about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--nixos/lib/test-driver/test-driver.py35
-rw-r--r--nixos/modules/config/no-x-libs.nix1
-rw-r--r--nixos/modules/services/misc/gitea.nix22
-rw-r--r--nixos/tests/ferm.nix30
-rw-r--r--nixos/tests/nat.nix55
-rw-r--r--nixos/tests/predictable-interface-names.nix6
-rw-r--r--pkgs/applications/audio/mda-lv2/default.nix4
-rw-r--r--pkgs/applications/audio/qtractor/default.nix4
-rw-r--r--pkgs/applications/audio/strawberry/default.nix4
-rw-r--r--pkgs/applications/audio/yoshimi/default.nix4
-rw-r--r--pkgs/applications/display-managers/lightdm/gtk-greeter.nix4
-rw-r--r--pkgs/applications/editors/neovim/neovim-remote.nix4
-rw-r--r--pkgs/applications/graphics/fig2dev/default.nix4
-rw-r--r--pkgs/applications/misc/kanboard/default.nix4
-rw-r--r--pkgs/applications/misc/minder/default.nix4
-rw-r--r--pkgs/applications/misc/opencpn/default.nix6
-rw-r--r--pkgs/applications/misc/taskell/default.nix4
-rw-r--r--pkgs/applications/misc/xmrig/default.nix4
-rw-r--r--pkgs/applications/misc/xmrig/proxy.nix4
-rw-r--r--pkgs/applications/networking/mailreaders/mutt/default.nix4
-rw-r--r--pkgs/applications/networking/newsreaders/pan/default.nix4
-rw-r--r--pkgs/applications/office/libreoffice/default.nix2
-rw-r--r--pkgs/applications/office/libreoffice/still.nix2
-rw-r--r--pkgs/applications/science/biology/paml/default.nix5
-rw-r--r--pkgs/applications/window-managers/icewm/default.nix4
-rw-r--r--pkgs/development/compilers/go-jsonnet/default.nix35
-rw-r--r--pkgs/development/compilers/go-jsonnet/deps.nix48
-rw-r--r--pkgs/development/libraries/libfprint/default.nix40
-rw-r--r--pkgs/development/libraries/libsolv/default.nix5
-rw-r--r--pkgs/development/libraries/libxl/default.nix10
-rw-r--r--pkgs/development/libraries/polkit/default.nix6
-rw-r--r--pkgs/development/python-modules/aiorpcx/default.nix4
-rw-r--r--pkgs/development/python-modules/apsw/default.nix12
-rw-r--r--pkgs/development/python-modules/buildbot/default.nix11
-rw-r--r--pkgs/development/python-modules/buildbot/pkg.nix4
-rw-r--r--pkgs/development/python-modules/buildbot/plugins.nix10
-rw-r--r--pkgs/development/python-modules/buildbot/worker.nix4
-rw-r--r--pkgs/development/python-modules/matrix-nio/default.nix3
-rw-r--r--pkgs/development/python-modules/owslib/default.nix4
-rw-r--r--pkgs/development/python-modules/pykde4/default.nix46
-rw-r--r--pkgs/development/python-modules/pykde4/dlfcn.patch13
-rw-r--r--pkgs/development/python-modules/pykde4/kdelibs.nix48
-rw-r--r--pkgs/development/tools/ammonite/default.nix1
-rw-r--r--pkgs/development/tools/clang-tools/wrapper2
-rw-r--r--pkgs/development/tools/kubectx/default.nix4
-rw-r--r--pkgs/games/pioneer/default.nix4
-rw-r--r--pkgs/games/zandronum/default.nix9
-rw-r--r--pkgs/os-specific/linux/intel-compute-runtime/default.nix4
-rw-r--r--pkgs/os-specific/linux/ipset/default.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.14.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.19.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/perf.nix9
-rw-r--r--pkgs/os-specific/linux/mcelog/default.nix4
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/default.nix26
-rw-r--r--pkgs/os-specific/linux/psmisc/default.nix4
-rw-r--r--pkgs/servers/dns/nsd/default.nix4
-rw-r--r--pkgs/servers/mail/postfix/default.nix4
-rw-r--r--pkgs/servers/misc/subsonic/default.nix4
-rw-r--r--pkgs/servers/squid/default.nix4
-rw-r--r--pkgs/servers/web-apps/moodle/default.nix4
-rw-r--r--pkgs/shells/nushell/default.nix6
-rw-r--r--pkgs/tools/filesystems/grive2/default.nix4
-rw-r--r--pkgs/tools/networking/haproxy/default.nix4
-rw-r--r--pkgs/tools/networking/nebula/default.nix43
-rw-r--r--pkgs/tools/networking/openapi-generator-cli/default.nix4
-rw-r--r--pkgs/tools/security/fprintd/default.nix14
-rw-r--r--pkgs/top-level/aliases.nix2
-rw-r--r--pkgs/top-level/all-packages.nix8
-rw-r--r--pkgs/top-level/python-packages.nix5
69 files changed, 307 insertions, 409 deletions
diff --git a/nixos/lib/test-driver/test-driver.py b/nixos/lib/test-driver/test-driver.py
index e45521424de3..02c172c4a4d6 100644
--- a/nixos/lib/test-driver/test-driver.py
+++ b/nixos/lib/test-driver/test-driver.py
@@ -16,6 +16,8 @@ import tempfile
 import time
 import unicodedata
 from typing import Tuple, Any, Callable, Dict, Iterator, Optional, List
+import shlex
+import pathlib
 
 CHAR_TO_KEY = {
     "A": "shift-a",
@@ -91,6 +93,10 @@ def eprint(*args: object, **kwargs: Any) -> None:
     print(*args, file=sys.stderr, **kwargs)
 
 
+def make_command(args: list) -> str:
+    return " ".join(map(shlex.quote, (map(str, args))))
+
+
 def create_vlan(vlan_nr: str) -> Tuple[str, str, "subprocess.Popen[bytes]", Any]:
     global log
     log.log("starting VDE switch for network {}".format(vlan_nr))
@@ -215,7 +221,7 @@ class Machine:
             return path
 
         self.state_dir = create_dir("vm-state-{}".format(self.name))
-        self.shared_dir = create_dir("xchg-shared")
+        self.shared_dir = create_dir("{}/xchg".format(self.state_dir))
 
         self.booted = False
         self.connected = False
@@ -524,6 +530,33 @@ class Machine:
             if ret.returncode != 0:
                 raise Exception("Cannot convert screenshot")
 
+    def copy_from_vm(self, source: str, target_dir: str = "") -> None:
+        """Copy a file from the VM (specified by an in-VM source path) to a path
+        relative to `$out`. The file is copied via the `shared_dir` shared among
+        all the VMs (using a temporary directory).
+        """
+        # Compute the source, target, and intermediate shared file names
+        out_dir = pathlib.Path(os.environ.get("out", os.getcwd()))
+        vm_src = pathlib.Path(source)
+        with tempfile.TemporaryDirectory(dir=self.shared_dir) as shared_td:
+            shared_temp = pathlib.Path(shared_td)
+            vm_shared_temp = pathlib.Path("/tmp/xchg") / shared_temp.name
+            vm_intermediate = vm_shared_temp / vm_src.name
+            intermediate = shared_temp / vm_src.name
+            # Copy the file to the shared directory inside VM
+            self.succeed(make_command(["mkdir", "-p", vm_shared_temp]))
+            self.succeed(make_command(["cp", "-r", vm_src, vm_intermediate]))
+            self.succeed("sync")
+            abs_target = out_dir / target_dir / vm_src.name
+            abs_target.parent.mkdir(exist_ok=True, parents=True)
+            # Copy the file from the shared directory outside VM
+            if intermediate.is_dir():
+                shutil.copytree(intermediate, abs_target)
+            else:
+                shutil.copy(intermediate, abs_target)
+        # Make sure the cleanup is synced into VM
+        self.succeed("sync")
+
     def dump_tty_contents(self, tty: str) -> None:
         """Debugging: Dump the contents of the TTY<n>
         """
diff --git a/nixos/modules/config/no-x-libs.nix b/nixos/modules/config/no-x-libs.nix
index d0f62d05870a..873b8073fed9 100644
--- a/nixos/modules/config/no-x-libs.nix
+++ b/nixos/modules/config/no-x-libs.nix
@@ -35,7 +35,6 @@ with lib;
       networkmanager-vpnc = super.networkmanager-vpnc.override { withGnome = false; };
       networkmanager-iodine = super.networkmanager-iodine.override { withGnome = false; };
       gobject-introspection = super.gobject-introspection.override { x11Support = false; };
-      polkit = super.polkit.override { withGnome = false; };
     }));
   };
 }
diff --git a/nixos/modules/services/misc/gitea.nix b/nixos/modules/services/misc/gitea.nix
index c8c59fb256e8..b6f4d88adbef 100644
--- a/nixos/modules/services/misc/gitea.nix
+++ b/nixos/modules/services/misc/gitea.nix
@@ -394,6 +394,28 @@ in
         WorkingDirectory = cfg.stateDir;
         ExecStart = "${gitea.bin}/bin/gitea web";
         Restart = "always";
+
+        # Filesystem
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectControlGroups = true;
+        ReadWritePaths = cfg.stateDir;
+        # Caps
+        CapabilityBoundingSet = "";
+        NoNewPrivileges = true;
+        # Misc.
+        LockPersonality = true;
+        RestrictRealtime = true;
+        PrivateMounts = true;
+        PrivateUsers = true;
+        MemoryDenyWriteExecute = true;
+        SystemCallFilter = "~@chown @clock @cpu-emulation @debug @keyring @memlock @module @mount @obsolete @privileged @raw-io @reboot @resources @setuid @swap";
+        SystemCallArchitectures = "native";
+        RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6";
       };
 
       environment = {
diff --git a/nixos/tests/ferm.nix b/nixos/tests/ferm.nix
index edf9c8036aca..a73c9ce739cf 100644
--- a/nixos/tests/ferm.nix
+++ b/nixos/tests/ferm.nix
@@ -1,5 +1,5 @@
 
-import ./make-test.nix ({ pkgs, ...} : {
+import ./make-test-python.nix ({ pkgs, ...} : {
   name = "ferm";
   meta = with pkgs.stdenv.lib.maintainers; {
     maintainers = [ mic92 ];
@@ -53,24 +53,22 @@ import ./make-test.nix ({ pkgs, ...} : {
 
   testScript =
     ''
-      startAll;
+      start_all()
 
-      $client->waitForUnit("network-online.target");
-      $server->waitForUnit("ferm.service");
-      $server->waitForUnit("nginx.service");
-      $server->waitUntilSucceeds("ss -ntl | grep -q 80");
+      client.wait_for_unit("network-online.target")
+      server.wait_for_unit("ferm.service")
+      server.wait_for_unit("nginx.service")
+      server.wait_until_succeeds("ss -ntl | grep -q 80")
 
