diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 50ac45adc252..8a5845cafe3c 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -2536,6 +2536,11 @@
     github = "MikePlayle";
     name = "Mike Playle";
   };
+  mkazulak = {
+    email = "kazulakm@gmail.com";
+    github = "mulderr";
+    name = "Maciej Kazulak";
+  };
   mkg = {
     email = "mkg@vt.edu";
     github = "mkgvt";
diff --git a/nixos/modules/services/networking/ssh/sshd.nix b/nixos/modules/services/networking/ssh/sshd.nix
index 902e759f3a3a..961e72b2b810 100644
--- a/nixos/modules/services/networking/ssh/sshd.nix
+++ b/nixos/modules/services/networking/ssh/sshd.nix
@@ -334,7 +334,9 @@ in
     services.openssh.moduliFile = mkDefault "${cfgc.package}/etc/ssh/moduli";
 
     environment.etc = authKeysFiles //
-      { "ssh/moduli".source = cfg.moduliFile; };
+      { "ssh/moduli".source = cfg.moduliFile;
+        "ssh/sshd_config".text = cfg.extraConfig;
+      };
 
     systemd =
       let
@@ -365,7 +367,7 @@ in
               { ExecStart =
                   (optionalString cfg.startWhenNeeded "-") +
                   "${cfgc.package}/bin/sshd " + (optionalString cfg.startWhenNeeded "-i ") +
-                  "-f ${pkgs.writeText "sshd_config" cfg.extraConfig}";
+                  "-f /etc/ssh/sshd_config";
                 KillMode = "process";
               } // (if cfg.startWhenNeeded then {
                 StandardInput = "socket";
diff --git a/nixos/tests/gnome3.nix b/nixos/tests/gnome3.nix
index 492fa61484a0..591ed8600685 100644
--- a/nixos/tests/gnome3.nix
+++ b/nixos/tests/gnome3.nix
@@ -11,8 +11,9 @@ import ./make-test.nix ({ pkgs, ...} : {
 
       services.xserver.enable = true;
 
-      services.xserver.displayManager.auto.enable = true;
-      services.xserver.displayManager.auto.user = "alice";
+      services.xserver.displayManager.lightdm.enable = true;
+      services.xserver.displayManager.lightdm.autoLogin.enable = true;
+      services.xserver.displayManager.lightdm.autoLogin.user = "alice";
       services.xserver.desktopManager.gnome3.enable = true;
 
       virtualisation.memorySize = 1024;
@@ -21,7 +22,9 @@ import ./make-test.nix ({ pkgs, ...} : {
   testScript =
     ''
       $machine->waitForX;
-      $machine->sleep(15);
+
+      # wait for alice to be logged in
+      $machine->waitForUnit("default.target","alice");
 
       # Check that logging in has given the user ownership of devices.
       $machine->succeed("getfacl /dev/snd/timer | grep -q alice");
diff --git a/pkgs/applications/editors/emacs/macport.nix b/pkgs/applications/editors/emacs/macport.nix
index 7b58b4528189..b0e36592ae79 100644
--- a/pkgs/applications/editors/emacs/macport.nix
+++ b/pkgs/applications/editors/emacs/macport.nix
@@ -26,13 +26,13 @@ stdenv.mkDerivation rec {
     sha256 = "0f2wzdw2a3ac581322b2y79rlj3c9f33ddrq9allj97r1si6v5xk";
   };
 
+  patches = [ ./clean-env.patch ];
+
   enableParallelBuilding = true;
 
   nativeBuildInputs = [ pkgconfig autoconf automake ];
 
-  buildInputs = [ ncurses libxml2 gnutls texinfo gettext ];
-
-  propagatedBuildInputs = [
+  buildInputs = [ ncurses libxml2 gnutls texinfo gettext
     AppKit Carbon Cocoa IOKit OSAKit Quartz QuartzCore WebKit
     ImageCaptureCore GSS ImageIO   # may be optional
   ];
diff --git a/pkgs/applications/graphics/darktable/default.nix b/pkgs/applications/graphics/darktable/default.nix
index 4de49524f82f..ee35afb09237 100644
--- a/pkgs/applications/graphics/darktable/default.nix
+++ b/pkgs/applications/graphics/darktable/default.nix
@@ -6,12 +6,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "2.4.3";
+  version = "2.4.4";
   name = "darktable-${version}";
 
   src = fetchurl {
     url = "https://github.com/darktable-org/darktable/releases/download/release-${version}/darktable-${version}.tar.xz";
-    sha256 = "1lq3xp7hhfhfwqrz0f2mrp3xywnpvb0nlw6lbm5cgx22s5xzri8x";
+    sha256 = "0kdhmiw4wxk2w9v2hms9yk8nl4ymdshnqyj0l07nivzzr6w20hwn";
   };
 
   nativeBuildInputs = [ cmake ninja llvm pkgconfig intltool perl desktop-file-utils wrapGAppsHook ];
diff --git a/pkgs/applications/misc/hello-unfree/default.nix b/pkgs/applications/misc/hello-unfree/default.nix
new file mode 100644
index 000000000000..ef378b2c5ffb
--- /dev/null
+++ b/pkgs/applications/misc/hello-unfree/default.nix
@@ -0,0 +1,23 @@
+{ stdenv }:
+
+stdenv.mkDerivation rec {
+  name = "example-unfree-package-${version}";
+  version = "1.0";
+
+  phases = [ "installPhase" "fixupPhase" ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cat > $out/bin/hello-unfree << EOF
+    #!/bin/sh
+    echo "Hello, you are running an unfree system!"
+    EOF
+    chmod +x $out/bin/hello-unfree
+  '';
+
+  meta = {
+    description = "An example package with unfree license (for testing)";
+    license = stdenv.lib.licenses.unfree;
+    maintainers = [ stdenv.lib.maintainers.oxij ];
+  };
+}
diff --git a/pkgs/applications/misc/hello/default.nix b/pkgs/applications/misc/hello/default.nix
index c94f78317f4e..7998d30f253f 100644
--- a/pkgs/applications/misc/hello/default.nix
+++ b/pkgs/applications/misc/hello/default.nix
@@ -1,7 +1,8 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "hello-2.10";
+  name = "hello-${version}";
+  version = "2.10";
 
   src = fetchurl {
     url = "mirror://gnu/hello/${name}.tar.gz";
diff --git a/pkgs/applications/misc/josm/default.nix b/pkgs/applications/misc/josm/default.nix
index 6c14c93c83da..d79e2620c343 100644
--- a/pkgs/applications/misc/josm/default.nix
+++ b/pkgs/applications/misc/josm/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "josm-${version}";
-  version = "13576";
+  version = "13878";
 
   src = fetchurl {
     url = "https://josm.openstreetmap.de/download/josm-snapshot-${version}.jar";
-    sha256 = "0pw7srvds8zs53ibvj779vj505h2gfrn7xqx13hkbacdg441jkd4";
+    sha256 = "0f8cbzlrlyq8awhzgbjvsljih19s8dzxhhwb4h2dfiakv1rl6vvx";
   };
 
   buildInputs = [ jre8 makeWrapper ];
diff --git a/pkgs/applications/misc/kdeconnect/default.nix b/pkgs/applications/misc/kdeconnect/default.nix
index 0d02dbba69eb..97e371e9e72c 100644
--- a/pkgs/applications/misc/kdeconnect/default.nix
+++ b/pkgs/applications/misc/kdeconnect/default.nix
@@ -20,12 +20,12 @@
 
 stdenv.mkDerivation rec {
   pname = "kdeconnect";
-  version = "1.3.0";
+  version = "1.3.1";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://kde/stable/${pname}/${version}/src/${pname}-kde-${version}.tar.xz";
-    sha256 = "0gzv55hks6j37pf7d18l40n1q6j8b74j9qg3v44p8sp0gnglwkcm";
+    sha256 = "0rzjbn4d2lh81n19dd3a5ilm8qml3zs3g3ahg75avcw8770rr344";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
index 97b719c1471b..b8ee0aebb5fe 100644
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@@ -98,7 +98,7 @@ let
   fteLibPath = makeLibraryPath [ stdenv.cc.cc gmp ];
 
