Merge branch 'staging-next' into staging

2020-03-10 11:17:27 +01:00 · 2020-03-10 11:17:27 +01:00 · 0e3ad60b62
commit 0e3ad60b62
parent 1d9c10c8de a7db7b576c
150 changed files with 3623 additions and 2411 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -3096,6 +3096,12 @@
    githubId = 4401220;
    name = "Michael Eden";
  };
+  illiusdope = {
+    email = "mat@marini.ca";
+    github = "illiusdope";
+    gitHubId = 61913481;
+    name = "Mat Marini";
+  };
  ilya-fedin = {
    email = "fedin-ilja2010@ya.ru";
    github = "ilya-fedin";
@ -5492,6 +5498,12 @@
    githubId = 11016164;
    name = "Fedor Pakhomov";
  };
+  paluh = {
+    email = "paluho@gmail.com";
+    github = "paluh";
+    githubId = 190249;
+    name = "Tomasz Rybarczyk";
+  };
  pamplemousse = {
    email = "xav.maso@gmail.com";
    github = "Pamplemousse";
--- a/nixos/modules/security/acme.nix
+++ b/nixos/modules/security/acme.nix
@ -302,7 +302,7 @@ in
                lpath = "acme/${cert}";
                apath = "/var/lib/${lpath}";
                spath = "/var/lib/acme/.lego";
-                rights = if data.allowKeysForGroup then "750" else "700";
+                fileMode = if data.allowKeysForGroup then "640" else "600";
                globalOpts = [ "-d" data.domain "--email" data.email "--path" "." "--key-type" data.keyType ]
                          ++ optionals (cfg.acceptTerms) [ "--accept-tos" ]
                          ++ optionals (data.dnsProvider != null && !data.dnsPropagationCheck) [ "--dns.disable-cp" ]
@ -331,7 +331,7 @@ in
                    Group = data.group;
                    PrivateTmp = true;
                    StateDirectory = "acme/.lego ${lpath}";
-                    StateDirectoryMode = rights;
+                    StateDirectoryMode = if data.allowKeysForGroup then "750" else "700";
                    WorkingDirectory = spath;
                    # Only try loading the credentialsFile if the dns challenge is enabled
                    EnvironmentFile = if data.dnsProvider != null then data.credentialsFile else null;
@ -354,10 +354,11 @@ in
                            cp -p ${spath}/certificates/${keyName}.issuer.crt chain.pem
                            ln -sf fullchain.pem cert.pem
                            cat key.pem fullchain.pem > full.pem
-                            chmod ${rights} *.pem
-                            chown '${data.user}:${data.group}' *.pem
                          fi

+                          chmod ${fileMode} *.pem
+                          chown '${data.user}:${data.group}' *.pem
+
                          ${data.postRun}
                        '';
                      in
@ -399,7 +400,7 @@ in

                      # Give key acme permissions
                      chown '${data.user}:${data.group}' "${apath}/"{key,fullchain,full}.pem
-                      chmod ${rights} "${apath}/"{key,fullchain,full}.pem
+                      chmod ${fileMode} "${apath}/"{key,fullchain,full}.pem
                    '';
                  serviceConfig = {
                    Type = "oneshot";
--- a/nixos/modules/services/misc/zoneminder.nix
+++ b/nixos/modules/services/misc/zoneminder.nix
@ -77,6 +77,8 @@ in {
        `config.services.zoneminder.database.createLocally` to true. Otherwise,
        when set to `false` (the default), you will have to create the database
        and database user as well as populate the database yourself.
+        Additionally, you will need to run `zmupdate.pl` yourself when
+        upgrading to a newer version.
      '';

      webserver = mkOption {
@ -330,6 +332,8 @@ in {
            ${config.services.mysql.package}/bin/mysql < ${pkg}/share/zoneminder/db/zm_create.sql
            touch "/var/lib/${dirName}/db-created"
          fi
+
+          ${zoneminder}/bin/zmupdate.pl -nointeractive
        '';
        serviceConfig = {
          User = user;
--- a/nixos/modules/services/monitoring/prometheus/exporters.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters.nix
@ -29,6 +29,7 @@ let
    "fritzbox"
    "json"
    "mail"
+    "mikrotik"
    "minio"
    "nextcloud"
    "nginx"
@ -197,13 +198,25 @@ in

  config = mkMerge ([{
    assertions = [ {
-      assertion = (cfg.snmp.configurationPath == null) != (cfg.snmp.configuration == null);
+      assertion = cfg.snmp.enable -> (
+        (cfg.snmp.configurationPath == null) != (cfg.snmp.configuration == null)
+      );
      message = ''
        Please ensure you have either `services.prometheus.exporters.snmp.configuration'
          or `services.prometheus.exporters.snmp.configurationPath' set!
      '';
    } {
-      assertion = (cfg.mail.configFile == null) != (cfg.mail.configuration == {});
+      assertion = cfg.mikrotik.enable -> (
+        (cfg.mikrotik.configFile == null) != (cfg.mikrotik.configuration == null)
+      );
+      message = ''
+        Please specify either `services.prometheus.exporters.mikrotik.configuration'
+          or `services.prometheus.exporters.mikrotik.configFile'.
+      '';
+    } {
+      assertion = cfg.mail.enable -> (
+        (cfg.mail.configFile == null) != (cfg.mail.configuration == null)
+      );
      message = ''
        Please specify either 'services.prometheus.exporters.mail.configuration'
          or 'services.prometheus.exporters.mail.configFile'.
--- a/nixos/modules/services/monitoring/prometheus/exporters/blackbox.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/blackbox.nix
@ -61,7 +61,7 @@ in {
      ExecStart = ''
        ${pkgs.prometheus-blackbox-exporter}/bin/blackbox_exporter \
          --web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
-          --config.file ${adjustedConfigFile} \
+          --config.file ${escapeShellArg adjustedConfigFile} \
          ${concatStringsSep " \\\n  " cfg.extraFlags}
      '';
      ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
--- a/nixos/modules/services/monitoring/prometheus/exporters/collectd.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/collectd.nix
@ -66,7 +66,7 @@ in
    serviceConfig = {
      ExecStart = ''
        ${pkgs.prometheus-collectd-exporter}/bin/collectd_exporter \
-          -log.format ${cfg.logFormat} \
+          -log.format ${escapeShellArg cfg.logFormat} \
          -log.level ${cfg.logLevel} \
          -web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
          ${collectSettingsArgs} \
--- a/nixos/modules/services/monitoring/prometheus/exporters/dnsmasq.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/dnsmasq.nix
@ -30,7 +30,7 @@ in
        ${pkgs.prometheus-dnsmasq-exporter}/bin/dnsmasq_exporter \
          --listen ${cfg.listenAddress}:${toString cfg.port} \
          --dnsmasq ${cfg.dnsmasqListenAddress} \
-          --leases_path ${cfg.leasesPath} \
+          --leases_path ${escapeShellArg cfg.leasesPath} \
          ${concatStringsSep " \\\n  " cfg.extraFlags}
      '';
    };
--- a/nixos/modules/services/monitoring/prometheus/exporters/dovecot.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/dovecot.nix
@ -64,7 +64,7 @@ in
        ${pkgs.prometheus-dovecot-exporter}/bin/dovecot_exporter \
          --web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
          --web.telemetry-path ${cfg.telemetryPath} \
-          --dovecot.socket-path ${cfg.socketPath} \
+          --dovecot.socket-path ${escapeShellArg cfg.socketPath} \
          --dovecot.scopes ${concatStringsSep "," cfg.scopes} \
          ${concatStringsSep " \\\n  " cfg.extraFlags}
      '';
--- a/nixos/modules/services/monitoring/prometheus/exporters/json.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/json.nix
@ -27,7 +27,7 @@ in
      ExecStart = ''
        ${pkgs.prometheus-json-exporter}/bin/prometheus-json-exporter \
          --port ${toString cfg.port} \
-          ${cfg.url} ${cfg.configFile} \
+          ${cfg.url} ${escapeShellArg cfg.configFile} \
          ${concatStringsSep " \\\n  " cfg.extraFlags}
      '';
    };
--- a/nixos/modules/services/monitoring/prometheus/exporters/mail.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/mail.nix
@ -90,7 +90,7 @@ let
        Timeout until mails are considered "didn't make it".
      '';
    };
-    disableFileDelition = mkOption {
+    disableFileDeletion = mkOption {
      type = types.bool;
      default = false;
      description = ''
@ -127,8 +127,8 @@ in
      '';
    };
    configuration = mkOption {
-      type = types.submodule exporterOptions;
-      default = {};
+      type = types.nullOr (types.submodule exporterOptions);
+      default = null;
      description = ''
        Specify the mailexporter configuration file to use.
      '';
@ -147,8 +147,9 @@ in
      ExecStart = ''
        ${pkgs.prometheus-mail-exporter}/bin/mailexporter \
          --web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
+          --web.telemetry-path ${cfg.telemetryPath} \
          --config.file ${
-            if cfg.configuration != {} then configurationFile else cfg.configFile
+            if cfg.configuration != null then configurationFile else (escapeShellArg cfg.configFile)
          } \
          ${concatStringsSep " \\\n  " cfg.extraFlags}
      '';
--- a/nixos/modules/services/monitoring/prometheus/exporters/mikrotik.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/mikrotik.nix
@ -0,0 +1,66 @@
+{ config, lib, pkgs, options }:
+
+with lib;
+
+let
+  cfg = config.services.prometheus.exporters.mikrotik;
+in
+{
+  port = 9436;
+  extraOpts = {
+    configFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = ''
+        Path to a mikrotik exporter configuration file. Mutually exclusive with
+        <option>configuration</option> option.
+      '';
+      example = literalExample "./mikrotik.yml";
+    };
+
+    configuration = mkOption {
+      type = types.nullOr types.attrs;
+      default = null;
+      description = ''
+        Mikrotik exporter configuration as nix attribute set. Mutually exclusive with
+        <option>configFile</option> option.
+
+        See <link xlink:href="https://github.com/nshttpd/mikrotik-exporter/blob/master/README.md"/>
+        for the description of the configuration file format.
+      '';
+      example = literalExample ''
+        {
+          devices = [
+            {
+              name = "my_router";
+              address = "10.10.0.1";
+              user = "prometheus";
+              password = "changeme";
+            }
+          ];
+          features = {
+            bgp = true;
+            dhcp = true;
+            routes = true;
+            optics = true;
+          };
+        }
+      '';
+    };
+  };
+  serviceOpts = let
+    configFile = if cfg.configFile != null
+                 then cfg.configFile
+                 else "${pkgs.writeText "mikrotik-exporter.yml" (builtins.toJSON cfg.configuration)}";
+    in {
+    serviceConfig = {
+      # -port is misleading name, it actually accepts address too
+      ExecStart = ''
+        ${pkgs.prometheus-mikrotik-exporter}/bin/mikrotik-exporter \
+          -config-file=${escapeShellArg configFile} \
+          -port=${cfg.listenAddress}:${toString cfg.port} \
+          ${concatStringsSep " \\\n  " cfg.extraFlags}
+      '';
+    };
+  };
+}
--- a/nixos/modules/services/monitoring/prometheus/exporters/minio.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/minio.nix
@ -54,8 +54,8 @@ in
        ${pkgs.prometheus-minio-exporter}/bin/minio-exporter \
          -web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
          -minio.server ${cfg.minioAddress} \
-          -minio.access-key ${cfg.minioAccessKey} \
-          -minio.access-secret ${cfg.minioAccessSecret} \
+          -minio.access-key ${escapeShellArg cfg.minioAccessKey} \
+          -minio.access-secret ${escapeShellArg cfg.minioAccessSecret} \
          ${optionalString cfg.minioBucketStats "-minio.bucket-stats"} \
          ${concatStringsSep " \\\n  " cfg.extraFlags}
      '';
--- a/nixos/modules/services/monitoring/prometheus/exporters/nextcloud.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/nextcloud.nix
@ -50,7 +50,7 @@ in
          -u ${cfg.username} \
          -t ${cfg.timeout} \
          -l ${cfg.url} \
-          -p @${cfg.passwordFile} \
+          -p ${escapeShellArg "@${cfg.passwordFile}"} \
          ${concatStringsSep " \\\n  " cfg.extraFlags}
      '';
    };
--- a/nixos/modules/services/monitoring/prometheus/exporters/postfix.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/postfix.nix
@ -67,15 +67,15 @@ in
        ${pkgs.prometheus-postfix-exporter}/bin/postfix_exporter \
          --web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
          --web.telemetry-path ${cfg.telemetryPath} \
-          --postfix.showq_path ${cfg.showqPath} \
+          --postfix.showq_path ${escapeShellArg cfg.showqPath} \
          ${concatStringsSep " \\\n  " (cfg.extraFlags
          ++ optional cfg.systemd.enable "--systemd.enable"
          ++ optional cfg.systemd.enable (if cfg.systemd.slice != null
                                          then "--systemd.slice ${cfg.systemd.slice}"
                                          else "--systemd.unit ${cfg.systemd.unit}")
          ++ optional (cfg.systemd.enable && (cfg.systemd.journalPath != null))
-                       "--systemd.journal_path ${cfg.systemd.journalPath}"
-          ++ optional (!cfg.systemd.enable) "--postfix.logfile_path ${cfg.logfilePath}")}
+                       "--systemd.journal_path ${escapeShellArg cfg.systemd.journalPath}"
+          ++ optional (!cfg.systemd.enable) "--postfix.logfile_path ${escapeShellArg cfg.logfilePath}")}
      '';
    };
  };
--- a/nixos/modules/services/monitoring/prometheus/exporters/snmp.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/snmp.nix
@ -19,7 +19,7 @@ in

    configuration = mkOption {
      type = types.nullOr types.attrs;
-      default = {};
+      default = null;
      description = ''
        Snmp exporter configuration as nix attribute set. Mutually exclusive with 'configurationPath' option.
      '';
@ -36,15 +36,15 @@ in
    };

    logFormat = mkOption {
-      type = types.str;
-      default = "logger:stderr";
+      type = types.enum ["logfmt" "json"];
+      default = "logfmt";
      description = ''
-        Set the log target and format.
+        Output format of log messages.
      '';
    };

