about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--lib/systems/examples.nix4
-rw-r--r--lib/systems/parse.nix3
-rw-r--r--maintainers/maintainer-list.nix9
-rw-r--r--nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix12
-rw-r--r--nixos/modules/installer/cd-dvd/installation-cd-graphical-gnome.nix2
-rw-r--r--nixos/modules/installer/cd-dvd/installation-cd-graphical-kde.nix9
-rw-r--r--nixos/modules/profiles/graphical.nix1
-rw-r--r--nixos/modules/services/x11/desktop-managers/gnome3.nix7
-rw-r--r--nixos/tests/xmonad.nix32
-rw-r--r--pkgs/applications/audio/drumkv1/default.nix10
-rw-r--r--pkgs/applications/graphics/drawio/default.nix4
-rw-r--r--pkgs/applications/misc/bleachbit/default.nix4
-rw-r--r--pkgs/applications/misc/guake/default.nix53
-rw-r--r--pkgs/applications/networking/calls/default.nix18
-rw-r--r--pkgs/applications/networking/mailreaders/neomutt/default.nix4
-rw-r--r--pkgs/applications/video/mpv/default.nix2
-rw-r--r--pkgs/build-support/fetchurl/default.nix4
-rw-r--r--pkgs/desktops/gnome-3/misc/gnome-flashback/default.nix8
-rw-r--r--pkgs/development/compilers/gcc/4.8/default.nix34
-rw-r--r--pkgs/development/compilers/gcc/4.9/default.nix34
-rw-r--r--pkgs/development/compilers/gcc/5/default.nix38
-rw-r--r--pkgs/development/compilers/gcc/6/default.nix41
-rw-r--r--pkgs/development/compilers/gcc/7/default.nix40
-rw-r--r--pkgs/development/compilers/gcc/8/default.nix42
-rw-r--r--pkgs/development/compilers/gcc/9/default.nix42
-rw-r--r--pkgs/development/compilers/gcc/common/configure-flags.nix4
-rw-r--r--pkgs/development/compilers/gcc/common/extra-target-flags.nix30
-rw-r--r--pkgs/development/compilers/gcc/common/mfcgthreads-patches-repo.nix1
-rw-r--r--pkgs/development/compilers/gcc/snapshot/default.nix42
-rw-r--r--pkgs/development/compilers/go/1.13.nix4
-rw-r--r--pkgs/development/haskell-modules/configuration-nix.nix6
-rw-r--r--pkgs/development/haskell-modules/patches/servant-client-core-redact-auth-header.patch75
-rw-r--r--pkgs/development/haskell-modules/patches/servant-client-core-streamBody.patch82
-rw-r--r--pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh2
-rw-r--r--pkgs/development/libraries/arrow-cpp/default.nix2
-rw-r--r--pkgs/development/libraries/at-spi2-atk/default.nix4
-rw-r--r--pkgs/development/libraries/boehm-gc/default.nix8
-rw-r--r--pkgs/development/libraries/boehm-gc/mcfgthread.patch11
-rw-r--r--pkgs/development/libraries/check/default.nix4
-rw-r--r--pkgs/development/libraries/fdk-aac/default.nix4
-rw-r--r--pkgs/development/libraries/glib/default.nix4
-rw-r--r--pkgs/development/libraries/gnu-efi/default.nix4
-rw-r--r--pkgs/development/libraries/gtest/default.nix4
-rw-r--r--pkgs/development/libraries/harfbuzz/default.nix4
-rw-r--r--pkgs/development/libraries/ilmbase/default.nix15
-rw-r--r--pkgs/development/libraries/jbig2dec/default.nix6
-rw-r--r--pkgs/development/libraries/libical/default.nix4
-rw-r--r--pkgs/development/libraries/libinput/default.nix4
-rw-r--r--pkgs/development/libraries/libmicrohttpd/default.nix4
-rw-r--r--pkgs/development/libraries/librsvg/default.nix4
-rw-r--r--pkgs/development/libraries/libuv/default.nix4
-rw-r--r--pkgs/development/libraries/libxml2/default.nix21
-rw-r--r--pkgs/development/libraries/libxml2/utf8-xmlErrorFuncHandler.patch30
-rw-r--r--pkgs/development/libraries/libxslt/default.nix10
-rw-r--r--pkgs/development/libraries/nghttp2/default.nix9
-rw-r--r--pkgs/development/libraries/nspr/default.nix4
-rw-r--r--pkgs/development/libraries/openal-soft/default.nix8
-rw-r--r--pkgs/development/libraries/openal-soft/search-out.patch12
-rw-r--r--pkgs/development/libraries/openexr/default.nix9
-rw-r--r--pkgs/development/libraries/pcre/default.nix2
-rw-r--r--pkgs/development/libraries/polkit/default.nix3
-rw-r--r--pkgs/development/libraries/rocksdb/default.nix1
-rw-r--r--pkgs/development/python-modules/Babel/default.nix4
-rw-r--r--pkgs/development/python-modules/datasette/default.nix12
-rw-r--r--pkgs/development/python-modules/google_cloud_vision/default.nix7
-rw-r--r--pkgs/development/python-modules/jsonlines/default.nix28
-rw-r--r--pkgs/development/python-modules/jupyterlab_server/default.nix3
-rw-r--r--pkgs/development/python-modules/pyjson5/default.nix26
-rw-r--r--pkgs/development/python-modules/recommonmark/default.nix18
-rw-r--r--pkgs/development/python-modules/sphinx/2.nix75
-rw-r--r--pkgs/development/python-modules/sphinx/default.nix16
-rw-r--r--pkgs/development/python-modules/websockets/default.nix4
-rw-r--r--pkgs/development/python-modules/wurlitzer/default.nix6
-rw-r--r--pkgs/development/tools/analysis/include-what-you-use/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/cmake/default.nix4
-rw-r--r--pkgs/development/tools/documentation/gnome-doc-utils/default.nix5
-rw-r--r--pkgs/development/tools/misc/automake/automake-1.15.x.nix2
-rw-r--r--pkgs/development/tools/misc/automake/help2man-SOURCE_DATE_EPOCH-support.patch41
-rw-r--r--pkgs/development/tools/misc/itstool/default.nix18
-rw-r--r--pkgs/games/steam/chrootenv.nix1
-rw-r--r--pkgs/misc/cups/default.nix4
-rw-r--r--pkgs/misc/ghostscript/default.nix22
-rw-r--r--pkgs/misc/jackaudio/default.nix9
-rw-r--r--pkgs/misc/themes/numix-solarized/default.nix4
-rw-r--r--pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix10
-rw-r--r--pkgs/os-specific/linux/shadow/default.nix10
-rw-r--r--pkgs/os-specific/windows/default.nix52
-rw-r--r--pkgs/os-specific/windows/mcfgthreads/default.nix24
-rw-r--r--pkgs/os-specific/windows/mingw-w64/default.nix4
-rw-r--r--pkgs/servers/dns/knot-dns/default.nix4
-rw-r--r--pkgs/servers/monitoring/prometheus/blackbox-exporter.nix7
-rw-r--r--pkgs/servers/search/elasticsearch/plugins.nix79
-rw-r--r--pkgs/shells/zsh/antibody/default.nix8
-rw-r--r--pkgs/tools/X11/caffeine-ng/default.nix7
-rw-r--r--pkgs/tools/audio/abcmidi/default.nix4
-rw-r--r--pkgs/tools/backup/btrbk/default.nix4
-rw-r--r--pkgs/tools/filesystems/btrfs-progs/default.nix4
-rw-r--r--pkgs/tools/filesystems/ceph/default.nix35
-rw-r--r--pkgs/tools/misc/licensor/default.nix23
-rw-r--r--pkgs/tools/misc/man-db/default.nix4
-rw-r--r--pkgs/tools/networking/modem-manager/default.nix4
-rw-r--r--pkgs/tools/networking/twa/default.nix20
-rw-r--r--pkgs/tools/package-management/home-manager/default.nix6
-rw-r--r--pkgs/tools/security/trousers/default.nix19
-rw-r--r--pkgs/tools/typesetting/fop/default.nix2
-rw-r--r--pkgs/tools/typesetting/tex/dblatex/default.nix4
-rw-r--r--pkgs/top-level/all-packages.nix55
-rw-r--r--pkgs/top-level/perl-packages.nix72
-rw-r--r--pkgs/top-level/python-packages.nix17
109 files changed, 1119 insertions, 574 deletions
diff --git a/lib/systems/examples.nix b/lib/systems/examples.nix
index 511ae1979485..585156c24759 100644
--- a/lib/systems/examples.nix
+++ b/lib/systems/examples.nix
@@ -207,7 +207,7 @@ rec {
 
   # 32 bit mingw-w64
   mingw32 = {
-    config = "i686-pc-mingw32";
+    config = "i686-w64-mingw32";
     libc = "msvcrt"; # This distinguishes the mingw (non posix) toolchain
     platform = {};
   };
@@ -215,7 +215,7 @@ rec {
   # 64 bit mingw-w64
   mingwW64 = {
     # That's the triplet they use in the mingw-w64 docs.
-    config = "x86_64-pc-mingw32";
+    config = "x86_64-w64-mingw32";
     libc = "msvcrt"; # This distinguishes the mingw (non posix) toolchain
     platform = {};
   };
diff --git a/lib/systems/parse.nix b/lib/systems/parse.nix
index e923334a11bd..362357446025 100644
--- a/lib/systems/parse.nix
+++ b/lib/systems/parse.nix
@@ -208,6 +208,9 @@ rec {
   vendors = setTypes types.openVendor {
     apple = {};
     pc = {};
+    # Actually matters, unlocking some MinGW-w64-specific options in GCC. See
+    # bottom of https://sourceforge.net/p/mingw-w64/wiki2/Unicode%20apps/
+    w64 = {};
 
     none = {};
     unknown = {};
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index ec21dd9fafb3..5b7eec82c7a1 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -2884,6 +2884,15 @@
     githubId = 137306;
     name = "Michele Catalano";
   };
+  isgy = {
+    email = "isgy@teiyg.com";
+    github = "isgy";
+    githubId = 13622947;
+    keys = [{
+      longkeyid = "rsa4096/0xD3E1B013B4631293";
+      fingerprint = "1412 816B A9FA F62F D051 1975 D3E1 B013 B463 1293";
+    }];
+  };
   ivan = {
     email = "ivan@ludios.org";
     github = "ivan";
diff --git a/nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix b/nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix
index 719ba5ffb127..e0b558dcb0d8 100644
--- a/nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix
+++ b/nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix
@@ -22,17 +22,7 @@ with lib;
     });
   '';
 
-  services.xserver = {
-    enable = true;
-
-    # Automatically login as nixos.
-    displayManager.slim = {
-      enable = true;
-      defaultUser = "nixos";
-      autoLogin = true;
-    };
-
-  };
+  services.xserver.enable = true;
 
   # Provide networkmanager for easy wireless configuration.
   networking.networkmanager.enable = true;
diff --git a/nixos/modules/installer/cd-dvd/installation-cd-graphical-gnome.nix b/nixos/modules/installer/cd-dvd/installation-cd-graphical-gnome.nix
index 0b813bbf37b4..23c3426bff08 100644
--- a/nixos/modules/installer/cd-dvd/installation-cd-graphical-gnome.nix
+++ b/nixos/modules/installer/cd-dvd/installation-cd-graphical-gnome.nix
@@ -10,8 +10,6 @@ with lib;
 
   services.xserver.desktopManager.gnome3.enable = true;
 
-  services.xserver.displayManager.slim.enable = mkForce false;
-
   # Auto-login as root.
   services.xserver.displayManager.gdm.autoLogin = {
     enable = true;
diff --git a/nixos/modules/installer/cd-dvd/installation-cd-graphical-kde.nix b/nixos/modules/installer/cd-dvd/installation-cd-graphical-kde.nix
index 1dc7920ff640..6a10a6404e67 100644
--- a/nixos/modules/installer/cd-dvd/installation-cd-graphical-kde.nix
+++ b/nixos/modules/installer/cd-dvd/installation-cd-graphical-kde.nix
@@ -13,6 +13,15 @@ with lib;
       enable = true;
       enableQt4Support = false;
     };
+
+    # Automatically login as nixos.
+    displayManager.sddm = {
+      enable = true;
+      autoLogin = {
+        enable = true;
+        user = "nixos";
+      };
+    };
   };
 
   environment.systemPackages = with pkgs; [
diff --git a/nixos/modules/profiles/graphical.nix b/nixos/modules/profiles/graphical.nix
index 649f5564ac61..ac3c228b3c65 100644
--- a/nixos/modules/profiles/graphical.nix
+++ b/nixos/modules/profiles/graphical.nix
@@ -16,7 +16,6 @@
 
   # Enable sound in virtualbox appliances.
   hardware.pulseaudio.enable = true;
-  hardware.pulseaudio.systemWide = true; # Needed since we run plasma as root.
 
   environment.systemPackages = [ pkgs.glxinfo pkgs.firefox ];
 }
diff --git a/nixos/modules/services/x11/desktop-managers/gnome3.nix b/nixos/modules/services/x11/desktop-managers/gnome3.nix
index 0aae25662c64..88350a176506 100644
--- a/nixos/modules/services/x11/desktop-managers/gnome3.nix
+++ b/nixos/modules/services/x11/desktop-managers/gnome3.nix
@@ -184,6 +184,13 @@ in
         enableGnomeKeyring = true;
       };
 
+      systemd.packages = with pkgs.gnome3; [
+        gnome-flashback
+      ] ++ (map
+        (wm: gnome-flashback.mkSystemdTargetForWm {
+          inherit (wm) wmName;
+        }) cfg.flashback.customSessions);
+
       services.dbus.packages = [
         pkgs.gnome3.gnome-screensaver
       ];
diff --git a/nixos/tests/xmonad.nix b/nixos/tests/xmonad.nix
index 79c15ccffecd..c2e5ba60d7bc 100644
--- a/nixos/tests/xmonad.nix
+++ b/nixos/tests/xmonad.nix
@@ -1,4 +1,4 @@
-import ./make-test.nix ({ pkgs, ...} : {
+import ./make-test-python.nix ({ pkgs, ...} : {
   name = "xmonad";
   meta = with pkgs.stdenv.lib.maintainers; {
     maintainers = [ nequissimus ];
@@ -21,19 +21,21 @@ import ./make-test.nix ({ pkgs, ...} : {
     };
   };
 
-  testScript = { ... }: ''
-    $machine->waitForX;
-    $machine->waitForFile("/home/alice/.Xauthority");
-    $machine->succeed("xauth merge ~alice/.Xauthority");
-    $machine->sendKeys("alt-ctrl-x");
-    $machine->waitForWindow(qr/alice.*machine/);
-    $machine->sleep(1);
-    $machine->screenshot("terminal");
-    $machine->waitUntilSucceeds("xmonad --restart");
-    $machine->sleep(3);
-    $machine->sendKeys("alt-shift-ret");
-    $machine->waitForWindow(qr/alice.*machine/);
-    $machine->sleep(1);
-    $machine->screenshot("terminal");
+  testScript = { nodes, ... }: let
+    user = nodes.machine.config.users.users.alice;
+  in ''
+    machine.wait_for_x()
+    machine.wait_for_file("${user.home}/.Xauthority")
+    machine.succeed("xauth merge ${user.home}/.Xauthority")
+    machine.send_chars("alt-ctrl-x")
+    machine.wait_for_window("${user.name}.*machine")
+    machine.sleep(1)
+    machine.screenshot("terminal")
+    machine.wait_until_succeeds("xmonad --restart")
+    machine.sleep(3)
+    machine.send_chars("alt-shift-ret")
+    machine.wait_for_window("${user.name}.*machine")
+    machine.sleep(1)
+    machine.screenshot("terminal")
   '';
 })
diff --git a/pkgs/applications/audio/drumkv1/default.nix b/pkgs/applications/audio/drumkv1/default.nix
index 604fe4c4ab71..b926ff09d22b 100644
--- a/pkgs/applications/audio/drumkv1/default.nix
+++ b/pkgs/applications/audio/drumkv1/default.nix
@@ -1,19 +1,19 @@
-{ stdenv, fetchurl, pkgconfig, libjack2, alsaLib, libsndfile, liblo, lv2, qt5 }:
+{ mkDerivation, lib, fetchurl, pkgconfig, libjack2, alsaLib, libsndfile, liblo, lv2, qt5 }:
 
-stdenv.mkDerivation rec {
+mkDerivation rec {
   pname = "drumkv1";
-  version = "0.9.10";
+  version = "0.9.11";
 
   src = fetchurl {
     url = "mirror://sourceforge/drumkv1/${pname}-${version}.tar.gz";
-    sha256 = "0h08r6vq23dlnag67fcfcpx83wampx4fag82v4bgkqg2sdh64p3n";
+    sha256 = "1wnjn175l0mz51k9pjf3pdzv54c4jlh63saavld9lm6zfgfs13d7";
   };
 
   buildInputs = [ libjack2 alsaLib libsndfile liblo lv2 qt5.qtbase qt5.qttools ];
 
   nativeBuildInputs = [ pkgconfig ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "An old-school drum-kit sampler synthesizer with stereo fx";
     homepage = http://drumkv1.sourceforge.net/;
     license = licenses.gpl2Plus;
diff --git a/pkgs/applications/graphics/drawio/default.nix b/pkgs/applications/graphics/drawio/default.nix
index 4142310b705a..25cefabbd634 100644
--- a/pkgs/applications/graphics/drawio/default.nix
+++ b/pkgs/applications/graphics/drawio/default.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "drawio";
-  version = "12.1.7";
+  version = "12.2.2";
 
   src = fetchurl {
     url = "https://github.com/jgraph/drawio-desktop/releases/download/v${version}/draw.io-x86_64-${version}.rpm";
-    sha256 = "1vac0cz99yjlz7b186wyy4wk4sxkvlirpjmh3vw65xaxamn8spn3";
+    sha256 = "04h11gdy78py9zrs3v6y0hhhc2n1h4s0ymbvf6qn4vv4r3r9vbaw";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/bleachbit/default.nix b/pkgs/applications/misc/bleachbit/default.nix
index 3f13972de9bb..01eb69baadd8 100644
--- a/pkgs/applications/misc/bleachbit/default.nix
+++ b/pkgs/applications/misc/bleachbit/default.nix
@@ -1,13 +1,13 @@
 { stdenv, pythonPackages, fetchurl, gettext }:
 pythonPackages.buildPythonApplication rec {
   pname = "bleachbit";
-  version = "2.2";
+  version = "3.0";
 
   format = "other";
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "1yj9bc3k6s1aib7znb79h5rybfv691zz4szxkwf9fm9nr0dws603";
+    sha256 = "18ns9hms671b4l0189m1m2agprkydnpvyky9q2f5hxf35i9cn67d";
   };
 
   nativeBuildInputs = [ gettext ];
diff --git a/pkgs/applications/misc/guake/default.nix b/pkgs/applications/misc/guake/default.nix
index 97303c43fb1a..d403ddc8b26c 100644
--- a/pkgs/applications/misc/guake/default.nix
+++ b/pkgs/applications/misc/guake/default.nix
@@ -1,10 +1,21 @@
-{ stdenv, fetchFromGitHub, python3, gettext, gobject-introspection, wrapGAppsHook, glibcLocales
-, gtk3, keybinder3, libnotify, libutempter, vte, libwnck3 }:
+{ stdenv
+, fetchFromGitHub
+, python3
+, gettext
+, gobject-introspection
+, wrapGAppsHook
+, gtk3
+, keybinder3
+, libnotify
+, libutempter
+, vte
+, libwnck3
+}:
 
-let
+python3.pkgs.buildPythonApplication rec {
+  pname = "guake";
   version = "3.6.3";
-in python3.pkgs.buildPythonApplication {
-  name = "guake-${version}";
+
   format = "other";
 
   src = fetchFromGitHub {
@@ -19,18 +30,34 @@ in python3.pkgs.buildPythonApplication {
   # and https://github.com/NixOS/nixpkgs/issues/56943
   strictDeps = false;
 
-  nativeBuildInputs = [ gettext gobject-introspection wrapGAppsHook python3.pkgs.pip glibcLocales ];
-
-  buildInputs = [ gtk3 keybinder3 libnotify python3 vte ];
+  nativeBuildInputs = [
+    gettext
+    gobject-introspection
+    wrapGAppsHook
+    python3.pkgs.pip
+  ];
 
-  propagatedBuildInputs = with python3.pkgs; [ dbus-python pbr pycairo pygobject3 libwnck3 ];
+  buildInputs = [
+    gtk3
+    keybinder3
+    libnotify
+    libwnck3
+    python3
+    vte
+  ];
 
-  LC_ALL = "en_US.UTF-8"; # fixes weird encoding error, see https://github.com/NixOS/nixpkgs/pull/38642#issuecomment-379727699
+  propagatedBuildInputs = with python3.pkgs; [
+    dbus-python
+    pbr
+    pycairo
+    pygobject3
+    setuptools
+  ];
 
