about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--maintainers/maintainer-list.nix10
-rw-r--r--nixos/doc/manual/release-notes/rl-2003.xml299
-rw-r--r--nixos/modules/services/continuous-integration/hydra/default.nix52
-rw-r--r--nixos/modules/services/mail/roundcube.nix19
-rw-r--r--nixos/modules/services/web-apps/nextcloud.nix17
-rw-r--r--nixos/tests/roundcube.nix1
-rw-r--r--pkgs/applications/audio/strawberry/default.nix4
-rw-r--r--pkgs/applications/editors/jetbrains/default.nix32
-rw-r--r--pkgs/applications/graphics/feh/default.nix4
-rw-r--r--pkgs/applications/misc/gpxsee/default.nix4
-rw-r--r--pkgs/applications/misc/hugo/default.nix6
-rw-r--r--pkgs/applications/misc/mako/default.nix5
-rw-r--r--pkgs/applications/misc/megacmd/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/chromium/common.nix7
-rw-r--r--pkgs/applications/networking/cluster/minikube/default.nix8
-rw-r--r--pkgs/applications/networking/cluster/nomad/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/linphone/default.nix1
-rw-r--r--pkgs/applications/networking/remote/freerdp/default.nix17
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-bug/default.nix10
-rw-r--r--pkgs/build-support/build-bazel-package/default.nix6
-rw-r--r--pkgs/data/fonts/nerdfonts/shas.nix3
-rwxr-xr-xpkgs/data/fonts/nerdfonts/update.sh74
-rw-r--r--pkgs/data/themes/matcha/default.nix4
-rw-r--r--pkgs/development/interpreters/dhall/build-dhall-package.nix19
-rw-r--r--pkgs/development/libraries/fcppt/default.nix11
-rw-r--r--pkgs/development/libraries/gstreamer/good/default.nix12
-rw-r--r--pkgs/development/libraries/liblinphone/default.nix9
-rw-r--r--pkgs/development/libraries/metal/default.nix25
-rw-r--r--pkgs/development/libraries/physics/herwig/default.nix4
-rw-r--r--pkgs/development/libraries/physics/thepeg/default.nix4
-rw-r--r--pkgs/development/python-modules/arviz/default.nix18
-rw-r--r--pkgs/development/python-modules/awkward1/default.nix14
-rw-r--r--pkgs/development/python-modules/gst-python/default.nix9
-rw-r--r--pkgs/development/python-modules/nose2/default.nix11
-rw-r--r--pkgs/development/python-modules/pyhomematic/default.nix4
-rw-r--r--pkgs/development/python-modules/pymc3/default.nix4
-rw-r--r--pkgs/development/python-modules/smart_open/default.nix4
-rw-r--r--pkgs/development/python-modules/snapcast/default.nix4
-rw-r--r--pkgs/development/python-modules/tensorflow-probability/default.nix28
-rw-r--r--pkgs/development/tools/build-managers/bazel/buildtools/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/bazel/buildtools/deps.nix4
-rw-r--r--pkgs/development/tools/hcloud/default.nix6
-rw-r--r--pkgs/development/tools/misc/strace/default.nix4
-rw-r--r--pkgs/development/tools/shellcheck/default.nix17
-rw-r--r--pkgs/games/pingus/default.nix4
-rw-r--r--pkgs/games/simutrans/default.nix26
-rw-r--r--pkgs/games/spring/default.nix10
-rw-r--r--pkgs/os-specific/linux/rtkit/default.nix55
-rw-r--r--pkgs/servers/tautulli/default.nix4
-rw-r--r--pkgs/servers/uftp/default.nix4
-rw-r--r--pkgs/servers/zoneminder/default.nix8
-rw-r--r--pkgs/shells/zsh/oh-my-zsh/default.nix6
-rw-r--r--pkgs/tools/audio/pulsemixer/default.nix4
-rw-r--r--pkgs/tools/filesystems/catcli/default.nix30
-rw-r--r--pkgs/tools/misc/starship/default.nix6
-rw-r--r--pkgs/tools/text/amber/default.nix6
-rw-r--r--pkgs/tools/typesetting/tikzit/default.nix6
-rw-r--r--pkgs/top-level/all-packages.nix7
-rw-r--r--pkgs/top-level/php-packages.nix2
59 files changed, 697 insertions, 287 deletions
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index a8b4cc852829..1a4f2b94f5d1 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -5771,6 +5771,12 @@
     githubId = 5515707;
     name = "Peter Romfeld";
   };
+  petersjt014 = {
+    email = "petersjt014@gmail.com";
+    github = "petersjt014";
+    githubId = 29493551;
+    name = "Josh Peters";
+  };
   peti = {
     email = "simons@cryp.to";
     github = "peti";
@@ -7867,8 +7873,8 @@
     githubId = 7953163;
     name = "Vika Shleina";
     keys = [{
-      longkeyid = "rsa4096/0x5402B9B5497BACDB";
-      fingerprint = "A03C D09C 36CF D9F6 1ADF  AF11 5402 B9B5 497B ACDB";
+      longkeyid = "rsa2048/0x4F62CD07CE64796A";
+      fingerprint = "B3C0 DA1A C18B 82E8 CA8B  B1D1 4F62 CD07 CE64 796A";
     }];
   };
   vinymeuh = {
diff --git a/nixos/doc/manual/release-notes/rl-2003.xml b/nixos/doc/manual/release-notes/rl-2003.xml
index f09fb3255d84..1bb9aab90c06 100644
--- a/nixos/doc/manual/release-notes/rl-2003.xml
+++ b/nixos/doc/manual/release-notes/rl-2003.xml
@@ -24,6 +24,21 @@
     </para>
    </listitem>
    <listitem>
+    <para>Core version changes:</para>
+    <para>gcc: 8.3.0 -&gt; 9.2.0</para>
+    <para>glibc: 2.27 -&gt; 2.30</para>
+    <para>linux: 4.19 -&gt; 5.4</para>
+    <para>mesa: 19.1.5 -&gt; 19.3.3</para>
+    <para>openssl: 1.0.2u -&gt; 1.1.1d</para>
+   </listitem>
+   <listitem>
+    <para>Desktop version changes:</para>
+    <para>plasma5: 5.16.5 -&gt; 5.17.5</para>
+    <para>kdeApplications: 19.08.2 -&gt; 19.12.3</para>
+    <para>gnome3: 3.32 -&gt; 3.34</para>
+    <para>pantheon: 5.0 -&gt; 5.1.3</para>
+   </listitem>
+   <listitem>
     <para>
      Linux kernel is updated to branch 5.4 by default (from 4.19).
      Users of Intel GPUs may prefer to explicitly set branch to 4.19 to avoid some regressions.
@@ -44,6 +59,24 @@
     </para>
    </listitem>
    <listitem>
+    <para>
+     GNOME 3 has been upgraded to 3.34. Please take a look at their
+     <link xlink:href="https://help.gnome.org/misc/release-notes/3.34">Release Notes</link>
+     for details.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     If you enable the Pantheon Desktop Manager via
+     <xref linkend="opt-services.xserver.desktopManager.pantheon.enable" />, we now default to also use
+     <link xlink:href="https://blog.elementary.io/say-hello-to-the-new-greeter/">
+      Pantheon's newly designed greeter
+     </link>.
+      Contrary to NixOS's usual update policy, Pantheon will receive updates during the cycle of
+      NixOS 20.03 when backwards compatible.
+    </para>
+   </listitem>
+   <listitem>
      <para>
        By default zfs pools will now be trimmed on a weekly basis.
        Trimming is only done on supported devices (i.e. NVME or SSDs)
@@ -128,6 +161,241 @@ See https://github.com/NixOS/nixpkgs/pull/71684 for details.
      It was created so Geary could function properly outside of GNOME.
     </para>
    </listitem>
+   <listitem>
+     <para>
+       <filename>./config/console.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./hardware/brillo.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./hardware/tuxedo-keyboard.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./programs/bandwhich.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./programs/bash-my-aws.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./programs/liboping.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./programs/traceroute.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/backup/sanoid.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/backup/syncoid.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/backup/zfs-replication.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/continuous-integration/buildkite-agents.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/databases/victoriametrics.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/desktops/gnome3/gnome-initial-setup.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/desktops/neard.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/games/openarena.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/hardware/fancontrol.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/mail/sympa.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/misc/freeswitch.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/misc/mame.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/monitoring/do-agent.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/monitoring/prometheus/xmpp-alerts.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/network-filesystems/orangefs/server.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/network-filesystems/orangefs/client.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/networking/3proxy.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/networking/corerad.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/networking/go-shadowsocks2.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/networking/ntp/openntpd.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/networking/shorewall.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/networking/shorewall6.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/networking/spacecookie.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/networking/trickster.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/networking/v2ray.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/networking/xandikos.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/networking/yggdrasil.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/web-apps/dokuwiki.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/web-apps/gotify-server.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/web-apps/grocy.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/web-apps/ihatemoney</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/web-apps/moinmoin.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/web-apps/trac.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/web-apps/trilium.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/web-apps/shiori.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/web-servers/ttyd.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/x11/picom.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/x11/hardware/digimend.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./services/x11/imwheel.nix</filename>
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       <filename>./virtualisation/cri-o.nix</filename>
+     </para>
+   </listitem>
   </itemizedlist>
 
  </section>
@@ -632,6 +900,25 @@ auth required pam_succeed_if.so uid >= 1000 quiet
      The <option>services.dnscrypt-proxy</option> module has been removed
      as it used the deprecated version of dnscrypt-proxy. We've added
      <xref linkend="opt-services.dnscrypt-proxy2.enable"/> to use the supported version.
+     This module supports configuration via the Nix attribute set
+     <xref linkend="opt-services.dnscrypt-proxy2.settings" />, or by passing a TOML configuration file via
+     <xref linkend="opt-services.dnscrypt-proxy2.configFile" />.
+<programlisting>
+# Example configuration:
+services.dnscrypt-proxy2.enable = true;
+services.dnscrypt-proxy2.settings = {
+  listen_addresses = [ "127.0.0.1:43" ];
+  sources.public-resolvers = {
+    urls = [ "https://download.dnscrypt.info/resolvers-list/v2/public-resolvers.md" ];
+    cache_file = "public-resolvers.md";
+    minisign_key = "RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3";
+    refresh_delay = 72;
+  };
+};
+
+services.dnsmasq.enable = true;
+services.dnsmasq.servers = [ "127.0.0.1#43" ];
+</programlisting>
     </para>
    </listitem>
    <listitem>
@@ -720,7 +1007,7 @@ auth required pam_succeed_if.so uid >= 1000 quiet
     </para>
     <warning>
      <para>
-      Please note that if you're comming from <literal>19.03</literal> or older, you have
+      Please note that if you're coming from <literal>19.03</literal> or older, you have
       to manually upgrade to <literal>19.09</literal> first to upgrade your server
       to Nextcloud v16.
      </para>
@@ -809,7 +1096,8 @@ auth required pam_succeed_if.so uid >= 1000 quiet
    <listitem>
     <para>
      The nginx web server previously started its master process as root
-     privileged, then ran worker processes as a less privileged identity user.
+     privileged, then ran worker processes as a less privileged identity user
+     (the <literal>nginx</literal> user).
      This was changed to start all of nginx as a less privileged user (defined by
      <literal>services.nginx.user</literal> and
      <literal>services.nginx.group</literal>). As a consequence, all files that
@@ -817,6 +1105,13 @@ auth required pam_succeed_if.so uid >= 1000 quiet
      certificates and keys, etc.) must now be readable by this less privileged
      user/group.
     </para>
+    <para>
+     To continue to use the old approach, you can configure:
+      <programlisting>
+services.nginx.appendConfig = let cfg = config.services.nginx; in ''user ${cfg.user} ${cfg.group};'';
+systemd.services.nginx.serviceConfig.User = lib.mkForce "root";
+      </programlisting>
+    </para>
    </listitem>
    <listitem>
     <para>
diff --git a/nixos/modules/services/continuous-integration/hydra/default.nix b/nixos/modules/services/continuous-integration/hydra/default.nix
index 52e4a3aed330..502a5898a5de 100644
--- a/nixos/modules/services/continuous-integration/hydra/default.nix
+++ b/nixos/modules/services/continuous-integration/hydra/default.nix
@@ -39,6 +39,36 @@ let
 
   inherit (config.system) stateVersion;
 
