about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--doc/stdenv.xml17
-rw-r--r--lib/default.nix2
-rw-r--r--lib/systems/default.nix5
-rw-r--r--lib/systems/doubles.nix9
-rw-r--r--lib/systems/for-meta.nix38
-rw-r--r--lib/systems/inspect.nix1
-rw-r--r--lib/tests/systems.nix10
-rw-r--r--maintainers/scripts/luarocks-packages.csv85
-rwxr-xr-xmaintainers/scripts/update-luarocks-packages34
-rwxr-xr-xmaintainers/scripts/update.nix25
-rw-r--r--nixos/doc/manual/release-notes/rl-1909.xml12
-rw-r--r--nixos/modules/misc/ids.nix4
-rw-r--r--nixos/modules/module-list.nix2
-rw-r--r--nixos/modules/services/audio/jack.nix275
-rw-r--r--nixos/modules/services/desktops/geoclue2.nix13
-rw-r--r--nixos/modules/services/networking/btsync.nix324
-rw-r--r--nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix50
-rw-r--r--nixos/modules/services/system/localtime.nix8
-rw-r--r--nixos/modules/services/torrent/deluge.nix152
-rw-r--r--nixos/modules/services/x11/compton.nix36
-rw-r--r--nixos/modules/services/x11/redshift.nix8
-rw-r--r--nixos/modules/system/boot/loader/grub/grub.nix1
-rw-r--r--nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py2
-rw-r--r--nixos/tests/deluge.nix49
-rw-r--r--pkgs/applications/altcoins/wasabiwallet/default.nix44
-rw-r--r--pkgs/applications/audio/qjackctl/default.nix4
-rw-r--r--pkgs/applications/audio/reaper/default.nix4
-rw-r--r--pkgs/applications/graphics/drawpile/default.nix4
-rw-r--r--pkgs/applications/misc/calibre/default.nix4
-rw-r--r--pkgs/applications/misc/lutris/default.nix4
-rw-r--r--pkgs/applications/misc/urlscan/default.nix4
-rw-r--r--pkgs/applications/misc/xterm/default.nix4
-rw-r--r--pkgs/applications/networking/bittorrentsync/1.4.x.nix9
-rw-r--r--pkgs/applications/networking/bittorrentsync/2.0.x.nix9
-rw-r--r--pkgs/applications/networking/bittorrentsync/generic.nix41
-rw-r--r--pkgs/applications/networking/browsers/opera/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/tor-browser-bundle/default.nix2
-rw-r--r--pkgs/applications/networking/cluster/kubernetes/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/terraform-providers/elasticsearch/default.nix20
-rw-r--r--pkgs/applications/networking/cluster/terraform-providers/elasticsearch/deps.nix75
-rw-r--r--pkgs/applications/networking/dropbox/default.nix2
-rw-r--r--pkgs/applications/networking/instant-messengers/franz/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix8
-rw-r--r--pkgs/applications/networking/instant-messengers/telegram/tdesktop/generic.nix10
-rw-r--r--pkgs/applications/networking/instant-messengers/zoom-us/default.nix3
-rw-r--r--pkgs/applications/networking/irc/hexchat/default.nix4
-rw-r--r--pkgs/applications/office/spice-up/default.nix4
-rw-r--r--pkgs/applications/office/timetrap/default.nix2
-rw-r--r--pkgs/applications/office/zim/default.nix4
-rw-r--r--pkgs/applications/radio/urh/default.nix12
-rw-r--r--pkgs/applications/science/astronomy/gildas/default.nix6
-rw-r--r--pkgs/applications/science/biology/picard-tools/default.nix4
-rw-r--r--pkgs/applications/science/chemistry/quantum-espresso/default.nix4
-rw-r--r--pkgs/applications/science/electronics/gtkwave/default.nix4
-rw-r--r--pkgs/applications/version-management/git-repo/default.nix4
-rw-r--r--pkgs/applications/version-management/src/default.nix4
-rw-r--r--pkgs/applications/window-managers/sway/default.nix25
-rw-r--r--pkgs/build-support/kernel/make-initrd.nix14
-rwxr-xr-xpkgs/common-updater/scripts/update-source-version22
-rw-r--r--pkgs/data/fonts/inter/default.nix6
-rw-r--r--pkgs/data/fonts/libertinus/default.nix4
-rw-r--r--pkgs/data/fonts/national-park/default.nix24
-rw-r--r--pkgs/data/fonts/public-sans/default.nix4
-rw-r--r--pkgs/desktops/gnome-2/default.nix4
-rw-r--r--pkgs/desktops/gnome-2/platform/gtkhtml/4.x.nix4
-rw-r--r--pkgs/desktops/gnome-3/apps/gnome-maps/default.nix4
-rw-r--r--pkgs/desktops/gnome-3/apps/gnome-nettool/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-control-center/default.nix4
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-software/default.nix4
-rw-r--r--pkgs/desktops/gnome-3/core/rygel/default.nix4
-rw-r--r--pkgs/desktops/gnome-3/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/misc/gitg/default.nix25
-rw-r--r--pkgs/desktops/gnome-3/misc/gtkhtml/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/update.nix4
-rw-r--r--pkgs/development/compilers/julia/shared.nix5
-rw-r--r--pkgs/development/compilers/ocaml/4.08.nix4
-rw-r--r--pkgs/development/compilers/purescript/purescript/default.nix13
-rw-r--r--pkgs/development/compilers/purescript/purescript/test-minimal-module/Main.js8
-rw-r--r--pkgs/development/compilers/purescript/purescript/test-minimal-module/Main.purs9
-rw-r--r--pkgs/development/compilers/purescript/purescript/test-minimal-module/default.nix11
-rw-r--r--pkgs/development/coq-modules/mathcomp/default.nix26
-rw-r--r--pkgs/development/coq-modules/mathcomp/extra.nix68
-rw-r--r--pkgs/development/haskell-modules/configuration-common.nix4
-rw-r--r--pkgs/development/haskell-modules/configuration-hackage2nix.yaml1
-rw-r--r--pkgs/development/interpreters/proglodyte-wasm/default.nix4
-rw-r--r--pkgs/development/interpreters/python/cpython/2.7/default.nix4
-rw-r--r--pkgs/development/libraries/cppzmq/default.nix10
-rw-r--r--pkgs/development/libraries/croaring/default.nix28
-rw-r--r--pkgs/development/libraries/enchant/1.x.nix (renamed from pkgs/development/libraries/enchant/default.nix)0
-rw-r--r--pkgs/development/libraries/gbenchmark/default.nix10
-rw-r--r--pkgs/development/libraries/geoclue/default.nix1
-rw-r--r--pkgs/development/libraries/gtkspell/3.nix6
-rw-r--r--pkgs/development/libraries/libebml/default.nix4
-rw-r--r--pkgs/development/libraries/libxls/default.nix7
-rw-r--r--pkgs/development/libraries/p11-kit/default.nix2
-rw-r--r--pkgs/development/libraries/qpdf/default.nix4
-rw-r--r--pkgs/development/libraries/qt-5/modules/qtwebengine.nix3
-rw-r--r--pkgs/development/libraries/qtwebkit-plugins/default.nix6
-rw-r--r--pkgs/development/libraries/tpm2-tss/default.nix4
-rw-r--r--pkgs/development/libraries/v8/5_x.nix199
-rw-r--r--pkgs/development/libraries/v8/6_x.nix193
-rw-r--r--pkgs/development/libraries/v8/darwin.patch22
-rw-r--r--pkgs/development/libraries/v8/default.nix222
-rw-r--r--pkgs/development/libraries/wlroots/default.nix8
-rw-r--r--pkgs/development/libraries/xgboost/default.nix4
-rw-r--r--pkgs/development/lua-modules/generated-packages.nix285
-rw-r--r--pkgs/development/lua-modules/overrides.nix9
-rw-r--r--pkgs/development/ocaml-modules/alcotest/default.nix10
-rw-r--r--pkgs/development/python-modules/XlsxWriter/default.nix4
-rw-r--r--pkgs/development/python-modules/apprise/default.nix31
-rw-r--r--pkgs/development/python-modules/avro/default.nix4
-rw-r--r--pkgs/development/python-modules/awkward/default.nix4
-rw-r--r--pkgs/development/python-modules/braintree/default.nix4
-rw-r--r--pkgs/development/python-modules/bugwarrior/default.nix4
-rw-r--r--pkgs/development/python-modules/datatable/default.nix40
-rw-r--r--pkgs/development/python-modules/distributed/default.nix4
-rw-r--r--pkgs/development/python-modules/fasteners/default.nix18
-rw-r--r--pkgs/development/python-modules/flask-swagger/default.nix27
-rw-r--r--pkgs/development/python-modules/gsd/default.nix4
-rw-r--r--pkgs/development/python-modules/h11/default.nix4
-rw-r--r--pkgs/development/python-modules/hmmlearn/default.nix12
-rw-r--r--pkgs/development/python-modules/nibabel/default.nix4
-rw-r--r--pkgs/development/python-modules/nuitka/default.nix4
-rw-r--r--pkgs/development/python-modules/numericalunits/default.nix4
-rw-r--r--pkgs/development/python-modules/packet-python/default.nix30
-rw-r--r--pkgs/development/python-modules/pglast/default.nix36
-rw-r--r--pkgs/development/python-modules/pychromecast/default.nix4
-rw-r--r--pkgs/development/python-modules/pyenchant/default.nix5
-rw-r--r--pkgs/development/python-modules/pylint/default.nix4
-rw-r--r--pkgs/development/python-modules/pytest-tornado/default.nix4
-rw-r--r--pkgs/development/python-modules/python-stdnum/default.nix15
-rw-r--r--pkgs/development/python-modules/rpyc/default.nix4
-rw-r--r--pkgs/development/python-modules/stripe/default.nix15
-rw-r--r--pkgs/development/python-modules/twilio/default.nix4
-rw-r--r--pkgs/development/python-modules/typesentry/default.nix33
-rw-r--r--pkgs/development/python-modules/uncertainties/default.nix4
-rw-r--r--pkgs/development/python-modules/xgboost/default.nix8
-rw-r--r--pkgs/development/python-modules/xgboost/lib-path-for-python.patch21
-rw-r--r--pkgs/development/tools/analysis/swarm/default.nix23
-rw-r--r--pkgs/development/tools/build-managers/gn/default.nix2
-rw-r--r--pkgs/development/tools/build-managers/gn/setup-hook.sh14
-rw-r--r--pkgs/development/tools/build-managers/qbs/default.nix5
-rw-r--r--pkgs/development/tools/cargo-web/default.nix21
-rw-r--r--pkgs/development/tools/continuous-integration/gitlab-runner/default.nix8
-rw-r--r--pkgs/development/tools/git-repo-updater/default.nix22
-rw-r--r--pkgs/development/tools/just/default.nix6
-rw-r--r--pkgs/development/tools/ktlint/default.nix4
-rw-r--r--pkgs/development/tools/misc/gede/default.nix4
-rw-r--r--pkgs/development/tools/misc/luarocks/luarocks-nix.nix4
-rw-r--r--pkgs/development/tools/ocaml/merlin/default.nix14
-rw-r--r--pkgs/development/tools/rust/cargo-make/default.nix10
-rw-r--r--pkgs/development/tools/skopeo/default.nix2
-rw-r--r--pkgs/development/tools/xcbuild/wrapper.nix7
-rw-r--r--pkgs/development/web/nodejs/nodejs.nix12
-rw-r--r--pkgs/development/web/nodejs/v12.nix8
-rw-r--r--pkgs/development/web/now-cli/default.nix4
-rw-r--r--pkgs/games/gzdoom/default.nix4
-rw-r--r--pkgs/games/klavaro/default.nix4
-rw-r--r--pkgs/games/onscripter-en/default.nix3
-rw-r--r--pkgs/games/openspades/default.nix14
-rw-r--r--pkgs/games/quake3/ioquake/default.nix8
-rw-r--r--pkgs/games/ultrastardx/default.nix3
-rw-r--r--pkgs/games/unnethack/default.nix9
-rw-r--r--pkgs/misc/drivers/hplip/3.16.11.nix13
-rw-r--r--pkgs/misc/drivers/hplip/3.18.5.nix225
-rw-r--r--pkgs/misc/emulators/citra/default.nix9
-rw-r--r--pkgs/misc/emulators/rpcs3/default.nix52
-rw-r--r--pkgs/os-specific/linux/android-udev-rules/default.nix4
-rw-r--r--pkgs/os-specific/linux/irqbalance/default.nix4
-rw-r--r--pkgs/os-specific/linux/nfs-utils/default.nix10
-rw-r--r--pkgs/os-specific/linux/rdma-core/default.nix4
-rw-r--r--pkgs/os-specific/linux/schedtool/default.nix13
-rw-r--r--pkgs/os-specific/linux/trinity/default.nix13
-rw-r--r--pkgs/servers/amqp/rabbitmq-server/default.nix4
-rw-r--r--pkgs/servers/dns/pdns-recursor/default.nix4
-rw-r--r--pkgs/servers/http/unit/default.nix7
-rw-r--r--pkgs/servers/http/unit/unit-rootless.patch24
-rw-r--r--pkgs/servers/mail/rspamd/default.nix4
-rw-r--r--pkgs/servers/monitoring/loki/default.nix24
-rw-r--r--pkgs/servers/plex/raw.nix4
-rw-r--r--pkgs/servers/sabnzbd/default.nix4
-rw-r--r--pkgs/servers/search/solr/8.x.nix4
-rw-r--r--pkgs/servers/sql/cockroachdb/default.nix6
-rw-r--r--pkgs/servers/sql/mariadb/cmake-plugin-includedir.patch16
-rw-r--r--pkgs/servers/sql/mariadb/default.nix137
-rw-r--r--pkgs/servers/sql/mariadb/include-dirs-path.patch13
-rw-r--r--pkgs/servers/x11/xorg/default.nix6
-rw-r--r--pkgs/servers/x11/xorg/tarballs.list2
-rw-r--r--pkgs/stdenv/generic/check-meta.nix13
-rw-r--r--pkgs/tools/X11/virtualgl/lib.nix8
-rw-r--r--pkgs/tools/audio/pulsemixer/default.nix5
-rw-r--r--pkgs/tools/backup/duplicity/default.nix68
-rw-r--r--pkgs/tools/backup/duplicity/gnutar-in-test.patch18
-rw-r--r--pkgs/tools/backup/duplicity/linux-disable-timezone-test.patch10
-rw-r--r--pkgs/tools/backup/duplicity/use-installed-scripts-in-test.patch13
-rw-r--r--pkgs/tools/bootloaders/refind/0001-toolchain.patch27
-rw-r--r--pkgs/tools/bootloaders/refind/default.nix8
-rw-r--r--pkgs/tools/graphics/nip2/default.nix11
-rw-r--r--pkgs/tools/graphics/vips/default.nix11
-rw-r--r--pkgs/tools/graphics/wallutils/default.nix6
-rw-r--r--pkgs/tools/inputmethods/fcitx/unwrapped.nix4
-rw-r--r--pkgs/tools/misc/grub4dos/default.nix9
-rw-r--r--pkgs/tools/misc/hexyl/default.nix6
-rw-r--r--pkgs/tools/misc/jdupes/default.nix6
-rw-r--r--pkgs/tools/misc/kronometer/default.nix2
-rw-r--r--pkgs/tools/misc/sdl-jstest/default.nix16
-rw-r--r--pkgs/tools/misc/txr/default.nix21
-rw-r--r--pkgs/tools/misc/websocat/default.nix6
-rw-r--r--pkgs/tools/misc/you-get/default.nix4
-rw-r--r--pkgs/tools/networking/brook/default.nix4
-rw-r--r--pkgs/tools/networking/brook/deps.nix78
-rw-r--r--pkgs/tools/networking/network-manager/applet.nix4
-rw-r--r--pkgs/tools/networking/strongswan/default.nix8
-rw-r--r--pkgs/tools/networking/strongswan/modprobe-path.patch56
-rw-r--r--pkgs/tools/networking/uget/default.nix4
-rw-r--r--pkgs/tools/security/hashcat/default.nix10
-rw-r--r--pkgs/tools/security/hashcat/use-installed-xxhash.patch22
-rw-r--r--pkgs/tools/security/keybase/default.nix4
-rw-r--r--pkgs/tools/security/keybase/gui.nix6
-rw-r--r--pkgs/tools/security/paperkey/default.nix4
-rw-r--r--pkgs/tools/system/proot/default.nix6
-rw-r--r--pkgs/tools/system/rsyslog/default.nix4
-rw-r--r--pkgs/tools/text/vale/default.nix4
-rw-r--r--pkgs/tools/virtualization/amazon-ecs-cli/default.nix4
-rw-r--r--pkgs/top-level/aliases.nix3
-rw-r--r--pkgs/top-level/all-packages.nix68
-rw-r--r--pkgs/top-level/coq-packages.nix43
-rw-r--r--pkgs/top-level/default.nix4
-rw-r--r--pkgs/top-level/impure.nix5
-rw-r--r--pkgs/top-level/php-packages.nix20
-rw-r--r--pkgs/top-level/python-packages.nix10
-rw-r--r--pkgs/top-level/static.nix5
-rw-r--r--pkgs/top-level/unix-tools.nix4
234 files changed, 2709 insertions, 1956 deletions
diff --git a/doc/stdenv.xml b/doc/stdenv.xml
index 00d1ec870988..a14d78afe71a 100644
--- a/doc/stdenv.xml
+++ b/doc/stdenv.xml
@@ -709,19 +709,16 @@ passthru.updateScript = writeScript "update-zoom-us" ''
 <programlisting>
 passthru.updateScript = [ ../../update.sh pname "--requested-release=unstable" ];
 </programlisting>
-      Note that the update scripts will be run in parallel by default; you
-      should avoid running <command>git commit</command> or any other commands
-      that cannot handle that.
+     </para>
+     <para>
+      The script will be usually run from the root of the Nixpkgs repository
+      but you should not rely on that. Also note that the update scripts will
+      be run in parallel by default; you should avoid running <command>git
+      commit</command> or any other commands that cannot handle that.
      </para>
      <para>
       For information about how to run the updates, execute
-      <cmdsynopsis>
-       <command>nix-shell</command> 
-       <arg>
-        maintainers/scripts/update.nix
-       </arg>
-      </cmdsynopsis>
-      .
+      <command>nix-shell maintainers/scripts/update.nix</command>.
      </para>
     </listitem>
    </varlistentry>
diff --git a/lib/default.nix b/lib/default.nix
index 8735b6476795..3efaaf0f8f9e 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -50,7 +50,7 @@ let
     filesystem = callLibs ./filesystem.nix;
 
     # back-compat aliases
-    platforms = systems.forMeta;
+    platforms = systems.doubles;
 
     inherit (builtins) add addErrorContext attrNames concatLists
       deepSeq elem elemAt filter genericClosure genList getAttr
diff --git a/lib/systems/default.nix b/lib/systems/default.nix
index 5e6d277be7d5..8aa413f53817 100644
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@@ -3,7 +3,6 @@
 
 rec {
   doubles = import ./doubles.nix { inherit lib; };
-  forMeta = import ./for-meta.nix { inherit lib; };
   parse = import ./parse.nix { inherit lib; };
   inspect = import ./inspect.nix { inherit lib; };
   platforms = import ./platforms.nix { inherit lib; };
@@ -15,7 +14,9 @@ rec {
   # `parsed` is inferred from args, both because there are two options with one
   # clearly prefered, and to prevent cycles. A simpler fixed point where the RHS
   # always just used `final.*` would fail on both counts.
-  elaborate = args: let
+  elaborate = args': let
+    args = if lib.isString args' then { system = args'; }
+           else args';
     final = {
       # Prefer to parse `config` as it is strictly more informative.
       parsed = parse.mkSystemFromString (if args ? config then args.config else args.system);
diff --git a/lib/systems/doubles.nix b/lib/systems/doubles.nix
index c6877ebef0bc..09e9089aa6fd 100644
--- a/lib/systems/doubles.nix
+++ b/lib/systems/doubles.nix
@@ -19,6 +19,12 @@ let
     "x86_64-windows" "i686-windows"
 
     "wasm64-wasi" "wasm32-wasi"
+
+    "powerpc64le-linux"
+
+    "riscv32-linux" "riscv64-linux"
+
+    "aarch64-none" "avr-none" "arm-none" "i686-none" "x86_64-none" "powerpc-none" "msp430-none"
   ];
 
   allParsed = map parse.mkSystemFromString all;
@@ -36,6 +42,7 @@ in rec {
   i686    = filterDoubles predicates.isi686;
   x86_64  = filterDoubles predicates.isx86_64;
   mips    = filterDoubles predicates.isMips;
+  riscv   = filterDoubles predicates.isRiscV;
 
   cygwin  = filterDoubles predicates.isCygwin;
   darwin  = filterDoubles predicates.isDarwin;
@@ -50,5 +57,7 @@ in rec {
   wasi    = filterDoubles predicates.isWasi;
   windows = filterDoubles predicates.isWindows;
 
+  embedded = filterDoubles predicates.isNone;
+
   mesaPlatforms = ["i686-linux" "x86_64-linux" "x86_64-darwin" "armv5tel-linux" "armv6l-linux" "armv7l-linux" "armv7a-linux" "aarch64-linux" "powerpc64le-linux"];
 }
diff --git a/lib/systems/for-meta.nix b/lib/systems/for-meta.nix
deleted file mode 100644
index 17ae94deb7d1..000000000000
--- a/lib/systems/for-meta.nix
+++ /dev/null
@@ -1,38 +0,0 @@
-{ lib }:
-let
-  inherit (lib.systems) parse;
-  inherit (lib.systems.inspect) patterns;
-
-  abis = lib.mapAttrs (_: abi: builtins.removeAttrs abi [ "assertions" ]) parse.abis;
-
-in rec {
-  all     = [ {} ]; # `{}` matches anything
-  none    = [];
-
-  arm     = [ patterns.isAarch32 ];
-  aarch64 = [ patterns.isAarch64 ];
-  x86     = [ patterns.isx86 ];
-  i686    = [ patterns.isi686 ];
-  x86_64  = [ patterns.isx86_64 ];
-  mips    = [ patterns.isMips ];
-  riscv   = [ patterns.isRiscV ];
-
-  cygwin  = [ patterns.isCygwin ];
-  darwin  = [ patterns.isDarwin ];
-  freebsd = [ patterns.isFreeBSD ];
-  # Should be better, but MinGW is unclear.
-  gnu     = [
-    { kernel = parse.kernels.linux; abi = abis.gnu; }
-    { kernel = parse.kernels.linux; abi = abis.gnueabi; }
-    { kernel = parse.kernels.linux; abi = abis.gnueabihf; }
-  ];
-  illumos = [ patterns.isSunOS ];
-  linux   = [ patterns.isLinux ];
-  netbsd  = [ patterns.isNetBSD ];
-  openbsd = [ patterns.isOpenBSD ];
-  unix    = patterns.isUnix; # Actually a list
-  windows = [ patterns.isWindows ];
-  wasi    = [ patterns.isWasi ];
-
-  inherit (lib.systems.doubles) mesaPlatforms;
-}
diff --git a/lib/systems/inspect.nix b/lib/systems/inspect.nix
index 1c90af88879a..9a12e3c3926d 100644
--- a/lib/systems/inspect.nix
+++ b/lib/systems/inspect.nix
@@ -44,6 +44,7 @@ rec {
     isCygwin       = { kernel = kernels.windows; abi = abis.cygnus; };
     isMinGW        = { kernel = kernels.windows; abi = abis.gnu; };
     isWasi         = { kernel = kernels.wasi; };
+    isNone         = { kernel = kernels.none; };
 
     isAndroid      = [ { abi = abis.android; } { abi = abis.androideabi; } ];
     isMusl         = with abis; map (a: { abi = a; }) [ musl musleabi musleabihf ];
diff --git a/lib/tests/systems.nix b/lib/tests/systems.nix
index 161e3e7d07ac..7fc4b2eabcfd 100644
--- a/lib/tests/systems.nix
+++ b/lib/tests/systems.nix
@@ -12,19 +12,19 @@ let
     expected = lib.sort lib.lessThan y;
   };
 in with lib.systems.doubles; lib.runTests {
-  testall = mseteq all (linux ++ darwin ++ freebsd ++ openbsd ++ netbsd ++ illumos ++ wasi ++ windows);
+  testall = mseteq all (linux ++ darwin ++ freebsd ++ openbsd ++ netbsd ++ illumos ++ wasi ++ windows ++ embedded);
 
-  testarm = mseteq arm [ "armv5tel-linux" "armv6l-linux" "armv7l-linux" ];
-  testi686 = mseteq i686 [ "i686-linux" "i686-freebsd" "i686-netbsd" "i686-openbsd" "i686-cygwin" "i686-windows" ];
+  testarm = mseteq arm [ "armv5tel-linux" "armv6l-linux" "armv7l-linux" "arm-none" ];
+  testi686 = mseteq i686 [ "i686-linux" "i686-freebsd" "i686-netbsd" "i686-openbsd" "i686-cygwin" "i686-windows" "i686-none" ];
   testmips = mseteq mips [ "mipsel-linux" ];
-  testx86_64 = mseteq x86_64 [ "x86_64-linux" "x86_64-darwin" "x86_64-freebsd" "x86_64-openbsd" "x86_64-netbsd" "x86_64-cygwin" "x86_64-solaris" "x86_64-windows" ];
+  testx86_64 = mseteq x86_64 [ "x86_64-linux" "x86_64-darwin" "x86_64-freebsd" "x86_64-openbsd" "x86_64-netbsd" "x86_64-cygwin" "x86_64-solaris" "x86_64-windows" "x86_64-none" ];
 
   testcygwin = mseteq cygwin [ "i686-cygwin" "x86_64-cygwin" ];
   testdarwin = mseteq darwin [ "x86_64-darwin" ];
   testfreebsd = mseteq freebsd [ "i686-freebsd" "x86_64-freebsd" ];
   testgnu = mseteq gnu (linux /* ++ kfreebsd ++ ... */);
   testillumos = mseteq illumos [ "x86_64-solaris" ];
-  testlinux = mseteq linux [ "i686-linux" "x86_64-linux" "armv5tel-linux" "armv6l-linux" "armv7l-linux" "aarch64-linux" "mipsel-linux" ];
+  testlinux = mseteq linux [ "aarch64-linux" "armv5tel-linux" "armv6l-linux" "armv7l-linux" "i686-linux" "mipsel-linux" "riscv32-linux" "riscv64-linux" "x86_64-linux" "powerpc64le-linux" ];
   testnetbsd = mseteq netbsd [ "i686-netbsd" "x86_64-netbsd" ];
   testopenbsd = mseteq openbsd [ "i686-openbsd" "x86_64-openbsd" ];
   testwindows = mseteq windows [ "i686-cygwin" "x86_64-cygwin" "i686-windows" "x86_64-windows" ];
diff --git a/maintainers/scripts/luarocks-packages.csv b/maintainers/scripts/luarocks-packages.csv
index a7989c74b21a..0c52faef1bff 100644
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@@ -1,41 +1,44 @@
-# nix name, luarocks name, server, version/additionnal args
-ansicolors,
-argparse,
-basexx,
-binaryheap,
-dkjson
-fifo
-http
-inspect
-ldoc
-lgi
-lpeg_patterns
-lpty
-lrexlib-gnu,
-lrexlib-posix,
-ltermbox,
-lua-cmsgpack,
-lua_cliargs,
-lua-iconv,
-lua-messagepack,
-lua-term,
-lua-toml,
-luabitop,
-luaevent,
-luacheck
-luaffi,,http://luarocks.org/dev,
-luuid,
-markdown,
-penlight,
-rapidjson,
-say,
-std__debug,std._debug,
-std_normalize,std.normalize,
-luv,
-luasystem,
-mediator_lua,,http://luarocks.org/manifests/teto
-mpack,,http://luarocks.org/manifests/teto
-nvim-client,,http://luarocks.org/manifests/teto
-busted,,http://luarocks.org/manifests/teto
-luassert,,http://luarocks.org/manifests/teto
-coxpcall,,https://luarocks.org/manifests/hisham,1.17.0-1
+# nix name, luarocks name, server, version,luaversion
+ansicolors,,,,
+argparse,,,,
+basexx,,,,
+binaryheap,,,,
+digestif,,http://luarocks.org/dev,,lua5_3
+dkjson,,,,
+fifo,,,,
+http,,,,
+inspect,,,,
+ldoc,,,,
+lgi,,,,
+lpeg_patterns,,,,
+lpeglabel,,,,
+lpty,,,,
+lrexlib-gnu,,,,
+lrexlib-posix,,,,
+ltermbox,,,,
+lua-cmsgpack,,,,
+lua_cliargs,,,,
+lua-iconv,,,,
+lua-lsp,,http://luarocks.org/dev,,
+lua-messagepack,,,,
+lua-term,,,,
+lua-toml,,,,
+luabitop,,,,
+luaevent,,,,
+luacheck,,,,
+luaffi,,http://luarocks.org/dev,,
+luuid,,,,
+markdown,,,,
+penlight,,,,
+rapidjson,,,,
+say,,,,
+std__debug,std._debug,,,
+std_normalize,std.normalize,,,
+luv,,,,
+luasystem,,,,
+mediator_lua,,http://luarocks.org/manifests/teto,,
+mpack,,http://luarocks.org/manifests/teto,,
+nvim-client,,,,
+busted,,http://luarocks.org/manifests/teto,,
+luassert,,,,
+coxpcall,,https://luarocks.org/manifests/hisham,1.17.0-1,
diff --git a/maintainers/scripts/update-luarocks-packages b/maintainers/scripts/update-luarocks-packages
index e7ab61b1a9c7..e2f2cc6bbd2e 100755
--- a/maintainers/scripts/update-luarocks-packages
+++ b/maintainers/scripts/update-luarocks-packages
@@ -12,11 +12,6 @@
 # stop the script upon C-C
 set -eu -o pipefail
 
-if [ $# -lt 1 ]; then
-	print_help
-    exit 1
-fi
-
 CSV_FILE="maintainers/scripts/luarocks-packages.csv"
 TMP_FILE="$(mktemp)"
 
@@ -25,16 +20,21 @@ exit_trap()
   local lc="$BASH_COMMAND" rc=$?
   test $rc -eq 0 || echo -e "*** error $rc: $lc.\nGenerated temporary file in $TMP_FILE" >&2
 }
-trap exit_trap EXIT
 
 print_help() {
     echo "Usage: $0 <GENERATED_FILE>"
     echo "(most likely pkgs/development/lua-modules/generated-packages.nix)"
-	echo ""
-	echo " -c <CSV_FILE> to set the list of luarocks package to generate"
-	exit 1
+    echo ""
+    echo " -c <CSV_FILE> to set the list of luarocks package to generate"
+    exit 1
 }
 
+if [ $# -lt 1 ]; then
+    print_help
+    exit 1
+fi
+
+trap exit_trap EXIT
 
 while getopts ":hc:" opt; do
   case $opt in
@@ -76,15 +76,16 @@ FOOTER="
 function convert_pkg () {
     nix_pkg_name="$1"
     lua_pkg_name="$2"
-    server="${3:+--server=$3}"
-    version="${4:-}"
+    server="${3:+--only-server=$3}"
+    pkg_version="${4:-}"
+    lua_version="${5:+--lua-dir=$(nix path-info nixpkgs.$5)/bin}"
 
-    echo "looking at $lua_pkg_name (version $version) from server [$server]" >&2
-    cmd="luarocks nix $server $lua_pkg_name $version"
+    echo "looking at $lua_pkg_name (version $pkg_version) from server [$server]" >&2
+    cmd="luarocks nix $server $lua_version $lua_pkg_name $pkg_version"
+    echo "Running $cmd" >&2
     drv="$nix_pkg_name = $($cmd)"
     if [ $? -ne 0 ]; then
         echo "Failed to convert $pkg" >&2
-        echo "$drv" >&2
     else
         echo "$drv" | tee -a "$TMP_FILE"
     fi
@@ -94,8 +95,7 @@ function convert_pkg () {
 echo "$HEADER" | tee "$TMP_FILE"
 
 # list of packages with format
-# name,server,version
-while IFS=, read -r nix_pkg_name lua_pkg_name server version
+while IFS=, read -r nix_pkg_name lua_pkg_name server pkg_version luaversion
 do
     if [ "${nix_pkg_name:0:1}" == "#" ]; then
         echo "Skipping comment ${nix_pkg_name}" >&2
@@ -105,7 +105,7 @@ do
         echo "Using nix_name as lua_pkg_name" >&2
         lua_pkg_name="$nix_pkg_name"
     fi
-    convert_pkg "$nix_pkg_name" "$lua_pkg_name" "$server" "$version"
+    convert_pkg "$nix_pkg_name" "$lua_pkg_name" "$server" "$pkg_version" "$luaversion"
 done < "$CSV_FILE"
 
 # close the set
diff --git a/maintainers/scripts/update.nix b/maintainers/scripts/update.nix
index 120cd5552f48..04723cb8a366 100755
--- a/maintainers/scripts/update.nix
+++ b/maintainers/scripts/update.nix
@@ -20,7 +20,9 @@ let
       in
         [x] ++ nubOn f xs;
 
-  pkgs = import ./../../default.nix { };
+  pkgs = import ./../../default.nix {
+    overlays = [];
+  };
 
   packagesWith = cond: return: set:
     nubOn (pkg: pkg.updateScript)
@@ -67,9 +69,12 @@ let
     let
       attrSet = pkgs.lib.attrByPath (pkgs.lib.splitString "." path) null pkgs;
     in
-      packagesWith (name: pkg: builtins.hasAttr "updateScript" pkg)
-                     (name: pkg: pkg)
-                     attrSet;
+      if attrSet == null then
+        builtins.throw "Attribute path `${path}` does not exists."
+      else
+        packagesWith (name: pkg: builtins.hasAttr "updateScript" pkg)
+                       (name: pkg: pkg)
+                       attrSet;
 
   packageByName = name:
     let
@@ -122,9 +127,17 @@ let
   packageData = package: {
     name = package.name;
     pname = (builtins.parseDrvName package.name).name;
-    updateScript = pkgs.lib.toList package.updateScript;
+    updateScript = map builtins.toString (pkgs.lib.toList package.updateScript);
   };
 
+  packagesJson = pkgs.writeText "packages.json" (builtins.toJSON (map packageData packages));
+
+  optionalArgs =
+    pkgs.lib.optional (max-workers != null) "--max-workers=${max-workers}"
+    ++ pkgs.lib.optional (keep-going == "true") "--keep-going";
+
+  args = [ packagesJson ] ++ optionalArgs;
+
 in pkgs.stdenv.mkDerivation {
   name = "nixpkgs-update-script";
   buildCommand = ''
@@ -139,6 +152,6 @@ in pkgs.stdenv.mkDerivation {
   '';
   shellHook = ''
     unset shellHook # do not contaminate nested shells
-    exec ${pkgs.python3.interpreter} ${./update.py} ${pkgs.writeText "packages.json" (builtins.toJSON (map packageData packages))}${pkgs.lib.optionalString (max-workers != null) " --max-workers=${max-workers}"}${pkgs.lib.optionalString (keep-going == "true") " --keep-going"}
+    exec ${pkgs.python3.interpreter} ${./update.py} ${builtins.concatStringsSep " " args}
   '';
 }
diff --git a/nixos/doc/manual/release-notes/rl-1909.xml b/nixos/doc/manual/release-notes/rl-1909.xml
index 665345d6f358..922239998ad6 100644
--- a/nixos/doc/manual/release-notes/rl-1909.xml
+++ b/nixos/doc/manual/release-notes/rl-1909.xml
@@ -114,6 +114,18 @@
    </listitem>
    <listitem>
     <para>
+     Since Bittorrent Sync was superseded by Resilio Sync in 2016, the
+     <literal>bittorrentSync</literal>, <literal>bittorrentSync14</literal>,
+     and <literal>bittorrentSync16</literal> packages have been removed in
+     favor of <literal>resilio-sync</literal>.
+    </para>
+    <para>
+     The corresponding module, <option>services.btsync</option> has been
+     replaced by the <option>services.resilio</option> module.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
       The limesurvey apache subservice was replaced with a full NixOS module.
       One can configure it using the <option>services.limesurvey.enable</option>
       and <option>services.limesurvey.virtualHost</option> options.
diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix
index 5b7fa5d2b98f..f1118f472e44 100644
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@@ -145,7 +145,7 @@
       #notbit = 111; # unused
       aerospike = 111;
       ngircd = 112;
-      btsync = 113;
+      #btsync = 113; # unused
       minecraft = 114;
       vault = 115;
       rippled = 116;
@@ -457,7 +457,7 @@
       #notbit = 111; # unused
       aerospike = 111;
       #ngircd = 112; # unused
-      btsync = 113;
+      #btsync = 113; # unused
       #minecraft = 114; # unused
       vault = 115;
       #ripped = 116; # unused
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 5042470802f0..1017d25bf285 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -184,6 +184,7 @@
   ./services/amqp/activemq/default.nix
   ./services/amqp/rabbitmq.nix
   ./services/audio/alsa.nix
+  ./services/audio/jack.nix
   ./services/audio/icecast.nix
   ./services/audio/liquidsoap.nix
   ./services/audio/mpd.nix
@@ -542,7 +543,6 @@
   ./services/networking/autossh.nix
   ./services/networking/bird.nix
   ./services/networking/bitlbee.nix
-  ./services/networking/btsync.nix
   ./services/networking/charybdis.nix
   ./services/networking/chrony.nix
   ./services/networking/cjdns.nix
diff --git a/nixos/modules/services/audio/jack.nix b/nixos/modules/services/audio/jack.nix
new file mode 100644
index 000000000000..1364abd40447
--- /dev/null
+++ b/nixos/modules/services/audio/jack.nix
@@ -0,0 +1,275 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.jack;
+
+  pcmPlugin = cfg.jackd.enable && cfg.alsa.enable;
+  loopback = cfg.jackd.enable && cfg.loopback.enable;
+
+  enable32BitAlsaPlugins = cfg.alsa.support32Bit && pkgs.stdenv.isx86_64 && pkgs.pkgsi686Linux.alsaLib != null;
+
+  umaskNeeded = versionOlder cfg.jackd.package.version "1.9.12";
+  bridgeNeeded = versionAtLeast cfg.jackd.package.version "1.9.12";
+in {
+  options = {
+    services.jack = {
+      jackd = {
+        enable = mkEnableOption ''
+          JACK Audio Connection Kit. You need to add yourself to the "jackaudio" group
+        '';
+
+        package = mkOption {
+          # until jack1 promiscuous mode is fixed
+          internal = true;
+          type = types.package;
+          default = pkgs.jack2;
+          defaultText = "pkgs.jack2";
+          example = literalExample "pkgs.jack1";
+          description = ''
+            The JACK package to use.
+          '';
+        };
+
+        extraOptions = mkOption {
+          type = types.listOf types.str;
+          default = [
+            "-dalsa"
+          ];
+          example = literalExample ''
+            [ "-dalsa" "--device" "hw:1" ];
+          '';
+          description = ''
+            Specifies startup command line arguments to pass to JACK server.
+          '';
+        };
+
+        session = mkOption {
+          type = types.lines;
+          description = ''
+            Commands to run after JACK is started.
+          '';
+        };
+
+      };
+
+      alsa = {
+        enable = mkOption {
+          type = types.bool;
+          default = true;
+          description = ''
+            Route audio to/from generic ALSA-using applications using ALSA JACK PCM plugin.
+          '';
+        };
+
+        support32Bit = mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            Whether to support sound for 32-bit ALSA applications on 64-bit system.
+          '';
+        };
+      };
+
+      loopback = {
+        enable = mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            Create ALSA loopback device, instead of using PCM plugin. Has broader
+            application support (things like Steam will work), but may need fine-tuning
+            for concrete hardware.
+          '';
+        };
+
+        index = mkOption {
+          type = types.int;
+          default = 10;
+          description = ''
+            Index of an ALSA loopback device.
+          '';
+        };
+
+        config = mkOption {
+          type = types.lines;
+          description = ''
+            ALSA config for loopback device.
+          '';
+        };
+
+        session = mkOption {
+          type = types.lines;
+          description = ''
+            Additional commands to run to setup loopback device.
+          '';
+        };
+      };
+
+    };
+
+  };
+
+  config = mkMerge [
+
+    (mkIf pcmPlugin {
+      sound.extraConfig = ''
+        pcm_type.jack {
+          libs.native = ${pkgs.alsaPlugins}/lib/alsa-lib/libasound_module_pcm_jack.so ;
+          ${lib.optionalString enable32BitAlsaPlugins
+          "libs.32Bit = ${pkgs.pkgsi686Linux.alsaPlugins}/lib/alsa-lib/libasound_module_pcm_jack.so ;"}
+        }
+        pcm.!default {
+          @func getenv
+          vars [ PCM ]
+          default "plug:jack"
+        }
+      '';
+    })
+
+    (mkIf loopback {
+      boot.kernelModules = [ "snd-aloop" ];
+      boot.kernelParams = [ "snd-aloop.index=${toString cfg.loopback.index}" ];
+      sound.extraConfig = cfg.loopback.config;
+    })
+
+    (mkIf cfg.jackd.enable {
+      services.jack.jackd.session = ''
+        ${lib.optionalString bridgeNeeded "${pkgs.a2jmidid}/bin/a2jmidid -e &"}
+      '';
+      # https://alsa.opensrc.org/Jack_and_Loopback_device_as_Alsa-to-Jack_bridge#id06
+      services.jack.loopback.config = ''
+        pcm.loophw00 {
+          type hw
+          card ${toString cfg.loopback.index}
+          device 0
+          subdevice 0
+        }
+        pcm.amix {
+          type dmix
+          ipc_key 219345
+          slave {
+            pcm loophw00
+          }
+        }
+        pcm.asoftvol {
+          type softvol
+          slave.pcm "amix"
+          control { name Master }
+        }
+        pcm.cloop {
+          type hw
+          card ${toString cfg.loopback.index}
+          device 1
+          subdevice 0
+          format S32_LE
+        }
+        pcm.loophw01 {
+          type hw
+          card ${toString cfg.loopback.index}
+          device 0
+          subdevice 1
+        }
+        pcm.ploop {
+          type hw
+          card ${toString cfg.loopback.index}
+          device 1
+          subdevice 1
+          format S32_LE
+        }
+        pcm.aduplex {
+          type asym
+          playback.pcm "asoftvol"
+          capture.pcm "loophw01"
+        }
+        pcm.!default {
+          type plug
+          slave.pcm aduplex
+        }
+      '';
+      services.jack.loopback.session = ''
+        alsa_in -j cloop -dcloop &
+        alsa_out -j ploop -dploop &
+        while [ "$(jack_lsp cloop)" == "" ] || [ "$(jack_lsp ploop)" == "" ]; do sleep 1; done
+        jack_connect cloop:capture_1 system:playback_1
+        jack_connect cloop:capture_2 system:playback_2
+        jack_connect system:capture_1 ploop:playback_1
+        jack_connect system:capture_2 ploop:playback_2
+      '';
+
+      assertions = [
+        {
+          assertion = !(cfg.alsa.enable && cfg.loopback.enable);
+          message = "For JACK both alsa and loopback options shouldn't be used at the same time.";
+        }
+      ];
+
+      users.users.jackaudio = {
+        group = "jackaudio";
+        extraGroups = [ "audio" ];
+        description = "JACK Audio system service user";
+      };
+      # http://jackaudio.org/faq/linux_rt_config.html
+      security.pam.loginLimits = [
+        { domain = "@jackaudio"; type = "-"; item = "rtprio"; value = "99"; }
+        { domain = "@jackaudio"; type = "-"; item = "memlock"; value = "unlimited"; }
+      ];
+      users.groups.jackaudio = {};
+
+      environment = {
+        systemPackages = [ cfg.jackd.package ];
+        etc."alsa/conf.d/50-jack.conf".source = "${pkgs.alsaPlugins}/etc/alsa/conf.d/50-jack.conf";
+        variables.JACK_PROMISCUOUS_SERVER = "jackaudio";
+      };
+
+      services.udev.extraRules = ''
+        ACTION=="add", SUBSYSTEM=="sound", ATTRS{id}!="Loopback", TAG+="systemd", ENV{SYSTEMD_WANTS}="jack.service"
+      '';
+
+      systemd.services.jack = {
+        description = "JACK Audio Connection Kit";
+        serviceConfig = {
+          User = "jackaudio";
+          ExecStart = "${cfg.jackd.package}/bin/jackd ${lib.escapeShellArgs cfg.jackd.extraOptions}";
+          LimitRTPRIO = 99;
+          LimitMEMLOCK = "infinity";
+        } // optionalAttrs umaskNeeded {
+          UMask = "007";
+        };
+        path = [ cfg.jackd.package ];
+        environment = {
+          JACK_PROMISCUOUS_SERVER = "jackaudio";
+          JACK_NO_AUDIO_RESERVATION = "1";
+        };
+        restartIfChanged = false;
+      };
+      systemd.services.jack-session = {
+        description = "JACK session";
+        script = ''
+          jack_wait -w
+          ${cfg.jackd.session}
+          ${lib.optionalString cfg.loopback.enable cfg.loopback.session}
+        '';
+        serviceConfig = {
+          RemainAfterExit = true;
+          User = "jackaudio";
+          StateDirectory = "jack";
+          LimitRTPRIO = 99;
+          LimitMEMLOCK = "infinity";
+        };
+        path = [ cfg.jackd.package ];
+        environment = {
+          JACK_PROMISCUOUS_SERVER = "jackaudio";
+          HOME = "/var/lib/jack";
+        };
+        wantedBy = [ "jack.service" ];
+        partOf = [ "jack.service" ];
+        after = [ "jack.service" ];
+        restartIfChanged = false;
+      };
+    })
+
+  ];
+
+  meta.maintainers = [ maintainers.gnidorah ];
+}
diff --git a/nixos/modules/services/desktops/geoclue2.nix b/nixos/modules/services/desktops/geoclue2.nix
index a16dbc04a5f7..040fe157d52d 100644
--- a/nixos/modules/services/desktops/geoclue2.nix
+++ b/nixos/modules/services/desktops/geoclue2.nix
@@ -188,6 +188,19 @@ in
 
     systemd.packages = [ package ];
 
+    users.users.geoclue = {
+      isSystemUser = true;
+      home = "/var/lib/geoclue";
+      group = "geoclue";
+      description = "Geoinformation service";
+    };
+
+    users.groups.geoclue = {};
+
+    systemd.tmpfiles.rules = [
+      "d /var/lib/geoclue 0755 geoclue geoclue"
+    ];
+
     # restart geoclue service when the configuration changes
     systemd.services."geoclue".restartTriggers = [
       config.environment.etc."geoclue/geoclue.conf".source
diff --git a/nixos/modules/services/networking/btsync.nix b/nixos/modules/services/networking/btsync.nix
deleted file mode 100644
index 33e85ef58e6e..000000000000
--- a/nixos/modules/services/networking/btsync.nix
+++ /dev/null
@@ -1,324 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-  cfg = config.services.btsync;
-
-  bittorrentSync = cfg.package;
-
-  listenAddr = cfg.httpListenAddr + ":" + (toString cfg.httpListenPort);
-
-  optionalEmptyStr = b: v: optionalString (b != "") v;
-
-  webUIConfig = optionalString cfg.enableWebUI
-    ''
-      "webui":
-      {
-        ${optionalEmptyStr cfg.httpLogin     "\"login\":          \"${cfg.httpLogin}\","}
-        ${optionalEmptyStr cfg.httpPass      "\"password\":       \"${cfg.httpPass}\","}
-        ${optionalEmptyStr cfg.apiKey        "\"api_key\":        \"${cfg.apiKey}\","}
-        ${optionalEmptyStr cfg.directoryRoot "\"directory_root\": \"${cfg.directoryRoot}\","}
-        "listen": "${listenAddr}"
-      }
-    '';
-
-  knownHosts = e:
-    optionalString (e ? "knownHosts")
-      (concatStringsSep "," (map (v: "\"${v}\"") e."knownHosts"));
-
-  sharedFoldersRecord =
-    concatStringsSep "," (map (entry:
-      let helper = attr: v:
-        if (entry ? attr) then boolToString entry.attr else boolToString v;
-      in
-      ''
-        {
-          "secret": "${entry.secret}",
-          "dir":    "${entry.directory}",
-
-          "use_relay_server": ${helper "useRelayServer" true},
-          "use_tracker":      ${helper "useTracker"     true},
-          "use_dht":          ${helper "useDHT"        false},
-
-          "search_lan":       ${helper "searchLAN"      true},
-          "use_sync_trash":   ${helper "useSyncTrash"   true},
-
-          "known_hosts": [${knownHosts entry}]
-        }
-      '') cfg.sharedFolders);
-
-  sharedFoldersConfig = optionalString (cfg.sharedFolders != [])
-    ''
-      "shared_folders":
-        [
-        ${sharedFoldersRecord}
-        ]
-    '';
-
-  configFile = pkgs.writeText "btsync.config"
-    ''
-      {
-        "device_name":     "${cfg.deviceName}",
-        "storage_path":    "${cfg.storagePath}",
-        "listening_port":  ${toString cfg.listeningPort},
-        "use_gui":         false,
-
-        "check_for_updates": ${boolToString cfg.checkForUpdates},
-        "use_upnp":          ${boolToString cfg.useUpnp},
-        "download_limit":    ${toString cfg.downloadLimit},
-        "upload_limit":      ${toString cfg.uploadLimit},
-        "lan_encrypt_data":  ${boolToString cfg.encryptLAN},
-
-        ${webUIConfig}
-        ${sharedFoldersConfig}
-      }
-    '';
-in
-{
-  options = {
-    services.btsync = {
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          If enabled, start the Bittorrent Sync daemon. Once enabled, you can
-          interact with the service through the Web UI, or configure it in your
-          NixOS configuration. Enabling the <literal>btsync</literal> service
-          also installs a systemd user unit which can be used to start
-          user-specific copies of the daemon. Once installed, you can use
-          <literal>systemctl --user start btsync</literal> as your user to start
-          the daemon using the configuration file located at
-          <literal>$HOME/.config/btsync.conf</literal>.
-        '';
-      };
-
-      deviceName = mkOption {
-        type = types.str;
-        example = "Voltron";
-        description = ''
-          Name of the Bittorrent Sync device.
-        '';
-      };
-
-      listeningPort = mkOption {
-        type = types.int;
-        default = 0;
-        example = 44444;
-        description = ''
-          Listening port. Defaults to 0 which randomizes the port.
-        '';
-      };
-
-      checkForUpdates = mkOption {
-        type = types.bool;
-        default = true;
-        description = ''
-          Determines whether to check for updates and alert the user
-          about them in the UI.
-        '';
-      };
-
-      useUpnp = mkOption {
-        type = types.bool;
-        default = true;
-        description = ''
-          Use Universal Plug-n-Play (UPnP)
-        '';
-      };
-
-      downloadLimit = mkOption {
-        type = types.int;
-        default = 0;
-        example = 1024;
-        description = ''
-          Download speed limit. 0 is unlimited (default).
-        '';
-      };
-
-      uploadLimit = mkOption {
-        type = types.int;
-        default = 0;
-        example = 1024;
-        description = ''
-          Upload speed limit. 0 is unlimited (default).
-        '';
-      };
-
-      httpListenAddr = mkOption {
-        type = types.str;
-        default = "0.0.0.0";
-        example = "1.2.3.4";
-        description = ''
-          HTTP address to bind to.
-        '';
-      };
-
-      httpListenPort = mkOption {
-        type = types.int;
-        default = 9000;
-        description = ''
-          HTTP port to bind on.
-        '';
-      };
-
-      httpLogin = mkOption {
-        type = types.str;
-        example = "allyourbase";
-        default = "";
-        description = ''
-          HTTP web login username.
-        '';
-      };
-
-      httpPass = mkOption {
-        type = types.str;
-        example = "arebelongtous";
-        default = "";
-        description = ''
-          HTTP web login password.
-        '';
-      };
-
-      encryptLAN = mkOption {
-        type = types.bool;
-        default = true;
-        description = "Encrypt LAN data.";
-      };
-
-      enableWebUI = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Enable Web UI for administration. Bound to the specified
-          <literal>httpListenAddress</literal> and
-          <literal>httpListenPort</literal>.
-          '';
-      };
-
-      package = mkOption {
-        type = types.package;
-        example = literalExample "pkgs.bittorrentSync20";
-        description = ''
-          Branch of bittorrent sync to use.
-        '';
-      };
-
-      storagePath = mkOption {
-        type = types.path;
-        default = "/var/lib/btsync/";
-        description = ''
-          Where BitTorrent Sync will store it's database files (containing
-          things like username info and licenses). Generally, you should not
-          need to ever change this.
-        '';
-      };
-
-      apiKey = mkOption {
-        type = types.str;
-        default = "";
-        description = "API key, which enables the developer API.";
-      };
-
-      directoryRoot = mkOption {
-        type = types.str;
-        default = "";
-        example = "/media";
-        description = "Default directory to add folders in the web UI.";
-      };
-
-      sharedFolders = mkOption {
-        default = [];
-        example =
-          [ { secret         = "AHMYFPCQAHBM7LQPFXQ7WV6Y42IGUXJ5Y";
-              directory      = "/home/user/sync_test";
-              useRelayServer = true;
-              useTracker     = true;
-              useDHT         = false;
-              searchLAN      = true;
-              useSyncTrash   = true;
-              knownHosts     =
-                [ "192.168.1.2:4444"
-                  "192.168.1.3:4444"
-                ];
-            }
-          ];
-        description = ''
-          Shared folder list. If enabled, web UI must be
-          disabled. Secrets can be generated using <literal>btsync
-          --generate-secret</literal>. Note that this secret will be
-          put inside the Nix store, so it is realistically not very
-          secret.
-
-          If you would like to be able to modify the contents of this
-          directories, it is recommended that you make your user a
-          member of the <literal>btsync</literal> group.
-
-          Directories in this list should be in the
-          <literal>btsync</literal> group, and that group must have
-          write access to the directory. It is also recommended that
-          <literal>chmod g+s</literal> is applied to the directory
-          so that any sub directories created will also belong to
-          the <literal>btsync</literal> group. Also,
-          <literal>setfacl -d -m group:btsync:rwx</literal> and
-          <literal>setfacl -m group:btsync:rwx</literal> should also
-          be applied so that the sub directories are writable by
-          the group.
-        '';
-      };
-    };
-  };
-
-  config = mkIf cfg.enable {
-    assertions =
-      [ { assertion = cfg.deviceName != "";
-          message   = "Device name cannot be empty.";
-        }
-        { assertion = cfg.enableWebUI -> cfg.sharedFolders == [];
-          message   = "If using shared folders, the web UI cannot be enabled.";
-        }
-        { assertion = cfg.apiKey != "" -> cfg.enableWebUI;
-          message   = "If you're using an API key, you must enable the web server.";
-        }
-      ];
-
-    services.btsync.package = mkOptionDefault pkgs.bittorrentSync14;
-
-    users.users.btsync = {
-      description     = "Bittorrent Sync Service user";
-      home            = cfg.storagePath;
-      createHome      = true;
-      uid             = config.ids.uids.btsync;
-      group           = "btsync";
-    };
-
-    users.groups = [
-      { name = "btsync";
-      }];
-
-    systemd.services.btsync = with pkgs; {
-      description = "Bittorrent Sync Service";
-      wantedBy    = [ "multi-user.target" ];
-      after       = [ "network.target" "local-fs.target" ];
-      serviceConfig = {
-        Restart   = "on-abort";
-        UMask     = "0002";
-        User      = "btsync";
-        ExecStart =
-          "${bittorrentSync}/bin/btsync --nodaemon --config ${configFile}";
-      };
-    };
-
-    systemd.user.services.btsync = with pkgs; {
-      description = "Bittorrent Sync user service";
-      after       = [ "network.target" "local-fs.target" ];
-      serviceConfig = {
-        Restart   = "on-abort";
-        ExecStart =
-          "${bittorrentSync}/bin/btsync --nodaemon --config %h/.config/btsync.conf";
-      };
-    };
-
-    environment.systemPackages = [ cfg.package ];
-  };
-}
diff --git a/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix b/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix
index d4f7e95f859f..808cb863a9cf 100644
--- a/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix
+++ b/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix
@@ -6,7 +6,7 @@
 #
 #   git clone https://github.com/strongswan/strongswan.git
 #   cd strongswan
-#   git diff 5.5.3..5.6.0 src/swanctl/swanctl.opt
+#   git diff 5.7.2..5.8.0 src/swanctl/swanctl.opt
 
 lib: with (import ./param-constructors.nix lib);
 
