Merge commit '891f607d5301d6730cb1f9dcf3618bcb1ab7f10e'

48 files changed, 234 insertions, 173 deletions

diff --git a/nixpkgs/pkgs/development/tools/analysis/autoflake/default.nix b/nixpkgs/pkgs/development/tools/analysis/autoflake/default.nix
index 396a5817c672..884b511b8af1 100644
--- a/nixpkgs/pkgs/development/tools/analysis/autoflake/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/autoflake/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, python3Packages }:
+{ lib, stdenv, python3Packages }:
 
 with python3Packages;
 buildPythonApplication rec {
@@ -14,7 +14,7 @@ buildPythonApplication rec {
 
   doCheck = true;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://github.com/myint/autoflake";
     description = "A simple program which removes unused imports and unused variables as reported by pyflakes";
     license = licenses.mit;
diff --git a/nixpkgs/pkgs/development/tools/analysis/bingrep/default.nix b/nixpkgs/pkgs/development/tools/analysis/bingrep/default.nix
index 236669dc54f7..ae54723dda3b 100644
--- a/nixpkgs/pkgs/development/tools/analysis/bingrep/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/bingrep/default.nix
@@ -1,19 +1,19 @@
-{ stdenv, rustPlatform, fetchFromGitHub }:
+{ lib, stdenv, rustPlatform, fetchFromGitHub }:
 
 rustPlatform.buildRustPackage rec {
   pname = "bingrep";
-  version = "0.8.2";
+  version = "0.8.5";
 
   src = fetchFromGitHub {
     owner = "m4b";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1qv41g7mblnq07145m03s2fhbrjfsc0924zb9z4cp159ygkggxcy";
+    sha256 = "sha256-ayA3aEidZPa5GJgbbm5K3X2Xgd5Eb6TgUU80Gw/p07w=";
   };
 
-  cargoSha256 = "1z53408mcmy698xb2sxj1s1p9xc9srlkj0v8wswhdp7nq27vwkdj";
+  cargoSha256 = "sha256-3eGYU5O7HSpawIL/8OVmROCzXfdnoMAnIujjrIp00xg=";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Greps through binaries from various OSs and architectures, and colors them";
     homepage = "https://github.com/m4b/bingrep";
     license = licenses.mit;
diff --git a/nixpkgs/pkgs/development/tools/analysis/cargo-tarpaulin/default.nix b/nixpkgs/pkgs/development/tools/analysis/cargo-tarpaulin/default.nix
index b4cfa356b277..a0f251bfe910 100644
--- a/nixpkgs/pkgs/development/tools/analysis/cargo-tarpaulin/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/cargo-tarpaulin/default.nix
@@ -1,4 +1,4 @@
-{ lib, pkgconfig, rustPlatform, fetchFromGitHub, openssl }:
+{ lib, pkg-config, rustPlatform, fetchFromGitHub, openssl }:
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-tarpaulin";
@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage rec {
   };
 
   nativeBuildInputs = [
-    pkgconfig
+    pkg-config
   ];
   buildInputs = [ openssl ];
 
diff --git a/nixpkgs/pkgs/development/tools/analysis/cccc/default.nix b/nixpkgs/pkgs/development/tools/analysis/cccc/default.nix
index 374331f3ac87..bcbda8ad7e60 100644
--- a/nixpkgs/pkgs/development/tools/analysis/cccc/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/cccc/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl }:
+{ lib, stdenv, fetchurl }:
 
 let
   name = "cccc";
@@ -30,8 +30,8 @@ stdenv.mkDerivation {
       complexity and metrics proposed by Chidamber&Kemerer and Henry&Kafura.
     '';
     homepage = "http://cccc.sourceforge.net/";
-    license = stdenv.lib.licenses.gpl2;
-    platforms = stdenv.lib.platforms.unix;
-    maintainers = [ stdenv.lib.maintainers.linquize ];
+    license = lib.licenses.gpl2;
+    platforms = lib.platforms.unix;
+    maintainers = [ lib.maintainers.linquize ];
   };
 }
diff --git a/nixpkgs/pkgs/development/tools/analysis/checkov/default.nix b/nixpkgs/pkgs/development/tools/analysis/checkov/default.nix
new file mode 100644
index 000000000000..6277b1d4239e
--- /dev/null
+++ b/nixpkgs/pkgs/development/tools/analysis/checkov/default.nix
@@ -0,0 +1,77 @@
+{ stdenv, pkgs, lib, python3, fetchFromGitHub }:
+
+let
+  pname = "checkov";
+  version = "1.0.674";
+  src = fetchFromGitHub {
+    owner = "bridgecrewio";
+    repo = pname;
+    rev = version;
+    sha256 = "/S8ic5ZVxA2vd/rjRPX5gslbmnULL7BSx34vgWIsheQ=";
+  };
+
+  disabled = pkgs.python3Packages.pythonOlder "3.7";
+
+  # CheckOV only work with `dpath 1.5.0`
+  dpath = pkgs.python3Packages.buildPythonPackage rec {
+    pname = "dpath";
+    version = "1.5.0";
+
+    src = pkgs.python3Packages.fetchPypi {
+      inherit pname version;
+      sha256 = "SWYVtOqEI20Y4NKGEi3nSGmmDg+H4sfsZ4f/KGxINhs=";
+    };
+
+    doCheck = false;
+  };
+in
+python3.pkgs.buildPythonPackage rec {
+  inherit pname version disabled src;
+
+  nativeBuildInputs = with python3.pkgs; [ setuptools_scm ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    pytest
+    coverage
+    bandit
+    bc-python-hcl2
+    deep_merge
+    tabulate
+    colorama
+    termcolor
+    junit-xml
+    dpath
+    pyyaml
+    boto3
+    GitPython
+    six
+    jmespath
+    tqdm
+    update_checker
+    semantic-version
+    packaging
+  ];
+
+  # Both of these tests are pulling from external srouces (https://github.com/bridgecrewio/checkov/blob/f03a4204d291cf47e3753a02a9b8c8d805bbd1be/.github/workflows/build.yml)
+  preCheck = ''
+    rm -rf integration_tests/*
+    rm -rf tests/terraform/*
+  '';
+
+  # Wrap the executable so that the python packages are available
+  # it's just a shebang script which calls `python -m checkov "$@"`
+  postFixup = ''
+    wrapProgram $out/bin/checkov \
+      --set PYTHONPATH $PYTHONPATH
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/bridgecrewio/checkov";
+    description = "Static code analysis tool for infrastructure-as-code";
+    longDescription = ''
+    Prevent cloud misconfigurations during build-time for Terraform, Cloudformation, Kubernetes, Serverless framework and other infrastructure-as-code-languages with Checkov by Bridgecrew.
+    '';
+    license = licenses.asl20;
+    maintainers = with maintainers; [ anhdle14 ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/tools/analysis/checkstyle/default.nix b/nixpkgs/pkgs/development/tools/analysis/checkstyle/default.nix
index 786ed360ef33..e5325f7da8c7 100644
--- a/nixpkgs/pkgs/development/tools/analysis/checkstyle/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/checkstyle/default.nix
@@ -1,12 +1,12 @@
-{ stdenv, fetchurl, makeWrapper, jre }:
+{ lib, stdenv, fetchurl, makeWrapper, jre }:
 
