about summary refs log tree commit diff
path: root/pkgs
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs')
-rw-r--r--pkgs/applications/audio/qmmp/default.nix8
-rw-r--r--pkgs/applications/audio/vcv-rack/default.nix5
-rw-r--r--pkgs/applications/graphics/openscad/default.nix25
-rw-r--r--pkgs/applications/misc/bemenu/default.nix45
-rw-r--r--pkgs/applications/misc/electrum/default.nix10
-rw-r--r--pkgs/applications/misc/k2pdfopt/default.nix23
-rw-r--r--pkgs/applications/misc/k2pdfopt/leptonica-CVE-2018-3836.patch95
-rw-r--r--pkgs/applications/misc/kitty/default.nix15
-rw-r--r--pkgs/applications/misc/octoprint/default.nix19
-rw-r--r--pkgs/applications/misc/tilix/default.nix4
-rw-r--r--pkgs/applications/misc/tzupdate/default.nix4
-rw-r--r--pkgs/applications/misc/zathura/core/default.nix10
-rw-r--r--pkgs/applications/misc/zathura/default.nix3
-rw-r--r--pkgs/applications/misc/zathura/pdf-mupdf/default.nix4
-rw-r--r--pkgs/applications/networking/p2p/qbittorrent/default.nix4
-rw-r--r--pkgs/applications/networking/p2p/tixati/default.nix4
-rw-r--r--pkgs/applications/networking/sniffers/wireshark/default.nix6
-rw-r--r--pkgs/applications/networking/syncthing/default.nix4
-rw-r--r--pkgs/applications/science/biology/eggnog-mapper/default.nix4
-rw-r--r--pkgs/applications/science/math/cbc/default.nix10
-rw-r--r--pkgs/applications/science/math/pynac/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/fast-export/default.nix51
-rw-r--r--pkgs/applications/version-management/git-and-tools/svn-all-fast-export/default.nix4
-rw-r--r--pkgs/applications/version-management/src/default.nix14
-rw-r--r--pkgs/applications/video/mkclean/default.nix37
-rw-r--r--pkgs/applications/window-managers/i3/wk-switch.nix15
-rw-r--r--pkgs/build-support/docker/default.nix21
-rw-r--r--pkgs/build-support/docker/examples.nix39
-rw-r--r--pkgs/data/fonts/unifont/default.nix8
-rw-r--r--pkgs/data/fonts/unifont_upper/default.nix4
-rw-r--r--pkgs/desktops/gnome-3/core/evolution-data-server/default.nix4
-rw-r--r--pkgs/development/compilers/ghc/8.6.4.nix5
-rw-r--r--pkgs/development/compilers/ghc/8.6.5.nix5
-rw-r--r--pkgs/development/compilers/ghc/8.8.1.nix5
-rw-r--r--pkgs/development/compilers/ghc/head.nix5
-rw-r--r--pkgs/development/compilers/llvm/7/lldb.nix6
-rw-r--r--pkgs/development/haskell-modules/configuration-ghc-8.8.x.nix42
-rw-r--r--pkgs/development/haskell-modules/configuration-hackage2nix.yaml17
-rw-r--r--pkgs/development/haskell-modules/configuration-nix.nix20
-rw-r--r--pkgs/development/haskell-modules/hackage-packages.nix115
-rw-r--r--pkgs/development/libraries/alkimia/default.nix11
-rw-r--r--pkgs/development/libraries/ctl/default.nix35
-rw-r--r--pkgs/development/libraries/ctl/source.nix11
-rw-r--r--pkgs/development/libraries/gtksourceview/3.x.nix4
-rw-r--r--pkgs/development/libraries/java/lombok/default.nix4
-rw-r--r--pkgs/development/libraries/libgda/default.nix4
-rw-r--r--pkgs/development/libraries/linbox/default.nix5
-rw-r--r--pkgs/development/libraries/portaudio/default.nix2
-rw-r--r--pkgs/development/libraries/range-v3/default.nix4
-rw-r--r--pkgs/development/python-modules/av/default.nix7
-rw-r--r--pkgs/development/python-modules/holoviews/default.nix4
-rw-r--r--pkgs/development/python-modules/py-radix/default.nix28
-rw-r--r--pkgs/development/python-modules/qdarkstyle/default.nix4
-rw-r--r--pkgs/development/python-modules/qtpy/default.nix4
-rw-r--r--pkgs/development/python-modules/shodan/default.nix4
-rw-r--r--pkgs/development/python-modules/typed-ast/default.nix4
-rw-r--r--pkgs/development/tools/analysis/radare2/default.nix12
-rw-r--r--pkgs/development/tools/build-managers/bazel/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/buck/default.nix4
-rw-r--r--pkgs/development/tools/react-native-debugger/default.nix4
-rw-r--r--pkgs/development/tools/scalafmt/default.nix7
-rw-r--r--pkgs/development/tools/wabt/default.nix4
-rw-r--r--pkgs/games/azimuth/default.nix64
-rw-r--r--pkgs/misc/screensavers/xautolock/default.nix4
-rw-r--r--pkgs/misc/vscode-extensions/cpptools/default.nix4
-rw-r--r--pkgs/misc/vscode-extensions/wakatime/default.nix4
-rw-r--r--pkgs/os-specific/linux/bpftool/default.nix26
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix6
-rw-r--r--pkgs/os-specific/linux/zfs/default.nix4
-rw-r--r--pkgs/servers/http/nginx/modules.nix113
-rw-r--r--pkgs/servers/search/elasticsearch/5.x.nix5
-rw-r--r--pkgs/servers/search/elasticsearch/6.x.nix4
-rw-r--r--pkgs/servers/search/elasticsearch/7.x.nix4
-rw-r--r--pkgs/tools/misc/coreutils/coreutils-8.31-musl-cross.patch1153
-rw-r--r--pkgs/tools/misc/coreutils/default.nix14
-rw-r--r--pkgs/tools/misc/qt5ct/default.nix4
-rw-r--r--pkgs/tools/misc/shell-hist/default.nix23
-rw-r--r--pkgs/tools/misc/tlp/default.nix4
-rw-r--r--pkgs/tools/misc/ttyplot/default.nix4
-rw-r--r--pkgs/tools/misc/uutils-coreutils/default.nix8
-rw-r--r--pkgs/tools/misc/youtube-dl/default.nix4
-rw-r--r--pkgs/tools/networking/tgt/default.nix4
-rw-r--r--pkgs/tools/security/tboot/default.nix4
-rw-r--r--pkgs/tools/security/vault/default.nix4
-rw-r--r--pkgs/tools/security/yara/default.nix4
-rw-r--r--pkgs/tools/system/stress-ng/default.nix50
-rw-r--r--pkgs/top-level/all-packages.nix34
-rw-r--r--pkgs/top-level/python-packages.nix2
-rw-r--r--pkgs/top-level/release-cross.nix2
89 files changed, 2161 insertions, 288 deletions
diff --git a/pkgs/applications/audio/qmmp/default.nix b/pkgs/applications/audio/qmmp/default.nix
index eab498b96249..490f8639d389 100644
--- a/pkgs/applications/audio/qmmp/default.nix
+++ b/pkgs/applications/audio/qmmp/default.nix
@@ -29,17 +29,17 @@
 # handle that.
 
 stdenv.mkDerivation rec {
-  name = "qmmp-1.3.1";
+  name = "qmmp-1.3.2";
 
   src = fetchurl {
     url = "http://qmmp.ylsoftware.com/files/${name}.tar.bz2";
-    sha256 = "1dmybzibpr6hpr2iv1wvrjgww842mng2x0rh1mr8gs8j191xvlhw";
+    sha256 = "1rh063kcyg7gs9yj2r4v5irpnq4pjaxaxsgrw30mdr21xhhc15cz";
   };
 
+  nativeBuildInputs = [ cmake pkgconfig ];
   buildInputs =
     [ # basic requirements
-      cmake pkgconfig xlibsWrapper
-      qtbase qttools qtmultimedia qtx11extras
+      qtbase qttools qtmultimedia qtx11extras xlibsWrapper
       # transports
       curl libmms
       # input plugins
diff --git a/pkgs/applications/audio/vcv-rack/default.nix b/pkgs/applications/audio/vcv-rack/default.nix
index 27533084804a..15935751c32a 100644
--- a/pkgs/applications/audio/vcv-rack/default.nix
+++ b/pkgs/applications/audio/vcv-rack/default.nix
@@ -72,8 +72,9 @@ with stdenv.lib; stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     description = "Open-source virtual modular synthesizer";
     homepage = http://vcvrack.com/;
-    # The source is BSD-3 licensed, some of the art is CC-BY-NC 4.0 or unfree
-    license = [ licenses.bsd3 licenses.cc-by-nc-40 licenses.unfree ];
+    # The source is BSD-3 licensed, some of the art is CC-BY-NC 4.0 or under a
+    # no-derivatives clause
+    license = with licenses; [ bsd3 cc-by-nc-40 unfreeRedistributable ];
     maintainers = with maintainers; [ moredread ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/applications/graphics/openscad/default.nix b/pkgs/applications/graphics/openscad/default.nix
index bce2e8826983..5922206a8b9e 100644
--- a/pkgs/applications/graphics/openscad/default.nix
+++ b/pkgs/applications/graphics/openscad/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, qt5, libsForQt5
 , bison, flex, eigen, boost, libGLU_combined, glew, opencsg, cgal
-, mpfr, gmp, glib, pkgconfig, harfbuzz, gettext
+, mpfr, gmp, glib, pkgconfig, harfbuzz, gettext, freetype, fontconfig
 }:
 
 stdenv.mkDerivation rec {
@@ -18,11 +18,13 @@ stdenv.mkDerivation rec {
     sha256 = "1y63yqyd0v255liik4ff5ak6mj86d8d76w436x76hs5dk6jgpmfb";
   };
 
+  nativeBuildInputs = [ bison flex pkgconfig ];
+
   buildInputs = [
-    bison flex eigen boost libGLU_combined glew opencsg cgal mpfr gmp glib
-    pkgconfig harfbuzz gettext
-  ]
-    ++ (with qt5; [qtbase qmake])
+    eigen boost glew opencsg cgal mpfr gmp glib
+    harfbuzz gettext freetype fontconfig
+  ] ++ stdenv.lib.optional stdenv.isLinux libGLU_combined
+    ++ (with qt5; [qtbase qmake] ++ stdenv.lib.optional stdenv.isDarwin qtmacextras)
     ++ (with libsForQt5; [qscintilla])
   ;
 
@@ -33,6 +35,17 @@ stdenv.mkDerivation rec {
 
   doCheck = false;
 
+  postInstall = stdenv.lib.optionalString stdenv.isDarwin ''
+    mkdir $out/Applications
+    mv $out/bin/*.app $out/Applications
+    rmdir $out/bin || true
+
+    mv --target-directory=$out/Applications/OpenSCAD.app/Contents/Resources \
+      $out/share/openscad/{examples,color-schemes,locale,libraries,fonts}
+
+    rmdir $out/share/openscad
+  '';
+
   meta = {
     description = "3D parametric model compiler";
     longDescription = ''
@@ -48,7 +61,7 @@ stdenv.mkDerivation rec {
     '';
     homepage = http://openscad.org/;
     license = stdenv.lib.licenses.gpl2;
-    platforms = stdenv.lib.platforms.linux;
+    platforms = stdenv.lib.platforms.unix;
     maintainers = with stdenv.lib.maintainers;
       [ bjornfor raskin the-kenny ];
   };
diff --git a/pkgs/applications/misc/bemenu/default.nix b/pkgs/applications/misc/bemenu/default.nix
new file mode 100644
index 000000000000..89c32668be9c
--- /dev/null
+++ b/pkgs/applications/misc/bemenu/default.nix
@@ -0,0 +1,45 @@
+{ stdenv, fetchFromGitHub, cairo, cmake, libxkbcommon
+, pango, fribidi, harfbuzz, pcre, pkgconfig
+, ncursesSupport ? true, ncurses ? null
+, waylandSupport ? true, wayland ? null
+, x11Support ? true, xlibs ? null, xorg ? null
+}:
+
+assert ncursesSupport -> ncurses != null;
+assert waylandSupport -> wayland != null;
+assert x11Support -> xlibs != null && xorg != null;
+
+stdenv.mkDerivation rec {
+  pname = "bemenu";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "Cloudef";
+    repo = "bemenu";
+    rev = "33e540a2b04ce78f5c7ab4a60b899c67f586cc32";
+    sha256 = "11h55m9dx6ai12pqij52ydjm36dvrcc856pa834njihrp626pl4w";
+  };
+
+  nativeBuildInputs = [ cmake pkgconfig pcre ];
+
+  buildInputs = with stdenv.lib; [
+    cairo
+    fribidi
+    harfbuzz
+    libxkbcommon
+    pango
+  ] ++ optionals ncursesSupport [ ncurses ]
+    ++ optionals waylandSupport [ wayland ]
+    ++ optionals x11Support [
+      xlibs.libX11 xlibs.libXinerama xlibs.libXft
+      xorg.libXdmcp xorg.libpthreadstubs xorg.libxcb
+    ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/Cloudef/bemenu";
+    description = "Dynamic menu library and client program inspired by dmenu";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ thiagokokada ];
+    platforms = with platforms; linux;
+  };
+}
diff --git a/pkgs/applications/misc/electrum/default.nix b/pkgs/applications/misc/electrum/default.nix
index 6185b7d228f8..9cabd6dda7c6 100644
--- a/pkgs/applications/misc/electrum/default.nix
+++ b/pkgs/applications/misc/electrum/default.nix
@@ -3,16 +3,6 @@
 let
   version = "3.3.5";
 
-  qdarkstyle = python3Packages.buildPythonPackage rec {
-    pname = "QDarkStyle";
-    version = "2.5.4";
-    src = python3Packages.fetchPypi {
-      inherit pname version;
-      sha256 = "1w715m1i5pycfqcpkrggpn0rs9cakx6cm5v8rggcxnf4p0i0kdiy";
-    };
-    doCheck = false; # no tests
-  };
-
   # Not provided in official source releases, which are what upstream signs.
   tests = fetchFromGitHub {
     owner = "spesmilo";
diff --git a/pkgs/applications/misc/k2pdfopt/default.nix b/pkgs/applications/misc/k2pdfopt/default.nix
index 0049e9aca755..bf29e05db1b8 100644
--- a/pkgs/applications/misc/k2pdfopt/default.nix
+++ b/pkgs/applications/misc/k2pdfopt/default.nix
@@ -57,7 +57,28 @@ stdenv.mkDerivation rec {
       prePatch = ''
         cp ${src}/leptonica_mod/{allheaders.h,dewarp2.c,leptwin.c} src/
       '';
-      patches = [];
+      patches = [
+        # stripped down copy of upstream commit b88c821f8d347bce0aea86d606c710303919f3d2
+        ./leptonica-CVE-2018-3836.patch
+        (fetchpatch {
+          # CVE-2018-7186
+          url = "https://github.com/DanBloomberg/leptonica/commit/"
+              + "ee301cb2029db8a6289c5295daa42bba7715e99a.patch";
+          sha256 = "0cgb7mvz2px1rg5i80wk1wxxjvzjga617d8q6j7qygkp7jm6495d";
+        })
+        (fetchpatch {
+          # CVE-2018-7247
+          url = "https://github.com/DanBloomberg/leptonica/commit/"
+              + "c1079bb8e77cdd426759e466729917ca37a3ed9f.patch";
+          sha256 = "1z4iac5gwqggh7aa8cvyp6nl9fwd1v7wif26caxc9y5qr3jj34qf";
+        })
+        (fetchpatch {
+          # CVE-2018-7440
+          url = "https://github.com/DanBloomberg/leptonica/commit/"
+              + "49ecb6c2dfd6ed5078c62f4a8eeff03e3beced3b.patch";
+          sha256 = "1hjmva98iaw9xj7prg7aimykyayikcwnk4hk0380007hqb35lqmy";
+        })
+      ];
     });
     tesseract_modded = tesseract4.override {
       tesseractBase = tesseract4.tesseractBase.overrideAttrs (_: {
diff --git a/pkgs/applications/misc/k2pdfopt/leptonica-CVE-2018-3836.patch b/pkgs/applications/misc/k2pdfopt/leptonica-CVE-2018-3836.patch
new file mode 100644
index 000000000000..f1b4170fbaae
--- /dev/null
+++ b/pkgs/applications/misc/k2pdfopt/leptonica-CVE-2018-3836.patch
@@ -0,0 +1,95 @@
+--- a/src/allheaders.h
++++ b/src/allheaders.h
+@@ -2600,6 +2600,7 @@
+ LEPT_DLL extern char * stringReverse ( const char *src );
+ LEPT_DLL extern char * strtokSafe ( char *cstr, const char *seps, char **psaveptr );
+ LEPT_DLL extern l_int32 stringSplitOnToken ( char *cstr, const char *seps, char **phead, char **ptail );
++LEPT_DLL extern l_int32 stringCheckForChars ( const char *src, const char *chars, l_int32 *pfound );
+ LEPT_DLL extern char * stringRemoveChars ( const char *src, const char *remchars );
+ LEPT_DLL extern l_int32 stringFindSubstr ( const char *src, const char *sub, l_int32 *ploc );
+ LEPT_DLL extern char * stringReplaceSubstr ( const char *src, const char *sub1, const char *sub2, l_int32 *pfound, l_int32 *ploc );
+--- a/src/gplot.c
++++ b/src/gplot.c
+@@ -141,9 +141,10 @@
+             const char  *xlabel,
+             const char  *ylabel)
+ {
+-char   *newroot;
+-char    buf[L_BUF_SIZE];
+-GPLOT  *gplot;
++char    *newroot;
++char     buf[L_BUF_SIZE];
++l_int32  badchar;
++GPLOT   *gplot;
+ 
+     PROCNAME("gplotCreate");
+ 
+@@ -152,6 +153,9 @@
+     if (outformat != GPLOT_PNG && outformat != GPLOT_PS &&
+         outformat != GPLOT_EPS && outformat != GPLOT_LATEX)
+         return (GPLOT *)ERROR_PTR("outformat invalid", procName, NULL);
++    stringCheckForChars(rootname, "`;&|><\"?*", &badchar);
++    if (badchar)  /* danger of command injection */
++        return (GPLOT *)ERROR_PTR("invalid rootname", procName, NULL);
+ 
+     if ((gplot = (GPLOT *)LEPT_CALLOC(1, sizeof(GPLOT))) == NULL)
+         return (GPLOT *)ERROR_PTR("gplot not made", procName, NULL);
+--- a/src/utils2.c
++++ b/src/utils2.c
+@@ -42,6 +42,7 @@
+  *           l_int32    stringSplitOnToken()
+  *
+  *       Find and replace string and array procs
++ *           l_int32    stringCheckForChars()
+  *           char      *stringRemoveChars()
+  *           l_int32    stringFindSubstr()
+  *           char      *stringReplaceSubstr()
+@@ -701,6 +702,48 @@
+ /*--------------------------------------------------------------------*
+  *                       Find and replace procs                       *
+  *--------------------------------------------------------------------*/
++/*!
++ * \brief   stringCheckForChars()
++ *
++ * \param[in]    src      input string; can be of zero length
++ * \param[in]    chars    string of chars to be searched for in %src
++ * \param[out]   pfound   1 if any characters are found; 0 otherwise
++ * \return  0 if OK, 1 on error
++ *
++ * <pre>
++ * Notes:
++ *      (1) This can be used to sanitize an operation by checking for
++ *          special characters that don't belong in a string.
++ * </pre>
++ */
++l_int32
++stringCheckForChars(const char  *src,
++                    const char  *chars,
++                    l_int32     *pfound)
++{
++char     ch;
++l_int32  i, n;
++
++    PROCNAME("stringCheckForChars");
++
++    if (!pfound)
++        return ERROR_INT("&found not defined", procName, 1);
++    *pfound = FALSE;
++    if (!src || !chars)
++        return ERROR_INT("src and chars not both defined", procName, 1);
++
++    n = strlen(src);
++    for (i = 0; i < n; i++) {
++        ch = src[i];
++        if (strchr(chars, ch)) {
++            *pfound = TRUE;
++            break;
++        }
++    }
++    return 0;
++}
++
++
+ /*!
+  * \brief   stringRemoveChars()
+  *
diff --git a/pkgs/applications/misc/kitty/default.nix b/pkgs/applications/misc/kitty/default.nix
index 3edb48cc489b..be70efba5ad7 100644
--- a/pkgs/applications/misc/kitty/default.nix
+++ b/pkgs/applications/misc/kitty/default.nix
@@ -2,7 +2,7 @@
   harfbuzz, fontconfig, pkgconfig, ncurses, imagemagick, xsel,
   libstartup_notification, libX11, libXrandr, libXinerama, libXcursor,
   libxkbcommon, libXi, libXext, wayland-protocols, wayland,
-  which, dbus,
+  which, dbus, fetchpatch,
   Cocoa,
   CoreGraphics,
   Foundation,
@@ -67,6 +67,17 @@ buildPythonApplication rec {
       libstartup_notification = "${libstartup_notification}/lib/libstartup-notification-1.so";
     })
   ] ++ stdenv.lib.optionals stdenv.isDarwin [
+    (fetchpatch {
+      name = "macos-symlink-1";
+      url = https://github.com/kovidgoyal/kitty/commit/bdeec612667f6976109247fe1750b10dda9c24c0.patch;
+      sha256 = "1d18x260w059qag80kgb2cgi2h4rricvqhwpbrw79s8yxzs7jhxk";
+    })
+    (fetchpatch {
+      # fixup of previous patch
+      name = "macos-symlink-2";
+      url = https://github.com/kovidgoyal/kitty/commit/af2c9a49b1ad31e94242295d88598591623fbf11.patch;
+      sha256 = "0k3dmgbvmh66j8k3h8dw6la6ma6f20fng6jjypy982kxvracsnl5";
+    })
     ./macos-10.11.patch
     ./no-lto.patch
     ./no-werror.patch
@@ -84,7 +95,7 @@ buildPythonApplication rec {
     mkdir -p $out
     ${if stdenv.isDarwin then ''
     mkdir "$out/bin"
-    ln -s ../Applications/kitty.app/Contents/MacOS/kitty "$out/bin/kitty"
+    ln -s ../Applications/kitty.app/Contents/MacOS/kitty-deref-symlink "$out/bin/kitty"
     mkdir "$out/Applications"
     cp -r kitty.app "$out/Applications/kitty.app"
     '' else ''
diff --git a/pkgs/applications/misc/octoprint/default.nix b/pkgs/applications/misc/octoprint/default.nix
index 76a0a5748081..b8ed4c5ddbee 100644
--- a/pkgs/applications/misc/octoprint/default.nix
+++ b/pkgs/applications/misc/octoprint/default.nix
@@ -15,13 +15,26 @@ let
     packageOverrides = lib.foldr lib.composeExtensions (self: super: { }) ([
       (mkOverride "flask"       "0.10.1" "0wrkavjdjndknhp8ya8j850jq7a1cli4g5a93mg8nh1xz2gq50sc")
       (mkOverride "flask_login" "0.2.11" "1rg3rsjs1gwi2pw6vr9jmhaqm9b3vc9c4hfcsvp4y8agbh7g3mc3")
-      (mkOverride "jinja2"      "2.8.1"  "14aqmhkc9rw5w0v311jhixdm6ym8vsm29dhyxyrjfqxljwx1yd1m")
       (mkOverride "pylru"       "1.0.9"  "0b0pq0l7xv83dfsajsc49jcxzc99kb9jfx1a1dlx22hzcy962dvi")
       (mkOverride "sarge"       "0.1.4"  "08s8896973bz1gg0pkr592w6g4p6v47bkfvws5i91p9xf8b35yar")
       (mkOverride "tornado"     "4.5.3"  "02jzd23l4r6fswmwxaica9ldlyc2p6q8dk6dyff7j58fmdzf853d")
 
       # https://github.com/NixOS/nixpkgs/pull/58179#issuecomment-478605134
       (mkOverride "werkzeug"    "0.14.1" "c3fd7a7d41976d9f44db327260e263132466836cef6f91512889ed60ad26557c")
+
+      # Octoprint holds back jinja2 to 2.8.1 due to breaking changes.
+      # This old version does not have updated test config for pytest 4,
+      # and pypi tarball doesn't contain tests dir anyways.
+      (pself: psuper: {
+        jinja2 = psuper.jinja2.overridePythonAttrs (oldAttrs: rec {
+          version = "2.8.1";
+          src = oldAttrs.src.override {
+            inherit version;
+            sha256 = "14aqmhkc9rw5w0v311jhixdm6ym8vsm29dhyxyrjfqxljwx1yd1m";
+          };
+          doCheck = false;
+        });
+      })
     ]);
   };
 
@@ -69,7 +82,7 @@ in py.pkgs.buildPythonApplication rec {
     pylru pyyaml sarge feedparser netifaces click websocket_client
     scandir chainmap future dateutil futures wrapt monotonic emoji
     frozendict
-  ];
+  ] ++ lib.optionals stdenv.isDarwin [ py.pkgs.appdirs ];
 
   checkInputs = with py.pkgs; [ nose mock ddt ];
 
