
+
   meta = with lib; {
     description = "Automatic documentation from sources for MkDocs";
     homepage = "https://github.com/mkdocstrings/mkdocstrings";
diff --git a/pkgs/development/python-modules/openai/default.nix b/pkgs/development/python-modules/openai/default.nix
index cfc719e13666..8aa091a25c71 100644
--- a/pkgs/development/python-modules/openai/default.nix
+++ b/pkgs/development/python-modules/openai/default.nix
@@ -1,12 +1,14 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, aiohttp
 , matplotlib
 , numpy
 , openpyxl
 , pandas
 , pandas-stubs
 , plotly
+, pytest-asyncio
 , pytest-mock
 , pytestCheckHook
 , pythonOlder
@@ -16,11 +18,12 @@
 , tqdm
 , typing-extensions
 , wandb
+, withOptionalDependencies ? false
 }:
 
 buildPythonPackage rec {
   pname = "openai";
-  version = "0.25.0";
+  version = "0.26.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7.1";
@@ -29,29 +32,35 @@ buildPythonPackage rec {
     owner = "openai";
     repo = "openai-python";
     rev = "v${version}";
-    hash = "sha256-bwv7lpdDYlk+y3KBjv7cSvaGr3v02riNCUfPFh6yv1I=";
+    hash = "sha256-M6ZaYTOBAwLogWPafSnBYw3rUry+sS9VwQWAM9tDfr8=";
   };
 
   propagatedBuildInputs = [
-    numpy
-    openpyxl
-    pandas
-    pandas-stubs
+    aiohttp
     requests
     tqdm
+  ] ++ lib.optionals (pythonOlder "3.8") [
     typing-extensions
-  ];
+  ] ++ lib.optionals withOptionalDependencies (builtins.attrValues {
+    inherit (passthru.optional-dependencies) embeddings wandb;
+  });
 
   passthru.optional-dependencies = {
-    wandb = [
-      wandb
+    datalib = [
+      numpy
+      openpyxl
+      pandas
+      pandas-stubs
     ];
     embeddings = [
       matplotlib
       plotly
       scikit-learn
       tenacity
-    ];
+    ] ++ passthru.optional-dependencies.datalib;
+    wandb = [
+      wandb
+    ] ++ passthru.optional-dependencies.datalib;
   };
 
   pythonImportsCheck = [
@@ -60,6 +69,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytestCheckHook
+    pytest-asyncio
     pytest-mock
   ];
 
@@ -72,6 +82,7 @@ buildPythonPackage rec {
   disabledTestPaths = [
     # Requires a real API key
     "openai/tests/test_endpoints.py"
+    "openai/tests/asyncio/test_endpoints.py"
     # openai: command not found
     "openai/tests/test_file_cli.py"
     "openai/tests/test_long_examples_validator.py"
diff --git a/pkgs/development/python-modules/particle/default.nix b/pkgs/development/python-modules/particle/default.nix
index 1564a4c21761..aaa62ada8ba3 100644
--- a/pkgs/development/python-modules/particle/default.nix
+++ b/pkgs/development/python-modules/particle/default.nix
@@ -1,56 +1,66 @@
 { lib
+, attrs
 , buildPythonPackage
 , fetchFromGitHub
 , fetchPypi
-, setuptools-scm
-, attrs
-, deprecated
+, hatch-vcs
+, hatchling
 , hepunits
-, pytestCheckHook
-, tabulate
 , pandas
+, pytestCheckHook
+, pythonOlder
+, setuptools-scm
+, tabulate
 }:
 
 buildPythonPackage rec {
   pname = "particle";
-  version = "0.21.0";
+  version = "0.21.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-SDdIg05+gfLNaQ+glitTf3Z/6K9HBci62mjIu9rIoX0=";
+    hash = "sha256-Mw9IVQoXZU8ByU6OI2Wtmo3PJuVz6KzzH7I+pPYkssQ=";
   };
+
+  postPatch = ''
+    # Disable benchmark tests, so we won't need pytest-benchmark and pytest-cov
+    # as dependencies
+    substituteInPlace pyproject.toml \
+      --replace '"--benchmark-disable",' ""
+  '';
+
   nativeBuildInputs = [
-    setuptools-scm
+    hatch-vcs
+    hatchling
   ];
 
   propagatedBuildInputs = [
     attrs
-    deprecated
     hepunits
   ];
 
-  pythonImportsCheck = [
-    "particle"
-  ];
-
-  preCheck = ''
-    # Disable benchmark tests, so we won't need pytest-benchmark and pytest-cov
-    # as dependencies
-    substituteInPlace pyproject.toml \
-      --replace '"--benchmark-disable", ' ""
-    rm tests/particle/test_performance.py
-  '';
-
   nativeCheckInputs = [
     pytestCheckHook
     tabulate
     pandas
   ];
 
-  meta = {
-    description = "Package to deal with particles, the PDG particle data table, PDGIDs, etc.";
+  pythonImportsCheck = [
+    "particle"
+  ];
+
+  disabledTestPaths = [
+    "tests/particle/test_performance.py"
+  ];
+
+  meta = with lib; {
+    description = "Package to deal with particles, the PDG particle data table and others";
     homepage = "https://github.com/scikit-hep/particle";
-    license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ doronbehar ];
+    changelog = "https://github.com/scikit-hep/particle/releases/tag/v${version}";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ doronbehar ];
   };
 }
diff --git a/pkgs/development/python-modules/peaqevcore/default.nix b/pkgs/development/python-modules/peaqevcore/default.nix
index 94479a12141d..5dd2bf7f7439 100644
--- a/pkgs/development/python-modules/peaqevcore/default.nix
+++ b/pkgs/development/python-modules/peaqevcore/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "peaqevcore";
-  version = "10.2.6";
+  version = "10.2.8";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-uQPz7IB14dFrupZIA87jG5P7USaGKs0WWlgbaLAEPp4=";
+    hash = "sha256-wMC5SnC0KJ6pauvAKq+jTJiFoD0dlYBtxU8cag/JmnM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pip-tools/default.nix b/pkgs/development/python-modules/pip-tools/default.nix
index 48818a594059..406378adddd9 100644
--- a/pkgs/development/python-modules/pip-tools/default.nix
+++ b/pkgs/development/python-modules/pip-tools/default.nix
@@ -17,7 +17,7 @@
 buildPythonPackage rec {
   pname = "pip-tools";
   version = "6.12.1";
-  format = "setuptools";
+  format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
diff --git a/pkgs/development/python-modules/psd-tools/default.nix b/pkgs/development/python-modules/psd-tools/default.nix
index e34359d08231..f0baddf628db 100644
--- a/pkgs/development/python-modules/psd-tools/default.nix
+++ b/pkgs/development/python-modules/psd-tools/default.nix
@@ -1,10 +1,9 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, isPy27
+, pythonOlder
 , docopt
 , pillow
-, enum34
 , scikitimage
 , aggdraw
 , pytestCheckHook
@@ -14,16 +13,21 @@
 
 buildPythonPackage rec {
   pname = "psd-tools";
-  version = "1.9.23";
+  version = "1.9.24";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "psd-tools";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-pJUf5rE5QMnfNytU1P0Zbj1iztrK5xrX4CJ/WvIG8mY=";
+    hash = "sha256-RW8v3UeO2tCjKkCqraFw2IfVt2YL3EbixfGsK7pOQYI=";
   };
 
-  nativeBuildInputs = [ cython ];
+  nativeBuildInputs = [
+    cython
+  ];
 
   propagatedBuildInputs = [
     aggdraw
@@ -33,13 +37,18 @@ buildPythonPackage rec {
     scikitimage
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
-  pythonImportsCheck = [ "psd_tools" ];
+  pythonImportsCheck = [
+    "psd_tools"
+  ];
 
   meta = with lib; {
     description = "Python package for reading Adobe Photoshop PSD files";
     homepage = "https://github.com/kmike/psd-tools";
+    changelog = "https://github.com/psd-tools/psd-tools/blob/v${version}/CHANGES.rst";
     license = licenses.mit;
     maintainers = with maintainers; [ onny ];
   };
diff --git a/pkgs/development/python-modules/pyro4/default.nix b/pkgs/development/python-modules/pyro4/default.nix
index 70aaaa7b4cfb..7b0c8229c899 100644
--- a/pkgs/development/python-modules/pyro4/default.nix
+++ b/pkgs/development/python-modules/pyro4/default.nix
@@ -1,12 +1,12 @@
 { lib
 , buildPythonPackage
-, fetchPypi
-, serpent
-, dill
 , cloudpickle
+, dill
+, fetchPypi
 , msgpack
-, isPy27
 , pytestCheckHook
+, pythonAtLeast
+, serpent
 }:
 
 buildPythonPackage rec {
@@ -14,7 +14,9 @@ buildPythonPackage rec {
   version = "4.82";
   format = "setuptools";
 
-  disabled = isPy27;
+  # No support Python >= 3.11
+  # https://github.com/irmen/Pyro4/issues/246
+  disabled = pythonAtLeast "3.11";
 
   src = fetchPypi {
     pname = "Pyro4";
@@ -37,12 +39,13 @@ buildPythonPackage rec {
   ];
 
   # add testsupport.py to PATH
-  preCheck = "PYTHONPATH=tests/PyroTests:$PYTHONPATH";
+  preCheck = ''
+    PYTHONPATH=tests/PyroTests:$PYTHONPATH
+  '';
 
-
-  pytestFlagsArray = [
+  disabledTestPaths = [
     # ignore network related tests, which fail in sandbox
-    "--ignore=tests/PyroTests/test_naming.py"
+    "tests/PyroTests/test_naming.py"
   ];
 
   disabledTests = [
@@ -61,6 +64,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Distributed object middleware for Python (RPC)";
     homepage = "https://github.com/irmen/Pyro4";
+    changelog = "https://github.com/irmen/Pyro4/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ prusnak ];
   };
diff --git a/pkgs/development/python-modules/pyro5/default.nix b/pkgs/development/python-modules/pyro5/default.nix
index e96952174417..7c469595ab74 100644
--- a/pkgs/development/python-modules/pyro5/default.nix
+++ b/pkgs/development/python-modules/pyro5/default.nix
@@ -1,36 +1,52 @@
-{ buildPythonPackage
-, fetchPypi
-, lib
+{ lib
 , stdenv
+, buildPythonPackage
+, fetchPypi
 , serpent
 , pythonOlder
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
-  pname = "Pyro5";
+  pname = "pyro5";
   version = "5.14";
+  format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
-    inherit pname version;
-    sha256 = "sha256-ZP3OE3sP5TLohhTSRrfJi74KT0JnhsUkU5rNxeaUCGo=";
+    pname = "Pyro5";
+    inherit version;
+    hash = "sha256-ZP3OE3sP5TLohhTSRrfJi74KT0JnhsUkU5rNxeaUCGo=";
   };
 
-  propagatedBuildInputs = [ serpent ];
+  propagatedBuildInputs = [
+    serpent
+  ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
-  # ignore network related tests, which fail in sandbox
-  disabledTests = [ "StartNSfunc" "Broadcast" "GetIP" "TestNameServer" "TestBCSetup" ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+  disabledTests = [
+    # Ignore network related tests, which fail in sandbox
+    "StartNSfunc"
+    "Broadcast"
+    "GetIP"
+    "TestNameServer"
+    "TestBCSetup"
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
     "Socket"
   ];
 
+  pythonImportsCheck = [
+    "Pyro5"
+  ];
+
   meta = with lib; {
     description = "Distributed object middleware for Python (RPC)";
     homepage = "https://github.com/irmen/Pyro5";
+    changelog = "https://github.com/irmen/Pyro5/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ peterhoeg ];
   };
diff --git a/pkgs/development/python-modules/python-redis-lock/default.nix b/pkgs/development/python-modules/python-redis-lock/default.nix
index 263e01bafd78..103349f7b65f 100644
--- a/pkgs/development/python-modules/python-redis-lock/default.nix
+++ b/pkgs/development/python-modules/python-redis-lock/default.nix
@@ -1,28 +1,39 @@
 { lib
 , stdenv
 , buildPythonPackage
+, eventlet
 , fetchPypi
-, redis
-, pytestCheckHook
-, process-tests
+, gevent
 , pkgs
-, withDjango ? false, django-redis
+, process-tests
+, pytestCheckHook
+, pythonOlder
+, redis
+, withDjango ? false
+, django-redis
 }:
 
 buildPythonPackage rec {
   pname = "python-redis-lock";
   version = "4.0.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-Sr0Lz0kTasrWZye/VIbdJJQHjKVeSe+mk/eUB3MZCRo=";
+    hash = "sha256-Sr0Lz0kTasrWZye/VIbdJJQHjKVeSe+mk/eUB3MZCRo=";
   };
 
   propagatedBuildInputs = [
     redis
-  ] ++ lib.optional withDjango django-redis;
+  ] ++ lib.optional withDjango [
+    django-redis
+  ];
 
   nativeCheckInputs = [
+    eventlet
+    gevent
     pytestCheckHook
     process-tests
     pkgs.redis
@@ -37,10 +48,15 @@ buildPythonPackage rec {
     "test_reset_all_signalizes"
   ];
 
+  pythonImportsCheck = [
+    "redis_lock"
+  ];
+
   meta = with lib; {
+    changelog = "https://github.com/ionelmc/python-redis-lock/blob/v${version}/CHANGELOG.rst";
+    description = "Lock context manager implemented via redis SETNX/BLPOP";
     homepage = "https://github.com/ionelmc/python-redis-lock";
     license = licenses.bsd2;
-    description = "Lock context manager implemented via redis SETNX/BLPOP";
     maintainers = with maintainers; [ vanschelven ];
   };
 }
diff --git a/pkgs/development/python-modules/python-stdnum/default.nix b/pkgs/development/python-modules/python-stdnum/default.nix
index 14efde9224b5..19142bc13fb8 100644
--- a/pkgs/development/python-modules/python-stdnum/default.nix
+++ b/pkgs/development/python-modules/python-stdnum/default.nix
@@ -3,6 +3,7 @@
 , fetchPypi
 , pytestCheckHook
 , pythonOlder
+, zeep
 }:
 
 buildPythonPackage rec {
@@ -17,10 +18,21 @@ buildPythonPackage rec {
     hash = "sha256-vMdj2cSa4j2l0remhtX9He7J2QUTQRYKENGscjomvsA=";
   };
 
+  postPatch = ''
+    substituteInPlace setup.cfg \
+      --replace " --cov=stdnum --cov-report=term-missing:skip-covered --cov-report=html" ""
+  '';
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
 
+  passthru.optional-dependencies = {
+    SOAP = [
+      zeep
+    ];
+  };
+
   pythonImportsCheck = [
     "stdnum"
   ];
@@ -28,6 +40,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python module to handle standardized numbers and codes";
     homepage = "https://arthurdejong.org/python-stdnum/";
+    changelog = "https://github.com/arthurdejong/python-stdnum/blob/${version}/ChangeLog";
     license = licenses.lgpl21Plus;
     maintainers = with maintainers; [ johbo ];
   };
diff --git a/pkgs/development/python-modules/pyvicare/default.nix b/pkgs/development/python-modules/pyvicare/default.nix
index b01149da578d..97d2b5a83ba6 100644
--- a/pkgs/development/python-modules/pyvicare/default.nix
+++ b/pkgs/development/python-modules/pyvicare/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pyvicare";
-  version = "2.23.0";
+  version = "2.24.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "somm15";
     repo = "PyViCare";
     rev = version;
-    sha256 = "sha256-EBDk0XuE8zVFoGYbK2LIWeDfsj3iUZUUERNKARKwuKU=";
+    sha256 = "sha256-D0N7kRTzfKCxLNtRJML+xykvsv3Mv0WHdlA05eLHl3M=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/reikna/default.nix b/pkgs/development/python-modules/reikna/default.nix
index a4055fb65f0e..dd75551b34e5 100644
--- a/pkgs/development/python-modules/reikna/default.nix
+++ b/pkgs/development/python-modules/reikna/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "reikna";
-  version = "0.7.6";
+  version = "0.8.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "722fefbd253d0bbcbf5250b7b9c4aca5722cde4ca38bfbf863a551a5fc26edfa";
+    sha256 = "sha256-fpa1Pfo5EAafg7Pgha17G6k5G13fdErjclv0On/uYyI=";
   };
 
   nativeCheckInputs = [ sphinx pytest-cov pytest ];
diff --git a/pkgs/development/python-modules/rich-click/default.nix b/pkgs/development/python-modules/rich-click/default.nix
index 104e5bfb8297..4c4de7f75d8b 100644
--- a/pkgs/development/python-modules/rich-click/default.nix
+++ b/pkgs/development/python-modules/rich-click/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "rich-click";
-  version = "1.6.0";
+  version = "1.6.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "ewels";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-l8tMyxSkh4eckD21NofK9FBgeGKAqZB0J3B98HpWZ0s=";
+    hash = "sha256-Be6okg3zmbdbdlB4/uwioUxn6CZUay/istiIoiFrsJk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/sentry-sdk/default.nix b/pkgs/development/python-modules/sentry-sdk/default.nix
index 07cfdca5c2c5..e01c1828fe60 100644
--- a/pkgs/development/python-modules/sentry-sdk/default.nix
+++ b/pkgs/development/python-modules/sentry-sdk/default.nix
@@ -40,7 +40,7 @@
 
 buildPythonPackage rec {
   pname = "sentry-sdk";
-  version = "1.12.1";
+  version = "1.14.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -49,7 +49,7 @@ buildPythonPackage rec {
     owner = "getsentry";
     repo = "sentry-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-ugCbjhOZTJ1+DeTKDTQJMIO6wjkqVL5tvPGoRrZKwGI=";
+    hash = "sha256-2STQKIAoaGLreGGkqOSrNrByu7j+7oxZihwp9COhuGM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/tensorflow-probability/default.nix b/pkgs/development/python-modules/tensorflow-probability/default.nix
index 819dc0634d4a..6f820298ec13 100644
--- a/pkgs/development/python-modules/tensorflow-probability/default.nix
+++ b/pkgs/development/python-modules/tensorflow-probability/default.nix
@@ -1,5 +1,6 @@
 { lib
 , fetchFromGitHub
+, bazel_3
 , buildBazelPackage
 , buildPythonPackage
 , python
@@ -45,6 +46,8 @@ let
       tensorflow
     ];
 
+    bazel = bazel_3;
+
     bazelTarget = ":pip_pkg";
 
     fetchAttrs = {
diff --git a/pkgs/development/python-modules/tika/default.nix b/pkgs/development/python-modules/tika/default.nix
index 375560ad9817..f71772749c13 100644
--- a/pkgs/development/python-modules/tika/default.nix
+++ b/pkgs/development/python-modules/tika/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "tika";
-  version = "1.24";
+  version = "2.6.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "wsUPQFYi90UxhBEE+ehcF1Ea7eEd6OU4XqsaKaMfGRs=";
+    sha256 = "sha256-VmcOuBKUTrJe1z8bOwdapB56E1t0skCCLyi4GeWzc9o=";
   };
 
   propagatedBuildInputs = [ pyyaml requests ];
diff --git a/pkgs/development/python-modules/tplink-omada-client/default.nix b/pkgs/development/python-modules/tplink-omada-client/default.nix
index 04e7f890bf1c..c51830b7fc7b 100644
--- a/pkgs/development/python-modules/tplink-omada-client/default.nix
+++ b/pkgs/development/python-modules/tplink-omada-client/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "tplink-omada-client";
-  version = "1.0.2";
+  version = "1.1.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "tplink_omada_client";
     inherit version;
-    hash = "sha256-W3WJPYQofNcpW5AyIW3ms6FxQ2yWzocL3nrZGCdm+gk=";
+    hash = "sha256-p58W6PIYdimJz8Cdzv/rr8GRW1wLcb0jnhNxkbuQiBo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/yalexs-ble/default.nix b/pkgs/development/python-modules/yalexs-ble/default.nix
index 9b4d1091843d..3e2de3d2afcd 100644
--- a/pkgs/development/python-modules/yalexs-ble/default.nix
+++ b/pkgs/development/python-modules/yalexs-ble/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "yalexs-ble";
-  version = "1.12.7";
+  version = "1.12.8";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "bdraco";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-f2JrUzgSPbko/H7n6IYiw3nLU9SkIH8BgSEyMlGppok=";
+    hash = "sha256-04Xl2TBs9RL+KWmJgUY+PDoYN4AAvrcWP7TJBEu5lNU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/analysis/dotenv-linter/default.nix b/pkgs/development/tools/analysis/dotenv-linter/default.nix
index fdd4d84673b5..fec39c962a66 100644
--- a/pkgs/development/tools/analysis/dotenv-linter/default.nix
+++ b/pkgs/development/tools/analysis/dotenv-linter/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "dotenv-linter";
-  version = "3.2.0";
+  version = "3.3.0";
 
   src = fetchFromGitHub {
     owner = "dotenv-linter";
     repo = "dotenv-linter";
     rev = "v${version}";
-    sha256 = "sha256-YWL1aPcMdU4lo7h/T2sdl2H6qnx3lfMtV39Ak4yP88w=";
+    sha256 = "sha256-HCP1OUWm/17e73TbinmDxYUi18/KXxppstyUSixjlSo=";
   };
 
