Merge staging into staging-next

pkgs/applications/virtualization/qemu/default.nix

@@ -35,7 +35,7 @@ let
 in
 
 stdenv.mkDerivation rec {
-  version = "3.1.0";
+  version = "4.0.0";
   name = "qemu-"
     + stdenv.lib.optionalString xenSupport "xen-"
     + stdenv.lib.optionalString hostCpuOnly "host-cpu-only-"
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://wiki.qemu.org/download/qemu-${version}.tar.bz2";
-    sha256 = "08frr1fdjx8qcfh3fafn10kibdwbvkqqvfl7hpqbm7i9dg4f1zlq";
+    sha256 = "085g6f75si8hbn94mnnjn1r7ysixn5bqj4bhqwvadj00fhzp2zvd";
   };
 
   nativeBuildInputs = [ python2 pkgconfig flex bison ];
@@ -78,13 +78,7 @@ stdenv.mkDerivation rec {
     ./no-etc-install.patch
     ./fix-qemu-ga.patch
     ./9p-ignore-noatime.patch
-    (fetchpatch {
-      name = "CVE-2019-3812.patch";
-      url = "https://git.qemu.org/?p=qemu.git;a=patch;h=b05b267840515730dbf6753495d5b7bd8b04ad1c";
-      sha256 = "03a5vc5wvirbyi5r8kb2r4m2w6f1zmh9bqsr2psh4pblwar0nf55";
-    })
   ] ++ optional nixosTestRunner ./force-uid0-on-9p.patch
-    ++ optional pulseSupport ./fix-hda-recording.patch
     ++ optionals stdenv.hostPlatform.isMusl [
     (fetchpatch {
       url = https://raw.githubusercontent.com/alpinelinux/aports/2bb133986e8fa90e2e76d53369f03861a87a74ef/main/qemu/xattr_size_max.patch;

pkgs/applications/virtualization/qemu/fix-hda-recording.patch

@@ -1,34 +0,0 @@
-diff --git a/audio/paaudio.c b/audio/paaudio.c
-index fea6071..c1169d4 100644
---- a/audio/paaudio.c
-+++ b/audio/paaudio.c
-@@ -608,6 +608,7 @@ static int qpa_init_in(HWVoiceIn *hw, struct audsettings *as, void *drv_opaque)
- {
-     int error;
-     pa_sample_spec ss;
-+    pa_buffer_attr ba;
-     struct audsettings obt_as = *as;
-     PAVoiceIn *pa = (PAVoiceIn *) hw;
-     paaudio *g = pa->g = drv_opaque;
-@@ -616,6 +617,12 @@ static int qpa_init_in(HWVoiceIn *hw, struct audsettings *as, void *drv_opaque)
-     ss.channels = as->nchannels;
-     ss.rate = as->freq;
-
-+    ba.fragsize = pa_frame_size (&ss) * g->conf.samples;
-+    ba.maxlength = 5 * ba.fragsize;
-+    ba.tlength = -1;
-+    ba.prebuf = -1;
-+    ba.minreq = -1;
-+
-     obt_as.fmt = pa_to_audfmt (ss.format, &obt_as.endianness);
-
-     pa->stream = qpa_simple_new (
-@@ -625,7 +632,7 @@ static int qpa_init_in(HWVoiceIn *hw, struct audsettings *as, void *drv_opaque)
-         g->conf.source,
-         &ss,
-         NULL,                   /* channel map */
--        NULL,                   /* buffering attributes */
-+        &ba,                    /* buffering attributes */
-         &error
-         );
-     if (!pa->stream) {

pkgs/applications/virtualization/qemu/no-etc-install.patch

@@ -1,10 +1,25 @@
+From 98b3e5993bbdb0013b6cc1814e0ad9555290c3af Mon Sep 17 00:00:00 2001
+From: Will Dietz <w@wdtz.org>
+Date: Tue, 23 Apr 2019 21:31:45 -0500
+Subject: [PATCH] no install localstatedir
+
+---
+ Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Makefile b/Makefile
+index 04a0d45050..5dc82d0eb7 100644
 --- a/Makefile
 +++ b/Makefile
-@@ -597,7 +597,7 @@
+@@ -786,7 +786,7 @@ endif
  
+ ICON_SIZES=16x16 24x24 32x32 48x48 64x64 128x128 256x256 512x512
  
 -install: all $(if $(BUILD_DOCS),install-doc) install-datadir install-localstatedir
 +install: all $(if $(BUILD_DOCS),install-doc) install-datadir
  ifneq ($(TOOLS),)
  	$(call install-prog,$(subst qemu-ga,qemu-ga$(EXESUF),$(TOOLS)),$(DESTDIR)$(bindir))
  endif
+-- 
+2.21.GIT
+

pkgs/build-support/nuke-references/builder.sh

@@ -7,7 +7,7 @@ cat > $out/bin/nuke-refs <<EOF
 excludes=""
 while getopts e: o; do
     case "\$o" in
-        e) storeId=\$(echo "\$OPTARG" | sed -n "s|^$NIX_STORE/\\([a-z0-9]\{32\}\\)-.*|\1|p")
+        e) storeId=\$(echo "\$OPTARG" | $perl/bin/perl -ne "print \"\\\$1\" if m|^\Q$NIX_STORE\E/([a-z0-9]{32})-.*|")
            if [ -z "\$storeId" ]; then
                echo "-e argument must be a Nix store path"
                exit 1
@@ -20,7 +20,7 @@ shift \$((\$OPTIND-1))
 
 for i in "\$@"; do
     if test ! -L "\$i" -a -f "\$i"; then
-        cat "\$i" | $perl/bin/perl -pe "s|$NIX_STORE/\$excludes[a-z0-9]{32}-|$NIX_STORE/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-|g" > "\$i.tmp"
+        cat "\$i" | $perl/bin/perl -pe "s|\Q$NIX_STORE\E/\$excludes[a-z0-9]{32}-|$NIX_STORE/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-|g" > "\$i.tmp"
         if test -x "\$i"; then chmod +x "\$i.tmp"; fi
         mv "\$i.tmp" "\$i"
     fi

pkgs/data/misc/cacert/setup-hook.sh

@@ -1,4 +1,6 @@
 cacertHook() {
+    export NIX_SSL_CERT_FILE=@out@/etc/ssl/certs/ca-bundle.crt
+    # left for compatibility
     export SSL_CERT_FILE=@out@/etc/ssl/certs/ca-bundle.crt
 }
 

