Merge pull request #74795 from NixOS/staging-next

Staging next
2019-12-05 10:19:02 +01:00 · 2019-12-05 10:19:02 +01:00 · 273ec23322
commit 273ec23322
parent cc6cf0a96a 51ef7c3e49
70 changed files with 497 additions and 366 deletions
--- a/pkgs/applications/gis/saga/default.nix
+++ b/pkgs/applications/gis/saga/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, gdal, wxGTK30, proj, libiodbc, lzma, jasper,
+{ stdenv, fetchurl, gdal, wxGTK30, proj, libiodbc, lzma,
  libharu, opencv, vigra, postgresql, Cocoa,
  unixODBC , poppler, hdf4, hdf5, netcdf, sqlite, qhull, giflib }:

@ -9,7 +9,7 @@ stdenv.mkDerivation {
  # See https://groups.google.com/forum/#!topic/nix-devel/h_vSzEJAPXs
  # for why the have additional buildInputs on darwin
  buildInputs = [ gdal wxGTK30 proj libharu opencv vigra postgresql libiodbc lzma
-                  jasper qhull giflib ]
+                  qhull giflib ]
                ++ stdenv.lib.optionals stdenv.isDarwin
                  [ Cocoa unixODBC poppler hdf4.out hdf5 netcdf sqlite ];

--- a/pkgs/applications/graphics/digikam/default.nix
+++ b/pkgs/applications/graphics/digikam/default.nix
@ -26,7 +26,7 @@
 , exiv2
 , ffmpeg
 , flex
-, jasper
+, jasper ? null, withJpeg2k ? false  # disable JPEG2000 support, jasper has unfixed CVE
 , lcms2
 , lensfun
 , libgphoto2
@ -70,7 +70,6 @@ mkDerivation rec {
    exiv2
    ffmpeg
    flex
-    jasper
    lcms2
    lensfun
    libgphoto2
@ -103,7 +102,8 @@ mkDerivation rec {
    marble
    oxygen
    threadweaver
-  ];
+  ]
+  ++ lib.optionals withJpeg2k [ jasper ];

  enableParallelBuilding = true;

--- a/pkgs/applications/misc/k2pdfopt/default.nix
+++ b/pkgs/applications/misc/k2pdfopt/default.nix
@ -3,7 +3,7 @@
 , enableGSL ? true, gsl
 , enableGhostScript ? true, ghostscript
 , enableMuPDF ? true, mupdf
-, enableJPEG2K ? true, jasper
+, enableJPEG2K ? false, jasper ? null  # disabled by default, jasper has unfixed CVE
 , enableDJVU ? true, djvulibre
 , enableGOCR ? false, gocr # Disabled by default due to crashes
 , enableTesseract ? true, leptonica, tesseract4
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@ -152,11 +152,7 @@ let
    ] ++ optionals (useVaapi) [
      # source: https://aur.archlinux.org/cgit/aur.git/tree/vaapi-fix.patch?h=chromium-vaapi
      ./patches/vaapi-fix.patch
-    ] ++ optional stdenv.isAarch64 (fetchpatch {
-      url       = https://raw.githubusercontent.com/OSSystems/meta-browser/e4a667deaaf9a26a3a1aeb355770d1f29da549ad/recipes-browser/chromium/files/aarch64-skia-build-fix.patch;
-      postFetch = "substituteInPlace $out --replace __aarch64__ SK_CPU_ARM64";
-      sha256    = "018fbdzyw9rvia8m0qkk5gv8q8gl7x34rrjbn7mi1fgxdsayn22s";
-    });
+    ];

    postPatch = ''
      # We want to be able to specify where the sandbox is via CHROME_DEVEL_SANDBOX
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@ -1,4 +1,4 @@
-{ newScope, config, stdenv, llvmPackages, gcc8Stdenv, llvmPackages_8
+{ newScope, config, stdenv, llvmPackages_8
 , makeWrapper, ed
 , glib, gtk3, gnome3, gsettings-desktop-schemas
 , libva ? null
@ -20,11 +20,8 @@
 }:

 let
-  stdenv_ = if stdenv.isAarch64 then gcc8Stdenv else llvmPackages_8.stdenv;
-  llvmPackages_ = if stdenv.isAarch64 then llvmPackages else llvmPackages_8;
-in let
-  stdenv = stdenv_;
-  llvmPackages = llvmPackages_;
+  stdenv = llvmPackages_8.stdenv;
+  llvmPackages = llvmPackages_8;

  callPackage = newScope chromium;

--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@ -1,5 +1,5 @@
 { fetchurl, stdenv, buildPackages
-, curl, openssl, zlib, expat, perlPackages, python, gettext, cpio
+, curl, openssl, zlib, expat, perlPackages, python3, gettext, cpio
 , gnugrep, gnused, gawk, coreutils # needed at runtime by git-filter-branch etc
 , openssh, pcre2
 , asciidoc, texinfo, xmlto, docbook2x, docbook_xsl, docbook_xml_dtd_45
@ -91,7 +91,7 @@ stdenv.mkDerivation {
    "SHELL_PATH=${stdenv.shell}"
  ]
  ++ (if perlSupport then ["PERL_PATH=${perlPackages.perl}/bin/perl"] else ["NO_PERL=1"])
-  ++ (if pythonSupport then ["PYTHON_PATH=${python}/bin/python"] else ["NO_PYTHON=1"])
+  ++ (if pythonSupport then ["PYTHON_PATH=${python3}/bin/python"] else ["NO_PYTHON=1"])
  ++ stdenv.lib.optionals stdenv.isSunOS ["INSTALL=install" "NO_INET_NTOP=" "NO_INET_PTON="]
  ++ (if stdenv.isDarwin then ["NO_APPLE_COMMON_CRYPTO=1"] else ["sysconfdir=/etc"])
  ++ stdenv.lib.optionals stdenv.hostPlatform.isMusl ["NO_SYS_POLL_H=1" "NO_GETTEXT=YesPlease"]
@ -253,7 +253,10 @@ stdenv.mkDerivation {
  installCheckTarget = "test";

  # see also installCheckFlagsArray
-  installCheckFlags = "DEFAULT_TEST_TARGET=prove";
+  installCheckFlags = [
+    "DEFAULT_TEST_TARGET=prove"
+    "PERL_PATH=${buildPackages.perl}/bin/perl"
+  ];

  preInstallCheck = ''
    installCheckFlagsArray+=(
@ -296,6 +299,13 @@ stdenv.mkDerivation {
    # Tested to fail: 2.18.0
    disable_test t9902-completion "sourcing the completion script clears cached --options"

+    ${stdenv.lib.optionalString (!perlSupport) ''
+      # request-pull is a Bash script that invokes Perl, so it is not available
+      # when NO_PERL=1, and the test should be skipped, but the test suite does
+      # not check for the Perl prerequisite.
+      disable_test t5150-request-pull
+    ''}
+
    # As of 2.19.0, t5562 refers to #!/usr/bin/perl
    patchShebangs t/t5562/invoke-with-content-length.pl
  '' + stdenv.lib.optionalString stdenv.isDarwin ''
--- a/pkgs/applications/video/kodi/default.nix
+++ b/pkgs/applications/video/kodi/default.nix
@ -9,7 +9,7 @@
 , libXinerama, libXrandr
 , libXtst, libXfixes, systemd
 , alsaLib, libGLU, libGL, glew, fontconfig, freetype, ftgl
-, libjpeg, jasper, libpng, libtiff
+, libjpeg, libpng, libtiff
 , libmpeg2, libsamplerate, libmad
 , libogg, libvorbis, flac, libxslt
 , lzo, libcdio, libmodplug, libass, libbluray
@ -157,7 +157,7 @@ in stdenv.mkDerivation {
      libX11 xorgproto libXt libXmu libXext
      libXinerama libXrandr libXtst libXfixes
      alsaLib libGL libGLU glew fontconfig freetype ftgl
-      libjpeg jasper libpng libtiff
+      libjpeg libpng libtiff
      libmpeg2 libsamplerate libmad
      libogg libvorbis flac libxslt systemd
      lzo libcdio libmodplug libass libbluray
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@ -73,9 +73,9 @@ let
 in

 stdenv.mkDerivation {
-  name = targetPrefix
-    + (if name != "" then name else "${bintoolsName}-wrapper")
-    + (stdenv.lib.optionalString (bintools != null && bintoolsVersion != "") "-${bintoolsVersion}");
+  pname = targetPrefix
+    + (if name != "" then name else "${bintoolsName}-wrapper");
+  version = if bintools == null then null else bintoolsVersion;

  preferLocalBuild = true;

--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@ -93,9 +93,9 @@ assert nativeLibc == bintools.nativeLibc;
 assert nativePrefix == bintools.nativePrefix;

 stdenv.mkDerivation {
-  name = targetPrefix
-    + (if name != "" then name else "${ccName}-wrapper")
-    + (stdenv.lib.optionalString (cc != null && ccVersion != "") "-${ccVersion}");
+  pname = targetPrefix
+    + (if name != "" then name else "${ccName}-wrapper");
+  version = if cc == null then null else ccVersion;

  preferLocalBuild = true;

@ -132,6 +132,8 @@ stdenv.mkDerivation {
    src=$PWD
  '';

+  wrapper = ./cc-wrapper.sh;
+
  installPhase =
    ''
      mkdir -p $out/bin $out/nix-support
@ -171,42 +173,42 @@ stdenv.mkDerivation {
      export default_cxx_stdlib_compile="${default_cxx_stdlib_compile}"

      if [ -e $ccPath/${targetPrefix}gcc ]; then
-        wrap ${targetPrefix}gcc ${./cc-wrapper.sh} $ccPath/${targetPrefix}gcc
+        wrap ${targetPrefix}gcc $wrapper $ccPath/${targetPrefix}gcc
        ln -s ${targetPrefix}gcc $out/bin/${targetPrefix}cc
        export named_cc=${targetPrefix}gcc
        export named_cxx=${targetPrefix}g++
      elif [ -e $ccPath/clang ]; then
-        wrap ${targetPrefix}clang ${./cc-wrapper.sh} $ccPath/clang
+        wrap ${targetPrefix}clang $wrapper $ccPath/clang
        ln -s ${targetPrefix}clang $out/bin/${targetPrefix}cc
        export named_cc=${targetPrefix}clang
        export named_cxx=${targetPrefix}clang++
      fi

      if [ -e $ccPath/${targetPrefix}g++ ]; then
-        wrap ${targetPrefix}g++ ${./cc-wrapper.sh} $ccPath/${targetPrefix}g++
+        wrap ${targetPrefix}g++ $wrapper $ccPath/${targetPrefix}g++
        ln -s ${targetPrefix}g++ $out/bin/${targetPrefix}c++
      elif [ -e $ccPath/clang++ ]; then
-        wrap ${targetPrefix}clang++ ${./cc-wrapper.sh} $ccPath/clang++
+        wrap ${targetPrefix}clang++ $wrapper $ccPath/clang++
        ln -s ${targetPrefix}clang++ $out/bin/${targetPrefix}c++
      fi

      if [ -e $ccPath/cpp ]; then
-        wrap ${targetPrefix}cpp ${./cc-wrapper.sh} $ccPath/cpp
+        wrap ${targetPrefix}cpp $wrapper $ccPath/cpp
      fi
    ''

    + optionalString cc.langFortran or false ''
-      wrap ${targetPrefix}gfortran ${./cc-wrapper.sh} $ccPath/${targetPrefix}gfortran
+      wrap ${targetPrefix}gfortran $wrapper $ccPath/${targetPrefix}gfortran
      ln -sv ${targetPrefix}gfortran $out/bin/${targetPrefix}g77
      ln -sv ${targetPrefix}gfortran $out/bin/${targetPrefix}f77
    ''

    + optionalString cc.langJava or false ''
-      wrap ${targetPrefix}gcj ${./cc-wrapper.sh} $ccPath/${targetPrefix}gcj
+      wrap ${targetPrefix}gcj $wrapper $ccPath/${targetPrefix}gcj
    ''

    + optionalString cc.langGo or false ''
-      wrap ${targetPrefix}gccgo ${./cc-wrapper.sh} $ccPath/${targetPrefix}gccgo
+      wrap ${targetPrefix}gccgo $wrapper $ccPath/${targetPrefix}gccgo
    '';

  strictDeps = true;
--- a/pkgs/desktops/gnome-3/core/adwaita-icon-theme/default.nix
+++ b/pkgs/desktops/gnome-3/core/adwaita-icon-theme/default.nix
@ -3,11 +3,11 @@

 stdenv.mkDerivation rec {
  pname = "adwaita-icon-theme";
-  version = "3.34.0";
+  version = "3.34.3";

  src = fetchurl {
    url = "mirror://gnome/sources/adwaita-icon-theme/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0zvwikj3a07i3g3rir4cc63b14822lrzzgprs1j2nmb3h8gykds0";
+    sha256 = "025rj1fskw1y448hiar4a9icyzpyr242nlh9xhsmyp8jb71dihp7";
  };

  # For convenience, we can specify adwaita-icon-theme only in packages
--- a/pkgs/development/compilers/gcc/4.8/default.nix
+++ b/pkgs/development/compilers/gcc/4.8/default.nix
@ -111,7 +111,8 @@ in
 assert x11Support -> (filter (x: x == null) ([ gtk2 libart_lgpl ] ++ xlibs)) == [];

 stdenv.mkDerivation ({
-  name = "${crossNameAddon}${name}${if stripped then "" else "-debug"}-${version}";
+  pname = "${crossNameAddon}${name}${if stripped then "" else "-debug"}";
+  inherit version;

  builder = ../builder.sh;

--- a/pkgs/development/compilers/gcc/4.9/default.nix
+++ b/pkgs/development/compilers/gcc/4.9/default.nix
@ -116,7 +116,8 @@ in
 assert x11Support -> (filter (x: x == null) ([ gtk2 libart_lgpl ] ++ xlibs)) == [];

 stdenv.mkDerivation ({
-  name = "${crossNameAddon}${name}${if stripped then "" else "-debug"}-${version}";
+  pname = "${crossNameAddon}${name}${if stripped then "" else "-debug"}";
+  inherit version;

  builder = ../builder.sh;

--- a/pkgs/development/compilers/gcc/5/default.nix
+++ b/pkgs/development/compilers/gcc/5/default.nix
@ -107,7 +107,8 @@ in
 assert x11Support -> (filter (x: x == null) ([ gtk2 libart_lgpl ] ++ xlibs)) == [];

 stdenv.mkDerivation ({
-  name = "${crossNameAddon}${name}${if stripped then "" else "-debug"}-${version}";
+  pname = "${crossNameAddon}${name}${if stripped then "" else "-debug"}";
+  inherit version;

  builder = ../builder.sh;

--- a/pkgs/development/compilers/gcc/6/default.nix
+++ b/pkgs/development/compilers/gcc/6/default.nix
@ -104,7 +104,8 @@ in
 assert x11Support -> (filter (x: x == null) ([ gtk2 libart_lgpl ] ++ xlibs)) == [];

 stdenv.mkDerivation ({
-  name = "${crossNameAddon}${name}${if stripped then "" else "-debug"}-${version}";
+  pname = "${crossNameAddon}${name}${if stripped then "" else "-debug"}";
+  inherit version;

  builder = ../builder.sh;

