Merge master into staging-next

27 files changed, 137 insertions, 369 deletions

diff --git a/pkgs/development/libraries/SDL2/default.nix b/pkgs/development/libraries/SDL2/default.nix
index 8f1b7d93d002..2909b16d65d8 100644
--- a/pkgs/development/libraries/SDL2/default.nix
+++ b/pkgs/development/libraries/SDL2/default.nix
@@ -9,6 +9,7 @@
 , dbusSupport ? stdenv.isLinux && !stdenv.hostPlatform.isAndroid, dbus
 , udevSupport ? false, udev
 , ibusSupport ? false, ibus
+, fcitxSupport ? false, fcitx
 , pulseaudioSupport ? config.pulseaudio or stdenv.isLinux && !stdenv.hostPlatform.isAndroid
 , libpulseaudio
 , AudioUnit, Cocoa, CoreAudio, CoreServices, ForceFeedback, OpenGL
@@ -55,6 +56,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ libiconv ]
     ++ dlopenBuildInputs
     ++ optional  ibusSupport ibus
+    ++ optional  fcitxSupport fcitx
     ++ optionals stdenv.isDarwin [
       AudioUnit Cocoa CoreAudio CoreServices ForceFeedback OpenGL
       # Needed for NSDefaultRunLoopMode symbols.
diff --git a/pkgs/development/libraries/audio/libbass/default.nix b/pkgs/development/libraries/audio/libbass/default.nix
index 390ca6bb04b7..0e1445ca9ee1 100644
--- a/pkgs/development/libraries/audio/libbass/default.nix
+++ b/pkgs/development/libraries/audio/libbass/default.nix
@@ -11,7 +11,7 @@ let
         x86_64-linux = "x64/libbass.so";
       };
       urlpath = "bass${version}-linux.zip";
-      sha256 = "0alxx7knkvzwwifqrmzavafwq53flja7s1ckaabk6p2ir2f0j5cp";
+      sha256 = "1hjxp1akj8367qlglv5rqpwq2dimfz3bkllwq39abavz4sp8smjz";
     };
 
     bass_fx = {
@@ -21,7 +21,7 @@ let
         x86_64-linux = "x64/libbass_fx.so";
       };
       urlpath = "z/0/bass_fx${version}-linux.zip";
-      sha256 = "0j1cbq88j3vnqf2bibcqnfhciz904w48ldgycyh9d8954hwyg22m";
+      sha256 = "1q0g74z7iyhxqps5b3gnnbic8v2jji1r0mkvais57lsx8y21sbin";
     };
   };
 
diff --git a/pkgs/development/libraries/aws-sdk-cpp/default.nix b/pkgs/development/libraries/aws-sdk-cpp/default.nix
index e53c75e6f74e..f46571587efd 100644
--- a/pkgs/development/libraries/aws-sdk-cpp/default.nix
+++ b/pkgs/development/libraries/aws-sdk-cpp/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   name = "aws-sdk-cpp-${version}";
-  version = "1.7.56";
+  version = "1.7.90";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-sdk-cpp";
     rev = version;
-    sha256 = "0vfw5bqlwm5r0ikziz3jx6yb5v24lwig0m62979zy3ndx36kpb9b";
+    sha256 = "0zpqi612qmm0n53crxiisv0vdif43ymg13kafy6vv43j2wmh66ga";
   };
 
   # FIXME: might be nice to put different APIs in different outputs
diff --git a/pkgs/development/libraries/boost/1.70.nix b/pkgs/development/libraries/boost/1.70.nix
new file mode 100644
index 000000000000..5f7b39c1189e
--- /dev/null
+++ b/pkgs/development/libraries/boost/1.70.nix
@@ -0,0 +1,11 @@
+{ stdenv, callPackage, fetchurl, fetchpatch, ... } @ args:
+
+callPackage ./generic.nix (args // rec {
+  version = "1.70.0";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/boost/boost_1_70_0.tar.bz2";
+    # SHA256 from http://www.boost.org/users/history/version_1_70_0.html
+    sha256 = "430ae8354789de4fd19ee52f3b1f739e1fba576f0aded0897c3c2bc00fb38778";
+  };
+})
diff --git a/pkgs/development/libraries/crypto++/default.nix b/pkgs/development/libraries/crypto++/default.nix
index cbd3e4054159..61a825cd3745 100644
--- a/pkgs/development/libraries/crypto++/default.nix
+++ b/pkgs/development/libraries/crypto++/default.nix
@@ -18,17 +18,11 @@ stdenv.mkDerivation rec {
   ];
 
