Merge staging-next into staging

2019-07-20 09:21:59 +02:00 · 2019-07-20 09:21:59 +02:00 · be25210e89
commit be25210e89
parent 214d73a46b 3b24d6e187
129 changed files with 4199 additions and 1404 deletions
--- a/.github/FUNDING.yml
+++ b/.github/FUNDING.yml
@ -1,3 +1,3 @@
 # These are supported funding model platforms

-custom: https://nixos.org/nixos/foundation.html
+open_collective: nixos
--- a/README.md
+++ b/README.md
@ -1,6 +1,7 @@
 [<img src="https://nixos.org/logo/nixos-hires.png" width="500px" alt="logo" />](https://nixos.org/nixos)

 [![Code Triagers Badge](https://www.codetriage.com/nixos/nixpkgs/badges/users.svg)](https://www.codetriage.com/nixos/nixpkgs)
+[![Open Collective supporters](https://opencollective.com/nixos/tiers/supporter/badge.svg?label=Supporter&color=brightgreen)](https://opencollective.com/nixos)

 Nixpkgs is a collection of packages for the [Nix](https://nixos.org/nix/) package
 manager. It is periodically built and tested by the [Hydra](https://hydra.nixos.org/)
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -250,6 +250,11 @@
    github = "akru";
    name = "Alexander Krupenkin ";
  };
+  alexarice = {
+    email = "alexrice999@hotmail.co.uk";
+    github = "alexarice";
+    name = "Alex Rice";
+  };
  alexchapman = {
    email = "alex@farfromthere.net";
    github = "AJChapman";
@ -2454,6 +2459,11 @@
    email = "me@joelt.io";
    name = "Joel Taylor";
  };
+  joepie91 = {
+    email = "admin@cryto.net";
+    name = "Sven Slootweg";
+    github = "joepie91";
+  };
  johanot = {
    email = "write@ownrisk.dk";
    github = "johanot";
@ -4537,11 +4547,6 @@
    github = "rzetterberg";
    name = "Richard Zetterberg";
  };
-  s1lvester = {
-    email = "s1lvester@bockhacker.me";
-    github = "s1lvester";
-    name = "Markus Silvester";
-  };
  samdroid-apps = {
    email = "sam@sam.today";
    github = "samdroid-apps";
@ -5763,9 +5768,9 @@
    name = "Christian Zagrodnick";
  };
  zalakain = {
-    email = "contact@unaizalakain.info";
+    email = "ping@umazalakain.info";
    github = "umazalakain";
-    name = "Unai Zalakain";
+    name = "Uma Zalakain";
  };
  zaninime = {
    email = "francesco@zanini.me";
--- a/nixos/modules/config/xdg/portal.nix
+++ b/nixos/modules/config/xdg/portal.nix
@ -0,0 +1,38 @@
+{ config, pkgs ,lib ,... }:
+with lib;
+{
+  options.xdg.portal = {
+    enable =
+      mkEnableOption "<link xlink:href='https://github.com/flatpak/xdg-desktop-portal'>xdg desktop integration</link>"//{
+        default = true;
+      };
+
+    extraPortals = mkOption {
+      type = types.listOf types.package;
+      default = [];
+      description = ''
+        List of additional portals to add to path. Portals allow interaction
+        with system, like choosing files or taking screenshots. At minimum,
+        a desktop portal implementation should be listed. GNOME and KDE already
+        adds <package>xdg-desktop-portal-gtk</package>; and
+        <package>xdg-desktop-portal-kde</package> respectively. On other desktop
+        environments you probably want to add them yourself.
+      '';
+    };
+  };
+
+  config =
+    let
+      cfg = config.xdg.portal;
+      packages = [ pkgs.xdg-desktop-portal ] ++ cfg.extraPortals;
+
+    in mkIf cfg.enable {
+
+      services.dbus.packages  = packages;
+      systemd.packages = packages;
+      environment.variables = {
+        GTK_USE_PORTAL = "1";
+        XDG_DESKTOP_PORTAL_PATH = map (p: "${p}/share/xdg-desktop-portal/portals") cfg.extraPortals;
+      };
+    };
+}
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -11,6 +11,7 @@
  ./config/xdg/icons.nix
  ./config/xdg/menus.nix
  ./config/xdg/mime.nix
+  ./config/xdg/portal.nix
  ./config/appstream.nix
  ./config/xdg/sounds.nix
  ./config/gtk/gtk-icon-cache.nix
@ -139,6 +140,7 @@
  ./programs/sway.nix
  ./programs/thefuck.nix
  ./programs/tmux.nix
+  ./programs/tsm-client.nix
  ./programs/udevil.nix
  ./programs/venus.nix
  ./programs/vim.nix
@ -210,6 +212,7 @@
  ./services/backup/restic-rest-server.nix
  ./services/backup/rsnapshot.nix
  ./services/backup/tarsnap.nix
+  ./services/backup/tsm.nix
  ./services/backup/znapzend.nix
  ./services/cluster/hadoop/default.nix
  ./services/cluster/kubernetes/addons/dns.nix
--- a/nixos/modules/programs/tsm-client.nix
+++ b/nixos/modules/programs/tsm-client.nix
@ -0,0 +1,287 @@
+{ config, lib, pkgs, ... }:
+
+let
+
+  inherit (builtins) length map;
+  inherit (lib.attrsets) attrNames filterAttrs hasAttr mapAttrs mapAttrsToList optionalAttrs;
+  inherit (lib.modules) mkDefault mkIf;
+  inherit (lib.options) literalExample mkEnableOption mkOption;
+  inherit (lib.strings) concatStringsSep optionalString toLower;
+  inherit (lib.types) addCheck attrsOf lines loaOf nullOr package path port str strMatching submodule;
+
+  # Checks if given list of strings contains unique
+  # elements when compared without considering case.
+  # Type: checkIUnique :: [string] -> bool
+  # Example: checkIUnique ["foo" "Foo"] => false
+  checkIUnique = lst:
+    let
+      lenUniq = l: length (lib.lists.unique l);
+    in
+      lenUniq lst == lenUniq (map toLower lst);
+
+  # TSM rejects servername strings longer than 64 chars.
+  servernameType = strMatching ".{1,64}";
+
+  serverOptions = { name, config, ... }: {
+    options.name = mkOption {
+      type = servernameType;
+      example = "mainTsmServer";
+      description = ''
+        Local name of the IBM TSM server,
+        must be uncapitalized and no longer than 64 chars.
+        The value will be used for the
+        <literal>server</literal>
+        directive in <filename>dsm.sys</filename>.
+      '';
+    };
+    options.server = mkOption {
+      type = strMatching ".+";
+      example = "tsmserver.company.com";
+      description = ''
+        Host/domain name or IP address of the IBM TSM server.
+        The value will be used for the
+        <literal>tcpserveraddress</literal>
+        directive in <filename>dsm.sys</filename>.
+      '';
+    };
+    options.port = mkOption {
+      type = addCheck port (p: p<=32767);
+      default = 1500;  # official default
+      description = ''
+        TCP port of the IBM TSM server.
+        The value will be used for the
+        <literal>tcpport</literal>
+        directive in <filename>dsm.sys</filename>.
+        TSM does not support ports above 32767.
+      '';
+    };
+    options.node = mkOption {
+      type = strMatching ".+";
+      example = "MY-TSM-NODE";
+      description = ''
+        Target node name on the IBM TSM server.
+        The value will be used for the
+        <literal>nodename</literal>
+        directive in <filename>dsm.sys</filename>.
+      '';
+    };
+    options.genPasswd = mkEnableOption ''
+      automatic client password generation.
+      This option influences the
+      <literal>passwordaccess</literal>
+      directive in <filename>dsm.sys</filename>.
+      The password will be stored in the directory
+      given by the option <option>passwdDir</option>.
+      <emphasis>Caution</emphasis>:
+      If this option is enabled and the server forces
+      to renew the password (e.g. on first connection),
+      a random password will be generated and stored
+    '';
+    options.passwdDir = mkOption {
+      type = path;
+      example = "/home/alice/tsm-password";
+      description = ''
+        Directory that holds the TSM
+        node's password information.
+        The value will be used for the
+        <literal>passworddir</literal>
+        directive in <filename>dsm.sys</filename>.
+      '';
+    };
+    options.includeExclude = mkOption {
+      type = lines;
+      default = "";
+      example = ''
+        exclude.dir     /nix/store
+        include.encrypt /home/.../*
+      '';
+      description = ''
+        <literal>include.*</literal> and
+        <literal>exclude.*</literal> directives to be
+        used when sending files to the IBM TSM server.
+        The lines will be written into a file that the
+        <literal>inclexcl</literal>
+        directive in <filename>dsm.sys</filename> points to.
+      '';
+    };
+    options.extraConfig = mkOption {
+      # TSM option keys are case insensitive;
+      # we have to ensure there are no keys that
+      # differ only by upper and lower case.
+      type = addCheck
+        (attrsOf (nullOr str))
+        (attrs: checkIUnique (attrNames attrs));
+      default = {};
+      example.compression = "yes";
+      example.passwordaccess = null;
+      description = ''
+        Additional key-value pairs for the server stanza.
+        Values must be strings, or <literal>null</literal>
+        for the key not to be used in the stanza
+        (e.g. to overrule values generated by other options).
+      '';
+    };
+    options.text = mkOption {
+      type = lines;
+      example = literalExample
+        ''lib.modules.mkAfter "compression no"'';
+      description = ''
+        Additional text lines for the server stanza.
+        This option can be used if certion configuration keys
+        must be used multiple times or ordered in a certain way
+        as the <option>extraConfig</option> option can't
+        control the order of lines in the resulting stanza.
+        Note that the <literal>server</literal>
+        line at the beginning of the stanza is
+        not part of this option's value.
+      '';
+    };
+    options.stanza = mkOption {
+      type = str;
+      internal = true;
+      visible = false;
+      description = "Server stanza text generated from the options.";
+    };
+    config.name = mkDefault name;
+    # Client system-options file directives are explained here:
+    # https://www.ibm.com/support/knowledgecenter/SSEQVQ_8.1.8/client/c_opt_usingopts.html
+    config.extraConfig =
+      mapAttrs (lib.trivial.const mkDefault) (
+        {
+          commmethod = "v6tcpip";  # uses v4 or v6, based on dns lookup result
+          tcpserveraddress = config.server;
+          tcpport = builtins.toString config.port;
+          nodename = config.node;
+          passwordaccess = if config.genPasswd then "generate" else "prompt";
+          passworddir = ''"${config.passwdDir}"'';
+        } // optionalAttrs (config.includeExclude!="") {
+          inclexcl = ''"${pkgs.writeText "inclexcl.dsm.sys" config.includeExclude}"'';
+        }
+      );
+    config.text =
+      let
+        attrset = filterAttrs (k: v: v!=null) config.extraConfig;
+        mkLine = k: v: k + optionalString (v!="") "  ${v}";
+        lines = mapAttrsToList mkLine attrset;
+      in
+        concatStringsSep "\n" lines;
+    config.stanza = ''
+      server  ${config.name}
+      ${config.text}
+    '';
+  };
+
+  options.programs.tsmClient = {
+    enable = mkEnableOption ''
+      IBM Spectrum Protect (Tivoli Storage Manager, TSM)
+      client command line applications with a
+      client system-options file "dsm.sys"
+    '';
+    servers = mkOption {
+      type = loaOf (submodule [ serverOptions ]);
+      default = {};
+      example.mainTsmServer = {
+        server = "tsmserver.company.com";
+        node = "MY-TSM-NODE";
+        extraConfig.compression = "yes";
+      };
+      description = ''
+        Server definitions ("stanzas")
+        for the client system-options file.
+      '';
+    };
+    defaultServername = mkOption {
+      type = nullOr servernameType;
+      default = null;
+      example = "mainTsmServer";
+      description = ''
+        If multiple server stanzas are declared with
+        <option>programs.tsmClient.servers</option>,
+        this option may be used to name a default
+        server stanza that IBM TSM uses in the absence of
+        a user-defined <filename>dsm.opt</filename> file.
+        This option translates to a
+        <literal>defaultserver</literal> configuration line.
+      '';
+    };
+    dsmSysText = mkOption {
+      type = lines;
+      readOnly = true;
+      description = ''
+        This configuration key contains the effective text
+        of the client system-options file "dsm.sys".
+        It should not be changed, but may be
+        used to feed the configuration into other
+        TSM-depending packages used on the system.
+      '';
+    };
+    package = mkOption {
+      type = package;
+      default = pkgs.tsm-client;
+      defaultText = "pkgs.tsm-client";
+      example = literalExample "pkgs.tsm-client-withGui";
+      description = ''
+        The TSM client derivation to be
+        added to the system environment.
+        It will called with <literal>.override</literal>
+        to add paths to the client system-options file.
+      '';
+    };
+    wrappedPackage = mkOption {
+      type = package;
+      readOnly = true;
+      description = ''
+        The TSM client derivation, wrapped with the path
+        to the client system-options file "dsm.sys".
+        This option is to provide the effective derivation
+        for other modules that want to call TSM executables.
+      '';
+    };
+  };
+
+  cfg = config.programs.tsmClient;
+
+  assertions = [
+    {
+      assertion = checkIUnique (mapAttrsToList (k: v: v.name) cfg.servers);
+      message = ''
+        TSM servernames contain duplicate name
+        (note that case doesn't matter!)
+      '';
+    }
+    {
+      assertion = (cfg.defaultServername!=null)->(hasAttr cfg.defaultServername cfg.servers);
+      message = "TSM defaultServername not found in list of servers";
+    }
+  ];
+
+  dsmSysText = ''
+    ****  IBM Spectrum Protect (Tivoli Storage Manager)
+    ****  client system-options file "dsm.sys".
+    ****  Do not edit!
+    ****  This file is generated by NixOS configuration.
+
+    ${optionalString (cfg.defaultServername!=null) "defaultserver  ${cfg.defaultServername}"}
+
+    ${concatStringsSep "\n" (mapAttrsToList (k: v: v.stanza) cfg.servers)}
+  '';
+
+in
+
+{
+
+  inherit options;
+
+  config = mkIf cfg.enable {
+    inherit assertions;
+    programs.tsmClient.dsmSysText = dsmSysText;
+    programs.tsmClient.wrappedPackage = cfg.package.override rec {
+      dsmSysCli = pkgs.writeText "dsm.sys" cfg.dsmSysText;
+      dsmSysApi = dsmSysCli;
+    };
+    environment.systemPackages = [ cfg.wrappedPackage ];
+  };
+
+  meta.maintainers = [ lib.maintainers.yarny ];
+
+}
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@ -19,6 +19,7 @@ with lib;
        let value = getAttrFromPath [ "services" "ddclient" "domain" ] config;
        in if value != "" then [ value ] else []))
    (mkRemovedOptionModule [ "services" "ddclient" "homeDir" ] "")
+    (mkRenamedOptionModule [ "services" "flatpak" "extraPortals" ] [ "xdg" "portal" "extraPortals" ])
    (mkRenamedOptionModule [ "services" "i2pd" "extIp" ] [ "services" "i2pd" "address" ])
    (mkRenamedOptionModule [ "services" "kubernetes" "apiserver" "admissionControl" ] [ "services" "kubernetes" "apiserver" "enableAdmissionPlugins" ])
    (mkRenamedOptionModule [ "services" "kubernetes" "apiserver" "address" ] ["services" "kubernetes" "apiserver" "bindAddress"])
--- a/nixos/modules/services/backup/tsm.nix
+++ b/nixos/modules/services/backup/tsm.nix
@ -0,0 +1,106 @@
+{ config, lib, ... }:
+
+let
+
+  inherit (lib.attrsets) hasAttr;
+  inherit (lib.modules) mkDefault mkIf;
+  inherit (lib.options) mkEnableOption mkOption;
+  inherit (lib.types) nullOr strMatching;
+
+  options.services.tsmBackup = {
+    enable = mkEnableOption ''
+      automatic backups with the
+      IBM Spectrum Protect (Tivoli Storage Manager, TSM) client.
+      This also enables
+      <option>programs.tsmClient.enable</option>
+    '';
+    command = mkOption {
+      type = strMatching ".+";
+      default = "backup";
+      example = "incr";
+      description = ''
+        The actual command passed to the
+        <literal>dsmc</literal> executable to start the backup.
+      '';
+    };
+    servername = mkOption {
+      type = strMatching ".+";
+      example = "mainTsmServer";
+      description = ''
+        Create a systemd system service
+        <literal>tsm-backup.service</literal> that starts
+        a backup based on the given servername's stanza.
+        Note that this server's
+        <option>passwdDir</option> will default to
+        <filename>/var/lib/tsm-backup/password</filename>
+        (but may be overridden);
+        also, the service will use
+        <filename>/var/lib/tsm-backup</filename> as
+        <literal>HOME</literal> when calling
+        <literal>dsmc</literal>.
+      '';
+    };
+    autoTime = mkOption {
+      type = nullOr (strMatching ".+");
+      default = null;
+      example = "12:00";
+      description = ''
+        The backup service will be invoked
+        automatically at the given date/time,
+        which must be in the format described in
+        <citerefentry><refentrytitle>systemd.time</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
+        The default <literal>null</literal>
+        disables automatic backups.
+      '';
+    };
+  };
+
+  cfg = config.services.tsmBackup;
+  cfgPrg = config.programs.tsmClient;
+
+  assertions = [
+    {
+      assertion = hasAttr cfg.servername cfgPrg.servers;
+      message = "TSM service servername not found in list of servers";
+    }
+    {
+      assertion = cfgPrg.servers.${cfg.servername}.genPasswd;
+      message = "TSM service requires automatic password generation";
+    }
+  ];
+
+in
+
+{
+
+  inherit options;
+
+  config = mkIf cfg.enable {
+    inherit assertions;
+    programs.tsmClient.enable = true;
+    programs.tsmClient.servers."${cfg.servername}".passwdDir =
+      mkDefault "/var/lib/tsm-backup/password";
+    systemd.services.tsm-backup = {
+      description = "IBM Spectrum Protect (Tivoli Storage Manager) Backup";
+      # DSM_LOG needs a trailing slash to have it treated as a directory.
+      # `/var/log` would be littered with TSM log files otherwise.
+      environment.DSM_LOG = "/var/log/tsm-backup/";
+      # TSM needs a HOME dir to store certificates.
+      environment.HOME = "/var/lib/tsm-backup";
+      # for exit status description see
+      # https://www.ibm.com/support/knowledgecenter/en/SSEQVQ_8.1.8/client/c_sched_rtncode.html
+      serviceConfig.SuccessExitStatus = "4 8";
+      # The `-se` option must come after the command.
+      # The `-optfile` option suppresses a `dsm.opt`-not-found warning.
+      serviceConfig.ExecStart =
+        "${cfgPrg.wrappedPackage}/bin/dsmc ${cfg.command} -se='${cfg.servername}' -optfile=/dev/null";
+      serviceConfig.LogsDirectory = "tsm-backup";
+      serviceConfig.StateDirectory = "tsm-backup";
+      serviceConfig.StateDirectoryMode = "0750";
+      startAt = mkIf (cfg.autoTime!=null) cfg.autoTime;
+    };
+  };
+
+  meta.maintainers = [ lib.maintainers.yarny ];
+
+}
--- a/nixos/modules/services/desktops/flatpak.nix
+++ b/nixos/modules/services/desktops/flatpak.nix
@ -15,38 +15,22 @@ in {
  options = {
    services.flatpak = {
      enable = mkEnableOption "flatpak";
-
-      extraPortals = mkOption {
-        type = types.listOf types.package;
-        default = [];
-        description = ''
-          List of additional portals to add to path. Portals allow interaction
-          with system, like choosing files or taking screenshots. At minimum,
-          a desktop portal implementation should be listed. GNOME already
-          adds <package>xdg-desktop-portal-gtk</package>; for KDE, there
-          is <package>xdg-desktop-portal-kde</package>. Other desktop
-          environments will probably want to do the same.
-        '';
-      };
    };
  };