-      subtest "port 80 is allowed", sub {
-          $client->succeed("curl --fail -g http://192.168.1.1:80/status");
-          $client->succeed("curl --fail -g http://[fd00::1]:80/status");
-      };
+      with subtest("port 80 is allowed"):
+          client.succeed("curl --fail -g http://192.168.1.1:80/status")
+          client.succeed("curl --fail -g http://[fd00::1]:80/status")
 
-      subtest "port 8080 is not allowed", sub {
-          $server->succeed("curl --fail -g http://192.168.1.1:8080/status");
-          $server->succeed("curl --fail -g http://[fd00::1]:8080/status");
+      with subtest("port 8080 is not allowed"):
+          server.succeed("curl --fail -g http://192.168.1.1:8080/status")
+          server.succeed("curl --fail -g http://[fd00::1]:8080/status")
 
-          $client->fail("curl --fail -g http://192.168.1.1:8080/status");
-          $client->fail("curl --fail -g http://[fd00::1]:8080/status");
-      };
+          client.fail("curl --fail -g http://192.168.1.1:8080/status")
+          client.fail("curl --fail -g http://[fd00::1]:8080/status")
     '';
 })
diff --git a/nixos/tests/nat.nix b/nixos/tests/nat.nix
index 51d9cf166bb6..0d1f7aaedfa2 100644
--- a/nixos/tests/nat.nix
+++ b/nixos/tests/nat.nix
@@ -3,7 +3,7 @@
 # client on the inside network, a server on the outside network, and a
 # router connected to both that performs Network Address Translation
 # for the client.
-import ./make-test.nix ({ pkgs, lib, withFirewall, withConntrackHelpers ? false, ... }:
+import ./make-test-python.nix ({ pkgs, lib, withFirewall, withConntrackHelpers ? false, ... }:
   let
     unit = if withFirewall then "firewall" else "nat";
 
@@ -69,49 +69,52 @@ import ./make-test.nix ({ pkgs, lib, withFirewall, withConntrackHelpers ? false,
         routerDummyNoNatClosure = nodes.routerDummyNoNat.config.system.build.toplevel;
         routerClosure = nodes.router.config.system.build.toplevel;
       in ''
-        $client->start;
-        $router->start;
-        $server->start;
+        client.start()
+        router.start()
+        server.start()
 
         # The router should have access to the server.
-        $server->waitForUnit("network.target");
-        $server->waitForUnit("httpd");
-        $router->waitForUnit("network.target");
-        $router->succeed("curl --fail http://server/ >&2");
+        server.wait_for_unit("network.target")
+        server.wait_for_unit("httpd")
+        router.wait_for_unit("network.target")
+        router.succeed("curl --fail http://server/ >&2")
 
         # The client should be also able to connect via the NAT router.
-        $router->waitForUnit("${unit}");
-        $client->waitForUnit("network.target");
-        $client->succeed("curl --fail http://server/ >&2");
-        $client->succeed("ping -c 1 server >&2");
+        router.wait_for_unit("${unit}")
+        client.wait_for_unit("network.target")
+        client.succeed("curl --fail http://server/ >&2")
+        client.succeed("ping -c 1 server >&2")
 
         # Test whether passive FTP works.
-        $server->waitForUnit("vsftpd");
-        $server->succeed("echo Hello World > /home/ftp/foo.txt");
-        $client->succeed("curl -v ftp://server/foo.txt >&2");
+        server.wait_for_unit("vsftpd")
+        server.succeed("echo Hello World > /home/ftp/foo.txt")
+        client.succeed("curl -v ftp://server/foo.txt >&2")
 
         # Test whether active FTP works.
-        $client->${if withConntrackHelpers then "succeed" else "fail"}(
-          "curl -v -P - ftp://server/foo.txt >&2");
+        client.${if withConntrackHelpers then "succeed" else "fail"}("curl -v -P - ftp://server/foo.txt >&2")
 
         # Test ICMP.
-        $client->succeed("ping -c 1 router >&2");
-        $router->succeed("ping -c 1 client >&2");
+        client.succeed("ping -c 1 router >&2")
+        router.succeed("ping -c 1 client >&2")
 
         # If we turn off NAT, the client shouldn't be able to reach the server.
-        $router->succeed("${routerDummyNoNatClosure}/bin/switch-to-configuration test 2>&1");
-        $client->fail("curl --fail --connect-timeout 5 http://server/ >&2");
-        $client->fail("ping -c 1 server >&2");
+        router.succeed(
+            "${routerDummyNoNatClosure}/bin/switch-to-configuration test 2>&1"
+        )
+        client.fail("curl --fail --connect-timeout 5 http://server/ >&2")
+        client.fail("ping -c 1 server >&2")
 
         # And make sure that reloading the NAT job works.
-        $router->succeed("${routerClosure}/bin/switch-to-configuration test 2>&1");
+        router.succeed(
+            "${routerClosure}/bin/switch-to-configuration test 2>&1"
+        )
         # FIXME: this should not be necessary, but nat.service is not started because
         #        network.target is not triggered
         #        (https://github.com/NixOS/nixpkgs/issues/16230#issuecomment-226408359)
         ${lib.optionalString (!withFirewall) ''
-          $router->succeed("systemctl start nat.service");
+          router.succeed("systemctl start nat.service")
         ''}
-        $client->succeed("curl --fail http://server/ >&2");
-        $client->succeed("ping -c 1 server >&2");
+        client.succeed("curl --fail http://server/ >&2")
+        client.succeed("ping -c 1 server >&2")
       '';
   })
diff --git a/nixos/tests/predictable-interface-names.nix b/nixos/tests/predictable-interface-names.nix
index 194b4dafa772..83883477a5cc 100644
--- a/nixos/tests/predictable-interface-names.nix
+++ b/nixos/tests/predictable-interface-names.nix
@@ -4,7 +4,7 @@
 }:
 
 let
-  inherit (import ../lib/testing.nix { inherit system pkgs; }) makeTest;
+  inherit (import ../lib/testing-python.nix { inherit system pkgs; }) makeTest;
 in pkgs.lib.listToAttrs (pkgs.lib.crossLists (predictable: withNetworkd: {
   name = pkgs.lib.optionalString (!predictable) "un" + "predictable"
        + pkgs.lib.optionalString withNetworkd "Networkd";
@@ -20,8 +20,8 @@ in pkgs.lib.listToAttrs (pkgs.lib.crossLists (predictable: withNetworkd: {
     };
 
     testScript = ''
-      print $machine->succeed("ip link");
-      $machine->${if predictable then "fail" else "succeed"}("ip link show eth0 ");
+      print(machine.succeed("ip link"))
+      machine.${if predictable then "fail" else "succeed"}("ip link show eth0")
     '';
   };
 }) [[true false] [true false]])
diff --git a/pkgs/applications/audio/mda-lv2/default.nix b/pkgs/applications/audio/mda-lv2/default.nix
index 901be5a23d08..61f2bc33f7f7 100644
--- a/pkgs/applications/audio/mda-lv2/default.nix
+++ b/pkgs/applications/audio/mda-lv2/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mda-lv2";
-  version = "1.2.2";
+  version = "1.2.4";
 
   src = fetchurl {
     url = "https://download.drobilla.net/${pname}-${version}.tar.bz2";
-    sha256 = "0hh40c5d2m0k5gb3vw031l6lqn59dg804an3mkmhkc7qv4gc6xm4";
+    sha256 = "1a3cv6w5xby9yn11j695rbh3c4ih7rxfxmkca9s1324ljphh06m8";
   };
 
   nativeBuildInputs = [ pkgconfig wafHook ];
diff --git a/pkgs/applications/audio/qtractor/default.nix b/pkgs/applications/audio/qtractor/default.nix
index dee9b8f20c89..46dafb72c412 100644
--- a/pkgs/applications/audio/qtractor/default.nix
+++ b/pkgs/applications/audio/qtractor/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "qtractor";
-  version = "0.9.10";
+  version = "0.9.11";
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "00fj762qdna4bm8hshdhkwfa48s01bi5sk4f030rfk77mivl09jk";
+    sha256 = "02cpjlf3j4sm74hz88r1frnlycs52rs11mzplr2q8plji3ic5w50";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/audio/strawberry/default.nix b/pkgs/applications/audio/strawberry/default.nix
index bf17798531ba..07e7bb84c565 100644
--- a/pkgs/applications/audio/strawberry/default.nix
+++ b/pkgs/applications/audio/strawberry/default.nix
@@ -35,13 +35,13 @@
 
 mkDerivation rec {
   pname = "strawberry";
-  version = "0.6.6";
+  version = "0.6.7";
 
   src = fetchFromGitHub {
     owner = "jonaski";
     repo = pname;
     rev = version;
-    sha256 = "113z2qdcg0fm6ff2k36nl5zbbj5wsidl94ca1sfnsv9bq9lkvck5";
+    sha256 = "14bw4hmysrbl4havz03s3wl8bv76380wddf5zzrjvfjjpwn333r6";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/audio/yoshimi/default.nix b/pkgs/applications/audio/yoshimi/default.nix
index 6b6963ea471a..24620d91ff5a 100644
--- a/pkgs/applications/audio/yoshimi/default.nix
+++ b/pkgs/applications/audio/yoshimi/default.nix
@@ -6,11 +6,11 @@ assert stdenv ? glibc;
 
 stdenv.mkDerivation  rec {
   pname = "yoshimi";
-  version = "1.6.0.2";
+  version = "1.6.0.3";
 
   src = fetchurl {
     url = "mirror://sourceforge/yoshimi/${pname}-${version}.tar.bz2";
-    sha256 = "0q2cw168r53r50zghkdqcxba2cybn44axbdkwacvkm7ag2z0j2l8";
+    sha256 = "1z2mnmm299ng6jcwa61dzr1ilwa5fjgsggxl2wa5smji6b4npmx7";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/display-managers/lightdm/gtk-greeter.nix b/pkgs/applications/display-managers/lightdm/gtk-greeter.nix
index 5b1490a6b3be..91fe3e5b22f2 100644
--- a/pkgs/applications/display-managers/lightdm/gtk-greeter.nix
+++ b/pkgs/applications/display-managers/lightdm/gtk-greeter.nix
@@ -20,7 +20,7 @@
 
 let
   ver_branch = "2.0";
-  version = "2.0.6";
+  version = "2.0.7";
 in
 stdenv.mkDerivation rec {
   pname = "lightdm-gtk-greeter";
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "${meta.homepage}/${ver_branch}/${version}/+download/${pname}-${version}.tar.gz";
-    sha256 = "1pis5qyg95pg31dvnfqq34bzgj00hg4vs547r8h60lxjk81z8p15";
+    sha256 = "1g7wc3d3vqfa7mrdhx1w9ywydgjbffla6rbrxq9k3sc62br97qms";
   };
 
