Merge commit 'a1dd419c1ffacea87eba066a2bb332e03cb68f66'

29 files changed, 164 insertions, 118 deletions

diff --git a/nixpkgs/pkgs/development/libraries/babl/default.nix b/nixpkgs/pkgs/development/libraries/babl/default.nix
index 947065997ec9..eff6ff626325 100644
--- a/nixpkgs/pkgs/development/libraries/babl/default.nix
+++ b/nixpkgs/pkgs/development/libraries/babl/default.nix
@@ -1,11 +1,12 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "babl-0.1.62";
+  pname = "babl";
+  version = "0.1.66";
 
   src = fetchurl {
-    url = "https://ftp.gtk.org/pub/babl/0.1/${name}.tar.bz2";
-    sha256 = "047msfzj8v4sfl61a2xhd69r9rh2pjq4lzpk3j10ijyv9qbry9yw";
+    url = "https://ftp.gtk.org/pub/babl/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
+    sha256 = "0qx1dwbinxihwl2lmxi60qiqi402jlrdcnixx14kk6j88n9xi79n";
   };
 
   doCheck = true;
diff --git a/nixpkgs/pkgs/development/libraries/beignet/clang_llvm.patch b/nixpkgs/pkgs/development/libraries/beignet/clang_llvm.patch
index 88876f157cdb..bcdad510e10d 100644
--- a/nixpkgs/pkgs/development/libraries/beignet/clang_llvm.patch
+++ b/nixpkgs/pkgs/development/libraries/beignet/clang_llvm.patch
@@ -47,16 +47,3 @@ index a148321..96cafb8 100644
    set(CLANG_LIBRARIES ${CLANG_LIBRARIES} ${CLANG_LIB})
  	unset(CLANG_LIB CACHE)
  endmacro()
-diff --git a/./CMakeLists.txt b/../Beignet-1.1.2-Source_new/CMakeLists.txt
-index 88985d7..01bca9e 100644
---- a/./CMakeLists.txt
-+++ b/../Beignet-1.1.2-Source_new/CMakeLists.txt
-@@ -205,7 +205,7 @@ IF(OCLIcd_FOUND)
-     "intel-beignet.icd.in"
-     "${ICD_FILE_NAME}"
-   )
--  install (FILES ${CMAKE_CURRENT_BINARY_DIR}/${ICD_FILE_NAME} DESTINATION /etc/OpenCL/vendors)
-+  install (FILES ${CMAKE_CURRENT_BINARY_DIR}/${ICD_FILE_NAME} DESTINATION ${CMAKE_INSTALL_PREFIX}/etc/OpenCL/vendors)
- ELSE(OCLIcd_FOUND)
-   MESSAGE(STATUS "Looking for OCL ICD header file - not found")
- ENDIF(OCLIcd_FOUND)
diff --git a/nixpkgs/pkgs/development/libraries/beignet/default.nix b/nixpkgs/pkgs/development/libraries/beignet/default.nix
index ba6fc7cb541b..05ff5593205a 100644
--- a/nixpkgs/pkgs/development/libraries/beignet/default.nix
+++ b/nixpkgs/pkgs/development/libraries/beignet/default.nix
@@ -1,5 +1,5 @@
 { stdenv
-, fetchurl
+, fetchFromGitHub
 , cmake
 , pkgconfig
 , clang-unwrapped
@@ -19,11 +19,13 @@
 
 stdenv.mkDerivation rec {
   name = "beignet-${version}";
-  version = "1.3.2";
+  version = "unstable-2018.08.20";
 
-  src = fetchurl {
-    url = "https://01.org/sites/default/files/${name}-source.tar.gz"; 
-    sha256 = "0hqb04jhjjslnmi3fnpzphanz84zywwkyw2sjr1k5qlx2jxfsmf5";
+  src = fetchFromGitHub {
+    owner  = "intel";
+    repo   = "beignet";
+    rev    = "fc5f430cb7b7a8f694d86acbb038bd5b38ec389c";
+    sha256 = "1z64v69w7f52jrskh1jfyh1x46mzfhjrqxj9hhgzh3xxv9yla32h";
   };
 
   patches = [ ./clang_llvm.patch ];
@@ -31,6 +33,7 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   postPatch = ''
+    substituteInPlace CMakeLists.txt --replace /etc/OpenCL/vendors "\''${CMAKE_INSTALL_PREFIX}/etc/OpenCL/vendors"
     patchShebangs src/git_sha1.sh
   '';
 