  ###### implementation
  config = mkIf cfg.enable {
+
    environment.systemPackages = [ pkgs.flatpak ];

-    services.dbus.packages = [ pkgs.flatpak pkgs.xdg-desktop-portal ] ++ cfg.extraPortals;
+    services.dbus.packages = [ pkgs.flatpak ];

-    systemd.packages = [ pkgs.flatpak pkgs.xdg-desktop-portal ] ++ cfg.extraPortals;
+    systemd.packages = [ pkgs.flatpak ];

    environment.profiles = [
      "$HOME/.local/share/flatpak/exports"
      "/var/lib/flatpak/exports"
    ];
-
-    environment.variables = {
-      XDG_DESKTOP_PORTAL_PATH = map (p: "${p}/share/xdg-desktop-portal/portals") cfg.extraPortals;
-    };
  };
 }
--- a/nixos/modules/services/desktops/flatpak.xml
+++ b/nixos/modules/services/desktops/flatpak.xml
@ -29,7 +29,7 @@
  in other cases, you will need to add something like the following to your
  <filename>configuration.nix</filename>:
 <programlisting>
-  <xref linkend="opt-services.flatpak.extraPortals"/> = [ pkgs.xdg-desktop-portal-gtk ];
+  <xref linkend="opt-xdg.portal.extraPortals"/> = [ pkgs.xdg-desktop-portal-gtk ];
 </programlisting>
 </para>
 <para>
--- a/nixos/modules/services/mail/postfix.nix
+++ b/nixos/modules/services/mail/postfix.nix
@ -13,6 +13,7 @@ let
                      || cfg.extraAliases != "";
  haveTransport = cfg.transport != "";
  haveVirtual = cfg.virtual != "";
+  haveLocalRecipients = cfg.localRecipients != null;

  clientAccess =
    optional (cfg.dnsBlacklistOverrides != "")
@ -244,6 +245,7 @@ let

  aliasesFile = pkgs.writeText "postfix-aliases" aliases;
  virtualFile = pkgs.writeText "postfix-virtual" cfg.virtual;
+  localRecipientMapFile = pkgs.writeText "postfix-local-recipient-map" (concatMapStrings (x: x + " ACCEPT\n") cfg.localRecipients);
  checkClientAccessFile = pkgs.writeText "postfix-check-client-access" cfg.dnsBlacklistOverrides;
  mainCfFile = pkgs.writeText "postfix-main.cf" mainCf;
  masterCfFile = pkgs.writeText "postfix-master.cf" masterCfContent;
@ -506,6 +508,19 @@ in
        '';
      };

+      localRecipients = mkOption {
+        type = with types; nullOr (listOf string);
+        default = null;
+        description = ''
+          List of accepted local users. Specify a bare username, an
+          <literal>"@domain.tld"</literal> wild-card, or a complete
+          <literal>"user@domain.tld"</literal> address. If set, these names end
+          up in the local recipient map -- see the local(8) man-page -- and
+          effectively replace the system user database lookup that's otherwise
+          used by default.
+        '';
+      };
+
      transport = mkOption {
        default = "";
        description = "
@ -742,6 +757,7 @@ in
      // optionalAttrs haveAliases { alias_maps = [ "${cfg.aliasMapType}:/etc/postfix/aliases" ]; }
      // optionalAttrs haveTransport { transport_maps = [ "hash:/etc/postfix/transport" ]; }
      // optionalAttrs haveVirtual { virtual_alias_maps = [ "${cfg.virtualMapType}:/etc/postfix/virtual" ]; }
+      // optionalAttrs haveLocalRecipients { local_recipient_maps = [ "hash:/etc/postfix/local_recipients" ] ++ optional haveAliases "$alias_maps"; }
      // optionalAttrs (cfg.dnsBlacklists != []) { smtpd_client_restrictions = clientRestrictions; }
      // optionalAttrs cfg.useSrs {
        sender_canonical_maps = [ "tcp:127.0.0.1:10001" ];
@ -869,6 +885,9 @@ in
    (mkIf haveVirtual {
      services.postfix.mapFiles."virtual" = virtualFile;
    })
+    (mkIf haveLocalRecipients {
+      services.postfix.mapFiles."local_recipients" = localRecipientMapFile;
+    })
    (mkIf cfg.enableHeaderChecks {
      services.postfix.mapFiles."header_checks" = headerChecksFile;
    })
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@ -52,7 +52,7 @@ let
    gitlab_url = "http+unix://${pathUrlQuote gitlabSocket}";
    http_settings.self_signed_cert = false;
    repos_path = "${cfg.statePath}/repositories";
-    secret_file = "${cfg.statePath}/config/gitlab_shell_secret";
+    secret_file = "${cfg.statePath}/gitlab_shell_secret";
    log_file = "${cfg.statePath}/log/gitlab-shell.log";
    custom_hooks_dir = "${cfg.statePath}/custom_hooks";
    redis = {
@ -109,7 +109,7 @@ let
      gitlab_shell = {
        path = "${cfg.packages.gitlab-shell}";
        hooks_path = "${cfg.statePath}/shell/hooks";
-        secret_file = "${cfg.statePath}/config/gitlab_shell_secret";
+        secret_file = "${cfg.statePath}/gitlab_shell_secret";
        upload_pack = true;
        receive_pack = true;
      };
@ -132,14 +132,9 @@ let
    HOME = "${cfg.statePath}/home";
    UNICORN_PATH = "${cfg.statePath}/";
    GITLAB_PATH = "${cfg.packages.gitlab}/share/gitlab/";
-    GITLAB_STATE_PATH = cfg.statePath;
-    GITLAB_UPLOADS_PATH = "${cfg.statePath}/uploads";
    SCHEMA = "${cfg.statePath}/db/schema.rb";
+    GITLAB_UPLOADS_PATH = "${cfg.statePath}/uploads";
    GITLAB_LOG_PATH = "${cfg.statePath}/log";
-    GITLAB_SHELL_PATH = "${cfg.packages.gitlab-shell}";
-    GITLAB_SHELL_CONFIG_PATH = "${cfg.statePath}/shell/config.yml";
-    GITLAB_SHELL_SECRET_PATH = "${cfg.statePath}/config/gitlab_shell_secret";
-    GITLAB_SHELL_HOOKS_PATH = "${cfg.statePath}/shell/hooks";
    GITLAB_REDIS_CONFIG_FILE = pkgs.writeText "redis.yml" (builtins.toJSON redisConfig);
    prometheus_multiproc_dir = "/run/gitlab";
    RAILS_ENV = "production";
@ -502,23 +497,43 @@ in {
    systemd.tmpfiles.rules = [
      "d /run/gitlab 0755 ${cfg.user} ${cfg.group} -"
      "d ${gitlabEnv.HOME} 0750 ${cfg.user} ${cfg.group} -"
+      "z ${gitlabEnv.HOME}/.ssh/authorized_keys 0600 ${cfg.user} ${cfg.group} -"
      "d ${cfg.backupPath} 0750 ${cfg.user} ${cfg.group} -"
+      "d ${cfg.statePath} 0750 ${cfg.user} ${cfg.group} -"
      "d ${cfg.statePath}/builds 0750 ${cfg.user} ${cfg.group} -"
      "d ${cfg.statePath}/config 0750 ${cfg.user} ${cfg.group} -"
      "d ${cfg.statePath}/db 0750 ${cfg.user} ${cfg.group} -"
      "d ${cfg.statePath}/log 0750 ${cfg.user} ${cfg.group} -"
      "d ${cfg.statePath}/repositories 2770 ${cfg.user} ${cfg.group} -"
      "d ${cfg.statePath}/shell 0750 ${cfg.user} ${cfg.group} -"
+      "d ${cfg.statePath}/tmp 0750 ${cfg.user} ${cfg.group} -"
      "d ${cfg.statePath}/tmp/pids 0750 ${cfg.user} ${cfg.group} -"
      "d ${cfg.statePath}/tmp/sockets 0750 ${cfg.user} ${cfg.group} -"
      "d ${cfg.statePath}/uploads 0700 ${cfg.user} ${cfg.group} -"
+      "d ${cfg.statePath}/custom_hooks 0700 ${cfg.user} ${cfg.group} -"
      "d ${cfg.statePath}/custom_hooks/pre-receive.d 0700 ${cfg.user} ${cfg.group} -"
      "d ${cfg.statePath}/custom_hooks/post-receive.d 0700 ${cfg.user} ${cfg.group} -"
      "d ${cfg.statePath}/custom_hooks/update.d 0700 ${cfg.user} ${cfg.group} -"
+      "d ${gitlabConfig.production.shared.path} 0750 ${cfg.user} ${cfg.group} -"
      "d ${gitlabConfig.production.shared.path}/artifacts 0750 ${cfg.user} ${cfg.group} -"
      "d ${gitlabConfig.production.shared.path}/lfs-objects 0750 ${cfg.user} ${cfg.group} -"
      "d ${gitlabConfig.production.shared.path}/pages 0750 ${cfg.user} ${cfg.group} -"
-    ];
+      "L+ ${cfg.statePath}/lib - - - - ${cfg.packages.gitlab}/share/gitlab/lib"
+      "L+ /run/gitlab/config - - - - ${cfg.statePath}/config"
+      "L+ /run/gitlab/log - - - - ${cfg.statePath}/log"
+      "L+ /run/gitlab/tmp - - - - ${cfg.statePath}/tmp"
+      "L+ /run/gitlab/uploads - - - - ${cfg.statePath}/uploads"
+
+      "L+ /run/gitlab/shell-config.yml - - - - ${pkgs.writeText "config.yml" (builtins.toJSON gitlabShellConfig)}"
+
+      "L+ ${cfg.statePath}/config/gitlab.yml - - - - ${pkgs.writeText "gitlab.yml" (builtins.toJSON gitlabConfig)}"
+      "L+ ${cfg.statePath}/config/database.yml - - - - ${pkgs.writeText "database.yml" (builtins.toJSON databaseConfig)}"
+      "L+ ${cfg.statePath}/config/secrets.yml - - - - ${pkgs.writeText "secrets.yml" (builtins.toJSON secretsConfig)}"
+      "L+ ${cfg.statePath}/config/unicorn.rb - - - - ${./defaultUnicornConfig.rb}"
+
+      "L+ ${cfg.statePath}/config/initializers/extra-gitlab.rb - - - - ${extraGitlabRb}"
+    ] ++ optional cfg.smtp.enable
+      "L+ ${cfg.statePath}/config/initializers/smtp_settings.rb - - - - ${smtpSettings}" ;

    systemd.services.gitlab-sidekiq = {
      after = [ "network.target" "redis.service" "gitlab.service" ];
@ -609,40 +624,14 @@ in {
        gnupg
      ];
      preStart = ''
-        cp -rf ${cfg.packages.gitlab}/share/gitlab/db/* ${cfg.statePath}/db
-        rm -rf ${cfg.statePath}/config
-        mkdir ${cfg.statePath}/config
-        if [ -e ${cfg.statePath}/lib ]; then
-          rm ${cfg.statePath}/lib
-        fi
+        ${pkgs.sudo}/bin/sudo -u ${cfg.user} cp -f ${cfg.packages.gitlab}/share/gitlab/VERSION ${cfg.statePath}/VERSION
+        ${pkgs.sudo}/bin/sudo -u ${cfg.user} rm -rf ${cfg.statePath}/db/*
+        ${pkgs.sudo}/bin/sudo -u ${cfg.user} cp -rf --no-preserve=mode ${cfg.packages.gitlab}/share/gitlab/config.dist/* ${cfg.statePath}/config
+        ${pkgs.sudo}/bin/sudo -u ${cfg.user} cp -rf --no-preserve=mode ${cfg.packages.gitlab}/share/gitlab/db/* ${cfg.statePath}/db

-        ln -sf ${cfg.packages.gitlab}/share/gitlab/lib ${cfg.statePath}/lib
-        [ -L /run/gitlab/config ] || ln -sf ${cfg.statePath}/config /run/gitlab/config
-        [ -L /run/gitlab/log ] || ln -sf ${cfg.statePath}/log /run/gitlab/log
-        [ -L /run/gitlab/tmp ] || ln -sf ${cfg.statePath}/tmp /run/gitlab/tmp
-        [ -L /run/gitlab/uploads ] || ln -sf ${cfg.statePath}/uploads /run/gitlab/uploads
-        cp ${cfg.packages.gitlab}/share/gitlab/VERSION ${cfg.statePath}/VERSION
-        cp -rf ${cfg.packages.gitlab}/share/gitlab/config.dist/* ${cfg.statePath}/config
-        ln -sf ${extraGitlabRb} ${cfg.statePath}/config/initializers/extra-gitlab.rb
-        ${optionalString cfg.smtp.enable ''
-          ln -sf ${smtpSettings} ${cfg.statePath}/config/initializers/smtp_settings.rb
-        ''}
-        ${pkgs.openssl}/bin/openssl rand -hex 32 > ${cfg.statePath}/config/gitlab_shell_secret
+        ${pkgs.openssl}/bin/openssl rand -hex 32 > ${cfg.statePath}/gitlab_shell_secret

-        # JSON is a subset of YAML
-        ln -sf ${pkgs.writeText "gitlab.yml" (builtins.toJSON gitlabConfig)} ${cfg.statePath}/config/gitlab.yml
-        ln -sf ${pkgs.writeText "database.yml" (builtins.toJSON databaseConfig)} ${cfg.statePath}/config/database.yml
-        ln -sf ${pkgs.writeText "secrets.yml" (builtins.toJSON secretsConfig)} ${cfg.statePath}/config/secrets.yml
-        ln -sf ${./defaultUnicornConfig.rb} ${cfg.statePath}/config/unicorn.rb
-
-        # Install the shell required to push repositories
-        ln -sf ${pkgs.writeText "config.yml" (builtins.toJSON gitlabShellConfig)} /run/gitlab/shell-config.yml
-        [ -L ${cfg.statePath}/shell/hooks ] ||  ln -sf ${cfg.packages.gitlab-shell}/hooks ${cfg.statePath}/shell/hooks
-        ${cfg.packages.gitlab-shell}/bin/install
-
-        chown -R ${cfg.user}:${cfg.group} ${cfg.statePath}/
-        chmod -R ug+rwX,o-rwx+X ${cfg.statePath}/
-        chown -R ${cfg.user}:${cfg.group} /run/gitlab
+        ${pkgs.sudo}/bin/sudo -u ${cfg.user} ${cfg.packages.gitlab-shell}/bin/install

        if ! test -e "${cfg.statePath}/db-created"; then
          if [ "${cfg.databaseHost}" = "127.0.0.1" ]; then
@ -655,7 +644,7 @@ in {

          ${pkgs.sudo}/bin/sudo -u ${cfg.user} -H ${gitlab-rake}/bin/gitlab-rake db:schema:load

-          touch "${cfg.statePath}/db-created"
+          ${pkgs.sudo}/bin/sudo -u ${cfg.user} touch "${cfg.statePath}/db-created"
        fi

        # Always do the db migrations just to be sure the database is up-to-date
@ -664,22 +653,13 @@ in {
        if ! test -e "${cfg.statePath}/db-seeded"; then
          ${pkgs.sudo}/bin/sudo -u ${cfg.user} ${gitlab-rake}/bin/gitlab-rake db:seed_fu \
            GITLAB_ROOT_PASSWORD='${cfg.initialRootPassword}' GITLAB_ROOT_EMAIL='${cfg.initialRootEmail}'
-          touch "${cfg.statePath}/db-seeded"
+          ${pkgs.sudo}/bin/sudo -u ${cfg.user} touch "${cfg.statePath}/db-seeded"
        fi

-        # The gitlab:shell:create_hooks task seems broken for fixing links
-        # so we instead delete all the hooks and create them anew
+        # We remove potentially broken links to old gitlab-shell versions
        rm -f ${cfg.statePath}/repositories/**/*.git/hooks
-        ${pkgs.sudo}/bin/sudo -u ${cfg.user} -H ${gitlab-rake}/bin/gitlab-rake gitlab:shell:create_hooks

        ${pkgs.sudo}/bin/sudo -u ${cfg.user} -H ${pkgs.git}/bin/git config --global core.autocrlf "input"
-
-        # Change permissions in the last step because some of the
-        # intermediary scripts like to create directories as root.
-        chmod -R u+rwX,go-rwx+X ${gitlabEnv.HOME}
-        chmod -R ug+rwX,o-rwx ${cfg.statePath}/repositories
-        chmod -R ug-s ${cfg.statePath}/repositories
-        find ${cfg.statePath}/repositories -type d -print0 | xargs -0 chmod g+s
      '';

      serviceConfig = {
--- a/nixos/modules/services/security/tor.nix
+++ b/nixos/modules/services/security/tor.nix
@ -81,7 +81,7 @@ let

    ${optionalString (elem cfg.relay.role ["bridge" "private-bridge"]) ''
      BridgeRelay 1
-      ServerTransportPlugin ${concatStringsSep "," cfg.relay.bridgeTransports} exec ${obfs4}/bin/obfs4proxy managed
+      ServerTransportPlugin ${concatStringsSep "," cfg.relay.bridgeTransports} exec ${pkgs.obfs4}/bin/obfs4proxy managed
      ExtORPort auto
      ${optionalString (cfg.relay.role == "private-bridge") ''
        ExtraInfoStatistics 0
--- a/nixos/modules/services/x11/desktop-managers/gnome3.nix
+++ b/nixos/modules/services/x11/desktop-managers/gnome3.nix
@ -154,7 +154,7 @@ in {
    services.hardware.bolt.enable = mkDefault true;
    services.xserver.libinput.enable = mkDefault true; # for controlling touchpad settings via gnome control center
    systemd.packages = [ pkgs.gnome3.vino ];
-    services.flatpak.extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
+    xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-gtk ];

    # If gnome3 is installed, build vim for gtk3 too.
    nixpkgs.config.vim.gui = "gtk3";
--- a/nixos/modules/services/x11/desktop-managers/pantheon.nix
+++ b/nixos/modules/services/x11/desktop-managers/pantheon.nix
@ -145,6 +145,8 @@ in
      isSystem = true;
    };

+    xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
+
    networking.networkmanager.enable = mkDefault true;
    networking.networkmanager.basePackages =
      { inherit (pkgs) networkmanager modemmanager wpa_supplicant;
--- a/nixos/modules/services/x11/desktop-managers/plasma5.nix
+++ b/nixos/modules/services/x11/desktop-managers/plasma5.nix
@ -224,6 +224,8 @@ in
      security.pam.services.sddm.enableKwallet = true;
      security.pam.services.slim.enableKwallet = true;

+      xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-kde ];
+
      # Update the start menu for each user that is currently logged in
      system.userActivationScripts.plasmaSetup = ''
        # The KDE icon cache is supposed to update itself
--- a/pkgs/applications/audio/gxplugins-lv2/default.nix
+++ b/pkgs/applications/audio/gxplugins-lv2/default.nix
@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
  name = "${pname}-${version}";
  pname = "GxPlugins.lv2";
-  version = "0.5";
+  version = "0.7";

  src = fetchFromGitHub {
    owner = "brummer10";
    repo = pname;
    rev = "v${version}";
-    sha256 = "16r5bj7w726d9327flg530fn0bli4crkxjss7i56yhb1bsi39mbv";
+    sha256 = "0jqdqnkg7pg9plcbxy49p7gcs1aj6h0xf7y9gndmjmkw5yjn2940";
    fetchSubmodules = true;
  };