 
-  configurePhase = let
-    marchflags =
-      if stdenv.isi686 then "-march=i686" else
-      if stdenv.isx86_64 then "-march=nocona -mtune=generic" else
-      "";
-    in
-    ''
+  configurePhase = ''
       sed -i GNUmakefile \
-        -e 's|-march=native|${marchflags} -fPIC|g' \
+        -e 's|-march=native|-fPIC|g' \
         -e '/^CXXFLAGS =/s|-g ||'
-    '';
+  '';
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/fflas-ffpack/default.nix b/pkgs/development/libraries/fflas-ffpack/default.nix
index 2dd58e64585a..a37a11f5cb0c 100644
--- a/pkgs/development/libraries/fflas-ffpack/default.nix
+++ b/pkgs/development/libraries/fflas-ffpack/default.nix
@@ -1,7 +1,6 @@
 { stdenv, fetchFromGitHub, autoreconfHook, givaro, pkgconfig, blas
 , fetchpatch
 , gmpxx
-, optimize ? false # impure
 }:
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
@@ -40,19 +39,17 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--with-blas-libs=-l${blas.linkName}"
     "--with-lapack-libs=-l${blas.linkName}"
-  ] ++ stdenv.lib.optionals (!optimize) [
+  ] ++ stdenv.lib.optionals stdenv.isx86_64 {
     # disable SIMD instructions (which are enabled *when available* by default)
-    "--disable-sse"
-    "--disable-sse2"
-    "--disable-sse3"
-    "--disable-ssse3"
-    "--disable-sse41"
-    "--disable-sse42"
-    "--disable-avx"
-    "--disable-avx2"
-    "--disable-fma"
-    "--disable-fma4"
-  ];
+    "default"        = [ "--disable-sse3" "--disable-ssse3" "--disable-sse41" "--disable-sse42" "--disable-avx" "--disable-avx2" "--disable-fma" "--disable-fma4" ];
+    "westmere"       = [                                                                        "--disable-avx" "--disable-avx2" "--disable-fma" "--disable-fma4" ];
+    "sandybridge"    = [                                                                                        "--disable-avx2" "--disable-fma" "--disable-fma4" ];
+    "ivybridge"      = [                                                                                        "--disable-avx2" "--disable-fma" "--disable-fma4" ];
+    "haswell"        = [                                                                                                                         "--disable-fma4" ];
+    "broadwell"      = [                                                                                                                         "--disable-fma4" ];
+    "skylake"        = [                                                                                                                         "--disable-fma4" ];
+    "skylake-avx512" = [                                                                                                                         "--disable-fma4" ];
+  }.${stdenv.hostPlatform.platform.gcc.arch or "default"};
 
   doCheck = true;
 
diff --git a/pkgs/development/libraries/freetds/default.nix b/pkgs/development/libraries/freetds/default.nix
index 5c70df02cdc8..d8bb9e8e85b0 100644
--- a/pkgs/development/libraries/freetds/default.nix
+++ b/pkgs/development/libraries/freetds/default.nix
@@ -8,11 +8,11 @@ assert odbcSupport -> unixODBC != null;
 
 stdenv.mkDerivation rec {
   name = "freetds-${version}";
-  version = "1.00.111";
+  version = "1.1.6";
 
   src = fetchurl {
     url    = "http://www.freetds.org/files/stable/${name}.tar.bz2";
-    sha256 = "17vn95bjiib3ia3h64b7akcmgmj6wfjx7w538iylhf9whqvssi4j";
+    sha256 = "18rry59npbhxpzjb0l3ib7zlnlzj43srb5adcm65wyklklsh0gn2";
   };
 
   buildInputs = [
diff --git a/pkgs/development/libraries/givaro/default.nix b/pkgs/development/libraries/givaro/default.nix
index 0773daa2d09a..bfbce57b0a6a 100644
--- a/pkgs/development/libraries/givaro/default.nix
+++ b/pkgs/development/libraries/givaro/default.nix
@@ -1,6 +1,4 @@
-{ stdenv, fetchFromGitHub, automake, autoconf, libtool, autoreconfHook, gmpxx
-, optimize ? false # impure
-}:
+{ stdenv, fetchFromGitHub, automake, autoconf, libtool, autoreconfHook, gmpxx }:
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "givaro";
@@ -19,19 +17,17 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     "--disable-optimization"
-  ] ++ stdenv.lib.optionals (!optimize) [
+  ] ++ stdenv.lib.optionals stdenv.isx86_64 {
     # disable SIMD instructions (which are enabled *when available* by default)
-    "--disable-sse"
-    "--disable-sse2"
-    "--disable-sse3"
-    "--disable-ssse3"
-    "--disable-sse41"
-    "--disable-sse42"
-    "--disable-avx"
-    "--disable-avx2"
-    "--disable-fma"
-    "--disable-fma4"
-  ];
+    "default"        = [ "--disable-sse3" "--disable-ssse3" "--disable-sse41" "--disable-sse42" "--disable-avx" "--disable-avx2" "--disable-fma" "--disable-fma4" ];
+    "westmere"       = [                                                                        "--disable-avx" "--disable-avx2" "--disable-fma" "--disable-fma4" ];
+    "sandybridge"    = [                                                                                        "--disable-avx2" "--disable-fma" "--disable-fma4" ];
+    "ivybridge"      = [                                                                                        "--disable-avx2" "--disable-fma" "--disable-fma4" ];
+    "haswell"        = [                                                                                                                         "--disable-fma4" ];
+    "broadwell"      = [                                                                                                                         "--disable-fma4" ];
+    "skylake"        = [                                                                                                                         "--disable-fma4" ];
+    "skylake-avx512" = [                                                                                                                         "--disable-fma4" ];
+  }.${stdenv.hostPlatform.platform.gcc.arch or "default"};
 