@@ -227,6 +227,22 @@ in {
       irrespective of the value of this option (even when set to no).
     '';
 
+    childless = mkEnumParam [ "allow" "force" "never" ] "allow" ''
+      Use childless IKE_SA initiation (RFC 6023) for IKEv2.  Acceptable values
+      are <literal>allow</literal> (the default), <literal>force</literal> and
+      <literal>never</literal>. If set to <literal>allow</literal>, responders
+      will accept childless IKE_SAs (as indicated via notify in the IKE_SA_INIT
+      response) while initiators continue to create regular IKE_SAs with the
+      first CHILD_SA created during IKE_AUTH, unless the IKE_SA is initiated
+      explicitly without any children (which will fail if the responder does not
+      support or has disabled this extension).  If set to
+      <literal>force</literal>, only childless initiation is accepted and the
+      first CHILD_SA is created with a separate CREATE_CHILD_SA exchange
+      (e.g. to use an independent DH exchange for all CHILD_SAs). Finally,
+      setting the option to <literal>never</literal> disables support for
+      childless IKE_SAs as responder.
+    '';
+
     send_certreq = mkYesNoParam yes ''
       Send certificate request payloads to offer trusted root CA certificates to
       the peer. Certificate requests help the peer to choose an appropriate
@@ -350,6 +366,16 @@ in {
       name from either the pools section or an external pool.
     '';
 
+    if_id_in = mkStrParam "0" ''
+      XFRM interface ID set on inbound policies/SA, can be overridden by child
+      config, see there for details.
+    '';
+
+    if_id_out = mkStrParam "0" ''
+      XFRM interface ID set on outbound policies/SA, can be overridden by child
+      config, see there for details.
+    '';
+
     mediation = mkYesNoParam no ''
       Whether this connection is a mediation connection, that is, whether this
       connection is used to mediate other connections using the IKEv2 Mediation
@@ -799,7 +825,7 @@ in {
         Updown script to invoke on CHILD_SA up and down events.
       '';
 
-      hostaccess = mkYesNoParam yes ''
+      hostaccess = mkYesNoParam no ''
         Hostaccess variable to pass to <literal>updown</literal> script.
       '';
 
@@ -960,6 +986,26 @@ in {
         mask requires at least Linux 4.19.
       '';
 
+      if_id_in = mkStrParam "0" ''
+        XFRM interface ID set on inbound policies/SA. This allows installing
+        duplicate policies/SAs and associates them with an interface with the
+        same ID. The special value <literal>%unique</literal> sets a unique
+        interface ID on each CHILD_SA instance, beyond that the value
+        <literal>%unique-dir</literal> assigns a different unique interface ID
+        for each CHILD_SA direction (in/out).
+      '';
+
+      if_id_out = mkStrParam "0" ''
+        XFRM interface ID set on outbound policies/SA. This allows installing
+        duplicate policies/SAs and associates them with an interface with the
+        same ID. The special value <literal>%unique</literal> sets a unique
+        interface ID on each CHILD_SA instance, beyond that the value
+        <literal>%unique-dir</literal> assigns a different unique interface ID
+        for each CHILD_SA direction (in/out).
+
+        The daemon will not install routes for CHILD_SAs that have this option set.
+     '';
+
       tfc_padding = mkParamOfType (with lib.types; either int (enum ["mtu"])) 0 ''
         Pads ESP packets with additional data to have a consistent ESP packet
         size for improved Traffic Flow Confidentiality. The padding defines the
diff --git a/nixos/modules/services/system/localtime.nix b/nixos/modules/services/system/localtime.nix
index c7e897c96448..8e9286b94078 100644
--- a/nixos/modules/services/system/localtime.nix
+++ b/nixos/modules/services/system/localtime.nix
@@ -20,7 +20,13 @@ in {
   };
 
   config = mkIf cfg.enable {
-    services.geoclue2.enable = true;
+    services.geoclue2 = {
+      enable = true;
+      appConfig."localtime" = {
+        isAllowed = true;
+        isSystem = true;
+      };
+    };
 
     # so polkit will pick up the rules
     environment.systemPackages = [ pkgs.localtime ];
diff --git a/nixos/modules/services/torrent/deluge.nix b/nixos/modules/services/torrent/deluge.nix
index 84f0437b9411..01a5890a7845 100644
--- a/nixos/modules/services/torrent/deluge.nix
+++ b/nixos/modules/services/torrent/deluge.nix
@@ -5,8 +5,33 @@ with lib;
 let
   cfg = config.services.deluge;
   cfg_web = config.services.deluge.web;
+
   openFilesLimit = 4096;
+  listenPortsDefault = [ 6881 6889 ];
+
+  listToRange = x: { from = elemAt x 0; to = elemAt x 1; };
+
+  configDir = "${cfg.dataDir}/.config/deluge";
+  configFile = pkgs.writeText "core.conf" (builtins.toJSON cfg.config);
+  declarativeLockFile = "${configDir}/.declarative";
 
+  preStart = if cfg.declarative then ''
+    if [ -e ${declarativeLockFile} ]; then
+      # Was declarative before, no need to back up anything
+      ln -sf ${configFile} ${configDir}/core.conf
+      ln -sf ${cfg.authFile} ${configDir}/auth
+    else
+      # Declarative for the first time, backup stateful files
+      ln -sb --suffix=.stateful ${configFile} ${configDir}/core.conf
+      ln -sb --suffix=.stateful ${cfg.authFile} ${configDir}/auth
+      echo "Autogenerated file that signifies that this server configuration is managed declaratively by NixOS" \
+        > ${declarativeLockFile}
+    fi
+  '' else ''
+    if [ -e ${declarativeLockFile} ]; then
+      rm ${declarativeLockFile}
+    fi
+  '';
 in {
   options = {
     services = {
@@ -15,42 +40,151 @@ in {
 
         openFilesLimit = mkOption {
           default = openFilesLimit;
-          example = 8192;
           description = ''
             Number of files to allow deluged to open.
           '';
         };
+
+        config = mkOption {
+          type = types.attrs;
+          default = {};
+          example = literalExample ''
+            {
+              download_location = "/srv/torrents/";
+              max_upload_speed = "1000.0";
+              share_ratio_limit = "2.0";
+              allow_remote = true;
+              daemon_port = 58846;
+              listen_ports = [ ${toString listenPortsDefault} ];
+            }
+          '';
+          description = ''
+            Deluge core configuration for the core.conf file. Only has an effect
+            when <option>services.deluge.declarative</option> is set to
+            <literal>true</literal>. String values must be quoted, integer and
+            boolean values must not. See
+            <link xlink:href="https://git.deluge-torrent.org/deluge/tree/deluge/core/preferencesmanager.py#n41"/>
+            for the availaible options.
+          '';
+        };
+
+        declarative = mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            Whether to use a declarative deluge configuration.
+            Only if set to <literal>true</literal>, the options
+            <option>services.deluge.config</option>,
+            <option>services.deluge.openFirewall</option> and
+            <option>services.deluge.authFile</option> will be
+            applied.
+          '';
+        };
+
+        openFirewall = mkOption {
+          default = false;
+          type = types.bool;
+          description = ''
+            Whether to open the firewall for the ports in
+            <option>services.deluge.config.listen_ports</option>. It only takes effet if
+            <option>services.deluge.declarative</option> is set to
+            <literal>true</literal>.
+
+            It does NOT apply to the daemon port nor the web UI port. To access those
+            ports secuerly check the documentation
+            <link xlink:href="https://dev.deluge-torrent.org/wiki/UserGuide/ThinClient#CreateSSHTunnel"/>
+            or use a VPN or configure certificates for deluge.
+          '';
+        };
+
+        dataDir = mkOption {
+          type = types.path;
+          default = "/var/lib/deluge";
+          description = ''
+            The directory where deluge will create files.
+          '';
+        };
+
+        authFile = mkOption {
+          type = types.path;
+          example = "/run/keys/deluge-auth";
+          description = ''
+            The file managing the authentication for deluge, the format of this
+            file is straightforward, each line contains a
+            username:password:level tuple in plaintext. It only has an effect
+            when <option>services.deluge.declarative</option> is set to
+            <literal>true</literal>.
+            See <link xlink:href="https://dev.deluge-torrent.org/wiki/UserGuide/Authentication"/> for
+            more informations.
+          '';
+        };
       };
 
-      deluge.web.enable = mkEnableOption "Deluge Web daemon";
+      deluge.web = {
+        enable = mkEnableOption "Deluge Web daemon";
+        port = mkOption {
+        type = types.port;
+          default = 8112;
+          description = ''
+            Deluge web UI port.
+          '';
+        };
+      };
     };
   };
 
   config = mkIf cfg.enable {
 
+    systemd.tmpfiles.rules = [ "d '${configDir}' 0770 deluge deluge" ]
+    ++ optional (cfg.config ? "download_location")
+      "d '${cfg.config.download_location}' 0770 deluge deluge"
+    ++ optional (cfg.config ? "torrentfiles_location")
+      "d '${cfg.config.torrentfiles_location}' 0770 deluge deluge"
+    ++ optional (cfg.config ? "move_completed_path")
+      "d '${cfg.config.move_completed_path}' 0770 deluge deluge";
+
     systemd.services.deluged = {
       after = [ "network.target" ];
       description = "Deluge BitTorrent Daemon";
       wantedBy = [ "multi-user.target" ];
       path = [ pkgs.deluge ];
       serviceConfig = {
-        ExecStart = "${pkgs.deluge}/bin/deluged -d";
-        # To prevent "Quit & shutdown daemon" from working; we want systemd to manage it!
+        ExecStart = ''
+          ${pkgs.deluge}/bin/deluged \
+            --do-not-daemonize \
+            --config ${configDir}
+        '';
+        # To prevent "Quit & shutdown daemon" from working; we want systemd to
+        # manage it!
         Restart = "on-success";
         User = "deluge";
         Group = "deluge";
+        UMask = "0002";
         LimitNOFILE = cfg.openFilesLimit;
       };
+      preStart = preStart;
     };
 
     systemd.services.delugeweb = mkIf cfg_web.enable {
-      after = [ "network.target" ];
+      after = [ "network.target" "deluged.service"];
+      requires = [ "deluged.service" ];
       description = "Deluge BitTorrent WebUI";
       wantedBy = [ "multi-user.target" ];
       path = [ pkgs.deluge ];
-      serviceConfig.ExecStart = "${pkgs.deluge}/bin/deluge --ui web";
-      serviceConfig.User = "deluge";
-      serviceConfig.Group = "deluge";
+      serviceConfig = {
+        ExecStart = ''
+          ${pkgs.deluge}/bin/deluge-web \
+            --config ${configDir} \
+            --port ${toString cfg.web.port}
+        '';
+        User = "deluge";
+        Group = "deluge";
+      };
+    };
+
+    networking.firewall = mkIf (cfg.declarative && cfg.openFirewall && !(cfg.config.random_port or true)) {
+      allowedTCPPortRanges = singleton (listToRange (cfg.config.listen_ports or listenPortsDefault));
+      allowedUDPPortRanges = singleton (listToRange (cfg.config.listen_ports or listenPortsDefault));
     };
 
     environment.systemPackages = [ pkgs.deluge ];
@@ -58,7 +192,7 @@ in {
     users.users.deluge = {
       group = "deluge";
       uid = config.ids.uids.deluge;
-      home = "/var/lib/deluge/";
+      home = cfg.dataDir;
       createHome = true;
       description = "Deluge Daemon user";
     };
diff --git a/nixos/modules/services/x11/compton.nix b/nixos/modules/services/x11/compton.nix
index 11db0a133d6d..d4357324c870 100644
--- a/nixos/modules/services/x11/compton.nix
+++ b/nixos/modules/services/x11/compton.nix
@@ -7,10 +7,19 @@ let
 
   cfg = config.services.compton;
 
+  literalAttrs = v:
+    if isString v then toString v
+    else if isAttrs v then "{\n"
+      + concatStringsSep "\n" (mapAttrsToList
+        (name: value: "${literalAttrs name} = ${literalAttrs value};")
+        v)
+      + "\n}"
+    else generators.toPretty {} v;
+
   floatBetween = a: b: with lib; with types;
     addCheck str (x: versionAtLeast x a && versionOlder x b);
 
-  pairOf = x: with types; addCheck (listOf x) (y: lib.length y == 2);
+  pairOf = x: with types; addCheck (listOf x) (y: length y == 2);
 
   opacityRules = optionalString (length cfg.opacityRules != 0)
     (concatMapStringsSep ",\n" (rule: ''"${rule}"'') cfg.opacityRules);
@@ -23,8 +32,7 @@ let
       fade-in-step  = ${elemAt cfg.fadeSteps 0};
       fade-out-step = ${elemAt cfg.fadeSteps 1};
       fade-exclude  = ${toJSON cfg.fadeExclude};
-    '' + 
-    optionalString cfg.shadow ''
+    '' + optionalString cfg.shadow ''
 
       # shadows
       shadow = true;
@@ -39,10 +47,7 @@ let
       inactive-opacity = ${cfg.inactiveOpacity};
 
       wintypes:
-      {
-        popup_menu = { opacity = ${cfg.menuOpacity}; }
-        dropdown_menu = { opacity = ${cfg.menuOpacity}; }
-      };
+      ${literalAttrs cfg.wintypes};
 
       opacity-rule = [
         ${opacityRules}
@@ -50,7 +55,7 @@ let
 
       # other options
       backend = ${toJSON cfg.backend};
-      vsync = ${lib.boolToString cfg.vSync};
+      vsync = ${boolToString cfg.vSync};
       refresh-rate = ${toString cfg.refreshRate};
     '' + cfg.extraOptions);
 
@@ -98,7 +103,7 @@ in {
       example = [
         "window_type *= 'menu'"
         "name ~= 'Firefox$'"
-        "focused = 1" 
+        "focused = 1"
       ];
       description = ''
         List of conditions of windows that should not be faded.
@@ -138,7 +143,7 @@ in {
       example = [
         "window_type *= 'menu'"
         "name ~= 'Firefox$'"
-        "focused = 1" 
+        "focused = 1"
       ];
       description = ''
         List of conditions of windows that should have no shadow.
@@ -173,6 +178,15 @@ in {
       '';
     };
 
+    wintypes = mkOption {
+      type = types.attrs;
+      default = { popup_menu = { opacity = cfg.menuOpacity; }; dropdown_menu = { opacity = cfg.menuOpacity; }; };
+      example = {};
+      description = ''
+        Rules for specific window types.
+      '';
+    };
+
     opacityRules = mkOption {
       type = types.listOf types.str;
       default = [];
@@ -201,7 +215,7 @@ in {
         let
           res = x != "none";
           msg = "The type of services.compton.vSync has changed to bool:"
-                + " interpreting ${x} as ${lib.boolToString res}";
+                + " interpreting ${x} as ${boolToString res}";
         in
           if isBool x then x
           else warn msg res;
diff --git a/nixos/modules/services/x11/redshift.nix b/nixos/modules/services/x11/redshift.nix
index b7dd7debcb63..4345a3348081 100644
--- a/nixos/modules/services/x11/redshift.nix
+++ b/nixos/modules/services/x11/redshift.nix
@@ -119,7 +119,13 @@ in {
     # needed so that .desktop files are installed, which geoclue cares about
     environment.systemPackages = [ cfg.package ];
 
-    services.geoclue2.enable = mkIf (cfg.provider == "geoclue2") true;
+    services.geoclue2 = mkIf (cfg.provider == "geoclue2") {
+      enable = true;
+      appConfig."redshift" = {
+        isAllowed = true;
+        isSystem = true;
+      };
+    };
 
     systemd.user.services.redshift = 
     let
diff --git a/nixos/modules/system/boot/loader/grub/grub.nix b/nixos/modules/system/boot/loader/grub/grub.nix
index 99aa7759c954..4e4d14985b0d 100644
--- a/nixos/modules/system/boot/loader/grub/grub.nix
+++ b/nixos/modules/system/boot/loader/grub/grub.nix
@@ -360,6 +360,7 @@ in
       font = mkOption {
         type = types.nullOr types.path;
         default = "${realGrub}/share/grub/unicode.pf2";
+        defaultText = ''"''${pkgs.grub2}/share/grub/unicode.pf2"'';
         description = ''
           Path to a TrueType, OpenType, or pf2 font to be used by Grub.
         '';
diff --git a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
index 940d4c0eb973..ebe37ca10a2d 100644
--- a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
+++ b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
@@ -154,7 +154,7 @@ def remove_old_entries(gens):
         except ValueError:
             pass
     for path in glob.iglob("@efiSysMountPoint@/efi/nixos/*"):
-        if not path in known_paths:
+        if not path in known_paths and not os.path.isdir(path):
             os.unlink(path)
 
 def get_profiles():
diff --git a/nixos/tests/deluge.nix b/nixos/tests/deluge.nix
index b4be5e465cc0..22ad84e7bff1 100644
--- a/nixos/tests/deluge.nix
+++ b/nixos/tests/deluge.nix
@@ -5,25 +5,56 @@ import ./make-test.nix ({ pkgs, ...} : {
   };
 
   nodes = {
-    server =
+    simple = {
+      services.deluge = {
+        enable = true;
+        web.enable = true;
+      };
+      networking.firewall.allowedTCPPorts = [ 8112 ];
+    };
+
+    declarative =
       { ... }:
 
-      { services.deluge = {
+      {
+        services.deluge = {
           enable = true;
-          web.enable = true;
+          openFirewall = true;
+          declarative = true;
+          config = {
+            allow_remote = true;
+            download_location = "/var/lib/deluge/my-download";
+            daemon_port = 58846;
+            listen_ports = [ 6881 6889 ];
+          };
+          web = {
+            enable = true;
+            port =  3142;
+          };
+          authFile = pkgs.writeText "deluge-auth" ''
+            localclient:a7bef72a890:10
+            andrew:password:10
+            user3:anotherpass:5
+          '';
         };
-        networking.firewall.allowedTCPPorts = [ 8112 ];
+        environment.systemPackages = [ pkgs.deluge ];
       };
 
-    client = { };
   };
 
   testScript = ''
     startAll;
 
-    $server->waitForUnit("deluged");
-    $server->waitForUnit("delugeweb");
-    $client->waitForUnit("network.target");
-    $client->waitUntilSucceeds("curl --fail http://server:8112");
+    $simple->waitForUnit("deluged");
+    $simple->waitForUnit("delugeweb");
+    $simple->waitForOpenPort("8112");
+    $declarative->waitForUnit("network.target");
+    $declarative->waitUntilSucceeds("curl --fail http://simple:8112");
+
+    $declarative->waitForUnit("deluged");
+    $declarative->waitForUnit("delugeweb");
+    $declarative->waitUntilSucceeds("curl --fail http://declarative:3142");
+    $declarative->succeed("deluge-console 'help' | grep -q 'rm - Remove a torrent'");
+    $declarative->succeed("deluge-console 'connect 127.0.0.1:58846 andrew password; help' | grep -q 'rm - Remove a torrent'");
   '';
 })
diff --git a/pkgs/applications/altcoins/wasabiwallet/default.nix b/pkgs/applications/altcoins/wasabiwallet/default.nix
new file mode 100644
index 000000000000..9eef471adad2
--- /dev/null
+++ b/pkgs/applications/altcoins/wasabiwallet/default.nix
@@ -0,0 +1,44 @@
+{ stdenv, fetchurl, makeDesktopItem, openssl_1_1, xorg, curl, fontconfig, krb5, zlib, dotnet-sdk }:
+
+stdenv.mkDerivation rec {
+  pname = "wasabiwallet";
+  version = "1.1.5";
+
+	src = fetchurl {
+		url = "https://github.com/zkSNACKs/WalletWasabi/releases/download/v${version}/WasabiLinux-${version}.tar.gz";
+		sha256 = "1iq7qkpq073yq1bz8pam4cbm2myznhpjr3g9afblvmxwgbdjxak0";
+	};
+
+	dontBuild = true;
+	dontPatchELF = true;
+
+	desktopItem = makeDesktopItem {
+		name = "wasabi";
+		exec = "wasabiwallet";
+		desktopName = "Wasabi";
+		genericName = "Bitcoin wallet";
+		comment = meta.description;
+		categories = "Application;Network;Utility;";
+	};
+
+  installPhase = ''
+		mkdir -p $out/opt/${pname} $out/bin $out/share/applications
+		cp -Rv . $out/opt/${pname}
+		cd $out/opt/${pname}
+		for i in $(find . -type f -name '*.so') wassabee
+			do
+				patchelf --set-rpath ${stdenv.lib.makeLibraryPath [ openssl_1_1 stdenv.cc.cc.lib xorg.libX11 curl fontconfig.lib krb5 zlib dotnet-sdk ]} $i
+			done
+		patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" wassabee
+		ln -s $out/opt/${pname}/wassabee $out/bin/${pname}
+		cp -v $desktopItem/share/applications/* $out/share/applications
+	'';
+
+  meta = with stdenv.lib; {
+    description = "Privacy focused Bitcoin wallet";
+    homepage = "https://wasabiwallet.io/";
+    license = licenses.mit;
+    platforms = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ mmahut ];
+  };
+}
diff --git a/pkgs/applications/audio/qjackctl/default.nix b/pkgs/applications/audio/qjackctl/default.nix
index 018dd39580f5..fbb2f498c0b1 100644
--- a/pkgs/applications/audio/qjackctl/default.nix
+++ b/pkgs/applications/audio/qjackctl/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchurl, pkgconfig, alsaLib, libjack2, dbus, qtbase, qttools, qtx11extras }:
 
 stdenv.mkDerivation rec {
-  version = "0.5.7";
+  version = "0.5.8";
   name = "qjackctl-${version}";
 
   # some dependencies such as killall have to be installed additionally
 
   src = fetchurl {
     url = "mirror://sourceforge/qjackctl/${name}.tar.gz";
-    sha256 = "1g6a5j74p45yisl28bw4fcc9nr6b710ikk459p4mp6djh9gs8v95";
+    sha256 = "1r5hf3hcr20n93jrrm7xk2zf6yx264pcr4d10cpybhrancxh602n";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/audio/reaper/default.nix b/pkgs/applications/audio/reaper/default.nix
index fc6a78af0bcf..40e390ab3bbb 100644
--- a/pkgs/applications/audio/reaper/default.nix
+++ b/pkgs/applications/audio/reaper/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   name = "reaper-${version}";
-  version = "5.974";
+  version = "5.978";
 
   src = fetchurl {
     url = "https://www.reaper.fm/files/${stdenv.lib.versions.major version}.x/reaper${builtins.replaceStrings ["."] [""] version}_linux_x86_64.tar.xz";
-    sha256 = "0pmjdh4d1jsplv99nrgjn437bgjp7hqk6fynvqk3lbn1zw3wk0i9";
+    sha256 = "0na7364zxxcic5mq4vaaj4va0g6rhwnwn9fg5gb421iba29ylmhg";
   };
 
   nativeBuildInputs = [ autoPatchelfHook makeWrapper ];
diff --git a/pkgs/applications/graphics/drawpile/default.nix b/pkgs/applications/graphics/drawpile/default.nix
index cba103b0e9e5..31a9fa57b500 100644
--- a/pkgs/applications/graphics/drawpile/default.nix
+++ b/pkgs/applications/graphics/drawpile/default.nix
@@ -59,11 +59,11 @@ let
 
 in stdenv.mkDerivation rec {
   name = "drawpile-${version}";
-  version = "2.1.8";
+  version = "2.1.10";
 
   src = fetchurl {
     url = "https://drawpile.net/files/src/drawpile-${version}.tar.gz";
-    sha256 = "1gm58zb7nh9h6v0i5pr49sfi17piik5jj757nhl0wrd10nwkipn5";
+    sha256 = "074lp5z5kh6qwar3y4ik7gma5mdgafdsb50q425xcd3pv00gy0hm";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/calibre/default.nix b/pkgs/applications/misc/calibre/default.nix
index 99e71d769bea..c05b98a07283 100644
--- a/pkgs/applications/misc/calibre/default.nix
+++ b/pkgs/applications/misc/calibre/default.nix
@@ -5,12 +5,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "3.42.0";
+  version = "3.44.0";
   name = "calibre-${version}";
 
   src = fetchurl {
     url = "https://download.calibre-ebook.com/${version}/${name}.tar.xz";
-    sha256 = "0ymdhws3cb44p3fb24vln1wx6s7qnb8rr241jvm6qbj5rnp984dm";
+    sha256 = "13d3cbn8qbjd8a19qprra6gmib1d818c3zgf3q70kx6b2fq58lzi";
   };
 
   patches = [
diff --git a/pkgs/applications/misc/lutris/default.nix b/pkgs/applications/misc/lutris/default.nix
index e659ed2322ed..3ccceb0e9220 100644
--- a/pkgs/applications/misc/lutris/default.nix
+++ b/pkgs/applications/misc/lutris/default.nix
@@ -31,7 +31,7 @@ let
     graphite2 gtk2 gtk3 udev ncurses wayland libglvnd vulkan-loader
 
     # Lutris
-    gobjectIntrospection gdk_pixbuf pango openssl sqlite xterm libnotify procps
+    gobject-introspection gdk_pixbuf hicolor-icon-theme pango openssl sqlite xterm libnotify procps
 
     # Adventure Game Studio
     allegro dumb
@@ -47,7 +47,7 @@ let
 
     # DOSBox
     SDL_net SDL_sound
- 
+
     # GOG
     glib-networking
 
diff --git a/pkgs/applications/misc/urlscan/default.nix b/pkgs/applications/misc/urlscan/default.nix
index 43861d9f60a6..87800cf90d6d 100644
--- a/pkgs/applications/misc/urlscan/default.nix
+++ b/pkgs/applications/misc/urlscan/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "urlscan";
-  version = "0.9.2";
+  version = "0.9.3";
 
   src = fetchFromGitHub {
     owner = "firecat53";
     repo = pname;
     rev = version;
-    sha256 = "16cc1vvvhylrl9208d253k11rqzi95mg7hrf7xbd0bqxvd6rmxar";
+    sha256 = "0z24k8sk2zfp2pwysyp844vmhr5vbkj74frwy4i0v5pj60i9jl0v";
   };
 
   propagatedBuildInputs = [ python3Packages.urwid ];
diff --git a/pkgs/applications/misc/xterm/default.nix b/pkgs/applications/misc/xterm/default.nix
index f91989e22a9b..ab33612ded97 100644
--- a/pkgs/applications/misc/xterm/default.nix
+++ b/pkgs/applications/misc/xterm/default.nix
@@ -3,14 +3,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "xterm-345";
+  name = "xterm-346";
 
   src = fetchurl {
     urls = [
      "ftp://ftp.invisible-island.net/xterm/${name}.tgz"
      "https://invisible-mirror.net/archives/xterm/${name}.tgz"
    ];
-    sha256 = "0dfmy9vgpmxi8rsnv2lb2lmq5ny26f0pjhcj348l0d3rs61afjb6";
+    sha256 = "0xwamhawgh77q2nlibciv77hznirwhnbs3r52rl4sdaqq1rpscng";
   };
 
   buildInputs =
diff --git a/pkgs/applications/networking/bittorrentsync/1.4.x.nix b/pkgs/applications/networking/bittorrentsync/1.4.x.nix
deleted file mode 100644
index 9d57cdaaf20d..000000000000
--- a/pkgs/applications/networking/bittorrentsync/1.4.x.nix
+++ /dev/null
@@ -1,9 +0,0 @@
-{ stdenv, fetchurl, ... } @ args:
-
-import ./generic.nix (args // {
-  version = "1.4.111";
-  sha256s = {
-    "x86_64-linux" = "0bw3ds3ndcnkry5mpv645z2bfi5z387bh0f7b35blxq1yv93r83f";
-    "i686-linux"   = "1qwaj7l7nsd4afx7ksb4b1c22mki9qa40803v9x1a8bhbdfhkczk";
-  };
-})
diff --git a/pkgs/applications/networking/bittorrentsync/2.0.x.nix b/pkgs/applications/networking/bittorrentsync/2.0.x.nix
deleted file mode 100644
index d2db3eec26e8..000000000000
--- a/pkgs/applications/networking/bittorrentsync/2.0.x.nix
+++ /dev/null
@@ -1,9 +0,0 @@
-{ stdenv, fetchurl, ... } @ args:
-
-import ./generic.nix (args // {
-  version = "2.3.8";
-  sha256s = {
-    "x86_64-linux" = "02n5s561cz3mprg682mrbmh3qai42dh64jgi05rqy9s6wgbn66ly";
-    "i686-linux"   = "118qrnxc7gvm30rsz0xfx6dlxmrr0dk5ajrvszhy06ww7xvqhzji";
-  };
-})
diff --git a/pkgs/applications/networking/bittorrentsync/generic.nix b/pkgs/applications/networking/bittorrentsync/generic.nix
deleted file mode 100644
index 1075aea8db3a..000000000000
--- a/pkgs/applications/networking/bittorrentsync/generic.nix
+++ /dev/null
@@ -1,41 +0,0 @@
-{ stdenv, fetchurl, version, sha256s, ... }:
-
-let
-  arch = {
-    "x86_64-linux" = "x64";
-    "i686-linux" = "i386";
-  }.${stdenv.hostPlatform.system} or throwSystem;
-  libPath = stdenv.lib.makeLibraryPath [ stdenv.cc.libc ];
-  throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";
-in
-
-stdenv.mkDerivation rec {
-  name = "btsync-${version}";
-  inherit version;
-
-  src = fetchurl {
-    # annoyingly, downloads for 1.4 and 2.3 do not follow the same URL layout; this is
-    # a simple work-around, in place of overriding the url in the caller.
-    urls = [
-      "https://download-cdn.getsync.com/${version}/linux-${arch}/BitTorrent-Sync_${arch}.tar.gz"
-      "http://syncapp.bittorrent.com/${version}/btsync_${arch}-${version}.tar.gz"
-    ];
-    sha256 = sha256s.${stdenv.hostPlatform.system} or throwSystem;
-  };
-
-  dontStrip = true; # Don't strip, otherwise patching the rpaths breaks
-  sourceRoot = ".";
-
-  installPhase = ''
-    install -D btsync "$out/bin/btsync"
-    patchelf --interpreter "$(< $NIX_CC/nix-support/dynamic-linker)" --set-rpath ${libPath} "$out/bin/btsync"
-  '';
-
-  meta = {
-    description = "Automatically sync files via secure, distributed technology";
-    homepage    = https://www.getsync.com/;
-    license     = stdenv.lib.licenses.unfreeRedistributable;
-    platforms   = stdenv.lib.platforms.linux;
-    maintainers = with stdenv.lib.maintainers; [ domenkozar thoughtpolice cwoac ];
-  };
-}
diff --git a/pkgs/applications/networking/browsers/opera/default.nix b/pkgs/applications/networking/browsers/opera/default.nix
index e95e762a4149..e55e939dd4aa 100644
--- a/pkgs/applications/networking/browsers/opera/default.nix
+++ b/pkgs/applications/networking/browsers/opera/default.nix
@@ -40,7 +40,7 @@
 let
 
   mirror = https://get.geo.opera.com/pub/opera/desktop;
-  version = "58.0.3135.127";
+  version = "60.0.3255.109";
 
   rpath = stdenv.lib.makeLibraryPath [
 
@@ -96,7 +96,7 @@ in stdenv.mkDerivation {
 
   src = fetchurl {
     url = "${mirror}/${version}/linux/opera-stable_${version}_amd64.deb";
-    sha256 = "1nk4zfmb2dv464r1q6n9b66zg7a8h5xfwypzqd791rhmsfjrxn51";
+    sha256 = "0y3cjjzp41pa15sw8bp7n5ab8j8b1kk5h11b4pl6w8spsyk2cpqh";
   };
 
   unpackCmd = "${dpkg}/bin/dpkg-deb -x $curSrc .";
diff --git a/pkgs/applications/networking/browsers/tor-browser-bundle/default.nix b/pkgs/applications/networking/browsers/tor-browser-bundle/default.nix
index 834be5cd3020..80879baa2835 100644
--- a/pkgs/applications/networking/browsers/tor-browser-bundle/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle/default.nix
@@ -280,7 +280,7 @@ stdenv.mkDerivation rec {
       TZ=":" \
       \
       DISPLAY="\$DISPLAY" \
-      XAUTHORITY="\$XAUTHORITY" \
+      XAUTHORITY="\''${XAUTHORITY:-}" \
       DBUS_SESSION_BUS_ADDRESS="\$DBUS_SESSION_BUS_ADDRESS" \
       \
       HOME="\$HOME" \
diff --git a/pkgs/applications/networking/cluster/kubernetes/default.nix b/pkgs/applications/networking/cluster/kubernetes/default.nix
index 3967883af55e..3a1248f44177 100644
--- a/pkgs/applications/networking/cluster/kubernetes/default.nix
+++ b/pkgs/applications/networking/cluster/kubernetes/default.nix
@@ -15,13 +15,13 @@ with lib;
 
 stdenv.mkDerivation rec {
   name = "kubernetes-${version}";
-  version = "1.14.1";
+  version = "1.14.2";
 
   src = fetchFromGitHub {
     owner = "kubernetes";
     repo = "kubernetes";
     rev = "v${version}";
-    sha256 = "1cyln9nwry290fpffx6xxy0ll7ybib5ifja7nnq93f3f2p0sj421";
+    sha256 = "17jb05c5i9y725jf5ad2ki99wyi2dv2jdhfgcxrki9fzjsx967g2";
   };
 
   buildInputs = [ removeReferencesTo makeWrapper which go rsync go-bindata ];
diff --git a/pkgs/applications/networking/cluster/terraform-providers/elasticsearch/default.nix b/pkgs/applications/networking/cluster/terraform-providers/elasticsearch/default.nix
index b9f28cbd6cb0..ae456185a80d 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/elasticsearch/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/elasticsearch/default.nix
@@ -1,24 +1,22 @@
-{ stdenv, fetchFromGitHub, buildGoPackage }:
-buildGoPackage rec {
+{ stdenv, fetchFromGitHub, buildGoModule }:
+buildGoModule rec {
   name = "terraform-provider-elasticsearch-${version}";
-  version = "0.6.0";
-
-  goPackagePath = "github.com/phillbaker/terraform-provider-elasticsearch";
-
-  # ./deps.nix was generated using the work-around described in:
-  # https://github.com/kamilchm/go2nix/issues/19
-  goDeps = ./deps.nix;
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "phillbaker";
     repo = "terraform-provider-elasticsearch";
     rev = "v${version}";
-    sha256 = "04i7jwhm1mg4m8p7y6yg83j76fx0ncallzbza1g1wc5cjjbkvgs2";
+    sha256 = "0ci9gcn9ijdbx25wa99iy0b3sl7akqa7b6gi9wnnl1dawpqznj7v";
   };
 
+  modSha256 = "1xk21xswqwpv34j4ba4fj8lcbvfdd12x7rq1hrdyd21mdhmrhw0p";
+
+  subPackages = [ "." ];
+
   # Terraform allow checking the provider versions, but this breaks
   # if the versions are not provided via file paths.
-  postBuild = "mv go/bin/terraform-provider-elasticsearch{,_v${version}}";
+  postInstall = "mv $out/bin/terraform-provider-elasticsearch{,_v${version}}";
 
   meta = with stdenv.lib; {
     description = "Terraform provider for elasticsearch";
diff --git a/pkgs/applications/networking/cluster/terraform-providers/elasticsearch/deps.nix b/pkgs/applications/networking/cluster/terraform-providers/elasticsearch/deps.nix
deleted file mode 100644
index b89e20cd4864..000000000000
--- a/pkgs/applications/networking/cluster/terraform-providers/elasticsearch/deps.nix
+++ /dev/null
@@ -1,75 +0,0 @@
-# This file was generated by https://github.com/kamilchm/go2nix v1.3.0
-[
-  {
-    goPackagePath = "github.com/aws/aws-sdk-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/aws/aws-sdk-go";
-      rev = "512bdaf8bec30abd545b440447cebb57b53d3af9";
-      sha256 = "1j7kjk6i8vg4nwlsxjypqz3gc9j1a9x8r3bg99w1x2ap3vrh7sl8";
-    };
-  }
-  {
-    goPackagePath = "github.com/deoxxa/aws_signing_client";
-    fetch = {
-      type = "git";
-      url = "https://github.com/deoxxa/aws_signing_client";
-      rev = "c20ee106809eacdffcc81ac7cb984261f8e3067e";
-      sha256 = "01cw1f6hzgx1df730vdwd7vhbn7yl6zv3sr42iz4sd1dcdqwzlkq";
-    };
-  }
-  {
-    goPackagePath = "github.com/hashicorp/terraform";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/terraform";
-      rev = "dbce85d85ff0beebc660b3d1805b4ef15361af00";
-      sha256 = "17kd3ln1i40qb8fll5918rvgackzf1ibmr7li1p9vky4ki3iwr0l";
-    };
-  }
-  {
-    goPackagePath = "github.com/mailru/easyjson";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mailru/easyjson";
-      rev = "3fdea8d05856a0c8df22ed4bc71b3219245e4485";
-      sha256 = "0g3crph77yhv4ipdnwqc32z4cp87ahi4ikad5kyy6q4znnxliz74";
-    };
-  }
-  {
-    goPackagePath = "github.com/olivere/elastic";
-    fetch = {
-      type = "git";
-      url = "https://github.com/olivere/elastic";
-      rev = "2a5234d20b058173aaea6835e671fc83eee777b0";
-      sha256 = "08r62d29m6f7d5hwb9zm5b612wbvzd9sn97nb48q174gbk8685yw";
-    };
-  }
-  {
-    goPackagePath = "github.com/pkg/errors";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pkg/errors";
-      rev = "816c9085562cd7ee03e7f8188a1cfd942858cded";
-      sha256 = "1ws5crb7c70wdicavl6qr4g03nn6m92zd6wwp9n2ygz5c8rmxh8k";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/olivere/elastic.v5";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/olivere/elastic.v5";
-      rev = "b708306d715bea9b983685e94ab4602cdc9f988b";
-      sha256 = "0ks0h0ik0aqjm8dm2imbyd1z7rfmqiwilf3bc9nnplp9hc07471y";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/olivere/elastic.v6";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/olivere/elastic.v6";
-      rev = "e6cae211ee802eab70248a68fe2cb03b616744c9";
-      sha256 = "0nbf4mr31gxm4zn5w362y22mh98ckl3d0bxli4f3rwx6zw12arfg";
-    };
-  }
-]
diff --git a/pkgs/applications/networking/dropbox/default.nix b/pkgs/applications/networking/dropbox/default.nix
index 47ae6307ce7e..d820d40f7a34 100644
--- a/pkgs/applications/networking/dropbox/default.nix
+++ b/pkgs/applications/networking/dropbox/default.nix
@@ -36,7 +36,7 @@ buildFHSUserEnv {
     libICE libSM libX11 libXcomposite libXdamage libXext libXfixes libXrender
     libXxf86vm libxcb xkeyboardconfig
     curl dbus firefox-bin fontconfig freetype gcc glib gnutar libxml2 libxslt
-    procps zlib mesa libxshmfence libpthreadstubs
+    procps zlib mesa libxshmfence libpthreadstubs libappindicator
   ];
 
   extraInstallCommands = ''
diff --git a/pkgs/applications/networking/instant-messengers/franz/default.nix b/pkgs/applications/networking/instant-messengers/franz/default.nix
index d33761ba772e..2c692055f9ae 100644
--- a/pkgs/applications/networking/instant-messengers/franz/default.nix
+++ b/pkgs/applications/networking/instant-messengers/franz/default.nix
@@ -3,12 +3,12 @@
 , gnome2, dbus, nss, nspr, alsaLib, cups, expat, udev, libnotify, xdg_utils }:
 
 let
-  version = "5.0.0-beta.19";
+  version = "5.1.0";
 in stdenv.mkDerivation rec {
   name = "franz-${version}";
   src = fetchurl {
     url = "https://github.com/meetfranz/franz/releases/download/v${version}/franz_${version}_amd64.deb";
-    sha256 = "1b9b8y19iqx8bnax7hbh9rkjfxk8a9gqb1akrcxwwfi46l816gyy";
+    sha256 = "a474d2e9c6fb99abfc4c7e9290a0e52eef62233fa25c962afdde75fe151277d0";
   };
 
   # don't remove runtime deps
diff --git a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
index 71deacecea0e..92416dce6c8a 100644
--- a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
@@ -7,7 +7,7 @@ let
 
   # Please keep the version x.y.0.z and do not update to x.y.76.z because the
   # source of the latter disappears much faster.
-  version = "8.44.0.40";
+  version = "8.46.0.60";
 
   rpath = stdenv.lib.makeLibraryPath [
     alsaLib
@@ -58,7 +58,7 @@ let
     if stdenv.hostPlatform.system == "x86_64-linux" then
       fetchurl {
         url = "https://repo.skype.com/deb/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb";
-        sha256 = "08b5nfx1c8czx5nga3zlg60rxnyg2iy627vnaq8cf9dv620vbrw8";
+        sha256 = "0v7a28zmgx1mxqgyfrj8byvjs9ibnirqplly8ll221gns8qjvrls";
       }
     else
       throw "Skype for linux is not supported on ${stdenv.hostPlatform.system}";
diff --git a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
index c7b990db6022..f906d4712f99 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
@@ -4,11 +4,11 @@ let
   mkTelegram = args: qt5.callPackage (import ./generic.nix args) { };
   stableVersion = {
     stable = true;
-    version = "1.7.0";
-    sha256Hash = "1plfby243hf65wjmppq1qnqmp25pgi4x3awqd4h83ly9hn8qdwfk";
+    version = "1.7.3";
+    sha256Hash = "0y0chdfxq75ydx8lz40yfpbx8ycm8vdkl5dvll6glxjq5m21kxf9";
     # svn log svn://svn.archlinux.org/community/telegram-desktop/trunk
-    archPatchesRevision = "464796";
-    archPatchesHash = "1bq7r69k3i9p1csdsca0w41jyz6fbyn4qriv3lg7s28j9s803kw8";
+    archPatchesRevision = "476826";
+    archPatchesHash = "1vnlvba60hxd5jlh0fvsa50xmb9xgcphdsx6j1ld7f12m7ik68zr";
   };
 in {
   stable = mkTelegram stableVersion;
diff --git a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/generic.nix b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/generic.nix
index c32e6b186b7a..8276e839940f 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/generic.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/generic.nix
@@ -1,7 +1,7 @@
 { stable, version, sha256Hash, archPatchesRevision, archPatchesHash }:
 
 { mkDerivation, lib, fetchFromGitHub, fetchsvn
-, pkgconfig, pythonPackages, cmake, wrapGAppsHook
+, pkgconfig, pythonPackages, cmake, wrapGAppsHook, gcc8
 , qtbase, qtimageformats, gtk3, libappindicator-gtk3, libnotify, xdg_utils
 , dee, ffmpeg, openalSoft, minizip, libopus, alsaLib, libpulseaudio, range-v3
 }:
@@ -29,7 +29,8 @@ mkDerivation rec {
   };
 
   # TODO: libtgvoip.patch no-gtk2.patch
-  patches = [ "${archPatches}/tdesktop.patch" ];
+  # TODO: Avoid tdesktop_lottie_animation_qtdebug.patch and tdesktop_qtlottie_qtdebug.patch
+  patches = [ "${archPatches}/tdesktop.patch" "${archPatches}/tdesktop_lottie_animation_qtdebug.patch" ];
 
   postPatch = ''
     substituteInPlace Telegram/SourceFiles/platform/linux/linux_libs.cpp \
@@ -38,7 +39,7 @@ mkDerivation rec {
       --replace '"notify"' '"${libnotify}/lib/libnotify.so"'
   '';
 
-  nativeBuildInputs = [ pkgconfig pythonPackages.gyp cmake wrapGAppsHook ];
+  nativeBuildInputs = [ pkgconfig pythonPackages.gyp cmake wrapGAppsHook gcc8 ];
 
   # We want to run wrapProgram manually (with additional parameters)
   dontWrapGApps = true;
@@ -77,6 +78,9 @@ mkDerivation rec {
     pushd "Telegram/ThirdParty/libtgvoip"
     patch -Np1 -i "${archPatches}/libtgvoip.patch"
     popd
+    pushd "Telegram/ThirdParty/qtlottie"
+    patch -Np1 -i "${archPatches}/tdesktop_qtlottie_qtdebug.patch"
+    popd
 
     sed -i Telegram/gyp/telegram_linux.gypi \
       -e 's,/usr,/does-not-exist,g' \
diff --git a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
index b477a194faf1..2ce42fd9f835 100644
--- a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
@@ -4,7 +4,7 @@
 , qtimageformats, qtlocation, qtquickcontrols, qtquickcontrols2, qtscript, qtsvg
 , qttools, qtwayland, qtwebchannel, qtwebengine
 # Runtime
-, coreutils, libjpeg_turbo, pciutils, procps, utillinux
+, coreutils, libjpeg_turbo, pciutils, procps, utillinux, libv4l
 , pulseaudioSupport ? true, libpulseaudio ? null
 }:
 
@@ -72,6 +72,7 @@ in stdenv.mkDerivation {
 
       makeWrapper $packagePath/zoom $out/bin/zoom-us \
         --prefix PATH : "${makeBinPath [ coreutils glib.dev pciutils procps qttools.dev utillinux ]}" \
+        --prefix LD_PRELOAD : "${libv4l}/lib/libv4l/v4l2convert.so" \
         --run "cd $packagePath"
 
       runHook postInstall
diff --git a/pkgs/applications/networking/irc/hexchat/default.nix b/pkgs/applications/networking/irc/hexchat/default.nix
index f03e4c4e9e34..34c4fcf0c88c 100644
--- a/pkgs/applications/networking/irc/hexchat/default.nix
+++ b/pkgs/applications/networking/irc/hexchat/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, pkgconfig, gtk2, lua, perl, python2
 , libtool, pciutils, dbus-glib, libcanberra-gtk2, libproxy
-, libsexy, enchant, libnotify, openssl, intltool
+, libsexy, enchant1, libnotify, openssl, intltool
 , desktop-file-utils, hicolor-icon-theme
 , autoconf, automake, autoconf-archive
 }:
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
 
   #hexchat and heachat-text loads enchant spell checking library at run time and so it needs to have route to the path
   patchPhase = ''
-    sed -i "s,libenchant.so.1,${enchant}/lib/libenchant.so.1,g" src/fe-gtk/sexy-spell-entry.c
+    sed -i "s,libenchant.so.1,${enchant1}/lib/libenchant.so.1,g" src/fe-gtk/sexy-spell-entry.c
   '';
 
   preConfigure = ''
diff --git a/pkgs/applications/office/spice-up/default.nix b/pkgs/applications/office/spice-up/default.nix
index c0ee9bc81b76..a99ac7e44b78 100644
--- a/pkgs/applications/office/spice-up/default.nix
+++ b/pkgs/applications/office/spice-up/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "spice-up";
-  version = "1.8.1";
+  version = "1.8.2";
 
   src = fetchFromGitHub {
     owner = "Philip-Scott";
     repo = "Spice-up";
     rev = version;
-    sha256 = "0vgs2z6yr0d5vwb04wd2s22144pdrjhqik9xs69q4dxjxa84iw0h";
+    sha256 = "1pix911l4ddn50026a5sbpqfzba6fmw40m1yzbknmkgd2ny28f0m";
   };
 