@ -20,6 +20,12 @@ stdenv.mkDerivation rec {

  installFlags = [ "INSTALL_DIR=$(out)/lib/lv2" ];

+  configurePhase = ''
+    for i in GxBoobTube GxValveCaster; do
+      substituteInPlace $i.lv2/Makefile --replace "\$(shell which echo) -e" "echo -e"
+    done
+  '';
+
  meta = with stdenv.lib; {
    homepage = https://github.com/brummer10/GxPlugins.lv2;
    description = "A set of extra lv2 plugins from the guitarix project";
--- a/pkgs/applications/audio/midisheetmusic/default.nix
+++ b/pkgs/applications/audio/midisheetmusic/default.nix
@ -47,6 +47,7 @@ in stdenv.mkDerivation {

    makeWrapper ${mono}/bin/mono $out/bin/midisheetmusic.mono.exe \
      --prefix LD_LIBRARY_PATH : ${stdenv.lib.makeLibraryPath [ gtk2 cups ]} \
+      --prefix PATH : ${stdenv.lib.makeBinPath [ timidity ]} \
      --add-flags $out/bin/.MidiSheetMusic.exe
  '';

--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@ -13,9 +13,9 @@ let
    sha256Hash = "090rc307mfm0yw4h592l9307lq4aas8zq0ci49csn6kxhds8rsrm";
  };
  betaVersion = {
-    version = "3.5.0.17"; # "Android Studio 3.5 Beta 5"
-    build = "191.5675373";
-    sha256Hash = "0iw9v2rzr32dhs3z4vgz93zvxcv111q4cvwzi2cb83hn8kl050ip";
+    version = "3.5.0.18"; # "Android Studio 3.5 RC 1"
+    build = "191.5717577";
+    sha256Hash = "1p0w7xrfk33m1wvwnc3s3s7w9rm8wn9b3bjn566w2qpjv5ngdkn3";
  };
  latestVersion = { # canary & dev
    version = "3.6.0.3"; # "Android Studio 3.6 Canary 3"
--- a/pkgs/applications/editors/emacs/default.nix
+++ b/pkgs/applications/editors/emacs/default.nix
@ -61,7 +61,8 @@ stdenv.mkDerivation rec {
    ++ lib.optionals stdenv.isLinux [ dbus libselinux systemd ]
    ++ lib.optionals withX
      [ xlibsWrapper libXaw Xaw3d libXpm libpng libjpeg libungif libtiff librsvg libXft
-        imagemagick gconf ]
+        gconf ]
+    ++ lib.optionals (withX || withNS) [ imagemagick ]
    ++ lib.optionals (stdenv.isLinux && withX) [ m17n_lib libotf ]
    ++ lib.optional (withX && withGTK2) gtk2-x11
    ++ lib.optionals (withX && withGTK3) [ gtk3-x11 gsettings-desktop-schemas ]
--- a/pkgs/applications/editors/kdevelop5/kdev-php.nix
+++ b/pkgs/applications/editors/kdevelop5/kdev-php.nix
@ -1,15 +1,12 @@
 { stdenv, lib, fetchurl, cmake, extra-cmake-modules, threadweaver, ktexteditor, kdevelop-unwrapped, kdevelop-pg-qt }:

-let
-  pname = "kdev-php";
-  version = "5.3.2";
-in
 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
+  pname = "kdev-php";
+  version = "5.3.3";

  src = fetchurl {
    url = "https://github.com/KDE/${pname}/archive/v${version}.tar.gz";
-    sha256 = "0yjn7y7al2xs8g0mrjvcym8gbjy4wmiv7lsljcrasjd7ymag1wgs";
+    sha256 = "0nn3yfbi60h7p7p1w2pvgg098qplbds79rk2iadyvhvl3sjd77wf";
  };

  nativeBuildInputs = [ cmake extra-cmake-modules ];
@ -19,7 +16,7 @@ stdenv.mkDerivation rec {
    maintainers = [ maintainers.aanderse ];
    platforms = platforms.linux;
    description = "PHP support for KDevelop";
-    homepage = https://www.kdevelop.org;
+    homepage = "https://www.kdevelop.org";
    license = [ licenses.gpl2 ];
  };
 }
--- a/pkgs/applications/editors/kdevelop5/kdev-python.nix
+++ b/pkgs/applications/editors/kdevelop5/kdev-python.nix
@ -1,15 +1,12 @@
 { stdenv, lib, fetchurl, cmake, extra-cmake-modules, threadweaver, ktexteditor, kdevelop-unwrapped, python }:

-let
-  pname = "kdev-python";
-  version = "5.3.2";
-in
 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
+  pname = "kdev-python";
+  version = "5.3.3";

  src = fetchurl {
    url = "https://github.com/KDE/${pname}/archive/v${version}.tar.gz";
-    sha256 = "0gqv1abzfpxkrf538rb62d2291lmlra8rghm9q9r3x8a46wh96zm";
+    sha256 = "0bqsny2jgi6wi1cz65i2j9r1hiwna2x10mzy7vdk8bz7b4z766yg";
  };

  cmakeFlags = [
@ -23,7 +20,7 @@ stdenv.mkDerivation rec {
    maintainers = [ maintainers.aanderse ];
    platforms = platforms.linux;
    description = "Python support for KDevelop";
-    homepage = https://www.kdevelop.org;
+    homepage = "https://www.kdevelop.org";
    license = [ licenses.gpl2 ];
  };
 }
--- a/pkgs/applications/editors/kdevelop5/kdevelop.nix
+++ b/pkgs/applications/editors/kdevelop5/kdevelop.nix
@ -8,16 +8,15 @@
 }:

 let
-  pname = "kdevelop";
-  version = "5.3.2";
  qtVersion = "5.${lib.versions.minor qtbase.version}";
 in
 mkDerivation rec {
-  name = "${pname}-${version}";
+  pname = "kdevelop";
+  version = "5.3.3";

  src = fetchurl {
-    url = "mirror://kde/stable/${pname}/${version}/src/${name}.tar.xz";
-    sha256 = "0akgdnvrab6mbwnmvgzsplk0qh83k1hnm5xc06yxr1s1a5sxbk08";
+    url = "mirror://kde/stable/${pname}/${version}/src/${pname}-${version}.tar.xz";
+    sha256 = "0778587qvi268ab2fgggfl40cv2swgr8q891q1paflp3m1xirpff";
  };

  nativeBuildInputs = [
@ -77,7 +76,7 @@ mkDerivation rec {
        programing languages. It is based on KDevPlatform, KDE and Qt
        libraries and is under development since 1998.
      '';
-    homepage = https://www.kdevelop.org;
+    homepage = "https://www.kdevelop.org";
    license = with licenses; [ gpl2Plus lgpl2Plus ];
  };
 }
--- a/pkgs/applications/graphics/imv/default.nix
+++ b/pkgs/applications/graphics/imv/default.nix
@ -1,32 +1,34 @@
 { stdenv, fetchFromGitHub, SDL2, SDL2_ttf
 , freeimage, fontconfig, pkgconfig
 , asciidoc, docbook_xsl, libxslt, cmocka
+, librsvg
 }:

 stdenv.mkDerivation rec {
  name = "imv-${version}";
-  version = "3.0.0";
+  version = "3.1.2";

  src = fetchFromGitHub {
    owner  = "eXeC64";
    repo   = "imv";
    rev    = "v${version}";
-    sha256 = "0j5aykdkm1g518ism5y5flhwxvjvl92ksq989fhl2wpnv0la82jp";
+    sha256 = "0gg362x2f7hli6cr6s7dmlanh4cqk7fd2pmk4zs9438jvqklf4cl";
  };

  buildInputs = [
    SDL2 SDL2_ttf freeimage fontconfig pkgconfig
-    asciidoc docbook_xsl libxslt cmocka
+    asciidoc docbook_xsl libxslt cmocka librsvg
  ];

  installFlags = [ "PREFIX=$(out)" "CONFIGPREFIX=$(out)/etc" ];

+  doCheck = true;
+
  meta = with stdenv.lib; {
    description = "A command line image viewer for tiling window managers";
-    homepage    = https://github.com/eXeC64/imv; 
+    homepage    = https://github.com/eXeC64/imv;
    license     = licenses.gpl2;
-    maintainers = with maintainers; [ rnhmjoj ];
+    maintainers = with maintainers; [ rnhmjoj markus1189 ];
    platforms   = [ "i686-linux" "x86_64-linux" ];
  };
 }
-
--- a/pkgs/applications/misc/evtest-qt/default.nix
+++ b/pkgs/applications/misc/evtest-qt/default.nix
@ -0,0 +1,25 @@
+{ stdenv, qtbase, cmake, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  pname = "evtest-qt";
+  version = "0.2.0";
+
+  src = fetchFromGitHub {
+    owner = "Grumbel";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1wfzkgq81764qzxgk0y5vvpxcrb3icvrr4dd4mj8njrqgbwmn0mw";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [ qtbase ];
+
+  meta = with stdenv.lib; {
+    description = "Simple input device tester for linux with Qt GUI";
+    homepage = "https://github.com/Grumbel/evtest-qt";
+    maintainers = with maintainers; [ alexarice ];
+    platforms = platforms.linux;
+    license = licenses.gpl3;
+  };
+}
--- a/pkgs/applications/misc/keepassx/community.nix
+++ b/pkgs/applications/misc/keepassx/community.nix
@ -112,7 +112,7 @@ stdenv.mkDerivation rec {
    longDescription = "A community fork of KeePassX, which is itself a port of KeePass Password Safe. The goal is to extend and improve KeePassX with new features and bugfixes to provide a feature-rich, fully cross-platform and modern open-source password manager. Accessible via native cross-platform GUI, CLI, and browser integration with the KeePassXC Browser Extension (https://github.com/keepassxreboot/keepassxc-browser).";
    homepage = https://keepassxc.org/;
    license = licenses.gpl2;
-    maintainers = with maintainers; [ s1lvester jonafato ];
+    maintainers = with maintainers; [ jonafato ];
    platforms = with platforms; linux ++ darwin;
  };
 }
--- a/pkgs/applications/misc/lutris/chrootenv.nix
+++ b/pkgs/applications/misc/lutris/chrootenv.nix
@ -0,0 +1,111 @@
+{ lib, buildFHSUserEnv, lutris-unwrapped
+, steamSupport ? true
+}:
+
+let
+
+  qt5Deps = pkgs: with pkgs.qt5; [ qtbase qtmultimedia ];
+  gnome3Deps = pkgs: with pkgs.gnome3; [ zenity gtksourceview gnome-desktop libgnome-keyring webkitgtk ];
+  xorgDeps = pkgs: with pkgs.xorg; [
+    libX11 libXrender libXrandr libxcb libXmu libpthreadstubs libXext libXdmcp
+    libXxf86vm libXinerama libSM libXv libXaw libXi libXcursor libXcomposite
+    xrandr
+  ];
+
+in buildFHSUserEnv {
+  name = "lutris";
+
+  runScript = "lutris";
+
+  targetPkgs = pkgs: with pkgs; [
+    lutris-unwrapped
+
+    # Common
+    libsndfile libtheora libogg libvorbis libopus libGLU libpcap libpulseaudio
+    libao libusb libevdev libudev libgcrypt libxml2 libusb libpng libmpeg2 libv4l
+    libjpeg libxkbcommon libass libcdio libjack2 libsamplerate libzip libmad libaio
+    libcap libtiff libva libgphoto2 libxslt libtxc_dxtn libsndfile giflib zlib glib
+    alsaLib zziplib bash dbus keyutils zip cabextract freetype unzip coreutils
+    readline gcc SDL SDL2 curl graphite2 gtk2 gtk3 udev ncurses wayland libglvnd
+    vulkan-loader xdg_utils sqlite
+
+    # Adventure Game Studio
+    allegro dumb
+
+    # Desmume
+    lua agg soundtouch openal desktop-file-utils pangox_compat atk
+
+    # DGen // TODO: libarchive is broken
+
+    # Dolphin
+    bluez ffmpeg gettext portaudio wxGTK30 miniupnpc mbedtls lzo sfml gsm
+    wavpack gnutls-kdh orc nettle gmp pcre vulkan-loader
+
+    # DOSBox
+    SDL_net SDL_sound
+
+    # GOG
+    glib-networking
+
+    # Higan // TODO: "higan is not available for the x86_64 architecture"
+
+    # Libretro
+    fluidsynth hidapi mesa libdrm
+
+    # MAME
+    qt48 fontconfig SDL2_ttf
+
+    # Mednafen
+    freeglut mesa_glu
+
+    # MESS
+    expat
+
+    # Minecraft
+    nss
+
+    # Mupen64Plus
+    boost dash
+
+    # Osmose
+    qt4
+
+    # PCSX2 // TODO: "libgobject-2.0.so.0: wrong ELF class: ELFCLASS64"
+
+    # PPSSPP
+    glew snappy
+
+    # Redream // "redream is not available for the x86_64 architecture"
+
+    # ResidualVM
+    flac
+
+    # rpcs3 // TODO: "error while loading shared libraries: libz.so.1..."
+    llvm_4
+
+    # ScummVM
+    nasm sndio
+
+    # Snes9x
+    epoxy minizip
+
+    # Vice
+    bison flex
+
+    # WINE
+    perl which p7zip gnused gnugrep psmisc cups lcms2 mpg123 cairo unixODBC
+    samba4 sane-backends openldap opencl-headers ocl-icd utillinux
+
+    # ZDOOM
+    soundfont-fluid bzip2 game-music-emu
+  ] ++ qt5Deps pkgs
+    ++ gnome3Deps pkgs
+    ++ xorgDeps pkgs
+    ++ lib.optional steamSupport pkgs.steam;
+
+  extraInstallCommands = ''
+    mkdir -p $out/share
+    ln -sf ${lutris-unwrapped}/share/applications $out/share
+    ln -sf ${lutris-unwrapped}/share/icons $out/share
+  '';
+}
--- a/pkgs/applications/misc/lutris/default.nix
+++ b/pkgs/applications/misc/lutris/default.nix
@ -1,178 +1,66 @@
-{ stdenv, pkgs, buildFHSUserEnv, makeDesktopItem, fetchFromGitHub
-, wrapGAppsHook, python3Packages }:
+{ buildPythonApplication, lib, fetchFromGitHub
+, wrapGAppsHook, gobject-introspection, gnome-desktop, libnotify, libgnome-keyring, pango
+, gdk_pixbuf, atk, webkitgtk, gst_all_1
+, evdev, pyyaml, pygobject3, requests, pillow
+, xrandr, pciutils, psmisc, glxinfo, vulkan-tools, xboxdrv, pulseaudio, p7zip, xgamma
+, libstrangle, wine, fluidsynth, xorgserver
+}:

 let
-  qt5Deps = with pkgs; with qt5; [ qtbase qtmultimedia ];
-  gnome3Deps = with pkgs; with gnome3; [ zenity gtksourceview gnome-desktop libgnome-keyring webkitgtk ];
-
-  python3Deps = with pkgs; with python3Packages; [
-    evdev pyyaml pyxdg pygobject3 pyqt5 dbus-python requests pillow
+  # See lutris/util/linux.py
+  binPath = lib.makeBinPath [
+    xrandr
+    pciutils
+    psmisc
+    glxinfo
+    vulkan-tools
+    xboxdrv
+    pulseaudio
+    p7zip
+    xgamma
+    libstrangle
+    wine
+    fluidsynth
+    xorgserver
  ];

-  xorgDeps = with pkgs; with xorg; [
-    libX11 libXrender libXrandr libxcb libXmu libpthreadstubs libXext libXdmcp
-    libXxf86vm libXinerama libSM libXv libXaw libXi libXcursor libXcomposite
-    xrandr xdg_utils
-  ];
-
-  gstDeps = with pkgs; with gst_all_1; [
+  gstDeps = with gst_all_1; [
    gstreamer gst-plugins-base gst-plugins-good gst-plugins-bad gst-plugins-ugly
    gst-libav
  ];

-  deps = with pkgs; [
-    # Common
-    stdenv.cc.cc libGL libGLU_combined libsndfile libtheora libogg libvorbis
-    libopus libGLU libpcap libpulseaudio libao libusb libevdev libudev libgcrypt
-    libxml2 libusb libpng libmpeg2 libv4l libjpeg libxkbcommon libass libcdio
-    libjack2 libsamplerate libzip libmad libaio libcap libtiff libva libgphoto2
-    libxslt libtxc_dxtn libsndfile giflib zlib glib alsaLib zziplib bash dbus
-    keyutils zip cabextract freetype unzip coreutils readline gcc SDL SDL2 curl
-    graphite2 gtk2 gtk3 udev ncurses wayland libglvnd vulkan-loader
+in buildPythonApplication rec {
+  name = "lutris-original-${version}";
+  version = "0.5.2.1";

-    # Lutris
-    gobject-introspection gdk_pixbuf hicolor-icon-theme pango openssl sqlite xterm libnotify procps
-
-    # Adventure Game Studio
-    allegro dumb
-
-    # Desmume
-    lua agg soundtouch openal desktop-file-utils pangox_compat atk
-
-    # DGen // TODO: libarchive is broken
-
-    # Dolphin
-    bluez ffmpeg gettext portaudio wxGTK30 miniupnpc mbedtls lzo sfml gsm
-    wavpack gnutls-kdh orc nettle gmp pcre vulkan-loader
-
-    # DOSBox
-    SDL_net SDL_sound
-
-    # GOG
-    glib-networking
-
-    # Higan // TODO: "higan is not available for the x86_64 architecture"
-
-    # Libretro
-    fluidsynth hidapi mesa libdrm
-
-    # MAME
-    qt48 fontconfig SDL2_ttf
-
-    # Mednafen
-    freeglut mesa_glu
-
-    # MESS
-    expat
-
-    # Minecraft
-    nss
-
-    # Mupen64Plus
-    boost dash
-
-    # Osmose
-    qt4
-
-    # PCSX2 // TODO: "libgobject-2.0.so.0: wrong ELF class: ELFCLASS64"
-
-    # PPSSPP
-    glew snappy
-
-    # Redream // "redream is not available for the x86_64 architecture"
-
-    # ResidualVM
-    flac
-
-    # rpcs3 // TODO: "error while loading shared libraries: libz.so.1..."
-    llvm_4
-
-    # ScummVM
-    nasm sndio
-
-    # Snes9x
-    epoxy minizip
-
-    # Steam
-    steam
-
-    # Vice
-    bison flex
-
-    # WINE
-    perl which p7zip gnused gnugrep psmisc cups lcms2 mpg123 cairo unixODBC
-    samba4 sane-backends openldap opencl-headers ocl-icd utillinux
-
-    wineWowPackages.staging
-
-    # ZDOOM
-    soundfont-fluid bzip2 game-music-emu
-  ] ++ qt5Deps
-    ++ gnome3Deps
-    ++ python3Deps
-    ++ xorgDeps
-    ++ gstDeps;
-
-  lutris = python3Packages.buildPythonApplication rec {
-    name = "lutris-original-${version}";
-    version = "0.5.2.1";
-
-    src = fetchFromGitHub {
-      owner = "lutris";
-      repo = "lutris";
-      rev = "v${version}";
-      sha256 = "023yqnzmnkfpq21r6ky6jzwbjxjcw1a5zqrrdl6fwwlr78fdhgpv";
-    };
-
-    enableParallelBuilding = true;
-    nativeBuildInputs = [ wrapGAppsHook ];
-    propagatedBuildInputs = deps;
-    fullPath = stdenv.lib.makeLibraryPath deps;
-    preConfigure = "export HOME=$PWD";
-
-    makeWrapperArgs = [
-      "--prefix LD_LIBRARY_PATH : ${fullPath}:$out/lib"
-      "--set GI_TYPELIB_PATH $GI_TYPELIB_PATH"
-      "--prefix XDG_DATA_DIRS : $out/share"
-      "--suffix XDG_DATA_DIRS : $XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH"
-    ];
-
-    postInstall = ''
-      mkdir -p $out/lib
-      ln -sf ${pkgs.gsm}/lib/libgsm.so $out/lib/libgsm.so.1
-      mv $out/bin/lutris $out/bin/lutris-${version}
-    '';
-
-    meta = with stdenv.lib; {
-      homepage = "https://lutris.net";
-      description = "Open Source gaming platform for GNU/Linux";
-      license = licenses.gpl3;
-      maintainers = with maintainers; [ chiiruno ];
-      platforms = platforms.linux;
-    };
+  src = fetchFromGitHub {
+    owner = "lutris";
+    repo = "lutris";
+    rev = "v${version}";
+    sha256 = "023yqnzmnkfpq21r6ky6jzwbjxjcw1a5zqrrdl6fwwlr78fdhgpv";
  };