@@ -101,8 +104,8 @@ stdenv.mkDerivation rec {
     homepage = https://cgit.freedesktop.org/beignet/;
     description = "OpenCL Library for Intel Ivy Bridge and newer GPUs";
     longDescription = ''
-      The package provides an open source implementation of the OpenCL specification for Intel GPUs. 
-      It supports the Intel OpenCL runtime library and compiler. 
+      The package provides an open source implementation of the OpenCL specification for Intel GPUs.
+      It supports the Intel OpenCL runtime library and compiler.
     '';
     license = licenses.lgpl21Plus;
     maintainers = with maintainers; [ artuuge zimbatm ];
diff --git a/nixpkgs/pkgs/development/libraries/dbus/default.nix b/nixpkgs/pkgs/development/libraries/dbus/default.nix
index 6d85fe1233cf..60d0cc81d2bc 100644
--- a/nixpkgs/pkgs/development/libraries/dbus/default.nix
+++ b/nixpkgs/pkgs/development/libraries/dbus/default.nix
@@ -6,8 +6,8 @@ assert x11Support -> libX11 != null
                   && libSM != null;
 
 let
-  version = "1.12.12";
-  sha256 = "1y7mxhkw2shd9mi9s62k81lz8npjkrafapr4fyfms7hs04kg4ilm";
+  version = "1.12.14";
+  sha256 = "13aca7gzgl7z1dfdipfs23773w8n6z01d4rj5kmssv4gms8c5ya4";
 
 self = stdenv.mkDerivation {
     name = "dbus-${version}";
diff --git a/nixpkgs/pkgs/development/libraries/faad2/default.nix b/nixpkgs/pkgs/development/libraries/faad2/default.nix
index 50323846e980..e7e4835d2ed3 100644
--- a/nixpkgs/pkgs/development/libraries/faad2/default.nix
+++ b/nixpkgs/pkgs/development/libraries/faad2/default.nix
@@ -12,6 +12,30 @@ stdenv.mkDerivation rec {
     sha256 = "1db37ydb6mxhshbayvirm5vz6j361bjim4nkpwjyhmy4ddfinmhl";
   };
 
+  patches = let
+    fp = { ver ? "2.8.8-3", pname, name ? (pname + ".patch"), sha256 }: fetchurl {
+      url = "https://salsa.debian.org/multimedia-team/faad2/raw/debian/${ver}"
+          + "/debian/patches/${pname}.patch?inline=false";
+      inherit name sha256;
+    };
+  in [
+    (fp {
+      # critical bug addressed in vlc 3.0.7 (but we use system-provided faad)
+      pname = "0004-Fix-a-couple-buffer-overflows";
+      sha256 = "1mwycdfagz6wpda9j3cp7lf93crgacpa8rwr58p3x0i5cirnnmwq";
+    })
+    (fp {
+      name = "CVE-2018-20362.patch";
+      pname = "0009-syntax.c-check-for-syntax-element-inconsistencies";
+      sha256 = "1z849l5qyvhyn5pvm6r07fa50nrn8nsqnrka2nnzgkhxlhvzpa81";
+    })
+    (fp {
+      name = "CVE-2018-20194.patch";
+      pname = "0010-sbr_hfadj-sanitize-frequency-band-borders";
+      sha256 = "1b1kbz4mv0zhpq8h3djnvqafh1gn12nikk9v3jrxyryywacirah4";
+    })
+  ];
+
   configureFlags = []
     ++ optional drmSupport "--with-drm";
 
diff --git a/nixpkgs/pkgs/development/libraries/flatpak/default.nix b/nixpkgs/pkgs/development/libraries/flatpak/default.nix
index aff5737432f5..4ea17e588a9b 100644
--- a/nixpkgs/pkgs/development/libraries/flatpak/default.nix
+++ b/nixpkgs/pkgs/development/libraries/flatpak/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, autoreconfHook, docbook_xml_dtd_412, docbook_xml_dtd_42, docbook_xml_dtd_43, docbook_xsl, which, libxml2
 , gobject-introspection, gtk-doc, intltool, libxslt, pkgconfig, xmlto, appstream-glib, substituteAll, glibcLocales, yacc, xdg-dbus-proxy, p11-kit
 , bubblewrap, bzip2, dbus, glib, gpgme, json-glib, libarchive, libcap, libseccomp, coreutils, gettext, python2, hicolor-icon-theme
-, libsoup, lzma, ostree, polkit, python3, systemd, xorg, valgrind, glib-networking, wrapGAppsHook, gnome3, gsettings-desktop-schemas }:
+, libsoup, lzma, ostree, polkit, python3, systemd, xorg, valgrind, glib-networking, wrapGAppsHook, gnome3, gsettings-desktop-schemas, librsvg }:
 
 stdenv.mkDerivation rec {
   pname = "flatpak";
@@ -33,6 +33,7 @@ stdenv.mkDerivation rec {
     ./respect-xml-catalog-files-var.patch
     ./use-flatpak-from-path.patch
     ./unset-env-vars.patch
+    ./validate-icon-pixbuf.patch
   ];
 
   nativeBuildInputs = [
@@ -44,6 +45,7 @@ stdenv.mkDerivation rec {
     bubblewrap bzip2 dbus gnome3.dconf glib gpgme json-glib libarchive libcap libseccomp
     libsoup lzma ostree polkit python3 systemd xorg.libXau
     gsettings-desktop-schemas glib-networking
+    librsvg # for flatpak-validate-icon
   ];
 