--- a/pkgs/development/compilers/gcc/7/default.nix
+++ b/pkgs/development/compilers/gcc/7/default.nix
@ -78,7 +78,8 @@ let majorVersion = "7";
 in

 stdenv.mkDerivation ({
-  name = "${crossNameAddon}${name}${if stripped then "" else "-debug"}-${version}";
+  pname = "${crossNameAddon}${name}${if stripped then "" else "-debug"}";
+  inherit version;

  builder = ../builder.sh;

--- a/pkgs/development/compilers/gcc/8/default.nix
+++ b/pkgs/development/compilers/gcc/8/default.nix
@ -70,7 +70,8 @@ let majorVersion = "8";
 in

 stdenv.mkDerivation ({
-  name = "${crossNameAddon}${name}${if stripped then "" else "-debug"}-${version}";
+  pname = "${crossNameAddon}${name}${if stripped then "" else "-debug"}";
+  inherit version;

  builder = ../builder.sh;

--- a/pkgs/development/compilers/gcc/9/default.nix
+++ b/pkgs/development/compilers/gcc/9/default.nix
@ -69,7 +69,8 @@ let majorVersion = "9";
 in

 stdenv.mkDerivation ({
-  name = "${crossNameAddon}${name}${if stripped then "" else "-debug"}-${version}";
+  pname = "${crossNameAddon}${name}${if stripped then "" else "-debug"}";
+  inherit version;

  builder = ../builder.sh;

--- a/pkgs/development/compilers/gcc/snapshot/default.nix
+++ b/pkgs/development/compilers/gcc/snapshot/default.nix
@ -66,7 +66,8 @@ let majorVersion = "7";
 in

 stdenv.mkDerivation ({
-  name = "${crossNameAddon}${name}${if stripped then "" else "-debug"}-${version}";
+  pname = "${crossNameAddon}${name}${if stripped then "" else "-debug"}";
+  inherit version;

  builder = ../builder.sh;

--- a/pkgs/development/compilers/llvm/4/clang/default.nix
+++ b/pkgs/development/compilers/llvm/4/clang/default.nix
@ -6,7 +6,8 @@
 let
  gcc = if stdenv.cc.isGNU then stdenv.cc.cc else stdenv.cc.cc.gcc;
  self = stdenv.mkDerivation ({
-    name = "clang-${version}";
+    pname = "clang";
+    inherit version;

    src = fetch "cfe" "16vnv3msnvx33dydd17k2cq0icndi1a06bg5vcxkrhjjb1rqlwv1";

@ -91,7 +92,7 @@ let
      platforms   = stdenv.lib.platforms.all;
    };
  } // stdenv.lib.optionalAttrs enableManpages {
-    name = "clang-manpages-${version}";
+    pname = "clang-manpages";

    buildPhase = ''
      make docs-clang-man
--- a/pkgs/development/compilers/llvm/4/llvm.nix
+++ b/pkgs/development/compilers/llvm/4/llvm.nix
@ -24,7 +24,8 @@ let
 in

 stdenv.mkDerivation ({
-  name = "llvm-${version}";
+  pname = "llvm";
+  inherit version;

  src = fetch "llvm" "0l9bf7kdwhlj0kq1hawpyxhna1062z3h7qcz2y8nfl9dz2qksy6s";

@ -166,7 +167,7 @@ stdenv.mkDerivation ({
    platforms   = stdenv.lib.platforms.all;
  };
 } // stdenv.lib.optionalAttrs enableManpages {
-  name = "llvm-manpages-${version}";
+  pname = "llvm-manpages";

  buildPhase = ''
    make docs-llvm-man
--- a/pkgs/development/compilers/llvm/5/clang/default.nix
+++ b/pkgs/development/compilers/llvm/5/clang/default.nix
@ -6,7 +6,8 @@
 let
  gcc = if stdenv.cc.isGNU then stdenv.cc.cc else stdenv.cc.cc.gcc;
  self = stdenv.mkDerivation ({
-    name = "clang-${version}";
+    pname = "clang";
+    inherit version;

    src = fetch "cfe" "0018520c4qxf5hgjdqgpz2dgl3faf4gsz87fdlb8zdmx99rfk77s";

@ -87,7 +88,7 @@ let
      platforms   = stdenv.lib.platforms.all;
    };
  } // stdenv.lib.optionalAttrs enableManpages {
-    name = "clang-manpages-${version}";
+    pname = "clang-manpages";

    buildPhase = ''
      make docs-clang-man
--- a/pkgs/development/compilers/llvm/5/llvm.nix
+++ b/pkgs/development/compilers/llvm/5/llvm.nix
@ -23,7 +23,8 @@ let
 in

 stdenv.mkDerivation ({
-  name = "llvm-${version}";
+  pname = "llvm";
+  inherit version;

  src = fetch "llvm" "0g1bbj2n6xv4p1n6hh17vj3vpvg56wacipc81dgwga9mg2lys8nm";

@ -149,7 +150,7 @@ stdenv.mkDerivation ({
    platforms   = stdenv.lib.platforms.all;
  };
 } // stdenv.lib.optionalAttrs enableManpages {
-  name = "llvm-manpages-${version}";
+  pname = "llvm-manpages";

  buildPhase = ''
    make docs-llvm-man
--- a/pkgs/development/compilers/llvm/6/clang/default.nix
+++ b/pkgs/development/compilers/llvm/6/clang/default.nix
@ -6,7 +6,8 @@
 let
  gcc = if stdenv.cc.isGNU then stdenv.cc.cc else stdenv.cc.cc.gcc;
  self = stdenv.mkDerivation ({
-    name = "clang-${version}";
+    pname = "clang";
+    inherit version;

    src = fetch "cfe" "0rxn4rh7rrnsqbdgp4gzc8ishbkryhpl1kd3mpnxzpxxhla3y93w";

@ -87,7 +88,7 @@ let
      platforms   = stdenv.lib.platforms.all;
    };
  } // stdenv.lib.optionalAttrs enableManpages {
-    name = "clang-manpages-${version}";
+    pname = "clang-manpages";

    buildPhase = ''
      make docs-clang-man
--- a/pkgs/development/compilers/llvm/6/llvm.nix
+++ b/pkgs/development/compilers/llvm/6/llvm.nix
@ -26,7 +26,8 @@ let
 in

 stdenv.mkDerivation ({
-  name = "llvm-${version}";
+  pname = "llvm";
+  inherit version;

  src = fetch "llvm" "1qpls3vk85lydi5b4axl0809fv932qgsqgdgrk098567z4jc7mmn";

@ -154,7 +155,7 @@ stdenv.mkDerivation ({
    platforms   = stdenv.lib.platforms.all;
  };
 } // stdenv.lib.optionalAttrs enableManpages {
-  name = "llvm-manpages-${version}";
+  pname = "llvm-manpages";

  buildPhase = ''
    make docs-llvm-man
--- a/pkgs/development/compilers/llvm/7/clang/default.nix
+++ b/pkgs/development/compilers/llvm/7/clang/default.nix
@ -6,7 +6,8 @@

 let
  self = stdenv.mkDerivation ({
-    name = "clang-${version}";
+    pname = "clang";
+    inherit version;

    src = fetch "cfe" "0vc4i87qwxnw9lci4ayws9spakg0z6w5w670snj9f8g5m9rc8zg9";

@ -93,7 +94,7 @@ let
      platforms   = stdenv.lib.platforms.all;
    };
  } // stdenv.lib.optionalAttrs enableManpages {
-    name = "clang-manpages-${version}";
+    pname = "clang-manpages";

    buildPhase = ''
      make docs-clang-man
--- a/pkgs/development/compilers/llvm/7/compiler-rt.nix
+++ b/pkgs/development/compilers/llvm/7/compiler-rt.nix
@ -7,6 +7,10 @@ stdenv.mkDerivation {
  nativeBuildInputs = [ cmake python llvm ];
  buildInputs = stdenv.lib.optional stdenv.hostPlatform.isDarwin libcxxabi;

+  NIX_CFLAGS_COMPILE = [
+    "-DSCUDO_DEFAULT_OPTIONS=DeleteSizeMismatch=0:DeallocationTypeMismatch=0"
+  ];
+
  cmakeFlags = stdenv.lib.optionals (stdenv.hostPlatform.useLLVM or false || stdenv.isDarwin) [
    "-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON"
    "-DCMAKE_C_COMPILER_TARGET=${stdenv.hostPlatform.config}"
--- a/pkgs/development/compilers/llvm/7/llvm.nix
+++ b/pkgs/development/compilers/llvm/7/llvm.nix
@ -30,7 +30,8 @@ let
    imap (i: _: concatStringsSep "." (take i parts)) parts;

 in stdenv.mkDerivation ({
-  name = "llvm-${version}";
+  pname = "llvm";
+  inherit version;

  src = fetch "llvm" "0r1p5didv4rkgxyvbkyz671xddg6i3dxvbpsi1xxipkla0l9pk0v";
  polly_src = fetch "polly" "16qkns4ab4x0azrvhy4j7cncbyb2rrbdrqj87zphvqxm5pvm8m1h";
@ -175,7 +176,7 @@ in stdenv.mkDerivation ({
    platforms   = stdenv.lib.platforms.all;
  };
 } // stdenv.lib.optionalAttrs enableManpages {
-  name = "llvm-manpages-${version}";
+  pname = "llvm-manpages";

  buildPhase = ''
    make docs-llvm-man
--- a/pkgs/development/compilers/llvm/8/clang/default.nix
+++ b/pkgs/development/compilers/llvm/8/clang/default.nix
@ -6,7 +6,8 @@

 let
  self = stdenv.mkDerivation ({
-    name = "clang-${version}";
+    pname = "clang";
+    inherit version;

    src = fetch "cfe" "0ihnbdl058gvl2wdy45p5am55bq8ifx8m9mhcsgj9ax8yxlzvvvh";

@ -105,7 +106,7 @@ let
      platforms   = stdenv.lib.platforms.all;
    };
  } // stdenv.lib.optionalAttrs enableManpages {
-    name = "clang-manpages-${version}";
+    pname = "clang-manpages";

    buildPhase = ''
      make docs-clang-man
--- a/pkgs/development/compilers/llvm/8/compiler-rt.nix
+++ b/pkgs/development/compilers/llvm/8/compiler-rt.nix
@ -7,6 +7,10 @@ stdenv.mkDerivation {
  nativeBuildInputs = [ cmake python llvm ];
  buildInputs = stdenv.lib.optional stdenv.hostPlatform.isDarwin libcxxabi;

+  NIX_CFLAGS_COMPILE = [
+    "-DSCUDO_DEFAULT_OPTIONS=DeleteSizeMismatch=0:DeallocationTypeMismatch=0"
+  ];
+
  cmakeFlags = stdenv.lib.optionals (stdenv.hostPlatform.useLLVM or false) [
    "-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON"
    "-DCMAKE_C_COMPILER_TARGET=${stdenv.hostPlatform.config}"
--- a/pkgs/development/compilers/llvm/8/llvm.nix
+++ b/pkgs/development/compilers/llvm/8/llvm.nix
@ -28,7 +28,8 @@ let
    concatStringsSep "." (take 1 (splitVersion release_version));

 in stdenv.mkDerivation ({
-  name = "llvm-${version}";
+  pname = "llvm";
+  inherit version;

  src = fetch "llvm" "1rvm5gqp5v8hfn17kqws3zhk94w4kxndal12bqa0y57p09nply24";
  polly_src = fetch "polly" "1lfjdz3ilj5xmjxvicd8f5ykybks67ry2pdb777352r3mzlgg8g8";
@ -150,7 +151,7 @@ in stdenv.mkDerivation ({
    platforms   = stdenv.lib.platforms.all;
  };
 } // stdenv.lib.optionalAttrs enableManpages {
-  name = "llvm-manpages-${version}";
+  pname = "llvm-manpages";

  buildPhase = ''
    make docs-llvm-man
--- a/pkgs/development/compilers/llvm/9/compiler-rt.nix
+++ b/pkgs/development/compilers/llvm/9/compiler-rt.nix
@ -7,6 +7,10 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ cmake python llvm ];
  buildInputs = stdenv.lib.optional stdenv.hostPlatform.isDarwin libcxxabi;

+  NIX_CFLAGS_COMPILE = [
+    "-DSCUDO_DEFAULT_OPTIONS=DeleteSizeMismatch=0:DeallocationTypeMismatch=0"
+  ];
+
  cmakeFlags = stdenv.lib.optionals (stdenv.hostPlatform.useLLVM or false) [
    "-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON"
    "-DCMAKE_C_COMPILER_TARGET=${stdenv.hostPlatform.config}"
--- a/pkgs/development/interpreters/perl/default.nix
+++ b/pkgs/development/interpreters/perl/default.nix
@ -181,11 +181,11 @@ let
      priority = 6; # in `buildEnv' (including the one inside `perl.withPackages') the library files will have priority over files in `perl`
    };
  } // optionalAttrs (stdenv.buildPlatform != stdenv.hostPlatform) rec {
-    crossVersion = "980998f7d11baf97284426ca91f84681d49a08f5"; # Jul 20, 2019
+    crossVersion = "ba90816ef2c24dc06fd6cd2c854abcfa1aae00a3"; # Nov 22, 2019

    perl-cross-src = fetchurl {
      url = "https://github.com/arsv/perl-cross/archive/${crossVersion}.tar.gz";
-      sha256 = "1hg3k2rhjs5gclrm05z87nvlh4j9pg7mkm9998h9gy6mzk8224q5";
+      sha256 = "19jq5fz6l64s0v6j64n5mkk5v2srpyfn9sc09hwbpkp9n74q82j4";
    };

    depsBuildBuild = [ buildPackages.stdenv.cc makeWrapper ];
@ -213,15 +213,15 @@ in {
  perl530 = common {
    perl = pkgs.perl530;
    buildPerl = buildPackages.perl530;
-    version = "5.30.0";
-    sha256 = "1wkmz6xn3fswpqhz29akiklcxclnlykhp96a8bqcz36rak3i64l5";
+    version = "5.30.1";
+    sha256 = "0r7r8a7pkgxp3w5lza559ahxczw6hzpwvhkpc4c99vpi3xbjagdz";
  };

  # the latest Devel version
  perldevel = common {
    perl = pkgs.perldevel;
    buildPerl = buildPackages.perldevel;
-    version = "5.31.2";
-    sha256 = "00bdh9lmjb0m7dhk8mj7kab7cg2zn9zgw82y4hgkwydzg6d1jis0";
+    version = "5.31.6";
+    sha256 = "08n3c8xm1brxpckqy8i1xgjrpl4afrhcva9bhxswr938n675x71k";
  };
 }
--- a/pkgs/development/libraries/gdk-pixbuf/default.nix
+++ b/pkgs/development/libraries/gdk-pixbuf/default.nix
@ -1,6 +1,6 @@
 { stdenv, fetchurl, nixosTests, fixDarwinDylibNames, meson, ninja, pkgconfig, gettext, python3, libxml2, libxslt, docbook_xsl
 , docbook_xml_dtd_43, gtk-doc, glib, libtiff, libjpeg, libpng, libX11, gnome3
-, jasper, gobject-introspection, doCheck ? false, makeWrapper }:
+, gobject-introspection, doCheck ? false, makeWrapper }:

 let
  pname = "gdk-pixbuf";
@ -31,11 +31,10 @@ in stdenv.mkDerivation rec {
  ]
    ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;