@@ -82,7 +95,7 @@ in py.pkgs.buildPythonApplication rec {
   '';
 
   checkPhase = ''
-    HOME=$(mktemp -d) nosetests
+    HOME=$(mktemp -d) nosetests ${lib.optionalString stdenv.isDarwin "--exclude=test_set_external_modification"}
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/misc/tilix/default.nix b/pkgs/applications/misc/tilix/default.nix
index ed9ae5ade9ff..342eca0a6fdc 100644
--- a/pkgs/applications/misc/tilix/default.nix
+++ b/pkgs/applications/misc/tilix/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tilix";
-  version = "1.9.0";
+  version = "1.9.3";
 
   src = fetchFromGitHub {
     owner = "gnunn1";
     repo = "tilix";
     rev = version;
-    sha256 = "1k8hqpq6bzmn06b4s8c257n37ghgp3fl7l9g6fy0giwk1x0ix735";
+    sha256 = "0mg9y4xd2pnv0smibg7dyy733jarvx6qpdqap3sj7fpyni0jvpph";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/tzupdate/default.nix b/pkgs/applications/misc/tzupdate/default.nix
index a5d2f206f3a5..c887876634f5 100644
--- a/pkgs/applications/misc/tzupdate/default.nix
+++ b/pkgs/applications/misc/tzupdate/default.nix
@@ -5,11 +5,11 @@ let
 in
 buildPythonApplication rec {
   pname = "tzupdate";
-  version = "1.3.1";
+  version = "1.4.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "085kp4v9ijhkfvr0r5rzn4z7nrkb2qig05j0bajb0gkgynwf8wnz";
+    sha256 = "1sc3z2bx2nhnxg82x0jy19pr8lw56chbr90c2lr11w495csqwhz7";
   };
 
   propagatedBuildInputs = [ requests ];
diff --git a/pkgs/applications/misc/zathura/core/default.nix b/pkgs/applications/misc/zathura/core/default.nix
index f3258c0c7116..6378cf1c0681 100644
--- a/pkgs/applications/misc/zathura/core/default.nix
+++ b/pkgs/applications/misc/zathura/core/default.nix
@@ -32,15 +32,15 @@ stdenv.mkDerivation rec {
   ] ++ optional synctexSupport "-Dsynctex=enabled";
 
   nativeBuildInputs = [
-    meson ninja pkgconfig appstream-glib desktop-file-utils python3.pkgs.sphinx
+    meson ninja pkgconfig desktop-file-utils python3.pkgs.sphinx
     gettext makeWrapper libxml2
-  ];
+  ] ++ optional stdenv.isLinux appstream-glib;
 
   buildInputs = [
-    gtk girara libintl libseccomp
-    sqlite glib file librsvg
+    gtk girara libintl sqlite glib file librsvg
   ] ++ optional synctexSupport texlive.bin.core
-    ++ optional stdenv.isDarwin [ gtk-mac-integration ];
+    ++ optional stdenv.isLinux libseccomp
+    ++ optional stdenv.isDarwin gtk-mac-integration;
 
   meta = {
     homepage = https://pwmt.org/projects/zathura/;
diff --git a/pkgs/applications/misc/zathura/default.nix b/pkgs/applications/misc/zathura/default.nix
index dfddfe7d91e1..e3db15ca78d4 100644
--- a/pkgs/applications/misc/zathura/default.nix
+++ b/pkgs/applications/misc/zathura/default.nix
@@ -1,5 +1,6 @@
 { config, pkgs
-, useMupdf ? config.zathura.useMupdf or true
+# zathura_pdf_mupdf fails to load _opj_create_decompress at runtime on Darwin (https://github.com/NixOS/nixpkgs/pull/61295#issue-277982980)
+, useMupdf ? config.zathura.useMupdf or (!pkgs.stdenv.isDarwin)
 , synctexSupport ? true }:
 
 let
diff --git a/pkgs/applications/misc/zathura/pdf-mupdf/default.nix b/pkgs/applications/misc/zathura/pdf-mupdf/default.nix
index 709c1edb0b83..e2c08a00da20 100644
--- a/pkgs/applications/misc/zathura/pdf-mupdf/default.nix
+++ b/pkgs/applications/misc/zathura/pdf-mupdf/default.nix
@@ -21,9 +21,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     zathura_core girara mupdf cairo
-  ] ++ stdenv.lib.optional stdenv.isDarwin [
-    gtk-mac-integration
-  ];
+  ] ++ lib.optional stdenv.isDarwin gtk-mac-integration;
 
   PKG_CONFIG_ZATHURA_PLUGINDIR= "lib/zathura";
 
diff --git a/pkgs/applications/networking/p2p/qbittorrent/default.nix b/pkgs/applications/networking/p2p/qbittorrent/default.nix
index 81c493fedcf1..9696c55bd865 100644
--- a/pkgs/applications/networking/p2p/qbittorrent/default.nix
+++ b/pkgs/applications/networking/p2p/qbittorrent/default.nix
@@ -10,13 +10,13 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "qbittorrent-${version}";
-  version = "4.1.5";
+  version = "4.1.6";
 
   src = fetchFromGitHub {
     owner = "qbittorrent";
     repo = "qbittorrent";
     rev = "release-${version}";
-    sha256 = "09zcygaxfv9g6av0vsvlyzv4v65wvj766xyfx31yz5ig3xan6ak1";
+    sha256 = "1y9kv84sy5fg64wbl4xpm8qh0hjba7ibk045cazp0m736rjmxk8c";
   };
 
   # NOTE: 2018-05-31: CMake is working but it is not officially supported
diff --git a/pkgs/applications/networking/p2p/tixati/default.nix b/pkgs/applications/networking/p2p/tixati/default.nix
index d58c4214d0e0..7a5f389af248 100644
--- a/pkgs/applications/networking/p2p/tixati/default.nix
+++ b/pkgs/applications/networking/p2p/tixati/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "tixati-${version}";
-  version = "2.59";
+  version = "2.61";
 
   src = fetchurl {
     url = "https://download2.tixati.com/download/tixati-${version}-1.x86_64.manualinstall.tar.gz";
-    sha256 = "0vf5y9kj2g7psgdzv2r46jdh5krdps838ca4wwwxi0dd1mwa65my";
+    sha256 = "05f8lcsac2mr90bhk999qkj8wwd6igdl07389bqrd1ydjasacl2k";
   };
 
   installPhase = ''
diff --git a/pkgs/applications/networking/sniffers/wireshark/default.nix b/pkgs/applications/networking/sniffers/wireshark/default.nix
index 46869ecb24f2..b9d973287d29 100644
--- a/pkgs/applications/networking/sniffers/wireshark/default.nix
+++ b/pkgs/applications/networking/sniffers/wireshark/default.nix
@@ -14,7 +14,8 @@ let
   variant = if withQt then "qt" else "cli";
 
 in stdenv.mkDerivation {
-  name = "wireshark-${variant}-${version}";
+  pname = "wireshark-${variant}";
+  inherit version;
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
@@ -24,7 +25,6 @@ in stdenv.mkDerivation {
 
   cmakeFlags = [
     "-DBUILD_wireshark=${if withQt then "ON" else "OFF"}"
-    "-DENABLE_QT5=${if withQt then "ON" else "OFF"}"
     "-DENABLE_APPLICATION_BUNDLE=${if withQt && stdenv.isDarwin then "ON" else "OFF"}"
   ];
 
@@ -95,6 +95,8 @@ in stdenv.mkDerivation {
 
   enableParallelBuilding = true;
 
+  dontFixCmake = true;
+
   shellHook = ''
     # to be able to run the resulting binary
     export WIRESHARK_RUN_FROM_BUILD_DIRECTORY=1
diff --git a/pkgs/applications/networking/syncthing/default.nix b/pkgs/applications/networking/syncthing/default.nix
index 7cdc73419538..ccb346868a1f 100644
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@@ -3,14 +3,14 @@
 let
   common = { stname, target, postInstall ? "" }:
     buildGoPackage rec {
-      version = "1.1.1";
+      version = "1.1.3";
       name = "${stname}-${version}";
 
       src = fetchFromGitHub {
         owner  = "syncthing";
         repo   = "syncthing";
         rev    = "v${version}";
-        sha256 = "1nkc4ivc8mg9c1njqlkhb9i5f4c1via1rdqfbhwgkj86s6cnxrg7";
+        sha256 = "00jshqa0nkwj06bfq16p359ss6nl6h49s31hag79wl9gwkca38va";
       };
 
       goPackagePath = "github.com/syncthing/syncthing";
diff --git a/pkgs/applications/science/biology/eggnog-mapper/default.nix b/pkgs/applications/science/biology/eggnog-mapper/default.nix
index a15425ec2137..c9a9b55c31e6 100644
--- a/pkgs/applications/science/biology/eggnog-mapper/default.nix
+++ b/pkgs/applications/science/biology/eggnog-mapper/default.nix
@@ -12,8 +12,8 @@ python27Packages.buildPythonApplication rec {
   };
 
   patches = (fetchpatch {
-    url = https://github.com/eggnogdb/eggnog-mapper/pull/125/commits/b7828e4c8c1c453e391aef050f06ff3f84ff9faf.patch;
-    sha256 = "0nz1a7ybm4j5c7vdm3annnxz9036iam2044hia341a0am9wydmzk";
+    url = "https://github.com/eggnogdb/eggnog-mapper/commit/6972f601ade85b65090efca747d2302acb58507f.patch";
+    sha256 = "0abnmn0bh11jihf5d3cggiild1ykawzv5f5fhb4cyyi8fvy4hcxf";
   });
 
   buildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/science/math/cbc/default.nix b/pkgs/applications/science/math/cbc/default.nix
index 93aefbca2160..d0857e2a517c 100644
--- a/pkgs/applications/science/math/cbc/default.nix
+++ b/pkgs/applications/science/math/cbc/default.nix
@@ -1,11 +1,12 @@
 { lib, stdenv, fetchurl, zlib, bzip2 }:
 
-stdenv.mkDerivation {
-  name = "cbc-2.9.9";
+stdenv.mkDerivation rec {
+  pname = "cbc";
+  version = "2.10.2";
 
   src = fetchurl {
-    url = "https://www.coin-or.org/download/source/Cbc/Cbc-2.9.9.tgz";
-    sha256 = "1w8axdzm05xf5y13c31w7rc5z6ywxqxiwafnxcq3p195kgj0915a";
+    url = "https://www.coin-or.org/download/source/Cbc/Cbc-${version}.tgz";
+    sha256 = "0frbxkh6nbh46kaxsx5bmzridgip3v7aq75l8yak5npiiq4jlwv3";
   };
 
   configureFlags = [ "-C" ];
@@ -23,6 +24,7 @@ stdenv.mkDerivation {
     license = lib.licenses.epl10;
     maintainers = [ lib.maintainers.eelco ];
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
+    broken = stdenv.isAarch64; # Missing <immintrin.h> after 2.10.0
     description = "A mixed integer programming solver";
   };
 }
diff --git a/pkgs/applications/science/math/pynac/default.nix b/pkgs/applications/science/math/pynac/default.nix
index f05700b1bd81..75a46bb182ae 100644
--- a/pkgs/applications/science/math/pynac/default.nix
+++ b/pkgs/applications/science/math/pynac/default.nix
@@ -9,14 +9,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "0.7.24";
+  version = "0.7.25";
   pname = "pynac";
 
   src = fetchFromGitHub {
     owner = "pynac";
     repo = "pynac";
     rev = "pynac-${version}";
-    sha256 = "0i3qxww28576jim0abgkqy9mi2k0lfllgyx8xpfqsqb75ai970ik";
+    sha256 = "0nnifvg6kzx0lq6gz7znind8g30v3d2pjfwgsdiks3vv9kv9nbj3";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/version-management/git-and-tools/fast-export/default.nix b/pkgs/applications/version-management/git-and-tools/fast-export/default.nix
index fd50febb4699..c9fd33312d72 100644
--- a/pkgs/applications/version-management/git-and-tools/fast-export/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/fast-export/default.nix
@@ -1,41 +1,42 @@
-{stdenv, fetchgit, mercurial, makeWrapper, subversion}:
+{stdenv, fetchgit, mercurial, makeWrapper}:
 
-with stdenv.lib;
-stdenv.mkDerivation {
-  name = "fast-export";
+stdenv.mkDerivation rec {
+  pname = "fast-export";
+  version = "190107";
 
   src = fetchgit {
     url = git://repo.or.cz/fast-export.git;
-    rev = "d202200fd9daa75cdb37d4cf067d4ca00e269535";
-    sha256 = "0m4llsg9rx4sza1kf39kxsdvhi6y87a18wm5k19c5r2h3vpylwcc";
+    rev = "v${version}";
+    sha256 = "14azfps9jd5anivcvfwflgsvqdyy6gm9jy284kzx2ng9f7871d14";
   };
 
-  buildInputs = [mercurial.python mercurial makeWrapper subversion];
+  buildInputs = [mercurial.python mercurial makeWrapper];
 
-  dontBuild = true; # skip svn for now
-
-  # TODO also support svn stuff
-  # moving .py files into lib directory so that you can't pick the wrong file from PATH.
-  # This requires redefining ROOT
   installPhase = ''
-    sed -i "s@/usr/bin/env.*@$(type -p python)@" *.py
-    l=$out/libexec/git-fast-export
-    mkdir -p $out/{bin,doc/git-fast-export} $l
-    sed -i "s@ROOT=.*@ROOT=$l@" *.sh
-    mv *.sh $out/bin
-    mv *.py $l
-    for p in $out/bin/*.sh; do
-      wrapProgram $p \
-        --prefix PYTHONPATH : "$(echo ${mercurial}/lib/python*/site-packages):$(echo ${mercurial.python}/lib/python*/site-packages)${stdenv.lib.concatMapStrings (x: ":$(echo ${x}/lib/python*/site-packages)") mercurial.pythonPackages or []}" \
-        --prefix PATH : "$(dirname $(type -p python))":$l
+    binPath=$out/bin
+    libexecPath=$out/libexec/${pname}
+    sitepackagesPath=$out/${mercurial.python.sitePackages}
+    mkdir -p $binPath $libexecPath $sitepackagesPath
+
+    # Patch shell scripts so they can execute the Python scripts
+    sed -i "s|ROOT=.*|ROOT=$libexecPath|" *.sh
+
+    mv hg-fast-export.sh hg-reset.sh $binPath
+    mv hg-fast-export.py hg-reset.py $libexecPath
+    mv hg2git.py pluginloader plugins $sitepackagesPath
+
+    for script in $out/bin/*.sh; do
+      wrapProgram $script \
+        --prefix PATH : "${mercurial.python}/bin":$libexec \
+        --prefix PYTHONPATH : "${mercurial}/${mercurial.python.sitePackages}":$sitepackagesPath
     done
   '';
 
-  meta = {
-    description = "Import svn, mercurial into git";
+  meta = with stdenv.lib; {
+    description = "Import mercurial into git";
     homepage = https://repo.or.cz/w/fast-export.git;
     license = licenses.gpl2;
     maintainers = [ maintainers.koral ];
-    platforms = stdenv.lib.platforms.unix;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/applications/version-management/git-and-tools/svn-all-fast-export/default.nix b/pkgs/applications/version-management/git-and-tools/svn-all-fast-export/default.nix
index 0ee188cc19d0..34c367b20a43 100644
--- a/pkgs/applications/version-management/git-and-tools/svn-all-fast-export/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/svn-all-fast-export/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub, qmake, qtbase, qttools, subversion, apr }:
 
 let
-  version = "1.0.13";
+  version = "1.0.16";
 in
 stdenv.mkDerivation {
   name = "svn-all-fast-export-${version}";
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
     owner = "svn-all-fast-export";
     repo = "svn2git";
     rev = version;
-    sha256 = "0f1qj0c4cdq46mz54wcy17g7rq1fy2q0bq3sswhr7r5a2s433x4f";
+    sha256 = "1xs3gngjkna458liaqjsc8ryld03mdmvycnkzwsgyzfxsgjx1i3l";
   };
 
   nativeBuildInputs = [ qmake qttools ];
diff --git a/pkgs/applications/version-management/src/default.nix b/pkgs/applications/version-management/src/default.nix
index 20d3922138b6..e41d40beb591 100644
--- a/pkgs/applications/version-management/src/default.nix
+++ b/pkgs/applications/version-management/src/default.nix
@@ -2,20 +2,21 @@
 
 stdenv.mkDerivation rec {
   name = "src-${version}";
-  version = "1.24";
+  version = "1.25";
 
   src = fetchurl {
     url = "http://www.catb.org/~esr/src/${name}.tar.gz";
-    sha256 = "0n9j2mywbm8c7mc5b3m7dvn6gff88wwwaygk4y1jivpg1f6s3k3l";
+    sha256 = "0qd10w8fwbrgaj8sx49q6cfhqq3ylhwn7nl9v6kxi1yjlw2p098p";
   };
 
-  buildInputs = [ python rcs git makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ python rcs git ];
 
   preConfigure = ''
     patchShebangs .
   '';
 
-  makeFlags = [ "prefix=$(out)" ];
+  makeFlags = [ "prefix=${placeholder "out"}" ];
 
   postInstall = ''
     wrapProgram $out/bin/src \
@@ -32,8 +33,9 @@ stdenv.mkDerivation rec {
       will seem familiar to Subversion/Git/hg users, and no binary blobs
       anywhere.
     '';
-    homepage = http://www.catb.org/esr/src/;
-    license = licenses.bsd3;
+    homepage = "http://www.catb.org/esr/src/";
+    changelog = "https://gitlab.com/esr/src/raw/${version}/NEWS";
+    license = licenses.bsd2;
     platforms = platforms.all;
     maintainers = with maintainers; [ calvertvl AndersonTorres ];
   };
diff --git a/pkgs/applications/video/mkclean/default.nix b/pkgs/applications/video/mkclean/default.nix
new file mode 100644
index 000000000000..4a3cbc81b35e
--- /dev/null
+++ b/pkgs/applications/video/mkclean/default.nix
@@ -0,0 +1,37 @@
+{ dos2unix, fetchurl, stdenv }:
+
+stdenv.mkDerivation rec {
+  pname = "mkclean";
+  version = "0.8.10";
+
+  hardeningDisable = [ "format" ];
+  nativeBuildInputs = [ dos2unix ];
+
+  src = fetchurl {
+    url = "mirror://sourceforge/matroska/${pname}-${version}.tar.bz2";
+    sha256 = "0zbpi4sm68zb20d53kbss93fv4aafhcmz7dsd0zdf01vj1r3wxwn";
+  };
+
+  configurePhase = ''
+    dos2unix ./mkclean/configure.compiled
+    ./mkclean/configure.compiled
+  '';
+
+  buildPhase = ''
+    make -C mkclean
+  '';
+
+  installPhase = ''
+    mkdir -p $out/{bin,lib}
+    mv release/gcc_linux_*/*.* $out/lib
+    mv release/gcc_linux_*/* $out/bin
+  '';
+
+  meta = with stdenv.lib; {
+    description = "mkclean is a command line tool to clean and optimize Matroska (.mkv / .mka / .mks / .mk3d) and WebM (.webm / .weba) files that have already been muxed.";
+    homepage = "https://www.matroska.org";
+    license = licenses.bsdOriginal;
+    maintainers = with maintainers; [ chrisaw ];
+    platforms = [ "i686-linux" "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/applications/window-managers/i3/wk-switch.nix b/pkgs/applications/window-managers/i3/wk-switch.nix
index 39bd62cd5aa9..5b1cdbe05f5d 100644
--- a/pkgs/applications/window-managers/i3/wk-switch.nix
+++ b/pkgs/applications/window-managers/i3/wk-switch.nix
@@ -1,18 +1,17 @@
-{ stdenv, fetchFromGitHub, python2Packages }:
+{ stdenv, fetchFromGitHub, python3Packages }:
 
-python2Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "i3-wk-switch";
-  version = "2017-08-21";
+  version = "2019-05-10";
 
-  # https://github.com/tmfink/i3-wk-switch/commit/484f840bc4c28ddc60fa3be81e2098f7689e78fb
   src = fetchFromGitHub {
     owner = "tmfink";
     repo = pname;
-    rev = "484f840";
-    sha256 = "0nrc13ld5bx07wrgnpzgpbaixb4rpi93xiapvyb8srd49fj9pcmb";
+    rev = "05a2d5d35e9841d2a26630f1866fc0a0e8e708eb";
+    sha256 = "0ln192abdqrrs7rdazp9acbji2y6pf68z2d1by4nf2q529dh24dc";
   };
 
-  propagatedBuildInputs = with python2Packages; [ i3-py ];
+  propagatedBuildInputs = with python3Packages; [ i3ipc ];
 
   dontBuild = true;
   doCheck = false;
@@ -23,7 +22,7 @@ python2Packages.buildPythonApplication rec {
   '';
 
   meta = with stdenv.lib; {
-    description = "XMonad-like workspace switching for i3";
+    description = "XMonad-like workspace switching for i3 and sway";
     maintainers = with maintainers; [ synthetica ];
     platforms = platforms.linux;
     license = licenses.mit;
diff --git a/pkgs/build-support/docker/default.nix b/pkgs/build-support/docker/default.nix
index 11945e7b6f72..57e40069003a 100644
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@@ -216,7 +216,7 @@ rec {
         find image/$extractionID/layer -name ".wh.*" -exec bash -c 'name="$(basename {}|sed "s/^.wh.//")"; mknod "$(dirname {})/$name" c 0 0; rm {}' \;
 
         # Get the next lower directory and continue the loop.
-        lowerdir=$lowerdir''${lowerdir:+:}image/$extractionID/layer
+        lowerdir=image/$extractionID/layer''${lowerdir:+:}$lowerdir
       done
 
       mkdir work
@@ -585,9 +585,9 @@ rec {
           layerID=$(sha256sum "$layer/json" | cut -d ' ' -f 1)
           ln -s "$layer" "./image/$layerID"
 
-          manifestJson=$(echo "$manifestJson" | jq ".[0].Layers |= [\"$layerID/layer.tar\"] + .")
-          imageJson=$(echo "$imageJson" | jq ".history |= [{\"created\": \"$(jq -r .created ${configJson})\"}] + .")
-          imageJson=$(echo "$imageJson" | jq ".rootfs.diff_ids |= [\"sha256:$layerChecksum\"] + .")
+          manifestJson=$(echo "$manifestJson" | jq ".[0].Layers |= . + [\"$layerID/layer.tar\"]")
+          imageJson=$(echo "$imageJson" | jq ".history |= . + [{\"created\": \"$(jq -r .created ${configJson})\"}]")
+          imageJson=$(echo "$imageJson" | jq ".rootfs.diff_ids |= . + [\"sha256:$layerChecksum\"]")
         done
         imageJsonChecksum=$(echo "$imageJson" | sha256sum | cut -d ' ' -f1)
         echo "$imageJson" > "image/$imageJsonChecksum.json"
@@ -779,23 +779,24 @@ rec {
         # Use the temp folder we've been working on to create a new image.
         mv temp image/$layerID
 
-        # Add the new layer ID to the beginning of the layer list
+        # Add the new layer ID to the end of the layer list
         (
+          cat layer-list
           # originally this used `sed -i "1i$layerID" layer-list`, but
           # would fail if layer-list was completely empty.
           echo "$layerID/layer.tar"
-          cat layer-list
         ) | ${pkgs.moreutils}/bin/sponge layer-list
 
         # Create image json and image manifest
         imageJson=$(cat ${baseJson} | jq ". + {\"rootfs\": {\"diff_ids\": [], \"type\": \"layers\"}}")
         manifestJson=$(jq -n "[{\"RepoTags\":[\"$imageName:$imageTag\"]}]")
 
