Merge remote-tracking branch 'upstream/master' into staging

2018-08-01 19:06:09 +03:00 · 2018-08-01 19:06:09 +03:00 · 6260fc8b8e
commit 6260fc8b8e
parent a1fc74b835 e94fcbcd01
90 changed files with 1416 additions and 374 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -539,6 +539,11 @@
    github = "boothead";
    name = "Ben Ford";
  };
+  borisbabic = {
+    email = "boris.ivan.babic@gmail.com";
+    github = "borisbabic";
+    name = "Boris Babić";
+  };
  bosu = {
    email = "boriss@gmail.com";
    github = "bosu";
@ -921,6 +926,11 @@
    github = "deepfire";
    name = "Kosyrev Serge";
  };
+  deltaevo = {
+    email = "deltaduartedavid@gmail.com";
+    github = "DeltaEvo";
+    name = "Duarte David";
+  };
  demin-dmitriy = {
    email = "demindf@gmail.com";
    github = "demin-dmitriy";
@ -2259,6 +2269,11 @@
    github = "luispedro";
    name = "Luis Pedro Coelho";
  };
+  lukeadams = {
+    email = "luke.adams@belljar.io";
+    github = "lukeadams";
+    name = "Luke Adams";
+  };
  lukego = {
    email = "luke@snabb.co";
    github = "lukego";
--- a/nixos/modules/services/cluster/kubernetes/default.nix
+++ b/nixos/modules/services/cluster/kubernetes/default.nix
@ -838,6 +838,8 @@ in {
        path = with pkgs; [ gitMinimal openssh docker utillinux iproute ethtool thin-provisioning-tools iptables socat ] ++ cfg.path;
        serviceConfig = {
          Slice = "kubernetes.slice";
+          CPUAccounting = true;
+          MemoryAccounting = true;
          ExecStart = ''${cfg.package}/bin/kubelet \
            ${optionalString (taints != "")
              "--register-with-taints=${taints}"} \
--- a/pkgs/applications/altcoins/bitcoin.nix
+++ b/pkgs/applications/altcoins/bitcoin.nix
@ -5,13 +5,13 @@
 with stdenv.lib;
 stdenv.mkDerivation rec{
  name = "bitcoin" + (toString (optional (!withGui) "d")) + "-" + version;
-  version = "0.16.1";
+  version = "0.16.2";

  src = fetchurl {
    urls = [ "https://bitcoincore.org/bin/bitcoin-core-${version}/bitcoin-${version}.tar.gz"
             "https://bitcoin.org/bin/bitcoin-core-${version}/bitcoin-${version}.tar.gz"
           ];
-    sha256 = "1zkqp93yircd3pbxczxfnibkpq0sgcv5r7wg6d196b9pwgr9zd39";
+    sha256 = "1n07qykx5hc0ph8fwn7hfrbsrjv19fdzvs5h0nysq4wfgn5wa40r";
  };

  nativeBuildInputs = [ pkgconfig autoreconfHook ];
--- a/pkgs/applications/audio/audio-recorder/default.nix
+++ b/pkgs/applications/audio/audio-recorder/default.nix
@ -1,41 +1,29 @@
-{ stdenv, fetchurl, lib
-, pkgconfig, intltool, autoconf, gnome3
-, glib, dbus, gtk3, libdbusmenu-gtk3, libappindicator-gtk3, gst_all_1
+{ stdenv, fetchurl
+, pkgconfig, intltool, gnome3
+, glib, dbus, gtk3, libappindicator-gtk3, gst_all_1
 , librsvg, wrapGAppsHook
 , pulseaudioSupport ? true, libpulseaudio ? null }:

-with lib;
-
 stdenv.mkDerivation rec {
  name = "audio-recorder-${version}";
-  version = "1.9.7";
+  version = "2.1.3";

  src = fetchurl {
-    name = "${name}-zesty.tar.gz";
-    url = "${meta.homepage}/+archive/ubuntu/ppa/+files/audio-recorder_${version}%7Ezesty.tar.gz";
-    sha256 = "163c0vs5qj72y62731yp6sl6s0indh2szhjg02mxigv9b68dx89c";
+    name = "${name}.tar.gz";
+    url = "${meta.homepage}/+archive/ubuntu/ppa/+files/audio-recorder_${version}%7Ebionic.tar.gz";
+    sha256 = "160pnmnmc9zwzyclsci3w1qwlgxkfx1y3x5ck6i587w78570an1r";
  };

-  nativeBuildInputs = [ pkgconfig intltool autoconf wrapGAppsHook ];
+  # https://bugs.launchpad.net/audio-recorder/+bug/1784622
+  NIX_CFLAGS_COMPILE = "-I${gnome3.glib.dev}/include/gio-unix-2.0";

-  buildInputs = with gst_all_1; [
-    glib dbus gtk3 librsvg libdbusmenu-gtk3 libappindicator-gtk3 (stdenv.lib.getLib gnome3.dconf)
+  nativeBuildInputs = [ pkgconfig intltool wrapGAppsHook ];
+
+  buildInputs = [
+    glib dbus gtk3 librsvg libappindicator-gtk3
+  ] ++ (with gst_all_1; [
    gstreamer gst-plugins-base gst-plugins-good gst-plugins-bad gst-plugins-ugly gst-libav
-  ] ++ optional pulseaudioSupport libpulseaudio;
-
-  postPatch = ''
-    substituteInPlace configure.ac \
-      --replace 'PKG_CHECK_MODULES(GIO, gio-2.0 >= $GLIB_REQUIRED)' \
-                'PKG_CHECK_MODULES(GIO, gio-2.0 >= $GLIB_REQUIRED gio-unix-2.0)'
-    autoconf
-    intltoolize
-  '';
-
-  preFixup = ''
-    gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : $out/share:$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH
-      --prefix GST_PLUGIN_SYSTEM_PATH_1_0 : $GST_PLUGIN_SYSTEM_PATH_1_0
-      --prefix GIO_EXTRA_MODULES : ${stdenv.lib.getLib gnome3.dconf}/lib/gio/modules)
-  '';
+  ]) ++ stdenv.lib.optional pulseaudioSupport libpulseaudio;

  meta = with stdenv.lib; {
    description = "Audio recorder for GNOME and Unity Desktops";
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@ -43,9 +43,9 @@ in rec {
  beta = mkStudio (latestVersion // {
    pname = "android-studio-preview";
    #pname = "android-studio-beta"; # TODO: Rename and provide symlink
-    version = "3.2.0.21"; # "Android Studio 3.2 Beta 4"
-    build = "181.4886486";
-    sha256Hash = "1n4lcy0ng87fv45qjlpdb2zn3zl5lg6jwkbaijhbsm2rh4ljisr3";
+    version = "3.2.0.22"; # "Android Studio 3.2 Beta 5"
+    build = "181.4913314";
+    sha256Hash = "016nyn1pqviy089hg0dq7m4cqb39fdxdcy4zknkaq7dmgv1dj6x9";

    meta = stable.meta // {
      description = "The Official IDE for Android (beta channel)";
--- a/pkgs/applications/editors/atom/default.nix
+++ b/pkgs/applications/editors/atom/default.nix
@ -1,12 +1,15 @@
 { stdenv, pkgs, fetchurl, makeWrapper, gvfs, atomEnv}:

 let
-  common = pname: {version, sha256}: stdenv.mkDerivation rec {
-    name = "${pname}-${version}";
-    inherit version;
+  common = pname: {version, sha256, beta ? null}:
+      let fullVersion = version + stdenv.lib.optionalString (beta != null) "-beta${toString beta}";
+      name = "${pname}-${fullVersion}";
+  in stdenv.mkDerivation {
+    inherit name;
+    version = fullVersion;

    src = fetchurl {
-      url = "https://github.com/atom/atom/releases/download/v${version}/atom-amd64.deb";
+      url = "https://github.com/atom/atom/releases/download/v${fullVersion}/atom-amd64.deb";
      name = "${name}.deb";
      inherit sha256;
    };
@ -61,12 +64,13 @@ let
  };
 in stdenv.lib.mapAttrs common {
  atom = {
-    version = "1.28.2";
-    sha256 = "07lz4lj07dbfz952l3q9vplvg41pxl1cx89gzy8bzzr3ay7kn6za";
+    version = "1.29.0";
+    sha256 = "0f0qpn8aw2qlqk8ah71xvk4vcmwsnsf2f3g4hz0rvaqnhb9ri9fz";
  };

  atom-beta = {
-    version = "1.29.0-beta1";
-    sha256 = "121y716pnq4vpjrymr505prskvi5a2lnn8hw79q8b4hf7yz0j6rb";
+    version = "1.30.0";
+    beta = 1;
+    sha256 = "0ygqj81xlwhzmmci0d0rd2q7xfskxd1k7h6db3zvvjdxjcnyqp1z";
  };
 }
--- a/pkgs/applications/misc/1password/default.nix
+++ b/pkgs/applications/misc/1password/default.nix
@ -2,24 +2,24 @@

 stdenv.mkDerivation rec {
  name = "1password-${version}";
-  version = "0.4.1";
+  version = "0.5.1";
  src =
    if stdenv.system == "i686-linux" then
      fetchzip {
        url = "https://cache.agilebits.com/dist/1P/op/pkg/v${version}/op_linux_386_v${version}.zip";
-        sha256 = "1yzzh1f6hx7vwdgzp0znsjarjiw4xqmmrkc5xwywgjpg81qqpl8c";
+        sha256 = "08kzjilxpkvlwqjyxnic1n6xiy6gkndijwxdksm59k7c56mdawsz";
        stripRoot = false;
      }
    else if stdenv.system == "x86_64-linux" then
      fetchzip {
        url = "https://cache.agilebits.com/dist/1P/op/pkg/v${version}/op_linux_amd64_v${version}.zip";
-        sha256 = "0dgj1zqmpdbnsz2v2j7nqm232cdgyp9wagc089dxi4hbzkmfcvzx";
+        sha256 = "1bsbzaqws0z991r6rkjrxay74fj4g5ld4d748ygr0950zwi1m3h7";
        stripRoot = false;
      }
    else if stdenv.system == "x86_64-darwin" then
      fetchzip {
        url = "https://cache.agilebits.com/dist/1P/op/pkg/v${version}/op_darwin_amd64_v${version}.zip";
-        sha256 = "116bvyfg38npdhlzaxan5y47cbw7jvj94q5w6v71kxsjzxk9l44a";
+        sha256 = "1dhr8m9icip27v802gxl1vhl9rf0jq5awirdm72lqmlypj86df0g";
        stripRoot = false;
      }
    else throw "Architecture not supported";
@ -34,13 +34,11 @@ stdenv.mkDerivation rec {
  '';

  meta = with stdenv.lib; {
-    description = "1Password command-line tool";
-    homepage    = [
-      "https://blog.agilebits.com/2017/09/06/announcing-the-1password-command-line-tool-public-beta/"
-      "https://app-updates.agilebits.com/product_history/CLI"
-    ];
-    maintainers = with maintainers; [ joelburget ];
-    license     = licenses.unfree;
-    platforms   = [ "i686-linux" "x86_64-linux" "x86_64-darwin" ];
+    description  = "1Password command-line tool";
+    homepage     = https://support.1password.com/command-line/;
+    downloadPage = https://app-updates.agilebits.com/product_history/CLI;
+    maintainers  = with maintainers; [ joelburget ];
+    license      = licenses.unfree;
+    platforms    = [ "i686-linux" "x86_64-linux" "x86_64-darwin" ];
  };
 }
--- a/pkgs/applications/misc/memo/default.nix
+++ b/pkgs/applications/misc/memo/default.nix
@ -8,13 +8,13 @@ stdenv.mkDerivation rec {

  name = "memo-${version}";

-  version = "0.4";
+  version = "0.5";

  src = fetchFromGitHub {
    owner  = "mrVanDalo";
    repo   = "memo";
    rev    = "${version}";
-    sha256 = "06999nps46dxrjakvpin1d2zvfpjil69hb3bxagq29icalag3y2z";
+    sha256 = "1kq8hmq4lgvkk717nhmdryr90g61xm0jm7y8dzya8jsxsn531gm8";
  };

  installPhase = let
@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
    else
      "#pandoc_cmd=pandoc";
  in ''
-    mkdir -p $out/{bin,share/man/man1,share/bash-completion/completions}
+    mkdir -p $out/{bin,share/man/man1,share/bash-completion/completions,share/zsh/site-functions}
    substituteInPlace memo \
      --replace "ack_cmd=ack"       "ack_cmd=${silver-searcher}/bin/ag" \
      --replace "tree_cmd=tree"     "tree_cmd=${tree}/bin/tree" \
@ -31,7 +31,8 @@ stdenv.mkDerivation rec {
      --replace "pandoc_cmd=pandoc" "${pandocReplacement}"
    mv memo $out/bin/
    mv doc/memo.1 $out/share/man/man1/memo.1
-    mv completion/memo.bash $out/share/bash-completion/completions/memo.sh
+    mv completion/bash/memo.sh $out/share/bash-completion/completions/memo.sh
+    mv completion/zsh/_memo    $out/share/zsh/site-functions/_memo
  '';

  meta = {
--- a/pkgs/applications/misc/termite/default.nix
+++ b/pkgs/applications/misc/termite/default.nix
@ -1,55 +1,42 @@
-{ stdenv, fetchFromGitHub, lib, pkgconfig, vte, gtk3, ncurses, makeWrapper, wrapGAppsHook, symlinkJoin
-, configFile ? null
-}:
+{ stdenv, fetchFromGitHub, pkgconfig, vte, gtk3, ncurses, wrapGAppsHook }:

-let
+stdenv.mkDerivation rec {
+  name = "termite-${version}";
  version = "13";
-  termite = stdenv.mkDerivation {
-    name = "termite-${version}";