-  propagatedBuildInputs = [ glib libtiff libjpeg libpng jasper ];
+  propagatedBuildInputs = [ glib libtiff libjpeg libpng ];

  mesonFlags = [
    "-Ddocs=true"
-    "-Djasper=true"
    "-Dx11=true"
    "-Dgir=${if gobject-introspection != null then "true" else "false"}"
    "-Dgio_sniffing=false"
--- a/pkgs/development/libraries/gdk-pixbuf/setup-hook.sh
+++ b/pkgs/development/libraries/gdk-pixbuf/setup-hook.sh
@ -4,7 +4,7 @@ findGdkPixbufLoaders() {
 	local loadersCache="$1/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache"
 	if [[ -f "$loadersCache" ]]; then
 		if [[ -f "${GDK_PIXBUF_MODULE_FILE-}" ]]; then
-			if [[ "$(cat "$loadersCache" | wc -l)" > "$(cat "$GDK_PIXBUF_MODULE_FILE" | wc -l)" ]]; then
+			if (( "$(cat "$loadersCache" | wc -l)" > "$(cat "$GDK_PIXBUF_MODULE_FILE" | wc -l)" )); then
 				export GDK_PIXBUF_MODULE_FILE="$loadersCache"
 			fi
 		else
--- a/pkgs/development/libraries/gegl/4.0.nix
+++ b/pkgs/development/libraries/gegl/4.0.nix
@ -105,6 +105,9 @@ stdenv.mkDerivation rec {
    "-Dlibv4l=disabled"
    "-Dlibv4l2=disabled"
    "-Dumfpack=disabled"
+    # Disabled due to multiple vulnerabilities, see
+    # https://github.com/NixOS/nixpkgs/pull/73586
+    "-Djasper=disabled"
  ];

  # TODO: Fix missing math symbols in gegl seamless clone.
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@ -48,11 +48,11 @@ in

 stdenv.mkDerivation rec {
  pname = "glib";
-  version = "2.62.2";
+  version = "2.62.3";

  src = fetchurl {
    url = "mirror://gnome/sources/glib/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1wdkvqq6fkk99smmnjg7d999v4qhbgs7halwfcwz0vgp2fj29239";
+    sha256 = "1i2mlrd351dnmpfi465qmx9rhgyff01j29a2x3lczzyky34ss024";
  };

  patches = optionals stdenv.isDarwin [
--- a/pkgs/development/libraries/grib-api/default.nix
+++ b/pkgs/development/libraries/grib-api/default.nix
@ -1,5 +1,5 @@
-{ fetchurl, stdenv,
-  cmake, netcdf, gfortran, jasper, libpng,
+{ fetchurl, fetchpatch, stdenv,
+  cmake, netcdf, gfortran, libpng, openjpeg,
  enablePython ? false, pythonPackages }:

 stdenv.mkDerivation rec{
@ -11,6 +11,13 @@ stdenv.mkDerivation rec{
    sha256 = "0qbj12ap7yy2rl1pq629chnss2jl73wxdj1lwzv0xp87r6z5qdfl";
  };

+  patches = [
+    (fetchpatch {
+      url = "https://salsa.debian.org/science-team/grib-api/raw/debian/1.28.0-2/debian/patches/openjpeg2.patch";
+      sha256 = "05faxh51vlidiazxq1ssd3k4cjivk1adyn30k94mxqa1xnb2r2pc";
+    })
+  ];
+
  preConfigure = ''
    # Fix "no member named 'inmem_' in 'jas_image_t'"
    substituteInPlace "src/grib_jasper_encoding.c" --replace "image.inmem_    = 1;" ""
@ -19,8 +26,8 @@ stdenv.mkDerivation rec{
  buildInputs = [ cmake
                  netcdf
                  gfortran
-                  jasper
                  libpng
+                  openjpeg
                ] ++ stdenv.lib.optionals enablePython [
                  pythonPackages.python
                ];
@ -32,6 +39,7 @@ stdenv.mkDerivation rec{
  cmakeFlags = [ "-DENABLE_PYTHON=${if enablePython then "ON" else "OFF"}"
                 "-DENABLE_PNG=ON"
                 "-DENABLE_FORTRAN=ON"
+                 "-DOPENJPEG_INCLUDE_DIR=${openjpeg.dev}/include/${openjpeg.incDir}"
               ];

  enableParallelBuilding = true;
@ -52,13 +60,15 @@ stdenv.mkDerivation rec{
    homepage = https://software.ecmwf.int/wiki/display/GRIB/Home;
    license = licenses.asl20;
    platforms = with platforms; linux ++ darwin;
-    description = "ECMWF Library for the GRIB file format";
+    description = "ECMWF Library for the GRIB file format -- DEPRECATED";
    longDescription = ''
      The ECMWF GRIB API is an application program interface accessible from C,
      FORTRAN and Python programs developed for encoding and decoding WMO FM-92
      GRIB edition 1 and edition 2 messages.
+
+      Please note: GRIB-API support is being discontinued at the end of 2018.
+      After which there will be no further releases. Please upgrade to ecCodes
    '';
    maintainers = with maintainers; [ knedlsepp ];
  };
 }
-
--- a/pkgs/development/libraries/jasper/default.nix
+++ b/pkgs/development/libraries/jasper/default.nix
@ -42,5 +42,10 @@ stdenv.mkDerivation rec {
    platforms = platforms.unix;
    license = licenses.jasper;
    maintainers = with maintainers; [ pSub ];
+    knownVulnerabilities = [
+      "Numerous CVE unsolved upstream"
+      "See: https://github.com/NixOS/nixpkgs/pull/57681#issuecomment-475857499"
+      "See: https://github.com/mdadams/jasper/issues/208"
+    ];
  };
 }
--- a/pkgs/development/libraries/jsoncpp/default.nix
+++ b/pkgs/development/libraries/jsoncpp/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "jsoncpp";
-  version = "1.9.1";
+  version = "1.9.2";

  src = fetchFromGitHub {
    owner = "open-source-parsers";
    repo = "jsoncpp";
    rev = version;
-    sha256 = "00g356iv3kcp0gadj7gbyzf9jn9avvx9vxbxc7c2i5nnry8z72wj";
+    sha256 = "037d1b1qdmn3rksmn1j71j26bv4hkjv7sn7da261k853xb5899sg";
  };

  /* During darwin bootstrap, we have a cp that doesn't understand the
--- a/pkgs/development/libraries/libftdi/1.x.nix
+++ b/pkgs/development/libraries/libftdi/1.x.nix
@ -1,11 +1,11 @@
 { stdenv, fetchurl, cmake, pkgconfig, libusb1, libconfuse
 , cppSupport ? true, boost ? null
-, pythonSupport ? true, python ? null, swig ? null
+, pythonSupport ? true, python3 ? null, swig ? null
 , docSupport ? true, doxygen ? null
 }:

 assert cppSupport -> boost != null;
-assert pythonSupport -> python != null && swig != null;
+assert pythonSupport -> python3 != null && swig != null;
 assert docSupport -> doxygen != null;

 stdenv.mkDerivation rec {
@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ cmake pkgconfig ];
  buildInputs = with stdenv.lib; [ libconfuse ]
    ++ optionals cppSupport [ boost ]
-    ++ optionals pythonSupport [ python swig ]
+    ++ optionals pythonSupport [ python3 swig ]
    ++ optionals docSupport [ doxygen ];

  preBuild = stdenv.lib.optionalString docSupport ''
--- a/pkgs/development/libraries/libicns/default.nix
+++ b/pkgs/development/libraries/libicns/default.nix
@ -1,14 +1,24 @@
-{ stdenv, fetchurl, libpng, jasper }:
+{ stdenv, fetchurl, fetchpatch, autoreconfHook, libpng, openjpeg }:

 stdenv.mkDerivation rec {
-  name = "libicns-0.8.1";
+  pname = "libicns";
+  version = "0.8.1";

  src = fetchurl {
-    url = "mirror://sourceforge/icns/${name}.tar.gz";
+    url = "mirror://sourceforge/icns/${pname}-${version}.tar.gz";
    sha256 = "1hjm8lwap7bjyyxsyi94fh5817xzqhk4kb5y0b7mb6675xw10prk";
  };

-  buildInputs = [ libpng jasper ];
+  patches = [
+    (fetchpatch {
+      url = "https://sources.debian.org/data/main/libi/libicns/0.8.1-3.1/debian/patches/support-libopenjp2.patch";
+      sha256 = "0ss298lyzvydxvaxsadi6kbbjpwykd86jw3za76brcsg2dpssgas";
+    })
+  ];
+
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ libpng openjpeg ];
+  NIX_CFLAGS_COMPILE = [ "-I${openjpeg.dev}/include/${openjpeg.incDir}" ];

  meta = with stdenv.lib; {
    description = "Library for manipulation of the Mac OS icns resource format";
--- a/pkgs/development/libraries/libidn2/default.nix
+++ b/pkgs/development/libraries/libidn2/default.nix
@ -4,11 +4,11 @@ with stdenv.lib;

 stdenv.mkDerivation rec {
  pname = "libidn2";
-  version = "2.2.0";
+  version = "2.3.0";

  src = fetchurl {
    url = "mirror://gnu/gnu/libidn/${pname}-${version}.tar.gz";
-    sha256 = "1zl1cc2xgxw31pdhvhr5ij36x4vvpy16jq667rspin06nlr4fwzw";
+    sha256 = "1ddqr80kmz4l8g3r3gf7bmf2v29fgivlc2bgxfiscjg2sarivjz1";
  };

  outputs = [ "bin" "dev" "out" "info" "devdoc" ];
--- a/pkgs/development/libraries/libmbim/default.nix
+++ b/pkgs/development/libraries/libmbim/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "libmbim";
-  version = "1.20.0";
+  version = "1.20.2";

  src = fetchurl {
    url = "https://www.freedesktop.org/software/libmbim/${pname}-${version}.tar.xz";
-    sha256 = "0rm8j4zh9gnb3yi324cnxy91gdimc1vg5gv1kxc2m5lymb3wdxrc";
+    sha256 = "16q550sy84izi5ic3sbbhjnnka2fwhj8vvdrirpn9xspbsgbc3sm";
  };

  outputs = [ "out" "dev" "man" ];
--- a/pkgs/development/libraries/libraw/default.nix
+++ b/pkgs/development/libraries/libraw/default.nix
@ -1,4 +1,7 @@
-{ stdenv, fetchurl, lcms2, jasper, pkgconfig }:
+{ stdenv, fetchurl, lcms2, pkgconfig
+, jasper ? null, withJpeg2k ? false
+# disable JPEG2000 support by default as jasper has many CVE
+}:

 stdenv.mkDerivation rec {
  pname = "libraw";
@ -11,7 +14,7 @@ stdenv.mkDerivation rec {

  outputs = [ "out" "lib" "dev" "doc" ];

-  buildInputs = [ jasper ];
+  buildInputs = stdenv.lib.optionals withJpeg2k [ jasper ];

  propagatedBuildInputs = [ lcms2 ];

--- a/pkgs/development/libraries/libseccomp/default.nix
+++ b/pkgs/development/libraries/libseccomp/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "libseccomp";
-  version = "2.4.1";
+  version = "2.4.2";

  src = fetchurl {
    url = "https://github.com/seccomp/libseccomp/releases/download/v${version}/libseccomp-${version}.tar.gz";
-    sha256 = "1s06h2cgk0xxwmhwj72z33bllafc1xqnxzk2yyra2rmg959778qw";
+    sha256 = "0nsq81acrbkdr8zairxbwa33bj2a6126npp76b4srjl472sjfkxm";
  };

  outputs = [ "out" "lib" "dev" "man" ];
--- a/pkgs/development/libraries/nss/default.nix
+++ b/pkgs/development/libraries/nss/default.nix
@ -5,7 +5,7 @@ let
    url = http://dev.gentoo.org/~polynomial-c/mozilla/nss-3.15.4-pem-support-20140109.patch.xz;
    sha256 = "10ibz6y0hknac15zr6dw4gv9nb5r5z9ym6gq18j3xqx7v7n3vpdw";
  };
-  version = "3.46.1";
+  version = "3.47.1";
  underscoreVersion = builtins.replaceStrings ["."] ["_"] version;

 in stdenv.mkDerivation rec {
@ -14,7 +14,7 @@ in stdenv.mkDerivation rec {

  src = fetchurl {
    url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/${pname}-${version}.tar.gz";
-    sha256 = "0l9ns44rlkp1bpblplspfbqmyhb8rhvc89y56kqh725rgpny1xrv";
+    sha256 = "1yx68a1ks63s8914zmiz9h1nh0261aqzcblgg1cb4ig33p5x3qqs";
  };

  depsBuildBuild = [ buildPackages.stdenv.cc ];
@ -27,7 +27,8 @@ in stdenv.mkDerivation rec {
  propagatedBuildInputs = [ nspr ];

  prePatch = ''
-    xz -d < ${nssPEM} | patch -p1
+    # strip the trailing whitespace from the patch line…
+    xz -d < ${nssPEM} | sed -e '/^-DIRS = builtins $/ s/ $//' | patch -p1
  '';

  patches =
--- a/pkgs/development/libraries/opencv/3.x.nix
+++ b/pkgs/development/libraries/opencv/3.x.nix
@ -9,7 +9,7 @@
 , enableTIFF      ? true, libtiff
 , enableWebP      ? true, libwebp
 , enableEXR ?     !stdenv.isDarwin, openexr, ilmbase
-, enableJPEG2K    ? true, jasper
+, enableJPEG2K    ? false, jasper  # disable jasper by default (many CVE)
 , enableEigen     ? true, eigen
 , enableOpenblas  ? true, openblas
 , enableContrib   ? true
--- a/pkgs/development/libraries/opencv/4.x.nix
+++ b/pkgs/development/libraries/opencv/4.x.nix
@ -9,7 +9,7 @@
 , enableTIFF      ? true, libtiff
 , enableWebP      ? true, libwebp
 , enableEXR ?     !stdenv.isDarwin, openexr, ilmbase
-, enableJPEG2K    ? true, jasper
+, enableJPEG2K    ? false, jasper  # disable jasper by default (many CVE)
 , enableEigen     ? true, eigen
 , enableOpenblas  ? true, openblas
 , enableContrib   ? true
--- a/pkgs/development/libraries/opencv/default.nix
+++ b/pkgs/development/libraries/opencv/default.nix
@ -6,7 +6,7 @@
 , enablePNG ? true, libpng
 , enableTIFF ? true, libtiff
 , enableEXR ? (!stdenv.isDarwin), openexr, ilmbase
-, enableJPEG2K ? true, jasper
+, enableJPEG2K ? false, jasper  # disable jasper by default (many CVE)
 , enableFfmpeg ? false, ffmpeg
 , enableGStreamer ? false, gst_all_1
 , enableEigen ? true, eigen
--- a/pkgs/development/libraries/openscenegraph/default.nix
+++ b/pkgs/development/libraries/openscenegraph/default.nix
@ -2,7 +2,7 @@
  libX11, libXinerama, libXrandr, libGLU, libGL,
  glib, ilmbase, libxml2, pcre, zlib,
  jpegSupport ? true, libjpeg,
-  jasperSupport ? true, jasper,
+  jasperSupport ? false, jasper,  # disable jasper by default (many CVE)
  exrSupport ? false, openexr,
  gifSupport ? true, giflib,
  pngSupport ? true, libpng,
--- a/pkgs/development/libraries/pcre2/default.nix
+++ b/pkgs/development/libraries/pcre2/default.nix
@ -2,10 +2,10 @@