+  hydra-package =
+  let
+    makeWrapperArgs = concatStringsSep " " (mapAttrsToList (key: value: "--set \"${key}\" \"${value}\"") hydraEnv);
+  in pkgs.buildEnv rec {
+    name = "hydra-env";
+    buildInputs = [ pkgs.makeWrapper ];
+    paths = [ cfg.package ];
+
+    postBuild = ''
+      if [ -L "$out/bin" ]; then
+          unlink "$out/bin"
+      fi
+      mkdir -p "$out/bin"
+
+      for path in ${concatStringsSep " " paths}; do
+        if [ -d "$path/bin" ]; then
+          cd "$path/bin"
+          for prg in *; do
+            if [ -f "$prg" ]; then
+              rm -f "$out/bin/$prg"
+              if [ -x "$prg" ]; then
+                makeWrapper "$path/bin/$prg" "$out/bin/$prg" ${makeWrapperArgs}
+              fi
+            fi
+          done
+        fi
+      done
+   '';
+  };
+
 in
 
 {
@@ -266,7 +296,7 @@ in
         use-substitutes = ${if cfg.useSubstitutes then "1" else "0"}
       '';
 
-    environment.systemPackages = [ cfg.package ];
+    environment.systemPackages = [ hydra-package ];
 
     environment.variables = hydraEnv;
 
@@ -327,7 +357,7 @@ in
           chown hydra.hydra ${cfg.gcRootsDir}
           chmod 2775 ${cfg.gcRootsDir}
         '';
-        serviceConfig.ExecStart = "${cfg.package}/bin/hydra-init";
+        serviceConfig.ExecStart = "${hydra-package}/bin/hydra-init";
         serviceConfig.PermissionsStartOnly = true;
         serviceConfig.User = "hydra";
         serviceConfig.Type = "oneshot";
@@ -342,7 +372,7 @@ in
         restartTriggers = [ hydraConf ];
         serviceConfig =
           { ExecStart =
-              "@${cfg.package}/bin/hydra-server hydra-server -f -h '${cfg.listenHost}' "
+              "@${hydra-package}/bin/hydra-server hydra-server -f -h '${cfg.listenHost}' "
               + "-p ${toString cfg.port} --max_spare_servers 5 --max_servers 25 "
               + "--max_requests 100 ${optionalString cfg.debugServer "-d"}";
             User = "hydra-www";
@@ -355,15 +385,15 @@ in
       { wantedBy = [ "multi-user.target" ];
         requires = [ "hydra-init.service" ];
         after = [ "hydra-init.service" "network.target" ];
-        path = [ cfg.package pkgs.nettools pkgs.openssh pkgs.bzip2 config.nix.package ];
+        path = [ hydra-package pkgs.nettools pkgs.openssh pkgs.bzip2 config.nix.package ];
         restartTriggers = [ hydraConf ];
         environment = env // {
           PGPASSFILE = "${baseDir}/pgpass-queue-runner"; # grrr
           IN_SYSTEMD = "1"; # to get log severity levels
         };
         serviceConfig =
-          { ExecStart = "@${cfg.package}/bin/hydra-queue-runner hydra-queue-runner -v";
-            ExecStopPost = "${cfg.package}/bin/hydra-queue-runner --unlock";
+          { ExecStart = "@${hydra-package}/bin/hydra-queue-runner hydra-queue-runner -v";
+            ExecStopPost = "${hydra-package}/bin/hydra-queue-runner --unlock";
             User = "hydra-queue-runner";
             Restart = "always";
 
@@ -377,11 +407,11 @@ in
       { wantedBy = [ "multi-user.target" ];
         requires = [ "hydra-init.service" ];
         after = [ "hydra-init.service" "network.target" ];
-        path = with pkgs; [ cfg.package nettools jq ];
+        path = with pkgs; [ hydra-package nettools jq ];
         restartTriggers = [ hydraConf ];
         environment = env;
         serviceConfig =
-          { ExecStart = "@${cfg.package}/bin/hydra-evaluator hydra-evaluator";
+          { ExecStart = "@${hydra-package}/bin/hydra-evaluator hydra-evaluator";
             User = "hydra";
             Restart = "always";
             WorkingDirectory = baseDir;
@@ -393,7 +423,7 @@ in
         after = [ "hydra-init.service" ];
         environment = env;
         serviceConfig =
-          { ExecStart = "@${cfg.package}/bin/hydra-update-gc-roots hydra-update-gc-roots";
+          { ExecStart = "@${hydra-package}/bin/hydra-update-gc-roots hydra-update-gc-roots";
             User = "hydra";
           };
         startAt = "2,14:15";
@@ -404,7 +434,7 @@ in
         after = [ "hydra-init.service" ];
         environment = env;
         serviceConfig =
-          { ExecStart = "@${cfg.package}/bin/hydra-send-stats hydra-send-stats";
+          { ExecStart = "@${hydra-package}/bin/hydra-send-stats hydra-send-stats";
             User = "hydra";
           };
       };
@@ -418,7 +448,7 @@ in
           PGPASSFILE = "${baseDir}/pgpass-queue-runner";
         };
         serviceConfig =
-          { ExecStart = "@${cfg.package}/bin/hydra-notify hydra-notify";
+          { ExecStart = "@${hydra-package}/bin/hydra-notify hydra-notify";
             # FIXME: run this under a less privileged user?
             User = "hydra-queue-runner";
             Restart = "always";
diff --git a/nixos/modules/services/mail/roundcube.nix b/nixos/modules/services/mail/roundcube.nix
index 0bb0eaedad50..21e92cfee016 100644
--- a/nixos/modules/services/mail/roundcube.nix
+++ b/nixos/modules/services/mail/roundcube.nix
@@ -7,6 +7,7 @@ let
   fpm = config.services.phpfpm.pools.roundcube;
   localDB = cfg.database.host == "localhost";
   user = cfg.database.username;
+  phpWithPspell = pkgs.php.withExtensions (e: [ e.pspell ] ++ pkgs.php.enabledExtensions);
 in
 {
   options.services.roundcube = {
@@ -85,6 +86,15 @@ in
       '';
     };
 
+    dicts = mkOption {
+      type = types.listOf types.package;
+      default = [];
+      example = literalExample "with pkgs.aspellDicts; [ en fr de ]";
+      description = ''
+        List of aspell dictionnaries for spell checking. If empty, spell checking is disabled.
+      '';
+    };
+
     extraConfig = mkOption {
       type = types.lines;
       default = "";
@@ -109,6 +119,11 @@ in
       $config['plugins'] = [${concatMapStringsSep "," (p: "'${p}'") cfg.plugins}];
       $config['des_key'] = file_get_contents('/var/lib/roundcube/des_key');
       $config['mime_types'] = '${pkgs.nginx}/conf/mime.types';
+      $config['enable_spellcheck'] = ${if cfg.dicts == [] then "false" else "true"};
+      # by default, spellchecking uses a third-party cloud services
+      $config['spellcheck_engine'] = 'pspell';
+      $config['spellcheck_languages'] = array(${lib.concatMapStringsSep ", " (dict: let p = builtins.parseDrvName dict.shortName; in "'${p.name}' => '${dict.fullName}'") cfg.dicts});
+
       ${cfg.extraConfig}
     '';
 
@@ -172,6 +187,8 @@ in
         "pm.max_requests" = 500;
         "catch_workers_output" = true;
       };
+      phpPackage = phpWithPspell;
+      phpEnv.ASPELL_CONF = "dict-dir ${pkgs.aspellWithDicts (_: cfg.dicts)}/lib/aspell";
     };
     systemd.services.phpfpm-roundcube.after = [ "roundcube-setup.service" ];
 
@@ -199,7 +216,7 @@ in
             ${psql} <<< 'TRUNCATE TABLE session;'
           fi
 
-          ${pkgs.php}/bin/php ${cfg.package}/bin/update.sh
+          ${phpWithPspell}/bin/php ${cfg.package}/bin/update.sh
         '';
         serviceConfig = {
           Type = "oneshot";
diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index 9de2fbc07328..5f6f2bc7a16d 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -322,12 +322,21 @@ in {
           Please migrate your configuration to config.services.nextcloud.poolSettings.
         '')
         ++ (optional (versionOlder cfg.package.version "18") ''
+          A legacy Nextcloud install (from before NixOS 20.03) may be installed.
+
           You're currently deploying an older version of Nextcloud. This may be needed
-          since Nextcloud doesn't allow major version upgrades across multiple versions (i.e. an
-          upgrade from 16 is possible to 17, but not to 18).
+          since Nextcloud doesn't allow major version upgrades that skip multiple
+          versions (i.e. an upgrade from 16 is possible to 17, but not 16 to 18).
+
+          It is assumed that Nextcloud will be upgraded from version 16 to 17.
+
+           * If this is a fresh install, there will be no upgrade to do now.
+
+           * If this server already had Nextcloud installed, first deploy this to your
+             server, and wait until the upgrade to 17 is finished.
 
-          Please deploy this to your server and wait until the migration is finished. After
-          that you can deploy to the latest Nextcloud version available.
+          Then, set `services.nextcloud.package` to `pkgs.nextcloud18` to upgrade to
+          Nextcloud version 18.
         '');
 
       services.nextcloud.package = with pkgs;
diff --git a/nixos/tests/roundcube.nix b/nixos/tests/roundcube.nix
index 1897b53e283a..97e1125694b6 100644
--- a/nixos/tests/roundcube.nix
+++ b/nixos/tests/roundcube.nix
@@ -12,6 +12,7 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         database.password = "not production";
         package = pkgs.roundcube.withPlugins (plugins: [ plugins.persistent_login ]);
         plugins = [ "persistent_login" ];
+        dicts = with pkgs.aspellDicts; [ en fr de ];
       };
       services.nginx.virtualHosts.roundcube = {
         forceSSL = false;
diff --git a/pkgs/applications/audio/strawberry/default.nix b/pkgs/applications/audio/strawberry/default.nix
index ad5685f71b02..6c565911eb44 100644
--- a/pkgs/applications/audio/strawberry/default.nix
+++ b/pkgs/applications/audio/strawberry/default.nix
@@ -35,13 +35,13 @@
 
 mkDerivation rec {
   pname = "strawberry";
-  version = "0.6.8";
+  version = "0.6.9";
 
   src = fetchFromGitHub {
     owner = "jonaski";
     repo = pname;
     rev = version;
-    sha256 = "0jc1m1855dg3f1i1p744c5s42ssmjs61znw4cf28ifamw1nbr1r5";
+    sha256 = "0ssyqa14j54sja2dzhzrznbf1bbl0nc62p4jh2pd6fhinpw8y6dk";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/editors/jetbrains/default.nix b/pkgs/applications/editors/jetbrains/default.nix
index 5ff03918d1eb..b98acae2a8f1 100644
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@@ -263,12 +263,12 @@ in
 
   datagrip = buildDataGrip rec {
     name = "datagrip-${version}";
-    version = "2019.3.4"; /* updated by script */
+    version = "2020.1"; /* updated by script */
     description = "Your Swiss Army Knife for Databases and SQL";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/datagrip/${name}.tar.gz";
-      sha256 = "1ygbi212sga6mdkassi51idh7ppchr77ifq3vi5bbm4ibgnsf2b4"; /* updated by script */
+      sha256 = "1z3asz9fp3xnmbhngar60g8rba83kx987ar67j5m8ws7cijqlzix"; /* updated by script */
     };
     wmClass = "jetbrains-datagrip";
     update-channel = "DataGrip RELEASE";
@@ -276,12 +276,12 @@ in
 
   goland = buildGoland rec {
     name = "goland-${version}";
-    version = "2019.3.3"; /* updated by script */
+    version = "2019.3.4"; /* updated by script */
     description = "Up and Coming Go IDE";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/go/${name}.tar.gz";
-      sha256 = "091ym7vyb0hxzz6a1jfb88x0lj499vjd04bq8swmw14m1akmk3lf"; /* updated by script */
+      sha256 = "01dik4ppn4a6m1bmz6cmdnyrilh2v190lrys65n4nps03sjy2v0b"; /* updated by script */
     };
     wmClass = "jetbrains-goland";
     update-channel = "GoLand RELEASE";
@@ -289,12 +289,12 @@ in
 