pkgs/data/misc/publicsuffix-list/default.nix

@@ -0,0 +1,25 @@
+{ lib, fetchFromGitHub }:
+
+let
+  pname = "publicsuffix-list";
+  version = "2019-05-24";
+in fetchFromGitHub rec {
+  name = "${pname}-${version}";
+  owner = "publicsuffix";
+  repo = "list";
+  rev = "a1db0e898956e126de65be1a5e977fbbbbeebe33";
+  sha256 = "092153w2jr7nx28p9wc9k6b5azi9c39ghnqfnfiwfzv1j8jm3znq";
+
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
+    install -Dm0444 public_suffix_list.dat tests/test_psl.txt -t $out/share/publicsuffix
+  '';
+
+  meta = with lib; {
+    homepage = "https://publicsuffix.org/";
+    description = "Cross-vendor public domain suffix database";
+    platforms = platforms.all;
+    license = licenses.mpl20;
+    maintainers = [ maintainers.c0bw3b ];
+  };
+}

pkgs/development/compilers/go/1.11.nix

@@ -29,12 +29,12 @@ let
 in
 
 stdenv.mkDerivation rec {
-  name = "go-${version}";
+  pname = "go";
-  version = "1.11.6";
+  version = "1.11.10";
 
   src = fetchurl {
     url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "0cz1sdhxf9283p1p4jxb020pym0ncd0qlfh36r3hkv6bbm1a2vd9";
+    sha256 = "06rw962xigbrxblp942jbh7k133blpxg2xfrxi32qdhxkmmfj9yz";
   };
 
   # perl is used for testing go vet

pkgs/development/compilers/go/1.12.nix

@@ -29,12 +29,12 @@ let
 in
 
 stdenv.mkDerivation rec {
-  name = "go-${version}";
+  pname = "go";
-  version = "1.12.1";
+  version = "1.12.5";
 
   src = fetchurl {
     url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "12l12mmgqvy3nbscy7sz83qj4m6iz5a322aq9sk45f7l9ml2gq8b";
+    sha256 = "1s034pr60h20lsw171vbzqxqvcqn0s04dxfyqczyfcmkrf4g199a";
   };
 
   # perl is used for testing go vet

pkgs/development/interpreters/gauche/default.nix

@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     "--with-iconv=${libiconv}"
     "--with-dbm=gdbm"
     "--with-zlib=${zlib}"
-    "--with-ca-bundle=$SSL_CERT_FILE"
+    "--with-ca-bundle=$NIX_SSL_CERT_FILE"
     # TODO: Enable slib
     #       Current slib in nixpkgs is specialized to Guile
     # "--with-slib=${slibGuile}/lib/slib"

pkgs/development/interpreters/perl/default.nix

@@ -171,11 +171,11 @@ let
       priority = 6; # in `buildEnv' (including the one inside `perl.withPackages') the library files will have priority over files in `perl`
     };
   } // stdenv.lib.optionalAttrs (stdenv.buildPlatform != stdenv.hostPlatform) rec {
-    crossVersion = "9e4051cd28b7b3afb162776f5627c7abe4c7b9ea"; # Apr 21, 2019
+    crossVersion = "2152db1ea241f796206ab309036be1a7d127b370"; # May 25, 2019
 
     perl-cross-src = fetchurl {
       url = "https://github.com/arsv/perl-cross/archive/${crossVersion}.tar.gz";
-      sha256 = "0dj99w2dicbp3c3wn0k32785pc4c68iqnlyxswnza6mhw6wvl9v7";
+      sha256 = "1k08iqdkf9q00hbcq2b933w3vmds7xkfr90phhk0qf64l18wdrkf";
     };
 
     depsBuildBuild = [ buildPackages.stdenv.cc makeWrapper ];
@@ -199,11 +199,18 @@ in {
     sha256 = "1iynpsxdym4h76kgndmn3ykvwxhqz444xvaz8z2irsxkvmnlb5da";
   };
 
+  perl530 = common {
+    perl = pkgs.perl530;
+    buildPerl = buildPackages.perl530;
+    version = "5.30.0";
+    sha256 = "1wkmz6xn3fswpqhz29akiklcxclnlykhp96a8bqcz36rak3i64l5";
+  };
+
   # the latest Devel version
   perldevel = common {
     perl = pkgs.perldevel;
     buildPerl = buildPackages.perldevel;
-    version = "5.29.9";
+    version = "5.30.0";
-    sha256 = "017x3nghyc5m8q1yqnrdma96b3d5rlfx87vv5mi64jq0r8k6zppm";
+    sha256 = "1wkmz6xn3fswpqhz29akiklcxclnlykhp96a8bqcz36rak3i64l5";
   };
 }

pkgs/development/libraries/boost/generic.nix

@@ -97,9 +97,9 @@ let
 in
 
 stdenv.mkDerivation {
-  name = "boost-${version}";
+  pname = "boost";
 
-  inherit src;
+  inherit src version;
 
   patchFlags = "";
 
@@ -112,11 +112,10 @@ stdenv.mkDerivation {
   meta = {
     homepage = http://boost.org/;
     description = "Collection of C++ libraries";
-    license = stdenv.lib.licenses.boost;
+    license = licenses.boost;
-
     platforms = platforms.unix ++ platforms.windows;
-    badPlatforms = stdenv.lib.optional (versionOlder version "1.59") "aarch64-linux"
+    badPlatforms = optional (versionOlder version "1.59") "aarch64-linux"
-                 ++ stdenv.lib.optional ((versionOlder version "1.57") || version == "1.58") "x86_64-darwin";
+                 ++ optional ((versionOlder version "1.57") || version == "1.58") "x86_64-darwin";
     maintainers = with maintainers; [ peti ];
   };
 
@@ -158,16 +157,22 @@ stdenv.mkDerivation {
     ++ optional (toolset != null) "--with-toolset=${toolset}";
 
   buildPhase = ''
+    runHook preBuild
     ./b2 ${b2Args}
+    runHook postBuild
   '';
 
   installPhase = ''
+    runHook preInstall
+
     # boostbook is needed by some applications
     mkdir -p $dev/share/boostbook
     cp -a tools/boostbook/{xsl,dtd} $dev/share/boostbook/
 