 stdenv.mkDerivation rec {
  pname = "pcre2";
-  version = "10.33";
+  version = "10.34";
  src = fetchurl {
    url = "https://ftp.pcre.org/pub/pcre/${pname}-${version}.tar.bz2";
-    sha256 = "1anqi7vpbfzag7imccrc6di1zl5rl63ab7rfpmajpw6d1kzlsl9m";
+    sha256 = "1jlqnzcz2yi70dm40wyfa9w8is9z2kh4dl8zjnv3vqd9mgzp7i3l";
  };

  configureFlags = [
--- a/pkgs/development/libraries/silgraphite/graphite2.nix
+++ b/pkgs/development/libraries/silgraphite/graphite2.nix
@ -1,13 +1,13 @@
 { stdenv, fetchurl, pkgconfig, freetype, cmake, python }:

 stdenv.mkDerivation rec {
-  version = "1.3.6";
+  version = "1.3.13";
  pname = "graphite2";

  src = fetchurl {
    url = "https://github.com/silnrsi/graphite/releases/download/"
-      + "${version}/graphite-${version}.tgz";
-    sha256 = "0xdg6bc02bl8yz39l5i2skczfg17q4lif0qqan0dhvk0mibpcpj7";
+      + "${version}/graphite2-${version}.tgz";
+    sha256 = "01jzhwnj1c3d68dmw15jdxly0hwkmd8ja4kw755rbkykn1ly2qyx";
  };

  nativeBuildInputs = [ pkgconfig cmake ];
--- a/pkgs/development/python-modules/Cython/default.nix
+++ b/pkgs/development/python-modules/Cython/default.nix
@ -2,6 +2,7 @@
 , stdenv
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , python
 , glibcLocales
 , pkgconfig
@ -41,6 +42,15 @@ in buildPythonPackage rec {
  buildInputs = [ glibcLocales gdb ];
  LC_ALL = "en_US.UTF-8";

+  patches = [
+    # https://github.com/cython/cython/issues/2752, needed by sage (https://trac.sagemath.org/ticket/26855) and up to be included in 0.30
+    (fetchpatch {
+      name = "non-int-conversion-to-pyhash.patch";
+      url = "https://github.com/cython/cython/commit/28251032f86c266065e4976080230481b1a1bb29.patch";
+      sha256 = "19rg7xs8gr90k3ya5c634bs8gww1sxyhdavv07cyd2k71afr83gy";
+    })
+  ];
+
  checkPhase = ''
    export HOME="$NIX_BUILD_TOP"
    ${python.interpreter} runtests.py -j$NIX_BUILD_CORES \
--- a/pkgs/development/python-modules/gunicorn/default.nix
+++ b/pkgs/development/python-modules/gunicorn/default.nix
@ -1,5 +1,10 @@
 { stdenv, buildPythonPackage, fetchPypi
-, pytest, mock, pytestcov, coverage }:
+, coverage
+, mock
+, pytest
+, pytestcov
+, setuptools
+}:

 buildPythonPackage rec {
  pname = "gunicorn";
@ -10,6 +15,8 @@ buildPythonPackage rec {
    sha256 = "fa2662097c66f920f53f70621c6c58ca4a3c4d3434205e608e121b5b3b71f4f3";
  };

+  propagatedBuildInputs = [ setuptools ];
+
  checkInputs = [ pytest mock pytestcov coverage ];

  prePatch = ''
@ -17,9 +24,12 @@ buildPythonPackage rec {
      --replace "coverage>=4.0,<4.4" "coverage"
  '';

-  # Test failures but patch does not apply cleanly
-  # https://github.com/benoitc/gunicorn/commit/f38f717539b1b7296720805b8ae3969c3509b9c1
-  doCheck = false;
+  # better than no tests
+  checkPhase = ''
+    $out/bin/gunicorn --help > /dev/null
+  '';
+
+  pythonImportsCheck = [ "gunicorn" ];

  meta = with stdenv.lib; {
    homepage = https://pypi.python.org/pypi/gunicorn;
--- a/pkgs/development/tools/build-managers/cmake/default.nix
+++ b/pkgs/development/tools/build-managers/cmake/default.nix
@ -19,12 +19,12 @@ stdenv.mkDerivation rec {
          + lib.optionalString useNcurses "-cursesUI"
          + lib.optionalString withQt5 "-qt5UI"
          + lib.optionalString useQt4 "-qt4UI";
-  version = "3.15.4";
+  version = "3.15.5";

  src = fetchurl {
    url = "${meta.homepage}files/v${lib.versions.majorMinor version}/cmake-${version}.tar.gz";
    # compare with https://cmake.org/files/v${lib.versions.majorMinor version}/cmake-${version}-SHA-256.txt
-    sha256 = "0ypd051rh3nxhjfb5wcmnxi78p1d1qbzrhazn94lwdr1xa4ia8ca";
+    sha256 = "1d5y8d92axcc6rfqlsxamayfs3fc1vdby91hn5mx1kn02ppprpgv";
  };

  patches = [
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@ -17,7 +17,7 @@ let
  # is now upstream.
  # https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;a=commitdiff;h=330b90b5ffbbc20c5de6ae6c7f60c40fab2e7a4f;hp=99181ccac0fc7d82e7dabb05dc7466e91f1645d3
  version = "2.31.1";
-  basename = "binutils-${version}";
+  basename = "binutils";
  # The targetPrefix prepended to binary names to allow multiple binuntils on the
  # PATH to both be usable.
  targetPrefix = lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform)
@ -30,13 +30,14 @@ let
  };
  # HACK to ensure that we preserve source from bootstrap binutils to not rebuild LLVM
  normal-src = stdenv.__bootPackages.binutils-unwrapped.src or (fetchurl {
-    url = "mirror://gnu/binutils/${basename}.tar.bz2";
+    url = "mirror://gnu/binutils/${basename}-${version}.tar.bz2";
    sha256 = "1l34hn1zkmhr1wcrgf0d4z7r3najxnw3cx2y2fk7v55zjlk3ik7z";
  });
 in

 stdenv.mkDerivation {
-  name = targetPrefix + basename;
+  pname = targetPrefix + basename;
+  inherit version;

  src = if stdenv.targetPlatform.isVc4 then vc4-binutils-src else normal-src;

@ -143,7 +144,7 @@ stdenv.mkDerivation {
  enableParallelBuilding = true;

  passthru = {
-    inherit targetPrefix version;
+    inherit targetPrefix;
  };

  meta = with lib; {
--- a/pkgs/development/tools/misc/gdb/default.nix
+++ b/pkgs/development/tools/misc/gdb/default.nix
@ -1,4 +1,4 @@
-{ stdenv
+{ stdenv, targetPackages

 # Build time
 , fetchurl, pkgconfig, perl, texinfo, setupDebugInfoDirs, buildPackages
@ -8,7 +8,12 @@

 , pythonSupport ? stdenv.hostPlatform == stdenv.buildPlatform && !stdenv.hostPlatform.isCygwin, python3 ? null
 , guile ? null
-
+, safePaths ? [
+   # $debugdir:$datadir/auto-load are whitelisted by default by GDB
+   "$debugdir" "$datadir/auto-load"
+   # targetPackages so we get the right libc when cross-compiling and using buildPackages.gdb
+   targetPackages.stdenv.cc.cc.lib
+  ]
 }:

 let
@ -70,6 +75,7 @@ stdenv.mkDerivation rec {
    "--with-gmp=${gmp.dev}"
    "--with-mpfr=${mpfr.dev}"
    "--with-expat" "--with-libexpat-prefix=${expat.dev}"
+    "--with-auto-load-safe-path=${builtins.concatStringsSep ":" safePaths}"
  ] ++ stdenv.lib.optional (!pythonSupport) "--without-python";

  postInstall =
--- a/pkgs/os-specific/darwin/apple-sdk/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk/default.nix
@ -12,8 +12,8 @@ let
    #  3. ???
    #  4. Profit
    src = fetchurl {
-      url    = "http://swcdn.apple.com/content/downloads/28/09/091-29862/pafhn2u002b9slnrxzy9p86rpedycnjhb5/DevSDK_OSX1012.pkg";
-      sha256 = "1sggc70rypqwcjwr7ciavw8sczwll16cwqxdxrbw7r2qvy3b0nhx";
+      url    = "http://swcdn.apple.com/content/downloads/33/36/041-90419-A_7JJ4H9ZHO2/xs88ob5wjz6riz7g6764twblnvksusg4ps/DevSDK_OSX1012.pkg";
+      sha256 = "13xq34sb7383b37hwy076gnhf96prpk1b4087p87xnwswxbrisih";
    };

    buildInputs = [ xar cpio python pbzx ];
--- a/pkgs/os-specific/darwin/binutils/default.nix
+++ b/pkgs/os-specific/darwin/binutils/default.nix
@ -14,7 +14,8 @@ in

 # TODO: loop over targetPrefixed binaries too
 stdenv.mkDerivation {
-  name = "${targetPrefix}cctools-binutils-darwin";
+  pname = "${targetPrefix}cctools-binutils-darwin";
+  inherit (cctools) version;
  outputs = [ "out" "info" "man" ];
  buildCommand = ''
    mkdir -p $out/bin $out/include
--- a/pkgs/os-specific/darwin/cctools/apfs.patch
+++ b/pkgs/os-specific/darwin/cctools/apfs.patch
@ -1,22 +0,0 @@
-diff --git a/cctools/ld64/src/ld/OutputFile.cpp b/cctools/ld64/src/ld/OutputFile.cpp
-index 8859882..158c7d2 100644
--- a/cctools/ld64/src/ld/OutputFile.cpp
-+++ b/cctools/ld64/src/ld/OutputFile.cpp
-@@ -2786,7 +2786,7 @@ void OutputFile::writeOutputFile(ld::Internal& state)
- #ifdef __APPLE__ // ld64-port
- 			struct statfs fsInfo;
- 			if ( statfs(_options.outputFilePath(), &fsInfo) != -1 ) {
-				if ( strcmp(fsInfo.f_fstypename, "hfs") == 0) {
-+				if ( (strcmp(fsInfo.f_fstypename, "hfs") == 0) || (strcmp(fsInfo.f_fstypename, "apfs") == 0) ) {
- 					(void)unlink(_options.outputFilePath());
- 					outputIsMappableFile = true;
- 				}
-@@ -2814,7 +2814,7 @@ void OutputFile::writeOutputFile(ld::Internal& state)
- #ifdef __APPLE__ // ld64-port
- 			struct statfs fsInfo;
- 			if ( statfs(dirPath, &fsInfo) != -1 ) {
-				if ( strcmp(fsInfo.f_fstypename, "hfs") == 0) {
-+				if ( (strcmp(fsInfo.f_fstypename, "hfs") == 0) || (strcmp(fsInfo.f_fstypename, "apfs") == 0) ) {
- 					outputIsMappableFile = true;
- 				}
- 			}
--- a/pkgs/os-specific/darwin/cctools/ld-rpath-nonfinal.patch
+++ b/pkgs/os-specific/darwin/cctools/ld-rpath-nonfinal.patch
@ -1,13 +1,14 @@
 diff --git a/cctools/ld64/src/ld/Options.cpp b/cctools/ld64/src/ld/Options.cpp
-index 9250016..91d54ec 100644
+index e4b37ec..4189ebc 100644
 --- a/cctools/ld64/src/ld/Options.cpp
 +++ b/cctools/ld64/src/ld/Options.cpp
-@@ -4175,23 +4175,9 @@ void Options::checkIllegalOptionCombinations()
+@@ -5800,24 +5800,6 @@ void Options::checkIllegalOptionCombinations()
+ 	if ( fDeadStrip && (fOutputKind == Options::kObjectFile) )
 		throw "-r and -dead_strip cannot be used together";
 
- 	// can't use -rpath unless targeting 10.5 or later
+-	// can't use -rpath unless targeting 10.5 or later
 -	if ( fRPaths.size() > 0 ) {
-		if ( !minOS(ld::mac10_5, ld::iOS_2_0) )
+-		if ( !platforms().minOS(ld::version2008) )
 -			throw "-rpath can only be used when targeting Mac OS X 10.5 or later";
 -		switch ( fOutputKind ) {
 -			case Options::kDynamicExecutable:
@ -23,9 +24,6 @@ index 9250016..91d54ec 100644
 -		}
 -	}
 -	
-+	if ( fRPaths.size() > 0 && !minOS(ld::mac10_5, ld::iOS_2_0) )
-+		throw "-rpath can only be used when targeting Mac OS X 10.5 or later";
-+
 	if ( fPositionIndependentExecutable ) {
 		switch ( fOutputKind ) {
 			case Options::kDynamicExecutable:
--- a/pkgs/os-specific/darwin/cctools/port.nix
+++ b/pkgs/os-specific/darwin/cctools/port.nix
@ -18,14 +18,14 @@ assert (!stdenv.hostPlatform.isDarwin) -> maloader != null;

 let
  baseParams = rec {
-    name = "${targetPrefix}cctools-port-${version}";
-    version = "895";
+    name = "${targetPrefix}cctools-port";
+    version = "927.0.2";

    src = fetchFromGitHub {
      owner  = "tpoechtrager";
      repo   = "cctools-port";
-      rev    = "07619027f8311fa61b4a549c75994b88739a82d8";
-      sha256 = "12g94hhz5v5bmy2w0zb6fb4bjlmn992gygc60h9nai15kshj2spi";
+      rev    = "8239a5211bcf07d6b9d359782e1a889ec1d7cce5";
+      sha256 = "0h8b1my0wf1jyjq63wbiqkl2clgxsf87f6i4fjhqs431fzlq8sac";
    };

    outputs = [ "out" "dev" ];
@ -35,7 +35,7 @@ let
      ++ stdenv.lib.optionals stdenv.isDarwin [ libcxxabi libobjc ]
      ++ stdenv.lib.optional enableTapiSupport libtapi;

-    patches = [ ./ld-rpath-nonfinal.patch ./ld-ignore-rpath-link.patch ./apfs.patch ];
+    patches = [ ./ld-ignore-rpath-link.patch ./ld-rpath-nonfinal.patch ];

    __propagatedImpureHostDeps = [
      # As far as I can tell, otool from cctools is the only thing that depends on these two, and we should fix them
@ -84,12 +84,6 @@ let
      cd cctools
    '';