   PBR_VERSION = version; # pbr needs either .git directory, sdist, or env var
 
   makeFlags = [
-    "prefix=$(out)"
+    "prefix=${placeholder ''out''}"
   ];
 
   preFixup = ''
@@ -39,9 +66,9 @@ in python3.pkgs.buildPythonApplication {
 
   meta = with stdenv.lib; {
     description = "Drop-down terminal for GNOME";
-    homepage = http://guake-project.org;
+    homepage = "http://guake-project.org";
     license = licenses.gpl2;
-    platforms = platforms.linux;
     maintainers = [ maintainers.msteen ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/networking/calls/default.nix b/pkgs/applications/networking/calls/default.nix
index 63caf836ad9e..065f264f1529 100644
--- a/pkgs/applications/networking/calls/default.nix
+++ b/pkgs/applications/networking/calls/default.nix
@@ -9,24 +9,26 @@
 , gom
 , gsound
 , evolution-data-server
+, folks
 , desktop-file-utils
 , libpeas
 , dbus
+, vala
 , xorg
 , xvfb_run
 , libxml2
 }:
 
 stdenv.mkDerivation rec {
-  pname = "calls-unstable";
-  version = "2019-10-09";
+  pname = "calls";
+  version = "unstable-2019-10-29";
 
   src = fetchFromGitLab {
     domain = "source.puri.sm";
     owner = "Librem5";
-    repo = pname;
-    rev = "4b4cfa04266ebbe2f3da5abd9624ea07aa159fea";
-    sha256 = "0qvnddjpkh6gsywzdi24lmjlbwi0q54m1xa6hiaf1ch1j7kcv8fr";
+    repo = "calls";
+    rev = "9fe575053d8f01c3a76a6c20d39f0816166d5afd";
+    sha256 = "01inx4mvrzvklwrfryw5hw9p89v8cn78m3qmv97g7a3v0h5c0n35";
   };
 
   nativeBuildInputs = [
@@ -34,27 +36,29 @@ stdenv.mkDerivation rec {
     ninja
     pkgconfig
     desktop-file-utils
+    vala
   ];
 
   buildInputs = [
     modemmanager
     libhandy
     evolution-data-server
+    folks
     gom
     gsound
     gtk3
     libhandy
     libpeas
-    libxml2
   ];
 
   checkInputs = [
     dbus
     xvfb_run
-    xorg.xauth
   ];
 
   mesonFlags = [
+    # docs fail to build
+    # https://source.puri.sm/Librem5/calls/issues/99
     "-Dgtk_doc=false"
   ];
 
diff --git a/pkgs/applications/networking/mailreaders/neomutt/default.nix b/pkgs/applications/networking/mailreaders/neomutt/default.nix
index 81dc935f40d1..4305294297aa 100644
--- a/pkgs/applications/networking/mailreaders/neomutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/neomutt/default.nix
@@ -4,14 +4,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "20191102";
+  version = "20191111";
   pname = "neomutt";
 
   src = fetchFromGitHub {
     owner  = "neomutt";
     repo   = "neomutt";
     rev    = version;
-    sha256 = "0x5f9zbvxsxg5y2ir4xq4xw1q2snaxkidhdyhcxw5ljw3qqwhlyq";
+    sha256 = "16xr7wdmjw0i72xbnyyh098wx4cr0m8w2cr1szdi1b14p4kpgr67";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/video/mpv/default.nix b/pkgs/applications/video/mpv/default.nix
index 7aedce98d56f..78e0544fa1d1 100644
--- a/pkgs/applications/video/mpv/default.nix
+++ b/pkgs/applications/video/mpv/default.nix
@@ -52,7 +52,7 @@
 , zimgSupport        ? true,           zimg          ? null
 , archiveSupport     ? false,          libarchive    ? null
 , jackaudioSupport   ? false,          libjack2      ? null
-, openalSupport      ? false,          openalSoft    ? null
+, openalSupport      ? true,          openalSoft    ? null
 , vapoursynthSupport ? false,          vapoursynth   ? null
 }:
 
diff --git a/pkgs/build-support/fetchurl/default.nix b/pkgs/build-support/fetchurl/default.nix
index 6300587a7d15..7d23a3a7f8f1 100644
--- a/pkgs/build-support/fetchurl/default.nix
+++ b/pkgs/build-support/fetchurl/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenvNoCC, curl }: # Note that `curl' may be `null', in case of the native stdenvNoCC.
+{ lib, buildPackages ? { inherit stdenvNoCC; }, stdenvNoCC, curl }: # Note that `curl' may be `null', in case of the native stdenvNoCC.
 
 let
 
@@ -10,7 +10,7 @@ let
   # resulting store derivations (.drv files) much smaller, which in
   # turn makes nix-env/nix-instantiate faster.
   mirrorsFile =
-    stdenvNoCC.mkDerivation ({
+    buildPackages.stdenvNoCC.mkDerivation ({
       name = "mirrors-list";
       builder = ./write-mirror-list.sh;
       preferLocalBuild = true;
diff --git a/pkgs/desktops/gnome-3/misc/gnome-flashback/default.nix b/pkgs/desktops/gnome-3/misc/gnome-flashback/default.nix
index e381860ca2c9..dc7e0ed222f0 100644
--- a/pkgs/desktops/gnome-3/misc/gnome-flashback/default.nix
+++ b/pkgs/desktops/gnome-3/misc/gnome-flashback/default.nix
@@ -22,6 +22,7 @@
 , writeTextFile
 , writeShellScriptBin
 , xkeyboard_config
+, runCommand
 }:
 
 let
@@ -141,6 +142,13 @@ let
           DesktopNames=GNOME-Flashback;GNOME;
         '';
       };
+
+      mkSystemdTargetForWm = { wmName }:
+        runCommand "gnome-flashback-${wmName}.target" {} ''
+          mkdir -p $out/lib/systemd/user
+          cp "${gnome-flashback}/lib/systemd/user/gnome-session-x11@gnome-flashback-metacity.target" \
+            "$out/lib/systemd/user/gnome-session-x11@gnome-flashback-${wmName}.target"
+        '';
     };
 
     meta = with stdenv.lib; {
diff --git a/pkgs/development/compilers/gcc/4.8/default.nix b/pkgs/development/compilers/gcc/4.8/default.nix
index 084ced822c70..c047d9e50ee1 100644
--- a/pkgs/development/compilers/gcc/4.8/default.nix
+++ b/pkgs/development/compilers/gcc/4.8/default.nix
@@ -24,6 +24,7 @@
 , enablePlugin ? stdenv.hostPlatform == stdenv.buildPlatform # Whether to support user-supplied plug-ins
 , name ? "gcc"
 , libcCross ? null
+, threadsCross ? null # for MinGW
 , crossStageStatic ? false
 , # Strip kills static libs of other archs (hence no cross)
   stripped ? stdenv.hostPlatform == stdenv.buildPlatform
@@ -48,10 +49,14 @@ assert stdenv.hostPlatform.isDarwin -> gnused != null;
 # The go frontend is written in c++
 assert langGo -> langCC;
 
+# threadsCross is just for MinGW
+assert threadsCross != null -> stdenv.targetPlatform.isWindows;
+
 with stdenv.lib;
 with builtins;
 
-let version = "4.8.5";
+let majorVersion = "4";
+    version = "${majorVersion}.8.5";
 
     inherit (stdenv) buildPlatform hostPlatform targetPlatform;
 
@@ -172,6 +177,8 @@ stdenv.mkDerivation ({
     ++ (optional hostPlatform.isDarwin gnused)
     ;
 
+  depsTargetTarget = optional (!crossStageStatic && threadsCross != null) threadsCross;
+
   preConfigure = import ../common/pre-configure.nix {
     inherit (stdenv) lib;
     inherit version hostPlatform langJava langGo;
@@ -253,24 +260,13 @@ stdenv.mkDerivation ({
     ++ optionals javaAwtGtk [ gmp mpfr ]
   ));
 
-  EXTRA_TARGET_FLAGS = optionals
-    (targetPlatform != hostPlatform && libcCross != null)
-    ([
-      "-idirafter ${getDev libcCross}${libcCross.incdir or "/include"}"
-    ] ++ optionals (! crossStageStatic) [
-      "-B${libcCross.out}${libcCross.libdir or "/lib"}"
-    ]);
-
-  EXTRA_TARGET_LDFLAGS = optionals
-    (targetPlatform != hostPlatform && libcCross != null)
-    ([
-      "-Wl,-L${libcCross.out}${libcCross.libdir or "/lib"}"
-    ] ++ (if crossStageStatic then [
-        "-B${libcCross.out}${libcCross.libdir or "/lib"}"
-      ] else [
-        "-Wl,-rpath,${libcCross.out}${libcCross.libdir or "/lib"}"
-        "-Wl,-rpath-link,${libcCross.out}${libcCross.libdir or "/lib"}"
-    ]));
+  inherit
+    (import ../common/extra-target-flags.nix {
+      inherit stdenv crossStageStatic libcCross threadsCross;
+    })
+    EXTRA_TARGET_FLAGS
+    EXTRA_TARGET_LDFLAGS
+    ;
 
   passthru = {
     inherit langC langCC langObjC langObjCpp langFortran langGo version;
diff --git a/pkgs/development/compilers/gcc/4.9/default.nix b/pkgs/development/compilers/gcc/4.9/default.nix
index a2a9f39a94eb..78027bcdac45 100644
--- a/pkgs/development/compilers/gcc/4.9/default.nix
+++ b/pkgs/development/compilers/gcc/4.9/default.nix
@@ -24,6 +24,7 @@
 , enablePlugin ? stdenv.hostPlatform == stdenv.buildPlatform # Whether to support user-supplied plug-ins
 , name ? "gcc"
 , libcCross ? null
+, threadsCross ? null # for MinGW
 , crossStageStatic ? false
 , # Strip kills static libs of other archs (hence no cross)
   stripped ? stdenv.hostPlatform == stdenv.buildPlatform
@@ -48,10 +49,14 @@ assert stdenv.hostPlatform.isDarwin -> gnused != null;
 # The go frontend is written in c++
 assert langGo -> langCC;
 
+# threadsCross is just for MinGW
+assert threadsCross != null -> stdenv.targetPlatform.isWindows;
+
 with stdenv.lib;
 with builtins;
 
-let version = "4.9.4";
+let majorVersion = "4";
+    version = "${majorVersion}.9.4";
 
     inherit (stdenv) buildPlatform hostPlatform targetPlatform;
 
@@ -178,6 +183,8 @@ stdenv.mkDerivation ({
     ++ (optional hostPlatform.isDarwin gnused)
     ;
 
+  depsTargetTarget = optional (!crossStageStatic && threadsCross != null) threadsCross;
+
   preConfigure = import ../common/pre-configure.nix {
     inherit (stdenv) lib;
     inherit version hostPlatform langJava langGo;
@@ -259,24 +266,13 @@ stdenv.mkDerivation ({
     ++ optionals javaAwtGtk [ gmp mpfr ]
   ));
 
-  EXTRA_TARGET_FLAGS = optionals
-    (targetPlatform != hostPlatform && libcCross != null)
-    ([
-      "-idirafter ${getDev libcCross}${libcCross.incdir or "/include"}"
-    ] ++ optionals (! crossStageStatic) [
-      "-B${libcCross.out}${libcCross.libdir or "/lib"}"
-    ]);
-
-  EXTRA_TARGET_LDFLAGS = optionals
-    (targetPlatform != hostPlatform && libcCross != null)
-    ([
-      "-Wl,-L${libcCross.out}${libcCross.libdir or "/lib"}"
-    ] ++ (if crossStageStatic then [
-        "-B${libcCross.out}${libcCross.libdir or "/lib"}"
-      ] else [
-        "-Wl,-rpath,${libcCross.out}${libcCross.libdir or "/lib"}"
-        "-Wl,-rpath-link,${libcCross.out}${libcCross.libdir or "/lib"}"
-    ]));
+  inherit
+    (import ../common/extra-target-flags.nix {
+      inherit stdenv crossStageStatic libcCross threadsCross;
+    })
+    EXTRA_TARGET_FLAGS
+    EXTRA_TARGET_LDFLAGS
+    ;
 
   passthru = {
     inherit langC langCC langObjC langObjCpp langFortran langGo version;
diff --git a/pkgs/development/compilers/gcc/5/default.nix b/pkgs/development/compilers/gcc/5/default.nix
index 775245aae420..a6aab5c26d43 100644
--- a/pkgs/development/compilers/gcc/5/default.nix
+++ b/pkgs/development/compilers/gcc/5/default.nix
@@ -24,6 +24,7 @@
 , enablePlugin ? stdenv.hostPlatform == stdenv.buildPlatform # Whether to support user-supplied plug-ins
 , name ? "gcc"
 , libcCross ? null
+, threadsCross ? null # for MinGW
 , crossStageStatic ? false
 , # Strip kills static libs of other archs (hence no cross)
   stripped ? stdenv.hostPlatform == stdenv.buildPlatform
@@ -46,10 +47,14 @@ assert stdenv.hostPlatform.isDarwin -> gnused != null;
 # The go frontend is written in c++
 assert langGo -> langCC;
 
+# threadsCross is just for MinGW
+assert threadsCross != null -> stdenv.targetPlatform.isWindows;
+
 with stdenv.lib;
 with builtins;
 
-let version = "5.5.0";
+let majorVersion = "5";
+    version = "${majorVersion}.5.0";
 
     inherit (stdenv) buildPlatform hostPlatform targetPlatform;
 
@@ -62,6 +67,10 @@ let version = "5.5.0";
       ++ optional stdenv.hostPlatform.isMusl (fetchpatch {
         url = https://raw.githubusercontent.com/richfelker/musl-cross-make/e84b1bd1fc12a3def33111ca6df522cd6e5ec361/patches/gcc-5.3.0/0001-musl.diff;
         sha256 = "0pppbf8myi2kjhm3z3479ihn1cm60kycfv60gj8yy1bs0pl1qcfm";
+      })
+      ++ optional (!crossStageStatic && targetPlatform.isMinGW) (fetchpatch {
+        url = "https://raw.githubusercontent.com/lhmouse/MINGW-packages/${import ../common/mfcgthreads-patches-repo.nix}/mingw-w64-gcc-git/9000-gcc-${majorVersion}-branch-Added-mcf-thread-model-support-from-mcfgthread.patch";
+        sha256 = "074bl5n27d1ksa31pvzj4vd8xd46r118k0w94gdv3s1vydg7mah0";
       });
 
     javaEcj = fetchurl {
@@ -184,6 +193,8 @@ stdenv.mkDerivation ({
     ++ (optional hostPlatform.isDarwin gnused)
     ;
 
+  depsTargetTarget = optional (!crossStageStatic && threadsCross != null) threadsCross;
+
   NIX_LDFLAGS = stdenv.lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
 
   preConfigure = import ../common/pre-configure.nix {
@@ -266,24 +277,13 @@ stdenv.mkDerivation ({
     ++ optionals javaAwtGtk [ gmp mpfr ]
   ));
 
-  EXTRA_TARGET_FLAGS = optionals
-    (targetPlatform != hostPlatform && libcCross != null)
-    ([
-      "-idirafter ${getDev libcCross}${libcCross.incdir or "/include"}"
-    ] ++ optionals (! crossStageStatic) [
-      "-B${libcCross.out}${libcCross.libdir or "/lib"}"
-    ]);
-
-  EXTRA_TARGET_LDFLAGS = optionals
-    (targetPlatform != hostPlatform && libcCross != null)
-    ([
-      "-Wl,-L${libcCross.out}${libcCross.libdir or "/lib"}"
-    ] ++ (if crossStageStatic then [
-        "-B${libcCross.out}${libcCross.libdir or "/lib"}"
-      ] else [
-        "-Wl,-rpath,${libcCross.out}${libcCross.libdir or "/lib"}"
-        "-Wl,-rpath-link,${libcCross.out}${libcCross.libdir or "/lib"}"
-    ]));
+  inherit
+    (import ../common/extra-target-flags.nix {
+      inherit stdenv crossStageStatic libcCross threadsCross;
+    })
+    EXTRA_TARGET_FLAGS
+    EXTRA_TARGET_LDFLAGS
+    ;
 
   passthru = {
     inherit langC langCC langObjC langObjCpp langFortran langGo version;
diff --git a/pkgs/development/compilers/gcc/6/default.nix b/pkgs/development/compilers/gcc/6/default.nix
index 3f5644e9450c..4ec24dbe88e7 100644
--- a/pkgs/development/compilers/gcc/6/default.nix
+++ b/pkgs/development/compilers/gcc/6/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, targetPackages, fetchurl, noSysDirs
+{ stdenv, targetPackages, fetchurl, fetchpatch, noSysDirs
 , langC ? true, langCC ? true, langFortran ? false
 , langObjC ? stdenv.targetPlatform.isDarwin
 , langObjCpp ? stdenv.targetPlatform.isDarwin
@@ -24,6 +24,7 @@
 , enablePlugin ? stdenv.hostPlatform == stdenv.buildPlatform # Whether to support user-supplied plug-ins
 , name ? "gcc"
 , libcCross ? null
+, threadsCross ? null # for MinGW
 , crossStageStatic ? false
 , # Strip kills static libs of other archs (hence no cross)
   stripped ? stdenv.hostPlatform == stdenv.buildPlatform
@@ -46,10 +47,14 @@ assert stdenv.hostPlatform.isDarwin -> gnused != null;
 # The go frontend is written in c++
 assert langGo -> langCC;
 
+# threadsCross is just for MinGW
+assert threadsCross != null -> stdenv.targetPlatform.isWindows;
+
 with stdenv.lib;
 with builtins;
 
-let version = "6.5.0";
+let majorVersion = "6";
+    version = "${majorVersion}.5.0";
 
     inherit (stdenv) buildPlatform hostPlatform targetPlatform;
 
@@ -59,7 +64,10 @@ let version = "6.5.0";
       ++ optional noSysDirs ../no-sys-dirs.patch
       ++ optional langFortran ../gfortran-driving.patch
       ++ optional (targetPlatform.libc == "musl") ../libgomp-dont-force-initial-exec.patch
-      ;
+      ++ optional (!crossStageStatic && targetPlatform.isMinGW) (fetchpatch {
+        url = "https://raw.githubusercontent.com/lhmouse/MINGW-packages/${import ../common/mfcgthreads-patches-repo.nix}/mingw-w64-gcc-git/9000-gcc-${majorVersion}-branch-Added-mcf-thread-model-support-from-mcfgthread.patch";
+        sha256 = "1c449jgm1vx9g4kv82bxmvlgrwb8f6kwkl0gqmjlmhf7f4hjy2nr";
+      });
 
     javaEcj = fetchurl {
       # The `$(top_srcdir)/ecj.jar' file is automatically picked up at
@@ -186,6 +194,8 @@ stdenv.mkDerivation ({
     ++ (optional hostPlatform.isDarwin gnused)
     ;
 
+  depsTargetTarget = optional (!crossStageStatic && threadsCross != null) threadsCross;
+
   NIX_LDFLAGS = stdenv.lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
 
   preConfigure = import ../common/pre-configure.nix {
@@ -268,24 +278,13 @@ stdenv.mkDerivation ({
     ++ optionals javaAwtGtk [ gmp mpfr ]
   ));
 
-  EXTRA_TARGET_FLAGS = optionals
-    (targetPlatform != hostPlatform && libcCross != null)
-    ([
-      "-idirafter ${getDev libcCross}${libcCross.incdir or "/include"}"
-    ] ++ optionals (! crossStageStatic) [
-      "-B${libcCross.out}${libcCross.libdir or "/lib"}"
-    ]);
-
-  EXTRA_TARGET_LDFLAGS = optionals
-    (targetPlatform != hostPlatform && libcCross != null)
-    ([
-      "-Wl,-L${libcCross.out}${libcCross.libdir or "/lib"}"
-    ] ++ (if crossStageStatic then [
-        "-B${libcCross.out}${libcCross.libdir or "/lib"}"
-      ] else [
-        "-Wl,-rpath,${libcCross.out}${libcCross.libdir or "/lib"}"
-        "-Wl,-rpath-link,${libcCross.out}${libcCross.libdir or "/lib"}"
-    ]));
+  inherit
+    (import ../common/extra-target-flags.nix {
+      inherit stdenv crossStageStatic libcCross threadsCross;
+    })
+    EXTRA_TARGET_FLAGS
+    EXTRA_TARGET_LDFLAGS
+    ;
 
   passthru = {
     inherit langC langCC langObjC langObjCpp langFortran langGo version;
diff --git a/pkgs/development/compilers/gcc/7/default.nix b/pkgs/development/compilers/gcc/7/default.nix
index f780bfdfc76a..aa46a5263898 100644
--- a/pkgs/development/compilers/gcc/7/default.nix
+++ b/pkgs/development/compilers/gcc/7/default.nix
@@ -17,6 +17,7 @@
 , enablePlugin ? stdenv.hostPlatform == stdenv.buildPlatform # Whether to support user-supplied plug-ins
 , name ? "gcc"
 , libcCross ? null
+, threadsCross ? null # for MinGW
 , crossStageStatic ? false
 , # Strip kills static libs of other archs (hence no cross)
   stripped ? stdenv.hostPlatform == stdenv.buildPlatform
@@ -35,10 +36,14 @@ assert stdenv.hostPlatform.isDarwin -> gnused != null;
 # The go frontend is written in c++
 assert langGo -> langCC;
 
+# threadsCross is just for MinGW
+assert threadsCross != null -> stdenv.targetPlatform.isWindows;
+
 with stdenv.lib;
 with builtins;
 
-let version = "7.4.0";
+let majorVersion = "7";
+    version = "${majorVersion}.4.0";
 
     inherit (stdenv) buildPlatform hostPlatform targetPlatform;
 
@@ -59,7 +64,11 @@ let version = "7.4.0";
       })
       ++ optional langFortran ../gfortran-driving.patch
       ++ optional (targetPlatform.libc == "musl" && targetPlatform.isPower) ../ppc-musl.patch
-      ++ optional (targetPlatform.libc == "musl") ../libgomp-dont-force-initial-exec.patch;
+      ++ optional (targetPlatform.libc == "musl") ../libgomp-dont-force-initial-exec.patch
+      ++ optional (!crossStageStatic && targetPlatform.isMinGW) (fetchpatch {
+        url = "https://raw.githubusercontent.com/lhmouse/MINGW-packages/${import ../common/mfcgthreads-patches-repo.nix}/mingw-w64-gcc-git/9000-gcc-${majorVersion}-branch-Added-mcf-thread-model-support-from-mcfgthread.patch";
+        sha256 = "1nyjnshpq5gbcbbpfv27hy4ajvycmgkpiabkjlxnnrnq1d99k1ay";
+      });
 
     /* Cross-gcc settings (build == host != target) */
     crossMingw = targetPlatform != hostPlatform && targetPlatform.libc == "msvcrt";
@@ -161,6 +170,8 @@ stdenv.mkDerivation ({
     ++ (optional hostPlatform.isDarwin gnused)
     ;
 
+  depsTargetTarget = optional (!crossStageStatic && threadsCross != null) threadsCross;
+
   NIX_CFLAGS_COMPILE = stdenv.lib.optionalString (stdenv.cc.isClang && langFortran) "-Wno-unused-command-line-argument";
   NIX_LDFLAGS = stdenv.lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
 
@@ -232,24 +243,13 @@ stdenv.mkDerivation ({
 
   LIBRARY_PATH = optionals (targetPlatform == hostPlatform) (makeLibraryPath (optional (zlib != null) zlib));
 
-  EXTRA_TARGET_FLAGS = optionals
-    (targetPlatform != hostPlatform && libcCross != null)
-    ([
-      "-idirafter ${getDev libcCross}${libcCross.incdir or "/include"}"
-    ] ++ optionals (! crossStageStatic) [
-      "-B${libcCross.out}${libcCross.libdir or "/lib"}"
-    ]);
-
-  EXTRA_TARGET_LDFLAGS = optionals
-    (targetPlatform != hostPlatform && libcCross != null)
-    ([
-      "-Wl,-L${libcCross.out}${libcCross.libdir or "/lib"}"
-    ] ++ (if crossStageStatic then [
-        "-B${libcCross.out}${libcCross.libdir or "/lib"}"
-      ] else [
-        "-Wl,-rpath,${libcCross.out}${libcCross.libdir or "/lib"}"
-        "-Wl,-rpath-link,${libcCross.out}${libcCross.libdir or "/lib"}"
-    ]));
+  inherit
+    (import ../common/extra-target-flags.nix {
+      inherit stdenv crossStageStatic libcCross threadsCross;
+    })
+    EXTRA_TARGET_FLAGS
+    EXTRA_TARGET_LDFLAGS
+    ;
 
   passthru = {
     inherit langC langCC langObjC langObjCpp langFortran langGo version;
diff --git a/pkgs/development/compilers/gcc/8/default.nix b/pkgs/development/compilers/gcc/8/default.nix
index dc051d9c4b6a..0874d4d085ad 100644
--- a/pkgs/development/compilers/gcc/8/default.nix
+++ b/pkgs/development/compilers/gcc/8/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, targetPackages, fetchurl, noSysDirs
+{ stdenv, targetPackages, fetchurl, fetchpatch, noSysDirs
 , langC ? true, langCC ? true, langFortran ? false
 , langObjC ? stdenv.targetPlatform.isDarwin
 , langObjCpp ? stdenv.targetPlatform.isDarwin
@@ -17,6 +17,7 @@
 , enablePlugin ? stdenv.hostPlatform == stdenv.buildPlatform # Whether to support user-supplied plug-ins
 , name ? "gcc"
 , libcCross ? null
+, threadsCross ? null # for MinGW
 , crossStageStatic ? false
 , # Strip kills static libs of other archs (hence no cross)
   stripped ? stdenv.hostPlatform == stdenv.buildPlatform
@@ -35,10 +36,14 @@ assert stdenv.hostPlatform.isDarwin -> gnused != null;
 # The go frontend is written in c++
 assert langGo -> langCC;
 