   idea-community = buildIdea rec {
     name = "idea-community-${version}";
-    version = "2019.3.4"; /* updated by script */
+    version = "2020.1"; /* updated by script */
     description = "Integrated Development Environment (IDE) by Jetbrains, community edition";
     license = stdenv.lib.licenses.asl20;
     src = fetchurl {
       url = "https://download.jetbrains.com/idea/ideaIC-${version}.tar.gz";
-      sha256 = "1kspj5a9z6smcgrfxdylvc0y53s7y6jv7ckfhmbkvplmrj0h0wd7"; /* updated by script */
+      sha256 = "1rgqr7fn1sy0zbkfmrw3ll8jps345br3y4aqhynyr48mxiwi4c7s"; /* updated by script */
     };
     wmClass = "jetbrains-idea-ce";
     update-channel = "IntelliJ IDEA RELEASE";
@@ -302,12 +302,12 @@ in
 
   idea-ultimate = buildIdea rec {
     name = "idea-ultimate-${version}";
-    version = "2019.3.4"; /* updated by script */
+    version = "2020.1"; /* updated by script */
     description = "Integrated Development Environment (IDE) by Jetbrains, requires paid license";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/idea/ideaIU-${version}-no-jbr.tar.gz";
-      sha256 = "1i34kcd2j1xwx3l2sqc6jh3b69wqbxwwlq5yb7kf2ms9x4144bn0"; /* updated by script */
+      sha256 = "0lrimmczl49azwsms56l4dg7himzr991a209r921jxa32rdjfq6x"; /* updated by script */
     };
     wmClass = "jetbrains-idea";
     update-channel = "IntelliJ IDEA RELEASE";
@@ -328,12 +328,12 @@ in
 
   pycharm-community = buildPycharm rec {
     name = "pycharm-community-${version}";
-    version = "2019.3.4"; /* updated by script */
+    version = "2020.1"; /* updated by script */
     description = "PyCharm Community Edition";
     license = stdenv.lib.licenses.asl20;
     src = fetchurl {
       url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "0k917si1d28fnmjyvi0fs7rkdyvi2vr0d138436lh300a6y0z6wr"; /* updated by script */
+      sha256 = "1ld9hh9bxirsv5rwrx7wbmfaxwvxfw7cjfjqi8l0q0n93v89z90s"; /* updated by script */
     };
     wmClass = "jetbrains-pycharm-ce";
     update-channel = "PyCharm RELEASE";
@@ -341,12 +341,12 @@ in
 
   pycharm-professional = buildPycharm rec {
     name = "pycharm-professional-${version}";
-    version = "2019.3.4"; /* updated by script */
+    version = "2020.1"; /* updated by script */
     description = "PyCharm Professional Edition";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "1hdwzkh6qzad2pqskqw9m8glj15x9d2g4csl0dxk6an82ps52naz"; /* updated by script */
+      sha256 = "1swd2qfhsa6i1aq7z2s183d0hif2gmk1kkw9ns4aybny0wvvnqw2"; /* updated by script */
     };
     wmClass = "jetbrains-pycharm";
     update-channel = "PyCharm RELEASE";
@@ -367,12 +367,12 @@ in
 
   ruby-mine = buildRubyMine rec {
     name = "ruby-mine-${version}";
-    version = "2019.3.3"; /* updated by script */
+    version = "2019.3.4"; /* updated by script */
     description = "The Most Intelligent Ruby and Rails IDE";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/ruby/RubyMine-${version}.tar.gz";
-      sha256 = "0lkzb3rifr7r23vijcz7rqcxjpykx7dkghiq5prk1zz83hzi4b2j"; /* updated by script */
+      sha256 = "13lwrqrkg5vk0azqfhr67psgv1idvkxwjxly2xawr6cy5vnrcd8s"; /* updated by script */
     };
     wmClass = "jetbrains-rubymine";
     update-channel = "RubyMine RELEASE";
@@ -380,12 +380,12 @@ in
 
   webstorm = buildWebStorm rec {
     name = "webstorm-${version}";
-    version = "2019.3.4"; /* updated by script */
+    version = "2020.1"; /* updated by script */
     description = "Professional IDE for Web and JavaScript development";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/webstorm/WebStorm-${version}.tar.gz";
-      sha256 = "0q3595r4m22wf5r5zyncr1zv7yap5przbzjnyf75y51mqwl1g61i"; /* updated by script */
+      sha256 = "1c68li5jxsjml0macdb0s04llwwq1hni5z8vq2zdfcn5zm3xwpif"; /* updated by script */
     };
     wmClass = "jetbrains-webstorm";
     update-channel = "WebStorm RELEASE";
diff --git a/pkgs/applications/graphics/feh/default.nix b/pkgs/applications/graphics/feh/default.nix
index 1eb99a9a7e41..a0e04bf4ad32 100644
--- a/pkgs/applications/graphics/feh/default.nix
+++ b/pkgs/applications/graphics/feh/default.nix
@@ -6,11 +6,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "feh";
-  version = "3.3";
+  version = "3.4";
 
   src = fetchurl {
     url = "https://feh.finalrewind.org/${pname}-${version}.tar.bz2";
-    sha256 = "04c8cgwzkax481sz7lbzy23mk79bqmjy3qpvr7vxa4c14mc9k5gk";
+    sha256 = "0r83zincbfnk8g13xwm2qaccml9srnwlsmpc1f0nhwjkqyjmqm0q";
   };
 
   outputs = [ "out" "man" "doc" ];
diff --git a/pkgs/applications/misc/gpxsee/default.nix b/pkgs/applications/misc/gpxsee/default.nix
index eeb76091aa8d..7077b855e3d0 100644
--- a/pkgs/applications/misc/gpxsee/default.nix
+++ b/pkgs/applications/misc/gpxsee/default.nix
@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "gpxsee";
-  version = "7.27";
+  version = "7.28";
 
   src = fetchFromGitHub {
     owner = "tumic0";
     repo = "GPXSee";
     rev = version;
-    sha256 = "1yillax9npmz912c6qa6yijrqrbm1gaz2h69v2ab9fb127qv4anj";
+    sha256 = "0077y5az3hb46rvkqrpl4zxga5wnm85ca6rz1rdpwiwhq4ch9q8y";
   };
 
   nativeBuildInputs = [ qmake qttools ];
diff --git a/pkgs/applications/misc/hugo/default.nix b/pkgs/applications/misc/hugo/default.nix
index 46abf3696169..7fc042832b50 100644
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "hugo";
-  version = "0.68.3";
+  version = "0.69.0";
 
   goPackagePath = "github.com/gohugoio/hugo";
 
@@ -10,10 +10,10 @@ buildGoModule rec {
     owner = "gohugoio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "138sv4q6f1szpkrrxnzhvxr6rrznhq1d7in0zba1pifsw3yimqq4";
+    sha256 = "050gqjrdfy5ygwl60qdspjn9s6a84k311g3p2fk3sr7i4rnwf36l";
   };
 
-  modSha256 = "04vzm65kbj9905z4cf5yh6yc6g3b0pd5vc00lrxw84pwgqgc0ykb";
+  modSha256 = "07zfqz7d2slswiyx0pw6ip4l428q7nc3i95d4w6d7hfqp0pvp6i0";
 
   buildFlags = [ "-tags" "extended" ];
 
diff --git a/pkgs/applications/misc/mako/default.nix b/pkgs/applications/misc/mako/default.nix
index 89ae647042d3..e1b14acb46f4 100644
--- a/pkgs/applications/misc/mako/default.nix
+++ b/pkgs/applications/misc/mako/default.nix
@@ -1,6 +1,7 @@
 { stdenv, fetchFromGitHub, meson, ninja, pkgconfig, scdoc
 , systemd, pango, cairo, gdk-pixbuf
-, wayland, wayland-protocols }:
+, wayland, wayland-protocols
+, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
   pname = "mako";
@@ -13,7 +14,7 @@ stdenv.mkDerivation rec {
     sha256 = "0hwvibpnrximb628w9dsfjpi30b5jy7nfkm4d94z5vhp78p43vxh";
   };
 
-  nativeBuildInputs = [ meson ninja pkgconfig scdoc wayland-protocols ];
+  nativeBuildInputs = [ meson ninja pkgconfig scdoc wayland-protocols wrapGAppsHook ];
   buildInputs = [ systemd pango cairo gdk-pixbuf wayland ];
 
   mesonFlags = [ "-Dzsh-completions=true" ];
diff --git a/pkgs/applications/misc/megacmd/default.nix b/pkgs/applications/misc/megacmd/default.nix
index c54151de3b1a..07d194dbff42 100644
--- a/pkgs/applications/misc/megacmd/default.nix
+++ b/pkgs/applications/misc/megacmd/default.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation rec {
   pname = "megacmd";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "meganz";
     repo = "MEGAcmd";
     rev = "${version}_Linux";
-    sha256 = "004j8m3xs6slx03g2g6wzr97myl2v3zc09wxnfar5c62a625pd53";
+    sha256 = "0czyhsms0a0237d6h9b21n9p4nm4zkjanhhbvw26k6266g6c1nyr";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 9f7583b1ef5c..585a5f49df37 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -149,10 +149,13 @@ let
       #
       # ++ optionals (channel == "dev") [ ( githubPatch "<patch>" "0000000000000000000000000000000000000000000000000000000000000000" ) ]
       # ++ optional (versionRange "68" "72") ( githubPatch "<patch>" "0000000000000000000000000000000000000000000000000000000000000000" )
-    ] ++ optionals (useVaapi) [
+    ] ++ optionals (useVaapi) ([
       # source: https://aur.archlinux.org/cgit/aur.git/tree/vaapi-fix.patch?h=chromium-vaapi
       ./patches/vaapi-fix.patch
-    ];
+    ] ++ optionals (versionRange "81" "82") [
+      (githubPatch "5b2ff215473e0526b5b24aeff4ad90d369b21c75" "0n00vh8wfpn2ay5fqsxcsx0zadnv7mihm72bcvnrfzh75nzbg902")
+      (githubPatch "98e343ab369e4262511b5fce547728e3e5eefba8" "00wwp653jk0k0yvix00vr7ymgck9dj7fxjwx4nc67ynn84dh6064")
+    ]);
 
     postPatch = ''
       # We want to be able to specify where the sandbox is via CHROME_DEVEL_SANDBOX
diff --git a/pkgs/applications/networking/cluster/minikube/default.nix b/pkgs/applications/networking/cluster/minikube/default.nix
index ea1fec651439..d48a28f46a89 100644
--- a/pkgs/applications/networking/cluster/minikube/default.nix
+++ b/pkgs/applications/networking/cluster/minikube/default.nix
@@ -10,19 +10,19 @@
 
 buildGoModule rec {
   pname   = "minikube";
-  version = "1.8.1";
+  version = "1.9.2";
   # for -ldflags
-  commit  = "cbda04cf6bbe65e987ae52bb393c10099ab62014";
+  commit  = "1b78a7b8a99ad6a3c62b8d22f57120d614d17935";
 
   goPackagePath = "k8s.io/minikube";
   subPackages   = [ "cmd/minikube" ];
-  modSha256     = "1wyz8aq291lx614ilqrcgzdc8rjxbd6v3rv1fy6r2m6snyysycfn";
+  modSha256     = "1pxs6myszgma3rzz0nhfjbnylv6m0xzlinvmlg0c4ijvkkzxg3v5";
 
   src = fetchFromGitHub {
     owner  = "kubernetes";
     repo   = "minikube";
     rev    = "v${version}";
-    sha256 = "1nf0n701rw3anp8j7k3f553ipqwpzzxci41zsi0il4l35dpln5g0";
+    sha256 = "025v45427d885qkjjg7ig8fgrvjalnf1lajsj0cnbwbih2m69svg";
   };
 
   nativeBuildInputs = [ pkgconfig go-bindata makeWrapper ];
diff --git a/pkgs/applications/networking/cluster/nomad/default.nix b/pkgs/applications/networking/cluster/nomad/default.nix
index 8e59671159ad..829ea1000f06 100644
--- a/pkgs/applications/networking/cluster/nomad/default.nix
+++ b/pkgs/applications/networking/cluster/nomad/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "nomad";
-  version = "0.10.5";
+  version = "0.11.0";
   rev = "v${version}";
 
   goPackagePath = "github.com/hashicorp/nomad";
@@ -12,7 +12,7 @@ buildGoPackage rec {
     owner = "hashicorp";
     repo = pname;
     inherit rev;
-    sha256 = "0i9104anf3qaydm1izlwrzvpzizd6p1zy651hsynscnnxa56cmyk";
+    sha256 = "0jg7h52wlgd2aslx13fs97j3b8g5xfgil3p2jsc4j95l7lmqn7bv";
   };
 