   USER = "pbuilder";
diff --git a/pkgs/applications/office/timetrap/default.nix b/pkgs/applications/office/timetrap/default.nix
index ad0d5c636f36..efeb23b3e83d 100644
--- a/pkgs/applications/office/timetrap/default.nix
+++ b/pkgs/applications/office/timetrap/default.nix
@@ -3,7 +3,7 @@
 bundlerApp {
   pname = "timetrap";
   gemdir = ./.;
-  exes = [ "timetrap" ];
+  exes = [ "t" "timetrap" ];
 
   meta = with lib; {
     description = "A simple command line time tracker written in ruby";
diff --git a/pkgs/applications/office/zim/default.nix b/pkgs/applications/office/zim/default.nix
index c31284c2747f..a41064666d58 100644
--- a/pkgs/applications/office/zim/default.nix
+++ b/pkgs/applications/office/zim/default.nix
@@ -9,11 +9,11 @@
 
 python3Packages.buildPythonApplication rec {
   name = "zim-${version}";
-  version = "0.71.0";
+  version = "0.71.1";
 
   src = fetchurl {
     url = "http://zim-wiki.org/downloads/${name}.tar.gz";
-    sha256 = "0mr3911ls5zp3z776ysrdm3sg89zg29r3ip23msydcdbl8wymw30";
+    sha256 = "0d7whwpbklkhamlvysa0yyix1hchkpdynimf3gp1xbibg8mqzbxc";
   };
 
   buildInputs = [ gtk3 gobject-introspection wrapGAppsHook ];
diff --git a/pkgs/applications/radio/urh/default.nix b/pkgs/applications/radio/urh/default.nix
index ced3bccd7b67..11a132ba06f7 100644
--- a/pkgs/applications/radio/urh/default.nix
+++ b/pkgs/applications/radio/urh/default.nix
@@ -2,14 +2,14 @@
 , hackrf, rtl-sdr, airspy, limesuite }:
 
 python3Packages.buildPythonApplication rec {
-  name = "urh-${version}";
-  version = "2.5.7";
+  pname = "urh";
+  version = "2.7.0";
 
   src = fetchFromGitHub {
     owner = "jopohl";
-    repo = "urh";
+    repo = pname;
     rev = "v${version}";
-    sha256 = "110fwlj2fw8jgrsgqfkha7lx8f06w0ymh51mgpckx8a0wycznhcy";
+    sha256 = "0yxv38p8a2srk9c55jj96vcib6m6pb6m485ysfg2ilwjzipx2ab0";
   };
 
   buildInputs = [ hackrf rtl-sdr airspy limesuite ];
@@ -20,9 +20,9 @@ python3Packages.buildPythonApplication rec {
   doCheck = false;
 
   meta = with stdenv.lib; {
-    inherit (src.meta) homepage;
+    homepage = "https://github.com/jopohl/urh";
     description = "Universal Radio Hacker: investigate wireless protocols like a boss";
-    license = licenses.asl20;
+    license = licenses.gpl3;
     platforms = platforms.linux;
     maintainers = with maintainers; [ fpletz ];
   };
diff --git a/pkgs/applications/science/astronomy/gildas/default.nix b/pkgs/applications/science/astronomy/gildas/default.nix
index 592225b16966..e5a9fca33374 100644
--- a/pkgs/applications/science/astronomy/gildas/default.nix
+++ b/pkgs/applications/science/astronomy/gildas/default.nix
@@ -7,8 +7,8 @@ let
 in
 
 stdenv.mkDerivation rec {
-  srcVersion = "may19a";
-  version = "20190501_a";
+  srcVersion = "jun19b";
+  version = "20190601_b";
   name = "gildas-${version}";
 
   src = fetchurl {
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     # source code of the previous release to a different directory
     urls = [ "http://www.iram.fr/~gildas/dist/gildas-src-${srcVersion}.tar.xz"
       "http://www.iram.fr/~gildas/dist/archive/gildas/gildas-src-${srcVersion}.tar.xz" ];
-    sha256 = "f6132116bce0ea716a6eb13a63f538d27567a8bfb159f7d567abb9dac5429e30";
+    sha256 = "363d191afdb1fda12ec19d6b9c3ab4189e7c3b036e78f7359d17671d846118ce";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/science/biology/picard-tools/default.nix b/pkgs/applications/science/biology/picard-tools/default.nix
index 91468eaf819b..5fc222bb2993 100644
--- a/pkgs/applications/science/biology/picard-tools/default.nix
+++ b/pkgs/applications/science/biology/picard-tools/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "picard-tools-${version}";
-  version = "2.19.2";
+  version = "2.20.2";
 
   src = fetchurl {
     url = "https://github.com/broadinstitute/picard/releases/download/${version}/picard.jar";
-    sha256 = "0dfap1whga03r0fh3adi684dyp9agfdi96hb2aqskgr9jp0z69rb";
+    sha256 = "0qpc6pi3fmzv8rs5cmk3dd4clrkzbrngsl384b5g0y7471lhavbi";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/science/chemistry/quantum-espresso/default.nix b/pkgs/applications/science/chemistry/quantum-espresso/default.nix
index 777b3499bedc..5e1c77e24751 100644
--- a/pkgs/applications/science/chemistry/quantum-espresso/default.nix
+++ b/pkgs/applications/science/chemistry/quantum-espresso/default.nix
@@ -4,12 +4,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "6.4";
+  version = "6.4.1";
   name = "quantum-espresso-${version}";
 
   src = fetchurl {
     url = "https://gitlab.com/QEF/q-e/-/archive/qe-${version}/q-e-qe-${version}.tar.gz";
-    sha256 = "1zjblzf0xzwmhmpjm56xvv8wsv5jmp5a204irzyicmd77p86c4vq";
+    sha256 = "027skhp2zzx0f4mh6azqjljdimchak5cdn13v4x7aj5q2zvfkmxh";
   };
 
   passthru = {
diff --git a/pkgs/applications/science/electronics/gtkwave/default.nix b/pkgs/applications/science/electronics/gtkwave/default.nix
index e4c743ccdef5..4830e2a032a9 100644
--- a/pkgs/applications/science/electronics/gtkwave/default.nix
+++ b/pkgs/applications/science/electronics/gtkwave/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "gtkwave-${version}";
-  version = "3.3.100";
+  version = "3.3.101";
 
   src = fetchurl {
     url    = "mirror://sourceforge/gtkwave/${name}.tar.gz";
-    sha256 = "1z60i5nh8dz8j9ii63fwaw7k0p3x0scp91478cxmdv4xhp4njlxa";
+    sha256 = "1j6capxwgi8aj3sgqg1r7161icni9y8y93g1rl3bzd3s40jcyhsz";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/applications/version-management/git-repo/default.nix b/pkgs/applications/version-management/git-repo/default.nix
index b629c8fe9109..04ae45f75b39 100644
--- a/pkgs/applications/version-management/git-repo/default.nix
+++ b/pkgs/applications/version-management/git-repo/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   name = "git-repo-${version}";
-  version = "1.13.2";
+  version = "1.13.3";
 
   src = fetchFromGitHub {
     owner = "android";
     repo = "tools_repo";
     rev = "v${version}";
-    sha256 = "0ll1yzwgpayps7c05j8kf1m4zvww7crmlyy7xa0w5g2krbjvjzvi";
+    sha256 = "0wyr6fyc9kzzw6y2cxvri35ib1sh156n6lnv119j5r1rzvc2lg6r";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/version-management/src/default.nix b/pkgs/applications/version-management/src/default.nix
index e41d40beb591..049f2756a551 100644
--- a/pkgs/applications/version-management/src/default.nix
+++ b/pkgs/applications/version-management/src/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "src-${version}";
-  version = "1.25";
+  version = "1.26";
 
   src = fetchurl {
     url = "http://www.catb.org/~esr/src/${name}.tar.gz";
-    sha256 = "0qd10w8fwbrgaj8sx49q6cfhqq3ylhwn7nl9v6kxi1yjlw2p098p";
+    sha256 = "06npsnf2bfjgcs7wilhcqn24zn286nyy4qyp3yp88zapkxzlap23";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/window-managers/sway/default.nix b/pkgs/applications/window-managers/sway/default.nix
index 3299811c4978..7d5c4c05131d 100644
--- a/pkgs/applications/window-managers/sway/default.nix
+++ b/pkgs/applications/window-managers/sway/default.nix
@@ -1,35 +1,28 @@
-{ stdenv, fetchFromGitHub, fetchpatch
+{ stdenv, fetchFromGitHub, makeWrapper
 , meson, ninja
 , pkgconfig, scdoc
 , wayland, libxkbcommon, pcre, json_c, dbus, libevdev
 , pango, cairo, libinput, libcap, pam, gdk_pixbuf
-, wlroots, wayland-protocols
+, wlroots, wayland-protocols, swaybg
 }:
 
 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
   pname = "sway";
-  version = "1.0";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "swaywm";
     repo = "sway";
     rev = version;
-    sha256 = "09cndc2nl39d3l7g5634xp0pxcz60pvc5277mfw89r22mh0j78rx";
+    sha256 = "0yhn9zdg9mzfhn97c440lk3pw6122nrhx0is5sqmvgr6p814f776";
   };
 
   patches = [
-    # Fix for a compiler warning that causes a build failure
-    # (see https://github.com/swaywm/sway/issues/3862):
-    (fetchpatch {
-      url = "https://github.com/swaywm/sway/commit/bcde298a719f60b9913133dbd2a169dedbc8dd7d.patch";
-      sha256 = "0r583nmqvq43ib93yv6flw8pj833v32lbs0q0xld56s3rnzvvdcp";
-    })
     ./sway-config-no-nix-store-references.patch
     ./load-configuration-from-etc.patch
   ];
 
-  nativeBuildInputs = [ pkgconfig meson ninja scdoc ];
+  nativeBuildInputs = [ pkgconfig meson ninja scdoc makeWrapper ];
 
   buildInputs = [
     wayland libxkbcommon pcre json_c dbus libevdev
@@ -44,6 +37,14 @@ stdenv.mkDerivation rec {
     "-Dtray=enabled" "-Dman-pages=enabled"
   ];
 
+  postInstall = ''
+    wrapProgram $out/bin/sway --prefix PATH : "${swaybg}/bin"
+  '';
+
+  postPatch = ''
+    sed -i "s/version: '1.0'/version: '${version}'/" meson.build
+  '';
+
   meta = with stdenv.lib; {
     description = "i3-compatible tiling Wayland compositor";
     homepage    = https://swaywm.org;
diff --git a/pkgs/build-support/kernel/make-initrd.nix b/pkgs/build-support/kernel/make-initrd.nix
index 7ad1affb65a3..7a5642e565de 100644
--- a/pkgs/build-support/kernel/make-initrd.nix
+++ b/pkgs/build-support/kernel/make-initrd.nix
@@ -16,10 +16,16 @@
 , name ? "initrd"
 , compressor ? "gzip -9n"
 , prepend ? []
+, lib
 }:
+let 
+  # !!! Move this into a public lib function, it is probably useful for others
+  toValidStoreName = x: with builtins; 
+    lib.concatStringsSep "-" (filter (x: !(isList x)) (split "[^a-zA-Z0-9_=.?-]+" x));
 
-stdenv.mkDerivation rec {
+in stdenv.mkDerivation rec {
   inherit name;
+
   builder = ./make-initrd.sh;
 
   makeUInitrd = stdenv.hostPlatform.platform.kernelTarget == "uImage";
@@ -36,8 +42,12 @@ stdenv.mkDerivation rec {
   # Note: we don't use closureInfo yet, as that won't build with nix-1.x.
   # See #36268.
   exportReferencesGraph =
-    map (x: [("closure-" + baseNameOf x.symlink) x.object]) contents;
+    lib.zipListsWith 
+      (x: i: [("closure-${toValidStoreName (baseNameOf x.symlink)}-${toString i}") x.object]) 
+      contents 
+      (lib.range 0 (lib.length contents - 1));
   pathsFromGraph = ./paths-from-graph.pl;
 
   inherit compressor prepend;
 }
+
diff --git a/pkgs/common-updater/scripts/update-source-version b/pkgs/common-updater/scripts/update-source-version
index bc2c68feaeaa..591ffa6ca5ba 100755
--- a/pkgs/common-updater/scripts/update-source-version
+++ b/pkgs/common-updater/scripts/update-source-version
@@ -86,14 +86,10 @@ if [ $(grep -c "$oldHash" "$nixFile") != 1 ]; then
     die "Couldn't locate old source hash '$oldHash' (or it appeared more than once) in '$nixFile'!"
 fi
 
-oldUrl=$(nix-instantiate $systemArg --eval -E "with import ./. {}; builtins.elemAt $attr.src.drvAttrs.urls 0" | tr -d '"')
+oldUrl=$(nix-instantiate $systemArg --eval -E "with import ./. {}; builtins.elemAt ($attr.src.drvAttrs.urls or [ $attr.src.url ]) 0" | tr -d '"')
 
 if [ -z "$oldUrl" ]; then
-    oldUrl=$(nix-instantiate $systemArg --eval -E "with import ./. {}; $attr.src.url" | tr -d '"')
-
-    if [ -z "$oldUrl" ]; then
-      die "Couldn't evaluate source url from '$attr.src'!"
-    fi
+    die "Couldn't evaluate source url from '$attr.src'!"
 fi
 
 drvName=$(nix-instantiate $systemArg --eval -E "with import ./. {}; (builtins.parseDrvName $attr.name).name" | tr -d '"')
@@ -109,13 +105,13 @@ if [ "$oldVersion" = "$newVersion" ]; then
 fi
 
 # Escape regex metacharacter that are allowed in store path names
-oldVersion=$(echo "$oldVersion" | sed -re 's|[.+]|\\&|g')
-oldUrl=$(echo "$oldUrl" | sed -re 's|[${}.+]|\\&|g')
+oldVersionEscaped=$(echo "$oldVersion" | sed -re 's|[.+]|\\&|g')
+oldUrlEscaped=$(echo "$oldUrl" | sed -re 's|[${}.+]|\\&|g')
 
-if [ $(grep -c -E "^\s*(let\b)?\s*$versionKey\s*=\s*\"$oldVersion\"" "$nixFile") = 1 ]; then
-    pattern="/\b$versionKey\b\s*=/ s|\"$oldVersion\"|\"$newVersion\"|"
-elif [ $(grep -c -E "^\s*(let\b)?\s*name\s*=\s*\"[^\"]+-$oldVersion\"" "$nixFile") = 1 ]; then
-    pattern="/\bname\b\s*=/ s|-$oldVersion\"|-$newVersion\"|"
+if [ $(grep -c -E "^\s*(let\b)?\s*$versionKey\s*=\s*\"$oldVersionEscaped\"" "$nixFile") = 1 ]; then
+    pattern="/\b$versionKey\b\s*=/ s|\"$oldVersionEscaped\"|\"$newVersion\"|"
+elif [ $(grep -c -E "^\s*(let\b)?\s*name\s*=\s*\"[^\"]+-$oldVersionEscaped\"" "$nixFile") = 1 ]; then
+    pattern="/\bname\b\s*=/ s|-$oldVersionEscaped\"|-$newVersion\"|"
 else
     die "Couldn't figure out where out where to patch in new version in '$attr'!"
 fi
@@ -128,7 +124,7 @@ fi
 
 # Replace new URL
 if [ -n "$newUrl" ]; then
-    sed -i "$nixFile" -re "s|\"$oldUrl\"|\"$newUrl\"|"
+    sed -i "$nixFile" -re "s|\"$oldUrlEscaped\"|\"$newUrl\"|"
 
     if cmp -s "$nixFile" "$nixFile.bak"; then
         die "Failed to replace source URL '$oldUrl' to '$newUrl' in '$attr'!"
diff --git a/pkgs/data/fonts/inter/default.nix b/pkgs/data/fonts/inter/default.nix
index f11f13283d55..589acbcee5cc 100644
--- a/pkgs/data/fonts/inter/default.nix
+++ b/pkgs/data/fonts/inter/default.nix
@@ -1,7 +1,7 @@
 { lib, fetchzip }:
 
 let
-  version = "3.5";
+  version = "3.7";
 in fetchzip {
   name = "inter-${version}";
 
@@ -12,14 +12,14 @@ in fetchzip {
     unzip -j $downloadedFile \*.otf -d $out/share/fonts/opentype
   '';
 
-  sha256 = "0zqixzzbb3n1j4jvpjm0hlxc32j53hgq4j078gihjkhgvjhsklf2";
+  sha256 = "1ja1v3605vp09azpabgmk710kic85zxwi4kksmqj9z805fmxddp6";
 
   meta = with lib; {
     homepage = https://rsms.me/inter/;
     description = "A typeface specially designed for user interfaces";
     license = licenses.ofl;
     platforms = platforms.all;
-    maintainers = with maintainers; [ demize ];
+    maintainers = with maintainers; [ demize dtzWill ];
   };
 }
 
diff --git a/pkgs/data/fonts/libertinus/default.nix b/pkgs/data/fonts/libertinus/default.nix
index 578550bbe452..62aad87c902b 100644
--- a/pkgs/data/fonts/libertinus/default.nix
+++ b/pkgs/data/fonts/libertinus/default.nix
@@ -1,7 +1,7 @@
 { lib, fetchFromGitHub }:
 
 let
-  version = "6.8";
+  version = "6.9";
 in fetchFromGitHub rec {
   name = "libertinus-${version}";
 
@@ -14,7 +14,7 @@ in fetchFromGitHub rec {
     install -m444 -Dt $out/share/fonts/opentype *.otf
     install -m444 -Dt $out/share/doc/${name}    *.txt
   '';
-  sha256 = "0iwbw3sw8rcsifpzw72g3cz0a960scv7cib8mwrw53282waqq2gc";
+  sha256 = "0765a7w0askkhrjmjk638gcm9h6fcm1jpaza8iw9afr3sz1s0xlq";
 
   meta = with lib; {
     description = "A fork of the Linux Libertine and Linux Biolinum fonts";
diff --git a/pkgs/data/fonts/national-park/default.nix b/pkgs/data/fonts/national-park/default.nix
new file mode 100644
index 000000000000..bc8fc8041a81
--- /dev/null
+++ b/pkgs/data/fonts/national-park/default.nix
@@ -0,0 +1,24 @@
+{ lib, fetchzip }:
+
+let
+  pname = "national-park-typeface";
+  version = "206464";
+in fetchzip {
+  name = "${pname}-${version}";
+  url = "https://files.cargocollective.com/c${version}/NationalPark.zip";
+
+  postFetch = ''
+    mkdir -p $out/share/fonts
+    unzip -j $downloadedFile National\*.otf -d $out/share/fonts/opentype/
+  '';
+
+  sha256 = "044gh4xcasp8i9ny6z4nmns1am2pk5krc4ann2afq35v9bnl2q5d";
+
+  meta = with lib; {
+    description = ''Typeface designed to mimic the national park service
+    signs that are carved using a router bit'';
+    homepage = https://nationalparktypeface.com/;
+    license = licenses.ofl;
+    maintainers = with maintainers; [ dtzWill ];
+  };
+}
diff --git a/pkgs/data/fonts/public-sans/default.nix b/pkgs/data/fonts/public-sans/default.nix
index cfcf25633406..ae9cf31e30d8 100644
--- a/pkgs/data/fonts/public-sans/default.nix
+++ b/pkgs/data/fonts/public-sans/default.nix
@@ -1,7 +1,7 @@
 { lib, fetchzip }:
 
 let
-  version = "1.003";
+  version = "1.004";
 in fetchzip rec {
   name = "public-sans-${version}";
 
@@ -12,7 +12,7 @@ in fetchzip rec {
     unzip $downloadedFile fonts/{otf,variable}/\*.\[ot\]tf -d $out/share/
   '';
 
-  sha256 = "02ranwr1bw4n9n1ljw234nzhj2a0hgradniib37nh10maark5wg3";
+  sha256 = "1d9ll6gvvlmlykv868lq7xmwldlfjp94k0rjqifipg3q1qv051lg";
 
   meta = with lib; {
     description = "A strong, neutral, principles-driven, open source typeface for text or display";
diff --git a/pkgs/desktops/gnome-2/default.nix b/pkgs/desktops/gnome-2/default.nix
index b1a2d6ae7faf..95e6d0f12b03 100644
--- a/pkgs/desktops/gnome-2/default.nix
+++ b/pkgs/desktops/gnome-2/default.nix
@@ -47,9 +47,9 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   libbonoboui = callPackage ./platform/libbonoboui { };
 
-  gtkhtml = callPackage ./platform/gtkhtml { };
+  gtkhtml = callPackage ./platform/gtkhtml { enchant = pkgs.enchant1; };
 
-  gtkhtml4 = callPackage ./platform/gtkhtml/4.x.nix { };
+  gtkhtml4 = callPackage ./platform/gtkhtml/4.x.nix { enchant = pkgs.enchant1; };
 
   gtkglext = callPackage ./platform/gtkglext { };
 
diff --git a/pkgs/desktops/gnome-2/platform/gtkhtml/4.x.nix b/pkgs/desktops/gnome-2/platform/gtkhtml/4.x.nix
index 493f88290f3a..f38ad7f24911 100644
--- a/pkgs/desktops/gnome-2/platform/gtkhtml/4.x.nix
+++ b/pkgs/desktops/gnome-2/platform/gtkhtml/4.x.nix
@@ -1,5 +1,5 @@
-{ stdenv, fetchurl, pkgconfig, gtk3, intltool,
-GConf, enchant, isocodes, gnome_icon_theme, gsettings-desktop-schemas }:
+{ stdenv, fetchurl, pkgconfig, gtk3, intltool, fetchpatch
+, GConf, enchant, isocodes, gnome_icon_theme, gsettings-desktop-schemas }:
 
 stdenv.mkDerivation rec {
   version = "4.10.0";
diff --git a/pkgs/desktops/gnome-3/apps/gnome-maps/default.nix b/pkgs/desktops/gnome-3/apps/gnome-maps/default.nix
index a059ec3ac3ce..25faf2676b82 100644
--- a/pkgs/desktops/gnome-3/apps/gnome-maps/default.nix
+++ b/pkgs/desktops/gnome-3/apps/gnome-maps/default.nix
@@ -5,13 +5,13 @@
 
 let
   pname = "gnome-maps";
-  version = "3.32.2";
+  version = "3.32.2.1";
 in stdenv.mkDerivation rec {
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "1yvwzdfxjdgx4478l2i240ssvbr8hm5sg4krc1gw2ps08sgap7yx";
+    sha256 = "1m191iq1gjaqz79ci3dkbmwrkxp7pzknngimlf5bqib5x8yairlb";
   };
 
   doCheck = true;
diff --git a/pkgs/desktops/gnome-3/apps/gnome-nettool/default.nix b/pkgs/desktops/gnome-3/apps/gnome-nettool/default.nix
index 00a76318b697..37401af3ce60 100644
--- a/pkgs/desktops/gnome-3/apps/gnome-nettool/default.nix
+++ b/pkgs/desktops/gnome-3/apps/gnome-nettool/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = pname;
-      attrPath = "gnom3.gnome-nettool";
+      attrPath = "gnome3.${pname}";
       versionPolicy = "none";
     };
   };
diff --git a/pkgs/desktops/gnome-3/core/gnome-control-center/default.nix b/pkgs/desktops/gnome-3/core/gnome-control-center/default.nix
index cfd20044c6c6..6331aa9eb149 100644
--- a/pkgs/desktops/gnome-3/core/gnome-control-center/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-control-center/default.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-control-center";
-  version = "3.32.1";
+  version = "3.32.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0xpcmwgnn29syi2kfxc8233a5f3j8cij5wcn76xmsmwxvxz5r85l";
+    sha256 = "03np0mhfl9kkdw4cb711pda0cli9zgh2bq2gqn2zwbdi3qnhk9gs";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome-3/core/gnome-software/default.nix b/pkgs/desktops/gnome-3/core/gnome-software/default.nix
index ab4b360221e5..4a5366a72e70 100644
--- a/pkgs/desktops/gnome-3/core/gnome-software/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-software/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   name = "gnome-software-${version}";
-  version = "3.32.2";
+  version = "3.32.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-software/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "12kw5vyg8jy0xiq1shfh4ksar2dpyzcdxbyx8lrp9494d606nrlx";
+    sha256 = "1r24q2c0i5xwp7dahw4wzycrhijix0nl7bxq1x0za57qm62ysfl9";
   };
 
   patches = [
diff --git a/pkgs/desktops/gnome-3/core/rygel/default.nix b/pkgs/desktops/gnome-3/core/rygel/default.nix
index 5e701e488f26..c38e677a4217 100644
--- a/pkgs/desktops/gnome-3/core/rygel/default.nix
+++ b/pkgs/desktops/gnome-3/core/rygel/default.nix
@@ -28,14 +28,14 @@
 
 stdenv.mkDerivation rec {
   pname = "rygel";
-  version = "0.38.0";
+  version = "0.38.1";
 
   # TODO: split out lib
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "03ky18hwcz362lbhqm1zm0ax2a075r69xms5cznchn9p9w8z5axc";
+    sha256 = "1w8bi2rw91qyfny1zxhy32k4qn62hdjl2m38f75cp7wv6494d7w0";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome-3/default.nix b/pkgs/desktops/gnome-3/default.nix
index 8680e3ed81da..151581b73eb9 100644
--- a/pkgs/desktops/gnome-3/default.nix
+++ b/pkgs/desktops/gnome-3/default.nix
@@ -347,7 +347,7 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   pidgin-im-gnome-shell-extension = callPackage ./misc/pidgin { };
 
-  gtkhtml = callPackage ./misc/gtkhtml { };
+  gtkhtml = callPackage ./misc/gtkhtml { enchant = pkgs.enchant1; };
 
   pomodoro = callPackage ./misc/pomodoro { };
 
diff --git a/pkgs/desktops/gnome-3/misc/gitg/default.nix b/pkgs/desktops/gnome-3/misc/gitg/default.nix
index cb4c5c05cb0b..94703f375b21 100644
--- a/pkgs/desktops/gnome-3/misc/gitg/default.nix
+++ b/pkgs/desktops/gnome-3/misc/gitg/default.nix
@@ -1,8 +1,8 @@
 { stdenv
 , fetchurl
 , fetchpatch
-, vala_0_42
-, intltool
+, vala
+, gettext
 , pkgconfig
 , gtk3
 , glib
@@ -24,34 +24,35 @@
 , meson
 , ninja
 , python3
+, hicolor-icon-theme
+, libdazzle
 }:
 
 stdenv.mkDerivation rec {
   pname = "gitg";
-  version = "3.30.1";
+  version = "3.32.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1fz8q1aiql6k740savdjh0vzbyhcflgf94cfdhvzcrrvm929n2ss";
+    sha256 = "1wzsv7bh0a2w70f938hkpzbb9xkyrp3bil65c0q3yf2v72nbbn81";
   };
 
   patches = [
-    # Fix build with latest libgit2-glib
+    # https://gitlab.gnome.org/GNOME/gitg/issues/213
     (fetchpatch {
-      url = https://gitlab.gnome.org/GNOME/gitg/commit/42bceea265f53fe7fd4a41037b936deed975fc6c.patch;
-      sha256 = "1xq245rsi1bi66lswk33pdiazfaagxf77836ds5q73900rx4r7fw";
+      url = "https://gitlab.gnome.org/GNOME/gitg/merge_requests/83.patch";
+      sha256 = "1f7wx1d3k5pnp8zbrqssip57b9jxn3hc7a83psm7fny970qmd18z";
     })
   ];
 
   postPatch = ''
     chmod +x meson_post_install.py
     patchShebangs meson_post_install.py
-    sed -i '/gtk-update-icon-cache/s/^/#/' meson_post_install.py
 
     substituteInPlace tests/libgitg/test-commit.vala --replace "/bin/bash" "${bash}/bin/bash"
   '';
 
-  doCheck = false; # FAIL: tests-gitg gtk_style_context_add_provider_for_screen: assertion 'GDK_IS_SCREEN (screen)' failed
+  doCheck = true;
 
   enableParallelBuilding = true;
 
@@ -63,6 +64,7 @@ stdenv.mkDerivation rec {
     gtksourceview
     gtkspell3
     json-glib
+    libdazzle
     libgee
     libgit2-glib
     libpeas
@@ -72,12 +74,13 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     gobject-introspection
-    intltool
+    hicolor-icon-theme
+    gettext
     meson
     ninja
     pkgconfig
     python3
-    vala_0_42 # fails build with 0.44, drop in >3.30.1
+    vala
     wrapGAppsHook
   ];
 
diff --git a/pkgs/desktops/gnome-3/misc/gtkhtml/default.nix b/pkgs/desktops/gnome-3/misc/gtkhtml/default.nix
index 543453a2bd31..b8cce222f939 100644
--- a/pkgs/desktops/gnome-3/misc/gtkhtml/default.nix
+++ b/pkgs/desktops/gnome-3/misc/gtkhtml/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, gtk3, intltool
+{ stdenv, fetchurl, pkgconfig, gtk3, intltool, fetchpatch
 , gnome3, enchant, isocodes, gsettings-desktop-schemas }:
 
 stdenv.mkDerivation rec {
diff --git a/pkgs/desktops/gnome-3/update.nix b/pkgs/desktops/gnome-3/update.nix
index 2ee72d46993d..f42b67239505 100644
--- a/pkgs/desktops/gnome-3/update.nix
+++ b/pkgs/desktops/gnome-3/update.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, writeScript, python3, common-updater-scripts, coreutils, gnugrep, gnused }:
+{ stdenv, lib, writeScript, python3, common-updater-scripts }:
 { packageName, attrPath ? packageName, versionPolicy ? "odd-unstable" }:
 
 let
@@ -9,7 +9,7 @@ let
     package_name="$1"
     attr_path="$2"
     version_policy="$3"
-    PATH=${lib.makeBinPath [ common-updater-scripts coreutils gnugrep gnused python ]}
+    PATH=${lib.makeBinPath [ common-updater-scripts python ]}
     latest_tag=$(python "${./find-latest-version.py}" "$package_name" "$version_policy" "stable")
     update-source-version "$attr_path" "$latest_tag"
   '';
diff --git a/pkgs/development/compilers/julia/shared.nix b/pkgs/development/compilers/julia/shared.nix
index 6706cf1e2bd4..131b72624842 100644
--- a/pkgs/development/compilers/julia/shared.nix
+++ b/pkgs/development/compilers/julia/shared.nix
@@ -173,16 +173,11 @@ stdenv.mkDerivation rec {
       "USE_SYSTEM_ZLIB=1"
     ];
 
-  NIX_CFLAGS_COMPILE = [ "-fPIC" ];
-
   LD_LIBRARY_PATH = makeLibraryPath [
     arpack fftw fftwSinglePrec gmp libgit2 mpfr openblas openlibm
     openspecfun pcre2
   ];
 
-  dontStrip = true;
-  dontPatchELF = true;
-
   enableParallelBuilding = true;
 
   doCheck = !stdenv.isDarwin;
diff --git a/pkgs/development/compilers/ocaml/4.08.nix b/pkgs/development/compilers/ocaml/4.08.nix
index 53d4ceef92a7..a4172e8f2b7c 100644
--- a/pkgs/development/compilers/ocaml/4.08.nix
+++ b/pkgs/development/compilers/ocaml/4.08.nix
@@ -1,8 +1,8 @@
 import ./generic.nix {
   major_version = "4";
   minor_version = "08";
-  patch_version = "0+beta3";
-  sha256 = "02pk4bxrgqb12hvpbxyqnl4nwr4g2h96wsfzfd1k8vj8h0jmxzc4";
+  patch_version = "0+rc1";
+  sha256 = "014yincnkfg0j2jy0cn30l5hb1y4sf2qf1gy9ix9ghgn32iw5ndk";
 
   # If the executable is stripped it does not work
   dontStrip = true;
diff --git a/pkgs/development/compilers/purescript/purescript/default.nix b/pkgs/development/compilers/purescript/purescript/default.nix
index 67818bfa1dc9..d25cd9fee770 100644
--- a/pkgs/development/compilers/purescript/purescript/default.nix
+++ b/pkgs/development/compilers/purescript/purescript/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, zlib, gmp, ncurses5, lib }:
+{ stdenv, pkgs, fetchurl, zlib, gmp, ncurses5, lib }:
 
 # from justinwoo/easy-purescript-nix
 # https://github.com/justinwoo/easy-purescript-nix/blob/d383972c82620a712ead4033db14110497bc2c9c/purs.nix
@@ -18,19 +18,19 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "purescript";
-  version = "0.12.5";
+  version = "0.13.0";
 
   src =
     if stdenv.isDarwin
     then
     fetchurl {
       url = "https://github.com/${pname}/${pname}/releases/download/v${version}/macos.tar.gz";
-      sha256 = "15j9lkrl15dicx37bmh0199b3qdixig7w24wvdzi20jqbacz8nkn";
+      sha256 = "0xpisy38gj6fgyyzm6fdl0v819dhjmil4634xxangvhvs7jf5il0";
     }
     else
     fetchurl {
       url = "https://github.com/${pname}/${pname}/releases/download/v${version}/linux64.tar.gz";
-      sha256 = "07dva5gxq77g787krscv4dsz5088fzkvpmm9fwxw9a59jszzs7kq";
+      sha256 = "06g5q69yv6c3alq9vr8zjqqzamlii7xf6vj9j52akjq5lww214ba";
     };
 
 
@@ -50,6 +50,11 @@ in stdenv.mkDerivation rec {
     mkdir -p $out/etc/bash_completion.d/
     $PURS --bash-completion-script $PURS > $out/etc/bash_completion.d/purs-completion.bash
   '';
+
+  passthru.tests = {
+    minimal-module = pkgs.callPackage ./test-minimal-module {};
+  };
+
   meta = with stdenv.lib; {
     description = "A strongly-typed functional programming language that compiles to JavaScript";
     homepage = http://www.purescript.org/;
diff --git a/pkgs/development/compilers/purescript/purescript/test-minimal-module/Main.js b/pkgs/development/compilers/purescript/purescript/test-minimal-module/Main.js
new file mode 100644
index 000000000000..a3547e206b7c
--- /dev/null
+++ b/pkgs/development/compilers/purescript/purescript/test-minimal-module/Main.js
@@ -0,0 +1,8 @@
+"use strict"
+
+exports.log = function (s) {
+    return function () {
+        console.log(s);
+        return {};
+    };
+};
diff --git a/pkgs/development/compilers/purescript/purescript/test-minimal-module/Main.purs b/pkgs/development/compilers/purescript/purescript/test-minimal-module/Main.purs
new file mode 100644
index 000000000000..8bf5a23f3469
--- /dev/null
+++ b/pkgs/development/compilers/purescript/purescript/test-minimal-module/Main.purs
@@ -0,0 +1,9 @@
+module Main where
+
+foreign import data Effect :: Type -> Type
+data Unit = Unit
+
+foreign import log :: String -> Effect Unit
+
+main :: Effect Unit
+main = log "hello world"
diff --git a/pkgs/development/compilers/purescript/purescript/test-minimal-module/default.nix b/pkgs/development/compilers/purescript/purescript/test-minimal-module/default.nix
new file mode 100644
index 000000000000..5f01298960cd
--- /dev/null
+++ b/pkgs/development/compilers/purescript/purescript/test-minimal-module/default.nix
@@ -0,0 +1,11 @@
+{ runCommand, purescript, nodejs }:
+
+runCommand "purescript-test-minimal-module" {} ''
+  ${purescript}/bin/purs compile -o ./output ${./.}/Main.purs
+
+  echo 'require("./output/Main/index.js").main()' > node.js
+
+  ${nodejs}/bin/node node.js | grep "hello world" || echo "did not output hello world"
+
+  touch $out
+''
diff --git a/pkgs/development/coq-modules/mathcomp/default.nix b/pkgs/development/coq-modules/mathcomp/default.nix
index a9933692db3b..c769ab5521e8 100644
--- a/pkgs/development/coq-modules/mathcomp/default.nix
+++ b/pkgs/development/coq-modules/mathcomp/default.nix
@@ -5,12 +5,14 @@ with builtins // stdenv.lib;
 let
   # sha256 of released mathcomp versions
   mathcomp-sha256 = {
+    "1.9.0" = "0lid9zaazdi3d38l8042lczb02pw5m9wq0yysiilx891hgq2p81r";
     "1.8.0" = "07l40is389ih8bi525gpqs3qp4yb2kl11r9c8ynk1ifpjzpnabwp";
     "1.7.0" = "0wnhj9nqpx2bw6n1l4i8jgrw3pjajvckvj3lr4vzjb3my2lbxdd1";
     "1.6.1" = "1ilw6vm4dlsdv9cd7kmf0vfrh2kkzr45wrqr8m37miy0byzr4p9i";
   };
   # versions of coq compatible with released mathcomp versions
   mathcomp-coq-versions = {
+    "1.9.0" = flip elem ["8.7" "8.8" "8.9" "8.10"];
     "1.8.0" = flip elem ["8.7" "8.8" "8.9"];
     "1.7.0" = flip elem ["8.6" "8.7" "8.8" "8.9"];
     "1.6.1" = flip elem ["8.5"];
@@ -56,20 +58,22 @@ let
       echo "-I ." >> Make
       echo "-R . mathcomp.all" >> Make
       '';
+      is-released = builtins.isString mathcomp-version;
+      custom-version = if is-released then mathcomp-version else "custom";
 
       # the base set of attributes for mathcomp
       attrs = rec {
-        name = "coq${coq.coq-version}-${pkgname}-${mathcomp-version}";
+        name = "coq${coq.coq-version}-${pkgname}-${custom-version}";
 
         # used in ssreflect
-        version = mathcomp-version;
+        version = custom-version;
 
-        src = fetchFromGitHub {
+        src = if is-released then fetchFromGitHub {
           owner = "math-comp";
           repo = "math-comp";
           rev = "mathcomp-${mathcomp-version}";
           sha256 = mathcomp-sha256.${mathcomp-version};
-        };
+        } else mathcomp-version;
 
         nativeBuildInputs = optionals withDoc [ graphviz ];
         buildInputs = [ ncurses which ] ++ (with coq.ocamlPackages; [ ocaml findlib camlp5 ]);
@@ -117,6 +121,7 @@ getAttrOr = a: n: a."${n}" or (throw a.error);
 
 mathcompCorePkgs_1_7 = mathcompGen "1.7.0";
 mathcompCorePkgs_1_8 = mathcompGen "1.8.0";
+mathcompCorePkgs_1_9 = mathcompGen "1.9.0";
 mathcompCorePkgs     = recurseIntoAttrs
   (mapDerivationAttrset dontDistribute (mathcompGen default-mathcomp-version));
 
@@ -126,6 +131,7 @@ in rec {
 inherit mathcompGenSingle;
 mathcomp_1_7_single = getAttrOr (mathcompGenSingle "1.7.0") "single";
 mathcomp_1_8_single = getAttrOr (mathcompGenSingle "1.8.0") "single";
+mathcomp_1_9_single = getAttrOr (mathcompGenSingle "1.9.0") "single";
 mathcomp_single     = dontDistribute
  (getAttrOr (mathcompGenSingle default-mathcomp-version) "single");
 
@@ -133,15 +139,19 @@ mathcomp_single     = dontDistribute
 # generates an attribute set {ssreflect = <drv>; ... character = <drv>; all = <drv>;}.
 # each of these have a special attribute overrideMathcomp which
 # must be used instead of overrideAttrs in order to also fix the dependencies
-inherit mathcompGen mathcompCorePkgs_1_7 mathcompCorePkgs_1_8 mathcompCorePkgs;
+inherit mathcompGen mathcompCorePkgs
+        mathcompCorePkgs_1_7 mathcompCorePkgs_1_8 mathcompCorePkgs_1_9;
+
 
+mathcomp     = getAttrOr mathcompCorePkgs     "all";
 mathcomp_1_7 = getAttrOr mathcompCorePkgs_1_7 "all";
 mathcomp_1_8 = getAttrOr mathcompCorePkgs_1_8 "all";
-mathcomp     = getAttrOr mathcompCorePkgs     "all";
+mathcomp_1_9 = getAttrOr mathcompCorePkgs_1_9 "all";
 
-ssreflect     = getAttrOr mathcompCorePkgs     "ssreflect";
+ssreflect     = getAttrOr mathcompCorePkgs    "ssreflect";
 
 } //
 (mapAttrs' (n: pkg: {name = "mathcomp-${n}"; value = pkg;}) mathcompCorePkgs) //
 (mapAttrs' (n: pkg: {name = "mathcomp-${n}_1_7"; value = pkg;}) mathcompCorePkgs_1_7) //
-(mapAttrs' (n: pkg: {name = "mathcomp-${n}_1_8"; value = pkg;}) mathcompCorePkgs_1_8)
+(mapAttrs' (n: pkg: {name = "mathcomp-${n}_1_8"; value = pkg;}) mathcompCorePkgs_1_8) //
+(mapAttrs' (n: pkg: {name = "mathcomp-${n}_1_9"; value = pkg;}) mathcompCorePkgs_1_9)
diff --git a/pkgs/development/coq-modules/mathcomp/extra.nix b/pkgs/development/coq-modules/mathcomp/extra.nix
index 3666d54a7869..c30ba19b75a3 100644
--- a/pkgs/development/coq-modules/mathcomp/extra.nix
+++ b/pkgs/development/coq-modules/mathcomp/extra.nix
@@ -7,6 +7,7 @@ let
 param = {
   finmap = {
     version-sha256 = {
+      "1.2.1" = "0jryb5dq8js3imbmwrxignlk5zh8gwfb1wr4b1s7jbwz410vp7zf";
       "1.2.0" = "0b6wrdr0d7rcnv86s37zm80540jl2wmiyf39ih7mw3dlwli2cyj4";
       "1.1.0" = "05df59v3na8jhpsfp7hq3niam6asgcaipg2wngnzxzqnl86srp2a";
       "1.0.0" = "0sah7k9qm8sw17cgd02f0x84hki8vj8kdz7h15i7rmz08rj0whpa";
@@ -27,18 +28,42 @@ param = {
   };
  analysis = {
     version-sha256 = {
+      "0.2.2" = "1d5dwg9di2ppdzfg21zr0a691zigb5kz0lcw263jpyli1nrq7cvk";
       "0.2.0" = "1186xjxgns4ns1szyi931964bjm0mp126qzlv10mkqqgfw07nhrd";
       "0.1.0" = "0hwkr2wzy710pcyh274fcarzdx8sv8myp16pv0vq5978nmih46al";
     };
     description = "Analysis library compatible with Mathematical Components";
   };
+  real-closed = {
+    version-sha256 = {
+      "1.0.3" = "1xbzkzqgw5p42dx1liy6wy8lzdk39zwd6j14fwvv5735k660z7yb";
+      "1.0.2" = "0097pafwlmzd0gyfs31bxpi1ih04i72nxhn99r93aj20mn7mcsgl";
+      "1.0.1" = "0j81gkjbza5vg89v4n9z598mfdbql416963rj4b8fzm7dp2r4rxg";
+    };
+    description = "Mathematical Components Library on real closed fields";
+  };
 };
 versions = {
+  "1.9.0" = {
+    finmap.version = "1.2.1";
+    bigenough.version = "1.0.0";
+    analysis = {
+      version = "0.2.2";
+      core-deps = with coqPackages; [ mathcomp_1_9-field ];
+      extra-deps = with coqPackages; [ mathcomp_1_9-finmap mathcomp_1_9-bigenough ];
+    };
+    multinomials = {};
+    real-closed = {
+      version = "1.0.3";
+      core-deps = with coqPackages; [ mathcomp_1_9-field ];
+      extra-deps = with coqPackages; [ mathcomp_1_9-bigenough ];
+    };
+  }; 
   "1.8.0" = {
-    finmap.version = "1.2.0";
+    finmap.version = "1.2.1";
     bigenough.version = "1.0.0";
     analysis = {
-      version = "0.2.0";
+      version = "0.2.2";
       core-deps = with coqPackages; [ mathcomp_1_8-field ];
       extra-deps = with coqPackages; [ mathcomp_1_8-finmap mathcomp_1_8-bigenough ];
     };
@@ -47,6 +72,11 @@ versions = {
       core-deps = with coqPackages; [ mathcomp_1_8-algebra ];
       extra-deps = with coqPackages; [ mathcomp_1_8-finmap mathcomp_1_8-bigenough ];
     };
+    real-closed = {
+      version = "1.0.3";
+      core-deps = with coqPackages; [ mathcomp_1_8-field ];
+      extra-deps = with coqPackages; [ mathcomp_1_8-bigenough ];
+    };
   };
   "1.7.0" = {
     finmap.version = "1.1.0";
@@ -61,6 +91,11 @@ versions = {
       core-deps = with coqPackages; [ mathcomp_1_7-algebra ];
       extra-deps = with coqPackages; [ mathcomp_1_7-finmap_1_0 mathcomp_1_7-bigenough ];
     };
+    real-closed = {
+      version = "1.0.1";
+      core-deps = with coqPackages; [ mathcomp_1_8-field ];
+      extra-deps = with coqPackages; [ mathcomp_1_8-bigenough ];
+    };
   };
 };
 
@@ -71,12 +106,17 @@ packageGen = {
   owner ? "math-comp",
   core-deps ? [ coqPackages.mathcomp-ssreflect ],
   extra-deps ? [],
-  coq-versions ? ["8.6" "8.7" "8.8" "8.9"],
   mathcomp ? current-mathcomp,
+  compatibleCoqVersions ? null,
   license ? mathcomp.meta.license,
   # mandatory
   package, version ? "broken", version-sha256, description
   }:
+  let
+    theCompatibleCoqVersions = if compatibleCoqVersions == null
+                               then mathcomp.compatibleCoqVersions
+                               else compatibleCoqVersions;
+  in
   { "${package}" = let from = src; in
 
   stdenv.mkDerivation rec {
@@ -105,8 +145,8 @@ packageGen = {
 
     passthru = {
       inherit version-sha256;
-      compatibleCoqVersions = if meta.broken then _: false else
-                              v: builtins.elem v coq-versions;
+      compatibleCoqVersions = if meta.broken then _: false
+                              else theCompatibleCoqVersions;
     };
   };
   };
@@ -115,14 +155,16 @@ current-versions = versions."${current-mathcomp.version}" or {};
 
 select = x: mapAttrs (n: pkg: {package = n;} // pkg) (recursiveUpdate param x);
 
-all = (mapAttrs' (n: pkg:
-        {name = "mathcomp_1_7-${n}";
-         value = (packageGen ({mathcomp = coqPackages.mathcomp_1_7;} // pkg))."${n}";})
-        (select versions."1.7.0")) //
-      (mapAttrs' (n: pkg:
-        {name = "mathcomp_1_8-${n}";
-         value = (packageGen ({mathcomp = coqPackages.mathcomp_1_8;} // pkg))."${n}";})
-        (select versions."1.8.0")) //
+for-version = v: suffix: (mapAttrs' (n: pkg:
+        {name = "mathcomp_${suffix}-${n}";
+         value = (packageGen ({
+             mathcomp = coqPackages."mathcomp_${suffix}";
+           } // pkg))."${n}";})
+        (select versions."${v}"));
+
+all = (for-version "1.7.0" "1_7") //
+      (for-version "1.8.0" "1_8") //
+      (for-version "1.9.0" "1_9") //
      (recurseIntoAttrs (mapDerivationAttrset dontDistribute (
         mapAttrs' (n: pkg: {name = "mathcomp-${n}"; value = (packageGen pkg)."${n}";})
               (select current-versions))));
diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index f5c6f3da14aa..8d61454a5f68 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -1282,4 +1282,8 @@ self: super: {
   ats-pkg = super.ats-pkg.override { dhall = self.dhall_1_23_0; };
   dhall-to-cabal = super.dhall-to-cabal.override { dhall = self.dhall_1_23_0; };
 
+  # Test suite doesn't work with current QuickCheck
+  # https://github.com/pruvisto/heap/issues/11
+  heap = dontCheck super.heap;
+
 } // import ./configuration-tensorflow.nix {inherit pkgs haskellLib;} self super
diff --git a/pkgs/development/haskell-modules/configuration-hackage2nix.yaml b/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
index 6a1ba4da69f5..871ad5c3ab3e 100644
--- a/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
@@ -5430,7 +5430,6 @@ broken-packages:
   - hdr-histogram
   - HDRUtils
   - headergen
-  - heap
   - heartbeat-streams
   - heatitup
   - heatitup-complete
diff --git a/pkgs/development/interpreters/proglodyte-wasm/default.nix b/pkgs/development/interpreters/proglodyte-wasm/default.nix
index 9a30ae7d8a85..5710f1066757 100644
--- a/pkgs/development/interpreters/proglodyte-wasm/default.nix
+++ b/pkgs/development/interpreters/proglodyte-wasm/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, clang, python, v8_static, coreutils }:
+{ stdenv, fetchFromGitHub, cmake, clang, python, v8, coreutils }:
 
 let
   sexpr_wasm_prototype = stdenv.mkDerivation {
@@ -45,7 +45,7 @@ stdenv.mkDerivation {
   installPhase = ''
     export DESTDIR=$out
     export MKTEMPDIR=${coreutils}/bin
-    export D8DIR=${v8_static}/bin
+    export D8DIR=${v8}/bin
     export SWDIR=${sexpr_wasm_prototype}/bin
     make install
   '';
diff --git a/pkgs/development/interpreters/python/cpython/2.7/default.nix b/pkgs/development/interpreters/python/cpython/2.7/default.nix
index 894a9b084c68..bc90d93a7e3d 100644
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@@ -22,6 +22,7 @@
 , sourceVersion
 , sha256
 , passthruFun
+, static ? false
 }:
 
 assert x11Support -> tcl != null
@@ -164,7 +165,8 @@ let
   ]
     # Never even try to use lchmod on linux,
     # don't rely on detecting glibc-isms.
-  ++ optional stdenv.hostPlatform.isLinux "ac_cv_func_lchmod=no";
+  ++ optional stdenv.hostPlatform.isLinux "ac_cv_func_lchmod=no"
+  ++ optional static "LDFLAGS=-static";
 
   buildInputs =
     optional (stdenv ? cc && stdenv.cc.libc != null) stdenv.cc.libc ++
diff --git a/pkgs/development/libraries/cppzmq/default.nix b/pkgs/development/libraries/cppzmq/default.nix
index 9933d1034af8..4c63e93e5c41 100644
--- a/pkgs/development/libraries/cppzmq/default.nix
+++ b/pkgs/development/libraries/cppzmq/default.nix
@@ -2,18 +2,24 @@
 
 stdenv.mkDerivation rec {
   name = "cppzmq-${version}";
-  version = "4.2.3";
+  version = "4.3.0";
 
   src = fetchFromGitHub {
     owner = "zeromq";
     repo = "cppzmq";
     rev = "v${version}";
-    sha256 = "1yjs25ra5s8zs0rhk50w3f1rrrl80hhq784lwdhh1m3risk740sa";
+    sha256 = "1g45cdny1m08zw4l261bqcqfdb825mnwjwqcf35bkyc03fr4213l";
   };
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ zeromq ];
 
+  cmakeFlags = [
+    # Tests try to download googletest at compile time; there is no option
+    # to use a system one and no simple way to download it beforehand.
+    "-DCPPZMQ_BUILD_TESTS=OFF"
+  ];
+
   meta = with stdenv.lib; {
     homepage = https://github.com/zeromq/cppzmq;
     license = licenses.bsd2;
diff --git a/pkgs/development/libraries/croaring/default.nix b/pkgs/development/libraries/croaring/default.nix
new file mode 100644
index 000000000000..6e6ee2479d44
--- /dev/null
+++ b/pkgs/development/libraries/croaring/default.nix
@@ -0,0 +1,28 @@
+{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake }:
+
+stdenv.mkDerivation rec {
+  pname = "croaring";
+  version = "0.2.61";
+
+  src = fetchFromGitHub {
+    owner = "RoaringBitmap";
+    repo = "CRoaring";
+    rev = "v${version}";
+    sha256 = "14y8iwv6b6gg7hgs00yqg8rwx4vwbb1zs2s99lxa51zx9vp1alcn";
+  };
+
+  patches = fetchpatch {
+    url = "https://github.com/RoaringBitmap/CRoaring/commit/8d8c60736f506b2b8f1c365148a8a541b26a55f2.patch";
+    sha256 = "1y2mbn4i8lj3lkn5s8zziyr9pl1fq9hndzz9c01dkv3s8sn7f55s";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  meta = with lib; {
+    description = "Compressed bitset library for C and C++";
+    homepage = http://roaringbitmap.org/;
+    license = licenses.asl20;
+    maintainers = with maintainers; [ orivej ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/development/libraries/enchant/default.nix b/pkgs/development/libraries/enchant/1.x.nix
index b7303468cbaf..b7303468cbaf 100644
--- a/pkgs/development/libraries/enchant/default.nix
+++ b/pkgs/development/libraries/enchant/1.x.nix
diff --git a/pkgs/development/libraries/gbenchmark/default.nix b/pkgs/development/libraries/gbenchmark/default.nix
index dc5c2024c02a..7e35ed2e5309 100644
--- a/pkgs/development/libraries/gbenchmark/default.nix
+++ b/pkgs/development/libraries/gbenchmark/default.nix
@@ -2,20 +2,24 @@
 
 stdenv.mkDerivation rec {
   name = "gbenchmark-${version}";
-  version = "1.4.1";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "benchmark";
     rev = "v${version}";
-    sha256 = "0l1f6azka85fkb8kdmh4qmmpxhsv7lr7wvll6sld31mfz0cai1kd";
+    sha256 = "0r9dbg4cbk47gwmayys31a83m3y67k0kh1f6pl8i869rbd609ndh";
   };
 
   nativeBuildInputs = [ cmake ];
 