   # Upstream source
-  version = "7.5.4";
+  version = "7.5.5";
 
   lang = "en-US";
 
@@ -108,7 +108,7 @@ let
         "https://github.com/TheTorProject/gettorbrowser/releases/download/v${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
         "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
       ];
-      sha256 = "1d5q2vc7kyd2wizl4551yf54rcagh3y2xf1lzvrswxq4kasii3h9";
+      sha256 = "0v8mxxfqfpwm2nqmb3jyi91rqvxm4n391ilnvxavi00pd5p0glfh";
     };
 
     "i686-linux" = fetchurl {
@@ -116,7 +116,7 @@ let
         "https://github.com/TheTorProject/gettorbrowser/releases/download/v${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
         "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
       ];
-      sha256 = "18v7ykv23gsylvn9mlkp5547yz3y833i9h126r7195wsqdshizdj";
+      sha256 = "1j1bhj50d0fqimcl10qfg076gp1wq42s6k9865jdvd3xfsgldnsj";
     };
   };
 in
diff --git a/pkgs/applications/networking/cluster/kontemplate/default.nix b/pkgs/applications/networking/cluster/kontemplate/default.nix
index fd599cd86586..e5d649c68b79 100644
--- a/pkgs/applications/networking/cluster/kontemplate/default.nix
+++ b/pkgs/applications/networking/cluster/kontemplate/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name          = "kontemplate-${version}";
-  version       = "1.5.0";
+  version       = "1.6.0";
   goPackagePath = "github.com/tazjin/kontemplate";
   goDeps        = ./deps.nix;
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     owner  = "tazjin";
     repo   = "kontemplate";
     rev    = "v${version}";
-    sha256 = "0k3yr0ypw6brj1lxqs041zsyi0r09113i0x3xfj48zv4ralq74b6";
+    sha256 = "06qcf2cxs686kd7iqccmqd5chdzxgbkav95byjim7sgvq9qjajfi";
   };
 
   meta = with lib; {
diff --git a/pkgs/applications/networking/p2p/synapse-bt/default.nix b/pkgs/applications/networking/p2p/synapse-bt/default.nix
index c8d54e945bf9..2c257a1294ac 100644
--- a/pkgs/applications/networking/p2p/synapse-bt/default.nix
+++ b/pkgs/applications/networking/p2p/synapse-bt/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, rustPlatform, pkgconfig, openssl }:
+{ stdenv, fetchFromGitHub, rustPlatform, pkgconfig, openssl, Security }:
 
 rustPlatform.buildRustPackage rec {
   name = "synapse-bt-unstable-${version}";
@@ -13,7 +13,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "1psrmgf6ddzqwx7gf301rx84asfnvxpsvkx2fan453v65819k960";
 
-  buildInputs = [ pkgconfig openssl ];
+  buildInputs = [ pkgconfig openssl ] ++ stdenv.lib.optional stdenv.isDarwin Security;
 
   cargoBuildFlags = [ "--all" ];
 
diff --git a/pkgs/desktops/gnome-3/core/totem/default.nix b/pkgs/desktops/gnome-3/core/totem/default.nix
index b4c15b5dce2e..f852e053cdeb 100644
--- a/pkgs/desktops/gnome-3/core/totem/default.nix
+++ b/pkgs/desktops/gnome-3/core/totem/default.nix
@@ -15,11 +15,6 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  # https://bugs.launchpad.net/ubuntu/+source/totem/+bug/1712021
-  # https://bugzilla.gnome.org/show_bug.cgi?id=784236
-  # https://github.com/mesonbuild/meson/issues/1994
-  enableParallelBuilding = false;
-
   NIX_CFLAGS_COMPILE = "-I${gnome3.glib.dev}/include/gio-unix-2.0";
 
   nativeBuildInputs = [ meson ninja vala pkgconfig intltool python3Packages.python itstool wrapGAppsHook ];
@@ -46,7 +41,13 @@ stdenv.mkDerivation rec {
     patchShebangs .
   '';
 
-  mesonFlags = [ "-Dwith-nautilusdir=lib/nautilus/extensions-3.0" ];
+  mesonFlags = [
+    "-Dwith-nautilusdir=lib/nautilus/extensions-3.0"
+    # https://bugs.launchpad.net/ubuntu/+source/totem/+bug/1712021
+    # https://bugzilla.gnome.org/show_bug.cgi?id=784236
+    # https://github.com/mesonbuild/meson/issues/1994
+    "-Denable-vala=no"
+  ];
 
   wrapPrefixVariables = [ "PYTHONPATH" ];
 
diff --git a/pkgs/desktops/mate/mate-desktop/default.nix b/pkgs/desktops/mate/mate-desktop/default.nix
index f84b6b254207..09f8da17e096 100644
--- a/pkgs/desktops/mate/mate-desktop/default.nix
+++ b/pkgs/desktops/mate/mate-desktop/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "mate-desktop-${version}";
-  version = "1.20.1";
+  version = "1.20.3";
 
   src = fetchurl {
     url = "http://pub.mate-desktop.org/releases/${mate.getRelease version}/${name}.tar.xz";
-    sha256 = "0jxhhf9w6mz8ha6ymgj2alzmiydylg4ngqslkjxx37vvpvms2dyx";
+    sha256 = "132z1wwmh5115cpgkx9w6hzkk87f1vh66paaf3b2d2qfci7myffs";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/compilers/ghcjs-ng/default.nix b/pkgs/development/compilers/ghcjs-ng/default.nix
index 04c3431f6f23..6e883aeafe83 100644
--- a/pkgs/development/compilers/ghcjs-ng/default.nix
+++ b/pkgs/development/compilers/ghcjs-ng/default.nix
@@ -50,7 +50,7 @@ let
   };
 
   bootGhcjs = haskellLib.justStaticExecutables passthru.bootPkgs.ghcjs;
-  libexec = "${bootGhcjs}/libexec/${builtins.replaceStrings ["darwin"] ["osx"] stdenv.system}-${passthru.bootPkgs.ghc.name}/${bootGhcjs.name}";
+  libexec = "${bootGhcjs}/libexec/${builtins.replaceStrings ["darwin" "i686"] ["osx" "i386"] stdenv.system}-${passthru.bootPkgs.ghc.name}/${bootGhcjs.name}";
 