   # ui:
diff --git a/pkgs/applications/networking/instant-messengers/linphone/default.nix b/pkgs/applications/networking/instant-messengers/linphone/default.nix
index ced6f91fa1c8..0d97fcbbf511 100644
--- a/pkgs/applications/networking/instant-messengers/linphone/default.nix
+++ b/pkgs/applications/networking/instant-messengers/linphone/default.nix
@@ -223,7 +223,6 @@ mkDerivation rec {
     cp linphone.desktop $out/share/applications/
     cp -r ../assets/icons $out/share/
     mkdir -p $out/share/belr/grammars
-    ln -s ${belcard}/share/belr/grammars/* $out/share/belr/grammars/
     ln -s ${liblinphone}/share/belr/grammars/* $out/share/belr/grammars/
     mkdir -p $out/share/linphone
     ln -s ${liblinphone}/share/linphone/* $out/share/linphone/
diff --git a/pkgs/applications/networking/remote/freerdp/default.nix b/pkgs/applications/networking/remote/freerdp/default.nix
index 1dbf80f20f55..655a8e7102d5 100644
--- a/pkgs/applications/networking/remote/freerdp/default.nix
+++ b/pkgs/applications/networking/remote/freerdp/default.nix
@@ -1,9 +1,11 @@
 { stdenv, lib, fetchFromGitHub, cmake, pkgconfig
 , alsaLib, ffmpeg, glib, openssl, pcre, zlib
-, libX11, libXcursor, libXdamage, libXext, libXi, libXinerama, libXrandr, libXrender, libXv
+, libX11, libXcursor, libXdamage, libXext, libXi, libXinerama, libXrandr, libXrender, libXv, libXtst
 , libxkbcommon, libxkbfile
 , wayland
 , gstreamer, gst-plugins-base, gst-plugins-good, libunwind, orc
+, libxslt
+, libusb1
 , libpulseaudio ? null
 , cups ? null
 , pcsclite ? null
@@ -14,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "freerdp";
-  version = "2.0.0-rc4";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner  = "FreeRDP";
     repo   = "FreeRDP";
     rev    = version;
-    sha256 = "0546i0m2d4nz5jh84ngwzpcm3c43fp987jk6cynqspsmvapab6da";
+    sha256 = "0d2559v0z1jnq6jlrvsgdf8p6gd27m8kwdnxckl1x0ygaxs50bqc";
   };
 
   # outputs = [ "bin" "out" "dev" ];
@@ -31,7 +33,7 @@ stdenv.mkDerivation rec {
       --replace "Requires:" "Requires: @WINPR_PKG_CONFIG_FILENAME@"
   '' + lib.optionalString (pcsclite != null) ''
     substituteInPlace "winpr/libwinpr/smartcard/smartcard_pcsc.c" \
-      --replace "libpcsclite.so" "${stdenv.lib.getLib pcsclite}/lib/libpcsclite.so"
+      --replace "libpcsclite.so" "${lib.getLib pcsclite}/lib/libpcsclite.so"
   '' + lib.optionalString nocaps ''
     substituteInPlace "libfreerdp/locale/keyboard_xkbfile.c" \
       --replace "RDP_SCANCODE_CAPSLOCK" "RDP_SCANCODE_LCONTROL"
@@ -40,9 +42,10 @@ stdenv.mkDerivation rec {
   buildInputs = with lib; [
     alsaLib cups ffmpeg glib openssl pcre pcsclite libpulseaudio zlib
     gstreamer gst-plugins-base gst-plugins-good libunwind orc
-    libX11 libXcursor libXdamage libXext libXi libXinerama libXrandr libXrender libXv
+    libX11 libXcursor libXdamage libXext libXi libXinerama libXrandr libXrender libXv libXtst
     libxkbcommon libxkbfile
-    wayland
+    wayland libusb1
+    libxslt
   ] ++ optional stdenv.isLinux systemd;
 
   nativeBuildInputs = [
@@ -71,7 +74,7 @@ stdenv.mkDerivation rec {
     '';
     homepage = "http://www.freerdp.com/";
     license = licenses.asl20;
-    maintainers = with maintainers; [ peterhoeg ];
+    maintainers = with maintainers; [ peterhoeg lheckemann ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/applications/version-management/git-and-tools/git-bug/default.nix b/pkgs/applications/version-management/git-and-tools/git-bug/default.nix
index 37adcecd62f4..3ca25d6cf13e 100644
--- a/pkgs/applications/version-management/git-and-tools/git-bug/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-bug/default.nix
@@ -2,21 +2,21 @@
 
 buildGoModule rec {
   pname = "git-bug";
-  version = "0.7.0";
-  rev = "71580c41a931a1ad2c04682e0fd701661b716c95";
+  version = "0.7.1"; # the `rev` below pins the version of the source to get
+  rev = "2d64b85db71a17ff3277bbbf7ac9d8e81f8e416c";
   goPackagePath = "github.com/MichaelMure/git-bug";
 
   src = fetchFromGitHub {
     inherit rev;
     owner = "MichaelMure";
     repo = "git-bug";
-    sha256 = "0mhqvcwa6y3hrrv88vbp22k7swzr8xw6ipm80gdpx85yp8j2wdkh";
+    sha256 = "01ab3mlwh5g1vr3x85fppflg18gb8ip9mjfsp2b5rfigd9lxyyns";
   };
 
-  modSha256 = "1cfn49cijiarzzczrpd28x1k7ib98xyzlvn3zghwk2ngfgiah3ld";
+  modSha256 = "05wxvzsbhvz15596019vs7h09kynfsfjx3i5xyrl5xjzdxbaqbrq";
 
   buildFlagsArray = ''
-    -ldflags= 
+    -ldflags=
       -X ${goPackagePath}/commands.GitCommit=${rev}
       -X ${goPackagePath}/commands.GitLastTag=${version}
       -X ${goPackagePath}/commands.GitExactTag=${version}
diff --git a/pkgs/build-support/build-bazel-package/default.nix b/pkgs/build-support/build-bazel-package/default.nix
index 47c72bf92602..9a64b84f076b 100644
--- a/pkgs/build-support/build-bazel-package/default.nix
+++ b/pkgs/build-support/build-bazel-package/default.nix
@@ -181,9 +181,9 @@ in stdenv.mkDerivation (fBuildAttrs // {
     done
     linkopts=()
     host_linkopts=()
-    for flag in $NIX_LD_FLAGS; do
-      linkopts+=( "--linkopt=$flag" )
-      host_linkopts+=( "--host_linkopt=$flag" )
+    for flag in $NIX_LDFLAGS; do
+      linkopts+=( "--linkopt=-Wl,$flag" )
+      host_linkopts+=( "--host_linkopt=-Wl,$flag" )
     done
 
     BAZEL_USE_CPP_ONLY_TOOLCHAIN=1 \
diff --git a/pkgs/data/fonts/nerdfonts/shas.nix b/pkgs/data/fonts/nerdfonts/shas.nix
index 3436042f5f6b..e360dd042b12 100644
--- a/pkgs/data/fonts/nerdfonts/shas.nix
+++ b/pkgs/data/fonts/nerdfonts/shas.nix
@@ -24,6 +24,8 @@
 	"iA-Writer" = "0clksrxw6xcv5c1pbd8rl2rc3r15iak1qv8v6bn0j2mccjcss64z";
 	"IBMPlexMono" = "0xkfkpnkkrvjfiv624l7lpmfji107y7645w6ah47ijyg47yxkmsg";
 	"Inconsolata" = "14gbwc0k3d1j496w6pv9kry1pglswzd0armsdb0g1mqgzfdf1ci1";
+	"InconsolataGo" = "0c6yhx242d82dalyjas42qniy0jagqs47cfsfarwmzar6zg3lj5m";
+	"InconsolataLGC" = "1746nl1rz4hscfgbmd8642wq3z1wizvfjb50y3yyjsc1ixc1f0pd";
 	"Iosevka" = "1qqd4xh98vxb99rh2a2qv9gjclilhaw84pyqdpbx225qhvw9xlkb";
 	"JetBrainsMono" = "1kc8fyk1aczxkmn8dzv1gy6xfi2jywgahd8np576v2dn8kx16844";
 	"Lekton" = "0mny5j9bns9104wg2wmabdw0sl80c7i3dzp4j5mxh8jybx929d3i";
@@ -45,5 +47,6 @@
 	"Terminus" = "0g2ybs225fwxmvwfnanc32jc2lfnag3agmliv1vrb5mxyqzm53gj";
 	"Tinos" = "077n4k6yh4qbirfkl02zqn3057kymspr10zcbfkf4ldvifa36pjd";
 	"Ubuntu" = "1lzdrgb8vk5dwicxhvkgbain5phf88g3zgv5ya2ihh052xsl3qih";
+	"UbuntuMono" = "0wa8ri7f3g8vwd194q812qh8nzplnmhl5ak0yhgilmm44s46ad0h";
 	"VictorMono" = "18z92kwggfqwrd5m09yda55hcb4b159278lps6f9hr8icwki6v9q";
 }
diff --git a/pkgs/data/fonts/nerdfonts/update.sh b/pkgs/data/fonts/nerdfonts/update.sh
index e3d0c27933e9..ccfab174dd8f 100755
--- a/pkgs/data/fonts/nerdfonts/update.sh
+++ b/pkgs/data/fonts/nerdfonts/update.sh
@@ -1,73 +1,21 @@
 #!/usr/bin/env nix-shell
-#! nix-shell -i bash -p rsstail nix-prefetch
+#! nix-shell -i bash -p nix-prefetch jq
 
-# NOTE: Before running this script, please make sure this list is up-to-date -
-# meaning there are no new fonts they provide at https://github.com/ryanoasis/nerd-fonts/releases/
-fonts=(
-	"3270"
-	Agave
-	AnonymousPro
-	Arimo
-	AurulentSansMono
-	BigBlueTerminal
-	BitstreamVeraSansMono
-	CascadiaCode
-	CodeNewRoman
-	Cousine
-	DaddyTimeMono
-	DejaVuSansMono
-	DroidSansMono
-	FantasqueSansMono
-	FiraCode
-	FiraMono
-	Go-Mono
-	Gohu
-	Hack
-	Hasklig
-	HeavyData
-	Hermit
-	iA-Writer
-	IBMPlexMono
-	Inconsolata
-	Iosevka
-	JetBrainsMono
-	Lekton
-	LiberationMono
-	Meslo
-	Monofur
-	Monoid
-	Mononoki
-	MPlus
-	Noto
-	OpenDyslexic
-	Overpass
-	ProFont
-	ProggyClean
-	RobotoMono
-	ShareTechMono
-	SourceCodePro
-	SpaceMono
-	Terminus
-	Tinos
-	Ubuntu
-	VictorMono
-)
-
-releases_url="https://github.com/ryanoasis/nerd-fonts/releases.atom"
-
-version="$(rsstail -1 -u "$releases_url" -H -l -r | sed -e '/^Title: /d' -e 's:.*/::' -e 's/^v//g' | sort -V | tail -1)"
-
-echo Using version "$version"
+latest_release=$(curl --silent https://api.github.com/repos/ryanoasis/nerd-fonts/releases/latest)
+version=$(jq -r '.tag_name' <<<"$latest_release")
 
 dirname="$(dirname "$0")"
-echo \""$version"\" > "$dirname/version.nix"
+echo \""${version#v}"\" >"$dirname/version.nix"
 
-base_url="https://github.com/ryanoasis/nerd-fonts/releases/download/v${version}"
+echo Using version "$version"
 
 printf '{\n' > "$dirname/shas.nix"
 