   # On darwin, tests are linked to dylib in the nix store, so we need to make
   # sure tests run after installPhase.
diff --git a/pkgs/development/libraries/gsl/default.nix b/pkgs/development/libraries/gsl/default.nix
index 9fd3f8a7a998..c8846509d004 100644
--- a/pkgs/development/libraries/gsl/default.nix
+++ b/pkgs/development/libraries/gsl/default.nix
@@ -8,10 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1395y9hlhqadn5g9j8q22224fds5sd92jxi9czfavjj24myasq04";
   };
 
-  patches = [
-    # ToDo: there might be more impurities than FMA support check
-    ./disable-fma.patch # https://lists.gnu.org/archive/html/bug-gsl/2011-11/msg00019.html
-  ];
+  # do not let -march=skylake to enable FMA (https://lists.gnu.org/archive/html/bug-gsl/2011-11/msg00019.html)
+  NIX_CFLAGS_COMPILE = stdenv.lib.optional stdenv.isx86_64 "-mno-fma";
 
   # https://lists.gnu.org/archive/html/bug-gsl/2015-11/msg00012.html
   doCheck = stdenv.hostPlatform.system != "i686-linux" && stdenv.hostPlatform.system != "aarch64-linux";
diff --git a/pkgs/development/libraries/gsl/disable-fma.patch b/pkgs/development/libraries/gsl/disable-fma.patch
deleted file mode 100644
index bb1eda9ccccd..000000000000
--- a/pkgs/development/libraries/gsl/disable-fma.patch
+++ /dev/null
@@ -1,32 +0,0 @@
---- a/configure.ac        2011-09-22 16:13:22 +0000
-+++ b/configure.ac        2011-11-26 23:55:24 +0000
-@@ -381,6 +381,28 @@
- AC_SUBST(HAVE_DARWIN_IEEE_INTERFACE)
- AC_SUBST(HAVE_DARWIN86_IEEE_INTERFACE)
- 
-+dnl check for compiler flags to disable use of FMA
-+save_cflags="$CFLAGS"
-+AC_CACHE_CHECK([for compiler flags to disable use of FMA], ac_cv_c_fma_flags,
-+[
-+if test X"$GCC" = Xyes; then
-+    fma_flags='-ffp-contract=off'
-+else
-+    fma_flags=
-+fi
-+if test X"$fma_flags" != X; then
-+  CFLAGS="$fma_flags $CFLAGS"
-+  AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[]], [[int foo;]])],[ac_cv_c_fma_flags="$fma_flags"],[ac_cv_c_fma_flags="none"])
-+else
-+  ac_cv_c_fma_flags="none"
-+fi])
-+
-+if test "$ac_cv_c_fma_flags" != "none" ; then
-+   CFLAGS="$ac_cv_c_fma_flags $save_cflags"
-+else
-+   CFLAGS="$save_cflags"
-+fi
-+
- dnl Check for IEEE control flags
- 
- save_cflags="$CFLAGS"
-
diff --git a/pkgs/development/libraries/gsl/gsl-1_16.nix b/pkgs/development/libraries/gsl/gsl-1_16.nix
index 69fe1b0db554..e5772c8772ec 100644
--- a/pkgs/development/libraries/gsl/gsl-1_16.nix
+++ b/pkgs/development/libraries/gsl/gsl-1_16.nix
@@ -8,9 +8,10 @@ stdenv.mkDerivation rec {
     sha256 = "0lrgipi0z6559jqh82yx8n4xgnxkhzj46v96dl77hahdp58jzg3k";
   };
 
+  # do not let -march=skylake to enable FMA (https://lists.gnu.org/archive/html/bug-gsl/2011-11/msg00019.html)
+  NIX_CFLAGS_COMPILE = stdenv.lib.optional stdenv.isx86_64 "-mno-fma";
+
   patches = [
-    # ToDo: there might be more impurities than FMA support check
-    ./disable-fma.patch # https://lists.gnu.org/archive/html/bug-gsl/2011-11/msg00019.html
     (fetchpatch {
       name = "bug-39055.patch";
       url = "https://git.savannah.gnu.org/cgit/gsl.git/patch/?id=9cc12d";
diff --git a/pkgs/development/libraries/libbap/default.nix b/pkgs/development/libraries/libbap/default.nix
index 5153b63e91c5..2a129bc648f0 100644
--- a/pkgs/development/libraries/libbap/default.nix
+++ b/pkgs/development/libraries/libbap/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   name = "libbap-${version}";
-  version = "master-2018-03-01";
+  version = "master-2019-04-05";
 
   src = fetchFromGitHub {
     owner = "BinaryAnalysisPlatform";
     repo = "bap-bindings";
-    rev = "bd125c379a784d4265c2ddcf1f6e34bde2e568d4";
-    sha256 = "0dp90djyjc262v1b1cw5irp424a8394y86fyprdk8z741wg56m3v";
+    rev = "1a89db62f1239a15d310b400f74e151c0a64f37f";
+    sha256 = "0mln9adjgxzhjmjayq06ahgiay4vj5kmnzdxqz3nsik9h3npycd6";
   };
 
   nativeBuildInputs = [ autoreconfHook which ];
diff --git a/pkgs/development/libraries/libiio/default.nix b/pkgs/development/libraries/libiio/default.nix
index ec025d31ce3f..ee8029966dc2 100644
--- a/pkgs/development/libraries/libiio/default.nix
+++ b/pkgs/development/libraries/libiio/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   name = "libiio-${version}";
-  version = "0.17";
+  version = "0.18";
 