     # Let boost install everything else
     ./b2 ${b2Args} install
+
+    runHook postInstall
   '';
 
   postFixup = ''

pkgs/development/libraries/gdbm/default.nix

@@ -1,12 +1,14 @@
 { stdenv, lib, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "gdbm-1.18.1";
+  pname = "gdbm";
+  version = "1.18.1";
+
   # FIXME: remove on update to > 1.18.1
   NIX_CFLAGS_COMPILE = if stdenv.cc.isClang then "-Wno-error=return-type" else null;
 
   src = fetchurl {
-    url = "mirror://gnu/gdbm/${name}.tar.gz";
+    url = "mirror://gnu/gdbm/${pname}-${version}.tar.gz";
     sha256 = "1p4ibds6z3ccy65lkmd6lm7js0kwifvl53r0fd759fjxgr917rl6";
   };
 
@@ -25,10 +27,12 @@ stdenv.mkDerivation rec {
       substituteInPlace tests/testsuite.at --replace \
         'm4_include([dbmfetch03.at])' ""
   '';
+
+  enableParallelBuilding = true;
   configureFlags = [ "--enable-libgdbm-compat" ];
 
-  postInstall = ''
   # create symlinks for compatibility
+  postInstall = ''
     install -dm755 $out/include/gdbm
     (
       cd $out/include/gdbm
@@ -40,9 +44,8 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "GNU dbm key/value database library";
-
+    longDescription = ''
-    longDescription =
+       GNU dbm (or GDBM, for short) is a library of database functions that
-      '' GNU dbm (or GDBM, for short) is a library of database functions that
        use extensible hashing and work similar to the standard UNIX dbm.
        These routines are provided to a programmer needing to create and
        manipulate a hashed database.
@@ -59,7 +62,6 @@ stdenv.mkDerivation rec {
        For compatibility with programs using old UNIX dbm function, the
        package also provides traditional dbm and ndbm interfaces.
       '';
-
     homepage = https://www.gnu.org/software/gdbm/;
     license = licenses.gpl3Plus;
     platforms = platforms.all;

pkgs/development/libraries/gnutls/default.nix

@@ -1,6 +1,6 @@
 { config, lib, stdenv, fetchurl, zlib, lzo, libtasn1, nettle, pkgconfig, lzip
 , perl, gmp, autoconf, autogen, automake, libidn, p11-kit, libiconv
-, unbound, dns-root-data, gettext
+, unbound, dns-root-data, gettext, cacert
 , guileBindings ? config.gnutls.guile or false, guile
 , tpmSupport ? false, trousers, which, nettools, libunistring
 , withSecurity ? false, Security  # darwin Security.framework
@@ -8,7 +8,7 @@
 
 assert guileBindings -> guile != null;
 let
-  version = "3.6.7";
+  version = "3.6.8";
 
   # XXX: Gnulib's `test-select' fails on FreeBSD:
   # http://hydra.nixos.org/build/2962084/nixlog/1/raw .
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "mirror://gnupg/gnutls/v3.6/gnutls-${version}.tar.xz";
-    sha256 = "1ql8l6l5bxks2pgpwb1602zc0j6ivhpy27hdfc49h8xgbanhjd2v";
+    sha256 = "10ry71sy8zbksa905bjryphafcg25gkmfa3pf48ripimar7990da";
   };
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
@@ -72,6 +72,9 @@ stdenv.mkDerivation {
   propagatedBuildInputs = [ nettle ];
 
   inherit doCheck;
+  # stdenv's `NIX_SSL_CERT_FILE=/no-cert-file.crt` broke tests with:
+  #   Error setting the x509 trust file: Error while reading file.
+  checkInputs = [ cacert ];
 
   # Fixup broken libtool and pkgconfig files
   preFixup = lib.optionalString (!isDarwin) ''

pkgs/development/libraries/icu/64.nix

@@ -0,0 +1,4 @@
+import ./base.nix {
+  version = "64.2";
+  sha256 = "0v0xsf14xwlj125y9fd8lrhsaych4d8liv8gr746zng6g225szb2";
+}

pkgs/development/libraries/libbytesize/default.nix

@@ -1,10 +1,10 @@
 { stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, gettext
 , gtk-doc, libxslt, docbook_xml_dtd_43, docbook_xsl
-, python3, pcre, gmp, mpfr
+, python3, pcre2, gmp, mpfr
 }:
 
 let
-  version = "1.4";
+  version = "2.0";
 in stdenv.mkDerivation rec {
   name = "libbytesize-${version}";
 
@@ -12,14 +12,14 @@ in stdenv.mkDerivation rec {
     owner = "storaged-project";
     repo = "libbytesize";
     rev = version;
-    sha256 = "1yxlc0f960rhqmh3fs3p0hvw0y2cikplgc27zsz6rn4h5dlrfmi2";
+    sha256 = "0m950idlyv6mbkhr8ngnda5l5wwb5lzs4wn4kxl73cvdlcvklmwj";
   };
 
   outputs = [ "out" "dev" "devdoc" ];
 
   nativeBuildInputs = [ autoreconfHook pkgconfig gettext gtk-doc libxslt docbook_xml_dtd_43 docbook_xsl python3 ];
 
-  buildInputs = [ pcre gmp mpfr ];
+  buildInputs = [ pcre2 gmp mpfr ];
 
   meta = with stdenv.lib; {
     description = "A tiny library providing a C “class” for working with arbitrary big sizes in bytes";

pkgs/development/libraries/libpsl/default.nix

@@ -1,34 +1,22 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, docbook_xsl, docbook_xml_dtd_43, gtk-doc, icu
+{ stdenv, fetchurl, autoreconfHook, docbook_xsl, docbook_xml_dtd_43, gtk-doc, lzip
-, libxslt, pkgconfig, python3 }:
+, libidn2, libunistring, libxslt, pkgconfig, python3, valgrind
+, publicsuffix-list
+}:
 
-let
+stdenv.mkDerivation rec {
+  pname = "libpsl";
+  version = "0.21.0";
 
-  listVersion = "2017-02-03";
+  src = fetchurl {
-  listSources = fetchFromGitHub {
+    url = "https://github.com/rockdaboot/${pname}/releases/download/${pname}-${version}/${pname}-${version}.tar.lz";
-    sha256 = "0fhc86pjv50hxj3xf9r4mh0zzvdzqp5lac20caaxq1hlvdzavaa3";
+    sha256 = "183hadbira0d2zvv8272lspy31dgm9x26z35c61s5axcd5wd9g9i";
-    rev = "37e30d13801eaad3383b122c11d8091c7ac21040";
-    repo = "list";
-    owner = "publicsuffix";
   };
 
