Merge commit 'bc9df0f66110039e495b6debe3a6cda4a1bb0fed'

26 files changed, 310 insertions, 110 deletions

diff --git a/nixpkgs/pkgs/applications/misc/audio/sox/default.nix b/nixpkgs/pkgs/applications/misc/audio/sox/default.nix
index a598ec1caca1..622e7169faec 100644
--- a/nixpkgs/pkgs/applications/misc/audio/sox/default.nix
+++ b/nixpkgs/pkgs/applications/misc/audio/sox/default.nix
@@ -1,9 +1,10 @@
-{ config, lib, stdenv, fetchurl, CoreAudio
+{ config, lib, stdenv, fetchurl, pkgconfig, CoreAudio
 , enableAlsa ? true, alsaLib ? null
 , enableLibao ? true, libao ? null
 , enableLame ? config.sox.enableLame or false, lame ? null
 , enableLibmad ? true, libmad ? null
 , enableLibogg ? true, libogg ? null, libvorbis ? null
+, enableOpusfile ? true, opusfile ? null
 , enableFLAC ? true, flac ? null
 , enablePNG ? true, libpng ? null
 , enableLibsndfile ? true, libsndfile ? null
@@ -22,12 +23,16 @@ stdenv.mkDerivation rec {
     sha256 = "0v2znlxkxxcd3f48hf3dx9pq7i6fdhb62kgj7wv8xggz8f35jpxl";
   };
 
+  # configure.ac uses pkg-config only to locate libopusfile
+  nativeBuildInputs = optional enableOpusfile pkgconfig;
+
   buildInputs =
     optional (enableAlsa && stdenv.isLinux) alsaLib ++
     optional enableLibao libao ++
     optional enableLame lame ++
     optional enableLibmad libmad ++
     optionals enableLibogg [ libogg libvorbis ] ++
+    optional enableOpusfile opusfile ++
     optional enableFLAC flac ++
     optional enablePNG libpng ++
     optional enableLibsndfile libsndfile ++
diff --git a/nixpkgs/pkgs/applications/misc/bemenu/default.nix b/nixpkgs/pkgs/applications/misc/bemenu/default.nix
new file mode 100644
index 000000000000..89c32668be9c
--- /dev/null
+++ b/nixpkgs/pkgs/applications/misc/bemenu/default.nix
@@ -0,0 +1,45 @@
+{ stdenv, fetchFromGitHub, cairo, cmake, libxkbcommon
+, pango, fribidi, harfbuzz, pcre, pkgconfig
+, ncursesSupport ? true, ncurses ? null
+, waylandSupport ? true, wayland ? null
+, x11Support ? true, xlibs ? null, xorg ? null
+}:
+
+assert ncursesSupport -> ncurses != null;
+assert waylandSupport -> wayland != null;
+assert x11Support -> xlibs != null && xorg != null;
+
+stdenv.mkDerivation rec {
+  pname = "bemenu";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "Cloudef";
+    repo = "bemenu";
+    rev = "33e540a2b04ce78f5c7ab4a60b899c67f586cc32";
+    sha256 = "11h55m9dx6ai12pqij52ydjm36dvrcc856pa834njihrp626pl4w";
+  };
+
+  nativeBuildInputs = [ cmake pkgconfig pcre ];
+
+  buildInputs = with stdenv.lib; [
+    cairo
+    fribidi
+    harfbuzz
+    libxkbcommon
+    pango
+  ] ++ optionals ncursesSupport [ ncurses ]
+    ++ optionals waylandSupport [ wayland ]
+    ++ optionals x11Support [
+      xlibs.libX11 xlibs.libXinerama xlibs.libXft
+      xorg.libXdmcp xorg.libpthreadstubs xorg.libxcb
+    ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/Cloudef/bemenu";
+    description = "Dynamic menu library and client program inspired by dmenu";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ thiagokokada ];
+    platforms = with platforms; linux;
+  };
+}
diff --git a/nixpkgs/pkgs/applications/misc/calcurse/default.nix b/nixpkgs/pkgs/applications/misc/calcurse/default.nix
index e6dafe4d08af..dc0460c2a233 100644
--- a/nixpkgs/pkgs/applications/misc/calcurse/default.nix
+++ b/nixpkgs/pkgs/applications/misc/calcurse/default.nix
@@ -9,17 +9,13 @@ stdenv.mkDerivation rec {
     sha256 = "0vw2xi6a2lrhrb8n55zq9lv4mzxhby4xdf3hmi1vlfpyrpdwkjzd";
   };
 
-  buildInputs = [ ncurses gettext python3 ];
+  buildInputs = [ ncurses gettext python3 python3Packages.wrapPython ];
   nativeBuildInputs = [ makeWrapper ];
 