+# threadsCross is just for MinGW
+assert threadsCross != null -> stdenv.targetPlatform.isWindows;
+
 with stdenv.lib;
 with builtins;
 
-let version = "8.3.0";
+let majorVersion = "8";
+    version = "${majorVersion}.3.0";
 
     inherit (stdenv) buildPlatform hostPlatform targetPlatform;
 
@@ -51,7 +56,11 @@ let version = "8.3.0";
       }) */
       ++ optional langFortran ../gfortran-driving.patch
       ++ optional (targetPlatform.libc == "musl" && targetPlatform.isPower) ../ppc-musl.patch
-      ++ optional (targetPlatform.libc == "musl") ../libgomp-dont-force-initial-exec.patch;
+      ++ optional (targetPlatform.libc == "musl") ../libgomp-dont-force-initial-exec.patch
+      ++ optional (!crossStageStatic && targetPlatform.isMinGW) (fetchpatch {
+        url = "https://raw.githubusercontent.com/lhmouse/MINGW-packages/${import ../common/mfcgthreads-patches-repo.nix}/mingw-w64-gcc-git/9000-gcc-${majorVersion}-branch-Added-mcf-thread-model-support-from-mcfgthread.patch";
+        sha256 = "1in5kvcknlpi9z1vvjw6jfmwy8k12zvbqlqfnq84qpm99r0rh00a";
+      });
 
     /* Cross-gcc settings (build == host != target) */
     crossMingw = targetPlatform != hostPlatform && targetPlatform.libc == "msvcrt";
@@ -153,6 +162,8 @@ stdenv.mkDerivation ({
     ++ (optional hostPlatform.isDarwin gnused)
     ;
 
+  depsTargetTarget = optional (!crossStageStatic && threadsCross != null) threadsCross;
+
   NIX_LDFLAGS = stdenv.lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
 
   preConfigure = import ../common/pre-configure.nix {
@@ -219,24 +230,13 @@ stdenv.mkDerivation ({
 
   LIBRARY_PATH = optionals (targetPlatform == hostPlatform) (makeLibraryPath (optional (zlib != null) zlib));
 
-  EXTRA_TARGET_FLAGS = optionals
-    (targetPlatform != hostPlatform && libcCross != null)
-    ([
-      "-idirafter ${getDev libcCross}${libcCross.incdir or "/include"}"
-    ] ++ optionals (! crossStageStatic) [
-      "-B${libcCross.out}${libcCross.libdir or "/lib"}"
-    ]);
-
-  EXTRA_TARGET_LDFLAGS = optionals
-    (targetPlatform != hostPlatform && libcCross != null)
-    ([
-      "-Wl,-L${libcCross.out}${libcCross.libdir or "/lib"}"
-    ] ++ (if crossStageStatic then [
-        "-B${libcCross.out}${libcCross.libdir or "/lib"}"
-      ] else [
-        "-Wl,-rpath,${libcCross.out}${libcCross.libdir or "/lib"}"
-        "-Wl,-rpath-link,${libcCross.out}${libcCross.libdir or "/lib"}"
-    ]));
+  inherit
+    (import ../common/extra-target-flags.nix {
+      inherit stdenv crossStageStatic libcCross threadsCross;
+    })
+    EXTRA_TARGET_FLAGS
+    EXTRA_TARGET_LDFLAGS
+    ;
 
   passthru = {
     inherit langC langCC langObjC langObjCpp langFortran langGo version;
diff --git a/pkgs/development/compilers/gcc/9/default.nix b/pkgs/development/compilers/gcc/9/default.nix
index 57f4a72c135a..f16dcb59b469 100644
--- a/pkgs/development/compilers/gcc/9/default.nix
+++ b/pkgs/development/compilers/gcc/9/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, targetPackages, fetchurl, noSysDirs
+{ stdenv, targetPackages, fetchurl, fetchpatch, noSysDirs
 , langC ? true, langCC ? true, langFortran ? false
 , langObjC ? stdenv.targetPlatform.isDarwin
 , langObjCpp ? stdenv.targetPlatform.isDarwin
@@ -17,6 +17,7 @@
 , enablePlugin ? stdenv.hostPlatform == stdenv.buildPlatform # Whether to support user-supplied plug-ins
 , name ? "gcc"
 , libcCross ? null
+, threadsCross ? null # for MinGW
 , crossStageStatic ? false
 , # Strip kills static libs of other archs (hence no cross)
   stripped ? stdenv.hostPlatform == stdenv.buildPlatform
@@ -35,10 +36,14 @@ assert stdenv.hostPlatform.isDarwin -> gnused != null;
 # The go frontend is written in c++
 assert langGo -> langCC;
 
+# threadsCross is just for MinGW
+assert threadsCross != null -> stdenv.targetPlatform.isWindows;
+
 with stdenv.lib;
 with builtins;
 
-let version = "9.2.0";
+let majorVersion = "9";
+    version = "${majorVersion}.2.0";
 
     inherit (stdenv) buildPlatform hostPlatform targetPlatform;
 
@@ -50,7 +55,11 @@ let version = "9.2.0";
         sha256 = ""; # TODO: uncomment and check hash when available.
       }) */
       ++ optional langFortran ../gfortran-driving.patch
-      ++ optional (targetPlatform.libc == "musl" && targetPlatform.isPower) ../ppc-musl.patch;
+      ++ optional (targetPlatform.libc == "musl" && targetPlatform.isPower) ../ppc-musl.patch
+      ++ optional (!crossStageStatic && targetPlatform.isMinGW) (fetchpatch {
+        url = "https://raw.githubusercontent.com/lhmouse/MINGW-packages/${import ../common/mfcgthreads-patches-repo.nix}/mingw-w64-gcc-git/9000-gcc-${majorVersion}-branch-Added-mcf-thread-model-support-from-mcfgthread.patch";
+        sha256 = "1in5kvcknlpi9z1vvjw6jfmwy8k12zvbqlqfnq84qpm99r0rh00a";
+      });
 
     /* Cross-gcc settings (build == host != target) */
     crossMingw = targetPlatform != hostPlatform && targetPlatform.libc == "msvcrt";
@@ -152,6 +161,8 @@ stdenv.mkDerivation ({
     ++ (optional hostPlatform.isDarwin gnused)
     ;
 
+  depsTargetTarget = optional (!crossStageStatic && threadsCross != null) threadsCross;
+
   NIX_LDFLAGS = stdenv.lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
 
   preConfigure = import ../common/pre-configure.nix {
@@ -218,24 +229,13 @@ stdenv.mkDerivation ({
 
   LIBRARY_PATH = optionals (targetPlatform == hostPlatform) (makeLibraryPath (optional (zlib != null) zlib));
 
-  EXTRA_TARGET_FLAGS = optionals
-    (targetPlatform != hostPlatform && libcCross != null)
-    ([
-      "-idirafter ${getDev libcCross}${libcCross.incdir or "/include"}"
-    ] ++ optionals (! crossStageStatic) [
-      "-B${libcCross.out}${libcCross.libdir or "/lib"}"
-    ]);
-
-  EXTRA_TARGET_LDFLAGS = optionals
-    (targetPlatform != hostPlatform && libcCross != null)
-    ([
-      "-Wl,-L${libcCross.out}${libcCross.libdir or "/lib"}"
-    ] ++ (if crossStageStatic then [
-        "-B${libcCross.out}${libcCross.libdir or "/lib"}"
-      ] else [
-        "-Wl,-rpath,${libcCross.out}${libcCross.libdir or "/lib"}"
-        "-Wl,-rpath-link,${libcCross.out}${libcCross.libdir or "/lib"}"
-    ]));
+  inherit
+    (import ../common/extra-target-flags.nix {
+      inherit stdenv crossStageStatic libcCross threadsCross;
+    })
+    EXTRA_TARGET_FLAGS
+    EXTRA_TARGET_LDFLAGS
+    ;
 
   passthru = {
     inherit langC langCC langObjC langObjCpp langFortran langGo version;
diff --git a/pkgs/development/compilers/gcc/common/configure-flags.nix b/pkgs/development/compilers/gcc/common/configure-flags.nix
index 7554818e0a00..5b12e5bfe5a9 100644
--- a/pkgs/development/compilers/gcc/common/configure-flags.nix
+++ b/pkgs/development/compilers/gcc/common/configure-flags.nix
@@ -50,7 +50,7 @@ let
       "--disable-decimal-float" # requires libc
       "--disable-libmpx" # requires libc
     ] ++ lib.optionals crossMingw [
-      "--with-headers=${libcCross}/include"
+      "--with-headers=${lib.getDev libcCross}/include"
       "--with-gcc"
       "--with-gnu-as"
       "--with-gnu-ld"
@@ -63,7 +63,7 @@ let
       "--enable-__cxa_atexit"
       "--enable-long-long"
       "--enable-threads=${if targetPlatform.isUnix then "posix"
-                          else if targetPlatform.isWindows then "win32"
+                          else if targetPlatform.isWindows then "mcf"
                           else "single"}"
       "--enable-nls"
       "--disable-decimal-float" # No final libdecnumber (it may work only in 386)
diff --git a/pkgs/development/compilers/gcc/common/extra-target-flags.nix b/pkgs/development/compilers/gcc/common/extra-target-flags.nix
new file mode 100644
index 000000000000..bce9a8d47381
--- /dev/null
+++ b/pkgs/development/compilers/gcc/common/extra-target-flags.nix
@@ -0,0 +1,30 @@
+{ stdenv, crossStageStatic, libcCross, threadsCross }:
+
+let
+  inherit (stdenv) lib hostPlatform targetPlatform;
+in
+
+{
+  EXTRA_TARGET_FLAGS = let
+      mkFlags = dep: lib.optionals (targetPlatform != hostPlatform && dep != null) ([
+        "-idirafter ${lib.getDev dep}${dep.incdir or "/include"}"
+      ] ++ stdenv.lib.optionals (! crossStageStatic) [
+        "-B${lib.getLib dep}${dep.libdir or "/lib"}"
+      ]);
+    in mkFlags libcCross
+    ++ lib.optionals (!crossStageStatic) (mkFlags threadsCross)
+    ;
+
+  EXTRA_TARGET_LDFLAGS = let
+      mkFlags = dep: lib.optionals (targetPlatform != hostPlatform && dep != null) ([
+        "-Wl,-L${lib.getLib dep}${dep.libdir or "/lib"}"
+      ] ++ (if crossStageStatic then [
+          "-B${lib.getLib dep}${dep.libdir or "/lib"}"
+        ] else [
+          "-Wl,-rpath,${lib.getLib dep}${dep.libdir or "/lib"}"
+          "-Wl,-rpath-link,${lib.getLib dep}${dep.libdir or "/lib"}"
+      ]));
+    in mkFlags libcCross
+    ++ lib.optionals (!crossStageStatic) (mkFlags threadsCross)
+    ;
+}
diff --git a/pkgs/development/compilers/gcc/common/mfcgthreads-patches-repo.nix b/pkgs/development/compilers/gcc/common/mfcgthreads-patches-repo.nix
new file mode 100644
index 000000000000..f8822c6dba0e
--- /dev/null
+++ b/pkgs/development/compilers/gcc/common/mfcgthreads-patches-repo.nix
@@ -0,0 +1 @@
+"740f233da00c4fb5bcc225b2e29768824bcecc58"
diff --git a/pkgs/development/compilers/gcc/snapshot/default.nix b/pkgs/development/compilers/gcc/snapshot/default.nix
index ef55806ce080..5344b6591696 100644
--- a/pkgs/development/compilers/gcc/snapshot/default.nix
+++ b/pkgs/development/compilers/gcc/snapshot/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, targetPackages, fetchurl, noSysDirs
+{ stdenv, targetPackages, fetchurl, fetchpatch, noSysDirs
 , langC ? true, langCC ? true, langFortran ? false
 , langObjC ? stdenv.targetPlatform.isDarwin
 , langObjCpp ? stdenv.targetPlatform.isDarwin
@@ -17,6 +17,7 @@
 , enablePlugin ? stdenv.hostPlatform == stdenv.buildPlatform # Whether to support user-supplied plug-ins
 , name ? "gcc"
 , libcCross ? null
+, threadsCross ? null # for MinGW
 , crossStageStatic ? false
 , # Strip kills static libs of other archs (hence no cross)
   stripped ? stdenv.hostPlatform == stdenv.buildPlatform
@@ -36,10 +37,14 @@ assert stdenv.hostPlatform.isDarwin -> gnused != null;
 # The go frontend is written in c++
 assert langGo -> langCC;
 
+# threadsCross is just for MinGW
+assert threadsCross != null -> stdenv.targetPlatform.isWindows;
+
 with stdenv.lib;
 with builtins;
 
-let version = "7-20170409";
+let majorVersion = "7";
+    version = "${majorVersion}-20170409";
 
     inherit (stdenv) buildPlatform hostPlatform targetPlatform;
 
@@ -47,7 +52,11 @@ let version = "7-20170409";
       [ ]
       ++ optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
       ++ optional noSysDirs ../no-sys-dirs.patch
-      ++ optional langFortran ../gfortran-driving.patch;
+      ++ optional langFortran ../gfortran-driving.patch
+      ++ optional (!crossStageStatic && targetPlatform.isMinGW) (fetchpatch {
+        url = "https://raw.githubusercontent.com/lhmouse/MINGW-packages/${import ../common/mfcgthreads-patches-repo.nix}/mingw-w64-gcc-git/9000-gcc-${majorVersion}-branch-Added-mcf-thread-model-support-from-mcfgthread.patch";
+        sha256 = "1nyjnshpq5gbcbbpfv27hy4ajvycmgkpiabkjlxnnrnq1d99k1ay";
+      });
 
     /* Cross-gcc settings (build == host != target) */
     crossMingw = targetPlatform != hostPlatform && targetPlatform.libc == "msvcrt";
@@ -119,6 +128,8 @@ stdenv.mkDerivation ({
     ++ (optional hostPlatform.isDarwin gnused)
     ;
 
+  depsTargetTarget = optional (!crossStageStatic && threadsCross != null) threadsCross;
+
   NIX_LDFLAGS = stdenv.lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
 
   preConfigure = import ../common/pre-configure.nix {
@@ -186,24 +197,13 @@ stdenv.mkDerivation ({
 
   LIBRARY_PATH = optionals (targetPlatform == hostPlatform) (makeLibraryPath (optional (zlib != null) zlib));
 
-  EXTRA_TARGET_FLAGS = optionals
-    (targetPlatform != hostPlatform && libcCross != null)
-    ([
-      "-idirafter ${getDev libcCross}${libcCross.incdir or "/include"}"
-    ] ++ optionals (! crossStageStatic) [
-      "-B${libcCross.out}${libcCross.libdir or "/lib"}"
-    ]);
-
-  EXTRA_TARGET_LDFLAGS = optionals
-    (targetPlatform != hostPlatform && libcCross != null)
-    ([
-      "-Wl,-L${libcCross.out}${libcCross.libdir or "/lib"}"
-    ] ++ (if crossStageStatic then [
-        "-B${libcCross.out}${libcCross.libdir or "/lib"}"
-      ] else [
-        "-Wl,-rpath,${libcCross.out}${libcCross.libdir or "/lib"}"
-        "-Wl,-rpath-link,${libcCross.out}${libcCross.libdir or "/lib"}"
-    ]));
+  inherit
+    (import ../common/extra-target-flags.nix {
+      inherit stdenv crossStageStatic libcCross threadsCross;
+    })
+    EXTRA_TARGET_FLAGS
+    EXTRA_TARGET_LDFLAGS
+    ;
 
   passthru = {
     inherit langC langCC langObjC langObjCpp langFortran langGo version;
diff --git a/pkgs/development/compilers/go/1.13.nix b/pkgs/development/compilers/go/1.13.nix
index 95c51e2e880b..9e8a6601724b 100644
--- a/pkgs/development/compilers/go/1.13.nix
+++ b/pkgs/development/compilers/go/1.13.nix
@@ -30,11 +30,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.13.3";
+  version = "1.13.4";
 
   src = fetchurl {
     url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "1pz3423gw3z2zwcmk9l2c6v68w5is39gndq7502c9mbm8c226wag";
+    sha256 = "093n5v0bipaan0qqc02wash18r625y74r4zhmjwlc9zf8asfmnwm";
   };
 
   # perl is used for testing go vet
diff --git a/pkgs/development/haskell-modules/configuration-nix.nix b/pkgs/development/haskell-modules/configuration-nix.nix
index f729c3c8373d..5308296c8332 100644
--- a/pkgs/development/haskell-modules/configuration-nix.nix
+++ b/pkgs/development/haskell-modules/configuration-nix.nix
@@ -517,9 +517,9 @@ self: super: builtins.intersectAttrs super {
   # https://github.com/plow-technologies/servant-streaming/issues/12
   servant-streaming-server = dontCheck super.servant-streaming-server;
 
-  # https://github.com/haskell-servant/servant/pull/1128
-  servant-client-core = if (pkgs.lib.getVersion super.servant-client-core) == "0.15" then
-    appendPatch super.servant-client-core ./patches/servant-client-core-streamBody.patch
+  # https://github.com/haskell-servant/servant/pull/1238
+  servant-client-core = if (pkgs.lib.getVersion super.servant-client-core) == "0.16" then
+    appendPatch super.servant-client-core ./patches/servant-client-core-redact-auth-header.patch
   else
     super.servant-client-core;
 
diff --git a/pkgs/development/haskell-modules/patches/servant-client-core-redact-auth-header.patch b/pkgs/development/haskell-modules/patches/servant-client-core-redact-auth-header.patch
new file mode 100644
index 000000000000..0f6a34f4f265
--- /dev/null
+++ b/pkgs/development/haskell-modules/patches/servant-client-core-redact-auth-header.patch
@@ -0,0 +1,75 @@
+diff --git a/servant-client-core.cabal b/servant-client-core.cabal
+index 5789da601..3faf65bb4 100644
+--- a/servant-client-core.cabal
++++ b/servant-client-core.cabal
+@@ -96,6 +96,7 @@ test-suite spec
+   main-is:             Spec.hs
+   other-modules:
+       Servant.Client.Core.Internal.BaseUrlSpec
++      Servant.Client.Core.RequestSpec
+ 
+   -- Dependencies inherited from the library. No need to specify bounds.
+   build-depends:
+diff --git a/src/Servant/Client/Core/Request.hs b/src/Servant/Client/Core/Request.hs
+index 73756e702..0276d46f8 100644
+--- a/src/Servant/Client/Core/Request.hs
++++ b/src/Servant/Client/Core/Request.hs
+@@ -64,8 +64,32 @@ data RequestF body path = Request
+   , requestHeaders     :: Seq.Seq Header
+   , requestHttpVersion :: HttpVersion
+   , requestMethod      :: Method
+-  } deriving (Generic, Typeable, Eq, Show, Functor, Foldable, Traversable)
++  } deriving (Generic, Typeable, Eq, Functor, Foldable, Traversable)
+ 
++instance (Show a, Show b) =>
++           Show (Servant.Client.Core.Request.RequestF a b) where
++    showsPrec p req
++      = showParen
++        (p >= 11)
++        ( showString "Request {requestPath = "
++        . showsPrec 0 (requestPath req)
++        . showString ", requestQueryString = "
++        . showsPrec 0 (requestQueryString req)
++        . showString ", requestBody = "
++        . showsPrec 0 (requestBody req)
++        . showString ", requestAccept = "
++        . showsPrec 0 (requestAccept req)
++        . showString ", requestHeaders = "
++        . showsPrec 0 (redactSensitiveHeader <$> requestHeaders req))
++        . showString ", requestHttpVersion = "
++        . showsPrec 0 (requestHttpVersion req)
++        . showString ", requestMethod = "
++        . showsPrec 0 (requestMethod req)
++        . showString "}"
++       where
++        redactSensitiveHeader :: Header -> Header
++        redactSensitiveHeader ("Authorization", _) = ("Authorization", "<REDACTED>")
++        redactSensitiveHeader h = h
+ instance Bifunctor RequestF where bimap = bimapDefault
+ instance Bifoldable RequestF where bifoldMap = bifoldMapDefault
+ instance Bitraversable RequestF where
+diff --git a/test/Servant/Client/Core/RequestSpec.hs b/test/Servant/Client/Core/RequestSpec.hs
+new file mode 100644
+index 000000000..99a1db7d3
+--- /dev/null
++++ b/test/Servant/Client/Core/RequestSpec.hs
+@@ -0,0 +1,19 @@
++{-# OPTIONS_GHC -fno-warn-orphans #-}
++{-# LANGUAGE OverloadedStrings #-}
++module Servant.Client.Core.RequestSpec (spec) where
++
++
++import           Prelude ()
++import           Prelude.Compat
++import           Control.Monad
++import           Data.List (isInfixOf)
++import           Servant.Client.Core.Request
++import           Test.Hspec
++
++spec :: Spec
++spec = do
++  describe "Request" $ do
++    describe "show" $ do
++      it "redacts the authorization header" $ do
++        let request = void $ defaultRequest { requestHeaders = pure ("authorization", "secret") }
++        isInfixOf "secret" (show request) `shouldBe` False
diff --git a/pkgs/development/haskell-modules/patches/servant-client-core-streamBody.patch b/pkgs/development/haskell-modules/patches/servant-client-core-streamBody.patch
deleted file mode 100644
index ebadd215cb76..000000000000
--- a/pkgs/development/haskell-modules/patches/servant-client-core-streamBody.patch
+++ /dev/null
@@ -1,82 +0,0 @@
-diff --git a/src/Servant/Client/Core/Internal/HasClient.hs b/src/Servant/Client/Core/Internal/HasClient.hs
-index 712007006..6be92ec6d 100644
---- a/src/Servant/Client/Core/Internal/HasClient.hs
-+++ b/src/Servant/Client/Core/Internal/HasClient.hs
-@@ -16,6 +16,8 @@ module Servant.Client.Core.Internal.HasClient where
- import           Prelude ()
- import           Prelude.Compat
- 
-+import           Control.Concurrent.MVar
-+                 (modifyMVar, newMVar)
- import qualified Data.ByteString                        as BS
- import qualified Data.ByteString.Lazy                   as BL
- import           Data.Foldable
-@@ -36,13 +38,14 @@ import qualified Network.HTTP.Types                     as H
- import           Servant.API
-                  ((:<|>) ((:<|>)), (:>), AuthProtect, BasicAuth, BasicAuthData,
-                  BuildHeadersTo (..), Capture', CaptureAll, Description,
--                 EmptyAPI, FramingUnrender (..), FromSourceIO (..), Header',
--                 Headers (..), HttpVersion, IsSecure, MimeRender (mimeRender),
-+                 EmptyAPI, FramingRender (..), FramingUnrender (..),
-+                 FromSourceIO (..), Header', Headers (..), HttpVersion,
-+                 IsSecure, MimeRender (mimeRender),
-                  MimeUnrender (mimeUnrender), NoContent (NoContent), QueryFlag,
-                  QueryParam', QueryParams, Raw, ReflectMethod (..), RemoteHost,
-                  ReqBody', SBoolI, Stream, StreamBody', Summary, ToHttpApiData,
--                 Vault, Verb, WithNamedContext, contentType, getHeadersHList,
--                 getResponse, toQueryParam, toUrlPiece)
-+                 ToSourceIO (..), Vault, Verb, WithNamedContext, contentType,
-+                 getHeadersHList, getResponse, toQueryParam, toUrlPiece)
- import           Servant.API.ContentTypes
-                  (contentTypes)
- import           Servant.API.Modifiers
-@@ -538,7 +541,7 @@ instance (MimeRender ct a, HasClient m api)
-     hoistClientMonad pm (Proxy :: Proxy api) f (cl a)
- 
- instance
--    ( HasClient m api
-+    ( HasClient m api, MimeRender ctype chunk, FramingRender framing, ToSourceIO chunk a
-     ) => HasClient m (StreamBody' mods framing ctype a :> api)
-   where
- 
-@@ -547,7 +550,39 @@ instance
-     hoistClientMonad pm _ f cl = \a ->
-       hoistClientMonad pm (Proxy :: Proxy api) f (cl a)
- 
--    clientWithRoute _pm Proxy _req _body = error "HasClient @StreamBody"
-+    clientWithRoute pm Proxy req body
-+        = clientWithRoute pm (Proxy :: Proxy api)
-+        $ setRequestBody (RequestBodyStreamChunked givesPopper) (contentType ctypeP) req
-+      where
-+        ctypeP   = Proxy :: Proxy ctype
-+        framingP = Proxy :: Proxy framing
-+
-+        sourceIO = framingRender
-+            framingP
-+            (mimeRender ctypeP :: chunk -> BL.ByteString)
-+            (toSourceIO body)
-+
-+        -- not pretty.
-+        givesPopper :: (IO BS.ByteString -> IO ()) -> IO ()
-+        givesPopper needsPopper = S.unSourceT sourceIO $ \step0 -> do
-+            ref <- newMVar step0
-+
-+            -- Note sure we need locking, but it's feels safer.
-+            let popper :: IO BS.ByteString
-+                popper = modifyMVar ref nextBs
-+
-+            needsPopper popper
-+
-+        nextBs S.Stop          = return (S.Stop, BS.empty)
-+        nextBs (S.Error err)   = fail err
-+        nextBs (S.Skip s)      = nextBs s
-+        nextBs (S.Effect ms)   = ms >>= nextBs
-+        nextBs (S.Yield lbs s) = case BL.toChunks lbs of
-+            []     -> nextBs s
-+            (x:xs) | BS.null x -> nextBs step'
-+                   | otherwise -> return (step', x)
-+                where
-+                  step' = S.Yield (BL.fromChunks xs) s
-
-
-
diff --git a/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh b/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh
index c99ef313c102..322a0336df2c 100644
--- a/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh
@@ -17,7 +17,7 @@ setuptoolsBuildPhase() {
     eval "@pythonInterpreter@ nix_run_setup $args bdist_wheel"
 
