15 files changed, 134 insertions, 54 deletions
diff --git a/pkgs/development/libraries/cairo/default.nix b/pkgs/development/libraries/cairo/default.nix
index 38dfceb2e004..0151bac402cd 100644
--- a/pkgs/development/libraries/cairo/default.nix
+++ b/pkgs/development/libraries/cairo/default.nix
@@ -1,7 +1,8 @@
 { config, stdenv, fetchurl, fetchpatch, pkgconfig, libiconv
-, libintl, expat, zlib, libpng, pixman, fontconfig, freetype, xorg
+, libintl, expat, zlib, libpng, pixman, fontconfig, freetype
+, x11Support? !stdenv.isDarwin, libXext, libXrender
 , gobjectSupport ? true, glib
-, xcbSupport ? true # no longer experimental since 1.12
+, xcbSupport ? x11Support, libxcb, xcbutil # no longer experimental since 1.12
 , libGLSupported
 , glSupport ? config.cairo.gl or (libGLSupported && stdenv.isLinux && !stdenv.isAarch32 && !stdenv.isMips)
 , libGL ? null # libGLU_combined is no longer a big dependency
@@ -52,8 +53,8 @@ in stdenv.mkDerivation rec {
     Carbon
   ]);
 
-  propagatedBuildInputs =
-    with xorg; [ libXext fontconfig expat freetype pixman zlib libpng libXrender ]
+  propagatedBuildInputs = [ fontconfig expat freetype pixman zlib libpng ]
+    ++ optionals x11Support [ libXext libXrender ]
     ++ optionals xcbSupport [ libxcb xcbutil ]
     ++ optional gobjectSupport glib
     ++ optional glSupport libGL
diff --git a/pkgs/development/libraries/cracklib/default.nix b/pkgs/development/libraries/cracklib/default.nix
index d335a286c87b..ea3f5e6476bc 100644
--- a/pkgs/development/libraries/cracklib/default.nix
+++ b/pkgs/development/libraries/cracklib/default.nix
@@ -1,5 +1,5 @@
 let version = "2.9.7"; in
-{ stdenv, fetchurl, zlib, gettext
+{ stdenv, lib, buildPackages, fetchurl, zlib, gettext
 , wordlists ? [ (fetchurl {
   url = "https://github.com/cracklib/cracklib/releases/download/v${version}/cracklib-words-${version}.gz";
   sha256 = "12fk8w06q628v754l357cf8kfjna98wj09qybpqr892az3x4a33z";
@@ -15,6 +15,7 @@ stdenv.mkDerivation rec {
     sha256 = "1rimpjsdnmw8f5b7k558cic41p2qy2n2yrlqp5vh7mp4162hk0py";
   };
 
+  nativeBuildInputs = lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) buildPackages.cracklib;
   buildInputs = [ zlib gettext ];
 
   postPatch = ''
@@ -25,12 +26,12 @@ stdenv.mkDerivation rec {
   '';
 
   postInstall = ''
-    make dict
+    make dict-local
   '';
   doInstallCheck = true;
   installCheckTarget = "test";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage    = https://github.com/cracklib/cracklib;
     description = "A library for checking the strength of passwords";
     license = licenses.lgpl21; # Different license for the wordlist: http://www.openwall.com/wordlists
diff --git a/pkgs/development/libraries/flatpak/default.nix b/pkgs/development/libraries/flatpak/default.nix
index a4a0bd1a263c..aff5737432f5 100644
--- a/pkgs/development/libraries/flatpak/default.nix
+++ b/pkgs/development/libraries/flatpak/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, autoreconfHook, docbook_xml_dtd_412, docbook_xml_dtd_42, docbook_xml_dtd_43, docbook_xsl, which, libxml2
 , gobject-introspection, gtk-doc, intltool, libxslt, pkgconfig, xmlto, appstream-glib, substituteAll, glibcLocales, yacc, xdg-dbus-proxy, p11-kit
 , bubblewrap, bzip2, dbus, glib, gpgme, json-glib, libarchive, libcap, libseccomp, coreutils, gettext, python2, hicolor-icon-theme
-, libsoup, lzma, ostree, polkit, python3, systemd, xorg, valgrind, glib-networking, wrapGAppsHook, gnome3 }:
+, libsoup, lzma, ostree, polkit, python3, systemd, xorg, valgrind, glib-networking, wrapGAppsHook, gnome3, gsettings-desktop-schemas }:
 
