diff --git a/pkgs/development/compilers/graalvm/001_mx.py.patch b/pkgs/development/compilers/graalvm/001_mx.py.patch
index a87a030aa395..0477c6c556f1 100644
--- a/pkgs/development/compilers/graalvm/001_mx.py.patch
+++ b/pkgs/development/compilers/graalvm/001_mx.py.patch
@@ -1,57 +1,31 @@
 diff --git a/mx.py b/mx.py
-index af7a9c2..08c0ea8 100755
+index a0b9315..b7d67a0 100755
 --- a/mx.py
 +++ b/mx.py
-@@ -4976,30 +4976,6 @@ class PackedResourceLibrary(ResourceLibrary):
+@@ -238,21 +238,7 @@ def _check_file_with_sha1(path, sha1, sha1path, mustExist=True, newFile=False, l
+             f.write(value or sha1OfFile(path))
  
-     def get_path(self, resolve):
-         extract_path = _make_absolute(self.extract_path, self.suite.dir)
--        download_path = super(PackedResourceLibrary, self).get_path(resolve)
--        if resolve and self._check_extract_needed(extract_path, download_path):
--            extract_path_tmp = tempfile.mkdtemp(suffix=basename(extract_path), dir=dirname(extract_path))
--            try:
--                # extract archive
--                Extractor.create(download_path).extract(extract_path_tmp)
--                # ensure modification time is up to date
--                os.utime(extract_path_tmp, None)
--                logv("Moving temporary directory {} to {}".format(extract_path_tmp, extract_path))
--                try:
--                    # attempt atomic overwrite
--                    os.rename(extract_path_tmp, extract_path)
--                except OSError:
--                    # clean destination & re-try for cases where atomic overwrite doesn't work
--                    rmtree(extract_path, ignore_errors=True)
--                    os.rename(extract_path_tmp, extract_path)
--            except OSError as ose:
--                # Rename failed. Race with other process?
--                if self._check_extract_needed(extract_path, download_path):
--                    # ok something really went wrong
--                    abort("Extracting {} failed!".format(download_path), context=ose)
--            finally:
--                rmtree(extract_path_tmp, ignore_errors=True)
+     if exists(path):
+-        if sha1Check and sha1:
+-            if not _sha1CachedValid() or (newFile and sha1 != _sha1Cached()):
+-                logv('Create/update SHA1 cache file ' + sha1path)
+-                _writeSha1Cached()
 -
-         return extract_path
- 
-     def _check_download_needed(self):
-@@ -5900,7 +5876,7 @@ class HgConfig(VC):
- 
-     def update_to_branch(self, vcdir, branch, abortOnError=True):
-         cmd = ['update', branch]
--        self.hg_command(vcdir, cmd, abortOnError=abortOnError)
-+        self.run(['hg', vcdir] + cmd)
- 
-     def add(self, vcdir, path, abortOnError=True):
-         return self.run(['hg', '-q', '-R', vcdir, 'add', path]) == 0
-@@ -5937,7 +5913,7 @@ class HgConfig(VC):
-                 return None
- 
-     def parent_info(self, vcdir, abortOnError=True):
--        out = self.hg_command(vcdir, ["log", "-r", ".", "--template", "{author}|||{date|hgdate}"], abortOnError=abortOnError)
-+        out = _check_output_str(["hg", '-R', vcdir, "log", "-r", ".", "--template", "{author}|||{date|hgdate}"])
-         author, date = out.split("|||")
-         ts, _ = date.split(" ")
-         return self._sanitize_parent_info({
-@@ -8301,46 +8277,8 @@ class SuiteImport:
+-            if sha1 != _sha1Cached():
+-                computedSha1 = sha1OfFile(path)
+-                if sha1 == computedSha1:
+-                    warn('Fixing corrupt SHA1 cache file ' + sha1path)
+-                    _writeSha1Cached(computedSha1)
+-                    return True
+-                if logErrors:
+-                    size = os.path.getsize(path)
+-                    log_error('SHA1 of {} [size: {}] ({}) does not match expected value ({})'.format(TimeStampFile(path), size, computedSha1, sha1))
+-                return False
++        return True
+     elif mustExist:
+         if logErrors:
+             log_error("'{}' does not exist".format(path))
+@@ -1057,46 +1043,8 @@ class SuiteImport:
          version = import_dict.get("version")
          suite_dir = None
          version_from = import_dict.get("versionFrom")
@@ -100,7 +74,7 @@ index af7a9c2..08c0ea8 100755
  
      @staticmethod
      def get_source_urls(source, kind=None):
-@@ -8381,8 +8319,6 @@ class Suite(object):
+@@ -1467,8 +1415,6 @@ class Suite(object):
      :type dists: list[Distribution]
      """
      def __init__(self, mxDir, primary, internal, importing_suite, load, vc, vc_dir, dynamicallyImported=False):
@@ -109,7 +83,7 @@ index af7a9c2..08c0ea8 100755
          self.imported_by = [] if primary else [importing_suite]
          self.mxDir = mxDir
          self.dir = dirname(mxDir)
-@@ -8410,7 +8346,7 @@ class Suite(object):
+@@ -1496,7 +1442,7 @@ class Suite(object):
          self._outputRoot = None
          self._preloaded_suite_dict = None
          self.vc = vc
@@ -118,7 +92,7 @@ index af7a9c2..08c0ea8 100755
          self._preload_suite_dict()
          self._init_imports()
          if load:
-@@ -9310,7 +9246,9 @@ def get_dynamic_imports():
+@@ -2405,7 +2351,9 @@ class Repository(SuiteConstituent):
  class SourceSuite(Suite):
      """A source suite"""
      def __init__(self, mxDir, primary=False, load=True, internal=False, importing_suite=None, dynamicallyImported=False):
@@ -129,7 +103,7 @@ index af7a9c2..08c0ea8 100755
          Suite.__init__(self, mxDir, primary, internal, importing_suite, load, vc, vc_dir, dynamicallyImported=dynamicallyImported)
          logvv("SourceSuite.__init__({}), got vc={}, vc_dir={}".format(mxDir, self.vc, self.vc_dir))
          self.projects = []
-@@ -9359,17 +9297,7 @@ class SourceSuite(Suite):
+@@ -2454,17 +2402,7 @@ class SourceSuite(Suite):
          """
          Gets the release tag from VC or create a time based once if VC is unavailable
          """
@@ -148,73 +122,7 @@ index af7a9c2..08c0ea8 100755
  
      def scm_metadata(self, abortOnError=False):
          scm = self.scm
-@@ -12541,55 +12469,8 @@ def _attempt_download(url, path, jarEntryName=None):
-     return False
- 
- def download(path, urls, verbose=False, abortOnError=True, verifyOnly=False):
--    """
--    Attempts to downloads content for each URL in a list, stopping after the first successful download.
--    If the content cannot be retrieved from any URL, the program is aborted, unless abortOnError=False.
--    The downloaded content is written to the file indicated by `path`.
--    """
--    if not verifyOnly:
--        ensure_dirname_exists(path)
--        assert not path.endswith(os.sep)
--
--    # https://docs.oracle.com/javase/7/docs/api/java/net/JarURLConnection.html
--    jarURLPattern = re.compile('jar:(.*)!/(.*)')
--    verify_errors = {}
--    for url in urls:
--        if not verifyOnly or verbose:
--            log('Downloading ' + url + ' to ' + path)
--        m = jarURLPattern.match(url)
--        jarEntryName = None
--        if m:
--            url = m.group(1)
--            jarEntryName = m.group(2)
--
--        if verifyOnly:
--            try:
--                conn = _urlopen(url, timeout=10)
--                conn.close()
--                return True
--            except (IOError, socket.timeout) as e:
--                _suggest_tlsv1_error(e)
--                verify_errors[url] = e
--            continue
--
--        for i in range(4):
--            if i != 0:
--                time.sleep(1)
--                warn('Retry {} to download from {}'.format(i, url))
--            res = _attempt_download(url, path, jarEntryName)
--            if res is True:
--                return True
--            if res is False:
--                break
--
--    if abortOnError:
--        msg = 'Could not download to ' + path + ' from any of the following URLs: ' + ', '.join(urls)
--        if verifyOnly:
--            for url, e in verify_errors.items():
--                msg += '\n  ' + url + ': ' + str(e)
--        abort(msg)
--    else:
--        return False
-+    print("FAKE download(path={} urls={} verbose={} abortOnError={} verifyOnly={})".format(path, urls, verbose, abortOnError, verifyOnly))
-+    return True
- 
- def update_file(path, content, showDiff=False):
-     """
-@@ -13393,6 +13274,7 @@ class Archiver(SafeFileCreation):
- 
-     def _add_zip(self, filename, archive_name, provenance):
-         self._add_provenance(archive_name, provenance)
-+        os.utime(filename, (315532800, 315532800))
-         self.zf.write(filename, archive_name)
- 
-     def _add_str_zip(self, data, archive_name, provenance):
-@@ -18541,12 +18423,35 @@ def _find_suite_import(importing_suite, suite_import, fatalIfMissing=True, load=
+@@ -2993,12 +2931,35 @@ def _find_suite_import(importing_suite, suite_import, fatalIfMissing=True, load=
          Attempts to locate an existing suite in the local context
          Returns the path to the mx.name dir if found else None
          """
@@ -255,3 +163,129 @@ index af7a9c2..08c0ea8 100755
  
      def _get_import_dir(url, mode):
          """Return directory where the suite will be cloned to"""
+@@ -3816,7 +3777,7 @@ def getmtime(name):
+     """
+     Wrapper for builtin open function that handles long path names on Windows.
+     """
+-    return os.path.getmtime(_safe_path(name))
++    return 315532800
+ 
+ 
+ def stat(name):
+@@ -4062,57 +4023,8 @@ def _attempt_download(url, path, jarEntryName=None):
+     return False
+ 
+ def download(path, urls, verbose=False, abortOnError=True, verifyOnly=False):
+-    """
+-    Attempts to downloads content for each URL in a list, stopping after the first successful download.
+-    If the content cannot be retrieved from any URL, the program is aborted, unless abortOnError=False.
+-    The downloaded content is written to the file indicated by `path`.
+-    """
+-    if not verifyOnly:
+-        ensure_dirname_exists(path)
+-        assert not path.endswith(os.sep)
+-
+-    # https://docs.oracle.com/javase/7/docs/api/java/net/JarURLConnection.html
+-    jarURLPattern = re.compile('jar:(.*)!/(.*)')
+-    verify_errors = {}
+-    for url in urls:
+-        if not verifyOnly or verbose:
+-            log('Downloading ' + url + ' to ' + path)
+-        m = jarURLPattern.match(url)
+-        jarEntryName = None
+-        if m:
+-            url = m.group(1)
+-            jarEntryName = m.group(2)
+-
+-        if not _opts.trust_http and (url.lower().startswith('http://') or url.lower().startswith('ftp://')):
+-            warn('Downloading from non-https URL {}. Use --trust-http mx option to suppress this warning.'.format(url))
+-
+-        if verifyOnly:
+-            try:
+-                conn = _urlopen(url, timeout=10)
+-                conn.close()
+-            except (IOError, socket.timeout) as e:
+-                _suggest_tlsv1_error(e)
+-                verify_errors[url] = e
+-        else:
+-            for i in range(4):
+-                if i != 0:
+-                    time.sleep(1)
+-                    warn('Retry {} to download from {}'.format(i, url))
+-                if _attempt_download(url, path, jarEntryName):
+-                    return True # Download was successful
+-
+-    if verifyOnly and len(verify_errors) < len(urls): # verify-mode at least one success -> success
+-        return True
+-    else: # Either verification error or no download was successful
+-        msg = 'Could not download to ' + path + ' from any of the following URLs: ' + ', '.join(urls)
+-        if verifyOnly: # verify-mode -> print error details
+-            for url, e in verify_errors.items():
+-                msg += '\n  ' + url + ': ' + str(e)
+-        if abortOnError:
+-            abort(msg)
+-        else:
+-            warn(msg)
+-            return False
++    print("FAKE download(path={} urls={} verbose={} abortOnError={} verifyOnly={})".format(path, urls, verbose, abortOnError, verifyOnly))
++    return True
+ 
+ def update_file(path, content, showDiff=False):
+     """
+@@ -7887,30 +7799,6 @@ class PackedResourceLibrary(ResourceLibrary):
+ 
+     def get_path(self, resolve):
+         extract_path = _make_absolute(self.extract_path, self.suite.dir)
+-        download_path = super(PackedResourceLibrary, self).get_path(resolve)
+-        if resolve and self._check_extract_needed(extract_path, download_path):
+-            extract_path_tmp = tempfile.mkdtemp(suffix=basename(extract_path), dir=dirname(extract_path))
+-            try:
+-                # extract archive
+-                Extractor.create(download_path).extract(extract_path_tmp)
+-                # ensure modification time is up to date
+-                os.utime(extract_path_tmp, None)
+-                logv("Moving temporary directory {} to {}".format(extract_path_tmp, extract_path))
+-                try:
+-                    # attempt atomic overwrite
+-                    os.rename(extract_path_tmp, extract_path)
+-                except OSError:
+-                    # clean destination & re-try for cases where atomic overwrite doesn't work
+-                    rmtree(extract_path, ignore_errors=True)
+-                    os.rename(extract_path_tmp, extract_path)
+-            except OSError as ose:
+-                # Rename failed. Race with other process?
+-                if self._check_extract_needed(extract_path, download_path):
+-                    # ok something really went wrong
+-                    abort("Extracting {} failed!".format(download_path), context=ose)
+-            finally:
+-                rmtree(extract_path_tmp, ignore_errors=True)
+-
+         return extract_path
+ 
+     def _check_download_needed(self):
+@@ -8430,7 +8318,7 @@ class VC(_with_metaclass(ABCMeta, object)):
+         :param str branch: a branch name
+         :param bool abortOnError: if True abort on error
+         """
+-        abort(self.kind + " update_to_branch is not implemented")
++        self.run(['hg', vcdir] + cmd)
+ 
+     def is_release_from_tags(self, vcdir, prefix):
+         """
+@@ -8831,7 +8719,7 @@ class HgConfig(VC):
+                 return None
+ 
+     def parent_info(self, vcdir, abortOnError=True):
+-        out = self.hg_command(vcdir, ["log", "-r", ".", "--template", "{author}|||{date|hgdate}"], abortOnError=abortOnError)
++        out = _check_output_str(["hg", '-R', vcdir, "log", "-r", ".", "--template", "{author}|||{date|hgdate}"])
+         author, date = out.split("|||")
+         ts, _ = date.split(" ")
+         return self._sanitize_parent_info({
+@@ -14069,6 +13957,7 @@ class Archiver(SafeFileCreation):
+ 
+     def _add_zip(self, filename, archive_name, provenance):
+         self._add_provenance(archive_name, provenance)
++        os.utime(filename, (315532800, 315532800))
+         self.zf.write(filename, archive_name)
+ 
+     def _add_str_zip(self, data, archive_name, provenance):
diff --git a/pkgs/development/compilers/graalvm/005_tool_jt.rb.patch b/pkgs/development/compilers/graalvm/005_tool_jt.rb.patch
new file mode 100644
index 000000000000..06f693db9f63
--- /dev/null
+++ b/pkgs/development/compilers/graalvm/005_tool_jt.rb.patch
@@ -0,0 +1,46 @@
+diff --git a/tool/jt.rb b/tool/jt.rb
+index 870d88edcb..0a6e4c367b 100755
+--- a/tool/jt.rb
++++ b/tool/jt.rb
+@@ -152,13 +152,16 @@ module Utilities
+   end
+ 
+   def find_mx
+-    if which('mx')
+-      'mx'
++    if ENV.key?("MX_GIT_CACHE_DIR")
++      "mx-internal"
+     else
+-      mx_repo = find_or_clone_repo("https://github.com/graalvm/mx.git")
+-      "#{mx_repo}/mx"
++      if which('mx')
++        'mx'
++      else
++        mx_repo = find_or_clone_repo("https://github.com/graalvm/mx.git")
++        "#{mx_repo}/mx"
++      end
+     end
+-  end
+ 
+   def find_launcher(use_native)
+     if use_native
+@@ -444,8 +447,8 @@ module Commands
+           --no-sforceimports                         do not run sforceimports before building
+           parser                                     build the parser
+           options                                    build the options
+-          graalvm                                    build a minimal JVM-only GraalVM containing only TruffleRuby, 
+-                                                     available by default in mxbuild/truffleruby-jvm, 
++          graalvm                                    build a minimal JVM-only GraalVM containing only TruffleRuby,
++                                                     available by default in mxbuild/truffleruby-jvm,
+                                                      the Ruby is symlinked into rbenv or chruby if available
+               --graal      include the GraalVM Compiler in the build
+               --native     build native ruby image as well, available in mxbuild/truffleruby-native
+@@ -491,7 +494,7 @@ module Commands
+       jt test compiler                               run compiler tests
+       jt test integration [TESTS]                    run integration tests
+       jt test bundle [--jdebug]                      tests using bundler
+-      jt test gems [TESTS]                           tests using gems 
++      jt test gems [TESTS]                           tests using gems
+       jt test ecosystem [TESTS]                      tests using the wider ecosystem such as bundler, Rails, etc
+       jt test cexts [--no-openssl] [--no-gems] [test_names...]
+                                                      run C extension tests (set GEM_HOME)
diff --git a/pkgs/development/compilers/graalvm/006_mx_copylib.py.patch b/pkgs/development/compilers/graalvm/006_mx_copylib.py.patch
new file mode 100644
index 000000000000..43ca3e168327
--- /dev/null
+++ b/pkgs/development/compilers/graalvm/006_mx_copylib.py.patch
@@ -0,0 +1,14 @@
+diff --git a/mx.fastr/mx_copylib.py b/mx.fastr/mx_copylib.py
+index 4f57e1954..db45220d9 100644
+--- a/mx.fastr/mx_copylib.py
++++ b/mx.fastr/mx_copylib.py
+@@ -54,6 +54,9 @@ def _copylib(lib, libpath, plain_libpath_base, target):
+     else:
+         try:
+             if platform.system() == 'Linux':
++                # https://github.com/oracle/fastr/issues/110
++                if libpath.endswith("libgcc_s.so"):
++                    libpath = libpath + ".1"
+                 output = subprocess.check_output(['objdump', '-p', libpath])
+             elif platform.system() == 'SunOS':
+                 output = subprocess.check_output(['elfdump', '-d', libpath])
diff --git a/pkgs/development/compilers/graalvm/007_unimplemented.c.patch b/pkgs/development/compilers/graalvm/007_unimplemented.c.patch
new file mode 100644
index 000000000000..96cca7ed239b
--- /dev/null
+++ b/pkgs/development/compilers/graalvm/007_unimplemented.c.patch
@@ -0,0 +1,85 @@
+diff --git a/com.oracle.truffle.r.native/fficall/src/common/unimplemented.c b/com.oracle.truffle.r.native/fficall/src/common/unimplemented.c
+index dcf081316..c2cb4879b 100644
+--- a/com.oracle.truffle.r.native/fficall/src/common/unimplemented.c
++++ b/com.oracle.truffle.r.native/fficall/src/common/unimplemented.c
+@@ -20,8 +20,10 @@
+ 
+ #include <Rinternals.h>
+ #include <stdlib.h>
++#include <rlocale.h>
+ 
+ #include <R_ext/eventloop.h>
++#include <R_ext/GraphicsEngine.h>
+ #include <Defn.h>
+ 
+ Rboolean known_to_be_latin1 = FALSE;
+@@ -166,3 +168,69 @@ int Scollate(SEXP a, SEXP b) {
+ void z_prec_r(Rcomplex *r, Rcomplex *x, double digits) {
+     unimplemented("z_prec_r");
+ }
++
++int Rf_AdobeSymbol2ucs2(int n) {
++  unimplemented("Rf_AdobeSymbol2ucs2");
++  return 0;
++}
++
++size_t Mbrtowc(wchar_t *wc, const char *s, size_t n, mbstate_t *ps) {
++  unimplemented("Mbrtowc");
++  return 0;
++}
++
++double R_GE_VStrHeight(const char *s, cetype_t enc, const pGEcontext gc, pGEDevDesc dd) {
++  unimplemented("R_GE_VStrHeight");
++  return 0;
++}
++
++void R_GE_VText(double x, double y, const char * const s, cetype_t enc,
++		double x_justify, double y_justify, double rotation,
++		const pGEcontext gc, pGEDevDesc dd) {
++  unimplemented("R_GE_VText");
++}
++
++double R_GE_VStrWidth(const char *s, cetype_t enc, const pGEcontext gc, pGEDevDesc dd) {
++  unimplemented("R_GE_VStrWidth");
++}
++
++void setulb(int n, int m, double *x, double *l, double *u, int *nbd,
++	    double *f, double *g, double factr, double *pgtol,
++	    double *wa, int * iwa, char *task, int iprint, int *isave) {
++  unimplemented("setulb");
++}
++
++void genptry(int n, double *p, double *ptry, double scale, void *ex) {
++  unimplemented("genptry");
++}
++
++double EXP(double x) {
++  unimplemented("EXP");
++  return 0;
++}
++
++double LOG(double x) {
++  unimplemented("LOG");
++  return 0;
++}
++
++Rwchar_t Rf_utf8toucs32(wchar_t high, const char *s) {
++  unimplemented("Rf_utf8toucs32");
++  return 0;
++}
++
++size_t mbtoucs(unsigned int *wc, const char *s, size_t n) {
++  unimplemented("mbtoucs");
++  return (size_t) 0;
++}
++
++
++int DispatchOrEval(SEXP call, SEXP op, const char *generic, SEXP args,
++		   SEXP rho, SEXP *ans, int dropmissing, int argsevald) {
++  unimplemented("DispatchOrEval");
++  return 0;
++}
++
++void ENSURE_NAMEDMAX (SEXP x) {
++  unimplemented("ENSURE_NAMEDMAX");
++}
diff --git a/pkgs/development/compilers/graalvm/008_remove_jfr.patch b/pkgs/development/compilers/graalvm/008_remove_jfr.patch
new file mode 100644
index 000000000000..1aea044c8023
--- /dev/null
+++ b/pkgs/development/compilers/graalvm/008_remove_jfr.patch
@@ -0,0 +1,33 @@
+diff --git a/mx.jvmci/suite.py b/mx.jvmci/suite.py
+index 9690c0a38f..fa1d36b7e1 100644
+--- a/mx.jvmci/suite.py
++++ b/mx.jvmci/suite.py
+@@ -241,18 +241,7 @@ suite = {
+       "workingSets" : "JVMCI,HotSpot,SPARC",
+     },
+ 
+-    "jdk.vm.ci.hotspot.jfr" : {
+-      "subDir" : "jvmci",
+-      "sourceDirs" : ["src"],
+-      "dependencies" : [
+-        "jdk.vm.ci.hotspot",
+-        "JFR",
+-      ],
+-      "checkstyle" : "jdk.vm.ci.hotspot",
+-      "javaCompliance" : "1.8",
+-      "profile" : "",
+-      "workingSets" : "JVMCI,HotSpot",
+-    },
++
+ 
+     "hotspot" : {
+       "native" : True,
+@@ -354,7 +343,7 @@ suite = {
+         "jdk.vm.ci.hotspot.aarch64",
+         "jdk.vm.ci.hotspot.amd64",
+         "jdk.vm.ci.hotspot.sparc",
+-        "jdk.vm.ci.hotspot.jfr",
++
+       ],
+       "distDependencies" : [
+         "JVMCI_SERVICES",
diff --git a/pkgs/development/compilers/graalvm/009_remove_signedness_verifier.patch b/pkgs/development/compilers/graalvm/009_remove_signedness_verifier.patch
new file mode 100644
index 000000000000..cf8bd4050662
--- /dev/null
+++ b/pkgs/development/compilers/graalvm/009_remove_signedness_verifier.patch
@@ -0,0 +1,21 @@
+diff --git a/substratevm/src/com.oracle.svm.hosted/src/com/oracle/svm/hosted/c/query/SizeAndSignednessVerifier.java b/substratevm/src/com.oracle.svm.hosted/src/com/oracle/svm/hosted/c/query/SizeAndSignednessVerifier.java
+index 23a76357fd2..f13694b6ed7 100644
+--- a/substratevm/src/com.oracle.svm.hosted/src/com/oracle/svm/hosted/c/query/SizeAndSignednessVerifier.java
++++ b/substratevm/src/com.oracle.svm.hosted/src/com/oracle/svm/hosted/c/query/SizeAndSignednessVerifier.java
+@@ -249,15 +249,6 @@ public final class SizeAndSignednessVerifier extends NativeInfoTreeVisitor {
+     }
+ 
+     private void checkSignedness(boolean isUnsigned, ResolvedJavaType type, ResolvedJavaMethod method) {
+-        if (isSigned(type)) {
+-            if (isUnsigned) {
+-                addError("Type " + type.toJavaName(false) + " is signed, but accessed C value is unsigned", method);
+-            }
+-        } else if (nativeLibs.isWordBase(type)) {
+-            /* every Word type other than Signed is assumed to be unsigned. */
+-            if (!isUnsigned) {
+-                addError("Type " + type.toJavaName(false) + " is unsigned, but accessed C value is signed", method);
+-            }
+-        }
++
+     }
+ }
diff --git a/pkgs/development/compilers/graalvm/010_mx_substratevm.py b/pkgs/development/compilers/graalvm/010_mx_substratevm.py
new file mode 100644
index 000000000000..afb6b5681679
--- /dev/null
+++ b/pkgs/development/compilers/graalvm/010_mx_substratevm.py
@@ -0,0 +1,13 @@
+diff --git a/substratevm/mx.substratevm/mx_substratevm.py b/substratevm/mx.substratevm/mx_substratevm.py
+index b89163ef983..0fd0138b336 100644
+--- a/substratevm/mx.substratevm/mx_substratevm.py
++++ b/substratevm/mx.substratevm/mx_substratevm.py
+@@ -189,7 +189,7 @@ if str(svm_java_compliance().value) not in GRAAL_COMPILER_FLAGS_MAP:
+     mx.abort("Substrate VM does not support this Java version: " + str(svm_java_compliance()))
+ GRAAL_COMPILER_FLAGS = GRAAL_COMPILER_FLAGS_BASE + GRAAL_COMPILER_FLAGS_MAP[str(svm_java_compliance().value)]
+ 
+-IMAGE_ASSERTION_FLAGS = ['-H:+VerifyGraalGraphs', '-H:+VerifyPhases']
++IMAGE_ASSERTION_FLAGS = ['-H:+VerifyGraalGraphs', '-H:+VerifyPhases', '-H:+ReportExceptionStackTraces']
+ suite = mx.suite('substratevm')
+ svmSuites = [suite]
+ clibraryDists = ['SVM_HOSTED_NATIVE']
diff --git a/pkgs/development/compilers/graalvm/default.nix b/pkgs/development/compilers/graalvm/default.nix
index ec81063e67e2..b3066b3098cb 100644
--- a/pkgs/development/compilers/graalvm/default.nix
+++ b/pkgs/development/compilers/graalvm/default.nix
@@ -1,10 +1,11 @@
 { stdenv, lib, fetchFromGitHub, fetchurl, fetchzip, fetchgit, mercurial_4, python27, setJavaClassPath,
-  zlib, makeWrapper, openjdk, unzip, git, clang, llvm, which, icu, ruby, bzip2, glibc
-  # gfortran, readline, bzip2, lzma, pcre, curl, ed, tree ## WIP: fastr deps
+  which, zlib, makeWrapper, openjdk, unzip, git, clang, llvm, icu, ruby, glibc, bash, gcc, libobjc,
+  xcodebuild, gfortran, readline, bzip2, lzma, pcre, curl, ed, libresolv, libiconv, writeScriptBin,
+  openssl, perl, CoreFoundation, Foundation, JavaNativeFoundation, JavaRuntimeSupport, JavaVM, Cocoa
 }:
 
