Merge branch 'staging' into glibc230

309 files changed, 4656 insertions, 1855 deletions

diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md
index 199e678bc291..bbcf82f7ed69 100644
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -833,6 +833,7 @@ used in `buildPythonPackage`.
 - `pythonRemoveBinBytecode` to remove bytecode from the `/bin` folder.
 - `setuptoolsBuildHook` to build a wheel using `setuptools`.
 - `setuptoolsCheckHook` to run tests with `python setup.py test`.
+- `venvShellHook` to source a Python 3 `venv` at the `venvDir` location. A `venv` is created if it does not yet exist.
 - `wheelUnpackHook` to move a wheel to the correct folder so it can be installed with the `pipInstallHook`.
 
 ### Development mode
diff --git a/doc/languages-frameworks/rust.section.md b/doc/languages-frameworks/rust.section.md
index 709a0d504cf7..0edf03ad26a9 100644
--- a/doc/languages-frameworks/rust.section.md
+++ b/doc/languages-frameworks/rust.section.md
@@ -32,17 +32,17 @@ Rust applications are packaged by using the `buildRustPackage` helper from `rust
 
 ```
 rustPlatform.buildRustPackage rec {
-  name = "ripgrep-${version}";
-  version = "0.4.0";
+  pname = "ripgrep";
+  version = "11.0.2";
 
   src = fetchFromGitHub {
     owner = "BurntSushi";
-    repo = "ripgrep";
-    rev = "${version}";
-    sha256 = "0y5d1n6hkw85jb3rblcxqas2fp82h3nghssa4xqrhqnz25l799pj";
+    repo = pname;
+    rev = version;
+    sha256 = "1iga3320mgi7m853la55xip514a3chqsdi1a1rwv25lr9b1p7vd3";
   };
 
-  cargoSha256 = "0q68qyl2h6i0qsz82z840myxlnjay8p1w5z7hfyr8fqp7wgwa9cx";
+  cargoSha256 = "17ldqr3asrdcsh4l29m3b5r37r5d0b3npq1lrgjmxb6vlx6a36qh";
   verifyCargoDeps = true;
 
   meta = with stdenv.lib; {
@@ -66,7 +66,11 @@ added in `cargoPatches` will also be prepended to the patches in `patches` at
 build-time.
 
 When `verifyCargoDeps` is set to `true`, the build will also verify that the
-`cargoSha256` is not out of date by comparing the `Cargo.lock` file in both the `cargoDeps` and `src`. Note that this option changes the value of `cargoSha256` since it also copies the `Cargo.lock` in it. To avoid breaking backward-compatibility this option is not enabled by default but hopefully will be in the future.
+`cargoSha256` is not out of date by comparing the `Cargo.lock` file in both the
+`cargoDeps` and `src`. Note that this option changes the value of `cargoSha256`
+since it also copies the `Cargo.lock` in it. To avoid breaking
+backward-compatibility this option is not enabled by default but hopefully will
+be in the future.
 
 ### Building a crate for a different target
 
diff --git a/doc/overrides.css b/doc/overrides.css
index 4c7d4a31be2d..73901a3f543b 100644
--- a/doc/overrides.css
+++ b/doc/overrides.css
@@ -1,9 +1,22 @@
 .docbook .xref img[src^=images\/callouts\/],
 .screen img,
-.programlisting img {
+.programlisting img,
+.literallayout img,
+.synopsis img {
     width: 1em;
 }
 
 .calloutlist img {
     width: 1.5em;
 }
+
+.prompt,
+.screen img,
+.programlisting img,
+.literallayout img,
+.synopsis img {
+    -moz-user-select: none;
+    -webkit-user-select: none;
+    -ms-user-select: none;
+    user-select: none;
+}
diff --git a/lib/cli.nix b/lib/cli.nix
new file mode 100644
index 000000000000..f47625d2f537
--- /dev/null
+++ b/lib/cli.nix
@@ -0,0 +1,56 @@
+{ lib }:
+
+rec {
+  /* Automatically convert an attribute set to command-line options.
+
+     This helps protect against malformed command lines and also to reduce
+     boilerplate related to command-line construction for simple use cases.
+
+     Example:
+       encodeGNUCommandLine
+         { }
+         { data = builtins.toJSON { id = 0; };
+
+           X = "PUT";
+
+           retry = 3;
+
+           retry-delay = null;
+
+           url = [ "https://example.com/foo" "https://example.com/bar" ];
+
+           silent = false;
+
+           verbose = true;
+         };
+       => "'-X' 'PUT' '--data' '{\"id\":0}' '--retry' '3' '--url' 'https://example.com/foo' '--url' 'https://example.com/bar' '--verbose'"
+  */
+  encodeGNUCommandLine =
+    options: attrs: lib.escapeShellArgs (toGNUCommandLine options attrs);
+
+  toGNUCommandLine =
+    { renderKey ?
+        key: if builtins.stringLength key == 1 then "-${key}" else "--${key}"
+
+    , renderOption ?
+        key: value:
+          if value == null
+          then []
+          else [ (renderKey key) (builtins.toString value) ]
+
+    , renderBool ? key: value: lib.optional value (renderKey key)
+
+    , renderList ? key: value: lib.concatMap (renderOption key) value
+    }:
+    options:
+      let
+        render = key: value:
+                 if builtins.isBool value
+            then renderBool key value
+            else if builtins.isList value
+            then renderList key value
+            else renderOption key value;
+
+      in
+        builtins.concatLists (lib.mapAttrsToList render options);
+}
diff --git a/lib/default.nix b/lib/default.nix
index 9f7a088d792d..5abafe1b2acf 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -39,6 +39,7 @@ let
 
     # misc
     asserts = callLibs ./asserts.nix;
+    cli = callLibs ./cli.nix;
     debug = callLibs ./debug.nix;
     generators = callLibs ./generators.nix;
     misc = callLibs ./deprecated.nix;
@@ -100,7 +101,7 @@ let
     inherit (sources) pathType pathIsDirectory cleanSourceFilter
       cleanSource sourceByRegex sourceFilesBySuffices
       commitIdFromGitRepo cleanSourceWith pathHasContext
-      canCleanSource;
+      canCleanSource pathIsRegularFile;
     inherit (modules) evalModules unifyModuleSyntax
       applyIfFunction mergeModules
       mergeModules' mergeOptionDecls evalOptionValue mergeDefinitions
@@ -120,6 +121,7 @@ let
       isOptionType mkOptionType;
     inherit (asserts)
       assertMsg assertOneOf;
+    inherit (cli) encodeGNUCommandLine toGNUCommandLine;
     inherit (debug) addErrorContextToAttrs traceIf traceVal traceValFn
       traceXMLVal traceXMLValMarked traceSeq traceSeqN traceValSeq
       traceValSeqFn traceValSeqN traceValSeqNFn traceShowVal
diff --git a/lib/sources.nix b/lib/sources.nix
index 51bcf5559e32..0fd172c42b77 100644
--- a/lib/sources.nix
+++ b/lib/sources.nix
@@ -9,6 +9,9 @@ rec {
   # Returns true if the path exists and is a directory, false otherwise
   pathIsDirectory = p: if builtins.pathExists p then (pathType p) == "directory" else false;
 
+  # Returns true if the path exists and is a regular file, false otherwise
+  pathIsRegularFile = p: if builtins.pathExists p then (pathType p) == "regular" else false;
+
   # Bring in a path as a source, filtering out all Subversion and CVS
   # directories, as well as backup files (*~).
   cleanSourceFilter = name: type: let baseName = baseNameOf (toString name); in ! (
@@ -110,24 +113,43 @@ rec {
       with builtins;
         let fileName       = toString path + "/" + file;
             packedRefsName = toString path + "/packed-refs";
-        in if lib.pathExists fileName
+        in if pathIsRegularFile path
+           # Resolve git worktrees. See gitrepository-layout(5)
+           then
+             let m   = match "^gitdir: (.*)$" (lib.fileContents path);
+             in if m == null
+                then throw ("File contains no gitdir reference: " + path)
+                else
+                  let gitDir     = lib.head m;
+                      commonDir' = if pathIsRegularFile "${gitDir}/commondir"
+                                   then lib.fileContents "${gitDir}/commondir"
+                                   else gitDir;
+                      commonDir  = if lib.hasPrefix "/" commonDir'
+                                   then commonDir'
+                                   else toString (/. + "${gitDir}/${commonDir'}");
+                      refFile    = lib.removePrefix "${commonDir}/" "${gitDir}/${file}";
+                  in readCommitFromFile refFile commonDir
+
+           else if pathIsRegularFile fileName
+           # Sometimes git stores the commitId directly in the file but
+           # sometimes it stores something like: «ref: refs/heads/branch-name»
            then
              let fileContent = lib.fileContents fileName;
-                 # Sometimes git stores the commitId directly in the file but
-                 # sometimes it stores something like: «ref: refs/heads/branch-name»
                  matchRef    = match "^ref: (.*)$" fileContent;
-             in if   matchRef == null
+             in if  matchRef == null
                 then fileContent
                 else readCommitFromFile (lib.head matchRef) path
+
+           else if pathIsRegularFile packedRefsName
            # Sometimes, the file isn't there at all and has been packed away in the
            # packed-refs file, so we have to grep through it:
-           else if lib.pathExists packedRefsName
            then
              let fileContent = readFile packedRefsName;
                  matchRef    = match (".*\n([^\n ]*) " + file + "\n.*") fileContent;
-             in if   matchRef == null
+             in if  matchRef == null
                 then throw ("Could not find " + file + " in " + packedRefsName)
                 else lib.head matchRef
+
            else throw ("Not a .git directory: " + path);
     in readCommitFromFile "HEAD";
 
diff --git a/lib/tests/misc.nix b/lib/tests/misc.nix
index b064faa1e1ba..e47b48b5017d 100644
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@@ -441,4 +441,25 @@ runTests {
     expected  = "«foo»";
   };
 
+  testRenderOptions = {
+    expr =
+       encodeGNUCommandLine
+         { }
+         { data = builtins.toJSON { id = 0; };
+
+           X = "PUT";
+
+           retry = 3;
+
+           retry-delay = null;
+
+           url = [ "https://example.com/foo" "https://example.com/bar" ];
+
+           silent = false;
+
+           verbose = true;
+         };
+
+    expected = "'-X' 'PUT' '--data' '{\"id\":0}' '--retry' '3' '--url' 'https://example.com/foo' '--url' 'https://example.com/bar' '--verbose'";
+  };
 }
diff --git a/lib/tests/modules.sh b/lib/tests/modules.sh
index c8340ff7f157..8cd632a439cd 100755
--- a/lib/tests/modules.sh
+++ b/lib/tests/modules.sh
@@ -174,8 +174,7 @@ checkConfigOutput "true" config.submodule.inner ./declare-submoduleWith-modules.
 checkConfigOutput "true" config.submodule.outer ./declare-submoduleWith-modules.nix
 
 ## Paths should be allowed as values and work as expected
-# Temporarily disabled until https://github.com/NixOS/nixpkgs/pull/76861
-#checkConfigOutput "true" config.submodule.enable ./declare-submoduleWith-path.nix
+checkConfigOutput "true" config.submodule.enable ./declare-submoduleWith-path.nix
 
 # Check that disabledModules works recursively and correctly
 checkConfigOutput "true" config.enable ./disable-recursive/main.nix
diff --git a/lib/trivial.nix b/lib/trivial.nix
index 3a25e31fb052..940ec1a3d59e 100644
--- a/lib/trivial.nix
+++ b/lib/trivial.nix
@@ -191,7 +191,7 @@ rec {
     let
       revisionFile = "${toString ./..}/.git-revision";
       gitRepo      = "${toString ./..}/.git";
-    in if lib.pathIsDirectory gitRepo
+    in if builtins.pathExists gitRepo
        then lib.commitIdFromGitRepo gitRepo
        else if lib.pathExists revisionFile then lib.fileContents revisionFile
        else default;
diff --git a/lib/types.nix b/lib/types.nix
index e86f6d364761..d8a5db0c89f0 100644
--- a/lib/types.nix
+++ b/lib/types.nix
@@ -340,18 +340,68 @@ rec {
             let
               padWidth = stringLength (toString (length def.value));
               unnamed = i: unnamedPrefix + fixedWidthNumber padWidth i;
+              anyString = placeholder "name";
+              nameAttrs = [
+                { path = [ "environment" "etc" ];
+                  name = "target";
+                }
+                { path = [ "containers" anyString "bindMounts" ];
+                  name = "mountPoint";
+                }
+                { path = [ "programs" "ssh" "knownHosts" ];
+                  # hostNames is actually a list so we would need to handle it only when singleton
+                  name = "hostNames";
+                }
+                { path = [ "fileSystems" ];
+                  name = "mountPoint";
+                }
+                { path = [ "boot" "specialFileSystems" ];
+                  name = "mountPoint";
+                }
+                { path = [ "services" "znapzend" "zetup" ];
+                  name = "dataset";
+                }
+                { path = [ "services" "znapzend" "zetup" anyString "destinations" ];
+                  name = "label";
+                }
+                { path = [ "services" "geoclue2" "appConfig" ];
+                  name = "desktopID";
+                }
+              ];
+              matched = let
+                equals = a: b: b == anyString || a == b;
+                fallback = { name = "name"; };
+              in findFirst ({ path, ... }: all (v: v == true) (zipListsWith equals loc path)) fallback nameAttrs;
+              nameAttr = matched.name;
+              nameValueOld = value:
+                if isList value then
+                  if length value > 0 then
+                    "[ " + concatMapStringsSep " " escapeNixString value + " ]"
+                  else
+                    "[ ]"
+                else
+                  escapeNixString value;
+              nameValueNew = value: unnamed:
+                if isList value then
+                  if length value > 0 then
+                    head value
+                  else
+                    unnamed
+                else
+                  value;
               res =
                 { inherit (def) file;
                   value = listToAttrs (
                     imap1 (elemIdx: elem:
-                      { name  = elem.name or (unnamed elemIdx);
+                      { name  = nameValueNew (elem.${nameAttr} or (unnamed elemIdx)) (unnamed elemIdx);
                         value = elem;
                       }) def.value);
                 };
               option = concatStringsSep "." loc;
               sample = take 3 def.value;
-              list = concatMapStrings (x: ''{ name = "${x.name or "unnamed"}"; ...} '') sample;
-              set = concatMapStrings (x: ''${x.name or "unnamed"} = {...}; '') sample;
+              more = lib.optionalString (length def.value > 3) "... ";
+              list = concatMapStrings (x: ''{ ${nameAttr} = ${nameValueOld (x.${nameAttr} or "unnamed")}; ...} '') sample;
+              set = concatMapStrings (x: ''${nameValueNew (x.${nameAttr} or "unnamed") "unnamed"} = {...}; '') sample;
               msg = ''
                 In file ${def.file}
                 a list is being assigned to the option config.${option}.
@@ -359,10 +409,10 @@ rec {
                 See https://git.io/fj2zm for more information.
                 Do
                   ${option} =
-                    { ${set}...}
+                    { ${set}${more}}
                 instead of
                   ${option} =
-                    [ ${list}...]
+                    [ ${list}${more}]
               '';
             in
               lib.warn msg res
@@ -430,14 +480,16 @@ rec {
           else unify (if shorthandOnlyDefinesConfig then { config = value; } else value);
 
         allModules = defs: modules ++ imap1 (n: { value, file }:
-          # Annotate the value with the location of its definition for better error messages
-          coerce (lib.modules.unifyModuleSyntax file "${toString file}-${toString n}") value
+          if isAttrs value || isFunction value then
+            # Annotate the value with the location of its definition for better error messages
+            coerce (lib.modules.unifyModuleSyntax file "${toString file}-${toString n}") value
+          else value
         ) defs;
 
       in
       mkOptionType rec {
         name = "submodule";
-        check = x: isAttrs x || isFunction x;
+        check = x: isAttrs x || isFunction x || path.check x;
         merge = loc: defs:
           (evalModules {
             modules = allModules defs;
@@ -538,7 +590,7 @@ rec {
         tail' = tail ts;
       in foldl' either head' tail';
 
-    # Either value of type `finalType` or `coercedType`, the latter is
+    # Either value of type `coercedType` or `finalType`, the former is
     # converted to `finalType` using `coerceFunc`.
     coercedTo = coercedType: coerceFunc: finalType:
       assert lib.assertMsg (coercedType.getSubModules == null)
@@ -547,12 +599,12 @@ rec {
       mkOptionType rec {
         name = "coercedTo";
         description = "${finalType.description} or ${coercedType.description} convertible to it";
-        check = x: finalType.check x || (coercedType.check x && finalType.check (coerceFunc x));
+        check = x: (coercedType.check x && finalType.check (coerceFunc x)) || finalType.check x;
         merge = loc: defs:
           let
             coerceVal = val:
-              if finalType.check val then val
-              else coerceFunc val;
+              if coercedType.check val then coerceFunc val
+              else val;
           in finalType.merge loc (map (def: def // { value = coerceVal def.value; }) defs);
         emptyValue = finalType.emptyValue;
         getSubOptions = finalType.getSubOptions;
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index fc9991b42433..bdeed800890f 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -505,6 +505,12 @@
     githubId = 750786;
     name = "Justin Wood";
   };
+  anmonteiro = {
+    email = "anmonteiro@gmail.com";
+    github = "anmonteiro";
+    githubId = 661909;
+    name = "Antonio Nuno Monteiro";
+  };
   anpryl = {
     email = "anpryl@gmail.com";
     github = "anpryl";
@@ -2433,6 +2439,12 @@
     githubId = 844574;
     name = "Daniel Austin";
   };
+  flyfloh = {
+    email = "nix@halbmastwurf.de";
+    github = "flyfloh";
+    githubId = 74379;
+    name = "Florian Pester";
+  };
   fmthoma = {
     email = "f.m.thoma@googlemail.com";
     github = "fmthoma";
@@ -4430,6 +4442,12 @@
     githubId = 158568;
     name = "Matthias C. M. Troffaes";
   };
+  McSinyx = {
+    email = "vn.mcsinyx@gmail.com";
+    github = "McSinyx";
+    githubId = 13689192;
+    name = "Nguyễn Gia Phong";
+  };
   mdaiter = {
     email = "mdaiter8121@gmail.com";
     github = "mdaiter";
@@ -5070,6 +5088,12 @@
     githubId = 7588406;
     name = "Andrew R. M.";
   };
+  nloomans = {
+    email = "noah@nixos.noahloomans.com";
+    github = "nloomans";
+    githubId = 7829481;
+    name = "Noah Loomans";
+  };
   nmattia = {
     email = "nicolas@nmattia.com";
     github = "nmattia";
@@ -7014,6 +7038,11 @@
     github = "timbertson";
     name = "Tim Cuthbertson";
   };
+  timma = {
+    email = "kunduru.it.iitb@gmail.com";
+    github = "ktrsoft";
+    name = "Timma";
+  };
   timokau = {
     email = "timokau@zoho.com";
     github = "timokau";
diff --git a/nixos/doc/manual/development/option-types.xml b/nixos/doc/manual/development/option-types.xml
index 55d9c123e3f1..957349ad1811 100644
--- a/nixos/doc/manual/development/option-types.xml
+++ b/nixos/doc/manual/development/option-types.xml
@@ -257,9 +257,9 @@
     <listitem>
      <para>
       A set of sub options <replaceable>o</replaceable>.
-      <replaceable>o</replaceable> can be an attribute set or a function
-      returning an attribute set. Submodules are used in composed types to
-      create modular options. This is equivalent to
+      <replaceable>o</replaceable> can be an attribute set, a function
+      returning an attribute set, or a path to a file containing such a value. Submodules are used in
+      composed types to create modular options. This is equivalent to
       <literal>types.submoduleWith { modules = toList o; shorthandOnlyDefinesConfig = true; }</literal>.
       Submodules are detailed in
       <xref
diff --git a/nixos/doc/manual/man-pages.xml b/nixos/doc/manual/man-pages.xml
index f5a1dd2d69f4..49acfe7330b6 100644
--- a/nixos/doc/manual/man-pages.xml
+++ b/nixos/doc/manual/man-pages.xml
@@ -6,7 +6,7 @@
   <author><personname><firstname>Eelco</firstname><surname>Dolstra</surname></personname>
    <contrib>Author</contrib>
   </author>
-  <copyright><year>2007-2019</year><holder>Eelco Dolstra</holder>
+  <copyright><year>2007-2020</year><holder>Eelco Dolstra</holder>
   </copyright>
  </info>
  <xi:include href="man-configuration.xml" />
diff --git a/nixos/doc/manual/release-notes/rl-2003.xml b/nixos/doc/manual/release-notes/rl-2003.xml
index ca319dfea411..51f91268eff0 100644
--- a/nixos/doc/manual/release-notes/rl-2003.xml
+++ b/nixos/doc/manual/release-notes/rl-2003.xml
@@ -391,6 +391,16 @@ users.users.me =
      <link xlink:href="https://github.com/NixOS/nixpkgs/pull/63103">PR #63103</link>.
     </para>
    </listitem>
+   <listitem>
+    <para>
+     For NixOS modules, the types <literal>types.submodule</literal> and <literal>types.submoduleWith</literal> now support
+     paths as allowed values, similar to how <literal>imports</literal> supports paths.
+     Because of this, if you have a module that defines an option of type
+     <literal>either (submodule ...) path</literal>, it will break since a path
+     is now treated as the first type instead of the second. To fix this, change
+     the type to <literal>either path (submodule ...)</literal>.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 
diff --git a/nixos/lib/test-driver/test-driver.py b/nixos/lib/test-driver/test-driver.py
index 7e575189209a..c2cbedc5e3e2 100644
--- a/nixos/lib/test-driver/test-driver.py
+++ b/nixos/lib/test-driver/test-driver.py
@@ -704,7 +704,8 @@ class Machine:
 
         def process_serial_output() -> None:
             for _line in self.process.stdout:
-                line = _line.decode("unicode_escape").replace("\r", "").rstrip()
+                # Ignore undecodable bytes that may occur in boot menus
+                line = _line.decode(errors="ignore").replace("\r", "").rstrip()
                 eprint("{} # {}".format(self.name, line))
                 self.logger.enqueue({"msg": line, "machine": self.name})
 
diff --git a/nixos/lib/testing-python.nix b/nixos/lib/testing-python.nix
index 3d09be3b6cd5..a7f6d7926514 100644
--- a/nixos/lib/testing-python.nix
+++ b/nixos/lib/testing-python.nix
@@ -155,7 +155,7 @@ in rec {
             --add-flags "''${vms[*]}" \
             ${lib.optionalString enableOCR
               "--prefix PATH : '${ocrProg}/bin:${imagemagick_tiff}/bin'"} \
-            --run "export testScript=\"\$(cat $out/test-script)\"" \
+            --run "export testScript=\"\$(${coreutils}/bin/cat $out/test-script)\"" \
             --set VLANS '${toString vlans}'
           ln -s ${testDriver}/bin/nixos-test-driver $out/bin/nixos-run-vms
           wrapProgram $out/bin/nixos-run-vms \
diff --git a/nixos/modules/hardware/usb-wwan.nix b/nixos/modules/hardware/usb-wwan.nix
index 2d20421586a7..679a6c6497cb 100644
--- a/nixos/modules/hardware/usb-wwan.nix
+++ b/nixos/modules/hardware/usb-wwan.nix
@@ -21,6 +21,19 @@ with lib;
   ###### implementation
 
   config = mkIf config.hardware.usbWwan.enable {
+    # Attaches device specific handlers.
     services.udev.packages = with pkgs; [ usb-modeswitch-data ];
+
+    # Triggered by udev, usb-modeswitch creates systemd services via a
+    # template unit in the usb-modeswitch package.
+    systemd.packages = with pkgs; [ usb-modeswitch ];
+
+    # The systemd service requires the usb-modeswitch-data. The
+    # usb-modeswitch package intends to discover this via the
+    # filesystem at /usr/share/usb_modeswitch, and merge it with user
+    # configuration in /etc/usb_modeswitch.d. Configuring the correct
+    # path in the package is difficult, as it would cause a cyclic
+    # dependency.
+    environment.etc."usb_modeswitch.d".source = "${pkgs.usb-modeswitch-data}/share/usb_modeswitch";
   };
 }
diff --git a/nixos/modules/misc/version.nix b/nixos/modules/misc/version.nix
index b85614771ee4..ddbd3963cc57 100644
--- a/nixos/modules/misc/version.nix
+++ b/nixos/modules/misc/version.nix
@@ -91,8 +91,8 @@ in
       # These defaults are set here rather than up there so that
       # changing them would not rebuild the manual
       version = mkDefault (cfg.release + cfg.versionSuffix);
-      revision      = mkIf (pathIsDirectory gitRepo) (mkDefault            gitCommitId);
-      versionSuffix = mkIf (pathIsDirectory gitRepo) (mkDefault (".git." + gitCommitId));
+      revision      = mkIf (pathExists gitRepo) (mkDefault            gitCommitId);
+      versionSuffix = mkIf (pathExists gitRepo) (mkDefault (".git." + gitCommitId));
     };
 
     # Generate /etc/os-release.  See
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index a6c1d7c5d66c..a48434641b0c 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -735,6 +735,7 @@
   ./services/networking/wicd.nix
   ./services/networking/wireguard.nix
   ./services/networking/wpa_supplicant.nix
+  ./services/networking/xandikos.nix
   ./services/networking/xinetd.nix
   ./services/networking/xl2tpd.nix
   ./services/networking/xrdp.nix
diff --git a/nixos/modules/services/continuous-integration/buildbot/master.nix b/nixos/modules/services/continuous-integration/buildbot/master.nix
index 326d2cbd82cc..e3da3092d459 100644
--- a/nixos/modules/services/continuous-integration/buildbot/master.nix
+++ b/nixos/modules/services/continuous-integration/buildbot/master.nix
@@ -222,7 +222,7 @@ in {
   };
 
   config = mkIf cfg.enable {
-    users.groups = optional (cfg.group == "buildbot") {
+    users.groups = optionalAttrs (cfg.group == "buildbot") {
       buildbot = { };
     };
 
diff --git a/nixos/modules/services/continuous-integration/buildbot/worker.nix b/nixos/modules/services/continuous-integration/buildbot/worker.nix
index 7613692f0a34..52f24b8cee3c 100644
--- a/nixos/modules/services/continuous-integration/buildbot/worker.nix
+++ b/nixos/modules/services/continuous-integration/buildbot/worker.nix
@@ -136,7 +136,7 @@ in {
   config = mkIf cfg.enable {
     services.buildbot-worker.workerPassFile = mkDefault (pkgs.writeText "buildbot-worker-password" cfg.workerPass);
 
-    users.groups = optional (cfg.group == "bbworker") {
+    users.groups = optionalAttrs (cfg.group == "bbworker") {
       bbworker = { };
     };
 
diff --git a/nixos/modules/services/continuous-integration/jenkins/slave.nix b/nixos/modules/services/continuous-integration/jenkins/slave.nix
index 26368cb94e47..3c0e6f78e74c 100644
--- a/nixos/modules/services/continuous-integration/jenkins/slave.nix
+++ b/nixos/modules/services/continuous-integration/jenkins/slave.nix
@@ -50,7 +50,7 @@ in {
   };
 
   config = mkIf (cfg.enable && !masterCfg.enable) {
-    users.groups = optional (cfg.group == "jenkins") {
+    users.groups = optionalAttrs (cfg.group == "jenkins") {
       jenkins.gid = config.ids.gids.jenkins;
     };
 
diff --git a/nixos/modules/services/databases/openldap.nix b/nixos/modules/services/databases/openldap.nix
index 5bf57a1bf9cb..809f61cfa818 100644
--- a/nixos/modules/services/databases/openldap.nix
+++ b/nixos/modules/services/databases/openldap.nix
@@ -259,6 +259,8 @@ in
           ${openldap.out}/bin/slapadd ${configOpts} -l ${dataFile}
         ''}
         chown -R "${cfg.user}:${cfg.group}" "${cfg.dataDir}"
+
+        ${openldap}/bin/slaptest ${configOpts}
       '';
       serviceConfig.ExecStart =
         "${openldap.out}/libexec/slapd -d '${cfg.logLevel}' " +
diff --git a/nixos/modules/services/hardware/usbmuxd.nix b/nixos/modules/services/hardware/usbmuxd.nix
index 50b931dcb487..11a4b0a858f9 100644
--- a/nixos/modules/services/hardware/usbmuxd.nix
+++ b/nixos/modules/services/hardware/usbmuxd.nix
@@ -51,7 +51,7 @@ in
       };
     };
 
-    users.groups = optional (cfg.group == defaultUserGroup) {
+    users.groups = optionalAttrs (cfg.group == defaultUserGroup) {
       ${cfg.group} = { };
     };
 
diff --git a/nixos/modules/services/mail/postfix.nix b/nixos/modules/services/mail/postfix.nix
index d7378821440d..19e11b31d9ca 100644
--- a/nixos/modules/services/mail/postfix.nix
+++ b/nixos/modules/services/mail/postfix.nix
@@ -612,10 +612,7 @@ in
     {
 
       environment = {
-        etc = singleton
-          { source = "/var/lib/postfix/conf";
-            target = "postfix";
-          };
+        etc.postfix.source = "/var/lib/postfix/conf";
 
         # This makes it comfortable to run 'postqueue/postdrop' for example.
         systemPackages = [ pkgs.postfix ];
diff --git a/nixos/modules/services/mail/spamassassin.nix b/nixos/modules/services/mail/spamassassin.nix
index 07b3bf0420aa..75442c7cdb5e 100644
--- a/nixos/modules/services/mail/spamassassin.nix
+++ b/nixos/modules/services/mail/spamassassin.nix
@@ -124,7 +124,7 @@ in
     # Allow users to run 'spamc'.
 
     environment = {
-      etc = singleton { source = spamdEnv; target = "spamassassin"; };
+      etc.spamassassin.source = spamdEnv;
       systemPackages = [ pkgs.spamassassin ];
     };
 
diff --git a/nixos/modules/services/misc/gitea.nix b/nixos/modules/services/misc/gitea.nix
index 258476dd9feb..38910a5a005d 100644
--- a/nixos/modules/services/misc/gitea.nix
+++ b/nixos/modules/services/misc/gitea.nix
@@ -364,7 +364,7 @@ in
           ''}
           sed -e "s,#secretkey#,$KEY,g" \
               -e "s,#dbpass#,$DBPASS,g" \
-              -e "s,#jwtsecet#,$JWTSECET,g" \
+              -e "s,#jwtsecret#,$JWTSECRET,g" \
               -e "s,#mailerpass#,$MAILERPASSWORD,g" \
               -i ${runConfig}
           chmod 640 ${runConfig} ${secretKey} ${jwtSecret}
diff --git a/nixos/modules/services/misc/paperless.nix b/nixos/modules/services/misc/paperless.nix
index 3985dc0b303c..bfaf760fb836 100644
--- a/nixos/modules/services/misc/paperless.nix
+++ b/nixos/modules/services/misc/paperless.nix
@@ -123,9 +123,9 @@ in
   config = mkIf cfg.enable {
 
     systemd.tmpfiles.rules = [
-      "d '${cfg.dataDir}' - ${cfg.user} ${cfg.user} - -"
+      "d '${cfg.dataDir}' - ${cfg.user} ${config.users.users.${cfg.user}.group} - -"
     ] ++ (optional cfg.consumptionDirIsPublic
-      "d '${cfg.consumptionDir}' 777 ${cfg.user} ${cfg.user} - -"
+      "d '${cfg.consumptionDir}' 777 - - - -"
       # If the consumption dir is not created here, it's automatically created by
       # 'manage' with the default permissions.
     );
@@ -169,17 +169,15 @@ in
     };
 
     users = optionalAttrs (cfg.user == defaultUser) {
-      users = [{
-        name = defaultUser;
+      users.${defaultUser} = {
         group = defaultUser;
         uid = config.ids.uids.paperless;
         home = cfg.dataDir;
-      }];
+      };
 
-      groups = [{
-        name = defaultUser;
+      groups.${defaultUser} = {
         gid = config.ids.gids.paperless;
-      }];
+      };
     };
   };
 }
diff --git a/nixos/modules/services/networking/ndppd.nix b/nixos/modules/services/networking/ndppd.nix
index 92088623517f..e015f76f622b 100644
--- a/nixos/modules/services/networking/ndppd.nix
+++ b/nixos/modules/services/networking/ndppd.nix
@@ -161,7 +161,25 @@ in {
       documentation = [ "man:ndppd(1)" "man:ndppd.conf(5)" ];
       after = [ "network-pre.target" ];
       wantedBy = [ "multi-user.target" ];
-      serviceConfig.ExecStart = "${pkgs.ndppd}/bin/ndppd -c ${ndppdConf}";
+      serviceConfig = {
+        ExecStart = "${pkgs.ndppd}/bin/ndppd -c ${ndppdConf}";
+
+        # Sandboxing
+        CapabilityBoundingSet = "CAP_NET_RAW CAP_NET_ADMIN";
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectControlGroups = true;
+        RestrictAddressFamilies = "AF_INET6 AF_PACKET AF_NETLINK";
+        RestrictNamespaces = true;
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+      };
     };
   };
 }
diff --git a/nixos/modules/services/networking/wpa_supplicant.nix b/nixos/modules/services/networking/wpa_supplicant.nix
index 8f05c3949fba..de0f11595a94 100644
--- a/nixos/modules/services/networking/wpa_supplicant.nix
+++ b/nixos/modules/services/networking/wpa_supplicant.nix
@@ -233,6 +233,7 @@ in {
       path = [ pkgs.wpa_supplicant ];
 
       script = ''
+        iface_args="-s -u -D${cfg.driver} -c ${configFile}"
         ${if ifaces == [] then ''
           for i in $(cd /sys/class/net && echo *); do
             DEVTYPE=
@@ -240,14 +241,14 @@ in {
             if [ -e "$UEVENT_PATH" ]; then
               source "$UEVENT_PATH"
               if [ "$DEVTYPE" = "wlan" -o -e /sys/class/net/$i/wireless ]; then
-                ifaces="$ifaces''${ifaces:+ -N} -i$i"
+                args+="''${args:+ -N} -i$i $iface_args"
               fi
             fi
           done
         '' else ''
-          ifaces="${concatStringsSep " -N " (map (i: "-i${i}") ifaces)}"
+          args="${concatMapStringsSep " -N " (i: "-i${i} $iface_args") ifaces}"
         ''}
-        exec wpa_supplicant -s -u -D${cfg.driver} -c ${configFile} $ifaces
+        exec wpa_supplicant $args
       '';
     };
 
diff --git a/nixos/modules/services/networking/xandikos.nix b/nixos/modules/services/networking/xandikos.nix
new file mode 100644
index 000000000000..87c029156b9e
--- /dev/null
+++ b/nixos/modules/services/networking/xandikos.nix
@@ -0,0 +1,148 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.xandikos;
+in
+{
+
+  options = {
+    services.xandikos = {
+      enable = mkEnableOption "Xandikos CalDAV and CardDAV server";
+
+      package = mkOption {
+        type = types.package;
+        default = pkgs.xandikos;
+        defaultText = "pkgs.xandikos";
+        description = "The Xandikos package to use.";
+      };
+
+      address = mkOption {
+        type = types.str;
+        default = "localhost";
+        description = ''
+          The IP address on which Xandikos will listen.
+          By default listens on localhost.
+        '';
+      };
+
+      port = mkOption {
+        type = types.port;
+        default = 8080;
+        description = "The port of the Xandikos web application";
+      };
+
+      routePrefix = mkOption {
+        type = types.str;
+        default = "/";
+        description = ''
+          Path to Xandikos.
+          Useful when Xandikos is behind a reverse proxy.
+        '';
+      };
+
+      extraOptions = mkOption {
+        default = [];
+        type = types.listOf types.str;
+        example = literalExample ''
+          [ "--autocreate"
+            "--defaults"
+            "--current-user-principal user"
+            "--dump-dav-xml"
+          ]
+        '';
+        description = ''
+          Extra command line arguments to pass to xandikos.
+        '';
+      };
+
+      nginx = mkOption {
+        default = {};
+        description = ''
+          Configuration for nginx reverse proxy.
+        '';
+
+        type = types.submodule {
+          options = {
+            enable = mkOption {
+              type = types.bool;
+              default = false;
+              description = ''
+                Configure the nginx reverse proxy settings.
+              '';
+            };
+
+            hostName = mkOption {
+              type = types.str;
+              description = ''
+                The hostname use to setup the virtualhost configuration
+              '';
+            };
+          };
+        };
+      };
+
+    };
+
+  };
+
+  config = mkIf cfg.enable (
+    mkMerge [
+      {
+        meta.maintainers = [ lib.maintainers."0x4A6F" ];
+
+        systemd.services.xandikos = {
+          description = "A Simple Calendar and Contact Server";
+          after = [ "network.target" ];
+          wantedBy = [ "multi-user.target" ];
+
+          serviceConfig = {
+            User = "xandikos";
+            Group = "xandikos";
+            DynamicUser = "yes";
+            RuntimeDirectory = "xandikos";
+            StateDirectory = "xandikos";
+            StateDirectoryMode = "0700";
+            PrivateDevices = true;
+            # Sandboxing
+            CapabilityBoundingSet = "CAP_NET_RAW CAP_NET_ADMIN";
+            ProtectSystem = "strict";
+            ProtectHome = true;
+            PrivateTmp = true;
+            ProtectKernelTunables = true;
+            ProtectKernelModules = true;
+            ProtectControlGroups = true;
+            RestrictAddressFamilies = "AF_INET AF_INET6 AF_UNIX AF_PACKET AF_NETLINK";
+            RestrictNamespaces = true;
+            LockPersonality = true;
+            MemoryDenyWriteExecute = true;
+            RestrictRealtime = true;
+            RestrictSUIDSGID = true;
+            ExecStart = ''
+              ${cfg.package}/bin/xandikos \
+                --directory /var/lib/xandikos \
+                --listen_address ${cfg.address} \
+                --port ${toString cfg.port} \
+                --route-prefix ${cfg.routePrefix} \
+                ${lib.concatStringsSep " " cfg.extraOptions}
+            '';
+          };
+        };
+      }
+
+      (
+        mkIf cfg.nginx.enable {
+          services.nginx = {
+            enable = true;
+            virtualHosts."${cfg.nginx.hostName}" = {
+              locations."/" = {
+                proxyPass = "http://${cfg.address}:${toString cfg.port}/";
+              };
+            };
+          };
+        }
+      )
+    ]
+  );
+}
diff --git a/nixos/modules/services/security/certmgr.nix b/nixos/modules/services/security/certmgr.nix
index e89078883ebe..94c0ba141179 100644
--- a/nixos/modules/services/security/certmgr.nix
+++ b/nixos/modules/services/security/certmgr.nix
@@ -113,7 +113,7 @@ in
         otherCert = "/var/certmgr/specs/other-cert.json";
       }
       '';
-      type = with types; attrsOf (either (submodule {
+      type = with types; attrsOf (either path (submodule {
         options = {
           service = mkOption {
             type = nullOr str;
@@ -148,7 +148,7 @@ in
             description = "certmgr spec request object.";
           };
         };
-    }) path);
+    }));
       description = ''
         Certificate specs as described by:
         <link xlink:href="https://github.com/cloudflare/certmgr#certificate-specs" />
diff --git a/nixos/modules/services/torrent/transmission.nix b/nixos/modules/services/torrent/transmission.nix
index aa1acdf7d20b..5ba72e8d7730 100644
--- a/nixos/modules/services/torrent/transmission.nix
+++ b/nixos/modules/services/torrent/transmission.nix
@@ -129,19 +129,23 @@ in
     # It's useful to have transmission in path, e.g. for remote control
     environment.systemPackages = [ pkgs.transmission ];
 
-    users.users = optionalAttrs (cfg.user == "transmission") (singleton
-      { name = "transmission";
+    users.users = optionalAttrs (cfg.user == "transmission") ({
+      transmission = {
+        name = "transmission";
         group = cfg.group;
         uid = config.ids.uids.transmission;
         description = "Transmission BitTorrent user";
         home = homeDir;
         createHome = true;
-      });
+      };
+    });
 
-    users.groups = optionalAttrs (cfg.group == "transmission") (singleton
-      { name = "transmission";
+    users.groups = optionalAttrs (cfg.group == "transmission") ({
+      transmission = {
+        name = "transmission";
         gid = config.ids.gids.transmission;
-      });
+      };
+    });
 
     # AppArmor profile
     security.apparmor.profiles = mkIf apparmor [
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index fe9c4df1416f..67dfd931d4bf 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -295,6 +295,7 @@ in
   wireguard-generated = handleTest ./wireguard/generated.nix {};
   wireguard-namespaces = handleTest ./wireguard/namespaces.nix {};
   wordpress = handleTest ./wordpress.nix {};
+  xandikos = handleTest ./xandikos.nix {};
   xautolock = handleTest ./xautolock.nix {};
   xfce = handleTest ./xfce.nix {};
   xmonad = handleTest ./xmonad.nix {};
diff --git a/nixos/tests/bittorrent.nix b/nixos/tests/bittorrent.nix
index e5be652c7112..0a97d5556a26 100644
--- a/nixos/tests/bittorrent.nix
+++ b/nixos/tests/bittorrent.nix
@@ -18,6 +18,17 @@ let
   externalRouterAddress = "80.100.100.1";
   externalClient2Address = "80.100.100.2";
   externalTrackerAddress = "80.100.100.3";
+
+  transmissionConfig = { ... }: {
+    environment.systemPackages = [ pkgs.transmission ];
+    services.transmission = {
+      enable = true;
+      settings = {
+        dht-enabled = false;
+        message-level = 3;
+      };
+    };
+  };
 in
 
 {
@@ -26,88 +37,79 @@ in
     maintainers = [ domenkozar eelco rob bobvanderlinden ];
   };
 
-  nodes =
-    { tracker =
-        { pkgs, ... }:
-        { environment.systemPackages = [ pkgs.transmission ];
-
-          virtualisation.vlans = [ 1 ];
-          networking.interfaces.eth1.ipv4.addresses = [
-            { address = externalTrackerAddress; prefixLength = 24; }
-          ];
-
-          # We need Apache on the tracker to serve the torrents.
-          services.httpd.enable = true;
-          services.httpd.adminAddr = "foo@example.org";
-          services.httpd.documentRoot = "/tmp";
-
-          networking.firewall.enable = false;
-
-          services.opentracker.enable = true;
-
-          services.transmission.enable = true;
-          services.transmission.settings.dht-enabled = false;
-          services.transmission.settings.port-forwaring-enabled = false;
-        };
-
-      router =
-        { pkgs, nodes, ... }:
-        { virtualisation.vlans = [ 1 2 ];
-          networking.nat.enable = true;
-          networking.nat.internalInterfaces = [ "eth2" ];
-          networking.nat.externalInterface = "eth1";
-          networking.firewall.enable = true;
-          networking.firewall.trustedInterfaces = [ "eth2" ];
-          networking.interfaces.eth0.ipv4.addresses = [];
-          networking.interfaces.eth1.ipv4.addresses = [
-            { address = externalRouterAddress; prefixLength = 24; }
-          ];
-          networking.interfaces.eth2.ipv4.addresses = [
-            { address = internalRouterAddress; prefixLength = 24; }
-          ];
-          services.miniupnpd = {
-            enable = true;
-            externalInterface = "eth1";
-            internalIPs = [ "eth2" ];
-            appendConfig = ''
-              ext_ip=${externalRouterAddress}
-            '';
+  nodes = {
+    tracker = { pkgs, ... }: {
+      imports = [ transmissionConfig ];
+
+      virtualisation.vlans = [ 1 ];
+      networking.firewall.enable = false;
+      networking.interfaces.eth1.ipv4.addresses = [
+        { address = externalTrackerAddress; prefixLength = 24; }
+      ];
+
+      # We need Apache on the tracker to serve the torrents.
+      services.httpd = {
+        enable = true;
+        virtualHosts = {
+          "torrentserver.org" = {
+            adminAddr = "foo@example.org";
+            documentRoot = "/tmp";
           };
         };
+      };
+      services.opentracker.enable = true;
+    };
 
-      client1 =
-        { pkgs, nodes, ... }:
-        { environment.systemPackages = [ pkgs.transmission pkgs.miniupnpc ];
-          virtualisation.vlans = [ 2 ];
-          networking.interfaces.eth0.ipv4.addresses = [];
-          networking.interfaces.eth1.ipv4.addresses = [
-            { address = internalClient1Address; prefixLength = 24; }
-          ];
-          networking.defaultGateway = internalRouterAddress;
-          networking.firewall.enable = false;
-          services.transmission.enable = true;
-          services.transmission.settings.dht-enabled = false;
-          services.transmission.settings.message-level = 3;
-        };
+    router = { pkgs, nodes, ... }: {
+      virtualisation.vlans = [ 1 2 ];
+      networking.nat.enable = true;
+      networking.nat.internalInterfaces = [ "eth2" ];
+      networking.nat.externalInterface = "eth1";
+      networking.firewall.enable = true;
+      networking.firewall.trustedInterfaces = [ "eth2" ];
+      networking.interfaces.eth0.ipv4.addresses = [];
+      networking.interfaces.eth1.ipv4.addresses = [
+        { address = externalRouterAddress; prefixLength = 24; }
+      ];
+      networking.interfaces.eth2.ipv4.addresses = [
+        { address = internalRouterAddress; prefixLength = 24; }
+      ];
+      services.miniupnpd = {
+        enable = true;
+        externalInterface = "eth1";
+        internalIPs = [ "eth2" ];
+        appendConfig = ''
+          ext_ip=${externalRouterAddress}
+        '';
+      };
+    };
 
-      client2 =
-        { pkgs, ... }:
-        { environment.systemPackages = [ pkgs.transmission ];
-          virtualisation.vlans = [ 1 ];
-          networking.interfaces.eth0.ipv4.addresses = [];
-          networking.interfaces.eth1.ipv4.addresses = [
-            { address = externalClient2Address; prefixLength = 24; }
-          ];
-          networking.firewall.enable = false;
-          services.transmission.enable = true;
-          services.transmission.settings.dht-enabled = false;
-          services.transmission.settings.port-forwaring-enabled = false;
-        };
+    client1 = { pkgs, nodes, ... }: {
+      imports = [ transmissionConfig ];
+      environment.systemPackages = [ pkgs.miniupnpc ];
+
+      virtualisation.vlans = [ 2 ];
+      networking.interfaces.eth0.ipv4.addresses = [];
+      networking.interfaces.eth1.ipv4.addresses = [
+        { address = internalClient1Address; prefixLength = 24; }
+      ];
+      networking.defaultGateway = internalRouterAddress;
+      networking.firewall.enable = false;
     };
 
-  testScript =
-    { nodes, ... }:
-    ''
+    client2 = { pkgs, ... }: {
+      imports = [ transmissionConfig ];
+
+      virtualisation.vlans = [ 1 ];
+      networking.interfaces.eth0.ipv4.addresses = [];
+      networking.interfaces.eth1.ipv4.addresses = [
+        { address = externalClient2Address; prefixLength = 24; }
+      ];
+      networking.firewall.enable = false;
+    };
+  };
+
+  testScript = { nodes, ... }: ''
       start_all()
 
       # Wait for network and miniupnpd.
@@ -159,5 +161,4 @@ in
           "cmp /tmp/test.tar.bz2 ${file}"
       )
     '';
-
 })
diff --git a/nixos/tests/xandikos.nix b/nixos/tests/xandikos.nix
new file mode 100644
index 000000000000..0fded20ff1a9
--- /dev/null
+++ b/nixos/tests/xandikos.nix
@@ -0,0 +1,70 @@
+import ./make-test-python.nix (
+  { pkgs, lib, ... }:
+
+    {
+      name = "xandikos";
+
+      meta.maintainers = [ lib.maintainers."0x4A6F" ];
+
+      nodes = {
+        xandikos_client = {};
+        xandikos_default = {
+          networking.firewall.allowedTCPPorts = [ 8080 ];
+          services.xandikos.enable = true;
+        };
+        xandikos_proxy = {
+          networking.firewall.allowedTCPPorts = [ 80 8080 ];
+          services.xandikos.enable = true;
+          services.xandikos.address = "localhost";
+          services.xandikos.port = 8080;
+          services.xandikos.routePrefix = "/xandikos/";
+          services.xandikos.extraOptions = [
+            "--defaults"
+          ];
+          services.nginx = {
+            enable = true;
+            recommendedProxySettings = true;
+            virtualHosts."xandikos" = {
+              serverName = "xandikos.local";
+              basicAuth.xandikos = "snakeOilPassword";
+              locations."/xandikos/" = {
+                proxyPass = "http://localhost:8080/";
+              };
+            };
+          };
+        };
+      };
+
+      testScript = ''
+        start_all()
+
+        with subtest("Xandikos default"):
+            xandikos_default.wait_for_unit("multi-user.target")
+            xandikos_default.wait_for_unit("xandikos.service")
+            xandikos_default.wait_for_open_port(8080)
+            xandikos_default.succeed("curl --fail http://localhost:8080/")
+            xandikos_default.succeed(
+                "curl -s --fail --location http://localhost:8080/ | grep -qi Xandikos"
+            )
+            xandikos_client.wait_for_unit("network.target")
+            xandikos_client.fail("curl --fail http://xandikos_default:8080/")
+
+        with subtest("Xandikos proxy"):
+            xandikos_proxy.wait_for_unit("multi-user.target")
+            xandikos_proxy.wait_for_unit("xandikos.service")
+            xandikos_proxy.wait_for_open_port(8080)
+            xandikos_proxy.succeed("curl --fail http://localhost:8080/")
+            xandikos_proxy.succeed(
+                "curl -s --fail --location http://localhost:8080/ | grep -qi Xandikos"
+            )
+            xandikos_client.wait_for_unit("network.target")
+            xandikos_client.fail("curl --fail http://xandikos_proxy:8080/")
+            xandikos_client.succeed(
+                "curl -s --fail -u xandikos:snakeOilPassword -H 'Host: xandikos.local' http://xandikos_proxy/xandikos/ | grep -qi Xandikos"
+            )
+            xandikos_client.succeed(
+                "curl -s --fail -u xandikos:snakeOilPassword -H 'Host: xandikos.local' http://xandikos_proxy/xandikos/user/ | grep -qi Xandikos"
+            )
+      '';
+    }
+)
diff --git a/pkgs/applications/audio/pavucontrol/default.nix b/pkgs/applications/audio/pavucontrol/default.nix
index fee86cb5bcae..d07cf8a476b5 100644
--- a/pkgs/applications/audio/pavucontrol/default.nix
+++ b/pkgs/applications/audio/pavucontrol/default.nix
@@ -1,5 +1,5 @@
 { fetchurl, stdenv, pkgconfig, intltool, libpulseaudio, gtkmm3
-, libcanberra-gtk3, makeWrapper, gnome3 }:
+, libcanberra-gtk3, gnome3, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
   pname = "pavucontrol";
@@ -10,16 +10,10 @@ stdenv.mkDerivation rec {
     sha256 = "1qhlkl3g8d7h72xjskii3g1l7la2cavwp69909pzmbi2jyn5pi4g";
   };
 
-  preFixup = ''
-    wrapProgram "$out/bin/pavucontrol" \
-     --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE" \
-     --prefix XDG_DATA_DIRS : "$XDG_ICON_DIRS"
-  '';
-
-  buildInputs = [ libpulseaudio gtkmm3 libcanberra-gtk3 makeWrapper
+  buildInputs = [ libpulseaudio gtkmm3 libcanberra-gtk3
                   gnome3.adwaita-icon-theme ];
 
-  nativeBuildInputs = [ pkgconfig intltool ];
+  nativeBuildInputs = [ pkgconfig intltool wrapGAppsHook ];
 
   configureFlags = [ "--disable-lynx" ];
 
diff --git a/pkgs/applications/audio/spotifyd/default.nix b/pkgs/applications/audio/spotifyd/default.nix
index 36ab017c5cbb..b80638110306 100644
--- a/pkgs/applications/audio/spotifyd/default.nix
+++ b/pkgs/applications/audio/spotifyd/default.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "spotifyd";
-  version = "0.2.20";
+  version = "0.2.23";
 
   src = fetchFromGitHub {
     owner = "Spotifyd";
     repo = "spotifyd";
     rev = "v${version}";
-    sha256 = "1hf4wpk7r0s4jpjhxaz67y1hd8jx9ns5imd85r3cdg4lxf3j5gph";
+    sha256 = "0xxr21avgr4pvlr5vgb68jmad5xy5kqvaxfzh0qn1jpiax7y3avm";
   };
 
-  cargoSha256 = "1h3fis47hmxvppiv1icjhgp48nd46gayfcmzfjs34q6jask90n0w";
+  cargoSha256 = "1ykmn7zzwn9my96bbxwkparab5lck1zzdkpafil2mmrjyvyi40da";
 
   cargoBuildFlags = [
     "--no-default-features"
diff --git a/pkgs/applications/editors/emacs-modes/elpa-generated.nix b/pkgs/applications/editors/emacs-modes/elpa-generated.nix
index bfbddb6fc37c..9d4fb66f7322 100644
--- a/pkgs/applications/editors/emacs-modes/elpa-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/elpa-generated.nix
@@ -3236,10 +3236,10 @@
       elpaBuild {
         pname = "undo-tree";
         ename = "undo-tree";
-        version = "0.7";
+        version = "0.7.2";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/undo-tree-0.7.el";
-          sha256 = "0mc5spiqx20z8vh8b24dp9hqj27h5bm5wqk0ga7c6s6mp69r72h4";
+          url = "https://elpa.gnu.org/packages/undo-tree-0.7.2.el";
+          sha256 = "0gdqh5rkgwlancbjx5whgl5gqkdipdkspkl2bqmrq70sgg5ahrcc";
         };
         packageRequires = [];
         meta = {
@@ -3734,4 +3734,4 @@
           license = lib.licenses.free;
         };
       }) {};
-  }
\ No newline at end of file
+  }
diff --git a/pkgs/applications/editors/emacs-modes/melpa-packages.nix b/pkgs/applications/editors/emacs-modes/melpa-packages.nix
index e15da80b3b1b..5c9456b76a63 100644
--- a/pkgs/applications/editors/emacs-modes/melpa-packages.nix
+++ b/pkgs/applications/editors/emacs-modes/melpa-packages.nix
@@ -111,6 +111,11 @@ env NIXPKGS_ALLOW_BROKEN=1 nix-instantiate --show-trace ../../../../ -A emacsPac
 
         flycheck-rtags = fix-rtags super.flycheck-rtags;
 
+        gnuplot = super.gnuplot.overrideAttrs (old: {
+          nativeBuildInputs =
+            (old.nativeBuildInputs or []) ++ [ pkgs.autoreconfHook ];
+        });
+
         pdf-tools = super.pdf-tools.overrideAttrs(old: {
           nativeBuildInputs = [ external.pkgconfig ];
           buildInputs = with external; old.buildInputs ++ [ autoconf automake libpng zlib poppler ];
diff --git a/pkgs/applications/editors/neovim/qt.nix b/pkgs/applications/editors/neovim/qt.nix
index 3a46f68e7755..8fe93d37c7e8 100644
--- a/pkgs/applications/editors/neovim/qt.nix
+++ b/pkgs/applications/editors/neovim/qt.nix
@@ -4,13 +4,13 @@
 let
   unwrapped = mkDerivation rec {
     pname = "neovim-qt-unwrapped";
-    version = "0.2.12";
+    version = "0.2.15";
 
     src = fetchFromGitHub {
       owner  = "equalsraf";
       repo   = "neovim-qt";
       rev    = "v${version}";
-      sha256 = "09s3044j0y8nmyi8ykslfii6fx7k9mckmdvb0jn2xmdabpb60i20";
+      sha256 = "097nykglqp4jyvla4yp32sc1f1hph4cqqhp6rm9ww7br8c0j54xl";
     };
 
     cmakeFlags = [
diff --git a/pkgs/applications/graphics/openimageio/default.nix b/pkgs/applications/graphics/openimageio/default.nix
index c743f8bd6532..23cad7e859df 100644
--- a/pkgs/applications/graphics/openimageio/default.nix
+++ b/pkgs/applications/graphics/openimageio/default.nix
@@ -39,6 +39,5 @@ stdenv.mkDerivation rec {
     license = licenses.bsd3;
     maintainers = [ maintainers.goibhniu ];
     platforms = platforms.unix;
-    badPlatforms = [ "x86_64-darwin" ];
   };
 }
diff --git a/pkgs/applications/graphics/paraview/default.nix b/pkgs/applications/graphics/paraview/default.nix
index 1a47a3557493..ddf7c5370623 100644
--- a/pkgs/applications/graphics/paraview/default.nix
+++ b/pkgs/applications/graphics/paraview/default.nix
@@ -30,7 +30,7 @@ mkDerivation rec {
   # libraries.  These reside in build/lib, and are not found by
   # default.
   preBuild = ''
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/lib:$PWD/VTK/ThirdParty/vtkm/vtk-m/lib
+    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib:$PWD/VTK/ThirdParty/vtkm/vtk-m/lib
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/graphics/pencil/default.nix b/pkgs/applications/graphics/pencil/default.nix
index 37857fc459ea..edd923822ea3 100644
--- a/pkgs/applications/graphics/pencil/default.nix
+++ b/pkgs/applications/graphics/pencil/default.nix
@@ -1,32 +1,72 @@
-{ stdenv, fetchurl, lib, makeWrapper,
+{ stdenv, fetchurl, lib, makeWrapper, wrapGAppsHook,
   # build dependencies
-  alsaLib, atk, cairo, cups, dbus, expat, fontconfig,
-  freetype, gdk-pixbuf, glib, gnome2, nspr, nss, xorg,
-  glibc, systemd
+  alsaLib, atk, at-spi2-atk, at-spi2-core, cairo, cups, dbus, expat, fontconfig,
+  freetype, gdk-pixbuf, glib, glibc, gtk3, libuuid, nspr, nss, pango,
+  xorg, systemd
 }:
+let
 
-stdenv.mkDerivation rec {
-  version = "3.0.4";
+  deps = [
+    alsaLib
+    atk
+    at-spi2-atk
+    at-spi2-core
+    cairo
+    cups
+    dbus
+    expat
+    fontconfig
+    freetype
+    gdk-pixbuf
+    glib
+    glibc
+    gtk3
+    libuuid
+    nspr
+    nss
+    pango
+    xorg.libX11
+    xorg.libxcb
+    xorg.libXScrnSaver
+    xorg.libXcomposite
+    xorg.libXcursor
+    xorg.libXdamage
+    xorg.libXext
+    xorg.libXfixes
+    xorg.libXi
+    xorg.libXrandr
+    xorg.libXrender
+    xorg.libXtst
+    stdenv.cc.cc.lib
+    stdenv.cc.cc
+  ];
+
+in stdenv.mkDerivation rec {
+  version = "3.1.0";
   pname = "pencil";
 
   src = fetchurl {
-    url    = "http://pencil.evolus.vn/dl/V${version}/Pencil_${version}_amd64.deb";
-    sha256 = "58e2b794c615ea8715d8374f177e19c87f7071e359826ec34a59836d537a62fd";
+    url    = "http://pencil.evolus.vn/dl/V${version}.ga/pencil_${version}.ga_amd64.deb";
+    sha256 = "01ae54b1a1351b909eb2366c6ec00816e1deba370e58f35601cf7368f10aaba3";
   };
 
   sourceRoot = ".";
 
   unpackCmd = ''
-    ar p "$src" data.tar.xz | tar xJ
+    ar p "$src" data.tar.gz | tar xz
   '';
 
   dontBuild = true;
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper wrapGAppsHook ];
+
+  buildInputs = deps;
 
   installPhase = ''
-    mkdir -p $out/bin
-    cp -R usr/share opt $out/
+    mkdir -p $out/bin $out/opt $out/share/applications
+    cp -R usr/share $out/
+    cp -R opt/pencil*/ $out/opt/pencil
+    cp $out/opt/pencil/pencil.desktop $out/share/applications/
 
     # fix the path in the desktop file
     substituteInPlace \
@@ -34,42 +74,12 @@ stdenv.mkDerivation rec {
       --replace /opt/ $out/opt/
 
     # symlink the binary to bin/
-    ln -s $out/opt/Pencil/pencil $out/bin/pencil
+    ln -s $out/opt/pencil/pencil $out/bin/pencil
   '';
 
 
   preFixup = let
-    packages = [
-      alsaLib
-      atk
-      cairo
-      cups
-      dbus
-      expat
-      fontconfig
-      freetype
-      gdk-pixbuf
-      glib
-      gnome2.GConf
-      gnome2.gtk
-      gnome2.pango
-      nspr
-      nss
-      xorg.libX11
-      xorg.libXScrnSaver
-      xorg.libXcomposite
-      xorg.libXcursor
-      xorg.libXdamage
-      xorg.libXext
-      xorg.libXfixes
-      xorg.libXi
-      xorg.libXrandr
-      xorg.libXrender
-      xorg.libXtst
-      stdenv.cc.cc.lib
-      stdenv.cc.cc
-      glibc
-    ];
+    packages = deps;
     libPathNative = lib.makeLibraryPath packages;
     libPath64 = lib.makeSearchPathOutput "lib" "lib64" packages;
     libPath = "${libPathNative}:${libPath64}";
@@ -77,21 +87,13 @@ stdenv.mkDerivation rec {
     # patch executable
     patchelf \
       --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-      --set-rpath "${libPath}:$out/opt/Pencil" \
-      $out/opt/Pencil/pencil
-
-    # patch libnode
-    patchelf \
-      --set-rpath "${libPath}" \
-      $out/opt/Pencil/libnode.so
-
-    # libffmpeg is for some reason  not executable
-    chmod a+x $out/opt/Pencil/libffmpeg.so
+      --set-rpath "${libPath}:$out/opt/pencil" \
+      $out/opt/pencil/pencil
 
     # fix missing libudev
-    ln -s ${systemd.lib}/lib/libudev.so.1 $out/opt/Pencil/libudev.so.1
-    wrapProgram $out/opt/Pencil/pencil \
-      --prefix LD_LIBRARY_PATH : $out/opt/Pencil
+    ln -s ${systemd.lib}/lib/libudev.so.1 $out/opt/pencil/libudev.so.1
+    wrapProgram $out/opt/pencil/pencil \
+      --prefix LD_LIBRARY_PATH : $out/opt/pencil
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/graphics/rx/default.nix b/pkgs/applications/graphics/rx/default.nix
index f2b56b578b6e..3093fa107d6b 100644
--- a/pkgs/applications/graphics/rx/default.nix
+++ b/pkgs/applications/graphics/rx/default.nix
@@ -7,13 +7,13 @@ with stdenv.lib;
 
 rustPlatform.buildRustPackage rec {
   pname = "rx";
-  version = "0.3.1";
+  version = "0.3.2";
 
   src = fetchFromGitHub {
     owner = "cloudhead";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1byaxbhd3q49473kcdd52rvn3xq7bmy8bdx3pz0jiw96bclzhcgq";
+    sha256 = "1n5s7v2z13550gkqz7w6dw62jdy60wdi8w1lfa23609b4yhg4w94";
   };
 
   cargoSha256 = "173jfjvdag97f6jvfg366hjk9v3cz301cbzpcahy51rbf1cip1w1";
diff --git a/pkgs/applications/misc/audio/soxr/default.nix b/pkgs/applications/misc/audio/soxr/default.nix
index 7c4e6ff8c3d7..20a754ba98ae 100644
--- a/pkgs/applications/misc/audio/soxr/default.nix
+++ b/pkgs/applications/misc/audio/soxr/default.nix
@@ -11,9 +11,9 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "doc" ]; # headers are just two and very small
 
   preConfigure = if stdenv.isDarwin then ''
-    export DYLD_LIBRARY_PATH="$DYLD_LIBRARY_PATH:"`pwd`/build/src
+    export DYLD_LIBRARY_PATH="$DYLD_LIBRARY_PATH''${DYLD_LIBRARY_PATH:+:}"`pwd`/build/src
   '' else ''
-    export LD_LIBRARY_PATH="$LD_LIBRARY_PATH:"`pwd`/build/src
+    export LD_LIBRARY_PATH="$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}"`pwd`/build/src
   '';
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/misc/blender/darwin.patch b/pkgs/applications/misc/blender/darwin.patch
new file mode 100644
index 000000000000..43b96466df28
--- /dev/null
+++ b/pkgs/applications/misc/blender/darwin.patch
@@ -0,0 +1,105 @@
+diff a/build_files/cmake/platform/platform_apple.cmake b/build_files/cmake/platform/platform_apple.cmake
+--- a/build_files/cmake/platform/platform_apple.cmake
++++ b/build_files/cmake/platform/platform_apple.cmake
+@@ -35,7 +35,6 @@ else()
+   message(STATUS "Using pre-compiled LIBDIR: ${LIBDIR}")
+ endif()
+ if(NOT EXISTS "${LIBDIR}/")
+-  message(FATAL_ERROR "Mac OSX requires pre-compiled libs at: '${LIBDIR}'")
+ endif()
+ 
+ if(WITH_OPENAL)
+@@ -79,7 +78,7 @@ endif()
+ if(WITH_CODEC_SNDFILE)
+   set(LIBSNDFILE ${LIBDIR}/sndfile)
+   set(LIBSNDFILE_INCLUDE_DIRS ${LIBSNDFILE}/include)
+-  set(LIBSNDFILE_LIBRARIES sndfile FLAC ogg vorbis vorbisenc)
++  set(LIBSNDFILE_LIBRARIES sndfile)
+   set(LIBSNDFILE_LIBPATH ${LIBSNDFILE}/lib ${LIBDIR}/ffmpeg/lib)  # TODO, deprecate
+ endif()
+ 
+@@ -90,7 +89,7 @@ if(WITH_PYTHON)
+     # normally cached but not since we include them with blender
+     set(PYTHON_INCLUDE_DIR "${LIBDIR}/python/include/python${PYTHON_VERSION}m")
+     set(PYTHON_EXECUTABLE "${LIBDIR}/python/bin/python${PYTHON_VERSION}m")
+-    set(PYTHON_LIBRARY ${LIBDIR}/python/lib/libpython${PYTHON_VERSION}m.a)
++    set(PYTHON_LIBRARY "${LIBDIR}/python/lib/libpython${PYTHON_VERSION}m.dylib")
+     set(PYTHON_LIBPATH "${LIBDIR}/python/lib/python${PYTHON_VERSION}")
+     # set(PYTHON_LINKFLAGS "-u _PyMac_Error")  # won't  build with this enabled
+   else()
+@@ -155,10 +154,7 @@ if(WITH_CODEC_FFMPEG)
+   set(FFMPEG_INCLUDE_DIRS ${FFMPEG}/include)
+   set(FFMPEG_LIBRARIES
+     avcodec avdevice avformat avutil
+-    mp3lame swscale x264 xvidcore
+-    theora theoradec theoraenc
+-    vorbis vorbisenc vorbisfile ogg opus
+-    vpx swresample)
++    swscale swresample)
+   set(FFMPEG_LIBPATH ${FFMPEG}/lib)
+ endif()
+ 
+@@ -199,14 +195,14 @@ if(WITH_OPENCOLLADA)
+   set(OPENCOLLADA ${LIBDIR}/opencollada)
+ 
+   set(OPENCOLLADA_INCLUDE_DIRS
+-    ${LIBDIR}/opencollada/include/COLLADAStreamWriter
+-    ${LIBDIR}/opencollada/include/COLLADABaseUtils
+-    ${LIBDIR}/opencollada/include/COLLADAFramework
+-    ${LIBDIR}/opencollada/include/COLLADASaxFrameworkLoader
+-    ${LIBDIR}/opencollada/include/GeneratedSaxParser
++    ${LIBDIR}/opencollada/include/opencollada/COLLADAStreamWriter
++    ${LIBDIR}/opencollada/include/opencollada/COLLADABaseUtils
++    ${LIBDIR}/opencollada/include/opencollada/COLLADAFramework
++    ${LIBDIR}/opencollada/include/opencollada/COLLADASaxFrameworkLoader
++    ${LIBDIR}/opencollada/include/opencollada/GeneratedSaxParser
+   )
+ 
+-  set(OPENCOLLADA_LIBPATH ${OPENCOLLADA}/lib)
++  set(OPENCOLLADA_LIBPATH ${OPENCOLLADA}/lib/opencollada)
+   set(OPENCOLLADA_LIBRARIES
+     OpenCOLLADASaxFrameworkLoader
+     -lOpenCOLLADAFramework
+@@ -215,7 +211,7 @@ if(WITH_OPENCOLLADA)
+     -lMathMLSolver
+     -lGeneratedSaxParser
+     -lbuffer -lftoa -lUTF
+-    ${OPENCOLLADA_LIBPATH}/libxml2.a
++    xml2
+   )
+   # PCRE is bundled with openCollada
+   # set(PCRE ${LIBDIR}/pcre)
+@@ -276,14 +272,13 @@ if(WITH_BOOST)
+ endif()
+ 
+ if(WITH_INTERNATIONAL OR WITH_CODEC_FFMPEG)
+-  set(PLATFORM_LINKFLAGS "${PLATFORM_LINKFLAGS} -liconv") # boost_locale and ffmpeg needs it !