 in stdenv.mkDerivation {
     name = bootGhcjs.name;
diff --git a/pkgs/development/libraries/aws-sdk-cpp/default.nix b/pkgs/development/libraries/aws-sdk-cpp/default.nix
index 46e6a73433d0..5fce7bae8fcd 100644
--- a/pkgs/development/libraries/aws-sdk-cpp/default.nix
+++ b/pkgs/development/libraries/aws-sdk-cpp/default.nix
@@ -15,13 +15,13 @@ let
         else throw "Unsupported system!";
 in stdenv.mkDerivation rec {
   name = "aws-sdk-cpp-${version}";
-  version = "1.4.50";
+  version = "1.4.60";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-sdk-cpp";
     rev = version;
-    sha256 = "1qly5zn7w9j8w6a9pjw25xnr01sfq8dn8g5zrz6xyjgz590fj2x7";
+    sha256 = "0zn1pyhn37w8di9byq5p3y886hsgf5569bmxiqb7bvjcrhnlb83l";
   };
 
   # FIXME: might be nice to put different APIs in different outputs
diff --git a/pkgs/development/libraries/npth/default.nix b/pkgs/development/libraries/npth/default.nix
index a600938cdbb2..203be8b6907b 100644
--- a/pkgs/development/libraries/npth/default.nix
+++ b/pkgs/development/libraries/npth/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
   name = "npth-1.5";
 
   src = fetchurl {
-    url = "ftp://ftp.gnupg.org/gcrypt/npth/${name}.tar.bz2";
+    url = "mirror://gnupg/npth/${name}.tar.bz2";
     sha256 = "1hmkkp6vzyrh8v01c2ynzf9vwikyagp7p1lxhbnr4ysk3w66jji9";
   };
 
diff --git a/pkgs/development/libraries/odpic/default.nix b/pkgs/development/libraries/odpic/default.nix
new file mode 100644
index 000000000000..07edc24ecabc
--- /dev/null
+++ b/pkgs/development/libraries/odpic/default.nix
@@ -0,0 +1,45 @@
+{ stdenv, fetchurl, fetchpatch, fixDarwinDylibNames, oracle-instantclient, libaio }:
+
+stdenv.mkDerivation rec {
+  name = "odpic-${version}";
+  version = "2.4.0";
+
+  src = fetchurl {
+    url = "https://github.com/oracle/odpi/archive/v${version}.tar.gz";
+    sha256 = "1z793mg8hmy067xhllip7ca84xy07ca1cqilnr35mbvhmydp03zz";
+  };
+
+  patches = [ (fetchpatch {
+    url = https://github.com/oracle/odpi/commit/31fdd70c06be711840a2668f572c7ee7c4434d18.patch;
+    sha256 = "1f00zp4w7l4vnkg0fmvnkga20ih8kjd5bxvr1nryziibjh1xp41j";
+  }) ];
+
+  nativeBuildInputs = stdenv.lib.optional stdenv.isDarwin [ fixDarwinDylibNames ];
+
+  buildInputs = [ oracle-instantclient ]
+    ++ stdenv.lib.optionals stdenv.isLinux [ libaio ];
+
+  libPath = stdenv.lib.makeLibraryPath
+    [ oracle-instantclient ];
+
+  dontPatchELF = true;
+  makeFlags = [ "PREFIX=$(out)" "CC=cc" "LD=cc"];
+
+  postFixup = ''
+    ${stdenv.lib.optionalString (stdenv.isLinux) ''
+      patchelf --set-rpath "${libPath}" $out/lib/libodpic${stdenv.hostPlatform.extensions.sharedLibrary}
+    ''}
+    ${stdenv.lib.optionalString (stdenv.isDarwin) ''
+      install_name_tool -add_rpath "${libPath}" $out/lib/libodpic${stdenv.hostPlatform.extensions.sharedLibrary}
+    ''}
+    '';
+
+  meta = with stdenv.lib; {
+    description = "Oracle ODPI-C library";
+    homepage = "https://oracle.github.io/odpi/";
+    maintainers = with maintainers; [ mkazulak flokli ];
+    license = licenses.asl20;
+    platforms = [ "x86_64-linux" "x86_64-darwin" ];
+    hydraPlatforms = [];
+  };
+}
diff --git a/pkgs/development/libraries/oracle-instantclient/default.nix b/pkgs/development/libraries/oracle-instantclient/default.nix
index 7e0f2e1cf903..56f0cc084d14 100644
--- a/pkgs/development/libraries/oracle-instantclient/default.nix
+++ b/pkgs/development/libraries/oracle-instantclient/default.nix
@@ -1,49 +1,57 @@
-{ stdenv, requireFile, autoPatchelfHook, rpmextract, libaio, makeWrapper, odbcSupport ? false, unixODBC }:
+{ stdenv, requireFile, autoPatchelfHook, unzip, libaio, makeWrapper, odbcSupport ? false, unixODBC }:
 
 assert odbcSupport -> unixODBC != null;
 
 let
-    baseVersion = "12.2";
-    requireSource = version: rel: part: hash: (requireFile rec {
-      name = "oracle-instantclient${baseVersion}-${part}-${version}-${rel}.x86_64.rpm";
-      message = ''
-        This Nix expression requires that ${name} already
-        be part of the store. Download the file
-        manually at
-
-        http://www.oracle.com/technetwork/topics/linuxx86-64soft-092277.html
-
-        and add it to the Nix store using either:
-          nix-store --add-fixed sha256 ${name}
-        or
-          nix-prefetch-url --type sha256 file:///path/to/${name}
-      '';
-      url = "http://www.oracle.com/technetwork/topics/linuxx86-64soft-092277.html";
-      sha256 = hash;
-    });
-in stdenv.mkDerivation rec {
+  baseVersion = "12.2";
   version = "${baseVersion}.0.1.0";
+
+  requireSource = component: arch: version: rel: hash: (requireFile rec {
+    name = "instantclient-${component}-${arch}-${version}" + (stdenv.lib.optionalString (rel != "") "-${rel}") + ".zip";
+    url = "http://www.oracle.com/technetwork/database/database-technologies/instant-client/downloads/index.html";
+    sha256 = hash;
+  });
+
+  throwSystem = throw "Unsupported system: ${stdenv.system}";
+
+  arch = {
+    "x86_64-linux" = "linux.x64";
+    "x86_64-darwin" = "macos.x64";
+  }."${stdenv.system}" or throwSystem;
+
+  srcs = {
+    "x86_64-linux" = [
+      (requireSource "basic" arch version "" "5015e3c9fba84e009f7519893f798a1622c37d1ae2c55104ff502c52a0fe5194")
+      (requireSource "sdk" arch version "" "7f404c3573c062ce487a51ac4cfe650c878d7edf8e73b364ec852645ed1098cb")
+      (requireSource "sqlplus" arch version "" "d49b2bd97376591ca07e7a836278933c3f251875c215044feac73ba9f451dfc2") ]
+      ++ stdenv.lib.optional odbcSupport (requireSource "odbc" arch version "2" "365a4ae32c7062d9fbc3fb41add748e7881f774484a175a4b41a2c294ce9095d");
+    "x86_64-darwin" = [
+      (requireSource "basic" arch version "2" "3ed3102e5a24f0da638694191edb34933309fb472eb1df21ad5c86eedac3ebb9")
+      (requireSource "sdk" arch version "2" "e0befca9c4e71ebc9f444957ffa70f01aeeec5976ea27c40406471b04c34848b")
+      (requireSource "sqlplus" arch version "2" "d147cbb5b2a954fdcb4b642df4f0bd1153fd56e0f56e7fa301601b4f7e2abe0e") ]
+      ++ stdenv.lib.optional odbcSupport (requireSource "odbc" arch version "2" "1805c1ab6c8c5e8df7bdcc35d7f2b94c329ecf4dff9bde55d5f9b159ecd8b64e");
+  }."${stdenv.system}" or throwSystem;
+
+in stdenv.mkDerivation rec {
+  inherit version srcs;
   name = "oracle-instantclient-${version}";
 
