Merge branch 'staging-next' into staging

2020-12-01 03:26:36 +01:00 · 2020-12-01 03:26:36 +01:00 · 27b974d84b
commit 27b974d84b
parent 0bdfc4dd31 bf5da4bbd4
153 changed files with 1640 additions and 7808 deletions
--- a/README.md
+++ b/README.md
@ -60,7 +60,7 @@ channels](https://nixos.org/nix/manual/#sec-channels).
 Nixpkgs is among the most active projects on GitHub. While thousands
 of open issues and pull requests might seem a lot at first, it helps
 consider it in the context of the scope of the project. Nixpkgs
-describes how to build over 40,000 pieces of software and implements a
+describes how to build tens of thousands of pieces of software and implements a
 Linux distribution. The [GitHub Insights](https://github.com/NixOS/nixpkgs/pulse)
 page gives a sense of the project activity.

--- a/doc/builders/packages/emacs.section.md
+++ b/doc/builders/packages/emacs.section.md
@ -0,0 +1,119 @@
+# Emacs {#sec-emacs}
+
+## Configuring Emacs
+
+The Emacs package comes with some extra helpers to make it easier to configure. `emacsWithPackages` allows you to manage packages from ELPA. This means that you will not have to install that packages from within Emacs. For instance, if you wanted to use `company` `counsel`, `flycheck`, `ivy`, `magit`, `projectile`, and `use-package` you could use this as a `~/.config/nixpkgs/config.nix` override:
+
+```nix
+{
+  packageOverrides = pkgs: with pkgs; {
+    myEmacs = emacsWithPackages (epkgs: (with epkgs.melpaStablePackages; [
+      company
+      counsel
+      flycheck
+      ivy
+      magit
+      projectile
+      use-package
+    ]));
+  }
+}
+```
+
+You can install it like any other packages via `nix-env -iA myEmacs`. However, this will only install those packages. It will not `configure` them for us. To do this, we need to provide a configuration file. Luckily, it is possible to do this from within Nix! By modifying the above example, we can make Emacs load a custom config file. The key is to create a package that provide a `default.el` file in `/share/emacs/site-start/`. Emacs knows to load this file automatically when it starts.
+
+```nix
+{
+  packageOverrides = pkgs: with pkgs; rec {
+    myEmacsConfig = writeText "default.el" ''
+      ;; initialize package
+
+      (require 'package)
+      (package-initialize 'noactivate)
+      (eval-when-compile
+        (require 'use-package))
+
+      ;; load some packages
+
+      (use-package company
+        :bind ("&lt;C-tab&gt;" . company-complete)
+        :diminish company-mode
+        :commands (company-mode global-company-mode)
+        :defer 1
+        :config
+        (global-company-mode))
+
+      (use-package counsel
+        :commands (counsel-descbinds)
+        :bind (([remap execute-extended-command] . counsel-M-x)
+               ("C-x C-f" . counsel-find-file)
+               ("C-c g" . counsel-git)
+               ("C-c j" . counsel-git-grep)
+               ("C-c k" . counsel-ag)
+               ("C-x l" . counsel-locate)
+               ("M-y" . counsel-yank-pop)))
+
+      (use-package flycheck
+        :defer 2
+        :config (global-flycheck-mode))
+
+      (use-package ivy
+        :defer 1
+        :bind (("C-c C-r" . ivy-resume)
+               ("C-x C-b" . ivy-switch-buffer)
+               :map ivy-minibuffer-map
+               ("C-j" . ivy-call))
+        :diminish ivy-mode
+        :commands ivy-mode
+        :config
+        (ivy-mode 1))
+
+      (use-package magit
+        :defer
+        :if (executable-find "git")
+        :bind (("C-x g" . magit-status)
+               ("C-x G" . magit-dispatch-popup))
+        :init
+        (setq magit-completing-read-function 'ivy-completing-read))
+
+      (use-package projectile
+        :commands projectile-mode
+        :bind-keymap ("C-c p" . projectile-command-map)
+        :defer 5
+        :config
+        (projectile-global-mode))
+    '';
+
+    myEmacs = emacsWithPackages (epkgs: (with epkgs.melpaStablePackages; [
+      (runCommand "default.el" {} ''
+         mkdir -p $out/share/emacs/site-lisp
+         cp ${myEmacsConfig} $out/share/emacs/site-lisp/default.el
+       '')
+      company
+      counsel
+      flycheck
+      ivy
+      magit
+      projectile
+      use-package
+    ]));
+  };
+}
+```
+
+This provides a fairly full Emacs start file. It will load in addition to the user's presonal config. You can always disable it by passing `-q` to the Emacs command.
+
+Sometimes `emacsWithPackages` is not enough, as this package set has some priorities imposed on packages (with the lowest priority assigned to Melpa Unstable, and the highest for packages manually defined in `pkgs/top-level/emacs-packages.nix`). But you can't control this priorities when some package is installed as a dependency. You can override it on per-package-basis, providing all the required dependencies manually - but it's tedious and there is always a possibility that an unwanted dependency will sneak in through some other package. To completely override such a package you can use `overrideScope'`.
+
+```nix
+overrides = self: super: rec {
+  haskell-mode = self.melpaPackages.haskell-mode;
+  ...
+};
+((emacsPackagesGen emacs).overrideScope' overrides).emacsWithPackages
+  (p: with p; [
+    # here both these package will use haskell-mode of our own choice
+    ghc-mod
+    dante
+  ])
+```
--- a/doc/builders/packages/emacs.xml
+++ b/doc/builders/packages/emacs.xml
@ -1,131 +0,0 @@
-<section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xml:id="sec-emacs">
- <title>Emacs</title>
-
- <section xml:id="sec-emacs-config">
-  <title>Configuring Emacs</title>
-
-  <para>
-   The Emacs package comes with some extra helpers to make it easier to configure. <varname>emacsWithPackages</varname> allows you to manage packages from ELPA. This means that you will not have to install that packages from within Emacs. For instance, if you wanted to use <literal>company</literal>, <literal>counsel</literal>, <literal>flycheck</literal>, <literal>ivy</literal>, <literal>magit</literal>, <literal>projectile</literal>, and <literal>use-package</literal> you could use this as a <filename>~/.config/nixpkgs/config.nix</filename> override:
-  </para>
-
-<screen>
-{
-  packageOverrides = pkgs: with pkgs; {
-    myEmacs = emacsWithPackages (epkgs: (with epkgs.melpaStablePackages; [
-      company
-      counsel
-      flycheck
-      ivy
-      magit
-      projectile
-      use-package
-    ]));
-  }
-}
-</screen>
-
-  <para>
-   You can install it like any other packages via <command>nix-env -iA myEmacs</command>. However, this will only install those packages. It will not <literal>configure</literal> them for us. To do this, we need to provide a configuration file. Luckily, it is possible to do this from within Nix! By modifying the above example, we can make Emacs load a custom config file. The key is to create a package that provide a <filename>default.el</filename> file in <filename>/share/emacs/site-start/</filename>. Emacs knows to load this file automatically when it starts.
-  </para>
-
-<screen>
-{
-  packageOverrides = pkgs: with pkgs; rec {
-    myEmacsConfig = writeText "default.el" ''
-;; initialize package
-
-(require 'package)
-(package-initialize 'noactivate)
-(eval-when-compile
-  (require 'use-package))
-
-;; load some packages
-
-(use-package company
-  :bind ("&lt;C-tab&gt;" . company-complete)
-  :diminish company-mode
-  :commands (company-mode global-company-mode)
-  :defer 1
-  :config
-  (global-company-mode))
-
-(use-package counsel
-  :commands (counsel-descbinds)
-  :bind (([remap execute-extended-command] . counsel-M-x)
-         ("C-x C-f" . counsel-find-file)
-         ("C-c g" . counsel-git)
-         ("C-c j" . counsel-git-grep)
-         ("C-c k" . counsel-ag)
-         ("C-x l" . counsel-locate)
-         ("M-y" . counsel-yank-pop)))
-
-(use-package flycheck
-  :defer 2
-  :config (global-flycheck-mode))
-
-(use-package ivy
-  :defer 1
-  :bind (("C-c C-r" . ivy-resume)
-         ("C-x C-b" . ivy-switch-buffer)
-         :map ivy-minibuffer-map
-         ("C-j" . ivy-call))
-  :diminish ivy-mode
-  :commands ivy-mode
-  :config
-  (ivy-mode 1))
-
-(use-package magit
-  :defer
-  :if (executable-find "git")
-  :bind (("C-x g" . magit-status)
-         ("C-x G" . magit-dispatch-popup))
-  :init
-  (setq magit-completing-read-function 'ivy-completing-read))
-
-(use-package projectile
-  :commands projectile-mode
-  :bind-keymap ("C-c p" . projectile-command-map)
-  :defer 5
-  :config
-  (projectile-global-mode))
-    '';
-    myEmacs = emacsWithPackages (epkgs: (with epkgs.melpaStablePackages; [
-      (runCommand "default.el" {} ''
-mkdir -p $out/share/emacs/site-lisp
-cp ${myEmacsConfig} $out/share/emacs/site-lisp/default.el
-'')
-      company
-      counsel
-      flycheck
-      ivy
-      magit
-      projectile
-      use-package
-    ]));
-  };
-}
-</screen>
-
-  <para>
-   This provides a fairly full Emacs start file. It will load in addition to the user's presonal config. You can always disable it by passing <command>-q</command> to the Emacs command.
-  </para>
-
-  <para>
-   Sometimes <varname>emacsWithPackages</varname> is not enough, as this package set has some priorities imposed on packages (with the lowest priority assigned to Melpa Unstable, and the highest for packages manually defined in <filename>pkgs/top-level/emacs-packages.nix</filename>). But you can't control this priorities when some package is installed as a dependency. You can override it on per-package-basis, providing all the required dependencies manually - but it's tedious and there is always a possibility that an unwanted dependency will sneak in through some other package. To completely override such a package you can use <varname>overrideScope'</varname>.
-  </para>
-
-<screen>
-overrides = self: super: rec {
-  haskell-mode = self.melpaPackages.haskell-mode;
-  ...
-};
-((emacsPackagesGen emacs).overrideScope' overrides).emacsWithPackages (p: with p; [
-  # here both these package will use haskell-mode of our own choice
-  ghc-mod
-  dante
-])
-</screen>
- </section>
-</section>
--- a/doc/builders/packages/index.xml
+++ b/doc/builders/packages/index.xml
@ -9,9 +9,9 @@
 <xi:include href="dlib.xml" />
 <xi:include href="eclipse.xml" />
 <xi:include href="elm.xml" />
- <xi:include href="emacs.xml" />
+ <xi:include href="emacs.section.xml" />
 <xi:include href="ibus.xml" />
- <xi:include href="kakoune.xml" />
+ <xi:include href="kakoune.section.xml" />
 <xi:include href="linux.xml" />
 <xi:include href="locales.xml" />
 <xi:include href="nginx.xml" />
--- a/doc/builders/packages/kakoune.section.md
+++ b/doc/builders/packages/kakoune.section.md
@ -0,0 +1,9 @@
+# Kakoune {#sec-kakoune}
+
+Kakoune can be built to autoload plugins:
+
+```nix
+(kakoune.override {
+  plugins = with pkgs.kakounePlugins; [ parinfer-rust ];
+})
+```
--- a/doc/builders/packages/kakoune.xml
+++ b/doc/builders/packages/kakoune.xml
@ -1,12 +0,0 @@
-<section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xml:id="sec-kakoune">
- <title>Kakoune</title>
-
- <para>
-  Kakoune can be built to autoload plugins:
-<programlisting>(kakoune.override {
-  plugins = with pkgs.kakounePlugins; [ parinfer-rust ];
-})</programlisting>
- </para>
-</section>
--- a/doc/languages-frameworks/index.xml
+++ b/doc/languages-frameworks/index.xml
@ -25,7 +25,7 @@
 <xi:include href="perl.xml" />
 <xi:include href="php.section.xml" />
 <xi:include href="python.section.xml" />
- <xi:include href="qt.xml" />
+ <xi:include href="qt.section.xml" />
 <xi:include href="r.section.xml" />
 <xi:include href="ruby.section.xml" />
 <xi:include href="rust.section.xml" />
--- a/doc/languages-frameworks/qt.section.md
+++ b/doc/languages-frameworks/qt.section.md
@ -0,0 +1,124 @@
+# Qt {#sec-language-qt}
+
+This section describes the differences between Nix expressions for Qt libraries and applications and Nix expressions for other C++ software. Some knowledge of the latter is assumed.
+
+There are primarily two problems which the Qt infrastructure is designed to address: ensuring consistent versioning of all dependencies and finding dependencies at runtime.
+
+## Nix expression for a Qt package (default.nix) {#qt-default-nix}
+
+```{=docbook}
+<programlisting>
+{ mkDerivation, lib, qtbase }: <co xml:id='qt-default-nix-co-1' />
+
+mkDerivation { <co xml:id='qt-default-nix-co-2' />
+  pname = "myapp";
+  version = "1.0";
+
+  buildInputs = [ qtbase ]; <co xml:id='qt-default-nix-co-3' />
+}
+</programlisting>
+
+ <calloutlist>
+  <callout arearefs='qt-default-nix-co-1'>
+   <para>
+    Import <literal>mkDerivation</literal> and Qt (such as <literal>qtbase</literal> modules directly. <emphasis>Do not</emphasis> import Qt package sets; the Qt versions of dependencies may not be coherent, causing build and runtime failures.
+   </para>
+  </callout>
+  <callout arearefs='qt-default-nix-co-2'>
+   <para>
+    Use <literal>mkDerivation</literal> instead of <literal>stdenv.mkDerivation</literal>. <literal>mkDerivation</literal> is a wrapper around <literal>stdenv.mkDerivation</literal> which applies some Qt-specific settings. This deriver accepts the same arguments as <literal>stdenv.mkDerivation</literal>; refer to <xref linkend='chap-stdenv' /> for details.
+   </para>
+   <para>
+    To use another deriver instead of <literal>stdenv.mkDerivation</literal>, use <literal>mkDerivationWith</literal>:
+<programlisting>
+mkDerivationWith myDeriver {
+  # ...
+}
+</programlisting>
+    If you cannot use <literal>mkDerivationWith</literal>, please refer to <xref linkend='qt-runtime-dependencies' />.
+   </para>
+  </callout>
+  <callout arearefs='qt-default-nix-co-3'>
+   <para>
+    <literal>mkDerivation</literal> accepts the same arguments as <literal>stdenv.mkDerivation</literal>, such as <literal>buildInputs</literal>.
+   </para>
+  </callout>
+ </calloutlist>
+```
+
+## Locating runtime dependencies {#qt-runtime-dependencies}
+Qt applications need to be wrapped to find runtime dependencies. If you cannot use `mkDerivation` or `mkDerivationWith` above, include `wrapQtAppsHook` in `nativeBuildInputs`:
+
+```nix
+stdenv.mkDerivation {
+  # ...
+
+  nativeBuildInputs = [ wrapQtAppsHook ];
+}
+```
+Entries added to `qtWrapperArgs` are used to modify the wrappers created by `wrapQtAppsHook`. The entries are passed as arguments to [wrapProgram executable makeWrapperArgs](#fun-wrapProgram).
+
+```nix
+mkDerivation {
+  # ...
+
+  qtWrapperArgs = [ ''--prefix PATH : /path/to/bin'' ];
+}
+```
+
+Set `dontWrapQtApps` to stop applications from being wrapped automatically. It is required to wrap applications manually with `wrapQtApp`, using the syntax of [wrapProgram executable makeWrapperArgs](#fun-wrapProgram):
+
+```nix
+mkDerivation {
+  # ...
+
+  dontWrapQtApps = true;
+  preFixup = ''
+      wrapQtApp "$out/bin/myapp" --prefix PATH : /path/to/bin
+  '';
+}
+```
+
+> Note: `wrapQtAppsHook` ignores files that are non-ELF executables. This means that scripts won't be automatically wrapped so you'll need to manually wrap them as previously mentioned. An example of when you'd always need to do this is with Python applications that use PyQT.
+
+Libraries are built with every available version of Qt. Use the `meta.broken` attribute to disable the package for unsupported Qt versions:
+
+```nix
+mkDerivation {
+  # ...
+
+  # Disable this library with Qt &lt; 5.9.0
+  meta.broken = builtins.compareVersions qtbase.version "5.9.0" &lt; 0;
+}
+```
+## Adding a library to Nixpkgs
+   Add a Qt library to all-packages.nix by adding it to the collection inside `mkLibsForQt5`. This ensures that the library is built with every available version of Qt as needed.
+
+### Example Adding a Qt library to all-packages.nix {#qt-library-all-packages-nix}
+
+```
+{
+  # ...
+
+  mkLibsForQt5 = self: with self; {
+    # ...
+
+    mylib = callPackage ../path/to/mylib {};
+  };
+
+  # ...
+}
+```
+## Adding an application to Nixpkgs
+Add a Qt application to *all-packages.nix* using `libsForQt5.callPackage` instead of the usual `callPackage`. The former ensures that all dependencies are built with the same version of Qt.
+
+### Example Adding a QT application to all-packages.nix {#qt-application-all-packages-nix}
+```nix
+{
+  # ...
+
+  myapp = libsForQt5.callPackage ../path/to/myapp/ {};
+
+  # ...
+}
+```
--- a/doc/languages-frameworks/qt.xml
+++ b/doc/languages-frameworks/qt.xml
@ -1,149 +0,0 @@
-<section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xml:id="sec-language-qt">
- <title>Qt</title>
-
- <para>
-  This section describes the differences between Nix expressions for Qt libraries and applications and Nix expressions for other C++ software. Some knowledge of the latter is assumed. There are primarily two problems which the Qt infrastructure is designed to address: ensuring consistent versioning of all dependencies and finding dependencies at runtime.
- </para>
-
- <example xml:id='qt-default-nix'>
-  <title>Nix expression for a Qt package (<filename>default.nix</filename>)</title>
-<programlisting>
-{ mkDerivation, lib, qtbase }: <co xml:id='qt-default-nix-co-1' />
-
-mkDerivation { <co xml:id='qt-default-nix-co-2' />
-  pname = "myapp";
-  version = "1.0";
-
-  buildInputs = [ qtbase ]; <co xml:id='qt-default-nix-co-3' />
-}
-</programlisting>
- </example>
-
- <calloutlist>
-  <callout arearefs='qt-default-nix-co-1'>
-   <para>
-    Import <literal>mkDerivation</literal> and Qt (such as <literal>qtbase</literal> modules directly. <emphasis>Do not</emphasis> import Qt package sets; the Qt versions of dependencies may not be coherent, causing build and runtime failures.
-   </para>
-  </callout>
-  <callout arearefs='qt-default-nix-co-2'>
-   <para>
-    Use <literal>mkDerivation</literal> instead of <literal>stdenv.mkDerivation</literal>. <literal>mkDerivation</literal> is a wrapper around <literal>stdenv.mkDerivation</literal> which applies some Qt-specific settings. This deriver accepts the same arguments as <literal>stdenv.mkDerivation</literal>; refer to <xref linkend='chap-stdenv' /> for details.
-   </para>
-   <para>
-    To use another deriver instead of <literal>stdenv.mkDerivation</literal>, use <literal>mkDerivationWith</literal>:
-<programlisting>
-mkDerivationWith myDeriver {
-  # ...
-}
-</programlisting>
-    If you cannot use <literal>mkDerivationWith</literal>, please refer to <xref linkend='qt-runtime-dependencies' />.
-   </para>
-  </callout>
-  <callout arearefs='qt-default-nix-co-3'>
-   <para>
-    <literal>mkDerivation</literal> accepts the same arguments as <literal>stdenv.mkDerivation</literal>, such as <literal>buildInputs</literal>.
-   </para>
-  </callout>
- </calloutlist>
-
- <formalpara xml:id='qt-runtime-dependencies'>
-  <title>Locating runtime dependencies</title>
-  <para>
-   Qt applications need to be wrapped to find runtime dependencies. If you cannot use <literal>mkDerivation</literal> or <literal>mkDerivationWith</literal> above, include <literal>wrapQtAppsHook</literal> in <literal>nativeBuildInputs</literal>:
-<programlisting>
-stdenv.mkDerivation {
-  # ...
-
-  nativeBuildInputs = [ wrapQtAppsHook ];
-}
-</programlisting>
-  </para>
- </formalpara>
-
- <para>
-  Entries added to <literal>qtWrapperArgs</literal> are used to modify the wrappers created by <literal>wrapQtAppsHook</literal>. The entries are passed as arguments to <xref linkend='fun-wrapProgram' />.
-<programlisting>
-mkDerivation {
-  # ...
-
-  qtWrapperArgs = [ ''--prefix PATH : /path/to/bin'' ];
-}
-</programlisting>
- </para>
-
- <para>
-  Set <literal>dontWrapQtApps</literal> to stop applications from being wrapped automatically. It is required to wrap applications manually with <literal>wrapQtApp</literal>, using the syntax of <xref linkend='fun-wrapProgram' />:
-<programlisting>
-mkDerivation {
-  # ...
-
-  dontWrapQtApps = true;
-  preFixup = ''
-      wrapQtApp "$out/bin/myapp" --prefix PATH : /path/to/bin
-  '';
-}
-</programlisting>
- </para>
-
- <note>
-  <para>
-   <literal>wrapQtAppsHook</literal> ignores files that are non-ELF executables. This means that scripts won't be automatically wrapped so you'll need to manually wrap them as previously mentioned. An example of when you'd always need to do this is with Python applications that use PyQT.
-  </para>
- </note>
-
- <para>
-  Libraries are built with every available version of Qt. Use the <literal>meta.broken</literal> attribute to disable the package for unsupported Qt versions:
-<programlisting>
-mkDerivation {
-  # ...
-
-  # Disable this library with Qt &lt; 5.9.0
-  meta.broken = builtins.compareVersions qtbase.version "5.9.0" &lt; 0;
-}
-</programlisting>
- </para>
-
- <formalpara>
-  <title>Adding a library to Nixpkgs</title>
-  <para>
-   Add a Qt library to <filename>all-packages.nix</filename> by adding it to the collection inside <literal>mkLibsForQt5</literal>. This ensures that the library is built with every available version of Qt as needed.
-   <example xml:id='qt-library-all-packages-nix'>
-    <title>Adding a Qt library to <filename>all-packages.nix</filename></title>
-<programlisting>
-{
-  # ...
-
-  mkLibsForQt5 = self: with self; {
-    # ...
-
-    mylib = callPackage ../path/to/mylib {};
-  };
-
-  # ...
-}
-</programlisting>
-   </example>
-  </para>
- </formalpara>
-
- <formalpara>
-  <title>Adding an application to Nixpkgs</title>
-  <para>
-   Add a Qt application to <filename>all-packages.nix</filename> using <literal>libsForQt5.callPackage</literal> instead of the usual <literal>callPackage</literal>. The former ensures that all dependencies are built with the same version of Qt.
-   <example xml:id='qt-application-all-packages-nix'>
-    <title>Adding a Qt application to <filename>all-packages.nix</filename></title>
-<programlisting>
-{
-  # ...
-
-  myapp = libsForQt5.callPackage ../path/to/myapp/ {};
-
-  # ...
-}
-</programlisting>
-   </example>
-  </para>
- </formalpara>
-</section>
--- a/doc/using/overlays.xml
+++ b/doc/using/overlays.xml
@ -28,6 +28,7 @@
   </para>