+ endif()
+ 
+ if(WITH_OPENIMAGEIO)
+   set(OPENIMAGEIO ${LIBDIR}/openimageio)
+   set(OPENIMAGEIO_INCLUDE_DIRS ${OPENIMAGEIO}/include)
+   set(OPENIMAGEIO_LIBRARIES
+-    ${OPENIMAGEIO}/lib/libOpenImageIO.a
++    ${OPENIMAGEIO}/lib/libOpenImageIO.dylib
+     ${PNG_LIBRARIES}
+     ${JPEG_LIBRARIES}
+     ${TIFF_LIBRARY}
+@@ -306,7 +301,7 @@ endif()
+ if(WITH_OPENCOLORIO)
+   set(OPENCOLORIO ${LIBDIR}/opencolorio)
+   set(OPENCOLORIO_INCLUDE_DIRS ${OPENCOLORIO}/include)
+-  set(OPENCOLORIO_LIBRARIES OpenColorIO tinyxml yaml-cpp)
++  set(OPENCOLORIO_LIBRARIES OpenColorIO)
+   set(OPENCOLORIO_LIBPATH ${OPENCOLORIO}/lib)
+ endif()
+ 
+@@ -443,7 +438,7 @@ else()
+   set(CMAKE_CXX_FLAGS_RELEASE "-mdynamic-no-pic -fno-strict-aliasing")
+ endif()
+ 
+-if(${XCODE_VERSION} VERSION_EQUAL 5 OR ${XCODE_VERSION} VERSION_GREATER 5)
++if(FALSE)
+   # Xcode 5 is always using CLANG, which has too low template depth of 128 for libmv
+   set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -ftemplate-depth=1024")
+ endif()
diff --git a/pkgs/applications/misc/blender/default.nix b/pkgs/applications/misc/blender/default.nix
index 0af78852204d..83f2bf63642d 100644
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@@ -1,13 +1,14 @@
 { config, stdenv, lib, fetchurl, boost, cmake, ffmpeg, gettext, glew
 , ilmbase, libXi, libX11, libXext, libXrender
 , libjpeg, libpng, libsamplerate, libsndfile
-, libtiff, libGLU, libGL, openal, opencolorio, openexr, openimageio, openjpeg_1, python3Packages
+, libtiff, libGLU, libGL, openal, opencolorio, openexr, openimageio2, openjpeg, python3Packages
 , openvdb, libXxf86vm, tbb
 , zlib, fftw, opensubdiv, freetype, jemalloc, ocl-icd, addOpenGLRunpath
 , jackaudioSupport ? false, libjack2
 , cudaSupport ? config.cudaSupport or false, cudatoolkit
 , colladaSupport ? true, opencollada
 , enableNumpy ? false, makeWrapper
+, pugixml, SDL, Cocoa, CoreGraphics, ForceFeedback, OpenAL, OpenGL
 }:
 
 with lib;
@@ -23,22 +24,53 @@ stdenv.mkDerivation rec {
     sha256 = "1zl0ar95qkxsrbqw9miz2hrjijlqjl06vg3clfk9rm7krr2l3b2j";
   };
 
+  patches = lib.optional stdenv.isDarwin ./darwin.patch;
+
   nativeBuildInputs = [ cmake ] ++ optional cudaSupport addOpenGLRunpath;
   buildInputs =
     [ boost ffmpeg gettext glew ilmbase
-      libXi libX11 libXext libXrender
-      freetype libjpeg libpng libsamplerate libsndfile libtiff libGLU libGL openal
-      opencolorio openexr openimageio openjpeg_1 python zlib fftw jemalloc
+      freetype libjpeg libpng libsamplerate libsndfile libtiff
+      opencolorio openexr openimageio2 openjpeg python zlib fftw jemalloc
       (opensubdiv.override { inherit cudaSupport; })
-      openvdb libXxf86vm tbb
+      tbb
       makeWrapper
     ]
+    ++ (if (!stdenv.isDarwin) then [
+      libXi libX11 libXext libXrender
+      libGLU libGL openal
+      libXxf86vm
+      # OpenVDB currently doesn't build on darwin
+      openvdb
+    ]
+    else [
+      pugixml SDL Cocoa CoreGraphics ForceFeedback OpenAL OpenGL
+    ])
     ++ optional jackaudioSupport libjack2
     ++ optional cudaSupport cudatoolkit
     ++ optional colladaSupport opencollada;
 
   postPatch =
-    ''
+    if stdenv.isDarwin then ''
+      : > build_files/cmake/platform/platform_apple_xcode.cmake
+      substituteInPlace source/creator/CMakeLists.txt \
+        --replace '${"$"}{LIBDIR}/python' \
+                  '${python}'
+      substituteInPlace build_files/cmake/platform/platform_apple.cmake \
+        --replace '${"$"}{LIBDIR}/python' \
+                  '${python}' \
+        --replace '${"$"}{LIBDIR}/opencollada' \
+                  '${opencollada}' \
+        --replace '${"$"}{PYTHON_LIBPATH}/site-packages/numpy' \
+                  '${python3Packages.numpy}/${python.sitePackages}/numpy' \
+        --replace 'set(OPENJPEG_INCLUDE_DIRS ' \
+                  'set(OPENJPEG_INCLUDE_DIRS "'$(echo ${openjpeg.dev}/include/openjpeg-*)'") #' \
+        --replace 'set(OPENJPEG_LIBRARIES ' \
+                  'set(OPENJPEG_LIBRARIES "${openjpeg}/lib/libopenjp2.dylib") #' \
+        --replace 'set(OPENIMAGEIO ' \
+                  'set(OPENIMAGEIO "${openimageio2.out}") #' \
+        --replace 'set(OPENEXR_INCLUDE_DIRS ' \
+                  'set(OPENEXR_INCLUDE_DIRS "${openexr.dev}/include/OpenEXR") #'
+    '' else ''
       substituteInPlace extern/clew/src/clew.c --replace '"libOpenCL.so"' '"${ocl-icd}/lib/libOpenCL.so"'
     '';
 
@@ -48,7 +80,7 @@ stdenv.mkDerivation rec {
       "-DWITH_CODEC_SNDFILE=ON"
       "-DWITH_INSTALL_PORTABLE=OFF"
       "-DWITH_FFTW3=ON"
-      #"-DWITH_SDL=ON"
+      "-DWITH_SDL=OFF"
       "-DWITH_OPENCOLORIO=ON"
       "-DWITH_OPENSUBDIV=ON"
       "-DPYTHON_LIBRARY=${python.libPrefix}m"
@@ -61,10 +93,18 @@ stdenv.mkDerivation rec {
       "-DWITH_OPENVDB=ON"
       "-DWITH_TBB=ON"
       "-DWITH_IMAGE_OPENJPEG=ON"
+      "-DWITH_OPENCOLLADA=${if colladaSupport then "ON" else "OFF"}"
+    ]
+    ++ optionals stdenv.isDarwin [
+      "-DWITH_CYCLES_OSL=OFF" # requires LLVM
+      "-DWITH_OPENVDB=OFF" # OpenVDB currently doesn't build on darwin
+
+      "-DLIBDIR=/does-not-exist"
     ]
+    # Clang doesn't support "-export-dynamic"
+    ++ optional stdenv.cc.isClang "-DPYTHON_LINKFLAGS="
     ++ optional jackaudioSupport "-DWITH_JACK=ON"
-    ++ optional cudaSupport "-DWITH_CYCLES_CUDA_BINARIES=ON"
-    ++ optional colladaSupport "-DWITH_OPENCOLLADA=ON";
+    ++ optional cudaSupport "-DWITH_CYCLES_CUDA_BINARIES=ON";
 
   NIX_CFLAGS_COMPILE = "-I${ilmbase.dev}/include/OpenEXR -I${python}/include/${python.libPrefix}";
 
@@ -95,7 +135,7 @@ stdenv.mkDerivation rec {
     # They comment two licenses: GPLv2 and Blender License, but they
     # say: "We've decided to cancel the BL offering for an indefinite period."
     license = licenses.gpl2Plus;
-    platforms = [ "x86_64-linux" ];
+    platforms = [ "x86_64-linux" "x86_64-darwin" ];
     maintainers = [ maintainers.goibhniu ];
   };
 }
diff --git a/pkgs/applications/misc/font-manager/default.nix b/pkgs/applications/misc/font-manager/default.nix
index edb47e11dd7f..afa0a06d33fc 100644
--- a/pkgs/applications/misc/font-manager/default.nix
+++ b/pkgs/applications/misc/font-manager/default.nix
@@ -1,17 +1,17 @@
-{ stdenv, fetchFromGitHub, meson, ninja, gettext, python3, fetchpatch,
+{ stdenv, fetchFromGitHub, meson, ninja, gettext, python3,
   pkgconfig, libxml2, json-glib , sqlite, itstool, librsvg, yelp-tools,
   vala, gtk3, gnome3, desktop-file-utils, wrapGAppsHook, gobject-introspection
 }:
 
 stdenv.mkDerivation rec {
   pname = "font-manager";
-  version = "0.7.5";
+  version = "0.7.7";
 
   src = fetchFromGitHub {
     owner = "FontManager";
     repo = "master";
     rev = version;
-    sha256 = "16hma8rrkam6ngn5vbdaryn31vdixvii6920g9z928gylz9xkd3g";
+    sha256 = "1bzqvspplp1zj0n0869jqbc60wgbjhf0vdrn5bj8dfawxynh8s5f";
   };
 
   nativeBuildInputs = [
@@ -38,19 +38,6 @@ stdenv.mkDerivation rec {
     gnome3.adwaita-icon-theme
   ];
 
-  mesonFlags = [
-    "-Ddisable_pycompile=true"
-  ];
-
-  patches = [
-    # fix build with Vala 0.46
-    (fetchpatch {
-      url = "https://github.com/FontManager/font-manager/commit/c73b40de11f376f4515a0edfe97fb3721a264b35.patch";
-      sha256 = "0lacwsifgvda2r3z6j2a0svdqr6mgav7zkvih35xa8155y8wfpnw";
-      excludes = [ "fedora/font-manager.spec" ];
-    })
-  ];
-
   postPatch = ''
     chmod +x meson_post_install.py
     patchShebangs meson_post_install.py
diff --git a/pkgs/applications/misc/mako/default.nix b/pkgs/applications/misc/mako/default.nix
index ffb938f30a57..f86effe989fa 100644
--- a/pkgs/applications/misc/mako/default.nix
+++ b/pkgs/applications/misc/mako/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mako";
-  version = "1.4";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "emersion";
     repo = pname;
     rev = "v${version}";
-    sha256 = "11ymiq6cr2ma0iva1mqybn3j6k73bsc6lv6pcbdq7hkhd4f9b7j9";
+    sha256 = "0hwvibpnrximb628w9dsfjpi30b5jy7nfkm4d94z5vhp78p43vxh";
   };
 
   nativeBuildInputs = [ meson ninja pkgconfig scdoc wayland-protocols ];
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     description = "A lightweight Wayland notification daemon";
     homepage = https://wayland.emersion.fr/mako/;
     license = licenses.mit;
-    maintainers = with maintainers; [ dywedir ];
+    maintainers = with maintainers; [ dywedir synthetica ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/misc/osmctools/default.nix b/pkgs/applications/misc/osmctools/default.nix
index 2dfbb7a23705..c03e57920da9 100644
--- a/pkgs/applications/misc/osmctools/default.nix
+++ b/pkgs/applications/misc/osmctools/default.nix
@@ -1,46 +1,27 @@
-{ stdenv, fetchurl, zlib } :
+{ stdenv, fetchFromGitLab, autoreconfHook, zlib }:
 
-let
-
-  convert_src = fetchurl {
-    url = http://m.m.i24.cc/osmconvert.c;
-    sha256 = "1mvmb171c1jqxrm80jc7qicwk4kgg7yq694n7ci65g6i284r984x";
-    # version = 0.8.5
-  };
+stdenv.mkDerivation rec {
+  pname = "osmctools";
+  version = "0.9";
 
-  filter_src = fetchurl {
-    url = http://m.m.i24.cc/osmfilter.c;
-    sha256 = "0vm3bls9jb2cb5b11dn82sxnc22qzkf4ghmnkivycigrwa74i6xl";
-    # version = 1.4.0
+  src = fetchFromGitLab {
+    owner = "osm-c-tools";
+    repo = pname;
+    rev = version;
+    sha256 = "1m8d3r1q1v05pkr8k9czrmb4xjszw6hvgsf3kn9pf0v14gpn4r8f";
   };
 
-in
-
-stdenv.mkDerivation {
-  pname = "osmctools";
-  version = "0.8.5plus1.4.0";
-
+  nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ zlib ];
 
-  phases = [ "buildPhase" "installPhase" ];
-
-  buildPhase = ''
-    cc ${convert_src} -lz -O3 -o osmconvert
-    cc ${filter_src} -O3 -o osmfilter
-  '';
-
-  installPhase = ''
-    mkdir -p $out/bin
-    mv osmconvert $out/bin
-    mv osmfilter $out/bin
-  '';
-
   meta = with stdenv.lib; {
     description = "Command line tools for transforming Open Street Map files";
     homepage = [
-      https://wiki.openstreetmap.org/wiki/Osmconvert
-      https://wiki.openstreetmap.org/wiki/Osmfilter
+      https://wiki.openstreetmap.org/wiki/osmconvert
+      https://wiki.openstreetmap.org/wiki/osmfilter
+      https://wiki.openstreetmap.org/wiki/osmupdate
     ];
+    maintainers = with maintainers; [ sikmir ];
     platforms = platforms.unix;
     license = licenses.agpl3;
   };
diff --git a/pkgs/applications/misc/waybar/default.nix b/pkgs/applications/misc/waybar/default.nix
index 84735feef21c..212013fb655d 100644
--- a/pkgs/applications/misc/waybar/default.nix
+++ b/pkgs/applications/misc/waybar/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, meson, pkgconfig, ninja
+{ stdenv, fetchFromGitHub, meson, pkgconfig, ninja, wrapGAppsHook
 , wayland, wlroots, gtkmm3, libinput, libsigcxx, jsoncpp, fmt, scdoc, spdlog, gtk-layer-shell
 , traySupport  ? true,  libdbusmenu-gtk3
 , pulseSupport ? false, libpulseaudio
@@ -19,7 +19,7 @@
     };
 
     nativeBuildInputs = [
-      meson ninja pkgconfig scdoc
+      meson ninja pkgconfig scdoc wrapGAppsHook
     ];
 
     buildInputs = with stdenv.lib;
diff --git a/pkgs/applications/networking/Sylk/default.nix b/pkgs/applications/networking/Sylk/default.nix
index 36f6279c2092..d99a87954dec 100644
--- a/pkgs/applications/networking/Sylk/default.nix
+++ b/pkgs/applications/networking/Sylk/default.nix
@@ -2,7 +2,7 @@
 
 let
   pname = "Sylk";
-  version = "2.1.0";
+  version = "2.5.0";
 in
 
 appimageTools.wrapType2 rec {
@@ -10,7 +10,7 @@ appimageTools.wrapType2 rec {
 
   src = fetchurl {
     url = "http://download.ag-projects.com/Sylk/Sylk-${version}-x86_64.AppImage";
-    sha256 = "1ifi8qr6f84dcssxhv5ar1s48nsqxiv2j1blc82248hmq5is24mf";
+    sha256 = "1jhs25zzdac3r2wz886vlpb0bz77p52mdlrbsbv28h6is79pbd69";
   };
 
   profile = ''
diff --git a/pkgs/applications/networking/browsers/chromium/plugins.nix b/pkgs/applications/networking/browsers/chromium/plugins.nix
index ef0b5ac0eb67..c4a09c8063db 100644
--- a/pkgs/applications/networking/browsers/chromium/plugins.nix
+++ b/pkgs/applications/networking/browsers/chromium/plugins.nix
@@ -45,11 +45,11 @@ let
 
   flash = stdenv.mkDerivation rec {
     pname = "flashplayer-ppapi";
-    version = "32.0.0.303";
+    version = "32.0.0.314";
 
     src = fetchzip {
       url = "https://fpdownload.adobe.com/pub/flashplayer/pdc/${version}/flash_player_ppapi_linux.x86_64.tar.gz";
-      sha256 = "0b2cw8y9rif2p0lyy2ir1v5lchxlsh543b9c743a2p85c9p7q62b";
+      sha256 = "05xcscpzglpfpiiqc3ngs5snxli99irjk18g5vdhw91jk9808gnl";
       stripRoot = false;
     };
 
diff --git a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
index 7e3705a3b0bd..5ecb6bfb0766 100644
--- a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
@@ -74,7 +74,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "flashplayer";
-  version = "32.0.0.303";
+  version = "32.0.0.314";
 
   src = fetchurl {
     url =
@@ -85,14 +85,14 @@ stdenv.mkDerivation rec {
     sha256 =
       if debug then
         if arch == "x86_64" then
-          "05hfc5ywmcvp6zf8aqmzjp3qy3byp0zdl0ssrv9gvzcskdqkhsj2"
+          "076l93wjcy15sic88cyq6msp87gdhcvbk4ym2vbvvjz2bav2z456"
         else
-          "12hl8lvxz648ha70gi3v85mwf0nnayjiaslr669vjan3ww94jymv"
+          "0kxr8d6fh00akqgk3lwv0z6rk7xswislicsbh9b9p33f19mj7c8a"
       else
         if arch == "x86_64" then
-          "0x0mabgswly2v8z13832pkbjsv404aq61pback6sgmp2lyycdg6w"
+          "0a3hvp0qmqlann8k875ajf0i70cv0an1a3mr8kbgji46dxqvwjxz"
         else
-          "16kbpf1i3aqlrfbfh5ncg1n46ncl9hp6qdp36s5j3ivbc68pj81z";
+          "0jyywas2z7ssgzng82qgnp01gy6nccqavkbx9529m07xrclvqbxn";
   };
 
   nativeBuildInputs = [ unzip ];
diff --git a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
index 28b4c8a36c93..353aff7e707e 100644
--- a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
@@ -50,7 +50,7 @@
 
 stdenv.mkDerivation {
   pname = "flashplayer-standalone";
-  version = "32.0.0.303";
+  version = "32.0.0.314";
 
   src = fetchurl {
     url =
@@ -60,9 +60,9 @@ stdenv.mkDerivation {
         "https://fpdownload.macromedia.com/pub/flashplayer/updaters/32/flash_player_sa_linux.x86_64.tar.gz";
     sha256 =
       if debug then
-        "0xkzlv90lpyy54j6pllknrp1l9vjyh6dsl63l4c8cgh4i830gi14"
+        "0zlin94rip13rn58m7v5l6m20ylnw59l77rbg5j5qyxkr53zawdz"
       else
-        "0mi3ggv6zhzmdd1h68cgl87n6izhp0pbkhnidd2gl2cp95f23c2d";
+        "0pfrm02iwa01pqx3adqj0sw27p1ddlz9knjky6x248ak8zywsqr2";
   };
 
   nativeBuildInputs = [ unzip ];
diff --git a/pkgs/applications/networking/cawbird/default.nix b/pkgs/applications/networking/cawbird/default.nix
index 6462dd499493..af8b7241659e 100644
--- a/pkgs/applications/networking/cawbird/default.nix
+++ b/pkgs/applications/networking/cawbird/default.nix
@@ -20,14 +20,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.0.3.1";
+  version = "1.0.4";
   pname = "cawbird";
 
   src = fetchFromGitHub {
     owner = "IBBoard";
     repo = "cawbird";
     rev = "v${version}";
-    sha256 = "sha256:1v1y4bx0mm518b9vlpsry12fw1qz2j28jfhjqq73blvzd89lgb0y";
+    sha256 = "sha256:1gqi7bn08b9cjpb0mgs6bk1a2npdfhn56ckps95nck0jyqzfbnir";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/cluster/cni/plugins.nix b/pkgs/applications/networking/cluster/cni/plugins.nix
index d0186fb9b4c0..39c3b9f65072 100644
--- a/pkgs/applications/networking/cluster/cni/plugins.nix
+++ b/pkgs/applications/networking/cluster/cni/plugins.nix
@@ -1,13 +1,13 @@
 { stdenv, lib, fetchFromGitHub, go, removeReferencesTo, buildGoPackage }:
 buildGoPackage rec {
   pname = "cni-plugins";
-  version = "0.8.3";
+  version = "0.8.4";
 
   src = fetchFromGitHub {
     owner = "containernetworking";
     repo = "plugins";
     rev = "v${version}";
-    sha256 = "0dc4fs08x4x518yhgvq3drjvansnc0cb8rm4h5wiw7k3whjii3cd";
+    sha256 = "02kz6y3klhbriybsskn4hmldwli28cycnp2klsm2x0y9c73iczdp";
   };
 
   goDeps = ./plugins-deps.nix;
diff --git a/pkgs/applications/networking/cluster/docker-machine/xhyve-deps.nix b/pkgs/applications/networking/cluster/docker-machine/xhyve-deps.nix
deleted file mode 100644
index 99cb7b98f5cc..000000000000
--- a/pkgs/applications/networking/cluster/docker-machine/xhyve-deps.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-# This file was generated by https://github.com/kamilchm/go2nix v1.2.1
-[
-  {
-    goPackagePath = "github.com/docker/machine";
-    fetch = {
-      type = "git";
-      url = "https://github.com/docker/machine";
-      rev = "5b274558ea6ca822c06dd407a4e774a0105c3f60";
-      sha256 = "1wdq9h4bx7awgclh969gvmcnl9jvgv7ldfklnclh5iv47mi7q22d";
-    };
-  }
-  {
-    goPackagePath = "github.com/zchee/libhyperkit";
-    fetch = {
-      type = "git";
-      url = "https://github.com/zchee/libhyperkit";
-      rev = "1a19a7693fac32b46ec6cdd22da6fbec974447fc";
-      sha256 = "119f5gcl24znwnmi837jk667asd3lirx32jldpd4mbyb3sm9nz24";
-    };
-  }
-]
diff --git a/pkgs/applications/networking/cluster/docker-machine/xhyve.nix b/pkgs/applications/networking/cluster/docker-machine/xhyve.nix
index 1c2caff50d53..1f1e59a56a4e 100644
--- a/pkgs/applications/networking/cluster/docker-machine/xhyve.nix
+++ b/pkgs/applications/networking/cluster/docker-machine/xhyve.nix
@@ -1,24 +1,36 @@
-{ stdenv, buildGoPackage, fetchFromGitHub, pkgconfig, Hypervisor, vmnet }:
+{ stdenv, buildGoPackage, fetchFromGitHub, fetchpatch, pkgconfig, cctools, Hypervisor, vmnet }:
 
 buildGoPackage rec {
   pname = "docker-machine-xhyve";
-  version = "0.3.3";
+  version = "0.4.0";
 
   goPackagePath = "github.com/zchee/docker-machine-driver-xhyve";
-  goDeps = ./xhyve-deps.nix;
+
+  # https://github.com/machine-drivers/docker-machine-driver-xhyve/pull/225
+  patches = fetchpatch {
+    url = "https://github.com/machine-drivers/docker-machine-driver-xhyve/commit/546256494bf2ccc33e4125bf45f504b0e3027d5a.patch";
+    sha256 = "1i8wxqccqkxvqrbsyd0g9s0kdskd8xi2jv0c1bji9aj4rq0a8cgz";
+  };
+
+  preBuild = ''
+    make -C go/src/${goPackagePath} CC=${stdenv.cc}/bin/cc LIBTOOL=${cctools}/bin/libtool GIT_CMD=: lib9p
+    export CGO_CFLAGS=-I$(pwd)/go/src/${goPackagePath}/vendor/github.com/jceel/lib9p
+    export CGO_LDFLAGS=$(pwd)/go/src/${goPackagePath}/vendor/build/lib9p/lib9p.a
+  '';
+  buildFlags = "--tags lib9p";
 
   src = fetchFromGitHub {
     rev    = "v${version}";
-    owner  = "zchee";
+    owner  = "machine-drivers";
     repo   = "docker-machine-driver-xhyve";
-    sha256 = "0rj6pyqp4yv4j28bglqjs95rip5i77vv8mrkmqv1rxrsl3i8aqqy";
+    sha256 = "0000v97fr8xc5b39v44hsa87wrbk4bcwyaaivxv4hxlf4vlgg863";
   };
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ Hypervisor vmnet ];
 
   meta = with stdenv.lib; {
-    homepage = https://github.com/zchee/docker-machine-driver-xhyve;
+    homepage = https://github.com/machine-drivers/docker-machine-driver-xhyve;
     description = "Xhyve driver for docker-machine.";
     license = licenses.bsd3;
     maintainers = with maintainers; [ periklis ];
diff --git a/pkgs/applications/networking/mailreaders/claws-mail/default.nix b/pkgs/applications/networking/mailreaders/claws-mail/default.nix
index e89a36eade07..f62ab292d669 100644
--- a/pkgs/applications/networking/mailreaders/claws-mail/default.nix
+++ b/pkgs/applications/networking/mailreaders/claws-mail/default.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
 
   preConfigure = ''
     # autotools check tries to dlopen libpython as a requirement for the python plugin
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:${python}/lib
+    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}${python}/lib
   '';
 
   postPatch = ''
diff --git a/pkgs/applications/networking/mailreaders/mutt/default.nix b/pkgs/applications/networking/mailreaders/mutt/default.nix
index f0b8fdcf8e2a..b7bf5eb329ca 100644
--- a/pkgs/applications/networking/mailreaders/mutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/mutt/default.nix
@@ -27,11 +27,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "mutt";
-  version = "1.13.2";
+  version = "1.13.3";
 
   src = fetchurl {
     url = "http://ftp.mutt.org/pub/mutt/${pname}-${version}.tar.gz";
-    sha256 = "0x4yfvk8415p80h9an242n6q3b43mw6mnnczh95zd3j0zwdr6wrg";
+    sha256 = "0y3ks10mc7m8c7pd4c4j8pj7n5rqcvzrjs8mzldv7z7jnlb30hkq";
   };
 
   patches = optional smimeSupport (fetchpatch {
diff --git a/pkgs/applications/office/gnucash/default.nix b/pkgs/applications/office/gnucash/default.nix
index 963a896dd512..476b1128b945 100644
--- a/pkgs/applications/office/gnucash/default.nix
+++ b/pkgs/applications/office/gnucash/default.nix
@@ -79,7 +79,7 @@ stdenv.mkDerivation rec {
   #   80 - test-gnc-module-scm-module (Failed)
   #   81 - test-gnc-module-scm-multi (Failed)
   preCheck = ''
-    export LD_LIBRARY_PATH=$PWD/lib:$PWD/lib/gnucash:$PWD/lib/gnucash/test:$LD_LIBRARY_PATH
+    export LD_LIBRARY_PATH=$PWD/lib:$PWD/lib/gnucash:$PWD/lib/gnucash/test''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH
     export NIX_CFLAGS_LINK="-lgtest -lgtest_main"
   '';
   doCheck = false;
diff --git a/pkgs/applications/radio/soapysdr/default.nix b/pkgs/applications/radio/soapysdr/default.nix
index c4879f01e606..e072ec97b974 100644
--- a/pkgs/applications/radio/soapysdr/default.nix
+++ b/pkgs/applications/radio/soapysdr/default.nix
@@ -8,7 +8,7 @@
 
 let
 
-  version = "0.7.1";
+  version = "0.7.2";
   modulesVersion = with lib; versions.major version + "." + versions.minor version;
   modulesPath = "lib/SoapySDR/modules" + modulesVersion;
   extraPackagesSearchPath = lib.makeSearchPath modulesPath extraPackages;
@@ -21,7 +21,7 @@ in stdenv.mkDerivation {
     owner = "pothosware";
     repo = "SoapySDR";
     rev = "soapy-sdr-${version}";
-    sha256 = "1rbnd3w12kzsh94fiywyn4vch7h0kf75m88fi6nq992b3vnmiwvl";
+    sha256 = "102wnpjxrwba20pzdh1vvx0yg1h8vqd8z914idxflg9p14r6v5am";
   };
 
   nativeBuildInputs = [ cmake makeWrapper pkgconfig ];
diff --git a/pkgs/applications/science/math/nota/default.nix b/pkgs/applications/science/math/nota/default.nix
new file mode 100644
index 000000000000..897785ef6e8b
--- /dev/null
+++ b/pkgs/applications/science/math/nota/default.nix
@@ -0,0 +1,40 @@
+{ mkDerivation, haskellPackages, fetchurl, lib }:
+
+mkDerivation rec {
+  pname = "nota";
+  version = "1.0";
+
+  # Can't use fetchFromGitLab since codes.kary.us doesn't support https
+  src = fetchurl {
+    url = "http://codes.kary.us/nota/nota/-/archive/V${version}/nota-V${version}.tar.bz2";
+    sha256 = "0bbs6bm9p852hvqadmqs428ir7m65h2prwyma238iirv42pk04v8";
+  };
+
+  postUnpack = ''
+    export sourceRoot=$sourceRoot/source
+  '';
+
+  isLibrary = false;
+  isExecutable = true;
+
+  libraryHaskellDepends = with haskellPackages; [
+    base
+    bytestring
+    array
+    split
+    scientific
+    parsec
+    ansi-terminal
+    regex-compat
+    containers
+    terminal-size
+    numbers
+    text
+    time
+  ];
+
+  description = "The most beautiful command line calculator";
+  homepage = "https://kary.us/nota";
+  license = lib.licenses.mpl20;
+  maintainers = with lib.maintainers; [ dtzWill ];
+}
diff --git a/pkgs/applications/science/math/sage/sage-env.nix b/pkgs/applications/science/math/sage/sage-env.nix
index 00397239876b..68e0d134ace2 100644
--- a/pkgs/applications/science/math/sage/sage-env.nix
+++ b/pkgs/applications/science/math/sage/sage-env.nix
@@ -177,7 +177,7 @@ writeTextFile rec {
     export SAGE_EXTCODE='${sagelib.src}/src/ext'
 
   # for find_library
-    export DYLD_LIBRARY_PATH="${lib.makeLibraryPath [stdenv.cc.libc singular]}:$DYLD_LIBRARY_PATH"
+    export DYLD_LIBRARY_PATH="${lib.makeLibraryPath [stdenv.cc.libc singular]}''${DYLD_LIBRARY_PATH:+:}$DYLD_LIBRARY_PATH"
   '';
 } // {
   lib = sagelib; # equivalent of `passthru`, which `writeTextFile` doesn't support
diff --git a/pkgs/applications/version-management/git-and-tools/gitstatus/default.nix b/pkgs/applications/version-management/git-and-tools/gitstatus/default.nix
index 94753275b613..9b77690868be 100644
--- a/pkgs/applications/version-management/git-and-tools/gitstatus/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/gitstatus/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ (callPackage ./romkatv_libgit2.nix {}) ];
   patchPhase = ''
-    sed -i "s|local daemon=.*|local daemon=$out/bin/gitstatusd|" gitstatus.plugin.zsh
+    sed -i "1i GITSTATUS_DAEMON=$out/bin/gitstatusd" gitstatus.plugin.zsh
   '';
   installPhase = ''
     install -Dm755 gitstatusd $out/bin/gitstatusd
diff --git a/pkgs/applications/version-management/gitlab/data.json b/pkgs/applications/version-management/gitlab/data.json
index be7f0afdc77d..3f1aef360ba7 100644
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@@ -1,11 +1,11 @@
 {
-  "version": "12.6.2",
-  "repo_hash": "0bchamvr3f0ph49f7xa76gsp2mjj1ajy4q0wy1hjvr9bayxx94av",
+  "version": "12.6.4",
+  "repo_hash": "0jsww785bxvjdrp1wsz6zkvx9zr69j24bway6nfyjkz8a7vbl9ls",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v12.6.2-ee",
+  "rev": "v12.6.4-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "a4b6c71d4b7c1588587345e2dfe0c6bd7cc63a83",
+    "GITALY_SERVER_VERSION": "1.77.1",
     "GITLAB_PAGES_VERSION": "1.12.0",
     "GITLAB_SHELL_VERSION": "10.3.0",
     "GITLAB_WORKHORSE_VERSION": "8.18.0"
diff --git a/pkgs/applications/version-management/gitlab/gitaly/default.nix b/pkgs/applications/version-management/gitlab/gitaly/default.nix
index 97d7404de8b1..a4b4540e87aa 100644
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@@ -17,14 +17,14 @@ let
       };
   };
 in buildGoPackage rec {
-  version = "a4b6c71d4b7c1588587345e2dfe0c6bd7cc63a83";
+  version = "1.77.1";
   pname = "gitaly";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitaly";
-    rev = version;
-    sha256 = "1pxmhq1nrc8q2kk83bz5afx14hshqgzqm6j4vgmyjvbmdvgl80wv";
+    rev = "v${version}";
+    sha256 = "08xc9lxlvga36yq1wdvb1h4zk70c36qspyd7azhkw84kzwfrif1c";
   };
 
   # Fix a check which assumes that hook files are writeable by their
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
index b6f57297c077..2c4a5f2e816c 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
@@ -327,7 +327,7 @@ group :metrics do
   gem 'influxdb', '~> 0.2', require: false
 
   # Prometheus
-  gem 'prometheus-client-mmap', '~> 0.9.10'
+  gem 'prometheus-client-mmap', '~> 0.10.0'
   gem 'raindrops', '~> 0.18'
 end
 
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
index 0e3227058620..57e428ca955e 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
@@ -531,8 +531,8 @@ GEM
       regexp_parser (~> 1.1)
       regexp_property_values (~> 0.3)
     json (1.8.6)
-    json-jwt (1.9.4)
-      activesupport
+    json-jwt (1.11.0)
+      activesupport (>= 4.2)
       aes_key_wrap
       bindata
     json-schema (2.8.0)
@@ -746,7 +746,7 @@ GEM
       parser
       unparser
     procto (0.0.3)
-    prometheus-client-mmap (0.9.10)
+    prometheus-client-mmap (0.10.0)
     pry (0.11.3)
       coderay (~> 1.1.0)
       method_source (~> 0.9.0)
@@ -1283,7 +1283,7 @@ DEPENDENCIES
   peek (~> 1.1)
   pg (~> 1.1)
   premailer-rails (~> 1.10.3)
-  prometheus-client-mmap (~> 0.9.10)
+  prometheus-client-mmap (~> 0.10.0)
   pry-byebug (~> 3.5.1)
   pry-rails (~> 0.3.4)
   rack (~> 2.0.7)
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
index 55cdfaa16b91..854178ffbe37 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
@@ -2326,10 +2326,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "065k7vffdki73f4nz89lxi6wxmcw5dlf593831pgvlbralll6x3r";
+      sha256 = "18rf9v20i0dk5dblr7m22di959xpch2h7gsx0cl585cryr7apwp3";
       type = "gem";
     };
-    version = "1.9.4";
+    version = "1.11.0";
   };
   json-schema = {
     dependencies = ["addressable"];
@@ -3365,10 +3365,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0immyg4as0isyj2dcjf44n0avg1jv5kx1qk0asrgb5ayzwmjqg1k";
+      sha256 = "00d2c79xhz5k3fcclarjr1ffxbrvc6236f4rrvriad9kwqr7c1mp";
       type = "gem";
     };
-    version = "0.9.10";
+    version = "0.10.0";
   };
   pry = {
     dependencies = ["coderay" "method_source"];
diff --git a/pkgs/applications/video/avidemux/default.nix b/pkgs/applications/video/avidemux/default.nix
index c28d900dd9f1..00bdb370aae4 100644
--- a/pkgs/applications/video/avidemux/default.nix
+++ b/pkgs/applications/video/avidemux/default.nix
@@ -66,7 +66,7 @@ stdenv.mkDerivation rec {
     cd "$sourceRoot"
     patchPhase
 
-    export LD_LIBRARY_PATH="$LD_LIBRARY_PATH:${libXext}/lib"
+    export LD_LIBRARY_PATH="$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}${libXext}/lib"
     ${stdenv.shell} bootStrap.bash \
       --with-core \
       ${if withQT then "--with-qt" else "--without-qt"} \
diff --git a/pkgs/applications/window-managers/sway/lock-fancy.nix b/pkgs/applications/window-managers/sway/lock-fancy.nix
index 6dd8db0f45be..aa2db698f747 100644
--- a/pkgs/applications/window-managers/sway/lock-fancy.nix
+++ b/pkgs/applications/window-managers/sway/lock-fancy.nix
@@ -18,7 +18,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "Big-B";
-    repo = pname;
+    repo = "swaylock-fancy";
     rev = "35618ceec70338047355b6b057825e68f16971b5";
     sha256 = "06fjqwblmj0d9pq6y11rr73mizirna4ixy6xkvblf1c7sn5n8lpc";
   };
diff --git a/pkgs/build-support/build-fhs-userenv/env.nix b/pkgs/build-support/build-fhs-userenv/env.nix
index 295b17eec67c..8de43d5a9195 100644
--- a/pkgs/build-support/build-fhs-userenv/env.nix
+++ b/pkgs/build-support/build-fhs-userenv/env.nix
@@ -52,7 +52,7 @@ let
   etcProfile = writeText "profile" ''
     export PS1='${name}-chrootenv:\u@\h:\w\$ '
     export LOCALE_ARCHIVE='/usr/lib/locale/locale-archive'
-    export LD_LIBRARY_PATH="/run/opengl-driver/lib:/run/opengl-driver-32/lib:/usr/lib:/usr/lib32:$LD_LIBRARY_PATH"
+    export LD_LIBRARY_PATH="/run/opengl-driver/lib:/run/opengl-driver-32/lib:/usr/lib:/usr/lib32''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
     export PATH="/run/wrappers/bin:/usr/bin:/usr/sbin:$PATH"
     export TZDIR='/etc/zoneinfo'
 
diff --git a/pkgs/build-support/rust/default.nix b/pkgs/build-support/rust/default.nix
index f9cf8f1f0c1f..4089436c0e0b 100644
--- a/pkgs/build-support/rust/default.nix
+++ b/pkgs/build-support/rust/default.nix
@@ -100,9 +100,9 @@ stdenv.mkDerivation (args // {
   '' + stdenv.lib.optionalString verifyCargoDeps ''
     if ! diff source/Cargo.lock $cargoDeps/Cargo.lock ; then
       echo
-      echo "ERROR: cargoSha256 is out of date."
+      echo "ERROR: cargoSha256 is out of date"
       echo
-      echo "Cargo.lock is not the same in $cargoDeps."
+      echo "Cargo.lock is not the same in $cargoDeps"
       echo
       echo "To fix the issue:"
       echo '1. Use "1111111111111111111111111111111111111111111111111111" as the cargoSha256 value'
diff --git a/pkgs/build-support/setup-hooks/make-symlinks-relative.sh b/pkgs/build-support/setup-hooks/make-symlinks-relative.sh
new file mode 100644
index 000000000000..0608d3ca81c4
--- /dev/null
+++ b/pkgs/build-support/setup-hooks/make-symlinks-relative.sh
@@ -0,0 +1,28 @@
+fixupOutputHooks+=(_makeSymlinksRelative)
+
+# For every symlink in $output that refers to another file in $output
+# ensure that the symlink is relative. This removes references to the output
+# has from the resulting store paths and thus the NAR files.
+_makeSymlinksRelative() {
+    local symlinkTarget
+
+    if [ -n "${dontRewriteSymlinks-}" ]; then
+        return 0
+    fi
+
+    while IFS= read -r -d $'\0' f; do
+        symlinkTarget=$(readlink "$f")
+        if [[ "$symlinkTarget"/ != "$prefix"/* ]]; then
+            # skip this symlink as it doesn't point to $prefix
+            continue
+        fi
+
+        if [ ! -e "$symlinkTarget" ]; then
+            echo "the symlink $f is broken, it points to $symlinkTarget (which is missing)"
+        fi
+
+        echo "rewriting symlink $f to be relative to $prefix"
+        ln -snrf "$symlinkTarget" "$f"
+
+    done < <(find $prefix -type l -print0)
+}
diff --git a/pkgs/data/fonts/victor-mono/default.nix b/pkgs/data/fonts/victor-mono/default.nix
index ea562f7fa6ea..89b13585eb0b 100644
--- a/pkgs/data/fonts/victor-mono/default.nix
+++ b/pkgs/data/fonts/victor-mono/default.nix
@@ -2,7 +2,7 @@
 
 let
   pname = "victor-mono";
-  version = "1.3.0";
+  version = "1.3.1";
 in fetchFromGitHub rec {
   name = "${pname}-${version}";
 
@@ -26,7 +26,7 @@ in fetchFromGitHub rec {
     unzip -j VictorMonoAll.zip \*.otf -d $out/share/fonts/opentype/${pname}
   '';
 
-  sha256 = "1lv2x7kfspabnhvm8z79n165fw3awvzj1r8f0g5zn26wgdalgw69";
+  sha256 = "1yj91rhs9pd705406r4lqabdfzjclbz837nzm6z1rziy6mbpd61s";
 
   meta = with lib; {
     description = "Free programming font with cursive italics and ligatures";
diff --git a/pkgs/desktops/deepin/dde-file-manager/default.nix b/pkgs/desktops/deepin/dde-file-manager/default.nix
index 5d0d04bfb764..62931dfcd811 100644
--- a/pkgs/desktops/deepin/dde-file-manager/default.nix
+++ b/pkgs/desktops/deepin/dde-file-manager/default.nix
@@ -228,8 +228,8 @@ mkDerivation rec {
   ];
 
   preBuild = ''
-    export LD_LIBRARY_PATH="$LD_LIBRARY_PATH:${zlib}/lib";
-    export LD_LIBRARY_PATH="$LD_LIBRARY_PATH:${libX11}/lib";
+    export LD_LIBRARY_PATH="$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}${zlib}/lib";
+    export LD_LIBRARY_PATH="$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}${libX11}/lib";
   '';
 
   dontWrapQtApps = true;
diff --git a/pkgs/desktops/enlightenment/efl.nix b/pkgs/desktops/enlightenment/efl.nix
index 183e72565d3d..b4b271fb38f3 100644
--- a/pkgs/desktops/enlightenment/efl.nix
+++ b/pkgs/desktops/enlightenment/efl.nix
@@ -123,7 +123,7 @@ stdenv.mkDerivation rec {
 
   preConfigure = ''
     # allow ecore_con to find libcurl.so, which is a runtime dependency (it is dlopened)
-    export LD_LIBRARY_PATH="${curl.out}/lib:$LD_LIBRARY_PATH"
+    export LD_LIBRARY_PATH="${curl.out}/lib''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
 
     source "$setupHook"
   '';
diff --git a/pkgs/desktops/gnome-3/apps/seahorse/default.nix b/pkgs/desktops/gnome-3/apps/seahorse/default.nix
index c6d5b22f9348..315968fde651 100644
--- a/pkgs/desktops/gnome-3/apps/seahorse/default.nix
+++ b/pkgs/desktops/gnome-3/apps/seahorse/default.nix
@@ -26,11 +26,11 @@
 
 stdenv.mkDerivation rec {
   pname = "seahorse";
-  version = "3.34";
+  version = "3.34.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "16sfnqrdlr5xx6kixx2ln1mva7nngjlw1k3f5n454vyaigffjh2v";
+    sha256 = "19c2zylwgycb5q9hal8rmflc2sywc5c2grpsfsq3rf37i9lfwynw";
   };
 
   doCheck = true;
diff --git a/pkgs/development/compilers/bs-platform/bs-platform-62.nix b/pkgs/development/compilers/bs-platform/build-bs-platform.nix
index d2913caaee64..03e01a7a0da5 100644
--- a/pkgs/development/compilers/bs-platform/bs-platform-62.nix
+++ b/pkgs/development/compilers/bs-platform/build-bs-platform.nix
@@ -1,35 +1,33 @@
-{ stdenv, fetchFromGitHub, ninja, nodejs, python3 }:
-let
-  version = "6.2.1";
-  ocaml-version = "4.06.1";
-  src = fetchFromGitHub {
-    owner = "BuckleScript";
-    repo = "bucklescript";
-    rev = "${version}";
-    sha256 = "0zx9nq7cik0c60n3rndqfqy3vdbj5lcrx6zcqcz2d60jjxi1z32y";
-    fetchSubmodules = true;
-  };
-  ocaml =  import ./ocaml.nix {
-    bs-version = version;
+# This file is based on https://github.com/turboMaCk/bs-platform.nix/blob/master/build-bs-platform.nix
+# to make potential future updates simpler
+
+{ stdenv, fetchFromGitHub, ninja, runCommand, nodejs, python3,
+  ocaml-version, version, src,
+  ocaml ? (import ./ocaml.nix {
     version = ocaml-version;
     inherit stdenv;
     src = "${src}/ocaml";
-  };
-in
+  }),
+  custom-ninja ? (ninja.overrideAttrs (attrs: {
+    src = runCommand "ninja-patched-source" {} ''
+      mkdir -p $out
+      tar zxvf ${src}/vendor/ninja.tar.gz -C $out
+    '';
+    patches = [];
+  }))
+}:
 stdenv.mkDerivation {
   inherit src version;
   pname = "bs-platform";
   BS_RELEASE_BUILD = "true";
-  buildInputs = [ nodejs python3 ];
+  buildInputs = [ nodejs python3 custom-ninja ];
 
   patchPhase = ''
     sed -i 's:./configure.py --bootstrap:python3 ./configure.py --bootstrap:' ./scripts/install.js
-
     mkdir -p ./native/${ocaml-version}/bin
-    ln -sf ${ocaml}/bin/* ./native/${ocaml-version}/bin
-
+    ln -sf ${ocaml}/bin/*  ./native/${ocaml-version}/bin
     rm -f vendor/ninja/snapshot/ninja.linux
-    cp ${ninja}/bin/ninja vendor/ninja/snapshot/ninja.linux
+    cp ${custom-ninja}/bin/ninja vendor/ninja/snapshot/ninja.linux
   '';
 
   configurePhase = ''
@@ -42,12 +40,9 @@ stdenv.mkDerivation {
 
   installPhase = ''
     node scripts/install.js
-
     mkdir -p $out/bin
-
     cp -rf jscomp lib vendor odoc_gen native $out
     cp bsconfig.json package.json $out
-
     ln -s $out/lib/bsb $out/bin/bsb
     ln -s $out/lib/bsc $out/bin/bsc
     ln -s $out/lib/bsrefmt $out/bin/bsrefmt
diff --git a/pkgs/development/compilers/bs-platform/default.nix b/pkgs/development/compilers/bs-platform/default.nix
index 5eb11671ca90..7abf7b306a55 100644
--- a/pkgs/development/compilers/bs-platform/default.nix
+++ b/pkgs/development/compilers/bs-platform/default.nix
@@ -1,15 +1,28 @@
-{ stdenv, fetchFromGitHub, ninja, nodejs, python3, ... }:
+{ stdenv, runCommand, fetchFromGitHub, ninja, nodejs, python3, ... }:
 let
+  build-bs-platform = import ./build-bs-platform.nix;
+in
+(build-bs-platform {
+  inherit stdenv runCommand fetchFromGitHub ninja nodejs python3;
+  version = "7.0.1";
+  ocaml-version = "4.06.1";
+
+  src = fetchFromGitHub {
+    owner = "BuckleScript";
+    repo = "bucklescript";
+    rev = "52770839e293ade2bcf187f2639000ca0a9a1d46";
+    sha256 = "0s7g2zfhshsilv9zyp0246bypg34d294z27alpwz03ws9608yr7k";
+    fetchSubmodules = true;
+  };
+}).overrideAttrs (attrs: {
   meta = with stdenv.lib; {
     description = "A JavaScript backend for OCaml focused on smooth integration and clean generated code.";
     homepage = https://bucklescript.github.io;
     license = licenses.lgpl3;
-    maintainers = with maintainers; [ turbomack gamb ];
+    maintainers = with maintainers; [ turbomack gamb anmonteiro ];
     platforms = platforms.all;
+    # Currently there is an issue with aarch build in hydra
+    # https://github.com/BuckleScript/bucklescript/issues/4091
+    badPlatforms = platforms.aarch64;
   };
-in
-{
-  bs-platform-621 = import ./bs-platform-62.nix {
-    inherit stdenv fetchFromGitHub ninja nodejs python3;
-  } // { inherit meta; };
-}
+})
diff --git a/pkgs/development/compilers/bs-platform/ocaml.nix b/pkgs/development/compilers/bs-platform/ocaml.nix
index 1f2fdd571f3d..9aa34d02b362 100644
--- a/pkgs/development/compilers/bs-platform/ocaml.nix
+++ b/pkgs/development/compilers/bs-platform/ocaml.nix
@@ -1,7 +1,7 @@
-{ stdenv, src, version, bs-version }:
+{ stdenv, src, version }:
 stdenv.mkDerivation rec {
   inherit src version;
-  name = "ocaml-${version}+bs-${bs-version}";
+  name = "ocaml-${version}+bs";
   configurePhase = ''
     ./configure -prefix $out
   '';
diff --git a/pkgs/development/compilers/ghc/8.10.1.nix b/pkgs/development/compilers/ghc/8.10.1.nix
index 25226d4d0e6b..b68e48025512 100644
--- a/pkgs/development/compilers/ghc/8.10.1.nix
+++ b/pkgs/development/compilers/ghc/8.10.1.nix
@@ -86,12 +86,12 @@ let
 
 in
 stdenv.mkDerivation (rec {
-  version = "8.10.0.20191210";
+  version = "8.10.0.20200108";
   name = "${targetPrefix}ghc-${version}";
 
   src = fetchurl {
-    url = "https://downloads.haskell.org/ghc/8.10.1-alpha2/ghc-${version}-src.tar.xz";
-    sha256 = "1mmv8s9cs41kp7wh1qqnzin5wv32cvs3lmzgda7njz0ssqb0mmvj";
+    url = "https://downloads.haskell.org/ghc/8.10.1-rc1/ghc-${version}-src.tar.xz";
+    sha256 = "1xm6cb3s2x3rycnyvkh12mp65xi3zbwrk5ima8sg7c245f3dl0ay";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/compilers/graalvm/001_mx.py.patch b/pkgs/development/compilers/graalvm/001_mx.py.patch
index a87a030aa395..0477c6c556f1 100644
--- a/pkgs/development/compilers/graalvm/001_mx.py.patch
+++ b/pkgs/development/compilers/graalvm/001_mx.py.patch
@@ -1,57 +1,31 @@
 diff --git a/mx.py b/mx.py
-index af7a9c2..08c0ea8 100755
+index a0b9315..b7d67a0 100755
 --- a/mx.py
 +++ b/mx.py
-@@ -4976,30 +4976,6 @@ class PackedResourceLibrary(ResourceLibrary):
+@@ -238,21 +238,7 @@ def _check_file_with_sha1(path, sha1, sha1path, mustExist=True, newFile=False, l
+             f.write(value or sha1OfFile(path))
  
-     def get_path(self, resolve):
-         extract_path = _make_absolute(self.extract_path, self.suite.dir)
--        download_path = super(PackedResourceLibrary, self).get_path(resolve)
--        if resolve and self._check_extract_needed(extract_path, download_path):
--            extract_path_tmp = tempfile.mkdtemp(suffix=basename(extract_path), dir=dirname(extract_path))
--            try:
--                # extract archive
--                Extractor.create(download_path).extract(extract_path_tmp)
--                # ensure modification time is up to date
--                os.utime(extract_path_tmp, None)
--                logv("Moving temporary directory {} to {}".format(extract_path_tmp, extract_path))
--                try:
--                    # attempt atomic overwrite
--                    os.rename(extract_path_tmp, extract_path)
--                except OSError:
--                    # clean destination & re-try for cases where atomic overwrite doesn't work
--                    rmtree(extract_path, ignore_errors=True)
--                    os.rename(extract_path_tmp, extract_path)
--            except OSError as ose:
--                # Rename failed. Race with other process?
--                if self._check_extract_needed(extract_path, download_path):
--                    # ok something really went wrong
--                    abort("Extracting {} failed!".format(download_path), context=ose)
--            finally:
--                rmtree(extract_path_tmp, ignore_errors=True)
+     if exists(path):
+-        if sha1Check and sha1:
+-            if not _sha1CachedValid() or (newFile and sha1 != _sha1Cached()):
+-                logv('Create/update SHA1 cache file ' + sha1path)
+-                _writeSha1Cached()
 -
-         return extract_path
- 
-     def _check_download_needed(self):
-@@ -5900,7 +5876,7 @@ class HgConfig(VC):
- 
-     def update_to_branch(self, vcdir, branch, abortOnError=True):
-         cmd = ['update', branch]
--        self.hg_command(vcdir, cmd, abortOnError=abortOnError)
-+        self.run(['hg', vcdir] + cmd)
- 
-     def add(self, vcdir, path, abortOnError=True):
-         return self.run(['hg', '-q', '-R', vcdir, 'add', path]) == 0
-@@ -5937,7 +5913,7 @@ class HgConfig(VC):
-                 return None
- 
-     def parent_info(self, vcdir, abortOnError=True):
--        out = self.hg_command(vcdir, ["log", "-r", ".", "--template", "{author}|||{date|hgdate}"], abortOnError=abortOnError)
-+        out = _check_output_str(["hg", '-R', vcdir, "log", "-r", ".", "--template", "{author}|||{date|hgdate}"])
-         author, date = out.split("|||")
-         ts, _ = date.split(" ")
-         return self._sanitize_parent_info({
-@@ -8301,46 +8277,8 @@ class SuiteImport:
+-            if sha1 != _sha1Cached():
+-                computedSha1 = sha1OfFile(path)
+-                if sha1 == computedSha1:
+-                    warn('Fixing corrupt SHA1 cache file ' + sha1path)
+-                    _writeSha1Cached(computedSha1)
+-                    return True
+-                if logErrors:
+-                    size = os.path.getsize(path)
+-                    log_error('SHA1 of {} [size: {}] ({}) does not match expected value ({})'.format(TimeStampFile(path), size, computedSha1, sha1))
+-                return False
++        return True
+     elif mustExist:
+         if logErrors:
+             log_error("'{}' does not exist".format(path))
+@@ -1057,46 +1043,8 @@ class SuiteImport:
          version = import_dict.get("version")
          suite_dir = None
          version_from = import_dict.get("versionFrom")
@@ -100,7 +74,7 @@ index af7a9c2..08c0ea8 100755
  
      @staticmethod
      def get_source_urls(source, kind=None):
-@@ -8381,8 +8319,6 @@ class Suite(object):
+@@ -1467,8 +1415,6 @@ class Suite(object):
      :type dists: list[Distribution]
      """
      def __init__(self, mxDir, primary, internal, importing_suite, load, vc, vc_dir, dynamicallyImported=False):
@@ -109,7 +83,7 @@ index af7a9c2..08c0ea8 100755
          self.imported_by = [] if primary else [importing_suite]
          self.mxDir = mxDir
          self.dir = dirname(mxDir)
-@@ -8410,7 +8346,7 @@ class Suite(object):
+@@ -1496,7 +1442,7 @@ class Suite(object):
          self._outputRoot = None
          self._preloaded_suite_dict = None
          self.vc = vc
@@ -118,7 +92,7 @@ index af7a9c2..08c0ea8 100755
          self._preload_suite_dict()
          self._init_imports()
          if load:
-@@ -9310,7 +9246,9 @@ def get_dynamic_imports():
+@@ -2405,7 +2351,9 @@ class Repository(SuiteConstituent):
  class SourceSuite(Suite):
      """A source suite"""
      def __init__(self, mxDir, primary=False, load=True, internal=False, importing_suite=None, dynamicallyImported=False):
@@ -129,7 +103,7 @@ index af7a9c2..08c0ea8 100755
          Suite.__init__(self, mxDir, primary, internal, importing_suite, load, vc, vc_dir, dynamicallyImported=dynamicallyImported)
          logvv("SourceSuite.__init__({}), got vc={}, vc_dir={}".format(mxDir, self.vc, self.vc_dir))
          self.projects = []
-@@ -9359,17 +9297,7 @@ class SourceSuite(Suite):
+@@ -2454,17 +2402,7 @@ class SourceSuite(Suite):
          """
          Gets the release tag from VC or create a time based once if VC is unavailable
          """
@@ -148,7 +122,57 @@ index af7a9c2..08c0ea8 100755
  
      def scm_metadata(self, abortOnError=False):
          scm = self.scm
-@@ -12541,55 +12469,8 @@ def _attempt_download(url, path, jarEntryName=None):
+@@ -2993,12 +2931,35 @@ def _find_suite_import(importing_suite, suite_import, fatalIfMissing=True, load=
+         Attempts to locate an existing suite in the local context
+         Returns the path to the mx.name dir if found else None
+         """
+-        if mode == 'binary':
+-            # binary suites are always stored relative to the importing suite in mx-private directory
+-            return importing_suite._find_binary_suite_dir(suite_import.name)
++        warn("FAKE CLONE: " + str(suite_import))
++        if (suite_import.name == "truffle"):
++            return join(get_env('TMP'), "source", "truffle", "mx.truffle")
++        if (suite_import.name == "graal-nodejs"):
++            return join(get_env('MX_GIT_CACHE_DIR'), "graaljs", "graal-nodejs", "mx.graal-nodejs")
++        if (suite_import.name == "truffleruby"):
++            return join(get_env('MX_GIT_CACHE_DIR'), "truffleruby", "mx.truffleruby")
++        if (suite_import.name == "graalpython"):
++            return join(get_env('MX_GIT_CACHE_DIR'), "graalpython", "mx.graalpython")
++        if (suite_import.name == "vm"):
++            return join(get_env('TMP'), "source", "vm", "mx.vm")
++        if (suite_import.name == "fastr"):
++            return join(get_env('MX_GIT_CACHE_DIR'), "fastr", "mx.fastr")
++        if (suite_import.name == "sdk"):
++            return join(get_env('TMP'), "source", "sdk", "mx.sdk")
++        if (suite_import.name == "graal-js"):
++            return join(get_env('MX_GIT_CACHE_DIR'), "graaljs", "graal-js", "mx.graal-js")
++        if (suite_import.name == "regex"):
++            return join(get_env('TMP'), "source", "regex", "mx.regex")
++        if (suite_import.name == "substratevm"):
++            return join(get_env('TMP'), "source", "substratevm", "mx.substratevm")
++        if (suite_import.name == "tools"):
++            return join(get_env('TMP'), "source", "tools", "mx.tools")
++        if (suite_import.name == "sulong"):
++            return join(get_env('TMP'), "source", "sulong", "mx.sulong")
++        if (suite_import.name == "compiler"):
++            return join(get_env('TMP'), "source", "compiler", "mx.compiler")
+         else:
+-            # use the SuiteModel to locate a local source copy of the suite
+-            return _suitemodel.find_suite_dir(suite_import)
++            return join(get_env('MX_GIT_CACHE_DIR'), suite_import.name)
+ 
+     def _get_import_dir(url, mode):
+         """Return directory where the suite will be cloned to"""
+@@ -3816,7 +3777,7 @@ def getmtime(name):
+     """
+     Wrapper for builtin open function that handles long path names on Windows.
+     """
+-    return os.path.getmtime(_safe_path(name))
++    return 315532800
+ 
+ 
+ def stat(name):
+@@ -4062,57 +4023,8 @@ def _attempt_download(url, path, jarEntryName=None):
      return False
  
  def download(path, urls, verbose=False, abortOnError=True, verifyOnly=False):
@@ -173,40 +197,91 @@ index af7a9c2..08c0ea8 100755
 -            url = m.group(1)
 -            jarEntryName = m.group(2)
 -
+-        if not _opts.trust_http and (url.lower().startswith('http://') or url.lower().startswith('ftp://')):
+-            warn('Downloading from non-https URL {}. Use --trust-http mx option to suppress this warning.'.format(url))
+-
 -        if verifyOnly:
 -            try:
 -                conn = _urlopen(url, timeout=10)
 -                conn.close()
--                return True
 -            except (IOError, socket.timeout) as e:
 -                _suggest_tlsv1_error(e)
 -                verify_errors[url] = e
--            continue
+-        else:
+-            for i in range(4):
+-                if i != 0:
+-                    time.sleep(1)
+-                    warn('Retry {} to download from {}'.format(i, url))
+-                if _attempt_download(url, path, jarEntryName):
+-                    return True # Download was successful
 -
--        for i in range(4):
--            if i != 0:
--                time.sleep(1)
--                warn('Retry {} to download from {}'.format(i, url))
--            res = _attempt_download(url, path, jarEntryName)
--            if res is True:
--                return True
--            if res is False:
--                break
--
--    if abortOnError:
+-    if verifyOnly and len(verify_errors) < len(urls): # verify-mode at least one success -> success
+-        return True
+-    else: # Either verification error or no download was successful
 -        msg = 'Could not download to ' + path + ' from any of the following URLs: ' + ', '.join(urls)
--        if verifyOnly:
+-        if verifyOnly: # verify-mode -> print error details
 -            for url, e in verify_errors.items():
 -                msg += '\n  ' + url + ': ' + str(e)
--        abort(msg)
--    else:
--        return False
+-        if abortOnError:
+-            abort(msg)
+-        else:
+-            warn(msg)
+-            return False
 +    print("FAKE download(path={} urls={} verbose={} abortOnError={} verifyOnly={})".format(path, urls, verbose, abortOnError, verifyOnly))
 +    return True
  
  def update_file(path, content, showDiff=False):
      """
-@@ -13393,6 +13274,7 @@ class Archiver(SafeFileCreation):
+@@ -7887,30 +7799,6 @@ class PackedResourceLibrary(ResourceLibrary):
+ 
+     def get_path(self, resolve):
+         extract_path = _make_absolute(self.extract_path, self.suite.dir)
+-        download_path = super(PackedResourceLibrary, self).get_path(resolve)
+-        if resolve and self._check_extract_needed(extract_path, download_path):
+-            extract_path_tmp = tempfile.mkdtemp(suffix=basename(extract_path), dir=dirname(extract_path))
+-            try:
+-                # extract archive
+-                Extractor.create(download_path).extract(extract_path_tmp)
+-                # ensure modification time is up to date
+-                os.utime(extract_path_tmp, None)
+-                logv("Moving temporary directory {} to {}".format(extract_path_tmp, extract_path))
+-                try:
+-                    # attempt atomic overwrite
+-                    os.rename(extract_path_tmp, extract_path)
+-                except OSError:
+-                    # clean destination & re-try for cases where atomic overwrite doesn't work
+-                    rmtree(extract_path, ignore_errors=True)
+-                    os.rename(extract_path_tmp, extract_path)
+-            except OSError as ose:
+-                # Rename failed. Race with other process?
+-                if self._check_extract_needed(extract_path, download_path):
+-                    # ok something really went wrong
+-                    abort("Extracting {} failed!".format(download_path), context=ose)
+-            finally:
+-                rmtree(extract_path_tmp, ignore_errors=True)
+-
+         return extract_path
+ 
+     def _check_download_needed(self):
+@@ -8430,7 +8318,7 @@ class VC(_with_metaclass(ABCMeta, object)):
+         :param str branch: a branch name
+         :param bool abortOnError: if True abort on error
+         """
+-        abort(self.kind + " update_to_branch is not implemented")
++        self.run(['hg', vcdir] + cmd)
+ 
+     def is_release_from_tags(self, vcdir, prefix):
+         """
+@@ -8831,7 +8719,7 @@ class HgConfig(VC):
+                 return None
+ 
+     def parent_info(self, vcdir, abortOnError=True):
+-        out = self.hg_command(vcdir, ["log", "-r", ".", "--template", "{author}|||{date|hgdate}"], abortOnError=abortOnError)
++        out = _check_output_str(["hg", '-R', vcdir, "log", "-r", ".", "--template", "{author}|||{date|hgdate}"])
+         author, date = out.split("|||")
+         ts, _ = date.split(" ")
+         return self._sanitize_parent_info({
+@@ -14069,6 +13957,7 @@ class Archiver(SafeFileCreation):
  
      def _add_zip(self, filename, archive_name, provenance):
          self._add_provenance(archive_name, provenance)
@@ -214,44 +289,3 @@ index af7a9c2..08c0ea8 100755
          self.zf.write(filename, archive_name)
  
      def _add_str_zip(self, data, archive_name, provenance):
-@@ -18541,12 +18423,35 @@ def _find_suite_import(importing_suite, suite_import, fatalIfMissing=True, load=
-         Attempts to locate an existing suite in the local context
-         Returns the path to the mx.name dir if found else None
-         """
--        if mode == 'binary':
--            # binary suites are always stored relative to the importing suite in mx-private directory
--            return importing_suite._find_binary_suite_dir(suite_import.name)
-+        warn("FAKE CLONE: " + str(suite_import))
-+        if (suite_import.name == "truffle"):
-+            return join(get_env('TMP'), "source", "truffle", "mx.truffle")
-+        if (suite_import.name == "graal-nodejs"):
-+            return join(get_env('MX_GIT_CACHE_DIR'), "graaljs", "graal-nodejs", "mx.graal-nodejs")
-+        if (suite_import.name == "truffleruby"):
-+            return join(get_env('MX_GIT_CACHE_DIR'), "truffleruby", "mx.truffleruby")
-+        if (suite_import.name == "graalpython"):
-+            return join(get_env('MX_GIT_CACHE_DIR'), "graalpython", "mx.graalpython")
-+        if (suite_import.name == "vm"):
-+            return join(get_env('TMP'), "source", "vm", "mx.vm")
-+        if (suite_import.name == "fastr"):
-+            return join(get_env('MX_GIT_CACHE_DIR'), "fastr", "mx.fastr")
-+        if (suite_import.name == "sdk"):
-+            return join(get_env('TMP'), "source", "sdk", "mx.sdk")
-+        if (suite_import.name == "graal-js"):
-+            return join(get_env('MX_GIT_CACHE_DIR'), "graaljs", "graal-js", "mx.graal-js")
-+        if (suite_import.name == "regex"):
-+            return join(get_env('TMP'), "source", "regex", "mx.regex")
-+        if (suite_import.name == "substratevm"):
-+            return join(get_env('TMP'), "source", "substratevm", "mx.substratevm")
-+        if (suite_import.name == "tools"):
-+            return join(get_env('TMP'), "source", "tools", "mx.tools")
-+        if (suite_import.name == "sulong"):
-+            return join(get_env('TMP'), "source", "sulong", "mx.sulong")
-+        if (suite_import.name == "compiler"):
-+            return join(get_env('TMP'), "source", "compiler", "mx.compiler")
-         else:
--            # use the SuiteModel to locate a local source copy of the suite
--            return _suitemodel.find_suite_dir(suite_import)
-+            return join(get_env('MX_GIT_CACHE_DIR'), suite_import.name)
- 
-     def _get_import_dir(url, mode):
-         """Return directory where the suite will be cloned to"""
diff --git a/pkgs/development/compilers/graalvm/005_tool_jt.rb.patch b/pkgs/development/compilers/graalvm/005_tool_jt.rb.patch
new file mode 100644
index 000000000000..06f693db9f63
--- /dev/null
+++ b/pkgs/development/compilers/graalvm/005_tool_jt.rb.patch
@@ -0,0 +1,46 @@
+diff --git a/tool/jt.rb b/tool/jt.rb
+index 870d88edcb..0a6e4c367b 100755
+--- a/tool/jt.rb
++++ b/tool/jt.rb
+@@ -152,13 +152,16 @@ module Utilities
+   end
+ 
+   def find_mx
+-    if which('mx')
+-      'mx'
++    if ENV.key?("MX_GIT_CACHE_DIR")
++      "mx-internal"
+     else
+-      mx_repo = find_or_clone_repo("https://github.com/graalvm/mx.git")
+-      "#{mx_repo}/mx"
++      if which('mx')
++        'mx'
++      else
++        mx_repo = find_or_clone_repo("https://github.com/graalvm/mx.git")
++        "#{mx_repo}/mx"
++      end
+     end
+-  end
+ 
+   def find_launcher(use_native)
+     if use_native
+@@ -444,8 +447,8 @@ module Commands
+           --no-sforceimports                         do not run sforceimports before building
+           parser                                     build the parser
+           options                                    build the options
+-          graalvm                                    build a minimal JVM-only GraalVM containing only TruffleRuby, 
+-                                                     available by default in mxbuild/truffleruby-jvm, 
++          graalvm                                    build a minimal JVM-only GraalVM containing only TruffleRuby,
++                                                     available by default in mxbuild/truffleruby-jvm,
+                                                      the Ruby is symlinked into rbenv or chruby if available
+               --graal      include the GraalVM Compiler in the build
+               --native     build native ruby image as well, available in mxbuild/truffleruby-native
+@@ -491,7 +494,7 @@ module Commands
+       jt test compiler                               run compiler tests
+       jt test integration [TESTS]                    run integration tests
+       jt test bundle [--jdebug]                      tests using bundler
+-      jt test gems [TESTS]                           tests using gems 
++      jt test gems [TESTS]                           tests using gems
+       jt test ecosystem [TESTS]                      tests using the wider ecosystem such as bundler, Rails, etc
+       jt test cexts [--no-openssl] [--no-gems] [test_names...]