 let
-  version = "19.1.1";
+  version = "19.2.1";
   mercurial = mercurial_4;
   truffleMake = ./truffle.make;
   makeMxGitCache = list: out: ''
@@ -25,6 +26,57 @@ let
     chmod -R +rw ${out}/graaljs/graal-nodejs/mx.graal-nodejs/python2
     patchShebangs ${out}/graaljs/graal-nodejs/mx.graal-nodejs/python2/python
 
+    # # TUFFLE-RUBY # #
+    (cd ${out}/truffleruby && git apply ${./005_tool_jt.rb.patch})
+    patchShebangs ${out}/truffleruby/tool/query-versions-json.rb
+
+    substituteInPlace ${out}/truffleruby/src/main/c/Makefile \
+      --replace '(MX_HOME)/mx' '(MX_HOME)/mx-internal'
+
+    substituteInPlace ${out}/truffleruby/src/processor/java/org/truffleruby/processor/BuildInformationProcessor.java \
+      --replace 'trufflerubyHome = findHome();' \
+                'trufflerubyHome = new File(System.getenv("MX_GIT_CACHE_DIR"), "truffleruby");' \
+      --replace tool/query-versions-json.rb 'ruby tool/query-versions-json.rb' \
+      --replace 'revision = runCommand("git rev-parse --short=8 HEAD");' \
+                'revision = "${version}";' \
+      --replace 'compileDate = runCommand("git log -1 --date=short --pretty=format:%cd");' \
+                'compileDate = "1970-01-01";'
+
+    substituteInPlace ${out}/truffleruby/mx.truffleruby/mx_truffleruby.py \
+      --replace "mx_binary = join(mx._mx_home, 'mx')" "mx_binary = join(mx._mx_home, 'mx-internal')"
+
+    # # FASTR # #
+    (cd ${out}/fastr && git apply ${ ./006_mx_copylib.py.patch })
+    (cd ${out}/fastr && git apply ${ ./007_unimplemented.c.patch })
+    substituteInPlace ${out}/fastr/com.oracle.truffle.r.parser.processor/src/com/oracle/truffle/r/parser/processor/GenerateRParserProcessor.java \
+      --replace 'File suiteRoot = srcGenDir.getCanonicalFile().getParentFile().getParentFile().getParentFile();' \
+                'File suiteRoot = new File(System.getenv("MX_GIT_CACHE_DIR"), "fastr");'
+
+    substituteInPlace ${out}/fastr/com.oracle.truffle.r.native/gnur/Makefile.libs \
+      --replace 'mx -p' 'mx-internal -p'
+
+    substituteInPlace ${out}/fastr/com.oracle.truffle.r.native/include/Makefile \
+      --replace 'mx -p' 'mx-internal -p'
+
+    substituteInPlace ${out}/fastr/com.oracle.truffle.r.native/fficall/Makefile \
+      --replace 'mx -p' 'mx-internal -p'
+
+    substituteInPlace ${out}/fastr/com.oracle.truffle.r.native.recommended/Makefile \
+      --replace 'mx -p' 'mx-internal -p'
+
+    # Make sure that the logs aren't hidden when compiling gnur
+    substituteInPlace ${out}/fastr/com.oracle.truffle.r.native/gnur/Makefile.gnur \
+      --replace '> gnur_configure.log 2>&1' "" \
+      --replace '> gnur_make.log 2>&1' ""
+
+    substituteInPlace ${out}/fastr/com.oracle.truffle.r.native/run/Linux/Renviron \
+      --replace /bin/ "" \
+      --replace /usr/bin/ ""
+
+    sed -i "s|exec \$mx|exec mx-internal|g" ${out}/fastr/com.oracle.truffle.r.native/run/*.sh
+    chmod +x ${out}/fastr/com.oracle.truffle.r.native/run/*.sh
+    patchShebangs ${out}/fastr/com.oracle.truffle.r.native/run/*.sh
+
     cd ${out}
     hg init
     hg add
@@ -50,14 +102,15 @@ let
                 unzip "$out/${name}" -d "$out/$BASENAME.extracted"
 
                 # Ninja is called later in the build process
-                if [ -f $out/$BASENAME.extracted/ninja ]; then
-                  patchelf --set-interpreter \
-                    "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-                    --set-rpath "${stdenv.cc.cc.lib}/lib64" \
-                    $out/$BASENAME.extracted/ninja
-                fi
-              ''
-            else ""}
+               ${lib.optionalString stdenv.isLinux ''
+                 if [ -f $out/$BASENAME.extracted/ninja ]; then
+                   patchelf --set-interpreter \
+                     "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+                     --set-rpath "${stdenv.cc.cc.lib}/lib64" \
+                     $out/$BASENAME.extracted/ninja
+                 fi''}
+                ''
+              else ""}
          '') list}
       '';
     };
@@ -89,30 +142,32 @@ let
     rec { sha1 = "42a25dc3219429f0e5d060061f71acb49bf010a0"; name = "HAMCREST_${sha1}/hamcrest.jar";                                                   url = mirror://maven/org/hamcrest/hamcrest-core/1.3/hamcrest-core-1.3.jar; }
     rec { sha1 = "1dc37250fbc78e23a65a67fbbaf71d2e9cbc3c0b"; name = "HAMCREST_${sha1}/hamcrest.sources.jar";                                           url = mirror://maven/org/hamcrest/hamcrest-core/1.3/hamcrest-core-1.3-sources.jar; }
     rec { sha1 = "0d031013db9a80d6c88330c42c983fbfa7053193"; name = "hsdis_${sha1}/hsdis.so";                                                          url = "https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/hsdis/intel/hsdis-amd64-linux-${sha1}.so"; }
-  ];
+] ++ lib.optionals stdenv.isLinux [
+  rec { sha1 = "0d031013db9a80d6c88330c42c983fbfa7053193"; name = "hsdis_${sha1}/hsdis.so";                                                          url = "https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/hsdis/intel/hsdis-amd64-linux-${sha1}.so"; }
+                                                                          ]
+++ lib.optionals stdenv.isDarwin [
+  rec { sha1 = "67f6d23cbebd8998450a88b5bef362171f66f11a"; name = "hsdis_${sha1}/hsdis.dylib";                                                       url = "https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/hsdis/intel/hsdis-amd64-darwin-${sha1}.dylib"; }
+                                                                          ];
 
   graal-mxcache = jvmci8-mxcache ++ [
+    # rec { sha1 = "5001adab652fc4eb35e30cdefbb0765442f8b7db"; name = "LLVM_ORG_LIBCXX_SRC_${sha1}/llvm-org-libcxx-src.tar.gz";                          url = https://lafo.ssw.uni-linz.ac.at/pub/llvm-org/compiler-rt-llvmorg-8.0.0-4-gd563e33a79-bgae3b177eaa-linux-amd64.tar.gz; }
+    rec { sha1 = "5001adab652fc4eb35e30cdefbb0765442f8b7db"; name = "LLVM_ORG_COMPILER_RT_LINUX_${sha1}/llvm-org-compiler-rt-linux.tar.gz";            url = https://lafo.ssw.uni-linz.ac.at/pub/llvm-org/compiler-rt-llvmorg-8.0.0-4-gd563e33a79-bgae3b177eaa-linux-amd64.tar.gz; }
     rec { sha1 = "a990b2dba1c706f5c43c56fedfe70bad9a695852"; name = "LLVM_WRAPPER_${sha1}/llvm-wrapper.jar";                                           url = mirror://maven/org/bytedeco/javacpp-presets/llvm/6.0.1-1.4.2/llvm-6.0.1-1.4.2.jar; }
     rec { sha1 = "decbd95d46092fa9afaf2523b5b23d07ad7ad6bc"; name = "LLVM_WRAPPER_${sha1}/llvm-wrapper.sources.jar";                                   url = mirror://maven/org/bytedeco/javacpp-presets/llvm/6.0.1-1.4.2/llvm-6.0.1-1.4.2-sources.jar; }
-    rec { sha1 = "344483aefa15147c121a8fb6fb35a2406768cc5c"; name = "LLVM_PLATFORM_SPECIFIC_${sha1}/llvm-platform-specific.jar";                       url = mirror://maven/org/bytedeco/javacpp-presets/llvm/6.0.1-1.4.2/llvm-6.0.1-1.4.2-linux-x86_64.jar; }
-    rec { sha1 = "503402aa0cf80fd95ede043c0011152c2b4556fd"; name = "LLVM_PLATFORM_${sha1}/llvm-platform.jar";                                         url = mirror://maven/org/bytedeco/javacpp-presets/llvm-platform/6.0.1-1.4.2/llvm-platform-6.0.1-1.4.2.jar; }
     rec { sha1 = "cfa6a0259d98bff5aa8d41ba11b4d1dad648fbaa"; name = "JAVACPP_${sha1}/javacpp.jar";                                                     url = mirror://maven/org/bytedeco/javacpp/1.4.2/javacpp-1.4.2.jar; }
     rec { sha1 = "fdb2d2c17f6b91cdd5421554396da8905f0dfed2"; name = "JAVACPP_${sha1}/javacpp.sources.jar";                                             url = mirror://maven/org/bytedeco/javacpp/1.4.2/javacpp-1.4.2-sources.jar; }
     rec { sha1 = "702ca2d0ae93841c5ab75e4d119b29780ec0b7d9"; name = "NINJA_SYNTAX_${sha1}/ninja-syntax.tar.gz";                                        url = "https://pypi.org/packages/source/n/ninja_syntax/ninja_syntax-1.7.2.tar.gz"; }
-    rec { sha1 = "987234c4ce45505c21302e097c24efef4873325c"; name = "NINJA_${sha1}/ninja.zip";                                                         url = "https://github.com/ninja-build/ninja/releases/download/v1.8.2/ninja-linux.zip";
-          isNinja = true; }
     rec { sha1 = "f2cfb09cee12469ff64f0d698b13de19903bb4f7"; name = "NanoHTTPD-WebSocket_${sha1}/nanohttpd-websocket.jar";                             url = mirror://maven/org/nanohttpd/nanohttpd-websocket/2.3.1/nanohttpd-websocket-2.3.1.jar; }
     rec { sha1 = "a8d54d1ca554a77f377eff6bf9e16ca8383c8f6c"; name = "NanoHTTPD_${sha1}/nanohttpd.jar";                                                 url = mirror://maven/org/nanohttpd/nanohttpd/2.3.1/nanohttpd-2.3.1.jar; }
     rec { sha1 = "946f8aa9daa917dd81a8b818111bec7e288f821a"; name = "ANTLR4_${sha1}/antlr4.jar";                                                       url = mirror://maven/org/antlr/antlr4-runtime/4.7.1/antlr4-runtime-4.7.1.jar; }
     rec { sha1 = "c3aeac59c022bdc497c8c48ed86fa50450e4896a"; name = "JLINE_${sha1}/jline.jar";                                                         url = mirror://maven/jline/jline/2.14.6/jline-2.14.6.jar; }
     rec { sha1 = "d0bdc21c5e6404726b102998e44c66a738897905"; name = "JAVA_ALLOCATION_INSTRUMENTER_${sha1}/java-allocation-instrumenter.jar";           url = mirror://maven/com/google/code/java-allocation-instrumenter/java-allocation-instrumenter/3.1.0/java-allocation-instrumenter-3.1.0.jar; }
-    rec { sha1 = "0da08b8cce7bbf903602a25a3a163ae252435795"; name = "ASM5_${sha1}/asm5.jar";                                                        url = mirror://maven/org/ow2/asm/asm/5.0.4/asm-5.0.4.jar; }
+    rec { sha1 = "0da08b8cce7bbf903602a25a3a163ae252435795"; name = "ASM5_${sha1}/asm5.jar";                                                           url = mirror://maven/org/ow2/asm/asm/5.0.4/asm-5.0.4.jar; }
     rec { sha1 = "396ce0c07ba2b481f25a70195c7c94922f0d1b0b"; name = "ASM_TREE5_${sha1}/asm-tree5.jar";                                                 url = mirror://maven/org/ow2/asm/asm-tree/5.0.4/asm-tree-5.0.4.jar; }
     rec { sha1 = "280c265b789e041c02e5c97815793dfc283fb1e6"; name = "LIBFFI_SOURCES_${sha1}/libffi-sources.tar.gz";                                    url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/libffi-3.2.1.tar.gz; }
     rec { sha1 = "8819cea8bfe22c9c63f55465e296b3855ea41786"; name = "TruffleJSON_${sha1}/trufflejson.jar";                                             url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/trufflejson-20180130.jar; }
     rec { sha1 = "9712a8124c40298015f04a74f61b3d81a51513af"; name = "CHECKSTYLE_8.8_${sha1}/checkstyle-8.8.jar";                                       url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/checkstyle-8.8-all.jar; }
-    rec { sha1 = "158ba6f2b346469b5f8083d1700c3f55b8b9082c"; name = "VISUALVM_COMMON_${sha1}/visualvm-common.tar.gz";                                  url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/visualvm/visualvm-19_0_0-11.tar.gz; }
-    rec { sha1 = "eb5ffa476ed2f6fac0ecd4bb2ae32741f9646932"; name = "VISUALVM_PLATFORM_SPECIFIC_${sha1}/visualvm-platform-specific.tar.gz";            url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/visualvm/visualvm-19_0_0-11-linux-amd64.tar.gz; }
+    rec { sha1 = "8dc5a90bed5f51d7538d05b8c31c31b7dfddbd66"; name = "VISUALVM_COMMON_${sha1}/visualvm-common.tar.gz";                                  url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/visualvm/visualvm-19_0_0-20.tar.gz; }
     rec { sha1 = "e6e60889b7211a80b21052a249bd7e0f88f79fee"; name = "Java-WebSocket_${sha1}/java-websocket.jar";                                       url = mirror://maven/org/java-websocket/Java-WebSocket/1.3.9/Java-WebSocket-1.3.9.jar; }
     rec { sha1 = "7a4d00d5ec5febd252a6182e8b6e87a0a9821f81"; name = "ICU4J_${sha1}/icu4j.jar";                                                         url = mirror://maven/com/ibm/icu/icu4j/62.1/icu4j-62.1.jar; }
     # This duplication of asm with underscore and minus is totally weird
@@ -138,15 +193,25 @@ let
     rec { sha1 = "505a09064f6e2209616f38724f6d97d8d889aa92"; name = "JONI_${sha1}/joni.sources.jar";                                                   url = mirror://maven/org/jruby/joni/joni/2.1.25/joni-2.1.25-sources.jar; }
     rec { sha1 = "c4f7d054303948eb6a4066194253886c8af07128"; name = "XZ-1.8_${sha1}/xz-1.8.jar";                                                       url = mirror://maven/org/tukaani/xz/1.8/xz-1.8.jar; }
     rec { sha1 = "9314d3d372b05546a33791fbc8dd579c92ebd16b"; name = "GNUR_${sha1}/gnur.tar.gz";                                                        url = http://cran.rstudio.com/src/base/R-3/R-3.5.1.tar.gz; }
-    rec { sha1 = "90aa8308da72ae610207d8f6ca27736921be692a"; name = "ANTLR4_COMPLETE_${sha1}/antlr4-complete.jar";                                     url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/antlr-4.7.1-complete.jar; }
-  ];
+    rec { sha1 = "90aa8308da72ae610207d8f6ca27736921be692a"; name = "ANTLR4_COMPLETE_${sha1}/antlr4-complete.jar";                                     url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/antlr-4.7.1-complete.jar; }] ++
+  lib.optionals stdenv.isLinux [
+    rec { sha1 = "df4c1f784294d02a82d78664064248283bfcc297"; name = "LLVM_ORG_${sha1}/llvm-org.tar.gz";                                                url = https://lafo.ssw.uni-linz.ac.at/pub/llvm-org/llvm-llvmorg-8.0.0-4-gd563e33a79-bgae3b177eaa-linux-amd64.tar.gz; }
+    rec { sha1 = "344483aefa15147c121a8fb6fb35a2406768cc5c"; name = "LLVM_PLATFORM_SPECIFIC_${sha1}/llvm-platform-specific.jar";                       url = mirror://maven/org/bytedeco/javacpp-presets/llvm/6.0.1-1.4.2/llvm-6.0.1-1.4.2-linux-x86_64.jar; }
+    rec { sha1 = "fd1a723d62cbbc591041d303e8b151d89f131643"; name = "VISUALVM_PLATFORM_SPECIFIC_${sha1}/visualvm-platform-specific.tar.gz";            url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/visualvm/visualvm-19_0_0-20-linux-amd64.tar.gz; }
+    rec { sha1 = "987234c4ce45505c21302e097c24efef4873325c"; name = "NINJA_${sha1}/ninja.zip";                                                         url = "https://github.com/ninja-build/ninja/releases/download/v1.8.2/ninja-linux.zip";
+          isNinja = true; }] ++
+  lib.optionals stdenv.isDarwin [
+    rec { sha1 = "0fa1af180755fa4cc018ee9be33f2d7d827593c4"; name = "LLVM_ORG_${sha1}/llvm-org.tar.gz";                                                url = https://lafo.ssw.uni-linz.ac.at/pub/llvm-org/llvm-llvmorg-8.0.0-4-gd563e33a79-bgae3b177eaa-darwin-amd64.tar.gz; }
+    rec { sha1 = "57bc74574104a9e0a2dc4d7a71ffcc5731909e57"; name = "LLVM_PLATFORM_SPECIFIC_${sha1}/llvm-platform-specific.jar";                       url = mirror://maven/org/bytedeco/javacpp-presets/llvm/6.0.1-1.4.2/llvm-6.0.1-1.4.2-macosx-x86_64.jar; }
+    rec { sha1 = "ae23bb365930f720acc88c62640bae6852a37d67"; name = "VISUALVM_PLATFORM_SPECIFIC_${sha1}/visualvm-platform-specific.tar.gz";            url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/visualvm/visualvm-19_0_0-20-macosx-x86_64.tar.gz; }
+    rec { sha1 = "8142c497f7dfbdb052a1e31960fdfe2c6f9a5ca2"; name = "NINJA_${sha1}/ninja.zip";                                                         url = "https://github.com/ninja-build/ninja/releases/download/v1.8.2/ninja-mac.zip";
+          isNinja = true; }];
 