   nativeBuildInputs = [ pkgconfig intltool wrapGAppsHook ];
diff --git a/pkgs/applications/editors/neovim/neovim-remote.nix b/pkgs/applications/editors/neovim/neovim-remote.nix
index 18f458fd85c7..9893c6085a69 100644
--- a/pkgs/applications/editors/neovim/neovim-remote.nix
+++ b/pkgs/applications/editors/neovim/neovim-remote.nix
@@ -4,14 +4,14 @@ with stdenv.lib;
 
 pythonPackages.buildPythonApplication rec {
   pname = "neovim-remote";
-  version = "2.2.2";
+  version = "2.2.3";
   disabled = !pythonPackages.isPy3k;
 
   src = fetchFromGitHub {
     owner = "mhinz";
     repo = "neovim-remote";
     rev = "v${version}";
-    sha256 = "129yjpwn6480rd5na866h4mcr6rf60rqv651hks5fn3ws112n751";
+    sha256 = "0g7gs5gigk3krydxdpmscgfr1fms0a6rc6am2y4c5szkgbd1d0ph";
   };
 
   propagatedBuildInputs = with pythonPackages; [ pynvim psutil ];
diff --git a/pkgs/applications/graphics/fig2dev/default.nix b/pkgs/applications/graphics/fig2dev/default.nix
index ae38730226a4..c364badc1742 100644
--- a/pkgs/applications/graphics/fig2dev/default.nix
+++ b/pkgs/applications/graphics/fig2dev/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, ghostscript, libpng } :
 
 let
-  version = "3.2.7a";
+  version = "3.2.7b";
 
 in stdenv.mkDerivation {
   pname = "fig2dev";
@@ -9,7 +9,7 @@ in stdenv.mkDerivation {
 
   src = fetchurl {
     url = "mirror://sourceforge/mcj/fig2dev-${version}.tar.xz";
-    sha256 = "0a7vkfl38fvkhg3na5gr9c4fskas9wbs84y9djg85nzwbshik8mx";
+    sha256 = "1ck8gnqgg13xkxq4hrdy706i4xdgrlckx6bi6wxm1g514121pp27";
   };
 
   buildInputs = [ libpng ];
diff --git a/pkgs/applications/misc/kanboard/default.nix b/pkgs/applications/misc/kanboard/default.nix
index 0bdf8e49d969..d3cef00bbe8a 100644
--- a/pkgs/applications/misc/kanboard/default.nix
+++ b/pkgs/applications/misc/kanboard/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "kanboard";
-  version = "1.2.11";
+  version = "1.2.12";
 
   src = fetchFromGitHub {
     owner = "kanboard";
     repo = "kanboard";
     rev = "v${version}";
-    sha256 = "0if5nh4m4y3xlvlv86jph7ix5nvpgc1zjkp4cq5iig6z0041bw98";
+    sha256 = "1m1drgbyk1m6mf69xqlz9gqcj650n9m4y2fdj7d2yv20q8r31489";
   };
 
   dontBuild = true;
diff --git a/pkgs/applications/misc/minder/default.nix b/pkgs/applications/misc/minder/default.nix
index 4b92a43451a3..5c31cdf6e727 100644
--- a/pkgs/applications/misc/minder/default.nix
+++ b/pkgs/applications/misc/minder/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "minder";
-  version = "1.5.0";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "phase1geo";
     repo = pname;
     rev = version;
-    sha256 = "0lhmv3z2jifv4cksxa27jigdfj9n81myjsxg38xp28fx5x3h8bzc";
+    sha256 = "1z3if8bbiigb3m5py641y0j8d9z0s6kbb325waxbqs240pcxipml";
   };
 
   nativeBuildInputs = [ pkgconfig meson ninja python3 wrapGAppsHook vala shared-mime-info ];
diff --git a/pkgs/applications/misc/opencpn/default.nix b/pkgs/applications/misc/opencpn/default.nix
index 9240b5d8910e..375552aaa33a 100644
--- a/pkgs/applications/misc/opencpn/default.nix
+++ b/pkgs/applications/misc/opencpn/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "opencpn-unstable";
-  version = "2019-05-15";
+  version = "2019-11-21";
 
   src = fetchFromGitHub {
     owner = "OpenCPN";
     repo = "OpenCPN";
-    rev = "83a3c4b5ff011d4eb070f009e0a46d194b177047";
-    sha256 = "00s1mxnkf1gg41hrz0zp8ypkp98py0m1c22im2zd09k6lcddxw5p";
+    rev = "e73dc935545b2bbcf193cc61d987a0178c52d7a7";
+    sha256 = "0yiqahkzwcbzgabc5xgxmwlngapkfiaqyva3mwz29xj0c5lg2bdk";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/applications/misc/taskell/default.nix b/pkgs/applications/misc/taskell/default.nix
index 702c3124d8ab..488e49c21817 100644
--- a/pkgs/applications/misc/taskell/default.nix
+++ b/pkgs/applications/misc/taskell/default.nix
@@ -1,8 +1,8 @@
 { lib, haskellPackages, fetchFromGitHub }:
 
 let
-  version = "1.6.1";
-  sha256  = "047gvpq52pif9sfb4qcfdiwz50x3wlnjvsnnjzypm1qlwyl2rbz1";
+  version = "1.7.3";
+  sha256  = "1439fh79ilc6jvz894cfzhk7gy5r2sv4v79bvqmmqbzbqk9qsbvx";
 
 in (haskellPackages.mkDerivation {
   pname = "taskell";
diff --git a/pkgs/applications/misc/xmrig/default.nix b/pkgs/applications/misc/xmrig/default.nix
index 037d6be22991..441cab3dd7b6 100644
--- a/pkgs/applications/misc/xmrig/default.nix
+++ b/pkgs/applications/misc/xmrig/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xmrig";
-  version = "5.0.1";
+  version = "5.1.0";
 
   src = fetchFromGitHub {
     owner = "xmrig";
     repo = "xmrig";
     rev = "v${version}";
-    sha256 = "0w6vbrp44l25jhv3kx1m0841rkv7im30581gds0qb7lhyqm0hnbg";
+    sha256 = "1lkw7xrj20ppfmv7abki9i60yjks9i7nr8ni9p6n7rilfbp4603k";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/misc/xmrig/proxy.nix b/pkgs/applications/misc/xmrig/proxy.nix
index 54fdbdb7cc19..fc3070d1dcb4 100644
--- a/pkgs/applications/misc/xmrig/proxy.nix
+++ b/pkgs/applications/misc/xmrig/proxy.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xmrig-proxy";
-  version = "5.0.0";
+  version = "5.0.1";
 
   src = fetchFromGitHub {
     owner = "xmrig";
     repo = "xmrig-proxy";
     rev = "v${version}";
-    sha256 = "0h0yxzpar952ix94j10qyf31c20g45w0nxr02vfybjip48dvlf76";
+    sha256 = "0lp11p4lf03l9x2kcpq1j19z7c1zrdvjmcfh2xyvlbw8pqx0hxkv";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/networking/mailreaders/mutt/default.nix b/pkgs/applications/networking/mailreaders/mutt/default.nix
index 3af4c7f5e15f..bc4bb49981e4 100644
--- a/pkgs/applications/networking/mailreaders/mutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/mutt/default.nix
@@ -27,11 +27,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "mutt";
-  version = "1.12.2";
+  version = "1.13.0";
 
   src = fetchurl {
     url = "http://ftp.mutt.org/pub/mutt/${pname}-${version}.tar.gz";
-    sha256 = "10k8352s0z7yan6d4z2am80qd3bsaky4h89g72wl4xr3x067ahmw";
+    sha256 = "1dzmypmcyqsxcb0qwz1b2v3nhvd83jcqlnn3acvgaiag10hxq3d0";
   };
 
   patches = optional smimeSupport (fetchpatch {
diff --git a/pkgs/applications/networking/newsreaders/pan/default.nix b/pkgs/applications/networking/newsreaders/pan/default.nix
index 3f90f65476e4..f50d9516167a 100644
--- a/pkgs/applications/networking/newsreaders/pan/default.nix
+++ b/pkgs/applications/networking/newsreaders/pan/default.nix
@@ -7,7 +7,7 @@
 
 assert spellChecking -> gtkspell3 != null;
 
-let version = "0.145"; in
+let version = "0.146"; in
 
 stdenv.mkDerivation {
   pname = "pan";
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "http://pan.rebelbase.com/download/releases/${version}/source/pan-${version}.tar.bz2";
-    sha256 = "1b4wamv33hprghcjk903bpvnd233yxyrm18qnh13alc8h1553nk8";
+    sha256 = "17agd27sn4a7nahvkpg0w39kv74njgdrrygs74bbvpaj8rk2hb55";
   };
 
   nativeBuildInputs = [ pkgconfig gettext intltool itstool libxml2 makeWrapper ];
diff --git a/pkgs/applications/office/libreoffice/default.nix b/pkgs/applications/office/libreoffice/default.nix
index 42f75560a5ab..912ab42ce28a 100644
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@@ -13,7 +13,7 @@
 , librevenge, libe-book, libmwaw, glm, glew, gst_all_1
 , gdb, commonsLogging, librdf_rasqal, wrapGAppsHook
 , gnome3, glib, ncurses, epoxy, gpgme
-, langs ? [ "ca" "cs" "de" "en-GB" "en-US" "eo" "es" "fr" "hu" "it" "ja" "nl" "pl" "ru" "sl" "zh-CN" ]
+, langs ? [ "ca" "cs" "de" "en-GB" "en-US" "eo" "es" "fr" "hu" "it" "ja" "nl" "pl" "pt" "pt-BR" "ru" "sl" "zh-CN" ]
 , withHelp ? true
 , kdeIntegration ? false
 }:
diff --git a/pkgs/applications/office/libreoffice/still.nix b/pkgs/applications/office/libreoffice/still.nix
index c42820e61148..ee1497bfb7e9 100644
--- a/pkgs/applications/office/libreoffice/still.nix
+++ b/pkgs/applications/office/libreoffice/still.nix
@@ -13,7 +13,7 @@
 , librevenge, libe-book, libmwaw, glm, glew, gst_all_1
 , gdb, commonsLogging, librdf_rasqal, wrapGAppsHook
 , gnome3, glib, ncurses, epoxy, gpgme
-, langs ? [ "ca" "cs" "de" "en-GB" "en-US" "eo" "es" "fr" "hu" "it" "ja" "nl" "pl" "ru" "sl" "zh-CN" ]
+, langs ? [ "ca" "cs" "de" "en-GB" "en-US" "eo" "es" "fr" "hu" "it" "ja" "nl" "pl" "pt" "pt-BR" "ru" "sl" "zh-CN" ]
 , withHelp ? true
 , kdeIntegration ? false
 }:
diff --git a/pkgs/applications/science/biology/paml/default.nix b/pkgs/applications/science/biology/paml/default.nix
index fe6919656d9d..731e31c588fa 100644
--- a/pkgs/applications/science/biology/paml/default.nix
+++ b/pkgs/applications/science/biology/paml/default.nix
@@ -1,11 +1,11 @@
 {stdenv, fetchurl}:
 