-        for layerTar in $(tac ./layer-list); do
+        for layerTar in $(cat ./layer-list); do
           layerChecksum=$(sha256sum image/$layerTar | cut -d ' ' -f1)
-          imageJson=$(echo "$imageJson" | jq ".history |= [{\"created\": \"$(jq -r .created ${baseJson})\"}] + .")
-          imageJson=$(echo "$imageJson" | jq ".rootfs.diff_ids |= [\"sha256:$layerChecksum\"] + .")
-          manifestJson=$(echo "$manifestJson" | jq ".[0].Layers |= [\"$layerTar\"] + .")
+          imageJson=$(echo "$imageJson" | jq ".history |= . + [{\"created\": \"$(jq -r .created ${baseJson})\"}]")
+          # diff_ids order is from the bottom-most to top-most layer
+          imageJson=$(echo "$imageJson" | jq ".rootfs.diff_ids |= . + [\"sha256:$layerChecksum\"]")
+          manifestJson=$(echo "$manifestJson" | jq ".[0].Layers |= . + [\"$layerTar\"]")
         done
 
         imageJsonChecksum=$(echo "$imageJson" | sha256sum | cut -d ' ' -f1)
diff --git a/pkgs/build-support/docker/examples.nix b/pkgs/build-support/docker/examples.nix
index 557a4dbf54b7..ac21be907b83 100644
--- a/pkgs/build-support/docker/examples.nix
+++ b/pkgs/build-support/docker/examples.nix
@@ -187,4 +187,43 @@ rec {
     runAsRoot = "touch /example-file";
     fromImage = bash;
   };
+
+  # 13. example of 3 layers images This image is used to verify the
+  # order of layers is correct.
+  # It allows to validate
+  # - the layer of parent are below
+  # - the order of parent layer is preserved at image build time
+  #   (this is why there are 3 images)
+  layersOrder = let
+    l1 = pkgs.dockerTools.buildImage {
+      name = "l1";
+      tag = "latest";
+      extraCommands = ''
+        mkdir -p tmp
+        echo layer1 > tmp/layer1
+        echo layer1 > tmp/layer2
+        echo layer1 > tmp/layer3
+      '';
+    };
+    l2 = pkgs.dockerTools.buildImage {
+      name = "l2";
+      fromImage = l1;
+      tag = "latest";
+      extraCommands = ''
+        mkdir -p tmp
+        echo layer2 > tmp/layer2
+        echo layer2 > tmp/layer3
+      '';
+    };
+  in pkgs.dockerTools.buildImage {
+    name = "l3";
+    fromImage = l2;
+    tag = "latest";
+    contents = [ pkgs.coreutils ];
+    extraCommands = ''
+      mkdir -p tmp
+      echo layer3 > tmp/layer3
+    '';
+  };
+
 }
diff --git a/pkgs/data/fonts/unifont/default.nix b/pkgs/data/fonts/unifont/default.nix
index b167a7802d15..d495efc79eca 100644
--- a/pkgs/data/fonts/unifont/default.nix
+++ b/pkgs/data/fonts/unifont/default.nix
@@ -2,16 +2,16 @@
 
 stdenv.mkDerivation rec {
   name = "unifont-${version}";
-  version = "12.0.01";
+  version = "12.1.01";
 
   ttf = fetchurl {
     url = "mirror://gnu/unifont/${name}/${name}.ttf";
-    sha256 = "191vgddv5fksg7g01q692nfcb02ks2y28fi9fv8aghvs36q4iana";
+    sha256 = "05knv3vlnk8ahaybwz6r95d3a1h7h7q9ll6ij2jl7zgjhcx4zy5d";
   };
 
   pcf = fetchurl {
     url = "mirror://gnu/unifont/${name}/${name}.pcf.gz";
-    sha256 = "14xbrsdrnllly8h2afan3b4v486vd4y8iff8zqmcfliw0cipm8v4";
+    sha256 = "0q7dlnfzk49m4pgf2s7jv05jysa6sfxx3w0y17yis9j7g18lyw1b";
   };
 
   nativeBuildInputs = [ mkfontscale mkfontdir ];
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
 
   outputHashAlgo = "sha256";
   outputHashMode = "recursive";
-  outputHash = "1jccbz7wyyk7rpyapgsppcgakgpm1l9fqqxs7fg9naav7i0nzzpg";
+  outputHash = "0sgdr9dma4hkda3siydfvjrnzrpri8r7iqs2zqf77z9n4zn90qp5";
 
   meta = with stdenv.lib; {
     description = "Unicode font for Base Multilingual Plane";
diff --git a/pkgs/data/fonts/unifont_upper/default.nix b/pkgs/data/fonts/unifont_upper/default.nix
index d94a2cc02420..7ab04fd6befe 100644
--- a/pkgs/data/fonts/unifont_upper/default.nix
+++ b/pkgs/data/fonts/unifont_upper/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchzip }:
 
 let
-  version = "12.0.01";
+  version = "12.1.01";
 in fetchzip rec {
   name = "unifont_upper-${version}";
 
@@ -9,7 +9,7 @@ in fetchzip rec {
 
   postFetch = "install -Dm644 $downloadedFile $out/share/fonts/truetype/unifont_upper.ttf";
 
-  sha256 = "1mmbndyi91fcdj7ykk5y7rypmm5jf2zf5pp5ab8hq3aa9y7invw3";
+  sha256 = "11b14ka2w16vssxdhgq7k9bx7xx0sr36hfi2vzyimmaibasi1r74";
 
   meta = with stdenv.lib; {
     description = "Unicode font for glyphs above the Unicode Basic Multilingual Plane";
diff --git a/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix b/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix
index da99fb68b858..8920c4018821 100644
--- a/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix
+++ b/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   name = "evolution-data-server-${version}";
-  version = "3.32.1";
+  version = "3.32.2";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution-data-server/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "0jb8d2a4kzz7an7d3db8mfpvhb6r1wrp8dk11vpa3jby60cxbbyd";
+    sha256 = "1jdk3az797kznkg40nbxb3ddyx8s6favzxlc4vr840zxcl84k9vy";
   };
 
   patches = [
diff --git a/pkgs/development/compilers/ghc/8.6.4.nix b/pkgs/development/compilers/ghc/8.6.4.nix
index 640709aba1b8..54c53691574e 100644
--- a/pkgs/development/compilers/ghc/8.6.4.nix
+++ b/pkgs/development/compilers/ghc/8.6.4.nix
@@ -9,7 +9,7 @@
 , # GHC can be built with system libffi or a bundled one.
   libffi ? null
 
-, useLLVM ? !stdenv.targetPlatform.isx86 || (stdenv.targetPlatform.isMusl && stdenv.hostPlatform != stdenv.targetPlatform)
+, useLLVM ? !stdenv.targetPlatform.isx86
 , # LLVM is conceptually a run-time-only depedendency, but for
   # non-x86, we need LLVM to bootstrap later stages, so it becomes a
   # build-time dependency too.
@@ -31,7 +31,8 @@
 
 , # What flavour to build. An empty string indicates no
   # specific flavour and falls back to ghc default values.
-  ghcFlavour ? stdenv.lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform) "perf-cross"
+  ghcFlavour ? stdenv.lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform)
+    (if useLLVM then "perf-cross" else "perf-cross-ncg")
 
 , # Whether to disable the large address space allocator
   # necessary fix for iOS: https://www.reddit.com/r/haskell/comments/4ttdz1/building_an_osxi386_to_iosarm64_cross_compiler/d5qvd67/
diff --git a/pkgs/development/compilers/ghc/8.6.5.nix b/pkgs/development/compilers/ghc/8.6.5.nix
index e891ff42ff60..bc45540036d2 100644
--- a/pkgs/development/compilers/ghc/8.6.5.nix
+++ b/pkgs/development/compilers/ghc/8.6.5.nix
@@ -9,7 +9,7 @@
 , # GHC can be built with system libffi or a bundled one.
   libffi ? null
 
-, useLLVM ? !stdenv.targetPlatform.isx86 || (stdenv.targetPlatform.isMusl && stdenv.hostPlatform != stdenv.targetPlatform)
+, useLLVM ? !stdenv.targetPlatform.isx86
 , # LLVM is conceptually a run-time-only depedendency, but for
   # non-x86, we need LLVM to bootstrap later stages, so it becomes a
   # build-time dependency too.
@@ -31,7 +31,8 @@
 
 , # What flavour to build. An empty string indicates no
   # specific flavour and falls back to ghc default values.
-  ghcFlavour ? stdenv.lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform) "perf-cross"
+  ghcFlavour ? stdenv.lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform)
+    (if useLLVM then "perf-cross" else "perf-cross-ncg")
 
 , # Whether to disable the large address space allocator
   # necessary fix for iOS: https://www.reddit.com/r/haskell/comments/4ttdz1/building_an_osxi386_to_iosarm64_cross_compiler/d5qvd67/
diff --git a/pkgs/development/compilers/ghc/8.8.1.nix b/pkgs/development/compilers/ghc/8.8.1.nix
index 9772d045b765..ad2d64866f85 100644
--- a/pkgs/development/compilers/ghc/8.8.1.nix
+++ b/pkgs/development/compilers/ghc/8.8.1.nix
@@ -9,7 +9,7 @@
 , # GHC can be built with system libffi or a bundled one.
   libffi ? null
 
-, useLLVM ? !stdenv.targetPlatform.isx86 || (stdenv.targetPlatform.isMusl && stdenv.hostPlatform != stdenv.targetPlatform)
+, useLLVM ? !stdenv.targetPlatform.isx86
 , # LLVM is conceptually a run-time-only depedendency, but for
   # non-x86, we need LLVM to bootstrap later stages, so it becomes a
   # build-time dependency too.
@@ -31,7 +31,8 @@
 
 , # What flavour to build. An empty string indicates no
   # specific flavour and falls back to ghc default values.
-  ghcFlavour ? stdenv.lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform) "perf-cross"
+  ghcFlavour ? stdenv.lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform)
+    (if useLLVM then "perf-cross" else "perf-cross-ncg")
 
 , # Whether to disable the large address space allocator
   # necessary fix for iOS: https://www.reddit.com/r/haskell/comments/4ttdz1/building_an_osxi386_to_iosarm64_cross_compiler/d5qvd67/
diff --git a/pkgs/development/compilers/ghc/head.nix b/pkgs/development/compilers/ghc/head.nix
index 88b273500dc0..46d8dfafd0fe 100644
--- a/pkgs/development/compilers/ghc/head.nix
+++ b/pkgs/development/compilers/ghc/head.nix
@@ -6,7 +6,7 @@
 
 , libiconv ? null, ncurses
 
-, useLLVM ? !stdenv.targetPlatform.isx86 || (stdenv.targetPlatform.isMusl && stdenv.hostPlatform != stdenv.targetPlatform)
+, useLLVM ? !stdenv.targetPlatform.isx86
 , # LLVM is conceptually a run-time-only depedendency, but for
   # non-x86, we need LLVM to bootstrap later stages, so it becomes a
   # build-time dependency too.
@@ -29,7 +29,8 @@
 , version ? "8.7.20190115"
 , # What flavour to build. An empty string indicates no
   # specific flavour and falls back to ghc default values.
-  ghcFlavour ? stdenv.lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform) "perf-cross"
+  ghcFlavour ? stdenv.lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform)
+    (if useLLVM then "perf-cross" else "perf-cross-ncg")
 
 , # Whether to disable the large address space allocator
   # necessary fix for iOS: https://www.reddit.com/r/haskell/comments/4ttdz1/building_an_osxi386_to_iosarm64_cross_compiler/d5qvd67/
diff --git a/pkgs/development/compilers/llvm/7/lldb.nix b/pkgs/development/compilers/llvm/7/lldb.nix
index a697aac5b8f2..f58871f1d7cd 100644
--- a/pkgs/development/compilers/llvm/7/lldb.nix
+++ b/pkgs/development/compilers/llvm/7/lldb.nix
@@ -27,6 +27,9 @@ stdenv.mkDerivation {
       cmake/modules/LLDBStandalone.cmake
     sed -i 's,"$.LLVM_LIBRARY_DIR.",${llvm}/lib ${clang-unwrapped}/lib,' \
       cmake/modules/LLDBStandalone.cmake
+    sed -i -e 's,message(SEND_ERROR "Cannot find debugserver on system."),,' \
+           -e 's,string(STRIP ''${XCODE_DEV_DIR} XCODE_DEV_DIR),,' \
+           tools/debugserver/source/CMakeLists.txt
   '';
 
   nativeBuildInputs = [ cmake python which swig ];
@@ -36,8 +39,11 @@ stdenv.mkDerivation {
   CXXFLAGS = "-fno-rtti";
   hardeningDisable = [ "format" ];
 
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-I${libxml2.dev}/include/libxml2";
+
   cmakeFlags = [
     "-DLLDB_CODESIGN_IDENTITY=" # codesigning makes nondeterministic
+    "-DSKIP_DEBUGSERVER=ON"
   ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/haskell-modules/configuration-ghc-8.8.x.nix b/pkgs/development/haskell-modules/configuration-ghc-8.8.x.nix
index abf2760075b1..dc3071e5fab3 100644
--- a/pkgs/development/haskell-modules/configuration-ghc-8.8.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-8.8.x.nix
@@ -41,8 +41,30 @@ self: super: {
   unix = null;
   xhtml = null;
 
-  # Use our native version of the Cabal library.
-  cabal-install = (doJailbreak super.cabal-install).overrideScope (self: super: { Cabal = null; });
+  # Use the current git version of cabal-install.
+  cabal-install = overrideCabal (super.cabal-install.overrideScope (self: super: { Cabal = self.Cabal-git; })) (drv: {
+    src = pkgs.fetchFromGitHub {
+      owner = "haskell";
+      repo = "cabal";
+      rev = "e98f6c26fa301b49921c2df67934bf9b0a4f3386";
+      sha256 = "15nrkvckq2rw31z7grgbsg5f0gxfc09afsrqdfi4n471k630xd2i";
+    };
+    version = "20190510-git";
+    editedCabalFile = null;
+    postUnpack = "sourceRoot+=/cabal-install";
+    jailbreak = true;
+  });
+  Cabal-git = overrideCabal super.Cabal_2_4_1_0 (drv: {
+    src = pkgs.fetchFromGitHub {
+      owner = "haskell";
+      repo = "cabal";
+      rev = "e98f6c26fa301b49921c2df67934bf9b0a4f3386";
+      sha256 = "15nrkvckq2rw31z7grgbsg5f0gxfc09afsrqdfi4n471k630xd2i";
+    };
+    version = "20190510-git";
+    editedCabalFile = null;
+    postUnpack = "sourceRoot+=/Cabal";
+  });
 
   # Ignore overly restrictive upper version bounds.
   async = doJailbreak super.async;
@@ -56,10 +78,12 @@ self: super: {
   lucid = doJailbreak super.lucid;
   parallel = doJailbreak super.parallel;
   quickcheck-instances = doJailbreak super.quickcheck-instances;
+  setlocale = doJailbreak super.setlocale;
   split = doJailbreak super.split;
   tasty-expected-failure = doJailbreak super.tasty-expected-failure;
   test-framework = doJailbreak super.test-framework;
   th-lift = self.th-lift_0_8_0_1;
+  hledger-lib = doJailbreak super.hledger-lib;  # base >=4.8 && <4.13, easytest >=0.2.1 && <0.3
 
   # These packages don't work and need patching and/or an update.
   primitive = overrideSrc (doJailbreak super.primitive) {
@@ -160,9 +184,21 @@ self: super: {
     url = "https://raw.githubusercontent.com/hvr/head.hackage/master/patches/attoparsec-0.13.2.2.patch";
     sha256 = "13i1p5g0xzxnv966nlyb77mfmxvg9jzbym1d36h1ajn045yf4igl";
   });
-  aeson = appendPatch super.aeson (pkgs.fetchpatch {
+  aeson = appendPatch (dontCheck super.aeson) (pkgs.fetchpatch {   # the test suite breaks the compiler
     url = "https://raw.githubusercontent.com/hvr/head.hackage/master/patches/aeson-1.4.3.0.patch";
     sha256 = "1z6wmsmc682qs3y768r0zx493dxardwbsp0wdc4dsx83c0m5x66f";
   });
+  cassava = appendPatch super.cassava (pkgs.fetchpatch {
+    url = "https://raw.githubusercontent.com/hvr/head.hackage/master/patches/cassava-0.5.1.0.patch";
+    sha256 = "11scwwjp94si90vb8v5yr291g9qwv5l223z8y0g0lc63932bp63g";
+  });
+  shakespeare = appendPatch super.shakespeare (pkgs.fetchpatch {
+    url = "https://raw.githubusercontent.com/hvr/head.hackage/master/patches/shakespeare-2.0.20.patch";
+    sha256 = "1dgx41ylahj4wk8r422aik0d7qdpawdga4gqz905nvlnhqjla58y";
+  });
+  lens = appendPatch (doJailbreak super.lens) (pkgs.fetchpatch {
+    url = "https://raw.githubusercontent.com/hvr/head.hackage/master/patches/lens-4.17.1.patch";
+    sha256 = "0w89ipi6dfkx5vlw4a64hh6fd0bm9hg33mwpghliyyxik5jmilv1";
+  });
 
 }
diff --git a/pkgs/development/haskell-modules/configuration-hackage2nix.yaml b/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
index 99967aa6724f..fe76c581edaa 100644
--- a/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
@@ -3750,6 +3750,7 @@ broken-packages:
   - cparsing
   - CPBrainfuck
   - cpio-conduit
+  - cpkg
   - cplusplus-th
   - cprng-aes-effect
   - cpuperf
@@ -3956,6 +3957,7 @@ broken-packages:
   - dead-simple-json
   - Deadpan-DDP
   - debian
+  - debug
   - debug-me
   - debug-trace-var
   - decepticons
@@ -5083,6 +5085,7 @@ broken-packages:
   - hakismet
   - hakka
   - hako
+  - hakyll
   - hakyll-agda
   - hakyll-blaze-templates
   - hakyll-contrib
@@ -5091,9 +5094,16 @@ broken-packages:
   - hakyll-contrib-hyphenation
   - hakyll-contrib-links
   - hakyll-convert
+  - hakyll-dhall
+  - hakyll-dir-list
+  - hakyll-favicon
   - hakyll-filestore
+  - hakyll-images
   - hakyll-ogmarkup
   - hakyll-R
+  - hakyll-sass
+  - hakyll-series
+  - hakyll-shakespeare
   - hakyll-shortcode
   - hakyll-shortcut-links
   - halberd
@@ -5627,6 +5637,7 @@ broken-packages:
   - hocker
   - hodatime
   - HODE
+  - Hoed
   - hog
   - hogg
   - hoggl
@@ -6335,6 +6346,7 @@ broken-packages:
   - katip-syslog
   - katt
   - kawaii
+  - kazura-queue
   - kd-tree
   - kdesrc-build-extra
   - kdt
@@ -6442,6 +6454,7 @@ broken-packages:
   - language-c-comments
   - language-c-inline
   - language-conf
+  - language-csharp
   - language-css
   - language-dart
   - language-dockerfile
@@ -7470,6 +7483,7 @@ broken-packages:
   - parsec-pratt
   - parseerror-eq
   - parsely
+  - parser-combinators-tests
   - parser-helper
   - parser241
   - parsergen
@@ -8203,6 +8217,7 @@ broken-packages:
   - RNAlien
   - RNAwolf
   - rncryptor
+  - rob
   - robin
   - robots-txt
   - roc-cluster
@@ -8453,6 +8468,7 @@ broken-packages:
   - servant-streaming-docs
   - servant-streaming-server
   - servant-waargonaut
+  - servant-xml
   - servant-zeppelin
   - servant-zeppelin-client
   - servant-zeppelin-server
@@ -9741,6 +9757,7 @@ broken-packages:
   - wiring
   - withdependencies
   - wkt
+  - wkt-geom
   - wl-pprint-ansiterm
   - wl-pprint-terminfo
   - WL500gPControl
diff --git a/pkgs/development/haskell-modules/configuration-nix.nix b/pkgs/development/haskell-modules/configuration-nix.nix
index 1be90f902e68..f4dd805568ea 100644
--- a/pkgs/development/haskell-modules/configuration-nix.nix
+++ b/pkgs/development/haskell-modules/configuration-nix.nix
@@ -128,6 +128,26 @@ self: super: builtins.intersectAttrs super {
   # the system-fileio tests use canonicalizePath, which fails in the sandbox
   system-fileio = if pkgs.stdenv.isDarwin then dontCheck super.system-fileio else super.system-fileio;
 
+  # Prevents needing to add `security_tool` as a run-time dependency for
+  # everything using x509-system to give access to the `security` executable.
+  x509-system =
+    if pkgs.stdenv.hostPlatform.isDarwin && !pkgs.stdenv.cc.nativeLibc
+    then
+      # darwin.security_tool is broken in Mojave (#45042)
+
+      # We will use the system provided security for now.
+      # Beware this WILL break in sandboxes!
+
+      # TODO(matthewbauer): If someone really needs this to work in sandboxes,
+      # I think we can add a propagatedImpureHost dep here, but I’m hoping to
+      # get a proper fix available soonish.
+      overrideCabal super.x509-system (drv: {
+        postPatch = (drv.postPatch or "") + ''
+          substituteInPlace System/X509/MacOS.hs --replace security /usr/bin/security
+        '';
+      })
+    else super.x509-system;
+
   # https://github.com/NixOS/cabal2nix/issues/136 and https://github.com/NixOS/cabal2nix/issues/216
   gio = disableHardening (addPkgconfigDepend (addBuildTool super.gio self.buildHaskellPackages.gtk2hs-buildtools) pkgs.glib) ["fortify"];
   glib = disableHardening (addPkgconfigDepend (addBuildTool super.glib self.buildHaskellPackages.gtk2hs-buildtools) pkgs.glib) ["fortify"];
diff --git a/pkgs/development/haskell-modules/hackage-packages.nix b/pkgs/development/haskell-modules/hackage-packages.nix
index 41d94bd5309a..ddcfa0ff447c 100644
--- a/pkgs/development/haskell-modules/hackage-packages.nix
+++ b/pkgs/development/haskell-modules/hackage-packages.nix
@@ -10169,6 +10169,8 @@ self: {
        testHaskellDepends = [ base process QuickCheck ];
        description = "Lightweight algorithmic debugging";
        license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "HoleyMonoid" = callPackage
@@ -44208,8 +44210,8 @@ self: {
      }:
      mkDerivation {
        pname = "cabal-cache";
-       version = "1.0.0.7";
-       sha256 = "1r1qz3nrh2k4gx6j6iiw3gvcflkl9l5yk81nj0c2snrz8wgsq28b";
+       version = "1.0.0.9";
+       sha256 = "1h7wp30gmggsrjgspsahn6b045njy6c23mhgkmhz6nn5s4wa1hak";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -58088,6 +58090,8 @@ self: {
        testHaskellDepends = [ base hspec hspec-megaparsec megaparsec ];
        description = "Build tool for C";
        license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "cplex-hs" = callPackage
@@ -64785,6 +64789,8 @@ self: {
        ];
        description = "Simple trace-based debugger";
        license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "debug-diff" = callPackage
@@ -66627,6 +66633,8 @@ self: {
        pname = "dhall-bash";
        version = "1.0.20";
        sha256 = "1nqiyvyj0dw1a6shy9bb1qxzjrnh8544hsa2c6rwg2j36f0lk73d";
+       revision = "1";
+       editedCabalFile = "0rld0k17lprd8ibwbk0aan94lbd5ffsx5a5apjgk4d4cs3jchycp";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -66696,6 +66704,8 @@ self: {
        pname = "dhall-json";
        version = "1.2.8";
        sha256 = "0s5iygh9rfmhx3v62dnfr55xz60rjvnicrq9ydspy129mhf0zzgd";
+       revision = "1";
+       editedCabalFile = "04gbbjns1vgafvc10zx4vrk130kww0a6c4lcqcmapa8yi7vz9670";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -66763,6 +66773,8 @@ self: {
        pname = "dhall-text";
        version = "1.0.17";
        sha256 = "0bs246857r801qnqvh8cb5wm1rplr7grynl4h989i61qz7vcqf53";
+       revision = "1";
+       editedCabalFile = "1avvybk495zngswlnjiqj8nk7iycwzzhxx3cml4w2yhqlic3xx2g";
        isLibrary = false;
        isExecutable = true;
        executableHaskellDepends = [
@@ -92221,12 +92233,13 @@ self: {
          bup curl git gnupg lsof openssh perl rsync wget which
        ];
        preConfigure = "export HOME=$TEMPDIR; patchShebangs .";
-       postBuild = ''
+       installPhase = "make PREFIX=$out BUILDER=: install";
+       checkPhase = ''
          ln -sf dist/build/git-annex/git-annex git-annex
          ln -sf git-annex git-annex-shell
+         export PATH+=":$PWD"
+         git-annex test
        '';
-       installPhase = "make PREFIX=$out BUILDER=: install install-completions";
-       checkPhase = ''PATH+=":$PWD" git-annex test'';
        enableSharedExecutables = false;
        description = "manage files with git, without checking their contents into git";
        license = stdenv.lib.licenses.agpl3;
@@ -99881,6 +99894,19 @@ self: {
        license = stdenv.lib.licenses.gpl3;
      }) {};
 
+  "gw" = callPackage
+    ({ mkDerivation, base, unix }:
+     mkDerivation {
+       pname = "gw";
+       version = "0.1";
+       sha256 = "055pkk3gg74r4yzh3fxq1zvp1fv3i8cd53jscy1b2n3mmzhbzahv";
+       isLibrary = false;
+       isExecutable = true;
+       executableHaskellDepends = [ base unix ];
+       description = "ghcWithPackages cmdline util";
+       license = stdenv.lib.licenses.bsd3;
+     }) {};
+
   "gyah-bin" = callPackage
     ({ mkDerivation, base, extra, GiveYouAHead }:
      mkDerivation {
@@ -102234,6 +102260,8 @@ self: {
        testToolDepends = [ utillinux ];
        description = "A static website compiler library";
        license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {inherit (pkgs) utillinux;};
 
   "hakyll-R" = callPackage
@@ -102413,6 +102441,8 @@ self: {
        executableHaskellDepends = [ base dhall hakyll ];
        description = "Dhall compiler for Hakyll";
        license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "hakyll-dir-list" = callPackage
@@ -102427,6 +102457,8 @@ self: {
        ];
        description = "Allow Hakyll to create hierarchical menues from directories";
        license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "hakyll-elm" = callPackage
@@ -102455,6 +102487,8 @@ self: {
        executableHaskellDepends = [ base hakyll ];
        testHaskellDepends = [ base ];
        license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "hakyll-filestore" = callPackage
@@ -102494,6 +102528,8 @@ self: {
        ];
        description = "Hakyll utilities to work with images";
        license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "hakyll-ogmarkup" = callPackage
@@ -102522,6 +102558,8 @@ self: {
        ];
        description = "Hakyll SASS compiler over hsass";
        license = stdenv.lib.licenses.mit;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "hakyll-series" = callPackage
@@ -102533,6 +102571,8 @@ self: {
        libraryHaskellDepends = [ base containers hakyll ];
        description = "Adds series functionality to hakyll";
        license = stdenv.lib.licenses.mit;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "hakyll-shakespeare" = callPackage
@@ -102550,6 +102590,8 @@ self: {
        ];
        description = "Hakyll Hamlet compiler";
        license = stdenv.lib.licenses.mit;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "hakyll-shortcode" = callPackage
@@ -119173,6 +119215,29 @@ self: {
        license = stdenv.lib.licenses.bsd3;
      }) {inherit (pkgs) ruby;};
 