 stdenv.mkDerivation rec {
   pname = "flatpak";
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     bubblewrap bzip2 dbus gnome3.dconf glib gpgme json-glib libarchive libcap libseccomp
     libsoup lzma ostree polkit python3 systemd xorg.libXau
-    gnome3.gsettings-desktop-schemas glib-networking
+    gsettings-desktop-schemas glib-networking
   ];
 
   checkInputs = [ valgrind ];
diff --git a/pkgs/development/libraries/gmp/6.x.nix b/pkgs/development/libraries/gmp/6.x.nix
index ce78f3230882..f320c303123e 100644
--- a/pkgs/development/libraries/gmp/6.x.nix
+++ b/pkgs/development/libraries/gmp/6.x.nix
@@ -1,4 +1,5 @@
-{ stdenv, fetchurl, m4, cxx ? !stdenv.hostPlatform.useAndroidPrebuilt
+{ stdenv, fetchurl, m4
+, cxx ? !stdenv.hostPlatform.useAndroidPrebuilt && !stdenv.hostPlatform.isWasm
 , buildPackages
 , withStatic ? false }:
 
diff --git a/pkgs/development/libraries/gnu-config/default.nix b/pkgs/development/libraries/gnu-config/default.nix
index 3f0fcafa4475..7918fb7b9c4b 100644
--- a/pkgs/development/libraries/gnu-config/default.nix
+++ b/pkgs/development/libraries/gnu-config/default.nix
@@ -1,21 +1,21 @@
 { stdenv, fetchurl }:
 
 let
-  rev = "b75cdc942a6172f63b34faf642b8c797239f6776";
+  rev = "a8d79c3130da83c7cacd6fee31b9acc53799c406";
 
   # Don't use fetchgit as this is needed during Aarch64 bootstrapping
   configGuess = fetchurl {
     url = "https://git.savannah.gnu.org/cgit/config.git/plain/config.guess?id=${rev}";
-    sha256 = "1bb8z1wzjs81p9qrvji4bc2a8zyxjinz90k8xq7sxxdp6zrmq1sv";
+    sha256 = "0qbq49gr2cmf4gzrjvrmpwxxgzl3vap1xm902xa8pkcqdvriq0qw";
   };
   configSub = fetchurl {
     url = "https://git.savannah.gnu.org/cgit/config.git/plain/config.sub?id=${rev}";
-    sha256 = "00dn5i2cp4iqap5vr368r5ifrgcjfq5pr97i4dkkdbha1han5hsc";
+    sha256 = "0i699axqfkxk9mgv1hlms5r44pf0s642yz75ajjjpwzhw4d5pnv4";
   };
 in
 stdenv.mkDerivation rec {
   name = "gnu-config-${version}";
-  version = "2016-12-31";
+  version = "2019-04-15";
 