     runHook postBuild
-    echo "Finished executing setuptoolsInstallPhase"
+    echo "Finished executing setuptoolsBuildPhase"
 }
 
 setuptoolsShellHook() {
diff --git a/pkgs/development/libraries/arrow-cpp/default.nix b/pkgs/development/libraries/arrow-cpp/default.nix
index e277617c0ff8..f6f3493002ad 100644
--- a/pkgs/development/libraries/arrow-cpp/default.nix
+++ b/pkgs/development/libraries/arrow-cpp/default.nix
@@ -93,7 +93,7 @@ in stdenv.mkDerivation rec {
     ];
   in ''
     ctest -L unittest -V \
-      --exclude-regex '(${builtins.concatStringsSep "|" excludedTests})'
+      --exclude-regex '^(${builtins.concatStringsSep "|" excludedTests})$'
   '');
 
   meta = {
diff --git a/pkgs/development/libraries/at-spi2-atk/default.nix b/pkgs/development/libraries/at-spi2-atk/default.nix
index 4af9c9ce32b6..f63a341e26ea 100644
--- a/pkgs/development/libraries/at-spi2-atk/default.nix
+++ b/pkgs/development/libraries/at-spi2-atk/default.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "at-spi2-atk";
-  version = "2.34.0";
+  version = "2.34.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "00250s72ii8w6lb6ww61v49y9k4cswfj0hhawqlram7bl6b7x6is";
+    sha256 = "05ncp7s5nddjinffs26mcvpbd63vk1m3cv5y530p3plgfhqgjvbp";
   };
 
   nativeBuildInputs = [ meson ninja pkgconfig ];
diff --git a/pkgs/development/libraries/boehm-gc/default.nix b/pkgs/development/libraries/boehm-gc/default.nix
index bc8b7a8c7600..5ae6200473bd 100644
--- a/pkgs/development/libraries/boehm-gc/default.nix
+++ b/pkgs/development/libraries/boehm-gc/default.nix
@@ -1,4 +1,5 @@
 { lib, stdenv, fetchurl
+, autoreconfHook
 , enableLargeConfig ? false # doc: https://github.com/ivmai/bdwgc/blob/v7.6.6/doc/README.macros#L179
 }:
 
@@ -22,12 +23,17 @@ stdenv.mkDerivation rec {
   '';
 
   patches = # https://github.com/ivmai/bdwgc/pull/208
-    lib.optional stdenv.hostPlatform.isRiscV ./riscv.patch;
+    lib.optional stdenv.hostPlatform.isRiscV ./riscv.patch
+    # boehm-gc whitelists GCC threading models
+    ++ lib.optional stdenv.hostPlatform.isMinGW ./mcfgthread.patch;
 
   configureFlags =
     [ "--enable-cplusplus" "--with-libatomic-ops=none" ]
     ++ lib.optional enableLargeConfig "--enable-large-config";
 
+  nativeBuildInputs =
+    lib.optional stdenv.hostPlatform.isMinGW autoreconfHook;
+
   doCheck = true; # not cross;
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/boehm-gc/mcfgthread.patch b/pkgs/development/libraries/boehm-gc/mcfgthread.patch
new file mode 100644
index 000000000000..c4aa996aebd7
--- /dev/null
+++ b/pkgs/development/libraries/boehm-gc/mcfgthread.patch
@@ -0,0 +1,11 @@
+--- a/configure.ac
++++ b/configure.ac
+@@ -277,7 +277,7 @@ case "$THREADS" in
+         ;;
+     esac
+     ;;
+- win32)
++ win32 | mcf)
+     AC_DEFINE(GC_THREADS)
+     use_parallel_mark=$enable_parallel_mark
+     if test "${enable_parallel_mark}" != no \
diff --git a/pkgs/development/libraries/check/default.nix b/pkgs/development/libraries/check/default.nix
index 08610d1e9aff..6a94d9a71ce3 100644
--- a/pkgs/development/libraries/check/default.nix
+++ b/pkgs/development/libraries/check/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "check";
-  version = "0.12.0";
+  version = "0.13.0";
 
   src = fetchurl {
     url = "https://github.com/libcheck/check/releases/download/${version}/check-${version}.tar.gz";
-    sha256 = "0d22h8xshmbpl9hba9ch3xj8vb9ybm5akpsbbh7yj07fic4h2hj6";
+    sha256 = "02crar51gniijrrl9p8f9maibnwc33n76kw5cqr7xk3s8hqnncy4";
   };
 
   # Test can randomly fail: http://hydra.nixos.org/build/7243912
diff --git a/pkgs/development/libraries/fdk-aac/default.nix b/pkgs/development/libraries/fdk-aac/default.nix
index 70269002e2fe..16560f19c861 100644
--- a/pkgs/development/libraries/fdk-aac/default.nix
+++ b/pkgs/development/libraries/fdk-aac/default.nix
@@ -5,11 +5,11 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
   pname = "fdk-aac";
-  version = "2.0.0";
+  version = "2.0.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/opencore-amr/fdk-aac/${pname}-${version}.tar.gz";
-    sha256 = "0v6rbyw9f9lpfvcg3v1qyapga5hqfnb3wp3x5yaxpwcgjw7ydmpp";
+    sha256 = "0wgjjc0dfkm2w966lc9c8ir8f671vl1ppch3mya3h58jjjm360c4";
   };
 
   configureFlags = [ ]
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index 68bc169bb89b..494d0a61f062 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -48,11 +48,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "glib";
-  version = "2.62.1";
+  version = "2.62.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1pzrw2x9r0kyghrvwdbx3nqn2wcrrxy962f5gbdacwh83m705n9x";
+    sha256 = "1wdkvqq6fkk99smmnjg7d999v4qhbgs7halwfcwz0vgp2fj29239";
   };
 
   patches = optionals stdenv.isDarwin [
diff --git a/pkgs/development/libraries/gnu-efi/default.nix b/pkgs/development/libraries/gnu-efi/default.nix
index 6ae1f47e38cd..0d704f74c1e9 100644
--- a/pkgs/development/libraries/gnu-efi/default.nix
+++ b/pkgs/development/libraries/gnu-efi/default.nix
@@ -4,11 +4,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "gnu-efi";
-  version = "3.0.9";
+  version = "3.0.11";
 
   src = fetchurl {
     url = "mirror://sourceforge/gnu-efi/${pname}-${version}.tar.bz2";
-    sha256 = "1w3p4aqlc5j93q44la7dc8cr3hky20zvsd0h0k2lyzhwmrzfl5b7";
+    sha256 = "1ffnc4xbzfggs37ymrgfx76j56kk2644c081ivhr2bjkla9ag3gj";
   };
 
   buildInputs = [ pciutils ];
diff --git a/pkgs/development/libraries/gtest/default.nix b/pkgs/development/libraries/gtest/default.nix
index 5fecd45b7da1..4326be597246 100644
--- a/pkgs/development/libraries/gtest/default.nix
+++ b/pkgs/development/libraries/gtest/default.nix
@@ -3,7 +3,7 @@
 
 stdenv.mkDerivation rec {
   pname = "gtest";
-  version = "1.8.1";
+  version = "1.10.0";
 
   outputs = [ "out" "dev" ];
 
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     owner = "google";
     repo = "googletest";
     rev = "release-${version}";
-    sha256 = "0270msj6n7mggh4xqqjp54kswbl7mkcc8px1p5dqdpmw5ngh9fzk";
+    sha256 = "1zbmab9295scgg4z2vclgfgjchfjailjnvzc6f5x9jvlsdi3dpwz";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/harfbuzz/default.nix b/pkgs/development/libraries/harfbuzz/default.nix
index 361ac4f27aa0..42f68eea83f2 100644
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@@ -8,7 +8,7 @@
 }:
 
 let
-  version = "2.6.2";
+  version = "2.6.4";
   inherit (stdenv.lib) optional optionals optionalString;
 in
 
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/harfbuzz/release/harfbuzz-${version}.tar.xz";
-    sha256 = "097ncrkaawdzpgwlrpp4kwciq4z5pqz2n4f3yra5vc7jyxr6lk1v";
+    sha256 = "04iwq13w6zkdhljmsxrzgg4fyh04qnwfn57rgrl9kmijc7cvh4wl";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/ilmbase/default.nix b/pkgs/development/libraries/ilmbase/default.nix
index 5cc0f7c1f46d..82d5583c55fc 100644
--- a/pkgs/development/libraries/ilmbase/default.nix
+++ b/pkgs/development/libraries/ilmbase/default.nix
@@ -1,4 +1,5 @@
-{ stdenv, fetchurl, buildPackages, automake, autoconf, libtool, which }:
+{ stdenv, fetchurl, buildPackages, automake, autoconf, libtool, which,
+  fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "ilmbase";
@@ -21,7 +22,17 @@ stdenv.mkDerivation rec {
 
   NIX_CFLAGS_LINK = [ "-pthread" ];
 
-  patches = [ ./bootstrap.patch ./cross.patch ];
+  patches = [
+    ./bootstrap.patch
+    ./cross.patch
+    (fetchpatch {
+      name = "CVE-2018-18443.patch";
+      url = "https://github.com/kdt3rd/openexr/commit/5fa930b82cff2db386c64ca512af19e60c14d32a.patch";
+      sha256 = "1j6xd0qkx99acc1szycxaj0wwp01yac67jz48hwc4fwwpz8blx4s";
+      stripLen = 1;
+      excludes = [ "CHANGES.md" ];
+    })
+  ];
 
   # fails 1 out of 1 tests with
   # "lt-ImathTest: testBoxAlgo.cpp:892: void {anonymous}::boxMatrixTransform(): Assertion `b21 == b2' failed"
diff --git a/pkgs/development/libraries/jbig2dec/default.nix b/pkgs/development/libraries/jbig2dec/default.nix
index 31c9c89d96fc..35fbdfe488af 100644
--- a/pkgs/development/libraries/jbig2dec/default.nix
+++ b/pkgs/development/libraries/jbig2dec/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, python, autoconf }:
 
 stdenv.mkDerivation rec {
-  name = "jbig2dec-0.16";
+  name = "jbig2dec-0.17";
 
   src = fetchurl {
-    url = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs927/${name}.tar.gz";
-    sha256 = "00h61y7bh3z6mqfzxyb318gyh0f8jwarg4hvlrm83rqps8avzxm4";
+    url = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs950/${name}.tar.gz";
+    sha256 = "0wpvslmwazia3z8gyk343kbq6yj47pxr4x5yjvx332v309qssazp";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/libical/default.nix b/pkgs/development/libraries/libical/default.nix
index 050cba5460d9..903a1a26eb71 100644
--- a/pkgs/development/libraries/libical/default.nix
+++ b/pkgs/development/libraries/libical/default.nix
@@ -15,7 +15,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libical";
-  version = "3.0.5";
+  version = "3.0.6";
 
   outputs = [ "out" "dev" ]; # "devdoc" ];
 
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     owner = "libical";
     repo = "libical";
     rev = "v${version}";
-    sha256 = "03kjc4s1svmzkmzkr0irgczq37aslhj4bxnvjqav0jwa2zrynhra";
+    sha256 = "181lf07fj36fp0rbcjjmb53yzdvv9i4qxpnbpax8hayjhha8pjh3";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libinput/default.nix b/pkgs/development/libraries/libinput/default.nix
index 044ef2dd6a79..2085d27a1ee1 100644
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@@ -27,11 +27,11 @@ in
 with stdenv.lib;
 stdenv.mkDerivation rec {
   pname = "libinput";
-  version = "1.14.1";
+  version = "1.14.3";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/libinput/${pname}-${version}.tar.xz";
-    sha256 = "0w7fas37mp2k06f12i3lnj717lw73asziknj6z51kh1m50ja6cz3";
+    sha256 = "1dy58j8dvr7ri34bx0lppmh5638m956azgwk501w373hi42kmsqg";
   };
 
   outputs = [ "bin" "out" "dev" ];
diff --git a/pkgs/development/libraries/libmicrohttpd/default.nix b/pkgs/development/libraries/libmicrohttpd/default.nix
index 866edcc437cf..c83406269354 100644
--- a/pkgs/development/libraries/libmicrohttpd/default.nix
+++ b/pkgs/development/libraries/libmicrohttpd/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libmicrohttpd";
-  version = "0.9.67";
+  version = "0.9.68";
 
   src = fetchurl {
     url = "mirror://gnu/libmicrohttpd/${pname}-${version}.tar.gz";
-    sha256 = "1584lv2miq7sp7yjd58lcbddh3yh5p8f9gbygn1d96fh4ckqa7vy";
+    sha256 = "0q8bc4hrxn6llml7w2vam6n833x8injs39wgdkhwkawr50m6wwf5";
   };
 
   outputs = [ "out" "dev" "devdoc" "info" ];
diff --git a/pkgs/development/libraries/librsvg/default.nix b/pkgs/development/libraries/librsvg/default.nix
index e54098b44598..e9a67c5d0598 100644
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@@ -4,14 +4,14 @@
 
 let
   pname = "librsvg";
-  version = "2.46.1";
+  version = "2.46.3";
 in
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "0hvnqrgfi8c2xh94gxs6xwwg1m2z3l0lblqs2anlx8k3g9ag589d";
+    sha256 = "1s3a96i7f4pynjwxxvhysp4b6r7kyi8nasdxfyi62hc7gm34d3kn";
   };
 
   outputs = [ "out" "dev" "installedTests" ];
diff --git a/pkgs/development/libraries/libuv/default.nix b/pkgs/development/libraries/libuv/default.nix
index f9b49a46ebf2..3c4f90edeccc 100644
--- a/pkgs/development/libraries/libuv/default.nix
+++ b/pkgs/development/libraries/libuv/default.nix
@@ -1,14 +1,14 @@
 { stdenv, lib, fetchFromGitHub, autoconf, automake, libtool, pkgconfig, ApplicationServices, CoreServices }:
 
 stdenv.mkDerivation rec {
-  version = "1.32.0";
+  version = "1.33.1";
   pname = "libuv";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "1ifazxr5ssw2ay6j66acaxgfwq0x8130fvsyjs1wxvf2r9g4ds9w";
+    sha256 = "13w60g9pc6998v8plslwpwn7f1hx3c1y4zhgmw025nyd504h5lak";
   };
 
   postPatch = let
diff --git a/pkgs/development/libraries/libxml2/default.nix b/pkgs/development/libraries/libxml2/default.nix
index 04954f3e1f5f..7ed50f612243 100644
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@@ -1,15 +1,12 @@
 { stdenv, lib, fetchurl
-, zlib, xz, python2, ncurses, findXMLCatalogs
+, zlib, xz, python, ncurses, findXMLCatalogs
 , pythonSupport ? stdenv.buildPlatform == stdenv.hostPlatform
 , icuSupport ? false, icu ? null
 , enableShared ? stdenv.hostPlatform.libc != "msvcrt"
 , enableStatic ? !enableShared,
 }:
 
-let
-  python = python2;
-
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "libxml2";
   version = "2.9.9";
 
@@ -17,6 +14,20 @@ in stdenv.mkDerivation rec {
     url = "http://xmlsoft.org/sources/${pname}-${version}.tar.gz";
     sha256 = "0wd881jzvqayx0ihzba29jl80k06xj9ywp16kxacdqs3064p1ywl";
   };
+  patches = [
+    # Upstream bugs:
+    #   https://bugzilla.gnome.org/show_bug.cgi?id=789714
+    #   https://gitlab.gnome.org/GNOME/libxml2/issues/64
+    # Patch from https://bugzilla.opensuse.org/show_bug.cgi?id=1065270 ,
+    # but only the UTF-8 part.
+    # Can also be mitigated by fixing malformed XML inputs, such as in
+    # https://gitlab.gnome.org/GNOME/gnumeric/merge_requests/3 .
+    # Other discussion:
+    #   https://github.com/itstool/itstool/issues/22
+    #   https://github.com/NixOS/nixpkgs/pull/63174
+    #   https://github.com/NixOS/nixpkgs/pull/72342
+    ./utf8-xmlErrorFuncHandler.patch
+  ];
 
   outputs = [ "bin" "dev" "out" "man" "doc" ]
     ++ lib.optional pythonSupport "py"
diff --git a/pkgs/development/libraries/libxml2/utf8-xmlErrorFuncHandler.patch b/pkgs/development/libraries/libxml2/utf8-xmlErrorFuncHandler.patch
new file mode 100644
index 000000000000..9f4c99b09341
--- /dev/null
+++ b/pkgs/development/libraries/libxml2/utf8-xmlErrorFuncHandler.patch
@@ -0,0 +1,30 @@
+Index: libxml2-2.9.5/python/libxml.c
+===================================================================
+--- libxml2-2.9.5.orig/python/libxml.c
++++ libxml2-2.9.5/python/libxml.c
+@@ -1620,6 +1620,7 @@ libxml_xmlErrorFuncHandler(ATTRIBUTE_UNU
+     PyObject *message;
+     PyObject *result;
+     char str[1000];
++    unsigned char *ptr = (unsigned char *)str;
+ 
+ #ifdef DEBUG_ERROR
+     printf("libxml_xmlErrorFuncHandler(%p, %s, ...) called\n", ctx, msg);
+@@ -1636,10 +1637,16 @@ libxml_xmlErrorFuncHandler(ATTRIBUTE_UNU
+ 	    str[999] = 0;
+         va_end(ap);
+ 
++#if PY_MAJOR_VERSION >= 3
++        /* Ensure the error string doesn't start at UTF8 continuation. */
++        while (*ptr && (*ptr & 0xc0) == 0x80)
++            ptr++;
++#endif
++
+         list = PyTuple_New(2);
+         PyTuple_SetItem(list, 0, libxml_xmlPythonErrorFuncCtxt);
+         Py_XINCREF(libxml_xmlPythonErrorFuncCtxt);
+-        message = libxml_charPtrConstWrap(str);
++        message = libxml_charPtrConstWrap(ptr);
+         PyTuple_SetItem(list, 1, message);
+         result = PyEval_CallObject(libxml_xmlPythonErrorFuncHandler, list);
+         Py_XDECREF(list);
diff --git a/pkgs/development/libraries/libxslt/default.nix b/pkgs/development/libraries/libxslt/default.nix
index 1a3efee176a0..ed77a1873a80 100644
--- a/pkgs/development/libraries/libxslt/default.nix
+++ b/pkgs/development/libraries/libxslt/default.nix
@@ -1,9 +1,9 @@
-{ stdenv, fetchurl, fetchpatch, libxml2, findXMLCatalogs, python2, libgcrypt
+{ stdenv, fetchurl, fetchpatch, libxml2, findXMLCatalogs, python, libgcrypt
 , cryptoSupport ? false
 , pythonSupport ? stdenv.buildPlatform == stdenv.hostPlatform
 }:
 