   src = fetchFromGitHub {
     owner  = "analogdevicesinc";
     repo   = "libiio";
     rev    = "refs/tags/v${version}";
-    sha256 = "15lghy0zlq667abs1ggbvmb1qiw7vzhhzkw8dm9vzix4ffma2igg";
+    sha256 = "1cmg3ipam101iy9yncwz2y48idaqaw4fg7i9i4c8vfjisfcycnkk";
   };
 
   outputs = [ "out" "lib" "dev" "python" ];
diff --git a/pkgs/development/libraries/liblcf/default.nix b/pkgs/development/libraries/liblcf/default.nix
index 8154a74aef5d..313780a9f0f0 100644
--- a/pkgs/development/libraries/liblcf/default.nix
+++ b/pkgs/development/libraries/liblcf/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "liblcf-${version}";
-  version = "0.5.4";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "EasyRPG";
     repo = "liblcf";
     rev = version;
-    sha256 = "1842hns0rbjncrhwjj7fzg9b3n47adn5jp4dg2zz34gfah3q4ig8";
+    sha256 = "1nhwwb32c3x0y82s0w93k0xz8h6xsd0sb4r1a0my8fd8p5rsnwbi";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
diff --git a/pkgs/development/libraries/libseccomp/default.nix b/pkgs/development/libraries/libseccomp/default.nix
index 54ca09a7b0db..6b38bcf2c778 100644
--- a/pkgs/development/libraries/libseccomp/default.nix
+++ b/pkgs/development/libraries/libseccomp/default.nix
@@ -28,7 +28,11 @@ stdenv.mkDerivation rec {
     homepage    = "https://github.com/seccomp/libseccomp";
     license     = licenses.lgpl21;
     platforms   = platforms.linux;
-    badPlatforms = platforms.riscv;
+    badPlatforms = [
+      "alpha-linux"
+      "riscv64-linux" "riscv32-linux"
+      "sparc-linux" "sparc64-linux"
+    ];
     maintainers = with maintainers; [ thoughtpolice ];
   };
 }
diff --git a/pkgs/development/libraries/libusb1/default.nix b/pkgs/development/libraries/libusb1/default.nix
index ac5c38a34f11..0620163bb320 100644
--- a/pkgs/development/libraries/libusb1/default.nix
+++ b/pkgs/development/libraries/libusb1/default.nix
@@ -1,6 +1,6 @@
-{ stdenv, fetchurl, pkgconfig, systemd ? null, libobjc, IOKit }:
+{ stdenv, fetchurl, pkgconfig, systemd ? null, libobjc, IOKit, withStatic ? false }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (rec {
   name = "libusb-1.0.22";
 