-    # TODO: this builds an ld without support for LLVM's LTO. We need to teach it, but that's rather
-    # hairy to handle during bootstrap. Perhaps it could be optional?
-    preConfigure = ''
-      sh autogen.sh
-    '';
-
    preInstall = ''
      pushd include
      make DSTROOT=$out/include RC_OS=common install
--- a/pkgs/os-specific/darwin/libtapi/default.nix
+++ b/pkgs/os-specific/darwin/libtapi/default.nix
@ -1,18 +1,19 @@
-{ lib, stdenv, fetchFromGitHub, cmake, python }:
+{ lib, stdenv, fetchFromGitHub, cmake, python, clang_6 }:

 stdenv.mkDerivation {
-  name = "libtapi";
+  name = "libtapi-1000.10.8";
  src = fetchFromGitHub {
    owner = "tpoechtrager";
    repo = "apple-libtapi";
-    rev = "e56673694db395e25b31808b4fbb9a7005e6875f";
-    sha256 = "1lnl1af9sszp9wxfk0wljrpdmwcx83j0w5c0y4qw4pqrdkdgwks7";
+    rev = "cd9885b97fdff92cc41e886bba4a404c42fdf71b";
+    sha256 = "1a19h39a48agvnmal99n9j1fjadiqwib7hfzmn342wmgh9z3vk0g";
  };

  nativeBuildInputs = [ cmake python ];
+  buildInputs = [ clang_6.cc ];

  preConfigure = ''
-    cd src/apple-llvm/src
+    cd src/llvm
  '';

  cmakeFlags = [ "-DLLVM_INCLUDE_TESTS=OFF" ];
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "iproute2";
-  version = "5.3.0";
+  version = "5.4.0";

  src = fetchurl {
    url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0gvv269wjn4279hxr5zzwsk2c5qgswr47za3hm1x4frsk52iw76b";
+    sha256 = "1bl6c3af7wbgi6nqjfm32fkhqh63iphkg2g11f1srifll1ham5zy";
  };

  preConfigure = ''
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@ -30,7 +30,7 @@ let gnupg-minimal = gnupg.override {
  bzip2 = null;
 };
 in stdenv.mkDerivation {
-  version = "243";
+  version = "243.3";
  pname = "systemd";

  # When updating, use https://github.com/systemd/systemd-stable tree, not the development one!
@ -38,8 +38,8 @@ in stdenv.mkDerivation {
  src = fetchFromGitHub {
    owner = "NixOS";
    repo = "systemd";
-    rev = "d25cf413c6bff1b5a9d216a8830e3a90c9cad1de";
-    sha256 = "0ilvrnh3m7g0yflxl16fk52gkb1z0fwwk9ba5gs4005nzpl0c7i0";
+    rev = "491a247eff9b7ce1e5877f5f3431517c95f3222f";
+    sha256 = "1xqiahapg480m165glrwqbfmc1fxw5sacdlm933cwyi1q8x4537g";
  };

  outputs = [ "out" "lib" "man" "dev" ];
--- a/pkgs/tools/graphics/dcraw/default.nix
+++ b/pkgs/tools/graphics/dcraw/default.nix
@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
  name = "dcraw-9.28.0";

  src = fetchurl {
-    url = "https://www.cybercom.net/~dcoffin/dcraw/archive/${name}.tar.gz";
+    url = "https://www.dechifro.org/dcraw/archive/${name}.tar.gz";
    sha256 = "1fdl3xa1fbm71xzc3760rsjkvf0x5jdjrvdzyg2l9ka24vdc7418";
  };

@ -23,10 +23,17 @@ stdenv.mkDerivation rec {
  '';

  meta = {
-    homepage = http://www.cybercom.net/~dcoffin/dcraw/;
+    homepage = https://www.dechifro.org/dcraw/;
    description = "Decoder for many camera raw picture formats";
    license = stdenv.lib.licenses.free;
    platforms = stdenv.lib.platforms.unix; # Once had cygwin problems
    maintainers = [ ];
+    knownVulnerabilities = [
+      "CVE-2018-19655"
+      "CVE-2018-19565"
+      "CVE-2018-19566"
+      "CVE-2018-19567"
+      "CVE-2018-19568"
+    ];
  };
 }
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "unbound";
-  version = "1.9.4";
+  version = "1.9.5";

  src = fetchurl {
    url = "https://unbound.net/downloads/${pname}-${version}.tar.gz";
-    sha256 = "1c2bjm13x8bkw0ds1mhn9ivd2gzmfrb0x5y76bkz09a04bxjagix";
+    sha256 = "0myv8l886gmlh9nh4j3q5549idxnl51hf9cw20yxfqbwd47l13ca";
  };

  # https://github.com/NLnetLabs/unbound/pull/90
--- a/pkgs/tools/security/gnupg/22.nix
+++ b/pkgs/tools/security/gnupg/22.nix
@ -16,11 +16,11 @@ assert guiSupport -> pinentry != null && enableMinimal == false;
 stdenv.mkDerivation rec {
  pname = "gnupg";

-  version = "2.2.17";
+  version = "2.2.18";

  src = fetchurl {
    url = "mirror://gnupg/gnupg/${pname}-${version}.tar.bz2";
-    sha256 = "056mgy09lvsi03531a437qj58la1j2x1y1scvfi53diris3658mg";
+    sha256 = "02pcdmb9p4a8hil88gyd86mnc85jldss3cl02jvbkcjmrbi7rlrh";
  };

  depsBuildBuild = [ buildPackages.stdenv.cc ];
--- a/pkgs/tools/security/pcsclite/default.nix
+++ b/pkgs/tools/security/pcsclite/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, udev, dbus, perl, python2
+{ stdenv, fetchurl, pkgconfig, udev, dbus, perl, python3
 , IOKit ? null }:

 stdenv.mkDerivation rec {
@ -35,8 +35,8 @@ stdenv.mkDerivation rec {
    moveToOutput bin/pcsc-spy "$dev"
  '';

-  nativeBuildInputs = [ pkgconfig perl python2 ];
-  buildInputs = stdenv.lib.optionals stdenv.isLinux [ udev dbus ]
+  nativeBuildInputs = [ pkgconfig perl ];
+  buildInputs = [ python3 ] ++ stdenv.lib.optionals stdenv.isLinux [ udev dbus ]
             ++ stdenv.lib.optionals stdenv.isDarwin [ IOKit ];

  meta = with stdenv.lib; {
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@ -87,11 +87,11 @@ let

  ack = buildPerlPackage {
    pname = "ack";
-    version = "3.1.3";
+    version = "3.2.0";

    src = fetchurl {
-      url = mirror://cpan/authors/id/P/PE/PETDANCE/ack-v3.1.3.tar.gz;
-      sha256 = "0bxsrs6lv98sjdww5q6bcsm2qk4w6l5falpzjijvj1i2if123gb1";
+      url = mirror://cpan/authors/id/P/PE/PETDANCE/ack-v3.2.0.tar.gz;
+      sha256 = "00yvhkr974akdlhiyxkcz4rmfjyhvpikxf6k49b6q6iwa5a0j1ss";
    };

    outputs = ["out" "man"];
@ -158,10 +158,10 @@ let

  AlienBuild = buildPerlPackage {
    pname = "Alien-Build";
-    version = "1.89";
+    version = "1.92";
    src = fetchurl {
-      url = mirror://cpan/authors/id/P/PL/PLICEASE/Alien-Build-1.89.tar.gz;
-      sha256 = "1jr740v95hdhjxkj5kcpwb022y6iqzmsax50fa69qbiwnjjnzqzz";
+      url = mirror://cpan/authors/id/P/PL/PLICEASE/Alien-Build-1.92.tar.gz;
+      sha256 = "0y8a0ircxc93qqic1i76sspbcr4pdjg6j8ha4zbvv279f8x1g5fd";
    };
    propagatedBuildInputs = [ CaptureTiny FFICheckLib FileWhich Filechdir PathTiny PkgConfig ];
    buildInputs = [ DevelHide Test2Suite ];
@ -221,7 +221,7 @@ let
    installPhase = "./Build install --prefix $out";

    SDL_INST_DIR = pkgs.SDL.dev;
-    buildInputs = [ ArchiveExtract ArchiveZip TextPatch pkgs.SDL ];
+    buildInputs = [ pkgs.SDL ArchiveExtract ArchiveZip TextPatch ];
    propagatedBuildInputs = [ CaptureTiny FileShareDir FileWhich ];

    meta = {
@ -347,10 +347,10 @@ let

  ApacheAuthCookie = buildPerlPackage {
    pname = "Apache-AuthCookie";
-    version = "3.27";
+    version = "3.28";
    src = fetchurl {
-      url = mirror://cpan/authors/id/M/MS/MSCHOUT/Apache-AuthCookie-3.27.tar.gz;
-      sha256 = "58daeb3e44c681ff88f8fb00e4aabaa7a40cbee73dbdb84fcf6c285b15d357bd";
+      url = mirror://cpan/authors/id/M/MS/MSCHOUT/Apache-AuthCookie-3.28.tar.gz;
+      sha256 = "bcd795a7f654a94ae0a6bd734ba4d8ba1085371fca486229dba49f1c2d62142b";
    };
    buildInputs = [ ApacheTest ];
    propagatedBuildInputs = [ ClassLoad HTTPBody HashMultiValue WWWFormUrlEncoded ];
@ -368,10 +368,10 @@ let

  ApacheLogFormatCompiler = buildPerlModule {
    pname = "Apache-LogFormat-Compiler";
-    version = "0.35";
+    version = "0.36";
    src = fetchurl {
-      url = mirror://cpan/authors/id/K/KA/KAZEBURO/Apache-LogFormat-Compiler-0.35.tar.gz;
-      sha256 = "06i70ydxk2wa2rcqn16842kra2qz3jwk0vk1abq8lah4180c0m0n";
+      url = mirror://cpan/authors/id/K/KA/KAZEBURO/Apache-LogFormat-Compiler-0.36.tar.gz;
+      sha256 = "05xcl7j65vakx7x79jqjikyw0nzf60bc2w6hhc0q5sklxq1ral4l";
    };
    buildInputs = [ HTTPMessage ModuleBuildTiny TestMockTime TestRequires TryTiny URI ];
    propagatedBuildInputs = [ POSIXstrftimeCompiler ];
@ -507,10 +507,10 @@ let

  Appperlbrew = buildPerlModule {
    pname = "App-perlbrew";
-    version = "0.86";
+    version = "0.87";
    src = fetchurl {
-      url = mirror://cpan/authors/id/G/GU/GUGOD/App-perlbrew-0.86.tar.gz;
-      sha256 = "11qh94am7fghizmjaf5c7w868svjbv9g4ffirykj8qa6q40zdspp";
+      url = mirror://cpan/authors/id/G/GU/GUGOD/App-perlbrew-0.87.tar.gz;
+      sha256 = "0zcczp1dq116ym05yhjpmzv5qmkwfd9lzcwiy51i8ii13qq5hja7";
    };
    buildInputs = [ pkgs.curl FileWhich IOAll ModuleBuildTiny PathClass TestException TestNoWarnings TestOutput TestSpec TestTempDirTiny ];
    propagatedBuildInputs = [ CPANPerlReleases CaptureTiny DevelPatchPerl locallib ];
@ -1183,7 +1183,7 @@ let
      sha256 = "0z4lnc3jfqx8rykm998q2jy5wkhb8p5pir80g9lqpi4lb0ilic6c";
    };
    propagatedBuildInputs = [ Furl URI ];
-    buildInputs = [ FileWhich TestTCP TestRequires TestSharedFork ];
+    buildInputs = [ FileWhich TestRequires TestSharedFork TestTCP ];
    meta = {
      description = "KyotoTycoon client library";
      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
@ -2769,10 +2769,10 @@ let

  CompressRawBzip2 = buildPerlPackage {
    pname = "Compress-Raw-Bzip2";
-    version = "2.087";
+    version = "2.090";
    src = fetchurl {
-      url = mirror://cpan/authors/id/P/PM/PMQS/Compress-Raw-Bzip2-2.087.tar.gz;
-      sha256 = "1yqcy26dlcgy5gkl6rvvj60f83kgd99y8qylynibjx84vbyhvfvp";
+      url = mirror://cpan/authors/id/P/PM/PMQS/Compress-Raw-Bzip2-2.090.tar.gz;
+      sha256 = "0yi972il6i0ya65qar0767mm3sb2wbsrllsgx6296s5myh2838p6";
    };

    # Don't build a private copy of bzip2.
@ -2788,11 +2788,11 @@ let

  CompressRawZlib = buildPerlPackage {
    pname = "Compress-Raw-Zlib";
-    version = "2.087";
+    version = "2.090";

    src = fetchurl {
-      url = mirror://cpan/authors/id/P/PM/PMQS/Compress-Raw-Zlib-2.087.tar.gz;
-      sha256 = "13gfbfhaw1iiz2vmgpjggrcd704czqx3jk5alw765cw6wghwk0cc";
+      url = mirror://cpan/authors/id/P/PM/PMQS/Compress-Raw-Zlib-2.090.tar.gz;
+      sha256 = "0ndgkv7z4zi3ffail9abp02x62dx1j3pnxn3rjw91py7pjd4kj7j";
    };

    preConfigure = ''
@ -3049,10 +3049,10 @@ let

  Connector = buildPerlPackage {
    pname = "Connector";
-    version = "1.27";
+    version = "1.28";
    src = fetchurl {
-      url = mirror://cpan/authors/id/M/MR/MRSCOTTY/Connector-1.27.tar.gz;
-      sha256 = "98ff4700fde2b7872d89566a3308d03c2899c88cb6317af901869513bdbfb603";
+      url = mirror://cpan/authors/id/M/MR/MRSCOTTY/Connector-1.28.tar.gz;
+      sha256 = "0cd1575bab80e78294aa79809904f40d2f534d99b78e0161454f037625c6bf7d";
    };
    buildInputs = [ ConfigMerge ConfigStd ConfigVersioned DBDSQLite DBI ProcSafeExec TemplateToolkit YAML ];
    propagatedBuildInputs = [ LogLog4perl Moose ];
@ -3234,10 +3234,10 @@ let

  CpanelJSONXS = buildPerlPackage {
    pname = "Cpanel-JSON-XS";
-    version = "4.14";
+    version = "4.17";
    src = fetchurl {
-      url = mirror://cpan/authors/id/R/RU/RURBAN/Cpanel-JSON-XS-4.14.tar.gz;
-      sha256 = "6e63bf65cd7e94f08fb8ae7ccd6f94fb3447852865882bba9aaa155c9eea5938";
+      url = mirror://cpan/authors/id/R/RU/RURBAN/Cpanel-JSON-XS-4.17.tar.gz;
+      sha256 = "fa80ae47caa9beee6db9b12df2c04482e98df1d62041a114ccd82b681a8706fb";
    };
    meta = {
      description = "CPanel fork of JSON::XS, fast and correct serializing";
@ -3316,10 +3316,10 @@ let