   checkInputs = [ valgrind ];
diff --git a/nixpkgs/pkgs/development/libraries/flatpak/validate-icon-pixbuf.patch b/nixpkgs/pkgs/development/libraries/flatpak/validate-icon-pixbuf.patch
new file mode 100644
index 000000000000..5b8cc2d0383f
--- /dev/null
+++ b/nixpkgs/pkgs/development/libraries/flatpak/validate-icon-pixbuf.patch
@@ -0,0 +1,13 @@
+diff --git a/icon-validator/validate-icon.c b/icon-validator/validate-icon.c
+index 6e23d9f2..f0659a78 100644
+--- a/icon-validator/validate-icon.c
++++ b/icon-validator/validate-icon.c
+@@ -193,6 +193,8 @@ rerun_in_sandbox (const char *arg_width,
+     add_args (args, "--setenv", "G_MESSAGES_DEBUG", g_getenv ("G_MESSAGES_DEBUG"), NULL);
+   if (g_getenv ("G_MESSAGES_PREFIXED"))
+     add_args (args, "--setenv", "G_MESSAGES_PREFIXED", g_getenv ("G_MESSAGES_PREFIXED"), NULL);
++  if (g_getenv ("GDK_PIXBUF_MODULE_FILE"))
++    add_args (args, "--setenv", "GDK_PIXBUF_MODULE_FILE", g_getenv ("GDK_PIXBUF_MODULE_FILE"), NULL);
+ 
+   add_args (args, validate_icon, arg_width, arg_height, filename, NULL);
+   g_ptr_array_add (args, NULL);
diff --git a/nixpkgs/pkgs/development/libraries/glib/default.nix b/nixpkgs/pkgs/development/libraries/glib/default.nix
index db4eee38b6e4..a2c7bdc5bde6 100644
--- a/nixpkgs/pkgs/development/libraries/glib/default.nix
+++ b/nixpkgs/pkgs/development/libraries/glib/default.nix
@@ -46,7 +46,7 @@ let
   '';
 
   binPrograms = optional (!stdenv.isDarwin) "gapplication" ++ [ "gdbus" "gio" "gsettings" ];
-  version = "2.60.2";
+  version = "2.60.3";
 in
 
 stdenv.mkDerivation rec {
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "1nc0iyday7866hq0hb78h7lxa44an998lzis8jhgvp8a0rsm9w9f";
+    sha256 = "1fb0nx9fcmic8rsh0fbp79lqpasfjxljvnshbw2hsya51mb0vaq4";
   };
 
   patches = optional stdenv.isDarwin ./darwin-compilation.patch
diff --git a/nixpkgs/pkgs/development/libraries/goffice/default.nix b/nixpkgs/pkgs/development/libraries/goffice/default.nix
index 3d3275b041f1..a14c40e6d87e 100644
--- a/nixpkgs/pkgs/development/libraries/goffice/default.nix
+++ b/nixpkgs/pkgs/development/libraries/goffice/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "goffice";
-  version = "0.10.44";
+  version = "0.10.45";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1fd7cm6j0g0mqgpqs4y22b4gd2ll4mcyvg4d0q22d5ndjapl4q3d";
+    sha256 = "702ba567e9ec0bbdd9b1a8161cd24648b4868d57a6cb89128f13c125f6f31947";
   };
 
   nativeBuildInputs = [ pkgconfig intltool ];
diff --git a/nixpkgs/pkgs/development/libraries/harfbuzz/default.nix b/nixpkgs/pkgs/development/libraries/harfbuzz/default.nix
index 7c364c0fcdf5..a405633c1b8d 100644
--- a/nixpkgs/pkgs/development/libraries/harfbuzz/default.nix
+++ b/nixpkgs/pkgs/development/libraries/harfbuzz/default.nix
@@ -8,7 +8,7 @@
 }:
 
 let
-  version = "2.3.1";
+  version = "2.5.1";
   inherit (stdenv.lib) optional optionals optionalString;
 in
 
@@ -16,8 +16,8 @@ stdenv.mkDerivation {
   name = "harfbuzz${optionalString withIcu "-icu"}-${version}";
 
   src = fetchurl {
-    url = "https://www.freedesktop.org/software/harfbuzz/release/harfbuzz-${version}.tar.bz2";
-    sha256 = "0s74ramsbfa183rxkidqgfd2vbhrwicnrqzqsq440dwibffnj1gj";
+    url = "https://www.freedesktop.org/software/harfbuzz/release/harfbuzz-${version}.tar.xz";
+    sha256 = "17kiyq23g7bnjvyn2yg4gyr7i7qjam65n20whsrplpxxk9bk8j3d";
   };
 
   postPatch = ''
diff --git a/nixpkgs/pkgs/development/libraries/hwloc/default.nix b/nixpkgs/pkgs/development/libraries/hwloc/default.nix
index 81e30d675d28..5866d6b8fedb 100644
--- a/nixpkgs/pkgs/development/libraries/hwloc/default.nix
+++ b/nixpkgs/pkgs/development/libraries/hwloc/default.nix
@@ -7,7 +7,7 @@ assert x11Support -> libX11 != null && cairo != null;
 with stdenv.lib;
 
 let
-  version = "2.0.3";
+  version = "2.0.4";
   versmm = versions.major version + "." + versions.minor version;
   name = "hwloc-${version}";
 