+  "hruby_0_3_7" = callPackage
+    ({ mkDerivation, aeson, attoparsec, base, bytestring, Cabal
+     , process, QuickCheck, ruby, scientific, stm, text
+     , unordered-containers, vector
+     }:
+     mkDerivation {
+       pname = "hruby";
+       version = "0.3.7";
+       sha256 = "1i77gmkggm6l17zr1jrn65rjgh3m47f7wz5j9c715mi2ilr01qfx";
+       setupHaskellDepends = [ base Cabal process ];
+       libraryHaskellDepends = [
+         aeson attoparsec base bytestring scientific stm text
+         unordered-containers vector
+       ];
+       librarySystemDepends = [ ruby ];
+       testHaskellDepends = [
+         aeson attoparsec base QuickCheck text vector
+       ];
+       description = "Embed a Ruby intepreter in your Haskell program !";
+       license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+     }) {inherit (pkgs) ruby;};
+
   "hs-GeoIP" = callPackage
     ({ mkDerivation, base, bytestring, deepseq, GeoIP }:
      mkDerivation {
@@ -137709,6 +137774,8 @@ self: {
        ];
        description = "Fast concurrent queues much inspired by unagi-chan";
        license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "kbq-gu" = callPackage
@@ -140522,6 +140589,8 @@ self: {
        libraryToolDepends = [ alex ];
        description = "C# source code manipulation";
        license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "language-css" = callPackage
@@ -172143,6 +172212,8 @@ self: {
        testToolDepends = [ hspec-discover ];
        description = "Test suite of parser-combinators";
        license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "parser-helper" = callPackage
@@ -192469,12 +192540,16 @@ self: {
      }) {};
 
   "relation" = callPackage
-    ({ mkDerivation, array, base, containers, groom }:
+    ({ mkDerivation, base, containers, hedgehog, hspec, hspec-discover
+     , hw-hspec-hedgehog
+     }:
      mkDerivation {
        pname = "relation";
-       version = "0.2.1";
-       sha256 = "03h6l8v3ppxbwg9ddgg121yx3i2v4vbcpwrv1vg3mgbw5pwq7x4c";
-       libraryHaskellDepends = [ array base containers groom ];
+       version = "0.4";
+       sha256 = "1jy5m0jih6ik05zagngrskk1ibiiblxsydxgdq6kjx1aa2pqnmqi";
+       libraryHaskellDepends = [ base containers ];
+       testHaskellDepends = [ base hedgehog hspec hw-hspec-hedgehog ];
+       testToolDepends = [ hspec-discover ];
        description = "A data structure representing Relations on Sets";
        license = stdenv.lib.licenses.bsd3;
        hydraPlatforms = stdenv.lib.platforms.none;
@@ -195640,6 +195715,8 @@ self: {
        testHaskellDepends = [ base directory ];
        description = "Simple projects generator";
        license = stdenv.lib.licenses.mit;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "robin" = callPackage
@@ -204334,6 +204411,8 @@ self: {
        ];
        description = "Servant support for the XML Content-Type";
        license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "servant-yaml" = callPackage
@@ -223107,6 +223186,22 @@ self: {
        broken = true;
      }) {};
 
+  "tasty-lua" = callPackage
+    ({ mkDerivation, base, bytestring, directory, file-embed, hslua
+     , tasty, tasty-hunit, text
+     }:
+     mkDerivation {
+       pname = "tasty-lua";
+       version = "0.1.0";
+       sha256 = "199zhrd48ixyi32spnm85v0dj6i09sl3rwi42kaxdlxkkmc54i1z";
+       libraryHaskellDepends = [
+         base bytestring file-embed hslua tasty text
+       ];
+       testHaskellDepends = [ base directory hslua tasty tasty-hunit ];
+       description = "Write tests in Lua, integrate into tasty";
+       license = stdenv.lib.licenses.mit;
+     }) {};
+
   "tasty-program" = callPackage
     ({ mkDerivation, base, deepseq, directory, filepath, process, tasty
      }:
@@ -245543,6 +245638,8 @@ self: {
        ];
        description = "A parser of WKT, WKB and eWKB";
        license = stdenv.lib.licenses.asl20;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "wl-pprint" = callPackage
diff --git a/pkgs/development/libraries/alkimia/default.nix b/pkgs/development/libraries/alkimia/default.nix
index 6f4fd09015e5..f98c8fa480e1 100644
--- a/pkgs/development/libraries/alkimia/default.nix
+++ b/pkgs/development/libraries/alkimia/default.nix
@@ -1,19 +1,20 @@
 { mkDerivation, fetchurl, lib
-, extra-cmake-modules, doxygen, graphviz, qtbase, mpir
+, extra-cmake-modules, doxygen, graphviz, qtbase, qtwebkit, mpir
+, kdelibs4support, plasma-framework, knewstuff, kpackage
 }:
 
 mkDerivation rec {
   name = "alkimia-${version}";
-  version = "7.0.1";
+  version = "8.0.1";
 
   src = fetchurl {
-    url = "mirror://kde/stable/alkimia/${version}/src/${name}.tar.xz";
-    sha256 = "1fri76465058fgsyrmdrc3hj1javz4g10mfzqp5rsj7qncjr1i22";
+    url = "mirror://kde/stable/alkimia/${version}/${name}.tar.xz";
+    sha256 = "059i6vn36sdq5zn2vqzh4asvvgdgs7n478nk9phvb5gdys01fq7m";
   };
 
   nativeBuildInputs = [ extra-cmake-modules doxygen graphviz ];
 
-  buildInputs = [ qtbase ];
+  buildInputs = [ qtbase qtwebkit kdelibs4support plasma-framework knewstuff kpackage ];
   propagatedBuildInputs = [ mpir ];
 
   meta = {
diff --git a/pkgs/development/libraries/ctl/default.nix b/pkgs/development/libraries/ctl/default.nix
index ac6c9657dde6..71e301044766 100644
--- a/pkgs/development/libraries/ctl/default.nix
+++ b/pkgs/development/libraries/ctl/default.nix
@@ -1,22 +1,31 @@
-{ stdenv, callPackage, cmake, pkgconfig, ilmbase, libtiff, openexr }:
+{ stdenv, fetchFromGitHub, fetchpatch, cmake, pkgconfig, ilmbase, libtiff, openexr }:
 
-let
-  source = callPackage ./source.nix { };
-in
-stdenv.mkDerivation {
-  name = "ctl-${source.version}";
+stdenv.mkDerivation rec {
+  pname = "ctl";
+  version = "1.5.2";
 
-  src = source.src;
+  src = fetchFromGitHub {
+    owner = "ampas";
+    repo = pname;
+    rev = "${pname}-${version}";
+    sha256 = "0a698rd1cmixh3mk4r1xa6rjli8b8b7dbx89pb43xkgqxy67glwx";
+  };
+
+  patches = [
+    (fetchpatch {
+      name = "ctl-1.5.2-ilm_230.patch";
+      url = "https://src.fedoraproject.org/rpms/CTL/raw/9d7c15a91bccdc0a9485d463bf2789be72e6b17d/f/ctl-1.5.2-ilm_230.patch";
+      sha256 = "0mdx7llwrm0q8ai53zhyxi40i9h5s339dbkqpqv30yzi2xpnfj3d";
+    })
+  ];
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ cmake libtiff ilmbase openexr ];
+  nativeBuildInputs = [ cmake pkgconfig ];
+  buildInputs = [ libtiff ilmbase openexr ];
 
   meta = with stdenv.lib; {
     description = "Color Transformation Language";
-    homepage = http://ampasctl.sourceforge.net;
-    license = "A.M.P.A.S";
+    homepage = "https://github.com/ampas/CTL";
+    license = "A.M.P.A.S"; # BSD-derivative, free but GPL incompatible
     platforms = platforms.all;
   };
-
-  passthru.source = source;
 }
diff --git a/pkgs/development/libraries/ctl/source.nix b/pkgs/development/libraries/ctl/source.nix
deleted file mode 100644
index d0cb83c0369f..000000000000
--- a/pkgs/development/libraries/ctl/source.nix
+++ /dev/null
@@ -1,11 +0,0 @@
-{ fetchFromGitHub }:
-rec {
-  version = "1.5.2";
-
-  src = fetchFromGitHub {
-    owner = "ampas";
-    repo = "CTL";
-    rev = "ctl-${version}";
-    sha256 = "0a698rd1cmixh3mk4r1xa6rjli8b8b7dbx89pb43xkgqxy67glwx";
-  };
-}
diff --git a/pkgs/development/libraries/gtksourceview/3.x.nix b/pkgs/development/libraries/gtksourceview/3.x.nix
index 0f72afe4cc15..9d1751afaf91 100644
--- a/pkgs/development/libraries/gtksourceview/3.x.nix
+++ b/pkgs/development/libraries/gtksourceview/3.x.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   name = "gtksourceview-${version}";
-  version = "3.24.10";
+  version = "3.24.11";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtksourceview/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "16ym7jwiki4s1pilwr4incx0yg7ll94f1cajrnpndkxxs36hcm5b";
+    sha256 = "1zbpj283b5ycz767hqz5kdq02wzsga65pp4fykvhg8xj6x50f6v9";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/libraries/java/lombok/default.nix b/pkgs/development/libraries/java/lombok/default.nix
index 7f932d52dc41..be3ddfff4c84 100644
--- a/pkgs/development/libraries/java/lombok/default.nix
+++ b/pkgs/development/libraries/java/lombok/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "lombok-1.18.4";
+  name = "lombok-1.18.8";
 
   src = fetchurl {
     url = "https://projectlombok.org/downloads/${name}.jar";
-    sha256 = "0hlpycnmzd71ihn59hzf445dvwky2lkv57jimx91i6v7xcnr5wrr";
+    sha256 = "1z14rc3fh03qvn2xkjrb7ha0hddv3f3vsp781xm336sp4cl9b5h3";
   };
 
   buildCommand = ''
diff --git a/pkgs/development/libraries/libgda/default.nix b/pkgs/development/libraries/libgda/default.nix
index 95860ac94201..bb6402dc4287 100644
--- a/pkgs/development/libraries/libgda/default.nix
+++ b/pkgs/development/libraries/libgda/default.nix
@@ -9,11 +9,11 @@ assert postgresSupport -> postgresql != null;
 
 (if stdenv.isAarch64 then overrideCC stdenv gcc6 else stdenv).mkDerivation rec {
   pname = "libgda";
-  version = "5.2.8";
+  version = "5.2.9";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0id4my5wh2m6rd7ijqp2azsjdb4l4yjrv3imq71kly00gjc6v1z2";
+    sha256 = "16vxv2qvysh22s8h9h6irx96sacagxkz0i4qgi1wc6ibly6fvjjr";
   };
   configureFlags = with stdenv.lib; [ "--enable-gi-system-install=no" ]
     ++ (optional (mysqlSupport) "--with-mysql=yes")
diff --git a/pkgs/development/libraries/linbox/default.nix b/pkgs/development/libraries/linbox/default.nix
index 8389ba7e3e0f..cde422906dac 100644
--- a/pkgs/development/libraries/linbox/default.nix
+++ b/pkgs/development/libraries/linbox/default.nix
@@ -12,13 +12,13 @@
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "linbox";
-  version = "1.6.0";
+  version = "1.6.1";
 
   src = fetchFromGitHub {
     owner = "linbox-team";
     repo = "${pname}";
     rev = "v${version}";
-    sha256 = "0rmk474hvgkggmhxwa5i52wdnbvipx9n8mpsc41j1c96q4v8fl22";
+    sha256 = "11mgj7pkppvzmhx5g6wfnzisk36z00gqzzq9p14hzh5dbdhk3693";
   };
 
   nativeBuildInputs = [
@@ -61,6 +61,7 @@ stdenv.mkDerivation rec {
     license = stdenv.lib.licenses.lgpl21Plus;
     maintainers = [stdenv.lib.maintainers.timokau];
     platforms = stdenv.lib.platforms.unix;
+    broken = stdenv.isDarwin || stdenv.isAarch64; # https://trac.sagemath.org/ticket/26932#comment:21
     homepage = http://linalg.org/;
   };
 }
diff --git a/pkgs/development/libraries/portaudio/default.nix b/pkgs/development/libraries/portaudio/default.nix
index 6a882ecd9003..89248597f5d9 100644
--- a/pkgs/development/libraries/portaudio/default.nix
+++ b/pkgs/development/libraries/portaudio/default.nix
@@ -15,6 +15,8 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--disable-mac-universal --enable-cxx" ];
 
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-error=nullability-inferred-on-nested-type -Wno-error=nullability-completeness-on-arrays";
+
   propagatedBuildInputs = stdenv.lib.optionals stdenv.isDarwin [ AudioUnit AudioToolbox CoreAudio CoreServices Carbon ];
 
   patchPhase = stdenv.lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/libraries/range-v3/default.nix b/pkgs/development/libraries/range-v3/default.nix
index 7fe4b504a992..256b756ed45d 100644
--- a/pkgs/development/libraries/range-v3/default.nix
+++ b/pkgs/development/libraries/range-v3/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "range-v3-${version}";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "ericniebler";
     repo = "range-v3";
     rev = version;
-    sha256 = "1s5gj799aa94nfg3r24whq7ck69g0zypf70w14wx64pgwg0424vf";
+    sha256 = "0fzbpaa4vwlivi417zxm1d6v4lkp5c9f5bd706nn2fmw3zxjj815";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/python-modules/av/default.nix b/pkgs/development/python-modules/av/default.nix
index 84c9b21f933e..c32719140ea7 100644
--- a/pkgs/development/python-modules/av/default.nix
+++ b/pkgs/development/python-modules/av/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, nose
 , numpy
 , ffmpeg_4
 , libav
@@ -10,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "av";
-  version = "6.1.2";
+  version = "6.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "eebbb56eeae650b1fc551f94d51aee39b487bf4df73c39daea186c5d2950650f";
+    sha256 = "1wm33qajxcpl9rn7zfb2pwwqn87idb7ic7h5zwy2hgbpjnh3vc2g";
   };
 
-  checkInputs = [ nose numpy ];
+  checkInputs = [ numpy ];
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ ffmpeg_4 ];
diff --git a/pkgs/development/python-modules/holoviews/default.nix b/pkgs/development/python-modules/holoviews/default.nix
index 1de465cfec09..405b66ce724b 100644
--- a/pkgs/development/python-modules/holoviews/default.nix
+++ b/pkgs/development/python-modules/holoviews/default.nix
@@ -15,11 +15,11 @@
 
 buildPythonPackage rec {
   pname = "holoviews";
-  version = "1.11.3";
+  version = "1.12.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "cb03053bfcb96ccef181405b6d3482a5b868f0c7fbaa68b52d25e0071dafd1bc";
+    sha256 = "0i4lfnajz685hlp9m0bjn7s279bv6mm5118b1qmldzqdnvw4s032";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/py-radix/default.nix b/pkgs/development/python-modules/py-radix/default.nix
new file mode 100644
index 000000000000..b06de3a27a7f
--- /dev/null
+++ b/pkgs/development/python-modules/py-radix/default.nix
@@ -0,0 +1,28 @@
+{ stdenv
+, buildPythonPackage
+, fetchFromGitHub
+, coverage
+, nose
+}:
+
+buildPythonPackage rec {
+  pname = "py-radix";
+  version = "0.10.0";
+
+  src = fetchFromGitHub {
+    owner = "mjschultz";
+    repo = "py-radix";
+    rev = "v${version}";
+    sha256 = "01xyn9lg6laavnzczf5bck1l1c2718ihxx0hvdkclnnxjqhbrqis";
+  };
+
+  doCheck = true;
+  checkInputs = [ coverage nose ];
+
+  meta = with stdenv.lib; {
+    description = "Python radix tree for IPv4 and IPv6 prefix matching";
+    homepage = https://github.com/mjschultz/py-radix;
+    license = with licenses; [ isc bsdOriginal ];
+    maintainers = with maintainers; [ mkg ];
+  };
+}
diff --git a/pkgs/development/python-modules/qdarkstyle/default.nix b/pkgs/development/python-modules/qdarkstyle/default.nix
index 5f8c59584dcc..425bb21a687b 100644
--- a/pkgs/development/python-modules/qdarkstyle/default.nix
+++ b/pkgs/development/python-modules/qdarkstyle/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "qdarkstyle";
-  version = "2.6.6";
+  version = "2.6.8";
 
   src = fetchPypi {
     inherit version;
     pname = "QDarkStyle";
-    sha256 = "1jbvvg36fnbvpzvg4ns7zx5jj8h1xsqdr05v5m98a0a9r8awdx3m";
+    sha256 = "18l2ynq2x8jd380nr47xy947c3qdmhv8nnxnan03y5d51azm8yh3";
   };
 
   # No tests available
diff --git a/pkgs/development/python-modules/qtpy/default.nix b/pkgs/development/python-modules/qtpy/default.nix
index d0bea83ad268..24e607f2849a 100644
--- a/pkgs/development/python-modules/qtpy/default.nix
+++ b/pkgs/development/python-modules/qtpy/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "QtPy";
-  version = "1.7.0";
+  version = "1.7.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0gjg7farw6mkmrwqcg6ms7j74g8py2msvawddji4wy8yfvql1ifl";
+    sha256 = "17pdn4d77gjjrsq7m1i6dz9px0dfi6wgaqz2v3sa3crl15spawp9";
   };
 
   # no concrete propagatedBuildInputs as multiple backends are supposed
diff --git a/pkgs/development/python-modules/shodan/default.nix b/pkgs/development/python-modules/shodan/default.nix
index 586edd766cda..cefe7dac2210 100644
--- a/pkgs/development/python-modules/shodan/default.nix
+++ b/pkgs/development/python-modules/shodan/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "shodan";
-  version = "1.12.1";
+  version = "1.13.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0fd68yaqhpay7jxhyc6xkdrak88wdblxs0phgdkngbakx2yaw2y3";
+    sha256 = "06z9h5vxrvqns3yr4jfrxifw0iqdn6ijlnznpmyi8nc18h8yma2a";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/typed-ast/default.nix b/pkgs/development/python-modules/typed-ast/default.nix
index 507f7ec49bd3..f540cf72877a 100644
--- a/pkgs/development/python-modules/typed-ast/default.nix
+++ b/pkgs/development/python-modules/typed-ast/default.nix
@@ -1,10 +1,10 @@
 { buildPythonPackage, fetchPypi, lib, pythonOlder }:
 buildPythonPackage rec {
   pname = "typed-ast";
-  version = "1.3.4";
+  version = "1.3.5";
   src = fetchPypi{
     inherit pname version;
-    sha256 = "68c362848d9fb71d3c3e5f43c09974a0ae319144634e7a47db62f0f2a54a7fa7";
+    sha256 = "1m7pr6qpana3cvqwiw7mlvrgvmw27ch5mx1592572xhlki8g85ak";
   };
   # Only works with Python 3.3 and newer;
   disabled = pythonOlder "3.3";
diff --git a/pkgs/development/tools/analysis/radare2/default.nix b/pkgs/development/tools/analysis/radare2/default.nix
index c80a14063a59..5a3ee3d8cbdd 100644
--- a/pkgs/development/tools/analysis/radare2/default.nix
+++ b/pkgs/development/tools/analysis/radare2/default.nix
@@ -110,12 +110,12 @@ in {
   #<generated>
   # DO NOT EDIT! Automatically generated by ./update.py
   radare2 = generic {
-    version_commit = "21276";
-    gittap = "3.4.1";
-    gittip = "da30e593718d5149f2a3d520c7f79fe1c7ca46ef";
-    rev = "3.4.1";
-    version = "3.4.1";
-    sha256 = "02qfj11j8f37hl46m8h4x9pv161glgdr7q3rfhwmq46px9y7f17p";
+    version_commit = "21707";
+    gittap = "3.5.0";
+    gittip = "75cfab37c6cfd0caffb9a90a949f5e60282bbd6c";
+    rev = "3.5.0";
+    version = "3.5.0";
+    sha256 = "03zm74a4vpip4pzj1s3gm2bdihw0iz47w8sxbhjf74074x1ylpzv";
     cs_ver = "4.0.1";
     cs_sha256 = "0ijwxxk71nr9z91yxw20zfj4bbsbrgvixps5c7cpj163xlzlwba6";
   };
diff --git a/pkgs/development/tools/build-managers/bazel/default.nix b/pkgs/development/tools/build-managers/bazel/default.nix
index 1e29e4b34f08..e106c6962dc3 100644
--- a/pkgs/development/tools/build-managers/bazel/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/default.nix
@@ -153,7 +153,7 @@ stdenv.mkDerivation rec {
       sed -i -e 's/<.*\*>//g' tools/osx/xcode_locator.m
 
       # don't use system installed Xcode to run clang, use Nix clang instead
-      sed -i -e "s;/usr/bin/xcrun clang;${clang}/bin/clang $NIX_CFLAGS_COMPILE $NIX_LDFLAGS -framework CoreFoundation;g" \
+      sed -i -e "s;/usr/bin/xcrun clang;${stdenv.cc}/bin/clang $NIX_CFLAGS_COMPILE $NIX_LDFLAGS -framework CoreFoundation;g" \
         scripts/bootstrap/compile.sh \
         src/tools/xcode/realpath/BUILD \
         src/tools/xcode/stdredirect/BUILD \
@@ -256,7 +256,7 @@ stdenv.mkDerivation rec {
     makeWrapper
     which
     customBash
-  ] ++ lib.optionals (stdenv.isDarwin) [ cctools clang libcxx CoreFoundation CoreServices Foundation ];
+  ] ++ lib.optionals (stdenv.isDarwin) [ cctools libcxx CoreFoundation CoreServices Foundation ];
 
   # Bazel makes extensive use of symlinks in the WORKSPACE.
   # This causes problems with infinite symlinks if the build output is in the same location as the
diff --git a/pkgs/development/tools/build-managers/buck/default.nix b/pkgs/development/tools/build-managers/buck/default.nix
index 832e8e351645..2cbf3a33a094 100644
--- a/pkgs/development/tools/build-managers/buck/default.nix
+++ b/pkgs/development/tools/build-managers/buck/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "buck";
-  version = "2019.01.10.01";
+  version = "2019.05.06.01";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0987s399v4ba2a3crca12vsg9001xcb5drhqi564ninpa5vxamr2";
+    sha256 = "0bcj1g8hmcpdgz3c2sxglxxq1jn1x0p9dk6hml8ajkn4h82kw12y";
   };
 
   patches = [ ./pex-mtime.patch ];
diff --git a/pkgs/development/tools/react-native-debugger/default.nix b/pkgs/development/tools/react-native-debugger/default.nix
index 9a4211299555..3b6c7940384a 100644
--- a/pkgs/development/tools/react-native-debugger/default.nix
+++ b/pkgs/development/tools/react-native-debugger/default.nix
@@ -38,11 +38,11 @@ let
   ];
 in stdenv.mkDerivation rec {
   name = "react-native-debugger-${version}";
-  version = "0.9.7";
+  version = "0.9.8";
 
   src = fetchurl {
     url = "https://github.com/jhen0409/react-native-debugger/releases/download/v${version}/rn-debugger-linux-x64.zip";
-    sha256 = "0f1wvk1550z4imcs60sv229zllcxpykx4b60bw658idr1xc3c0ix";
+    sha256 = "07mcliy5f3kcqr76izqirqzwb2rwbnl3k1al9dln1izim0lhx06r";
   };
 
   buildInputs = [ unzip ];
diff --git a/pkgs/development/tools/scalafmt/default.nix b/pkgs/development/tools/scalafmt/default.nix
index db3a2af8f5b5..a9f8a4cd4b34 100644
--- a/pkgs/development/tools/scalafmt/default.nix
+++ b/pkgs/development/tools/scalafmt/default.nix
@@ -2,7 +2,7 @@
 
 let
   baseName = "scalafmt";
-  version = "2.0.0-RC5";
+  version = "2.0.0-RC7";
   deps = stdenv.mkDerivation {
     name = "${baseName}-deps-${version}";
     buildCommand = ''
@@ -13,13 +13,14 @@ let
     '';
     outputHashMode = "recursive";
     outputHashAlgo = "sha256";
-    outputHash     = "0y2nja4dj3l7f7m9dxr8xwda8vv27dwj090gfsa78a20vq1d3xxw";
+    outputHash     = "0scz3pp63z6xfj69kvsfr8l3ll9rq95j4xlhlyrzg1vfl1gf41ig";
   };
 in
 stdenv.mkDerivation rec {
   name = "${baseName}-${version}";
 