+                                                      run C extension tests (set GEM_HOME)
diff --git a/pkgs/development/compilers/graalvm/006_mx_copylib.py.patch b/pkgs/development/compilers/graalvm/006_mx_copylib.py.patch
new file mode 100644
index 000000000000..43ca3e168327
--- /dev/null
+++ b/pkgs/development/compilers/graalvm/006_mx_copylib.py.patch
@@ -0,0 +1,14 @@
+diff --git a/mx.fastr/mx_copylib.py b/mx.fastr/mx_copylib.py
+index 4f57e1954..db45220d9 100644
+--- a/mx.fastr/mx_copylib.py
++++ b/mx.fastr/mx_copylib.py
+@@ -54,6 +54,9 @@ def _copylib(lib, libpath, plain_libpath_base, target):
+     else:
+         try:
+             if platform.system() == 'Linux':
++                # https://github.com/oracle/fastr/issues/110
++                if libpath.endswith("libgcc_s.so"):
++                    libpath = libpath + ".1"
+                 output = subprocess.check_output(['objdump', '-p', libpath])
+             elif platform.system() == 'SunOS':
+                 output = subprocess.check_output(['elfdump', '-d', libpath])
diff --git a/pkgs/development/compilers/graalvm/007_unimplemented.c.patch b/pkgs/development/compilers/graalvm/007_unimplemented.c.patch
new file mode 100644
index 000000000000..96cca7ed239b
--- /dev/null
+++ b/pkgs/development/compilers/graalvm/007_unimplemented.c.patch
@@ -0,0 +1,85 @@
+diff --git a/com.oracle.truffle.r.native/fficall/src/common/unimplemented.c b/com.oracle.truffle.r.native/fficall/src/common/unimplemented.c
+index dcf081316..c2cb4879b 100644
+--- a/com.oracle.truffle.r.native/fficall/src/common/unimplemented.c
++++ b/com.oracle.truffle.r.native/fficall/src/common/unimplemented.c
+@@ -20,8 +20,10 @@
+ 
+ #include <Rinternals.h>
+ #include <stdlib.h>
++#include <rlocale.h>
+ 
+ #include <R_ext/eventloop.h>
++#include <R_ext/GraphicsEngine.h>
+ #include <Defn.h>
+ 
+ Rboolean known_to_be_latin1 = FALSE;
+@@ -166,3 +168,69 @@ int Scollate(SEXP a, SEXP b) {
+ void z_prec_r(Rcomplex *r, Rcomplex *x, double digits) {
+     unimplemented("z_prec_r");
+ }
++
++int Rf_AdobeSymbol2ucs2(int n) {
++  unimplemented("Rf_AdobeSymbol2ucs2");
++  return 0;
++}
++
++size_t Mbrtowc(wchar_t *wc, const char *s, size_t n, mbstate_t *ps) {
++  unimplemented("Mbrtowc");
++  return 0;
++}
++
++double R_GE_VStrHeight(const char *s, cetype_t enc, const pGEcontext gc, pGEDevDesc dd) {
++  unimplemented("R_GE_VStrHeight");
++  return 0;
++}
++
++void R_GE_VText(double x, double y, const char * const s, cetype_t enc,
++		double x_justify, double y_justify, double rotation,
++		const pGEcontext gc, pGEDevDesc dd) {
++  unimplemented("R_GE_VText");
++}
++
++double R_GE_VStrWidth(const char *s, cetype_t enc, const pGEcontext gc, pGEDevDesc dd) {
++  unimplemented("R_GE_VStrWidth");
++}
++
++void setulb(int n, int m, double *x, double *l, double *u, int *nbd,
++	    double *f, double *g, double factr, double *pgtol,
++	    double *wa, int * iwa, char *task, int iprint, int *isave) {
++  unimplemented("setulb");
++}
++
++void genptry(int n, double *p, double *ptry, double scale, void *ex) {
++  unimplemented("genptry");
++}
++
++double EXP(double x) {
++  unimplemented("EXP");
++  return 0;
++}
++
++double LOG(double x) {
++  unimplemented("LOG");
++  return 0;
++}
++
++Rwchar_t Rf_utf8toucs32(wchar_t high, const char *s) {
++  unimplemented("Rf_utf8toucs32");
++  return 0;
++}
++
++size_t mbtoucs(unsigned int *wc, const char *s, size_t n) {
++  unimplemented("mbtoucs");
++  return (size_t) 0;
++}
++
++
++int DispatchOrEval(SEXP call, SEXP op, const char *generic, SEXP args,
++		   SEXP rho, SEXP *ans, int dropmissing, int argsevald) {
++  unimplemented("DispatchOrEval");
++  return 0;
++}
++
++void ENSURE_NAMEDMAX (SEXP x) {
++  unimplemented("ENSURE_NAMEDMAX");
++}
diff --git a/pkgs/development/compilers/graalvm/008_remove_jfr.patch b/pkgs/development/compilers/graalvm/008_remove_jfr.patch
new file mode 100644
index 000000000000..1aea044c8023
--- /dev/null
+++ b/pkgs/development/compilers/graalvm/008_remove_jfr.patch
@@ -0,0 +1,33 @@
+diff --git a/mx.jvmci/suite.py b/mx.jvmci/suite.py
+index 9690c0a38f..fa1d36b7e1 100644
+--- a/mx.jvmci/suite.py
++++ b/mx.jvmci/suite.py
+@@ -241,18 +241,7 @@ suite = {
+       "workingSets" : "JVMCI,HotSpot,SPARC",
+     },
+ 
+-    "jdk.vm.ci.hotspot.jfr" : {
+-      "subDir" : "jvmci",
+-      "sourceDirs" : ["src"],
+-      "dependencies" : [
+-        "jdk.vm.ci.hotspot",
+-        "JFR",
+-      ],
+-      "checkstyle" : "jdk.vm.ci.hotspot",
+-      "javaCompliance" : "1.8",
+-      "profile" : "",
+-      "workingSets" : "JVMCI,HotSpot",
+-    },
++
+ 
+     "hotspot" : {
+       "native" : True,
+@@ -354,7 +343,7 @@ suite = {
+         "jdk.vm.ci.hotspot.aarch64",
+         "jdk.vm.ci.hotspot.amd64",
+         "jdk.vm.ci.hotspot.sparc",
+-        "jdk.vm.ci.hotspot.jfr",
++
+       ],
+       "distDependencies" : [
+         "JVMCI_SERVICES",
diff --git a/pkgs/development/compilers/graalvm/009_remove_signedness_verifier.patch b/pkgs/development/compilers/graalvm/009_remove_signedness_verifier.patch
new file mode 100644
index 000000000000..cf8bd4050662
--- /dev/null
+++ b/pkgs/development/compilers/graalvm/009_remove_signedness_verifier.patch
@@ -0,0 +1,21 @@
+diff --git a/substratevm/src/com.oracle.svm.hosted/src/com/oracle/svm/hosted/c/query/SizeAndSignednessVerifier.java b/substratevm/src/com.oracle.svm.hosted/src/com/oracle/svm/hosted/c/query/SizeAndSignednessVerifier.java
+index 23a76357fd2..f13694b6ed7 100644
+--- a/substratevm/src/com.oracle.svm.hosted/src/com/oracle/svm/hosted/c/query/SizeAndSignednessVerifier.java
++++ b/substratevm/src/com.oracle.svm.hosted/src/com/oracle/svm/hosted/c/query/SizeAndSignednessVerifier.java
+@@ -249,15 +249,6 @@ public final class SizeAndSignednessVerifier extends NativeInfoTreeVisitor {
+     }
+ 
+     private void checkSignedness(boolean isUnsigned, ResolvedJavaType type, ResolvedJavaMethod method) {
+-        if (isSigned(type)) {
+-            if (isUnsigned) {
+-                addError("Type " + type.toJavaName(false) + " is signed, but accessed C value is unsigned", method);
+-            }
+-        } else if (nativeLibs.isWordBase(type)) {
+-            /* every Word type other than Signed is assumed to be unsigned. */
+-            if (!isUnsigned) {
+-                addError("Type " + type.toJavaName(false) + " is unsigned, but accessed C value is signed", method);
+-            }
+-        }
++
+     }
+ }
diff --git a/pkgs/development/compilers/graalvm/010_mx_substratevm.py b/pkgs/development/compilers/graalvm/010_mx_substratevm.py
new file mode 100644
index 000000000000..afb6b5681679
--- /dev/null
+++ b/pkgs/development/compilers/graalvm/010_mx_substratevm.py
@@ -0,0 +1,13 @@
+diff --git a/substratevm/mx.substratevm/mx_substratevm.py b/substratevm/mx.substratevm/mx_substratevm.py
+index b89163ef983..0fd0138b336 100644
+--- a/substratevm/mx.substratevm/mx_substratevm.py
++++ b/substratevm/mx.substratevm/mx_substratevm.py
+@@ -189,7 +189,7 @@ if str(svm_java_compliance().value) not in GRAAL_COMPILER_FLAGS_MAP:
+     mx.abort("Substrate VM does not support this Java version: " + str(svm_java_compliance()))
+ GRAAL_COMPILER_FLAGS = GRAAL_COMPILER_FLAGS_BASE + GRAAL_COMPILER_FLAGS_MAP[str(svm_java_compliance().value)]
+ 
+-IMAGE_ASSERTION_FLAGS = ['-H:+VerifyGraalGraphs', '-H:+VerifyPhases']
++IMAGE_ASSERTION_FLAGS = ['-H:+VerifyGraalGraphs', '-H:+VerifyPhases', '-H:+ReportExceptionStackTraces']
+ suite = mx.suite('substratevm')
+ svmSuites = [suite]
+ clibraryDists = ['SVM_HOSTED_NATIVE']
diff --git a/pkgs/development/compilers/graalvm/default.nix b/pkgs/development/compilers/graalvm/default.nix
index ec81063e67e2..b3066b3098cb 100644
--- a/pkgs/development/compilers/graalvm/default.nix
+++ b/pkgs/development/compilers/graalvm/default.nix
@@ -1,10 +1,11 @@
 { stdenv, lib, fetchFromGitHub, fetchurl, fetchzip, fetchgit, mercurial_4, python27, setJavaClassPath,
-  zlib, makeWrapper, openjdk, unzip, git, clang, llvm, which, icu, ruby, bzip2, glibc
-  # gfortran, readline, bzip2, lzma, pcre, curl, ed, tree ## WIP: fastr deps
+  which, zlib, makeWrapper, openjdk, unzip, git, clang, llvm, icu, ruby, glibc, bash, gcc, libobjc,
+  xcodebuild, gfortran, readline, bzip2, lzma, pcre, curl, ed, libresolv, libiconv, writeScriptBin,
+  openssl, perl, CoreFoundation, Foundation, JavaNativeFoundation, JavaRuntimeSupport, JavaVM, Cocoa
 }:
 
 let
-  version = "19.1.1";
+  version = "19.2.1";
   mercurial = mercurial_4;
   truffleMake = ./truffle.make;
   makeMxGitCache = list: out: ''
@@ -25,6 +26,57 @@ let
     chmod -R +rw ${out}/graaljs/graal-nodejs/mx.graal-nodejs/python2
     patchShebangs ${out}/graaljs/graal-nodejs/mx.graal-nodejs/python2/python
 
+    # # TUFFLE-RUBY # #
+    (cd ${out}/truffleruby && git apply ${./005_tool_jt.rb.patch})
+    patchShebangs ${out}/truffleruby/tool/query-versions-json.rb
+
+    substituteInPlace ${out}/truffleruby/src/main/c/Makefile \
+      --replace '(MX_HOME)/mx' '(MX_HOME)/mx-internal'
+
+    substituteInPlace ${out}/truffleruby/src/processor/java/org/truffleruby/processor/BuildInformationProcessor.java \
+      --replace 'trufflerubyHome = findHome();' \
+                'trufflerubyHome = new File(System.getenv("MX_GIT_CACHE_DIR"), "truffleruby");' \
+      --replace tool/query-versions-json.rb 'ruby tool/query-versions-json.rb' \
+      --replace 'revision = runCommand("git rev-parse --short=8 HEAD");' \
+                'revision = "${version}";' \
+      --replace 'compileDate = runCommand("git log -1 --date=short --pretty=format:%cd");' \
+                'compileDate = "1970-01-01";'
+
+    substituteInPlace ${out}/truffleruby/mx.truffleruby/mx_truffleruby.py \
+      --replace "mx_binary = join(mx._mx_home, 'mx')" "mx_binary = join(mx._mx_home, 'mx-internal')"
+
+    # # FASTR # #
+    (cd ${out}/fastr && git apply ${ ./006_mx_copylib.py.patch })
+    (cd ${out}/fastr && git apply ${ ./007_unimplemented.c.patch })
+    substituteInPlace ${out}/fastr/com.oracle.truffle.r.parser.processor/src/com/oracle/truffle/r/parser/processor/GenerateRParserProcessor.java \
+      --replace 'File suiteRoot = srcGenDir.getCanonicalFile().getParentFile().getParentFile().getParentFile();' \
+                'File suiteRoot = new File(System.getenv("MX_GIT_CACHE_DIR"), "fastr");'
+
+    substituteInPlace ${out}/fastr/com.oracle.truffle.r.native/gnur/Makefile.libs \
+      --replace 'mx -p' 'mx-internal -p'
+
+    substituteInPlace ${out}/fastr/com.oracle.truffle.r.native/include/Makefile \
+      --replace 'mx -p' 'mx-internal -p'
+
+    substituteInPlace ${out}/fastr/com.oracle.truffle.r.native/fficall/Makefile \
+      --replace 'mx -p' 'mx-internal -p'
+
+    substituteInPlace ${out}/fastr/com.oracle.truffle.r.native.recommended/Makefile \
+      --replace 'mx -p' 'mx-internal -p'
+
+    # Make sure that the logs aren't hidden when compiling gnur
+    substituteInPlace ${out}/fastr/com.oracle.truffle.r.native/gnur/Makefile.gnur \
+      --replace '> gnur_configure.log 2>&1' "" \
+      --replace '> gnur_make.log 2>&1' ""
+
+    substituteInPlace ${out}/fastr/com.oracle.truffle.r.native/run/Linux/Renviron \
+      --replace /bin/ "" \
+      --replace /usr/bin/ ""
+
+    sed -i "s|exec \$mx|exec mx-internal|g" ${out}/fastr/com.oracle.truffle.r.native/run/*.sh
+    chmod +x ${out}/fastr/com.oracle.truffle.r.native/run/*.sh
+    patchShebangs ${out}/fastr/com.oracle.truffle.r.native/run/*.sh
+
     cd ${out}
     hg init
     hg add
@@ -50,14 +102,15 @@ let
                 unzip "$out/${name}" -d "$out/$BASENAME.extracted"
 
                 # Ninja is called later in the build process
-                if [ -f $out/$BASENAME.extracted/ninja ]; then
-                  patchelf --set-interpreter \
-                    "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-                    --set-rpath "${stdenv.cc.cc.lib}/lib64" \
-                    $out/$BASENAME.extracted/ninja
-                fi
-              ''
-            else ""}
+               ${lib.optionalString stdenv.isLinux ''
+                 if [ -f $out/$BASENAME.extracted/ninja ]; then
+                   patchelf --set-interpreter \
+                     "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+                     --set-rpath "${stdenv.cc.cc.lib}/lib64" \
+                     $out/$BASENAME.extracted/ninja
+                 fi''}
+                ''
+              else ""}
          '') list}
       '';
     };
@@ -89,30 +142,32 @@ let
     rec { sha1 = "42a25dc3219429f0e5d060061f71acb49bf010a0"; name = "HAMCREST_${sha1}/hamcrest.jar";                                                   url = mirror://maven/org/hamcrest/hamcrest-core/1.3/hamcrest-core-1.3.jar; }
     rec { sha1 = "1dc37250fbc78e23a65a67fbbaf71d2e9cbc3c0b"; name = "HAMCREST_${sha1}/hamcrest.sources.jar";                                           url = mirror://maven/org/hamcrest/hamcrest-core/1.3/hamcrest-core-1.3-sources.jar; }
     rec { sha1 = "0d031013db9a80d6c88330c42c983fbfa7053193"; name = "hsdis_${sha1}/hsdis.so";                                                          url = "https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/hsdis/intel/hsdis-amd64-linux-${sha1}.so"; }
-  ];
+] ++ lib.optionals stdenv.isLinux [
+  rec { sha1 = "0d031013db9a80d6c88330c42c983fbfa7053193"; name = "hsdis_${sha1}/hsdis.so";                                                          url = "https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/hsdis/intel/hsdis-amd64-linux-${sha1}.so"; }
+                                                                          ]
+++ lib.optionals stdenv.isDarwin [
+  rec { sha1 = "67f6d23cbebd8998450a88b5bef362171f66f11a"; name = "hsdis_${sha1}/hsdis.dylib";                                                       url = "https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/hsdis/intel/hsdis-amd64-darwin-${sha1}.dylib"; }
+                                                                          ];
 
   graal-mxcache = jvmci8-mxcache ++ [
+    # rec { sha1 = "5001adab652fc4eb35e30cdefbb0765442f8b7db"; name = "LLVM_ORG_LIBCXX_SRC_${sha1}/llvm-org-libcxx-src.tar.gz";                          url = https://lafo.ssw.uni-linz.ac.at/pub/llvm-org/compiler-rt-llvmorg-8.0.0-4-gd563e33a79-bgae3b177eaa-linux-amd64.tar.gz; }
+    rec { sha1 = "5001adab652fc4eb35e30cdefbb0765442f8b7db"; name = "LLVM_ORG_COMPILER_RT_LINUX_${sha1}/llvm-org-compiler-rt-linux.tar.gz";            url = https://lafo.ssw.uni-linz.ac.at/pub/llvm-org/compiler-rt-llvmorg-8.0.0-4-gd563e33a79-bgae3b177eaa-linux-amd64.tar.gz; }
     rec { sha1 = "a990b2dba1c706f5c43c56fedfe70bad9a695852"; name = "LLVM_WRAPPER_${sha1}/llvm-wrapper.jar";                                           url = mirror://maven/org/bytedeco/javacpp-presets/llvm/6.0.1-1.4.2/llvm-6.0.1-1.4.2.jar; }
     rec { sha1 = "decbd95d46092fa9afaf2523b5b23d07ad7ad6bc"; name = "LLVM_WRAPPER_${sha1}/llvm-wrapper.sources.jar";                                   url = mirror://maven/org/bytedeco/javacpp-presets/llvm/6.0.1-1.4.2/llvm-6.0.1-1.4.2-sources.jar; }
-    rec { sha1 = "344483aefa15147c121a8fb6fb35a2406768cc5c"; name = "LLVM_PLATFORM_SPECIFIC_${sha1}/llvm-platform-specific.jar";                       url = mirror://maven/org/bytedeco/javacpp-presets/llvm/6.0.1-1.4.2/llvm-6.0.1-1.4.2-linux-x86_64.jar; }
-    rec { sha1 = "503402aa0cf80fd95ede043c0011152c2b4556fd"; name = "LLVM_PLATFORM_${sha1}/llvm-platform.jar";                                         url = mirror://maven/org/bytedeco/javacpp-presets/llvm-platform/6.0.1-1.4.2/llvm-platform-6.0.1-1.4.2.jar; }
     rec { sha1 = "cfa6a0259d98bff5aa8d41ba11b4d1dad648fbaa"; name = "JAVACPP_${sha1}/javacpp.jar";                                                     url = mirror://maven/org/bytedeco/javacpp/1.4.2/javacpp-1.4.2.jar; }
     rec { sha1 = "fdb2d2c17f6b91cdd5421554396da8905f0dfed2"; name = "JAVACPP_${sha1}/javacpp.sources.jar";                                             url = mirror://maven/org/bytedeco/javacpp/1.4.2/javacpp-1.4.2-sources.jar; }
     rec { sha1 = "702ca2d0ae93841c5ab75e4d119b29780ec0b7d9"; name = "NINJA_SYNTAX_${sha1}/ninja-syntax.tar.gz";                                        url = "https://pypi.org/packages/source/n/ninja_syntax/ninja_syntax-1.7.2.tar.gz"; }
-    rec { sha1 = "987234c4ce45505c21302e097c24efef4873325c"; name = "NINJA_${sha1}/ninja.zip";                                                         url = "https://github.com/ninja-build/ninja/releases/download/v1.8.2/ninja-linux.zip";
-          isNinja = true; }
     rec { sha1 = "f2cfb09cee12469ff64f0d698b13de19903bb4f7"; name = "NanoHTTPD-WebSocket_${sha1}/nanohttpd-websocket.jar";                             url = mirror://maven/org/nanohttpd/nanohttpd-websocket/2.3.1/nanohttpd-websocket-2.3.1.jar; }
     rec { sha1 = "a8d54d1ca554a77f377eff6bf9e16ca8383c8f6c"; name = "NanoHTTPD_${sha1}/nanohttpd.jar";                                                 url = mirror://maven/org/nanohttpd/nanohttpd/2.3.1/nanohttpd-2.3.1.jar; }
     rec { sha1 = "946f8aa9daa917dd81a8b818111bec7e288f821a"; name = "ANTLR4_${sha1}/antlr4.jar";                                                       url = mirror://maven/org/antlr/antlr4-runtime/4.7.1/antlr4-runtime-4.7.1.jar; }
     rec { sha1 = "c3aeac59c022bdc497c8c48ed86fa50450e4896a"; name = "JLINE_${sha1}/jline.jar";                                                         url = mirror://maven/jline/jline/2.14.6/jline-2.14.6.jar; }
     rec { sha1 = "d0bdc21c5e6404726b102998e44c66a738897905"; name = "JAVA_ALLOCATION_INSTRUMENTER_${sha1}/java-allocation-instrumenter.jar";           url = mirror://maven/com/google/code/java-allocation-instrumenter/java-allocation-instrumenter/3.1.0/java-allocation-instrumenter-3.1.0.jar; }
-    rec { sha1 = "0da08b8cce7bbf903602a25a3a163ae252435795"; name = "ASM5_${sha1}/asm5.jar";                                                        url = mirror://maven/org/ow2/asm/asm/5.0.4/asm-5.0.4.jar; }
+    rec { sha1 = "0da08b8cce7bbf903602a25a3a163ae252435795"; name = "ASM5_${sha1}/asm5.jar";                                                           url = mirror://maven/org/ow2/asm/asm/5.0.4/asm-5.0.4.jar; }
     rec { sha1 = "396ce0c07ba2b481f25a70195c7c94922f0d1b0b"; name = "ASM_TREE5_${sha1}/asm-tree5.jar";                                                 url = mirror://maven/org/ow2/asm/asm-tree/5.0.4/asm-tree-5.0.4.jar; }
     rec { sha1 = "280c265b789e041c02e5c97815793dfc283fb1e6"; name = "LIBFFI_SOURCES_${sha1}/libffi-sources.tar.gz";                                    url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/libffi-3.2.1.tar.gz; }
     rec { sha1 = "8819cea8bfe22c9c63f55465e296b3855ea41786"; name = "TruffleJSON_${sha1}/trufflejson.jar";                                             url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/trufflejson-20180130.jar; }
     rec { sha1 = "9712a8124c40298015f04a74f61b3d81a51513af"; name = "CHECKSTYLE_8.8_${sha1}/checkstyle-8.8.jar";                                       url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/checkstyle-8.8-all.jar; }
-    rec { sha1 = "158ba6f2b346469b5f8083d1700c3f55b8b9082c"; name = "VISUALVM_COMMON_${sha1}/visualvm-common.tar.gz";                                  url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/visualvm/visualvm-19_0_0-11.tar.gz; }
-    rec { sha1 = "eb5ffa476ed2f6fac0ecd4bb2ae32741f9646932"; name = "VISUALVM_PLATFORM_SPECIFIC_${sha1}/visualvm-platform-specific.tar.gz";            url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/visualvm/visualvm-19_0_0-11-linux-amd64.tar.gz; }
+    rec { sha1 = "8dc5a90bed5f51d7538d05b8c31c31b7dfddbd66"; name = "VISUALVM_COMMON_${sha1}/visualvm-common.tar.gz";                                  url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/visualvm/visualvm-19_0_0-20.tar.gz; }
     rec { sha1 = "e6e60889b7211a80b21052a249bd7e0f88f79fee"; name = "Java-WebSocket_${sha1}/java-websocket.jar";                                       url = mirror://maven/org/java-websocket/Java-WebSocket/1.3.9/Java-WebSocket-1.3.9.jar; }
     rec { sha1 = "7a4d00d5ec5febd252a6182e8b6e87a0a9821f81"; name = "ICU4J_${sha1}/icu4j.jar";                                                         url = mirror://maven/com/ibm/icu/icu4j/62.1/icu4j-62.1.jar; }
     # This duplication of asm with underscore and minus is totally weird
@@ -138,15 +193,25 @@ let
     rec { sha1 = "505a09064f6e2209616f38724f6d97d8d889aa92"; name = "JONI_${sha1}/joni.sources.jar";                                                   url = mirror://maven/org/jruby/joni/joni/2.1.25/joni-2.1.25-sources.jar; }
     rec { sha1 = "c4f7d054303948eb6a4066194253886c8af07128"; name = "XZ-1.8_${sha1}/xz-1.8.jar";                                                       url = mirror://maven/org/tukaani/xz/1.8/xz-1.8.jar; }
     rec { sha1 = "9314d3d372b05546a33791fbc8dd579c92ebd16b"; name = "GNUR_${sha1}/gnur.tar.gz";                                                        url = http://cran.rstudio.com/src/base/R-3/R-3.5.1.tar.gz; }
-    rec { sha1 = "90aa8308da72ae610207d8f6ca27736921be692a"; name = "ANTLR4_COMPLETE_${sha1}/antlr4-complete.jar";                                     url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/antlr-4.7.1-complete.jar; }
-  ];
+    rec { sha1 = "90aa8308da72ae610207d8f6ca27736921be692a"; name = "ANTLR4_COMPLETE_${sha1}/antlr4-complete.jar";                                     url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/antlr-4.7.1-complete.jar; }] ++
+  lib.optionals stdenv.isLinux [
+    rec { sha1 = "df4c1f784294d02a82d78664064248283bfcc297"; name = "LLVM_ORG_${sha1}/llvm-org.tar.gz";                                                url = https://lafo.ssw.uni-linz.ac.at/pub/llvm-org/llvm-llvmorg-8.0.0-4-gd563e33a79-bgae3b177eaa-linux-amd64.tar.gz; }
+    rec { sha1 = "344483aefa15147c121a8fb6fb35a2406768cc5c"; name = "LLVM_PLATFORM_SPECIFIC_${sha1}/llvm-platform-specific.jar";                       url = mirror://maven/org/bytedeco/javacpp-presets/llvm/6.0.1-1.4.2/llvm-6.0.1-1.4.2-linux-x86_64.jar; }
+    rec { sha1 = "fd1a723d62cbbc591041d303e8b151d89f131643"; name = "VISUALVM_PLATFORM_SPECIFIC_${sha1}/visualvm-platform-specific.tar.gz";            url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/visualvm/visualvm-19_0_0-20-linux-amd64.tar.gz; }
+    rec { sha1 = "987234c4ce45505c21302e097c24efef4873325c"; name = "NINJA_${sha1}/ninja.zip";                                                         url = "https://github.com/ninja-build/ninja/releases/download/v1.8.2/ninja-linux.zip";
+          isNinja = true; }] ++
+  lib.optionals stdenv.isDarwin [
+    rec { sha1 = "0fa1af180755fa4cc018ee9be33f2d7d827593c4"; name = "LLVM_ORG_${sha1}/llvm-org.tar.gz";                                                url = https://lafo.ssw.uni-linz.ac.at/pub/llvm-org/llvm-llvmorg-8.0.0-4-gd563e33a79-bgae3b177eaa-darwin-amd64.tar.gz; }
+    rec { sha1 = "57bc74574104a9e0a2dc4d7a71ffcc5731909e57"; name = "LLVM_PLATFORM_SPECIFIC_${sha1}/llvm-platform-specific.jar";                       url = mirror://maven/org/bytedeco/javacpp-presets/llvm/6.0.1-1.4.2/llvm-6.0.1-1.4.2-macosx-x86_64.jar; }
+    rec { sha1 = "ae23bb365930f720acc88c62640bae6852a37d67"; name = "VISUALVM_PLATFORM_SPECIFIC_${sha1}/visualvm-platform-specific.tar.gz";            url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/visualvm/visualvm-19_0_0-20-macosx-x86_64.tar.gz; }
+    rec { sha1 = "8142c497f7dfbdb052a1e31960fdfe2c6f9a5ca2"; name = "NINJA_${sha1}/ninja.zip";                                                         url = "https://github.com/ninja-build/ninja/releases/download/v1.8.2/ninja-mac.zip";
+          isNinja = true; }];
 
   graal-mxcachegit = [
-    { sha256 = "05z2830ng71bhgsxc0zyc74l1bz7hg54la8j1r99993fhhch4y36"; name = "graaljs";     url = "https://github.com/graalvm/graaljs.git";     rev = "vm-${version}"; }
-    { sha256 = "0ai5x4n1c2lcfkfpp29zn1bcmp3khc5hvssyw1qr1l2zy79fxwjp"; name = "truffleruby"; url = "https://github.com/oracle/truffleruby.git";  rev = "vm-${version}"; }
-    { sha256 = "010079qsl6dff3yca8vlzcahq9z1ppyr758shjkm1f7izwphjv7p"; name = "fastr";       url = "https://github.com/oracle/fastr.git";        rev = "vm-${version}"; }
-    { sha256 = "0hcqbasqs0yb7p1sal63qbxqxh942gh5vzl95pfdlflmc2g82v4q"; name = "graalpython"; url = "https://github.com/graalvm/graalpython.git"; rev = "vm-${version}"; }
-  ];
+    { sha256 = "01w39ms39gl3cw7c2fgcacr2yjg94im9x2x7p5g94l6xlcgqvcnr"; name = "graaljs";     url = "https://github.com/graalvm/graaljs.git";     rev = "vm-${version}"; }
+    { sha256 = "1dps9n5b9c80pbg1fmlwpffy6ina0f0h27di24kafc8isxrdggia"; name = "truffleruby"; url = "https://github.com/oracle/truffleruby.git";  rev = "vm-${version}"; }
+    { sha256 = "0jdpdqm3ld1wsasmi8ka26qf19cibjac8lrqm040h5vh0iqzxizy"; name = "fastr";       url = "https://github.com/oracle/fastr.git";        rev = "vm-${version}"; }
+    { sha256 = "1gv8vafwrafjzvgv4gwk4kcsb3bnvsx07qa5inc0bdyxy5shl381"; name = "graalpython"; url = "https://github.com/graalvm/graalpython.git"; rev = "vm-${version}"; }];
 
   ninja-syntax = python27.pkgs.buildPythonPackage rec {
     version = "1.7.2";
@@ -169,13 +234,13 @@ let
 in rec {
 
   mx = stdenv.mkDerivation rec {
-    version = "5.223.0";
+    version = "5.247.1";
     pname = "mx";
     src = fetchFromGitHub {
       owner  = "graalvm";
       repo   = "mx";
       rev    = version;
-      sha256 = "0q51dnm6n1472p93dxr4jh8d7cv09a70pq89cdgxwh42vapykrn9";
+      sha256 = "038qr49rqzkhj76nqd27h8fysssnlpdhmy23ks2y81xlxhlzkc59";
     };
     nativeBuildInputs = [ makeWrapper ];
     prePatch = ''
@@ -214,15 +279,17 @@ in rec {
   };
 
   jvmci8 = stdenv.mkDerivation rec {
-    version = "19.2-b01";
+    version = "19.3-b05";
     pname = "jvmci";
     src = fetchFromGitHub {
       owner  = "graalvm";
       repo   = "graal-jvmci-8";
       rev    = "jvmci-${version}";
-      sha256 = "0maipj871vaxvap4576m0pzblzqxfjjzmwap3ndd84ny8d6vbqaa";
+      sha256 =  "0j7my76vldbrvki9x1gn9ics3x2z96j05jdy4nflbpik8i396114";
     };
-    buildInputs = [ mx mercurial openjdk ];
+    buildInputs = [ mx mercurial openjdk ] ++ lib.optional stdenv.isDarwin [
+      libobjc CoreFoundation Foundation JavaNativeFoundation JavaRuntimeSupport JavaVM xcodebuild Cocoa
+    ];
     postUnpack = ''
       # a fake mercurial dir to prevent mx crash and supply the version to mx
       ( cd $sourceRoot
@@ -233,17 +300,27 @@ in rec {
         hg checkout ${lib.escapeShellArg src.rev}
       )
     '';
-    patches = [ ./004_mx_jvmci.py.patch ];
+    patches = [ ./004_mx_jvmci.py.patch ] ++
+              lib.optional stdenv.isDarwin [
+                ./008_remove_jfr.patch ];
     postPatch =''
       # The hotspot version name regex fix
       substituteInPlace mx.jvmci/mx_jvmci.py \
-        --replace "\\d+.\\d+-b\\d+" "\\d+.\\d+-bga"
-      substituteInPlace src/share/vm/jvmci/jvmciCompilerToVM.cpp \
-        --replace 'method->name_and_sig_as_C_string(), method->native_function(), entry' \
-                  'method->name_and_sig_as_C_string(), p2i(method->native_function()), p2i(entry)' || exit -1
+        --replace "\\d+.\\d+-b\\d+" "\\d+.\\d+-b[g\\d][a\\d]"
+      # darwin: https://github.com/oracle/graal/issues/1816
+      substituteInPlace src/share/vm/code/compiledIC.cpp \
+        --replace 'entry == false' '*entry == false'
     '';
     hardeningDisable = [ "fortify" ];
-    NIX_CFLAGS_COMPILE = "-Wno-error=format-overflow -Wno-error=nonnull";
+    NIX_CFLAGS_COMPILE = toString (lib.optional stdenv.isDarwin [
+      "-Wno-reserved-user-defined-literal"
+      "-Wno-c++11-narrowing"
+    ] ++
+    lib.optional stdenv.isLinux [
+      "-Wno-error=format-overflow" # newly detected by gcc7
+      "-Wno-error=nonnull"
+    ]);
+
     buildPhase = ''
       export MX_ALT_OUTPUT_ROOT=$NIX_BUILD_TOP/mxbuild
       export MX_CACHE_DIR=${makeMxCache jvmci8-mxcache}
@@ -254,7 +331,9 @@ in rec {
     '';
     installPhase = ''
       mkdir -p $out
-      mv openjdk1.8.0_*/linux-amd64/product/* $out
+      ${if stdenv.isDarwin
+        then "mv openjdk1.8.0_*/darwin-amd64/product/* $out"
+        else "mv openjdk1.8.0_*/linux-amd64/product/* $out"}
       install -v -m0555 -D $MX_CACHE_DIR/hsdis*/hsdis.so $out/jre/lib/amd64/hsdis-amd64.so
     '';
     # copy-paste openjdk's preFixup
@@ -276,25 +355,36 @@ in rec {
     inherit (openjdk) meta;
   };
 
-  graalvm8 = stdenv.mkDerivation rec {
+  graalvm8 = 	stdenv.mkDerivation rec {
     inherit version;
     pname = "graal";
     src = fetchFromGitHub {
       owner  = "oracle";
       repo   = "graal";
       rev    = "vm-${version}";
-      sha256 = "0abx6adk91yzaf1md4qbidxykpqcgphh6j4hj01ry57s4if0j66f";
+      sha256 = "0v8zkmzkyhmmmvra5pp876d4i4ijrrw15j98ipayc7is02kwiwmq";
     };
-    patches = [ ./002_setjmp.c.patch ./003_mx_truffle.py.patch ];
-    buildInputs = [ mx zlib mercurial jvmci8 git clang llvm
-                    python27withPackages which icu ruby bzip2
-                    # gfortran readline bzip2 lzma pcre.dev curl ed ## WIP: fastr dependencies
+
+    patches = [ ./002_setjmp.c.patch ./003_mx_truffle.py.patch ] ++
+              lib.optional stdenv.isDarwin [
+                ./009_remove_signedness_verifier.patch ./010_mx_substratevm.py
+              ];
+
+    buildInputs = [ mx zlib.dev mercurial jvmci8 git llvm clang
+                    python27withPackages icu ruby bzip2 which
+                    readline bzip2 lzma pcre curl ed gfortran
+                  ]  ++ lib.optional stdenv.isDarwin [
+                    CoreFoundation gcc.cc.lib libiconv perl openssl
                   ];
+
     postUnpack = ''
-      cp ${stdenv.cc.cc}/include/c++/${lib.getVersion stdenv.cc.cc}/stdlib.h \
-        $sourceRoot/sulong/projects/com.oracle.truffle.llvm.libraries.bitcode/include
-      cp ${truffleMake} $TMP && mv *truffle.make truffle.make
+      ${lib.optionalString stdenv.isLinux ''
+        cp ${stdenv.cc.cc}/include/c++/${lib.getVersion stdenv.cc.cc}/stdlib.h \
+          $sourceRoot/sulong/projects/com.oracle.truffle.llvm.libraries.bitcode/include
+      ''}
+      cp ${truffleMake} $TMPDIR/truffle.make
       rm $sourceRoot/truffle/src/libffi/patches/others/0001-Add-mx-bootstrap-Makefile.patch
+
       # a fake mercurial dir to prevent mx crash and supply the version to mx
       ( cd $sourceRoot
         hg init
@@ -303,57 +393,93 @@ in rec {
         hg tag      ${lib.escapeShellArg src.rev}
         hg checkout ${lib.escapeShellArg src.rev}
       )
+
+      # make a copy of jvmci8
+      mkdir $NIX_BUILD_TOP/jvmci8
+      cp -dpR ${jvmci8}/* $NIX_BUILD_TOP/jvmci8
+      chmod +w -R $NIX_BUILD_TOP/jvmci8
+      export MX_CACHE_DIR=${makeMxCache graal-mxcache}
+      export MX_GIT_CACHE_DIR=$NIX_BUILD_TOP/mxgitcache
+      ${makeMxGitCache graal-mxcachegit "$MX_GIT_CACHE_DIR"}
+      cd $TMPDIR
     '';
+
     postPatch = ''
       substituteInPlace substratevm/src/com.oracle.svm.core.posix/src/com/oracle/svm/core/posix/headers/PosixDirectives.java \
         --replace '<zlib.h>' '<${zlib.dev}/include/zlib.h>'
       substituteInPlace substratevm/src/com.oracle.svm.hosted/src/com/oracle/svm/hosted/image/CCLinkerInvocation.java \
         --replace 'cmd.add("-v");' 'cmd.add("-v"); cmd.add("-L${zlib}/lib");'
-      substituteInPlace substratevm/src/com.oracle.svm.hosted/src/com/oracle/svm/hosted/c/codegen/CCompilerInvoker.java \
-        --replace 'command.add(Platform.includedIn(Platform.WINDOWS.class) ? "CL" : "gcc");' \
-          'command.add(Platform.includedIn(Platform.WINDOWS.class) ? "CL" : "${stdenv.cc}/bin/gcc");'
+
+      # For debugging native-image build, add this replace statement on CCompilerInvoker.java
+      # --replace '(String line : lines) {' '(String line : lines) {System.out.println("DEBUG: " + line);'
+      ${if stdenv.isLinux then ''
+          substituteInPlace substratevm/src/com.oracle.svm.hosted/src/com/oracle/svm/hosted/c/codegen/CCompilerInvoker.java \
+            --replace 'command.add(Platform.includedIn(Platform.WINDOWS.class) ? "CL" : "gcc");' \
+                      'command.add(Platform.includedIn(Platform.WINDOWS.class) ? "CL" : "${stdenv.cc}/bin/gcc");' ''
+        else ''
+          substituteInPlace substratevm/src/com.oracle.svm.hosted/src/com/oracle/svm/hosted/c/codegen/CCompilerInvoker.java \
+            --replace 'command.add(Platform.includedIn(Platform.WINDOWS.class) ? "CL" : "gcc");' \
+                      'command.add(Platform.includedIn(Platform.WINDOWS.class) ? "CL" : "${gcc.cc}/bin/gcc");
+                       command.add("-F"); command.add("${CoreFoundation}/Library/Frameworks");
+                       command.add("-framework"); command.add("CoreFoundation");'
+       ''}
+
+      # prevent cyclical imports caused by identical <include> names
       substituteInPlace substratevm/src/com.oracle.svm.hosted/src/com/oracle/svm/hosted/image/CCLinkerInvocation.java \
         --replace 'protected String compilerCommand = "cc";' 'protected String compilerCommand = "${stdenv.cc}/bin/cc";'
-      # prevent cyclical imports caused by identical <include> names
-      substituteInPlace sulong/projects/com.oracle.truffle.llvm.libraries.bitcode/include/stdlib.h \
-        --replace '# include <cstdlib>' '# include "${stdenv.cc.cc}/include/c++/${lib.getVersion stdenv.cc.cc}/cstdlib"'
       # dragonegg can't seem to compile on nix, so let's not require it
       substituteInPlace sulong/mx.sulong/suite.py \
         --replace '"requireDragonegg" : True,' '"requireDragonegg" : False,'
       substituteInPlace truffle/mx.truffle/mx_truffle.py \
         --replace 'os.path.relpath(self.subject.delegate.dir, self.subject.suite.vc_dir)' \
                   'self.subject.delegate.dir'
-
+      substituteInPlace sulong/projects/bootstrap-toolchain-launchers/Makefile \
+        --replace /bin/bash ${bash}/bin/bash
       # Patch the native-image template, as it will be run during build
       chmod +x vm/mx.vm/launcher_template.sh && patchShebangs vm/mx.vm
       # Prevent random errors from too low maxRuntimecompilemethods
       substituteInPlace truffle/mx.truffle/macro-truffle.properties \
         --replace '-H:MaxRuntimeCompileMethods=1400' \
                   '-H:MaxRuntimeCompileMethods=28000'
+      ${lib.optionalString stdenv.isDarwin ''
+        substituteInPlace truffle/src/com.oracle.truffle.nfi.test.native/src/object.cc \
+          --replace '#include <stdlib.h>' ""
+      ''}
+      ${lib.optionalString stdenv.isLinux ''
+        substituteInPlace sulong/projects/com.oracle.truffle.llvm.libraries.bitcode/include/stdlib.h \
+          --replace '# include <cstdlib>' '# include "${stdenv.cc.cc}/include/c++/${lib.getVersion stdenv.cc.cc}/cstdlib"'
+      ''}
     '';
 
     buildPhase = ''
-      # make a copy of jvmci8
-      mkdir $NIX_BUILD_TOP/jvmci8
-      cp -dpR ${jvmci8}/* $NIX_BUILD_TOP/jvmci8
-      chmod +w -R $NIX_BUILD_TOP/jvmci8
-
       export MX_ALT_OUTPUT_ROOT=$NIX_BUILD_TOP/mxbuild
-      export MX_CACHE_DIR=${makeMxCache graal-mxcache}
       export MX_GIT_CACHE='refcache'
-      export MX_GIT_CACHE_DIR=$NIX_BUILD_TOP/mxgitcache
       export JVMCI_VERSION_CHECK='ignore'
       export JAVA_HOME=$NIX_BUILD_TOP/jvmci8
-      # export FASTR_RELEASE=true ## WIP
-      ${makeMxGitCache graal-mxcachegit "$MX_GIT_CACHE_DIR"}
-      cd $NIX_BUILD_TOP/source
-
+      export FASTR_RELEASE=true
+      export PKG_LDFLAGS_OVERRIDE="-L${pcre.out}/lib -L${zlib}/lib -L${gfortran.cc.lib}/lib64"
+      ${lib.optionalString stdenv.isDarwin ''
+        export CC="gcc"
+        export CPP="gcc -E"
+        export NIX_CXXSTDLIB_LINK=""
+        export NIX_TARGET_CXXSTDLIB_LINK=""
+        export OPENSSL_PREFIX=$(realpath openssl)
+        # this fixes error: impure path 'LibFFIHeaderDirectives' used in link
+        export NIX_ENFORCE_PURITY=0
+      ''}
       ( cd vm
-        mx-internal -v --dynamicimports /substratevm,/tools,sulong,/graal-nodejs,graalpython build
+        mx-internal -v --suite sdk --suite compiler --suite vm --suite tools --suite regex --suite truffle \
+                       --dynamicimports /substratevm,/sulong,graal-js,graalpython,fastr,truffleruby build
       )
     '';
 
-    installPhase = ''
+    installPhase =
+      (if stdenv.isDarwin then ''
+      mkdir -p $out
+      rm -rf $MX_ALT_OUTPUT_ROOT/vm/darwin-amd64/GRAALVM_*STAGE1*
+      cp -rf $MX_ALT_OUTPUT_ROOT/vm/darwin-amd64/GRAALVM*/graalvm-unknown-${version}/* $out
+      ''
+       else ''
       mkdir -p $out
       rm -rf $MX_ALT_OUTPUT_ROOT/vm/linux-amd64/GRAALVM_*STAGE1*
       cp -rf $MX_ALT_OUTPUT_ROOT/vm/linux-amd64/GRAALVM*/graalvm-unknown-${version}/* $out
@@ -366,7 +492,7 @@ in rec {
       cp -rf ${glibc}/lib/* $out/jre/lib/svm/clibraries/linux-amd64/
       cp ${glibc.static}/lib/* $out/jre/lib/svm/clibraries/linux-amd64/
       cp ${zlib.static}/lib/libz.a $out/jre/lib/svm/clibraries/linux-amd64/libz.a
-    '';
+    '');
 
     inherit (jvmci8) preFixup;
     dontStrip = true; # stripped javac crashes with "segmentaion fault"
@@ -390,12 +516,14 @@ in rec {
       ./helloworld
       ./helloworld | fgrep 'Hello World'
 
-      # Ahead-Of-Time compilation with --static
-      $out/bin/native-image --no-server --static HelloWorld
-      ./helloworld
-      ./helloworld | fgrep 'Hello World'
-    '';
-
+      ${lib.optionalString stdenv.isLinux
+        ''
+          # Ahead-Of-Time compilation with --static (supported on linux only)
+          $out/bin/native-image --no-server --static HelloWorld
+          ./helloworld
+          ./helloworld | fgrep 'Hello World'
+        ''}
+         '';
     enableParallelBuilding = true;
     passthru.home = graalvm8;
 
@@ -404,7 +532,7 @@ in rec {
       description = "High-Performance Polyglot VM";
       license = licenses.gpl2;
       maintainers = with maintainers; [ volth hlolli ];
-      platforms = [ "x86_64-linux" /*"aarch64-linux" "x86_64-darwin"*/ ];
+      platforms = [ "x86_64-linux" "x86_64-darwin" /*"aarch64-linux"*/ ];
     };
   };
 }
diff --git a/pkgs/development/compilers/graalvm/truffle.make b/pkgs/development/compilers/graalvm/truffle.make
index da887c142408..ec357446a5df 100644
--- a/pkgs/development/compilers/graalvm/truffle.make
+++ b/pkgs/development/compilers/graalvm/truffle.make
@@ -2,13 +2,15 @@
 
 # `make MX_VERBOSE=y` will report all lines executed. The actual value doesn't
 # matter as long as it's not empty.
+
 QUIETLY$(MX_VERBOSE) = @
 
 .PHONY: default
 
 default:
+	sed -i "s|-print-multi-os-directory||g" ../$(SOURCES)/configure
 	$(QUIETLY) echo CONFIGURE libffi
 	$(QUIETLY) mkdir ../$(OUTPUT)
-	$(QUIETLY) cd ../$(OUTPUT) && ../$(SOURCES)/configure $(CONFIGURE_ARGS) > ../libffi.configure.log
+	$(QUIETLY) cd ../$(OUTPUT) && ../$(SOURCES)/configure $(CONFIGURE_ARGS)
 	$(QUIETLY) echo MAKE libffi
-	$(QUIETLY) $(MAKE) -C ../$(OUTPUT) > ../libffi.build.log
+	$(QUIETLY) $(MAKE) -C ../$(OUTPUT)
diff --git a/pkgs/development/compilers/halide/default.nix b/pkgs/development/compilers/halide/default.nix
index 0b28b61a27b2..44c079af9263 100644
--- a/pkgs/development/compilers/halide/default.nix
+++ b/pkgs/development/compilers/halide/default.nix
@@ -29,7 +29,7 @@ in llvmPackages.stdenv.mkDerivation {
   # To handle the lack of 'local' RPATH; required, as they call one of
   # their built binaries requiring their libs, in the build process.
   preBuild = ''
-    export LD_LIBRARY_PATH="$(pwd)/lib:$LD_LIBRARY_PATH"
+    export LD_LIBRARY_PATH="$(pwd)/lib''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/compilers/llvm/4/clang/default.nix b/pkgs/development/compilers/llvm/4/clang/default.nix
index a90fbe6ae837..5bdd3731207e 100644
--- a/pkgs/development/compilers/llvm/4/clang/default.nix
+++ b/pkgs/development/compilers/llvm/4/clang/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetch, cmake, libxml2, llvm, version, release_version, clang-tools-extra_src, python
+{ stdenv, fetch, cmake, libxml2, llvm, version, release_version, clang-tools-extra_src, python3
 , fixDarwinDylibNames
 , enableManpages ? false
 }:
@@ -19,8 +19,8 @@ let
       mv clang-tools-extra-* $sourceRoot/tools/extra
     '';
 
-    nativeBuildInputs = [ cmake python ]
-      ++ stdenv.lib.optional enableManpages python.pkgs.sphinx;
+    nativeBuildInputs = [ cmake python3 ]
+      ++ stdenv.lib.optional enableManpages python3.pkgs.sphinx;
 
     buildInputs = [ libxml2 llvm ]
       ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
diff --git a/pkgs/development/compilers/llvm/4/default.nix b/pkgs/development/compilers/llvm/4/default.nix
index 9651dbb72f4d..2f457880db10 100644
--- a/pkgs/development/compilers/llvm/4/default.nix
+++ b/pkgs/development/compilers/llvm/4/default.nix
@@ -1,5 +1,5 @@
 { lowPrio, newScope, pkgs, stdenv, cmake, libstdcxxHook
-, libxml2, python, isl, fetchurl, overrideCC, wrapCCWith
+, libxml2, python3, isl, fetchurl, overrideCC, wrapCCWith
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
 }:
@@ -17,7 +17,7 @@ let
   clang-tools-extra_src = fetch "clang-tools-extra" "1dhmp7ccfpr42bmvk3kp37ngjpf3a9m5d4kkpsn7d00hzi7fdl9m";
 
   tools = stdenv.lib.makeExtensible (tools: let
-    callPackage = newScope (tools // { inherit stdenv cmake libxml2 python isl release_version version fetch; });
+    callPackage = newScope (tools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch; });
   in {
 
     llvm = callPackage ./llvm.nix {
@@ -29,12 +29,12 @@ let
 
     llvm-manpages = lowPrio (tools.llvm.override {
       enableManpages = true;
-      python = pkgs.python;  # don't use python-boot
+      python3 = pkgs.python3;  # don't use python-boot
     });
 
     clang-manpages = lowPrio (tools.clang-unwrapped.override {
       enableManpages = true;
-      python = pkgs.python;  # don't use python-boot
+      python3 = pkgs.python3;  # don't use python-boot
     });
 
     libclang = tools.clang-unwrapped.lib;
@@ -57,7 +57,7 @@ let
   });
 
   libraries = stdenv.lib.makeExtensible (libraries: let
-    callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake libxml2 python isl release_version version fetch; });
+    callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch; });
   in {
 
     stdenv = overrideCC stdenv buildLlvmTools.clang;
diff --git a/pkgs/development/compilers/llvm/4/libc++/default.nix b/pkgs/development/compilers/llvm/4/libc++/default.nix
index 0213741e3e06..264342701ae9 100644
--- a/pkgs/development/compilers/llvm/4/libc++/default.nix
+++ b/pkgs/development/compilers/llvm/4/libc++/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetch, cmake, python, libcxxabi, fixDarwinDylibNames, version }:
+{ lib, stdenv, fetch, cmake, python3, libcxxabi, fixDarwinDylibNames, version }:
 
 stdenv.mkDerivation {
   pname = "libc++";
@@ -31,7 +31,7 @@ stdenv.mkDerivation {
   '' + lib.optionalString stdenv.hostPlatform.isMusl ''
     patchShebangs utils/cat_files.py
   '';
-  nativeBuildInputs = [ cmake ] ++ stdenv.lib.optional stdenv.hostPlatform.isMusl python;
+  nativeBuildInputs = [ cmake ] ++ stdenv.lib.optional stdenv.hostPlatform.isMusl python3;
 
   buildInputs = [ libcxxabi ] ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
 
diff --git a/pkgs/development/compilers/llvm/4/lldb.nix b/pkgs/development/compilers/llvm/4/lldb.nix
index 8adf11abddda..7f6231278e6c 100644
--- a/pkgs/development/compilers/llvm/4/lldb.nix
+++ b/pkgs/development/compilers/llvm/4/lldb.nix
@@ -9,7 +9,7 @@
 , libxml2
 , llvm
 , clang-unwrapped
-, python
+, python3
 , version
 , darwin
 }:
@@ -31,7 +31,7 @@ stdenv.mkDerivation {
       cmake/modules/LLDBStandalone.cmake
   '';
 
-  nativeBuildInputs = [ cmake python which swig ];
+  nativeBuildInputs = [ cmake python3 which swig ];
   buildInputs = [ ncurses zlib libedit libxml2 llvm ]
     ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.libobjc darwin.apple_sdk.libs.xpc darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa ];
 
diff --git a/pkgs/development/compilers/llvm/4/llvm.nix b/pkgs/development/compilers/llvm/4/llvm.nix
index 317a5ea06f48..0d3ce1614ded 100644
--- a/pkgs/development/compilers/llvm/4/llvm.nix
+++ b/pkgs/development/compilers/llvm/4/llvm.nix
@@ -2,7 +2,7 @@
 , fetch
 , fetchpatch
 , cmake
-, python
+, python3
 , libffi
 , libbfd
 , libxml2
@@ -40,8 +40,8 @@ stdenv.mkDerivation ({
   outputs = [ "out" ]
     ++ stdenv.lib.optional enableSharedLibraries "lib";
 
-  nativeBuildInputs = [ cmake python ]
-    ++ stdenv.lib.optional enableManpages python.pkgs.sphinx;
+  nativeBuildInputs = [ cmake python3 ]
+    ++ stdenv.lib.optional enableManpages python3.pkgs.sphinx;
 
   buildInputs = [ libxml2 libffi ];
 
@@ -143,7 +143,7 @@ stdenv.mkDerivation ({
   '';
 
   preCheck = ''
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/lib
+    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib
   '';
 
   postInstall = stdenv.lib.optionalString enableSharedLibraries ''
diff --git a/pkgs/development/compilers/llvm/5/clang/default.nix b/pkgs/development/compilers/llvm/5/clang/default.nix
index 6695609b8ecd..e391ce046dbc 100644
--- a/pkgs/development/compilers/llvm/5/clang/default.nix
+++ b/pkgs/development/compilers/llvm/5/clang/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetch, cmake, libxml2, llvm, version, clang-tools-extra_src, python
+{ stdenv, fetch, cmake, libxml2, llvm, version, clang-tools-extra_src, python3
 , fixDarwinDylibNames
 , enableManpages ? false
 }:
@@ -19,8 +19,8 @@ let
       mv clang-tools-extra-* $sourceRoot/tools/extra
     '';
 
-    nativeBuildInputs = [ cmake python ]
-      ++ stdenv.lib.optional enableManpages python.pkgs.sphinx;
+    nativeBuildInputs = [ cmake python3 ]
+      ++ stdenv.lib.optional enableManpages python3.pkgs.sphinx;
 
     buildInputs = [ libxml2 llvm ]
       ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
diff --git a/pkgs/development/compilers/llvm/5/compiler-rt.nix b/pkgs/development/compilers/llvm/5/compiler-rt.nix
index c87b0f235961..0282591b6e20 100644
--- a/pkgs/development/compilers/llvm/5/compiler-rt.nix
+++ b/pkgs/development/compilers/llvm/5/compiler-rt.nix
@@ -1,11 +1,11 @@
-{ stdenv, version, fetch, cmake, python, llvm, libcxxabi }:
+{ stdenv, version, fetch, cmake, python3, llvm, libcxxabi }:
 with stdenv.lib;
 stdenv.mkDerivation {
   pname = "compiler-rt";
   inherit version;
   src = fetch "compiler-rt" "0ipd4jdxpczgr2w6lzrabymz6dhzj69ywmyybjjc1q397zgrvziy";
 
-  nativeBuildInputs = [ cmake python llvm ];
+  nativeBuildInputs = [ cmake python3 llvm ];
   buildInputs = stdenv.lib.optional stdenv.hostPlatform.isDarwin libcxxabi;
 
   configureFlags = [
diff --git a/pkgs/development/compilers/llvm/5/default.nix b/pkgs/development/compilers/llvm/5/default.nix
index 6807240df81e..05f4dbf6aa06 100644
--- a/pkgs/development/compilers/llvm/5/default.nix
+++ b/pkgs/development/compilers/llvm/5/default.nix
@@ -1,5 +1,5 @@
 { lowPrio, newScope, pkgs, stdenv, cmake, libstdcxxHook
-, libxml2, python, isl, fetchurl, overrideCC, wrapCCWith
+, libxml2, python3, isl, fetchurl, overrideCC, wrapCCWith
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
 }:
@@ -16,7 +16,7 @@ let
   clang-tools-extra_src = fetch "clang-tools-extra" "018b3fiwah8f8br5i26qmzh6sjvzchpn358sn8v079m49f2jldm3";
 
   tools = stdenv.lib.makeExtensible (tools: let
-    callPackage = newScope (tools // { inherit stdenv cmake libxml2 python isl release_version version fetch; });
+    callPackage = newScope (tools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch; });
     mkExtraBuildCommands = cc: ''
       rsrc="$out/resource-root"
       mkdir "$rsrc"
@@ -36,12 +36,12 @@ let
 
     llvm-manpages = lowPrio (tools.llvm.override {
       enableManpages = true;
-      python = pkgs.python;  # don't use python-boot
+      python3 = pkgs.python3;  # don't use python-boot
     });
 
     clang-manpages = lowPrio (tools.clang-unwrapped.override {
       enableManpages = true;
-      python = pkgs.python;  # don't use python-boot
+      python3 = pkgs.python3;  # don't use python-boot
     });
 
     libclang = tools.clang-unwrapped.lib;
@@ -74,7 +74,7 @@ let
   });
 
   libraries = stdenv.lib.makeExtensible (libraries: let
-    callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake libxml2 python isl release_version version fetch; });
+    callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch; });
   in {
 
     compiler-rt = callPackage ./compiler-rt.nix {};
diff --git a/pkgs/development/compilers/llvm/5/libc++/default.nix b/pkgs/development/compilers/llvm/5/libc++/default.nix
index 03d8a2085d0b..b02e09a83a81 100644
--- a/pkgs/development/compilers/llvm/5/libc++/default.nix
+++ b/pkgs/development/compilers/llvm/5/libc++/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetch, cmake, python, libcxxabi, fixDarwinDylibNames, version }:
+{ lib, stdenv, fetch, cmake, python3, libcxxabi, fixDarwinDylibNames, version }:
 
 stdenv.mkDerivation {
   pname = "libc++";
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
   '' + lib.optionalString stdenv.hostPlatform.isMusl ''
     patchShebangs utils/cat_files.py
   '';
-  nativeBuildInputs = [ cmake ] ++ stdenv.lib.optional stdenv.hostPlatform.isMusl python;
+  nativeBuildInputs = [ cmake ] ++ stdenv.lib.optional stdenv.hostPlatform.isMusl python3;
 
   buildInputs = [ libcxxabi ] ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
 
diff --git a/pkgs/development/compilers/llvm/5/lldb.nix b/pkgs/development/compilers/llvm/5/lldb.nix
index cce44c7e50f9..a91a7e4354ef 100644
--- a/pkgs/development/compilers/llvm/5/lldb.nix
+++ b/pkgs/development/compilers/llvm/5/lldb.nix
@@ -9,7 +9,7 @@
 , libxml2
 , llvm
 , clang-unwrapped
-, python
+, python3
 , version
 , darwin
 }:
@@ -30,7 +30,7 @@ stdenv.mkDerivation {
       cmake/modules/LLDBStandalone.cmake
   '';
 
-  nativeBuildInputs = [ cmake python which swig ];
+  nativeBuildInputs = [ cmake python3 which swig ];
   buildInputs = [ ncurses zlib libedit libxml2 llvm ]
     ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.libobjc darwin.apple_sdk.libs.xpc darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa ];
 
diff --git a/pkgs/development/compilers/llvm/5/llvm.nix b/pkgs/development/compilers/llvm/5/llvm.nix
index d26af8438e73..2ce17765d633 100644
--- a/pkgs/development/compilers/llvm/5/llvm.nix
+++ b/pkgs/development/compilers/llvm/5/llvm.nix
@@ -2,7 +2,7 @@
 , fetch
 , fetchpatch
 , cmake
-, python
+, python3
 , libffi
 , libbfd
 , libxml2
@@ -37,8 +37,8 @@ stdenv.mkDerivation ({
   outputs = [ "out" "python" ]
     ++ stdenv.lib.optional enableSharedLibraries "lib";
 
-  nativeBuildInputs = [ cmake python ]
-    ++ stdenv.lib.optional enableManpages python.pkgs.sphinx;
+  nativeBuildInputs = [ cmake python3 ]
+    ++ stdenv.lib.optional enableManpages python3.pkgs.sphinx;
 
   buildInputs = [ libxml2 libffi ];
 
@@ -119,7 +119,7 @@ stdenv.mkDerivation ({
   '';
 
   preCheck = ''
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/lib
+    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib
   '';
 
   postInstall = ''
diff --git a/pkgs/development/compilers/llvm/6/clang/default.nix b/pkgs/development/compilers/llvm/6/clang/default.nix
index d093379b3c99..9374fc0bda9f 100644
--- a/pkgs/development/compilers/llvm/6/clang/default.nix
+++ b/pkgs/development/compilers/llvm/6/clang/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetch, cmake, libxml2, llvm, version, clang-tools-extra_src, python
+{ stdenv, fetch, cmake, libxml2, llvm, version, clang-tools-extra_src, python3
 , fixDarwinDylibNames
 , enableManpages ? false
 }:
@@ -19,8 +19,8 @@ let
       mv clang-tools-extra-* $sourceRoot/tools/extra
     '';
 
-    nativeBuildInputs = [ cmake python ]
-      ++ stdenv.lib.optional enableManpages python.pkgs.sphinx;
+    nativeBuildInputs = [ cmake python3 ]
+      ++ stdenv.lib.optional enableManpages python3.pkgs.sphinx;
 
     buildInputs = [ libxml2 llvm ]
       ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
diff --git a/pkgs/development/compilers/llvm/6/compiler-rt.nix b/pkgs/development/compilers/llvm/6/compiler-rt.nix
index 4cf79e79569c..b3b6e86fc525 100644
--- a/pkgs/development/compilers/llvm/6/compiler-rt.nix
+++ b/pkgs/development/compilers/llvm/6/compiler-rt.nix
@@ -1,11 +1,11 @@
-{ stdenv, version, fetch, cmake, python, llvm, libcxxabi }:
+{ stdenv, version, fetch, cmake, python3, llvm, libcxxabi }:
 with stdenv.lib;
 stdenv.mkDerivation {
   pname = "compiler-rt";
   inherit version;
   src = fetch "compiler-rt" "1fcr3jn24yr8lh36nc0c4ikli4744i2q9m1ik67p1jymwwaixkgl";
 
-  nativeBuildInputs = [ cmake python llvm ];
+  nativeBuildInputs = [ cmake python3 llvm ];
   buildInputs = stdenv.lib.optional stdenv.hostPlatform.isDarwin libcxxabi;
 
   configureFlags = [
diff --git a/pkgs/development/compilers/llvm/6/default.nix b/pkgs/development/compilers/llvm/6/default.nix
index ae51c19ec728..d4745930ed3f 100644
--- a/pkgs/development/compilers/llvm/6/default.nix
+++ b/pkgs/development/compilers/llvm/6/default.nix
@@ -1,5 +1,5 @@
 { lowPrio, newScope, pkgs, stdenv, cmake, libstdcxxHook
-, libxml2, python, isl, fetchurl, overrideCC, wrapCCWith
+, libxml2, python3, isl, fetchurl, overrideCC, wrapCCWith
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
 }:
@@ -16,7 +16,7 @@ let
   clang-tools-extra_src = fetch "clang-tools-extra" "1w8ml7fyn4vyxmy59n2qm4r1k1kgwgwkaldp6m45fdv4g0kkfbhd";
 
   tools = stdenv.lib.makeExtensible (tools: let
-    callPackage = newScope (tools // { inherit stdenv cmake libxml2 python isl release_version version fetch; });
+    callPackage = newScope (tools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch; });
     mkExtraBuildCommands = cc: ''
       rsrc="$out/resource-root"
       mkdir "$rsrc"
@@ -36,12 +36,12 @@ let
 
     llvm-manpages = lowPrio (tools.llvm.override {
       enableManpages = true;
-      python = pkgs.python;  # don't use python-boot
+      python3 = pkgs.python3;  # don't use python-boot
     });
 
     clang-manpages = lowPrio (tools.clang-unwrapped.override {
       enableManpages = true;
-      python = pkgs.python;  # don't use python-boot
+      python3 = pkgs.python3;  # don't use python-boot
     });
 
     libclang = tools.clang-unwrapped.lib;
@@ -74,7 +74,7 @@ let
   });
 
   libraries = stdenv.lib.makeExtensible (libraries: let
-    callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake libxml2 python isl release_version version fetch; });
+    callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch; });
   in {
 
     compiler-rt = callPackage ./compiler-rt.nix {};
diff --git a/pkgs/development/compilers/llvm/6/libc++/default.nix b/pkgs/development/compilers/llvm/6/libc++/default.nix
index 658068cbfaff..831c6c9c7002 100644
--- a/pkgs/development/compilers/llvm/6/libc++/default.nix
+++ b/pkgs/development/compilers/llvm/6/libc++/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetch, cmake, python, libcxxabi, fixDarwinDylibNames, version }:
+{ lib, stdenv, fetch, cmake, python3, libcxxabi, fixDarwinDylibNames, version }:
 
 stdenv.mkDerivation {
   pname = "libc++";
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
   '' + lib.optionalString stdenv.hostPlatform.isMusl ''
     patchShebangs utils/cat_files.py
   '';
-  nativeBuildInputs = [ cmake ] ++ stdenv.lib.optional stdenv.hostPlatform.isMusl python;
+  nativeBuildInputs = [ cmake ] ++ stdenv.lib.optional stdenv.hostPlatform.isMusl python3;
 
   buildInputs = [ libcxxabi ] ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
 
diff --git a/pkgs/development/compilers/llvm/6/lldb.nix b/pkgs/development/compilers/llvm/6/lldb.nix
index d3db8082c963..30d72d944264 100644
--- a/pkgs/development/compilers/llvm/6/lldb.nix
+++ b/pkgs/development/compilers/llvm/6/lldb.nix
@@ -9,7 +9,7 @@
 , libxml2
 , llvm
 , clang-unwrapped
-, python
+, python3
 , version
 , darwin
 }:
@@ -30,7 +30,7 @@ stdenv.mkDerivation {
       cmake/modules/LLDBStandalone.cmake
   '';
 
-  nativeBuildInputs = [ cmake python which swig ];
+  nativeBuildInputs = [ cmake python3 which swig ];
   buildInputs = [ ncurses zlib libedit libxml2 llvm ]
     ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.libobjc darwin.apple_sdk.libs.xpc darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa ];
 
diff --git a/pkgs/development/compilers/llvm/6/llvm.nix b/pkgs/development/compilers/llvm/6/llvm.nix
index c6d2c09c2df6..80acd3fa2fe1 100644
--- a/pkgs/development/compilers/llvm/6/llvm.nix
+++ b/pkgs/development/compilers/llvm/6/llvm.nix
@@ -1,7 +1,7 @@
 { stdenv
 , fetch
 , cmake
-, python
+, python3
 , libffi
 , libbfd
 , libxml2
@@ -40,8 +40,8 @@ stdenv.mkDerivation ({
   outputs = [ "out" "python" ]
     ++ optional enableSharedLibraries "lib";
 
-  nativeBuildInputs = [ cmake python ]
-    ++ optional enableManpages python.pkgs.sphinx;
+  nativeBuildInputs = [ cmake python3 ]
+    ++ optional enableManpages python3.pkgs.sphinx;
 
   buildInputs = [ libxml2 libffi ];
 
@@ -120,7 +120,7 @@ stdenv.mkDerivation ({
   '';
 
   preCheck = ''
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/lib
+    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib
   '';
 
   postInstall = ''
diff --git a/pkgs/development/compilers/llvm/7/clang/default.nix b/pkgs/development/compilers/llvm/7/clang/default.nix
index 5ac9a7a2672a..cc5dcfc160bc 100644
--- a/pkgs/development/compilers/llvm/7/clang/default.nix
+++ b/pkgs/development/compilers/llvm/7/clang/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetch, cmake, libxml2, llvm, version, clang-tools-extra_src, python
+{ stdenv, fetch, cmake, libxml2, llvm, version, clang-tools-extra_src, python3
 , fixDarwinDylibNames
 , enableManpages ? false
 , enablePolly ? false # TODO: get this info from llvm (passthru?)
@@ -19,8 +19,8 @@ let
       mv clang-tools-extra-* $sourceRoot/tools/extra
     '';
 
-    nativeBuildInputs = [ cmake python ]
-      ++ stdenv.lib.optional enableManpages python.pkgs.sphinx;
+    nativeBuildInputs = [ cmake python3 ]
+      ++ stdenv.lib.optional enableManpages python3.pkgs.sphinx;
 
     buildInputs = [ libxml2 llvm ]
       ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
diff --git a/pkgs/development/compilers/llvm/7/compiler-rt.nix b/pkgs/development/compilers/llvm/7/compiler-rt.nix
index a7d4bcb86962..ae98940adeab 100644
--- a/pkgs/development/compilers/llvm/7/compiler-rt.nix
+++ b/pkgs/development/compilers/llvm/7/compiler-rt.nix
@@ -1,10 +1,10 @@
-{ stdenv, version, fetch, cmake, python, llvm, libcxxabi }:
+{ stdenv, version, fetch, cmake, python3, llvm, libcxxabi }:
 stdenv.mkDerivation {
   pname = "compiler-rt";
   inherit version;
   src = fetch "compiler-rt" "1n48p8gjarihkws0i2bay5w9bdwyxyxxbpwyng7ba58jb30dlyq5";
 
-  nativeBuildInputs = [ cmake python llvm ];
+  nativeBuildInputs = [ cmake python3 llvm ];
   buildInputs = stdenv.lib.optional stdenv.hostPlatform.isDarwin libcxxabi;
 
   NIX_CFLAGS_COMPILE = [
diff --git a/pkgs/development/compilers/llvm/7/default.nix b/pkgs/development/compilers/llvm/7/default.nix
index 621a246225d7..f5dbea58a7db 100644
--- a/pkgs/development/compilers/llvm/7/default.nix
+++ b/pkgs/development/compilers/llvm/7/default.nix
@@ -1,5 +1,5 @@
 { lowPrio, newScope, pkgs, stdenv, cmake, libstdcxxHook
-, libxml2, python, isl, fetchurl, overrideCC, wrapCCWith, wrapBintoolsWith
+, libxml2, python3, isl, fetchurl, overrideCC, wrapCCWith, wrapBintoolsWith
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
 }:
@@ -16,7 +16,7 @@ let
   clang-tools-extra_src = fetch "clang-tools-extra" "0lb4kdh7j2fhfz8kd6iv5df7m3pikiryk1vvwsf87spc90n09q0w";
 
   tools = stdenv.lib.makeExtensible (tools: let
-    callPackage = newScope (tools // { inherit stdenv cmake libxml2 python isl release_version version fetch; });
+    callPackage = newScope (tools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch; });
     mkExtraBuildCommands = cc: ''
       rsrc="$out/resource-root"
       mkdir "$rsrc"
@@ -42,12 +42,12 @@ let
 
     llvm-manpages = lowPrio (tools.llvm.override {
       enableManpages = true;
-      python = pkgs.python;  # don't use python-boot
+      python3 = pkgs.python3;  # don't use python-boot
     });
 
     clang-manpages = lowPrio (tools.clang-unwrapped.override {
       enableManpages = true;
-      python = pkgs.python;  # don't use python-boot
+      python3 = pkgs.python3;  # don't use python-boot
     });
 
     libclang = tools.clang-unwrapped.lib;
@@ -126,7 +126,7 @@ let
   });
 
   libraries = stdenv.lib.makeExtensible (libraries: let
-    callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake libxml2 python isl release_version version fetch; });
+    callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch; });
   in {
 
     compiler-rt = callPackage ./compiler-rt.nix {
diff --git a/pkgs/development/compilers/llvm/7/libc++/default.nix b/pkgs/development/compilers/llvm/7/libc++/default.nix
index f6f9970d7a6e..f2cdd2f6f5fa 100644
--- a/pkgs/development/compilers/llvm/7/libc++/default.nix
+++ b/pkgs/development/compilers/llvm/7/libc++/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetch, cmake, python, libcxxabi, fixDarwinDylibNames, version
+{ lib, stdenv, fetch, cmake, python3, libcxxabi, fixDarwinDylibNames, version
 , enableShared ? ! stdenv.hostPlatform.isMusl }:
 
 stdenv.mkDerivation {
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
   '' + lib.optionalString stdenv.hostPlatform.isMusl ''
     patchShebangs utils/cat_files.py
   '';
-  nativeBuildInputs = [ cmake ] ++ stdenv.lib.optional stdenv.hostPlatform.isMusl python;
+  nativeBuildInputs = [ cmake ] ++ stdenv.lib.optional stdenv.hostPlatform.isMusl python3;
 
   buildInputs = [ libcxxabi ] ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
 
diff --git a/pkgs/development/compilers/llvm/7/lldb.nix b/pkgs/development/compilers/llvm/7/lldb.nix
index 44687ead4d1c..ace6ae812fde 100644
--- a/pkgs/development/compilers/llvm/7/lldb.nix
+++ b/pkgs/development/compilers/llvm/7/lldb.nix
@@ -10,7 +10,7 @@
 , llvm
 , clang-unwrapped
 , perl
-, python
+, python3
 , version
 , darwin
 }:
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
 
   src = fetch "lldb" "0klsscg1sczc4nw2l53xggi969k361cng2sjjrfp3bv4g5x14s4v";
 
-  nativeBuildInputs = [ cmake perl python which swig ];
+  nativeBuildInputs = [ cmake perl python3 which swig ];
   buildInputs = [ ncurses zlib libedit libxml2 llvm ]
     ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.libobjc darwin.apple_sdk.libs.xpc darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa ];
 
diff --git a/pkgs/development/compilers/llvm/7/llvm.nix b/pkgs/development/compilers/llvm/7/llvm.nix
index c56bbfd0eab9..d7fb1fe4b93f 100644
--- a/pkgs/development/compilers/llvm/7/llvm.nix
+++ b/pkgs/development/compilers/llvm/7/llvm.nix
@@ -2,7 +2,7 @@
 , fetch
 , fetchpatch
 , cmake
-, python
+, python3
 , libffi
 , libbfd
 , libpfm
@@ -48,8 +48,8 @@ in stdenv.mkDerivation ({
   outputs = [ "out" "python" ]
     ++ optional enableSharedLibraries "lib";
 
-  nativeBuildInputs = [ cmake python ]
-    ++ optional enableManpages python.pkgs.sphinx;
+  nativeBuildInputs = [ cmake python3 ]
+    ++ optional enableManpages python3.pkgs.sphinx;
 
   buildInputs = [ libxml2 libffi ]
     ++ optional enablePFM libpfm; # exegesis
@@ -141,7 +141,7 @@ in stdenv.mkDerivation ({
   '';
 
   preCheck = ''
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/lib
+    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib
   '';
 
   postInstall = ''
diff --git a/pkgs/development/compilers/llvm/8/clang/default.nix b/pkgs/development/compilers/llvm/8/clang/default.nix
index 8c540e45b286..8601f6d06809 100644
--- a/pkgs/development/compilers/llvm/8/clang/default.nix
+++ b/pkgs/development/compilers/llvm/8/clang/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetch, cmake, libxml2, llvm, version, clang-tools-extra_src, python
+{ stdenv, fetch, cmake, libxml2, llvm, version, clang-tools-extra_src, python3
 , fixDarwinDylibNames
 , enableManpages ? false
 , enablePolly ? false # TODO: get this info from llvm (passthru?)