-  # Build Python environment with httplib2 for calcurse-caldav
-  pythonEnv = python3Packages.python.buildEnv.override {
-    extraLibs = [ python3Packages.httplib2 ];
-  };
-  propagatedBuildInputs = [ pythonEnv ];
-
   postInstall = ''
-    substituteInPlace $out/bin/calcurse-caldav --replace /usr/bin/python3 ${pythonEnv}/bin/python3
+    patchShebangs .
+    buildPythonPath ${python3Packages.httplib2}
+    patchPythonScript $out/bin/calcurse-caldav
   '';
 
   meta = with stdenv.lib; {
diff --git a/nixpkgs/pkgs/applications/misc/electrum/default.nix b/nixpkgs/pkgs/applications/misc/electrum/default.nix
index 5f252d97d867..9cabd6dda7c6 100644
--- a/nixpkgs/pkgs/applications/misc/electrum/default.nix
+++ b/nixpkgs/pkgs/applications/misc/electrum/default.nix
@@ -1,28 +1,36 @@
-{ stdenv, fetchFromGitHub, python3, python3Packages, zbar, secp256k1 }:
+{ stdenv, fetchurl, fetchFromGitHub, python3, python3Packages, zbar, secp256k1 }:
 
 let
-  qdarkstyle = python3Packages.buildPythonPackage rec {
-    pname = "QDarkStyle";
-    version = "2.5.4";
-    src = python3Packages.fetchPypi {
-      inherit pname version;
-      sha256 = "1w715m1i5pycfqcpkrggpn0rs9cakx6cm5v8rggcxnf4p0i0kdiy";
-    };
-    doCheck = false; # no tests
+  version = "3.3.5";
+
+  # Not provided in official source releases, which are what upstream signs.
+  tests = fetchFromGitHub {
+    owner = "spesmilo";
+    repo = "electrum";
+    rev = version;
+    sha256 = "11rzzrv5xxqazcb7q1ig93d6cisqmd1x0jrgvfgzysbzvi51gg11";
+
+    extraPostFetch = ''
+      mv $out ./all
+      mv ./all/electrum/tests $out
+    '';
   };
 in
 
 python3Packages.buildPythonApplication rec {
   pname = "electrum";
-  version = "3.3.4";
+  inherit version;
 
-  src = fetchFromGitHub {
-    owner = "spesmilo";
-    repo = "electrum";
-    rev = version;
-    sha256 = "0yxdpc602jnd14xz3px85ka0b6db98zwbgfi9a3vj8p1k3mmiwaj";
+  src = fetchurl {
+    url = "https://download.electrum.org/${version}/Electrum-${version}.tar.gz";
+    sha256 = "1csj0n96zlajnrs39wsazfj5lmy7v7n77cdz56lr8nkmchh6k9z1";
   };
 
+  postUnpack = ''
+    # can't symlink, tests get confused
+    cp -ar ${tests} $sourceRoot/electrum/tests
+  '';
+
   propagatedBuildInputs = with python3Packages; [
     aiorpcx
     aiohttp
@@ -64,7 +72,10 @@ python3Packages.buildPythonApplication rec {
     rm -rf $out/${python3.sitePackages}/nix
 
     substituteInPlace $out/share/applications/electrum.desktop \
-      --replace "Exec=electrum %u" "Exec=$out/bin/electrum %u"
+      --replace 'Exec=sh -c "PATH=\"\\$HOME/.local/bin:\\$PATH\"; electrum %u"' \
+                "Exec=$out/bin/electrum %u" \
+      --replace 'Exec=sh -c "PATH=\"\\$HOME/.local/bin:\\$PATH\"; electrum --testnet %u"' \
+                "Exec=$out/bin/electrum --testnet %u"
   '';
 
   checkInputs = with python3Packages; [ pytest ];
diff --git a/nixpkgs/pkgs/applications/misc/gallery-dl/default.nix b/nixpkgs/pkgs/applications/misc/gallery-dl/default.nix
new file mode 100644
index 000000000000..4b2bcde04a47
--- /dev/null
+++ b/nixpkgs/pkgs/applications/misc/gallery-dl/default.nix
@@ -0,0 +1,21 @@
+{ lib, python3Packages }:
+
+python3Packages.buildPythonApplication rec {
+  pname = "gallery_dl";
+  version = "1.8.3";
+
+  src = python3Packages.fetchPypi {
+    inherit pname version;
+    sha256 = "671ee6ff7baa3d63393d9856686313b4e0146f875dd937326942dd2fff605a72";
+  };
+
+  doCheck = false;
+  propagatedBuildInputs = with python3Packages; [ requests ];
+
+  meta = {
+    description = "Command-line program to download image-galleries and -collections from several image hosting sites";
+    homepage = https://github.com/mikf/gallery-dl;
+    license = lib.licenses.gpl2;
+    maintainers = with lib.maintainers; [ dawidsowa ];
+  };
+}
diff --git a/nixpkgs/pkgs/applications/misc/gpsbabel/clang-4.patch b/nixpkgs/pkgs/applications/misc/gpsbabel/clang-4.patch
deleted file mode 100644
index 6bd19ae60440..000000000000
--- a/nixpkgs/pkgs/applications/misc/gpsbabel/clang-4.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-diff --git a/bushnell.cc b/bushnell.cc
-index 8fa844d..40707c4 100644
---- a/bushnell.cc
-+++ b/bushnell.cc
-@@ -135,7 +135,7 @@ bushnell_get_icon_from_name(QString name)
-     name = "Waypoint";
-   }
-
--  for (t = bushnell_icons; t->icon > 0; t++) {
-+  for (t = bushnell_icons; t->icon != 0; t++) {
-     if (0 == name.compare(t->icon, Qt::CaseInsensitive)) {
-       return t->symbol;
-     }
-@@ -147,7 +147,7 @@ static const char*
- bushnell_get_name_from_symbol(signed int s)
- {
-   icon_mapping_t* t;
--  for (t = bushnell_icons; t->icon > 0; t++) {
-+  for (t = bushnell_icons; t->icon != 0; t++) {
-     if (s == t->symbol) {
-       return t->icon;
-     }
diff --git a/nixpkgs/pkgs/applications/misc/gpsbabel/default.nix b/nixpkgs/pkgs/applications/misc/gpsbabel/default.nix
index 0911fbace449..aa0ed5f64632 100644
--- a/nixpkgs/pkgs/applications/misc/gpsbabel/default.nix
+++ b/nixpkgs/pkgs/applications/misc/gpsbabel/default.nix
@@ -2,17 +2,16 @@
 