-  buildInputs = [ libaio stdenv.cc.cc.lib ] ++ stdenv.lib.optional odbcSupport unixODBC;
-  nativeBuildInputs = [ autoPatchelfHook makeWrapper rpmextract ];
+  buildInputs = [ stdenv.cc.cc.lib ]
+    ++ stdenv.lib.optionals (stdenv.isLinux) [ libaio ]
+    ++ stdenv.lib.optional odbcSupport unixODBC;
+  nativeBuildInputs = [ autoPatchelfHook makeWrapper unzip ];
 
-  srcs = [
-    (requireSource version "1" "basic" "43c4bfa938af741ae0f9964a656f36a0700849f5780a2887c8e9f1be14fe8b66")
-    (requireSource version "1" "devel" "4c7ad8d977f9f908e47c5e71ce56c2a40c7dc83cec8a5c106b9ff06d45bb3442")
-    (requireSource version "1" "sqlplus" "303e82820a10f78e401e2b07d4eebf98b25029454d79f06c46e5f9a302ce5552")
-  ] ++ stdenv.lib.optional odbcSupport (requireSource version "2" "odbc" "e870c84d2d4be6f77c0760083b82b7ffbb15a4bf5c93c4e6c84f36d6ed4dfdf1");
-
-  unpackCmd = "rpmextract $curSrc";
+  unpackCmd = "unzip $curSrc";
 
   installPhase = ''
-    mkdir -p "$out/"{bin,include,lib,"share/${name}/demo/"}
+    mkdir -p "$out/"{bin,include,lib,"share/java","share/${name}/demo/"}
 
-    install -Dm755 lib/oracle/${baseVersion}/client64/bin/* $out/bin
+    install -Dm755 {sqlplus,adrci,genezi} $out/bin
     ln -s $out/bin/sqlplus $out/bin/sqlplus64
-    install -Dm644 lib/oracle/${baseVersion}/client64/lib/* $out/lib
-    install -Dm644 include/oracle/${baseVersion}/client64/* $out/include
-    install -Dm644 share/oracle/${baseVersion}/client64/demo/* $out/share/${name}/demo
+    install -Dm644 *${stdenv.hostPlatform.extensions.sharedLibrary}* $out/lib
+    install -Dm644 *.jar $out/share/java
+    install -Dm644 sdk/include/* $out/include
+    install -Dm644 sdk/demo/* $out/share/${name}/demo
   '';
 
   meta = with stdenv.lib; {
@@ -54,7 +62,7 @@ in stdenv.mkDerivation rec {
       command line SQL client.
     '';
     license = licenses.unfree;
-    platforms = [ "x86_64-linux" ];
+    platforms = [ "x86_64-linux" "x86_64-darwin" ];
     maintainers = with maintainers; [ pesterhazy flokli ];
     hydraPlatforms = [];
   };
diff --git a/pkgs/development/libraries/science/math/ipopt/default.nix b/pkgs/development/libraries/science/math/ipopt/default.nix
index f694f72f22b6..0af00f75d994 100644
--- a/pkgs/development/libraries/science/math/ipopt/default.nix
+++ b/pkgs/development/libraries/science/math/ipopt/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "ipopt-${version}";
-  version = "3.12.9";
+  version = "3.12.10";
 
   src = fetchurl {
     url = "http://www.coin-or.org/download/source/Ipopt/Ipopt-${version}.zip";
-    sha256 = "1fqdjgxh6l1xjvw1ffma7lg92xqg0l8sj02y0zqvbfnx8i47qs9a";
+    sha256 = "004pd90knnnzcx727knb7ffkabb1ggbskb8s607bfvfgdd7wlli9";
   };
 
   CXXDEFS = [ "-DHAVE_RAND" "-DHAVE_CSTRING" "-DHAVE_CSTDIO" ];
diff --git a/pkgs/development/python-modules/cx_oracle/0001-odpi-src-dpiOci.c-nixify-libclntsh.so-dlopen.patch b/pkgs/development/python-modules/cx_oracle/0001-odpi-src-dpiOci.c-nixify-libclntsh.so-dlopen.patch
deleted file mode 100644
index a2de7b248531..000000000000
--- a/pkgs/development/python-modules/cx_oracle/0001-odpi-src-dpiOci.c-nixify-libclntsh.so-dlopen.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From 355b9d812efdfbd041e14b365258b69c81689981 Mon Sep 17 00:00:00 2001
-From: Florian Klink <flokli@flokli.de>
-Date: Thu, 17 May 2018 18:37:40 +0200
-Subject: [PATCH] odpi/src/dpiOci.c: nixify libclntsh.so dlopen
-
----
- odpi/src/dpiOci.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/odpi/src/dpiOci.c b/odpi/src/dpiOci.c
-index 76b9867..22c2987 100644
---- a/odpi/src/dpiOci.c
-+++ b/odpi/src/dpiOci.c
-@@ -1575,6 +1575,10 @@ static int dpiOci__loadLib(dpiError *error)
-             }
-         }
-     }
-+    if(!dpiOciLibHandle) {
-+        dpiOciLibHandle = dlopen("@libclntsh@", RTLD_LAZY);
-+    }
-+
- #endif
- 
-     if (!dpiOciLibHandle) {
--- 
-2.16.3
-
diff --git a/pkgs/development/python-modules/cx_oracle/default.nix b/pkgs/development/python-modules/cx_oracle/default.nix
index 717faf1128f0..7c0fa32eb99f 100644
--- a/pkgs/development/python-modules/cx_oracle/default.nix
+++ b/pkgs/development/python-modules/cx_oracle/default.nix
@@ -1,22 +1,19 @@
-{ stdenv, buildPythonPackage, fetchPypi, oracle-instantclient }:
+{ stdenv, buildPythonPackage, fetchPypi, odpic }:
 
 buildPythonPackage rec {
   pname = "cx_Oracle";
   version = "6.3.1";
 
-  buildInputs = [
-    oracle-instantclient
-  ];
+  buildInputs = [ odpic ];
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "0200j6jh80rpgzxmvgcxmkshaj4zadq32g2i97nlwiq3f7q374l7";
   };
 