-assert pythonSupport -> python2 != null;
+assert pythonSupport -> python != null;
 assert pythonSupport -> libxml2.pythonSupport;
 
 with stdenv.lib;
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
   outputs = [ "bin" "dev" "out" "man" "doc" ] ++ stdenv.lib.optional pythonSupport "py";
 
   buildInputs = [ libxml2.dev ]
-    ++ stdenv.lib.optionals pythonSupport [ libxml2.py python2 ]
+    ++ stdenv.lib.optionals pythonSupport [ libxml2.py python ]
     ++ stdenv.lib.optionals cryptoSupport [ libgcrypt ];
 
   propagatedBuildInputs = [ findXMLCatalogs ];
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
     "--without-debug"
     "--without-mem-debug"
     "--without-debugger"
-  ] ++ optional pythonSupport "--with-python=${python2}"
+  ] ++ optional pythonSupport "--with-python=${python}"
     ++ optional (!cryptoSupport) "--without-crypto";
 
   postFixup = ''
@@ -58,7 +58,7 @@ stdenv.mkDerivation rec {
   '' + optionalString pythonSupport ''
     mkdir -p $py/nix-support
     echo ${libxml2.py} >> $py/nix-support/propagated-build-inputs
-    moveToOutput lib/python2.7 "$py"
+    moveToOutput ${python.libPrefix} "$py"
   '';
 
   passthru = {
diff --git a/pkgs/development/libraries/nghttp2/default.nix b/pkgs/development/libraries/nghttp2/default.nix
index d02247196b1a..04018f0e80b5 100644
--- a/pkgs/development/libraries/nghttp2/default.nix
+++ b/pkgs/development/libraries/nghttp2/default.nix
@@ -1,7 +1,9 @@
 { stdenv, fetchurl, pkgconfig
 
 # Optional Dependencies
-, openssl ? null, libev ? null, zlib ? null, c-ares ? null
+, openssl ? null, zlib ? null
+, enableLibEv ? !stdenv.hostPlatform.isWindows, libev ? null
+, enableCAres ? !stdenv.hostPlatform.isWindows, c-ares ? null
 , enableHpack ? false, jansson ? null
 , enableAsioLib ? false, boost ? null
 , enableGetAssets ? false, libxml2 ? null
@@ -28,7 +30,10 @@ stdenv.mkDerivation rec {
   outputs = [ "bin" "out" "dev" "lib" ];
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ openssl libev zlib c-ares ]
+  buildInputs = [ openssl ]
+    ++ optional enableLibEv libev
+    ++ [ zlib ]
+    ++ optional enableCAres c-ares
     ++ optional enableHpack jansson
     ++ optional enableAsioLib boost
     ++ optional enableGetAssets libxml2
diff --git a/pkgs/development/libraries/nspr/default.nix b/pkgs/development/libraries/nspr/default.nix
index f5e4843a826e..23587cbef6b7 100644
--- a/pkgs/development/libraries/nspr/default.nix
+++ b/pkgs/development/libraries/nspr/default.nix
@@ -2,7 +2,7 @@
 , CoreServices ? null
 , buildPackages }:
 
-let version = "4.22"; in
+let version = "4.23"; in
 
 stdenv.mkDerivation {
   pname = "nspr";
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "mirror://mozilla/nspr/releases/v${version}/src/nspr-${version}.tar.gz";
-    sha256 = "0c6ljv3bdqhc169srbpjy0cs52xk715p04zy08rcjvl54k6bdr69";
+    sha256 = "193p6i2r6wvpb4i04a9pxbqkxcn8rbcmwl81m4yp5xgs6w8857ab";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/openal-soft/default.nix b/pkgs/development/libraries/openal-soft/default.nix
index 89ac85b752b7..76f2861428d6 100644
--- a/pkgs/development/libraries/openal-soft/default.nix
+++ b/pkgs/development/libraries/openal-soft/default.nix
@@ -20,6 +20,14 @@ stdenv.mkDerivation rec {
     sha256 = "0b0g0q1c36nfb289xcaaj3cmyfpiswvvgky3qyalsf9n4dj7vnzi";
   };
 
+  # this will make it find its own data files (e.g. HRTF profiles)
+  # without any other configuration
+  patches = [ ./search-out.patch ];
+  postPatch = ''
+    substituteInPlace Alc/helpers.c \
+      --replace "@OUT@" $out
+  '';
+
   nativeBuildInputs = [ cmake ];
 
   buildInputs = []
diff --git a/pkgs/development/libraries/openal-soft/search-out.patch b/pkgs/development/libraries/openal-soft/search-out.patch
new file mode 100644
index 000000000000..0f9c2abad3c3
--- /dev/null
+++ b/pkgs/development/libraries/openal-soft/search-out.patch
@@ -0,0 +1,12 @@
+diff -Nuar a/Alc/helpers.c b/Alc/helpers.c
+--- a/Alc/helpers.c	1970-01-01 00:00:01.000000000 +0000
++++ b/Alc/helpers.c	1970-01-01 00:00:02.000000000 +0000
+@@ -951,6 +951,8 @@
+             }
+         }
+ 
++        DirectorySearch("@OUT@/share", ext, &results);
++
+         alstr_reset(&path);
+     }
+ 
diff --git a/pkgs/development/libraries/openexr/default.nix b/pkgs/development/libraries/openexr/default.nix
index 9eef138c532e..7bd3985c12b2 100644
--- a/pkgs/development/libraries/openexr/default.nix
+++ b/pkgs/development/libraries/openexr/default.nix
@@ -1,4 +1,5 @@
-{ lib, stdenv, buildPackages, fetchurl, autoconf, automake, libtool, pkgconfig, zlib, ilmbase, }:
+{ lib, stdenv, buildPackages, fetchurl, autoconf, automake, libtool, pkgconfig,
+  zlib, ilmbase, fetchpatch }:
 
 let
   # Doesn't really do anything when not crosscompiling
@@ -16,6 +17,12 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./bootstrap.patch
+    (fetchpatch {
+      name = "CVE-2018-18444.patch";
+      url = "https://github.com/openexr/openexr/commit/1b0f1e5d7dcf2e9d6cbb4e005e803808b010b1e0.patch";
+      sha256 = "0f5m4wdwqqg8wfg7azzsz5yfpdrvws314rd4sqfc74j1g6wrcnqj";
+      stripLen = 1;
+    })
   ];
 
   outputs = [ "bin" "dev" "out" "doc" ];
diff --git a/pkgs/development/libraries/pcre/default.nix b/pkgs/development/libraries/pcre/default.nix
index 2e111240758d..cf08f9893697 100644
--- a/pkgs/development/libraries/pcre/default.nix
+++ b/pkgs/development/libraries/pcre/default.nix
@@ -29,8 +29,6 @@ in stdenv.mkDerivation {
   ]
     ++ optional (variant != null) "--enable-${variant}";
 
-  buildInputs = optional (stdenv.hostPlatform.libc == "msvcrt") windows.mingw_w64_pthreads;
-
   # https://bugs.exim.org/show_bug.cgi?id=2173
   patches = [ ./stacksize-detection.patch ];
 
diff --git a/pkgs/development/libraries/polkit/default.nix b/pkgs/development/libraries/polkit/default.nix
index 9fdf53a13724..05813bf29dca 100644
--- a/pkgs/development/libraries/polkit/default.nix
+++ b/pkgs/development/libraries/polkit/default.nix
@@ -28,8 +28,9 @@ stdenv.mkDerivation rec {
 
   patches = [
     # Don't use etc/dbus-1/system.d
+    # Upstream MR: https://gitlab.freedesktop.org/polkit/polkit/merge_requests/11
     (fetchpatch {
-      url = "https://gitlab.freedesktop.org/polkit/polkit/merge_requests/11.patch";
+      url = "https://gitlab.freedesktop.org/polkit/polkit/commit/5dd4e22efd05d55833c4634b56e473812b5acbf2.patch";
       sha256 = "17lv7xj5ksa27iv4zpm4zwd4iy8zbwjj4ximslfq3sasiz9kxhlp";
     })
   ] ++ stdenv.lib.optionals stdenv.hostPlatform.isMusl [
diff --git a/pkgs/development/libraries/rocksdb/default.nix b/pkgs/development/libraries/rocksdb/default.nix
index d2ea22b85a1a..2bb56bec8c0a 100644
--- a/pkgs/development/libraries/rocksdb/default.nix
+++ b/pkgs/development/libraries/rocksdb/default.nix
@@ -30,6 +30,7 @@ stdenv.mkDerivation rec {
     "-DWITH_ZLIB=1"
     "-DWITH_ZSTD=1"
     "-DWITH_GFLAGS=0"
+    "-DUSE_RTTI=1"
     (lib.optional
         (stdenv.hostPlatform.system == "i686-linux"
          || stdenv.hostPlatform.system == "x86_64-linux")
diff --git a/pkgs/development/python-modules/Babel/default.nix b/pkgs/development/python-modules/Babel/default.nix
index 96226518800a..97b352578209 100644
--- a/pkgs/development/python-modules/Babel/default.nix
+++ b/pkgs/development/python-modules/Babel/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchPypi, pytz, pytest, freezegun, glibcLocales }:
+{ stdenv, lib, buildPythonPackage, fetchPypi, pytz, pytest, freezegun, glibcLocales }:
 
 buildPythonPackage rec {
   pname = "Babel";
@@ -13,6 +13,8 @@ buildPythonPackage rec {
 
   checkInputs = [ pytest freezegun glibcLocales ];
 
+  doCheck = !stdenv.isDarwin;
+
   preCheck = ''
     export LC_ALL="en_US.UTF-8"
   '';
diff --git a/pkgs/development/python-modules/datasette/default.nix b/pkgs/development/python-modules/datasette/default.nix
index 828976f0e9fb..7210aa6b1e31 100644
--- a/pkgs/development/python-modules/datasette/default.nix
+++ b/pkgs/development/python-modules/datasette/default.nix
@@ -20,16 +20,16 @@
 
 buildPythonPackage rec {
   pname = "datasette";
-  version = "0.29.3";
+  version = "0.30.2";
 
   src = fetchFromGitHub {
     owner = "simonw";
     repo = "datasette";
     rev = version;
-    sha256 = "0cib7pd4z240ncck0pskzvizblhwkr42fsjpd719wdxy4scs7yqa";
+    sha256 = "07swnpz4c7vzlc69vavs1xvbhr5fa8g63kyfj1hf3zafskgjnzwy";
   };
 
-  buildInputs = [ pytestrunner ];
+  nativeBuildInputs = [ pytestrunner ];
 
   propagatedBuildInputs = [
     click
@@ -57,15 +57,19 @@ buildPythonPackage rec {
       --replace "Sanic==0.7.0" "Sanic" \
       --replace "hupper==1.0" "hupper" \
       --replace "pint~=0.8.1" "pint" \
+      --replace "pluggy~=0.12.0" "pint" \
       --replace "Jinja2==2.10.1" "Jinja2" \
       --replace "uvicorn~=0.8.4" "uvicorn"
   '';
 
   # many tests require network access
+  # test_black fails on darwin
   checkPhase = ''
     pytest --ignore tests/test_api.py \
            --ignore tests/test_csv.py \
-           --ignore tests/test_html.py
+           --ignore tests/test_html.py \
+           --ignore tests/test_black.py \
+           -k 'not facet'
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/google_cloud_vision/default.nix b/pkgs/development/python-modules/google_cloud_vision/default.nix
index a8d748db126d..10c8792b9c86 100644
--- a/pkgs/development/python-modules/google_cloud_vision/default.nix
+++ b/pkgs/development/python-modules/google_cloud_vision/default.nix
@@ -3,7 +3,6 @@
 , fetchPypi
 , enum34
 , google_api_core
-, pytest
 , mock
 }:
 
@@ -16,11 +15,13 @@ buildPythonPackage rec {
     sha256 = "f33aea6721d453901ded268dee61a01ab77d4cd215a76edc3cc61b6028299d3e";
   };
 
-  checkInputs = [ pytest mock ];
+  checkInputs = [ mock ];
   propagatedBuildInputs = [ enum34 google_api_core ];
 
+  # pytest seems to pick up some file which overrides PYTHONPATH
   checkPhase = ''
-    pytest tests/unit
+    cd tests/unit
+    python -m unittest discover
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/python-modules/jsonlines/default.nix b/pkgs/development/python-modules/jsonlines/default.nix
new file mode 100644
index 000000000000..eec4c6b38469
--- /dev/null
+++ b/pkgs/development/python-modules/jsonlines/default.nix
@@ -0,0 +1,28 @@
+{ lib, fetchFromGitHub, buildPythonPackage, six
+, flake8, pep8-naming, pytest, pytestcov, pytestpep8 }:
+
+buildPythonPackage rec {
+  pname = "jsonlines";
+  version = "1.2.0";
+
+  src = fetchFromGitHub {
+    owner = "wbolster";
+    repo = pname;
+    rev = version;
+    sha256 = "1f8zsqy8p9a41gqg2a5x7sppc5qhhq7gw58id2aigb270yxzs7jw";
+  };
+
+  propagatedBuildInputs = [ six ];
+
+  checkInputs = [ flake8 pep8-naming pytest pytestcov pytestpep8 ];
+  checkPhase = ''
+    pytest
+  '';
+
+  meta = with lib; {
+    description = "Python library to simplify working with jsonlines and ndjson data";
+    homepage = https://github.com/wbolster/jsonlines;
+    maintainers = with maintainers; [ sondr3 ];
+    license = licenses.bsd3;
+  };
+}
diff --git a/pkgs/development/python-modules/jupyterlab_server/default.nix b/pkgs/development/python-modules/jupyterlab_server/default.nix
index 6d0da2925cc2..edfe01728a49 100644
--- a/pkgs/development/python-modules/jupyterlab_server/default.nix
+++ b/pkgs/development/python-modules/jupyterlab_server/default.nix
@@ -6,6 +6,7 @@
 , pythonOlder
 , requests
 , pytest
+, pyjson5
 }:
 
 buildPythonPackage rec {
@@ -19,7 +20,7 @@ buildPythonPackage rec {
   };
 
   checkInputs = [ requests pytest ];
-  propagatedBuildInputs = [ notebook jsonschema ];
+  propagatedBuildInputs = [ notebook jsonschema pyjson5 ];
 
   # test_listing test fails
   # this is a new package and not all tests pass
diff --git a/pkgs/development/python-modules/pyjson5/default.nix b/pkgs/development/python-modules/pyjson5/default.nix
new file mode 100644
index 000000000000..232bafd3ba7e
--- /dev/null
+++ b/pkgs/development/python-modules/pyjson5/default.nix
@@ -0,0 +1,26 @@
+{ buildPythonPackage, lib, nose, fetchFromGitHub }:
+
+buildPythonPackage rec {
+  pname = "pyjson5";
+  version = "0.8.5";
+
+  src = fetchFromGitHub {
+    owner = "dpranke";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0nyngj18jlkgvm1177lc3cj47wm4yh3dqigygvcvw7xkyryafsqn";
+  };
+
+  doCheck = true;
+  checkInputs = [ nose ];
+  checkPhase = ''
+    nosetests
+  '';
+
+  meta = with lib; {
+    description = "Python implementation of the JSON5 data format";
+    license = licenses.asl20;
+    homepage = "https://github.com/dpranke/pyjson5";
+    maintainers = with maintainers; [ isgy ];
+  };
+}
diff --git a/pkgs/development/python-modules/recommonmark/default.nix b/pkgs/development/python-modules/recommonmark/default.nix
index f6965fd6cd93..98cee494f3f1 100644
--- a/pkgs/development/python-modules/recommonmark/default.nix
+++ b/pkgs/development/python-modules/recommonmark/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, pytest
+, pytestCheckHook
 , CommonMark
 , docutils
 , sphinx
@@ -9,22 +9,26 @@
 
 buildPythonPackage rec {
   pname = "recommonmark";
-  version = "0.5.0";
+  version = "0.6.0";
 
   # PyPI tarball is missing some test files: https://github.com/rtfd/recommonmark/pull/128
   src = fetchFromGitHub {
     owner = "rtfd";
     repo = pname;
     rev = version;
-    sha256 = "04bjqx2hczmg7rnj2rpsjk7h24diwk83s6fhgrxk00k40w2bpz5j";
+    sha256 = "0m6qk17irka448vcz5b39yck1qsq90k98dmkx80mni0w00yq9ggd";
   };
 
-  checkInputs = [ pytest ];
+  checkInputs = [ pytestCheckHook ];
   propagatedBuildInputs = [ CommonMark docutils sphinx ];
 
-  checkPhase = ''
-    py.test
-  '';
+  dontUseSetuptoolsCheck = true;
+
+  disabledTests = [
+    # https://github.com/readthedocs/recommonmark/issues/164
+    "test_lists"
+    "test_integration"
+  ];
 
   meta = {
     description = "A docutils-compatibility bridge to CommonMark";
diff --git a/pkgs/development/python-modules/sphinx/2.nix b/pkgs/development/python-modules/sphinx/2.nix
new file mode 100644
index 000000000000..b6374989690e
--- /dev/null
+++ b/pkgs/development/python-modules/sphinx/2.nix
@@ -0,0 +1,75 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pytest
+, simplejson
+, mock
+, glibcLocales
+, html5lib
+, pythonOlder
+, enum34
+, python
+, docutils
+, jinja2
+, pygments
+, alabaster
+, Babel
+, snowballstemmer
+, six
+, sqlalchemy
+, whoosh
+, imagesize
+, requests
+, typing
+, sphinxcontrib-websupport
+, setuptools
+}:
+
+buildPythonPackage rec {
+  pname = "sphinx";
+  version = "1.8.5";
+  src = fetchPypi {
+    pname = "Sphinx";
+    inherit version;
+    sha256 = "c7658aab75c920288a8cf6f09f244c6cfdae30d82d803ac1634d9f223a80ca08";
+  };
+  LC_ALL = "en_US.UTF-8";
+
+  checkInputs = [ pytest ];
+  buildInputs = [ simplejson mock glibcLocales html5lib ] ++ lib.optional (pythonOlder "3.4") enum34;
+  # Disable two tests that require network access.
+  checkPhase = ''
+    cd tests; ${python.interpreter} run.py --ignore py35 -k 'not test_defaults and not test_anchors_ignored'
+  '';
+  propagatedBuildInputs = [
+    docutils
+    jinja2
+    pygments
+    alabaster
+    Babel
+    setuptools
+    snowballstemmer
+    six
+    sphinxcontrib-websupport
+    sqlalchemy
+    whoosh
+    imagesize
+    requests
+  ] ++ lib.optional (pythonOlder "3.5") typing;
+
+  # Lots of tests. Needs network as well at some point.
+  doCheck = false;
+
+  # https://github.com/NixOS/nixpkgs/issues/22501
+  # Do not run `python sphinx-build arguments` but `sphinx-build arguments`.
+  postPatch = ''
+    substituteInPlace sphinx/make_mode.py --replace "sys.executable, " ""
+  '';
+
+  meta = {
+    description = "A tool that makes it easy to create intelligent and beautiful documentation for Python projects";
+    homepage = http://sphinx.pocoo.org/;
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ nand0p ];
+  };
+}
diff --git a/pkgs/development/python-modules/sphinx/default.nix b/pkgs/development/python-modules/sphinx/default.nix
index 1e69692eac1e..307232903e89 100644
--- a/pkgs/development/python-modules/sphinx/default.nix
+++ b/pkgs/development/python-modules/sphinx/default.nix
@@ -20,6 +20,12 @@
 , whoosh
 , imagesize
 , requests
+, sphinxcontrib-applehelp
+, sphinxcontrib-devhelp
+, sphinxcontrib-htmlhelp
+, sphinxcontrib-jsmath
+, sphinxcontrib-qthelp
+, sphinxcontrib-serializinghtml
 , sphinxcontrib-websupport
 , typing
 , setuptools
@@ -27,11 +33,11 @@
 
 buildPythonPackage rec {
   pname = "sphinx";
-  version = "1.8.3";
+  version = "2.2.0";
   src = fetchPypi {
     pname = "Sphinx";
     inherit version;
-    sha256 = "c4cb17ba44acffae3d3209646b6baec1e215cad3065e852c68cc569d4df1b9f8";
+    sha256 = "0d586b0f8c2fc3cc6559c5e8fd6124628110514fda0e5d7c82e682d749d2e845";
   };
   LC_ALL = "en_US.UTF-8";
 
@@ -54,6 +60,12 @@ buildPythonPackage rec {
     whoosh
     imagesize
     requests
+    sphinxcontrib-applehelp
+    sphinxcontrib-devhelp
+    sphinxcontrib-htmlhelp
+    sphinxcontrib-jsmath
+    sphinxcontrib-qthelp
+    sphinxcontrib-serializinghtml
     sphinxcontrib-websupport
   ] ++ lib.optional (pythonOlder "3.5") typing;
 
diff --git a/pkgs/development/python-modules/websockets/default.nix b/pkgs/development/python-modules/websockets/default.nix
index 9202d02ad5b9..1e1e1ef58a8e 100644
--- a/pkgs/development/python-modules/websockets/default.nix
+++ b/pkgs/development/python-modules/websockets/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "websockets";
-  version = "8.0.2";
+  version = "8.1";
 
   src = fetchFromGitHub {
     owner = "aaugustin";
     repo = pname;
     rev = version;
-    sha256 = "02fgb8gib4z5fqv30brz3mhxmblw9bw0978fhpjdrkj7wvqrz5h8";
+    sha256 = "05jbqcbjg50ydwl0fijhdlqcq7fl6v99kjva66kmmzzza7vwa872";
   };
 
   disabled = pythonOlder "3.3";
diff --git a/pkgs/development/python-modules/wurlitzer/default.nix b/pkgs/development/python-modules/wurlitzer/default.nix
index 8a4d96515d7c..b946d23acf60 100644
--- a/pkgs/development/python-modules/wurlitzer/default.nix
+++ b/pkgs/development/python-modules/wurlitzer/default.nix
@@ -1,8 +1,10 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, isPy27
 , mock
 , pytest
+, selectors2
 }:
 
 buildPythonPackage rec {
@@ -14,6 +16,8 @@ buildPythonPackage rec {
     sha256 = "0xndv47iwc9k8cp5r9r1z3r0xww0r5x5b7qsmn39gk2gsg0119c6";
   };
 