-  desktopItem = makeDesktopItem {
-    name = "Lutris";
-    exec = "lutris";
-    icon = "lutris";
-    comment = lutris.meta.description;
-    desktopName = "Lutris";
-    genericName = "Gaming Platform";
-    categories = "Network;Game;Emulator;";
-    startupNotify = "false";
+  buildInputs = [
+    wrapGAppsHook gobject-introspection gnome-desktop libnotify libgnome-keyring pango
+    gdk_pixbuf atk webkitgtk
+  ] ++ gstDeps;
+
+  makeWrapperArgs = [
+    "--prefix PATH : ${binPath}"
+  ];
+
+  propagatedBuildInputs = [
+    evdev pyyaml pygobject3 requests pillow
+  ];
+
+  preCheck = "export HOME=$PWD";
+
+  meta = with lib; {
+    homepage = "https://lutris.net";
+    description = "Open Source gaming platform for GNU/Linux";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ chiiruno ];
+    platforms = platforms.linux;
  };
-
-in buildFHSUserEnv rec {
-  name = "lutris";
-
-  runScript = "lutris-${lutris.version}";
-  targetPkgs = pkgs: [ lutris pkgs.glxinfo pkgs.pciutils ];
-  passthru.lutris = lutris;
-
-  extraInstallCommands = ''
-    mkdir -p $out/share
-    cp -r ${desktopItem}/share/applications $out/share
-    ln -sf ${lutris}/share/icons $out/share
-  '';
 }
+
--- a/pkgs/applications/misc/sidequest/default.nix
+++ b/pkgs/applications/misc/sidequest/default.nix
@ -0,0 +1,69 @@
+{ stdenv, lib, fetchurl, buildFHSUserEnv, makeDesktopItem, makeWrapper, atomEnv, libuuid, at-spi2-atk, icu, openssl, zlib }:
+	let
+		pname = "sidequest";
+		version = "0.3.1";
+		
+		desktopItem = makeDesktopItem rec {
+			name = "SideQuest";
+			exec = "SideQuest";
+			desktopName = name;
+			genericName = "VR App Store";
+			categories = "Settings;PackageManager;";
+		};
+
+		sidequest = stdenv.mkDerivation {
+			inherit pname version;
+
+			src = fetchurl {
+				url = "https://github.com/the-expanse/SideQuest/releases/download/${version}/SideQuest-linux-x64.tar.gz";
+				sha256 = "1hj398zzp1x74zhp9rlhqzm9a0ck6zh9bj39g6fpvc38zab5dj1p";
+			};
+
+			buildInputs = [ makeWrapper ];
+
+			buildCommand = ''
+				mkdir -p "$out/lib/SideQuest" "$out/bin"
+				tar -xzf "$src" -C "$out/lib/SideQuest" --strip-components 1
+
+				ln -s "$out/lib/SideQuest/SideQuest" "$out/bin"
+
+				fixupPhase
+
+				# mkdir -p "$out/share/applications"
+				# ln -s "${desktopItem}/share/applications/*" "$out/share/applications"
+
+				patchelf \
+					--set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+					--set-rpath "${atomEnv.libPath}/lib:${lib.makeLibraryPath [libuuid at-spi2-atk]}:$out/lib/SideQuest" \
+					"$out/lib/SideQuest/SideQuest"
+			'';
+		};
+	in buildFHSUserEnv {
+		name = "SideQuest";
+
+		passthru = {
+			inherit pname version;
+
+			meta = with stdenv.lib; {
+				description = "An open app store and side-loading tool for Android-based VR devices such as the Oculus Go, Oculus Quest or Moverio BT 300";
+				homepage = "https://github.com/the-expanse/SideQuest";
+				downloadPage = "https://github.com/the-expanse/SideQuest/releases";
+				license = licenses.mit;
+				maintainers = [ maintainers.joepie91 ];
+				platforms = [ "x86_64-linux" ];
+			};
+		};
+		
+		targetPkgs = pkgs: [
+			sidequest
+			# Needed in the environment on runtime, to make QuestSaberPatch work
+			icu openssl zlib
+		];
+
+		extraInstallCommands = ''
+			mkdir -p "$out/share/applications"
+			ln -s "${desktopItem}/share/applications/*" "$out/share/applications"
+		'';
+
+		runScript = "SideQuest";
+	}
--- a/pkgs/applications/networking/instant-messengers/discord/base.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/base.nix
@ -36,7 +36,7 @@ in stdenv.mkDerivation rec {
        --prefix LD_LIBRARY_PATH : ${libPath}

    ln -s $out/opt/${binaryName}/${binaryName} $out/bin/
-    ln -s $out/opt/${binaryName}/discord.png $out/share/pixmaps/${binaryName}.png
+    ln -s $out/opt/${binaryName}/discord.png $out/share/pixmaps/${pname}.png

    ln -s "${desktopItem}/share/applications" $out/share/
  '';
--- a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
@ -13,11 +13,11 @@ assert pulseaudioSupport -> libpulseaudio != null;
 let
  inherit (stdenv.lib) concatStringsSep makeBinPath optional;

-  version = "2.8.264592.0714";
+  version = "2.9.265650.0716";
  srcs = {
    x86_64-linux = fetchurl {
      url = "https://zoom.us/client/${version}/zoom_x86_64.tar.xz";
-      sha256 = "0ndrsyyawls487v7vlga0yn574xvhmfc14vdjxg23nvn0jxh2dvw";
+      sha256 = "1wg5yw8g0c6p9y0wcqxr1rndgclasg7v1ybbx8s1a2p98izjkcaa";
    };
  };

--- a/pkgs/applications/networking/mailreaders/aerc/default.nix
+++ b/pkgs/applications/networking/mailreaders/aerc/default.nix
@ -5,11 +5,11 @@

 buildGoModule rec {
  pname = "aerc";
-  version = "0.1.1";
+  version = "0.1.4";

  src = fetchurl {
    url = "https://git.sr.ht/~sircmpwn/aerc/archive/${version}.tar.gz";
-    sha256 = "0rpwjjnaq8mj619ajzyl3kad7sysbz87qz2ds0jyy7kvyzv6r7zb";
+    sha256 = "0vlqgcjbq6yp7ffrfs3zwa9hrm4vyx9245v9pkqdn328xlff3h55";
  };

  nativeBuildInputs = [
@ -43,7 +43,7 @@ buildGoModule rec {
      ${stdenv.lib.makeBinPath [ w3m dante ]}
  '';

-  modSha256 = "0p8lp6xwg6jacrnxzw3q73mqxy9wzj5vs0k1saa48ardqd2f7b00";
+  modSha256 = "0v1b76nax5295bjrq19wdzm2ixiszlk7j1v1k9sjz4la07h5bvfj";

  meta = with stdenv.lib; {
    description = "aerc is an email client for your terminal";
--- a/pkgs/applications/networking/msmtp/default.nix
+++ b/pkgs/applications/networking/msmtp/default.nix
@ -9,11 +9,11 @@ let

 in stdenv.mkDerivation rec {
  pname = "msmtp";
-  version = "1.8.4";
+  version = "1.8.5";

  src = fetchurl {
    url = "https://marlam.de/${pname}/releases/${pname}-${version}.tar.xz";
-    sha256 = "1xr926lyy44baqdgv9q0sw5z6ll2cb4lx2g4lgpgbqn8bglpzpg5";
+    sha256 = "0fczpfxlr62wkr7bwhp24clxg962k5khgz14h818qyy4v77dl4qn";
  };

  patches = [
--- a/pkgs/applications/networking/msmtp/paths.patch
+++ b/pkgs/applications/networking/msmtp/paths.patch
@ -59,7 +59,8 @@ index bdb4fb8..1363a67 100755
 ##
 log() {
 +  local NAME=msmtpq
-   local ARG RC PFX="$('date' +'%Y %d %b %H:%M:%S')"
+   local ARG RC PFX
+   PFX="$('date' +'%Y %d %b %H:%M:%S')"
                                      # time stamp prefix - "2008 13 Mar 03:59:45 "
   if [ "$1" = '-e' ] ; then          # there's an error exit code
@@ -154,10 +157,19 @@ log() {
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@ -1,32 +1,32 @@
 {
  "ce": {
-    "version": "11.10.8",
-    "repo_hash": "1ygwkajkwhr2vzkzljfj6l1ypvmmzj9ps8ijha5m9qglkzjz0gsn",
-    "deb_hash": "1b66yw0i795pahainx3rpqaliffmn5py0ws8is8f5hr7cghchln0",
-    "deb_url": "https://packages.gitlab.com/gitlab/gitlab-ce/packages/debian/stretch/gitlab-ce_11.10.8-ce.0_amd64.deb/download.deb",
+    "version": "12.0.3",
+    "repo_hash": "0vrw4f9wczcnd66w2ym3mfnrr1qmjs5jyxhvc6sf93lk2n1d27sk",
+    "deb_hash": "0y1nv0hasphpkxrma43d7ipp2b3wsy08asrwshqc58rw9q7cnbcy",
+    "deb_url": "https://packages.gitlab.com/gitlab/gitlab-ce/packages/debian/stretch/gitlab-ce_12.0.3-ce.0_amd64.deb/download.deb",
    "owner": "gitlab-org",
    "repo": "gitlab-ce",
-    "rev": "v11.10.8",
+    "rev": "v12.0.3",
    "passthru": {
-      "GITALY_SERVER_VERSION": "1.34.3",
-      "GITLAB_PAGES_VERSION": "1.5.0",
-      "GITLAB_SHELL_VERSION": "9.0.0",
-      "GITLAB_WORKHORSE_VERSION": "8.5.2"
+      "GITALY_SERVER_VERSION": "1.47.0",
+      "GITLAB_PAGES_VERSION": "1.6.1",
+      "GITLAB_SHELL_VERSION": "9.3.0",
+      "GITLAB_WORKHORSE_VERSION": "8.7.0"
    }
  },
  "ee": {
-    "version": "11.10.8",
-    "repo_hash": "1vw0d99w5bvagbl9xia5ik3754s7jgkh01b3wm77snfkcg31psb6",
-    "deb_hash": "05fsjxlr56zv4wc90r6ns81n5h1ykafjsi8vq6h22gzxjjvaay7m",
-    "deb_url": "https://packages.gitlab.com/gitlab/gitlab-ee/packages/debian/stretch/gitlab-ee_11.10.8-ee.0_amd64.deb/download.deb",
+    "version": "12.0.3",
+    "repo_hash": "1gndyxmr93qrlnbhi75sql49wqnd579yi3aqhx8b477fjac2wd69",
+    "deb_hash": "082n3dsi2jwv4aagzgk1g0mm2csxgg6lpgnc49zfhyz9frdvf9mq",
+    "deb_url": "https://packages.gitlab.com/gitlab/gitlab-ee/packages/debian/stretch/gitlab-ee_12.0.3-ee.0_amd64.deb/download.deb",
    "owner": "gitlab-org",
    "repo": "gitlab-ee",
-    "rev": "v11.10.8-ee",
+    "rev": "v12.0.3-ee",
    "passthru": {
-      "GITALY_SERVER_VERSION": "1.34.3",
-      "GITLAB_PAGES_VERSION": "1.5.0",
-      "GITLAB_SHELL_VERSION": "9.0.0",
-      "GITLAB_WORKHORSE_VERSION": "8.5.2"
+      "GITALY_SERVER_VERSION": "1.47.0",
+      "GITLAB_PAGES_VERSION": "1.6.1",
+      "GITLAB_SHELL_VERSION": "9.3.0",
+      "GITLAB_WORKHORSE_VERSION": "8.7.0"
    }
  }
 }
--- a/pkgs/applications/version-management/gitlab/default.nix
+++ b/pkgs/applications/version-management/gitlab/default.nix
@ -4,11 +4,26 @@
 }:

 let
-  rubyEnv = bundlerEnv {
+  rubyEnv = bundlerEnv rec {
    name = "gitlab-env-${version}";
    inherit ruby;
    gemdir = ./rubyEnv- + "${if gitlabEnterprise then "ee" else "ce"}";
-    groups = [ "default" "unicorn" "ed25519" "metrics" ];
+    gemset =
+      let x = import (gemdir + "/gemset.nix");
+      in x // {
+        # grpc expects the AR environment variable to contain `ar rpc`. See the
+        # discussion in nixpkgs #63056.
+        grpc = x.grpc // {
+          patches = [ ./fix-grpc-ar.patch ];
+          dontBuild = false;
+        };
+      };
+    groups = [
+      "default" "unicorn" "ed25519" "metrics" "development" "puma" "test"
+    ];
+    # N.B. omniauth_oauth2_generic and apollo_upload_server both provide a
+    # `console` executable.
+    ignoreCollisions = true;
  };

  flavour = if gitlabEnterprise then "ee" else "ce";
--- a/pkgs/applications/version-management/gitlab/fix-grpc-ar.patch
+++ b/pkgs/applications/version-management/gitlab/fix-grpc-ar.patch
@ -0,0 +1,10 @@
+--- a/src/ruby/ext/grpc/extconf.rb
+++ b/src/ruby/ext/grpc/extconf.rb
+@@ -27,6 +27,7 @@ ENV['MACOSX_DEPLOYMENT_TARGET'] = '10.7'
+ if ENV['AR'].nil? || ENV['AR'].size == 0
+     ENV['AR'] = RbConfig::CONFIG['AR'] + ' rcs'
+ end
+ENV['AR'] = ENV['AR'] + ' rcs'
+ if ENV['CC'].nil? || ENV['CC'].size == 0
+     ENV['CC'] = RbConfig::CONFIG['CC']
+ end
--- a/pkgs/applications/version-management/gitlab/gitaly/Gemfile
+++ b/pkgs/applications/version-management/gitlab/gitaly/Gemfile
@ -1,29 +1,32 @@
 source 'https://rubygems.org'

 # Require bundler >= 1.16.5 to avoid this bug: https://github.com/bundler/bundler/issues/6537
-gem 'bundler', '>= 1.16.5'
+gem 'bundler', '>= 1.17.3'

 gem 'rugged', '~> 0.28'
 gem 'github-linguist', '~> 6.1', require: 'linguist'
 gem 'gitlab-markup', '~> 1.7.0'
-gem 'gitaly-proto', '~> 1.22.0'
-gem 'activesupport', '~> 5.0.2'
+gem 'activesupport', '~> 5.1.7'
+gem 'gitaly-proto', '~> 1.32.0'
 gem 'rdoc', '~> 4.2'
 gem 'gitlab-gollum-lib', '~> 4.2.7.7', require: false
 gem 'gitlab-gollum-rugged_adapter', '~> 0.4.4.2', require: false
-gem 'grpc', '~> 1.15.0'
+gem 'grpc', '~> 1.19.0'
 gem 'sentry-raven', '~> 2.9.0', require: false
 gem 'faraday', '~> 0.12'
 gem 'rbtrace', require: false

+# Labkit provides observability functionality
+gem 'gitlab-labkit', '~> 0.3.0'
+
 # Detects the open source license the repository includes
 # This version needs to be in sync with GitLab CE/EE
 gem 'licensee', '~> 8.9.0'