-  buildInputs = [ jdk makeWrapper deps ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jdk deps ];
 
   doCheck = true;
 
diff --git a/pkgs/development/tools/wabt/default.nix b/pkgs/development/tools/wabt/default.nix
index e607fe2ff142..e9ced0e753a0 100644
--- a/pkgs/development/tools/wabt/default.nix
+++ b/pkgs/development/tools/wabt/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "wabt-${version}";
-  version = "1.0.10";
+  version = "1.0.11";
 
   src = fetchFromGitHub {
     owner  = "WebAssembly";
     repo   = "wabt";
     rev    = version;
-    sha256 = "0vki02317mbk5f2w9fxyslcrn5rl2sk845rrs318i37wsz6ismp3";
+    sha256 = "0hn88vlqyclpk79v3wg3lrssd9vwhjdgvb41g03jqakygxxgnmp5";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/games/azimuth/default.nix b/pkgs/games/azimuth/default.nix
new file mode 100644
index 000000000000..3370f339fa2a
--- /dev/null
+++ b/pkgs/games/azimuth/default.nix
@@ -0,0 +1,64 @@
+{ stdenv, fetchFromGitHub, SDL }:
+
+stdenv.mkDerivation rec {
+  pname = "azimuth";
+  version = "1.0.2";
+
+  src = fetchFromGitHub {
+    owner  = "mdsteele";
+    repo   = "azimuth";
+    rev    = "v${version}";
+    sha256 = "0yh52i3vfmj5zd7fs1r2xpjy2mknycr5xz6kyixj2qncb25xsm7z";
+  };
+
+  preConfigure = ''
+    substituteInPlace data/azimuth.desktop \
+      --replace Exec=azimuth "Exec=$out/bin/azimuth" \
+      --replace "Version=%AZ_VERSION_NUMBER" "Version=${version}"
+  '';
+
+  makeFlags = [
+    "BUILDTYPE=release"
+  ];
+
+  buildInputs = [ SDL ];
+
+  enableParallelBuilding = true;
+
+  # the game doesn't have an installation procedure
+  installPhase = ''
+    mkdir -p $out/bin
+    cp out/release/host/bin/azimuth $out/bin/azimuth
+    cp out/release/host/bin/editor $out/bin/azimuth-editor
+    cp out/release/host/bin/muse $out/bin/azimuth-muse
+    cp out/release/host/bin/zfxr $out/bin/azimuth-zfxr
+    mkdir -p $out/share/doc/azimuth
+    cp doc/* README.md LICENSE $out/share/doc/azimuth
+    mkdir -p $out/share/icons/hicolor/128x128/apps $out/share/icons/hicolor/64x64/apps $out/share/icons/hicolor/48x48/apps $out/share/icons/hicolor/32x32/apps
+    cp data/icons/icon_128x128.png $out/share/icons/hicolor/128x128/apps/azimuth.png
+    cp data/icons/icon_64x64.png $out/share/icons/hicolor/64x64/apps/azimuth.png
+    cp data/icons/icon_48x48.png $out/share/icons/hicolor/48x48/apps/azimuth.png
+    cp data/icons/icon_32x32.png $out/share/icons/hicolor/32x32/apps/azimuth.png
+    mkdir -p $out/share/applications
+    cp data/azimuth.desktop $out/share/applications
+  '';
+
+  meta = {
+    description = "A metroidvania game using only vectorial graphic";
+    longDescription = ''
+      Azimuth is a metroidvania game, and something of an homage to the previous
+      greats of the genre (Super Metroid in particular). You will need to pilot
+      your ship, explore the inside of the planet, fight enemies, overcome
+      obstacles, and uncover the storyline piece by piece. Azimuth features a
+      huge game world to explore, lots of little puzzles to solve, dozens of
+      weapons and upgrades to find and use, and a wide variety of enemies and
+      bosses to tangle with.
+    '';
+
+    license = stdenv.lib.licenses.gpl3Plus;
+    homepage = https://mdsteele.games/azimuth/index.html;
+    maintainers = with stdenv.lib.maintainers; [ marius851000 ];
+    platforms = stdenv.lib.platforms.linux;
+  };
+
+}
diff --git a/pkgs/misc/screensavers/xautolock/default.nix b/pkgs/misc/screensavers/xautolock/default.nix
index 8edb618b3891..0da198aab789 100644
--- a/pkgs/misc/screensavers/xautolock/default.nix
+++ b/pkgs/misc/screensavers/xautolock/default.nix
@@ -4,7 +4,7 @@
 
 stdenv.mkDerivation rec {
   name = "xautolock-${version}";
-  version = "2.2-6-ge68d0ed";
+  version = "2.2-7-ga23dd5c";
 
   # This repository contains xautolock-2.2 plus various useful patches that
   # were collected from Debian, etc.
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     owner = "peti";
     repo = "xautolock";
     rev = "v${version}";
-    sha256 = "1131ki6zwk94s8j6zqywf8r5kanx3nrjm692rxh8pcz4hv9qp1mz";
+    sha256 = "10j61rl0sx9sh84rjyfyddl73xb5i2cpb17fyrli8kwj39nw0v2g";
   };
 
   nativeBuildInputs = [ imake gccmakedep ];
diff --git a/pkgs/misc/vscode-extensions/cpptools/default.nix b/pkgs/misc/vscode-extensions/cpptools/default.nix
index ca44ccb8cd23..89ed98cd0a79 100644
--- a/pkgs/misc/vscode-extensions/cpptools/default.nix
+++ b/pkgs/misc/vscode-extensions/cpptools/default.nix
@@ -68,8 +68,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "cpptools";
     publisher = "ms-vscode";
-    version = "0.22.1";
-    sha256 = "1f79vbp19k1zm2y5djr4vim0h5y5rnm96rg8fx2h9zb8i559230k";
+    version = "0.23.0";
+    sha256 = "1c7qia60fgak5pisl1qzp2kvm1cs30b29rxpydk7j3lqcpqr5ixj";
   };
 
   buildInputs = [
diff --git a/pkgs/misc/vscode-extensions/wakatime/default.nix b/pkgs/misc/vscode-extensions/wakatime/default.nix
index f4c8ca8647d9..034866d5b2fa 100644
--- a/pkgs/misc/vscode-extensions/wakatime/default.nix
+++ b/pkgs/misc/vscode-extensions/wakatime/default.nix
@@ -8,8 +8,8 @@ in
     mktplcRef = {
       name = "vscode-wakatime";
       publisher = "WakaTime";
-      version = "2.0.9";
-      sha256 = "0fbliim80ydq90c606jhl79fdcmmpb9fs402mvy3g9zmjixspnpb";
+      version = "2.1.0";
+      sha256 = "0a23l8vaj0yghfh9lbi453vjghaxgjmphfjy2s4lgrvq38j4bv9n";
     };
 
     postPatch = ''
diff --git a/pkgs/os-specific/linux/bpftool/default.nix b/pkgs/os-specific/linux/bpftool/default.nix
new file mode 100644
index 000000000000..cc4786ab3848
--- /dev/null
+++ b/pkgs/os-specific/linux/bpftool/default.nix
@@ -0,0 +1,26 @@
+{ stdenv, fetchurl
+, libopcodes, libbfd, libelf
+, linuxPackages_latest
+}:
+
+stdenv.mkDerivation rec {
+  pname = "bpftool";
+  inherit (linuxPackages_latest.kernel) version src;
+
+  buildInputs = [ libopcodes libbfd libelf ];
+
+  preConfigure = ''
+    cd tools/bpf/bpftool
+    substituteInPlace ./Makefile \
+      --replace '/usr/local' "$out" \
+      --replace '/usr'       "$out" \
+      --replace '/sbin'      '/bin'
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Debugging/program analysis tool for the eBPF subsystem";
+    license     = [ licenses.gpl2 licenses.bsd2 ];
+    platforms   = platforms.linux;
+    maintainers = with maintainers; [ thoughtpolice ];
+  };
+}
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 5711e019f95b..58a2429d47c6 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -426,6 +426,12 @@ let
 
       VFIO_PCI_VGA = mkIf stdenv.is64bit yes;
 
+      # VirtualBox guest drivers in the kernel conflict with the ones in the
+      # official additions package and prevent the vboxsf module from loading,
+      # so disable them for now.
+      VBOXGUEST = option no;
+      DRM_VBOXVIDEO = option no;
+
     } // optionalAttrs (stdenv.isx86_64 || stdenv.isi686) ({
       XEN = option yes;
 
diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
index 81143032c917..c6140bd12be0 100644
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@@ -182,9 +182,9 @@ in {
     # incompatibleKernelVersion = "4.19";
 
     # this package should point to a version / git revision compatible with the latest kernel release
-    version = "0.8.0-rc4";
+    version = "0.8.0-rc5";
 
-    sha256 = "02cdxf62758smbqy723yqv8lkch1043alvcwhdnvya21ygcgycnw";
+    sha256 = "1944w36rk33mn44zfvc1qbn2sv9h90r25zxnanwvyhss0vgqw73v";
     isUnstable = true;
 
     extraPatches = [
diff --git a/pkgs/servers/http/nginx/modules.nix b/pkgs/servers/http/nginx/modules.nix
index 6a0114a6ba55..347ac2903787 100644
--- a/pkgs/servers/http/nginx/modules.nix
+++ b/pkgs/servers/http/nginx/modules.nix
@@ -6,8 +6,8 @@ let
     src = fetchFromGitHub {
       owner = "chobits";
       repo = "ngx_http_proxy_connect_module";
-      rev = "8201639082cba702211585b03d4cc7bc51c65167";
-      sha256 = "0z71x3xnlczrr2kq43w3drxj9g14fkk4jz66x921v0yb8r9mnn5a";
+      rev = "18e2520b361ffebde6c08c8119ecfba113a3b53c";
+      sha256 = "1nyil5n2a97nqsqarvnp4bazw4vnxifqizzw5aank4vi9xlq90b2";
     };
 
     patches = [
@@ -32,12 +32,21 @@ in
     inputs = [ pkgs.brotli ];
   };
 
+  coolkit = {
+    src = fetchFromGitHub {
+      owner  = "FRiCKLE";
+      repo   = "ngx_coolkit";
+      rev    = "0.2";
+      sha256 = "1idj0cqmfsdqawjcqpr1fsq670fdki51ksqk2lslfpcs3yrfjpqh";
+    };
+  };
+
   dav = {
     src = fetchFromGitHub {
       owner = "arut";
       repo = "nginx-dav-ext-module";
-      rev = "v0.1.0";
-      sha256 = "1ifahd69vz715g3zim618jbmxb7kcmzykc696grskxm0svpy294k";
+      rev = "v3.0.0";
+      sha256 = "000dm5zk0m1hm1iq60aff5r6y8xmqd7djrwhgnz9ig01xyhnjv9w";
     };
     inputs = [ pkgs.expat ];
   };
@@ -87,6 +96,14 @@ in
     };
   };
 
+  http_proxy_connect_module_v15 = http_proxy_connect_module_generic "proxy_connect_rewrite_1015" // {
+    supports = with lib.versions; version: major version == "1" && minor version == "15";
+  };
+
+  http_proxy_connect_module_v14 = http_proxy_connect_module_generic "proxy_connect_rewrite_1014" // {
+    supports = with lib.versions; version: major version == "1" && minor version == "14";
+  };
+
   ipscrub = {
     src = fetchFromGitHub {
       owner = "masonicboom";
@@ -97,12 +114,30 @@ in
     inputs = [ pkgs.libbsd ];
   };
 
+  limit-speed = {
+    src = fetchFromGitHub {
+      owner = "yaoweibin";
+      repo = "nginx_limit_speed_module";
+      rev = "f77ad4a56fbb134878e75827b40cf801990ed936";
+      sha256 = "0kkrd08zpcwx938i2is07vq6pgjkvn97xzjab0g4zaz8bivgmjp8";
+    };
+  };
+
+  live ={
+    src = fetchFromGitHub {
+      owner = "arut";
+      repo = "nginx-live-module";
+      rev = "5e4a1e3a718e65e5206c24eba00d42b0d1c4b7dd";
+      sha256 = "1kpnhl4b50zim84z22ahqxyxfq4jv8ab85kzsy2n5ciqbyg491lz";
+    };
+  };
+
   lua = {
     src = fetchFromGitHub {
       owner = "openresty";
       repo = "lua-nginx-module";
-      rev = "v0.10.13";
-      sha256 = "19mpc76lfhyyvkfs2n08b4rc9cf2v7rm8fskkf60hsdcf6qna822";
+      rev = "v0.10.14";
+      sha256 = "1vg6pp9n8z42p6f3jqk15gvdyy7mfvs5ssfbiy83bydjx42fq7g0";
     };
     inputs = [ pkgs.luajit ];
     preConfigure = ''
@@ -148,6 +183,24 @@ in
     };
   };
 
+  mpeg-ts ={
+    src = fetchFromGitHub {
+      owner = "arut";
+      repo = "nginx-ts-module";
+      rev = "v0.1.1";
+      sha256 = "12dxcyy6wna1fccl3a9lnsbymd6p4apnwz6c24w74v97qvpfdxqd";
+    };
+  };
+
+  naxsi ={
+    src = fetchFromGitHub {
+      owner = "nbs-system";
+      repo = "naxsi";
+      rev = "0.56";
+      sha256 = "12kn6wbl8xqc19fi05ffprqps4pplg4a6i1cf01xc0d6brx1fg8v";
+    } + "/naxsi_src";
+  };
+
   ngx_aws_auth = {
     src = fetchFromGitHub {
       owner = "anomalizer";
@@ -254,6 +307,24 @@ in
     };
   };
 
+  slowfs-cache = {
+    src = fetchFromGitHub {
+      owner  = "FRiCKLE";
+      repo   = "ngx_slowfs_cache";
+      rev    = "1.10";
+      sha256 = "1gyza02pcws3zqm1phv3ag50db5gnapxyjwy8skjmvawz7p5bmxr";
+    };
+  };
+
+  sorted-querystring = {
+    src = fetchFromGitHub {
+      owner = "wandenberg";
+      repo = "nginx-sorted-querystring-module";
+      rev = "0.3";
+      sha256 = "0p6b0hcws39n27fx4xp9k4hb3pcv7b6kah4qqaj0pzjy3nbp4gj7";
+    };
+  };
+
   statsd = {
     src = fetchFromGitHub {
       owner = "apcera";
@@ -285,8 +356,8 @@ in
     src = fetchFromGitHub {
       owner = "yaoweibin";
       repo = "ngx_http_substitutions_filter_module";
-      rev = "v0.6.4";
-      sha256 = "0q86cv0mfffh43id5xanywyhpd7b0jijrmk8y311c13l9ajrd2rx";
+      rev = "bc58cb11844bc42735bbaef7085ea86ace46d05b";
+      sha256 = "1q5hr3sqys4f365gzjci549rn9ylhgj4xb29ril04zr5vkhzlnar";
     };
   };
 
@@ -303,8 +374,8 @@ in
     src = fetchFromGitHub {
       owner = "yaoweibin";
       repo = "nginx_upstream_check_module";
-      rev = "9aecf15ec379fe98f62355c57b60c0bc83296f04";
-      sha256 = "1cjisxw1wykll683nw09k0i1nvzslp4dr59x58cvarpk43paim2y";
+      rev = "007f76f7adbcbd6abd9352502af1a4ae463def85";
+      sha256 = "1qcg7c9rcl70wr1qf188shnn9s2f7cxnlw05s6scbvlgnf6ik6in";
     };
   };
 
@@ -312,8 +383,8 @@ in
     src = fetchFromGitHub {
       owner = "tarantool";
       repo = "nginx_upstream_module";
-      rev = "v2.7";
-      sha256 = "05dwj0caj910p7kan2qjvm6x2x601igryhny2xzr47hhsk5q1cnx";
+      rev = "v2.7.1";
+      sha256 = "0ya4330in7zjzqw57djv4icpk0n1j98nvf0f8v296yi9rjy054br";
     };
     inputs = [ pkgs.msgpuck.dev pkgs.yajl ];
   };
@@ -327,6 +398,16 @@ in
     };
   };
 
+  video-thumbextractor = {
+    src = fetchFromGitHub {
+      owner = "wandenberg";
+      repo = "nginx-video-thumbextractor-module";
+      rev = "0.9.0";
+      sha256 = "1b0v471mzbcys73pzr7gpvzzhff0cva0l5ff32cv7z1v9c0ypji7";
+    };
+    inputs = [ pkgs.ffmpeg ];
+  };
+
   vts = {
     src = fetchFromGitHub {
       owner = "vozlt";
@@ -335,12 +416,4 @@ in
       sha256 = "1jq2s9k7hah3b317hfn9y3g1q4g4x58k209psrfsqs718a9sw8c7";
     };
   };
-
-  http_proxy_connect_module_v15 = http_proxy_connect_module_generic "proxy_connect_rewrite_1015" // {
-    supports = with lib.versions; version: major version == "1" && minor version == "15";
-  };
-
-  http_proxy_connect_module_v14 = http_proxy_connect_module_generic "proxy_connect_rewrite_1014" // {
-    supports = with lib.versions; version: major version == "1" && minor version == "14";
-  };
 }
diff --git a/pkgs/servers/search/elasticsearch/5.x.nix b/pkgs/servers/search/elasticsearch/5.x.nix
index 0d67988e8208..6142d751dab1 100644
--- a/pkgs/servers/search/elasticsearch/5.x.nix
+++ b/pkgs/servers/search/elasticsearch/5.x.nix
@@ -1,4 +1,5 @@
-{ stdenv, fetchurl, elk5Version, makeWrapper, jre_headless, utillinux }:
+{ stdenv, fetchurl, elk5Version, makeWrapper, jre_headless
+, utillinux, gnugrep, coreutils }:
 
 with stdenv.lib;
 
@@ -23,7 +24,7 @@ stdenv.mkDerivation rec {
 
     wrapProgram $out/bin/elasticsearch \
       --prefix ES_CLASSPATH : "$out/lib/*" \
-      --prefix PATH : "${utillinux}/bin" \
+      --prefix PATH : "${makeBinPath [ utillinux gnugrep coreutils ]}" \
       --set JAVA_HOME "${jre_headless}" \
       --set ES_JVM_OPTIONS "$out/config/jvm.options"
 
diff --git a/pkgs/servers/search/elasticsearch/6.x.nix b/pkgs/servers/search/elasticsearch/6.x.nix
index 73bee6c47f3c..fffc84b2d281 100644
--- a/pkgs/servers/search/elasticsearch/6.x.nix
+++ b/pkgs/servers/search/elasticsearch/6.x.nix
@@ -4,7 +4,7 @@
 , fetchurl
 , makeWrapper
 , jre_headless
-, utillinux
+, utillinux, gnugrep, coreutils
 , autoPatchelfHook
 , zlib
 }:
@@ -45,7 +45,7 @@ stdenv.mkDerivation (rec {
     chmod -x $out/bin/*.*
 
     wrapProgram $out/bin/elasticsearch \
-      --prefix PATH : "${utillinux}/bin/" \
+      --prefix PATH : "${makeBinPath [ utillinux gnugrep coreutils ]}" \
       --set JAVA_HOME "${jre_headless}"
 
     wrapProgram $out/bin/elasticsearch-plugin --set JAVA_HOME "${jre_headless}"
diff --git a/pkgs/servers/search/elasticsearch/7.x.nix b/pkgs/servers/search/elasticsearch/7.x.nix
index a55a43baa0be..ddb1d2299cbb 100644
--- a/pkgs/servers/search/elasticsearch/7.x.nix
+++ b/pkgs/servers/search/elasticsearch/7.x.nix
@@ -4,7 +4,7 @@
 , fetchurl
 , makeWrapper
 , jre_headless
-, utillinux
+, utillinux, gnugrep, coreutils
 , autoPatchelfHook
 , zlib
 }:
@@ -56,7 +56,7 @@ stdenv.mkDerivation (rec {
     chmod +x $out/bin/*
 
     wrapProgram $out/bin/elasticsearch \
-      --prefix PATH : "${utillinux}/bin/" \
+      --prefix PATH : "${makeBinPath [ utillinux coreutils gnugrep ]}" \
       --set JAVA_HOME "${jre_headless}"
 