-  cargoSha256 = "sha256-q59hpnXc00OzrJk1KOWbIPQYfIE+7ku9XtTDXHgwQBg=";
+  cargoSha256 = "sha256-4r4NTq2rLnpmm/nwxJ9RoN2+JrUI6XKGfYFI78NY710=";
 
   buildInputs = lib.optional stdenv.isDarwin Security;
 
diff --git a/pkgs/development/tools/bingo/default.nix b/pkgs/development/tools/bingo/default.nix
index 0c0d90bb9fc9..f95810fb7718 100644
--- a/pkgs/development/tools/bingo/default.nix
+++ b/pkgs/development/tools/bingo/default.nix
@@ -8,10 +8,10 @@ buildGoModule rec {
     owner = "bwplotka";
     repo = "bingo";
     rev = "v${version}";
-    sha256 = "sha256-s+vdtMzeHUtUlmMlvgnK83RYoMqS3GqrTnu7LssIK6A=";
+    hash = "sha256-s+vdtMzeHUtUlmMlvgnK83RYoMqS3GqrTnu7LssIK6A=";
   };
 
-  vendorSha256 = "sha256-28p1g+p+guJ0x4/5QDGsGN6gDnZkE4AKF/2cFgNjPDM=";
+  vendorHash = "sha256-28p1g+p+guJ0x4/5QDGsGN6gDnZkE4AKF/2cFgNjPDM=";
 
   postPatch = ''
     rm get_e2e_test.go get_e2e_utils_test.go
diff --git a/pkgs/development/tools/cocogitto/default.nix b/pkgs/development/tools/cocogitto/default.nix
index 52fdf0c1e400..af3a32bb9d69 100644
--- a/pkgs/development/tools/cocogitto/default.nix
+++ b/pkgs/development/tools/cocogitto/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cocogitto";
-  version = "5.2.0";
+  version = "5.3.0";
 
   src = fetchFromGitHub {
     owner = "oknozor";
     repo = pname;
     rev = version;
-    sha256 = "sha256-ZjDZMI84z8riRtidZVeCktwJUMkZU28E23MveJSD7xY=";
+    sha256 = "sha256-BqyV4hJw7H9yN5Kj/XwhYS6hElXdKUJEUi5M/PNlPO0=";
   };
 
-  cargoSha256 = "sha256-oaWWAVTKxrshfvqE+HMQ1WeeEz8lOE7qc6RrgSjDtdU=";
+  cargoHash = "sha256-MA3XW2tPn0qVx7ve+UqCoG4nQ7UyuvXEebrPuLKqS4g=";
 
   # Test depend on git configuration that would likly exist in a normal user enviroment
   # and might be failing to create the test repository it works in.
diff --git a/pkgs/development/tools/cue/default.nix b/pkgs/development/tools/cue/default.nix
index d159a329e539..5ef396d38397 100644
--- a/pkgs/development/tools/cue/default.nix
+++ b/pkgs/development/tools/cue/default.nix
@@ -8,7 +8,7 @@ buildGoModule rec {
     owner = "cue-lang";
     repo = "cue";
     rev = "v${version}";
-    sha256 = "sha256-v9MYrijnbtJpTgRZ4hmkaekisOyujldGewCRNbkVzWw=";
+    hash = "sha256-v9MYrijnbtJpTgRZ4hmkaekisOyujldGewCRNbkVzWw=";
   };
 
   postPatch = ''
@@ -16,7 +16,7 @@ buildGoModule rec {
     rm -f cmd/cue/cmd/script_test.go
   '';
 
-  vendorSha256 = "sha256-jTfV8DJlr5LxS3HjOEBkVzBvZKiySrmINumXSUIq2mI=";
+  vendorHash = "sha256-jTfV8DJlr5LxS3HjOEBkVzBvZKiySrmINumXSUIq2mI=";
 
   excludedPackages = [ "internal/ci/updatetxtar" "internal/cmd/embedpkg" "internal/cmd/qgo" "pkg/gen" ];
 
diff --git a/pkgs/development/tools/gojq/default.nix b/pkgs/development/tools/gojq/default.nix
index 177d838ff093..e1690aea4d1f 100644
--- a/pkgs/development/tools/gojq/default.nix
+++ b/pkgs/development/tools/gojq/default.nix
@@ -8,10 +8,10 @@ buildGoModule rec {
     owner = "itchyny";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-xJx3ge+8cIGL1j5vnU4JhCcwmXIRhJ66PYnEG223Fbc=";
+    hash = "sha256-xJx3ge+8cIGL1j5vnU4JhCcwmXIRhJ66PYnEG223Fbc=";
   };
 
-  vendorSha256 = "sha256-BnDtHqqU/kFJyeG1g4UZ51eSnUlbQ6eRKTFoz6kxl0s=";
+  vendorHash = "sha256-BnDtHqqU/kFJyeG1g4UZ51eSnUlbQ6eRKTFoz6kxl0s=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/development/tools/hatch/default.nix b/pkgs/development/tools/hatch/default.nix
index ad4746c48c0c..f7604220f3aa 100644
--- a/pkgs/development/tools/hatch/default.nix
+++ b/pkgs/development/tools/hatch/default.nix
@@ -63,6 +63,9 @@ python3.pkgs.buildPythonApplication rec {
     "test_editable_pth"
     # AssertionError: assert len(extract_installed_requirements(output.splitlines())) > 0
     "test_creation_allow_system_packages"
+  ] ++ lib.optionals stdenv.isDarwin [
+    # https://github.com/NixOS/nixpkgs/issues/209358
+    "test_scripts_no_environment"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/tools/ktlint/default.nix b/pkgs/development/tools/ktlint/default.nix
index e80e4c8b4d44..dbc794e02084 100644
--- a/pkgs/development/tools/ktlint/default.nix
+++ b/pkgs/development/tools/ktlint/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ktlint";
-  version = "0.48.0";
+  version = "0.48.2";
 
   src = fetchurl {
     url = "https://github.com/pinterest/ktlint/releases/download/${version}/ktlint";
-    sha256 = "0sdmfdmxgks9bbzg8nn1gdx55g7qiwpdxkx6p9lwa71mdfc14r2z";
+    sha256 = "0hh3zm21a976px3lhf2przczspiyk88k68fmnwsknn281y9pyr70";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -26,6 +26,7 @@ stdenv.mkDerivation rec {
     homepage = "https://ktlint.github.io/";
     license = licenses.mit;
     platforms = jre_headless.meta.platforms;
+    changelog = "https://github.com/pinterest/ktlint/blob/master/CHANGELOG.md";
     maintainers = with maintainers; [ tadfisher SubhrajyotiSen ];
   };
 }
diff --git a/pkgs/development/tools/kube-linter/default.nix b/pkgs/development/tools/kube-linter/default.nix
index 690095d44fbe..6261cdc1b501 100644
--- a/pkgs/development/tools/kube-linter/default.nix
+++ b/pkgs/development/tools/kube-linter/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kube-linter";
-  version = "0.5.1";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "stackrox";
     repo = pname;
     rev = version;
-    sha256 = "sha256-FEiUnJFmrHj97aSjfJtsjS9Qy4A6mzXicIrJZdgZbag=";
+    sha256 = "sha256-/iwNyThgdXAXu1ulf68+X7nA9wE9jEqN7F5wuT5GMwk=";
   };
 
-  vendorSha256 = "sha256-5dsM5jfD/apRs5NT/XqM8eHEgiyGQHHG3MG6cOFQKr8=";
+  vendorHash = "sha256-jWXR7tHYT15h7QSxinYyPaBs5utUmdeWWm+GPpfwiA4=";
 
   ldflags = [
     "-s" "-w" "-X golang.stackrox.io/kube-linter/internal/version.version=${version}"
diff --git a/pkgs/development/tools/language-servers/millet/default.nix b/pkgs/development/tools/language-servers/millet/default.nix
index 66983ea8a49d..34e8311800e4 100644
--- a/pkgs/development/tools/language-servers/millet/default.nix
+++ b/pkgs/development/tools/language-servers/millet/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "millet";
-  version = "0.7.0";
+  version = "0.7.4";
 
   src = fetchFromGitHub {
     owner = "azdavis";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-qjwnHFJpgDVaiSF3rKkyEbhIG4QbMOUrN1rnc9MnKU0=";
+    hash = "sha256-YTONlTE9cTl0O7EHRVhrPtuGgIUdX8mvdWu352uHbCE=";
   };
 
-  cargoHash = "sha256-efVnO9hNIEiAzOK0mkPMNrWlWHYEWwV2HWac8jBxW5k=";
+  cargoHash = "sha256-U2bbZZCeY7/Jp7AuAKYcZzDIpIxGbNJrmr2Sr2CMr2A=";
 
   postPatch = ''
     rm .cargo/config.toml
diff --git a/pkgs/development/tools/language-servers/sumneko-lua-language-server/default.nix b/pkgs/development/tools/language-servers/sumneko-lua-language-server/default.nix
index 9a372b1c6d7a..24b360a78180 100644
--- a/pkgs/development/tools/language-servers/sumneko-lua-language-server/default.nix
+++ b/pkgs/development/tools/language-servers/sumneko-lua-language-server/default.nix
@@ -4,13 +4,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "sumneko-lua-language-server";
-  version = "3.6.5";
+  version = "3.6.7";
 
   src = fetchFromGitHub {
     owner = "sumneko";
     repo = "lua-language-server";
     rev = version;
-    sha256 = "sha256-4/RRE9IB/qy8YszPzEvrBVLi1X0XCNh+lJYwMXTTD1I=";
+    sha256 = "sha256-x7/yO1rJ+VBG4EFpISYblRECLW2lsLz5wcqLR14UV/g=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/tools/misc/nimlsp/default.nix b/pkgs/development/tools/misc/nimlsp/default.nix
index af4ed6977b19..9c6505b3abd5 100644
--- a/pkgs/development/tools/misc/nimlsp/default.nix
+++ b/pkgs/development/tools/misc/nimlsp/default.nix
@@ -2,17 +2,17 @@
 
 nimPackages.buildNimPackage rec {
   pname = "nimlsp";
-  version = "0.4.1";
+  version = "0.4.4";
   nimBinOnly = true;
 
   src = fetchFromGitHub {
     owner = "PMunch";
     repo = "nimlsp";
     rev = "v${version}";
-    sha256 = "sha256-LAtUGhYEcOwvZzexQ2y3/HPgOge2EsScCbujJ/hz5Ec=";
+    sha256 = "sha256-Z67iKlL+dnRbxdFt/n/fsUcb2wpZwzPpL/G29jfCaMY=";
   };
 
-  buildInputs = with nimPackages; [ jsonschema ];
+  buildInputs = with nimPackages; [ jsonschema asynctools ];
 
   nimFlags = [
     "--threads:on"
diff --git a/pkgs/development/tools/misc/nxpmicro-mfgtools/default.nix b/pkgs/development/tools/misc/nxpmicro-mfgtools/default.nix
index 2106a649775c..6dd504a3cf9e 100644
--- a/pkgs/development/tools/misc/nxpmicro-mfgtools/default.nix
+++ b/pkgs/development/tools/misc/nxpmicro-mfgtools/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nxpmicro-mfgtools";
-  version = "1.4.243";
+  version = "1.5.11";
 
   src = fetchFromGitHub {
     owner = "NXPmicro";
     repo = "mfgtools";
     rev = "uuu_${version}";
-    hash = "sha256-gyy9D6y1y+9GlT3wfW+huoWaZP1e8YzZnc7EbJftppI=";
+    hash = "sha256-RD0haw0C89uvTlLHtvlv1VwU4Jw2U19Caiq+BSfB4hU=";
   };
 
   nativeBuildInputs = [ cmake pkg-config installShellFiles ];
diff --git a/pkgs/development/tools/misc/pkgconf/default.nix b/pkgs/development/tools/misc/pkgconf/default.nix
index 7e7b60de295f..b80def838887 100644
--- a/pkgs/development/tools/misc/pkgconf/default.nix
+++ b/pkgs/development/tools/misc/pkgconf/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pkgconf";
-  version = "1.9.3";
+  version = "1.9.4";
 
   src = fetchurl {
     url = "https://distfiles.dereferenced.org/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-X7NVtIfVT7bTQeTxjU4vfoE6ZiLPA6noev+mpAVlaZ0=";
+    hash = "sha256-2szxu+WjDRSbVWx9L//+r9dte1FOJJJxq91QFTPB2K4=";
   };
 
   outputs = [ "out" "lib" "dev" "man" "doc" ];
diff --git a/pkgs/development/tools/ocaml/ocp-indent/default.nix b/pkgs/development/tools/ocaml/ocp-indent/default.nix
index 29673d99dd0b..aae650fbdc25 100644
--- a/pkgs/development/tools/ocaml/ocp-indent/default.nix
+++ b/pkgs/development/tools/ocaml/ocp-indent/default.nix
@@ -18,7 +18,7 @@ buildDunePackage rec {
   buildInputs = [ cmdliner ];
 
   meta = with lib; {
-    homepage = "http://typerex.ocamlpro.com/ocp-indent.html";
+    homepage = "https://www.typerex.org/ocp-indent.html";
     description = "A customizable tool to indent OCaml code";
     license = licenses.gpl3;
     maintainers = [ maintainers.jirkamarsik ];
diff --git a/pkgs/development/tools/open-policy-agent/default.nix b/pkgs/development/tools/open-policy-agent/default.nix
index f7f0eca56cad..530d349303c7 100644
--- a/pkgs/development/tools/open-policy-agent/default.nix
+++ b/pkgs/development/tools/open-policy-agent/default.nix
@@ -11,15 +11,15 @@ assert enableWasmEval && stdenv.isDarwin -> builtins.throw "building with wasm o
 
 buildGoModule rec {
   pname = "open-policy-agent";
-  version = "0.47.4";
+  version = "0.48.0";
 
   src = fetchFromGitHub {
     owner = "open-policy-agent";
     repo = "opa";
     rev = "v${version}";
-    sha256 = "sha256-EHDSil077g/K8XCWQ9Pry/oyh0Bs3ckS/5Co1z/+Yes=";
+    hash = "sha256-//xwk5T477Ae61MqZCrj8VcG23mqrP04/VVuUwtxyio=";
   };
-  vendorSha256 = null;
+  vendorHash = null;
 
   nativeBuildInputs = [ installShellFiles ];
 
@@ -42,7 +42,7 @@ buildGoModule rec {
     getGoDirs() {
       go list ./... | grep -v -e e2e ${lib.optionalString stdenv.isDarwin "-e wasm"}
     }
-    '' + lib.optionalString stdenv.isDarwin ''
+  '' + lib.optionalString stdenv.isDarwin ''
     # remove tests that have "too many open files"/"no space left on device" issues on darwin in hydra
     rm server/server_test.go
   '';
diff --git a/pkgs/development/tools/pulumictl/default.nix b/pkgs/development/tools/pulumictl/default.nix
index 561187eae0f0..948115c332ed 100644
--- a/pkgs/development/tools/pulumictl/default.nix
+++ b/pkgs/development/tools/pulumictl/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "pulumictl";
-  version = "0.0.39";
+  version = "0.0.41";
 
   src = fetchFromGitHub {
     owner = "pulumi";
     repo = "pulumictl";
     rev = "v${version}";
-    sha256 = "sha256-85a0qW4Fy+ojAhdlRU/m7mkHX91GoZAHlEGPljLAj4c=";
+    sha256 = "sha256-6QBE6+wJ9MQXey9nXaJn69uVUhIVlWMdH9ROiMi7bZk=";
   };
 
   vendorHash = "sha256-WzfTS68YIpoZYbm6i0USxXyEyR4px+hrNRbsCTXdJsk=";
diff --git a/pkgs/development/tools/ruff/default.nix b/pkgs/development/tools/ruff/default.nix
index 8854ee18bf61..fe61330c13a8 100644
--- a/pkgs/development/tools/ruff/default.nix
+++ b/pkgs/development/tools/ruff/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ruff";
-  version = "0.0.230";
+  version = "0.0.233";
 
   src = fetchFromGitHub {
     owner = "charliermarsh";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-40QVmxdEuWQEFCkf8ypEWsH1R6A3WjTXWPC99RnWsgI=";
+    sha256 = "sha256-d+JF5CUswlqx0S3W9W2B2Pgt/hj3hHky1p4OF3eqr84=";
   };
 
-  cargoSha256 = "sha256-ek/+qYOsFhbwWuHn6ezWzsxxeK0umrNAZZVFJl2ya1M=";
+  cargoSha256 = "sha256-ZuBbgf4CYQpN8TgfEnAl54/SnkkbssoCSdB+2ZZPenk=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.CoreServices
diff --git a/pkgs/development/tools/rust/cargo-expand/default.nix b/pkgs/development/tools/rust/cargo-expand/default.nix
index 6112b01e79f4..5e699f9a7b06 100644
--- a/pkgs/development/tools/rust/cargo-expand/default.nix
+++ b/pkgs/development/tools/rust/cargo-expand/default.nix
@@ -1,30 +1,26 @@
 { lib
-, stdenv
 , rustPlatform
 , fetchFromGitHub
-, libiconv
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-expand";
-  version = "1.0.37";
+  version = "1.0.38";
 
   src = fetchFromGitHub {
     owner = "dtolnay";
     repo = pname;
     rev = version;
-    sha256 = "sha256-BdaOtbZ+F1cgoZRmoQM/5Rzx4OUHmqSnsApeNfWz+J8=";
+    sha256 = "sha256-n7GDvniwkyCYiu7/qw0TQsVsTZfjcSpkF2Qo/uO60e4=";
   };
 
-  cargoHash = "sha256-2wD0QJFTW8cIv8S1JSgffBqlcPOVd151WuKlaZF+6aA=";
-
-  buildInputs = lib.optional stdenv.isDarwin libiconv;
+  cargoHash = "sha256-oA+8bceow7Cdao9FhkXkfFyrCpgvR4NJHddevbhUFkA=";
 
   meta = with lib; {
-    description =
-      "A utility and Cargo subcommand designed to let people expand macros in their Rust source code";
+    description = "A utility and Cargo subcommand designed to let people expand macros in their Rust source code";
     homepage = "https://github.com/dtolnay/cargo-expand";
+    changelog = "https://github.com/dtolnay/cargo-expand/releases/tag/${version}";
     license = with licenses; [ mit asl20 ];
-    maintainers = with maintainers; [ xrelkd ];
+    maintainers = with maintainers; [ figsoda xrelkd ];
   };
 }
diff --git a/pkgs/development/tools/rust/cargo-zigbuild/default.nix b/pkgs/development/tools/rust/cargo-zigbuild/default.nix
index 496c8768ed46..7d58d112da31 100644
--- a/pkgs/development/tools/rust/cargo-zigbuild/default.nix
+++ b/pkgs/development/tools/rust/cargo-zigbuild/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-zigbuild";
-  version = "0.14.3";
+  version = "0.14.5";
 
   src = fetchFromGitHub {
     owner = "messense";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-OHr+VCYt+w1VWv6XAfMZv0I7IZJ1m0UtErgMonGytns=";
+    sha256 = "sha256-+H+T/PEpJyRySTJlVGbAevLzAEZs5J8BNqwZjiXhuuU=";
   };
 
-  cargoSha256 = "sha256-tOJNQLPWpCqHCFRk85PW91axUTljo8YoeWUpPrl8P4c=";
+  cargoSha256 = "sha256-IOR/G+SPGl3MgOMjmsVPpvoode8U7K52vqs7yu0BdQk=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/development/tools/rust/rust-analyzer/default.nix b/pkgs/development/tools/rust/rust-analyzer/default.nix
index 05d20447dc59..a90ac2780e8a 100644
--- a/pkgs/development/tools/rust/rust-analyzer/default.nix
+++ b/pkgs/development/tools/rust/rust-analyzer/default.nix
@@ -12,14 +12,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rust-analyzer-unwrapped";
-  version = "2023-01-16";
-  cargoSha256 = "sha256-M0AwSksEUKVw+Eo+D7BnkoKycNRQDOnemIgremXp5fs=";
+  version = "2023-01-23";
+  cargoSha256 = "sha256-NSdHvWN5BIEXZMFiweKYbJayxDqlFmqJp+sIzeORhSU=";
 
   src = fetchFromGitHub {
     owner = "rust-lang";
     repo = "rust-analyzer";
     rev = version;
-    sha256 = "sha256-m+EVsqnYIDdabuIs7K+e343RZ7V3mQHijoYuHWS7Dj4=";
+    sha256 = "sha256-Uq6jngJnf2UqKrOzqMXtq5IVxkU3eNCkmORPdccLxp0=";
   };
 
   auditable = true; # TODO: remove when this is the default
diff --git a/pkgs/development/tools/typos/default.nix b/pkgs/development/tools/typos/default.nix
index a1d6044871cf..1a231575476c 100644
--- a/pkgs/development/tools/typos/default.nix
+++ b/pkgs/development/tools/typos/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "typos";
-  version = "1.13.7";
+  version = "1.13.8";
 
   src = fetchFromGitHub {
     owner = "crate-ci";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-9adccECtWty9GURjzUd6sPYn8qojGWzCrDIpUxswx4k=";
+    hash = "sha256-ROMO6IkfpzFvB5Y4RRqrX5NnYzdHT1tsJBdCc1lDu7k=";
   };
 