+  propagatedBuildInputs = lib.optionals isPy27 [ selectors2 ];
+
   checkInputs = [ mock pytest ];
 
   checkPhase = ''
@@ -25,4 +29,4 @@ buildPythonPackage rec {
     homepage = https://github.com/minrk/wurlitzer;
     license = lib.licenses.mit;
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/development/tools/analysis/include-what-you-use/default.nix b/pkgs/development/tools/analysis/include-what-you-use/default.nix
index c05d47e396cf..424d83822e87 100644
--- a/pkgs/development/tools/analysis/include-what-you-use/default.nix
+++ b/pkgs/development/tools/analysis/include-what-you-use/default.nix
@@ -3,10 +3,10 @@
 stdenv.mkDerivation rec {
   pname = "include-what-you-use";
   # Also bump llvmPackages in all-packages.nix to the supported version!
-  version = "0.12";
+  version = "0.13";
 
   src = fetchurl {
-    sha256 = "09b0h704fh7r4f5h92p5997cj3zk1v04bqp4jk1j1f6cmfq2z2d5";
+    sha256 = "1jav4qf7d303by9iy6v08w73wfwzj76i54inh90w1s34m9q44aa9";
     url = "${meta.homepage}/downloads/${pname}-${version}.src.tar.gz";
   };
 
diff --git a/pkgs/development/tools/build-managers/cmake/default.nix b/pkgs/development/tools/build-managers/cmake/default.nix
index 5bad0100a032..6dd7f5a884cf 100644
--- a/pkgs/development/tools/build-managers/cmake/default.nix
+++ b/pkgs/development/tools/build-managers/cmake/default.nix
@@ -19,12 +19,12 @@ stdenv.mkDerivation rec {
           + lib.optionalString useNcurses "-cursesUI"
           + lib.optionalString withQt5 "-qt5UI"
           + lib.optionalString useQt4 "-qt4UI";
-  version = "3.15.1";
+  version = "3.15.4";
 
   src = fetchurl {
     url = "${meta.homepage}files/v${lib.versions.majorMinor version}/cmake-${version}.tar.gz";
     # compare with https://cmake.org/files/v${lib.versions.majorMinor version}/cmake-${version}-SHA-256.txt
-    sha256 = "1xyprly3sf4wi0n1x79k4n22yxm6pb7fv70gqr9lvc7qv14cbphq";
+    sha256 = "0ypd051rh3nxhjfb5wcmnxi78p1d1qbzrhazn94lwdr1xa4ia8ca";
   };
 
   patches = [
diff --git a/pkgs/development/tools/documentation/gnome-doc-utils/default.nix b/pkgs/development/tools/documentation/gnome-doc-utils/default.nix
index 2f29fb2fbad2..54c37fa61837 100644
--- a/pkgs/development/tools/documentation/gnome-doc-utils/default.nix
+++ b/pkgs/development/tools/documentation/gnome-doc-utils/default.nix
@@ -29,6 +29,11 @@ python2Packages.buildPythonApplication rec {
     };
   };
 
+  postFixup = ''
+    # Do not propagate Python
+    rm $out/nix-support/propagated-build-inputs
+  '';
+
   meta = with stdenv.lib; {
     description = "Collection of documentation utilities for the GNOME project";
     homepage = "https://gitlab.gnome.org/GNOME/gnome-doc-utils";
diff --git a/pkgs/development/tools/misc/automake/automake-1.15.x.nix b/pkgs/development/tools/misc/automake/automake-1.15.x.nix
index e1aeb025c30f..f1a486446170 100644
--- a/pkgs/development/tools/misc/automake/automake-1.15.x.nix
+++ b/pkgs/development/tools/misc/automake/automake-1.15.x.nix
@@ -13,6 +13,8 @@ stdenv.mkDerivation rec {
 
   setupHook = ./setup-hook.sh;
 
+  patches = [ ./help2man-SOURCE_DATE_EPOCH-support.patch ];
+
   # Disable indented log output from Make, otherwise "make.test" will
   # fail.
   preCheck = "unset NIX_INDENT_MAKE";
diff --git a/pkgs/development/tools/misc/automake/help2man-SOURCE_DATE_EPOCH-support.patch b/pkgs/development/tools/misc/automake/help2man-SOURCE_DATE_EPOCH-support.patch
new file mode 100644
index 000000000000..048f75e63343
--- /dev/null
+++ b/pkgs/development/tools/misc/automake/help2man-SOURCE_DATE_EPOCH-support.patch
@@ -0,0 +1,41 @@
+From 2e3357d7f0d63f1caeb40d9644c2436a5cd0da5f Mon Sep 17 00:00:00 2001
+From: David Terry <me@xwvvvvwx.com>
+Date: Fri, 18 Oct 2019 10:23:11 +0200
+Subject: [PATCH] help2man: add support for SOURCE_DATE_EPOCH
+
+---
+ doc/help2man | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/doc/help2man b/doc/help2man
+index af4306f..4a64167 100755
+--- a/doc/help2man
++++ b/doc/help2man
+@@ -213,11 +213,23 @@ sub get_option_value;
+ my $help_text   = get_option_value $ARGV[0], $help_option;
+ $version_text ||= get_option_value $ARGV[0], $version_option;
+ 
++# By default the generated manual pages will include the current date.  This may
++# however be overriden by setting the environment variable $SOURCE_DATE_EPOCH
++# to an integer value of the seconds since the UNIX epoch.  This is primarily
++# intended to support reproducible builds (wiki.debian.org/ReproducibleBuilds)
++# and will additionally ensure that the output date string is UTC.
++my $epoch_secs = time;
++if (exists $ENV{SOURCE_DATE_EPOCH} and $ENV{SOURCE_DATE_EPOCH} =~ /^(\d+)$/)
++{
++    $epoch_secs = $1;
++    $ENV{TZ} = 'UTC';
++}
++
+ # Translators: the following message is a strftime(3) format string, which in
+ # the English version expands to the month as a word and the full year.  It
+ # is used on the footer of the generated manual pages.  If in doubt, you may
+ # just use %x as the value (which should be the full locale-specific date).
+-my $date = enc strftime _("%B %Y"), localtime;
++my $date = enc strftime _("%B %Y"), localtime $epoch_secs;
+ (my $program = $ARGV[0]) =~ s!.*/!!;
+ my $package = $program;
+ my $version;
+-- 
+2.23.0
+
diff --git a/pkgs/development/tools/misc/itstool/default.nix b/pkgs/development/tools/misc/itstool/default.nix
index 9368a3c1acf8..a5c3623b699c 100644
--- a/pkgs/development/tools/misc/itstool/default.nix
+++ b/pkgs/development/tools/misc/itstool/default.nix
@@ -1,24 +1,14 @@
-{ stdenv, fetchurl, python2, libxml2Python }:
-# We need the same Python as is used to build libxml2Python
+{ stdenv, fetchurl, python3 }:
 
 stdenv.mkDerivation rec {
-  # 2.0.3+ breaks the build of gnome3.gnome-desktop
-  # https://github.com/itstool/itstool/issues/17
-  name = "itstool-2.0.2";
+  name = "itstool-2.0.6";
 
   src = fetchurl {
     url = "http://files.itstool.org/itstool/${name}.tar.bz2";
-    sha256 = "bf909fb59b11a646681a8534d5700fec99be83bb2c57badf8c1844512227033a";
+    sha256 = "1acjgf8zlyk7qckdk19iqaca4jcmywd7vxjbcs1mm6kaf8icqcv2";
   };
 
-  buildInputs = [ python2 libxml2Python ];
-
-  patchPhase =
-    ''
-      sed -e '/import libxml2/i import sys\
-      sys.path.append("${libxml2Python}/lib/${python2.libPrefix}/site-packages")' \
-      -i itstool.in
-    '';
+  buildInputs = [ (python3.withPackages(ps: with ps; [ libxml2 ])) ];
 
   meta = {
     homepage = http://itstool.org/;
diff --git a/pkgs/games/steam/chrootenv.nix b/pkgs/games/steam/chrootenv.nix
index b2bca7ca7b97..0de961e6d49f 100644
--- a/pkgs/games/steam/chrootenv.nix
+++ b/pkgs/games/steam/chrootenv.nix
@@ -75,6 +75,7 @@ in buildFHSUserEnv rec {
     xorg.libX11
     xorg.libXfixes
     libGL
+    libva
 
     # Not formally in runtime but needed by some games
     at-spi2-atk
diff --git a/pkgs/misc/cups/default.nix b/pkgs/misc/cups/default.nix
index ffac9a97b281..d18829673cc7 100644
--- a/pkgs/misc/cups/default.nix
+++ b/pkgs/misc/cups/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   pname = "cups";
 
   # After 2.2.6, CUPS requires headers only available in macOS 10.12+
-  version = if stdenv.isDarwin then "2.2.6" else "2.2.12";
+  version = if stdenv.isDarwin then "2.2.6" else "2.3.0";
 
   passthru = { inherit version; };
 
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     url = "https://github.com/apple/cups/releases/download/v${version}/cups-${version}-source.tar.gz";
     sha256 = if version == "2.2.6"
              then "16qn41b84xz6khrr2pa2wdwlqxr29rrrkjfi618gbgdkq9w5ff20"
-             else "1a4sgx5y7z16flmpnchd2ix294bnzy0v8mdkd96a4j27kr2anq8g";
+             else "19d1jpdpxy0fclq37pchi7ldnw9dssxx3zskcgqai3h0rwlh5bxc";
   };
 
   outputs = [ "out" "lib" "dev" "man" ];
diff --git a/pkgs/misc/ghostscript/default.nix b/pkgs/misc/ghostscript/default.nix
index ac410a229970..89583bb15d3d 100644
--- a/pkgs/misc/ghostscript/default.nix
+++ b/pkgs/misc/ghostscript/default.nix
@@ -10,8 +10,8 @@ assert cupsSupport -> cups != null;
 
 let
   version = "9.${ver_min}";
-  ver_min = "27";
-  sha512 = "00m8pfvvg4dzvrzk66myr8kid76x44sgqk84m9562g4viv9zbw759l8q9qg64mgvbajzn78zpqfgdlgz9nwgcdb1vpwc08gm12ssrsy";
+  ver_min = "50";
+  sha512 = "3p46kzn6kh7z4qqnqydmmvdlgzy5730z3yyvyxv6i4yb22mgihzrwqmhmvfn3b7lypwf6fdkkndarzv7ly3zndqpyvg89x436sms7iw";
 
   fonts = stdenv.mkDerivation {
     name = "ghostscript-fonts";
@@ -47,24 +47,6 @@ stdenv.mkDerivation rec {
   patches = [
     ./urw-font-files.patch
     ./doc-no-ref.diff
-    (fetchpatch {
-        name = "CVE-2019-10216.patch";
-        url = "https://git.ghostscript.com/?p=ghostpdl.git;a=patch;h=5b85ddd19a8420a1bd2d5529325be35d78e94234";
-        sha256 = "165svml4knq1xlysfvj7vc07h68bhv3rgvl83xrhxsxdzs1ign31";
-    })
-    (fetchpatch {
-        name = "CVE-2019-14811.CVE-2019-14812.CVE-2019-14813.patch";
-        url = "https://git.ghostscript.com/?p=ghostpdl.git;a=patch;h=885444fcbe10dc42787ecb76686c8ee4dd33bf33";
-        sha256 = "19928sr7xpx7iibk9gn127g0r1yv2lcfpwgk2ipzz4wgrs3f5j70";
-    })
-    (fetchpatch {
-        name = "CVE-2019-14817-partial.patch";
-        url = "https://git.ghostscript.com/?p=ghostpdl.git;a=patch;h=cd1b1cacadac2479e291efe611979bdc1b3bdb19";
-        # patch doesn't apply cleanly to all files, but at least partially applying it fixes
-        # *most* of the problematic sites.
-        excludes = ["Resource/Init/pdf_font.ps"];
-        sha256 = "0f8qgdqpv7bldc9akvjj10af2h2876cvnz4q3nvg4a00rk5i05wn";
-    })
   ];
 
   outputs = [ "out" "man" "doc" ];
diff --git a/pkgs/misc/jackaudio/default.nix b/pkgs/misc/jackaudio/default.nix
index f246c41d9659..6ca09c9516b2 100644
--- a/pkgs/misc/jackaudio/default.nix
+++ b/pkgs/misc/jackaudio/default.nix
@@ -28,13 +28,13 @@ let
 in
 stdenv.mkDerivation rec {
   name = "${prefix}jack2-${version}";
-  version = "1.9.12";
+  version = "1.9.13";
 
   src = fetchFromGitHub {
     owner = "jackaudio";
     repo = "jack2";
     rev = "v${version}";
-    sha256 = "0ynpyn0l77m94b50g7ysl795nvam3ra65wx5zb46nxspgbf6wnkh";
+    sha256 = "1dnq75ylcv3npsyvzzkj0g8mdnzwis1whc2pk6s5hkcc1bgvv2xy";
   };
 
   nativeBuildInputs = [ pkgconfig python makeWrapper wafHook ];
@@ -49,11 +49,6 @@ stdenv.mkDerivation rec {
         --replace /bin/bash ${bash}/bin/bash
   '';
 
-  patches = [ (fetchpatch {
-    url = "https://github.com/jackaudio/jack2/commit/d851fada460d42508a6f82b19867f63853062583.patch";
-    sha256 = "1iwwxjzvgrj7dz3s8alzlhcgmcarjcbkrgvsmy6kafw21pyyw7hp";
-  }) ];
-
   wafConfigureFlags = [
     "--classic"
     "--autostart=${if (optDbus != null) then "dbus" else "classic"}"
diff --git a/pkgs/misc/themes/numix-solarized/default.nix b/pkgs/misc/themes/numix-solarized/default.nix
index 4fd06fae61bc..0596141da80b 100644
--- a/pkgs/misc/themes/numix-solarized/default.nix
+++ b/pkgs/misc/themes/numix-solarized/default.nix
@@ -3,14 +3,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "20170810";
+  version = "20180913";
   pname = "numix-solarized-gtk-theme";
 
   src = fetchFromGitHub {
     owner = "Ferdi265";
     repo = "numix-solarized-gtk-theme";
     rev = version;
-    sha256 = "0l4xvsiyg15kp6xwpvm3jckxyhr1lxd678lkhrcyf40n7rd4xinl";
+    sha256 = "1kda0lyqi3cxh163fbj8yyi6jj6pf0y980k4s0cmyi3hkh4cqyd5";
   };
 
   nativeBuildInputs = [ python3 sass glib gdk-pixbuf libxml2 inkscape optipng ];
diff --git a/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix b/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
index 3b5867837bda..8db9d4fb3b5d 100644
--- a/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
+++ b/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
@@ -1,13 +1,13 @@
-{ stdenv, fetchgit }:
+{ stdenv, fetchgit, lib }:
 
 stdenv.mkDerivation rec {
   pname = "firmware-linux-nonfree";
-  version = "2019-09-23";
+  version = "2019-10-22";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git";
-    rev = "20190923";
-    sha256 = "1gq55ny6lb2nh6rr1w55bslzysyj0bwdl6rbpv882hhyjrnsma0n";
+    rev = lib.replaceStrings ["-"] [""] version;
+    sha256 = "03ycc55h7vgd4fmb7v7gl7lplf7pg7acs16aa2rramgldxqvyx7j";
   };
 
   installFlags = [ "DESTDIR=$(out)" ];
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   outputHashMode = "recursive";
   outputHashAlgo = "sha256";
-  outputHash = "1y2z3wxqq2km6x08kfdqgcr9xczbq1h2jqyrqr6h31bapjb8x0k9";
+  outputHash = "15nm0xh2xq8mnk7a66iljcklc15gvh6jcpz2d9llg1fkv6w8lqc6";
 
   meta = with stdenv.lib; {
     description = "Binary firmware collection packaged by kernel.org";
diff --git a/pkgs/os-specific/linux/shadow/default.nix b/pkgs/os-specific/linux/shadow/default.nix
index 1a38b804888a..f810270a29e2 100644
--- a/pkgs/os-specific/linux/shadow/default.nix
+++ b/pkgs/os-specific/linux/shadow/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchpatch, fetchFromGitHub, autoreconfHook, libxslt, libxml2
-, docbook_xml_dtd_45, docbook_xsl, gnome-doc-utils, flex, bison
+, docbook_xml_dtd_45, docbook_xsl, itstool, flex, bison
 , pam ? null, glibcCross ? null
 }:
 
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = stdenv.lib.optional (pam != null && stdenv.isLinux) pam;
   nativeBuildInputs = [autoreconfHook libxslt libxml2
-    docbook_xml_dtd_45 docbook_xsl gnome-doc-utils flex bison
+    docbook_xml_dtd_45 docbook_xsl flex bison itstool
     ];
 
   patches =
@@ -38,6 +38,12 @@ stdenv.mkDerivation rec {
       # Obtain XML resources from XML catalog (patch adapted from gtk-doc)
       ./respect-xml-catalog-files-var.patch
       dots_in_usernames
+      # Allow building with itstool
+      # https://github.com/shadow-maint/shadow/pull/184
+      (fetchpatch {
+        url = https://github.com/shadow-maint/shadow/commit/6c6c8d3a33bba32277e1ed46f55df1e6dbc914b7.patch;
+        sha256 = "0xfr1mrfv5xsmri6l7ycbpz3qhs4vf3fyci4kwpffi3icsfjn557";
+      })
     ];
 
   # The nix daemon often forbids even creating set[ug]id files.
diff --git a/pkgs/os-specific/windows/default.nix b/pkgs/os-specific/windows/default.nix
index 4621c2da10fb..7f1634d5c0b3 100644
--- a/pkgs/os-specific/windows/default.nix
+++ b/pkgs/os-specific/windows/default.nix
@@ -1,29 +1,45 @@
-{ newScope, crossLibcStdenv }: let
+{ stdenv, buildPackages
+, newScope, overrideCC, crossLibcStdenv, libcCross
+}:
 
-  callPackage = newScope self;
+stdenv.lib.makeScope newScope (self: with self; {
 
-  self = {
-    cygwinSetup = callPackage ./cygwin-setup { };
+  cygwinSetup = callPackage ./cygwin-setup { };
 
-    jom = callPackage ./jom { };
+  jom = callPackage ./jom { };
 
-    w32api = callPackage ./w32api { };
+  w32api = callPackage ./w32api { };
 
-    mingwrt = callPackage ./mingwrt { };
-    mingw_runtime = self.mingwrt;
+  mingwrt = callPackage ./mingwrt { };
+  mingw_runtime = mingwrt;
 
-    mingw_w64 = callPackage ./mingw-w64 {
-      stdenv = crossLibcStdenv;
-    };
-
-    mingw_w64_headers = callPackage ./mingw-w64/headers.nix { };
+  mingw_w64 = callPackage ./mingw-w64 {
+    stdenv = crossLibcStdenv;
+  };
 
-    mingw_w64_pthreads = callPackage ./mingw-w64/pthreads.nix { };
+  crossThreadsStdenv = overrideCC crossLibcStdenv
+    (if stdenv.hostPlatform.useLLVM or false
+     then buildPackages.llvmPackages_8.lldClangNoLibcxx
+     else buildPackages.gccCrossStageStatic.override (old: {
+       bintools = old.bintools.override {
+         libc = libcCross;
+       };
+       libc = libcCross;
+     }));
 
-    pthreads = callPackage ./pthread-w32 { };
+  mingw_w64_headers = callPackage ./mingw-w64/headers.nix { };
 
-    wxMSW = callPackage ./wxMSW-2.8 { };
+  mingw_w64_pthreads = callPackage ./mingw-w64/pthreads.nix {
+    stdenv = crossThreadsStdenv;
+  };
 
-    libgnurx = callPackage ./libgnurx { };
+  mcfgthreads = callPackage ./mcfgthreads {
+    stdenv = crossThreadsStdenv;
   };
-in self
+
+  pthreads = callPackage ./pthread-w32 { };
+
+  wxMSW = callPackage ./wxMSW-2.8 { };
+
+  libgnurx = callPackage ./libgnurx { };
+})
diff --git a/pkgs/os-specific/windows/mcfgthreads/default.nix b/pkgs/os-specific/windows/mcfgthreads/default.nix
new file mode 100644
index 000000000000..6c4cd1710256
--- /dev/null
+++ b/pkgs/os-specific/windows/mcfgthreads/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, fetchFromGitHub, autoreconfHook }:
+
+stdenv.mkDerivation {
+  pname = "mcfgthreads";
+  version = "git";
+
+  src = fetchFromGitHub {
+    owner = "lhmouse";
+    repo = "mcfgthread";
+    rev = "9570e5ca7b98002d707c502c919d951bf256b9c6";
+    sha256 = "10y2x3x601a7c1hkd6zlr3xpfsnlr05xl28v23clf619756a5755";
+  };
+
+  outputs = [ "out" "dev" ];
+
+  # Don't want prebuilt binaries sneaking in.
+  postUnpack = ''
+    rm -r "$sourceRoot/debug" "$sourceRoot/release"
+  '';
+
+  nativeBuildInputs = [
+    autoreconfHook
+  ];
+}
diff --git a/pkgs/os-specific/windows/mingw-w64/default.nix b/pkgs/os-specific/windows/mingw-w64/default.nix
index 022aaffe5961..7efc2e213133 100644
--- a/pkgs/os-specific/windows/mingw-w64/default.nix
+++ b/pkgs/os-specific/windows/mingw-w64/default.nix
@@ -11,11 +11,15 @@ in stdenv.mkDerivation {
     sha256 = "00zq3z1hbzd5yzmskskjg79xrzwsqx7ihyprfaxy4hb897vf29sm";
   };
 
+  outputs = [ "out" "dev" ];
+
   configureFlags = [
     "--enable-idl"
     "--enable-secure-api"
   ];
 
+  enableParallelBuilding = true;
+
   buildInputs = [ windows.mingw_w64_headers ];
   dontStrip = true;
   hardeningDisable = [ "stackprotector" "fortify" ];
diff --git a/pkgs/servers/dns/knot-dns/default.nix b/pkgs/servers/dns/knot-dns/default.nix
index 6e87ac5052c6..26d0217254a1 100644
--- a/pkgs/servers/dns/knot-dns/default.nix
+++ b/pkgs/servers/dns/knot-dns/default.nix
@@ -7,11 +7,11 @@ let inherit (stdenv.lib) optional optionals; in
 # Note: ATM only the libraries have been tested in nixpkgs.
 stdenv.mkDerivation rec {
   pname = "knot-dns";
-  version = "2.9.0";
+  version = "2.9.1";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/knot-dns/knot-${version}.tar.xz";
-    sha256 = "df7434eaefbabbf7cca2d6cba5038be48a4668e508215ca197532bac7c9b21a2";
+    sha256 = "f19121956caa360c387923654f13e4c97b3fb9093d242e110d7e0916b8d8a04d";
   };
 
   outputs = [ "bin" "out" "dev" ];
diff --git a/pkgs/servers/monitoring/prometheus/blackbox-exporter.nix b/pkgs/servers/monitoring/prometheus/blackbox-exporter.nix
index e15dce8ae450..b44ebd35e9a7 100644
--- a/pkgs/servers/monitoring/prometheus/blackbox-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/blackbox-exporter.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "blackbox_exporter";
-  version = "0.15.1";
+  version = "0.16.0";
   rev = version;
 
   goPackagePath = "github.com/prometheus/blackbox_exporter";
@@ -11,10 +11,11 @@ buildGoPackage rec {
     rev = "v${version}";
     owner = "prometheus";
     repo = "blackbox_exporter";
-    sha256 = "14z4xkkh9jb6ylclzsyj6gyqrb67lxs5cxd7lrs70qli567gzqwc";
+    sha256 = "1zbf3ljasv0r91rrmk3mj5nhimaf7xg3aih1ldz27rh5yww7gyzg";
   };
 