   <para>
+    NOTE: DO NOT USE THIS in nixpkgs.
    Further overlays can be added by calling the <literal>pkgs.extend</literal> or <literal>pkgs.appendOverlays</literal>, although it is often preferable to avoid these functions, because they recompute the Nixpkgs fixpoint, which is somewhat expensive to do.
   </para>
  </section>
--- a/lib/modules.nix
+++ b/lib/modules.nix
@ -265,7 +265,7 @@ rec {
      if badAttrs != {} then
        throw "Module `${key}' has an unsupported attribute `${head (attrNames badAttrs)}'. This is caused by introducing a top-level `config' or `options' attribute. Add configuration attributes immediately on the top level instead, or move all of them (namely: ${toString (attrNames badAttrs)}) into the explicit `config' attribute."
      else
-        { _file = m._file or file;
+        { _file = toString m._file or file;
          key = toString m.key or key;
          disabledModules = m.disabledModules or [];
          imports = m.imports or [];
@ -273,7 +273,7 @@ rec {
          config = addFreeformType (addMeta (m.config or {}));
        }
    else
-      { _file = m._file or file;
+      { _file = toString m._file or file;
        key = toString m.key or key;
        disabledModules = m.disabledModules or [];
        imports = m.require or [] ++ m.imports or [];
--- a/maintainers/scripts/nixpkgs-lint.pl
+++ b/maintainers/scripts/nixpkgs-lint.pl
@ -35,7 +35,7 @@ GetOptions("package|p=s" => \$filter,
    ) or exit 1;

 # Evaluate Nixpkgs into an XML representation.
-my $xml = `nix-env -f '$path' -qa '$filter' --xml --meta --drv-path`;
+my $xml = `nix-env -f '$path' --arg overlays '[]' -qa '$filter' --xml --meta --drv-path`;
 die "$0: evaluation of ‘$path’ failed\n" if $? != 0;

 my $info = XMLin($xml, KeyAttr => { 'item' => '+attrPath', 'meta' => 'name' }, ForceArray => 1, SuppressEmpty => '' ) or die "cannot parse XML output";
--- a/nixos/doc/manual/release-notes/rl-2103.xml
+++ b/nixos/doc/manual/release-notes/rl-2103.xml
@ -160,6 +160,11 @@
    <package>btc1</package> has been abandoned upstream, and removed.
    </para>
   </listitem>
+   <listitem>
+    <para>
+    <package>cpp_ethereum</package> (aleth) has been abandoned upstream, and removed.
+    </para>
+   </listitem>
   <listitem>
    <para>
    <package>riak-cs</package> package removed along with <varname>services.riak-cs</varname> module.
--- a/nixos/modules/security/doas.nix
+++ b/nixos/modules/security/doas.nix
@ -12,6 +12,7 @@ let

  mkOpts = rule: concatStringsSep " " [
    (optionalString rule.noPass "nopass")
+    (optionalString rule.noLog "nolog")
    (optionalString rule.persist "persist")
    (optionalString rule.keepEnv "keepenv")
    "setenv { SSH_AUTH_SOCK ${concatStringsSep " " rule.setEnv} }"
@ -118,6 +119,16 @@ in
              '';
            };