-  cargoHash = "sha256-5hg+w2IZOI6d06H7sAokO0v4b6ofxvak64v3he5n4LI=";
+  cargoHash = "sha256-VAVlzciWVKcgl/QKiF3Hfzx11jUi/0J9b6EmaZzG9qE=";
 
   meta = with lib; {
     description = "Source code spell checker";
diff --git a/pkgs/games/ecwolf/default.nix b/pkgs/games/ecwolf/default.nix
index f8ca3b40f532..505c76f38f94 100644
--- a/pkgs/games/ecwolf/default.nix
+++ b/pkgs/games/ecwolf/default.nix
@@ -1,16 +1,32 @@
-{ stdenv, lib, fetchurl, makeDesktopItem, copyDesktopItems, cmake, pkg-config, zlib, bzip2, libjpeg, SDL, SDL_mixer, gtk2 }:
+{ stdenv
+, lib
+, fetchFromBitbucket
+, makeDesktopItem
+, copyDesktopItems
+, cmake
+, pkg-config
+, zlib
+, bzip2
+, libjpeg
+, SDL2
+, SDL2_net
+, SDL2_mixer
+, gtk2
+}:
 
 stdenv.mkDerivation rec {
   pname = "ecwolf";
-  version = "1.3.3";
+  version = "1.4.0";
 
-  src = fetchurl {
-    url = "https://maniacsvault.net/ecwolf/files/ecwolf/1.x/${pname}-${version}-src.tar.xz";
-    sha256 = "1sbdv672dz47la5a5qwmdi1v258k9kc5dkx7cdj2b6gk8nbm2srl";
+  src = fetchFromBitbucket {
+    owner = pname;
+    repo = pname;
+    rev = version;
+    sha256 = "n1G1zvfE1l42fbJ7ZaMdV0QXn45PjMpaaZTDQAOBtYk=";
   };
 
   nativeBuildInputs = [ cmake copyDesktopItems pkg-config ];
-  buildInputs = [ zlib bzip2 libjpeg SDL SDL_mixer gtk2 ];
+  buildInputs = [ zlib bzip2 libjpeg SDL2 SDL2_net SDL2_mixer gtk2 ];
 
   desktopItems = [
     (makeDesktopItem {
@@ -45,6 +61,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
+    broken = stdenv.isDarwin;
     description = "Enhanched SDL-based port of Wolfenstein 3D for various platforms";
     homepage = "https://maniacsvault.net/ecwolf/";
     license = licenses.gpl2Plus;
diff --git a/pkgs/misc/cups/default.nix b/pkgs/misc/cups/default.nix
index 06fdb4d65e72..d9f136f81389 100644
--- a/pkgs/misc/cups/default.nix
+++ b/pkgs/misc/cups/default.nix
@@ -22,10 +22,8 @@
 , nixosTests
 }:
 
-with lib;
 stdenv.mkDerivation rec {
   pname = "cups";
-
   version = "2.4.2";
 
   src = fetchurl {
@@ -48,9 +46,9 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config removeReferencesTo ];
 
   buildInputs = [ zlib libjpeg libpng libtiff libusb1 gnutls libpaper ]
-    ++ optionals stdenv.isLinux [ avahi pam dbus acl ]
-    ++ optional enableSystemd systemd
-    ++ optionals stdenv.isDarwin (with darwin; [
+    ++ lib.optionals stdenv.isLinux [ avahi pam dbus acl ]
+    ++ lib.optional enableSystemd systemd
+    ++ lib.optionals stdenv.isDarwin (with darwin; [
       configd apple_sdk.frameworks.ApplicationServices
     ]);
 
@@ -62,18 +60,18 @@ stdenv.mkDerivation rec {
     "--sysconfdir=/etc"
     "--enable-raw-printing"
     "--enable-threads"
-  ] ++ optionals stdenv.isLinux [
+  ] ++ lib.optionals stdenv.isLinux [
     "--enable-dbus"
     "--enable-pam"
     "--with-dbusdir=${placeholder "out"}/share/dbus-1"
-  ] ++ optional (libusb1 != null) "--enable-libusb"
-    ++ optional (gnutls != null) "--enable-ssl"
-    ++ optional (avahi != null) "--enable-avahi"
-    ++ optional (libpaper != null) "--enable-libpaper";
+  ] ++ lib.optional (libusb1 != null) "--enable-libusb"
+    ++ lib.optional (gnutls != null) "--enable-ssl"
+    ++ lib.optional (avahi != null) "--enable-avahi"
+    ++ lib.optional (libpaper != null) "--enable-libpaper";
 
   # AR has to be an absolute path
   preConfigure = ''
-    export AR="${getBin stdenv.cc.bintools.bintools}/bin/${stdenv.cc.targetPrefix}ar"
+    export AR="${lib.getBin stdenv.cc.bintools.bintools}/bin/${stdenv.cc.targetPrefix}ar"
     configureFlagsArray+=(
       # Put just lib/* and locale into $lib; this didn't work directly.
       # lib/cups is moved back to $out in postInstall.
@@ -84,7 +82,7 @@ stdenv.mkDerivation rec {
 
       "--with-systemd=$out/lib/systemd/system"
 
-      ${optionalString stdenv.isDarwin ''
+      ${lib.optionalString stdenv.isDarwin ''
         "--with-bundledir=$out"
       ''}
     )
@@ -130,7 +128,7 @@ stdenv.mkDerivation rec {
       for f in "$out"/lib/systemd/system/*; do
         substituteInPlace "$f" --replace "$lib/$libexec" "$out/$libexec"
       done
-    '' + optionalString stdenv.isLinux ''
+    '' + lib.optionalString stdenv.isLinux ''
       # Use xdg-open when on Linux
       substituteInPlace "$out"/share/applications/cups.desktop \
         --replace "Exec=htmlview" "Exec=xdg-open"
@@ -138,7 +136,7 @@ stdenv.mkDerivation rec {
 
   passthru.tests.nixos = nixosTests.printing;
 
-  meta = {
+  meta = with lib; {
     homepage = "https://openprinting.github.io/cups/";
     description = "A standards-based printing system for UNIX";
     license = licenses.asl20;
diff --git a/pkgs/misc/dxvk/default.nix b/pkgs/misc/dxvk/default.nix
index b93c46f09100..2c55b6b50cef 100644
--- a/pkgs/misc/dxvk/default.nix
+++ b/pkgs/misc/dxvk/default.nix
@@ -7,7 +7,8 @@
 
 stdenvNoCC.mkDerivation (finalAttrs:
   let
-    inherit (stdenvNoCC.hostPlatform.uname) system;
+    system = lib.toLower stdenvNoCC.targetPlatform.uname.system;
+
     # DXVK needs to be a separate derivation because it’s actually a set of DLLs for Windows that
     # needs to be built with a cross-compiler.
     dxvk32 = pkgsCross.mingw32.callPackage ./dxvk.nix {
diff --git a/pkgs/misc/fastly/default.nix b/pkgs/misc/fastly/default.nix
index 60e5a72e37eb..21b2e3574319 100644
--- a/pkgs/misc/fastly/default.nix
+++ b/pkgs/misc/fastly/default.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "fastly";
-  version = "4.6.2";
+  version = "5.0.0";
 
   src = fetchFromGitHub {
     owner = "fastly";
     repo = "cli";
     rev = "refs/tags/v${version}";
-    hash = "sha256-E91Vg/dPJQwBZar7Wo5IeMlFoI/jwz7ALtv67DW1Rsk=";
+    hash = "sha256-rbb+OtzOZbTYJt4IH1QXKdQ9JevGLEvhcC+F7rW337k=";
     # The git commit is part of the `fastly version` original output;
     # leave that output the same in nixpkgs. Use the `.git` directory
     # to retrieve the commit SHA, and remove the directory afterwards,
@@ -31,7 +31,7 @@ buildGoModule rec {
     "cmd/fastly"
   ];
 
-  vendorHash = "sha256-Gyc0c3RntrWFEqk+AixvXSRRqjr7SEYGeqIJ/ysoFgs=";
+  vendorHash = "sha256-TxF0H1kZSn9VFrR8z5JJwWXCG6Gl8QH88qwQidGY7oc=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/os-specific/linux/fxload/default.nix b/pkgs/os-specific/linux/fxload/default.nix
index 3c5443f3432f..e8b9d0648bd8 100644
--- a/pkgs/os-specific/linux/fxload/default.nix
+++ b/pkgs/os-specific/linux/fxload/default.nix
@@ -15,8 +15,8 @@ stdenv.mkDerivation rec {
 
   # fxload binary exist inside the `examples/bin` directory of `libusb1`
   postFixup = ''
-    mkdir -p $out/sbin
-    ln -s ${passthru.libusb}/examples/bin/fxload $out/sbin/fxload
+    mkdir -p $out/bin
+    ln -s ${passthru.libusb}/examples/bin/fxload $out/bin/fxload
   '';
 
   passthru.libusb = libusb1.override { withExamples = true; };
diff --git a/pkgs/os-specific/linux/rtl8189es/default.nix b/pkgs/os-specific/linux/rtl8189es/default.nix
index f53ed777d08c..e50129f1e2b9 100644
--- a/pkgs/os-specific/linux/rtl8189es/default.nix
+++ b/pkgs/os-specific/linux/rtl8189es/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "rtl8189es-${kernel.version}-${version}";
-  version = "2022-08-30";
+  version = "2022-10-30";
 
   src = fetchFromGitHub {
     owner = "jwrdegoede";
     repo = "rtl8189ES_linux";
-    rev = "c93cfd712a3acd2ecdeda19a66d269c20f8803f1";
-    sha256 = "sha256-bBUxo8lplFwXfsSNf5lz9XCpQ6M0vWelmFoCal95FpI=";
+    rev = "e58bd86c9d9408c648b1246a0dd76b16856ec172";
+    sha256 = "sha256-KKly72N6ACBTB4CSBM6Q/S1wGMTg5NZA3QYslYPNUr8=";
   };
 
   nativeBuildInputs = [ bc nukeReferences ] ++ kernel.moduleBuildDependencies;
diff --git a/pkgs/os-specific/linux/virtio_vmmci/default.nix b/pkgs/os-specific/linux/virtio_vmmci/default.nix
index ccf462702fd3..d18818a10de8 100644
--- a/pkgs/os-specific/linux/virtio_vmmci/default.nix
+++ b/pkgs/os-specific/linux/virtio_vmmci/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "virtio_vmmci";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "voutilad";
     repo = "virtio_vmmci";
     rev = "${version}";
-    sha256 = "104xnpcy5kb4y7ipy1fx1v6byddzs63bv2dqjy3yl23n764fsy43";
+    hash = "sha256-ZHslYYZFjM3wp0W5J3/WwCtQ2wDzT1jNc26Z/giTC8g=";
   };
 
   hardeningDisable = [ "pic" "format" ];
diff --git a/pkgs/os-specific/linux/vmm_clock/default.nix b/pkgs/os-specific/linux/vmm_clock/default.nix
index 853e7765ee23..1a10df62d46d 100644
--- a/pkgs/os-specific/linux/vmm_clock/default.nix
+++ b/pkgs/os-specific/linux/vmm_clock/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "vmm_clock";
-  version = "0.1.0";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "voutilad";
     repo = "vmm_clock";
     rev = "${version}";
-    sha256 = "0hg7ywznh6v11fywsz6f7w298bxph0wwm046zqaqncjvr4aizla4";
+    hash = "sha256-8z/N/dbkeFd40sH7jatNmSS62B88tC0jVgNljhxslOo=";
   };
 
   hardeningDisable = [ "pic" "format" ];
@@ -26,7 +26,6 @@ stdenv.mkDerivation rec {
   ];
 
   meta = with lib; {
-    broken = kernel.kernelOlder "4.19";
     description =
       "Experimental implementation of a kvmclock-derived clocksource for Linux guests under OpenBSD's hypervisor";
     homepage = "https://github.com/voutilad/vmm_clock";
diff --git a/pkgs/servers/bird/default.nix b/pkgs/servers/bird/default.nix
index 03bbafce8d4e..467e3ffe70b9 100644
--- a/pkgs/servers/bird/default.nix
+++ b/pkgs/servers/bird/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bird";
-  version = "2.0.11";
+  version = "2.0.12";
 
   src = fetchurl {
     url = "ftp://bird.network.cz/pub/bird/${pname}-${version}.tar.gz";
-    hash = "sha256-YKe4O2e50InSp0WhH93RJGH2MavHtkW2wIWt+Qs/VdY=";
+    hash = "sha256-PsRiojfQbR9EVdbsAKQvCxaGBh/JiOXImoQdAd11O1M=";
   };
 
   nativeBuildInputs = [ flex bison ];
diff --git a/pkgs/servers/gemini/gmnisrv/default.nix b/pkgs/servers/gemini/gmnisrv/default.nix
index 81e1c17467cc..d37a7247ecf4 100644
--- a/pkgs/servers/gemini/gmnisrv/default.nix
+++ b/pkgs/servers/gemini/gmnisrv/default.nix
@@ -11,6 +11,10 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-V9HXXYQIo3zeqZjJEn+dhemNg6AU+ee3FRmBmXgLuYQ=";
   };
 
+  NIX_CFLAGS_COMPILE = [
+    "-Wno-error=deprecated-declarations"
+  ];
+
   postPatch = ''
     substituteInPlace config.sh \
       --replace "pkg-config" "${stdenv.cc.targetPrefix}pkg-config"
diff --git a/pkgs/servers/http/apache-httpd/2.4.nix b/pkgs/servers/http/apache-httpd/2.4.nix
index ec8b3e5c6fa2..fa20e4605540 100644
--- a/pkgs/servers/http/apache-httpd/2.4.nix
+++ b/pkgs/servers/http/apache-httpd/2.4.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "apache-httpd";
-  version = "2.4.54";
+  version = "2.4.55";
 
   src = fetchurl {
     url = "mirror://apache/httpd/httpd-${version}.tar.bz2";
-    sha256 = "sha256-6zl/7u/MryVPjUXeN2jZ1o6Oc4UcSa/VtxdtHs+Aw0A=";
+    sha256 = "sha256-Eda6GeNsC5PKYuR+b/wtLyiElCaUvODyPznHG9xfaaw=";
   };
 
   # FIXME: -dev depends on -doc
diff --git a/pkgs/servers/hylafaxplus/default.nix b/pkgs/servers/hylafaxplus/default.nix
index 681c7ca7a817..278f0b4c5260 100644
--- a/pkgs/servers/hylafaxplus/default.nix
+++ b/pkgs/servers/hylafaxplus/default.nix
@@ -32,8 +32,8 @@
 let
 
   pname = "hylafaxplus";
-  version = "7.0.6";
-  hash = "sha512-0faeEwF/XQE/85zwUMOnrGzvGanuWRDr53SnrgbX0i/SHjHelzSEd2TK6plVOfV4w8RY7Ox7lSO1gjqEEzfZyw==";
+  version = "7.0.7";
+  hash = "sha512-nUvt+M0HBYN+MsGskuuDt1j0nI5Dk8MbfK/OVxP2FCDby3eiDg0eDtcpIxlOe4o0klko07zDRIb06zqh8ABuKA==";
 
   configSite = substituteAll {
     name = "${pname}-config.site";
@@ -72,16 +72,6 @@ stdenv.mkDerivation {
   patches = [
     # adjust configure check to work with libtiff > 4.1
     ./libtiff-4.patch
-    # fix missing exports in libtiff 4.5+
-    # https://gitlab.com/libtiff/libtiff/-/issues/504
-    # can probably be dropped with next hylafaxplus release
-    (fetchurl {
-      name = "hylafaxplus-7.0.6-tiff-4.5.0.patch";
-      url = "https://dev.gentoo.org/~sam/distfiles/net-misc/hylafaxplus/hylafaxplus-7.0.6-tiff-4.5.0.patch.xz";
-      downloadToTemp = true;
-      postFetch = ''xz -d < $downloadedFile > $out'';
-      hash = "sha256-koZvvzlgZHcANVaYdewnuLARz2TTeyDZRjm0EYWzsmk=";
-    })
   ];
   # Note that `configure` (and maybe `faxsetup`) are looking
   # for a couple of standard binaries in the `PATH` and
diff --git a/pkgs/servers/hylafaxplus/libtiff-4.patch b/pkgs/servers/hylafaxplus/libtiff-4.patch
index c890f317e513..e00d94b5a979 100644
--- a/pkgs/servers/hylafaxplus/libtiff-4.patch
+++ b/pkgs/servers/hylafaxplus/libtiff-4.patch
@@ -5,7 +5,7 @@ https://bugs.gentoo.org/706154
  				echo '#define TIFFSTRIPBYTECOUNTS uint32_t'
  				echo '#define TIFFVERSION TIFF_VERSION'
  				echo '#define TIFFHEADER TIFFHeader';;
--		4.[01234])	tiff_runlen_t="uint32_t"
+-		4.[012345])	tiff_runlen_t="uint32_t"
 +		4.[0-9])	tiff_runlen_t="uint32_t"
  				tiff_offset_t="uint64_t"
  				echo '#define TIFFSTRIPBYTECOUNTS uint64_t'
diff --git a/pkgs/servers/invidious/versions.json b/pkgs/servers/invidious/versions.json
index 005627dd7e9d..c1abe663ea90 100644
--- a/pkgs/servers/invidious/versions.json
+++ b/pkgs/servers/invidious/versions.json
@@ -4,9 +4,9 @@
     "sha256": "sha256-EU6T9yQCdOLx98Io8o01rEsgxDFF/Xoy42LgPopD2/A="
   },
   "invidious": {
-    "rev": "05258d56bdc3f4de1f0da0c0dbd2d540f68cbdd5",
-    "sha256": "sha256-5vA9LCtHgXj7Pn5U/oLDKnwR/ZNtayl2QBA9jkzs98E=",
-    "version": "unstable-2023-01-10"
+    "rev": "dbee027ed9b568469815b319332e029964bff7fb",
+    "sha256": "sha256-M0m3JtA9Qx5ZpgNujeUBC/7TVES9dKLEr5pKgn8l1cM=",
+    "version": "unstable-2023-01-22"
   },
   "lsquic": {
     "sha256": "sha256-hG8cUvhbCNeMOsKkaJlgGpzUrIx47E/WhmPIdI5F3qM=",
diff --git a/pkgs/servers/jackett/default.nix b/pkgs/servers/jackett/default.nix
index a2a2486bc170..a672433583c1 100644
--- a/pkgs/servers/jackett/default.nix
+++ b/pkgs/servers/jackett/default.nix
@@ -9,13 +9,13 @@
 
 buildDotnetModule rec {
   pname = "jackett";
-  version = "0.20.2679";
+  version = "0.20.2688";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha512-uB1gOtalInBOFulmdHvA9ycPt0CvEefXZyGhYwUZ+bjyMaM1T6QcrPeSjuBQ10nIrRmqrXMSZB3cvthSwm+Rrw==";
+    hash = "sha512-e2uJ4uV6e3cwvnt3hw8qAYmUOhoyfX93YEgsV1pT/lZynYS7/FRF2jgo8ZUa1WC8lr/+tBQl+17jkxuQoIT7AA==";
   };
 
   projectFile = "src/Jackett.Server/Jackett.Server.csproj";
diff --git a/pkgs/servers/matrix-synapse/default.nix b/pkgs/servers/matrix-synapse/default.nix
index 18041897f232..9fc2c676b946 100644
--- a/pkgs/servers/matrix-synapse/default.nix
+++ b/pkgs/servers/matrix-synapse/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, python3, openssl, rustPlatform
-, enableSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd, systemd
+, enableSystemd ? lib.meta.availableOn stdenv.hostPlatform python3.pkgs.systemd
 , nixosTests
 , enableRedis ? true
 , callPackage
diff --git a/pkgs/servers/mautrix-facebook/default.nix b/pkgs/servers/mautrix-facebook/default.nix
index fcef839a9ddf..017501ded007 100644
--- a/pkgs/servers/mautrix-facebook/default.nix
+++ b/pkgs/servers/mautrix-facebook/default.nix
@@ -1,10 +1,9 @@
 { lib
 , stdenv
-, systemd
-, enableSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd
 , fetchFromGitHub
 , fetchpatch
 , python3
+, enableSystemd ? lib.meta.availableOn stdenv.hostPlatform python3.pkgs.systemd
 }:
 
 python3.pkgs.buildPythonPackage rec {
diff --git a/pkgs/servers/nfs-ganesha/default.nix b/pkgs/servers/nfs-ganesha/default.nix
index 2ac109cb0dad..560853b5d959 100644
--- a/pkgs/servers/nfs-ganesha/default.nix
+++ b/pkgs/servers/nfs-ganesha/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nfs-ganesha";
-  version = "4.2";
+  version = "4.3";
 
   src = fetchFromGitHub {
     owner = "nfs-ganesha";
     repo = "nfs-ganesha";
     rev = "V${version}";
-    sha256 = "sha256-9Hn1teHo5sHJLYQYM+nAIwq7Gckxl1TCTk/GxLME1qo=";
+    sha256 = "sha256-MafP6kl3SmtT2/vLPDwy8U7+tE6hUBr/lWmiAcjsQNU=";
   };
 
   preConfigure = "cd src";
diff --git a/pkgs/servers/roundcube/default.nix b/pkgs/servers/roundcube/default.nix
index 18856c556772..288aa6f4e78d 100644
--- a/pkgs/servers/roundcube/default.nix
+++ b/pkgs/servers/roundcube/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "roundcube";
-  version = "1.6.0";
+  version = "1.6.1";
 
   src = fetchurl {
     url = "https://github.com/roundcube/roundcubemail/releases/download/${version}/roundcubemail-${version}-complete.tar.gz";
-    sha256 = "sha256-JAnM3+LkZfCGy5/BjIjf4Kr2zMI5JFZJdQYSCZIWlLo=";
+    sha256 = "sha256-RsL2ujS8t+V+R8sDS/M45fx9zO3dqSEqLvO9MUbZe+0=";
   };
 
   patches = [ ./0001-Don-t-resolve-symlinks-when-trying-to-find-INSTALL_P.patch ];
diff --git a/pkgs/servers/sql/postgresql/ext/timescaledb.nix b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
index 52a3ff1b6824..f1756924c154 100644
--- a/pkgs/servers/sql/postgresql/ext/timescaledb.nix
+++ b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation rec {
   pname = "timescaledb";
-  version = "2.9.1";
+  version = "2.9.2";
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ postgresql openssl libkrb5 ];
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     owner = "timescale";
     repo = "timescaledb";
     rev = version;
-    sha256 = "sha256-fvVSxDiGZAewyuQ2vZDb0I6tmlDXl6trjZp8+qDBtb8=";
+    sha256 = "sha256-3n3nqAVow8nIocXPsgCZcNkV+jr/G5/CmnSUfj2WMWo=";
   };
 
   cmakeFlags = [ "-DSEND_TELEMETRY_DEFAULT=OFF" "-DREGRESS_CHECKS=OFF" "-DTAP_CHECKS=OFF" ]
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 113aa9462761..2ee8c070ae19 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -339,6 +339,7 @@ rec {
           '';
           passthru = {
             isLLVM = true;
+            cxxabi = self."${finalLlvmPackages}".libcxxabi;
           };
         };
 