-    src = fetchFromGitHub {
-      owner = "thestinger";
-      repo = "termite";
-      rev = "v${version}";
-      sha256 = "02cn70ygl93ghhkhs3xdxn5b1yadc255v3yp8cmhhyzsv5027hvj";
-      fetchSubmodules = true;
-    };
-
-    # https://github.com/thestinger/termite/pull/516
-    patches = [ ./url_regexp_trailing.patch ./add_errno_header.patch
-                ] ++ lib.optional stdenv.isDarwin ./remove_ldflags_macos.patch;
-
-    makeFlags = [ "VERSION=v${version}" "PREFIX=" "DESTDIR=$(out)" ];
-
-    buildInputs = [ vte gtk3 ncurses ];
-
-    nativeBuildInputs = [ wrapGAppsHook pkgconfig ];
-
-    outputs = [ "out" "terminfo" ];
-
-    postInstall = ''
-      mkdir -p $terminfo/share
-      mv $out/share/terminfo $terminfo/share/terminfo
-
-      mkdir -p $out/nix-support
-      echo "$terminfo" >> $out/nix-support/propagated-user-env-packages
-    '';
-
-    meta = with stdenv.lib; {
-      description = "A simple VTE-based terminal";
-      license = licenses.lgpl2Plus;
-      homepage = https://github.com/thestinger/termite/;
-      maintainers = with maintainers; [ koral garbas ];
-      platforms = platforms.all;
-    };
+  src = fetchFromGitHub {
+    owner = "thestinger";
+    repo = "termite";
+    rev = "v${version}";
+    sha256 = "02cn70ygl93ghhkhs3xdxn5b1yadc255v3yp8cmhhyzsv5027hvj";
+    fetchSubmodules = true;
  };
-in if configFile == null then termite else symlinkJoin {
-  name = "termite-with-config-${version}";
-  paths = [ termite ];
-  nativeBuildInputs = [ makeWrapper ];
-  postBuild = ''
-    wrapProgram $out/bin/termite \
-      --add-flags "--config ${configFile}"
+
+  # https://github.com/thestinger/termite/pull/516
+  patches = [ ./url_regexp_trailing.patch ./add_errno_header.patch
+              ] ++ stdenv.lib.optional stdenv.isDarwin ./remove_ldflags_macos.patch;
+
+  makeFlags = [ "VERSION=v${version}" "PREFIX=" "DESTDIR=$(out)" ];
+
+  buildInputs = [ vte gtk3 ncurses ];
+
+  nativeBuildInputs = [ wrapGAppsHook pkgconfig ];
+
+  outputs = [ "out" "terminfo" ];
+
+  postInstall = ''
+    mkdir -p $terminfo/share
+    mv $out/share/terminfo $terminfo/share/terminfo
+
+    mkdir -p $out/nix-support
+    echo "$terminfo" >> $out/nix-support/propagated-user-env-packages
  '';
-  passthru.terminfo = termite.terminfo;
+
+  meta = with stdenv.lib; {
+    description = "A simple VTE-based terminal";
+    license = licenses.lgpl2Plus;
+    homepage = https://github.com/thestinger/termite/;
+    maintainers = with maintainers; [ koral garbas ];
+    platforms = platforms.all;
+  };
 }
--- a/pkgs/applications/misc/termite/wrapper.nix
+++ b/pkgs/applications/misc/termite/wrapper.nix
@ -0,0 +1,15 @@
+{  makeWrapper, wrapGAppsHook, symlinkJoin, configFile ? null, termite }:
+
+if configFile == null then termite else symlinkJoin {
+  name = "termite-with-config-${termite.version}";
+
+  paths = [ termite ];
+  nativeBuildInputs = [ makeWrapper ];
+
+  postBuild = ''
+    wrapProgram $out/bin/termite \
+      --add-flags "--config ${configFile}"
+  '';
+
+  passthru.terminfo = termite.terminfo;
+}
--- a/pkgs/applications/science/electronics/kicad/default.nix
+++ b/pkgs/applications/science/electronics/kicad/default.nix
@ -1,72 +1,73 @@
-{ stdenv, fetchurl, cmake, libGLU_combined, wxGTK, zlib, libX11, gettext, glew, cairo, curl, openssl, boost, pkgconfig, doxygen }:
+{ wxGTK, lib, stdenv, fetchurl, cmake, libGLU_combined, zlib
+, libX11, gettext, glew, glm, cairo, curl, openssl, boost, pkgconfig
+, doxygen, pcre, libpthreadstubs, libXdmcp
+, wrapGAppsHook
+, oceSupport ? true, opencascade
+, ngspiceSupport ? true, libngspice
+, swig, python, pythonPackages
+}:

+assert ngspiceSupport -> libngspice != null;
+
+with lib;
 stdenv.mkDerivation rec {
  name = "kicad-${version}";
-  series = "4.0";
-  version = "4.0.7";
+  series = "5.0";
+  version = "5.0.0";

-  srcs = [
-    (fetchurl {
-      url = "https://code.launchpad.net/kicad/${series}/${version}/+download/kicad-${version}.tar.xz";
-      sha256 = "1hgxan9321szgyqnkflb0q60yjf4yvbcc4cpwhm0yz89qrvlq1q9";
-    })
+  src = fetchurl {
+    url = "https://launchpad.net/kicad/${series}/${version}/+download/kicad-${version}.tar.xz";
+    sha256 = "17nqjszyvd25wi6550j981whlnb1wxzmlanljdjihiki53j84x9p";
+  };

-    (fetchurl {
-      url = "http://downloads.kicad-pcb.org/libraries/kicad-library-${version}.tar.gz";
-      sha256 = "1azb7v1y3l6j329r9gg7f4zlg0wz8nh4s4i5i0l9s4yh9r6i9zmv";
-    })
+  postPatch = ''
+    substituteInPlace CMakeModules/KiCadVersion.cmake \
+      --replace no-vcs-found ${version}
+  '';

-    (fetchurl {
-      url = "http://downloads.kicad-pcb.org/libraries/kicad-footprints-${version}.tar.gz";
-      sha256 = "08qrz5zzsb5127jlnv24j0sgiryd5nqwg3lfnwi8j9a25agqk13j";
-    })
+  cmakeFlags = [
+    "-DKICAD_SCRIPTING=ON"
+    "-DKICAD_SCRIPTING_MODULES=ON"
+    "-DKICAD_SCRIPTING_WXPYTHON=ON"
+    # nix installs wxPython headers in wxPython package, not in wxwidget
+    # as assumed. We explicitely set the header location.
+    "-DCMAKE_CXX_FLAGS=-I${pythonPackages.wxPython}/include/wx-3.0"
+  ] ++ optionals (oceSupport) [ "-DKICAD_USE_OCE=ON" "-DOCE_DIR=${opencascade}" ]
+    ++ optional (ngspiceSupport) "-DKICAD_SPICE=ON";
+
+  nativeBuildInputs = [
+    # https://www.mail-archive.com/kicad-developers@lists.launchpad.net/msg29840.html
+    (cmake.override {majorVersion = "3.10";})
+    doxygen
+    pkgconfig
+    wrapGAppsHook
+    pythonPackages.wrapPython
  ];
+  pythonPath = [ pythonPackages.wxPython ];
+  propagatedBuildInputs = [ pythonPackages.wxPython ];

-  sourceRoot = "kicad-${version}";
+  buildInputs = [
+    libGLU_combined zlib libX11 wxGTK pcre libXdmcp gettext glew glm libpthreadstubs
+    cairo curl openssl boost
+    swig python
+  ] ++ optional (oceSupport) opencascade
+    ++ optional (ngspiceSupport) libngspice;

-  cmakeFlags = ''
-    -DKICAD_SKIP_BOOST=ON
-    -DKICAD_BUILD_VERSION=${version}
-    -DKICAD_REPO_NAME=stable
+  # this breaks other applications in kicad
+  dontWrapGApps = true;
+
+  preFixup = ''
+    buildPythonPath "$out $pythonPath"
+    gappsWrapperArgs+=(--set PYTHONPATH "$program_PYTHONPATH")
+
+    wrapProgram "$out/bin/kicad" "''${gappsWrapperArgs[@]}"
  '';

-  enableParallelBuilding = true; # often fails on Hydra: fatal error: pcb_plot_params_lexer.h: No such file or directory
-
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ cmake libGLU_combined wxGTK zlib libX11 gettext glew cairo curl openssl boost doxygen ];
-
-  # They say they only support installs to /usr or /usr/local,
-  # so we have to handle this.
-  patchPhase = ''
-    sed -i -e 's,/usr/local/kicad,'$out,g common/gestfich.cpp
-  '';
-
-  postUnpack = ''
-    pushd $(pwd)
-  '';
-
-  postInstall = ''
-    popd
-
-    pushd kicad-library-*
-    cmake -DCMAKE_INSTALL_PREFIX=$out
-    make $MAKE_FLAGS
-    make install
-    popd
-
-    pushd kicad-footprints-*
-    mkdir -p $out/share/kicad/modules
-    cp -R *.pretty $out/share/kicad/modules/
-    popd
-  '';
-
-
  meta = {
    description = "Free Software EDA Suite";
    homepage = http://www.kicad-pcb.org/;
-    license = stdenv.lib.licenses.gpl2;
-    maintainers = with stdenv.lib.maintainers; [viric];
-    platforms = with stdenv.lib.platforms; linux;
-    hydraPlatforms = []; # 'output limit exceeded' error on hydra
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ berce ];
+    platforms = with platforms; linux;
  };
 }
--- a/pkgs/applications/version-management/bazaar/CVE-2017-14176.patch
+++ b/pkgs/applications/version-management/bazaar/CVE-2017-14176.patch
@ -0,0 +1,149 @@
+diff --git a/bzrlib/tests/test_ssh_transport.py b/bzrlib/tests/test_ssh_transport.py
+index 9e37c3b..fe9f219 100644
+--- a/bzrlib/tests/test_ssh_transport.py
+++ b/bzrlib/tests/test_ssh_transport.py
+@@ -22,6 +22,7 @@ from bzrlib.transport.ssh import (
+     SSHCorpSubprocessVendor,
+     LSHSubprocessVendor,
+     SSHVendorManager,
+    StrangeHostname,
+     )
+ 
+ 
+@@ -161,6 +162,19 @@ class SSHVendorManagerTests(TestCase):
+ 
+ class SubprocessVendorsTests(TestCase):
+ 
+    def test_openssh_command_tricked(self):
+        vendor = OpenSSHSubprocessVendor()
+        self.assertEqual(
+            vendor._get_vendor_specific_argv(
+                "user", "-oProxyCommand=blah", 100, command=["bzr"]),
+            ["ssh", "-oForwardX11=no", "-oForwardAgent=no",
+                "-oClearAllForwardings=yes",
+                "-oNoHostAuthenticationForLocalhost=yes",
+                "-p", "100",
+                "-l", "user",
+                "--",
+                "-oProxyCommand=blah", "bzr"])
+
+     def test_openssh_command_arguments(self):
+         vendor = OpenSSHSubprocessVendor()
+         self.assertEqual(
+@@ -171,6 +185,7 @@ class SubprocessVendorsTests(TestCase):
+                 "-oNoHostAuthenticationForLocalhost=yes",
+                 "-p", "100",
+                 "-l", "user",
+                "--",
+                 "host", "bzr"]
+             )
+ 
+@@ -184,9 +199,16 @@ class SubprocessVendorsTests(TestCase):
+                 "-oNoHostAuthenticationForLocalhost=yes",
+                 "-p", "100",
+                 "-l", "user",
+-                "-s", "host", "sftp"]
+                "-s", "--", "host", "sftp"]
+             )
+ 
+    def test_openssh_command_tricked(self):
+        vendor = SSHCorpSubprocessVendor()
+        self.assertRaises(
+            StrangeHostname,
+            vendor._get_vendor_specific_argv,
+                "user", "-oProxyCommand=host", 100, command=["bzr"])
+
+     def test_sshcorp_command_arguments(self):
+         vendor = SSHCorpSubprocessVendor()
+         self.assertEqual(
+@@ -209,6 +231,13 @@ class SubprocessVendorsTests(TestCase):
+                 "-s", "sftp", "host"]
+             )
+ 
+    def test_lsh_command_tricked(self):
+        vendor = LSHSubprocessVendor()
+        self.assertRaises(
+            StrangeHostname,
+            vendor._get_vendor_specific_argv,
+                "user", "-oProxyCommand=host", 100, command=["bzr"])
+
+     def test_lsh_command_arguments(self):
+         vendor = LSHSubprocessVendor()
+         self.assertEqual(
+@@ -231,6 +260,13 @@ class SubprocessVendorsTests(TestCase):
+                 "--subsystem", "sftp", "host"]
+             )
+ 
+    def test_plink_command_tricked(self):
+        vendor = PLinkSubprocessVendor()
+        self.assertRaises(
+            StrangeHostname,
+            vendor._get_vendor_specific_argv,
+                "user", "-oProxyCommand=host", 100, command=["bzr"])
+
+     def test_plink_command_arguments(self):
+         vendor = PLinkSubprocessVendor()
+         self.assertEqual(
+diff --git a/bzrlib/transport/ssh.py b/bzrlib/transport/ssh.py
+index eecaa26..6f22341 100644
+--- a/bzrlib/transport/ssh.py
+++ b/bzrlib/transport/ssh.py
+@@ -46,6 +46,10 @@ else:
+     from paramiko.sftp_client import SFTPClient
+ 
+ 
+class StrangeHostname(errors.BzrError):
+    _fmt = "Refusing to connect to strange SSH hostname %(hostname)s"
+
+
+ SYSTEM_HOSTKEYS = {}
+ BZR_HOSTKEYS = {}
+ 
+@@ -360,6 +364,11 @@ class SubprocessVendor(SSHVendor):
+     # tests, but beware of using PIPE which may hang due to not being read.
+     _stderr_target = None
+ 
+    @staticmethod
+    def _check_hostname(arg):
+        if arg.startswith('-'):
+            raise StrangeHostname(hostname=arg)
+
+     def _connect(self, argv):
+         # Attempt to make a socketpair to use as stdin/stdout for the SSH
+         # subprocess.  We prefer sockets to pipes because they support
+@@ -424,9 +433,9 @@ class OpenSSHSubprocessVendor(SubprocessVendor):
+         if username is not None:
+             args.extend(['-l', username])
+         if subsystem is not None:
+-            args.extend(['-s', host, subsystem])
+            args.extend(['-s', '--', host, subsystem])
+         else:
+-            args.extend([host] + command)
+            args.extend(['--', host] + command)
+         return args
+ 
+ register_ssh_vendor('openssh', OpenSSHSubprocessVendor())
+@@ -439,6 +448,7 @@ class SSHCorpSubprocessVendor(SubprocessVendor):
+ 
+     def _get_vendor_specific_argv(self, username, host, port, subsystem=None,
+                                   command=None):
+        self._check_hostname(host)
+         args = [self.executable_path, '-x']
+         if port is not None:
+             args.extend(['-p', str(port)])
+@@ -460,6 +470,7 @@ class LSHSubprocessVendor(SubprocessVendor):
+ 
+     def _get_vendor_specific_argv(self, username, host, port, subsystem=None,
+                                   command=None):
+        self._check_hostname(host)
+         args = [self.executable_path]
+         if port is not None:
+             args.extend(['-p', str(port)])
+@@ -481,6 +492,7 @@ class PLinkSubprocessVendor(SubprocessVendor):
+ 
+     def _get_vendor_specific_argv(self, username, host, port, subsystem=None,
+                                   command=None):
+        self._check_hostname(host)
+         args = [self.executable_path, '-x', '-a', '-ssh', '-2', '-batch']
+         if port is not None:
+             args.extend(['-P', str(port)])
--- a/pkgs/applications/version-management/bazaar/default.nix
+++ b/pkgs/applications/version-management/bazaar/default.nix
@ -1,5 +1,4 @@
 { stdenv, fetchurl, python2Packages
-, fetchpatch
 , withSFTP ? true
 }:

@ -21,11 +20,7 @@ python2Packages.buildPythonApplication rec {
  patches = [
    # Bazaar can't find the certificates alone
    ./add_certificates.patch
-    (fetchpatch {
-      url = "https://bazaar.launchpad.net/~brz/brz/trunk/revision/6754";
-      sha256 = "0mdqa9w1p6cmli6976v4wi0sw9r4p5prkj7lzfd1877wk11c9c73";
-      name = "CVE-2017-14176.patch";
-    })
+    ./CVE-2017-14176.patch
  ];
  postPatch = ''
    substituteInPlace bzrlib/transport/http/_urllib2_wrappers.py \
--- a/pkgs/applications/version-management/git-and-tools/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/default.nix
@ -111,6 +111,8 @@ let

  hubUnstable = throw "use gitAndTools.hub instead";