@@ -19,8 +19,8 @@ let
       mv clang-tools-extra-* $sourceRoot/tools/extra
     '';
 
-    nativeBuildInputs = [ cmake python ]
-      ++ stdenv.lib.optional enableManpages python.pkgs.sphinx;
+    nativeBuildInputs = [ cmake python3 ]
+      ++ stdenv.lib.optional enableManpages python3.pkgs.sphinx;
 
     buildInputs = [ libxml2 llvm ]
       ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
diff --git a/pkgs/development/compilers/llvm/8/compiler-rt.nix b/pkgs/development/compilers/llvm/8/compiler-rt.nix
index 344ff7256755..9c0829146f72 100644
--- a/pkgs/development/compilers/llvm/8/compiler-rt.nix
+++ b/pkgs/development/compilers/llvm/8/compiler-rt.nix
@@ -1,10 +1,10 @@
-{ stdenv, version, fetch, cmake, python, llvm, libcxxabi }:
+{ stdenv, version, fetch, cmake, python3, llvm, libcxxabi }:
 stdenv.mkDerivation {
   pname = "compiler-rt";
   inherit version;
   src = fetch "compiler-rt" "0dqqf8f930l8gag4d9qjgn1n0pj0nbv2anviqqhdi1rkhas8z0hi";
 
-  nativeBuildInputs = [ cmake python llvm ];
+  nativeBuildInputs = [ cmake python3 llvm ];
   buildInputs = stdenv.lib.optional stdenv.hostPlatform.isDarwin libcxxabi;
 
   NIX_CFLAGS_COMPILE = [
diff --git a/pkgs/development/compilers/llvm/8/default.nix b/pkgs/development/compilers/llvm/8/default.nix
index 36d7a14142b4..8b916e1cda7d 100644
--- a/pkgs/development/compilers/llvm/8/default.nix
+++ b/pkgs/development/compilers/llvm/8/default.nix
@@ -1,5 +1,5 @@
 { lowPrio, newScope, pkgs, stdenv, cmake, libstdcxxHook
-, libxml2, python, isl, fetchurl, overrideCC, wrapCCWith, wrapBintoolsWith
+, libxml2, python3, isl, fetchurl, overrideCC, wrapCCWith, wrapBintoolsWith
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
 }:
@@ -16,7 +16,7 @@ let
   clang-tools-extra_src = fetch "clang-tools-extra" "1qf3097bc5ia8p6cpmbx985rjr3yaah5s8fc0nv7pw742yv7jw8q";
 
   tools = stdenv.lib.makeExtensible (tools: let
-    callPackage = newScope (tools // { inherit stdenv cmake libxml2 python isl release_version version fetch; });
+    callPackage = newScope (tools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch; });
     mkExtraBuildCommands = cc: ''
       rsrc="$out/resource-root"
       mkdir "$rsrc"
@@ -42,12 +42,12 @@ let
 
     llvm-manpages = lowPrio (tools.llvm.override {
       enableManpages = true;
-      python = pkgs.python;  # don't use python-boot
+      python3 = pkgs.python3;  # don't use python-boot
     });
 
     clang-manpages = lowPrio (tools.clang-unwrapped.override {
       enableManpages = true;
-      python = pkgs.python;  # don't use python-boot
+      python3 = pkgs.python3;  # don't use python-boot
     });
 
     libclang = tools.clang-unwrapped.lib;
@@ -162,7 +162,7 @@ let
   });
 
   libraries = stdenv.lib.makeExtensible (libraries: let
-    callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake libxml2 python isl release_version version fetch; });
+    callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch; });
   in {
 
     compiler-rt = callPackage ./compiler-rt.nix ({} //
diff --git a/pkgs/development/compilers/llvm/8/libc++/default.nix b/pkgs/development/compilers/llvm/8/libc++/default.nix
index 8ec1c419748d..883d9c8776f3 100644
--- a/pkgs/development/compilers/llvm/8/libc++/default.nix
+++ b/pkgs/development/compilers/llvm/8/libc++/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetch, cmake, python, libcxxabi, fixDarwinDylibNames, version
+{ lib, stdenv, fetch, cmake, python3, libcxxabi, fixDarwinDylibNames, version
 , enableShared ? true }:
 
 stdenv.mkDerivation {
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
     patchShebangs utils/cat_files.py
   '';
   nativeBuildInputs = [ cmake ]
-    ++ stdenv.lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) python;
+    ++ stdenv.lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) python3;
 
   buildInputs = [ libcxxabi ] ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
 
diff --git a/pkgs/development/compilers/llvm/8/lldb.nix b/pkgs/development/compilers/llvm/8/lldb.nix
index 254933c82a09..75be5b993df3 100644
--- a/pkgs/development/compilers/llvm/8/lldb.nix
+++ b/pkgs/development/compilers/llvm/8/lldb.nix
@@ -9,7 +9,7 @@
 , libxml2
 , llvm
 , clang-unwrapped
-, python
+, python3
 , version
 , darwin
 }:
@@ -30,7 +30,7 @@ stdenv.mkDerivation {
       cmake/modules/LLDBStandalone.cmake
   '';
 
-  nativeBuildInputs = [ cmake python which swig ];
+  nativeBuildInputs = [ cmake python3 which swig ];
   buildInputs = [ ncurses zlib libedit libxml2 llvm ]
     ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.libobjc darwin.apple_sdk.libs.xpc darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa ];
 
diff --git a/pkgs/development/compilers/llvm/8/llvm.nix b/pkgs/development/compilers/llvm/8/llvm.nix
index df3d6e796aa0..a9c4a6b0ba25 100644
--- a/pkgs/development/compilers/llvm/8/llvm.nix
+++ b/pkgs/development/compilers/llvm/8/llvm.nix
@@ -1,7 +1,7 @@
 { stdenv
 , fetch
 , cmake
-, python
+, python3
 , libffi
 , libbfd
 , libpfm
@@ -46,8 +46,8 @@ in stdenv.mkDerivation ({
   outputs = [ "out" "python" ]
     ++ optional enableSharedLibraries "lib";
 
-  nativeBuildInputs = [ cmake python ]
-    ++ optionals enableManpages [ python.pkgs.sphinx python.pkgs.recommonmark ];
+  nativeBuildInputs = [ cmake python3 ]
+    ++ optionals enableManpages [ python3.pkgs.sphinx python3.pkgs.recommonmark ];
 
   buildInputs = [ libxml2 libffi ]
     ++ optional enablePFM libpfm; # exegesis
@@ -117,7 +117,7 @@ in stdenv.mkDerivation ({
   '';
 
   preCheck = ''
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/lib
+    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib
   '';
 
   postInstall = ''
diff --git a/pkgs/development/compilers/llvm/9/clang/default.nix b/pkgs/development/compilers/llvm/9/clang/default.nix
index 1b779b118a7f..5f89c3dc3b71 100644
--- a/pkgs/development/compilers/llvm/9/clang/default.nix
+++ b/pkgs/development/compilers/llvm/9/clang/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetch, cmake, libxml2, llvm, version, clang-tools-extra_src, python
+{ stdenv, fetch, cmake, libxml2, llvm, version, clang-tools-extra_src, python3
 , fixDarwinDylibNames
 , enableManpages ? false
 , enablePolly ? false # TODO: get this info from llvm (passthru?)
@@ -19,8 +19,8 @@ let
       mv clang-tools-extra-* $sourceRoot/tools/extra
     '';
 
-    nativeBuildInputs = [ cmake python ]
-      ++ stdenv.lib.optional enableManpages python.pkgs.sphinx;
+    nativeBuildInputs = [ cmake python3 ]
+      ++ stdenv.lib.optional enableManpages python3.pkgs.sphinx;
 
     buildInputs = [ libxml2 llvm ]
       ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
diff --git a/pkgs/development/compilers/llvm/9/compiler-rt.nix b/pkgs/development/compilers/llvm/9/compiler-rt.nix
index 75d0614b5142..037953bb23d8 100644
--- a/pkgs/development/compilers/llvm/9/compiler-rt.nix
+++ b/pkgs/development/compilers/llvm/9/compiler-rt.nix
@@ -1,10 +1,10 @@
-{ stdenv, version, fetch, cmake, python, llvm, libcxxabi }:
+{ stdenv, version, fetch, cmake, python3, llvm, libcxxabi }:
 stdenv.mkDerivation rec {
   pname = "compiler-rt";
   inherit version;
   src = fetch pname "0xwh79g3zggdabxgnd0bphry75asm1qz7mv3hcqihqwqr6aspgy2";
 
-  nativeBuildInputs = [ cmake python llvm ];
+  nativeBuildInputs = [ cmake python3 llvm ];
   buildInputs = stdenv.lib.optional stdenv.hostPlatform.isDarwin libcxxabi;
 
   NIX_CFLAGS_COMPILE = [
diff --git a/pkgs/development/compilers/llvm/9/default.nix b/pkgs/development/compilers/llvm/9/default.nix
index c9e8ce91f0ce..38ab7794018f 100644
--- a/pkgs/development/compilers/llvm/9/default.nix
+++ b/pkgs/development/compilers/llvm/9/default.nix
@@ -1,5 +1,5 @@
 { lowPrio, newScope, pkgs, stdenv, cmake, libstdcxxHook
-, libxml2, python, isl, fetchurl, overrideCC, wrapCCWith, wrapBintoolsWith
+, libxml2, python3, isl, fetchurl, overrideCC, wrapCCWith, wrapBintoolsWith
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
 }:
@@ -16,7 +16,7 @@ let
   clang-tools-extra_src = fetch "clang-tools-extra" "01vgzd4k1q93nfs8gyl83mjlc4x0qsgfqw32lacbjzdxg0mdfvxj";
 
   tools = stdenv.lib.makeExtensible (tools: let
-    callPackage = newScope (tools // { inherit stdenv cmake libxml2 python isl release_version version fetch; });
+    callPackage = newScope (tools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch; });
     mkExtraBuildCommands = cc: ''
       rsrc="$out/resource-root"
       mkdir "$rsrc"
@@ -42,12 +42,12 @@ let
 
     llvm-manpages = lowPrio (tools.llvm.override {
       enableManpages = true;
-      python = pkgs.python;  # don't use python-boot
+      python3 = pkgs.python3;  # don't use python-boot
     });
 
     clang-manpages = lowPrio (tools.clang-unwrapped.override {
       enableManpages = true;
-      python = pkgs.python;  # don't use python-boot
+      python3 = pkgs.python3;  # don't use python-boot
     });
 
     libclang = tools.clang-unwrapped.lib;
@@ -162,7 +162,7 @@ let
   });
 
   libraries = stdenv.lib.makeExtensible (libraries: let
-    callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake libxml2 python isl release_version version fetch; });
+    callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch; });
   in {
 
     compiler-rt = callPackage ./compiler-rt.nix ({} //
diff --git a/pkgs/development/compilers/llvm/9/libc++/default.nix b/pkgs/development/compilers/llvm/9/libc++/default.nix
index 1166c7bd76c9..9e3525574d5c 100644
--- a/pkgs/development/compilers/llvm/9/libc++/default.nix
+++ b/pkgs/development/compilers/llvm/9/libc++/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetch, cmake, python, libcxxabi, fixDarwinDylibNames, version
+{ lib, stdenv, fetch, cmake, python3, libcxxabi, fixDarwinDylibNames, version
 , enableShared ? true }:
 
 stdenv.mkDerivation {
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
     patchShebangs utils/cat_files.py
   '';
   nativeBuildInputs = [ cmake ]
-    ++ stdenv.lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) python;
+    ++ stdenv.lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) python3;
 
   buildInputs = [ libcxxabi ] ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
 
diff --git a/pkgs/development/compilers/llvm/9/lldb.nix b/pkgs/development/compilers/llvm/9/lldb.nix
index 64f111502cc5..506fc1c3e505 100644
--- a/pkgs/development/compilers/llvm/9/lldb.nix
+++ b/pkgs/development/compilers/llvm/9/lldb.nix
@@ -9,7 +9,7 @@
 , libxml2
 , llvm
 , clang-unwrapped
-, python
+, python3
 , version
 , darwin
 , lit
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./lldb-procfs.patch ];
 
-  nativeBuildInputs = [ cmake python which swig lit ];
+  nativeBuildInputs = [ cmake python3 which swig lit ];
   buildInputs = [
     ncurses
     zlib
diff --git a/pkgs/development/compilers/llvm/9/llvm.nix b/pkgs/development/compilers/llvm/9/llvm.nix
index acd3ec92897f..2cdc5a5fd066 100644
--- a/pkgs/development/compilers/llvm/9/llvm.nix
+++ b/pkgs/development/compilers/llvm/9/llvm.nix
@@ -1,7 +1,7 @@
 { stdenv
 , fetch
 , cmake
-, python
+, python3
 , libffi
 , libbfd
 , libpfm
@@ -46,8 +46,8 @@ in stdenv.mkDerivation (rec {
   outputs = [ "out" "python" ]
     ++ optional enableSharedLibraries "lib";
 
-  nativeBuildInputs = [ cmake python ]
-    ++ optionals enableManpages [ python.pkgs.sphinx python.pkgs.recommonmark ];
+  nativeBuildInputs = [ cmake python3 ]
+    ++ optionals enableManpages [ python3.pkgs.sphinx python3.pkgs.recommonmark ];
 
   buildInputs = [ libxml2 libffi ]
     ++ optional enablePFM libpfm; # exegesis
@@ -134,7 +134,7 @@ in stdenv.mkDerivation (rec {
   '';
 
   preCheck = ''
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/lib
+    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib
   '';
 
   postInstall = ''
diff --git a/pkgs/development/compilers/mlton/20130715.nix b/pkgs/development/compilers/mlton/20130715.nix
index 207ed8f29bc7..52bb0a0775cf 100644
--- a/pkgs/development/compilers/mlton/20130715.nix
+++ b/pkgs/development/compilers/mlton/20130715.nix
@@ -77,7 +77,7 @@ stdenv.mkDerivation rec {
     chmod u+x $(pwd)/../${usr_prefix}/bin/mlton
 
     # So the builder runs the binary compiler with gmp.
-    export LD_LIBRARY_PATH=${gmp.out}/lib:$LD_LIBRARY_PATH
+    export LD_LIBRARY_PATH=${gmp.out}/lib''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH
 
   '' + stdenv.lib.optionalString stdenv.isLinux ''
     # Patch ELF interpreter.
diff --git a/pkgs/development/compilers/openjdk/darwin/8.nix b/pkgs/development/compilers/openjdk/darwin/8.nix
index bc7a33932b27..8afaf90f9437 100644
--- a/pkgs/development/compilers/openjdk/darwin/8.nix
+++ b/pkgs/development/compilers/openjdk/darwin/8.nix
@@ -7,11 +7,14 @@ let
   };
 
   jdk = stdenv.mkDerivation {
-    name = "zulu1.8.0_222-8.40.0.25-ca-fx";
+    # @hlolli: Later version than 1.8.0_202 throws error when building jvmci.
+    # dyld: lazy symbol binding failed: Symbol not found: _JVM_BeforeHalt
+    # Referenced from: ../libjava.dylib Expected in: .../libjvm.dylib
+    name = "zulu1.8.0_202-8.36.0.1";
 
     src = fetchurl {
-      url = "http://cdn.azul.com/zulu/bin/zulu8.40.0.25-ca-fx-jdk8.0.222-macosx_x64.zip";
-      sha256 = "1mal8bdc94q7ahx7p3xggy3qpxr6h83g2y01wzgvnqjd8n5i3qr1";
+      url = "https://cdn.azul.com/zulu/bin/zulu8.36.0.1-ca-jdk8.0.202-macosx_x64.zip";
+      sha256 = "0s92l1wlf02vjx8dvrsla2kq7qwxnmgh325b38mgqy872016jm9p";
       curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/zulu-linux/";
     };
 
diff --git a/pkgs/development/compilers/solc/default.nix b/pkgs/development/compilers/solc/default.nix
index 23e6c64f3ffc..0f71ed79e7ee 100644
--- a/pkgs/development/compilers/solc/default.nix
+++ b/pkgs/development/compilers/solc/default.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
   checkPhase = ''
     while IFS= read -r -d ''' dir
     do
-      LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$(pwd)/$dir
+      LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$(pwd)/$dir
       export LD_LIBRARY_PATH
     done <   <(find . -type d -print0)
 
diff --git a/pkgs/development/guile-modules/guile-lib/default.nix b/pkgs/development/guile-modules/guile-lib/default.nix
index cea464ad5d27..97f501f41db7 100644
--- a/pkgs/development/guile-modules/guile-lib/default.nix
+++ b/pkgs/development/guile-modules/guile-lib/default.nix
@@ -21,7 +21,7 @@ in stdenv.mkDerivation {
   preCheck = ''
     # Make `libgcc_s.so' visible for `pthread_cancel'.
     export LD_LIBRARY_PATH=\
-    "$(dirname $(echo ${stdenv.cc.cc.lib}/lib*/libgcc_s.so)):$LD_LIBRARY_PATH"
+    "$(dirname $(echo ${stdenv.cc.cc.lib}/lib*/libgcc_s.so))''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/interpreters/perl/default.nix b/pkgs/development/interpreters/perl/default.nix
index 3231c17e8d9b..751b9667a1f1 100644
--- a/pkgs/development/interpreters/perl/default.nix
+++ b/pkgs/development/interpreters/perl/default.nix
@@ -96,8 +96,7 @@ let
         "-Dprefix=${placeholder "out"}"
         "-Dman1dir=${placeholder "out"}/share/man/man1"
         "-Dman3dir=${placeholder "out"}/share/man/man3"
-      ]
-      ++ optional (stdenv.isAarch32 || stdenv.isMips) "-Dldflags=\"-lm -lrt\"";
+      ];
 
     configureScript = optionalString (!crossCompiling) "${stdenv.shell} ./Configure";
 
diff --git a/pkgs/development/interpreters/pure/default.nix b/pkgs/development/interpreters/pure/default.nix
index 9c35fc354976..764ee241aff3 100644
--- a/pkgs/development/interpreters/pure/default.nix
+++ b/pkgs/development/interpreters/pure/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   configureFlags = [ "--enable-release" ];
   doCheck = true;
   checkPhase = ''
-    LD_LIBRARY_PATH=$LD_LIBRARY_PATH:${llvm}/lib make check
+    LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}${llvm}/lib make check
   '';
   postInstall = ''
     wrapProgram $out/bin/pure --prefix LD_LIBRARY_PATH : ${llvm}/lib
diff --git a/pkgs/development/interpreters/python/cpython/2.7/boot.nix b/pkgs/development/interpreters/python/cpython/2.7/boot.nix
deleted file mode 100644
index 0b9ddc0bb345..000000000000
--- a/pkgs/development/interpreters/python/cpython/2.7/boot.nix
+++ /dev/null
@@ -1,103 +0,0 @@
-{ stdenv, fetchurl, configd, CF, coreutils }:
-
-with stdenv.lib;
-
-let
-
-  mkPaths = paths: {
-    C_INCLUDE_PATH = makeSearchPathOutput "dev" "include" paths;
-    LIBRARY_PATH = makeLibraryPath paths;
-  };
-
-in
-
-stdenv.mkDerivation rec {
-  pname = "python-boot";
-  version = "2.7.12";
-  libPrefix = "python2.7";
-
-  src = fetchurl {
-    url = "https://www.python.org/ftp/python/2.7.12/Python-${version}.tar.xz";
-    sha256 = "0y7rl603vmwlxm6ilkhc51rx2mfj14ckcz40xxgs0ljnvlhp30yp";
-  };
-
-  inherit (mkPaths buildInputs) C_INCLUDE_PATH LIBRARY_PATH;
-
-  LDFLAGS = optionalString (!stdenv.isDarwin) "-lgcc_s";
-  NIX_CFLAGS_COMPILE = optionalString stdenv.isDarwin "-msse2";
-
-  buildInputs = optionals stdenv.isDarwin [ CF configd ];
-
-  patches =
-    [ # Look in C_INCLUDE_PATH and LIBRARY_PATH for stuff.
-      ./search-path.patch
-
-      # Python recompiles a Python if the mtime stored *in* the
-      # pyc/pyo file differs from the mtime of the source file.  This
-      # doesn't work in Nix because Nix changes the mtime of files in
-      # the Nix store to 1.  So treat that as a special case.
-      ./nix-store-mtime.patch
-
-      # patch python to put zero timestamp into pyc
-      # if DETERMINISTIC_BUILD env var is set
-      ./deterministic-build.patch
-    ];
-
-  # Hack hack hack to stop shit from failing from a missing _scproxy on Darwin. Since
-  # we only use this python for bootstrappy things, it doesn't really matter if it
-  # doesn't have perfect proxy support in urllib :) this just makes it fall back on env
-  # vars instead of attempting to read the proxy configuration automatically, so not a
-  # huge loss even if for whatever reason we did want proxy support.
-  postPatch = ''
-    substituteInPlace Lib/urllib.py --replace "if sys.platform == 'darwin'" "if False"
-  '';
-
-  DETERMINISTIC_BUILD = 1;
-
-  preConfigure = ''
-      # Purity.
-      for i in /usr /sw /opt /pkg; do
-        substituteInPlace ./setup.py --replace $i /no-such-path
-      done
-    '' + optionalString (stdenv ? cc && stdenv.cc.libc != null) ''
-      for i in Lib/plat-*/regen; do
-        substituteInPlace $i --replace /usr/include/ ${stdenv.cc.libc}/include/
-      done
-    '' + optionalString stdenv.isDarwin ''
-      substituteInPlace configure --replace '`/usr/bin/arch`' '"i386"'
-      substituteInPlace Lib/multiprocessing/__init__.py \
-        --replace 'os.popen(comm)' 'os.popen("${coreutils}/bin/nproc")'
-    '';
-
-  configureFlags = [ "--enable-shared" "--with-threads" "--enable-unicode=ucs4" ]
-    ++ optionals stdenv.isCygwin [ "ac_cv_func_bind_textdomain_codeset=yes" ]
-    ++ optionals stdenv.isDarwin [ "--disable-toolbox-glue" ];
-
-  postInstall =
-    ''
-      ln -s $out/share/man/man1/{python2.7.1.gz,python.1.gz}
-
-      rm "$out"/lib/python*/plat-*/regen # refers to glibc.dev
-    '';
-
-  enableParallelBuilding = true;
-
-  passthru.pkgs = builtins.throw "python-boot does not support packages, this package is only intended for bootstrapping." {};
-
-  meta = {
-    homepage = http://python.org;
-    description = "A high-level dynamically-typed programming language";
-    longDescription = ''
-      Python is a remarkably powerful dynamic programming language that
-      is used in a wide variety of application domains. Some of its key
-      distinguishing features include: clear, readable syntax; strong
-      introspection capabilities; intuitive object orientation; natural
-      expression of procedural code; full modularity, supporting
-      hierarchical packages; exception-based error handling; and very
-      high level dynamic data types.
-    '';
-    license = stdenv.lib.licenses.psfl;
-    platforms = stdenv.lib.platforms.all;
-    maintainers = with stdenv.lib.maintainers; [ lnl7 domenkozar ];
-  };
-}
diff --git a/pkgs/development/interpreters/python/cpython/2.7/default.nix b/pkgs/development/interpreters/python/cpython/2.7/default.nix
index e6b3dff433b3..77b37c5f5c39 100644
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@@ -11,7 +11,7 @@
 , tcl ? null, tk ? null, tix ? null, xlibsWrapper ? null, libX11 ? null, x11Support ? false
 , zlib
 , self
-, CF, configd, coreutils
+, configd, coreutils
 , python-setup-hook
 # Some proprietary libs assume UCS2 unicode, especially on darwin :(
 , ucsEncoding ? 4
@@ -180,7 +180,7 @@ let
     ++ optional stdenv.hostPlatform.isCygwin expat
     ++ [ db gdbm ncurses sqlite readline ]
     ++ optionals x11Support [ tcl tk xlibsWrapper libX11 ]
-    ++ optionals stdenv.isDarwin ([ CF ] ++ optional (configd != null) configd);
+    ++ optional (stdenv.isDarwin && configd != null) configd;
   nativeBuildInputs =
     optionals (stdenv.hostPlatform != stdenv.buildPlatform)
     [ buildPackages.stdenv.cc buildPackages.python ];
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index c1c90d35815c..b778b62f908d 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -11,7 +11,7 @@
 , tcl ? null, tk ? null, tix ? null, libX11 ? null, xorgproto ? null, x11Support ? false
 , zlib
 , self
-, CF, configd
+, configd
 , python-setup-hook
 , nukeReferences
 # For the Python package set
@@ -57,10 +57,10 @@ let
     pythonForBuild
   ];
 
-  buildInputs = filter (p: p != null) [
+  buildInputs = filter (p: p != null) ([
     zlib bzip2 expat lzma libffi gdbm sqlite readline ncurses openssl ]
     ++ optionals x11Support [ tcl tk libX11 xorgproto ]
-    ++ optionals stdenv.isDarwin [ CF configd ];
+    ++ optionals stdenv.isDarwin [ configd ]);
 
   hasDistutilsCxxPatch = !(stdenv.cc.isGNU or false);
 
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index caf2e13bdf62..367a6194ecff 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -57,7 +57,7 @@ in {
       suffix = "";
     };
     sha256 = "0hds28cg226m8j8sr394nm9yc4gxhvlv109w0avsf2mxrlrz0hsd";
-    inherit (darwin) CF configd;
+    inherit (darwin) configd;
     inherit passthruFun;
   };
 
@@ -70,7 +70,7 @@ in {
       suffix = "";
     };
     sha256 = "0jdh9pvx6m6lfz2liwvvhn7vks7qrysqgwn517fkpxb77b33fjn2";
-    inherit (darwin) CF configd;
+    inherit (darwin) configd;
     inherit passthruFun;
   };
 
@@ -83,7 +83,7 @@ in {
       suffix = "";
     };
     sha256 = "1pj0mz1xl27khi250p29c0y99vxg662js8zp71aprkf8i8wkr0qa";
-    inherit (darwin) CF configd;
+    inherit (darwin) configd;
     inherit passthruFun;
   };
 
@@ -96,7 +96,7 @@ in {
       suffix = "";
     };
     sha256 = "0gskry19ylw91p38pdq36qcgk6h3x5i4ia0ik977kw2943kwr8jm";
-    inherit (darwin) CF configd;
+    inherit (darwin) configd;
     inherit passthruFun;
   };
 
@@ -109,7 +109,7 @@ in {
       suffix = "";
     };
     sha256 = "1s4lwn5vzsajlc88m6hkghsvnjw4d00l2dsgng0m2w6vyqbl32bm";
-    inherit (darwin) CF configd;
+    inherit (darwin) configd;
     inherit passthruFun;
   };
 
@@ -122,7 +122,7 @@ in {
       suffix = "a2";
     };
     sha256 = "02a301bdcldin05ksdg8xw8xr6gdkpf73p0cabvn9rdl6yhkr3q8";
-    inherit (darwin) CF configd;
+    inherit (darwin) configd;
     inherit passthruFun;
   };
 
@@ -136,6 +136,7 @@ in {
     ncurses = null;
     gdbm = null;
     sqlite = null;
+    configd = null;
     stripConfig = true;
     stripIdlelib = true;
     stripTests = true;
diff --git a/pkgs/development/interpreters/python/hooks/default.nix b/pkgs/development/interpreters/python/hooks/default.nix
index f05b3b1eec63..159637ae9d5f 100644
--- a/pkgs/development/interpreters/python/hooks/default.nix
+++ b/pkgs/development/interpreters/python/hooks/default.nix
@@ -2,6 +2,9 @@
 { python
 , callPackage
 , makeSetupHook
+, disabledIf
+, isPy3k
+, ensureNewerSourcesForZipFilesHook
 }:
 
 let
@@ -109,6 +112,15 @@ in rec {
       };
     } ./setuptools-check-hook.sh) {};
 
+  venvShellHook = disabledIf (!isPy3k) (callPackage ({ }:
+    makeSetupHook {
+      name = "venv-shell-hook";
+      deps = [ ensureNewerSourcesForZipFilesHook ];
+      substitutions = {
+        inherit pythonInterpreter;
+    };
+  } ./venv-shell-hook.sh) {});
+
   wheelUnpackHook = callPackage ({ wheel }:
     makeSetupHook {
       name = "wheel-unpack-hook.sh";
diff --git a/pkgs/development/interpreters/python/hooks/venv-shell-hook.sh b/pkgs/development/interpreters/python/hooks/venv-shell-hook.sh
new file mode 100644
index 000000000000..3185b1f9fae9
--- /dev/null
+++ b/pkgs/development/interpreters/python/hooks/venv-shell-hook.sh
@@ -0,0 +1,26 @@
+venvShellHook() {
+    echo "Executing venvHook"
+    runHook preShellHook
+
+    if [ -d "${venvDir}" ]; then
+      echo "Skipping venv creation, '${venvDir}' already exists"
+    else
+      echo "Creating new venv environment in path: '${venvDir}'"
+      @pythonInterpreter@ -m venv "${venvDir}"
+    fi
+
+    source "${venvDir}/bin/activate"
+
+    runHook postShellHook
+    echo "Finished executing venvShellHook"
+}
+
+if [ -z "${dontUseVenvShellHook:-}" ] && [ -z "${shellHook-}" ]; then
+    echo "Using venvShellHook"
+    if [ -z "${venvDir-}" ]; then
+        echo "Error: \`venvDir\` should be set when using \`venvShellHook\`."
+        exit 1
+    else
+        shellHook=venvShellHook
+    fi
+fi
diff --git a/pkgs/development/libraries/alure2/default.nix b/pkgs/development/libraries/alure2/default.nix
new file mode 100644
index 000000000000..91919873fa63
--- /dev/null
+++ b/pkgs/development/libraries/alure2/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, fetchFromGitHub, cmake, openal, libvorbis, opusfile, libsndfile }:
+
+stdenv.mkDerivation rec {
+  pname = "alure2";
+  version = "unstable-2020-01-09";
+
+  src = fetchFromGitHub {
+    owner = "kcat";
+    repo = "alure";
+    rev = "4b7b58d3f0de444d6f26aa705704deb59145f586";
+    sha256 = "0ds18hhy2wpvx498z5hcpzfqz9i60ixsi0cjihyvk20rf4qy12vg";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ openal libvorbis opusfile libsndfile ];
+
+  meta = with stdenv.lib; {
+    description = "A utility library for OpenAL, providing a C++ API and managing common tasks that include file loading, caching, and streaming";
+    homepage = "https://github.com/kcat/alure";
+    license = licenses.zlib;
+    platforms = platforms.linux;
+    maintainers  = with maintainers; [ McSinyx ];
+  };
+}
diff --git a/pkgs/development/libraries/boxfort/default.nix b/pkgs/development/libraries/boxfort/default.nix
index 95c1afd090f4..fb6e735c46e7 100644
--- a/pkgs/development/libraries/boxfort/default.nix
+++ b/pkgs/development/libraries/boxfort/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
   preCheck = ''
-    export LD_LIBRARY_PATH=`pwd`:$LD_LIBRARY_PATH
+    export LD_LIBRARY_PATH=`pwd`''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH
   '';
 
   outputs = [ "dev" "out" ];
diff --git a/pkgs/development/libraries/caf/default.nix b/pkgs/development/libraries/caf/default.nix
index ecf991cb59ce..e32ec1695792 100644
--- a/pkgs/development/libraries/caf/default.nix
+++ b/pkgs/development/libraries/caf/default.nix
@@ -22,8 +22,8 @@ stdenv.mkDerivation rec {
   doCheck = true;
   checkTarget = "test";
   preCheck = ''
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/lib
-    export DYLD_LIBRARY_PATH=$DYLD_LIBRARY_PATH:$PWD/lib
+    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib
+    export DYLD_LIBRARY_PATH=$DYLD_LIBRARY_PATH''${DYLD_LIBRARY_PATH:+:}$PWD/lib
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/cln/default.nix b/pkgs/development/libraries/cln/default.nix
index dc36414fc28d..6627f46c18e7 100644
--- a/pkgs/development/libraries/cln/default.nix
+++ b/pkgs/development/libraries/cln/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "cln";
-  version = "1.3.5";
+  version = "1.3.6";
 
   src = fetchurl {
     url = "${meta.homepage}${pname}-${version}.tar.bz2";
-    sha256 = "0bc43v4fyxwik9gjkvm8jan74bkx9bjssv61lfh9jhhblmj010bq";
+    sha256 = "0jlq9l4hphk7qqlgqj9ihjp4m3rwjbhk6q4v00lsbgbri07574pl";
   };
 
   buildInputs = [ gmp ];
diff --git a/pkgs/development/libraries/clutter-gst/default.nix b/pkgs/development/libraries/clutter-gst/default.nix
index 3c88327c790b..2db4f6bf1ab8 100644
--- a/pkgs/development/libraries/clutter-gst/default.nix
+++ b/pkgs/development/libraries/clutter-gst/default.nix
@@ -1,13 +1,13 @@
 { fetchurl, stdenv, pkgconfig, clutter, gtk3, glib, cogl, gnome3, gdk-pixbuf }:
 
-let
+stdenv.mkDerivation rec {
   pname = "clutter-gst";
   version = "3.0.27";
-in stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
+
+  outputs = [ "out" "dev" ];
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "17czmpl92dzi4h3rn5rishk015yi3jwiw29zv8qan94xcmnbssgy";
   };
 
diff --git a/pkgs/development/libraries/cpp-netlib/default.nix b/pkgs/development/libraries/cpp-netlib/default.nix
index a4729cdeaed8..31c4c70dd9d0 100644
--- a/pkgs/development/libraries/cpp-netlib/default.nix
+++ b/pkgs/development/libraries/cpp-netlib/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, boost, openssl, asio }:
+{ stdenv, fetchFromGitHub, cmake, boost, openssl }:
 
 stdenv.mkDerivation rec {
   pname = "cpp-netlib";
@@ -14,18 +14,22 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ cmake boost openssl ];
 
-  # This can be removed when updating to 0.13, see https://github.com/cpp-netlib/cpp-netlib/issues/629
-  propagatedBuildInputs = [ asio ];
-
   cmakeFlags = [
     "-DCPP-NETLIB_BUILD_SHARED_LIBS=ON"
   ];
 
   enableParallelBuilding = true;
 
+  # The test driver binary lacks an RPath to the library's libs
+  preCheck = ''
+    export LD_LIBRARY_PATH=$PWD/libs/network/src
+  '';
+
+  # Most tests make network GET requests to various websites
+  doCheck = false;
+
   meta = with stdenv.lib; {
-    description =
-      "Collection of open-source libraries for high level network programming";
+    description = "Collection of open-source libraries for high level network programming";
     homepage    = https://cpp-netlib.org;
     license     = licenses.boost;
     platforms   = platforms.all;
diff --git a/pkgs/development/libraries/cppunit/default.nix b/pkgs/development/libraries/cppunit/default.nix
index 76fd6db18b05..b006b0911f14 100644
--- a/pkgs/development/libraries/cppunit/default.nix
+++ b/pkgs/development/libraries/cppunit/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "cppunit";
-  version = "1.14.0";
+  version = "1.15.0";
 
   src = fetchurl {
     url = "https://dev-www.libreoffice.org/src/${pname}-${version}.tar.gz";
-    sha256 = "1027cyfx5gsjkdkaf6c2wnjh68882grw8n672018cj3vs9lrhmix";
+    sha256 = "08j9hc11yl07ginsf282pshn6zpy96yhzf7426sfn10f8gdxyq8w";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/criterion/default.nix b/pkgs/development/libraries/criterion/default.nix
index c2721d3839a1..3dc4b4624048 100644
--- a/pkgs/development/libraries/criterion/default.nix
+++ b/pkgs/development/libraries/criterion/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   cmakeFlags = [ "-DCTESTS=ON" ];
   doCheck = true;
   preCheck = ''
-    export LD_LIBRARY_PATH=`pwd`:$LD_LIBRARY_PATH
+    export LD_LIBRARY_PATH=`pwd`''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH
   '';
   checkTarget = "criterion_tests test";
 
diff --git a/pkgs/development/libraries/cutelyst/default.nix b/pkgs/development/libraries/cutelyst/default.nix
index 6cd464e55390..2cf611eed275 100644
--- a/pkgs/development/libraries/cutelyst/default.nix
+++ b/pkgs/development/libraries/cutelyst/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   ];
 
   preBuild = ''
-    export LD_LIBRARY_PATH="$LD_LIBRARY_PATH:`pwd`/Cutelyst:`pwd`/EventLoopEPoll"
+    export LD_LIBRARY_PATH="$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}`pwd`/Cutelyst:`pwd`/EventLoopEPoll"
   '';
 
   postBuild = ''
diff --git a/pkgs/development/libraries/exiv2/default.nix b/pkgs/development/libraries/exiv2/default.nix
index 21f63e07335d..425346df816e 100644
--- a/pkgs/development/libraries/exiv2/default.nix
+++ b/pkgs/development/libraries/exiv2/default.nix
@@ -69,7 +69,7 @@ stdenv.mkDerivation rec {
     ''}
 
     ${stdenv.lib.optionalString stdenv.isDarwin ''
-      export DYLD_LIBRARY_PATH=$DYLD_LIBRARY_PATH:`pwd`/lib
+      export DYLD_LIBRARY_PATH=$DYLD_LIBRARY_PATH''${DYLD_LIBRARY_PATH:+:}`pwd`/lib
       # Removing tests depending on charset conversion
       substituteInPlace ../test/Makefile --replace "conversions.sh" ""
       rm -f ../tests/bugfixes/redmine/test_issue_460.py
diff --git a/pkgs/development/libraries/glfw/3.x.nix b/pkgs/development/libraries/glfw/3.x.nix
index cf988d323994..16368ae21276 100644
--- a/pkgs/development/libraries/glfw/3.x.nix
+++ b/pkgs/development/libraries/glfw/3.x.nix
@@ -4,14 +4,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "3.3";
+  version = "3.3.1";
   pname = "glfw";
 
   src = fetchFromGitHub {
     owner = "glfw";
     repo = "GLFW";
     rev = version;
-    sha256 = "1f1hqpqffzg46z33ybs2c3akmkly7b3qmgp5byk50nvad6g2pm4p";
+    sha256 = "0c7nlrhq84gdq10diyv6nshjbv8410bmn0vging815pfvis208xc";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index 4a7d6cce90b0..187562132300 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -160,7 +160,7 @@ stdenv.mkDerivation rec {
   checkInputs = [ tzdata libxml2 desktop-file-utils shared-mime-info ];
 
   preCheck = optionalString doCheck ''
-    export LD_LIBRARY_PATH="$NIX_BUILD_TOP/${pname}-${version}/glib/.libs:$LD_LIBRARY_PATH"
+    export LD_LIBRARY_PATH="$NIX_BUILD_TOP/${pname}-${version}/glib/.libs''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
     export TZDIR="${tzdata}/share/zoneinfo"
     export XDG_CACHE_HOME="$TMP"
     export XDG_RUNTIME_HOME="$TMP"
diff --git a/pkgs/development/libraries/glog/default.nix b/pkgs/development/libraries/glog/default.nix
index 04846c3ab427..aa846e41d550 100644
--- a/pkgs/development/libraries/glog/default.nix
+++ b/pkgs/development/libraries/glog/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, fetchpatch, cmake, perl }:
+{ stdenv, lib, fetchFromGitHub, fetchpatch, cmake, gflags, perl }:
 
 stdenv.mkDerivation rec {
   pname = "glog";
@@ -20,8 +20,16 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    # A path clash on case-insensitive file systems blocks creation of the build directory.
+    # The file in question is specific to bazel and does not influence the build result.
+    rm BUILD
+  '';
+
   nativeBuildInputs = [ cmake ];
 
+  propagatedBuildInputs = [ gflags ];
+
   cmakeFlags = [ "-DBUILD_SHARED_LIBS=ON" ];
 
   checkInputs = [ perl ];
diff --git a/pkgs/development/libraries/grpc/default.nix b/pkgs/development/libraries/grpc/default.nix
index abcd3abaf309..dfec171f1dbc 100644
--- a/pkgs/development/libraries/grpc/default.nix
+++ b/pkgs/development/libraries/grpc/default.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
   '';
 
   preBuild = ''
-    export LD_LIBRARY_PATH=$(pwd):$LD_LIBRARY_PATH
+    export LD_LIBRARY_PATH=$(pwd)''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH
   '';
 
   NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-error=unknown-warning-option";
diff --git a/pkgs/development/libraries/gtkd/default.nix b/pkgs/development/libraries/gtkd/default.nix
index 0b2df597be57..2cad4a19a0f3 100644
--- a/pkgs/development/libraries/gtkd/default.nix
+++ b/pkgs/development/libraries/gtkd/default.nix
@@ -7,6 +7,8 @@ in stdenv.mkDerivation rec {
   pname = "gtkd";
   version = "3.9.0";
 
+  outputs = [ "out" "dev" ];
+
   src = fetchzip {
     url = "https://gtkd.org/Downloads/sources/GtkD-${version}.zip";
     sha256 = "12kc4s5gp6gn456d8pzhww1ggi9qbxldmcpp6855297g2x8xxy5p";
@@ -118,6 +120,15 @@ in stdenv.mkDerivation rec {
     "PKG_CONFIG=${pkgconfig}/bin/pkg-config"
   ];
 
+  # The .pc files does not declare an `includedir=`, so the multiple
+  # outputs setup hook misses this.
+  postFixup = ''
+    for pc in $dev/lib/pkgconfig/*; do
+      substituteInPlace $pc \
+        --replace "$out/include" "$dev/include"
+    done
+  '';
+
   meta = with stdenv.lib; {
     description = "D binding and OO wrapper for GTK";
     homepage = https://gtkd.org;
diff --git a/pkgs/development/libraries/jsoncpp/default.nix b/pkgs/development/libraries/jsoncpp/default.nix
index 72158e186ac2..7b06cc8ad4e6 100644
--- a/pkgs/development/libraries/jsoncpp/default.nix
+++ b/pkgs/development/libraries/jsoncpp/default.nix
@@ -23,9 +23,9 @@ stdenv.mkDerivation rec {
   # Hack to be able to run the test, broken because we use
   # CMAKE_SKIP_BUILD_RPATH to avoid cmake resetting rpath on install
   preBuild = if stdenv.isDarwin then ''
-    export DYLD_LIBRARY_PATH="`pwd`/src/lib_json:$DYLD_LIBRARY_PATH"
+    export DYLD_LIBRARY_PATH="`pwd`/src/lib_json''${DYLD_LIBRARY_PATH:+:}$DYLD_LIBRARY_PATH"
   '' else ''
-    export LD_LIBRARY_PATH="`pwd`/src/lib_json:$LD_LIBRARY_PATH"
+    export LD_LIBRARY_PATH="`pwd`/src/lib_json''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
   '';
 
   nativeBuildInputs = [ cmake python ];
diff --git a/pkgs/development/libraries/kde-frameworks/extra-cmake-modules/nix-lib-path.patch b/pkgs/development/libraries/kde-frameworks/extra-cmake-modules/nix-lib-path.patch
index f019e67d3f08..804fffc8fdcb 100644
--- a/pkgs/development/libraries/kde-frameworks/extra-cmake-modules/nix-lib-path.patch
+++ b/pkgs/development/libraries/kde-frameworks/extra-cmake-modules/nix-lib-path.patch
@@ -1,12 +1,12 @@
 diff --git a/kde-modules/KDEInstallDirs.cmake b/kde-modules/KDEInstallDirs.cmake
-index 0acd33f..c04b0a5 100644
+index c1d056b..d9e19f0 100644
 --- a/kde-modules/KDEInstallDirs.cmake
 +++ b/kde-modules/KDEInstallDirs.cmake
-@@ -236,35 +236,6 @@
+@@ -242,35 +242,6 @@
  # GNUInstallDirs code deals with re-configuring, but that is dealt with
  # by the _define_* macros in this module).
  set(_LIBDIR_DEFAULT "lib")
--# Override this default 'lib' with 'lib64' iff:
+-# Override this default 'lib' with 'lib64' if:
 -#  - we are on a Linux, kFreeBSD or Hurd system but NOT cross-compiling
 -#  - we are NOT on debian
 -#  - we are NOT on flatpak
diff --git a/pkgs/development/libraries/kde-frameworks/fetch.sh b/pkgs/development/libraries/kde-frameworks/fetch.sh
index c76ff9fb2c81..f1db686b03e2 100644
--- a/pkgs/development/libraries/kde-frameworks/fetch.sh
+++ b/pkgs/development/libraries/kde-frameworks/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/frameworks/5.64/ )
+WGET_ARGS=( https://download.kde.org/stable/frameworks/5.65/ )
diff --git a/pkgs/development/libraries/kde-frameworks/kinit/kdeinit-extra_libs.patch b/pkgs/development/libraries/kde-frameworks/kinit/kdeinit-extra_libs.patch
index 89145e3e1dde..d5b1a4accaa7 100644
--- a/pkgs/development/libraries/kde-frameworks/kinit/kdeinit-extra_libs.patch
+++ b/pkgs/development/libraries/kde-frameworks/kinit/kdeinit-extra_libs.patch
@@ -38,10 +38,9 @@ Index: kinit-5.32.0/src/kdeinit/kinit.cpp
      static void secondary_child_handler(int)
 @@ -1692,7 +1676,7 @@ int main(int argc, char **argv)
      if (!d.suicide && qEnvironmentVariableIsEmpty("KDE_IS_PRELINKED")) {
-         const int extrasCount = sizeof(extra_libs) / sizeof(extra_libs[0]);
-         for (int i = 0; i < extrasCount; i++) {
--            const QString extra = findSharedLib(QString::fromLatin1(extra_libs[i]));
-+            const QString extra = QString::fromLatin1(extra_libs[i]);
+         for (const char *extra_lib : extra_libs) {
+-            const QString extra = findSharedLib(QString::fromLatin1(extra_lib));
++            const QString extra = QString::fromLatin1(extra_lib);
              if (!extra.isEmpty()) {
                  QLibrary l(extra);
                  l.setLoadHints(QLibrary::ExportExternalSymbolsHint);
diff --git a/pkgs/development/libraries/kde-frameworks/srcs.nix b/pkgs/development/libraries/kde-frameworks/srcs.nix
index 32edca387102..ab49d43674df 100644
--- a/pkgs/development/libraries/kde-frameworks/srcs.nix
+++ b/pkgs/development/libraries/kde-frameworks/srcs.nix
@@ -3,651 +3,659 @@
 
 {
   attica = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/attica-5.64.0.tar.xz";
-      sha256 = "c9b060693656a458f92905091e12d800be020abbf47bb68b9f769a191aa368d9";
-      name = "attica-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/attica-5.65.0.tar.xz";
+      sha256 = "a62908517f9cf44fd13c2cb37868f6484710284bc85bd85b532c3b8b7fc2b9ea";
+      name = "attica-5.65.0.tar.xz";
     };
   };
   baloo = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/baloo-5.64.0.tar.xz";
-      sha256 = "adaaef1aeec07ccc210210a2e67f4d12c0275226bb05d0220da0281f1a3984c2";
-      name = "baloo-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/baloo-5.65.0.tar.xz";
+      sha256 = "c24c53838d57b40a1f099cb40240cad86fb9ebbf09fd0f811d9ce14a9cf5f3bf";
+      name = "baloo-5.65.0.tar.xz";
     };
   };
   bluez-qt = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/bluez-qt-5.64.0.tar.xz";
-      sha256 = "7d6c7ba913cea6059327726325b8af4cf2baa7594b8be3143e0649eaa36f8384";
-      name = "bluez-qt-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/bluez-qt-5.65.0.tar.xz";
+      sha256 = "ad60bd7ee5d46bcee838d3c36031ccd4d427cd6ac93286831695f89198a5f143";
+      name = "bluez-qt-5.65.0.tar.xz";
     };
   };
   breeze-icons = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/breeze-icons-5.64.0.tar.xz";
-      sha256 = "08c2f7efc5f1550668dd2e0cff1641b1b6ec8a91f01614ee14c6abc4d975672f";
-      name = "breeze-icons-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/breeze-icons-5.65.0.tar.xz";
+      sha256 = "166c0a7d49524313c5355e763f6561075ef33cae968ddf6da3174d2788dd7da3";
+      name = "breeze-icons-5.65.0.tar.xz";
     };
   };
   extra-cmake-modules = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/extra-cmake-modules-5.64.0.tar.xz";
-      sha256 = "1865efc6254bed44e0a6918c5af3da62be4008ba7a197a47f35251f298041a69";
-      name = "extra-cmake-modules-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/extra-cmake-modules-5.65.0.tar.xz";
+      sha256 = "41634536ca1165a758acd85aa11112177616019e2d3974693a92d1d9bc91c105";
+      name = "extra-cmake-modules-5.65.0.tar.xz";
     };
   };
   frameworkintegration = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/frameworkintegration-5.64.0.tar.xz";
-      sha256 = "6c1880f8300a014bb835ce29fd68651bfd38400de8044fe5914cb4392df48a26";
-      name = "frameworkintegration-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/frameworkintegration-5.65.0.tar.xz";
+      sha256 = "3170f99d4418b25225813822e22a1bdf8d73af87cd00b696089b696b151d43be";
+      name = "frameworkintegration-5.65.0.tar.xz";
     };
   };
   kactivities = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kactivities-5.64.0.tar.xz";
-      sha256 = "5afbd0785c04127c91f1ad7402c95ce3f994fb94b216baf56cd802a3a230a3f9";
-      name = "kactivities-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kactivities-5.65.0.tar.xz";
+      sha256 = "00a64654861cdff809be5f78931bfd671fe81841380b9c3926f75957c18f139b";
+      name = "kactivities-5.65.0.tar.xz";
     };
   };
   kactivities-stats = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kactivities-stats-5.64.0.tar.xz";
-      sha256 = "ca1c07b1250735372a4f6aa6b493536d420a902de0d7a8c9777b437fb6ab0bf9";
-      name = "kactivities-stats-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kactivities-stats-5.65.0.tar.xz";
+      sha256 = "5a7ae4c43610ac6d6ce084d639a9a3b6db58ac14a61b56be53a9282573b296c0";
+      name = "kactivities-stats-5.65.0.tar.xz";
     };
   };
   kapidox = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kapidox-5.64.0.tar.xz";
-      sha256 = "f75eedfa1af51f5224b14d8bc4c229c2c2d27f607e00172d24bdcede1c899fb4";
-      name = "kapidox-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kapidox-5.65.0.tar.xz";
+      sha256 = "3748814024088e72a510bde782f47235fded41835ee4dcc130a441a814af7a68";
+      name = "kapidox-5.65.0.tar.xz";
     };
   };
   karchive = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/karchive-5.64.0.tar.xz";
-      sha256 = "135fbfb2dfe107e4487723a5f887d1d074e13258a4583d592639366094aafe1a";
-      name = "karchive-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/karchive-5.65.0.tar.xz";
+      sha256 = "9e6cdb2cf10407fd435b97eb284ac56ad1bca95f0b1789a8bc26c9cee7edcc52";
+      name = "karchive-5.65.0.tar.xz";
     };
   };
   kauth = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kauth-5.64.0.tar.xz";
-      sha256 = "ac95525bf1430868c8f54dbdc986478cf7b21192ad3b486381485b429eadddcc";
-      name = "kauth-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kauth-5.65.0.tar.xz";
+      sha256 = "277821947090e806f5850983e110134480915bf8e9609e0f24eaf34f7ca00c5f";
+      name = "kauth-5.65.0.tar.xz";
     };
   };
   kbookmarks = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kbookmarks-5.64.0.tar.xz";
-      sha256 = "51343a57b50032d60ffae123f426cdd67cd290ce306ae494c1956d0b899d4ff2";
-      name = "kbookmarks-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kbookmarks-5.65.0.tar.xz";
+      sha256 = "c00a04d77ce2b4744feb5ae43f50f8ae5c18b752eae52a8f4d9db47046daf18a";
+      name = "kbookmarks-5.65.0.tar.xz";
     };
   };
   kcalendarcore = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kcalendarcore-5.64.0.tar.xz";
-      sha256 = "983f240a7478a780dc403d577827f027856f9f67e8c3bfe8b69d56093e5bb80e";
-      name = "kcalendarcore-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kcalendarcore-5.65.0.tar.xz";
+      sha256 = "fb79dc1bd1153c7fc38242c577a324462b8913e151bc33b74f7997e48d494cb8";
+      name = "kcalendarcore-5.65.0.tar.xz";
     };
   };
   kcmutils = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kcmutils-5.64.0.tar.xz";
-      sha256 = "f55938c566669e9fcdd786ebfd89edfc11b0c283532aed04cfe4162b58a8b649";
-      name = "kcmutils-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kcmutils-5.65.0.tar.xz";
+      sha256 = "fbb525cb21afbf9752d171ceb333a805c40d4722b98da6fce0243e37b8398ec3";
+      name = "kcmutils-5.65.0.tar.xz";
     };
   };
   kcodecs = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kcodecs-5.64.0.tar.xz";
-      sha256 = "24cbffb123179cf4386500ae7bc7c99f65c4422cd7b91f314152f11cd596402a";
-      name = "kcodecs-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kcodecs-5.65.0.tar.xz";
+      sha256 = "eca1642a559aad9aed57ea3ad5c7a62a2b20ad13969b6fcba671f5bc7c9782fd";
+      name = "kcodecs-5.65.0.tar.xz";
     };
   };
   kcompletion = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kcompletion-5.64.0.tar.xz";
-      sha256 = "4fe5b9254e038e654d55167163b2812582f31fe550c977979d692b69424c2508";
-      name = "kcompletion-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kcompletion-5.65.0.tar.xz";
+      sha256 = "bdd7201940fa47ac1b62f6fcf7a12883abed44876ff729cb430c11d3868eb8ae";
+      name = "kcompletion-5.65.0.tar.xz";
     };
   };
   kconfig = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kconfig-5.64.0.tar.xz";
-      sha256 = "112c1db9f038dbacf357d08645c83ca103d8c3e7fb0c880ac16f665fdf7d9157";
-      name = "kconfig-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kconfig-5.65.0.tar.xz";
+      sha256 = "8dfa064effdf559e1179e9d7e5ec12ff9d79fcfef1859bd1793557261e94a6ed";
+      name = "kconfig-5.65.0.tar.xz";
     };
   };
   kconfigwidgets = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kconfigwidgets-5.64.0.tar.xz";
-      sha256 = "e84d590c064f2a86d5b9d2fb5d8aa7abc8ac8752125f5d3197cca6dc7e115c56";
-      name = "kconfigwidgets-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kconfigwidgets-5.65.0.tar.xz";
+      sha256 = "210a694aacd0d6bd26a5a6b78986d180960ddb7e26933b127a0107ae4995a120";
+      name = "kconfigwidgets-5.65.0.tar.xz";
     };
   };
   kcontacts = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kcontacts-5.64.0.tar.xz";
-      sha256 = "0bf0a1ba6ebedd400bed7a490093962cde6a2b26c49627d6770a71524db63058";
-      name = "kcontacts-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kcontacts-5.65.0.tar.xz";
+      sha256 = "84dd287010c8daa6865337df39ce14b44f8f7c14c810fe095d264d5bafa7b306";
+      name = "kcontacts-5.65.0.tar.xz";
     };
   };
   kcoreaddons = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kcoreaddons-5.64.0.tar.xz";
-      sha256 = "3f0cb3273debf9791dda3f1ad135b6b1a20d88fed1e21890c4b70bac64fdb188";
-      name = "kcoreaddons-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kcoreaddons-5.65.0.tar.xz";
+      sha256 = "0f334b123b307829d11a39f639845f2f74d290490b264d9b188f1a785e16bf41";
+      name = "kcoreaddons-5.65.0.tar.xz";
     };
   };
   kcrash = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kcrash-5.64.0.tar.xz";
-      sha256 = "9e9ad5e7a6a3e9a128128a7863204f8c4a555bd8659d8ed4ef4cc6bb2fc48290";
-      name = "kcrash-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kcrash-5.65.0.tar.xz";
+      sha256 = "6b05608507dd2f8821399c4596021bcf9da79a284726a093c8b81b6d3cc4e034";
+      name = "kcrash-5.65.0.tar.xz";
     };
   };
   kdbusaddons = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kdbusaddons-5.64.0.tar.xz";
-      sha256 = "74a6eb443a74eb74a859238b555a3b16be1d6367c4db2a7af5b16da528d57f62";
-      name = "kdbusaddons-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kdbusaddons-5.65.0.tar.xz";
+      sha256 = "e2777538c6d1f0dd5956b3bc2c9cfe34fe360655c188e658f52f926ff8cb3fcc";
+      name = "kdbusaddons-5.65.0.tar.xz";
     };
   };
   kdeclarative = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kdeclarative-5.64.0.tar.xz";
-      sha256 = "1bf199aebabe63880babc364572de44f6b0a94ffbbffd955bc85916c2be7701d";
-      name = "kdeclarative-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kdeclarative-5.65.0.tar.xz";
+      sha256 = "a0274de8c84d73dd17b1bc0faf64a9e0d0655035c0574148ba64986e367cd881";
+      name = "kdeclarative-5.65.0.tar.xz";
     };
   };
   kded = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kded-5.64.0.tar.xz";
-      sha256 = "2e8bda93918ac174254c8f70a71c9d6966a4721e14a631760e1b912d108001be";
-      name = "kded-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kded-5.65.0.tar.xz";
+      sha256 = "14ba21ffed8b425be7550c8b7e3ba78d3f208b800bba7db6c950e02c06d1f032";
+      name = "kded-5.65.0.tar.xz";
     };
   };
   kdelibs4support = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/portingAids/kdelibs4support-5.64.0.tar.xz";
-      sha256 = "8c9e23e0e22ccec8b46b4c4b160adb8c8765c1dc308bf297f6f72ccc97c7b682";
-      name = "kdelibs4support-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/portingAids/kdelibs4support-5.65.0.tar.xz";
+      sha256 = "c7ebd744c1c8dbc1b8adcf815a7a019b73e5f85653dda3e19dc9f31cab4e7701";
+      name = "kdelibs4support-5.65.0.tar.xz";
     };
   };
   kdesignerplugin = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/portingAids/kdesignerplugin-5.64.0.tar.xz";
-      sha256 = "1ca638ec822d9882f4a865d599ce8ad94785fa890ce73bccd5e78210c4a3d95b";
-      name = "kdesignerplugin-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/portingAids/kdesignerplugin-5.65.0.tar.xz";
+      sha256 = "e6ba152df5848789cd35f1734dfd3d20f439a21ebba8b96caf747654de42c515";
+      name = "kdesignerplugin-5.65.0.tar.xz";
     };
   };
   kdesu = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kdesu-5.64.0.tar.xz";
-      sha256 = "f4644b0ee91c55473589909c20a7fa1cfbd3d466f1c72b330d53871a2346d4f0";
-      name = "kdesu-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kdesu-5.65.0.tar.xz";
+      sha256 = "a39a727db863a45969cca2736b321257a2a6c0f2db7e0c70cbe9cf8b3f180d40";
+      name = "kdesu-5.65.0.tar.xz";
     };
   };
   kdewebkit = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/portingAids/kdewebkit-5.64.0.tar.xz";
-      sha256 = "882801a1fd944b08918cb7d9341985e4330e7adac00ae4e6dddcea5343393ac1";
-      name = "kdewebkit-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/portingAids/kdewebkit-5.65.0.tar.xz";
+      sha256 = "82525a8fda1e9e2e7cde348b6e7227b0747f93d75a7648f4863e0e6889640586";
+      name = "kdewebkit-5.65.0.tar.xz";
     };
   };
   kdnssd = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kdnssd-5.64.0.tar.xz";
-      sha256 = "92d9a4947c45e56ea15e417eaf87121b4b3a4f1f81dfd154d2ee968a9797f46b";
-      name = "kdnssd-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kdnssd-5.65.0.tar.xz";
+      sha256 = "e7f684580f3f6060a73da33439b463ed0f47f72e7129c142b09b4b642331969f";
+      name = "kdnssd-5.65.0.tar.xz";
     };
   };
   kdoctools = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kdoctools-5.64.0.tar.xz";
-      sha256 = "3e669c9bdf8822c262d834a9fbe9250ffdc91ea49c916b2c16ac8483b62f8fce";
-      name = "kdoctools-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kdoctools-5.65.0.tar.xz";
+      sha256 = "0ff2b70bc46ffc7b62dba9476163ed26ba7fddb8be0ba34ecf48055bcabb649b";
+      name = "kdoctools-5.65.0.tar.xz";
     };
   };
   kemoticons = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kemoticons-5.64.0.tar.xz";
-      sha256 = "0b586957bfe26ce0fe44eca305992f99e3c31fbeb19a9d369c4abfdf9cc0400f";
-      name = "kemoticons-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kemoticons-5.65.0.tar.xz";
+      sha256 = "923853ef4fd472369f9d5ec3732d6d03dc55b6ba1dd79146f24551d642e09e51";
+      name = "kemoticons-5.65.0.tar.xz";
     };
   };
   kfilemetadata = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kfilemetadata-5.64.0.tar.xz";
-      sha256 = "4b581e4d659defe4db595a984ed4c037bc80e0bf7b298ec79e6aa5061fa56e23";
-      name = "kfilemetadata-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kfilemetadata-5.65.0.tar.xz";
+      sha256 = "9df372bcc1f910a332b4f5f8b34f5cfeb453c002bec93cdb4004e36157883a75";
+      name = "kfilemetadata-5.65.0.tar.xz";
     };
   };
   kglobalaccel = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kglobalaccel-5.64.0.tar.xz";
-      sha256 = "6863515428988c129acfcceaa3518f90d72c590aff2c295a958a68d0c4cd02ab";
-      name = "kglobalaccel-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kglobalaccel-5.65.0.tar.xz";
+      sha256 = "48fc4678ad28aaba07056b2e6f4b8cc7b8e9522cad8dbed43980a0b38ad9b8df";
+      name = "kglobalaccel-5.65.0.tar.xz";
     };
   };
   kguiaddons = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kguiaddons-5.64.0.tar.xz";
-      sha256 = "4caac79b7341c7796f3ca5e1d88cef57ecab2eefcac9ab654fd977706c89bae4";
-      name = "kguiaddons-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kguiaddons-5.65.0.tar.xz";
+      sha256 = "f6b34db7c21ced8179351f2bf38c7c073fa4e0f6de2f9d03986aedba4f87488d";
+      name = "kguiaddons-5.65.0.tar.xz";
     };
   };
   kholidays = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kholidays-5.64.0.tar.xz";
-      sha256 = "65b847ba7a00e1a42c0048fe05a400f584e1d9e746edb5d935331ffcb1f5d4ab";
-      name = "kholidays-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kholidays-5.65.0.tar.xz";
+      sha256 = "613f9050c4970a22680c72680dc76d45b270fb5b76129a994a375ad158ab832c";
+      name = "kholidays-5.65.0.tar.xz";
     };
   };
   khtml = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/portingAids/khtml-5.64.0.tar.xz";
-      sha256 = "00d3a3e8c8b8072f4894d74f91d963cfefbd681e47da0b8e80e1297224c5af85";
-      name = "khtml-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/portingAids/khtml-5.65.0.tar.xz";
+      sha256 = "cfbfda470b4aecd189489e44983aa3c725ef0d234992afd38701273663d7ccba";
+      name = "khtml-5.65.0.tar.xz";
     };
   };
   ki18n = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/ki18n-5.64.0.tar.xz";
-      sha256 = "ccd2c2f8b14251701f902c9e7d046da1582e544d31edae743911f3554022d024";
-      name = "ki18n-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/ki18n-5.65.0.tar.xz";
+      sha256 = "303c3ef4fc7e417233211373a21759332f39a9ae45c9ce7b407eaba412d2caa4";
+      name = "ki18n-5.65.0.tar.xz";
     };
   };
   kiconthemes = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kiconthemes-5.64.0.tar.xz";
-      sha256 = "f89a97e9501d841d4543249776783ebd1fc4d7f69e114f8a56027f59ad32000a";
-      name = "kiconthemes-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kiconthemes-5.65.0.tar.xz";