+            noLog = mkOption {
+              type = with types; bool;
+              default = false;
+              description = ''
+                If <code>true</code>, successful executions will not be logged
+                to
+                <citerefentry><refentrytitle>syslogd</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
+              '';
+            };
+
            persist = mkOption {
              type = with types; bool;
              default = false;
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@ -757,7 +757,7 @@ in {

    systemd.services.gitaly = {
      after = [ "network.target" "gitlab.service" ];
-      requires = [ "gitlab.service" ];
+      bindsTo = [ "gitlab.service" ];
      wantedBy = [ "multi-user.target" ];
      path = with pkgs; [
        openssh
--- a/nixos/modules/services/misc/mautrix-telegram.nix
+++ b/nixos/modules/services/misc/mautrix-telegram.nix
@ -21,6 +21,7 @@ in {
        default = {
          appservice = rec {
            database = "sqlite:///${dataDir}/mautrix-telegram.db";
+            database_opts = {};
            hostname = "0.0.0.0";
            port = 8080;
            address = "http://localhost:${toString port}";
@ -29,6 +30,8 @@ in {
          bridge = {
            permissions."*" = "relaybot";
            relaybot.whitelist = [ ];
+            double_puppet_server_map = {};
+            login_shared_secret_map = {};
          };

          logging = {
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -40,18 +40,18 @@ in
  bittorrent = handleTest ./bittorrent.nix {};
  bitwarden = handleTest ./bitwarden.nix {};
  blockbook-frontend = handleTest ./blockbook-frontend.nix {};
-  buildkite-agents = handleTest ./buildkite-agents.nix {};
  boot = handleTestOn ["x86_64-linux"] ./boot.nix {}; # syslinux is unsupported on aarch64
  boot-stage1 = handleTest ./boot-stage1.nix {};
  borgbackup = handleTest ./borgbackup.nix {};
  buildbot = handleTest ./buildbot.nix {};
+  buildkite-agents = handleTest ./buildkite-agents.nix {};
  caddy = handleTest ./caddy.nix {};
  cadvisor = handleTestOn ["x86_64-linux"] ./cadvisor.nix {};
  cage = handleTest ./cage.nix {};
  cagebreak = handleTest ./cagebreak.nix {};
  cassandra = handleTest ./cassandra.nix {};
-  ceph-single-node = handleTestOn ["x86_64-linux"] ./ceph-single-node.nix {};
  ceph-multi-node = handleTestOn ["x86_64-linux"] ./ceph-multi-node.nix {};
+  ceph-single-node = handleTestOn ["x86_64-linux"] ./ceph-single-node.nix {};
  certmgr = handleTest ./certmgr.nix {};
  cfssl = handleTestOn ["x86_64-linux"] ./cfssl.nix {};
  charliecloud = handleTest ./charliecloud.nix {};
@ -59,9 +59,9 @@ in
  cjdns = handleTest ./cjdns.nix {};
  clickhouse = handleTest ./clickhouse.nix {};
  cloud-init = handleTest ./cloud-init.nix {};
+  cockroachdb = handleTestOn ["x86_64-linux"] ./cockroachdb.nix {};
  codimd = handleTest ./codimd.nix {};
  consul = handleTest ./consul.nix {};
-  cockroachdb = handleTestOn ["x86_64-linux"] ./cockroachdb.nix {};
  containers-bridge = handleTest ./containers-bridge.nix {};
  containers-custom-pkgs.nix = handleTest ./containers-custom-pkgs.nix {};
  containers-ephemeral = handleTest ./containers-ephemeral.nix {};
@ -85,7 +85,6 @@ in
  dnscrypt-wrapper = handleTestOn ["x86_64-linux"] ./dnscrypt-wrapper {};
  doas = handleTest ./doas.nix {};
  docker = handleTestOn ["x86_64-linux"] ./docker.nix {};
-  oci-containers = handleTestOn ["x86_64-linux"] ./oci-containers.nix {};
  docker-edge = handleTestOn ["x86_64-linux"] ./docker-edge.nix {};
  docker-registry = handleTest ./docker-registry.nix {};
  docker-tools = handleTestOn ["x86_64-linux"] ./docker-tools.nix {};
@ -119,24 +118,23 @@ in
  fsck = handleTest ./fsck.nix {};
  ft2-clone = handleTest ./ft2-clone.nix {};
  gerrit = handleTest ./gerrit.nix {};
-  gotify-server = handleTest ./gotify-server.nix {};
-  grocy = handleTest ./grocy.nix {};
  gitdaemon = handleTest ./gitdaemon.nix {};
  gitea = handleTest ./gitea.nix {};
  gitlab = handleTest ./gitlab.nix {};
  gitolite = handleTest ./gitolite.nix {};
  gitolite-fcgiwrap = handleTest ./gitolite-fcgiwrap.nix {};
  glusterfs = handleTest ./glusterfs.nix {};
-  gnome3-xorg = handleTest ./gnome3-xorg.nix {};
  gnome3 = handleTest ./gnome3.nix {};
-  installed-tests = pkgs.recurseIntoAttrs (handleTest ./installed-tests {});
+  gnome3-xorg = handleTest ./gnome3-xorg.nix {};
+  go-neb = handleTest ./go-neb.nix {};
  gocd-agent = handleTest ./gocd-agent.nix {};
  gocd-server = handleTest ./gocd-server.nix {};
-  go-neb = handleTest ./go-neb.nix {};
  google-oslogin = handleTest ./google-oslogin {};
+  gotify-server = handleTest ./gotify-server.nix {};
  grafana = handleTest ./grafana.nix {};
  graphite = handleTest ./graphite.nix {};
  graylog = handleTest ./graylog.nix {};
+  grocy = handleTest ./grocy.nix {};
  grub = handleTest ./grub.nix {};
  gvisor = handleTest ./gvisor.nix {};
  hadoop.hdfs = handleTestOn [ "x86_64-linux" ] ./hadoop/hdfs.nix {};
@ -144,6 +142,8 @@ in
  handbrake = handleTestOn ["x86_64-linux"] ./handbrake.nix {};
  haproxy = handleTest ./haproxy.nix {};
  hardened = handleTest ./hardened.nix {};
+  installed-tests = pkgs.recurseIntoAttrs (handleTest ./installed-tests {});
+  oci-containers = handleTestOn ["x86_64-linux"] ./oci-containers.nix {};
  # 9pnet_virtio used to mount /nix partition doesn't support
  # hibernation. This test happens to work on x86_64-linux but
  # not on other platforms.
@ -160,8 +160,8 @@ in
  ihatemoney = handleTest ./ihatemoney.nix {};
  incron = handleTest ./incron.nix {};
  influxdb = handleTest ./influxdb.nix {};
-  initrd-network-ssh = handleTest ./initrd-network-ssh {};
  initrd-network-openvpn = handleTest ./initrd-network-openvpn {};
+  initrd-network-ssh = handleTest ./initrd-network-ssh {};
  initrdNetwork = handleTest ./initrd-network.nix {};
  installer = handleTest ./installer.nix {};
  iodine = handleTest ./iodine.nix {};
@ -201,8 +201,8 @@ in
  lxd-nftables = handleTest ./lxd-nftables.nix {};
  #logstash = handleTest ./logstash.nix {};
  lorri = handleTest ./lorri/default.nix {};
-  magnetico = handleTest ./magnetico.nix {};
  magic-wormhole-mailbox-server = handleTest ./magic-wormhole-mailbox-server.nix {};
+  magnetico = handleTest ./magnetico.nix {};
  mailcatcher = handleTest ./mailcatcher.nix {};
  mariadb-galera-mariabackup = handleTest ./mysql/mariadb-galera-mariabackup.nix {};
  mariadb-galera-rsync = handleTest ./mysql/mariadb-galera-rsync.nix {};
@ -213,9 +213,9 @@ in
  metabase = handleTest ./metabase.nix {};
  minecraft = handleTest ./minecraft.nix {};
  minecraft-server = handleTest ./minecraft-server.nix {};
+  minidlna = handleTest ./minidlna.nix {};
  miniflux = handleTest ./miniflux.nix {};
  minio = handleTest ./minio.nix {};
-  minidlna = handleTest ./minidlna.nix {};
  misc = handleTest ./misc.nix {};
  moinmoin = handleTest ./moinmoin.nix {};
  mongodb = handleTest ./mongodb.nix {};
@ -240,10 +240,10 @@ in
  ncdns = handleTest ./ncdns.nix {};
  ndppd = handleTest ./ndppd.nix {};
  neo4j = handleTest ./neo4j.nix {};
-  specialisation = handleTest ./specialisation.nix {};
  netdata = handleTest ./netdata.nix {};
  networking.networkd = handleTest ./networking.nix { networkd = true; };
  networking.scripted = handleTest ./networking.nix { networkd = false; };
+  specialisation = handleTest ./specialisation.nix {};
  # TODO: put in networking.nix after the test becomes more complete
  networkingProxy = handleTest ./networking-proxy.nix {};
  nextcloud = handleTest ./nextcloud {};
@ -269,8 +269,8 @@ in
  openldap = handleTest ./openldap.nix {};
  opensmtpd = handleTest ./opensmtpd.nix {};
  openssh = handleTest ./openssh.nix {};
-  openstack-image-userdata = (handleTestOn ["x86_64-linux"] ./openstack-image.nix {}).userdata or {};
  openstack-image-metadata = (handleTestOn ["x86_64-linux"] ./openstack-image.nix {}).metadata or {};
+  openstack-image-userdata = (handleTestOn ["x86_64-linux"] ./openstack-image.nix {}).userdata or {};
  orangefs = handleTest ./orangefs.nix {};
  os-prober = handleTestOn ["x86_64-linux"] ./os-prober.nix {};
  osrm-backend = handleTest ./osrm-backend.nix {};
@ -280,6 +280,7 @@ in
  pam-u2f = handleTest ./pam-u2f.nix {};
  pantheon = handleTest ./pantheon.nix {};
  paperless = handleTest ./paperless.nix {};
+  pdns-recursor = handleTest ./pdns-recursor.nix {};
  peerflix = handleTest ./peerflix.nix {};
  pgjwt = handleTest ./pgjwt.nix {};
  pgmanage = handleTest ./pgmanage.nix {};
@ -339,9 +340,9 @@ in
  snapper = handleTest ./snapper.nix {};
  sogo = handleTest ./sogo.nix {};
  solr = handleTest ./solr.nix {};
+  sonarr = handleTest ./sonarr.nix {};
  spacecookie = handleTest ./spacecookie.nix {};
  spike = handleTest ./spike.nix {};
-  sonarr = handleTest ./sonarr.nix {};
  sslh = handleTest ./sslh.nix {};
  sssd = handleTestOn ["x86_64-linux"] ./sssd.nix {};
  sssd-ldap = handleTestOn ["x86_64-linux"] ./sssd-ldap.nix {};
@ -358,13 +359,12 @@ in
  systemd-boot = handleTest ./systemd-boot.nix {};
  systemd-confinement = handleTest ./systemd-confinement.nix {};
  systemd-journal = handleTest ./systemd-journal.nix {};
-  systemd-timesyncd = handleTest ./systemd-timesyncd.nix {};
-  systemd-networkd-vrf = handleTest ./systemd-networkd-vrf.nix {};
  systemd-networkd = handleTest ./systemd-networkd.nix {};
  systemd-networkd-dhcpserver = handleTest ./systemd-networkd-dhcpserver.nix {};
  systemd-networkd-ipv6-prefix-delegation = handleTest ./systemd-networkd-ipv6-prefix-delegation.nix {};
+  systemd-networkd-vrf = handleTest ./systemd-networkd-vrf.nix {};
  systemd-nspawn = handleTest ./systemd-nspawn.nix {};
-  pdns-recursor = handleTest ./pdns-recursor.nix {};
+  systemd-timesyncd = handleTest ./systemd-timesyncd.nix {};
  taskserver = handleTest ./taskserver.nix {};
  telegraf = handleTest ./telegraf.nix {};
  tiddlywiki = handleTest ./tiddlywiki.nix {};
@ -372,15 +372,16 @@ in
  tinydns = handleTest ./tinydns.nix {};
  tor = handleTest ./tor.nix {};
  # traefik test relies on docker-containers
+  trac = handleTest ./trac.nix {};
  traefik = handleTestOn ["x86_64-linux"] ./traefik.nix {};
  transmission = handleTest ./transmission.nix {};
-  trac = handleTest ./trac.nix {};
-  trilium-server = handleTestOn ["x86_64-linux"] ./trilium-server.nix {};
  trezord = handleTest ./trezord.nix {};
  trickster = handleTest ./trickster.nix {};
+  trilium-server = handleTestOn ["x86_64-linux"] ./trilium-server.nix {};
  tuptime = handleTest ./tuptime.nix {};
-  unbound = handleTest ./unbound.nix {};
+  ucg = handleTest ./ucg.nix {};
  udisks2 = handleTest ./udisks2.nix {};
+  unbound = handleTest ./unbound.nix {};
  unit-php = handleTest ./web-servers/unit-php.nix {};
  upnp = handleTest ./upnp.nix {};
  uwsgi = handleTest ./uwsgi.nix {};
--- a/nixos/tests/ucg.nix
+++ b/nixos/tests/ucg.nix
@ -0,0 +1,18 @@
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "ucg";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ AndersonTorres ];
+  };
+
+  machine = { pkgs, ... }: {
+    environment.systemPackages = [ pkgs.ucg ];
+  };
+
+  testScript = ''
+    machine.succeed("echo 'Lorem ipsum dolor sit amet\n2.7182818284590' > /tmp/foo")
+    assert "dolor" in machine.succeed("ucg 'dolor' /tmp/foo")
+    assert "Lorem" in machine.succeed("ucg --ignore-case 'lorem' /tmp/foo")
+    machine.fail("ucg --word-regexp '2718' /tmp/foo")
+    machine.fail("ucg 'pisum' /tmp/foo")
+  '';
+})
--- a/pkgs/applications/audio/cadence/default.nix
+++ b/pkgs/applications/audio/cadence/default.nix
@ -96,5 +96,7 @@ mkDerivation rec {
    license = stdenv.lib.licenses.gpl2Plus;
    maintainers = with stdenv.lib.maintainers; [ worldofpeace ];
    platforms = [ "x86_64-linux" ];
+    # Needs QT 5.14
+    broken = true;
  };
 }
--- a/pkgs/applications/blockchains/ledger-live-desktop/default.nix
+++ b/pkgs/applications/blockchains/ledger-live-desktop/default.nix
@ -2,12 +2,12 @@

 let
  pname = "ledger-live-desktop";
-  version = "2.16.0";
+  version = "2.17.1";
  name = "${pname}-${version}";

  src = fetchurl {
    url = "https://github.com/LedgerHQ/${pname}/releases/download/v${version}/${pname}-${version}-linux-x86_64.AppImage";
-    sha256 = "16z2cy41vxbrvjblj09in6669pks1p9y3rgx8b7afjwf102ba9yi";
+    sha256 = "1r0cl4jfgg0b3zr46bh9dhhg2qgsh3xj99w3ryyjdxydfvychvz8";
  };