+  pre-commit = callPackage ./pre-commit { };
+
  qgit = qt5.callPackage ./qgit { };

  stgit = callPackage ./stgit {
--- a/pkgs/applications/version-management/git-and-tools/pre-commit/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/pre-commit/default.nix
@ -0,0 +1,31 @@
+{ stdenv, python3Packages }:
+with python3Packages; buildPythonApplication rec {
+  pname = "pre_commit";
+  version = "1.10.4";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1kn8h9k9ca330m5n7r4cvxp679y3sc95m1x23a3qhzgam09n7jwr";
+  };
+
+  propagatedBuildInputs = [
+    aspy-yaml
+    cached-property
+    cfgv
+    identify
+    nodeenv
+    six
+    toml
+    virtualenv
+  ];
+
+  # Tests fail due to a missing windll dependency
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "A framework for managing and maintaining multi-language pre-commit hooks";
+    homepage = https://pre-commit.com/;
+    license = licenses.mit;
+    maintainers = with maintainers; [ borisbabic ];
+  };
+}
--- a/pkgs/applications/video/mpv/default.nix
+++ b/pkgs/applications/video/mpv/default.nix
@ -21,6 +21,7 @@
 , sdl2Support        ? true,  SDL2          ? null
 , alsaSupport        ? true,  alsaLib       ? null
 , screenSaverSupport ? true,  libXScrnSaver ? null
+, cmsSupport         ? true,  lcms2         ? null
 , vdpauSupport       ? true,  libvdpau      ? null
 , dvdreadSupport     ? true,  libdvdread    ? null
 , dvdnavSupport      ? true,  libdvdnav     ? null
@ -53,6 +54,7 @@ assert xvSupport          -> x11Support && available libXv;
 assert sdl2Support        -> available SDL2;
 assert alsaSupport        -> available alsaLib;
 assert screenSaverSupport -> available libXScrnSaver;
+assert cmsSupport         -> available lcms2;
 assert vdpauSupport       -> available libvdpau;
 assert dvdreadSupport     -> available libdvdread;
 assert dvdnavSupport      -> available libdvdnav;
@ -136,6 +138,7 @@ in stdenv.mkDerivation rec {
    ++ optional pulseSupport       libpulseaudio
    ++ optional rubberbandSupport  rubberband
    ++ optional screenSaverSupport libXScrnSaver
+    ++ optional cmsSupport        lcms2
    ++ optional vdpauSupport       libvdpau
    ++ optional speexSupport       speex
    ++ optional bs2bSupport        libbs2b
--- a/pkgs/applications/window-managers/stumpish/default.nix
+++ b/pkgs/applications/window-managers/stumpish/default.nix
@ -0,0 +1,44 @@
+{ stdenv, substituteAll, fetchurl, fetchFromGitHub, bash, gnused, ncurses, xorg, rlwrap }:
+
+stdenv.mkDerivation rec {
+  pname = "stumpish";
+  version = "0.0.1";
+  name = "${pname}-${version}";
+
+  src = fetchFromGitHub {
+    owner = "stumpwm";
+    repo = "stumpwm-contrib";
+    rev = "9f5f06652c480159ec57d1fd8751b16f02db06dc";
+    sha256 = "1dxzsnir3158p8y2128s08r9ca0ywr9mcznivmhn1lycw8mg4nfl";
+  };
+
+  buildInputs = [
+    gnused xorg.xprop rlwrap ncurses
+  ];
+
+  patches = [
+    (substituteAll {
+      src = ./paths.patch;
+      sed = "${gnused}/bin/sed";
+      xprop = "${xorg.xprop}/bin/xprop";
+      rlwrap = "${rlwrap}/bin/rlwrap";
+      tput = "${ncurses}/bin/tput";
+    })
+  ];
+
+  buildPhase = ''
+    mkdir -p $out/bin
+  '';
+
+  installPhase = ''
+    cp util/stumpish/stumpish $out/bin
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/stumpwm/stumpwm-contrib;
+    description = "STUMPwm Interactive SHell";
+    license = licenses.gpl2;
+    maintainers = [ maintainers.ebzzry ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/applications/window-managers/stumpish/paths.patch
+++ b/pkgs/applications/window-managers/stumpish/paths.patch
@ -0,0 +1,87 @@
+diff --git a/util/stumpish/stumpish b/util/stumpish/stumpish
+index 830cb1b..64213dc 100755
+--- a/util/stumpish/stumpish
+++ b/util/stumpish/stumpish
+@@ -28,8 +28,8 @@ then
+ fi
+ 
+ # replace -E with -r option for old versions of GNU sed
+-if ! sed -E 1p /dev/null 2>/dev/null; then
+-    sed() { shift; command sed -r "$@"; }
+if ! @sed@ -E 1p /dev/null 2>/dev/null; then
+    sed() { shift; command @sed@ -r "$@"; }
+ fi
+ 
+ # parse C-style backslash sequences by default
+@@ -41,9 +41,9 @@ wait_result ()
+ {
+     while true
+     do
+-	RESULT=$(xprop -root -f STUMPWM_COMMAND_RESULT 8s \
+	RESULT=$(@xprop@ -root -f STUMPWM_COMMAND_RESULT 8s \
+ 	    STUMPWM_COMMAND_RESULT 2>/dev/null |
+-	    sed -E 's/\\([[:digit:]]+)/\\0\1/g')
+	    @sed@ -E 's/\\([[:digit:]]+)/\\0\1/g')
+ 	if echo "$RESULT" | grep -v -q 'not found.$'
+ 	then
+ 	    break
+@@ -52,7 +52,7 @@ wait_result ()
+ 	sleep $DELAY
+     done
+ 
+-    xprop -root -remove STUMPWM_COMMAND_RESULT
+    @xprop@ -root -remove STUMPWM_COMMAND_RESULT
+ 
+     if echo "$RESULT" | grep -q '= $'
+     then
+@@ -60,7 +60,7 @@ wait_result ()
+     fi
+ 
+     echo "$RESULT" |
+-    sed -E 's/[^"\\n]+"//
+    @sed@ -E 's/[^"\\n]+"//
+             /^"[[:space:]]*$/d
+             s/(^|[^\\])\\n/\1\
+ /g
+@@ -80,7 +80,7 @@ send_cmd ()
+ 	exit
+     fi
+ 
+-    xprop -root -f STUMPWM_COMMAND 8s -set STUMPWM_COMMAND "$cmd"
+    @xprop@ -root -f STUMPWM_COMMAND 8s -set STUMPWM_COMMAND "$cmd"
+ 
+     wait_result
+ }
+@@ -123,8 +123,8 @@ tput ()
+     local cap1=$1 cap2=$2
+     shift 2
+ 
+-    command tput $cap1 $@ 2>/dev/null ||
+-    command tput $cap2 $@ 2>/dev/null
+    command @tput@ $cap1 $@ 2>/dev/null ||
+    command @tput@ $cap2 $@ 2>/dev/null
+ }
+ 
+ READLINE=yes
+@@ -156,18 +156,18 @@ then
+ else
+     if [ -t 0 ]
+     then
+-	if ! type rlwrap 2>/dev/null >&2
+	if ! type @rlwrap@ 2>/dev/null >&2
+ 	then
+ 	    warn rlwrap not found, command completion won\'t work
+ 	elif [ $READLINE = yes ]
+ 	then
+ 	    COMMANDS="${TMPDIR:-/tmp}/stumpish.commands.$$"
+ 	    echo $(send_cmd "commands") |
+-	    sed -E 's/[[:space:]]+/\
+	    @sed@ -E 's/[[:space:]]+/\
+ /g' |
+ 	    sort > "$COMMANDS"
+ 	    trap 'rm -f "$COMMANDS"' exit int term
+-	    rlwrap -b '' -f "$COMMANDS" "$0" -r
+	    @rlwrap@ -b '' -f "$COMMANDS" "$0" -r
+ 	    exit
+ 	fi
+ 
--- a/pkgs/data/fonts/ia-writer-duospace/default.nix
+++ b/pkgs/data/fonts/ia-writer-duospace/default.nix
@ -0,0 +1,26 @@
+{ lib, fetchFromGitHub }:
+
+let
+  version = "20180721";
+in fetchFromGitHub rec {
+  name = "ia-writer-duospace-${version}";
+
+  owner = "iaolo";
+  repo = "iA-Fonts";
+  rev = "55edf60f544078ab1e14987bc67e9029a200e0eb";
+  sha256 = "0932lcxf861vb3hz52z1xj8r99ag9sdyqsnq9brv7gc4kp2l339c";
+
+  postFetch = ''
+    tar --strip-components=1 -xzvf $downloadedFile
+    mkdir -p $out/share/fonts/opentype
+    cp "iA Writer Duospace/OTF (Mac)/"*.otf $out/share/fonts/opentype/
+  '';
+
+  meta = with lib; {
+    description = "iA Writer Duospace Typeface";
+    homepage = https://ia.net/topics/in-search-of-the-perfect-writing-font;
+    license = licenses.ofl;
+    platforms = platforms.all;
+    maintainers = [ maintainers.marsam ];
+  };
+}
--- a/pkgs/data/fonts/inriafonts/default.nix
+++ b/pkgs/data/fonts/inriafonts/default.nix
@ -0,0 +1,40 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+
+  pname = "inriafonts";
+  version = "1.200";
+  name = "${pname}-${version}";
+
+src = fetchFromGitHub {
+  owner = "BlackFoundry";
+  repo = "InriaFonts";
+  rev = "v${version}";
+  sha256 = "06775y99lyh6hj5hzvrx56iybdck8a8xfqkipqd5c4cldg0a9hh8";
+};
+
+installPhase = ''
+  mkdir -p $out/share/fonts/truetype
+  cp fonts/*/TTF/*.ttf $out/share/fonts/truetype
+  mkdir -p $out/share/fonts/opentype
+  cp fonts/*/OTF/*.otf $out/share/fonts/opentype
+'';
+
+  meta = with stdenv.lib; {
+    homepage = https://black-foundry.com/work/inria;
+    description = "Inria Sans and Inria Serif";
+    longDescription = ''
+      Inria Sans and Inria Serif are the two members of a type family
+      design for the communication of Inria, the French national institute
+      dedicated to numeric research. The Institut needed a font
+      showing its values at the crossroad of humanity, technology,
+      excellence and creativity. Black[Foudry] created a humanist
+      typeface with a unapologetically contemporary design as the
+      Sans-serif part and a more rational axis and drawing for the
+      serif. Both members comes in 3 weights with matching italics.
+      '';
+    license = licenses.ofl;
+    maintainers = with maintainers; [ leenaars ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/data/fonts/sarasa-gothic/default.nix
+++ b/pkgs/data/fonts/sarasa-gothic/default.nix
@ -1,12 +1,12 @@
 { stdenv, fetchurl, p7zip }:

 stdenv.mkDerivation rec {
-  version = "0.5.2";
+  version = "0.6.0";
  name = "sarasa-gothic-${version}";

  package = fetchurl {
    url = "https://github.com/be5invis/Sarasa-Gothic/releases/download/v${version}/sarasa-gothic-ttf-${version}.7z";
-    sha256 = "18ycw57k7yhrbb8njzhzk6x32xnjal61wr48qxkqy4lh9zfy0p22";
+    sha256 = "00kyx03lpgycxaw0cyx96hhrx8gwkcmy3qs35q7r09y60vg5i0nv";
  };

  nativeBuildInputs = [ p7zip ];
--- a/pkgs/data/icons/capitaine-cursors/default.nix
+++ b/pkgs/data/icons/capitaine-cursors/default.nix
@ -0,0 +1,45 @@
+{ stdenv, fetchFromGitHub
+, inkscape, xcursorgen }:
+
+stdenv.mkDerivation rec {
+  name = "capitaine-cursors-${version}";
+  version = "2.1";
+
+  src = fetchFromGitHub {
+    owner = "keeferrourke";
+    repo = "capitaine-cursors";
+    rev = "r${version}";
+    sha256 = "0ljvq1dqscp5gyf23qszn2ax80bxkqw2vx5zh3qln9vnzfascirb";
+  };
+
+  postPatch = ''
+    patchShebangs .
+  '';
+
+  buildInputs  =[
+    inkscape
+    xcursorgen
+  ];
+
+  buildPhase = ''
+    # https://github.com/NixOS/nixpkgs/blob/master/pkgs/data/fonts/emojione/default.nix#L16
+    HOME="$NIX_BUILD_ROOT" ./build.sh
+  '';
+
+  installPhase = ''
+    install -dm 0755 $out/share/icons
+    cp -pr dist $out/share/icons/capitaine-cursors
+  '';
+
+  meta = with stdenv.lib; {
+    description = ''
+      An x-cursor theme inspired by macOS and based on KDE Breeze
+    '';
+    homepage = https://github.com/keeferrourke/capitaine-cursors;
+    license = licenses.lgpl3;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [
+      eadwu
+    ];
+  };
+}
--- a/pkgs/desktops/gnome-3/apps/evolution/default.nix
+++ b/pkgs/desktops/gnome-3/apps/evolution/default.nix
@ -5,13 +5,13 @@
 , libcanberra-gtk3, bogofilter, gst_all_1, procps, p11-kit, openldap }:

 let
-  version = "3.28.3";
+  version = "3.28.5";
 in stdenv.mkDerivation rec {
  name = "evolution-${version}";

  src = fetchurl {
    url = "mirror://gnome/sources/evolution/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "1s1vlznc22q1f8fm8fhggi8xak52b6n952s562f3kpv6g0dm2x6k";
+    sha256 = "1q1nfga39f44knrcvcxk8ivhl6fvg92g71cq3hcp4a7krb3jwa5v";
  };

  propagatedUserEnvPkgs = [ gnome3.evolution-data-server ];
--- a/pkgs/desktops/gnome-3/apps/file-roller/default.nix
+++ b/pkgs/desktops/gnome-3/apps/file-roller/default.nix
@ -3,11 +3,11 @@

 stdenv.mkDerivation rec {
  name = "file-roller-${version}";
-  version = "3.28.0";
+  version = "3.28.1";

  src = fetchurl {
    url = "mirror://gnome/sources/file-roller/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "15pn2m80x45bzibig4zrqybnbr0n1f9wpqx7f2p6difldns3jwf1";
+    sha256 = "09y2blmlsccfxc2npcayhicq00r9n03897s1aizkahn1m970hjsp";
  };

  LANG = "en_US.UTF-8"; # postinstall.py
--- a/pkgs/desktops/gnome-3/apps/polari/default.nix
+++ b/pkgs/desktops/gnome-3/apps/polari/default.nix
@ -5,13 +5,13 @@

 let
  pname = "polari";
-  version = "3.28.0";
+  version = "3.28.1";
 in stdenv.mkDerivation rec {
  name = "${pname}-${version}";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "08zgdqrnxl752nv0gac1k7wvjd4j7h5n4c0flrq7q337p40k3dd5";
+    sha256 = "1066j1lbrkpcxhvrg3gcv7gv8dzqv5ny9qi9dnm8r1dsx2hil9yc";
  };

  propagatedUserEnvPkgs = [ telepathy-idle telepathy-logger ];
--- a/pkgs/desktops/gnome-3/core/eog/default.nix
+++ b/pkgs/desktops/gnome-3/core/eog/default.nix
@ -4,13 +4,13 @@

 let
  pname = "eog";
-  version = "3.28.2";
+  version = "3.28.3";
 in stdenv.mkDerivation rec {
  name = "${pname}-${version}";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "1gasrfqi7qrzdq1idh29r0n6ikkqjb6pbp7a8k5krfz5hkhyfin0";
+    sha256 = "1lj8v9m8jdxc3d4nzmgrxcccddg3hh8lkbmz4g71yxa0ykxxvbip";
  };

  nativeBuildInputs = [ meson ninja pkgconfig gettext itstool wrapGAppsHook libxml2 gobjectIntrospection ];
--- a/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix
+++ b/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix
@ -5,13 +5,13 @@

 stdenv.mkDerivation rec {
  name = "evolution-data-server-${version}";
-  version = "3.28.3";
+  version = "3.28.5";

  outputs = [ "out" "dev" ];

  src = fetchurl {
    url = "mirror://gnome/sources/evolution-data-server/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "11sq795115vrcgxl9svscm6wg8isjj784c3d84qzb6z47zq92zj3";
+    sha256 = "1247gv0ggwnd1i2n7iglb3crfapx6s9nrl896bzy9k87fb94hlyr";
  };

  patches = [
--- a/pkgs/desktops/gnome-3/core/gnome-bluetooth/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-bluetooth/default.nix
@ -3,11 +3,11 @@

 stdenv.mkDerivation rec {
  name = "gnome-bluetooth-${version}";
-  version = "3.28.0";
+  version = "3.28.1";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-bluetooth/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "0q7yzklrlayj99risj096mr5x35anx94wvr6nbf6pwbvvzv7453p";
+    sha256 = "1g3yrq5792qvc5rxnf26cgciawrca27hqn6wxfcf63bpa2dsjcsn";
  };

  passthru = {
--- a/pkgs/desktops/gnome-3/core/gnome-shell/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-shell/default.nix
@ -13,11 +13,11 @@ let

 in stdenv.mkDerivation rec {
  name = "gnome-shell-${version}";
-  version = "3.28.2";
+  version = "3.28.3";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-shell/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "1b9n89ij2g5nqaqp7a13jnqcd8qa2v9p55rbi71al3xvqk091ri7";
+    sha256 = "0xm2a8inj2zkrpgkhy69rbqh44q62gpwm4javzbvvvgx0srza90w";
  };