+      sha256 = "6549774254705861654e0393ab53b7a06b62415644d6bbe5479f7458b22895c5";
+      name = "kiconthemes-5.65.0.tar.xz";
     };
   };
   kidletime = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kidletime-5.64.0.tar.xz";
-      sha256 = "8287e958a8a2a9538bec1038f5e31ebba338ff522de9c51265ca1d63030581d0";
-      name = "kidletime-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kidletime-5.65.0.tar.xz";
+      sha256 = "10b12437efb42c66956a728dad3a04d84dab5a081536a3b7029393a0ae3f1722";
+      name = "kidletime-5.65.0.tar.xz";
     };
   };
   kimageformats = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kimageformats-5.64.0.tar.xz";
-      sha256 = "48c6a7026854127fc83698ab11e6639a525d387cf384f2558db6c7478bceae4c";
-      name = "kimageformats-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kimageformats-5.65.0.tar.xz";
+      sha256 = "51ed246d07e33b5214a5594566955c2b1eff44e009998e74d7f2fe8011f82d13";
+      name = "kimageformats-5.65.0.tar.xz";
     };
   };
   kinit = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kinit-5.64.0.tar.xz";
-      sha256 = "5298b783499cedb681c334b20234a511cb3377e66d140e7df6b7c1899186263d";
-      name = "kinit-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kinit-5.65.0.tar.xz";
+      sha256 = "bbff3999f40d67284e7f90118f29dbedc9fdd673ce74f29f82a9115f4b5efbc1";
+      name = "kinit-5.65.0.tar.xz";
     };
   };
   kio = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kio-5.64.0.tar.xz";
-      sha256 = "e38c8dcf634989f0f7ec95b68bdd936b9e05f7d242e4050b01f79b7021108f59";
-      name = "kio-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kio-5.65.0.tar.xz";
+      sha256 = "7d3cc0c82e83c082b424a2fe4c796c4c46f233ccd565775babbf6b434fce851b";
+      name = "kio-5.65.0.tar.xz";
     };
   };
   kirigami2 = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kirigami2-5.64.0.tar.xz";
-      sha256 = "c394360e2323c55cf654d09ec762a03c47db0027e6a992646ea32d27ce8b228e";
-      name = "kirigami2-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kirigami2-5.65.0.tar.xz";
+      sha256 = "034222e4beec5c5b142cdbdd35304fe5374097367237af1feb5252dabe87e261";
+      name = "kirigami2-5.65.0.tar.xz";
     };
   };
   kitemmodels = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kitemmodels-5.64.0.tar.xz";
-      sha256 = "1bae70e4c6a033eea649efc17f0a060aba89144f4c469f235fbf5023dba5abc4";
-      name = "kitemmodels-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kitemmodels-5.65.0.tar.xz";
+      sha256 = "01980a8b518cdb442ace10f7a61dacec1cb61ff708d86edf83ee079cb6451d41";
+      name = "kitemmodels-5.65.0.tar.xz";
     };
   };
   kitemviews = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kitemviews-5.64.0.tar.xz";
-      sha256 = "0b3f8a0116c042ae187b67f35ffd40872352b91f5f236d19dd26ffad8db83fee";
-      name = "kitemviews-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kitemviews-5.65.0.tar.xz";
+      sha256 = "689f2517432861932a05b5c71e1c8c1378bee6773850e8a13a5907d0af58d5cb";
+      name = "kitemviews-5.65.0.tar.xz";
     };
   };
   kjobwidgets = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kjobwidgets-5.64.0.tar.xz";
-      sha256 = "3b39fc5dfc0f1a9cc9bffed3d05b90ba46c52c63cbbeffa0666f5f09e7093ce0";
-      name = "kjobwidgets-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kjobwidgets-5.65.0.tar.xz";
+      sha256 = "2b68d848b086f274020334cadd28d212125e05a7fdd97ff97ac801aed80ec852";
+      name = "kjobwidgets-5.65.0.tar.xz";
     };
   };
   kjs = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/portingAids/kjs-5.64.0.tar.xz";
-      sha256 = "93855cde810feb7208443a93f81c952bdb42f9886154959bc7a6509c9863e503";
-      name = "kjs-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/portingAids/kjs-5.65.0.tar.xz";
+      sha256 = "d7c9f86a500049a3aa940be469e86e5dbe00d41de9c9488916958ef1a1037df0";
+      name = "kjs-5.65.0.tar.xz";
     };
   };
   kjsembed = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/portingAids/kjsembed-5.64.0.tar.xz";
-      sha256 = "939226116cb47fd66dc45a41baa3c0f45b7ab904ec7674088ced3df5c7bae62e";
-      name = "kjsembed-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/portingAids/kjsembed-5.65.0.tar.xz";
+      sha256 = "e6d919e6c87f7a38df623a4f5061cafa50b61fe10f9d4769f61f116f4e920d21";
+      name = "kjsembed-5.65.0.tar.xz";
     };
   };
   kmediaplayer = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/portingAids/kmediaplayer-5.64.0.tar.xz";
-      sha256 = "ce4816a14134c4968559ff5030895ab69b63b66e9b541b74595ce05e4fe68d1d";
-      name = "kmediaplayer-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/portingAids/kmediaplayer-5.65.0.tar.xz";
+      sha256 = "bbab29b71d07ec736b842abc54a67441cb89b25b81e957bd8a95c1550f95c673";
+      name = "kmediaplayer-5.65.0.tar.xz";
     };
   };
   knewstuff = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/knewstuff-5.64.0.tar.xz";
-      sha256 = "91334c95a1082ae402ee869da399e5bdbac986c8b30a85d0a899b30de1f3be72";
-      name = "knewstuff-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/knewstuff-5.65.0.tar.xz";
+      sha256 = "0ec8ab4d7f52c94fb479c0c56ed762748832c76e88b495694b7485e79d9797d9";
+      name = "knewstuff-5.65.0.tar.xz";
     };
   };
   knotifications = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/knotifications-5.64.0.tar.xz";
-      sha256 = "5f0c3b158ba253e8df81016c8921d689836ecac063a39766c0290352c9f71bc1";
-      name = "knotifications-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/knotifications-5.65.0.tar.xz";
+      sha256 = "9d766c1566ea7cab83e6cd9c57f76583b3404f9864ed1ba1bc65535ea4c98087";
+      name = "knotifications-5.65.0.tar.xz";
     };
   };
   knotifyconfig = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/knotifyconfig-5.64.0.tar.xz";
-      sha256 = "f496ed0728e688347da360f7aad7f2666cb0310ab669c6006ce9661233218b27";
-      name = "knotifyconfig-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/knotifyconfig-5.65.0.tar.xz";
+      sha256 = "a0eb8a27b545d7cc9c61bef6630b9f6d68da76e49c2c8ac8b4ae03d8f89b1e54";
+      name = "knotifyconfig-5.65.0.tar.xz";
     };
   };
   kpackage = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kpackage-5.64.0.tar.xz";
-      sha256 = "c39c80317c75206ec347edf6d301cb66c2117489f37725374fcfe3b1459aaed6";
-      name = "kpackage-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kpackage-5.65.0.tar.xz";
+      sha256 = "5ac5f6a687c244709487bc47d7aeca276ad7a925d7618fdf04a7af0e1e3fa581";
+      name = "kpackage-5.65.0.tar.xz";
     };
   };
   kparts = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kparts-5.64.0.tar.xz";
-      sha256 = "61338a37015c2df787b8e0fe49f0ef320474a82831b4f110fb5aefd1635b1d9f";
-      name = "kparts-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kparts-5.65.0.tar.xz";
+      sha256 = "f0fb059a21c744fd5da8e201e4fe329ed1bccaf586541fecd55ddb48191e725f";
+      name = "kparts-5.65.0.tar.xz";
     };
   };
   kpeople = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kpeople-5.64.0.tar.xz";
-      sha256 = "b5bc8d037dab124ea65be1c480b25943e789a403176f8b31599383dcdec20a0e";
-      name = "kpeople-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kpeople-5.65.0.tar.xz";
+      sha256 = "e12ab7b8b02369a505f2f408b9ffba6742369e9f8b9fa7cafed9b23a49526eac";
+      name = "kpeople-5.65.0.tar.xz";
     };
   };
   kplotting = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kplotting-5.64.0.tar.xz";
-      sha256 = "f38f65c97d199077c88213bce84c6162ba254c443f06ccfaf62088ff0e217f7b";
-      name = "kplotting-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kplotting-5.65.0.tar.xz";
+      sha256 = "967d483cba446a2fb734cd1bcc5340349b62f38f41b3759cc58bf8970ac3b719";
+      name = "kplotting-5.65.0.tar.xz";
     };
   };
   kpty = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kpty-5.64.0.tar.xz";
-      sha256 = "c2ece8c6b336ee85973e005969f1228bbfac87cbace6853e9d01a7b5c5fe319e";
-      name = "kpty-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kpty-5.65.0.tar.xz";
+      sha256 = "b7607cac36ef58aca675a2d90445f1152670c513d6992112ab01ade5400d4554";
+      name = "kpty-5.65.0.tar.xz";
+    };
+  };
+  kquickcharts = {
+    version = "5.65.0";
+    src = fetchurl {
+      url = "${mirror}/stable/frameworks/5.65/kquickcharts-5.65.0.tar.xz";
+      sha256 = "f9ab7697845c872d25e998f2b213d4c32c0b2ccdef99de018dc486d1c4a98388";
+      name = "kquickcharts-5.65.0.tar.xz";
     };
   };
   kross = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/portingAids/kross-5.64.0.tar.xz";
-      sha256 = "d8a7e9fbeba4d16d6288d13d72a5f7581aa8be5894b06f83dbc6068b04551ebd";
-      name = "kross-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/portingAids/kross-5.65.0.tar.xz";
+      sha256 = "c7414c2d6bb959920c2dca01c2b50131a5715629e0229283f8e6dfcfae1a64a5";
+      name = "kross-5.65.0.tar.xz";
     };
   };
   krunner = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/krunner-5.64.0.tar.xz";
-      sha256 = "e056635f347eb4d8b2a1545de993b28ead1af4e8e4acc43f1dd1637b528fe0b2";
-      name = "krunner-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/krunner-5.65.0.tar.xz";
+      sha256 = "0806c1d9ade246348e952e538cc75dc303c27728a887b67dbf27edac6cffffe6";
+      name = "krunner-5.65.0.tar.xz";
     };
   };
   kservice = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kservice-5.64.0.tar.xz";
-      sha256 = "60e0c111485158f89211a62403697714dfe141e3539c1c7e1bf04550db74f02f";
-      name = "kservice-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kservice-5.65.0.tar.xz";
+      sha256 = "663ca1539929e9d1188de3732fc8d1353bc5714b434fdf2fa37c4769e4b26fa3";
+      name = "kservice-5.65.0.tar.xz";
     };
   };
   ktexteditor = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/ktexteditor-5.64.0.tar.xz";
-      sha256 = "0fe12c57a7428d78c46d3367bdae47a0b9fbbd762be4f57f0c52dcd76e309ed5";
-      name = "ktexteditor-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/ktexteditor-5.65.0.tar.xz";
+      sha256 = "830aed1f7d181bf79e57a11373046baf762507a30fe1adc19cb2fc13d9be60c0";
+      name = "ktexteditor-5.65.0.tar.xz";
     };
   };
   ktextwidgets = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/ktextwidgets-5.64.0.tar.xz";
-      sha256 = "0e94c36c7d836450d4c52bd933c492235ea0071b15702c302aed003e8400bbfd";
-      name = "ktextwidgets-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/ktextwidgets-5.65.0.tar.xz";
+      sha256 = "dedad270e03688f937b72e683a249bad464a22df3f97a1cd1bc3be400ec31a11";
+      name = "ktextwidgets-5.65.0.tar.xz";
     };
   };
   kunitconversion = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kunitconversion-5.64.0.tar.xz";
-      sha256 = "6783d6180b132a80dce2a4cc6c793dae0f5859b0709207c5fc6f4501ef53a822";
-      name = "kunitconversion-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kunitconversion-5.65.0.tar.xz";
+      sha256 = "aa751f4b5d9648656120e9e99b0e28560e468daa01156c85865fbfca42de683d";
+      name = "kunitconversion-5.65.0.tar.xz";
     };
   };
   kwallet = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kwallet-5.64.0.tar.xz";
-      sha256 = "16ff5bb5724105c3d59404f292232c03c6003f6229b483509e395e1171ccabde";
-      name = "kwallet-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kwallet-5.65.0.tar.xz";
+      sha256 = "93822bded2273e21be16d8c34c5f33939afeba0dd9d4f2f3ff3ae93029f71eb0";
+      name = "kwallet-5.65.0.tar.xz";
     };
   };
   kwayland = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kwayland-5.64.0.tar.xz";
-      sha256 = "1540d4ff62afd0bff234e08618fc77d2c54b5cd69bf9c478c45a08a6e69349d3";
-      name = "kwayland-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kwayland-5.65.0.tar.xz";
+      sha256 = "75b22e59dd6d3d70ce7a46b8d431050e2f00f6094ae25e969af90ae535037b12";
+      name = "kwayland-5.65.0.tar.xz";
     };
   };
   kwidgetsaddons = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kwidgetsaddons-5.64.0.tar.xz";
-      sha256 = "a2d4a47489621d095c4979ea25d5d8304cf4004b10a892a2b314d74cd30cb5da";
-      name = "kwidgetsaddons-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kwidgetsaddons-5.65.0.tar.xz";
+      sha256 = "f5124ae8beb1da1ec5cca979b862c398635ee84e87283a7f528978df928a971d";
+      name = "kwidgetsaddons-5.65.0.tar.xz";
     };
   };
   kwindowsystem = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kwindowsystem-5.64.0.tar.xz";
-      sha256 = "77c2e6b0032a79547f80bcd36682aa72c0e901e3b5acc83a58f69d644ce03dab";
-      name = "kwindowsystem-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kwindowsystem-5.65.0.tar.xz";
+      sha256 = "9745aebe1d0fdcdede623b9a7cd55b86520e3122278a6c4f82ebb83e0cf514c2";
+      name = "kwindowsystem-5.65.0.tar.xz";
     };
   };
   kxmlgui = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kxmlgui-5.64.0.tar.xz";
-      sha256 = "faa95b92b3b03130022841a6797d5beb3efb6a0d757afaefe038889af76a1dd1";
-      name = "kxmlgui-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kxmlgui-5.65.0.tar.xz";
+      sha256 = "1de343bd51ba57053fd30eefb2237fb022b7cc274be6132fb9064bec64c39e95";
+      name = "kxmlgui-5.65.0.tar.xz";
     };
   };
   kxmlrpcclient = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kxmlrpcclient-5.64.0.tar.xz";
-      sha256 = "8c36472cb69a2d5eeb88c437907f7b0b46703ef34d04df7b45a8c90eb95fd6b0";
-      name = "kxmlrpcclient-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/kxmlrpcclient-5.65.0.tar.xz";
+      sha256 = "2b29df46f16c606488238c7936b8cfc198f06549e01ad4b52cae0cb66fa85282";
+      name = "kxmlrpcclient-5.65.0.tar.xz";
     };
   };
   modemmanager-qt = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/modemmanager-qt-5.64.0.tar.xz";
-      sha256 = "a9d8554b3720cf46aaaa70da87c79688afc5baa155ffd19ea00e4cae2a1caa21";
-      name = "modemmanager-qt-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/modemmanager-qt-5.65.0.tar.xz";
+      sha256 = "21cd64acbe50d402ea5c3636e628acbc8c73ee32021a6e184c449380216380c2";
+      name = "modemmanager-qt-5.65.0.tar.xz";
     };
   };
   networkmanager-qt = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/networkmanager-qt-5.64.0.tar.xz";
-      sha256 = "369d0391e199d059dd2faa554324cbd45334f7864ccfc462699b06c89af04bbf";
-      name = "networkmanager-qt-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/networkmanager-qt-5.65.0.tar.xz";
+      sha256 = "171bac57c2f965b893a70e8bbeab5e1ed80d7d6df97cc52b0a830acdf0c1b82a";
+      name = "networkmanager-qt-5.65.0.tar.xz";
     };
   };
   oxygen-icons5 = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/oxygen-icons5-5.64.0.tar.xz";
-      sha256 = "41d415b4bd9cca0d9abc43b187059d833ce92b3fff3da66eb8ff4004215e91ef";
-      name = "oxygen-icons5-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/oxygen-icons5-5.65.0.tar.xz";
+      sha256 = "a0e6868aa905f2ca784164fc80b2cb85b1dcebf12588bc4a023c46550923d665";
+      name = "oxygen-icons5-5.65.0.tar.xz";
     };
   };
   plasma-framework = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/plasma-framework-5.64.0.tar.xz";
-      sha256 = "3f1311a48826ab0a76f47d05b02f9a9486f821cc1ad757b895b570e371acfd09";
-      name = "plasma-framework-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/plasma-framework-5.65.0.tar.xz";
+      sha256 = "794616029509897bdf1685fc1fd0b6cfb66f4edd3627aa69138f100a4615c826";
+      name = "plasma-framework-5.65.0.tar.xz";
     };
   };
   prison = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/prison-5.64.0.tar.xz";
-      sha256 = "31e136dd33940f32fdb87699b113c57aab566112bb9649f20a057c4eee20db2e";
-      name = "prison-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/prison-5.65.0.tar.xz";
+      sha256 = "8dd4400817b4863597eb87fafce27f6cb11ad8a1f4da7491e4c9e4dcaa2fdff1";
+      name = "prison-5.65.0.tar.xz";
     };
   };
   purpose = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/purpose-5.64.0.tar.xz";
-      sha256 = "004794dfa2d0bcef316d582f37e5691e3980c99240ef570313a98a8d44235b0d";
-      name = "purpose-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/purpose-5.65.0.tar.xz";
+      sha256 = "680700a330cee3a82e9cba02a511cd2963aa20875c99e863b4b93998efc81e24";
+      name = "purpose-5.65.0.tar.xz";
     };
   };
   qqc2-desktop-style = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/qqc2-desktop-style-5.64.0.tar.xz";
-      sha256 = "b0e6ad1ccbd01b6974c3222c6098b6c1ae1fe594c26fe0e2817c35dd90b6013a";
-      name = "qqc2-desktop-style-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/qqc2-desktop-style-5.65.0.tar.xz";
+      sha256 = "a583e4ed8a4513fdd287d432d9a68fa30941803c7a77ce58f2a08b9d77d9628c";
+      name = "qqc2-desktop-style-5.65.0.tar.xz";
     };
   };
   solid = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/solid-5.64.0.tar.xz";
-      sha256 = "fcbbfd124759854bde2da74e1768da818361f61f2839877b4efbcd38b825da6b";
-      name = "solid-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/solid-5.65.0.tar.xz";
+      sha256 = "e94cf8e434b49b8a70318a41219e18b6d2d3b1912a2c3050b69cd66773cc3d00";
+      name = "solid-5.65.0.tar.xz";
     };
   };
   sonnet = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/sonnet-5.64.0.tar.xz";
-      sha256 = "3af364858f76c0206136ae8f3c03da5442ea5e42d2560877f5e00f33850c84dc";
-      name = "sonnet-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/sonnet-5.65.0.tar.xz";
+      sha256 = "1f63ccfa8266e167fd996a253a3d1933a913c12e829056c74fe335fbfb327cbc";
+      name = "sonnet-5.65.0.tar.xz";
     };
   };
   syndication = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/syndication-5.64.0.tar.xz";
-      sha256 = "bffcd673a70646c8cb683ed7b26f6ef251a2ffe439fc78123ccee4332b567b57";
-      name = "syndication-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/syndication-5.65.0.tar.xz";
+      sha256 = "1be1bd32b4c75c6bb1b35d67cc7643089e0c525cb30e392220c1ac88240e7694";
+      name = "syndication-5.65.0.tar.xz";
     };
   };
   syntax-highlighting = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/syntax-highlighting-5.64.0.tar.xz";
-      sha256 = "9655fa79d99fb7d585ae1a11c03d204c83263fe19391e7610575fb0436052b5f";
-      name = "syntax-highlighting-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/syntax-highlighting-5.65.0.tar.xz";
+      sha256 = "5ac5cffeed055adb7f1ef734bab41268dcfbf5e0abdefcf82df2be4479dfc97b";
+      name = "syntax-highlighting-5.65.0.tar.xz";
     };
   };
   threadweaver = {
-    version = "5.64.0";
+    version = "5.65.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/threadweaver-5.64.0.tar.xz";
-      sha256 = "4a3ec0b2b45a5997b24d60059d95006fca5fd86f5d619d8fb1fd30d7510f5a02";
-      name = "threadweaver-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.65/threadweaver-5.65.0.tar.xz";
+      sha256 = "19d74c5feb15903047d8bdf7fd1c94b4b6d0d22f3c860ff99ed1ef00a1f4b8b0";
+      name = "threadweaver-5.65.0.tar.xz";
     };
   };
 }
diff --git a/pkgs/development/libraries/leptonica/default.nix b/pkgs/development/libraries/leptonica/default.nix
index e26f4f6022aa..6d73b00a6d17 100644
--- a/pkgs/development/libraries/leptonica/default.nix
+++ b/pkgs/development/libraries/leptonica/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "leptonica";
-  version = "1.78.0";
+  version = "1.79.0";
 
   src = fetchurl {
     url = "http://www.leptonica.org/source/${pname}-${version}.tar.gz";
-    sha256 = "122s9b8hi93va4lgwnwrbma50x5fp740npy0s92xybd2wy0jxvg2";
+    sha256 = "1n004gv1dj3pq1fcnfdclvvx5nang80336aa67nvs3nnqp4ncn84";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
diff --git a/pkgs/development/libraries/libappindicator/default.nix b/pkgs/development/libraries/libappindicator/default.nix
index e9fccaf28abf..d09684a04438 100644
--- a/pkgs/development/libraries/libappindicator/default.nix
+++ b/pkgs/development/libraries/libappindicator/default.nix
@@ -19,6 +19,8 @@ stdenv.mkDerivation rec {
   versionMajor = "12.10";
   versionMinor = "0";
 
+  outputs = [ "out" "dev" ];
+
   src = fetchurl {
     url = "${meta.homepage}/${versionMajor}/${version}/+download/libappindicator-${version}.tar.gz";
     sha256 = "17xlqd60v0zllrxp8bgq3k5a1jkj0svkqn8rzllcyjh8k0gpr46m";
diff --git a/pkgs/development/libraries/libarchive/default.nix b/pkgs/development/libraries/libarchive/default.nix
index e3927f34fab9..04b4e409b9bd 100644
--- a/pkgs/development/libraries/libarchive/default.nix
+++ b/pkgs/development/libraries/libarchive/default.nix
@@ -10,13 +10,13 @@ assert xarSupport -> libxml2 != null;
 
 stdenv.mkDerivation rec {
   pname = "libarchive";
-  version = "3.4.0";
+  version = "3.4.1";
 
   src = fetchFromGitHub {
     owner = "libarchive";
     repo = "libarchive";
     rev = "v${version}";
-    sha256 = "063f5bw9qmksj3iy6094qxwawx174cx00q1fg6l698wqw7xn8ihq";
+    sha256 = "0g0kzfl01zy1aabr5jcrh8480mb16vh3pacdhg6mm2bdv2f5w8z1";
   };
 
   outputs = [ "out" "lib" "dev" ];
diff --git a/pkgs/development/libraries/libde265/default.nix b/pkgs/development/libraries/libde265/default.nix
index 918f76753891..c9f45280bdad 100644
--- a/pkgs/development/libraries/libde265/default.nix
+++ b/pkgs/development/libraries/libde265/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, autoreconfHook, pkgconfig }:
 
 stdenv.mkDerivation rec {
-  version = "1.0.4";
+  version = "1.0.5";
   pname = "libde265";
 
   src = fetchFromGitHub {
     owner = "strukturag";
     repo = "libde265";
     rev = "v${version}";
-    sha256 = "0svxrhh1pv7xpj75svz0iw1sq5i6z2grj7sc3q11hl63666hzh7d";
+    sha256 = "1qisj8ryzbknam3hk81rq70fsd9mcpxm898bqygvbsmbwyvmz3pg";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
diff --git a/pkgs/development/libraries/libdeflate/default.nix b/pkgs/development/libraries/libdeflate/default.nix
index b06a0a9450ab..cc06815bbffc 100644
--- a/pkgs/development/libraries/libdeflate/default.nix
+++ b/pkgs/development/libraries/libdeflate/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libdeflate";
-  version = "1.3";
+  version = "1.5";
 
   src = fetchFromGitHub {
     owner = "ebiggers";
     repo = "libdeflate";
     rev = "v${version}";
-    sha256 = "019xsz5dnbpxiz29j3zqsxyi4ksjkkygi6a2zyc8fxbm8lvaa9ar";
+    sha256 = "1v0y7998p8a8wpblnpdyk5zzvpj8pbrpzxwxmv0b0axrhaarxrf3";
   };
 
   postPatch = ''
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     description = "Fast DEFLATE/zlib/gzip compressor and decompressor";
     license = licenses.mit;
     homepage = https://github.com/ebiggers/libdeflate;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     maintainers = with maintainers; [ orivej ];
   };
 }
diff --git a/pkgs/development/libraries/libdvdnav/default.nix b/pkgs/development/libraries/libdvdnav/default.nix
index 45a73a624883..8cca9091734f 100644
--- a/pkgs/development/libraries/libdvdnav/default.nix
+++ b/pkgs/development/libraries/libdvdnav/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libdvdnav";
-  version = "6.0.0";
+  version = "6.0.1";
 
   src = fetchurl {
     url = "http://get.videolan.org/libdvdnav/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "062njcksmpgw9yv3737qkf93r2pzhaxi9szqjabpa8d010dp38ph";
+    sha256 = "0cv7j8irsv1n2dadlnhr6i1b8pann2ah6xpxic41f04my6ba6rp5";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/development/libraries/libgnomekbd/default.nix b/pkgs/development/libraries/libgnomekbd/default.nix
index 21523bf2e1a5..f35f3f87fbeb 100644
--- a/pkgs/development/libraries/libgnomekbd/default.nix
+++ b/pkgs/development/libraries/libgnomekbd/default.nix
@@ -4,6 +4,8 @@ stdenv.mkDerivation rec {
   pname = "libgnomekbd";
   version = "3.26.1";
 
+  outputs = [ "out" "dev" ];
+
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "0y962ykn3rr9gylj0pwpww7bi20lmhvsw6qvxs5bisbn2mih5jpp";
diff --git a/pkgs/development/libraries/libinput/default.nix b/pkgs/development/libraries/libinput/default.nix
index 8d48082e1d9c..5cbf7c9145db 100644
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@@ -27,11 +27,11 @@ in
 with stdenv.lib;
 stdenv.mkDerivation rec {
   pname = "libinput";
-  version = "1.14.3";
+  version = "1.15.0";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/libinput/${pname}-${version}.tar.xz";
-    sha256 = "1dy58j8dvr7ri34bx0lppmh5638m956azgwk501w373hi42kmsqg";
+    sha256 = "1qa3b2fd4pv8ysf0mgwnyhqv9v48zgy3sy0q3a3vxcmwcvpizgxz";
   };
 
   outputs = [ "bin" "out" "dev" ];
diff --git a/pkgs/development/libraries/libnotify/default.nix b/pkgs/development/libraries/libnotify/default.nix
index 59039aadb895..f51383833417 100644
--- a/pkgs/development/libraries/libnotify/default.nix
+++ b/pkgs/development/libraries/libnotify/default.nix
@@ -14,6 +14,8 @@ stdenv.mkDerivation rec {
   pname = "libnotify";
   version = "0.7.8";
 
+  outputs = [ "out" "dev" ];
+
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "1371csx0n92g60b5dmai4mmzdnx8081mc3kcgc6a0xipcq5rw839";
diff --git a/pkgs/development/libraries/liboauth/default.nix b/pkgs/development/libraries/liboauth/default.nix
index ea792b007bae..46e3e65ff80b 100644
--- a/pkgs/development/libraries/liboauth/default.nix
+++ b/pkgs/development/libraries/liboauth/default.nix
@@ -9,6 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "07w1aq8y8wld43wmbk2q8134p3bfkp2vma78mmsfgw2jn1bh3xhd";
   };
 
+  outputs = [ "out" "dev" ];
+
   nativeBuildInputs = [ pkgconfig ];
 
   propagatedBuildInputs = [ nss nspr ];
diff --git a/pkgs/development/libraries/libpeas/default.nix b/pkgs/development/libraries/libpeas/default.nix
index cdb1b95935f4..a4632924a93a 100644
--- a/pkgs/development/libraries/libpeas/default.nix
+++ b/pkgs/development/libraries/libpeas/default.nix
@@ -6,6 +6,8 @@ stdenv.mkDerivation rec {
   pname = "libpeas";
   version = "1.24.0";
 
+  outputs = [ "out" "dev" ];
+
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "1yg6r0srz3knhgvplprl3pikrq5c02dmdxgfwcynd6hjih9h16hb";
diff --git a/pkgs/development/libraries/libtins/default.nix b/pkgs/development/libraries/libtins/default.nix
index c90cff31677b..60bb092c6fa4 100644
--- a/pkgs/development/libraries/libtins/default.nix
+++ b/pkgs/development/libraries/libtins/default.nix
@@ -32,8 +32,8 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
   doCheck = true;
   preCheck = ''
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD${placeholder "out"}/lib
-    export DYLD_LIBRARY_PATH=$DYLD_LIBRARY_PATH:$PWD${placeholder "out"}/lib
+    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD${placeholder "out"}/lib
+    export DYLD_LIBRARY_PATH=$DYLD_LIBRARY_PATH''${DYLD_LIBRARY_PATH:+:}$PWD${placeholder "out"}/lib
   '';
   checkTarget = "tests test";
 
diff --git a/pkgs/development/libraries/libvirt/default.nix b/pkgs/development/libraries/libvirt/default.nix
index 0556e311736a..44cdd9edf523 100644
--- a/pkgs/development/libraries/libvirt/default.nix
+++ b/pkgs/development/libraries/libvirt/default.nix
@@ -102,6 +102,7 @@ in stdenv.mkDerivation rec {
   ] ++ optionals stdenv.isLinux [
     "QEMU_BRIDGE_HELPER=/run/wrappers/bin/qemu-bridge-helper"
     "QEMU_PR_HELPER=/run/libvirt/nix-helpers/qemu-pr-helper"
+    "EBTABLES_PATH=${ebtables}/bin/ebtables-legacy"
     "--with-attr"
     "--with-apparmor"
     "--with-secdriver-apparmor"
diff --git a/pkgs/development/libraries/libvpx/CVE-2019-9232.CVE-2019-9325.CVE-2019-9371.CVE-2019-9433.patch b/pkgs/development/libraries/libvpx/CVE-2019-9232.CVE-2019-9325.CVE-2019-9371.CVE-2019-9433.patch
new file mode 100644
index 000000000000..552c4e08d5f9
--- /dev/null
+++ b/pkgs/development/libraries/libvpx/CVE-2019-9232.CVE-2019-9325.CVE-2019-9371.CVE-2019-9433.patch
@@ -0,0 +1,211 @@
+Backports of
+
+From 46e17f0cb4a80b36755c84b8bf15731d3386c08f Mon Sep 17 00:00:00 2001
+From: kyslov <kyslov@google.com>
+Date: Fri, 4 Jan 2019 17:04:09 -0800
+Subject: [PATCH] Fix OOB memory access on fuzzed data
+
+From 0681cff1ad36b3ef8ec242f59b5a6c4234ccfb88 Mon Sep 17 00:00:00 2001
+From: James Zern <jzern@google.com>
+Date: Tue, 24 Jul 2018 21:36:50 -0700
+Subject: [PATCH] vp9: fix OOB read in decoder_peek_si_internal
+
+From f00890eecdf8365ea125ac16769a83aa6b68792d Mon Sep 17 00:00:00 2001
+From: James Zern <jzern@google.com>
+Date: Tue, 11 Dec 2018 18:06:20 -0800
+Subject: [PATCH] update libwebm to libwebm-1.0.0.27-352-g6ab9fcf
+
+From 34d54b04e98dd0bac32e9aab0fbda0bf501bc742 Mon Sep 17 00:00:00 2001
+From: James Zern <jzern@google.com>
+Date: Tue, 9 Apr 2019 18:37:44 -0700
+Subject: [PATCH] update libwebm to libwebm-1.0.0.27-358-gdbf1d10
+
+From 52add5896661d186dec284ed646a4b33b607d2c7 Mon Sep 17 00:00:00 2001
+From: Jerome Jiang <jianj@google.com>
+Date: Wed, 23 May 2018 15:43:00 -0700
+Subject: [PATCH] VP8: Fix use-after-free in postproc.
+
+to address CVE-2019-9232 CVE-2019-9325 CVE-2019-9371 CVE-2019-9433
+
+--- libvpx-1.7.0.orig/test/decode_api_test.cc
++++ libvpx-1.7.0/test/decode_api_test.cc
+@@ -138,8 +138,30 @@ TEST(DecodeAPI, Vp9InvalidDecode) {
+   EXPECT_EQ(VPX_CODEC_OK, vpx_codec_destroy(&dec));
+ }
+ 
+-TEST(DecodeAPI, Vp9PeekSI) {
++void TestPeekInfo(const uint8_t *const data, uint32_t data_sz,
++                  uint32_t peek_size) {
+   const vpx_codec_iface_t *const codec = &vpx_codec_vp9_dx_algo;
++  // Verify behavior of vpx_codec_decode. vpx_codec_decode doesn't even get
++  // to decoder_peek_si_internal on frames of size < 8.
++  if (data_sz >= 8) {
++    vpx_codec_ctx_t dec;
++    EXPECT_EQ(VPX_CODEC_OK, vpx_codec_dec_init(&dec, codec, NULL, 0));
++    EXPECT_EQ((data_sz < peek_size) ? VPX_CODEC_UNSUP_BITSTREAM
++                                    : VPX_CODEC_CORRUPT_FRAME,
++              vpx_codec_decode(&dec, data, data_sz, NULL, 0));
++    vpx_codec_iter_t iter = NULL;
++    EXPECT_EQ(NULL, vpx_codec_get_frame(&dec, &iter));
++    EXPECT_EQ(VPX_CODEC_OK, vpx_codec_destroy(&dec));
++  }
++
++  // Verify behavior of vpx_codec_peek_stream_info.
++  vpx_codec_stream_info_t si;
++  si.sz = sizeof(si);
++  EXPECT_EQ((data_sz < peek_size) ? VPX_CODEC_UNSUP_BITSTREAM : VPX_CODEC_OK,
++            vpx_codec_peek_stream_info(codec, data, data_sz, &si));
++}
++
++TEST(DecodeAPI, Vp9PeekStreamInfo) {
+   // The first 9 bytes are valid and the rest of the bytes are made up. Until
+   // size 10, this should return VPX_CODEC_UNSUP_BITSTREAM and after that it
+   // should return VPX_CODEC_CORRUPT_FRAME.
+@@ -150,24 +172,18 @@ TEST(DecodeAPI, Vp9PeekSI) {
+   };
+ 
+   for (uint32_t data_sz = 1; data_sz <= 32; ++data_sz) {
+-    // Verify behavior of vpx_codec_decode. vpx_codec_decode doesn't even get
+-    // to decoder_peek_si_internal on frames of size < 8.
+-    if (data_sz >= 8) {
+-      vpx_codec_ctx_t dec;
+-      EXPECT_EQ(VPX_CODEC_OK, vpx_codec_dec_init(&dec, codec, NULL, 0));
+-      EXPECT_EQ(
+-          (data_sz < 10) ? VPX_CODEC_UNSUP_BITSTREAM : VPX_CODEC_CORRUPT_FRAME,
+-          vpx_codec_decode(&dec, data, data_sz, NULL, 0));
+-      vpx_codec_iter_t iter = NULL;
+-      EXPECT_EQ(NULL, vpx_codec_get_frame(&dec, &iter));
+-      EXPECT_EQ(VPX_CODEC_OK, vpx_codec_destroy(&dec));
+-    }
+-
+-    // Verify behavior of vpx_codec_peek_stream_info.
+-    vpx_codec_stream_info_t si;
+-    si.sz = sizeof(si);
+-    EXPECT_EQ((data_sz < 10) ? VPX_CODEC_UNSUP_BITSTREAM : VPX_CODEC_OK,
+-              vpx_codec_peek_stream_info(codec, data, data_sz, &si));
++    TestPeekInfo(data, data_sz, 10);
++  }
++}
++
++TEST(DecodeAPI, Vp9PeekStreamInfoTruncated) {
++  // This profile 1 header requires 10.25 bytes, ensure
++  // vpx_codec_peek_stream_info doesn't over read.
++  const uint8_t profile1_data[10] = { 0xa4, 0xe9, 0x30, 0x68, 0x53,
++                                      0xe9, 0x30, 0x68, 0x53, 0x04 };
++
++  for (uint32_t data_sz = 1; data_sz <= 10; ++data_sz) {
++    TestPeekInfo(profile1_data, data_sz, 11);
+   }
+ }
+ #endif  // CONFIG_VP9_DECODER
+--- libvpx-1.7.0.orig/third_party/libwebm/mkvparser/mkvparser.cc
++++ libvpx-1.7.0/third_party/libwebm/mkvparser/mkvparser.cc
+@@ -5307,8 +5307,8 @@ long VideoTrack::Parse(Segment* pSegment
+ 
+   const long long stop = pos + s.size;
+ 
+-  Colour* colour = NULL;
+-  Projection* projection = NULL;
++  std::unique_ptr<Colour> colour_ptr;
++  std::unique_ptr<Projection> projection_ptr;
+ 
+   while (pos < stop) {
+     long long id, size;
+@@ -5357,11 +5357,19 @@ long VideoTrack::Parse(Segment* pSegment
+       if (rate <= 0)
+         return E_FILE_FORMAT_INVALID;
+     } else if (id == libwebm::kMkvColour) {
+-      if (!Colour::Parse(pReader, pos, size, &colour))
++      Colour* colour = NULL;
++      if (!Colour::Parse(pReader, pos, size, &colour)) {
+         return E_FILE_FORMAT_INVALID;
++      } else {
++        colour_ptr.reset(colour);
++      }
+     } else if (id == libwebm::kMkvProjection) {
+-      if (!Projection::Parse(pReader, pos, size, &projection))
++      Projection* projection = NULL;
++      if (!Projection::Parse(pReader, pos, size, &projection)) {
+         return E_FILE_FORMAT_INVALID;
++      } else {
++        projection_ptr.reset(projection);
++      }
+     }
+ 
+     pos += size;  // consume payload
+@@ -5392,8 +5400,8 @@ long VideoTrack::Parse(Segment* pSegment
+   pTrack->m_display_unit = display_unit;
+   pTrack->m_stereo_mode = stereo_mode;
+   pTrack->m_rate = rate;
+-  pTrack->m_colour = colour;
+-  pTrack->m_projection = projection;
++  pTrack->m_colour = colour_ptr.release();
++  pTrack->m_projection = projection_ptr.release();
+ 
+   pResult = pTrack;
+   return 0;  // success
+--- libvpx-1.7.0.orig/vp8/common/postproc.c
++++ libvpx-1.7.0/vp8/common/postproc.c
+@@ -65,7 +65,7 @@ void vp8_deblock(VP8_COMMON *cm, YV12_BU
+   double level = 6.0e-05 * q * q * q - .0067 * q * q + .306 * q + .0065;
+   int ppl = (int)(level + .5);
+ 
+-  const MODE_INFO *mode_info_context = cm->show_frame_mi;
++  const MODE_INFO *mode_info_context = cm->mi;
+   int mbr, mbc;
+ 
+   /* The pixel thresholds are adjusted according to if or not the macroblock
+--- libvpx-1.7.0.orig/vp8/decoder/dboolhuff.h
++++ libvpx-1.7.0/vp8/decoder/dboolhuff.h
+@@ -76,7 +76,7 @@ static int vp8dx_decode_bool(BOOL_DECODE
+   }
+ 
+   {
+-    register int shift = vp8_norm[range];
++    const unsigned char shift = vp8_norm[(unsigned char)range];
+     range <<= shift;
+     value <<= shift;
+     count -= shift;
+--- libvpx-1.7.0.orig/vp9/vp9_dx_iface.c
++++ libvpx-1.7.0/vp9/vp9_dx_iface.c
+@@ -97,7 +97,7 @@ static vpx_codec_err_t decoder_peek_si_i
+     const uint8_t *data, unsigned int data_sz, vpx_codec_stream_info_t *si,
+     int *is_intra_only, vpx_decrypt_cb decrypt_cb, void *decrypt_state) {
+   int intra_only_flag = 0;
+-  uint8_t clear_buffer[10];
++  uint8_t clear_buffer[11];
+ 
+   if (data + data_sz <= data) return VPX_CODEC_INVALID_PARAM;
+ 
+@@ -158,6 +158,9 @@ static vpx_codec_err_t decoder_peek_si_i
+         if (profile > PROFILE_0) {
+           if (!parse_bitdepth_colorspace_sampling(profile, &rb))
+             return VPX_CODEC_UNSUP_BITSTREAM;
++          // The colorspace info may cause vp9_read_frame_size() to need 11
++          // bytes.
++          if (data_sz < 11) return VPX_CODEC_UNSUP_BITSTREAM;
+         }
+         rb.bit_offset += REF_FRAMES;  // refresh_frame_flags
+         vp9_read_frame_size(&rb, (int *)&si->w, (int *)&si->h);
+--- libvpx-1.7.0.orig/vpx_dsp/bitreader.h
++++ libvpx-1.7.0/vpx_dsp/bitreader.h
+@@ -94,7 +94,7 @@ static INLINE int vpx_read(vpx_reader *r
+   }
+ 
+   {
+-    register int shift = vpx_norm[range];
++    const unsigned char shift = vpx_norm[(unsigned char)range];
+     range <<= shift;
+     value <<= shift;
+     count -= shift;
+--- libvpx-1.7.0.orig/vpx_dsp/bitreader_buffer.c
++++ libvpx-1.7.0/vpx_dsp/bitreader_buffer.c
+@@ -23,7 +23,7 @@ int vpx_rb_read_bit(struct vpx_read_bit_
+     rb->bit_offset = off + 1;
+     return bit;
+   } else {
+-    rb->error_handler(rb->error_handler_data);
++    if (rb->error_handler != NULL) rb->error_handler(rb->error_handler_data);
+     return 0;
+   }
+ }
diff --git a/pkgs/development/libraries/libvpx/default.nix b/pkgs/development/libraries/libvpx/default.nix
index d80fe6a998c9..ddde03e28768 100644
--- a/pkgs/development/libraries/libvpx/default.nix
+++ b/pkgs/development/libraries/libvpx/default.nix
@@ -65,7 +65,11 @@ stdenv.mkDerivation rec {
     sha256 = "0vvh89hvp8qg9an9vcmwb7d9k3nixhxaz6zi65qdjnd0i56kkcz6";
   };
 
-  patchPhase = ''patchShebangs .'';
+  patches = [
+    ./CVE-2019-9232.CVE-2019-9325.CVE-2019-9371.CVE-2019-9433.patch
+  ];
+
+  postPatch = ''patchShebangs .'';
 
   outputs = [ "bin" "dev" "out" ];
   setOutputFlags = false;
diff --git a/pkgs/development/libraries/libvterm-neovim/default.nix b/pkgs/development/libraries/libvterm-neovim/default.nix
index 50ee7e4d3873..0cd1b64c1b9e 100644
--- a/pkgs/development/libraries/libvterm-neovim/default.nix
+++ b/pkgs/development/libraries/libvterm-neovim/default.nix
@@ -6,13 +6,14 @@
 
 stdenv.mkDerivation {
   pname = "libvterm-neovim";
-  version = "2019-10-08";
+  # Releases are not tagged, look at commit history to find latest release
+  version = "0.1.3";
 
   src = fetchFromGitHub {
     owner = "neovim";
     repo = "libvterm";
-    rev = "7c72294d84ce20da4c27362dbd7fa4b08cfc91da";
-    sha256 = "111qyxq33x74dwdnqcnzlv9j0n8hxyribd6ppwcsxmyrniyw9qrk";
+    rev = "65dbda3ed214f036ee799d18b2e693a833a0e591";
+    sha256 = "0r6yimzbkgrsi9aaxwvxahai2lzgjd1ysblr6m6by5w459853q3n";
   };
 
   buildInputs = [ perl ];
diff --git a/pkgs/development/libraries/onnxruntime/default.nix b/pkgs/development/libraries/onnxruntime/default.nix
index 33bc4c6e82c2..90da6c192120 100644
--- a/pkgs/development/libraries/onnxruntime/default.nix
+++ b/pkgs/development/libraries/onnxruntime/default.nix
@@ -1,16 +1,16 @@
 { stdenv, fetchFromGitHub, glibcLocales
-, cmake, python3
+, cmake, python3, libpng, zlib
 }:
 
 stdenv.mkDerivation rec {
   pname = "onnxruntime";
-  version = "1.0.0";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "onnxruntime";
     rev = "v${version}";
-    sha256 = "1d28lzrjnq69yl8j9ncxlsxl0bniacn3hnsr9van10zgp527436v";
+    sha256 = "1ryf5v2h07c7b42q2p9id88i270ajyz5rlsradp00dy8in6dn2yr";
     # TODO: use nix-versions of grpc, onnx, eigen, googletest, etc.
     # submodules increase src size and compile times significantly
     # not currently feasible due to how integrated cmake build is with git
@@ -25,12 +25,19 @@ stdenv.mkDerivation rec {
     python3 # for shared-lib or server
   ];
 
+  buildInputs = [
+    # technically optional, but highly recommended
+    libpng
+    zlib
+  ];
+
   cmakeDir = "../cmake";
 
   cmakeFlags = [
     "-Donnxruntime_USE_OPENMP=ON"
     "-Donnxruntime_BUILD_SHARED_LIB=ON"
-    "-Donnxruntime_ENABLE_LTO=ON"
+    # flip back to ON next release
+    "-Donnxruntime_ENABLE_LTO=OFF" # https://github.com/microsoft/onnxruntime/issues/2828
   ];
 
   # ContribOpTest.StringNormalizerTest sets locale to en_US.UTF-8"
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 118aa984c174..3016f025e9dc 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -36,7 +36,7 @@ let
 
     outputs = [ "bin" "dev" "out" "man" ] ++ optional withDocs "doc";
     setOutputFlags = false;
-    separateDebugInfo = stdenv.hostPlatform.isLinux;
+    separateDebugInfo = stdenv.cc.isGNU;
 
     nativeBuildInputs = [ perl ];
     buildInputs = stdenv.lib.optional withCryptodev cryptodev;
diff --git a/pkgs/development/libraries/orcania/default.nix b/pkgs/development/libraries/orcania/default.nix
index bc27011c5887..2f8765f9a725 100644
--- a/pkgs/development/libraries/orcania/default.nix
+++ b/pkgs/development/libraries/orcania/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   doCheck = true;
 
   preCheck = ''
-    export LD_LIBRARY_PATH="$(pwd):$LD_LIBRARY_PATH"
+    export LD_LIBRARY_PATH="$(pwd)''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
     export DYLD_FALLBACK_LIBRARY_PATH="$(pwd):$DYLD_FALLBACK_LIBRARY_PATH"
   '';
 
diff --git a/pkgs/development/libraries/physics/rivet/default.nix b/pkgs/development/libraries/physics/rivet/default.nix
index 95e44f2364cb..7f7260d52c0c 100644
--- a/pkgs/development/libraries/physics/rivet/default.nix
+++ b/pkgs/development/libraries/physics/rivet/default.nix
@@ -12,8 +12,8 @@ stdenv.mkDerivation rec {
   patches = [
     ./darwin.patch # configure relies on impure sw_vers to -Dunix
     (fetchpatch {
-      url = "https://phab-files.hepforge.org/file/data/j3ja4jirrdyrovrmnbuh/PHID-FILE-6vnor4aoz3s2ejruisrg/file";
-      sha256 = "0flxv08wcd0m5di75s2zvm015k2k70nqgpcgcbq7m604z26pd6ab";
+      url = "https://gitlab.com/hepcedar/rivet/commit/37bd34f52cce66946ebb311a8fe61bfc5f69cc00.diff";
+      sha256 = "0wj3ilpfq2gpc33bj3800l9vyvc9lrrlj1x9ss5qki0yiqd8i2aa";
     })
   ];
 
diff --git a/pkgs/development/libraries/poppler/default.nix b/pkgs/development/libraries/poppler/default.nix
index eb1e9ec732ff..f3e33d7616fb 100644
--- a/pkgs/development/libraries/poppler/default.nix
+++ b/pkgs/development/libraries/poppler/default.nix
@@ -12,11 +12,11 @@ let
 in
 stdenv.mkDerivation rec {
   name = "poppler-${suffix}-${version}";
-  version = "0.83.0"; # beware: updates often break cups-filters build
+  version = "0.84.0"; # beware: updates often break cups-filters build
 
   src = fetchurl {
     url = "${meta.homepage}/poppler-${version}.tar.xz";
-    sha256 = "16vr1g5qsqwyxfnyikqw37i04x9zpp45far2x90c7qbijw6nap38";
+    sha256 = "0ccp2gx05cz5y04k5pgbyi4ikyq60nafa7x2yx4aaf1vfkd318f7";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/qt-4.x/4.8/default.nix b/pkgs/development/libraries/qt-4.x/4.8/default.nix
index 25953949eb76..379f5b3d80e0 100644
--- a/pkgs/development/libraries/qt-4.x/4.8/default.nix
+++ b/pkgs/development/libraries/qt-4.x/4.8/default.nix
@@ -125,7 +125,7 @@ stdenv.mkDerivation rec {
       ];
 
   preConfigure = ''
-    export LD_LIBRARY_PATH="`pwd`/lib:$LD_LIBRARY_PATH"
+    export LD_LIBRARY_PATH="`pwd`/lib''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
     configureFlags+="
       -docdir $out/share/doc/${name}
       -plugindir $out/lib/qt4/plugins
diff --git a/pkgs/development/libraries/qt-5/modules/qtbase.nix b/pkgs/development/libraries/qt-5/modules/qtbase.nix
index bc23d0f9cafe..930c59d347b1 100644
--- a/pkgs/development/libraries/qt-5/modules/qtbase.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtbase.nix
@@ -164,7 +164,7 @@ stdenv.mkDerivation {
 
   setOutputFlags = false;
   preConfigure = ''
-    export LD_LIBRARY_PATH="$PWD/lib:$PWD/plugins/platforms:$LD_LIBRARY_PATH"
+    export LD_LIBRARY_PATH="$PWD/lib:$PWD/plugins/platforms''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
     ${lib.optionalString (compareVersion "5.9.0" < 0) ''
     # We need to set LD to CXX or otherwise we get nasty compile errors
     export LD=$CXX
diff --git a/pkgs/development/libraries/science/biology/htslib/default.nix b/pkgs/development/libraries/science/biology/htslib/default.nix
index 7d771414fb01..cdd56731fa0e 100644
--- a/pkgs/development/libraries/science/biology/htslib/default.nix
+++ b/pkgs/development/libraries/science/biology/htslib/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "htslib";
-  version = "1.9";
+  version = "1.10.2";
 
   src = fetchurl {
     url = "https://github.com/samtools/htslib/releases/download/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "16ljv43sc3fxmv63w7b2ff8m1s7h89xhazwmbm1bicz8axq8fjz0";
+    sha256 = "0f8rglbvf4aaw41i2sxlpq7pvhly93sjqiz0l4q3hwki5zg47dg3";
   };
 
   # perl is only used during the check phase.
diff --git a/pkgs/development/libraries/science/math/arpack/default.nix b/pkgs/development/libraries/science/math/arpack/default.nix
index 36576de05631..89f3aa94247b 100644
--- a/pkgs/development/libraries/science/math/arpack/default.nix
+++ b/pkgs/development/libraries/science/math/arpack/default.nix
@@ -30,9 +30,9 @@ stdenv.mkDerivation {
   ];
 
   preCheck = if stdenv.isDarwin then ''
-    export DYLD_LIBRARY_PATH=$DYLD_LIBRARY_PATH:`pwd`/lib
+    export DYLD_LIBRARY_PATH=$DYLD_LIBRARY_PATH''${DYLD_LIBRARY_PATH:+:}`pwd`/lib
   '' else ''
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:`pwd`/lib
+    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}`pwd`/lib
   '' + ''
     # Prevent tests from using all cores
     export OMP_NUM_THREADS=2
diff --git a/pkgs/development/libraries/science/math/scalapack/default.nix b/pkgs/development/libraries/science/math/scalapack/default.nix
index bff0d9a85fa2..fda902f320c9 100644
--- a/pkgs/development/libraries/science/math/scalapack/default.nix
+++ b/pkgs/development/libraries/science/math/scalapack/default.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
     # Run single threaded
     export OMP_NUM_THREADS=1
 
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:`pwd`/lib
+    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}`pwd`/lib
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/x264/default.nix b/pkgs/development/libraries/x264/default.nix
index 9998add0d930..2757ca7704c4 100644
--- a/pkgs/development/libraries/x264/default.nix
+++ b/pkgs/development/libraries/x264/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, nasm }:
+{ stdenv, lib, fetchurl, nasm }:
 
 stdenv.mkDerivation rec {
   pname = "x264";
@@ -9,6 +9,10 @@ stdenv.mkDerivation rec {
     sha256 = "1xv41z04km3rf374xk3ny7v8ibr211ph0j5am0909ln63mphc48f";
   };
 
+  # Upstream ./configure greps for (-mcpu|-march|-mfpu) in CFLAGS, which in nix
+  # is put in the cc wrapper anyway.
+  patches = [ ./disable-arm-neon-default.patch ];
+
   postPatch = ''
     patchShebangs .
   '';
@@ -17,15 +21,16 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "lib" "dev" ];
 
-  preConfigure = ''
+  preConfigure = lib.optionalString (stdenv.buildPlatform.isx86_64 || stdenv.hostPlatform.isi686) ''
     # `AS' is set to the binutils assembler, but we need nasm
     unset AS
   '';
 
   configureFlags = [ "--enable-shared" ]
-    ++ stdenv.lib.optional (!stdenv.isi686) "--enable-pic";
+    ++ stdenv.lib.optional (!stdenv.isi686) "--enable-pic"
+    ++ stdenv.lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) "--cross-prefix=${stdenv.cc.targetPrefix}";
 
-  nativeBuildInputs = [ nasm ];
+  nativeBuildInputs = lib.optional (stdenv.hostPlatform.isx86_64 || stdenv.hostPlatform.isi686) nasm;
 
   meta = with stdenv.lib; {
     description = "Library for encoding H264/AVC video streams";
diff --git a/pkgs/development/libraries/x264/disable-arm-neon-default.patch b/pkgs/development/libraries/x264/disable-arm-neon-default.patch
new file mode 100644
index 000000000000..6971944abb4f
--- /dev/null
+++ b/pkgs/development/libraries/x264/disable-arm-neon-default.patch
@@ -0,0 +1,13 @@
+diff -Naur x264-snapshot-20190517-2245-stable-orig/configure x264-snapshot-20190517-2245-stable/configure
+--- x264-snapshot-20190517-2245-stable-orig/configure	2020-01-03 19:51:03.041037657 -0500
++++ x264-snapshot-20190517-2245-stable/configure	2020-01-03 19:52:15.075034609 -0500
+@@ -930,9 +930,6 @@
+ fi
+ 
+ if [ $asm = auto -a $ARCH = ARM ] ; then
+-    # set flags so neon is built by default
+-    [ $compiler == CL ] || echo $CFLAGS | grep -Eq '(-mcpu|-march|-mfpu)' || CFLAGS="$CFLAGS -mcpu=cortex-a8 -mfpu=neon"
+-
+     cc_check '' '' '__asm__("add r0, r1, r2");' && define HAVE_ARM_INLINE_ASM
+     if [ $compiler = CL ] && cpp_check '' '' 'defined(_M_ARM) && _M_ARM >= 7' ; then
+         define HAVE_ARMV6
diff --git a/pkgs/development/libraries/yder/default.nix b/pkgs/development/libraries/yder/default.nix
index 7025fd2eb1cc..5ddb1d1a1313 100644
--- a/pkgs/development/libraries/yder/default.nix
+++ b/pkgs/development/libraries/yder/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   doCheck = true;
 
   preCheck = ''
-    export LD_LIBRARY_PATH="$(pwd):$LD_LIBRARY_PATH"
+    export LD_LIBRARY_PATH="$(pwd)''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
     export DYLD_FALLBACK_LIBRARY_PATH="$(pwd):$DYLD_FALLBACK_LIBRARY_PATH"
   '';
 
diff --git a/pkgs/development/ocaml-modules/lens/default.nix b/pkgs/development/ocaml-modules/lens/default.nix
new file mode 100644
index 000000000000..27a753ae81a5
--- /dev/null
+++ b/pkgs/development/ocaml-modules/lens/default.nix
@@ -0,0 +1,23 @@
+{ lib, fetchzip, ppx_deriving, ppxfind, buildDunePackage }:
+
+buildDunePackage rec {
+  pname = "lens";
+  version = "1.2.3";
+
+  src = fetchzip {
+    url = "https://github.com/pdonadeo/ocaml-lens/archive/v${version}.tar.gz";
+    sha256 = "09k2vhzysx91syjhgv6w1shc9mgzi0l4bhwpx1g5pi4r4ghjp07y";
+  };
+
+  minimumOCamlVersion = "4.04.1";
+  buildInputs = [ ppx_deriving ppxfind ];
+
+  meta = with lib; {
+    homepage = https://github.com/pdonadeo/ocaml-lens;
+    description = "Functional lenses";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [
+      kazcw
+    ];
+  };
+}
diff --git a/pkgs/development/ocaml-modules/sqlite3/default.nix b/pkgs/development/ocaml-modules/sqlite3/default.nix
index 53b11f285a67..f47d7d37631f 100644
--- a/pkgs/development/ocaml-modules/sqlite3/default.nix
+++ b/pkgs/development/ocaml-modules/sqlite3/default.nix
@@ -1,24 +1,22 @@
-{ stdenv, fetchurl, sqlite, ocaml, findlib, ocamlbuild, pkgconfig }:
+{ lib, fetchurl, sqlite, pkgconfig, buildDunePackage }:
 
-stdenv.mkDerivation rec {
-  pname = "ocaml-sqlite3";
-  version = "2.0.9";
+buildDunePackage rec {
+  pname = "sqlite3";
+  version = "5.0.1";
+  minimumOCamlVersion = "4.05";
 
   src = fetchurl {
-    url = "https://github.com/mmottl/sqlite3-ocaml/releases/download/v${version}/sqlite3-ocaml-${version}.tar.gz";
-    sha256 = "0rwsx1nfa3xqmbygim2qx45jqm1gwf08m70wmcwkx50f1qk3l551";
+    url = "https://github.com/mmottl/sqlite3-ocaml/releases/download/${version}/sqlite3-${version}.tbz";
+    sha256 = "0iymkszrs6qwak0vadfzc8yd8jfwn06zl08ggb4jr2mgk2c8mmsn";
   };
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ ocaml findlib ocamlbuild sqlite ];
+  buildInputs = [ sqlite ];
 
-  createFindlibDestdir = true;
-
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://mmottl.github.io/sqlite3-ocaml/;
     description = "OCaml bindings to the SQLite 3 database access library";
     license = licenses.mit;
-    platforms = ocaml.meta.platforms or [];
     maintainers = with maintainers; [
       maggesi vbgl
     ];
diff --git a/pkgs/development/ocaml-modules/uchar/default.nix b/pkgs/development/ocaml-modules/uchar/default.nix
index 2140871021da..b5b2170e56ab 100644
--- a/pkgs/development/ocaml-modules/uchar/default.nix
+++ b/pkgs/development/ocaml-modules/uchar/default.nix
@@ -8,10 +8,10 @@ stdenv.mkDerivation {
     sha256 = "1w2saw7zanf9m9ffvz2lvcxvlm118pws2x1wym526xmydhqpyfa7";
   };
 
-  nativeBuildInputs = [ ocaml ocamlbuild findlib opaline ];
-  buildInputs = [ findlib ocaml ocamlbuild opaline ];
+  nativeBuildInputs = [ ocaml ocamlbuild findlib ];
+  buildInputs = [ findlib ocaml ocamlbuild ];
   buildPhase = "ocaml pkg/build.ml native=true native-dynlink=${if withShared then "true" else "false"}";
-  installPhase = "opaline -libdir $OCAMLFIND_DESTDIR";
+  installPhase = "${opaline}/bin/opaline -libdir $OCAMLFIND_DESTDIR";
   configurePlatforms = [];
 
   meta = {
diff --git a/pkgs/development/pharo/vm/build-vm.nix b/pkgs/development/pharo/vm/build-vm.nix
index 5fc747cbc8c2..38516cc19145 100644
--- a/pkgs/development/pharo/vm/build-vm.nix
+++ b/pkgs/development/pharo/vm/build-vm.nix
@@ -117,7 +117,7 @@ stdenv.mkDerivation rec {
     cat > "$out/bin/${cmd}" <<EOF
     #!${runtimeShell}
     set -f
-    LD_LIBRARY_PATH="\$LD_LIBRARY_PATH:$libs" exec $out/pharo "\$@"
+    LD_LIBRARY_PATH="\$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$libs" exec $out/pharo "\$@"
     EOF
     chmod +x "$out/bin/${cmd}"
     ln -s ${libgit2}/lib/libgit2.so* "$out/"
diff --git a/pkgs/development/python-modules/avro-python3/default.nix b/pkgs/development/python-modules/avro-python3/default.nix
new file mode 100644
index 000000000000..c9db39a325fa
--- /dev/null
+++ b/pkgs/development/python-modules/avro-python3/default.nix
@@ -0,0 +1,22 @@
+{ lib, stdenv, buildPythonPackage, fetchPypi, isPy3k }:
+
+buildPythonPackage rec {
+  pname = "avro-python3";
+  version = "1.8.2";
+  disabled = !isPy3k;
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "f82cf0d66189600b1e6b442f650ad5aca6c189576723dcbf6f9ce096eab81bd6";
+  };
+
+  doCheck = false;        # No such file or directory: './run_tests.py
+
+  meta = with lib; {
+    description = "A serialization and RPC framework";
+    homepage = https://pypi.python.org/pypi/avro-python3/;
+    license = licenses.asl20;
+
+    maintainers = [ maintainers.shlevy maintainers.timma ];
+  };
+}
diff --git a/pkgs/development/python-modules/botocore/default.nix b/pkgs/development/python-modules/botocore/default.nix
index 50504257c64e..a03e3d9f5f41 100644
--- a/pkgs/development/python-modules/botocore/default.nix
+++ b/pkgs/development/python-modules/botocore/default.nix
@@ -19,8 +19,6 @@ buildPythonPackage rec {
     sha256 = "8223485841ef4731a5d4943a733295ba69d0005c4ae64c468308cc07f6960d39";
   };
 
-  outputs = [ "out" "dev" ];
-
   propagatedBuildInputs = [
     dateutil
     jmespath
diff --git a/pkgs/development/python-modules/django-extensions/default.nix b/pkgs/development/python-modules/django-extensions/default.nix
index 7f755010b730..d62542536768 100644
--- a/pkgs/development/python-modules/django-extensions/default.nix
+++ b/pkgs/development/python-modules/django-extensions/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchFromGitHub, pythonOlder
+{ lib, buildPythonPackage, fetchFromGitHub, fetchpatch, pythonOlder
 , six, typing, pygments
 , django, shortuuid, python-dateutil, pytest
 , pytest-django, pytestcov, mock, vobject
@@ -16,6 +16,15 @@ buildPythonPackage rec {
     sha256 = "0053yqq4vq3mwy7zkfs5vfm3g8j9sfy3vrc6xby83qlj9wz43ipi";
   };
 
+  # This patch fixes a single failing test and can be removed when updating this pkg
+  # to the next version
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/django-extensions/django-extensions/commit/1d21786da2e6868d98ae34c82079e1e03ad1aa97.patch";
+      sha256 = "0d81zpj0f8a7ijrfb12j0b67fgj89k3axaskz1nwqsr4wc6n4bw2";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace setup.py --replace "'tox'," ""
 
diff --git a/pkgs/development/python-modules/gpxpy/default.nix b/pkgs/development/python-modules/gpxpy/default.nix
new file mode 100644
index 000000000000..028ca3654236
--- /dev/null
+++ b/pkgs/development/python-modules/gpxpy/default.nix
@@ -0,0 +1,27 @@
+{ lib, fetchFromGitHub, buildPythonPackage, python, lxml }:
+
+buildPythonPackage rec {
+  pname = "gpxpy";
+  version = "1.3.5";
+
+  src = fetchFromGitHub {
+    owner = "tkrajina";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "18r7pfda7g3l0hv8j9565n52cvvgjxiiqqzagfdfaba1djgl6p8b";
+  };
+
+  propagatedBuildInputs = [ lxml ];
+
+  checkPhase = ''
+    ${python.interpreter} -m unittest test
+  '';
+
+  meta = with lib; {
+    description = "Python GPX (GPS eXchange format) parser";
+    homepage = "https://github.com/tkrajina/gpxpy";
+    license = licenses.asl20;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ sikmir ];
+  };
+}
diff --git a/pkgs/development/python-modules/onnx/default.nix b/pkgs/development/python-modules/onnx/default.nix
new file mode 100644
index 000000000000..3f3cf38f3332
--- /dev/null
+++ b/pkgs/development/python-modules/onnx/default.nix
@@ -0,0 +1,78 @@
+{ lib
+, fetchpatch
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, isPy27
+, cmake
+, protobuf
+, numpy
+, six
+, typing-extensions
+, typing
+, pytestrunner
+, pytest
+, nbval
+, tabulate
+}:
+
+buildPythonPackage rec {
+  pname = "onnx";
+  version = "1.6.0";
+
+  # Due to Protobuf packaging issues this build of Onnx with Python 2 gives
+  # errors on import
+  disabled = isPy27;
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0ig33jl3591041lyylxp52yi20rfrcqx3i030hd6al8iabzc721v";
+  };
+
+  # Remove the unqualified requirement for the typing package for running the
+  # tests. typing is already required for the installation, where it is
+  # correctly qualified so as to only be required for sufficiently old Python
+  # versions.
+  # This patch should be in the next release (>1.6).