   buildCommand = ''
     mkdir -p $out
diff --git a/pkgs/development/libraries/gsettings-desktop-schemas/default.nix b/pkgs/development/libraries/gsettings-desktop-schemas/default.nix
new file mode 100644
index 000000000000..c1bdcd6956e7
--- /dev/null
+++ b/pkgs/development/libraries/gsettings-desktop-schemas/default.nix
@@ -0,0 +1,47 @@
+{ stdenv, fetchurl, pkgconfig, intltool, glib, gobject-introspection
+, meson
+, ninja
+, python3
+  # just for passthru
+, gnome3 }:
+
+stdenv.mkDerivation rec {
+  name = "gsettings-desktop-schemas-${version}";
+  version = "3.32.0";
+
+  src = fetchurl {
+    url = "mirror://gnome/sources/gsettings-desktop-schemas/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    sha256 = "0d8a6479vappgplq5crdr3ah0ykqcr3fw533wkx9v1a8lnrv8n9d";
+  };
+
+  passthru = {
+    updateScript = gnome3.updateScript { packageName = "gsettings-desktop-schemas"; };
+  };
+
+  # meson installs the schemas to share/glib-2.0/schemas
+  # We add the override file there too so it will be compiled and later moved by
+  # glib's setup hook.
+  preInstall = ''
+    mkdir -p $out/share/glib-2.0/schemas
+    cat - > $out/share/glib-2.0/schemas/remove-backgrounds.gschema.override <<- EOF
+      [org.gnome.desktop.background]
+      picture-uri='''
+
+      [org.gnome.desktop.screensaver]
+      picture-uri='''
+    EOF
+  '';
+
+  postPatch = ''
+    chmod +x build-aux/meson/post-install.py
+    patchShebangs build-aux/meson/post-install.py
+  '';
+
+  buildInputs = [ glib gobject-introspection ];
+
+  nativeBuildInputs = [ pkgconfig python3 meson ninja ];
+
+  meta = with stdenv.lib; {
+    maintainers = gnome3.maintainers;
+  };
+}
diff --git a/pkgs/development/libraries/gtk+/3.x.nix b/pkgs/development/libraries/gtk+/3.x.nix
index 27c638d8a87f..30b33c7aea97 100644
--- a/pkgs/development/libraries/gtk+/3.x.nix
+++ b/pkgs/development/libraries/gtk+/3.x.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, fetchpatch, pkgconfig, gettext, perl, makeWrapper, shared-mime-info, isocodes
 , expat, glib, cairo, pango, gdk_pixbuf, atk, at-spi2-atk, gobject-introspection, fribidi
-, xorg, epoxy, json-glib, libxkbcommon, gmp, gnome3, autoreconfHook
+, xorg, epoxy, json-glib, libxkbcommon, gmp, gnome3, autoreconfHook, gsettings-desktop-schemas
 , x11Support ? stdenv.isLinux
 , waylandSupport ? stdenv.isLinux, mesa_noglu, wayland, wayland-protocols
 , xineramaSupport ? stdenv.isLinux
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ libxkbcommon epoxy json-glib isocodes ]
     ++ optional stdenv.isDarwin AppKit;
   propagatedBuildInputs = with xorg; with stdenv.lib;
-    [ expat glib cairo pango gdk_pixbuf atk at-spi2-atk gnome3.gsettings-desktop-schemas fribidi
+    [ expat glib cairo pango gdk_pixbuf atk at-spi2-atk gsettings-desktop-schemas fribidi
       libXrandr libXrender libXcomposite libXi libXcursor libSM libICE ]
     ++ optional stdenv.isDarwin Cocoa  # explicitly propagated, always needed
     ++ optionals waylandSupport [ mesa_noglu wayland wayland-protocols ]
diff --git a/pkgs/development/libraries/http-parser/default.nix b/pkgs/development/libraries/http-parser/default.nix
index d63911ad24fc..68bf4ebec347 100644
--- a/pkgs/development/libraries/http-parser/default.nix
+++ b/pkgs/development/libraries/http-parser/default.nix
@@ -1,13 +1,15 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchFromGitHub }:
 
 let
-  version = "2.9.1";
+  version = "2.9.2";
 in stdenv.mkDerivation {
   name = "http-parser-${version}";
 
-  src = fetchurl {
-    url = "https://github.com/joyent/http-parser/archive/v${version}.tar.gz";
-    sha256 = "08fypqh3jkwvlznvmwwwir53ffg2xcxy0v8bjz6wxjlb41qhf8ik";
+  src = fetchFromGitHub {
+    owner = "nodejs";
+    repo = "http-parser";
+    rev = "v${version}";
+    sha256 = "1qs6x3n2nrcj1wiik5pg5i16inykf7rcfdfdy7rwyzf40pvdl3c2";
   };
 