-  libVersion = "0.20.2";
+  nativeBuildInputs = [ autoreconfHook docbook_xsl docbook_xml_dtd_43 gtk-doc lzip pkgconfig python3 valgrind ];
-
+  buildInputs = [ libidn2 libunistring libxslt ];
-in stdenv.mkDerivation rec {
+  propagatedBuildInputs = [ publicsuffix-list ];
-  name = "libpsl-${version}";
-  version = "${libVersion}-list-${listVersion}";
-
-  src = fetchFromGitHub {
-    sha256 = "0ijingxpnvl5xnna32j93ijagvjsvw2lhj71q39hz9xhzjzrda9b";
-    rev = "libpsl-${libVersion}";
-    repo = "libpsl";
-    owner = "rockdaboot";
-  };
-
-  buildInputs = [ icu libxslt ];
-  nativeBuildInputs = [ autoreconfHook docbook_xsl docbook_xml_dtd_43 gtk-doc pkgconfig python3 ];
 
   postPatch = ''
-    substituteInPlace src/psl.c --replace bits/stat.h sys/stat.h
     patchShebangs src/psl-make-dafsa
   '';
 
@@ -36,15 +24,14 @@ in stdenv.mkDerivation rec {
     gtkdocize
   '';
 
-  preConfigure = ''
-    # The libpsl check phase requires the list's test scripts (tests/) as well
-    cp -Rv "${listSources}"/* list
-  '';
   configureFlags = [
-    "--disable-builtin"
     "--disable-static"
     "--enable-gtk-doc"
     "--enable-man"
+    "--enable-valgrind-tests"
+    "--with-psl-distfile=${publicsuffix-list}/share/publicsuffix/public_suffix_list.dat"
+    "--with-psl-file=${publicsuffix-list}/share/publicsuffix/public_suffix_list.dat"
+    "--with-psl-testfile=${publicsuffix-list}/share/publicsuffix/test_psl.txt"
   ];
 
   enableParallelBuilding = true;
@@ -60,8 +47,10 @@ in stdenv.mkDerivation rec {
       "supercookies" and "super domain" certificates, for highlighting parts of
       the domain in a user interface or sorting domain lists by site.
     '';
-    homepage = http://rockdaboot.github.io/libpsl/;
+    homepage = "https://rockdaboot.github.io/libpsl/";
+    changelog = "https://raw.githubusercontent.com/rockdaboot/${pname}/${pname}-${version}/NEWS";
     license = licenses.mit;
-    platforms = with platforms; linux ++ darwin;
+    platforms = platforms.unix;
+    maintainers = [ maintainers.c0bw3b ];
   };
 }

pkgs/development/libraries/librsvg/default.nix

@@ -5,14 +5,14 @@
 
 let
   pname = "librsvg";
-  version = "2.44.13";
+  version = "2.44.14";
 in
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "13ybdfx1agp0is81hy699nqvzb4zg1msjyvsmqcx0hb41jzn1mnj";
+    sha256 = "00z3qimpk909pcqq0jlsis5sskc6kn7cqia20smd9k9rhs3ag1ba";
   };
 
   outputs = [ "out" "dev" "installedTests" ];

pkgs/development/libraries/libsoup/default.nix

@@ -5,11 +5,11 @@
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "libsoup";
-  version = "2.66.1";
+  version = "2.66.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "1zs3bhspwg7fggxd7x1rrggpkcf2j9ch6dhncq9syh252z0vcb2a";
+    sha256 = "0amfw1yvy1kjrg41rfh2vvrw5gkwnyckqbw1fab50hm6xc1acbmx";
   };
 
   postPatch = ''

pkgs/development/libraries/openssl/default.nix

@@ -136,6 +136,11 @@ in {
     sha256 = "0jza8cmznnyiia43056dij1jdmz62dx17wsn0zxksh9h6817nmaw";
     patches = [
       ./1.1/nix-ssl-cert-file.patch
+      (fetchurl {
+        name = "long-chacha-nonce.patch";
+        url = "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff_plain;h=f426625b6ae9a7831010750490a5f0ad689c5ba3";
+        sha256= "02ghqg3vzmzx3s1dwwwbm1p1l4asaiampyg4k9vfrjwficvgpdgp";
+      })
 
       (if stdenv.hostPlatform.isDarwin
        then ./1.1/use-etc-ssl-certs-darwin.patch

pkgs/development/libraries/sqlite/default.nix

@@ -9,7 +9,7 @@ let
 in
 
 stdenv.mkDerivation rec {
-  name = "sqlite-${version}";
+  pname = "sqlite";
   version = "3.28.0";
 
   # NB! Make sure to update analyzer.nix src (in the same directory).
@@ -71,6 +71,7 @@ stdenv.mkDerivation rec {
     sed -i $out/lib/libsqlite3.la -e "s/dependency_libs=.*/dependency_libs='''/"
   '';
 
+  enableParallelBuilding = true;
   doCheck = false; # fails to link against tcl
 
   meta = {

pkgs/development/libraries/webkitgtk/default.nix

@@ -15,7 +15,7 @@ assert stdenv.isDarwin -> !enableGtk2Plugins;
 with stdenv.lib;
 stdenv.mkDerivation rec {
   name = "webkitgtk-${version}";
-  version = "2.24.1";
+  version = "2.24.2";
 
   meta = {
     description = "Web content rendering engine, GTK+ port";
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://webkitgtk.org/releases/${name}.tar.xz";
-    sha256 = "0v9riwrmwi9wxbb8hlvcbyyxa9zxhcdk6s1xcspalk6asam8xjsk";
+    sha256 = "071jnjvjq6wsxx1jh4ql3j53h1nhphs5ga67fa5i9xjvs3qb3701";
   };
 
   patches = optionals stdenv.isDarwin [

pkgs/development/libraries/x265/default.nix

@@ -1,4 +1,5 @@
-{ stdenv, fetchurl, fetchpatch, cmake, yasm
+{ stdenv, fetchurl, fetchpatch, cmake, nasm, numactl
+, numaSupport ? stdenv.hostPlatform.isLinux && (stdenv.hostPlatform.isx86 || stdenv.hostPlatform.isAarch64)  # Enabled by default on NUMA platforms
 , debugSupport ? false # Run-time sanity checks (debugging)
 , highbitdepthSupport ? false # false=8bits per channel, true=10/12bits per channel
 , werrorSupport ? false # Warnings as errors
@@ -16,25 +17,19 @@ in
 