   src = fetchurl {
@@ -32,4 +32,8 @@ stdenv.mkDerivation rec {
     license = licenses.lgpl21Plus;
     maintainers = [ ];
   };
-}
+} // stdenv.lib.optionalAttrs withStatic {
+  # Carefully added here to avoid a mass rebuild.
+  # Inline this the next time this package changes.
+  dontDisableStatic = withStatic;
+})
diff --git a/pkgs/development/libraries/libwmf/CVE-2006-3376.patch b/pkgs/development/libraries/libwmf/CVE-2006-3376.patch
deleted file mode 100644
index 4c7519d9c101..000000000000
--- a/pkgs/development/libraries/libwmf/CVE-2006-3376.patch
+++ /dev/null
@@ -1,28 +0,0 @@
---- libwmf-0.2.8.4.orig/src/player.c
-+++ libwmf-0.2.8.4/src/player.c
-@@ -23,6 +23,7 @@
- 
- #include <stdio.h>
- #include <stdlib.h>
-+#include <stdint.h>
- #include <string.h>
- #include <math.h>
- 
-@@ -132,8 +133,14 @@
- 		}
- 	}
- 
--/*	P->Parameters = (unsigned char*) wmf_malloc (API,(MAX_REC_SIZE(API)-3) * 2 * sizeof (unsigned char));
-- */	P->Parameters = (unsigned char*) wmf_malloc (API,(MAX_REC_SIZE(API)  ) * 2 * sizeof (unsigned char));
-+	if (MAX_REC_SIZE(API) > UINT32_MAX / 2)
-+	{
-+		API->err = wmf_E_InsMem;
-+		WMF_DEBUG (API,"bailing...");
-+		return (API->err);
-+	}
-+
-+ 	P->Parameters = (unsigned char*) wmf_malloc (API,(MAX_REC_SIZE(API)  ) * 2 * sizeof (unsigned char));
- 
- 	if (ERR (API))
- 	{	WMF_DEBUG (API,"bailing...");
-
diff --git a/pkgs/development/libraries/libwmf/CVE-2009-1364.patch b/pkgs/development/libraries/libwmf/CVE-2009-1364.patch
deleted file mode 100644
index e2a4501662c6..000000000000
--- a/pkgs/development/libraries/libwmf/CVE-2009-1364.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- libwmf-0.2.8.4.orig/src/extra/gd/gd_clip.c
-+++ libwmf-0.2.8.4/src/extra/gd/gd_clip.c
-@@ -70,6 +70,7 @@
- 	{	more = gdRealloc (im->clip->list,(im->clip->max + 8) * sizeof (gdClipRectangle));
- 		if (more == 0) return;
- 		im->clip->max += 8;
-+		im->clip->list = more;
- 	}
- 	im->clip->list[im->clip->count] = (*rect);
- 	im->clip->count++;
-
diff --git a/pkgs/development/libraries/libwmf/CVE-2015-0848+4588+4695+4696.patch b/pkgs/development/libraries/libwmf/CVE-2015-0848+4588+4695+4696.patch
deleted file mode 100644
index 54d47800298b..000000000000
--- a/pkgs/development/libraries/libwmf/CVE-2015-0848+4588+4695+4696.patch
+++ /dev/null
@@ -1,186 +0,0 @@
---- libwmf-0.2.8.4.orig/src/player/meta.h
-+++ libwmf-0.2.8.4/src/player/meta.h
-@@ -1565,7 +1565,7 @@ static int meta_rgn_create (wmfAPI* API,
- 	objects = P->objects;
- 
- 	i = 0;
--	while (objects[i].type && (i < NUM_OBJECTS (API))) i++;
-+	while ((i < NUM_OBJECTS (API)) && objects[i].type) i++;
- 
- 	if (i == NUM_OBJECTS (API))
- 	{	WMF_ERROR (API,"Object out of range!");
-@@ -2142,7 +2142,7 @@ static int meta_dib_brush (wmfAPI* API,w
- 	objects = P->objects;
- 
- 	i = 0;
--	while (objects[i].type && (i < NUM_OBJECTS (API))) i++;
-+	while ((i < NUM_OBJECTS (API)) && objects[i].type) i++;
- 
- 	if (i == NUM_OBJECTS (API))
- 	{	WMF_ERROR (API,"Object out of range!");
-@@ -2593,9 +2593,10 @@ static int meta_dc_restore (wmfAPI* API,
- 		polyrect.BR = 0;
- 
- 		polyrect.count = 0;
-+	
-+		if (FR->region_clip) FR->region_clip (API,&polyrect);
- 	}
- 
--	if (FR->region_clip) FR->region_clip (API,&polyrect);
- 
- 	return (changed);
- }
-@@ -3067,7 +3068,7 @@ static int meta_pen_create (wmfAPI* API,
- 	objects = P->objects;
- 
- 	i = 0;
--	while (objects[i].type && (i < NUM_OBJECTS (API))) i++;
-+	while ((i < NUM_OBJECTS (API)) && objects[i].type) i++;
- 
- 	if (i == NUM_OBJECTS (API))
- 	{	WMF_ERROR (API,"Object out of range!");
-@@ -3181,7 +3182,7 @@ static int meta_brush_create (wmfAPI* AP
- 	objects = P->objects;
- 
- 	i = 0;
--	while (objects[i].type && (i < NUM_OBJECTS (API))) i++;
-+	while ((i < NUM_OBJECTS (API)) && objects[i].type) i++;
- 
- 	if (i == NUM_OBJECTS (API))
- 	{	WMF_ERROR (API,"Object out of range!");
-@@ -3288,7 +3289,7 @@ static int meta_font_create (wmfAPI* API
- 	objects = P->objects;
- 
- 	i = 0;
--	while (objects[i].type && (i < NUM_OBJECTS (API))) i++;
-+	while ((i < NUM_OBJECTS (API)) && objects[i].type) i++;
- 
- 	if (i == NUM_OBJECTS (API))
- 	{	WMF_ERROR (API,"Object out of range!");
-@@ -3396,7 +3397,7 @@ static int meta_palette_create (wmfAPI*
- 	objects = P->objects;
- 
- 	i = 0;
--	while (objects[i].type && (i < NUM_OBJECTS (API))) i++;
-+	while ((i < NUM_OBJECTS (API)) && objects[i].type) i++;
- 
- 	if (i == NUM_OBJECTS (API))
- 	{	WMF_ERROR (API,"Object out of range!");
---- libwmf-0.2.8.4.orig/src/ipa/ipa.h
-+++ libwmf-0.2.8.4/src/ipa/ipa.h
-@@ -48,7 +48,7 @@ static int            ReadBlobByte (BMPS
- static unsigned short ReadBlobLSBShort (BMPSource*);
- static unsigned long  ReadBlobLSBLong (BMPSource*);
- static long           TellBlob (BMPSource*);
--static void           DecodeImage (wmfAPI*,wmfBMP*,BMPSource*,unsigned int,unsigned char*);
-+static int            DecodeImage (wmfAPI*,wmfBMP*,BMPSource*,unsigned int,unsigned char*);
- static void           ReadBMPImage (wmfAPI*,wmfBMP*,BMPSource*);
- static int            ExtractColor (wmfAPI*,wmfBMP*,wmfRGB*,unsigned int,unsigned int);
- static void           SetColor (wmfAPI*,wmfBMP*,wmfRGB*,unsigned char,unsigned int,unsigned int);
---- libwmf-0.2.8.4.orig/src/ipa/ipa/bmp.h
-+++ libwmf-0.2.8.4/src/ipa/ipa/bmp.h
-@@ -859,7 +859,7 @@ static long TellBlob (BMPSource* src)
- %
- %
- */
--static void DecodeImage (wmfAPI* API,wmfBMP* bmp,BMPSource* src,unsigned int compression,unsigned char* pixels)
-+static int DecodeImage (wmfAPI* API,wmfBMP* bmp,BMPSource* src,unsigned int compression,unsigned char* pixels)
- {	int byte;
- 	int count;
- 	int i;
-@@ -870,12 +870,14 @@ static void DecodeImage (wmfAPI* API,wmf
- 	U32 u;
- 
- 	unsigned char* q;
-+	unsigned char* end;
- 
- 	for (u = 0; u < ((U32) bmp->width * (U32) bmp->height); u++) pixels[u] = 0;
- 
- 	byte = 0;
- 	x = 0;
- 	q = pixels;
-+	end = pixels + bmp->width * bmp->height;
- 
- 	for (y = 0; y < bmp->height; )
- 	{	count = ReadBlobByte (src);
-@@ -884,7 +886,10 @@ static void DecodeImage (wmfAPI* API,wmf
- 		{	/* Encoded mode. */
- 			byte = ReadBlobByte (src);
- 			for (i = 0; i < count; i++)
--			{	if (compression == 1)
-+			{	
-+				if (q == end)
-+					return 0;
-+			 	if (compression == 1)
- 				{	(*(q++)) = (unsigned char) byte;
- 				}
- 				else
-@@ -896,13 +901,15 @@ static void DecodeImage (wmfAPI* API,wmf
- 		else
- 		{	/* Escape mode. */
- 			count = ReadBlobByte (src);
--			if (count == 0x01) return;
-+			if (count == 0x01) return 1;
- 			switch (count)
- 			{
- 			case 0x00:
- 			 {	/* End of line. */
- 				x = 0;
- 				y++;
-+				if (y >= bmp->height)
-+					return 0;
- 				q = pixels + y * bmp->width;
- 				break;
- 			 }
-@@ -910,13 +917,20 @@ static void DecodeImage (wmfAPI* API,wmf
- 			 {	/* Delta mode. */
- 				x += ReadBlobByte (src);
- 				y += ReadBlobByte (src);
-+				if (y >= bmp->height)
-+					return 0;
-+				if (x >= bmp->width)
-+					return 0;
- 				q = pixels + y * bmp->width + x;
- 				break;
- 			 }
- 			default:
- 			 {	/* Absolute mode. */
- 				for (i = 0; i < count; i++)
--				{	if (compression == 1)
-+				{
-+					if (q == end)
-+						return 0;
-+					if (compression == 1)
- 					{	(*(q++)) = ReadBlobByte (src);
- 					}
- 					else
-@@ -943,7 +957,7 @@ static void DecodeImage (wmfAPI* API,wmf
- 	byte = ReadBlobByte (src);  /* end of line */
- 	byte = ReadBlobByte (src);
- 
--	return;
-+	return 1;
- }
- 
- /*
-@@ -1143,8 +1157,18 @@ static void ReadBMPImage (wmfAPI* API,wm
- 		}
- 	}
- 	else
--	{	/* Convert run-length encoded raster pixels. */
--		DecodeImage (API,bmp,src,(unsigned int) bmp_info.compression,data->image);
-+	{
-+		if (bmp_info.bits_per_pixel == 8)	/* Convert run-length encoded raster pixels. */
-+		{
-+			if (!DecodeImage (API,bmp,src,(unsigned int) bmp_info.compression,data->image))
-+			{	WMF_ERROR (API,"corrupt bmp");
-+				API->err = wmf_E_BadFormat;
-+			}
-+		}
-+		else
-+		{	WMF_ERROR (API,"Unexpected pixel depth");
-+			API->err = wmf_E_BadFormat;
-+		}
- 	}
- 
- 	if (ERR (API))
diff --git a/pkgs/development/libraries/libwmf/default.nix b/pkgs/development/libraries/libwmf/default.nix
index bf685862adf1..e7aa5f7ecc9f 100644
--- a/pkgs/development/libraries/libwmf/default.nix
+++ b/pkgs/development/libraries/libwmf/default.nix
@@ -1,31 +1,27 @@
-{ stdenv, fetchurl, fetchpatch, zlib, imagemagick, libpng, pkgconfig, glib
-, freetype, libjpeg, libxml2 }:
+{ stdenv, fetchFromGitHub, pkgconfig
+, freetype, glib, imagemagick, libjpeg, libpng, libxml2, zlib
+}:
 