    logLevel = mkOption {
-      type = types.enum ["debug" "info" "warn" "error" "fatal"];
+      type = types.enum ["debug" "info" "warn" "error"];
      default = "info";
      description = ''
        Only log messages with the given severity or above.
@ -54,13 +54,13 @@ in
  serviceOpts = let
    configFile = if cfg.configurationPath != null
                 then cfg.configurationPath
-                 else "${pkgs.writeText "snmp-eporter-conf.yml" (builtins.toJSON cfg.configuration)}";
+                 else "${pkgs.writeText "snmp-exporter-conf.yml" (builtins.toJSON cfg.configuration)}";
    in {
    serviceConfig = {
      ExecStart = ''
        ${pkgs.prometheus-snmp-exporter.bin}/bin/snmp_exporter \
-          --config.file=${configFile} \
-          --log.format=${cfg.logFormat} \
+          --config.file=${escapeShellArg configFile} \
+          --log.format=${escapeShellArg cfg.logFormat} \
          --log.level=${cfg.logLevel} \
          --web.listen-address=${cfg.listenAddress}:${toString cfg.port} \
          ${concatStringsSep " \\\n  " cfg.extraFlags}
--- a/nixos/modules/services/monitoring/prometheus/exporters/unifi.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/unifi.nix
@ -55,8 +55,8 @@ in
        ${pkgs.prometheus-unifi-exporter}/bin/unifi_exporter \
          -telemetry.addr ${cfg.listenAddress}:${toString cfg.port} \
          -unifi.addr ${cfg.unifiAddress} \
-          -unifi.username ${cfg.unifiUsername} \
-          -unifi.password ${cfg.unifiPassword} \
+          -unifi.username ${escapeShellArg cfg.unifiUsername} \
+          -unifi.password ${escapeShellArg cfg.unifiPassword} \
          -unifi.timeout ${cfg.unifiTimeout} \
          ${optionalString cfg.unifiInsecure "-unifi.insecure" } \
          ${concatStringsSep " \\\n  " cfg.extraFlags}
--- a/nixos/modules/services/monitoring/prometheus/exporters/varnish.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/varnish.nix
@ -74,10 +74,10 @@ in
        ${pkgs.prometheus-varnish-exporter}/bin/prometheus_varnish_exporter \
          --web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
          --web.telemetry-path ${cfg.telemetryPath} \
-          --varnishstat-path ${cfg.varnishStatPath} \
+          --varnishstat-path ${escapeShellArg cfg.varnishStatPath} \
          ${concatStringsSep " \\\n  " (cfg.extraFlags
            ++ optional (cfg.healthPath != null) "--web.health-path ${cfg.healthPath}"
-            ++ optional (cfg.instance != null) "-n ${cfg.instance}"
+            ++ optional (cfg.instance != null) "-n ${escapeShellArg cfg.instance}"
            ++ optional cfg.noExit "--no-exit"
            ++ optional cfg.withGoMetrics "--with-go-metrics"
            ++ optional cfg.verbose "--verbose"
--- a/nixos/modules/services/monitoring/prometheus/exporters/wireguard.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/wireguard.nix
@ -59,7 +59,7 @@ in {
          ${optionalString cfg.verbose "-v"} \
          ${optionalString cfg.singleSubnetPerField "-s"} \
          ${optionalString cfg.withRemoteIp "-r"} \
-          ${optionalString (cfg.wireguardConfig != null) "-n ${cfg.wireguardConfig}"}
+          ${optionalString (cfg.wireguardConfig != null) "-n ${escapeShellArg cfg.wireguardConfig}"}
      '';
    };
  };
--- a/nixos/modules/services/networking/shorewall.nix
+++ b/nixos/modules/services/networking/shorewall.nix
@ -26,13 +26,14 @@ in {
        description = "The shorewall package to use.";
      };
      configs = lib.mkOption {
-        type        = types.attrsOf types.str;
+        type        = types.attrsOf types.lines;
        default     = {};
        description = ''
          This option defines the Shorewall configs.
          The attribute name defines the name of the config,
          and the attribute value defines the content of the config.
        '';
+        apply = lib.mapAttrs (name: text: pkgs.writeText "${name}" text);
      };
    };
  };
@ -62,7 +63,7 @@ in {
      '';
    };
    environment = {
-      etc = lib.mapAttrs' (name: conf: lib.nameValuePair "shorewall/${name}" {text=conf;}) cfg.configs;
+      etc = lib.mapAttrs' (name: conf: lib.nameValuePair "shorewall/${name}" {source=conf;}) cfg.configs;
      systemPackages = [ cfg.package ];
    };
  };
--- a/nixos/modules/services/networking/shorewall6.nix
+++ b/nixos/modules/services/networking/shorewall6.nix
@ -26,13 +26,14 @@ in {
        description = "The shorewall package to use.";
      };
      configs = lib.mkOption {
-        type        = types.attrsOf types.str;
+        type        = types.attrsOf types.lines;
        default     = {};
        description = ''
          This option defines the Shorewall configs.
          The attribute name defines the name of the config,
          and the attribute value defines the content of the config.
        '';
+        apply = lib.mapAttrs (name: text: pkgs.writeText "${name}" text);
      };
    };
  };
@ -62,7 +63,7 @@ in {
      '';
    };
    environment = {
-      etc = lib.mapAttrs' (name: conf: lib.nameValuePair "shorewall6/${name}" {text=conf;}) cfg.configs;
+      etc = lib.mapAttrs' (name: conf: lib.nameValuePair "shorewall6/${name}" {source=conf;}) cfg.configs;
      systemPackages = [ cfg.package ];
    };
  };
--- a/nixos/modules/services/networking/wireguard.nix
+++ b/nixos/modules/services/networking/wireguard.nix
@ -428,7 +428,7 @@ in
      ++ (attrValues (
        mapAttrs (name: value: {
          assertion = value.generatePrivateKeyFile -> (value.privateKey == null);
-          message = "networking.wireguard.interfaces.${name}.generatePrivateKey must not be set if networking.wireguard.interfaces.${name}.privateKey is set.";
+          message = "networking.wireguard.interfaces.${name}.generatePrivateKeyFile must not be set if networking.wireguard.interfaces.${name}.privateKey is set.";
        }) cfg.interfaces))
        ++ map ({ interfaceName, peer, ... }: {
          assertion = (peer.presharedKey == null) || (peer.presharedKeyFile == null);
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@ -87,10 +87,17 @@ let
      ${optionalString (cfg.sslDhparam != null) "ssl_dhparam ${cfg.sslDhparam};"}

      ${optionalString (cfg.recommendedTlsSettings) ''
-        ssl_session_cache shared:SSL:42m;
-        ssl_session_timeout 23m;
-        ssl_ecdh_curve secp384r1;
-        ssl_prefer_server_ciphers on;
+        # Keep in sync with https://ssl-config.mozilla.org/#server=nginx&config=intermediate
+
+        ssl_session_timeout 1d;
+        ssl_session_cache shared:SSL:10m;
+        # Breaks forward secrecy: https://github.com/mozilla/server-side-tls/issues/135
+        ssl_session_tickets off;
+        # We don't enable insecure ciphers by default, so this allows
+        # clients to pick the most performant, per https://github.com/mozilla/server-side-tls/issues/260
+        ssl_prefer_server_ciphers off;
+
+        # OCSP stapling
        ssl_stapling on;
        ssl_stapling_verify on;
      ''}
@ -487,8 +494,9 @@ in

      sslCiphers = mkOption {
        type = types.str;
-        default = "EECDH+aRSA+AESGCM:EDH+aRSA:EECDH+aRSA:+AES256:+AES128:+SHA1:!CAMELLIA:!SEED:!3DES:!DES:!RC4:!eNULL";
-        description = "Ciphers to choose from when negotiating tls handshakes.";
+        # Keep in sync with https://ssl-config.mozilla.org/#server=nginx&config=intermediate
+        default = "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
+        description = "Ciphers to choose from when negotiating TLS handshakes.";
      };

      sslProtocols = mkOption {
--- a/nixos/modules/services/web-servers/uwsgi.nix
+++ b/nixos/modules/services/web-servers/uwsgi.nix
@ -32,7 +32,7 @@ let
              inherit plugins;
            } // removeAttrs c [ "type" "pythonPackages" ]
              // optionalAttrs (python != null) {
-                pythonpath = "${pythonEnv}/${python.sitePackages}";
+                pyhome = "${pythonEnv}";
                env =
                  # Argh, uwsgi expects list of key-values there instead of a dictionary.
                  let env' = c.env or [];
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@ -224,7 +224,7 @@ let
          after = [ "postfix.service" ];
          requires = [ "postfix.service" ];
          preStart = ''
-            mkdir -p 0600 mail-exporter/new
+            mkdir -p -m 0700 mail-exporter/new
          '';
          serviceConfig = {
            ProtectHome = true;
@ -245,6 +245,46 @@ let
      '';
    };

+    mikrotik = {
+      exporterConfig = {
+        enable = true;
+        extraFlags = [ "-timeout=1s" ];
+        configuration = {
+          devices = [
+            {
+              name = "router";
+              address = "192.168.42.48";
+              user = "prometheus";
+              password = "shh";
+            }
+          ];
+          features = {
+            bgp = true;
+            dhcp = true;
+            dhcpl = true;
+            dhcpv6 = true;
+            health = true;
+            routes = true;
+            poe = true;
+            pools = true;
+            optics = true;
+            w60g = true;
+            wlansta = true;
+            wlanif = true;
+            monitor = true;
+            ipsec = true;
+          };
+        };
+      };
+      exporterTest = ''
+        wait_for_unit("prometheus-mikrotik-exporter.service")
+        wait_for_open_port(9436)
+        succeed(
+            "curl -sSf http://localhost:9436/metrics | grep -q 'mikrotik_scrape_collector_success{device=\"router\"} 0'"
+        )
+      '';
+    };
+
    nextcloud = {
      exporterConfig = {
        enable = true;
@ -363,6 +403,7 @@ let
      };
      metricProvider = {
        services.rspamd.enable = true;
+        virtualisation.memorySize = 1024;
      };
      exporterTest = ''
        wait_for_unit("rspamd.service")
--- a/pkgs/applications/editors/focuswriter/default.nix
+++ b/pkgs/applications/editors/focuswriter/default.nix
@ -2,11 +2,11 @@

 mkDerivation rec {
  pname = "focuswriter";
-  version = "1.7.4";
+  version = "1.7.5";

  src = fetchurl {
    url = "https://gottcode.org/focuswriter/focuswriter-${version}-src.tar.bz2";
-    sha256 = "1fli85p9d58gsg2kwmncqdcw1nmx062kddbrhr50mnsn04dc4j3g";
+    sha256 = "19fqxyas941xcqjj68qpj42ayq0vw5rbd4ms5kvx8jyspp7wysqc";
  };

  nativeBuildInputs = [ pkgconfig qmake qttools ];
@ -22,6 +22,6 @@ mkDerivation rec {
    license = licenses.gpl3Plus;
    maintainers = with maintainers; [ madjar ];
    platforms = platforms.linux;
-    homepage = https://gottcode.org/focuswriter/;
+    homepage = "https://gottcode.org/focuswriter/";
  };
 }
--- a/pkgs/applications/editors/rednotebook/default.nix
+++ b/pkgs/applications/editors/rednotebook/default.nix
@ -5,13 +5,13 @@

 buildPythonApplication rec {
  pname = "rednotebook";
-  version = "2.16";
+  version = "2.18";

  src = fetchFromGitHub {
    owner = "jendrikseipp";
    repo = "rednotebook";
    rev = "v${version}";
-    sha256 = "1cziac9pmhpxvs8qg54wbckzgjpplqb55hykg5vdwdqqs7j054aj";
+    sha256 = "1m75ns6vgycyi3zjlc9w2gnry1gyfz1jxhrklcxxi6aap0jxlgnr";
  };

  # We have not packaged tests.
--- a/pkgs/applications/editors/vim/macvim-sparkle.patch
+++ b/pkgs/applications/editors/vim/macvim-sparkle.patch
@ -1,106 +0,0 @@
-diff --git a/src/MacVim/English.lproj/MainMenu.nib/designable.nib b/src/MacVim/English.lproj/MainMenu.nib/designable.nib
-index bdbcfdb9e..5efc78ab6 100644
--- a/src/MacVim/English.lproj/MainMenu.nib/designable.nib
-+++ b/src/MacVim/English.lproj/MainMenu.nib/designable.nib
-@@ -24,11 +24,6 @@
-                                     <action selector="orderFrontStandardAboutPanel:" target="-2" id="142"/>
-                                 </connections>
-                             </menuItem>
-                            <menuItem title="Check for Updates…" id="255">
-                                <connections>
-                                    <action selector="checkForUpdates:" target="Jqk-qh-n0J" id="Wau-rL-cbn"/>
-                                </connections>
-                            </menuItem>
-                             <menuItem isSeparatorItem="YES" id="196">
-                                 <modifierMask key="keyEquivalentModifierMask" command="YES"/>
-                             </menuItem>
-@@ -206,6 +201,5 @@
-                 </menuItem>
-             </items>
-         </menu>
-        <customObject id="Jqk-qh-n0J" customClass="SUUpdater"/>
-     </objects>
- </document>
-diff --git a/src/MacVim/English.lproj/Preferences.nib/designable.nib b/src/MacVim/English.lproj/Preferences.nib/designable.nib
-index 889450913..38afc3416 100644
--- a/src/MacVim/English.lproj/Preferences.nib/designable.nib
-+++ b/src/MacVim/English.lproj/Preferences.nib/designable.nib
-@@ -88,14 +88,10 @@
-                     <rect key="frame" x="207" y="208" width="258" height="18"/>
-                     <autoresizingMask key="autoresizingMask" flexibleMinY="YES"/>
-                     <string key="toolTip">Checks for updates and presents a dialog box showing the release notes and prompt for whether you want to install the new version.</string>
-                    <buttonCell key="cell" type="check" title="Check for updates" bezelStyle="regularSquare" imagePosition="left" alignment="left" inset="2" id="975">
-+                    <buttonCell key="cell" type="check" title="Check for updates" bezelStyle="regularSquare" imagePosition="left" alignment="left" enabled="NO" inset="2" id="975">
-                         <behavior key="behavior" changeContents="YES" doesNotDimImage="YES" lightByContents="YES"/>
-                         <font key="font" metaFont="system"/>
-                     </buttonCell>
-                    <connections>
-                        <action selector="checkForUpdatesChanged:" target="-2" id="YjS-ig-M1j"/>
-                        <binding destination="58" name="value" keyPath="values.SUCheckAtStartup" id="169"/>
-                    </connections>
-                 </button>
-                 <textField verticalHuggingPriority="750" id="121">
-                     <rect key="frame" x="209" y="50" width="243" height="58"/>
-@@ -186,16 +182,13 @@
-                     <rect key="frame" x="221" y="188" width="244" height="18"/>
-                     <autoresizingMask key="autoresizingMask" flexibleMinY="YES"/>
-                     <string key="toolTip">MacVim will automatically download and install updates without prompting. The updated version will be used the next time MacVim starts.</string>
-                    <buttonCell key="cell" type="check" title="Automatically install updates" bezelStyle="regularSquare" imagePosition="left" alignment="left" inset="2" id="GfP-vg-mec">
-+                    <buttonCell key="cell" type="check" title="Automatically install updates" bezelStyle="regularSquare" imagePosition="left" alignment="left" enabled="NO" inset="2" id="GfP-vg-mec">
-                         <behavior key="behavior" changeContents="YES" doesNotDimImage="YES" lightByContents="YES"/>
-                         <font key="font" metaFont="system"/>
-                         <connections>
-                             <binding destination="58" name="enabled" keyPath="values.SUCheckAtStartup" id="5oY-Gf-XJN"/>
-                         </connections>
-                     </buttonCell>
-                    <connections>
-                        <binding destination="58" name="value" keyPath="values.SUAutomaticallyUpdate" id="kyZ-ah-zKf"/>
-                    </connections>
-                 </button>
-             </subviews>
-             <point key="canvasLocation" x="137.5" y="382"/>
-diff --git a/src/MacVim/MacVim.xcodeproj/project.pbxproj b/src/MacVim/MacVim.xcodeproj/project.pbxproj
-index 648c4290d..c7dd99d1e 100644
--- a/src/MacVim/MacVim.xcodeproj/project.pbxproj
-+++ b/src/MacVim/MacVim.xcodeproj/project.pbxproj
-@@ -66,8 +66,6 @@
- 		1DFE25A50C527BC4003000F7 /* PSMTabBarControl.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 1D493DB90C52533B00AB718C /* PSMTabBarControl.framework */; };
- 		52818B031C1C08CE00F59085 /* QLStephen.qlgenerator in Copy QuickLookPlugin */ = {isa = PBXBuildFile; fileRef = 52818AFF1C1C075300F59085 /* QLStephen.qlgenerator */; settings = {ATTRIBUTES = (CodeSignOnCopy, ); }; };
- 		528DA66A1426D4F9003380F1 /* macvim-askpass in Copy Scripts */ = {isa = PBXBuildFile; fileRef = 528DA6691426D4EB003380F1 /* macvim-askpass */; };
-		52A364731C4A5789005757EC /* Sparkle.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 52A364721C4A5789005757EC /* Sparkle.framework */; };
-		52A364761C4A57C1005757EC /* Sparkle.framework in Copy Frameworks */ = {isa = PBXBuildFile; fileRef = 52A364721C4A5789005757EC /* Sparkle.framework */; settings = {ATTRIBUTES = (CodeSignOnCopy, RemoveHeadersOnCopy, ); }; };
- 		52B7ED9B1C4A4D6900AFFF15 /* dsa_pub.pem in Resources */ = {isa = PBXBuildFile; fileRef = 52B7ED9A1C4A4D6900AFFF15 /* dsa_pub.pem */; };
- 		8D11072A0486CEB800E47090 /* MainMenu.nib in Resources */ = {isa = PBXBuildFile; fileRef = 29B97318FDCFA39411CA2CEA /* MainMenu.nib */; };
- 		8D11072B0486CEB800E47090 /* InfoPlist.strings in Resources */ = {isa = PBXBuildFile; fileRef = 089C165CFE840E0CC02AAC07 /* InfoPlist.strings */; };
-@@ -124,7 +122,6 @@
- 			dstPath = "";
- 			dstSubfolderSpec = 10;
- 			files = (
-				52A364761C4A57C1005757EC /* Sparkle.framework in Copy Frameworks */,
- 				1D493DBA0C52534300AB718C /* PSMTabBarControl.framework in Copy Frameworks */,
- 			);
- 			name = "Copy Frameworks";
-@@ -250,7 +247,6 @@
- 		32CA4F630368D1EE00C91783 /* MacVim_Prefix.pch */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MacVim_Prefix.pch; sourceTree = "<group>"; };
- 		52818AFA1C1C075300F59085 /* QuickLookStephen.xcodeproj */ = {isa = PBXFileReference; lastKnownFileType = "wrapper.pb-project"; name = QuickLookStephen.xcodeproj; path = qlstephen/QuickLookStephen.xcodeproj; sourceTree = "<group>"; };
- 		528DA6691426D4EB003380F1 /* macvim-askpass */ = {isa = PBXFileReference; lastKnownFileType = text.script.sh; path = "macvim-askpass"; sourceTree = "<group>"; };
-		52A364721C4A5789005757EC /* Sparkle.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; path = Sparkle.framework; sourceTree = "<group>"; };
- 		52B7ED9A1C4A4D6900AFFF15 /* dsa_pub.pem */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = dsa_pub.pem; sourceTree = "<group>"; };
- 		8D1107310486CEB800E47090 /* Info.plist */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.plist; path = Info.plist; sourceTree = "<group>"; };
- 		8D1107320486CEB800E47090 /* MacVim.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = MacVim.app; sourceTree = BUILT_PRODUCTS_DIR; };
-@@ -264,7 +260,6 @@
- 				1DFE25A50C527BC4003000F7 /* PSMTabBarControl.framework in Frameworks */,
- 				8D11072F0486CEB800E47090 /* Cocoa.framework in Frameworks */,
- 				1D8B5A53104AF9FF002E59D5 /* Carbon.framework in Frameworks */,
-				52A364731C4A5789005757EC /* Sparkle.framework in Frameworks */,
- 			);
- 			runOnlyForDeploymentPostprocessing = 0;
- 		};
-@@ -443,7 +438,6 @@
- 		29B97323FDCFA39411CA2CEA /* Frameworks */ = {
- 			isa = PBXGroup;
- 			children = (
-				52A364721C4A5789005757EC /* Sparkle.framework */,
- 				1D8B5A52104AF9FF002E59D5 /* Carbon.framework */,
- 				1D493DB30C52533B00AB718C /* PSMTabBarControl.xcodeproj */,
- 				1058C7A0FEA54F0111CA2CBB /* Linked Frameworks */,
--- a/pkgs/applications/editors/vim/macvim.nix
+++ b/pkgs/applications/editors/vim/macvim.nix
@ -27,13 +27,13 @@ in
 stdenv.mkDerivation {
  pname = "macvim";