 stdenv.mkDerivation rec {
-  version = "8.38";
+  version = "8.39";
   pname = "checkstyle";
 
   src = fetchurl {
     url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-${version}/checkstyle-${version}-all.jar";
-    sha256 = "1j4k75iv32fsp40ajdfm99zady5c0h0f39xvmv70frp8p58kq3rl";
+    sha256 = "sha256-CPPSJVKf01TA89Qk/uyvIU+ejo5JyT4Mc35KKJPv4IE=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Checks Java source against a coding standard";
     longDescription = ''
       checkstyle is a development tool to help programmers write Java code that
diff --git a/nixpkgs/pkgs/development/tools/analysis/clang-analyzer/default.nix b/nixpkgs/pkgs/development/tools/analysis/clang-analyzer/default.nix
index 43b32052bf3c..4752b31649d3 100644
--- a/nixpkgs/pkgs/development/tools/analysis/clang-analyzer/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/clang-analyzer/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, clang, llvmPackages, perl, makeWrapper, python3 }:
+{ lib, stdenv, fetchurl, clang, llvmPackages, perl, makeWrapper, python3 }:
 
 stdenv.mkDerivation rec {
   pname = "clang-analyzer";
@@ -27,8 +27,8 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Clang Static Analyzer";
     homepage    = "http://clang-analyzer.llvm.org";
-    license     = stdenv.lib.licenses.bsd3;
-    platforms   = stdenv.lib.platforms.unix;
-    maintainers = [ stdenv.lib.maintainers.thoughtpolice ];
+    license     = lib.licenses.bsd3;
+    platforms   = lib.platforms.unix;
+    maintainers = [ lib.maintainers.thoughtpolice ];
   };
 }
diff --git a/nixpkgs/pkgs/development/tools/analysis/coan/default.nix b/nixpkgs/pkgs/development/tools/analysis/coan/default.nix
index 4c6e9f1a078c..1e0b79e0daa5 100644
--- a/nixpkgs/pkgs/development/tools/analysis/coan/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/coan/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, perl }:
+{ lib, stdenv, fetchurl, perl }:
 
 stdenv.mkDerivation rec {
   version = "6.0.1";
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     mv -v $out/share/man/man1/coan.1.{1,gz}
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "The C preprocessor chainsaw";
     longDescription = ''
       A software engineering tool for analysing preprocessor-based
diff --git a/nixpkgs/pkgs/development/tools/analysis/codeql/default.nix b/nixpkgs/pkgs/development/tools/analysis/codeql/default.nix
index fc37324bc925..f3ad1d81e57d 100644
--- a/nixpkgs/pkgs/development/tools/analysis/codeql/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/codeql/default.nix
@@ -1,4 +1,4 @@
-{ stdenv
+{ lib, stdenv
 , fetchzip
 , zlib
 , xorg
@@ -12,7 +12,7 @@
 
 stdenv.mkDerivation rec {
   pname = "codeql";
-  version = "2.4.0";
+  version = "2.4.1";
 
   dontConfigure = true;
   dontBuild = true;
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   src = fetchzip {
     url = "https://github.com/github/codeql-cli-binaries/releases/download/v${version}/codeql.zip";
-    sha256 = "1mplya2dyqqmm6gj4if2k4h2fra15rxf2yfnhphqhz40kz75sxk8";
+    sha256 = "sha256-UHH+nV62jHvEY6T5UKz5cm9zse9pWHPAjjsGHfpPoPY=";
   };
 
   nativeBuildInputs = [
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
     ln -s $out/codeql/codeql $out/bin/
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Semantic code analysis engine";
     homepage = "https://semmle.com/codeql";
     maintainers = [ maintainers.dump_stack ];
diff --git a/nixpkgs/pkgs/development/tools/analysis/cov-build/default.nix b/nixpkgs/pkgs/development/tools/analysis/cov-build/default.nix
index bd8c5c37c864..93a4ffab388d 100644
--- a/nixpkgs/pkgs/development/tools/analysis/cov-build/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/cov-build/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, requireFile }:
+{ lib, stdenv, requireFile }:
 
 let
   message = ''
@@ -41,8 +41,8 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Coverity Scan build tools";
     homepage    = "https://scan.coverity.com";
-    license     = stdenv.lib.licenses.unfreeRedistributable;
-    platforms   = stdenv.lib.platforms.linux;
-    maintainers = [ stdenv.lib.maintainers.thoughtpolice ];
+    license     = lib.licenses.unfreeRedistributable;
+    platforms   = lib.platforms.linux;
+    maintainers = [ lib.maintainers.thoughtpolice ];
   };
 }
diff --git a/nixpkgs/pkgs/development/tools/analysis/coz/default.nix b/nixpkgs/pkgs/development/tools/analysis/coz/default.nix
index 42b47a9a8fd8..17968a466bf4 100644
--- a/nixpkgs/pkgs/development/tools/analysis/coz/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/coz/default.nix
@@ -1,4 +1,4 @@
-{ stdenv
+{ lib, stdenv
 , fetchFromGitHub
 , libelfin
 , ncurses
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
   meta = {
     homepage = "https://github.com/plasma-umass/coz";
     description = "Profiler based on casual profiling";
-    license = stdenv.lib.licenses.bsd2;
-    maintainers = with stdenv.lib.maintainers; [ zimbatm ];
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ zimbatm ];
   };
 }
diff --git a/nixpkgs/pkgs/development/tools/analysis/cppcheck/default.nix b/nixpkgs/pkgs/development/tools/analysis/cppcheck/default.nix
index 91bcecbb43d1..30c0614446e6 100644
--- a/nixpkgs/pkgs/development/tools/analysis/cppcheck/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/cppcheck/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, libxslt, docbook_xsl, docbook_xml_dtd_45, pcre, withZ3 ? true, z3 }:
+{ lib, stdenv, fetchurl, libxslt, docbook_xsl, docbook_xml_dtd_45, pcre, withZ3 ? true, z3 }:
 
 stdenv.mkDerivation rec {
   pname = "cppcheck";
@@ -9,11 +9,11 @@ stdenv.mkDerivation rec {
     sha256 = "0mlw0z20qf0g9qrmdmbykzf87wlcgmah8bacmp4mk6dwfzr9g9n3";
   };
 
-  buildInputs = [ pcre ] ++ stdenv.lib.optionals withZ3 [ z3 ];
+  buildInputs = [ pcre ] ++ lib.optionals withZ3 [ z3 ];
   nativeBuildInputs = [ libxslt docbook_xsl docbook_xml_dtd_45 ];
 
   makeFlags = [ "PREFIX=$(out)" "FILESDIR=$(out)/cfg" "HAVE_RULES=yes" ]
-   ++ stdenv.lib.optionals withZ3 [ "USE_Z3=yes" "CPPFLAGS=-DNEW_Z3=1" ];
+   ++ lib.optionals withZ3 [ "USE_Z3=yes" "CPPFLAGS=-DNEW_Z3=1" ];
 
   outputs = [ "out" "man" ];
 