@@ -348,6 +349,9 @@ rec {
             mkdir -p $out/lib
             ln -s ${bootstrapTools}/lib/libc++abi.dylib $out/lib/libc++abi.dylib
           '';
+          passthru = {
+            libName = "c++abi";
+          };
         };
 
         compiler-rt = stdenv.mkDerivation {
diff --git a/pkgs/tools/X11/xpra/default.nix b/pkgs/tools/X11/xpra/default.nix
index 05a36726c0c7..2f793e318088 100644
--- a/pkgs/tools/X11/xpra/default.nix
+++ b/pkgs/tools/X11/xpra/default.nix
@@ -36,8 +36,6 @@
 , xorgserver
 }:
 
-with lib;
-
 let
   inherit (python3.pkgs) cython buildPythonApplication;
 
@@ -206,7 +204,7 @@ in buildPythonApplication rec {
     updateScript = ./update.sh;
   };
 
-  meta = {
+  meta = with lib; {
     homepage = "https://xpra.org/";
     downloadPage = "https://xpra.org/src/";
     description = "Persistent remote applications for X";
diff --git a/pkgs/tools/admin/pulumi-bin/default.nix b/pkgs/tools/admin/pulumi-bin/default.nix
index 71c61d7a0543..9f2f7bd6c71a 100644
--- a/pkgs/tools/admin/pulumi-bin/default.nix
+++ b/pkgs/tools/admin/pulumi-bin/default.nix
@@ -1,7 +1,5 @@
 { lib, stdenv, fetchurl, autoPatchelfHook, makeWrapper, installShellFiles }:
 
-with lib;
-
 let
   data = import ./data.nix {};
 in stdenv.mkDerivation {
@@ -16,7 +14,7 @@ in stdenv.mkDerivation {
 
   installPhase = ''
     install -D -t $out/bin/ *
-  '' + optionalString stdenv.isLinux ''
+  '' + lib.optionalString stdenv.isLinux ''
     wrapProgram $out/bin/pulumi --set LD_LIBRARY_PATH "${stdenv.cc.cc.lib}/lib"
   '' + ''
     installShellCompletion --cmd pulumi \
@@ -25,9 +23,9 @@ in stdenv.mkDerivation {
       --zsh  <($out/bin/pulumi completion zsh)
   '';
 
-  nativeBuildInputs = [ installShellFiles ] ++ optionals stdenv.isLinux [ autoPatchelfHook makeWrapper ];
+  nativeBuildInputs = [ installShellFiles ] ++ lib.optionals stdenv.isLinux [ autoPatchelfHook makeWrapper ];
 
-  meta = {
+  meta = with lib; {
     homepage = "https://pulumi.io/";
     description = "Pulumi is a cloud development platform that makes creating cloud programs easy and productive";
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
diff --git a/pkgs/tools/admin/scaleway-cli/default.nix b/pkgs/tools/admin/scaleway-cli/default.nix
index b570d7134edc..9c4a215dba8b 100644
--- a/pkgs/tools/admin/scaleway-cli/default.nix
+++ b/pkgs/tools/admin/scaleway-cli/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "scaleway-cli";
-  version = "2.9.0";
+  version = "2.10.0";
 
   src = fetchFromGitHub {
     owner = "scaleway";
     repo = "scaleway-cli";
     rev = "v${version}";
-    sha256 = "sha256-Sh7K0PgjX2/vio2E8/qdiP+WC2SoGpS9oU4UizV+sOs=";
+    sha256 = "sha256-Xy4arniOrCln58swFExd0ZoU6wymKYFinReMs7YudeY=";
   };
 
-  vendorHash = "sha256-sYvq502huyCxI4zpPLfPVyyKqTclrfxL9idCGW4Xops=";
+  vendorHash = "sha256-BNiF90jovSyCcRGfv6Kya4fLpqV2VF2Qa3QqdyQio5c=";
 
   ldflags = [
     "-w"
diff --git a/pkgs/tools/admin/tigervnc/default.nix b/pkgs/tools/admin/tigervnc/default.nix
index 724301854b40..e4933986176e 100644
--- a/pkgs/tools/admin/tigervnc/default.nix
+++ b/pkgs/tools/admin/tigervnc/default.nix
@@ -23,8 +23,6 @@
 , nixosTests
 }:
 
-with lib;
-
 stdenv.mkDerivation rec {
   version = "1.12.0";
   pname = "tigervnc";
diff --git a/pkgs/tools/audio/dsp/default.nix b/pkgs/tools/audio/dsp/default.nix
index 01b1ed107be9..57990199dfa8 100644
--- a/pkgs/tools/audio/dsp/default.nix
+++ b/pkgs/tools/audio/dsp/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     owner = "bmc0";
     repo = "dsp";
     rev = "v${version}";
-    sha256 = "sha256-S1pzVQ/ceNsx0vGmzdDWw2TjPVLiRgzR4edFblWsekY=";
+    hash = "sha256-S1pzVQ/ceNsx0vGmzdDWw2TjPVLiRgzR4edFblWsekY=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/tools/backup/bup/default.nix b/pkgs/tools/backup/bup/default.nix
index 072166f7a5b0..86e598ff6008 100644
--- a/pkgs/tools/backup/bup/default.nix
+++ b/pkgs/tools/backup/bup/default.nix
@@ -7,8 +7,6 @@ assert par2Support -> par2cmdline != null;
 
 let version = "0.32"; in
 
-with lib;
-
 stdenv.mkDerivation {
   pname = "bup";
   inherit version;
@@ -31,7 +29,7 @@ stdenv.mkDerivation {
   postPatch = ''
     patchShebangs .
     substituteInPlace Makefile --replace "-Werror" ""
-  '' + optionalString par2Support ''
+  '' + lib.optionalString par2Support ''
     substituteInPlace cmd/fsck-cmd.py --replace "'par2'" "'${par2cmdline}/bin/par2'"
   '';
 
@@ -49,7 +47,7 @@ stdenv.mkDerivation {
       --prefix PATH : ${git}/bin
   '';
 
-  meta = {
+  meta = with lib; {
     homepage = "https://github.com/bup/bup";
     description = "Efficient file backup system based on the git packfile format";
     license = licenses.gpl2Plus;
diff --git a/pkgs/tools/backup/luckybackup/default.nix b/pkgs/tools/backup/luckybackup/default.nix
index ad2e237b3fb7..61c0c186fe27 100644
--- a/pkgs/tools/backup/luckybackup/default.nix
+++ b/pkgs/tools/backup/luckybackup/default.nix
@@ -3,7 +3,6 @@
 , rsync, ssh
 }:
 
-with lib;
 mkDerivation rec {
   pname = "luckybackup";
   version = "0.5.0";
@@ -26,7 +25,7 @@ mkDerivation rec {
     done
   '';
 
-  meta = {
+  meta = with lib; {
     description = "A powerful, fast and reliable backup & sync tool";
     longDescription = ''
       luckyBackup is an application for data back-up and synchronization
diff --git a/pkgs/tools/bluetooth/bluez-alsa/default.nix b/pkgs/tools/bluetooth/bluez-alsa/default.nix
index e10c82d7201a..da87a7b89e5d 100644
--- a/pkgs/tools/bluetooth/bluez-alsa/default.nix
+++ b/pkgs/tools/bluetooth/bluez-alsa/default.nix
@@ -9,8 +9,6 @@
 # TODO: aptxSupport
 }:
 
-with lib;
-
 stdenv.mkDerivation rec {
   pname = "bluez-alsa";
   version = "4.0.0";
@@ -28,7 +26,7 @@ stdenv.mkDerivation rec {
     alsa-lib bluez glib sbc dbus
     readline libbsd ncurses
   ]
-  ++ optional aacSupport fdk_aac;
+  ++ lib.optional aacSupport fdk_aac;
 
   configureFlags = [
     "--with-alsaplugindir=${placeholder "out"}/lib/alsa-lib"
@@ -36,9 +34,9 @@ stdenv.mkDerivation rec {
     "--enable-rfcomm"
     "--enable-hcitop"
   ]
-  ++ optional aacSupport "--enable-aac";
+  ++ lib.optional aacSupport "--enable-aac";
 
-  meta = {
+  meta = with lib; {
     description = "Bluez 5 Bluetooth Audio ALSA Backend";
     longDescription = ''
       Bluez-ALSA (BlueALSA) is an ALSA backend for Bluez 5 audio interface.
diff --git a/pkgs/tools/compression/crabz/default.nix b/pkgs/tools/compression/crabz/default.nix
index 67c4cffbc331..c4d9e06e4c8a 100644
--- a/pkgs/tools/compression/crabz/default.nix
+++ b/pkgs/tools/compression/crabz/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "crabz";
-  version = "0.7.5";
+  version = "0.7.10";
 
   src = fetchFromGitHub {
     owner = "sstadick";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-9PZbrdgHX7zOftecvsyVjYUkBlFEt20lYtLSkFcb8dg=";
+    sha256 = "sha256-A1mjnGnFKgCdwr2J0MBUzpL/UI9nOHDxbrZ9UazqZik=";
   };
 
-  cargoSha256 = "sha256-tT6RCL5pOAMZw7cQr0BCAde9Y/1FeBBLXF6uXfM1I0A=";
+  cargoSha256 = "sha256-YxO0YPY82Q6dXOBs2ZoSAv14p67kNsmhGOiwt+voD5I=";
 
   nativeBuildInputs = [ cmake ];
 
diff --git a/pkgs/tools/filesystems/go-mtpfs/default.nix b/pkgs/tools/filesystems/go-mtpfs/default.nix
index a544fd7b8be3..115928e4979c 100644
--- a/pkgs/tools/filesystems/go-mtpfs/default.nix
+++ b/pkgs/tools/filesystems/go-mtpfs/default.nix
@@ -8,10 +8,10 @@ buildGoModule rec {
     owner = "hanwen";
     repo = "go-mtpfs";
     rev = "v${version}";
-    sha256 = "sha256-HVfB8/MImgZZLx4tcrlYOfQjpAdHMHshEaSsd+n758w=";
+    hash = "sha256-HVfB8/MImgZZLx4tcrlYOfQjpAdHMHshEaSsd+n758w=";
   };
 
-  vendorSha256 = "sha256-OrAEvD2rF0Y0bvCD9TUv/E429lASsvC3uK3qNvbg734=";
+  vendorHash = "sha256-OrAEvD2rF0Y0bvCD9TUv/E429lASsvC3uK3qNvbg734=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/tools/filesystems/squashfuse/default.nix b/pkgs/tools/filesystems/squashfuse/default.nix
index 1b4033ea695b..dba2a474ccc3 100644
--- a/pkgs/tools/filesystems/squashfuse/default.nix
+++ b/pkgs/tools/filesystems/squashfuse/default.nix
@@ -1,8 +1,6 @@
 { lib, stdenv, fetchFromGitHub, autoreconfHook, libtool, fuse,
   pkg-config, lz4, xz, zlib, lzo, zstd }:
 
-with lib;
-
 stdenv.mkDerivation rec {
 
   pname = "squashfuse";
@@ -22,7 +20,7 @@ stdenv.mkDerivation rec {
     description = "FUSE filesystem to mount squashfs archives";
     homepage = "https://github.com/vasi/squashfuse";
     maintainers = [  ];
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
     license = "BSD-2-Clause";
   };
 }
diff --git a/pkgs/tools/games/pokefinder/default.nix b/pkgs/tools/games/pokefinder/default.nix
index 547b0c47bc26..176cdc76ee0f 100644
--- a/pkgs/tools/games/pokefinder/default.nix
+++ b/pkgs/tools/games/pokefinder/default.nix
@@ -26,8 +26,11 @@ stdenv.mkDerivation rec {
     patchShebangs Source/Core/Resources/
   '';
 
-  installPhase = ''
+  installPhase = lib.optionalString (!stdenv.isDarwin) ''
     install -D Source/Forms/PokeFinder $out/bin/PokeFinder
+  '' + lib.optionalString stdenv.isDarwin ''
+    mkdir -p $out/Applications
+    cp -R Source/Forms/PokeFinder.app $out/Applications
   '';
 
   nativeBuildInputs = [ cmake wrapQtAppsHook ];
diff --git a/pkgs/tools/graphics/gifsicle/default.nix b/pkgs/tools/graphics/gifsicle/default.nix
index b200f487b232..c21d51dce605 100644
--- a/pkgs/tools/graphics/gifsicle/default.nix
+++ b/pkgs/tools/graphics/gifsicle/default.nix
@@ -3,8 +3,6 @@
 , static ? stdenv.hostPlatform.isStatic
 }:
 
-with lib;
-
 stdenv.mkDerivation rec {
   pname = "gifsicle";
   version = "1.93";
@@ -14,11 +12,11 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-kvZweXMr9MHaCH5q4JBSBYRuWsd3ulyqZtEqc6qUNEc=";
   };
 
-  buildInputs = optionals gifview [ xorgproto libXt libX11 ];
+  buildInputs = lib.optionals gifview [ xorgproto libXt libX11 ];
 
-  configureFlags = optional (!gifview) "--disable-gifview";
+  configureFlags = lib.optional (!gifview) "--disable-gifview";
 
-  LDFLAGS = optionalString static "-static";
+  LDFLAGS = lib.optionalString static "-static";
 
   doCheck = true;
   checkPhase = ''
@@ -29,7 +27,7 @@ stdenv.mkDerivation rec {
     description = "Command-line tool for creating, editing, and getting information about GIF images and animations";
     homepage = "https://www.lcdf.org/gifsicle/";
     license = lib.licenses.gpl2;
-    platforms = platforms.all;
+    platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ zimbatm ];
   };
 }
diff --git a/pkgs/tools/graphics/ldgallery/viewer/default.nix b/pkgs/tools/graphics/ldgallery/viewer/default.nix
index d1acce2d7f37..bbaed09684eb 100644
--- a/pkgs/tools/graphics/ldgallery/viewer/default.nix
+++ b/pkgs/tools/graphics/ldgallery/viewer/default.nix
@@ -1,7 +1,5 @@
 { lib, stdenv, fetchFromGitHub, pkgs, pandoc, CoreServices }:
 
-with lib;
-
 let
   # Note for maintainers:
   # * keep version in sync with the ldgallery compiler
@@ -21,13 +19,13 @@ let
   nodePkg = nodePackages.package.override {
     src = "${sourcePkg}/viewer";
     postInstall = "npm run build";
-    buildInputs = optionals stdenv.isDarwin [ CoreServices ];
+    buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
   };
 
 in
 
 # making sure that the source and the node package are in sync
-assert versions.majorMinor nodePkg.version == removePrefix "v" sourcePkg.rev;
+assert lib.versions.majorMinor nodePkg.version == lib.removePrefix "v" sourcePkg.rev;
 
 stdenv.mkDerivation {
   pname = nodePkg.packageName;
diff --git a/pkgs/tools/graphics/optipng/default.nix b/pkgs/tools/graphics/optipng/default.nix
index 7b8ddaf713b3..3e9127a9a9ae 100644
--- a/pkgs/tools/graphics/optipng/default.nix
+++ b/pkgs/tools/graphics/optipng/default.nix
@@ -4,8 +4,6 @@
 
 # This package comes with its own copy of zlib, libpng and pngxtern
 
-with lib;
-
 stdenv.mkDerivation rec {
   pname = "optipng";
   version = "0.7.7";
@@ -17,7 +15,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libpng ];
 
-  LDFLAGS = optional static "-static";
+  LDFLAGS = lib.optional static "-static";
   # Workaround for crash in cexcept.h. See
   # https://github.com/NixOS/nixpkgs/issues/28106
   preConfigure = ''
diff --git a/pkgs/tools/graphics/pgf/default.nix b/pkgs/tools/graphics/pgf/default.nix
index 7cac5a8e21bd..a2adb7ee61d9 100644
--- a/pkgs/tools/graphics/pgf/default.nix
+++ b/pkgs/tools/graphics/pgf/default.nix
@@ -1,6 +1,5 @@
 { lib, stdenv, fetchurl, autoconf, automake, libtool, dos2unix, libpgf, freeimage, doxygen }:
 
-with lib;
 stdenv.mkDerivation rec {
   pname = "pgf";
   version = "6.14.12";
diff --git a/pkgs/tools/inputmethods/ibus/default.nix b/pkgs/tools/inputmethods/ibus/default.nix
index 4037868518fe..e3403e334b8b 100644
--- a/pkgs/tools/inputmethods/ibus/default.nix
+++ b/pkgs/tools/inputmethods/ibus/default.nix
@@ -34,8 +34,6 @@
 , nixosTests
 }:
 
-with lib;
-
 let
   python3Runtime = python3.withPackages (ps: with ps; [ pygobject3 ]);
   python3BuildEnv = python3.buildEnv.override {
@@ -88,10 +86,10 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     "--disable-memconf"
-    (enableFeature (dconf != null) "dconf")
-    (enableFeature (libnotify != null) "libnotify")
-    (enableFeature withWayland "wayland")
-    (enableFeature enableUI "ui")
+    (lib.enableFeature (dconf != null) "dconf")
+    (lib.enableFeature (libnotify != null) "libnotify")
+    (lib.enableFeature withWayland "wayland")
+    (lib.enableFeature enableUI "ui")
     "--enable-gtk4"
     "--enable-install-tests"
     "--with-unicode-emoji-dir=${unicode-emoji}/share/unicode/emoji"
@@ -133,7 +131,7 @@ stdenv.mkDerivation rec {
     isocodes
     json-glib
     libnotify
-  ] ++ optionals withWayland [
+  ] ++ lib.optionals withWayland [
     libxkbcommon
     wayland
   ];
@@ -165,7 +163,7 @@ stdenv.mkDerivation rec {
     };
   };
 
-  meta = {
+  meta = with lib; {
     homepage = "https://github.com/ibus/ibus";
     description = "Intelligent Input Bus, input method framework";
     license = licenses.lgpl21Plus;
diff --git a/pkgs/tools/inputmethods/uim/default.nix b/pkgs/tools/inputmethods/uim/default.nix
index e1daecbd10ff..cbc978821a03 100644
--- a/pkgs/tools/inputmethods/uim/default.nix
+++ b/pkgs/tools/inputmethods/uim/default.nix
@@ -18,8 +18,6 @@
 , withMisc ? false, libeb ? null
 }:
 