 stdenv.mkDerivation rec {
   name = "x265-${version}";
-  version = "2.9";
+  version = "3.0";
 
   src = fetchurl {
     urls = [
       "https://get.videolan.org/x265/x265_${version}.tar.gz"
       "ftp://ftp.videolan.org/pub/videolan/x265/x265_${version}.tar.gz"
     ];
-    sha256 = "090hp4216isis8q5gb7bwzia8rfyzni54z21jnwm97x3hiy6ibpb";
+    sha256 = "0qh65wdpasrspkm1y0dlfa123myax568yi0sas0lmg5b1hkgrff5";
   };
 
   enableParallelBuilding = true;
 
   patches = [
-    # Fix issue #442 (linking issue on non-x86 platforms)
-    # Applies on v2.9 only, this should be removed at next update
-    (fetchpatch {
-      url = "https://bitbucket.org/multicoreware/x265/commits/471726d3a0462739ff8e3518eb1a1e8a01de4e8d/raw";
-      sha256 = "0mj8lb8ng8lrhzjavap06vjhqf6j0r3sn76c6rhs3012f86lv928";
-    })
     # Fix build on ARM (#406)
     (fetchpatch {
       url = "https://bitbucket.org/multicoreware/x265/issues/attachments/406/multicoreware/x265/1527562952.26/406/X265-2.8-asm-primitives.patch";
@@ -67,7 +62,7 @@ stdenv.mkDerivation rec {
     rm $out/lib/*.a
   '';
 
-  nativeBuildInputs = [ cmake yasm ];
+  nativeBuildInputs = [ cmake nasm ] ++ stdenv.lib.optional numaSupport numactl;
 
   meta = with stdenv.lib; {
     description = "Library for encoding h.265/HEVC video streams";

pkgs/development/perl-modules/generic/default.nix

@@ -1,6 +1,6 @@
 { lib, stdenv, perl, buildPerl, toPerlModule }:
 
-{ nativeBuildInputs ? [], name, ... } @ attrs:
+{ buildInputs ? [], nativeBuildInputs ? [], name, ... } @ attrs:
 
 toPerlModule(stdenv.mkDerivation (
   (
@@ -36,6 +36,7 @@ toPerlModule(stdenv.mkDerivation (
   {
     name = "perl${perl.version}-${name}";
     builder = ./builder.sh;
+    buildInputs = buildInputs ++ [ perl ];
     nativeBuildInputs = nativeBuildInputs ++ [ (perl.dev or perl) ];
     fullperl = buildPerl;
   }

pkgs/development/python-modules/certifi/default.nix

@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "certifi";
-  version = "2018.11.29";
+  version = "2019.3.9";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1dvccavd2fzq4j37w0sznylp92ps14zi6gvlxzm23in0yhzciya7";
+    sha256 = "1bnpw7hrf9i1l9gfxjnzi45hkrvzz0pyn9ia8m4mw7sxhgb08qdj";
   };
 
   meta = {

pkgs/development/python-modules/elasticsearch-curator/default.nix

@@ -17,11 +17,11 @@
 
 buildPythonPackage rec {
   pname   = "elasticsearch-curator";
-  version = "5.6.0";
+  version = "5.7.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0r4p229233ivprxnvp33hilkgczijmyvi33wivxhhj6q3kkywpyq";
+    sha256 = "0a6q7jcqwcqf8cv76lzldf90hnj2x8gha754x515dq10zsi9sjms";
   };
 
   # The test hangs so we disable it.

pkgs/development/python-modules/elasticsearch-dsl/default.nix

@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "elasticsearch-dsl";
-  version = "6.3.1";
+  version = "7.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1gh8a0shqi105k325hgwb9avrpdjh0mc6mxwfg9ba7g6lssb702z";
+    sha256 = "08kgpcf6lp8gjan6dvdx35340i4yqa77klapk8j7165svfjc5v9a";
   };
 
   propagatedBuildInputs = [ elasticsearch python-dateutil six ]

pkgs/development/python-modules/elasticsearch/default.nix

@@ -7,11 +7,11 @@
 
 buildPythonPackage (rec {
   pname = "elasticsearch";
-  version = "6.3.1";
+  version = "7.0.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "aada5cfdc4a543c47098eb3aca6663848ef5d04b4324935ced441debc11ec98b";
+    sha256 = "0ax00k6xi7g419azjdn8g19zad304xmxw62pcfp3njawqnlnwp24";
   };
 
   # Check is disabled because running them destroy the content of the local cluster!

pkgs/development/tools/build-managers/meson/default.nix

@@ -1,5 +1,15 @@
 { lib, python3Packages, stdenv, writeTextDir, substituteAll, targetPackages }:
 
+let
+  # See https://mesonbuild.com/Reference-tables.html#cpu-families
+  cpuFamilies = {
+    "aarch64" = "aarch64";
+    "armv6l"  = "arm";
+    "armv7l"  = "arm";
+    "i686"    = "x86";
+    "x86_64"  = "x86_64";
+  };
+in
 python3Packages.buildPythonApplication rec {
   version = "0.49.2";
   pname = "meson";
@@ -62,13 +72,15 @@ python3Packages.buildPythonApplication rec {
     ar = '${targetPackages.stdenv.cc.bintools.targetPrefix}ar'
     strip = '${targetPackages.stdenv.cc.bintools.targetPrefix}strip'
     pkgconfig = 'pkg-config'
+    ld = '${targetPackages.stdenv.cc.targetPrefix}ld'
+    objcopy = '${targetPackages.stdenv.cc.targetPrefix}objcopy'
 