   graal-mxcachegit = [
-    { sha256 = "05z2830ng71bhgsxc0zyc74l1bz7hg54la8j1r99993fhhch4y36"; name = "graaljs";     url = "https://github.com/graalvm/graaljs.git";     rev = "vm-${version}"; }
-    { sha256 = "0ai5x4n1c2lcfkfpp29zn1bcmp3khc5hvssyw1qr1l2zy79fxwjp"; name = "truffleruby"; url = "https://github.com/oracle/truffleruby.git";  rev = "vm-${version}"; }
-    { sha256 = "010079qsl6dff3yca8vlzcahq9z1ppyr758shjkm1f7izwphjv7p"; name = "fastr";       url = "https://github.com/oracle/fastr.git";        rev = "vm-${version}"; }
-    { sha256 = "0hcqbasqs0yb7p1sal63qbxqxh942gh5vzl95pfdlflmc2g82v4q"; name = "graalpython"; url = "https://github.com/graalvm/graalpython.git"; rev = "vm-${version}"; }
-  ];
+    { sha256 = "01w39ms39gl3cw7c2fgcacr2yjg94im9x2x7p5g94l6xlcgqvcnr"; name = "graaljs";     url = "https://github.com/graalvm/graaljs.git";     rev = "vm-${version}"; }
+    { sha256 = "1dps9n5b9c80pbg1fmlwpffy6ina0f0h27di24kafc8isxrdggia"; name = "truffleruby"; url = "https://github.com/oracle/truffleruby.git";  rev = "vm-${version}"; }
+    { sha256 = "0jdpdqm3ld1wsasmi8ka26qf19cibjac8lrqm040h5vh0iqzxizy"; name = "fastr";       url = "https://github.com/oracle/fastr.git";        rev = "vm-${version}"; }
+    { sha256 = "1gv8vafwrafjzvgv4gwk4kcsb3bnvsx07qa5inc0bdyxy5shl381"; name = "graalpython"; url = "https://github.com/graalvm/graalpython.git"; rev = "vm-${version}"; }];
 
   ninja-syntax = python27.pkgs.buildPythonPackage rec {
     version = "1.7.2";
@@ -169,13 +234,13 @@ let
 in rec {
 
   mx = stdenv.mkDerivation rec {
-    version = "5.223.0";
+    version = "5.247.1";
     pname = "mx";
     src = fetchFromGitHub {
       owner  = "graalvm";
       repo   = "mx";
       rev    = version;
-      sha256 = "0q51dnm6n1472p93dxr4jh8d7cv09a70pq89cdgxwh42vapykrn9";
+      sha256 = "038qr49rqzkhj76nqd27h8fysssnlpdhmy23ks2y81xlxhlzkc59";
     };
     nativeBuildInputs = [ makeWrapper ];
     prePatch = ''
@@ -214,15 +279,17 @@ in rec {
   };
 
   jvmci8 = stdenv.mkDerivation rec {
-    version = "19.2-b01";
+    version = "19.3-b05";
     pname = "jvmci";
     src = fetchFromGitHub {
       owner  = "graalvm";
       repo   = "graal-jvmci-8";
       rev    = "jvmci-${version}";
-      sha256 = "0maipj871vaxvap4576m0pzblzqxfjjzmwap3ndd84ny8d6vbqaa";
+      sha256 =  "0j7my76vldbrvki9x1gn9ics3x2z96j05jdy4nflbpik8i396114";
     };
-    buildInputs = [ mx mercurial openjdk ];
+    buildInputs = [ mx mercurial openjdk ] ++ lib.optional stdenv.isDarwin [
+      libobjc CoreFoundation Foundation JavaNativeFoundation JavaRuntimeSupport JavaVM xcodebuild Cocoa
+    ];
     postUnpack = ''
       # a fake mercurial dir to prevent mx crash and supply the version to mx
       ( cd $sourceRoot
@@ -233,17 +300,27 @@ in rec {
         hg checkout ${lib.escapeShellArg src.rev}
       )
     '';
-    patches = [ ./004_mx_jvmci.py.patch ];
+    patches = [ ./004_mx_jvmci.py.patch ] ++
+              lib.optional stdenv.isDarwin [
+                ./008_remove_jfr.patch ];
     postPatch =''
       # The hotspot version name regex fix
       substituteInPlace mx.jvmci/mx_jvmci.py \
-        --replace "\\d+.\\d+-b\\d+" "\\d+.\\d+-bga"
-      substituteInPlace src/share/vm/jvmci/jvmciCompilerToVM.cpp \
-        --replace 'method->name_and_sig_as_C_string(), method->native_function(), entry' \
-                  'method->name_and_sig_as_C_string(), p2i(method->native_function()), p2i(entry)' || exit -1
+        --replace "\\d+.\\d+-b\\d+" "\\d+.\\d+-b[g\\d][a\\d]"
+      # darwin: https://github.com/oracle/graal/issues/1816
+      substituteInPlace src/share/vm/code/compiledIC.cpp \
+        --replace 'entry == false' '*entry == false'
     '';
     hardeningDisable = [ "fortify" ];
-    NIX_CFLAGS_COMPILE = "-Wno-error=format-overflow -Wno-error=nonnull";
+    NIX_CFLAGS_COMPILE = toString (lib.optional stdenv.isDarwin [
+      "-Wno-reserved-user-defined-literal"
+      "-Wno-c++11-narrowing"
+    ] ++
+    lib.optional stdenv.isLinux [
+      "-Wno-error=format-overflow" # newly detected by gcc7
+      "-Wno-error=nonnull"
+    ]);
+
     buildPhase = ''
       export MX_ALT_OUTPUT_ROOT=$NIX_BUILD_TOP/mxbuild
       export MX_CACHE_DIR=${makeMxCache jvmci8-mxcache}
@@ -254,7 +331,9 @@ in rec {
     '';
     installPhase = ''
       mkdir -p $out
-      mv openjdk1.8.0_*/linux-amd64/product/* $out
+      ${if stdenv.isDarwin
+        then "mv openjdk1.8.0_*/darwin-amd64/product/* $out"
+        else "mv openjdk1.8.0_*/linux-amd64/product/* $out"}
       install -v -m0555 -D $MX_CACHE_DIR/hsdis*/hsdis.so $out/jre/lib/amd64/hsdis-amd64.so
     '';
     # copy-paste openjdk's preFixup
@@ -276,25 +355,36 @@ in rec {
     inherit (openjdk) meta;
   };
 
-  graalvm8 = stdenv.mkDerivation rec {
+  graalvm8 = 	stdenv.mkDerivation rec {
     inherit version;
     pname = "graal";
     src = fetchFromGitHub {
       owner  = "oracle";
       repo   = "graal";
       rev    = "vm-${version}";
-      sha256 = "0abx6adk91yzaf1md4qbidxykpqcgphh6j4hj01ry57s4if0j66f";
+      sha256 = "0v8zkmzkyhmmmvra5pp876d4i4ijrrw15j98ipayc7is02kwiwmq";
     };
-    patches = [ ./002_setjmp.c.patch ./003_mx_truffle.py.patch ];
-    buildInputs = [ mx zlib mercurial jvmci8 git clang llvm
-                    python27withPackages which icu ruby bzip2
-                    # gfortran readline bzip2 lzma pcre.dev curl ed ## WIP: fastr dependencies
+
+    patches = [ ./002_setjmp.c.patch ./003_mx_truffle.py.patch ] ++
+              lib.optional stdenv.isDarwin [
+                ./009_remove_signedness_verifier.patch ./010_mx_substratevm.py
+              ];
+
+    buildInputs = [ mx zlib.dev mercurial jvmci8 git llvm clang
+                    python27withPackages icu ruby bzip2 which
+                    readline bzip2 lzma pcre curl ed gfortran
+                  ]  ++ lib.optional stdenv.isDarwin [
+                    CoreFoundation gcc.cc.lib libiconv perl openssl
                   ];
+
     postUnpack = ''
-      cp ${stdenv.cc.cc}/include/c++/${lib.getVersion stdenv.cc.cc}/stdlib.h \
-        $sourceRoot/sulong/projects/com.oracle.truffle.llvm.libraries.bitcode/include
-      cp ${truffleMake} $TMP && mv *truffle.make truffle.make
+      ${lib.optionalString stdenv.isLinux ''
+        cp ${stdenv.cc.cc}/include/c++/${lib.getVersion stdenv.cc.cc}/stdlib.h \
+          $sourceRoot/sulong/projects/com.oracle.truffle.llvm.libraries.bitcode/include
+      ''}
+      cp ${truffleMake} $TMPDIR/truffle.make
       rm $sourceRoot/truffle/src/libffi/patches/others/0001-Add-mx-bootstrap-Makefile.patch
+
       # a fake mercurial dir to prevent mx crash and supply the version to mx
       ( cd $sourceRoot
         hg init
@@ -303,57 +393,93 @@ in rec {
         hg tag      ${lib.escapeShellArg src.rev}
         hg checkout ${lib.escapeShellArg src.rev}
       )
+
+      # make a copy of jvmci8
+      mkdir $NIX_BUILD_TOP/jvmci8
+      cp -dpR ${jvmci8}/* $NIX_BUILD_TOP/jvmci8
+      chmod +w -R $NIX_BUILD_TOP/jvmci8
+      export MX_CACHE_DIR=${makeMxCache graal-mxcache}
+      export MX_GIT_CACHE_DIR=$NIX_BUILD_TOP/mxgitcache
+      ${makeMxGitCache graal-mxcachegit "$MX_GIT_CACHE_DIR"}
+      cd $TMPDIR
     '';
+
     postPatch = ''
       substituteInPlace substratevm/src/com.oracle.svm.core.posix/src/com/oracle/svm/core/posix/headers/PosixDirectives.java \
         --replace '<zlib.h>' '<${zlib.dev}/include/zlib.h>'
       substituteInPlace substratevm/src/com.oracle.svm.hosted/src/com/oracle/svm/hosted/image/CCLinkerInvocation.java \
         --replace 'cmd.add("-v");' 'cmd.add("-v"); cmd.add("-L${zlib}/lib");'
-      substituteInPlace substratevm/src/com.oracle.svm.hosted/src/com/oracle/svm/hosted/c/codegen/CCompilerInvoker.java \
-        --replace 'command.add(Platform.includedIn(Platform.WINDOWS.class) ? "CL" : "gcc");' \
-          'command.add(Platform.includedIn(Platform.WINDOWS.class) ? "CL" : "${stdenv.cc}/bin/gcc");'
+
+      # For debugging native-image build, add this replace statement on CCompilerInvoker.java
+      # --replace '(String line : lines) {' '(String line : lines) {System.out.println("DEBUG: " + line);'
+      ${if stdenv.isLinux then ''
+          substituteInPlace substratevm/src/com.oracle.svm.hosted/src/com/oracle/svm/hosted/c/codegen/CCompilerInvoker.java \
+            --replace 'command.add(Platform.includedIn(Platform.WINDOWS.class) ? "CL" : "gcc");' \
+                      'command.add(Platform.includedIn(Platform.WINDOWS.class) ? "CL" : "${stdenv.cc}/bin/gcc");' ''
+        else ''
+          substituteInPlace substratevm/src/com.oracle.svm.hosted/src/com/oracle/svm/hosted/c/codegen/CCompilerInvoker.java \
+            --replace 'command.add(Platform.includedIn(Platform.WINDOWS.class) ? "CL" : "gcc");' \
+                      'command.add(Platform.includedIn(Platform.WINDOWS.class) ? "CL" : "${gcc.cc}/bin/gcc");
+                       command.add("-F"); command.add("${CoreFoundation}/Library/Frameworks");
+                       command.add("-framework"); command.add("CoreFoundation");'
+       ''}
+
+      # prevent cyclical imports caused by identical <include> names
       substituteInPlace substratevm/src/com.oracle.svm.hosted/src/com/oracle/svm/hosted/image/CCLinkerInvocation.java \
         --replace 'protected String compilerCommand = "cc";' 'protected String compilerCommand = "${stdenv.cc}/bin/cc";'
-      # prevent cyclical imports caused by identical <include> names
-      substituteInPlace sulong/projects/com.oracle.truffle.llvm.libraries.bitcode/include/stdlib.h \
-        --replace '# include <cstdlib>' '# include "${stdenv.cc.cc}/include/c++/${lib.getVersion stdenv.cc.cc}/cstdlib"'
       # dragonegg can't seem to compile on nix, so let's not require it
       substituteInPlace sulong/mx.sulong/suite.py \
         --replace '"requireDragonegg" : True,' '"requireDragonegg" : False,'
       substituteInPlace truffle/mx.truffle/mx_truffle.py \
         --replace 'os.path.relpath(self.subject.delegate.dir, self.subject.suite.vc_dir)' \
                   'self.subject.delegate.dir'
-
+      substituteInPlace sulong/projects/bootstrap-toolchain-launchers/Makefile \
+        --replace /bin/bash ${bash}/bin/bash
       # Patch the native-image template, as it will be run during build
       chmod +x vm/mx.vm/launcher_template.sh && patchShebangs vm/mx.vm
       # Prevent random errors from too low maxRuntimecompilemethods
       substituteInPlace truffle/mx.truffle/macro-truffle.properties \
         --replace '-H:MaxRuntimeCompileMethods=1400' \
                   '-H:MaxRuntimeCompileMethods=28000'
+      ${lib.optionalString stdenv.isDarwin ''
+        substituteInPlace truffle/src/com.oracle.truffle.nfi.test.native/src/object.cc \
+          --replace '#include <stdlib.h>' ""
+      ''}
+      ${lib.optionalString stdenv.isLinux ''
+        substituteInPlace sulong/projects/com.oracle.truffle.llvm.libraries.bitcode/include/stdlib.h \
+          --replace '# include <cstdlib>' '# include "${stdenv.cc.cc}/include/c++/${lib.getVersion stdenv.cc.cc}/cstdlib"'
+      ''}
     '';
 
     buildPhase = ''
-      # make a copy of jvmci8
-      mkdir $NIX_BUILD_TOP/jvmci8
-      cp -dpR ${jvmci8}/* $NIX_BUILD_TOP/jvmci8
-      chmod +w -R $NIX_BUILD_TOP/jvmci8
-
       export MX_ALT_OUTPUT_ROOT=$NIX_BUILD_TOP/mxbuild
-      export MX_CACHE_DIR=${makeMxCache graal-mxcache}
       export MX_GIT_CACHE='refcache'
-      export MX_GIT_CACHE_DIR=$NIX_BUILD_TOP/mxgitcache
       export JVMCI_VERSION_CHECK='ignore'
       export JAVA_HOME=$NIX_BUILD_TOP/jvmci8
-      # export FASTR_RELEASE=true ## WIP
-      ${makeMxGitCache graal-mxcachegit "$MX_GIT_CACHE_DIR"}
-      cd $NIX_BUILD_TOP/source
-
+      export FASTR_RELEASE=true
+      export PKG_LDFLAGS_OVERRIDE="-L${pcre.out}/lib -L${zlib}/lib -L${gfortran.cc.lib}/lib64"
+      ${lib.optionalString stdenv.isDarwin ''
+        export CC="gcc"
+        export CPP="gcc -E"
+        export NIX_CXXSTDLIB_LINK=""
+        export NIX_TARGET_CXXSTDLIB_LINK=""
+        export OPENSSL_PREFIX=$(realpath openssl)
+        # this fixes error: impure path 'LibFFIHeaderDirectives' used in link
+        export NIX_ENFORCE_PURITY=0
+      ''}
       ( cd vm
-        mx-internal -v --dynamicimports /substratevm,/tools,sulong,/graal-nodejs,graalpython build
+        mx-internal -v --suite sdk --suite compiler --suite vm --suite tools --suite regex --suite truffle \
+                       --dynamicimports /substratevm,/sulong,graal-js,graalpython,fastr,truffleruby build
       )
     '';
 
-    installPhase = ''
+    installPhase =
+      (if stdenv.isDarwin then ''
+      mkdir -p $out
+      rm -rf $MX_ALT_OUTPUT_ROOT/vm/darwin-amd64/GRAALVM_*STAGE1*
+      cp -rf $MX_ALT_OUTPUT_ROOT/vm/darwin-amd64/GRAALVM*/graalvm-unknown-${version}/* $out
+      ''
+       else ''
       mkdir -p $out
       rm -rf $MX_ALT_OUTPUT_ROOT/vm/linux-amd64/GRAALVM_*STAGE1*
       cp -rf $MX_ALT_OUTPUT_ROOT/vm/linux-amd64/GRAALVM*/graalvm-unknown-${version}/* $out
@@ -366,7 +492,7 @@ in rec {
       cp -rf ${glibc}/lib/* $out/jre/lib/svm/clibraries/linux-amd64/
       cp ${glibc.static}/lib/* $out/jre/lib/svm/clibraries/linux-amd64/
       cp ${zlib.static}/lib/libz.a $out/jre/lib/svm/clibraries/linux-amd64/libz.a
-    '';
+    '');
 
     inherit (jvmci8) preFixup;
     dontStrip = true; # stripped javac crashes with "segmentaion fault"
@@ -390,12 +516,14 @@ in rec {
       ./helloworld
       ./helloworld | fgrep 'Hello World'
 
-      # Ahead-Of-Time compilation with --static
-      $out/bin/native-image --no-server --static HelloWorld
-      ./helloworld
-      ./helloworld | fgrep 'Hello World'
-    '';
-
+      ${lib.optionalString stdenv.isLinux
+        ''
+          # Ahead-Of-Time compilation with --static (supported on linux only)
+          $out/bin/native-image --no-server --static HelloWorld
+          ./helloworld
+          ./helloworld | fgrep 'Hello World'
+        ''}
+         '';
     enableParallelBuilding = true;
     passthru.home = graalvm8;
 
@@ -404,7 +532,7 @@ in rec {
       description = "High-Performance Polyglot VM";
       license = licenses.gpl2;
       maintainers = with maintainers; [ volth hlolli ];
-      platforms = [ "x86_64-linux" /*"aarch64-linux" "x86_64-darwin"*/ ];
+      platforms = [ "x86_64-linux" "x86_64-darwin" /*"aarch64-linux"*/ ];
     };
   };
 }
diff --git a/pkgs/development/compilers/graalvm/truffle.make b/pkgs/development/compilers/graalvm/truffle.make
index da887c142408..ec357446a5df 100644
--- a/pkgs/development/compilers/graalvm/truffle.make
+++ b/pkgs/development/compilers/graalvm/truffle.make
@@ -2,13 +2,15 @@
 
 # `make MX_VERBOSE=y` will report all lines executed. The actual value doesn't
 # matter as long as it's not empty.
+
 QUIETLY$(MX_VERBOSE) = @
 
 .PHONY: default
 
 default:
+	sed -i "s|-print-multi-os-directory||g" ../$(SOURCES)/configure
 	$(QUIETLY) echo CONFIGURE libffi
 	$(QUIETLY) mkdir ../$(OUTPUT)
-	$(QUIETLY) cd ../$(OUTPUT) && ../$(SOURCES)/configure $(CONFIGURE_ARGS) > ../libffi.configure.log
+	$(QUIETLY) cd ../$(OUTPUT) && ../$(SOURCES)/configure $(CONFIGURE_ARGS)
 	$(QUIETLY) echo MAKE libffi
-	$(QUIETLY) $(MAKE) -C ../$(OUTPUT) > ../libffi.build.log
+	$(QUIETLY) $(MAKE) -C ../$(OUTPUT)
diff --git a/pkgs/development/compilers/llvm/7/clang/HIP-use-PATH-7.patch b/pkgs/development/compilers/llvm/7/clang/HIP-use-PATH-7.patch
new file mode 100644
index 000000000000..764dddd966cb
--- /dev/null
+++ b/pkgs/development/compilers/llvm/7/clang/HIP-use-PATH-7.patch
@@ -0,0 +1,68 @@
+From 8412cba68835f8f4cc527d02194b181faa5944d4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Holger=20W=C3=BCnsche?= <holger.o.wuensche@t-online.de>
+Date: Tue, 21 Jan 2020 19:46:09 +0100
+Subject: [PATCH] [HIP] use GetProgramPath for executable discovery
+
+This change replaces the manual building of executable paths
+using llvm::sys::path::append with GetProgramPath.
+This enables adding other paths in case executables reside
+in different directories and makes the code easier to read.
+
+Differential Revision: https://reviews.llvm.org/D72903
+---
+ clang/lib/Driver/ToolChains/HIP.cpp | 18 ++++++------------
+ 1 file changed, 6 insertions(+), 12 deletions(-)
+
+diff --git a/lib/Driver/ToolChains/HIP.cpp b/lib/Driver/ToolChains/HIP.cpp
+index 03acf45a9b3..75fd3226c75 100644
+--- a/lib/Driver/ToolChains/HIP.cpp
++++ b/lib/Driver/ToolChains/HIP.cpp
+@@ -98,9 +98,8 @@ const char *AMDGCN::Linker::constructLLVMLinkCommand(
+   const char *OutputFileName =
+       C.addTempFile(C.getArgs().MakeArgString(TmpName));
+   CmdArgs.push_back(OutputFileName);
+-  SmallString<128> ExecPath(C.getDriver().Dir);
+-  llvm::sys::path::append(ExecPath, "llvm-link");
+-  const char *Exec = Args.MakeArgString(ExecPath);
++  const char *Exec =
++      Args.MakeArgString(getToolChain().GetProgramPath("llvm-link"));
+   C.addCommand(llvm::make_unique<Command>(JA, *this, Exec, CmdArgs, Inputs));
+   return OutputFileName;
+ }
+@@ -141,9 +140,8 @@ const char *AMDGCN::Linker::constructOptCommand(
+   const char *OutputFileName =
+       C.addTempFile(C.getArgs().MakeArgString(TmpFileName));
+   OptArgs.push_back(OutputFileName);
+-  SmallString<128> OptPath(C.getDriver().Dir);
+-  llvm::sys::path::append(OptPath, "opt");
+-  const char *OptExec = Args.MakeArgString(OptPath);
++  const char *OptExec =
++      Args.MakeArgString(getToolChain().GetProgramPath("opt"));
+   C.addCommand(llvm::make_unique<Command>(JA, *this, OptExec, OptArgs, Inputs));
+   return OutputFileName;
+ }
+@@ -161,9 +159,7 @@ const char *AMDGCN::Linker::constructLlcCommand(
+   const char *LlcOutputFile =
+       C.addTempFile(C.getArgs().MakeArgString(LlcOutputFileName));
+   LlcArgs.push_back(LlcOutputFile);
+-  SmallString<128> LlcPath(C.getDriver().Dir);
+-  llvm::sys::path::append(LlcPath, "llc");
+-  const char *Llc = Args.MakeArgString(LlcPath);
++  const char *Llc = Args.MakeArgString(getToolChain().GetProgramPath("llc"));
+   C.addCommand(llvm::make_unique<Command>(JA, *this, Llc, LlcArgs, Inputs));
+   return LlcOutputFile;
+ }
+@@ -178,9 +174,7 @@ void AMDGCN::Linker::constructLldCommand(Compilation &C, const JobAction &JA,
+   ArgStringList LldArgs{"-flavor",    "gnu", "--no-undefined",
+                         "-shared",    "-o",  Output.getFilename(),
+                         InputFileName};
+-  SmallString<128> LldPath(C.getDriver().Dir);
+-  llvm::sys::path::append(LldPath, "lld");
+-  const char *Lld = Args.MakeArgString(LldPath);
++  const char *Lld = Args.MakeArgString(getToolChain().GetProgramPath("lld"));
+   C.addCommand(llvm::make_unique<Command>(JA, *this, Lld, LldArgs, Inputs));
+ }
+ 
+-- 
+2.23.1
+
diff --git a/pkgs/development/compilers/llvm/7/clang/default.nix b/pkgs/development/compilers/llvm/7/clang/default.nix
index cc5dcfc160bc..6e01f4259ee0 100644
--- a/pkgs/development/compilers/llvm/7/clang/default.nix
+++ b/pkgs/development/compilers/llvm/7/clang/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetch, cmake, libxml2, llvm, version, clang-tools-extra_src, python3
+{ stdenv, fetch, cmake, libxml2, llvm, version, clang-tools-extra_src, python3, lld
 , fixDarwinDylibNames
 , enableManpages ? false
 , enablePolly ? false # TODO: get this info from llvm (passthru?)
@@ -22,7 +22,7 @@ let
     nativeBuildInputs = [ cmake python3 ]
       ++ stdenv.lib.optional enableManpages python3.pkgs.sphinx;
 