-with lib;
-
 assert withGtk2 -> gtk2 != null;
 assert withGtk3 -> gtk3 != null;
 
@@ -59,18 +57,18 @@ stdenv.mkDerivation rec {
   buildInputs = [
     ncurses m17n_lib m17n_db expat
   ]
-  ++ optional withAnthy anthy
-  ++ optional withGtk2 gtk2
-  ++ optional withGtk3 gtk3
-  ++ optional withQt4 qt4
-  ++ optionals withQt5 [ qt5.qtbase.bin qt5.qtbase.dev ]
-  ++ optional withLibnotify libnotify
-  ++ optional withSqlite sqlite
-  ++ optionals withNetworking [
+  ++ lib.optional withAnthy anthy
+  ++ lib.optional withGtk2 gtk2
+  ++ lib.optional withGtk3 gtk3
+  ++ lib.optional withQt4 qt4
+  ++ lib.optionals withQt5 [ qt5.qtbase.bin qt5.qtbase.dev ]
+  ++ lib.optional withLibnotify libnotify
+  ++ lib.optional withSqlite sqlite
+  ++ lib.optionals withNetworking [
     curl openssl
   ]
-  ++ optional withFFI libffi
-  ++ optional withMisc libeb;
+  ++ lib.optional withFFI libffi
+  ++ lib.optional withMisc libeb;
 
   prePatch = ''
     patchShebangs *.sh */*.sh */*/*.sh
@@ -113,25 +111,25 @@ stdenv.mkDerivation rec {
     "--with-xft"
     "--with-expat=${expat.dev}"
   ]
-  ++ optional withAnthy "--with-anthy-utf8"
-  ++ optional withGtk2 "--with-gtk2"
-  ++ optional withGtk3 "--with-gtk3"
-  ++ optionals withQt4 [
+  ++ lib.optional withAnthy "--with-anthy-utf8"
+  ++ lib.optional withGtk2 "--with-gtk2"
+  ++ lib.optional withGtk3 "--with-gtk3"
+  ++ lib.optionals withQt4 [
     "--with-qt4"
     "--with-qt4-immodule"
   ]
-  ++ optionals withQt5 [
+  ++ lib.optionals withQt5 [
     "--with-qt5"
     "--with-qt5-immodule"
   ]
-  ++ optional withLibnotify "--enable-notify=libnotify"
-  ++ optional withSqlite "--with-sqlite3"
-  ++ optionals withNetworking [
+  ++ lib.optional withLibnotify "--enable-notify=libnotify"
+  ++ lib.optional withSqlite "--with-sqlite3"
+  ++ lib.optionals withNetworking [
     "--with-curl"
     "--with-openssl-dir=${openssl.dev}"
   ]
-  ++ optional withFFI "--with-ffi"
-  ++ optional withMisc "--with-eb";
+  ++ lib.optional withFFI "--with-ffi"
+  ++ lib.optional withMisc "--with-eb";
 
   # TODO: things in `./configure --help`, but not in nixpkgs
   #--with-canna            Use Canna [default=no]
diff --git a/pkgs/tools/misc/catimg/default.nix b/pkgs/tools/misc/catimg/default.nix
index 3f94a559e612..6230b21c3872 100644
--- a/pkgs/tools/misc/catimg/default.nix
+++ b/pkgs/tools/misc/catimg/default.nix
@@ -1,7 +1,5 @@
 { lib, stdenv, fetchFromGitHub, cmake } :
 
-with lib;
-
 stdenv.mkDerivation rec {
   pname = "catimg";
   version = "2.7.0";
@@ -15,7 +13,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
-  meta = {
+  meta = with lib; {
     license = licenses.mit;
     homepage = "https://github.com/posva/catimg";
     description = "Insanely fast image printing in your terminal";
diff --git a/pkgs/tools/misc/claws/default.nix b/pkgs/tools/misc/claws/default.nix
index 7c2cfecf27a0..7c9a35f1ebce 100644
--- a/pkgs/tools/misc/claws/default.nix
+++ b/pkgs/tools/misc/claws/default.nix
@@ -8,10 +8,10 @@ buildGoModule rec {
     rev = version;
     owner = "thehowl";
     repo = pname;
-    sha256 = "sha256-3zzUBeYfu9x3vRGX1DionLnAs1e44tFj8Z1dpVwjdCg=";
+    hash = "sha256-3zzUBeYfu9x3vRGX1DionLnAs1e44tFj8Z1dpVwjdCg=";
   };
 
-  vendorSha256 = "sha256-FP+3Rw5IdCahhx9giQrpepMMtF1pWcyjNglrlu9ju0Q=";
+  vendorHash = "sha256-FP+3Rw5IdCahhx9giQrpepMMtF1pWcyjNglrlu9ju0Q=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/tools/misc/desktop-file-utils/default.nix b/pkgs/tools/misc/desktop-file-utils/default.nix
index af3e907c04ae..597eced414f6 100644
--- a/pkgs/tools/misc/desktop-file-utils/default.nix
+++ b/pkgs/tools/misc/desktop-file-utils/default.nix
@@ -1,7 +1,5 @@
 { lib, stdenv, fetchurl, pkg-config, meson, ninja, glib, libintl }:
 
-with lib;
-
 stdenv.mkDerivation rec {
   pname = "desktop-file-utils";
   version = "0.26";
@@ -21,7 +19,7 @@ stdenv.mkDerivation rec {
 
   setupHook = ./setup-hook.sh;
 
-  meta = {
+  meta = with lib; {
     homepage = "http://www.freedesktop.org/wiki/Software/desktop-file-utils";
     description = "Command line utilities for working with .desktop files";
     platforms = platforms.linux ++ platforms.darwin;
diff --git a/pkgs/tools/misc/fzf/default.nix b/pkgs/tools/misc/fzf/default.nix
index 8e84b5d6fc7c..fa6df2cebff4 100644
--- a/pkgs/tools/misc/fzf/default.nix
+++ b/pkgs/tools/misc/fzf/default.nix
@@ -2,8 +2,6 @@
 , lib
 , buildGoModule
 , fetchFromGitHub
-, fetchpatch
-, writeText
 , writeShellScriptBin
 , runtimeShell
 , installShellFiles
@@ -26,13 +24,13 @@ let
 in
 buildGoModule rec {
   pname = "fzf";
-  version = "0.36.0";
+  version = "0.37.0";
 
   src = fetchFromGitHub {
     owner = "junegunn";
     repo = pname;
     rev = version;
-    hash = "sha256-1PKu8l4Mx17CpePUE0JEnLPNsUdJ0KvW6Lx6VZM27kI=";
+    hash = "sha256-m+tKNz7tUWkm/Vg9DhcfZyaBgZh+Mcf0mRfc5/SW2Os=";
   };
 
   vendorHash = "sha256-MsMwBBualAwJzCrv/WNBJakv6LcKZYsDUqkNmivUMOQ=";
@@ -47,16 +45,6 @@ buildGoModule rec {
     "-s" "-w" "-X main.version=${version} -X main.revision=${src.rev}"
   ];
 
-  patches = [
-    # fix for test failure on 32-bit platforms
-    # can be removed in the next release of fzf
-    # https://github.com/junegunn/fzf/issues/3127
-    (fetchpatch {
-      url = "https://github.com/junegunn/fzf/commit/aa7361337d3f78ae1e32283ba395446025323abb.patch";
-      hash = "sha256-ZmBdJa7eq9f58f2pL7QrtDSApkQJQBH/Em12J5xk3Q4=";
-    })
-  ];
-
   # The vim plugin expects a relative path to the binary; patch it to abspath.
   postPatch = ''
     sed -i -e "s|expand('<sfile>:h:h')|'$out'|" plugin/fzf.vim
diff --git a/pkgs/tools/misc/grub/2.0x.nix b/pkgs/tools/misc/grub/2.0x.nix
index 8c625df390ad..ca12c1f25887 100644
--- a/pkgs/tools/misc/grub/2.0x.nix
+++ b/pkgs/tools/misc/grub/2.0x.nix
@@ -13,7 +13,6 @@
 , kbdcompSupport ? false, ckbcomp
 }:
 
-with lib;
 let
   pcSystems = {
     i686-linux.target = "i386";
@@ -40,8 +39,8 @@ let
     riscv64-linux.target = "riscv64";
   };
 
-  canEfi = any (system: stdenv.hostPlatform.system == system) (mapAttrsToList (name: _: name) efiSystemsBuild);
-  inPCSystems = any (system: stdenv.hostPlatform.system == system) (mapAttrsToList (name: _: name) pcSystems);
+  canEfi = lib.any (system: stdenv.hostPlatform.system == system) (lib.mapAttrsToList (name: _: name) efiSystemsBuild);
+  inPCSystems = lib.any (system: stdenv.hostPlatform.system == system) (lib.mapAttrsToList (name: _: name) pcSystems);
 
   version = "2.06";
 
@@ -330,8 +329,8 @@ stdenv.mkDerivation rec {
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ bison flex python3 pkg-config gettext freetype autoreconfHook ];
   buildInputs = [ ncurses libusb-compat-0_1 freetype lvm2 fuse libtool bash ]
-    ++ optional doCheck qemu
-    ++ optional zfsSupport zfs;
+    ++ lib.optional doCheck qemu
+    ++ lib.optional zfsSupport zfs;
 
   strictDeps = true;
 
@@ -369,7 +368,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     "--enable-grub-mount" # dep of os-prober
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     # grub doesn't do cross-compilation as usual and tries to use unprefixed
     # tools to target the host. Provide toolchain information explicitly for
     # cross builds.
@@ -380,9 +379,9 @@ stdenv.mkDerivation rec {
     "TARGET_OBJCOPY=${stdenv.cc.targetPrefix}objcopy"
     "TARGET_RANLIB=${stdenv.cc.targetPrefix}ranlib"
     "TARGET_STRIP=${stdenv.cc.targetPrefix}strip"
-  ] ++ optional zfsSupport "--enable-libzfs"
-    ++ optionals efiSupport [ "--with-platform=efi" "--target=${efiSystemsBuild.${stdenv.hostPlatform.system}.target}" "--program-prefix=" ]
-    ++ optionals xenSupport [ "--with-platform=xen" "--target=${efiSystemsBuild.${stdenv.hostPlatform.system}.target}"];
+  ] ++ lib.optional zfsSupport "--enable-libzfs"
+    ++ lib.optionals efiSupport [ "--with-platform=efi" "--target=${efiSystemsBuild.${stdenv.hostPlatform.system}.target}" "--program-prefix=" ]
+    ++ lib.optionals xenSupport [ "--with-platform=xen" "--target=${efiSystemsBuild.${stdenv.hostPlatform.system}.target}"];
 
   # save target that grub is compiled for
   grubTarget = if efiSupport
diff --git a/pkgs/tools/misc/grub/pvgrub_image/default.nix b/pkgs/tools/misc/grub/pvgrub_image/default.nix
index d6aba812405c..3137c820eeac 100644
--- a/pkgs/tools/misc/grub/pvgrub_image/default.nix
+++ b/pkgs/tools/misc/grub/pvgrub_image/default.nix
@@ -1,6 +1,5 @@
 { lib, stdenv, grub2_xen }:
 
-with lib;
 let
   efiSystemsBuild = {
     i686-linux.target = "i386";
diff --git a/pkgs/tools/misc/grub/trusted.nix b/pkgs/tools/misc/grub/trusted.nix
index 4947949ac5bb..2d07932dab2e 100644
--- a/pkgs/tools/misc/grub/trusted.nix
+++ b/pkgs/tools/misc/grub/trusted.nix
@@ -18,14 +18,13 @@
 , for_HP_laptop ? false
 }:
 
-with lib;
 let
   pcSystems = {
     i686-linux.target = "i386";
     x86_64-linux.target = "i386";
   };
 
-  inPCSystems = any (system: stdenv.hostPlatform.system == system) (mapAttrsToList (name: _: name) pcSystems);
+  inPCSystems = lib.any (system: stdenv.hostPlatform.system == system) (lib.mapAttrsToList (name: _: name) pcSystems);
 
   version = if for_HP_laptop then "1.2.1" else "1.2.0";
 
@@ -59,7 +58,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autogen flex bison python2 autoconf automake ];
   buildInputs = [ ncurses libusb-compat-0_1 freetype gettext lvm2 ]
-    ++ optional doCheck qemu;
+    ++ lib.optional doCheck qemu;
 
   hardeningDisable = [ "stackprotector" "pic" ];
 
diff --git a/pkgs/tools/misc/hexd/default.nix b/pkgs/tools/misc/hexd/default.nix
index e3a3f79f3268..510de6a8ee36 100644
--- a/pkgs/tools/misc/hexd/default.nix
+++ b/pkgs/tools/misc/hexd/default.nix
@@ -1,7 +1,5 @@
 { lib, stdenv, fetchFromGitHub }:
 
-with lib;
-
 stdenv.mkDerivation rec {
   pname = "hexd";
   version = "1.1.0";
@@ -15,7 +13,7 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "PREFIX=$(out)" ];
 
-  meta = {
+  meta = with lib; {
     description = "Colourful, human-friendly hexdump tool";
     homepage = "https://github.com/FireyFly/hexd";
     maintainers = [ maintainers.FireyFly ];
diff --git a/pkgs/tools/misc/locate-dominating-file/default.nix b/pkgs/tools/misc/locate-dominating-file/default.nix
new file mode 100644
index 000000000000..8932b6f62259
--- /dev/null
+++ b/pkgs/tools/misc/locate-dominating-file/default.nix
@@ -0,0 +1,56 @@
+{ bats
+, bash
+, fetchFromGitHub
+, lib
+, stdenvNoCC
+, getopt
+}:
+let
+  version = "0.0.1";
+in
+stdenvNoCC.mkDerivation {
+  pname = "locate-dominating-file";
+  inherit version;
+  src = fetchFromGitHub {
+    owner = "roman";
+    repo = "locate-dominating-file";
+    rev = "v${version}";
+    sha256 = "sha256-gwh6fAw7BV7VFIkQN02QIhK47uxpYheMk64UeLyp2IY=";
+  };
+
+  doCheck = true;
+
+  postPatch = ''
+    for file in $(find src tests -type f); do
+      patchShebangs "$file"
+    done
+  '';
+
+  buildInputs = [ getopt ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp src/locate-dominating-file.sh $out/bin/locate-dominating-file
+
+    runHook postInstall
+  '';
+
+  checkInputs = [ (bats.withLibraries (p: [ p.bats-support p.bats-assert ])) ];
+
+  checkPhase = ''
+    runHook preCheck
+
+    bats -t tests
+
+    runHook postCheck
+  '';
+
+  meta = with lib; {
+    description = "Program that looks up in a directory hierarchy for a given filename";
+    license = licenses.mit;
+    maintainers = [ maintainers.roman ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/tools/misc/logstash/6.x.nix b/pkgs/tools/misc/logstash/6.x.nix
index 4de78cf4cbd7..ef5d04ee4765 100644
--- a/pkgs/tools/misc/logstash/6.x.nix
+++ b/pkgs/tools/misc/logstash/6.x.nix
@@ -7,11 +7,9 @@
 , jre
 }:
 
-with lib;
-
 let this = stdenv.mkDerivation rec {
   version = elk6Version;
-  pname = "logstash${optionalString (!enableUnfree) "-oss"}";
+  pname = "logstash${lib.optionalString (!enableUnfree) "-oss"}";
 
   src = fetchurl {
     url = "https://artifacts.elastic.co/downloads/logstash/${pname}-${version}.tar.gz";
@@ -63,7 +61,7 @@ let this = stdenv.mkDerivation rec {
     maintainers = with maintainers; [ wjlroe offline basvandijk ];
   };
   passthru.tests =
-    optionalAttrs (!enableUnfree) (
+    lib.optionalAttrs (!enableUnfree) (
       assert this.drvPath == nixosTests.elk.ELK-6.elkPackages.logstash.drvPath;
       {
         elk = nixosTests.elk.ELK-6;
diff --git a/pkgs/tools/misc/logstash/7.x.nix b/pkgs/tools/misc/logstash/7.x.nix
index 221c7be83dff..cdf810d2a209 100644
--- a/pkgs/tools/misc/logstash/7.x.nix
+++ b/pkgs/tools/misc/logstash/7.x.nix
@@ -9,12 +9,10 @@
 , jre
 }:
 
-with lib;
-
 let
-  info = splitString "-" stdenv.hostPlatform.system;
-  arch = elemAt info 0;
-  plat = elemAt info 1;
+  info = lib.splitString "-" stdenv.hostPlatform.system;
+  arch = lib.elemAt info 0;
+  plat = lib.elemAt info 1;
   shas =
     if enableUnfree
     then {
@@ -29,7 +27,7 @@ let
     };
   this = stdenv.mkDerivation rec {
     version = elk7Version;
-    pname = "logstash${optionalString (!enableUnfree) "-oss"}";
+    pname = "logstash${lib.optionalString (!enableUnfree) "-oss"}";
 
 
     src = fetchurl {
@@ -79,7 +77,7 @@ let
       maintainers = with maintainers; [ wjlroe offline basvandijk ];
     };
     passthru.tests =
-      optionalAttrs (config.allowUnfree && enableUnfree) (
+      lib.optionalAttrs (config.allowUnfree && enableUnfree) (
         assert this.drvPath == nixosTests.elk.unfree.ELK-7.elkPackages.logstash.drvPath;
         {
           elk = nixosTests.elk.unfree.ELK-7;
diff --git a/pkgs/tools/misc/moreutils/default.nix b/pkgs/tools/misc/moreutils/default.nix
index 1f002136ad02..0a7423ec5576 100644
--- a/pkgs/tools/misc/moreutils/default.nix
+++ b/pkgs/tools/misc/moreutils/default.nix
@@ -11,7 +11,6 @@
 , darwin
 }:
 
-with lib;
 stdenv.mkDerivation rec {
   pname = "moreutils";
   version = "0.67";
@@ -28,7 +27,7 @@ stdenv.mkDerivation rec {
 
   strictDeps = true;
   nativeBuildInputs = [ makeWrapper perl libxml2 libxslt docbook-xsl docbook_xml_dtd_44 ];
-  buildInputs = optional stdenv.isDarwin darwin.cctools;
+  buildInputs = lib.optional stdenv.isDarwin darwin.cctools;
 
   propagatedBuildInputs = with perlPackages; [ perl IPCRun TimeDate TimeDuration ];
 
@@ -40,7 +39,7 @@ stdenv.mkDerivation rec {
     wrapProgram $out/bin/ts --prefix PERL5LIB : $PERL5LIB
   '';
 
-  meta = {
+  meta = with lib; {
     description = "Growing collection of the unix tools that nobody thought to write long ago when unix was young";
     homepage = "https://joeyh.name/code/moreutils/";
     maintainers = with maintainers; [ koral pSub ];
diff --git a/pkgs/tools/misc/nurl/default.nix b/pkgs/tools/misc/nurl/default.nix
index ab2b28c52e0c..9154c1eabbe3 100644
--- a/pkgs/tools/misc/nurl/default.nix
+++ b/pkgs/tools/misc/nurl/default.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nurl";
-  version = "0.3.5";
+  version = "0.3.6";
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "nurl";
     rev = "v${version}";
-    hash = "sha256-MPgJIO7pHpXeryJZB/u1iBpBhleKfTWkrArW2L0E4EM=";
+    hash = "sha256-AJHmHTkKHd99GCBlVv2t8Q9kUlCtOcK+ukYzEs5U3S4=";
   };
 
-  cargoSha256 = "sha256-yMWNFY9exmDyqcU2iT9YFAcknYmtbYJ9VhJqlKg+NF4=";
+  cargoSha256 = "sha256-0QUuYNzKN8dbGiJq2JxElR39zIlqvHXjPzT1dGc6cRM=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/tools/misc/phrase-cli/default.nix b/pkgs/tools/misc/phrase-cli/default.nix
index 74aa65002278..f2eafc38472d 100644
--- a/pkgs/tools/misc/phrase-cli/default.nix
+++ b/pkgs/tools/misc/phrase-cli/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "phrase-cli";
-  version = "2.6.2";
+  version = "2.6.4";
 
   src = fetchFromGitHub {
     owner = "phrase";
     repo = "phrase-cli";
     rev = version;
-    sha256 = "sha256-jByxNjz0KwcikOIpyxpswRbH4PFPu7mi9wERLHchPrI=";
+    sha256 = "sha256-9jNRXAP+qNihqr30/dSHqzDkyh+GauafMQBkBit5gmc=";
   };
 
-  vendorHash = "sha256-LlMBV52CG1uYW7I/e0VwoIIr0wk3ysc5gqrAlFRPsvE=";
+  vendorHash = "sha256-zUwp7RqaKtxbTzEOhcmGG/+tqtBKs7cm6+sFNCKET08=";
 
   ldflags = [ "-X=github.com/phrase/phrase-cli/cmd.PHRASE_CLIENT_VERSION=${version}" ];
 
diff --git a/pkgs/tools/misc/pixd/default.nix b/pkgs/tools/misc/pixd/default.nix
index 8152849d9b52..2e8f552e1a81 100644
--- a/pkgs/tools/misc/pixd/default.nix
+++ b/pkgs/tools/misc/pixd/default.nix
@@ -1,7 +1,5 @@
 { lib, stdenv, fetchFromGitHub }:
 