-  buildInputs = [ gtest ];
+  postPatch = ''
+    cp -r ${gtest.src} googletest
+    chmod -R u+w googletest
+  '';
 
   enableParallelBuilding = true;
+  doCheck = true;
 
   meta = with stdenv.lib; {
     description = "A microbenchmark support library";
diff --git a/pkgs/development/libraries/geoclue/default.nix b/pkgs/development/libraries/geoclue/default.nix
index 70319c9151f5..6a44f01d0110 100644
--- a/pkgs/development/libraries/geoclue/default.nix
+++ b/pkgs/development/libraries/geoclue/default.nix
@@ -42,6 +42,7 @@ stdenv.mkDerivation rec {
     "-Ddemo-agent=${if withDemoAgent then "true" else "false"}"
     "--sysconfdir=/etc"
     "-Dsysconfdir_install=${placeholder "out"}/etc"
+    "-Ddbus-srv-user=geoclue"
   ] ++ optionals stdenv.isDarwin [
     "-D3g-source=false"
     "-Dcdma-source=false"
diff --git a/pkgs/development/libraries/gtkspell/3.nix b/pkgs/development/libraries/gtkspell/3.nix
index 6d4288376800..f0baecb19904 100644
--- a/pkgs/development/libraries/gtkspell/3.nix
+++ b/pkgs/development/libraries/gtkspell/3.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl, gtk3, aspell, pkgconfig, enchant2, isocodes, intltool, gobject-introspection, vala}:
+{stdenv, fetchurl, gtk3, aspell, pkgconfig, enchant, isocodes, intltool, gobject-introspection, vala}:
 
 stdenv.mkDerivation rec {
   name = "gtkspell-${version}";
@@ -12,8 +12,8 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkgconfig intltool gobject-introspection vala ];
-  buildInputs = [ aspell gtk3 enchant2 isocodes ];
-  propagatedBuildInputs = [ enchant2 ];
+  buildInputs = [ aspell gtk3 enchant isocodes ];
+  propagatedBuildInputs = [ enchant ];
 
   configureFlags = [
     "--enable-introspection"
diff --git a/pkgs/development/libraries/libebml/default.nix b/pkgs/development/libraries/libebml/default.nix
index 6a26910c8bd6..2d15e419a764 100644
--- a/pkgs/development/libraries/libebml/default.nix
+++ b/pkgs/development/libraries/libebml/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libebml";
-  version = "1.3.7";
+  version = "1.3.9";
 
   src = fetchFromGitHub {
     owner  = "Matroska-Org";
     repo   = "libebml";
     rev    = "release-${version}";
-    sha256 = "0pdfl83nbbdddbxajx34srg4mcfcz8ca21qyvlnpw81hfnrhmjkv";
+    sha256 = "0q2xfabaymrf0xkhwc9akx6m04lgra2b53wcn9mnh5dqiiazizi7";
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];
diff --git a/pkgs/development/libraries/libxls/default.nix b/pkgs/development/libraries/libxls/default.nix
index 3a3d99b655da..a2a576edc0f7 100644
--- a/pkgs/development/libraries/libxls/default.nix
+++ b/pkgs/development/libraries/libxls/default.nix
@@ -1,11 +1,12 @@
 { stdenv, fetchurl, unzip }:
 
 stdenv.mkDerivation rec {
-  name = "libxls-1.4.0";
+  name = "libxls-${version}";
+  version = "1.5.1";
 
   src = fetchurl {
-    url = "mirror://sourceforge/libxls/${name}.zip";
-    sha256 = "1g8ds7wbhsa4hdcn77xc2c0l3vvz5bx2hx9ng9c9n7aii92ymfnk";
+    url = "https://github.com/libxls/libxls/releases/download/v${version}/libxls-${version}.tar.gz";
+    sha256 = "0dam8qgbc5ykzaxmrjhpmfm8lnlcdk6cbpzyaya91qwwa80qbj1v";
   };
 
   nativeBuildInputs = [ unzip ];
diff --git a/pkgs/development/libraries/p11-kit/default.nix b/pkgs/development/libraries/p11-kit/default.nix
index 28645c545cd7..0e1be8633468 100644
--- a/pkgs/development/libraries/p11-kit/default.nix
+++ b/pkgs/development/libraries/p11-kit/default.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  doCheck = true;
+  doCheck = !stdenv.isDarwin;
 
   installFlags = [ "exampledir=\${out}/etc/pkcs11" ];
 
diff --git a/pkgs/development/libraries/qpdf/default.nix b/pkgs/development/libraries/qpdf/default.nix
index 156a8c4c15cb..dceda3c04bd4 100644
--- a/pkgs/development/libraries/qpdf/default.nix
+++ b/pkgs/development/libraries/qpdf/default.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchurl, fetchpatch, libjpeg, zlib, perl }:
 
-let version = "8.4.1";
+let version = "8.4.2";
 in
 stdenv.mkDerivation rec {
   name = "qpdf-${version}";
 
   src = fetchurl {
     url = "mirror://sourceforge/qpdf/qpdf/${version}/${name}.tar.gz";
-    sha256 = "1fsfy38dnm9cy1j40jw5x8vn84l6f2kgb68rdjl0wxignfw05z87";
+    sha256 = "1hrys6zmia8fw6f6ih3ckgsc1jr12fizdwaiy7dyd64kxxjhm8v9";
   };
 
   nativeBuildInputs = [ perl ];
diff --git a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
index 86897cb3f16f..aa9cdb4d5ae7 100644
--- a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
@@ -33,6 +33,9 @@ qtModule {
 
   enableParallelBuilding = true;
 
+  # Don’t use the gn setup hook
+  dontUseGnConfigure = true;
+
   # ninja builds some components with -Wno-format,
   # which cannot be set at the same time as -Wformat-security
   hardeningDisable = [ "format" ];
diff --git a/pkgs/development/libraries/qtwebkit-plugins/default.nix b/pkgs/development/libraries/qtwebkit-plugins/default.nix
index 07209be0dce0..46a9785739a6 100644
--- a/pkgs/development/libraries/qtwebkit-plugins/default.nix
+++ b/pkgs/development/libraries/qtwebkit-plugins/default.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchFromGitHub, qmake, qtwebkit, hunspell }:
 
 stdenv.mkDerivation {
-  name = "qtwebkit-plugins-2015-05-09";
+  name = "qtwebkit-plugins-2017-01-25";
 
   src = fetchFromGitHub {
     owner = "QupZilla";
     repo = "qtwebkit-plugins";
-    rev = "4e2e0402abd847346bec704be5305ba849eb754b";
-    sha256 = "0xyq25l56jgdxgqqv0380brhw9gg0hin5hyrf1j6d3c8k1gka20m";
+    rev = "b58ee9d5b31977491662aa4e8bee16404638bf14";
+    sha256 = "04wvlhdj45g1v1a3zl0pkf9r72i22h1br10lhhrgad7ypym974gw";
   };
 
   nativeBuildInputs = [ qmake ];
diff --git a/pkgs/development/libraries/tpm2-tss/default.nix b/pkgs/development/libraries/tpm2-tss/default.nix
index b092a973bc21..cb1052356786 100644
--- a/pkgs/development/libraries/tpm2-tss/default.nix
+++ b/pkgs/development/libraries/tpm2-tss/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tpm2-tss";
-  version = "2.2.2";
+  version = "2.2.3";
 
   src = fetchurl {
     url = "https://github.com/tpm2-software/${pname}/releases/download/${version}/${pname}-${version}.tar.gz";
-    sha256 = "0bbi1vpca5j7jbvy2z76jilpf5km5as1k37bkb2mwzmpibnypmf1";
+    sha256 = "1hwrka0g817a4d1177vv0z13gp66bxzxhflfxswjhcdk93kaws8k";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/v8/5_x.nix b/pkgs/development/libraries/v8/5_x.nix
new file mode 100644
index 000000000000..2b9fa5cc04c0
--- /dev/null
+++ b/pkgs/development/libraries/v8/5_x.nix
@@ -0,0 +1,199 @@
+{ stdenv, lib, fetchgit, fetchFromGitHub, gyp, readline, python, which, icu
+, patchelf, coreutils, xcbuild
+, doCheck ? false
+, static ? false
+}:
+
+assert readline != null;
+
+let
+  arch = if stdenv.isx86_64 then "x64"
+            else if stdenv.isi686 then "ia32"
+            else if stdenv.isAarch64 then "arm64"
+            else if stdenv.isAarch32 then "arm"
+            else throw "Unknown architecture for v8";
+  git_url = "https://chromium.googlesource.com";
+  clangFlag = if stdenv.isDarwin then "1" else "0";
+  sharedFlag = if static then "static_library" else "shared_library";
+
+  deps = {
+    "build" = fetchgit {
+      url = "${git_url}/chromium/src/build.git";
+      rev = "2c67d4d74b6b3673228fab191918500a582ef3b0";
+      sha256 = "0jc7hci5yh792pw0ahjfxrk5xzllnlrv9llmwlgcgn2x8x6bn34q";
+    };
+    "tools/gyp" = fetchgit {
+      url = "${git_url}/external/gyp.git";
+      rev = "e7079f0e0e14108ab0dba58728ff219637458563";
+      sha256 = "0yd1ds13z0r9d2sb67f9i1gjn1zgzwyfv96qqqp6pn5pcfbialg6";
+    };
+    "third_party/icu" = fetchgit {
+      url = "${git_url}/chromium/deps/icu.git";
+      rev = "b5ecbb29a26532f72ef482569b223d5a51fd50bf";
+      sha256 = "0ld47wdnk8grcba221z67l3pnphv9zwifk4y44f5b946w3iwmpns";
+    };
+    "buildtools" = fetchgit {
+      url = "${git_url}/chromium/buildtools.git";
+      rev = "60f7f9a8b421ebf9a46041dfa2ff11c0fe59c582";
+      sha256 = "0i10bw7yhslklqwcx5krs3k05sicb73cpwd0mkaz96yxsvmkvjq0";
+    };
+    "base/trace_event/common" = fetchgit {
+      url = "${git_url}/chromium/src/base/trace_event/common.git";
+      rev = "315bf1e2d45be7d53346c31cfcc37424a32c30c8";
+      sha256 = "1pp2ygvp20j6g4868hrmiw0j704kdvsi9d9wx2gbk7w79rc36695";
+    };
+    "platform/inspector_protocol" = fetchgit {
+      url = "${git_url}/chromium/src/third_party/WebKit/Source/platform/inspector_protocol.git";
+      rev = "f49542089820a34a9a6e33264e09b73779407512";
+      sha256 = "1lwpass3p4rpp2kjmxxxpkqyv4lznxhf4i0yy7mmrd7jkpc7kn8k";
+    };
+    "tools/mb" = fetchgit {
+      url = "${git_url}/chromium/src/tools/mb.git";
+      rev = "0c4dc43c454f26936ddf3074ab8e9a41e3dc03a3";
+      sha256 = "0f96qphbmwn1pprv0a6xf68p01s1jzx2sz6pmadqbrs1dgh1xwnk";
+    };
+    "tools/swarming_client" = fetchgit {
+      url = "${git_url}/external/swarming.client.git";
+      rev = "7f63a272f7d9785ce41b6d10bb3106c49a968e57";
+      sha256 = "1pmb8bq4qifjf2dzz8c4jdwhlvwgrl9ycjaalcyh1sbh4lx3yvv2";
+    };
+    "testing/gtest" = fetchgit {
+      url = "${git_url}/external/github.com/google/googletest.git";
+      rev = "6f8a66431cb592dad629028a50b3dd418a408c87";
+      sha256 = "0bdba2lr6pg15bla9600zg0r0vm4lnrx0wqz84p376wfdxra24vw";
+    };
+    "testing/gmock" = fetchgit {
+      url = "${git_url}/external/googlemock.git";
+      rev = "0421b6f358139f02e102c9c332ce19a33faf75be";
+      sha256 = "1xiky4v98maxs8fg1avcd56y0alv3hw8qyrlpd899zgzbq2k10pp";
+    };
+    "test/benchmarks/data" = fetchgit {
+      url = "${git_url}/v8/deps/third_party/benchmarks.git";
+      rev = "05d7188267b4560491ff9155c5ee13e207ecd65f";
+      sha256 = "0ad2ay14bn67d61ks4dmzadfnhkj9bw28r4yjdjjyzck7qbnzchl";
+    };
+    "test/mozilla/data" = fetchgit {
+      url = "${git_url}/v8/deps/third_party/mozilla-tests.git";
+      rev = "f6c578a10ea707b1a8ab0b88943fe5115ce2b9be";
+      sha256 = "0rfdan76yfawqxbwwb35aa57b723j3z9fx5a2w16nls02yk2kqyn";
+    };
+    "test/simdjs/data" = fetchgit {
+      url = "${git_url}/external/github.com/tc39/ecmascript_simd.git";
+      rev = "baf493985cb9ea7cdbd0d68704860a8156de9556";
+      sha256 = "178r0k40a58c1187gfzqz2i6as34l8cliy1g1x870wyy0qcvlq2q";
+    };
+    "test/test262/data" = fetchgit {
+      url = "${git_url}/external/github.com/tc39/test262.git";
+      rev = "88bc7fe7586f161201c5f14f55c9c489f82b1b67";
+      sha256 = "0gc7fmaqrgwb6rl02jnrm3synpwzzg0dfqy3zm386r1qcisl93xs";
+    };
+    "test/test262/harness" = fetchgit {
+      url = "${git_url}/external/github.com/test262-utils/test262-harness-py.git";
+      rev = "cbd968f54f7a95c6556d53ba852292a4c49d11d8";
+      sha256 = "094c3600a4wh1m3fvvlivn290kik1pzzvwabq77lk8bh4jkkv7ki";
+    };
+    "tools/clang" = fetchgit {
+      url = "${git_url}/chromium/src/tools/clang.git";
+      rev = "496622ab4aaa5be7e5a9b80617013cb02f45dc87";
+      sha256 = "1gkhk2bzpxwzkirzcqfixxpprbr8mn6rk00krm25daarm3smydmf";
+    };
+  };
+
+in
+
+stdenv.mkDerivation rec {
+  name = "v8-${version}";
+  version = "5.4.232";
+
+  inherit doCheck;
+
+  src = fetchFromGitHub {
+    owner = "v8";
+    repo = "v8";
+    rev = version;
+    sha256 = "1nqxbkz75m8xrjih0sj3f3iqvif4192vxdaxzy8r787rihjwg9nx";
+  };
+
+  postUnpack = ''
+    ${lib.concatStringsSep "\n" (
+      lib.mapAttrsToList (n: v: ''
+        mkdir -p $sourceRoot/${n}
+        cp -r ${v}/* $sourceRoot/${n}
+      '') deps)}
+  '';
+
+  # Patch based off of:
+  # https://github.com/cowboyd/libv8/tree/v5.1.281.67.0/patches
+  patches = lib.optional (!doCheck) ./libv8-5.4.232.patch;
+
+  postPatch = ''
+    sed -i 's,#!/usr/bin/env python,#!${python}/bin/python,' gypfiles/gyp_v8
+    sed -i 's,/bin/echo,${coreutils}/bin/echo,' gypfiles/standalone.gypi
+    sed -i '/CR_CLANG_REVISION/ d' gypfiles/standalone.gypi
+    sed -i 's/-Wno-format-pedantic//g' gypfiles/standalone.gypi
+  '';
+
+  configurePhase = ''
+    PYTHONPATH="tools/generate_shim_headers:$PYTHONPATH" \
+    PYTHONPATH="$(toPythonPath ${gyp}):$PYTHONPATH" \
+      gypfiles/gyp_v8 \
+        -f make \
+        --generator-output="out" \
+        -Dflock_index=0 \
+        -Dclang=${clangFlag} \
+        -Dv8_enable_i18n_support=1 \
+        -Duse_system_icu=1 \
+        -Dcomponent=${sharedFlag} \
+        -Dconsole=readline \
+        -Dv8_target_arch=${arch} \
+        -Dv8_use_external_startup_data=0
+  '';
+
+  nativeBuildInputs = [ which ];
+  buildInputs = [ readline python icu ]
+    ++ stdenv.lib.optional stdenv.isDarwin xcbuild
+    ++ stdenv.lib.optional stdenv.isLinux patchelf;
+
+  NIX_CFLAGS_COMPILE = "-Wno-error=strict-overflow -Wno-error=unused-function -Wno-error=attributes"
+    + stdenv.lib.optionalString stdenv.cc.isClang " -Wno-error=unused-lambda-capture";
+
+  buildFlags = [
+    "LINK=c++"
+    "-C out"
+    "builddir=$(CURDIR)/Release"
+    "BUILDTYPE=Release"
+  ];
+
+  enableParallelBuilding = true;
+
+  dontUpdateAutotoolsGnuConfigScripts = if stdenv.isAarch64 then true else null;
+
+  # the `libv8_libplatform` target is _only_ built as a static library,
+  # and is expected to be statically linked in when needed.
+  # see the following link for further commentary:
+  # https://github.com/cowboyd/therubyracer/issues/391
+  installPhase = ''
+    install -vD out/Release/d8 "$out/bin/d8"
+    install -vD out/Release/mksnapshot "$out/bin/mksnapshot"
+    ${if static then ""
+    else if stdenv.isDarwin then ''
+    install -vD out/Release/libv8.dylib "$out/lib/libv8.dylib"
+    install_name_tool -change /usr/local/lib/libv8.dylib $out/lib/libv8.dylib -change /usr/lib/libgcc_s.1.dylib ${stdenv.cc.cc.lib}/lib/libgcc_s.1.dylib $out/bin/d8
+    install_name_tool -id $out/lib/libv8.dylib -change /usr/lib/libgcc_s.1.dylib ${stdenv.cc.cc.lib}/lib/libgcc_s.1.dylib $out/lib/libv8.dylib
+    '' else ''
+    install -vD out/Release/lib.target/libv8.so "$out/lib/libv8.so"
+    ''}
+    mkdir -p "$out/include"
+    cp -vr include/*.h "$out/include"
+    cp -vr include/libplatform "$out/include"
+    mkdir -p "$out/lib"
+    cp -v  out/Release/*.a "$out/lib"
+  '';
+
+  meta = with lib; {
+    description = "Google's open source JavaScript engine";
+    maintainers = with maintainers; [ cstrahan proglodyte ];
+    platforms = platforms.linux ++ platforms.darwin;
+    license = licenses.bsd3;
+  };
+}
diff --git a/pkgs/development/libraries/v8/6_x.nix b/pkgs/development/libraries/v8/6_x.nix
deleted file mode 100644
index 85d0c0d91bb5..000000000000
--- a/pkgs/development/libraries/v8/6_x.nix
+++ /dev/null
@@ -1,193 +0,0 @@
-{ stdenv, lib, fetchgit, fetchFromGitHub, gn, ninja, python, glib, pkgconfig
-, doCheck ? false
-, snapshot ? true
-}:
-
-let
-  arch = if stdenv.isAarch32
-         then if stdenv.is64bit
-              then"arm64"
-              else "arm"
-         else if stdenv.is64bit
-              then"x64"
-              else "ia32";
-  git_url = "https://chromium.googlesource.com";
-
-  # This data is from the DEPS file in the root of a V8 checkout
-  deps = {
-    "base/trace_event/common" = fetchgit {
-      url    = "${git_url}/chromium/src/base/trace_event/common.git";
-      rev    = "211b3ed9d0481b4caddbee1322321b86a483ca1f";
-      sha256 = "080sya1dg32hi5gj7zr3r5l18r6w8g0imajyf3xfvnz67a2i8dd7";
-    };
-    "build" = fetchgit {
-      url    = "${git_url}/chromium/src/build.git";
-      rev    = "7315579e388589b62236ad933f09afd1e838d234";
-      sha256 = "14gsigyjfm03kfzmz0v6429b6qnycvzx0yj3vwaks8may26aiv71";
-    };
-    "buildtools" = fetchgit {
-      url    = "${git_url}/chromium/buildtools.git";
-      rev    = "0dd5c6f980d22be96b728155249df2da355989d9";
-      sha256 = "0m1fh0qjcx9c69khnqcsqvrnqs7ji6wfxns9vv9mknj20sph5ydr";
-    };
-    "test/benchmarks/data" = fetchgit {
-      url    = "${git_url}/v8/deps/third_party/benchmarks.git";
-      rev    = "05d7188267b4560491ff9155c5ee13e207ecd65f";
-      sha256 = "0ad2ay14bn67d61ks4dmzadfnhkj9bw28r4yjdjjyzck7qbnzchl";
-    };
-    "test/mozilla/data" = fetchgit {
-      url    = "${git_url}/v8/deps/third_party/mozilla-tests.git";
-      rev    = "f6c578a10ea707b1a8ab0b88943fe5115ce2b9be";
-      sha256 = "0rfdan76yfawqxbwwb35aa57b723j3z9fx5a2w16nls02yk2kqyn";
-    };
-    "test/test262/data" = fetchgit {
-      url    = "${git_url}/external/github.com/tc39/test262.git";
-      rev    = "a6c1d05ac4fed084fa047e4c52ab2a8c9c2a8aef";
-      sha256 = "1cy3val2ih6r4sbaxd1v9fir87mrlw1kr54s64g68gnch53ck9s3";
-    };
-    "test/test262/harness" = fetchgit {
-      url    = "${git_url}/external/github.com/test262-utils/test262-harness-py.git";
-      rev    = "0f2acdd882c84cff43b9d60df7574a1901e2cdcd";
-      sha256 = "00brj5avp43yamc92kinba2mg3a2x1rcd7wnm7z093l73idprvkp";
-    };
-    "test/wasm-js" = fetchgit {
-      url    = "${git_url}/external/github.com/WebAssembly/spec.git";
-      rev    = "2113ea7e106f8a964e0445ba38f289d2aa845edd";
-      sha256 = "07aw7x2xzmzk905mqf8gbbb1bi1a5kv99g8iv6x2p07d3zns7xzx";
-    };
-    "third_party/depot_tools" = fetchgit {
-      url    = "${git_url}/chromium/tools/depot_tools.git";
-      rev    = "fb734036f4b5ae6d5afc63cbfc41d3a5d1c29a82";
-      sha256 = "1738y7xgfnn0hfdr8g5jw7555841ycxbn580mdffwv4jnbn7120s";
-    };
-    "third_party/googletest/src" = fetchgit {
-      url    = "${git_url}/external/github.com/google/googletest.git";
-      rev    = "ce468a17c434e4e79724396ee1b51d86bfc8a88b";
-      sha256 = "0nik8wb1b0zk2sslawgp5h211r5bc4x7m962dgnmbk11ccvsmr23";
-    };
-    "third_party/icu" = fetchgit {
-      url    = "${git_url}/chromium/deps/icu.git";
-      rev    = "a9a2bd3ee4f1d313651c5272252aaf2a3e7ed529";
-      sha256 = "1bfyxakgv9z0rxbqsy5csi85kg8dqy7i6zybmng5wyzag9cns4f9";
-    };
-    "third_party/instrumented_libraries" = fetchgit {
-      url    = "${git_url}/chromium/src/third_party/instrumented_libraries.git";
-      rev    = "323cf32193caecbf074d1a0cb5b02b905f163e0f";
-      sha256 = "0q3n3ivqva28qpn67ds635521pwzpc9apcyagz65i9j17bb1k231";
-    };
-    "third_party/jinja2" = fetchgit {
-      url    = "${git_url}/chromium/src/third_party/jinja2.git";
-      rev    = "b41863e42637544c2941b574c7877d3e1f663e25";
-      sha256 = "1qgilclkav67m6cl2xq2kmzkswrkrb2axc2z8mw58fnch4j1jf1r";
-    };
-    "third_party/markupsafe" = fetchgit {
-      url    = "${git_url}/chromium/src/third_party/markupsafe.git";
-      rev    = "8f45f5cfa0009d2a70589bcda0349b8cb2b72783";
-      sha256 = "168ppjmicfdh4i1l0l25s86mdbrz9fgxmiq1rx33x79mph41scfz";
-    };
-    "third_party/proguard" = fetchgit {
-      url    = "${git_url}/chromium/src/third_party/proguard.git";
-      rev    = "eba7a98d98735b2cc65c54d36baa5c9b46fe4f8e";
-      sha256 = "1yx86z2p243b0ykixgqz6nlqfp8swa6n0yl5fgb29fa4jvsjz3d1";
-    };
-    "tools/clang" = fetchgit {
-      url    = "${git_url}/chromium/src/tools/clang.git";
-      rev    = "c0b1d892b2bc1291eb287d716ca239c1b03fb215";
-      sha256 = "1mz1pqzr2b37mymbkqkmpmj48j7a8ig0ibaw3dfilbx5nbl4wd2z";
-    };
-    "tools/gyp" = fetchgit {
-      url    = "${git_url}/external/gyp.git";
-      rev    = "d61a9397e668fa9843c4aa7da9e79460fe590bfb";
-      sha256 = "1z081h72mjy285jb1kj5xd0pb4p12n9blvsimsavyn3ldmswv0r0";
-    };
-    "tools/luci-go" = fetchgit {
-      url    = "${git_url}/chromium/src/tools/luci-go.git";
-      rev    = "abcd908f74fdb155cc8870f5cae48dff1ece7c3c";
-      sha256 = "07c8vanc31wal6aw8v0s499l7ifrgvdvi2sx4ln3nyha5ngxinld";
-    };
-    "tools/swarming_client" = fetchgit {
-      url    = "${git_url}/infra/luci/client-py.git";
-      rev    = "9a518d097dca20b7b00ce3bdfc5d418ccc79893a";
-      sha256 = "1d8nly7rp24gx7q0m01jvsc15nw5fahayfczwd40gzzzkmvhjazi";
-    };
-  };
-
-in
-
-stdenv.mkDerivation rec {
-  name = "v8-${version}";
-  version = "6.9.427.14";
-
-  inherit doCheck;
-
-  src = fetchFromGitHub {
-    owner = "v8";
-    repo = "v8";
-    rev = version;
-    sha256 = "13d50iz87qh7v8l8kjky8wqs9rvz02pgw74q8crqi5ywnvvill1x";
-  };
-
-  postUnpack = ''
-    ${lib.concatStringsSep "\n" (
-      lib.mapAttrsToList (n: v: ''
-        mkdir -p $sourceRoot/${n}
-        cp -r ${v}/* $sourceRoot/${n}
-      '') deps)}
-  '';
-
-  prePatch = ''
-    # use our gn, not the bundled one
-    sed -i -e 's#gn_path = .*#gn_path = "${gn}/bin/gn"#' tools/mb/mb.py
-
-    # disable tests
-    if [ "$doCheck" = "" ]; then sed -i -e '/"test:gn_all",/d' BUILD.gn; fi
-
-    # disable sysroot usage
-    chmod u+w build/config build/config/sysroot.gni
-    sed -i build/config/sysroot.gni \
-        -e '/use_sysroot =/ { s#\(use_sysroot =\).*#\1 false#; :a  n; /current_cpu/ { s/^/#/; ba };  }'
-
-    # patch shebangs (/usr/bin/env)
-    patchShebangs tools/dev/v8gen.py
-  '';
-
-  configurePhase = ''
-    tools/dev/v8gen.py -vv ${arch}.release -- \
-        is_component_build=true               \
-        ${if snapshot then "v8_use_external_startup_data=false" else "v8_use_snapshot=false"} \
-        is_clang=false                        \
-        linux_use_bundled_binutils=false      \
-        treat_warnings_as_errors=false        \
-        use_custom_libcxx=false               \
-        use_custom_libcxx_for_host=false
-  '';
-
-  nativeBuildInputs = [ gn ninja pkgconfig ];
-  buildInputs = [ python glib ];
-
-  buildPhase = ''
-    ninja -C out.gn/${arch}.release/
-  '';
-
-  enableParallelBuilding = true;
-
-  installPhase = ''
-    install -vD out.gn/${arch}.release/d8 "$out/bin/d8"
-    install -vD out.gn/${arch}.release/mksnapshot "$out/bin/mksnapshot"
-    mkdir -p "$out/lib"
-    for f in libicui18n.so libicuuc.so libv8_libbase.so libv8_libplatform.so libv8.so; do
-        install -vD out.gn/${arch}.release/$f "$out/lib/$f"
-    done
-    install -vD out.gn/${arch}.release/icudtl.dat "$out/lib/icudtl.dat"
-    mkdir -p "$out/include"
-    cp -vr include/*.h "$out/include"
-    cp -vr include/libplatform "$out/include"
-  '';
-
-  meta = with lib; {
-    description = "Google's open source JavaScript engine";
-    maintainers = with maintainers; [ cstrahan proglodyte ];
-    platforms = platforms.linux;
-    license = licenses.bsd3;
-  };
-}
diff --git a/pkgs/development/libraries/v8/darwin.patch b/pkgs/development/libraries/v8/darwin.patch
new file mode 100644
index 000000000000..629d5e4dc392
--- /dev/null
+++ b/pkgs/development/libraries/v8/darwin.patch
@@ -0,0 +1,22 @@
+diff --git a/toolchain/gcc_toolchain.gni b/toolchain/gcc_toolchain.gni
+index 80e2a362a..df138c87b 100644
+--- a/build/toolchain/gcc_toolchain.gni
++++ b/build/toolchain/gcc_toolchain.gni
+@@ -355,6 +355,8 @@ template("gcc_toolchain") {
+         # AIX does not support either -D (deterministic output) or response
+         # files.
+         command = "$ar -X64 {{arflags}} -r -c -s {{output}} {{inputs}}"
++      } else if (current_os == "mac") {
++        command = "$ar {{arflags}} -r -c -s {{output}} {{inputs}}"
+       } else {
+         rspfile = "{{output}}.rsp"
+         rspfile_content = "{{inputs}}"
+@@ -546,7 +548,7 @@ template("gcc_toolchain") {
+ 
+       start_group_flag = ""
+       end_group_flag = ""
+-      if (current_os != "aix") {
++      if (current_os != "aix" && current_os != "mac") {
+         # the "--start-group .. --end-group" feature isn't available on the aix ld.
+         start_group_flag = "-Wl,--start-group"
+         end_group_flag = "-Wl,--end-group "
diff --git a/pkgs/development/libraries/v8/default.nix b/pkgs/development/libraries/v8/default.nix
index 2b9fa5cc04c0..f7c4f34e8e6e 100644
--- a/pkgs/development/libraries/v8/default.nix
+++ b/pkgs/development/libraries/v8/default.nix
@@ -1,101 +1,43 @@
-{ stdenv, lib, fetchgit, fetchFromGitHub, gyp, readline, python, which, icu
-, patchelf, coreutils, xcbuild
-, doCheck ? false
-, static ? false
+{ stdenv, lib, fetchgit, fetchFromGitHub
+, gn, ninja, python, glib, pkgconfig, icu
+, xcbuild, darwin
+, fetchpatch
 }:
 
-assert readline != null;
-
 let
-  arch = if stdenv.isx86_64 then "x64"
-            else if stdenv.isi686 then "ia32"
-            else if stdenv.isAarch64 then "arm64"
-            else if stdenv.isAarch32 then "arm"
-            else throw "Unknown architecture for v8";
   git_url = "https://chromium.googlesource.com";
-  clangFlag = if stdenv.isDarwin then "1" else "0";
-  sharedFlag = if static then "static_library" else "shared_library";
 
+  # This data is from the DEPS file in the root of a V8 checkout
   deps = {
-    "build" = fetchgit {
-      url = "${git_url}/chromium/src/build.git";
-      rev = "2c67d4d74b6b3673228fab191918500a582ef3b0";
-      sha256 = "0jc7hci5yh792pw0ahjfxrk5xzllnlrv9llmwlgcgn2x8x6bn34q";
-    };
-    "tools/gyp" = fetchgit {
-      url = "${git_url}/external/gyp.git";
-      rev = "e7079f0e0e14108ab0dba58728ff219637458563";
-      sha256 = "0yd1ds13z0r9d2sb67f9i1gjn1zgzwyfv96qqqp6pn5pcfbialg6";
-    };
-    "third_party/icu" = fetchgit {
-      url = "${git_url}/chromium/deps/icu.git";
-      rev = "b5ecbb29a26532f72ef482569b223d5a51fd50bf";
-      sha256 = "0ld47wdnk8grcba221z67l3pnphv9zwifk4y44f5b946w3iwmpns";
-    };
-    "buildtools" = fetchgit {
-      url = "${git_url}/chromium/buildtools.git";
-      rev = "60f7f9a8b421ebf9a46041dfa2ff11c0fe59c582";
-      sha256 = "0i10bw7yhslklqwcx5krs3k05sicb73cpwd0mkaz96yxsvmkvjq0";
-    };
     "base/trace_event/common" = fetchgit {
-      url = "${git_url}/chromium/src/base/trace_event/common.git";
-      rev = "315bf1e2d45be7d53346c31cfcc37424a32c30c8";
-      sha256 = "1pp2ygvp20j6g4868hrmiw0j704kdvsi9d9wx2gbk7w79rc36695";
-    };
-    "platform/inspector_protocol" = fetchgit {
-      url = "${git_url}/chromium/src/third_party/WebKit/Source/platform/inspector_protocol.git";
-      rev = "f49542089820a34a9a6e33264e09b73779407512";
-      sha256 = "1lwpass3p4rpp2kjmxxxpkqyv4lznxhf4i0yy7mmrd7jkpc7kn8k";
-    };
-    "tools/mb" = fetchgit {
-      url = "${git_url}/chromium/src/tools/mb.git";
-      rev = "0c4dc43c454f26936ddf3074ab8e9a41e3dc03a3";
-      sha256 = "0f96qphbmwn1pprv0a6xf68p01s1jzx2sz6pmadqbrs1dgh1xwnk";
-    };
-    "tools/swarming_client" = fetchgit {
-      url = "${git_url}/external/swarming.client.git";
-      rev = "7f63a272f7d9785ce41b6d10bb3106c49a968e57";
-      sha256 = "1pmb8bq4qifjf2dzz8c4jdwhlvwgrl9ycjaalcyh1sbh4lx3yvv2";
-    };
-    "testing/gtest" = fetchgit {
-      url = "${git_url}/external/github.com/google/googletest.git";
-      rev = "6f8a66431cb592dad629028a50b3dd418a408c87";
-      sha256 = "0bdba2lr6pg15bla9600zg0r0vm4lnrx0wqz84p376wfdxra24vw";
-    };
-    "testing/gmock" = fetchgit {
-      url = "${git_url}/external/googlemock.git";
-      rev = "0421b6f358139f02e102c9c332ce19a33faf75be";
-      sha256 = "1xiky4v98maxs8fg1avcd56y0alv3hw8qyrlpd899zgzbq2k10pp";
-    };
-    "test/benchmarks/data" = fetchgit {
-      url = "${git_url}/v8/deps/third_party/benchmarks.git";
-      rev = "05d7188267b4560491ff9155c5ee13e207ecd65f";
-      sha256 = "0ad2ay14bn67d61ks4dmzadfnhkj9bw28r4yjdjjyzck7qbnzchl";
+      url    = "${git_url}/chromium/src/base/trace_event/common.git";
+      rev    = "936ba8a963284a6b3737cf2f0474a7131073abee";
+      sha256 = "14nr22fqdpxma1kzjflj6a865vr3hfnnm2gs4vcixyq4kmfzfcy2";
     };
-    "test/mozilla/data" = fetchgit {
-      url = "${git_url}/v8/deps/third_party/mozilla-tests.git";
-      rev = "f6c578a10ea707b1a8ab0b88943fe5115ce2b9be";
-      sha256 = "0rfdan76yfawqxbwwb35aa57b723j3z9fx5a2w16nls02yk2kqyn";
+    "build" = fetchgit {
+      url    = "${git_url}/chromium/src/build.git";
+      rev    = "325e95d6dae64f35b160b3dc7d73218cee5ec079";
+      sha256 = "0dddyxa76p2xpjhmxif05v63i5ar6h5v684fdl667sg84f5bhhxf";
     };
-    "test/simdjs/data" = fetchgit {
-      url = "${git_url}/external/github.com/tc39/ecmascript_simd.git";
-      rev = "baf493985cb9ea7cdbd0d68704860a8156de9556";
-      sha256 = "178r0k40a58c1187gfzqz2i6as34l8cliy1g1x870wyy0qcvlq2q";
+    "third_party/googletest/src" = fetchgit {
+      url    = "${git_url}/external/github.com/google/googletest.git";
+      rev    = "5ec7f0c4a113e2f18ac2c6cc7df51ad6afc24081";
+      sha256 = "0gmr10042c0xybxnn6g7ndj1na1mmd3l9w7449qlcv4s8gmfs7k6";
     };
-    "test/test262/data" = fetchgit {
-      url = "${git_url}/external/github.com/tc39/test262.git";
-      rev = "88bc7fe7586f161201c5f14f55c9c489f82b1b67";
-      sha256 = "0gc7fmaqrgwb6rl02jnrm3synpwzzg0dfqy3zm386r1qcisl93xs";
+    "third_party/icu" = fetchgit {
+      url    = "${git_url}/chromium/deps/icu.git";
+      rev    = "960f195aa87acaec46e6104ec93a596da7ae0843";
+      sha256 = "073kh6gpcairgjxf3hlhpqljc13gwl2aj8fz91fv220xibwqs834";
     };
-    "test/test262/harness" = fetchgit {
-      url = "${git_url}/external/github.com/test262-utils/test262-harness-py.git";
-      rev = "cbd968f54f7a95c6556d53ba852292a4c49d11d8";
-      sha256 = "094c3600a4wh1m3fvvlivn290kik1pzzvwabq77lk8bh4jkkv7ki";
+    "third_party/jinja2" = fetchgit {
+      url    = "${git_url}/chromium/src/third_party/jinja2.git";
+      rev    = "b41863e42637544c2941b574c7877d3e1f663e25";
+      sha256 = "1qgilclkav67m6cl2xq2kmzkswrkrb2axc2z8mw58fnch4j1jf1r";
     };
-    "tools/clang" = fetchgit {
-      url = "${git_url}/chromium/src/tools/clang.git";
-      rev = "496622ab4aaa5be7e5a9b80617013cb02f45dc87";
-      sha256 = "1gkhk2bzpxwzkirzcqfixxpprbr8mn6rk00krm25daarm3smydmf";
+    "third_party/markupsafe" = fetchgit {
+      url    = "${git_url}/chromium/src/third_party/markupsafe.git";
+      rev    = "8f45f5cfa0009d2a70589bcda0349b8cb2b72783";
+      sha256 = "168ppjmicfdh4i1l0l25s86mdbrz9fgxmiq1rx33x79mph41scfz";
     };
   };
 
@@ -103,15 +45,23 @@ in
 
 stdenv.mkDerivation rec {
   name = "v8-${version}";
-  version = "5.4.232";
+  version = "7.4.255";
 
-  inherit doCheck;
+  doCheck = true;
+
+  patches = [
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/RPi-Distro/chromium-browser/master/debian/patches/revert-Xclang-instcombine-lower-dbg-declare.patch";
+      sha256 = "02hczcg43m36q8j1kv5j3hq9czj9niiil9w13w22vzv2f3c67dvn";
+    })
+    ./darwin.patch
+  ];
 
   src = fetchFromGitHub {
     owner = "v8";
     repo = "v8";
     rev = version;
-    sha256 = "1nqxbkz75m8xrjih0sj3f3iqvif4192vxdaxzy8r787rihjwg9nx";
+    sha256 = "14i0c71hmffzqnq9n73dh9dnabdxhbjhzkhqpk5yv9y90bwrzi2n";
   };
 
   postUnpack = ''
@@ -120,80 +70,46 @@ stdenv.mkDerivation rec {
         mkdir -p $sourceRoot/${n}
         cp -r ${v}/* $sourceRoot/${n}
       '') deps)}
+    chmod u+w -R .
   '';
 
-  # Patch based off of:
-  # https://github.com/cowboyd/libv8/tree/v5.1.281.67.0/patches
-  patches = lib.optional (!doCheck) ./libv8-5.4.232.patch;
-
-  postPatch = ''
-    sed -i 's,#!/usr/bin/env python,#!${python}/bin/python,' gypfiles/gyp_v8
-    sed -i 's,/bin/echo,${coreutils}/bin/echo,' gypfiles/standalone.gypi
-    sed -i '/CR_CLANG_REVISION/ d' gypfiles/standalone.gypi
-    sed -i 's/-Wno-format-pedantic//g' gypfiles/standalone.gypi
-  '';
-
-  configurePhase = ''
-    PYTHONPATH="tools/generate_shim_headers:$PYTHONPATH" \
-    PYTHONPATH="$(toPythonPath ${gyp}):$PYTHONPATH" \
-      gypfiles/gyp_v8 \
-        -f make \
-        --generator-output="out" \
-        -Dflock_index=0 \
-        -Dclang=${clangFlag} \
-        -Dv8_enable_i18n_support=1 \
-        -Duse_system_icu=1 \
-        -Dcomponent=${sharedFlag} \
-        -Dconsole=readline \
-        -Dv8_target_arch=${arch} \
-        -Dv8_use_external_startup_data=0
-  '';
-
-  nativeBuildInputs = [ which ];
-  buildInputs = [ readline python icu ]
-    ++ stdenv.lib.optional stdenv.isDarwin xcbuild
-    ++ stdenv.lib.optional stdenv.isLinux patchelf;
-
-  NIX_CFLAGS_COMPILE = "-Wno-error=strict-overflow -Wno-error=unused-function -Wno-error=attributes"
-    + stdenv.lib.optionalString stdenv.cc.isClang " -Wno-error=unused-lambda-capture";
-
-  buildFlags = [
-    "LINK=c++"
-    "-C out"
-    "builddir=$(CURDIR)/Release"
-    "BUILDTYPE=Release"
-  ];
+  gnFlags = [
+    "use_custom_libcxx=false"
+    "is_clang=${if stdenv.cc.isClang then "true" else "false"}"
+    "use_sysroot=false"
+    # "use_system_icu=true"
+    "is_component_build=false"
+    "v8_use_external_startup_data=false"
+    "v8_monolithic=true"
+    "is_debug=true"
+    "is_official_build=false"
+    "treat_warnings_as_errors=false"
+    "v8_enable_i18n_support=true"
+    "use_gold=false"
+    "use_system_xcode=true"
+    # ''custom_toolchain="//build/toolchain/linux/unbundle:default"''
+    ''host_toolchain="//build/toolchain/linux/unbundle:default"''
+    ''v8_snapshot_toolchain="//build/toolchain/linux/unbundle:default"''
+  ] ++ stdenv.lib.optional stdenv.cc.isClang ''clang_base_path="${stdenv.cc}"'';
+
+  nativeBuildInputs = [ gn ninja pkgconfig python ]
+    ++ stdenv.lib.optionals stdenv.isDarwin [ xcbuild darwin.DarwinTools ];
+  buildInputs = [ glib icu ];
+
+  ninjaFlags = [ ":d8" "v8_monolith" ];
 
   enableParallelBuilding = true;
 
-  dontUpdateAutotoolsGnuConfigScripts = if stdenv.isAarch64 then true else null;
-
-  # the `libv8_libplatform` target is _only_ built as a static library,
-  # and is expected to be statically linked in when needed.
-  # see the following link for further commentary:
-  # https://github.com/cowboyd/therubyracer/issues/391
   installPhase = ''
-    install -vD out/Release/d8 "$out/bin/d8"
-    install -vD out/Release/mksnapshot "$out/bin/mksnapshot"
-    ${if static then ""
-    else if stdenv.isDarwin then ''
-    install -vD out/Release/libv8.dylib "$out/lib/libv8.dylib"
-    install_name_tool -change /usr/local/lib/libv8.dylib $out/lib/libv8.dylib -change /usr/lib/libgcc_s.1.dylib ${stdenv.cc.cc.lib}/lib/libgcc_s.1.dylib $out/bin/d8
-    install_name_tool -id $out/lib/libv8.dylib -change /usr/lib/libgcc_s.1.dylib ${stdenv.cc.cc.lib}/lib/libgcc_s.1.dylib $out/lib/libv8.dylib
-    '' else ''
-    install -vD out/Release/lib.target/libv8.so "$out/lib/libv8.so"
-    ''}
-    mkdir -p "$out/include"
-    cp -vr include/*.h "$out/include"
-    cp -vr include/libplatform "$out/include"
-    mkdir -p "$out/lib"
-    cp -v  out/Release/*.a "$out/lib"
+    install -D d8 $out/bin/d8
+    install -D obj/libv8_monolith.a $out/lib/libv8.a
+    cp -r ../../include $out
   '';
 
   meta = with lib; {
     description = "Google's open source JavaScript engine";
-    maintainers = with maintainers; [ cstrahan proglodyte ];
-    platforms = platforms.linux ++ platforms.darwin;
+    maintainers = with maintainers; [ cstrahan proglodyte matthewbauer ];
+    platforms = platforms.unix;
     license = licenses.bsd3;
   };
 }
diff --git a/pkgs/development/libraries/wlroots/default.nix b/pkgs/development/libraries/wlroots/default.nix
index d3b2d78bf0a6..47e1c37492c1 100644
--- a/pkgs/development/libraries/wlroots/default.nix
+++ b/pkgs/development/libraries/wlroots/default.nix
@@ -4,17 +4,15 @@
 , libpng, ffmpeg_4
 }:
 
-let
+stdenv.mkDerivation rec {
   pname = "wlroots";
-  version = "0.5.0";
-in stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "swaywm";
     repo = "wlroots";
     rev = version;
-    sha256 = "1phiidyddzgaxy4gbqwmykxn0y8za6y5mp66l9dpd9i6fml153yq";
+    sha256 = "1rdcmll5b8w242n6yfjpsaprq280ck2jmbz46dxndhignxgda7k4";
   };
 
   # $out for the library, $bin for rootston, and $examples for the example
diff --git a/pkgs/development/libraries/xgboost/default.nix b/pkgs/development/libraries/xgboost/default.nix
index b4c79d7f8164..37e55afc4e9f 100644
--- a/pkgs/development/libraries/xgboost/default.nix
+++ b/pkgs/development/libraries/xgboost/default.nix
@@ -8,13 +8,13 @@ assert ncclSupport -> cudaSupport;
 
 stdenv.mkDerivation rec {
   name = "xgboost-${version}";
-  version = "0.72";
+  version = "0.90";
 
   # needs submodules
   src = fetchgit {
     url = "https://github.com/dmlc/xgboost";
     rev = "refs/tags/v${version}";
-    sha256 = "1d4kw2jm7d12g8qwi7p9r3429y7sjks9xp9yhvfpx5jh7qakkxj6";
+    sha256 = "1zs15k9crkiq7bnr4gqq53mkn3w8z9dq4nwlavmfcr5xr5gw2pw4";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index e13f6a4d96e7..e7557930f110 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -1,7 +1,7 @@
 
 /* pkgs/development/lua-modules/generated-packages.nix is an auto-generated file -- DO NOT EDIT!
 Regenerate it with:
-nixpkgs$ ./maintainers/scripts/update-luarocks-packages pkgs/development/lua-modules/generated-packages.nix
+nixpkgs$ maintainers/scripts/update-luarocks-packages pkgs/development/lua-modules/generated-packages.nix
 
 These packages are manually refined in lua-overrides.nix
 */
@@ -18,9 +18,8 @@ ansicolors = buildLuarocksPackage {
     url    = https://luarocks.org/ansicolors-1.0.2-3.src.rock;
     sha256 = "1mhmr090y5394x1j8p44ws17sdwixn5a0r4i052bkfgk3982cqfz";
   };
-  disabled = ( luaOlder "5.1" );
+  disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
-  buildType = "builtin";
 
   meta = {
     homepage = "https://github.com/kikito/ansicolors.lua";
@@ -38,9 +37,8 @@ argparse = buildLuarocksPackage {
     url    = https://luarocks.org/argparse-0.6.0-1.src.rock;
     sha256 = "10ic5wppyghd1lmgwgl0lb40pv8z9fi9i87080axxg8wsr19y0p4";
   };
-  disabled = ( luaOlder "5.1" ) || ( luaAtLeast "5.4" );
+  disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
   propagatedBuildInputs = [ lua ];
-  buildType = "builtin";
 
   meta = {
     homepage = "https://github.com/mpeterv/argparse";
@@ -64,9 +62,8 @@ basexx = buildLuarocksPackage {
     sha256 = "1rnz6xixxqwy0q6y2hi14rfid4w47h69gfi0rnlq24fz8q2b0qpz";
   };
 