     [properties]
     needs_exe_wrapper = true
 
     [host_machine]
     system = '${targetPackages.stdenv.targetPlatform.parsed.kernel.name}'
-    cpu_family = '${targetPackages.stdenv.targetPlatform.parsed.cpu.family}'
+    cpu_family = '${cpuFamilies.${targetPackages.stdenv.targetPlatform.parsed.cpu.name}}'
     cpu = '${targetPackages.stdenv.targetPlatform.parsed.cpu.name}'
     endian = ${if targetPackages.stdenv.targetPlatform.isLittleEndian then "'little'" else "'big'"}
   '';

pkgs/development/tools/misc/gdb/default.nix

@@ -13,7 +13,7 @@
 
 let
   basename = "gdb-${version}";
-  version = "8.2.1";
+  version = "8.3";
 in
 
 assert pythonSupport -> python3 != null;
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnu/gdb/${basename}.tar.xz";
-    sha256 = "00i27xqawjv282a07i73lp1l02n0a3ywzhykma75qg500wll6sha";
+    sha256 = "0bnpzz0rl672xg5547q5qck2sxi6cnyixmk8bbb4gifw17ipwbw0";
   };
 
   patches = [

pkgs/development/tools/misc/swig/2.x.nix

@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, autoconf, automake, libtool, bison, pcre }:
 
 stdenv.mkDerivation rec {
-  name = "swig-${version}";
+  pname = "swig";
   version = "2.0.12";
 
   src = fetchFromGitHub {
@@ -16,8 +16,8 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--without-tcl" ];
 
+  # Disable ccache documentation as it needs yodl
   postPatch = ''
-    # Disable ccache documentation as it need yodl
     sed -i '/man1/d' CCache/Makefile.in
   '';
 
@@ -25,26 +25,11 @@ stdenv.mkDerivation rec {
     ./autogen.sh
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "SWIG, an interface compiler that connects C/C++ code to higher-level languages";
-
-    longDescription = ''
-       SWIG is an interface compiler that connects programs written in C and
-       C++ with languages such as Perl, Python, Ruby, Scheme, and Tcl.  It
-       works by taking the declarations found in C/C++ header files and using
-       them to generate the wrapper code that scripting languages need to
-       access the underlying C/C++ code.  In addition, SWIG provides a variety
-       of customization features that let you tailor the wrapping process to
-       suit your application.
-    '';
-
     homepage = http://swig.org/;
-
+    # Different types of licenses available: http://www.swig.org/Release/LICENSE .
-    # Licensing is a mess: http://www.swig.org/Release/LICENSE .
+    license = licenses.gpl3Plus;
-    license = "BSD-style";
+    platforms = with platforms; linux ++ darwin;
-
-    platforms = lib.platforms.linux ++ lib.platforms.darwin;
-
-    maintainers = [ ];
   };
 }

pkgs/development/tools/misc/swig/3.x.nix

@@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub, autoconf, automake, libtool, bison, pcre, buildPackages }:
 
 stdenv.mkDerivation rec {
-  name = "swig-${version}";
+  pname = "swig";
   version = "3.0.12";
 
   src = fetchFromGitHub {
@@ -17,8 +17,8 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--without-tcl" ];
 
+  # Disable ccache documentation as it needs yodl
   postPatch = ''
-    # Disable ccache documentation as it need yodl
     sed -i '/man1/d' CCache/Makefile.in
   '';
 

pkgs/development/tools/misc/swig/default.nix

@@ -1,10 +1,11 @@
 { stdenv, fetchurl, boost, tcl }:
 
 stdenv.mkDerivation rec {
-  name = "swig-1.3.40";
+  pname = "swig";
+  version = "1.3.40";
 
   src = fetchurl {
-    url = "mirror://sourceforge/swig/${name}.tar.gz";
+    url = "mirror://sourceforge/swig/${pname}-${version}.tar.gz";
     sha256 = "02dc8g8wy75nd2is1974rl24c6mdl0ai1vszs1xpg9nd7dlv6i8r";
   };
 
@@ -14,26 +15,12 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--disable-ccache" ];
 
-  meta = {
-    description = "Interface compiler that connects C/C++ code to higher-level languages";
-
-    longDescription = ''
-       SWIG is an interface compiler that connects programs written in C and
-       C++ with languages such as Perl, Python, Ruby, Scheme, and Tcl.  It
-       works by taking the declarations found in C/C++ header files and using
-       them to generate the wrapper code that scripting languages need to
-       access the underlying C/C++ code.  In addition, SWIG provides a variety
-       of customization features that let you tailor the wrapping process to
-       suit your application.
-    '';
 
+  meta = with stdenv.lib; {
+    description = "SWIG, an interface compiler that connects C/C++ code to higher-level languages";
     homepage = http://swig.org/;
-
+    # Different types of licenses available: http://www.swig.org/Release/LICENSE .
-    # Licensing is a mess: http://www.swig.org/Release/LICENSE .
+    license = licenses.gpl3Plus;
-    license = "BSD-style";
+    platforms = with platforms; linux ++ darwin;
-
-    platforms = stdenv.lib.platforms.all;
-
-    maintainers = [ ];
   };
 }

pkgs/development/tools/pypi2nix/default.nix

@@ -43,7 +43,7 @@ in stdenv.mkDerivation rec {
     mv click-*/click                    $out/pkgs/click
     mv requests-*/requests              $out/pkgs/
 
-    if [ "$IN_NIX_SHELL" != "1" ]; then
+    if [ -z "$IN_NIX_SHELL" ]; then
       if [ -e git-export ]; then
         mv git-export/src/pypi2nix      $out/pkgs/pypi2nix
       else

pkgs/misc/jackaudio/default.nix

@@ -1,9 +1,9 @@
 { stdenv, fetchFromGitHub, pkgconfig, python2Packages, makeWrapper
 , fetchpatch
 , bash, libsamplerate, libsndfile, readline, eigen, celt
-, wafHook, aften
+, wafHook
 # Darwin Dependencies
-, AudioUnit, CoreAudio, cf-private, libobjc, Accelerate
+, aften, AudioUnit, CoreAudio, cf-private, libobjc, Accelerate
 
 # Optional Dependencies
 , dbus ? null, libffado ? null, alsaLib ? null
@@ -40,9 +40,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig python makeWrapper wafHook ];
   buildInputs = [ libsamplerate libsndfile readline eigen celt
     optDbus optPythonDBus optLibffado optAlsaLib optLibopus
-    aften
   ] ++ optionals stdenv.isDarwin [
-    AudioUnit CoreAudio Accelerate cf-private libobjc
+    aften AudioUnit CoreAudio Accelerate cf-private libobjc
   ];
 
   prePatch = ''

pkgs/os-specific/linux/alsa-lib/default.nix

@@ -1,11 +1,11 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "alsa-lib-1.1.8";
+  name = "alsa-lib-1.1.9";
 
   src = fetchurl {
     url = "mirror://alsa/lib/${name}.tar.bz2";
-    sha256 = "1pxf0zkmps03l3zzd0fr828xhkg6a8hxljmbxzc2cyj2ls9kmp1w";
+    sha256 = "0jwr9g4yxg9gj6xx0sb2r6wrdl8amrjd19hilkrq4rirynp770s8";
   };
 
   patches = [

pkgs/os-specific/linux/systemd/default.nix

@@ -96,7 +96,7 @@ in stdenv.mkDerivation rec {
     "-Dsystem-gid-max=499"
     # "-Dtime-epoch=1"
 
