Merge commit '90441b4b47fc7280de6a5bd1a228017caaa0f97f'

25 files changed, 207 insertions, 87 deletions

diff --git a/nixpkgs/pkgs/servers/amqp/rabbitmq-server/default.nix b/nixpkgs/pkgs/servers/amqp/rabbitmq-server/default.nix
index f1838f2a2cba..868fd3a6d561 100644
--- a/nixpkgs/pkgs/servers/amqp/rabbitmq-server/default.nix
+++ b/nixpkgs/pkgs/servers/amqp/rabbitmq-server/default.nix
@@ -1,5 +1,6 @@
 { stdenv, fetchurl, erlang, elixir, python, libxml2, libxslt, xmlto
 , docbook_xml_dtd_45, docbook_xsl, zip, unzip, rsync, getconf, socat
+, procps, coreutils, gnused, systemd, glibcLocales
 , AppKit, Carbon, Cocoa
 }:
 
@@ -15,7 +16,7 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs =
-    [ erlang elixir python libxml2 libxslt xmlto docbook_xml_dtd_45 docbook_xsl zip unzip rsync ]
+    [ erlang elixir python libxml2 libxslt xmlto docbook_xml_dtd_45 docbook_xsl zip unzip rsync glibcLocales ]
     ++ stdenv.lib.optionals stdenv.isDarwin [ AppKit Carbon Cocoa ];
 
   outputs = [ "out" "man" "doc" ];
@@ -23,15 +24,31 @@ stdenv.mkDerivation rec {
   installFlags = [ "PREFIX=$(out)" "RMQ_ERLAPP_DIR=$(out)" ];
   installTargets = [ "install" "install-man" ];
 
-  runtimePath = stdenv.lib.makeBinPath [getconf erlang socat];
+  preBuild = ''
+    export LANG=C.UTF-8 # fix elixir locale warning
+  '';
+
+  runtimePath = stdenv.lib.makeBinPath [
+    erlang
+    getconf # for getting memory limits
+    socat systemd procps # for systemd unit activation check
+    gnused coreutils # used by helper scripts
+  ];
   postInstall = ''
-    echo 'PATH=${runtimePath}:''${PATH:+:}$PATH' >> $out/sbin/rabbitmq-env
+    # rabbitmq-env calls to sed/coreutils, so provide everything early
+    sed -i $out/sbin/rabbitmq-env -e '2s|^|PATH=${runtimePath}\''${PATH:+:}\$PATH/\n|'
+
+    # rabbitmq-server script uses `dirname` to get hold of a
+    # rabbitmq-env, so let's provide this file directly. After that
+    # point everything is OK - the PATH above will kick in
+    substituteInPlace $out/sbin/rabbitmq-server \
+      --replace '`dirname $0`/rabbitmq-env' \
+                "$out/sbin/rabbitmq-env"
 
-    # we know exactly where rabbitmq is gonna be,
-    # so we patch that into the env-script
-    substituteInPlace $out/sbin/rabbitmq-env \
-      --replace 'RABBITMQ_SCRIPTS_DIR=`dirname $SCRIPT_PATH`' \
-                "RABBITMQ_SCRIPTS_DIR=$out/sbin"
+    # We know exactly where rabbitmq is gonna be, so we patch that into the env-script.
+    # By doing it early we make sure that auto-detection for this will
+    # never be executed (somewhere below in the script).
+    sed -i $out/sbin/rabbitmq-env -e "2s|^|RABBITMQ_SCRIPTS_DIR=$out/sbin\n|"
 
     # there’s a few stray files that belong into share
     mkdir -p $doc/share/doc/rabbitmq-server
diff --git a/nixpkgs/pkgs/servers/dante/default.nix b/nixpkgs/pkgs/servers/dante/default.nix
index ae083f17ada9..c36ca2f8f509 100644
--- a/nixpkgs/pkgs/servers/dante/default.nix
+++ b/nixpkgs/pkgs/servers/dante/default.nix
@@ -11,7 +11,9 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ pam libkrb5 cyrus_sasl miniupnpc ];
 
-  configureFlags = ["--with-libc=libc${stdenv.targetPlatform.extensions.sharedLibrary}"];
+  configureFlags = if !stdenv.isDarwin
+    then [ "--with-libc=libc.so.6" ]
+    else [ "--with-libc=libc${stdenv.targetPlatform.extensions.sharedLibrary}" ];
 
   dontAddDisableDepTrack = stdenv.isDarwin;
 
diff --git a/nixpkgs/pkgs/servers/ftp/bftpd/default.nix b/nixpkgs/pkgs/servers/ftp/bftpd/default.nix
index e7c22904ceac..34757462a176 100644
--- a/nixpkgs/pkgs/servers/ftp/bftpd/default.nix
+++ b/nixpkgs/pkgs/servers/ftp/bftpd/default.nix
@@ -5,11 +5,11 @@ let
 