 stdenv.mkDerivation rec {
   name = "gpsbabel-${version}";
-  version = "1.5.4";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "gpsbabel";
     repo = "gpsbabel";
     rev = "gpsbabel_${lib.replaceStrings ["."] ["_"] version}";
-    sha256 = "0v6wpp14zkfbarmksf9dn3wmpj1araxd7xi5xp7gpl7kafb9aiwi";
+    sha256 = "0q17jhmaf7z5lld2ff7h6jb3v1yz8hbwd2rmaq2dsamc53dls8iw";
   };
 
   patches = [
-    ./clang-4.patch
     (fetchpatch {
       url = https://sources.debian.net/data/main/g/gpsbabel/1.5.3-2/debian/patches/use_minizip;
       sha256 = "03fpsmlx1wc48d1j405zkzp8j64hcp0z72islf4mk1immql3ibcr";
diff --git a/nixpkgs/pkgs/applications/misc/hello/default.nix b/nixpkgs/pkgs/applications/misc/hello/default.nix
index c0a39d2d91d3..63a8af99f7cf 100644
--- a/nixpkgs/pkgs/applications/misc/hello/default.nix
+++ b/nixpkgs/pkgs/applications/misc/hello/default.nix
@@ -18,6 +18,7 @@ stdenv.mkDerivation rec {
       It is fully customizable.
     '';
     homepage = https://www.gnu.org/software/hello/manual/;
+    changelog = "https://git.savannah.gnu.org/cgit/hello.git/plain/NEWS?h=v${version}";
     license = licenses.gpl3Plus;
     maintainers = [ maintainers.eelco ];
     platforms = platforms.all;
diff --git a/nixpkgs/pkgs/applications/misc/hubstaff/default.nix b/nixpkgs/pkgs/applications/misc/hubstaff/default.nix
index 2b6e58a6ab36..46f50e2fd996 100644
--- a/nixpkgs/pkgs/applications/misc/hubstaff/default.nix
+++ b/nixpkgs/pkgs/applications/misc/hubstaff/default.nix
@@ -5,7 +5,9 @@
 
 let
 
-  version = "1.3.1-ff75f26";
+  data = builtins.fromJSON (builtins.readFile ./revision.json);
+
+  inherit (data) version url sha256;
 
   rpath = stdenv.lib.makeLibraryPath
     [ libX11 zlib libSM libICE libXext freetype libXrender fontconfig libXft
@@ -17,10 +19,7 @@ in
 stdenv.mkDerivation {
   name = "hubstaff-${version}";
 
-  src = fetchurl {
-    url = "https://hubstaff-production.s3.amazonaws.com/downloads/HubstaffClient/Builds/Release/${version}/Hubstaff-${version}.sh";
-    sha256 = "0jm5l34r6lkfkg8vsdfqbr0axngxznhagwcl9y184lnyji91fmdl";
-  };
+  src = fetchurl { inherit sha256 url; };
 
   nativeBuildInputs = [ unzip makeWrapper ];
 