-    buildInputs = [ libxml2 llvm ]
+    buildInputs = [ libxml2 llvm lld ]
       ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
 
     cmakeFlags = [
@@ -38,7 +38,11 @@ let
       "-DLINK_POLLY_INTO_TOOLS=ON"
     ];
 
-    patches = [ ./purity.patch ];
+    patches = [
+      ./purity.patch
+      # make clang -xhip use $PATH to find executables
+      ./HIP-use-PATH-7.patch
+    ];
 
     postPatch = ''
       sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' \
diff --git a/pkgs/development/compilers/llvm/7/default.nix b/pkgs/development/compilers/llvm/7/default.nix
index f5dbea58a7db..04e1610fb791 100644
--- a/pkgs/development/compilers/llvm/7/default.nix
+++ b/pkgs/development/compilers/llvm/7/default.nix
@@ -32,6 +32,7 @@ let
     llvm-polly = callPackage ./llvm.nix { enablePolly = true; };
 
     clang-unwrapped = callPackage ./clang {
+      inherit (tools) lld;
       inherit clang-tools-extra_src;
     };
     clang-polly-unwrapped = callPackage ./clang {
diff --git a/pkgs/development/compilers/llvm/8/clang/HIP-use-PATH-8.patch b/pkgs/development/compilers/llvm/8/clang/HIP-use-PATH-8.patch
new file mode 100644
index 000000000000..f4be100d1ab9
--- /dev/null
+++ b/pkgs/development/compilers/llvm/8/clang/HIP-use-PATH-8.patch
@@ -0,0 +1,80 @@
+From d9f1b7d7571b252e0ba2359ae6cfa93a9903c0e7 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Holger=20W=C3=BCnsche?= <holger.o.wuensche@t-online.de>
+Date: Tue, 21 Jan 2020 19:49:44 +0100
+Subject: [PATCH] [HIP] use GetProgramPath for executable discovery
+
+This change replaces the manual building of executable paths
+using llvm::sys::path::append with GetProgramPath.
+This enables adding other paths in case executables reside
+in different directories and makes the code easier to read.
+
+Differential Revision: https://reviews.llvm.org/D72903
+---
+ clang/lib/Driver/ToolChains/HIP.cpp | 23 ++++++++---------------
+ 1 file changed, 8 insertions(+), 15 deletions(-)
+
+diff --git a/lib/Driver/ToolChains/HIP.cpp b/lang/lib/Driver/ToolChains/HIP.cpp
+index 868765cf88e..31f2d68ec6c 100644
+--- a/lib/Driver/ToolChains/HIP.cpp
++++ b/lib/Driver/ToolChains/HIP.cpp
+@@ -104,9 +104,8 @@ const char *AMDGCN::Linker::constructLLVMLinkCommand(
+   const char *OutputFileName =
+       C.addTempFile(C.getArgs().MakeArgString(TmpName));
+   CmdArgs.push_back(OutputFileName);
+-  SmallString<128> ExecPath(C.getDriver().Dir);
+-  llvm::sys::path::append(ExecPath, "llvm-link");
+-  const char *Exec = Args.MakeArgString(ExecPath);
++  const char *Exec =
++      Args.MakeArgString(getToolChain().GetProgramPath("llvm-link"));
+   C.addCommand(llvm::make_unique<Command>(JA, *this, Exec, CmdArgs, Inputs));
+   return OutputFileName;
+ }
+@@ -147,9 +146,8 @@ const char *AMDGCN::Linker::constructOptCommand(
+   const char *OutputFileName =
+       C.addTempFile(C.getArgs().MakeArgString(TmpFileName));
+   OptArgs.push_back(OutputFileName);
+-  SmallString<128> OptPath(C.getDriver().Dir);
+-  llvm::sys::path::append(OptPath, "opt");
+-  const char *OptExec = Args.MakeArgString(OptPath);
++  const char *OptExec =
++      Args.MakeArgString(getToolChain().GetProgramPath("opt"));
+   C.addCommand(llvm::make_unique<Command>(JA, *this, OptExec, OptArgs, Inputs));
+   return OutputFileName;
+ }
+@@ -167,9 +165,7 @@ const char *AMDGCN::Linker::constructLlcCommand(
+   const char *LlcOutputFile =
+       C.addTempFile(C.getArgs().MakeArgString(LlcOutputFileName));
+   LlcArgs.push_back(LlcOutputFile);
+-  SmallString<128> LlcPath(C.getDriver().Dir);
+-  llvm::sys::path::append(LlcPath, "llc");
+-  const char *Llc = Args.MakeArgString(LlcPath);
++  const char *Llc = Args.MakeArgString(getToolChain().GetProgramPath("llc"));
+   C.addCommand(llvm::make_unique<Command>(JA, *this, Llc, LlcArgs, Inputs));
+   return LlcOutputFile;
+ }
+@@ -184,9 +180,7 @@ void AMDGCN::Linker::constructLldCommand(Compilation &C, const JobAction &JA,
+   ArgStringList LldArgs{"-flavor",    "gnu", "--no-undefined",
+                         "-shared",    "-o",  Output.getFilename(),
+                         InputFileName};
+-  SmallString<128> LldPath(C.getDriver().Dir);
+-  llvm::sys::path::append(LldPath, "lld");
+-  const char *Lld = Args.MakeArgString(LldPath);
++  const char *Lld = Args.MakeArgString(getToolChain().GetProgramPath("lld"));
+   C.addCommand(llvm::make_unique<Command>(JA, *this, Lld, LldArgs, Inputs));
+ }
+ 
+@@ -218,9 +212,8 @@ void AMDGCN::constructHIPFatbinCommand(Compilation &C, const JobAction &JA,
+       Args.MakeArgString(std::string("-outputs=").append(OutputFileName));
+   BundlerArgs.push_back(BundlerOutputArg);
+ 
+-  SmallString<128> BundlerPath(C.getDriver().Dir);
+-  llvm::sys::path::append(BundlerPath, "clang-offload-bundler");
+-  const char *Bundler = Args.MakeArgString(BundlerPath);
++  const char *Bundler = Args.MakeArgString(
++          T.getToolChain().GetProgramPath("clang-offload-bundler"));
+   C.addCommand(llvm::make_unique<Command>(JA, T, Bundler, BundlerArgs, Inputs));
+ }
+ 
+-- 
+2.23.1
+
diff --git a/pkgs/development/compilers/llvm/8/clang/default.nix b/pkgs/development/compilers/llvm/8/clang/default.nix
index 8601f6d06809..81a069e6c01b 100644
--- a/pkgs/development/compilers/llvm/8/clang/default.nix
+++ b/pkgs/development/compilers/llvm/8/clang/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetch, cmake, libxml2, llvm, version, clang-tools-extra_src, python3
+{ stdenv, fetch, cmake, libxml2, llvm, version, clang-tools-extra_src, python3, lld
 , fixDarwinDylibNames
 , enableManpages ? false
 , enablePolly ? false # TODO: get this info from llvm (passthru?)
@@ -22,7 +22,7 @@ let
     nativeBuildInputs = [ cmake python3 ]
       ++ stdenv.lib.optional enableManpages python3.pkgs.sphinx;
 
-    buildInputs = [ libxml2 llvm ]
+    buildInputs = [ libxml2 llvm lld ]
       ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
 
     cmakeFlags = [
@@ -50,6 +50,8 @@ let
       ./unwindlib.patch
       # https://reviews.llvm.org/D51899
       ./compiler-rt-baremetal.patch
+      # make clang -xhip use $PATH to find executables
+      ./HIP-use-PATH-8.patch
     ];
 
     postPatch = ''
diff --git a/pkgs/development/compilers/llvm/8/default.nix b/pkgs/development/compilers/llvm/8/default.nix
index 8b916e1cda7d..d604dda5fe5e 100644
--- a/pkgs/development/compilers/llvm/8/default.nix
+++ b/pkgs/development/compilers/llvm/8/default.nix
@@ -32,6 +32,7 @@ let
     llvm-polly = callPackage ./llvm.nix { enablePolly = true; };
 
     clang-unwrapped = callPackage ./clang {
+      inherit (tools) lld;
       inherit clang-tools-extra_src;
     };
     clang-polly-unwrapped = callPackage ./clang {
diff --git a/pkgs/development/compilers/llvm/9/clang/HIP-use-PATH-9.patch b/pkgs/development/compilers/llvm/9/clang/HIP-use-PATH-9.patch
new file mode 100644
index 000000000000..102d810ff681
--- /dev/null
+++ b/pkgs/development/compilers/llvm/9/clang/HIP-use-PATH-9.patch
@@ -0,0 +1,80 @@
+From 7147e9774c74abcd1d6db24e24d0fd989c2b97dd Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Holger=20W=C3=BCnsche?= <holger.o.wuensche@t-online.de>
+Date: Tue, 21 Jan 2020 19:52:04 +0100
+Subject: [PATCH] [HIP] use GetProgramPath for executable discovery
+
+This change replaces the manual building of executable paths
+using llvm::sys::path::append with GetProgramPath.
+This enables adding other paths in case executables reside
+in different directories and makes the code easier to read.
+
+Differential Revision: https://reviews.llvm.org/D72903
+---
+ clang/lib/Driver/ToolChains/HIP.cpp | 23 ++++++++---------------
+ 1 file changed, 8 insertions(+), 15 deletions(-)
+
+diff --git a/lib/Driver/ToolChains/HIP.cpp b/lib/Driver/ToolChains/HIP.cpp
+index 2ec97e798fd..735c302debb 100644
+--- a/lib/Driver/ToolChains/HIP.cpp
++++ b/lib/Driver/ToolChains/HIP.cpp
+@@ -66,9 +66,8 @@ const char *AMDGCN::Linker::constructLLVMLinkCommand(
+   const char *OutputFileName =
+       C.addTempFile(C.getArgs().MakeArgString(TmpName));
+   CmdArgs.push_back(OutputFileName);
+-  SmallString<128> ExecPath(C.getDriver().Dir);
+-  llvm::sys::path::append(ExecPath, "llvm-link");
+-  const char *Exec = Args.MakeArgString(ExecPath);
++  const char *Exec =
++      Args.MakeArgString(getToolChain().GetProgramPath("llvm-link"));
+   C.addCommand(llvm::make_unique<Command>(JA, *this, Exec, CmdArgs, Inputs));
+   return OutputFileName;
+ }
+@@ -114,9 +113,8 @@ const char *AMDGCN::Linker::constructOptCommand(
+   const char *OutputFileName =
+       C.addTempFile(C.getArgs().MakeArgString(TmpFileName));
+   OptArgs.push_back(OutputFileName);
+-  SmallString<128> OptPath(C.getDriver().Dir);
+-  llvm::sys::path::append(OptPath, "opt");
+-  const char *OptExec = Args.MakeArgString(OptPath);
++  const char *OptExec =
++      Args.MakeArgString(getToolChain().GetProgramPath("opt"));
+   C.addCommand(llvm::make_unique<Command>(JA, *this, OptExec, OptArgs, Inputs));
+   return OutputFileName;
+ }
+@@ -156,9 +154,7 @@ const char *AMDGCN::Linker::constructLlcCommand(
+   const char *LlcOutputFile =
+       C.addTempFile(C.getArgs().MakeArgString(LlcOutputFileName));
+   LlcArgs.push_back(LlcOutputFile);
+-  SmallString<128> LlcPath(C.getDriver().Dir);
+-  llvm::sys::path::append(LlcPath, "llc");
+-  const char *Llc = Args.MakeArgString(LlcPath);
++  const char *Llc = Args.MakeArgString(getToolChain().GetProgramPath("llc"));
+   C.addCommand(llvm::make_unique<Command>(JA, *this, Llc, LlcArgs, Inputs));
+   return LlcOutputFile;
+ }
+@@ -172,9 +168,7 @@ void AMDGCN::Linker::constructLldCommand(Compilation &C, const JobAction &JA,
+   // The output from ld.lld is an HSA code object file.
+   ArgStringList LldArgs{
+       "-flavor", "gnu", "-shared", "-o", Output.getFilename(), InputFileName};
+-  SmallString<128> LldPath(C.getDriver().Dir);
+-  llvm::sys::path::append(LldPath, "lld");
+-  const char *Lld = Args.MakeArgString(LldPath);
++  const char *Lld = Args.MakeArgString(getToolChain().GetProgramPath("lld"));
+   C.addCommand(llvm::make_unique<Command>(JA, *this, Lld, LldArgs, Inputs));
+ }
+ 
+@@ -206,9 +200,8 @@ void AMDGCN::constructHIPFatbinCommand(Compilation &C, const JobAction &JA,
+       Args.MakeArgString(std::string("-outputs=").append(OutputFileName));
+   BundlerArgs.push_back(BundlerOutputArg);
+ 
+-  SmallString<128> BundlerPath(C.getDriver().Dir);
+-  llvm::sys::path::append(BundlerPath, "clang-offload-bundler");
+-  const char *Bundler = Args.MakeArgString(BundlerPath);
++  const char *Bundler = Args.MakeArgString(
++      T.getToolChain().GetProgramPath("clang-offload-bundler"));
+   C.addCommand(llvm::make_unique<Command>(JA, T, Bundler, BundlerArgs, Inputs));
+ }
+ 
+-- 
+2.23.1
+
diff --git a/pkgs/development/compilers/llvm/9/clang/default.nix b/pkgs/development/compilers/llvm/9/clang/default.nix
index 5f89c3dc3b71..d8df52df553c 100644
--- a/pkgs/development/compilers/llvm/9/clang/default.nix
+++ b/pkgs/development/compilers/llvm/9/clang/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetch, cmake, libxml2, llvm, version, clang-tools-extra_src, python3
+{ stdenv, fetch, cmake, libxml2, llvm, version, clang-tools-extra_src, python3, lld
 , fixDarwinDylibNames
 , enableManpages ? false
 , enablePolly ? false # TODO: get this info from llvm (passthru?)
@@ -22,7 +22,7 @@ let
     nativeBuildInputs = [ cmake python3 ]
       ++ stdenv.lib.optional enableManpages python3.pkgs.sphinx;
 
-    buildInputs = [ libxml2 llvm ]
+    buildInputs = [ libxml2 llvm lld ]
       ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
 
     cmakeFlags = [
@@ -43,6 +43,8 @@ let
       ./purity.patch
       # https://reviews.llvm.org/D51899
       ./compiler-rt-baremetal.patch
+      # make clang -xhip use $PATH to find executables
+      ./HIP-use-PATH-9.patch
     ];
 
     postPatch = ''
diff --git a/pkgs/development/compilers/llvm/9/default.nix b/pkgs/development/compilers/llvm/9/default.nix
index 38ab7794018f..11e44b8bdfaa 100644
--- a/pkgs/development/compilers/llvm/9/default.nix
+++ b/pkgs/development/compilers/llvm/9/default.nix
@@ -32,6 +32,7 @@ let
     llvm-polly = callPackage ./llvm.nix { enablePolly = true; };
 
     clang-unwrapped = callPackage ./clang {
+      inherit (tools) lld;
       inherit clang-tools-extra_src;
     };
     clang-polly-unwrapped = callPackage ./clang {
diff --git a/pkgs/development/compilers/openjdk/darwin/8.nix b/pkgs/development/compilers/openjdk/darwin/8.nix
index bc7a33932b27..8afaf90f9437 100644
--- a/pkgs/development/compilers/openjdk/darwin/8.nix
+++ b/pkgs/development/compilers/openjdk/darwin/8.nix
@@ -7,11 +7,14 @@ let
   };
 
   jdk = stdenv.mkDerivation {
-    name = "zulu1.8.0_222-8.40.0.25-ca-fx";
+    # @hlolli: Later version than 1.8.0_202 throws error when building jvmci.
+    # dyld: lazy symbol binding failed: Symbol not found: _JVM_BeforeHalt
+    # Referenced from: ../libjava.dylib Expected in: .../libjvm.dylib
+    name = "zulu1.8.0_202-8.36.0.1";
 
     src = fetchurl {
-      url = "http://cdn.azul.com/zulu/bin/zulu8.40.0.25-ca-fx-jdk8.0.222-macosx_x64.zip";
-      sha256 = "1mal8bdc94q7ahx7p3xggy3qpxr6h83g2y01wzgvnqjd8n5i3qr1";
+      url = "https://cdn.azul.com/zulu/bin/zulu8.36.0.1-ca-jdk8.0.202-macosx_x64.zip";
+      sha256 = "0s92l1wlf02vjx8dvrsla2kq7qwxnmgh325b38mgqy872016jm9p";
       curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/zulu-linux/";
     };
 
diff --git a/pkgs/development/libraries/at-spi2-core/default.nix b/pkgs/development/libraries/at-spi2-core/default.nix
index 84a8a6b90265..cdb172d0d21f 100644
--- a/pkgs/development/libraries/at-spi2-core/default.nix
+++ b/pkgs/development/libraries/at-spi2-core/default.nix
@@ -30,7 +30,9 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "dev" ];
 
   nativeBuildInputs = [ meson ninja pkgconfig gobject-introspection makeWrapper ];
-  buildInputs = [ dbus glib libX11 libXtst libXi ];
+  buildInputs = [ libX11 libXtst libXi ];
+  # In atspi-2.pc dbus-1 glib-2.0
+  propagatedBuildInputs = [ dbus glib ];
 
   doCheck = false; # fails with "AT-SPI: Couldn't connect to accessibility bus. Is at-spi-bus-launcher running?"
 
diff --git a/pkgs/development/libraries/clutter-gst/default.nix b/pkgs/development/libraries/clutter-gst/default.nix
index 3c88327c790b..2db4f6bf1ab8 100644
--- a/pkgs/development/libraries/clutter-gst/default.nix
+++ b/pkgs/development/libraries/clutter-gst/default.nix
@@ -1,13 +1,13 @@
 { fetchurl, stdenv, pkgconfig, clutter, gtk3, glib, cogl, gnome3, gdk-pixbuf }:
 
-let
+stdenv.mkDerivation rec {
   pname = "clutter-gst";
   version = "3.0.27";
-in stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
+
+  outputs = [ "out" "dev" ];
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "17czmpl92dzi4h3rn5rishk015yi3jwiw29zv8qan94xcmnbssgy";
   };
 
diff --git a/pkgs/development/libraries/cppunit/default.nix b/pkgs/development/libraries/cppunit/default.nix
index 76fd6db18b05..b006b0911f14 100644
--- a/pkgs/development/libraries/cppunit/default.nix
+++ b/pkgs/development/libraries/cppunit/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "cppunit";
-  version = "1.14.0";
+  version = "1.15.0";
 
   src = fetchurl {
     url = "https://dev-www.libreoffice.org/src/${pname}-${version}.tar.gz";
-    sha256 = "1027cyfx5gsjkdkaf6c2wnjh68882grw8n672018cj3vs9lrhmix";
+    sha256 = "08j9hc11yl07ginsf282pshn6zpy96yhzf7426sfn10f8gdxyq8w";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/epoxy/default.nix b/pkgs/development/libraries/epoxy/default.nix
index 362607eed181..1009f7ae708c 100644
--- a/pkgs/development/libraries/epoxy/default.nix
+++ b/pkgs/development/libraries/epoxy/default.nix
@@ -6,13 +6,13 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "epoxy";
-  version = "1.5.3";
+  version = "1.5.4";
 
   src = fetchFromGitHub {
     owner = "anholt";
     repo = "libepoxy";
     rev = version;
-    sha256 = "03nrmf161xyj3q9zsigr5qj5vx5dsfxxyjva73cm1mgqqc5d60px";
+    sha256 = "0rmg0qlswn250h0arx434jh3hwzsr95lawanpmh1czsfvrcx59l6";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/gtkd/default.nix b/pkgs/development/libraries/gtkd/default.nix
index 0b2df597be57..2cad4a19a0f3 100644
--- a/pkgs/development/libraries/gtkd/default.nix
+++ b/pkgs/development/libraries/gtkd/default.nix
@@ -7,6 +7,8 @@ in stdenv.mkDerivation rec {
   pname = "gtkd";
   version = "3.9.0";
 
+  outputs = [ "out" "dev" ];
+
   src = fetchzip {
     url = "https://gtkd.org/Downloads/sources/GtkD-${version}.zip";
     sha256 = "12kc4s5gp6gn456d8pzhww1ggi9qbxldmcpp6855297g2x8xxy5p";
@@ -118,6 +120,15 @@ in stdenv.mkDerivation rec {
     "PKG_CONFIG=${pkgconfig}/bin/pkg-config"
   ];
 
+  # The .pc files does not declare an `includedir=`, so the multiple
+  # outputs setup hook misses this.
+  postFixup = ''
+    for pc in $dev/lib/pkgconfig/*; do
+      substituteInPlace $pc \
+        --replace "$out/include" "$dev/include"
+    done
+  '';
+
   meta = with stdenv.lib; {
     description = "D binding and OO wrapper for GTK";
     homepage = https://gtkd.org;
diff --git a/pkgs/development/libraries/kde-frameworks/extra-cmake-modules/nix-lib-path.patch b/pkgs/development/libraries/kde-frameworks/extra-cmake-modules/nix-lib-path.patch
index f019e67d3f08..804fffc8fdcb 100644
--- a/pkgs/development/libraries/kde-frameworks/extra-cmake-modules/nix-lib-path.patch
+++ b/pkgs/development/libraries/kde-frameworks/extra-cmake-modules/nix-lib-path.patch
@@ -1,12 +1,12 @@
 diff --git a/kde-modules/KDEInstallDirs.cmake b/kde-modules/KDEInstallDirs.cmake
-index 0acd33f..c04b0a5 100644
+index c1d056b..d9e19f0 100644
 --- a/kde-modules/KDEInstallDirs.cmake
 +++ b/kde-modules/KDEInstallDirs.cmake
-@@ -236,35 +236,6 @@
+@@ -242,35 +242,6 @@
  # GNUInstallDirs code deals with re-configuring, but that is dealt with
  # by the _define_* macros in this module).
  set(_LIBDIR_DEFAULT "lib")
--# Override this default 'lib' with 'lib64' iff:
+-# Override this default 'lib' with 'lib64' if:
 -#  - we are on a Linux, kFreeBSD or Hurd system but NOT cross-compiling
 -#  - we are NOT on debian
 -#  - we are NOT on flatpak
diff --git a/pkgs/development/libraries/kde-frameworks/fetch.sh b/pkgs/development/libraries/kde-frameworks/fetch.sh
index c76ff9fb2c81..d4fcf620db60 100644
--- a/pkgs/development/libraries/kde-frameworks/fetch.sh
+++ b/pkgs/development/libraries/kde-frameworks/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/frameworks/5.64/ )
+WGET_ARGS=( https://download.kde.org/stable/frameworks/5.66/ )
diff --git a/pkgs/development/libraries/kde-frameworks/kinit/kdeinit-extra_libs.patch b/pkgs/development/libraries/kde-frameworks/kinit/kdeinit-extra_libs.patch
index 89145e3e1dde..d5b1a4accaa7 100644
--- a/pkgs/development/libraries/kde-frameworks/kinit/kdeinit-extra_libs.patch
+++ b/pkgs/development/libraries/kde-frameworks/kinit/kdeinit-extra_libs.patch
@@ -38,10 +38,9 @@ Index: kinit-5.32.0/src/kdeinit/kinit.cpp
      static void secondary_child_handler(int)
 @@ -1692,7 +1676,7 @@ int main(int argc, char **argv)
      if (!d.suicide && qEnvironmentVariableIsEmpty("KDE_IS_PRELINKED")) {
-         const int extrasCount = sizeof(extra_libs) / sizeof(extra_libs[0]);
-         for (int i = 0; i < extrasCount; i++) {
--            const QString extra = findSharedLib(QString::fromLatin1(extra_libs[i]));
-+            const QString extra = QString::fromLatin1(extra_libs[i]);
+         for (const char *extra_lib : extra_libs) {
+-            const QString extra = findSharedLib(QString::fromLatin1(extra_lib));
++            const QString extra = QString::fromLatin1(extra_lib);
              if (!extra.isEmpty()) {
                  QLibrary l(extra);
                  l.setLoadHints(QLibrary::ExportExternalSymbolsHint);
diff --git a/pkgs/development/libraries/kde-frameworks/srcs.nix b/pkgs/development/libraries/kde-frameworks/srcs.nix
index 32edca387102..2441ff693590 100644
--- a/pkgs/development/libraries/kde-frameworks/srcs.nix
+++ b/pkgs/development/libraries/kde-frameworks/srcs.nix
@@ -3,651 +3,659 @@
 