  appimageContents = appimageTools.extractType2 {
@ -30,8 +30,7 @@ in appimageTools.wrapType2 rec {
    description = "Wallet app for Ledger Nano S and Ledger Blue";
    homepage = "https://www.ledger.com/live";
    license = licenses.mit;
-    maintainers = with maintainers; [ thedavidmeister nyanloutre RaghavSood ];
+    maintainers = with maintainers; [ thedavidmeister nyanloutre RaghavSood th0rgal ];
    platforms = [ "x86_64-linux" ];
  };
 }
-
--- a/pkgs/applications/editors/kakoune/plugins/default.nix
+++ b/pkgs/applications/editors/kakoune/plugins/default.nix
@ -12,4 +12,5 @@
  kak-powerline = pkgs.callPackage ./kak-powerline.nix { };
  kak-prelude = pkgs.callPackage ./kak-prelude.nix { };
  kak-vertical-selection = pkgs.callPackage ./kak-vertical-selection.nix { };
+  openscad-kak = pkgs.callPackage ./openscad.kak.nix { };
 }
--- a/pkgs/applications/editors/kakoune/plugins/openscad.kak.nix
+++ b/pkgs/applications/editors/kakoune/plugins/openscad.kak.nix
@ -0,0 +1,25 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation {
+  pname = "openscad.kak";
+  version = "unstable-2019-11-08";
+
+  src = fetchFromGitHub {
+    owner = "mayjs";
+    repo = "openscad.kak";
+    rev = "d9143d5e7834e3356b49720664d5647cab9db7cc";
+    sha256 = "0j4dqhrn56z77hdalfdxagwz8h6nwr8s9i4w0bs2644k72lsm2ix";
+  };
+
+  installPhase = ''
+    install -Dm644 rc/openscad.kak -t $out/share/kak/autoload/plugins/
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Syntax highlighting for OpenSCAD files";
+    homepage = "https://github.com/mayjs/openscad.kak";
+    license = licenses.unlicense;
+    maintainers = with maintainers; [ eraserhd ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/applications/gis/qgis/unwrapped.nix
+++ b/pkgs/applications/gis/qgis/unwrapped.nix
@ -53,5 +53,8 @@ in mkDerivation rec {
    license = lib.licenses.gpl2Plus;
    platforms = with lib.platforms; linux;
    maintainers = with lib.maintainers; [ lsix ];
+    # Our 3.10 LTS cannot use a newer Qt (5.15) version because it requires qtwebkit
+    # and our qtwebkit fails to build with 5.15. 01bcfd3579219d60e5d07df309a000f96b2b658b
+    broken = true;
  };
 }
--- a/pkgs/applications/graphics/fondo/default.nix
+++ b/pkgs/applications/graphics/fondo/default.nix
@ -21,13 +21,13 @@

 stdenv.mkDerivation rec {
  pname = "fondo";
-  version = "1.3.10";
+  version = "1.4.0";

  src = fetchFromGitHub {
    owner = "calo001";
    repo = pname;
    rev = version;
-    sha256 = "0yrbcngmwhn5gl5if9w2cx8shh33zk5fd6iqwnapsq8y0lzq6ppr";
+    sha256 = "0cdcn4qmdryk2x327f1z3pq8pg4cb0q1jr779gh8s6nqajyk8nqm";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/graphics/renderdoc/default.nix
+++ b/pkgs/applications/graphics/renderdoc/default.nix
@ -13,14 +13,14 @@ let
  pythonPackages = python3Packages;
 in
 mkDerivation rec {
-  version = "1.10";
+  version = "1.11";
  pname = "renderdoc";

  src = fetchFromGitHub {
    owner = "baldurk";
    repo = "renderdoc";
    rev = "v${version}";
-    sha256 = "1ibf2lv3q69fkzv1nsva2mbdjlayrpxicrd96d9nfcw64f2mv6ds";
+    sha256 = "01r4fq03fpyhwvn47wx3dw29vcadcd0qml00h36q38cq3pi9x42j";
  };

  buildInputs = [
--- a/pkgs/applications/misc/archivy/default.nix
+++ b/pkgs/applications/misc/archivy/default.nix
@ -0,0 +1,57 @@
+{ stdenv, lib, python3, fetchPypi, appdirs, attrs, requests,
+beautifulsoup4, click-plugins, elasticsearch, flask_login, flask_wtf,
+pypandoc, python-dotenv, python-frontmatter, tinydb, validators,
+watchdog, wtforms }:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "archivy";
+  version = "0.8.5";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "144ckgxjaw29yp5flyxd1rnkm7hlim4zgy6xng7x0a9j54h527iq";
+  };
+
+  # Relax some dependencies
+  postPatch = ''
+    substituteInPlace requirements.txt \
+      --replace 'validators ==' 'validators >=' \
+      --replace 'elasticsearch ==' 'elasticsearch >=' \
+      --replace 'python-dotenv ==' 'python-dotenv >=' \
+      --replace 'beautifulsoup4 ==' 'beautifulsoup4 >=' \
+      --replace 'WTForms ==' 'WTForms >=' \
+      --replace 'python_dotenv ==' 'python_dotenv >=' \
+      --replace 'attrs == 20.2.0' 'attrs' \
+      --replace 'python_frontmatter == 0.5.0' 'python_frontmatter' \
+      --replace 'requests ==' 'requests >='
+  '';
+
+  propagatedBuildInputs = [
+    appdirs
+    attrs
+    beautifulsoup4
+    click-plugins
+    elasticsearch
+    flask_login
+    flask_wtf
+    pypandoc
+    python-dotenv
+    python-frontmatter
+    tinydb
+    requests
+    validators
+    watchdog
+    wtforms
+  ];
+
+  # __init__.py attempts to mkdir in read-only file system
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "Self-hosted knowledge repository";
+    homepage = "https://archivy.github.io";
+    license = licenses.mit;
+    maintainers = with maintainers; [ siraben ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/applications/misc/cheat/default.nix
+++ b/pkgs/applications/misc/cheat/default.nix
@ -3,13 +3,13 @@

 buildGoModule rec {
  pname = "cheat";
-  version = "4.1.1";
+  version = "4.2.0";

  src = fetchFromGitHub {
    owner = "cheat";
    repo = "cheat";
    rev = version;
-    sha256 = "0mraraby0s213ay2ahqsdvnyg76awbqllrkkx17mrx9z3ykba62d";
+    sha256 = "sha256-Q/frWu82gB15LEzwYCbJr7k0yZ+AXBvcPWxoevSpeqU=";
  };

  subPackages = [ "cmd/cheat" ];
--- a/pkgs/applications/misc/cpp-ethereum/default.nix
+++ b/pkgs/applications/misc/cpp-ethereum/default.nix
@ -1,85 +0,0 @@
-{ stdenv
-, fetchFromGitHub
-, cmake
-, jsoncpp
-, libjson-rpc-cpp
-, curl
-, boost
-, leveldb
-, cryptopp
-, libcpuid
-, opencl-headers
-, ocl-icd
-, miniupnpc
-, libmicrohttpd
-, gmp
-, libGLU, libGL
-, extraCmakeFlags ? []
-}:
-stdenv.mkDerivation rec {
-  pname = "cpp-ethereum";
-  version = "1.3.0";
-
-  src = fetchFromGitHub {
-    owner = "ethereum";
-    repo = "cpp-ethereum";
-    rev = "62ab9522e58df9f28d2168ea27999a214b16ea96";
-    sha256 = "1fxgpqhmjhpv0zzs1m3yf9h8mh25dqpa7pmcfy7f9qiqpfdr4zq9";
-  };
-
-  cmakeFlags = [ "-DCMAKE_BUILD_TYPE=Release" extraCmakeFlags ];
-
-  configurePhase = ''
-    export BOOST_INCLUDEDIR=${boost.dev}/include
-    export BOOST_LIBRARYDIR=${boost.out}/lib
-
-    mkdir -p Build/Install
-    pushd Build
-
-    cmake .. -DCMAKE_INSTALL_PREFIX=$(pwd)/Install $cmakeFlags
-  '';
-
-  enableParallelBuilding = true;
-
-  runPath = with stdenv.lib; makeLibraryPath ([ stdenv.cc.cc ] ++ buildInputs);
-
-  installPhase = ''
-    make install
-
-    mkdir -p $out
-
-    for f in Install/lib/*.so* $(find Install/bin -executable -type f); do
-      patchelf --set-rpath $runPath:$out/lib $f
-    done
-
-    cp -r Install/* $out
-  '';
-
-  buildInputs = [
-    cmake
-    jsoncpp
-    libjson-rpc-cpp
-    curl
-    boost
-    leveldb
-    cryptopp
-    libcpuid
-    opencl-headers
-    ocl-icd
-    miniupnpc
-    libmicrohttpd
-    gmp
-    libGLU libGL
-  ];
-
-  dontStrip = true;
-
-  meta = with stdenv.lib; {
-    description = "Ethereum C++ client";
-    homepage = "https://github.com/ethereum/cpp-ethereum";
-    license = licenses.gpl3;
-    maintainers = with maintainers; [ artuuge ];
-    platforms = platforms.linux;
-    broken = true; # 2018-04-10
-  };
-}
--- a/pkgs/applications/misc/gallery-dl/default.nix
+++ b/pkgs/applications/misc/gallery-dl/default.nix
@ -1,27 +1,28 @@
-{ lib, python3Packages }:
+{ lib, buildPythonApplication, fetchPypi, requests, pytestCheckHook }:

-python3Packages.buildPythonApplication rec {
+buildPythonApplication rec {
  pname = "gallery_dl";
-  version = "1.15.2";
+  version = "1.15.4";

-  src = python3Packages.fetchPypi {
+  src = fetchPypi {
    inherit pname version;
-    sha256 = "0f2d1ixg0ir7ispxxggv378dc0m55k9y19075swf893maxf07f35";
+    sha256 = "0byn1ggrb9yg9d29205q312v95jy66qp4z384kys8cmrd3mky111";
  };

-  propagatedBuildInputs = with python3Packages; [ requests ];
+  propagatedBuildInputs = [ requests ];

-  checkInputs = with python3Packages; [ pytestCheckHook ];
+  checkInputs = [ pytestCheckHook ];
  pytestFlagsArray = [
    # requires network access
    "--ignore=test/test_results.py"
    "--ignore=test/test_downloader.py"
  ];

-  meta = {
+  meta = with lib; {
    description = "Command-line program to download image-galleries and -collections from several image hosting sites";
    homepage = "https://github.com/mikf/gallery-dl";
-    license = lib.licenses.gpl2;
-    maintainers = with lib.maintainers; [ dawidsowa ];
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ dawidsowa ];
+    platforms = platforms.unix;
  };
 }
--- a/pkgs/applications/misc/gpx/default.nix
+++ b/pkgs/applications/misc/gpx/default.nix
@ -2,7 +2,7 @@

 stdenv.mkDerivation rec {
  pname = "gpx";
-  version = "2.6.7";
+  version = "2.6.8";

  nativeBuildInputs = [ autoreconfHook ];

@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
    owner = "markwal";
    repo = "GPX";
    rev = version;
-    sha256 = "1dl5vlsx05ipy10h18xigicb3k7m33sa9hfyd46hkpr2glx7jh4p";
+    sha256 = "1izs8s5npkbfrsyk17429hyl1vyrbj9dp6vmdlbb2vh6mfgl54h8";
  };

  meta = {
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "hugo";
-  version = "0.78.2";
+  version = "0.79.0";

  src = fetchFromGitHub {
    owner = "gohugoio";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1xjxyx520wa6sgvighjp82qqfi0ykfskp0za5j95167c56ss8lm4";
+    sha256 = "0i9c12w0jlfrqb5gygfn20rn41m7qy6ab03n779wbzwfqqz85mj6";
  };

-  vendorSha256 = "00jjcw76l12ppx3q1xhly7q10jfi2kx62a8z3r1k7m2593k8c4vq";
+  vendorSha256 = "0jb6aqdv9yx7fxbkgd73rx6kvxagxscrin5b5bal3ig7ys1ghpsp";

  doCheck = false;

--- a/pkgs/applications/misc/keeweb/default.nix
+++ b/pkgs/applications/misc/keeweb/default.nix
@ -4,7 +4,7 @@ let
  throwSystem = throw "Unsupported system: ${system}";

  pname = "keeweb";
-  version = "1.15.7";
+  version = "1.16.0";
  name = "${pname}-${version}";

  suffix = {
@ -15,8 +15,8 @@ let
  src = fetchurl {
    url = "https://github.com/keeweb/keeweb/releases/download/v${version}/KeeWeb-${version}.${suffix}";
    sha256 = {
-      x86_64-linux = "0cy0avl0m07xs523xm0rzsmifl28sv4rjb2jj3x492qmr2v64ckk";
-      x86_64-darwin = "0r8c3zi0ibj0bb0gfc1axfn0y4qpjqfr0xpcxf810d65kaz6wic4";
+      x86_64-linux = "1pivic7n5nv00s8bb51i2jz2mxgjn92hkc8n0p8662ai1cdng47g";
+      x86_64-darwin = "0q6k0qgkgzid9yjbfsfpp8l9dr0n8xp25a4jf2bxwickm4irs9mz";
    }.${system} or throwSystem;
  };

--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@ -118,6 +118,7 @@ buildStdenv.mkDerivation ({

  patches = [
    ./env_var_for_system_dir.patch
+    ./no-buildconfig-ffx76.patch
  ] ++

  # there are two flavors of pipewire support
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@ -1,4 +1,4 @@
-{ config, stdenv, lib, callPackage, fetchurl, nss_3_44 }:
+{ stdenv, lib, callPackage, fetchurl, fetchpatch }:

 let
  common = opts: callPackage (import ./common.nix opts) {};
@ -14,7 +14,14 @@ rec {
    };

    patches = [
-      ./no-buildconfig-ffx76.patch
+      # Fix compilation on aarch64 with newer rust version
+      # See https://bugzilla.mozilla.org/show_bug.cgi?id=1677690
+      # and https://bugzilla.redhat.com/show_bug.cgi?id=1897675
+      (fetchpatch {
+        name = "aarch64-simd-bgz-1677690.patch";
+        url = "https://github.com/mozilla/gecko-dev/commit/71597faac0fde4f608a60dd610d0cefac4972cc3.patch";
+        sha256 = "1f61nsgbv2c2ylgjs7wdahxrrlgc19gjy5nzs870zr1g832ybwin";
+      })
    ];

    meta = {
@ -41,10 +48,6 @@ rec {
      sha512 = "20h53cn7p4dds1yfm166iwbjdmw4fkv5pfk4z0pni6x8ddjvg19imzs6ggmpnfhaji8mnlknm7xp5j7x9vi24awvdxdds5n88rh25hd";
    };

-    patches = [
-      ./no-buildconfig-ffx76.patch
-    ];
-
    meta = {
      description = "A web browser built from Firefox Extended Support Release source tree";
      homepage = "http://www.mozilla.com/en-US/firefox/";
--- a/pkgs/applications/networking/mailreaders/inboxer/default.nix
+++ b/pkgs/applications/networking/mailreaders/inboxer/default.nix
@ -4,7 +4,7 @@

 stdenv.mkDerivation rec {
  pname = "inboxer";
-  version = "1.2.1";
+  version = "1.2.3";

  meta = with stdenv.lib; {
    description = "Unofficial, free and open-source Google Inbox Desktop App";
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://github.com/denysdovhan/inboxer/releases/download/v${version}/inboxer_${version}_amd64.deb";
-    sha256 = "0nyxas07d6ckgjazxapmc6iyakd2cddla6wflr5rhfp78d7kax3a";
+    sha256 = "1ak8sr9sc0fkbrmfynxivbn9csrbyly4fhjlk7kx10aq8hk893a7";
  };

  unpackPhase = ''
--- a/pkgs/applications/networking/p2p/magnetico/default.nix
+++ b/pkgs/applications/networking/p2p/magnetico/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "magnetico";
-  version = "0.11.0";
+  version = "0.12.0";

  src = fetchFromGitHub {
    owner  = "boramalper";
    repo   = "magnetico";
    rev    = "v${version}";
-    sha256 = "1622xcl5v67lrnkjwbg7g5b5ikrawx7p91jxbj3ixc1za2f3a3fn";
+    sha256 = "1avqnfn4llmc9xmpsjfc9ivki0cfvd8sljfzd9yac94xcj581s83";
  };