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     cp cppcheck.1 $man/share/man/man1/cppcheck.1
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A static analysis tool for C/C++ code";
     longDescription = ''
       Check C/C++ code for memory leaks, mismatching allocation-deallocation,
diff --git a/nixpkgs/pkgs/development/tools/analysis/egypt/default.nix b/nixpkgs/pkgs/development/tools/analysis/egypt/default.nix
index 080b19bf163b..cfb974c86ddd 100644
--- a/nixpkgs/pkgs/development/tools/analysis/egypt/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/egypt/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, perlPackages }:
+{ lib, stdenv, fetchurl, perlPackages }:
 
 perlPackages.buildPerlPackage rec {
   pname = "egypt";
@@ -15,7 +15,7 @@ perlPackages.buildPerlPackage rec {
 
   doCheck = true;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Tool for making call graphs of C programmes";
     longDescription = ''
       Egypt is a simple tool for creating call graphs of C programs. It neither
diff --git a/nixpkgs/pkgs/development/tools/analysis/emma/default.nix b/nixpkgs/pkgs/development/tools/analysis/emma/default.nix
index 3cc16c07ec59..97f93722a182 100644
--- a/nixpkgs/pkgs/development/tools/analysis/emma/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/emma/default.nix
@@ -1,8 +1,8 @@
-{stdenv, fetchurl, unzip}:
+{lib, stdenv, fetchurl, unzip}:
 
 stdenv.mkDerivation {
   name = "emma-2.0.5312";
-  
+
   src = fetchurl {
     url = "mirror://sourceforge/emma/emma-2.0.5312.zip";
     sha256 = "0xxy39s2lvgs56vicjzpcz936l1vjaplliwa0dm7v3iyvw6jn7vj";
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
   meta = {
     homepage = "http://emma.sourceforge.net/";
     description = "A code coverage tool for Java";
-    platforms = stdenv.lib.platforms.unix;
-    license = stdenv.lib.licenses.cpl10;
+    platforms = lib.platforms.unix;
+    license = lib.licenses.cpl10;
   };
 }
diff --git a/nixpkgs/pkgs/development/tools/analysis/evmdis/default.nix b/nixpkgs/pkgs/development/tools/analysis/evmdis/default.nix
index 64a1c3173930..b8f3aa0ac1fb 100644
--- a/nixpkgs/pkgs/development/tools/analysis/evmdis/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/evmdis/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoPackage, fetchFromGitHub }:
+{ lib, stdenv, buildGoPackage, fetchFromGitHub }:
 
 buildGoPackage {
   pname = "evmdis-unstable";
@@ -12,7 +12,7 @@ buildGoPackage {
     sha256 = "09y4j7ipgv8yd99g3xk3f079w8fqfj7kl1y7ry81ainysn0qlqrg";
   };
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://github.com/Arachnid/evmdis";
     description = "Ethereum EVM disassembler";
     license = [ licenses.asl20 ];
diff --git a/nixpkgs/pkgs/development/tools/analysis/findbugs/default.nix b/nixpkgs/pkgs/development/tools/analysis/findbugs/default.nix
index d522b2b94227..265f62904530 100644
--- a/nixpkgs/pkgs/development/tools/analysis/findbugs/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/findbugs/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl }:
+{ lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
   name = "findbugs-3.0.1";
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     EOF
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A static analysis tool to find bugs in Java programs automatically";
     homepage = "http://findbugs.sourceforge.net/";
     maintainers = with maintainers; [ pSub ];
diff --git a/nixpkgs/pkgs/development/tools/analysis/flow/default.nix b/nixpkgs/pkgs/development/tools/analysis/flow/default.nix
index 80731a2106e4..fc39e86007d4 100644
--- a/nixpkgs/pkgs/development/tools/analysis/flow/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/flow/default.nix
@@ -1,14 +1,14 @@
-{ stdenv, fetchFromGitHub, ocamlPackages, CoreServices }:
+{ lib, stdenv, fetchFromGitHub, ocamlPackages, CoreServices }:
 
 stdenv.mkDerivation rec {
   pname = "flow";
-  version = "0.141.0";
+  version = "0.143.0";
 
   src = fetchFromGitHub {
     owner  = "facebook";
     repo   = "flow";
     rev    = "refs/tags/v${version}";
-    sha256 = "1hbq55gi834zapmly0gmg3kpqa1zwxcw4gll4g6vgzr0pfa0bwb2";
+    sha256 = "sha256-j4vsuPs/xr/oy4ZWGBBCy+2mPMQtxE01gqpjsYITCa0=";
   };
 
   installPhase = ''
@@ -17,9 +17,9 @@ stdenv.mkDerivation rec {
   '';
 
   buildInputs = (with ocamlPackages; [ ocaml findlib ocamlbuild dtoa core_kernel sedlex_2 ocaml_lwt lwt_log lwt_ppx ppx_deriving ppx_gen_rec ppx_tools_versioned visitors wtf8 ocaml-migrate-parsetree ])
-    ++ stdenv.lib.optionals stdenv.isDarwin [ CoreServices ];
+    ++ lib.optionals stdenv.isDarwin [ CoreServices ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A static type checker for JavaScript";
     homepage = "https://flow.org/";
     changelog = "https://github.com/facebook/flow/releases/tag/v${version}";
diff --git a/nixpkgs/pkgs/development/tools/analysis/frama-c/default.nix b/nixpkgs/pkgs/development/tools/analysis/frama-c/default.nix
index 94012ce7ff68..394bd6558fbf 100644
--- a/nixpkgs/pkgs/development/tools/analysis/frama-c/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/frama-c/default.nix
@@ -73,8 +73,8 @@ stdenv.mkDerivation rec {
   meta = {
     description = "An extensible and collaborative platform dedicated to source-code analysis of C software";
     homepage    = "http://frama-c.com/";
-    license     = stdenv.lib.licenses.lgpl21;
-    maintainers = with stdenv.lib.maintainers; [ thoughtpolice amiddelk ];
-    platforms   = stdenv.lib.platforms.unix;
+    license     = lib.licenses.lgpl21;
+    maintainers = with lib.maintainers; [ thoughtpolice amiddelk ];
+    platforms   = lib.platforms.unix;
   };
 }
diff --git a/nixpkgs/pkgs/development/tools/analysis/garcosim/tracefilegen/default.nix b/nixpkgs/pkgs/development/tools/analysis/garcosim/tracefilegen/default.nix
index d0221e80b9bc..8984a395818b 100644
--- a/nixpkgs/pkgs/development/tools/analysis/garcosim/tracefilegen/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/garcosim/tracefilegen/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake }:
+{ lib, stdenv, fetchFromGitHub, cmake }:
 