-for font in "${fonts[@]}"; do
-	printf '\t"%s" = "%s";\n' "$font" "$(nix-prefetch-url "${base_url}/${font}.zip")" >> "$dirname/shas.nix"
-done
+while
+  read -r name
+  read -r url
+do
+    printf '\t"%s" = "%s";\n' "${name%.*}" "$(nix-prefetch-url "$url")" >>"$dirname/shas.nix"
+done < <(jq -r '.assets[] | .name, .browser_download_url' <<<"$latest_release")
 
 printf '}\n' >> "$dirname/shas.nix"
diff --git a/pkgs/data/themes/matcha/default.nix b/pkgs/data/themes/matcha/default.nix
index 75d31acb83fb..d45c759f8808 100644
--- a/pkgs/data/themes/matcha/default.nix
+++ b/pkgs/data/themes/matcha/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "matcha";
-  version = "2020-04-03";
+  version = "2020-04-08";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = pname;
     rev = version;
-    sha256 = "0arnc12zsbypv550dv5j22z4hkc58yncxqhc03xcmxjw1h8lzrwv";
+    sha256 = "0gmdscw9gv19k80ciai6zziih2nccr5snz5na48gr4k5rhq9mzqx";
   };
 
   buildInputs = [ gdk-pixbuf librsvg ];
diff --git a/pkgs/development/interpreters/dhall/build-dhall-package.nix b/pkgs/development/interpreters/dhall/build-dhall-package.nix
index 739dc9b3d52e..9303244eb885 100644
--- a/pkgs/development/interpreters/dhall/build-dhall-package.nix
+++ b/pkgs/development/interpreters/dhall/build-dhall-package.nix
@@ -1,4 +1,4 @@
-{ haskell, haskellPackages, lib, lndir, runCommand, writeText }:
+{ dhall, haskell, lib, lndir, runCommand, writeText }:
 
 { name
 
@@ -34,18 +34,9 @@
 }:
 
 let
-  # `buildDhallPackage` requires version 1.25.0 or newer of the Haskell
-  # interpreter for Dhall.  Given that the default version is 1.24.0 we choose
-  # the latest available version instead until the default is upgraded.
-  #
   # HTTP support is disabled in order to force that HTTP dependencies are built
   # using Nix instead of using Dhall's support for HTTP imports.
-  dhall =
-    haskell.lib.justStaticExecutables
-      (haskell.lib.appendConfigureFlag
-        haskellPackages.dhall_1_29_0
-        "-f-with-http"
-      );
+  dhallNoHTTP = haskell.lib.appendConfigureFlag dhall "-f-with-http";
 
   file = writeText "${name}.dhall" code;
 
@@ -69,13 +60,13 @@ in
 
     mkdir -p $out/${cacheDhall}
 
-    ${dhall}/bin/dhall --alpha --file '${file}' > $out/${sourceFile}
+    ${dhallNoHTTP}/bin/dhall --alpha --file '${file}' > $out/${sourceFile}
 
-    SHA_HASH=$(${dhall}/bin/dhall hash <<< $out/${sourceFile})
+    SHA_HASH=$(${dhallNoHTTP}/bin/dhall hash <<< $out/${sourceFile})
 
     HASH_FILE="''${SHA_HASH/sha256:/1220}"
 
-    ${dhall}/bin/dhall encode --file $out/${sourceFile} > $out/${cacheDhall}/$HASH_FILE
+    ${dhallNoHTTP}/bin/dhall encode --file $out/${sourceFile} > $out/${cacheDhall}/$HASH_FILE
 
     echo "missing $SHA_HASH" > $out/binary.dhall
 
diff --git a/pkgs/development/libraries/fcppt/default.nix b/pkgs/development/libraries/fcppt/default.nix
index 21a2b23f414d..22d3bd889e11 100644
--- a/pkgs/development/libraries/fcppt/default.nix
+++ b/pkgs/development/libraries/fcppt/default.nix
@@ -1,20 +1,19 @@
-{ stdenv, fetchFromGitHub, cmake, boost, brigand, catch2 }:
-
+{ stdenv, fetchFromGitHub, cmake, boost, catch2, metal }:
 stdenv.mkDerivation rec {
   pname = "fcppt";
-  version = "3.2.2";
+  version = "3.5.0";
 
   src = fetchFromGitHub {
     owner = "freundlich";
     repo = "fcppt";
     rev = version;
-    sha256 = "09mah52m3lih2n0swpsh8qb72yzl4nixaq99xp7wxyxxprhf4bpa";
+    sha256 = "045cmn4sym6ria96l4fsc1vrs8l4xrl1gzkmja82f4ddj8qkji2f";
   };
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ boost catch2 ];
+  buildInputs = [ boost catch2 metal ];
 
-  cmakeFlags = [ "-DENABLE_EXAMPLES=false" "-DENABLE_CATCH=true" "-DENABLE_TEST=true" "-DBrigand_INCLUDE_DIR=${brigand}/include" ];
+  cmakeFlags = [ "-DCMAKE_SKIP_BUILD_RPATH=false" "-DENABLE_BOOST=true" "-DENABLE_EXAMPLES=true" "-DENABLE_CATCH=true" "-DENABLE_TEST=true" ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/gstreamer/good/default.nix b/pkgs/development/libraries/gstreamer/good/default.nix
index a7c2bcf838e7..100d270673fc 100644
--- a/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/pkgs/development/libraries/gstreamer/good/default.nix
@@ -29,9 +29,7 @@
 , mpg123
 , twolame
 , gtkSupport ? false, gtk3 ? null
-  # As of writing, jack2 incurs a Qt dependency (big!) via `ffado`.
-  # In the future we should probably split `ffado`.
-, enableJack ? false, jack2
+, enableJack ? true, libjack2
 , libXdamage
 , libXext
 , libXfixes
@@ -104,8 +102,8 @@ stdenv.mkDerivation rec {
     libavc1394
     libiec61883
     libgudev
-  ] ++ optionals (stdenv.isLinux && enableJack) [
-    jack2
+  ] ++ optionals enableJack [
+    libjack2
   ];
 
   mesonFlags = [
@@ -113,8 +111,8 @@ stdenv.mkDerivation rec {
     "-Dqt5=disabled" # not clear as of writing how to correctly pass in the required qt5 deps
   ] ++ optionals (!gtkSupport) [
     "-Dgtk3=disabled"
-  ] ++ optionals (!stdenv.isLinux || !enableJack) [
-    "-Djack=disabled" # unclear whether Jack works on Darwin
+  ] ++ optionals (!enableJack) [
+    "-Djack=disabled"
   ] ++ optionals (!stdenv.isLinux) [
     "-Ddv1394=disabled" # Linux only
     "-Doss4=disabled" # Linux only
diff --git a/pkgs/development/libraries/liblinphone/default.nix b/pkgs/development/libraries/liblinphone/default.nix
index c6628e9043cd..a0ee8fe00539 100644
--- a/pkgs/development/libraries/liblinphone/default.nix
+++ b/pkgs/development/libraries/liblinphone/default.nix
@@ -140,6 +140,15 @@ stdenv.mkDerivation rec {
     pkgconfig
   ];
 
+  # Some grammar files needed to be copied too from some dependencies. I suppose
+  # if one define a dependency in such a way that its share directory is found,
+  # then this copying would be unnecessary. Instead of actually copying these
+  # files, create a symlink.
+  postInstall = ''
+    mkdir -p $out/share/belr/grammars
+    ln -s ${belcard}/share/belr/grammars/* $out/share/belr/grammars/
+  '';
+
   meta = with stdenv.lib; {
     homepage = "https://www.linphone.org/technical-corner/liblinphone";
     description = "Library for SIP calls and instant messaging";
diff --git a/pkgs/development/libraries/metal/default.nix b/pkgs/development/libraries/metal/default.nix
new file mode 100644
index 000000000000..7e047c28d0a6
--- /dev/null
+++ b/pkgs/development/libraries/metal/default.nix
@@ -0,0 +1,25 @@
+{ stdenv, fetchFromGitHub, cmake }:
+stdenv.mkDerivation rec {
+  pname = "metal";
+  version = "2.1.1";
+
+  src = fetchFromGitHub {
+    owner = "brunocodutra";
+    repo = "metal";
+    rev = "v${version}";
+    sha256 = "07n1aqyaixbd66l24km5ip3pkmidkx9m3saygf7cfp6vvbgmi42l";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    description = "Single-header C++11 library designed to make you love template metaprogramming";
+    homepage = "https://github.com/brunocodutra/metal";
+    license = licenses.mit;
+    maintainers = with maintainers; [ pmiddend ];
+    platforms = platforms.linux;
+  };
+
+}
diff --git a/pkgs/development/libraries/physics/herwig/default.nix b/pkgs/development/libraries/physics/herwig/default.nix
index 2ea259c2b713..c1a803fd314b 100644
--- a/pkgs/development/libraries/physics/herwig/default.nix
+++ b/pkgs/development/libraries/physics/herwig/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "herwig";
-  version = "7.2.0";
+  version = "7.2.1";
 
   src = fetchurl {
     url = "https://www.hepforge.org/archive/herwig/Herwig-${version}.tar.bz2";
-    sha256 = "0r5iyai2j99pk9p36g4rp98bxm55zd1ik9kgm2zf5zgpvxfm8csr";
+    sha256 = "11m6xvardnk0i8x8b3dpwg4c4ncq0xmlfg2n5r5qmh6544pz7zyl";
   };
 
   nativeBuildInputs = [ autoconf automake libtool ];
diff --git a/pkgs/development/libraries/physics/thepeg/default.nix b/pkgs/development/libraries/physics/thepeg/default.nix
index 10a01d003496..876aeec0fab7 100644
--- a/pkgs/development/libraries/physics/thepeg/default.nix
+++ b/pkgs/development/libraries/physics/thepeg/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "thepeg";
-  version = "2.2.0";
+  version = "2.2.1";
 
   src = fetchurl {
     url = "https://www.hepforge.org/archive/thepeg/ThePEG-${version}.tar.bz2";
-    sha256 = "1y7vwsc4zk629np4rpjh7a8qzvyqc2fixnwq98dgdndp2544gqfk";
+    sha256 = "13x5gssv22mpa2w6i0vaalwcr57170vh3b4xrw8mrm3abqhwgav3";
   };
 
   buildInputs = [ boost fastjet gsl hepmc2 lhapdf rivet zlib ];
diff --git a/pkgs/development/python-modules/arviz/default.nix b/pkgs/development/python-modules/arviz/default.nix
index 2bc3ed760934..e30bd77f4ad0 100644
--- a/pkgs/development/python-modules/arviz/default.nix
+++ b/pkgs/development/python-modules/arviz/default.nix
@@ -22,13 +22,13 @@
 
 buildPythonPackage rec {
   pname = "arviz";
-  version = "0.6.1";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "arviz-devs";
     repo = "arviz";
     rev = version;
-    sha256 = "1qc4piz18hfik32gj4v65ckwv516mppq2ac0jyqs21lhqfwbgv9w";
+    sha256 = "03hj7bkkj6kfqdk6ri2mp53wk4k7xpafxk01vgs6k9zg3rlnq7ny";
   };
 
   propagatedBuildInputs = [
@@ -69,8 +69,18 @@ buildPythonPackage rec {
   # data_numpyro, data_pyro, data_pystan, and plots.
   checkPhase = ''
     cd arviz/tests/
-    HOME=$TMPDIR pytest test_{data_cmdstan,data_emcee,data,data_tfp,\
-    diagnostics,plot_utils,rcparams,stats,stats_utils,utils}.py
+    export HOME=$TMPDIR
+    pytest \
+      base_tests/test_data.py \
+      base_tests/test_diagnostics.py \
+      base_tests/test_plot_utils.py \
+      base_tests/test_rcparams.py \
+      base_tests/test_stats.py \
+      base_tests/test_stats_utils.py \
+      base_tests/test_utils.py \
+      external_tests/test_data_cmdstan.py \
+      external_tests/test_data_emcee.py \
+      external_tests/test_data_tfp.py
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/awkward1/default.nix b/pkgs/development/python-modules/awkward1/default.nix
index a35a97c5e024..ce0d5e747c03 100644
--- a/pkgs/development/python-modules/awkward1/default.nix
+++ b/pkgs/development/python-modules/awkward1/default.nix
@@ -4,17 +4,17 @@
 , cmake
 , numba
 , numpy
-, pytest
+, pytestCheckHook
 , rapidjson
 }:
 
 buildPythonPackage rec {
   pname = "awkward1";
-  version = "0.1.38";
+  version = "0.2.12";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1c87defa8c1661ffe36f8a785fa9a60ae3b70484984a935e710cd8cb1f763fd7";
+    sha256 = "a87d89c218151d840c032be4cba6801801683ea00e91dc17fd7bc527ad8eb09b";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -23,13 +23,11 @@ buildPythonPackage rec {
 
   dontUseCmakeConfigure = true;
 