@@ -16,7 +16,7 @@ in stdenv.mkDerivation {
 
   src = fetchurl {
     url = "http://www.open-mpi.org/software/hwloc/v${versmm}/downloads/${name}.tar.bz2";
-    sha256 = "09f7ajak8wv5issr0hw72vs3jkldc7crcc7z5fd34sspkvrsm4z3";
+    sha256 = "1aa7s208gdijk19vvzzahyl8pglk1va3yd6kdbpfa5pz5ms0ag35";
   };
 
   configureFlags = [
diff --git a/nixpkgs/pkgs/development/libraries/libevent/default.nix b/nixpkgs/pkgs/development/libraries/libevent/default.nix
index 39d2c29b0127..2bc2bcb5b856 100644
--- a/nixpkgs/pkgs/development/libraries/libevent/default.nix
+++ b/nixpkgs/pkgs/development/libraries/libevent/default.nix
@@ -6,25 +6,13 @@ assert sslSupport -> openssl != null;
 
 stdenv.mkDerivation rec {
   name = "libevent-${version}";
-  version = "2.1.8";
+  version = "2.1.10";
 
   src = fetchurl {
     url = "https://github.com/libevent/libevent/releases/download/release-${version}-stable/libevent-${version}-stable.tar.gz";
-    sha256 = "1hhxnxlr0fsdv7bdmzsnhdz16fxf3jg2r6vyljcl3kj6pflcap4n";
+    sha256 = "1c25928gdv495clxk2v1d4gkr5py7ack4gx2n7d13frnld0syr78";
   };
 
-  #NOTE: Patches to support libressl-2.7. These are taken from libevent upstream, and can both be dropped with the next release.
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/libevent/libevent/commit/22dd14945c25600de3cf8b91000c66703b551e4f.patch";
-      sha256 = "0fzcb241cp9mm7j6baw22blcglbc083ryigzyjaij8r530av10kd";
-    })
-    (fetchpatch {
-      url = "https://github.com/libevent/libevent/commit/28b8075400c70b2d2da2ce07e590c2ec6d11783d.patch";
-      sha256 = "0dkzlk44033xksg2iq5w90r3lnziwl1mgz291nzqq906zrya0sdb";
-    })
-  ];
-
   # libevent_openssl is moved into its own output, so that openssl isn't present
   # in the default closure.
   outputs = [ "out" "dev" ]
diff --git a/nixpkgs/pkgs/development/libraries/libical/default.nix b/nixpkgs/pkgs/development/libraries/libical/default.nix
index 8ca3dd727545..916530220526 100644
--- a/nixpkgs/pkgs/development/libraries/libical/default.nix
+++ b/nixpkgs/pkgs/development/libraries/libical/default.nix
@@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
   name = "libical-${version}";
   version = "3.0.4";
 
-  outputs = [ "out" "dev" "devdoc" ];
+  outputs = [ "out" "dev" ]; #"devdoc" ];
 
   src = fetchFromGitHub {
     owner = "libical";
@@ -17,7 +17,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     perl pkgconfig cmake ninja vala gobject-introspection
     (python3.withPackages (pkgs: with pkgs; [ pygobject3 ])) # running libical-glib tests
-    gtk-doc docbook_xsl docbook_xml_dtd_43 # docs
+# Docs building fails: https://github.com/NixOS/nixpkgs/pull/61657#issuecomment-495579489
+#    gtk-doc docbook_xsl docbook_xml_dtd_43 # docs
   ];
   buildInputs = [ glib libxml2 icu ];
 
diff --git a/nixpkgs/pkgs/development/libraries/libidn2/default.nix b/nixpkgs/pkgs/development/libraries/libidn2/default.nix
index c0fadfeb6798..5ec5b8e04dd0 100644
--- a/nixpkgs/pkgs/development/libraries/libidn2/default.nix
+++ b/nixpkgs/pkgs/development/libraries/libidn2/default.nix
@@ -4,11 +4,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "libidn2-${version}";
-  version = "2.1.1a";
+  version = "2.2.0";
 
   src = fetchurl {
     url = "mirror://gnu/gnu/libidn/${name}.tar.gz";
-    sha256 = "0wlb0jrkccsdxlx90wx6ax5raqcm6y9c75dcgc6j6m6gdv7nnrjp";
+    sha256 = "1zl1cc2xgxw31pdhvhr5ij36x4vvpy16jq667rspin06nlr4fwzw";
   };
 
   outputs = [ "bin" "dev" "out" "info" "devdoc" ];
diff --git a/nixpkgs/pkgs/development/libraries/libnftnl/default.nix b/nixpkgs/pkgs/development/libraries/libnftnl/default.nix
index f94af3498421..ad51ac8d6dbb 100644
--- a/nixpkgs/pkgs/development/libraries/libnftnl/default.nix
+++ b/nixpkgs/pkgs/development/libraries/libnftnl/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, pkgconfig, libmnl }:
 
 stdenv.mkDerivation rec {
-  version = "1.1.2";
-  name = "libnftnl-${version}";
+  version = "1.1.3";
+  pname = "libnftnl";
 