-stdenv.mkDerivation {
-  name = "libwmf-0.2.8.4";
+stdenv.mkDerivation rec {
+  pname = "libwmf";
+  version = "0.2.12";
 
-  src = fetchurl {
-    url = mirror://sourceforge/wvware/libwmf-0.2.8.4.tar.gz;
-    sha256 = "1y3wba4q8pl7kr51212jwrsz1x6nslsx1gsjml1x0i8549lmqd2v";
+  src = fetchFromGitHub {
+    owner = "caolanm";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0i2w5hg8mbgmgabxyd48qp1gx2mhk33hgr3jqvg72k0nhkd2jhf6";
   };
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ zlib imagemagick libpng glib freetype libjpeg libxml2 ];
-
-  patches = [
-    ./CVE-2006-3376.patch ./CVE-2009-1364.patch
-    ./CVE-2015-0848+4588+4695+4696.patch
-    (fetchpatch {
-      name = "libwmf-0.2.8.4-CVE-2016-9011-debian.patch";
-      url = "https://bugs.debian.org/cgi-bin/bugreport.cgi?att=1;bug=842090;filename=libwmf-0.2.8.4-CVE-2016-9011-debian.patch;msg=10";
-      sha256 = "15vnqrj1dlvn0g8ccrxj2r2cyb1rv0qf0kfangxfgsi5h8is0c2b";
-    })
-  ];
+  enableParallelBuilding = true;
 