 in stdenv.mkDerivation rec {
   name = "${pname}-${version}";
-  version = "5.2";
+  version = "5.4";
 
   src = fetchurl {
     url = "mirror://sourceforge/project/${pname}/${pname}/${name}/${name}.tar.gz";
-    sha256 = "0kmavljj3zwpgdib9nb14fnriiv0l9zm3hglimcyz26sxbw5jqky";
+    sha256 = "19fd9r233wkjk8gdxn6qsjgfijiw67a48xhgbm2kq46bx80yf3pg";
   };
 
   preConfigure = ''
diff --git a/nixpkgs/pkgs/servers/home-assistant/component-packages.nix b/nixpkgs/pkgs/servers/home-assistant/component-packages.nix
index ebb6192fa6aa..275241fcd176 100644
--- a/nixpkgs/pkgs/servers/home-assistant/component-packages.nix
+++ b/nixpkgs/pkgs/servers/home-assistant/component-packages.nix
@@ -339,7 +339,7 @@
     "hyperion" = ps: with ps; [  ];
     "ialarm" = ps: with ps; [  ];
     "iaqualink" = ps: with ps; [  ];
-    "icloud" = ps: with ps; [  ];
+    "icloud" = ps: with ps; [ pyicloud ];
     "idteck_prox" = ps: with ps; [  ];
     "ifttt" = ps: with ps; [ aiohttp-cors pyfttt ];
     "iglo" = ps: with ps; [  ];
diff --git a/nixpkgs/pkgs/servers/home-assistant/esphome.nix b/nixpkgs/pkgs/servers/home-assistant/esphome.nix
index 27dabd2a2eb2..12b36de49650 100644
--- a/nixpkgs/pkgs/servers/home-assistant/esphome.nix
+++ b/nixpkgs/pkgs/servers/home-assistant/esphome.nix
@@ -3,27 +3,26 @@
 let
   python = python3.override {
     packageOverrides = self: super: {
-      tornado = super.tornado.overridePythonAttrs (oldAttrs: rec {
-        version = "5.1.1";
+      protobuf = super.protobuf.override {
+        protobuf = protobuf3_10;
+      };
+      pyyaml = super.pyyaml.overridePythonAttrs (oldAttrs: rec {
+        version = "5.1.2";
         src = oldAttrs.src.override {
           inherit version;
-          sha256 = "4e5158d97583502a7e2739951553cbd88a72076f152b4b11b64b9a10c4c49409";
+          sha256 = "1r5faspz73477hlbjgilw05xsms0glmsa371yqdd26znqsvg1b81";
         };
       });
-      protobuf = super.protobuf.override {
-        protobuf = protobuf3_10;
-      };
-
     };
   };
 
 in python.pkgs.buildPythonApplication rec {
   pname = "esphome";
-  version = "1.14.1";
+  version = "1.14.3";
 
   src = python.pkgs.fetchPypi {
     inherit pname version;
-    sha256 = "1hw1q2fck9429077w207rk65a1krzyi6qya5pzjkpw4av5s0v0g3";
+    sha256 = "0xnsl000c5a2li9qw9anrzzq437qn1n4hcfc24i4rfq37awzmig7";
   };
 
   ESPHOME_USE_SUBPROCESS = "";
diff --git a/nixpkgs/pkgs/servers/http/apache-httpd/2.4.nix b/nixpkgs/pkgs/servers/http/apache-httpd/2.4.nix
index d5da6df8d689..252365098ddc 100644
--- a/nixpkgs/pkgs/servers/http/apache-httpd/2.4.nix
+++ b/nixpkgs/pkgs/servers/http/apache-httpd/2.4.nix
@@ -39,6 +39,7 @@ stdenv.mkDerivation rec {
   prePatch = ''
     sed -i config.layout -e "s|installbuilddir:.*|installbuilddir: $dev/share/build|"
     sed -i support/apachectl.in -e 's|@LYNX_PATH@|${lynx}/bin/lynx|'
+    sed -i support/apachectl.in -e 's|$HTTPD -t|$HTTPD -t -f /etc/httpd/httpd.conf|'
   '';
 