 {
   attica = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/attica-5.64.0.tar.xz";
-      sha256 = "c9b060693656a458f92905091e12d800be020abbf47bb68b9f769a191aa368d9";
-      name = "attica-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/attica-5.66.0.tar.xz";
+      sha256 = "e87ea061d393104804aa65db69ec3489512b472d8fb821c9fc49ffdcb85177fb";
+      name = "attica-5.66.0.tar.xz";
     };
   };
   baloo = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/baloo-5.64.0.tar.xz";
-      sha256 = "adaaef1aeec07ccc210210a2e67f4d12c0275226bb05d0220da0281f1a3984c2";
-      name = "baloo-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/baloo-5.66.0.tar.xz";
+      sha256 = "9495869eee72f587efadc8a848c3f76b93a1dcb1914c8e818d7084451107a1f8";
+      name = "baloo-5.66.0.tar.xz";
     };
   };
   bluez-qt = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/bluez-qt-5.64.0.tar.xz";
-      sha256 = "7d6c7ba913cea6059327726325b8af4cf2baa7594b8be3143e0649eaa36f8384";
-      name = "bluez-qt-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/bluez-qt-5.66.0.tar.xz";
+      sha256 = "cc3f3fcc1df87b61480549d658c1a27690661aaa4f22a65552efe3f6bf41c887";
+      name = "bluez-qt-5.66.0.tar.xz";
     };
   };
   breeze-icons = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/breeze-icons-5.64.0.tar.xz";
-      sha256 = "08c2f7efc5f1550668dd2e0cff1641b1b6ec8a91f01614ee14c6abc4d975672f";
-      name = "breeze-icons-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/breeze-icons-5.66.0.tar.xz";
+      sha256 = "445a77204c7d9ac398e7f1d1594cd93e719665c85c7fb9ef71fde1ce68cb64d7";
+      name = "breeze-icons-5.66.0.tar.xz";
     };
   };
   extra-cmake-modules = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/extra-cmake-modules-5.64.0.tar.xz";
-      sha256 = "1865efc6254bed44e0a6918c5af3da62be4008ba7a197a47f35251f298041a69";
-      name = "extra-cmake-modules-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/extra-cmake-modules-5.66.0.tar.xz";
+      sha256 = "2ff1a4ede28488ea787e742ab37edaacc5f59bf9188476e48f681ce23300b9c4";
+      name = "extra-cmake-modules-5.66.0.tar.xz";
     };
   };
   frameworkintegration = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/frameworkintegration-5.64.0.tar.xz";
-      sha256 = "6c1880f8300a014bb835ce29fd68651bfd38400de8044fe5914cb4392df48a26";
-      name = "frameworkintegration-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/frameworkintegration-5.66.0.tar.xz";
+      sha256 = "55c01613436781d74652bef19fc594448cdee4c002d5e1713b583473455f54d8";
+      name = "frameworkintegration-5.66.0.tar.xz";
     };
   };
   kactivities = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kactivities-5.64.0.tar.xz";
-      sha256 = "5afbd0785c04127c91f1ad7402c95ce3f994fb94b216baf56cd802a3a230a3f9";
-      name = "kactivities-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kactivities-5.66.0.tar.xz";
+      sha256 = "7c37c8f189cb3c9f0cacbcef606562d8bc596e685d2a47bc9994deae6e69f41f";
+      name = "kactivities-5.66.0.tar.xz";
     };
   };
   kactivities-stats = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kactivities-stats-5.64.0.tar.xz";
-      sha256 = "ca1c07b1250735372a4f6aa6b493536d420a902de0d7a8c9777b437fb6ab0bf9";
-      name = "kactivities-stats-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kactivities-stats-5.66.0.tar.xz";
+      sha256 = "567de599a8fd8b6a5304fc1696e24b069b4eaa7bbc643b1e760293d8c1162b73";
+      name = "kactivities-stats-5.66.0.tar.xz";
     };
   };
   kapidox = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kapidox-5.64.0.tar.xz";
-      sha256 = "f75eedfa1af51f5224b14d8bc4c229c2c2d27f607e00172d24bdcede1c899fb4";
-      name = "kapidox-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kapidox-5.66.0.tar.xz";
+      sha256 = "19af4d93adfa22ff4de832185c1e9191d35039394bb032ee60e33efc5cc456db";
+      name = "kapidox-5.66.0.tar.xz";
     };
   };
   karchive = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/karchive-5.64.0.tar.xz";
-      sha256 = "135fbfb2dfe107e4487723a5f887d1d074e13258a4583d592639366094aafe1a";
-      name = "karchive-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/karchive-5.66.0.tar.xz";
+      sha256 = "434f315af624d315b06a35ba5e71e570f36ca454af891833d6e896e42edf23d8";
+      name = "karchive-5.66.0.tar.xz";
     };
   };
   kauth = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kauth-5.64.0.tar.xz";
-      sha256 = "ac95525bf1430868c8f54dbdc986478cf7b21192ad3b486381485b429eadddcc";
-      name = "kauth-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kauth-5.66.0.tar.xz";
+      sha256 = "f167ec8f926caf348a161a39e0c0588f517fe3a49ab4f39c1dfa94f47e104414";
+      name = "kauth-5.66.0.tar.xz";
     };
   };
   kbookmarks = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kbookmarks-5.64.0.tar.xz";
-      sha256 = "51343a57b50032d60ffae123f426cdd67cd290ce306ae494c1956d0b899d4ff2";
-      name = "kbookmarks-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kbookmarks-5.66.0.tar.xz";
+      sha256 = "b225463ec0fe2424a1f5e70c83b02e3ece6a3ca80832cd2621732d18d7160a43";
+      name = "kbookmarks-5.66.0.tar.xz";
     };
   };
   kcalendarcore = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kcalendarcore-5.64.0.tar.xz";
-      sha256 = "983f240a7478a780dc403d577827f027856f9f67e8c3bfe8b69d56093e5bb80e";
-      name = "kcalendarcore-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kcalendarcore-5.66.0.tar.xz";
+      sha256 = "bbdb48c775ccc1e1bdba962b5ccdc0611a2d14523076d33c4507c05db3ab33d3";
+      name = "kcalendarcore-5.66.0.tar.xz";
     };
   };
   kcmutils = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kcmutils-5.64.0.tar.xz";
-      sha256 = "f55938c566669e9fcdd786ebfd89edfc11b0c283532aed04cfe4162b58a8b649";
-      name = "kcmutils-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kcmutils-5.66.0.tar.xz";
+      sha256 = "e02dbf996ed93bdc2813a2a64dcb0ddeb54987dd84bbe787bd890b17d57e4a85";
+      name = "kcmutils-5.66.0.tar.xz";
     };
   };
   kcodecs = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kcodecs-5.64.0.tar.xz";
-      sha256 = "24cbffb123179cf4386500ae7bc7c99f65c4422cd7b91f314152f11cd596402a";
-      name = "kcodecs-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kcodecs-5.66.0.tar.xz";
+      sha256 = "0dcb684ad75374bbab82b90bda20e914cf656bd51a6dff69bbb1bfc650481a05";
+      name = "kcodecs-5.66.0.tar.xz";
     };
   };
   kcompletion = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kcompletion-5.64.0.tar.xz";
-      sha256 = "4fe5b9254e038e654d55167163b2812582f31fe550c977979d692b69424c2508";
-      name = "kcompletion-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kcompletion-5.66.0.tar.xz";
+      sha256 = "be5e272e257b9fe5b951d7c596fef7c75b16886e6b1cd5ebff60d87bd6dd495d";
+      name = "kcompletion-5.66.0.tar.xz";
     };
   };
   kconfig = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kconfig-5.64.0.tar.xz";
-      sha256 = "112c1db9f038dbacf357d08645c83ca103d8c3e7fb0c880ac16f665fdf7d9157";
-      name = "kconfig-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kconfig-5.66.0.tar.xz";
+      sha256 = "c0df73bde40162a5ffc20604c2ad343e71a6df852c3f7b05e70e1464f5f63256";
+      name = "kconfig-5.66.0.tar.xz";
     };
   };
   kconfigwidgets = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kconfigwidgets-5.64.0.tar.xz";
-      sha256 = "e84d590c064f2a86d5b9d2fb5d8aa7abc8ac8752125f5d3197cca6dc7e115c56";
-      name = "kconfigwidgets-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kconfigwidgets-5.66.0.tar.xz";
+      sha256 = "730834528307c65691d67c901f1c186b49d74ee986ef75e171e867e8751bf10a";
+      name = "kconfigwidgets-5.66.0.tar.xz";
     };
   };
   kcontacts = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kcontacts-5.64.0.tar.xz";
-      sha256 = "0bf0a1ba6ebedd400bed7a490093962cde6a2b26c49627d6770a71524db63058";
-      name = "kcontacts-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kcontacts-5.66.0.tar.xz";
+      sha256 = "08086f554eb4718e91a9e96d143ba05fc741289928db9bcc21b21ca7125b0017";
+      name = "kcontacts-5.66.0.tar.xz";
     };
   };
   kcoreaddons = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kcoreaddons-5.64.0.tar.xz";
-      sha256 = "3f0cb3273debf9791dda3f1ad135b6b1a20d88fed1e21890c4b70bac64fdb188";
-      name = "kcoreaddons-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kcoreaddons-5.66.0.tar.xz";
+      sha256 = "8a8edf566cb08ad83cb17f942eeb8746993249cd0f7679f7eb810201b85e464b";
+      name = "kcoreaddons-5.66.0.tar.xz";
     };
   };
   kcrash = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kcrash-5.64.0.tar.xz";
-      sha256 = "9e9ad5e7a6a3e9a128128a7863204f8c4a555bd8659d8ed4ef4cc6bb2fc48290";
-      name = "kcrash-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kcrash-5.66.0.tar.xz";
+      sha256 = "5a518059de3f3e85ee7b38a0edf348d097993518ce9b17504470f0d8aad3f2e4";
+      name = "kcrash-5.66.0.tar.xz";
     };
   };
   kdbusaddons = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kdbusaddons-5.64.0.tar.xz";
-      sha256 = "74a6eb443a74eb74a859238b555a3b16be1d6367c4db2a7af5b16da528d57f62";
-      name = "kdbusaddons-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kdbusaddons-5.66.0.tar.xz";
+      sha256 = "ee600f15af2fb9a28ad15f7e0689d519211fa63b86f2e6c356bd32530ebdfa46";
+      name = "kdbusaddons-5.66.0.tar.xz";
     };
   };
   kdeclarative = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kdeclarative-5.64.0.tar.xz";
-      sha256 = "1bf199aebabe63880babc364572de44f6b0a94ffbbffd955bc85916c2be7701d";
-      name = "kdeclarative-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kdeclarative-5.66.0.tar.xz";
+      sha256 = "ed3a334d8bce6d70e68e013d4210bd6e11cb2ebce9ede4c1813f44dada7eca73";
+      name = "kdeclarative-5.66.0.tar.xz";
     };
   };
   kded = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kded-5.64.0.tar.xz";
-      sha256 = "2e8bda93918ac174254c8f70a71c9d6966a4721e14a631760e1b912d108001be";
-      name = "kded-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kded-5.66.0.tar.xz";
+      sha256 = "52223e641c4e8e3158220ed7b6c48e4c3f3e67f882603ada0e3757b4136255a4";
+      name = "kded-5.66.0.tar.xz";
     };
   };
   kdelibs4support = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/portingAids/kdelibs4support-5.64.0.tar.xz";
-      sha256 = "8c9e23e0e22ccec8b46b4c4b160adb8c8765c1dc308bf297f6f72ccc97c7b682";
-      name = "kdelibs4support-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/portingAids/kdelibs4support-5.66.0.tar.xz";
+      sha256 = "314d0ddb95c024c3d36dd262fcaa9295b462e6430f84b22c82f145029e3b2708";
+      name = "kdelibs4support-5.66.0.tar.xz";
     };
   };
   kdesignerplugin = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/portingAids/kdesignerplugin-5.64.0.tar.xz";
-      sha256 = "1ca638ec822d9882f4a865d599ce8ad94785fa890ce73bccd5e78210c4a3d95b";
-      name = "kdesignerplugin-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/portingAids/kdesignerplugin-5.66.0.tar.xz";
+      sha256 = "a7f9c530d8c7d214a176ee381541bd45f3a000a3e86404040b11f1394912d40b";
+      name = "kdesignerplugin-5.66.0.tar.xz";
     };
   };
   kdesu = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kdesu-5.64.0.tar.xz";
-      sha256 = "f4644b0ee91c55473589909c20a7fa1cfbd3d466f1c72b330d53871a2346d4f0";
-      name = "kdesu-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kdesu-5.66.0.tar.xz";
+      sha256 = "764d30acb0ef1d609c9454ecabb939bd64a814442e01aba769eba0673b56f88a";
+      name = "kdesu-5.66.0.tar.xz";
     };
   };
   kdewebkit = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/portingAids/kdewebkit-5.64.0.tar.xz";
-      sha256 = "882801a1fd944b08918cb7d9341985e4330e7adac00ae4e6dddcea5343393ac1";
-      name = "kdewebkit-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/portingAids/kdewebkit-5.66.0.tar.xz";
+      sha256 = "f73d2599ce2269eaab45ddc11bdeb49dc887e950ded57454f3fd6499c370a777";
+      name = "kdewebkit-5.66.0.tar.xz";
     };
   };
   kdnssd = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kdnssd-5.64.0.tar.xz";
-      sha256 = "92d9a4947c45e56ea15e417eaf87121b4b3a4f1f81dfd154d2ee968a9797f46b";
-      name = "kdnssd-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kdnssd-5.66.0.tar.xz";
+      sha256 = "e280246212329f2834437ea3e84971fc85f3a3e6824963322e1f5de6aa04709c";
+      name = "kdnssd-5.66.0.tar.xz";
     };
   };
   kdoctools = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kdoctools-5.64.0.tar.xz";
-      sha256 = "3e669c9bdf8822c262d834a9fbe9250ffdc91ea49c916b2c16ac8483b62f8fce";
-      name = "kdoctools-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kdoctools-5.66.0.tar.xz";
+      sha256 = "41e4ca7aceab17919ef4a82ad99606f520ebfe57f30205597b4184f7a3730a7a";
+      name = "kdoctools-5.66.0.tar.xz";
     };
   };
   kemoticons = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kemoticons-5.64.0.tar.xz";
-      sha256 = "0b586957bfe26ce0fe44eca305992f99e3c31fbeb19a9d369c4abfdf9cc0400f";
-      name = "kemoticons-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kemoticons-5.66.0.tar.xz";
+      sha256 = "dc307192d883108134da104d1507709a3b80c5b5e9984377840bd42d39a431dd";
+      name = "kemoticons-5.66.0.tar.xz";
     };
   };
   kfilemetadata = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kfilemetadata-5.64.0.tar.xz";
-      sha256 = "4b581e4d659defe4db595a984ed4c037bc80e0bf7b298ec79e6aa5061fa56e23";
-      name = "kfilemetadata-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kfilemetadata-5.66.0.tar.xz";
+      sha256 = "d78c2128887591229e6c61c60e77af8647e407d570b07892f5f06ab682f807b9";
+      name = "kfilemetadata-5.66.0.tar.xz";
     };
   };
   kglobalaccel = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kglobalaccel-5.64.0.tar.xz";
-      sha256 = "6863515428988c129acfcceaa3518f90d72c590aff2c295a958a68d0c4cd02ab";
-      name = "kglobalaccel-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kglobalaccel-5.66.0.tar.xz";
+      sha256 = "fae805994f946791525da65ca15f93b65b2001241c7539ad04b3aaef937fb1c3";
+      name = "kglobalaccel-5.66.0.tar.xz";
     };
   };
   kguiaddons = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kguiaddons-5.64.0.tar.xz";
-      sha256 = "4caac79b7341c7796f3ca5e1d88cef57ecab2eefcac9ab654fd977706c89bae4";
-      name = "kguiaddons-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kguiaddons-5.66.0.tar.xz";
+      sha256 = "379e5ed87b00d344a13e424e39d97d74d494c503400bcd72df132de74c8cc591";
+      name = "kguiaddons-5.66.0.tar.xz";
     };
   };
   kholidays = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kholidays-5.64.0.tar.xz";
-      sha256 = "65b847ba7a00e1a42c0048fe05a400f584e1d9e746edb5d935331ffcb1f5d4ab";
-      name = "kholidays-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kholidays-5.66.0.tar.xz";
+      sha256 = "2d9bb70fbcb3a45208409228b5e5a88b0cb00fe8f2621e2e938bc77c2df11f02";
+      name = "kholidays-5.66.0.tar.xz";
     };
   };
   khtml = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/portingAids/khtml-5.64.0.tar.xz";
-      sha256 = "00d3a3e8c8b8072f4894d74f91d963cfefbd681e47da0b8e80e1297224c5af85";
-      name = "khtml-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/portingAids/khtml-5.66.0.tar.xz";
+      sha256 = "ee34b082760262fb9b5e287960955075ec72179585e51567350a08bf0b4b7a10";
+      name = "khtml-5.66.0.tar.xz";
     };
   };
   ki18n = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/ki18n-5.64.0.tar.xz";
-      sha256 = "ccd2c2f8b14251701f902c9e7d046da1582e544d31edae743911f3554022d024";
-      name = "ki18n-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/ki18n-5.66.0.tar.xz";
+      sha256 = "9622337a513fcb8f0b5100c218b9fa85617f92024e5d7feada6d071f58a329e3";
+      name = "ki18n-5.66.0.tar.xz";
     };
   };
   kiconthemes = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kiconthemes-5.64.0.tar.xz";
-      sha256 = "f89a97e9501d841d4543249776783ebd1fc4d7f69e114f8a56027f59ad32000a";
-      name = "kiconthemes-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kiconthemes-5.66.0.tar.xz";
+      sha256 = "93fa9b8d0f951c2c9991f366081f98670086f2b66a740d7be95b64c35dff111d";
+      name = "kiconthemes-5.66.0.tar.xz";
     };
   };
   kidletime = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kidletime-5.64.0.tar.xz";
-      sha256 = "8287e958a8a2a9538bec1038f5e31ebba338ff522de9c51265ca1d63030581d0";
-      name = "kidletime-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kidletime-5.66.0.tar.xz";
+      sha256 = "66e891b33ed9026ed6fd211cd1ecf3405255b19d3a58199b87af0b22a40d7185";
+      name = "kidletime-5.66.0.tar.xz";
     };
   };
   kimageformats = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kimageformats-5.64.0.tar.xz";
-      sha256 = "48c6a7026854127fc83698ab11e6639a525d387cf384f2558db6c7478bceae4c";
-      name = "kimageformats-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kimageformats-5.66.0.tar.xz";
+      sha256 = "c3b02befbb03f25deca0c7ffafea8c8a5eb79e21d8e2e566bf6fddf4f8afe04d";
+      name = "kimageformats-5.66.0.tar.xz";
     };
   };
   kinit = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kinit-5.64.0.tar.xz";
-      sha256 = "5298b783499cedb681c334b20234a511cb3377e66d140e7df6b7c1899186263d";
-      name = "kinit-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kinit-5.66.0.tar.xz";
+      sha256 = "6d9b6ea1542ff5529fd42f49240be37bbd8a3dfdfe8c45ac980b3c9b3fee650e";
+      name = "kinit-5.66.0.tar.xz";
     };
   };
   kio = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kio-5.64.0.tar.xz";
-      sha256 = "e38c8dcf634989f0f7ec95b68bdd936b9e05f7d242e4050b01f79b7021108f59";
-      name = "kio-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kio-5.66.0.tar.xz";
+      sha256 = "c5350e20474b48c4fc02347186b7e4db24cb7580ba8c0f1e120b302e6b8db17d";
+      name = "kio-5.66.0.tar.xz";
     };
   };
   kirigami2 = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kirigami2-5.64.0.tar.xz";
-      sha256 = "c394360e2323c55cf654d09ec762a03c47db0027e6a992646ea32d27ce8b228e";
-      name = "kirigami2-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kirigami2-5.66.0.tar.xz";
+      sha256 = "4e4abfeaa5e997de52076786dd0d314f178bc883b1b48a8b2cf37dd5979ac41b";
+      name = "kirigami2-5.66.0.tar.xz";
     };
   };
   kitemmodels = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kitemmodels-5.64.0.tar.xz";
-      sha256 = "1bae70e4c6a033eea649efc17f0a060aba89144f4c469f235fbf5023dba5abc4";
-      name = "kitemmodels-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kitemmodels-5.66.0.tar.xz";
+      sha256 = "5c8bcc36b9c29868ba7fa1ece9b83385379d7fed04937a92454ac94a356b3854";
+      name = "kitemmodels-5.66.0.tar.xz";
     };
   };
   kitemviews = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kitemviews-5.64.0.tar.xz";
-      sha256 = "0b3f8a0116c042ae187b67f35ffd40872352b91f5f236d19dd26ffad8db83fee";
-      name = "kitemviews-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kitemviews-5.66.0.tar.xz";
+      sha256 = "026461fa2e3e0237a56eb18a2817453c788514578f27a4aa0832b85fe98a09ab";
+      name = "kitemviews-5.66.0.tar.xz";
     };
   };
   kjobwidgets = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kjobwidgets-5.64.0.tar.xz";
-      sha256 = "3b39fc5dfc0f1a9cc9bffed3d05b90ba46c52c63cbbeffa0666f5f09e7093ce0";
-      name = "kjobwidgets-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kjobwidgets-5.66.0.tar.xz";
+      sha256 = "34501be3ec85f0e71dba22669b3c862b297606e9bbff9aae466667c7075b6f8d";
+      name = "kjobwidgets-5.66.0.tar.xz";
     };
   };
   kjs = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/portingAids/kjs-5.64.0.tar.xz";
-      sha256 = "93855cde810feb7208443a93f81c952bdb42f9886154959bc7a6509c9863e503";
-      name = "kjs-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/portingAids/kjs-5.66.0.tar.xz";
+      sha256 = "9bed62ebf9fba7d986ff7baabf6c4431f02826c9be70beda15cc62c692fb5f7f";
+      name = "kjs-5.66.0.tar.xz";
     };
   };
   kjsembed = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/portingAids/kjsembed-5.64.0.tar.xz";
-      sha256 = "939226116cb47fd66dc45a41baa3c0f45b7ab904ec7674088ced3df5c7bae62e";
-      name = "kjsembed-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/portingAids/kjsembed-5.66.0.tar.xz";
+      sha256 = "58fe647901b69167b7c66a284c3181c2eda9c3b751548eb43bfe0795d10eb0ce";
+      name = "kjsembed-5.66.0.tar.xz";
     };
   };
   kmediaplayer = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/portingAids/kmediaplayer-5.64.0.tar.xz";
-      sha256 = "ce4816a14134c4968559ff5030895ab69b63b66e9b541b74595ce05e4fe68d1d";
-      name = "kmediaplayer-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/portingAids/kmediaplayer-5.66.0.tar.xz";
+      sha256 = "7ec1fea10a1017a0f32183fdc3b2cca38c11273240423ac0d393626436fd4230";
+      name = "kmediaplayer-5.66.0.tar.xz";
     };
   };
   knewstuff = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/knewstuff-5.64.0.tar.xz";
-      sha256 = "91334c95a1082ae402ee869da399e5bdbac986c8b30a85d0a899b30de1f3be72";
-      name = "knewstuff-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/knewstuff-5.66.0.tar.xz";
+      sha256 = "acef94661e3a0e42938224c17b90f835d6686d88a25698fe82980d7e1139b1fe";
+      name = "knewstuff-5.66.0.tar.xz";
     };
   };
   knotifications = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/knotifications-5.64.0.tar.xz";
-      sha256 = "5f0c3b158ba253e8df81016c8921d689836ecac063a39766c0290352c9f71bc1";
-      name = "knotifications-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/knotifications-5.66.0.tar.xz";
+      sha256 = "aad3697a35109fad49fa286b7837d382599478bac33151cd7991c760866c12c1";
+      name = "knotifications-5.66.0.tar.xz";
     };
   };
   knotifyconfig = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/knotifyconfig-5.64.0.tar.xz";
-      sha256 = "f496ed0728e688347da360f7aad7f2666cb0310ab669c6006ce9661233218b27";
-      name = "knotifyconfig-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/knotifyconfig-5.66.0.tar.xz";
+      sha256 = "fd9e09b099f49896b5afa6f5663ef82266531ec413d4edeb03ebc768314a37d8";
+      name = "knotifyconfig-5.66.0.tar.xz";
     };
   };
   kpackage = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kpackage-5.64.0.tar.xz";
-      sha256 = "c39c80317c75206ec347edf6d301cb66c2117489f37725374fcfe3b1459aaed6";
-      name = "kpackage-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kpackage-5.66.0.tar.xz";
+      sha256 = "ae848a72e789a80d4a9d0346e90cb1038ebc784da6e7ff645411edd878554ab5";
+      name = "kpackage-5.66.0.tar.xz";
     };
   };
   kparts = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kparts-5.64.0.tar.xz";
-      sha256 = "61338a37015c2df787b8e0fe49f0ef320474a82831b4f110fb5aefd1635b1d9f";
-      name = "kparts-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kparts-5.66.0.tar.xz";
+      sha256 = "6de2395cd6a9993f216f4dc4718f352bc4cbbd8147734c76be0e1e6149f733d0";
+      name = "kparts-5.66.0.tar.xz";
     };
   };
   kpeople = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kpeople-5.64.0.tar.xz";
-      sha256 = "b5bc8d037dab124ea65be1c480b25943e789a403176f8b31599383dcdec20a0e";
-      name = "kpeople-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kpeople-5.66.0.tar.xz";
+      sha256 = "2728f08a9417ceb62aa9fc5a3340aed291aeb8a852e5f6f46c5a23fcc34168ab";
+      name = "kpeople-5.66.0.tar.xz";
     };
   };
   kplotting = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kplotting-5.64.0.tar.xz";
-      sha256 = "f38f65c97d199077c88213bce84c6162ba254c443f06ccfaf62088ff0e217f7b";
-      name = "kplotting-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kplotting-5.66.0.tar.xz";
+      sha256 = "2a4387f748614f005cf67e549b9466c6eed52589ac58297857ba6a0be92c32ee";
+      name = "kplotting-5.66.0.tar.xz";
     };
   };
   kpty = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kpty-5.64.0.tar.xz";
-      sha256 = "c2ece8c6b336ee85973e005969f1228bbfac87cbace6853e9d01a7b5c5fe319e";
-      name = "kpty-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kpty-5.66.0.tar.xz";
+      sha256 = "a7fac6ced7504cec13a6776f0f4ba22db9878e44e2bbf85a219a2590e061c859";
+      name = "kpty-5.66.0.tar.xz";
+    };
+  };
+  kquickcharts = {
+    version = "5.66.0";
+    src = fetchurl {
+      url = "${mirror}/stable/frameworks/5.66/kquickcharts-5.66.0.tar.xz";
+      sha256 = "70fae10b2af1c504e3b166beb0a342cdef0e0f8eb42e53ba88f0e3b174331624";
+      name = "kquickcharts-5.66.0.tar.xz";
     };
   };
   kross = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/portingAids/kross-5.64.0.tar.xz";
-      sha256 = "d8a7e9fbeba4d16d6288d13d72a5f7581aa8be5894b06f83dbc6068b04551ebd";
-      name = "kross-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/portingAids/kross-5.66.0.tar.xz";
+      sha256 = "109159996da54ec52ec8114ff05f88bdee6428e49ca84515ab73c457e0005ebc";
+      name = "kross-5.66.0.tar.xz";
     };
   };
   krunner = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/krunner-5.64.0.tar.xz";
-      sha256 = "e056635f347eb4d8b2a1545de993b28ead1af4e8e4acc43f1dd1637b528fe0b2";
-      name = "krunner-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/krunner-5.66.0.tar.xz";
+      sha256 = "b7d67d61c0b0f96128c143e3d2694dc5ced88a7de73db0f4493f084de9dc9701";
+      name = "krunner-5.66.0.tar.xz";
     };
   };
   kservice = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kservice-5.64.0.tar.xz";
-      sha256 = "60e0c111485158f89211a62403697714dfe141e3539c1c7e1bf04550db74f02f";
-      name = "kservice-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kservice-5.66.0.tar.xz";
+      sha256 = "f1174576f6e3e562d7de65494efc2c1c3ac569c656b8301ffbe34576ea623a6a";
+      name = "kservice-5.66.0.tar.xz";
     };
   };
   ktexteditor = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/ktexteditor-5.64.0.tar.xz";
-      sha256 = "0fe12c57a7428d78c46d3367bdae47a0b9fbbd762be4f57f0c52dcd76e309ed5";
-      name = "ktexteditor-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/ktexteditor-5.66.0.tar.xz";
+      sha256 = "9156e5e554b17d73078e4df09ae524a684f6adff8c2bbd40705b67fd30a6cc0b";
+      name = "ktexteditor-5.66.0.tar.xz";
     };
   };
   ktextwidgets = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/ktextwidgets-5.64.0.tar.xz";
-      sha256 = "0e94c36c7d836450d4c52bd933c492235ea0071b15702c302aed003e8400bbfd";
-      name = "ktextwidgets-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/ktextwidgets-5.66.0.tar.xz";
+      sha256 = "dcc4595ceeecd3f59236ed303f2a0d61915c88eb36ad040a0562b60fb10cb9a1";
+      name = "ktextwidgets-5.66.0.tar.xz";
     };
   };
   kunitconversion = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kunitconversion-5.64.0.tar.xz";
-      sha256 = "6783d6180b132a80dce2a4cc6c793dae0f5859b0709207c5fc6f4501ef53a822";
-      name = "kunitconversion-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kunitconversion-5.66.0.tar.xz";
+      sha256 = "82db51b59ffdb5b2e69bc5c6ea54521acbc49ee5601baaf4e43cba50d12b418c";
+      name = "kunitconversion-5.66.0.tar.xz";
     };
   };
   kwallet = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kwallet-5.64.0.tar.xz";
-      sha256 = "16ff5bb5724105c3d59404f292232c03c6003f6229b483509e395e1171ccabde";
-      name = "kwallet-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kwallet-5.66.0.tar.xz";
+      sha256 = "6e48070e22a822a4003e1f7a739fe1e335bcf46982cbf4909d23a6e40689a827";
+      name = "kwallet-5.66.0.tar.xz";
     };
   };
   kwayland = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kwayland-5.64.0.tar.xz";
-      sha256 = "1540d4ff62afd0bff234e08618fc77d2c54b5cd69bf9c478c45a08a6e69349d3";
-      name = "kwayland-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kwayland-5.66.0.tar.xz";
+      sha256 = "f43231f10a5294f7ac3d43d2b903f1cf9649364782ca55831e0c069a54cc170d";
+      name = "kwayland-5.66.0.tar.xz";
     };
   };
   kwidgetsaddons = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kwidgetsaddons-5.64.0.tar.xz";
-      sha256 = "a2d4a47489621d095c4979ea25d5d8304cf4004b10a892a2b314d74cd30cb5da";
-      name = "kwidgetsaddons-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kwidgetsaddons-5.66.0.tar.xz";
+      sha256 = "311d8274469f03b1938da5a4f7ad17c82e3f96bc79ec28624cb748b13403f451";
+      name = "kwidgetsaddons-5.66.0.tar.xz";
     };
   };
   kwindowsystem = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kwindowsystem-5.64.0.tar.xz";
-      sha256 = "77c2e6b0032a79547f80bcd36682aa72c0e901e3b5acc83a58f69d644ce03dab";
-      name = "kwindowsystem-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kwindowsystem-5.66.0.tar.xz";
+      sha256 = "416e2ba52a8c95a6b161ca306724525c1971723cb12e7d8ad7fa108e0b820f0c";
+      name = "kwindowsystem-5.66.0.tar.xz";
     };
   };
   kxmlgui = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kxmlgui-5.64.0.tar.xz";
-      sha256 = "faa95b92b3b03130022841a6797d5beb3efb6a0d757afaefe038889af76a1dd1";
-      name = "kxmlgui-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kxmlgui-5.66.0.tar.xz";
+      sha256 = "a8f9ed354e30ff1f40306e876d96fcd1fa3a26a8e6acfccdeab8f3437d7231bc";
+      name = "kxmlgui-5.66.0.tar.xz";
     };
   };
   kxmlrpcclient = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/kxmlrpcclient-5.64.0.tar.xz";
-      sha256 = "8c36472cb69a2d5eeb88c437907f7b0b46703ef34d04df7b45a8c90eb95fd6b0";
-      name = "kxmlrpcclient-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/kxmlrpcclient-5.66.0.tar.xz";
+      sha256 = "6b637c138414d93104477034737c9e866d99e43f883a3dfc45d3220df6c21e6c";
+      name = "kxmlrpcclient-5.66.0.tar.xz";
     };
   };
   modemmanager-qt = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/modemmanager-qt-5.64.0.tar.xz";
-      sha256 = "a9d8554b3720cf46aaaa70da87c79688afc5baa155ffd19ea00e4cae2a1caa21";
-      name = "modemmanager-qt-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/modemmanager-qt-5.66.0.tar.xz";
+      sha256 = "50e24894d0243dbd2fc1a44a1e6368e3bb95a20c1ca56106d26752d5854d8be9";
+      name = "modemmanager-qt-5.66.0.tar.xz";
     };
   };
   networkmanager-qt = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/networkmanager-qt-5.64.0.tar.xz";
-      sha256 = "369d0391e199d059dd2faa554324cbd45334f7864ccfc462699b06c89af04bbf";
-      name = "networkmanager-qt-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/networkmanager-qt-5.66.0.tar.xz";
+      sha256 = "3089951c69845c4f6d1848bbbaf05116a72d4207a9f2d63b063a76c78549bf45";
+      name = "networkmanager-qt-5.66.0.tar.xz";
     };
   };
   oxygen-icons5 = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/oxygen-icons5-5.64.0.tar.xz";
-      sha256 = "41d415b4bd9cca0d9abc43b187059d833ce92b3fff3da66eb8ff4004215e91ef";
-      name = "oxygen-icons5-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/oxygen-icons5-5.66.0.tar.xz";
+      sha256 = "c6275fdcd4883c143adf4f16450a63dcb8651073a205bd14c599ec6ab638e8ef";
+      name = "oxygen-icons5-5.66.0.tar.xz";
     };
   };
   plasma-framework = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/plasma-framework-5.64.0.tar.xz";
-      sha256 = "3f1311a48826ab0a76f47d05b02f9a9486f821cc1ad757b895b570e371acfd09";
-      name = "plasma-framework-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/plasma-framework-5.66.0.tar.xz";
+      sha256 = "3263ccf95a6fcf8fde087d402d89d64c64c0130d4df62b95b860fada13aad419";
+      name = "plasma-framework-5.66.0.tar.xz";
     };
   };
   prison = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/prison-5.64.0.tar.xz";
-      sha256 = "31e136dd33940f32fdb87699b113c57aab566112bb9649f20a057c4eee20db2e";
-      name = "prison-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/prison-5.66.0.tar.xz";
+      sha256 = "ff5b4ae32ae44f2aea4b9254afe54af0fc9ea742517116cd2322e1a71a7315ce";
+      name = "prison-5.66.0.tar.xz";
     };
   };
   purpose = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/purpose-5.64.0.tar.xz";
-      sha256 = "004794dfa2d0bcef316d582f37e5691e3980c99240ef570313a98a8d44235b0d";
-      name = "purpose-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/purpose-5.66.0.tar.xz";
+      sha256 = "33b8ec6ede6a1deee6c85e45ebe42aca9a3add7884ee68aa8f1a16ed0637b4db";
+      name = "purpose-5.66.0.tar.xz";
     };
   };
   qqc2-desktop-style = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/qqc2-desktop-style-5.64.0.tar.xz";
-      sha256 = "b0e6ad1ccbd01b6974c3222c6098b6c1ae1fe594c26fe0e2817c35dd90b6013a";
-      name = "qqc2-desktop-style-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/qqc2-desktop-style-5.66.0.tar.xz";
+      sha256 = "49bb518fc9f3c08cb330b1d82cb5c68d9ea358a562c6e460ea06aaaa13812b87";
+      name = "qqc2-desktop-style-5.66.0.tar.xz";
     };
   };
   solid = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/solid-5.64.0.tar.xz";
-      sha256 = "fcbbfd124759854bde2da74e1768da818361f61f2839877b4efbcd38b825da6b";
-      name = "solid-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/solid-5.66.0.tar.xz";
+      sha256 = "78deab8c55c30f2c923795730a9655b4d05a75cd6240bc0caa64104b141a3a39";
+      name = "solid-5.66.0.tar.xz";
     };
   };
   sonnet = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/sonnet-5.64.0.tar.xz";
-      sha256 = "3af364858f76c0206136ae8f3c03da5442ea5e42d2560877f5e00f33850c84dc";
-      name = "sonnet-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/sonnet-5.66.0.tar.xz";
+      sha256 = "5ca700e8e9954b380cc5f4cee0f392888ae240ccd2c4d3a37a2f41f8ac9c8294";
+      name = "sonnet-5.66.0.tar.xz";
     };
   };
   syndication = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/syndication-5.64.0.tar.xz";
-      sha256 = "bffcd673a70646c8cb683ed7b26f6ef251a2ffe439fc78123ccee4332b567b57";
-      name = "syndication-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/syndication-5.66.0.tar.xz";
+      sha256 = "5e6c90360461b820a48069af2838cffbcbedfe8bcd042535823e1cf1b43cd6b7";
+      name = "syndication-5.66.0.tar.xz";
     };
   };
   syntax-highlighting = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/syntax-highlighting-5.64.0.tar.xz";
-      sha256 = "9655fa79d99fb7d585ae1a11c03d204c83263fe19391e7610575fb0436052b5f";
-      name = "syntax-highlighting-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/syntax-highlighting-5.66.0.tar.xz";
+      sha256 = "e572719cb64524c6abc476eeccca56f54cb0d7352fc747af3036dbe817566c25";
+      name = "syntax-highlighting-5.66.0.tar.xz";
     };
   };
   threadweaver = {
-    version = "5.64.0";
+    version = "5.66.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.64/threadweaver-5.64.0.tar.xz";
-      sha256 = "4a3ec0b2b45a5997b24d60059d95006fca5fd86f5d619d8fb1fd30d7510f5a02";
-      name = "threadweaver-5.64.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.66/threadweaver-5.66.0.tar.xz";
+      sha256 = "a63db1ef8421e68534f5b9891013286fbad2ef8677f28c15ec733f086ae5cee3";
+      name = "threadweaver-5.66.0.tar.xz";
     };
   };
 }
diff --git a/pkgs/development/libraries/libappindicator/default.nix b/pkgs/development/libraries/libappindicator/default.nix
index e9fccaf28abf..d09684a04438 100644
--- a/pkgs/development/libraries/libappindicator/default.nix
+++ b/pkgs/development/libraries/libappindicator/default.nix
@@ -19,6 +19,8 @@ stdenv.mkDerivation rec {
   versionMajor = "12.10";
   versionMinor = "0";
 