 stdenv.mkDerivation rec {
 
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     cp -ar $src/Documentation/html $out/share/doc/${name}/.
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Automatically generate all types of basic memory management operations and write into trace files";
     homepage = "https://github.com/GarCoSim";
     maintainers = [ maintainers.cmcdragonkai ];
diff --git a/nixpkgs/pkgs/development/tools/analysis/garcosim/tracefilesim/default.nix b/nixpkgs/pkgs/development/tools/analysis/garcosim/tracefilesim/default.nix
index 10f0d74c0dc7..3f97485cbfa4 100644
--- a/nixpkgs/pkgs/development/tools/analysis/garcosim/tracefilesim/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/garcosim/tracefilesim/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchgit }:
+{ lib, stdenv, fetchgit }:
 
 stdenv.mkDerivation {
 
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
     cp ./traceFileSim "$out/bin"
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Ease the analysis of existing memory management techniques, as well as the prototyping of new memory management techniques";
     homepage = "https://github.com/GarCoSim";
     maintainers = [ maintainers.cmcdragonkai ];
diff --git a/nixpkgs/pkgs/development/tools/analysis/hopper/default.nix b/nixpkgs/pkgs/development/tools/analysis/hopper/default.nix
index 68f12dac70f5..b169877f5c1f 100644
--- a/nixpkgs/pkgs/development/tools/analysis/hopper/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/hopper/default.nix
@@ -67,7 +67,7 @@ stdenv.mkDerivation rec {
       --replace "Exec=/opt/hopper-${rev}/bin/Hopper" "Exec=$out/bin/hopper"
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://www.hopperapp.com/index.html";
     description = "A macOS and Linux Disassembler";
     license = licenses.unfree;
diff --git a/nixpkgs/pkgs/development/tools/analysis/hotspot/default.nix b/nixpkgs/pkgs/development/tools/analysis/hotspot/default.nix
index f04d060290f1..6ea079e3ec15 100644
--- a/nixpkgs/pkgs/development/tools/analysis/hotspot/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/hotspot/default.nix
@@ -1,4 +1,4 @@
-{ stdenv,
+{ lib, stdenv,
   mkDerivation,
   cmake,
   elfutils,
@@ -27,8 +27,8 @@ mkDerivation rec {
     fetchSubmodules = true;
   };
 
+  nativeBuildInputs = [ cmake ];
   buildInputs = [
-    cmake
     elfutils
     extra-cmake-modules
     kconfigwidgets
@@ -50,8 +50,6 @@ mkDerivation rec {
     mkdir -p 3rdparty/perfparser/.git
   '';
 
-  enableParallelBuilding = true;
-
   meta = {
     description = "A GUI for Linux perf";
     longDescription = ''
@@ -60,8 +58,8 @@ mkDerivation rec {
       then displays the result in a graphical way.
     '';
     homepage = "https://github.com/KDAB/hotspot";
-    license = with stdenv.lib.licenses; [ gpl2 gpl3 ];
-    platforms = stdenv.lib.platforms.linux;
-    maintainers = with stdenv.lib.maintainers; [ nh2 ];
+    license = with lib.licenses; [ gpl2 gpl3 ];
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ nh2 ];
   };
 }
diff --git a/nixpkgs/pkgs/development/tools/analysis/ikos/default.nix b/nixpkgs/pkgs/development/tools/analysis/ikos/default.nix
index 7108e9311b82..26c7b6dd0b70 100644
--- a/nixpkgs/pkgs/development/tools/analysis/ikos/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/ikos/default.nix
@@ -20,7 +20,8 @@ stdenv.mkDerivation rec {
     sha256 = "0k3kp1af0qx3l1x6a4sl4fm8qlwchjvwkvs2ck0fhfnc62q2im5f";
   };
 
-  buildInputs = [ cmake boost tbb gmp clang llvm sqlite python
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ boost tbb gmp clang llvm sqlite python
                   ocamlPackages.apron mpfr ppl doxygen graphviz ];
 
   cmakeFlags = [ "-DAPRON_ROOT=${ocamlPackages.apron}" ];
diff --git a/nixpkgs/pkgs/development/tools/analysis/include-what-you-use/default.nix b/nixpkgs/pkgs/development/tools/analysis/include-what-you-use/default.nix
index 8bda0ac2223f..db1cf9c6ead5 100644
--- a/nixpkgs/pkgs/development/tools/analysis/include-what-you-use/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/include-what-you-use/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, cmake, llvmPackages, python2 }:
+{ lib, stdenv, fetchurl, cmake, llvmPackages, python2 }:
 
 stdenv.mkDerivation rec {
   pname = "include-what-you-use";
@@ -15,14 +15,12 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [ "-DIWYU_LLVM_ROOT_PATH=${llvmPackages.clang-unwrapped}" ];
 
-  enableParallelBuilding = true;
-
   postInstall = ''
     substituteInPlace $out/bin/iwyu_tool.py \
       --replace "'include-what-you-use'" "'$out/bin/include-what-you-use'"
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Analyze #includes in C/C++ source files with clang";
     longDescription = ''
       For every symbol (type, function variable, or macro) that you use in
diff --git a/nixpkgs/pkgs/development/tools/analysis/jdepend/default.nix b/nixpkgs/pkgs/development/tools/analysis/jdepend/default.nix
index c903833a731a..faa68dadc3b4 100644
--- a/nixpkgs/pkgs/development/tools/analysis/jdepend/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/jdepend/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, ant, jdk, runtimeShell }:
+{ lib, stdenv, fetchFromGitHub, ant, jdk, runtimeShell }:
 
 stdenv.mkDerivation rec {
   pname = "jdepend";
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     chmod a+x $out/bin/jdepend
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Traverses Java class file directories and generates design quality metrics for each Java package";
     homepage = "http://www.clarkware.com/software/JDepend.html";
     license = licenses.bsd3;
diff --git a/nixpkgs/pkgs/development/tools/analysis/kcov/default.nix b/nixpkgs/pkgs/development/tools/analysis/kcov/default.nix
index bbea8a1dd65d..15891e74044a 100644
--- a/nixpkgs/pkgs/development/tools/analysis/kcov/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/kcov/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchFromGitHub, cmake, pkgconfig, zlib, curl, elfutils, python, libiberty, libopcodes}:
+{lib, stdenv, fetchFromGitHub, cmake, pkg-config, zlib, curl, elfutils, python, libiberty, libopcodes}:
 
 stdenv.mkDerivation rec {
   pname = "kcov";
@@ -12,13 +12,11 @@ stdenv.mkDerivation rec {
   };
 
   preConfigure = "patchShebangs src/bin-to-c-source.py";
-  nativeBuildInputs = [ cmake pkgconfig ];
+  nativeBuildInputs = [ cmake pkg-config ];
 
   buildInputs = [ zlib curl elfutils python libiberty libopcodes ];
 