   # Required for ‘pthread_cancel’.
diff --git a/nixpkgs/pkgs/servers/http/jetty/default.nix b/nixpkgs/pkgs/servers/http/jetty/default.nix
index 8d2340647cb4..4a3a3f2da016 100644
--- a/nixpkgs/pkgs/servers/http/jetty/default.nix
+++ b/nixpkgs/pkgs/servers/http/jetty/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "jetty";
-  version = "9.4.24.v20191120";
+  version = "9.4.25.v20191220";
   src = fetchurl {
     url = "https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-distribution/${version}/jetty-distribution-${version}.tar.gz";
     name = "jetty-distribution-${version}.tar.gz";
-    sha256 = "072vr8gfly2xdwxx1c771yymf145l8nv0j31liwqrih8zqvvhsd4";
+    sha256 = "1jnx4hnvd2krsdisqwpws1qd1r0f8gm9a4sx4a8c7zqrmfd2zx1a";
   };
 
   phases = [ "unpackPhase" "installPhase" ];
diff --git a/nixpkgs/pkgs/servers/http/lwan/default.nix b/nixpkgs/pkgs/servers/http/lwan/default.nix
index f692832e882b..9cd9a6b7fec1 100644
--- a/nixpkgs/pkgs/servers/http/lwan/default.nix
+++ b/nixpkgs/pkgs/servers/http/lwan/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lwan";
-  version = "0.1";
+  version = "0.2";
 
   src = fetchFromGitHub {
     owner = "lpereira";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1mckryzb06smky0bx2bkqwqzpnq4pb8vlgmmwsvqmwi4mmw9wmi1";
+    sha256 = "1z1g6bmdsf7zj809sq6jqkpzkdnx1jch84kk67h0v2x6lxhdpv5r";
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];
diff --git a/nixpkgs/pkgs/servers/http/unit/default.nix b/nixpkgs/pkgs/servers/http/unit/default.nix
index d210fcefc85c..c3af0d555438 100644
--- a/nixpkgs/pkgs/servers/http/unit/default.nix
+++ b/nixpkgs/pkgs/servers/http/unit/default.nix
@@ -18,16 +18,21 @@
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
-  version = "1.13.0";
+  version = "1.14.0";
   pname = "unit";
 
   src = fetchFromGitHub {
     owner = "nginx";
     repo = "unit";
     rev = version;
-    sha256 = "1b5il05isq5yvnx2qpnihsrmj0jliacvhrm58i87d48anwpv1k8q";
+    sha256 = "01anczfcdwd22hb0y4zw647f86ivk5zq8lcd13xfxjvkmnsnbj9w";
   };
 
+  patches = [
+    # https://github.com/nginx/unit/issues/357
+    ./drop_cap.patch
+  ];
+
   nativeBuildInputs = [ which ];
 
   buildInputs = [ ]
diff --git a/nixpkgs/pkgs/servers/http/unit/drop_cap.patch b/nixpkgs/pkgs/servers/http/unit/drop_cap.patch
new file mode 100644
index 000000000000..87caf77904e2
--- /dev/null
+++ b/nixpkgs/pkgs/servers/http/unit/drop_cap.patch
@@ -0,0 +1,79 @@
+diff -r ed17ce89119f src/nxt_capability.c
+--- a/src/nxt_capability.c      Fri Dec 06 17:02:23 2019 +0000
++++ b/src/nxt_capability.c      Mon Dec 09 23:23:00 2019 +0000
+@@ -93,6 +93,26 @@ nxt_capability_specific_set(nxt_task_t *
+     return NXT_OK;
+ }
+ 
++
++nxt_int_t
++nxt_capability_drop_all(nxt_task_t *task)
++{
++    struct __user_cap_header_struct hdr;
++    struct __user_cap_data_struct data[2];
++
++    hdr.version = nxt_capability_linux_get_version();
++    hdr.pid = nxt_pid;
++
++    nxt_memset(data, 0, sizeof(data));
++
++    if (nxt_slow_path(nxt_capset(&hdr, data) == -1)) {
++        nxt_alert(task, "failed to drop capabilities %E", nxt_errno);
++        return NXT_ERROR;
++    }
++
++    return NXT_OK;
++}
++
+ #else
+ 
+ static nxt_int_t
+diff -r ed17ce89119f src/nxt_capability.h
+--- a/src/nxt_capability.h      Fri Dec 06 17:02:23 2019 +0000
++++ b/src/nxt_capability.h      Mon Dec 09 23:23:00 2019 +0000
+@@ -14,4 +14,6 @@ typedef struct {
+ NXT_EXPORT nxt_int_t nxt_capability_set(nxt_task_t *task,
+     nxt_capabilities_t *cap);
+ 
++NXT_EXPORT nxt_int_t nxt_capability_drop_all(nxt_task_t *task);
++
+ #endif /* _NXT_CAPABILITY_INCLUDED_ */
+diff -r ed17ce89119f src/nxt_process.c
+--- a/src/nxt_process.c Fri Dec 06 17:02:23 2019 +0000
++++ b/src/nxt_process.c Mon Dec 09 23:23:00 2019 +0000
+@@ -264,7 +264,7 @@ cleanup:
+ static void
+ nxt_process_start(nxt_task_t *task, nxt_process_t *process)
+ {
+-    nxt_int_t                    ret, cap_setid;
++    nxt_int_t                    ret, cap_setid, drop_caps;
+     nxt_port_t                   *port, *main_port;
+     nxt_thread_t                 *thread;
+     nxt_runtime_t                *rt;
+@@ -285,9 +285,12 @@ nxt_process_start(nxt_task_t *task, nxt_
+ 
+     cap_setid = rt->capabilities.setid;
+ 
++    drop_caps = cap_setid;
++
+ #if (NXT_HAVE_CLONE_NEWUSER)
+-    if (!cap_setid && NXT_CLONE_USER(init->isolation.clone.flags)) {
++    if (NXT_CLONE_USER(init->isolation.clone.flags)) {
+         cap_setid = 1;
++        drop_caps = 0;
+     }
+ #endif
+ 
+@@ -301,6 +304,12 @@ nxt_process_start(nxt_task_t *task, nxt_
+         if (nxt_slow_path(ret != NXT_OK)) {
+             goto fail;
+         }
++
++#if (NXT_HAVE_LINUX_CAPABILITY)
++        if (drop_caps && nxt_capability_drop_all(task) != NXT_OK) {
++            goto fail;
++        }
++#endif
+     }
+ 
+     rt->type = init->type;
\ No newline at end of file
diff --git a/nixpkgs/pkgs/servers/jellyfin/default.nix b/nixpkgs/pkgs/servers/jellyfin/default.nix
index b1116dc4a95d..6da342ae8803 100644
--- a/nixpkgs/pkgs/servers/jellyfin/default.nix
+++ b/nixpkgs/pkgs/servers/jellyfin/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, unzip, sqlite, makeWrapper, dotnet-sdk, ffmpeg,
+{ stdenv, lib, fetchurl, unzip, sqlite, makeWrapper, dotnet-netcore, ffmpeg,
   fontconfig, freetype }:
 