+  outputs = [ "out" "dev" ];
+
   src = fetchurl {
     url = "${meta.homepage}/${versionMajor}/${version}/+download/libappindicator-${version}.tar.gz";
     sha256 = "17xlqd60v0zllrxp8bgq3k5a1jkj0svkqn8rzllcyjh8k0gpr46m";
diff --git a/pkgs/development/libraries/libde265/default.nix b/pkgs/development/libraries/libde265/default.nix
index 918f76753891..c9f45280bdad 100644
--- a/pkgs/development/libraries/libde265/default.nix
+++ b/pkgs/development/libraries/libde265/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, autoreconfHook, pkgconfig }:
 
 stdenv.mkDerivation rec {
-  version = "1.0.4";
+  version = "1.0.5";
   pname = "libde265";
 
   src = fetchFromGitHub {
     owner = "strukturag";
     repo = "libde265";
     rev = "v${version}";
-    sha256 = "0svxrhh1pv7xpj75svz0iw1sq5i6z2grj7sc3q11hl63666hzh7d";
+    sha256 = "1qisj8ryzbknam3hk81rq70fsd9mcpxm898bqygvbsmbwyvmz3pg";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
diff --git a/pkgs/development/libraries/libdvdnav/default.nix b/pkgs/development/libraries/libdvdnav/default.nix
index 45a73a624883..8cca9091734f 100644
--- a/pkgs/development/libraries/libdvdnav/default.nix
+++ b/pkgs/development/libraries/libdvdnav/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libdvdnav";
-  version = "6.0.0";
+  version = "6.0.1";
 
   src = fetchurl {
     url = "http://get.videolan.org/libdvdnav/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "062njcksmpgw9yv3737qkf93r2pzhaxi9szqjabpa8d010dp38ph";
+    sha256 = "0cv7j8irsv1n2dadlnhr6i1b8pann2ah6xpxic41f04my6ba6rp5";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/development/libraries/libgnomekbd/default.nix b/pkgs/development/libraries/libgnomekbd/default.nix
index 21523bf2e1a5..f35f3f87fbeb 100644
--- a/pkgs/development/libraries/libgnomekbd/default.nix
+++ b/pkgs/development/libraries/libgnomekbd/default.nix
@@ -4,6 +4,8 @@ stdenv.mkDerivation rec {
   pname = "libgnomekbd";
   version = "3.26.1";
 
+  outputs = [ "out" "dev" ];
+
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "0y962ykn3rr9gylj0pwpww7bi20lmhvsw6qvxs5bisbn2mih5jpp";
diff --git a/pkgs/development/libraries/libinput/default.nix b/pkgs/development/libraries/libinput/default.nix
index 8d48082e1d9c..5cbf7c9145db 100644
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@@ -27,11 +27,11 @@ in
 with stdenv.lib;
 stdenv.mkDerivation rec {
   pname = "libinput";
-  version = "1.14.3";
+  version = "1.15.0";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/libinput/${pname}-${version}.tar.xz";
-    sha256 = "1dy58j8dvr7ri34bx0lppmh5638m956azgwk501w373hi42kmsqg";
+    sha256 = "1qa3b2fd4pv8ysf0mgwnyhqv9v48zgy3sy0q3a3vxcmwcvpizgxz";
   };
 
   outputs = [ "bin" "out" "dev" ];
diff --git a/pkgs/development/libraries/libnotify/default.nix b/pkgs/development/libraries/libnotify/default.nix
index 59039aadb895..f51383833417 100644
--- a/pkgs/development/libraries/libnotify/default.nix
+++ b/pkgs/development/libraries/libnotify/default.nix
@@ -14,6 +14,8 @@ stdenv.mkDerivation rec {
   pname = "libnotify";
   version = "0.7.8";
 
+  outputs = [ "out" "dev" ];
+
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "1371csx0n92g60b5dmai4mmzdnx8081mc3kcgc6a0xipcq5rw839";
diff --git a/pkgs/development/libraries/liboauth/default.nix b/pkgs/development/libraries/liboauth/default.nix
index ea792b007bae..46e3e65ff80b 100644
--- a/pkgs/development/libraries/liboauth/default.nix
+++ b/pkgs/development/libraries/liboauth/default.nix
@@ -9,6 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "07w1aq8y8wld43wmbk2q8134p3bfkp2vma78mmsfgw2jn1bh3xhd";
   };
 
+  outputs = [ "out" "dev" ];
+
   nativeBuildInputs = [ pkgconfig ];
 
   propagatedBuildInputs = [ nss nspr ];
diff --git a/pkgs/development/libraries/libpeas/default.nix b/pkgs/development/libraries/libpeas/default.nix
index cdb1b95935f4..a4632924a93a 100644
--- a/pkgs/development/libraries/libpeas/default.nix
+++ b/pkgs/development/libraries/libpeas/default.nix
@@ -6,6 +6,8 @@ stdenv.mkDerivation rec {
   pname = "libpeas";
   version = "1.24.0";
 