     wrapProgram $out/bin/elasticsearch-plugin --set JAVA_HOME "${jre_headless}"
diff --git a/pkgs/tools/misc/coreutils/coreutils-8.31-musl-cross.patch b/pkgs/tools/misc/coreutils/coreutils-8.31-musl-cross.patch
new file mode 100644
index 000000000000..02b0b85db312
--- /dev/null
+++ b/pkgs/tools/misc/coreutils/coreutils-8.31-musl-cross.patch
@@ -0,0 +1,1153 @@
+From 453ff940449bbbde9ec00f0bbf82a359c5598fc7 Mon Sep 17 00:00:00 2001
+From: Bruno Haible <bruno@clisp.org>
+Date: Sat, 23 Mar 2019 23:00:52 +0100
+Subject: [PATCH 1/1] Support cross-compilation to musl libc.
+
+Reported by Necktwi Ozfguah <necktwi@ferryfair.com>.
+
+* m4/calloc.m4 (_AC_FUNC_CALLOC_IF): Add cross-compilation guesses for
+musl libc.
+* m4/canonicalize.m4 (gl_FUNC_REALPATH_WORKS): Likewise.
+* m4/chown.m4 (gl_FUNC_CHOWN): Likewise.
+* m4/d-ino.m4 (gl_CHECK_TYPE_STRUCT_DIRENT_D_INO): Likewise.
+* m4/fdopendir.m4 (gl_FUNC_FDOPENDIR): Likewise.
+* m4/fnmatch.m4 (gl_FUNC_FNMATCH_POSIX): Likewise.
+* m4/fpurge.m4 (gl_FUNC_FPURGE): Likewise.
+* m4/getcwd.m4 (gl_FUNC_GETCWD_NULL): Likewise.
+* m4/getcwd-abort-bug.m4 (gl_FUNC_GETCWD_ABORT_BUG): Likewise.
+* m4/getdelim.m4 (gl_FUNC_GETDELIM): Likewise.
+* m4/getgroups.m4 (AC_FUNC_GETGROUPS, gl_FUNC_GETGROUPS): Likewise.
+* m4/getline.m4 (gl_FUNC_GETLINE): Likewise.
+* m4/gettimeofday.m4 (gl_FUNC_GETTIMEOFDAY_CLOBBER): Likewise.
+* m4/hypot.m4 (gl_FUNC_HYPOT): Likewise.  // removed
+* m4/hypotf.m4 (gl_FUNC_HYPOTF): Likewise.  // removed
+* m4/hypotl.m4 (gl_FUNC_HYPOTL): Likewise.  // removed
+* m4/iconv_open-utf.m4 (gl_FUNC_ICONV_OPEN_UTF_SUPPORT): Likewise.  // removed
+* m4/link-follow.m4 (gl_FUNC_LINK_FOLLOWS_SYMLINK): Likewise.
+* m4/log.m4 (gl_FUNC_LOG): Likewise.  // removed
+* m4/logf.m4 (gl_FUNC_LOGF): Likewise.  // removed
+* m4/logl.m4 (gl_FUNC_LOGL_WORKS): Likewise.  // removed
+* m4/log10.m4 (gl_FUNC_LOG10): Likewise.  // removed
+* m4/log10f.m4 (gl_FUNC_LOG10F): Likewise.  // removed
+* m4/log10l.m4 (gl_FUNC_LOG10L): Likewise.  // removed
+* m4/log1p.m4 (gl_FUNC_LOG1P): Likewise.  // removed
+* m4/log1pf.m4 (gl_FUNC_LOG1PF): Likewise.  // removed
+* m4/log1pl.m4 (gl_FUNC_LOG1PL): Likewise.  // removed
+* m4/log2.m4 (gl_FUNC_LOG2): Likewise.  // removed
+* m4/log2f.m4 (gl_FUNC_LOG2F): Likewise.  // removed
+* m4/malloc.m4 (_AC_FUNC_MALLOC_IF): Likewise.
+* m4/mkdir.m4 (gl_FUNC_MKDIR): Likewise.
+* m4/mkstemp.m4 (gl_FUNC_MKSTEMP): Likewise.
+* m4/modf.m4 (gl_FUNC_MODF): Likewise.  // removed
+* m4/modff.m4 (gl_FUNC_MODFF): Likewise.  // removed
+* m4/modfl.m4 (gl_FUNC_MODFL): Likewise.  // removed
+* m4/perror.m4 (gl_FUNC_PERROR): Likewise.
+* m4/printf.m4 (gl_PRINTF_SIZES_C99, gl_PRINTF_INFINITE,
+gl_PRINTF_INFINITE_LONG_DOUBLE, gl_PRINTF_DIRECTIVE_A,
+gl_PRINTF_DIRECTIVE_F, gl_PRINTF_FLAG_ZERO, gl_SNPRINTF_TRUNCATION_C99,
+gl_SNPRINTF_RETVAL_C99, gl_SNPRINTF_DIRECTIVE_N,
+gl_VSNPRINTF_ZEROSIZE_C99): Likewise.
+* m4/ptsname.m4 (gl_FUNC_PTSNAME): Likewise.  // removed
+* m4/putenv.m4 (gl_FUNC_PUTENV): Likewise.
+* m4/realloc.m4 (_AC_FUNC_REALLOC_IF): Likewise.
+* m4/remainder.m4 (gl_FUNC_REMAINDER): Likewise.  // removed
+* m4/remainderf.m4 (gl_FUNC_REMAINDERF): Likewise.  // removed
+* m4/remainderl.m4 (gl_FUNC_REMAINDERL): Likewise.  // removed
+* m4/rintl.m4 (gl_FUNC_RINTL): Likewise.  // removed
+* m4/round.m4 (gl_FUNC_ROUND): Likewise.  // removed
+* m4/roundf.m4 (gl_FUNC_ROUNDF): Likewise.  // removed
+* m4/roundl.m4 (gl_FUNC_ROUNDL): Likewise.  // removed
+* m4/setenv.m4 (gl_FUNC_SETENV): Likewise.
+* m4/signbit.m4 (gl_SIGNBIT): Likewise.
+* m4/sleep.m4 (gl_FUNC_SLEEP): Likewise.
+* m4/stpncpy.m4 (gl_FUNC_STPNCPY): Likewise.
+* m4/strerror.m4 (gl_FUNC_STRERROR, gl_FUNC_STRERROR_0): Likewise.
+* m4/strtod.m4 (gl_FUNC_STRTOD): Likewise.
+* m4/strtold.m4 (gl_FUNC_STRTOLD): Likewise.
+* m4/trunc.m4 (gl_FUNC_TRUNC): Likewise.    // removed
+* m4/truncf.m4 (gl_FUNC_TRUNCF): Likewise.  // removed
+* m4/truncl.m4 (gl_FUNC_TRUNCL): Likewise.  // removed
+* m4/tzset.m4 (gl_FUNC_TZSET_CLOBBER): Likewise.
+* m4/ungetc.m4 (gl_FUNC_UNGETC_WORKS): Likewise.
+* m4/usleep.m4 (gl_FUNC_USLEEP): Likewise.
+* m4/utimes.m4 (gl_FUNC_UTIMES): Likewise.
+* m4/wcwidth.m4 (gl_FUNC_WCWIDTH): Likewise.
+---
+ m4/calloc.m4           |  4 ++-
+ m4/canonicalize.m4     |  4 ++-
+ m4/chown.m4            | 22 +++++++------
+ m4/d-ino.m4            | 16 +++++-----
+ m4/fdopendir.m4        | 12 ++++---
+ m4/fnmatch.m4          | 18 ++++++++---
+ m4/fpurge.m4           | 24 +++++++++-----
+ m4/getcwd-abort-bug.m4 | 11 +++++--
+ m4/getcwd.m4           |  4 ++-
+ m4/getdelim.m4         | 40 ++++++++++++++----------
+ m4/getgroups.m4        |  6 +++-
+ m4/getline.m4          | 38 +++++++++++++---------
+ m4/gettimeofday.m4     |  4 ++-
+ m4/link-follow.m4      |  4 ++-
+ m4/malloc.m4           |  4 +--
+ m4/mkdir.m4            |  4 ++-
+ m4/mkstemp.m4          |  4 ++-
+ m4/perror.m4           | 12 ++++---
+ m4/printf.m4           | 22 ++++++++++++-
+ m4/putenv.m4           |  4 ++-
+ m4/realloc.m4          |  4 +--
+ m4/setenv.m4           |  4 ++-
+ m4/signbit.m4          |  6 +++-
+ m4/sleep.m4            |  4 ++-
+ m4/stpncpy.m4          | 14 +++++++--
+ m4/strerror.m4         |  6 +++-
+ m4/strtod.m4           | 10 +++---
+ m4/strtold.m4          |  9 ++++--
+ m4/tzset.m4            |  4 ++-
+ m4/ungetc.m4           | 18 ++++++-----
+ m4/usleep.m4           |  4 ++-
+ m4/utimes.m4           | 10 +++---
+ m4/wcwidth.m4          | 12 ++++---
+ 76 files changed, 461 insertions(+), 157 deletions(-)
+
+diff --git a/m4/calloc.m4 b/m4/calloc.m4
+index 012a5bf..d76535d 100644
+--- a/m4/calloc.m4
++++ b/m4/calloc.m4
+@@ -1,4 +1,4 @@
+-# calloc.m4 serial 18
++# calloc.m4 serial 19
+
+ # Copyright (C) 2004-2019 Free Software Foundation, Inc.
+ # This file is free software; the Free Software Foundation
+@@ -40,6 +40,8 @@ AC_DEFUN([_AC_FUNC_CALLOC_IF],
+        [case "$host_os" in
+                          # Guess yes on glibc systems.
+           *-gnu* | gnu*) ac_cv_func_calloc_0_nonnull="guessing yes" ;;
++                         # Guess yes on musl systems.
++          *-musl*)       ac_cv_func_calloc_0_nonnull="guessing yes" ;;
+                          # Guess yes on native Windows.
+           mingw*)        ac_cv_func_calloc_0_nonnull="guessing yes" ;;
+                          # If we don't know, assume the worst.
+diff --git a/m4/canonicalize.m4 b/m4/canonicalize.m4
+index 5b6e25d..b61747b 100644
+--- a/m4/canonicalize.m4
++++ b/m4/canonicalize.m4
+@@ -1,4 +1,4 @@
+-# canonicalize.m4 serial 29
++# canonicalize.m4 serial 30
+
+ dnl Copyright (C) 2003-2007, 2009-2019 Free Software Foundation, Inc.
+
+@@ -113,6 +113,8 @@ AC_DEFUN([gl_FUNC_REALPATH_WORKS],
+      [case "$host_os" in
+                        # Guess yes on glibc systems.
+         *-gnu* | gnu*) gl_cv_func_realpath_works="guessing yes" ;;
++                       # Guess yes on musl systems.
++        *-musl*)       gl_cv_func_realpath_works="guessing yes" ;;
+                        # Guess no on native Windows.
+         mingw*)        gl_cv_func_realpath_works="guessing no" ;;
+                        # If we don't know, assume the worst.
+diff --git a/m4/chown.m4 b/m4/chown.m4
+index ecfc0c0..b798325 100644
+--- a/m4/chown.m4
++++ b/m4/chown.m4
+@@ -1,4 +1,4 @@
+-# serial 30
++# serial 32
+ # Determine whether we need the chown wrapper.
+
+ dnl Copyright (C) 1997-2001, 2003-2005, 2007, 2009-2019 Free Software
+@@ -109,10 +109,12 @@ AC_DEFUN_ONCE([gl_FUNC_CHOWN],
+         [gl_cv_func_chown_slash_works=yes],
+         [gl_cv_func_chown_slash_works=no],
+         [case "$host_os" in
+-                   # Guess yes on glibc systems.
+-           *-gnu*) gl_cv_func_chown_slash_works="guessing yes" ;;
+-                   # If we don't know, assume the worst.
+-           *)      gl_cv_func_chown_slash_works="guessing no" ;;
++                    # Guess yes on glibc systems.
++           *-gnu*)  gl_cv_func_chown_slash_works="guessing yes" ;;
++                    # Guess yes on musl systems.
++           *-musl*) gl_cv_func_chown_slash_works="guessing yes" ;;
++                    # If we don't know, assume the worst.
++           *)       gl_cv_func_chown_slash_works="guessing no" ;;
+          esac
+         ])
+       rm -f conftest.link conftest.file])
+@@ -145,10 +147,12 @@ AC_DEFUN_ONCE([gl_FUNC_CHOWN],
+         [gl_cv_func_chown_ctime_works=yes],
+         [gl_cv_func_chown_ctime_works=no],
+         [case "$host_os" in
+-                   # Guess yes on glibc systems.
+-           *-gnu*) gl_cv_func_chown_ctime_works="guessing yes" ;;
+-                   # If we don't know, assume the worst.
+-           *)      gl_cv_func_chown_ctime_works="guessing no" ;;
++                    # Guess yes on glibc systems.
++           *-gnu*)  gl_cv_func_chown_ctime_works="guessing yes" ;;
++                    # Guess yes on musl systems.
++           *-musl*) gl_cv_func_chown_ctime_works="guessing yes" ;;
++                    # If we don't know, assume the worst.
++           *)       gl_cv_func_chown_ctime_works="guessing no" ;;
+          esac
+         ])
+       rm -f conftest.file])
+diff --git a/m4/d-ino.m4 b/m4/d-ino.m4
+index f1420cc..87dcacc 100644
+--- a/m4/d-ino.m4
++++ b/m4/d-ino.m4
+@@ -1,4 +1,4 @@
+-# serial 18
++# serial 19
+
+ dnl From Jim Meyering.
+ dnl
+@@ -40,12 +40,14 @@ AC_DEFUN([gl_CHECK_TYPE_STRUCT_DIRENT_D_INO],
+            [gl_cv_struct_dirent_d_ino=yes],
+            [gl_cv_struct_dirent_d_ino=no],
+            [case "$host_os" in
+-                           # Guess yes on glibc systems with Linux kernel.
+-              linux*-gnu*) gl_cv_struct_dirent_d_ino="guessing yes" ;;
+-                           # Guess no on native Windows.
+-              mingw*)      gl_cv_struct_dirent_d_ino="guessing no" ;;
+-                           # If we don't know, assume the worst.
+-              *)           gl_cv_struct_dirent_d_ino="guessing no" ;;
++                            # Guess yes on glibc systems with Linux kernel.
++              linux*-gnu*)  gl_cv_struct_dirent_d_ino="guessing yes" ;;
++                            # Guess yes on musl systems with Linux kernel.
++              linux*-musl*) gl_cv_struct_dirent_d_ino="guessing yes" ;;
++                            # Guess no on native Windows.
++              mingw*)       gl_cv_struct_dirent_d_ino="guessing no" ;;
++                            # If we don't know, assume the worst.
++              *)            gl_cv_struct_dirent_d_ino="guessing no" ;;
+             esac
+            ])])
+    case "$gl_cv_struct_dirent_d_ino" in
+diff --git a/m4/fdopendir.m4 b/m4/fdopendir.m4
+index 0490551..b2b3b03 100644
+--- a/m4/fdopendir.m4
++++ b/m4/fdopendir.m4
+@@ -1,4 +1,4 @@
+-# serial 10
++# serial 11
+ # See if we need to provide fdopendir.
+
+ dnl Copyright (C) 2009-2019 Free Software Foundation, Inc.
+@@ -45,10 +45,12 @@ DIR *fdopendir (int);
+          [gl_cv_func_fdopendir_works=yes],
+          [gl_cv_func_fdopendir_works=no],
+          [case "$host_os" in
+-                    # Guess yes on glibc systems.
+-            *-gnu*) gl_cv_func_fdopendir_works="guessing yes" ;;
+-                    # If we don't know, assume the worst.
+-            *)      gl_cv_func_fdopendir_works="guessing no" ;;
++                     # Guess yes on glibc systems.
++            *-gnu*)  gl_cv_func_fdopendir_works="guessing yes" ;;
++                     # Guess yes on musl systems.
++            *-musl*) gl_cv_func_fdopendir_works="guessing yes" ;;
++                     # If we don't know, assume the worst.
++            *)       gl_cv_func_fdopendir_works="guessing no" ;;
+           esac
+          ])])
+     case "$gl_cv_func_fdopendir_works" in
+diff --git a/m4/fnmatch.m4 b/m4/fnmatch.m4
+index c264ca7..75ba55b 100644
+--- a/m4/fnmatch.m4
++++ b/m4/fnmatch.m4
+@@ -1,4 +1,4 @@
+-# Check for fnmatch - serial 13.  -*- coding: utf-8 -*-
++# Check for fnmatch - serial 14.  -*- coding: utf-8 -*-
+
+ # Copyright (C) 2000-2007, 2009-2019 Free Software Foundation, Inc.
+ # This file is free software; the Free Software Foundation
+@@ -14,6 +14,7 @@ AC_DEFUN([gl_FUNC_FNMATCH_POSIX],
+   m4_divert_text([DEFAULTS], [gl_fnmatch_required=POSIX])
+
+   AC_REQUIRE([gl_FNMATCH_H])
++  AC_REQUIRE([AC_CANONICAL_HOST]) dnl for cross-compiles
+   gl_fnmatch_required_lowercase=`
+     echo $gl_fnmatch_required | LC_ALL=C tr '[[A-Z]]' '[[a-z]]'
+   `
+@@ -117,12 +118,19 @@ AC_DEFUN([gl_FUNC_FNMATCH_POSIX],
+             ]])],
+          [eval "$gl_fnmatch_cache_var=yes"],
+          [eval "$gl_fnmatch_cache_var=no"],
+-         [eval "$gl_fnmatch_cache_var=\"guessing no\""])
++         [case "$host_os" in
++                     # Guess yes on musl systems.
++            *-musl*) eval "$gl_fnmatch_cache_var=\"guessing yes\"" ;;
++                     # Guess no otherwise, even on glibc systems.
++            *)       eval "$gl_fnmatch_cache_var=\"guessing no\"" ;;
++          esac
++         ])
+       ])
+     eval "gl_fnmatch_result=\"\$$gl_fnmatch_cache_var\""
+-    if test "$gl_fnmatch_result" != yes; then
+-      REPLACE_FNMATCH=1
+-    fi
++    case "$gl_fnmatch_result" in
++      *yes) ;;
++      *) REPLACE_FNMATCH=1 ;;
++    esac
+   fi
+   if test $HAVE_FNMATCH = 0 || test $REPLACE_FNMATCH = 1; then
+     gl_REPLACE_FNMATCH_H
+diff --git a/m4/fpurge.m4 b/m4/fpurge.m4
+index cb21f56..6c5b3e9 100644
+--- a/m4/fpurge.m4
++++ b/m4/fpurge.m4
+@@ -1,4 +1,4 @@
+-# fpurge.m4 serial 8
++# fpurge.m4 serial 9
+ dnl Copyright (C) 2007, 2009-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -7,12 +7,13 @@ dnl with or without modifications, as long as this notice is preserved.
+ AC_DEFUN([gl_FUNC_FPURGE],
+ [
+   AC_REQUIRE([gl_STDIO_H_DEFAULTS])
++  AC_REQUIRE([AC_CANONICAL_HOST]) dnl for cross-compiles
+   AC_CHECK_FUNCS_ONCE([fpurge])
+   AC_CHECK_FUNCS_ONCE([__fpurge])
+   AC_CHECK_DECLS([fpurge], , , [[#include <stdio.h>]])
+   if test "x$ac_cv_func_fpurge" = xyes; then
+     HAVE_FPURGE=1
+-    # Detect BSD bug.  Only cygwin 1.7 is known to be immune.
++    # Detect BSD bug.  Only cygwin 1.7 and musl are known to be immune.
+     AC_CACHE_CHECK([whether fpurge works], [gl_cv_func_fpurge_works],
+       [AC_RUN_IFELSE(
+          [AC_LANG_PROGRAM(
+@@ -48,11 +49,20 @@ AC_DEFUN([gl_FUNC_FPURGE],
+                return 13;
+              return 0;
+             ])],
+-      [gl_cv_func_fpurge_works=yes], [gl_cv_func_fpurge_works=no],
+-      [gl_cv_func_fpurge_works='guessing no'])])
+-    if test "x$gl_cv_func_fpurge_works" != xyes; then
+-      REPLACE_FPURGE=1
+-    fi
++         [gl_cv_func_fpurge_works=yes],
++         [gl_cv_func_fpurge_works=no],
++         [case "$host_os" in
++                     # Guess yes on musl systems.
++            *-musl*) gl_cv_func_fpurge_works="guessing yes" ;;
++                     # Guess no otherwise.
++            *)       gl_cv_func_fpurge_works="guessing no" ;;
++          esac
++         ])
++      ])
++    case "$gl_cv_func_fpurge_works" in
++      *yes) ;;
++      *) REPLACE_FPURGE=1 ;;
++    esac
+   else
+     HAVE_FPURGE=0
+   fi
+diff --git a/m4/getcwd-abort-bug.m4 b/m4/getcwd-abort-bug.m4
+index f0f24a5..7227f08 100644
+--- a/m4/getcwd-abort-bug.m4
++++ b/m4/getcwd-abort-bug.m4
+@@ -1,4 +1,4 @@
+-# serial 9
++# serial 11
+ # Determine whether getcwd aborts when the length of the working directory
+ # name is unusually large.  Any length between 4k and 16k trigger the bug
+ # when using glibc-2.4.90-9 or older.
+@@ -13,6 +13,7 @@
+ # gl_FUNC_GETCWD_ABORT_BUG([ACTION-IF-FOUND[, ACTION-IF-NOT-FOUND]])
+ AC_DEFUN([gl_FUNC_GETCWD_ABORT_BUG],
+ [
++  AC_REQUIRE([AC_CANONICAL_HOST]) dnl for cross-compiles
+   AC_CHECK_DECLS_ONCE([getcwd])
+   AC_CHECK_HEADERS_ONCE([unistd.h])
+   AC_REQUIRE([gl_PATHMAX_SNIPPET_PREREQ])
+@@ -142,7 +143,13 @@ main ()
+         else
+           gl_cv_func_getcwd_abort_bug=no
+         fi],
+-       [gl_cv_func_getcwd_abort_bug=yes])
++       [case "$host_os" in
++                   # Guess no on musl systems.
++          *-musl*) gl_cv_func_getcwd_abort_bug="guessing no" ;;
++                   # Guess yes otherwise, even on glibc systems.
++          *)       gl_cv_func_getcwd_abort_bug="guessing yes"
++        esac
++       ])
+     ])
+   AS_IF([test $gl_cv_func_getcwd_abort_bug = yes], [$1], [$2])
+ ])
+diff --git a/m4/getcwd.m4 b/m4/getcwd.m4
+index 4929b51..625171a 100644
+--- a/m4/getcwd.m4
++++ b/m4/getcwd.m4
+@@ -6,7 +6,7 @@
+ # with or without modifications, as long as this notice is preserved.
+
+ # Written by Paul Eggert.
+-# serial 16
++# serial 17
+
+ AC_DEFUN([gl_FUNC_GETCWD_NULL],
+   [
+@@ -50,6 +50,8 @@ AC_DEFUN([gl_FUNC_GETCWD_NULL],
+         [[case "$host_os" in
+                            # Guess yes on glibc systems.
+             *-gnu* | gnu*) gl_cv_func_getcwd_null="guessing yes";;
++                           # Guess yes on musl systems.
++            *-musl*)       gl_cv_func_getcwd_null="guessing yes";;
+                            # Guess yes on Cygwin.
+             cygwin*)       gl_cv_func_getcwd_null="guessing yes";;
+                            # If we don't know, assume the worst.
+diff --git a/m4/getdelim.m4 b/m4/getdelim.m4
+index bf17c57..e77c379 100644
+--- a/m4/getdelim.m4
++++ b/m4/getdelim.m4
+@@ -1,4 +1,4 @@
+-# getdelim.m4 serial 12
++# getdelim.m4 serial 13
+
+ dnl Copyright (C) 2005-2007, 2009-2019 Free Software Foundation, Inc.
+ dnl
+@@ -11,6 +11,7 @@ AC_PREREQ([2.59])
+ AC_DEFUN([gl_FUNC_GETDELIM],
+ [
+   AC_REQUIRE([gl_STDIO_H_DEFAULTS])
++  AC_REQUIRE([AC_CANONICAL_HOST]) dnl for cross-compiles
+
+   dnl Persuade glibc <stdio.h> to declare getdelim().
+   AC_REQUIRE([AC_USE_SYSTEM_EXTENSIONS])
+@@ -21,9 +22,10 @@ AC_DEFUN([gl_FUNC_GETDELIM],
+   if test $ac_cv_func_getdelim = yes; then
+     HAVE_GETDELIM=1
+     dnl Found it in some library.  Verify that it works.
+-    AC_CACHE_CHECK([for working getdelim function], [gl_cv_func_working_getdelim],
+-    [echo fooNbarN | tr -d '\012' | tr N '\012' > conftest.data
+-    AC_RUN_IFELSE([AC_LANG_SOURCE([[
++    AC_CACHE_CHECK([for working getdelim function],
++      [gl_cv_func_working_getdelim],
++      [echo fooNbarN | tr -d '\012' | tr N '\012' > conftest.data
++       AC_RUN_IFELSE([AC_LANG_SOURCE([[
+ #    include <stdio.h>
+ #    include <stdlib.h>
+ #    include <string.h>
+@@ -53,25 +55,31 @@ AC_DEFUN([gl_FUNC_GETDELIM],
+       fclose (in);
+       return 0;
+     }
+-    ]])], [gl_cv_func_working_getdelim=yes] dnl The library version works.
+-    , [gl_cv_func_working_getdelim=no] dnl The library version does NOT work.
+-    , dnl We're cross compiling. Assume it works on glibc2 systems.
+-      [AC_EGREP_CPP([Lucky GNU user],
+-         [
++    ]])],
++         [gl_cv_func_working_getdelim=yes],
++         [gl_cv_func_working_getdelim=no],
++         [dnl We're cross compiling.
++          dnl Guess it works on glibc2 systems and musl systems.
++          AC_EGREP_CPP([Lucky GNU user],
++            [
+ #include <features.h>
+ #ifdef __GNU_LIBRARY__
+  #if (__GLIBC__ >= 2) && !defined __UCLIBC__
+   Lucky GNU user
+  #endif
+ #endif
+-         ],
+-         [gl_cv_func_working_getdelim="guessing yes"],
+-         [gl_cv_func_working_getdelim="guessing no"])]
+-    )])
++            ],
++            [gl_cv_func_working_getdelim="guessing yes"],
++            [case "$host_os" in
++               *-musl*) gl_cv_func_working_getdelim="guessing yes" ;;
++               *)       gl_cv_func_working_getdelim="guessing no" ;;
++             esac
++            ])
++         ])
++      ])
+     case "$gl_cv_func_working_getdelim" in
+-      *no)
+-        REPLACE_GETDELIM=1
+-        ;;
++      *yes) ;;
++      *) REPLACE_GETDELIM=1 ;;
+     esac
+   else
+     HAVE_GETDELIM=0
+diff --git a/m4/getgroups.m4 b/m4/getgroups.m4
+index 2ce986e..c93447b 100644
+--- a/m4/getgroups.m4
++++ b/m4/getgroups.m4
+@@ -1,4 +1,4 @@
+-# serial 21
++# serial 22
+
+ dnl From Jim Meyering.
+ dnl A wrapper around AC_FUNC_GETGROUPS.
+@@ -42,6 +42,8 @@ AC_DEFUN([AC_FUNC_GETGROUPS],
+          [case "$host_os" in # ((
+                            # Guess yes on glibc systems.
+             *-gnu* | gnu*) ac_cv_func_getgroups_works="guessing yes" ;;
++                           # Guess yes on musl systems.
++            *-musl*)       ac_cv_func_getgroups_works="guessing yes" ;;
+                            # If we don't know, assume the worst.
+             *)             ac_cv_func_getgroups_works="guessing no" ;;
+           esac
+@@ -95,6 +97,8 @@ AC_DEFUN([gl_FUNC_GETGROUPS],
+           [case "$host_os" in
+                             # Guess yes on glibc systems.
+              *-gnu* | gnu*) gl_cv_func_getgroups_works="guessing yes" ;;
++                            # Guess yes on musl systems.
++             *-musl*)       gl_cv_func_getgroups_works="guessing yes" ;;
+                             # If we don't know, assume the worst.
+              *)             gl_cv_func_getgroups_works="guessing no" ;;
+            esac
+diff --git a/m4/getline.m4 b/m4/getline.m4
+index 5b2ead2..32f771c 100644
+--- a/m4/getline.m4
++++ b/m4/getline.m4
+@@ -1,4 +1,4 @@
+-# getline.m4 serial 28
++# getline.m4 serial 29
+
+ dnl Copyright (C) 1998-2003, 2005-2007, 2009-2019 Free Software Foundation,
+ dnl Inc.
+@@ -16,6 +16,7 @@ dnl to do with the function we need.
+ AC_DEFUN([gl_FUNC_GETLINE],
+ [
+   AC_REQUIRE([gl_STDIO_H_DEFAULTS])
++  AC_REQUIRE([AC_CANONICAL_HOST]) dnl for cross-compiles
+
+   dnl Persuade glibc <stdio.h> to declare getline().
+   AC_REQUIRE([AC_USE_SYSTEM_EXTENSIONS])
+@@ -28,9 +29,10 @@ AC_DEFUN([gl_FUNC_GETLINE],
+                  gl_getline_needs_run_time_check=yes],
+                 [am_cv_func_working_getline=no])
+   if test $gl_getline_needs_run_time_check = yes; then
+-    AC_CACHE_CHECK([for working getline function], [am_cv_func_working_getline],
+-    [echo fooNbarN | tr -d '\012' | tr N '\012' > conftest.data
+-    AC_RUN_IFELSE([AC_LANG_SOURCE([[
++    AC_CACHE_CHECK([for working getline function],
++      [am_cv_func_working_getline],
++      [echo fooNbarN | tr -d '\012' | tr N '\012' > conftest.data
++       AC_RUN_IFELSE([AC_LANG_SOURCE([[
+ #    include <stdio.h>
+ #    include <stdlib.h>
+ #    include <string.h>
+@@ -61,21 +63,28 @@ AC_DEFUN([gl_FUNC_GETLINE],
+       fclose (in);
+       return 0;
+     }
+-    ]])], [am_cv_func_working_getline=yes] dnl The library version works.
+-    , [am_cv_func_working_getline=no] dnl The library version does NOT work.
+-    , dnl We're cross compiling. Assume it works on glibc2 systems.
+-      [AC_EGREP_CPP([Lucky GNU user],
+-         [
++    ]])],
++         [am_cv_func_working_getline=yes],
++         [am_cv_func_working_getline=no],
++         [dnl We're cross compiling.
++          dnl Guess it works on glibc2 systems and musl systems.
++          AC_EGREP_CPP([Lucky GNU user],
++            [
+ #include <features.h>
+ #ifdef __GNU_LIBRARY__
+  #if (__GLIBC__ >= 2) && !defined __UCLIBC__
+   Lucky GNU user
+  #endif
+ #endif
+-         ],
+-         [am_cv_func_working_getline="guessing yes"],
+-         [am_cv_func_working_getline="guessing no"])]
+-    )])
++            ],
++            [am_cv_func_working_getline="guessing yes"],
++            [case "$host_os" in
++               *-musl*) am_cv_func_working_getline="guessing yes" ;;
++               *)       am_cv_func_working_getline="guessing no" ;;
++             esac
++            ])
++         ])
++      ])
+   fi
+
+   if test $ac_cv_have_decl_getline = no; then
+@@ -83,7 +92,8 @@ AC_DEFUN([gl_FUNC_GETLINE],
+   fi
+
+   case "$am_cv_func_working_getline" in
+-    *no)
++    *yes) ;;
++    *)
+       dnl Set REPLACE_GETLINE always: Even if we have not found the broken
+       dnl getline function among $LIBS, it may exist in libinet and the
+       dnl executable may be linked with -linet.
+diff --git a/m4/gettimeofday.m4 b/m4/gettimeofday.m4
+index d29b4bf..5e2ef6f 100644
+--- a/m4/gettimeofday.m4
++++ b/m4/gettimeofday.m4
+@@ -1,4 +1,4 @@
+-# serial 25
++# serial 26
+
+ # Copyright (C) 2001-2003, 2005, 2007, 2009-2019 Free Software Foundation, Inc.
+ # This file is free software; the Free Software Foundation
+@@ -105,6 +105,8 @@ AC_DEFUN([gl_FUNC_GETTIMEOFDAY_CLOBBER],
+       case "$host_os" in
+                        # Guess all is fine on glibc systems.
+         *-gnu* | gnu*) gl_cv_func_gettimeofday_clobber="guessing no" ;;
++                       # Guess all is fine on musl systems.
++        *-musl*)       gl_cv_func_gettimeofday_clobber="guessing no" ;;
+                        # Guess no on native Windows.
+         mingw*)        gl_cv_func_gettimeofday_clobber="guessing no" ;;
+                        # If we don't know, assume the worst.
+diff --git a/m4/link-follow.m4 b/m4/link-follow.m4
+index cbd2dca..8ac7301 100644
+--- a/m4/link-follow.m4
++++ b/m4/link-follow.m4