-  version = "8.1.2234";
+  version = "8.2.319";

  src = fetchFromGitHub {
    owner = "macvim-dev";
    repo = "macvim";
-    rev = "snapshot-161";
-    sha256 = "1hp3y85pj1icz053g627a1wp5pnwgxhk07pyd4arwcxs2103agw4";
+    rev = "snapshot-162";
+    sha256 = "1mg55jlrz533wlqrx028fyv86rfhdzvm5kdi8xlf67flc5hh9vrp";
  };

  enableParallelBuilding = true;
@ -43,18 +43,7 @@ stdenv.mkDerivation {
    gettext ncurses cscope luajit ruby tcl perl python.pkg
  ];

-  patches = [ ./macvim.patch ./macvim-sparkle.patch ];
-
-  # The sparkle patch modified the nibs, so we have to recompile them
-  postPatch = ''
-    for nib in MainMenu Preferences; do
-      # redirect stdin/stdout/stderr to /dev/null because ibtool marks them nonblocking
-      # and not redirecting screws with subsequent commands.
-      # redirecting stderr is unfortunate but I don't know of a reasonable way to remove O_NONBLOCK
-      # from the fds.
-      /usr/bin/ibtool --compile src/MacVim/English.lproj/$nib.nib/keyedobjects.nib src/MacVim/English.lproj/$nib.nib >/dev/null 2>/dev/null </dev/null
-    done
-  '';
+  patches = [ ./macvim.patch ];

  configureFlags = [
      "--enable-cscope"
@ -76,11 +65,20 @@ stdenv.mkDerivation {
      "--with-tclsh=${tcl}/bin/tclsh"
      "--with-tlib=ncurses"
      "--with-compiledby=Nix"
+      "--disable-sparkle"
      "LDFLAGS=-headerpad_max_install_names"
  ];

  makeFlags = ''PREFIX=$(out) CPPFLAGS="-Wno-error"'';

+  # Remove references to Sparkle.framework from the project.
+  # It's unused (we disabled it with --disable-sparkle) and this avoids
+  # copying the unnecessary several-megabyte framework into the result.
+  postPatch = ''
+    echo "Patching file src/MacVim/MacVim.xcodeproj/project.pbxproj"
+    sed -e '/Sparkle\.framework/d' -i src/MacVim/MacVim.xcodeproj/project.pbxproj
+  '';
+
  # This is unfortunate, but we need to use the same compiler as Xcode,
  # but Xcode doesn't provide a way to configure the compiler.
  #
--- a/pkgs/applications/editors/vscode/with-extensions.nix
+++ b/pkgs/applications/editors/vscode/with-extensions.nix
@ -48,7 +48,7 @@ let
  wrappedPkgName = lib.removeSuffix "-${wrappedPkgVersion}" vscode.name;

  combinedExtensionsDrv = buildEnv {
-    name = "${wrappedPkgName}-extensions-${wrappedPkgVersion}";
+    name = "vscode-extensions";
    paths = vscodeExtensions;
  };

@ -70,6 +70,6 @@ runCommand "${wrappedPkgName}-with-extensions-${wrappedPkgVersion}" {
  ln -sT "${vscode}/share/applications/${executableName}.desktop" "$out/share/applications/${executableName}.desktop"
  ln -sT "${vscode}/share/applications/${executableName}-url-handler.desktop" "$out/share/applications/${executableName}-url-handler.desktop"
  makeWrapper "${vscode}/bin/${executableName}" "$out/bin/${executableName}" ${lib.optionalString (vscodeExtensions != []) ''
-    --add-flags "--extensions-dir ${combinedExtensionsDrv}/share/${wrappedPkgName}/extensions"
+    --add-flags "--extensions-dir ${combinedExtensionsDrv}"
  ''}
 ''
--- a/pkgs/applications/graphics/rawtherapee/default.nix
+++ b/pkgs/applications/graphics/rawtherapee/default.nix
@ -4,14 +4,14 @@
 }:

 stdenv.mkDerivation rec {
-  version = "5.7";
+  version = "5.8";
  pname = "rawtherapee";

  src = fetchFromGitHub {
    owner = "Beep6581";
    repo = "RawTherapee";
    rev = version;
-    sha256 = "0j3887a3683fqpvp66kaw6x81ai3gf5nvrbmb4cc8rb0lgj2xv2g";
+    sha256 = "0d644s4grfia6f3k6y0byd5pwajr12kai2kc280yxi8v3w1b12ik";
  };

  nativeBuildInputs = [ cmake pkgconfig wrapGAppsHook ];
--- a/pkgs/applications/misc/cherrytree/default.nix
+++ b/pkgs/applications/misc/cherrytree/default.nix
@ -2,11 +2,11 @@

 pythonPackages.buildPythonApplication rec {
  pname = "cherrytree";
-  version = "0.38.11";
+  version = "0.39.0";

  src = fetchurl {
    url = "https://www.giuspen.com/software/${pname}-${version}.tar.xz";
-    sha256 = "1awrrfyawa7d8qaipvikxm1p0961060az2qvmv9wwpl47zcnk1dn";
+    sha256 = "07ibr891qix7xa2sk6fdxdsji8q56c1wf786mxaz77500m0xfx4m";
  };

  nativeBuildInputs = [ gettext ];
--- a/pkgs/applications/misc/dbeaver/default.nix
+++ b/pkgs/applications/misc/dbeaver/default.nix
@ -30,7 +30,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://dbeaver.io/files/${version}/dbeaver-ce-${version}-linux.gtk.x86_64.tar.gz";
-    sha256 = "0ggay9igpqwq016yzfz2dw3cjhlzadaml0hi06iqzhxljr86qm44";
+    sha256 = "1fnvwndzny51z0zmdnlafdcxawsyz435g712mc4bjjj29qy0inzm";
  };

  installPhase = ''
--- a/pkgs/applications/misc/elogind/default.nix
+++ b/pkgs/applications/misc/elogind/default.nix
@ -29,13 +29,13 @@ with stdenv.lib;

 stdenv.mkDerivation rec {
  pname = "elogind";
-  version = "243.4";
+  version = "243.7";

  src = fetchFromGitHub {
    owner = "elogind";
    repo = pname;
    rev = "v${version}";
-    sha256 = "141frvgyk4fafcxsix94qc0d9ffrwksld8lqq4hq6xsgjlvv0mrs";
+    sha256 = "0cihdf7blhncm2359qxli24j9l3dkn15gjys5vpjwny80zlym5ma";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/fluxboxlauncher/default.nix
+++ b/pkgs/applications/misc/fluxboxlauncher/default.nix
@ -0,0 +1,56 @@
+{ lib
+, fetchFromGitHub
+, python3
+, gtk3
+, wrapGAppsHook
+, glibcLocales
+, gobject-introspection
+, gettext
+, pango
+, gdk-pixbuf
+, atk
+, fluxbox
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "fluxboxlauncher";
+  version = "0.2.1";
+
+  src = fetchFromGitHub {
+    owner = "mothsart";
+    repo = "fluxboxlauncher";
+    rev = "0.2.1";
+    sha256 = "024h1dk0bhc5s4dldr6pqabrgcqih9p8cys5lqgkgz406y4vyzvf";
+  };
+
+  nativeBuildInputs = [
+    wrapGAppsHook
+    gobject-introspection
+    pango
+    gdk-pixbuf
+    atk
+    gettext
+  ];
+
+  buildInputs = [
+    glibcLocales
+    gtk3
+    python3
+    fluxbox
+  ];
+
+  makeWrapperArgs = [ "--set LOCALE_ARCHIVE ${glibcLocales}/lib/locale/locale-archive"
+                      "--set CHARSET en_us.UTF-8" ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    pygobject3
+  ];
+
+  meta = with lib; {
+    description = "A Gui editor (gtk) to configure applications launching on a fluxbox session";
+    homepage = "https://github.com/mothsART/fluxboxlauncher";
+    maintainers = with maintainers; [ mothsart ];
+    license = licenses.bsdOriginal;
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/misc/gpxsee/default.nix
+++ b/pkgs/applications/misc/gpxsee/default.nix
@ -1,24 +1,23 @@
-{ stdenv, mkDerivation, lib, fetchFromGitHub, qmake, qttools }:
+{ stdenv, mkDerivation, fetchFromGitHub, qmake, qttools }:

 mkDerivation rec {
  pname = "gpxsee";
-  version = "7.22";
+  version = "7.25";

  src = fetchFromGitHub {
    owner = "tumic0";
    repo = "GPXSee";
    rev = version;
-    sha256 = "0gxkx255d8cn5076ync731cdygwvi95rxv463pd4rdw5srbr0gm5";
+    sha256 = "0lml3hz2zxljl9j5wnh7bn9bj8k9v3wf6bk3g77x9nnarsmw0fcx";
  };

-  nativeBuildInputs = [ qmake ];
-  buildInputs = [ qttools ];
+  nativeBuildInputs = [ qmake qttools ];

  preConfigure = ''
    lrelease lang/*.ts
  '';

-  postInstall = lib.optionalString stdenv.isDarwin ''
+  postInstall = with stdenv; lib.optionalString isDarwin ''
    mkdir -p $out/Applications
    mv GPXSee.app $out/Applications
    wrapQtApp $out/Applications/GPXSee.app/Contents/MacOS/GPXSee
@ -26,8 +25,8 @@ mkDerivation rec {

  enableParallelBuilding = true;

-  meta = with lib; {
-    homepage = https://www.gpxsee.org/;
+  meta = with stdenv.lib; {
+    homepage = "https://www.gpxsee.org/";
    description = "GPS log file viewer and analyzer";
    longDescription = ''
      GPXSee is a Qt-based GPS log file viewer and analyzer that supports
--- a/pkgs/applications/misc/notable/default.nix
+++ b/pkgs/applications/misc/notable/default.nix
@ -2,13 +2,13 @@

 let
  pname = "notable";
-  version = "1.7.3";
+  version = "1.8.4";
 in
 appimageTools.wrapType2 rec {
  name = "${pname}-${version}";
  src = fetchurl {
    url = "https://github.com/notable/notable/releases/download/v${version}/Notable-${version}.AppImage";
-    sha256 = "1a7xpdk23np398nrgivyp8z54idqm72dfwx67i2rmxa3dnmcxkvl";
+    sha256 = "0rvz8zwsi62kiq89pv8n2wh9h5yb030kvdr1vf65xwqkhqcrzrby";
  };

  profile = ''
@ -22,8 +22,8 @@ appimageTools.wrapType2 rec {

  meta = with lib; {
    description = "The markdown-based note-taking app that doesn't suck";
-    homepage = https://github.com/notable/notable;
-    license = licenses.agpl3;
+    homepage = "https://github.com/notable/notable";
+    license = licenses.unfree;
    platforms = [ "x86_64-linux" ];
    maintainers = with maintainers; [ dtzWill ];
  };
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@ -112,8 +112,8 @@ in rec {
  terraform_0_11-full = terraform_0_11.full;

  terraform_0_12 = pluggable (generic {
-    version = "0.12.21";
-    sha256 = "128mrqib8rigy6kk6fby0pjh4jh2qm2qwkrlbn0wgfln0637d9ff";
+    version = "0.12.23";
+    sha256 = "1lr2gfk5dmj6rhv5rvzn3fggb34za73ryjy0vdzx4kf3qj12r0wz";
    patches = [ ./provider-path.patch ];
    passthru = { inherit plugins; };
  });
--- a/pkgs/applications/networking/ids/suricata/default.nix
+++ b/pkgs/applications/networking/ids/suricata/default.nix
@ -34,11 +34,11 @@
 in
 stdenv.mkDerivation rec {
  pname = "suricata";
-  version = "5.0.1";
+  version = "5.0.2";

  src = fetchurl {
    url = "https://www.openinfosecfoundation.org/download/${pname}-${version}.tar.gz";
-    sha256 = "034b0nl0hkh0v26gwbawi2wdv7mb9p54cfg8gc9b8hsw49k3c1wh";
+    sha256 = "1ryfa3bzd8mrq2k5kjfwmblxqqziz6b9n1dnh692mazf5z4wlc3z";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@ -23,7 +23,7 @@ let
      else "");
 in stdenv.mkDerivation rec {
  pname = "signal-desktop";
-  version = "1.32.0"; # Please backport all updates to the stable channel.
+  version = "1.32.1"; # Please backport all updates to the stable channel.
  # All releases have a limited lifetime and "expire" 90 days after the release.
  # When releases "expire" the application becomes unusable until an update is
  # applied. The expiration date for the current release can be extracted with:
@ -33,7 +33,7 @@ in stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "1ggblpw2xxhm78sqadswcv0314zagksj34z8pywjnr8h9zkcyiap";
+    sha256 = "0sfzz1z57l20prj2s8hdl8ip1hrlzb5fqnccqcfd101a6mjnp9i9";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
@ -7,7 +7,7 @@ let