   src = fetchurl {
-    url = "https://netfilter.org/projects/libnftnl/files/${name}.tar.bz2";
-    sha256 = "0pffmsv41alsn5ac7mwnb9fh3qpwzqk13jrzn6c5i71wq6kbgix5";
+    url = "https://netfilter.org/projects/${pname}/files/${pname}-${version}.tar.bz2";
+    sha256 = "03xszkcpqk3s1rqc6vh7g5j13kh3d3yjnvjhk5scds3an39rgp92";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/nixpkgs/pkgs/development/libraries/libpsl/default.nix b/nixpkgs/pkgs/development/libraries/libpsl/default.nix
index ac00920d054c..7e2443d31e92 100644
--- a/nixpkgs/pkgs/development/libraries/libpsl/default.nix
+++ b/nixpkgs/pkgs/development/libraries/libpsl/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     "--disable-static"
-    "--enable-gtk-doc"
+#    "--enable-gtk-doc"
     "--enable-man"
     "--enable-valgrind-tests"
     "--with-psl-distfile=${publicsuffix-list}/share/publicsuffix/public_suffix_list.dat"
diff --git a/nixpkgs/pkgs/development/libraries/librime/default.nix b/nixpkgs/pkgs/development/libraries/librime/default.nix
index b1e426172538..71362fd7ef7b 100644
--- a/nixpkgs/pkgs/development/libraries/librime/default.nix
+++ b/nixpkgs/pkgs/development/libraries/librime/default.nix
@@ -2,14 +2,14 @@
   libyamlcpp, gmock }:
 
 stdenv.mkDerivation rec {
-  name = "librime-${version}";
-  version = "1.4.0";
+  pname = "librime";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "rime";
     repo = "librime";
     rev = "${version}";
-    sha256 = "1zkx1wfbd94v55gfycyd2b94jxclfyk2zl7yw35pyjx63qdlb6sd";
+    sha256 = "10wvh1l4317yzcys4rzlkw42i6cj5p8g62r1xzyjw32ky2d0ndxl";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/nixpkgs/pkgs/development/libraries/libsodium/default.nix b/nixpkgs/pkgs/development/libraries/libsodium/default.nix
index 51f779bca6bf..8c88abd2c441 100644
--- a/nixpkgs/pkgs/development/libraries/libsodium/default.nix
+++ b/nixpkgs/pkgs/development/libraries/libsodium/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "libsodium-1.0.17";
+  name = "libsodium-1.0.18";
 
   src = fetchurl {
     url = "https://download.libsodium.org/libsodium/releases/${name}.tar.gz";
-    sha256 = "1cf2d9v1gylz1qcy2zappbf526qfmph6gd6fnn3w2b347vixmhqc";
+    sha256 = "1h9ncvj23qbbni958knzsli8dvybcswcjbx0qjjgi922nf848l3g";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/nixpkgs/pkgs/development/libraries/liburcu/default.nix b/nixpkgs/pkgs/development/libraries/liburcu/default.nix
index 0cc18d82720b..0cc1b0d08f9d 100644
--- a/nixpkgs/pkgs/development/libraries/liburcu/default.nix
+++ b/nixpkgs/pkgs/development/libraries/liburcu/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl }:
 
 stdenv.mkDerivation rec {
-  version = "0.10.2";
+  version = "0.11.0";
   name = "liburcu-${version}";
 
   src = fetchurl {
     url = "https://lttng.org/files/urcu/userspace-rcu-${version}.tar.bz2";
-    sha256 = "1k31faqz9plx5dwxq8g1fnczxda1is4s1x4ph0gjrq3gmy6qixmk";
+    sha256 = "1rxk5vbkbmqlsnjnvkjz0pkx2076mqnq6jzblpmz8rk29x66kx8s";
   };
 
   checkInputs = [ perl ];
diff --git a/nixpkgs/pkgs/development/libraries/liburing/default.nix b/nixpkgs/pkgs/development/libraries/liburing/default.nix
index 4564bab227bc..cce10a761d3f 100644
--- a/nixpkgs/pkgs/development/libraries/liburing/default.nix
+++ b/nixpkgs/pkgs/development/libraries/liburing/default.nix
@@ -3,12 +3,12 @@
 
 stdenv.mkDerivation rec {
   name = "liburing-${version}";
-  version = "1.0.0pre132_${builtins.substring 0 7 src.rev}";
+  version = "1.0.0pre137_${builtins.substring 0 7 src.rev}";
 
   src = fetchgit {
     url    = "http://git.kernel.dk/liburing";
-    rev    = "f8865bc65feced660a3075175200a60968187bba";
-    sha256 = "13l6s5iyrhqa0yj272qax0261cfw3nz09hq5hpf0f0kb2952d4rc";
+    rev    = "91dde5c956b1af491bc6c16ee230daa4b4b66706";
+    sha256 = "0rk1ikrn3s6sp3gx7kc4y6msx7yncr3845m67vhk8lxvhd90sgza";
   };
 
   separateDebugInfo = true;
diff --git a/nixpkgs/pkgs/development/libraries/libuv/default.nix b/nixpkgs/pkgs/development/libraries/libuv/default.nix
index 78abbe7392c9..e725439a3f1a 100644
--- a/nixpkgs/pkgs/development/libraries/libuv/default.nix
+++ b/nixpkgs/pkgs/development/libraries/libuv/default.nix
@@ -1,14 +1,14 @@
 { stdenv, lib, fetchpatch, fetchFromGitHub, autoconf, automake, libtool, pkgconfig, ApplicationServices, CoreServices }:
 