-  patches = [ ./0001-odpi-src-dpiOci.c-nixify-libclntsh.so-dlopen.patch ];
-
-  postPatch = ''
-    substituteInPlace odpi/src/dpiOci.c --replace @libclntsh@ "${oracle-instantclient}/lib/libclntsh.so";
+  preConfigure = ''
+    export ODPIC_INC_DIR="${odpic}/include"
+    export ODPIC_LIB_DIR="${odpic}/lib"
   '';
 
   # Check need an Oracle database to run
diff --git a/pkgs/development/python-modules/mypy/default.nix b/pkgs/development/python-modules/mypy/default.nix
index 5ce05b7938f5..65cdf79059df 100644
--- a/pkgs/development/python-modules/mypy/default.nix
+++ b/pkgs/development/python-modules/mypy/default.nix
@@ -2,14 +2,14 @@
 
 buildPythonPackage rec {
   pname = "mypy";
-  version = "0.600";
+  version = "0.610";
 
   # Tests not included in pip package.
   doCheck = false;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1pd3kkz435wlvi9fwqbi3xag5zs59jcjqi6c9gzdjdn23friq9dw";
+    sha256 = "0fc7h7hf9042nlqczdvj2ngz2hc7rcnd35qz5pb840j38x9n8wpl";
   };
 
   disabled = !isPy3k;
diff --git a/pkgs/development/python-modules/paperspace/default.nix b/pkgs/development/python-modules/paperspace/default.nix
new file mode 100644
index 000000000000..7d228f0af6ac
--- /dev/null
+++ b/pkgs/development/python-modules/paperspace/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, fetchPypi, buildPythonPackage
+, boto3, requests
+}:
+
+buildPythonPackage rec {
+  pname = "paperspace";
+  version = "0.0.11";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0z19arikcjpfvp3bgssnlhplm1qzgw95s3r5fnsyf7nwmc4pvvpa";
+  };
+
+  propagatedBuildInputs = [ boto3 requests ];
+
+  # tries to use /homeless-shelter to mimic container usage, etc
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "Python API for Paperspace Cloud";
+    homepage    = https://paperspace.com;
+    license     = licenses.isc;
+    platforms   = platforms.unix;
+    maintainers = with maintainers; [ thoughtpolice ];
+  };
+}
diff --git a/pkgs/development/python-modules/pylibmc/default.nix b/pkgs/development/python-modules/pylibmc/default.nix
index 7f57f17efeb1..47499e4ae188 100644
--- a/pkgs/development/python-modules/pylibmc/default.nix
+++ b/pkgs/development/python-modules/pylibmc/default.nix
@@ -1,4 +1,5 @@
-{ buildPythonPackage, fetchPypi, stdenv, libmemcached, zlib }:
+{ buildPythonPackage, fetchPypi, stdenv, libmemcached, zlib, cyrus_sasl }:
+
 buildPythonPackage rec {
   version = "1.5.2";
   pname = "pylibmc";
@@ -9,7 +10,8 @@ buildPythonPackage rec {
     sha256 = "fc54e28a9f1b5b2ec0c030da29c7ad8a15c2755bd98aaa4142eaf419d5fabb33";
   };
 
-  buildInputs = [ libmemcached zlib ];
+  buildInputs = [ libmemcached zlib cyrus_sasl ];
+  setupPyBuildFlags = [ "--with-sasl2" ];
 
   # requires an external memcached server running
   doCheck = false;
diff --git a/pkgs/games/spring/springlobby.nix b/pkgs/games/spring/springlobby.nix
index 36256d31fda7..2000398b537d 100644
--- a/pkgs/games/spring/springlobby.nix
+++ b/pkgs/games/spring/springlobby.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   name = "springlobby-${version}";
-  version = "0.255";
+  version = "0.264";
 
   src = fetchurl {
     url = "http://www.springlobby.info/tarballs/springlobby-${version}.tar.bz2";
-    sha256 = "12iv6h1mz998lzxc2jwkza0m1yvaaq8h05k36i85xyp7g90197jw";
+    sha256 = "1i31anvvywhl2m8014m3vk74cj74l37j6a0idzfhd4ack8b9hg2x";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/os-specific/darwin/iproute2mac/default.nix b/pkgs/os-specific/darwin/iproute2mac/default.nix
new file mode 100644
index 000000000000..3ff03aace4ee
--- /dev/null
+++ b/pkgs/os-specific/darwin/iproute2mac/default.nix
@@ -0,0 +1,38 @@
+{ stdenv, fetchFromGitHub, darwin, python }:
+
+stdenv.mkDerivation rec {
+  version = "1.2.1";
+  name = "iproute2mac-${version}";
+
+  src = fetchFromGitHub {
+    owner = "brona";
+    repo = "iproute2mac";
+    rev = "v${version}";
+    sha256 = "1n6la7blbxza2m79cpnywsavhzsdv4gzdxrkly4dppyidjg6jy1h";
+  };
+
+  buildInputs = [ python ];
+
+  postPatch = ''
+    substituteInPlace src/ip.py \
+      --replace /usr/bin/python ${python}/bin/python \
+      --replace /sbin/ifconfig ${darwin.network_cmds}/bin/ifconfig \
+      --replace /sbin/route ${darwin.network_cmds}/bin/route \
+      --replace /usr/sbin/netstat ${darwin.network_cmds}/bin/netstat \
+      --replace /usr/sbin/ndp ${darwin.network_cmds}/bin/ndp \
+      --replace /usr/sbin/arp ${darwin.network_cmds}/bin/arp \
+      --replace /usr/sbin/networksetup ${darwin.network_cmds}/bin/networksetup
+  '';
+  installPhase = ''
+    mkdir -p $out/bin
+    install -D -m 755 src/ip.py $out/bin/ip
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/brona/iproute2mac;
+    description = "CLI wrapper for basic network utilites on Mac OS X inspired with iproute2 on Linux systems - ip command.";
+    license = licenses.mit;
+    maintainers = with maintainers; [ flokli ];
+    platforms = platforms.darwin;
+  };
+}
diff --git a/pkgs/os-specific/linux/sysstat/default.nix b/pkgs/os-specific/linux/sysstat/default.nix
index db9f05f5f4d8..0da32371b351 100644
--- a/pkgs/os-specific/linux/sysstat/default.nix
+++ b/pkgs/os-specific/linux/sysstat/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, gettext, bzip2 }:
 
 stdenv.mkDerivation rec {
-  name = "sysstat-11.7.3";
+  name = "sysstat-11.7.4";
 
   src = fetchurl {
     url = "http://perso.orange.fr/sebastien.godard/${name}.tar.xz";
-    sha256 = "1sk6rhdqr8xsm456fkhkcmbnqgkymqqs3jkapcf8mrnsx36gz94f";
+    sha256 = "144h5fb93s33w3pmgw7qadw1f7c4jq41m5lzcs49ihl44yi6aqm9";
   };
 
   buildInputs = [ gettext ];
diff --git a/pkgs/servers/dns/bind/default.nix b/pkgs/servers/dns/bind/default.nix
index 2b1830ea6797..d424d510cd28 100644
--- a/pkgs/servers/dns/bind/default.nix
+++ b/pkgs/servers/dns/bind/default.nix
@@ -1,4 +1,6 @@
-{ stdenv, lib, fetchurl, openssl, libtool, perl, libxml2
+{ stdenv, lib, fetchurl
+, perl
+, libcap, libtool, libxml2, openssl
 , enablePython ? false, python3 ? null
 , enableSeccomp ? false, libseccomp ? null, buildPackages
 }:
@@ -22,7 +24,7 @@ stdenv.mkDerivation rec {
     stdenv.lib.optional stdenv.isDarwin ./darwin-openssl-linking-fix.patch;
 
   nativeBuildInputs = [ perl ];
-  buildInputs = [ openssl libtool libxml2 ]
+  buildInputs = [ libcap libtool libxml2 openssl ]
     ++ lib.optional enableSeccomp libseccomp
     ++ lib.optional enablePython python3;
 