  # Please keep the version x.y.0.z and do not update to x.y.76.z because the
  # source of the latter disappears much faster.
-  version = "8.55.0.141";
+  version = "8.56.0.103";

  rpath = stdenv.lib.makeLibraryPath [
    alsaLib
@ -63,7 +63,7 @@ let
          "https://repo.skype.com/deb/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
          "https://web.archive.org/web/https://repo.skype.com/deb/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
        ];
-        sha256 = "0yfbxrnf2mjihrsvp0r81kbxh3rfh53y7sbfp3bwqky951a93qis";
+        sha256 = "01qyi92dh4xalzaqzj9n3bz59y91rx45gkyw4k9ckjknbjwb3c90";
      }
    else
      throw "Skype for linux is not supported on ${stdenv.hostPlatform.system}";
--- a/pkgs/applications/networking/instant-messengers/teamspeak/server.nix
+++ b/pkgs/applications/networking/instant-messengers/teamspeak/server.nix
@ -4,13 +4,13 @@ let
  arch = if stdenv.is64bit then "amd64" else "x86";
 in stdenv.mkDerivation rec {
  pname = "teamspeak-server";
-  version = "3.10.2";
+  version = "3.11.0";

  src = fetchurl {
    url = "https://files.teamspeak-services.com/releases/server/${version}/teamspeak3-server_linux_${arch}-${version}.tar.bz2";
    sha256 = if stdenv.is64bit
-      then "03c717qjlbym02nwy82l6jhrkbidsdm1jv5k8p3c10p6a46jy9nl"
-      else "1ay0lmbv2rw9klz289yg0hhsac83kfzzlbwwhjpi28xndl2lq4bf";
+      then "18hsr119dq46rvhz5sb9snn2gfxwiig37g6bfzk24x6wlga3xihq"
+      else "1lyazw328azi0asvgvcsxglc1saqih6ss0g8pc8f5pzqngk9p953";
  };

  buildInputs = [ stdenv.cc.cc ];
--- a/pkgs/applications/office/fava/default.nix
+++ b/pkgs/applications/office/fava/default.nix
@ -5,11 +5,11 @@ let
 in
 buildPythonApplication rec {
  pname = "fava";
-  version = "1.12";
+  version = "1.13";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0309y25l7aijk7il9hpjia23yc5dfac0h78xdmzb0w0ynxbjsmi6";
+    sha256 = "1pjfa5xb2imhcf7q037h8g0bp9nrnj1xyblgqphnjnz6hbr58a59";
  };

  checkInputs = [ python3.pkgs.pytest ];
--- a/pkgs/applications/office/zotero/default.nix
+++ b/pkgs/applications/office/zotero/default.nix
@ -35,11 +35,11 @@

 stdenv.mkDerivation rec {
  pname = "zotero";
-  version = "5.0.82";
+  version = "5.0.83";

  src = fetchurl {
    url = "https://download.zotero.org/client/release/${version}/Zotero-${version}_linux-x86_64.tar.bz2";
-    sha256 = "02a9dlsdd7dh56dwvsjskr899bqi8ijcvzc71xcjwaik6rp8xw88";
+    sha256 = "1abkwxdi154hnry8nsvxbklvbsnvd7cs2as0041h2kbiz824pv31";
  };

  buildInputs= [ wrapGAppsHook gsettings-desktop-schemas gtk3 gnome3.adwaita-icon-theme dconf ];
@ -131,7 +131,7 @@ stdenv.mkDerivation rec {
  '';

  meta = with stdenv.lib; {
-    homepage = https://www.zotero.org;
+    homepage = "https://www.zotero.org";
    description = "Collect, organize, cite, and share your research sources";
    license = licenses.agpl3;
    platforms = platforms.linux;
--- a/pkgs/applications/radio/urh/default.nix
+++ b/pkgs/applications/radio/urh/default.nix
@ -5,13 +5,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "urh";
-  version = "2.8.2";
+  version = "2.8.3";

  src = fetchFromGitHub {
    owner = "jopohl";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0cypm602zl3s4qggmafj4c246h65qgzsj3bsimvc5zz7jspk6m77";
+    sha256 = "17104livp6fv2zg56sqv90lqb7ywqhq2qfnal1hriwwh1b92glv8";
  };

  nativeBuildInputs = [ qt5.wrapQtAppsHook ];
--- a/pkgs/applications/science/logic/acgtk/default.nix
+++ b/pkgs/applications/science/logic/acgtk/default.nix
@ -2,15 +2,16 @@

 stdenv.mkDerivation {

-  name = "acgtk-1.5.0";
+  pname = "acgtk";
+  version = "1.5.1";

  src = fetchurl {
-    url = http://calligramme.loria.fr/acg/software/acg-1.5.0-20181019.tar.gz;
-    sha256 = "14n003gxzw5w79hlpw1ja4nq97jqf9zqyg00ihvpxw4bv9jlm8jm";
+    url = https://acg.loria.fr/software/acg-1.5.1-20191113.tar.gz;
+    sha256 = "17595qfwhzz5q091ak6i6bg5wlppbn8zfn58x3hmmmjvx2yfajn1";
  };

  buildInputs = [ dune ] ++ (with ocamlPackages; [
-    ocaml findlib ansiterminal cairo2 fmt logs menhir mtime ocf
+    ocaml findlib ansiterminal cairo2 cmdliner fmt logs menhir mtime yojson
  ]);

  buildPhase = "dune build";
@ -18,7 +19,7 @@ stdenv.mkDerivation {
  inherit (dune) installPhase;

  meta = with stdenv.lib; {
-    homepage = http://calligramme.loria.fr/acg/;
+    homepage = https://acg.loria.fr/;
    description = "A toolkit for developing ACG signatures and lexicon";
    license = licenses.cecill20;
    inherit (ocamlPackages.ocaml.meta) platforms;
--- a/pkgs/applications/science/logic/elan/default.nix
+++ b/pkgs/applications/science/logic/elan/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "elan";
-  version = "0.7.5";
+  version = "0.8.0";

  src = fetchFromGitHub {
    owner = "kha";
    repo = "elan";
    rev = "v${version}";
-    sha256 = "1147f3lzr6lgvf580ppspn20bdwnf6l8idh1h5ana0p0lf5a0dn1";
+    sha256 = "0n2ncssjcmp3x5kbnci7xbq5fgcihlr3vaglyhhwzrxkjy2vpmpd";
  };

-  cargoSha256 = "0vja1cq6z7jlr4nzfdzn4gl8l31yld82zmgzwihnalif13q3fcps";
+  cargoSha256 = "1pkg0n7kxckr0zhr8dr12b9fxg5q185kj3r9k2rmnkj2dpa2mxh3";

  nativeBuildInputs = [ pkgconfig ];

@ -22,7 +22,7 @@ rustPlatform.buildRustPackage rec {
  postInstall = ''
    pushd $out/bin
    mv elan-init elan
-    for link in lean leanpkg leanchecker; do
+    for link in lean leanpkg leanchecker leanc; do
      ln -s elan $link
    done
    popd
--- a/pkgs/applications/science/logic/why3/default.nix
+++ b/pkgs/applications/science/logic/why3/default.nix
@ -1,4 +1,4 @@
-{ callPackage, fetchurl, stdenv
+{ callPackage, fetchurl, fetchpatch, stdenv
 , ocamlPackages, coqPackages, rubber, hevea, emacs }:

 stdenv.mkDerivation {
@ -30,7 +30,13 @@ stdenv.mkDerivation {
  enableParallelBuilding = true;

  # Remove unnecessary call to which
-  patches = [ ./configure.patch ];
+  patches = [ ./configure.patch
+    # Compatibility with js_of_ocaml 3.5
+    (fetchpatch {
+      url = "https://gitlab.inria.fr/why3/why3/commit/269ab313382fe3e64ef224813937314748bf7cf0.diff";
+      sha256 = "0i92wdnbh8pihvl93ac0ma1m5g95jgqqqj4kw6qqvbbjjqdgvzwa";
+    })
+  ];

  configureFlags = [ "--enable-verbose-make" ];

--- a/pkgs/applications/video/clipgrab/default.nix
+++ b/pkgs/applications/video/clipgrab/default.nix
@ -5,10 +5,10 @@

 mkDerivation rec {
  pname = "clipgrab";
-  version = "3.8.7";
+  version = "3.8.11";

  src = fetchurl {
-    sha256 = "1mjkq487w168537qzw4pd010lp25vm1s2zji6cykcaa2cxcd6p7p";
+    sha256 = "0jpfdmyzjasq4x1xvk7b1cmhhq6fz6ydvvbwz2wclph367x496xk";
    # The .tar.bz2 "Download" link is a binary blob, the source is the .tar.gz!
    url = "https://download.clipgrab.org/${pname}-${version}.tar.gz";
  };
@ -49,7 +49,7 @@ mkDerivation rec {
      Dailymotion and many other online video sites. It converts downloaded
      videos to MPEG4, MP3 or other formats in just one easy step.
    '';
-    homepage = https://clipgrab.org/;
+    homepage = "https://clipgrab.org/";
    license = licenses.gpl3Plus;
    platforms = platforms.linux;
  };
--- a/pkgs/applications/virtualization/crun/default.nix
+++ b/pkgs/applications/virtualization/crun/default.nix
@ -33,13 +33,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "crun";
-  version = "0.12.2.1";
+  version = "0.13";

  src = fetchFromGitHub {
    owner = "containers";
    repo = pname;
    rev = version;
-    sha256 = "16hjkkr1fp542ycyp87pj626mzfrza5mcb82hhkp4a8m8bqmpzp4";
+    sha256 = "0c5acf916yv2zv3xjvxk1sa4h3n2wljc5hw61php7q37pbjc1ppn";
    fetchSubmodules = true;
  };

@ -64,7 +64,7 @@ stdenv.mkDerivation rec {

  meta = with lib; {
    description = "A fast and lightweight fully featured OCI runtime and C library for running containers";
-    license = licenses.gpl3;
+    license = licenses.gpl2Plus;
    platforms = platforms.linux;
    inherit (src.meta) homepage;
  };
--- a/pkgs/data/fonts/recursive/default.nix
+++ b/pkgs/data/fonts/recursive/default.nix
@ -1,7 +1,7 @@
 { lib, fetchzip }:

 let
-  version = "1.042";
+  version = "1.043";
 in
 fetchzip {
  name = "recursive-${version}";
@ -14,7 +14,7 @@ fetchzip {
    unzip -j $downloadedFile \*.woff2 -d $out/share/fonts/woff2
  '';

-  sha256 = "1zcrvnzwd39fim2jxa3by6jgdrx7fdp64iw2bd181iwzinv1yqsa";
+  sha256 = "0y7wg3ssr4j0r8dyxd0i0ji8bjvipzsqf0l6wznl5sfxk41mvjvd";

  meta = with lib; {
    homepage = "https://recursive.design/";
--- a/pkgs/data/misc/hackage/default.nix
+++ b/pkgs/data/misc/hackage/default.nix
@ -1,6 +1,6 @@
 { fetchurl }:

 fetchurl {
-  url = "https://github.com/commercialhaskell/all-cabal-hashes/archive/3ff0be5c9ee1ead33e07158b9a4a579fa2fb7a7f.tar.gz";
-  sha256 = "15jqdjxyzcmg50zvl7szv6s2zi4k82as5wi6mkiwwpbdricg50pl";
+  url = "https://github.com/commercialhaskell/all-cabal-hashes/archive/fcb0ed924c8504d54870d6dc2092b9dab8305732.tar.gz";
+  sha256 = "0b7dxgj40y9svddrx14scnxls20ww4f717zhz3lwigb16dm4crpi";
 }
--- a/pkgs/development/arduino/arduino-core/default.nix
+++ b/pkgs/development/arduino/arduino-core/default.nix
@ -3,7 +3,8 @@
 , withGui ? false, gtk2 ? null, withTeensyduino ? false
  /* Packages needed for Teensyduino */
 , upx, fontconfig, xorg, gcc
-, atk, glib, pango, gdk-pixbuf, libpng12, expat, freetype,
+, atk, glib, pango, gdk-pixbuf, libpng12, expat, freetype
+, cairo, udev
 }:

 assert withGui -> gtk2 != null;
@ -32,6 +33,7 @@ let

  teensy_libpath = stdenv.lib.makeLibraryPath [
    atk
+    cairo
    expat
    fontconfig
    freetype
@ -42,11 +44,13 @@ let
    libpng12
    libusb
    pango
+    udev
    xorg.libSM
    xorg.libX11
    xorg.libXext
    xorg.libXft
    xorg.libXinerama
+    xorg.libXxf86vm
    zlib
  ];
  teensy_architecture =
--- a/pkgs/development/compilers/ghc/8.4.4.nix
+++ b/pkgs/development/compilers/ghc/8.4.4.nix
@ -87,7 +87,7 @@ stdenv.mkDerivation (rec {
  name = "${targetPrefix}ghc-${version}";

  src = fetchurl {
-    url = "https://downloads.haskell.org/~ghc/${version}/ghc-${version}-src.tar.xz";
+    url = "https://downloads.haskell.org/ghc/${version}/ghc-${version}-src.tar.xz";
    sha256 = "1ch4j2asg7pr52ai1hwzykxyj553wndg7wq93i47ql4fllspf48i";
  };

--- a/pkgs/development/compilers/ghc/8.6.5.nix
+++ b/pkgs/development/compilers/ghc/8.6.5.nix
@ -92,7 +92,7 @@ stdenv.mkDerivation (rec {
  name = "${targetPrefix}ghc-${version}";

  src = fetchurl {
-    url = "https://downloads.haskell.org/~ghc/${version}/ghc-${version}-src.tar.xz";
+    url = "https://downloads.haskell.org/ghc/${version}/ghc-${version}-src.tar.xz";
    sha256 = "0qg3zsmbk4rkwkc3jpas3zs74qaxmw4sp4v1mhsbj0a0dzls2jjd";
  };

@ -187,7 +187,7 @@ stdenv.mkDerivation (rec {
  strictDeps = true;

  # Don’t add -liconv to LDFLAGS automatically so that GHC will add it itself.
-	dontAddExtraLibs = true;
+  dontAddExtraLibs = true;

  nativeBuildInputs = [
    perl autoconf automake m4 python3 sphinx
--- a/pkgs/development/compilers/intel-graphics-compiler/default.nix
+++ b/pkgs/development/compilers/intel-graphics-compiler/default.nix
@ -24,13 +24,13 @@ in

 stdenv.mkDerivation rec {
  pname = "intel-graphics-compiler";
-  version = "1.0.3041";
+  version = "1.0.3151";

  src = fetchFromGitHub {
    owner = "intel";
    repo = "intel-graphics-compiler";
    rev = "igc-${version}";
-    sha256 = "1d3vxq4v8jdjgl5jdm9qpxzgaw98r84dzs9lk9ph02khfkajqhjm";
+    sha256 = "1c2ll563a2j4sv3r468i4lv158hkzywnyajyk7iyin7bhqhm2vzf";
  };

  nativeBuildInputs = [ clang cmake bison flex llvm python ];
--- a/pkgs/development/coq-modules/QuickChick/default.nix
+++ b/pkgs/development/coq-modules/QuickChick/default.nix
@ -25,6 +25,12 @@ let params =
      rev = "v${version}";
      sha256 = "1c34v1k37rk7v0xk2czv5n79mbjxjrm6nh3llg2mpfmdsqi68wf3";
    };
+
+    "8.10" = rec {
+      version = "1.2.0";
+      rev = "v${version}";
+      sha256 = "1xs4mr3rdb0g44736jb40k370hw3maxdk12jiq1w1dl3q5gfrhah";
+    };
  };
  param = params.${coq.coq-version};
 in
--- a/pkgs/development/coq-modules/simple-io/default.nix
+++ b/pkgs/development/coq-modules/simple-io/default.nix
@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
  };

  passthru = {
-    compatibleCoqVersions = v: builtins.elem v [ "8.7" "8.8" "8.9" ];
+    compatibleCoqVersions = v: builtins.elem v [ "8.7" "8.8" "8.9" "8.10" ];
  };

 }
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@ -1072,8 +1072,35 @@ self: super: {