 let
@@ -32,7 +32,7 @@ in stdenv.mkDerivation rec {
   ];
 
   propagatedBuildInputs = [
-    dotnet-sdk
+    dotnet-netcore
     sqlite
   ];
 
@@ -42,7 +42,7 @@ in stdenv.mkDerivation rec {
     install -dm 755 "$out/opt/jellyfin"
     cp -r * "$out/opt/jellyfin"
 
-    makeWrapper "${dotnet-sdk}/bin/dotnet" $out/bin/jellyfin \
+    makeWrapper "${dotnet-netcore}/bin/dotnet" $out/bin/jellyfin \
       --prefix LD_LIBRARY_PATH : "${stdenv.lib.makeLibraryPath [
         sqlite fontconfig freetype stdenv.cc.cc.lib
       ]}:$out/opt/jellyfin/runtimes/${runtimeDir}/native/" \
diff --git a/nixpkgs/pkgs/servers/mail/mailman/default.nix b/nixpkgs/pkgs/servers/mail/mailman/default.nix
index e4caa7a01be2..54719db376cd 100644
--- a/nixpkgs/pkgs/servers/mail/mailman/default.nix
+++ b/nixpkgs/pkgs/servers/mail/mailman/default.nix
@@ -1,12 +1,13 @@
-{ stdenv, buildPythonPackage, fetchPypi, fetchpatch, alembic, aiosmtpd, dnspython
-, flufl_bounce, flufl_i18n, flufl_lock, lazr_config, lazr_delegates, passlib
-, requests, zope_configuration, click, falcon, importlib-resources
+{ stdenv, buildPythonPackage, fetchPypi, fetchpatch, isPy3k, alembic, aiosmtpd
+, dnspython, flufl_bounce, flufl_i18n, flufl_lock, lazr_config, lazr_delegates
+, passlib, requests, zope_configuration, click, falcon, importlib-resources
 , zope_component, lynx, postfix, authheaders, gunicorn
 }:
 
