about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--nixos/doc/manual/release-notes/rl-1909.xml39
-rw-r--r--nixos/modules/module-list.nix1
-rw-r--r--nixos/modules/services/monitoring/prometheus/default.nix118
-rw-r--r--nixos/modules/services/monitoring/prometheus/pushgateway.nix166
-rw-r--r--nixos/modules/system/boot/kernel.nix18
-rw-r--r--nixos/tests/prometheus-2.nix47
-rw-r--r--pkgs/applications/audio/drumkv1/default.nix4
-rw-r--r--pkgs/applications/audio/flacon/default.nix4
-rw-r--r--pkgs/applications/audio/qsynth/default.nix4
-rw-r--r--pkgs/applications/audio/qtractor/default.nix4
-rw-r--r--pkgs/applications/audio/samplv1/default.nix4
-rw-r--r--pkgs/applications/audio/synthv1/default.nix4
-rw-r--r--pkgs/applications/editors/android-studio/default.nix16
-rw-r--r--pkgs/applications/editors/neovim/neovim-remote.nix4
-rw-r--r--pkgs/applications/editors/okteta/default.nix4
-rw-r--r--pkgs/applications/gis/qgis/unwrapped.nix4
-rw-r--r--pkgs/applications/graphics/drawpile/default.nix4
-rw-r--r--pkgs/applications/misc/latte-dock/default.nix4
-rw-r--r--pkgs/applications/networking/feedreaders/rssguard/default.nix4
-rw-r--r--pkgs/applications/networking/gns3/default.nix12
-rw-r--r--pkgs/applications/networking/instant-messengers/zoom-us/default.nix4
-rw-r--r--pkgs/applications/radio/urh/default.nix4
-rw-r--r--pkgs/applications/science/biology/star/default.nix4
-rw-r--r--pkgs/applications/science/electronics/gtkwave/default.nix4
-rw-r--r--pkgs/applications/science/logic/petrinizer/default.nix25
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-remote-hg/default.nix24
-rw-r--r--pkgs/applications/video/obs-studio/linuxbrowser.nix4
-rw-r--r--pkgs/applications/video/streamlink/default.nix4
-rw-r--r--pkgs/development/interpreters/renpy/default.nix4
-rw-r--r--pkgs/development/interpreters/spidermonkey/52.nix16
-rw-r--r--pkgs/development/libraries/ace/default.nix4
-rw-r--r--pkgs/development/libraries/boost/darwin-1.55-no-system-python.patch45
-rw-r--r--pkgs/development/libraries/boost/generic.nix5
-rw-r--r--pkgs/development/libraries/double-conversion/default.nix4
-rw-r--r--pkgs/development/libraries/flatpak/default.nix1
-rw-r--r--pkgs/development/libraries/flatpak/unset-env-vars.patch10
-rw-r--r--pkgs/development/libraries/libassuan/default.nix9
-rw-r--r--pkgs/development/libraries/matio/default.nix4
-rw-r--r--pkgs/development/libraries/opencolorio/default.nix4
-rw-r--r--pkgs/development/libraries/openfst/default.nix4
-rw-r--r--pkgs/development/libraries/polkit/default.nix10
-rw-r--r--pkgs/development/libraries/protobufc/1.3.nix5
-rw-r--r--pkgs/development/python-modules/XlsxWriter/default.nix4
-rw-r--r--pkgs/development/python-modules/gensim/default.nix4
-rw-r--r--pkgs/development/python-modules/keepkey/default.nix4
-rw-r--r--pkgs/development/python-modules/peewee/default.nix4
-rw-r--r--pkgs/development/python-modules/py3exiv2/default.nix4
-rw-r--r--pkgs/development/python-modules/py3status/default.nix4
-rw-r--r--pkgs/development/python-modules/pysaml2/default.nix4
-rw-r--r--pkgs/development/python-modules/shellingham/default.nix4
-rw-r--r--pkgs/development/python-modules/shodan/default.nix4
-rw-r--r--pkgs/development/python-modules/smart_open/default.nix4
-rw-r--r--pkgs/development/python-modules/tenacity/default.nix4
-rw-r--r--pkgs/development/python-modules/twilio/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/apache-maven/default.nix4
-rw-r--r--pkgs/development/tools/just/default.nix6
-rw-r--r--pkgs/development/tools/ocaml/dune/default.nix4
-rw-r--r--pkgs/development/tools/ocaml/opam/default.nix8
-rw-r--r--pkgs/games/openttd/default.nix4
-rw-r--r--pkgs/games/steam/chrootenv.nix5
-rw-r--r--pkgs/misc/emulators/wine/sources.nix14
-rw-r--r--pkgs/os-specific/linux/kernel/generic.nix6
-rw-r--r--pkgs/os-specific/linux/kernel/manual-config.nix5
-rw-r--r--pkgs/os-specific/linux/nmon/default.nix4
-rw-r--r--pkgs/servers/amqp/rabbitmq-server/default.nix4
-rw-r--r--pkgs/servers/lidarr/default.nix4
-rw-r--r--pkgs/servers/mail/rspamd/default.nix4
-rw-r--r--pkgs/servers/monitoring/telegraf/default.nix4
-rw-r--r--pkgs/servers/monitoring/telegraf/deps-1.10.2.nix (renamed from pkgs/servers/monitoring/telegraf/deps-1.9.2.nix)116
-rw-r--r--pkgs/servers/nosql/neo4j/default.nix4
-rw-r--r--pkgs/servers/roundcube/default.nix4
-rw-r--r--pkgs/servers/rt/default.nix4
-rw-r--r--pkgs/tools/filesystems/moosefs/default.nix4
-rw-r--r--pkgs/tools/misc/autojump/default.nix4
-rw-r--r--pkgs/tools/misc/doitlive/default.nix4
-rw-r--r--pkgs/tools/misc/ipxe/default.nix8
-rw-r--r--pkgs/tools/misc/plantuml/default.nix4
-rw-r--r--pkgs/tools/misc/ttfautohint/default.nix4
-rw-r--r--pkgs/tools/networking/inetutils/default.nix14
-rw-r--r--pkgs/tools/networking/inetutils/inetutils-1_9-PATH_PROCNET_DEV.patch26
-rw-r--r--pkgs/tools/networking/socat/default.nix4
-rw-r--r--pkgs/tools/networking/stubby/default.nix4
-rw-r--r--pkgs/tools/networking/stunnel/default.nix4
-rw-r--r--pkgs/tools/networking/tgt/default.nix4
-rw-r--r--pkgs/tools/networking/urlwatch/default.nix4
-rw-r--r--pkgs/tools/security/lastpass-cli/default.nix4
-rw-r--r--pkgs/tools/security/lynis/default.nix4
-rw-r--r--pkgs/tools/system/stress-ng/default.nix4
-rw-r--r--pkgs/tools/text/ripgrep/default.nix6
-rw-r--r--pkgs/top-level/all-packages.nix3
-rw-r--r--pkgs/top-level/coq-packages.nix7
91 files changed, 757 insertions, 274 deletions
diff --git a/nixos/doc/manual/release-notes/rl-1909.xml b/nixos/doc/manual/release-notes/rl-1909.xml
index 0a0228cdffb3..2dc2dc41ff24 100644
--- a/nixos/doc/manual/release-notes/rl-1909.xml
+++ b/nixos/doc/manual/release-notes/rl-1909.xml
@@ -35,26 +35,6 @@
    The following new services were added since the last release:
   </para>
 
-  <itemizedlist>
-   <listitem>
-    <para>
-       Besides the existing <option>services.prometheus</option> module which
-       targets Prometheus-1 a new <option>services.prometheus2</option> module
-       has been added which targets Prometheus-2.
-    </para>
-    <para>
-       Both modules can be enabled at the same time. In fact
-       <link xlink:href="https://prometheus.io/docs/prometheus/latest/migration/#storage">
-       this is needed for upgrading existing Prometheus-1 data to Prometheus-2
-       </link>.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      There is a new <option>services.tox-node</option> module for running tox bootstrap nodes.
-    </para>
-   </listitem>
-  </itemizedlist>
  </section>
 
  <section xmlns="http://docbook.org/ns/docbook"
@@ -89,25 +69,6 @@
    </listitem>
    <listitem>
     <para>
-      The directory where Prometheus will store its metric data is now
-      managed by systemd's StateDirectory mechanism. It still defaults
-      to <literal>/var/lib/prometheus</literal>.
-    </para>
-    <para>
-      Its location can be specified by the new
-      <option>services.prometheus.stateDir</option> option which
-      defaults to <literal>prometheus</literal>. Note that this should
-      be a directory relative to <literal>/var/lib/</literal>.
-    </para>
-    <para>
-      The option <option>services.prometheus.dataDir</option> has been
-      deprecated. You can still set it but it's now required to have
-      <literal>/var/lib/</literal> as a prefix and you can't set
-      <option>services.prometheus.stateDir</option> at the same time.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
       The options <option>services.prometheus.alertmanager.user</option> and
       <option>services.prometheus.alertmanager.group</option> have been removed
       because the alertmanager service is now using systemd's <link
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index e9a5b8b9445d..c97e9f01ad77 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -491,6 +491,7 @@
   ./services/monitoring/prometheus/default.nix
   ./services/monitoring/prometheus/alertmanager.nix
   ./services/monitoring/prometheus/exporters.nix
+  ./services/monitoring/prometheus/pushgateway.nix
   ./services/monitoring/riemann.nix
   ./services/monitoring/riemann-dash.nix
   ./services/monitoring/riemann-tools.nix
diff --git a/nixos/modules/services/monitoring/prometheus/default.nix b/nixos/modules/services/monitoring/prometheus/default.nix
index 0d73551dc071..e7ac12c07d33 100644
--- a/nixos/modules/services/monitoring/prometheus/default.nix
+++ b/nixos/modules/services/monitoring/prometheus/default.nix
@@ -54,7 +54,7 @@ let
     rule_files = map (promtoolCheck "check-rules" "rules") (cfg.ruleFiles ++ [
       (pkgs.writeText "prometheus.rules" (concatStringsSep "\n" cfg.rules))
     ]);
-    scrape_configs = cfg.scrapeConfigs;
+    scrape_configs = filterEmpty cfg.scrapeConfigs;
   };
 
   generatedPrometheusYml = writePrettyJSON "prometheus.yml" promConfig;
@@ -81,7 +81,7 @@ let
     rule_files = map (prom2toolCheck "check rules" "rules") (cfg2.ruleFiles ++ [
       (pkgs.writeText "prometheus.rules" (concatStringsSep "\n" cfg2.rules))
     ]);
-    scrape_configs = cfg2.scrapeConfigs;
+    scrape_configs = filterEmpty cfg2.scrapeConfigs;
     alerting = optionalAttrs (cfg2.alertmanagerURL != []) {
       alertmanagers = [{
         static_configs = [{
@@ -108,6 +108,21 @@ let
   ] ++
   optional (cfg2.webExternalUrl != null) "--web.external-url=${cfg2.webExternalUrl}";
 
+  filterEmpty = filterAttrsListRecursive (_n: v: !(v == null || v == [] || v == {}));
+  filterAttrsListRecursive = pred: x:
+    if isAttrs x then
+      listToAttrs (
+        concatMap (name:
+          let v = x.${name}; in
+          if pred name v then [
+            (nameValuePair name (filterAttrsListRecursive pred v))
+          ] else []
+        ) (attrNames x)
+      )
+    else if isList x then
+      map (filterAttrsListRecursive pred) x
+    else x;
+
   promTypes.globalConfig = types.submodule {
     options = {
       scrape_interval = mkOption {
@@ -277,6 +292,14 @@ let
           List of labeled target groups for this job.
         '';
       };
+      ec2_sd_configs = mkOption {
+        type = types.listOf promTypes.ec2_sd_config;
+        default = [];
+        apply = x: map _filter x;
+        description = ''
+          List of EC2 service discovery configurations.
+        '';
+      };
       relabel_configs = mkOption {
         type = types.listOf promTypes.relabel_config;
         default = [];
@@ -306,6 +329,96 @@ let
     };
   };
 
+  promTypes.ec2_sd_config = types.submodule {
+    options = {
+      region = mkOption {
+        type = types.str;
+        description = ''
+          The AWS Region.
+        '';
+      };
+      endpoint = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = ''
+          Custom endpoint to be used.
+        '';
+      };
+      access_key = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = ''
+          The AWS API key id. If blank, the environment variable
+          <literal>AWS_ACCESS_KEY_ID</literal> is used.
+        '';
+      };
+      secret_key = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = ''
+          The AWS API key secret. If blank, the environment variable
+           <literal>AWS_SECRET_ACCESS_KEY</literal> is used.
+        '';
+      };
+      profile = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = ''
+          Named AWS profile used to connect to the API.
+        '';
+      };
+      role_arn = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = ''
+          AWS Role ARN, an alternative to using AWS API keys.
+        '';
+      };
+      refresh_interval = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = ''
+          Refresh interval to re-read the instance list.
+        '';
+      };
+      port = mkOption {
+        type = types.int;
+        default = 80;
+        description = ''
+          The port to scrape metrics from. If using the public IP
+          address, this must instead be specified in the relabeling
+          rule.
+        '';
+      };
+      filters = mkOption {
+        type = types.nullOr (types.listOf promTypes.filter);
+        default = null;
+        description = ''
+          Filters can be used optionally to filter the instance list by other criteria.
+        '';
+      };
+    };
+  };
+
+  promTypes.filter = types.submodule {
+    options = {
+      name = mkOption {
+        type = types.str;
+        description = ''
+          See <link xlink:href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstances.html">this list</link>
+          for the available filters.
+        '';
+      };
+      value = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        description = ''
+          Value of the filter.
+        '';
+      };
+    };
+  };
+
   promTypes.dns_sd_config = types.submodule {
     options = {
       names = mkOption {
@@ -480,7 +593,6 @@ let
     };
   };
 