  CPANPerlReleases = buildPerlPackage {
    pname = "CPAN-Perl-Releases";
-    version = "4.14";
+    version = "4.22";
    src = fetchurl {
-      url = mirror://cpan/authors/id/B/BI/BINGOS/CPAN-Perl-Releases-4.14.tar.gz;
-      sha256 = "0ki6bc0wdc047nyx2j4byk8nsrnm18vn0nr1s1x9wh3xi0wasn7r";
+      url = mirror://cpan/authors/id/B/BI/BINGOS/CPAN-Perl-Releases-4.22.tar.gz;
+      sha256 = "1gwa1jzcv08fjg282jxakh24zni6ajgwhgraz6hjxk1j2hiaykjd";
    };
    meta = {
      homepage = https://github.com/bingos/cpan-perl-releases;
@ -3776,10 +3776,10 @@ let

  CryptX = buildPerlPackage {
    pname = "CryptX";
-    version = "0.064";
+    version = "0.066";
    src = fetchurl {
-      url = mirror://cpan/authors/id/M/MI/MIK/CryptX-0.064.tar.gz;
-      sha256 = "176ef4d2eac80731b360db04289431f0b96acc2568a1fec856abed4a51779a47";
+      url = mirror://cpan/authors/id/M/MI/MIK/CryptX-0.066.tar.gz;
+      sha256 = "e7e823ac4db0b452e885b0e0d5adfc8a9c5f688938f1adf3f1d91432b3238335";
    };
    meta = {
      description = "Crypto toolkit";
@ -3817,12 +3817,12 @@ let

  DataCompare = buildPerlPackage {
    pname = "Data-Compare";
-    version = "1.26";
+    version = "1.27";
    src = fetchurl {
-      url = mirror://cpan/authors/id/D/DC/DCANTRELL/Data-Compare-1.26.tar.gz;
-      sha256 = "03g0z2w8hz7750x6wkl6zq7shk12fry44gkzrz7b904s5fmphl4p";
+      url = mirror://cpan/authors/id/D/DC/DCANTRELL/Data-Compare-1.27.tar.gz;
+      sha256 = "1gg8rqbv3x6a1lrpabv6vnlab53zxmpwz2ygad9fcx4gygqj12l1";
    };
-    propagatedBuildInputs = [ FileFindRule ];
+    propagatedBuildInputs = [ Clone FileFindRule ];
  };

  DataDump = buildPerlPackage {
@ -4362,10 +4362,10 @@ let

  DateTimeCalendarJulian = buildPerlPackage {
    pname = "DateTime-Calendar-Julian";
-    version = "0.101";
+    version = "0.102";
    src = fetchurl {
-      url = mirror://cpan/authors/id/W/WY/WYANT/DateTime-Calendar-Julian-0.101.tar.gz;
-      sha256 = "1q7zflwv44yybyz5nd01bc69zw5m540qg4fnh4xlj2icbm3sf7br";
+      url = mirror://cpan/authors/id/W/WY/WYANT/DateTime-Calendar-Julian-0.102.tar.gz;
+      sha256 = "0j95dhma66spjyb04zi6rwy7l33hibnrx02mn0znd9m89aiq52s6";
    };
    meta = {
      description = "Dates in the Julian calendar";
@ -4615,10 +4615,10 @@ let

  DateTimeTimeZone = buildPerlPackage {
    pname = "DateTime-TimeZone";
-    version = "2.37";
+    version = "2.38";
    src = fetchurl {
-      url = mirror://cpan/authors/id/D/DR/DROLSKY/DateTime-TimeZone-2.37.tar.gz;
-      sha256 = "6c12dfa6ad190191d437a7661c644fc38aaf109001e1d958c95dbb0aa143c421";
+      url = mirror://cpan/authors/id/D/DR/DROLSKY/DateTime-TimeZone-2.38.tar.gz;
+      sha256 = "0e5c99ef22471f4d262ac590ce5ce8177094d7a92f380d8eea6219f5a12dc0cd";
    };
    buildInputs = [ TestFatal TestRequires ];
    propagatedBuildInputs = [ ClassSingleton ParamsValidationCompiler Specio namespaceautoclean ];
@ -4703,12 +4703,12 @@ let

  DevelChecklib = buildPerlPackage {
    pname = "Devel-CheckLib";
-    version = "1.13";
+    version = "1.14";
    src = fetchurl {
-      url = mirror://cpan/authors/id/M/MA/MATTN/Devel-CheckLib-1.13.tar.gz;
-      sha256 = "1a19qkwxwz3wqb16cdabymfbf9kiydiifw90nd5srpq5hy8gvb94";
+      url = mirror://cpan/authors/id/M/MA/MATTN/Devel-CheckLib-1.14.tar.gz;
+      sha256 = "15621qh5gaan1sgmk9y9svl70nm8viw17x5h1kf0zknkk8lmw77j";
    };
-    buildInputs = [ IOCaptureOutput MockConfig ];
+    buildInputs = [ CaptureTiny MockConfig ];
  };

  DevelCheckOS = buildPerlPackage {
@ -4723,10 +4723,10 @@ let

  DevelPatchPerl = buildPerlPackage {
    pname = "Devel-PatchPerl";
-    version = "1.64";
+    version = "1.80";
    src = fetchurl {
-      url = mirror://cpan/authors/id/B/BI/BINGOS/Devel-PatchPerl-1.64.tar.gz;
-      sha256 = "16fl04m0b9jccq30h7myaj6hsv4ivx53i3q5klq0d0q6w0k5sb4v";
+      url = mirror://cpan/authors/id/B/BI/BINGOS/Devel-PatchPerl-1.80.tar.gz;
+      sha256 = "0nffiyfa1dx1ypg2chckpzh7syx47z10rxg6fjf4sb5d1gryxmmf";
    };
    propagatedBuildInputs = [ Filepushd ModulePluggable ];
    meta = {
@ -4752,10 +4752,10 @@ let

  DevelPPPort = buildPerlPackage {
    pname = "Devel-PPPort";
-    version = "3.54";
+    version = "3.55";
    src = fetchurl {
-      url = mirror://cpan/authors/id/A/AT/ATOOMIC/Devel-PPPort-3.54.tar.gz;
-      sha256 = "f30fbbef7bdd6fb12348caf39e795c19c1639b8156e2e2f2927205140e35b0a9";
+      url = mirror://cpan/authors/id/A/AT/ATOOMIC/Devel-PPPort-3.55.tar.gz;
+      sha256 = "bac0421ed1ba02f118f2bc1b1a760616847a0c60cb0184651f3f076f46d0946e";
    };
    meta = {
      description = "Perl/Pollution/Portability";
@ -4811,10 +4811,10 @@ let

  DBDMock = buildPerlModule {
    pname = "DBD-Mock";
-    version = "1.49";
+    version = "1.52";
    src = fetchurl {
-      url = mirror://cpan/authors/id/J/JL/JLCOOPER/DBD-Mock-1.49.tar.gz;
-      sha256 = "3c88bd9322d3d1a215b0c8dad8b27f06885a063f8f47fb8747f6e86f8b9d7116";
+      url = mirror://cpan/authors/id/J/JL/JLCOOPER/DBD-Mock-1.52.tar.gz;
+      sha256 = "c33ac1118ff4e6a542e62e0fc56d9c0d4abecc442c7acb59c0975fc376812442";
    };
    propagatedBuildInputs = [ DBI ];
    buildInputs = [ ModuleBuildTiny TestException ];
@ -5026,7 +5026,7 @@ let
      sha256 = "d705f85825aced299020534349778537524526d64f524217ca362787f683c3bd";
    };
    buildInputs = [ DBDSQLite TestDeep TestException TestWarn ];
-    propagatedBuildInputs = [ ClassAccessorGrouped ClassC3Componentised ConfigAny ContextPreserve DBI DataDumperConcise DataPage ModuleFind PathClass SQLAbstract ScopeGuard SubName namespaceclean ];
+    propagatedBuildInputs = [ ClassAccessorGrouped ClassC3Componentised ConfigAny ContextPreserve DBI DataDumperConcise DataPage DevelGlobalDestruction ModuleFind PathClass SQLAbstract ScopeGuard SubName namespaceclean ];
    meta = {
      homepage = https://metacpan.org/pod/DBIx::Class;
      description = "Extensible and flexible object <-> relational mapper";
@ -5094,10 +5094,10 @@ let

  DBIxClassHelpers = buildPerlPackage {
    pname = "DBIx-Class-Helpers";
-    version = "2.034000";
+    version = "2.034001";
    src = fetchurl {
-      url = mirror://cpan/authors/id/F/FR/FREW/DBIx-Class-Helpers-2.034000.tar.gz;
-      sha256 = "bf92b5495fddd50daa15126e015d5d210a44b6bb43baa8859b5adaa57cd96c59";
+      url = mirror://cpan/authors/id/F/FR/FREW/DBIx-Class-Helpers-2.034001.tar.gz;
+      sha256 = "5bdbe716a32eec30d12fd743169a8d99b7358eaef8b153224ca61aa543c283c9";
    };
    buildInputs = [ DBDSQLite DateTimeFormatSQLite TestDeep TestFatal TestRoo aliased ];
    propagatedBuildInputs = [ CarpClan DBIxClassCandy DBIxIntrospector SafeIsa TextBrew ];
@ -6270,6 +6270,20 @@ let
    };
  };

+  EnvSanctify = buildPerlPackage {
+    pname = "Env-Sanctify";
+    version = "1.12";
+    src = fetchurl {
+      url = mirror://cpan/authors/id/B/BI/BINGOS/Env-Sanctify-1.12.tar.gz;
+      sha256 = "0prj51c9w4k6nrpnpfw6an96953vna74g698kyk78m163ikbbqr0";
+    };
+    meta = {
+      description = "Lexically scoped sanctification of %ENV";
+      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
+      homepage = "https://github.com/bingos/env-sanctify";
+    };
+  };
+
  Error = buildPerlModule {
    pname = "Error";
    version = "0.17028";
@ -6281,10 +6295,10 @@ let

  EV = buildPerlPackage {
    pname = "EV";
-    version = "4.27";
+    version = "4.29";
    src = fetchurl {
-      url = mirror://cpan/authors/id/M/ML/MLEHMANN/EV-4.27.tar.gz;
-      sha256 = "55750e5422d8cac7a2d0c89feeaca7d840ab2268f4c537655cdda0085e0d0cbc";
+      url = mirror://cpan/authors/id/M/ML/MLEHMANN/EV-4.29.tar.gz;
+      sha256 = "cbed1824ac9ef0740325140393216be55a6eb8f16a5996395fab243ee28da78e";
    };
    buildInputs = [ CanaryStability ];
    propagatedBuildInputs = [ commonsense ];
@ -7451,8 +7465,8 @@ let
      url = "mirror://cpan/authors/id/T/TO/TOKUHIROM/Furl-3.13.tar.gz";
      sha256 = "1wxa2v9yjzvnzp62p1jvcx8x61z5qvlvzyah853vvaywpjxwyyl8";
    };
-    propagatedBuildInputs = [ HTTPParserXS ModuleBuildTiny ClassAccessorLite ];
-    buildInputs = [ HTTPBody HTTPProxy NetIDNEncode Plack PlackMiddlewareDeflater Starlet TestRequires TestTCP TestSharedFork ];
+    propagatedBuildInputs = [ ClassAccessorLite HTTPParserXS MozillaCA ];
+    buildInputs = [ HTTPCookieJar HTTPProxy ModuleBuildTiny Plack Starlet TestFakeHTTPD TestRequires TestSharedFork TestTCP TestValgrind URI ];
    meta = {
      description = "Lightning-fast URL fetcher";
      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
@ -7763,6 +7777,7 @@ let
      sha256 = "af53f2d3f63297e046676eae14a76296afdd2910e09723b6b113708622b7989b";
    };
    buildInputs = [ pkgs.gnupg1orig ];
+    doCheck = !stdenv.isAarch64;
  };

  GnuPGInterface = buildPerlPackage {
@ -8547,12 +8562,28 @@ let
    };
  };

+  HTTPCookieJar = buildPerlPackage {
+    pname = "HTTP-CookieJar";
+    version = "0.008";
+    src = fetchurl {
+      url = mirror://cpan/authors/id/D/DA/DAGOLDEN/HTTP-CookieJar-0.008.tar.gz;
+      sha256 = "0rfw6avcralggs7bf7n86flvhaahxjnqzvpwszp0sk4z4wwy01wm";
+    };
+    propagatedBuildInputs = [ HTTPDate ];
+    buildInputs = [ TestDeep TestRequires URI ];
+    meta = {
+      description = "A minimalist HTTP user agent cookie jar";
+      license = with stdenv.lib.licenses; [ asl20 ];
+      homepage = "https://github.com/dagolden/HTTP-CookieJar";
+    };
+  };
+
  HTTPCookies = buildPerlPackage {
    pname = "HTTP-Cookies";
-    version = "6.04";
+    version = "6.07";
    src = fetchurl {
-      url = mirror://cpan/authors/id/O/OA/OALDERS/HTTP-Cookies-6.04.tar.gz;
-      sha256 = "1m0kxcirbvbkrm2c59p1bkbvzlcdymg8fdpa7wlxijlx0xwz1iqc";
+      url = mirror://cpan/authors/id/O/OA/OALDERS/HTTP-Cookies-6.07.tar.gz;
+      sha256 = "0apa7smnlzanh1gdrm7id42iv64vy5skj53ank2rsk07avg8qbva";
    };
    propagatedBuildInputs = [ HTTPMessage ];
    meta = {
@ -8577,23 +8608,24 @@ let

  HTTPDate = buildPerlPackage {
    pname = "HTTP-Date";
-    version = "6.02";
+    version = "6.05";
    src = fetchurl {
-      url = mirror://cpan/authors/id/G/GA/GAAS/HTTP-Date-6.02.tar.gz;
-      sha256 = "0cz357kafhhzw7w59iyi0wvhw7rlh5g1lh38230ckw7rl0fr9fg8";
+      url = mirror://cpan/authors/id/O/OA/OALDERS/HTTP-Date-6.05.tar.gz;
+      sha256 = "0awjdbz7x0jd5pna55dwxhs3k6xp3sw6b2zg3p2yndxxvya64p9n";
    };
    meta = {
      description = "Date conversion routines";
      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
    };
+    propagatedBuildInputs = [ TimeDate TimeLocal ];
  };

  HTTPEntityParser = buildPerlModule {
     pname = "HTTP-Entity-Parser";
-     version = "0.21";
+     version = "0.22";
     src = fetchurl {
-       url = mirror://cpan/authors/id/K/KA/KAZEBURO/HTTP-Entity-Parser-0.21.tar.gz;
-       sha256 = "1n7qhyscllialds5jsk1k8x2vmfbjvisa3342as5x15hpm13wkf1";
+       url = mirror://cpan/authors/id/K/KA/KAZEBURO/HTTP-Entity-Parser-0.22.tar.gz;
+       sha256 = "1j6nxs0nmx160ip0xw9gb3l19ii8pz9x1ay1y15q7rmllbr1rzlk";
     };
     propagatedBuildInputs = [ HTTPMultiPartParser HashMultiValue JSONMaybeXS StreamBuffered WWWFormUrlEncoded ];
     buildInputs = [ HTTPMessage ModuleBuildTiny ];
@ -8848,10 +8880,10 @@ let