-gem 'google-protobuf', '~> 3.6'
+gem 'google-protobuf', '~> 3.7.1'

 group :development, :test do
-  gem 'rubocop', '~> 0.50', require: false
+  gem 'rubocop', '~> 0.69', require: false
  gem 'rspec', require: false
  gem 'rspec-parameterized', require: false
  gem 'timecop', require: false
--- a/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock
@ -2,7 +2,20 @@ GEM
  remote: https://rubygems.org/
  specs:
    abstract_type (0.0.7)
-    activesupport (5.0.7.2)
+    actionpack (5.1.7)
+      actionview (= 5.1.7)
+      activesupport (= 5.1.7)
+      rack (~> 2.0)
+      rack-test (>= 0.6.3)
+      rails-dom-testing (~> 2.0)
+      rails-html-sanitizer (~> 1.0, >= 1.0.2)
+    actionview (5.1.7)
+      activesupport (= 5.1.7)
+      builder (~> 3.1)
+      erubi (~> 1.4)
+      rails-dom-testing (~> 2.0)
+      rails-html-sanitizer (~> 1.0, >= 1.0.3)
+    activesupport (5.1.7)
      concurrent-ruby (~> 1.0, >= 1.0.2)
      i18n (>= 0.7, < 2)
      minitest (~> 5.1)
@ -10,33 +23,33 @@ GEM
    adamantium (0.2.0)
      ice_nine (~> 0.11.0)
      memoizable (~> 0.4.0)
-    addressable (2.5.2)
+    addressable (2.6.0)
      public_suffix (>= 2.0.2, < 4.0)
    ast (2.4.0)
-    binding_of_caller (0.8.0)
-      debug_inspector (>= 0.0.1)
+    binding_ninja (0.2.3)
+    builder (3.2.3)
    charlock_holmes (0.7.6)
    coderay (1.1.2)
    concord (0.1.5)
      adamantium (~> 0.2.0)
      equalizer (~> 0.0.9)
-    concurrent-ruby (1.1.3)
+    concurrent-ruby (1.1.5)
    crack (0.4.3)
      safe_yaml (~> 1.0.0)
    crass (1.0.4)
-    debug_inspector (0.0.3)
    diff-lcs (1.3)
    docile (1.1.5)
    equalizer (0.0.11)
+    erubi (1.8.0)
    escape_utils (1.2.1)
-    factory_bot (4.11.1)
-      activesupport (>= 3.0.0)
-    faraday (0.15.3)
+    factory_bot (5.0.2)
+      activesupport (>= 4.2.0)
+    faraday (0.15.4)
      multipart-post (>= 1.2, < 3)
    ffi (1.10.0)
    gemojione (3.3.0)
      json
-    gitaly-proto (1.22.0)
+    gitaly-proto (1.32.0)
      grpc (~> 1.0)
    github-linguist (6.4.1)
      charlock_holmes (~> 0.7.6)
@ -60,44 +73,57 @@ GEM
      diff-lcs (~> 1.1)
      mime-types (>= 1.16)
      posix-spawn (~> 0.3)
+    gitlab-labkit (0.3.0)
+      actionpack (~> 5)
+      activesupport (~> 5)
+      grpc (~> 1.19.0)
+      jaeger-client (~> 0.10)
+      opentracing (~> 0.4)
    gitlab-markup (1.7.0)
    gollum-grit_adapter (1.0.1)
      gitlab-grit (~> 2.7, >= 2.7.1)
    google-protobuf (3.7.1)
    googleapis-common-protos-types (1.0.4)
      google-protobuf (~> 3.0)
-    grpc (1.15.0)
+    grpc (1.19.0)
      google-protobuf (~> 3.1)
      googleapis-common-protos-types (~> 1.0.0)
-    hashdiff (0.3.8)
+    hashdiff (0.3.9)
    i18n (1.6.0)
      concurrent-ruby (~> 1.0)
    ice_nine (0.11.2)
+    jaeger-client (0.10.0)
+      opentracing (~> 0.3)
+      thrift
+    jaro_winkler (1.5.2)
    json (2.2.0)
    licensee (8.9.2)
      rugged (~> 0.24)
    listen (0.5.3)
+    loofah (2.2.3)
+      crass (~> 1.0.2)
+      nokogiri (>= 1.5.9)
    memoizable (0.4.2)
      thread_safe (~> 0.3, >= 0.3.1)
    method_source (0.9.2)
    mime-types (3.2.2)
      mime-types-data (~> 3.2015)
-    mime-types-data (3.2018.0812)
+    mime-types-data (3.2019.0331)
    mini_portile2 (2.4.0)
    minitest (5.11.3)
-    msgpack (1.2.6)
+    msgpack (1.2.10)
    multi_json (1.13.1)
    multipart-post (2.0.0)
-    nokogiri (1.10.2)
+    nokogiri (1.10.3)
      mini_portile2 (~> 2.4.0)
    nokogumbo (1.5.0)
      nokogiri
+    opentracing (0.5.0)
    optimist (3.0.0)
-    parallel (1.12.1)
-    parser (2.5.3.0)
+    parallel (1.17.0)
+    parser (2.6.3.0)
      ast (~> 2.4.0)
    posix-spawn (0.3.13)
-    powerpack (0.1.2)
    proc_to_ast (0.1.0)
      coderay
      parser
@ -107,6 +133,14 @@ GEM
      coderay (~> 1.1.0)
      method_source (~> 0.9.0)
    public_suffix (3.0.3)
+    rack (2.0.7)
+    rack-test (1.1.0)
+      rack (>= 1.0, < 3)
+    rails-dom-testing (2.0.3)
+      activesupport (>= 4.2.0)
+      nokogiri (>= 1.6)
+    rails-html-sanitizer (1.0.4)
+      loofah (~> 2.2, >= 2.2.2)
    rainbow (3.0.0)
    rbtrace (0.4.11)
      ffi (>= 1.0.6)
@ -114,35 +148,35 @@ GEM
      optimist (>= 3.0.0)
    rdoc (4.3.0)
    rouge (3.3.0)
-    rspec (3.7.0)
-      rspec-core (~> 3.7.0)
-      rspec-expectations (~> 3.7.0)
-      rspec-mocks (~> 3.7.0)
-    rspec-core (3.7.1)
-      rspec-support (~> 3.7.0)
-    rspec-expectations (3.7.0)
+    rspec (3.8.0)
+      rspec-core (~> 3.8.0)
+      rspec-expectations (~> 3.8.0)
+      rspec-mocks (~> 3.8.0)
+    rspec-core (3.8.0)
+      rspec-support (~> 3.8.0)
+    rspec-expectations (3.8.3)
      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.7.0)
-    rspec-mocks (3.7.0)
+      rspec-support (~> 3.8.0)
+    rspec-mocks (3.8.0)
      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.7.0)
-    rspec-parameterized (0.4.0)
-      binding_of_caller
+      rspec-support (~> 3.8.0)
+    rspec-parameterized (0.4.2)
+      binding_ninja (>= 0.2.3)
      parser
      proc_to_ast
      rspec (>= 2.13, < 4)
      unparser
-    rspec-support (3.7.1)
-    rubocop (0.54.0)
+    rspec-support (3.8.0)
+    rubocop (0.69.0)
+      jaro_winkler (~> 1.5.1)
      parallel (~> 1.10)
-      parser (>= 2.5)
-      powerpack (~> 0.1)
+      parser (>= 2.6)
      rainbow (>= 2.2.2, < 4.0)
      ruby-progressbar (~> 1.7)
-      unicode-display_width (~> 1.0, >= 1.0.1)
+      unicode-display_width (>= 1.4.0, < 1.7)
    ruby-progressbar (1.10.0)
    rugged (0.28.1)
-    safe_yaml (1.0.4)
+    safe_yaml (1.0.5)
    sanitize (4.6.6)
      crass (~> 1.0.2)
      nokogiri (>= 1.4.4)
@ -156,17 +190,18 @@ GEM
    simplecov-html (0.9.0)
    stringex (2.8.5)
    thread_safe (0.3.6)
+    thrift (0.11.0.0)
    timecop (0.9.1)
    tzinfo (1.2.5)
      thread_safe (~> 0.1)
-    unicode-display_width (1.4.0)
-    unparser (0.2.8)
+    unicode-display_width (1.6.0)
+    unparser (0.4.5)
      abstract_type (~> 0.0.7)
      adamantium (~> 0.2.0)
      concord (~> 0.1.5)
      diff-lcs (~> 1.3)
      equalizer (~> 0.0.9)
-      parser (>= 2.3.1.2, < 2.6)
+      parser (~> 2.6.3)
      procto (~> 0.0.2)
    vcr (4.0.0)
    webmock (3.4.2)
@ -178,17 +213,18 @@ PLATFORMS
  ruby

 DEPENDENCIES
-  activesupport (~> 5.0.2)
-  bundler (>= 1.16.5)
+  activesupport (~> 5.1.7)
+  bundler (>= 1.17.3)
  factory_bot
  faraday (~> 0.12)
-  gitaly-proto (~> 1.22.0)
+  gitaly-proto (~> 1.32.0)
  github-linguist (~> 6.1)
  gitlab-gollum-lib (~> 4.2.7.7)
  gitlab-gollum-rugged_adapter (~> 0.4.4.2)
+  gitlab-labkit (~> 0.3.0)
  gitlab-markup (~> 1.7.0)
-  google-protobuf (~> 3.6)
-  grpc (~> 1.15.0)
+  google-protobuf (~> 3.7.1)
+  grpc (~> 1.19.0)
  licensee (~> 8.9.0)
  listen (~> 0.5.0)
  pry (~> 0.12.2)
@ -196,7 +232,7 @@ DEPENDENCIES
  rdoc (~> 4.2)
  rspec
  rspec-parameterized
-  rubocop (~> 0.50)
+  rubocop (~> 0.69)
  rugged (~> 0.28)
  sentry-raven (~> 2.9.0)
  simplecov (~> 0.9.0)
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@ -1,20 +1,30 @@
-{ stdenv, fetchFromGitLab, buildGoPackage, ruby, bundlerEnv }:
+{ stdenv, fetchFromGitLab, buildGoPackage, ruby, bundlerEnv, pkgconfig, libgit2 }:

 let
-  rubyEnv = bundlerEnv {
+  rubyEnv = bundlerEnv rec {
    name = "gitaly-env";
    inherit ruby;
    gemdir = ./.;
+    gemset =
+      let x = import (gemdir + "/gemset.nix");
+      in x // {
+        # grpc expects the AR environment variable to contain `ar rpc`. See the
+        # discussion in nixpkgs #63056.
+        grpc = x.grpc // {
+          patches = [ ../fix-grpc-ar.patch ];
+          dontBuild = false;
+        };
+      };
  };
 in buildGoPackage rec {
-  version = "1.34.3";
+  version = "1.47.0";
  name = "gitaly-${version}";

  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitaly";
    rev = "v${version}";
-    sha256 = "0lv3czkxcan2zv9asd79nn8z1bihyxszi1d5hazmb299v23cppzm";
+    sha256 = "1b8gshvwiypwl0f4963l37y7sjrn851marr77fhczx128axrniiw";
  };

  goPackagePath = "gitlab.com/gitlab-org/gitaly";
@ -23,7 +33,10 @@ in buildGoPackage rec {
    inherit rubyEnv;
  };

-  buildInputs = [ rubyEnv.wrappedRuby ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ rubyEnv.wrappedRuby libgit2 ];
+  goDeps = ./deps.nix;
+  preBuild = "rm -r go/src/gitlab.com/gitlab-org/labkit/vendor";