@@ -32,6 +34,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     "--localstatedir=/var"
+    "--with-libcap=${libcap.dev}"
     "--with-libtool"
     "--with-libxml2=${libxml2.dev}"
     "--with-openssl=${openssl.dev}"
@@ -43,6 +46,7 @@ stdenv.mkDerivation rec {
     "--without-idn"
     "--without-idnlib"
     "--without-lmdb"
+    "--without-libjson"
     "--without-pkcs11"
     "--without-purify"
     "--with-randomdev=/dev/random"
diff --git a/pkgs/servers/nextcloud/default.nix b/pkgs/servers/nextcloud/default.nix
index 7513d3c71d2b..fb43643f9038 100644
--- a/pkgs/servers/nextcloud/default.nix
+++ b/pkgs/servers/nextcloud/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name= "nextcloud-${version}";
-  version = "13.0.2";
+  version = "13.0.3";
 
   src = fetchurl {
     url = "https://download.nextcloud.com/server/releases/${name}.tar.bz2";
-    sha256 = "0zf4z4cn4wwsybxirvzyk7l6xjw9gkc60lzm8jqz9aak3a5gk5kk";
+    sha256 = "1r4k3vbjxm07mlm430hmp61dx052ikgzw0bqlmg09p8011a6fdhq";
   };
 
   installPhase = ''
diff --git a/pkgs/servers/web-apps/matomo/default.nix b/pkgs/servers/web-apps/matomo/default.nix
index 27cf873e7908..a4a26fd506bc 100644
--- a/pkgs/servers/web-apps/matomo/default.nix
+++ b/pkgs/servers/web-apps/matomo/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "matomo-${version}";
-  version = "3.5.0";
+  version = "3.5.1";
 
   src = fetchurl {
     # TODO: As soon as the tarballs are renamed as well on future releases, this should be enabled again
     # url = "https://builds.matomo.org/${name}.tar.gz";
     url = "https://builds.matomo.org/piwik-${version}.tar.gz";
-    sha256 = "1l656b194h7z3k52ywl7sfa2h6sxa5gf22wcfrp0pp07v9p6pc5f";
+    sha256 = "0ifrgaw30h4d6hwwzrz8i9k036dxzkxgh71y9s0ds10lhr8vidym";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/shells/zsh/antibody/default.nix b/pkgs/shells/zsh/antibody/default.nix
index b95ba35045d0..6d428b69e630 100644
--- a/pkgs/shells/zsh/antibody/default.nix
+++ b/pkgs/shells/zsh/antibody/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "antibody-${version}";
-  version = "3.4.6";
+  version = "3.5.0";
   rev = "v${version}";
   
   goPackagePath = "github.com/getantibody/antibody";
@@ -11,7 +11,7 @@ buildGoPackage rec {
     inherit rev;
     owner  = "getantibody";
     repo   = "antibody";
-    sha256 = "0pvsngvlxv5iw7yj18snslag8c61ji4w3j3rw543ckl6k3f9zq6c";
+    sha256 = "0x9wfki7cl3cm9h21zj37196gwdzgllfgqmgy9n86m82wbla6slb";
   };
 