-    (if stdenv.isAarch32 || stdenv.isAarch64 || !stdenv.hostPlatform.isEfi then "-Dgnu-efi=false" else "-Dgnu-efi=true")
+    (if !stdenv.hostPlatform.isEfi then "-Dgnu-efi=false" else "-Dgnu-efi=true")
     "-Defi-libdir=${toString gnu-efi}/lib"
     "-Defi-includedir=${toString gnu-efi}/include/efi"
     "-Defi-ldsdir=${toString gnu-efi}/lib"

pkgs/servers/dns/bind/default.nix

@@ -8,30 +8,22 @@
 assert enableSeccomp -> libseccomp != null;
 assert enablePython -> python3 != null;
 
-let version = "9.12.4-P1"; in
+let version = "9.14.2"; in
 
 stdenv.mkDerivation rec {
   name = "bind-${version}";
 
   src = fetchurl {
     url = "https://ftp.isc.org/isc/bind9/${version}/${name}.tar.gz";
-    sha256 = "1if7zc5gzrfd28csc63v9bjwrc0rgvm1x9yx058946hc5gp5lyp2";
+    sha256 = "033zqajnj5ys45g899132xkhh9f0hsh76ffv7302wl166xbjfh0f";
   };
 
   outputs = [ "out" "lib" "dev" "man" "dnsutils" "host" ];
 
-  patches = [ ./dont-keep-configure-flags.patch ./remove-mkdir-var.patch ] ++
+  patches = [
-    [
+    ./dont-keep-configure-flags.patch
-      # Workaround for missing atomic operations on aarch64. Upstream added the
+    ./remove-mkdir-var.patch
-      # below patch after the release. Can probably be dropped with the next
+  ] ++ stdenv.lib.optional stdenv.isDarwin ./darwin-openssl-linking-fix.patch;
-      # version.
-      (fetchpatch {
-        name = "client-atomics-as-refcount.patch";
-        url = https://gitlab.isc.org/isc-projects/bind9/commit/d72f436b7d7c697b262968c48c2d7643069ab17f.diff;
-        sha256 = "0sidlab9wcv21751fbq3h9m4wy6hk7frag9ar2jndw8rn3axr2qy";
-      })
-    ] ++
-    stdenv.lib.optional stdenv.isDarwin ./darwin-openssl-linking-fix.patch;
 
   nativeBuildInputs = [ perl ];
   buildInputs = [ libtool libxml2 openssl ]

pkgs/servers/dns/bind/dont-keep-configure-flags.patch

@@ -1,8 +1,8 @@
 diff --git a/bin/named/include/named/globals.h b/bin/named/include/named/globals.h
-index 388dc97..3c6135c 100644
+index b8e356b..cbe6c94 100644
 --- a/bin/named/include/named/globals.h
 +++ b/bin/named/include/named/globals.h
-@@ -65,7 +65,9 @@ EXTERN const char *		named_g_version		INIT(VERSION);
+@@ -68,7 +68,9 @@ EXTERN const char *		named_g_version		INIT(VERSION);
  EXTERN const char *		named_g_product		INIT(PRODUCT);
  EXTERN const char *		named_g_description	INIT(DESCRIPTION);
  EXTERN const char *		named_g_srcid		INIT(SRCID);
@@ -13,12 +13,12 @@ index 388dc97..3c6135c 100644
  EXTERN in_port_t		named_g_port		INIT(0);
  EXTERN isc_dscp_t		named_g_dscp		INIT(-1);
 diff --git a/bin/named/main.c b/bin/named/main.c
-index 4fb0566..60d56cd 100644
+index 62d9ce3..342abdc 100644
 --- a/bin/named/main.c
 +++ b/bin/named/main.c
-@@ -672,8 +672,10 @@ parse_command_line(int argc, char *argv[]) {
+@@ -459,8 +459,10 @@ printversion(bool verbose) {
- 			       (*named_g_description != '\0') ? " " : "",
+ 	}
- 			       named_g_description, named_g_srcid);
+ 
  	printf("running on %s\n", named_os_uname());
 +#if 0
  	printf("built by %s with %s\n",
@@ -27,7 +27,7 @@ index 4fb0566..60d56cd 100644
  #ifdef __clang__
  	printf("compiled by CLANG %s\n", __VERSION__);
  #else
-@@ -1075,9 +1077,11 @@ setup(void) {
+@@ -1001,9 +1003,11 @@ setup(void) {
  		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
  		      "running on %s", named_os_uname());
  

pkgs/stdenv/adapters.nix

@@ -60,6 +60,7 @@ rec {
           "--enable-static"
           "--disable-shared"
         ];
+        mesonFlags = (args.mesonFlags or []) ++ [ "-Ddefault_library=static" ];
       });
     };
 

pkgs/stdenv/generic/setup.sh

@@ -646,10 +646,13 @@ fi
 export NIX_BUILD_CORES
 
 
-# Prevent OpenSSL-based applications from using certificates in
+# Prevent SSL libraries from using certificates in /etc/ssl, unless set explicitly.
-# /etc/ssl.
+# Leave it in impure shells for convenience.
-# Leave it in shells for convenience.
+if [ -z "${NIX_SSL_CERT_FILE:-}" ] && [ "${IN_NIX_SHELL:-}" != "impure" ]; then
-if [ -z "${SSL_CERT_FILE:-}" ] && [ -z "${IN_NIX_SHELL:-}" ]; then
+  export NIX_SSL_CERT_FILE=/no-cert-file.crt
+fi
+# Another variant left for compatibility.
+if [ -z "${SSL_CERT_FILE:-}" ] && [ "${IN_NIX_SHELL:-}" != "impure" ]; then
   export SSL_CERT_FILE=/no-cert-file.crt
 fi
 