- 
 in {
   options = {
     services.prometheus = {
diff --git a/nixos/modules/services/monitoring/prometheus/pushgateway.nix b/nixos/modules/services/monitoring/prometheus/pushgateway.nix
new file mode 100644
index 000000000000..f8fcc3eb97ef
--- /dev/null
+++ b/nixos/modules/services/monitoring/prometheus/pushgateway.nix
@@ -0,0 +1,166 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.services.prometheus.pushgateway;
+
+  cmdlineArgs =
+       opt "web.listen-address" cfg.web.listen-address
+    ++ opt "web.telemetry-path" cfg.web.telemetry-path
+    ++ opt "web.external-url" cfg.web.external-url
+    ++ opt "web.route-prefix" cfg.web.route-prefix
+    ++ optional cfg.persistMetrics ''--persistence.file="/var/lib/${cfg.stateDir}/metrics"''
+    ++ opt "persistence.interval" cfg.persistence.interval
+    ++ opt "log.level" cfg.log.level
+    ++ opt "log.format" cfg.log.format
+    ++ cfg.extraFlags;
+
+  opt = k : v : optional (v != null) ''--${k}="${v}"'';
+
+in {
+  options = {
+    services.prometheus.pushgateway = {
+      enable = mkEnableOption "Prometheus Pushgateway";
+
+      package = mkOption {
+        type = types.package;
+        default = pkgs.prometheus-pushgateway;
+        defaultText = "pkgs.prometheus-pushgateway";
+        description = ''
+          Package that should be used for the prometheus pushgateway.
+        '';
+      };
+
+      web.listen-address = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = ''
+          Address to listen on for the web interface, API and telemetry.
+
+          <literal>null</literal> will default to <literal>:9091</literal>.
+        '';
+      };
+
+      web.telemetry-path = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = ''
+          Path under which to expose metrics.
+
+          <literal>null</literal> will default to <literal>/metrics</literal>.
+        '';
+      };
+
+      web.external-url = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = ''
+          The URL under which Pushgateway is externally reachable.
+        '';
+      };
+
+      web.route-prefix = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = ''
+          Prefix for the internal routes of web endpoints.
+
+          Defaults to the path of
+          <option>services.prometheus.pushgateway.web.external-url</option>.
+        '';
+      };
+
+      persistence.interval = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        example = "10m";
+        description = ''
+          The minimum interval at which to write out the persistence file.
+
+          <literal>null</literal> will default to <literal>5m</literal>.
+        '';
+      };
+
+      log.level = mkOption {
+        type = types.nullOr (types.enum ["debug" "info" "warn" "error" "fatal"]);
+        default = null;
+        description = ''
+          Only log messages with the given severity or above.
+
+          <literal>null</literal> will default to <literal>info</literal>.
+        '';
+      };
+
+      log.format = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        example = "logger:syslog?appname=bob&local=7";
+        description = ''
+          Set the log target and format.
+
+          <literal>null</literal> will default to <literal>logger:stderr</literal>.
+        '';
+      };
+
+      extraFlags = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        description = ''
+          Extra commandline options when launching the Pushgateway.
+        '';
+      };
+
+      persistMetrics = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to persist metrics to a file.
+
+          When enabled metrics will be saved to a file called
+          <literal>metrics</literal> in the directory
+          <literal>/var/lib/pushgateway</literal>. The directory below
+          <literal>/var/lib</literal> can be set using
+          <option>services.prometheus.pushgateway.stateDir</option>.
+        '';
+      };
+
+      stateDir = mkOption {
+        type = types.str;
+        default = "pushgateway";
+        description = ''
+          Directory below <literal>/var/lib</literal> to store metrics.
+
+          This directory will be created automatically using systemd's
+          StateDirectory mechanism when
+          <option>services.prometheus.pushgateway.persistMetrics</option>
+          is enabled.
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = !hasPrefix "/" cfg.stateDir;
+        message =
+          "The option services.prometheus.pushgateway.stateDir" +
+          " shouldn't be an absolute directory." +
+          " It should be a directory relative to /var/lib.";
+      }
+    ];
+    systemd.services.pushgateway = {
+      wantedBy = [ "multi-user.target" ];
+      after    = [ "network.target" ];
+      serviceConfig = {
+        Restart  = "always";
+        DynamicUser = true;
+        ExecStart = "${cfg.package}/bin/pushgateway" +
+          optionalString (length cmdlineArgs != 0) (" \\\n  " +
+            concatStringsSep " \\\n  " cmdlineArgs);
+        StateDirectory = if cfg.persistMetrics then cfg.stateDir else null;
+      };
+    };
+  };
+}
diff --git a/nixos/modules/system/boot/kernel.nix b/nixos/modules/system/boot/kernel.nix
index 8ea05ed14687..ab919099d112 100644
--- a/nixos/modules/system/boot/kernel.nix
+++ b/nixos/modules/system/boot/kernel.nix
@@ -5,7 +5,7 @@ with lib;
 let
 
   inherit (config.boot) kernelPatches;
-  inherit (config.boot.kernel) features;
+  inherit (config.boot.kernel) features randstructSeed;
   inherit (config.boot.kernelPackages) kernel;
 
   kernelModulesConf = pkgs.writeText "nixos.conf"
@@ -38,6 +38,7 @@ in
       default = pkgs.linuxPackages;
       apply = kernelPackages: kernelPackages.extend (self: super: {
         kernel = super.kernel.override {
+          inherit randstructSeed;
           kernelPatches = super.kernel.kernelPatches ++ kernelPatches;
           features = lib.recursiveUpdate super.kernel.features features;
         };
@@ -67,6 +68,19 @@ in
       description = "A list of additional patches to apply to the kernel.";
     };
 
+    boot.kernel.randstructSeed = mkOption {
+      type = types.str;
+      default = "";
+      example = "my secret seed";
+      description = ''
+        Provides a custom seed for the <varname>RANDSTRUCT</varname> security
+        option of the Linux kernel. Note that <varname>RANDSTRUCT</varname> is
+        only enabled in NixOS hardened kernels. Using a custom seed requires
+        building the kernel and dependent packages locally, since this
+        customization happens at build time.
+      '';
+    };
+
     boot.kernelParams = mkOption {
       type = types.listOf types.str;
       default = [ ];
@@ -298,7 +312,7 @@ in
       # !!! Should this really be needed?
       (isYes "MODULES")
       (isYes "BINFMT_ELF")
-    ];
+    ] ++ (optional (randstructSeed != "") (isYes "GCC_PLUGIN_RANDSTRUCT"));
 
     # nixpkgs kernels are assumed to have all required features
     assertions = if config.boot.kernelPackages.kernel ? features then [] else
diff --git a/nixos/tests/prometheus-2.nix b/nixos/tests/prometheus-2.nix
index 5a4d8668cb87..d7035d49ad4d 100644
--- a/nixos/tests/prometheus-2.nix
+++ b/nixos/tests/prometheus-2.nix
@@ -3,15 +3,29 @@ import ./make-test.nix {
 
   nodes = {
     one = { pkgs, ... }: {
+      environment.systemPackages = [ pkgs.jq ];
       services.prometheus2 = {
         enable = true;
-        scrapeConfigs = [{
-          job_name = "prometheus";
-          static_configs = [{
-            targets = [ "127.0.0.1:9090" ];
-            labels = { instance = "localhost"; };
-          }];
-        }];
+        scrapeConfigs = [
+          {
+            job_name = "prometheus";
+            static_configs = [
+              {
+                targets = [ "127.0.0.1:9090" ];
+                labels = { instance = "localhost"; };
+              }
+            ];
+          }
+          {
+            job_name = "pushgateway";
+            scrape_interval = "1s";
+            static_configs = [
+              {
+                targets = [ "127.0.0.1:9091" ];
+              }
+            ];
+          }
+        ];
         rules = [
           ''
             groups:
@@ -22,6 +36,12 @@ import ./make-test.nix {
           ''
         ];
       };
+      services.prometheus.pushgateway = {
+        enable = true;
+        persistMetrics = true;
+        persistence.interval = "1s";
+        stateDir = "prometheus-pushgateway";
+      };
     };
   };
 
@@ -30,5 +50,18 @@ import ./make-test.nix {
     $one->waitForUnit("prometheus2.service");
     $one->waitForOpenPort(9090);
     $one->succeed("curl -s http://127.0.0.1:9090/metrics");
+
+    # Let's test if pushing a metric to the pushgateway succeeds
+    # and whether that metric gets ingested by prometheus.
+    $one->waitForUnit("pushgateway.service");
+    $one->succeed(
+      "echo 'some_metric 3.14' | " .
+      "curl --data-binary \@- http://127.0.0.1:9091/metrics/job/some_job");
+    $one->waitUntilSucceeds(
+      "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=some_metric' " .
+      "| jq '.data.result[0].value[1]' | grep '\"3.14\"'");
+
+    # Let's test if the pushgateway persists metrics to the configured location.
+    $one->waitUntilSucceeds("test -e /var/lib/prometheus-pushgateway/metrics");
   '';
 }
diff --git a/pkgs/applications/audio/drumkv1/default.nix b/pkgs/applications/audio/drumkv1/default.nix
index 49ecf670f324..0bffa6a07555 100644
--- a/pkgs/applications/audio/drumkv1/default.nix
+++ b/pkgs/applications/audio/drumkv1/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "drumkv1-${version}";
-  version = "0.9.5";
+  version = "0.9.6";
 
   src = fetchurl {
     url = "mirror://sourceforge/drumkv1/${name}.tar.gz";
-    sha256 = "1azzwqgrrr4zr509sib2jvigfvz5bkwnx82chdadxdwfarai8586";
+    sha256 = "0d0kskr9pzdckw7sz4djjkkkgz1fa83zrq5my6qlxn68wqdj6800";
   };
 
   buildInputs = [ libjack2 alsaLib libsndfile liblo lv2 qt5.qtbase qt5.qttools ];
diff --git a/pkgs/applications/audio/flacon/default.nix b/pkgs/applications/audio/flacon/default.nix
index 1c5eaba78b27..a97b539e02a8 100644
--- a/pkgs/applications/audio/flacon/default.nix
+++ b/pkgs/applications/audio/flacon/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   name = "flacon-${version}";
-  version = "5.1.0";
+  version = "5.2.0";
 
   src = fetchFromGitHub {
     owner = "flacon";
     repo = "flacon";
     rev = "v${version}";
-    sha256 = "18m077z1hqjg10chy5rgajd9q1wnrcxhiidivgjcdchc9q5d4b08";
+    sha256 = "0vmbwpfjq66qv3zp7mss3hsxy6dxjybqfm7k2xyc0w181qclg1ya";
   };
 
   nativeBuildInputs = [ cmake pkgconfig makeWrapper ];
diff --git a/pkgs/applications/audio/qsynth/default.nix b/pkgs/applications/audio/qsynth/default.nix
index 603ca8b36405..b146513d7350 100644
--- a/pkgs/applications/audio/qsynth/default.nix
+++ b/pkgs/applications/audio/qsynth/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation  rec {
   name = "qsynth-${version}";
-  version = "0.5.5";
+  version = "0.5.6";
 
   src = fetchurl {
     url = "mirror://sourceforge/qsynth/${name}.tar.gz";
-    sha256 = "08x7znvbwi9miavcarymi7dsv8njmxzwzma20dbmz8j2aswm53w5";
+    sha256 = "0h4hhja8qbyzd6v24flw9wr4mwl03nplryx1gyrppn7sg13l1sx6";
   };
 
   nativeBuildInputs = [ autoconf pkgconfig ];
diff --git a/pkgs/applications/audio/qtractor/default.nix b/pkgs/applications/audio/qtractor/default.nix
index 59bbceac7050..703ce5c5cf90 100644
--- a/pkgs/applications/audio/qtractor/default.nix
+++ b/pkgs/applications/audio/qtractor/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "qtractor";
-  version = "0.9.5";
+  version = "0.9.6";
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "1zsikhqj5xzhw2x3b6pqlmcwz3hxx07lbbif8v3m3j41snzjic22";
+    sha256 = "06sa4wl8zr0k8dnjiil0gjwnhrkq95h50xv56ih1y8jgyzxchaxp";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/audio/samplv1/default.nix b/pkgs/applications/audio/samplv1/default.nix
index cba85aacfbb8..1a1315394602 100644
--- a/pkgs/applications/audio/samplv1/default.nix
+++ b/pkgs/applications/audio/samplv1/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "samplv1-${version}";
-  version = "0.9.5";
+  version = "0.9.6";
 
   src = fetchurl {
     url = "mirror://sourceforge/samplv1/${name}.tar.gz";
-    sha256 = "0402rdr46za21w34m7ajzbwiiqcd1h0da3b0ldsr2z5g2mrkzxv8";
+    sha256 = "16a5xix9pn0gl3fr6bv6zl1l9vrzgvy1q7xd8yxzfr3vi5s8x4z9";
   };
 
   buildInputs = [ libjack2 alsaLib liblo libsndfile lv2 qt5.qtbase qt5.qttools];
diff --git a/pkgs/applications/audio/synthv1/default.nix b/pkgs/applications/audio/synthv1/default.nix
index 0918cf42830b..485796946990 100644
--- a/pkgs/applications/audio/synthv1/default.nix
+++ b/pkgs/applications/audio/synthv1/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "synthv1-${version}";
-  version = "0.9.5";
+  version = "0.9.6";
 
   src = fetchurl {
     url = "mirror://sourceforge/synthv1/${name}.tar.gz";
-    sha256 = "1b9w4cml3cmcg09kh852cahas6l9ks8wl3gzp1az8rzxz4229yg1";
+    sha256 = "1hcngk7mxfrqf8v3r759x3wd0p02nc3q83j8m3k58p408y3mx7nr";
   };
 
   buildInputs = [ qt5.qtbase qt5.qttools libjack2 alsaLib liblo lv2 ];
diff --git a/pkgs/applications/editors/android-studio/default.nix b/pkgs/applications/editors/android-studio/default.nix
index e5e5e179b890..80d84bcd2fd4 100644
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -18,21 +18,11 @@ let
     sha256Hash = "1v4apc73jdhavhzj8j46mzh15rw08w1hd9y9ykarj3b5q7i2vyq1";
   };
   latestVersion = { # canary & dev
-    version = "3.5.0.9"; # "Android Studio 3.5 Canary 10"
-    build = "191.5416148";
-    sha256Hash = "03d2x6bqasw417dxc7b8y65rral73xm2ci512gprmsvwy42k3mqi";
+    version = "3.5.0.10"; # "Android Studio 3.5 Canary 11"
+    build = "191.5455988";
+    sha256Hash = "1g24a8fwnrfzdf093wdmqly3mzjddk5ndgi51qj98amn7kclsdpf";
   };
 in rec {
-  # Old alias (TODO @primeos: Remove after 19.03 is branched off):
-  preview = throw ''
-    The attributes "android-studio-preview" and "androidStudioPackages.preview"
-    are now deprecated and will be removed soon, please use
-    "androidStudioPackages.beta" instead. This attribute corresponds to the
-    beta channel, if you want the latest release you can use
-    "androidStudioPackages.dev" or "androidStudioPackages.canary" instead
-    (currently, there is no difference between both channels).
-  '';
-
   # Attributes are named by their corresponding release channels
 