diff --git a/nixpkgs/pkgs/applications/misc/hubstaff/revision.json b/nixpkgs/pkgs/applications/misc/hubstaff/revision.json
new file mode 100644
index 000000000000..85126a496c65
--- /dev/null
+++ b/nixpkgs/pkgs/applications/misc/hubstaff/revision.json
@@ -0,0 +1,5 @@
+{
+  "url": "https://hubstaff-production.s3.amazonaws.com/downloads/HubstaffClient/Builds/Release/1.4.5-c5b459ea/Hubstaff-1.4.5-c5b459ea.sh",
+  "version": "1.4.5-c5b459ea",
+  "sha256": "180qglbj175wln0kh8d5czhjvy7z503zxn4w6522hkz4ddz201nz"
+}
diff --git a/nixpkgs/pkgs/applications/misc/hubstaff/update.sh b/nixpkgs/pkgs/applications/misc/hubstaff/update.sh
new file mode 100755
index 000000000000..c4c1caf55db4
--- /dev/null
+++ b/nixpkgs/pkgs/applications/misc/hubstaff/update.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix-prefetch-git curl
+
+SCRIPT_DIR=$(dirname "$(readlink -f "$BASH_SOURCE")")
+
+installation_script_url=$(curl --fail --head --location --silent --output /dev/null --write-out %{url_effective} https://app.hubstaff.com/download/linux)
+
+version=$(echo "$installation_script_url" | sed -r 's/^https:\/\/hubstaff\-production\.s3\.amazonaws\.com\/downloads\/HubstaffClient\/Builds\/Release\/([^\/]+)\/Hubstaff.+$/\1/')
+
+sha256=$(nix-prefetch-url "$installation_script_url")
+
+cat <<EOT > $SCRIPT_DIR/revision.json
+{
+  "url": "$installation_script_url",
+  "version": "$version",
+  "sha256": "$sha256"
+}
+EOT
diff --git a/nixpkgs/pkgs/applications/misc/josm/default.nix b/nixpkgs/pkgs/applications/misc/josm/default.nix
index 22a1a4ba2adb..bfc4ac796154 100644
--- a/nixpkgs/pkgs/applications/misc/josm/default.nix
+++ b/nixpkgs/pkgs/applications/misc/josm/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "josm-${version}";
-  version = "14945";
+  version = "15031";
 
   src = fetchurl {
     url = "https://josm.openstreetmap.de/download/josm-snapshot-${version}.jar";
-    sha256 = "0kdfdn0i7gjfkkllb93598ywf0qlllzsia5q14szc5b5assl8qpb";
+    sha256 = "19qw1s5v0dha329a7rfnhby0rq5d109b3f1ln2w1dfkmirbl75ir";
   };
 