   meta = with stdenv.lib; {
     description = "WMF library from wvWare";
-    homepage = http://wvware.sourceforge.net/libwmf.html;
-    license = licenses.gpl2;
+    homepage = "http://wvware.sourceforge.net/libwmf.html";
+    downloadPage = "https://github.com/caolanm/libwmf/releases";
+    license = licenses.gpl2Plus;
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/linbox/default.nix b/pkgs/development/libraries/linbox/default.nix
index a9a649e2de76..ef2dbb10fba1 100644
--- a/pkgs/development/libraries/linbox/default.nix
+++ b/pkgs/development/libraries/linbox/default.nix
@@ -7,7 +7,6 @@
 , blas
 , fflas-ffpack
 , gmpxx
-, optimize ? false # impure
 , withSage ? false # sage support
 }:
 stdenv.mkDerivation rec {
@@ -37,19 +36,18 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--with-blas-libs=-l${blas.linkName}"
     "--disable-optimization"
-  ] ++ stdenv.lib.optionals (!optimize) [
+  ] ++ stdenv.lib.optionals stdenv.isx86_64 {
     # disable SIMD instructions (which are enabled *when available* by default)
-    "--disable-sse"
-    "--disable-sse2"
-    "--disable-sse3"
-    "--disable-ssse3"
-    "--disable-sse41"
-    "--disable-sse42"
-    "--disable-avx"
-    "--disable-avx2"
-    "--disable-fma"
-    "--disable-fma4"
-  ] ++ stdenv.lib.optionals withSage [
+    "default"        = [ "--disable-sse3" "--disable-ssse3" "--disable-sse41" "--disable-sse42" "--disable-avx" "--disable-avx2" "--disable-fma" "--disable-fma4" ];
+    "westmere"       = [                                                                        "--disable-avx" "--disable-avx2" "--disable-fma" "--disable-fma4" ];
+    "sandybridge"    = [                                                                                        "--disable-avx2" "--disable-fma" "--disable-fma4" ];
+    "ivybridge"      = [                                                                                        "--disable-avx2" "--disable-fma" "--disable-fma4" ];
+    "haswell"        = [                                                                                                                         "--disable-fma4" ];
+    "broadwell"      = [                                                                                                                         "--disable-fma4" ];
+    "skylake"        = [                                                                                                                         "--disable-fma4" ];
+    "skylake-avx512" = [                                                                                                                         "--disable-fma4" ];
+  }.${stdenv.hostPlatform.platform.gcc.arch or "default"}
+  ++ stdenv.lib.optionals withSage [
     "--enable-sage"
   ];
 
diff --git a/pkgs/development/libraries/mbedtls/default.nix b/pkgs/development/libraries/mbedtls/default.nix
index 7d070364a63c..a72d5a825c6a 100644
--- a/pkgs/development/libraries/mbedtls/default.nix
+++ b/pkgs/development/libraries/mbedtls/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   name = "mbedtls-${version}";
-  version = "2.16.0";
+  version = "2.17.0";
 
   src = fetchFromGitHub {
     owner = "ARMmbed";
     repo = "mbedtls";
     rev = name;
-    sha256 = "14gw3rga9qr6j8ssfjy7k4l8spz37gamqxh9qcwas7w48303897l";
+    sha256 = "1mk3xv61wvqqrzd6jnrz8csyfnwwwwpjzywj3fsfy99p51d7wqgw";
   };
 
   nativeBuildInputs = [ cmake ninja perl python ];
diff --git a/pkgs/development/libraries/qt-5/modules/qtbase.nix b/pkgs/development/libraries/qt-5/modules/qtbase.nix
index 9ae7b274917c..bd92d9bc27cc 100644
--- a/pkgs/development/libraries/qt-5/modules/qtbase.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtbase.nix
@@ -249,15 +249,18 @@ stdenv.mkDerivation {
     ++ (
       if (!stdenv.hostPlatform.isx86_64)
       then [ "-no-sse2" ]
-      else lib.optional (compareVersion "5.9.0" >= 0) [ "-sse2" ]
+      else lib.optionals (compareVersion "5.9.0" >= 0) {
+        "default"        = [ "-sse2" "-no-sse3" "-no-ssse3" "-no-sse4.1" "-no-sse4.2" "-no-avx" "-no-avx2" ];
+        "westmere"       = [ "-sse2"    "-sse3"    "-ssse3"    "-sse4.1"    "-sse4.2" "-no-avx" "-no-avx2" ];
+        "sandybridge"    = [ "-sse2"    "-sse3"    "-ssse3"    "-sse4.1"    "-sse4.2"    "-avx" "-no-avx2" ];
+        "ivybridge"      = [ "-sse2"    "-sse3"    "-ssse3"    "-sse4.1"    "-sse4.2"    "-avx" "-no-avx2" ];
+        "haswell"        = [ "-sse2"    "-sse3"    "-ssse3"    "-sse4.1"    "-sse4.2"    "-avx"    "-avx2" ];
+        "broadwell"      = [ "-sse2"    "-sse3"    "-ssse3"    "-sse4.1"    "-sse4.2"    "-avx"    "-avx2" ];
+        "skylake"        = [ "-sse2"    "-sse3"    "-ssse3"    "-sse4.1"    "-sse4.2"    "-avx"    "-avx2" ];
+        "skylake-avx512" = [ "-sse2"    "-sse3"    "-ssse3"    "-sse4.1"    "-sse4.2"    "-avx"    "-avx2" ];
+      }.${stdenv.hostPlatform.platform.gcc.arch or "default"}
     )
     ++ [
-      "-no-sse3"
-      "-no-ssse3"
-      "-no-sse4.1"
-      "-no-sse4.2"
-      "-no-avx"
-      "-no-avx2"
       "-no-mips_dsp"
       "-no-mips_dspr2"
     ]
diff --git a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
index fb838283b1b1..86897cb3f16f 100644
--- a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
@@ -102,6 +102,25 @@ EOF
       --replace 'libs = [ "sandbox" ]' 'libs = [ "/usr/lib/libsandbox.1.dylib" ]'
     '');
 