   stable = mkStudio (stableVersion // {
diff --git a/pkgs/applications/editors/neovim/neovim-remote.nix b/pkgs/applications/editors/neovim/neovim-remote.nix
index 891fd32df70b..52888c5f85d5 100644
--- a/pkgs/applications/editors/neovim/neovim-remote.nix
+++ b/pkgs/applications/editors/neovim/neovim-remote.nix
@@ -4,14 +4,14 @@ with stdenv.lib;
 
 pythonPackages.buildPythonApplication rec {
   pname = "neovim-remote";
-  version = "2.1.5";
+  version = "2.1.7";
   disabled = !pythonPackages.isPy3k;
 
   src = fetchFromGitHub {
     owner = "mhinz";
     repo = "neovim-remote";
     rev = "v${version}";
-    sha256 = "1h05b68ka1ka217f6svq8yxvnscwf9sl5cx46c0b6ygcbz1vr3ba";
+    sha256 = "014c8xvb7shy00vjx0b1k8zr7iknxskqab1aqvz9md3bn5rwkxm5";
   };
 
   propagatedBuildInputs = with pythonPackages; [ pynvim psutil ];
diff --git a/pkgs/applications/editors/okteta/default.nix b/pkgs/applications/editors/okteta/default.nix
index f2068eb30df0..ffa80bc68cae 100644
--- a/pkgs/applications/editors/okteta/default.nix
+++ b/pkgs/applications/editors/okteta/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   name = "okteta-${version}";
-  version = "0.26.0";
+  version = "0.26.1";
 
   src = fetchurl {
     url = "mirror://kde/stable/okteta/${version}/src/${name}.tar.xz";
-    sha256 = "0rxvbllisz4zl687zgpb9jj2nbxgfhhf2bj8bnsfaab5jb6jpi2y";
+    sha256 = "1bqq3ax47xym3ikwn6xsshs1b5gpfg5djrnkzszqnp127f1fxi54";
   };
 
   nativeBuildInputs = [ qtscript extra-cmake-modules kdoctools ];
diff --git a/pkgs/applications/gis/qgis/unwrapped.nix b/pkgs/applications/gis/qgis/unwrapped.nix
index e30f4a428a3e..719491ac2b08 100644
--- a/pkgs/applications/gis/qgis/unwrapped.nix
+++ b/pkgs/applications/gis/qgis/unwrapped.nix
@@ -10,12 +10,12 @@ let
     [ qscintilla-qt5 gdal jinja2 numpy psycopg2
       chardet dateutil pyyaml pytz requests urllib3 pygments pyqt5 sip owslib six ];
 in stdenv.mkDerivation rec {
-  version = "3.4.5";
+  version = "3.4.6";
   name = "qgis-unwrapped-${version}";
 
   src = fetchurl {
     url = "http://qgis.org/downloads/qgis-${version}.tar.bz2";
-    sha256 = "0myw1jgz8v8wncmrjsszn9ixylx84hafn0281c4hqhz623n3lxgx";
+    sha256 = "1skdimcbcv41hi4ii7iq8ka29k2zizzqv04fwidzfbxqclz7300h";
   };
 
   passthru = {
diff --git a/pkgs/applications/graphics/drawpile/default.nix b/pkgs/applications/graphics/drawpile/default.nix
index 6c354ebe37dc..75cd9447b86f 100644
--- a/pkgs/applications/graphics/drawpile/default.nix
+++ b/pkgs/applications/graphics/drawpile/default.nix
@@ -59,11 +59,11 @@ let
 
 in stdenv.mkDerivation rec {
   name = "drawpile-${version}";
-  version = "2.1.6";
+  version = "2.1.7";
 
   src = fetchurl {
     url = "https://drawpile.net/files/src/drawpile-${version}.tar.gz";
-    sha256 = "0vwsdvphigrq1daiazi411qflahlvgx8x8ssp581bng2lbq1vrbd";
+    sha256 = "1nk1rb1syrlkxq7qs101ifaf012mq42nmq1dbkssnx6niydi3bbd";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/latte-dock/default.nix b/pkgs/applications/misc/latte-dock/default.nix
index c27fda31a8fd..e560fa302940 100644
--- a/pkgs/applications/misc/latte-dock/default.nix
+++ b/pkgs/applications/misc/latte-dock/default.nix
@@ -3,12 +3,12 @@
 
 mkDerivation rec {
   pname = "latte-dock";
-  version = "0.8.6";
+  version = "0.8.8";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "https://download.kde.org/stable/${pname}/${name}.tar.xz";
-    sha256 = "1qzf9fkfkbv8vnc9p6lm7ya9hzydwk2f7671by9ij26f77lmxfb3";
+    sha256 = "137s7rx35a5qrfww3q8bllj4zyjfa7l709snvdfj34y7jbq7p6cd";
     name = "${name}.tar.xz";
   };
 
diff --git a/pkgs/applications/networking/feedreaders/rssguard/default.nix b/pkgs/applications/networking/feedreaders/rssguard/default.nix
index 297703cde696..a43d52d73597 100644
--- a/pkgs/applications/networking/feedreaders/rssguard/default.nix
+++ b/pkgs/applications/networking/feedreaders/rssguard/default.nix
@@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "rssguard";
-  version = "3.5.6";
+  version = "3.5.7";
 
   src = fetchFromGitHub {
     owner = "martinrotter";
     repo = pname;
     rev = version;
-    sha256 = "1pdas7hg3nzykm3qi951fk25c9s6gjb7my82b9xzjn2yd7ks71by";
+    sha256 = "1v0m2p6y7szdqbd2gl3972ah6cp6prfv2gp2a55ac1l8ba2dma4v";
   };
 
   buildInputs =  [ qtwebengine qttools ];
diff --git a/pkgs/applications/networking/gns3/default.nix b/pkgs/applications/networking/gns3/default.nix
index 9df43b690fd1..cda455d9e56e 100644
--- a/pkgs/applications/networking/gns3/default.nix
+++ b/pkgs/applications/networking/gns3/default.nix
@@ -1,16 +1,16 @@
 { callPackage, stdenv }:
 
 let
-  stableVersion = "2.1.15";
-  previewVersion = "2.2.0a4";
+  stableVersion = "2.1.16";
+  previewVersion = "2.2.0a5";
   addVersion = args:
     let version = if args.stable then stableVersion else previewVersion;
         branch = if args.stable then "stable" else "preview";
     in args // { inherit version branch; };
   mkGui = args: callPackage (import ./gui.nix (addVersion args)) { };
   mkServer = args: callPackage (import ./server.nix (addVersion args)) { };
-  guiSrcHash = "116wigkh5kwna00q200yv2wm8dpi4kmsns96iglzwrrl19fk538p";
-  serverSrcHash = "1mqwydxn58v5ddpnsxvf6vgqwhrfm3mwjwf030lv83zmcjhx237q";
+  guiSrcHash = "03d7yjdnks568njkrgyh7g6c3vf6v7wkifshz2bcvry79pp2h4nl";
+  serverSrcHash = "0p331aaqxw16kk5l2074qn9a7ih6fkivm05n8da3fwydzp9hjmcp";
 in {
   guiStable = mkGui {
     stable = true;
@@ -18,7 +18,7 @@ in {
   };
   guiPreview = mkGui {
     stable = false;
-    sha256Hash = "1a64c314v7mbaiipyap2skqgf69pyp1ld58cn2g3d89w2zrhf5q7";
+    sha256Hash = "0p4g5hszys68ijzsi2rb89j1rpg04wlqlzzrl92npvqqf2i0jdf8";
   };
 
   serverStable = mkServer {
@@ -27,6 +27,6 @@ in {
   };
   serverPreview = mkServer {
     stable = false;
-    sha256Hash = "1jlz8a34q3s1sz9r6swh3jnlp96602axnvh1byywry5fb9ga8mfy";
+    sha256Hash = "1yvdfczi8ah9m7b49l7larfs678hh7c424i1f73kivfds6211bj5";
   };
 }
diff --git a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
index 74e5e971742b..45d0dadbe902 100644
--- a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
@@ -13,11 +13,11 @@ assert pulseaudioSupport -> libpulseaudio != null;
 let
   inherit (stdenv.lib) concatStringsSep makeBinPath optional;
 
-  version = "2.8.182821.0412";
+  version = "2.8.183302.0415";
   srcs = {
     x86_64-linux = fetchurl {
       url = "https://zoom.us/client/${version}/zoom_x86_64.tar.xz";
-      sha256 = "18scnq9ga5nhslxg974zxlyqw1sjzg6l2g5mc6r4qqbbbn2nx92k";
+      sha256 = "07afq614fy09mjymmv3cf8vwa8ps78s2s4909g1a2rwvgkj8bw2x";
     };
   };
 
diff --git a/pkgs/applications/radio/urh/default.nix b/pkgs/applications/radio/urh/default.nix
index 452407d9c49a..ced3bccd7b67 100644
--- a/pkgs/applications/radio/urh/default.nix
+++ b/pkgs/applications/radio/urh/default.nix
@@ -3,13 +3,13 @@
 
 python3Packages.buildPythonApplication rec {
   name = "urh-${version}";
-  version = "2.5.6";
+  version = "2.5.7";
 
   src = fetchFromGitHub {
     owner = "jopohl";
     repo = "urh";
     rev = "v${version}";
-    sha256 = "06656lwbsjfs4hmh5xg38a1icgi49f37dkich0fx5yc92dvl8yfd";
+    sha256 = "110fwlj2fw8jgrsgqfkha7lx8f06w0ymh51mgpckx8a0wycznhcy";
   };
 
   buildInputs = [ hackrf rtl-sdr airspy limesuite ];
diff --git a/pkgs/applications/science/biology/star/default.nix b/pkgs/applications/science/biology/star/default.nix
index eb62a8c331f8..2f21da02fb00 100644
--- a/pkgs/applications/science/biology/star/default.nix
+++ b/pkgs/applications/science/biology/star/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "star-${version}";
-  version = "2.7.0c";
+  version = "2.7.0f";
 
   src = fetchFromGitHub {
     repo = "STAR";
     owner = "alexdobin";
     rev = version;
-    sha256 = "0r5jcckr45f71jwhz8xazi1w6kfhszq3y6r7f6zl9963ms1q1gfv";
+    sha256 = "0ndqlyimf7xf00nghn8awg12pw985ixghiypg98r2gdm7pscgd0i";
   };
 
   sourceRoot = "source/source";
diff --git a/pkgs/applications/science/electronics/gtkwave/default.nix b/pkgs/applications/science/electronics/gtkwave/default.nix
index 7d9d7a662f2f..e4c743ccdef5 100644
--- a/pkgs/applications/science/electronics/gtkwave/default.nix
+++ b/pkgs/applications/science/electronics/gtkwave/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "gtkwave-${version}";
-  version = "3.3.99";
+  version = "3.3.100";
 
   src = fetchurl {
     url    = "mirror://sourceforge/gtkwave/${name}.tar.gz";
-    sha256 = "0lc4y2vizrbxldjk5yw2i4y7pyprjdjqx3iafzjfnin694zp2630";
+    sha256 = "1z60i5nh8dz8j9ii63fwaw7k0p3x0scp91478cxmdv4xhp4njlxa";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/applications/science/logic/petrinizer/default.nix b/pkgs/applications/science/logic/petrinizer/default.nix
new file mode 100644
index 000000000000..cb35b9f27d52
--- /dev/null
+++ b/pkgs/applications/science/logic/petrinizer/default.nix
@@ -0,0 +1,25 @@
+{ mkDerivation, async, base, bytestring, containers, fetchFromGitLab, mtl
+, parallel-io, parsec, sbv, stdenv, stm, transformers
+}:
+mkDerivation rec {
+  pname = "petrinizer";
+  version = "0.9.1.1";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.lrz.de";
+    owner = "i7";
+    repo = pname;
+    rev = version;
+    sha256 = "1n7fzm96gq5rxm2f8w8sr1yzm1zcxpf0b473c6xnhsgqsis5j4xw";
+  };
+
+  isLibrary = false;
+  isExecutable = true;
+  executableHaskellDepends = [
+    async base bytestring containers mtl parallel-io parsec sbv stm
+    transformers
+  ];
+  description = "Safety and Liveness Analysis of Petri Nets with SMT solvers";
+  license = stdenv.lib.licenses.gpl3;
+  maintainers = with stdenv.lib.maintainers; [ raskin ];
+}
diff --git a/pkgs/applications/version-management/git-and-tools/git-remote-hg/default.nix b/pkgs/applications/version-management/git-and-tools/git-remote-hg/default.nix
index f30813cf1201..a93682f0c2e8 100644
--- a/pkgs/applications/version-management/git-and-tools/git-remote-hg/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-remote-hg/default.nix
@@ -1,16 +1,16 @@
-{ stdenv, fetchgit, mercurial, makeWrapper,
-  asciidoc, xmlto, docbook_xsl, docbook_xml_dtd_45, libxslt, libxml2
+{ stdenv, lib, fetchFromGitHub, mercurial, makeWrapper
+, asciidoc, xmlto, docbook_xsl, docbook_xml_dtd_45, libxslt, libxml2
 }:
 
 stdenv.mkDerivation rec {
-  rev = "e716a9e1a9e460a45663694ba4e9e8894a8452b2";
-  version = "0.2-${rev}";
-  name = "git-remote-hg-${version}";
+  pname = "git-remote-hg";
+  version = "1.0.0";
 
-  src = fetchgit {
-    inherit rev;
-    url = "git://github.com/fingolfin/git-remote-hg.git";
-    sha256 = "0cmlfdxfabrs3x10mfjfap8wz67s8xk2pjn2wlcj9k2v84gji60m";
+  src = fetchFromGitHub {
+    owner = "mnauw";
+    repo = "git-remote-hg";
+    rev = "v${version}";
+    sha256 = "0anl054zdi5rg5m4bm1n763kbdjkpdws3c89c8w8m5gq1ifsbd4d";
   };
 
   buildInputs = [ mercurial.python mercurial makeWrapper
@@ -26,9 +26,9 @@ stdenv.mkDerivation rec {
       --prefix PYTHONPATH : "$(echo ${mercurial}/lib/python*/site-packages):$(echo ${mercurial.python}/lib/python*/site-packages)${stdenv.lib.concatMapStrings (x: ":$(echo ${x}/lib/python*/site-packages)") mercurial.pythonPackages or []}"
   '';
 