-  vendorSha256 = "0g4m0jnpy0q64xnflphyc0lmhni0q9448h7grbbr7f1s9lpqsjml";
+  vendorSha256 = "087kikj6sjhjxqymnj7bpxawfmwckihi6mbmi39w0bn2040aflx5";

  nativeBuildInputs = [ go-bindata ];
  buildPhase = ''
--- a/pkgs/applications/networking/twtxt/default.nix
+++ b/pkgs/applications/networking/twtxt/default.nix
@ -0,0 +1,24 @@
+{ stdenv, lib, fetchFromGitHub, buildGoModule }:
+
+buildGoModule rec {
+  pname = "twtxt";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "jointwt";
+    repo = pname;
+    rev = version;
+    sha256 = "15jhfnhpk34nmad04f7xz1w041dba8cn17hq46p9n5sarjgkjiiw";
+  };
+
+  vendorSha256 = "1lnf8wd2rv9d292rp8jndfdg0rjs6gfw0yg49l9spw4yzifnd7f7";
+
+  subPackages = [ "cmd/twt" "cmd/twtd" ];
+
+  meta = with lib; {
+    description = "Self-hosted, Twitter-like decentralised microblogging platform";
+    homepage = "https://github.com/jointwt/twtxt";
+    license = licenses.mit;
+    maintainers = with maintainers; [ siraben ];
+  };
+}
--- a/pkgs/applications/office/portfolio/default.nix
+++ b/pkgs/applications/office/portfolio/default.nix
@ -24,11 +24,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "PortfolioPerformance";
-  version = "0.49.2";
+  version = "0.49.3";

  src = fetchurl {
    url = "https://github.com/buchen/portfolio/releases/download/${version}/PortfolioPerformance-${version}-linux.gtk.x86_64.tar.gz";
-    sha256 = "0c2ixzwbc094wqc2lyrh3w1azswg6xz3wdh8l4lbkiw02s9czhhn";
+    sha256 = "1j8d3bih2hs1c1a6pjqpmdlh2hbj76s00srl0f850d06jhldg3p6";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/biology/bwa/default.nix
+++ b/pkgs/applications/science/biology/bwa/default.nix
@ -11,6 +11,12 @@ stdenv.mkDerivation rec {

  buildInputs = [ zlib ];

+  # Avoid hardcoding gcc to allow environments with a different
+  # C compiler to build
+  preConfigure = ''
+    sed -i '/^CC/d' Makefile
+  '';
+
  # it's unclear which headers are intended to be part of the public interface
  # so we may find ourselves having to add more here over time
  installPhase = ''
@ -27,6 +33,6 @@ stdenv.mkDerivation rec {
    license     = licenses.gpl3;
    homepage    = "http://bio-bwa.sourceforge.net/";
    maintainers = with maintainers; [ luispedro ];
-    platforms = [ "x86_64-linux" ];
+    platforms = platforms.x86_64;
  };
 }
--- a/pkgs/applications/science/chemistry/openmolcas/default.nix
+++ b/pkgs/applications/science/chemistry/openmolcas/default.nix
@ -20,7 +20,7 @@ in stdenv.mkDerivation {
    owner = "Molcas";
    repo = "OpenMolcas";
    rev = gitLabRev;
-    sha256 = "1w8av44dx5r9yp2xhf9ypdrhappvk984wrd5pa1ww0qv6j2446ic";
+    sha256 = "0xr9plgb0cfmxxqmd3wrhvl0hv2jqqfqzxwzs1jysq2m9cxl314v";
  };

  patches = [
--- a/pkgs/applications/science/logic/proverif/default.nix
+++ b/pkgs/applications/science/logic/proverif/default.nix
@ -16,6 +16,7 @@ stdenv.mkDerivation rec {
    mkdir -p $out/bin
    cp ./proverif      $out/bin
    cp ./proveriftotex $out/bin
+    install -D -t $out/share/emacs/site-lisp/ emacs/proverif.el
  '';

  meta = {
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@ -1,11 +1,11 @@
 {
-  "version": "13.6.0",
-  "repo_hash": "1flri1cgx8drwf46x4sja366aiiif0ww807xrrcxa05pxj0mx8k5",
+  "version": "13.6.1",
+  "repo_hash": "0kfh9ngykrnvvjpx4m69pfyfvsvvqfxzlxhm8dgx9ypz4bpmr947",
  "owner": "gitlab-org",
  "repo": "gitlab",
-  "rev": "v13.6.0-ee",
+  "rev": "v13.6.1-ee",
  "passthru": {
-    "GITALY_SERVER_VERSION": "13.6.0",
+    "GITALY_SERVER_VERSION": "13.6.1",
    "GITLAB_PAGES_VERSION": "1.30.0",
    "GITLAB_SHELL_VERSION": "13.13.0",
    "GITLAB_WORKHORSE_VERSION": "8.54.0"
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@ -1,5 +1,7 @@
-{ stdenv, fetchFromGitLab, fetchFromGitHub, buildGoPackage, ruby,
-  bundlerEnv, pkgconfig, libgit2_0_27 }:
+{ stdenv, fetchFromGitLab, fetchFromGitHub, buildGoModule, ruby
+, bundlerEnv, pkgconfig
+# libgit2 + dependencies
+, libgit2, openssl, zlib, pcre, http-parser }:

 let
  rubyEnv = bundlerEnv rec {
@ -18,27 +20,27 @@ let
        };
      };
  };
-in buildGoPackage rec {
-  version = "13.6.0";
+in buildGoModule rec {
+  version = "13.6.1";
  pname = "gitaly";

  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitaly";
    rev = "v${version}";
-    sha256 = "1b3vjg5sxrg8cfxn1nh8j26h847kxrfnn2chbb5v3ivhp1kp6zh2";
+    sha256 = "02w7pf7l9sr2nk8ky9b0d5b4syx3d9my65h2kzvh2afk7kv35h5y";
  };

-  goPackagePath = "gitlab.com/gitlab-org/gitaly";
+  vendorSha256 = "15mx5g2wa93sajbdwh58wcspg0n51d1ciwb7f15d0nm5hspz3w9r";

  passthru = {
    inherit rubyEnv;
  };

+  buildFlags = [ "-tags=static,system_libgit2" ];
  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ rubyEnv.wrappedRuby libgit2_0_27 ];
-  goDeps = ./deps.nix;
-  preBuild = "rm -rf go/src/gitlab.com/gitlab-org/labkit/vendor";
+  buildInputs = [ rubyEnv.wrappedRuby libgit2 openssl zlib pcre http-parser ];
+  doCheck = false;

  postInstall = ''
    mkdir -p $ruby
--- a/pkgs/applications/version-management/gitlab/gitaly/deps.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/deps.nix
--- a/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
@ -1,6 +1,6 @@
-{ stdenv, fetchFromGitLab, buildGoPackage, ruby }:
+{ stdenv, fetchFromGitLab, buildGoModule, ruby }:

-buildGoPackage rec {
+buildGoModule rec {
  pname = "gitlab-shell";
  version = "13.13.0";
  src = fetchFromGitLab {
@ -14,17 +14,13 @@ buildGoPackage rec {

  patches = [ ./remove-hardcoded-locations.patch ];

-  goPackagePath = "gitlab.com/gitlab-org/gitlab-shell";
-  goDeps = ./deps.nix;
-
-  preBuild = ''
-    rm -rf "$NIX_BUILD_TOP/go/src/gitlab.com/gitlab-org/labkit/vendor"
-  '';
+  vendorSha256 = "16fa3bka0008x2yazahc6xxcv4fa6yqg74kk64v8lrp7snbvjf4d";

  postInstall = ''
-    cp -r "$NIX_BUILD_TOP/go/src/$goPackagePath"/bin/* $out/bin
-    cp -r "$NIX_BUILD_TOP/go/src/$goPackagePath"/{support,VERSION} $out/
+    cp -r "$NIX_BUILD_TOP/source"/bin/* $out/bin
+    cp -r "$NIX_BUILD_TOP/source"/{support,VERSION} $out/
  '';
+  doCheck = false;

  meta = with stdenv.lib; {
    description = "SSH access and repository management app for GitLab";
--- a/pkgs/applications/version-management/gitlab/gitlab-shell/deps.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-shell/deps.nix
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@ -1,6 +1,6 @@
-{ stdenv, fetchFromGitLab, git, buildGoPackage }:
+{ stdenv, fetchFromGitLab, git, buildGoModule }:

-buildGoPackage rec {
+buildGoModule rec {
  pname = "gitlab-workhorse";

  version = "8.54.0";
@ -12,10 +12,10 @@ buildGoPackage rec {
    sha256 = "0fz00sl9q4d3vbslh7y9nsnhjshgfg0x7mv7b7a9sc3mxmabp7gz";
  };

-  goPackagePath = "gitlab.com/gitlab-org/gitlab-workhorse";
-  goDeps = ./deps.nix;
+  vendorSha256 = "0wi6vj9phwh0bsdk2lrgq807nb90iivlm0bkdjkim06jq068mizj";
  buildInputs = [ git ];
  buildFlagsArray = "-ldflags=-X main.Version=${version}";
+  doCheck = false;

  meta = with stdenv.lib; {
    homepage = "http://www.gitlab.com/";
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/deps.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/deps.nix
--- a/pkgs/applications/video/openshot-qt/default.nix
+++ b/pkgs/applications/video/openshot-qt/default.nix
@ -55,5 +55,8 @@ mkDerivationWith python3Packages.buildPythonApplication rec {
    license = with licenses; gpl3Plus;
    maintainers = with maintainers; [ AndersonTorres ];
    platforms = with platforms; unix;
+    # Cannot use a newer Qt (5.15) version because it requires qtwebkit
+    # and our qtwebkit fails to build with 5.15. 01bcfd3579219d60e5d07df309a000f96b2b658b
+    broken = true;
  };
 }
--- a/pkgs/applications/video/qmplay2/default.nix
+++ b/pkgs/applications/video/qmplay2/default.nix
@ -0,0 +1,74 @@
+{ stdenv
+, fetchFromGitHub
+, pkg-config
+, cmake
+, alsaLib
+, ffmpeg
+, libass
+, libcddb
+, libcdio
+, libgme
+, libpulseaudio
+, libsidplayfp
+, libva
+, libXv
+, taglib
+, qtbase
+, qttools
+, vulkan-headers
+, vulkan-tools
+, wrapQtAppsHook
+}:
+
+let
+  pname = "qmplay2";
+  version = "20.07.04";
+in stdenv.mkDerivation {
+  inherit pname version;
+
+  src = fetchFromGitHub {
+    owner = "zaps166";
+    repo = "QMPlay2";
+    rev = version;
+    sha256 = "sha256-sUDucxSvsdD2C2FSVrrXeHdNdrjECtJSXVr106OdHzA=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [ cmake pkg-config wrapQtAppsHook ];
+  buildInputs = [
+    alsaLib
+    ffmpeg
+    libass
+    libcddb
+    libcdio
+    libgme
+    libpulseaudio
+    libsidplayfp
+    libva
+    libXv
+    qtbase
+    qttools
+    taglib
+    vulkan-headers
+    vulkan-tools
+  ];
+
+  postInstall = ''
+    # Because we think it is better to use only lowercase letters!
+    ln -s $out/bin/QMPlay2 $out/bin/qmplay2
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/zaps166/QMPlay2/";
+    description = "Qt-based Multimedia player";
+    longDescription = ''
+      QMPlay2 is a video and audio player. It can play all formats supported by
+      FFmpeg, libmodplug (including J2B and SFX). It also supports Audio CD, raw
+      files, Rayman 2 music and chiptunes. It contains YouTube and MyFreeMP3
+      browser.
+    '';
+    license = licenses.lgpl3Plus;
+    maintainers = with maintainers; [ AndersonTorres ];
+    platforms = with platforms; linux;
+  };
+}
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@ -100,6 +100,15 @@ stdenv.mkDerivation rec {
    })
  ];

+  # Remove CVE-2020-{29129,29130} for QEMU >5.1.0
+  postPatch = ''
+    (cd slirp && patch -p1 < ${fetchpatch {
+      name = "CVE-2020-29129_CVE-2020-29130.patch";
+      url = "https://gitlab.freedesktop.org/slirp/libslirp/-/commit/2e1dcbc0c2af64fcb17009eaf2ceedd81be2b27f.patch";
+      sha256 = "01vbjqgnc0kp881l5p6b31cyyirhwhavm6x36hlgkymswvl3wh9w";
+    }})
+  '';
+
  hardeningDisable = [ "stackprotector" ];

  preConfigure = ''
--- a/pkgs/build-support/rust/build-rust-crate/default.nix
+++ b/pkgs/build-support/rust/build-rust-crate/default.nix
@ -54,6 +54,10 @@ let
   };

   installCrate = import ./install-crate.nix { inherit stdenv; };
+
+   # Allow access to the rust attribute set from inside buildRustCrate, which
+   # has a parameter that shadows the name.
+   rustAttrs = rust;
 in