-  enableParallelBuilding = true;
-
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Code coverage tester for compiled programs, Python scripts and shell scripts";
 
     longDescription = ''
diff --git a/nixpkgs/pkgs/development/tools/analysis/lcov/default.nix b/nixpkgs/pkgs/development/tools/analysis/lcov/default.nix
index c6faeaa72f23..35c75d67da50 100644
--- a/nixpkgs/pkgs/development/tools/analysis/lcov/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/lcov/default.nix
@@ -1,4 +1,4 @@
- {stdenv, fetchFromGitHub, perl, perlPackages, makeWrapper }:
+ {lib, stdenv, fetchFromGitHub, perl, perlPackages, makeWrapper }:
 
 stdenv.mkDerivation rec {
   pname = "lcov";
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     wrapProgram $out/bin/genpng --set PERL5LIB ${perlPackages.makeFullPerlPath [ perlPackages.GD ]}
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Code coverage tool that enhances GNU gcov";
 
     longDescription =
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
       '';
 
     homepage = "http://ltp.sourceforge.net/coverage/lcov.php";
-    license = stdenv.lib.licenses.gpl2Plus;
+    license = lib.licenses.gpl2Plus;
 
     maintainers = with maintainers; [ dezgeg ];
     platforms = platforms.all;
diff --git a/nixpkgs/pkgs/development/tools/analysis/makefile2graph/default.nix b/nixpkgs/pkgs/development/tools/analysis/makefile2graph/default.nix
index 20fe74ecb74d..66f767f47028 100644
--- a/nixpkgs/pkgs/development/tools/analysis/makefile2graph/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/makefile2graph/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, makeWrapper, bash, gnumake }:
+{ lib, stdenv, fetchFromGitHub, makeWrapper, bash, gnumake }:
 
 stdenv.mkDerivation {
   name = "makefile2graph-2018-01-03";
@@ -19,10 +19,10 @@ stdenv.mkDerivation {
       --replace '/bin/sh' ${bash}/bin/bash \
       --replace 'make2graph' "$out/bin/make2graph"
     wrapProgram $out/bin/makefile2graph \
-      --set PATH ${stdenv.lib.makeBinPath [ gnumake ]}
+      --set PATH ${lib.makeBinPath [ gnumake ]}
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://github.com/lindenb/makefile2graph";
     description = "Creates a graph of dependencies from GNU-Make; Output is a graphiz-dot file or a Gexf-XML file";
     maintainers = with maintainers; [ cmcdragonkai ];
diff --git a/nixpkgs/pkgs/development/tools/analysis/oclgrind/default.nix b/nixpkgs/pkgs/development/tools/analysis/oclgrind/default.nix
index 8cc0477ca592..72154e909b65 100644
--- a/nixpkgs/pkgs/development/tools/analysis/oclgrind/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/oclgrind/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, llvmPackages, readline, python }:
+{ lib, stdenv, fetchFromGitHub, cmake, llvmPackages, readline, python }:
 
 stdenv.mkDerivation rec {
   pname = "oclgrind";
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     "-DCLANG_ROOT=${llvmPackages.clang-unwrapped}"
   ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "An OpenCL device simulator and debugger";
     homepage = "https://github.com/jrprice/oclgrind";
     license = licenses.bsd3;
diff --git a/nixpkgs/pkgs/development/tools/analysis/panopticon/default.nix b/nixpkgs/pkgs/development/tools/analysis/panopticon/default.nix
index cbc736e1a26c..ff5014bd46a9 100644
--- a/nixpkgs/pkgs/development/tools/analysis/panopticon/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/panopticon/default.nix
@@ -1,5 +1,5 @@
-{ stdenv, fetchFromGitHub, rustPlatform, qt5, git, cmake
-, pkgconfig, makeWrapper }:
+{ lib, stdenv, fetchFromGitHub, rustPlatform, qt5, git, cmake
+, pkg-config, makeWrapper }:
 
 rustPlatform.buildRustPackage rec {
   pname = "panopticon";
@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "1zv87nqhrzsxx0m891df4vagzssj3kblfv9yp7j96dw0vn9950qa";
   };
 
-  nativeBuildInputs = [ cmake pkgconfig ];
+  nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [ makeWrapper ];
   propagatedBuildInputs = with qt5; [
      qt5.qtbase
@@ -34,7 +34,7 @@ rustPlatform.buildRustPackage rec {
     makeWrapper $out/share/${pname}/${pname} $out/bin/${pname}
      '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A libre cross-platform disassembler";
     longDescription = ''
       Panopticon is a cross platform disassembler for reverse
diff --git a/nixpkgs/pkgs/development/tools/analysis/pev/default.nix b/nixpkgs/pkgs/development/tools/analysis/pev/default.nix
index 42e382c8bcad..a46bc067f11b 100644
--- a/nixpkgs/pkgs/development/tools/analysis/pev/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/pev/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, openssl, fetchFromGitHub }:
+{ lib, stdenv, openssl, fetchFromGitHub }:
 
 stdenv.mkDerivation {
   pname = "pev";
@@ -20,7 +20,7 @@ stdenv.mkDerivation {
 
   installFlags = [ "prefix=$(out)" ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A full-featured, open source, multiplatform command line toolkit to work with PE (Portable Executables) binaries";
     homepage = "https://pev.sourceforge.net/";
     license = licenses.gpl2;
diff --git a/nixpkgs/pkgs/development/tools/analysis/pmd/default.nix b/nixpkgs/pkgs/development/tools/analysis/pmd/default.nix
index 497a244f68b4..a75445c363b0 100644
--- a/nixpkgs/pkgs/development/tools/analysis/pmd/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/pmd/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, unzip, makeWrapper, openjdk }:
+{ lib, stdenv, fetchurl, unzip, makeWrapper, openjdk }:
 
 stdenv.mkDerivation rec {
   pname = "pmd";
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "An extensible cross-language static code analyzer";
     homepage = "https://pmd.github.io/";
     changelog = "https://pmd.github.io/pmd-${version}/pmd_release_notes.html";
diff --git a/nixpkgs/pkgs/development/tools/analysis/qcachegrind/default.nix b/nixpkgs/pkgs/development/tools/analysis/qcachegrind/default.nix
index d9f39667ceff..0145e51ee262 100644
--- a/nixpkgs/pkgs/development/tools/analysis/qcachegrind/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/qcachegrind/default.nix
@@ -1,7 +1,7 @@
-{ stdenv, qmake, qtbase, perl, python, php, kcachegrind }:
+{ lib, stdenv, qmake, qtbase, perl, python, php, kcachegrind }:
 
 let
-  name = stdenv.lib.replaceStrings ["kcachegrind"] ["qcachegrind"] kcachegrind.name;
+  name = lib.replaceStrings ["kcachegrind"] ["qcachegrind"] kcachegrind.name;
 
 in stdenv.mkDerivation {
   inherit name;
@@ -31,7 +31,7 @@ in stdenv.mkDerivation {
     install -Dm644 kcachegrind/48-apps-kcachegrind.png "$out/share/icons/hicolor/48x48/apps/kcachegrind.png"
   '');
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A Qt GUI to visualize profiling data";
     license = licenses.gpl2;
     platforms = platforms.unix;
diff --git a/nixpkgs/pkgs/development/tools/analysis/radare2/cutter.nix b/nixpkgs/pkgs/development/tools/analysis/radare2/cutter.nix
index d4a102ac097b..6d9543e3836f 100644
--- a/nixpkgs/pkgs/development/tools/analysis/radare2/cutter.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/radare2/cutter.nix
@@ -1,6 +1,6 @@
 { fetchFromGitHub, lib, mkDerivation
 # nativeBuildInputs
-, qmake, pkgconfig
+, qmake, pkg-config
 # Qt
 , qtbase, qtsvg, qtwebengine
 # buildInputs
@@ -30,12 +30,12 @@ mkDerivation rec {
       --replace "include(lib_radare2.pri)" ""
   '';
 