-  meta = with stdenv.lib; {
-    homepage = https://github.com/felipec/git-remote-hg;
-    description = "Semi-official Mercurial bridge from Git project, once installed, it allows you to clone, fetch and push to and from Mercurial repositories as if they were Git ones";
+  meta = with lib; {
+    homepage = https://github.com/mnauw/git-remote-hg;
+    description = "Semi-official Mercurial bridge from Git project";
     license = licenses.gpl2;
     maintainers = [ maintainers.garbas ];
     platforms = platforms.unix;
diff --git a/pkgs/applications/video/obs-studio/linuxbrowser.nix b/pkgs/applications/video/obs-studio/linuxbrowser.nix
index 6d02233be321..14f40ad8901f 100644
--- a/pkgs/applications/video/obs-studio/linuxbrowser.nix
+++ b/pkgs/applications/video/obs-studio/linuxbrowser.nix
@@ -10,12 +10,12 @@
 
 stdenv.mkDerivation rec {
   name = "obs-linuxbrowser-${version}";
-  version = "0.6.0";
+  version = "0.6.1";
   src = fetchFromGitHub {
     owner = "bazukas";
     repo = "obs-linuxbrowser";
     rev = version;
-    sha256 = "000ngkiwfjjl25v4hz6lh6mdkf119pnq0qv3jwdmmp6fpd0dxcgh";
+    sha256 = "1mi9pchy07ipnx1m2767n29d53v822yajcf6c3705dhz882z21zq";
   };
   nativeBuildInputs = [ cmake ];
   buildInputs = [ obs-studio ];
diff --git a/pkgs/applications/video/streamlink/default.nix b/pkgs/applications/video/streamlink/default.nix
index 4cc0890a8475..79f092a882c7 100644
--- a/pkgs/applications/video/streamlink/default.nix
+++ b/pkgs/applications/video/streamlink/default.nix
@@ -1,14 +1,14 @@
 { stdenv, pythonPackages, fetchFromGitHub, rtmpdump, ffmpeg }:
 
 pythonPackages.buildPythonApplication rec {
-  version = "1.0.0";
+  version = "1.1.1";
   name = "streamlink-${version}";
 
   src = fetchFromGitHub {
     owner = "streamlink";
     repo = "streamlink";
     rev = "${version}";
-    sha256 = "12x8gnp6lv3vi1z2wfb0vjim2wm6abpr938yy48kqj7qff385ihd";
+    sha256 = "1vyf0pifdqygg98azdkfhy5fdckb0w2ca7c46mkrj452gkvmcq33";
   };
 
   checkInputs = with pythonPackages; [ pytest mock requests-mock freezegun ];
diff --git a/pkgs/development/interpreters/renpy/default.nix b/pkgs/development/interpreters/renpy/default.nix
index 1b40c71e2ea5..16434837dd14 100644
--- a/pkgs/development/interpreters/renpy/default.nix
+++ b/pkgs/development/interpreters/renpy/default.nix
@@ -7,7 +7,7 @@ with pythonPackages;
 
 stdenv.mkDerivation rec {
   name = "renpy-${version}";
-  version = "7.2.0";
+  version = "7.2.2";
 
   meta = with stdenv.lib; {
     description = "Ren'Py Visual Novel Engine";
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://www.renpy.org/dl/${version}/renpy-${version}-source.tar.bz2";
-    sha256 = "1pnzxmh37zzldvlyklk2wgc8xbh3hm3wwmbl70zdphybjrxvc7i5";
+    sha256 = "0b8pky0npi4gw59cnjicyrc9q1x2zsxa7x68y74dbgjg9r0dgkd7";
   };
 
   patches = [
diff --git a/pkgs/development/interpreters/spidermonkey/52.nix b/pkgs/development/interpreters/spidermonkey/52.nix
index ea96e5ed334a..1d7a11df5a41 100644
--- a/pkgs/development/interpreters/spidermonkey/52.nix
+++ b/pkgs/development/interpreters/spidermonkey/52.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchpatch, autoconf213, pkgconfig, perl, python2, zip, which, readline, icu, zlib, nspr }:
+{ stdenv, fetchurl, fetchpatch, autoconf213, pkgconfig, perl, python2, zip, which, readline, icu, zlib, nspr, buildPackages }:
 
 let
   version = "52.9.0";
@@ -14,7 +14,7 @@ in stdenv.mkDerivation rec {
   setOutputFlags = false; # Configure script only understands --includedir
 
   buildInputs = [ readline icu zlib nspr ];
-  nativeBuildInputs = [ autoconf213 pkgconfig perl which python2 zip ];
+  nativeBuildInputs = [ autoconf213 pkgconfig perl which buildPackages.python2 zip ];
 
   # Apparently this package fails to build correctly with modern compilers, which at least
   # on ARMv6 causes polkit testsuite to break with an assertion failure in spidermonkey.
@@ -31,10 +31,12 @@ in stdenv.mkDerivation rec {
     })
   ];
 
+  configurePlatforms = [ "host" "target" ];
+
   preConfigure = ''
     export CXXFLAGS="-fpermissive"
     export LIBXUL_DIST=$out
-    export PYTHON="${python2.interpreter}"
+    export PYTHON="${buildPackages.python2.interpreter}"
     configureFlagsArray+=("--includedir=$dev/include")
 
     cd js/src
@@ -43,7 +45,7 @@ in stdenv.mkDerivation rec {
   '';
 
   configureFlags = [
-    "--with-system-nspr"
+    "--with-nspr-prefix=${nspr}"
     "--with-system-zlib"
     "--with-system-icu"
     "--with-intl-api"
@@ -51,6 +53,12 @@ in stdenv.mkDerivation rec {
     "--enable-shared-js"
   ] ++ stdenv.lib.optional stdenv.hostPlatform.isMusl "--disable-jemalloc";
 
+  makeFlags = [
+    "HOST_CC=${buildPackages.stdenv.cc}/bin/cc"
+  ];
+
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+
   enableParallelBuilding = true;
 
   postInstall = ''
diff --git a/pkgs/development/libraries/ace/default.nix b/pkgs/development/libraries/ace/default.nix
index 54c95d6087a1..e0c46acb6303 100644
--- a/pkgs/development/libraries/ace/default.nix
+++ b/pkgs/development/libraries/ace/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "ace-${version}";
-  version = "6.5.4";
+  version = "6.5.5";
 
   src = fetchurl {
     url = "http://download.dre.vanderbilt.edu/previous_versions/ACE-${version}.tar.bz2";
-    sha256 = "0qs54p2kwkk05nfkijdn0rksjw86bkdk4mnh2nkxgnv32s6wdkv6";
+    sha256 = "1r1bvy65n50l6lbxm1k1bscqcv29mpkgp0pgr5cvvv7ldisrjl39";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/boost/darwin-1.55-no-system-python.patch b/pkgs/development/libraries/boost/darwin-1.55-no-system-python.patch
new file mode 100644
index 000000000000..f8163f6d2718
--- /dev/null
+++ b/pkgs/development/libraries/boost/darwin-1.55-no-system-python.patch
@@ -0,0 +1,45 @@
+diff --git a/tools/build/src/tools/python.jam b/tools/build/src/tools/python.jam
+index 273b28a..2d2031e 100644
+--- a/tools/build/v2/tools/python.jam
++++ b/tools/build/v2/tools/python.jam
+@@ -428,13 +428,7 @@ local rule windows-installed-pythons ( version ? )
+ 
+ local rule darwin-installed-pythons ( version ? )
+ {
+-    version ?= $(.version-countdown) ;
+-
+-    local prefix
+-      = [ GLOB /System/Library/Frameworks /Library/Frameworks
+-          : Python.framework ] ;
+-
+-    return $(prefix)/Versions/$(version)/bin/python ;
++    return ;
+ }
+ 
+ 
+@@ -890,25 +884,6 @@ local rule configure ( version ? : cmd-or-prefix ? : includes * : libraries ? :
+ 
+     # See if we can find a framework directory on darwin.
+     local framework-directory ;
+-    if $(target-os) = darwin
+-    {
+-        # Search upward for the framework directory.
+-        local framework-directory = $(libraries[-1]) ;
+-        while $(framework-directory:D=) && $(framework-directory:D=) != Python.framework
+-        {
+-            framework-directory = $(framework-directory:D) ;
+-        }
+-
+-        if $(framework-directory:D=) = Python.framework
+-        {
+-            debug-message framework directory is \"$(framework-directory)\" ;
+-        }
+-        else
+-        {
+-            debug-message "no framework directory found; using library path" ;
+-            framework-directory = ;
+-        }
+-    }
+ 
+     local dll-path = $(libraries) ;
+ 
diff --git a/pkgs/development/libraries/boost/generic.nix b/pkgs/development/libraries/boost/generic.nix
index dd383bd01231..8ce44b878d07 100644
--- a/pkgs/development/libraries/boost/generic.nix
+++ b/pkgs/development/libraries/boost/generic.nix
@@ -104,7 +104,10 @@ stdenv.mkDerivation {
   patchFlags = "";
 
   patches = patches
-    ++ optional stdenv.isDarwin ./darwin-no-system-python.patch;
+  ++ optional stdenv.isDarwin (
+    if version == "1.55.0"
+    then ./darwin-1.55-no-system-python.patch
+    else ./darwin-no-system-python.patch);
 
   meta = {
     homepage = http://boost.org/;
diff --git a/pkgs/development/libraries/double-conversion/default.nix b/pkgs/development/libraries/double-conversion/default.nix
index 04fd04a564f8..402bf0232813 100644
--- a/pkgs/development/libraries/double-conversion/default.nix
+++ b/pkgs/development/libraries/double-conversion/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "double-conversion-${version}";
-  version = "3.1.3";
+  version = "3.1.4";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "double-conversion";
     rev = "v${version}";
-    sha256 = "082w15xq8f4c422a71phvcahgc8vmqrig97av9g9628q5n2ybbgg";
+    sha256 = "13xwcqk2c0q8c1siw566clxcpvp0xrxvb72mra42wa3nvq9wlsv6";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/flatpak/default.nix b/pkgs/development/libraries/flatpak/default.nix
index c3cac531263a..a4a0bd1a263c 100644
--- a/pkgs/development/libraries/flatpak/default.nix
+++ b/pkgs/development/libraries/flatpak/default.nix
@@ -32,6 +32,7 @@ stdenv.mkDerivation rec {
     # patch taken from gtk_doc
     ./respect-xml-catalog-files-var.patch
     ./use-flatpak-from-path.patch
+    ./unset-env-vars.patch
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/flatpak/unset-env-vars.patch b/pkgs/development/libraries/flatpak/unset-env-vars.patch
new file mode 100644
index 000000000000..798e388b23c2
--- /dev/null
+++ b/pkgs/development/libraries/flatpak/unset-env-vars.patch
@@ -0,0 +1,10 @@
+--- a/common/flatpak-run.c
++++ b/common/flatpak-run.c
+@@ -1192,6 +1192,7 @@ static const ExportData default_exports[] = {
+   {"PERLLIB", NULL},
+   {"PERL5LIB", NULL},
+   {"XCURSOR_PATH", NULL},
++  {"GDK_PIXBUF_MODULE_FILE", NULL},
+ };
+ 
+ static const ExportData no_ld_so_cache_exports[] = {
diff --git a/pkgs/development/libraries/libassuan/default.nix b/pkgs/development/libraries/libassuan/default.nix
index 3c78b6265bf9..507470900111 100644
--- a/pkgs/development/libraries/libassuan/default.nix
+++ b/pkgs/development/libraries/libassuan/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, stdenv, gettext, pth, libgpgerror }:
+{ fetchurl, stdenv, gettext, pth, libgpgerror, buildPackages }:
 
 stdenv.mkDerivation rec {
   pname = "libassuan";
@@ -12,7 +12,12 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "dev" "info" ];
   outputBin = "dev"; # libassuan-config
 
-  buildInputs = [ libgpgerror pth gettext];
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+  buildInputs = [ pth gettext ];
+
+  configureFlags = [
+    "--with-libgpg-error-prefix=${libgpgerror.dev}"
+  ];
 
   doCheck = true;
 
diff --git a/pkgs/development/libraries/matio/default.nix b/pkgs/development/libraries/matio/default.nix
index 72743efeb8ef..9abdf4bbd854 100644
--- a/pkgs/development/libraries/matio/default.nix
+++ b/pkgs/development/libraries/matio/default.nix
@@ -1,9 +1,9 @@
 { stdenv, fetchurl }:
 stdenv.mkDerivation rec {
-  name = "matio-1.5.14";
+  name = "matio-1.5.15";
   src = fetchurl {
     url = "mirror://sourceforge/matio/${name}.tar.gz";
-    sha256 = "0vhzh0idzlm0m28gxsnv1dcfp0229vdj49d749qn4xfdyncbnfhb";
+    sha256 = "1kxi15ph68nnbi0s1m8icb0685wg8ql8gj7wnkdk20kzpf3lbgr1";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/opencolorio/default.nix b/pkgs/development/libraries/opencolorio/default.nix
index 42c0de4d493c..3081c6c839c8 100644
--- a/pkgs/development/libraries/opencolorio/default.nix
+++ b/pkgs/development/libraries/opencolorio/default.nix
@@ -4,13 +4,13 @@ with lib;
 
 stdenv.mkDerivation rec {
   name = "opencolorio-${version}";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "imageworks";
     repo = "OpenColorIO";
     rev = "v${version}";
-    sha256 = "0cjsyn681xsg89lirlll5pqlsqg2vnk1278iiicmzjy2a2v8x7zq";
+    sha256 = "12srvxca51czpfjl0gabpidj9n84mw78ivxy5w75qhq2mmc798sb";
   };
 
   outputs = [ "bin" "out" "dev" ];
diff --git a/pkgs/development/libraries/openfst/default.nix b/pkgs/development/libraries/openfst/default.nix
index c8c66969ef9b..cd3210dd08b1 100644
--- a/pkgs/development/libraries/openfst/default.nix
+++ b/pkgs/development/libraries/openfst/default.nix
@@ -3,11 +3,11 @@
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "openfst";
-  version = "1.7.1";
+  version = "1.7.2";
 
   src = fetchurl {
     url = "http://www.openfst.org/twiki/pub/FST/FstDownload/${name}.tar.gz";
-    sha256 = "0x9wfcqd8hq4h349s7j77sr60h8xjdfshqw1m3a2n6z5bdr9qkm1";
+    sha256 = "0fqgk8195kz21is09gwzwnrg7fr9526bi9mh4apyskapz27pbhr1";
   };
   meta = {
     description = "Library for working with finite-state transducers";
diff --git a/pkgs/development/libraries/polkit/default.nix b/pkgs/development/libraries/polkit/default.nix
index 737a9a5badf2..f47d2713f1a4 100644
--- a/pkgs/development/libraries/polkit/default.nix
+++ b/pkgs/development/libraries/polkit/default.nix
@@ -2,6 +2,7 @@
 , intltool, spidermonkey_52 , gobject-introspection, libxslt, docbook_xsl, dbus
 , docbook_xml_dtd_412, gtk-doc, coreutils
 , useSystemd ? stdenv.isLinux, systemd
+, withGnome ? true
 , doCheck ? stdenv.isLinux
 }:
 