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/onnx/onnx/commit/c963586d0f8dd5740777b2fd06f04ec60816de9f.patch";
+      sha256 = "1hl26cw5zckc91gmh0bdah87jyprccxiw0f4i5h1gwkq28hm6wbj";
+    })
+  ];
+
+  nativeBuildInputs = [ cmake ];
+
+  propagatedBuildInputs = [
+    protobuf
+    numpy
+    six
+    typing-extensions
+  ] ++ lib.optional (pythonOlder "3.5") [ typing ];
+
+  checkInputs = [
+    pytestrunner
+    pytest
+    nbval
+    tabulate
+  ];
+
+  postPatch = ''
+    patchShebangs tools/protoc-gen-mypy.py
+  '';
+
+  # The executables are just utility scripts that aren't too important
+  postInstall = ''
+    rm -r $out/bin
+  '';
+
+  # The setup.py does all the configuration (running CMake)
+  dontConfigure = true;
+
+  meta = {
+    homepage    = http://onnx.ai;
+    description = "Open Neural Network Exchange";
+    license     = lib.licenses.mit;
+    maintainers = [ lib.maintainers.acairncross ];
+  };
+}
diff --git a/pkgs/development/python-modules/publicsuffix/default.nix b/pkgs/development/python-modules/publicsuffix/default.nix
index 027b017c23ec..061ad6858614 100644
--- a/pkgs/development/python-modules/publicsuffix/default.nix
+++ b/pkgs/development/python-modules/publicsuffix/default.nix
@@ -10,11 +10,8 @@ buildPythonPackage rec {
   };
 
 
-  # fix the ASCII-mode LICENSE file read
   # disable test_fetch and the doctests (which also invoke fetch)
-  patchPhase = stdenv.lib.optionalString isPy3k ''
-    sed -i "s/)\.read(/,encoding='utf-8'\0/" setup.py
-  '' + ''
+  postPatch = ''
     sed -i -e "/def test_fetch/i\\
     \\t@unittest.skip('requires internet')" -e "/def additional_tests():/,+1d" tests.py
   '';
diff --git a/pkgs/development/python-modules/pylint-celery/default.nix b/pkgs/development/python-modules/pylint-celery/default.nix
new file mode 100644
index 000000000000..6bc7a93049e9
--- /dev/null
+++ b/pkgs/development/python-modules/pylint-celery/default.nix
@@ -0,0 +1,37 @@
+{ buildPythonPackage
+, fetchFromGitHub
+, isPy3k
+, lib
+
+# pythonPackages
+, pylint-plugin-utils
+}:
+
+buildPythonPackage rec {
+  pname = "pylint-celery";
+  version = "0.3";
+  disabled = !isPy3k;
+
+  src = fetchFromGitHub {
+    owner = "PyCQA";
+    repo = pname;
+    rev = version;
+    sha256 = "05fhwraq12c2724pn4py1bjzy5rmsrb1x68zck73nlp5icba6yap";
+  };
+
+  propagatedBuildInputs = [
+    pylint-plugin-utils
+  ];
+
+  # Testing requires a very old version of pylint, incompatible with other dependencies
+  doCheck = false;
+
+  meta = with lib; {
+    description = "A Pylint plugin to analyze Celery applications";
+    homepage = "https://github.com/PyCQA/pylint-celery";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [
+      kamadorueda
+    ];
+  };
+}
diff --git a/pkgs/development/python-modules/pylint-django/default.nix b/pkgs/development/python-modules/pylint-django/default.nix
new file mode 100644
index 000000000000..04010098807c
--- /dev/null
+++ b/pkgs/development/python-modules/pylint-django/default.nix
@@ -0,0 +1,39 @@
+{ buildPythonPackage
+, fetchFromGitHub
+, isPy3k
+, lib
+
+# pythonPackages
+, django
+, pylint-plugin-utils
+}:
+
+buildPythonPackage rec {
+  pname = "pylint-django";
+  version = "2.0.12";
+  disabled = !isPy3k;
+
+  src = fetchFromGitHub {
+    owner = "PyCQA";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0ha06wpqqn5fp5dapgjhsdx3ahh3y62l7k2f3czlrdjmmivgdp9y";
+  };
+
+  propagatedBuildInputs = [
+    django
+    pylint-plugin-utils
+  ];
+
+  # Testing requires checkout from other repositories
+  doCheck = false;
+
+  meta = with lib; {
+    description = "A Pylint plugin to analyze Django applications";
+    homepage = "https://github.com/PyCQA/pylint-django";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [
+      kamadorueda
+    ];
+  };
+}
diff --git a/pkgs/development/python-modules/pylint-flask/default.nix b/pkgs/development/python-modules/pylint-flask/default.nix
new file mode 100644
index 000000000000..5077d07a936b
--- /dev/null
+++ b/pkgs/development/python-modules/pylint-flask/default.nix
@@ -0,0 +1,36 @@
+{ buildPythonPackage
+, fetchPypi
+, isPy3k
+, lib
+
+# pythonPackages
+, pylint-plugin-utils
+}:
+
+buildPythonPackage rec {
+  pname = "pylint-flask";
+  version = "0.6";
+  disabled = !isPy3k;
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "05qmwgkpvaa5k05abqjxfbrfk3wpdqb8ph690z7bzxvb47i7vngl";
+  };
+
+  propagatedBuildInputs = [
+    pylint-plugin-utils
+  ];
+
+  # Tests require a very old version of pylint
+  #   also tests are only available at GitHub, with an old release tag
+  doCheck = false;
+
+  meta = with lib; {
+    description = "A Pylint plugin to analyze Flask applications";
+    homepage = "https://github.com/jschaf/pylint-flask";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [
+      kamadorueda
+    ];
+  };
+}
diff --git a/pkgs/development/python-modules/pynrrd/default.nix b/pkgs/development/python-modules/pynrrd/default.nix
new file mode 100644
index 000000000000..02361fe84deb
--- /dev/null
+++ b/pkgs/development/python-modules/pynrrd/default.nix
@@ -0,0 +1,27 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, numpy
+, pytest
+}:
+
+buildPythonPackage rec {
+  pname = "pynrrd";
+  version = "0.4.2";
+
+  src = fetchFromGitHub {
+    owner = "mhe";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1wn3ara3i19fi1y9a5j4imyczpa6dkkzd5djggxg4kkl1ff9awrj";
+  };
+
+  propagatedBuildInputs = [ numpy ];
+
+  meta = with lib; {
+    homepage = https://github.com/mhe/pynrrd;
+    description = "Simple pure-Python reader for NRRD files";
+    license = licenses.mit;
+    maintainers = with maintainers; [ bcdarwin ];
+  };
+}
diff --git a/pkgs/development/python-modules/pyparsing/default.nix b/pkgs/development/python-modules/pyparsing/default.nix
index f1f43a5f495b..4acc4fa804b3 100644
--- a/pkgs/development/python-modules/pyparsing/default.nix
+++ b/pkgs/development/python-modules/pyparsing/default.nix
@@ -1,19 +1,35 @@
-{ stdenv, buildPythonPackage, fetchPypi }:
+{ buildPythonPackage
+, fetchFromGitHub
+, lib
+
+# pythonPackages
+, coverage
+}:
+
 buildPythonPackage rec {
-    pname = "pyparsing";
-    version = "2.4.6";
+  pname = "pyparsing";
+  version = "2.4.6";
 
-    src = fetchPypi {
-      inherit pname version;
-      sha256 = "4c830582a84fb022400b85429791bc551f1f4871c33f23e44f353119e92f969f";
-    };
+  src = fetchFromGitHub {
+    owner = "pyparsing";
+    repo = pname;
+    rev = "pyparsing_${version}";
+    sha256 = "1fh7s3cfr274pd6hh6zygl99842rqws98an2nkrrqj2spb9ldxcm";
+  };
 
-    # Not everything necessary to run the tests is included in the distribution
-    doCheck = false;
+  # https://github.com/pyparsing/pyparsing/blob/847af590154743bae61a32c3dc1a6c2a19009f42/tox.ini#L6
+  checkInputs = [ coverage ];
+  checkPhase = ''
+    coverage run --branch simple_unit_tests.py
+    coverage run --branch unitTests.py
+  '';
 
-    meta = with stdenv.lib; {
-      homepage = https://pyparsing.wikispaces.com/;
-      description = "An alternative approach to creating and executing simple grammars, vs. the traditional lex/yacc approach, or the use of regular expressions";
-      license = licenses.mit;
-    };
+  meta = with lib; {
+    homepage = "https://github.com/pyparsing/pyparsing";
+    description = "An alternative approach to creating and executing simple grammars, vs. the traditional lex/yacc approach, or the use of regular expressions";
+    license = licenses.mit;
+    maintainers = with maintainers; [
+      kamadorueda
+    ];
+  };
 }
diff --git a/pkgs/development/python-modules/python-dbusmock/default.nix b/pkgs/development/python-modules/python-dbusmock/default.nix
index 57f6fd7bf676..9cfc68dee465 100644
--- a/pkgs/development/python-modules/python-dbusmock/default.nix
+++ b/pkgs/development/python-modules/python-dbusmock/default.nix
@@ -1,15 +1,17 @@
-{ lib, buildPythonPackage, fetchPypi, runtimeShell,
+{ lib, buildPythonPackage, fetchFromGitHub, runtimeShell,
   nose, dbus, dbus-python, pygobject3,
   which, pyflakes, pycodestyle, bluez, networkmanager
 }:
 
 buildPythonPackage rec {
   pname = "python-dbusmock";
-  version = "0.18.3";
+  version = "0.19";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "994a178268b6d74aeb158c0f155cd141e9a0cfae14226a764cd022c4949fe242";
+  src = fetchFromGitHub {
+    owner = "martinpitt";
+    repo = pname;
+    rev = version;
+    sha256 = "09j338lmrjabbd3fpajr4piz4r20sl33030szfsqfzlwrrmvkyi0";
   };
 
   prePatch = ''
diff --git a/pkgs/development/python-modules/python-miio/default.nix b/pkgs/development/python-modules/python-miio/default.nix
new file mode 100644
index 000000000000..eb7c91531965
--- /dev/null
+++ b/pkgs/development/python-modules/python-miio/default.nix
@@ -0,0 +1,39 @@
+{ stdenv
+, buildPythonPackage
+, fetchPypi
+, appdirs
+, click
+, construct
+, cryptography
+, pytest
+, zeroconf
+, attrs
+, pytz
+, tqdm
+, netifaces
+}:
+
+buildPythonPackage rec {
+  pname = "python-miio";
+  version = "0.4.8";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "19423b3386b23d2e0fc94a8f6a358bcfbb44eed05376e33fd434d26d168bd18c";
+  };
+
+  checkInputs = [ pytest ];
+  propagatedBuildInputs = [ appdirs click construct cryptography zeroconf attrs pytz tqdm netifaces ];
+
+  checkPhase = ''
+    pytest
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Python library for interfacing with Xiaomi smart appliances";
+    homepage = https://github.com/rytilahti/python-miio;
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ flyfloh ];
+  };
+}
+
diff --git a/pkgs/development/python-modules/python-olm/default.nix b/pkgs/development/python-modules/python-olm/default.nix
index 4fc0ad66f95b..b1e01f7f4abf 100644
--- a/pkgs/development/python-modules/python-olm/default.nix
+++ b/pkgs/development/python-modules/python-olm/default.nix
@@ -1,5 +1,5 @@
 { lib, buildPythonPackage, olm,
-  cffi, future, typing }:
+  cffi, future, isPy3k, typing }:
 
 buildPythonPackage {
   pname = "python-olm";
@@ -15,8 +15,7 @@ buildPythonPackage {
   propagatedBuildInputs = [
     cffi
     future
-    typing
-  ];
+  ] ++ lib.optionals (!isPy3k) [ typing ];
 
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/pytorch/default.nix b/pkgs/development/python-modules/pytorch/default.nix
index d55be70ae490..0556ff93c13c 100644
--- a/pkgs/development/python-modules/pytorch/default.nix
+++ b/pkgs/development/python-modules/pytorch/default.nix
@@ -105,7 +105,7 @@ let
     path = "${cudatoolkit}/lib/stubs/libcuda.so";
   }];
   cudaStubEnv = lib.optionalString cudaSupport
-    "LD_LIBRARY_PATH=${cudaStub}\${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH} ";
+    "LD_LIBRARY_PATH=${cudaStub}\${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH ";
 
 in buildPythonPackage rec {
   version = "1.2.0";
diff --git a/pkgs/development/python-modules/requirements-detector/default.nix b/pkgs/development/python-modules/requirements-detector/default.nix
index a0f312389f1a..0d91cbc7509f 100644
--- a/pkgs/development/python-modules/requirements-detector/default.nix
+++ b/pkgs/development/python-modules/requirements-detector/default.nix
@@ -4,6 +4,7 @@
 , lib
 
 # pythonPackages
+, astroid
 , pytest
 }:
 
@@ -13,12 +14,16 @@ buildPythonPackage rec {
   disabled = isPy27;
 
   src = fetchFromGitHub {
-    owner = "yuvadm";
+    owner = "landscapeio";
     repo = pname;
     rev = version;
-    sha256 = "15s0n1lhkz0zwi33waqkkjipal3f7s45rxsj1bw89xpr4dj87qx5";
+    sha256 = "1sfmm7daz0kpdx6pynsvi6qlfhrzxx783l1wb69c8dfzya4xssym";
   };
 
+  propagatedBuildInputs = [
+    astroid
+  ];
+
   checkInputs = [
     pytest
   ];
diff --git a/pkgs/development/python-modules/s3transfer/default.nix b/pkgs/development/python-modules/s3transfer/default.nix
index 3020ab68ec76..2ba5a944d711 100644
--- a/pkgs/development/python-modules/s3transfer/default.nix
+++ b/pkgs/development/python-modules/s3transfer/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     sha256 = "6efc926738a3cd576c2a79725fed9afde92378aa5c6a957e3af010cb019fac9d";
   };
 
-  outputs = [ "out" "dev" ];
-
   propagatedBuildInputs =
     [ botocore
     ] ++ stdenv.lib.optional (pythonOlder "3") futures;
diff --git a/pkgs/development/python-modules/sentry-sdk/default.nix b/pkgs/development/python-modules/sentry-sdk/default.nix
index 67584789995e..d556dcb74cf2 100644
--- a/pkgs/development/python-modules/sentry-sdk/default.nix
+++ b/pkgs/development/python-modules/sentry-sdk/default.nix
@@ -13,6 +13,7 @@
 , pyramid
 , rq
 , sanic
+, sqlalchemy
 , stdenv
 , tornado
 , urllib3
@@ -27,7 +28,7 @@ buildPythonPackage rec {
     sha256 = "c6b919623e488134a728f16326c6f0bcdab7e3f59e7f4c472a90eea4d6d8fe82";
   };
 
-  checkInputs = [ django flask tornado bottle rq falcon ]
+  checkInputs = [ django flask tornado bottle rq falcon sqlalchemy ]
   ++ stdenv.lib.optionals isPy3k [ celery pyramid sanic aiohttp ];
 
   propagatedBuildInputs = [ urllib3 certifi ];
diff --git a/pkgs/development/python-modules/solo-python/default.nix b/pkgs/development/python-modules/solo-python/default.nix
index 52d7d7539f92..216e5a2a84f6 100644
--- a/pkgs/development/python-modules/solo-python/default.nix
+++ b/pkgs/development/python-modules/solo-python/default.nix
@@ -3,7 +3,7 @@
 
  buildPythonPackage rec {
   pname = "solo-python";
-  version = "0.0.18";
+  version = "0.0.21";
   format = "flit";
   disabled = pythonOlder "3.6"; # only python>=3.6 is supported
 
@@ -11,7 +11,7 @@
     owner = "solokeys";
     repo = pname;
     rev = version;
-    sha256 = "01mgppjvxlr93vrgz7bzisghpg1vqyaj4cg5wngk0h499iyx4d9q";
+    sha256 = "07r451dp3ma1mh735b2kjv86a4jkjhmag70cjqf73z7b61dmzl1q";
   };
 
   # replaced pinned fido, with unrestricted fido version
@@ -48,6 +48,5 @@
     homepage = "https://github.com/solokeys/solo-python";
     maintainers = with maintainers; [ wucke13 ];
     license = with licenses; [ asl20 mit ];
-    broken = true; # no longer compatible with fido2
   };
 }
diff --git a/pkgs/development/python-modules/srsly/default.nix b/pkgs/development/python-modules/srsly/default.nix
index 2b87c38b0854..42d3da93c90e 100644
--- a/pkgs/development/python-modules/srsly/default.nix
+++ b/pkgs/development/python-modules/srsly/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "srsly";
-  version = "0.2.0";
+  version = "1.0.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0gha1xfh64mapvgn0sghnjsvmjdrh5rywhs3j3bhkvwk42kf40ma";
+    sha256 = "0d49a90gsfyxwp8g14mvvw1kjm77qgx86zg4812kcmlz9ycb80hi";
   };
 
   propagatedBuildInputs = lib.optional (pythonOlder "3.4") pathlib;
diff --git a/pkgs/development/python-modules/stups-pierone/default.nix b/pkgs/development/python-modules/stups-pierone/default.nix
new file mode 100644
index 000000000000..aaa049916411
--- /dev/null
+++ b/pkgs/development/python-modules/stups-pierone/default.nix
@@ -0,0 +1,47 @@
+{ lib
+, fetchFromGitHub
+, buildPythonPackage
+, requests
+, stups-cli-support
+, stups-zign
+, pytest
+, pytestcov
+, hypothesis
+, isPy3k
+}:
+
+buildPythonPackage rec {
+  pname = "stups-pierone";
+  version = "1.1.45";
+  disabled = !isPy3k;
+
+  src = fetchFromGitHub {
+    owner = "zalando-stups";
+    repo = "pierone-cli";
+    rev = version;
+    sha256 = "1ggfizw27wpcagbbk15xpfrhq6b250cx4278b5d7y8s438g128cs";
+  };
+
+  propagatedBuildInputs = [
+    requests
+    stups-cli-support
+    stups-zign
+  ];
+
+  preCheck = "
+    export HOME=$TEMPDIR
+  ";
+
+  checkInputs = [
+    pytest
+    pytestcov
+    hypothesis
+  ];
+
+  meta = with lib; {
+    description = "Convenient command line client for STUPS' Pier One Docker registry";
+    homepage = "https://github.com/zalando-stups/pierone-cli";
+    license = licenses.asl20;
+    maintainers = [ maintainers.mschuwalow ];
+  };
+}
diff --git a/pkgs/development/python-modules/urllib3/default.nix b/pkgs/development/python-modules/urllib3/default.nix
index 0c8c97925a7b..9e28647fd016 100644
--- a/pkgs/development/python-modules/urllib3/default.nix
+++ b/pkgs/development/python-modules/urllib3/default.nix
@@ -11,8 +11,6 @@ buildPythonPackage rec {
     sha256 = "f3c5fd51747d450d4dcf6f923c81f78f811aab8205fda64b0aba34a4e48b0745";
   };
 
-  outputs = [ "out" "dev" ];
-
   NOSE_EXCLUDE = stdenv.lib.concatStringsSep "," [
     "test_headers" "test_headerdict" "test_can_validate_ip_san" "test_delayed_body_read_timeout"
     "test_timeout_errors_cause_retries" "test_select_multiple_interrupts_with_event"
diff --git a/pkgs/development/r-modules/default.nix b/pkgs/development/r-modules/default.nix
index 2019ee45f3cd..5fa0cd15962d 100644
--- a/pkgs/development/r-modules/default.nix
+++ b/pkgs/development/r-modules/default.nix
@@ -311,7 +311,6 @@ let
     rgdal = [ pkgs.proj.dev pkgs.gdal ];
     rgeos = [ pkgs.geos ];
     rggobi = [ pkgs.ggobi pkgs.gtk2.dev pkgs.libxml2.dev ];
-    rgl = [ pkgs.libGLU pkgs.libGL pkgs.xlibsWrapper ];
     Rglpk = [ pkgs.glpk ];
     RGtk2 = [ pkgs.gtk2.dev ];
     rhdf5 = [ pkgs.zlib ];
@@ -404,6 +403,7 @@ let
     RCurl = [ pkgs.curl.dev ];
     R2SWF = [ pkgs.pkgconfig ];
     rggobi = [ pkgs.pkgconfig ];
+    rgl = [ pkgs.libGLU pkgs.libGLU.dev pkgs.libGL pkgs.xlibsWrapper ];
     RGtk2 = [ pkgs.pkgconfig ];
     RProtoBuf = [ pkgs.pkgconfig ];
     Rpoppler = [ pkgs.pkgconfig ];
diff --git a/pkgs/development/tools/boomerang/default.nix b/pkgs/development/tools/boomerang/default.nix
index 9e567ef59b0d..821e51ac6058 100644
--- a/pkgs/development/tools/boomerang/default.nix
+++ b/pkgs/development/tools/boomerang/default.nix
@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "boomerang";
-  version = "0.5.1";
+  version = "0.5.2";
 
   src = fetchFromGitHub {
     owner = "BoomerangDecompiler";
     repo = pname;
     rev = "v${version}";
-    sha256 = "046ba4km8c31kbnllx05nbqhjmk7bpi56d3n8md8bsr98nj21a2j";
+    sha256 = "0xncdp0z8ry4lkzmvbj5d7hlzikivghpwicgywlv47spgh8ny0ix";
   };
 
   nativeBuildInputs = [ cmake bison flex ];
diff --git a/pkgs/development/tools/build-managers/ninja/default.nix b/pkgs/development/tools/build-managers/ninja/default.nix
index 1c90bcc3a9f8..7001510d52d6 100644
--- a/pkgs/development/tools/build-managers/ninja/default.nix
+++ b/pkgs/development/tools/build-managers/ninja/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, fetchpatch, python, buildDocs ? true, asciidoc, docbook_xml_dtd_45, docbook_xsl, libxslt, re2c }:
+{ stdenv, fetchFromGitHub, fetchpatch, python3, buildDocs ? true, asciidoc, docbook_xml_dtd_45, docbook_xsl, libxslt, re2c }:
 
 with stdenv.lib;
 
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
       sha256 = "0zsg46jflsh644jccrcgyfalr7fkzrv041kyi8644nyk923gcrl9";
     })
     # https://github.com/ninja-build/ninja/issues/1510 - fix w/musl, possibly BSDs?
-    # 
+    #
     (fetchpatch {
       name = "fix-issue-1510.patch";
       url = https://github.com/makepost/ninja/commit/567815df38a2ff54ad7478a90bd75c91e434236a.patch;
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  nativeBuildInputs = [ python re2c ] ++ optionals buildDocs [ asciidoc docbook_xml_dtd_45 docbook_xsl libxslt.bin ];
+  nativeBuildInputs = [ python3 re2c ] ++ optionals buildDocs [ asciidoc docbook_xml_dtd_45 docbook_xsl libxslt.bin ];
 
   buildPhase = ''
     python configure.py --bootstrap
diff --git a/pkgs/development/tools/misc/usb-modeswitch/configurable-usb-modeswitch.patch b/pkgs/development/tools/misc/usb-modeswitch/configurable-usb-modeswitch.patch
new file mode 100644
index 000000000000..3f96cfa75757
--- /dev/null
+++ b/pkgs/development/tools/misc/usb-modeswitch/configurable-usb-modeswitch.patch
@@ -0,0 +1,294 @@
+diff --git a/Makefile b/Makefile
+index 463a11f..f20072c 100644
+--- a/Makefile
++++ b/Makefile
+@@ -5,11 +5,11 @@ CFLAGS      += -Wall
+ LIBS        = `pkg-config --libs --cflags libusb-1.0`
+ RM          = /bin/rm -f
+ OBJS        = usb_modeswitch.c
+-PREFIX      = $(DESTDIR)/usr
+-ETCDIR      = $(DESTDIR)/etc
++PREFIX      = /usr/local
++ETCDIR      = $(PREFIX)/etc
+ SYSDIR      = $(ETCDIR)/systemd/system
+ UPSDIR      = $(ETCDIR)/init
+-UDEVDIR     = $(DESTDIR)/lib/udev
++UDEVDIR     = $(PREFIX)/lib/udev
+ SBINDIR     = $(PREFIX)/sbin
+ MANDIR      = $(PREFIX)/share/man/man1
+ VPATH       = jimtcl
+@@ -22,10 +22,17 @@ endif
+ JIM_CONFIGURE_OPTS = --disable-lineedit \
+ 	--with-out-jim-ext="stdlib posix load signal syslog" --prefix=/usr
+ 
++USE_UPSTART=$(shell if command -v initctl > /dev/null; then echo "true"; fi)
++USE_SYSTEMD=$(shell if command -v systemctl > /dev/null; then echo "true"; fi)
++
+ .PHONY: clean install install-common uninstall \
+ 	script shared static \
+ 	dispatcher-script dispatcher-shared dispatcher-static \
+-	install-script install-shared install-static
++	install-script install-shared install-static \
++	install-upstart install-systemd \
++	configure-dispatcher configure-script \
++	configure-upstart configure-systemd \
++	configure
+ 
+ all: script
+ 
+@@ -46,7 +53,25 @@ jim/libjim.a:
+ 	cd jim && CFLAGS="$(CFLAGS)" CC="$(CC)" ./configure $(JIM_CONFIGURE_OPTS)
+ 	$(MAKE) -C jim lib
+ 
+-dispatcher-script: usb_modeswitch.tcl
++configure-dispatcher:
++	sed -i \
++	  -e 's,^\(set setup(sbindir) \).*$$,\1$(SBINDIR),' \
++	  -e 's,^\(set setup(etcdir) \).*$$,\1$(ETCDIR),' \
++	  usb_modeswitch.tcl
++
++configure-script:
++	sed -i -e 's,^\(SBINDIR=\).*$$,\1$(SBINDIR),' usb_modeswitch.sh
++
++configure-systemd:
++	sed -i -e 's,@sbindir@,$(SBINDIR),' usb_modeswitch@.service
++
++configure-upstart:
++	sed -i -e 's,@sbindir@,$(SBINDIR),' usb-modeswitch-upstart.conf
++
++configure: configure-dispatcher configure-script \
++	configure-systemd configure-upstart
++
++dispatcher-script: configure-dispatcher usb_modeswitch.tcl
+ 	sed 's_!/usr/bin/tclsh_!'"$(TCL)"'_' < usb_modeswitch.tcl > usb_modeswitch_dispatcher
+ 
+ dispatcher-shared: jim/libjim.so dispatcher.c usb_modeswitch.string
+@@ -55,7 +80,7 @@ dispatcher-shared: jim/libjim.so dispatcher.c usb_modeswitch.string
+ dispatcher-static: jim/libjim.a dispatcher.c usb_modeswitch.string
+ 	$(CC) dispatcher.c $(LDFLAGS) jim/libjim.a -Ijim -o usb_modeswitch_dispatcher $(CFLAGS)
+ 
+-usb_modeswitch.string: usb_modeswitch.tcl
++usb_modeswitch.string: configure-dispatcher usb_modeswitch.tcl
+ 	$(HOST_TCL) make_string.tcl usb_modeswitch.tcl > $@
+ 
+ clean:
+@@ -76,16 +101,28 @@ ums-clean:
+ # If the systemd folder is present, install the service for starting the dispatcher
+ # If not, use the dispatcher directly from the udev rule as in previous versions
+ 
+-install-common: $(PROG) usb_modeswitch_dispatcher
+-	install -D --mode=755 usb_modeswitch $(SBINDIR)/usb_modeswitch
+-	install -D --mode=755 usb_modeswitch.sh $(UDEVDIR)/usb_modeswitch
+-	install -D --mode=644 usb_modeswitch.conf $(ETCDIR)/usb_modeswitch.conf
+-	install -D --mode=644 usb_modeswitch.1 $(MANDIR)/usb_modeswitch.1
+-	install -D --mode=644 usb_modeswitch_dispatcher.1 $(MANDIR)/usb_modeswitch_dispatcher.1
+-	install -D --mode=755 usb_modeswitch_dispatcher $(SBINDIR)/usb_modeswitch_dispatcher
++install-common: $(PROG) configure usb_modeswitch_dispatcher
++	install -D --mode=755 usb_modeswitch $(DESTDIR)$(SBINDIR)/usb_modeswitch
++	install -D --mode=755 usb_modeswitch.sh $(DESTDIR)$(UDEVDIR)/usb_modeswitch
++	install -D --mode=644 usb_modeswitch.conf $(DESTDIR)$(ETCDIR)/usb_modeswitch.conf
++	install -D --mode=644 usb_modeswitch.1 $(DESTDIR)$(MANDIR)/usb_modeswitch.1
++	install -D --mode=644 usb_modeswitch_dispatcher.1 $(DESTDIR)$(MANDIR)/usb_modeswitch_dispatcher.1
++	install -D --mode=755 usb_modeswitch_dispatcher $(DESTDIR)$(SBINDIR)/usb_modeswitch_dispatcher
+ 	install -d $(DESTDIR)/var/lib/usb_modeswitch
+-	test -d $(UPSDIR) -a -e /sbin/initctl && install --mode=644 usb-modeswitch-upstart.conf $(UPSDIR) || test 1
+-	test -d $(SYSDIR) -a \( -e /usr/bin/systemctl -o -e /bin/systemctl \) && install --mode=644 usb_modeswitch@.service $(SYSDIR) || test 1
++
++install-upstart:
++	install -D --mode=644 usb-modeswitch-upstart.conf $(DESTDIR)$(UPSDIR)/usb-modeswitch-upstart.conf
++
++install-systemd:
++	install -D --mode=644 usb_modeswitch@.service $(DESTDIR)$(SYSDIR)/usb_modeswitch@.service
++
++ifeq ($(USE_UPSTART),true)
++install-common: install-upstart
++endif
++
++ifeq ($(USE_SYSTEMD),true)
++install-common: install-systemd
++endif
+ 
+ install: install-script
+ 
+@@ -96,10 +133,10 @@ install-shared: dispatcher-shared install-common
+ install-static: dispatcher-static install-common
+ 
+ uninstall:
+-	$(RM) $(SBINDIR)/usb_modeswitch
+-	$(RM) $(SBINDIR)/usb_modeswitch_dispatcher
+-	$(RM) $(UDEVDIR)/usb_modeswitch
+-	$(RM) $(ETCDIR)/usb_modeswitch.conf
+-	$(RM) $(MANDIR)/usb_modeswitch.1
++	$(RM) $(DESTDIR)$(SBINDIR)/usb_modeswitch
++	$(RM) $(DESTDIR)$(SBINDIR)/usb_modeswitch_dispatcher
++	$(RM) $(DESTDIR)$(UDEVDIR)/usb_modeswitch
++	$(RM) $(DESTDIR)$(ETCDIR)/usb_modeswitch.conf
++	$(RM) $(DESTDIR)$(MANDIR)/usb_modeswitch.1
+ 	$(RM) -R $(DESTDIR)/var/lib/usb_modeswitch
+-	$(RM) $(SYSDIR)/usb_modeswitch@.service
++	$(RM) $(DESTDIR)$(SYSDIR)/usb_modeswitch@.service
+diff --git a/usb-modeswitch-upstart.conf b/usb-modeswitch-upstart.conf
+index 0d82b69..1c177b4 100644
+--- a/usb-modeswitch-upstart.conf
++++ b/usb-modeswitch-upstart.conf
+@@ -1,5 +1,5 @@
+ start on usb-modeswitch-upstart
+ task
+ script
+-	exec /usr/sbin/usb_modeswitch_dispatcher --switch-mode $UMS_PARAM
++	exec @sbindir@/usb_modeswitch_dispatcher --switch-mode $UMS_PARAM
+ end script
+diff --git a/usb_modeswitch.sh b/usb_modeswitch.sh
+index eb3fa3e..0e93166 100755
+--- a/usb_modeswitch.sh
++++ b/usb_modeswitch.sh
+@@ -1,5 +1,9 @@
+ #!/bin/sh
+ # part of usb_modeswitch 2.5.2
++
++# Compile time configuration, injected by the Makefile
++SBINDIR=/usr/sbin
++
+ device_in()
+ {
+ 	if [ ! -e /var/lib/usb_modeswitch/$1 ]; then
+@@ -37,7 +41,7 @@ if [ $(expr "$1" : "--.*") ]; then
+ 		v_id=$3
+ 	fi
+ fi
+-PATH=/sbin:/usr/sbin:$PATH
++
+ case "$1" in
+ 	--driver-bind)
+ 		# driver binding code removed
+@@ -46,9 +50,7 @@ case "$1" in
+ 	--symlink-name)
+ 		device_in "link_list" $v_id $p_id
+ 		if [ "$?" = "1" ]; then
+-			if [ -e "/usr/sbin/usb_modeswitch_dispatcher" ]; then
+-				exec usb_modeswitch_dispatcher $1 $2 2>>/dev/null
+-			fi
++			exec $SBINDIR/usb_modeswitch_dispatcher $1 $2 2>>/dev/null
+ 		fi
+ 		exit 0
+ 		;;
+@@ -61,15 +63,13 @@ if [ "$p2" = "" -a "$p1" != "" ]; then
+ 	p2=$p1
+ fi
+ 
+-PATH=/bin:/sbin:/usr/bin:/usr/sbin
+-init_path=`readlink -f /sbin/init`
+-if [ `basename $init_path` = "systemd" ]; then
++if command -v systemctl > /dev/null; then
+ 	systemctl --no-block start usb_modeswitch@$p2.service
+-elif [ -e "/etc/init/usb-modeswitch-upstart.conf" ]; then
++elif command -v initctl > /dev/null; then
+ 	initctl emit --no-wait usb-modeswitch-upstart UMS_PARAM=$p2
+ else
+ 	# only old distros, new udev will kill all subprocesses
+ 	exec 1<&- 2<&- 5<&- 7<&-
+-	exec usb_modeswitch_dispatcher --switch-mode $p2 &
++	exec $SBINDIR/usb_modeswitch_dispatcher --switch-mode $p2 &
+ fi
+ exit 0
+diff --git a/usb_modeswitch.tcl b/usb_modeswitch.tcl
+index d2ee50c..8a48751 100755
+--- a/usb_modeswitch.tcl
++++ b/usb_modeswitch.tcl
+@@ -12,6 +12,16 @@
+ # Part of usb-modeswitch-2.5.2 package
+ # (C) Josua Dietze 2009-2017
+ 
++# Compile-time configuration, injected by the Makefile.
++set setup(sbindir) /usr/sbin
++set setup(etcdir) /etc
++
++# External dependency default location
++set setup(dbdir) /usr/share/usb_modeswitch
++
++# Derived configuration
++set setup(dbdir_etc) $setup(etcdir)/usb_modeswitch.d
++
+ set arg0 [lindex $argv 0]
+ if [regexp {\.tcl$} $arg0] {
+ 	if [file exists $arg0] {
+@@ -91,10 +101,8 @@ if {![regexp {(.*?):.*$} $arg1 d device]} {
+ }
+ set flags(logwrite) 1
+ 
+-set setup(dbdir) /usr/share/usb_modeswitch
+-set setup(dbdir_etc) /etc/usb_modeswitch.d
+ if {![file exists $setup(dbdir)] && ![file exists $setup(dbdir_etc)]} {
+-	Log "\nError: no config database found in /usr/share or /etc. Exit"
++	Log "\nError: no config database found in $setup(dbdir) or $setup(dbdir_etc). Exit"
+ 	SafeExit
+ }
+ 
+@@ -261,7 +269,7 @@ if {$config(NoMBIMCheck)==0 && $usb(bNumConfigurations) > 1} {
+ 	if [CheckMBIM] {
+ 		Log " driver for MBIM devices is available"
+ 		Log "Find MBIM configuration number ..."
+-		if [catch {set cfgno [exec /usr/sbin/usb_modeswitch -j -Q $busParam $devParam -v $usb(idVendor) -p $usb(idProduct)]} err] {
++		if [catch {set cfgno [exec $setup(sbindir)/usb_modeswitch -j -Q $busParam $devParam -v $usb(idVendor) -p $usb(idProduct)]} err] {
+ 			Log "Error when trying to find MBIM configuration, switch to legacy modem mode"
+ 		} else {
+ 			set cfgno [string trim $cfgno]
+@@ -297,7 +305,7 @@ if {$report == ""} {
+ 	# Now we are actually switching
+ 	if $flags(logging) {
+ 		Log "Command line:\nusb_modeswitch -W -D $configParam $busParam $devParam -v $usb(idVendor) -p $usb(idProduct) -f \$flags(config)"
+-		catch {set report [exec /usr/sbin/usb_modeswitch -W -D $configParam $busParam $devParam -v $usb(idVendor) -p $usb(idProduct) -f "$flags(config)" 2>@1]} report
++		catch {set report [exec $setup(sbindir)/usb_modeswitch -W -D $configParam $busParam $devParam -v $usb(idVendor) -p $usb(idProduct) -f "$flags(config)" 2>@1]} report
+ 		Log "\nVerbose debug output of usb_modeswitch and libusb follows"
+ 		Log "(Note that some USB errors are to be expected in the process)"
+ 		Log "--------------------------------"
+@@ -305,7 +313,7 @@ if {$report == ""} {
+ 		Log "--------------------------------"
+ 		Log "(end of usb_modeswitch output)\n"
+ 	} else {
+-		catch {set report [exec /usr/sbin/usb_modeswitch -Q -D $configParam $busParam $devParam -v $usb(idVendor) -p $usb(idProduct) -f "$flags(config)" 2>@1]} report
++		catch {set report [exec $setup(sbindir)/usb_modeswitch -Q -D $configParam $busParam $devParam -v $usb(idVendor) -p $usb(idProduct) -f "$flags(config)" 2>@1]} report
+ 	}
+ }
+ 
+@@ -498,9 +506,9 @@ return 1
+ 
+ proc {ParseGlobalConfig} {} {
+ 
+-global flags
++global flags setup
+ set configFile ""
+-set places [list /etc/usb_modeswitch.conf /etc/sysconfig/usb_modeswitch /etc/default/usb_modeswitch]
++set places [list $setup(etcdir)/usb_modeswitch.conf $setup(etcdir)/sysconfig/usb_modeswitch $setup(etcdir)/default/usb_modeswitch]
+ foreach cfg $places {
+ 	if [file exists $cfg] {
+ 		set configFile $cfg
+@@ -897,10 +905,12 @@ proc {SysLog} {msg} {
+ 
+ global flags
+ if {![info exists flags(logger)]} {
+-	set flags(logger) ""
+-	foreach fn {/bin/logger /usr/bin/logger} {
+-		if [file exists $fn] {
+-			set flags(logger) $fn
++	set flags(logger) [exec sh -c "command -v logger || true"]
++	if {$flags(logger) == ""} {
++		foreach fn {/bin/logger /usr/bin/logger} {
++			if [file exists $fn] {
++				set flags(logger) $fn
++			}
+ 		}
+ 	}
+ 	Log "Logger is $flags(logger)"
+diff --git a/usb_modeswitch@.service b/usb_modeswitch@.service
+index f74a8bf..90cb96a 100644
+--- a/usb_modeswitch@.service
++++ b/usb_modeswitch@.service
+@@ -3,6 +3,6 @@ Description=USB_ModeSwitch_%i
+ 
+ [Service]
+ Type=oneshot
+-ExecStart=/usr/sbin/usb_modeswitch_dispatcher --switch-mode %i
++ExecStart=@sbindir@/usb_modeswitch_dispatcher --switch-mode %i
+ #ExecStart=/bin/echo %i
+ 
diff --git a/pkgs/development/tools/misc/usb-modeswitch/data.nix b/pkgs/development/tools/misc/usb-modeswitch/data.nix
index d2b80011dea0..6280b103ab60 100644
--- a/pkgs/development/tools/misc/usb-modeswitch/data.nix
+++ b/pkgs/development/tools/misc/usb-modeswitch/data.nix
@@ -9,10 +9,13 @@ stdenv.mkDerivation rec {
     sha256 = "1ygahl3r26r38ai8yyblq9nhf3v5i6n6r6672p5wf88wg5h9n0rz";
   };
 
-  inherit (usb-modeswitch) makeFlags;
+  makeFlags = [
+    "PREFIX=$(out)"
+    "DESTDIR=$(out)"
+  ];
 
   prePatch = ''
-    sed -i 's@usb_modeswitch@${usb-modeswitch}/bin/usb_modeswitch@g' 40-usb_modeswitch.rules
+    sed -i 's@usb_modeswitch@${usb-modeswitch}/lib/udev/usb_modeswitch@g' 40-usb_modeswitch.rules
   '';
 
   # we add tcl here so we can patch in support for new devices by dropping config into
diff --git a/pkgs/development/tools/misc/usb-modeswitch/default.nix b/pkgs/development/tools/misc/usb-modeswitch/default.nix
index a0e1b8eb8ceb..731ac836412a 100644
--- a/pkgs/development/tools/misc/usb-modeswitch/default.nix
+++ b/pkgs/development/tools/misc/usb-modeswitch/default.nix
@@ -1,4 +1,5 @@
-{ stdenv, fetchurl, pkgconfig, libusb1 }:
+{ stdenv, lib, fetchurl, pkgconfig, makeWrapper
+, libusb1, tcl, utillinux, coreutils, bash }:
 
 stdenv.mkDerivation rec {
   pname = "usb-modeswitch";
@@ -9,19 +10,32 @@ stdenv.mkDerivation rec {
     sha256 = "18wbbxc5cfsmikba0msdvd5qlaga27b32nhrzicyd9mdddp265f2";
   };
 
+  patches = [ ./configurable-usb-modeswitch.patch ];
+
+  # Remove attempts to write to /etc and /var/lib.
+  postPatch = ''
+    sed -i \
+      -e '/^\tinstall .* usb_modeswitch.conf/s,$(ETCDIR),$(out)/etc,' \
+      -e '\,^\tinstall -d .*/var/lib/usb_modeswitch,d' \
+      Makefile
+  '';
+
   makeFlags = [
-    "DESTDIR=$(out)"
     "PREFIX=$(out)"
+    "ETCDIR=/etc"
+    "USE_UPSTART=false"
+    "USE_SYSTEMD=true"
+    "SYSDIR=$(out)/lib/systemd/system"
+    "UDEVDIR=$(out)/lib/udev"
   ];
 
-  # make clean: we always build from source. It should be necessary on x86_64 only
-  preConfigure = ''
-    find -type f | xargs sed 's@/bin/rm@rm@g' -i
-    make clean
+  postFixup = ''
+    wrapProgram $out/bin/usb_modeswitch_dispatcher \
+      --set PATH ${lib.makeBinPath [ utillinux coreutils bash ]}
   '';
 
-  buildInputs = [ libusb1 ];
-  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libusb1 tcl ];
+  nativeBuildInputs = [ pkgconfig makeWrapper ];
 
   meta = with stdenv.lib; {
     description = "A mode switching tool for controlling 'multi-mode' USB devices";
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/default.nix b/pkgs/development/tools/poetry2nix/poetry2nix/default.nix
index 8e0e861fab3f..b6d533875523 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/default.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/default.nix
@@ -20,16 +20,10 @@ let
 
   getFunctorFn = fn: if builtins.typeOf fn == "set" then fn.__functor else fn;
 
-  getAttrDefault = attribute: set: default: (
-    if builtins.hasAttr attribute set
-    then builtins.getAttr attribute set
-    else default
-  );
-
   # Map SPDX identifiers to license names
   spdxLicenses = lib.listToAttrs (lib.filter (pair: pair.name != null) (builtins.map (v: { name = if lib.hasAttr "spdxId" v then v.spdxId else null; value = v; }) (lib.attrValues lib.licenses)));
   # Get license by id falling back to input string
-  getLicenseBySpdxId = spdxId: getAttrDefault spdxId spdxLicenses spdxId;
+  getLicenseBySpdxId = spdxId: spdxLicenses.${spdxId} or spdxId;
 
   #
   # Returns an attrset { python, poetryPackages } for the given lockfile
@@ -65,7 +59,7 @@ let
       # closure as python can only ever have one version of a dependency
       baseOverlay = self: super:
         let
-          getDep = depName: if builtins.hasAttr depName self then self."${depName}" else throw "foo";
+          getDep = depName: self.${depName};
 
           lockPkgs = builtins.listToAttrs (
             builtins.map (
@@ -74,7 +68,7 @@ let
                 value = self.mkPoetryDep (
                   pkgMeta // {
                     inherit pwd;
-                    source = getAttrDefault "source" pkgMeta null;
+                    source = pkgMeta.source or null;
                     files = lockFiles.${name};
                     pythonPackages = self;
                   }
@@ -159,12 +153,12 @@ let
       passedAttrs = builtins.removeAttrs attrs specialAttrs;
 
       getDeps = depAttr: let
-        deps = getAttrDefault depAttr pyProject.tool.poetry {};
+        deps = pyProject.tool.poetry.${depAttr} or {};
         depAttrs = builtins.map (d: lib.toLower d) (builtins.attrNames deps);
       in
         builtins.map (dep: py.pkgs."${dep}") depAttrs;
 
-      getInputs = attr: getAttrDefault attr attrs [];
+      getInputs = attr: attrs.${attr} or [];
       mkInput = attr: extraInputs: getInputs attr ++ extraInputs;
 
       buildSystemPkgs = poetryLib.getBuildSystemPkgs {
@@ -189,7 +183,7 @@ let
             python = py;
           };
 
-          postPatch = (getAttrDefault "postPatch" passedAttrs "") + ''
+          postPatch = (passedAttrs.postPatch or "") + ''
             # Tell poetry not to resolve the path dependencies. Any version is
             # fine !
             yj -tj < pyproject.toml | python ${./pyproject-without-path.py} > pyproject.json
@@ -199,7 +193,7 @@ let
 
           meta = meta // {
             inherit (pyProject.tool.poetry) description homepage;
-            license = getLicenseBySpdxId (getAttrDefault "license" pyProject.tool.poetry "unknown");
+            license = getLicenseBySpdxId (pyProject.tool.poetry.license or "unknown");
           };
 
         }
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/lib.nix b/pkgs/development/tools/poetry2nix/poetry2nix/lib.nix
index 559c3051a73a..68d854f26488 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/lib.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/lib.nix
@@ -30,22 +30,24 @@ let
     in
       (builtins.foldl' combine initial tokens).state;
 
-  fromTOML = toml: if builtins.hasAttr "fromTOML" builtins then builtins.fromTOML toml else
-    builtins.fromJSON (
-      builtins.readFile (
-        pkgs.runCommand "from-toml"
-          {
-            inherit toml;
-            allowSubstitutes = false;
-            preferLocalBuild = true;
-          }
-          ''
-            ${pkgs.remarshal}/bin/remarshal \
-              -if toml \
-              -i <(echo "$toml") \
-              -of json \
-              -o $out
-          ''
+  fromTOML = builtins.fromTOML or
+    (
+      toml: builtins.fromJSON (
+        builtins.readFile (
+          pkgs.runCommand "from-toml"
+            {
+              inherit toml;
+              allowSubstitutes = false;
+              preferLocalBuild = true;
+            }
+            ''
+              ${pkgs.remarshal}/bin/remarshal \
+                -if toml \
+                -i <(echo "$toml") \
+                -of json \
+                -o $out
+            ''
+        )
       )
     );
   readTOML = path: fromTOML (builtins.readFile path);
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/mk-poetry-dep.nix b/pkgs/development/tools/poetry2nix/poetry2nix/mk-poetry-dep.nix
index 256e2d90daaf..95543ca73590 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/mk-poetry-dep.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/mk-poetry-dep.nix
@@ -16,102 +16,112 @@
 , pwd
 , supportedExtensions ? lib.importJSON ./extensions.json
 , ...
-}: let
-
-  inherit (poetryLib) isCompatible getManyLinuxDeps fetchFromPypi;
+}:
 
-  inherit (import ./pep425.nix {
-    inherit lib python;
-    inherit (pkgs) stdenv;
-  }) selectWheel
-    ;
+pythonPackages.callPackage (
+  { preferWheel ? false
+  }:
 
-  fileCandidates = let
-    supportedRegex = ("^.*?(" + builtins.concatStringsSep "|" supportedExtensions + ")");
-    matchesVersion = fname: builtins.match ("^.*" + builtins.replaceStrings [ "." ] [ "\\." ] version + ".*$") fname != null;
-    hasSupportedExtension = fname: builtins.match supportedRegex fname != null;
-    isCompatibleEgg = fname: ! lib.strings.hasSuffix ".egg" fname || lib.strings.hasSuffix "py${python.pythonVersion}.egg" fname;
-  in
-    builtins.filter (f: matchesVersion f.file && hasSupportedExtension f.file && isCompatibleEgg f.file) files;
+    let
 
-  toPath = s: pwd + "/${s}";
+      inherit (poetryLib) isCompatible getManyLinuxDeps fetchFromPypi;
 
-  isSource = source != null;
-  isGit = isSource && source.type == "git";
-  isLocal = isSource && source.type == "directory";
+      inherit (import ./pep425.nix {
+        inherit lib python;
+        inherit (pkgs) stdenv;
+      }) selectWheel
+        ;
 
-  localDepPath = toPath source.url;
-  pyProject = poetryLib.readTOML (localDepPath + "/pyproject.toml");
+      fileCandidates = let
+        supportedRegex = ("^.*?(" + builtins.concatStringsSep "|" supportedExtensions + ")");
+        matchesVersion = fname: builtins.match ("^.*" + builtins.replaceStrings [ "." ] [ "\\." ] version + ".*$") fname != null;
+        hasSupportedExtension = fname: builtins.match supportedRegex fname != null;
+        isCompatibleEgg = fname: ! lib.strings.hasSuffix ".egg" fname || lib.strings.hasSuffix "py${python.pythonVersion}.egg" fname;
+      in
+        builtins.filter (f: matchesVersion f.file && hasSupportedExtension f.file && isCompatibleEgg f.file) files;
 
-  buildSystemPkgs = poetryLib.getBuildSystemPkgs {
-    inherit pythonPackages pyProject;
-  };
+      toPath = s: pwd + "/${s}";
 
-  fileInfo = let
-    isBdist = f: lib.strings.hasSuffix "whl" f.file;
-    isSdist = f: ! isBdist f && ! isEgg f;
-    isEgg = f: lib.strings.hasSuffix ".egg" f.file;
+      isSource = source != null;
+      isGit = isSource && source.type == "git";
+      isLocal = isSource && source.type == "directory";
 
-    binaryDist = selectWheel fileCandidates;
-    sourceDist = builtins.filter isSdist fileCandidates;
-    eggs = builtins.filter isEgg fileCandidates;
+      localDepPath = toPath source.url;
+      pyProject = poetryLib.readTOML (localDepPath + "/pyproject.toml");
 
-    lockFileEntry = builtins.head (sourceDist ++ binaryDist ++ eggs);
+      buildSystemPkgs = poetryLib.getBuildSystemPkgs {
+        inherit pythonPackages pyProject;
+      };
 
-    _isEgg = isEgg lockFileEntry;
+      fileInfo = let
+        isBdist = f: lib.strings.hasSuffix "whl" f.file;
+        isSdist = f: ! isBdist f && ! isEgg f;
+        isEgg = f: lib.strings.hasSuffix ".egg" f.file;
 
-  in
-    rec {
-      inherit (lockFileEntry) file hash;
-      name = file;
-      format =
-        if _isEgg then "egg"
-        else if lib.strings.hasSuffix ".whl" name then "wheel"
-        else "setuptools";
-      kind =
-        if _isEgg then python.pythonVersion
-        else if format == "setuptools" then "source"
-        else (builtins.elemAt (lib.strings.splitString "-" name) 2);
-    };
+        binaryDist = selectWheel fileCandidates;
+        sourceDist = builtins.filter isSdist fileCandidates;
+        eggs = builtins.filter isEgg fileCandidates;
 
-  baseBuildInputs = lib.optional (name != "setuptools_scm" && name != "setuptools-scm") pythonPackages.setuptools_scm;
+        entries = (if preferWheel then binaryDist ++ sourceDist else sourceDist ++ binaryDist) ++ eggs;
 
-in
+        lockFileEntry = builtins.head entries;
 
-buildPythonPackage {
-  pname = name;
-  version = version;
+        _isEgg = isEgg lockFileEntry;
 
-  doCheck = false; # We never get development deps
-  dontStrip = true;
-  format = if isLocal then "pyproject" else if isGit then "setuptools" else fileInfo.format;
+      in
+        rec {
+          inherit (lockFileEntry) file hash;
+          name = file;
+          format =
+            if _isEgg then "egg"
+            else if lib.strings.hasSuffix ".whl" name then "wheel"
+            else "setuptools";
+          kind =
+            if _isEgg then python.pythonVersion
+            else if format == "setuptools" then "source"
+            else (builtins.elemAt (lib.strings.splitString "-" name) 2);
+        };
 
-  nativeBuildInputs = if (!isSource && (getManyLinuxDeps fileInfo.name).str != null) then [ autoPatchelfHook ] else [];
-  buildInputs = baseBuildInputs ++ (if !isSource then (getManyLinuxDeps fileInfo.name).pkg else []);
+      baseBuildInputs = lib.optional (name != "setuptools_scm" && name != "setuptools-scm") pythonPackages.setuptools_scm;
 
-  propagatedBuildInputs =
-    let
-      # Some dependencies like django gets the attribute name django
-      # but dependencies try to access Django
-      deps = builtins.map (d: lib.toLower d) (builtins.attrNames dependencies);
     in
-      (builtins.map (n: pythonPackages.${n}) deps) ++ (if isLocal then buildSystemPkgs else []);
-
-  meta = {
-    broken = ! isCompatible python.version python-versions;
-    license = [];
-  };
-
-  # We need to retrieve kind from the interpreter and the filename of the package
-  # Interpreters should declare what wheel types they're compatible with (python type + ABI)
-  # Here we can then choose a file based on that info.
-  src = if isGit then (
-    builtins.fetchGit {
-      inherit (source) url;
-      rev = source.reference;
-    }
-  ) else if isLocal then (localDepPath) else fetchFromPypi {
-    pname = name;
-    inherit (fileInfo) file hash kind;
-  };
-}
+
+      buildPythonPackage {
+        pname = name;
+        version = version;
+
+        doCheck = false; # We never get development deps
+        dontStrip = true;
+        format = if isLocal then "pyproject" else if isGit then "setuptools" else fileInfo.format;
+
+        nativeBuildInputs = if (!isSource && (getManyLinuxDeps fileInfo.name).str != null) then [ autoPatchelfHook ] else [];
+        buildInputs = baseBuildInputs ++ (if !isSource then (getManyLinuxDeps fileInfo.name).pkg else []);
+
+        propagatedBuildInputs =
+          let
+            # Some dependencies like django gets the attribute name django
+            # but dependencies try to access Django
+            deps = builtins.map (d: lib.toLower d) (builtins.attrNames dependencies);
+          in
+            (builtins.map (n: pythonPackages.${n}) deps) ++ (if isLocal then buildSystemPkgs else []);
+
+        meta = {
+          broken = ! isCompatible python.version python-versions;
+          license = [];
+        };
+
+        # We need to retrieve kind from the interpreter and the filename of the package
+        # Interpreters should declare what wheel types they're compatible with (python type + ABI)
+        # Here we can then choose a file based on that info.
+        src = if isGit then (
+          builtins.fetchGit {
+            inherit (source) url;
+            rev = source.reference;
+          }
+        ) else if isLocal then (localDepPath) else fetchFromPypi {
+          pname = name;
+          inherit (fileInfo) file hash kind;
+        };
+      }
+
+) {}
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/overrides.nix b/pkgs/development/tools/poetry2nix/poetry2nix/overrides.nix
index 207841fd005f..48b8ff9859be 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/overrides.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/overrides.nix
@@ -5,14 +5,6 @@
 
 self: super:
 
-let
-
-  getAttrDefault = attribute: set: default:
-    if builtins.hasAttr attribute set
-    then builtins.getAttr attribute set
-    else default;
-
-in
 {
   av = super.av.overrideAttrs (
     old: {
@@ -52,7 +44,7 @@ in
   django = (
     super.django.overrideAttrs (
       old: {
-        propagatedNativeBuildInputs = (getAttrDefault "propagatedNativeBuildInputs" old [])
+        propagatedNativeBuildInputs = (old.propagatedNativeBuildInputs or [])
         ++ [ pkgs.gettext ];
       }
     )
@@ -64,7 +56,7 @@ in
         if ! test -e LICENSE; then
           touch LICENSE
         fi
-      '' + (getAttrDefault "configurePhase" old "");
+      '' + (old.configurePhase or "");
     }
   );
 
@@ -85,6 +77,13 @@ in
     }
   );
 
+  # importlib-metadata has an incomplete dependency specification
+  importlib-metadata = super.importlib-metadata.overrideAttrs (
+    old: {
+      propagatedBuildInputs = old.propagatedBuildInputs ++ lib.optional self.python.isPy2 self.pathlib2;
+    }
+  );
+
   lap = super.lap.overrideAttrs (
     old: {
       propagatedBuildInputs = old.propagatedBuildInputs ++ [
@@ -154,6 +153,11 @@ in
     }
   );
 
+  # Calls Cargo at build time for source builds and is really tricky to package
+  maturin = super.maturin.override {
+    preferWheel = true;
+  };
+
   mccabe = super.mccabe.overrideAttrs (
     old: {
       postPatch = ''
@@ -293,6 +297,93 @@ in
     }
   );
 
+  pyqt5 = super.pyqt5.overridePythonAttrs (
+    old: {
+      format = "other";
+
+      nativeBuildInputs = old.nativeBuildInputs ++ [
+        pkgs.pkgconfig
+        pkgs.qt5.qmake
+        pkgs.xorg.lndir
+        pkgs.qt5.qtbase
+        pkgs.qt5.qtsvg
+        pkgs.qt5.qtdeclarative
+        pkgs.qt5.qtwebchannel
+        # self.pyqt5-sip
+        self.sip
+      ];
+
+      buildInputs = old.buildInputs ++ [
+        pkgs.dbus
+        pkgs.qt5.qtbase
+        pkgs.qt5.qtsvg
+        pkgs.qt5.qtdeclarative
+        self.sip
+      ];
+
+      # Fix dbus mainloop
+      inherit (pkgs.python3.pkgs.pyqt5) patches;
+
+      configurePhase = ''
+        runHook preConfigure
+
+        export PYTHONPATH=$PYTHONPATH:$out/${self.python.sitePackages}
+
+        mkdir -p $out/${self.python.sitePackages}/dbus/mainloop
+        ${self.python.executable} configure.py  -w \
+          --confirm-license \
+          --no-qml-plugin \
+          --bindir=$out/bin \
+          --destdir=$out/${self.python.sitePackages} \
+          --stubsdir=$out/${self.python.sitePackages}/PyQt5 \
+          --sipdir=$out/share/sip/PyQt5 \
+          --designer-plugindir=$out/plugins/designer
+
+        runHook postConfigure
+      '';
+
+      postInstall = ''
+        ln -s ${self.pyqt5-sip}/${self.python.sitePackages}/PyQt5/sip.* $out/${self.python.sitePackages}/PyQt5/
+        for i in $out/bin/*; do
+          wrapProgram $i --prefix PYTHONPATH : "$PYTHONPATH"
+        done
+
+        # # Let's make it a namespace package
+        # cat << EOF > $out/${self.python.sitePackages}/PyQt5/__init__.py
+        # from pkgutil import extend_path
+        # __path__ = extend_path(__path__, __name__)
+        # EOF
+      '';
+
+      installCheckPhase = let
+        modules = [
+          "PyQt5"
+          "PyQt5.QtCore"
+          "PyQt5.QtQml"
+          "PyQt5.QtWidgets"
+          "PyQt5.QtGui"
+        ];
+        imports = lib.concatMapStrings (module: "import ${module};") modules;
+      in
+        ''
+          echo "Checking whether modules can be imported..."
+          ${self.python.interpreter} -c "${imports}"
+        '';
+
+      doCheck = true;
+
+      enableParallelBuilding = true;
+    }
+  );
+
+  pytest-datadir = super.pytest-datadir.overrideAttrs (
+    old: {
+      postInstall = ''
+        rm -f $out/LICENSE
+      '';
+    }
+  );
+
   python-prctl = super.python-prctl.overrideAttrs (
     old: {
       buildInputs = old.buildInputs ++ [
@@ -340,6 +431,14 @@ in
     }
   );
 
+  vose-alias-method = super.pytest-datadir.overrideAttrs (
+    old: {
+      postInstall = ''
+        rm -f $out/LICENSE
+      '';
+    }
+  );
+
   # Stop infinite recursion by using bootstrapped pkg from nixpkgs
   wheel = (
     pkgs.python3.pkgs.override {
diff --git a/pkgs/development/tools/prospector/default.nix b/pkgs/development/tools/prospector/default.nix
new file mode 100644
index 000000000000..38472ce86f01
--- /dev/null
+++ b/pkgs/development/tools/prospector/default.nix
@@ -0,0 +1,74 @@
+{ lib
+, pkgs
+, python
+}:
+
+let
+  py = python.override {
+    packageOverrides = self: super: {
+      pep8-naming = super.pep8-naming.overridePythonAttrs(oldAttrs: rec {
+        version = "0.4.1";
+        src = oldAttrs.src.override {
+          inherit version;
+          sha256 = "0nhf8p37y008shd4f21bkj5pizv8q0l8cpagyyb8gr059d6gvvaf";
+        };
+      });
+    };
+  };
+  setoptconf = py.pkgs.callPackage ./setoptconf.nix { };
+in
+
+with py.pkgs;
+
+buildPythonApplication rec {
+  pname = "prospector";
+  version = "1.2.0";
+  disabled = isPy27;
+
+  src = pkgs.fetchFromGitHub {
+    owner = "PyCQA";
+    repo = pname;
+    rev = version;
+    sha256 = "07kb37zrrsriqzcmli0ghx7qb1iwkzh83qsiikl9jy50faby2sjg";
+  };
+
+  checkInputs = [
+    pytest
+  ];
+
+  checkPhase = ''
+    pytest
+  '';
+
+  patchPhase = ''
+    substituteInPlace setup.py \
+      --replace 'pycodestyle<=2.4.0' 'pycodestyle<=2.5.0'
+  '';
+
+  propagatedBuildInputs = [
+    astroid
+    django
+    dodgy
+    mccabe
+    pep8-naming
+    pycodestyle
+    pydocstyle
+    pyflakes
+    pylint
+    pylint-celery
+    pylint-django
+    pylint-flask
+    pyyaml
+    requirements-detector
+    setoptconf
+  ];
+
+  meta = with lib; {
+    description = "Tool to analyse Python code and output information about errors, potential problems, convention violations and complexity";
+    homepage = "https://github.com/PyCQA/prospector";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [
+      kamadorueda
+    ];
+  };
+}
diff --git a/pkgs/development/tools/prospector/setoptconf.nix b/pkgs/development/tools/prospector/setoptconf.nix
new file mode 100644
index 000000000000..62b4e95357dc
--- /dev/null
+++ b/pkgs/development/tools/prospector/setoptconf.nix
@@ -0,0 +1,26 @@
+{ buildPythonPackage
+, fetchPypi
+, lib
+}:
+
+buildPythonPackage rec {
+  pname = "setoptconf";
+  version = "0.2.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "177l7j68j751i781bgk6pfhxjj7hwqxzdm2ja5fkywbp0275s2sv";
+  };
+
+  # Base tests provided via PyPi are broken
+  doCheck = false;
+
+  meta = with lib; {
+    homepage = "https://pypi.org/project/setoptconf";
+    description = "A module for retrieving program settings from various sources in a consistant method";
+    license = licenses.mit;
+    maintainers = with maintainers; [
+      kamadorueda
+    ];
+  };
+}
diff --git a/pkgs/development/tools/rnix-lsp/default.nix b/pkgs/development/tools/rnix-lsp/default.nix
new file mode 100644
index 000000000000..37a1955ce8b2
--- /dev/null
+++ b/pkgs/development/tools/rnix-lsp/default.nix
@@ -0,0 +1,22 @@
+{ callPackage, lib, fetchFromGitHub, rustPlatform }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "rnix-lsp";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "nix-community";
+    repo = "rnix-lsp";
+    rev = "v${version}";
+
+    sha256 = "0fy620c34kxl27sd62x9mj0555bcdmnmbsxavmyiwb497z1m9wnn";
+  };
+
+  cargoSha256 = "1wm5m7b6zr6wg1k59rmqis1zp9i2990p7y0ml852hxv34an7pp5d";
+
+  meta = with lib; {
+    description = "A work-in-progress language server for Nix, with syntax checking and basic completion";
+    license = licenses.mit;
+    maintainers = with maintainers; [ jD91mZM2 ];
+  };
+}
diff --git a/pkgs/development/tools/vagrant/default.nix b/pkgs/development/tools/vagrant/default.nix
index 4ef723c9a1fa..ea3382f3e706 100644
--- a/pkgs/development/tools/vagrant/default.nix
+++ b/pkgs/development/tools/vagrant/default.nix
@@ -33,6 +33,8 @@ let
       for gem in "$out"/lib/ruby/gems/*/gems/*; do
         cp -a "$gem/" "$gem.new"
         rm "$gem"
+        # needed on macOS, otherwise the mv yields permission denied 
+        chmod +w "$gem.new"
         mv "$gem.new" "$gem"
       done
     '';
diff --git a/pkgs/games/dwarf-fortress/dfhack/default.nix b/pkgs/games/dwarf-fortress/dfhack/default.nix
index 544fa26b21cc..5706337dffd7 100644
--- a/pkgs/games/dwarf-fortress/dfhack/default.nix
+++ b/pkgs/games/dwarf-fortress/dfhack/default.nix
@@ -109,7 +109,7 @@ let
     '';
 
     preBuild = ''
-      export LD_LIBRARY_PATH="$PWD/depends/protobuf:$LD_LIBRARY_PATH"
+      export LD_LIBRARY_PATH="$PWD/depends/protobuf''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
     '';
 
     cmakeFlags = [ "-DDFHACK_BUILD_ARCH=${arch}" "-DDOWNLOAD_RUBY=OFF" ]
diff --git a/pkgs/games/dwarf-fortress/wrapper/dfhack.in b/pkgs/games/dwarf-fortress/wrapper/dfhack.in
index 4cf884ebed2c..026b33ab87bf 100644
--- a/pkgs/games/dwarf-fortress/wrapper/dfhack.in
+++ b/pkgs/games/dwarf-fortress/wrapper/dfhack.in
@@ -7,5 +7,5 @@ for i in dfhack.init-example dfhack-config/default hack/* stonesense/*; do
 done
 
 cd "$DF_DIR"
-LD_LIBRARY_PATH="$env_dir/hack/libs:$env_dir/hack:$LD_LIBRARY_PATH" \
+LD_LIBRARY_PATH="$env_dir/hack/libs:$env_dir/hack${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH" \
   LD_PRELOAD="$env_dir/hack/libdfhack.so:$LD_PRELOAD" exec $env_dir/libs/Dwarf_Fortress "$@"
diff --git a/pkgs/games/mindustry/default.nix b/pkgs/games/mindustry/default.nix
new file mode 100644
index 000000000000..0b3824f2ec82
--- /dev/null
+++ b/pkgs/games/mindustry/default.nix
@@ -0,0 +1,106 @@
+{ stdenv
+, makeWrapper
+, makeDesktopItem
+, fetchFromGitHub
+, gradle_5
+, perl
+, jre
+, libpulseaudio
+
+# Make the build version easily overridable.
+# Server and client build versions must match, and an empty build version means
+# any build is allowed, so this parameter acts as a simple whitelist.
+# Takes the package version and returns the build version.
+, makeBuildVersion ? (v: v)
+}:
+
+let
+  pname = "mindustry";
+  # Note: when raising the version, ensure that all SNAPSHOT versions in
+  # build.gradle are replaced by a fixed version
+  # (the current one at the time of release) (see postPatch).