   buildInputs = [ jdk11 makeWrapper ];
diff --git a/nixpkgs/pkgs/applications/misc/k2pdfopt/default.nix b/nixpkgs/pkgs/applications/misc/k2pdfopt/default.nix
index 0049e9aca755..bf29e05db1b8 100644
--- a/nixpkgs/pkgs/applications/misc/k2pdfopt/default.nix
+++ b/nixpkgs/pkgs/applications/misc/k2pdfopt/default.nix
@@ -57,7 +57,28 @@ stdenv.mkDerivation rec {
       prePatch = ''
         cp ${src}/leptonica_mod/{allheaders.h,dewarp2.c,leptwin.c} src/
       '';
-      patches = [];
+      patches = [
+        # stripped down copy of upstream commit b88c821f8d347bce0aea86d606c710303919f3d2
+        ./leptonica-CVE-2018-3836.patch
+        (fetchpatch {
+          # CVE-2018-7186
+          url = "https://github.com/DanBloomberg/leptonica/commit/"
+              + "ee301cb2029db8a6289c5295daa42bba7715e99a.patch";
+          sha256 = "0cgb7mvz2px1rg5i80wk1wxxjvzjga617d8q6j7qygkp7jm6495d";
+        })
+        (fetchpatch {
+          # CVE-2018-7247
+          url = "https://github.com/DanBloomberg/leptonica/commit/"
+              + "c1079bb8e77cdd426759e466729917ca37a3ed9f.patch";
+          sha256 = "1z4iac5gwqggh7aa8cvyp6nl9fwd1v7wif26caxc9y5qr3jj34qf";
+        })
+        (fetchpatch {
+          # CVE-2018-7440
+          url = "https://github.com/DanBloomberg/leptonica/commit/"
+              + "49ecb6c2dfd6ed5078c62f4a8eeff03e3beced3b.patch";
+          sha256 = "1hjmva98iaw9xj7prg7aimykyayikcwnk4hk0380007hqb35lqmy";
+        })
+      ];
     });
     tesseract_modded = tesseract4.override {
       tesseractBase = tesseract4.tesseractBase.overrideAttrs (_: {
diff --git a/nixpkgs/pkgs/applications/misc/k2pdfopt/leptonica-CVE-2018-3836.patch b/nixpkgs/pkgs/applications/misc/k2pdfopt/leptonica-CVE-2018-3836.patch
new file mode 100644
index 000000000000..f1b4170fbaae
--- /dev/null
+++ b/nixpkgs/pkgs/applications/misc/k2pdfopt/leptonica-CVE-2018-3836.patch
@@ -0,0 +1,95 @@
+--- a/src/allheaders.h
++++ b/src/allheaders.h
+@@ -2600,6 +2600,7 @@
+ LEPT_DLL extern char * stringReverse ( const char *src );
+ LEPT_DLL extern char * strtokSafe ( char *cstr, const char *seps, char **psaveptr );
+ LEPT_DLL extern l_int32 stringSplitOnToken ( char *cstr, const char *seps, char **phead, char **ptail );
++LEPT_DLL extern l_int32 stringCheckForChars ( const char *src, const char *chars, l_int32 *pfound );
+ LEPT_DLL extern char * stringRemoveChars ( const char *src, const char *remchars );
+ LEPT_DLL extern l_int32 stringFindSubstr ( const char *src, const char *sub, l_int32 *ploc );
+ LEPT_DLL extern char * stringReplaceSubstr ( const char *src, const char *sub1, const char *sub2, l_int32 *pfound, l_int32 *ploc );
+--- a/src/gplot.c
++++ b/src/gplot.c
+@@ -141,9 +141,10 @@
+             const char  *xlabel,
+             const char  *ylabel)
+ {
+-char   *newroot;
+-char    buf[L_BUF_SIZE];
+-GPLOT  *gplot;
++char    *newroot;
++char     buf[L_BUF_SIZE];
++l_int32  badchar;
++GPLOT   *gplot;
+ 
+     PROCNAME("gplotCreate");
+ 
+@@ -152,6 +153,9 @@
+     if (outformat != GPLOT_PNG && outformat != GPLOT_PS &&
+         outformat != GPLOT_EPS && outformat != GPLOT_LATEX)
+         return (GPLOT *)ERROR_PTR("outformat invalid", procName, NULL);
++    stringCheckForChars(rootname, "`;&|><\"?*", &badchar);
++    if (badchar)  /* danger of command injection */
++        return (GPLOT *)ERROR_PTR("invalid rootname", procName, NULL);
+ 
+     if ((gplot = (GPLOT *)LEPT_CALLOC(1, sizeof(GPLOT))) == NULL)
+         return (GPLOT *)ERROR_PTR("gplot not made", procName, NULL);
+--- a/src/utils2.c
++++ b/src/utils2.c
+@@ -42,6 +42,7 @@
+  *           l_int32    stringSplitOnToken()
+  *
+  *       Find and replace string and array procs
++ *           l_int32    stringCheckForChars()
+  *           char      *stringRemoveChars()
+  *           l_int32    stringFindSubstr()
+  *           char      *stringReplaceSubstr()
+@@ -701,6 +702,48 @@
+ /*--------------------------------------------------------------------*
+  *                       Find and replace procs                       *
+  *--------------------------------------------------------------------*/
++/*!
++ * \brief   stringCheckForChars()
++ *
++ * \param[in]    src      input string; can be of zero length
++ * \param[in]    chars    string of chars to be searched for in %src
++ * \param[out]   pfound   1 if any characters are found; 0 otherwise
++ * \return  0 if OK, 1 on error
++ *
++ * <pre>
++ * Notes:
++ *      (1) This can be used to sanitize an operation by checking for
++ *          special characters that don't belong in a string.
++ * </pre>
++ */
++l_int32
++stringCheckForChars(const char  *src,
++                    const char  *chars,
++                    l_int32     *pfound)
++{
++char     ch;
++l_int32  i, n;
++
++    PROCNAME("stringCheckForChars");
++
++    if (!pfound)
++        return ERROR_INT("&found not defined", procName, 1);
++    *pfound = FALSE;
++    if (!src || !chars)
++        return ERROR_INT("src and chars not both defined", procName, 1);
++
++    n = strlen(src);
++    for (i = 0; i < n; i++) {
++        ch = src[i];
++        if (strchr(chars, ch)) {
++            *pfound = TRUE;
++            break;
++        }
++    }
++    return 0;
++}
++
++
+ /*!
+  * \brief   stringRemoveChars()
+  *
diff --git a/nixpkgs/pkgs/applications/misc/kitty/default.nix b/nixpkgs/pkgs/applications/misc/kitty/default.nix
index 3edb48cc489b..be70efba5ad7 100644
--- a/nixpkgs/pkgs/applications/misc/kitty/default.nix
+++ b/nixpkgs/pkgs/applications/misc/kitty/default.nix
@@ -2,7 +2,7 @@
   harfbuzz, fontconfig, pkgconfig, ncurses, imagemagick, xsel,
   libstartup_notification, libX11, libXrandr, libXinerama, libXcursor,
   libxkbcommon, libXi, libXext, wayland-protocols, wayland,
-  which, dbus,
+  which, dbus, fetchpatch,
   Cocoa,
   CoreGraphics,
   Foundation,
@@ -67,6 +67,17 @@ buildPythonApplication rec {
       libstartup_notification = "${libstartup_notification}/lib/libstartup-notification-1.so";
     })
   ] ++ stdenv.lib.optionals stdenv.isDarwin [
+    (fetchpatch {
+      name = "macos-symlink-1";
+      url = https://github.com/kovidgoyal/kitty/commit/bdeec612667f6976109247fe1750b10dda9c24c0.patch;
+      sha256 = "1d18x260w059qag80kgb2cgi2h4rricvqhwpbrw79s8yxzs7jhxk";
+    })
+    (fetchpatch {
+      # fixup of previous patch
+      name = "macos-symlink-2";
+      url = https://github.com/kovidgoyal/kitty/commit/af2c9a49b1ad31e94242295d88598591623fbf11.patch;
+      sha256 = "0k3dmgbvmh66j8k3h8dw6la6ma6f20fng6jjypy982kxvracsnl5";
+    })
     ./macos-10.11.patch
     ./no-lto.patch
     ./no-werror.patch
@@ -84,7 +95,7 @@ buildPythonApplication rec {
     mkdir -p $out
     ${if stdenv.isDarwin then ''
     mkdir "$out/bin"
-    ln -s ../Applications/kitty.app/Contents/MacOS/kitty "$out/bin/kitty"
+    ln -s ../Applications/kitty.app/Contents/MacOS/kitty-deref-symlink "$out/bin/kitty"
     mkdir "$out/Applications"
     cp -r kitty.app "$out/Applications/kitty.app"
     '' else ''
diff --git a/nixpkgs/pkgs/applications/misc/moonlight-embedded/default.nix b/nixpkgs/pkgs/applications/misc/moonlight-embedded/default.nix
index 76c2ba69d35b..5f314d19dda3 100644
--- a/nixpkgs/pkgs/applications/misc/moonlight-embedded/default.nix
+++ b/nixpkgs/pkgs/applications/misc/moonlight-embedded/default.nix
@@ -1,18 +1,18 @@
 { stdenv, fetchFromGitHub, cmake, perl
 , alsaLib, libevdev, libopus, udev, SDL2
 , ffmpeg, pkgconfig, xorg, libvdpau, libpulseaudio, libcec
-, curl, expat, avahi, enet, libuuid
+, curl, expat, avahi, enet, libuuid, libva
 }:
 