 /* The overridable pkgs.buildRustCrate function.
@ -250,7 +254,7 @@ stdenv.mkDerivation (rec {
      depsMetadata = lib.foldl' (str: dep: str + dep.metadata) "" (dependencies ++ buildDependencies);
      hashedMetadata = builtins.hashString "sha256"
        (crateName + "-" + crateVersion + "___" + toString (mkRustcFeatureArgs crateFeatures) +
-          "___" + depsMetadata);
+          "___" + depsMetadata + "___" + rustAttrs.toRustTarget stdenv.hostPlatform);
      in lib.substring 0 10 hashedMetadata;

    build = crate.build or "";
--- a/pkgs/data/fonts/iosevka/bin.nix
+++ b/pkgs/data/fonts/iosevka/bin.nix
@ -10,7 +10,7 @@ let
    (builtins.attrNames (builtins.removeAttrs variantHashes [ "iosevka" ]));
 in stdenv.mkDerivation rec {
  pname = "${name}-bin";
-  version = "3.7.1";
+  version = "4.0.0";

  src = fetchurl {
    url = "https://github.com/be5invis/Iosevka/releases/download/v${version}/ttc-${name}-${version}.zip";
--- a/pkgs/data/fonts/iosevka/variants.nix
+++ b/pkgs/data/fonts/iosevka/variants.nix
@ -1,24 +1,24 @@
 # This file was autogenerated. DO NOT EDIT!
 {
-  iosevka = "0h226f32nwlqnsdc86bwk2wcdl2hsq5q1s2ln6dsf9m7w8ajn0nr";
-  iosevka-aile = "05k3h7n7mkpdsjcxha27vjj503b4129jd90wj8qyk5h0nrgy1rc6";
-  iosevka-curly = "0fxcc99n9ghkdjmfxba9mg4fc0dwlvnnxlmc618jv6s3k2xn7sza";
-  iosevka-curly-slab = "1qgxyw5v91l4cw3mvqzagk9amyy63iqh72bnsz63daxgss3fpsab";
-  iosevka-etoile = "184rjidnjayv5wsrxxxf39mvdcjafdwcvp0h4rfniy9s0ifrwjvf";
-  iosevka-slab = "1cbrv5pyhnvwrdaj8r011igw2yjgzzigd82g1r10d348lk64wja1";
-  iosevka-sparkle = "124jnjzffnfw58b78svw8rzgal10z5nspwc267pvq7q0f2ak1wpp";
-  iosevka-ss01 = "18ckb0ch4za4vgwqz8azx8vhg9v9a922ffbckrbmy8n5bi03dl7w";
-  iosevka-ss02 = "0cwm2jdni5m9z0xagpmq9vvjp3yvin7c7bnavsj15yfvpq8b8qsp";
-  iosevka-ss03 = "1yzbvkr726f8mm024qzy2hdd7nz4kymgjm0cj5208c57bln0byr2";
-  iosevka-ss04 = "1kpz84a1cb39rxc87whw0fh0k9ak2qbcq59hm425da2acf27a648";
-  iosevka-ss05 = "1xnnm96jnw90mhwylsw1ad6m8pr4r1bd02l7g82m5hmr7bc4b7dd";
-  iosevka-ss06 = "1raw01ijiawaqxfmj0m8z8jrb2ns7vzy68lak63mss8j35xzg1l5";
-  iosevka-ss07 = "0bjhjwjif7qw6wyyrzfg2pdvy1b070k053ndmjard6sh1rcln02d";
-  iosevka-ss08 = "1qwgk8riff57np4hlmd0kcl9bx511x9zmnlrjq3ilfn6abdwgm7i";
-  iosevka-ss09 = "0sfnhmcrsv1v7l756hx70y1mrp35fbs6wrsczw4vxfbbaigs767r";
-  iosevka-ss10 = "10n70z7588h8y2z274vjn6hvzc7lg87znibcmkk2brmx2g5bw2wl";
-  iosevka-ss11 = "0mnyd04vdqr8jm3syv6ddrn61f27k91kxkdy86pp34xaac2ipmm0";
-  iosevka-ss12 = "1f8pn2220s6r566b40ncnqrfmfdhnlr0nkvzj9swgvx66jr8mlhj";
-  iosevka-ss13 = "1py5qgfqm9wp9pzcxg83mydvf3r6nhrqi21d0fvmnk04ghk1psd6";
-  iosevka-ss14 = "0z47kqicd26x5v94zy97xyl277v0s6856pbllfn1gv92ax2dg5cy";
+  iosevka = "05wlap8r7kfg5zyj8gf7i1cypgs6lwpkh51g4cyj01zjkkv9g7k8";
+  iosevka-aile = "18qa6q1djjr34aj340ab47ajkkcq4wfv7m36f303kabgwfif247r";
+  iosevka-curly = "138hl95n3c2cfblzgh8adi1aljwn1xljjbffd0nrb12hipmgddql";
+  iosevka-curly-slab = "0x18zzphri1fx4lql51n8bam0pq2xb61p1gx50km3wlvkrbmbj23";
+  iosevka-etoile = "0byv8x3nqjka4ivpa8h6hq2k18cjnf69qmcc06dy4ym45a34qqsw";
+  iosevka-slab = "0a2h1g69r9nmp5cskgciywsiq07rxn0cskhvwbwaq64rsqbr1l58";
+  iosevka-sparkle = "13kwdgziylicwkl9s9v9bx9zbbrsrys6n7gx2jzgkdlsj8wkd73i";
+  iosevka-ss01 = "0achcgfcya6sl15wknlyyghpz3d7q62wa0fikl74wr5xyl7h7f1f";
+  iosevka-ss02 = "09gsawl61acykpd2429g1mz0l7i4gl0j1fl0lzc1giy6kbvrkggb";
+  iosevka-ss03 = "07fdxmlpqv6z5hbly8l344x96m80jbz8rq5h9qkfz63xlq0376sj";
+  iosevka-ss04 = "0q3v6spylhaxsf6spv6q5kh87mxbkh9x04s3h1g3rjv6gdlxi9n4";
+  iosevka-ss05 = "1zzdx4d6zrc1qbhsp0bfg91v63h1y943pylfxns09bzk9wjppvba";
+  iosevka-ss06 = "1a3ar8xhn9rf5isxvwqvifczl20ddgs4dw9ypjflmdbyhr3n0yw5";
+  iosevka-ss07 = "01x33sx5d54mdph7csnk6mhkhyc879rwp9spxwyrajghzd0ql8w6";
+  iosevka-ss08 = "0a1kmyr5q2w7qky0ya0gaqmg0lhdafyag8c8idacl7gnra944hi0";
+  iosevka-ss09 = "0m7cm8c3795a8kfy19d9wjmii6ycimcclg5pn9g91kg49q8y9gi2";
+  iosevka-ss10 = "1gfdjz6yifbyb9gl19q3q69as3fnmih17ghhrzzhc7qll68r6k6z";
+  iosevka-ss11 = "119ivw6kcqvzbj46xv8avpg56w3nqdkhhl176gj3bpk1jbjip1wh";
+  iosevka-ss12 = "1vx8rc328whsjjj87fa29kpp9ibk6x52r1brjp37cywjd5ix6l78";
+  iosevka-ss13 = "1gmmm2jlvrl6pzcsc2bhy3qvmzmsns8hlc52ddrwdbw0wi28zhs3";
+  iosevka-ss14 = "0mwg2bvkpxzpsdhky9k6fn81061pk0f23whj1hj4mn191xpw41fy";
 }
--- a/pkgs/data/themes/mojave/default.nix
+++ b/pkgs/data/themes/mojave/default.nix
@ -2,14 +2,14 @@

 stdenv.mkDerivation rec {
  pname = "mojave-gtk-theme";
-  version = "2020-03-19";
+  version = "2020-11-29";

  srcs = [
    (fetchFromGitHub {
      owner = "vinceliuice";
      repo = pname;
      rev = version;
-      sha256 = "1f120sx092i56q4dx2b8d3nnn9pdw67656446nw702rix7zc5jpx";
+      sha256 = "07lcg28y0scpii29j85343kmcga4wyaayjpx9a118z838mnvb757";
    })
    (fetchurl {
      url = "https://github.com/vinceliuice/Mojave-gtk-theme/raw/11741a99d96953daf9c27e44c94ae50a7247c0ed/macOS_Mojave_Wallpapers.tar.xz";
--- a/pkgs/development/compilers/unison/default.nix
+++ b/pkgs/development/compilers/unison/default.nix
@ -1,5 +1,7 @@
 { stdenv, fetchurl, autoPatchelfHook
 , ncurses5, zlib, gmp
+, makeWrapper
+, less
 }:

 stdenv.mkDerivation rec {
@ -23,12 +25,13 @@ stdenv.mkDerivation rec {
  dontBuild = true;
  dontConfigure = true;

-  nativeBuildInputs = stdenv.lib.optional (!stdenv.isDarwin) autoPatchelfHook;
+  nativeBuildInputs = [ makeWrapper ] ++ (stdenv.lib.optional (!stdenv.isDarwin) autoPatchelfHook);
  buildInputs = stdenv.lib.optionals (!stdenv.isDarwin) [ ncurses5 zlib gmp ];

  installPhase = ''
    mkdir -p $out/bin
    mv ucm $out/bin
+    wrapProgram $out/bin/ucm --prefix PATH ":" "${stdenv.lib.makeBinPath [ less ]}";
  '';

  meta = with stdenv.lib; {
--- a/pkgs/development/interpreters/octave/default.nix
+++ b/pkgs/development/interpreters/octave/default.nix
@ -59,12 +59,12 @@
 assert (!blas.isILP64) && (!lapack.isILP64);

 mkDerivation rec {
-  version = "5.2.0";
+  version = "6.1.0";
  pname = "octave";

  src = fetchurl {
    url = "mirror://gnu/octave/${pname}-${version}.tar.gz";
-    sha256 = "1qcmcpsq1lfka19fxzvxjwjhg113c39a9a0x8plkhvwdqyrn5sig";
+    sha256 = "0mqa1g3fq0q45mqc0didr8vl6bk7jzj6gjsf1522qqjq2r04xwvg";
  };

  buildInputs = [
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@ -102,7 +102,7 @@ with pkgs;
        inherit hasDistutilsCxxPatch;
        # TODO: rename to pythonOnBuild
        # Not done immediately because its likely used outside Nixpkgs.
-        pythonForBuild = pythonOnBuildForHost;
+        pythonForBuild = pythonOnBuildForHost.override { inherit packageOverrides; self = pythonForBuild; };

        tests = callPackage ./tests.nix {
          python = self;
--- a/pkgs/development/libraries/botan/2.0.nix
+++ b/pkgs/development/libraries/botan/2.0.nix
@ -1,9 +1,9 @@
 { callPackage, ... } @ args:

 callPackage ./generic.nix (args // {
-  baseVersion = "2.7";
+  baseVersion = "2.9";
  revision = "0";
-  sha256 = "142aqabwc266jxn8wrp0f1ffrmcvdxwvyh8frb38hx9iaqazjbg4";
+  sha256 = "06fiyalvc68p11qqh953azx2vrbav5vr00yvcfp67p9l4csn8m9h";
  postPatch = ''
    sed -e 's@lang_flags "@&--std=c++11 @' -i src/build-data/cc/{gcc,clang}.txt
  '';
--- a/pkgs/development/libraries/gtk-layer-shell/default.nix
+++ b/pkgs/development/libraries/gtk-layer-shell/default.nix
@ -13,7 +13,7 @@

 stdenv.mkDerivation rec {
  pname = "gtk-layer-shell";
-  version = "0.3.0";
+  version = "0.5.1";

  outputs = [ "out" "dev" "devdoc" ];

@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
    owner = "wmww";
    repo = "gtk-layer-shell";
    rev = "v${version}";
-    sha256 = "1f7hfwik7a9kzw0q1k3xc1yisrgg8lbp5pjr337phc9hm38lhq3c";
+    sha256 = "1yfqfv3hn92cy9y5zgvz7qhq2ypill2z5857ki5snjimhjdz0cnw";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/libamqpcpp/default.nix
+++ b/pkgs/development/libraries/libamqpcpp/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "libamqpcpp";
-  version = "4.3.8";
+  version = "4.3.10";

  src = fetchFromGitHub {
    owner = "CopernicaMarketingSoftware";
    repo = "AMQP-CPP";
    rev = "v${version}";
-    sha256 = "1cgpk1v8wgsdyl2gx1bk1nrqflc17ciy0wdg3rgzgy0avl4yghww";
+    sha256 = "0yy6sq4rvv9c0f09vljnqx92zvr39bn1spl735hzn6253d7fm3a5";
  };

  buildInputs = [ openssl ];
--- a/pkgs/development/libraries/libff/default.nix
+++ b/pkgs/development/libraries/libff/default.nix
@ -0,0 +1,28 @@
+{ stdenv, fetchFromGitHub, cmake, boost, gmp, openssl, pkg-config }:
+
+stdenv.mkDerivation rec {
+  pname = "libff";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "scipr-lab";
+    repo = "libff";
+    rev = "v${version}";
+    sha256 = "0dczi829497vqlmn6n4fgi89bc2h9f13gx30av5z2h6ikik7crgn";
+    fetchSubmodules = true;
+  };
+
+  cmakeFlags = [ "-DWITH_PROCPS=Off" ];
+
+  nativeBuildInputs = [ cmake pkg-config ];
+  buildInputs = [ boost gmp openssl ];
+
+  meta = with stdenv.lib; {
+    description = "C++ library for Finite Fields and Elliptic Curves";
+    changelog = "https://github.com/scipr-lab/libff/blob/develop/CHANGELOG.md";
+    homepage = "https://github.com/scipr-lab/libff";
+    license = licenses.mit;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ arturcygan ];
+  };
+}
--- a/pkgs/development/libraries/libproxy/default.nix
+++ b/pkgs/development/libraries/libproxy/default.nix
@ -71,6 +71,17 @@ stdenv.mkDerivation rec {
      url = "https://github.com/libproxy/libproxy/pull/95.patch";
      sha256 = "18vyr6wlis9zfwml86606jpgb9mss01l9aj31iiciml8p857aixi";
    })
+    (fetchpatch {
+      name = "CVE-2020-25219.patch";
+      url = "https://github.com/libproxy/libproxy/commit/a83dae404feac517695c23ff43ce1e116e2bfbe0.patch";
+      sha256 = "0wdh9qjq99aw0jnf2840237i3hagqzy42s09hz9chfgrw8pyr72k";
+    })
+    (fetchpatch {
+      name = "CVE-2020-26154.patch";
+      url = "https://github.com/libproxy/libproxy/commit/4411b523545b22022b4be7d0cac25aa170ae1d3e.patch";
+      sha256 = "0pdy9sw49lxpaiwq073cisk0npir5bkch70nimdmpszxwp3fv1d8";
+    })
+
  ] ++ stdenv.lib.optionals stdenv.isDarwin [
    (fetchpatch {
      url = "https://github.com/libproxy/libproxy/commit/44158f03f8522116758d335688ed840dfcb50ac8.patch";
--- a/pkgs/development/libraries/libslirp/default.nix
+++ b/pkgs/development/libraries/libslirp/default.nix
@ -1,5 +1,6 @@
 { stdenv
 , fetchFromGitLab
+, fetchpatch
 , meson
 , ninja
 , pkg-config
@ -18,6 +19,15 @@ stdenv.mkDerivation rec {
    sha256 = "0pzgjj2x2vrjshrzrl2x39xp5lgwg4b4y9vs8xvadh1ycl10v3fv";
  };