-  doCheck = true;
+  # dns-lookup is performed for the tests
+  doCheck = false;
 
   meta = with stdenv.lib; {
     description = "Blackbox probing of endpoints over HTTP, HTTPS, DNS, TCP and ICMP";
diff --git a/pkgs/servers/search/elasticsearch/plugins.nix b/pkgs/servers/search/elasticsearch/plugins.nix
index 3a480bd74674..a40a142368ab 100644
--- a/pkgs/servers/search/elasticsearch/plugins.nix
+++ b/pkgs/servers/search/elasticsearch/plugins.nix
@@ -1,4 +1,4 @@
-{ pkgs, lib, stdenv, fetchurl, unzip, elasticsearch }:
+{ lib, stdenv, fetchurl, unzip, elasticsearch }:
 
 let
   esVersion = elasticsearch.version;
@@ -16,27 +16,27 @@ let
   }:
     stdenv.mkDerivation (a // {
       inherit installPhase;
+      pname = "elasticsearch-${pluginName}";
       dontUnpack = true;
       buildInputs = [ unzip ];
       meta = a.meta // {
         platforms = elasticsearch.meta.platforms;
-        maintainers = (a.meta.maintainers or []) ++ (with stdenv.lib.maintainers; [ offline ]);
+        maintainers = (a.meta.maintainers or []) ++ (with lib.maintainers; [ offline ]);
       };
     });
 in {
 
   analysis-lemmagen = esPlugin rec {
-    name = "elasticsearch-analysis-lemmagen-${version}";
-    pluginName = "elasticsearch-analysis-lemmagen";
+    pluginName = "analysis-lemmagen";
     version = esVersion;
     src = fetchurl {
-      url = "https://github.com/vhyza/${pluginName}/releases/download/v${version}/${name}-plugin.zip";
+      url = "https://github.com/vhyza/${pluginName}/releases/download/v${version}/${pluginName}-${version}-plugin.zip";
       sha256 =
-        if version == "7.0.1" then "155zj9zw81msx976c952nk926ndav1zqhmy2xih6nr82qf0p71hm"
-        else if version == "6.7.2" then "1r176ncjbilkmri2c5rdxh5xqsrn77m1f0p98zs47czwlqh230iq"
+        if version == "7.3.1" then "1nb82z6s94mzdx1srb1pwj7cpzs8w74njap0xiqn7sg5ylk6adm8"
+        else if version == "6.8.3" then "12bshvp01pp2lgwd0cn9l58axg8gdimsh4g9wfllxi1bdpv4cy53"
         else throw "unsupported version ${version} for plugin ${pluginName}";
     };
-    meta = with stdenv.lib; {
+    meta = with lib; {
       homepage = https://github.com/vhyza/elasticsearch-analysis-lemmagen;
       description = "LemmaGen Analysis plugin provides jLemmaGen lemmatizer as Elasticsearch token filter";
       license = licenses.asl20;
@@ -44,37 +44,50 @@ in {
   };
 
   discovery-ec2 = esPlugin rec {
-    name = "elasticsearch-discovery-ec2-${version}";
     pluginName = "discovery-ec2";
     version = esVersion;
-    src = pkgs.fetchurl {
+    src = fetchurl {
       url = "https://artifacts.elastic.co/downloads/elasticsearch-plugins/${pluginName}/${pluginName}-${version}.zip";
       sha256 =
-        if version == "7.0.1" then "0nrvralh4fygs0ys2ikg3x08jdyh9276d5w7yfncbbi0xrg9hk6g"
-        else if version == "6.7.2" then "1p0cdz3lfksfd2kvlcj0syxhbx27mimsaw8q4kgjpjjjwqayg523"
-        else if version == "5.6.16" then "1300pfmnlpfm1hh2jgas8j2kqjqiqkxhr8czshj9lx0wl4ciknin"
+        if version == "7.3.1" then "1p30by7pqnvj8dcwws51kh9s962c42qwqq07gmj4jl83zxcl8kyl"
+        else if version == "6.8.3" then "0pmffz761dqjpvmkl7i7xsyw1iyyspqpddxp89rjsznfc9pak5im"
         else throw "unsupported version ${version} for plugin ${pluginName}";
     };
-    meta = with stdenv.lib; {
+    meta = with lib; {
       homepage = https://github.com/elastic/elasticsearch/tree/master/plugins/discovery-ec2;
       description = "The EC2 discovery plugin uses the AWS API for unicast discovery.";
       license = licenses.asl20;
     };
   };
 
+  ingest-attachment = esPlugin rec {
+    pluginName = "ingest-attachment";
+    version = esVersion;
+    src = fetchurl {
+      url = "https://artifacts.elastic.co/downloads/elasticsearch-plugins/${pluginName}/${pluginName}-${version}.zip";
+      sha256 =
+        if version == "7.3.1" then "1b9l17zv6582sdcdiabwd293xx5ckc2d3h6smiv6znk5f4dxj7km"
+        else if version == "6.8.3" then "0kfr4i2rcwinjn31xrc2piicasjanaqcgnbif9xc7lnak2nnzmll"
+        else throw "unsupported version ${version} for plugin ${pluginName}";
+    };
+    meta = with lib; {
+      homepage = https://github.com/elastic/elasticsearch/tree/master/plugins/ingest-attachment;
+      description = "Ingest processor that uses Apache Tika to extract contents";
+      license = licenses.asl20;
+    };
+  };
+
   repository-s3 = esPlugin rec {
-    name = "elasticsearch-repository-s3-${version}";
     pluginName = "repository-s3";
     version = esVersion;
-    src = pkgs.fetchurl {
+    src = fetchurl {
       url = "https://artifacts.elastic.co/downloads/elasticsearch-plugins/${pluginName}/${pluginName}-${esVersion}.zip";
       sha256 =
-        if version == "7.0.1" then "17bf8m1q92j5yhgldckl4hlsfv6qgwwqdc1da9kzgidgky7jwkbc"
-        else if version == "6.7.2" then "1l353zfyv3qziz8xkann9cbzx4wj5s14wnknfw351j6vgdq26l12"
-        else if version == "5.6.16" then "0k3li5xv1270ygb9lqk6ji3nngngl2im3z38k08nd627vxdrzij2"
+        if version == "7.3.1" then "1dqd3hd8qa1bsvd1p42k5zcrdmb66d2yspfc7g8nsz89w6b1invg"
+        else if version == "6.8.3" then "1mm6hj2m1db68n81rzsvlw6nisflr5ikzk5zv9nmk0z641n5vh1x"
         else throw "unsupported version ${version} for plugin ${pluginName}";
     };
-    meta = with stdenv.lib; {
+    meta = with lib; {
       homepage = https://github.com/elastic/elasticsearch/tree/master/plugins/repository-s3;
       description = "The S3 repository plugin adds support for using AWS S3 as a repository for Snapshot/Restore.";
       license = licenses.asl20;
@@ -82,18 +95,16 @@ in {
   };
 
   repository-gcs = esPlugin rec {
-    name = "elasticsearch-repository-gcs-${version}";
     pluginName = "repository-gcs";
     version = esVersion;
-    src = pkgs.fetchurl {
+    src = fetchurl {
       url = "https://artifacts.elastic.co/downloads/elasticsearch-plugins/${pluginName}/${pluginName}-${esVersion}.zip";
       sha256 =
-        if version == "7.0.1" then "0a3rc2gggsj7xfncil1s53dmq799lcm82h0yncs94jnb182sbmzc"
-        else if version == "6.7.2" then "0afccbvb7x6y3nrwmal09vpgxyz4lar6lffw4mngalcppsk8irvv"
-        else if version == "5.6.16" then "0hwqx4yhdn4c0ccdpvgrg30ag8hy3mgxgk7h7pibdmzvy7qw7501"
+        if version == "7.3.1" then "0kpb1hn2fb4lh6kn96vi7265ign9lwcd0zfc19l4n6fpp8js5lfh"
+        else if version == "6.8.3" then "1s2klpvnhpkrk53p64zbga3b66czi7h1a13f58kfn2cn0zfavnbk"
         else throw "unsupported version ${version} for plugin ${pluginName}";
     };
-    meta = with stdenv.lib; {
+    meta = with lib; {
       homepage = https://github.com/elastic/elasticsearch/tree/master/plugins/repository-gcs;
       description = "The GCS repository plugin adds support for using Google Cloud Storage as a repository for Snapshot/Restore.";
       license = licenses.asl20;
@@ -103,23 +114,21 @@ in {
   search-guard = let
     majorVersion = lib.head (builtins.splitVersion esVersion);
   in esPlugin rec {
-    name = "elasticsearch-search-guard-${version}";
     pluginName = "search-guard";
     version =
-      if esVersion == "7.0.1" then "${esVersion}-35.0.0"
-      else if esVersion == "6.7.2" then "${esVersion}-25.1"
-      else if esVersion == "5.6.16" then "${esVersion}-19.3"
+      # https://docs.search-guard.com/latest/search-guard-versions
+      if esVersion == "7.3.1" then "${esVersion}-37.0.0"
+      else if esVersion == "6.8.3" then "${esVersion}-25.5"
       else throw "unsupported version ${esVersion} for plugin ${pluginName}";
     src = fetchurl {
       url = "mirror://maven/com/floragunn/${pluginName}-${majorVersion}/${version}/${pluginName}-${majorVersion}-${version}.zip";
       sha256 =
-        if version == "7.0.1-35.0.0" then "0wsiqq7j7ph9g2vhhvjmwrh5a2q1wzlysgr75gc35zcvqz6cq8ha"
-        else if version == "6.7.2-25.1" then "119r1zibi0z40mfxrpkx0zzay0yz6c7syqmmw8i2681wmz4nksda"
-        else if version == "5.6.16-19.3" then "1q70anihh89c53fnk8wlq9z5dx094j0f9a0y0v2zsqx18lz9ikmx"
+        if version == "7.3.1-37.0.0" then "0rb631npr6vykrhln3x6q75xwb0wndvrspwnak0rld5d7pqn1r04"
+        else if version == "6.8.3-25.5" then "0a7ys9qinc0fjyka03cx9rv0pm7wnvslk234zv5vrphkrj52s1cb"
         else throw "unsupported version ${version} for plugin ${pluginName}";
     };
-    meta = with stdenv.lib; {
-      homepage = https://github.com/floragunncom/search-guard;
+    meta = with lib; {
+      homepage = https://search-guard.com;
       description = "Elasticsearch plugin that offers encryption, authentication, and authorisation. ";
       license = licenses.asl20;
     };
diff --git a/pkgs/shells/zsh/antibody/default.nix b/pkgs/shells/zsh/antibody/default.nix
index 0ea3c8d158d0..e1bfc68dc4de 100644
--- a/pkgs/shells/zsh/antibody/default.nix
+++ b/pkgs/shells/zsh/antibody/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "antibody";
-  version = "4.1.2";
+  version = "4.2.0";
 
   goPackagePath = "github.com/getantibody/antibody";
 
@@ -10,15 +10,15 @@ buildGoModule rec {
     owner = "getantibody";
     repo = "antibody";
     rev = "v${version}";
-    sha256 = "1csanmvix7b2sa7nsy8nh3jq6gmhp8i51xivsabm1lj2y30c0ly3";
+    sha256 = "1vds7mxqxa7xlhvjvmnh1nr1ra3dciav0qlv45s1dmwn5qrcilci";
   };
 
-  modSha256 = "1p9cw92ivwgpkvjxvwd9anbd1vzhpicm9il4pg37z2kgr2ihhnyh";
+  modSha256 = "1n9sgrm16iig600f4q1cmbwwk0822isjvbyazplylha843510b17";
 
   meta = with lib; {
     description = "The fastest shell plugin manager";
     homepage = https://github.com/getantibody/antibody;
     license = licenses.mit;
-    maintainers = with maintainers; [ worldofpeace ];
+    maintainers = with maintainers; [ filalex77 worldofpeace ];
   };
 }
diff --git a/pkgs/tools/X11/caffeine-ng/default.nix b/pkgs/tools/X11/caffeine-ng/default.nix
index b54a7303ff87..c161a7c77378 100644
--- a/pkgs/tools/X11/caffeine-ng/default.nix
+++ b/pkgs/tools/X11/caffeine-ng/default.nix
@@ -23,10 +23,15 @@ python3Packages.buildPythonApplication rec {
 
   doCheck = false; # There are no tests.
 
-  postBuild = ''
+  postInstall = ''
     mkdir -p $out/share
     cp -r share $out/
+    # autostart file
+    cp -r $out/lib/python*/site-packages/etc $out/etc/
     glib-compile-schemas --strict $out/share/glib-2.0/schemas
+    for i in $(find $out -name "*.desktop"); do
+      substituteInPlace $i --replace /usr $out
+    done
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/audio/abcmidi/default.nix b/pkgs/tools/audio/abcmidi/default.nix
index 773b09958ea7..8d990f3a3a88 100644
--- a/pkgs/tools/audio/abcmidi/default.nix
+++ b/pkgs/tools/audio/abcmidi/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "abcMIDI";
-  version = "2019.08.11";
+  version = "2019.10.13";
 
   src = fetchzip {
     url = "https://ifdo.ca/~seymour/runabc/${pname}-${version}.zip";
-    sha256 = "0rkqmavg7iv9080jdqs0qz80nanhizv6jk0fg9d5xvq3gnmfvnj1";
+    sha256 = "1i2gpfrzi12smrlni25fcah6a8rb5l7p358r60jbysc2bpzxwd9l";
   };
 
   # There is also a file called "makefile" which seems to be preferred by the standard build phase
diff --git a/pkgs/tools/backup/btrbk/default.nix b/pkgs/tools/backup/btrbk/default.nix
index 963d7945b89d..71e1807603c8 100644
--- a/pkgs/tools/backup/btrbk/default.nix
+++ b/pkgs/tools/backup/btrbk/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "btrbk";
-  version = "0.28.3";
+  version = "0.29.0";
 
   src = fetchurl {
     url = "https://digint.ch/download/btrbk/releases/${pname}-${version}.tar.xz";
-    sha256 = "0s69pcjkjxg77cgyjahwyg2w81ckgzwz1ds4ifjw7z0zhjxy7miz";
+    sha256 = "1ki40jga09x361lj36hgzw3ahs0cg2w0s3rjwp209255fzyl89il";
   };
 
   nativeBuildInputs = [ asciidoc asciidoctor makeWrapper ];
diff --git a/pkgs/tools/filesystems/btrfs-progs/default.nix b/pkgs/tools/filesystems/btrfs-progs/default.nix
index 95fc1c1cd7ac..e04b9efe48fd 100644
--- a/pkgs/tools/filesystems/btrfs-progs/default.nix
+++ b/pkgs/tools/filesystems/btrfs-progs/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "btrfs-progs";
-  version = "5.2.2";
+  version = "5.3.1";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${version}.tar.xz";
-    sha256 = "1imivxjppi8zl27gn472pwpk8bg5dijkbyi340by31vhy7dj24w2";
+    sha256 = "0f6s1iwiqbncrvxp74k50s88x6zqf85sjxg04kyni82l1vk1m8xz";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/filesystems/ceph/default.nix b/pkgs/tools/filesystems/ceph/default.nix
index 141d21951a88..3066be27772e 100644
--- a/pkgs/tools/filesystems/ceph/default.nix
+++ b/pkgs/tools/filesystems/ceph/default.nix
@@ -6,9 +6,10 @@
 , libxml2, zlib, lz4
 , openldap, lttng-ust
 , babeltrace, gperf
+, gtest
 , cunit, snappy
 , rocksdb, makeWrapper
-, leveldb, oathToolkit, removeReferencesTo
+, leveldb, oathToolkit
 
 # Optional Dependencies
 , yasm ? null, fcgi ? null, expat ? null
@@ -108,14 +109,14 @@ in rec {
     nativeBuildInputs = [
       cmake
       pkgconfig which git python3Packages.wrapPython makeWrapper
+      python3Packages.python # for the toPythonPath function
       (ensureNewerSourcesHook { year = "1980"; })
     ];
 
     buildInputs = cryptoLibsMap.${cryptoStr} ++ [
       boost ceph-python-env libxml2 optYasm optLibatomic_ops optLibs3
-      malloc zlib openldap lttng-ust babeltrace gperf cunit
+      malloc zlib openldap lttng-ust babeltrace gperf gtest cunit
       snappy rocksdb lz4 oathToolkit leveldb
-      removeReferencesTo
     ] ++ optionals stdenv.isLinux [
       linuxHeaders utillinux libuuid udev keyutils optLibaio optLibxfs optZfs
       # ceph 14
@@ -124,54 +125,52 @@ in rec {
       optFcgi optExpat optCurl optFuse optLibedit
     ];
 
+    pythonPath = [ ceph-python-env "${placeholder "out"}/${ceph-python-env.sitePackages}" ];
+
     preConfigure =''
       substituteInPlace src/common/module.c --replace "/sbin/modinfo"  "modinfo"
       substituteInPlace src/common/module.c --replace "/sbin/modprobe" "modprobe"
-      # Since Boost 1.67 this seems to have changed
-      substituteInPlace CMakeLists.txt --replace "list(APPEND BOOST_COMPONENTS python)" "list(APPEND BOOST_COMPONENTS python37)"
-      substituteInPlace src/CMakeLists.txt --replace "Boost::python " "Boost::python37 "
 
       # for pybind/rgw to find internal dep
       export LD_LIBRARY_PATH="$PWD/build/lib:$LD_LIBRARY_PATH"
       # install target needs to be in PYTHONPATH for "*.pth support" check to succeed
-      export PYTHONPATH=${ceph-python-env}/lib/python3.7/site-packages:$lib/lib/python3.7/site-packages/:$out/lib/python3.7/site-packages/
 
-      patchShebangs src/spdk
+      patchShebangs src/script src/spdk src/test src/tools
     '';
 
     cmakeFlags = [
       "-DWITH_PYTHON3=ON"
       "-DWITH_SYSTEM_ROCKSDB=OFF"
+      "-DCMAKE_INSTALL_DATADIR=${placeholder "lib"}/lib"
+
 
       "-DWITH_SYSTEM_BOOST=ON"
+      "-DWITH_SYSTEM_ROCKSDB=ON"
+      "-DWITH_SYSTEM_GTEST=ON"
+      "-DMGR_PYTHON_VERSION=${ceph-python-env.python.pythonVersion}"
       "-DWITH_SYSTEMD=OFF"
       "-DWITH_TESTS=OFF"
       # TODO breaks with sandbox, tries to download stuff with npm
       "-DWITH_MGR_DASHBOARD_FRONTEND=OFF"
     ];
 
-    preFixup = ''
-      find $lib -type f -exec remove-references-to -t $out '{}' +
-      mv $out/share/ceph/mgr $lib/lib/ceph/
-    '';
-
     postFixup = ''
-      export PYTHONPATH="${ceph-python-env}/lib/python3.7/site-packages:$lib/lib/ceph/mgr:$out/lib/python3.7/site-packages/"
       wrapPythonPrograms
-      wrapProgram $out/bin/ceph-mgr --prefix PYTHONPATH ":" "${ceph-python-env}/lib/python3.7/site-packages:$lib/lib/ceph/mgr:$out/lib/python3.7/site-packages/"
-      wrapProgram $out/bin/ceph-volume --prefix PYTHONPATH ":" "${ceph-python-env}/lib/python3.7/site-packages:$lib/lib/ceph/mgr:$out/lib/python3.7/site-packages/"
+      wrapProgram $out/bin/ceph-mgr --prefix PYTHONPATH ":" "$(toPythonPath ${placeholder "out"}):$(toPythonPath ${ceph-python-env})"
     '';
 
     enableParallelBuilding = true;
 
     outputs = [ "out" "lib" "dev" "doc" "man" ];
 
+    doCheck = false; # uses pip to install things from the internet
+
     meta = {
       homepage = https://ceph.com/;
       description = "Distributed storage system";
       license = with licenses; [ lgpl21 gpl2 bsd3 mit publicDomain ];
       maintainers = with maintainers; [ adev ak krav johanot ];
-      platforms = platforms.unix;
+      platforms = [ "x86_64-linux" ];
     };
 
     passthru.version = version;
@@ -183,7 +182,7 @@ in rec {
         description = "Tools needed to mount Ceph's RADOS Block Devices";
         license = with licenses; [ lgpl21 gpl2 bsd3 mit publicDomain ];
         maintainers = with maintainers; [ adev ak johanot krav ];
-        platforms = platforms.unix;
+        platforms = [ "x86_64-linux" ];
       };
     } ''
       mkdir -p $out/{bin,etc,lib/python3.7/site-packages}
diff --git a/pkgs/tools/misc/licensor/default.nix b/pkgs/tools/misc/licensor/default.nix
new file mode 100644
index 000000000000..99d9fc72681e
--- /dev/null
+++ b/pkgs/tools/misc/licensor/default.nix
@@ -0,0 +1,23 @@
+{ lib, rustPlatform, fetchFromGitHub }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "licensor";
+  version = "2.0.0";
+
+  src = fetchFromGitHub {
+    owner = "raftario";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0bb6q3jpzdygjcs3apl38zzmgkn22ya5wxlqgmlp0cybqbhpi20s";
+  };
+
+  cargoSha256 = "1cvwyj2043vi5905n5126ikwbs3flfgzqkzjnzha0h8in8p3skv1";
+
+  meta = with lib; {
+    description = "Write licenses to stdout";
+    homepage = "https://github.com/raftario/licensor";
+    license = licenses.mit;
+    maintainers = with maintainers; [ filalex77 ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/tools/misc/man-db/default.nix b/pkgs/tools/misc/man-db/default.nix
index a8fb7eea97c4..49e4ab44836e 100644
--- a/pkgs/tools/misc/man-db/default.nix
+++ b/pkgs/tools/misc/man-db/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, pkgconfig, libpipeline, db, groff, libiconv, makeWrapper, buildPackages }:
 
 stdenv.mkDerivation rec {
-  name = "man-db-2.8.6.1";
+  name = "man-db-2.8.7";
 
   src = fetchurl {
     url = "mirror://savannah/man-db/${name}.tar.xz";
-    sha256 = "0a1sh5gxa16k6irzf3q2lli8m204w9ik1xm62wjgf1mzknxs4xrc";
+    sha256 = "09mkpvwirv9kh2pqhfq90zl7pjdl63f4w4g1x6zhhp9hjswmpkdr";
   };
 
   outputs = [ "out" "doc" ];
diff --git a/pkgs/tools/networking/modem-manager/default.nix b/pkgs/tools/networking/modem-manager/default.nix
index d921e841c5b8..221e873387f1 100644
--- a/pkgs/tools/networking/modem-manager/default.nix
+++ b/pkgs/tools/networking/modem-manager/default.nix
@@ -3,12 +3,12 @@
 
 stdenv.mkDerivation rec {
   pname = "modem-manager";
-  version = "1.10.4";
+  version = "1.10.6";
 
   package = "ModemManager";
   src = fetchurl {
     url = "https://www.freedesktop.org/software/${package}/${package}-${version}.tar.xz";
-    sha256 = "0w6wdj9dh7zwhzl68775h1ni6zcgvss524dp17kph50zpas6nmgs";
+    sha256 = "15n9sd6ymxvw7hidc9pw81j89acwi5cjfhj220a68mi1h8vsfb1w";
   };
 
   nativeBuildInputs = [ vala gobject-introspection gettext pkgconfig ];
diff --git a/pkgs/tools/networking/twa/default.nix b/pkgs/tools/networking/twa/default.nix
index fe75b35eea2b..b15b6dcba31e 100644
--- a/pkgs/tools/networking/twa/default.nix
+++ b/pkgs/tools/networking/twa/default.nix
@@ -4,6 +4,7 @@
 , fetchFromGitHub
 , gawk
 , host
+, jq
 , lib
 , makeWrapper
 , ncurses
@@ -12,18 +13,25 @@
 
 stdenv.mkDerivation rec {
   pname = "twa";
-  version = "1.8.0";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "trailofbits";
     repo = "twa";
     rev = version;
-    sha256 = "1xq35xyz5536nwrwmlp1wqa7q9jgh90ly7vdy3a5rvxnksx0b2l5";
+    sha256 = "1ab3bcyhfach9y15w8ffvqqan2qk8h62n6z8nqbgygi7n1mf6jzx";
   };
 
   dontBuild = true;
 