+  outputs = [ "out" "dev" ];
+
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "1yg6r0srz3knhgvplprl3pikrq5c02dmdxgfwcynd6hjih9h16hb";
diff --git a/pkgs/development/libraries/libuv/default.nix b/pkgs/development/libraries/libuv/default.nix
index 524896b8bfd2..a41a6ec32d06 100644
--- a/pkgs/development/libraries/libuv/default.nix
+++ b/pkgs/development/libraries/libuv/default.nix
@@ -1,14 +1,14 @@
 { stdenv, lib, fetchFromGitHub, autoconf, automake, libtool, pkgconfig, ApplicationServices, CoreServices }:
 
 stdenv.mkDerivation rec {
-  version = "1.34.0";
+  version = "1.34.1";
   pname = "libuv";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "0vcrrqf0zqgsfmgbyl45qhajyab98kxqq66l0w4lkj5say86aln8";
+    sha256 = "0vkn76wr2nivhmgjnkni2yih642mrlzkxbivdmlvcf3hg4h7gipp";
   };
 
   postPatch = let
diff --git a/pkgs/development/libraries/libvpx/CVE-2019-9232.CVE-2019-9325.CVE-2019-9371.CVE-2019-9433.patch b/pkgs/development/libraries/libvpx/CVE-2019-9232.CVE-2019-9325.CVE-2019-9371.CVE-2019-9433.patch
new file mode 100644
index 000000000000..552c4e08d5f9
--- /dev/null
+++ b/pkgs/development/libraries/libvpx/CVE-2019-9232.CVE-2019-9325.CVE-2019-9371.CVE-2019-9433.patch
@@ -0,0 +1,211 @@
+Backports of
+
+From 46e17f0cb4a80b36755c84b8bf15731d3386c08f Mon Sep 17 00:00:00 2001
+From: kyslov <kyslov@google.com>
+Date: Fri, 4 Jan 2019 17:04:09 -0800
+Subject: [PATCH] Fix OOB memory access on fuzzed data
+
+From 0681cff1ad36b3ef8ec242f59b5a6c4234ccfb88 Mon Sep 17 00:00:00 2001
+From: James Zern <jzern@google.com>
+Date: Tue, 24 Jul 2018 21:36:50 -0700
+Subject: [PATCH] vp9: fix OOB read in decoder_peek_si_internal
+
+From f00890eecdf8365ea125ac16769a83aa6b68792d Mon Sep 17 00:00:00 2001
+From: James Zern <jzern@google.com>
+Date: Tue, 11 Dec 2018 18:06:20 -0800
+Subject: [PATCH] update libwebm to libwebm-1.0.0.27-352-g6ab9fcf
+
+From 34d54b04e98dd0bac32e9aab0fbda0bf501bc742 Mon Sep 17 00:00:00 2001
+From: James Zern <jzern@google.com>
+Date: Tue, 9 Apr 2019 18:37:44 -0700
+Subject: [PATCH] update libwebm to libwebm-1.0.0.27-358-gdbf1d10
+
+From 52add5896661d186dec284ed646a4b33b607d2c7 Mon Sep 17 00:00:00 2001
+From: Jerome Jiang <jianj@google.com>
+Date: Wed, 23 May 2018 15:43:00 -0700
+Subject: [PATCH] VP8: Fix use-after-free in postproc.
+
+to address CVE-2019-9232 CVE-2019-9325 CVE-2019-9371 CVE-2019-9433
+
+--- libvpx-1.7.0.orig/test/decode_api_test.cc
++++ libvpx-1.7.0/test/decode_api_test.cc
+@@ -138,8 +138,30 @@ TEST(DecodeAPI, Vp9InvalidDecode) {
+   EXPECT_EQ(VPX_CODEC_OK, vpx_codec_destroy(&dec));
+ }
+ 
+-TEST(DecodeAPI, Vp9PeekSI) {
++void TestPeekInfo(const uint8_t *const data, uint32_t data_sz,
++                  uint32_t peek_size) {
+   const vpx_codec_iface_t *const codec = &vpx_codec_vp9_dx_algo;
++  // Verify behavior of vpx_codec_decode. vpx_codec_decode doesn't even get
++  // to decoder_peek_si_internal on frames of size < 8.
++  if (data_sz >= 8) {
++    vpx_codec_ctx_t dec;
++    EXPECT_EQ(VPX_CODEC_OK, vpx_codec_dec_init(&dec, codec, NULL, 0));
++    EXPECT_EQ((data_sz < peek_size) ? VPX_CODEC_UNSUP_BITSTREAM
++                                    : VPX_CODEC_CORRUPT_FRAME,
++              vpx_codec_decode(&dec, data, data_sz, NULL, 0));
++    vpx_codec_iter_t iter = NULL;
++    EXPECT_EQ(NULL, vpx_codec_get_frame(&dec, &iter));
++    EXPECT_EQ(VPX_CODEC_OK, vpx_codec_destroy(&dec));
++  }
++
++  // Verify behavior of vpx_codec_peek_stream_info.
++  vpx_codec_stream_info_t si;
++  si.sz = sizeof(si);
++  EXPECT_EQ((data_sz < peek_size) ? VPX_CODEC_UNSUP_BITSTREAM : VPX_CODEC_OK,
++            vpx_codec_peek_stream_info(codec, data, data_sz, &si));
++}
++
++TEST(DecodeAPI, Vp9PeekStreamInfo) {
+   // The first 9 bytes are valid and the rest of the bytes are made up. Until
+   // size 10, this should return VPX_CODEC_UNSUP_BITSTREAM and after that it
+   // should return VPX_CODEC_CORRUPT_FRAME.
+@@ -150,24 +172,18 @@ TEST(DecodeAPI, Vp9PeekSI) {
+   };
+ 
+   for (uint32_t data_sz = 1; data_sz <= 32; ++data_sz) {
+-    // Verify behavior of vpx_codec_decode. vpx_codec_decode doesn't even get
+-    // to decoder_peek_si_internal on frames of size < 8.
+-    if (data_sz >= 8) {
+-      vpx_codec_ctx_t dec;
+-      EXPECT_EQ(VPX_CODEC_OK, vpx_codec_dec_init(&dec, codec, NULL, 0));
+-      EXPECT_EQ(
+-          (data_sz < 10) ? VPX_CODEC_UNSUP_BITSTREAM : VPX_CODEC_CORRUPT_FRAME,
+-          vpx_codec_decode(&dec, data, data_sz, NULL, 0));
+-      vpx_codec_iter_t iter = NULL;
+-      EXPECT_EQ(NULL, vpx_codec_get_frame(&dec, &iter));
+-      EXPECT_EQ(VPX_CODEC_OK, vpx_codec_destroy(&dec));
+-    }
+-
+-    // Verify behavior of vpx_codec_peek_stream_info.
+-    vpx_codec_stream_info_t si;
+-    si.sz = sizeof(si);
+-    EXPECT_EQ((data_sz < 10) ? VPX_CODEC_UNSUP_BITSTREAM : VPX_CODEC_OK,
+-              vpx_codec_peek_stream_info(codec, data, data_sz, &si));
++    TestPeekInfo(data, data_sz, 10);
++  }
++}
++
++TEST(DecodeAPI, Vp9PeekStreamInfoTruncated) {
++  // This profile 1 header requires 10.25 bytes, ensure
++  // vpx_codec_peek_stream_info doesn't over read.
++  const uint8_t profile1_data[10] = { 0xa4, 0xe9, 0x30, 0x68, 0x53,
++                                      0xe9, 0x30, 0x68, 0x53, 0x04 };
++
++  for (uint32_t data_sz = 1; data_sz <= 10; ++data_sz) {
++    TestPeekInfo(profile1_data, data_sz, 11);
+   }
+ }
+ #endif  // CONFIG_VP9_DECODER
+--- libvpx-1.7.0.orig/third_party/libwebm/mkvparser/mkvparser.cc
++++ libvpx-1.7.0/third_party/libwebm/mkvparser/mkvparser.cc
+@@ -5307,8 +5307,8 @@ long VideoTrack::Parse(Segment* pSegment
+ 
+   const long long stop = pos + s.size;
+ 
+-  Colour* colour = NULL;
+-  Projection* projection = NULL;
++  std::unique_ptr<Colour> colour_ptr;
++  std::unique_ptr<Projection> projection_ptr;
+ 
+   while (pos < stop) {
+     long long id, size;
+@@ -5357,11 +5357,19 @@ long VideoTrack::Parse(Segment* pSegment
+       if (rate <= 0)
+         return E_FILE_FORMAT_INVALID;
+     } else if (id == libwebm::kMkvColour) {
+-      if (!Colour::Parse(pReader, pos, size, &colour))
++      Colour* colour = NULL;
++      if (!Colour::Parse(pReader, pos, size, &colour)) {
+         return E_FILE_FORMAT_INVALID;
++      } else {
++        colour_ptr.reset(colour);
++      }
+     } else if (id == libwebm::kMkvProjection) {
+-      if (!Projection::Parse(pReader, pos, size, &projection))
++      Projection* projection = NULL;
++      if (!Projection::Parse(pReader, pos, size, &projection)) {
+         return E_FILE_FORMAT_INVALID;
++      } else {
++        projection_ptr.reset(projection);
++      }
+     }
+ 
+     pos += size;  // consume payload
+@@ -5392,8 +5400,8 @@ long VideoTrack::Parse(Segment* pSegment
+   pTrack->m_display_unit = display_unit;
+   pTrack->m_stereo_mode = stereo_mode;
+   pTrack->m_rate = rate;
+-  pTrack->m_colour = colour;
+-  pTrack->m_projection = projection;
++  pTrack->m_colour = colour_ptr.release();
++  pTrack->m_projection = projection_ptr.release();
+ 
+   pResult = pTrack;
+   return 0;  // success
+--- libvpx-1.7.0.orig/vp8/common/postproc.c
++++ libvpx-1.7.0/vp8/common/postproc.c
+@@ -65,7 +65,7 @@ void vp8_deblock(VP8_COMMON *cm, YV12_BU
+   double level = 6.0e-05 * q * q * q - .0067 * q * q + .306 * q + .0065;
+   int ppl = (int)(level + .5);
+ 
+-  const MODE_INFO *mode_info_context = cm->show_frame_mi;
++  const MODE_INFO *mode_info_context = cm->mi;
+   int mbr, mbc;
+ 
+   /* The pixel thresholds are adjusted according to if or not the macroblock
+--- libvpx-1.7.0.orig/vp8/decoder/dboolhuff.h
++++ libvpx-1.7.0/vp8/decoder/dboolhuff.h
+@@ -76,7 +76,7 @@ static int vp8dx_decode_bool(BOOL_DECODE
+   }
+ 
+   {
+-    register int shift = vp8_norm[range];
++    const unsigned char shift = vp8_norm[(unsigned char)range];
+     range <<= shift;
+     value <<= shift;
+     count -= shift;
+--- libvpx-1.7.0.orig/vp9/vp9_dx_iface.c
++++ libvpx-1.7.0/vp9/vp9_dx_iface.c
+@@ -97,7 +97,7 @@ static vpx_codec_err_t decoder_peek_si_i
+     const uint8_t *data, unsigned int data_sz, vpx_codec_stream_info_t *si,
+     int *is_intra_only, vpx_decrypt_cb decrypt_cb, void *decrypt_state) {
+   int intra_only_flag = 0;
+-  uint8_t clear_buffer[10];
++  uint8_t clear_buffer[11];
+ 
+   if (data + data_sz <= data) return VPX_CODEC_INVALID_PARAM;
+ 
+@@ -158,6 +158,9 @@ static vpx_codec_err_t decoder_peek_si_i
+         if (profile > PROFILE_0) {
+           if (!parse_bitdepth_colorspace_sampling(profile, &rb))
+             return VPX_CODEC_UNSUP_BITSTREAM;
++          // The colorspace info may cause vp9_read_frame_size() to need 11
++          // bytes.
++          if (data_sz < 11) return VPX_CODEC_UNSUP_BITSTREAM;
+         }
+         rb.bit_offset += REF_FRAMES;  // refresh_frame_flags
+         vp9_read_frame_size(&rb, (int *)&si->w, (int *)&si->h);
+--- libvpx-1.7.0.orig/vpx_dsp/bitreader.h
++++ libvpx-1.7.0/vpx_dsp/bitreader.h
+@@ -94,7 +94,7 @@ static INLINE int vpx_read(vpx_reader *r
+   }
+ 
+   {
+-    register int shift = vpx_norm[range];
++    const unsigned char shift = vpx_norm[(unsigned char)range];
+     range <<= shift;
+     value <<= shift;
+     count -= shift;
+--- libvpx-1.7.0.orig/vpx_dsp/bitreader_buffer.c
++++ libvpx-1.7.0/vpx_dsp/bitreader_buffer.c
+@@ -23,7 +23,7 @@ int vpx_rb_read_bit(struct vpx_read_bit_
+     rb->bit_offset = off + 1;
+     return bit;
+   } else {
+-    rb->error_handler(rb->error_handler_data);
++    if (rb->error_handler != NULL) rb->error_handler(rb->error_handler_data);
+     return 0;
+   }
+ }
diff --git a/pkgs/development/libraries/libvpx/default.nix b/pkgs/development/libraries/libvpx/default.nix
index d80fe6a998c9..ddde03e28768 100644
--- a/pkgs/development/libraries/libvpx/default.nix
+++ b/pkgs/development/libraries/libvpx/default.nix
@@ -65,7 +65,11 @@ stdenv.mkDerivation rec {
     sha256 = "0vvh89hvp8qg9an9vcmwb7d9k3nixhxaz6zi65qdjnd0i56kkcz6";
   };
 
-  patchPhase = ''patchShebangs .'';
+  patches = [
+    ./CVE-2019-9232.CVE-2019-9325.CVE-2019-9371.CVE-2019-9433.patch
+  ];
+
+  postPatch = ''patchShebangs .'';
 
   outputs = [ "bin" "dev" "out" ];
   setOutputFlags = false;
diff --git a/pkgs/development/libraries/poppler/default.nix b/pkgs/development/libraries/poppler/default.nix
index eb1e9ec732ff..f3e33d7616fb 100644
--- a/pkgs/development/libraries/poppler/default.nix
+++ b/pkgs/development/libraries/poppler/default.nix
@@ -12,11 +12,11 @@ let
 in
 stdenv.mkDerivation rec {
   name = "poppler-${suffix}-${version}";
-  version = "0.83.0"; # beware: updates often break cups-filters build
+  version = "0.84.0"; # beware: updates often break cups-filters build
 
   src = fetchurl {
     url = "${meta.homepage}/poppler-${version}.tar.xz";
-    sha256 = "16vr1g5qsqwyxfnyikqw37i04x9zpp45far2x90c7qbijw6nap38";
+    sha256 = "0ccp2gx05cz5y04k5pgbyi4ikyq60nafa7x2yx4aaf1vfkd318f7";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/v8/default.nix b/pkgs/development/libraries/v8/default.nix
index a02e540173d8..60e856e61dfe 100644
--- a/pkgs/development/libraries/v8/default.nix
+++ b/pkgs/development/libraries/v8/default.nix
@@ -121,8 +121,6 @@ stdenv.mkDerivation rec {
     Version: ${version}
     Libs: -L$out/lib -lv8 -pthread
     Cflags: -I$out/include
-    Libs: -L$out/lib -lpulse
-    Cflags: -I$out/include
     EOF
   '';
 
diff --git a/pkgs/development/libraries/wavpack/default.nix b/pkgs/development/libraries/wavpack/default.nix
index cd0b8bdb29dd..808836af1def 100644
--- a/pkgs/development/libraries/wavpack/default.nix
+++ b/pkgs/development/libraries/wavpack/default.nix
@@ -1,8 +1,8 @@
-{ stdenv, fetchurl, libiconv, fetchpatch }:
+{ stdenv, fetchurl, libiconv }:
 
 stdenv.mkDerivation rec {
   pname = "wavpack";
-  version = "5.1.0";
+  version = "5.2.0";
 
   enableParallelBuilding = true;
 
@@ -10,77 +10,9 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "http://www.wavpack.com/${pname}-${version}.tar.bz2";
-    sha256 = "0i19c6krc0p9krwrqy9s5xahaafigqzxcn31piidmlaqadyn4f8r";
+    sha256 = "062f97bvm466ygvix3z0kbgffvvrc5cg2ak568jaq8r56v28q8rw";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/dbry/WavPack/commit/26cb47f99d481ad9b93eeff80d26e6b63bbd7e15.patch";
-      name = "CVE-2018-10536-CVE-2018-10537.patch";
-      sha256 = "0s0fyycd4x7pw4vl1yp2vp4zrlk04j85idvnxz5h96fj6196anw6";
-    })
-    (fetchpatch {
-      url = "https://github.com/dbry/WavPack/commit/6f8bb34c2993a48ab9afbe353e6d0cff7c8d821d.patch";
-      name = "CVE-2018-10538-CVE-2018-10539-CVE-2018-10540.patch";
-      sha256 = "03qzmaq9mwiqbzrx1lvkgkhz3cjv7dky1b4lka3d5q2rwdlyw5qk";
-    })
-    (fetchpatch {
-      url = "https://github.com/dbry/WavPack/commit/d5bf76b5a88d044a1be1d5656698e3ba737167e5.patch";
-      name = "CVE-2018-6767.patch";
-      sha256 = "158c60i188kbxl0hzb7g74g21pknz7fk429vnbbx9zk1mlyyyl5b";
-    })
-    (fetchpatch {
-      url = "https://github.com/dbry/WavPack/commit/bf408e95f43fafdcef42c3f5f9c9d0e6ab0331b9.patch";
-      name = "CVE-2019-11498-1.patch";
-      sha256 = "161dw759v1lzbhj7daw2gbmcji8s0njpa65xmqhqw73bwpzb3xkd";
-    })
-    (fetchpatch {
-      url = "https://github.com/dbry/WavPack/commit/cd353bccafb1274a525c3536aaff8c48c3a33aa0.patch";
-      name = "CVE-2019-11498-2.patch";
-      sha256 = "120sb1iqkq2gadh0qydqvca4vwx31zb7gk1d0nm0y5agav2ai0dk";
-    })
-    (fetchpatch {
-      url = "https://github.com/dbry/WavPack/commit/4c0faba32fddbd0745cbfaf1e1aeb3da5d35b9fc.patch";
-      name = "CVE-2019-11498-3.patch";
-      sha256 = "12744yn1035mf7wzgqrkyadw5mwqf9v34ckj2m5sirk97k47k0wa";
-    })
-    (fetchpatch {
-      url = "https://github.com/dbry/WavPack/commit/bc6cba3f552c44565f7f1e66dc1580189addb2b4.patch";
-      name = "CVE-2019-11498-4.patch";
-      sha256 = "0qdw071b14hmxkjw6kn83d8hzq89l3hqh64pl1f1wb8m51w5xfg7";
-    })
-    (fetchpatch {
-      url = "https://github.com/dbry/WavPack/commit/070ef6f138956d9ea9612e69586152339dbefe51.patch";
-      name = "CVE-2018-19840.patch";
-      sha256 = "08y27py8hnki74ad8wbknnd36vj5pzzcm2vk3ngcbsjnj7x5mffz";
-    })
-    (fetchpatch {
-      url = "https://github.com/dbry/WavPack/commit/bba5389dc598a92bdf2b297c3ea34620b6679b5b.patch";
-      name = "CVE-2018-19841.patch";
-      sha256 = "08gx5xx51bi86cqqy7cv1d25k669a7wnkksasjspphwkpwkcxymy";
-    })
-    (fetchpatch {
-      url = "https://github.com/dbry/WavPack/commit/f68a9555b548306c5b1ee45199ccdc4a16a6101b.patch";
-      name = "CVE-2019-1010317.patch";
-      sha256 = "0v748nd9408v6ah37cn8wr0k0m0ny1g884q8q92j1dhwad69kfid";
-    })
-    (fetchpatch {
-      url = "https://github.com/dbry/WavPack/commit/33a0025d1d63ccd05d9dbaa6923d52b1446a62fe.patch";
-      name = "CVE-2019-1010319.patch";
-      sha256 = "011sqdgpykilaj2c4ns298z7aad03yprpva0dqr39nx88ji6jnrb";
-    })
-    (fetchpatch {
-      url = "https://github.com/dbry/WavPack/commit/36a24c7881427d2e1e4dc1cef58f19eee0d13aec.patch";
-      name = "CVE-2018-7253.patch";
-      sha256 = "130kvmlpaj6x1pm6qzdzrmf4xzhp0pj29qrardb76zcfinx5pk2n";
-    })
-    (fetchpatch {
-      url = "https://github.com/dbry/WavPack/commit/8e3fe45a7bac31d9a3b558ae0079e2d92a04799e.patch";
-      name = "CVE-2018-7254.patch";
-      sha256 = "06fdzw2cbdj8ajf171z1g53cl6bf1cdh2czswqldrqqvv3jkzk77";
-    })
-  ];
-
   meta = with stdenv.lib; {
     description = "Hybrid audio compression format";
     homepage    = http://www.wavpack.com/;
diff --git a/pkgs/development/libraries/x264/default.nix b/pkgs/development/libraries/x264/default.nix
index 2757ca7704c4..5c4c64d0e1cf 100644
--- a/pkgs/development/libraries/x264/default.nix
+++ b/pkgs/development/libraries/x264/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "x264";
-  version = "20190517-2245";
+  version = "20191217-2245";
 
   src = fetchurl {
     url = "https://download.videolan.org/x264/snapshots/x264-snapshot-${version}-stable.tar.bz2";
-    sha256 = "1xv41z04km3rf374xk3ny7v8ibr211ph0j5am0909ln63mphc48f";
+    sha256 = "0q214q4rhbhigyx3dfhp6d5v5gzln01cxccl153ps5ih567mqjdj";
   };
 
   # Upstream ./configure greps for (-mcpu|-march|-mfpu) in CFLAGS, which in nix
@@ -24,6 +24,8 @@ stdenv.mkDerivation rec {
   preConfigure = lib.optionalString (stdenv.buildPlatform.isx86_64 || stdenv.hostPlatform.isi686) ''
     # `AS' is set to the binutils assembler, but we need nasm
     unset AS
+  '' + lib.optionalString (stdenv.hostPlatform.isAarch64 || stdenv.hostPlatform.isAarch32) ''
+    export AS=$CC
   '';
 
   configureFlags = [ "--enable-shared" ]
diff --git a/pkgs/development/python-modules/botocore/default.nix b/pkgs/development/python-modules/botocore/default.nix
index 50504257c64e..a03e3d9f5f41 100644
--- a/pkgs/development/python-modules/botocore/default.nix
+++ b/pkgs/development/python-modules/botocore/default.nix
@@ -19,8 +19,6 @@ buildPythonPackage rec {
     sha256 = "8223485841ef4731a5d4943a733295ba69d0005c4ae64c468308cc07f6960d39";
   };
 