-  disabled = ( luaOlder "5.1" );
+  disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
-  buildType = "builtin";
 
   meta = {
     homepage = "https://github.com/aiq/basexx";
@@ -81,21 +78,49 @@ binaryheap = buildLuarocksPackage {
   version = "0.4-1";
 
   src = fetchurl {
-      url    = https://luarocks.org/binaryheap-0.4-1.src.rock;
-      sha256 = "11rd8r3bpinfla2965jgjdv1hilqdc1q6g1qla5978d7vzg19kpc";
+    url    = https://luarocks.org/binaryheap-0.4-1.src.rock;
+    sha256 = "11rd8r3bpinfla2965jgjdv1hilqdc1q6g1qla5978d7vzg19kpc";
   };
-  disabled = ( luaOlder "5.1");
-  propagatedBuildInputs = [ lua ];  
-  buildType = "builtin";
+  disabled = (luaOlder "5.1");
+  propagatedBuildInputs = [ lua ];
 
   meta = {
     homepage = "https://github.com/Tieske/binaryheap.lua";
-    description="Binary heap implementation in pure Lua";
+    description = "Binary heap implementation in pure Lua";
     license = {
       fullName = "MIT/X11";
     };
   };
 };
+digestif = buildLuarocksPackage {
+  pname = "digestif";
+  version = "scm-1";
+
+  knownRockspec = (fetchurl {
+    url    = http://luarocks.org/dev/digestif-scm-1.rockspec;
+    sha256 = "18rixbni4hmrmh3qj3vpjbsphzdvchswajphc9ysm52ccpyzh687";
+  }).outPath;
+
+  src = fetchgit ( removeAttrs (builtins.fromJSON ''{
+  "url": "git://github.com/astoff/digestif",
+  "rev": "19442554ae18607707f09e6663d65bb8bb4ebb58",
+  "date": "2019-06-01T15:41:36+02:00",
+  "sha256": "1sglkgx2s1xc725h9b97jhfbi3scs32si83xss5m3n0xidwmlbzb",
+  "fetchSubmodules": true
+}
+ '') ["date"]) ;
+
+  disabled = (luaOlder "5.3");
+  propagatedBuildInputs = [ lua lpeg dkjson ];
+
+  meta = {
+    homepage = "https://github.com/astoff/digestif/";
+    description = "Code analyzer for TeX.";
+    license = {
+      fullName = "MIT";
+    };
+  };
+};
 dkjson = buildLuarocksPackage {
   pname = "dkjson";
   version = "2.5-2";
@@ -104,9 +129,8 @@ dkjson = buildLuarocksPackage {
     url    = https://luarocks.org/dkjson-2.5-2.src.rock;
     sha256 = "1qy9bzqnb9pf9d48hik4iq8h68aw3270kmax7mmpvvpw7kkyp483";
   };
-  disabled = ( luaOlder "5.1" ) || ( luaAtLeast "5.4" );
+  disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
   propagatedBuildInputs = [ lua ];
-  buildType = "builtin";
 
   meta = {
     homepage = "http://dkolf.de/src/dkjson-lua.fsl/";
@@ -124,9 +148,7 @@ fifo = buildLuarocksPackage {
     url    = https://luarocks.org/fifo-0.2-0.src.rock;
     sha256 = "082c5g1m8brnsqj5gnjs65bm7z50l6b05cfwah14lqaqsr5a5pjk";
   };
-
   propagatedBuildInputs = [ lua ];
-  buildType = "builtin";
 
   meta = {
     homepage = "https://github.com/daurnimator/fifo.lua";
@@ -141,16 +163,15 @@ http = buildLuarocksPackage {
   version = "0.3-0";
 
   src = fetchurl {
-      url    = https://luarocks.org/http-0.3-0.src.rock;
-      sha256 = "0vvl687bh3cvjjwbyp9cphqqccm3slv4g7y3h03scp3vpq9q4ccq";
+    url    = https://luarocks.org/http-0.3-0.src.rock;
+    sha256 = "0vvl687bh3cvjjwbyp9cphqqccm3slv4g7y3h03scp3vpq9q4ccq";
   };
-  disabled = ( luaOlder "5.1");
-  propagatedBuildInputs = [ lua compat53 bit32 cqueues luaossl basexx lpeg lpeg_patterns binaryheap fifo ];  
-  buildType = "builtin";
+  disabled = (luaOlder "5.1");
+  propagatedBuildInputs = [ lua compat53 bit32 cqueues luaossl basexx lpeg lpeg_patterns binaryheap fifo ];
 
   meta = {
     homepage = "https://github.com/daurnimator/lua-http";
-    description="HTTP library for Lua";
+    description = "HTTP library for Lua";
     license = {
       fullName = "MIT";
     };
@@ -164,9 +185,8 @@ inspect = buildLuarocksPackage {
     url    = https://luarocks.org/inspect-3.1.1-0.src.rock;
     sha256 = "0k4g9ahql83l4r2bykfs6sacf9l1wdpisav2i0z55fyfcdv387za";
   };
-  disabled = ( luaOlder "5.1" );
+  disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
-  buildType = "builtin";
 
   meta = {
     homepage = "https://github.com/kikito/inspect.lua";
@@ -191,7 +211,6 @@ ldoc = buildLuarocksPackage {
   };
 
   propagatedBuildInputs = [ penlight markdown ];
-  buildType = "builtin";
 
   meta = {
     homepage = "http://stevedonovan.github.com/ldoc";
@@ -209,9 +228,8 @@ lgi = buildLuarocksPackage {
     url    = https://luarocks.org/lgi-0.9.2-1.src.rock;
     sha256 = "07ajc5pdavp785mdyy82n0w6d592n96g95cvq025d6i0bcm2cypa";
   };
-  disabled = ( luaOlder "5.1" );
+  disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
-  buildType = "make";
 
   meta = {
     homepage = "http://github.com/pavouk/lgi";
@@ -229,9 +247,7 @@ lpeg_patterns = buildLuarocksPackage {
     url    = https://luarocks.org/lpeg_patterns-0.5-0.src.rock;
     sha256 = "0mlw4nayrsdxrh98i26avz5i4170a9brciybw88kks496ra36v8f";
   };
-
   propagatedBuildInputs = [ lua lpeg ];
-  buildType = "builtin";
 
   meta = {
     homepage = "https://github.com/daurnimator/lpeg_patterns/archive/v0.5.zip";
@@ -241,6 +257,25 @@ lpeg_patterns = buildLuarocksPackage {
     };
   };
 };
+lpeglabel = buildLuarocksPackage {
+  pname = "lpeglabel";
+  version = "1.5.0-1";
+
+  src = fetchurl {
+    url    = https://luarocks.org/lpeglabel-1.5.0-1.src.rock;
+    sha256 = "068mwvwwn5n69pdm04qnk354391w9mk34jsczxql0xi5qgmz6w8j";
+  };
+  disabled = (luaOlder "5.1");
+  propagatedBuildInputs = [ lua ];
+
+  meta = {
+    homepage = "https://github.com/sqmedeiros/lpeglabel/";
+    description = "Parsing Expression Grammars For Lua with Labeled Failures";
+    license = {
+      fullName = "MIT/X11";
+    };
+  };
+};
 lpty = buildLuarocksPackage {
   pname = "lpty";
   version = "1.2.2-1";
@@ -249,9 +284,8 @@ lpty = buildLuarocksPackage {
     url    = https://luarocks.org/lpty-1.2.2-1.src.rock;
     sha256 = "1vxvsjgjfirl6ranz6k4q4y2dnxqh72bndbk400if22x8lqbkxzm";
   };
-  disabled = ( luaOlder "5.1" );
+  disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
-  buildType = "make";
 
   meta = {
     homepage = "http://www.tset.de/lpty/";
@@ -269,9 +303,8 @@ lrexlib-gnu = buildLuarocksPackage {
     url    = https://luarocks.org/lrexlib-gnu-2.9.0-1.src.rock;
     sha256 = "036rda4rji1pbnbxk1nzjy5zmigdsiacqbzrbvciwq3lrxa2j5s2";
   };
-  disabled = ( luaOlder "5.1" );
+  disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
-  buildType = "builtin";
 
   meta = {
     homepage = "http://github.com/rrthomas/lrexlib";
@@ -289,9 +322,8 @@ lrexlib-posix = buildLuarocksPackage {
     url    = https://luarocks.org/lrexlib-posix-2.9.0-1.src.rock;
     sha256 = "0ifpybf4m94g1nk70l0f5m45gph0rbp5wrxrl1hnw8ibv3mc1b1r";
   };
-  disabled = ( luaOlder "5.1" );
+  disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
-  buildType = "builtin";
 
   meta = {
     homepage = "http://github.com/rrthomas/lrexlib";
@@ -309,9 +341,8 @@ ltermbox = buildLuarocksPackage {
     url    = https://luarocks.org/ltermbox-0.2-1.src.rock;
     sha256 = "08jqlmmskbi1ml1i34dlmg6hxcs60nlm32dahpxhcrgjnfihmyn8";
   };
-  disabled = ( luaOlder "5.1" );
+  disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
-  buildType = "builtin";
 
   meta = {
     homepage = "http://code.google.com/p/termbox";
@@ -331,16 +362,16 @@ lua-cmsgpack = buildLuarocksPackage {
   }).outPath;
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
-    "url": "git://github.com/antirez/lua-cmsgpack.git",
-    "rev": "57b1f90cf6cec46450e87289ed5a676165d31071",
-    "date": "2018-06-14T11:56:56+02:00",
-    "sha256": "0yiwl4p1zh9qid3ksc4n9fv5bwaa9vjb0vgwnkars204xmxdj8fj",
-    "fetchSubmodules": true
-  } '') ["date"]) ;
-
-  disabled = ( luaOlder "5.1" );
+  "url": "git://github.com/antirez/lua-cmsgpack.git",
+  "rev": "57b1f90cf6cec46450e87289ed5a676165d31071",
+  "date": "2018-06-14T11:56:56+02:00",
+  "sha256": "0yiwl4p1zh9qid3ksc4n9fv5bwaa9vjb0vgwnkars204xmxdj8fj",
+  "fetchSubmodules": true
+}
+ '') ["date"]) ;
+
+  disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
-  buildType = "builtin";
 
   meta = {
     homepage = "http://github.com/antirez/lua-cmsgpack";
@@ -358,9 +389,8 @@ lua_cliargs = buildLuarocksPackage {
     url    = https://luarocks.org/lua_cliargs-3.0-2.src.rock;
     sha256 = "0qqdnw00r16xbyqn4w1xwwpg9i9ppc3c1dcypazjvdxaj899hy9w";
   };
-  disabled = ( luaOlder "5.1" );
+  disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
-  buildType = "builtin";
 
   meta = {
     homepage = "https://github.com/amireh/lua_cliargs";
@@ -378,9 +408,8 @@ lua-iconv = buildLuarocksPackage {
     url    = https://luarocks.org/lua-iconv-7-3.src.rock;
     sha256 = "03xibhcqwihyjhxnzv367q4bfmzmffxl49lmjsq77g0prw8v0q83";
   };
-  disabled = ( luaOlder "5.1" );
+  disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
-  buildType = "builtin";
 
   meta = {
     homepage = "http://ittner.github.com/lua-iconv/";
@@ -390,21 +419,49 @@ lua-iconv = buildLuarocksPackage {
     };
   };
 };
+lua-lsp = buildLuarocksPackage {
+  pname = "lua-lsp";
+  version = "scm-2";
+
+  knownRockspec = (fetchurl {
+    url    = http://luarocks.org/dev/lua-lsp-scm-2.rockspec;
+    sha256 = "0qk3i6j0km4d1fs61fxhkmnbxmgpq24nygr8wknl6hbj2kya25rb";
+  }).outPath;
+
+  src = fetchgit ( removeAttrs (builtins.fromJSON ''{
+  "url": "git://github.com/Alloyed/lua-lsp",
+  "rev": "0de511803ed616214333210a2d003cf05a64dc18",
+  "date": "2018-09-08T10:11:54-04:00",
+  "sha256": "15dnsyh5664vi7qn73y2r114rhs5l9lfi84pwqkq5cafkiiy49qa",
+  "fetchSubmodules": true
+}
+ '') ["date"]) ;
+
+  disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
+  propagatedBuildInputs = [ lua dkjson lpeglabel inspect ];
+
+  meta = {
+    homepage = "https://github.com/Alloyed/lua-lsp";
+    description = "No summary";
+    license = {
+      fullName = "MIT";
+    };
+  };
+};
 lua-messagepack = buildLuarocksPackage {
   pname = "lua-messagepack";
   version = "0.5.1-2";
 
   src = fetchurl {
-      url    = https://luarocks.org/lua-messagepack-0.5.1-2.src.rock;
-      sha256 = "0bsdzdd24p9z3j4z1avw7qaqx87baa1pm58v275pw4h6n72z492g";
+    url    = https://luarocks.org/lua-messagepack-0.5.1-2.src.rock;
+    sha256 = "0bsdzdd24p9z3j4z1avw7qaqx87baa1pm58v275pw4h6n72z492g";
   };
-  disabled = ( luaOlder "5.1");
-  propagatedBuildInputs = [ lua ];  
-  buildType = "builtin";
+  disabled = (luaOlder "5.1");
+  propagatedBuildInputs = [ lua ];
 
   meta = {
     homepage = "http://fperrad.frama.io/lua-MessagePack/";
-    description="a pure Lua implementation of the MessagePack serialization format";
+    description = "a pure Lua implementation of the MessagePack serialization format";
     license = {
       fullName = "MIT/X11";
     };
@@ -424,7 +481,6 @@ lua-term = buildLuarocksPackage {
     sha256 = "0c3zc0cl3a5pbdn056vnlan16g0wimv0p9bq52h7w507f72x18f1";
   };
 
-  buildType = "builtin";
 
   meta = {
     homepage = "https://github.com/hoelzro/lua-term";
@@ -439,16 +495,15 @@ lua-toml = buildLuarocksPackage {
   version = "2.0-1";
 
   src = fetchurl {
-      url    = https://luarocks.org/lua-toml-2.0-1.src.rock;
-      sha256 = "0lyqlnydqbplq82brw9ipqy9gijin6hj1wc46plz994pg4i2c74m";
+    url    = https://luarocks.org/lua-toml-2.0-1.src.rock;
+    sha256 = "0lyqlnydqbplq82brw9ipqy9gijin6hj1wc46plz994pg4i2c74m";
   };
-  disabled = ( luaOlder "5.1");
-  propagatedBuildInputs = [ lua ];  
-  buildType = "builtin";
+  disabled = (luaOlder "5.1");
+  propagatedBuildInputs = [ lua ];
 
   meta = {
     homepage = "https://github.com/jonstoler/lua-toml";
-    description="toml decoder/encoder for Lua";
+    description = "toml decoder/encoder for Lua";
     license = {
       fullName = "MIT";
     };
@@ -464,16 +519,16 @@ luabitop = buildLuarocksPackage {
   }).outPath;
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
-    "url": "git://github.com/LuaDist/luabitop.git",
-    "rev": "81bb23b0e737805442033535de8e6d204d0e5381",
-    "date": "2013-02-18T16:36:42+01:00",
-    "sha256": "0lsc556hlkddjbmcdbg7wc2g55bfy743p8ywdzl8x7kk847r043q",
-    "fetchSubmodules": true
-  } '') ["date"]) ;
-
-  disabled = ( luaOlder "5.1" ) || ( luaAtLeast "5.3" );
+  "url": "git://github.com/LuaDist/luabitop.git",
+  "rev": "81bb23b0e737805442033535de8e6d204d0e5381",
+  "date": "2013-02-18T16:36:42+01:00",
+  "sha256": "0lsc556hlkddjbmcdbg7wc2g55bfy743p8ywdzl8x7kk847r043q",
+  "fetchSubmodules": true
+}
+ '') ["date"]) ;
+
+  disabled = (luaOlder "5.1") || (luaAtLeast "5.3");
   propagatedBuildInputs = [ lua ];
-  buildType = "builtin";
 
   meta = {
     homepage = "http://bitop.luajit.org/";
@@ -491,9 +546,8 @@ luaevent = buildLuarocksPackage {
     url    = https://luarocks.org/luaevent-0.4.6-1.src.rock;
     sha256 = "0chq09nawiz00lxd6pkdqcb8v426gdifjw6js3ql0lx5vqdkb6dz";
   };
-  disabled = ( luaOlder "5.1" );
+  disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
-  buildType = "builtin";
 
   meta = {
     homepage = "https://github.com/harningt/luaevent";
@@ -511,9 +565,8 @@ luacheck = buildLuarocksPackage {
     url    = https://luarocks.org/luacheck-0.23.0-1.src.rock;
     sha256 = "0akj61c7k1na2mggsckvfn9a3ljfp4agnmr9gp3mac4vin99a1cl";
   };
-  disabled = ( luaOlder "5.1" ) || ( luaAtLeast "5.4" );
+  disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
   propagatedBuildInputs = [ lua argparse luafilesystem ];
-  buildType = "builtin";
 
   meta = {
     homepage = "https://github.com/mpeterv/luacheck";
@@ -531,9 +584,8 @@ luaffi = buildLuarocksPackage {
     url    = http://luarocks.org/dev/luaffi-scm-1.src.rock;
     sha256 = "0dia66w8sgzw26bwy36gzyb2hyv7kh9n95lh5dl0158rqa6fsf26";
   };
-  disabled = ( luaOlder "5.1" );
+  disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
-  buildType = "builtin";
 
   meta = {
     homepage = "https://github.com/facebook/luaffifb";
@@ -551,9 +603,8 @@ luuid = buildLuarocksPackage {
     url    = https://luarocks.org/luuid-20120509-2.src.rock;
     sha256 = "08q54x0m51w89np3n117h2a153wsgv3qayabd8cz6i55qm544hkg";
   };
-  disabled = ( luaOlder "5.2" ) || ( luaAtLeast "5.4" );
+  disabled = (luaOlder "5.2") || (luaAtLeast "5.4");
   propagatedBuildInputs = [ lua ];
-  buildType = "builtin";
 
   meta = {
     homepage = "http://www.tecgraf.puc-rio.br/~lhf/ftp/lua/#luuid";
@@ -571,9 +622,8 @@ markdown = buildLuarocksPackage {
     url    = https://luarocks.org/markdown-0.33-1.src.rock;
     sha256 = "01xw4b4jvmrv1hz2gya02g3nphsj3hc94hsbc672ycj8pcql5n5y";
   };
-  disabled = ( luaOlder "5.1" ) || ( luaAtLeast "5.4" );
+  disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
   propagatedBuildInputs = [ lua ];
-  buildType = "builtin";
 
   meta = {
     homepage = "https://github.com/mpeterv/markdown";
@@ -598,7 +648,6 @@ penlight = buildLuarocksPackage {
   };
 
   propagatedBuildInputs = [ luafilesystem ];
-  buildType = "builtin";
 
   meta = {
     homepage = "http://stevedonovan.github.com/Penlight";
@@ -613,16 +662,15 @@ rapidjson = buildLuarocksPackage {
   version = "0.5.1-1";
 
   src = fetchurl {
-      url    = https://luarocks.org/rapidjson-0.5.1-1.src.rock;
-      sha256 = "0hnqsixnbz95cvm9q5dn0lr0qjvhqw4llw6l1sjswwk0am4yybay";
+    url    = https://luarocks.org/rapidjson-0.5.1-1.src.rock;
+    sha256 = "0hnqsixnbz95cvm9q5dn0lr0qjvhqw4llw6l1sjswwk0am4yybay";
   };
-  disabled = ( luaOlder "5.1");
-  propagatedBuildInputs = [ lua ];  
-  buildType = "cmake";
+  disabled = (luaOlder "5.1");
+  propagatedBuildInputs = [ lua ];
 
   meta = {
     homepage = "https://github.com/xpol/lua-rapidjson";
-    description="Json module based on the very fast RapidJSON.";
+    description = "Json module based on the very fast RapidJSON.";
     license = {
       fullName = "MIT";
     };
@@ -642,9 +690,8 @@ say = buildLuarocksPackage {
     sha256 = "1jh76mxq9dcmv7kps2spwcc6895jmj2sf04i4y9idaxlicvwvs13";
   };
 
-  disabled = ( luaOlder "5.1" );
+  disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
-  buildType = "builtin";
 
   meta = {
     homepage = "http://olivinelabs.com/busted/";
@@ -662,9 +709,8 @@ std__debug = buildLuarocksPackage {
     url    = https://luarocks.org/std._debug-1.0.1-1.src.rock;
     sha256 = "1qkcc5rph3ns9mzrfsa1671pb3hzbzfnaxvyw7zdly2b7ll88svz";
   };
-  disabled = ( luaOlder "5.1" ) || ( luaAtLeast "5.5" );
+  disabled = (luaOlder "5.1") || (luaAtLeast "5.5");
   propagatedBuildInputs = [ lua ];
-  buildType = "builtin";
 
   meta = {
     homepage = "http://lua-stdlib.github.io/_debug";
@@ -682,9 +728,8 @@ std_normalize = buildLuarocksPackage {
     url    = https://luarocks.org/std.normalize-2.0.2-1.src.rock;
     sha256 = "0yn60zqnxflhhlv6xk6w0ifdfxk1qcg8gq1wnrrbwsxwpipsrfjh";
   };
-  disabled = ( luaOlder "5.1" ) || ( luaAtLeast "5.4" );
+  disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
   propagatedBuildInputs = [ lua std__debug ];
-  buildType = "builtin";
 
   meta = {
     homepage = "https://lua-stdlib.github.io/normalize";
@@ -696,15 +741,14 @@ std_normalize = buildLuarocksPackage {
 };
 luv = buildLuarocksPackage {
   pname = "luv";
-  version = "1.27.0-0";
+  version = "1.29.1-1";
 
   src = fetchurl {
-    url    = https://luarocks.org/luv-1.27.0-0.src.rock;
-    sha256 = "16csnnypi2m71ncr8qwc9drqbrb40l5li1nk7zpsxnslg5fiax6x";
+    url    = https://luarocks.org/luv-1.29.1-1.src.rock;
+    sha256 = "0x801pp8h2035lbncsb6vkwgxqrai69ri3sp9g1dwnfnipsfsvrg";
   };
-  disabled = ( luaOlder "5.1" );
+  disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
-  buildType = "cmake";
 
   meta = {
     homepage = "https://github.com/luvit/luv";
@@ -722,9 +766,8 @@ luasystem = buildLuarocksPackage {
     url    = https://luarocks.org/luasystem-0.2.1-0.src.rock;
     sha256 = "091xmp8cijgj0yzfsjrn7vljwznjnjn278ay7z9pjwpwiva0diyi";
   };
-  disabled = ( luaOlder "5.1" );
+  disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
-  buildType = "builtin";
 
   meta = {
     homepage = "http://olivinelabs.com/luasystem/";
@@ -742,9 +785,8 @@ mediator_lua = buildLuarocksPackage {
     url    = http://luarocks.org/manifests/teto/mediator_lua-1.1.2-0.src.rock;
     sha256 = "18j49vvs94yfk4fw0xsq4v3j4difr6c99gfba0kxairmcqamd1if";
   };
-  disabled = ( luaOlder "5.1" );
+  disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
-  buildType = "builtin";
 
   meta = {
     homepage = "http://olivinelabs.com/mediator_lua/";
@@ -763,8 +805,6 @@ mpack = buildLuarocksPackage {
     sha256 = "0nq4ixaminkc7fwfpivysyv0al3j5dffsvgdrnwnqdg3w7jgfbw7";
   };
 
-  buildType = "builtin";
-
   meta = {
     homepage = "https://github.com/libmpack/libmpack-lua/releases/download/1.0.7/libmpack-lua-1.0.7.tar.gz";
     description = "Lua binding to libmpack";
@@ -775,18 +815,17 @@ mpack = buildLuarocksPackage {
 };
 nvim-client = buildLuarocksPackage {
   pname = "nvim-client";
-  version = "0.1.0-1";
+  version = "0.2.0-1";
 
   src = fetchurl {
-    url    = https://luarocks.org/nvim-client-0.1.0-1.src.rock;
-    sha256 = "1p57mrvm0ny3yi5cydr3z9qwzyg124rjp5w7vdflf2i23z39mkma";
+    url    = https://luarocks.org/nvim-client-0.2.0-1.src.rock;
+    sha256 = "1ah9mjvz28hrbwnyb5n60znz3m0m41rn7jpnxwfx773cys3skidx";
   };
-  disabled = ( luaOlder "5.1" );
+  disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua mpack luv coxpcall ];
-  buildType = "builtin";
 
   meta = {
-    homepage = "https://github.com/neovim/lua-client/archive/0.1.0-1.tar.gz";
+    homepage = "https://github.com/neovim/lua-client/archive/0.2.0-1.tar.gz";
     description = "Lua client to Nvim";
     license = {
       fullName = "Apache";
@@ -795,21 +834,14 @@ nvim-client = buildLuarocksPackage {
 };
 busted = buildLuarocksPackage {
   pname = "busted";
-  version = "2.0.rc13-0";
-
-  knownRockspec = (fetchurl {
-    url    = https://luarocks.org/busted-2.0.rc13-0.rockspec;
-    sha256 = "0hrvhg1324q5ra6cpjh1y3by6lrzs0ljah4jl48l8xlgw1z9z1q5";
-  }).outPath;
+  version = "2.0.rc12-1";
 
   src = fetchurl {
-    url    = https://github.com/Olivine-Labs/busted/archive/v2.0.rc13-0.tar.gz;
-    sha256 = "0m72bldn1r6j94ahcfmpaq1mmysrshf9qi9fjas7hpal0jp8ivvl";
+    url    = http://luarocks.org/manifests/teto/busted-2.0.rc12-1.src.rock;
+    sha256 = "18fzdc7ww4nxwinnw9ah5hi329ghrf0h8xrwcy26lk9qcs9n079z";
   };
-
-  disabled = ( luaOlder "5.1" );
+  disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua lua_cliargs luafilesystem luasystem dkjson say luassert lua-term penlight mediator_lua ];
-  buildType = "builtin";
 
   meta = {
     homepage = "http://olivinelabs.com/busted/";
@@ -833,9 +865,8 @@ luassert = buildLuarocksPackage {
     sha256 = "1vwq3wqj9cjyz9lnf1n38yhpcglr2h40v3n9096i8vcpmyvdb3ka";
   };
 
-  disabled = ( luaOlder "5.1" );
+  disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua say ];
-  buildType = "builtin";
 
   meta = {
     homepage = "http://olivinelabs.com/busted/";
@@ -854,8 +885,6 @@ coxpcall = buildLuarocksPackage {
     sha256 = "0n1jmda4g7x06458596bamhzhcsly6x0p31yp6q3jz4j11zv1zhi";
   };
 
-  buildType = "builtin";
-
   meta = {
     homepage = "http://keplerproject.github.io/coxpcall";
     description = "Coroutine safe xpcall and pcall";
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index c88f5f9f57ca..935de7cf0159 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -47,6 +47,15 @@ with super;
     buildInputs = [ pkgs.libiconv ];
   });
   luv = super.luv.overrideAttrs(oa: {
+    # Use system libuv instead of building local and statically linking
+    # This is a hacky way to specify -DWITH_SHARED_LIBUV=ON which
+    # should be possible but I'm unable to make work.
+    # While at it, remove bundled libuv source entirely to be sure.
+    # We may wish to drop bundled lua submodules too...
+    preBuild = ''
+     sed -i 's,\(option(WITH_SHARED_LIBUV.*\)OFF,\1ON,' CMakeLists.txt
+     rm -rf deps/libuv
+    '';
     propagatedBuildInputs = oa.propagatedBuildInputs ++ [ pkgs.libuv ];
   });
 
diff --git a/pkgs/development/ocaml-modules/alcotest/default.nix b/pkgs/development/ocaml-modules/alcotest/default.nix
index 8723b6a1f1ff..c43ad10d7d82 100644
--- a/pkgs/development/ocaml-modules/alcotest/default.nix
+++ b/pkgs/development/ocaml-modules/alcotest/default.nix
@@ -1,12 +1,13 @@
 { stdenv, fetchzip, ocaml, findlib, ocamlbuild, topkg, dune
-, cmdliner, astring, fmt, result
+, cmdliner, astring, fmt, result, uuidm
 }:
 
 let param =
   if stdenv.lib.versionAtLeast ocaml.version "4.02" then {
-    version = "0.8.2";
-    sha256 = "1zpg079v89mz2dpnh59f9hk5r03wl26skfn43llrv3kg24abjfpf";
+    version = "0.8.5";
+    sha256 = "1mhckvdcxkikbzgvy24kjz4265l15b86a6swz7m3ynbgvqdcfzqn";
     buildInputs = [ dune ];
+    propagatedBuildInputs = [ uuidm ];
     buildPhase = "dune build -p alcotest";
     inherit (dune) installPhase;
   } else {
@@ -28,7 +29,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ ocaml findlib ] ++ param.buildInputs;
 
-  propagatedBuildInputs = [ cmdliner astring fmt result ];
+  propagatedBuildInputs = [ cmdliner astring fmt result ]
+  ++ (param.propagatedBuildInputs or []);
 
   createFindlibDestdir = true;
 
diff --git a/pkgs/development/python-modules/XlsxWriter/default.nix b/pkgs/development/python-modules/XlsxWriter/default.nix
index 096dfb6a7799..678141f394f9 100644
--- a/pkgs/development/python-modules/XlsxWriter/default.nix
+++ b/pkgs/development/python-modules/XlsxWriter/default.nix
@@ -3,7 +3,7 @@
 buildPythonPackage rec {
 
   pname = "XlsxWriter";
-  version = "1.1.7";
+  version = "1.1.8";
 
   # PyPI release tarball doesn't contain tests so let's use GitHub. See:
   # https://github.com/jmcnamara/XlsxWriter/issues/327
@@ -11,7 +11,7 @@ buildPythonPackage rec {
     owner = "jmcnamara";
     repo = pname;
     rev = "RELEASE_${version}";
-    sha256 = "1zv5222bymfr7046ps5512x1kk7ipcx46jjxylaap1p6llqj7zlj";
+    sha256 = "19qhdcycaiamd3bp8v2z9rpirxsr4c29fgs219k2766fpmfrgx40";
   };
 
   meta = {
diff --git a/pkgs/development/python-modules/apprise/default.nix b/pkgs/development/python-modules/apprise/default.nix
new file mode 100644
index 000000000000..632600a8fe34
--- /dev/null
+++ b/pkgs/development/python-modules/apprise/default.nix
@@ -0,0 +1,31 @@
+{ lib, buildPythonPackage, fetchPypi
+, Babel, decorator, requests, requests_oauthlib, oauthlib, urllib3, six, click, markdown, pyyaml
+, pytestrunner, coverage, flake8, mock, pytest, pytestcov, tox
+}:
+
+buildPythonPackage rec {
+  pname = "apprise";
+  version = "0.7.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "c3c7922f7b80107620f541a6c16435485e7045771b3ecfb998deacee0eb90753";
+  };
+
+  nativeBuildInputs = [ Babel ];
+
+  propagatedBuildInputs = [
+    decorator requests requests_oauthlib oauthlib urllib3 six click markdown pyyaml
+  ];
+
+  checkInputs = [
+    pytestrunner coverage flake8 mock pytest pytestcov tox
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/caronc/apprise";
+    description = "Push Notifications that work with just about every platform!";
+    license = licenses.mit;
+    maintainers = [ maintainers.marsam ];
+  };
+}
diff --git a/pkgs/development/python-modules/avro/default.nix b/pkgs/development/python-modules/avro/default.nix
index 045790b9bc2d..97ecb5a1127f 100644
--- a/pkgs/development/python-modules/avro/default.nix
+++ b/pkgs/development/python-modules/avro/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "avro";
-  version = "1.8.2";
+  version = "1.9.0";
   disabled = isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8f9ee40830b70b5fb52a419711c9c4ad0336443a6fba7335060805f961b04b59";
+    sha256 = "0af72fcql34v30cvjqm9nmz68rl35znn5qbd4k3b9ks02xzy3b2y";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/python-modules/awkward/default.nix b/pkgs/development/python-modules/awkward/default.nix
index 057f20fce526..5de1f9fa8488 100644
--- a/pkgs/development/python-modules/awkward/default.nix
+++ b/pkgs/development/python-modules/awkward/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "awkward";
-  version = "0.9.0";
+  version = "0.10.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "140fdncibnlpdqr6hk8lhgkv7m2v8786rips5qp92r05agfzbhs0";
+    sha256 = "0vq27db5k8cc5jpbdrl531gjhig0f9iy0i7z6ks81lz1a2mkvjik";
   };
 
   nativeBuildInputs = [ pytestrunner ];
diff --git a/pkgs/development/python-modules/braintree/default.nix b/pkgs/development/python-modules/braintree/default.nix
index 393285636b60..2d1ca0d5f787 100644
--- a/pkgs/development/python-modules/braintree/default.nix
+++ b/pkgs/development/python-modules/braintree/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "braintree";
-  version = "3.53.0";
+  version = "3.54.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "026apwkjn83la7jm0azz3qajg26nza3gh49zd37j0rsp6cgmfa24";
+    sha256 = "09dbj04r55hnm8zvfz8wbnxkxb1pfy7g43pzcgs4hhh5xh45ppfd";
   };
 
   propagatedBuildInputs = [ requests ];
diff --git a/pkgs/development/python-modules/bugwarrior/default.nix b/pkgs/development/python-modules/bugwarrior/default.nix
index b2b10671f2b9..74df8a6b628f 100644
--- a/pkgs/development/python-modules/bugwarrior/default.nix
+++ b/pkgs/development/python-modules/bugwarrior/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "bugwarrior";
-  version = "1.6.0";
+  version = "1.7.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "cfa4fac19b4f4638928347b8fe192315f72813c3e8ed668867e5891338c7e4ec";
+    sha256 = "1pmznka5dxcdjfak0p1yh7lhfbfazmx8g9ysv57lsrkqy4n61qks";
   };
 
   buildInputs = [ mock unittest2 nose /* jira megaplan */ ];
diff --git a/pkgs/development/python-modules/datatable/default.nix b/pkgs/development/python-modules/datatable/default.nix
new file mode 100644
index 000000000000..3ea926ac23be
--- /dev/null
+++ b/pkgs/development/python-modules/datatable/default.nix
@@ -0,0 +1,40 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, llvm
+, typesentry
+, blessed
+, pytest
+}:
+
+buildPythonPackage rec {
+  pname = "datatable";
+  version = "0.8.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1s8z81zffrckvdwrrl0pkjc7gsdvjxw59xgg6ck81dl7gkh5grjk";
+  };
+
+  disabled = pythonOlder "3.5";
+
+  propagatedBuildInputs = [ typesentry blessed ];
+  buildInputs = [ llvm ];
+  checkInputs = [ pytest ];
+
+  LLVM = llvm;
+
+  checkPhase = ''
+    # py.test adds local datatable to path, which doesn't contain built native library.
+    mv datatable datatable.hidden
+    pytest
+  '';
+
+  meta = with lib; {
+    description = "data.table for Python";
+    homepage = "https://github.com/h2oai/datatable";
+    license = licenses.mpl20;
+    maintainers = with maintainers; [ abbradar ];
+  };
+}
diff --git a/pkgs/development/python-modules/distributed/default.nix b/pkgs/development/python-modules/distributed/default.nix
index ae309b49ccc5..2fd6829bc464 100644
--- a/pkgs/development/python-modules/distributed/default.nix
+++ b/pkgs/development/python-modules/distributed/default.nix
@@ -28,12 +28,12 @@
 
 buildPythonPackage rec {
   pname = "distributed";
-  version = "1.27.1";
+  version = "1.28.1";
 
   # get full repository need conftest.py to run tests
   src = fetchPypi {
     inherit pname version;
-    sha256 = "117q16ha03m8y9ydxg5svwx2cv1r2703hcy4a0zgjh5nhx4rfhiy";
+    sha256 = "12n487qn66jkgq4nd3vgyc9hfqw4i7zwr4dyybsqm4xmgs5kzn1v";
   };
 
   checkInputs = [ pytest pytest-repeat pytest-faulthandler pytest-timeout mock joblib ];
diff --git a/pkgs/development/python-modules/fasteners/default.nix b/pkgs/development/python-modules/fasteners/default.nix
index 77a6f9b04088..50a6dbf40df6 100644
--- a/pkgs/development/python-modules/fasteners/default.nix
+++ b/pkgs/development/python-modules/fasteners/default.nix
@@ -4,30 +4,30 @@
 , six
 , monotonic
 , testtools
-, python
 , isPy3k
+, nose
+, futures
 }:
 
 buildPythonPackage rec {
   pname = "fasteners";
-  version = "0.14.1";
+  version = "0.15";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "063y20kx01ihbz2mziapmjxi2cd0dq48jzg587xdsdp07xvpcz22";
+    sha256 = "3a176da6b70df9bb88498e1a18a9e4a8579ed5b9141207762368a1017bf8f5ef";
   };
 
-  propagatedBuildInputs = [ six monotonic testtools ];
+  propagatedBuildInputs = [ six monotonic ];
+
+  checkInputs = [ testtools nose ] ++ stdenv.lib.optionals (!isPy3k) [ futures ];
 
   checkPhase = ''
-    ${python.interpreter} -m unittest discover
+    nosetests
   '';
 
-  # Tests are written for Python 3.x only (concurrent.futures)
-  doCheck = isPy3k;
-
   meta = with stdenv.lib; {
-    description = "Fasteners";
+    description = "A python package that provides useful locks";
     homepage = https://github.com/harlowja/fasteners;
     license = licenses.asl20;
   };
diff --git a/pkgs/development/python-modules/flask-swagger/default.nix b/pkgs/development/python-modules/flask-swagger/default.nix
new file mode 100644
index 000000000000..c690e4e64ae5
--- /dev/null
+++ b/pkgs/development/python-modules/flask-swagger/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, buildPythonPackage, fetchPypi
+, flask, pyyaml }:
+
+buildPythonPackage rec {
+  version = "0.2.14";
+  pname = "flask-swagger";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "b4085f5bc36df4c20b6548cd1413adc9cf35719b0f0695367cd542065145294d";
+  };
+
+  # No Tests
+  doCheck = false;
+
+  propagatedBuildInputs = [
+    flask
+    pyyaml
+  ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/gangverk/flask-swagger";
+    license = licenses.mit;
+    description = "Extract swagger specs from your flask project";
+    maintainers = with maintainers; [ vanschelven ];
+  };
+}
diff --git a/pkgs/development/python-modules/gsd/default.nix b/pkgs/development/python-modules/gsd/default.nix
index 38826a9b3f29..567cc6f8930d 100644
--- a/pkgs/development/python-modules/gsd/default.nix
+++ b/pkgs/development/python-modules/gsd/default.nix
@@ -5,12 +5,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "1.6.2";
+  version = "1.7.0";
   pname = "gsd";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "58a6669f2375936810d74c3ee7e62c5616acf9e15aa32603701e55ab6fada5f5";
+    sha256 = "0fpk69wachyydpk9cbs901m7hkwrrvq24ykxsrz62km9ql8lr2vp";
   };
 
   propagatedBuildInputs = [ numpy ];
diff --git a/pkgs/development/python-modules/h11/default.nix b/pkgs/development/python-modules/h11/default.nix
index ecfb37eeda5a..42ebf1b81da7 100644
--- a/pkgs/development/python-modules/h11/default.nix
+++ b/pkgs/development/python-modules/h11/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "h11";
-  version = "0.8.1";
+  version = "0.9.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "acca6a44cb52a32ab442b1779adf0875c443c689e9e028f8d831a3769f9c5208";
+    sha256 = "1qfad70h59hya21vrzz8dqyyaiqhac0anl2dx3s3k80gpskvrm1k";
   };
 
   checkInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/hmmlearn/default.nix b/pkgs/development/python-modules/hmmlearn/default.nix
index db8ff5726ab9..9938d4053879 100644
--- a/pkgs/development/python-modules/hmmlearn/default.nix
+++ b/pkgs/development/python-modules/hmmlearn/default.nix
@@ -1,18 +1,22 @@
-{ lib, fetchurl, buildPythonPackage, numpy, scikitlearn }:
+{ lib, fetchurl, buildPythonPackage, numpy, scikitlearn, setuptools_scm, cython, pytest }:
 
 buildPythonPackage rec {
   pname = "hmmlearn";
-  version = "0.2.1";
+  version = "0.2.2";
   name = pname + "-" + version;
 
   src = fetchurl {
     url = "mirror://pypi/h/hmmlearn/${name}.tar.gz";
-    sha256 = "d43f5b25f9019ef5d01914d0972a5fa0594e82ab75d2c6aec26d682e47bd553c";
+    sha256 = "081c53xs5wn5vikwslallwdv0am09w9cbbggl5dbkqpnic9zx4h4";
   };
 
+  buildInputs = [ setuptools_scm cython ];
   propagatedBuildInputs = [ numpy scikitlearn ];
+  checkInputs = [ pytest ];
 
-  doCheck = false;
+  checkPhase = ''
+    pytest --doctest-modules --pyargs hmmlearn
+  '';
 
   meta = with lib; {
     description = "Hidden Markov Models in Python with scikit-learn like API";
diff --git a/pkgs/development/python-modules/nibabel/default.nix b/pkgs/development/python-modules/nibabel/default.nix
index da664d9a8d0f..76494c70b2ea 100644
--- a/pkgs/development/python-modules/nibabel/default.nix
+++ b/pkgs/development/python-modules/nibabel/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "nibabel";
-  version = "2.3.3";
+  version = "2.4.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b6366634c65b04464e62f3a9a8df1faa172f780ed7f1af1c6818b3dc2f1202c3";
+    sha256 = "f165ff1cb4464902d6594eb2694e2cfb6f8b9fe233b856c976c3cff623ee0e17";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/nuitka/default.nix b/pkgs/development/python-modules/nuitka/default.nix
index 57b48f991891..bf5ca3d55830 100644
--- a/pkgs/development/python-modules/nuitka/default.nix
+++ b/pkgs/development/python-modules/nuitka/default.nix
@@ -13,13 +13,13 @@ let
   # Therefore we create a separate env for it.
   scons = pkgs.python27.withPackages(ps: [ pkgs.scons ]);
 in buildPythonPackage rec {
-  version = "0.6.3";
+  version = "0.6.3.1";
   pname = "Nuitka";
 
   # Latest version is not yet on PyPi
   src = fetchurl {
     url = "https://github.com/kayhayen/Nuitka/archive/${version}.tar.gz";
-    sha256 = "0nzk6r724dyai33fi7xmc6jn57pkcwqm553vlv0r11blvc92d7pp";
+    sha256 = "0h05krv871ymz55k6lrdlfyqndck6lwyy69dk5v4sakgfd5iawqf";
   };
 
   checkInputs = [ vmprof pyqt4 ];
diff --git a/pkgs/development/python-modules/numericalunits/default.nix b/pkgs/development/python-modules/numericalunits/default.nix
index 1212bf0039c9..41b4c1a8f318 100644
--- a/pkgs/development/python-modules/numericalunits/default.nix
+++ b/pkgs/development/python-modules/numericalunits/default.nix
@@ -4,12 +4,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "1.16";
+  version = "1.23";
   pname = "numericalunits";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "71ae8e236c7a223bccefffb670dca68be476dd63b7b9009641fc64099455da25";
+    sha256 = "1q1jrzxx0k7j82c5q061hd10mp965ra8813vb09ji326fbxzn2gy";
   };
 
   # no tests
diff --git a/pkgs/development/python-modules/packet-python/default.nix b/pkgs/development/python-modules/packet-python/default.nix
index 5811d510dff9..61d387590480 100644
--- a/pkgs/development/python-modules/packet-python/default.nix
+++ b/pkgs/development/python-modules/packet-python/default.nix
@@ -3,36 +3,36 @@
 , fetchPypi
 , requests
 , python
-, fetchpatch
+
+# For tests/setup.py
+, pytest
+, pytestrunner
+, requests-mock
 }:
 
 buildPythonPackage rec {
   pname = "packet-python";
-  version = "1.37.1";
+  version = "1.38.2";
   src = fetchPypi {
     inherit pname version;
-    sha256 = "316941d2473c0f42ac17ac89e9aa63a023bb96f35cf8eafe9e091ea424892778";
+    sha256 = "1lh97la51fa3nxjl4ngsanrxw6qq5jwwn0dxj2f0946m043200xl";
   };
+  nativeBuildInputs = [ pytestrunner ];
   propagatedBuildInputs = [ requests ];
+  checkInputs = [
+    pytest
+    pytestrunner
+    requests-mock
+  ];
 
   checkPhase = ''
-    ${python.interpreter} -m unittest discover -s test
+    ${python.interpreter} setup.py test
   '';
 
-  patches = [
-    (fetchpatch {
-      url = https://github.com/packethost/packet-python/commit/361ad0c60d0bfce2a992eefd17e917f9dcf36400.patch;
-      sha256 = "1cmzyq0302y4cqmim6arnvn8n620qysq458g2w5aq4zj1vz1q9g1";
-    })
-  ];
-
-  # Not all test files are included in archive
-  doCheck = false;
-
   meta = {
     description = "A Python client for the Packet API.";
     homepage    = "https://github.com/packethost/packet-python";
     license     = lib.licenses.lgpl3;
     maintainers = with lib.maintainers; [ dipinhora ];
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/development/python-modules/pglast/default.nix b/pkgs/development/python-modules/pglast/default.nix
new file mode 100644
index 000000000000..bfa6c301a7ba
--- /dev/null
+++ b/pkgs/development/python-modules/pglast/default.nix
@@ -0,0 +1,36 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, isPy3k
+, pythonOlder
+, aenum
+, pytest
+, pytestcov
+}:
+
+buildPythonPackage rec {
+  pname = "pglast";
+  version = "1.4";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1442ae2cfc6427e9a8fcc2dc18d9ecfcaa1b16eba237fdcf0b2b13912eab9a86";
+  };
+
+  disabled = !isPy3k;
+
+  propagatedBuildInputs = lib.optionals (pythonOlder "3.6") [ aenum ];
+
+  checkInputs = [ pytest pytestcov ];
+
+  checkPhase = ''
+    pytest
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/lelit/pglast";
+    description = "PostgreSQL Languages AST and statements prettifier";
+    license = licenses.gpl3Plus;
+    maintainers = [ maintainers.marsam ];
+  };
+}
diff --git a/pkgs/development/python-modules/pychromecast/default.nix b/pkgs/development/python-modules/pychromecast/default.nix
index ff4059d862ee..ef5996f32c78 100644
--- a/pkgs/development/python-modules/pychromecast/default.nix
+++ b/pkgs/development/python-modules/pychromecast/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "PyChromecast";
-  version = "3.2.1";
+  version = "3.2.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e1e71e30581e1021b6bdd50a80cfcdcfa86d9082171fdd719c5ca6a77b8a9699";
+    sha256 = "17l7nlnpqjgnrw4hzs52lbzmdxa1vm3v51mm33l4c43c1md5m2ns";
   };
 
   disabled = !isPy3k;
diff --git a/pkgs/development/python-modules/pyenchant/default.nix b/pkgs/development/python-modules/pyenchant/default.nix
index 6b49c65faae0..8c240261463a 100644
--- a/pkgs/development/python-modules/pyenchant/default.nix
+++ b/pkgs/development/python-modules/pyenchant/default.nix
@@ -13,10 +13,10 @@ buildPythonPackage rec {
     sha256 = "fc31cda72ace001da8fe5d42f11c26e514a91fa8c70468739216ddd8de64e2a0";
   };
 
-  propagatedBuildInputs = [ pkgs.enchant ];
+  propagatedBuildInputs = [ pkgs.enchant1 ];
 
   patchPhase = let
-    path_hack_script = "s|LoadLibrary(e_path)|LoadLibrary('${pkgs.enchant}/lib/' + e_path)|";
+    path_hack_script = "s|LoadLibrary(e_path)|LoadLibrary('${pkgs.enchant1}/lib/' + e_path)|";
   in ''
     sed -i "${path_hack_script}" enchant/_enchant.py
 
@@ -31,6 +31,7 @@ buildPythonPackage rec {
     description = "pyenchant: Python bindings for the Enchant spellchecker";
     homepage = https://pythonhosted.org/pyenchant/;
     license = licenses.lgpl21;
+    badPlatforms = [ "x86_64-darwin" ];
   };
 
 }
diff --git a/pkgs/development/python-modules/pylint/default.nix b/pkgs/development/python-modules/pylint/default.nix
index 8f1f4378a394..64259872ce32 100644
--- a/pkgs/development/python-modules/pylint/default.nix
+++ b/pkgs/development/python-modules/pylint/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, buildPythonPackage, fetchPypi, python, pythonOlder, astroid,
-  isort, mccabe, pytest, pytestrunner, pyenchant }:
+  isort, mccabe, pytest, pytestrunner }:
 
 buildPythonPackage rec {
   pname = "pylint";
@@ -14,7 +14,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [ pytestrunner ];
 
-  checkInputs = [ pytest pyenchant ];
+  checkInputs = [ pytest ];
 
   propagatedBuildInputs = [ astroid isort mccabe ];
 
diff --git a/pkgs/development/python-modules/pytest-tornado/default.nix b/pkgs/development/python-modules/pytest-tornado/default.nix
index c03590f8de88..a5c351502683 100644
--- a/pkgs/development/python-modules/pytest-tornado/default.nix
+++ b/pkgs/development/python-modules/pytest-tornado/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "pytest-tornado";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0jv7jhq6ddhsmnz67vc76r4kwac9k5a142968zppyw9av6qalbl4";
+    sha256 = "0ncaq7icijls6qh66kv19w3i9av2wnmaycfr4yadyybajr8yvffz";
   };
 
   # package has no tests
diff --git a/pkgs/development/python-modules/python-stdnum/default.nix b/pkgs/development/python-modules/python-stdnum/default.nix
index 582192113243..06577249a02d 100644
--- a/pkgs/development/python-modules/python-stdnum/default.nix
+++ b/pkgs/development/python-modules/python-stdnum/default.nix
@@ -1,14 +1,19 @@
-{ lib, fetchPypi, buildPythonPackage, isPy3k }:
+{ lib, fetchPypi, buildPythonPackage, nose }:
 
 buildPythonPackage rec {
-  version = "1.10";
+  version = "1.11";
   pname = "python-stdnum";
-  # Failing tests and dependency issue on Py3k
-  disabled = isPy3k;
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0prs63q8zdgwr5cxc5a43zvsm66l0gf9jk19qdf85m6isnp5186a";
+    sha256 = "d5f0af1bee9ddd9a20b398b46ce062dbd4d41fcc9646940f2667256a44df3854";
   };
+
+  checkInputs = [ nose ];
+
+  checkPhase = ''
+    nosetests
+  '';
+
   meta = {
     homepage = https://arthurdejong.org/python-stdnum/;
     description = "Python module to handle standardized numbers and codes";
diff --git a/pkgs/development/python-modules/rpyc/default.nix b/pkgs/development/python-modules/rpyc/default.nix
index 982fd7fcf59b..b69bf1851a8b 100644
--- a/pkgs/development/python-modules/rpyc/default.nix
+++ b/pkgs/development/python-modules/rpyc/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "rpyc";
-  version = "4.0.2";
+  version = "4.1.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a0d87cbad152f25e3702a03cb7fd67f6b10c87680a60ec3aea8dca5a56307c10";
+    sha256 = "1pz90h21f74n8i3cx5ndxm4r3rismkx5qbw1c0cmfci9a3009rq5";
   };
 
   propagatedBuildInputs = [ nose plumbum ];
diff --git a/pkgs/development/python-modules/stripe/default.nix b/pkgs/development/python-modules/stripe/default.nix
index e69414735888..180ff7580806 100644
--- a/pkgs/development/python-modules/stripe/default.nix
+++ b/pkgs/development/python-modules/stripe/default.nix
@@ -1,9 +1,8 @@
-{ lib, buildPythonPackage, fetchPypi, isPy3k
-, unittest2, mock, requests, simplejson }:
+{ lib, buildPythonPackage, fetchPypi, requests, toml, pytest, pytestcov, pytest-mock, pytest_xdist }:
 
 buildPythonPackage rec {
   pname = "stripe";
-  version = "2.27.0";
+  version = "2.29.3";
 
   # Tests require network connectivity and there's no easy way to disable
   # them. ~ C.
@@ -11,12 +10,16 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0pvypngbmiji92nfs28bmiyl7brsm6cj18d9vhnwyydnzn3nlkl1";
+    sha256 = "73f9af72ef8125e0d1c713177d006f1cbe95602beb3e10cb0b0a4ae358d1ae86";
   };
 
-  checkInputs = [ unittest2 mock ];
+  postPatch = ''
+    substituteInPlace setup.py --replace "toml>=0.9,<0.10" "toml>=0.9"
+  '';
 
-  propagatedBuildInputs = [ requests ] ++ lib.optional (!isPy3k) simplejson;
+  propagatedBuildInputs = [ toml requests ];
+
+  checkInputs = [ pytest pytestcov pytest-mock pytest_xdist ];
 
   meta = with lib; {
     description = "Stripe Python bindings";
diff --git a/pkgs/development/python-modules/twilio/default.nix b/pkgs/development/python-modules/twilio/default.nix
index f8fbf8e49f4a..d6fed4b9007f 100644
--- a/pkgs/development/python-modules/twilio/default.nix
+++ b/pkgs/development/python-modules/twilio/default.nix
@@ -3,13 +3,13 @@
 
 buildPythonPackage rec {
   pname = "twilio";
-  version = "6.26.2";
+  version = "6.27.1";
   # tests not included in PyPi, so fetch from github instead
   src = fetchFromGitHub {
     owner = "twilio";
     repo = "twilio-python";
     rev = version;
-    sha256 = "0z0ahbckh5calwgkmd493znixclhjjrly8jfymhwlw6g0g79kavw";
+    sha256 = "1yd4cpl4y01d3a956gsdg13vx02rb176wyh7mzr0aznkp38nyw5w";
   };
 
   buildInputs = [ nose mock ];
diff --git a/pkgs/development/python-modules/typesentry/default.nix b/pkgs/development/python-modules/typesentry/default.nix
new file mode 100644
index 000000000000..3aeb84113c2d
--- /dev/null
+++ b/pkgs/development/python-modules/typesentry/default.nix
@@ -0,0 +1,33 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, colorama
+, pytest
+, pytestcov
+}:
+
+buildPythonPackage rec {
+  pname = "typesentry";
+  version = "0.2.7";
+
+  # Only wheel distribution is available on PyPi.
+  src = fetchFromGitHub {
+    owner = "h2oai";
+    repo = "typesentry";
+    rev = "0ca8ed0e62d15ffe430545e7648c9a9b2547b49c";
+    sha256 = "0z615f9dxaab3bay3v27j7q99qm6l6q8xv872yvsp87sxj7apfki";
+  };
+
+  propagatedBuildInputs = [ colorama ];
+  checkInputs = [ pytest pytestcov ];
+  checkPhase = ''
+    pytest
+  '';
+
+  meta = with lib; {
+    description = "Python 2.7 & 3.5+ runtime type-checker";
+    homepage = "https://github.com/h2oai/typesentry";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ abbradar ];
+  };
+}
diff --git a/pkgs/development/python-modules/uncertainties/default.nix b/pkgs/development/python-modules/uncertainties/default.nix
index 2d7fdaa7eca5..6e357f307e3a 100644
--- a/pkgs/development/python-modules/uncertainties/default.nix
+++ b/pkgs/development/python-modules/uncertainties/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "uncertainties";
-  version = "3.0.3";
+  version = "3.1.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1hp00k10d5n69s446flss8b4rd02wq8dscvakv7ylfyf2p8y564s";
+    sha256 = "18b184110cbe31303d25a7bc7f73d51b9cb4e15563cb9aa25ccfbd0ebe07d448";
   };
 
   buildInputs = [ nose numpy ];
diff --git a/pkgs/development/python-modules/xgboost/default.nix b/pkgs/development/python-modules/xgboost/default.nix
index d9b8fc892c16..559789149736 100644
--- a/pkgs/development/python-modules/xgboost/default.nix
+++ b/pkgs/development/python-modules/xgboost/default.nix
@@ -1,9 +1,15 @@
 { stdenv
 , buildPythonPackage
+, pytest
 , nose
 , scipy
+, scikitlearn
 , xgboost
 , substituteAll
+, pandas
+, matplotlib
+, graphviz
+, datatable
 }:
 
 buildPythonPackage rec {
@@ -21,7 +27,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ scipy ];
   buildInputs = [ xgboost ];
-  checkInputs = [ nose ];
+  checkInputs = [ nose pytest scikitlearn pandas matplotlib graphviz datatable ];
 
   checkPhase = ''
     ln -sf ../demo .
diff --git a/pkgs/development/python-modules/xgboost/lib-path-for-python.patch b/pkgs/development/python-modules/xgboost/lib-path-for-python.patch
index 68b39dee53e9..86c628c694bf 100644
--- a/pkgs/development/python-modules/xgboost/lib-path-for-python.patch
+++ b/pkgs/development/python-modules/xgboost/lib-path-for-python.patch
@@ -1,24 +1,3 @@
-diff --git a/python-package/setup.py b/python-package/setup.py
-index e6c3386f..4ed0a8bd 100644
---- a/python-package/setup.py
-+++ b/python-package/setup.py
-@@ -16,8 +16,6 @@ libpath_py = os.path.join(CURRENT_DIR, 'xgboost/libpath.py')
- libpath = {'__file__': libpath_py}
- exec(compile(open(libpath_py, "rb").read(), libpath_py, 'exec'), libpath, libpath)
- 
--LIB_PATH = [os.path.relpath(libfile, CURRENT_DIR) for libfile in libpath['find_lib_path']()]
--print("Install libxgboost from: %s" % LIB_PATH)
- # Please use setup_pip.py for generating and deploying pip installation
- # detailed instruction in setup_pip.py
- setup(name='xgboost',
-@@ -35,7 +33,6 @@ setup(name='xgboost',
-       # this will use MANIFEST.in during install where we specify additional files,
-       # this is the golden line
-       include_package_data=True,
--      data_files=[('xgboost', LIB_PATH)],
-       license='Apache-2.0',
-       classifiers=['License :: OSI Approved :: Apache Software License'],
-       url='https://github.com/dmlc/xgboost')
 diff --git a/python-package/xgboost/libpath.py b/python-package/xgboost/libpath.py
 index d87922c0..859a30fb 100644
 --- a/python-package/xgboost/libpath.py
diff --git a/pkgs/development/tools/analysis/swarm/default.nix b/pkgs/development/tools/analysis/swarm/default.nix
index a67d9b8d42e8..86e4d6ef5f69 100644
--- a/pkgs/development/tools/analysis/swarm/default.nix
+++ b/pkgs/development/tools/analysis/swarm/default.nix
@@ -1,23 +1,18 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
-  name = "swarm-${version}";
-  version = "3.1";
+  name = "swarm-2019-03-11";
 