 stdenv.mkDerivation rec {
-  version = "4.9i";
+  version = "4.9j";
   pname = "paml";
   src = fetchurl {
     url = "http://abacus.gene.ucl.ac.uk/software/paml${version}.tgz";
-    sha256 = "1k5lcyls6c33ppp5fxl8ply2fy7i2k0gcqaifsl7gnc81d8ay4dw";
+    sha256 = "0qflf3i27x6jwks3c6q560m1q8r043ja96syah145113iz5wdalp";
   };
 
   preBuild = ''
@@ -29,6 +29,5 @@ stdenv.mkDerivation rec {
     longDescription = ''PAML is a package of programs for phylogenetic analyses of DNA or protein sequences using maximum likelihood. It is maintained and distributed for academic use free of charge by Ziheng Yang. ANSI C source codes are distributed for UNIX/Linux/Mac OSX, and executables are provided for MS Windows. PAML is not good for tree making. It may be used to estimate parameters and test hypotheses to study the evolutionary process, when you have reconstructed trees using other programs such as PAUP*, PHYLIP, MOLPHY, PhyML, RaxML, etc.'';
     license     = "non-commercial";
     homepage    = http://abacus.gene.ucl.ac.uk/software/paml.html;
-    broken = true;
   };
 }
diff --git a/pkgs/applications/window-managers/icewm/default.nix b/pkgs/applications/window-managers/icewm/default.nix
index f388c2d99db2..58fa0d194e11 100644
--- a/pkgs/applications/window-managers/icewm/default.nix
+++ b/pkgs/applications/window-managers/icewm/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "icewm";
-  version = "1.6.0";
+  version = "1.6.3";
 
   src = fetchFromGitHub {
     owner  = "bbidulock";
     repo   = "icewm";
     rev    = version;
-    sha256 = "1l8hjmb19d7ds7z21cx207h86wkjcmmmamcnalgkwh4alvbawc2p";
+    sha256 = "0h3w718x28fd4sz36ka9wpgcb98scna6qpycxzls4cjji3rjgm0l";
   };
 
   nativeBuildInputs = [ cmake pkgconfig perl asciidoc ];
diff --git a/pkgs/development/compilers/go-jsonnet/default.nix b/pkgs/development/compilers/go-jsonnet/default.nix
index e051d41993cc..949190903673 100644
--- a/pkgs/development/compilers/go-jsonnet/default.nix
+++ b/pkgs/development/compilers/go-jsonnet/default.nix
@@ -1,33 +1,24 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "go-jsonnet";
-  version = "0.13.0";
-
-  goPackagePath = "github.com/google/go-jsonnet";
-
-  # regenerate deps.nix using following steps:
-  #
-  # go get -u github.com/google/go-jsonnet
-  # cd $GOPATH/src/github.com/google/go-jsonnet
-  # git checkout <version>
-  # dep init
-  # dep2nix
-  goDeps = ./deps.nix;
+  version = "0.14.0";
 
   src = fetchFromGitHub {
-    rev = "v${version}";
     owner = "google";
     repo = "go-jsonnet";
-    sha256 = "0x95sqhrw4pscxq0q8781wix0w881k9my5kn5nf6k0fg1d6qlgiy";
-    fetchSubmodules = true;
+    rev = "v${version}";
+    sha256 = "1q0mpydh8h0zrml605q9r259y8584kbwcr9g4sqcb1n13b4d1sgp";
   };
 
-  meta = {
+  modSha256 = "1b6hz5a66hhlzpcv1badxr1b4nmk4lw0507d5jks7lqzvvwd0sxq";
+
+  subPackages = [ "cmd/jsonnet" ];
+
+  meta = with lib; {
     description = "An implementation of Jsonnet in pure Go";
-    maintainers = with lib.maintainers; [ nshalman ];
-    license = lib.licenses.asl20;
-    homepage = https://github.com/google/go-jsonnet;
-    platforms = lib.platforms.unix;
+    homepage = "https://github.com/google/go-jsonnet";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ nshalman ];
   };
 }
diff --git a/pkgs/development/compilers/go-jsonnet/deps.nix b/pkgs/development/compilers/go-jsonnet/deps.nix
deleted file mode 100644
index 1f413a16d81d..000000000000
--- a/pkgs/development/compilers/go-jsonnet/deps.nix
+++ /dev/null
@@ -1,48 +0,0 @@
-# file generated from Gopkg.lock using dep2nix (https://github.com/nixcloud/dep2nix)
-[
-  {
-    goPackagePath  = "github.com/fatih/color";
-    fetch = {
-      type = "git";
-      url = "https://github.com/fatih/color";
-      rev =  "5b77d2a35fb0ede96d138fc9a99f5c9b6aef11b4";
-      sha256 = "0v8msvg38r8d1iiq2i5r4xyfx0invhc941kjrsg5gzwvagv55inv";
-    };
-  }
-  {
-    goPackagePath  = "github.com/mattn/go-colorable";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mattn/go-colorable";
-      rev =  "167de6bfdfba052fa6b2d3664c8f5272e23c9072";
-      sha256 = "1nwjmsppsjicr7anq8na6md7b1z84l9ppnlr045hhxjvbkqwalvx";
-    };
-  }
-  {
-    goPackagePath  = "github.com/mattn/go-isatty";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mattn/go-isatty";
-      rev =  "1311e847b0cb909da63b5fecfb5370aa66236465";
-      sha256 = "0rqfh1rj6f5wm8p2ky7inm8g10152p7w6n2cli17kf9gad797i8h";
-    };
-  }
-  {
-    goPackagePath  = "github.com/sergi/go-diff";
-    fetch = {
-      type = "git";
-      url = "https://github.com/sergi/go-diff";
-      rev =  "1744e2970ca51c86172c8190fadad617561ed6e7";
-      sha256 = "0swiazj8wphs2zmk1qgq75xza6m19snif94h2m6fi8dqkwqdl7c7";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/sys";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sys";
-      rev =  "4c4f7f33c9ed00de01c4c741d2177abfcfe19307";
-      sha256 = "191001bxqyc3xfs46nnqmm7jdk0r73vk7a4zqngfl7zwjv9smwsq";
-    };
-  }
-]
\ No newline at end of file
diff --git a/pkgs/development/libraries/libfprint/default.nix b/pkgs/development/libraries/libfprint/default.nix
index 9a6db72ae058..6819ffba21c3 100644
--- a/pkgs/development/libraries/libfprint/default.nix
+++ b/pkgs/development/libraries/libfprint/default.nix
@@ -1,41 +1,27 @@
-{ thinkpad ? false
-, stdenv
-, fetchFromGitHub
+{ stdenv
 , fetchurl
 , pkgconfig
 , meson
 , ninja
-, libusb
+, gusb
 , pixman
 , glib
 , nss
-, gtk3
+, gobject-introspection
 , coreutils
 , gtk-doc
 , docbook_xsl
 , docbook_xml_dtd_43
-, openssl ? null
 }:
 
-assert thinkpad -> openssl != null;
-
 stdenv.mkDerivation rec {
-  pname = "libfprint" + stdenv.lib.optionalString thinkpad "-thinkpad";
-  version = "1.0";
+  pname = "libfprint";
+  version = "1.90";
 
-  src = {
-    libfprint-thinkpad =
-      fetchFromGitHub {
-        owner = "3v1n0";
-        repo = "libfprint";
-        rev = "2e2e3821717e9042e93a995bdbd3d00f2df0be9c";
-        sha256 = "1vps1wrp7hskf13f7jrv0dwry2fcid76x2w463wplngp63cj7b3b";
-      };
-    libfprint = fetchurl {
-      url = "https://gitlab.freedesktop.org/libfprint/libfprint/uploads/aff93e9921d1cff53d7c070944952ff9/libfprint-${version}.tar.xz";
-      sha256 = "0v84pd12v016m8iimhq39fgzamlarqccsr7d98cvrrwrzrgcixrd";
-    };
-  }.${pname};
+  src = fetchurl {
+    url = "https://gitlab.freedesktop.org/libfprint/libfprint/uploads/1bba17b5daa130aa548bc7ea96dc58c4/libfprint-1.90.0.tar.xz";
+    sha256 = "930f530df369ff874d7971f0b7c7bdb7c81597e91af4668694b98fe30b4b3371";
+  };
 
   nativeBuildInputs = [
     pkgconfig
@@ -44,17 +30,15 @@ stdenv.mkDerivation rec {
     gtk-doc
     docbook_xsl
     docbook_xml_dtd_43
+    gobject-introspection
   ];
 
   buildInputs = [
-    libusb
+    gusb
     pixman
     glib
     nss
-    gtk3
-  ]
-  ++ stdenv.lib.optional thinkpad openssl
-  ;
+  ];
 
   mesonFlags = [
     "-Dudev_rules_dir=${placeholder "out"}/lib/udev/rules.d"
diff --git a/pkgs/development/libraries/libsolv/default.nix b/pkgs/development/libraries/libsolv/default.nix
index 84f6656d0b8b..c3fe1ad619af 100644
--- a/pkgs/development/libraries/libsolv/default.nix
+++ b/pkgs/development/libraries/libsolv/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, cmake, ninja, zlib, expat, rpm, db }:
 
 stdenv.mkDerivation rec {
-  version  = "0.7.7";
+  version  = "0.7.9";
   pname = "libsolv";
 
   src = fetchFromGitHub {
     owner  = "openSUSE";
     repo   = "libsolv";
     rev    = version;
-    sha256 = "0f6r5j5d4fbzx9ihbbwrqylayw90qac8kapkhmfcvsh7f8whr623";
+    sha256 = "1ijb4nywc3hx142194d85x7db0j5g2n0i750665fal30qrw2x43y";
   };
 
   cmakeFlags = [
@@ -24,6 +24,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "A free package dependency solver";
+    homepage    = "https://github.com/openSUSE/libsolv";
     license     = licenses.bsd3;
     platforms   = platforms.linux;
     maintainers = with maintainers; [ copumpkin ];
diff --git a/pkgs/development/libraries/libxl/default.nix b/pkgs/development/libraries/libxl/default.nix
index 8153fb883cac..8618fc80a525 100644
--- a/pkgs/development/libraries/libxl/default.nix
+++ b/pkgs/development/libraries/libxl/default.nix
@@ -2,14 +2,15 @@
 
 stdenv.mkDerivation rec {
   pname = "libxl";
-  version = "3.8.5";
+  version = "3.8.7";
 
   src = fetchurl {
     url = "http://www.libxl.com/download/${pname}-lin-${version}.tar.gz";
-    sha256 = "15n8gxyznk1nm2kgp86hd36rnivjsby9ccl12lyabv6q3fab6fsx";
+    sha256 = "0mfi2mlsgqjw9ki3c5bsb6nr2aqym7s1priw70f69r12azzxfqw3";
   };
 