 buildPythonPackage rec {
   pname = "mailman";
   version = "3.3.0";
+  disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
diff --git a/nixpkgs/pkgs/servers/mail/mailman/hyperkitty.nix b/nixpkgs/pkgs/servers/mail/mailman/hyperkitty.nix
index 1f8da7c3c403..57c1b355bf26 100644
--- a/nixpkgs/pkgs/servers/mail/mailman/hyperkitty.nix
+++ b/nixpkgs/pkgs/servers/mail/mailman/hyperkitty.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildPythonPackage, fetchPypi, isort, coverage, mock
+{ stdenv, buildPythonPackage, fetchPypi, isPy3k, isort, coverage, mock
 , robot-detection, django_extensions, rjsmin, cssmin, django-mailman3
 , django-haystack, flufl_lock, networkx, dateutil, defusedxml
 , django-paintstore, djangorestframework, django, django-q
@@ -8,6 +8,7 @@
 buildPythonPackage rec {
   pname = "HyperKitty";
   version = "1.3.2";
+  disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
diff --git a/nixpkgs/pkgs/servers/mail/public-inbox/default.nix b/nixpkgs/pkgs/servers/mail/public-inbox/default.nix
index dab53d765e37..affcb0e8b237 100644
--- a/nixpkgs/pkgs/servers/mail/public-inbox/default.nix
+++ b/nixpkgs/pkgs/servers/mail/public-inbox/default.nix
@@ -1,4 +1,4 @@
-{ buildPerlPackage, lib, fetchurl, fetchpatch, fetchgit, makeWrapper
+{ buildPerlPackage, lib, fetchurl, fetchpatch, makeWrapper
 , DBDSQLite, EmailMIME, IOSocketSSL, IPCRun, Plack, PlackMiddlewareReverseProxy
 , SearchXapian, TimeDate, URI
 , git, highlight, openssl, xapian
diff --git a/nixpkgs/pkgs/servers/mautrix-whatsapp/default.nix b/nixpkgs/pkgs/servers/mautrix-whatsapp/default.nix
index f497ba97e70d..bb72ce1b45fd 100644
--- a/nixpkgs/pkgs/servers/mautrix-whatsapp/default.nix
+++ b/nixpkgs/pkgs/servers/mautrix-whatsapp/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule {
   pname = "mautrix-whatsapp-unstable";
-  version = "2020-01-07";
+  version = "2020-01-12";
 
   src = fetchFromGitHub {
     owner = "tulir";
     repo = "mautrix-whatsapp";
-    rev = "302fae6649f083ae2a1d4431157e6045865f62ad";
-    sha256 = "0rnlbw1xqk9kjc23pmybxdznxylpfxl35wa37lkafymfardjjavb";
+    rev = "39e46833b471b0cf262d4ff57fcd61530b5d2b9e";
+    sha256 = "1r1f52advibb97vrhi2gw0d0scnsvfbmfqizsbpjmgm7ci9jjhcl";
   };
 
   modSha256 = "18bcv7x49bqnzwhafh8fvyv9z2d4j6w0iyqql0alq57hy7h7lxik";
diff --git a/nixpkgs/pkgs/servers/monitoring/grafana/default.nix b/nixpkgs/pkgs/servers/monitoring/grafana/default.nix
index 787c7b1d463a..183bbc73f5db 100644
--- a/nixpkgs/pkgs/servers/monitoring/grafana/default.nix
+++ b/nixpkgs/pkgs/servers/monitoring/grafana/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "grafana";
-  version = "6.5.2";
+  version = "6.5.3";
 
   goPackagePath = "github.com/grafana/grafana";
 
@@ -12,12 +12,12 @@ buildGoPackage rec {
     rev = "v${version}";
     owner = "grafana";
     repo = "grafana";
-    sha256 = "1hplnb8rv2sxai05qf6il5kza08bkhcawvymr2h9lfdsj7p4kbzy";
+    sha256 = "1ks951b3ar1wdpbxn8ak74m8zh02d3lbmk6mphwni68c019ymahi";
   };
 
   srcStatic = fetchurl {
     url = "https://dl.grafana.com/oss/release/grafana-${version}.linux-amd64.tar.gz";
-    sha256 = "1fnj41lp9b53iyjgis5x8k3g5vl73fdrxsdxnf10d4ma95cwb2qa";
+    sha256 = "1gjj0h7kz4lan00ka5kg901l3nyzswnjfr0slqy08bl4svqpizh2";
   };
 
   postPatch = ''
diff --git a/nixpkgs/pkgs/servers/nginx-sso/default.nix b/nixpkgs/pkgs/servers/nginx-sso/default.nix
index b0ed1c973c0d..10a0c99996d7 100644
--- a/nixpkgs/pkgs/servers/nginx-sso/default.nix
+++ b/nixpkgs/pkgs/servers/nginx-sso/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "nginx-sso";
-  version = "0.23.0";
+  version = "0.24.0";
   rev = "v${version}";
 
   goPackagePath = "github.com/Luzifer/nginx-sso";
@@ -11,7 +11,7 @@ buildGoPackage rec {
     inherit rev;
     owner = "Luzifer";
     repo = "nginx-sso";
-    sha256 = "1wfk56xnjbx7cwrryrl3jy8zw7sz8akq55nsxiq2i6h3vafy4yaz";
+    sha256 = "0jkmd1hdr40i1wd3001ixjv1nminsxmwhvnhcgfqcdn5gnaradwn";
   };
 
   postInstall = ''
diff --git a/nixpkgs/pkgs/servers/rippled/default.nix b/nixpkgs/pkgs/servers/rippled/default.nix
index 840f63f3e058..905e776ea362 100644
--- a/nixpkgs/pkgs/servers/rippled/default.nix
+++ b/nixpkgs/pkgs/servers/rippled/default.nix
@@ -1,34 +1,28 @@
-{ stdenv, fetchFromGitHub, fetchgit, fetchurl, git, cmake, pkgconfig
+{ stdenv, fetchFromGitHub, fetchgit, fetchurl, runCommand, git, cmake, pkgconfig
 , openssl, boost, zlib }:
 