   NIX_CFLAGS_COMPILE = "-Wno-error";
@@ -19,7 +21,7 @@ in stdenv.mkDerivation {
 
   meta = with stdenv.lib; {
     description = "An HTTP message parser written in C";
-    homepage = https://github.com/joyent/http-parser;
+    homepage = https://github.com/nodejs/http-parser;
     maintainers = with maintainers; [ matthewbauer ];
     license = licenses.mit;
     platforms = platforms.unix;
diff --git a/pkgs/development/libraries/libpng/default.nix b/pkgs/development/libraries/libpng/default.nix
index 765f03d9825d..849f7d29ef6d 100644
--- a/pkgs/development/libraries/libpng/default.nix
+++ b/pkgs/development/libraries/libpng/default.nix
@@ -3,31 +3,21 @@
 assert zlib != null;
 
 let
-  patchVersion = "1.6.36";
+  patchVersion = "1.6.37";
   patch_src = fetchurl {
     url = "mirror://sourceforge/libpng-apng/libpng-${patchVersion}-apng.patch.gz";
-    sha256 = "03ywdwaq1k3pfslvbs2b33z3pdmazz6yp8g56mzafacvfgd367wc";
+    sha256 = "1dh0250mw9b2hx7cdmnb2blk7ddl49n6vx8zz7jdmiwxy38v4fw2";
   };
   whenPatched = stdenv.lib.optionalString apngSupport;
 
 in stdenv.mkDerivation rec {
   name = "libpng" + whenPatched "-apng" + "-${version}";
-  version = "1.6.36";
+  version = "1.6.37";
 
   src = fetchurl {
     url = "mirror://sourceforge/libpng/libpng-${version}.tar.xz";
-    sha256 = "06d35a3xz2a0kph82r56hqm1fn8fbwrqs07xzmr93dx63x695szc";
+    sha256 = "1jl8in381z0128vgxnvn33nln6hzckl7l7j9nqvkaf1m9n1p0pjh";
   };
-  patches = [
-    (fetchurl { # https://github.com/glennrp/libpng/issues/266
-      url = "https://salsa.debian.org/debian/libpng1.6/raw/0e1348f3d/debian/patches/272.patch";
-      sha256 = "1d36khgryq2p27bdx10xrr4kcjr7cdfdj2zhdcjzznpnpns97s6n";
-    })
-    (fetchurl { # https://github.com/glennrp/libpng/issues/275
-      url = "https://salsa.debian.org/debian/libpng1.6/raw/853d1977/debian/patches/CVE-2019-7317.patch";
-      sha256 = "0c8qc176mqh08kcxlnx40rzdggchihkrlzqw6qg6lf0c9ygkf55k";
-    })
-  ];
   postPatch = whenPatched "gunzip < ${patch_src} | patch -Np1";
 
   outputs = [ "out" "dev" "man" ];
diff --git a/pkgs/development/libraries/libseccomp/default.nix b/pkgs/development/libraries/libseccomp/default.nix
index 0571cc5b3ac5..54ca09a7b0db 100644
--- a/pkgs/development/libraries/libseccomp/default.nix
+++ b/pkgs/development/libraries/libseccomp/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "libseccomp-${version}";
-  version = "2.4.0";
+  version = "2.4.1";
 
   src = fetchurl {
     url = "https://github.com/seccomp/libseccomp/releases/download/v${version}/libseccomp-${version}.tar.gz";
-    sha256 = "0paj1szszpf8plykrd66jqg1x3kmqs395rbjskahld2bnplcfx1f";
+    sha256 = "1s06h2cgk0xxwmhwj72z33bllafc1xqnxzk2yyra2rmg959778qw";
   };
 