-  checkInputs = [ pytest numba ];
-  checkPhase = ''
-    py.test
-  '';
+  checkInputs = [ pytestCheckHook numba ];
+  dontUseSetuptoolsCheck = true;
 
   meta = with lib; {
-    description = "Development of awkward 1.0, to replace scikit-hep/awkward-array in 2020";
+    description = "Manipulate JSON-like data with NumPy-like idioms";
     homepage = "https://github.com/scikit-hep/awkward-1.0";
     license = licenses.bsd3;
     maintainers = with maintainers; [ veprbl ];
diff --git a/pkgs/development/python-modules/gst-python/default.nix b/pkgs/development/python-modules/gst-python/default.nix
index 405dd7374fcc..11080d3fbc84 100644
--- a/pkgs/development/python-modules/gst-python/default.nix
+++ b/pkgs/development/python-modules/gst-python/default.nix
@@ -9,6 +9,7 @@
 , gobject-introspection
 , gst-plugins-base
 , isPy3k
+, fetchpatch
 }:
 
 buildPythonPackage rec {
@@ -38,6 +39,14 @@ buildPythonPackage rec {
     pygobject3
   ];
 
+  patches = stdenv.lib.optionals stdenv.isDarwin [
+    # Fix configure python lib detection in macOS. Remove with the next release
+    (fetchpatch {
+      url = "https://github.com/GStreamer/gst-python/commit/f98c206bdf01529f8ea395a719b10baf2bdf717f.patch";
+      sha256 = "04n4zrnfivgr7iaqw4sjlbd882s8halc2bbbhfxqf0sg2lqwmrxg";
+    })
+  ];
+
   mesonFlags = [
     "-Dpython=python${if isPy3k then "3" else "2"}"
     "-Dpygi-overrides-dir=${placeholder "out"}/${python.sitePackages}/gi/overrides"
diff --git a/pkgs/development/python-modules/nose2/default.nix b/pkgs/development/python-modules/nose2/default.nix
index 9ba65a222599..300ed80ca408 100644
--- a/pkgs/development/python-modules/nose2/default.nix
+++ b/pkgs/development/python-modules/nose2/default.nix
@@ -3,21 +3,22 @@
 , fetchPypi
 , six
 , pythonOlder
-, mock
 , coverage
 }:
 
 buildPythonPackage rec {
   pname = "nose2";
-  version = "0.9.1";
+  version = "0.9.2";
+
+  # Requires mock 2.0.0 if python < 3.6, but NixPkgs has mock 3.0.5.
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "16drs4bc2wvgwwi1pf6pmk6c00pl16vs1v7djc4a8kwpsxpibphf";
+    sha256 = "0pmbb6nk31yhgh4zkcblzxsznml7f7pf5q1ihgrwvbxv4mwzfql7";
   };
 
-  propagatedBuildInputs = [ six coverage ]
-    ++ stdenv.lib.optionals (pythonOlder "3.4") [ mock ];
+  propagatedBuildInputs = [ six coverage ];
 
   # AttributeError: 'module' object has no attribute 'collector'
   doCheck = false;
diff --git a/pkgs/development/python-modules/pyhomematic/default.nix b/pkgs/development/python-modules/pyhomematic/default.nix
index 1b0708806266..7d8fa826b0e7 100644
--- a/pkgs/development/python-modules/pyhomematic/default.nix
+++ b/pkgs/development/python-modules/pyhomematic/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "pyhomematic";
-  version = "0.1.62";
+  version = "0.1.65";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3547ad176f287a9d3b4409692485b6fb456107d70350a32071423e13803cfdab";
+    sha256 = "0a562dqxs2j9q0xyywrh43dlbpdqr3mhvrrk8abdpmgj6gl33zac";
   };
 
   # PyPI tarball does not include tests/ directory
diff --git a/pkgs/development/python-modules/pymc3/default.nix b/pkgs/development/python-modules/pymc3/default.nix
index 922a8bb59c5a..0c99b501c3f2 100644
--- a/pkgs/development/python-modules/pymc3/default.nix
+++ b/pkgs/development/python-modules/pymc3/default.nix
@@ -9,6 +9,8 @@
 , tqdm
 , six
 , h5py
+, arviz
+, packaging
 , pytest
 , nose
 , parameterized
@@ -37,6 +39,8 @@ buildPythonPackage rec {
     tqdm
     six
     h5py
+    arviz
+    packaging
   ];
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/smart_open/default.nix b/pkgs/development/python-modules/smart_open/default.nix
index 48cfcb132f09..6244ea62333e 100644
--- a/pkgs/development/python-modules/smart_open/default.nix
+++ b/pkgs/development/python-modules/smart_open/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "smart_open";
-  version = "1.9.0";
+  version = "1.11.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0xmnp8ywakwg3y21gqdvjw8a4v42vaxfq6njqizzllm4c9g2nk76";
+    sha256 = "1692h0j6jbxmm0acy1lbbbf4j34l0idi1vpzk6b5ixm0akzcfgl1";
   };
 
   # nixpkgs version of moto is >=1.2.0, remove version pin to fix build
diff --git a/pkgs/development/python-modules/snapcast/default.nix b/pkgs/development/python-modules/snapcast/default.nix
index ccdaa64b098d..6e319a183418 100644
--- a/pkgs/development/python-modules/snapcast/default.nix
+++ b/pkgs/development/python-modules/snapcast/default.nix
@@ -3,13 +3,13 @@
 
 buildPythonPackage rec {
   pname = "snapcast";
-  version = "2.0.10";
+  version = "2.1.0";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2a862a57ca65aa11cf010a19cdfee37e5728d486ee92684b00233442613b5120";
+    sha256 = "1z3c9p22pm3823jzh917c3rryv02mhigrjkjf9wlhzmjwx5vmjqf";
   };
 
   checkInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/tensorflow-probability/default.nix b/pkgs/development/python-modules/tensorflow-probability/default.nix
index d5dda5d6b5fb..3a5ee229b432 100644
--- a/pkgs/development/python-modules/tensorflow-probability/default.nix
+++ b/pkgs/development/python-modules/tensorflow-probability/default.nix
@@ -1,15 +1,18 @@
 { lib
 , fetchFromGitHub
+, fetchpatch
 , buildBazelPackage
 , buildPythonPackage
 , python
 , setuptools
 , wheel
+, absl-py
 , tensorflow
 , six
 , numpy
 , decorator
 , cloudpickle
+, gast
 , hypothesis
 , scipy
 , matplotlib
@@ -18,7 +21,7 @@
 }:
 
 let
-  version = "0.7";
+  version = "0.8.0";
   pname = "tensorflow_probability";
 
   # first build all binaries and generate setup.py using bazel
@@ -28,21 +31,37 @@ let
     src = fetchFromGitHub {
       owner = "tensorflow";
       repo = "probability";
-      rev = "v${version}";
-      sha256 = "0sy9gmjcvmwciamqvd7kd9qw2wd7ksklk80815fsn7sj0wiqxjyd";
+      rev = "${version}";
+      sha256 = "07cm8zba8n0ihzdm3k4a4rsg5v62xxsfvcw4h0niz91c0parqjqy";
     };
 
+    patches = [
+      (fetchpatch {
+        name = "gast-0.3.patch";
+        url = "https://github.com/tensorflow/probability/commit/ae7a9d9771771ec1e7755a3588b9325f050a84cc.patch";
+        sha256 = "0kfhx30gshm8f3945na9yjjik71r20qmjzifbigaj4l8dwd9dz1a";
+        excludes = ["testing/*"];
+      })
+      (fetchpatch {
+        name = "cloudpickle-1.2.patch";
+        url = "https://github.com/tensorflow/probability/commit/78ef12b5afe3f567d16c70b74015ed1ddff1b0c8.patch";
+        sha256 = "12ms2xcljvvrnig0j78s3wfv4yf3bm5ps4rgfgv5lg2a8mzpc1ga";
+      })
+    ];
+
     nativeBuildInputs = [
       # needed to create the output wheel in installPhase
       python
       setuptools
       wheel
+      absl-py
+      tensorflow
     ];
 
     bazelTarget = ":pip_pkg";
 
     fetchAttrs = {
-      sha256 = "0sjjj9z1dhilhpc8pq4154czrb79z9cm044jvn75kxcjv6v5l2m5";
+      sha256 = "0135nxxvkmjzpd80r1g9fdkk9h62g0xlvp32g5zgk0hkma5kq0bx";
     };
 
     buildAttrs = {
@@ -75,6 +94,7 @@ in buildPythonPackage {
     numpy
     decorator
     cloudpickle
+    gast
   ];
 
   # Listed here:
diff --git a/pkgs/development/tools/build-managers/bazel/buildtools/default.nix b/pkgs/development/tools/build-managers/bazel/buildtools/default.nix
index 8257f4eade9b..004d0f732ffa 100644
--- a/pkgs/development/tools/build-managers/bazel/buildtools/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/buildtools/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "bazel-buildtools";
-  version = "1.0.0";
+  version = "2.2.1";
 
   goPackagePath = "github.com/bazelbuild/buildtools";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     owner = "bazelbuild";
     repo = "buildtools";
     rev = version;
-    sha256 = "1rgz1bpg2db6z4q04z061h5b9qjk8padi71xyjcwqfchwqpl7hiv";
+    sha256 = "165jvn7r7bxivb8mpvp6dni5a5ns9a3vm6y5clyxdbjhfkll8wra";
   };
 
   goDeps = ./deps.nix;
diff --git a/pkgs/development/tools/build-managers/bazel/buildtools/deps.nix b/pkgs/development/tools/build-managers/bazel/buildtools/deps.nix
index 38be0dedc371..a64f96d2c072 100644
--- a/pkgs/development/tools/build-managers/bazel/buildtools/deps.nix
+++ b/pkgs/development/tools/build-managers/bazel/buildtools/deps.nix
@@ -4,8 +4,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/golang/protobuf";
-      rev = "d23c5127dc24889085f8ccea5c9d560a57a879d8";
-      sha256 = "1cyyr52yhj3fzrily3rmsbqyj8va4ld75lmry0857m39rgpv8sy1";
+      rev = "84668698ea25b64748563aa20726db66a6b8d299";
+      sha256 = "1gkd1942vk9n8kfzdwy1iil6wgvlwjq7a3y5jc49ck4lz9rhmgkq";
     };
   }
   {
diff --git a/pkgs/development/tools/hcloud/default.nix b/pkgs/development/tools/hcloud/default.nix
index 477a476dfe78..bdaf04054e9c 100644
--- a/pkgs/development/tools/hcloud/default.nix
+++ b/pkgs/development/tools/hcloud/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "hcloud";
-  version = "1.16.1";
+  version = "1.16.2";
 
   goPackagePath = "github.com/hetznercloud/cli";
 
@@ -10,10 +10,10 @@ buildGoModule rec {
     owner = "hetznercloud";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "1d6qa21sq79hr84nnn3j7w0776mnq58g8g1krpnh4d6bv3kc3lq7";
+    sha256 = "0cxh92df8gdl4bmr22pdvdxdkdjyfy0jv48y0k6awy1xz61r94ap";
   };
 
-  modSha256 = "1zy41hi2qzrdmih3pkpng8im576lhkr64zm66w73p7jyvy0kf9sx";
+  modSha256 = "1sdp62q4rnx7dp4i0dhnc8kzi8h6zzjdy7ym0mk9r7xkxxx0s3ds";
 
   buildFlagsArray = [ "-ldflags=" "-w -X github.com/hetznercloud/cli/cli.Version=${version}" ];
 
diff --git a/pkgs/development/tools/misc/strace/default.nix b/pkgs/development/tools/misc/strace/default.nix
index 80852274102e..e547fef46c4c 100644
--- a/pkgs/development/tools/misc/strace/default.nix
+++ b/pkgs/development/tools/misc/strace/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "strace";
-  version = "5.5";
+  version = "5.6";
 
   src = fetchurl {
     url = "https://strace.io/files/${version}/${pname}-${version}.tar.xz";
-    sha256 = "1zrhpzjlgfwfl8dd53llswmmharm5rbi0zch7lln5sjris69an4z";
+    sha256 = "008v3xacgv8hw2gpqibacxs47j23161mmibf2qh9xv86mvp6i68q";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
diff --git a/pkgs/development/tools/shellcheck/default.nix b/pkgs/development/tools/shellcheck/default.nix
index ca3e801e3ed1..568b9e1e1ddd 100644
--- a/pkgs/development/tools/shellcheck/default.nix
+++ b/pkgs/development/tools/shellcheck/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, haskellPackages, haskell }:
+{ stdenv, lib, haskellPackages, haskell, pandoc }:
 