-  nativeBuildInputs = [ qmake pkgconfig python3 wrapQtAppsHook ];
+  nativeBuildInputs = [ qmake pkg-config python3 wrapQtAppsHook ];
   propagatedBuildInputs = [ python3.pkgs.pyside2 ];
   buildInputs = [ qtbase qtsvg qtwebengine r2-for-cutter python3 ];
 
   qmakeFlags = with python3.pkgs; [
-    "CONFIG+=link_pkgconfig"
+    "CONFIG+=link_pkg-config"
     "PKGCONFIG+=r_core"
     # Leaving this enabled doesn't break build but generates errors
     # at runtime (to console) about being unable to load needed bits.
diff --git a/nixpkgs/pkgs/development/tools/analysis/radare2/default.nix b/nixpkgs/pkgs/development/tools/analysis/radare2/default.nix
index e86ef2532498..3623893ea63e 100644
--- a/nixpkgs/pkgs/development/tools/analysis/radare2/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/radare2/default.nix
@@ -1,6 +1,6 @@
-{stdenv, fetchFromGitHub
+{lib, stdenv, fetchFromGitHub
 , buildPackages
-, pkgconfig
+, pkg-config
 , libusb-compat-0_1, readline, libewf, perl, zlib, openssl
 , libuv, file, libzip, xxHash
 , gtk2 ? null, vte ? null, gtkdialog ? null
@@ -19,7 +19,7 @@ assert pythonBindings -> python3 != null;
 
 
 let
-  inherit (stdenv.lib) optional;
+  inherit (lib) optional;
 
   generic = {
     version_commit, # unused
@@ -56,11 +56,6 @@ let
         # radare 3.3 compat for radare2-cutter
         (cd shlr && ln -s ../capstone-${cs_ver} capstone)
         tar -czvf shlr/capstone-${cs_ver}.tar.gz capstone-${cs_ver}
-        # necessary because they broke the offline-build:
-        # https://github.com/radare/radare2/commit/6290e4ff4cc167e1f2c28ab924e9b99783fb1b38#diff-a44d840c10f1f1feaf401917ae4ccd54R258
-        # https://github.com/radare/radare2/issues/13087#issuecomment-465159716
-        curl() { true; }
-        export -f curl
       '';
 
       postInstall = ''
@@ -83,7 +78,7 @@ let
       enableParallelBuilding = true;
       depsBuildBuild = [ buildPackages.stdenv.cc ];
 
-      nativeBuildInputs = [ pkgconfig ];
+      nativeBuildInputs = [ pkg-config ];
       buildInputs = [ file readline libusb-compat-0_1 libewf perl zlib openssl libuv ]
         ++ optional useX11 [ gtkdialog vte gtk2 ]
         ++ optional rubyBindings [ ruby ]
@@ -100,9 +95,9 @@ let
       meta = {
         description = "unix-like reverse engineering framework and commandline tools";
         homepage = "http://radare.org/";
-        license = stdenv.lib.licenses.gpl2Plus;
-        maintainers = with stdenv.lib.maintainers; [ raskin makefu mic92 ];
-        platforms = with stdenv.lib.platforms; linux;
+        license = lib.licenses.gpl2Plus;
+        maintainers = with lib.maintainers; [ raskin makefu mic92 ];
+        platforms = with lib.platforms; linux;
         inherit version;
       };
   };
@@ -110,12 +105,12 @@ in {
   #<generated>
   # DO NOT EDIT! Automatically generated by ./update.py
   radare2 = generic {
-    version_commit = "24959";
-    gittap = "4.5.1";
-    gittip = "293cf5ae65ba4e28828095dcae212955593ba255";
-    rev = "4.5.1";
-    version = "4.5.1";
-    sha256 = "0qigy1px0jy74c5ig73dc2fqjcy6vcy76i25dx9r3as6zfpkkaxj";
+    version_commit = "25480";
+    gittap = "5.0.0";
+    gittip = "a476454c00f64acbb7425c178c98714ef76e26d7";
+    rev = "5.0.0";
+    version = "5.0.0";
+    sha256 = "0aa7c27kd0l55fy5qfvxqmakp4pz6240v3hn84095qmqkzcbs420";
     cs_ver = "4.0.2";
     cs_sha256 = "0y5g74yjyliciawpn16zhdwya7bd3d7b1cccpcccc2wg8vni1k2w";
   };
diff --git a/nixpkgs/pkgs/development/tools/analysis/randoop/default.nix b/nixpkgs/pkgs/development/tools/analysis/randoop/default.nix
index b51b26eab172..0d10d6d6b277 100644
--- a/nixpkgs/pkgs/development/tools/analysis/randoop/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/randoop/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, unzip }:
+{ lib, stdenv, fetchurl, unzip }:
 
 stdenv.mkDerivation rec {
   version = "4.2.5";
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     cp README.txt $out/doc
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Automatic test generation for Java";
     homepage = "https://randoop.github.io/randoop/";
     license = licenses.mit;
diff --git a/nixpkgs/pkgs/development/tools/analysis/retdec/default.nix b/nixpkgs/pkgs/development/tools/analysis/retdec/default.nix
index b0e5319df2d6..1701abeb25fd 100644
--- a/nixpkgs/pkgs/development/tools/analysis/retdec/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/retdec/default.nix
@@ -9,7 +9,7 @@
 , autoconf
 , automake
 , libtool
-, pkgconfig
+, pkg-config
 , bison
 , flex
 , groff
@@ -145,7 +145,7 @@ in stdenv.mkDerivation rec {
     autoconf
     automake
     libtool
-    pkgconfig
+    pkg-config
     bison
     flex
     groff
@@ -216,8 +216,6 @@ in stdenv.mkDerivation rec {
     substituteInPlace scripts/retdec-unpacker.py --replace "'upx'" "'${upx}/bin/upx'"
   '';
 