   outputs = [ "out" "lib" "dev" "man" ];
diff --git a/pkgs/development/libraries/libuv/default.nix b/pkgs/development/libraries/libuv/default.nix
index 7b8ea82e03de..32697bdc0e01 100644
--- a/pkgs/development/libraries/libuv/default.nix
+++ b/pkgs/development/libraries/libuv/default.nix
@@ -17,11 +17,10 @@ stdenv.mkDerivation rec {
       "spawn_setuid_fails" "spawn_setgid_fails" "fs_chown" # user namespaces
       "getaddrinfo_fail" "getaddrinfo_fail_sync"
       "threadpool_multiple_event_loops" # times out on slow machines
-    ]
-      # Sometimes: timeout (no output), failed uv_listen. Someone
-      # should report these failures to libuv team. There tests should
-      # be much more robust.
-      ++ stdenv.lib.optionals stdenv.isDarwin [
+    ] ++ stdenv.lib.optionals stdenv.isDarwin [
+        # Sometimes: timeout (no output), failed uv_listen. Someone
+        # should report these failures to libuv team. There tests should
+        # be much more robust.
         "process_title" "emfile" "poll_duplex" "poll_unidirectional"
         "ipc_listen_before_write" "ipc_listen_after_write" "ipc_tcp_connection"
         "tcp_alloc_cb_fail" "tcp_ping_pong" "tcp_ref3" "tcp_ref4"
@@ -34,11 +33,16 @@ stdenv.mkDerivation rec {
         "multiple_listen" "delayed_accept"
         "shutdown_close_tcp" "shutdown_eof" "shutdown_twice" "callback_stack"
         "tty_pty" "condvar_5"
-      ] ++ stdenv.lib.optionals stdenv.isAarch32 [
-        # I observe this test failing with some regularity on ARMv7:
-        # https://github.com/libuv/libuv/issues/1871
-        "shutdown_close_pipe"
-      ];
+        # Tests that fail when sandboxing is enabled.
+        "fs_event_close_in_callback" "fs_event_watch_dir"
+        "fs_event_watch_dir_recursive" "fs_event_watch_file"
+        "fs_event_watch_file_current_dir" "fs_event_watch_file_exact_path"
+        "process_priority" "udp_create_early_bad_bind"
+    ] ++ stdenv.lib.optionals stdenv.isAarch32 [
+      # I observe this test failing with some regularity on ARMv7:
+      # https://github.com/libuv/libuv/issues/1871
+      "shutdown_close_pipe"
+    ];
     tdRegexp = lib.concatStringsSep "\\|" toDisable;
     in lib.optionalString doCheck ''
       sed '/${tdRegexp}/d' -i test/test-list.h
@@ -55,6 +59,9 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
+  # Some of the tests use localhost networking.
+  __darwinAllowLocalNetworking = true;
+
   meta = with lib; {
     description = "A multi-platform support library with a focus on asynchronous I/O";
     homepage    = https://github.com/libuv/libuv;
diff --git a/pkgs/development/libraries/nghttp2/default.nix b/pkgs/development/libraries/nghttp2/default.nix
index 277ef7923e61..2642ee5510a1 100644
--- a/pkgs/development/libraries/nghttp2/default.nix
+++ b/pkgs/development/libraries/nghttp2/default.nix
@@ -18,11 +18,11 @@ let inherit (stdenv.lib) optional; in
 
 stdenv.mkDerivation rec {
   pname = "nghttp2";
-  version = "1.37.0";
+  version = "1.38.0";
 
   src = fetchurl {
     url = "https://github.com/${pname}/${pname}/releases/download/v${version}/${pname}-${version}.tar.bz2";
-    sha256 = "1bi3aw096kd51abazvv6ilplz6gjbm84yr3mzxklbhysv38y6xl2";
+    sha256 = "156r3myrglkmrdv4zh151g9zcr7b92zjn15wx5i9ypw0naanjc4g";
   };
 