 # this wraps around the haskell package
 # and puts the documentation into place
@@ -16,17 +16,22 @@ let
     in drv' // { meta = meta' // overrideFn meta'; };
 
   bin = haskell.lib.justStaticExecutables haskellPackages.ShellCheck;
-  src = haskellPackages.ShellCheck.src;
 
   shellcheck = stdenv.mkDerivation {
     pname = "shellcheck";
     version = bin.version;
 
-    inherit src;
+    inherit (haskellPackages.ShellCheck) meta src;
+
+    nativeBuildInputs = [ pandoc ];
 
     outputs = [ "bin" "man" "doc" "out" ];
 
-    phases = [ "unpackPhase" "installPhase" "fixupPhase" ];
+    phases = [ "unpackPhase" "buildPhase" "installPhase" "fixupPhase" ];
+
+    buildPhase = ''
+      pandoc -s -f markdown-smart -t man shellcheck.1.md -o shellcheck.1
+    '';
 
     installPhase = ''
       install -Dm755 ${bin}/bin/shellcheck $bin/bin/shellcheck
@@ -34,10 +39,6 @@ let
       install -Dm644 shellcheck.1 $man/share/man/man1/shellcheck.1
       mkdir $out
     '';
-
-    # just some file copying
-    preferLocalBuild = true;
-    allowSubstitutes = false;
   };
 
 in
diff --git a/pkgs/games/pingus/default.nix b/pkgs/games/pingus/default.nix
index e96e1a6a6e06..6ffc38f6700f 100644
--- a/pkgs/games/pingus/default.nix
+++ b/pkgs/games/pingus/default.nix
@@ -4,8 +4,8 @@ stdenv.mkDerivation rec {
   pname = "pingus";
   version = "unstable-0.7.6.0.20191104";
 
-  nativeBuildInputs = [ pkgconfig git ];
-  buildInputs = [ cmake SDL2 SDL2_image boost libpng SDL2_mixer libGLU libGL jsoncpp ];
+  nativeBuildInputs = [ cmake pkgconfig git ];
+  buildInputs = [ SDL2 SDL2_image boost libpng SDL2_mixer libGLU libGL jsoncpp ];
   src = fetchgit {
     url = "https://gitlab.com/pingus/pingus/";
     rev = "709546d9b9c4d6d5f45fc9112b45ac10c7f9417d";
diff --git a/pkgs/games/simutrans/default.nix b/pkgs/games/simutrans/default.nix
index 7b79eefff826..b75b67e0528e 100644
--- a/pkgs/games/simutrans/default.nix
+++ b/pkgs/games/simutrans/default.nix
@@ -12,14 +12,14 @@ let
   );
 
   ver1 = "120";
-  ver2 = "2";
-  ver3 = "2";
+  ver2 = "4";
+  ver3 = "1";
   version =   "${ver1}.${ver2}.${ver3}";
   ver_dash =  "${ver1}-${ver2}-${ver3}";
 
   binary_src = fetchurl {
     url = "mirror://sourceforge/simutrans/simutrans/${ver_dash}/simutrans-src-${ver_dash}.zip";
-    sha256 = "1yi6rwbrnfd65qfz63cncw2n56pbypvg6cllwh71mgvs6x2c28kz";
+    sha256 = "0yw7vjvmczp022mgk35swwhpbiszpz91mwsgicxglwivgc30vvic";
   };
 
 
@@ -28,8 +28,8 @@ let
     (pakName: attrs: mkPak (attrs // {inherit pakName;}))
   {
     pak64 = {
-      srcPath = "120-2/simupak64-120-2";
-      sha256 = "1s310pssar4s1nf6gi9cizbx4m75avqm2qk039ha5rk8jk4lzkmk";
+      srcPath = "121-0/simupak64-121-0";
+      sha256 = "1k335kh8dhm1hdn5iwn3sdgnrlpk0rqxmmgqgqcwsi09cmw45m5c";
     };
     "pak64.japan" = {
       # No release for 120.2 yet!
@@ -38,12 +38,12 @@ let
     };
 
     pak128 = {
-      srcPath = "pak128%20for%20ST%20120.2.2%20%282.7%2C%20minor%20changes%29/pak128";
-      sha256 = "1x6g6yfv1hvjyh3ciccly1i2k2n2b63dw694gdg4j90a543rmclg";
+      srcPath = "pak128%20for%20ST%20120.4.1%20%282.8.1%2C%20priority%20signals%20%2B%20bugfix%29/pak128";
+      sha256 = "0z01y7r0rz7q79vr17bbnkgcbjjrimphy1dwb1pgbiv4klz7j5xw";
     };
     "pak128.britain" = {
-      srcPath = "pak128.Britain%20for%20120-1/pak128.Britain.1.17-120-1";
-      sha256 = "1nviwqizvch9n3n826nmmi7c707dxv0727m7lhc1n2zsrrxcxlr5";
+      srcPath = "pak128.Britain%20for%20120-1/pak128.Britain.1.18-120-3";
+      sha256 = "1kyb0s54kysvdr0zdln9106yx75d71j4lbw3v87k3i440cj3r1d3";
     };
     "pak128.cs" = { # note: it needs pak128 to work
       url = "mirror://sourceforge/simutrans/Pak128.CS/pak128.cz_v.0.2.1.zip";
@@ -51,8 +51,8 @@ let
     };
     "pak128.german" = {
       url = "mirror://sourceforge/simutrans/PAK128.german/"
-        + "PAK128.german_0.10.x_for_ST_120.x/PAK128.german_0.10.3_for_ST_120.x.zip";
-      sha256 = "1379zcviyf3v0wsli33sqa509k6zlw6fkk57vahc44mrnhka5fpb";
+        + "pak128.german_1.2_for_ST_121.0/PAK128.german_1.2_for_ST_121-0.zip";
+      sha256 = "1jxjckz4b02yv1mv1zc3pmajpq740dfnlvhr0x762lbrybymvagi";
     };
 
     /* This release contains accented filenames that prevent unzipping.
@@ -83,6 +83,7 @@ let
         toStrip=`find . -iname '*.pak' | head -n 1 | sed 's|\./\(.*\)/[^/]*$|\1|'`
         echo "Detected path '$toStrip' to strip"
         mv ./"$toStrip"/* .
+        rm -f "$toStrip/.directory" #pak128.german had this
         rmdir -p "$toStrip"
       '';
     };
@@ -114,7 +115,7 @@ let
 
     sourceRoot = ".";
 
-  nativeBuildInputs = [ pkgconfig ];
+    nativeBuildInputs = [ pkgconfig ];
     buildInputs = [ zlib libpng bzip2 SDL SDL_mixer unzip ];
 
     configurePhase = let
@@ -164,7 +165,6 @@ let
       license = with licenses; [ artistic1 gpl1Plus ];
       maintainers = with maintainers; [ kkallio vcunat phile314 ];
       platforms = with platforms; linux; # TODO: ++ darwin;
-      broken = true;
     };
   };
 
diff --git a/pkgs/games/spring/default.nix b/pkgs/games/spring/default.nix
index 6e3d42e2891b..1d61d87f2bdc 100644
--- a/pkgs/games/spring/default.nix
+++ b/pkgs/games/spring/default.nix
@@ -8,17 +8,17 @@
 stdenv.mkDerivation rec {
   pname = "spring";
   version = "104.0.1-${buildId}-g${shortRev}";
-  # usually the latest in https://github.com/spring/spring/commits/maintenance 
-  rev = "8ecf38a784ed3c4e3d67bc8d59839a77e0f0b83e";
+  # usually the latest in https://github.com/spring/spring/commits/maintenance
+  rev = "c4e1654d5d2758fb8bf8f5c9769dd4be2a3eb866";
   shortRev = builtins.substring 0 7 rev;
-  buildId = "1477";
+  buildId = "1482";
 
   # taken from https://github.com/spring/spring/commits/maintenance
   src = fetchFromGitHub {
     owner = "spring";
     repo = "spring";
     inherit rev;
-    sha256 = "0iai1wnd7msabgw2979cp2k54sgcfvidfmymhnck31jwbfa6y021";
+    sha256 = "1rnpn8i4m5spkf3jjndz17ldh4h09q7bh6zaxzmpgxilh8gjdj92";
     fetchSubmodules = true;
   };
 
@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
     homepage = "https://springrts.com/";
     description = "A powerful real-time strategy (RTS) game engine";
     license = licenses.gpl2;
-    maintainers = [ maintainers.phreedom maintainers.qknight maintainers.domenkozar ];
+    maintainers = [ maintainers.phreedom maintainers.qknight maintainers.domenkozar maintainers.sorki ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/rtkit/default.nix b/pkgs/os-specific/linux/rtkit/default.nix
index 1b1e99e752ba..b3f73e6c3bba 100644
--- a/pkgs/os-specific/linux/rtkit/default.nix
+++ b/pkgs/os-specific/linux/rtkit/default.nix
@@ -1,43 +1,46 @@
-{ stdenv, fetchurl, fetchpatch, pkgconfig, dbus, libcap }:
+{ stdenv, fetchFromGitHub, fetchpatch
+, meson, ninja, pkgconfig, unixtools
+, dbus, libcap, polkit, systemd
+}:
 
 stdenv.mkDerivation rec {
-  name = "rtkit-0.11";
-
-  src = fetchurl {
-    url = "http://0pointer.de/public/${name}.tar.xz";
-    sha256 = "1l5cb1gp6wgpc9vq6sx021qs6zb0nxg3cn1ba00hjhgnrw4931b8";
+  pname = "rtkit";
+  version = "0.13";
+
+  src = fetchFromGitHub {
+    owner = "heftig";
+    repo = "rtkit";
+    rev = "c295fa849f52b487be6433e69e08b46251950399";
+    sha256 = "0yfsgi3pvg6dkizrww1jxpkvcbhzyw9110n1dypmzq0c5hlzjxcd";
   };
 
-  configureFlags = [
-    "--with-systemdsystemunitdir=$(out)/etc/systemd/system"
-  ];
-
   patches = [
-    # Drop removed ControlGroup stanza
     (fetchpatch {
-      url = "http://git.0pointer.net/rtkit.git/patch/?id=6c28e20c0be2f616a025059fda0ffac84e7f4f17";
-      sha256 = "0lsxk5nv08i1wjb4xh20i5fcwg3x0qq0k4f8bc0r9cczph2sv7ck";
+      url = "https://github.com/heftig/rtkit/commit/7d62095b94f8df3891c984a1535026d2658bb177.patch";
+      sha256 = "17acv549zqcgh7sgprfagbf6drqsr0zdwvf1dsqda7wlqc2h9zn7";
     })
 