-  src = fetchurl {
-    url = "http://www.spinroot.com/swarm/swarm${version}.tar";
-    sha256 = "12hi6wy0v0jfbrmgfxpnz7vxfzz3g1c6z7dj8p8kc2nm0q5bii47";
+  src = fetchFromGitHub {
+    owner = "nimble-code";
+    repo = "swarm";
+    rev = "4b36ed83c8fbb074f2dc5777fe1c0ab4d73cc7d9";
+    sha256 = "18zwlwsiiksivjpg6agmbmg0zsw2fl9475ss66b6pgcsya2q4afs";
   };
 
-  sourceRoot = ".";
-
-  buildPhase = ''
-    gcc -O2 -lm swarm.c -o swarm
-  '';
-
   installPhase = ''
-    install -Dm755 swarm $out/bin/swarm
-    install -Dm644 swarm.1 $out/share/man/man1/swarm.1
+    install -Dm755 Src/swarm $out/bin/swarm
+    install -Dm644 Doc/swarm.1 $out/share/man/man1/swarm.1
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/tools/build-managers/gn/default.nix b/pkgs/development/tools/build-managers/gn/default.nix
index 8c1b55fc5c9a..7ee4c4ee2580 100644
--- a/pkgs/development/tools/build-managers/gn/default.nix
+++ b/pkgs/development/tools/build-managers/gn/default.nix
@@ -52,6 +52,8 @@ stdenv.mkDerivation rec {
     install -vD out/gn "$out/bin/gn"
   '';
 
+  setupHook = ./setup-hook.sh;
+
   meta = with lib; {
     description = "A meta-build system that generates NinjaBuild files";
     homepage = https://gn.googlesource.com/gn;
diff --git a/pkgs/development/tools/build-managers/gn/setup-hook.sh b/pkgs/development/tools/build-managers/gn/setup-hook.sh
new file mode 100644
index 000000000000..75d2edcaf1c6
--- /dev/null
+++ b/pkgs/development/tools/build-managers/gn/setup-hook.sh
@@ -0,0 +1,14 @@
+gnConfigurePhase() {
+    runHook preConfigure
+
+    echo "gn flags: $gnFlags ${gnFlagsArray[@]}"
+
+    gn gen out/Release --args="$gnFlags ${gnFlagsArray[@]}"
+    cd out/Release/
+
+    runHook postConfigure
+}
+
+if [ -z "$dontUseGnConfigure" -a -z "$configurePhase" ]; then
+    configurePhase=gnConfigurePhase
+fi
diff --git a/pkgs/development/tools/build-managers/qbs/default.nix b/pkgs/development/tools/build-managers/qbs/default.nix
index 196a5d2a7fc9..266dff8cf6ce 100644
--- a/pkgs/development/tools/build-managers/qbs/default.nix
+++ b/pkgs/development/tools/build-managers/qbs/default.nix
@@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
   name = "qbs-${version}";
 
-  version = "1.13.0";
+  version = "1.13.1";
 
   src = fetchFromGitHub {
     owner = "qbs";
     repo = "qbs";
     rev = "v${version}";
-    sha256 = "12zzbhddsgfxyzglknvim0bb7rrnifawnx18g35g1105ybfak607";
+    sha256 = "1a9mydfsax5pzbnx8g8f9blc4xpk5rdjq8fvkdaiwapdczban1ya";
   };
 
   nativeBuildInputs = [ qmake ];
@@ -22,6 +22,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "A tool that helps simplify the build process for developing projects across multiple platforms";
+    homepage = "https://wiki.qt.io/Qbs";
     license = licenses.lgpl3;
     maintainers = with maintainers; [ expipiplus1 ];
     platforms = platforms.linux;
diff --git a/pkgs/development/tools/cargo-web/default.nix b/pkgs/development/tools/cargo-web/default.nix
index f170780b6e3f..262a3d31742a 100644
--- a/pkgs/development/tools/cargo-web/default.nix
+++ b/pkgs/development/tools/cargo-web/default.nix
@@ -1,29 +1,32 @@
 { stdenv, fetchFromGitHub, openssl, perl, pkgconfig, rustPlatform
-, CoreServices, Security
+, CoreServices, Security, cf-private
 }:
 
 rustPlatform.buildRustPackage rec {
-  name = "cargo-web-${version}";
-  version = "0.6.23";
+  pname = "cargo-web";
+  version = "0.6.25";
 
   src = fetchFromGitHub {
     owner = "koute";
-    repo = "cargo-web";
+    repo = pname;
     rev = version;
-    sha256 = "1qbi3z4x39il07xlhfvq5ckzjqrf0yf6p8qidf24fp92gb940zxr";
+    sha256 = "0q77bryc7ap8gb4rzp9xk8ngqwxh106qn7899g30lwxycnyii0mf";
   };
 
-  cargoSha256 = "1ysp8y0s0ha5gffwkra2vd1qh5wmfy1678k9hsfals0ww2f79wii";
+  cargoSha256 = "1f4sj260q4rlzbajwimya1yhh90hmmbhr47yfg9i8xcv5cg0cqjn";
 
   nativeBuildInputs = [ openssl perl pkgconfig ];
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ CoreServices Security ];
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [
+    CoreServices Security
+    # Needed for CFURLResourceIsReachable symbols.
+    cf-private
+  ];
 
   meta = with stdenv.lib; {
     description = "A Cargo subcommand for the client-side Web";
     homepage = https://github.com/koute/cargo-web;
-    license = with licenses; [asl20 /* or */ mit];
+    license = with licenses; [ asl20 /* or */ mit ];
     maintainers = [ maintainers.kevincox ];
-    broken = stdenv.isDarwin;  # test with CoreFoundation 10.11
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
index a8f4336cf71e..42e8f26970f5 100644
--- a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
@@ -1,16 +1,16 @@
 { lib, buildGoPackage, fetchFromGitLab, fetchurl }:
 
 let
-  version = "11.10.1";
+  version = "11.11.0";
   # Gitlab runner embeds some docker images these are prebuilt for arm and x86_64
   docker_x86_64 = fetchurl {
     url = "https://gitlab-runner-downloads.s3.amazonaws.com/v${version}/helper-images/prebuilt-x86_64.tar.xz";
-    sha256 = "120gpyim54mc8z84gzpbms5hkg2xg4sgzdvkrn1fis9myvd55bav";
+    sha256 = "0h35y3ifqqsirkbgg75jj30n1ggyyncbwjnnxwdhc3r9hbbc545y";
   };
 
   docker_arm = fetchurl {
     url = "https://gitlab-runner-downloads.s3.amazonaws.com/v${version}/helper-images/prebuilt-arm.tar.xz";
-    sha256 = "0qfqsi1fm94sxv7g975fw0av871f677rp48yv8q5669ipm16n9qk";
+    sha256 = "1lphzy5xxyc4qgmnf7rrplida2zdn2mfl9p9fr3gyjs7gbcr92d7";
   };
 in
 buildGoPackage rec {
@@ -29,7 +29,7 @@ buildGoPackage rec {
     owner = "gitlab-org";
     repo = "gitlab-runner";
     rev = "v${version}";
-    sha256 = "1nxv783rdzdwm0qq3li893p7q3n8gg7abla2961f3n735gjlnibx";
+    sha256 = "0i45p4z8f7ggdh7624473d8qhz7d75hlhz98p3z69dggx38vv49y";
   };
 
   patches = [ ./fix-shell-path.patch ];
diff --git a/pkgs/development/tools/git-repo-updater/default.nix b/pkgs/development/tools/git-repo-updater/default.nix
new file mode 100644
index 000000000000..6acb628a322c
--- /dev/null
+++ b/pkgs/development/tools/git-repo-updater/default.nix
@@ -0,0 +1,22 @@
+{ lib, buildPythonApplication, fetchPypi
+, colorama, GitPython }:
+
+buildPythonApplication rec {
+  pname = "gitup";
+  version = "0.5";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "11ilz9i2yxrbipyjzpfkj7drx9wkrn3phvd1a60jivphbqdldpgf";
+  };
+
+  propagatedBuildInputs = [ colorama GitPython ];
+
+  meta = with lib; {
+    description = "Easily update multiple Git repositories at once";
+    homepage = "https://github.com/earwig/git-repo-updater";
+    license = licenses.mit;
+    maintainers = [ maintainers.bdesham ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/development/tools/just/default.nix b/pkgs/development/tools/just/default.nix
index a819c157a57f..447cc51ac39b 100644
--- a/pkgs/development/tools/just/default.nix
+++ b/pkgs/development/tools/just/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "just";
-  version = "0.4.3";
+  version = "0.4.4";
 
   src = fetchFromGitHub {
     owner = "casey";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0zlxnbifmw1l3j4qw4l8d1mxyj0a7qw2fq90ffghf79f9zgrl4g3";
+    sha256 = "06k1pl2qmmr9q0ffw6l0dzqqfgpckmrdzjpzn9cw23shhihv99a8";
   };
 
-  cargoSha256 = "0i7qa6qwvql9nv88vg6d7b1bh50xx53phd341fxba4a27kbmalqg";
+  cargoSha256 = "1blsdl9dsq24vhm8cg1ja9m4b3h343lndibq6wz2kcwdq4i8jhd0";
 
   checkInputs = [ coreutils bash dash ];
 
diff --git a/pkgs/development/tools/ktlint/default.nix b/pkgs/development/tools/ktlint/default.nix
index c46250142c9e..0bfe54508b81 100644
--- a/pkgs/development/tools/ktlint/default.nix
+++ b/pkgs/development/tools/ktlint/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "ktlint-${version}";
-  version = "0.32.0";
+  version = "0.33.0";
 
   src = fetchurl {
     url = "https://github.com/shyiko/ktlint/releases/download/${version}/ktlint";
-    sha256 = "0ha4n2gsfvcycwammywqr7xg5ydlgpflmlm380v767178p5r5llm";
+    sha256 = "11yh4d7ybmddw86n8ms259rwd3q0gx2qqir2x92dhywp6pb8g11b";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/tools/misc/gede/default.nix b/pkgs/development/tools/misc/gede/default.nix
index 3099bc38dc20..70a157bc0840 100644
--- a/pkgs/development/tools/misc/gede/default.nix
+++ b/pkgs/development/tools/misc/gede/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "gede-${version}";
-  version = "2.13.1";
+  version = "2.14.1";
 
   src = fetchurl {
     url = "http://gede.acidron.com/uploads/source/${name}.tar.xz";
-    sha256 = "00qgp45hgcnmv8qj0vicqmiwa82rzyadcqy48xfxjd4xgf0qy5bk";
+    sha256 = "1z7577zwz7h03d58as93hyx99isi3p4i3rhxr8l01zgi65mz0mr9";
   };
 
   nativeBuildInputs = [ qmake makeWrapper python ];
diff --git a/pkgs/development/tools/misc/luarocks/luarocks-nix.nix b/pkgs/development/tools/misc/luarocks/luarocks-nix.nix
index 198da09e1d06..d9f481425b62 100644
--- a/pkgs/development/tools/misc/luarocks/luarocks-nix.nix
+++ b/pkgs/development/tools/misc/luarocks/luarocks-nix.nix
@@ -4,7 +4,7 @@ luarocks.overrideAttrs(old: {
   src = fetchFromGitHub {
     owner = "teto";
     repo = "luarocks";
-    rev = "ca52159dcb544161e5bef1e4e366f3da31fa4555";
-    sha256 = "13g7vpyirq51qmmnjsqhhiia9wdnq9aw4da0n3r7l1ar95q168sn";
+    rev = "595456f1246d66e5bdce0de838d0d6188274991c";
+    sha256 = "14nn0n5a0m516lnbwljy85h7y98zwnfbcyz7hgsm6fn4p8316yz2";
   };
 })
diff --git a/pkgs/development/tools/ocaml/merlin/default.nix b/pkgs/development/tools/ocaml/merlin/default.nix
index e059a5d6a76c..ca98daa8c28c 100644
--- a/pkgs/development/tools/ocaml/merlin/default.nix
+++ b/pkgs/development/tools/ocaml/merlin/default.nix
@@ -1,14 +1,16 @@
-{ stdenv, fetchzip, buildDunePackage, yojson }:
+{ stdenv, fetchFromGitHub, buildDunePackage, yojson }:
 
 buildDunePackage rec {
   pname = "merlin";
-  version = "3.2.2";
+  version = "3.3.0";
 
-  minimumOCamlVersion = "4.02";
+  minimumOCamlVersion = "4.02.1";
 
-  src = fetchzip {
-    url = "https://github.com/ocaml/merlin/archive/v${version}.tar.gz";
-    sha256 = "15ssgmwdxylbwhld9p1cq8x6kadxyhll5bfyf11dddj6cldna3hb";
+  src = fetchFromGitHub {
+    owner = "ocaml";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1s4y7jz581hj4gqv4pkk3980khw4lm0qzcj416b4ckji40q7nf9d";
   };
 
   buildInputs = [ yojson ];
diff --git a/pkgs/development/tools/rust/cargo-make/default.nix b/pkgs/development/tools/rust/cargo-make/default.nix
index 78eb0aa3e94d..ab625d7ea357 100644
--- a/pkgs/development/tools/rust/cargo-make/default.nix
+++ b/pkgs/development/tools/rust/cargo-make/default.nix
@@ -2,7 +2,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-make";
-  version = "0.19.3";
+  version = "0.19.4";
 
   src =
     let
@@ -10,11 +10,11 @@ rustPlatform.buildRustPackage rec {
         owner = "sagiegurari";
         repo = pname;
         rev = version;
-        sha256 = "11mkfwvzsr86w9675zpq8gcq5avsfvwffca26h6gkc7ahqcsx3ac";
+        sha256 = "019dn401p4bds144fbvqxbnn8vswcj0lxr8cvgpxb2y22640z60l";
       };
       cargo-lock = fetchurl {
-        url = "https://gist.githubusercontent.com/xrelkd/e4c9c7738b21f284d97cb7b1d181317d/raw/3592410d14443cc6be675553a9c228401114fa5f/cargo-make-Cargo.lock";
-        sha256 = "0m8m2pn8y7n1js1kkva4lxahz5j4d73lj7l45h8dd30lw2w4n3hg";
+        url = "https://gist.githubusercontent.com/xrelkd/e4c9c7738b21f284d97cb7b1d181317d/raw/c5b9fde279a9f6d55d97e0ba4e0b4cd62e0ab2bf/cargo-make-Cargo.lock";
+        sha256 = "1d5md3m8hxwf3pwvx059fsk1b3vvqm17pxbbyiisn9v4psrsmld5";
       };
     in
     runCommand "cargo-make-src" {} ''
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
 
-  cargoSha256 = "00yvx87s8vngb97ldq2amdhdv3nn38liys7nilay73phx0xybx4p";
+  cargoSha256 = "0wf60ck0w3m9fa19dz99q84kw05sxlj2pp6bd8r1db3cfy8f8h8j";
 
   # Some tests fail because they need network access.
   # However, Travis ensures a proper build.
diff --git a/pkgs/development/tools/skopeo/default.nix b/pkgs/development/tools/skopeo/default.nix
index 66941ca281ef..6dfda2bbfe6c 100644
--- a/pkgs/development/tools/skopeo/default.nix
+++ b/pkgs/development/tools/skopeo/default.nix
@@ -44,7 +44,7 @@ buildGoPackage rec {
   postBuild = ''
     # depends on buildGoPackage not changing …
     pushd ./go/src/${goPackagePath}
-    make install-docs MANINSTALLDIR="$man"
+    make install-docs MANINSTALLDIR="$man/share/man"
     popd
   '';
 
diff --git a/pkgs/development/tools/xcbuild/wrapper.nix b/pkgs/development/tools/xcbuild/wrapper.nix
index 902d21040501..bc49a48778fc 100644
--- a/pkgs/development/tools/xcbuild/wrapper.nix
+++ b/pkgs/development/tools/xcbuild/wrapper.nix
@@ -3,7 +3,7 @@
 , runtimeShell, callPackage
 , xcodePlatform ? stdenv.targetPlatform.xcodePlatform or "MacOSX"
 , xcodeVer ? stdenv.targetPlatform.xcodeVer or "9.4.1"
-, sdkVer ? stdenv.targetPlatform.sdkVer or "10.10" }:
+, sdkVer ? stdenv.targetPlatform.sdkVer or "10.12" }:
 
 let
 
@@ -107,6 +107,9 @@ runCommand "xcodebuild-${xcbuild.version}" {
   ln -s ${platforms} $out/Platforms
   ln -s ${toolchains} $out/Toolchains
 
+  mkdir -p $out/Applications/Xcode.app/Contents
+  ln -s $out $out/Applications/Xcode.app/Contents/Developer
+
   makeWrapper ${xcbuild}/bin/xcodebuild $out/bin/xcodebuild \
     --add-flags "-xcconfig ${xcconfig}" \
     --add-flags "DERIVED_DATA_DIR=." \
@@ -116,7 +119,7 @@ runCommand "xcodebuild-${xcbuild.version}" {
     --run '[ "$1" = "-license" ] && exit 0'
 
   substitute ${xcode-select} $out/bin/xcode-select \
-    --subst-var-by DEVELOPER_DIR $out
+    --subst-var-by DEVELOPER_DIR $out/Applications/Xcode.app/Contents/Developer
   chmod +x $out/bin/xcode-select
 
   substitute ${xcrun} $out/bin/xcrun
diff --git a/pkgs/development/web/nodejs/nodejs.nix b/pkgs/development/web/nodejs/nodejs.nix
index 7364789d505a..b4213c6ed944 100644
--- a/pkgs/development/web/nodejs/nodejs.nix
+++ b/pkgs/development/web/nodejs/nodejs.nix
@@ -4,7 +4,7 @@
 , writeScript, coreutils, gnugrep, jq, curl, common-updater-scripts, nix, runtimeShell
 , gnupg
 , darwin, xcbuild
-, procps
+, procps, icu
 }:
 
 with stdenv.lib;
@@ -30,7 +30,9 @@ let
      *  as that would put the paths into bin/nodejs.
      *  Including pkgconfig in build inputs would also have the same effect!
      */
-  ]) (builtins.attrNames sharedLibDeps);
+  ]) (builtins.attrNames sharedLibDeps) ++ [
+    "--with-intl=system-icu"
+  ];
 
   copyLibHeaders =
     map
@@ -51,10 +53,10 @@ in
     };
 
     buildInputs = optionals stdenv.isDarwin [ CoreServices ApplicationServices ]
-      ++ [ python2 zlib libuv openssl http-parser ];
+      ++ [ python2 zlib libuv openssl http-parser icu ];
 
-    nativeBuildInputs = [ which utillinux ]
-      ++ optionals stdenv.isDarwin [ pkgconfig xcbuild ];
+    nativeBuildInputs = [ which utillinux pkgconfig ]
+      ++ optionals stdenv.isDarwin [ xcbuild ];
 
     configureFlags = sharedConfigureFlags ++ [ "--without-dtrace" ] ++ extraConfigFlags;
 
diff --git a/pkgs/development/web/nodejs/v12.nix b/pkgs/development/web/nodejs/v12.nix
index 06eb3e45e6fc..1e68714f8c14 100644
--- a/pkgs/development/web/nodejs/v12.nix
+++ b/pkgs/development/web/nodejs/v12.nix
@@ -1,10 +1,10 @@
-{ stdenv, callPackage, lib, openssl, enableNpm ? true }:
+{ stdenv, callPackage, lib, openssl, icu, enableNpm ? true }:
 
 let
-  buildNodejs = callPackage ./nodejs.nix { inherit openssl; };
+  buildNodejs = callPackage ./nodejs.nix { inherit openssl icu; };
 in
   buildNodejs {
     inherit enableNpm;
-    version = "12.3.1";
-    sha256 = "1zhb5nq9s6cshbm6lf7qsy310fcsiy9wdr869vs6hw76zyn50axs";
+    version = "12.4.0";
+    sha256 = "1qwcv8m1m3293vmb4x2xrpqlpaa1r1951gf0mva60b2hsdk27d90";
   }
diff --git a/pkgs/development/web/now-cli/default.nix b/pkgs/development/web/now-cli/default.nix
index 943fb457f008..025a7e15e294 100644
--- a/pkgs/development/web/now-cli/default.nix
+++ b/pkgs/development/web/now-cli/default.nix
@@ -1,12 +1,12 @@
 { stdenv, lib, fetchurl }:
 stdenv.mkDerivation rec {
   name = "now-cli-${version}";
-  version = "15.0.10";
+  version = "15.3.0";
 
   # TODO: switch to building from source, if possible
   src = fetchurl {
     url = "https://github.com/zeit/now-cli/releases/download/${version}/now-linux.gz";
-    sha256 = "00w9bniz87jjvizl364hpfssvbl1y1fdzp0732j348x528px2krh";
+    sha256 = "08bymzwx4biyqw3md8pa9q6lbnxlpxicrndp4b1hmhdf9i859w5l";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/games/gzdoom/default.nix b/pkgs/games/gzdoom/default.nix
index 755781b8bd46..f64a392a6e40 100644
--- a/pkgs/games/gzdoom/default.nix
+++ b/pkgs/games/gzdoom/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, cmake, makeWrapper
-, openal, fluidsynth, soundfont-fluid, libGL, SDL2
+, openal, fluidsynth_1, soundfont-fluid, libGL, SDL2
 , bzip2, zlib, libjpeg, libsndfile, mpg123, game-music-emu }:
 
 stdenv.mkDerivation rec {
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake makeWrapper ];
   buildInputs = [
-    SDL2 libGL openal fluidsynth bzip2 zlib libjpeg libsndfile mpg123
+    SDL2 libGL openal fluidsynth_1 bzip2 zlib libjpeg libsndfile mpg123
     game-music-emu
   ];
 
diff --git a/pkgs/games/klavaro/default.nix b/pkgs/games/klavaro/default.nix
index aed61f40b177..9fc7d0c3a7da 100644
--- a/pkgs/games/klavaro/default.nix
+++ b/pkgs/games/klavaro/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "klavaro-${version}";
-  version = "3.05";
+  version = "3.07";
 
   src = fetchurl {
     url = "mirror://sourceforge/klavaro/${name}.tar.bz2";
-    sha256 = "046xc7is1jz5azkwrb7i9wdqkz8hdm68ga02g6whmi53130wd0py";
+    sha256 = "1zz7kr3rhprn1ixmh58x8sdmdfl42lki7vgbina3sgnamx31zia5";
   };
 
   nativeBuildInputs = [ intltool makeWrapper pkgconfig ];
diff --git a/pkgs/games/onscripter-en/default.nix b/pkgs/games/onscripter-en/default.nix
index cc337f58f735..921ed8a72f33 100644
--- a/pkgs/games/onscripter-en/default.nix
+++ b/pkgs/games/onscripter-en/default.nix
@@ -7,7 +7,8 @@ stdenv.mkDerivation rec {
   name = "onscripter-en-20110930";
 
   src = fetchurl {
-    url = "http://unclemion.com/dev/attachments/download/36/${name}-src.tar.bz2";
+    # The website is not available now.
+    url = "https://www.dropbox.com/s/ag21owy9poyr2oy/onscripter-en-20110930-src.tar.bz2";
     sha256 = "1kzm6d894c0ihgkwhd03x3kaqqz0sb6kf0r86xrrz12y309zfam6";
   };
 
diff --git a/pkgs/games/openspades/default.nix b/pkgs/games/openspades/default.nix
index f218ba762ca9..e0acf60144ed 100644
--- a/pkgs/games/openspades/default.nix
+++ b/pkgs/games/openspades/default.nix
@@ -6,14 +6,14 @@
 
 stdenv.mkDerivation rec {
   name = "openspades-${version}";
-  version = "0.1.2";
+  version = "0.1.3";
   devPakVersion = "33";
 
   src = fetchFromGitHub {
     owner = "yvt";
     repo = "openspades";
     rev = "v${version}";
-    sha256 = "1mfj46c3pnn1f6awy3b6faxs26i93a5jsrvkdlr12ndsykvi6ng6";
+    sha256 = "1fvmqbif9fbipd0vphp57pk6blb4yp8xvqlc2ppipk5pjv6a3d2h";
   };
 
   nativeBuildInputs = [ cmake imagemagick unzip zip file ];
@@ -41,11 +41,20 @@ stdenv.mkDerivation rec {
     sha256 = "1bd2fyn7mlxa3xnsvzj08xjzw02baimqvmnix07blfhb78rdq9q9";
   };
 
+  notoFont = fetchurl {
+    url = "https://github.com/yvt/openspades/releases/download/v0.1.1b/NotoFonts.pak";
+    sha256 = "0kaz8j85wjjnf18z0lz69xr1z8makg30jn2dzdyicd1asrj0q1jm";
+  };
+
   postPatch = ''
     sed -i 's,^wget .*,cp $devPak "$PAK_NAME",' Resources/downloadpak.sh
     patchShebangs Resources
   '';
 
+  postInstall = ''
+    cp $notoFont $out/share/games/openspades/Resources/
+  '';
+
   enableParallelBuilding = true;
 
   NIX_CFLAGS_LINK = [ "-lopenal" ];
@@ -55,5 +64,6 @@ stdenv.mkDerivation rec {
     homepage    = "https://github.com/yvt/openspades/";
     license     = licenses.gpl3;
     platforms   = platforms.all;
+    maintainers = with maintainers; [ abbradar ];
   };
 }
diff --git a/pkgs/games/quake3/ioquake/default.nix b/pkgs/games/quake3/ioquake/default.nix
index 0a3256976755..7bc0863a33f8 100644
--- a/pkgs/games/quake3/ioquake/default.nix
+++ b/pkgs/games/quake3/ioquake/default.nix
@@ -1,21 +1,21 @@
-{ stdenv, fetchFromGitHub, which, pkgconfig, SDL2, libGLU_combined, openalSoft
+{ stdenv, fetchFromGitHub, which, pkgconfig, SDL2, libGL, openalSoft
 , curl, speex, opusfile, libogg, libvorbis, libopus, libjpeg, mumble, freetype
 }:
 
 stdenv.mkDerivation rec {
   name = "ioquake3-git-${version}";
-  version = "2018-12-14";
+  version = "2019-05-29";
 
   src = fetchFromGitHub {
     owner = "ioquake";
     repo = "ioq3";
-    rev = "b0d2b141e702aafc3dcf77a026e12757f00e45ed";
+    rev = "350b8f9c7c88c002dccea4f0350f1919b86d3b4e";
     sha256 = "17qkqi22f2fyh6bnfcf1zz2lycgv08d6aw52sf0hqw7r3qq86d08";
   };
 
   nativeBuildInputs = [ which pkgconfig ];
   buildInputs = [
-    SDL2 libGLU_combined openalSoft curl speex opusfile libogg libvorbis libopus libjpeg
+    SDL2 libGL openalSoft curl speex opusfile libogg libvorbis libopus libjpeg
     freetype mumble
   ];
 
diff --git a/pkgs/games/ultrastardx/default.nix b/pkgs/games/ultrastardx/default.nix
index 2e9b3cf8d8ca..f3eec52098d0 100644
--- a/pkgs/games/ultrastardx/default.nix
+++ b/pkgs/games/ultrastardx/default.nix
@@ -23,9 +23,10 @@ in stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig autoreconfHook ];
   buildInputs = [ fpc libpng ] ++ sharedLibs;
 
+  # https://github.com/UltraStar-Deluxe/USDX/issues/462
   postPatch = ''
-    # autoconf substitutes strange things otherwise
     substituteInPlace src/config.inc.in \
+      --subst-var-by lua_LIB_NAME liblua.so \
       --subst-var-by libpcre_LIBNAME libpcre.so.1
   '';
 
diff --git a/pkgs/games/unnethack/default.nix b/pkgs/games/unnethack/default.nix
index a1a8272fd0f9..be1b5bd11956 100644
--- a/pkgs/games/unnethack/default.nix
+++ b/pkgs/games/unnethack/default.nix
@@ -1,12 +1,13 @@
 { stdenv, fetchgit, utillinux, ncurses, flex, bison }:
 
 stdenv.mkDerivation rec {
-  name = "unnethack-5.3.1";
+  name = "unnethack-${version}";
+  version = "5.2.0";
 
   src = fetchgit {
     url = "https://github.com/UnNetHack/UnNetHack";
-    rev = "63677eb256b5a75430f190cfb0f76bdd9bd0b9dd";
-    sha256 = "0w6vyg0j2xdvr5vdlyf3dwliyxjzcr5fdbx5maygxiql44j104v3";
+    rev = "refs/tags/${version}";
+    sha256 = "088gd2c7v95f2pm9ky38i28sz73mnsksr2p2hhhflkchxncd21f1";
   };
 
   buildInputs = [ ncurses ];
@@ -22,6 +23,8 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "GAMEPERM=744" ];
 
+  enableParallelBuilding = true;
+
   postInstall = ''
     cp -r /tmp/unnethack $out/share/unnethack/profile
     mv $out/bin/unnethack $out/bin/.wrapped_unnethack
diff --git a/pkgs/misc/drivers/hplip/3.16.11.nix b/pkgs/misc/drivers/hplip/3.16.11.nix
index e99fe1a201d2..8f5004693eac 100644
--- a/pkgs/misc/drivers/hplip/3.16.11.nix
+++ b/pkgs/misc/drivers/hplip/3.16.11.nix
@@ -28,16 +28,17 @@ let
   };
 
   hplipPlatforms = {
-    "i686-linux"   = "x86_32";
-    "x86_64-linux" = "x86_64";
-    "armv6l-linux" = "arm32";
-    "armv7l-linux" = "arm32";
+    "i686-linux"    = "x86_32";
+    "x86_64-linux"  = "x86_64";
+    "armv6l-linux"  = "arm32";
+    "armv7l-linux"  = "arm32";
+    "aarch64-linux" = "arm64";
   };
 
   hplipArch = hplipPlatforms."${stdenv.hostPlatform.system}"
     or (throw "HPLIP not supported on ${stdenv.hostPlatform.system}");
 
-  pluginArches = [ "x86_32" "x86_64" "arm32" ];
+  pluginArches = [ "x86_32" "x86_64" "arm32" "arm64" ];
 
 in
 
@@ -186,7 +187,7 @@ pythonPackages.buildPythonApplication {
     license = if withPlugin
       then licenses.unfree
       else with licenses; [ mit bsd2 gpl2Plus ];
-    platforms = [ "i686-linux" "x86_64-linux" "armv6l-linux" "armv7l-linux" ];
+    platforms = [ "i686-linux" "x86_64-linux" "armv6l-linux" "armv7l-linux" "aarch64-linux" ];
     maintainers = with maintainers; [ ttuegel ];
   };
 }
diff --git a/pkgs/misc/drivers/hplip/3.18.5.nix b/pkgs/misc/drivers/hplip/3.18.5.nix
new file mode 100644
index 000000000000..2be65e40c45f
--- /dev/null
+++ b/pkgs/misc/drivers/hplip/3.18.5.nix
@@ -0,0 +1,225 @@
+{ stdenv, fetchurl, substituteAll
+, pkgconfig
+, cups, zlib, libjpeg, libusb1, pythonPackages, sane-backends
+, dbus, file, ghostscript, usbutils
+, net_snmp, openssl, perl, nettools
+, bash, coreutils, utillinux
+, withQt5 ? true
+, withPlugin ? false
+, withStaticPPDInstall ? false
+}:
+
+let
+
+  name = "hplip-${version}";
+  version = "3.18.5";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/hplip/${name}.tar.gz";
+    sha256 = "0xb7ga2wgbwjxsss67mjn2y6fmqsfwzmv11ivvfzhnl36lh22hkb";
+  };
+
+  plugin = fetchurl {
+    url = "https://www.openprinting.org/download/printdriver/auxfiles/HP/plugins/${name}-plugin.run";
+    sha256 = "1jf74jya071zqvwhy9n0c3007pzgcxydkw7qdh4sx70brly81i7p";
+  };
+
+  hplipState = substituteAll {
+    inherit version;
+    src = ./hplip.state;
+  };
+
+  hplipPlatforms = {
+    "i686-linux"    = "x86_32";
+    "x86_64-linux"  = "x86_64";
+    "armv6l-linux"  = "arm32";
+    "armv7l-linux"  = "arm32";
+    "aarch64-linux" = "arm64";
+  };
+
+  hplipArch = hplipPlatforms."${stdenv.hostPlatform.system}"
+    or (throw "HPLIP not supported on ${stdenv.hostPlatform.system}");
+
+  pluginArches = [ "x86_32" "x86_64" "arm32" "arm64" ];
+
+in
+
+assert withPlugin -> builtins.elem hplipArch pluginArches
+  || throw "HPLIP plugin not supported on ${stdenv.hostPlatform.system}";
+
+pythonPackages.buildPythonApplication {
+  inherit name src;
+  format = "other";
+
+  buildInputs = [
+    libjpeg
+    cups
+    libusb1
+    sane-backends
+    dbus
+    file
+    ghostscript
+    net_snmp
+    openssl
+    perl
+    zlib
+  ];
+
+  nativeBuildInputs = [
+    pkgconfig
+  ];
+
+  pythonPath = with pythonPackages; [
+    dbus
+    pillow
+    pygobject2
+    reportlab
+    usbutils
+    sip
+  ] ++ stdenv.lib.optionals withQt5 [
+    pyqt5
+  ];
+
+  makeWrapperArgs = [ "--prefix" "PATH" ":" "${nettools}/bin" ];
+
+  prePatch = ''
+    # HPLIP hardcodes absolute paths everywhere. Nuke from orbit.
+    find . -type f -exec sed -i \
+      -e s,/etc/hp,$out/etc/hp,g \
+      -e s,/etc/sane.d,$out/etc/sane.d,g \
+      -e s,/usr/include/libusb-1.0,${libusb1.dev}/include/libusb-1.0,g \
+      -e s,/usr/share/hal/fdi/preprobe/10osvendor,$out/share/hal/fdi/preprobe/10osvendor,g \
+      -e s,/usr/lib/systemd/system,$out/lib/systemd/system,g \
+      -e s,/var/lib/hp,$out/var/lib/hp,g \
+      -e s,/usr/bin/perl,${perl}/bin/perl,g \
+      -e s,/usr/bin/file,${file}/bin/file,g \
+      -e s,/usr/bin/gs,${ghostscript}/bin/gs,g \
+      -e s,/usr/share/cups/fonts,${ghostscript}/share/ghostscript/fonts,g \
+      -e "s,ExecStart=/usr/bin/python /usr/bin/hp-config_usb_printer,ExecStart=$out/bin/hp-config_usb_printer,g" \
+      {} +
+  '';
+
+  preConfigure = ''
+    export configureFlags="$configureFlags
+      --with-hpppddir=$out/share/cups/model/HP
+      --with-cupsfilterdir=$out/lib/cups/filter
+      --with-cupsbackenddir=$out/lib/cups/backend
+      --with-icondir=$out/share/applications
+      --with-systraydir=$out/xdg/autostart
+      --with-mimedir=$out/etc/cups
+      --enable-policykit
+      ${stdenv.lib.optionalString withStaticPPDInstall "--enable-cups-ppd-install"}
+      --disable-qt4
+      ${stdenv.lib.optionalString withQt5 "--enable-qt5"}
+    "
+
+    export makeFlags="
+      halpredir=$out/share/hal/fdi/preprobe/10osvendor
+      rulesdir=$out/etc/udev/rules.d
+      policykit_dir=$out/share/polkit-1/actions
+      policykit_dbus_etcdir=$out/etc/dbus-1/system.d
+      policykit_dbus_sharedir=$out/share/dbus-1/system-services
+      hplip_confdir=$out/etc/hp
+      hplip_statedir=$out/var/lib/hp
+    "
+
+    # Prevent 'ppdc: Unable to find include file "<font.defs>"' which prevent
+    # generation of '*.ppd' files.
+    # This seems to be a 'ppdc' issue when the tool is run in a hermetic sandbox.
+    # Could not find how to fix the problem in 'ppdc' so this is a workaround.
+    export CUPS_DATADIR="${cups}/share/cups"
+  '';
+
+  enableParallelBuilding = true;
+
+  #
+  # Running `hp-diagnose_plugin -g` can be used to diagnose
+  # issues with plugins.
+  #
+  postInstall = stdenv.lib.optionalString withPlugin ''
+    sh ${plugin} --noexec --keep
+    cd plugin_tmp
+
+    cp plugin.spec $out/share/hplip/
+
+    mkdir -p $out/share/hplip/data/firmware
+    cp *.fw.gz $out/share/hplip/data/firmware
+
+    mkdir -p $out/share/hplip/data/plugins
+    cp license.txt $out/share/hplip/data/plugins
+
+    mkdir -p $out/share/hplip/prnt/plugins
+    for plugin in lj hbpl1; do
+      cp $plugin-${hplipArch}.so $out/share/hplip/prnt/plugins
+      chmod 0755 $out/share/hplip/prnt/plugins/$plugin-${hplipArch}.so
+      ln -s $out/share/hplip/prnt/plugins/$plugin-${hplipArch}.so \
+        $out/share/hplip/prnt/plugins/$plugin.so
+    done
+
+    mkdir -p $out/share/hplip/scan/plugins
+    for plugin in bb_soap bb_marvell bb_soapht bb_escl; do
+      cp $plugin-${hplipArch}.so $out/share/hplip/scan/plugins
+      chmod 0755 $out/share/hplip/scan/plugins/$plugin-${hplipArch}.so
+      ln -s $out/share/hplip/scan/plugins/$plugin-${hplipArch}.so \
+        $out/share/hplip/scan/plugins/$plugin.so
+    done
+
+    mkdir -p $out/share/hplip/fax/plugins
+    for plugin in fax_marvell; do
+      cp $plugin-${hplipArch}.so $out/share/hplip/fax/plugins
+      chmod 0755 $out/share/hplip/fax/plugins/$plugin-${hplipArch}.so
+      ln -s $out/share/hplip/fax/plugins/$plugin-${hplipArch}.so \
+        $out/share/hplip/fax/plugins/$plugin.so
+    done
+
+    mkdir -p $out/var/lib/hp
+    cp ${hplipState} $out/var/lib/hp/hplip.state
+
+    rm $out/etc/udev/rules.d/56-hpmud.rules
+  '';
+
+  # The installed executables are just symlinks into $out/share/hplip,
+  # but wrapPythonPrograms ignores symlinks. We cannot replace the Python
+  # modules in $out/share/hplip with wrapper scripts because they import
+  # each other as libraries. Instead, we emulate wrapPythonPrograms by
+  # 1. Calling patchPythonProgram on the original script in $out/share/hplip
+  # 2. Making our own wrapper pointing directly to the original script.
+  dontWrapPythonPrograms = true;
+  preFixup = ''
+    buildPythonPath "$out $pythonPath"
+
+    for bin in $out/bin/*; do
+      py=$(readlink -m $bin)
+      rm $bin
+      echo "patching \`$py'..."
+      patchPythonScript "$py"
+      echo "wrapping \`$bin'..."
+      makeWrapper "$py" "$bin" \
+          --prefix PATH ':' "$program_PATH" \
+          --set PYTHONNOUSERSITE "true" \
+          $makeWrapperArgs
+    done
+  '';
+
+  postFixup = ''
+    substituteInPlace $out/etc/hp/hplip.conf --replace /usr $out
+  '' + stdenv.lib.optionalString (!withPlugin) ''
+    # A udev rule to notify users that they need the binary plugin.
+    # Needs a lot of patching but might save someone a bit of confusion:
+    substituteInPlace $out/etc/udev/rules.d/56-hpmud.rules \
+      --replace {,${bash}}/bin/sh \
+      --replace {/usr,${coreutils}}/bin/nohup \
+      --replace {,${utillinux}/bin/}logger \
+      --replace {/usr,$out}/bin
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Print, scan and fax HP drivers for Linux";
+    homepage = https://developers.hp.com/hp-linux-imaging-and-printing;
+    license = if withPlugin
+      then licenses.unfree
+      else with licenses; [ mit bsd2 gpl2Plus ];
+    platforms = [ "i686-linux" "x86_64-linux" "armv6l-linux" "armv7l-linux" "aarch64-linux" ];
+    maintainers = with maintainers; [ jgeerds ttuegel ];
+  };
+}
diff --git a/pkgs/misc/emulators/citra/default.nix b/pkgs/misc/emulators/citra/default.nix
index 1845757fb308..b0d422385424 100644
--- a/pkgs/misc/emulators/citra/default.nix
+++ b/pkgs/misc/emulators/citra/default.nix
@@ -2,19 +2,18 @@
 
 stdenv.mkDerivation rec { 
   name = "citra-${version}";
-  version = "2018-06-09";
+  version = "2019-05-25";
 
   # Submodules
   src = fetchgit {
     url = "https://github.com/citra-emu/citra";
-    rev = "cf9bfe0690f1934847500cc5079b1aaf3299a507";
-    sha256 = "1ryc5d3fnhzlrzh1yljbq9x5n79dsb5hgqdba8z4x56iccx0kd0p";
+    rev = "186ffc235f744dad315a603a98cce4597ef0f65f";
+    sha256 = "0w24an80yjmkfcxjzdvsbpahx46bmd90liq5m6qva5pgnpmxx7pn";
   };
 
   enableParallelBuilding = true;
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ SDL2 qtbase qtmultimedia boost curl gtest ];
-  cmakeFlags = [ "-DUSE_SYSTEM_CURL=ON" "-DUSE_SYSTEM_GTEST=ON" ];
+  buildInputs = [ SDL2 qtbase qtmultimedia boost ];
 
   preConfigure = ''
     # Trick configure system.
diff --git a/pkgs/misc/emulators/rpcs3/default.nix b/pkgs/misc/emulators/rpcs3/default.nix
index 732a5971ed3c..4c44377c11e6 100644
--- a/pkgs/misc/emulators/rpcs3/default.nix
+++ b/pkgs/misc/emulators/rpcs3/default.nix
@@ -1,29 +1,29 @@
-{ stdenv, lib, fetchgit, cmake, pkgconfig, git                                                                      
-, qt5, openal, glew, vulkan-loader, libpng, ffmpeg, libevdev, python27                                              
-, pulseaudioSupport ? true, libpulseaudio                                                                           
-, waylandSupport ? true, wayland                                                                                    
-, alsaSupport ? true, alsaLib                                                                                       
-}:                                                                                                                  
-                                                                                                                    
-let                                                                                                                 
-  majorVersion = "0.0.5";                                                                                           
-  gitVersion = "6980-81e5f3b7f"; # echo $(git rev-list HEAD --count)-$(git rev-parse --short HEAD)                  
-in                                                                                                                  
-stdenv.mkDerivation rec {                                                                                           
-  name = "rpcs3-${version}";                                                                                        
-  version = "${majorVersion}-${gitVersion}";                                                                        
-                                                                                                                    
-  src = fetchgit {                                                                                                  
-    url = "https://github.com/RPCS3/rpcs3";                                                                         
-    rev = "81e5f3b7f299942f56bcfdde54edd09c722b32d8";                                                               
-    sha256 = "0czj6ga1nccqgcvi58sjnv1cc4k7qvwijp4warml463hpsmbd9r0";                                                
-  };                                                                                                                
-                                                                                                                    
-  preConfigure = ''                                                                                                 
-    cat > ./rpcs3/git-version.h <<EOF                                                                               
-    #define RPCS3_GIT_VERSION "${gitVersion}"                                                                       
-    #define RPCS3_GIT_BRANCH "HEAD"                                                                                 
-    #define RPCS3_GIT_VERSION_NO_UPDATE 1                                                                           
+{ stdenv, lib, fetchgit, cmake, pkgconfig, git
+, qt5, openal, glew, vulkan-loader, libpng, ffmpeg, libevdev, python27
+, pulseaudioSupport ? true, libpulseaudio
+, waylandSupport ? true, wayland
+, alsaSupport ? true, alsaLib
+}:
+
+let
+  majorVersion = "0.0.6";
+  gitVersion = "8187-790962425"; # echo $(git rev-list HEAD --count)-$(git rev-parse --short HEAD)
+in
+stdenv.mkDerivation rec {
+  name = "rpcs3-${version}";
+  version = "${majorVersion}-${gitVersion}";
+
+  src = fetchgit {
+    url = "https://github.com/RPCS3/rpcs3";
+    rev = "790962425cfb893529f72b3ef0dd1424fcc42973";
+    sha256 = "154ys29b9xdws3bp4b7rb3kc0h9hd49g2yf3z9268cdq8aclahaa";
+  };
+
+  preConfigure = ''
+    cat > ./rpcs3/git-version.h <<EOF
+    #define RPCS3_GIT_VERSION "${gitVersion}"
+    #define RPCS3_GIT_BRANCH "HEAD"
+    #define RPCS3_GIT_VERSION_NO_UPDATE 1
     EOF
   '';
 
diff --git a/pkgs/os-specific/linux/android-udev-rules/default.nix b/pkgs/os-specific/linux/android-udev-rules/default.nix
index bfacdd4a2f42..b03636d6f7f6 100644
--- a/pkgs/os-specific/linux/android-udev-rules/default.nix
+++ b/pkgs/os-specific/linux/android-udev-rules/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   name = "android-udev-rules-${version}";
-  version = "20190114";
+  version = "20190315";
 
   src = fetchFromGitHub {
     owner = "M0Rf30";
     repo = "android-udev-rules";
     rev = version;
-    sha256 = "1x3vaq8jpnfhxc2lzz5jnlz219w66sn151v5fkdgv68pya4nzhjj";
+    sha256 = "1w8zkww3cj6yzcsfzwvj1gkf4dfflhp1vd9fixnmlbm43kwkqrdr";
   };
 
   installPhase = ''
diff --git a/pkgs/os-specific/linux/irqbalance/default.nix b/pkgs/os-specific/linux/irqbalance/default.nix
index c4a29d2d601d..e606e3db6ee6 100644
--- a/pkgs/os-specific/linux/irqbalance/default.nix
+++ b/pkgs/os-specific/linux/irqbalance/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "irqbalance-${version}";
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "irqbalance";
     repo = "irqbalance";
     rev = "v${version}";
-    sha256 = "1wdwch4nb479xhinin4yqvcjah6h09i4nh8fhnsfbn1mzl0hiv09";
+    sha256 = "01r9s63yxaijg8jqcbkwqlyqq2z673szb0vzd7qb2y3gk5jlif2y";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
diff --git a/pkgs/os-specific/linux/nfs-utils/default.nix b/pkgs/os-specific/linux/nfs-utils/default.nix
index 19a5184f8962..29b47f29ed24 100644
--- a/pkgs/os-specific/linux/nfs-utils/default.nix
+++ b/pkgs/os-specific/linux/nfs-utils/default.nix
@@ -9,11 +9,11 @@ in
 
 stdenv.mkDerivation rec {
   name = "nfs-utils-${version}";
-  version = "2.3.3";
+  version = "2.3.4";
 
   src = fetchurl {
     url = "https://kernel.org/pub/linux/utils/nfs-utils/${version}/${name}.tar.xz";
-    sha256 = "08k36d7l8yqylscnln3p85lcfwi7r7g6n3bnslgmzc1i71wk92zn";
+    sha256 = "1kcn11glc3rma1gvykbk1s542mgz36ipi7yqxlk9jyh8hsiqncpq";
   };
 
   # libnfsidmap is built together with nfs-utils from the same source,
@@ -37,8 +37,6 @@ stdenv.mkDerivation rec {
         --replace '$dir/bin/krb5-config' ${lib.getDev kerberos}/bin/krb5-config
     '';
 
-  #configureScript = "bash -x configure";
-
   configureFlags =
     [ "--enable-gss"
       "--with-statedir=/var/lib/nfs"
@@ -100,7 +98,9 @@ stdenv.mkDerivation rec {
     '';
 
   # One test fails on mips.
-  doCheck = !stdenv.isMips;
+  # doCheck = !stdenv.isMips;
+  # https://bugzilla.kernel.org/show_bug.cgi?id=203793
+  doCheck = false;
 
   disallowedReferences = [ (lib.getDev kerberos) ];
 
diff --git a/pkgs/os-specific/linux/rdma-core/default.nix b/pkgs/os-specific/linux/rdma-core/default.nix
index 02d628fdfbcd..6acd327ef0ed 100644
--- a/pkgs/os-specific/linux/rdma-core/default.nix
+++ b/pkgs/os-specific/linux/rdma-core/default.nix
@@ -3,7 +3,7 @@
 } :
 
 let
-  version = "23.1";
+  version = "24.0";
 
 in stdenv.mkDerivation {
   name = "rdma-core-${version}";
@@ -12,7 +12,7 @@ in stdenv.mkDerivation {
     owner = "linux-rdma";
     repo = "rdma-core";
     rev = "v${version}";
-    sha256 = "0blwqfj73bnk7byj2mavvnyh87mwhpzwgzg60s9vv9jnfcnbhlhk";
+    sha256 = "038msip4fnd8fh6m0vhnqwsaarp86dbnc9hvf5n19aqhlqbabbdc";
   };
 
   nativeBuildInputs = [ cmake pkgconfig pandoc ];
diff --git a/pkgs/os-specific/linux/schedtool/default.nix b/pkgs/os-specific/linux/schedtool/default.nix
index f24996562d8b..2c02ef924c3f 100644
--- a/pkgs/os-specific/linux/schedtool/default.nix
+++ b/pkgs/os-specific/linux/schedtool/default.nix
@@ -1,11 +1,14 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
-  name = "schedtool-1.3.0";
+  name = "schedtool-${version}";
+  version = "1.3.0";
 