-  outputs = [ "out" "dev" ];
-
   propagatedBuildInputs = [
     dateutil
     jmespath
diff --git a/pkgs/development/python-modules/numpy/default.nix b/pkgs/development/python-modules/numpy/default.nix
index bdd766968851..92bcb131ab19 100644
--- a/pkgs/development/python-modules/numpy/default.nix
+++ b/pkgs/development/python-modules/numpy/default.nix
@@ -27,13 +27,13 @@ let
   };
 in buildPythonPackage rec {
   pname = "numpy";
-  version = "1.18.0";
+  version = "1.18.1";
   format = "pyproject.toml";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "a9d72d9abaf65628f0f31bbb573b7d9304e43b1e6bbae43149c17737a42764c4";
+    sha256 = "b6ff59cee96b454516e47e7721098e6ceebef435e3e21ac2d6c3b8b02628eb77";
   };
 
   nativeBuildInputs = [ gfortran pytest cython setuptoolsBuildHook ];
diff --git a/pkgs/development/python-modules/pandas/default.nix b/pkgs/development/python-modules/pandas/default.nix
index fc5841ba796e..c9db6b1169a1 100644
--- a/pkgs/development/python-modules/pandas/default.nix
+++ b/pkgs/development/python-modules/pandas/default.nix
@@ -30,11 +30,11 @@ let
 
 in buildPythonPackage rec {
   pname = "pandas";
-  version = "0.25.3";
+  version = "1.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "52da74df8a9c9a103af0a72c9d5fdc8e0183a90884278db7f386b5692a2220a4";
+    sha256 = "3ea6cc86931f57f18b1240572216f09922d91b19ab8a01cf24734394a3db3bec";
   };
 
   checkInputs = [ pytest glibcLocales moto hypothesis ];
diff --git a/pkgs/development/python-modules/pyparsing/default.nix b/pkgs/development/python-modules/pyparsing/default.nix
index f1f43a5f495b..4acc4fa804b3 100644
--- a/pkgs/development/python-modules/pyparsing/default.nix
+++ b/pkgs/development/python-modules/pyparsing/default.nix
@@ -1,19 +1,35 @@
-{ stdenv, buildPythonPackage, fetchPypi }:
+{ buildPythonPackage
+, fetchFromGitHub
+, lib
+
+# pythonPackages
+, coverage
+}:
+
 buildPythonPackage rec {
-    pname = "pyparsing";
-    version = "2.4.6";
+  pname = "pyparsing";
+  version = "2.4.6";
 
-    src = fetchPypi {
-      inherit pname version;
-      sha256 = "4c830582a84fb022400b85429791bc551f1f4871c33f23e44f353119e92f969f";
-    };
+  src = fetchFromGitHub {
+    owner = "pyparsing";
+    repo = pname;
+    rev = "pyparsing_${version}";
+    sha256 = "1fh7s3cfr274pd6hh6zygl99842rqws98an2nkrrqj2spb9ldxcm";
+  };
 
-    # Not everything necessary to run the tests is included in the distribution
-    doCheck = false;
+  # https://github.com/pyparsing/pyparsing/blob/847af590154743bae61a32c3dc1a6c2a19009f42/tox.ini#L6
+  checkInputs = [ coverage ];
+  checkPhase = ''
+    coverage run --branch simple_unit_tests.py
+    coverage run --branch unitTests.py
+  '';
 
-    meta = with stdenv.lib; {
-      homepage = https://pyparsing.wikispaces.com/;
-      description = "An alternative approach to creating and executing simple grammars, vs. the traditional lex/yacc approach, or the use of regular expressions";
-      license = licenses.mit;
-    };
+  meta = with lib; {
+    homepage = "https://github.com/pyparsing/pyparsing";
+    description = "An alternative approach to creating and executing simple grammars, vs. the traditional lex/yacc approach, or the use of regular expressions";
+    license = licenses.mit;
+    maintainers = with maintainers; [
+      kamadorueda
+    ];
+  };
 }
diff --git a/pkgs/development/python-modules/pytest/default.nix b/pkgs/development/python-modules/pytest/default.nix
index 48b6e89a10ea..bb44cebad914 100644
--- a/pkgs/development/python-modules/pytest/default.nix
+++ b/pkgs/development/python-modules/pytest/default.nix
@@ -3,7 +3,7 @@
 , atomicwrites, mock, writeText, pathlib2, wcwidth, packaging, isPyPy, python
 }:
 buildPythonPackage rec {
-  version = "5.3.2";
+  version = "5.3.5";
   pname = "pytest";
 
   disabled = !isPy3k;
@@ -15,7 +15,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "6b571215b5a790f9b41f19f3531c53a45cf6bb8ef2988bc1ff9afb38270b25fa";
+    sha256 = "0d5fe9189a148acc3c3eb2ac8e1ac0742cb7618c084f3d228baaec0c254b318d";
   };
 
   checkInputs = [ hypothesis mock ];
diff --git a/pkgs/development/python-modules/s3transfer/default.nix b/pkgs/development/python-modules/s3transfer/default.nix
index 3020ab68ec76..2ba5a944d711 100644
--- a/pkgs/development/python-modules/s3transfer/default.nix
+++ b/pkgs/development/python-modules/s3transfer/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     sha256 = "6efc926738a3cd576c2a79725fed9afde92378aa5c6a957e3af010cb019fac9d";
   };
 
-  outputs = [ "out" "dev" ];
-
   propagatedBuildInputs =
     [ botocore
     ] ++ stdenv.lib.optional (pythonOlder "3") futures;
diff --git a/pkgs/development/python-modules/urllib3/default.nix b/pkgs/development/python-modules/urllib3/default.nix
index 0c8c97925a7b..9e28647fd016 100644
--- a/pkgs/development/python-modules/urllib3/default.nix
+++ b/pkgs/development/python-modules/urllib3/default.nix
@@ -11,8 +11,6 @@ buildPythonPackage rec {
     sha256 = "f3c5fd51747d450d4dcf6f923c81f78f811aab8205fda64b0aba34a4e48b0745";
   };
 
-  outputs = [ "out" "dev" ];
-
   NOSE_EXCLUDE = stdenv.lib.concatStringsSep "," [
     "test_headers" "test_headerdict" "test_can_validate_ip_san" "test_delayed_body_read_timeout"
     "test_timeout_errors_cause_retries" "test_select_multiple_interrupts_with_event"
diff --git a/pkgs/development/tools/build-managers/cmake/default.nix b/pkgs/development/tools/build-managers/cmake/default.nix
index 93e75a855d3d..33d762dbe92c 100644
--- a/pkgs/development/tools/build-managers/cmake/default.nix
+++ b/pkgs/development/tools/build-managers/cmake/default.nix
@@ -19,12 +19,12 @@ stdenv.mkDerivation rec {
           + lib.optionalString useNcurses "-cursesUI"
           + lib.optionalString withQt5 "-qt5UI"
           + lib.optionalString useQt4 "-qt4UI";
-  version = "3.16.2";
+  version = "3.16.3";
 
   src = fetchurl {
     url = "${meta.homepage}files/v${lib.versions.majorMinor version}/cmake-${version}.tar.gz";
     # compare with https://cmake.org/files/v${lib.versions.majorMinor version}/cmake-${version}-SHA-256.txt
-    sha256 = "1ag65ignli58kpmji6gjhj8xw4w1qdr910i99hsvx8hcqrp7h2cc";
+    sha256 = "0s06wrp0jnw2l4yq94skj53hwnz7lqrmhh96sq7w7njkkggickz5";
   };
 
   patches = [
diff --git a/pkgs/misc/cups/default.nix b/pkgs/misc/cups/default.nix
index d18829673cc7..6786623fee3e 100644
--- a/pkgs/misc/cups/default.nix
+++ b/pkgs/misc/cups/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   pname = "cups";
 
   # After 2.2.6, CUPS requires headers only available in macOS 10.12+
-  version = if stdenv.isDarwin then "2.2.6" else "2.3.0";
+  version = if stdenv.isDarwin then "2.2.6" else "2.3.1";
 
   passthru = { inherit version; };
 
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     url = "https://github.com/apple/cups/releases/download/v${version}/cups-${version}-source.tar.gz";
     sha256 = if version == "2.2.6"
              then "16qn41b84xz6khrr2pa2wdwlqxr29rrrkjfi618gbgdkq9w5ff20"
-             else "19d1jpdpxy0fclq37pchi7ldnw9dssxx3zskcgqai3h0rwlh5bxc";
+             else "1kkpmj17205j8w9hdff2bfpk6lwdmr3gx0j4r35nhgvya24rvjhv";
   };
 
   outputs = [ "out" "lib" "dev" "man" ];
diff --git a/pkgs/os-specific/darwin/apple-sdk/default.nix b/pkgs/os-specific/darwin/apple-sdk/default.nix
index aef7341e5e9f..9890d385259c 100644
--- a/pkgs/os-specific/darwin/apple-sdk/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk/default.nix
@@ -61,9 +61,16 @@ let
     installPhase = ''
       linkFramework() {
         local path="$1"
+        local nested_path="$1"
         local dest="$out/Library/Frameworks/$path"
+        if [ "$path" == "JavaNativeFoundation.framework" ]; then
+          local nested_path="JavaVM.framework/Versions/A/Frameworks/JavaNativeFoundation.framework"
+        fi
+        if [ "$path" == "JavaRuntimeSupport.framework" ]; then
+          local nested_path="JavaVM.framework/Versions/A/Frameworks/JavaRuntimeSupport.framework"
+        fi
         local name="$(basename "$path" .framework)"
-        local current="$(readlink "/System/Library/Frameworks/$path/Versions/Current")"
+        local current="$(readlink "/System/Library/Frameworks/$nested_path/Versions/Current")"
         if [ -z "$current" ]; then
           current=A
         fi
@@ -75,25 +82,21 @@ let
         # ApplicationServices in the 10.9 SDK
         local isChild=0
 
-        if [ -d "${sdk.out}/Library/Frameworks/$path/Versions/$current/Headers" ]; then
+        if [ -d "${sdk.out}/Library/Frameworks/$nested_path/Versions/$current/Headers" ]; then
           isChild=1
-          cp -R "${sdk.out}/Library/Frameworks/$path/Versions/$current/Headers" .
+          cp -R "${sdk.out}/Library/Frameworks/$nested_path/Versions/$current/Headers" .
         elif [ -d "${sdk.out}/Library/Frameworks/$name.framework/Versions/$current/Headers" ]; then
           current="$(readlink "/System/Library/Frameworks/$name.framework/Versions/Current")"
           cp -R "${sdk.out}/Library/Frameworks/$name.framework/Versions/$current/Headers" .
         fi
-        ln -s -L "/System/Library/Frameworks/$path/Versions/$current/$name"
-        ln -s -L "/System/Library/Frameworks/$path/Versions/$current/Resources"
+        ln -s -L "/System/Library/Frameworks/$nested_path/Versions/$current/$name"
+        ln -s -L "/System/Library/Frameworks/$nested_path/Versions/$current/Resources"
 
-        if [ -f "/System/Library/Frameworks/$path/module.map" ]; then
-          ln -s "/System/Library/Frameworks/$path/module.map"
+        if [ -f "/System/Library/Frameworks/$nested_path/module.map" ]; then
+          ln -s "/System/Library/Frameworks/$nested_path/module.map"
         fi
 
-        if [ $isChild -eq 1 ]; then
-          pushd "${sdk.out}/Library/Frameworks/$path/Versions/$current" >/dev/null
-        else
-          pushd "${sdk.out}/Library/Frameworks/$name.framework/Versions/$current" >/dev/null
-        fi
+        pushd "${sdk.out}/Library/Frameworks/$nested_path/Versions/$current" >/dev/null
         local children=$(echo Frameworks/*.framework)
         popd >/dev/null
 
@@ -109,7 +112,6 @@ let
         popd >/dev/null
       }
 
-
       linkFramework "${name}.framework"
     '';
 
diff --git a/pkgs/os-specific/darwin/apple-sdk/frameworks.nix b/pkgs/os-specific/darwin/apple-sdk/frameworks.nix
index b5a378cc6ae1..09e0e4e48ecd 100644
--- a/pkgs/os-specific/darwin/apple-sdk/frameworks.nix
+++ b/pkgs/os-specific/darwin/apple-sdk/frameworks.nix
@@ -65,6 +65,8 @@ with frameworks; with libs; {
   InstallerPlugins        = [];
   InstantMessage          = [];
   JavaFrameEmbedding      = [];
+  JavaNativeFoundation    = [];
+  JavaRuntimeSupport      = [];
   JavaScriptCore          = [];
   Kerberos                = [];
   Kernel                  = [ IOKit ];
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libdispatch/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libdispatch/default.nix
index 46e9e592ddc6..e7aa47bdb6b1 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libdispatch/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libdispatch/default.nix
@@ -12,5 +12,14 @@ appleDerivation {
 
     cp -r dispatch/*.h $out/include/dispatch
     cp -r os/object*.h  $out/include/os
+
+    # gcc compatability. Source: https://stackoverflow.com/a/28014302/3714556
+    substituteInPlace $out/include/dispatch/object.h \
+      --replace 'typedef void (^dispatch_block_t)(void);' \
+                '#ifdef __clang__
+                 typedef void (^dispatch_block_t)(void);
+                 #else
+                 typedef void* dispatch_block_t;
+                 #endif'
   '';
 }
diff --git a/pkgs/os-specific/linux/iproute/default.nix b/pkgs/os-specific/linux/iproute/default.nix
index b8b46b33e96c..8e753121b7f0 100644
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "iproute2";
-  version = "5.4.0";
+  version = "5.5.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1bl6c3af7wbgi6nqjfm32fkhqh63iphkg2g11f1srifll1ham5zy";
+    sha256 = "0ywg70f98wgfai35jl47xzpjp45a6n7crja4vc8ql85cbi1l7ids";
   };
 
   preConfigure = ''
diff --git a/pkgs/servers/pulseaudio/default.nix b/pkgs/servers/pulseaudio/default.nix
index da201765e55e..49909510d2ed 100644
--- a/pkgs/servers/pulseaudio/default.nix
+++ b/pkgs/servers/pulseaudio/default.nix
@@ -108,7 +108,10 @@ stdenv.mkDerivation rec {
     rm -rf $out/{bin,share,etc,lib/{pulse-*,systemd}}
     sed 's|-lltdl|-L${libtool.lib}/lib -lltdl|' -i $out/lib/pulseaudio/libpulsecore-${version}.la
   ''
-    + ''moveToOutput lib/cmake "$dev" '';
+    + ''
+    moveToOutput lib/cmake "$dev"
+    rm -f $out/bin/qpaeq # this is packaged by the "qpaeq" package now, because of missing deps
+  '';
 
   preFixup = lib.optionalString stdenv.isLinux ''
     wrapProgram $out/libexec/pulse/gsettings-helper \
diff --git a/pkgs/servers/pulseaudio/qpaeq.nix b/pkgs/servers/pulseaudio/qpaeq.nix
new file mode 100644
index 000000000000..c84cc29f6528
--- /dev/null
+++ b/pkgs/servers/pulseaudio/qpaeq.nix
@@ -0,0 +1,54 @@
+{ mkDerivation
+, makeDesktopItem
+, python3
+, fetchurl
+, lib
+, pulseaudio
+}:
+
+let
+  desktopItem = makeDesktopItem {
+    name = "qpaeq";
+    exec = "@out@/bin/qpaeq";
+    icon = "audio-volume-high";
+    desktopName = "qpaeq";
+    genericName = "Audio equalizer";
+    categories = "Music;Sound;";
+    startupNotify = "false";
+  };
+in
+mkDerivation rec {
+  pname = "qpaeq";
+  inherit (pulseaudio) version src;
+
+  buildInputs = [
+    ((python3.withPackages (ps: with ps; [
+          pyqt5
+          dbus-python
+        ])))
+  ];
+
+  dontBuild = true;
+  dontConfigure = true;
+
+  installPhase = ''
+    runHook preInstall
+    install -D ./src/utils/qpaeq $out/bin/qpaeq
+    install -D ${desktopItem}/share/applications/qpaeq.desktop $out/share/applications/qpaeq.desktop
+    runHook postInstall
+  '';
+
+  preFixup = ''
+    sed "s|,sip|,PyQt5.sip|g" -i $out/bin/qpaeq
+    wrapQtApp $out/bin/qpaeq
+    sed "s|@out@|$out|g" -i $out/share/applications/qpaeq.desktop
+  '';
+
+  meta = {
+    description = "An equalizer interface for pulseaudio's equalizer sinks";
+    homepage = http://www.pulseaudio.org/;
+    license = lib.licenses.lgpl2Plus;
+    maintainers = with lib.maintainers; [ lovek323 mkg20001 ];
+    platforms = lib.platforms.unix;
+  };
+}
diff --git a/pkgs/servers/samba/4.x.nix b/pkgs/servers/samba/4.x.nix
index c7ee15bc9f86..27139ed846c1 100644
--- a/pkgs/servers/samba/4.x.nix
+++ b/pkgs/servers/samba/4.x.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, python, pkgconfig, perl, libxslt, docbook_xsl, rpcgen
+{ lib, stdenv, fetchurl, fetchpatch, python, pkgconfig, perl, libxslt, docbook_xsl, rpcgen
 , fixDarwinDylibNames
 , docbook_xml_dtd_42, readline
 , popt, iniparser, libbsd, libarchive, libiconv, gettext
@@ -20,11 +20,11 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "samba";
-  version = "4.10.11";
+  version = "4.11.5";
 
   src = fetchurl {
     url = "mirror://samba/pub/samba/stable/${pname}-${version}.tar.gz";
-    sha256 = "157qvz8x2s7994rzxhcmpc79cfk86zc0rq5qwg8alvjcw0r457v0";
+    sha256 = "0gyr773dl0krcra6pvyp8i9adj3r16ihrrm2b71c0974cbzrkqpk";
   };
 
   outputs = [ "out" "dev" "man" ];
@@ -34,6 +34,11 @@ stdenv.mkDerivation rec {
     ./patch-source3__libads__kerberos_keytab.c.patch
     ./4.x-no-persistent-install-dynconfig.patch
     ./4.x-fix-makeflags-parsing.patch
+    (fetchpatch {
+      name = "test-oLschema2ldif-fmemopen.patch";
+      url = "https://gitlab.com/samba-team/samba/commit/5e517e57c9d4d35e1042a49d3592652b05f0c45b.patch";
+      sha256 = "1bbldf794svsdvcbp649imghmj0jck7545d3k9xs953qkkgwkbxi";
+    })
   ];
 
   nativeBuildInputs = optionals stdenv.isDarwin [ rpcgen fixDarwinDylibNames ];
@@ -41,12 +46,12 @@ stdenv.mkDerivation rec {
   buildInputs = [
     python pkgconfig perl libxslt docbook_xsl docbook_xml_dtd_42 /*
     docbook_xml_dtd_45 */ readline popt iniparser jansson
-    libbsd libarchive zlib fam libiconv gettext libunwind krb5Full
+    libbsd libarchive zlib fam libiconv gettext libunwind krb5Full gnutls
   ] ++ optionals stdenv.isLinux [ libaio systemd ]
     ++ optional enableLDAP openldap
     ++ optional (enablePrinting && stdenv.isLinux) cups
     ++ optional enableMDNS avahi
-    ++ optionals enableDomainController [ gnutls gpgme lmdb ]
+    ++ optionals enableDomainController [ gpgme lmdb ]
     ++ optional enableRegedit ncurses
     ++ optional (enableCephFS && stdenv.isLinux) libceph
     ++ optionals (enableGlusterFS && stdenv.isLinux) [ glusterfs libuuid ]
@@ -61,9 +66,6 @@ stdenv.mkDerivation rec {
     sed -i "s,\(XML_CATALOG_FILES=\"\),\1$XML_CATALOG_FILES ,g" buildtools/wafsamba/wafsamba.py
 
     patchShebangs ./buildtools/bin
-  '' + optionalString stdenv.isDarwin ''
-     substituteInPlace libcli/dns/wscript_build \
-       --replace "bld.SAMBA_BINARY('resolvconftest'" "True or bld.SAMBA_BINARY('resolvconftest'"
   '';
 
   configureFlags = [
diff --git a/pkgs/tools/admin/awscli/default.nix b/pkgs/tools/admin/awscli/default.nix
index f38d4cd1a1d6..06ddd0e85896 100644
--- a/pkgs/tools/admin/awscli/default.nix
+++ b/pkgs/tools/admin/awscli/default.nix
@@ -57,9 +57,6 @@ in py.pkgs.buildPythonApplication rec {
     pyyaml
     groff
     less
-    urllib3
-    dateutil
-    jmespath
   ];
 
   postInstall = ''
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index 519a33c60d69..1294c6758f48 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -52,6 +52,10 @@ stdenv.mkDerivation (rec {
 
     sed '2i print "Skipping env -S test";  exit 77;' -i ./tests/misc/env-S.pl
 
+    # Fails on systems with a rootfs. Looks like a bug in the test, see
+    # https://lists.gnu.org/archive/html/bug-coreutils/2019-12/msg00000.html
+    sed '2i print "Skipping df skip-rootfs test"; exit 77' -i ./tests/df/skip-rootfs.sh
+
     # these tests fail in the unprivileged nix sandbox (without nix-daemon) as we break posix assumptions
     for f in ./tests/chgrp/{basic.sh,recurse.sh,default-no-deref.sh,no-x.sh,posix-H.sh}; do
       sed '2i echo Skipping chgrp && exit 77' -i "$f"
diff --git a/pkgs/tools/system/pciutils/default.nix b/pkgs/tools/system/pciutils/default.nix
index b773529a0d77..51cfaf9f333c 100644
--- a/pkgs/tools/system/pciutils/default.nix
+++ b/pkgs/tools/system/pciutils/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, pkgconfig, zlib, kmod, which }:
 
 stdenv.mkDerivation rec {
-  name = "pciutils-3.6.2"; # with release-date database
+  name = "pciutils-3.6.4"; # with release-date database
 
   src = fetchurl {
     url = "mirror://kernel/software/utils/pciutils/${name}.tar.xz";
-    sha256 = "1wwkpglvvr1sdj2gxz9khq507y02c4px48njy25divzdhv4jwifv";
+    sha256 = "0mb0f2phdcmp4kfiqsszn2k6nlln0w160ffzrjjv4bbfjwrgfzzn";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/tools/text/gnused/default.nix b/pkgs/tools/text/gnused/default.nix
index 3d73bfba6576..953be5e07d66 100644
--- a/pkgs/tools/text/gnused/default.nix
+++ b/pkgs/tools/text/gnused/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnused";
-  version = "4.7";
+  version = "4.8";
 
   src = fetchurl {
     url = "mirror://gnu/sed/sed-${version}.tar.xz";
-    sha256 = "0smxcx66vx29djzb542nxcynl7qnzxqa5032ibazi7x2s267d198";
+    sha256 = "0cznxw73fzv1n3nj2zsq6nf73rvsbxndp444xkpahdqvlzz0r6zp";
   };
 
   outputs = [ "out" "info" ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 92d90410ee1e..5e3e48c43783 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8441,7 +8441,13 @@ in
   jre = jre8;
   jre_headless = jre8_headless;
 
-  inherit (callPackages ../development/compilers/graalvm { }) mx jvmci8 graalvm8;
+  inherit (callPackages ../development/compilers/graalvm {
+    gcc = if stdenv.targetPlatform.isDarwin then gcc8 else gcc;
+    inherit (darwin.apple_sdk.frameworks)
+      CoreFoundation Foundation JavaNativeFoundation
+      JavaVM JavaRuntimeSupport Cocoa;
+    inherit (darwin) libiconv libobjc libresolv;
+  }) mx jvmci8 graalvm8;
 
   inherit (callPackages ../development/compilers/graalvm/enterprise-edition.nix { })
     graalvm8-ee
@@ -15475,6 +15481,8 @@ in
     inherit (darwin.apple_sdk.frameworks) CoreServices AudioUnit Cocoa;
   };
 
+  qpaeq = qt5.callPackage ../servers/pulseaudio/qpaeq.nix { };
+
   pulseaudioFull = pulseaudio.override {
     x11Support = true;
     jackaudioSupport = true;