   goDeps = ./deps.nix;
diff --git a/pkgs/shells/zsh/antibody/deps.nix b/pkgs/shells/zsh/antibody/deps.nix
index 6e97ff319029..b824358fbbab 100644
--- a/pkgs/shells/zsh/antibody/deps.nix
+++ b/pkgs/shells/zsh/antibody/deps.nix
@@ -1,82 +1,109 @@
 [
   {
-    goPackagePath = "github.com/alecthomas/kingpin";
+    goPackagePath  = "github.com/alecthomas/kingpin";
     fetch = {
       type = "git";
       url = "https://github.com/alecthomas/kingpin";
-      rev = "a39589180ebd6bbf43076e514b55f20a95d43086";
+      rev =  "a39589180ebd6bbf43076e514b55f20a95d43086";
       sha256 = "0b00bfiwl76qflnmnk3cnlaii6wxgzzdnby99cxdych4f8qmzlv3";
     };
   }
   {
-    goPackagePath = "github.com/alecthomas/template";
+    goPackagePath  = "github.com/alecthomas/template";
     fetch = {
       type = "git";
       url = "https://github.com/alecthomas/template";
-      rev = "a0175ee3bccc567396460bf5acd36800cb10c49c";
+      rev =  "a0175ee3bccc567396460bf5acd36800cb10c49c";
       sha256 = "0qjgvvh26vk1cyfq9fadyhfgdj36f1iapbmr5xp6zqipldz8ffxj";
     };
   }
   {
-    goPackagePath = "github.com/alecthomas/units";
+    goPackagePath  = "github.com/alecthomas/units";
     fetch = {
       type = "git";
       url = "https://github.com/alecthomas/units";
-      rev = "2efee857e7cfd4f3d0138cc3cbb1b4966962b93a";
+      rev =  "2efee857e7cfd4f3d0138cc3cbb1b4966962b93a";
       sha256 = "1j65b91qb9sbrml9cpabfrcf07wmgzzghrl7809hjjhrmbzri5bl";
     };
   }
   {
-    goPackagePath = "github.com/caarlos0/gohome";
+    goPackagePath  = "github.com/caarlos0/gohome";
     fetch = {
       type = "git";
       url = "https://github.com/caarlos0/gohome";
-      rev = "c08fdebe2a8b9b92637a423c66ac5d4a8f4e91e8";
+      rev =  "c08fdebe2a8b9b92637a423c66ac5d4a8f4e91e8";
       sha256 = "1wpg7dpi44kic4y20bk6fjwpanm65h1hj4762dsp41kbdfzc8322";
     };
   }
   {
-    goPackagePath = "github.com/getantibody/folder";
+    goPackagePath  = "github.com/davecgh/go-spew";
     fetch = {
       type = "git";
-      url = "https://github.com/getantibody/folder";
-      rev = "e65aa38ebeb03e6d6e91b90a637f3b7c17e1b6d6";
-      sha256 = "0h8al3sl4gxg1p33s8jrz91i7vrqahk12p0b3srlhnz1sn4ahn8n";
+      url = "https://github.com/davecgh/go-spew";
+      rev =  "346938d642f2ec3594ed81d874461961cd0faa76";
+      sha256 = "0d4jfmak5p6lb7n2r6yvf5p1zcw0l8j74kn55ghvr7zr7b7axm6c";
     };
   }
   {
-    goPackagePath = "golang.org/x/crypto";
+    goPackagePath  = "github.com/getantibody/folder";
+    fetch = {
+      type = "git";
+      url = "https://github.com/getantibody/folder";
+      rev =  "479aa91767d47bc27599e6ebc7fd07945dd38132";
+      sha256 = "0mzc2x7897f17kj2v807d8cqzgclq9bsz2xqz81j1k85g53l513j";
+    };
+  }
+  {
+    goPackagePath  = "github.com/pmezard/go-difflib";
+    fetch = {
+      type = "git";
+      url = "https://github.com/pmezard/go-difflib";
+      rev =  "792786c7400a136282c1664665ae0a8db921c6c2";
+      sha256 = "0c1cn55m4rypmscgf0rrb88pn58j3ysvc2d0432dp3c6fqg6cnzw";
+    };
+  }
+  {
+    goPackagePath  = "github.com/stretchr/testify";
+    fetch = {
+      type = "git";
+      url = "https://github.com/stretchr/testify";
+      rev =  "12b6f73e6084dad08a7c6e575284b177ecafbc71";
+      sha256 = "01f80s0q64pw5drfgqwwk1wfwwkvd2lhbs56lhhkff4ni83k73fd";
+    };
+  }
+  {
+    goPackagePath  = "golang.org/x/crypto";
     fetch = {
       type = "git";
       url = "https://go.googlesource.com/crypto";
-      rev = "1a580b3eff7814fc9b40602fd35256c63b50f491";
+      rev =  "1a580b3eff7814fc9b40602fd35256c63b50f491";
       sha256 = "11adgxc6fzcb3dxr5v2g4nk6ggrz04qnx633hzgmzfh2wv3blgv7";
     };
   }
   {
-    goPackagePath = "golang.org/x/net";
+    goPackagePath  = "golang.org/x/net";
     fetch = {
       type = "git";
       url = "https://go.googlesource.com/net";
-      rev = "2491c5de3490fced2f6cff376127c667efeed857";
+      rev =  "2491c5de3490fced2f6cff376127c667efeed857";
       sha256 = "1wmijnrxi9p2rv8g6clqkzdihn5ncv29j0s4s1bz9ksncdr36ll3";
     };
   }
   {
-    goPackagePath = "golang.org/x/sync";
+    goPackagePath  = "golang.org/x/sync";
     fetch = {
       type = "git";
       url = "https://go.googlesource.com/sync";
-      rev = "1d60e4601c6fd243af51cc01ddf169918a5407ca";
+      rev =  "1d60e4601c6fd243af51cc01ddf169918a5407ca";
       sha256 = "046jlanz2lkxq1r57x9bl6s4cvfqaic6p2xybsj8mq1120jv4rs6";
     };
   }
   {
-    goPackagePath = "golang.org/x/sys";
+    goPackagePath  = "golang.org/x/sys";
     fetch = {
       type = "git";
       url = "https://go.googlesource.com/sys";
-      rev = "7c87d13f8e835d2fb3a70a2912c811ed0c1d241b";
+      rev =  "7c87d13f8e835d2fb3a70a2912c811ed0c1d241b";
       sha256 = "03fhkng37rczqwfgah5hd7d373jps3hcfx79dmky2fh62yvpcyn3";
     };
   }
diff --git a/pkgs/tools/archivers/p7zip/default.nix b/pkgs/tools/archivers/p7zip/default.nix
index 886ed8179091..6cabd8ff976b 100644
--- a/pkgs/tools/archivers/p7zip/default.nix
+++ b/pkgs/tools/archivers/p7zip/default.nix
@@ -12,13 +12,13 @@ stdenv.mkDerivation rec {
   patches = [
     (fetchpatch rec {
       name = "CVE-2016-9296.patch";
-      url = "https://src.fedoraproject.org/cgit/rpms/p7zip.git/plain/${name}?id=4b3973f6a5d";
+      url = "https://salsa.debian.org/debian/p7zip/raw/debian/${version}+dfsg-6/debian/patches/12-${name}";
       sha256 = "09wbkzai46bwm8zmplsz0m4jck3qn7snr68i9p1gsih300zidj0m";
     })
     (fetchpatch rec {
       name = "CVE-2017-17969.patch";
-      url = "https://anonscm.debian.org/cgit/users/robert/p7zip.git/plain/debian/patches/13-${name}?h=debian/16.02%2bdfsg-5";
-      sha256 = "16lbf6rgyl7xwxfjgg1243jvi39yb3i5pgqfnxswyc0jzhxv81d7";
+      url = "https://salsa.debian.org/debian/p7zip/raw/debian/${version}+dfsg-6/debian/patches/13-${name}";
+      sha256 = "00pycdwx6gw7w591bg54ym6zhbxgn47p3zhms6mnmaycfzw09mkn";
     })
   ];
 
diff --git a/pkgs/tools/filesystems/xfsprogs/default.nix b/pkgs/tools/filesystems/xfsprogs/default.nix
index cc2bbad1680a..d38e26edec6e 100644
--- a/pkgs/tools/filesystems/xfsprogs/default.nix
+++ b/pkgs/tools/filesystems/xfsprogs/default.nix
@@ -12,8 +12,8 @@ stdenv.mkDerivation rec {
   version = "4.14.0";
 
   src = fetchgit {
-    url = "git://git.kernel.org/pub/scm/fs/xfs/xfsprogs-dev.git";
-    rev = "refs/tags/v${version}";
+    url = "https://git.kernel.org/pub/scm/fs/xfs/xfsprogs-dev.git";
+    rev = "v${version}";
     sha256 = "19mg3avm188xz215hqbbh7251q27qwm7g1xr8ffrjwvzmdq55rxj";
   };
 
diff --git a/pkgs/tools/misc/ddcutil/default.nix b/pkgs/tools/misc/ddcutil/default.nix
index e5af0c8d7263..35c18954bf3f 100644
--- a/pkgs/tools/misc/ddcutil/default.nix
+++ b/pkgs/tools/misc/ddcutil/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   name = "ddcutil-${version}";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner  = "rockowitz";
     repo   = "ddcutil";
     rev    = "v${version}";
-    sha256 = "1lcn3jbhpcm6ixp24vsfnk1v0qi0fjkkf57f4grs1wg148s3jpvc";
+    sha256 = "0chs5bfw4yjnr7brhxxqydybcxdkjv4gnik2s0cvjzcj3bqnz73b";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
diff --git a/pkgs/tools/misc/debootstrap/default.nix b/pkgs/tools/misc/debootstrap/default.nix
index d12038a707d2..bf4319759fb6 100644
--- a/pkgs/tools/misc/debootstrap/default.nix
+++ b/pkgs/tools/misc/debootstrap/default.nix
@@ -4,13 +4,13 @@
 # There is also cdebootstrap now. Is that easier to maintain?
 stdenv.mkDerivation rec {
   name = "debootstrap-${version}";
-  version = "1.0.100";
+  version = "1.0.101";
 