 stdenv.mkDerivation rec {
   name = "moonlight-embedded-${version}";
-  version = "2.4.7";
+  version = "2.4.9";
 
   src = fetchFromGitHub {
     owner = "irtimmer";
     repo = "moonlight-embedded";
     rev = "v${version}";
-    sha256 = "0ihgb0kh4rhbgn55s25rfbs8063zqvcyqn137jn3nsc0is1595a9";
+    sha256 = "1mzs0dr6bg57kjyxjh48hfmlsil7fvgqf9lhjzxxj3llvpxwws86";
     fetchSubmodules = true;
   };
 
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     alsaLib libevdev libopus udev SDL2
     ffmpeg pkgconfig xorg.libxcb libvdpau libpulseaudio libcec
-    xorg.libpthreadstubs curl expat avahi enet libuuid
+    xorg.libpthreadstubs curl expat avahi enet libuuid libva
   ];
 
   meta = with stdenv.lib; {
diff --git a/nixpkgs/pkgs/applications/misc/octoprint/default.nix b/nixpkgs/pkgs/applications/misc/octoprint/default.nix
index 76a0a5748081..b8ed4c5ddbee 100644
--- a/nixpkgs/pkgs/applications/misc/octoprint/default.nix
+++ b/nixpkgs/pkgs/applications/misc/octoprint/default.nix
@@ -15,13 +15,26 @@ let
     packageOverrides = lib.foldr lib.composeExtensions (self: super: { }) ([
       (mkOverride "flask"       "0.10.1" "0wrkavjdjndknhp8ya8j850jq7a1cli4g5a93mg8nh1xz2gq50sc")
       (mkOverride "flask_login" "0.2.11" "1rg3rsjs1gwi2pw6vr9jmhaqm9b3vc9c4hfcsvp4y8agbh7g3mc3")
-      (mkOverride "jinja2"      "2.8.1"  "14aqmhkc9rw5w0v311jhixdm6ym8vsm29dhyxyrjfqxljwx1yd1m")
       (mkOverride "pylru"       "1.0.9"  "0b0pq0l7xv83dfsajsc49jcxzc99kb9jfx1a1dlx22hzcy962dvi")
       (mkOverride "sarge"       "0.1.4"  "08s8896973bz1gg0pkr592w6g4p6v47bkfvws5i91p9xf8b35yar")
       (mkOverride "tornado"     "4.5.3"  "02jzd23l4r6fswmwxaica9ldlyc2p6q8dk6dyff7j58fmdzf853d")
 
       # https://github.com/NixOS/nixpkgs/pull/58179#issuecomment-478605134
       (mkOverride "werkzeug"    "0.14.1" "c3fd7a7d41976d9f44db327260e263132466836cef6f91512889ed60ad26557c")
+
+      # Octoprint holds back jinja2 to 2.8.1 due to breaking changes.
+      # This old version does not have updated test config for pytest 4,
+      # and pypi tarball doesn't contain tests dir anyways.
+      (pself: psuper: {
+        jinja2 = psuper.jinja2.overridePythonAttrs (oldAttrs: rec {
+          version = "2.8.1";
+          src = oldAttrs.src.override {
+            inherit version;
+            sha256 = "14aqmhkc9rw5w0v311jhixdm6ym8vsm29dhyxyrjfqxljwx1yd1m";
+          };
+          doCheck = false;
+        });
+      })
     ]);
   };
 