@@ -42,11 +43,12 @@ stdenv.mkDerivation rec {
   outputs = [ "bin" "dev" "out" ]; # small man pages in $bin
 
   nativeBuildInputs =
-    [ gtk-doc pkgconfig autoreconfHook intltool gobject-introspection perl ]
+    [ glib gtk-doc pkgconfig intltool perl ]
     ++ [ libxslt docbook_xsl docbook_xml_dtd_412 ]; # man pages
   buildInputs =
-    [ glib expat pam spidermonkey_52 gobject-introspection ]
-    ++ stdenv.lib.optional useSystemd systemd;
+    [ glib expat pam spidermonkey_52 ]
+    ++ stdenv.lib.optional useSystemd systemd
+    ++ stdenv.lib.optional withGnome gobject-introspection;
 
   NIX_CFLAGS_COMPILE = " -Wno-deprecated-declarations "; # for polkit 0.114 and glib 2.56
 
@@ -73,7 +75,7 @@ stdenv.mkDerivation rec {
     "--with-systemdsystemunitdir=$(out)/etc/systemd/system"
     "--with-polkitd-user=polkituser" #TODO? <nixos> config.ids.uids.polkituser
     "--with-os-type=NixOS" # not recognized but prevents impurities on non-NixOS
-    "--enable-introspection"
+    (if withGnome then "--enable-introspection" else "--disable-introspection")
   ] ++ stdenv.lib.optional (!doCheck) "--disable-test";
 
   makeFlags = "INTROSPECTION_GIRDIR=$(out)/share/gir-1.0 INTROSPECTION_TYPELIBDIR=$(out)/lib/girepository-1.0";
diff --git a/pkgs/development/libraries/protobufc/1.3.nix b/pkgs/development/libraries/protobufc/1.3.nix
index 4d53c42a3478..c3a815c45ac8 100644
--- a/pkgs/development/libraries/protobufc/1.3.nix
+++ b/pkgs/development/libraries/protobufc/1.3.nix
@@ -5,7 +5,8 @@ callPackage ./generic.nix (args // rec {
   src = fetchFromGitHub {
     owner = "protobuf-c";
     repo = "protobuf-c";
-    rev = "v${version}";
-    sha256 = "1dmvs0bhyx94ipaq3c7jmwcz4hwjmznn7310kqkqx7ly0w5vxxxr";
+    #rev = "v${version}";
+    rev = "9412830d0680150d429d2aa170b8d7218ab49397";
+    sha256 = "175cmaj5231iqzhf5a9sxw2y3i165chk3681m1b5mp8di927q5ai";
   };
 })
diff --git a/pkgs/development/python-modules/XlsxWriter/default.nix b/pkgs/development/python-modules/XlsxWriter/default.nix
index 99da64268ee2..e7c5595fe087 100644
--- a/pkgs/development/python-modules/XlsxWriter/default.nix
+++ b/pkgs/development/python-modules/XlsxWriter/default.nix
@@ -3,7 +3,7 @@
 buildPythonPackage rec {
 
   pname = "XlsxWriter";
-  version = "1.1.5";
+  version = "1.1.6";
 
   # PyPI release tarball doesn't contain tests so let's use GitHub. See:
   # https://github.com/jmcnamara/XlsxWriter/issues/327
@@ -11,7 +11,7 @@ buildPythonPackage rec {
     owner = "jmcnamara";
     repo = pname;
     rev = "RELEASE_${version}";
-    sha256 = "13250y53mr0pki93sqscy2bx01fxh6b6wvvj6m95ky0wqrrbmg39";
+    sha256 = "1hmagwh2k61r90a9xgp3xj24wb97ckllvgn82vsin9kvhhj1459i";
   };
 
   meta = {
diff --git a/pkgs/development/python-modules/gensim/default.nix b/pkgs/development/python-modules/gensim/default.nix
index 8c7b96e66dda..2bd1bfce6f95 100644
--- a/pkgs/development/python-modules/gensim/default.nix
+++ b/pkgs/development/python-modules/gensim/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "gensim";
-  version = "3.7.1";
+  version = "3.7.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ed845ac585f724ae1f40fdb517ed8ade822531f9bbcd1be4a599c2e86aff48a8";
+    sha256 = "1la4y935sdah8ywa7krwy80hcl4n2k8cdx4ncy3dg3y2mdg3vq24";
   };
 
   propagatedBuildInputs = [ smart_open numpy six scipy ];
diff --git a/pkgs/development/python-modules/keepkey/default.nix b/pkgs/development/python-modules/keepkey/default.nix
index 551614409db4..bbe72befb6d2 100644
--- a/pkgs/development/python-modules/keepkey/default.nix
+++ b/pkgs/development/python-modules/keepkey/default.nix
@@ -3,13 +3,13 @@
 
 buildPythonPackage rec {
   pname = "keepkey";
-  version = "6.0.2";
+  version = "6.0.3";
 
   src = fetchFromGitHub {
     owner = "keepkey";
     repo = "python-keepkey";
     rev = "v${version}";
-    sha256 = "1778c9vabn9a7b7lbirwclswnqmzqm00slklvnhqacbbdf4rp417";
+    sha256 = "0jnkh1nin1lwnx32ak6sv8gzmpnkvcy6vm23wzm1ymzfndxk6rnm";
   };
 
   propagatedBuildInputs = [ protobuf hidapi trezor ];
diff --git a/pkgs/development/python-modules/peewee/default.nix b/pkgs/development/python-modules/peewee/default.nix
index 344f52d245f6..08c908e0aa59 100644
--- a/pkgs/development/python-modules/peewee/default.nix
+++ b/pkgs/development/python-modules/peewee/default.nix
@@ -10,14 +10,14 @@
 buildPythonPackage rec {
 
   pname = "peewee";
-  version = "3.9.2";
+  version = "3.9.3";
 
   # pypi release does not provide tests
   src = fetchFromGitHub {
     owner = "coleifer";
     repo = pname;
     rev = version;
-    sha256 = "0rmjr90555s1n6caqbncvilx6v30cksmcr4bjzylapsl3a5aw9aa";
+    sha256 = "1frwwqkk0y1bkcm7bdzbyv2119vv640ncgs4d55zhbs70fxm2ylj";
   };
 
 
diff --git a/pkgs/development/python-modules/py3exiv2/default.nix b/pkgs/development/python-modules/py3exiv2/default.nix
index 676f6b22990b..2a886c4cf915 100644
--- a/pkgs/development/python-modules/py3exiv2/default.nix
+++ b/pkgs/development/python-modules/py3exiv2/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "py3exiv2";
-  version = "0.5.0";
+  version = "0.6.1";
   disabled = !(isPy3k);
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "09mv7hcczayzjbd4dsrph16ab21slaiamgph9lwr1kjdw7ri5cpg";
+    sha256 = "1j2pkynqdqrxf86qyzrjj76i33ylxfsrqxv4j2x9bkd0hk6x0pa6";
   };
 
   buildInputs = [ exiv2 boost ];
diff --git a/pkgs/development/python-modules/py3status/default.nix b/pkgs/development/python-modules/py3status/default.nix
index d8f3c01bbd48..8cca405f7bfd 100644
--- a/pkgs/development/python-modules/py3status/default.nix
+++ b/pkgs/development/python-modules/py3status/default.nix
@@ -23,11 +23,11 @@
 
 buildPythonPackage rec {
   pname = "py3status";
-  version = "3.16";
+  version = "3.18";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1xrfph277bgjln3jbpzpgkhxad04fjvj7s3xfil42q1sxi4s3q3g";
+    sha256 = "053znyl68sjmlp3r4br5jxhqqswjfbb1rb8k6f9qpzcym37439r0";
   };
 
   doCheck = false;
diff --git a/pkgs/development/python-modules/pysaml2/default.nix b/pkgs/development/python-modules/pysaml2/default.nix
index 04d0d1c34a54..9512fce4f452 100644
--- a/pkgs/development/python-modules/pysaml2/default.nix
+++ b/pkgs/development/python-modules/pysaml2/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "pysaml2";
-  version = "4.6.5";
+  version = "4.7.0";
 
   # No tests in PyPI tarball
   src = fetchFromGitHub {
     owner = "IdentityPython";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0xlbr52vzx1j9sg65jhqv01vp4a49afjy03lc2zb0ggx0xxzngvb";
+    sha256 = "1bpfvy2xd3aqf79ihglmxlxnv7406184p99h5mn5h9ifs54vvhhl";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/shellingham/default.nix b/pkgs/development/python-modules/shellingham/default.nix
index c1791db9fbc9..707a79e10551 100644
--- a/pkgs/development/python-modules/shellingham/default.nix
+++ b/pkgs/development/python-modules/shellingham/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "shellingham";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "116r78nhw74rh857kv9l614xjr6k89919s6l8b14hlvy8fz8rg51";
+    sha256 = "1q7kws7w4x2hji3g7y0ni9ddk4sd676ylrb3db54gbpys6xj6nwq";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/python-modules/shodan/default.nix b/pkgs/development/python-modules/shodan/default.nix
index bf57b9846ee5..586edd766cda 100644
--- a/pkgs/development/python-modules/shodan/default.nix
+++ b/pkgs/development/python-modules/shodan/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "shodan";
-  version = "1.11.1";
+  version = "1.12.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0kjcyw3xmps3maf4vzn1pypc6i60q8b67xj78v4gbv4yx2cp2fzr";
+    sha256 = "0fd68yaqhpay7jxhyc6xkdrak88wdblxs0phgdkngbakx2yaw2y3";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/smart_open/default.nix b/pkgs/development/python-modules/smart_open/default.nix
index 9d4df1135994..7504d527ca7b 100644
--- a/pkgs/development/python-modules/smart_open/default.nix
+++ b/pkgs/development/python-modules/smart_open/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "smart_open";
-  version = "1.8.0";
+  version = "1.8.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a52206bb69c38c5f08709ec2ee5704b0f86fc0a770935b5dad9b5841bfd5f502";
+    sha256 = "0a38mwlz92mlaxz8f8z4yyacpgykiysbcwfykrgr74vlic8x4m5i";
   };
 
   # nixpkgs version of moto is >=1.2.0, remove version pin to fix build
diff --git a/pkgs/development/python-modules/tenacity/default.nix b/pkgs/development/python-modules/tenacity/default.nix
index d34231ca9a9e..3540bebd1960 100644
--- a/pkgs/development/python-modules/tenacity/default.nix
+++ b/pkgs/development/python-modules/tenacity/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "tenacity";
-  version = "5.0.3";
+  version = "5.0.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "12z36fq6qfn9sgd1snsfwrk5j2cw29bsb7mkb0g818fal41g7dr4";
+    sha256 = "06sp12cn8zcb7rqklq91f6mxhvrdq5cs0p3pdiazacqcmvvwbhx0";
   };
 
   nativeBuildInputs = [ pbr ];
diff --git a/pkgs/development/python-modules/twilio/default.nix b/pkgs/development/python-modules/twilio/default.nix
index 2b04fdc20c95..9c20226fea05 100644
--- a/pkgs/development/python-modules/twilio/default.nix
+++ b/pkgs/development/python-modules/twilio/default.nix
@@ -3,13 +3,13 @@
 
 buildPythonPackage rec {
   pname = "twilio";
-  version = "6.26.0";
+  version = "6.26.1";
   # tests not included in PyPi, so fetch from github instead
   src = fetchFromGitHub {
     owner = "twilio";
     repo = "twilio-python";
     rev = version;
-    sha256 = "0l50n5hljkp7w2l4c36arxf4dxhkfhs7ywwck9y1gvcgsnvccmss";
+    sha256 = "1ly22ah487jkq0my1l3c6hbx24fgganjhxrlrcw5jfc80qmgd3hd";
   };
 
   buildInputs = [ nose mock ];
diff --git a/pkgs/development/tools/build-managers/apache-maven/default.nix b/pkgs/development/tools/build-managers/apache-maven/default.nix
index c48954a6aaa3..cde6ea2f7a87 100644
--- a/pkgs/development/tools/build-managers/apache-maven/default.nix
+++ b/pkgs/development/tools/build-managers/apache-maven/default.nix
@@ -2,7 +2,7 @@
 
 assert jdk != null;
 
-let version = "3.6.0"; in
+let version = "3.6.1"; in
 stdenv.mkDerivation rec {
   name = "apache-maven-${version}";
 
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://apache/maven/maven-3/${version}/binaries/${name}-bin.tar.gz";
-    sha256 = "0ds61yy6hs7jgmld64b65ss6kpn5cwb186hw3i4il7vaydm386va";
+    sha256 = "1rv97g9qr6sifl88rxbsqnz5i79m6ifs36srri08j3y3k5dc6a15";
   };
 
   buildInputs = [ makeWrapper ];
diff --git a/pkgs/development/tools/just/default.nix b/pkgs/development/tools/just/default.nix
index 70f09d467f6b..ccfa62c0b0df 100644
--- a/pkgs/development/tools/just/default.nix
+++ b/pkgs/development/tools/just/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "just";
-  version = "0.4.0";
+  version = "0.4.2";
 
   src = fetchFromGitHub {
     owner = "casey";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1v42y8lc1akpnzad0gf89jywbxa74mmzimfsbvkdi7101z5q5qlp";
+    sha256 = "0l35pri5m5k5j12zd42kr5pdx97q1xq1r0shif7hs768if0n8ihm";
   };
 