+  NIX_CFLAGS_COMPILE =
+  # it fails when compiled with -march=sandybridge https://github.com/NixOS/nixpkgs/pull/59148#discussion_r276696940
+  # TODO: investigate and fix properly
+    lib.optionals (stdenv.hostPlatform.platform.gcc.arch or "" == "sandybridge") [ "-march=westmere" ] ++
+    lib.optionals stdenv.isDarwin [
+      "-DMAC_OS_X_VERSION_MAX_ALLOWED=MAC_OS_X_VERSION_10_10"
+      "-DMAC_OS_X_VERSION_MIN_REQUIRED=MAC_OS_X_VERSION_10_10"
+
+      #
+      # Prevent errors like
+      # /nix/store/xxx-apple-framework-CoreData/Library/Frameworks/CoreData.framework/Headers/NSEntityDescription.h:51:7:
+      # error: pointer to non-const type 'id' with no explicit ownership
+      #     id** _kvcPropertyAccessors;
+      #
+      # TODO remove when new Apple SDK is in
+      #
+      "-fno-objc-arc"
+    ];
+
   preConfigure = ''
     export NINJAFLAGS=-j$NIX_BUILD_CORES
 
diff --git a/pkgs/development/libraries/utf8proc/default.nix b/pkgs/development/libraries/utf8proc/default.nix
index 5b05f9ffef4a..72f6f57553fb 100644
--- a/pkgs/development/libraries/utf8proc/default.nix
+++ b/pkgs/development/libraries/utf8proc/default.nix
@@ -1,19 +1,21 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
-  name = "utf8proc-${version}";
-  version = "2.2.0";
+  pname = "utf8proc";
+  version = "2.3.0";
 
-  src = fetchurl {
-    url = "https://github.com/JuliaLang/utf8proc/archive/v${version}.tar.gz";
-    sha256 = "1gsxxp7vk36z1g5mg19kq10j35dks5f9slsab2xfazh5vgdx33rz";
+  src = fetchFromGitHub {
+    owner = "JuliaStrings";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1jhjl7nw6262ks5zrk447qmh6z2r5rrnnrm742dk33d7031g3s55";
   };
 
   makeFlags = [ "prefix=$(out)" ];
 
   meta = with stdenv.lib; {
     description = "A clean C library for processing UTF-8 Unicode data";
-    homepage = https://julialang.org/utf8proc;
+    homepage = "https://juliastrings.github.io/utf8proc/";
     license = licenses.mit;
     platforms = platforms.all;
     maintainers = [ maintainers.ftrvxmtrx ];
diff --git a/pkgs/development/libraries/vte/default.nix b/pkgs/development/libraries/vte/default.nix
index 7089da984a97..33262325674e 100644
--- a/pkgs/development/libraries/vte/default.nix
+++ b/pkgs/development/libraries/vte/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "vte";
-  version = "0.56.1";
+  version = "0.56.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0z6w4vrz51bjnvk773j4pnrqfmkvaaa58yc6yi3jwcx90b68xyh2";
+    sha256 = "0dyj2dqbzap37dvjax6vy2kwfqsw9d1hrc4ji33lha3mk1q3b5bf";
   };
 
   passthru = {
diff --git a/pkgs/development/libraries/xmlsec/default.nix b/pkgs/development/libraries/xmlsec/default.nix
index 94f1d187267e..b19bf000b0d4 100644
--- a/pkgs/development/libraries/xmlsec/default.nix
+++ b/pkgs/development/libraries/xmlsec/default.nix
@@ -2,14 +2,14 @@
 , openssl, nss, makeWrapper }:
 
 let
-  version = "1.2.26";
+  version = "1.2.28";
 in
 stdenv.mkDerivation rec {
   name = "xmlsec-${version}";
 
   src = fetchurl {
     url = "https://www.aleksey.com/xmlsec/download/xmlsec1-${version}.tar.gz";
-    sha256 = "0l1dk344rn3j2vnj13daz72xd8j1msvzhg82n2il5ji0qz4pd0ld";
+    sha256 = "1m12caglhyx08g8lh2sl3nkldlpryzdx2d572q73y3m33s0w9vhk";
   };
 
   outputs = [ "out" "dev" ];