+  version = "102";
+  buildVersion = makeBuildVersion version;
+
+  src = fetchFromGitHub {
+    owner = "Anuken";
+    repo = "Mindustry";
+    rev = "v${version}";
+    sha256 = "0g4zy2zlynv6f427pq1ngnl0zpr6nnih10wd2l8vl9bxwzjygwdr";
+  };
+
+  desktopItem = makeDesktopItem {
+    type = "Application";
+    name = "Mindustry";
+    desktopName = "Mindustry";
+    exec = "mindustry";
+    icon = "mindustry";
+  };
+
+  postPatch = ''
+    # Remove unbuildable iOS stuff
+    sed -i '/^project(":ios"){/,/^}/d' build.gradle
+    sed -i '/robo(vm|VM)/d' build.gradle
+    rm ios/build.gradle
+
+    # Pin 'SNAPSHOT' versions
+    sed -i 's/com.github.anuken:packr:-SNAPSHOT/com.github.anuken:packr:034efe51781d2d8faa90370492133241bfb0283c/' build.gradle
+  '';
+
+  # fake build to pre-download deps into fixed-output derivation
+  deps = stdenv.mkDerivation {
+    pname = "${pname}-deps";
+    inherit version src postPatch;
+    nativeBuildInputs = [ gradle_5 perl ];
+    buildPhase = ''
+      export GRADLE_USER_HOME=$(mktemp -d)
+      gradle --no-daemon desktop:dist -Pbuildversion=${buildVersion}
+      gradle --no-daemon server:dist -Pbuildversion=${buildVersion}
+    '';
+    # perl code mavenizes pathes (com.squareup.okio/okio/1.13.0/a9283170b7305c8d92d25aff02a6ab7e45d06cbe/okio-1.13.0.jar -> com/squareup/okio/okio/1.13.0/okio-1.13.0.jar)
+    installPhase = ''
+      find $GRADLE_USER_HOME/caches/modules-2 -type f -regex '.*\.\(jar\|pom\)' \
+        | perl -pe 's#(.*/([^/]+)/([^/]+)/([^/]+)/[0-9a-f]{30,40}/([^/\s]+))$# ($x = $2) =~ tr|\.|/|; "install -Dm444 $1 \$out/$x/$3/$4/$5" #e' \
+        | sh
+    '';
+    outputHashAlgo = "sha256";
+    outputHashMode = "recursive";
+    outputHash = "1sscxrr32f2agwz34pm491xqkz7m4bwdc1p3g64kcnl3p6rg7r7k";
+  };
+
+in stdenv.mkDerivation rec {
+  inherit pname version src postPatch;
+
+  nativeBuildInputs = [ gradle_5 makeWrapper ];
+
+  buildPhase = ''
+    export GRADLE_USER_HOME=$(mktemp -d)
+    # point to offline repo
+    sed -ie "s#mavenLocal()#mavenLocal(); maven { url '${deps}' }#g" build.gradle
+    gradle --offline --no-daemon desktop:dist -Pbuildversion=${buildVersion}
+    gradle --offline --no-daemon server:dist -Pbuildversion=${buildVersion}
+  '';
+
+  installPhase = ''
+    install -Dm644 desktop/build/libs/Mindustry.jar $out/share/mindustry.jar
+    install -Dm644 server/build/libs/server-release.jar $out/share/mindustry-server.jar
+    mkdir $out/bin
+    makeWrapper ${jre}/bin/java $out/bin/mindustry \
+      --prefix LD_LIBRARY_PATH : ${libpulseaudio}/lib \
+      --add-flags "-jar $out/share/mindustry.jar"
+    makeWrapper ${jre}/bin/java $out/bin/mindustry-server \
+      --add-flags "-jar $out/share/mindustry-server.jar"
+    install -Dm644 core/assets/icons/icon_64.png $out/share/icons/hicolor/64x64/apps/mindustry.png
+    install -Dm644 ${desktopItem}/share/applications/Mindustry.desktop $out/share/applications/Mindustry.desktop
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "https://mindustrygame.github.io/";
+    downloadPage = "https://github.com/Anuken/Mindustry/releases";
+    description = "A sandbox tower defense game";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ fgaz ];
+    platforms = platforms.all;
+  };
+}
+
diff --git a/pkgs/games/steam/chrootenv.nix b/pkgs/games/steam/chrootenv.nix
index 9229f4fbc93e..4245704575c4 100644
--- a/pkgs/games/steam/chrootenv.nix
+++ b/pkgs/games/steam/chrootenv.nix
@@ -53,7 +53,7 @@ let
       echo "$runtime_paths"
       exit 0
     fi
-    export LD_LIBRARY_PATH="$runtime_paths:$LD_LIBRARY_PATH"
+    export LD_LIBRARY_PATH="$runtime_paths''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
     exec "$@"
   '';
 
@@ -260,7 +260,7 @@ in buildFHSUserEnv rec {
         exit 1
       fi
       shift
-      ${lib.optionalString (!nativeOnly) "export LD_LIBRARY_PATH=/lib32:/lib64:${lib.concatStringsSep ":" ldPath}:$LD_LIBRARY_PATH"}
+      ${lib.optionalString (!nativeOnly) "export LD_LIBRARY_PATH=/lib32:/lib64:${lib.concatStringsSep ":" ldPath}\${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"}
       exec -- "$run" "$@"
     '';
   };
diff --git a/pkgs/games/ultrastardx/default.nix b/pkgs/games/ultrastardx/default.nix
index 1c40d8f5800f..feaf6cabf32a 100644
--- a/pkgs/games/ultrastardx/default.nix
+++ b/pkgs/games/ultrastardx/default.nix
@@ -12,21 +12,19 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "ultrastardx";
-  version = "2017.8.0";
+  version = "unstable-2019-01-07";
   src = fetchFromGitHub {
     owner = "UltraStar-Deluxe";
     repo = "USDX";
-    rev = "v${version}";
-    sha256 = "1zp0xfwzci3cjmwx3cprcxvm60cik5cvhvrz9n4d6yb8dv38nqzm";
+    rev = "3df142590f29db1505cc58746af9f8cf7cb4a6a5";
+    sha256 = "EpwGKK9B8seF7gRwo3kCeSzFQQW1p8rP4HXeu8/LoyA=";
   };
 
   nativeBuildInputs = [ pkgconfig autoreconfHook ];
   buildInputs = [ fpc libpng ] ++ sharedLibs;
 
-  # https://github.com/UltraStar-Deluxe/USDX/issues/462
   postPatch = ''
     substituteInPlace src/config.inc.in \
-      --subst-var-by lua_LIB_NAME liblua.so \
       --subst-var-by libpcre_LIBNAME libpcre.so.1
   '';
 
diff --git a/pkgs/misc/cups/default.nix b/pkgs/misc/cups/default.nix
index d18829673cc7..6786623fee3e 100644
--- a/pkgs/misc/cups/default.nix
+++ b/pkgs/misc/cups/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   pname = "cups";
 
   # After 2.2.6, CUPS requires headers only available in macOS 10.12+
-  version = if stdenv.isDarwin then "2.2.6" else "2.3.0";
+  version = if stdenv.isDarwin then "2.2.6" else "2.3.1";
 
   passthru = { inherit version; };
 
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     url = "https://github.com/apple/cups/releases/download/v${version}/cups-${version}-source.tar.gz";
     sha256 = if version == "2.2.6"
              then "16qn41b84xz6khrr2pa2wdwlqxr29rrrkjfi618gbgdkq9w5ff20"
-             else "19d1jpdpxy0fclq37pchi7ldnw9dssxx3zskcgqai3h0rwlh5bxc";
+             else "1kkpmj17205j8w9hdff2bfpk6lwdmr3gx0j4r35nhgvya24rvjhv";
   };
 
   outputs = [ "out" "lib" "dev" "man" ];
diff --git a/pkgs/misc/emulators/retroarch/cores.nix b/pkgs/misc/emulators/retroarch/cores.nix
index 45ed31168f00..2176d53628fa 100644
--- a/pkgs/misc/emulators/retroarch/cores.nix
+++ b/pkgs/misc/emulators/retroarch/cores.nix
@@ -786,10 +786,11 @@ in with stdenv.lib.licenses;
 
   snes9x = (mkLibRetroCore rec {
     core = "snes9x";
-    src = fetchRetro {
+    src = fetchFromGitHub {
+      owner = "snes9xgit";
       repo = core;
-      rev = "29b78df8c9f0f48ed4605d08a187a134b3b316d6";
-      sha256 = "004h1pkxvbn4zlh8bqs6z17k04jw5wzbwklpgvmb7hbxshsi4qid";
+      rev = "04692e1ee45cc647423774ee17c63208c2713638";
+      sha256 = "09p9m85fxwrrrapjb08rcxknpgq5d6a87arrm1jn94r56glxlcfa";
     };
     description = "Port of SNES9x git to libretro";
     license = "Non-commercial";
diff --git a/pkgs/misc/vim-plugins/generated.nix b/pkgs/misc/vim-plugins/generated.nix
index 425ac9a09945..134162717037 100644
--- a/pkgs/misc/vim-plugins/generated.nix
+++ b/pkgs/misc/vim-plugins/generated.nix
@@ -50,12 +50,12 @@ let
 
   alchemist-vim = buildVimPluginFrom2Nix {
     pname = "alchemist-vim";
-    version = "2019-11-27";
+    version = "2020-01-10";
     src = fetchFromGitHub {
       owner = "slashmili";
       repo = "alchemist.vim";
-      rev = "911eda990ef259d1f035061c5dfb2f44adb2697e";
-      sha256 = "04lm3k6svq4y2a7kqq5phzyny93ynnjdmsv2s98pw6c4z5fq5y1m";
+      rev = "a5158d2e731afe3bca25a6a76eb706ff34e155b0";
+      sha256 = "0r1xiw0f46if7whxan2asi1klyijlyaf61p0xg5v81nnh64w6lhs";
     };
   };
 
@@ -193,12 +193,12 @@ let
 
   bufexplorer = buildVimPluginFrom2Nix {
     pname = "bufexplorer";
-    version = "2019-02-13";
+    version = "2020-01-10";
     src = fetchFromGitHub {
       owner = "jlanzarotta";
       repo = "bufexplorer";
-      rev = "162f6031ada3b2d1ad171e02e93f417ee1689176";
-      sha256 = "0ws8yw1s77pb0gm5wvj5w5symx8fqqzcdizds8cg47cfmw97zz1h";
+      rev = "8014787603fff635dfae6afd4dbe9297673a0b39";
+      sha256 = "0drj8q6wg9h08nf517l0dks1fbcnc558zg7dqavxc43maymq5mxm";
     };
   };
 
@@ -424,23 +424,23 @@ let
 
   coc-metals = buildVimPluginFrom2Nix {
     pname = "coc-metals";
-    version = "2020-01-03";
+    version = "2020-01-13";
     src = fetchFromGitHub {
       owner = "ckipp01";
       repo = "coc-metals";
-      rev = "a2c71dc75b35251549d1ba2cdb5f9ee286ab9f90";
-      sha256 = "0hzd7m1rli2vgwvykrv9ld5q9na867l5d56fl02d7d3q9ykfn6j7";
+      rev = "b2b3c6e43f8dc0a9353046faacb2cfafe0220228";
+      sha256 = "160y5rz1nhpdlb9j3ximn6ylj0rabkbvl0h7jil95rin60sq91d1";
     };
   };
 
   coc-neco = buildVimPluginFrom2Nix {
     pname = "coc-neco";
-    version = "2019-09-23";
+    version = "2020-01-11";
     src = fetchFromGitHub {
       owner = "neoclide";
       repo = "coc-neco";
-      rev = "e6eb1ccc2ab98966fe678107c6da0d4ddfa34f10";
-      sha256 = "14lph4dg7q0s5yjdr8snz9yl7bn6gs42ikizb6mxq43qqfdnxzdx";
+      rev = "e203327ff80c56fc51d85f73df9049455edf1a56";
+      sha256 = "1snfb92pahdfkch0cwhd0pcmia35al518351np2hq8dhbs7fc02n";
     };
   };
 
@@ -523,12 +523,12 @@ let
 
   coc-solargraph = buildVimPluginFrom2Nix {
     pname = "coc-solargraph";
-    version = "2019-08-11";
+    version = "2020-01-11";
     src = fetchFromGitHub {
       owner = "neoclide";
       repo = "coc-solargraph";
-      rev = "6a146623192e661e18830c58abe1055fddcf57d7";
-      sha256 = "1mc8jqpgwy5q4jzb5p09j5mal9paq50dl1hsxhg0y5q6rqrr7qhz";
+      rev = "c767dd19c8d07920e10f126b4b71f187c7bdcb6a";
+      sha256 = "014k1sqjfzcr052vnqnr5ccxpw2yr0dfgd0657nwjgbhnpf8qn3s";
     };
   };
 
@@ -545,12 +545,12 @@ let
 
   coc-tabnine = buildVimPluginFrom2Nix {
     pname = "coc-tabnine";
-    version = "2019-12-10";
+    version = "2020-01-06";
     src = fetchFromGitHub {
       owner = "neoclide";
       repo = "coc-tabnine";
-      rev = "f72b4f47109918cc6ad43b42ed566bec61feff8e";
-      sha256 = "1jaj6qsascdpdyz0g8yvi7bcxf4jwcrb0766x4dsmfk9r7prxifl";
+      rev = "442c829185ecab2268d1b9fd076c5286bbd39562";
+      sha256 = "0as4b33nnp7anqbxkkja8lp37y4a74b3507zyk3gmmna0my1ca3r";
     };
   };
 
@@ -700,12 +700,12 @@ let
 
   context_filetype-vim = buildVimPluginFrom2Nix {
     pname = "context_filetype-vim";
-    version = "2019-08-17";
+    version = "2020-01-08";
     src = fetchFromGitHub {
       owner = "Shougo";
       repo = "context_filetype.vim";
-      rev = "9d495ce4ddfdae8f0b268fcec3a7a5e0062456e8";
-      sha256 = "0g5ixgg8p2vrpjhyy52xln7a5f8rcbglgyir620ynzhz1phdilg4";
+      rev = "cbe3c0069e6a13bd9bfcd9739c0770f7fd4b4ef4";
+      sha256 = "07mnch8vi7snx8jfz32hkg4v4ml2ywb8yn0jycshn317j253fbmj";
     };
   };
 
@@ -808,17 +808,6 @@ let
     };
   };
 
-  defx-icons = buildVimPluginFrom2Nix {
-    pname = "defx-icons";
-    version = "2019-11-03";
-    src = fetchFromGitHub {
-      owner = "kristijanhusak";
-      repo = "defx-icons";
-      rev = "1412fd083eb54ffedb4f3ae32ddc7ce28613a144";
-      sha256 = "1x0xpixbmxm15g5nmsslccdngm14sg86ymy6mywg9xfbnrh1vn0p";
-    };
-  };
-
   defx-git = buildVimPluginFrom2Nix {
     pname = "defx-git";
     version = "2019-12-25";
@@ -830,14 +819,25 @@ let
     };
   };
 
+  defx-icons = buildVimPluginFrom2Nix {
+    pname = "defx-icons";
+    version = "2019-11-03";
+    src = fetchFromGitHub {
+      owner = "kristijanhusak";
+      repo = "defx-icons";
+      rev = "1412fd083eb54ffedb4f3ae32ddc7ce28613a144";
+      sha256 = "1x0xpixbmxm15g5nmsslccdngm14sg86ymy6mywg9xfbnrh1vn0p";
+    };
+  };
+
   defx-nvim = buildVimPluginFrom2Nix {
     pname = "defx-nvim";
-    version = "2020-01-02";
+    version = "2020-01-08";
     src = fetchFromGitHub {
       owner = "Shougo";
       repo = "defx.nvim";
-      rev = "aa1b5c762bbabaeeb5f3eca976e65bbb2f82a883";
-      sha256 = "0pfsky4i4h769fjmrvy89d9ickkfifvmq0m54c6qhs24bycx0s7j";
+      rev = "2823cfbf37ae86bf20b56a4dacff123c54dc85fa";
+      sha256 = "0hbmdkwfhihjn1sxlznhv6fls8zgfvm7srigw8anxh7zr7rx2qz3";
     };
   };
 
@@ -876,12 +876,12 @@ let
 
   denite-nvim = buildVimPluginFrom2Nix {
     pname = "denite-nvim";
-    version = "2020-01-05";
+    version = "2020-01-13";
     src = fetchFromGitHub {
       owner = "Shougo";
       repo = "denite.nvim";
-      rev = "908cd3a3fe5b03783da7186441b2fe0c146f31b3";
-      sha256 = "0qrz0mrrx79525rzab0l1qx3q49531306b05hgqrlkzx9zcppk8l";
+      rev = "22dd7524bef3468af674fb1ecfb3e55ee679ebc0";
+      sha256 = "03cf90kvq337mj151y5m0w5px6h3y6hanfj2bcxwnpwifmjdinij";
     };
   };
 
@@ -978,12 +978,12 @@ let
 
   deoplete-lsp = buildVimPluginFrom2Nix {
     pname = "deoplete-lsp";
-    version = "2019-12-24";
+    version = "2020-01-10";
     src = fetchFromGitHub {
       owner = "Shougo";
       repo = "deoplete-lsp";
-      rev = "0985ba9f5a5f35521087b9ca0858c96ab3785158";
-      sha256 = "09bfsd217qi1ndfrfrjla1vlhnp8r9q9qirkwjjajbqhk4ws90pm";
+      rev = "7a8c44f423bc4339c092a759abaad40131d2c98a";
+      sha256 = "1gg9j26xq668s4gbww0p2x8pkh3ssbzgyp2hxppk2ws7x8c2cihi";
     };
   };
 
@@ -1022,12 +1022,12 @@ let
 
   deoplete-nvim = buildVimPluginFrom2Nix {
     pname = "deoplete-nvim";
-    version = "2019-12-27";
+    version = "2020-01-10";
     src = fetchFromGitHub {
       owner = "Shougo";
       repo = "deoplete.nvim";
-      rev = "840c46aed8033efe19c7a5a809713c809b4a6bb5";
-      sha256 = "09bivhh6iig9vskia9fz1cz2c6dbn3xf4cgm77z9ppaii00n9wh3";
+      rev = "1e1af97ed05f12ad16104365d40e1f26a3e98a1d";
+      sha256 = "01zgvadp7h47ni9bvvgbg68vxb0hijw670xyps557ii4aadkk28f";
     };
   };
 
@@ -1245,12 +1245,12 @@ let
 
   fzf-vim = buildVimPluginFrom2Nix {
     pname = "fzf-vim";
-    version = "2019-12-22";
+    version = "2020-01-10";
     src = fetchFromGitHub {
       owner = "junegunn";
       repo = "fzf.vim";
-      rev = "76669c3c1d675833f9d89f6496f16a7accc0f40e";
-      sha256 = "0p5z9bljjfnp4kkpf9pb5zwv5l9xdk3aikpfxjj8scafl99k4m5r";
+      rev = "8a6894d6a560497bd35947f55ece381bf4f2d9ed";
+      sha256 = "17f64c3z03g45iw68ir9wszq3bjlk661ccy87g0wxvl2pkcmnk53";
     };
   };
 
@@ -1278,12 +1278,12 @@ let
 
   ghcid = buildVimPluginFrom2Nix {
     pname = "ghcid";
-    version = "2019-12-14";
+    version = "2020-01-09";
     src = fetchFromGitHub {
       owner = "ndmitchell";
       repo = "ghcid";
-      rev = "723054642faf15082bbad6a0d6db921918e5db61";
-      sha256 = "0ln5y7jfd4m59ci39zffjmzi9bda0bck7mkxk0i5fyp4whp8jqdr";
+      rev = "40a6ed21bc811e7795c525ce9a4fc689c6b99f60";
+      sha256 = "020g3032gggxllnapqf7nbg5wqjg3c2z190f2jx3cl6z0fswgiwz";
     };
   };
 
@@ -1300,12 +1300,12 @@ let
 
   gist-vim = buildVimPluginFrom2Nix {
     pname = "gist-vim";
-    version = "2019-07-08";
+    version = "2020-01-09";
     src = fetchFromGitHub {
       owner = "mattn";
       repo = "gist-vim";
-      rev = "e485c6c24a62b378a2a4c8687e36e7f54ceca18c";
-      sha256 = "1fkm7aada088l9f5rf6fk1valfanwzfrsfip9w4q9w2mqvd7n1kn";
+      rev = "c1f9b5aef7fa68f5151e62ceadbc9a9c48d58962";
+      sha256 = "0q83dqhp3n0hj0mdkvj2kilywpqy512r1vpay0f9z57vkx29grzr";
     };
   };
 
@@ -1531,12 +1531,12 @@ let
 
   jedi-vim = buildVimPluginFrom2Nix {
     pname = "jedi-vim";
-    version = "2020-01-01";
+    version = "2020-01-10";
     src = fetchFromGitHub {
       owner = "davidhalter";
       repo = "jedi-vim";
-      rev = "2572136fcb4c9941553dd05504007806613c8946";
-      sha256 = "08fdaxaldbmg76bkj0xni4cpgqiss4cdxnv3jxskwvs6v9dxmbcs";
+      rev = "c0ded0baf2971cec3698d7c799c04ad971a1484d";
+      sha256 = "0bbivgm62a9v28r968dsx174km72an9xxz98r1r4z5krllccilab";
       fetchSubmodules = true;
     };
   };
@@ -1675,12 +1675,12 @@ let
 
   lh-vim-lib = buildVimPluginFrom2Nix {
     pname = "lh-vim-lib";
-    version = "2019-12-29";
+    version = "2020-01-12";
     src = fetchFromGitHub {
       owner = "LucHermitte";
       repo = "lh-vim-lib";
-      rev = "6e60e3a6575449e08feb27fb3528b55e71fd56e3";
-      sha256 = "054wxj8f23ddqs3mp8rvw2lsplqfyn352zcq6biywbybjm2xphf7";
+      rev = "13a59968c0d76884f2ef1feb27493ba90d62deb0";
+      sha256 = "0g9dfg7y7znj3iiz67323jbflg6d34hq8hc8v4gcjnrinagyydnv";
     };
   };
 
@@ -1928,12 +1928,12 @@ let
 
   neomake = buildVimPluginFrom2Nix {
     pname = "neomake";
-    version = "2019-12-20";
+    version = "2020-01-07";
     src = fetchFromGitHub {
       owner = "neomake";
       repo = "neomake";
-      rev = "212c0d8b05ee65b9be77675db147d05abd323a46";
-      sha256 = "0fjmrnmnqjb1r4cxbrlxwpwbm7jgs47wx6pql565946adv5bckh2";
+      rev = "2669c679fa2d39457eba3f84f50404d7994e22cf";
+      sha256 = "1ag11acrg32qgwn0c3lsv7ai0f8hs3hklpnqjx84jb0kb1fqp8s2";
     };
   };
 
@@ -1961,12 +1961,12 @@ let
 
   neosnippet-vim = buildVimPluginFrom2Nix {
     pname = "neosnippet-vim";
-    version = "2019-12-28";
+    version = "2020-01-08";
     src = fetchFromGitHub {
       owner = "Shougo";
       repo = "neosnippet.vim";
-      rev = "6cccbd41851f3d8f47c5e225d552a217cede4f3f";
-      sha256 = "0jrdya11fzis746x1s802g2w20v47dhaxlmczb2fv4x3fxfwql5p";
+      rev = "5673f584c06431978a17609865f2adcf5e934be3";
+      sha256 = "05g4dixqn584h6z2w7va676q74fl1839f86wsjfm09kfdlql4n1m";
     };
   };
 
@@ -2038,12 +2038,12 @@ let
 
   nerdtree = buildVimPluginFrom2Nix {
     pname = "nerdtree";
-    version = "2020-01-02";
+    version = "2020-01-06";
     src = fetchFromGitHub {
       owner = "scrooloose";
       repo = "nerdtree";
-      rev = "8a14891241e3468f9c13deaa6cf88aebe53b519f";
-      sha256 = "033qnzna0awys5w5wf9sj2gydm433l1919zz9cm984l0nmgmkp29";
+      rev = "ee79ecfb67e4403e54ea59c175ca4d39544395e8";
+      sha256 = "0zny0ycxfkcfj65y8m70spj96lv81fv52s07r8ncfa4bqm9kk9sd";
     };
   };
 
@@ -2102,6 +2102,17 @@ let
     };
   };
 
+  nvim-gdb = buildVimPluginFrom2Nix {
+    pname = "nvim-gdb";
+    version = "2019-10-28";
+    src = fetchFromGitHub {
+      owner = "sakhnik";
+      repo = "nvim-gdb";
+      rev = "aa343ab3089cb520289a614a7b7c71f43134b34a";
+      sha256 = "0qn0mq59x8jdkjvv47g2fjxnagvpa7pb01vl4jjrdwq34639i1bg";
+    };
+  };
+
   nvim-hs-vim = buildVimPluginFrom2Nix {
     pname = "nvim-hs-vim";
     version = "2019-04-14";
@@ -2487,6 +2498,17 @@ let
     };
   };
 
+  salt-vim = buildVimPluginFrom2Nix {
+    pname = "salt-vim";
+    version = "2017-07-01";
+    src = fetchFromGitHub {
+      owner = "saltstack";
+      repo = "salt-vim";
+      rev = "6ca9e3500cc39dd417b411435d58a1b720b331cc";
+      sha256 = "0r79bpl98xcsmkw6dg83cf1ghn89rzsr011zirk3v1wfxclri2c4";
+    };
+  };
+
   self = buildVimPluginFrom2Nix {
     pname = "self";
     version = "2014-05-28";
@@ -2687,12 +2709,12 @@ let
 
   syntastic = buildVimPluginFrom2Nix {
     pname = "syntastic";
-    version = "2019-11-20";
+    version = "2020-01-12";
     src = fetchFromGitHub {
       owner = "scrooloose";
       repo = "syntastic";
-      rev = "39b35b23b952d620b8ec7cabb13110f586663837";
-      sha256 = "1nc3019c969ms6m0hrj5k1kggcvsywn6j7kz0scdwzvfd6bcla6h";
+      rev = "3b756bc1066a6df6b54415f2aa7eceaa67ee1ee4";
+      sha256 = "1c9nsg36an3jyma0bhz6c9ymmcrayim6cxn82g37skl040gksvn4";
     };
   };
 
@@ -2731,12 +2753,12 @@ let
 
   tagbar = buildVimPluginFrom2Nix {
     pname = "tagbar";
-    version = "2020-01-04";
+    version = "2020-01-08";
     src = fetchFromGitHub {
       owner = "majutsushi";
       repo = "tagbar";
-      rev = "3753b235a1163cfbc3b7c417825d1910b2f66100";
-      sha256 = "16nw145n17d9fnwhcp42k85sf2mx2nyp7wy4gllhw48xnwgh6qpb";
+      rev = "3bd3ba403dfaf5868656264f979fc0dc63526afb";
+      sha256 = "1s9y6qxvys393gsql4x5v0y2wfdb8b2a7mv8a39as98msq67a4sx";
     };
   };
 
@@ -2875,12 +2897,12 @@ let
 
   tsuquyomi = buildVimPluginFrom2Nix {
     pname = "tsuquyomi";
-    version = "2019-07-17";
+    version = "2020-01-13";
     src = fetchFromGitHub {
       owner = "Quramy";
       repo = "tsuquyomi";
-      rev = "61e16ab1d1cb621385bc9c6a0c5e7744494ec9f5";
-      sha256 = "1w6m69695f4gx7d5fg3bnabhjx1680fvrz44f65jhdh2y2njm68h";
+      rev = "1fc47734abcb272df4321a50e2587c4c9e0a0a1a";
+      sha256 = "0dwc22zhzslgk60slr60rn26ww3ppl52nf6pcbnagxwfzadn5l6z";
     };
   };
 
@@ -2919,12 +2941,12 @@ let
 
   unicode-vim = buildVimPluginFrom2Nix {
     pname = "unicode-vim";
-    version = "2019-11-06";
+    version = "2020-01-06";
     src = fetchFromGitHub {
       owner = "chrisbra";
       repo = "unicode.vim";
-      rev = "49f79785e7fba0f40519a6b9074dcceb8626f7d5";
-      sha256 = "1k2b4wh0244dx7zinag88wfcwl2x2042z0zsyv9b77w81h8qfdd1";
+      rev = "d450defdb29842e66b779715941a98cbf73736ea";
+      sha256 = "196fi75rvhj0lrzpzkpzvlnrncnjysxj8iww0drc1aawjfkmn1ni";
     };
   };
 
@@ -3216,23 +3238,23 @@ let
 
   vim-airline = buildVimPluginFrom2Nix {
     pname = "vim-airline";
-    version = "2020-01-03";
+    version = "2020-01-13";
     src = fetchFromGitHub {
       owner = "vim-airline";
       repo = "vim-airline";
-      rev = "66f77d4a77e54946fedaac7d54d02271751eab40";
-      sha256 = "008k8v0nx219lbn0vsc1cwr537lg0gdb9s4d7hjpdq2rhh79zsg3";
+      rev = "8d694cba9c22efe8320a8fbc919a50bd938e7929";
+      sha256 = "17kjbc13rsjaxkpfj0f90v3khzid02rrkcdjss3sqa35f37wn2bz";
     };
   };
 
   vim-airline-themes = buildVimPluginFrom2Nix {
     pname = "vim-airline-themes";
-    version = "2020-01-03";
+    version = "2020-01-07";
     src = fetchFromGitHub {
       owner = "vim-airline";
       repo = "vim-airline-themes";
-      rev = "14c3a60ab0f42aa1001d8f32ffaab2c28935a1e7";
-      sha256 = "0k25x599sfaw931p5b83cpqhz5dzjxp01v3qlsi78rhjyw1y83jf";
+      rev = "9cfa14a6b7e2bd923b3f14252091ed35eda188fd";
+      sha256 = "09ap3w0ixbk5yxsyw165kh7lxmrbjlnz16a1z5qpd9d7afbl3k69";
     };
   };
 
@@ -3260,12 +3282,12 @@ let
 
   vim-asterisk = buildVimPluginFrom2Nix {
     pname = "vim-asterisk";
-    version = "2019-09-23";
+    version = "2020-01-07";
     src = fetchFromGitHub {
       owner = "haya14busa";
       repo = "vim-asterisk";
-      rev = "7cf0d8f379babbdbf538aefe3af444ac4ba21dce";
-      sha256 = "0y21ziz36sqa84dy9pv2jnr0ppalxn54bsk82zfc6064h3bqn77r";
+      rev = "66a64172d21fab44312d0d49b22f63eeeaf89b23";
+      sha256 = "1lksnr4mix9y2al2yfysrxqcska3cd82ck89fkjg5zqzb5wz20vs";
     };
   };
 
@@ -3282,12 +3304,12 @@ let
 
   vim-autoformat = buildVimPluginFrom2Nix {
     pname = "vim-autoformat";
-    version = "2019-12-04";
+    version = "2020-01-09";
     src = fetchFromGitHub {
       owner = "Chiel92";
       repo = "vim-autoformat";
-      rev = "354abcd3d533ba07eebc510102870d85d4e2c466";
-      sha256 = "1hngbjj12q5v73smyhsay4irp3q71cxyc60n97ybfik5mmm455nj";
+      rev = "4159c742ed0b547026b9e398ef78b31527b5e167";
+      sha256 = "0yq4jl252bndr45yhqwmv9mzgjsscywm0wn0lqz70xbz9ik69gvk";
     };
   };
 
@@ -3403,12 +3425,12 @@ let
 
   vim-codefmt = buildVimPluginFrom2Nix {
     pname = "vim-codefmt";
-    version = "2020-01-01";
+    version = "2020-01-13";
     src = fetchFromGitHub {
       owner = "google";
       repo = "vim-codefmt";
-      rev = "7556c68b1d68b9a2b1b4a9df838cdc4bcf87ba0a";
-      sha256 = "0bi6nbma0bwzvn7l6w88qgr4fbpfbipv936z346sh59dk17j4nv6";
+      rev = "af796cf4084a3d32b85313ccc82675d626d40b59";
+      sha256 = "0pbwirsh8nx0dgf82w1sy6az6mpwdnxzy0ycqrx6qxs6bbf1kf74";
     };
   };
 
@@ -3656,12 +3678,12 @@ let
 
   vim-easymotion = buildVimPluginFrom2Nix {
     pname = "vim-easymotion";
-    version = "2020-01-06";
+    version = "2020-01-13";
     src = fetchFromGitHub {
       owner = "easymotion";
       repo = "vim-easymotion";
-      rev = "83a09a19e7a9c51c6ca2e0f90f1dd27ef4c159c6";
-      sha256 = "1xaliyiv80vcsl5gqj40avgdf4384d5xhnvhh0jaklk1hmrdzxgf";
+      rev = "d534ba0d0c211d8228408c88fa3ebde13fecec37";
+      sha256 = "0yc28synqrqjnzgzpmn7ji3nnidb55mm8n27d0kkd2l80bygg8n4";
     };
   };
 
@@ -3700,12 +3722,12 @@ let
 
   vim-elm-syntax = buildVimPluginFrom2Nix {
     pname = "vim-elm-syntax";
-    version = "2019-11-28";
+    version = "2020-01-06";
     src = fetchFromGitHub {
       owner = "andys8";
       repo = "vim-elm-syntax";
-      rev = "7ed55d9bc2c0cfd023d7cc6541634bcbf36430b5";
-      sha256 = "1kq7qcw9l41q646a2ilwy94lj1qz9as14aqfmzkbi938yij18zpx";
+      rev = "904025e5db117fe292fdb7ae490feff1540696ea";
+      sha256 = "0nm1pzq5qg9mcg0vhvqjbnq20f98njf2yn0sfzlyjgna2ivvjasg";
     };
   };
 
@@ -3865,12 +3887,12 @@ let
 
   vim-fugitive = buildVimPluginFrom2Nix {
     pname = "vim-fugitive";
-    version = "2020-01-06";
+    version = "2020-01-11";
     src = fetchFromGitHub {
       owner = "tpope";
       repo = "vim-fugitive";
-      rev = "ddd64fc4c5c5365d56478f100f19898375244890";
-      sha256 = "1b6mw8bb8dc46vjz5qb2v0n5kfvwz4hk7q0frflrsyc6z3pw7hab";
+      rev = "6bc345f6f16aee0dcc361f2f3bf80e4964f461af";
+      sha256 = "0fbbi9gsmrjbff75y0r9zdjcbyc7lf5j9pyski3y5wma4z3l4idr";
     };
   };
 
@@ -3909,12 +3931,12 @@ let
 
   vim-gitgutter = buildVimPluginFrom2Nix {
     pname = "vim-gitgutter";
-    version = "2019-12-03";
+    version = "2020-01-06";
     src = fetchFromGitHub {
       owner = "airblade";
       repo = "vim-gitgutter";
-      rev = "1c53af9a0d3b622af5a62d69ddfc141c841a28c1";
-      sha256 = "0269cjkcx4arq7phyqv80ziafg5p1in5ci7207svixbfdg5hlmfs";
+      rev = "0946c53cfc6edfb8dbf4b25a27d013c0b6ec6619";
+      sha256 = "06n4w9c8w2dyh8nwmlmz4d8hqy4yk9i6w01qa9plbvkhb1lrv21l";
     };
   };
 
@@ -3942,12 +3964,12 @@ let
 
   vim-go = buildVimPluginFrom2Nix {
     pname = "vim-go";
-    version = "2020-01-03";
+    version = "2020-01-08";
     src = fetchFromGitHub {
       owner = "fatih";
       repo = "vim-go";
-      rev = "ee2071d8e63f9aab98d750a91fcc3358e9987bc9";
-      sha256 = "0a2ac5y8x3lhry5dzq2jbzvryfbvrdvn7bkd2wwm5bf2y9zpkbwk";
+      rev = "810e4b9faf1583443fe2d027d11993fb698b080f";
+      sha256 = "0841030jxifv0x8y4vqz0dvwkxirbynra5iibfgyv485ynhw2l8i";
     };
   };
 
@@ -4427,12 +4449,12 @@ let
 
   vim-lsc = buildVimPluginFrom2Nix {
     pname = "vim-lsc";
-    version = "2019-12-30";
+    version = "2020-01-07";
     src = fetchFromGitHub {
       owner = "natebosch";
       repo = "vim-lsc";
-      rev = "6cb8410e10f1b6a23adf238c1f93ce19a3eef83a";
-      sha256 = "1zqv58s35qvp53an15mvs7ywvarsqxc0has6yji99jwmjiq68pag";
+      rev = "2384903e1dd6314934f58e3c88b10924dd1bf4f7";
+      sha256 = "0xs64i4g27w8bdmznjilqg5rlrpaw12qiclg1p4l3ryyid27wki7";
     };
   };
 
@@ -5120,12 +5142,12 @@ let
 
   vim-snippets = buildVimPluginFrom2Nix {
     pname = "vim-snippets";
-    version = "2020-01-03";
+    version = "2020-01-13";
     src = fetchFromGitHub {
       owner = "honza";
       repo = "vim-snippets";
-      rev = "f324a43a5f6a941a55ee992bb852f3c2c504a509";
-      sha256 = "0dgxsn96vw4zgci58lzr4d4d4kwjbk9d52h51ibh3mhsikmpr7xk";
+      rev = "5279654b3e9fc280742d02c9509d4313d9da18e9";
+      sha256 = "0xnml4ayjwf7mzpz64alwygpgccvj4znask76ldw3hxp112fwcah";
     };
   };
 
@@ -5285,23 +5307,23 @@ let
 
   vim-terraform = buildVimPluginFrom2Nix {
     pname = "vim-terraform";
-    version = "2020-01-02";
+    version = "2020-01-06";
     src = fetchFromGitHub {
       owner = "hashivim";
       repo = "vim-terraform";
-      rev = "1df8ac3e1bc33e1c70bd3a1713d8c9cd2eb491e1";
-      sha256 = "0ivkm9vzzfn1iwzkkgk54kn846qnhvsaf8f4nzz3mllirjsl14am";
+      rev = "5ae986685ba479718b3f59263c519976cf9b4c80";
+      sha256 = "1dhgzpjykx9slv6lfbjnyci5ndixisdgym3y8zanhhhjp4nff41b";
     };
   };
 
   vim-test = buildVimPluginFrom2Nix {
     pname = "vim-test";
-    version = "2019-12-07";
+    version = "2020-01-09";
     src = fetchFromGitHub {
       owner = "janko-m";
       repo = "vim-test";
-      rev = "e9e824cf3f22fa1cddabb7ef739f2481436c3924";
-      sha256 = "0nl1b3zzw3w413lmdl4fhm8ia079hr1rz1kpx7sf0i86lx1c0dcv";
+      rev = "2f4efe7028e493a3d9eb06ccb7e27780b81687b7";
+      sha256 = "1yfpishvgj1zdnhsixzjqnbmvfw8qg908zqnis3gk8s9fmnrw6fz";
     };
   };
 
@@ -5505,12 +5527,12 @@ let
 
   vim-visual-multi = buildVimPluginFrom2Nix {
     pname = "vim-visual-multi";
-    version = "2019-12-18";
+    version = "2020-01-11";
     src = fetchFromGitHub {
       owner = "mg979";
       repo = "vim-visual-multi";
-      rev = "d332d08365bc735f60904a4207d650f191598378";
-      sha256 = "0g5lawg641ma216v53ivhbkzpmdqhcmgybb5kh1rz6s991j51ziy";
+      rev = "1b4d7269600a926a394b146f7d39044cd4dafa19";
+      sha256 = "0wknx72x7mbkw9007b6ylp1cpl6jap4kv3y85f9sz2lwlsbbkk4b";
     };
   };
 
@@ -5626,12 +5648,12 @@ let
 
   vimagit = buildVimPluginFrom2Nix {
     pname = "vimagit";
-    version = "2019-07-24";
+    version = "2020-01-12";
     src = fetchFromGitHub {
       owner = "jreybert";
       repo = "vimagit";
-      rev = "94762b1356ebdcb8ec486a86f45e69ef77a69465";
-      sha256 = "1p8izqdkx8g1aqmq9a2qm506bs4mvc4xdbzkh2k5xprm5vc14z0s";
+      rev = "bf7b16e99e075b019e56f2fbfb96c493ca3635e2";
+      sha256 = "1f7gvlhrvvkf69y5vfrkvidhx8aa03n1aqmdhk9qjd6sglfg5w0i";
     };
   };
 
@@ -5692,12 +5714,12 @@ let
 
   vimproc-vim = buildVimPluginFrom2Nix {
     pname = "vimproc-vim";
-    version = "2019-11-28";
+    version = "2020-01-06";
     src = fetchFromGitHub {
       owner = "Shougo";
       repo = "vimproc.vim";
-      rev = "89065f62883edb10a99aa1b1640d6d411907316b";
-      sha256 = "0699kf269rsyabl49m4n7vsi5bbxk129wq6ml3ykhy9g9m2b8a3k";
+      rev = "7425059fe2d9689f8560f1a47590677740669fdd";
+      sha256 = "1rp5jq4jv8zga98pw62635mby0sgw0inzknlwcdy0f2lfbdvaq8g";
     };
   };
 
@@ -5714,12 +5736,12 @@ let
 
   vimtex = buildVimPluginFrom2Nix {
     pname = "vimtex";
-    version = "2019-12-31";
+    version = "2020-01-12";
     src = fetchFromGitHub {
       owner = "lervag";
       repo = "vimtex";
-      rev = "020206fbe1f6981855a3fe2f96ef893db782d4b8";
-      sha256 = "113d1zdmx3vhjig4xrp1kqlzapdhygis2ky2paww42j22vakqywc";
+      rev = "aabfcf9e0c95bc08125aefaeb9fdfc9be04913c5";
+      sha256 = "0d7sv6f8iafwm891vl4wlsv93jfqjckmsrg2k9rfynk737vsmvp5";
     };
   };
 
@@ -5736,12 +5758,12 @@ let
 
   vimwiki = buildVimPluginFrom2Nix {
     pname = "vimwiki";
-    version = "2020-01-04";
+    version = "2020-01-13";
     src = fetchFromGitHub {
       owner = "vimwiki";
       repo = "vimwiki";
-      rev = "b90e6f2e3343277faca65156d733f725f76f1e53";
-      sha256 = "1z3mj73iqh4h3wx5cq4k7gp2nkbaj85v665v0phqw42c213064nb";
+      rev = "64c9f3d36d632b1657616c06ea8f08f14cf6438d";
+      sha256 = "0wwfl0bafwh9p8lzic75d0nl6v5dnpfid7fbiffr0i72agp0gcq7";
     };
   };
 
@@ -5758,12 +5780,12 @@ let
 
   vista-vim = buildVimPluginFrom2Nix {
     pname = "vista-vim";
-    version = "2020-01-06";
+    version = "2020-01-12";
     src = fetchFromGitHub {
       owner = "liuchengxu";
       repo = "vista.vim";
-      rev = "dcf134c83a6a3f9618a97cafab5b7fb1f1df3f84";
-      sha256 = "0w9q69a2k8a39b8zrd3sildisrdskbk6cgvbkmb3fqsr0zdzjxzv";
+      rev = "221893d85d2e8ed5ec51da12bf23d2e5bada57cf";
+      sha256 = "1ggwkmi6haj7hayiki3nd9vrc14l4z1912jd06w22hmyl86926x9";
     };
   };
 
@@ -5835,12 +5857,12 @@ let
 
   xptemplate = buildVimPluginFrom2Nix {
     pname = "xptemplate";
-    version = "2019-10-29";
+    version = "2020-01-07";
     src = fetchFromGitHub {
       owner = "drmingdrmer";
       repo = "xptemplate";
-      rev = "4dabcf320f18e33923dbcf793d3c04330dcb79a1";
-      sha256 = "07sr3ixlgfv0sql48fxvyimwdb8xr3iklmzfxb5wxfxgvhr4xbs8";
+      rev = "9cd1c622a5a7cc383ae3df2cec2bac5cb102fa7f";
+      sha256 = "01szas3gv4zw1v6c8yp5p2hygf3fqmpx0y2h6sn8696pfph7vjk3";
     };
   };
 
@@ -5868,12 +5890,12 @@ let
 
   yats-vim = buildVimPluginFrom2Nix {
     pname = "yats-vim";
-    version = "2020-01-06";
+    version = "2020-01-13";
     src = fetchFromGitHub {
       owner = "HerringtonDarkholme";
       repo = "yats.vim";
-      rev = "48184a10ecdda3efce0131aa73495f1edc449a33";
-      sha256 = "0nsdq17r2m2pmnz077rliqdlwk5sn1aj3bxl648bsli7rjacgaqq";
+      rev = "976d10ee24ce4d8790bcd80b3f7c6b8bbc9ec76d";
+      sha256 = "0f3kgb07js6pjr6p03iyspn5k852y5b90w1ylas7lbgz32a1f3hp";
       fetchSubmodules = true;
     };
   };
@@ -5925,12 +5947,12 @@ let
 
   zig-vim = buildVimPluginFrom2Nix {
     pname = "zig-vim";
-    version = "2020-01-02";
+    version = "2020-01-12";
     src = fetchFromGitHub {
       owner = "zig-lang";
       repo = "zig.vim";
-      rev = "7b644a313bf3e32a3b0c4616660d61f5ec8872d9";
-      sha256 = "1icv1qa4wf1kaknfs045m8md2938qggzl6a5wf76lcn1iw5nr1cc";
+      rev = "2a1de0f764e42f8b76daafc24249d6cb4a743c16";
+      sha256 = "0lbry8s34ld97m05q091q2dmpfkn8k6nsj0q1vrbrsml5i5xig9c";
     };
   };
 
diff --git a/pkgs/misc/vim-plugins/vim-plugin-names b/pkgs/misc/vim-plugins/vim-plugin-names
index 3c097c63fde8..b22a811d2a80 100644
--- a/pkgs/misc/vim-plugins/vim-plugin-names
+++ b/pkgs/misc/vim-plugins/vim-plugin-names
@@ -377,6 +377,8 @@ rust-lang/rust.vim
 ryanoasis/vim-devicons
 Rykka/riv.vim
 ryvnf/readline.vim
+sakhnik/nvim-gdb
+saltstack/salt-vim
 samoshkin/vim-mergetool
 sbdchd/neoformat
 scrooloose/nerdcommenter
diff --git a/pkgs/os-specific/darwin/apple-sdk/default.nix b/pkgs/os-specific/darwin/apple-sdk/default.nix
index c3914777c6dc..9890d385259c 100644
--- a/pkgs/os-specific/darwin/apple-sdk/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, xar, cpio, pkgs, python, pbzx, lib }:
+{ stdenv, fetchurl, xar, cpio, pkgs, python3, pbzx, lib }:
 
 let
   # sadly needs to be exported because security_tool needs it
@@ -16,7 +16,7 @@ let
       sha256 = "13xq34sb7383b37hwy076gnhf96prpk1b4087p87xnwswxbrisih";
     };
 
-    buildInputs = [ xar cpio python pbzx ];
+    nativeBuildInputs = [ xar cpio python3 pbzx ];
 
     outputs = [ "out" "dev" "man" ];
 
@@ -61,9 +61,16 @@ let
     installPhase = ''
       linkFramework() {
         local path="$1"
+        local nested_path="$1"
         local dest="$out/Library/Frameworks/$path"
+        if [ "$path" == "JavaNativeFoundation.framework" ]; then
+          local nested_path="JavaVM.framework/Versions/A/Frameworks/JavaNativeFoundation.framework"
+        fi
+        if [ "$path" == "JavaRuntimeSupport.framework" ]; then
+          local nested_path="JavaVM.framework/Versions/A/Frameworks/JavaRuntimeSupport.framework"
+        fi
         local name="$(basename "$path" .framework)"
-        local current="$(readlink "/System/Library/Frameworks/$path/Versions/Current")"
+        local current="$(readlink "/System/Library/Frameworks/$nested_path/Versions/Current")"
         if [ -z "$current" ]; then
           current=A
         fi
@@ -75,25 +82,21 @@ let
         # ApplicationServices in the 10.9 SDK
         local isChild=0
 
-        if [ -d "${sdk.out}/Library/Frameworks/$path/Versions/$current/Headers" ]; then
+        if [ -d "${sdk.out}/Library/Frameworks/$nested_path/Versions/$current/Headers" ]; then
           isChild=1
-          cp -R "${sdk.out}/Library/Frameworks/$path/Versions/$current/Headers" .
+          cp -R "${sdk.out}/Library/Frameworks/$nested_path/Versions/$current/Headers" .
         elif [ -d "${sdk.out}/Library/Frameworks/$name.framework/Versions/$current/Headers" ]; then
           current="$(readlink "/System/Library/Frameworks/$name.framework/Versions/Current")"
           cp -R "${sdk.out}/Library/Frameworks/$name.framework/Versions/$current/Headers" .
         fi
-        ln -s -L "/System/Library/Frameworks/$path/Versions/$current/$name"
-        ln -s -L "/System/Library/Frameworks/$path/Versions/$current/Resources"
+        ln -s -L "/System/Library/Frameworks/$nested_path/Versions/$current/$name"
+        ln -s -L "/System/Library/Frameworks/$nested_path/Versions/$current/Resources"
 
-        if [ -f "/System/Library/Frameworks/$path/module.map" ]; then
-          ln -s "/System/Library/Frameworks/$path/module.map"
+        if [ -f "/System/Library/Frameworks/$nested_path/module.map" ]; then
+          ln -s "/System/Library/Frameworks/$nested_path/module.map"
         fi
 
-        if [ $isChild -eq 1 ]; then
-          pushd "${sdk.out}/Library/Frameworks/$path/Versions/$current" >/dev/null
-        else
-          pushd "${sdk.out}/Library/Frameworks/$name.framework/Versions/$current" >/dev/null
-        fi
+        pushd "${sdk.out}/Library/Frameworks/$nested_path/Versions/$current" >/dev/null
         local children=$(echo Frameworks/*.framework)
         popd >/dev/null
 
@@ -109,7 +112,6 @@ let
         popd >/dev/null
       }
 
-
       linkFramework "${name}.framework"
     '';
 
diff --git a/pkgs/os-specific/darwin/apple-sdk/frameworks.nix b/pkgs/os-specific/darwin/apple-sdk/frameworks.nix
index b5a378cc6ae1..09e0e4e48ecd 100644
--- a/pkgs/os-specific/darwin/apple-sdk/frameworks.nix
+++ b/pkgs/os-specific/darwin/apple-sdk/frameworks.nix
@@ -65,6 +65,8 @@ with frameworks; with libs; {
   InstallerPlugins        = [];
   InstantMessage          = [];
   JavaFrameEmbedding      = [];
+  JavaNativeFoundation    = [];
+  JavaRuntimeSupport      = [];
   JavaScriptCore          = [];
   Kerberos                = [];
   Kernel                  = [ IOKit ];
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libdispatch/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libdispatch/default.nix
index 46e9e592ddc6..e7aa47bdb6b1 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libdispatch/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libdispatch/default.nix
@@ -12,5 +12,14 @@ appleDerivation {
 
     cp -r dispatch/*.h $out/include/dispatch
     cp -r os/object*.h  $out/include/os
+
+    # gcc compatability. Source: https://stackoverflow.com/a/28014302/3714556
+    substituteInPlace $out/include/dispatch/object.h \
+      --replace 'typedef void (^dispatch_block_t)(void);' \
+                '#ifdef __clang__
+                 typedef void (^dispatch_block_t)(void);
+                 #else
+                 typedef void* dispatch_block_t;
+                 #endif'
   '';
 }
diff --git a/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix b/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
index afa5dc1c08cb..da2d0c5dc7bf 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
@@ -1,9 +1,11 @@
 { appleDerivation, lib, bootstrap_cmds, bison, flex
-, gnum4, unifdef, perl, python
+, gnum4, unifdef, perl, python3
 , headersOnly ? true }:
 
 appleDerivation ({
-  nativeBuildInputs = [ bootstrap_cmds bison flex gnum4 unifdef perl python ];
+  nativeBuildInputs = [ bootstrap_cmds bison flex gnum4 unifdef perl python3 ];
+
+  patches = [ ./python3.patch ];
 
   postPatch = ''
     substituteInPlace Makefile \
diff --git a/pkgs/os-specific/darwin/apple-source-releases/xnu/python3.patch b/pkgs/os-specific/darwin/apple-source-releases/xnu/python3.patch
new file mode 100644
index 000000000000..10778406c8e0
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/xnu/python3.patch
@@ -0,0 +1,41 @@
+diff --git a/bsd/kern/makekdebugevents.py b/bsd/kern/makekdebugevents.py
+index 73b2db4..d354ba0 100755
+--- a/bsd/kern/makekdebugevents.py
++++ b/bsd/kern/makekdebugevents.py
+@@ -5,7 +5,7 @@
+ # named kd_events[] or these mappings.
+ # Required to generate a header file used by DEVELOPMENT and DEBUG kernels.
+ #
+- 
++
+ import sys
+ import re
+ 
+@@ -21,18 +21,18 @@ code_table = []
+ # scan file to generate internal table
+ with open(trace_code_file, 'rt') as codes:
+     for line in codes:
+-	m = id_name_pattern.match(line)
+-	if m:
++        m = id_name_pattern.match(line)
++    if m:
+             code_table += [(int(m.group(1),base=16), m.group(2))]
+ 
+ # emit typedef:
+-print "typedef struct {"
+-print "        uint32_t   id;"
+-print "        const char *name;"
+-print "} kd_event_t;"
++print("typedef struct {")
++print("        uint32_t   id;")
++print("        const char *name;")
++print("} kd_event_t;")
+ # emit structure declaration and sorted initialization:
+-print "kd_event_t kd_events[] = {"
++print("kd_event_t kd_events[] = {")
+ for mapping in sorted(code_table, key=lambda x: x[0]):
+-        print "        {0x%x, \"%s\"}," % mapping
+-print "};"
++        print("        {0x%x, \"%s\"}," % mapping)
++print("};")
+ 
diff --git a/pkgs/os-specific/darwin/iproute2mac/default.nix b/pkgs/os-specific/darwin/iproute2mac/default.nix
index be8554983074..e82636fce1f2 100644
--- a/pkgs/os-specific/darwin/iproute2mac/default.nix
+++ b/pkgs/os-specific/darwin/iproute2mac/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, darwin, python }:
+{ stdenv, fetchFromGitHub, darwin, python2 }:
 
 stdenv.mkDerivation rec {
   version = "1.2.1";
@@ -11,11 +11,11 @@ stdenv.mkDerivation rec {
     sha256 = "1n6la7blbxza2m79cpnywsavhzsdv4gzdxrkly4dppyidjg6jy1h";
   };
 
-  buildInputs = [ python ];
+  buildInputs = [ python2 ];
 
   postPatch = ''
     substituteInPlace src/ip.py \
-      --replace /usr/bin/python ${python}/bin/python \
+      --replace /usr/bin/python ${python2}/bin/python \
       --replace /sbin/ifconfig ${darwin.network_cmds}/bin/ifconfig \
       --replace /sbin/route ${darwin.network_cmds}/bin/route \
       --replace /usr/sbin/netstat ${darwin.network_cmds}/bin/netstat \
diff --git a/pkgs/os-specific/darwin/libtapi/default.nix b/pkgs/os-specific/darwin/libtapi/default.nix
index 2af1c5db2e32..182d1db3bfd5 100644
--- a/pkgs/os-specific/darwin/libtapi/default.nix
+++ b/pkgs/os-specific/darwin/libtapi/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, python, clang_6 }:
+{ lib, stdenv, fetchFromGitHub, cmake, python3, clang_6 }:
 
 stdenv.mkDerivation {
   name = "libtapi-1000.10.8";
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
     sha256 = "1a19h39a48agvnmal99n9j1fjadiqwib7hfzmn342wmgh9z3vk0g";
   };
 
-  nativeBuildInputs = [ cmake python ];
+  nativeBuildInputs = [ cmake python3 ];
   buildInputs = [ clang_6.cc ];
 
   preConfigure = ''
diff --git a/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix b/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
index 4f2f84b3c0a5..059cb70bfbd5 100644
--- a/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
+++ b/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, fetchurl, python, ninja, libxml2, objc4, ICU, curl }:
+{ stdenv, fetchFromGitHub, fetchurl, ninja, python3, curl, libxml2, objc4, ICU }:
 
 let
   # 10.12 adds a new sysdir.h that our version of CF in the main derivation depends on, but
@@ -20,8 +20,8 @@ stdenv.mkDerivation {
     sha256 = "17kpql0f27xxz4jjw84vpas5f5sn4vdqwv10g151rc3rswbwln1z";
   };
 
-  nativeBuildInputs = [ ninja python ];
-  buildInputs = [ libxml2 objc4 ICU curl ];
+  nativeBuildInputs = [ ninja python3 ];
+  buildInputs = [ curl libxml2 objc4 ICU ];
 
   sourceRoot = "source/CoreFoundation";
 
diff --git a/pkgs/os-specific/linux/ati-drivers/builder.sh b/pkgs/os-specific/linux/ati-drivers/builder.sh
index 09d218e87458..a9e5aaef3976 100644
--- a/pkgs/os-specific/linux/ati-drivers/builder.sh
+++ b/pkgs/os-specific/linux/ati-drivers/builder.sh
@@ -285,7 +285,7 @@ if test -z "$libsOnly"; then
     for prog in $BIN/*; do
       cp -f $prog $out/bin &&
       patchelf --set-interpreter $(echo $glibcDir/lib/ld-linux*.so.2) $out/bin/$(basename $prog) &&
-      wrapProgram $out/bin/$(basename $prog) --prefix LD_LIBRARY_PATH : $out/lib/:$gcc/lib/:$out/share/ati/:$libXinerama/lib/:$libXrandr/lib/:$libfontconfig/lib/:$libfreetype/lib/:$LD_LIBRARY_PATH
+      wrapProgram $out/bin/$(basename $prog) --prefix LD_LIBRARY_PATH : $out/lib/:$gcc/lib/:$out/share/ati/:$libXinerama/lib/:$libXrandr/lib/:$libfontconfig/lib/:$libfreetype/lib/${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH
     done
   }
 
diff --git a/pkgs/os-specific/linux/firejail/default.nix b/pkgs/os-specific/linux/firejail/default.nix
index 9ccd39d3582e..5a1337b0998d 100644
--- a/pkgs/os-specific/linux/firejail/default.nix
+++ b/pkgs/os-specific/linux/firejail/default.nix
@@ -36,10 +36,10 @@ stdenv.mkDerivation {
     sed -e "s@/etc/@$out/etc/@g" -e "/chmod u+s/d" -i Makefile
   '';
 
-  # We need to set the directory for the .local override files back to
+  # We need to set the directory for the .local override files to
   # /etc/firejail so we can actually override them
   postInstall = ''
-    sed -E -e 's@^include (.*)(/firejail/.*.local)$@include /etc\2@g' -i $out/etc/firejail/*.profile
+    sed -E -e 's@^include (.*.local)$@include /etc/firejail/\1@g' -i $out/etc/firejail/*.profile
   '';
 
   # At high parallelism, the build sometimes fails with:
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index 4701dca2e901..052217c0060d 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.14.163";
+  version = "4.14.164";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0jdh54rqdsb3b908v2q4xjn8y45b7rdnwgab0s4qf5alznfcqagb";
+    sha256 = "0jzbgpxlfy64q7zaqix87k8ci1fr9lkx1xr9m5zjniziydhi00x2";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index 73852c4846d1..e938d8ff33ec 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.19.94";
+  version = "4.19.95";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0rvlz94mjl7ygpmhz0yn2whx9dq9fmy0w1472bj16hkwbaki0an6";
+    sha256 = "1c2g5wcf4zgy5q51qrf0s4hf3pr1j8gi8gn27w8cafn1xqrcmvaa";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index 2ee7241396fb..0cdb2710b622 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.208";
+  version = "4.4.209";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "03jj91z5dc0ybpjy9w6aanb3k53gcj7gsjc32h3ldf72hlmgz6aq";
+    sha256 = "0m94795grq3sbj7jlmwc0ncq3vap9lf1z00sdiys17kjs3bcfbnh";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index e95a0d98139c..a5fa03b774ad 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.208";
+  version = "4.9.209";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0njjw1i8dilihn1hz62zra4b9y05fb3r2k2sqlkd0wfn86c1rbdp";
+    sha256 = "1qarm90l1r4y68v5swhf81z6v6gspa8sw9jab3fxrz8mz6zdan02";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.3.nix b/pkgs/os-specific/linux/kernel/linux-5.3.nix
deleted file mode 100644
index d83f0fb98130..000000000000
--- a/pkgs/os-specific/linux/kernel/linux-5.3.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ stdenv, buildPackages, fetchurl, perl, buildLinux, modDirVersionArg ? null, ... } @ args:
-
-with stdenv.lib;
-
-buildLinux (args // rec {
-  version = "5.3.18";
-
-  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
-
-  # branchVersion needs to be x.y
-  extraMeta.branch = versions.majorMinor version;
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "133342nv9ddjad2rizmcbilg9rhg339sfqr9l77j4cgkqhblkw90";
-  };
-} // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
index 00ab0accbdd8..73fe68261abf 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.4.10";
+  version = "5.4.11";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1p9f0h9fl1xy13dag1x7j2ic8kdv0zsp42c8baxn7cz3llc04g7j";
+    sha256 = "0b6pamnhyzf4n6sl8lxcnllrn41xmbldipfca23j1n71spjkdgb2";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-libre.nix b/pkgs/os-specific/linux/kernel/linux-libre.nix
index 799a84d96df6..5102a1c2086b 100644
--- a/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/pkgs/os-specific/linux/kernel/linux-libre.nix
@@ -1,8 +1,8 @@
 { stdenv, lib, fetchsvn, linux
 , scripts ? fetchsvn {
     url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
-    rev = "17185";
-    sha256 = "0hyd7wp73w4555d42xcvk4x4nxrfckbzah2ckb4d2aqzxab87789";
+    rev = "17198";
+    sha256 = "0cr7jpag6kr3iili5zmv1iimi5a1c175dcj8qvhcspwkbv7f17mp";
   }
 , ...
 }:
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index dcb274c92545..b6231b5a9729 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.5-rc3";
+  version = "5.5-rc6";
   extraMeta.branch = "5.5";
 
   # modDirVersion needs to be x.y.z, will always add .0
@@ -11,7 +11,7 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "1rf394d1d6c0mvf6006gq1bscq3jjcvj9xxmdwallfwpp9igs8id";
+    sha256 = "0y4rsxynn0qprrsxy4v5vr4ihhavn43yqqp1qfrrxsfw15djncc2";
   };
 
   # Should the testing kernels ever be built on Hydra?
diff --git a/pkgs/os-specific/linux/kernel/update-libre.sh b/pkgs/os-specific/linux/kernel/update-libre.sh
index 3b8a00edcdac..aea12df55cc5 100755
--- a/pkgs/os-specific/linux/kernel/update-libre.sh
+++ b/pkgs/os-specific/linux/kernel/update-libre.sh
@@ -6,6 +6,7 @@ nixpkgs="$(git rev-parse --show-toplevel)"
 path="$nixpkgs/pkgs/os-specific/linux/kernel/linux-libre.nix"
 
 old_rev="$(grep -o 'rev = ".*"' "$path" | awk -F'"' '{print $2}')"
+old_sha256="$(grep -o 'sha256 = ".*"' "$path" | awk -F'"' '{print $2}')"
 
 svn_url=https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/
 rev="$(curl -s "$svn_url" | grep -Em 1 -o 'Revision [0-9]+' | awk '{print $2}')"
@@ -17,10 +18,16 @@ fi
 
 sha256="$(QUIET=1 nix-prefetch-svn "$svn_url" "$rev" | tail -1)"
 
+if [ "$old_sha256" = "$sha256" ]; then
+    echo "No updates for linux-libre"
+    exit 0
+fi
+
 sed -i -e "s/rev = \".*\"/rev = \"$rev\"/" \
     -e "s/sha256 = \".*\"/sha256 = \"$sha256\"/" "$path"
 
-if [ -n "$COMMIT" ]; then
-    git commit -qm "linux_latest-libre: $old_rev -> $rev" "$path"
+if [ -n "${COMMIT-}" ]; then
+    git commit -qm "linux_latest-libre: $old_rev -> $rev" "$path" \
+       $nixpkgs/pkgs/os-specific/linux/kernel/linux-libre.nix
     echo "Updated linux_latest-libre $old_rev -> $rev"
 fi
diff --git a/pkgs/os-specific/linux/rfkill/udev.nix b/pkgs/os-specific/linux/rfkill/udev.nix
index 41dd3da9d31f..0575c46e28e3 100644
--- a/pkgs/os-specific/linux/rfkill/udev.nix
+++ b/pkgs/os-specific/linux/rfkill/udev.nix
@@ -8,18 +8,18 @@
 #   udev.packages = [ pkgs.rfkill_udev ];
 #
 # Add a hook script in the managed etc directory, e.g.:
-#   etc = [
-#     { source = pkgs.writeScript "rtfkill.hook" ''
-#         #!${pkgs.runtimeShell}
+#   etc."rfkill.hook" = {
+#     mode = "0755";
+#     text = ''
+#       #!${pkgs.runtimeShell}
 #
-#         if [ "$RFKILL_STATE" -eq "1" ]; then
-#           exec ${config.system.build.upstart}/sbin/initctl emit -n antenna-on
-#         else
-#           exec ${config.system.build.upstart}/sbin/initctl emit -n antenna-off
-#         fi
-#       '';
-#       target = "rfkill.hook";
-#     }
+#       if [ "$RFKILL_STATE" -eq "1" ]; then
+#         exec ${config.system.build.upstart}/sbin/initctl emit -n antenna-on
+#       else
+#         exec ${config.system.build.upstart}/sbin/initctl emit -n antenna-off
+#       fi
+#     '';
+#   }
 
 # Note: this package does not need the binaries
 # in the rfkill package.
diff --git a/pkgs/os-specific/linux/tiscamera/default.nix b/pkgs/os-specific/linux/tiscamera/default.nix
index dfcf4c9937b1..387a3bcf2c6f 100644
--- a/pkgs/os-specific/linux/tiscamera/default.nix
+++ b/pkgs/os-specific/linux/tiscamera/default.nix
@@ -84,7 +84,7 @@ stdenv.mkDerivation rec {
   # dependency on `libtcam` (which itself is built as part of this build). In order to allow
   # that, we set the dynamic linker's path to point on the build time location of the library.
   preBuild = ''
-    export LD_LIBRARY_PATH=$PWD/src:$LD_LIBRARY_PATH
+    export LD_LIBRARY_PATH=$PWD/src''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH
   '';
 
   meta = with lib; {
diff --git a/pkgs/servers/dante/default.nix b/pkgs/servers/dante/default.nix
index ae083f17ada9..c36ca2f8f509 100644
--- a/pkgs/servers/dante/default.nix
+++ b/pkgs/servers/dante/default.nix
@@ -11,7 +11,9 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ pam libkrb5 cyrus_sasl miniupnpc ];
 
-  configureFlags = ["--with-libc=libc${stdenv.targetPlatform.extensions.sharedLibrary}"];
+  configureFlags = if !stdenv.isDarwin
+    then [ "--with-libc=libc.so.6" ]
+    else [ "--with-libc=libc${stdenv.targetPlatform.extensions.sharedLibrary}" ];
 
   dontAddDisableDepTrack = stdenv.isDarwin;
 
diff --git a/pkgs/servers/ftp/bftpd/default.nix b/pkgs/servers/ftp/bftpd/default.nix
index e7c22904ceac..34757462a176 100644
--- a/pkgs/servers/ftp/bftpd/default.nix
+++ b/pkgs/servers/ftp/bftpd/default.nix
@@ -5,11 +5,11 @@ let
 
 in stdenv.mkDerivation rec {
   name = "${pname}-${version}";
-  version = "5.2";
+  version = "5.4";
 
   src = fetchurl {
     url = "mirror://sourceforge/project/${pname}/${pname}/${name}/${name}.tar.gz";
-    sha256 = "0kmavljj3zwpgdib9nb14fnriiv0l9zm3hglimcyz26sxbw5jqky";
+    sha256 = "19fd9r233wkjk8gdxn6qsjgfijiw67a48xhgbm2kq46bx80yf3pg";
   };
 
   preConfigure = ''
diff --git a/pkgs/servers/mail/public-inbox/0002-msgtime-drop-Date-Parse-for-RFC2822.patch b/pkgs/servers/mail/public-inbox/0002-msgtime-drop-Date-Parse-for-RFC2822.patch
new file mode 100644
index 000000000000..ebc9a6f22379
--- /dev/null
+++ b/pkgs/servers/mail/public-inbox/0002-msgtime-drop-Date-Parse-for-RFC2822.patch
@@ -0,0 +1,172 @@
+From c9b5164c954cd0de80d971f1c4ced16bf41ea81b Mon Sep 17 00:00:00 2001
+From: Eric Wong <e@80x24.org>
+Date: Fri, 29 Nov 2019 12:25:07 +0000
+Subject: [PATCH 2/2] msgtime: drop Date::Parse for RFC2822
+
+Date::Parse is not optimized for RFC2822 dates and isn't
+packaged on OpenBSD.  It's still useful for historical
+email when email clients were less conformant, but is
+less relevant for new emails.
+---
+ lib/PublicInbox/MsgTime.pm | 115 ++++++++++++++++++++++++++++++++-----
+ t/msgtime.t                |   6 ++
+ 2 files changed, 107 insertions(+), 14 deletions(-)
+
+diff --git a/lib/PublicInbox/MsgTime.pm b/lib/PublicInbox/MsgTime.pm
+index 58e11d72..e9b27a49 100644
+--- a/lib/PublicInbox/MsgTime.pm
++++ b/lib/PublicInbox/MsgTime.pm
+@@ -7,24 +7,114 @@ use strict;
+ use warnings;
+ use base qw(Exporter);
+ our @EXPORT_OK = qw(msg_timestamp msg_datestamp);
+-use Date::Parse qw(str2time strptime);
++use Time::Local qw(timegm);
++my @MoY = qw(january february march april may june
++		july august september october november december);
++my %MoY;
++@MoY{@MoY} = (0..11);
++@MoY{map { substr($_, 0, 3) } @MoY} = (0..11);
++
++my %OBSOLETE_TZ = ( # RFC2822 4.3 (Obsolete Date and Time)
++	EST => '-0500', EDT => '-0400',
++	CST => '-0600', CDT => '-0500',
++	MST => '-0700', MDT => '-0600',
++	PST => '-0800', PDT => '-0700',
++	UT => '+0000', GMT => '+0000', Z => '+0000',
++
++	# RFC2822 states:
++	#   The 1 character military time zones were defined in a non-standard
++	#   way in [RFC822] and are therefore unpredictable in their meaning.
++);
++my $OBSOLETE_TZ = join('|', keys %OBSOLETE_TZ);
+ 
+ sub str2date_zone ($) {
+ 	my ($date) = @_;
++	my ($ts, $zone);
++
++	# RFC822 is most likely for email, but we can tolerate an extra comma
++	# or punctuation as long as all the data is there.
++	# We'll use '\s' since Unicode spaces won't affect our parsing.
++	# SpamAssassin ignores commas and redundant spaces, too.
++	if ($date =~ /(?:[A-Za-z]+,?\s+)? # day-of-week
++			([0-9]+),?\s+  # dd
++			([A-Za-z]+)\s+ # mon
++			([0-9]{2,})\s+ # YYYY or YY (or YYY :P)
++			([0-9]+)[:\.] # HH:
++				((?:[0-9]{2})|(?:\s?[0-9])) # MM
++				(?:[:\.]((?:[0-9]{2})|(?:\s?[0-9])))? # :SS
++			\s+	# a TZ offset is required:
++				([\+\-])? # TZ sign
++				[\+\-]* # I've seen extra "-" e.g. "--500"
++				([0-9]+|$OBSOLETE_TZ)(?:\s|$) # TZ offset
++			/xo) {
++		my ($dd, $m, $yyyy, $hh, $mm, $ss, $sign, $tz) =
++					($1, $2, $3, $4, $5, $6, $7, $8);
++		# don't accept non-English months
++		defined(my $mon = $MoY{lc($m)}) or return;
++
++		if (defined(my $off = $OBSOLETE_TZ{$tz})) {
++			$sign = substr($off, 0, 1);
++			$tz = substr($off, 1);
++		}
++
++		# Y2K problems: 3-digit years, follow RFC2822
++		if (length($yyyy) <= 3) {
++			$yyyy += 1900;
++
++			# and 2-digit years from '09 (2009) (0..49)
++			$yyyy += 100 if $yyyy < 1950;
++		}
++
++		$ts = timegm($ss // 0, $mm, $hh, $dd, $mon, $yyyy);
+ 
+-	my $ts = str2time($date);
+-	return undef unless(defined $ts);
++		# Compute the time offset from [+-]HHMM
++		$tz //= 0;
++		my ($tz_hh, $tz_mm);
++		if (length($tz) == 1) {
++			$tz_hh = $tz;
++			$tz_mm = 0;
++		} elsif (length($tz) == 2) {
++			$tz_hh = 0;
++			$tz_mm = $tz;
++		} else {
++			$tz_hh = $tz;
++			$tz_hh =~ s/([0-9]{2})\z//;
++			$tz_mm = $1;
++		}
++		while ($tz_mm >= 60) {
++			$tz_mm -= 60;
++			$tz_hh += 1;
++		}
++		$sign //= '+';
++		my $off = $sign . ($tz_mm * 60 + ($tz_hh * 60 * 60));
++		$ts -= $off;
++		$sign = '+' if $off == 0;
++		$zone = sprintf('%s%02d%02d', $sign, $tz_hh, $tz_mm);
+ 
+-	# off is the time zone offset in seconds from GMT
+-	my ($ss,$mm,$hh,$day,$month,$year,$off) = strptime($date);
+-	return undef unless(defined $off);
++	# Time::Zone and Date::Parse are part of the same distibution,
++	# and we need Time::Zone to deal with tz names like "EDT"
++	} elsif (eval { require Date::Parse }) {
++		$ts = Date::Parse::str2time($date);
++		return undef unless(defined $ts);
+ 
+-	# Compute the time zone from offset
+-	my $sign = ($off < 0) ? '-' : '+';
+-	my $hour = abs(int($off / 3600));
+-	my $min  = ($off / 60) % 60;
+-	my $zone = sprintf('%s%02d%02d', $sign, $hour, $min);
++		# off is the time zone offset in seconds from GMT
++		my ($ss,$mm,$hh,$day,$month,$year,$off) =
++					Date::Parse::strptime($date);
++		return undef unless(defined $off);
++
++		# Compute the time zone from offset
++		my $sign = ($off < 0) ? '-' : '+';
++		my $hour = abs(int($off / 3600));
++		my $min  = ($off / 60) % 60;
++
++		$zone = sprintf('%s%02d%02d', $sign, $hour, $min);
++	} else {
++		warn "Date::Parse missing for non-RFC822 date: $date\n";
++		return undef;
++	}
+ 
++	# Note: we've already applied the offset to $ts at this point,
++	# but we want to keep "git fsck" happy.
+ 	# "-1200" is the furthest westermost zone offset,
+ 	# but git fast-import is liberal so we use "-1400"
+ 	if ($zone >= 1400 || $zone <= -1400) {
+@@ -59,9 +149,6 @@ sub msg_date_only ($) {
+ 	my @date = $hdr->header_raw('Date');
+ 	my ($ts);
+ 	foreach my $d (@date) {
+-		# Y2K problems: 3-digit years
+-		$d =~ s!([A-Za-z]{3}) ([0-9]{3}) ([0-9]{2}:[0-9]{2}:[0-9]{2})!