-  buildInputs = [ makeWrapper bash gawk curl netcat host.dnsutils ];
+  nativeBuildInputs = [ makeWrapper ];
+
+  buildInputs = [ bash
+                  curl
+                  gawk
+                  host.dnsutils
+                  jq
+                  netcat ];
 
   installPhase = ''
     install -Dm 0755 twa "$out/bin/twa"
@@ -32,7 +40,11 @@ stdenv.mkDerivation rec {
     install -Dm 0644 README.md "$out/share/doc/twa/README.md"
 
     wrapProgram "$out/bin/twa" \
-      --prefix PATH : ${stdenv.lib.makeBinPath [ curl netcat ncurses host.dnsutils ]}
+      --prefix PATH : ${stdenv.lib.makeBinPath [ curl
+                                                 host.dnsutils
+                                                 jq
+                                                 ncurses
+                                                 netcat ]}
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/package-management/home-manager/default.nix b/pkgs/tools/package-management/home-manager/default.nix
index 5f4cc58c6a22..da4bb43066cc 100644
--- a/pkgs/tools/package-management/home-manager/default.nix
+++ b/pkgs/tools/package-management/home-manager/default.nix
@@ -6,13 +6,13 @@
 stdenv.mkDerivation rec {
 
   pname = "home-manager";
-  version = "2019-10-23";
+  version = "2019-10-29";
 
   src = fetchFromGitHub {
     owner = "rycee";
     repo = "home-manager";
-    rev = "1b987952b5f7d18f0bb66317cf18ffda43ad45aa";
-    sha256 = "1jdmxdnyd6jaiqjjkzw3qr0ia4qvmwmgfn05hbph37v03p55ah5q";
+    rev = "450571056552c9311fcb2894328696b535265593";
+    sha256 = "1rlv234m0bqj9x2y9wnl8z3yq8mixzq8332nqlb8fw9k8mazis6s";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/security/trousers/default.nix b/pkgs/tools/security/trousers/default.nix
index 6f7fed20c89d..a38c011d7a49 100644
--- a/pkgs/tools/security/trousers/default.nix
+++ b/pkgs/tools/security/trousers/default.nix
@@ -2,13 +2,15 @@
 
 stdenv.mkDerivation rec {
   pname = "trousers";
-  version = "0.3.13";
+  version = "0.3.14";
 
   src = fetchurl {
     url = "mirror://sourceforge/trousers/trousers/${version}/${pname}-${version}.tar.gz";
-    sha256 = "1lvnla1c1ig2w3xvvrqg2w9qm7a1ygzy1j2gg8j7p8c87i58x45v";
+    sha256 = "0iwgsbrbb7nfqgl61x8aailwxm8akxh9gkcwxhsvf50x4qx72l6f";
   };
 
+  sourceRoot = ".";
+
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ openssl ];
 
@@ -16,21 +18,14 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--disable-usercheck" ];
 
-  # Attempt to remove -std=gnu89 when updating if using gcc5
-  NIX_CFLAGS_COMPILE = "-std=gnu89 -DALLOW_NON_TSS_CONFIG_FILE";
-  NIX_LDFLAGS = "-lgcc_s";
-
-  # Fix broken libtool file
-  preFixup = stdenv.lib.optionalString (!stdenv.isDarwin) ''
-    sed 's,-lcrypto,-L${openssl.out}/lib -lcrypto,' -i $out/lib/libtspi.la
-  '';
+  NIX_CFLAGS_COMPILE = [ "-DALLOW_NON_TSS_CONFIG_FILE" ];
+  enableParallelBuilding = true;
 
   meta = with stdenv.lib; {
     description = "Trusted computing software stack";
     homepage    = http://trousers.sourceforge.net/;
-    license     = licenses.cpl10;
+    license     = licenses.bsd3;
     maintainers = [ maintainers.ak ];
     platforms   = platforms.linux;
   };
 }
-
diff --git a/pkgs/tools/typesetting/fop/default.nix b/pkgs/tools/typesetting/fop/default.nix
index a72ca6980774..c681eaa6ddc6 100644
--- a/pkgs/tools/typesetting/fop/default.nix
+++ b/pkgs/tools/typesetting/fop/default.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
     '';
     homepage = https://xmlgraphics.apache.org/fop/;
     license = licenses.asl20;
-    platforms = platforms.linux;
+    platforms = platforms.all;
     maintainers = with maintainers; [ bjornfor ndowens ];
   };
 }
diff --git a/pkgs/tools/typesetting/tex/dblatex/default.nix b/pkgs/tools/typesetting/tex/dblatex/default.nix
index c4eaf4e1df46..cc9432f6f22d 100644
--- a/pkgs/tools/typesetting/tex/dblatex/default.nix
+++ b/pkgs/tools/typesetting/tex/dblatex/default.nix
@@ -21,11 +21,11 @@ assert enableAllFeatures ->
   ghostscript != null;
 
 stdenv.mkDerivation rec {
-  name = "dblatex-0.3.10";
+  name = "dblatex-0.3.11";
 
   src = fetchurl {
     url = "mirror://sourceforge/dblatex/${name}.tar.bz2";
-    sha256 = "1yicd861rqz78i2khl35j7nvc0ccv4jx4hzqrbhll17082vrdmkg";
+    sha256 = "0rp1bc2lgisigscq1i7zxfd2qdaxxxld6khbcxss4pq7fpi9fzkv";
   };
 
   buildInputs = [ python2 libxslt tex ]
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5b1672b41b6d..40b7347664ff 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -293,8 +293,10 @@ in
   fetchhg = callPackage ../build-support/fetchhg { };
 
   # `fetchurl' downloads a file from the network.
-  fetchurl = makeOverridable (import ../build-support/fetchurl) {
-    inherit lib stdenvNoCC;
+  fetchurl = if stdenv.buildPlatform != stdenv.hostPlatform
+   then buildPackages.fetchurl # No need to do special overrides twice,
+   else makeOverridable (import ../build-support/fetchurl) {
+    inherit lib stdenvNoCC buildPackages;
     curl = buildPackages.curl.override (old: rec {
       # break dependency cycles
       fetchurl = stdenv.fetchurlBoot;
@@ -2971,6 +2973,7 @@ in
   evemu = callPackage ../tools/system/evemu { };
 
   # The latest version used by elasticsearch, logstash, kibana and the the beats from elastic.
+  # When updating make sure to update all plugins or they will break!
   elk6Version = "6.8.3";
   elk7Version = "7.3.1";
 
@@ -3574,11 +3577,11 @@ in
   gnupg1 = gnupg1compat;    # use config.packageOverrides if you prefer original gnupg1
   gnupg20 = callPackage ../tools/security/gnupg/20.nix {
     guiSupport = stdenv.isDarwin;
-    pinentry = if stdenv.isDarwin then pinentry_mac else pinentry_gtk2;
+    pinentry = if stdenv.isDarwin then pinentry_mac else pinentry-gtk2;
   };
   gnupg22 = callPackage ../tools/security/gnupg/22.nix {
     guiSupport = stdenv.isDarwin;
-    pinentry = if stdenv.isDarwin then pinentry_mac else pinentry_gtk2;
+    pinentry = if stdenv.isDarwin then pinentry_mac else pinentry-gtk2;
   };
   gnupg = gnupg22;
 
@@ -4390,6 +4393,8 @@ in
 
   libsmi = callPackage ../development/libraries/libsmi { };
 
+  licensor = callPackage ../tools/misc/licensor { };
+
   lesspipe = callPackage ../tools/misc/lesspipe { };
 
   liquidsoap = callPackage ../tools/audio/liquidsoap/full.nix {
@@ -6759,9 +6764,7 @@ in
 
   trilium = callPackage ../applications/office/trilium { };
 
-  trousers = callPackage ../tools/security/trousers {
-    openssl = openssl_1_0_2;
-  };
+  trousers = callPackage ../tools/security/trousers { };
 
   trx = callPackage ../tools/audio/trx { };
 
@@ -7794,7 +7797,7 @@ in
     ../development/compilers/gcc/libstdc++-hook.sh;
 
   crossLibcStdenv = overrideCC stdenv
-    (if stdenv.targetPlatform.useLLVM or false
+    (if stdenv.hostPlatform.useLLVM or false
      then buildPackages.llvmPackages_8.lldClangNoLibc
      else buildPackages.gccCrossStageStatic);
 
@@ -7827,6 +7830,7 @@ in
       };
       bintools = binutils1;
       libc = libcCross1;
+      extraPackages = [];
   };
 
   gcc48 = lowPrio (wrapCC (callPackage ../development/compilers/gcc/4.8 {
@@ -7836,6 +7840,7 @@ in
     profiledCompiler = with stdenv; (!isSunOS && !isDarwin && (isi686 || isx86_64));
 
     libcCross = if stdenv.targetPlatform != stdenv.buildPlatform then libcCross else null;
+    threadsCross = if stdenv.targetPlatform != stdenv.buildPlatform then threadsCross else null;
 
     isl = if !stdenv.isDarwin then isl_0_14 else null;
     cloog = if !stdenv.isDarwin then cloog else null;
@@ -7849,6 +7854,7 @@ in
     profiledCompiler = with stdenv; (!isDarwin && (isi686 || isx86_64));
 
     libcCross = if stdenv.targetPlatform != stdenv.buildPlatform then libcCross else null;
+    threadsCross = if stdenv.targetPlatform != stdenv.buildPlatform then threadsCross else null;
 
     isl = if !stdenv.isDarwin then isl_0_11 else null;
 
@@ -7862,6 +7868,7 @@ in
     profiledCompiler = with stdenv; (!isDarwin && (isi686 || isx86_64));
 
     libcCross = if stdenv.targetPlatform != stdenv.buildPlatform then libcCross else null;
+    threadsCross = if stdenv.targetPlatform != stdenv.buildPlatform then threadsCross else null;
 
     isl = if !stdenv.isDarwin then isl_0_14 else null;
   }));
@@ -7873,6 +7880,7 @@ in
     profiledCompiler = with stdenv; (!isDarwin && (isi686 || isx86_64));
 
     libcCross = if stdenv.targetPlatform != stdenv.buildPlatform then libcCross else null;
+    threadsCross = if stdenv.targetPlatform != stdenv.buildPlatform then threadsCross else null;
 
     isl = if !stdenv.isDarwin then isl_0_14 else null;
   }));
@@ -7884,6 +7892,7 @@ in
     profiledCompiler = with stdenv; (!isDarwin && (isi686 || isx86_64));
 
     libcCross = if stdenv.targetPlatform != stdenv.buildPlatform then libcCross else null;
+    threadsCross = if stdenv.targetPlatform != stdenv.buildPlatform then threadsCross else null;
 
     isl = if !stdenv.isDarwin then isl_0_17 else null;
   }));
@@ -7895,6 +7904,7 @@ in
     profiledCompiler = with stdenv; (!isDarwin && (isi686 || isx86_64));
 
     libcCross = if stdenv.targetPlatform != stdenv.buildPlatform then libcCross else null;
+    threadsCross = if stdenv.targetPlatform != stdenv.buildPlatform then threadsCross else null;
 
     isl = if !stdenv.isDarwin then isl_0_17 else null;
   }));
@@ -7906,6 +7916,7 @@ in
     profiledCompiler = with stdenv; (!isDarwin && (isi686 || isx86_64));
 
     libcCross = if stdenv.targetPlatform != stdenv.buildPlatform then libcCross else null;
+    threadsCross = if stdenv.targetPlatform != stdenv.buildPlatform then threadsCross else null;
 
     isl = if !stdenv.isDarwin then isl_0_17 else null;
   }));
@@ -7917,6 +7928,7 @@ in
     profiledCompiler = with stdenv; (!isDarwin && (isi686 || isx86_64));
 
     libcCross = if stdenv.targetPlatform != stdenv.buildPlatform then libcCross else null;
+    threadsCross = if stdenv.targetPlatform != stdenv.buildPlatform then threadsCross else null;
 
     isl = isl_0_17;
   }));
@@ -8754,6 +8766,7 @@ in
       # provide the default choice, avoiding infinite recursion.
       bintools ? if stdenv.targetPlatform.isDarwin then darwin.binutils else binutils
     , libc ? bintools.libc
+    , extraPackages ? stdenv.lib.optional (cc.isGNU or false && stdenv.targetPlatform.isMinGW) threadsCross
     , ...
     } @ extraArgs:
       callPackage ../build-support/cc-wrapper (let self = {
@@ -8765,7 +8778,7 @@ in
     isGNU = cc.isGNU or false;
     isClang = cc.isClang or false;
 
-    inherit cc bintools libc;
+    inherit cc bintools libc extraPackages;
   } // extraArgs; in self);
 
   wrapCC = cc: wrapCCWith {
@@ -11285,6 +11298,11 @@ in
 
   libcCross = assert stdenv.targetPlatform != stdenv.buildPlatform; libcCrossChooser stdenv.targetPlatform.libc;
 
+  threadsCross =
+    if stdenv.targetPlatform.isMinGW && !(stdenv.targetPlatform.useLLVM or false)
+    then targetPackages.windows.mcfgthreads or windows.mcfgthreads
+    else null;
+
   wasilibc = callPackage ../development/libraries/wasilibc {
     stdenv = crossLibcStdenv;
   };
@@ -12861,9 +12879,13 @@ in
 
   libxmi = callPackage ../development/libraries/libxmi { };
 
-  libxml2 = callPackage ../development/libraries/libxml2 { };
+  libxml2 = callPackage ../development/libraries/libxml2 {
+    python = if stdenv.isDarwin then python2 else python3;
+  };
 
-  libxml2Python = pkgs.buildEnv { # slightly hacky
+  libxml2Python = let
+    libxml2 = python2Packages.libxml2;
+  in pkgs.buildEnv { # slightly hacky
     name = "libxml2+py-${res.libxml2.version}";
     paths = with libxml2; [ dev bin py ];
     inherit (libxml2) passthru;
@@ -12881,7 +12903,9 @@ in
 
   libxmp = callPackage ../development/libraries/libxmp { };
 
-  libxslt = callPackage ../development/libraries/libxslt { };
+  libxslt = callPackage ../development/libraries/libxslt {
+    python = if stdenv.isDarwin then python2 else python3;
+  };
 
   libixp_hg = callPackage ../development/libraries/libixp-hg { };
 
@@ -13279,7 +13303,10 @@ in
 
   wolfssl = callPackage ../development/libraries/wolfssl { };
 
-  openssl = openssl_1_1;
+  openssl =
+    if stdenv.hostPlatform.isMinGW # Work around broken cross build
+    then openssl_1_0_2
+    else openssl_1_1;
 
   inherit (callPackages ../development/libraries/openssl { })
     openssl_1_0_2
@@ -22489,7 +22516,7 @@ in
 
   displaycal = (newScope pythonPackages) ../applications/graphics/displaycal {};
 
-  drumkv1 = callPackage ../applications/audio/drumkv1 { };
+  drumkv1 = libsForQt5.callPackage ../applications/audio/drumkv1 { };
 
   duckmarines = callPackage ../games/duckmarines { love = love_0_10; };
 
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index b5b9fe9f1658..725810fe997c 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -1175,6 +1175,21 @@ let
     };
   };
 
+  CacheKyotoTycoon = buildPerlModule {
+    pname = "Cache-KyotoTycoon";
+    version = "0.16";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/T/TO/TOKUHIROM/Cache-KyotoTycoon-0.16.tar.gz";
+      sha256 = "0z4lnc3jfqx8rykm998q2jy5wkhb8p5pir80g9lqpi4lb0ilic6c";
+    };
+    propagatedBuildInputs = [ Furl URI ];
+    buildInputs = [ FileWhich TestTCP TestRequires TestSharedFork ];
+    meta = {
+      description = "KyotoTycoon client library";
+      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
+    };
+  };
+
   CacheMemcached = buildPerlPackage {
     pname = "Cache-Memcached";
     version = "1.30";
@@ -1948,6 +1963,20 @@ let
     };
   };
 
+  CDB_File = buildPerlPackage {
+    pname = "CDB_File";
+    version = "0.99";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/T/TO/TODDR/CDB_File-0.99.tar.gz";
+      sha256 = "1c32b30131871e8a7b23f47d8f65d9cdeb87069fa4c221781a03416496f91f16";
+    };
+    meta = {
+      homepage = "http://github.com/toddr/CDB_File";
+      description = "Perl extension for access to cdb databases";
+      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
+    };
+  };
+
   Catmandu = buildPerlModule {
     pname = "Catmandu";
     version = "1.2002";
@@ -7326,6 +7355,19 @@ let
     buildInputs = [ TestPod ];
   };
 
+  FindLib = buildPerlPackage {
+    pname = "Find-Lib";
+    version = "1.04";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/Y/YA/YANNK/Find-Lib-1.04.tar.gz";
+      sha256 = "0lg88v0sqfpq4d3jwvk6c9blqnpxbz8f4s22zr3b1qb160g94wqx";
+    };
+    meta = with stdenv.lib; {
+      description = "Helper to smartly find libs to use in the filesystem tree";
+      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
+    };
+  };
+
   FontAFM = buildPerlPackage {
     pname = "Font-AFM";
     version = "1.20";
@@ -7389,6 +7431,21 @@ let
     doCheck = false;
   };
 
+  Furl = buildPerlModule {
+    pname = "Furl";
+    version = "3.13";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/T/TO/TOKUHIROM/Furl-3.13.tar.gz";
+      sha256 = "1wxa2v9yjzvnzp62p1jvcx8x61z5qvlvzyah853vvaywpjxwyyl8";
+    };
+    propagatedBuildInputs = [ HTTPParserXS ModuleBuildTiny ClassAccessorLite ];
+    buildInputs = [ HTTPBody HTTPProxy NetIDNEncode Plack PlackMiddlewareDeflater Starlet TestRequires TestTCP TestSharedFork ];
+    meta = {
+      description = "Lightning-fast URL fetcher";
+      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
+    };
+  };
+
   GamesSolitaireVerify = buildPerlModule {
     pname = "Games-Solitaire-Verify";
     version = "0.2202";
@@ -10231,6 +10288,21 @@ let
     buildInputs = [ IPCRun3 TestFatal TestNeeds ];
   };
 
+  LogDispatchFileRotate = buildPerlPackage {
+    pname = "Log-Dispatch-FileRotate";
+    version = "1.36";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/M/MS/MSCHOUT/Log-Dispatch-FileRotate-1.36.tar.gz";
+      sha256 = "0vlmi17p7fky3x58rs7r5mdxi6l5jla8zhlb55kvssxc1w5v2b27";
+    };
+    propagatedBuildInputs = [ DateManip LogDispatch PathTiny ];
+    meta = {
+      description = "Log to Files that Archive/Rotate Themselves";
+      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
+    };
+    buildInputs = [ TestFatal TestNeeds TestWarn ];
+  };
+
   LogHandler = buildPerlModule {
     pname = "Log-Handler";
     version = "0.88";
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b507137649da..2321821a536e 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1962,6 +1962,8 @@ in {
 
   impacket = callPackage ../development/python-modules/impacket { };
 
+  jsonlines = callPackage ../development/python-modules/jsonlines { };
+
   jsonrpc-async = callPackage ../development/python-modules/jsonrpc-async { };
 
   jsonrpc-base = callPackage ../development/python-modules/jsonrpc-base { };
@@ -3736,10 +3738,9 @@ in {
   libplist = disabledIf isPy3k
     (toPythonModule (pkgs.libplist.override{python2Packages=self; })).py;
 
-  libxml2 = toPythonModule (pkgs.libxml2.override{pythonSupport=true; python2=python;}).py;
+  libxml2 = (toPythonModule (pkgs.libxml2.override{pythonSupport=true; inherit python;})).py;
 
-  libxslt = disabledIf isPy3k
-    (toPythonModule (pkgs.libxslt.override{pythonSupport=true; python2=python; inherit (self) libxml2;})).py;
+  libxslt = (toPythonModule (pkgs.libxslt.override{pythonSupport=true; inherit python; inherit (self) libxml2;})).py;
 
   limits = callPackage ../development/python-modules/limits { };
 
@@ -4688,6 +4689,8 @@ in {
 
   pyhocon = callPackage ../development/python-modules/pyhocon { };
 
+  pyjson5 = callPackage ../development/python-modules/pyjson5 {};
+
   pymaging = callPackage ../development/python-modules/pymaging { };
 
   pymaging_png = callPackage ../development/python-modules/pymaging_png { };
@@ -5055,9 +5058,13 @@ in {
 
   spark_parser = callPackage ../development/python-modules/spark_parser { };
 
-  sphinx = callPackage ../development/python-modules/sphinx { };
+  sphinx = if isPy3k then
+    callPackage ../development/python-modules/sphinx { }
+  else
+    callPackage ../development/python-modules/sphinx/2.nix { };
 
-  sphinx_1_7_9 = (callPackage ../development/python-modules/sphinx { })
+  # Only exists for a Haskell package.
+  sphinx_1_7_9 = (callPackage ../development/python-modules/sphinx/2.nix { })
     .overridePythonAttrs (oldAttrs: rec {
       version = "1.7.9";
       src = oldAttrs.src.override {