  # Generate shell completion.
  cabal2nix = generateOptparseApplicativeCompletion "cabal2nix" super.cabal2nix;
-  stack = generateOptparseApplicativeCompletion "stack" (super.stack.overrideScope (self: super: {
-  }));
+
+  stack =
+    let
+      stackWithOverrides =
+        super.stack.override {
+          # stack-2.1.3.1 requires pantry-0.2.0.0.
+          pantry = self.pantry_0_2_0_0;
+        };
+    in
+    generateOptparseApplicativeCompletion
+      "stack"
+      (appendPatches stackWithOverrides [
+        # This PR fixes stack up to be able to build with Cabal-3.  This patch
+        # can probably be dropped when the next stack release is made after
+        # 2.1.3.1.
+        (pkgs.fetchpatch {
+          url = "https://github.com/commercialhaskell/stack/pull/5156.diff";
+          sha256 = "0knk6f9fh1b4fxkhvx5gfrwclal4vi2va4zy34gpmwnjr7knf42y";
+          excludes = [
+            "snapshot-lts-12.yaml"
+            "snapshot-nightly.yaml"
+            "snapshot.yaml"
+          ];
+        })
+        # This patch fixes stack up to be able to build various GHC-8.8 changes.
+        # This can hopefully be dropped when the next stack release is made
+        # after 2.1.3.1 (assuming the next stack release uses GHC-8.8).
+        ./patches/stack-ghc882-support.patch
+      ]);

  # musl fixes
  # dontCheck: use of non-standard strptime "%s" which musl doesn't support; only used in test
@ -1306,11 +1333,6 @@ self: super: {
  # https://github.com/haskell-servant/servant-ekg/issues/15
  servant-ekg = doJailbreak super.servant-ekg;

-  # Needs ghc-lib-parser 8.8.1 (does not build with 8.8.0)
-  ormolu = doJailbreak (super.ormolu.override {
-    ghc-lib-parser = self.ghc-lib-parser_8_8_3_20200224;
-  });
-
  # krank-0.1.0 does not accept PyF-0.9.0.0.
  krank = doJailbreak super.krank;

@ -1401,4 +1423,48 @@ self: super: {
  # https://github.com/bergmark/feed/issues/43
  feed = dontCheck super.feed;

+  pantry_0_2_0_0 = appendPatches (dontCheck super.pantry_0_2_0_0) [
+    # pantry-0.2.0.0 doesn't build with ghc-8.8, but there is a PR adding support.
+    # https://github.com/commercialhaskell/pantry/pull/6
+    # Currently stack-2.1.3.1 requires pantry-0.2.0.0, but when a newer version of
+    # stack is released, it will probably use the newer pantry version, so we
+    # can completely get rid of pantry-0.2.0.0.
+    (pkgs.fetchpatch {
+      url = "https://github.com/commercialhaskell/pantry/pull/6.diff";
+      sha256 = "0aml06jshpjh3aiscs5av7y33m3d6s6x5pzdvh7pky476izfg87k";
+      excludes = [
+        ".azure/azure-linux-template.yml"
+        ".azure/azure-osx-template.yml"
+        ".azure/azure-windows-template.yml"
+        "package.yaml"
+        "pantry.cabal"
+        "stack-lts-11.yaml"
+        "stack-lts-12.yaml"
+        "stack-nightly.yaml"
+        "stack-windows.yaml"
+        "stack.yaml"
+      ];
+    })
+  ];
+
+  # https://github.com/serokell/nixfmt/pull/62
+  nixfmt = doJailbreak super.nixfmt;
+
+  # https://github.com/phadej/binary-orphans/issues/45
+  binary-instances = dontCheck super.binary-instances;
+
+  # Disabling the test suite lets the build succeed on older CPUs
+  # that are unable to run the generated library because they
+  # lack support for AES-NI, like some of our Hydra build slaves
+  # do. See https://github.com/NixOS/nixpkgs/issues/81915 for
+  # details.
+  cryptonite = dontCheck super.cryptonite;
+
+  # The test suite depends on an impure cabal-install installation
+  # in $HOME, which we don't have in our build sandbox.
+  cabal-install-parsers = dontCheck super.cabal-install-parsers;
+
+  # haskell-ci-0.8 needs cabal-install-parsers ==0.1, but we have 0.2.
+  haskell-ci = doJailbreak super.haskell-ci;
+
 } // import ./configuration-tensorflow.nix {inherit pkgs haskellLib;} self super
--- a/pkgs/development/haskell-modules/configuration-ghc-8.8.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-8.8.x.nix
@ -90,4 +90,8 @@ self: super: {
  # https://github.com/kowainik/relude/issues/241
  relude = dontCheck super.relude;

+  # The tests for semver-range need to be updated for the MonadFail change in
+  # ghc-8.8:
+  # https://github.com/adnelson/semver-range/issues/15
+  semver-range = dontCheck super.semver-range;
 }
--- a/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
@ -76,7 +76,7 @@ default-package-overrides:
  # gi-gdkx11-4.x requires gtk-4.x, which is still under development and
  # not yet available in Nixpkgs
  - gi-gdkx11 < 4
-  # LTS Haskell 15.1
+  # LTS Haskell 15.2
  - abstract-deque ==0.3
  - abstract-par ==0.3.3
  - AC-Angle ==1.0
@ -104,7 +104,7 @@ default-package-overrides:
  - aeson-schemas ==1.0.3
  - aeson-utils ==0.3.0.2
  - aeson-yak ==0.1.1.3
-  - aeson-yaml ==1.0.5.0
+  - aeson-yaml ==1.0.6.0
  - al ==0.1.4.2
  - alerts ==0.1.2.0
  - alex ==3.2.5
@ -266,7 +266,7 @@ default-package-overrides:
  - autoexporter ==1.1.15
  - auto-update ==0.1.6
  - avers ==0.0.17.1
-  - avro ==0.4.6.0
+  - avro ==0.4.7.0
  - aws-cloudfront-signed-cookies ==0.2.0.1
  - base16-bytestring ==0.1.1.6
  - base32string ==0.9.1
@ -354,12 +354,13 @@ default-package-overrides:
  - bv ==0.5
  - bv-little ==1.1.1
  - byteable ==0.1.1
+  - bytebuild ==0.3.4.0
  - bytedump ==1.0
  - byte-order ==0.1.2.0
  - byteorder ==1.0.4
  - bytes ==0.17
  - byteset ==0.1.1.0
-  - byteslice ==0.2.1.0
+  - byteslice ==0.2.2.0
  - bytesmith ==0.3.5.0
  - bytestring-builder ==0.10.8.2.0
  - bytestring-conversion ==0.3.1
@ -373,7 +374,7 @@ default-package-overrides:
  - cabal-doctest ==1.0.8
  - cabal-flatpak ==0.1
  - cabal-plan ==0.6.2.0
-  - cabal-rpm ==2.0.2
+  - cabal-rpm ==2.0.4
  - cache ==0.1.3.0
  - cacophony ==0.10.1
  - calendar-recycling ==0.0.0.1
@ -390,7 +391,7 @@ default-package-overrides:
  - cassava-megaparsec ==2.0.1
  - cast ==0.1.0.2
  - category ==0.2.5.0
-  - cayley-client ==0.4.11
+  - cayley-client ==0.4.12
  - cborg ==0.2.2.1
  - cborg-json ==0.2.2.0
  - cereal ==0.5.8.1
@ -498,7 +499,7 @@ default-package-overrides:
  - core-text ==0.2.3.3
  - countable ==1.0
  - cpio-conduit ==0.7.0
-  - cpphs ==1.20.8
+  - cpphs ==1.20.9
  - cprng-aes ==0.6.1
  - cpu ==0.1.2
  - cpuinfo ==0.1.0.1
@ -584,7 +585,7 @@ default-package-overrides:
  - declarative ==0.5.2
  - deepseq-generics ==0.2.0.0
  - deferred-folds ==0.9.10.1
-  - dejafu ==2.1.0.1
+  - dejafu ==2.1.0.3
  - dense-linear-algebra ==0.1.0.0
  - deque ==0.4.3
  - deriveJsonNoPrefix ==0.1.0.1
@ -661,6 +662,7 @@ default-package-overrides:
  - elerea ==2.9.0
  - elf ==0.30
  - eliminators ==0.6
+  - elm2nix ==0.2
  - elm-bridge ==0.5.2
  - elm-core-sources ==1.0.0
  - elm-export ==0.6.0.1
@ -724,11 +726,11 @@ default-package-overrides:
  - fft ==0.1.8.6
  - fgl ==5.7.0.2
  - filecache ==0.4.1
-  - file-embed ==0.0.11.1
+  - file-embed ==0.0.11.2
  - file-embed-lzma ==0
  - filelock ==0.1.1.4
  - filemanip ==0.3.6.3
-  - filepattern ==0.1.1
+  - filepattern ==0.1.2
  - fileplow ==0.1.0.0
  - filtrable ==0.1.3.0
  - fin ==0.1.1
@ -836,9 +838,9 @@ default-package-overrides:
  - ghcid ==0.8.1
  - ghci-hexcalc ==0.1.1.0
  - ghcjs-codemirror ==0.0.0.2
-  - ghc-lib ==8.8.2.20200205
-  - ghc-lib-parser ==8.8.2.20200205
-  - ghc-lib-parser-ex ==8.8.5.2
+  - ghc-lib ==8.8.3.20200224
+  - ghc-lib-parser ==8.8.3.20200224
+  - ghc-lib-parser-ex ==8.8.5.3
  - ghc-paths ==0.1.0.12
  - ghc-prof ==1.4.1.6
  - ghc-source-gen ==0.3.0.0
@ -882,7 +884,7 @@ default-package-overrides:
  - gluturtle ==0.0.58.1
  - gnuplot ==0.5.6.1
  - google-isbn ==1.0.3
-  - gothic ==0.1.3
+  - gothic ==0.1.4
  - gpolyline ==0.1.0.1
  - graph-core ==0.3.0.0
  - graphite ==0.10.0.1
@ -903,6 +905,7 @@ default-package-overrides:
  - hamtsolo ==1.0.3
  - HandsomeSoup ==0.4.2
  - happy ==1.19.12
+  - HasBigDecimal ==0.1.1
  - hashable ==1.3.0.0
  - hashable-time ==0.2.0.2
  - hashids ==1.0.2.4
@ -959,7 +962,7 @@ default-package-overrides:
  - hinotify ==0.4
  - hint ==0.9.0.2
  - hjsmin ==0.2.0.4
-  - hkgr ==0.2.4.1
+  - hkgr ==0.2.5.2
  - hlibcpuid ==0.2.0
  - hlibgit2 ==0.18.0.16
  - hmatrix ==0.20.0.0
@ -1078,7 +1081,7 @@ default-package-overrides:
  - hw-mquery ==0.2.0.2
  - hw-packed-vector ==0.2.0.1
  - hw-parser ==0.1.0.2
-  - hw-prim ==0.6.2.39
+  - hw-prim ==0.6.2.40
  - hw-rankselect ==0.13.3.2
  - hw-rankselect-base ==0.3.3.0
  - hw-simd ==0.1.1.5
@ -1121,6 +1124,7 @@ default-package-overrides:
  - ini ==0.4.1
  - inj ==1.0
  - inline-c ==0.9.0.0
+  - inline-c-cpp ==0.4.0.2
  - insert-ordered-containers ==0.2.3
  - inspection-testing ==0.4.2.2
  - instance-control ==0.1.2.0
@ -1163,6 +1167,7 @@ default-package-overrides:
  - ix-shapable ==0.1.0
  - jack ==0.7.1.4
  - jira-wiki-markup ==1.0.0
+  - jose ==0.8.2.0
  - jose-jwt ==0.8.0
  - js-dgtable ==0.5.2
  - js-flot ==0.8.3
@ -1172,7 +1177,7 @@ default-package-overrides:
  - jsonpath ==0.2.0.0
  - json-rpc ==1.0.1
  - json-rpc-generic ==0.2.1.5
-  - JuicyPixels ==3.3.4
+  - JuicyPixels ==3.3.5
  - JuicyPixels-extra ==0.4.1
  - JuicyPixels-scale-dct ==0.1.2
  - junit-xml ==0.1.0.0
@ -1197,7 +1202,7 @@ default-package-overrides:
  - lackey ==1.0.11
  - LambdaHack ==0.9.5.0
  - lame ==0.2.0
-  - language-avro ==0.1.0.0
+  - language-avro ==0.1.2.0
  - language-c ==0.8.3
  - language-c-quote ==0.12.2.1
  - language-haskell-extract ==0.2.4
@ -1333,6 +1338,7 @@ default-package-overrides:
  - miso ==1.4.0.0
  - missing-foreign ==0.1.1
  - mixed-types-num ==0.4.0.1
+  - mixpanel-client ==0.2.1
  - mltool ==0.2.0.1
  - mmap ==0.5.9
  - mmark ==0.0.7.2
@ -1612,7 +1618,7 @@ default-package-overrides:
  - pretty-sop ==0.2.0.3
  - pretty-types ==0.3.0.1
  - primes ==0.2.1.0
-  - primitive ==0.7.0.0
+  - primitive ==0.7.0.1
  - primitive-addr ==0.1.0.2
  - primitive-extras ==0.8
  - primitive-offset ==0.2.0.0
@ -1767,7 +1773,7 @@ default-package-overrides:
  - SafeSemaphore ==0.10.1
  - salak ==0.3.5.3
  - salak-yaml ==0.3.5.3
-  - saltine ==0.1.0.2
+  - saltine ==0.1.1.0
  - salve ==1.0.8
  - sample-frame ==0.0.3
  - sample-frame-np ==0.0.4.1
@ -1809,6 +1815,9 @@ default-package-overrides:
  - serf ==0.1.1.0
  - serialise ==0.2.2.0
  - servant ==0.16.2
+  - servant-auth ==0.3.2.0
+  - servant-auth-server ==0.4.5.1
+  - servant-auth-swagger ==0.2.10.0
  - servant-blaze ==0.9
  - servant-cassava ==0.10
  - servant-checked-exceptions ==2.2.0.0
@ -1836,6 +1845,7 @@ default-package-overrides:
  - servant-swagger-ui-redoc ==0.3.3.1.22.3
  - servant-websockets ==2.0.0
  - servant-yaml ==0.1.0.1
+  - serverless-haskell ==0.10.1
  - serversession ==1.0.1
  - serversession-frontend-wai ==1.0
  - ses-html ==0.4.0.0
@ -1881,7 +1891,7 @@ default-package-overrides:
  - skylighting ==0.8.3.2
  - skylighting-core ==0.8.3.2
  - slist ==0.1.0.0
-  - small-bytearray-builder ==0.3.3.0
+  - small-bytearray-builder ==0.3.4.0
  - smallcheck ==1.1.5
  - smoothie ==0.4.2.10
  - snap-blaze ==0.2.1.5
@ -1907,7 +1917,7 @@ default-package-overrides:
  - Spintax ==0.3.3
  - splice ==0.6.1.1
  - split ==0.2.3.4
-  - splitmix ==0.0.3
+  - splitmix ==0.0.4
  - spoon ==0.3.1
  - spreadsheet ==0.1.3.8
  - sql-words ==0.1.6.3
@ -1970,6 +1980,7 @@ default-package-overrides:
  - symengine ==0.1.2.0
  - sysinfo ==0.1.1
  - system-argv0 ==0.1.1
+  - systemd ==2.2.0
  - system-fileio ==0.3.16.4
  - system-filepath ==0.4.14
  - system-info ==0.5.1
@ -2039,7 +2050,7 @@ default-package-overrides:
  - text-printer ==0.5.0.1
  - text-region ==0.3.1.0
  - text-short ==0.1.3
-  - text-show ==3.8.4
+  - text-show ==3.8.5
  - text-show-instances ==3.8.3
  - text-zipper ==0.10.1
  - tfp ==1.0.1.1
@ -2174,7 +2185,7 @@ default-package-overrides:
  - unordered-containers ==0.2.10.0
  - unordered-intmap ==0.1.1
  - unsafe ==0.0
-  - urbit-hob ==0.3.1
+  - urbit-hob ==0.3.2
  - uri-bytestring ==0.3.2.2
  - uri-bytestring-aeson ==0.1.0.7
  - uri-encode ==1.5.0.5
@ -2333,7 +2344,7 @@ default-package-overrides:
  - zeromq4-haskell ==0.8.0
  - zeromq4-patterns ==0.3.1.0
  - zim-parser ==0.2.1.0
-  - zip ==1.3.0
+  - zip ==1.3.1
  - zip-archive ==0.4.1
  - zippers ==0.3
  - zip-stream ==0.2.0.1
@ -2348,7 +2359,6 @@ extra-packages:
  - ansi-terminal == 0.10.3             # required by cabal-plan, and policeman in ghc-8.8.x
  - aeson-pretty < 0.8                  # required by elm compiler
  - apply-refact < 0.4                  # newer versions don't work with GHC 8.0.x
-  - aws ^>= 0.18                        # pre-lts-11.x versions neeed by git-annex 6.20180227
  - binary > 0.7 && < 0.8               # keep a 7.x major release around for older compilers
  - binary > 0.8 && < 0.9               # keep a 8.x major release around for older compilers
  - blank-canvas < 0.6.3                # more recent versions depend on base-compat-batteries == 0.10.* but we're on base-compat-0.9.*
@ -2386,6 +2396,7 @@ extra-packages:
  - network == 3.0.*                    # required by network-bsd, HTTP, and many others (2019-04-30)
  - parallel == 3.2.0.3                 # newer versions don't work with GHC 6.12.3
  - patience ^>= 0.1                    # required by chell-0.4.x
+  - pantry == 0.2.0.0                   # required by stack-2.1.3.1
  - persistent >=2.5 && <2.8            # pre-lts-11.x versions neeed by git-annex 6.20180227
  - persistent-sqlite < 2.7             # pre-lts-11.x versions neeed by git-annex 6.20180227
  - prettyprinter == 1.6.1              # required by ghc 8.8.x, and dhall-1.29.0
@ -2957,29 +2968,17 @@ broken-packages:
  - awesomium
  - awesomium-glut
  - awesomium-raw
-  - aws
  - aws-configuration-tools
  - aws-dynamodb-conduit
-  - aws-dynamodb-streams
-  - aws-easy
-  - aws-ec2
  - aws-ec2-knownhosts
  - aws-elastic-transcoder
-  - aws-general
-  - aws-kinesis
  - aws-kinesis-client
  - aws-kinesis-reshard
-  - aws-lambda
-  - aws-lambda-haskell-runtime
  - aws-mfa-credentials
  - aws-performance-tests
-  - aws-route53
  - aws-sdk
-  - aws-sdk-text-converter
-  - aws-sdk-xml-unordered
  - aws-sign4
  - aws-simple
-  - aws-sns
  - axel
  - axiom
  - azubi
@ -3095,7 +3094,6 @@ broken-packages:
  - binary-ext
  - binary-file
  - binary-indexed-tree
-  - binary-instances
  - binary-protocol
  - binary-protocol-zmq
  - binary-search
@ -3359,7 +3357,6 @@ broken-packages:
  - cabal-install-bundle
  - cabal-install-ghc72
  - cabal-install-ghc74
-  - cabal-install-parsers
  - cabal-lenses
  - cabal-meta
  - cabal-mon
@ -5085,7 +5082,6 @@ broken-packages:
  - git-repair
  - git-sanity
  - gitdo
-  - github
  - github-backup
  - github-data
  - github-release
@ -5284,7 +5280,6 @@ broken-packages:
  - gtfs-realtime
  - gtk-jsinput
  - gtk-serialized-event
-  - gtk-sni-tray
  - gtk-toy
  - gtk2hs-hello
  - gtk2hs-rpn
@ -5504,7 +5499,6 @@ broken-packages:
  - haskell-bitmex-client
  - haskell-bitmex-rest
  - haskell-brainfuck
-  - haskell-ci
  - haskell-cnc
  - haskell-coffee
  - haskell-compression
@ -5520,9 +5514,7 @@ broken-packages:
  - haskell-go-checkers
  - haskell-in-space
  - haskell-kubernetes
-  - haskell-lsp
  - haskell-lsp-client
-  - haskell-lsp-types
  - haskell-ml
  - haskell-mpfr
  - haskell-names
@ -7070,6 +7062,7 @@ broken-packages:
  - liquid-fixpoint
  - liquidhaskell
  - liquidhaskell-cabal
+  - Liquorice
  - list-fusion-probe
  - list-mux
  - list-prompt
@ -7182,7 +7175,6 @@ broken-packages:
  - ls-usb
  - lscabal
  - LslPlus
-  - lsp-test
  - lsystem
  - ltext
  - ltk
@ -7803,7 +7795,6 @@ broken-packages:
  - nix-eval
  - nix-freeze-tree
  - nix-tools
-  - nixfmt
  - nixfromnpm
  - nixpkgs-update
  - nkjp
@ -8026,7 +8017,6 @@ broken-packages:
  - pangraph
  - panpipe
  - pansite
-  - pantry
  - pantry-tmp
  - papa
  - papa-base
@ -9108,7 +9098,6 @@ broken-packages:
  - semigroups-actions
  - semiring
  - semiring-num
-  - semver-range
  - sendgrid-haskell
  - sendgrid-v3
  - sensei
@ -9573,7 +9562,6 @@ broken-packages:
  - stable-marriage
  - stable-memo
  - stable-tree
-  - stack
  - stack-bump
  - stack-fix
  - stack-hpc-coveralls
@ -9624,7 +9612,6 @@ broken-packages:
  - statsd
  - statsd-client
  - statsdi
-  - status-notifier-item
  - statvfs
  - stb-image-redux
  - stc-lang
@ -9812,7 +9799,6 @@ broken-packages:
  - Tablify
  - tabloid
  - tabs
-  - taffybar
  - tag-bits
  - tag-stream
  - tagged-exception-core
@ -10140,6 +10126,7 @@ broken-packages:
  - tree-sitter-json
  - tree-sitter-php
  - tree-sitter-python
+  - tree-sitter-ql
  - tree-sitter-ruby
  - tree-sitter-tsx
  - tree-sitter-typescript
@ -10699,7 +10686,6 @@ broken-packages:
  - xchat-plugin
  - xcp
  - xdcc
-  - xdg-desktop-entry
  - xdot
  - Xec
  - xenstore
--- a/pkgs/development/haskell-modules/configuration-nix.nix
+++ b/pkgs/development/haskell-modules/configuration-nix.nix
@ -635,11 +635,19 @@ self: super: builtins.intersectAttrs super {