 stdenv.mkDerivation rec {
-  version = "1.28.0";
+  version = "1.29.1";
   pname = "libuv";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "0l0gx69sdy3sv3pirjbca2ws54n9d83mj0j96h77k0ncywimvi64";
+    sha256 = "0scnircr6khgh7l3bw9zyfzdgx2c11mpfhd9d8qlw47arrvqg7l8";
   };
 
   postPatch = let
diff --git a/nixpkgs/pkgs/development/libraries/mesa/default.nix b/nixpkgs/pkgs/development/libraries/mesa/default.nix
index 0724da8375e3..b34ca5253a29 100644
--- a/nixpkgs/pkgs/development/libraries/mesa/default.nix
+++ b/nixpkgs/pkgs/development/libraries/mesa/default.nix
@@ -19,7 +19,7 @@
 , libelfSupport ? stdenv.isLinux, libelf
 , llvmSupport ? true, llvmPackages
 , libglvndSupport ? true, libglvnd
-, valgrindSupport ? stdenv.isLinux, valgrind-light
+, withValgrind ? stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isAarch32, valgrind-light
 }:
 
 with lib;
@@ -41,10 +41,6 @@ assert enableRadv -> libdrmSupport && llvmSupport && libelfSupport;
   - libOSMesa is in $osmesa (~4 MB)
 */
 
-if ! elem stdenv.hostPlatform.system platforms.mesaPlatforms then
-  throw "${stdenv.system}: unsupported platform for Mesa"
-else
-
 let
   # platforms that have PCIe slots and thus can use most non-integrated GPUs
   pciePlatform = !stdenv.hostPlatform.isAarch32 && !stdenv.hostPlatform.isAarch64;
@@ -206,7 +202,7 @@ let
         ++ optional vdpauSupport libvdpau
         ++ optional vaSupport libva-minimal
         ++ optional omxBellagioSupport libomxil-bellagio
-        ++ optional valgrindSupport valgrind-light
+        ++ optional withValgrind valgrind-light
 
         ++ optionals (elem "x11" eglPlatforms)
           ((with xorg; [ xorgproto libX11 ]))
@@ -372,7 +368,7 @@ let
         description = "An open source implementation of OpenGL";
         homepage = https://www.mesa3d.org/;
         license = licenses.mit; # X11 variant, in most files
-        platforms = platforms.linux ++ platforms.darwin;
+        platforms = platforms.mesaPlatforms;
         maintainers = with maintainers; [ vcunat ];
       };
     };
diff --git a/nixpkgs/pkgs/development/libraries/mpich/default.nix b/nixpkgs/pkgs/development/libraries/mpich/default.nix
index ffe6b5edf961..1c6b8df15114 100644
--- a/nixpkgs/pkgs/development/libraries/mpich/default.nix
+++ b/nixpkgs/pkgs/development/libraries/mpich/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation  rec {
   name = "mpich-${version}";
-  version = "3.3";
+  version = "3.3.1";
 
   src = fetchurl {
     url = "https://www.mpich.org/static/downloads/${version}/mpich-${version}.tar.gz";
-    sha256 = "02zs118q9n4xz9qnfc24i2r84vnzgnwnyyqanfv03lf3wqpy17ij";
+    sha256 = "1raism1r4jsx4cybc9ddyr1xkccbxm0l8j3ryrw8kslfkkr1wmgy";
   };
 
   configureFlags = [
diff --git a/nixpkgs/pkgs/development/libraries/newt/default.nix b/nixpkgs/pkgs/development/libraries/newt/default.nix
index 1a5656b7ca16..60dc00a335d9 100644
--- a/nixpkgs/pkgs/development/libraries/newt/default.nix
+++ b/nixpkgs/pkgs/development/libraries/newt/default.nix
@@ -1,11 +1,12 @@
 { fetchurl, stdenv, slang, popt }:
 
 stdenv.mkDerivation rec {
-  name = "newt-0.52.20";
+  pname = "newt";
+  version = "0.52.21";
 
   src = fetchurl {
-    url = "https://fedorahosted.org/releases/n/e/newt/${name}.tar.gz";
-    sha256 = "1g3dpfnvaw7vljbr7nzq1rl88d6r8cmrvvng9inphgzwxxmvlrld";
+    url = "https://fedorahosted.org/releases/n/e/${pname}/${pname}-${version}.tar.gz";
+    sha256 = "0cdvbancr7y4nrj8257y5n45hmhizr8isynagy4fpsnpammv8pi6";
   };
 
   patchPhase = ''
diff --git a/nixpkgs/pkgs/development/libraries/nss/default.nix b/nixpkgs/pkgs/development/libraries/nss/default.nix
index 87bc1a16f236..f3fc4caf3154 100644
--- a/nixpkgs/pkgs/development/libraries/nss/default.nix
+++ b/nixpkgs/pkgs/development/libraries/nss/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, nspr, perl, zlib, sqlite, fixDarwinDylibNames }:
+{ stdenv, fetchurl, nspr, perl, zlib, sqlite, fixDarwinDylibNames, buildPackages }:
 
 let
   nssPEM = fetchurl {
@@ -17,7 +17,11 @@ in stdenv.mkDerivation rec {
     sha256 = "1zvabgxlyvz3fnv4w89y4a5qkscjmm88naf929dgvvgfnrchwqm5";
   };
 