+  patches = [
+    # remove >4.3.1
+    (fetchpatch {
+      name = "CVE-2020-29129_CVE-2020-29130.patch";
+      url = "https://gitlab.freedesktop.org/slirp/libslirp/-/commit/2e1dcbc0c2af64fcb17009eaf2ceedd81be2b27f.patch";
+      sha256 = "01vbjqgnc0kp881l5p6b31cyyirhwhavm6x36hlgkymswvl3wh9w";
+    })
+  ];
+
  nativeBuildInputs = [ meson ninja pkg-config ];

  buildInputs = [ glib ];
--- a/pkgs/development/libraries/pkcs11helper/default.nix
+++ b/pkgs/development/libraries/pkcs11helper/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "pkcs11-helper";
-  version = "1.26";
+  version = "1.27";

  src = fetchFromGitHub {
    owner = "OpenSC";
    repo = "pkcs11-helper";
    rev = "${pname}-${version}";
-    sha256 = "15n3vy1v5gian0gh5y7vq5a6n3fngfwb41sbvrlwbjw0yh23sb1b";
+    sha256 = "1idrqip59bqzcgddpnk2inin5n5yn4y0dmcyaggfpdishraiqgd5";
  };

  nativeBuildInputs = [ autoreconfHook pkgconfig ];
--- a/pkgs/development/libraries/pugixml/default.nix
+++ b/pkgs/development/libraries/pugixml/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "pugixml";
-  version = "1.10";
+  version = "1.11";

  src = fetchFromGitHub {
    owner = "zeux";
    repo = "pugixml";
    rev = "v${version}";
-    sha256 = "dywnLSJHeGaR3+0lTLpacWQL0rWlF8+LNCy+oCCO9C4=";
+    sha256 = "0q620bfd9lnph68jhqn7iv9bqmks7qk90riq6f6nr4kqc4xnravd";
  };

  outputs = if shared then [ "out" "dev" ] else [ "out" ];
--- a/pkgs/development/libraries/science/math/mkl/default.nix
+++ b/pkgs/development/libraries/science/math/mkl/default.nix
@ -20,12 +20,11 @@ let
  # Darwin is pinned to 2019.3 because the DMG does not unpack; see here for details:
  # https://github.com/matthewbauer/undmg/issues/4
  year = if stdenvNoCC.isDarwin then "2019" else "2020";
-  spot = if stdenvNoCC.isDarwin then "3" else "3";
-  rel = if stdenvNoCC.isDarwin then "199" else "279";
+  spot = if stdenvNoCC.isDarwin then "3" else "4";
+  rel = if stdenvNoCC.isDarwin then "199" else "304";

-  # Replace `openmpSpot` by `spot` after 2020.3. Release 2020.03
-  # adresses performance regressions and does not update OpenMP.
-  openmpSpot = if stdenvNoCC.isDarwin then spot else "2";
+  # Replace `openmpSpot` by `spot` after 2020.
+  openmpSpot = if stdenvNoCC.isDarwin then spot else "3";

  rpm-ver = "${year}.${spot}-${rel}-${year}.${spot}-${rel}";

@ -47,8 +46,8 @@ in stdenvNoCC.mkDerivation {
      })
    else
      (fetchurl {
-        url = "https://registrationcenter-download.intel.com/akdlm/irc_nas/tec/16903/l_mkl_${version}.tgz";
-        sha256 = "013shn3c823bjfssq4jyl3na5lbzj99s09ds608ljqllri7473ib";
+        url = "https://registrationcenter-download.intel.com/akdlm/irc_nas/tec/16917/l_mkl_${version}.tgz";
+        hash = "sha256-IxTUZTaXTb0I8qTk+emhVdx+eeJ5jHTn3fqtAKWRfqU=";
      });

  nativeBuildInputs = [ validatePkgConfig ] ++ (if stdenvNoCC.isDarwin
--- a/pkgs/development/libraries/ucx/default.nix
+++ b/pkgs/development/libraries/ucx/default.nix
@ -3,7 +3,7 @@
 }:

 let
-  version = "1.8.1";
+  version = "1.9.0";

 in stdenv.mkDerivation {
  name = "ucx-${version}";
@ -12,7 +12,7 @@ in stdenv.mkDerivation {
    owner = "openucx";
    repo = "ucx";
    rev = "v${version}";
-    sha256 = "0yfnx4shgydkp447kipavjzgl6z58jan6l7znhdi8ry4zbgk568a";
+    sha256 = "0i0ji5ivzxjqh3ys1m517ghw3am7cw1hvf40ma7hsq3wznsyx5s1";
  };

  nativeBuildInputs = [ autoreconfHook doxygen ];
--- a/pkgs/development/ocaml-modules/batteries/default.nix
+++ b/pkgs/development/ocaml-modules/batteries/default.nix
@ -1,22 +1,15 @@
-{ stdenv, fetchurl, fetchpatch, ocaml, findlib, ocamlbuild, qtest, num }:
+{ stdenv, fetchurl, ocaml, findlib, ocamlbuild, qtest, num }:

-let version = "3.1.0"; in
+let version = "3.2.0"; in

 stdenv.mkDerivation {
  name = "ocaml${ocaml.version}-batteries-${version}";

  src = fetchurl {
    url = "https://github.com/ocaml-batteries-team/batteries-included/releases/download/v${version}/batteries-${version}.tar.gz";
-    sha256 = "0bq1np3ai3r559s3vivn45yid25fwz76rvbmsg30j57j7cyr3jqm";
+    sha256 = "0a77njgc6c6kz4rpwqgmnii7f1na6hzsa55nqqm3dndhq9xh628w";
  };

-  # Fix a test case
-  patches = [(fetchpatch {
-    url = "https://github.com/ocaml-batteries-team/batteries-included/commit/7cbd9617d4efa5b3d647b1cc99d9a25fa01ac6dd.patch";
-    sha256 = "0q4kq10psr7n1xdv4rspk959n1a5mk9524pzm5v68ab2gkcgm8sk";
-
-  })];
-
  buildInputs = [ ocaml findlib ocamlbuild ];
  checkInputs = [ qtest ];
  propagatedBuildInputs = [ num ];
--- a/pkgs/development/python-modules/Wand/default.nix
+++ b/pkgs/development/python-modules/Wand/default.nix
@ -6,11 +6,11 @@

 buildPythonPackage rec {
  pname = "Wand";
-  version = "0.6.4";
+  version = "0.6.5";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "6aeb0183d94762b37a8cdee97174f38ae21e626d44f62f1e2f0ab48a35026e98";
+    sha256 = "ec981b4f07f7582fc564aba8b57763a549392e9ef8b6a338e9da54cdd229cf95";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/b2sdk/default.nix
+++ b/pkgs/development/python-modules/b2sdk/default.nix
@ -3,13 +3,13 @@

 buildPythonPackage rec {
  pname = "b2sdk";
-  version = "1.1.4";
+  version = "1.2.0";

  disabled = isPy27;

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0g527qdda105r5g9yjh4lxzlmz34m2bdz8dydqqy09igdsmiyi9j";
+    sha256 = "8e46ff9d47a9b90d8b9beab1969fcf4920300b02e20e6bf0745be04e09e8a6ff";
  };

  pythonImportsCheck = [ "b2sdk" ];
--- a/pkgs/development/python-modules/bitstruct/default.nix
+++ b/pkgs/development/python-modules/bitstruct/default.nix
@ -2,11 +2,11 @@

 buildPythonPackage rec {
  pname = "bitstruct";
-  version = "8.11.0";
+  version = "8.11.1";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0p9d5242pkzag7ac5b5zdjyfqwxvj2jisyjghp6yhjbbwz1z44rb";
+    sha256 = "4e7b8769c0f09fee403d0a5f637f8b575b191a79a92e140811aa109ce7461f0c";
  };

  meta = with lib; {
--- a/pkgs/development/python-modules/blessed/default.nix
+++ b/pkgs/development/python-modules/blessed/default.nix
@ -4,11 +4,11 @@

 buildPythonPackage rec {
  pname = "blessed";
-  version = "1.17.11";
+  version = "1.17.12";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "7d4914079a6e8e14fbe080dcaf14dee596a088057cdc598561080e3266123b48";
+    sha256 = "580429e7e0c6f6a42ea81b0ae5a4993b6205c6ccbb635d034b4277af8175753e";
  };

  checkInputs = [ pytest mock glibcLocales ];
--- a/pkgs/development/python-modules/blis/default.nix
+++ b/pkgs/development/python-modules/blis/default.nix
@ -9,11 +9,11 @@

 buildPythonPackage rec {
  pname = "blis";
-  version = "0.7.2";
+  version = "0.7.3";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "c14fb9ec3f5ed7c4940c132c7691469ac5d3e302891d95e935623bf1d4e17fbb";
+    sha256 = "19557b14763253ca3d4f6cfc9c9fe2eed3d65db14fa273ced8b0c17ce2bfda4a";
  };

  nativeBuildInputs = [
@ -34,6 +34,7 @@ buildPythonPackage rec {
    description = "BLAS-like linear algebra library";
    homepage = "https://github.com/explosion/cython-blis";
    license = licenses.bsd3;
+    platforms = platforms.x86_64;
    maintainers = with maintainers; [ danieldk ];
  };
 }
--- a/pkgs/development/python-modules/bsddb3/default.nix
+++ b/pkgs/development/python-modules/bsddb3/default.nix
@ -7,11 +7,11 @@

 buildPythonPackage rec {
  pname = "bsddb3";
-  version = "6.2.7";
+  version = "6.2.9";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "17yw0by4lycwpvnx06cnzbbchz4zvzbx3j89b20xa314xdizmxxh";
+    sha256 = "70d05ec8dc568f42e70fc919a442e0daadc2a905a1cfb7ca77f549d49d6e7801";
  };

  buildInputs = [ pkgs.db ];
--- a/pkgs/development/python-modules/bumps/default.nix
+++ b/pkgs/development/python-modules/bumps/default.nix
@ -2,7 +2,7 @@

 buildPythonPackage rec {
  pname = "bumps";
-  version = "0.7.16";
+  version = "0.7.18";

  propagatedBuildInputs = [six];

@ -12,7 +12,7 @@ buildPythonPackage rec {

  src = fetchPypi {
    inherit pname version;
-    sha256 = "3594452487b8404f1efaace9b70aefaeb345fa44dd74349f7829a61161d2f69a";
+    sha256 = "3217d4fd3ec767448d742f3b6ff527cc3817f2421b9a9a8456e1d8ee4a9b1087";
  };

  meta = with stdenv.lib; {
--- a/pkgs/development/python-modules/colander/default.nix
+++ b/pkgs/development/python-modules/colander/default.nix
@ -3,11 +3,11 @@

 buildPythonPackage rec {
  pname = "colander";
-  version = "1.8.2";
+  version = "1.8.3";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "54878d2ffd1afb020daca6cd5c6cfe6c0e44d0069fc825d57fe59aa6e4f6a499";
+    sha256 = "259592a0d6a89cbe63c0c5771f9c0c2522387415af8d715f599583eac659f7d4";
  };

  propagatedBuildInputs = [ translationstring iso8601 enum34 ];
--- a/pkgs/development/python-modules/colanderalchemy/default.nix
+++ b/pkgs/development/python-modules/colanderalchemy/default.nix
@ -1,6 +1,5 @@
 { stdenv
 , buildPythonPackage
-, fetchpatch
 , fetchPypi
 , unittest2
 , colander
@ -9,30 +8,21 @@

 buildPythonPackage rec {
  pname = "ColanderAlchemy";
-  version = "0.3.3";
+  version = "0.3.4";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "11wcni2xmfmy001rj62q2pwf305vvngkrfm5c4zlwvgbvlsrvnnw";
+    sha256 = "006wcfch2skwvma9bq3l06dyjnz309pa75h1rviq7i4pd9g463bl";
  };

-  patches = [
-    (fetchpatch {
-        url = "https://github.com/stefanofontanelli/ColanderAlchemy/commit/b45fe35f2936a5ccb705e9344075191e550af6c9.patch";
-        sha256 = "1kf278wjq49zd6fhpp55vdcawzdd107767shzfck522sv8gr6qvx";
-    })
-  ];
-
-  buildInputs = [ unittest2 ];
  propagatedBuildInputs = [ colander sqlalchemy ];

+  # Tests are not included in Pypi
+  doCheck = false;
+
  meta = with stdenv.lib; {
    description = "Autogenerate Colander schemas based on SQLAlchemy models";
    homepage = "https://github.com/stefanofontanelli/ColanderAlchemy";
    license = licenses.mit;
-    # ColanderAlchemy's tests currently fail with colander >1.6.0
-    # (see https://github.com/stefanofontanelli/ColanderAlchemy/issues/107)
-    broken = versionOlder "1.6.0" colander.version;
  };
-
 }
--- a/pkgs/development/python-modules/dependency-injector/default.nix
+++ b/pkgs/development/python-modules/dependency-injector/default.nix
@ -9,11 +9,11 @@ in

 buildPythonPackage rec {
  pname = "dependency-injector";
-  version = "4.4.1";
+  version = "4.5.1";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "8c3d9ec6502e2d8051dcdf2603cccb4a87da292a1770e9854814fe928fa4a9b1";
+    sha256 = "1d5d42a3547a8a8d3b7aa8f4325e5042231bbc86718c89e123c0c62c103cd9d5";
  };

  propagatedBuildInputs = [ six ];
--- a/pkgs/development/python-modules/dulwich/default.nix
+++ b/pkgs/development/python-modules/dulwich/default.nix
@ -4,12 +4,12 @@
 , git, glibcLocales }:

 buildPythonPackage rec {
-  version = "0.20.11";
+  version = "0.20.14";
  pname = "dulwich";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0b142794fb72647673173b80ed8b75e1f56b42a0972c5b3c752d88766a659d53";
+    sha256 = "21d6ee82708f7c67ce3fdcaf1f1407e524f7f4f7411a410a972faa2176baec0d";
  };