  # Needed to find /etc/NetworkManager/VPN
--- a/pkgs/desktops/gnome-3/core/grilo-plugins/default.nix
+++ b/pkgs/desktops/gnome-3/core/grilo-plugins/default.nix
@ -4,14 +4,14 @@

 let
  pname = "grilo-plugins";
-  version = "0.3.5";
+  version = "0.3.7";
  major = gnome3.versionBranch version;
 in stdenv.mkDerivation rec {
  name = "${pname}-${version}";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${major}/${name}.tar.xz";
-    sha256 = "1yv8a0mfd5qmdbdrnd0is5c51s1mvibhw61na99iagnbirxq4xr9";
+    sha256 = "0838mm7sdfwsiw022rjb27dlbbxncpx5jrpv3qzfadli66y3nbzw";
  };

  installFlags = [ "GRL_PLUGINS_DIR=$(out)/lib/grilo-${major}" ];
--- a/pkgs/desktops/gnome-3/core/grilo/default.nix
+++ b/pkgs/desktops/gnome-3/core/grilo/default.nix
@ -4,7 +4,7 @@

 let
  pname = "grilo";
-  version = "0.3.4"; # if you change minor, also change ./setup-hook.sh
+  version = "0.3.6"; # if you change minor, also change ./setup-hook.sh
 in stdenv.mkDerivation rec {
  name = "${pname}-${version}";

@ -13,7 +13,7 @@ in stdenv.mkDerivation rec {

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "0vh67gja6yn7czh77ssmx6ncp99fl2926pbi2hplqms27c2n8sbw";
+    sha256 = "14cwpk9jxi8rfjcmkav37zf0m52b1lqpkpkz858h80jqvn1clr8y";
  };

  setupHook = ./setup-hook.sh;
--- a/pkgs/desktops/gnome-3/core/mutter/default.nix
+++ b/pkgs/desktops/gnome-3/core/mutter/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  name = "mutter-${version}";
-  version = "3.28.2";
+  version = "3.28.3";

  src = fetchurl {
    url = "mirror://gnome/sources/mutter/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "0ighs1zvlssgq16v1h3vg280za7y448snq65gc5m1zmqqawqkymg";
+    sha256 = "0vq3rmq20d6b1mi6sf67wkzqys6hw5j7n7fd4hndcp19d5i26149";
  };

  passthru = {
--- a/pkgs/desktops/gnome-3/core/totem/default.nix
+++ b/pkgs/desktops/gnome-3/core/totem/default.nix
@ -6,11 +6,11 @@

 stdenv.mkDerivation rec {
  name = "totem-${version}";
-  version = "3.26.1";
+  version = "3.26.2";

  src = fetchurl {
    url = "mirror://gnome/sources/totem/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "10n302fdp3lhkzbij5sbzmsnln738029xil6cnng2d4dxv4n1099";
+    sha256 = "1llyisls3pzf5bwkpxyfyxc2d3gpa09n5pjy7qsjdqrp3ya4k36g";
  };

  doCheck = true;
--- a/pkgs/desktops/plasma-5/plasma-nm/0001-mobile-broadband-provider-info-path.patch
+++ b/pkgs/desktops/plasma-5/plasma-nm/0001-mobile-broadband-provider-info-path.patch
@ -16,7 +16,7 @@ index 568cb34..98a5992 100644
 #include <KLocale>
 
 -const QString MobileProviders::ProvidersFile = "/usr/share/mobile-broadband-provider-info/serviceproviders.xml";
-+const QString MobileProviders::ProvidersFile = "@mobile-broadband-provider-info@/share/mobile-broadband-provider-info/serviceproviders.xml";
+const QString MobileProviders::ProvidersFile = "@mobile_broadband_provider_info@/share/mobile-broadband-provider-info/serviceproviders.xml";
 
 bool localeAwareCompare(const QString & one, const QString & two) {
     return one.localeAwareCompare(two) < 0;
--- a/pkgs/desktops/plasma-5/plasma-nm/default.nix
+++ b/pkgs/desktops/plasma-5/plasma-nm/default.nix
@ -21,7 +21,7 @@ mkDerivation {
  patches = [
    (substituteAll {
      src = ./0001-mobile-broadband-provider-info-path.patch;
-      inherit mobile-broadband-provider-info;
+      mobile_broadband_provider_info = mobile-broadband-provider-info;
    })
    (substituteAll {
      src = ./0002-openvpn-binary-path.patch;
--- a/pkgs/desktops/xfce4-13/default.nix
+++ b/pkgs/desktops/xfce4-13/default.nix
@ -44,6 +44,8 @@ makeScope newScope (self: with self; {

  xfce4-appfinder = callPackage ./xfce4-appfinder { };

+  xfce4-battery-plugin = callPackage ./xfce4-battery-plugin { };
+
  xfce4-dev-tools = callPackage ./xfce4-dev-tools {
    mkXfceDerivation = mkXfceDerivation.override {
      xfce4-dev-tools = null;
--- a/pkgs/desktops/xfce4-13/mkXfceDerivation.nix
+++ b/pkgs/desktops/xfce4-13/mkXfceDerivation.nix
@ -1,6 +1,6 @@
-{ stdenv, fetchgit, pkgconfig, xfce4-dev-tools ? null }:
+{ stdenv, fetchgit, pkgconfig, xfce4-dev-tools, hicolor-icon-theme }:

-{ category, pname, sha256 ? null, version, ... } @ args:
+{ category, pname, version, rev ? "${pname}-${version}", sha256, ... } @ args:

 let
  inherit (builtins) filter getAttr head isList;
@ -16,12 +16,12 @@ let
    name = "${pname}-${version}";

    nativeBuildInputs = [ pkgconfig xfce4-dev-tools ];
+    buildInputs = [ hicolor-icon-theme ];
    configureFlags = [ "--enable-maintainer-mode" ];

    src = fetchgit {
      url = "git://git.xfce.org/${category}/${pname}";
-      rev = name;
-      inherit sha256;
+      inherit rev sha256;
    };

    enableParallelBuilding = true;
--- a/pkgs/desktops/xfce4-13/xfce4-battery-plugin/default.nix
+++ b/pkgs/desktops/xfce4-13/xfce4-battery-plugin/default.nix
@ -0,0 +1,11 @@
+{ mkXfceDerivation, gtk3, libxfce4ui, libxfce4util, xfce4-panel, xfconf }:
+
+mkXfceDerivation rec {
+  category = "panel-plugins";
+  pname = "xfce4-battery-plugin";
+  version = "1.1.0";
+  rev = version;
+  sha256 = "0mz0lj3wjrsj9n4wcqrvv08430g38nkjbdimxdy8316n6bqgngfn";
+
+  buildInputs = [ gtk3 libxfce4ui libxfce4util xfce4-panel xfconf ];
+}
--- a/pkgs/development/compilers/crystal/default.nix
+++ b/pkgs/development/compilers/crystal/default.nix
@ -3,25 +3,25 @@

 stdenv.mkDerivation rec {
  name = "crystal-${version}";
-  version = "0.25.0";
+  version = "0.25.1";

  src = fetchurl {
    url = "https://github.com/crystal-lang/crystal/archive/${version}.tar.gz";
-    sha256 = "1pnx21ky6cqfyv6df4mmjnyd1yh1bvcqkdzq6f0mk0yrkcl57k3q";
+    sha256 = "1ikzly6vs28ilqvqm4kxzhqs8mp6l4l344rhak63dav7vv97nnlv";
  };

-  prebuiltName = "crystal-0.25.0-1";
+  prebuiltName = "crystal-0.25.1-1";
  prebuiltSrc = let arch = {
    "x86_64-linux" = "linux-x86_64";
    "i686-linux" = "linux-i686";
    "x86_64-darwin" = "darwin-x86_64";
  }."${stdenv.system}" or (throw "system ${stdenv.system} not supported");
  in fetchurl {
-    url = "https://github.com/crystal-lang/crystal/releases/download/0.25.0/${prebuiltName}-${arch}.tar.gz";
+    url = "https://github.com/crystal-lang/crystal/releases/download/0.25.1/${prebuiltName}-${arch}.tar.gz";
    sha256 = {
-      "x86_64-linux" = "1q006086pbbvhmscbjzzgbdq1jkppd4p4kl9z9fn9j6np8fhi8ms";
-      "i686-linux" = "074ndm9n0mzsa7dkl3chhf234l85msm99yjksa5980lyqynyrw1d";
-      "x86_64-darwin" = "006f2j5984dkp5lsq8kns5mkxbhj50syjvzqk9z931pxl92wc7iy";
+      "x86_64-linux" = "0zjmbvbhi11p7s99jmvb3pac6zzsr792bxcfanrx503fjxxafgll";
+      "i686-linux" = "0i0hgsq7xa53594blqw5qi6jrqja18spifmalg7df2mj3h13h3pz";
+      "x86_64-darwin" = "1h369hzis1cigxbb6fgpahyq4d13gfgjc6adf300zc38yh8rvyy0";
    }."${stdenv.system}";
  };

--- a/pkgs/development/compilers/edk2/default.nix
+++ b/pkgs/development/compilers/edk2/default.nix
@ -25,8 +25,8 @@ edk2 = stdenv.mkDerivation {
  patches = [
    (fetchpatch {
      name = "short-circuit-the-transfer-of-an-empty-S3_CONTEXT.patch";
-      url = "https://github.com/tianocore/edk2/commit/9e2a8e928995c3b1bb664b73fd59785055c6b5f6";
-      sha256 = "0mdqa9w1p6cmli6976v4wi0sw9r4p5prkj7lzfd1877wk11c9c73";
+      url = "https://github.com/tianocore/edk2/commit/9e2a8e928995c3b1bb664b73fd59785055c6b5f6.diff";
+      sha256 = "0x24npijhgpjpsn3n74wayf8qcbaj97vi4z2iyf4almavqq8qaz4";
    })
  ];

--- a/pkgs/development/compilers/halide/default.nix
+++ b/pkgs/development/compilers/halide/default.nix
@ -0,0 +1,64 @@
+{ llvmPackages, lib, fetchFromGitHub, cmake
+, libpng, libjpeg, mesa_noglu, eigen3_3, openblas
+}:
+
+let
+  version = "2018_02_15";
+
+in llvmPackages.stdenv.mkDerivation {
+
+  name = "halide-${builtins.replaceStrings ["_"] ["."] version}";
+
+  src = fetchFromGitHub {
+    owner = "halide";
+    repo = "Halide";
+    rev = "release_${version}";
+    sha256 = "14lmpbxydx7ii0pxds6rgq5vw4i6yfjsq0bai1l5wwpv1rnwmbxd";
+  };
+
+  patches = [ ./nix.patch ];
+
+  # clang fails to compile intermediate code because
+  # of unused "--gcc-toolchain" option
+  postPatch = ''
+    sed -i "s/-Werror//" src/CMakeLists.txt
+  '';
+
+  cmakeFlags = [ "-DWARNINGS_AS_ERRORS=OFF" ];
+
+  # To handle the lack of 'local' RPATH; required, as they call one of
+  # their built binaries requiring their libs, in the build process.
+  preBuild = ''
+    export LD_LIBRARY_PATH="$(pwd)/lib:$LD_LIBRARY_PATH"
+  '';
+
+  enableParallelBuilding = true;
+
+  # Note: only openblas and not atlas part of this Nix expression
+  # see pkgs/development/libraries/science/math/liblapack/3.5.0.nix
+  # to get a hint howto setup atlas instead of openblas
+  buildInputs = [ llvmPackages.llvm libpng libjpeg mesa_noglu eigen3_3 openblas ];
+
+  nativeBuildInputs = [ cmake ];
+
+  # No install target for cmake available.
+  # Calling install target in Makefile causes complete rebuild
+  # and the library rpath is broken, because libncursesw.so.6 is missing.
+  # Another way is using "make halide_archive", but the tarball is not easy
+  # to disassemble.
+  installPhase = ''
+    find
+    mkdir -p "$out/lib" "$out/bin"
+    cp bin/HalideTrace* "$out/bin"
+    cp lib/libHalide.so "$out/lib"
+    cp -r include "$out"
+  '';
+
+  meta = with lib; {
+    description = "C++ based language for image processing and computational photography";
+    homepage = "https://halide-lang.org";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.ck3d ];
+  };
+}
--- a/pkgs/development/compilers/halide/nix.patch
+++ b/pkgs/development/compilers/halide/nix.patch
@ -0,0 +1,55 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 40a685b7e..c452efd09 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -49,10 +49,10 @@ set(CMAKE_RUNTIME_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}/bin")
+
+ set(LLVM_VERSION "${LLVM_VERSION_MAJOR}${LLVM_VERSION_MINOR}")
+
+-file(TO_NATIVE_PATH "${LLVM_TOOLS_BINARY_DIR}/llvm-as${CMAKE_EXECUTABLE_SUFFIX}" LLVM_AS)
+-file(TO_NATIVE_PATH "${LLVM_TOOLS_BINARY_DIR}/llvm-nm${CMAKE_EXECUTABLE_SUFFIX}" LLVM_NM)
+-file(TO_NATIVE_PATH "${LLVM_TOOLS_BINARY_DIR}/clang${CMAKE_EXECUTABLE_SUFFIX}" CLANG)
+-file(TO_NATIVE_PATH "${LLVM_TOOLS_BINARY_DIR}/llvm-config${CMAKE_EXECUTABLE_SUFFIX}" LLVM_CONFIG)
+find_program(LLVM_AS llvm-as HINTS ${LLVM_TOOLS_BINARY_DIR})
+find_program(LLVM_NM llvm-nm HINTS ${LLVM_TOOLS_BINARY_DIR})
+find_program(CLANG clang HINTS ${LLVM_TOOLS_BINARY_DIR})
+find_program(LLVM_CONFIG llvm-config HINTS ${LLVM_TOOLS_BINARY_DIR})
+
+ # LLVM doesn't appear to expose --system-libs via its CMake interface,
+ # so we must shell out to llvm-config to find this info
+diff --git a/apps/linear_algebra/CMakeLists.txt b/apps/linear_algebra/CMakeLists.txt
+index 132c80e6a..36ce865f2 100644
+--- a/apps/linear_algebra/CMakeLists.txt
+++ b/apps/linear_algebra/CMakeLists.txt
+@@ -26,7 +26,7 @@ if (CBLAS_FOUND)
+   #  Atlas requires also linking against its provided libcblas for cblas symbols
+   set(ATLAS_EXTRA_LIBS cblas) # XXX fragile
+   set(OpenBLAS_EXTRA_LIBS)
+-  set(BLAS_VENDORS OpenBLAS ATLAS)
+  set(BLAS_VENDORS OpenBLAS)
+
+   # TODO
+   # there are more vendors we could add here that support the cblas interface
+@@ -41,6 +41,7 @@ if (CBLAS_FOUND)
+       message(STATUS " ${BLAS_VENDOR}: Missing")
+     else()
+       message(STATUS " ${BLAS_VENDOR}: Found")
+      set(BLAS_LIBRARIES "${BLAS_LIBRARIES}" CACHE FILEPATH "BLAS library to use")
+       list(APPEND BLAS_VENDORS ${NAME})
+     endif()
+   endforeach()
+diff --git a/apps/linear_algebra/tests/CMakeLists.txt b/apps/linear_algebra/tests/CMakeLists.txt
+index 4b95eb3bb..1daa97437 100644
+--- a/apps/linear_algebra/tests/CMakeLists.txt
+++ b/apps/linear_algebra/tests/CMakeLists.txt
+@@ -19,6 +19,6 @@ target_compile_options(test_halide_blas PRIVATE -Wno-unused-variable)
+ target_link_libraries(test_halide_blas
+   PRIVATE
+    halide_blas
+-   cblas # XXX fragile
+   ${BLAS_LIBRARIES}
+    Halide
+ )
+--
+2.15.0
+
--- a/pkgs/development/compilers/llvm/5/llvm.nix
+++ b/pkgs/development/compilers/llvm/5/llvm.nix
@ -129,7 +129,8 @@ in stdenv.mkDerivation (rec {
    ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${release_version}.dylib
  '';