-  cargoSha256 = "1kgkcl7qffh6vbjdpvrkw8ih1v8zrxs3f0a20mg6z97gdym6mm8g";
+  cargoSha256 = "0wqjk2zxkd6lwki7blsdsbdnr250zs4d0ivjxc2w3i3xivlsjbw8";
 
   checkInputs = [ coreutils bash dash ];
 
diff --git a/pkgs/development/tools/ocaml/dune/default.nix b/pkgs/development/tools/ocaml/dune/default.nix
index 9ea595da3344..632fe9fff325 100644
--- a/pkgs/development/tools/ocaml/dune/default.nix
+++ b/pkgs/development/tools/ocaml/dune/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   name = "dune-${version}";
-  version = "1.9.0";
+  version = "1.9.1";
   src = fetchurl {
     url = "https://github.com/ocaml/dune/releases/download/${version}/dune-${version}.tbz";
-    sha256 = "18j5afg54bww9az05wc7m5ixzvvq38wfnwq6ni09pi2n848m21ca";
+    sha256 = "0z4jnj0a5vxjqlwksplhag9b3s3iqdcpcpjjzfazv5jdl5cf58f9";
   };
 
   buildInputs = [ ocaml findlib ];
diff --git a/pkgs/development/tools/ocaml/opam/default.nix b/pkgs/development/tools/ocaml/opam/default.nix
index a7f06e734530..1e1f7fade25a 100644
--- a/pkgs/development/tools/ocaml/opam/default.nix
+++ b/pkgs/development/tools/ocaml/opam/default.nix
@@ -55,13 +55,13 @@ let
       sha256 = "02lb2d9i12bxrz2ba5wygk2bycan316skqlyri0597q7j9210g8r";
     };
     opam = fetchurl {
-      url = "https://github.com/ocaml/opam/archive/2.0.2.zip";
-      sha256 = "0hxf0ns3si03rl7dxix7i30limbl50ffyvdyk9bqqms4ir8dcza6";
+      url = "https://github.com/ocaml/opam/archive/2.0.4.zip";
+      sha256 = "1312nc9s4h0vksiimz7jsv3zw17fa05p6mdx23s5sii0qspvnx8c";
     };
   };
 in stdenv.mkDerivation rec {
   name = "opam-${version}";
-  version = "2.0.2";
+  version = "2.0.4";
 
   buildInputs = [ unzip curl ncurses ocaml makeWrapper getconf ] ++ lib.optional stdenv.isLinux bubblewrap;
 
@@ -117,4 +117,4 @@ in stdenv.mkDerivation rec {
     platforms = platforms.all;
   };
 }
-# Generated by: ./opam.nix.pl -v 2.0.2 -p opam-shebangs.patch
+# Generated by: ./opam.nix.pl -v 2.0.4 -p opam-shebangs.patch
diff --git a/pkgs/games/openttd/default.nix b/pkgs/games/openttd/default.nix
index d0e880f5f2cc..80a66d31b802 100644
--- a/pkgs/games/openttd/default.nix
+++ b/pkgs/games/openttd/default.nix
@@ -29,11 +29,11 @@ let
 in
 stdenv.mkDerivation rec {
   name = "openttd-${version}";
-  version = "1.9.0";
+  version = "1.9.1";
 
   src = fetchurl {
     url = "http://proxy.binaries.openttd.org/openttd-releases/${version}/${name}-source.tar.xz";
-    sha256 = "06blx844q6a248jwzqlgi82692vvkmvb00bfdx4jhcwp9mayvza5";
+    sha256 = "1r8i6yzgww7aw8iibqagahg1gqgw7305g07agy0dpszzvp0mi0gz";
   };
 
   nativeBuildInputs = [ pkgconfig makeWrapper ];
diff --git a/pkgs/games/steam/chrootenv.nix b/pkgs/games/steam/chrootenv.nix
index 4661cf7d8035..598ddc485630 100644
--- a/pkgs/games/steam/chrootenv.nix
+++ b/pkgs/games/steam/chrootenv.nix
@@ -35,6 +35,10 @@ let
   ldPath = map (x: "/steamrt/${steam-runtime-wrapped.arch}/" + x) steam-runtime-wrapped.libs
            ++ lib.optionals (steam-runtime-wrapped-i686 != null) (map (x: "/steamrt/${steam-runtime-wrapped-i686.arch}/" + x) steam-runtime-wrapped-i686.libs);
 
+  setupSh = writeScript "setup.sh" ''
+    #!${runtimeShell}
+  '';
+
   runSh = writeScript "run.sh" ''
     #!${runtimeShell}
     runtime_paths="${lib.concatStringsSep ":" ldPath}"
@@ -168,6 +172,7 @@ in buildFHSUserEnv rec {
       ln -s ../lib32/steam-runtime steamrt/${steam-runtime-wrapped-i686.arch}
     ''}
     ln -s ${runSh} steamrt/run.sh
+    ln -s ${setupSh} steamrt/setup.sh
   '' else ''
     ln -s /usr/lib/libbz2.so usr/lib/libbz2.so.1.0
     ${lib.optionalString (steam-runtime-wrapped-i686 != null) ''
diff --git a/pkgs/misc/emulators/wine/sources.nix b/pkgs/misc/emulators/wine/sources.nix
index b8a896d86836..cfb4e35c2b55 100644
--- a/pkgs/misc/emulators/wine/sources.nix
+++ b/pkgs/misc/emulators/wine/sources.nix
@@ -31,24 +31,24 @@ in rec {
 
     ## see http://wiki.winehq.org/Mono
     mono = fetchurl rec {
-      version = "4.7.5";
+      version = "4.8.0";
       url = "http://dl.winehq.org/wine/wine-mono/${version}/wine-mono-${version}.msi";
-      sha256 = "0gsb03dc97hqdkw8kpl5ky53bygfnpxkgn2ry5bfzvfdfva6hk8m";
+      sha256 = "0y47mfjkb2viraqrvi8qpjn2935sra81h3l4bvaag737s7zmj0c9";
     };
   };
 
   unstable = fetchurl rec {
     # NOTE: Don't forget to change the SHA256 for staging as well.
-    version = "4.2";
+    version = "4.5";
     url = "https://dl.winehq.org/wine/source/4.x/wine-${version}.tar.xz";
-    sha256 = "1ysvq2jyvh7r27iwpsrlrwzj672jnrihry91bx3m3fysz3sl3ld1";
+    sha256 = "1dy1v27cw9vp2xnr8y4bdcvvw5ivcgpk2375jgn536csbwaxgwjz";
     inherit (stable) mono gecko32 gecko64;
   };
 
   staging = fetchFromGitHub rec {
     # https://github.com/wine-staging/wine-staging/releases
     inherit (unstable) version;
-    sha256 = "1dhv6y60g64bj3kgfknbfzxfzmy686dh7svxlvi4lfis2faikxmk";
+    sha256 = "18xpha7nl3jg7c24cgbncciyyqqb6svsyfp1xk81993wnl6r8abs";
     owner = "wine-staging";
     repo = "wine-staging";
     rev = "v${version}";
@@ -56,8 +56,8 @@ in rec {
 
   winetricks = fetchFromGitHub rec {
     # https://github.com/Winetricks/winetricks/releases
-    version = "20181203";
-    sha256 = "1as5h5xibpplm619b1i73g974p96q2jnd7fqm28xj3zkqy7qjdm3";
+    version = "20190310";
+    sha256 = "0mqzl7k9q7lfkmk8fk9dfzi2dm45h31mrid9265qh2d56nk28ali";
     owner = "Winetricks";
     repo = "winetricks";
     rev = version;
diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index df9a628f83da..5a086612925d 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -33,6 +33,10 @@
   # NixOS to implement kernel-specific behaviour.
   features ? {}
 
+, # Custom seed used for CONFIG_GCC_PLUGIN_RANDSTRUCT if enabled. This is
+  # automatically extended with extra per-version and per-config values.
+  randstructSeed ? ""
+
 , # A list of patches to apply to the kernel.  Each element of this list
   # should be an attribute set {name, patch} where `name' is a
   # symbolic name and `patch' is the actual patch.  The patch may
@@ -162,7 +166,7 @@ let
   }; # end of configfile derivation
 
   kernel = (callPackage ./manual-config.nix {}) {
-    inherit version modDirVersion src kernelPatches stdenv extraMeta configfile;
+    inherit version modDirVersion src kernelPatches randstructSeed stdenv extraMeta configfile;
 
     config = { CONFIG_MODULES = "y"; CONFIG_FW_LOADER = "m"; };
   };
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 4b570c1fe940..1512f47ade40 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -30,6 +30,9 @@ in {
   # Manually specified nixexpr representing the config
   # If unspecified, this will be autodetected from the .config
   config ? stdenv.lib.optionalAttrs allowImportFromDerivation (readConfig configfile),
+  # Custom seed used for CONFIG_GCC_PLUGIN_RANDSTRUCT if enabled. This is
+  # automatically extended with extra per-version and per-config values.
+  randstructSeed ? "",
   # Use defaultMeta // extraMeta
   extraMeta ? {},
   # Whether to utilize the controversial import-from-derivation feature to parse the config
@@ -111,7 +114,7 @@ let
         if [ -f scripts/gcc-plugins/gen-random-seed.sh ]; then
           substituteInPlace scripts/gcc-plugins/gen-random-seed.sh \
             --replace NIXOS_RANDSTRUCT_SEED \
-            $(echo ${src} ${configfile} | sha256sum | cut -d ' ' -f 1 | tr -d '\n')
+            $(echo ${randstructSeed}${src} ${configfile} | sha256sum | cut -d ' ' -f 1 | tr -d '\n')
         fi
       '';
 
diff --git a/pkgs/os-specific/linux/nmon/default.nix b/pkgs/os-specific/linux/nmon/default.nix
index 3ec0dc45e16d..bb00db9868e4 100644
--- a/pkgs/os-specific/linux/nmon/default.nix
+++ b/pkgs/os-specific/linux/nmon/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "nmon-${version}";
-  version = "16i";
+  version = "16j";
 
   src = fetchurl {
     url = "mirror://sourceforge/nmon/lmon${version}.c";
-    sha256 = "0k52nvkfhwq7125gbrz7p56gid4rik59am8w22ja8ihiribdfrmg";
+    sha256 = "05a6yc1w421r30qg32a8j0wajjv2ff1mwwsrariv3fz3ng4phf5s";
   };
 
   buildInputs = [ ncurses ];
diff --git a/pkgs/servers/amqp/rabbitmq-server/default.nix b/pkgs/servers/amqp/rabbitmq-server/default.nix
index b34a44715a57..37a2e6369d47 100644
--- a/pkgs/servers/amqp/rabbitmq-server/default.nix
+++ b/pkgs/servers/amqp/rabbitmq-server/default.nix
@@ -6,11 +6,11 @@
 stdenv.mkDerivation rec {
   name = "rabbitmq-server-${version}";
 
-  version = "3.7.12";
+  version = "3.7.14";
 
   src = fetchurl {
     url = "https://github.com/rabbitmq/rabbitmq-server/releases/download/v${version}/${name}.tar.xz";
-    sha256 = "14w7czxqdxgmsqxrvphzpyha1nq3yfhka4vy8wyzwixindgj493q";
+    sha256 = "12lx4ij89khg9nfiq5l9bijgm7yjrw9kh7y09wqjhv2ws0mq3437";
   };
 
   buildInputs =
diff --git a/pkgs/servers/lidarr/default.nix b/pkgs/servers/lidarr/default.nix
index 897c061c918d..fb2fd42dd7da 100644
--- a/pkgs/servers/lidarr/default.nix
+++ b/pkgs/servers/lidarr/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "lidarr-${version}";
-  version = "0.5.0.583";
+  version = "0.6.0.815";
 
   src = fetchurl {
     url = "https://github.com/lidarr/Lidarr/releases/download/v${version}/Lidarr.develop.${version}.linux.tar.gz";
-    sha256 = "0vqnx8vd7mv4lsl7ffsjanl9pm107bk3ndvfka2ky74qisrqcyz7";
+    sha256 = "08aa286y71pzn8wxjiag1bn5303i05jznqwmgrbqfb4jwz94pyjs";
   };
 
   buildInputs = [
diff --git a/pkgs/servers/mail/rspamd/default.nix b/pkgs/servers/mail/rspamd/default.nix
index a8c09945fa92..756796d62017 100644
--- a/pkgs/servers/mail/rspamd/default.nix
+++ b/pkgs/servers/mail/rspamd/default.nix
@@ -14,13 +14,13 @@ in
 
 stdenv.mkDerivation rec {
   name = "rspamd-${version}";
-  version = "1.9.0";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "rspamd";
     repo = "rspamd";
     rev = version;
-    sha256 = "0n5abzs2i3mz65p5dwbph5bdamqv28wc1iw4gc4f84m0cda1vs0r";
+    sha256 = "120944v0n2qh30ri5604h4xz38jm94f6s00gwhsjvs1sfm6csapz";
   };
 
   nativeBuildInputs = [ cmake pkgconfig perl ];
diff --git a/pkgs/servers/monitoring/telegraf/default.nix b/pkgs/servers/monitoring/telegraf/default.nix
index d3ddfe26d4a5..ee3b9d818ce1 100644
--- a/pkgs/servers/monitoring/telegraf/default.nix
+++ b/pkgs/servers/monitoring/telegraf/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "telegraf-${version}";
-  version = "1.9.2";
+  version = "1.10.2";
 
   goPackagePath = "github.com/influxdata/telegraf";
 