-  phases = [ "unpackPhase" "installPhase" "fixupPhase" ];
+  dontConfigure = true;
+  dontBuild = true;
 
   installPhase = ''
     mkdir $out
@@ -18,7 +19,8 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    description = "A lbrary for parsing excel files";
+    description = "A library for parsing Excel files";
+    homepage    = "http://www.libxl.com/";
     license     = licenses.unfree;
     platforms   = platforms.linux;
     maintainers = with maintainers; [  ];
diff --git a/pkgs/development/libraries/polkit/default.nix b/pkgs/development/libraries/polkit/default.nix
index d0df41c3e5ff..17163c2206cd 100644
--- a/pkgs/development/libraries/polkit/default.nix
+++ b/pkgs/development/libraries/polkit/default.nix
@@ -2,7 +2,7 @@
 , intltool, spidermonkey_60 , gobject-introspection, libxslt, docbook_xsl, dbus
 , docbook_xml_dtd_412, gtk-doc, coreutils
 , useSystemd ? (stdenv.isLinux && !stdenv.hostPlatform.isMusl), systemd, elogind
-, withGnome ? true
+, withIntrospection ? true
 # A few tests currently fail on musl (polkitunixusertest, polkitunixgrouptest, polkitidentitytest segfault).
 # Not yet investigated; it may be due to the "Make netgroup support optional"
 # patch not updating the tests correctly yet, or doing something wrong,
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
     [ expat pam spidermonkey_60 ]
     # On Linux, fall back to elogind when systemd support is off.
     ++ stdenv.lib.optional stdenv.isLinux (if useSystemd then systemd else elogind)
-    ++ stdenv.lib.optional withGnome gobject-introspection;
+    ++ stdenv.lib.optional withIntrospection gobject-introspection;
 
   propagatedBuildInputs = [
     glib # in .pc Requires
@@ -86,7 +86,7 @@ stdenv.mkDerivation rec {
     "--with-systemdsystemunitdir=${placeholder "out"}/etc/systemd/system"
     "--with-polkitd-user=polkituser" #TODO? <nixos> config.ids.uids.polkituser
     "--with-os-type=NixOS" # not recognized but prevents impurities on non-NixOS
-    (if withGnome then "--enable-introspection" else "--disable-introspection")
+    (if withIntrospection then "--enable-introspection" else "--disable-introspection")
   ] ++ stdenv.lib.optional (!doCheck) "--disable-test";
 
   makeFlags = [
diff --git a/pkgs/development/python-modules/aiorpcx/default.nix b/pkgs/development/python-modules/aiorpcx/default.nix
index 6350e3f0441a..eba64f465591 100644
--- a/pkgs/development/python-modules/aiorpcx/default.nix
+++ b/pkgs/development/python-modules/aiorpcx/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "aiorpcx";
-  version = "0.18.3";
+  version = "0.18.4";
 
   src = fetchPypi {
     inherit version;
     pname = "aiorpcX";
-    sha256 = "0k545hc7wl6sh1svydzbv6x7sx5pig2pqkl3yxs9riwmvzawx9xp";
+    sha256 = "0jpvrkan6w8bpq017m8si7r9hb1pyw3ip4vr1fl2pmi8ngzc1jdy";
   };
 
   propagatedBuildInputs = [ attrs ];
diff --git a/pkgs/development/python-modules/apsw/default.nix b/pkgs/development/python-modules/apsw/default.nix
index 9169b0d9ec3b..48e3b20c7c1c 100644
--- a/pkgs/development/python-modules/apsw/default.nix
+++ b/pkgs/development/python-modules/apsw/default.nix
@@ -3,7 +3,7 @@
 
 buildPythonPackage rec {
   pname = "apsw";
-  version = "3.29.0-r1";
+  version = "3.30.1-r1";
 
   disabled = isPyPy;
 
@@ -11,19 +11,11 @@ buildPythonPackage rec {
     owner = "rogerbinns";
     repo = "apsw";
     rev = version;
-    sha256 = "1p3sgmk9qwd0a634lirva44qgpyq0a74r9d70wxb6hsa52yjj9xb";
+    sha256 = "1zp38gj44bmzfxxpvgd7nixkp8vs2fpl839ag8vrh9z70dax22f0";
   };
 
   buildInputs = [ sqlite ];
 
-  patches = [
-    # Fixes a test failure with sqlite 3.30, see https://github.com/rogerbinns/apsw/issues/275
-    (fetchpatch {
-      url = "https://github.com/rogerbinns/apsw/commit/13df0b57bff59542978abf7c0a440c9274e3aac3.diff";
-      sha256 = "1wi1mfis2mr21389wdnvq44phg0bpm5vpwmxhvrj211vwfm0q7dv";
-    })
-  ];
-
   meta = with stdenv.lib; {
     description = "A Python wrapper for the SQLite embedded relational database engine";
     homepage = https://github.com/rogerbinns/apsw;
diff --git a/pkgs/development/python-modules/buildbot/default.nix b/pkgs/development/python-modules/buildbot/default.nix
index 8fc7b62a63c1..7385a3295518 100644
--- a/pkgs/development/python-modules/buildbot/default.nix
+++ b/pkgs/development/python-modules/buildbot/default.nix
@@ -25,11 +25,11 @@ let
 
   package = buildPythonPackage rec {
     pname = "buildbot";
-    version = "2.5.0";
+    version = "2.5.1";
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "06dza7kggybz8nf3i1skkadwrq9s0nkpqjfahifysaag3j3b5rp4";
+      sha256 = "13ddpcbndb22zlg9gjsf2pbgad45g1w5cg4a3z83085fkgnib7sr";
     };
 
     propagatedBuildInputs = [
@@ -74,13 +74,6 @@ let
       # This patch disables the test that tries to read /etc/os-release which
       # is not accessible in sandboxed builds.
       ./skip_test_linux_distro.patch
-      # Work around https://github.com/glyph/automat/issues/117
-      (fetchpatch {
-        url = "https://git.archlinux.org/svntogit/community.git/plain/trunk/buildbot-automat-117.diff?h=packages/buildbot&id=7904292340f98578adfe783a09e9eb4c5b1d4632";
-        name = "buildbot-automat-117.diff";
-        stripLen = 1;
-        sha256 = "0rng6f8nvghkihajz9m925rdp9q3c395bj4wc7r2s1minv613hba";
-      })
     ];
 
     postPatch = ''
diff --git a/pkgs/development/python-modules/buildbot/pkg.nix b/pkgs/development/python-modules/buildbot/pkg.nix
index 1a75d6a634fb..ff2be45bf32a 100644
--- a/pkgs/development/python-modules/buildbot/pkg.nix
+++ b/pkgs/development/python-modules/buildbot/pkg.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "buildbot-pkg";
-  version = "2.5.0";
+  version = "2.5.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1my9a791y6hsazzqs3f3svl6zw28x3qwj0a0vxffybqdij650nvw";
+    sha256 = "1g87pddsyas1r0f6z29047cwnz7ds4925f6n9g7b0pkj3k73ci06";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/buildbot/plugins.nix b/pkgs/development/python-modules/buildbot/plugins.nix
index 7ee8ddfb61a9..8722a6629e49 100644
--- a/pkgs/development/python-modules/buildbot/plugins.nix
+++ b/pkgs/development/python-modules/buildbot/plugins.nix
@@ -7,7 +7,7 @@
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "0awy96pb9s9g0nrmlrvqf5zi878z6mvj653inf9sm89x601a6lp1";
+      sha256 = "00k5dbcwzqlyk4lcp5qh1q8xbrxmg9gzqs7vl2r6f3wxi4ydb5nw";
     };
 
     # Remove unneccessary circular dependency on buildbot
@@ -36,7 +36,7 @@
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "0bp7bbq6rq1kdg3pf8plcpc4amam0pks5dlmyqj6bn29skfa5h1j";
+      sha256 = "0ai334y779jwqabrn2yjma41pw0a9k1qy7v68qbjd22n4my227ma";
     };
 
     buildInputs = [ buildbot-pkg ];
@@ -58,7 +58,7 @@
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "1mxxkqzh4a6574n2lk2ndi77d9g93hjpkwsqizj911n6ibsn4qw3";
+      sha256 = "1j450hwvg729mivzijbrx8ngalx56qvrx8mwwgy8arfwpnyfkr9l";
     };
 
     buildInputs = [ buildbot-pkg ];
@@ -80,7 +80,7 @@
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "1fkrd5crbgqgp8mr8qgfy559f59ys6hrspddzk3fwg5hrsckkjwr";
+      sha256 = "19w8is5s7d7l60mlchh1zd9nidpkswi8fivfa36b97plibn0jgw1";
     };
 
     buildInputs = [ buildbot-pkg ];
@@ -102,7 +102,7 @@
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "0cvbizcc92df08xcs8w6ah51yfilxz7sx9g8bbdrvw6m586ziczb";
+      sha256 = "1zl7y08rkw7bya6cli44msvcdgirsyfg3kxpf2z82vwgc6bwi785";
     };
 
     buildInputs = [ buildbot-pkg ];
diff --git a/pkgs/development/python-modules/buildbot/worker.nix b/pkgs/development/python-modules/buildbot/worker.nix
index 19ce3bf0ad66..048fb44a93bc 100644
--- a/pkgs/development/python-modules/buildbot/worker.nix
+++ b/pkgs/development/python-modules/buildbot/worker.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage (rec {
   pname = "buildbot-worker";
-  version = "2.5.0";
+  version = "2.5.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "05c8q6ykharry4lv47imh6agq55fxar8a9ldwx46clb480qwyc43";
+    sha256 = "1kpj85x8xflrccvy840v9bl3q1j63rk9kahj1qirbai1fxwvzbik";
   };
 
   propagatedBuildInputs = [ twisted future ];
diff --git a/pkgs/development/python-modules/matrix-nio/default.nix b/pkgs/development/python-modules/matrix-nio/default.nix
index 8658130d9f6a..9f5a086f2ee5 100644
--- a/pkgs/development/python-modules/matrix-nio/default.nix
+++ b/pkgs/development/python-modules/matrix-nio/default.nix
@@ -1,6 +1,6 @@
 { lib, buildPythonPackage, fetchFromGitHub, git,
   attrs, future, peewee, h11, h2, atomicwrites, pycryptodome, sphinx, Logbook, jsonschema,
-  python-olm, unpaddedbase64, aiohttp }:
+  python-olm, unpaddedbase64, aiohttp, cachetools }:
 