-  buildInputs = [ perl zlib sqlite ]
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+
+  nativeBuildInputs = [ perl ];
+
+  buildInputs = [ zlib sqlite ]
     ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
 
   propagatedBuildInputs = [ nspr ];
@@ -43,7 +47,9 @@ in stdenv.mkDerivation rec {
 
   preConfigure = "cd nss";
 
-  makeFlags = [
+  makeFlags = let
+    cpu = stdenv.hostPlatform.parsed.cpu.name;
+  in [
     "NSPR_INCLUDE_DIR=${nspr.dev}/include"
     "NSPR_LIB_DIR=${nspr.out}/lib"
     "NSDISTMODE=copy"
@@ -52,6 +58,12 @@ in stdenv.mkDerivation rec {
     "NSS_ENABLE_ECC=1"
     "USE_SYSTEM_ZLIB=1"
     "NSS_USE_SYSTEM_SQLITE=1"
+    "NATIVE_CC=${buildPackages.stdenv.cc}/bin/cc"
+  ] ++ stdenv.lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "OS_TEST=${cpu}"
+    "CPU_ARCH=${cpu}"
+    "CROSS_COMPILE=1"
+    "NSS_DISABLE_GTESTS=1" # don't want to build tests when cross-compiling
   ] ++ stdenv.lib.optional stdenv.is64bit "USE_64=1"
     ++ stdenv.lib.optional stdenv.isDarwin "CCC=clang++";
 
@@ -95,7 +107,10 @@ in stdenv.mkDerivation rec {
     chmod 0755 $out/bin/nss-config
   '';
 
-  postFixup = ''
+  postFixup = let
+    isCross = stdenv.hostPlatform != stdenv.buildPlatform;
+    nss = if isCross then buildPackages.nss.tools else "$out";
+  in ''
     for libname in freebl3 nssdbm3 softokn3
     do '' +
     (if stdenv.isDarwin
@@ -106,7 +121,7 @@ in stdenv.mkDerivation rec {
        libfile="$out/lib/lib$libname.so"
        LD_LIBRARY_PATH=$out/lib:${nspr.out}/lib \
      '') + ''
-        $out/bin/shlibsign -v -i "$libfile"
+        ${nss}/bin/shlibsign -v -i "$libfile"
     done
 
     moveToOutput bin "$tools"
diff --git a/nixpkgs/pkgs/development/libraries/opencascade/default.nix b/nixpkgs/pkgs/development/libraries/opencascade/default.nix
index 05d78488957a..8334bf195f7b 100644
--- a/nixpkgs/pkgs/development/libraries/opencascade/default.nix
+++ b/nixpkgs/pkgs/development/libraries/opencascade/default.nix
@@ -1,33 +1,49 @@
-{stdenv, fetchurl, libGLU_combined, tcl, tk, file, libXmu, cmake, libtool, qt4,
-ftgl, freetype}:
+{ stdenv, fetchFromGitHub, fetchpatch, libGL, libGLU, libXmu, cmake, ninja,
+  pkgconfig, fontconfig, freetype, expat, freeimage, vtk }:
 
 stdenv.mkDerivation rec {
-  name = "opencascade-oce-0.18.3";
-  src = fetchurl {
-    url = https://github.com/tpaviot/oce/archive/OCE-0.18.3.tar.gz;
-    sha256 = "0v4ny0qhr5hiialb2ss25bllfnd6j4g7mfxnqfmr1xsjpykxcly5";
+  pname = "opencascade-oce";
+  version = "0.18.3";
+
+  src = fetchFromGitHub {
+    owner = "tpaviot";
+    repo = "oce";
+    rev = "OCE-${version}";
+    sha256 = "17wy8dcf44vqisishv1jjf3cmcxyygqq29y9c3wjdj983qi2hsig";
   };
 
-  buildInputs = [ libGLU_combined tcl tk file libXmu libtool qt4 ftgl freetype cmake ];
+  nativeBuildInputs = [ cmake ninja pkgconfig ];
+  buildInputs = [ libGL libGLU libXmu freetype fontconfig expat freeimage vtk ];
 
-  # Fix for glibc 2.26
-  postPatch = ''
-    sed -i -e 's/^\( *#include <\)x\(locale.h>\)//' \
-      src/Standard/Standard_CLocaleSentry.hxx
-  '';
+  cmakeFlags = [
+    "-DOCE_INSTALL_PREFIX=${placeholder "out"}"
+    "-DOCE_WITH_FREEIMAGE=ON"
+    "-DOCE_WITH_VTK=ON"
+  ];
 