-  doCheck = stdenv.isLinux && (!stdenv.isi686);
+  doCheck = stdenv.isLinux && (!stdenv.isi686)
+            && (stdenv.hostPlatform == stdenv.targetPlatform);

  checkTarget = "check-all";

--- a/pkgs/development/compilers/llvm/6/llvm.nix
+++ b/pkgs/development/compilers/llvm/6/llvm.nix
@ -130,7 +130,8 @@ in stdenv.mkDerivation (rec {
    ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${release_version}.dylib
  '';

-  doCheck = stdenv.isLinux && (!stdenv.isi686);
+  doCheck = stdenv.isLinux && (!stdenv.isi686)
+            && (stdenv.hostPlatform == stdenv.targetPlatform);

  checkTarget = "check-all";

--- a/pkgs/development/compilers/mint/crystal2nix.cr
+++ b/pkgs/development/compilers/mint/crystal2nix.cr
@ -7,7 +7,7 @@ end

 class ShardLock
  YAML.mapping(
-    version: String,
+    version: Float32,
    shards: Hash(String, Hash(String, String))
  )
 end
--- a/pkgs/development/compilers/mint/default.nix
+++ b/pkgs/development/compilers/mint/default.nix
@ -28,13 +28,13 @@ let
  };
 in
 stdenv.mkDerivation rec {
-  version = "0.1.0";
+  version = "0.2.0";
  name = "mint-${version}";
  src = fetchFromGitHub {
    owner = "mint-lang";
    repo = "mint";
-    rev = "0.1.0";
-    sha256 = "0n9lnkm2k8lv3wcw0jc7bcpgvcjyp3a8cywn0w7ipb22q8cl0n96";
+    rev = "0.2.0";
+    sha256 = "1ds9zrvbmnfy744i9ri6v4w37aw7ccmdxzxmy8l97h045hzz9cp3";
  };

  buildInputs = [ crystal zlib openssl duktape ];
--- a/pkgs/development/compilers/mint/shards.nix
+++ b/pkgs/development/compilers/mint/shards.nix
@ -2,8 +2,8 @@
  admiral = {
    owner = "jwaldrip";
    repo = "admiral.cr";
-    rev = "v1.6.1";
-    sha256 = "0y30b9b9rkz43afd3b9l24hs0r170qyc07r05kvydbv89376c53i";
+    rev = "v1.7.2";
+    sha256 = "1j2cr4p3d44848v0gfl97p9kw2dslscnb1piyb7b3374iy345i0k";
  };
  ameba = {
    owner = "veelenga";
@ -14,8 +14,14 @@
  baked_file_system = {
    owner = "schovi";
    repo = "baked_file_system";
-    rev = "e1447549d5ac0560720fae62179b2f2c62c9bfd1";
-    sha256 = "1fi6zag1a6h4xwrfizy01dls3hhraqw0cmpwj7rjv1qcddjgig5z";
+    rev = "24dbaf2180b872c0f0fc777b34e3759108959e6e";
+    sha256 = "01p7hzsvms9cywdgs0rcs6mxdi94491wk55823fw2vxv24hvxnvk";
+  };
+  diff = {
+    owner = "MakeNowJust";
+    repo = "crystal-diff";
+    rev = "51962dc36f9bbb1b926d557f7cb8993a6c73cc63";
+    sha256 = "1nwnsxm8srfw8jg0yfi2v19x6j3dadx62hq0xpxra40qcqz9dbnp";
  };
  duktape = {
    owner = "jessedoyle";
@ -23,11 +29,17 @@
    rev = "v0.14.1";
    sha256 = "0fkay3qspzych050xl8xjkrphmxpzaj0dcf9jl22xwz8cx1l89f1";
  };
+  exception_page = {
+    owner = "crystal-loot";
+    repo = "exception_page";
+    rev = "v0.1.1";
+    sha256 = "0pimjm64p21cjhp0jhcgdmbgisx7amk8hhbkcprkbr44bj6rv9ay";
+  };
  kemal = {
    owner = "kemalcr";
    repo = "kemal";
-    rev = "a5870e7d24e5ec75c956bcf3e4423f55a2c4ff78";
-    sha256 = "1f2bm4xmfg6zqs3a8744pbk1vx964flf17g1mj01yslfcnzxywal";
+    rev = "09bb1fcd4073a374b3a61c99e48e05a866b23c08";
+    sha256 = "0yyb59i897gr8cqjbf48d6s0znq68ibpxarxkxkgrqk7lbvrqqr7";
  };
  kilt = {
    owner = "jeromegn";
--- a/pkgs/development/interpreters/php/default.nix
+++ b/pkgs/development/interpreters/php/default.nix
@ -9,14 +9,13 @@
 with lib;

 let
-  php7 = versionAtLeast version "7.0";
  generic =
  { version
  , sha256
  , imapSupport ? config.php.imap or (!stdenv.isDarwin)
  , ldapSupport ? config.php.ldap or true
  , mhashSupport ? config.php.mhash or true
-  , mysqlSupport ? (config.php.mysql or true) && (!php7)
+  , mysqlSupport ? (config.php.mysql or true)
  , mysqlndSupport ? config.php.mysqlnd or true
  , mysqliSupport ? config.php.mysqli or true
  , pdo_mysqlSupport ? config.php.pdo_mysql or true
@ -26,7 +25,7 @@ let
  , bcmathSupport ? config.php.bcmath or true
  , socketsSupport ? config.php.sockets or true
  , curlSupport ? config.php.curl or true
-  , curlWrappersSupport ? (config.php.curlWrappers or true) && (!php7)
+  , curlWrappersSupport ? config.php.curlWrappers or true
  , gettextSupport ? config.php.gettext or true
  , pcntlSupport ? config.php.pcntl or true
  , postgresqlSupport ? config.php.postgresql or true
@ -47,7 +46,7 @@ let
  , ftpSupport ? config.php.ftp or true
  , fpmSupport ? config.php.fpm or true
  , gmpSupport ? config.php.gmp or true
-  , mssqlSupport ? (config.php.mssql or (!stdenv.isDarwin)) && (!php7)
+  , mssqlSupport ? config.php.mssql or (!stdenv.isDarwin)
  , ztsSupport ? config.php.zts or false
  , calendarSupport ? config.php.calendar or true
  , sodiumSupport ? (config.php.sodium or true) && (versionAtLeast version "7.2")
@ -207,7 +206,7 @@ let
        outputsToInstall = [ "out" "dev" ];
      };

-      patches = if !php7 then [ ./fix-paths.patch ] else [ ./fix-paths-php7.patch ];
+      patches = [ ./fix-paths-php7.patch ];

      postPatch = optional stdenv.isDarwin ''
        substituteInPlace configure --replace "-lstdc++" "-lc++"
@ -220,16 +219,6 @@ let
    };

 in {
-  php56 = generic {
-    version = "5.6.36";
-    sha256 = "0ahp9vk33dpsqgld0gg4npff67v0l39hs3wk5dm6h3lablzhwsk2";
-  };
-
-  php70 = generic {
-    version = "7.0.30";
-    sha256 = "0l0bhnlgxmfl7mrdykmxfl53simxsksdcnbg5ymqz6r31i03hgr1";
-  };
-
  php71 = generic {
    version = "7.1.20";
    sha256 = "0i8xd6p4zdg8fl6f0j430raanlshsshr3s3jlm72b0gvi1n4f6rs";
--- a/pkgs/development/interpreters/php/fix-paths.patch
+++ b/pkgs/development/interpreters/php/fix-paths.patch
@ -1,68 +0,0 @@
-diff -ru php-5.4.14/configure php-5.4.14-new/configure
--- php-5.4.14/configure	2013-04-10 09:53:26.000000000 +0200
-+++ php-5.4.14-new/configure	2013-04-22 17:13:55.039043622 +0200
-@@ -6513,7 +6513,7 @@
- 
-   case $host_alias in
-   *aix*)
-    APXS_LIBEXECDIR=`$APXS -q LIBEXECDIR`
-+    APXS_LIBEXECDIR="$prefix/modules"
-     EXTRA_LDFLAGS="$EXTRA_LDFLAGS -Wl,-brtl -Wl,-bI:$APXS_LIBEXECDIR/httpd.exp"
-     PHP_AIX_LDFLAGS="-Wl,-brtl"
-     build_type=shared
-@@ -6706,7 +6706,7 @@
-   if test "$?" != "0"; then
-     APACHE_INSTALL="$APXS -i -a -n php5 $SAPI_SHARED" # Old apxs does not have -S option
-   else
-    APXS_LIBEXECDIR='$(INSTALL_ROOT)'`$APXS -q LIBEXECDIR`
-+    APXS_LIBEXECDIR="$prefix/modules"
-     if test -z `$APXS -q SYSCONFDIR`; then
-       APACHE_INSTALL="\$(mkinstalldirs) '$APXS_LIBEXECDIR' && \
-                        $APXS -S LIBEXECDIR='$APXS_LIBEXECDIR' \
-@@ -7909,7 +7909,7 @@
-    { (exit 1); exit 1; }; }
-   fi
- 
-  APXS_LIBEXECDIR='$(INSTALL_ROOT)'`$APXS -q LIBEXECDIR`
-+  APXS_LIBEXECDIR="$prefix/modules"
-   if test -z `$APXS -q SYSCONFDIR`; then
-     INSTALL_IT="\$(mkinstalldirs) '$APXS_LIBEXECDIR' && \
-                  $APXS -S LIBEXECDIR='$APXS_LIBEXECDIR' \
-@@ -8779,7 +8779,7 @@
-    { (exit 1); exit 1; }; }
-   fi
- 
-  APXS_LIBEXECDIR='$(INSTALL_ROOT)'`$APXS -q LIBEXECDIR`
-+  APXS_LIBEXECDIR="$prefix/modules"
-   if test -z `$APXS -q SYSCONFDIR`; then
-     INSTALL_IT="\$(mkinstalldirs) '$APXS_LIBEXECDIR' && \
-                  $APXS -S LIBEXECDIR='$APXS_LIBEXECDIR' \
-@@ -9634,7 +9634,7 @@
- 
-   case $host_alias in
-   *aix*)
-    APXS_LIBEXECDIR=`$APXS -q LIBEXECDIR`
-+    APXS_LIBEXECDIR="$prefix/modules"
-     EXTRA_LDFLAGS="$EXTRA_LDFLAGS -Wl,-brtl -Wl,-bI:$APXS_LIBEXECDIR/httpd.exp"
-     PHP_AIX_LDFLAGS="-Wl,-brtl"
-     build_type=shared
-@@ -9827,7 +9827,7 @@
-   if test "$?" != "0"; then
-     APACHE_HOOKS_INSTALL="$APXS -i -a -n php5 $SAPI_SHARED" # Old apxs does not have -S option
-   else
-    APXS_LIBEXECDIR='$(INSTALL_ROOT)'`$APXS -q LIBEXECDIR`
-+    APXS_LIBEXECDIR="$prefix/modules"
-     if test -z `$APXS -q SYSCONFDIR`; then
-       APACHE_HOOKS_INSTALL="\$(mkinstalldirs) '$APXS_LIBEXECDIR' && \
-                        $APXS -S LIBEXECDIR='$APXS_LIBEXECDIR' \
-@@ -59657,9 +59657,7 @@
- 
- 
- if test "$PHP_GETTEXT" != "no"; then
-  for i in $PHP_GETTEXT /usr/local /usr; do
-    test -r $i/include/libintl.h && GETTEXT_DIR=$i && break
-  done
-+  GETTEXT_DIR=$PHP_GETTEXT
- 
-   if test -z "$GETTEXT_DIR"; then
-     { { $as_echo "$as_me:$LINENO: error: Cannot locate header file libintl.h" >&5
--- a/pkgs/development/libraries/ffmpeg-full/default.nix
+++ b/pkgs/development/libraries/ffmpeg-full/default.nix
@ -68,6 +68,7 @@
 , ladspaH ? null # LADSPA audio filtering
 , lame ? null # LAME MP3 encoder
 , libass ? null # (Advanced) SubStation Alpha subtitle rendering
+, libaom ? null # AV1 encoder
 , libbluray ? null # BluRay reading
 , libbs2b ? null # bs2b DSP library
 , libcaca ? null # Textual display (ASCII art)
@ -334,6 +335,7 @@ stdenv.mkDerivation rec {
    #(enableFeature (ilbc != null) "libilbc")
    (enableFeature (ladspaH !=null) "ladspa")
    (enableFeature (lame != null) "libmp3lame")
+    (enableFeature (libaom != null) "libaom")
    (enableFeature (libass != null) "libass")
    #(enableFeature (libavc1394 != null) null null)
    (enableFeature (libbluray != null) "libbluray")
@ -407,7 +409,7 @@ stdenv.mkDerivation rec {

  buildInputs = [
    bzip2 celt fontconfig freetype frei0r fribidi game-music-emu gnutls gsm
-    libjack2 ladspaH lame libass libbluray libbs2b libcaca libdc1394 libmodplug libmysofa
+    libjack2 ladspaH lame libaom libass libbluray libbs2b libcaca libdc1394 libmodplug libmysofa
    libogg libopus libssh libtheora libvdpau libvorbis libvpx libwebp libX11
    libxcb libXv lzma openal openjpeg libpulseaudio rtmpdump opencore-amr
    samba SDL2 soxr speex vid-stab vo-amrwbenc wavpack x264 x265 xavs xvidcore
--- a/pkgs/development/libraries/ffmpeg/3.4.nix
+++ b/pkgs/development/libraries/ffmpeg/3.4.nix
@ -6,7 +6,7 @@