@@ -69,7 +82,7 @@ in py.pkgs.buildPythonApplication rec {
     pylru pyyaml sarge feedparser netifaces click websocket_client
     scandir chainmap future dateutil futures wrapt monotonic emoji
     frozendict
-  ];
+  ] ++ lib.optionals stdenv.isDarwin [ py.pkgs.appdirs ];
 
   checkInputs = with py.pkgs; [ nose mock ddt ];
 
@@ -82,7 +95,7 @@ in py.pkgs.buildPythonApplication rec {
   '';
 
   checkPhase = ''
-    HOME=$(mktemp -d) nosetests
+    HOME=$(mktemp -d) nosetests ${lib.optionalString stdenv.isDarwin "--exclude=test_set_external_modification"}
   '';
 
   meta = with stdenv.lib; {
diff --git a/nixpkgs/pkgs/applications/misc/playonlinux/default.nix b/nixpkgs/pkgs/applications/misc/playonlinux/default.nix
index da09c123dcde..e5c096fd2ae5 100644
--- a/nixpkgs/pkgs/applications/misc/playonlinux/default.nix
+++ b/nixpkgs/pkgs/applications/misc/playonlinux/default.nix
@@ -4,7 +4,7 @@
 , cabextract
 , gettext
 , glxinfo
-, gnupg1compat
+, gnupg
 , icoutils
 , imagemagick
 , netcat-gnu
@@ -32,7 +32,7 @@ let
       python2Packages.python
       gettext
       glxinfo
-      gnupg1compat
+      gnupg
       icoutils
       imagemagick
       netcat-gnu
diff --git a/nixpkgs/pkgs/applications/misc/pstree/default.nix b/nixpkgs/pkgs/applications/misc/pstree/default.nix
deleted file mode 100644
index 3cd52af6d321..000000000000
--- a/nixpkgs/pkgs/applications/misc/pstree/default.nix
+++ /dev/null
@@ -1,25 +0,0 @@
-{ stdenv, fetchurl }:
-
-stdenv.mkDerivation rec {
-  name = "pstree-2.39";
-
-  src = fetchurl {
-    urls = [
-      "http://www.sfr-fresh.com/unix/misc/${name}.tar.gz"
-      "https://distfiles.macports.org/pstree/${name}.tar.gz"
-    ];
-    sha256 = "17s7v15c4gryjpi11y1xq75022nkg4ggzvjlq2dkmyg67ssc76vw";
-  };
-
-  unpackPhase = "unpackFile \$src; sourceRoot=.";
-
-  buildPhase = "pwd; $CC -o pstree pstree.c";
-  installPhase = "mkdir -p \$out/bin; cp pstree \$out/bin";
-
-  meta = {
-    description = "Show the set of running processes as a tree";
-    license = "GPL";
-    maintainers = [ ];
-    platforms = stdenv.lib.platforms.unix;
-  };
-}
diff --git a/nixpkgs/pkgs/applications/misc/taskell/default.nix b/nixpkgs/pkgs/applications/misc/taskell/default.nix
index 6cb78e6d6bd7..743d89de4add 100644
--- a/nixpkgs/pkgs/applications/misc/taskell/default.nix
+++ b/nixpkgs/pkgs/applications/misc/taskell/default.nix
@@ -1,8 +1,8 @@
 { haskell, lib, haskellPackages, fetchFromGitHub }:
 
 let
-  version = "1.3.2";
-  sha256  = "0cyysvkl8m1ldlprmw9mpvch3r244nl25yv74dwcykga3g5mw4aa";
+  version = "1.4.3";
+  sha256  = "0i12x7qzfmmdvi09k96x53zzzrva2w3zbl2f6dkxb8kk5scqqa4v";
 
 in (haskellPackages.mkDerivation {
   pname = "taskell";
@@ -35,10 +35,12 @@ in (haskellPackages.mkDerivation {
     # containers
     # directory
     file-embed
+    fold-debounce
     http-conduit
     http-client
     http-types
     lens
+    raw-strings-qq
     # mtl
     # template-haskell
     # text
@@ -55,5 +57,9 @@ in (haskellPackages.mkDerivation {
     tasty-hunit
   ];
 
-  license = lib.licenses.bsd3;
+  description = "Command-line Kanban board/task manager with support for Trello boards and GitHub projects";
+  homepage    = "https://taskell.app";
+  license     = lib.licenses.bsd3;
+  maintainers = with lib.maintainers; [ matthiasbeyer ];
+  platforms   = with lib.platforms; unix ++ darwin;
 })
diff --git a/nixpkgs/pkgs/applications/misc/tilix/default.nix b/nixpkgs/pkgs/applications/misc/tilix/default.nix
index ed9ae5ade9ff..342eca0a6fdc 100644
--- a/nixpkgs/pkgs/applications/misc/tilix/default.nix
+++ b/nixpkgs/pkgs/applications/misc/tilix/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tilix";
-  version = "1.9.0";
+  version = "1.9.3";
 