  LC_ALL = "en_US.UTF-8";
--- a/pkgs/development/python-modules/ecpy/default.nix
+++ b/pkgs/development/python-modules/ecpy/default.nix
@ -9,11 +9,17 @@ buildPythonPackage rec {
    sha256 = "9635cffb9b6ecf7fd7f72aea1665829ac74a1d272006d0057d45a621aae20228";
  };

+  prePatch = ''
+    sed -i "s|reqs.append('future')|pass|" setup.py
+  '';
+
  propagatedBuildInputs = lib.optional (!isPy3k) future;

  # No tests implemented
  doCheck = false;

+  pythonImportsCheck = [ "ecpy" ];
+
  meta = with lib; {
    description = "Pure Pyhton Elliptic Curve Library";
    homepage = "https://github.com/ubinity/ECPy";
--- a/pkgs/development/python-modules/gin-config/default.nix
+++ b/pkgs/development/python-modules/gin-config/default.nix
@ -7,11 +7,11 @@

 buildPythonPackage rec {
  pname = "gin-config";
-  version = "0.3.0";
+  version = "0.4.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "6a83b7639ae76c276c0380d71d583f151b327a7c37978add314180ec1280a6cc";
+    sha256 = "9499c060e1faa340959fc4ada7fe53f643d6f8996a80262b28a082c1ef6849de";

  };

--- a/pkgs/development/python-modules/google_cloud_container/default.nix
+++ b/pkgs/development/python-modules/google_cloud_container/default.nix
@ -3,11 +3,11 @@

 buildPythonPackage rec {
  pname = "google-cloud-container";
-  version = "2.1.0";
+  version = "2.2.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "07rcq4c49zfaacyn5df62bs7qjf5hpmdm9mpb6nx510lylq0507x";
+    sha256 = "ce641b3ffaef407d5fe9b798955c6c6f2d1bfb58d6e11b4f87eb6fbb745a2711";
  };

  disabled = pythonOlder "3.6";
--- a/pkgs/development/python-modules/green/default.nix
+++ b/pkgs/development/python-modules/green/default.nix
@ -8,13 +8,13 @@

 buildPythonPackage rec {
  pname = "green";
-  version = "3.2.4";
+  version = "3.2.5";

  disabled = !isPy3k;

  src = fetchPypi {
    inherit pname version;
-    sha256 = "3473abb4629c8c1af9f6b59a4f9c757315736580053a64bbfd91ff21ccad57a8";
+    sha256 = "11d595d98afc3363d79e237141ad862c0574a62f92325d9e541ed1b1a54a72ae";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/httpbin/default.nix
+++ b/pkgs/development/python-modules/httpbin/default.nix
@ -3,7 +3,6 @@
 , fetchPypi
 , fetchpatch
 , flask
-, flask-common
 , flask-limiter
 , markupsafe
 , decorator
@ -15,24 +14,14 @@

 buildPythonPackage rec {
  pname = "httpbin";
-  version = "0.6.2";
+  version = "0.7.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0afa0486a76305cac441b5cc80d5d4ccd82b20875da7c5119ecfe616cefef45f";
+    sha256 = "1yldvf3585zcwj4vxvfm4yr9wwlz3pa2mx2pazqz8x8mr687gcyb";
  };

-  patches = [
-    # https://github.com/kennethreitz/httpbin/issues/403
-    # https://github.com/kennethreitz/flask-common/issues/7
-    # https://github.com/evansd/whitenoise/issues/166
-    (fetchpatch {
-      url = "https://github.com/javabrett/httpbin/commit/5735c888e1e51b369fcec41b91670a90535e661e.patch";
-      sha256 = "167h8mscdjagml33dyqk8nziiz3dqbggnkl6agsirk5270nl5f7q";
-    })
-  ];
-
-  propagatedBuildInputs = [ brotlipy flask flask-common flask-limiter markupsafe decorator itsdangerous raven six ];
+  propagatedBuildInputs = [ brotlipy flask flask-limiter markupsafe decorator itsdangerous raven six ];

  # No tests
  doCheck = false;
--- a/pkgs/development/python-modules/identify/default.nix
+++ b/pkgs/development/python-modules/identify/default.nix
@ -2,11 +2,11 @@

 buildPythonPackage rec {
  pname = "identify";
-  version = "1.5.9";
+  version = "1.5.10";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "c9504ba6a043ee2db0a9d69e43246bc138034895f6338d5aed1b41e4a73b1513";
+    sha256 = "943cd299ac7f5715fcb3f684e2fc1594c1e0f22a90d15398e5888143bd4144b5";
  };

  # Tests not included in PyPI tarball
--- a/pkgs/development/python-modules/ijson/default.nix
+++ b/pkgs/development/python-modules/ijson/default.nix
@ -2,11 +2,11 @@

 buildPythonPackage rec {
  pname = "ijson";
-  version = "3.1.2.post0";
+  version = "3.1.3";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "04fd8ebb8edb39db81f49b75b101d1e2a4d0728460e253fd9c98e3e17f9caa16";
+    sha256 = "d29977f7235b5bf83c372825c6abd8640ba0e3a8e031d3ffc3b63deaf6ae1487";
  };

  doCheck = false; # something about yajl
--- a/pkgs/development/python-modules/jupyterlab-git/default.nix
+++ b/pkgs/development/python-modules/jupyterlab-git/default.nix
@ -10,12 +10,12 @@

 buildPythonPackage rec {
  pname = "jupyterlab_git";
-  version = "0.23.1";
+  version = "0.23.2";
  disabled = pythonOlder "3.5";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "3c709c33df0b838e50f76fa2e7e0302bd3c32ec24e161ee0e8f436a3844e8b16";
+    sha256 = "2c4c55c5bc651a670b13e89064f7aba7422b72ad6b3f2b3890ac72cc9a2d4089";
  };

  propagatedBuildInputs = [ notebook nbdime git ];
--- a/pkgs/development/python-modules/mac_alias/default.nix
+++ b/pkgs/development/python-modules/mac_alias/default.nix
@ -2,12 +2,12 @@
 }:

 buildPythonPackage rec {
-  version = "2.1.0";
+  version = "2.1.1";
  pname = "mac_alias";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "9f07926e9befcc4ab35212d19541fe0e4e4abd67a7641aa75252a3ffd8deae94";
+    sha256 = "55468c84a87c8b3929a3dc98f753194f7fe93fd8621abbfea1a4019448058a14";
  };

  # pypi package does not include tests;
--- a/pkgs/development/python-modules/nipype/default.nix
+++ b/pkgs/development/python-modules/nipype/default.nix
@ -49,12 +49,12 @@ in

 buildPythonPackage rec {
  pname = "nipype";
-  version = "1.5.1";
+  version = "1.6.0";
  disabled = isPy27;

  src = fetchPypi {
    inherit pname version;
-    sha256 = "3d6aa37186e1d2f90917dfdf1faf5aeff469912554990e5d182ffe8435f250d5";
+    sha256 = "bc56ce63f74c9a9a23c6edeaf77631377e8ad2bea928c898cc89527a47f101cf";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/phx-class-registry/default.nix
+++ b/pkgs/development/python-modules/phx-class-registry/default.nix
@ -0,0 +1,28 @@
+{ stdenv, buildPythonPackage, fetchPypi, isPy27, pytestCheckHook }:
+
+buildPythonPackage rec {
+  pname = "phx-class-registry";
+  version = "3.0.5";
+
+  disabled = isPy27;
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "14iap8db2ldmnlf5kvxs52aps31rl98kpa5nq8wdm30a86n6457i";
+  };
+
+  checkInputs = [ pytestCheckHook ];
+
+  disabledTests = [
+    "test_branding"
+    "test_happy_path"
+    "test_len"
+  ];
+
+  meta = with stdenv.lib; {
+    description = "Registry pattern for Python classes, with setuptools entry points integration";
+    homepage = "https://github.com/todofixthis/class-registry";
+    license = licenses.mit;
+    maintainers = with maintainers; [ SuperSandro2000 ];
+  };
+}
--- a/pkgs/development/python-modules/pip-tools/default.nix
+++ b/pkgs/development/python-modules/pip-tools/default.nix
@ -3,11 +3,11 @@

 buildPythonPackage rec {
  pname = "pip-tools";
-  version = "5.3.1";
+  version = "5.4.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "5672c2b6ca0f1fd803f3b45568c2cf7fadf135b4971e7d665232b2075544c0ef";
+    sha256 = "084z41f8mh9g7pnmbqd2cn5dq3v05qjcrnj1ifpn2nfny86rklx4";
  };

  LC_ALL = "en_US.UTF-8";
--- a/pkgs/development/python-modules/pybullet/default.nix
+++ b/pkgs/development/python-modules/pybullet/default.nix
@ -8,11 +8,11 @@

 buildPythonPackage rec {
  pname = "pybullet";
-  version = "3.0.6";
+  version = "3.0.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "db4eea782c4d4808ef73b305a729d94f89035f7ad1b84032432e9dd101f689e4";
+    sha256 = "47e55d2b0c565a968406f314faad7c002be6d8b0afc8ad2c437d07b7b7d2f590";
  };

  buildInputs = [
--- a/pkgs/development/python-modules/pymavlink/default.nix
+++ b/pkgs/development/python-modules/pymavlink/default.nix
@ -2,11 +2,11 @@

 buildPythonPackage rec {
  pname = "pymavlink";
-  version = "2.4.12";
+  version = "2.4.13";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "2954bb071ff67fc5ab29ed2dabe3b5355c4063fb8b014477d9bfbceb87358bc6";
+    sha256 = "c09e285d049590fd76ef72bc19b4597bef80712e942b3a507ef1521b432d84cd";
  };

  propagatedBuildInputs = [ future lxml ];
--- a/pkgs/development/python-modules/pyserial/default.nix
+++ b/pkgs/development/python-modules/pyserial/default.nix
@ -2,11 +2,11 @@

 buildPythonPackage rec {
  pname = "pyserial";
-  version="3.4";
+  version="3.5";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "09y68bczw324a4jb9a1cfwrbjhq179vnfkkkrybbksp0vqgl0bbf";
+    sha256 = "1nyd4m4mnrz8scbfqn4zpq8gnbl4x42w5zz62vcgpzqd2waf0xrw";
  };

  checkPhase = "python -m unittest discover -s test";
--- a/pkgs/development/python-modules/pytest-metadata/default.nix
+++ b/pkgs/development/python-modules/pytest-metadata/default.nix
@ -3,11 +3,11 @@

 buildPythonPackage rec {
  pname = "pytest-metadata";
-  version = "1.10.0";
+  version = "1.11.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0593jf8l30ayrqr9gkmwfbhz9h8cyqp7mgwp7ah1gjysbajf1rmp";
+    sha256 = "71b506d49d34e539cc3cfdb7ce2c5f072bea5c953320002c95968e0238f8ecf1";
  };

  nativeBuildInputs = [ setuptools_scm ];
--- a/pkgs/development/python-modules/python-frontmatter/default.nix
+++ b/pkgs/development/python-modules/python-frontmatter/default.nix
@ -0,0 +1,30 @@
+{ stdenv, lib, fetchFromGitHub, python3Packages }:
+
+python3Packages.buildPythonPackage rec {
+  pname = "python-frontmatter";
+  version = "0.5.0";
+
+  src = fetchFromGitHub {
+    owner = "eyeseast";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1iki3rcbg7zs93m3mgqzncybqgdcch25qpwy84iz96qq8pipfs6g";
+  };
+
+  propagatedBuildInputs = with python3Packages; [
+    pyyaml
+    six
+  ];
+
+  checkInputs = with python3Packages; [
+    pytest
+  ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/eyeseast/python-frontmatter";
+    description = "Parse and manage posts with YAML (or other) frontmatter";
+    license = licenses.mit;
+    maintainers = with maintainers; [ siraben ];
+    platforms = lib.platforms.unix;
+  };
+}
--- a/pkgs/development/python-modules/smart_open/default.nix
+++ b/pkgs/development/python-modules/smart_open/default.nix
@ -13,12 +13,12 @@

 buildPythonPackage rec {
  pname = "smart_open";
-  version = "4.0.0";
+  version = "4.0.1";
  disabled = pythonOlder "3.5";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "2ce157700821e285bbacd8d01ec7a4f2582765460e541f55b216cb135db8be24";
+    sha256 = "49396d86de8e0d609ec40422c59f837dd944dcdf727feed6f2ff8cbdc0e3bc8e";
  };

  # nixpkgs version of moto is >=1.2.0, remove version pin to fix build
--- a/pkgs/development/python-modules/vispy/default.nix
+++ b/pkgs/development/python-modules/vispy/default.nix
@ -5,11 +5,11 @@

 buildPythonPackage rec {
  pname = "vispy";
-  version = "0.6.5";
+  version = "0.6.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "90cc76e79ee16c839bca05753e0c5f9f1c1c57963f2d3b248e4afac0fd75df75";
+    sha256 = "6f3c4d00be9e6761c046d520a86693d78a0925d47eeb2fc095e95dac776f74ee";
  };

  patches = [
--- a/pkgs/development/ruby-modules/gem/default.nix
+++ b/pkgs/development/ruby-modules/gem/default.nix
@ -49,6 +49,11 @@ lib.makeOverridable (
 , propagatedUserEnvPkgs ? []
 , buildFlags ? []
 , passthru ? {}
+# bundler expects gems to be stored in the cache directory for certain actions
+# such as `bundler install --redownload`.
+# At the cost of increasing the store size, you can keep the gems to have closer
+# alignment with what Bundler expects.
+, keepGemCache ? false
 , ...} @ attrs:

 let
@ -208,7 +213,7 @@ stdenv.mkDerivation ((builtins.removeAttrs attrs ["source"]) // {
    pushd $out/${ruby.gemPath}
    rm -fv doc/*/*/created.rid || true
    rm -fv {gems/*/ext/*,extensions/*/*/*}/{Makefile,mkmf.log,gem_make.out} || true
-    rm -fvr cache
+    ${if keepGemCache then "" else "rm -fvr cache"}
    popd

    # write out metadata and binstubs
--- a/Show More
+++ b/Show More