 callPackage ./generic.nix (args // rec {
  version = "${branch}";
-  branch = "3.4.3";
-  sha256 = "0s2p2bcrywlya4wjlyzi1382vngkiijjvjr6ms64xww5jplwmhmk";
+  branch = "3.4.4";
+  sha256 = "0xmcijcpa7b59ws5ycmnp0a3pjmnpgly0zv8yff6if4p7pw7406f";
  darwinFrameworks = [ Cocoa CoreMedia ];
 })
--- a/pkgs/development/libraries/libdazzle/default.nix
+++ b/pkgs/development/libraries/libdazzle/default.nix
@ -2,7 +2,7 @@
 , gtk-doc, docbook_xsl, dbus, xvfb_run, glib, gtk3, gnome3 }:

 let
-  version = "3.28.3";
+  version = "3.28.5";
  pname = "libdazzle";
 in
 stdenv.mkDerivation {
@ -13,7 +13,7 @@ stdenv.mkDerivation {

  src = fetchurl {
    url = "mirror://gnome/sources/libdazzle/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0q8apibs99yvrwdxlknq4nayss88wsj0rp5fv2x4hh0bgfw8i7w7";
+    sha256 = "08qdwv2flywnh6kibkyv0pnm67pk8xlmjh4yqx6hf13hyhkxkqgg";
  };

  nativeBuildInputs = [ ninja meson pkgconfig vala gobjectIntrospection libxml2 gtk-doc docbook_xsl dbus xvfb_run ];
--- a/pkgs/development/libraries/liblinear/default.nix
+++ b/pkgs/development/libraries/liblinear/default.nix
@ -0,0 +1,39 @@
+{stdenv, fetchurl}:
+
+stdenv.mkDerivation rec {
+  name = "liblinear-${version}";
+  version = "2.20";
+
+  src = fetchurl {
+    url = "https://www.csie.ntu.edu.tw/~cjlin/liblinear/liblinear-${version}.tar.gz";
+    sha256 = "13q48azqy9pd8jyhk0c2hzj5xav1snbdrj8pp38vwrv2wwhfz7rz";
+  };
+
+  buildPhase = ''
+    make
+    make lib
+  '';
+
+  installPhase = let
+    libSuff = stdenv.hostPlatform.extensions.sharedLibrary;
+  in ''
+    mkdir -p $out/lib $out/bin $out/include
+    cp liblinear.so.3 $out/lib/liblinear.3${libSuff}
+    ln -s $out/lib/liblinear.3${libSuff} $out/lib/liblinear${libSuff}
+    cp train $out/bin/liblinear-train
+    cp predict $out/bin/liblinear-predict
+    cp linear.h $out/include
+  '';
+
+  postFixup = stdenv.lib.optionalString stdenv.isDarwin ''
+    install_name_tool -id liblinear.3.dylib $out/lib/liblinear.3.dylib
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A library for large linear classification";
+    homepage = https://www.csie.ntu.edu.tw/~cjlin/liblinear/;
+    license = licenses.bsd3;
+    maintainers = [ maintainers.danieldk ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/development/ocaml-modules/janestreet/default.nix
+++ b/pkgs/development/ocaml-modules/janestreet/default.nix
@ -284,8 +284,9 @@ rec {
  };

  core_kernel = janePackage {
+    version = "0.11.1";
    name = "core_kernel";
-    hash = "0xaw8189i9z72fvzbxfv1qrf4wvj8v45bl7g3z7ynsqkvh6smr7d";
+    hash = "1dg7ygy7i64c5gaakb1cp1b26p9ks81vbxmb8fd7jff2q60j2z2g";
    propagatedBuildInputs = [ configurator jane-street-headers sexplib splittable_random ];
    meta.description = "Jane Street's standard library overlay (kernel)";
  };
--- a/pkgs/development/ocaml-modules/lambda-term/default.nix
+++ b/pkgs/development/ocaml-modules/lambda-term/default.nix
@ -1,19 +1,21 @@
-{ stdenv, fetchurl, libev, ocaml, findlib, jbuilder, zed, lwt_react }:
+{ stdenv, fetchurl, libev, ocaml, findlib, jbuilder
+, zed, lwt_log, lwt_react
+}:

 assert stdenv.lib.versionAtLeast ocaml.version "4.02";

 stdenv.mkDerivation rec {
-  version = "1.12.0";
+  version = "1.13";
  name = "ocaml${ocaml.version}-lambda-term-${version}";

  src = fetchurl {
    url = "https://github.com/diml/lambda-term/archive/${version}.tar.gz";
-    sha256 = "129m5jb015rqm6k3k25m1i2217vhz26n8sa7z113vjv4gs0bcd3d";
+    sha256 = "1hy5ryagqclgdm9lzh1qil5mrynlypv7mn6qm858hdcnmz9zzn0l";
  };

  buildInputs = [ libev ocaml findlib jbuilder ];

-  propagatedBuildInputs = [ zed lwt_react ];
+  propagatedBuildInputs = [ zed lwt_log lwt_react ];

  buildPhase = "jbuilder build -p lambda-term";

--- a/pkgs/development/ocaml-modules/uucp/default.nix
+++ b/pkgs/development/ocaml-modules/uucp/default.nix
@ -2,7 +2,7 @@

 let
  pname = "uucp";
-  version = "10.0.1";
+  version = "11.0.0";
  webpage = "http://erratique.ch/software/${pname}";
 in

@ -14,7 +14,7 @@ stdenv.mkDerivation {

  src = fetchurl {
    url = "${webpage}/releases/${pname}-${version}.tbz";
-    sha256 = "0qgbrx3lnrzii8a9f0hv4kp73y57q6fr79hskxxxs70q68j2xpfm";
+    sha256 = "0pidg2pmqsifmk4xx9cc5p5jprhg26xb68g1xddjm7sjzbdzhlm4";
  };

  buildInputs = [ ocaml findlib ocamlbuild topkg uutf uunf ];
--- a/pkgs/development/ocaml-modules/uunf/default.nix
+++ b/pkgs/development/ocaml-modules/uunf/default.nix
@ -8,11 +8,11 @@ assert stdenv.lib.versionAtLeast ocaml.version "4.01";

 stdenv.mkDerivation rec {
  name = "ocaml-${pname}-${version}";
-  version = "10.0.0";
+  version = "11.0.0";

  src = fetchurl {
    url = "${webpage}/releases/${pname}-${version}.tbz";
-    sha256 = "0c5lwica5668ybsffllk6x4p921nw4pljimgqikhf17k5hvyjsbr";
+    sha256 = "1j0v3dg19sq13fmbx4kzy3n1hjiv7hkm1ysxyrdva430jvqw23df";
  };

  buildInputs = [ ocaml findlib ocamlbuild topkg uutf cmdliner ];
@ -29,5 +29,6 @@ stdenv.mkDerivation rec {
    platforms = ocaml.meta.platforms or [];
    license = licenses.bsd3;
    maintainers = [ maintainers.vbgl ];
+    broken = stdenv.isAarch64;
  };
 }
--- a/pkgs/development/ocaml-modules/uuseg/default.nix
+++ b/pkgs/development/ocaml-modules/uuseg/default.nix
@ -8,11 +8,11 @@ in
 stdenv.mkDerivation rec {

  name = "ocaml${ocaml.version}-${pname}-${version}";
-  version = "10.0.0";
+  version = "11.0.0";

  src = fetchurl {
    url = "${webpage}/releases/${pname}-${version}.tbz";
-    sha256 = "01q8ljjgi7d73x7ms489b5my83xds4jax1vbjhwwjdai01friscc";
+    sha256 = "17mn8p9pn340kmvfgnl1m64zbpy60r6svkwsdn2lcg3yi2jlbrwp";
  };

  buildInputs = [ ocaml findlib ocamlbuild cmdliner topkg uutf ];
--- a/pkgs/development/python-modules/aspy.yaml/default.nix
+++ b/pkgs/development/python-modules/aspy.yaml/default.nix
@ -0,0 +1,22 @@
+{ lib, buildPythonPackage, fetchPypi, pyyaml }:
+
+buildPythonPackage rec {
+  pname = "aspy.yaml";
+  version = "1.1.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1ajb97kn044ximkzq2090h4yblrhw77540pwiw345cp7mwzy4xqa";
+  };
+
+  propagatedBuildInputs = [ pyyaml ];
+
+  # Tests not included in PyPI tarball
+  doCheck = false;
+
+  meta = with lib; {
+    description = "A few extensions to pyyaml";
+    homepage = https://github.com/asottile/aspy.yaml;
+    license = licenses.mit;
+  };
+}
--- a/pkgs/development/python-modules/cfgv/default.nix
+++ b/pkgs/development/python-modules/cfgv/default.nix
@ -0,0 +1,22 @@
+{ lib, buildPythonPackage, fetchPypi, six }:
+
+buildPythonPackage rec {
+  pname = "cfgv";
+  version = "1.1.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1akm5xdbi5kckgnhhfj6qavjwakm44cwqzhfx2ycgh7mkym1qyfi";
+  };
+
+  propagatedBuildInputs = [ six ];
+
+  # Tests not included in PyPI tarball
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Validate configuration and produce human readable error messages";
+    homepage = https://github.com/asottile/cfgv;
+    license = licenses.mit;
+  };
+}
--- a/pkgs/development/python-modules/fastpair/default.nix
+++ b/pkgs/development/python-modules/fastpair/default.nix
@ -0,0 +1,32 @@
+{ stdenv, buildPythonPackage, fetchFromGitHub, pytestrunner, pytest, scipy }:
+
+buildPythonPackage {
+  pname = "fastpair";
+  version = "2016-07-05";
+
+  src = fetchFromGitHub {
+    owner = "carsonfarmer";
+    repo = "fastpair";
+    rev = "92364962f6b695661f35a117bf11f96584128a8d";
+    sha256 = "1pv9sxycxdk567s5gs947rhlqngrb9nn9yh4dhdvg1ix1i8dca71";
+  };
+
+  buildInputs = [ pytestrunner ];
+
+  checkInputs = [ pytest ];
+
+  propagatedBuildInputs = [
+    scipy
+  ];
+
+  checkPhase = ''
+    py.test fastpair
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/carsonfarmer/fastpair;
+    description = "Data-structure for the dynamic closest-pair problem";
+    license = licenses.mit;
+    maintainers = with maintainers; [ cmcdragonkai ];
+  };
+}
--- a/pkgs/development/python-modules/futures/default.nix
+++ b/pkgs/development/python-modules/futures/default.nix
@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchPypi, isPy3k, python }:
+{ lib, buildPythonPackage, fetchPypi, isPy3k, python, stdenv }:

 buildPythonPackage rec {
  pname = "futures";
@ -16,6 +16,8 @@ buildPythonPackage rec {
    ${python.interpreter} test_futures.py
  '';

+  doCheck = !stdenv.isDarwin;
+
  meta = with lib; {
    description = "Backport of the concurrent.futures package from Python 3.2";
    homepage = "https://github.com/agronholm/pythonfutures";
--- a/pkgs/development/python-modules/identify/default.nix
+++ b/pkgs/development/python-modules/identify/default.nix
@ -0,0 +1,20 @@
+{ lib, buildPythonPackage, fetchPypi }:
+
+buildPythonPackage rec {
+  pname = "identify";
+  version = "1.1.4";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0hvwfpf6fmgn93abrvj88pi7sbcib32s4c5r99lw67kbziq5x129";
+  };
+
+  # Tests not included in PyPI tarball
+  doCheck = false;
+
+  meta = with lib; {
+    description = "File identification library for Python";
+    homepage = https://github.com/chriskuehl/identify;
+    license = licenses.mit;
+  };
+}
--- a/pkgs/development/python-modules/mysql-connector/default.nix
+++ b/pkgs/development/python-modules/mysql-connector/default.nix
@ -4,13 +4,13 @@

 buildPythonPackage rec {
  pname = "mysql-connector";
-  version = "8.0.11";
+  version = "8.0.12";

  src = fetchFromGitHub {
    owner = "mysql";
    repo = "mysql-connector-python";
    rev = version;
-    sha256 = "0w5sxy0zdkdj5cj35wwfjy9y8yn5yzk9biwwsglvhkqlkrms8fw1";
+    sha256 = "1i3148dka4zfqzz4n4n5k0qaqbc585bdpmjwgx5vp6iiv7pgvrxp";
  };

  propagatedBuildInputs = [ protobuf ];
--- a/pkgs/development/python-modules/nodeenv/default.nix
+++ b/pkgs/development/python-modules/nodeenv/default.nix
@ -0,0 +1,20 @@
+{ lib, buildPythonPackage, fetchPypi }:
+
+buildPythonPackage rec {
+  pname = "nodeenv";
+  version = "1.3.2";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0vs9nyf9w3655j1vv3abxj4vbig61c0hjmhpfb91gblv32shl15a";
+  };
+
+  # Tests not included in PyPI tarball
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Node.js virtual environment builder";
+    homepage = https://github.com/ekalinin/nodeenv;
+    license = licenses.bsd3;
+  };
+}
--- a/pkgs/development/python-modules/python-jose/default.nix
+++ b/pkgs/development/python-modules/python-jose/default.nix
@ -1,30 +1,29 @@
 { stdenv, buildPythonPackage, fetchFromGitHub
-, future, six, ecdsa, pycryptodome, pytest, cryptography
+, six, ecdsa, rsa, future, pytest, cryptography, pycryptodome
 }:

 buildPythonPackage rec {
  pname = "python-jose";
-  version = "2.0.2";
+  version = "3.0.0";

  # no tests in PyPI tarball
  src = fetchFromGitHub {
    owner = "mpdavis";
    repo = "python-jose";
-    # 2.0.2 not tagged on GitHub
-    # see https://github.com/mpdavis/python-jose/issues/86
-    rev = "28cc6719eceb89129eed59c25f7bdac015665bdd";
-    sha256 = "03wkq2rszy0rzy5gygsh4s7i6ls8zflgbcvxnflvmh7nis7002fp";
+    rev = version;
+    sha256 = "1dq8v87abqxv07wi403ywjk9jg1da125fviycqzki48cjxx0dhwj";
  };

  checkInputs = [
    pytest
-    cryptography # optional dependency, but needed in tests
+    # optional dependencies, but needed in tests
+    cryptography pycryptodome
  ];
  checkPhase = ''
    py.test
  '';