  spago =
    let
+      # Spago needs a patch for MonadFail changes.
+      # https://github.com/purescript/spago/pull/584
+      # This can probably be removed when a version after spago-0.14.0 is released.
+      spagoWithPatches = appendPatch super.spago (pkgs.fetchpatch {
+        url = "https://github.com/purescript/spago/pull/584/commits/898a8e48665e5a73ea03525ce2c973455ab9ac52.patch";
+        sha256 = "05gs1hjlcf60cr6728rhgwwgxp3ildly14v4l2lrh6ma2fljhyjy";
+      });
+
      # Spago basically compiles with LTS-14, but it requires a newer version
      # of directory.  This is to work around a bug only present on windows, so
      # we can safely jailbreak spago and use the older directory package from
      # LTS-14.
-      spagoWithOverrides = doJailbreak (super.spago.override {
+      spagoWithOverrides = doJailbreak (spagoWithPatches.override {
        # spago requires dhall-1.29.0.
        dhall = self.dhall_1_29_0;
      });
@ -710,4 +718,8 @@ self: super: builtins.intersectAttrs super {
  # break infinite recursion with base-orphans
  primitive = dontCheck super.primitive;

+  # dhall-1.29.0 tests access the network.  This override can be removed when
+  # dhall_1_29_0 is no longer used, since more recent versions of dhall don't
+  # access the network in checks.
+  dhall_1_29_0 = dontCheck super.dhall_1_29_0;
 }
--- a/pkgs/development/haskell-modules/hackage-packages.nix
+++ b/pkgs/development/haskell-modules/hackage-packages.nix
--- a/pkgs/development/haskell-modules/patches/stack-ghc882-support.patch
+++ b/pkgs/development/haskell-modules/patches/stack-ghc882-support.patch
@ -0,0 +1,104 @@
+diff --git a/src/Stack/Coverage.hs b/src/Stack/Coverage.hs
+index d95fa332..f80e121a 100644
+--- a/src/Stack/Coverage.hs
+++ b/src/Stack/Coverage.hs
+@@ -235,7 +235,7 @@ generateHpcReportForTargets opts tixFiles targetNames = do
+                              case nc of
+                                  CTest testName ->
+                                      liftM (pkgPath </>) $ parseRelFile (T.unpack testName ++ "/" ++ T.unpack testName ++ ".tix")
+-                                 _ -> fail $
+                                 _ -> liftIO $ fail $
+                                      "Can't specify anything except test-suites as hpc report targets (" ++
+                                      packageNameString name ++
+                                      " is used with a non test-suite target)"
+diff --git a/src/Stack/Package.hs b/src/Stack/Package.hs
+index b69337ce..08eb9b9f 100644
+--- a/src/Stack/Package.hs
+++ b/src/Stack/Package.hs
+@@ -463,7 +463,7 @@ makeObjectFilePathFromC
+ makeObjectFilePathFromC cabalDir namedComponent distDir cFilePath = do
+     relCFilePath <- stripProperPrefix cabalDir cFilePath
+     relOFilePath <-
+-        parseRelFile (replaceExtension (toFilePath relCFilePath) "o")
+        parseRelFile (System.FilePath.replaceExtension (toFilePath relCFilePath) "o")
+     return (componentOutputDir namedComponent distDir </> relOFilePath)
+ 
+ -- | Make the global autogen dir if Cabal version is new enough.
+diff --git a/src/Stack/Script.hs b/src/Stack/Script.hs
+index c63c9f62..70257be1 100644
+--- a/src/Stack/Script.hs
+++ b/src/Stack/Script.hs
+@@ -172,8 +172,8 @@ scriptCmd opts = do
+ 
+   toExeName fp =
+     if osIsWindows
+-      then replaceExtension fp "exe"
+-      else dropExtension fp
+      then System.FilePath.replaceExtension fp "exe"
+      else System.FilePath.dropExtension fp
+ 
+ getPackagesFromImports
+   :: FilePath -- ^ script filename
+diff --git a/src/Stack/Setup.hs b/src/Stack/Setup.hs
+index 8bbfc45c..5c5b028c 100644
+--- a/src/Stack/Setup.hs
+++ b/src/Stack/Setup.hs
+@@ -876,7 +876,7 @@ buildGhcFromSource getSetupInfo' installed (CompilerRepository url) commitId fla
+          (_,files) <- listDir (cwd </> bindistPath)
+          let
+            isBindist p = "ghc-" `isPrefixOf` (toFilePath (filename p))
+-                         && fileExtension (filename p) == ".xz"
+                         && (maybe "" id (fileExtension (filename p))) == ".xz"
+            mbindist = filter isBindist files
+          case mbindist of
+            [bindist] -> do
+diff --git a/src/Stack/Storage/Project.hs b/src/Stack/Storage/Project.hs
+index dc5318d8..984e6259 100644
+--- a/src/Stack/Storage/Project.hs
+++ b/src/Stack/Storage/Project.hs
+@@ -12,6 +12,9 @@
+ {-# LANGUAGE UndecidableInstances #-}
+ {-# OPTIONS_GHC -Wno-unused-top-binds -Wno-identities #-}
+ 
+{-# LANGUAGE DerivingStrategies #-}
+{-# LANGUAGE StandaloneDeriving #-}
+
+ -- | Work with SQLite database used for caches across a single project.
+ module Stack.Storage.Project
+     ( initProjectStorage
+diff --git a/src/Stack/Storage/User.hs b/src/Stack/Storage/User.hs
+index 3845b094..09695344 100644
+--- a/src/Stack/Storage/User.hs
+++ b/src/Stack/Storage/User.hs
+@@ -12,6 +12,9 @@
+ {-# LANGUAGE UndecidableInstances #-}
+ {-# OPTIONS_GHC -Wno-unused-top-binds -Wno-identities #-}
+ 
+{-# LANGUAGE DerivingStrategies #-}
+{-# LANGUAGE StandaloneDeriving #-}
+
+ -- | Work with SQLite database used for caches across an entire user account.
+ module Stack.Storage.User
+     ( initUserStorage
+diff --git a/src/Stack/Types/Config.hs b/src/Stack/Types/Config.hs
+index a5cc22b5..a329d353 100644
+--- a/src/Stack/Types/Config.hs
+++ b/src/Stack/Types/Config.hs
+@@ -406,7 +406,7 @@ instance FromJSON CabalConfigKey where
+ instance FromJSONKey CabalConfigKey where
+   fromJSONKey = FromJSONKeyTextParser parseCabalConfigKey
+ 
+-parseCabalConfigKey :: Monad m => Text -> m CabalConfigKey
+parseCabalConfigKey :: MonadFail m => Text -> m CabalConfigKey
+ parseCabalConfigKey "$targets" = pure CCKTargets
+ parseCabalConfigKey "$locals" = pure CCKLocals
+ parseCabalConfigKey "$everything" = pure CCKEverything
+@@ -974,7 +974,7 @@ parseConfigMonoidObject rootDir obj = do
+ 
+     return ConfigMonoid {..}
+   where
+-    handleExplicitSetupDep :: Monad m => (Text, Bool) -> m (Maybe PackageName, Bool)
+    handleExplicitSetupDep :: MonadFail m => (Text, Bool) -> m (Maybe PackageName, Bool)
+     handleExplicitSetupDep (name', b) = do
+         name <-
+             if name' == "*"
--- a/pkgs/development/libraries/dav1d/default.nix
+++ b/pkgs/development/libraries/dav1d/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitLab
+{ stdenv, fetchFromGitLab, fetchpatch
 , meson, ninja, nasm, pkgconfig
 , withTools ? false # "dav1d" binary
 , withExamples ? false, SDL2 # "dav1dplay" binary
@ -9,16 +9,23 @@ assert useVulkan -> withExamples;

 stdenv.mkDerivation rec {
  pname = "dav1d";
-  version = "0.5.2";
+  version = "0.6.0";

  src = fetchFromGitLab {
    domain = "code.videolan.org";
    owner = "videolan";
    repo = pname;
    rev = version;
-    sha256 = "0acxlgyz6c8ckw8vfgn60y2zg2n00l5xsq5jlxvwbh5w5pkc3ahf";
+    sha256 = "1gr859xzbqrsp892v9zzzgrg8smnnzgc1jmb68qzl54a4g6jrxm0";
  };

+  patches = [
+    (fetchpatch {
+      url = "https://code.videolan.org/videolan/dav1d/-/commit/e04227c5f6729b460e0b8e5fb52eae2d5acd15ef.patch";
+      sha256 = "18mpvwviqx0x9k6av98vgpjqlzcjd89g8496zsbf57bw5dadij3l";
+    })
+  ];
+
  nativeBuildInputs = [ meson ninja nasm pkgconfig ];
  # TODO: doxygen (currently only HTML and not build by default).
  buildInputs = stdenv.lib.optional withExamples SDL2
@ -38,6 +45,8 @@ stdenv.mkDerivation rec {
      subsampling and bit-depth parameters.
    '';
    inherit (src.meta) homepage;
+    changelog = "https://code.videolan.org/videolan/dav1d/-/tags/${version}";
+    # More technical: https://code.videolan.org/videolan/dav1d/blob/${version}/NEWS
    license = licenses.bsd2;
    platforms = platforms.unix;
    maintainers = with maintainers; [ primeos ];
--- a/pkgs/development/libraries/gdcm/default.nix
+++ b/pkgs/development/libraries/gdcm/default.nix
@ -1,12 +1,12 @@
 { stdenv, fetchurl, cmake, vtk, darwin }:

 stdenv.mkDerivation rec {
-  version = "3.0.4";
+  version = "3.0.5";
  pname = "gdcm";

  src = fetchurl {
    url = "mirror://sourceforge/gdcm/${pname}-${version}.tar.bz2";
-    sha256 = "0g46l7fjvn37sg29m0nb7wlnnpnxmlm9ryp7vam26ni02l73paid";
+    sha256 = "16d3sf81n4qhwbbx1d80jg6fhrla5paan384c4bbbqvbhm222yby";
  };

  dontUseCmakeBuildDir = true;
--- a/pkgs/development/libraries/libqmi/default.nix
+++ b/pkgs/development/libraries/libqmi/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "libqmi";
-  version = "1.24.4";
+  version = "1.24.6";

  src = fetchurl {
    url = "https://www.freedesktop.org/software/libqmi/${pname}-${version}.tar.xz";
-    sha256 = "12licfsszr6qxpg9b2b04qm2glk8d42fcy32zr8jzwrgr7gbl5h3";
+    sha256 = "1jfq8jdjc9z5c0g7m377svdlniwkr4k9hs7s8fsb5rvdq5xja98k";
  };

  outputs = [ "out" "dev" "devdoc" ];
--- a/pkgs/development/libraries/librealsense/default.nix
+++ b/pkgs/development/libraries/librealsense/default.nix
@ -2,7 +2,7 @@

 stdenv.mkDerivation rec {
  pname = "librealsense";
-  version = "2.31.0";
+  version = "2.32.1";

  outputs = [ "out" "dev" ];