pkgs/tools/filesystems/e2fsprogs/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "e2fsprogs";
-  version = "1.45.0";
+  version = "1.45.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "1sgcjarfksa8bkx81q5cd6rzqvhzgs28a0ljwyr4ggqpfx7d18vk";
+    sha256 = "0zi8jz28hs66vhjvrfxmkmr1via19aygcbzpnw3lp0crhizaasgf";
   };
 
   outputs = [ "bin" "dev" "out" "man" "info" ];
@@ -20,16 +20,23 @@ stdenv.mkDerivation rec {
     else [
       (fetchpatch {
       url = "https://raw.githubusercontent.com/void-linux/void-packages/9583597eb3e6e6b33f61dbc615d511ce030bc443/srcpkgs/e2fsprogs/patches/fix-glibcism.patch";
-      sha256 = "1fyml1iwrs412xn2w36ra28am3sq4klrrj60lnf7rysyw069nxk3";
+      sha256 = "1gfcsr0i3q8q2f0lqza8na0iy4l4p3cbii51ds6zmj0y4hz2dwhb";
+      excludes = [ "lib/ext2fs/hashmap.h" ];
       extraPrefix = "";
       })
     ];
 
   configureFlags =
     if stdenv.isLinux then [
-      "--enable-elf-shlibs" "--enable-symlink-install" "--enable-relative-symlinks"
+      "--enable-elf-shlibs"
-      # libuuid, libblkid, uuidd and fsck are in util-linux-ng (the "libuuid" dependency).
+      "--enable-symlink-install"
-      "--disable-libuuid" "--disable-uuidd" "--disable-libblkid" "--disable-fsck"
+      "--enable-relative-symlinks"
+      "--with-crond-dir=no"
+      # fsck, libblkid, libuuid and uuidd are in util-linux-ng (the "libuuid" dependency)
+      "--disable-fsck"
+      "--disable-libblkid"
+      "--disable-libuuid"
+      "--disable-uuidd"
     ] else [
       "--enable-libuuid --disable-e2initrd-helper"
     ];

pkgs/tools/misc/ethtool/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "ethtool-${version}";
-  version = "5.0";
+  version = "5.1";
 
   src = fetchurl {
     url = "mirror://kernel/software/network/ethtool/${name}.tar.xz";
-    sha256 = "16gfkf001mdid1vjrxwri7fs4iwiy6d4lkrssljr2n13y0xj7m7c";
+    sha256 = "11rkvb1nga9hdiycw0hjn6lh1sfy4p4yzcl4fw5jjrb5xhgsrzk5";
   };
 
   meta = with stdenv.lib; {

pkgs/tools/misc/file/default.nix

@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   name = "file-${version}";
-  version = "5.36";
+  version = "5.37";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.astron.com/pub/file/${name}.tar.gz"
       "https://distfiles.macports.org/file/${name}.tar.gz"
     ];
-    sha256 = "0ya330cdkvfi2d28h8gvhghj4gnhysmifmryysl0a97xq2884q7v";
+    sha256 = "0zz0p9bqnswfx0c16j8k62ivjq1m16x10xqv4hy9lcyxyxkkkhg9";
   };
 
   nativeBuildInputs = stdenv.lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) file;

pkgs/tools/networking/curl/default.nix

@@ -24,14 +24,14 @@ assert brotliSupport -> brotli != null;
 assert gssSupport -> libkrb5 != null;
 
 stdenv.mkDerivation rec {
-  name = "curl-7.64.1";
+  name = "curl-7.65.0";
 
   src = fetchurl {
     urls = [
       "https://curl.haxx.se/download/${name}.tar.bz2"
       "https://github.com/curl/curl/releases/download/${lib.replaceStrings ["."] ["_"] name}/${name}.tar.bz2"
     ];
-    sha256 = "0pd484nk4q4dxjilwla3bw1l1jy44043xs991xld0l2jncwcgisc";
+    sha256 = "0p6z77iv6wlxq7skbnxn61rn8rangrp4g4spr09y920fcf7w0iza";
   };
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];

pkgs/top-level/all-packages.nix

@@ -2730,6 +2730,13 @@ in
           sha256 = "f15516df478d5a56180fbf80e68f206010e6d160fc39fa508b65e035fd75130b";
         };
       });
+      pyyaml = super.pyyaml.overridePythonAttrs (oldAttrs: rec {
+        version = "3.12";
+        src = oldAttrs.src.override {
+          inherit version;
+          sha256 = "1aqjl8dk9amd4zr99n8v2qxzgmr2hdvqfma4zh7a41rj6336c9sr";
+        };
+      });
     };
   }).pkgs; toPythonApplication elasticsearch-curator;
 
@@ -10919,8 +10926,13 @@ in
   } // (stdenv.lib.optionalAttrs (stdenv.cc.isGNU && stdenv.hostPlatform.isi686) {
       stdenv = overrideCC stdenv gcc6; # with gcc-7: undefined reference to `__divmoddi4'
     }));
+  icu64 = callPackage ../development/libraries/icu/64.nix ({
+    nativeBuildRoot = buildPackages.icu64.override { buildRootOnly = true; };
+  } // (stdenv.lib.optionalAttrs (stdenv.cc.isGNU && stdenv.hostPlatform.isi686) {
+      stdenv = overrideCC stdenv gcc6; # with gcc-7: undefined reference to `__divmoddi4'
+    }));
 
-  icu = icu59;
+  icu = icu64;
 
   id3lib = callPackage ../development/libraries/id3lib { };
 
@@ -13963,9 +13975,10 @@ in
   ### DEVELOPMENT / PERL MODULES
 
   perlInterpreters = callPackages ../development/interpreters/perl {};
-  inherit (perlInterpreters) perl528 perldevel;
+  inherit (perlInterpreters) perl528 perl530 perldevel;
 
   perl528Packages = recurseIntoAttrs perl528.pkgs;
+  perl530Packages = recurseIntoAttrs perl530.pkgs;
   perldevelPackages = perldevel.pkgs;
 
   perl = perl528;
@@ -16490,6 +16503,8 @@ in
 
   public-sans  = callPackage ../data/fonts/public-sans { };
 
+  publicsuffix-list = callPackage ../data/misc/publicsuffix-list { };
+
   qogir-theme = callPackage ../data/themes/qogir { };
 
   redhat-official-fonts = callPackage ../data/fonts/redhat-official { };