  postInstall = ''
    mkdir -p $ruby
@ -42,7 +55,7 @@ in buildGoPackage rec {
  meta = with stdenv.lib; {
    homepage = http://www.gitlab.com/;
    platforms = platforms.unix;
-    maintainers = with maintainers; [ roblabla ];
+    maintainers = with maintainers; [ roblabla globin fpletz ];
    license = licenses.mit;
  };
 }
--- a/pkgs/applications/version-management/gitlab/gitaly/deps.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/deps.nix
@ -0,0 +1,687 @@
+# file generated from go.mod using vgo2nix (https://github.com/adisbladis/vgo2nix)
+[
+  {
+    goPackagePath = "cloud.google.com/go";
+    fetch = {
+      type = "git";
+      url = "https://code.googlesource.com/gocloud";
+      rev = "v0.26.0";
+      sha256 = "149v3ci17g6wd2pm18mzcncq5qpl9hwdjnz3rlbn5rfidyn46la1";
+    };
+  }
+  {
+    goPackagePath = "github.com/BurntSushi/toml";
+    fetch = {
+      type = "git";
+      url = "https://github.com/BurntSushi/toml";
+      rev = "v0.3.1";
+      sha256 = "1fjdwwfzyzllgiwydknf1pwjvy49qxfsczqx5gz3y0izs7as99j6";
+    };
+  }
+  {
+    goPackagePath = "github.com/OneOfOne/xxhash";
+    fetch = {
+      type = "git";
+      url = "https://github.com/OneOfOne/xxhash";
+      rev = "v1.2.2";
+      sha256 = "1mjfhrwhvxa48rycjnqpqzm521i38h1hdyz6pdwmhd7xb8j6gwi6";
+    };
+  }
+  {
+    goPackagePath = "github.com/alecthomas/template";
+    fetch = {
+      type = "git";
+      url = "https://github.com/alecthomas/template";
+      rev = "a0175ee3bccc";
+      sha256 = "0qjgvvh26vk1cyfq9fadyhfgdj36f1iapbmr5xp6zqipldz8ffxj";
+    };
+  }
+  {
+    goPackagePath = "github.com/alecthomas/units";
+    fetch = {
+      type = "git";
+      url = "https://github.com/alecthomas/units";
+      rev = "2efee857e7cf";
+      sha256 = "1j65b91qb9sbrml9cpabfrcf07wmgzzghrl7809hjjhrmbzri5bl";
+    };
+  }
+  {
+    goPackagePath = "github.com/beorn7/perks";
+    fetch = {
+      type = "git";
+      url = "https://github.com/beorn7/perks";
+      rev = "v1.0.0";
+      sha256 = "1i1nz1f6g55xi2y3aiaz5kqfgvknarbfl4f0sx4nyyb4s7xb1z9x";
+    };
+  }
+  {
+    goPackagePath = "github.com/certifi/gocertifi";
+    fetch = {
+      type = "git";
+      url = "https://github.com/certifi/gocertifi";
+      rev = "ee1a9a0726d2";
+      sha256 = "08l6lqaw83pva6fa0aafmhmy1mhb145av21772zfh3ij809a37i4";
+    };
+  }
+  {
+    goPackagePath = "github.com/cespare/xxhash";
+    fetch = {
+      type = "git";
+      url = "https://github.com/cespare/xxhash";
+      rev = "v1.1.0";
+      sha256 = "1qyzlcdcayavfazvi03izx83fvip8h36kis44zr2sg7xf6sx6l4x";
+    };
+  }
+  {
+    goPackagePath = "github.com/client9/misspell";
+    fetch = {
+      type = "git";
+      url = "https://github.com/client9/misspell";
+      rev = "v0.3.4";
+      sha256 = "1vwf33wsc4la25zk9nylpbp9px3svlmldkm0bha4hp56jws4q9cs";
+    };
+  }
+  {
+    goPackagePath = "github.com/cloudflare/tableflip";
+    fetch = {
+      type = "git";
+      url = "https://github.com/cloudflare/tableflip";
+      rev = "8392f1641731";
+      sha256 = "0by5hk8s0bhhl3kiw658p5g53zvc61k4q2wxnh1w64p5ghd1rfn8";
+    };
+  }
+  {
+    goPackagePath = "github.com/codahale/hdrhistogram";
+    fetch = {
+      type = "git";
+      url = "https://github.com/codahale/hdrhistogram";
+      rev = "3a0bb77429bd";
+      sha256 = "1zampgfjbxy192cbwdi7g86l1idxaam96d834wncnpfdwgh5kl57";
+    };
+  }
+  {
+    goPackagePath = "github.com/davecgh/go-spew";
+    fetch = {
+      type = "git";
+      url = "https://github.com/davecgh/go-spew";
+      rev = "v1.1.1";
+      sha256 = "0hka6hmyvp701adzag2g26cxdj47g21x6jz4sc6jjz1mn59d474y";
+    };
+  }
+  {
+    goPackagePath = "github.com/dgryski/go-sip13";
+    fetch = {
+      type = "git";
+      url = "https://github.com/dgryski/go-sip13";
+      rev = "e10d5fee7954";
+      sha256 = "15fyibfas209ljz3f7g07kdmfbl3hhyd9n5n7aq5n5p9m5mn41d6";
+    };
+  }
+  {
+    goPackagePath = "github.com/fsnotify/fsnotify";
+    fetch = {
+      type = "git";
+      url = "https://github.com/fsnotify/fsnotify";
+      rev = "v1.4.7";
+      sha256 = "07va9crci0ijlivbb7q57d2rz9h27zgn2fsm60spjsqpdbvyrx4g";
+    };
+  }
+  {
+    goPackagePath = "github.com/getsentry/raven-go";
+    fetch = {
+      type = "git";
+      url = "https://github.com/getsentry/raven-go";
+      rev = "v0.1.2";
+      sha256 = "1dl80kar4lzdcfl3w6jssi1ld6bv0rmx6sp6bz6rzysfr9ilm02z";
+    };
+  }
+  {
+    goPackagePath = "github.com/go-kit/kit";
+    fetch = {
+      type = "git";
+      url = "https://github.com/go-kit/kit";
+      rev = "v0.8.0";
+      sha256 = "1rcywbc2pvab06qyf8pc2rdfjv7r6kxdv2v4wnpqnjhz225wqvc0";
+    };
+  }
+  {
+    goPackagePath = "github.com/go-logfmt/logfmt";
+    fetch = {
+      type = "git";
+      url = "https://github.com/go-logfmt/logfmt";
+      rev = "v0.4.0";
+      sha256 = "06smxc112xmixz78nyvk3b2hmc7wasf2sl5vxj1xz62kqcq9lzm9";
+    };
+  }
+  {
+    goPackagePath = "github.com/go-stack/stack";
+    fetch = {
+      type = "git";
+      url = "https://github.com/go-stack/stack";
+      rev = "v1.8.0";
+      sha256 = "0wk25751ryyvxclyp8jdk5c3ar0cmfr8lrjb66qbg4808x66b96v";
+    };
+  }
+  {
+    goPackagePath = "github.com/gogo/protobuf";
+    fetch = {
+      type = "git";
+      url = "https://github.com/gogo/protobuf";
+      rev = "v1.1.1";
+      sha256 = "1525pq7r6h3s8dncvq8gxi893p2nq8dxpzvq0nfl5b4p6mq0v1c2";
+    };
+  }
+  {
+    goPackagePath = "github.com/golang/glog";
+    fetch = {
+      type = "git";
+      url = "https://github.com/golang/glog";
+      rev = "23def4e6c14b";
+      sha256 = "0jb2834rw5sykfr937fxi8hxi2zy80sj2bdn9b3jb4b26ksqng30";
+    };
+  }
+  {
+    goPackagePath = "github.com/golang/lint";
+    fetch = {
+      type = "git";
+      url = "https://github.com/golang/lint";
+      rev = "06c8688daad7";
+      sha256 = "0xi94dwvz50a66bq1hp9fyqkym5mcpdxdb1hrfvicldgjf37lc47";
+    };
+  }
+  {
+    goPackagePath = "github.com/golang/mock";
+    fetch = {
+      type = "git";
+      url = "https://github.com/golang/mock";
+      rev = "v1.1.1";
+      sha256 = "0ap8wb6pdl6ccmdb43advjll2ly4sz26wsc3axw0hbrjrybybzgy";
+    };
+  }
+  {
+    goPackagePath = "github.com/golang/protobuf";
+    fetch = {
+      type = "git";
+      url = "https://github.com/golang/protobuf";
+      rev = "v1.3.1";
+      sha256 = "15am4s4646qy6iv0g3kkqq52rzykqjhm4bf08dk0fy2r58knpsyl";
+    };
+  }
+  {
+    goPackagePath = "github.com/grpc-ecosystem/go-grpc-middleware";
+    fetch = {
+      type = "git";
+      url = "https://github.com/grpc-ecosystem/go-grpc-middleware";
+      rev = "v1.0.0";
+      sha256 = "0lwgxih021xfhfb1xb9la5f98bpgpaiz63sbllx77qwwl2rmhrsp";
+    };
+  }
+  {
+    goPackagePath = "github.com/grpc-ecosystem/go-grpc-prometheus";
+    fetch = {
+      type = "git";
+      url = "https://github.com/grpc-ecosystem/go-grpc-prometheus";
+      rev = "v1.2.0";
+      sha256 = "1lzk54h7np32b3acidg1ggbn8ppbnns0m71gcg9d1qkkdh8zrijl";
+    };
+  }
+  {
+    goPackagePath = "github.com/hpcloud/tail";
+    fetch = {
+      type = "git";
+      url = "https://github.com/hpcloud/tail";
+      rev = "v1.0.0";
+      sha256 = "1njpzc0pi1acg5zx9y6vj9xi6ksbsc5d387rd6904hy6rh2m6kn0";
+    };
+  }
+  {
+    goPackagePath = "github.com/julienschmidt/httprouter";
+    fetch = {
+      type = "git";
+      url = "https://github.com/julienschmidt/httprouter";
+      rev = "v1.2.0";
+      sha256 = "1k8bylc9s4vpvf5xhqh9h246dl1snxrzzz0614zz88cdh8yzs666";
+    };
+  }
+  {
+    goPackagePath = "github.com/kelseyhightower/envconfig";
+    fetch = {
+      type = "git";
+      url = "https://github.com/kelseyhightower/envconfig";
+      rev = "v1.3.0";
+      sha256 = "1zcq480ig7wbg4378qcfxznp2gzqmk7x6rbxizflvg9v2f376vrw";
+    };
+  }
+  {
+    goPackagePath = "github.com/kisielk/gotool";
+    fetch = {
+      type = "git";
+      url = "https://github.com/kisielk/gotool";
+      rev = "v1.0.0";
+      sha256 = "14af2pa0ssyp8bp2mvdw184s5wcysk6akil3wzxmr05wwy951iwn";
+    };
+  }
+  {
+    goPackagePath = "github.com/konsorten/go-windows-terminal-sequences";
+    fetch = {
+      type = "git";
+      url = "https://github.com/konsorten/go-windows-terminal-sequences";
+      rev = "v1.0.1";
+      sha256 = "1lchgf27n276vma6iyxa0v1xds68n2g8lih5lavqnx5x6q5pw2ip";
+    };
+  }
+  {
+    goPackagePath = "github.com/kr/logfmt";
+    fetch = {
+      type = "git";
+      url = "https://github.com/kr/logfmt";
+      rev = "b84e30acd515";
+      sha256 = "02ldzxgznrfdzvghfraslhgp19la1fczcbzh7wm2zdc6lmpd1qq9";
+    };
+  }
+  {
+    goPackagePath = "github.com/libgit2/git2go";
+    fetch = {
+      type = "git";
+      url = "https://github.com/libgit2/git2go";
+      rev = "ecaeb7a21d47";
+      sha256 = "1sh30jnzjag7ddhr4if65j8vpcpj4rw93sf1g033jf91flrzyx23";
+    };
+  }
+  {
+    goPackagePath = "github.com/lightstep/lightstep-tracer-go";
+    fetch = {
+      type = "git";
+      url = "https://github.com/lightstep/lightstep-tracer-go";
+      rev = "v0.15.6";
+      sha256 = "0g5bh3xdrsz30npk79h5ia340xyw97424xfrfzv3acqw3qg2sqn8";
+    };
+  }
+  {
+    goPackagePath = "github.com/matttproud/golang_protobuf_extensions";
+    fetch = {
+      type = "git";
+      url = "https://github.com/matttproud/golang_protobuf_extensions";
+      rev = "v1.0.1";
+      sha256 = "1d0c1isd2lk9pnfq2nk0aih356j30k3h1gi2w0ixsivi5csl7jya";
+    };
+  }
+  {
+    goPackagePath = "github.com/mwitkow/go-conntrack";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mwitkow/go-conntrack";
+      rev = "cc309e4a2223";
+      sha256 = "0nbrnpk7bkmqg9mzwsxlm0y8m7s9qd9phr1q30qlx2qmdmz7c1mf";
+    };
+  }
+  {
+    goPackagePath = "github.com/oklog/ulid";
+    fetch = {
+      type = "git";
+      url = "https://github.com/oklog/ulid";
+      rev = "v1.3.1";
+      sha256 = "0hybwyid820n80axrk863k2py93hbqlq6hxhf84ppmz0qd0ys0gq";
+    };
+  }
+  {
+    goPackagePath = "github.com/onsi/ginkgo";
+    fetch = {
+      type = "git";
+      url = "https://github.com/onsi/ginkgo";
+      rev = "v1.7.0";
+      sha256 = "14wgpdrvpc35rdz3859bz53sc1g4vpr1fysy15wy3ff9gmqs14yg";
+    };
+  }
+  {
+    goPackagePath = "github.com/onsi/gomega";
+    fetch = {
+      type = "git";
+      url = "https://github.com/onsi/gomega";
+      rev = "v1.4.3";
+      sha256 = "1c8rqg5i2hz3snmq7s41yar1zjnzilb0fyiyhkg83v97afcfx79v";
+    };
+  }
+  {
+    goPackagePath = "github.com/opentracing/opentracing-go";
+    fetch = {
+      type = "git";
+      url = "https://github.com/opentracing/opentracing-go";
+      rev = "v1.0.2";
+      sha256 = "0i0ghg94dg8lk05mw5n23983wq04yjvkjmdkc9z5y1f3508938h9";
+    };
+  }
+  {
+    goPackagePath = "github.com/philhofer/fwd";
+    fetch = {
+      type = "git";
+      url = "https://github.com/philhofer/fwd";
+      rev = "v1.0.0";
+      sha256 = "1pg84khadh79v42y8sjsdgfb54vw2kzv7hpapxkifgj0yvcp30g2";
+    };
+  }
+  {
+    goPackagePath = "github.com/pkg/errors";
+    fetch = {
+      type = "git";
+      url = "https://github.com/pkg/errors";
+      rev = "v0.8.0";
+      sha256 = "001i6n71ghp2l6kdl3qq1v2vmghcz3kicv9a5wgcihrzigm75pp5";
+    };
+  }
+  {
+    goPackagePath = "github.com/pmezard/go-difflib";
+    fetch = {
+      type = "git";
+      url = "https://github.com/pmezard/go-difflib";
+      rev = "v1.0.0";
+      sha256 = "0c1cn55m4rypmscgf0rrb88pn58j3ysvc2d0432dp3c6fqg6cnzw";
+    };
+  }
+  {
+    goPackagePath = "github.com/prometheus/client_golang";
+    fetch = {
+      type = "git";
+      url = "https://github.com/prometheus/client_golang";
+      rev = "v0.9.3";
+      sha256 = "1608rm1y2p3iv8k2x7wyc6hshvpbfkv2k77hy0x870syms1g3g1p";
+    };
+  }
+  {
+    goPackagePath = "github.com/prometheus/client_model";
+    fetch = {
+      type = "git";
+      url = "https://github.com/prometheus/client_model";
+      rev = "fd36f4220a90";
+      sha256 = "1bs5d72k361llflgl94c22n0w53j30rsfh84smgk8mbjbcmjsaa5";
+    };
+  }
+  {
+    goPackagePath = "github.com/prometheus/common";
+    fetch = {
+      type = "git";
+      url = "https://github.com/prometheus/common";
+      rev = "v0.4.0";
+      sha256 = "00008pczafy982m59n1j31pnp41f4grbc2c40jccp52xg3m5klmr";
+    };
+  }
+  {
+    goPackagePath = "github.com/prometheus/procfs";
+    fetch = {
+      type = "git";
+      url = "https://github.com/prometheus/procfs";
+      rev = "5867b95ac084";
+      sha256 = "1rahdk62ajj4zpfb3mgzjqip773la9fb0m87m7s9a0b39l3fmzvr";
+    };
+  }
+  {
+    goPackagePath = "github.com/prometheus/tsdb";
+    fetch = {
+      type = "git";
+      url = "https://github.com/prometheus/tsdb";
+      rev = "v0.7.1";
+      sha256 = "1c1da8i5byvhh4fp3vqjfb65aaksjskn3ggb8wg9hcfzjrhgpz04";
+    };
+  }
+  {
+    goPackagePath = "github.com/sirupsen/logrus";
+    fetch = {
+      type = "git";
+      url = "https://github.com/sirupsen/logrus";
+      rev = "v1.2.0";
+      sha256 = "0r6334x2bls8ddznvzaldx4g88msjjns4mlks95rqrrg7h0ijigg";
+    };
+  }
+  {
+    goPackagePath = "github.com/spaolacci/murmur3";
+    fetch = {
+      type = "git";
+      url = "https://github.com/spaolacci/murmur3";
+      rev = "f09979ecbc72";
+      sha256 = "1lv3zyz3jy2d76bhvvs8svygx66606iygdvwy5cwc0p5z8yghq25";
+    };
+  }
+  {
+    goPackagePath = "github.com/stretchr/objx";
+    fetch = {
+      type = "git";
+      url = "https://github.com/stretchr/objx";
+      rev = "v0.1.1";
+      sha256 = "0iph0qmpyqg4kwv8jsx6a56a7hhqq8swrazv40ycxk9rzr0s8yls";
+    };
+  }
+  {
+    goPackagePath = "github.com/stretchr/testify";
+    fetch = {
+      type = "git";
+      url = "https://github.com/stretchr/testify";
+      rev = "v1.2.2";
+      sha256 = "0dlszlshlxbmmfxj5hlwgv3r22x0y1af45gn1vd198nvvs3pnvfs";
+    };
+  }
+  {
+    goPackagePath = "github.com/tinylib/msgp";
+    fetch = {
+      type = "git";
+      url = "https://github.com/tinylib/msgp";
+      rev = "v1.1.0";
+      sha256 = "08ha23sn14071ywrgxlyj7r523vzdwx1i83dcp1mqa830glgqaff";
+    };
+  }
+  {
+    goPackagePath = "github.com/uber-go/atomic";
+    fetch = {
+      type = "git";
+      url = "https://github.com/uber-go/atomic";
+      rev = "v1.3.2";
+      sha256 = "11pzvjys5ddjjgrv94pgk9pnip9yyb54z7idf33zk7p7xylpnsv6";
+    };
+  }
+  {
+    goPackagePath = "github.com/uber/jaeger-client-go";
+    fetch = {
+      type = "git";
+      url = "https://github.com/uber/jaeger-client-go";
+      rev = "v2.15.0";
+      sha256 = "1qvqkf20dp5fyfg7qd3jc29q1yv0qjz2mkxa02j1v3n8ka134rff";
+    };
+  }
+  {
+    goPackagePath = "github.com/uber/jaeger-lib";
+    fetch = {
+      type = "git";
+      url = "https://github.com/uber/jaeger-lib";
+      rev = "v1.5.0";
+      sha256 = "113fwpn80ylx970w8h7nfqnhh18dpx1jadbk7rbr8k68q4di4y0q";
+    };
+  }
+  {
+    goPackagePath = "gitlab.com/gitlab-org/gitaly-proto";
+    fetch = {
+      type = "git";
+      url = "https://gitlab.com/gitlab-org/gitaly-proto.git";
+      rev = "v1.32.0";
+      sha256 = "16ykk5gv1gxhhg7xfr5ldgzq8vmlzjsn58fs0bmdc4w35lbnwi4v";
+    };
+  }
+  {
+    goPackagePath = "gitlab.com/gitlab-org/labkit";
+    fetch = {
+      type = "git";
+      url = "https://gitlab.com/gitlab-org/labkit.git";
+      rev = "0c3fc7cdd57c";
+      sha256 = "0fpn37v7dhhdgd63v4mq9cna9wdzrsfams13qmjmps3xpdw2wr9i";
+    };
+  }
+  {
+    goPackagePath = "go.uber.org/atomic";
+    fetch = {
+      type = "git";
+      url = "https://github.com/uber-go/atomic";
+      rev = "v1.3.2";
+      sha256 = "11pzvjys5ddjjgrv94pgk9pnip9yyb54z7idf33zk7p7xylpnsv6";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/crypto";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/crypto";
+      rev = "c2843e01d9a2";
+      sha256 = "01xgxbj5r79nmisdvpq48zfy8pzaaj90bn6ngd4nf33j9ar1dp8r";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/lint";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/lint";
+      rev = "06c8688daad7";
+      sha256 = "0xi94dwvz50a66bq1hp9fyqkym5mcpdxdb1hrfvicldgjf37lc47";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/net";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/net";
+      rev = "d8887717615a";
+      sha256 = "1wfm6ngxjyj7v5a2dqib6lw8bb2rdnf1kl48diykxjrsddn0s163";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/oauth2";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/oauth2";
+      rev = "d2e6202438be";
+      sha256 = "0wbn75fd10485nb93bm4kqldqifdim5xqy4v7r5sdvimvf3fyhn7";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/sync";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/sync";
+      rev = "37e7f081c4d4";
+      sha256 = "1bb0mw6ckb1k7z8v3iil2qlqwfj408fvvp8m1cik2b46p7snyjhm";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/sys";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/sys";
+      rev = "d0b11bdaac8a";
+      sha256 = "18yfsmw622l7gc5sqriv5qmck6903vvhivpzp8i3xfy3z33dybdl";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/text";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/text";
+      rev = "v0.3.0";
+      sha256 = "0r6x6zjzhr8ksqlpiwm5gdd7s209kwk5p4lw54xjvz10cs3qlq19";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/tools";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/tools";
+      rev = "6cd1fcedba52";
+      sha256 = "00hl0vkmy8impsnmc2dmm55sdhia95k0kqcrjbdpynryn1lamn5d";
+    };
+  }
+  {
+    goPackagePath = "google.golang.org/appengine";
+    fetch = {
+      type = "git";
+      url = "https://github.com/golang/appengine";
+      rev = "v1.1.0";
+      sha256 = "1pz202zszg8f35dk5pfhwgcdi3r6dx1l4yk6x6ly7nb4j45zi96x";
+    };
+  }
+  {
+    goPackagePath = "google.golang.org/genproto";
+    fetch = {
+      type = "git";
+      url = "https://github.com/google/go-genproto";
+      rev = "bd91e49a0898";
+      sha256 = "1f5q04h03q6fksbfkhz13ai5849rkkb8xrmmi7cxs4lzsi6ixkg8";
+    };
+  }
+  {
+    goPackagePath = "google.golang.org/grpc";
+    fetch = {
+      type = "git";
+      url = "https://github.com/grpc/grpc-go";
+      rev = "v1.16.0";
+      sha256 = "0a9xl6c5j7lvsb4q6ry5p892rjm86p47d4f8xrf0r8lxblf79qbg";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/DataDog/dd-trace-go.v1";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/DataDog/dd-trace-go.v1";
+      rev = "v1.7.0";
+      sha256 = "0j45skiiayfsaw8id4g20k51zfr0raj47a03q2icka5xrh3qj6yq";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/alecthomas/kingpin.v2";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/alecthomas/kingpin.v2";
+      rev = "v2.2.6";
+      sha256 = "0mndnv3hdngr3bxp7yxfd47cas4prv98sqw534mx7vp38gd88n5r";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/check.v1";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/check.v1";
+      rev = "20d25e280405";
+      sha256 = "0k1m83ji9l1a7ng8a7v40psbymxasmssbrrhpdv2wl4rhs0nc3np";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/fsnotify.v1";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/fsnotify.v1";
+      rev = "v1.4.7";
+      sha256 = "07va9crci0ijlivbb7q57d2rz9h27zgn2fsm60spjsqpdbvyrx4g";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/tomb.v1";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/tomb.v1";
+      rev = "dd632973f1e7";
+      sha256 = "1lqmq1ag7s4b3gc3ddvr792c5xb5k6sfn0cchr3i2s7f1c231zjv";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/yaml.v2";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/yaml.v2";
+      rev = "v2.2.2";
+      sha256 = "01wj12jzsdqlnidpyjssmj0r4yavlqy7dwrg7adqd8dicjc4ncsa";
+    };
+  }
+  {
+    goPackagePath = "honnef.co/go/tools";
+    fetch = {
+      type = "git";
+      url = "https://github.com/dominikh/go-tools";
+      rev = "88497007e858";
+      sha256 = "0rinkyx3r2bq45mgcasnn5jb07cwbv3p3s2wwcrzxsarsj6wa5lc";
+    };
+  }
+]
--- a/pkgs/applications/version-management/gitlab/gitaly/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/gemset.nix
@ -7,16 +7,38 @@
    };
    version = "0.0.7";
  };
+  actionpack = {
+    dependencies = ["actionview" "activesupport" "rack" "rack-test" "rails-dom-testing" "rails-html-sanitizer"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0zyi3dc50ii2msdkawaf11y4xw645ig57ha2jfnr8lpr8s1nlh52";
+      type = "gem";
+    };
+    version = "5.1.7";
+  };
+  actionview = {
+    dependencies = ["activesupport" "builder" "erubi" "rails-dom-testing" "rails-html-sanitizer"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0i2j580njb767yhf0k5ih3qqg38ybiah80ai8dsr6kjjw35aj747";
+      type = "gem";
+    };
+    version = "5.1.7";
+  };
  activesupport = {
    dependencies = ["concurrent-ruby" "i18n" "minitest" "tzinfo"];
    groups = ["default" "development" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1bcbr490ryw6295p0ja7xigcw0ivkdys90x3qbsbs8c4n1zwcp7p";
+      sha256 = "0znhiy90hdlx66jqhaycin4qrphrymsw68c36a1an7g481zvfv91";
      type = "gem";
    };
-    version = "5.0.7.2";
+    version = "5.1.7";
  };
  adamantium = {
    dependencies = ["ice_nine" "memoizable"];
@ -29,12 +51,14 @@
  };
  addressable = {
    dependencies = ["public_suffix"];
+    groups = ["default" "development" "test"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0viqszpkggqi8hq87pqp0xykhvz60g99nwmkwsb0v45kc2liwxvk";
+      sha256 = "0bcm2hchn897xjhqj9zzsxf3n9xhddymj4lsclz508f4vw3av46l";
      type = "gem";
    };
-    version = "2.5.2";
+    version = "2.6.0";
  };
  ast = {
    source = {
@ -44,14 +68,25 @@
    };
    version = "2.4.0";
  };
-  binding_of_caller = {
-    dependencies = ["debug_inspector"];
+  binding_ninja = {
+    groups = ["default" "development" "test"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "05syqlks7463zsy1jdfbbdravdhj9hpj5pv2m74blqpv8bq4vv5g";
+      sha256 = "17fa3sv6p2fw9g8fxpwx1kjhhs28aw41akkba0hlgvk60055b1aa";
      type = "gem";
    };
-    version = "0.8.0";
+    version = "0.2.3";
+  };
+  builder = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0qibi5s67lpdv1wgcj66wcymcr04q6j4mzws6a479n0mlrmh5wr1";
+      type = "gem";
+    };
+    version = "3.2.3";
  };
  charlock_holmes = {
    source = {
@ -79,12 +114,14 @@
    version = "0.1.5";
  };
  concurrent-ruby = {
+    groups = ["default" "development" "test"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "18q9skp5pfq4jwbxzmw8q2rn4cpw6mf4561i2hsjcl1nxdag2jvb";
+      sha256 = "1x07r23s7836cpp5z9yrlbpljcxpax14yw4fy4bnp6crhr6x24an";
      type = "gem";
    };
-    version = "1.1.3";
+    version = "1.1.5";
  };
  crack = {
    dependencies = ["safe_yaml"];
@ -103,14 +140,6 @@
    };
    version = "1.0.4";
  };
-  debug_inspector = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0vxr0xa1mfbkfcrn71n7c4f2dj7la5hvphn904vh20j3x4j5lrx0";
-      type = "gem";
-    };
-    version = "0.0.3";
-  };
  diff-lcs = {
    source = {
      remotes = ["https://rubygems.org"];
@ -135,6 +164,16 @@
    };
    version = "0.0.11";
  };
+  erubi = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1kagnf6ziahj0d781s6ryy6fwqwa3ad4xbzzj84p9m4nv4c2jir1";
+      type = "gem";
+    };
+    version = "1.8.0";
+  };
  escape_utils = {
    source = {
      remotes = ["https://rubygems.org"];
@ -145,21 +184,25 @@
  };
  factory_bot = {
    dependencies = ["activesupport"];
+    groups = ["development" "test"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "13q1b7imb591068plg4ashgsqgzarvfjz6xxn3jk6klzikz5zhg1";
+      sha256 = "02ijqa3g6lb8l8mvi40z1zgh9bb3gr08p2r2ym159ghhfbcrmbwk";
      type = "gem";
    };
-    version = "4.11.1";
+    version = "5.0.2";
  };
  faraday = {
    dependencies = ["multipart-post"];
+    groups = ["default"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "16hwxc8v0z6gkanckjhx0ffgqmzpc4ywz4dfhxpjlz2mbz8d5m52";
+      sha256 = "0s72m05jvzc1pd6cw1i289chas399q0a14xrwg4rvkdwy7bgzrh0";
      type = "gem";
    };
-    version = "0.15.3";
+    version = "0.15.4";
  };
  ffi = {
    source = {
@ -184,10 +227,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "114q2qnd6196xvzmv3jia4n4j4wm3rizqbvxjd9156g0hc20q6yf";
+      sha256 = "0glqy22p0xfaa3kvvrba04pj1dva8wpzlvhka37cvlqq95djcy19";
      type = "gem";
    };
-    version = "1.22.0";
+    version = "1.32.0";
  };
  github-linguist = {
    dependencies = ["charlock_holmes" "escape_utils" "mime-types" "rugged"];
@ -239,6 +282,17 @@
    };
    version = "2.8.2";
  };
+  gitlab-labkit = {
+    dependencies = ["actionpack" "activesupport" "grpc" "jaeger-client" "opentracing"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0dvapmdc9axm9dq2gg89qrqb318rkrsabpyybrqvcx1ipbi5k3a1";
+      type = "gem";
+    };
+    version = "0.3.0";
+  };
  gitlab-markup = {
    groups = ["default"];
    platforms = [];
@ -281,20 +335,24 @@
  };
  grpc = {
    dependencies = ["google-protobuf" "googleapis-common-protos-types"];
+    groups = ["default"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0m2wspnm1cfkmhlbp7yqv5bb4vsfh246cm0aavxra67aw4l8plhb";
+      sha256 = "1rdywzism5vxz8pnml6xjb9f19diclyy74014z69q01jzqwi1wgs";
      type = "gem";
    };
-    version = "1.15.0";
+    version = "1.19.0";
  };
  hashdiff = {
+    groups = ["default" "development" "test"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "19ykg5pax8798nh1yv71adkx0zzs7gn2rxjj86v7nsw0jba5lask";
+      sha256 = "1qji49afni3c90zws617x514xi7ik70g2iwngj9skq68mjcq6y4x";
      type = "gem";
    };
-    version = "0.3.8";
+    version = "0.3.9";
  };
  i18n = {
    dependencies = ["concurrent-ruby"];
@ -315,6 +373,27 @@
    };
    version = "0.11.2";
  };
+  jaeger-client = {
+    dependencies = ["opentracing" "thrift"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "198m72c9w3wfwr1mq22dcjjm7d4jd0bci4lrq6zq2zvlzhi04n8l";
+      type = "gem";
+    };
+    version = "0.10.0";
+  };
+  jaro_winkler = {
+    groups = ["default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1zz27z88qznix4r65gd9h56gl177snlfpgv10b0s69vi8qpl909l";
+      type = "gem";
+    };
+    version = "1.5.2";
+  };
  json = {
    groups = ["default"];
    platforms = [];
@ -342,6 +421,17 @@
    };
    version = "0.5.3";
  };
+  loofah = {
+    dependencies = ["crass" "nokogiri"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1ccsid33xjajd0im2xv941aywi58z7ihwkvaf1w2bv89vn5bhsjg";
+      type = "gem";
+    };
+    version = "2.2.3";
+  };
  memoizable = {
    dependencies = ["thread_safe"];
    source = {
@ -369,12 +459,14 @@
    version = "3.2.2";
  };
  mime-types-data = {
+    groups = ["default"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "07wvp0aw2gjm4njibb70as6rh5hi1zzri5vky1q6jx95h8l56idc";
+      sha256 = "1m00pg19cm47n1qlcxgl91ajh2yq0fszvn1vy8fy0s1jkrp9fw4a";
      type = "gem";
    };
-    version = "3.2018.0812";
+    version = "3.2019.0331";
  };
  mini_portile2 = {
    source = {
@ -393,12 +485,14 @@
    version = "5.11.3";
  };
  msgpack = {
+    groups = ["default"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0031gd2mjyba6jb7m97sqa149zjkr0vzn2s2gpb3m9nb67gqkm13";
+      sha256 = "1w38hilm3dk42dwk8ygiq49bl4in7y80hfqr63hk54mj4gmzi6ch";
      type = "gem";
    };
-    version = "1.2.6";
+    version = "1.2.10";
  };
  multi_json = {
    source = {
@ -422,10 +516,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0sy96cc8i5y4p67fhf4d9c6sg8ymrrva21zyvzw55l0pa1582wx2";
+      sha256 = "02bjydih0j515szfv9mls195cvpyidh6ixm7dwbl3s2sbaxxk5s4";
      type = "gem";
    };
-    version = "1.10.2";
+    version = "1.10.3";
  };
  nokogumbo = {
    dependencies = ["nokogiri"];
@ -436,6 +530,16 @@
    };
    version = "1.5.0";
  };
+  opentracing = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "11lj1d8vq0hkb5hjz8q4lm82cddrggpbb33dhqfn7rxhwsmxgdfy";
+      type = "gem";
+    };
+    version = "0.5.0";
+  };
  optimist = {
    source = {
      remotes = ["https://rubygems.org"];
@ -445,21 +549,25 @@
    version = "3.0.0";
  };
  parallel = {
+    groups = ["default" "development" "test"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "01hj8v1qnyl5ndrs33g8ld8ibk0rbcqdpkpznr04gkbxd11pqn67";
+      sha256 = "1x1gzgjrdlkm1aw0hfpyphsxcx90qgs3y4gmp9km3dvf4hc4qm8r";
      type = "gem";
    };
-    version = "1.12.1";
+    version = "1.17.0";
  };
  parser = {
    dependencies = ["ast"];
+    groups = ["default" "development" "test"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1zjk0w1kjj3xk8ymy1430aa4gg0k8ckphfj88br6il4pm83f0n1f";
+      sha256 = "1pnks149x0fzgqiw53qlmvcd8bi746cxdw03sjljby5s97p1fskn";
      type = "gem";
    };
-    version = "2.5.3.0";
+    version = "2.6.3.0";
  };
  posix-spawn = {
    source = {
@ -469,14 +577,6 @@
    };
    version = "0.3.13";
  };
-  powerpack = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1r51d67wd467rpdfl6x43y84vwm8f5ql9l9m85ak1s2sp3nc5hyv";
-      type = "gem";
-    };
-    version = "0.1.2";
-  };
  proc_to_ast = {
    dependencies = ["coderay" "parser" "unparser"];
    source = {
@ -511,6 +611,49 @@
    };
    version = "3.0.3";
  };
+  rack = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0z90vflxbgjy2n84r7mbyax3i2vyvvrxxrf86ljzn5rw65jgnn2i";
+      type = "gem";
+    };
+    version = "2.0.7";
+  };
+  rack-test = {
+    dependencies = ["rack"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0rh8h376mx71ci5yklnpqqn118z3bl67nnv5k801qaqn1zs62h8m";
+      type = "gem";
+    };
+    version = "1.1.0";
+  };
+  rails-dom-testing = {
+    dependencies = ["activesupport" "nokogiri"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1lfq2a7kp2x64dzzi5p4cjcbiv62vxh9lyqk2f0rqq3fkzrw8h5i";
+      type = "gem";
+    };
+    version = "2.0.3";
+  };
+  rails-html-sanitizer = {
+    dependencies = ["loofah"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1gv7vr5d9g2xmgpjfq4nxsqr70r9pr042r9ycqqnfvw5cz9c7jwr";
+      type = "gem";
+    };
+    version = "1.0.4";
+  };
  rainbow = {
    source = {
      remotes = ["https://rubygems.org"];
@ -546,65 +689,79 @@
  };
  rspec = {
    dependencies = ["rspec-core" "rspec-expectations" "rspec-mocks"];
+    groups = ["development" "test"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0134g96wzxjlig2gxzd240gm2dxfw8izcyi2h6hjmr40syzcyx01";
+      sha256 = "15ppasvb9qrscwlyjz67ppw1lnxiqnkzx5vkx1bd8x5n3dhikxc3";
      type = "gem";
    };
-    version = "3.7.0";
+    version = "3.8.0";
  };
  rspec-core = {
    dependencies = ["rspec-support"];
+    groups = ["default" "development" "test"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0zvjbymx3avxm3lf8v4gka3a862vnaxldmwvp6767bpy48nhnvjj";
+      sha256 = "1p1s5bnbqp3sxk67y0fh0x884jjym527r0vgmhbm81w7aq6b7l4p";
      type = "gem";
    };
-    version = "3.7.1";
+    version = "3.8.0";
  };
  rspec-expectations = {
    dependencies = ["diff-lcs" "rspec-support"];
+    groups = ["default" "development" "test"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1fw06wm8jdj8k7wrb8xmzj0fr1wjyb0ya13x31hidnyblm41hmvy";
+      sha256 = "1c4gs5ybf7km0qshdm92p38zvg32n1j2kr5fgs2icacz7xf2y6fy";
      type = "gem";
    };
-    version = "3.7.0";
+    version = "3.8.3";
  };
  rspec-mocks = {
    dependencies = ["diff-lcs" "rspec-support"];
+    groups = ["default" "development" "test"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0b02ya3qhqgmcywqv4570dlhav70r656f7dmvwg89whpkq1z1xr3";
+      sha256 = "06y508cjqycb4yfhxmb3nxn0v9xqf17qbd46l1dh4xhncinr4fyp";
      type = "gem";
    };
-    version = "3.7.0";
+    version = "3.8.0";
  };
  rspec-parameterized = {
-    dependencies = ["binding_of_caller" "parser" "proc_to_ast" "rspec" "unparser"];
+    dependencies = ["binding_ninja" "parser" "proc_to_ast" "rspec" "unparser"];
+    groups = ["development" "test"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0arynbr6cfjhccwc8gy2xf87nybdnncsnmfwknnh8s7d4mj730p0";
+      sha256 = "1c0892jbaznnldk1wi24qxm70g4zhw2idqx516rhgdzgd7yh5j31";
      type = "gem";
    };
-    version = "0.4.0";
+    version = "0.4.2";
  };
  rspec-support = {
+    groups = ["default" "development" "test"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1nl30xb6jmcl0awhqp6jycl01wdssblifwy921phfml70rd9flj1";
+      sha256 = "0p3m7drixrlhvj2zpc38b11x145bvm311x6f33jjcxmvcm0wq609";
      type = "gem";
    };
-    version = "3.7.1";
+    version = "3.8.0";
  };
  rubocop = {
-    dependencies = ["parallel" "parser" "powerpack" "rainbow" "ruby-progressbar" "unicode-display_width"];
+    dependencies = ["jaro_winkler" "parallel" "parser" "rainbow" "ruby-progressbar" "unicode-display_width"];
+    groups = ["development" "test"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "106y99lq0fg62k3vk1w5wwb4vq16pnh4l61skc82xck627z0h8is";
+      sha256 = "1cmw8ajaiidvrzjcsljh47f4l3lmcazqrzljgalj3szkr8ibkk5i";
      type = "gem";
    };
-    version = "0.54.0";
+    version = "0.69.0";
  };
  ruby-progressbar = {
    source = {
@ -625,12 +782,14 @@
    version = "0.28.1";
  };
  safe_yaml = {
+    groups = ["default" "development" "test"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1hly915584hyi9q9vgd968x2nsi5yag9jyf5kq60lwzi5scr7094";
+      sha256 = "0j7qv63p0vqcd838i2iy2f76c3dgwzkiz1d1xkg7n0pbnxj2vb56";
      type = "gem";
    };
-    version = "1.0.4";
+    version = "1.0.5";
  };
  sanitize = {
    dependencies = ["crass" "nokogiri" "nokogumbo"];
@ -687,6 +846,16 @@
    };
    version = "0.3.6";
  };
+  thrift = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "02p107kwx7jnkh6fpdgvaji0xdg6xkaarngkqjml6s4zny4m8slv";
+      type = "gem";
+    };
+    version = "0.11.0.0";
+  };
  timecop = {
    source = {
      remotes = ["https://rubygems.org"];
@ -705,21 +874,25 @@
    version = "1.2.5";
  };
  unicode-display_width = {
+    groups = ["default" "development" "test"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0040bsdpcmvp8w31lqi2s9s4p4h031zv52401qidmh25cgyh4a57";
+      sha256 = "08kfiniak1pvg3gn5k6snpigzvhvhyg7slmm0s2qx5zkj62c1z2w";
      type = "gem";
    };
-    version = "1.4.0";
+    version = "1.6.0";
  };
  unparser = {
    dependencies = ["abstract_type" "adamantium" "concord" "diff-lcs" "equalizer" "parser" "procto"];
+    groups = ["default" "development" "test"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0rh1649846ac17av30x0b0v9l45v0x1j2y1i8m1a7xdd0v4sld0z";
+      sha256 = "03vjj74kj86vlazhiclf63kf6gajs66k8ni34q70fdhf97d7b60c";
      type = "gem";
    };
-    version = "0.2.8";
+    version = "0.4.5";
  };
  vcr = {
    source = {
--- a/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
@ -1,14 +1,14 @@
 { stdenv, ruby, bundler, fetchFromGitLab, go }:

 stdenv.mkDerivation rec {
-  version = "9.0.0";
+  version = "9.3.0";
  name = "gitlab-shell-${version}";

  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-shell";
    rev = "v${version}";
-    sha256 = "0437pigcgd5qi9ars8br1l058h2mijyv02axlr8wdb1vjsss857g";
+    sha256 = "1r000h4sgplx7giqvqs5iy0zh3drf6qa1iiq0mxlk3h9fshs1348";
  };

  buildInputs = [ ruby bundler go ];
--- a/pkgs/applications/version-management/gitlab/gitlab-shell/remove-hardcoded-locations.patch
+++ b/pkgs/applications/version-management/gitlab/gitlab-shell/remove-hardcoded-locations.patch
@ -56,3 +56,16 @@ index 2cb76a8..f59ad5e 100644
   end
 
   def api
+diff --git a/go/internal/command/fallback/fallback.go b/go/internal/command/fallback/fallback.go
+index 2cb76a8..f59ad5e 100644
+--- a/go/internal/command/fallback/fallback.go
+++ b/go/internal/command/fallback/fallback.go
+@@ -21,7 +21,7 @@
+ )
+ 
+ func (c *Command) Execute() error {
+-	rubyCmd := filepath.Join(c.RootDir, "bin", RubyProgram)
+	rubyCmd := filepath.Join("/run/current-system/sw/bin", RubyProgram)
+ 
+ 	// Ensure rubyArgs[0] is the full path to gitlab-shell-ruby
+ 	rubyArgs := append([]string{rubyCmd}, c.Args[1:]...)
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
  name = "gitlab-workhorse-${version}";

-  version = "8.5.2";
+  version = "8.7.0";

  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-workhorse";
    rev = "v${version}";
-    sha256 = "0c1wpp81wr4x00pmc2z41xh4vy7yk97fkcg0cdy7gbz2hc5cm296";
+    sha256 = "1zlngc498hnzbxwdjn3ymr0xwrnfgnzzhn9lyf37yfbjl8x28n3z";
  };

  buildInputs = [ git go ];
--- a/pkgs/applications/version-management/gitlab/rubyEnv-ce/Gemfile
+++ b/pkgs/applications/version-management/gitlab/rubyEnv-ce/Gemfile
@ -1,7 +1,6 @@
 source 'https://rubygems.org'

-gem 'rails', '5.0.7.2'
-gem 'rails-deprecated_sanitizer', '~> 1.0.3'
+gem 'rails', '5.1.7'

 # Improves copy-on-write performance for MRI
 gem 'nakayoshi_fork', '~> 0.0.4'
@ -19,12 +18,12 @@ gem 'mysql2', '~> 0.4.10', group: :mysql
 gem 'pg', '~> 1.1', group: :postgres

 gem 'rugged', '~> 0.28'
-gem 'grape-path-helpers', '~> 1.0'
+gem 'grape-path-helpers', '~> 1.1'

 gem 'faraday', '~> 0.12'

 # Authentication libraries
-gem 'devise', '~> 4.4'
+gem 'devise', '~> 4.6'
 gem 'doorkeeper', '~> 4.3'
 gem 'doorkeeper-openid_connect', '~> 1.5'
 gem 'omniauth', '~> 1.8'
@ -42,6 +41,9 @@ gem 'omniauth-shibboleth', '~> 1.3.0'
 gem 'omniauth-twitter', '~> 1.4'
 gem 'omniauth_crowd', '~> 2.2.0'
 gem 'omniauth-authentiq', '~> 0.3.3'
+gem 'omniauth_openid_connect', '~> 0.3.1'
+gem "omniauth-ultraauth", '~> 0.0.2'
+gem 'omniauth-salesforce', '~> 1.0.5'
 gem 'rack-oauth2', '~> 1.9.3'
 gem 'jwt', '~> 2.1.0'

@ -58,6 +60,8 @@ gem 'u2f', '~> 0.2.1'
 # GitLab Pages
 gem 'validates_hostname', '~> 1.0.6'
 gem 'rubyzip', '~> 1.2.2', require: 'zip'
+# GitLab Pages letsencrypt support
+gem 'acme-client', '~> 2.0.2'

 # Browser detection
 gem 'browser', '~> 2.5'
@ -79,6 +83,7 @@ gem 'rack-cors', '~> 1.0.0', require: 'rack/cors'
 # GraphQL API
 gem 'graphql', '~> 1.8.0'
 gem 'graphiql-rails', '~> 1.4.10'
+gem 'apollo_upload_server', '~> 2.0.0.beta3'

 # Disable strong_params so that Mash does not respond to :permitted?
 gem 'hashie-forbidden_attributes'
@ -125,11 +130,12 @@ gem 'org-ruby', '~> 0.9.12'
 gem 'creole', '~> 0.5.0'
 gem 'wikicloth', '0.8.1'
 gem 'asciidoctor', '~> 1.5.8'
+gem 'asciidoctor-include-ext', '~> 0.3.1', require: false
 gem 'asciidoctor-plantuml', '0.0.8'
 gem 'rouge', '~> 3.1'
 gem 'truncato', '~> 0.7.11'
 gem 'bootstrap_form', '~> 4.2.0'
-gem 'nokogiri', '~> 1.10.1'
+gem 'nokogiri', '~> 1.10.3'
 gem 'escape_utils', '~> 1.1'

 # Calendar rendering
@ -149,6 +155,7 @@ end
 group :puma do
  gem 'puma', '~> 3.12', require: false
  gem 'puma_worker_killer', require: false
+  gem 'rack-timeout', require: false
 end

 # State machine
@ -158,13 +165,13 @@ gem 'state_machines-activerecord', '~> 0.5.1'
 gem 'acts-as-taggable-on', '~> 6.0'

 # Background jobs
-gem 'sidekiq', '~> 5.2.1'
+gem 'sidekiq', '~> 5.2.7'
 gem 'sidekiq-cron', '~> 1.0'
 gem 'redis-namespace', '~> 1.6.0'
 gem 'gitlab-sidekiq-fetcher', '~> 0.4.0', require: 'sidekiq-reliable-fetch'

 # Cron Parser
-gem 'fugit', '~> 1.1'
+gem 'fugit', '~> 1.2.1'

 # HTTP requests
 gem 'httparty', '~> 0.16.4'
@ -257,8 +264,7 @@ gem 'chronic_duration', '~> 0.10.6'
 gem 'webpack-rails', '~> 0.9.10'
 gem 'rack-proxy', '~> 0.6.0'

-gem 'sass-rails', '~> 5.0.6'
-gem 'sass', '~> 3.5'
+gem 'sassc-rails', '~> 2.1.0'
 gem 'uglifier', '~> 2.7.2'

 gem 'addressable', '~> 2.5.2'
@ -270,10 +276,13 @@ gem 'virtus', '~> 1.0.1'
 gem 'base32', '~> 0.3.0'

 # Sentry integration
-gem 'sentry-raven', '~> 2.7'
+gem 'sentry-raven', '~> 2.9'

 gem 'premailer-rails', '~> 1.9.7'