@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
    owner = "IntelRealSense";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0lw4dqywahi7wfd1dz5nkil55sh7wscsrwkapkvvgyi418pqvmpn";
+    sha256 = "1l45hrb3lgjh1kdi4khqhljndc434zf9llzbii6dcv911gxkipjr";
  };

  buildInputs = [
--- a/pkgs/development/libraries/libxmlb/default.nix
+++ b/pkgs/development/libraries/libxmlb/default.nix
@ -15,7 +15,7 @@

 stdenv.mkDerivation rec {
  pname = "libxmlb";
-  version = "0.1.14";
+  version = "0.1.15";

  outputs = [ "out" "lib" "dev" "devdoc" "installedTests" ];

@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
    owner = "hughsie";
    repo = "libxmlb";
    rev = version;
-    sha256 = "05snbv1dvqa96k7xlwi2sj161315kps3baansr9xdpwim5ckmwc6";
+    sha256 = "1mb73pnfwqc4mm0lm16yfn0lj495h8hcciprb2v6wgy3ifnnjxib";
  };

  patches = [
@ -66,7 +66,7 @@ stdenv.mkDerivation rec {

  meta = with stdenv.lib; {
    description = "A library to help create and query binary XML blobs";
-    homepage = https://github.com/hughsie/libxmlb;
+    homepage = "https://github.com/hughsie/libxmlb";
    license = licenses.lgpl21Plus;
    maintainers = with maintainers; [ jtojnar ];
    platforms = platforms.linux;
--- a/pkgs/development/libraries/onnxruntime/default.nix
+++ b/pkgs/development/libraries/onnxruntime/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "onnxruntime";
-  version = "1.1.1";
+  version = "1.1.2";

  src = fetchFromGitHub {
    owner = "microsoft";
    repo = "onnxruntime";
    rev = "v${version}";
-    sha256 = "0d79adxw09cd6xfyb2sxp38j03h3g7gn4ki85zhp9nicrrm179qz";
+    sha256 = "0chbn2wkl1w3msw0zscajinzlaaahg4w3lrpb2l8xgqdwbln0ckj";
    # TODO: use nix-versions of grpc, onnx, eigen, googletest, etc.
    # submodules increase src size and compile times significantly
    # not currently feasible due to how integrated cmake build is with git
--- a/pkgs/development/libraries/openmpi/default.nix
+++ b/pkgs/development/libraries/openmpi/default.nix
@ -14,7 +14,7 @@
 assert !cudaSupport || cudatoolkit != null;

 let
-  version = "4.0.2";
+  version = "4.0.3";

  cudatoolkit_joined = symlinkJoin {
    name = "${cudatoolkit.name}-unsplit";
@ -26,7 +26,7 @@ in stdenv.mkDerivation rec {

  src = with stdenv.lib.versions; fetchurl {
    url = "https://www.open-mpi.org/software/ompi/v${major version}.${minor version}/downloads/${pname}-${version}.tar.bz2";
-    sha256 = "0ms0zvyxyy3pnx9qwib6zaljyp2b3ixny64xvq3czv3jpr8zf2wh";
+    sha256 = "00zxcw99gr5n693cmcmn4f6a47vx1ywna895p0x7p163v37gw0hl";
  };

  postPatch = ''
@ -88,7 +88,7 @@ in stdenv.mkDerivation rec {
  };

  meta = with stdenv.lib; {
-    homepage = https://www.open-mpi.org/;
+    homepage = "https://www.open-mpi.org/";
    description = "Open source MPI-3 implementation";
    longDescription = "The Open MPI Project is an open source MPI-3 implementation that is developed and maintained by a consortium of academic, research, and industry partners. Open MPI is therefore able to combine the expertise, technologies, and resources from all across the High Performance Computing community in order to build the best MPI library available. Open MPI offers advantages for system and software vendors, application developers and computer science researchers.";
    maintainers = with maintainers; [ markuskowa ];
--- a/pkgs/development/libraries/science/math/osi/default.nix
+++ b/pkgs/development/libraries/science/math/osi/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  pname = "osi";
-  version = "0.108.4";
+  version = "0.108.6";

  src = fetchurl {
    url = "https://www.coin-or.org/download/source/Osi/Osi-${version}.tgz";
-    sha256 = "13bwhdh01g37vp3kjwl9nvij5s5ikh5f7zgrqgwrqfyk35q2x9s5";
+    sha256 = "1n2jlpq4aikbp0ncs16f7q1pj7yk6kny1bh4fmjaqnwrjw63zvsp";
  };

  buildInputs =
--- a/pkgs/development/misc/newlib/default.nix
+++ b/pkgs/development/misc/newlib/default.nix
@ -1,12 +1,12 @@
 { stdenv, fetchurl, buildPackages }:

-let version = "3.1.0";
+let version = "3.3.0";
 in stdenv.mkDerivation {
  pname = "newlib";
  inherit version;
  src = fetchurl {
    url = "ftp://sourceware.org/pub/newlib/newlib-${version}.tar.gz";
-    sha256 = "0ahh3n079zjp7d9wynggwrnrs27440aac04340chf1p9476a2kzv";
+    sha256 = "0ricyx792ig2cb2x31b653yb7w7f7mf2111dv5h96lfzmqz9xpaq";
  };

  depsBuildBuild = [ buildPackages.stdenv.cc ];
--- a/pkgs/development/ocaml-modules/eliom/default.nix
+++ b/pkgs/development/ocaml-modules/eliom/default.nix
@ -1,7 +1,6 @@
 { stdenv, fetchzip, which, ocsigen_server, ocaml,
  lwt_react,
-  opaline, ppx_tools, ppx_deriving, findlib
-, ppx_tools_versioned
+  opaline, ppx_deriving, findlib
 , js_of_ocaml-ocamlbuild, js_of_ocaml-ppx, js_of_ocaml-ppx_deriving_json
 , js_of_ocaml-lwt
 , js_of_ocaml-tyxml
@ -15,15 +14,14 @@ else
 stdenv.mkDerivation rec
 {
  pname = "eliom";
-  version = "6.8.0";
+  version = "6.10.1";

  src = fetchzip {
    url = "https://github.com/ocsigen/eliom/archive/${version}.tar.gz";
-    sha256 = "0di4q0wzbnk9sxlaj97ivghzh8qvjb8n17h80y4nmqhys97pldif";
+    sha256 = "006722wcmhsfhyzv3qbgrrn53fbv9v4i31z52a0pznb6cll45nkm";
  };

-  buildInputs = [ ocaml which findlib js_of_ocaml-ocamlbuild js_of_ocaml-ppx_deriving_json opaline ppx_tools
-    ppx_tools_versioned
+  buildInputs = [ ocaml which findlib js_of_ocaml-ocamlbuild js_of_ocaml-ppx_deriving_json opaline
  ];

  propagatedBuildInputs = [
--- a/pkgs/development/ocaml-modules/ocsigen-start/default.nix
+++ b/pkgs/development/ocaml-modules/ocsigen-start/default.nix
@ -1,15 +1,14 @@
-{ stdenv, fetchFromGitHub, ocaml, findlib, camlp4, ocsigen-toolkit, pgocaml, macaque, safepass, yojson
-, js_of_ocaml-camlp4, lwt_camlp4
+{ stdenv, fetchFromGitHub, ocaml, findlib, ocsigen-toolkit, pgocaml_ppx, macaque, safepass, yojson
 , cohttp-lwt-unix
 , resource-pooling
 }:

 stdenv.mkDerivation rec {
  name = "ocaml${ocaml.version}-ocsigen-start-${version}";
-  version = "2.7.0";
+  version = "2.16.1";

-  buildInputs = [ ocaml findlib js_of_ocaml-camlp4 lwt_camlp4 ];
-  propagatedBuildInputs = [ pgocaml macaque safepass ocsigen-toolkit yojson resource-pooling cohttp-lwt-unix camlp4 ];
+  buildInputs = [ ocaml findlib ];
+  propagatedBuildInputs = [ pgocaml_ppx safepass ocsigen-toolkit yojson resource-pooling cohttp-lwt-unix ];

  patches = [ ./templates-dir.patch ];

@ -23,7 +22,7 @@ stdenv.mkDerivation rec {
    owner = "ocsigen";
    repo = "ocsigen-start";
    rev = version;
-    sha256 = "1kp9g679xnff2ybwsicnc9c203hi9ri1ijbpp6221b2sj6zxf2wc";
+    sha256 = "1pzpyrd3vbhc7zvzh6bv44793ikx5bglpd5p4wk5jj65v1w39jwd";
  };

  meta = {
--- a/pkgs/development/ocaml-modules/ocsigen-toolkit/default.nix
+++ b/pkgs/development/ocaml-modules/ocsigen-toolkit/default.nix
@ -5,9 +5,9 @@
 stdenv.mkDerivation rec {
 pname = "ocsigen-toolkit";
 name = "ocaml${ocaml.version}-${pname}-${version}";
- version = "2.2.0";
+ version = "2.5.0";

- propagatedBuildInputs = [ calendar eliom js_of_ocaml-ppx_deriving_json ];
+ propagatedBuildInputs = [ calendar js_of_ocaml-ppx_deriving_json eliom ];
 buildInputs = [ ocaml findlib opaline ];

 installPhase =
@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
    owner = "ocsigen";
    repo = pname;
    rev = version;
-    sha256 = "0qy6501jf81qcmkbicgrb1x4pxsjkhr40plwdn09w37d8vx9va3s";
+    sha256 = "0hll8qr363pbb65jnr2w36zcbplbwn08xb7826ayiwigakj783p9";
  };

  createFindlibDestdir = true;
--- a/pkgs/development/ocaml-modules/ppx_import/default.nix
+++ b/pkgs/development/ocaml-modules/ppx_import/default.nix
@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, buildDunePackage, ocaml
+{ lib, fetchurl, buildDunePackage, ocaml
 , ounit, ppx_deriving, ppx_tools_versioned
 }:

@ -8,24 +8,21 @@ else

 buildDunePackage rec {
  pname = "ppx_import";
-  version = "1.5-3";
+  version = "1.7.1";

-  src = fetchFromGitHub {
-    owner = "ocaml-ppx";
-    repo = "ppx_import";
-    rev = "bd627d5afee597589761d6fee30359300b5e1d80";
-    sha256 = "1f9bphif1izhyx72hvwpkd9kxi9lfvygaicy6nbxyp6qgc87z4nm";
+  src = fetchurl {
+    url = "https://github.com/ocaml-ppx/ppx_import/releases/download/v${version}/ppx_import-v${version}.tbz";
+    sha256 = "16dyxfb7syz659rqa7yq36ny5vzl7gkqd7f4m6qm2zkjc1gc8j4v";
  };

  buildInputs = [ ounit ppx_deriving ];
  propagatedBuildInputs = [ ppx_tools_versioned ];

  doCheck = true;
-  checkTarget = "test";

  meta = {
    description = "A syntax extension that allows to pull in types or signatures from other compiled interface files";
    license = lib.licenses.mit;
-    inherit (src.meta) homepage;
+    homepage = "https://github.com/ocaml-ppx/ppx_import";
  };
 }
--- a/pkgs/development/ocaml-modules/ppxlib/default.nix
+++ b/pkgs/development/ocaml-modules/ppxlib/default.nix
@ -1,16 +1,23 @@
 { stdenv, fetchFromGitHub, buildDunePackage
+, version ? "0.8.1"
 , ocaml-compiler-libs, ocaml-migrate-parsetree, ppx_derivers, stdio
 }:

+let sha256 =
+  { "0.8.1" = "0vm0jajmg8135scbg0x60ivyy5gzv4abwnl7zls2mrw23ac6kml6";
+    "0.12.0" = "1cg0is23c05k1rc94zcdz452p9zn11dpqxm1pnifwx5iygz3w0a1";
+  }."${version}"
+; in
+
 buildDunePackage rec {
  pname = "ppxlib";
-  version = "0.8.1";
+  inherit version;

  src = fetchFromGitHub {
    owner = "ocaml-ppx";
    repo = pname;
    rev = version;
-    sha256 = "0vm0jajmg8135scbg0x60ivyy5gzv4abwnl7zls2mrw23ac6kml6";
+    inherit sha256;
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/atlassian-python-api/default.nix
+++ b/pkgs/development/python-modules/atlassian-python-api/default.nix
@ -16,11 +16,11 @@

 buildPythonPackage rec {
  pname = "atlassian-python-api";
-  version = "1.14.9";
+  version = "1.15.4";
  
  src = fetchPypi {
    inherit pname version;
-    sha256 = "28ff793cb43152384a810efc6ee572473daf3dc44bf7c1c295efb270a6d29251";
+    sha256 = "0vkq3sr4a23ipk74swsmc3ydg3q91asixb7hzl8mzkfpgnnyvr77";
  };
  
  checkInputs = [ pytestrunner pytest ];
--- a/pkgs/development/python-modules/azure-mgmt-storage/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-storage/default.nix
@ -7,13 +7,13 @@
 }:

 buildPythonPackage rec {
-  version = "7.1.0";
+  version = "7.2.0";
  pname = "azure-mgmt-storage";

  src = fetchPypi {
    inherit pname version;
    extension = "zip";
-    sha256 = "03yjvw1dwkwsadsv60i625mr9zpdryy7ywvh7p8fg60djszh1p5l";
+    sha256 = "01ck1ankgr9ikvfghhdcs777yrl2j2p8cw9q8nfdrjp22lpchabl";
  };

  postInstall = if isPy3k then "" else ''
--- a/pkgs/development/python-modules/ckcc-protocol/default.nix
+++ b/pkgs/development/python-modules/ckcc-protocol/default.nix
@ -12,12 +12,12 @@

 buildPythonPackage rec {
  pname = "ckcc-protocol";
-  version = "1.0.0";
+  version = "1.0.1";
  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "1glws7z7kk9qyl1j4446hb6vv3l4s5xca40zb4fzhsh6chm76h11";
+    sha256 = "13ihbhjgxyn1xvrbppjvnqm199q5fdwrljs0wm16iwyl56kf3wh3";
  };

  checkInputs = [
@ -28,7 +28,7 @@ buildPythonPackage rec {

  meta = with stdenv.lib; {
    description = "Communicate with your Coldcard using Python";
-    homepage = https://github.com/Coldcard/ckcc-protocol;
+    homepage = "https://github.com/Coldcard/ckcc-protocol";
    license = licenses.gpl3;
    maintainers = [ maintainers.hkjn ];
  };
--- a/pkgs/development/python-modules/cmd2/default.nix
+++ b/pkgs/development/python-modules/cmd2/default.nix
@ -6,11 +6,11 @@
 }:
 buildPythonPackage rec {
  pname = "cmd2";
-  version = "0.9.25";
+  version = "1.0.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0w5jh2lanqxsva9fr9p07mmbd5w4v6zmhf6lr0awksvhjx77lhdc";
+    sha256 = "sha256-GtSqmkWCHX/1t31sny3f2ek8uTS1oEMSM1rRXG9DuFI=";
  };