 buildPythonPackage rec {
   pname = "nio";
@@ -36,6 +36,7 @@ buildPythonPackage rec {
     python-olm
     unpaddedbase64
     aiohttp
+    cachetools
   ];
 
   doCheck = false;
diff --git a/pkgs/development/python-modules/owslib/default.nix b/pkgs/development/python-modules/owslib/default.nix
index 7921b0a7a148..1e79a7641472 100644
--- a/pkgs/development/python-modules/owslib/default.nix
+++ b/pkgs/development/python-modules/owslib/default.nix
@@ -1,11 +1,11 @@
 { lib, buildPythonPackage, fetchPypi, dateutil, requests, pytz, pyproj , pytest } :
 buildPythonPackage rec {
   pname = "OWSLib";
-  version = "0.18.0";
+  version = "0.19.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "018p2ypmpbbcgl0hp92s0vig1wirh41lj0wy62aafn5050pmqr7m";
+    sha256 = "0rdhymayyc6w1izlv1bf2wgx2dfxbp4k1vll5s1364isw60rjj8x";
   };
 
   buildInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/pykde4/default.nix b/pkgs/development/python-modules/pykde4/default.nix
deleted file mode 100644
index 5be43a412e52..000000000000
--- a/pkgs/development/python-modules/pykde4/default.nix
+++ /dev/null
@@ -1,46 +0,0 @@
-{ pyqt4, openssl_1_0_2
-, stdenv, callPackage, fetchurl, cmake, automoc4, sip }:
-
-let
-  kdelibs = callPackage ./kdelibs.nix {
-    openssl = openssl_1_0_2;
-  };
-  sip4_19_3 = sip.overrideAttrs (oldAttrs: rec {
-    src = fetchurl {
-      url = "mirror://sourceforge/pyqt/sip/sip-4.19.3/sip-4.19.3.tar.gz";
-      sha256 = "0x2bghbprwl3az1ni3p87i0bq8r99694la93kg65vi0cz12gh3bl";
-    };
-  });
-  pyqt4_fixed = pyqt4.overrideAttrs (oldAttrs: {
-    propagatedBuildInputs = [ sip4_19_3 ];
-  });
-in stdenv.mkDerivation rec {
-  version = "4.14.3";
-  pname = "pykde4";
-
-  src = fetchurl {
-    url = "mirror://kde/stable/${version}/src/${pname}-${version}.tar.xz";
-    sha256 = "1z40gnkyjlv6ds3cmpzvv99394rhmydr6rxx7qj33m83xnsxgfbz";
-  };
-
-  patches = [ ./dlfcn.patch ];
-
-  buildInputs = [
-    kdelibs
-  ];
-
-  nativeBuildInputs = [ cmake automoc4 ];
-
-  propagatedBuildInputs = [ pyqt4_fixed ];
-
-  enableParallelBuilding = true;
-
-  meta = with stdenv.lib; {
-    platforms = platforms.linux;
-    hydraPlatforms = platforms.none;
-    description = "Python bindings for KDE";
-    license = with licenses; [ gpl2 lgpl2 ];
-    homepage = https://api.kde.org/pykde-4.3-api/;
-    maintainers = with maintainers; [ gnidorah ];
-  };
-}
diff --git a/pkgs/development/python-modules/pykde4/dlfcn.patch b/pkgs/development/python-modules/pykde4/dlfcn.patch
deleted file mode 100644
index 63aff46eeab1..000000000000
--- a/pkgs/development/python-modules/pykde4/dlfcn.patch
+++ /dev/null
@@ -1,13 +0,0 @@
---- __init__.py.orig	2017-11-02 09:06:48.998054459 +0300
-+++ ./__init__.py	2017-11-02 09:24:28.089072752 +0300
-@@ -1,4 +1,8 @@
--import sys,DLFCN
-+import sys
-+try:
-+    import DLFCN
-+except ImportError:
-+    import os as DLFCN
- # This is needed to ensure that dynamic_cast and RTTI works inside kdelibs.
- sys.setdlopenflags(DLFCN.RTLD_NOW|DLFCN.RTLD_GLOBAL)
-      
-\ No newline at end of file
diff --git a/pkgs/development/python-modules/pykde4/kdelibs.nix b/pkgs/development/python-modules/pykde4/kdelibs.nix
deleted file mode 100644
index e6f20b8248b8..000000000000
--- a/pkgs/development/python-modules/pykde4/kdelibs.nix
+++ /dev/null
@@ -1,48 +0,0 @@
-{
-  stdenv, fetchurl, fetchpatch,
-  automoc4, cmake_2_8, libxslt, perl, pkgconfig, shared-mime-info,
-  attica, docbook_xml_dtd_42, docbook_xsl, giflib,
-  libdbusmenu_qt, libjpeg, phonon, qt4, openssl
-}:
-
-stdenv.mkDerivation rec {
-  version = "4.14.38";
-  pname = "kdelibs";
-  src = fetchurl {
-    url = "mirror://kde/stable/applications/17.08.3/src/${pname}-${version}.tar.xz";
-    sha256 = "1zn3yb09sd22bm54is0rn98amj0398zybl550dp406419sil7z9p";
-  };
-  patches = [
-    # https://phabricator.kde.org/D22989
-    (fetchpatch {
-      url = "https://cgit.kde.org/kdelibs.git/patch/?id=2c3762feddf7e66cf6b64d9058f625a715694a00";
-      sha256 = "1wbzywh8lcc66n6y3pxs18h7cwkq6g216faz27san33jpl8ra1i9";
-      name = "CVE-2019-14744.patch";
-    })
-  ];
-
-  enableParallelBuilding = true;
-
-  nativeBuildInputs = [
-    automoc4 cmake_2_8 libxslt perl pkgconfig shared-mime-info
-  ];
-  buildInputs = [
-    attica giflib libdbusmenu_qt libjpeg openssl
-  ];
-  propagatedBuildInputs = [ qt4 phonon ];
-
-  cmakeFlags = [
-    "-DDOCBOOKXML_CURRENTDTD_DIR=${docbook_xml_dtd_42}/xml/dtd/docbook"
-    "-DDOCBOOKXSL_DIR=${docbook_xsl}/xml/xsl/docbook"
-    "-DKJS_FORCE_DISABLE_PCRE=true"
-    "-DWITH_SOLID_UDISKS2=OFF"
-  ];
-
-  meta = with stdenv.lib; {
-    platforms = platforms.linux;
-    hydraPlatforms = platforms.none;
-    homepage = http://www.kde.org;
-    license = with licenses; [ gpl2 fdl12 lgpl21 ];
-    maintainers = with maintainers; [ gnidorah ];
-  };
-}
diff --git a/pkgs/development/tools/ammonite/default.nix b/pkgs/development/tools/ammonite/default.nix
index ad33edf004f0..69e81596574b 100644
--- a/pkgs/development/tools/ammonite/default.nix
+++ b/pkgs/development/tools/ammonite/default.nix
@@ -22,6 +22,7 @@ stdenv.mkDerivation rec {
     sed -i '0,/java/{s|java|${jre}/bin/java|}' $out/bin/amm
   '' + optionalString (disableRemoteLogging) ''
     sed -i '0,/ammonite.Main/{s|ammonite.Main|ammonite.Main --no-remote-logging|}' $out/bin/amm
+    sed -i '1i #!/bin/sh' $out/bin/amm
   '';
 
   meta = {
diff --git a/pkgs/development/tools/clang-tools/wrapper b/pkgs/development/tools/clang-tools/wrapper
index fe17880b07d8..53c99a67f2d3 100644
--- a/pkgs/development/tools/clang-tools/wrapper
+++ b/pkgs/development/tools/clang-tools/wrapper
@@ -6,7 +6,7 @@ buildcpath() {
     case $1 in
         -isystem)
             shift
-            path=$path${path':'}$1
+            path=$path${path:+':'}$1
     esac
     shift
   done
diff --git a/pkgs/development/tools/kubectx/default.nix b/pkgs/development/tools/kubectx/default.nix
index fe72f6dcf168..b3116a9b2f9d 100644
--- a/pkgs/development/tools/kubectx/default.nix
+++ b/pkgs/development/tools/kubectx/default.nix
@@ -4,13 +4,13 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "kubectx";
-  version = "0.7.0";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "ahmetb";
     repo = pname;
     rev = "v${version}";
-    sha256 = "11snp3li2w4ds2r7fc6mldlgj24mga40v0knlralaiz296bd6zcs";
+    sha256 = "0mv40jh94by99i5wkf3p52wk4l68hvly1k5gnn7zsy9avc8fjd0p";
   };
 
   buildInputs = [ makeWrapper ];
diff --git a/pkgs/games/pioneer/default.nix b/pkgs/games/pioneer/default.nix
index 0040bba6d399..cb9fe730f195 100644
--- a/pkgs/games/pioneer/default.nix
+++ b/pkgs/games/pioneer/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pioneer";
-  version = "20191009";
+  version = "20191117";
 
   src = fetchFromGitHub{
     owner = "pioneerspacesim";
     repo = "pioneer";
     rev = version;
-    sha256 = "1ll6pv1931z29kz1zvhnc6mgvjxz30q25lvb00qrsvh236nvll7n";
+    sha256 = "0ka5w1sfp56bs3njiwyr6ffy34qvqbzcvmra9cqwyvi7famn8b49";
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];
diff --git a/pkgs/games/zandronum/default.nix b/pkgs/games/zandronum/default.nix
index ce32e435608b..754c48149454 100644
--- a/pkgs/games/zandronum/default.nix
+++ b/pkgs/games/zandronum/default.nix
@@ -9,13 +9,14 @@ let
   sqlite = callPackage ./sqlite.nix { };
   clientLibPath = lib.makeLibraryPath [ fluidsynth ];
 
-in stdenv.mkDerivation {
-  name = "zandronum${suffix}-3.0";
+in stdenv.mkDerivation rec {
+  pname = "zandronum${suffix}";
+  version = "3.0.1";
 
   src = fetchhg {
     url = "https://bitbucket.org/Torr_Samaho/zandronum-stable";
-    rev = "dd3c3b57023f";
-    sha256 = "1f8pd8d2zjwdp6v9anp9yrkdbfhd2mp7svmnna0jiqgxjw6wkyls";
+    rev = "ZA_${version}";
+    sha256 = "16v5b6wfrmabs3ky6isbfhlrqdjrr1pvfxlxwk0im02kcpxxw9qw";
   };
 