@@ -14,7 +14,7 @@ buildGoPackage rec {
     owner = "influxdata";
     repo = "telegraf";
     rev = "${version}";
-    sha256 = "1416nx7mxa0b3bmnkarksicgvw6wja6s8xrf22yzak38qmmrpz2m";
+    sha256 = "0g27yczb49xf8nbhkzx7lv8378613afq9qx1gr5yhlpfrl4sgb69";
   };
 
   buildFlagsArray = [ ''-ldflags=
diff --git a/pkgs/servers/monitoring/telegraf/deps-1.9.2.nix b/pkgs/servers/monitoring/telegraf/deps-1.10.2.nix
index f65115a8622e..2655595ee693 100644
--- a/pkgs/servers/monitoring/telegraf/deps-1.9.2.nix
+++ b/pkgs/servers/monitoring/telegraf/deps-1.10.2.nix
@@ -91,15 +91,6 @@
     };
   }
   {
-    goPackagePath  = "github.com/alecthomas/template";
-    fetch = {
-      type = "git";
-      url = "https://github.com/alecthomas/template";
-      rev =  "a0175ee3bccc567396460bf5acd36800cb10c49c";
-      sha256 = "0qjgvvh26vk1cyfq9fadyhfgdj36f1iapbmr5xp6zqipldz8ffxj";
-    };
-  }
-  {
     goPackagePath  = "github.com/alecthomas/units";
     fetch = {
       type = "git";
@@ -154,6 +145,15 @@
     };
   }
   {
+    goPackagePath  = "github.com/caio/go-tdigest";
+    fetch = {
+      type = "git";
+      url = "https://github.com/caio/go-tdigest";
+      rev =  "f3c8d94f65d3096ac96eda54ffcd10c0fe1477f1";
+      sha256 = "0w3imv58rhb34x63w8m0k18yr6bnc2bf2rpz23dh82yvdg57nl6r";
+    };
+  }
+  {
     goPackagePath  = "github.com/cenkalti/backoff";
     fetch = {
       type = "git";
@@ -316,6 +316,15 @@
     };
   }
   {
+    goPackagePath  = "github.com/ghodss/yaml";
+    fetch = {
+      type = "git";
+      url = "https://github.com/ghodss/yaml";
+      rev =  "25d852aebe32c875e9c044af3eef9c7dc6bc777f";
+      sha256 = "1w9yq0bxzygc4qwkwwiy7k1k1yviaspcqqv18255k2xkjv5ipccz";
+    };
+  }
+  {
     goPackagePath  = "github.com/go-ini/ini";
     fetch = {
       type = "git";
@@ -329,8 +338,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/go-logfmt/logfmt";
-      rev =  "390ab7935ee28ec6b286364bba9b4dd6410cb3d5";
-      sha256 = "1gkgh3k5w1xwb2qbjq52p6azq3h1c1rr6pfwjlwj1zrijpzn2xb9";
+      rev =  "07c9b44f60d7ffdfb7d8efe1ad539965737836dc";
+      sha256 = "06smxc112xmixz78nyvk3b2hmc7wasf2sl5vxj1xz62kqcq9lzm9";
     };
   }
   {
@@ -451,6 +460,15 @@
     };
   }
   {
+    goPackagePath  = "github.com/harlow/kinesis-consumer";
+    fetch = {
+      type = "git";
+      url = "https://github.com/harlow/kinesis-consumer";
+      rev =  "2f58b136fee036f5de256b81a8461cc724fdf9df";
+      sha256 = "1m8ns5gipxxs2fkln494gqy1axhz8393cjan5wkdxc6xfchd0wa5";
+    };
+  }
+  {
     goPackagePath  = "github.com/hashicorp/consul";
     fetch = {
       type = "git";
@@ -559,6 +577,15 @@
     };
   }
   {
+    goPackagePath  = "github.com/karrick/godirwalk";
+    fetch = {
+      type = "git";
+      url = "https://github.com/karrick/godirwalk";
+      rev =  "2de2192f9e35ce981c152a873ed943b93b79ced4";
+      sha256 = "014n3pq9b4m2gx7h3ncf5xk7kw8g89yhbvnfc6dqg006r9q26w4w";
+    };
+  }
+  {
     goPackagePath  = "github.com/kballard/go-shellquote";
     fetch = {
       type = "git";
@@ -577,6 +604,15 @@
     };
   }
   {
+    goPackagePath  = "github.com/kubernetes/apimachinery";
+    fetch = {
+      type = "git";
+      url = "https://github.com/kubernetes/apimachinery";
+      rev =  "d41becfba9ee9bf8e55cec1dd3934cd7cfc04b99";
+      sha256 = "0d7akj020fahqgmicig39vfbs1nvkxachwbyw8wk2w90pfsicff1";
+    };
+  }
+  {
     goPackagePath  = "github.com/leodido/ragel-machinery";
     fetch = {
       type = "git";
@@ -761,8 +797,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/prometheus/client_golang";
-      rev =  "c5b7fccd204277076155f10851dad72b76a49317";
-      sha256 = "1xqny3147g12n4j03kxm8s9mvdbs3ln6i56c655mybrn9jjy48kd";
+      rev =  "505eaef017263e299324067d40ca2c48f6a2cf50";
+      sha256 = "02b4yg6rfag0m3j0i39sillcm5xczwv8h133vn12yr8qw04cnigs";
     };
   }
   {
@@ -824,8 +860,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/shirou/gopsutil";
-      rev =  "8048a2e9c5773235122027dd585cf821b2af1249";
-      sha256 = "17ri1ijhvg6gxscaw4sy0r5pkcyiqdsf6nn2d4q36hd0nrswvk29";
+      rev =  "071446942108a03a13cf0717275ad3bdbcb691b4";
+      sha256 = "0ai246kqsfm3xlnp4pp4d197djh6jrbjja832f355zhg3l9fqwfp";
     };
   }
   {
@@ -932,8 +968,17 @@
     fetch = {
       type = "git";
       url = "https://github.com/vmware/govmomi";
-      rev =  "e3a01f9611c32b2362366434bcd671516e78955d";
-      sha256 = "0cicd4m8ll7y1n0c97drmvmqwsqaspwpzc6nfp73f887m8ff1xis";
+      rev =  "3617f28d167d448f93f282a867870f109516d2a5";
+      sha256 = "1a82g4vzfgzp8ppcq3dhgv8van85am467ckx788yqk7rj4c3i5ir";
+    };
+  }
+  {
+    goPackagePath  = "github.com/wavefronthq/wavefront-sdk-go";
+    fetch = {
+      type = "git";
+      url = "https://github.com/wavefronthq/wavefront-sdk-go";
+      rev =  "fa87530cd02a8ad08bd179e1c39fb319a0cc0dae";
+      sha256 = "000ynkkpg2m4xynkmdx47asydw66nzp94f276gifws1a90yacay0";
     };
   }
   {
@@ -976,7 +1021,7 @@
     goPackagePath  = "golang.org/x/crypto";
     fetch = {
       type = "git";
-      url = "https://go.googlesource.com/crypto";
+      url = "https://github.com/golang/crypto.git";
       rev =  "a2144134853fc9a27a7b1e3eb4f19f1a76df13c9";
       sha256 = "0hjjk6k9dq7zllwsw9icdfbli12ii379q2lajd6l7lyw72wy28by";
     };
@@ -1000,19 +1045,28 @@
     };
   }
   {
+    goPackagePath  = "golang.org/x/sync";
+    fetch = {
+      type = "git";
+      url = "https://github.com/golang/sync.git";
+      rev =  "42b317875d0fa942474b76e1b46a6060d720ae6e";
+      sha256 = "0mrjhk7al7yyh76x9flvxy4jm5jyqh2fxbxagpaazxn1xdgkaif3";
+    };
+  }
+  {
     goPackagePath  = "golang.org/x/sys";
     fetch = {
       type = "git";
       url = "https://go.googlesource.com/sys";
-      rev =  "ac767d655b305d4e9612f5f6e33120b9176c4ad4";
-      sha256 = "1ds29n5lh4j21hmzxz7vk7hv1k6sixc7f0zsdc9xqdg0j7d212zm";
+      rev =  "7c4c994c65f702f41ed7d6620a2cb34107576a77";
+      sha256 = "19ss1k6id7dc0i61vw9arz03vpvwc2mxwdn99qq2galy0z3b8hbi";
     };
   }
   {
     goPackagePath  = "golang.org/x/text";
     fetch = {
       type = "git";
-      url = "https://go.googlesource.com/text";
+      url = "https://github.com/golang/text.git";
       rev =  "f21a4dfb5e38f5895301dc265a8def02365cc3d0";
       sha256 = "0r6x6zjzhr8ksqlpiwm5gdd7s209kwk5p4lw54xjvz10cs3qlq19";
     };
@@ -1054,15 +1108,6 @@
     };
   }
   {
-    goPackagePath  = "gopkg.in/alecthomas/kingpin.v2";
-    fetch = {
-      type = "git";
-      url = "https://github.com/alecthomas/kingpin";
-      rev =  "947dcec5ba9c011838740e680966fd7087a71d0d";
-      sha256 = "0mndnv3hdngr3bxp7yxfd47cas4prv98sqw534mx7vp38gd88n5r";
-    };
-  }
-  {
     goPackagePath  = "gopkg.in/asn1-ber.v1";
     fetch = {
       type = "git";
@@ -1099,6 +1144,15 @@
     };
   }
   {
+    goPackagePath  = "gopkg.in/inf.v0";
+    fetch = {
+      type = "git";
+      url = "https://github.com/go-inf/inf";
+      rev =  "d2d2541c53f18d2a059457998ce2876cc8e67cbf";
+      sha256 = "00k5iqjcp371fllqxncv7jkf80hn1zww92zm78cclbcn4ybigkng";
+    };
+  }
+  {
     goPackagePath  = "gopkg.in/ldap.v2";
     fetch = {
       type = "git";
@@ -1143,4 +1197,4 @@
       sha256 = "0dwjrs2lp2gdlscs7bsrmyc5yf6mm4fvgw71bzr9mv2qrd2q73s1";
     };
   }
-]
+]
\ No newline at end of file
diff --git a/pkgs/servers/nosql/neo4j/default.nix b/pkgs/servers/nosql/neo4j/default.nix
index 0781e66f0069..73ec5038fe3d 100644
--- a/pkgs/servers/nosql/neo4j/default.nix
+++ b/pkgs/servers/nosql/neo4j/default.nix
@@ -4,11 +4,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "neo4j-${version}";
-  version = "3.5.3";
+  version = "3.5.4";
 
   src = fetchurl {
     url = "https://neo4j.com/artifact.php?name=neo4j-community-${version}-unix.tar.gz";
-    sha256 = "1shkffikl9mrjg1kq2s2ylgf4691f9fv53d3x4qk2a6m4y1y9dnl";
+    sha256 = "0fqp3k0gr5qb2a7ck093fw581db9fmfvhsich740d588ik749jbh";
   };
 
   buildInputs = [ makeWrapper jre8 which gawk ];
diff --git a/pkgs/servers/roundcube/default.nix b/pkgs/servers/roundcube/default.nix
index 685e856644ea..4d8f034c51ee 100644
--- a/pkgs/servers/roundcube/default.nix
+++ b/pkgs/servers/roundcube/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "roundcube";
-  version = "1.3.8";
+  version = "1.3.9";
 
   src = fetchurl {
     url = "https://github.com/roundcube/roundcubemail/releases/download/${version}/roundcubemail-${version}-complete.tar.gz";
-    sha256 = "018djad7ygfl9c9f2l2j42qkg31ml3hs2f01f0dk361zckwk77n4";
+    sha256 = "1b91amcpzb7935hpm67iqw92bl5r1a0rkfrc8gfm8w9sngzv8vbj";
   };
 
   patches = [ ./0001-Don-t-resolve-symlinks-when-trying-to-find-INSTALL_P.patch ];
diff --git a/pkgs/servers/rt/default.nix b/pkgs/servers/rt/default.nix
index 4653946270cd..b2e40a8ede0e 100644
--- a/pkgs/servers/rt/default.nix
+++ b/pkgs/servers/rt/default.nix
@@ -33,11 +33,11 @@
 stdenv.mkDerivation rec {
   name = "rt-${version}";
 
-  version = "4.4.3";
+  version = "4.4.4";
 
   src = fetchurl {
     url = "https://download.bestpractical.com/pub/rt/release/${name}.tar.gz";
-    sha256 = "1cddgp3j7qm7r3v5j1l1hl6i6laxa64f4nalaarj094hmhyb92kk";
+    sha256 = "1108jhz1gvalcfnbzgpbk7fkxzxkkc7m74a3bnwyjzldlyj1dhrl";
   };
 
   patches = [ ./override-generated.patch ];
diff --git a/pkgs/tools/filesystems/moosefs/default.nix b/pkgs/tools/filesystems/moosefs/default.nix
index 03966533e3a3..0d58e8007efa 100644
--- a/pkgs/tools/filesystems/moosefs/default.nix
+++ b/pkgs/tools/filesystems/moosefs/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "moosefs";
-  version = "3.0.103";
+  version = "3.0.104";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "0pqralv57ci4zwd75hz4pxmd4l9d4nib2mcsvrb6jndxqkaqcvns";
+    sha256 = "057xg7zy872w4hczk9b9ckmqyah3qhgysvxddqizr204cyadicxh";
   };
 
   nativeBuildInputs = [ pkgconfig makeWrapper ];
diff --git a/pkgs/tools/misc/autojump/default.nix b/pkgs/tools/misc/autojump/default.nix
index 592334895fdd..ca4dde7a450c 100644
--- a/pkgs/tools/misc/autojump/default.nix
+++ b/pkgs/tools/misc/autojump/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "autojump-${version}";
-  version = "22.5.1";
+  version = "22.5.3";
 
   src = fetchFromGitHub {
     owner = "wting";
     repo = "autojump";
     rev = "release-v${version}";
-    sha256 = "1l1278g3k1qfrz41pkpjdhsabassb9si2d1bfbcmvbv5h3wmlqk9";
+    sha256 = "1rgpsh70manr2dydna9da4x7p8ahii7dgdgwir5fka340n1wrcws";
   };
 
   buildInputs = [ python bash ];
diff --git a/pkgs/tools/misc/doitlive/default.nix b/pkgs/tools/misc/doitlive/default.nix
index 00b04c2112f4..6edcefb11d5e 100644
--- a/pkgs/tools/misc/doitlive/default.nix
+++ b/pkgs/tools/misc/doitlive/default.nix
@@ -2,11 +2,11 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "doitlive";
-  version = "4.2.1";
+  version = "4.3.0";
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "0sffr78h0hdrlpamg6v0iw2cgrkv7wy82mvrbzri0w1jqd29s526";
+    sha256 = "03qrs032x206xrl0x3z0fpvxgjivzz9rkmb11bqlk1id10707cac";
   };
 
   propagatedBuildInputs = with python3Packages; [ click click-completion click-didyoumean ];
diff --git a/pkgs/tools/misc/ipxe/default.nix b/pkgs/tools/misc/ipxe/default.nix
index f2fac5e3d0f9..b06a1c47786f 100644
--- a/pkgs/tools/misc/ipxe/default.nix
+++ b/pkgs/tools/misc/ipxe/default.nix
@@ -3,8 +3,8 @@
 }:
 
 let
-  date = "20190310";
-  rev = "b6ffe28a21c53a0946d95751c905d9e0b6c3b630";
+  date = "20190318";
+  rev = "ebf2eaf515e46abd43bc798e7e4ba77bfe529218";
 in
 
 stdenv.mkDerivation {
@@ -13,8 +13,8 @@ stdenv.mkDerivation {
   buildInputs = [ perl cdrkit syslinux xz openssl ];
 
   src = fetchgit {
-    url = git://git.ipxe.org/ipxe.git;
-    sha256 = "1s8sy75lpx8zq60wc0i35d8c1wwm1rq3scxpkq31623d097mch59";
+    url = https://git.ipxe.org/ipxe.git;
+    sha256 = "0if3m8h1nfxy4n37cwlfbc5kand52290v80m4zvjppc81im3nr5g";
     inherit rev;
   };
 