 let
-  sqlite3 = fetchurl {
+  sqlite3 = fetchurl rec {
     url = "https://www.sqlite.org/2018/sqlite-amalgamation-3260000.zip";
     sha256 = "0vh9aa5dyvdwsyd8yp88ss300mv2c2m40z79z569lcxa6fqwlpfy";
-  };
-
-  beast = fetchgit {
-    url = "https://github.com/boostorg/beast.git";
-    rev = "2f9a8440c2432d8a196571d6300404cb76314125";
-    sha256 = "1n9ms5cn67b0p0mhldz5psgylds22sm5x22q7knrsf20856vlk5a";
-    fetchSubmodules = false;
-    leaveDotGit = true;
+    passthru.url = url;
   };
 
   docca = fetchgit {
     url = "https://github.com/vinniefalco/docca.git";
     rev = "335dbf9c3613e997ed56d540cc8c5ff2e28cab2d";
-    sha256 = "09cb90k0ygmnlpidybv6nzf6is51i80lnwlvad6ijc3gf1z6i1yh";
-    fetchSubmodules = false;
+    sha256 = "1yisdg7q2p9q9gz0c446796p3ggx9s4d6g8w4j1pjff55655805h";
     leaveDotGit = true;
+    fetchSubmodules = false;
   };
 
-  rocksdb = fetchgit {
+  rocksdb = fetchgit rec {
     url = "https://github.com/facebook/rocksdb.git";
-    rev = "a297643f2e327a8bc7061bfc838fdf11935a2cf2";
-    sha256 = "00z8i4fwr27j9d4ymnls7rcgfvm6xh36a4hy2m2njx4x513pgyzw";
-    fetchSubmodules = false;
+    rev = "v5.17.2";
+    sha256 = "0d9ssggjls1hc4zhng65yg8slqlcw0lr23qr6f39shg42lzr227p";
     leaveDotGit = true;
+    fetchSubmodules = false;
+    postFetch = "cd $out && git tag ${rev}";
   };
 
   lz4 = fetchgit rec {
@@ -51,8 +45,8 @@ let
 
   soci = fetchgit {
     url = "https://github.com/SOCI/soci.git";
-    rev = "3a1f602b3021b925d38828e3ff95f9e7f8887ff7";
-    sha256 = "0lnps42cidlrn43h13b9yc8cs3fwgz7wb6a1kfc9rnw7swkh757f";
+    rev = "04e1870294918d20761736743bb6136314c42dd5";
+    sha256 = "0w3b7qi3bwn8bxh4qbqy6c1fw2bbwh7pxvk8b3qb6h4qgsh6kx89";
     leaveDotGit = true;
     fetchSubmodules = false;
   };
@@ -67,11 +61,11 @@ let
   };
 
   nudb = fetchgit rec {
-    url = "https://github.com/vinniefalco/NuDB.git";
-    rev = "1.0.0";
-    sha256 = "142bxicv25xaw4fmpw8bbblb1grdw30wyj181xl4a5734zw3qgmz";
+    url = "https://github.com/CPPAlliance/NuDB.git";
+    rev = "2.0.1";
+    sha256 = "0h7hmwavrxzj1v547h3z0031ckwphjayfpv1mgcr6q86wm9p5468";
     leaveDotGit = true;
-    fetchSubmodules = false;
+    fetchSubmodules = true; # submodules are needed, rocksdb is dependency
     postFetch = "cd $out && git tag ${rev}";
   };
 
@@ -88,40 +82,54 @@ let
     url = "https://github.com/google/googletest.git";
     rev = "c3bb0ee2a63279a803aaad956b9b26d74bf9e6e2";
     sha256 = "0pj5b6jnrj5lrccz2disr8hklbnzd8hwmrwbfqmvhiwb9q9p0k2k";
-    leaveDotGit = true;
     fetchSubmodules = false;
+    leaveDotGit = true;
   };
 
   google-benchmark = fetchgit {
     url = "https://github.com/google/benchmark.git";
     rev = "5b7683f49e1e9223cf9927b24f6fd3d6bd82e3f8";
     sha256 = "0qg70j47zqnrbszlgrzmxpr4g88kq0gyq6v16bhaggfm83c6mg6i";
-    leaveDotGit = true;
     fetchSubmodules = false;
+    leaveDotGit = true;
   };
+
+  # hack to merge rocksdb revisions from rocksdb and nudb, so build process
+  # will find both
+  rocksdb-merged = runCommand "rocksdb-merged" {
+    buildInputs = [ git ];
+  } ''
+    commit=$(cd ${nudb} && git ls-tree HEAD extras/rocksdb | awk '{ print $3  }')
+    git clone ${rocksdb} $out && cd $out
+    git fetch ${nudb}/extras/rocksdb $commit
+    git checkout $commit
+  '';
 in stdenv.mkDerivation rec {
   pname = "rippled";
-  version = "1.2.1";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "ripple";
     repo = "rippled";
     rev = version;
-    sha256 = "1lm0zzz0hi2sh2f4iqq3scapzdjbxcjgr700fgham9wqgaj2ash5";
+    sha256 = "1z04378bg8lcyrnn7sl3j2zfxbwwy2biasg1d4fbaq4snxg5d1pq";
   };
 