   # zandronum tries to download sqlite now when running cmake, don't let it
diff --git a/pkgs/os-specific/linux/intel-compute-runtime/default.nix b/pkgs/os-specific/linux/intel-compute-runtime/default.nix
index 5021d12acecd..d8aefd02e7f4 100644
--- a/pkgs/os-specific/linux/intel-compute-runtime/default.nix
+++ b/pkgs/os-specific/linux/intel-compute-runtime/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-compute-runtime";
-  version = "19.34.13959";
+  version = "19.44.14658";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "compute-runtime";
     rev = version;
-    sha256 = "1m54w5p5pilrkmlmqgvgrsm3d5dqfdr4jai5siq5ccsqj4gnv1wz";
+    sha256 = "1pl7yhmgzf7r2b8jyxzmwdc7772gd24izy2z2g4n5s205s125k7x";
   };
 
   # Build script tries to write the ICD to /etc
diff --git a/pkgs/os-specific/linux/ipset/default.nix b/pkgs/os-specific/linux/ipset/default.nix
index 57255b4a382b..4463e6898511 100644
--- a/pkgs/os-specific/linux/ipset/default.nix
+++ b/pkgs/os-specific/linux/ipset/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, pkgconfig, libmnl }:
 
 stdenv.mkDerivation rec {
-  name = "ipset-7.3";
+  name = "ipset-7.4";
 
   src = fetchurl {
     url = "http://ipset.netfilter.org/${name}.tar.bz2";
-    sha256 = "0nm3vagr1pb5hr1028qrwx6v6s8bxf1m4qjx72vak42y032wfi26";
+    sha256 = "110q996yrf74ckpkc5f4pn8j5bqq98f27fsak3ibgr3zwmv435sa";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index 34654643c331..0f6d6393fe2f 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.14.156";
+  version = "4.14.157";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1h47fxfbq0d5ry7j3jxz45v5c4103qncgm2vydpz6zdx1kmrz27q";
+    sha256 = "0cvpagbjwpj63lpybfq1rnwdnxcjw49z0b5prah39krf0nd7dylh";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index f71ef185199f..c9a2771dfbc5 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.19.86";
+  version = "4.19.87";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1xmzcxsiydym574y7k313qd8s4c3mdahpb3nx3cingfl36ivnb5z";
+    sha256 = "07fsds2k0hxqgny86winzl46d79g6mb9s28bp7nwlvwf67l22wm5";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/perf.nix b/pkgs/os-specific/linux/kernel/perf.nix
index 1e5c987d508b..37b728bde887 100644
--- a/pkgs/os-specific/linux/kernel/perf.nix
+++ b/pkgs/os-specific/linux/kernel/perf.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, kernel, elfutils, python, perl, newt, slang, asciidoc, xmlto, makeWrapper
+{ lib, stdenv, kernel, elfutils, python2, python3, perl, newt, slang, asciidoc, xmlto, makeWrapper
 , docbook_xsl, docbook_xml_dtd_45, libxslt, flex, bison, pkgconfig, libunwind, binutils
 , libiberty, audit, libbfd, libopcodes, openssl, systemtap, numactl
 , zlib, withGtk ? false, gtk2 ? null
@@ -36,12 +36,13 @@ stdenv.mkDerivation {
   # perf refers both to newt and slang
   nativeBuildInputs = [
     asciidoc xmlto docbook_xsl docbook_xml_dtd_45 libxslt
-    flex bison libiberty audit makeWrapper pkgconfig python perl
+    flex bison libiberty audit makeWrapper pkgconfig
   ];
   buildInputs = [
     elfutils newt slang libunwind libbfd zlib openssl systemtap.stapBuild numactl
-    libopcodes
-  ] ++ stdenv.lib.optional withGtk gtk2;
+    libopcodes python3 perl
+  ] ++ stdenv.lib.optional withGtk gtk2
+    ++ (if (versionAtLeast kernel.version "4.19") then [ python3 ] else [ python2 ]);
 
   # Note: we don't add elfutils to buildInputs, since it provides a
   # bad `ld' and other stuff.
diff --git a/pkgs/os-specific/linux/mcelog/default.nix b/pkgs/os-specific/linux/mcelog/default.nix
index 2f0736318044..13bdbcc19f6f 100644
--- a/pkgs/os-specific/linux/mcelog/default.nix
+++ b/pkgs/os-specific/linux/mcelog/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mcelog";
-  version = "165";
+  version = "166";
 
   src = fetchFromGitHub {
     owner  = "andikleen";
     repo   = "mcelog";
     rev    = "v${version}";
-    sha256 = "1g242qz3jj7amgar497bbd8krljspwy89g1r32wz3fdpkn9m1w8s";
+    sha256 = "0q76lf5yrjq7b96ynj5dbf9ll94ymiab1b9106xpb4vbiwz0ia7w";
   };
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index e3affca1220c..f1053cd994f0 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -20,25 +20,25 @@ if ((!lib.versionOlder args.version "391")
 in
 rec {
   # Policy: use the highest stable version as the default (on our master).
-  stable = if stdenv.hostPlatform.system == "x86_64-linux" then stable_43x else legacy_390;
+  stable = if stdenv.hostPlatform.system == "x86_64-linux"
+    then generic {
+      version = "440.36";
+      sha256_64bit = "0nbdldwizb802w4x0rqnyb1p7iqz5nqiahqr534n5ihz21a6422h";
+      settingsSha256 = "07hnl3bq76vsl655ipfx9v4zxjq0nc5hp43dk49nny4pi6ly06p1";
+      persistencedSha256 = "08zm1i5sax16xfhkivkmady0yy5argmxv846x21q98ry1ic6cp6w";
+    }
+    else legacy_390;
 
   # No active beta right now
   beta = stable;
 
-  stable_43x = generic {
-    version = "435.21";
-    sha256_64bit = "0v3pq677ab01qdmwl5dawk8hn39qlwj05p8s9qzh9irmrlnc1izs";
-    settingsSha256 = "1p13cz79kncwx5067a3d7dbz6a1ibp611zynp1qdxpa65hwp2pxa";
-    persistencedSha256 = "0br8znxhz2ryzdj0j4jhqzvdgw9h899q8yz0p9429xz4wxkavgdr";
-  };
-
   # Last one supporting x86
   legacy_390 = generic {
-    version = "390.129";
-    sha256_32bit = "0dkgkp0zx40hf1fsq5xnvbschp7r3c1x1pnpdxna24pi4s62cm2q";
-    sha256_64bit = "0h0jcckqpd63vaj95lvdgj2sbbn9y1ri1xx7r2snxfx0plhwz46n";
-    settingsSha256 = "1w5nkxs7a40mq0qf97nhfazdqhfn1bvr54v50s8p0ggixb6vdm3l";
-    persistencedSha256 = "02v76202qcnh8hvg4y9wmk9swdlv7z39ppfd1c850nlv158vn5nf";
+    version = "390.132";
+    sha256_32bit = "0xgjywzkmmm6a5gby67l2kx0gn7bcxksv4wam0sqym6l1s7v5bai";
+    sha256_64bit = "0qgzsajrc3xkf2jjkwip3la0f2ixp45f76nmz5cphvzrb7k2slxn";
+    settingsSha256 = "07nylqzhldq1gr40q7x5424p2aml3qqnvl2zvnpzc65x2way34v6";
+    persistencedSha256 = "0vab5rj9b1n9yl9674q7i88w1i5p8nhvrwsayn7i1vh4wp3m840r";
   };
 
   legacy_340 = generic {
diff --git a/pkgs/os-specific/linux/psmisc/default.nix b/pkgs/os-specific/linux/psmisc/default.nix
index 413b7d5dcbdf..999df37706de 100644
--- a/pkgs/os-specific/linux/psmisc/default.nix
+++ b/pkgs/os-specific/linux/psmisc/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "psmisc";
-  version = "23.2";
+  version = "23.3";
 
   src = fetchFromGitLab {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "0d90wmibxpkl0d7sdibvvkwpyxyg6m6ksh5gwrjh15vf1swvd5i1";
+    sha256 = "1132xvrldv0dar2mf221mv5kvajq0v6yrq8k3nl0wslnh5baa0r0";
   };
 
   nativeBuildInputs = [ autoconf automake gettext ];
diff --git a/pkgs/servers/dns/nsd/default.nix b/pkgs/servers/dns/nsd/default.nix
index 531e00e578f8..b6a405f6d2d9 100644
--- a/pkgs/servers/dns/nsd/default.nix
+++ b/pkgs/servers/dns/nsd/default.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "nsd";
-  version = "4.2.2";
+  version = "4.2.3";
 
   src = fetchurl {
     url = "https://www.nlnetlabs.nl/downloads/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "1ys608jyp5scc957q4brm094c97sxlwymina7d2nvzi51aa37cw3";
+    sha256 = "1664wpglrwqk627xma10f9qa652vzmf90gsjd8pribyj74xrczc1";
   };
 
   prePatch = ''
diff --git a/pkgs/servers/mail/postfix/default.nix b/pkgs/servers/mail/postfix/default.nix
index 8b6a46b9657f..b3345f9420cb 100644
--- a/pkgs/servers/mail/postfix/default.nix
+++ b/pkgs/servers/mail/postfix/default.nix
@@ -26,11 +26,11 @@ in stdenv.mkDerivation rec {
 
   pname = "postfix";
 
-  version = "3.4.7";
+  version = "3.4.8";
 
   src = fetchurl {
     url = "ftp://ftp.cs.uu.nl/mirror/postfix/postfix-release/official/${pname}-${version}.tar.gz";
-    sha256 = "0rzr0n1gljhmxidsslbr9505xcv0hm8jahkp4dm87a1v3l956cpy";
+    sha256 = "0hw9kbr05qdzvfqhxi4dp4n3s9xvdh0gr0la08a4bip06ybl4pcd";
   };
 
   nativeBuildInputs = [ makeWrapper m4 ];
diff --git a/pkgs/servers/misc/subsonic/default.nix b/pkgs/servers/misc/subsonic/default.nix
index be5188f177ac..a7041fc57d05 100644
--- a/pkgs/servers/misc/subsonic/default.nix
+++ b/pkgs/servers/misc/subsonic/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "subsonic";
-  version = "6.1.5";
+  version = "6.1.6";
 
   src = fetchurl {
     url = "mirror://sourceforge/subsonic/subsonic-${version}-standalone.tar.gz";
-    sha256 = "1xz3flxd5hxcvvg1izzxpv5rxwb5zprk92vsgvmcniy7j7r66936";
+    sha256 = "180qdk8mnc147az8v9rmc1kgf8b13mmq88l195gjdwiqpflqzdyz";
   };
 
   inherit jre;
diff --git a/pkgs/servers/squid/default.nix b/pkgs/servers/squid/default.nix
index 72a7fff7c475..5a6cbd7e2d6f 100644
--- a/pkgs/servers/squid/default.nix
+++ b/pkgs/servers/squid/default.nix
@@ -3,11 +3,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "squid-4.8";
+  name = "squid-4.9";
 
   src = fetchurl {
     url = "http://www.squid-cache.org/Versions/v4/${name}.tar.xz";
-    sha256 = "0432m0ix046rkja7r7qpydgsm2kf1w393xym15nx6h9kv4jb7kbq";
+    sha256 = "188znkbpr315yxbpvpvbpb5sbsn15zmg8l207a55dc43cs687c8w";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/servers/web-apps/moodle/default.nix b/pkgs/servers/web-apps/moodle/default.nix
index 60dcbd8b7efe..2957d296dc4b 100644
--- a/pkgs/servers/web-apps/moodle/default.nix
+++ b/pkgs/servers/web-apps/moodle/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, writeText }:
 
 let
-  version = "3.7.3";
+  version = "3.8";
   stableVersion = builtins.substring 0 2 (builtins.replaceStrings ["."] [""] version);
 in
 