+@@ -1,4 +1,4 @@
+-# serial 20
++# serial 21
+ dnl Run a program to determine whether link(2) follows symlinks.
+ dnl Set LINK_FOLLOWS_SYMLINKS accordingly.
+
+@@ -88,6 +88,8 @@ AC_DEFUN([gl_FUNC_LINK_FOLLOWS_SYMLINK],
+             case "$host_os" in
+                                   # On glibc/Linux we know the result.
+               linux*-gnu* | gnu*) gl_cv_func_link_follows_symlink="guessing no" ;;
++                                  # On musl/Linux we know the result.
++              linux*-musl*)       gl_cv_func_link_follows_symlink="guessing no" ;;
+                                   # Otherwise, we don't know.
+               *)                  gl_cv_func_link_follows_symlink=unknown ;;
+             esac
+diff --git a/m4/malloc.m4 b/m4/malloc.m4
+index b9b8d4b..c469c45 100644
+--- a/m4/malloc.m4
++++ b/m4/malloc.m4
+@@ -1,4 +1,4 @@
+-# malloc.m4 serial 17
++# malloc.m4 serial 19
+ dnl Copyright (C) 2007, 2009-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -32,7 +32,7 @@ AC_DEFUN([_AC_FUNC_MALLOC_IF],
+        [ac_cv_func_malloc_0_nonnull=no],
+        [case "$host_os" in
+           # Guess yes on platforms where we know the result.
+-          *-gnu* | gnu* | freebsd* | netbsd* | openbsd* \
++          *-gnu* | gnu* | *-musl* | freebsd* | netbsd* | openbsd* \
+           | hpux* | solaris* | cygwin* | mingw*)
+             ac_cv_func_malloc_0_nonnull="guessing yes" ;;
+           # If we don't know, assume the worst.
+diff --git a/m4/mkdir.m4 b/m4/mkdir.m4
+index 4cd9590..366a3cd 100644
+--- a/m4/mkdir.m4
++++ b/m4/mkdir.m4
+@@ -1,4 +1,4 @@
+-# serial 14
++# serial 15
+
+ # Copyright (C) 2001, 2003-2004, 2006, 2008-2019 Free Software Foundation, Inc.
+ # This file is free software; the Free Software Foundation
+@@ -62,6 +62,8 @@ AC_DEFUN([gl_FUNC_MKDIR],
+       [case "$host_os" in
+                         # Guess yes on glibc systems.
+          *-gnu* | gnu*) gl_cv_func_mkdir_trailing_dot_works="guessing yes" ;;
++                        # Guess yes on musl systems.
++         *-musl*)       gl_cv_func_mkdir_trailing_dot_works="guessing yes" ;;
+                         # Guess no on native Windows.
+          mingw*)        gl_cv_func_mkdir_trailing_dot_works="guessing no" ;;
+                         # If we don't know, assume the worst.
+diff --git a/m4/mkstemp.m4 b/m4/mkstemp.m4
+index ae24c3b..1b15c2e 100644
+--- a/m4/mkstemp.m4
++++ b/m4/mkstemp.m4
+@@ -1,4 +1,4 @@
+-#serial 25
++#serial 26
+
+ # Copyright (C) 2001, 2003-2007, 2009-2019 Free Software Foundation, Inc.
+ # This file is free software; the Free Software Foundation
+@@ -59,6 +59,8 @@ AC_DEFUN([gl_FUNC_MKSTEMP],
+           [case "$host_os" in
+                             # Guess yes on glibc systems.
+              *-gnu* | gnu*) gl_cv_func_working_mkstemp="guessing yes" ;;
++                            # Guess yes on musl systems.
++             *-musl*)       gl_cv_func_working_mkstemp="guessing yes" ;;
+                             # Guess no on native Windows.
+              mingw*)        gl_cv_func_working_mkstemp="guessing no" ;;
+                             # If we don't know, assume the worst.
+diff --git a/m4/perror.m4 b/m4/perror.m4
+index 335be72..08e2db1 100644
+--- a/m4/perror.m4
++++ b/m4/perror.m4
+@@ -1,4 +1,4 @@
+-# perror.m4 serial 7
++# perror.m4 serial 8
+ dnl Copyright (C) 2008-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -48,10 +48,12 @@ AC_DEFUN([gl_FUNC_PERROR],
+             rm -rf conftest.txt1 conftest.txt2],
+            [gl_cv_func_perror_works=no],
+            [case "$host_os" in
+-                      # Guess yes on native Windows.
+-              mingw*) gl_cv_func_perror_works="guessing yes" ;;
+-                      # Otherwise guess no.
+-              *)      gl_cv_func_perror_works="guessing no" ;;
++                       # Guess yes on musl systems.
++              *-musl*) gl_cv_func_perror_works="guessing yes" ;;
++                       # Guess yes on native Windows.
++              mingw*)  gl_cv_func_perror_works="guessing yes" ;;
++                       # Otherwise guess no.
++              *)       gl_cv_func_perror_works="guessing no" ;;
+             esac
+            ])
+         ])
+diff --git a/m4/printf.m4 b/m4/printf.m4
+index cbf6ae4..6d2280e 100644
+--- a/m4/printf.m4
++++ b/m4/printf.m4
+@@ -1,4 +1,4 @@
+-# printf.m4 serial 60
++# printf.m4 serial 61
+ dnl Copyright (C) 2003, 2007-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -62,6 +62,8 @@ int main ()
+ changequote(,)dnl
+                                  # Guess yes on glibc systems.
+            *-gnu* | gnu*)        gl_cv_func_printf_sizes_c99="guessing yes";;
++                                 # Guess yes on musl systems.
++           *-musl*)              gl_cv_func_printf_sizes_c99="guessing yes";;
+                                  # Guess yes on FreeBSD >= 5.
+            freebsd[1-4].*)       gl_cv_func_printf_sizes_c99="guessing no";;
+            freebsd* | kfreebsd*) gl_cv_func_printf_sizes_c99="guessing yes";;
+@@ -240,6 +242,8 @@ int main ()
+ changequote(,)dnl
+                                  # Guess yes on glibc systems.
+            *-gnu* | gnu*)        gl_cv_func_printf_infinite="guessing yes";;
++                                 # Guess yes on musl systems.
++           *-musl*)              gl_cv_func_printf_infinite="guessing yes";;
+                                  # Guess yes on FreeBSD >= 6.
+            freebsd[1-5].*)       gl_cv_func_printf_infinite="guessing no";;
+            freebsd* | kfreebsd*) gl_cv_func_printf_infinite="guessing yes";;
+@@ -457,6 +461,8 @@ int main ()
+ changequote(,)dnl
+                                          # Guess yes on glibc systems.
+                    *-gnu* | gnu*)        gl_cv_func_printf_infinite_long_double="guessing yes";;
++                                         # Guess yes on musl systems.
++                   *-musl*)              gl_cv_func_printf_infinite_long_double="guessing yes";;
+                                          # Guess yes on FreeBSD >= 6.
+                    freebsd[1-5].*)       gl_cv_func_printf_infinite_long_double="guessing no";;
+                    freebsd* | kfreebsd*) gl_cv_func_printf_infinite_long_double="guessing yes";;
+@@ -575,6 +581,8 @@ int main ()
+                [gl_cv_func_printf_directive_a="guessing yes"],
+                [gl_cv_func_printf_directive_a="guessing no"])
+              ;;
++                                 # Guess yes on musl systems.
++           *-musl*)              gl_cv_func_printf_directive_a="guessing yes";;
+                                  # Guess no on Android.
+            linux*-android*)      gl_cv_func_printf_directive_a="guessing no";;
+                                  # Guess no on native Windows.
+@@ -625,6 +633,8 @@ int main ()
+ changequote(,)dnl
+                                  # Guess yes on glibc systems.
+            *-gnu* | gnu*)        gl_cv_func_printf_directive_f="guessing yes";;
++                                 # Guess yes on musl systems.
++           *-musl*)              gl_cv_func_printf_directive_f="guessing yes";;
+                                  # Guess yes on FreeBSD >= 6.
+            freebsd[1-5].*)       gl_cv_func_printf_directive_f="guessing no";;
+            freebsd* | kfreebsd*) gl_cv_func_printf_directive_f="guessing yes";;
+@@ -960,6 +970,8 @@ changequote(,)dnl
+          case "$host_os" in
+                             # Guess yes on glibc systems.
+            *-gnu* | gnu*)   gl_cv_func_printf_flag_zero="guessing yes";;
++                            # Guess yes on musl systems.
++           *-musl*)         gl_cv_func_printf_flag_zero="guessing yes";;
+                             # Guess yes on BeOS.
+            beos*)           gl_cv_func_printf_flag_zero="guessing yes";;
+                             # Guess no on Android.
+@@ -1206,6 +1218,8 @@ changequote(,)dnl
+          case "$host_os" in
+                                  # Guess yes on glibc systems.
+            *-gnu* | gnu*)        gl_cv_func_snprintf_truncation_c99="guessing yes";;
++                                 # Guess yes on musl systems.
++           *-musl*)              gl_cv_func_snprintf_truncation_c99="guessing yes";;
+                                  # Guess yes on FreeBSD >= 5.
+            freebsd[1-4].*)       gl_cv_func_snprintf_truncation_c99="guessing no";;
+            freebsd* | kfreebsd*) gl_cv_func_snprintf_truncation_c99="guessing yes";;
+@@ -1308,6 +1322,8 @@ int main ()
+ changequote(,)dnl
+                                  # Guess yes on glibc systems.
+            *-gnu* | gnu*)        gl_cv_func_snprintf_retval_c99="guessing yes";;
++                                 # Guess yes on musl systems.
++           *-musl*)              gl_cv_func_snprintf_retval_c99="guessing yes";;
+                                  # Guess yes on FreeBSD >= 5.
+            freebsd[1-4].*)       gl_cv_func_snprintf_retval_c99="guessing no";;
+            freebsd* | kfreebsd*) gl_cv_func_snprintf_retval_c99="guessing yes";;
+@@ -1400,6 +1416,8 @@ changequote(,)dnl
+          case "$host_os" in
+                                  # Guess yes on glibc systems.
+            *-gnu* | gnu*)        gl_cv_func_snprintf_directive_n="guessing yes";;
++                                 # Guess yes on musl systems.
++           *-musl*)              gl_cv_func_snprintf_directive_n="guessing yes";;
+                                  # Guess yes on FreeBSD >= 5.
+            freebsd[1-4].*)       gl_cv_func_snprintf_directive_n="guessing no";;
+            freebsd* | kfreebsd*) gl_cv_func_snprintf_directive_n="guessing yes";;
+@@ -1554,6 +1572,8 @@ changequote(,)dnl
+          case "$host_os" in
+                                  # Guess yes on glibc systems.
+            *-gnu* | gnu*)        gl_cv_func_vsnprintf_zerosize_c99="guessing yes";;
++                                 # Guess yes on musl systems.
++           *-musl*)              gl_cv_func_vsnprintf_zerosize_c99="guessing yes";;
+                                  # Guess yes on FreeBSD >= 5.
+            freebsd[1-4].*)       gl_cv_func_vsnprintf_zerosize_c99="guessing no";;
+            freebsd* | kfreebsd*) gl_cv_func_vsnprintf_zerosize_c99="guessing yes";;
+diff --git a/m4/putenv.m4 b/m4/putenv.m4
+index f8960f6..342ba26 100644
+--- a/m4/putenv.m4
++++ b/m4/putenv.m4
+@@ -1,4 +1,4 @@
+-# putenv.m4 serial 22
++# putenv.m4 serial 23
+ dnl Copyright (C) 2002-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -36,6 +36,8 @@ AC_DEFUN([gl_FUNC_PUTENV],
+              [case "$host_os" in
+                                # Guess yes on glibc systems.
+                 *-gnu* | gnu*) gl_cv_func_svid_putenv="guessing yes" ;;
++                               # Guess yes on musl systems.
++                *-musl*)       gl_cv_func_svid_putenv="guessing yes" ;;
+                                # Guess no on native Windows.
+                 mingw*)        gl_cv_func_svid_putenv="guessing no" ;;
+                                # If we don't know, assume the worst.
+diff --git a/m4/realloc.m4 b/m4/realloc.m4
+index f9f15ad..93066e8 100644
+--- a/m4/realloc.m4
++++ b/m4/realloc.m4
+@@ -1,4 +1,4 @@
+-# realloc.m4 serial 15
++# realloc.m4 serial 17
+ dnl Copyright (C) 2007, 2009-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -32,7 +32,7 @@ AC_DEFUN([_AC_FUNC_REALLOC_IF],
+        [ac_cv_func_realloc_0_nonnull=no],
+        [case "$host_os" in
+           # Guess yes on platforms where we know the result.
+-          *-gnu* | gnu* | freebsd* | netbsd* | openbsd* \
++          *-gnu* | gnu* | *-musl* | freebsd* | netbsd* | openbsd* \
+           | hpux* | solaris* | cygwin* | mingw*)
+             ac_cv_func_realloc_0_nonnull="guessing yes" ;;
+           # If we don't know, assume the worst.
+diff --git a/m4/setenv.m4 b/m4/setenv.m4
+index 6101274..a8f83d6 100644
+--- a/m4/setenv.m4
++++ b/m4/setenv.m4
+@@ -1,4 +1,4 @@
+-# setenv.m4 serial 27
++# setenv.m4 serial 28
+ dnl Copyright (C) 2001-2004, 2006-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -37,6 +37,8 @@ AC_DEFUN([gl_FUNC_SETENV],
+       [case "$host_os" in
+                         # Guess yes on glibc systems.
+          *-gnu* | gnu*) gl_cv_func_setenv_works="guessing yes" ;;
++                        # Guess yes on musl systems.
++         *-musl*)       gl_cv_func_setenv_works="guessing yes" ;;
+                         # If we don't know, assume the worst.
+          *)             gl_cv_func_setenv_works="guessing no" ;;
+        esac
+diff --git a/m4/signbit.m4 b/m4/signbit.m4
+index bf5bce5..f7f2f3d 100644
+--- a/m4/signbit.m4
++++ b/m4/signbit.m4
+@@ -1,4 +1,4 @@
+-# signbit.m4 serial 16
++# signbit.m4 serial 17
+ dnl Copyright (C) 2007-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -31,6 +31,8 @@ AC_DEFUN([gl_SIGNBIT],
+         [case "$host_os" in
+                           # Guess yes on glibc systems.
+            *-gnu* | gnu*) gl_cv_func_signbit="guessing yes" ;;
++                          # Guess yes on musl systems.
++           *-musl*)       gl_cv_func_signbit="guessing yes" ;;
+                           # Guess yes on native Windows.
+            mingw*)        gl_cv_func_signbit="guessing yes" ;;
+                           # If we don't know, assume the worst.
+@@ -62,6 +64,8 @@ AC_DEFUN([gl_SIGNBIT],
+         [case "$host_os" in
+                           # Guess yes on glibc systems.
+            *-gnu* | gnu*) gl_cv_func_signbit_gcc="guessing yes" ;;
++                          # Guess yes on musl systems.
++           *-musl*)       gl_cv_func_signbit_gcc="guessing yes" ;;
+                           # Guess yes on mingw, no on MSVC.
+            mingw*)        if test -n "$GCC"; then
+                             gl_cv_func_signbit_gcc="guessing yes"
+diff --git a/m4/sleep.m4 b/m4/sleep.m4
+index 5f71cc7..7bab467 100644
+--- a/m4/sleep.m4
++++ b/m4/sleep.m4
+@@ -1,4 +1,4 @@
+-# sleep.m4 serial 9
++# sleep.m4 serial 10
+ dnl Copyright (C) 2007-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -48,6 +48,8 @@ handle_alarm (int sig)
+       [case "$host_os" in
+                         # Guess yes on glibc systems.
+          *-gnu* | gnu*) gl_cv_func_sleep_works="guessing yes" ;;
++                        # Guess yes on musl systems.
++         *-musl*)       gl_cv_func_sleep_works="guessing yes" ;;
+                         # Guess no on native Windows.
+          mingw*)        gl_cv_func_sleep_works="guessing no" ;;
+                         # If we don't know, assume the worst.
+diff --git a/m4/stpncpy.m4 b/m4/stpncpy.m4
+index 83425dd..f8e1a7c 100644
+--- a/m4/stpncpy.m4
++++ b/m4/stpncpy.m4
+@@ -1,4 +1,4 @@
+-# stpncpy.m4 serial 16
++# stpncpy.m4 serial 17
+ dnl Copyright (C) 2002-2003, 2005-2007, 2009-2019 Free Software Foundation,
+ dnl Inc.
+ dnl This file is free software; the Free Software Foundation
+@@ -7,6 +7,8 @@ dnl with or without modifications, as long as this notice is preserved.
+
+ AC_DEFUN([gl_FUNC_STPNCPY],
+ [
++  AC_REQUIRE([AC_CANONICAL_HOST]) dnl for cross-compiles
++
+   dnl Persuade glibc <string.h> to declare stpncpy().
+   AC_REQUIRE([AC_USE_SYSTEM_EXTENSIONS])
+
+@@ -69,12 +71,18 @@ int main ()
+ ]])],
+         [gl_cv_func_stpncpy=yes],
+         [gl_cv_func_stpncpy=no],
+-        [AC_EGREP_CPP([Thanks for using GNU], [
++        [dnl Guess yes on glibc systems and musl systems.
++         AC_EGREP_CPP([Thanks for using GNU], [
+ #include <features.h>
+ #ifdef __GNU_LIBRARY__
+   Thanks for using GNU
+ #endif
+-], [gl_cv_func_stpncpy="guessing yes"], [gl_cv_func_stpncpy="guessing no"])
++],         [gl_cv_func_stpncpy="guessing yes"],
++           [case "$host_os" in
++              *-musl*) gl_cv_func_stpncpy="guessing yes" ;;
++              *)       gl_cv_func_stpncpy="guessing no" ;;
++            esac
++           ])
+         ])
+     ])
+     case "$gl_cv_func_stpncpy" in
+diff --git a/m4/strerror.m4 b/m4/strerror.m4
+index b452f7f..2c90f31 100644
+--- a/m4/strerror.m4
++++ b/m4/strerror.m4
+@@ -1,4 +1,4 @@
+-# strerror.m4 serial 19
++# strerror.m4 serial 20
+ dnl Copyright (C) 2002, 2007-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -26,6 +26,8 @@ AC_DEFUN([gl_FUNC_STRERROR],
+         [case "$host_os" in
+                           # Guess yes on glibc systems.
+            *-gnu* | gnu*) gl_cv_func_working_strerror="guessing yes" ;;
++                          # Guess yes on musl systems.
++           *-musl*)       gl_cv_func_working_strerror="guessing yes" ;;
+                           # If we don't know, assume the worst.
+            *)             gl_cv_func_working_strerror="guessing no" ;;
+          esac
+@@ -80,6 +82,8 @@ AC_DEFUN([gl_FUNC_STRERROR_0],
+       [case "$host_os" in
+                         # Guess yes on glibc systems.
+          *-gnu* | gnu*) gl_cv_func_strerror_0_works="guessing yes" ;;
++                        # Guess yes on musl systems.
++         *-musl*)       gl_cv_func_strerror_0_works="guessing yes" ;;
+                         # Guess yes on native Windows.
+          mingw*)        gl_cv_func_strerror_0_works="guessing yes" ;;
+                         # If we don't know, assume the worst.
+diff --git a/m4/strtod.m4 b/m4/strtod.m4
+index 9912217..d68ab75 100644
+--- a/m4/strtod.m4
++++ b/m4/strtod.m4
+@@ -1,4 +1,4 @@
+-# strtod.m4 serial 24
++# strtod.m4 serial 25
+ dnl Copyright (C) 2002-2003, 2006-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -115,9 +115,11 @@ numeric_equal (double x, double y)
+            ],
+            [gl_cv_func_strtod_works="guessing yes"],
+            [case "$host_os" in
+-                      # Guess yes on native Windows.
+-              mingw*) gl_cv_func_strtod_works="guessing yes" ;;
+-              *)      gl_cv_func_strtod_works="guessing no" ;;
++                       # Guess yes on musl systems.
++              *-musl*) gl_cv_func_strtod_works="guessing yes" ;;
++                       # Guess yes on native Windows.
++              mingw*)  gl_cv_func_strtod_works="guessing yes" ;;
++              *)       gl_cv_func_strtod_works="guessing no" ;;
+             esac
+            ])
+         ])
+diff --git a/m4/strtold.m4 b/m4/strtold.m4
+index 16b4eda..17125fe 100644
+--- a/m4/strtold.m4
++++ b/m4/strtold.m4
+@@ -1,4 +1,4 @@
+-# strtold.m4 serial 2
++# strtold.m4 serial 4
+ dnl Copyright (C) 2002-2003, 2006-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -98,7 +98,12 @@ numeric_equal (long double x, long double y)
+ #endif
+            ],
+            [gl_cv_func_strtold_works="guessing yes"],
+-           [gl_cv_func_strtod_works="guessing no"])
++           [case "$host_os" in
++                       # Guess yes on musl systems.
++              *-musl*) gl_cv_func_strtold_works="guessing yes" ;;
++              *)       gl_cv_func_strtold_works="guessing no" ;;
++            esac
++           ])
+         ])
+       ])
+     case "$gl_cv_func_strtold_works" in
+diff --git a/m4/tzset.m4 b/m4/tzset.m4
+index 1278801..afdfa8e 100644
+--- a/m4/tzset.m4
++++ b/m4/tzset.m4
+@@ -1,4 +1,4 @@
+-# serial 11
++# serial 12
+
+ # Copyright (C) 2003, 2007, 2009-2019 Free Software Foundation, Inc.
+ # This file is free software; the Free Software Foundation
+@@ -70,6 +70,8 @@ main ()
+        [case "$host_os" in
+                          # Guess all is fine on glibc systems.
+           *-gnu* | gnu*) gl_cv_func_tzset_clobber="guessing no" ;;
++                         # Guess all is fine on musl systems.
++          *-musl*)       gl_cv_func_tzset_clobber="guessing no" ;;
+                          # Guess no on native Windows.
+           mingw*)        gl_cv_func_tzset_clobber="guessing no" ;;
+                          # If we don't know, assume the worst.
+diff --git a/m4/ungetc.m4 b/m4/ungetc.m4
+index ab8757b..08baf33 100644
+--- a/m4/ungetc.m4
++++ b/m4/ungetc.m4
+@@ -1,4 +1,4 @@
+-# ungetc.m4 serial 6
++# ungetc.m4 serial 7
+ dnl Copyright (C) 2009-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -41,12 +41,16 @@ AC_DEFUN_ONCE([gl_FUNC_UNGETC_WORKS],
+            remove ("conftest.tmp");])],
+         [gl_cv_func_ungetc_works=yes], [gl_cv_func_ungetc_works=no],
+         [case "$host_os" in
+-                                       # Guess yes on glibc and bionic systems.
+-           *-gnu* | gnu* | *-android*) gl_cv_func_ungetc_works="guessing yes" ;;
+-                                       # Guess yes on native Windows.
+-           mingw*)                     gl_cv_func_ungetc_works="guessing yes" ;;
+-                                       # If we don't know, assume the worst.
+-           *)                          gl_cv_func_ungetc_works="guessing no" ;;
++                          # Guess yes on glibc systems.
++           *-gnu* | gnu*) gl_cv_func_ungetc_works="guessing yes" ;;
++                          # Guess yes on musl systems.
++           *-musl*)       gl_cv_func_ungetc_works="guessing yes" ;;
++                          # Guess yes on bionic systems.
++           *-android*)    gl_cv_func_ungetc_works="guessing yes" ;;
++                          # Guess yes on native Windows.
++           mingw*)        gl_cv_func_ungetc_works="guessing yes" ;;
++                          # If we don't know, assume the worst.
++           *)             gl_cv_func_ungetc_works="guessing no" ;;
+          esac
+         ])
+     ])
+diff --git a/m4/usleep.m4 b/m4/usleep.m4
+index 59605a8..4a6bff0 100644
+--- a/m4/usleep.m4
++++ b/m4/usleep.m4
+@@ -1,4 +1,4 @@
+-# usleep.m4 serial 5
++# usleep.m4 serial 6
+ dnl Copyright (C) 2009-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -31,6 +31,8 @@ AC_DEFUN([gl_FUNC_USLEEP],
+         [case "$host_os" in
+                           # Guess yes on glibc systems.
+            *-gnu* | gnu*) gl_cv_func_usleep_works="guessing yes" ;;
++                          # Guess yes on musl systems.
++           *-musl*)       gl_cv_func_usleep_works="guessing yes" ;;
+                           # Guess no on native Windows.
+            mingw*)        gl_cv_func_usleep_works="guessing no" ;;
+                           # If we don't know, assume the worst.
+diff --git a/m4/utimes.m4 b/m4/utimes.m4
+index 7209b6d..5806d8f 100644
+--- a/m4/utimes.m4
++++ b/m4/utimes.m4
+@@ -1,5 +1,5 @@
+ # Detect some bugs in glibc's implementation of utimes.
+-# serial 5
++# serial 6
+
+ dnl Copyright (C) 2003-2005, 2009-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+@@ -143,9 +143,11 @@ main ()
+        [gl_cv_func_working_utimes=yes],
+        [gl_cv_func_working_utimes=no],
+        [case "$host_os" in
+-                  # Guess no on native Windows.
+-          mingw*) gl_cv_func_working_utimes="guessing no" ;;
+-          *)      gl_cv_func_working_utimes="guessing no" ;;
++                   # Guess yes on musl systems.
++          *-musl*) gl_cv_func_working_utimes="guessing yes" ;;
++                   # Guess no on native Windows.
++          mingw*)  gl_cv_func_working_utimes="guessing no" ;;
++          *)       gl_cv_func_working_utimes="guessing no" ;;
+         esac
+        ])
+     ])
+diff --git a/m4/wcwidth.m4 b/m4/wcwidth.m4
+index baa2002..3952fd2 100644
+--- a/m4/wcwidth.m4
++++ b/m4/wcwidth.m4
+@@ -1,4 +1,4 @@
+-# wcwidth.m4 serial 27
++# wcwidth.m4 serial 28
+ dnl Copyright (C) 2006-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -98,9 +98,13 @@ int main ()
+           [
+ changequote(,)dnl
+            case "$host_os" in
+-                                        # Guess yes on glibc and AIX 7 systems.
+-             *-gnu* | gnu* | aix[7-9]*) gl_cv_func_wcwidth_works="guessing yes";;
+-             *)                         gl_cv_func_wcwidth_works="guessing no";;
++                            # Guess yes on glibc systems.
++             *-gnu* | gnu*) gl_cv_func_wcwidth_works="guessing yes";;
++                            # Guess yes on musl systems.
++             *-musl*)       gl_cv_func_wcwidth_works="guessing yes";;
++                            # Guess yes on AIX 7 systems.
++             aix[7-9]*)     gl_cv_func_wcwidth_works="guessing yes";;
++             *)             gl_cv_func_wcwidth_works="guessing no";;
+            esac
+ changequote([,])dnl
+           ])
+--
+1.9.1
+
+
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index 9cc48f446467..f83a2b940719 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, buildPackages
-, autoreconfHook, texinfo, fetchurl, perl, xz, libiconv, gmp ? null
+, autoreconfHook, bison, texinfo, fetchurl, perl, xz, libiconv, gmp ? null
 , aclSupport ? stdenv.isLinux, acl ? null
 , attrSupport ? stdenv.isLinux, attr ? null
 , selinuxSupport? false, libselinux ? null, libsepol ? null
@@ -24,7 +24,9 @@ stdenv.mkDerivation rec {
     sha256 = "1zg9m79x1i2nifj4kb0waf9x3i5h6ydkypkjnbsb9rnwis8rqypz";
   };
 