   src = fetchFromGitHub {
     owner = "gnunn1";
     repo = "tilix";
     rev = version;
-    sha256 = "1k8hqpq6bzmn06b4s8c257n37ghgp3fl7l9g6fy0giwk1x0ix735";
+    sha256 = "0mg9y4xd2pnv0smibg7dyy733jarvx6qpdqap3sj7fpyni0jvpph";
   };
 
   nativeBuildInputs = [
diff --git a/nixpkgs/pkgs/applications/misc/tthsum/default.nix b/nixpkgs/pkgs/applications/misc/tthsum/default.nix
index 66bfcbcf4d9a..dbac56abaa1d 100644
--- a/nixpkgs/pkgs/applications/misc/tthsum/default.nix
+++ b/nixpkgs/pkgs/applications/misc/tthsum/default.nix
@@ -15,6 +15,8 @@ stdenv.mkDerivation rec {
     cp obj-unix/tthsum $out/bin
   '';
 
+  doCheck = !stdenv.isDarwin;
+
   meta = with stdenv.lib; {
     description = "An md5sum-alike program that works with Tiger/THEX hashes";
     longDescription = ''
diff --git a/nixpkgs/pkgs/applications/misc/tzupdate/default.nix b/nixpkgs/pkgs/applications/misc/tzupdate/default.nix
index a5d2f206f3a5..c887876634f5 100644
--- a/nixpkgs/pkgs/applications/misc/tzupdate/default.nix
+++ b/nixpkgs/pkgs/applications/misc/tzupdate/default.nix
@@ -5,11 +5,11 @@ let
 in
 buildPythonApplication rec {
   pname = "tzupdate";
-  version = "1.3.1";
+  version = "1.4.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "085kp4v9ijhkfvr0r5rzn4z7nrkb2qig05j0bajb0gkgynwf8wnz";
+    sha256 = "1sc3z2bx2nhnxg82x0jy19pr8lw56chbr90c2lr11w495csqwhz7";
   };
 
   propagatedBuildInputs = [ requests ];
diff --git a/nixpkgs/pkgs/applications/misc/zathura/core/default.nix b/nixpkgs/pkgs/applications/misc/zathura/core/default.nix
index f3258c0c7116..6378cf1c0681 100644
--- a/nixpkgs/pkgs/applications/misc/zathura/core/default.nix
+++ b/nixpkgs/pkgs/applications/misc/zathura/core/default.nix
@@ -32,15 +32,15 @@ stdenv.mkDerivation rec {
   ] ++ optional synctexSupport "-Dsynctex=enabled";
 
   nativeBuildInputs = [
-    meson ninja pkgconfig appstream-glib desktop-file-utils python3.pkgs.sphinx
+    meson ninja pkgconfig desktop-file-utils python3.pkgs.sphinx
     gettext makeWrapper libxml2
-  ];
+  ] ++ optional stdenv.isLinux appstream-glib;
 
   buildInputs = [
-    gtk girara libintl libseccomp
-    sqlite glib file librsvg
+    gtk girara libintl sqlite glib file librsvg
   ] ++ optional synctexSupport texlive.bin.core
-    ++ optional stdenv.isDarwin [ gtk-mac-integration ];
+    ++ optional stdenv.isLinux libseccomp
+    ++ optional stdenv.isDarwin gtk-mac-integration;
 
   meta = {
     homepage = https://pwmt.org/projects/zathura/;
diff --git a/nixpkgs/pkgs/applications/misc/zathura/default.nix b/nixpkgs/pkgs/applications/misc/zathura/default.nix
index dfddfe7d91e1..e3db15ca78d4 100644
--- a/nixpkgs/pkgs/applications/misc/zathura/default.nix
+++ b/nixpkgs/pkgs/applications/misc/zathura/default.nix
@@ -1,5 +1,6 @@
 { config, pkgs
-, useMupdf ? config.zathura.useMupdf or true
+# zathura_pdf_mupdf fails to load _opj_create_decompress at runtime on Darwin (https://github.com/NixOS/nixpkgs/pull/61295#issue-277982980)
+, useMupdf ? config.zathura.useMupdf or (!pkgs.stdenv.isDarwin)
 , synctexSupport ? true }:
 
 let
diff --git a/nixpkgs/pkgs/applications/misc/zathura/pdf-mupdf/default.nix b/nixpkgs/pkgs/applications/misc/zathura/pdf-mupdf/default.nix
index 709c1edb0b83..e2c08a00da20 100644
--- a/nixpkgs/pkgs/applications/misc/zathura/pdf-mupdf/default.nix
+++ b/nixpkgs/pkgs/applications/misc/zathura/pdf-mupdf/default.nix
@@ -21,9 +21,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     zathura_core girara mupdf cairo
-  ] ++ stdenv.lib.optional stdenv.isDarwin [
-    gtk-mac-integration
-  ];
+  ] ++ lib.optional stdenv.isDarwin gtk-mac-integration;
 
   PKG_CONFIG_ZATHURA_PLUGINDIR= "lib/zathura";