-    # security patch: Pass uid of caller to polkit
     (fetchpatch {
-      url = "http://git.0pointer.net/rtkit.git/patch/?id=88d4082ef6caf6b071d749dca1c50e7edde914cc";
-      sha256 = "0hp1blbi359qz8fmr6nj4w9yc0jf3dd176f8pn25wdj38n13qkix";
-    })
-
-    # Fix format string errors due to -Werror=format-security
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/r/rtkit/0.11-6/debian/patches/0006-fix-format-strings.patch";
-      sha256 = "09mr89lh16jvz6cqw00zmh0xk919bjfhjkvna1czwmafwy9p7kgp";
+      url = "https://github.com/heftig/rtkit/commit/98f70edd8f534c371cb4308b9720739c5178918d.patch";
+      sha256 = "18mnjjsdjfr184nkzi01xyphpdngi31ry4bmkv9ysjxf9wilv4nl";
     })
   ];
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ dbus libcap ];
-  NIX_LDFLAGS = "-lrt";
+  nativeBuildInputs = [ meson ninja pkgconfig unixtools.xxd ];
+  buildInputs = [ dbus libcap polkit systemd ];
+
+  mesonFlags = [
+    "-Dinstalled_tests=false"
+
+    "-Ddbus_systemservicedir=${placeholder "out"}/share/dbus-1/system-services"
+    "-Ddbus_interfacedir=${placeholder "out"}/share/dbus-1/interfaces"
+    "-Ddbus_rulesdir=${placeholder "out"}/etc/dbus-1/system.d"
+    "-Dpolkit_actiondir=${placeholder "out"}/share/polkit-1/actions"
+    "-Dsystemd_systemunitdir=${placeholder "out"}/etc/systemd/system"
+  ];
 
   meta = with stdenv.lib; {
-    homepage = "http://0pointer.de/blog/projects/rtkit";
+    homepage = "https://github.com/heftig/rtkit";
     description = "A daemon that hands out real-time priority to processes";
     license = with licenses; [ gpl3 bsd0 ]; # lib is bsd license
     platforms = platforms.linux;
diff --git a/pkgs/servers/tautulli/default.nix b/pkgs/servers/tautulli/default.nix
index 32102dd48b5a..73b0a57b694a 100644
--- a/pkgs/servers/tautulli/default.nix
+++ b/pkgs/servers/tautulli/default.nix
@@ -1,7 +1,7 @@
 {stdenv, fetchFromGitHub, python }:
 
 stdenv.mkDerivation rec {
-  version = "2.2.0";
+  version = "2.2.1";
   pname = "Tautulli";
 
   pythonPath = [ python.pkgs.setuptools ];
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     owner = "Tautulli";
     repo = pname;
     rev = "v${version}";
-    sha256 = "10ahmgm4pr7lz39qcmgjqzlp435i2dasd6y47zpi1c5fy62jq4is";
+    sha256 = "0vcm9xjywy0c8lb37vdrn9payn80isij09lqkam37j08v5y64ln7";
   };
 
   buildPhase = ":";
diff --git a/pkgs/servers/uftp/default.nix b/pkgs/servers/uftp/default.nix
index d049991036f2..13efb08ec6a8 100644
--- a/pkgs/servers/uftp/default.nix
+++ b/pkgs/servers/uftp/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "uftp";
-  version = "4.10.1";
+  version = "4.10.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/uftp-multicast/source-tar/uftp-${version}.tar.gz";
-    sha256 = "1xi2cvn1lxk1h1kilmjiq8ybxln3rrh6m5cd340zg20vpzz56cwh";
+    sha256 = "01c54mqz37157dfq47zjqvfy7v98vbi9zn9mzrxszsz0gyq6mazc";
   };
 
   buildInputs = [ openssl ];
diff --git a/pkgs/servers/zoneminder/default.nix b/pkgs/servers/zoneminder/default.nix
index 93f22e77f870..978893d28ffd 100644
--- a/pkgs/servers/zoneminder/default.nix
+++ b/pkgs/servers/zoneminder/default.nix
@@ -78,13 +78,13 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "zoneminder";
-  version = "1.34.3";
+  version = "1.34.9";
 
   src = fetchFromGitHub {
     owner  = "ZoneMinder";
     repo   = "zoneminder";
     rev    = version;
-    sha256 = "0jp7950v36gxxzkwdp5i0312s26czhfsl5ixdxfzn21cx31hhlg0";
+    sha256 = "1xvgfsm260a3v0vqgbk7m9jzayhcs4ysyadnnxajyrndjhn802ic";
   };
 
   patches = [
@@ -170,10 +170,6 @@ in stdenv.mkDerivation rec {
     "-DZM_CONFIG_DIR=${placeholder "out"}/etc/zoneminder"
     "-DZM_WEB_USER=${user}"
     "-DZM_WEB_GROUP=${user}"
-
-    # Workaround issue in CMakeLists.txt where ZM_CGIDIR set to ${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_LIBEXECDIR}/zoneminder/cgi-bin
-    # But CMAKE_INSTALL_LIBEXECDIR is already an absolute path from cmake setup-hook
-    "-DZM_CGIDIR=${placeholder "out"}/libexec/zoneminder/cgi-bin"
   ];
 
   passthru = { inherit dirName; };
diff --git a/pkgs/shells/zsh/oh-my-zsh/default.nix b/pkgs/shells/zsh/oh-my-zsh/default.nix
index 95cc597a57a0..f11ef6a6cd9f 100644
--- a/pkgs/shells/zsh/oh-my-zsh/default.nix
+++ b/pkgs/shells/zsh/oh-my-zsh/default.nix
@@ -4,13 +4,13 @@
 { stdenv, fetchgit }:
 
 stdenv.mkDerivation rec {
-  version = "2020-03-12";
+  version = "2020-04-10";
   pname = "oh-my-zsh";
-  rev = "07e3236bc5c8dbf9d818a4f0145f09bdb4bec6f0";
+  rev = "d53355ab38763c6f637008d019c8e8b98f19b714";
 
   src = fetchgit { inherit rev;
     url = "https://github.com/ohmyzsh/ohmyzsh";
-    sha256 = "1imjvig60r250ljbnajxq4zv4fgs3l3jrrda0dvlnax5v5psxb12";
+    sha256 = "1rf086f26plqsyx4h19acqacwyr99amavhn1lk0g13kk58kcq9v6";
   };
 
   pathsToLink = [ "/share/oh-my-zsh" ];
diff --git a/pkgs/tools/audio/pulsemixer/default.nix b/pkgs/tools/audio/pulsemixer/default.nix
index 3cca6f68ffec..b735c40031f6 100644
--- a/pkgs/tools/audio/pulsemixer/default.nix
+++ b/pkgs/tools/audio/pulsemixer/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pulsemixer";
-  version = "1.5.0";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "GeorgeFilipkin";
     repo = pname;
     rev = version;
-    sha256 = "162nfpyqn4gp45x332a73n07c118vispz3jicin4p67x3f8f0g3j";
+    sha256 = "1jagx9zmz5pfsld8y2rj2kqg6ww9f6vqiawfy3vhqc49x3xx92p4";
   };
 
   inherit libpulseaudio;
diff --git a/pkgs/tools/filesystems/catcli/default.nix b/pkgs/tools/filesystems/catcli/default.nix
new file mode 100644
index 000000000000..4ac6c1d5b21e
--- /dev/null
+++ b/pkgs/tools/filesystems/catcli/default.nix
@@ -0,0 +1,30 @@
+{ stdenv
+, fetchFromGitHub
+, buildPythonApplication
+, docopt, anytree
+}:
+
+buildPythonApplication rec {
+
+  pname = "catcli";
+  version = "0.5.13";
+
+  src = fetchFromGitHub {
+    owner = "deadc0de6";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "04mrkqmm2c8fhi1h1hddc4yh3dqhcvkmcwzhj0ggn34v7wavgb5i";
+  };
+
+  propagatedBuildInputs = [ docopt anytree ];
+
+  postPatch = '' patchShebangs . '';
+
+  meta = with stdenv.lib; {
+    description = "The command line catalog tool for your offline data";
+    homepage = "https://github.com/deadc0de6/catcli";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ petersjt014 ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/tools/misc/starship/default.nix b/pkgs/tools/misc/starship/default.nix
index 01aec4aabb76..f3ee857810ab 100644
--- a/pkgs/tools/misc/starship/default.nix
+++ b/pkgs/tools/misc/starship/default.nix
@@ -3,13 +3,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "starship";
-  version = "0.39.0";
+  version = "0.40.0";
 
   src = fetchFromGitHub {
     owner = "starship";
     repo = pname;
     rev = "v${version}";
-    sha256 = "13phic9898wjc4b000nkwhy24yczn3dyhw8pqcaqhyzxdaj3gwmw";
+    sha256 = "11x5j91dank0zgxy1y5abhfymyzf3fpfvw6g1ll23vwxmspm8f4w";
   };
 
   nativeBuildInputs = stdenv.lib.optionals stdenv.isLinux [ pkg-config ];
@@ -22,7 +22,7 @@ rustPlatform.buildRustPackage rec {
       --replace "/bin/echo" "echo"
   '';
 
-  cargoSha256 = "0ds19sjy0fd7psmqkw64scjf3ysi408i7c1qk9zvqkl4ghz8wymg";
+  cargoSha256 = "0z0k9nq6fjg30380yc1skdzw0mhfljhkpagm8mh5w9bz1bzyd45d";
   checkPhase = "cargo test -- --skip directory::home_directory --skip directory::directory_in_root";
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/text/amber/default.nix b/pkgs/tools/text/amber/default.nix
index e59b8eaa9cde..4afab278370c 100644
--- a/pkgs/tools/text/amber/default.nix
+++ b/pkgs/tools/text/amber/default.nix
@@ -4,16 +4,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "amber";
-  version = "0.5.3";
+  version = "0.5.4";
 
   src = fetchFromGitHub {
     owner = "dalance";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0k70rk19hwdlhhqm91x12xcb8r09kzpijs0xwhplrwdh86qfxymx";
+    sha256 = "0pqz3spb5lmrj7w8hynmah9nrcfjsb1s0bmrr0cng9a9jx8amwzn";
   };
 
-  cargoSha256 = "0g8n3r6bdsfl1417wnss3ggnv5ywz8mx53hjglshmln40552znh3";
+  cargoSha256 = "1ps70swh96xbfn4hng5krlmwvw2bwrl2liqvx9v9vy6pr86643s6";
 
   buildInputs = stdenv.lib.optional stdenv.isDarwin Security;
 
diff --git a/pkgs/tools/typesetting/tikzit/default.nix b/pkgs/tools/typesetting/tikzit/default.nix
index 3cc99bc1a0e9..31baa431bfc9 100644
--- a/pkgs/tools/typesetting/tikzit/default.nix
+++ b/pkgs/tools/typesetting/tikzit/default.nix
@@ -2,13 +2,13 @@
 
 mkDerivation {
   pname = "tikzit";
-  version = "2.1.4";
+  version = "2.1.5";
 
   src = fetchFromGitHub {
     owner = "tikzit";
     repo = "tikzit";
-    rev = "v2.1.4";
-    sha256 = "121pgl2cdkksw48mjg6hzk7324ax6iw6fq7q3v1kdgwm8rwxm1fl";
+    rev = "v2.1.5";
+    sha256 = "1xrx7r8b6nb912k91pkdwaz2gijfq6lzssyqxard0591h2mycbcg";
   };
 
   nativeBuildInputs = [ qmake qttools flex bison ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 7aeaad312802..69c8b64adcfc 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -828,6 +828,8 @@ in
 
   certigo = callPackage ../tools/admin/certigo { };
 
+  catcli = python3Packages.callPackage ../tools/filesystems/catcli { };
+
   chezmoi = callPackage ../tools/misc/chezmoi { };
 
   chipsec = callPackage ../tools/security/chipsec {
@@ -5391,9 +5393,7 @@ in
 
   noip = callPackage ../tools/networking/noip { };
 
- nomad = callPackage ../applications/networking/cluster/nomad {
-    buildGoPackage = buildGo112Package;
-  };
+ nomad = callPackage ../applications/networking/cluster/nomad { };
 
   notable = callPackage ../applications/misc/notable { };
 
@@ -9038,6 +9038,7 @@ in
   scala_2_13 = callPackage ../development/compilers/scala/2.13.nix { jre = jre8; };
   scala = scala_2_13;
 
+  metal = callPackage ../development/libraries/metal { };
   metals = callPackage ../development/tools/metals { };
   scalafix = callPackage ../development/tools/scalafix { };
   scalafmt = callPackage ../development/tools/scalafmt { };
diff --git a/pkgs/top-level/php-packages.nix b/pkgs/top-level/php-packages.nix
index 65b164144129..28af31b73f2b 100644
--- a/pkgs/top-level/php-packages.nix
+++ b/pkgs/top-level/php-packages.nix
@@ -939,7 +939,7 @@ in
       # pdo_firebird (7.4, 7.3, 7.2)
       { name = "pdo_mysql";
         internalDeps = with php.extensions; [ pdo mysqlnd ];
-        configureFlags = [ "--with-pdo-mysql=mysqlnd" ];
+        configureFlags = [ "--with-pdo-mysql=mysqlnd" "PHP_MYSQL_SOCK=/run/mysqld/mysqld.sock" ];
         doCheck = false; }
       # pdo_oci (7.4, 7.3, 7.2)
       { name = "pdo_odbc";