-  enableParallelBuilding = true;
-
   doInstallCheck = true;
   installCheckPhase = ''
     ${python3.interpreter} "$out/bin/retdec-tests-runner.py"
diff --git a/nixpkgs/pkgs/development/tools/analysis/rr/default.nix b/nixpkgs/pkgs/development/tools/analysis/rr/default.nix
index 5e80d5b096db..b63713f00073 100644
--- a/nixpkgs/pkgs/development/tools/analysis/rr/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/rr/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, libpfm, zlib, pkgconfig, python3Packages, which, procps, gdb, capnproto }:
+{ lib, stdenv, fetchFromGitHub, cmake, libpfm, zlib, pkg-config, python3Packages, which, procps, gdb, capnproto }:
 
 stdenv.mkDerivation rec {
   version = "5.4.0";
@@ -21,9 +21,9 @@ stdenv.mkDerivation rec {
   # see https://github.com/mozilla/rr/issues/2269
   preConfigure = ''substituteInPlace CMakeLists.txt --replace "std=c++11" "std=c++14"'';
 
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ cmake pkg-config which ];
   buildInputs = [
-    cmake libpfm zlib python3Packages.python python3Packages.pexpect which procps gdb capnproto
+    libpfm zlib python3Packages.python python3Packages.pexpect procps gdb capnproto
   ];
   propagatedBuildInputs = [ gdb ]; # needs GDB to replay programs at runtime
   cmakeFlags = [
@@ -37,8 +37,6 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "fortify" ];
 
-  enableParallelBuilding = true;
-
   # FIXME
   #doCheck = true;
 
@@ -54,8 +52,8 @@ stdenv.mkDerivation rec {
       time the same execution is replayed.
     '';
 
-    license = with stdenv.lib.licenses; [ mit bsd2 ];
-    maintainers = with stdenv.lib.maintainers; [ pierron thoughtpolice ];
-    platforms = stdenv.lib.platforms.x86;
+    license = with lib.licenses; [ mit bsd2 ];
+    maintainers = with lib.maintainers; [ pierron thoughtpolice ];
+    platforms = lib.platforms.x86;
   };
 }
diff --git a/nixpkgs/pkgs/development/tools/analysis/smatch/default.nix b/nixpkgs/pkgs/development/tools/analysis/smatch/default.nix
index 1443c31192df..4330ec3d7426 100644
--- a/nixpkgs/pkgs/development/tools/analysis/smatch/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/smatch/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchgit, sqlite, pkgconfig, perl
+{ lib, stdenv, fetchgit, sqlite, pkg-config, perl
 , buildllvmsparse ? true
 , buildc2xml ? true
 , llvm ? null, libxml2 ? null
@@ -16,10 +16,10 @@ stdenv.mkDerivation {
     sha256 = "0r43qi6vryqg450fj73yjwbb7gzcgx64rhrhb3r1m6a252srijiy";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = [sqlite perl]
-   ++ stdenv.lib.optional buildllvmsparse llvm
-   ++ stdenv.lib.optional buildc2xml libxml2;
+   ++ lib.optional buildllvmsparse llvm
+   ++ lib.optional buildc2xml libxml2;
 
   preBuild =
     '' sed -i Makefile \
@@ -29,7 +29,7 @@ stdenv.mkDerivation {
   meta = {
     description = "A semantic analysis tool for C";
     homepage = "http://smatch.sourceforge.net/";
-    license = stdenv.lib.licenses.free; /* OSL, see http://www.opensource.org */
-    platforms = stdenv.lib.platforms.linux;
+    license = lib.licenses.free; /* OSL, see http://www.opensource.org */
+    platforms = lib.platforms.linux;
   };
 }
diff --git a/nixpkgs/pkgs/development/tools/analysis/snowman/default.nix b/nixpkgs/pkgs/development/tools/analysis/snowman/default.nix
index 2f7ff219081f..261645c062d3 100644
--- a/nixpkgs/pkgs/development/tools/analysis/snowman/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/snowman/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, mkDerivation, fetchFromGitHub, cmake, boost, qtbase }:
+{ lib, stdenv, mkDerivation, fetchFromGitHub, cmake, boost, qtbase }:
 
 mkDerivation rec {
   pname = "snowman";
@@ -19,9 +19,7 @@ mkDerivation rec {
     export sourceRoot=$sourceRoot/src
   '';
 
-  enableParallelBuilding = true;
-
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Native code to C/C++ decompiler";
     homepage = "http://derevenets.com/";
 
diff --git a/nixpkgs/pkgs/development/tools/analysis/sparse/default.nix b/nixpkgs/pkgs/development/tools/analysis/sparse/default.nix
index 945f6c80af52..e0d9840472b4 100644
--- a/nixpkgs/pkgs/development/tools/analysis/sparse/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/sparse/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, stdenv, pkgconfig, libxml2, llvm }:
+{ fetchurl, lib, stdenv, pkg-config, libxml2, llvm }:
 
 stdenv.mkDerivation rec {
   name = "sparse-0.5.0";
@@ -12,15 +12,15 @@ stdenv.mkDerivation rec {
     sed -i Makefile -e "s|^PREFIX=.*$|PREFIX=$out|g"
   '';
 
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = [ libxml2 llvm ];
   doCheck = true;
 
   meta = {
     description = "Semantic parser for C";
     homepage    = "https://git.kernel.org/cgit/devel/sparse/sparse.git/";
-    license     = stdenv.lib.licenses.mit;
-    platforms   = stdenv.lib.platforms.linux;
-    maintainers = [ stdenv.lib.maintainers.thoughtpolice ];
+    license     = lib.licenses.mit;
+    platforms   = lib.platforms.linux;
+    maintainers = [ lib.maintainers.thoughtpolice ];
   };
 }
diff --git a/nixpkgs/pkgs/development/tools/analysis/spin/default.nix b/nixpkgs/pkgs/development/tools/analysis/spin/default.nix
index 73e88f9811c3..49e31f53a846 100644
--- a/nixpkgs/pkgs/development/tools/analysis/spin/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/spin/default.nix
@@ -2,13 +2,13 @@
 , withISpin ? true, tk, swarm, graphviz }:
 
 let
-  binPath = stdenv.lib.makeBinPath [ gcc ];
-  ibinPath = stdenv.lib.makeBinPath [ gcc tk swarm graphviz tk ];
+  binPath = lib.makeBinPath [ gcc ];
+  ibinPath = lib.makeBinPath [ gcc tk swarm graphviz tk ];
 
 in stdenv.mkDerivation rec {
   pname = "spin";
   version = "6.4.9";
-  url-version = stdenv.lib.replaceChars ["."] [""] version;
+  url-version = lib.replaceChars ["."] [""] version;
 
   src = fetchurl {
     # The homepage is behind CloudFlare anti-DDoS protection, which blocks cURL.
@@ -36,7 +36,7 @@ in stdenv.mkDerivation rec {
       --prefix PATH ':' "$out/bin:${ibinPath}"
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Formal verification tool for distributed software systems";
     homepage = "http://spinroot.com/";
     license = licenses.free;
diff --git a/nixpkgs/pkgs/development/tools/analysis/splint/default.nix b/nixpkgs/pkgs/development/tools/analysis/splint/default.nix
index 4dc93897e869..581ff56bb614 100644
--- a/nixpkgs/pkgs/development/tools/analysis/splint/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/splint/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, stdenv, flex }:
+{ fetchurl, lib, stdenv, flex }:
 
 stdenv.mkDerivation rec {
   name = "splint-3.1.2";
@@ -8,13 +8,13 @@ stdenv.mkDerivation rec {
     sha256 = "02pv8kscsrkrzip9r08pfs9xs98q74c52mlxzbii6cv6vx1vd3f7";
   };
 