-  propagatedBuildInputs = [ future six ecdsa pycryptodome ];
+  propagatedBuildInputs = [ six ecdsa rsa future ];

  meta = with stdenv.lib; {
    homepage = https://github.com/mpdavis/python-jose;
--- a/pkgs/development/python-modules/slackclient/default.nix
+++ b/pkgs/development/python-modules/slackclient/default.nix
@ -0,0 +1,29 @@
+{ stdenv, buildPythonPackage, fetchFromGitHub, websocket_client, requests, six, pytest, codecov, coverage, mock, pytestcov, pytest-mock, responses, flake8 }:
+
+buildPythonPackage rec {
+  pname = "python-slackclient";
+  version = "1.2.1";
+
+  src = fetchFromGitHub {
+    owner  = "slackapi";
+    repo   = pname;
+    rev    = "${version}";
+    sha256 = "073fwf6fm2sqdp5ms3vm1v3ljh0pldi69k048404rp6iy3cfwkp0";
+  };
+
+  propagatedBuildInputs = [ websocket_client requests six ];
+
+  checkInputs = [ pytest codecov coverage mock pytestcov pytest-mock responses flake8 ];
+  # test_server.py fails because it needs connection (I think);
+  checkPhase = ''
+    py.test --cov-report= --cov=slackclient tests --ignore=tests/test_server.py
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A client for Slack, which supports the Slack Web API and Real Time Messaging (RTM) API";
+    homepage = https://github.com/slackapi/python-slackclient;
+    license = licenses.mit;
+    maintainers = with maintainers; [ psyanticy ];
+  };
+}
+
--- a/pkgs/development/tools/analysis/brakeman/default.nix
+++ b/pkgs/development/tools/analysis/brakeman/default.nix
@ -0,0 +1,17 @@
+{ lib, ruby, buildRubyGem }:
+
+buildRubyGem rec {
+  inherit ruby;
+  name = "${gemName}-${version}";
+  gemName = "brakeman";
+  version = "4.3.1";
+  source.sha256 = "1y4i4vw7hawypvgg04s544fqx52ml67h9zxsaqm8w5hvxmb20wkh";
+
+  meta = with lib; {
+    description = "Static analysis security scanner for Ruby on Rails";
+    homepage = https://brakemanscanner.org/;
+    license = [ licenses.cc-by-nc-sa-40 licenses.mit ];
+    platforms = ruby.meta.platforms;
+    maintainers = [ maintainers.marsam ];
+  };
+}
--- a/pkgs/development/tools/continuous-integration/jenkins/default.nix
+++ b/pkgs/development/tools/continuous-integration/jenkins/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "jenkins-${version}";
-  version = "2.107.3";
+  version = "2.121.2";

  src = fetchurl {
    url = "http://mirrors.jenkins.io/war-stable/${version}/jenkins.war";
-    sha256 = "1f4sz1dqcfypdywdwcz4byjmir7ismcpzg2hbgg6pcf5pq4yba8p";
+    sha256 = "00ln31ahhsihnxba2hldrjxdpyxl7xw731493a24cqlkdq89s3ys";
  };

  buildCommand = ''
--- a/pkgs/development/tools/mustache-go/default.nix
+++ b/pkgs/development/tools/mustache-go/default.nix
@ -0,0 +1,22 @@
+{ stdenv, buildGoPackage, fetchFromGitHub }:
+
+buildGoPackage rec {
+  name = "mustache-go-${version}";
+  version = "1.0.1";
+
+  goPackagePath = "github.com/cbroglie/mustache";
+
+  src = fetchFromGitHub {
+    owner = "cbroglie";
+    repo = "mustache";
+    rev = "v${version}";
+    sha256 = "1aywj4fijsv66n6gjiz3l8g1vg0fqzwbf8dcdcgfsvsdb056p90v";
+  };
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/cbroglie/mustache;
+    description = "The mustache template language in Go";
+    license = [ licenses.mit ];
+    maintainers = [ maintainers.Zimmi48 ];
+  };
+}
--- a/pkgs/development/tools/ocaml/camlp4/default.nix
+++ b/pkgs/development/tools/ocaml/camlp4/default.nix
@ -16,6 +16,9 @@ let param = {
  "4.06" = {
     version = "4.06+1";
     sha256 = "0fazfw2l7wdmbwnqc22xby5n4ri1wz27lw9pfzhsbcdrighykysf"; };
+  "4.07" = {
+     version = "4.07+1";
+     sha256 = "0cxl4hkqcvspvkx4f2k83217rh6051fll9i2yz7cw6m3bq57mdvl"; };
  }."${ocaml.meta.branch}";
 in

--- a/pkgs/development/tools/rust/cargo-asm/default.nix
+++ b/pkgs/development/tools/rust/cargo-asm/default.nix
@ -0,0 +1,27 @@
+{ stdenv, fetchFromGitHub, rustPlatform }:
+
+rustPlatform.buildRustPackage rec {
+  name = "cargo-asm-${version}";
+  version = "0.1.16";
+
+  src = fetchFromGitHub {
+    owner = "gnzlbg";
+    repo = "cargo-asm";
+    rev = "7d0ece74657edb002bd8530227b829b31fd19dcd";
+    sha256 = "0mzbh5zw5imlaagm5zjbjk9kqdnglm398rxkqisd22h6569ppqpc";
+  };
+
+  cargoSha256 = "1m2j6i8hc8isdlj77gv9m6sk6q0x3bvzpva2k16g27i1ngy1989b";
+
+  # Test checks against machine code output, which fails with some
+  # LLVM/compiler versions.
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "Display the assembly or LLVM-IR generated for Rust source code";
+    homepage = https://github.com/gnzlbg/cargo-asm;
+    license = licenses.mit;
+    maintainers = [ maintainers.danieldk ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/development/tools/yarn/default.nix
+++ b/pkgs/development/tools/yarn/default.nix
@ -1,4 +1,4 @@
-{ stdenv, nodejs, fetchzip, makeWrapper }:
+{ stdenv, nodejs, fetchzip }:

 stdenv.mkDerivation rec {
  name = "yarn-${version}";
@ -9,12 +9,13 @@ stdenv.mkDerivation rec {
    sha256 = "0bk006zs1bk6nwj9x07ry314fgxi21sk79h1paljbs6yzrv62h4g";
  };

-  buildInputs = [ makeWrapper nodejs ];
+  buildInputs = [ nodejs ];

  installPhase = ''
    mkdir -p $out/{bin,libexec/yarn/}
    cp -R . $out/libexec/yarn
-    makeWrapper $out/libexec/yarn/bin/yarn.js $out/bin/yarn
+    ln -s $out/libexec/yarn/bin/yarn.js $out/bin/yarn
+    ln -s $out/libexec/yarn/bin/yarn.js $out/bin/yarnpkg
  '';

  meta = with stdenv.lib; {
--- a/pkgs/games/scummvm/default.nix
+++ b/pkgs/games/scummvm/default.nix
@ -28,7 +28,7 @@ stdenv.mkDerivation rec {

  # They use 'install -s', that calls the native strip instead of the cross
  postConfigure = ''
-    sed -i "s/-c -s/-c -s --strip-program=''${STRIP@Q}" ports.mk
+    sed -i "s/-c -s/-c -s --strip-program=''${STRIP@Q}/" ports.mk
  '';

  meta = with stdenv.lib; {
--- a/pkgs/misc/cups/filters.nix
+++ b/pkgs/misc/cups/filters.nix
@ -2,6 +2,7 @@
 , libjpeg, libpng, perl, ijs, qpdf, dbus, avahi
 , makeWrapper, coreutils, gnused, bc, gawk, gnugrep, which, ghostscript
 , mupdf
+, fetchpatch
 }:

 let
@ -16,6 +17,16 @@ in stdenv.mkDerivation rec {
    sha256 = "0sjkmclcb1r77015wllsyz26272br3s17v6b1q2xwb2nm2gnwx9k";
  };

+  patches = [
+    # This patch fixes cups-filters when compiled with poppler-0.67.0.
+    # Issue: https://github.com/OpenPrinting/cups-filters/pull/50
+    # PR: https://github.com/OpenPrinting/cups-filters/pull/51
+    (fetchpatch {
+      url = "https://github.com/OpenPrinting/cups-filters/commit/219de01c61f3b1ec146abf142d0dfc8c560cc58e.patch";
+      sha256 = "0f0lql3rbm2g8mxrpigfyi8fb4i2g4av20g417jzdilp60jq0ny8";
+    })
+  ];
+
  nativeBuildInputs = [ pkgconfig makeWrapper ];

  buildInputs = [
--- a/pkgs/misc/scrcpy/default.nix
+++ b/pkgs/misc/scrcpy/default.nix
@ -0,0 +1,52 @@
+{ stdenv, fetchurl, fetchFromGitHub, makeWrapper
+, meson
+, ninja
+, pkgconfig
+
+, platformTools
+, ffmpeg
+, SDL2
+}:
+
+let
+  version = "1.2";
+  prebuilt_server = fetchurl {
+    url = "https://github.com/Genymobile/scrcpy/releases/download/v${version}/scrcpy-server-v${version}.jar";
+    sha256 = "0q0zyqw7y33r9ybjp8ay6yac7ifca1lq14pjvw6x78zxs976affb";
+  };
+in
+stdenv.mkDerivation rec {
+  name = "scrcpy-${version}";
+  inherit version;
+  src = fetchFromGitHub {
+    owner = "Genymobile";
+    repo = "scrcpy";
+    rev = "v${version}";
+    sha256 = "01zw6h6mz2cwqfh9lwypm8pbfx9m9df91l1fq1i0f1d8v49x8wqc";
+  };
+
+  nativeBuildInputs = [ makeWrapper meson ninja pkgconfig ];
+
+  buildInputs = [ ffmpeg SDL2 ];
+
+  # Manually install the server jar to prevent Meson from "fixing" it
+  preConfigure = ''
+    echo -n > server/meson.build
+  '';
+
+  postInstall = ''
+    mkdir -p "$out/share/scrcpy"
+    ln -s "${prebuilt_server}" "$out/share/scrcpy/scrcpy-server.jar"
+
+    # runtime dep on `adb` to push the server
+    wrapProgram "$out/bin/scrcpy" --prefix PATH : "${platformTools}/bin"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Display and control Android devices over USB or TCP/IP";
+    homepage = https://github.com/Genymobile/scrcpy;
+    license = licenses.asl20;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ deltaevo lukeadams ];
+  };
+}
--- a/pkgs/os-specific/linux/kernel/linux-hardkernel-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-hardkernel-4.14.nix
@ -1,10 +1,10 @@
 { stdenv, buildPackages, hostPlatform, fetchFromGitHub, perl, buildLinux, libelf, utillinux, ... } @ args:

 buildLinux (args // rec {
-  version = "4.14.47-139";
+  version = "4.14.55-146";

  # modDirVersion needs to be x.y.z.
-  modDirVersion = "4.14.47";
+  modDirVersion = "4.14.55";

  # branchVersion needs to be x.y. 
  extraMeta.branch = "4.14";
@ -13,7 +13,19 @@ buildLinux (args // rec {
    owner = "hardkernel";
    repo = "linux";
    rev = version;
-    sha256 = "0jjgrmvi1h8zs8snnvghnjd422yfmn7jv9y1n7xikmfv4nvwqrkv";
+    sha256 = "1bm1njng4rwfylgnqv06vabkvybm9rikqj1lsb7p9qcs3y1kw6mh";
  };

+  defconfig = "odroidxu4_defconfig";
+
+  # This extraConfig is (only) required because the gator module fails to build as-is.
+  extraConfig = ''
+
+    GATOR n
+
+    # This attempted fix applies correctly but does not fix the build.
+    #GATOR_MALI_MIDGARD_PATH ${src}/drivers/gpu/arm/midgard
+
+  '' + (args.extraConfig or "");
+
 } // (args.argsOverride or {}))
--- a/pkgs/servers/minio/default.nix
+++ b/pkgs/servers/minio/default.nix
@ -3,13 +3,13 @@
 buildGoPackage rec {
  name = "minio-${version}";

-  version = "2018-05-11T00-29-24Z";
+  version = "2018-07-31T02-11-47Z";

  src = fetchFromGitHub {
    owner = "minio";
    repo = "minio";
    rev = "RELEASE.${version}";
-    sha256 = "01jw1djfs0jbhsx9pmx3kj31mfhrw45lr1i4lwkmh8k7fxn8w13x";
+    sha256 = "0pngr2x15prn55r8xj59sqjn9yp98hhm5qgi12ybc6cfxx0wls52";
  };

  goPackagePath = "github.com/minio/minio";
--- a/pkgs/test/default.nix
+++ b/pkgs/test/default.nix
@ -22,6 +22,8 @@ with pkgs;
  cc-multilib-gcc = callPackage ./cc-wrapper/multilib.nix { stdenv = gccMultiStdenv; };
  cc-multilib-clang = callPackage ./cc-wrapper/multilib.nix { stdenv = clangMultiStdenv; };

+  ld-library-path = callPackage ./ld-library-path {};
+
  macOSSierraShared = callPackage ./macos-sierra-shared {};

  cross = callPackage ./cross {};
--- a/pkgs/test/ld-library-path/default.nix
+++ b/pkgs/test/ld-library-path/default.nix
@ -0,0 +1,88 @@
+{ stdenv }:
+
+# This tests that libraries listed in LD_LIBRARY_PATH take precedence over those listed in RPATH.
+
+let
+  # A simple test library: libgreeting.so which exports a single function getGreeting() returning the good old hello greeting.
+  libgreeting = stdenv.mkDerivation {
+    name = "libgreeting";
+
+    code = ''
+      const char* getGreeting() { return "Hello, world!"; }
+    '';
+
+    unpackPhase = ''
+      echo "$code" > libgreeting.c
+    '';
+
+    installPhase = ''
+      mkdir -p $out/lib
+      $CC -c -fpic libgreeting.c
+      $CC -shared libgreeting.o -o $out/lib/libgreeting.so
+    '';
+  };
+
+  # A variant of libgreeting.so that returns a different message.
+  libgoodbye = libgreeting.overrideAttrs (_: {
+    name = "libgoodbye";
+    code = ''
+      const char* getGreeting() { return "Goodbye, world!"; }
+    '';
+  });
+
+  # A simple consumer of libgreeting.so that just prints the greeting to stdout.
+  testProgram = stdenv.mkDerivation {
+    name = "greeting-test";
+
+    buildInputs = [ libgreeting ];
+
+    code = ''
+      #include <stdio.h>
+
+      extern const char* getGreeting(void);
+
+      int main() {
+        puts(getGreeting());
+      }
+    '';
+
+    unpackPhase = ''
+      echo "$code" > greeting-test.c
+    '';
+
+    installPhase = ''
+      mkdir -p $out/bin
+      $CC -c greeting-test.c
+      $CC greeting-test.o -lgreeting -o $out/bin/greeting-test
+
+      # Now test the installed binaries right after compiling them. In particular,
+      # don't do this in installCheckPhase because fixupPhase has been run by then!
+      (
+        export PATH=$out/bin
+        set -x
+
+        # Verify that our unmodified binary works as expected.
+        [ "$(greeting-test)" = "Hello, world!" ]
+
+        # And finally, test that a library in LD_LIBRARY_PATH takes precedence over the linked-in library.
+        [ "$(LD_LIBRARY_PATH=${libgoodbye}/lib greeting-test)" = "Goodbye, world!" ]
+      )
+    '';
+
+  };
+in stdenv.mkDerivation {
+  name = "test-LD_LIBRARY_PATH";
+  nativeBuildInputs = [ testProgram ];
+
+  buildCommand = ''
+    # And for good measure, repeat the tests again from a separate derivation,
+    # as fixupPhase done by the stdenv can (and has!) affect the result.
+
+    [ "$(greeting-test)" = "Hello, world!" ]
+    [ "$(LD_LIBRARY_PATH=${libgoodbye}/lib greeting-test)" = "Goodbye, world!" ]
+
+    touch $out
+  '';
+
+  meta.platforms = stdenv.lib.platforms.linux;
+}
--- a/pkgs/tools/filesystems/glusterfs/default.nix
+++ b/pkgs/tools/filesystems/glusterfs/default.nix
@ -15,10 +15,10 @@ let
    #       The command
    #         find /nix/store/...-glusterfs-.../ -name '*.py' -executable
    #       can help with finding new Python scripts.
-    version = "3.12.4";
+    version = "3.12.12";
    name="${baseName}-${version}";
    url="https://github.com/gluster/glusterfs/archive/v${version}.tar.gz";
-    sha256 = "01gsc3dw491ipl47q733iznddxbg42aa749vkyaq6i6w4d7m157f";
+    sha256 = "1q6rcf9y98w3kvgwdlbhl65phkdl0mfil6y7i3gnpf3d21gfb6nw";
  };
  buildInputs = [
    fuse bison flex_2_5_35 openssl ncurses readline
--- a/pkgs/tools/graphics/argyllcms/default.nix
+++ b/pkgs/tools/graphics/argyllcms/default.nix
@ -2,7 +2,7 @@
 , libXrender, libXext, libtiff, libjpeg, libpng, libXScrnSaver, writeText
 , libXdmcp, libXau, lib, openssl }:
 let
-  version = "2.0.0";
+  version = "2.0.1";
 in
 stdenv.mkDerivation rec {
  name = "argyllcms-${version}";
@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
    # Kind of flacky URL, it was reaturning 406 and inconsistent binaries for a
    # while on me. It might be good to find a mirror
    url = "https://www.argyllcms.com/Argyll_V${version}_src.zip";
-    sha256 = "1583hspas7rw5xwrs1rb4yn1yl34wh6lfik6xyszpfv39a2axdxx";
+    sha256 = "0a7m5mwvy74db34hvqsgy296469x3139qj5gfj4zqpnz0iyxhkny";