-  src = fetchurl {
-    url = "http://freequaos.host.sk/schedtool/${name}.tar.bz2";
-    sha256 = "1ky8q3jg4lsxbnlmm51q3jkxh160zy0l6a4xkdy2yncxc4m2l02f";
+  src = fetchFromGitHub {
+    owner = "freequaos";
+    repo = "schedtool";
+    rev = name;
+    sha256 = "1wdw6fnf9a01xfjhdah3mn8bp1bvahf2lfq74i6hk5b2cagkppyp";
   };
 
   makeFlags = [ "DESTDIR=$(out)" "DESTPREFIX=" ];
diff --git a/pkgs/os-specific/linux/trinity/default.nix b/pkgs/os-specific/linux/trinity/default.nix
index cc85740afddc..b855f0547ba0 100644
--- a/pkgs/os-specific/linux/trinity/default.nix
+++ b/pkgs/os-specific/linux/trinity/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
-  name = "trinity-${version}";
+  pname = "trinity";
   version = "1.9";
 
   src = fetchFromGitHub {
@@ -11,16 +11,9 @@ stdenv.mkDerivation rec {
     sha256 = "0z1a7x727xacam74jccd223k303sllgwpq30lnq9b6xxy8b659bv";
   };
 
-  # Fails on 32-bit otherwise
-  NIX_CFLAGS_COMPILE = [
-    "-Wno-error=int-to-pointer-cast"
-    "-Wno-error=pointer-to-int-cast"
-    "-Wno-error=incompatible-pointer-types"
-  ];
-
   postPatch = ''
-    patchShebangs ./configure
-    patchShebangs ./scripts/
+    patchShebangs configure
+    patchShebangs scripts
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/servers/amqp/rabbitmq-server/default.nix b/pkgs/servers/amqp/rabbitmq-server/default.nix
index 37a2e6369d47..3d36202e8616 100644
--- a/pkgs/servers/amqp/rabbitmq-server/default.nix
+++ b/pkgs/servers/amqp/rabbitmq-server/default.nix
@@ -6,11 +6,11 @@
 stdenv.mkDerivation rec {
   name = "rabbitmq-server-${version}";
 
-  version = "3.7.14";
+  version = "3.7.15";
 
   src = fetchurl {
     url = "https://github.com/rabbitmq/rabbitmq-server/releases/download/v${version}/${name}.tar.xz";
-    sha256 = "12lx4ij89khg9nfiq5l9bijgm7yjrw9kh7y09wqjhv2ws0mq3437";
+    sha256 = "14ipnvcrwln9mwr4r32461js2gdlrr4h4hy92393ixbkscf9wdir";
   };
 
   buildInputs =
diff --git a/pkgs/servers/dns/pdns-recursor/default.nix b/pkgs/servers/dns/pdns-recursor/default.nix
index 0e5ea98f30e8..a3c704ede7db 100644
--- a/pkgs/servers/dns/pdns-recursor/default.nix
+++ b/pkgs/servers/dns/pdns-recursor/default.nix
@@ -8,11 +8,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "pdns-recursor-${version}";
-  version = "4.1.12";
+  version = "4.1.13";
 
   src = fetchurl {
     url = "https://downloads.powerdns.com/releases/pdns-recursor-${version}.tar.bz2";
-    sha256 = "1j5hrpz4c9dqd30piqd8xyjmirdxp4dy71nx9rwq8l4i4nc0l774";
+    sha256 = "0vs6sv8pyd69jrzzhbdzh6vgva64swypknwpl070ppzk3xdvfa0k";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/servers/http/unit/default.nix b/pkgs/servers/http/unit/default.nix
index d798d5d231ec..3f0567695fb8 100644
--- a/pkgs/servers/http/unit/default.nix
+++ b/pkgs/servers/http/unit/default.nix
@@ -16,14 +16,14 @@
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
-  version = "1.8.0";
+  version = "1.9.0";
   name = "unit-${version}";
 
   src = fetchFromGitHub {
     owner = "nginx";
     repo = "unit";
     rev = "${version}";
-    sha256 = "1s5pfyhabnf9p5z2h1fh0wb4hqzkrha5bxahjnikmlkhw59s8zip";
+    sha256 = "0f7smgshfzksks2jfhi53g87wiyy38vwgj6aa70ql61m135dx7b1";
   };
 
   nativeBuildInputs = [ which ];
@@ -40,9 +40,6 @@ stdenv.mkDerivation rec {
     ++ optional withRuby ruby
     ++ optional withSSL openssl;
 
-  # Used patch to enable work with unprivileged user - https://github.com/nginx/unit/issues/228
-  patches = [ ./unit-rootless.patch ];
-
   configureFlags = [
     "--control=unix:/run/unit/control.unit.sock"
     "--pid=/run/unit/unit.pid"
diff --git a/pkgs/servers/http/unit/unit-rootless.patch b/pkgs/servers/http/unit/unit-rootless.patch
deleted file mode 100644
index 36506847f915..000000000000
--- a/pkgs/servers/http/unit/unit-rootless.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-diff --git a/src/nxt_process.c b/src/nxt_process.c
-index 5952029..7b29369 100644
---- a/src/nxt_process.c
-+++ b/src/nxt_process.c
-@@ -136,7 +136,7 @@ nxt_process_start(nxt_task_t *task, nxt_process_t *process)
-
-     nxt_random_init(&thread->random);
-
--    if (init->user_cred != NULL && getuid() == 0) {
-+    if (init->user_cred != NULL) {
-         /* Super-user. */
-
-         ret = nxt_user_cred_set(task, init->user_cred);
-@@ -434,9 +434,7 @@ nxt_user_cred_get(nxt_task_t *task, nxt_user_cred_t *uc, const char *group)
-         uc->base_gid = grp->gr_gid;
-     }
-
--    if (getuid() == 0) {
-         return nxt_user_groups_get(task, uc);
--    }
-
-     return NXT_OK;
- }
-
diff --git a/pkgs/servers/mail/rspamd/default.nix b/pkgs/servers/mail/rspamd/default.nix
index d4eb09220824..25e7807659df 100644
--- a/pkgs/servers/mail/rspamd/default.nix
+++ b/pkgs/servers/mail/rspamd/default.nix
@@ -14,13 +14,13 @@ in
 
 stdenv.mkDerivation rec {
   name = "rspamd-${version}";
-  version = "1.9.2";
+  version = "1.9.4";
 
   src = fetchFromGitHub {
     owner = "rspamd";
     repo = "rspamd";
     rev = version;
-    sha256 = "1ygyqlm8x8d54g829pmd3x3qp4rsxj8nq25kgzrpkw73spi7bkkq";
+    sha256 = "0b8n7xazmzjb6jf8sk0jg0x861nf1ayzxsvjaymw1qjgpn371r51";
   };
 
   nativeBuildInputs = [ cmake pkgconfig perl ];
diff --git a/pkgs/servers/monitoring/loki/default.nix b/pkgs/servers/monitoring/loki/default.nix
new file mode 100644
index 000000000000..63bded64a36e
--- /dev/null
+++ b/pkgs/servers/monitoring/loki/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, buildGoPackage, fetchFromGitHub }:
+
+buildGoPackage rec {
+  version = "0.1.0";
+  name = "grafana-loki-${version}";
+  goPackagePath = "github.com/grafana/loki";
+
+  doCheck = true;
+
+  src = fetchFromGitHub {
+    rev = "v${version}";
+    owner = "grafana";
+    repo = "loki";
+    sha256 = "18iysr8p84vd1sdjdnpc9cydd5rpw0azdjzpz8yjqhscqw9gk4w2";
+  };
+
+  meta = with stdenv.lib; {
+    description = "Like Prometheus, but for logs.";
+    license = licenses.asl20;
+    homepage = https://grafana.com/loki;
+    maintainers = with maintainers; [ willibutz ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/servers/plex/raw.nix b/pkgs/servers/plex/raw.nix
index 821bbc578dc9..082506cddfd7 100644
--- a/pkgs/servers/plex/raw.nix
+++ b/pkgs/servers/plex/raw.nix
@@ -8,14 +8,14 @@
 # server, and the FHS userenv and corresponding NixOS module should
 # automatically pick up the changes.
 stdenv.mkDerivation rec {
-  version = "1.15.4.994-107756f7e";
+  version = "1.15.6.1079-78232c603";
   pname = "plexmediaserver";
   name = "${pname}-${version}";
 
   # Fetch the source
   src = fetchurl {
     url = "https://downloads.plex.tv/plex-media-server-new/${version}/redhat/plexmediaserver-${version}.x86_64.rpm";
-    sha256 = "0jm1zzlazy41wnmyda8il03vmn9a5vvsfpxn3valkwiggsnvb2p8";
+    sha256 = "1fvj58b91227wig51hi98rg9r48rdnd8s32xdajjgspxy923mp5a";
   };
 
   outputs = [ "out" "basedb" ];
diff --git a/pkgs/servers/sabnzbd/default.nix b/pkgs/servers/sabnzbd/default.nix
index 12253d740b7b..364fcb118ce4 100644
--- a/pkgs/servers/sabnzbd/default.nix
+++ b/pkgs/servers/sabnzbd/default.nix
@@ -4,7 +4,7 @@ let
   pythonEnv = python2.withPackages(ps: with ps; [ cryptography cheetah yenc sabyenc ]);
   path = stdenv.lib.makeBinPath [ par2cmdline unrar unzip p7zip ];
 in stdenv.mkDerivation rec {
-  version = "2.3.8";
+  version = "2.3.9";
   pname = "sabnzbd";
   name = "${pname}-${version}";
 
@@ -12,7 +12,7 @@ in stdenv.mkDerivation rec {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "1kdm2gv4mpdmyzfm9mfv26yxvjks8ii7c12hprp1zrmcindxg03g";
+    sha256 = "06ln00rqz4xpsqhq0f495893xq1w5dfjawb8dgfyjjfds8627p16";
   };
 
   buildInputs = [ pythonEnv makeWrapper ];
diff --git a/pkgs/servers/search/solr/8.x.nix b/pkgs/servers/search/solr/8.x.nix
index 28808a00a7cf..3c21a2a77efb 100644
--- a/pkgs/servers/search/solr/8.x.nix
+++ b/pkgs/servers/search/solr/8.x.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "solr";
-  version = "8.1.0";
+  version = "8.1.1";
 
   src = fetchurl {
     url = "mirror://apache/lucene/${pname}/${version}/${pname}-${version}.tgz";
-    sha256 = "1w8hc2694c3acs4hqk0rkl3lmv4sbnji9n5mzw1piq90azlmnb1a";
+    sha256 = "18a6pgbvg6z38r3kqkhr152z7sa2hqip2g9fd26y4gzm2665j5dm";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/servers/sql/cockroachdb/default.nix b/pkgs/servers/sql/cockroachdb/default.nix
index 241ca9235c64..22ec301bceda 100644
--- a/pkgs/servers/sql/cockroachdb/default.nix
+++ b/pkgs/servers/sql/cockroachdb/default.nix
@@ -13,13 +13,13 @@ let
 in
 buildGoPackage rec {
   name = "cockroach-${version}";
-  version = "19.1.0";
+  version = "19.1.1";
 
   goPackagePath = "github.com/cockroachdb/cockroach";
 
   src = fetchurl {
     url = "https://binaries.cockroachdb.com/cockroach-v${version}.src.tgz";
-    sha256 = "1kb93jxgxc54c23v72ka116b2j7m82c1jghm7njd64qkbbcgrkkw";
+    sha256 = "1vbz5j0y9ri8c99k8fc5rnwigay478p1mac5g402639ilkqd41fc";
   };
 
   inherit nativeBuildInputs buildInputs;
@@ -59,6 +59,6 @@ buildGoPackage rec {
     description = "A scalable, survivable, strongly-consistent SQL database";
     license     = licenses.asl20;
     platforms   = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" ];
-    maintainers = with maintainers; [ rushmorem thoughtpolice ];
+    maintainers = with maintainers; [ rushmorem thoughtpolice rvolosatovs ];
   };
 }
diff --git a/pkgs/servers/sql/mariadb/cmake-plugin-includedir.patch b/pkgs/servers/sql/mariadb/cmake-plugin-includedir.patch
new file mode 100644
index 000000000000..d2a4535f7ba9
--- /dev/null
+++ b/pkgs/servers/sql/mariadb/cmake-plugin-includedir.patch
@@ -0,0 +1,16 @@
+diff --git a/cmake/plugin.cmake b/cmake/plugin.cmake
+index 31291d26..fad52814 100644
+--- a/cmake/plugin.cmake
++++ b/cmake/plugin.cmake
+@@ -34,6 +34,11 @@ MACRO(MYSQL_ADD_PLUGIN)
+     "LINK_LIBRARIES;DEPENDENCIES"
+     ${ARGN}
+   )
++
++  IF(WITHOUT_SERVER OR ARG_CLIENT)
++  INCLUDE_DIRECTORIES(${CMAKE_SOURCE_DIR}/include)
++  ENDIF()
++
+   IF(NOT WITHOUT_SERVER OR ARG_CLIENT)
+
+   # Add common include directories
diff --git a/pkgs/servers/sql/mariadb/default.nix b/pkgs/servers/sql/mariadb/default.nix
index 767565dd5820..988a90e27065 100644
--- a/pkgs/servers/sql/mariadb/default.nix
+++ b/pkgs/servers/sql/mariadb/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, fetchFromGitHub, cmake, pkgconfig, ncurses, zlib, xz, lzo, lz4, bzip2, snappy
-, libiconv, openssl, pcre, boost, judy, bison, libxml2
+, libiconv, openssl, pcre, boost, judy, bison, libxml2, libkrb5
 , libaio, libevent, jemalloc, cracklib, systemd, numactl, perl
 , fixDarwinDylibNames, cctools, CoreServices
 , asio, buildEnv, check, scons
@@ -22,14 +22,14 @@ galeraLibs = buildEnv {
 };
 
 common = rec { # attributes common to both builds
-  version = "10.2.17";
+  version = "10.3.15";
 
   src = fetchurl {
     urls = [
       "https://downloads.mariadb.org/f/mariadb-${version}/source/mariadb-${version}.tar.gz"
       "https://downloads.mariadb.com/MariaDB/mariadb-${version}/source/mariadb-${version}.tar.gz"
     ];
-    sha256 = "09xy6mgnz22mz8zgqlnddn8nzgs9xlz8lai4a7aa8x78in7hgcz7";
+    sha256 = "0s399nxk2z8fgdr527p64y74zwjc3gpv7psf1n2r6ksl9njr3wr7";
     name   = "mariadb-${version}.tar.gz";
   };
 
@@ -37,52 +37,50 @@ common = rec { # attributes common to both builds
 
   buildInputs = [
     ncurses openssl zlib pcre jemalloc libiconv
-  ] ++ stdenv.lib.optionals stdenv.isLinux [ libaio systemd ]
+  ] ++ stdenv.lib.optionals stdenv.isLinux [ libaio systemd libkrb5 ]
     ++ stdenv.lib.optionals stdenv.isDarwin [ perl fixDarwinDylibNames cctools CoreServices ];
 
   prePatch = ''
     sed -i 's,[^"]*/var/log,/var/log,g' storage/mroonga/vendor/groonga/CMakeLists.txt
   '';
 
-  patches = [ ./cmake-includedir.patch ./include-dirs-path.patch ]
+  patches = [ ./cmake-includedir.patch ]
     ++ stdenv.lib.optional stdenv.cc.isClang ./clang-isfinite.patch;
 
   cmakeFlags = [
     "-DBUILD_CONFIG=mysql_release"
     "-DMANUFACTURER=NixOS.org"
-    "-DDEFAULT_CHARSET=utf8"
-    "-DDEFAULT_COLLATION=utf8_general_ci"
+    "-DDEFAULT_CHARSET=utf8mb4"
+    "-DDEFAULT_COLLATION=utf8mb4_unicode_ci"
     "-DSECURITY_HARDENED=ON"
 
-    "-DMYSQL_UNIX_ADDR=/run/mysqld/mysqld.sock"
+    "-DINSTALL_UNIX_ADDRDIR=/run/mysqld/mysqld.sock"
+    "-DINSTALL_BINDIR=bin"
+    "-DINSTALL_DOCDIR=share/doc/mysql"
+    "-DINSTALL_DOCREADMEDIR=share/doc/mysql"
+    "-DINSTALL_INCLUDEDIR=include/mysql"
+    "-DINSTALL_INFODIR=share/mysql/docs"
+    "-DINSTALL_MANDIR=share/man"
     "-DINSTALL_MYSQLSHAREDIR=share/mysql"
+    "-DINSTALL_SCRIPTDIR=bin"
+    "-DINSTALL_SUPPORTFILESDIR=share/doc/mysql"
+    "-DINSTALL_MYSQLTESTDIR=OFF"
+    "-DINSTALL_SQLBENCHDIR=OFF"
 
     "-DWITH_ZLIB=system"
     "-DWITH_SSL=system"
     "-DWITH_PCRE=system"
-
+    "-DWITH_SAFEMALLOC=OFF"
+    "-DEMBEDDED_LIBRARY=OFF"
+  ] ++ optional stdenv.isDarwin [
     # On Darwin without sandbox, CMake will find the system java and attempt to build with java support, but
     # then it will fail during the actual build. Let's just disable the flag explicitly until someone decides
-    # to pass in java explicitly. This should have no effect on Linux.
+    # to pass in java explicitly.
     "-DCONNECT_WITH_JDBC=OFF"
-
-    # Same as above. Somehow on Darwin CMake decides that we support GSS even though we aren't provding the
-    # library through Nix, and then breaks later on. This should have no effect on Linux.
-    "-DPLUGIN_AUTH_GSSAPI=NO"
-    "-DPLUGIN_AUTH_GSSAPI_CLIENT=NO"
-  ]
-    ++ optional stdenv.isDarwin "-DCURSES_LIBRARY=${ncurses.out}/lib/libncurses.dylib"
-    ++ optional stdenv.hostPlatform.isMusl "-DWITHOUT_TOKUDB=1" # mariadb docs say disable this for musl
-    ;
-
-  preConfigure = ''
-    cmakeFlags="$cmakeFlags -DINSTALL_INCLUDEDIR=''${!outputDev}/include/mysql"
-  '';
-
-  postInstall = ''
-    rm "$out"/lib/*.a
-    find "''${!outputBin}/bin" -name '*test*' -delete
-  '';
+    "-DCURSES_LIBRARY=${ncurses.out}/lib/libncurses.dylib"
+  ] ++ optional stdenv.hostPlatform.isMusl [
+    "-DWITHOUT_TOKUDB=1" # mariadb docs say disable this for musl
+  ];
 
   passthru.mysqlVersion = "5.7";
 
@@ -98,28 +96,26 @@ common = rec { # attributes common to both builds
 client = stdenv.mkDerivation (common // {
   name = "mariadb-client-${common.version}";
 
-  outputs = [ "bin" "dev" "out" ];
+  outputs = [ "out" "dev" "man" ];
 
   propagatedBuildInputs = [ openssl zlib ]; # required from mariadb.pc
 
+  patches = [ ./cmake-plugin-includedir.patch ];
+
   cmakeFlags = common.cmakeFlags ++ [
     "-DWITHOUT_SERVER=ON"
+    "-DWITH_WSREP=OFF"
   ];
 
-  preConfigure = common.preConfigure + ''
-    cmakeFlags="$cmakeFlags \
-      -DINSTALL_BINDIR=$bin/bin \
-      -DINSTALL_SCRIPTDIR=$bin/bin \
-      -DINSTALL_SUPPORTFILESDIR=$bin/share/mysql \
-      -DINSTALL_DOCDIR=$bin/share/doc/mysql \
-      -DINSTALL_DOCREADMEDIR=$bin/share/doc/mysql \
-      "
-  '';
-
-  # prevent cycle; it needs to reference $dev
-  postInstall = common.postInstall + ''
-    moveToOutput bin/mysql_config "$dev"
-    moveToOutput bin/mariadb_config "$dev"
+  postInstall = ''
+    rm -r "$out"/share/mysql
+    rm -r "$out"/share/doc
+    rm "$out"/bin/{msql2mysql,mysql_plugin,mytop,wsrep_sst_rsync_wan,mysql_config,mariadb_config}
+    rm "$out"/lib/plugin/{daemon_example.ini,dialog.so,mysql_clear_password.so,sha256_password.so}
+    rm "$out"/lib/{libmariadb.so,libmysqlclient.so,libmysqlclient_r.so}
+    mv "$out"/lib/libmariadb.so.3 "$out"/lib/libmysqlclient.so
+    ln -sv libmysqlclient.so "$out"/lib/libmysqlclient_r.so
+    mkdir -p "$dev"/lib && mv "$out"/lib/{libmariadbclient.a,libmysqlclient.a,libmysqlclient_r.a,libmysqlservices.a} "$dev"/lib
   '';
 
   enableParallelBuilding = true; # the client should be OK
@@ -128,6 +124,8 @@ client = stdenv.mkDerivation (common // {
 everything = stdenv.mkDerivation (common // {
   name = "mariadb-${common.version}";
 
+  outputs = [ "out" "dev" "man" ];
+
   nativeBuildInputs = common.nativeBuildInputs ++ [ bison ];
 
   buildInputs = common.buildInputs ++ [
@@ -137,39 +135,36 @@ everything = stdenv.mkDerivation (common // {
 
   cmakeFlags = common.cmakeFlags ++ [
     "-DMYSQL_DATADIR=/var/lib/mysql"
-    "-DINSTALL_SYSCONFDIR=etc/mysql"
-    "-DINSTALL_INFODIR=share/mysql/docs"
-    "-DINSTALL_MANDIR=share/man"
     "-DINSTALL_PLUGINDIR=lib/mysql/plugin"
-    "-DINSTALL_SCRIPTDIR=bin"
-    "-DINSTALL_SUPPORTFILESDIR=share/mysql"
-    "-DINSTALL_DOCREADMEDIR=share/doc/mysql"
-    "-DINSTALL_DOCDIR=share/doc/mysql"
-    "-DINSTALL_SHAREDIR=share/mysql"
-    "-DINSTALL_MYSQLTESTDIR=OFF"
-    "-DINSTALL_SQLBENCHDIR=OFF"
-
-    "-DENABLED_LOCAL_INFILE=ON"
+    "-DENABLED_LOCAL_INFILE=OFF"
     "-DWITH_READLINE=ON"
-    "-DWITH_EXTRA_CHARSETS=complex"
-    "-DWITH_EMBEDDED_SERVER=ON"
-    "-DWITH_ARCHIVE_STORAGE_ENGINE=1"
-    "-DWITH_BLACKHOLE_STORAGE_ENGINE=1"
-    "-DWITH_INNOBASE_STORAGE_ENGINE=1"
-    "-DWITH_PARTITION_STORAGE_ENGINE=1"
-    "-DWITHOUT_EXAMPLE_STORAGE_ENGINE=1"
-    "-DWITHOUT_FEDERATED_STORAGE_ENGINE=1"
+    "-DWITH_EXTRA_CHARSETS=all"
+    "-DWITH_EMBEDDED_SERVER=OFF"
+    "-DWITH_UNIT_TESTS=OFF"
     "-DWITH_WSREP=ON"
     "-DWITH_INNODB_DISALLOW_WRITES=ON"
+    "-DWITHOUT_EXAMPLE=1"
+    "-DWITHOUT_FEDERATED=1"
   ] ++ stdenv.lib.optionals stdenv.isDarwin [
-    "-DWITHOUT_OQGRAPH_STORAGE_ENGINE=1"
+    "-DWITHOUT_OQGRAPH=1"
     "-DWITHOUT_TOKUDB=1"
   ];
 
-  postInstall = common.postInstall + ''
+  preConfigure = ''
+    cmakeFlags="$cmakeFlags \
+      -DINSTALL_SHAREDIR=$dev/share/mysql
+      -DINSTALL_SUPPORTFILESDIR=$dev/share/mysql"
+  '';
+
+  postInstall = ''
+    chmod +x "$out"/bin/wsrep_sst_common
     rm -r "$out"/data # Don't need testing data
-    rm "$out"/share/man/man1/mysql-test-run.pl.1
-    rm "$out"/bin/rcmysql
+    rm "$out"/bin/{mysql_find_rows,mysql_waitpid,mysqlaccess,mysqladmin,mysqlbinlog,mysqlcheck}
+    rm "$out"/bin/{mysqldump,mysqlhotcopy,mysqlimport,mysqlshow,mysqlslap,mysqltest}
+    rm "$out"/lib/mysql/plugin/{auth_gssapi_client.so,client_ed25519.so,daemon_example.ini}
+    rm "$out"/lib/{libmysqlclient.so,libmysqlclient_r.so}
+    mv "$out"/share/{groonga,groonga-normalizer-mysql} "$out"/share/doc/mysql
+    mkdir -p "$dev"/lib && mv "$out"/lib/{libmariadbclient.a,libmysqlclient.a,libmysqlclient_r.a,libmysqlservices.a} "$dev"/lib
   '' + optionalString (! stdenv.isDarwin) ''
     sed -i 's/-mariadb/-mysql/' "$out"/bin/galera_new_cluster
   '';
@@ -221,13 +216,13 @@ connector-c = stdenv.mkDerivation rec {
 
 galera = stdenv.mkDerivation rec {
   name = "mariadb-galera-${version}";
-  version = "25.3.24";
+  version = "25.3.26";
 
   src = fetchFromGitHub {
     owner = "codership";
     repo = "galera";
     rev = "release_${version}";
-    sha256 = "1yx3rqy7r4w2l3hnrri30hvsa296v8xidi18p5fdzcpmnhnlwjbi";
+    sha256 = "0fs0c1px9lknf1a5wwb12z1hj7j7b6hsfjddggikvkdkrnr2xs1f";
     fetchSubmodules = true;
   };
 
@@ -243,9 +238,9 @@ galera = stdenv.mkDerivation rec {
     export LIBPATH="${galeraLibs}/lib"
   '';
 
-  sconsFlags = "ssl=1 system_asio=1 strict_build_flags=0";
+  sconsFlags = "ssl=1 system_asio=0 strict_build_flags=0";
 
-  postInstall = ''
+  installPhase = ''
     # copied with modifications from scripts/packages/freebsd.sh
     GALERA_LICENSE_DIR="$share/licenses/${name}"
     install -d $out/{bin,lib/galera,share/doc/galera,$GALERA_LICENSE_DIR}
diff --git a/pkgs/servers/sql/mariadb/include-dirs-path.patch b/pkgs/servers/sql/mariadb/include-dirs-path.patch
deleted file mode 100644
index 8d468cf546a4..000000000000
--- a/pkgs/servers/sql/mariadb/include-dirs-path.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/libmariadb/mariadb_config/mariadb_config.c.in b/libmariadb/mariadb_config/mariadb_config.c.in
-index 45d2f4e..e5666db 100644
---- a/libmariadb/mariadb_config/mariadb_config.c.in
-+++ b/libmariadb/mariadb_config/mariadb_config.c.in
-@@ -5,7 +5,7 @@
- 
- static char *mariadb_progname;
- 
--#define INCLUDE "-I@CMAKE_INSTALL_PREFIX@/@INSTALL_INCLUDEDIR@ -I@CMAKE_INSTALL_PREFIX@/@INSTALL_INCLUDEDIR@/mysql"
-+#define INCLUDE "-I@INSTALL_INCLUDEDIR@ -I@INSTALL_INCLUDEDIR@/mysql"
- #define LIBS    "-L@CMAKE_INSTALL_PREFIX@/@INSTALL_LIBDIR@/ -lmariadb @extra_dynamic_LDFLAGS@"
- #define LIBS_SYS "@extra_dynamic_LDFLAGS@"
- #define CFLAGS  INCLUDE
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 44d4aad947d3..34aa18465c86 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -2679,11 +2679,11 @@ lib.makeScope newScope (self: with self; {
   }) {};
 
   xorgserver = callPackage ({ stdenv, pkgconfig, fetchurl, xorgproto, openssl, libX11, libXau, libXaw, libxcb, xcbutil, xcbutilwm, xcbutilimage, xcbutilkeysyms, xcbutilrenderutil, libXdmcp, libXfixes, libxkbfile, libXmu, libXpm, libXrender, libXres, libXt }: stdenv.mkDerivation {
-    name = "xorg-server-1.20.4";
+    name = "xorg-server-1.20.5";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/xserver/xorg-server-1.20.4.tar.bz2;
-      sha256 = "1vk6j7hmigfill9x8m7a6vvgb3s50ji2yf6yprbgqfz9xf9x83zy";
+      url = mirror://xorg/individual/xserver/xorg-server-1.20.5.tar.bz2;
+      sha256 = "17dc3g8cc55nbkx3np64dsz04n621dnzjmcc9wys0xbyyd1q47d8";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index c1ffd610eb1b..5326ab5a55a6 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -217,4 +217,4 @@ mirror://xorg/individual/util/lndir-1.0.3.tar.bz2
 mirror://xorg/individual/util/makedepend-1.0.6.tar.bz2
 mirror://xorg/individual/util/util-macros-1.19.2.tar.bz2
 mirror://xorg/individual/util/xorg-cf-files-1.0.6.tar.bz2
-mirror://xorg/individual/xserver/xorg-server-1.20.4.tar.bz2
+mirror://xorg/individual/xserver/xorg-server-1.20.5.tar.bz2
diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix
index 8cb0ad79587e..89e2a7a8031c 100644
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -169,7 +169,7 @@ let
     license = either (listOf lib.types.attrs) (either lib.types.attrs str);
     maintainers = listOf (attrsOf str);
     priority = int;
-    platforms = listOf (either str lib.systems.parsedPlatform.types.system);
+    platforms = listOf str;
     hydraPlatforms = listOf str;
     broken = bool;
     # TODO: refactor once something like Profpatsch's types-simple will land
@@ -210,11 +210,6 @@ let
     else "key '${k}' is unrecognized; expected one of: \n\t      [${lib.concatMapStringsSep ", " (x: "'${x}'") (lib.attrNames metaTypes)}]";
   checkMeta = meta: if shouldCheckMeta then lib.remove null (lib.mapAttrsToList checkMetaAttr meta) else [];
 
-  checkPlatform = attrs: let
-      anyMatch = lib.any (lib.meta.platformMatch hostPlatform);
-    in  anyMatch (attrs.meta.platforms or lib.platforms.all) &&
-      ! anyMatch (attrs.meta.badPlatforms or []);
-
   checkOutputsToInstall = attrs: let
       expectedOutputs = attrs.meta.outputsToInstall or [];
       actualOutputs = attrs.outputs or [ "out" ];
@@ -236,8 +231,10 @@ let
       { valid = false; reason = "blacklisted"; errormsg = "has a blacklisted license (‘${showLicense attrs.meta.license}’)"; }
     else if !allowBroken && attrs.meta.broken or false then
       { valid = false; reason = "broken"; errormsg = "is marked as broken"; }
-    else if !allowUnsupportedSystem && !(checkPlatform attrs) then
-      { valid = false; reason = "unsupported"; errormsg = "is not supported on ‘${hostPlatform.config}’"; }
+    else if !allowUnsupportedSystem &&
+            (!lib.lists.elem hostPlatform.system (attrs.meta.platforms or lib.platforms.all) ||
+              lib.lists.elem hostPlatform.system (attrs.meta.badPlatforms or [])) then
+      { valid = false; reason = "unsupported"; errormsg = "is not supported on ‘${hostPlatform.system}’"; }
     else if !(hasAllowedInsecure attrs) then
       { valid = false; reason = "insecure"; errormsg = "is marked as insecure"; }
     else if checkOutputsToInstall attrs then
diff --git a/pkgs/tools/X11/virtualgl/lib.nix b/pkgs/tools/X11/virtualgl/lib.nix
index 4c911e756330..47b54bec312c 100644
--- a/pkgs/tools/X11/virtualgl/lib.nix
+++ b/pkgs/tools/X11/virtualgl/lib.nix
@@ -1,12 +1,12 @@
-{ stdenv, fetchurl, cmake, libGLU_combined, libX11, libXv, libjpeg_turbo, fltk }:
+{ stdenv, fetchurl, cmake, libGL, libGLU, libX11, libXv, libXtst, libjpeg_turbo, fltk }:
 
 stdenv.mkDerivation rec {
   name = "virtualgl-lib-${version}";
-  version = "2.5.2";
+  version = "2.6.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/virtualgl/VirtualGL-${version}.tar.gz";
-    sha256 = "0f1jp7r4vajiksbiq08hkxd5bjj0jxlw7dy5750s52djg1v3hhsg";
+    sha256 = "0ngqwsm9bml6lis0igq3bn92amh04rccd6jhjibj3418hrbzipvr";
   };
 
   cmakeFlags = [ "-DVGL_SYSTEMFLTK=1" "-DTJPEG_LIBRARY=${libjpeg_turbo.out}/lib/libturbojpeg.so" ];
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
-  buildInputs = [ libjpeg_turbo libGLU_combined fltk libX11 libXv ];
+  buildInputs = [ libjpeg_turbo libGL libGLU fltk libX11 libXv libXtst ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/tools/audio/pulsemixer/default.nix b/pkgs/tools/audio/pulsemixer/default.nix
index 8251c7d5cfc9..051743b46e7a 100644
--- a/pkgs/tools/audio/pulsemixer/default.nix
+++ b/pkgs/tools/audio/pulsemixer/default.nix
@@ -1,15 +1,14 @@
 { stdenv, fetchFromGitHub, python3, libpulseaudio }:
 
 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
   pname = "pulsemixer";
-  version = "1.4.0";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "GeorgeFilipkin";
     repo = pname;
     rev = version;
-    sha256 = "0l5zawv36d46sj3k31k5w6imnnxzyn62r83wdhr7fp5mi3ls1h5x";
+    sha256 = "162nfpyqn4gp45x332a73n07c118vispz3jicin4p67x3f8f0g3j";
   };
 
   inherit libpulseaudio;
diff --git a/pkgs/tools/backup/duplicity/default.nix b/pkgs/tools/backup/duplicity/default.nix
index e14a62c8114d..b090da852638 100644
--- a/pkgs/tools/backup/duplicity/default.nix
+++ b/pkgs/tools/backup/duplicity/default.nix
@@ -1,4 +1,8 @@
-{ stdenv, fetchurl, python2Packages, librsync, ncftp, gnupg, rsync, makeWrapper }:
+{ stdenv, fetchpatch, fetchurl, python2Packages, librsync, ncftp, gnupg
+, gnutar
+, par2cmdline
+, utillinux
+, rsync, makeWrapper }:
 
 python2Packages.buildPythonApplication rec {
   name = "duplicity-${version}";
@@ -8,16 +12,46 @@ python2Packages.buildPythonApplication rec {
     url = "https://code.launchpad.net/duplicity/${stdenv.lib.versions.majorMinor version}-series/${version}/+download/${name}.tar.gz";
     sha256 = "0ag9dknslxlasslwfjhqgcqbkb1mvzzx93ry7lch2lfzcdd91am6";
   };
+  patches = [
+    ./gnutar-in-test.patch
+    ./use-installed-scripts-in-test.patch
+
+    # The following patches improve the performance of installCheckPhase:
+    # Ensure all duplicity output is captured in tests
+    (fetchpatch {
+      extraPrefix = "";
+      sha256 = "07ay3mmnw8p2j3v8yvcpjsx0rf2jqly9ablwjpmry23dz9f0mxsd";
+      url = "https://bazaar.launchpad.net/~duplicity-team/duplicity/0.8-series/diff/1359.2.1";
+    })
+    # Minimize time spent sleeping between backups
+    (fetchpatch {
+      extraPrefix = "";
+      sha256 = "0v99q6mvikb8sf68gh3s0zg12pq8fijs87fv1qrvdnc8zvs4pmfs";
+      url = "https://bazaar.launchpad.net/~duplicity-team/duplicity/0.8-series/diff/1359.2.2";
+    })
+    # Remove unnecessary sleeping after running backups in tests
+    (fetchpatch {
+      extraPrefix = "";
+      sha256 = "1bmgp4ilq2gwz2k73fxrqplf866hj57lbyabaqpkvwxhr0ch1jiq";
+      url = "https://bazaar.launchpad.net/~duplicity-team/duplicity/0.8-series/diff/1359.2.3";
+    })
+  ] ++ stdenv.lib.optionals stdenv.isLinux [
+    ./linux-disable-timezone-test.patch
+  ];
 
   buildInputs = [ librsync makeWrapper python2Packages.wrapPython ];
   propagatedBuildInputs = with python2Packages; [
     boto cffi cryptography ecdsa enum idna pygobject3 fasteners
     ipaddress lockfile paramiko pyasn1 pycrypto six
   ];
-  checkInputs = with python2Packages; [ lockfile mock pexpect ];
-
-  # lots of tests are failing, although we get a little further now with the bits in preCheck
-  doCheck = false;
+  checkInputs = [
+    gnupg  # Add 'gpg' to PATH.
+    gnutar  # Add 'tar' to PATH.
+    librsync  # Add 'rdiff' to PATH.
+    par2cmdline  # Add 'par2' to PATH.
+  ] ++ stdenv.lib.optionals stdenv.isLinux [
+    utillinux  # Add 'setsid' to PATH.
+  ] ++ (with python2Packages; [ lockfile mock pexpect ]);
 
   postInstall = ''
     wrapProgram $out/bin/duplicity \
@@ -27,12 +61,30 @@ python2Packages.buildPythonApplication rec {
   '';
 
   preCheck = ''
-    patchShebangs testing
+    wrapPythonProgramsIn "$PWD/testing/overrides/bin" "$pythonPath"
 
-    substituteInPlace testing/__init__.py \
-      --replace 'mkdir testfiles' 'mkdir -p testfiles'
+    # Add 'duplicity' to PATH for tests.
+    # Normally, 'setup.py test' adds 'build/scripts-2.7/' to PATH before running
+    # tests. However, 'build/scripts-2.7/duplicity' is not wrapped, so its
+    # shebang is incorrect and it fails to run inside Nix' sandbox.
+    # In combination with use-installed-scripts-in-test.patch, make 'setup.py
+    # test' use the installed 'duplicity' instead.
+    PATH="$out/bin:$PATH"
+
+    # Don't run developer-only checks (pep8, etc.).
+    export RUN_CODE_TESTS=0
+  '' + stdenv.lib.optionalString stdenv.isDarwin ''
+    # Work around the following error when running tests:
+    # > Max open files of 256 is too low, should be >= 1024.
+    # > Use 'ulimit -n 1024' or higher to correct.
+    ulimit -n 1024
   '';
 
+  # TODO: Fix test failures on macOS 10.13:
+  #
+  # > OSError: out of pty devices
+  doCheck = !stdenv.isDarwin;
+
   meta = with stdenv.lib; {
     description = "Encrypted bandwidth-efficient backup using the rsync algorithm";
     homepage = https://www.nongnu.org/duplicity;
diff --git a/pkgs/tools/backup/duplicity/gnutar-in-test.patch b/pkgs/tools/backup/duplicity/gnutar-in-test.patch
new file mode 100644
index 000000000000..b2820feb0190
--- /dev/null
+++ b/pkgs/tools/backup/duplicity/gnutar-in-test.patch
@@ -0,0 +1,18 @@
+--- a/testing/functional/test_restart.py
++++ b/testing/functional/test_restart.py
+@@ -323,14 +323,7 @@ class RestartTestWithoutEncryption(RestartTest):
+         https://launchpad.net/bugs/929067
+         """
+
+-        if platform.system().startswith('Linux'):
+-            tarcmd = "tar"
+-        elif platform.system().startswith('Darwin'):
+-            tarcmd = "gtar"
+-        elif platform.system().endswith('BSD'):
+-            tarcmd = "gtar"
+-        else:
+-            raise Exception("Platform %s not supported by tar/gtar." % platform.platform())
++        tarcmd = "tar"
+
+         # Intial normal backup
+         self.backup("full", "testfiles/blocktartest")
diff --git a/pkgs/tools/backup/duplicity/linux-disable-timezone-test.patch b/pkgs/tools/backup/duplicity/linux-disable-timezone-test.patch
new file mode 100644
index 000000000000..b5e6df18a15b
--- /dev/null
+++ b/pkgs/tools/backup/duplicity/linux-disable-timezone-test.patch
@@ -0,0 +1,10 @@
+--- a/testing/unit/test_statistics.py
++++ b/testing/unit/test_statistics.py
+@@ -59,6 +59,7 @@ class StatsObjTest(UnitTestCase):
+         s1 = StatsDeltaProcess()
+         assert s1.get_stat('SourceFiles') == 0
+
++    @unittest.skip("Broken on Linux in Nix' build environment")
+     def test_get_stats_string(self):
+         """Test conversion of stat object into string"""
+         s = StatsObj()
diff --git a/pkgs/tools/backup/duplicity/use-installed-scripts-in-test.patch b/pkgs/tools/backup/duplicity/use-installed-scripts-in-test.patch
new file mode 100644
index 000000000000..191808abc637
--- /dev/null
+++ b/pkgs/tools/backup/duplicity/use-installed-scripts-in-test.patch
@@ -0,0 +1,13 @@
+--- a/setup.py
++++ b/setup.py
+@@ -92,10 +92,6 @@ class TestCommand(test):
+                 except Exception:
+                     pass
+
+-        os.environ['PATH'] = "%s:%s" % (
+-            os.path.abspath(build_scripts_cmd.build_dir),
+-            os.environ.get('PATH'))
+-
+         test.run(self)
+
+     def run_tests(self):
diff --git a/pkgs/tools/bootloaders/refind/0001-toolchain.patch b/pkgs/tools/bootloaders/refind/0001-toolchain.patch
new file mode 100644
index 000000000000..13c4c88f95f0
--- /dev/null
+++ b/pkgs/tools/bootloaders/refind/0001-toolchain.patch
@@ -0,0 +1,27 @@
+diff --git a/Make.common b/Make.common
+index 3f0b919..ee365f5 100644
+--- a/Make.common
++++ b/Make.common
+@@ -33,22 +33,6 @@ ARCH            ?= $(HOSTARCH)
+ 
+ # Note: TIANOBASE is defined in master Makefile and exported
+ GENFW           = $(TIANOBASE)/BaseTools/Source/C/bin/GenFw
+-prefix          = /usr/bin/
+-ifeq ($(ARCH),aarch64)
+-  CC            = $(prefix)aarch64-linux-gnu-gcc
+-  AS            = $(prefix)aarch64-linux-gnu-as
+-  LD            = $(prefix)aarch64-linux-gnu-ld
+-  AR            = $(prefix)aarch64-linux-gnu-ar
+-  RANLIB        = $(prefix)aarch64-linux-gnu-ranlib
+-  OBJCOPY       = $(prefix)aarch64-linux-gnu-objcopy
+-else
+-  CC            = $(prefix)gcc
+-  AS            = $(prefix)as
+-  LD            = $(prefix)ld
+-  AR            = $(prefix)ar
+-  RANLIB        = $(prefix)ranlib
+-  OBJCOPY       = $(prefix)objcopy
+-endif
+ 
+ ifeq ($(MAKEWITH),TIANO)
+ # Below file defines TARGET (RELEASE or DEBUG) and TOOL_CHAIN_TAG (GCC44, GCC45, GCC46, or GCC47)
diff --git a/pkgs/tools/bootloaders/refind/default.nix b/pkgs/tools/bootloaders/refind/default.nix
index bc84edeb21b7..0cdcd4c58df4 100644
--- a/pkgs/tools/bootloaders/refind/default.nix
+++ b/pkgs/tools/bootloaders/refind/default.nix
@@ -4,6 +4,7 @@ let
   archids = {
     "x86_64-linux" = { hostarch = "x86_64"; efiPlatform = "x64"; };
     "i686-linux" = rec { hostarch = "ia32"; efiPlatform = hostarch; };
+    "aarch64-linux" = rec { hostarch = "aarch64"; efiPlatform = "aa64"; };
   };
 
   inherit
@@ -21,6 +22,10 @@ stdenv.mkDerivation rec {
     sha256 = "1bjd0dl77bc5k6g3kc7s8m57vpbg2zscph9qh84xll9rc10g3fir";
   };
 
+  patches = [
+    ./0001-toolchain.patch
+  ];
+
   buildInputs = [ gnu-efi ];
 
   hardeningDisable = [ "stackprotector" ];
@@ -32,6 +37,7 @@ stdenv.mkDerivation rec {
       "GNUEFILIB=${gnu-efi}/lib"
       "EFICRT0=${gnu-efi}/lib"
       "HOSTARCH=${hostarch}"
+      "ARCH=${hostarch}"
     ];
 
   buildFlags = [ "gnuefi" "fs_gnuefi" ];
@@ -116,7 +122,7 @@ stdenv.mkDerivation rec {
     '';
     homepage = http://refind.sourceforge.net/;
     maintainers = [ maintainers.AndersonTorres ];
-    platforms = [ "i686-linux" "x86_64-linux" ];
+    platforms = [ "i686-linux" "x86_64-linux" "aarch64-linux" ];
     license = licenses.gpl3Plus;
   };
 
diff --git a/pkgs/tools/graphics/nip2/default.nix b/pkgs/tools/graphics/nip2/default.nix
index d0ad0c27f20d..ac4d8441bf59 100644
--- a/pkgs/tools/graphics/nip2/default.nix
+++ b/pkgs/tools/graphics/nip2/default.nix
@@ -2,11 +2,12 @@
 fftw, gsl, goffice, libgsf }:
 
 stdenv.mkDerivation rec {
-  name = "nip2-8.3.0";
+  pname = "nip2";
+  version = "8.7.1";
 
   src = fetchurl {
-    url = "http://www.vips.ecs.soton.ac.uk/supported/current/${name}.tar.gz";
-    sha256 = "0vr12gyfvhxx2a28y74lzfg379d1fk0g9isc69k0vdgpn4y1i8aa";
+    url = "https://github.com/libvips/nip2/releases/download/v${version}/nip2-${version}.tar.gz";
+    sha256 = "0l7n427njif53npqn02gfjjly8y3khbrkzqxp10j5vp9h97psgiw";
   };
 
   buildInputs =
@@ -15,10 +16,10 @@ stdenv.mkDerivation rec {
   ];
 
   meta = with stdenv.lib; {
-    homepage = http://www.vips.ecs.soton.ac.uk;
+    homepage = "https://github.com/libvips/nip2";
     description = "Graphical user interface for VIPS image processing system";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ kovirobi ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/tools/graphics/vips/default.nix b/pkgs/tools/graphics/vips/default.nix
index 77f15aa99b6d..f5311d378d7e 100644
--- a/pkgs/tools/graphics/vips/default.nix
+++ b/pkgs/tools/graphics/vips/default.nix
@@ -10,13 +10,18 @@
 
 stdenv.mkDerivation rec {
   name = "vips-${version}";
-  version = "8.7.4";
+  version = "8.8.0";
 
   src = fetchFromGitHub {
     owner = "libvips";
     repo = "libvips";
     rev = "v${version}";
-    sha256 = "0mcax1qg5i4iqlvgkz3s0c938d7ymx24pv3q2n3w2pjylnnd489s";
+    sha256 = "17wz4rxn3jb171lrh8v3dxiykjhzwwzs5r7ly651dspcbi6s3r6c";
+    # Remove unicode file names which leads to different checksums on HFS+
+    # vs. other filesystems because of unicode normalisation.
+    extraPostFetch = ''
+      rm -r $out/test/test-suite/images/
+    '';
   };
 
   nativeBuildInputs = [ pkgconfig autoreconfHook gtk-doc gobject-introspection ];
@@ -30,7 +35,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    homepage = http://www.vips.ecs.soton.ac.uk;
+    homepage = "https://libvips.github.io/libvips/";
     description = "Image processing system for large images";
     license = licenses.lgpl2Plus;
     maintainers = with maintainers; [ kovirobi ];
diff --git a/pkgs/tools/graphics/wallutils/default.nix b/pkgs/tools/graphics/wallutils/default.nix
index 25ef433304c9..2d14c0809721 100644
--- a/pkgs/tools/graphics/wallutils/default.nix
+++ b/pkgs/tools/graphics/wallutils/default.nix
@@ -4,16 +4,16 @@
 
 buildGoModule rec {
   name = "wallutils-${version}";
-  version = "5.7.2";
+  version = "5.8.0";
 
   src = fetchFromGitHub {
     owner = "xyproto";
     repo = "wallutils";
     rev = version;
-    sha256 = "1q4487s83iwwgd40hkihpns84ya8mg54zp63ag519cdjizz38xyi";
+    sha256 = "1s9k2fwckpm1zpdxywckwbql38h0sp6y9ji88rxss7yjc2g12zaf";
   };
 
-  modSha256 = "0kj9s9ymd99a5w9r1d997qysnzlgpnmh5dnki33h1jlwz47nwkld";
+  modSha256 = "0rfmqmm0jld7zrv192dqv7khwb2xm9i77sa1wgr7q6afdhbkrm21";
 
   patches = [ ./lscollection-Add-NixOS-paths-to-DefaultWallpaperDirectories.patch ];
 
diff --git a/pkgs/tools/inputmethods/fcitx/unwrapped.nix b/pkgs/tools/inputmethods/fcitx/unwrapped.nix
index 50cc06d20593..b32368c93d3c 100644
--- a/pkgs/tools/inputmethods/fcitx/unwrapped.nix
+++ b/pkgs/tools/inputmethods/fcitx/unwrapped.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, pkgconfig, cmake, intltool, gettext
-, libxml2, enchant, isocodes, icu, libpthreadstubs
+, libxml2, enchant1, isocodes, icu, libpthreadstubs
 , pango, cairo, libxkbfile, libXau, libXdmcp, libxkbcommon
 , dbus, gtk2, gtk3, qt4, extra-cmake-modules
 , xkeyboard_config, pcre, libuuid
@@ -69,7 +69,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake extra-cmake-modules intltool pkgconfig pcre ];
 
   buildInputs = [
-    xkeyboard_config enchant gettext isocodes icu libpthreadstubs libXau libXdmcp libxkbfile
+    xkeyboard_config enchant1 gettext isocodes icu libpthreadstubs libXau libXdmcp libxkbfile
     libxkbcommon libxml2 dbus cairo gtk2 gtk3 pango qt4 libuuid
   ];
 
diff --git a/pkgs/tools/misc/grub4dos/default.nix b/pkgs/tools/misc/grub4dos/default.nix
index 9719ea6fe554..ec77f3965273 100644
--- a/pkgs/tools/misc/grub4dos/default.nix
+++ b/pkgs/tools/misc/grub4dos/default.nix
@@ -6,13 +6,13 @@ let arch =
   else throw "Unknown architecture";
 in stdenv.mkDerivation rec {
   name = "grub4dos-${version}";
-  version = "0.4.6a-2018-02-20";
+  version = "0.4.6a-2019-05-12";
 
   src = fetchFromGitHub {
     owner = "chenall";
     repo = "grub4dos";
-    rev = "74f6c862c73a4d21e61832174f4ab2f1d7f8b12a";
-    sha256 = "0p85y5adnlcs4cdi9dg6f5fzzc1y12bmfhx13qs0576izx2rma3q";
+    rev = "e8224a2d20760139ffaeafa07838e2c3c54de783";
+    sha256 = "0i7n71za43qnlsxfvjrv1z5g1w5jl9snpbnas7rw97rry7cgyswf";
   };
 
   nativeBuildInputs = [ nasm ];
@@ -30,6 +30,9 @@ in stdenv.mkDerivation rec {
   dontStrip = true;
   dontPatchELF = true;
 
+  # make[2]: *** No rule to make target 'pre_stage2_fullsize', needed by 'all-am'.  Stop.
+  enableParallelBuilding = false;
+
   meta = with stdenv.lib; {
     homepage = http://grub4dos.chenall.net/;
     description = "GRUB for DOS is the dos extension of GRUB";
diff --git a/pkgs/tools/misc/hexyl/default.nix b/pkgs/tools/misc/hexyl/default.nix
index dac369d99aa7..f6b0649e4046 100644
--- a/pkgs/tools/misc/hexyl/default.nix
+++ b/pkgs/tools/misc/hexyl/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname   = "hexyl";
-  version = "0.5.0";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner  = "sharkdp";
     repo   = pname;
     rev    = "v${version}";
-    sha256 = "1b5y2lwcv802hjp105h35vda1d6rgysm9qvrm0v96srm0qqh8rq3";
+    sha256 = "0511ikhfc0fa6cfp02n49zlzyqgwf7ymgn911y8fnjlaf6grsh67";
   };
 