-  patches = optional stdenv.hostPlatform.isCygwin ./coreutils-8.23-4.cygwin.patch;
+  patches = optional stdenv.hostPlatform.isCygwin ./coreutils-8.23-4.cygwin.patch
+         # Fix compilation in musl-cross environments. To be removed in coreutils-8.32.
+         ++ optional stdenv.hostPlatform.isMusl ./coreutils-8.31-musl-cross.patch;
 
   postPatch = ''
     # The test tends to fail on btrfs,f2fs and maybe other unusual filesystems.
@@ -55,7 +57,9 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "info" ];
 
-  nativeBuildInputs = [ perl xz.bin ];
+  nativeBuildInputs = [ perl xz.bin ]
+    ++ optionals stdenv.hostPlatform.isCygwin [ autoreconfHook texinfo ]   # due to patch
+    ++ optionals stdenv.hostPlatform.isMusl [ autoreconfHook bison ];   # due to patch
   configureFlags = [ "--with-packager=https://NixOS.org" ]
     ++ optional (singleBinary != false)
       ("--enable-single-binary" + optionalString (isString singleBinary) "=${singleBinary}")
@@ -73,7 +77,6 @@ stdenv.mkDerivation rec {
     ++ optional aclSupport acl
     ++ optional attrSupport attr
     ++ optional withOpenssl openssl
-    ++ optionals stdenv.hostPlatform.isCygwin [ autoreconfHook texinfo ]   # due to patch
     ++ optionals selinuxSupport [ libselinux libsepol ]
        # TODO(@Ericson2314): Investigate whether Darwin could benefit too
     ++ optional (stdenv.hostPlatform != stdenv.buildPlatform && stdenv.hostPlatform.libc != "glibc") libiconv;
@@ -132,4 +135,7 @@ stdenv.mkDerivation rec {
     maintainers = [ maintainers.eelco ];
   };
 
+} // optionalAttrs stdenv.hostPlatform.isMusl {
+  # Work around a bogus warning in conjunction with musl.
+  NIX_CFLAGS_COMPILE = "-Wno-error";
 }
diff --git a/pkgs/tools/misc/qt5ct/default.nix b/pkgs/tools/misc/qt5ct/default.nix
index 77331a7f025a..ddd4ae5ce056 100644
--- a/pkgs/tools/misc/qt5ct/default.nix
+++ b/pkgs/tools/misc/qt5ct/default.nix
@@ -4,11 +4,11 @@ let inherit (stdenv.lib) getDev; in
 
 stdenv.mkDerivation rec {
   pname = "qt5ct";
-  version = "0.38";
+  version = "0.39";
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "0p0317z79h906qwaf0p8ga6lmr1dlabkx12gn31bv9lnp9f55jwg";
+    sha256 = "069y6c17gfics8rz3rdsn2x2hb39m4qka08ygwpxa8gqppffqs9p";
   };
 
   nativeBuildInputs = [ qmake qttools ];
diff --git a/pkgs/tools/misc/shell-hist/default.nix b/pkgs/tools/misc/shell-hist/default.nix
new file mode 100644
index 000000000000..b44cbf100e8a
--- /dev/null
+++ b/pkgs/tools/misc/shell-hist/default.nix
@@ -0,0 +1,23 @@
+{ lib, fetchFromGitHub, rustPlatform }:
+
+rustPlatform.buildRustPackage {
+  pname = "shell-hist";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "jamesmunns";
+    repo = "shell-hist";
+    rev = "158de8c3908b49530ecd76bf6e65c210f351ef82";
+    sha256 = "0kc128xnnp1d56if70vfv0w3qnwhljhbnvzwwb7hfm3x2m0vqrqf";
+  };
+
+  cargoSha256 = "1nqnkzwqk879qy1261g1gds668xz6islhzq7chzhilaqpmvf6039";
+
+  meta = with lib; {
+    description = "Inspect your shell history";
+    homepage = "https://github.com/jamesmunns/shell-hist";
+    license = with licenses; [ mit /* or */ asl20 ];
+    maintainers = [ maintainers.spacekookie ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/tools/misc/tlp/default.nix b/pkgs/tools/misc/tlp/default.nix
index 2cdb8aff472e..6e431fdc98ea 100644
--- a/pkgs/tools/misc/tlp/default.nix
+++ b/pkgs/tools/misc/tlp/default.nix
@@ -15,13 +15,13 @@ let
 
 in stdenv.mkDerivation rec {
   name = "tlp-${version}";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchFromGitHub {
     owner = "linrunner";
     repo = "TLP";
     rev = version;
-    sha256 = "1msldl6y8fpvxa9p87lv3hvgxwk2vpiahqmapq485ihdjkshc558";
+    sha256 = "0vm31ca6kdak9xzwskz7a8hvdp67drfh2zcdwlz3260r8r2ypgg1";
   };
 
   outRef = placeholder "out";
diff --git a/pkgs/tools/misc/ttyplot/default.nix b/pkgs/tools/misc/ttyplot/default.nix
index 53a0e0a2992b..78aeab00a50f 100644
--- a/pkgs/tools/misc/ttyplot/default.nix
+++ b/pkgs/tools/misc/ttyplot/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "ttyplot-${version}";
-  version = "1.2";
+  version = "1.4";
 
   src = fetchFromGitHub {
     owner = "tenox7";
     repo = "ttyplot";
     rev = version;
-    sha256 = "1xaqzm71w2n0q532wpa3w818mvjvch3h34m2aq7pldkyk09frjxh";
+    sha256 = "19qm0hx9ljdw9qg78lydn3c627xy7xnx3knq5f7caw9lf0cdp7kf";
   };
 
   buildInputs = [ ncurses ];
diff --git a/pkgs/tools/misc/uutils-coreutils/default.nix b/pkgs/tools/misc/uutils-coreutils/default.nix
index 70f304134d90..a32ce090ecdd 100644
--- a/pkgs/tools/misc/uutils-coreutils/default.nix
+++ b/pkgs/tools/misc/uutils-coreutils/default.nix
@@ -1,18 +1,18 @@
 { stdenv, fetchFromGitHub, rustPlatform, cargo, cmake, sphinx, lib, prefix ? "uutils-" }:
 
 rustPlatform.buildRustPackage {
-  name = "uutils-coreutils-2018-09-30";
+  name = "uutils-coreutils-2019-05-03";
   src = fetchFromGitHub {
     owner = "uutils";
     repo = "coreutils";
-    rev = "a161b7e803aef08455ae0547dccd9210e38a4574";
-    sha256 = "19j40cma7rz6yf5j6nyid8qslbcmrnxdk6by53hflal2qx3g555z";
+    rev = "036dd812958ace22d973acf7b370f58072049dac";
+    sha256 = "0d9w3iiphhsk7l5l34682wayp90rgq5a3d94l3qdvhcqkfmpg727";
   };
 
   # too many impure/platform-dependent tests
   doCheck = false;
 
-  cargoSha256 = "1a9k7i4829plkxgsflmpji3mrw2i1vln6jsnhxmkl14h554yi5j4";
+  cargoSha256 = "0qnpx2xhckb45q8cgn0xh31dg5k73hqp5mz5zg3micmg7as4b621";
 
   makeFlags =
     [ "CARGO=${cargo}/bin/cargo" "PREFIX=$(out)" "PROFILE=release" "INSTALLDIR_MAN=$(out)/share/man/man1" ]
diff --git a/pkgs/tools/misc/youtube-dl/default.nix b/pkgs/tools/misc/youtube-dl/default.nix
index 724979439d4c..98dc79fbe11a 100644
--- a/pkgs/tools/misc/youtube-dl/default.nix
+++ b/pkgs/tools/misc/youtube-dl/default.nix
@@ -19,11 +19,11 @@ buildPythonPackage rec {
   # The websites youtube-dl deals with are a very moving target. That means that
   # downloads break constantly. Because of that, updates should always be backported
   # to the latest stable release.
-  version = "2019.04.30";
+  version = "2019.05.11";
 
   src = fetchurl {
     url = "https://yt-dl.org/downloads/${version}/${pname}-${version}.tar.gz";
-    sha256 = "1s43adnky8ayhjwmgmiqy6rmmygd4c23v36jhy2lzr2jpn8l53z1";
+    sha256 = "1y272jgdqwhf2njzqfln80zb2pmw83rvp6lxza6wghb7cld249j1";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/networking/tgt/default.nix b/pkgs/tools/networking/tgt/default.nix
index 9f3075b374e2..4491d183aad7 100644
--- a/pkgs/tools/networking/tgt/default.nix
+++ b/pkgs/tools/networking/tgt/default.nix
@@ -2,7 +2,7 @@
 , docbook_xsl }:
 
 let
-  version = "1.0.76";
+  version = "1.0.77";
 in stdenv.mkDerivation rec {
   name = "tgt-${version}";
 
@@ -10,7 +10,7 @@ in stdenv.mkDerivation rec {
     owner = "fujita";
     repo = "tgt";
     rev = "v${version}";
-    sha256 = "1q01ay0zn5gmy6df1iw1ic11p8zygxlp0r3nd887vvvjvlp3xrvc";
+    sha256 = "1qhck8v5057wn9nb1nsq6dzhvqzz51x8i3n0p1x36zbsmdjy2ajw";
   };
 
   buildInputs = [ libxslt systemd libaio docbook_xsl ];
diff --git a/pkgs/tools/security/tboot/default.nix b/pkgs/tools/security/tboot/default.nix
index a07a374c5d87..f159dd27c42a 100644
--- a/pkgs/tools/security/tboot/default.nix
+++ b/pkgs/tools/security/tboot/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "tboot-${version}";
-  version = "1.9.6";
+  version = "1.9.8";
 
   src = fetchurl {
     url = "mirror://sourceforge/tboot/${name}.tar.gz";
-    sha256 = "0f9afz260xhycpd0x5zz6jn8ha14i8j98rck0fhb55l1rbbfwm8v";
+    sha256 = "06f0ggl6vrb5ghklblvh2ixgmmjv31rkp1vfj9qm497iqwq9ac00";
   };
 
   patches = [ ./tboot-add-well-known-secret-option-to-lcp_writepol.patch ];
diff --git a/pkgs/tools/security/vault/default.nix b/pkgs/tools/security/vault/default.nix
index 86cc6221a5c1..1aa42dc75f3a 100644
--- a/pkgs/tools/security/vault/default.nix
+++ b/pkgs/tools/security/vault/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "vault-${version}";
-  version = "1.1.0";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "vault";
     rev = "v${version}";
-    sha256 = "11hyqqpfz839ipqv534vvljyarnr9wn98rzvyfwnx2lq76h2adqn";
+    sha256 = "1916zqmh4cam9nw3k95wiqizlpkbbm5qhfz4lblqba8pzc2y9v32";
   };
 
   nativeBuildInputs = [ go gox removeReferencesTo ];
diff --git a/pkgs/tools/security/yara/default.nix b/pkgs/tools/security/yara/default.nix
index 08457efe7405..7fcb9fc10bd1 100644
--- a/pkgs/tools/security/yara/default.nix
+++ b/pkgs/tools/security/yara/default.nix
@@ -5,14 +5,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "3.9.0";
+  version = "3.10.0";
   name = "yara-${version}";
 
   src = fetchFromGitHub {
     owner = "VirusTotal";
     repo = "yara";
     rev = "v${version}";
-    sha256 = "1a707nx1py1q1z9fc18c93gjd4k5k6k53a93qw09jlcc67xk2sz7";
+    sha256 = "1qxqk324cyvi4n09s79786ciig1gdyhs9dnsm07hf95a3kh6w5z2";
   };
 
   buildInputs = [ autoconf automake libtool pcre]
diff --git a/pkgs/tools/system/stress-ng/default.nix b/pkgs/tools/system/stress-ng/default.nix
index a31ce8f65e4b..eec36e8f0900 100644
--- a/pkgs/tools/system/stress-ng/default.nix
+++ b/pkgs/tools/system/stress-ng/default.nix
@@ -3,12 +3,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "stress-ng-${version}";
-  version = "0.09.57";
+  pname = "stress-ng";
+  version = "0.09.58";
 
   src = fetchurl {
-    url = "https://kernel.ubuntu.com/~cking/tarballs/stress-ng/${name}.tar.xz";
-    sha256 = "0xp55m1kif8hcjdcdhgaarghqf1gz5fa24qwl6zpmxkzl6bn002x";
+    url = "https://kernel.ubuntu.com/~cking/tarballs/${pname}/${pname}-${version}.tar.xz";
+    sha256 = "1rlll6wl0i0m21idfr3xr99pfgnb9wf9i35hsb0frmrpcvls06za";
   };
 
   # All platforms inputs then Linux-only ones
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
       attr keyutils libaio libapparmor libcap lksctp-tools
     ];
 
-  patchPhase = ''
+  postPatch = ''
     substituteInPlace Makefile --replace "/usr" ""
   '';
 
@@ -27,25 +27,39 @@ stdenv.mkDerivation rec {
   # mystery, though. :-(
   enableParallelBuilding = (!stdenv.isi686);
 
-  installFlags = [ "DESTDIR=$(out)" ];
+  installFlags = [ "DESTDIR=${placeholder "out"}" ];
 
   meta = with stdenv.lib; {
     description = "Stress test a computer system";
     longDescription = ''
-      Stress test a system in various selectable ways, exercising both various
-      physical subsystems and various operating system kernel interfaces:
-      - over 130 different stress tests
-      - over 70 CPU specific stress tests that exercise floating point,
-        integer, bit manipulation and control flow
-      - over 20 virtual memory stress tests
-      stress-ng was originally intended to make a machine work hard and trip
-      hardware issues such as thermal overruns as well as operating system
-      bugs that only occur when a system is being thrashed hard.
+      stress-ng will stress test a computer system in various selectable ways. It
+      was designed to exercise various physical subsystems of a computer as well as
+      the various operating system kernel interfaces. Stress-ng features:
+
+        * over 210 stress tests
+        * over 50 CPU specific stress tests that exercise floating point, integer,
+          bit manipulation and control flow
+        * over 20 virtual memory stress tests
+        * portable: builds on Linux, Solaris, *BSD, Minix, Android, MacOS X,
+          Debian Hurd, Haiku, Windows Subsystem for Linux and SunOs/Dilos with
+          gcc, clang, tcc and pcc.
+
+      stress-ng was originally intended to make a machine work hard and trip hardware
+      issues such as thermal overruns as well as operating system bugs that only
+      occur when a system is being thrashed hard. Use stress-ng with caution as some
+      of the tests can make a system run hot on poorly designed hardware and also can
+      cause excessive system thrashing which may be difficult to stop.
+
+      stress-ng can also measure test throughput rates; this can be useful to observe
+      performance changes across different operating system releases or types of
+      hardware. However, it has never been intended to be used as a precise benchmark
+      test suite, so do NOT use it in this manner.
     '';
-    homepage = https://kernel.ubuntu.com/~cking/stress-ng/;
-    downloadPage = https://kernel.ubuntu.com/~cking/tarballs/stress-ng/;
+    homepage = "https://kernel.ubuntu.com/~cking/stress-ng/";
+    downloadPage = "https://kernel.ubuntu.com/~cking/tarballs/stress-ng/";
+    changelog = "https://kernel.ubuntu.com/git/cking/stress-ng.git/plain/debian/changelog?h=V${version}";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ c0bw3b ];
-    platforms = platforms.linux; # TODO: fix https://github.com/NixOS/nixpkgs/pull/50506#issuecomment-439635963
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4f7c328bf763..3262e0e0d78a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1762,6 +1762,8 @@ in
 
   shab = callPackage ../tools/text/shab { };
 
+  shell-hist = callPackage ../tools/misc/shell-hist { };
+
   simg2img = callPackage ../tools/filesystems/simg2img { };
 
   snipes = callPackage ../games/snipes { };
@@ -2658,14 +2660,22 @@ in
   elk6Version = "6.7.2";
   elk7Version = "7.0.1";
 
-  elasticsearch5 = callPackage ../servers/search/elasticsearch/5.x.nix { };
-  elasticsearch6 = callPackage ../servers/search/elasticsearch/6.x.nix { };
+  elasticsearch5 = callPackage ../servers/search/elasticsearch/5.x.nix {
+    utillinux = utillinuxMinimal;
+  };
+  elasticsearch6 = callPackage ../servers/search/elasticsearch/6.x.nix {
+    utillinux = utillinuxMinimal;
+  };
   elasticsearch6-oss = callPackage ../servers/search/elasticsearch/6.x.nix {
     enableUnfree = false;
+    utillinux = utillinuxMinimal;
+  };
+  elasticsearch7 = callPackage ../servers/search/elasticsearch/7.x.nix {
+    utillinux = utillinuxMinimal;
   };
-  elasticsearch7 = callPackage ../servers/search/elasticsearch/7.x.nix { };
   elasticsearch7-oss = callPackage ../servers/search/elasticsearch/7.x.nix {
     enableUnfree = false;
+    utillinux = utillinuxMinimal;
   };
   elasticsearch = elasticsearch6;
   elasticsearch-oss = elasticsearch6-oss;
@@ -4517,6 +4527,8 @@ in
     withMinimal = false;
   };
 
+  mkclean = callPackage ../applications/video/mkclean {};
+
   mkcue = callPackage ../tools/cd-dvd/mkcue { };
 
   mkp224o = callPackage ../tools/security/mkp224o { };
@@ -8748,13 +8760,16 @@ in
 
   bam = callPackage ../development/tools/build-managers/bam {};
 
-  bazel_0_4 = callPackage ../development/tools/build-managers/bazel/0.4.nix { };
+  bazel_0_4 = callPackage ../development/tools/build-managers/bazel/0.4.nix {
+    stdenv = if stdenv.cc.isClang then llvmPackages_6.stdenv else stdenv;
+  };
   bazel = callPackage ../development/tools/build-managers/bazel {
     inherit (darwin) cctools;
     inherit (darwin.apple_sdk.frameworks) CoreFoundation CoreServices Foundation;
     buildJdk = jdk8;
     buildJdkName = "jdk8";
     runJdk = jdk11;
+    stdenv = if stdenv.cc.isClang then llvmPackages_6.stdenv else stdenv;
   };
 
   bazel-buildtools = callPackage ../development/tools/build-managers/bazel/buildtools { };
@@ -8816,6 +8831,8 @@ in
   buildkite-agent2 = callPackage ../development/tools/continuous-integration/buildkite-agent/2.x.nix { };
   buildkite-agent3 = callPackage ../development/tools/continuous-integration/buildkite-agent/3.x.nix { };
 
+  bpftool = callPackage ../os-specific/linux/bpftool { };
+
   byacc = callPackage ../development/tools/parsing/byacc { };
 
   cadre = callPackage ../development/tools/cadre { };
@@ -21110,6 +21127,8 @@ in
 
   atanks = callPackage ../games/atanks {};
 
+  azimuth = callPackage ../games/azimuth {};
+
   ballAndPaddle = callPackage ../games/ball-and-paddle {
     guile = guile_1_8;
   };
@@ -21457,7 +21476,10 @@ in
 
   nethack = callPackage ../games/nethack { };
 
-  nethack-qt = callPackage ../games/nethack { qtMode = true; };
+  nethack-qt = callPackage ../games/nethack {
+    qtMode = true;
+    stdenv = gccStdenv;
+  };
 
   nethack-x11 = callPackage ../games/nethack { x11Mode = true; };
 
@@ -24010,4 +24032,6 @@ in
 
   wasmtime = callPackage ../development/interpreters/wasmtime {};
 
+  bemenu = callPackage ../applications/misc/bemenu { };
+
 }
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 4c8026ced43a..d9ebd75b5c10 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -665,6 +665,8 @@ in {
 
   py-lru-cache = callPackage ../development/python-modules/py-lru-cache { };
 
+  py-radix = callPackage ../development/python-modules/py-radix { };
+
   pydbus = callPackage ../development/python-modules/pydbus { };
 
   pydocstyle = callPackage ../development/python-modules/pydocstyle { };
diff --git a/pkgs/top-level/release-cross.nix b/pkgs/top-level/release-cross.nix
index acccd155e08d..339973f05748 100644
--- a/pkgs/top-level/release-cross.nix
+++ b/pkgs/top-level/release-cross.nix
@@ -31,7 +31,7 @@ let
     buildPackages.gcc = nativePlatforms;
     coreutils = nativePlatforms;
     haskell.packages.ghcHEAD.hello = nativePlatforms;
-    haskell.packages.ghc844.hello = nativePlatforms;
+    haskellPackages.hello = nativePlatforms;
   };
 
   linuxCommon = lib.recursiveUpdate gnuCommon {