-with lib;
-
 stdenv.mkDerivation rec {
   pname = "pixd";
   version = "1.0.0";
@@ -15,7 +13,7 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "PREFIX=$(out)" ];
 
-  meta = {
+  meta = with lib; {
     description = "Colourful visualization tool for binary files";
     homepage = "https://github.com/FireyFly/pixd";
     maintainers = [ maintainers.FireyFly ];
diff --git a/pkgs/tools/misc/rmlint/default.nix b/pkgs/tools/misc/rmlint/default.nix
index 8211c5aebc77..850bdb83c898 100644
--- a/pkgs/tools/misc/rmlint/default.nix
+++ b/pkgs/tools/misc/rmlint/default.nix
@@ -20,7 +20,6 @@
 
 assert withGui -> !stdenv.isDarwin;
 
-with lib;
 stdenv.mkDerivation rec {
   pname = "rmlint";
   version = "2.10.1";
@@ -78,7 +77,7 @@ stdenv.mkDerivation rec {
     gappsWrapperArgs+=(--prefix PYTHONPATH : "$(toPythonPath $out):$(toPythonPath ${python3.pkgs.pygobject3}):$(toPythonPath ${python3.pkgs.pycairo})")
   '';
 
-  meta = {
+  meta = with lib; {
     description = "Extremely fast tool to remove duplicates and other lint from your filesystem";
     homepage = "https://rmlint.readthedocs.org";
     platforms = platforms.unix;
diff --git a/pkgs/tools/misc/setconf/default.nix b/pkgs/tools/misc/setconf/default.nix
new file mode 100644
index 000000000000..fdb80bfb25ba
--- /dev/null
+++ b/pkgs/tools/misc/setconf/default.nix
@@ -0,0 +1,24 @@
+{ lib
+, buildPythonApplication
+, fetchFromGitHub
+}:
+
+buildPythonApplication rec {
+  pname = "setconf";
+  version = "0.7.7";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "xyproto";
+    repo = "setconf";
+    rev = version;
+    hash = "sha256-HYZdDtDlGrT3zssDdMW3559hhC+cPy8qkmM8d9zEa1A=";
+  };
+
+  meta = {
+    homepage = "https://github.com/xyproto/setconf";
+    description = "A small utility for changing settings in configuration textfiles";
+    changelog = "https://github.com/xyproto/setconf/releases/tag/${version}";
+    maintainers = [ lib.maintainers.AndersonTorres ];
+  };
+}
diff --git a/pkgs/tools/misc/vtm/default.nix b/pkgs/tools/misc/vtm/default.nix
index fb68b5191b2e..fddef03c9cf8 100644
--- a/pkgs/tools/misc/vtm/default.nix
+++ b/pkgs/tools/misc/vtm/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vtm";
-  version = "0.9.8l";
+  version = "0.9.8n";
 
   src = fetchFromGitHub {
     owner = "netxs-group";
     repo = "vtm";
     rev = "v${version}";
-    sha256 = "sha256-6hZvnZXnoS97uQKxBbSJmMN1bGp42p0v4kJH7F+3mjU=";
+    sha256 = "sha256-uH4nyhc3u9yuUZfMJ8rU8cZGtyqMfL+LyNB0/h3X45E=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/tools/networking/dnsmasq/default.nix b/pkgs/tools/networking/dnsmasq/default.nix
index 6d4e28f6cb6b..766bb68e0f7b 100644
--- a/pkgs/tools/networking/dnsmasq/default.nix
+++ b/pkgs/tools/networking/dnsmasq/default.nix
@@ -5,14 +5,13 @@
 , nixosTests
 }:
 
-with lib;
 let
-  copts = concatStringsSep " " ([
+  copts = lib.concatStringsSep " " ([
     "-DHAVE_IDN"
     "-DHAVE_DNSSEC"
-  ] ++ optionals dbusSupport [
+  ] ++ lib.optionals dbusSupport [
     "-DHAVE_DBUS"
-  ] ++ optionals stdenv.isLinux [
+  ] ++ lib.optionals stdenv.isLinux [
     "-DHAVE_CONNTRACK"
   ]);
 in
@@ -43,7 +42,7 @@ stdenv.mkDerivation rec {
 
   hardeningEnable = [ "pie" ];
 
-  postBuild = optionalString stdenv.isLinux ''
+  postBuild = lib.optionalString stdenv.isLinux ''
     make -C contrib/lease-tools
   '';
 
@@ -51,17 +50,17 @@ stdenv.mkDerivation rec {
   # module can create it in Nix-land?
   postInstall = ''
     install -Dm644 trust-anchors.conf $out/share/dnsmasq/trust-anchors.conf
-  '' + optionalString stdenv.isDarwin ''
+  '' + lib.optionalString stdenv.isDarwin ''
     install -Dm644 contrib/MacOSX-launchd/uk.org.thekelleys.dnsmasq.plist \
       $out/Library/LaunchDaemons/uk.org.thekelleys.dnsmasq.plist
     substituteInPlace $out/Library/LaunchDaemons/uk.org.thekelleys.dnsmasq.plist \
       --replace "/usr/local/sbin" "$out/bin"
-  '' + optionalString stdenv.isLinux ''
+  '' + lib.optionalString stdenv.isLinux ''
     install -Dm755 contrib/lease-tools/dhcp_lease_time $out/bin/dhcp_lease_time
     install -Dm755 contrib/lease-tools/dhcp_release $out/bin/dhcp_release
     install -Dm755 contrib/lease-tools/dhcp_release6 $out/bin/dhcp_release6
 
-  '' + optionalString dbusSupport ''
+  '' + lib.optionalString dbusSupport ''
     install -Dm644 dbus/dnsmasq.conf $out/share/dbus-1/system.d/dnsmasq.conf
     mkdir -p $out/share/dbus-1/system-services
     cat <<END > $out/share/dbus-1/system-services/uk.org.thekelleys.dnsmasq.service
@@ -75,8 +74,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ nettle libidn ]
-    ++ optionals dbusSupport [ dbus ]
-    ++ optionals stdenv.isLinux [ libnetfilter_conntrack ];
+    ++ lib.optionals dbusSupport [ dbus ]
+    ++ lib.optionals stdenv.isLinux [ libnetfilter_conntrack ];
 
   passthru.tests = {
     prometheus-exporter = nixosTests.prometheus-exporters.dnsmasq;
@@ -87,7 +86,7 @@ stdenv.mkDerivation rec {
     kubernetes-dns-multi = nixosTests.kubernetes.dns-multi-node;
   };
 
-  meta = {
+  meta = with lib; {
     description = "An integrated DNS, DHCP and TFTP server for small networks";
     homepage = "https://www.thekelleys.org.uk/dnsmasq/doc.html";
     license = licenses.gpl2;
diff --git a/pkgs/tools/networking/eggdrop/default.nix b/pkgs/tools/networking/eggdrop/default.nix
index 9c5c8efa5a72..0f5a2aebc98b 100644
--- a/pkgs/tools/networking/eggdrop/default.nix
+++ b/pkgs/tools/networking/eggdrop/default.nix
@@ -1,14 +1,12 @@
-{ lib, stdenv, fetchFromGitHub, tcl }:
+{ lib, stdenv, fetchurl, tcl }:
 
 stdenv.mkDerivation rec {
   pname = "eggdrop";
-  version = "1.9.3";
+  version = "1.9.4";
 
-  src = fetchFromGitHub {
-    owner = "eggheads";
-    repo = "eggdrop";
-    rev = "v${version}";
-    sha256 = "sha256-BYPDIPn1nuVhnPjs2vZ6KC6pjBVYDWsRjB8c1Z6UUdE=";
+  src = fetchurl {
+    url = "https://ftp.eggheads.org/pub/eggdrop/source/${lib.versions.majorMinor version}/eggdrop-${version}.tar.gz";
+    hash = "sha256-DCh+N+h7XBidScnl2I9cwzhsmMB0MdPmAzgDwYkCltE=";
   };
 
   buildInputs = [ tcl ];
diff --git a/pkgs/tools/networking/flannel/default.nix b/pkgs/tools/networking/flannel/default.nix
index 57e75462e3a6..873afdea2e89 100644
--- a/pkgs/tools/networking/flannel/default.nix
+++ b/pkgs/tools/networking/flannel/default.nix
@@ -1,7 +1,5 @@
 { lib, buildGoModule, fetchFromGitHub, nixosTests }:
 
-with lib;
-
 buildGoModule rec {
   pname = "flannel";
   version = "0.20.2";
@@ -23,7 +21,7 @@ buildGoModule rec {
 
   passthru.tests = { inherit (nixosTests) flannel; };
 
-  meta = {
+  meta = with lib; {
     description = "Network fabric for containers, designed for Kubernetes";
     license = licenses.asl20;
     homepage = "https://github.com/flannel-io/flannel";
diff --git a/pkgs/tools/networking/imapsync/default.nix b/pkgs/tools/networking/imapsync/default.nix
index 5604145a182e..0fb519ad5af7 100644
--- a/pkgs/tools/networking/imapsync/default.nix
+++ b/pkgs/tools/networking/imapsync/default.nix
@@ -65,7 +65,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Mail folder synchronizer between IMAP servers";
     homepage = "https://imapsync.lamiral.info/";
-    license = licenses.wtfpl;
+    license = licenses.nlpl;
     maintainers = with maintainers; [ pSub ];
     platforms = platforms.unix;
   };
diff --git a/pkgs/tools/networking/logmein-hamachi/default.nix b/pkgs/tools/networking/logmein-hamachi/default.nix
index 74d32b452381..30a400df0a1a 100644
--- a/pkgs/tools/networking/logmein-hamachi/default.nix
+++ b/pkgs/tools/networking/logmein-hamachi/default.nix
@@ -1,7 +1,5 @@
 { lib, stdenv, fetchurl }:
 
-with lib;
-
 let
   arch =
     if stdenv.hostPlatform.system == "x86_64-linux" then "x64"
diff --git a/pkgs/tools/networking/nbd/default.nix b/pkgs/tools/networking/nbd/default.nix
index 66b27062043a..c60177065278 100644
--- a/pkgs/tools/networking/nbd/default.nix
+++ b/pkgs/tools/networking/nbd/default.nix
@@ -25,11 +25,6 @@ stdenv.mkDerivation rec {
     test = nixosTests.nbd;
   };
 
-  # Glib calls `clock_gettime', which is in librt. Linking that library
-  # here ensures that a proper rpath is added to the executable so that
-  # it can be loaded at run-time.
-  NIX_LDFLAGS = lib.optionalString stdenv.isLinux "-lrt -lpthread";
-
   meta = {
     homepage = "https://nbd.sourceforge.io/";
     description = "Map arbitrary files as block devices over the network";
diff --git a/pkgs/tools/networking/ndjbdns/default.nix b/pkgs/tools/networking/ndjbdns/default.nix
index ad3bf6752786..6746f456cfe3 100644
--- a/pkgs/tools/networking/ndjbdns/default.nix
+++ b/pkgs/tools/networking/ndjbdns/default.nix
@@ -1,7 +1,5 @@
 { lib, stdenv, fetchFromGitHub, autoreconfHook, systemd, pkg-config }:
 
-with lib;
-
 stdenv.mkDerivation {
   version = "1.06";
   pname = "ndjbdns";
@@ -15,9 +13,9 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
   buildInputs = [ ]
-    ++ optional stdenv.isLinux systemd;
+    ++ lib.optional stdenv.isLinux systemd;
 
-  meta = {
+  meta = with lib; {
     description = "A brand new release of the Djbdns";
     longDescription = ''
       Djbdns is a fully‐fledged Domain Name System(DNS), originally written by the eminent author of qmail, Dr. D J Bernstein.
diff --git a/pkgs/tools/networking/netbird/default.nix b/pkgs/tools/networking/netbird/default.nix
index cc05f5381706..c1becc886a59 100644
--- a/pkgs/tools/networking/netbird/default.nix
+++ b/pkgs/tools/networking/netbird/default.nix
@@ -14,16 +14,16 @@ let
 in
 buildGoModule rec {
   pname = "netbird";
-  version = "0.11.6";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "netbirdio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-q86GVCRppBU9qiCch0sjTnSsjl17xU5l3o72cBF3zZo=";
+    sha256 = "sha256-ajfNHkdYNJCuDhFmww1X0d9F0dmo2/h0GlfLYWvTHKc=";
   };
 
-  vendorSha256 = "sha256-TfHBvcG3e+yjifPVo0ZgcvLvD16fni4m71nCr4cCBD4=";
+  vendorHash = "sha256-3uEcb0nVHrfHZTZ/j/9l6zR1zMfLR0mVaN/Hydyam4Q=";
 
   nativeBuildInputs = [ installShellFiles ] ++ lib.optional ui pkg-config;
 
diff --git a/pkgs/tools/networking/ngrok/default.nix b/pkgs/tools/networking/ngrok/default.nix
index f12ae31a541e..fb1574bfdc1e 100644
--- a/pkgs/tools/networking/ngrok/default.nix
+++ b/pkgs/tools/networking/ngrok/default.nix
@@ -1,7 +1,5 @@
 { lib, stdenv, fetchurl }:
 
-with lib;
-
 let versions = lib.importJSON ./versions.json;
     arch = if stdenv.isi686 then "386"
            else if stdenv.isx86_64 then "amd64"
@@ -37,10 +35,10 @@ stdenv.mkDerivation {
   # Stripping causes SEGFAULT on x86_64-darwin
   dontStrip = true;
 
-  meta = {
+  meta = with lib; {
     description = "Allows you to expose a web server running on your local machine to the internet";
     homepage = "https://ngrok.com/";
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     platforms = [ "i686-linux" "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
     maintainers = with maintainers; [ bobvanderlinden brodes ];
diff --git a/pkgs/tools/networking/openssh/common.nix b/pkgs/tools/networking/openssh/common.nix
index 2f0b36f49728..c1b2199d0f9a 100644
--- a/pkgs/tools/networking/openssh/common.nix
+++ b/pkgs/tools/networking/openssh/common.nix
@@ -30,7 +30,6 @@
 , linkOpenssl ? true
 }:
 
-with lib;
 stdenv.mkDerivation rec {
   inherit pname version src;
 
@@ -57,12 +56,12 @@ stdenv.mkDerivation rec {
     # This is not the same as the libkrb5 from the inputs! pkgs.libkrb5 is
     # needed here to access krb5-config in order to cross compile. See:
     # https://github.com/NixOS/nixpkgs/pull/107606
-    ++ optional withKerberos pkgs.libkrb5
+    ++ lib.optional withKerberos pkgs.libkrb5
     ++ extraNativeBuildInputs;
   buildInputs = [ zlib openssl libedit ]
-    ++ optional withFIDO libfido2
-    ++ optional withKerberos libkrb5
-    ++ optional stdenv.isLinux pam;
+    ++ lib.optional withFIDO libfido2
+    ++ lib.optional withKerberos libkrb5
+    ++ lib.optional stdenv.isLinux pam;
 
   preConfigure = ''
     # Setting LD causes `configure' and `make' to disagree about which linker
@@ -80,11 +79,11 @@ stdenv.mkDerivation rec {
     "--with-libedit=yes"
     "--disable-strip"
     (if stdenv.isLinux then "--with-pam" else "--without-pam")
-  ] ++ optional (etcDir != null) "--sysconfdir=${etcDir}"
-    ++ optional withFIDO "--with-security-key-builtin=yes"
-    ++ optional withKerberos (assert libkrb5 != null; "--with-kerberos5=${libkrb5}")
-    ++ optional stdenv.isDarwin "--disable-libutil"
-    ++ optional (!linkOpenssl) "--without-openssl"
+  ] ++ lib.optional (etcDir != null) "--sysconfdir=${etcDir}"
+    ++ lib.optional withFIDO "--with-security-key-builtin=yes"
+    ++ lib.optional withKerberos (assert libkrb5 != null; "--with-kerberos5=${libkrb5}")
+    ++ lib.optional stdenv.isDarwin "--disable-libutil"
+    ++ lib.optional (!linkOpenssl) "--without-openssl"
     ++ extraConfigureFlags;
 
   ${if stdenv.hostPlatform.isStatic then "NIX_LDFLAGS" else null}= [ "-laudit" ] ++ lib.optionals withKerberos [ "-lkeyutils" ];
@@ -97,7 +96,7 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
   enableParallelChecking = false;
-  nativeCheckInputs = optional (!stdenv.isDarwin) hostname;
+  nativeCheckInputs = lib.optional (!stdenv.isDarwin) hostname;
   preCheck = lib.optionalString (stdenv.hostPlatform == stdenv.buildPlatform) ''
     # construct a dummy HOME
     export HOME=$(realpath ../dummy-home)
@@ -145,7 +144,7 @@ stdenv.mkDerivation rec {
   # integration tests hard to get working on darwin with its shaky
   # sandbox
   # t-exec tests fail on musl
-  checkTarget = optional (!stdenv.isDarwin && !stdenv.hostPlatform.isMusl) "t-exec"
+  checkTarget = lib.optional (!stdenv.isDarwin && !stdenv.hostPlatform.isMusl) "t-exec"
     # other tests are less demanding of the environment
     ++ [ "unit" "file-tests" "interop-tests" ];
 
@@ -165,7 +164,7 @@ stdenv.mkDerivation rec {
     borgbackup-integration = nixosTests.borgbackup;
   };
 
-  meta = {
+  meta = with lib; {
     description = "An implementation of the SSH protocol${extraDesc}";
     homepage = "https://www.openssh.com/";
     changelog = "https://www.openssh.com/releasenotes.html";
diff --git a/pkgs/tools/networking/snabb/default.nix b/pkgs/tools/networking/snabb/default.nix
index 97d9ff33ddfc..f58fd9a998b1 100644
--- a/pkgs/tools/networking/snabb/default.nix
+++ b/pkgs/tools/networking/snabb/default.nix
@@ -3,8 +3,6 @@
 , fetchFromGitHub
 }:
 
-with lib;
-
 stdenv.mkDerivation rec {
   pname = "snabb";
   version = "2022.10";
@@ -21,7 +19,7 @@ stdenv.mkDerivation rec {
     cp src/snabb $out/bin
   '';
 
-  meta = {
+  meta = with lib; {
     homepage = "https://github.com/SnabbCo/snabbswitch";
     description = "Simple and fast packet networking toolkit";
     longDescription = ''
diff --git a/pkgs/tools/networking/strongswan/default.nix b/pkgs/tools/networking/strongswan/default.nix
index 119f81baf5cb..40d2b68c449d 100644
--- a/pkgs/tools/networking/strongswan/default.nix
+++ b/pkgs/tools/networking/strongswan/default.nix
@@ -14,8 +14,6 @@
 # strongswan curl plugin may break.
 # See https://wiki.strongswan.org/projects/strongswan/wiki/Curl for more info.
 