   src = fetchurl {
     # git clone git://git.debian.org/d-i/debootstrap.git
     # I'd like to use the source. However it's lacking the lanny script ? (still true?)
     url = "mirror://debian/pool/main/d/debootstrap/debootstrap_${version}.tar.gz";
-    sha256 = "0jmwf26sq4bkdz6wi0dcjsrfkg8c8k3xdhi11xp6cdrw6qpw82ws";
+    sha256 = "1p1a81s8hq73byd7256iljdls389x2q7w6srgrgfmx5bl1csnzp3";
   };
 
   buildInputs = [ dpkg gettext gawk perl ];
diff --git a/pkgs/tools/networking/nzbget/default.nix b/pkgs/tools/networking/nzbget/default.nix
index ef65444ae331..20a448b0ded6 100644
--- a/pkgs/tools/networking/nzbget/default.nix
+++ b/pkgs/tools/networking/nzbget/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   name = "nzbget-${version}";
-  version = "19.1";
+  version = "20.0";
 
   src = fetchurl {
     url = "http://github.com/nzbget/nzbget/releases/download/v${version}/nzbget-${version}-src.tar.gz";
-    sha256 = "1rjwv555zc2hiagf00k8l1pzav91qglsnqbqkyy3pmn2d8sl5pq6";
+    sha256 = "0vyhmjg3ipjlv41il6kklys3m6rhqifdkv25a7ak772l6ba3dp04";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/tools/security/keybase/default.nix b/pkgs/tools/security/keybase/default.nix
index 331375273edd..47941a9d7787 100644
--- a/pkgs/tools/security/keybase/default.nix
+++ b/pkgs/tools/security/keybase/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "keybase-${version}";
-  version = "1.0.44";
+  version = "2.0.0";
 
   goPackagePath = "github.com/keybase/client";
   subPackages = [ "go/keybase" ];
@@ -13,7 +13,7 @@ buildGoPackage rec {
     owner  = "keybase";
     repo   = "client";
     rev    = "v${version}";
-    sha256 = "1np8fk15wwqkswzcyygga52r74dp101ny63i3m1wypgfky4hvsbb";
+    sha256 = "0lapcw9csr18n4pc1mlljs1bd8w8imzsic4qgr07s53i80bd8l6n";
   };
 
   buildFlags = [ "-tags production" ];
diff --git a/pkgs/tools/system/thermald/default.nix b/pkgs/tools/system/thermald/default.nix
index 1300a6a87655..27458174dc2a 100644
--- a/pkgs/tools/system/thermald/default.nix
+++ b/pkgs/tools/system/thermald/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "thermald-${version}";
-  version = "1.7.1";
+  version = "1.7.2";
 
   src = fetchFromGitHub {
     owner = "01org";
     repo = "thermal_daemon";
     rev = "v${version}";
-    sha256 = "0y0r8zcaxcnim3axc7kh5pm4py33pgv5mwh002cbrw6h90l2qzq1";
+    sha256 = "1cs2pq8xvfnsvrhg2bxawk4kn3z1qmfrnpnhs178pvfbglzh15hc";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/tools/text/fanficfare/default.nix b/pkgs/tools/text/fanficfare/default.nix
index 2ebab9d63904..7a395eb8905e 100644
--- a/pkgs/tools/text/fanficfare/default.nix
+++ b/pkgs/tools/text/fanficfare/default.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchurl, python27Packages }:
 
 python27Packages.buildPythonApplication rec {
-  version = "2.25.0";
+  version = "2.26.0";
   name = "fanficfare-${version}";
   nameprefix = "";
 
   src = fetchurl {
     url = "https://github.com/JimmXinu/FanFicFare/archive/v${version}.tar.gz";
-    sha256 = "1fval2jhrv3w762rmrbhbn8zj161aalvqy8n8q74yr8hzmpcvlwn";
+    sha256 = "1gas5x0xzkxnc0rvyi04phzxpxxd1jfmx9a7l2fhqmlw67lml4rr";
   };
 
   propagatedBuildInputs = with python27Packages; [ beautifulsoup4 chardet html5lib html2text ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1baef6881c2b..06a70709d84e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4148,6 +4148,8 @@ with pkgs;
 
   odpdown = callPackage ../tools/typesetting/odpdown { };
 
+  odpic = callPackage ../development/libraries/odpic { };
+
   odt2txt = callPackage ../tools/text/odt2txt { };
 
   offlineimap = callPackage ../tools/networking/offlineimap { };
@@ -7503,9 +7505,11 @@ with pkgs;
   spidermonkey_1_8_5 = callPackage ../development/interpreters/spidermonkey/1.8.5.nix { };
   spidermonkey_17 = callPackage ../development/interpreters/spidermonkey/17.nix { };
   spidermonkey_31 = callPackage ../development/interpreters/spidermonkey/31.nix { };
-  spidermonkey_38 = callPackage ../development/interpreters/spidermonkey/38.nix {
+  spidermonkey_38 = callPackage ../development/interpreters/spidermonkey/38.nix ({
     inherit (darwin) libobjc;
-  };
+  } // (stdenv.lib.optionalAttrs (stdenv.cc.isGNU && stdenv.hostPlatform.isi686) {
+      stdenv = overrideCC stdenv gcc6; # with gcc-7: undefined reference to `__divmoddi4'
+  }));
   spidermonkey_52 = callPackage ../development/interpreters/spidermonkey/52.nix { };
   spidermonkey = spidermonkey_31;
 
@@ -16298,6 +16302,7 @@ with pkgs;
   };
 
   hello = callPackage ../applications/misc/hello { };
+  hello-unfree = callPackage ../applications/misc/hello-unfree { };
 
   helmholtz = callPackage ../applications/audio/pd-plugins/helmholtz { };
 
@@ -17185,7 +17190,9 @@ with pkgs;
     inherit (gnome3) libgee;
   };
 
-  synapse-bt = callPackage ../applications/networking/p2p/synapse-bt { };
+  synapse-bt = callPackage ../applications/networking/p2p/synapse-bt {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   synfigstudio = callPackage ../applications/graphics/synfigstudio {
     fontsConf = makeFontsConf { fontDirectories = [ freefont_ttf ]; };
diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
index a53b16919ee3..c6be00b0288f 100644
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -51,8 +51,10 @@ in
     inherit (pkgs.llvmPackages) clang-unwrapped;
   };
 
+  iproute2mac = callPackage ../os-specific/darwin/iproute2mac { };
+
   libobjc = apple-source-releases.objc4;
-  
+
   lsusb = callPackage ../os-specific/darwin/lsusb { };
 
   opencflite = callPackage ../os-specific/darwin/opencflite { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 1f62f1e7c17f..e0ae870cae0f 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3731,6 +3731,8 @@ in {
   # These used to be here but were moved to all-packages, but I'll leave them around for a while.
   pants = pkgs.pants;
 
+  paperspace = callPackage ../development/python-modules/paperspace { };
+
   paperwork-backend = callPackage ../applications/office/paperwork/backend.nix { };
 
   papis-python-rofi = callPackage ../development/python-modules/papis-python-rofi { };