   hardeningDisable = ["format"];
-  cmakeFlags = ["-Dstatic=OFF"];
+  cmakeFlags = [
+    "-Dstatic=OFF"
+    "-DBOOST_LIBRARYDIR=${boost.out}/lib"
+    "-DBOOST_INCLUDEDIR=${boost.dev}/include"
+  ];
 
   nativeBuildInputs = [ pkgconfig cmake git ];
-  buildInputs = [ openssl openssl.dev boost zlib ];
+  buildInputs = [ openssl openssl.dev zlib ];
 
   preConfigure = ''
     export HOME=$PWD
 
-    git config --global url."file://${beast}".insteadOf "https://github.com/vinniefalco/Beast.git"
-    git config --global url."file://${docca}".insteadOf "https://github.com/vinniefalco/docca.git"
-    git config --global url."file://${rocksdb}".insteadOf "https://github.com/facebook/rocksdb.git"
+    git config --global url."file://${docca}".insteadOf "${docca.url}"
+    git config --global url."file://${rocksdb-merged}".insteadOf "${rocksdb.url}"
     git config --global url."file://${lz4}".insteadOf "${lz4.url}"
     git config --global url."file://${libarchive}".insteadOf "${libarchive.url}"
     git config --global url."file://${soci}".insteadOf "${soci.url}"
@@ -131,7 +139,7 @@ in stdenv.mkDerivation rec {
     git config --global url."file://${google-benchmark}".insteadOf "${google-benchmark.url}"
     git config --global url."file://${google-test}".insteadOf "${google-test.url}"
 
-    substituteInPlace CMakeLists.txt --replace "URL https://www.sqlite.org/2018/sqlite-amalgamation-3260000.zip" "URL ${sqlite3}"
+    substituteInPlace Builds/CMake/deps/Sqlite.cmake --replace "URL ${sqlite3.url}" "URL ${sqlite3}"
   '';
 
   doCheck = true;
@@ -141,7 +149,7 @@ in stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Ripple P2P payment network reference server";
-    homepage = https://ripple.com;
+    homepage = https://github.com/ripple/rippled;
     maintainers = with maintainers; [ ehmry offline ];
     license = licenses.isc;
     platforms = [ "x86_64-linux" ];
diff --git a/nixpkgs/pkgs/servers/search/groonga/default.nix b/nixpkgs/pkgs/servers/search/groonga/default.nix
index cfadeac5f076..d610a02ee919 100644
--- a/nixpkgs/pkgs/servers/search/groonga/default.nix
+++ b/nixpkgs/pkgs/servers/search/groonga/default.nix
@@ -7,11 +7,11 @@
 stdenv.mkDerivation rec {
 
   pname = "groonga";
-  version = "9.1.0";
+  version = "9.1.1";
 
   src = fetchurl {
     url    = "https://packages.groonga.org/source/groonga/${pname}-${version}.tar.gz";
-    sha256 = "11mlpnaldb6z438qdb7qjq9dxbh71l6v6lrv69fxka34izpgyhkk";
+    sha256 = "16i5bmypawxjac6g808qgr0z3rvla6g6dr586rmwl7sbq0z2nr82";
   };
 
   buildInputs = with stdenv.lib;
diff --git a/nixpkgs/pkgs/servers/sql/postgresql/ext/timescaledb.nix b/nixpkgs/pkgs/servers/sql/postgresql/ext/timescaledb.nix
index 0427de60aa52..6f0ec04cd752 100644
--- a/nixpkgs/pkgs/servers/sql/postgresql/ext/timescaledb.nix
+++ b/nixpkgs/pkgs/servers/sql/postgresql/ext/timescaledb.nix
@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation rec {
   pname = "timescaledb";
-  version = "1.5.1";
+  version = "1.6.0";
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ postgresql openssl ];
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     owner  = "timescale";
     repo   = "timescaledb";
     rev    = "refs/tags/${version}";
-    sha256 = "1mgmkc42nksfsmjg463v03rj1v8gybwlzzi515gxz6ijx8604w4c";
+    sha256 = "0b42rhkycr4pwwa4fxnmppd3bl0xz7azvlm145rd7warlsr5h0lb";
   };
 