-with lib;
-
 stdenv.mkDerivation rec {
   pname = "strongswan";
   version = "5.9.8"; # Make sure to also update <nixpkgs/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix> when upgrading!
@@ -32,10 +30,10 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config autoreconfHook perl gperf bison flex ];
   buildInputs =
     [ curl gmp python3 ldns unbound openssl pcsclite ]
-    ++ optionals enableTNC [ trousers sqlite libxml2 ]
-    ++ optionals stdenv.isLinux [ systemd.dev pam iptables ]
-    ++ optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ SystemConfiguration ])
-    ++ optionals enableNetworkManager [ networkmanager glib ];
+    ++ lib.optionals enableTNC [ trousers sqlite libxml2 ]
+    ++ lib.optionals stdenv.isLinux [ systemd.dev pam iptables ]
+    ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ SystemConfiguration ])
+    ++ lib.optionals enableNetworkManager [ networkmanager glib ];
 
   patches = [
     ./ext_auth-path.patch
@@ -43,7 +41,7 @@ stdenv.mkDerivation rec {
     ./updown-path.patch
   ];
 
-  postPatch = optionalString stdenv.isLinux ''
+  postPatch = lib.optionalString stdenv.isLinux ''
     # glibc-2.26 reorganized internal includes
     sed '1i#include <stdint.h>' -i src/libstrongswan/utils/utils/memory.h
 
@@ -62,16 +60,16 @@ stdenv.mkDerivation rec {
       "--enable-pkcs11" "--enable-eap-sim-pcsc" "--enable-dnscert" "--enable-unbound"
       "--enable-chapoly"
       "--enable-curl" ]
-    ++ optionals stdenv.isLinux [
+    ++ lib.optionals stdenv.isLinux [
       "--enable-farp" "--enable-dhcp"
       "--enable-systemd" "--with-systemdsystemunitdir=${placeholder "out"}/etc/systemd/system"
       "--enable-xauth-pam"
       "--enable-forecast"
       "--enable-connmark"
       "--enable-af-alg" ]
-    ++ optionals stdenv.isx86_64 [ "--enable-aesni" "--enable-rdrand" ]
-    ++ optional (stdenv.hostPlatform.system == "i686-linux") "--enable-padlock"
-    ++ optionals enableTNC [
+    ++ lib.optionals stdenv.isx86_64 [ "--enable-aesni" "--enable-rdrand" ]
+    ++ lib.optional (stdenv.hostPlatform.system == "i686-linux") "--enable-padlock"
+    ++ lib.optionals enableTNC [
          "--disable-gmp" "--disable-aes" "--disable-md5" "--disable-sha1" "--disable-sha2" "--disable-fips-prf"
          "--enable-eap-tnc" "--enable-eap-ttls" "--enable-eap-dynamic" "--enable-tnccs-20"
          "--enable-tnc-imc" "--enable-imc-os" "--enable-imc-attestation"
@@ -80,11 +78,11 @@ stdenv.mkDerivation rec {
          "--with-tss=trousers"
          "--enable-aikgen"
          "--enable-sqlite" ]
-    ++ optionals enableNetworkManager [
+    ++ lib.optionals enableNetworkManager [
          "--enable-nm"
          "--with-nm-ca-dir=/etc/ssl/certs" ]
     # Taken from: https://wiki.strongswan.org/projects/strongswan/wiki/MacOSX
-    ++ optionals stdenv.isDarwin [
+    ++ lib.optionals stdenv.isDarwin [
       "--disable-systemd"
       "--disable-xauth-pam"
       "--disable-kernel-netlink"
@@ -100,11 +98,11 @@ stdenv.mkDerivation rec {
     echo "include /etc/ipsec.secrets" >> $out/etc/ipsec.secrets
   '';
 
-  NIX_LDFLAGS = optionalString stdenv.cc.isGNU "-lgcc_s" ;
+  NIX_LDFLAGS = lib.optionalString stdenv.cc.isGNU "-lgcc_s" ;
 
   passthru.tests = { inherit (nixosTests) strongswan-swanctl; };
 
-  meta = {
+  meta = with lib; {
     description = "OpenSource IPsec-based VPN Solution";
     homepage = "https://www.strongswan.org";
     license = licenses.gpl2Plus;
diff --git a/pkgs/tools/package-management/nix-serve/default.nix b/pkgs/tools/package-management/nix-serve/default.nix
index d9faea9cea4d..20f374b8d108 100644
--- a/pkgs/tools/package-management/nix-serve/default.nix
+++ b/pkgs/tools/package-management/nix-serve/default.nix
@@ -8,8 +8,6 @@
 , nixosTests
 }:
 
-with lib;
-
 let
   rev = "e4675e38ab54942e351c7686e40fabec822120b9";
   sha256 = "1wm24p6pkxl1d7hrvf4ph6mwzawvqi22c60z9xzndn5xfyr4v0yr";
@@ -17,7 +15,7 @@ in
 
 stdenv.mkDerivation {
   pname = "nix-serve";
-  version = "0.2-${substring 0 7 rev}";
+  version = "0.2-${lib.substring 0 7 rev}";
 
   src = fetchFromGitHub {
     owner = "edolstra";
@@ -33,7 +31,7 @@ stdenv.mkDerivation {
     install -Dm0755 nix-serve.psgi $out/libexec/nix-serve/nix-serve.psgi
 
     makeWrapper ${perl.withPackages(p: [ p.DBDSQLite p.Plack p.Starman nix.perl-bindings ])}/bin/starman $out/bin/nix-serve \
-                --prefix PATH : "${makeBinPath [ bzip2 nix ]}" \
+                --prefix PATH : "${lib.makeBinPath [ bzip2 nix ]}" \
                 --add-flags $out/libexec/nix-serve/nix-serve.psgi
   '';
 
@@ -42,7 +40,7 @@ stdenv.mkDerivation {
     nix-serve-ssh = nixosTests.nix-serve-ssh;
   };
 
-  meta = {
+  meta = with lib; {
     homepage = "https://github.com/edolstra/nix-serve";
     description = "A utility for sharing a Nix store as a binary cache";
     maintainers = [ maintainers.eelco ];
diff --git a/pkgs/tools/package-management/nix-update/default.nix b/pkgs/tools/package-management/nix-update/default.nix
index 792780f9f2f1..2e20f1ad3dc2 100644
--- a/pkgs/tools/package-management/nix-update/default.nix
+++ b/pkgs/tools/package-management/nix-update/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonApplication rec {
   pname = "nix-update";
-  version = "0.13.0";
+  version = "0.14.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "Mic92";
     repo = pname;
     rev = version;
-    sha256 = "sha256-7kIHMGtsbC7CIlJPA7F1HwAXlqHf61mfjvnvA/v1Uno=";
+    sha256 = "sha256-7HZ5LEQAhA1TXQZVfeUGOruwgqJBkSFtmDLR8PLSiOw=";
   };
 
   makeWrapperArgs = [
diff --git a/pkgs/tools/package-management/poetry/default.nix b/pkgs/tools/package-management/poetry/default.nix
index c6f4c24ed718..069b6f24eaa5 100644
--- a/pkgs/tools/package-management/poetry/default.nix
+++ b/pkgs/tools/package-management/poetry/default.nix
@@ -6,7 +6,18 @@
 }:
 
 let
-  python = python3;
+  python = python3.override {
+    packageOverrides = self: super: {
+      dulwich = super.dulwich.overridePythonAttrs (old: rec {
+        version = "0.20.50";
+        src = self.fetchPypi {
+          inherit (old) pname;
+          inherit version;
+          hash = "sha256-UKlBeWssZ1vjm+co1UDBa1t853654bP4VWUOzmgy0r4=";
+        };
+      });
+    };
+  };
 in python.pkgs.buildPythonApplication rec {
   pname = "poetry";
   version = "1.3.2";
diff --git a/pkgs/tools/security/afl/qemu.nix b/pkgs/tools/security/afl/qemu.nix
index e33c4c2fb03a..9a8b4b3ca364 100644
--- a/pkgs/tools/security/afl/qemu.nix
+++ b/pkgs/tools/security/afl/qemu.nix
@@ -2,8 +2,6 @@
 , texinfo, libuuid, flex, bison, pixman, autoconf
 }:
 
-with lib;
-
 let
   cpuTarget = if stdenv.hostPlatform.system == "x86_64-linux" then "x86_64-linux-user"
     else if stdenv.hostPlatform.system == "i686-linux" then "i386-linux-user"
diff --git a/pkgs/tools/security/aflplusplus/qemu.nix b/pkgs/tools/security/aflplusplus/qemu.nix
index 1fb613aef2e2..cfcaece232c6 100644
--- a/pkgs/tools/security/aflplusplus/qemu.nix
+++ b/pkgs/tools/security/aflplusplus/qemu.nix
@@ -2,8 +2,6 @@
 , texinfo, libuuid, flex, bison, pixman, autoconf
 }:
 
-with lib;
-
 let
   qemuName = "qemu-3.1.0";
   cpuTarget = if stdenv.targetPlatform.system == "x86_64-linux" then "x86_64-linux-user"
diff --git a/pkgs/tools/security/b2sum/default.nix b/pkgs/tools/security/b2sum/default.nix
index c209fa82edb6..2b08da598fa3 100644
--- a/pkgs/tools/security/b2sum/default.nix
+++ b/pkgs/tools/security/b2sum/default.nix
@@ -1,7 +1,5 @@
 { lib, stdenv, fetchFromGitHub, openmp ? null }:
 
-with lib;
-
 stdenv.mkDerivation (finalAttrs: {
   pname = "b2sum";
   version = "20190724";
@@ -24,10 +22,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [ openmp ];
 
-  buildFlags = [ (optional (openmp == null) "NO_OPENMP=1") ];
+  buildFlags = [ (lib.optional (openmp == null) "NO_OPENMP=1") ];
   installFlags = [ "PREFIX=$(out)" ];
 
-  meta = {
+  meta = with lib; {
     description = "The b2sum utility is similar to the md5sum or shasum utilities but for BLAKE2";
     homepage = "https://blake2.net";
     license = with licenses; [ asl20 cc0 openssl ];
diff --git a/pkgs/tools/security/commix/default.nix b/pkgs/tools/security/commix/default.nix
index b2632c2d42ed..3b2ba60291dc 100644
--- a/pkgs/tools/security/commix/default.nix
+++ b/pkgs/tools/security/commix/default.nix
@@ -15,12 +15,19 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-QdhJp7oUqOY8Z36haIrHgP4hVGaFXlOxNVg1ams7uhg=";
   };
 
+  postInstall = ''
+    # Helper files are not handled by setup.py
+    mkdir -p $out/${python3.sitePackages}/src/txt
+    install -vD src/txt/* $out/${python3.sitePackages}/src/txt/
+  '';
+
   # Project has no tests
   doCheck = false;
 
   meta = with lib; {
     description = "Automated Command Injection Exploitation Tool";
     homepage = "https://github.com/commixproject/commix";
+    changelog = "https://github.com/commixproject/commix/releases/tag/v${version}";
     license = with licenses; [ gpl3Plus ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/tools/security/john/default.nix b/pkgs/tools/security/john/default.nix
index 8409bd8d2bc3..745b027a057e 100644
--- a/pkgs/tools/security/john/default.nix
+++ b/pkgs/tools/security/john/default.nix
@@ -2,8 +2,6 @@
 , gcc, python3Packages, perl, perlPackages, makeWrapper, fetchpatch
 }:
 
-with lib;
-
 stdenv.mkDerivation rec {
   pname = "john";
   version = "1.9.0-jumbo-1";
@@ -83,7 +81,7 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  meta = {
+  meta = with lib; {
     description = "John the Ripper password cracker";
     license = licenses.gpl2Plus;
     homepage = "https://github.com/openwall/john/";
diff --git a/pkgs/tools/security/knockpy/default.nix b/pkgs/tools/security/knockpy/default.nix
index 8f0cd43bd167..a3342e0b3809 100644
--- a/pkgs/tools/security/knockpy/default.nix
+++ b/pkgs/tools/security/knockpy/default.nix
@@ -5,13 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "knockpy";
-  version = "5.4.0";
+  version = "6.1.0";
+  format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "guelfoweb";
     repo = "knock";
     rev = "refs/tags/${version}";
-    hash = "sha256-If8w6Z75nQsayJBqJs+D9++7kqCbkmwkszOaMATDTpY=";
+    hash = "sha256-O4tXq4pDzuTBEGAls2I9bfBRdHssF4rFBec4OtfUx6A=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/security/modsecurity/default.nix b/pkgs/tools/security/modsecurity/default.nix
index 0d3b28716712..f8564bfe00f1 100644
--- a/pkgs/tools/security/modsecurity/default.nix
+++ b/pkgs/tools/security/modsecurity/default.nix
@@ -3,8 +3,6 @@
 , luaSupport ? false, lua5, perl
 }:
 
-with lib;
-
 let luaValue = if luaSupport then lua5 else "no";
     optional = lib.optional;
 in
@@ -49,7 +47,7 @@ stdenv.mkDerivation rec {
     cp -R * $nginx
   '';
 
-  meta = {
+  meta = with lib; {
     description = "Open source, cross-platform web application firewall (WAF)";
     license = licenses.asl20;
     homepage = "https://www.modsecurity.org/";
diff --git a/pkgs/tools/security/nmap/default.nix b/pkgs/tools/security/nmap/default.nix
index d6276b3cc40e..fbabe92b199b 100644
--- a/pkgs/tools/security/nmap/default.nix
+++ b/pkgs/tools/security/nmap/default.nix
@@ -6,8 +6,6 @@
 , withLua ? true
 }:
 
-with lib;
-
 stdenv.mkDerivation rec {
   pname = "nmap";
   version = "7.93";
@@ -18,7 +16,7 @@ stdenv.mkDerivation rec {
   };
 
   patches = [ ./zenmap.patch ]
-    ++ optionals stdenv.cc.isClang [(
+    ++ lib.optionals stdenv.cc.isClang [(
       # Fixes a compile error due an ambiguous reference to bind(2) in
       # nping/EchoServer.cc, which is otherwise resolved to std::bind.
       # https://github.com/nmap/nmap/pull/1363
@@ -29,7 +27,7 @@ stdenv.mkDerivation rec {
       }
     )];
 
-  prePatch = optionalString stdenv.isDarwin ''
+  prePatch = lib.optionalString stdenv.isDarwin ''
     substituteInPlace libz/configure \
         --replace /usr/bin/libtool ar \
         --replace 'AR="libtool"' 'AR="ar"' \
@@ -43,7 +41,7 @@ stdenv.mkDerivation rec {
     "--without-zenmap"
   ];
 
-  makeFlags = optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+  makeFlags = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
     "AR=${stdenv.cc.bintools.targetPrefix}ar"
     "RANLIB=${stdenv.cc.bintools.targetPrefix}ranlib"
     "CC=${stdenv.cc.targetPrefix}gcc"
@@ -56,7 +54,7 @@ stdenv.mkDerivation rec {
 
   doCheck = false; # fails 3 tests, probably needs the net
 
-  meta = {
+  meta = with lib; {
     description = "A free and open source utility for network discovery and security auditing";
     homepage    = "http://www.nmap.org";
     license     = licenses.gpl2;
diff --git a/pkgs/tools/security/pass/default.nix b/pkgs/tools/security/pass/default.nix
index c856c020d696..498e715a8ebf 100644
--- a/pkgs/tools/security/pass/default.nix
+++ b/pkgs/tools/security/pass/default.nix
@@ -11,8 +11,6 @@
 , tombPluginSupport ? false
 }:
 
-with lib;
-
 assert x11Support -> xclip != null;
 assert waylandSupport -> wl-clipboard != null;
 
@@ -35,7 +33,7 @@ let
       name = "pass";
       paths = selected;
       nativeBuildInputs = [ makeWrapper ];
-      buildInputs = concatMap (x: x.buildInputs) selected;
+      buildInputs = lib.concatMap (x: x.buildInputs) selected;
 
       postBuild = ''
         files=$(find $out/bin/ -type f -exec readlink -f {} \;)
@@ -79,7 +77,7 @@ stdenv.mkDerivation rec {
     # dependencies (s.el) here. The user has to do this themselves.
     mkdir -p "$out/share/emacs/site-lisp"
     cp "contrib/emacs/password-store.el" "$out/share/emacs/site-lisp/"
-  '' + optionalString dmenuSupport ''
+  '' + lib.optionalString dmenuSupport ''
     cp "contrib/dmenu/passmenu" "$out/bin/"
   '';
 
diff --git a/pkgs/tools/security/tcpcrypt/default.nix b/pkgs/tools/security/tcpcrypt/default.nix
index 2ad7fe3e9099..8b00431b6cbe 100644
--- a/pkgs/tools/security/tcpcrypt/default.nix
+++ b/pkgs/tools/security/tcpcrypt/default.nix
@@ -3,8 +3,6 @@
 , libcap, libpcap, libnfnetlink, libnetfilter_conntrack, libnetfilter_queue
 }:
 
-with lib;
-
 stdenv.mkDerivation rec {
   pname = "tcpcrypt";
   version = "0.5";
@@ -21,11 +19,11 @@ stdenv.mkDerivation rec {
   outputs = [ "bin" "dev" "out" ];
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ openssl libpcap ]
-    ++ optionals stdenv.isLinux [ libcap libnfnetlink libnetfilter_conntrack libnetfilter_queue ];
+    ++ lib.optionals stdenv.isLinux [ libcap libnfnetlink libnetfilter_conntrack libnetfilter_queue ];
 
   enableParallelBuilding = true;
 
-  meta = {
+  meta = with lib; {
     broken = stdenv.isDarwin;
     homepage = "http://tcpcrypt.org/";
     description = "Fast TCP encryption";
diff --git a/pkgs/tools/security/tor/update.nix b/pkgs/tools/security/tor/update.nix
index 50353ce32a6a..f0106aa26ea9 100644
--- a/pkgs/tools/security/tor/update.nix
+++ b/pkgs/tools/security/tor/update.nix
@@ -10,8 +10,6 @@
 , nix
 }:
 
-with lib;
-
 let
   downloadPageUrl = "https://dist.torproject.org";
 
@@ -28,7 +26,7 @@ writeScript "update-tor" ''
 
 set -eu -o pipefail
 
-export PATH=${makeBinPath [
+export PATH=${lib.makeBinPath [
   common-updater-scripts
   coreutils
   curl
@@ -63,7 +61,7 @@ sigFile=''${sigUrl##*/}
 export GNUPGHOME=$PWD/gnupg
 mkdir -m 700 -p "$GNUPGHOME"
 
-gpg --batch --recv-keys ${concatStringsSep " " (map (x: "'${x}'") signingKeys)}
+gpg --batch --recv-keys ${lib.concatStringsSep " " (map (x: "'${x}'") signingKeys)}
 gpg --batch --verify "$sigFile" "$checksumFile"
 
 sha256sum -c "$checksumFile"
diff --git a/pkgs/tools/security/vexctl/default.nix b/pkgs/tools/security/vexctl/default.nix
index 3821fa77dc88..335da7f93acf 100644
--- a/pkgs/tools/security/vexctl/default.nix
+++ b/pkgs/tools/security/vexctl/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "vexctl";
-  version = "0.0.2";
+  version = "0.1.0";
 
   src = fetchFromGitHub {
     owner = "chainguard-dev";
     repo = "vex";
     rev = "v${version}";
-    sha256 = "sha256-rDq62vkrZ8/76LERchxijmQCgo58KXlAIfv4SwI7egY=";
+    sha256 = "sha256-f5UVX6x4DwjlcgMAv0GuKBH9UUzFhQ8pW8l+9pc7RQ4=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -24,7 +24,7 @@ buildGoModule rec {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorSha256 = "sha256-7hhiJowtQv4JPqvpMiukL2JVgNeB5gi5X4p+AVGp4S0=";
+  vendorHash = "sha256-GZIssLLPg2dF7xsvsYn2MKYunMCpGbNA+6qCYBW++vk=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/system/htop/default.nix b/pkgs/tools/system/htop/default.nix
index cb79607ebbf8..305761e0c3be 100644
--- a/pkgs/tools/system/htop/default.nix
+++ b/pkgs/tools/system/htop/default.nix
@@ -1,6 +1,8 @@
-{ lib, fetchFromGitHub, stdenv, autoreconfHook
+{ lib, fetchFromGitHub, stdenv, autoreconfHook, pkg-config
 , ncurses
 , IOKit
+, libcap
+, libnl
 , sensorsSupport ? stdenv.isLinux, lm_sensors
 , systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd, systemd
 }:
@@ -18,15 +20,23 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-MwtsvdPHcUdegsYj9NGyded5XJQxXri1IM1j4gef1Xk=";
   };
 
-  nativeBuildInputs = [ autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook ]
+    ++ lib.optional stdenv.isLinux pkg-config
+  ;
 
   buildInputs = [ ncurses ]
     ++ lib.optional stdenv.isDarwin IOKit
+    ++ lib.optionals stdenv.isLinux [ libcap libnl ]
     ++ lib.optional sensorsSupport lm_sensors
     ++ lib.optional systemdSupport systemd
   ;
 
   configureFlags = [ "--enable-unicode" "--sysconfdir=/etc" ]
+    ++ lib.optionals stdenv.isLinux [
+      "--enable-affinity"
+      "--enable-capabilities"
+      "--enable-delayacct"
+    ]
     ++ lib.optional sensorsSupport "--with-sensors"
   ;
 
diff --git a/pkgs/tools/system/jump/default.nix b/pkgs/tools/system/jump/default.nix
index 31b3cae44607..c1e625e14c15 100644
--- a/pkgs/tools/system/jump/default.nix
+++ b/pkgs/tools/system/jump/default.nix
@@ -8,10 +8,10 @@ buildGoModule rec {
     owner = "gsamokovarov";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-nlCuotEiAX2+xx7T8jWZo2p4LNLhWXDdcU6DxJprgx0=";
+    hash = "sha256-nlCuotEiAX2+xx7T8jWZo2p4LNLhWXDdcU6DxJprgx0=";
   };
 
-  vendorSha256 = "sha256-nMUqZWdq//q/DNthvpKiYLq8f95O0QoItyX5w4vHzSA=";
+  vendorHash = "sha256-nMUqZWdq//q/DNthvpKiYLq8f95O0QoItyX5w4vHzSA=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/system/netdata/default.nix b/pkgs/tools/system/netdata/default.nix
index ee9d132de302..a84113fe20ba 100644
--- a/pkgs/tools/system/netdata/default.nix
+++ b/pkgs/tools/system/netdata/default.nix
@@ -14,8 +14,6 @@
 , withDebug ? false
 }:
 