-  patches = [ ./tmpdir.patch ] ++ stdenv.lib.optional stdenv.isDarwin ./darwin.patch;
+  patches = [ ./tmpdir.patch ] ++ lib.optional stdenv.isDarwin ./darwin.patch;
 
   buildInputs = [ flex ];
 
   doCheck = true;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "http://www.splint.org/";
     description = "Annotation-assisted lightweight static analyzer for C";
 
diff --git a/nixpkgs/pkgs/development/tools/analysis/swarm/default.nix b/nixpkgs/pkgs/development/tools/analysis/swarm/default.nix
index 03f218546ebf..894d9a2357ea 100644
--- a/nixpkgs/pkgs/development/tools/analysis/swarm/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/swarm/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, stdenv, fetchFromGitHub }:
 
 stdenv.mkDerivation {
   name = "swarm-2019-03-11";
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
     install -Dm644 Doc/swarm.1 $out/share/man/man1/swarm.1
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Verification script generator for Spin";
     homepage = "http://spinroot.com/";
     license = licenses.free;
diff --git a/nixpkgs/pkgs/development/tools/analysis/tflint/default.nix b/nixpkgs/pkgs/development/tools/analysis/tflint/default.nix
index 1011bcb5cc0c..617d255d7e51 100644
--- a/nixpkgs/pkgs/development/tools/analysis/tflint/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/tflint/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "tflint";
-  version = "0.22.0";
+  version = "0.23.1";
 
   src = fetchFromGitHub {
     owner = "terraform-linters";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0wbxlh2lwgdhhw902lqy6p2vh8adfq4yaa507js8an3byy26ls3d";
+    sha256 = "19vgan743xsnglwva93fs4sqcbpqbyrxbgn5qff809ns8hj8ir94";
   };
 
-  vendorSha256 = "0yk9xsb0s4kymfb3p14irks6b30b53r0mz7irgcmx9jxz8vyffqg";
+  vendorSha256 = "1y6ra9bkp6wl0pikvyqywhg5w18v3glnyvwqrddkkkabspl05nqx";
 
   doCheck = false;
 
diff --git a/nixpkgs/pkgs/development/tools/analysis/uefi-firmware-parser/default.nix b/nixpkgs/pkgs/development/tools/analysis/uefi-firmware-parser/default.nix
index 0ad042d74def..17f390714620 100644
--- a/nixpkgs/pkgs/development/tools/analysis/uefi-firmware-parser/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/uefi-firmware-parser/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, python3, fetchFromGitHub }:
+{ lib, stdenv, python3, fetchFromGitHub }:
 
 with python3.pkgs;
 
@@ -14,7 +14,7 @@ buildPythonApplication rec {
     sha256 = "1yn9vi91j1yxkn0icdnjhgl0qrqqkzyhccj39af4f19q1gdw995l";
   };
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://github.com/theopolis/uefi-firmware-parser/";
     description = "Parse BIOS/Intel ME/UEFI firmware related structures: Volumes, FileSystems, Files, etc";
     # MIT + license headers in some files
diff --git a/nixpkgs/pkgs/development/tools/analysis/valgrind/default.nix b/nixpkgs/pkgs/development/tools/analysis/valgrind/default.nix
index 60d3a7c5ebc9..d99bbe1cae4b 100644
--- a/nixpkgs/pkgs/development/tools/analysis/valgrind/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/valgrind/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, perl, gdb, cctools, xnu, bootstrap_cmds }:
+{ lib, stdenv, fetchurl, perl, gdb, cctools, xnu, bootstrap_cmds }:
 
 stdenv.mkDerivation rec {
   name = "valgrind-3.16.1";
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   # GDB is needed to provide a sane default for `--db-command'.
   # Perl is needed for `callgrind_{annotate,control}'.
-  buildInputs = [ gdb perl ]  ++ stdenv.lib.optionals (stdenv.isDarwin) [ bootstrap_cmds xnu ];
+  buildInputs = [ gdb perl ]  ++ lib.optionals (stdenv.isDarwin) [ bootstrap_cmds xnu ];
 
   # Perl is also a native build input.
   nativeBuildInputs = [ perl ];
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
   separateDebugInfo = stdenv.isLinux;
 
-  preConfigure = stdenv.lib.optionalString stdenv.isDarwin (
+  preConfigure = lib.optionalString stdenv.isDarwin (
     let OSRELEASE = ''
       $(awk -F '"' '/#define OSRELEASE/{ print $2 }' \
       <${xnu}/Library/Frameworks/Kernel.framework/Headers/libkern/version.h)'';
@@ -50,8 +50,8 @@ stdenv.mkDerivation rec {
   postPatch = "";
 
   configureFlags =
-    stdenv.lib.optional (stdenv.hostPlatform.system == "x86_64-linux" || stdenv.hostPlatform.system == "x86_64-darwin") "--enable-only64bit"
-    ++ stdenv.lib.optional stdenv.hostPlatform.isDarwin "--with-xcodedir=${xnu}/include";
+    lib.optional (stdenv.hostPlatform.system == "x86_64-linux" || stdenv.hostPlatform.system == "x86_64-darwin") "--enable-only64bit"
+    ++ lib.optional stdenv.hostPlatform.isDarwin "--with-xcodedir=${xnu}/include";
 
   doCheck = false; # fails
 
@@ -76,10 +76,10 @@ stdenv.mkDerivation rec {
       Valgrind to build new tools.
     '';
 
-    license = stdenv.lib.licenses.gpl2Plus;
+    license = lib.licenses.gpl2Plus;
 
-    maintainers = [ stdenv.lib.maintainers.eelco ];
-    platforms = stdenv.lib.platforms.unix;
+    maintainers = [ lib.maintainers.eelco ];
+    platforms = lib.platforms.unix;
     badPlatforms = [
       "armv5tel-linux" "armv6l-linux" "armv6m-linux"
       "sparc-linux" "sparc64-linux"
diff --git a/nixpkgs/pkgs/development/tools/analysis/valkyrie/default.nix b/nixpkgs/pkgs/development/tools/analysis/valkyrie/default.nix
index 1c571fe6be0f..10b9f7291a22 100644
--- a/nixpkgs/pkgs/development/tools/analysis/valkyrie/default.nix
+++ b/nixpkgs/pkgs/development/tools/analysis/valkyrie/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, qt4, qmake4Hook }:
+{ lib, stdenv, fetchurl, qt4, qmake4Hook }:
 
 stdenv.mkDerivation rec {
   name = "valkyrie-2.0.0";
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ qmake4Hook ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "http://www.valgrind.org/";
     description = "Qt4-based GUI for the Valgrind 3.6.x series";
     license = licenses.gpl2;