   outputs = [ "bin" "out" "dev" "lib" ];
diff --git a/pkgs/development/libraries/pango/default.nix b/pkgs/development/libraries/pango/default.nix
index ef60b331fc6c..b67db91ef642 100644
--- a/pkgs/development/libraries/pango/default.nix
+++ b/pkgs/development/libraries/pango/default.nix
@@ -1,7 +1,8 @@
-{ stdenv, fetchurl, pkgconfig, libXft, cairo, harfbuzz
+{ stdenv, fetchurl, pkgconfig, cairo, harfbuzz
 , libintl, gobject-introspection, darwin, fribidi, gnome3
 , gtk-doc, docbook_xsl, docbook_xml_dtd_43, makeFontsConf, freefont_ttf
 , meson, ninja, glib
+, x11Support? !stdenv.isDarwin, libXft
 }:
 
 with stdenv.lib;
@@ -32,7 +33,8 @@ in stdenv.mkDerivation rec {
     CoreGraphics
     CoreText
   ]);
-  propagatedBuildInputs = [ cairo glib libXft libintl ];
+  propagatedBuildInputs = [ cairo glib libintl ] ++
+    optional x11Support libXft;
 
   patches = [
     (fetchurl {
diff --git a/pkgs/development/libraries/wasilibc/default.nix b/pkgs/development/libraries/wasilibc/default.nix
new file mode 100644
index 000000000000..229d67b81edd
--- /dev/null
+++ b/pkgs/development/libraries/wasilibc/default.nix
@@ -0,0 +1,29 @@
+{ stdenv, fetchFromGitHub, lib }:
+
+stdenv.mkDerivation {
+  name = "wasilibc-20190413";
+  src = fetchFromGitHub {
+    owner = "CraneStation";
+    repo = "wasi-sysroot";
+    rev = "079d7bda78bc0ad8f69c1594444b54786545ce57";
+    sha256 = "09s906bc9485wzkgibnpfh0mii7jkldzr1a6g8k7ch0si8rshi5r";
+  };
+  makeFlags = [
+    "WASM_CC=${stdenv.cc.targetPrefix}cc"
+    "WASM_NM=${stdenv.cc.targetPrefix}nm"
+    "WASM_AR=${stdenv.cc.targetPrefix}ar"
+    "INSTALL_DIR=${placeholder "out"}"
+  ];
+
+  postInstall = ''
+    mv $out/lib/*/* $out/lib
+    ln -s $out/share/wasm32-wasi/undefined-symbols.txt $out/lib/wasi.imports
+  '';
+
+  meta = {
+    description = "WASI libc implementation for WebAssembly";
+    homepage    = "https://wasi.dev";
+    platforms   = lib.platforms.wasi;
+    maintainers = [ lib.maintainers.matthewbauer ];
+  };
+}
diff --git a/pkgs/development/libraries/xdg-desktop-portal-gtk/default.nix b/pkgs/development/libraries/xdg-desktop-portal-gtk/default.nix
index 28fa6a9ebd97..780b7d630cb7 100644
--- a/pkgs/development/libraries/xdg-desktop-portal-gtk/default.nix
+++ b/pkgs/development/libraries/xdg-desktop-portal-gtk/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, libxml2, xdg-desktop-portal, gtk3, glib, wrapGAppsHook, gnome3 }:
+{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, libxml2, xdg-desktop-portal, gtk3, glib, wrapGAppsHook, gnome3, gsettings-desktop-schemas }:
 
 stdenv.mkDerivation rec {
   pname = "xdg-desktop-portal-gtk";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig libxml2 xdg-desktop-portal wrapGAppsHook ];
-  buildInputs = [ glib gtk3 gnome3.gsettings-desktop-schemas ];
+  buildInputs = [ glib gtk3 gsettings-desktop-schemas ];
 
   meta = with stdenv.lib; {
     description = "Desktop integration portals for sandboxed apps";