  ImageInfo = buildPerlPackage {
    pname = "Image-Info";
-    version = "1.41";
+    version = "1.42";
    src = fetchurl {
-      url = mirror://cpan/authors/id/S/SR/SREZIC/Image-Info-1.41.tar.gz;
-      sha256 = "c546d27414686660dbc3cd8501537128c5285a8db0faf742c2dc12b9a29ba3db";
+      url = mirror://cpan/authors/id/S/SR/SREZIC/Image-Info-1.42.tar.gz;
+      sha256 = "2bca560c3f71b3c1cd63ac3a974e62f3baeb986b7ffaa026b929081b914a8f4f";
    };
    propagatedBuildInputs = [ IOStringy ];
    meta = {
@ -8862,10 +8894,10 @@ let

  ImageSane = buildPerlPackage {
    pname = "Image-Sane";
-    version = "4";
+    version = "5";
    src = fetchurl {
-      url = mirror://cpan/authors/id/R/RA/RATCLIFFE/Image-Sane-4.tar.gz;
-      sha256 = "f970a0314e554f6fe29dcc651aec5bd45b32d547801d304434ae80b4b806896b";
+      url = mirror://cpan/authors/id/R/RA/RATCLIFFE/Image-Sane-5.tar.gz;
+      sha256 = "229aa0e9f049efa760f3c2f6e61d9d539af43d8f764b50a6e03064b4729a35ff";
    };
    buildInputs = [ pkgs.sane-backends ExtUtilsDepends ExtUtilsPkgConfig TestRequires TryTiny ];
    propagatedBuildInputs = [ ExceptionClass Readonly ];
@ -8984,10 +9016,10 @@ let

  IOCaptureOutput = buildPerlPackage {
    pname = "IO-CaptureOutput";
-    version = "1.1104";
+    version = "1.1105";
    src = fetchurl {
-      url = mirror://cpan/authors/id/D/DA/DAGOLDEN/IO-CaptureOutput-1.1104.tar.gz;
-      sha256 = "fcc732fcb438f97a72b30e8c7796484bef2562e374553b207028e2fbf73f8330";
+      url = mirror://cpan/authors/id/D/DA/DAGOLDEN/IO-CaptureOutput-1.1105.tar.gz;
+      sha256 = "ae99009fca1273800f169ecb82f4ed1cc6c76795f156bee5c0093005d572f487";
    };
    meta = {
      homepage = https://github.com/dagolden/IO-CaptureOutput;
@ -8998,10 +9030,10 @@ let

  IOCompress = buildPerlPackage {
    pname = "IO-Compress";
-    version = "2.087";
+    version = "2.090";
    src = fetchurl {
-      url = mirror://cpan/authors/id/P/PM/PMQS/IO-Compress-2.087.tar.gz;
-      sha256 = "94f792775d0496fffe862363c76637e74ff5b46c40cf47042547686d164e23cb";
+      url = mirror://cpan/authors/id/P/PM/PMQS/IO-Compress-2.090.tar.gz;
+      sha256 = "4c12e54a83f993372d43dd67389a1ca92b5c33c108c7f86768a4797cd994e987";
    };
    propagatedBuildInputs = [ CompressRawBzip2 CompressRawZlib ];
    meta = {
@ -9535,10 +9567,10 @@ let

  JSONValidator = buildPerlPackage {
    pname = "JSON-Validator";
-    version = "3.15";
+    version = "3.16";
    src = fetchurl {
-      url = "mirror://cpan/authors/id/J/JH/JHTHORSEN/JSON-Validator-3.15.tar.gz";
-      sha256 = "ce14ed018b9843ef022c4c14e2171545d3da92e533c8f122b8e33f27444b2a6c";
+      url = mirror://cpan/authors/id/J/JH/JHTHORSEN/JSON-Validator-3.16.tar.gz;
+      sha256 = "d20775cf5fb1a61a6054a5bd3ce45b5371ac8ed483efca3cb8dc8a09937efe4e";
    };
    buildInputs = [ TestDeep ];
    propagatedBuildInputs = [ DataValidateDomain DataValidateIP Mojolicious NetIDNEncode YAMLLibYAML ];
@ -10027,10 +10059,10 @@ let

  ListSomeUtils = buildPerlPackage {
    pname = "List-SomeUtils";
-    version = "0.56";
+    version = "0.58";
    src = fetchurl {
-      url = mirror://cpan/authors/id/D/DR/DROLSKY/List-SomeUtils-0.56.tar.gz;
-      sha256 = "eaa7d99ce86380c0389876474c8eb84acc0a6bfeef1b0fc23a292592de6f89f7";
+      url = mirror://cpan/authors/id/D/DR/DROLSKY/List-SomeUtils-0.58.tar.gz;
+      sha256 = "96eafb359339d22bf2a2de421298847a3c40f6a28b6d44005d0965da86a5469d";
    };
    buildInputs = [ TestLeakTrace ];
    propagatedBuildInputs = [ ModuleImplementation ];
@ -10288,10 +10320,10 @@ let

  LogDispatch = buildPerlPackage {
    pname = "Log-Dispatch";
-    version = "2.68";
+    version = "2.69";
    src = fetchurl {
-      url = mirror://cpan/authors/id/D/DR/DROLSKY/Log-Dispatch-2.68.tar.gz;
-      sha256 = "1bxd3bhrn1h2q9f8r65z3101a32nl2kdb7l40bxg4vbsk4wk0ynh";
+      url = mirror://cpan/authors/id/D/DR/DROLSKY/Log-Dispatch-2.69.tar.gz;
+      sha256 = "0xsjb0j3dzs8ym8jbgi29kia4pz5vl8jzkmpxxrhhqjc1h54qqjq";
    };
    propagatedBuildInputs = [ DevelGlobalDestruction ParamsValidationCompiler Specio namespaceautoclean ];
    meta = {
@ -10308,12 +10340,12 @@ let
      url = "mirror://cpan/authors/id/M/MS/MSCHOUT/Log-Dispatch-FileRotate-1.36.tar.gz";
      sha256 = "0vlmi17p7fky3x58rs7r5mdxi6l5jla8zhlb55kvssxc1w5v2b27";
    };
-    propagatedBuildInputs = [ DateManip LogDispatch PathTiny ];
+    propagatedBuildInputs = [ DateManip LogDispatch ];
    meta = {
      description = "Log to Files that Archive/Rotate Themselves";
      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
    };
-    buildInputs = [ TestFatal TestNeeds TestWarn ];
+    buildInputs = [ PathTiny TestWarn ];
  };

  LogHandler = buildPerlModule {
@ -10433,7 +10465,7 @@ let
      url = "mirror://cpan/authors/id/L/LK/LKUNDRAK/Log-Journald-${version}.tar.gz";
      sha256 = "55992cf9a1e1fb833f428300525bfa7cf7ed46b83ec414f82a091789b37d08a3";
    };
-    buildInputs = [ ModuleBuild pkgs.pkgconfig pkgs.systemd ];
+    buildInputs = [ pkgs.pkgconfig pkgs.systemd ];
    postPatch = ''
      substituteInPlace Build.PL \
        --replace "libsystemd-journal" "libsystemd"
@ -10460,10 +10492,10 @@ let

  LWP = buildPerlPackage {
    pname = "libwww-perl";
-    version = "6.39";
+    version = "6.42";
    src = fetchurl {
-      url = mirror://cpan/authors/id/O/OA/OALDERS/libwww-perl-6.39.tar.gz;
-      sha256 = "9a8d7747938aa75d7d524c71574ae7f99ca66a5dac8255a7f7759f373e7774d5";
+      url = mirror://cpan/authors/id/O/OA/OALDERS/libwww-perl-6.42.tar.gz;
+      sha256 = "34253337a3404c4209d0e45377c9176d0ab6ea4b4570e3a597e26157181741d1";
    };
    propagatedBuildInputs = [ FileListing HTMLParser HTTPCookies HTTPDaemon HTTPNegotiate NetHTTP TryTiny WWWRobotRules ];
    # support cross-compilation by avoiding using `has_module` which does not work in miniperl (it requires B native module)
@ -10693,10 +10725,10 @@ let

  MailDKIM = buildPerlPackage {
    pname = "Mail-DKIM";
-    version = "0.57";
+    version = "0.58";
    src = fetchurl {
-      url = mirror://cpan/authors/id/M/MB/MBRADSHAW/Mail-DKIM-0.57.tar.gz;
-      sha256 = "0fmfhwn4sh98w62rc8j584l23vlhr7vii8glm2njx14f81a56lvb";
+      url = mirror://cpan/authors/id/M/MB/MBRADSHAW/Mail-DKIM-0.58.tar.gz;
+      sha256 = "0cgkal65qqcy57b21lgij90ba36wl66byw9i76g5yhwaa8ms8hqa";
    };
    propagatedBuildInputs = [ CryptOpenSSLRSA MailAuthenticationResults MailTools NetDNSResolverMock YAMLLibYAML ];
    doCheck = false; # tries to access the domain name system
@ -11248,10 +11280,10 @@ let

  MIMELite = buildPerlPackage {
    pname = "MIME-Lite";
-    version = "3.030";
+    version = "3.031";
    src = fetchurl {
-      url = mirror://cpan/authors/id/R/RJ/RJBS/MIME-Lite-3.030.tar.gz;
-      sha256 = "8f39901bc580bc3dce69e10415305e4435ff90264c63d29f707b4566460be962";
+      url = mirror://cpan/authors/id/R/RJ/RJBS/MIME-Lite-3.031.tar.gz;
+      sha256 = "f1235866482b67f00858b3edaa4ff4cf909ef900f1d15d889948bf9c03a591e0";
    };
    propagatedBuildInputs = [ EmailDateFormat ];
    meta = {
@ -11772,10 +11804,10 @@ let

  Mojolicious = buildPerlPackage {
    pname = "Mojolicious";
-    version = "8.25";
+    version = "8.26";
    src = fetchurl {
-      url = mirror://cpan/authors/id/S/SR/SRI/Mojolicious-8.25.tar.gz;
-      sha256 = "0yr5vpgwg9x435npzc6v477y260dgbj2yl9lxdjimmr6n5jryv1n";
+      url = mirror://cpan/authors/id/S/SR/SRI/Mojolicious-8.26.tar.gz;
+      sha256 = "17x3phc4ch85398kdybsz6cbraszby9dvlvcj6a6xscb20x35k4i";
    };
    meta = {
      homepage = https://mojolicious.org;
@ -11803,10 +11835,10 @@ let

  MojoliciousPluginOpenAPI = buildPerlPackage {
    pname = "Mojolicious-Plugin-OpenAPI";
-    version = "2.17";
+    version = "2.18";
    src = fetchurl {
-      url = "mirror://cpan/authors/id/J/JH/JHTHORSEN/Mojolicious-Plugin-OpenAPI-2.17.tar.gz";
-      sha256 = "c20f8b07fb8582fdbf0b540f4cfc5fe95f262743522a160526024342a7f0a1f0";
+      url = mirror://cpan/authors/id/J/JH/JHTHORSEN/Mojolicious-Plugin-OpenAPI-2.18.tar.gz;
+      sha256 = "340afe815e6195bc0ed5abcf5bcd0fdedf0be62656cede1768cfd99b62633d23";
    };
    propagatedBuildInputs = [ JSONValidator ];
    meta = {
@ -11851,10 +11883,10 @@ let

  MojoSQLite = buildPerlModule {
    pname = "Mojo-SQLite";
-    version = "3.003";
+    version = "3.002";
    src = fetchurl {
-      url = "mirror://cpan/authors/id/D/DB/DBOOK/Mojo-SQLite-3.003.tar.gz";
-      sha256 = "d96c00dcf45e2becc8e8181df074853d42616f2a660703455d0e0a2741478092";
+      url = mirror://cpan/authors/id/D/DB/DBOOK/Mojo-SQLite-3.002.tar.gz;
+      sha256 = "d7c6588599cfe30b24b3953927f23cfe0f9f5d3e77eeab1562249b48c205b699";
    };
    buildInputs = [ ModuleBuildTiny ];
    propagatedBuildInputs = [ DBDSQLite Mojolicious SQLAbstract URIdb ];
@ -11945,13 +11977,13 @@ let

  Moo = buildPerlPackage {
    pname = "Moo";
-    version = "2.003004";
+    version = "2.003006";
    src = fetchurl {
-      url = mirror://cpan/authors/id/H/HA/HAARG/Moo-2.003004.tar.gz;
-      sha256 = "f8bbb625f8e963eabe05cff9048fdd72bdd26777404ff2c40bc690f558be91e1";
+      url = mirror://cpan/authors/id/H/HA/HAARG/Moo-2.003006.tar.gz;
+      sha256 = "bcb2092ab18a45005b5e2e84465ebf3a4999d8e82a43a09f5a94d859ae7f2472";
    };
    buildInputs = [ TestFatal ];
-    propagatedBuildInputs = [ ClassMethodModifiers DevelGlobalDestruction ModuleRuntime RoleTiny SubQuote ];
+    propagatedBuildInputs = [ ClassMethodModifiers ModuleRuntime RoleTiny SubQuote ];
    meta = {
      description = "Minimalist Object Orientation (with Moose compatibility)";
      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
@ -12197,10 +12229,10 @@ let

  MooXlate = buildPerlPackage {
    pname = "MooX-late";
-    version = "0.015";
+    version = "0.016";
    src = fetchurl {
-      url = mirror://cpan/authors/id/T/TO/TOBYINK/MooX-late-0.015.tar.gz;
-      sha256 = "175326af3076fa8698669f289fad1322724978cddaf40ea04e600fcd7f6afbbf";
+      url = mirror://cpan/authors/id/T/TO/TOBYINK/MooX-late-0.016.tar.gz;
+      sha256 = "1fb6393e8b77c0ec1e99229bc6f5b9db362eedc172fa940b37defd9bb3415e4e";
    };
    buildInputs = [ TestFatal TestRequires ];
    propagatedBuildInputs = [ Moo TypeTiny ];
@ -12237,6 +12269,21 @@ let
    };
  };

+  TestValgrind = buildPerlPackage {
+    pname = "Test-Valgrind";
+    version = "1.19";
+    src = fetchurl {
+      url = mirror://cpan/authors/id/V/VP/VPIT/Test-Valgrind-1.19.tar.gz;
+      sha256 = "06w1c0ddmmdkhhvv9pxq2nv5i40nbqf4cssfkq38yypfbyhsff0q";
+    };
+    propagatedBuildInputs = [ EnvSanctify FileHomeDir PerlDestructLevel XMLTwig ];
+    meta = {
+      description = "Generate suppressions, analyse and test any command with valgrind.";
+      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
+      homepage = "http://search.cpan.org/dist/Test-Valgrind/";
+    };
+  };
+
  MouseXTypesPathClass = buildPerlPackage {
    pname = "MouseX-Types-Path-Class";
    version = "0.07";
@ -12925,7 +12972,7 @@ let
      url = "mirror://cpan/authors/id/E/ES/ESTRABD/MySQL-Diff-0.60.tar.gz";
      sha256 = "5d7080a4bd5714ff9ef536aa774a7adb3c6f0e760215ca6c39d8a3545344f956";
    };
-    propagatedBuildInputs = [ FileSlurp StringShellQuote pkgs.mysql-client ];
+    propagatedBuildInputs = [ pkgs.mysql-client FileSlurp StringShellQuote ];
    meta = {
      homepage = "https://github.com/estrabd/mysqldiff";
      description = "Generates a database upgrade instruction set";
@ -14061,10 +14108,10 @@ let