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://download.moodle.org/stable${stableVersion}/${pname}-${version}.tgz";
-    sha256 = "1n82n77lw83a5wjfjbvc74h2ny2z0zkdprxk7sai88rg6rix33ak";
+    sha256 = "00ssx0drgp1fy062x6alp0x8di7hjn4xc87v8skpy3aznchfxyk9";
   };
 
   phpConfig = writeText "config.php" ''
diff --git a/pkgs/shells/nushell/default.nix b/pkgs/shells/nushell/default.nix
index 3b37610ecedd..981853bdaf89 100644
--- a/pkgs/shells/nushell/default.nix
+++ b/pkgs/shells/nushell/default.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nushell";
-  version = "0.6.0";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "012fhy7ni4kyxypn25ssj6py1zxwk41bj4xb1ni4zaw47fqsj1nw";
+    sha256 = "0fdi5c9l8ij2vqcxwi9203mh1qj3lcqsl4kl2rkshqj45hn4ab2a";
   };
 
-  cargoSha256 = "17r6g80qcy1mb195fl5iwcr83d35q2hs71camhwjbdh8yrs9l1la";
+  cargoSha256 = "11cr88jmy34lzjka7agzfvm13hvg66ksa735rzcdx7lcxha538f3";
 
   nativeBuildInputs = [ pkg-config ]
     ++ stdenv.lib.optionals (withAllFeatures && stdenv.isLinux) [ python3 ];
diff --git a/pkgs/tools/filesystems/grive2/default.nix b/pkgs/tools/filesystems/grive2/default.nix
index 59ee358e028a..f325fc97e32c 100644
--- a/pkgs/tools/filesystems/grive2/default.nix
+++ b/pkgs/tools/filesystems/grive2/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, pkgconfig, yajl, cmake, libgcrypt, curl, expat, boost, libiberty }:
 
 stdenv.mkDerivation rec {
-  version = "0.5.0";
+  version = "0.5.1";
   pname = "grive2";
 
   src = fetchFromGitHub {
     owner = "vitalif";
     repo = "grive2";
     rev =  "v${version}";
-    sha256 = "0gyic9228j25l5x8qj9xxxp2cgbw6y4skxqx0xrq6qilhv4lj23c";
+    sha256 = "1kv34ys8qarjsxpb1kd8dp7b3b4ycyiwjzd6mg97d3jk7405g6nm";
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];
diff --git a/pkgs/tools/networking/haproxy/default.nix b/pkgs/tools/networking/haproxy/default.nix
index 2b5f52b51aa8..95457b012054 100644
--- a/pkgs/tools/networking/haproxy/default.nix
+++ b/pkgs/tools/networking/haproxy/default.nix
@@ -11,11 +11,11 @@ assert usePcre -> pcre != null;
 
 stdenv.mkDerivation rec {
   pname = "haproxy";
-  version = "2.0.8";
+  version = "2.0.10";
 
   src = fetchurl {
     url = "https://www.haproxy.org/download/${stdenv.lib.versions.majorMinor version}/src/${pname}-${version}.tar.gz";
-    sha256 = "02i87hr1dfhrk6nvvcig4m9bpww7hyl6qcxcl20rfvxd2n2iwzn3";
+    sha256 = "1sm42q9l159pdmjs5dg544z10dn6x073caljkqh0p4syshysnf0x";
   };
 
   buildInputs = [ openssl zlib ]
diff --git a/pkgs/tools/networking/nebula/default.nix b/pkgs/tools/networking/nebula/default.nix
new file mode 100644
index 000000000000..7f9d194e44a2
--- /dev/null
+++ b/pkgs/tools/networking/nebula/default.nix
@@ -0,0 +1,43 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "nebula";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "slackhq";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0j7fna352z8kzx6n0hck7rp122c0v44j9syz0v30vq47xq2pwj5c";
+  };
+
+  modSha256 = "130h0gc5z0w5inpc99y6mismwg3nyzk3bqdq5v9yclkxlhkbcp6d";
+
+  subPackages = [ "cmd/nebula" "cmd/nebula-cert" ];
+
+  buildFlagsArray = [ "-ldflags='-X main.Build=${version}'" ];
+
+  meta = with lib; {
+    description = "A scalable overlay networking tool with a focus on performance, simplicity and security";
+    longDescription = ''
+      Nebula is a scalable overlay networking tool with a focus on performance,
+      simplicity and security. It lets you seamlessly connect computers
+      anywhere in the world. Nebula is portable, and runs on Linux, OSX, and
+      Windows. (Also: keep this quiet, but we have an early prototype running
+      on iOS). It can be used to connect a small number of computers, but is
+      also able to connect tens of thousands of computers.
+
+      Nebula incorporates a number of existing concepts like encryption,
+      security groups, certificates, and tunneling, and each of those
+      individual pieces existed before Nebula in various forms. What makes
+      Nebula different to existing offerings is that it brings all of these
+      ideas together, resulting in a sum that is greater than its individual
+      parts.
+    '';
+    homepage = "https://github.com/slackhq/nebula";
+    license = licenses.mit;
+    maintainers = with maintainers; [ filalex77 ];
+    platforms = platforms.all;
+  };
+
+}
diff --git a/pkgs/tools/networking/openapi-generator-cli/default.nix b/pkgs/tools/networking/openapi-generator-cli/default.nix
index d9cde0123aa4..9429dee64bd6 100644
--- a/pkgs/tools/networking/openapi-generator-cli/default.nix
+++ b/pkgs/tools/networking/openapi-generator-cli/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, jre, makeWrapper }:
 
 stdenv.mkDerivation rec {
-  version = "4.2.0";
+  version = "4.2.1";
   pname = "openapi-generator-cli";
 
   jarfilename = "${pname}-${version}.jar";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "http://central.maven.org/maven2/org/openapitools/${pname}/${version}/${jarfilename}";
-    sha256 = "00c5y06b8lm6lhnnvl42yndwdgn42bwwfc7p1q7zcsga275b6jpb";
+    sha256 = "1inkiqbr183ksmkvpawagv1gqgc323wa1d6sdrd33pb9lk6wahdl";
   };
 
   phases = [ "installPhase" ];
diff --git a/pkgs/tools/security/fprintd/default.nix b/pkgs/tools/security/fprintd/default.nix
index 41a00306f695..13e6c0be391a 100644
--- a/pkgs/tools/security/fprintd/default.nix
+++ b/pkgs/tools/security/fprintd/default.nix
@@ -1,11 +1,9 @@
-{ thinkpad ? false
-, stdenv
+{ stdenv
 , fetchurl
 , fetchpatch
 , pkgconfig
 , intltool
-, libfprint-thinkpad ? null
-, libfprint ? null
+, libfprint
 , glib
 , dbus-glib
 , polkit
@@ -17,7 +15,7 @@
 }:
 
 stdenv.mkDerivation rec {
-  pname = "fprintd" + stdenv.lib.optionalString thinkpad "-thinkpad";
+  pname = "fprintd";
   version = "0.9.0";
 
   src = fetchurl {
@@ -46,10 +44,8 @@ stdenv.mkDerivation rec {
     nss
     pam
     systemd
-  ]
-  ++ stdenv.lib.optional thinkpad libfprint-thinkpad
-  ++ stdenv.lib.optional (!thinkpad) libfprint
-  ;
+    libfprint
+  ];
 
   configureFlags = [
     # is hardcoded to /var/lib/fprint, this is for the StateDirectory install target
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 61645c419861..cc92b56da570 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -115,6 +115,7 @@ mapAliases ({
   '';
   font-droid = throw "font-droid has been deprecated by noto-fonts"; # 2019-04-12
   foomatic_filters = foomatic-filters;  # 2016-08
+  fprintd-thinkpad = throw "removed from repository 2019-12-01: Install it manually with an override.";
   fuse_exfat = exfat;                   # 2015-09-11
   fuseki = apache-jena-fuseki; # added 2018-04-25
   fusesmb = throw "fusesmb is abandoned by upstream"; # added 2019-10-15
@@ -193,6 +194,7 @@ mapAliases ({
   liberation_ttf_v1_from_source = liberation_ttf_v1; # added 2018-12-12
   liberation_ttf_v2_from_source = liberation_ttf_v2; # added 2018-12-12
   liberationsansnarrow = liberation-sans-narrow; # added 2018-12-12
+  libfprint-thinkpad = throw "removed from repository 2019-12-01: Install it manually with an override.";
   libgnome_keyring = libgnome-keyring; # added 2018-02-25
   libgnome_keyring3 = libgnome-keyring3; # added 2018-02-25
   libgumbo = gumbo; # added 2018-01-21
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 43e1197f2578..76fd9bb8c845 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3303,9 +3303,6 @@ in
   fprot = callPackage ../tools/security/fprot { };
 
   fprintd = callPackage ../tools/security/fprintd { };
-  fprintd-thinkpad = fprintd.override {
-    thinkpad = true;
-  };
 
   franz = callPackage ../applications/networking/instant-messengers/franz { };
 
@@ -5075,6 +5072,8 @@ in
 
   ndppd = callPackage ../applications/networking/ndppd { };
 
+  nebula = callPackage ../tools/networking/nebula { };
+
   nemiver = callPackage ../development/tools/nemiver { };
 
   neofetch = callPackage ../tools/misc/neofetch { };
@@ -12220,9 +12219,6 @@ in
   };
 
   libfprint = callPackage ../development/libraries/libfprint { };
-  libfprint-thinkpad = libfprint.override {
-    thinkpad = true;
-  };
 
   libfpx = callPackage ../development/libraries/libfpx { };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 129074d6039c..ef1928cb87c4 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1049,11 +1049,6 @@ in {
 
   pyjwkest = callPackage ../development/python-modules/pyjwkest { };
 
-  pykde4 = callPackage ../development/python-modules/pykde4 {
-    inherit (self) pyqt4;
-    callPackage = pkgs.callPackage;
-  };
-
   pykdtree = callPackage ../development/python-modules/pykdtree {
     inherit (pkgs.llvmPackages) openmp;
   };