  LC_ALL="en_US.UTF-8";
--- a/pkgs/development/python-modules/denonavr/default.nix
+++ b/pkgs/development/python-modules/denonavr/default.nix
@ -3,13 +3,13 @@

 buildPythonPackage rec {
  pname = "denonavr";
-  version = "0.7.10";
+  version = "0.7.12";

  src = fetchFromGitHub {
    owner = "scarface-4711";
    repo = "denonavr";
    rev = version;
-    sha256 = "078nhr69f68nfazhmkf2sl7wiadqx96a5ry3ziggiy1xs04vflj7";
+    sha256 = "1i7r0f8ldxpy9vkwjla6rfkaq37071d36zfhb1dwm9jgp6ggi34m";
  };

  propagatedBuildInputs = [ requests ];
--- a/pkgs/development/python-modules/django-compat/default.nix
+++ b/pkgs/development/python-modules/django-compat/default.nix
@ -5,8 +5,6 @@
 buildPythonPackage rec {
  pname = "django-compat";
  version = "1.0.15";
-  # django-compat requires django < 2.0
-  disabled = stdenv.lib.versionAtLeast django.version "2.0";

  # the pypi packages don't include everything required for the tests
  src = fetchFromGitHub {
@ -16,6 +14,10 @@ buildPythonPackage rec {
    sha256 = "1pr6v38ahrsvxlgmcx69s4b5q5082f44gzi4h3c32sccdc4pwqxp";
  };

+  patches = [
+    ./fix-tests.diff
+  ];
+
  checkPhase = ''
    runHook preCheck

--- a/pkgs/development/python-modules/django-compat/fix-tests.diff
+++ b/pkgs/development/python-modules/django-compat/fix-tests.diff
@ -0,0 +1,56 @@
+diff -ur a/compat/tests/settings.py b/compat/tests/settings.py
+--- a/compat/tests/settings.py	2020-03-06 15:32:07.548482597 +0100
+++ b/compat/tests/settings.py	2020-03-06 22:19:25.422934249 +0100
+@@ -16,11 +16,12 @@
+     'django.contrib.admin',
+     'django.contrib.auth',
+     'django.contrib.contenttypes',
+    'django.contrib.messages',
+     'compat',
+     'compat.tests.test_app',
+ ]
+ 
+-MIDDLEWARE_CLASSES = (
+MIDDLEWARE = (
+     'django.contrib.sessions.middleware.SessionMiddleware',
+     'django.middleware.common.CommonMiddleware',
+     'django.middleware.csrf.CsrfViewMiddleware',
+@@ -43,6 +44,7 @@
+                 'django.template.context_processors.i18n',
+                 'django.template.context_processors.tz',
+                 'django.template.context_processors.request',
+                'django.contrib.messages.context_processors.messages',
+             ],
+             'loaders': [
+                 'django.template.loaders.filesystem.Loader',
+diff -ur a/compat/tests/test_compat.py b/compat/tests/test_compat.py
+--- a/compat/tests/test_compat.py	2020-03-06 15:32:07.548482597 +0100
+++ b/compat/tests/test_compat.py	2020-03-06 15:37:39.202835075 +0100
+@@ -9,7 +9,7 @@
+ from django.core.serializers.json import DjangoJSONEncoder
+ from django.test import TestCase, SimpleTestCase
+ from django.test.client import RequestFactory
+-from django.contrib.auth.views import logout
+from django.contrib.auth.views import auth_logout
+ try:
+     from django.urls import NoReverseMatch
+ except ImportError:
+@@ -103,7 +103,7 @@
+         Tests that passing a view name to ``resolve_url`` will result in the
+         URL path mapping to that view name.
+         """
+-        resolved_url = resolve_url(logout)
+        resolved_url = resolve_url(auth_logout)
+         self.assertEqual('/accounts/logout/', resolved_url)
+ 
+     '''
+diff -ur a/compat/tests/urls.py b/compat/tests/urls.py
+--- a/compat/tests/urls.py	2020-03-06 15:32:07.548482597 +0100
+++ b/compat/tests/urls.py	2020-03-06 15:34:25.962377799 +0100
+@@ -2,5 +2,5 @@
+ from django.contrib.auth import views
+ 
+ urlpatterns = [
+-    url(r'^accounts/logout/$', views.logout, name='logout'),
+    url(r'^accounts/logout/$', views.auth_logout, name='logout'),
+ ]
--- a/pkgs/development/python-modules/gym/default.nix
+++ b/pkgs/development/python-modules/gym/default.nix
@ -5,11 +5,11 @@

 buildPythonPackage rec {
  pname = "gym";
-  version = "0.15.6";
+  version = "0.16.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0qpx4w6k42sb9ncjk4r6i22qjbcxcnha43svhvvq1nh7796xqzgd";
+    sha256 = "06h5b639nmzhmy4m1j3vigm86iv5pv7k8jy6xpldyd4jdlf37nn5";
  };

  postPatch = ''
@ -26,7 +26,7 @@ buildPythonPackage rec {

  meta = with lib; {
    description = "A toolkit by OpenAI for developing and comparing your reinforcement learning agents";
-    homepage = https://gym.openai.com/;
+    homepage = "https://gym.openai.com/";
    license = licenses.mit;
    maintainers = with maintainers; [ hyphon81 ];
  };
--- a/pkgs/development/python-modules/hstspreload/default.nix
+++ b/pkgs/development/python-modules/hstspreload/default.nix
@ -6,14 +6,14 @@

 buildPythonPackage rec {
  pname = "hstspreload";
-  version = "2020.2.5";
+  version = "2020.2.29";
  disabled = isPy27;

  src = fetchFromGitHub {
    owner = "sethmlarson";
    repo = pname;
    rev = version;
-    sha256 = "1jz4qma04vkiczlj0fd9ahjf6c3yxvycvhp48c3n3l4aw4gfsbiz";
+    sha256 = "1s6f9sdr5l9dqri92s8qr7r1nyvai3vnpcaw06293kc8dribi0m2";
  };

  # tests require network connection
@ -21,7 +21,7 @@ buildPythonPackage rec {

  meta = with lib; {
    description = "Chromium HSTS Preload list as a Python package and updated daily";
-    homepage = https://github.com/sethmlarson/hstspreload;
+    homepage = "https://github.com/sethmlarson/hstspreload";
    license = licenses.bsd3;
    maintainers = [ maintainers.costrouc ];
  };
--- a/pkgs/development/python-modules/pikepdf/default.nix
+++ b/pkgs/development/python-modules/pikepdf/default.nix
@ -22,12 +22,12 @@

 buildPythonPackage rec {
  pname = "pikepdf";
-  version = "1.10.0";
+  version = "1.10.2";
  disabled = ! isPy3k;

  src = fetchPypi {
    inherit pname version;
-    sha256 = "1qa4sam1kvglwqwk573mjpsy8cy89yamr4val0g80hq1ribc56ah";
+    sha256 = "1y94ay2jz4m55nlyrg283xsjqsxigmj7vzrzf1mskbpjb20335fb";
  };

  buildInputs = [
--- a/pkgs/development/python-modules/pyface/default.nix
+++ b/pkgs/development/python-modules/pyface/default.nix
@ -4,11 +4,11 @@

 buildPythonPackage rec {
  pname = "pyface";
-  version = "6.1.1";
+  version = "6.1.2";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "1q5rihmhcdyyp44p31f5l4a0mc9m3293rvcnma5p8w0v8j7dbrm7";
+    sha256 = "1g2g3za64rfffbivlihbf5njrqbv63ln62rv9d8fi1gcrgaw6akw";
  };

  propagatedBuildInputs = [ setuptools six traits wxPython ];
@ -17,7 +17,7 @@ buildPythonPackage rec {

  meta = with stdenv.lib; {
    description = "Traits-capable windowing framework";
-    homepage = https://github.com/enthought/pyface;
+    homepage = "https://github.com/enthought/pyface";
    maintainers = with stdenv.lib.maintainers; [ knedlsepp ];
    license = licenses.bsdOriginal;
  };
--- a/pkgs/development/python-modules/pyftdi/default.nix
+++ b/pkgs/development/python-modules/pyftdi/default.nix
@ -8,12 +8,12 @@

 buildPythonPackage rec {
  pname = "pyftdi";
-  version = "0.42.2";
+  version = "0.44.2";
  disabled = pythonOlder "3.5";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "1bpb2rq7bc3p4g9qrfp4a7qcic79cvv1wh17j231bnpmy48njhvj";
+    sha256 = "18k9wnpjxg71v4jm0pwr2bmksq7sckr6ylh1slf0xgpg89b27bxq";
  };

  propagatedBuildInputs = [ pyusb pyserial ];
--- a/pkgs/development/python-modules/stem/default.nix
+++ b/pkgs/development/python-modules/stem/default.nix
@ -2,11 +2,11 @@

 buildPythonPackage rec {
  pname = "stem";
-  version = "1.7.1";
+  version = "1.8.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "18lc95pmc7i089nlsb06dsxyjl5wbhxfqgdxbjcia35ndh8z7sn9";
+    sha256 = "1hk8alc0r4m669ggngdfvryndd0fbx0w62sclcmg55af4ak8xd50";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/traitsui/default.nix
+++ b/pkgs/development/python-modules/traitsui/default.nix
@ -4,11 +4,11 @@

 buildPythonPackage rec {
  pname = "traitsui";
-  version = "6.1.1";
+  version = "6.1.3";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "080fq9hag7hvcnsd5c5fn74zjmjl6rjq40r0zwdz2bjlk9049xpi";
+    sha256 = "0kw1xy5ax6l0lzmk7pfzjw6qs0idv78k3118my7cbvw1n5iiff28";
  };

  propagatedBuildInputs = [ traits pyface wxPython ];
@ -17,7 +17,7 @@ buildPythonPackage rec {

  meta = with stdenv.lib; {
    description = "Traits-capable windowing framework";
-    homepage = https://github.com/enthought/traitsui;
+    homepage = "https://github.com/enthought/traitsui";
    maintainers = with stdenv.lib.maintainers; [ knedlsepp ];
    license = licenses.bsdOriginal;
  };
--- a/pkgs/development/python-modules/uproot/default.nix
+++ b/pkgs/development/python-modules/uproot/default.nix
@ -16,11 +16,11 @@

 buildPythonPackage rec {
  pname = "uproot";
-  version = "3.11.2";
+  version = "3.11.3";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "1bn8z640408s4h04ymy0y79fm5ss2mx99mkgdbw68a80x0p6982h";
+    sha256 = "19rvkxv015lkx0g01sb54y6agdbqbmkpxlyka4z1zf9dx2lx1iq5";
  };

  nativeBuildInputs = [ pytestrunner ];
@ -51,7 +51,7 @@ buildPythonPackage rec {
  '';

  meta = with lib; {
-    homepage = https://github.com/scikit-hep/uproot;
+    homepage = "https://github.com/scikit-hep/uproot";
    description = "ROOT I/O in pure Python and Numpy";
    license = licenses.bsd3;
    maintainers = with maintainers; [ ktf ];
--- a/pkgs/development/tools/ammonite/default.nix
+++ b/pkgs/development/tools/ammonite/default.nix
@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
  phases = "installPhase";

  installPhase = ''
-    install -Dm755 ${src} $out/bin/amm
+    install -Dm755 $src $out/bin/amm
    sed -i '0,/java/{s|java|${jre}/bin/java|}' $out/bin/amm
  '' + optionalString (disableRemoteLogging) ''
    sed -i '0,/ammonite.Main/{s|ammonite.Main|ammonite.Main --no-remote-logging|}' $out/bin/amm
--- a/pkgs/development/tools/cloudflare-wrangler/default.nix
+++ b/pkgs/development/tools/cloudflare-wrangler/default.nix
@ -3,18 +3,18 @@

 rustPlatform.buildRustPackage rec {
  pname = "cloudflare-wrangler";
-  version = "1.7.0";
+  version = "1.8.1";

  src = fetchFromGitHub {
    owner = "cloudflare";
    repo = "wrangler";
    rev = "v" + version;
-    sha256 = "0vc7f3jki2fdwlgpwhaxzm58g2898wpwbib7dmibb9kxv4jna8gj";
+    sha256 = "0lh06cnjddmy5h5xvbkg8f97vw2v0wr5fi7vrs3nnidiz7x4rsja";
  };

  # Delete this on next update; see #79975 for details
  legacyCargoFetcher = true;
-  cargoSha256 = "1f3gy3agpdg6pck5acxjfrd89hyp9x1byqhfizlizbfmwrqs4il8";
+  cargoSha256 = "0s07143vsrb2vwj4rarx5w3wcz1zh0gi8al6cdrfqyl7nhm1mshm";

  nativeBuildInputs = [ pkg-config ];

@ -30,7 +30,7 @@ rustPlatform.buildRustPackage rec {

  meta = with stdenv.lib; {
    description = "A CLI tool designed for folks who are interested in using Cloudflare Workers.";
-    homepage = https://github.com/cloudflare/wrangler;
+    homepage = "https://github.com/cloudflare/wrangler";
    license = with licenses; [ asl20 /* or */ mit ];
    maintainers = with maintainers; [ ];
    platforms = platforms.all;
--- a/pkgs/development/tools/documentation/mkdocs/default.nix
+++ b/pkgs/development/tools/documentation/mkdocs/default.nix
@ -1,6 +1,6 @@
-{ stdenv, lib, python, fetchFromGitHub }:
+{ stdenv, lib, python3, fetchFromGitHub }:

-with python.pkgs;
+with python3.pkgs;

 buildPythonApplication rec {
  pname = "mkdocs";
--- a/pkgs/development/tools/gir/default.nix
+++ b/pkgs/development/tools/gir/default.nix
@ -11,10 +11,7 @@ rustPlatform.buildRustPackage rec {
    sha256 = "1kn5kgdma9j6dwpmv6jmydak7ajlgdkw9sfkh3q7h8c2a8yikvxr";
  };

-  # Delete this on next update; see #79975 for details
-  legacyCargoFetcher = true;
-
-  cargoSha256 = "1ybd9h2f13fxmnkzbacd39rcyzjcjd2ra52y8kncg1s0dc0m8rjb";
+  cargoSha256 = "048qhlc4f5khxi7dnakgqkhgww44r6h3mlx2fm7y2wqivr3rj8p1";

  meta = with stdenv.lib; {
    description = "Tool to generate rust bindings and user API for glib-based libraries";
--- a/pkgs/development/tools/godot/default.nix
+++ b/pkgs/development/tools/godot/default.nix
@ -10,13 +10,13 @@ let
  };
 in stdenv.mkDerivation rec {
  pname = "godot";
-  version = "3.1.2";
+  version = "3.2";

  src = fetchFromGitHub {
    owner  = "godotengine";
    repo   = "godot";
    rev    = "${version}-stable";
-    sha256 = "12305wj2i4067jc50l8r0wmb7zjcna24fli8vb8kiaild0jrlip6";
+    sha256 = "0f15izjl4i2xlz1xj5pcslzl9gm3rmr3c21gh256ynpi2zhhkcdd";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/development/tools/godot/dont_clobber_environment.patch
+++ b/pkgs/development/tools/godot/dont_clobber_environment.patch
@ -11,7 +11,6 @@
 +    if (k in os.environ):
 +        env_base["ENV"][k] = os.environ[k]
 +
- env_base.android_maven_repos = []
- env_base.android_flat_dirs = []
- env_base.android_dependencies = []
-
+ env_base.disabled_modules = []
+ env_base.use_ptrcall = False
+ env_base.module_version_string = ""
--- a/pkgs/development/tools/golangci-lint/default.nix
+++ b/pkgs/development/tools/golangci-lint/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "golangci-lint";
-  version = "1.23.7";
+  version = "1.23.8";

  src = fetchFromGitHub {
    owner = "golangci";
    repo = "golangci-lint";
    rev = "v${version}";
-    sha256 = "1dcayxblim97hlgdx0wdlbj2jxvdqfk8912hz7ylb1007x7y5da5";
+    sha256 = "166pwgf86lkd277dq98vjry0ad0avrz12zxb9rfgbhl1z4ccwi1g";
  };

  modSha256 = "0sckz298bvkf4p4fdmsmza0zrj2s2pvc86qwg6i76vdh9yzvq5gx";
--- a/pkgs/development/tools/haskell/vaultenv/default.nix
+++ b/pkgs/development/tools/haskell/vaultenv/default.nix
@ -15,6 +15,11 @@ mkDerivation rec {

  buildTools = [ hpack ];

+  prePatch = ''
+    substituteInPlace package.yaml \
+        --replace -Werror ""
+  '';
+
  isLibrary = false;
  isExecutable = true;
  executableHaskellDepends = [
--- a/Show More
+++ b/Show More