+-			my $yyyy = $2 + 1900; "$1 $yyyy $3"!e;
+ 		$ts = eval { str2date_zone($d) } and return $ts;
+ 		if ($@) {
+ 			my $mid = $hdr->header_raw('Message-ID');
+diff --git a/t/msgtime.t b/t/msgtime.t
+index 6b396602..d9643b65 100644
+--- a/t/msgtime.t
++++ b/t/msgtime.t
+@@ -84,4 +84,10 @@ is_deeply(datestamp('Fri, 28 Jun 2002 12:54:40 -700'), [1025294080, '-0700']);
+ is_deeply(datestamp('Sat, 12 Jan 2002 12:52:57 -200'), [1010847177, '-0200']);
+ is_deeply(datestamp('Mon, 05 Nov 2001 10:36:16 -800'), [1004985376, '-0800']);
+ 
++# obsolete formats described in RFC2822
++for (qw(UT GMT Z)) {
++	is_deeply(datestamp('Fri, 02 Oct 1993 00:00:00 '.$_), [ 749520000, '+0000']);
++}
++is_deeply(datestamp('Fri, 02 Oct 1993 00:00:00 EDT'), [ 749534400, '-0400']);
++
+ done_testing();
+-- 
+2.24.1
+
diff --git a/pkgs/servers/mail/public-inbox/default.nix b/pkgs/servers/mail/public-inbox/default.nix
index b47495585004..affcb0e8b237 100644
--- a/pkgs/servers/mail/public-inbox/default.nix
+++ b/pkgs/servers/mail/public-inbox/default.nix
@@ -1,4 +1,4 @@
-{ buildPerlPackage, lib, fetchurl, makeWrapper
+{ buildPerlPackage, lib, fetchurl, fetchpatch, makeWrapper
 , DBDSQLite, EmailMIME, IOSocketSSL, IPCRun, Plack, PlackMiddlewareReverseProxy
 , SearchXapian, TimeDate, URI
 , git, highlight, openssl, xapian
@@ -29,6 +29,14 @@ buildPerlPackage rec {
     sha256 = "0sa2m4f2x7kfg3mi4im7maxqmqvawafma8f7g92nyfgybid77g6s";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://public-inbox.org/meta/20200101032822.GA13063@dcvr/raw";
+      sha256 = "0ncxqqkvi5lwi8zaa7lk7l8mf8h278raxsvbvllh3z7jhfb48r3l";
+    })
+    ./0002-msgtime-drop-Date-Parse-for-RFC2822.patch
+  ];
+
   outputs = [ "out" "devdoc" "sa_config" ];
 
   postConfigure = ''
diff --git a/pkgs/servers/plex/default.nix b/pkgs/servers/plex/default.nix
index 267bd4c2600f..3d69d2197803 100644
--- a/pkgs/servers/plex/default.nix
+++ b/pkgs/servers/plex/default.nix
@@ -97,6 +97,6 @@ buildFHSUserEnv {
 
     # Actually run Plex, prepending LD_LIBRARY_PATH with the libraries from
     # the Plex package.
-    LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$root exec "$root/Plex Media Server"
+    LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$root exec "$root/Plex Media Server"
   '';
 }
diff --git a/pkgs/servers/rippled/default.nix b/pkgs/servers/rippled/default.nix
index 840f63f3e058..905e776ea362 100644
--- a/pkgs/servers/rippled/default.nix
+++ b/pkgs/servers/rippled/default.nix
@@ -1,34 +1,28 @@
-{ stdenv, fetchFromGitHub, fetchgit, fetchurl, git, cmake, pkgconfig
+{ stdenv, fetchFromGitHub, fetchgit, fetchurl, runCommand, git, cmake, pkgconfig
 , openssl, boost, zlib }:
 
 let
-  sqlite3 = fetchurl {
+  sqlite3 = fetchurl rec {
     url = "https://www.sqlite.org/2018/sqlite-amalgamation-3260000.zip";
     sha256 = "0vh9aa5dyvdwsyd8yp88ss300mv2c2m40z79z569lcxa6fqwlpfy";
-  };
-
-  beast = fetchgit {
-    url = "https://github.com/boostorg/beast.git";
-    rev = "2f9a8440c2432d8a196571d6300404cb76314125";
-    sha256 = "1n9ms5cn67b0p0mhldz5psgylds22sm5x22q7knrsf20856vlk5a";
-    fetchSubmodules = false;
-    leaveDotGit = true;
+    passthru.url = url;
   };
 
   docca = fetchgit {
     url = "https://github.com/vinniefalco/docca.git";
     rev = "335dbf9c3613e997ed56d540cc8c5ff2e28cab2d";
-    sha256 = "09cb90k0ygmnlpidybv6nzf6is51i80lnwlvad6ijc3gf1z6i1yh";
-    fetchSubmodules = false;
+    sha256 = "1yisdg7q2p9q9gz0c446796p3ggx9s4d6g8w4j1pjff55655805h";
     leaveDotGit = true;
+    fetchSubmodules = false;
   };
 
-  rocksdb = fetchgit {
+  rocksdb = fetchgit rec {
     url = "https://github.com/facebook/rocksdb.git";
-    rev = "a297643f2e327a8bc7061bfc838fdf11935a2cf2";
-    sha256 = "00z8i4fwr27j9d4ymnls7rcgfvm6xh36a4hy2m2njx4x513pgyzw";
-    fetchSubmodules = false;
+    rev = "v5.17.2";
+    sha256 = "0d9ssggjls1hc4zhng65yg8slqlcw0lr23qr6f39shg42lzr227p";
     leaveDotGit = true;
+    fetchSubmodules = false;
+    postFetch = "cd $out && git tag ${rev}";
   };
 
   lz4 = fetchgit rec {
@@ -51,8 +45,8 @@ let
 
   soci = fetchgit {
     url = "https://github.com/SOCI/soci.git";
-    rev = "3a1f602b3021b925d38828e3ff95f9e7f8887ff7";
-    sha256 = "0lnps42cidlrn43h13b9yc8cs3fwgz7wb6a1kfc9rnw7swkh757f";
+    rev = "04e1870294918d20761736743bb6136314c42dd5";
+    sha256 = "0w3b7qi3bwn8bxh4qbqy6c1fw2bbwh7pxvk8b3qb6h4qgsh6kx89";
     leaveDotGit = true;
     fetchSubmodules = false;
   };
@@ -67,11 +61,11 @@ let
   };
 
   nudb = fetchgit rec {
-    url = "https://github.com/vinniefalco/NuDB.git";
-    rev = "1.0.0";
-    sha256 = "142bxicv25xaw4fmpw8bbblb1grdw30wyj181xl4a5734zw3qgmz";
+    url = "https://github.com/CPPAlliance/NuDB.git";
+    rev = "2.0.1";
+    sha256 = "0h7hmwavrxzj1v547h3z0031ckwphjayfpv1mgcr6q86wm9p5468";
     leaveDotGit = true;
-    fetchSubmodules = false;
+    fetchSubmodules = true; # submodules are needed, rocksdb is dependency
     postFetch = "cd $out && git tag ${rev}";
   };
 
@@ -88,40 +82,54 @@ let
     url = "https://github.com/google/googletest.git";
     rev = "c3bb0ee2a63279a803aaad956b9b26d74bf9e6e2";
     sha256 = "0pj5b6jnrj5lrccz2disr8hklbnzd8hwmrwbfqmvhiwb9q9p0k2k";
-    leaveDotGit = true;
     fetchSubmodules = false;
+    leaveDotGit = true;
   };
 
   google-benchmark = fetchgit {
     url = "https://github.com/google/benchmark.git";
     rev = "5b7683f49e1e9223cf9927b24f6fd3d6bd82e3f8";
     sha256 = "0qg70j47zqnrbszlgrzmxpr4g88kq0gyq6v16bhaggfm83c6mg6i";
-    leaveDotGit = true;
     fetchSubmodules = false;
+    leaveDotGit = true;
   };
+
+  # hack to merge rocksdb revisions from rocksdb and nudb, so build process
+  # will find both
+  rocksdb-merged = runCommand "rocksdb-merged" {
+    buildInputs = [ git ];
+  } ''
+    commit=$(cd ${nudb} && git ls-tree HEAD extras/rocksdb | awk '{ print $3  }')
+    git clone ${rocksdb} $out && cd $out
+    git fetch ${nudb}/extras/rocksdb $commit
+    git checkout $commit
+  '';
 in stdenv.mkDerivation rec {
   pname = "rippled";
-  version = "1.2.1";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "ripple";
     repo = "rippled";
     rev = version;
-    sha256 = "1lm0zzz0hi2sh2f4iqq3scapzdjbxcjgr700fgham9wqgaj2ash5";
+    sha256 = "1z04378bg8lcyrnn7sl3j2zfxbwwy2biasg1d4fbaq4snxg5d1pq";
   };
 
   hardeningDisable = ["format"];
-  cmakeFlags = ["-Dstatic=OFF"];
+  cmakeFlags = [
+    "-Dstatic=OFF"
+    "-DBOOST_LIBRARYDIR=${boost.out}/lib"
+    "-DBOOST_INCLUDEDIR=${boost.dev}/include"
+  ];
 
   nativeBuildInputs = [ pkgconfig cmake git ];
-  buildInputs = [ openssl openssl.dev boost zlib ];
+  buildInputs = [ openssl openssl.dev zlib ];
 
   preConfigure = ''
     export HOME=$PWD
 
-    git config --global url."file://${beast}".insteadOf "https://github.com/vinniefalco/Beast.git"
-    git config --global url."file://${docca}".insteadOf "https://github.com/vinniefalco/docca.git"
-    git config --global url."file://${rocksdb}".insteadOf "https://github.com/facebook/rocksdb.git"
+    git config --global url."file://${docca}".insteadOf "${docca.url}"
+    git config --global url."file://${rocksdb-merged}".insteadOf "${rocksdb.url}"
     git config --global url."file://${lz4}".insteadOf "${lz4.url}"
     git config --global url."file://${libarchive}".insteadOf "${libarchive.url}"
     git config --global url."file://${soci}".insteadOf "${soci.url}"
@@ -131,7 +139,7 @@ in stdenv.mkDerivation rec {
     git config --global url."file://${google-benchmark}".insteadOf "${google-benchmark.url}"
     git config --global url."file://${google-test}".insteadOf "${google-test.url}"
 
-    substituteInPlace CMakeLists.txt --replace "URL https://www.sqlite.org/2018/sqlite-amalgamation-3260000.zip" "URL ${sqlite3}"
+    substituteInPlace Builds/CMake/deps/Sqlite.cmake --replace "URL ${sqlite3.url}" "URL ${sqlite3}"
   '';
 
   doCheck = true;
@@ -141,7 +149,7 @@ in stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Ripple P2P payment network reference server";
-    homepage = https://ripple.com;
+    homepage = https://github.com/ripple/rippled;
     maintainers = with maintainers; [ ehmry offline ];
     license = licenses.isc;
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/servers/web-apps/moodle/default.nix b/pkgs/servers/web-apps/moodle/default.nix
index 2957d296dc4b..3de6005a3cf3 100644
--- a/pkgs/servers/web-apps/moodle/default.nix
+++ b/pkgs/servers/web-apps/moodle/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, writeText }:
 
 let
-  version = "3.8";
+  version = "3.8.1";
   stableVersion = builtins.substring 0 2 (builtins.replaceStrings ["."] [""] version);
 in
 
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://download.moodle.org/stable${stableVersion}/${pname}-${version}.tgz";
-    sha256 = "00ssx0drgp1fy062x6alp0x8di7hjn4xc87v8skpy3aznchfxyk9";
+    sha256 = "1xz2wq16blw9p2b6wlrn9lr524gddm5jyac5prka8kp6lrk0v0y1";
   };
 
   phpConfig = writeText "config.php" ''
diff --git a/pkgs/shells/bash/4.4.nix b/pkgs/shells/bash/4.4.nix
index 121368abf4c7..7ca57ac01564 100644
--- a/pkgs/shells/bash/4.4.nix
+++ b/pkgs/shells/bash/4.4.nix
@@ -41,9 +41,10 @@ stdenv.mkDerivation rec {
     -DSSH_SOURCE_BASHRC
   '';
 
-  patchFlags = [ "-p0" ];
+  patchFlags = [ "-p0" "-T" ];
 
   patches = upstreamPatches
+    ++ [ ./pgrp-pipe-4.4.patch ]
     ++ optional stdenv.hostPlatform.isCygwin ./cygwin-bash-4.4.11-2.src.patch
     # https://lists.gnu.org/archive/html/bug-bash/2016-10/msg00006.html
     ++ optional stdenv.hostPlatform.isMusl (fetchurl {
diff --git a/pkgs/shells/bash/5.0.nix b/pkgs/shells/bash/5.0.nix
index a06b08a5599c..05aaf39b3404 100644
--- a/pkgs/shells/bash/5.0.nix
+++ b/pkgs/shells/bash/5.0.nix
@@ -41,9 +41,10 @@ stdenv.mkDerivation rec {
     -DSSH_SOURCE_BASHRC
   '';
 
-  patchFlags = [ "-p0" ];
+  patchFlags = [ "-p0" "-T" ];
 
-  patches = upstreamPatches;
+  patches = upstreamPatches
+    ++ [ ./pgrp-pipe-5.0.patch ];
 
   configureFlags = [
     (if interactive then "--with-installed-readline" else "--disable-readline")
diff --git a/pkgs/shells/bash/pgrp-pipe-4.4.patch b/pkgs/shells/bash/pgrp-pipe-4.4.patch
new file mode 100644
index 000000000000..ea3d7bdf92b4
--- /dev/null
+++ b/pkgs/shells/bash/pgrp-pipe-4.4.patch
@@ -0,0 +1,29 @@
+diff -u ./configure ../bash-4.4-fixed/configure
+--- ./configure	2016-09-07 22:57:01.000000000 +0200
++++ ../bash-4.4-fixed/configure	2020-01-08 14:10:26.316858174 +0100
+@@ -16064,10 +16064,7 @@
+ solaris2*)	LOCAL_CFLAGS=-DSOLARIS ;;
+ lynxos*)	LOCAL_CFLAGS=-DRECYCLES_PIDS ;;
+ linux*)		LOCAL_LDFLAGS=-rdynamic		 # allow dynamic loading
+-		case "`uname -r`" in
+-		2.[456789]*|[34]*)	$as_echo "#define PGRP_PIPE 1" >>confdefs.h
+- ;;
+-		esac ;;
++		$as_echo "#define PGRP_PIPE 1" >>confdefs.h ;;
+ *qnx6*)		LOCAL_CFLAGS="-Dqnx -Dqnx6" LOCAL_LIBS="-lncurses" ;;
+ *qnx*)		LOCAL_CFLAGS="-Dqnx -F -3s" LOCAL_LDFLAGS="-3s" LOCAL_LIBS="-lunix -lncurses" ;;
+ powerux*)	LOCAL_LIBS="-lgen" ;;
+diff -u ./configure.ac ../bash-4.4-fixed/configure.ac
+--- ./configure.ac	2016-09-07 22:56:28.000000000 +0200
++++ ../bash-4.4-fixed/configure.ac	2016-09-07 22:56:28.000000000 +0200
+@@ -1092,9 +1092,7 @@
+ solaris2*)	LOCAL_CFLAGS=-DSOLARIS ;;
+ lynxos*)	LOCAL_CFLAGS=-DRECYCLES_PIDS ;;
+ linux*)		LOCAL_LDFLAGS=-rdynamic		 # allow dynamic loading
+-		case "`uname -r`" in
+-		2.[[456789]]*|[[34]]*)	AC_DEFINE(PGRP_PIPE) ;;
+-		esac ;;
++		AC_DEFINE(PGRP_PIPE) ;;
+ *qnx6*)		LOCAL_CFLAGS="-Dqnx -Dqnx6" LOCAL_LIBS="-lncurses" ;;
+ *qnx*)		LOCAL_CFLAGS="-Dqnx -F -3s" LOCAL_LDFLAGS="-3s" LOCAL_LIBS="-lunix -lncurses" ;;
+ powerux*)	LOCAL_LIBS="-lgen" ;;
diff --git a/pkgs/shells/bash/pgrp-pipe-5.0.patch b/pkgs/shells/bash/pgrp-pipe-5.0.patch
new file mode 100644
index 000000000000..2a9fa6f33c3b
--- /dev/null
+++ b/pkgs/shells/bash/pgrp-pipe-5.0.patch
@@ -0,0 +1,31 @@
+diff -u ./configure ../bash-5.0-fixed/configure
+--- ./configure	2019-01-02 15:43:31.000000000 +0100
++++ ../bash-5.0-fixed/configure	2020-01-08 14:18:21.017296179 +0100
+@@ -16312,11 +16312,7 @@
+ solaris2*)	LOCAL_CFLAGS=-DSOLARIS ;;
+ lynxos*)	LOCAL_CFLAGS=-DRECYCLES_PIDS ;;
+ linux*)		LOCAL_LDFLAGS=-rdynamic		 # allow dynamic loading
+-		case "`uname -r`" in
+-		1.*|2.[0123]*)	: ;;
+-		*)	$as_echo "#define PGRP_PIPE 1" >>confdefs.h
+- ;;
+-		esac ;;
++		$as_echo "#define PGRP_PIPE 1" >>confdefs.h ;;
+ netbsd*|openbsd*)	LOCAL_CFLAGS="-DDEV_FD_STAT_BROKEN" ;;
+ *qnx[67]*)	LOCAL_LIBS="-lncurses" ;;
+ *qnx*)		LOCAL_CFLAGS="-Dqnx -F -3s" LOCAL_LDFLAGS="-3s" LOCAL_LIBS="-lunix -lncurses" ;;
+diff -u ./configure.ac ../bash-5.0-fixed/configure.ac
+--- ./configure.ac	2019-01-02 15:39:11.000000000 +0100
++++ ../bash-5.0-fixed/configure.ac	2019-01-02 15:39:11.000000000 +0100
+@@ -1108,10 +1108,7 @@
+ solaris2*)	LOCAL_CFLAGS=-DSOLARIS ;;
+ lynxos*)	LOCAL_CFLAGS=-DRECYCLES_PIDS ;;
+ linux*)		LOCAL_LDFLAGS=-rdynamic		 # allow dynamic loading
+-		case "`uname -r`" in
+-		1.*|2.[[0123]]*)	: ;;
+-		*)	AC_DEFINE(PGRP_PIPE) ;;
+-		esac ;;
++		AC_DEFINE(PGRP_PIPE) ;;
+ netbsd*|openbsd*)	LOCAL_CFLAGS="-DDEV_FD_STAT_BROKEN" ;;
+ *qnx[[67]]*)	LOCAL_LIBS="-lncurses" ;;
+ *qnx*)		LOCAL_CFLAGS="-Dqnx -F -3s" LOCAL_LDFLAGS="-3s" LOCAL_LIBS="-lunix -lncurses" ;;
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 86a6e33c9424..f73fca48b7a7 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -190,13 +190,10 @@ in rec {
         useSharedLibraries = false;
       };
 
-      python = super.callPackage ../../development/interpreters/python/cpython/2.7/boot.nix {
-        CF = null;  # use CoreFoundation from bootstrap-tools
-        configd = null;
-      };
-      python2 = self.python;
+      python3 = super.python3Minimal;
 
       ninja = super.ninja.override { buildDocs = false; };
+
       darwin = super.darwin // {
         cctools = super.darwin.cctools.override {
           enableTapiSupport = false;
@@ -218,11 +215,11 @@ in rec {
   stage2 = prevStage: let
     persistent = self: super: with prevStage; {
       inherit
-        zlib patchutils m4 scons flex perl bison unifdef unzip openssl python
+        zlib patchutils m4 scons flex perl bison unifdef unzip openssl python3
         libxml2 gettext sharutils gmp libarchive ncurses pkg-config libedit groff
         openssh sqlite sed serf openldap db cyrus-sasl expat apr-util subversion xz
         findfreetype libssh curl cmake autoconf automake libtool ed cpio coreutils
-        libssh2 nghttp2 libkrb5 python2 ninja;
+        libssh2 nghttp2 libkrb5 ninja;
 
       darwin = super.darwin // {
         inherit (darwin)
@@ -252,11 +249,11 @@ in rec {
   stage3 = prevStage: let
     persistent = self: super: with prevStage; {
       inherit
-        patchutils m4 scons flex perl bison unifdef unzip openssl python
+        patchutils m4 scons flex perl bison unifdef unzip openssl python3
         gettext sharutils libarchive pkg-config groff bash subversion
         openssh sqlite sed serf openldap db cyrus-sasl expat apr-util
         findfreetype libssh curl cmake autoconf automake libtool cpio
-        libssh2 nghttp2 libkrb5 python2 ninja;
+        libssh2 nghttp2 libkrb5 ninja;
 
       # Avoid pulling in a full python and its extra dependencies for the llvm/clang builds.
       libxml2 = super.libxml2.override { pythonSupport = false; };
@@ -302,7 +299,7 @@ in rec {
   stage4 = prevStage: let
     persistent = self: super: with prevStage; {
       inherit
-        gnumake gzip gnused bzip2 gawk ed xz patch bash
+        gnumake gzip gnused bzip2 gawk ed xz patch bash python3
         ncurses libffi zlib gmp pcre gnugrep
         coreutils findutils diffutils patchutils ninja;
 
@@ -332,7 +329,7 @@ in rec {
         libxml2-nopython = super.libxml2.override { pythonSupport = false; };
         CF = super.darwin.CF.override {
           libxml2 = libxml2-nopython;
-          python = prevStage.python;
+          python3 = prevStage.python3;
         };
       };
     };
@@ -365,17 +362,6 @@ in rec {
         });
       in { inherit tools libraries; } // tools // libraries);
 
-      # N.B: the important thing here is to ensure that python == python2
-      # == python27 or you get weird issues with inconsistent package sets.
-      # In a particularly subtle bug, I overrode python2 instead of python27
-      # here, and it caused gnome-doc-utils to complain about:
-      # "PyThreadState_Get: no current thread". This is because Python gets
-      # really unhappy if you have Python A which loads a native python lib
-      # which was linked against Python B, which in our case was happening
-      # because we didn't override python "deeply enough". Anyway, this works
-      # and I'm just leaving this blurb here so people realize why it matters
-      python27 = super.python27.override { CF = prevStage.darwin.CF; };
-
       darwin = super.darwin // {
         inherit (darwin) dyld ICU Libsystem libiconv;
       } // lib.optionalAttrs (super.stdenv.targetPlatform == localSystem) {
@@ -438,7 +424,8 @@ in rec {
       inherit cc;
 
       darwin = super.darwin // {
-        xnu = super.darwin.xnu.override { python = super.python.override { configd = null; }; };
+        inherit (prevStage.darwin) CF;
+        xnu = super.darwin.xnu.override { inherit (prevStage) python3; };
       };
     });
   };
diff --git a/pkgs/stdenv/generic/default.nix b/pkgs/stdenv/generic/default.nix
index befeb4509973..df2d35d541b8 100644
--- a/pkgs/stdenv/generic/default.nix
+++ b/pkgs/stdenv/generic/default.nix
@@ -53,6 +53,7 @@ let lib = import ../../../lib; in lib.makeOverridable (
 let
   defaultNativeBuildInputs = extraNativeBuildInputs ++
     [ ../../build-support/setup-hooks/move-docs.sh
+      ../../build-support/setup-hooks/make-symlinks-relative.sh
       ../../build-support/setup-hooks/compress-man-pages.sh
       ../../build-support/setup-hooks/strip.sh
       ../../build-support/setup-hooks/patch-shebangs.sh
diff --git a/pkgs/tools/X11/libstrangle/nixos.patch b/pkgs/tools/X11/libstrangle/nixos.patch
index 912bdded6daf..03c8c19b54cf 100644
--- a/pkgs/tools/X11/libstrangle/nixos.patch
+++ b/pkgs/tools/X11/libstrangle/nixos.patch
@@ -26,4 +26,4 @@ index e280e86..b2dd42b 100755
 -# Execute the strangled program under a clean environment
  # pass through the FPS and overriden LD_PRELOAD environment variables
 -exec env FPS="${FPS}" LD_PRELOAD="${LD_PRELOAD}:libstrangle.so" "$@"
-+FPS="${FPS}" LD_LIBRARY_PATH="${LD_LIBRARY_PATH}:@out@/lib/libstrangle/lib64:@out@/lib/libstrangle/lib32" LD_PRELOAD="${LD_PRELOAD}:libstrangle.so" exec "$@"
++FPS="${FPS}" LD_LIBRARY_PATH="${LD_LIBRARY_PATH}${LD_LIBRARY_PATH:+:}@out@/lib/libstrangle/lib64:@out@/lib/libstrangle/lib32" LD_PRELOAD="${LD_PRELOAD}:libstrangle.so" exec "$@"
diff --git a/pkgs/tools/X11/primus/default.nix b/pkgs/tools/X11/primus/default.nix
index a70b619a6b46..eb8aa042e7b0 100644
--- a/pkgs/tools/X11/primus/default.nix
+++ b/pkgs/tools/X11/primus/default.nix
@@ -27,7 +27,7 @@ let
 
 in writeScriptBin "primusrun" ''
   #!${runtimeShell}
-  export LD_LIBRARY_PATH=${ldPath}:$LD_LIBRARY_PATH
+  export LD_LIBRARY_PATH=${ldPath}''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH
   # https://bugs.launchpad.net/ubuntu/+source/bumblebee/+bug/1758243
   export __GLVND_DISALLOW_PATCHING=1
   exec "$@"
diff --git a/pkgs/tools/admin/awscli/default.nix b/pkgs/tools/admin/awscli/default.nix
index f38d4cd1a1d6..06ddd0e85896 100644
--- a/pkgs/tools/admin/awscli/default.nix
+++ b/pkgs/tools/admin/awscli/default.nix
@@ -57,9 +57,6 @@ in py.pkgs.buildPythonApplication rec {
     pyyaml
     groff
     less
-    urllib3
-    dateutil
-    jmespath
   ];
 
   postInstall = ''
diff --git a/pkgs/tools/admin/azure-cli/default.nix b/pkgs/tools/admin/azure-cli/default.nix
index 1a492c41aeec..cc793f8300dc 100644
--- a/pkgs/tools/admin/azure-cli/default.nix
+++ b/pkgs/tools/admin/azure-cli/default.nix
@@ -1,12 +1,12 @@
 { stdenv, lib, python, fetchFromGitHub, installShellFiles }:
 
 let
-  version = "2.0.79";
+  version = "2.0.80";
   src = fetchFromGitHub {
     owner = "Azure";
     repo = "azure-cli";
     rev = "azure-cli-${version}";
-    sha256 = "0fzpq5fnqxkjghsjk4hi3jng5lgywpvj3fzb5sb7nb7ymvkvhad2";
+    sha256 = "05j74cfxjpi3w79w0i5av3h2m81bavbsc581vvh773ixivndds1k";
   };
 
   # put packages that needs to be overriden in the py package scope
diff --git a/pkgs/tools/admin/azure-cli/python-packages.nix b/pkgs/tools/admin/azure-cli/python-packages.nix
index ac0e633cb967..290800e42260 100644
--- a/pkgs/tools/admin/azure-cli/python-packages.nix
+++ b/pkgs/tools/admin/azure-cli/python-packages.nix
@@ -207,8 +207,8 @@ let
       azure-mgmt-authorization = overrideAzureMgmtPackage super.azure-mgmt-authorization "0.52.0" "zip"
         "0357laxgldb7lvvws81r8xb6mrq9dwwnr1bnwdnyj4bw6p21i9hn";
 
-      azure-mgmt-storage = overrideAzureMgmtPackage super.azure-mgmt-storage "7.0.0" "zip"
-        "01f17fb1myskj72zarc67i1sxfvk66lid9zn12gwjrz2vqc6npkz";
+      azure-mgmt-storage = overrideAzureMgmtPackage super.azure-mgmt-storage "7.1.0" "zip"
+        "03yjvw1dwkwsadsv60i625mr9zpdryy7ywvh7p8fg60djszh1p5l";
 
       azure-mgmt-servicefabric = overrideAzureMgmtPackage super.azure-mgmt-servicefabric "0.2.0" "zip"
         "1bcq6fcgrsvmk6q7v8mxzn1180jm2qijdqkqbv1m117zp1wj5gxj";
diff --git a/pkgs/tools/admin/eksctl/default.nix b/pkgs/tools/admin/eksctl/default.nix
index e5fcf3933ebc..3cadafc633ee 100644
--- a/pkgs/tools/admin/eksctl/default.nix
+++ b/pkgs/tools/admin/eksctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "eksctl";
-  version = "0.11.1";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = version;
-    sha256 = "197lf6cb1maam1yxy29wgp4dkakaavmwqvq2d9i4qxhscalrdra5";
+    sha256 = "1m4hcj2bi9v3ngjj2x1fifcnb450jrij06vbi3j28slsdwn1bcc8";
   };
 
-  modSha256 = "04ba3dyfwlf0m6kn7yp7qyp3h2qdwp17y1f9pa79y3c6sd2nadk2";
+  modSha256 = "1c8qyxzfazgw77rlv3yw2x39ymaq66jjd51im0jl4131a6hzj6fd";
 
   subPackages = [ "cmd/eksctl" ];
 
diff --git a/pkgs/tools/filesystems/btrfs-progs/default.nix b/pkgs/tools/filesystems/btrfs-progs/default.nix
index 1da8470280b8..e3545315d6f7 100644
--- a/pkgs/tools/filesystems/btrfs-progs/default.nix
+++ b/pkgs/tools/filesystems/btrfs-progs/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "btrfs-progs";
-  version = "5.4";
+  version = "5.4.1";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${version}.tar.xz";
-    sha256 = "1ykhasv0jc3qi3xrm5841mzkmlbkjw6rm70gl4aww90jj6ak55qg";
+    sha256 = "0scxg9p6z0wss92gmv5a8yxdmr8x449kb5v3bfnvs26n92r7zq7k";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/filesystems/ceph/default.nix b/pkgs/tools/filesystems/ceph/default.nix
index 9c7704410251..34f8ff8f447a 100644
--- a/pkgs/tools/filesystems/ceph/default.nix
+++ b/pkgs/tools/filesystems/ceph/default.nix
@@ -134,7 +134,7 @@ in rec {
       substituteInPlace src/common/module.c --replace "/sbin/modprobe" "modprobe"
 
       # for pybind/rgw to find internal dep
-      export LD_LIBRARY_PATH="$PWD/build/lib:$LD_LIBRARY_PATH"
+      export LD_LIBRARY_PATH="$PWD/build/lib''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
       # install target needs to be in PYTHONPATH for "*.pth support" check to succeed
 
       patchShebangs src/script src/spdk src/test src/tools
diff --git a/pkgs/tools/misc/broot/default.nix b/pkgs/tools/misc/broot/default.nix
index 63d5ff69e790..7980298eba16 100644
--- a/pkgs/tools/misc/broot/default.nix
+++ b/pkgs/tools/misc/broot/default.nix
@@ -1,17 +1,32 @@
-{ stdenv, rustPlatform, fetchFromGitHub }:
+{ stdenv, rustPlatform, fetchFromGitHub, coreutils, installShellFiles }:
 
 rustPlatform.buildRustPackage rec {
   pname = "broot";
-  version = "0.10.2";
+  version = "0.11.8";
 
   src = fetchFromGitHub {
     owner = "Canop";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1wisqb4cqdgsnjvmpgxbzs9zcw6npqw1kqxxs8mn33sxlikhbf2l";
+    sha256 = "1pbjlfwv4s50s731ryrcc54200g2i04acdxrxk4kpcvi6b19kbky";
   };
 
-  cargoSha256 = "09gnyj97akychin1axp9kcww3c04xx7x1qnplhs2yxfki62r4y2b";
+  cargoSha256 = "07ncclp4yqqr2lncw4bbcmknm09qzmdcq8iwkhyyfiy3fpyw9hqc";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postPatch = ''
+    substituteInPlace src/verb_store.rs --replace '"/bin/' '"${coreutils}/bin/'
+  '';
+
+  postInstall = ''
+    # install shell completion files
+    OUT_DIR=target/release/build/broot-*/out
+
+    installShellCompletion --bash $OUT_DIR/{br,broot}.bash
+    installShellCompletion --fish $OUT_DIR/{br,broot}.fish
+    installShellCompletion --zsh $OUT_DIR/{_br,_broot}
+  '';
 
   meta = with stdenv.lib; {
     description = "An interactive tree view, a fuzzy search, a balanced BFS descent and customizable commands";
diff --git a/pkgs/tools/misc/coreutils/coreutils-8.31-android-cross.patch b/pkgs/tools/misc/coreutils/coreutils-8.31-android-cross.patch
new file mode 100644
index 000000000000..97d95d1c5b19
--- /dev/null
+++ b/pkgs/tools/misc/coreutils/coreutils-8.31-android-cross.patch
@@ -0,0 +1,51 @@
+From 3bd82a82cf4ba693d2c31c7b95aaec4e56dc92a4 Mon Sep 17 00:00:00 2001
+From: Paul Eggert <eggert@cs.ucla.edu>
+Date: Mon, 11 Mar 2019 16:40:29 -0700
+Subject: [PATCH 1/1] strtod: fix clash with strtold
+
+Problem reported for RHEL 5 by Jesse Caldwell (Bug#34817).
+* lib/strtod.c (compute_minus_zero, minus_zero):
+Simplify by remving the macro / external variable,
+and having just a function.  User changed.  This avoids
+the need for an external variable that might clash.
+---
+ ChangeLog    |  9 +++++++++
+ lib/strtod.c | 11 +++++------
+ 2 files changed, 14 insertions(+), 6 deletions(-)
+
+diff --git a/lib/strtod.c b/lib/strtod.c
+index b9eaa51..69b1564 100644
+--- a/lib/strtod.c
++++ b/lib/strtod.c
+@@ -294,16 +294,15 @@ parse_number (const char *nptr,
+    ICC 10.0 has a bug when optimizing the expression -zero.
+    The expression -MIN * MIN does not work when cross-compiling
+    to PowerPC on Mac OS X 10.5.  */
+-#if defined __hpux || defined __sgi || defined __ICC
+ static DOUBLE
+-compute_minus_zero (void)
++minus_zero (void)
+ {
++#if defined __hpux || defined __sgi || defined __ICC
+   return -MIN * MIN;
+-}
+-# define minus_zero compute_minus_zero ()
+ #else
+-DOUBLE minus_zero = -0.0;
++  return -0.0;
+ #endif
++}
+ 
+ /* Convert NPTR to a DOUBLE.  If ENDPTR is not NULL, a pointer to the
+    character after the last one used in the number is put in *ENDPTR.  */
+@@ -479,6 +478,6 @@ STRTOD (const char *nptr, char **endptr)
+   /* Special case -0.0, since at least ICC miscompiles negation.  We
+      can't use copysign(), as that drags in -lm on some platforms.  */
+   if (!num && negative)
+-    return minus_zero;
++    return minus_zero ();
+   return negative ? -num : num;
+ }
+-- 
+1.9.1
+
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index cbe97dda9e5a..519a33c60d69 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -15,7 +15,7 @@ assert selinuxSupport -> libselinux != null && libsepol != null;
 
 with lib;
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (rec {
   pname = "coreutils";
   version = "8.31";
 
@@ -29,7 +29,9 @@ stdenv.mkDerivation rec {
          # To be removed in coreutils-8.32.
          ++ optional stdenv.hostPlatform.isMusl ./avoid-false-positive-in-date-debug-test.patch
          # Fix compilation in musl-cross environments. To be removed in coreutils-8.32.
-         ++ optional stdenv.hostPlatform.isMusl ./coreutils-8.31-musl-cross.patch;
+         ++ optional stdenv.hostPlatform.isMusl ./coreutils-8.31-musl-cross.patch
+         # Fix compilation in android-cross environments. To be removed in coreutils-8.32.
+         ++ [ ./coreutils-8.31-android-cross.patch ];
 
   postPatch = ''
     # The test tends to fail on btrfs,f2fs and maybe other unusual filesystems.
@@ -143,8 +145,9 @@ stdenv.mkDerivation rec {
 
     maintainers = [ maintainers.eelco ];
   };
-
 } // optionalAttrs stdenv.hostPlatform.isMusl {
   # Work around a bogus warning in conjunction with musl.
   NIX_CFLAGS_COMPILE = "-Wno-error";
-}
+} // stdenv.lib.optionalAttrs stdenv.hostPlatform.isAndroid {
+  NIX_CFLAGS_COMPILE = "-D__USE_FORTIFY_LEVEL=0";
+})
diff --git a/pkgs/tools/misc/diffoscope/default.nix b/pkgs/tools/misc/diffoscope/default.nix
index b64c527a6b99..c9f61ee34592 100644
--- a/pkgs/tools/misc/diffoscope/default.nix
+++ b/pkgs/tools/misc/diffoscope/default.nix
@@ -35,11 +35,14 @@ python3Packages.buildPythonApplication rec {
   #
   # Still missing these tools: abootimg docx2txt dumpxsb enjarify js-beautify lipo oggDump otool procyon-decompiler Rscript wasm2wat zipnode
   # Also these libraries: python3-guestfs
-  pythonPath = with python3Packages; [ debian libarchive-c python_magic tlsh rpm pyxattr ] ++ [
-      acl binutils-unwrapped bzip2 cdrkit colordiff coreutils cpio db diffutils
+  pythonPath = [
+      binutils-unwrapped bzip2 colordiff coreutils cpio db diffutils
       dtc e2fsprogs file findutils fontforge-fonttools gettext gnutar gzip
-      libarchive libcaca lz4 pgpdump progressbar33 sng sqlite squashfsTools unzip xxd xz
-    ] ++ lib.optionals enableBloat [
+      libarchive libcaca lz4 pgpdump sng sqlite squashfsTools unzip xxd xz
+    ]
+    ++ (with python3Packages; [ debian libarchive-c python_magic tlsh rpm progressbar33 ])
+    ++ lib.optionals stdenv.isLinux [ python3Packages.pyxattr acl cdrkit ]
+    ++ lib.optionals enableBloat [
       apktool cbfstool colord fpc ghc ghostscriptX giflib gnupg gnumeric imagemagick
       llvm jdk mono openssh pdftk poppler_utils tcpdump unoconv
       python3Packages.guestfs
@@ -69,6 +72,6 @@ python3Packages.buildPythonApplication rec {
     homepage    = https://wiki.debian.org/ReproducibleBuilds;
     license     = licenses.gpl3Plus;
     maintainers = with maintainers; [ dezgeg ];
-    platforms   = platforms.linux;
+    platforms   = platforms.unix;
   };
 }
diff --git a/pkgs/tools/misc/ethtool/default.nix b/pkgs/tools/misc/ethtool/default.nix
index bffc8a01f920..ec1e2c48e640 100644
--- a/pkgs/tools/misc/ethtool/default.nix
+++ b/pkgs/tools/misc/ethtool/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ethtool";
-  version = "5.3";
+  version = "5.4";
 
   src = fetchurl {
-    url = "mirror://kernel/software/network/ethtool/${pname}-${version}.tar.xz";
-    sha256 = "1i14zrg4a84zjpwvqi8an0zx0hm06g614a79zc2syrkhrvdw1npk";
+    url = "mirror://kernel/software/network/${pname}/${pname}-${version}.tar.xz";
+    sha256 = "0srbqp4a3x9ryrbm5q854375y04ni8j0bmsrl89nmsyn4x4ixy12";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/hakuneko/default.nix b/pkgs/tools/misc/hakuneko/default.nix
index 8c2e7dc7451d..0a27397551d9 100644
--- a/pkgs/tools/misc/hakuneko/default.nix
+++ b/pkgs/tools/misc/hakuneko/default.nix
@@ -1,28 +1,84 @@
-{ stdenv, fetchurl, wxGTK30, openssl, curl }:
-
+{ atomEnv
+, autoPatchelfHook
+, dpkg
+, fetchurl
+, makeDesktopItem
+, makeWrapper
+, udev
+, stdenv
+, wrapGAppsHook
+}:
+let
+  desktopItem = makeDesktopItem {
+    desktopName = "HakuNeko Desktop";
+    genericName = "Manga & Anime Downloader";
+    categories = "Network;FileTransfer;";
+    exec = "hakuneko";
+    icon = "hakuneko-desktop";
+    name = "hakuneko-desktop";
+    type = "Application";
+  };
+in
 stdenv.mkDerivation rec {
   pname = "hakuneko";
-  version = "1.4.2";
+  version = "5.0.8";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/hakuneko/hakuneko_${version}_src.tar.gz";
-    sha256 = "76a63fa05e91b082cb5a70a8abacef005354e99978ff8b1369f7aa0af7615d52";
-  };
+  src = {
+    "x86_64-linux" = fetchurl {
+      url = "https://github.com/manga-download/hakuneko/releases/download/v${version}/hakuneko-desktop_${version}_linux_amd64.deb";
+      sha256 = "924df1d7a0ab54b918529165317e4428b423c9045548d1e36bd634914f7957f0";
+    };
+    "i686-linux" = fetchurl {
+      url = "https://github.com/manga-download/hakuneko/releases/download/v${version}/hakuneko-desktop_${version}_linux_i386.deb";
+      sha256 = "988d8b0e8447dcd0a8d85927f5877bca9efb8e4b09ed3c80a6788390e54a48d2";
+    };
+  }."${stdenv.hostPlatform.system}";
+
+  dontBuild = true;
+  dontConfigure = true;
+  dontPatchELF = true;
+  dontWrapGApps = true;
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    dpkg
+    makeWrapper
+    wrapGAppsHook
+  ];
+
+  buildInputs = atomEnv.packages;
+
+  unpackPhase = ''
+    # The deb file contains a setuid binary, so 'dpkg -x' doesn't work here
+    dpkg --fsys-tarfile $src | tar --extract
+  '';
 
-  preConfigure = ''
-    substituteInPlace ./configure \
-       --replace /bin/bash $shell
-    '';
+  installPhase = ''
+    cp -R usr "$out"
+    # Overwrite existing .desktop file.
+    cp "${desktopItem}/share/applications/hakuneko-desktop.desktop" \
+       "$out/share/applications/hakuneko-desktop.desktop"
+  '';
 
-  buildInputs = [ wxGTK30 openssl curl ];
+  runtimeDependencies = [
+    udev.lib
+  ];
 
-  meta = {
-    description = "Manga downloader";
-    homepage = https://sourceforge.net/projects/hakuneko/;
-    license = stdenv.lib.licenses.mit;
-    platforms = stdenv.lib.platforms.linux;
+  postFixup = ''
+    makeWrapper $out/lib/hakuneko-desktop/hakuneko $out/bin/hakuneko \
+      "''${gappsWrapperArgs[@]}"
+  '';
 
-    # This project was abandoned upstream.
-    broken = true;
+  meta = with stdenv.lib; {
+    description = "Manga & Anime Downloader";
+    homepage = "https://sourceforge.net/projects/hakuneko/";
+    license = licenses.unlicense;
+    maintainers = with maintainers; [
+      nloomans
+    ];
+    platforms = [
+      "x86_64-linux"
+      "i686-linux"
+    ];
   };
 }
diff --git a/pkgs/tools/misc/snapper/default.nix b/pkgs/tools/misc/snapper/default.nix
index 466a5f3faf1c..283503f28788 100644
--- a/pkgs/tools/misc/snapper/default.nix
+++ b/pkgs/tools/misc/snapper/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "snapper";
-  version = "0.8.7";
+  version = "0.8.8";
 
   src = fetchFromGitHub {
     owner = "openSUSE";
     repo = "snapper";
     rev = "v${version}";
-    sha256 = "0605j4f3plb6q8lwf82y2jhply6dwj49jgxk8j16wsbf5k7lqzfq";
+    sha256 = "0wpf82xf61r9r20whhb83wk3408wac1if8awqm3bb36b9j7ni5jr";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/networking/axel/default.nix b/pkgs/tools/networking/axel/default.nix
index 1fa43e5849e2..a9ddd9a8b682 100644
--- a/pkgs/tools/networking/axel/default.nix
+++ b/pkgs/tools/networking/axel/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     description = "Console downloading program with some features for parallel connections for faster downloading";
     homepage = "https://github.com/axel-download-accelerator/axel";
     maintainers = with maintainers; [ pSub ];
-    platforms = with platforms; linux;
+    platforms = with platforms; unix;
     license = licenses.gpl2;
   };
 }
diff --git a/pkgs/tools/networking/bandwhich/default.nix b/pkgs/tools/networking/bandwhich/default.nix
index cfccefab3517..ae45e0c1fc12 100644
--- a/pkgs/tools/networking/bandwhich/default.nix
+++ b/pkgs/tools/networking/bandwhich/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "bandwhich";
-  version = "0.8.0";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "imsnif";
     repo = pname;
     rev = version;
-    sha256 = "1pd0hy17knalq4m5517ymbg95fa141843ir9283djlh3iqfgkm37";
+    sha256 = "0gjk84a4ks5107vrchwwnslpbcrprmznjy3sqn2mrwfvw5biycb3";
   };
 
-  cargoSha256 = "14mb6rbjxv3r8awvy0rjc23lyhg92q1q1dik6q1za1aq9w8yipwf";
+  cargoSha256 = "1sa81570cvvpqgdcpnb08b0q4c6ap8a2wxfp2z336jzbv0zgv8a6";
 
   buildInputs = stdenv.lib.optional stdenv.isDarwin Security;
 
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index 051271e97884..a732ddcb89ea 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -28,14 +28,14 @@ assert brotliSupport -> brotli != null;
 assert gssSupport -> libkrb5 != null;
 
 stdenv.mkDerivation rec {
-  name = "curl-7.67.0";
+  name = "curl-7.68.0";
 
   src = fetchurl {
     urls = [
       "https://curl.haxx.se/download/${name}.tar.bz2"
       "https://github.com/curl/curl/releases/download/${lib.replaceStrings ["."] ["_"] name}/${name}.tar.bz2"
     ];
-    sha256 = "0v2qb1c82m3qzkiyglsg1745qi791i9pl1jgnks8nm0sh9b6jpyx";
+    sha256 = "1fgf4f33wj25jk6lkpxmrvmfnnxvc66z3k3561rxr8nngn8m8zr0";
   };
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
diff --git a/pkgs/tools/networking/modem-manager/default.nix b/pkgs/tools/networking/modem-manager/default.nix
index 221e873387f1..8d173997d712 100644
--- a/pkgs/tools/networking/modem-manager/default.nix
+++ b/pkgs/tools/networking/modem-manager/default.nix
@@ -3,12 +3,12 @@
 
 stdenv.mkDerivation rec {
   pname = "modem-manager";
-  version = "1.10.6";
+  version = "1.12.2";
 
   package = "ModemManager";
   src = fetchurl {
     url = "https://www.freedesktop.org/software/${package}/${package}-${version}.tar.xz";
-    sha256 = "15n9sd6ymxvw7hidc9pw81j89acwi5cjfhj220a68mi1h8vsfb1w";
+    sha256 = "1si5bnm0d3b5ccpgj7xakl7pgy9mypm8ds6xgj1q0rzds2yx4xjg";
   };
 
   nativeBuildInputs = [ vala gobject-introspection gettext pkgconfig ];
diff --git a/pkgs/tools/networking/network-manager/default.nix b/pkgs/tools/networking/network-manager/default.nix
index e762ac73844c..1a33a735cfe4 100644
--- a/pkgs/tools/networking/network-manager/default.nix
+++ b/pkgs/tools/networking/network-manager/default.nix
@@ -4,17 +4,17 @@
 , gobject-introspection, modemmanager, openresolv, libndp, newt, libsoup
 , ethtool, gnused, iputils, kmod, jansson, gtk-doc, libxslt
 , docbook_xsl, docbook_xml_dtd_412, docbook_xml_dtd_42, docbook_xml_dtd_43
-, openconnect, curl, meson, ninja, libpsl }:
+, openconnect, curl, meson, ninja, libpsl, mobile-broadband-provider-info, runtimeShell }:
 
 let
   pythonForDocs = python3.withPackages (pkgs: with pkgs; [ pygobject3 ]);
 in stdenv.mkDerivation rec {
   pname = "network-manager";
-  version = "1.20.8";
+  version = "1.22.4";
 
   src = fetchurl {
     url = "mirror://gnome/sources/NetworkManager/${stdenv.lib.versions.majorMinor version}/NetworkManager-${version}.tar.xz";
-    sha256 = "1ijpnx25wy5bcvp4mc49va942q56d0pncpj4jpknpdzwilmf455d";
+    sha256 = "0682hm5l3ix8cq35yl5pxidri4kxbdnvj9llf8vg9mcg5abdaslv";
   };
 
   outputs = [ "out" "dev" "devdoc" "man" "doc" ];
@@ -54,8 +54,8 @@ in stdenv.mkDerivation rec {
   patches = [
     (substituteAll {
       src = ./fix-paths.patch;
-      inherit iputils kmod openconnect ethtool gnused dbus;
-      inherit (stdenv) shell;
+      inherit iputils kmod openconnect ethtool gnused systemd;
+      inherit runtimeShell;
     })
 
     # Meson does not support using different directories during build and
@@ -64,7 +64,7 @@ in stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    systemd libselinux audit libpsl libuuid polkit ppp libndp curl
+    systemd libselinux audit libpsl libuuid polkit ppp libndp curl mobile-broadband-provider-info
     bluez5 dnsmasq gobject-introspection modemmanager readline newt libsoup jansson
   ];
 
diff --git a/pkgs/tools/networking/network-manager/fix-install-paths.patch b/pkgs/tools/networking/network-manager/fix-install-paths.patch
index 5798c1edfb6e..02a006c1c3db 100644
--- a/pkgs/tools/networking/network-manager/fix-install-paths.patch
+++ b/pkgs/tools/networking/network-manager/fix-install-paths.patch
@@ -1,8 +1,8 @@
 diff --git a/meson.build b/meson.build
-index 4105a9c80..3d912557f 100644
+index 0af69f35d..9ab239c8a 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -884,9 +884,9 @@ meson.add_install_script(
+@@ -912,9 +912,9 @@ meson.add_install_script(
    join_paths('tools', 'meson-post-install.sh'),
    nm_datadir,
    nm_bindir,
@@ -11,19 +11,6 @@ index 4105a9c80..3d912557f 100644
    nm_pkglibdir,
 -  nm_pkgstatedir,
 +  nm_prefix + nm_pkgstatedir,
-   enable_docs ? 'install_docs' : '',
    nm_mandir,
- )
-diff --git a/src/settings/plugins/ifcfg-rh/meson.build b/src/settings/plugins/ifcfg-rh/meson.build
-index 58acdcfcb..e3a16d597 100644
---- a/src/settings/plugins/ifcfg-rh/meson.build
-+++ b/src/settings/plugins/ifcfg-rh/meson.build
-@@ -69,7 +69,7 @@ install_data(
- )
- 
- meson.add_install_script('sh', '-c',
--                         'mkdir -p $DESTDIR/@0@/sysconfig/network-scripts'.format(nm_sysconfdir))
-+                         'mkdir -p $DESTDIR/@0@/sysconfig/network-scripts'.format(nm_prefix + nm_sysconfdir))
- 
- if enable_tests
-   subdir('tests')
+   nm_sysconfdir,
+   enable_docs ? '1' : '0',
diff --git a/pkgs/tools/networking/network-manager/fix-paths.patch b/pkgs/tools/networking/network-manager/fix-paths.patch
index c45dc174a0df..af35fc0a36bf 100644
--- a/pkgs/tools/networking/network-manager/fix-paths.patch
+++ b/pkgs/tools/networking/network-manager/fix-paths.patch
@@ -1,8 +1,8 @@
 diff --git a/clients/common/nm-vpn-helpers.c b/clients/common/nm-vpn-helpers.c
-index 204b7c286..8bdb734c2 100644
+index ffae5f553..ba1093e4d 100644
 --- a/clients/common/nm-vpn-helpers.c
 +++ b/clients/common/nm-vpn-helpers.c
-@@ -215,10 +215,7 @@ nm_vpn_openconnect_authenticate_helper (const char *host,
+@@ -203,10 +203,7 @@ nm_vpn_openconnect_authenticate_helper (const char *host,
  		NULL,
  	};
  
@@ -15,7 +15,7 @@ index 204b7c286..8bdb734c2 100644
  	if (!g_spawn_sync (NULL,
  	                   (char **) NM_MAKE_STRV (path, "--authenticate", host),
 diff --git a/data/84-nm-drivers.rules b/data/84-nm-drivers.rules
-index e398cb9f2..31c56596a 100644
+index e398cb9f2..a43d61864 100644
 --- a/data/84-nm-drivers.rules
 +++ b/data/84-nm-drivers.rules
 @@ -7,6 +7,6 @@ ACTION!="add|change", GOTO="nm_drivers_end"
@@ -23,27 +23,27 @@ index e398cb9f2..31c56596a 100644
  ENV{ID_NET_DRIVER}=="?*", GOTO="nm_drivers_end"
  DRIVERS=="?*", GOTO="nm_drivers_end"
 -PROGRAM="/bin/sh -c '/usr/sbin/ethtool -i $$1 |/usr/bin/sed -n s/^driver:\ //p' -- $env{INTERFACE}", ENV{ID_NET_DRIVER}="%c"
-+PROGRAM="@shell@ -c '@ethtool@/bin/ethtool -i $$1 |@gnused@/bin/sed -n s/^driver:\ //p' -- $env{INTERFACE}", ENV{ID_NET_DRIVER}="%c"
++PROGRAM="@runtimeShell@ -c '@ethtool@/bin/ethtool -i $$1 |@gnused@/bin/sed -n s/^driver:\ //p' -- $env{INTERFACE}", ENV{ID_NET_DRIVER}="%c"
  
  LABEL="nm_drivers_end"
 diff --git a/data/NetworkManager.service.in b/data/NetworkManager.service.in
-index 2f442bf23..c3e797bf4 100644
+index 91ebd9a36..5201a56c3 100644
 --- a/data/NetworkManager.service.in
 +++ b/data/NetworkManager.service.in
 @@ -8,7 +8,7 @@ Before=network.target @DISTRO_NETWORK_SERVICE@
  [Service]
  Type=dbus
  BusName=org.freedesktop.NetworkManager
--ExecReload=/usr/bin/dbus-send --print-reply --system --type=method_call --dest=org.freedesktop.NetworkManager /org/freedesktop/NetworkManager org.freedesktop.NetworkManager.Reload uint32:0
-+ExecReload=@dbus@/bin/dbus-send --print-reply --system --type=method_call --dest=org.freedesktop.NetworkManager /org/freedesktop/NetworkManager org.freedesktop.NetworkManager.Reload uint32:0
+-ExecReload=/usr/bin/busctl call org.freedesktop.NetworkManager /org/freedesktop/NetworkManager org.freedesktop.NetworkManager Reload u 0
++ExecReload=@systemd@/bin/busctl call org.freedesktop.NetworkManager /org/freedesktop/NetworkManager org.freedesktop.NetworkManager Reload u 0
  #ExecReload=/bin/kill -HUP $MAINPID
  ExecStart=@sbindir@/NetworkManager --no-daemon
  Restart=on-failure
 diff --git a/libnm/meson.build b/libnm/meson.build
-index 710ef181d..3aa182dd4 100644
+index 51ca46d2b..0c04cc216 100644
 --- a/libnm/meson.build
 +++ b/libnm/meson.build
-@@ -280,7 +280,7 @@ if enable_introspection
+@@ -261,7 +261,7 @@ if enable_introspection
      name,
      input: libnm_gir[0],
      output: name,
@@ -52,20 +52,20 @@ index 710ef181d..3aa182dd4 100644
      depends: libnm_gir,
    )
  
-@@ -289,7 +289,7 @@ if enable_introspection
+@@ -270,7 +270,7 @@ if enable_introspection
      name,
-     input: libnm_gir[0],
+     input: [libnm_gir[0], nm_settings_docs_overrides],
      output: name,
--    command: [generate_setting_docs_env, python.path(), generate_setting_docs, '--lib-path', meson.current_build_dir(), '--gir', '@INPUT@', '--overrides', nm_settings_docs_overrides, '--output', '@OUTPUT@'],
-+    command: [generate_setting_docs_env, generate_setting_docs, '--lib-path', meson.current_build_dir(), '--gir', '@INPUT@', '--overrides', nm_settings_docs_overrides, '--output', '@OUTPUT@'],
+-    command: [generate_setting_docs_env, python.path(), generate_setting_docs, '--lib-path', meson.current_build_dir(), '--gir', '@INPUT0@', '--overrides', '@INPUT1@', '--output', '@OUTPUT@'],
++    command: [generate_setting_docs_env, generate_setting_docs, '--lib-path', meson.current_build_dir(), '--gir', '@INPUT0@', '--overrides', '@INPUT1@', '--output', '@OUTPUT@'],
      depends: libnm_gir,
    )
  endif
 diff --git a/src/devices/nm-device.c b/src/devices/nm-device.c
-index 67e23b8f9..b0ce52711 100644
+index e7a4a059a..0a8f8b7c6 100644
 --- a/src/devices/nm-device.c
 +++ b/src/devices/nm-device.c
-@@ -12840,14 +12840,14 @@ nm_device_start_ip_check (NMDevice *self)
+@@ -13179,14 +13179,14 @@ nm_device_start_ip_check (NMDevice *self)
  			gw = nm_ip4_config_best_default_route_get (priv->ip_config_4);
  			if (gw) {
  				nm_utils_inet4_ntop (NMP_OBJECT_CAST_IP4_ROUTE (gw)->gateway, buf);
@@ -83,10 +83,10 @@ index 67e23b8f9..b0ce52711 100644
  			}
  		}
 diff --git a/src/nm-core-utils.c b/src/nm-core-utils.c
-index d896d4d33..4cacb5cb6 100644
+index fb92289f0..c91b27b09 100644
 --- a/src/nm-core-utils.c
 +++ b/src/nm-core-utils.c
-@@ -446,7 +446,7 @@ nm_utils_modprobe (GError **error, gboolean suppress_error_logging, const char *
+@@ -336,7 +336,7 @@ nm_utils_modprobe (GError **error, gboolean suppress_error_logging, const char *
  
  	/* construct the argument list */
  	argv = g_ptr_array_sized_new (4);
diff --git a/pkgs/tools/security/fido2luks/default.nix b/pkgs/tools/security/fido2luks/default.nix
new file mode 100644
index 000000000000..0bb5a91a81a7
--- /dev/null
+++ b/pkgs/tools/security/fido2luks/default.nix
@@ -0,0 +1,32 @@
+{ stdenv
+, rustPlatform
+, fetchFromGitHub
+, cryptsetup
+, pkg-config
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "fido2luks";
+  version = "0.2.2";
+
+  src = fetchFromGitHub {
+    owner = "shimunn";
+    repo = pname;
+    rev = version;
+    sha256 = "018qzbgmgm0f0d0c7i54nqqjbr4k5mzy1xfavi6hpifjll971wci";
+  };
+
+  buildInputs = [ cryptsetup ];
+  nativeBuildInputs = [ pkg-config ];
+
+  cargoSha256 = "1kf757wxxk5h8dfbz588qw1pnyjbg5qzr7rz14i7x8rhmn5xwb74";
+  verifyCargoDeps = true;
+
+  meta = with stdenv.lib; {
+    description = "Decrypt your LUKS partition using a FIDO2 compatible authenticator";
+    homepage = "https://github.com/shimunn/fido2luks";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ prusnak mmahut ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/tools/security/jwt-cli/default.nix b/pkgs/tools/security/jwt-cli/default.nix
index 7146cc52e9e1..83b630a4f4f6 100644
--- a/pkgs/tools/security/jwt-cli/default.nix
+++ b/pkgs/tools/security/jwt-cli/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, rustPlatform }:
+{ stdenv, fetchFromGitHub, rustPlatform, Security }:
 
 rustPlatform.buildRustPackage rec {
   pname = "jwt-cli";
@@ -13,6 +13,8 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "005y92acsn5j490jkp23ny7bsjd9ql1glybmbh4cyc8b15hmy618";
 
+  buildInputs = stdenv.lib.optional stdenv.isDarwin Security;
+
   meta = with stdenv.lib; {
     description = "Super fast CLI tool to decode and encode JWTs";
     homepage = "https://github.com/mike-engel/jwt-cli";
diff --git a/pkgs/tools/security/neopg/default.nix b/pkgs/tools/security/neopg/default.nix
index 5e26bcf6759d..c58772346eea 100644
--- a/pkgs/tools/security/neopg/default.nix
+++ b/pkgs/tools/security/neopg/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
   dontUseCmakeBuildDir = true;
 
   preCheck = ''
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$(pwd)/3rdparty/googletest/googletest:$(pwd)/neopg
+    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$(pwd)/3rdparty/googletest/googletest:$(pwd)/neopg
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/security/pass/default.nix b/pkgs/tools/security/pass/default.nix
index 5d0e94bc803e..54a8f4de7d7b 100644
--- a/pkgs/tools/security/pass/default.nix
+++ b/pkgs/tools/security/pass/default.nix
@@ -111,6 +111,12 @@ let
     '' + stdenv.lib.optionalString stdenv.isDarwin ''
       # 'pass edit' uses hdid, which is not available from the sandbox.
       rm -f tests/t0200-edit-tests.sh
+      rm -f tests/t0010-generate-tests.sh
+      rm -f tests/t0020-show-tests.sh
+      rm -f tests/t0050-mv-tests.sh
+      rm -f tests/t0100-insert-tests.sh
+      rm -f tests/t0300-reencryption.sh
+      rm -f tests/t0400-grep.sh
     '';
 
     doCheck = false;
diff --git a/pkgs/tools/security/pcsclite/default.nix b/pkgs/tools/security/pcsclite/default.nix
index 263c308fc3d6..2141f12151fa 100644
--- a/pkgs/tools/security/pcsclite/default.nix
+++ b/pkgs/tools/security/pcsclite/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pcsclite";
-  version = "1.8.25";
+  version = "1.8.26";
 
   outputs = [ "bin" "out" "dev" "doc" "man" ];
 
   src = fetchurl {
     url = "https://pcsclite.apdu.fr/files/pcsc-lite-${version}.tar.bz2";
-    sha256 = "14l7irs1nsh8b036ag4cfy8wryyysch78scz5dw6xxqwqgnpjvfp";
+    sha256 = "1ndvvz0fgqwz70pijymsxmx25mzryb0zav1i8jjc067ndryvxdry";
   };
 
   patches = [ ./no-dropdir-literals.patch ];
diff --git a/pkgs/tools/text/gnused/default.nix b/pkgs/tools/text/gnused/default.nix
index 3d73bfba6576..953be5e07d66 100644
--- a/pkgs/tools/text/gnused/default.nix
+++ b/pkgs/tools/text/gnused/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnused";
-  version = "4.7";
+  version = "4.8";
 
   src = fetchurl {
     url = "mirror://gnu/sed/sed-${version}.tar.xz";
-    sha256 = "0smxcx66vx29djzb542nxcynl7qnzxqa5032ibazi7x2s267d198";
+    sha256 = "0cznxw73fzv1n3nj2zsq6nf73rvsbxndp444xkpahdqvlzz0r6zp";
   };
 
   outputs = [ "out" "info" ];
diff --git a/pkgs/tools/text/mdcat/default.nix b/pkgs/tools/text/mdcat/default.nix
index 626963bc6010..6b19251acf8e 100644
--- a/pkgs/tools/text/mdcat/default.nix
+++ b/pkgs/tools/text/mdcat/default.nix
@@ -2,26 +2,28 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdcat";
-  version = "0.14.0";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "lunaryorn";
     repo = pname;
     rev = "mdcat-${version}";
-    sha256 = "1q8h6pc1i89j1zl4s234inl9v95vsdrry1fzlis89sl2mnbv8ywy";
+    sha256 = "1x9c3cj3y8wvwr74kbz6nrdh61rinr98gcp3hnjpi6c3vg3xx4wh";
   };
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ openssl ] ++ stdenv.lib.optional stdenv.isDarwin Security;
 
-  cargoSha256 = "1hxsfls6fpllc9yg5ib3qz6pa62j1y1va8a6356j6812csk4ifnn";
+  cargoSha256 = "1kc434pa72n9xll2r4ddmd9xdwv3ls36cwsmdry392j41zmics51";
 
   checkInputs = [ ansi2html ];
   checkPhase = ''
     # Skip tests that use the network and that include files.
-    cargo test -- --skip terminal::iterm2 --skip terminal::resources::tests::remote \
+    cargo test -- --skip terminal::iterm2 \
       --skip magic::tests::detect_mimetype_of_svg_image \
-      --skip magic::tests::detect_mimetype_of_png_image
+      --skip magic::tests::detect_mimetype_of_png_image \
+      --skip resources::tests::read_url_with_http_url_fails_when_status_404 \
+      --skip resources::tests::read_url_with_http_url_returns_content_when_status_200
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/text/opencc/default.nix b/pkgs/tools/text/opencc/default.nix
index a2a02049d267..01b16908fb7c 100644
--- a/pkgs/tools/text/opencc/default.nix
+++ b/pkgs/tools/text/opencc/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
 
   makeFlags = [
     # let intermediate tools find intermediate library
-    "LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$(CURDIR)/src"
+    "LD_LIBRARY_PATH=$LD_LIBRARY_PATH\${LD_LIBRARY_PATH:+:}$(CURDIR)/src"
   ];
 
   # Parallel building occasionaly fails with: Error copying file "/tmp/nix-build-opencc-1.0.5.drv-0/OpenCC-ver.1.0.5/build/src/libopencc.so.1.0.0" to "/tmp/nix-build-opencc-1.0.5.drv-0/OpenCC-ver.1.0.5/build/src/tools".
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3e065d471984..460f4a3d3acc 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1298,7 +1298,7 @@ in
 
   burpsuite = callPackage ../tools/networking/burpsuite {};
 
-  bs-platform = (callPackage ../development/compilers/bs-platform {}).bs-platform-621;
+  bs-platform = callPackage ../development/compilers/bs-platform {};
 
   c3d = callPackage ../applications/graphics/c3d {
     inherit (darwin.apple_sdk.frameworks) Cocoa;
@@ -1860,7 +1860,9 @@ in
 
   jotta-cli = callPackage ../applications/misc/jotta-cli { };
 
-  jwt-cli = callPackage ../tools/security/jwt-cli { };
+  jwt-cli = callPackage ../tools/security/jwt-cli {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   kapacitor = callPackage ../servers/monitoring/kapacitor { };
 
@@ -3236,6 +3238,8 @@ in
 
   flux = callPackage ../development/compilers/flux { };
 
+  fido2luks = callPackage ../tools/security/fido2luks {};
+
   fierce = callPackage ../tools/security/fierce { };
 
   figlet = callPackage ../tools/misc/figlet { };
@@ -8380,7 +8384,13 @@ in
   jre = jre8;
   jre_headless = jre8_headless;
 
-  inherit (callPackages ../development/compilers/graalvm { }) mx jvmci8 graalvm8;
+  inherit (callPackages ../development/compilers/graalvm {
+    gcc = if stdenv.targetPlatform.isDarwin then gcc8 else gcc;
+    inherit (darwin.apple_sdk.frameworks)
+      CoreFoundation Foundation JavaNativeFoundation
+      JavaVM JavaRuntimeSupport Cocoa;
+    inherit (darwin) libiconv libobjc libresolv;
+  }) mx jvmci8 graalvm8;
 
   graalvm8-ee = callPackage ../development/compilers/graalvm/enterprise-edition.nix { };
 
@@ -10481,6 +10491,8 @@ in
 
   rman = callPackage ../development/tools/misc/rman { };
 
+  rnix-lsp = callPackage ../development/tools/rnix-lsp { };
+
   rolespec = callPackage ../development/tools/misc/rolespec { };
 
   rr = callPackage ../development/tools/analysis/rr { };
@@ -10770,6 +10782,8 @@ in
 
   alure = callPackage ../development/libraries/alure { };
 
+  alure2 = callPackage ../development/libraries/alure2 { };
+
   agg = callPackage ../development/libraries/agg { };
 
   allegro = allegro4;
@@ -11053,9 +11067,8 @@ in
 
   cpp-ipfs-api = callPackage ../development/libraries/cpp-ipfs-api { };
 
-  cpp-netlib = callPackage ../development/libraries/cpp-netlib {
-    openssl = openssl_1_0_2;
-  };
+  cpp-netlib = callPackage ../development/libraries/cpp-netlib {};
+
   uri = callPackage ../development/libraries/uri { };
 
   cppcms = callPackage ../development/libraries/cppcms { };
@@ -13105,7 +13118,7 @@ in
   libxmi = callPackage ../development/libraries/libxmi { };
 
   libxml2 = callPackage ../development/libraries/libxml2 {
-    python = if stdenv.isDarwin then python2 else python3;
+    python = python3;
   };
 
   libxml2Python = let
@@ -13642,6 +13655,10 @@ in
     buildPythonApplication click future six;
   };
 
+  prospector = callPackage ../development/tools/prospector {
+    python = python37;
+  };
+
   protobuf = protobuf3_7;
 
   protobuf3_11 = callPackage ../development/libraries/protobuf/3.11.nix { };
@@ -15666,7 +15683,9 @@ in
     libtool = darwin.cctools;
   };
 
-  rippled = callPackage ../servers/rippled { };
+  rippled = callPackage ../servers/rippled {
+    boost = boost17x;
+  };
 
   rippled-validator-keys-tool = callPackage ../servers/rippled/validator-keys-tool.nix {
     boost = boost167.override {
@@ -16338,14 +16357,6 @@ in
       ];
   };
 
-  linux_5_3 = callPackage ../os-specific/linux/kernel/linux-5.3.nix {
-    kernelPatches = [
-      kernelPatches.bridge_stp_helper
-      kernelPatches.request_key_helper
-      kernelPatches.export_kernel_fpu_functions."5.3"
-    ];
-  };
-
   linux_5_4 = callPackage ../os-specific/linux/kernel/linux-5.4.nix {
     kernelPatches = [
       kernelPatches.bridge_stp_helper
@@ -16568,7 +16579,6 @@ in
   linuxPackages_4_9 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_4_9);
   linuxPackages_4_14 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_4_14);
   linuxPackages_4_19 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_4_19);
-  linuxPackages_5_3 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_5_3);
   linuxPackages_5_4 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_5_4);
 
   # When adding to this list:
@@ -18207,7 +18217,9 @@ in
 
   bleachbit = callPackage ../applications/misc/bleachbit { };
 
-  blender = callPackage  ../applications/misc/blender { };
+  blender = callPackage  ../applications/misc/blender {
+    inherit (darwin.apple_sdk.frameworks) Cocoa CoreGraphics ForceFeedback OpenAL OpenGL;
+  };
 
   bluefish = callPackage ../applications/editors/bluefish {
     gtk = gtk3;
@@ -18549,6 +18561,7 @@ in
   docker-machine-kvm2 = callPackage ../applications/networking/cluster/docker-machine/kvm2.nix { };
   docker-machine-xhyve = callPackage ../applications/networking/cluster/docker-machine/xhyve.nix {
     inherit (darwin.apple_sdk.frameworks) Hypervisor vmnet;
+    inherit (darwin) cctools;
   };
 
   docker-distribution = callPackage ../applications/virtualization/docker/distribution.nix { };
@@ -23016,6 +23029,8 @@ in
 
   megaglest = callPackage ../games/megaglest {};
 
+  mindustry = callPackage ../games/mindustry { };
+
   minecraft = callPackage ../games/minecraft { };
 
   minecraft-server = callPackage ../games/minecraft-server { };
@@ -23907,6 +23922,8 @@ in
 
   nasc = callPackage ../applications/science/math/nasc { };
 
+  nota = haskellPackages.callPackage ../applications/science/math/nota { };
+
   openblas = callPackage ../development/libraries/science/math/openblas { };
 
   # A version of OpenBLAS using 32-bit integers on all platforms for compatibility with
@@ -25791,5 +25808,4 @@ in
   sentencepiece = callPackage ../development/libraries/sentencepiece {};
 
   kcli = callPackage ../development/tools/kcli {};
-
 }
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 4a7743b10901..4d956c494c05 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -468,6 +468,8 @@ let
 
     lambdaTerm = callPackage ../development/ocaml-modules/lambda-term { };
 
+    lens = callPackage ../development/ocaml-modules/lens { };
+
     linenoise = callPackage ../development/ocaml-modules/linenoise { };
 
     llvm = callPackage ../development/ocaml-modules/llvm {
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 3d64c41f4c2a..369707d39c5f 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -108,7 +108,7 @@ in {
   inherit buildSetupcfg;
 
   inherit (callPackage ../development/interpreters/python/hooks { })
-    eggUnpackHook eggBuildHook eggInstallHook flitBuildHook pipBuildHook pipInstallHook pytestCheckHook pythonCatchConflictsHook pythonImportsCheckHook pythonRemoveBinBytecodeHook setuptoolsBuildHook setuptoolsCheckHook wheelUnpackHook;
+    eggUnpackHook eggBuildHook eggInstallHook flitBuildHook pipBuildHook pipInstallHook pytestCheckHook pythonCatchConflictsHook pythonImportsCheckHook pythonRemoveBinBytecodeHook setuptoolsBuildHook setuptoolsCheckHook venvShellHook wheelUnpackHook;
 
   # helpers
 
@@ -903,6 +903,8 @@ in {
 
   oauthenticator = callPackage ../development/python-modules/oauthenticator { };
 
+  onnx = callPackage ../development/python-modules/onnx { };
+
   ordered-set = callPackage ../development/python-modules/ordered-set { };
 
   ortools = (toPythonModule (pkgs.or-tools.override {
@@ -1392,6 +1394,8 @@ in {
 
   stups-fullstop = callPackage ../development/python-modules/stups-fullstop { };
 
+  stups-pierone = callPackage ../development/python-modules/stups-pierone { };
+
   stups-tokens = callPackage ../development/python-modules/stups-tokens { };
 
   stups-zign = callPackage ../development/python-modules/stups-zign { };
@@ -1669,6 +1673,8 @@ in {
 
   avro3k = callPackage ../development/python-modules/avro3k {};
 
+  avro-python3 = callPackage ../development/python-modules/avro-python3 {};
+
   aws-lambda-builders = callPackage ../development/python-modules/aws-lambda-builders { };
 
   python-slugify = callPackage ../development/python-modules/python-slugify { };
@@ -2652,6 +2658,8 @@ in {
 
   gpsoauth = callPackage ../development/python-modules/gpsoauth { };
 
+  gpxpy = callPackage ../development/python-modules/gpxpy { };
+
   grip = callPackage ../development/python-modules/grip { };
 
   gst-python = callPackage ../development/python-modules/gst-python {
@@ -4824,6 +4832,12 @@ in {
   pylint = if isPy3k then callPackage ../development/python-modules/pylint { }
            else callPackage ../development/python-modules/pylint/1.9.nix { };
 
+  pylint-celery = callPackage ../development/python-modules/pylint-celery { };
+
+  pylint-django = callPackage ../development/python-modules/pylint-django { };
+
+  pylint-flask = callPackage ../development/python-modules/pylint-flask { };
+
   pylint-plugin-utils = callPackage ../development/python-modules/pylint-plugin-utils { };
 
   pyomo = callPackage ../development/python-modules/pyomo { };
@@ -4934,6 +4948,8 @@ in {
 
   pynmea2 = callPackage ../development/python-modules/pynmea2 {};
 
+  pynrrd = callPackage ../development/python-modules/pynrrd { };
+
   pynzb = callPackage ../development/python-modules/pynzb { };
 
   process-tests = callPackage ../development/python-modules/process-tests { };
@@ -5008,6 +5024,8 @@ in {
 
   python-markdown-math = callPackage ../development/python-modules/python-markdown-math { };
 
+  python-miio = callPackage ../development/python-modules/python-miio { };
+
   python-pipedrive = callPackage ../development/python-modules/python-pipedrive { };
 
   python-ptrace = callPackage ../development/python-modules/python-ptrace { };
diff --git a/pkgs/top-level/release-small.nix b/pkgs/top-level/release-small.nix
index 1ed3601270f8..ab7e4ce00d7d 100644
--- a/pkgs/top-level/release-small.nix
+++ b/pkgs/top-level/release-small.nix
@@ -156,7 +156,6 @@ with import ./release-lib.nix { inherit supportedSystems; };
   time = linux;
   tinycc = linux;
   udev = linux;
-  unar = linux;
   unzip = all;
   usbutils = linux;
   utillinux = linux;
diff --git a/pkgs/top-level/release.nix b/pkgs/top-level/release.nix
index 7060fea588a5..e39b40be662d 100644
--- a/pkgs/top-level/release.nix
+++ b/pkgs/top-level/release.nix
@@ -105,7 +105,6 @@ let
               jobs.nix-info-tested.x86_64-linux
               # Ensure that X11/GTK are in order.
               jobs.thunderbird.x86_64-linux
-              jobs.unar.x86_64-linux
               jobs.cachix.x86_64-linux
 
               /*