-with lib;
-
 let
   go-d-plugin = callPackage ./go.d.plugin.nix {};
 in stdenv.mkDerivation rec {
@@ -34,17 +32,17 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook pkg-config makeWrapper protobuf ];
   buildInputs = [ curl jemalloc libuv zlib ]
-    ++ optionals stdenv.isDarwin [ CoreFoundation IOKit libossp_uuid ]
-    ++ optionals (!stdenv.isDarwin) [ libcap libuuid ]
-    ++ optionals withCups [ cups ]
-    ++ optionals withDBengine [ lz4 ]
-    ++ optionals withIpmi [ freeipmi ]
-    ++ optionals withNetfilter [ libmnl libnetfilter_acct ]
-    ++ optionals withCloud [ json_c ]
-    ++ optionals withConnPubSub [ google-cloud-cpp grpc ]
-    ++ optionals withConnPrometheus [ snappy ]
-    ++ optionals (withCloud || withConnPrometheus) [ protobuf ]
-    ++ optionals withSsl [ openssl ];
+    ++ lib.optionals stdenv.isDarwin [ CoreFoundation IOKit libossp_uuid ]
+    ++ lib.optionals (!stdenv.isDarwin) [ libcap libuuid ]
+    ++ lib.optionals withCups [ cups ]
+    ++ lib.optionals withDBengine [ lz4 ]
+    ++ lib.optionals withIpmi [ freeipmi ]
+    ++ lib.optionals withNetfilter [ libmnl libnetfilter_acct ]
+    ++ lib.optionals withCloud [ json_c ]
+    ++ lib.optionals withConnPubSub [ google-cloud-cpp grpc ]
+    ++ lib.optionals withConnPrometheus [ snappy ]
+    ++ lib.optionals (withCloud || withConnPrometheus) [ protobuf ]
+    ++ lib.optionals withSsl [ openssl ];
 
   patches = [
     # required to prevent plugins from relying on /etc
@@ -68,12 +66,12 @@ in stdenv.mkDerivation rec {
   # We pick zlib.dev as a simple canary package with pkg-config input.
   disallowedReferences = [ zlib.dev ];
 
-  NIX_CFLAGS_COMPILE = optionalString withDebug "-O1 -ggdb -DNETDATA_INTERNAL_CHECKS=1";
+  NIX_CFLAGS_COMPILE = lib.optionalString withDebug "-O1 -ggdb -DNETDATA_INTERNAL_CHECKS=1";
 
   postInstall = ''
     ln -s ${go-d-plugin}/lib/netdata/conf.d/* $out/lib/netdata/conf.d
     ln -s ${go-d-plugin}/bin/godplugin $out/libexec/netdata/plugins.d/go.d.plugin
-  '' + optionalString (!stdenv.isDarwin) ''
+  '' + lib.optionalString (!stdenv.isDarwin) ''
     # rename this plugin so netdata will look for setuid wrapper
     mv $out/libexec/netdata/plugins.d/apps.plugin \
        $out/libexec/netdata/plugins.d/apps.plugin.org
@@ -83,13 +81,13 @@ in stdenv.mkDerivation rec {
        $out/libexec/netdata/plugins.d/perf.plugin.org
     mv $out/libexec/netdata/plugins.d/slabinfo.plugin \
        $out/libexec/netdata/plugins.d/slabinfo.plugin.org
-    ${optionalString withIpmi ''
+    ${lib.optionalString withIpmi ''
       mv $out/libexec/netdata/plugins.d/freeipmi.plugin \
          $out/libexec/netdata/plugins.d/freeipmi.plugin.org
     ''}
   '';
 
-  preConfigure = optionalString (!stdenv.isDarwin) ''
+  preConfigure = lib.optionalString (!stdenv.isDarwin) ''
     substituteInPlace collectors/python.d.plugin/python_modules/third_party/lm_sensors.py \
       --replace 'ctypes.util.find_library("sensors")' '"${lm_sensors.out}/lib/libsensors${stdenv.hostPlatform.extensions.sharedLibrary}"'
   '';
@@ -99,9 +97,9 @@ in stdenv.mkDerivation rec {
     "--sysconfdir=/etc"
     "--disable-ebpf"
     "--with-jemalloc=${jemalloc}"
-  ] ++ optionals (!withDBengine) [
+  ] ++ lib.optionals (!withDBengine) [
     "--disable-dbengine"
-  ] ++ optionals (!withCloud) [
+  ] ++ lib.optionals (!withCloud) [
     "--disable-cloud"
   ];
 
@@ -116,7 +114,7 @@ in stdenv.mkDerivation rec {
     tests.netdata = nixosTests.netdata;
   };
 
-  meta = {
+  meta = with lib; {
     broken = stdenv.isDarwin || stdenv.buildPlatform != stdenv.hostPlatform;
     description = "Real-time performance monitoring tool";
     homepage = "https://www.netdata.cloud/";
diff --git a/pkgs/tools/system/socklog/default.nix b/pkgs/tools/system/socklog/default.nix
index 7c40a8f0caf6..dc9486a6e3d5 100644
--- a/pkgs/tools/system/socklog/default.nix
+++ b/pkgs/tools/system/socklog/default.nix
@@ -1,7 +1,5 @@
 { lib, stdenv, fetchurl }:
 
-with lib;
-
 stdenv.mkDerivation rec {
   pname = "socklog";
   version = "2.1.0";
@@ -49,7 +47,7 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  meta = {
+  meta = with lib; {
     broken = stdenv.isDarwin;
     description = "System and kernel logging services";
     homepage = "http://smarden.org/socklog/";
diff --git a/pkgs/tools/text/ledger2beancount/default.nix b/pkgs/tools/text/ledger2beancount/default.nix
index 32a0f5863880..385222937676 100644
--- a/pkgs/tools/text/ledger2beancount/default.nix
+++ b/pkgs/tools/text/ledger2beancount/default.nix
@@ -1,7 +1,5 @@
 { lib, stdenv, fetchFromGitHub, makeWrapper, perlPackages, beancount }:
 
-with lib;
-
 let
   perlDeps = with perlPackages; [
     DateCalc
@@ -44,7 +42,7 @@ in stdenv.mkDerivation rec {
       --set PERL5LIB "${perlPackages.makeFullPerlPath perlDeps}"
   '';
 
-  meta = {
+  meta = with lib; {
     description = "Ledger to Beancount text-based converter";
     longDescription = ''
       A script to automatically convert Ledger-based textual ledgers to Beancount ones.
diff --git a/pkgs/tools/typesetting/satysfi/default.nix b/pkgs/tools/typesetting/satysfi/default.nix
index ee73c735d871..16fe6c579c0a 100644
--- a/pkgs/tools/typesetting/satysfi/default.nix
+++ b/pkgs/tools/typesetting/satysfi/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, ruby, dune_3, ocamlPackages
+{ lib, stdenv, fetchFromGitHub, ruby, ocamlPackages
 , ipaexfont, junicode, lmodern, lmmath
 }:
 let
@@ -34,7 +34,7 @@ let
     inherit (ocamlPackages.yojson) meta;
   };
 in
-  stdenv.mkDerivation rec {
+  ocamlPackages.buildDunePackage rec {
     pname = "satysfi";
     version = "0.0.8";
     src = fetchFromGitHub {
@@ -51,23 +51,24 @@ in
       $out/share/satysfi
     '';
 
-    DUNE_PROFILE = "release";
+    duneVersion = "3";
 
-    nativeBuildInputs = [ ruby dune_3 ];
+    nativeBuildInputs = with ocamlPackages; [ menhir cppo ];
 
     buildInputs = [ camlpdf otfm yojson-with-position ] ++ (with ocamlPackages; [
-      ocaml findlib menhir menhirLib
-      batteries camlimages core_kernel ppx_deriving uutf omd cppo re
+      menhirLib
+      batteries camlimages core_kernel ppx_deriving uutf omd re
     ]);
 
-    installPhase = ''
-      cp -r ${ipaexfont}/share/fonts/opentype/* lib-satysfi/dist/fonts/
-      cp -r ${junicode}/share/fonts/junicode-ttf/* lib-satysfi/dist/fonts/
-      cp -r ${lmodern}/share/fonts/opentype/public/lm/* lib-satysfi/dist/fonts/
-      cp -r ${lmmath}/share/fonts/opentype/latinmodern-math.otf lib-satysfi/dist/fonts/
-      make install PREFIX=$out LIBDIR=$out/share/satysfi
-      mkdir -p $out/share/satysfi/
+    postInstall = ''
+      mkdir -p $out/share/satysfi/dist/fonts
       cp -r lib-satysfi/dist/ $out/share/satysfi/
+      cp -r \
+        ${ipaexfont}/share/fonts/opentype/* \
+        ${junicode}/share/fonts/junicode-ttf/* \
+        ${lmodern}/share/fonts/opentype/public/lm/* \
+        ${lmmath}/share/fonts/opentype/latinmodern-math.otf \
+        $out/share/satysfi/dist/fonts
     '';
 
     meta = with lib; {
diff --git a/pkgs/tools/video/rtmpdump/default.nix b/pkgs/tools/video/rtmpdump/default.nix
index 6e05f81fcd8c..b6293ffbc539 100644
--- a/pkgs/tools/video/rtmpdump/default.nix
+++ b/pkgs/tools/video/rtmpdump/default.nix
@@ -12,7 +12,6 @@
 
 assert (gnutlsSupport || opensslSupport);
 
-with lib;
 stdenv.mkDerivation {
   pname = "rtmpdump";
   version = "unstable-2021-02-19";
@@ -36,20 +35,20 @@ stdenv.mkDerivation {
     "prefix=$(out)"
     "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
   ]
-    ++ optional gnutlsSupport "CRYPTO=GNUTLS"
-    ++ optional opensslSupport "CRYPTO=OPENSSL"
-    ++ optional stdenv.isDarwin "SYS=darwin"
-    ++ optional stdenv.cc.isClang "CC=clang";
+    ++ lib.optional gnutlsSupport "CRYPTO=GNUTLS"
+    ++ lib.optional opensslSupport "CRYPTO=OPENSSL"
+    ++ lib.optional stdenv.isDarwin "SYS=darwin"
+    ++ lib.optional stdenv.cc.isClang "CC=clang";
 
   propagatedBuildInputs = [ zlib ]
-    ++ optionals gnutlsSupport [ gnutls nettle ]
-    ++ optional opensslSupport openssl;
+    ++ lib.optionals gnutlsSupport [ gnutls nettle ]
+    ++ lib.optional opensslSupport openssl;
 
   outputs = [ "out" "dev" ];
 
   separateDebugInfo = true;
 
-  meta = {
+  meta = with lib; {
     description = "Toolkit for RTMP streams";
     homepage = "https://rtmpdump.mplayerhq.hu/";
     license = licenses.gpl2;
diff --git a/pkgs/tools/wayland/way-displays/default.nix b/pkgs/tools/wayland/way-displays/default.nix
index f27c15f70d5c..8d8b744583cf 100644
--- a/pkgs/tools/wayland/way-displays/default.nix
+++ b/pkgs/tools/wayland/way-displays/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "way-displays";
-  version = "1.6.2";
+  version = "1.7.1";
 
   src = fetchFromGitHub {
     owner = "alex-courtis";
     repo = "way-displays";
     rev = "${version}";
-    sha256 = "sha256-/dZDYc0XQ1fZYAsk9bd8vMAh7GMKuY6FX0WK5of+AMk=";
+    sha256 = "sha256-o8fju0EQy2KS5yxe9DP3A8ewYgA2GzJtMY41BGJUZis=";
   };
 
   strictDeps = true;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d38e73927d10..78d351f346e2 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -657,12 +657,10 @@ with pkgs;
   dotnet-sdk_7 = dotnetCorePackages.sdk_7_0;
 
   dotnet-runtime_3 = dotnetCorePackages.runtime_3_1;
-  dotnet-runtime_5 = dotnetCorePackages.runtime_5_0;
   dotnet-runtime_6 = dotnetCorePackages.runtime_6_0;
   dotnet-runtime_7 = dotnetCorePackages.runtime_7_0;
 
   dotnet-aspnetcore_3 = dotnetCorePackages.aspnetcore_3_1;
-  dotnet-aspnetcore_5 = dotnetCorePackages.aspnetcore_5_0;
   dotnet-aspnetcore_6 = dotnetCorePackages.aspnetcore_6_0;
   dotnet-aspnetcore_7 = dotnetCorePackages.aspnetcore_7_0;
 
@@ -2196,6 +2194,7 @@ with pkgs;
   zesarux = callPackage ../applications/emulators/zesarux { };
 
   zsnes = pkgsi686Linux.callPackage ../applications/emulators/zsnes { };
+  zsnes2 = pkgsi686Linux.callPackage ../applications/emulators/zsnes/2.x.nix { };
 
   ### APPLICATIONS/EMULATORS/BSNES
 
@@ -2319,6 +2318,8 @@ with pkgs;
 
   portfolio-filemanager = callPackage ../applications/file-managers/portfolio-filemanager { };
 
+  potreeconverter = callPackage ../applications/graphics/potreeconverter { };
+
   ranger = callPackage ../applications/file-managers/ranger { };
 
   sfm = callPackage ../applications/file-managers/sfm { };
@@ -3167,9 +3168,7 @@ with pkgs;
 
   gmni = callPackage ../applications/networking/browsers/gmni { };
 
-  gmnisrv = callPackage ../servers/gemini/gmnisrv {
-    openssl = openssl_1_1;
-  };
+  gmnisrv = callPackage ../servers/gemini/gmnisrv { };
 
   gmnitohtml = callPackage ../applications/misc/gmnitohtml { };
 
@@ -3366,7 +3365,7 @@ with pkgs;
 
   kjv = callPackage ../applications/misc/kjv { };
 
-  lukesmithxyz-bible-kjv = callPackage ../applications/misc/lukesmithxyz-bible/kjv.nix { };
+  lukesmithxyz-bible-kjv = callPackage ../applications/misc/kjv/lukesmithxyz-kjv.nix { };
 
   luigi = callPackage ../applications/networking/cluster/luigi { };
 
@@ -10301,7 +10300,9 @@ with pkgs;
 
   openimagedenoise_1_2_x = callPackage ../development/libraries/openimagedenoise/1_2_x.nix { };
 
-  openmvg = callPackage ../applications/science/misc/openmvg { };
+  openmvg = callPackage ../applications/science/misc/openmvg {
+    inherit (llvmPackages) openmp;
+  };
 
   openmvs = callPackage ../applications/science/misc/openmvs { };
 
@@ -17265,6 +17266,8 @@ with pkgs;
 
   cloudcompare = libsForQt5.callPackage ../applications/graphics/cloudcompare { };
 
+  cloudlog = callPackage ../applications/radio/cloudlog { };
+
   cloudflare-warp = callPackage ../tools/networking/cloudflare-warp { };
 
   cloudfoundry-cli = callPackage ../applications/networking/cluster/cloudfoundry-cli { };
@@ -20659,6 +20662,12 @@ with pkgs;
 
   libcutl = callPackage ../development/libraries/libcutl { };
 
+  libcxxrt = callPackage ../development/libraries/libcxxrt {
+    stdenv = if stdenv.hostPlatform.useLLVM or false
+             then overrideCC stdenv buildPackages.llvmPackages.tools.clangNoLibcxx
+             else stdenv;
+  };
+
   libdaemon = callPackage ../development/libraries/libdaemon { };
 
   libdatovka = callPackage ../development/libraries/libdatovka { };
@@ -21555,6 +21564,8 @@ with pkgs;
 
   libtsm = callPackage ../development/libraries/libtsm { };
 
+  libsv = callPackage ../development/libraries/libsv { };
+
   libgeotiff = callPackage ../development/libraries/libgeotiff { };
 
   libu2f-host = callPackage ../development/libraries/libu2f-host { };
@@ -22639,6 +22650,7 @@ with pkgs;
 
   qt6Packages = recurseIntoAttrs (import ./qt6-packages.nix {
     inherit lib pkgs qt6;
+    stdenv = if stdenv.isDarwin then darwin.apple_sdk_11_0.stdenv else stdenv;
   });
 
   quark-engine = callPackage ../tools/security/quark-engine { };
@@ -26835,6 +26847,8 @@ with pkgs;
 
   dosemu_fonts = callPackage ../data/fonts/dosemu-fonts { };
 
+  dotcolon-fonts = callPackage ../data/fonts/dotcolon-fonts { };
+
   e17gtk = callPackage ../data/themes/e17gtk { };
 
   eb-garamond = callPackage ../data/fonts/eb-garamond { };
@@ -26855,6 +26869,10 @@ with pkgs;
 
   eunomia = callPackage ../data/fonts/eunomia { };
 
+  fa_1 = callPackage ../data/fonts/fa_1 { };
+
+  f1_8 = callPackage ../data/fonts/f1_8 { };
+
   f5_6 = callPackage ../data/fonts/f5_6 { };
 
   faba-icon-theme = callPackage ../data/icons/faba-icon-theme { };
@@ -27192,6 +27210,8 @@ with pkgs;
 
   medio = callPackage ../data/fonts/medio { };
 
+  melete = callPackage ../data/fonts/melete { };
+
   mno16 = callPackage ../data/fonts/mno16 { };
 
   mnist = callPackage ../data/machine-learning/mnist { };
@@ -27228,6 +27248,8 @@ with pkgs;
 
   myrica = callPackage ../data/fonts/myrica { };
 
+  nacelle = callPackage ../data/fonts/nacelle { };
+
   nafees = callPackage ../data/fonts/nafees { };
 
   nanum = callPackage ../data/fonts/nanum {  };
@@ -31106,6 +31128,8 @@ with pkgs;
 
   pragha = libsForQt5.callPackage ../applications/audio/pragha { };
 
+  river-tag-overlay = callPackage ../applications/misc/river-tag-overlay { };
+
   rofi-mpd = callPackage ../applications/audio/rofi-mpd { };
 
   rofi-bluetooth = callPackage ../applications/misc/rofi-bluetooth { };
@@ -31972,6 +31996,10 @@ with pkgs;
 
   polymake = callPackage ../applications/science/math/polymake { };
 
+  pomodoro = callPackage ../applications/misc/pomodoro {
+    inherit (darwin.apple_sdk.frameworks) Foundation;
+  };
+
   pomotroid = callPackage ../applications/misc/pomotroid {
     electron = electron_9;
   };
@@ -32410,6 +32438,8 @@ with pkgs;
 
   secretscanner = callPackage ../tools/security/secretscanner { };
 
+  setconf = python3.pkgs.callPackage ../tools/misc/setconf { };
+
   semiphemeral = callPackage ../tools/misc/semiphemeral { };
 
   semver = callPackage ../applications/misc/semver { };
@@ -34316,7 +34346,7 @@ with pkgs;
   openethereum = callPackage ../applications/blockchains/openethereum { };
 
   polkadot = callPackage ../applications/blockchains/polkadot {
-    inherit (darwin.apple_sdk.frameworks) Security;
+    inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
   };
 
   particl-core = callPackage ../applications/blockchains/particl-core { };
@@ -38715,6 +38745,8 @@ with pkgs;
 
   tuner = callPackage ../applications/audio/tuner { };
 
+  locate-dominating-file = callPackage ../tools/misc/locate-dominating-file { };
+
   jfrog-cli = callPackage ../tools/misc/jfrog-cli { };
 
   ov = callPackage ../tools/text/ov { };
diff --git a/pkgs/top-level/nim-packages.nix b/pkgs/top-level/nim-packages.nix
index ca52d7f52b56..67863c3ac06d 100644
--- a/pkgs/top-level/nim-packages.nix
+++ b/pkgs/top-level/nim-packages.nix
@@ -14,6 +14,8 @@ lib.makeScope newScope (self:
     astpatternmatching =
       callPackage ../development/nim-packages/astpatternmatching { };
 
+    asynctools = callPackage ../development/nim-packages/asynctools { };
+
     base32 = callPackage ../development/nim-packages/base32 { };
 
     bumpy = callPackage ../development/nim-packages/bumpy { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index e21a89c4d8bf..b8c5b329e45f 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4803,9 +4803,6 @@ self: super: with self; {
 
   jaxlib-build = callPackage ../development/python-modules/jaxlib rec {
     inherit (pkgs.darwin) cctools;
-    buildBazelPackage = pkgs.buildBazelPackage.override {
-      stdenv = if stdenv.isDarwin then pkgs.darwin.apple_sdk_11_0.stdenv else stdenv;
-    };
     # Some platforms don't have `cudaSupport` defined, hence the need for 'or false'.
     cudaSupport = pkgs.config.cudaSupport or false;
     IOKit = pkgs.darwin.apple_sdk_11_0.IOKit;
diff --git a/pkgs/top-level/qt6-packages.nix b/pkgs/top-level/qt6-packages.nix
index e566a8af758c..9d6a58cb3b52 100644
--- a/pkgs/top-level/qt6-packages.nix
+++ b/pkgs/top-level/qt6-packages.nix
@@ -7,6 +7,7 @@
 { lib
 , pkgs
 , qt6
+, stdenv
 }:
 
 (lib.makeScope pkgs.newScope ( self:
@@ -24,6 +25,8 @@ let
 in
 
 (qt6 // {
+  inherit stdenv;
+
   # LIBRARIES
 
   inherit (kdeFrameworks) kcoreaddons;