   cmakeFlags = [ "-DSEND_TELEMETRY_DEFAULT=OFF" "-DREGRESS_CHECKS=OFF" ];
diff --git a/nixpkgs/pkgs/servers/tt-rss/theme-feedly/default.nix b/nixpkgs/pkgs/servers/tt-rss/theme-feedly/default.nix
index c35667546c66..8ad511e5b5b8 100644
--- a/nixpkgs/pkgs/servers/tt-rss/theme-feedly/default.nix
+++ b/nixpkgs/pkgs/servers/tt-rss/theme-feedly/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchFromGitHub }: stdenv.mkDerivation rec {
   pname = "tt-rss-theme-feedly";
-  version = "2.0.0";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "levito";
     repo = "tt-rss-feedly-theme";
     rev = "v${version}";
-    sha256 = "024hngwzfdgw5jqppc8vh75jidfqghaccy969hvbhxhgk6j6l8m4";
+    sha256 = "0rl5g664grx3m7yxa14rgnbvnlc3xnn44kzjji5layxww6jd8h2s";
   };
 
   dontBuild = true;
diff --git a/nixpkgs/pkgs/servers/web-apps/matomo/default.nix b/nixpkgs/pkgs/servers/web-apps/matomo/default.nix
index 5c88b8efb4a0..d5f0b7057f07 100644
--- a/nixpkgs/pkgs/servers/web-apps/matomo/default.nix
+++ b/nixpkgs/pkgs/servers/web-apps/matomo/default.nix
@@ -3,8 +3,8 @@
 let
   versions = {
     matomo = {
-      version = "3.13.0";
-      sha256 = "0h4jqibb86zw5l26r927qrbjhba8c79pc4xp3hgpi25p3fjncax8";
+      version = "3.13.1";
+      sha256 = "071m3sw3rrhlccbwdyklcn8rwp4mcnii5m2a7zmgx3rv87i9n2ni";
     };
 
     matomo-beta = {
diff --git a/nixpkgs/pkgs/servers/web-apps/moodle/default.nix b/nixpkgs/pkgs/servers/web-apps/moodle/default.nix
index 2957d296dc4b..3de6005a3cf3 100644
--- a/nixpkgs/pkgs/servers/web-apps/moodle/default.nix
+++ b/nixpkgs/pkgs/servers/web-apps/moodle/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, writeText }:
 
 let
-  version = "3.8";
+  version = "3.8.1";
   stableVersion = builtins.substring 0 2 (builtins.replaceStrings ["."] [""] version);
 in
 
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://download.moodle.org/stable${stableVersion}/${pname}-${version}.tgz";
-    sha256 = "00ssx0drgp1fy062x6alp0x8di7hjn4xc87v8skpy3aznchfxyk9";
+    sha256 = "1xz2wq16blw9p2b6wlrn9lr524gddm5jyac5prka8kp6lrk0v0y1";
   };
 
   phpConfig = writeText "config.php" ''
diff --git a/nixpkgs/pkgs/servers/web-apps/shaarli/material-theme.nix b/nixpkgs/pkgs/servers/web-apps/shaarli/material-theme.nix
index ef0a4331d41d..b0829fce7339 100644
--- a/nixpkgs/pkgs/servers/web-apps/shaarli/material-theme.nix
+++ b/nixpkgs/pkgs/servers/web-apps/shaarli/material-theme.nix
@@ -26,10 +26,13 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
+    # This package has not been updated for the new build process
+    # introduced in 0.10.3 which depends on npm and gulp.
+    broken = true;
     description = "A theme base on Google's Material Design for Shaarli, the superfast delicious clone";
     license = licenses.mit;
     homepage = https://github.com/kalvn/Shaarli-Material;
-    maintainers = with maintainers; [ schneefux ];
+    maintainers = with maintainers; [ ];
     platforms = platforms.all;
   };
 }
diff --git a/nixpkgs/pkgs/servers/zoneminder/default.nix b/nixpkgs/pkgs/servers/zoneminder/default.nix
index 2dcaf44010e7..e536ea0373cf 100644
--- a/nixpkgs/pkgs/servers/zoneminder/default.nix
+++ b/nixpkgs/pkgs/servers/zoneminder/default.nix
@@ -162,6 +162,10 @@ in stdenv.mkDerivation rec {
     "-DZM_CONFIG_DIR=${placeholder "out"}/etc/zoneminder"
     "-DZM_WEB_USER=${user}"
     "-DZM_WEB_GROUP=${user}"
+
+    # Workaround issue in CMakeLists.txt where ZM_CGIDIR set to ${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_LIBEXECDIR}/zoneminder/cgi-bin
+    # But CMAKE_INSTALL_LIBEXECDIR is already an absolute path from cmake setup-hook
+    "-DZM_CGIDIR=${placeholder "out"}/libexec/zoneminder/cgi-bin"
   ];
 
   passthru = { inherit dirName; };