-  cargoSha256 = "0z7dg098ivyvf4782hy8hc5c1ddj3qrrnrqhgpwcdbx3xlwn8p8x";
+  cargoSha256 = "126hq802hncji4yvkf7jvaq2njzw8kwzvc7fqw99nrdn4k56xig7";
 
   meta = with stdenv.lib; {
     description = "A command-line hex viewer";
diff --git a/pkgs/tools/misc/jdupes/default.nix b/pkgs/tools/misc/jdupes/default.nix
index 9ce06c9cf438..8fbd0a461d09 100644
--- a/pkgs/tools/misc/jdupes/default.nix
+++ b/pkgs/tools/misc/jdupes/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "jdupes-${version}";
-  version = "1.12";
+  version = "1.13";
 
   src = fetchFromGitHub {
     owner = "jbruchon";
     repo  = "jdupes";
     rev   = "v${version}";
-    sha256 = "1m5506scjbf2820p7mbsdsb2acg9jm74sb1604m9iz8v3dcn9dm6";
+    sha256 = "1apqc4ylx6jmpkaypi8323063g5685kl8nbjna2291lzf2pc4r9f";
     # Unicode file names lead to different checksums on HFS+ vs. other
     # filesystems because of unicode normalisation. The testdir
     # directories have such files and will be removed.
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   doCheck = false; # broken Makefile, the above also removes tests
 
   postInstall = ''
-    install -Dm644 -t $out/share/doc/jdupes CHANGES LICENSE README
+    install -Dm644 -t $out/share/doc/jdupes CHANGES LICENSE README.md
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/kronometer/default.nix b/pkgs/tools/misc/kronometer/default.nix
index 7fb4077e5367..0307cd86df88 100644
--- a/pkgs/tools/misc/kronometer/default.nix
+++ b/pkgs/tools/misc/kronometer/default.nix
@@ -17,6 +17,8 @@ mkDerivation rec {
   };
 
   meta = with lib; {
+    homepage = "https://kde.org/applications/utilities/kronometer/";
+    description = "A stopwatch application";
     license = licenses.gpl2;
     maintainers = with maintainers; [ peterhoeg ];
   };
diff --git a/pkgs/tools/misc/sdl-jstest/default.nix b/pkgs/tools/misc/sdl-jstest/default.nix
index f15d3f7162b8..6a2ed3bcb911 100644
--- a/pkgs/tools/misc/sdl-jstest/default.nix
+++ b/pkgs/tools/misc/sdl-jstest/default.nix
@@ -1,18 +1,18 @@
-{ fetchFromGitHub, stdenv, cmake, pkgconfig, SDL, SDL2, ncurses, docbook_xsl }:
+{ stdenv, fetchgit, cmake, pkgconfig, SDL, SDL2, ncurses, docbook_xsl, git }:
 
 stdenv.mkDerivation rec {
   name = "sdl-jstest-${version}";
-  version = "2016-03-29";
+  version = "2018-06-15";
 
-  src = fetchFromGitHub {
-    owner = "Grumbel";
-    repo = "sdl-jstest";
-    rev = "301a0e8cf3f96de4c5e58d9fe4413e5cd2b4e6d4";
-    sha256 = "1qrz09by5snc3n1wppf2y0pj7rx29dlh1g84glga8vvb03n3yb14";
+  # Submodules
+  src = fetchgit {
+    url = "https://github.com/Grumbel/sdl-jstest";
+    rev = "aafbdb1ed3e687583037ba55ae88b1210d6ce98b";
+    sha256 = "0p4cjzcq0bbkzad19jwdklylqhq2q390q7dpg8bfzl2rwls883rk";
   };
 
   buildInputs = [ SDL SDL2 ncurses ];
-  nativeBuildInputs = [ cmake pkgconfig docbook_xsl ];
+  nativeBuildInputs = [ cmake pkgconfig docbook_xsl git ];
   
   meta = with stdenv.lib; {
     homepage = https://github.com/Grumbel/sdl-jstest;
diff --git a/pkgs/tools/misc/txr/default.nix b/pkgs/tools/misc/txr/default.nix
index 368b0f908c76..4618324a75ab 100644
--- a/pkgs/tools/misc/txr/default.nix
+++ b/pkgs/tools/misc/txr/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, bison, flex, libffi }:
 
 stdenv.mkDerivation rec {
-  name = "txr-${version}";
-  version = "209";
+  pname = "txr";
+  version = "216";
 
   src = fetchurl {
-    url = "http://www.kylheku.com/cgit/txr/snapshot/${name}.tar.bz2";
-    sha256 = "1g236bk5ygh3car4kki3w6n0pwny8q4awg8p86fh2khj52qz6mdl";
+    url = "http://www.kylheku.com/cgit/txr/snapshot/${pname}-${version}.tar.bz2";
+    sha256 = "07cxdpc9zsqd0c2668g00dqjpd6zc4mfdn74aarr6d2hpzdhh937";
   };
 
   nativeBuildInputs = [ bison flex ];
@@ -20,12 +20,23 @@ stdenv.mkDerivation rec {
   # Remove failing test-- mentions 'usr/bin' so probably related :)
   preCheck = "rm -rf tests/017";
 
-  # TODO: install 'tl.vim', make avail when txr is installed or via plugin
+  postInstall = ''
+    d=$out/share/vim-plugins/txr
+    mkdir -p $d/{syntax,ftdetect}
+
+    cp {tl,txr}.vim $d/syntax/
+
+    cat > $d/ftdetect/txr.vim <<EOF
+      au BufRead,BufNewFile *.txr set filetype=txr | set lisp
+      au BufRead,BufNewFile *.tl,*.tlo set filetype=tl | set lisp
+    EOF
+  '';
 
   meta = with stdenv.lib; {
     description = "Programming language for convenient data munging";
     license = licenses.bsd2;
     homepage = http://nongnu.org/txr;
     maintainers = with stdenv.lib.maintainers; [ dtzWill ];
+    platforms = platforms.linux; # Darwin fails although it should work AFAIK
   };
 }
diff --git a/pkgs/tools/misc/websocat/default.nix b/pkgs/tools/misc/websocat/default.nix
index 48983fc85e13..a276b13a59ca 100644
--- a/pkgs/tools/misc/websocat/default.nix
+++ b/pkgs/tools/misc/websocat/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, rustPlatform, Security
+{ stdenv, fetchFromGitHub, pkgconfig, openssl, rustPlatform, Security
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -12,9 +12,11 @@ rustPlatform.buildRustPackage rec {
     sha256 = "1gf2snr12vnx2mhsrwkb5274r1pvdrf8m3bybrqbh8s9wd83nrh6";
   };
 
+  cargoBuildFlags = [ "--features=ssl" ];
   cargoSha256 = "1zqfvbihf8xwgh092n9wzm3mdgbv0n99gjsfk9przqj2vh7wfvh2";
 
-  buildInputs = stdenv.lib.optional stdenv.isDarwin Security;
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ openssl ] ++ stdenv.lib.optional stdenv.isDarwin Security;
 
   meta = with stdenv.lib; {
     description = "Command-line client for WebSockets (like netcat/socat)";
diff --git a/pkgs/tools/misc/you-get/default.nix b/pkgs/tools/misc/you-get/default.nix
index 2f009acc13a0..c32c141060a5 100644
--- a/pkgs/tools/misc/you-get/default.nix
+++ b/pkgs/tools/misc/you-get/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonApplication rec {
   pname = "you-get";
-  version = "0.4.1295";
+  version = "0.4.1302";
 
   # Tests aren't packaged, but they all hit the real network so
   # probably aren't suitable for a build environment anyway.
@@ -10,7 +10,7 @@ buildPythonApplication rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "15p9ngscrn20shkg909hcnsizqpbl038zbnmxwbprj88lnn8xz9m";
+    sha256 = "09iip5y5h6jv7wc38117wldnl91ndwgbnn1h8p890h0v25hk28vh";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/networking/brook/default.nix b/pkgs/tools/networking/brook/default.nix
index b840628e2151..dec74c72fbe7 100644
--- a/pkgs/tools/networking/brook/default.nix
+++ b/pkgs/tools/networking/brook/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "brook";
-  version = "20190401";
+  version = "20190601";
 
   goPackagePath = "github.com/txthinking/brook";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     owner = "txthinking";
     repo = "${pname}";
     rev = "v${version}";
-    sha256 = "0kx0dpvr3llpdzmw5bvzhdvwkmzrv6kqbsilx6rgrvyl61y9pyry";
+    sha256 = "04gx1p447wabw3d18s9sm8ynlvj2bp8ac9dsgs08kd1dyrsjlljk";
   };
 
   goDeps = ./deps.nix;
diff --git a/pkgs/tools/networking/brook/deps.nix b/pkgs/tools/networking/brook/deps.nix
index 68fffd34e2a3..a9a8d5e43e3b 100644
--- a/pkgs/tools/networking/brook/deps.nix
+++ b/pkgs/tools/networking/brook/deps.nix
@@ -9,57 +9,12 @@
     };
   }
   {
-    goPackagePath = "github.com/bitly/go-simplejson";
-    fetch = {
-      type = "git";
-      url = "https://github.com/bitly/go-simplejson";
-      rev = "9db4a59bd4d803ae0c173a7d8a538e056cd59d57";
-      sha256 = "0cbnjzjq55jnzk07zdk7nb96yzgpyawm1r6km3xignn8ih4bnn6g";
-    };
-  }
-  {
-    goPackagePath = "github.com/fatih/structs";
-    fetch = {
-      type = "git";
-      url = "https://github.com/fatih/structs";
-      rev = "878a968ab22548362a09bdb3322f98b00f470d46";
-      sha256 = "15nkffa8ylr5kkv52gyry675l8bzv3c0xx39j0fzz0vp2kcjyy8x";
-    };
-  }
-  {
-    goPackagePath = "github.com/go-sql-driver/mysql";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-sql-driver/mysql";
-      rev = "93c3765e9bb2e29c6a63277c9f829dae34ec24eb";
-      sha256 = "043yalxp97vc9xsd5npms0h6slxrlzf8dzvd9l0wcxa8v0cl9lp6";
-    };
-  }
-  {
-    goPackagePath = "github.com/jinzhu/inflection";
-    fetch = {
-      type = "git";
-      url = "https://github.com/jinzhu/inflection";
-      rev = "04140366298a54a039076d798123ffa108fff46c";
-      sha256 = "1s4qcnwaajp3c5ykwx4dfy32hykwsm0ki7kx8lcw8b0z0grkz6qh";
-    };
-  }
-  {
-    goPackagePath = "github.com/jmoiron/sqlx";
-    fetch = {
-      type = "git";
-      url = "https://github.com/jmoiron/sqlx";
-      rev = "1d3423c595d749e4613fce663591b44ae539d377";
-      sha256 = "0947211fqibv9sqsk22lfnk080vqnsxmsan9fff5phygbmzbhzzb";
-    };
-  }
-  {
     goPackagePath = "github.com/mdp/qrterminal";
     fetch = {
       type = "git";
       url = "https://github.com/mdp/qrterminal";
-      rev = "28b49810f53911623d0a538d8edc01b8cbe2bd0e";
-      sha256 = "17dq5niw57r1iq1rn1crpgbq1ydrcxqpzc9gj7dd1snc0p9n1rv1";
+      rev = "ee9ef6b3f704870848e4022c4bc8c4d8c192516c";
+      sha256 = "19dwrmkd1hqjngpmz05y9d0gxzxmdx1plya91ja08s1c1nqc264f";
     };
   }
   {
@@ -67,8 +22,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/miekg/dns";
-      rev = "73601d4aed9d844322611759d7f3619110b7c88e";
-      sha256 = "1frnj97bbch1qhg55fx2yz6mdjsz8fw94sj7pkrjms239j7vqcvm";
+      rev = "d16ecb693e3f8d524769fefce2192a4c92207ff9";
+      sha256 = "0x0danna6nzkbiprwjpj0bix2m25lsbvna1bncdm233l3prh8sb1";
     };
   }
   {
@@ -99,15 +54,6 @@
     };
   }
   {
-    goPackagePath = "github.com/txthinking/mailx";
-    fetch = {
-      type = "git";
-      url = "https://github.com/txthinking/mailx";
-      rev = "ebc2af2e1aa8d2178c30786c18eb138fbe40010d";
-      sha256 = "02h5b922savsljcgjz3gxkydk52zd2gbs51prz88l60n6miv9k70";
-    };
-  }
-  {
     goPackagePath = "github.com/txthinking/socks5";
     fetch = {
       type = "git";
@@ -121,8 +67,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/txthinking/x";
-      rev = "e13a838cdc21596c45b4e6b6fd15c822597c9ae3";
-      sha256 = "0l5gzhy3h3qynfkgd789hxkv433yqdn1mmk945bwjha7vrm4rx2z";
+      rev = "8956479d309307bcd91c2ec89370118aef61abf7";
+      sha256 = "0vfsbm5025cpmqpc506vz1vqlzmcw5sc1zrjgx8z22kp1q1slylv";
     };
   }
   {
@@ -130,8 +76,8 @@
     fetch = {
       type = "git";
       url = "https://go.googlesource.com/crypto";
-      rev = "38d8ce5564a5b71b2e3a00553993f1b9a7ae852f";
-      sha256 = "1x52liy2540pw75sqsw4vpg41vq2dnmqpc0j5r7k6jxv6xmbr5mb";
+      rev = "20be4c3c3ed52bfccdb2d59a412ee1a936d175a7";
+      sha256 = "1ph7y8v30hc95h1dwr7vrhg1nzs47a261qin6zg8mhf12g5k2lxb";
     };
   }
   {
@@ -139,8 +85,8 @@
     fetch = {
       type = "git";
       url = "https://go.googlesource.com/net";
-      rev = "eb5bcb51f2a31c7d5141d810b70815c05d9c9146";
-      sha256 = "17k4g8krxbl84gzcs275b7gsh66dzm15fdxivjnx9xz8q84l4kby";
+      rev = "f3200d17e092c607f615320ecaad13d87ad9a2b3";
+      sha256 = "1mskh7p80dd8j1ffy16917d3cyy7lfh1gb56n4rq9g1bwckz4lwy";
     };
   }
   {
@@ -148,8 +94,8 @@
     fetch = {
       type = "git";
       url = "https://go.googlesource.com/text";
-      rev = "31e7599a6c37728c25ca34167be099d072ad335d";
-      sha256 = "18i17j7nkkc5dl9rpzm8l345r409hfj4knfnldar684337x1irrf";
+      rev = "342b2e1fbaa52c93f31447ad2c6abc048c63e475";
+      sha256 = "0flv9idw0jm5nm8lx25xqanbkqgfiym6619w575p7nrdh0riqwqh";
     };
   }
   {
diff --git a/pkgs/tools/networking/network-manager/applet.nix b/pkgs/tools/networking/network-manager/applet.nix
index d9f9e6570acb..f7df0740ba17 100644
--- a/pkgs/tools/networking/network-manager/applet.nix
+++ b/pkgs/tools/networking/network-manager/applet.nix
@@ -6,13 +6,13 @@
 
 let
   pname = "network-manager-applet";
-  version = "1.8.20";
+  version = "1.8.22";
 in stdenv.mkDerivation rec {
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "1v1lvw9ak37gxha11rv49sai1vdyv128hdy0kliibiv6alavn385";
+    sha256 = "1vbyhxknixyrf75pbjl3rxcy32m8y9cx5s30s3598vgza081rvzb";
   };
 
   mesonFlags = [
diff --git a/pkgs/tools/networking/strongswan/default.nix b/pkgs/tools/networking/strongswan/default.nix
index 8cd76b9ca4e6..1f0271c22573 100644
--- a/pkgs/tools/networking/strongswan/default.nix
+++ b/pkgs/tools/networking/strongswan/default.nix
@@ -19,11 +19,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "strongswan-${version}";
-  version = "5.7.2";
+  version = "5.8.0"; # Make sure to also update <nixpkgs/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix> when upgrading!
 
   src = fetchurl {
     url = "https://download.strongswan.org/${name}.tar.bz2";
-    sha256 = "0w6cks42lvvyj5ivyhqyqxya48x93yzfpz281q3xmqicdskkp3ih";
+    sha256 = "0cq9m86ydd2i0awxkv4a256f4926p2f9pzlisyskl9fngl6f3c8m";
   };
 
   dontPatchELF = true;
@@ -40,10 +40,6 @@ stdenv.mkDerivation rec {
     ./ext_auth-path.patch
     ./firewall_defaults.patch
     ./updown-path.patch
-    (optional stdenv.isLinux (substituteAll {
-      src = ./modprobe-path.patch;
-      inherit kmod;
-    }))
   ];
 
   postPatch = optionalString stdenv.isLinux ''
diff --git a/pkgs/tools/networking/strongswan/modprobe-path.patch b/pkgs/tools/networking/strongswan/modprobe-path.patch
deleted file mode 100644
index 4c0cb59c13a1..000000000000
--- a/pkgs/tools/networking/strongswan/modprobe-path.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-diff --git a/src/starter/klips.c b/src/starter/klips.c
-index 2216546..d626677 100644
---- a/src/starter/klips.c
-+++ b/src/starter/klips.c
-@@ -30,7 +30,7 @@ bool starter_klips_init(void)
- 		/* ipsec module makes the pf_key proc interface visible */
- 		if (stat(PROC_MODULES, &stb) == 0)
- 		{
--			ignore_result(system("modprobe -qv ipsec"));
-+			ignore_result(system("@kmod@/bin/modprobe -qv ipsec"));
- 		}
- 
- 		/* now test again */
-@@ -42,9 +42,9 @@ bool starter_klips_init(void)
- 	}
- 
- 	/* load crypto algorithm modules */
--	ignore_result(system("modprobe -qv ipsec_aes"));
--	ignore_result(system("modprobe -qv ipsec_blowfish"));
--	ignore_result(system("modprobe -qv ipsec_sha2"));
-+	ignore_result(system("@kmod@/bin/modprobe -qv ipsec_aes"));
-+	ignore_result(system("@kmod@/bin/modprobe -qv ipsec_blowfish"));
-+	ignore_result(system("@kmod@/bin/modprobe -qv ipsec_sha2"));
- 
- 	DBG2(DBG_APP, "found KLIPS IPsec stack");
- 	return TRUE;
-diff --git a/src/starter/netkey.c b/src/starter/netkey.c
-index b150d3e..0a7c2ff 100644
---- a/src/starter/netkey.c
-+++ b/src/starter/netkey.c
-@@ -30,7 +30,7 @@ bool starter_netkey_init(void)
- 		/* af_key module makes the netkey proc interface visible */
- 		if (stat(PROC_MODULES, &stb) == 0)
- 		{
--			ignore_result(system("modprobe -qv af_key"));
-+			ignore_result(system("@kmod@/bin/modprobe -qv af_key"));
- 		}
- 
- 		/* now test again */
-@@ -44,11 +44,11 @@ bool starter_netkey_init(void)
- 	/* make sure that all required IPsec modules are loaded */
- 	if (stat(PROC_MODULES, &stb) == 0)
- 	{
--		ignore_result(system("modprobe -qv ah4"));
--		ignore_result(system("modprobe -qv esp4"));
--		ignore_result(system("modprobe -qv ipcomp"));
--		ignore_result(system("modprobe -qv xfrm4_tunnel"));
--		ignore_result(system("modprobe -qv xfrm_user"));
-+		ignore_result(system("@kmod@/bin/modprobe -qv ah4"));
-+		ignore_result(system("@kmod@/bin/modprobe -qv esp4"));
-+		ignore_result(system("@kmod@/bin/modprobe -qv ipcomp"));
-+		ignore_result(system("@kmod@/bin/modprobe -qv xfrm4_tunnel"));
-+		ignore_result(system("@kmod@/bin/modprobe -qv xfrm_user"));
- 	}
- 
- 	DBG2(DBG_APP, "found netkey IPsec stack");
diff --git a/pkgs/tools/networking/uget/default.nix b/pkgs/tools/networking/uget/default.nix
index 41c39cd27c26..b35c3e8c883e 100644
--- a/pkgs/tools/networking/uget/default.nix
+++ b/pkgs/tools/networking/uget/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   name = "uget-${version}";
-  version = "2.2.1";
+  version = "2.2.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/urlget/${name}.tar.gz";
-    sha256 = "0dlrjhnm1pg2vwmp7nl2xv1aia5hyirb3021rl46x859k63zap24";
+    sha256 = "1hmzk907blgzc1z6wv4zbzqrwad06zfm1rqc3svh5garxw8z7xsw";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/hashcat/default.nix b/pkgs/tools/security/hashcat/default.nix
index 8316adb5a1e2..72a13c0f259e 100644
--- a/pkgs/tools/security/hashcat/default.nix
+++ b/pkgs/tools/security/hashcat/default.nix
@@ -1,23 +1,23 @@
 { stdenv, fetchurl, makeWrapper, opencl-headers, ocl-icd, xxHash }:
 
 stdenv.mkDerivation rec {
-  name    = "hashcat-${version}";
-  version = "5.0.0";
+  pname   = "hashcat";
+  version = "5.1.0";
 
   src = fetchurl {
     url = "https://hashcat.net/files/hashcat-${version}.tar.gz";
-    sha256 = "13xh1lmzdppvx8wr8blqhdr8vpa24j099kz2xzb9pcnqy26dk4kh";
+    sha256 = "0f73y4cg8c7a6q7x34qvpfi4g3lw6j9bnn0a13g43aqyiskflfr8";
   };
-  patches = [ ./use-installed-xxhash.patch ];
 
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ opencl-headers xxHash ];
 
   makeFlags = [
     "PREFIX=${placeholder "out"}"
-    "OPENCL_HEADERS_KHRONOS=${opencl-headers}/include"
     "COMPTIME=1337"
     "VERSION_TAG=${version}"
+    "USE_SYSTEM_OPENCL=1"
+    "USE_SYSTEM_XXHASH=1"
   ];
 
   postFixup = ''
diff --git a/pkgs/tools/security/hashcat/use-installed-xxhash.patch b/pkgs/tools/security/hashcat/use-installed-xxhash.patch
deleted file mode 100644
index d02303558ebb..000000000000
--- a/pkgs/tools/security/hashcat/use-installed-xxhash.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-diff --git a/src/Makefile b/src/Makefile
-index 3a1cd680..576353fe 100644
---- a/src/Makefile
-+++ b/src/Makefile
-@@ -189,7 +189,7 @@ endif
- # brain and xxHash
- ifeq ($(ENABLE_BRAIN),1)
- CFLAGS                  += -DWITH_BRAIN
--CFLAGS                  += -Ideps/git/xxHash
-+LFLAGS                  += -lxxhash
- endif
- 
- ##
-@@ -313,7 +313,7 @@ WIN_32_OBJS             := $(foreach OBJ,$(OBJS_ALL),obj/$(OBJ).WIN.32.o)
- WIN_64_OBJS             := $(foreach OBJ,$(OBJS_ALL),obj/$(OBJ).WIN.64.o)
- 
- ifeq ($(ENABLE_BRAIN),1)
--OBJS_XXHASH             := xxhash
-+OBJS_XXHASH             :=
- 
- NATIVE_STATIC_OBJS      += $(foreach OBJ,$(OBJS_XXHASH),obj/$(OBJ).NATIVE.STATIC.o)
- NATIVE_SHARED_OBJS      += $(foreach OBJ,$(OBJS_XXHASH),obj/$(OBJ).NATIVE.SHARED.o)
diff --git a/pkgs/tools/security/keybase/default.nix b/pkgs/tools/security/keybase/default.nix
index e07acd4566de..02a322a18021 100644
--- a/pkgs/tools/security/keybase/default.nix
+++ b/pkgs/tools/security/keybase/default.nix
@@ -5,7 +5,7 @@
 
 buildGoPackage rec {
   name = "keybase-${version}";
-  version = "3.2.2";
+  version = "4.0.0";
 
   goPackagePath = "github.com/keybase/client";
   subPackages = [ "go/keybase" ];
@@ -14,7 +14,7 @@ buildGoPackage rec {
 
   src = fetchurl {
     url = "https://github.com/keybase/client/archive/v${version}.tar.gz";
-    sha256 = "ed977c45f3a888d291aaf46afc1e1e32e4851d44b26a39854f00a0003b7556b5";
+    sha256 = "14c0876mxz3xa2k4d665kf8j6k3hc6qybkj0gr4pr9c9gs70cgjh";
   };
 
   buildInputs = lib.optionals stdenv.isDarwin [
diff --git a/pkgs/tools/security/keybase/gui.nix b/pkgs/tools/security/keybase/gui.nix
index 0ca41fb7708d..bd9c1328d31c 100644
--- a/pkgs/tools/security/keybase/gui.nix
+++ b/pkgs/tools/security/keybase/gui.nix
@@ -4,16 +4,16 @@
 , runtimeShell, gsettings-desktop-schemas }:
 
 let
-  versionSuffix = "20190412141809.5262f90fd9";
+  versionSuffix = "20190508150240.6614a49937";
 in
 
 stdenv.mkDerivation rec {
   name = "keybase-gui-${version}";
-  version = "3.2.2"; # Find latest version from https://prerelease.keybase.io/deb/dists/stable/main/binary-amd64/Packages
+  version = "4.0.0"; # Find latest version from https://prerelease.keybase.io/deb/dists/stable/main/binary-amd64/Packages
 
   src = fetchurl {
     url = "https://s3.amazonaws.com/prerelease.keybase.io/linux_binaries/deb/keybase_${version + "-" + versionSuffix}_amd64.deb";
-    sha256 = "20f0cbfae52a8afbc88c1130279b2c2ced21fd498eee7e43c88f5b88abd8f21b";
+    sha256 = "1fj92gxwfd6909r79prsq760b9s50js1iip5c01621hz9y39jd6m";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/paperkey/default.nix b/pkgs/tools/security/paperkey/default.nix
index 03af1b8a101a..d7d1f1c40d47 100644
--- a/pkgs/tools/security/paperkey/default.nix
+++ b/pkgs/tools/security/paperkey/default.nix
@@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
   version = "1.6";
 
   src = fetchurl {
-    url = "http://www.jabberwocky.com/software/paperkey/${name}.tar.gz";
+    url = "https://www.jabberwocky.com/software/paperkey/${name}.tar.gz";
     sha256 = "1xq5gni6gksjkd5avg0zpd73vsr97appksfx0gx2m38s4w9zsid2";
   };
 
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
       retention qualities - far longer than the magnetic or optical means that
       are generally used to back up computer data.
     '';
-    homepage = http://www.jabberwocky.com/software/paperkey/;
+    homepage = "https://www.jabberwocky.com/software/paperkey/";
     license = licenses.gpl2;
     platforms = platforms.unix;
     maintainers = with maintainers; [ skeidel ];
diff --git a/pkgs/tools/system/proot/default.nix b/pkgs/tools/system/proot/default.nix
index c8028ed74a7c..79b86f1383c0 100644
--- a/pkgs/tools/system/proot/default.nix
+++ b/pkgs/tools/system/proot/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "proot";
-  version = "5.1.0.20190305";
+  version = "20190510";
 
   src = fetchFromGitHub {
     repo = "proot";
     owner = "proot-me";
-    rev = "ff61c86cb26f71c06af22574d9d4cc3a77292781";
-    sha256 = "0qink34bjv0lshf3c8997w39r8yxgbhxpjbxw47l5xkvimlpc0dl";
+    rev = "803e54d8a1b3d513108d3fc413ba6f7c80220b74";
+    sha256 = "0gwzqm5wpscj3fchlv3qggf3zzn0v00s4crb5ciwljan1zrqadhy";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/system/rsyslog/default.nix b/pkgs/tools/system/rsyslog/default.nix
index 8544ee9225fc..729a90aa317e 100644
--- a/pkgs/tools/system/rsyslog/default.nix
+++ b/pkgs/tools/system/rsyslog/default.nix
@@ -11,11 +11,11 @@ let
   mkFlag = cond: name: if cond then "--enable-${name}" else "--disable-${name}";
 in
 stdenv.mkDerivation rec {
-  name = "rsyslog-8.1904.0";
+  name = "rsyslog-8.1905.0";
 
   src = fetchurl {
     url = "https://www.rsyslog.com/files/download/rsyslog/${name}.tar.gz";
-    sha256 = "0gcwzyq3i76vn49yb97gfsx18mllwxb4q4avbp1vzy63vxcv963h";
+    sha256 = "1r0nf5j4y8p1hbay3kdgkggr76qm7sw10pnl4anxd3vninmlzgcn";
   };
 
   #patches = [ ./fix-gnutls-detection.patch ];
diff --git a/pkgs/tools/text/vale/default.nix b/pkgs/tools/text/vale/default.nix
index 7c21e621ea6d..3d911271ba91 100644
--- a/pkgs/tools/text/vale/default.nix
+++ b/pkgs/tools/text/vale/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "vale-${version}";
-  version = "1.4.0";
+  version = "1.4.2";
 
   goPackagePath = "github.com/errata-ai/vale";
 
@@ -12,7 +12,7 @@ buildGoPackage rec {
     owner  = "errata-ai";
     repo   = "vale";
     rev    = "v${version}";
-    sha256 = "05vrnmw7kpgxf2989jvmkwj9c3mv3zkr4z5rpmsplnhvgsnidg4g";
+    sha256 = "180532jp6m2ryppkjszs8b8gmvx9h54c8423par3907bgdxyzqj8";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/virtualization/amazon-ecs-cli/default.nix b/pkgs/tools/virtualization/amazon-ecs-cli/default.nix
index d98064df5aae..1578a759ec7d 100644
--- a/pkgs/tools/virtualization/amazon-ecs-cli/default.nix
+++ b/pkgs/tools/virtualization/amazon-ecs-cli/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "amazon-ecs-cli-${version}";
-  version = "1.14.0";
+  version = "1.14.1";
 
   src = fetchurl {
     url = "https://s3.amazonaws.com/amazon-ecs-cli/ecs-cli-linux-amd64-v${version}";
-    sha256 = "1m0vj98sy06bx8wryy9zgsl8pm1zwmlwhi52mzd00fqdfq0haggl";
+    sha256 = "12q167pbpxw38p1bzcy9z4ix7yh9giwkyrc4vq2qln3pjn9d31rj";
   };
 
   unpackPhase = ":";
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index de397996b2aa..acd02e0d8f7b 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -49,6 +49,9 @@ mapAliases ({
   bashCompletion = bash-completion; # Added 2016-09-28
   bridge_utils = bridge-utils;  # added 2015-02-20
   btrfsProgs = btrfs-progs; # added 2016-01-03
+  bittorrentSync = throw "bittorrentSync has been deprecated by resilio-sync."; # added 2019-06-03
+  bittorrentSync14 = throw "bittorrentSync14 has been deprecated by resilio-sync."; # added 2019-06-03
+  bittorrentSync20 = throw "bittorrentSync20 has been deprecated by resilio-sync."; # added 2019-06-03
   buildPerlPackage = perlPackages.buildPerlPackage; # added 2018-10-12
   bundler_HEAD = bundler; # added 2015-11-15
   cantarell_fonts = cantarell-fonts; # added 2018-03-03
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index fa3ea4b6c217..015a49e326c5 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -770,6 +770,8 @@ in
 
   git-fire = callPackage ../tools/misc/git-fire { };
 
+  git-repo-updater = python3Packages.callPackage ../development/tools/git-repo-updater { };
+
   git-town = callPackage ../tools/misc/git-town { };
 
   github-changelog-generator = callPackage ../development/tools/github-changelog-generator { };
@@ -4212,10 +4214,12 @@ in
   };
   nodejs-12_x = callPackage ../development/web/nodejs/v12.nix {
     openssl = openssl_1_1;
+    icu = icu63;
   };
   nodejs-slim-12_x = callPackage ../development/web/nodejs/v12.nix {
     enableNpm = false;
     openssl = openssl_1_1;
+    icu = icu63;
   };
 
   # Update this when adding the newest nodejs major version!
@@ -5625,9 +5629,7 @@ in
 
   routino = callPackage ../tools/misc/routino { };
 
-  rq = callPackage ../development/tools/rq {
-    v8 = v8.override { static = true; };
-  };
+  rq = callPackage ../development/tools/rq { };
 
   rsnapshot = callPackage ../tools/backup/rsnapshot { };
 
@@ -6508,6 +6510,8 @@ in
 
   wal_e = callPackage ../tools/backup/wal-e { };
 
+  wasabiwallet = callPackage ../applications/altcoins/wasabiwallet { };
+
   watchexec = callPackage ../tools/misc/watchexec {
     inherit (darwin.apple_sdk.frameworks) CoreServices;
   };
@@ -6721,7 +6725,7 @@ in
     deps = [ python ];
     substitutions = {
       inherit waf;
-      crossFlags = lib.optionalString (stdenv.hostPlatform != stdenv.targetPlatform)
+      crossFlags = lib.optionalString (stdenv.hostPlatform.system != stdenv.targetPlatform.system)
         ''--cross-compile "--cross-execute=${stdenv.targetPlatform.emulator pkgs}"'';
     };
   } ../development/tools/build-managers/waf/setup-hook.sh;
@@ -7971,6 +7975,7 @@ in
 
   cargo-web = callPackage ../development/tools/cargo-web {
     inherit (darwin.apple_sdk.frameworks) CoreServices Security;
+    inherit (darwin) cf-private;
   };
 
   carnix = (callPackage ../build-support/rust/carnix.nix { }).carnix { };
@@ -8618,9 +8623,7 @@ in
   tcl-8_5 = callPackage ../development/interpreters/tcl/8.5.nix { };
   tcl-8_6 = callPackage ../development/interpreters/tcl/8.6.nix { };
 
-  proglodyte-wasm = callPackage ../development/interpreters/proglodyte-wasm {
-    v8_static = v8.override { static = true; };
-  };
+  proglodyte-wasm = callPackage ../development/interpreters/proglodyte-wasm { };
 
   wasm-gc = callPackage ../development/interpreters/wasm-gc { };
 
@@ -10097,6 +10100,8 @@ in
 
   cre2 = callPackage ../development/libraries/cre2 { };
 
+  croaring = callPackage ../development/libraries/croaring { };
+
   cryptopp = callPackage ../development/libraries/crypto++ { };
 
   cryptominisat = callPackage ../applications/science/logic/cryptominisat { };
@@ -10206,9 +10211,10 @@ in
 
   elastix = callPackage ../development/libraries/science/biology/elastix { };
 
-  enchant = callPackage ../development/libraries/enchant { };
+  enchant1 = callPackage ../development/libraries/enchant/1.x.nix { };
 
   enchant2 = callPackage ../development/libraries/enchant/2.x.nix { };
+  enchant = enchant2;
 
   enet = callPackage ../development/libraries/enet { };
 
@@ -10806,7 +10812,7 @@ in
 
   gtksourceviewmm4 = callPackage ../development/libraries/gtksourceviewmm/4.x.nix { };
 
-  gtkspell2 = callPackage ../development/libraries/gtkspell { };
+  gtkspell2 = callPackage ../development/libraries/gtkspell { enchant = enchant1; };
 
   gtkspell3 = callPackage ../development/libraries/gtkspell/3.nix { };
 
@@ -13291,7 +13297,7 @@ in
 
   subdl = callPackage ../applications/video/subdl { };
 
-  subtitleeditor = callPackage ../applications/video/subtitleeditor { };
+  subtitleeditor = callPackage ../applications/video/subtitleeditor { enchant = enchant1; };
 
   suil = callPackage ../development/libraries/audio/suil { };
 
@@ -13479,11 +13485,7 @@ in
     stdenv = if stdenv.isDarwin then stdenv else overrideCC stdenv gcc5;
   };
 
-  v8_6_x = callPackage ../development/libraries/v8/6_x.nix {
-    inherit (python2Packages) python;
-  };
-
-  v8 = callPackage ../development/libraries/v8 ({
+  v8_5_x = callPackage ../development/libraries/v8/5_x.nix ({
     inherit (python2Packages) python gyp;
     icu = icu58; # v8-5.4.232 fails against icu4c-59.1
   } // lib.optionalAttrs stdenv.isLinux {
@@ -13491,6 +13493,14 @@ in
     stdenv = overrideCC stdenv gcc6;
   });
 
+  v8_6_x = v8;
+  v8 = callPackage ../development/libraries/v8 {
+    inherit (python2Packages) python;
+  } // lib.optionalAttrs stdenv.isLinux {
+    # doesn't build with gcc7
+    stdenv = overrideCC stdenv gcc6;
+  };
+
   vaapiIntel = callPackage ../development/libraries/vaapi-intel { };
 
   vaapi-intel-hybrid = callPackage ../development/libraries/vaapi-intel-hybrid { };
@@ -14204,6 +14214,8 @@ in
 
   grafana = callPackage ../servers/monitoring/grafana { };
 
+  grafana-loki = callPackage ../servers/monitoring/loki { };
+
   grafana_reporter = callPackage ../servers/monitoring/grafana-reporter { };
 
   h2o = callPackage ../servers/http/h2o { };
@@ -14428,7 +14440,9 @@ in
 
   mariadb = callPackage ../servers/sql/mariadb {
     asio = asio_1_10;
-    jemalloc = jemalloc.override ({ disableInitExecTls = true; });
+    # As per mariadb's cmake, "static jemalloc_pic.a can only be used up to jemalloc 4".
+    # https://jira.mariadb.org/browse/MDEV-15034
+    jemalloc = jemalloc450.override ({ disableInitExecTls = true; });
     inherit (darwin) cctools;
     inherit (pkgs.darwin.apple_sdk.frameworks) CoreServices;
   };
@@ -14950,11 +14964,7 @@ in
 
   cifs-utils = callPackage ../os-specific/linux/cifs-utils { };
 
-  cockroachdb = callPackage ../servers/sql/cockroachdb {
-    # XXX: this is failing with Go 1.12. Error is related to cgo, an
-    # update to this package might fix it.
-    buildGoPackage = buildGo111Package;
-  };
+  cockroachdb = callPackage ../servers/sql/cockroachdb { };
 
   conky = callPackage ../os-specific/linux/conky ({
     lua = lua5_3_compat;
@@ -16406,6 +16416,8 @@ in
 
   nanum-gothic-coding = callPackage ../data/fonts/nanum-gothic-coding {  };
 
+  national-park-typeface = callPackage ../data/fonts/national-park { };
+
   nordic = callPackage ../data/themes/nordic { };
 
   nordic-polar = callPackage ../data/themes/nordic-polar { };
@@ -17442,6 +17454,7 @@ in
     inherit (darwin.apple_sdk.frameworks)
       AppKit Carbon Cocoa IOKit OSAKit Quartz QuartzCore WebKit
       ImageCaptureCore GSS ImageIO;
+    stdenv = if stdenv.cc.isClang then llvmPackages_6.stdenv else stdenv;
   };
 
   emacsPackagesFor = emacs: self: let callPackage = newScope self; in rec {
@@ -20056,10 +20069,6 @@ in
 
   resilio-sync = callPackage ../applications/networking/resilio-sync { };
 
-  bittorrentSync = bittorrentSync14;
-  bittorrentSync14 = callPackage ../applications/networking/bittorrentsync/1.4.x.nix { };
-  bittorrentSync20 = callPackage ../applications/networking/bittorrentsync/2.0.x.nix { };
-
   dropbox = callPackage ../applications/networking/dropbox { };
 
   dropbox-cli = callPackage ../applications/networking/dropbox/cli.nix { };
@@ -21008,7 +21017,9 @@ in
 
   xmind = callPackage ../applications/misc/xmind { };
 
-  xneur = callPackage ../applications/misc/xneur { };
+  xneur = callPackage ../applications/misc/xneur {
+    enchant = enchant1;
+  };
 
   gxneur = callPackage ../applications/misc/gxneur  {
     inherit (gnome2) libglade GConf;
@@ -21019,6 +21030,7 @@ in
     inherit (gnome2) libglade scrollkeeper;
     gtkhtml = gnome2.gtkhtml4;
     python = python27;
+    enchant = enchant1;
   };
 
   xournal = callPackage ../applications/graphics/xournal {
@@ -23224,6 +23236,10 @@ in
 
   hplipWithPlugin_3_16_11 = hplip_3_16_11.override { withPlugin = true; };
 
+  hplip_3_18_5 = callPackage ../misc/drivers/hplip/3.18.5.nix { };
+
+  hplipWithPlugin_3_18_5 = hplip_3_18_5.override { withPlugin = true; };
+
   hyperfine = callPackage ../tools/misc/hyperfine {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
diff --git a/pkgs/top-level/coq-packages.nix b/pkgs/top-level/coq-packages.nix
index 9a1bdb07d5b9..cc40f78875c8 100644
--- a/pkgs/top-level/coq-packages.nix
+++ b/pkgs/top-level/coq-packages.nix
@@ -36,21 +36,38 @@ let
       ltac2 = callPackage ../development/coq-modules/ltac2 {};
       math-classes = callPackage ../development/coq-modules/math-classes { };
       inherit (callPackage ../development/coq-modules/mathcomp { })
-        mathcompGen mathcompGenSingle mathcompCorePkgs_1_7 mathcompCorePkgs_1_8 mathcompCorePkgs
-        mathcomp mathcomp_1_7 mathcomp_1_8 ssreflect
-        mathcomp-ssreflect mathcomp-ssreflect_1_7 mathcomp-ssreflect_1_8
-        mathcomp-fingroup mathcomp-fingroup_1_7 mathcomp-fingroup_1_8
-        mathcomp-algebra mathcomp-algebra_1_7 mathcomp-algebra_1_8
-        mathcomp-solvable mathcomp-solvable_1_7 mathcomp-solvable_1_8
-        mathcomp-field mathcomp-field_1_7 mathcomp-field_1_8
-        mathcomp-character mathcomp-character_1_7 mathcomp-character_1_8;
+        mathcompGen mathcompGenSingle ssreflect
+
+        mathcompCorePkgs mathcomp
+        mathcomp-ssreflect mathcomp-fingroup mathcomp-algebra
+        mathcomp-solvable mathcomp-field mathcomp-character
+
+        mathcompCorePkgs_1_7 mathcomp_1_7
+        mathcomp-ssreflect_1_7 mathcomp-fingroup_1_7 mathcomp-algebra_1_7
+        mathcomp-solvable_1_7 mathcomp-field_1_7 mathcomp-character_1_7
+
+        mathcompCorePkgs_1_8 mathcomp_1_8
+        mathcomp-ssreflect_1_8 mathcomp-fingroup_1_8 mathcomp-algebra_1_8
+        mathcomp-solvable_1_8 mathcomp-field_1_8 mathcomp-character_1_8
+
+        mathcompCorePkgs_1_9 mathcomp_1_9
+        mathcomp-ssreflect_1_9 mathcomp-fingroup_1_9 mathcomp-algebra_1_9
+        mathcomp-solvable_1_9 mathcomp-field_1_9 mathcomp-character_1_9;
       inherit (callPackage ../development/coq-modules/mathcomp/extra.nix { })
-        mathcompExtraGen
-        mathcomp-finmap mathcomp-bigenough mathcomp-analysis mathcomp-multinomials
-        mathcomp_1_7-finmap mathcomp_1_7-bigenough mathcomp_1_7-analysis mathcomp_1_7-multinomials
+        mathcompExtraGen multinomials
+
+        mathcomp-finmap mathcomp-bigenough mathcomp-analysis
+        mathcomp-multinomials mathcomp-real-closed
+
+        mathcomp_1_7-finmap mathcomp_1_7-bigenough mathcomp_1_7-analysis
+        mathcomp_1_7-multinomials mathcomp_1_7-real-closed
         mathcomp_1_7-finmap_1_0
-        mathcomp_1_8-finmap mathcomp_1_8-bigenough mathcomp_1_8-analysis mathcomp_1_8-multinomials
-        multinomials;
+
+        mathcomp_1_8-finmap mathcomp_1_8-bigenough mathcomp_1_8-analysis
+        mathcomp_1_8-multinomials mathcomp_1_8-real-closed
+
+        mathcomp_1_9-finmap mathcomp_1_9-bigenough mathcomp_1_9-analysis
+        mathcomp_1_9-multinomials mathcomp_1_9-real-closed;
       metalib = callPackage ../development/coq-modules/metalib { };
       paco = callPackage ../development/coq-modules/paco {};
       paramcoq = callPackage ../development/coq-modules/paramcoq {};
diff --git a/pkgs/top-level/default.nix b/pkgs/top-level/default.nix
index b6de076a570c..904ef8d39796 100644
--- a/pkgs/top-level/default.nix
+++ b/pkgs/top-level/default.nix
@@ -57,11 +57,11 @@ in let
 
   # From a minimum of `system` or `config` (actually a target triple, *not*
   # nixpkgs configuration), infer the other one and platform as needed.
-  localSystem = lib.systems.elaborate (
+  localSystem = lib.systems.elaborate (if builtins.isAttrs args.localSystem then (
     # Allow setting the platform in the config file. This take precedence over
     # the inferred platform, but not over an explicitly passed-in one.
     builtins.intersectAttrs { platform = null; } config1
-    // args.localSystem);
+    // args.localSystem) else args.localSystem);
 
   crossSystem = if crossSystem0 == null then localSystem
                 else lib.systems.elaborate crossSystem0;
diff --git a/pkgs/top-level/impure.nix b/pkgs/top-level/impure.nix
index da288f15d2e2..3ba6c08a140b 100644
--- a/pkgs/top-level/impure.nix
+++ b/pkgs/top-level/impure.nix
@@ -85,6 +85,7 @@ import ./. (builtins.removeAttrs args [ "system" "platform" ] // {
   inherit config overlays crossSystem crossOverlays;
   # Fallback: Assume we are building packages on the current (build, in GNU
   # Autotools parlance) system.
-  localSystem = (if args ? localSystem then {}
-                 else { system = builtins.currentSystem; }) // localSystem;
+  localSystem = if builtins.isString localSystem then localSystem
+                else (if args ? localSystem then {}
+                      else { system = builtins.currentSystem; }) // localSystem;
 })
diff --git a/pkgs/top-level/php-packages.nix b/pkgs/top-level/php-packages.nix
index 127b326f0410..119b99c3a56e 100644
--- a/pkgs/top-level/php-packages.nix
+++ b/pkgs/top-level/php-packages.nix
@@ -102,7 +102,7 @@ let
   };
 
   couchbase = buildPecl rec {
-    version = "2.6.0";
+    version = "2.6.1";
     pname = "couchbase";
 
     buildInputs = [ pkgs.libcouchbase pkgs.zlib igbinary pcs ];
@@ -111,7 +111,7 @@ let
       owner = "couchbase";
       repo = "php-couchbase";
       rev = "v${version}";
-      sha256 = "0lhcvgd4a0wvxniinxajj48p5krbp44h8932021qq14rv94r4k0b";
+      sha256 = "0jdzgcvab1vpxai23brmmvizjjq2d2dik9aklz6bzspfb512qjd6";
     };
 
     configureFlags = [ "--with-couchbase" ];
@@ -143,10 +143,10 @@ let
   };
 
   event = buildPecl rec {
-    version = "2.5.0";
+    version = "2.5.1";
     pname = "event";
 
-    sha256 = "1igbxla4s784z7lw1jar6pjyfn596040a52kfmawwclqf9qcvx0v";
+    sha256 = "0hnvmlbl994fjliqc3c65gv6f6syh9zmlfcbizqs3k67bbmkhiad";
 
     configureFlags = [ "--with-event-libevent-dir=${pkgs.libevent.dev}" ];
     nativeBuildInputs = [ pkgs.pkgconfig ];
@@ -174,10 +174,10 @@ let
   };
 
   imagick = buildPecl rec {
-    version = "3.4.3";
+    version = "3.4.4";
     pname = "imagick";
 
-    sha256 = "0z2nc92xfc5axa9f2dy95rmsd2c81q8cs1pm4anh0a50x9g5ng0z";
+    sha256 = "0xvhaqny1v796ywx83w7jyjyd0nrxkxf34w9zi8qc8aw8qbammcd";
 
     configureFlags = [ "--with-imagick=${pkgs.imagemagick.dev}" ];
     nativeBuildInputs = [ pkgs.pkgconfig ];
@@ -237,12 +237,12 @@ let
   };
 
   php-cs-fixer = mkDerivation rec {
-    version = "2.14.2";
+    version = "2.15.1";
     pname = "php-cs-fixer";
 
     src = pkgs.fetchurl {
       url = "https://github.com/FriendsOfPHP/PHP-CS-Fixer/releases/download/v${version}/php-cs-fixer.phar";
-      sha256 = "1d5msgrkiim8iwkkrq3m1cnx7wfi96m1qs6rbh279kw5ysvzkaj9";
+      sha256 = "0qbqdki6vj8bgj5m2k4mi0qgj17r6s2v2q7yc30hhgvksf7vamlc";
     };
 
     phases = [ "installPhase" ];
@@ -445,10 +445,10 @@ let
   };
 
   protobuf = buildPecl rec {
-    version = "3.7.1";
+    version = "3.8.0";
     pname = "protobuf";
 
-    sha256 = "0fbf29851dpgjfdgi6i1dgy047dfiazm6qh943w22zbj35l7g2yc";
+    sha256 = "09zs7w9iv6432i0js44ihxymbd4pcxlprlzqkcjsxjpbprs4qpv2";
 
     buildInputs = with pkgs; [ (if isPhp73 then pcre2 else pcre) ];
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 46de38b0bf35..6951e72677f0 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -187,6 +187,8 @@ in {
 
   aplpy = callPackage ../development/python-modules/aplpy { };
 
+  apprise = callPackage ../development/python-modules/apprise { };
+
   argon2_cffi = callPackage ../development/python-modules/argon2_cffi { };
 
   asana = callPackage ../development/python-modules/asana { };
@@ -345,6 +347,8 @@ in {
 
   btchip = callPackage ../development/python-modules/btchip { };
 
+  datatable = callPackage ../development/python-modules/datatable { };
+
   datamodeldict = callPackage ../development/python-modules/datamodeldict { };
 
   datasette = callPackage ../development/python-modules/datasette { };
@@ -2715,6 +2719,8 @@ in {
 
   flask_sqlalchemy = callPackage ../development/python-modules/flask-sqlalchemy { };
 
+  flask-swagger = callPackage ../development/python-modules/flask-swagger { };
+
   flask_testing = callPackage ../development/python-modules/flask-testing { };
 
   flask_wtf = callPackage ../development/python-modules/flask-wtf { };
@@ -3726,6 +3732,8 @@ in {
   pg8000 = callPackage ../development/python-modules/pg8000 { };
   pg8000_1_12 = callPackage ../development/python-modules/pg8000/1_12.nix { };
 
+  pglast = callPackage ../development/python-modules/pglast { };
+
   pgsanity = callPackage ../development/python-modules/pgsanity { };
 
   pgspecial = callPackage ../development/python-modules/pgspecial { };
@@ -4306,6 +4314,8 @@ in {
 
   typeguard = callPackage ../development/python-modules/typeguard { };
 
+  typesentry = callPackage ../development/python-modules/typesentry { };
+
   s3transfer = callPackage ../development/python-modules/s3transfer { };
 
   seqdiag = callPackage ../development/python-modules/seqdiag { };
diff --git a/pkgs/top-level/static.nix b/pkgs/top-level/static.nix
index ada3c2a5034c..bee6761c285b 100644
--- a/pkgs/top-level/static.nix
+++ b/pkgs/top-level/static.nix
@@ -82,9 +82,6 @@ in {
   busybox = super.busybox.override {
     enableStatic = true;
   };
-  v8 = super.v8.override {
-    static = true;
-  };
   libiberty = super.libiberty.override {
     staticBuild = true;
   };
@@ -161,4 +158,6 @@ in {
     };
   };
 
+  python27 = super.python27.override { static = true; };
+
 }
diff --git a/pkgs/top-level/unix-tools.nix b/pkgs/top-level/unix-tools.nix
index 00edb7c09072..56bab2fe4116 100644
--- a/pkgs/top-level/unix-tools.nix
+++ b/pkgs/top-level/unix-tools.nix
@@ -16,13 +16,13 @@ let
   version = "1003.1-2008";
 
   singleBinary = cmd: providers: let
-      provider = providers.${stdenv.hostPlatform.parsed.kernel.name};
+      provider = providers.${stdenv.hostPlatform.parsed.kernel.name} or providers.linux;
       bin = "${getBin provider}/bin/${cmd}";
       manpage = "${getOutput "man" provider}/share/man/man1/${cmd}.1.gz";
     in runCommand "${cmd}-${version}" {
       meta = {
         priority = 10;
-        platforms = map (n: { kernel.name = n; }) (attrNames providers);
+        platforms = lib.platforms.${stdenv.hostPlatform.parsed.kernel.name} or lib.platforms.all;
       };
       passthru = { inherit provider; };
       preferLocalBuild = true;