-  preConfigure = ''
-    cmakeFlags="$cmakeFlags -DOCE_INSTALL_PREFIX=$out"
-  '';
+  patches = [
+    # Use fontconfig instead of hardcoded directory list
+    # https://github.com/tpaviot/oce/pull/714
+    (fetchpatch {
+      url = "https://github.com/tpaviot/oce/commit/9643432b27fec8974ca0ee15c3c372f5fe8fc069.patch";
+      sha256 = "1wd940rszmh5apcpk5fv6126h8mcjcy4rjifrql5d4ac90v06v4c";
+    })
+    # Fix for glibc 2.26
+    (fetchpatch {
+      url = "https://github.com/tpaviot/oce/commit/3b44656e93270d782009b06ec4be84d2a13f8126.patch";
+      sha256 = "1ccakkcwy5g0184m23x0mnh22i0lk45xm8kgiv5z3pl7nh35dh8k";
+    })
+  ];
 
-  # https://bugs.freedesktop.org/show_bug.cgi?id=83631
-  NIX_CFLAGS_COMPILE = "-DGLX_GLXEXT_LEGACY";
-
-  enableParallelBuilding = true;
+  postPatch = ''
+    # make sure the installed cmake file uses absolute paths for fontconfig
+    substituteInPlace adm/cmake/TKService/CMakeLists.txt \
+      --replace FONTCONFIG_LIBRARIES FONTCONFIG_LINK_LIBRARIES
+  '';
 
   meta = with stdenv.lib; {
     description = "Open CASCADE Technology, libraries for 3D modeling and numerical simulation";
-    homepage = http://www.opencascade.org/;
+    homepage = "https://github.com/tpaviot/oce";
     maintainers = [ maintainers.viric ];
     platforms = platforms.linux;
     license = licenses.lgpl21;
diff --git a/nixpkgs/pkgs/development/libraries/openssl/default.nix b/nixpkgs/pkgs/development/libraries/openssl/default.nix
index 1c0d124b5c02..ef617a92eaa7 100644
--- a/nixpkgs/pkgs/development/libraries/openssl/default.nix
+++ b/nixpkgs/pkgs/development/libraries/openssl/default.nix
@@ -120,8 +120,8 @@ let
 in {
 
   openssl_1_0_2 = common {
-    version = "1.0.2r";
-    sha256 = "1mnh27zf6r1bhm5d9fxqq9slv2gz0d9z2ij9i679b0wapa5x0ldf";
+    version = "1.0.2s";
+    sha256 = "15mbmg8hf7s12vr3v2bdc0pi9y4pdbnsxhzk4fyyap42jaa5rgfa";
     patches = [
       ./1.0.2/nix-ssl-cert-file.patch
 
@@ -132,15 +132,10 @@ in {
   };
 
   openssl_1_1 = common {
-    version = "1.1.1b";
-    sha256 = "0jza8cmznnyiia43056dij1jdmz62dx17wsn0zxksh9h6817nmaw";
+    version = "1.1.1c";
+    sha256 = "142c7zdlz06hjrrvinb9f276czc78bnkyhd9xma621qmmmwk1yzn";
     patches = [
       ./1.1/nix-ssl-cert-file.patch
-      (fetchurl {
-        name = "long-chacha-nonce.patch";
-        url = "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff_plain;h=f426625b6ae9a7831010750490a5f0ad689c5ba3";
-        sha256= "02ghqg3vzmzx3s1dwwwbm1p1l4asaiampyg4k9vfrjwficvgpdgp";
-      })
 
       (if stdenv.hostPlatform.isDarwin
        then ./1.1/use-etc-ssl-certs-darwin.patch
diff --git a/nixpkgs/pkgs/development/libraries/physics/rivet/default.nix b/nixpkgs/pkgs/development/libraries/physics/rivet/default.nix
index 54bf1cc442b9..40ccd8cfd20b 100644
--- a/nixpkgs/pkgs/development/libraries/physics/rivet/default.nix
+++ b/nixpkgs/pkgs/development/libraries/physics/rivet/default.nix
@@ -17,12 +17,16 @@ stdenv.mkDerivation rec {
     scheme-basic
     collection-pstricks
     collection-fontsrecommended
+    l3kernel
+    l3packages
     mathastext
     pgf
     relsize
     sfmath
+    siunitx
     xcolor
     xkeyval
+    xstring
     ;};
   buildInputs = [ hepmc imagemagick python2 latex makeWrapper ];
   propagatedBuildInputs = [ fastjet ghostscript gsl yoda ];
diff --git a/nixpkgs/pkgs/development/libraries/pyotherside/default.nix b/nixpkgs/pkgs/development/libraries/pyotherside/default.nix
index aff7b409ad07..c7d43ae70268 100644
--- a/nixpkgs/pkgs/development/libraries/pyotherside/default.nix
+++ b/nixpkgs/pkgs/development/libraries/pyotherside/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pyotherside";
-  version = "1.5.5";
+  version = "1.5.6";
 
   src = fetchFromGitHub {
     owner = "thp";
     repo = "pyotherside";
     rev = version;
-    sha256 = "1mczagl7mrgw9rqxlasgybrkfigdw1g7k542q75am8gp82m6wka9";
+    sha256 = "1cjx0fbrq9qvbirwy76pw1f5skm2afd51k4qb269ql4gpl67d5lv";
   };
 
   nativeBuildInputs = [ qmake ];