  ParsePMFile = buildPerlPackage {
     pname = "Parse-PMFile";
-     version = "0.41";
+     version = "0.42";
     src = fetchurl {
-       url = mirror://cpan/authors/id/I/IS/ISHIGAKI/Parse-PMFile-0.41.tar.gz;
-       sha256 = "1ffv9msp4xjfaylay2zfqangxhgyr5xk993k5n1k08hh6qagq8df";
+       url = mirror://cpan/authors/id/I/IS/ISHIGAKI/Parse-PMFile-0.42.tar.gz;
+       sha256 = "0v3k5jslbl29735hs32x9si546v55cyy6sb58aib8vmq684wgxp7";
     };
     buildInputs = [ ExtUtilsMakeMakerCPANfile ];
     meta = {
@ -14261,6 +14308,17 @@ let
    };
  };

+  PerlDestructLevel = buildPerlPackage {
+    pname = "Perl-Destruct-Level";
+    version = "0.02";
+    src = fetchurl {
+      url = mirror://cpan/authors/id/R/RG/RGARCIA/Perl-Destruct-Level-0.02.tar.gz;
+      sha256 = "0fyiysrq874ncscgdjg522fs29gvqads6ynyhwxwwq1b545srd20";
+    };
+    meta = {
+    };
+  };
+
  PerlIOeol = buildPerlPackage {
    pname = "PerlIO-eol";
    version = "0.17";
@ -14713,10 +14771,10 @@ let

  ProcBackground = buildPerlPackage {
    pname = "Proc-Background";
-    version = "1.10";
+    version = "1.21";
    src = fetchurl {
-      url = mirror://cpan/authors/id/B/BZ/BZAJAC/Proc-Background-1.10.tar.gz;
-      sha256 = "1ce0dd78c0bb8393a2431b385a27b99fcc623a41ebec57b3cc09cc38cdb708ee";
+      url = mirror://cpan/authors/id/N/NE/NERDVANA/Proc-Background-1.21.tar.gz;
+      sha256 = "91b6a5aeb841b1c313498c78fad08e37d17595702dc6205b5ad38ef69949b7ee";
    };
    meta = {
    };
@ -14837,11 +14895,11 @@ let

  ProtocolHTTP2 = buildPerlModule {
    pname = "Protocol-HTTP2";
-    version = "1.09";
+    version = "1.10";

    src = fetchurl {
-      url = mirror://cpan/authors/id/C/CR/CRUX/Protocol-HTTP2-1.09.tar.gz;
-      sha256 = "1bc0ybkqhv81dscgzlbr62w4zqjsidcikmkbjanzn83g2b6ia9nc";
+      url = mirror://cpan/authors/id/C/CR/CRUX/Protocol-HTTP2-1.10.tar.gz;
+      sha256 = "0jm6jq1wszjrrcypyi642m2i8wgni50wdnzh9dzfkyjazdc00sn2";
    };
    buildInputs = [ AnyEvent ModuleBuildTiny NetSSLeay TestLeakTrace TestSharedFork TestTCP ];
  };
@ -15170,10 +15228,10 @@ let

  PodSimple = buildPerlPackage {
    pname = "Pod-Simple";
-    version = "3.39";
+    version = "3.40";
    src = fetchurl {
-      url = mirror://cpan/authors/id/K/KH/KHW/Pod-Simple-3.39.tar.gz;
-      sha256 = "0qh43griaz3i21ca745irrnjbksv5q07h4wdjv28nqpcc55pva8m";
+      url = mirror://cpan/authors/id/K/KH/KHW/Pod-Simple-3.40.tar.gz;
+      sha256 = "0384k8k18srsdj2a2j10gbvv19lnvynq359y9kb4zn5bv2wqqfh6";
    };
  };

@ -15513,10 +15571,10 @@ let

  RoleTiny = buildPerlPackage {
    pname = "Role-Tiny";
-    version = "2.001003";
+    version = "2.001004";
    src = fetchurl {
-      url = mirror://cpan/authors/id/H/HA/HAARG/Role-Tiny-2.001003.tar.gz;
-      sha256 = "6cef8d6371342a94a6a04c1be5bd7a3f2bd6ea36f1a21b4649b08d5b88b28eeb";
+      url = mirror://cpan/authors/id/H/HA/HAARG/Role-Tiny-2.001004.tar.gz;
+      sha256 = "92ba5712850a74102c93c942eb6e7f62f7a4f8f483734ed289d08b324c281687";
    };
    meta = {
      description = "Roles. Like a nouvelle cuisine portion size slice of Moose";
@ -15579,10 +15637,10 @@ let

  ScalarListUtils = buildPerlPackage {
    pname = "Scalar-List-Utils";
-    version = "1.52";
+    version = "1.53";
    src = fetchurl {
-      url = mirror://cpan/authors/id/P/PE/PEVANS/Scalar-List-Utils-1.52.tar.gz;
-      sha256 = "279d78cef84acae280da4dfb95eff0c9865d1611b1a3b026baddf42d1ba01de4";
+      url = mirror://cpan/authors/id/P/PE/PEVANS/Scalar-List-Utils-1.53.tar.gz;
+      sha256 = "bd4086b066fb3b18a0be2e7d9bc100a99aa0f233ad659492340415c7b2bdae99";
    };
    meta = {
      description = "Common Scalar and List utility subroutines";
@ -16250,10 +16308,10 @@ let

  StringCRC32 = buildPerlPackage {
    pname = "String-CRC32";
-    version = "1.7";
+    version = "1.8";
    src = fetchurl {
-      url = mirror://cpan/authors/id/L/LE/LEEJO/String-CRC32-1.7.tar.gz;
-      sha256 = "1j1bwbxcgxfbgw708rfrni3spwnnmnf717vq9s64nd63jmc4w5lg";
+      url = mirror://cpan/authors/id/L/LE/LEEJO/String-CRC32-1.8.tar.gz;
+      sha256 = "0vvwlf50vylx1m7nrjphkz309nsl2k2yqyldn3942337kiipjnmn";
    };
  };

@ -16762,10 +16820,10 @@ let

  SysSyslog = buildPerlPackage {
    pname = "Sys-Syslog";
-    version = "0.35";
+    version = "0.36";
    src = fetchurl {
-      url = mirror://cpan/authors/id/S/SA/SAPER/Sys-Syslog-0.35.tar.gz;
-      sha256 = "fe28e47b70b77aaae754385fe1470d174289e7b6908efa247d2e52486516fbb7";
+      url = mirror://cpan/authors/id/S/SA/SAPER/Sys-Syslog-0.36.tar.gz;
+      sha256 = "ed42a9e5ba04ad4856cc0cb5d38d289c3c5d3764543ec04efafc4af7e3378df8";
    };
    meta = {
      description = "Perl interface to the UNIX syslog(3) calls";
@ -17180,10 +17238,10 @@ let

  TermTable = buildPerlPackage {
    pname = "Term-Table";
-    version = "0.014";
+    version = "0.015";
    src = fetchurl {
-      url = mirror://cpan/authors/id/E/EX/EXODIST/Term-Table-0.014.tar.gz;
-      sha256 = "167a0669e2ef8c6386ea4dd213495e445049493ce1d5097d5632c0e928b7426d";
+      url = mirror://cpan/authors/id/E/EX/EXODIST/Term-Table-0.015.tar.gz;
+      sha256 = "d8a18b2801f91f0e5d747147ce786964a76f91d18568652908a3dc06a9b948d5";
    };
    propagatedBuildInputs = [ Importer ];
    meta = {
@ -17257,10 +17315,10 @@ let

  Test2Suite = buildPerlPackage {
    pname = "Test2-Suite";
-    version = "0.000126";
+    version = "0.000127";
    src = fetchurl {
-      url = mirror://cpan/authors/id/E/EX/EXODIST/Test2-Suite-0.000126.tar.gz;
-      sha256 = "370db8171c9105480872ae8948745dbd798b9d751aacc8aa0fc36266eeda79e3";
+      url = mirror://cpan/authors/id/E/EX/EXODIST/Test2-Suite-0.000127.tar.gz;
+      sha256 = "09443e7c99f9bef2c3f5999b919800db7d265b2c55f177726d3e5a61d8dbe690";
    };
    propagatedBuildInputs = [ ModulePluggable ScopeGuard SubInfo TermTable TestSimple13 ];
    meta = {
@ -17438,10 +17496,10 @@ let

  TestCompile = buildPerlModule {
    pname = "Test-Compile";
-    version = "2.3.0";
+    version = "2.3.1";
    src = fetchurl {
-      url = mirror://cpan/authors/id/E/EG/EGILES/Test-Compile-v2.3.0.tar.gz;
-      sha256 = "f61549769e55a9b251f83617b901c0461659b1360243ef046d4f112f7f4e4a8f";
+      url = mirror://cpan/authors/id/E/EG/EGILES/Test-Compile-v2.3.1.tar.gz;
+      sha256 = "1174cff010011ae43e6462755ccd8a6cf0372ca506705c60586f7b1748ff4ddf";
    };
    propagatedBuildInputs = [ UNIVERSALrequire ];
    meta = {
@ -17873,10 +17931,10 @@ let

  TestMockModule = buildPerlModule {
    pname = "Test-MockModule";
-    version = "0.170.0";
+    version = "0.171.0";
    src = fetchurl {
-      url = mirror://cpan/authors/id/G/GF/GFRANKS/Test-MockModule-v0.170.0.tar.gz;
-      sha256 = "0pggwrlqj6k44qayhbpjqkzry1r626iy2vf30zlf2jdhbjbvlycz";
+      url = mirror://cpan/authors/id/G/GF/GFRANKS/Test-MockModule-v0.171.0.tar.gz;
+      sha256 = "1arqgb1773zym5dqlwm6kz48bfrccjhb5bjfsif0vkalwq2gvm7b";
    };
    propagatedBuildInputs = [ SUPER ];
    buildInputs = [ TestWarnings ];
@ -18342,10 +18400,10 @@ let

  TestScript = buildPerlPackage {
    pname = "Test-Script";
-    version = "1.25";
+    version = "1.26";
    src = fetchurl {
-      url = mirror://cpan/authors/id/P/PL/PLICEASE/Test-Script-1.25.tar.gz;
-      sha256 = "199s78hh77zwwqba6pa1ngzjnzrdj2ka6qv5w0i286aafh93705n";
+      url = mirror://cpan/authors/id/P/PL/PLICEASE/Test-Script-1.26.tar.gz;
+      sha256 = "1dvkb8dvidnycd6ws2h2iy262h37fjakflv6z90xrw72xix26hkd";
    };

    buildInputs = [ Test2Suite ];
@ -18370,10 +18428,10 @@ let

  TestSimple13 = buildPerlPackage {
    pname = "Test-Simple";
-    version = "1.302168";
+    version = "1.302169";
    src = fetchurl {
-      url = mirror://cpan/authors/id/E/EX/EXODIST/Test-Simple-1.302168.tar.gz;
-      sha256 = "02f6132b2062abb23474b0fc02e70a0fbbf7bf581a6010e64c08891530447ffa";
+      url = mirror://cpan/authors/id/E/EX/EXODIST/Test-Simple-1.302169.tar.gz;
+      sha256 = "411704776f0f787b1c2e4fb0e612162650a80b0dc0a719d84abc1070025ac723";
    };
    meta = {
      description = "Basic utilities for writing tests";
@ -18463,10 +18521,10 @@ let

  TestTime = buildPerlPackage {
    pname = "Test-Time";
-    version = "0.05";
+    version = "0.08";
    src = fetchurl {
-      url = mirror://cpan/authors/id/S/SA/SATOH/Test-Time-0.05.tar.gz;
-      sha256 = "abef8885a811440114bfe067edc32f08500fbfd624902f8c3a81fc224ac4b410";
+      url = mirror://cpan/authors/id/S/SA/SATOH/Test-Time-0.08.tar.gz;
+      sha256 = "b8bc3b074bb2247e8588399c1e55d071f049cf6ce1c8b4192c38cf3c24559548";
    };
    meta = {
      description = "Overrides the time() and sleep() core functions for testing";
@ -19662,16 +19720,17 @@ let

  TypeTiny = buildPerlPackage {
    pname = "Type-Tiny";
-    version = "1.004004";
+    version = "1.006000";
    src = fetchurl {
-      url = mirror://cpan/authors/id/T/TO/TOBYINK/Type-Tiny-1.004004.tar.gz;
-      sha256 = "081281ea004cdd89003d938aa52c1398e24411dd8f7163b14d0977a13f7062be";
+      url = mirror://cpan/authors/id/T/TO/TOBYINK/Type-Tiny-1.006000.tar.gz;
+      sha256 = "d5a60013df0b4a108e5755cfea84a8e81b1eacd4a91f6f17a5515a864ed7fd00";
    };
    propagatedBuildInputs = [ ExporterTiny ];
    meta = {
      description = "Tiny, yet Moo(se)-compatible type constraint";
      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
    };
+    buildInputs = [ TestMemoryCycle ];
  };

  TypesSerialiser = buildPerlPackage {
@ -20064,10 +20123,10 @@ let

  WWWMechanize = buildPerlPackage {
    pname = "WWW-Mechanize";
-    version = "1.94";
+    version = "1.95";
    src = fetchurl {
-      url = mirror://cpan/authors/id/O/OA/OALDERS/WWW-Mechanize-1.94.tar.gz;
-      sha256 = "00hh5iaxyfmfgh5irz23v5qpc40hff2v78jyi93assi7a4amfl68";
+      url = mirror://cpan/authors/id/O/OA/OALDERS/WWW-Mechanize-1.95.tar.gz;
+      sha256 = "1w121x0xsn1bm699ncanyxqv3njqam3zzjkq8p54bqmzpikn5crs";
    };
    propagatedBuildInputs = [ HTMLForm HTMLTree LWP ];
    doCheck = false;
@ -20399,10 +20458,10 @@ let

  XMLParser = buildPerlPackage {
    pname = "XML-Parser";
-    version = "2.46";
+    version = "2.44";
    src = fetchurl {
-      url = mirror://cpan/authors/id/T/TO/TODDR/XML-Parser-2.46.tar.gz;
-      sha256 = "0pai3ik47q7rgnix9644c673fwydz52gqkxr9kxwq765j4j36cfk";
+      url = mirror://cpan/authors/id/T/TO/TODDR/XML-Parser-2.44.tar.gz;
+      sha256 = "05ij0g6bfn27iaggxf8nl5rhlwx6f6p6xmdav6rjcly3x5zd1s8s";
    };
    patchPhase = stdenv.lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
      substituteInPlace Expat/Makefile.PL --replace 'use English;' '#'