    # The argyllcms web server doesn't like curl ...
    curlOpts = "--user-agent 'Mozilla/5.0'";
--- a/pkgs/tools/misc/ldmtool/default.nix
+++ b/pkgs/tools/misc/ldmtool/default.nix
@ -0,0 +1,34 @@
+{ stdenv, fetchFromGitHub, autoconf, automake, gtk-doc, pkgconfig, libuuid,
+  libtool, readline, gobjectIntrospection, json-glib, lvm2, libxslt, docbook_xsl }:
+
+stdenv.mkDerivation rec {
+   name = "ldmtool-${version}";
+   version = "0.2.4";
+
+   src = fetchFromGitHub {
+     owner = "mdbooth";
+     repo = "libldm";
+     rev = "libldm-${version}";
+     sha256 = "1fy5wbmk8kwl86lzswq0d1z2j5y023qzfm2ppm8knzv9c47kniqk";
+   };
+
+   preConfigure = ''
+     sed -i docs/reference/ldmtool/Makefile.am \
+       -e 's|-nonet http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl|--nonet ${docbook_xsl}/xml/xsl/docbook/manpages/docbook.xsl|g'
+   '';
+
+   configureScript = "sh autogen.sh";
+
+   nativeBuildInputs = [ pkgconfig ];
+   buildInputs = [ autoconf automake gtk-doc lvm2 libxslt.bin
+     libtool readline gobjectIntrospection json-glib libuuid
+   ];
+
+   meta = with stdenv.lib; {
+     description = "Tool and library for managing Microsoft Windows Dynamic Disks";
+     homepage = https://github.com/mdbooth/libldm;
+     maintainers = with maintainers; [ jensbin ];
+     license = licenses.gpl3;
+     platforms = platforms.linux;
+   };
+}
--- a/pkgs/tools/networking/ipgrep/default.nix
+++ b/pkgs/tools/networking/ipgrep/default.nix
@ -0,0 +1,36 @@
+{ stdenv, fetchFromGitHub, pythonPackages, makeWrapper }:
+
+pythonPackages.buildPythonApplication rec {
+  version = "1.0";
+  pname = "ipgrep";
+
+  src = fetchFromGitHub {
+    owner = "jedisct1";
+    repo = pname;
+    rev = version;
+    sha256 = "1qaxvbqdalvz05aplhhrg7s4h7yx4clbfd50k46bgavhgcqqv8n3";
+  };
+
+  patchPhase = ''
+    mkdir -p ${pname} 
+    substituteInPlace setup.py \
+      --replace "'scripts': []" "'scripts': { '${pname}.py' }"
+  '';
+
+  propagatedBuildInputs = with pythonPackages; [
+    pycares
+    urllib3
+    requests
+  ];
+
+  meta = with stdenv.lib; {
+    description = "Extract, defang, resolve names and IPs from text";
+    longDescription = ''
+      ipgrep extracts possibly obfuscated host names and IP addresses
+      from text, resolves host names, and prints them, sorted by ASN.
+    '';
+    license = licenses.mit;
+    maintainers = with maintainers; [ leenaars ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/tools/networking/minio-client/default.nix
+++ b/pkgs/tools/networking/minio-client/default.nix
@ -3,13 +3,13 @@
 buildGoPackage rec {
  name = "minio-client-${version}";

-  version = "2018-04-28T00-08-20Z";
+  version = "2018-07-31T02-28-53Z";

  src = fetchFromGitHub {
    owner = "minio";
    repo = "mc";
    rev = "RELEASE.${version}";
-    sha256 = "03c9ahphkpsy6z9i9z50jcsgj5ba6gba2sw2nz22b1ynqiz3ds37";
+    sha256 = "1918yl5d92y4ij9d1v738pf574rwb6a911rjpmaj9awhrz8qa2bg";
  };

  goPackagePath = "github.com/minio/mc";
--- a/pkgs/tools/networking/miniupnpc/default.nix
+++ b/pkgs/tools/networking/miniupnpc/default.nix
@ -27,8 +27,8 @@ let
    };
 in {
  miniupnpc_2 = generic {
-    version = "2.0.20171212";
-    sha256 = "0za7pr6hrr3ajkifirhhxfn3hlhl06f622g8hnj5h8y18sp3bwff";
+    version = "2.0.20180203";
+    sha256 = "1dr0qaf2qz49aawgsnv7l41rda5yvdk3qfz2hd5cv9iwav3sipch";
  };
  miniupnpc_1 = generic {
    version = "1.9.20160209";
--- a/pkgs/tools/networking/p2p/bittornado/default.nix
+++ b/pkgs/tools/networking/p2p/bittornado/default.nix
@ -0,0 +1,26 @@
+{ lib, python3, fetchFromGitHub }:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "BitTornado";
+  version = "unstable-2018-02-09";
+
+  src = fetchFromGitHub {
+    owner = "effigies";
+    repo = "BitTornado";
+    rev = "a3e6d8bcdf9d99de064dc58b4a3e909e0349e589";
+    sha256 = "099bci3as592psf8ymmz225qyz2lbjhya7g50cb7hk64k92mqk9k";
+  };
+
+  postFixup = ''
+    for i in $(ls $out/bin); do		
+      mv $out/bin/$i $out/bin/''${i%.py}
+    done
+  '';
+
+  meta = with lib; {
+    inherit (src.meta) homepage;
+    description = "John Hoffman's fork of the original bittorrent";
+    license = licenses.mit;
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@ -34,7 +34,7 @@ let
      ++ lib.optional withLibseccomp libseccomp
      ++ lib.optional ((stdenv.isLinux || stdenv.isDarwin) && is20)
          (aws-sdk-cpp.override {
-            apis = ["s3"];
+            apis = ["s3" "transfer"];
            customMemoryManagement = false;
          })
      ++ lib.optional fromGit boost;
@ -144,12 +144,12 @@ in rec {

  nixUnstable = (lib.lowPrio (common rec {
    name = "nix-2.1${suffix}";
-    suffix = "pre6148_a4aac7f";
+    suffix = "pre6338_45bcf541";
    src = fetchFromGitHub {
      owner = "NixOS";
      repo = "nix";
-      rev = "a4aac7f88c59c97299027c9668461c637bbc6a72";
-      sha256 = "1250fg1rgzcd0qy960nhl2bw9hsc1a6pyz11rmxasr0h3j1a2z53";
+      rev = "45bcf5416a0ce53361fd37c6b27ba4ef6a34ce96";
+      sha256 = "0ps45n78wnczz99dd9fs54ydxwh2cjq73zbvmak0y49nhc3p0vvv";
    };
    fromGit = true;
  })) // { perl-bindings = perl-bindings {
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -589,6 +589,8 @@ with pkgs;

  awless = callPackage ../tools/virtualization/awless { };

+  brakeman = callPackage ../development/tools/analysis/brakeman { };
+
  ec2_api_tools = callPackage ../tools/virtualization/ec2-api-tools { };

  ec2_ami_tools = callPackage ../tools/virtualization/ec2-ami-tools { };
@ -682,6 +684,8 @@ with pkgs;

  imgpatchtools = callPackage ../development/mobile/imgpatchtools { };

+  ipgrep = callPackage ../tools/networking/ipgrep { };
+
  lastpass-cli = callPackage ../tools/security/lastpass-cli { };

  pacparser = callPackage ../tools/networking/pacparser { };
@ -866,6 +870,8 @@ with pkgs;

  bitbucket-cli = python2Packages.bitbucket-cli;

+  bittornado = callPackage ../tools/networking/p2p/bittornado { };
+
  blink = callPackage ../applications/networking/instant-messengers/blink { };

  blockhash = callPackage ../tools/graphics/blockhash { };
@ -2799,6 +2805,8 @@ with pkgs;

  gparted = callPackage ../tools/misc/gparted { };

+  ldmtool = callPackage ../tools/misc/ldmtool { };
+
  gpodder = callPackage ../applications/audio/gpodder { };

  gpp = callPackage ../development/tools/gpp { };
@ -2999,6 +3007,8 @@ with pkgs;

  halibut = callPackage ../tools/typesetting/halibut { };

+  halide = callPackage ../development/compilers/halide {};
+
  hardinfo = callPackage ../tools/system/hardinfo { };

  hdapsd = callPackage ../os-specific/linux/hdapsd { };
@ -5010,6 +5020,10 @@ with pkgs;
    inherit (darwin.apple_sdk.libs) utmp;
  };

+  scrcpy = callPackage ../misc/scrcpy {
+    inherit (androidenv) platformTools;
+  };
+
  screen-message = callPackage ../tools/X11/screen-message { };

  screencloud = callPackage ../applications/graphics/screencloud {
@ -7068,6 +7082,7 @@ with pkgs;
  cargo-release = callPackage ../tools/package-management/cargo-release { };
  cargo-tree = callPackage ../tools/package-management/cargo-tree { };

+  cargo-asm = callPackage ../development/tools/rust/cargo-asm { };
  cargo-fuzz = callPackage ../development/tools/rust/cargo-fuzz { };

  rainicorn = callPackage ../development/tools/rust/rainicorn { };
@ -7423,14 +7438,6 @@ with pkgs;
  php = php72;
  phpPackages = php72Packages;

-  php56Packages = recurseIntoAttrs (callPackage ./php-packages.nix {
-    php = php56;
-  });
-
-  php70Packages = recurseIntoAttrs (callPackage ./php-packages.nix {
-    php = php70;
-  });
-
  php71Packages = recurseIntoAttrs (callPackage ./php-packages.nix {
    php = php71;
  });
@ -7441,8 +7448,6 @@ with pkgs;


  inherit (callPackages ../development/interpreters/php { })
-    php56
-    php70
    php71
    php72;

@ -10501,6 +10506,8 @@ with pkgs;

  libksi = callPackage ../development/libraries/libksi { };

+  liblinear = callPackage ../development/libraries/liblinear { };
+
  libmad = callPackage ../development/libraries/libmad { };

  libmatchbox = callPackage ../development/libraries/libmatchbox { };
@ -14622,6 +14629,8 @@ with pkgs;

  cantarell-fonts = callPackage ../data/fonts/cantarell-fonts { };

+  capitaine-cursors = callPackage ../data/icons/capitaine-cursors { };
+
  carlito = callPackage ../data/fonts/carlito {};

  comfortaa = callPackage ../data/fonts/comfortaa {};
@ -14760,6 +14769,8 @@ with pkgs;

  hanazono = callPackage ../data/fonts/hanazono { };

+  ia-writer-duospace = callPackage ../data/fonts/ia-writer-duospace { };
+
  ibm-plex = callPackage ../data/fonts/ibm-plex { };

  iconpack-obsidian = callPackage ../data/icons/iconpack-obsidian { };
@ -14769,6 +14780,9 @@ with pkgs;

  input-fonts = callPackage ../data/fonts/input-fonts { };

+  inriafonts = callPackage ../data/fonts/inriafonts { };
+
+
  iosevka = callPackage ../data/fonts/iosevka {
    nodejs = nodejs-8_x;
  };
@ -14865,6 +14879,8 @@ with pkgs;

  mustache-spec = callPackage ../data/documentation/mustache-spec { };

+  mustache-go = callPackage ../development/tools/mustache-go { };
+
  myrica = callPackage ../data/fonts/myrica { };

  nafees = callPackage ../data/fonts/nafees { };
@ -18397,6 +18413,8 @@ with pkgs;

  stp = callPackage ../applications/science/logic/stp {};

+  stumpish = callPackage ../applications/window-managers/stumpish {};
+
  stumpwm = callPackage ../applications/window-managers/stumpwm {
    version = "latest";
  };
@ -18528,10 +18546,12 @@ with pkgs;
    vte = gnome3.vte;
  };

-  termite = callPackage ../applications/misc/termite {
+  termite-unwrapped = callPackage ../applications/misc/termite {
    vte = gnome3.vte-ng;
  };

+  termite = callPackage ../applications/misc/termite/wrapper.nix { termite = termite-unwrapped; };
+
  termtosvg = callPackage ../tools/misc/termtosvg { };

  tesseract = callPackage ../applications/graphics/tesseract { };
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -186,6 +186,8 @@ in {

  asn1crypto = callPackage ../development/python-modules/asn1crypto { };

+  aspy-yaml = callPackage ../development/python-modules/aspy.yaml { };
+
  astral = callPackage ../development/python-modules/astral { };

  astropy = callPackage ../development/python-modules/astropy {  };
@ -493,6 +495,8 @@ in {

  sklearn-deap = callPackage ../development/python-modules/sklearn-deap { };

+  slackclient = callPackage ../development/python-modules/slackclient { };
+
  spglib = callPackage ../development/python-modules/spglib { };

  supervise_api = callPackage ../development/python-modules/supervise_api { };
@ -1520,6 +1524,8 @@ in {

  cherrypy = callPackage ../development/python-modules/cherrypy {};

+  cfgv = callPackage ../development/python-modules/cfgv { };
+
  cftime = callPackage ../development/python-modules/cftime {};

  cjson = callPackage ../development/python-modules/cjson { };
@ -3050,6 +3056,8 @@ in {

  idna-ssl = callPackage ../development/python-modules/idna-ssl { };

+  identify = callPackage ../development/python-modules/identify { };
+
  ijson = callPackage ../development/python-modules/ijson {};

  imagesize = buildPythonPackage rec {
@ -5283,6 +5291,8 @@ in {

  fastimport = callPackage ../development/python-modules/fastimport { };

+  fastpair = callPackage ../development/python-modules/fastpair { };
+
  fastrlock = callPackage ../development/python-modules/fastrlock {};

  feedgen = callPackage ../development/python-modules/feedgen { };
@ -8440,6 +8450,8 @@ in {
    inherit (pkgs) which;
  };

+  nodeenv = callPackage ../development/python-modules/nodeenv { };
+
  nose = buildPythonPackage rec {
    version = "1.3.7";
    name = "nose-${version}";
@ -17488,18 +17500,6 @@ EOF
    propagatedBuildInputs = with self; [ six ];
  };

-  slackclient = buildPythonPackage rec {
-    name = "slackclient-${version}";
-    version = "1.0.0";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/s/slackclient/${name}.tar.gz";
-      sha256 = "063cbzp1fbdipv53gb0hnban1pg80pls0lbld98lhnykzkcb6vf0";
-    };
-
-    propagatedBuildInputs = with self; [ websocket_client requests ];
-  };
-
  tempora= callPackage ../development/python-modules/tempora { };

  hypchat = callPackage ../development/python-modules/hypchat { };