diff --git a/pkgs/tools/misc/plantuml/default.nix b/pkgs/tools/misc/plantuml/default.nix
index dd9b6d0b260b..4619d05c4c6a 100644
--- a/pkgs/tools/misc/plantuml/default.nix
+++ b/pkgs/tools/misc/plantuml/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, makeWrapper, jre, graphviz }:
 
 stdenv.mkDerivation rec {
-  version = "1.2019.2";
+  version = "1.2019.4";
   name = "plantuml-${version}";
 
   src = fetchurl {
     url = "mirror://sourceforge/project/plantuml/${version}/plantuml.${version}.jar";
-    sha256 = "17b9nwj0r4nbajql611lhy1kkgzigq8p8hkyv90psm7avwyd7fk2";
+    sha256 = "0kd0f7kknl6x1dibh4gsx3pl58bzylx42lxwmh9zv4d53gm6a93r";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/misc/ttfautohint/default.nix b/pkgs/tools/misc/ttfautohint/default.nix
index 4cbb2943d3cf..eed527da4168 100644
--- a/pkgs/tools/misc/ttfautohint/default.nix
+++ b/pkgs/tools/misc/ttfautohint/default.nix
@@ -5,12 +5,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.8.2";
+  version = "1.8.3";
   name = "ttfautohint-${version}";
 
   src = fetchurl {
     url = "mirror://savannah/freetype/${name}.tar.gz";
-    sha256 = "19w9g1ksr0vyblgcirppj0279gfj5s902jblzgav5a4n2mq42rrq";
+    sha256 = "0zpqgihn3yh3v51ynxwr8asqrijvs4gv686clwv7bm8sawr4kfw7";
   };
 
   postAutoreconf = ''
diff --git a/pkgs/tools/networking/inetutils/default.nix b/pkgs/tools/networking/inetutils/default.nix
index 1d2bfdc91189..612e3ec0f835 100644
--- a/pkgs/tools/networking/inetutils/default.nix
+++ b/pkgs/tools/networking/inetutils/default.nix
@@ -11,9 +11,21 @@ stdenv.mkDerivation rec {
   patches = [
     ./whois-Update-Canadian-TLD-server.patch
     ./service-name.patch
+    # https://git.congatec.com/yocto/meta-openembedded/commit/3402bfac6b595c622e4590a8ff5eaaa854e2a2a3
+    ./inetutils-1_9-PATH_PROCNET_DEV.patch
   ];
 
-  buildInputs = [ ncurses /* for `talk' */ perl /* for `whois' */ help2man ];
+  nativeBuildInputs = [ help2man perl /* for `whois' */ ];
+  buildInputs = [ ncurses /* for `talk' */ ];
+
+  # Don't use help2man if cross-compiling
+  # https://lists.gnu.org/archive/html/bug-sed/2017-01/msg00001.html
+  # https://git.congatec.com/yocto/meta-openembedded/blob/3402bfac6b595c622e4590a8ff5eaaa854e2a2a3/meta-networking/recipes-connectivity/inetutils/inetutils_1.9.1.bb#L44
+  preConfigure = let
+    isCross = stdenv.hostPlatform != stdenv.buildPlatform;
+  in lib.optionalString isCross ''
+    export HELP2MAN=true
+  '';
 
   configureFlags = [ "--with-ncurses-include-dir=${ncurses.dev}/include" ]
   ++ lib.optionals stdenv.hostPlatform.isMusl [ # Musl doesn't define rcmd
diff --git a/pkgs/tools/networking/inetutils/inetutils-1_9-PATH_PROCNET_DEV.patch b/pkgs/tools/networking/inetutils/inetutils-1_9-PATH_PROCNET_DEV.patch
new file mode 100644
index 000000000000..2592989a90a3
--- /dev/null
+++ b/pkgs/tools/networking/inetutils/inetutils-1_9-PATH_PROCNET_DEV.patch
@@ -0,0 +1,26 @@
+inetutils: define PATH_PROCNET_DEV if not already defined
+
+this prevents the following compilation error :
+system/linux.c:401:15: error: 'PATH_PROCNET_DEV' undeclared (first use in this function)
+
+this patch comes from :
+ http://repository.timesys.com/buildsources/i/inetutils/inetutils-1.9/
+
+Upstream-Status: Inappropriate [not author]
+
+Signed-of-by: Eric BĂ©nard <eric@eukrea.com>
+---
+diff -Naur inetutils-1.9.orig/ifconfig/system/linux.c inetutils-1.9/ifconfig/system/linux.c
+--- inetutils-1.9.orig/ifconfig/system/linux.c	2012-01-04 16:31:36.000000000 -0500
++++ inetutils-1.9/ifconfig/system/linux.c	2012-01-04 16:40:53.000000000 -0500
+@@ -49,6 +49,10 @@
+ #include "../ifconfig.h"
+ 
+ 
++#ifndef PATH_PROCNET_DEV
++  #define PATH_PROCNET_DEV "/proc/net/dev"
++#endif
++
+ /* ARPHRD stuff.  */
+ 
+ static void
diff --git a/pkgs/tools/networking/socat/default.nix b/pkgs/tools/networking/socat/default.nix
index 37fe3398ae8b..834ea1bd873d 100644
--- a/pkgs/tools/networking/socat/default.nix
+++ b/pkgs/tools/networking/socat/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, openssl, readline, which, nettools }:
 
 stdenv.mkDerivation rec {
-  name = "socat-1.7.3.2";
+  name = "socat-1.7.3.3";
 
   src = fetchurl {
     url = "http://www.dest-unreach.org/socat/download/${name}.tar.bz2";
-    sha256 = "0lcj6zpra33xhgvhmz9l3cqz10v8ybafb8dd1yqkwf1rhy01ymp3";
+    sha256 = "0jnhjijyq74g3wa4ph0am83z6vq7qna7ac0xqjma8s4197z3zmhd";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/networking/stubby/default.nix b/pkgs/tools/networking/stubby/default.nix
index 4685143c934b..89af381d0d6d 100644
--- a/pkgs/tools/networking/stubby/default.nix
+++ b/pkgs/tools/networking/stubby/default.nix
@@ -4,13 +4,13 @@
 stdenv.mkDerivation rec {
   pname = "stubby";
   name = "${pname}-${version}";
-  version = "0.2.5";
+  version = "0.2.6";
 
   src = fetchFromGitHub {
     owner = "getdnsapi";
     repo = pname;
     rev = "v${version}";
-    sha256 = "034y783dvh43v5ajxlgn4y9y7mdk1lwy87d7isaxpkigs1jqbrma";
+    sha256 = "164gm5cbnq785s78bqmbsgxrxkq8hw930xwkxxzi1f6jgz928dnf";
   };
 
   nativeBuildInputs = [ libtool m4 libbsd libyaml autoreconfHook ];
diff --git a/pkgs/tools/networking/stunnel/default.nix b/pkgs/tools/networking/stunnel/default.nix
index e00b5335d35e..b85e146971b2 100644
--- a/pkgs/tools/networking/stunnel/default.nix
+++ b/pkgs/tools/networking/stunnel/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name    = "stunnel-${version}";
-  version = "5.50";
+  version = "5.53";
 
   src = fetchurl {
     url    = "https://www.stunnel.org/downloads/${name}.tar.gz";
-    sha256 = "0j811iakljjxw39qchmqf235jdkwixb0i4xxjyi55f08558947cm";
+    sha256 = "119560alb8k0qz2zkjb2i80ikmn76fa6dg681fvrw9hlxsb9hhw0";
     # please use the contents of "https://www.stunnel.org/downloads/${name}.tar.gz.sha256",
     # not the output of `nix-prefetch-url`
   };
diff --git a/pkgs/tools/networking/tgt/default.nix b/pkgs/tools/networking/tgt/default.nix
index e1e19609d513..9f3075b374e2 100644
--- a/pkgs/tools/networking/tgt/default.nix
+++ b/pkgs/tools/networking/tgt/default.nix
@@ -2,7 +2,7 @@
 , docbook_xsl }:
 
 let
-  version = "1.0.75";
+  version = "1.0.76";
 in stdenv.mkDerivation rec {
   name = "tgt-${version}";
 
@@ -10,7 +10,7 @@ in stdenv.mkDerivation rec {
     owner = "fujita";
     repo = "tgt";
     rev = "v${version}";
-    sha256 = "008x7xz49fnqi91hw4nim4f25gp5qyjgzxfikmj7gz81mh4hhamj";
+    sha256 = "1q01ay0zn5gmy6df1iw1ic11p8zygxlp0r3nd887vvvjvlp3xrvc";
   };
 
   buildInputs = [ libxslt systemd libaio docbook_xsl ];
diff --git a/pkgs/tools/networking/urlwatch/default.nix b/pkgs/tools/networking/urlwatch/default.nix
index fc77846efc39..3e572a10da0a 100644
--- a/pkgs/tools/networking/urlwatch/default.nix
+++ b/pkgs/tools/networking/urlwatch/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   name = "urlwatch-${version}";
-  version = "2.16";
+  version = "2.17";
 
   src = fetchFromGitHub {
     owner  = "thp";
     repo   = "urlwatch";
     rev    = version;
-    sha256 = "1bkwr151bnv72aka2r9jwaq8lkz1p6031wr5pss4sij978qn5xld";
+    sha256 = "1865p3yczgpq8gvgh4cpgbx2ibc1fwycd7pagga9sj8r3q0giqyk";
   };
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/tools/security/lastpass-cli/default.nix b/pkgs/tools/security/lastpass-cli/default.nix
index 0415b10b25d8..37da20225205 100644
--- a/pkgs/tools/security/lastpass-cli/default.nix
+++ b/pkgs/tools/security/lastpass-cli/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lastpass-cli";
-  version = "1.3.2";
+  version = "1.3.3";
 
   src = fetchFromGitHub {
     owner = "lastpass";
     repo = pname;
     rev = "v${version}";
-    sha256 = "12qjqvqzi3pq7hrdpq59bcxqy6yj1mhx145g9rky1jm2ipzpfayq";
+    sha256 = "168jg8kjbylfgalhicn0llbykd7kdc9id2989gg0nxlgmnvzl58a";
   };
 
   nativeBuildInputs = [ asciidoc cmake docbook_xsl pkgconfig ];
diff --git a/pkgs/tools/security/lynis/default.nix b/pkgs/tools/security/lynis/default.nix
index ceff23911c7e..dfbda2b5e073 100644
--- a/pkgs/tools/security/lynis/default.nix
+++ b/pkgs/tools/security/lynis/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "lynis";
-  version = "2.7.2";
+  version = "2.7.3";
   name = "${pname}-${version}";
 
   src = fetchFromGitHub {
     owner = "CISOfy";
     repo = "${pname}";
     rev = "${version}";
-    sha256 = "0dbbfk47dpxx7zpb98n4w3ls3z5di57qnr2nsgxjvp49gk9j3f6k";
+    sha256 = "0md1w86i3fy9l78i98ijr5136nbhdiik2dxyw9qnzmvdlvkqmw70";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/system/stress-ng/default.nix b/pkgs/tools/system/stress-ng/default.nix
index 8237a4928a0b..a31ce8f65e4b 100644
--- a/pkgs/tools/system/stress-ng/default.nix
+++ b/pkgs/tools/system/stress-ng/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   name = "stress-ng-${version}";
-  version = "0.09.54";
+  version = "0.09.57";
 
   src = fetchurl {
     url = "https://kernel.ubuntu.com/~cking/tarballs/stress-ng/${name}.tar.xz";
-    sha256 = "0qbgabrxm8aj4a6bgf55mi7rv9sqcgl3kkm7j3qhkqjfn9rqzslb";
+    sha256 = "0xp55m1kif8hcjdcdhgaarghqf1gz5fa24qwl6zpmxkzl6bn002x";
   };
 
   # All platforms inputs then Linux-only ones
diff --git a/pkgs/tools/text/ripgrep/default.nix b/pkgs/tools/text/ripgrep/default.nix
index 81c88ecad9e5..aac0fc13603c 100644
--- a/pkgs/tools/text/ripgrep/default.nix
+++ b/pkgs/tools/text/ripgrep/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   name = "ripgrep-${version}";
-  version = "0.10.0";
+  version = "11.0.0";
 
   src = fetchFromGitHub {
     owner = "BurntSushi";
     repo = "ripgrep";
     rev = version;
-    sha256 = "017fz5kv1kv9jz7mb7vcxrklf5vybvfz2x61g6myzshqz4z1v1yb";
+    sha256 = "13yavwi2b4w1p5fmpfn1vnwarsanlib1vj4pn1z2hg3a3v0c10iv";
   };
 
-  cargoSha256 = "0k2b2vbklfdjk2zdc8ip480drc12gy1whlwj94p44hr3402azcgr";
+  cargoSha256 = "0zrn4qshk24wzhhx7s36m27q5430gq22vnksd8kw11s3058s6pwg";
 
   cargoBuildFlags = stdenv.lib.optional withPCRE2 "--features pcre2";
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 47d39264ee76..4748f00e66d2 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -16439,7 +16439,6 @@ in
   androidStudioPackages = recurseIntoAttrs
     (callPackage ../applications/editors/android-studio { });
   android-studio = androidStudioPackages.stable;
-  android-studio-preview = androidStudioPackages.preview;
 
   animbar = callPackage ../applications/graphics/animbar { };
 
@@ -19756,6 +19755,8 @@ in
 
   peru = callPackage ../applications/version-management/peru {};
 
+  petrinizer = haskellPackages.callPackage ../applications/science/logic/petrinizer {};
+
   pmidi = callPackage ../applications/audio/pmidi { };
 
   printrun = callPackage ../applications/misc/printrun { };
diff --git a/pkgs/top-level/coq-packages.nix b/pkgs/top-level/coq-packages.nix
index f08f2eacc23c..2659a3302025 100644
--- a/pkgs/top-level/coq-packages.nix
+++ b/pkgs/top-level/coq-packages.nix
@@ -2,8 +2,9 @@
 
 let
   mkCoqPackages' = self: coq:
-    let callPackage = newScope self ; in rec {
-      inherit callPackage coq;
+    let newScope = self.newScope;
+        callPackage = self.callPackage; in {
+      inherit coq;
       coqPackages = self;
 
       contribs = recurseIntoAttrs
@@ -75,7 +76,7 @@ in rec {
    * a `dontFilter` attribute into the Coq derivation.
    */
   mkCoqPackages = coq:
-    let self = mkCoqPackages' self coq; in
+    let self = lib.makeScope newScope (lib.flip mkCoqPackages' coq); in
     if coq.dontFilter or false then self
     else filterCoqPackages coq self;