+# LabKit: Tracing and Correlation
+gem 'gitlab-labkit', '~> 0.3.0'
+
 # I18n
 gem 'ruby_parser', '~> 3.8', require: false
 gem 'rails-i18n', '~> 5.1'
@ -281,7 +290,7 @@ gem 'gettext_i18n_rails', '~> 1.8.0'
 gem 'gettext_i18n_rails_js', '~> 1.3'
 gem 'gettext', '~> 3.2.2', require: false, group: :development

-gem 'batch-loader', '~> 1.2.2'
+gem 'batch-loader', '~> 1.4.0'

 # Perf bar
 gem 'peek', '~> 1.0.1'
@ -301,17 +310,11 @@ group :metrics do
  gem 'raindrops', '~> 0.18'
 end

-group :tracing do
-  # OpenTracing
-  gem 'opentracing', '~> 0.4.3'
-  gem 'jaeger-client', '~> 0.10.0'
-end
-
 group :development do
  gem 'foreman', '~> 0.84.0'
  gem 'brakeman', '~> 4.2', require: false

-  gem 'letter_opener_web', '~> 1.3.0'
+  gem 'letter_opener_web', '~> 1.3.4'
  gem 'rblineprof', '~> 0.3.6', platform: :mri, require: false

  # Better errors handler
@ -334,7 +337,7 @@ group :development, :test do
  gem 'database_cleaner', '~> 1.7.0'
  gem 'factory_bot_rails', '~> 4.8.2'
  gem 'rspec-rails', '~> 3.7.0'
-  gem 'rspec-retry', '~> 0.4.5'
+  gem 'rspec-retry', '~> 0.6.1'
  gem 'rspec_profiling', '~> 0.0.5'
  gem 'rspec-set', '~> 0.1.3'
  gem 'rspec-parameterized', require: false
@ -345,21 +348,22 @@ group :development, :test do
  # Generate Fake data
  gem 'ffaker', '~> 2.10'

-  gem 'capybara', '~> 2.16.1'
-  gem 'capybara-screenshot', '~> 1.0.18'
-  gem 'selenium-webdriver', '~> 3.12'
+  gem 'capybara', '~> 3.22.0'
+  gem 'capybara-screenshot', '~> 1.0.22'
+  gem 'selenium-webdriver', '~> 3.141'

  gem 'spring', '~> 2.0.0'
  gem 'spring-commands-rspec', '~> 1.0.4'

-  gem 'gitlab-styles', '~> 2.4', require: false
+  gem 'gitlab-styles', '~> 2.7', require: false
  # Pin these dependencies, otherwise a new rule could break the CI pipelines
-  gem 'rubocop', '~> 0.54.0'
+  gem 'rubocop', '~> 0.69.0'
+  gem 'rubocop-performance', '~> 1.1.0'
  gem 'rubocop-rspec', '~> 1.22.1'

  gem 'scss_lint', '~> 0.56.0', require: false
-  gem 'haml_lint', '~> 0.28.0', require: false
-  gem 'simplecov', '~> 0.14.0', require: false
+  gem 'haml_lint', '~> 0.31.0', require: false
+  gem 'simplecov', '~> 0.16.1', require: false
  gem 'bundler-audit', '~> 0.5.0', require: false

  gem 'benchmark-ips', '~> 2.3.0', require: false
@ -370,6 +374,7 @@ group :development, :test do
  gem 'activerecord_sane_schema_dumper', '1.0'

  gem 'stackprof', '~> 0.2.10', require: false
+  gem 'derailed_benchmarks', require: false

  gem 'simple_po_parser', '~> 1.1.2', require: false

@ -377,7 +382,7 @@ group :development, :test do
 end

 group :test do
-  gem 'shoulda-matchers', '~> 3.1.2', require: false
+  gem 'shoulda-matchers', '~> 4.0.1', require: false
  gem 'email_spec', '~> 2.2.0'
  gem 'json-schema', '~> 2.8.0'
  gem 'webmock', '~> 3.5.1'
@ -397,6 +402,9 @@ gem 'html2text'

 gem 'ruby-prof', '~> 0.17.0'
 gem 'rbtrace', '~> 0.4', require: false
+gem 'memory_profiler', '~> 0.9', require: false
+gem 'benchmark-memory', '~> 0.1', require: false
+gem 'activerecord-explain-analyze', '~> 0.1', require: false

 # OAuth
 gem 'oauth2', '~> 1.4'
@ -419,11 +427,11 @@ group :ed25519 do
 end

 # Gitaly GRPC client
-gem 'gitaly-proto', '~> 1.22.1', require: 'gitaly'
+gem 'gitaly-proto', '~> 1.32.0', require: 'gitaly'

-gem 'grpc', '~> 1.15.0'
+gem 'grpc', '~> 1.19.0'

-gem 'google-protobuf', '~> 3.6'
+gem 'google-protobuf', '~> 3.7.1'

 gem 'toml-rb', '~> 1.0.0', require: false

--- a/pkgs/applications/version-management/gitlab/rubyEnv-ce/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/rubyEnv-ce/Gemfile.lock
@ -4,41 +4,46 @@ GEM
    RedCloth (4.3.2)
    abstract_type (0.0.7)
    ace-rails-ap (4.1.2)
-    actioncable (5.0.7.2)
-      actionpack (= 5.0.7.2)
-      nio4r (>= 1.2, < 3.0)
+    acme-client (2.0.2)
+      faraday (~> 0.9, >= 0.9.1)
+    actioncable (5.1.7)
+      actionpack (= 5.1.7)
+      nio4r (~> 2.0)
      websocket-driver (~> 0.6.1)
-    actionmailer (5.0.7.2)
-      actionpack (= 5.0.7.2)
-      actionview (= 5.0.7.2)
-      activejob (= 5.0.7.2)
+    actionmailer (5.1.7)
+      actionpack (= 5.1.7)
+      actionview (= 5.1.7)
+      activejob (= 5.1.7)
      mail (~> 2.5, >= 2.5.4)
      rails-dom-testing (~> 2.0)
-    actionpack (5.0.7.2)
-      actionview (= 5.0.7.2)
-      activesupport (= 5.0.7.2)
+    actionpack (5.1.7)
+      actionview (= 5.1.7)
+      activesupport (= 5.1.7)
      rack (~> 2.0)
-      rack-test (~> 0.6.3)
+      rack-test (>= 0.6.3)
      rails-dom-testing (~> 2.0)
      rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    actionview (5.0.7.2)
-      activesupport (= 5.0.7.2)
+    actionview (5.1.7)
+      activesupport (= 5.1.7)
      builder (~> 3.1)
-      erubis (~> 2.7.0)
+      erubi (~> 1.4)
      rails-dom-testing (~> 2.0)
      rails-html-sanitizer (~> 1.0, >= 1.0.3)
-    activejob (5.0.7.2)
-      activesupport (= 5.0.7.2)
+    activejob (5.1.7)
+      activesupport (= 5.1.7)
      globalid (>= 0.3.6)
-    activemodel (5.0.7.2)
-      activesupport (= 5.0.7.2)
-    activerecord (5.0.7.2)
-      activemodel (= 5.0.7.2)
-      activesupport (= 5.0.7.2)
-      arel (~> 7.0)
+    activemodel (5.1.7)
+      activesupport (= 5.1.7)
+    activerecord (5.1.7)
+      activemodel (= 5.1.7)
+      activesupport (= 5.1.7)
+      arel (~> 8.0)
+    activerecord-explain-analyze (0.1.0)
+      activerecord (>= 4)
+      pg
    activerecord_sane_schema_dumper (1.0)
      rails (>= 5, < 6)
-    activesupport (5.0.7.2)
+    activesupport (5.1.7)
      concurrent-ruby (~> 1.0, >= 1.0.2)
      i18n (>= 0.7, < 2)
      minitest (~> 5.1)
@ -52,13 +57,18 @@ GEM
      public_suffix (>= 2.0.2, < 4.0)
    aes_key_wrap (1.0.1)
    akismet (2.0.0)
-    arel (7.1.4)
+    apollo_upload_server (2.0.0.beta.3)
+      graphql (>= 1.8)
+      rails (>= 4.2)
+    arel (8.0.0)
    asana (0.8.1)
      faraday (~> 0.9)
      faraday_middleware (~> 0.9)
      faraday_middleware-multi_json (~> 0.0)
      oauth2 (~> 1.0)
    asciidoctor (1.5.8)
+    asciidoctor-include-ext (0.3.1)
+      asciidoctor (>= 1.5.6, < 3.0.0)
    asciidoctor-plantuml (0.0.8)
      asciidoctor (~> 1.5)
    ast (2.4.0)
@ -73,16 +83,18 @@ GEM
      thread_safe (~> 0.3, >= 0.3.1)
    babosa (1.0.2)
    base32 (0.3.2)
-    batch-loader (1.2.2)
+    batch-loader (1.4.0)
    bcrypt (3.1.12)
    bcrypt_pbkdf (1.0.0)
    benchmark-ips (2.3.0)
+    benchmark-memory (0.1.2)
+      memory_profiler (~> 0.9)
    better_errors (2.5.0)
      coderay (>= 1.0.0)
      erubi (>= 1.0.0)
      rack (>= 0.9.0)
    bindata (2.4.3)
-    binding_ninja (0.2.2)
+    binding_ninja (0.2.3)
    binding_of_caller (0.8.0)
      debug_inspector (>= 0.0.1)
    bootsnap (1.4.1)
@ -100,13 +112,14 @@ GEM
      bundler (~> 1.2)
      thor (~> 0.18)
    byebug (9.1.0)
-    capybara (2.16.1)
+    capybara (3.22.0)
      addressable
      mini_mime (>= 0.1.3)
-      nokogiri (>= 1.3.3)
-      rack (>= 1.0.0)
-      rack-test (>= 0.5.4)
-      xpath (~> 2.0)
+      nokogiri (~> 1.8)
+      rack (>= 1.6.0)
+      rack-test (>= 0.6.3)
+      regexp_parser (~> 1.5)
+      xpath (~> 3.2)
    capybara-screenshot (1.0.22)
      capybara (>= 1.0, < 4)
      launchy
@ -132,9 +145,9 @@ GEM
    concord (0.1.5)
      adamantium (~> 0.2.0)
      equalizer (~> 0.0.9)
-    concurrent-ruby (1.1.3)
-    concurrent-ruby-ext (1.1.3)
-      concurrent-ruby (= 1.1.3)
+    concurrent-ruby (1.1.5)
+    concurrent-ruby-ext (1.1.5)
+      concurrent-ruby (= 1.1.5)
    connection_pool (2.2.2)
    crack (0.4.3)
      safe_yaml (~> 1.0.0)
@ -150,10 +163,18 @@ GEM
      html-pipeline
    declarative (0.0.10)
    declarative-option (0.1.0)
+    derailed_benchmarks (1.3.5)
+      benchmark-ips (~> 2)
+      get_process_mem (~> 0)
+      heapy (~> 0)
+      memory_profiler (~> 0)
+      rack (>= 1)
+      rake (> 10, < 13)
+      thor (~> 0.19)
    descendants_tracker (0.0.4)
      thread_safe (~> 0.3, >= 0.3.1)
    device_detector (1.0.0)
-    devise (4.4.3)
+    devise (4.6.2)
      bcrypt (~> 3.0)
      orm_adapter (~> 0.1)
      railties (>= 4.1.0, < 6.0)
@ -169,7 +190,7 @@ GEM
    diffy (3.1.0)
    discordrb-webhooks-blackst0ne (3.3.0)
      rest-client (~> 2.0)
-    docile (1.1.5)
+    docile (1.3.1)
    domain_name (0.5.20180417)
      unf (>= 0.0.5, < 1.0.0)
    doorkeeper (4.3.2)
@ -185,10 +206,9 @@ GEM
      mail (~> 2.7)
    encryptor (3.0.0)
    equalizer (0.0.11)
-    erubi (1.7.1)
-    erubis (2.7.0)
+    erubi (1.8.0)
    escape_utils (1.2.1)
-    et-orbi (1.1.7)
+    et-orbi (1.2.1)
      tzinfo
    eventmachine (1.2.7)
    excon (0.62.0)
@ -257,20 +277,20 @@ GEM
    fog-xml (0.1.3)
      fog-core
      nokogiri (>= 1.5.11, < 2.0.0)
-    font-awesome-rails (4.7.0.1)
-      railties (>= 3.2, < 5.1)
+    font-awesome-rails (4.7.0.4)
+      railties (>= 3.2, < 6.0)
    foreman (0.84.0)
      thor (~> 0.19.1)
    formatador (0.2.5)
-    fugit (1.1.9)
-      et-orbi (~> 1.1, >= 1.1.7)
+    fugit (1.2.1)
+      et-orbi (~> 1.1, >= 1.1.8)
      raabro (~> 1.1)
    fuubar (2.2.0)
      rspec-core (~> 3.0)
      ruby-progressbar (~> 1.4)
    gemojione (3.3.0)
      json
-    get_process_mem (0.2.0)
+    get_process_mem (0.2.3)
    gettext (3.2.9)
      locale (>= 2.0.5)
      text (>= 1.3.0)
@ -281,17 +301,24 @@ GEM
      gettext_i18n_rails (>= 0.7.1)
      po_to_json (>= 1.0.0)
      rails (>= 3.2.0)
-    gitaly-proto (1.22.1)
+    gitaly-proto (1.32.0)
      grpc (~> 1.0)
    github-markup (1.7.0)
    gitlab-default_value_for (3.1.1)
      activerecord (>= 3.2.0, < 6.0)
+    gitlab-labkit (0.3.0)
+      actionpack (~> 5)
+      activesupport (~> 5)
+      grpc (~> 1.19.0)
+      jaeger-client (~> 0.10)
+      opentracing (~> 0.4)
    gitlab-markup (1.7.0)
    gitlab-sidekiq-fetcher (0.4.0)
      sidekiq (~> 5)
-    gitlab-styles (2.5.1)
-      rubocop (~> 0.54.0)
+    gitlab-styles (2.7.0)
+      rubocop (~> 0.69.0)
      rubocop-gitlab-security (~> 0.1.0)
+      rubocop-performance (~> 1.1.0)
      rubocop-rspec (~> 1.19)
    gitlab_omniauth-ldap (2.1.1)
      net-ldap (~> 0.16)
@ -311,8 +338,8 @@ GEM
      mime-types (~> 3.0)
      representable (~> 3.0)
      retriable (>= 2.0, < 4.0)
-    google-protobuf (3.6.1)
-    googleapis-common-protos-types (1.0.3)
+    google-protobuf (3.7.1)
+    googleapis-common-protos-types (1.0.4)
      google-protobuf (~> 3.0)
    googleauth (0.6.6)
      faraday (~> 0.12)
@ -333,8 +360,8 @@ GEM
    grape-entity (0.7.1)
      activesupport (>= 4.0)
      multi_json (>= 1.3.2)
-    grape-path-helpers (1.0.6)
-      activesupport (>= 4, < 5.1)
+    grape-path-helpers (1.1.0)
+      activesupport
      grape (~> 1.0)
      rake (~> 12)
    grape_logging (1.7.0)
@ -343,13 +370,13 @@ GEM
      railties
      sprockets-rails
    graphql (1.8.1)
-    grpc (1.15.0)
+    grpc (1.19.0)
      google-protobuf (~> 3.1)
      googleapis-common-protos-types (~> 1.0.0)
    haml (5.0.4)
      temple (>= 0.8.0)
      tilt
-    haml_lint (0.28.0)
+    haml_lint (0.31.0)
      haml (>= 4.0, < 5.1)
      rainbow
      rake (>= 10, < 13)
@ -366,6 +393,7 @@ GEM
      hashie (>= 3.0)
    health_check (2.6.0)
      rails (>= 4.0)
+    heapy (0.1.4)
    hipchat (1.5.2)
      httparty
      mimemagic
@ -399,6 +427,7 @@ GEM
    jaeger-client (0.10.0)
      opentracing (~> 0.3)
      thrift
+    jaro_winkler (1.5.2)
    jira-ruby (1.4.1)
      activesupport
      multipart-post
@ -436,9 +465,9 @@ GEM
      rest-client (~> 2.0)
    launchy (2.4.3)
      addressable (~> 2.3)
-    letter_opener (1.4.1)
+    letter_opener (1.7.0)
      launchy (~> 2.2)
-    letter_opener_web (1.3.0)
+    letter_opener_web (1.3.4)
      actionmailer (>= 3.2)
      letter_opener (~> 1.0)
      railties (>= 3.2)
@ -466,16 +495,17 @@ GEM
    memoist (0.16.0)
    memoizable (0.4.2)
      thread_safe (~> 0.3, >= 0.3.1)
+    memory_profiler (0.9.13)
    method_source (0.9.2)
    mime-types (3.2.2)
      mime-types-data (~> 3.2015)
-    mime-types-data (3.2018.0812)
+    mime-types-data (3.2019.0331)
    mimemagic (0.3.2)
    mini_magick (4.8.0)
    mini_mime (1.0.1)
    mini_portile2 (2.4.0)
    minitest (5.11.3)
-    msgpack (1.2.6)
+    msgpack (1.2.10)
    multi_json (1.13.1)
    multi_xml (0.6.0)
    multipart-post (2.0.0)
@ -488,7 +518,7 @@ GEM
    net-ssh (5.0.1)
    netrc (0.11.0)
    nio4r (2.3.1)
-    nokogiri (1.10.1)
+    nokogiri (1.10.3)
      mini_portile2 (~> 2.4.0)
    nokogumbo (1.5.0)
      nokogiri
@ -543,6 +573,9 @@ GEM
      omniauth (~> 1.9)
    omniauth-oauth2-generic (0.2.2)
      omniauth-oauth2 (~> 1.0)
+    omniauth-salesforce (1.0.5)
+      omniauth (~> 1.0)
+      omniauth-oauth2 (~> 1.0)
    omniauth-saml (1.10.0)
      omniauth (~> 1.3, >= 1.3.2)
      ruby-saml (~> 1.7)
@ -551,18 +584,34 @@ GEM
    omniauth-twitter (1.4.0)
      omniauth-oauth (~> 1.1)
      rack
+    omniauth-ultraauth (0.0.2)
+      omniauth_openid_connect (~> 0.3.0)
    omniauth_crowd (2.2.3)
      activesupport
      nokogiri (>= 1.4.4)
      omniauth (~> 1.0)
-    opentracing (0.4.3)
+    omniauth_openid_connect (0.3.1)
+      addressable (~> 2.5)
+      omniauth (~> 1.3)
+      openid_connect (~> 1.1)
+    openid_connect (1.1.6)
+      activemodel
+      attr_required (>= 1.0.0)
+      json-jwt (>= 1.5.0)
+      rack-oauth2 (>= 1.6.1)
+      swd (>= 1.0.0)
+      tzinfo
+      validate_email
+      validate_url
+      webfinger (>= 1.0.1)
+    opentracing (0.5.0)
    optimist (3.0.0)
    org-ruby (0.9.12)
      rubypants (~> 0.2)
    orm_adapter (0.5.0)
    os (1.0.0)
-    parallel (1.12.1)
-    parser (2.5.3.0)
+    parallel (1.17.0)
+    parser (2.6.3.0)
      ast (~> 2.4.0)
    parslet (1.8.2)
    peek (1.0.1)
@ -591,7 +640,6 @@ GEM
    pg (1.1.4)
    po_to_json (1.0.1)
      json (>= 1.6.0)
-    powerpack (0.1.1)
    premailer (1.10.4)
      addressable
      css_parser (>= 1.4.10)
@ -613,7 +661,7 @@ GEM
      pry (~> 0.10)
    pry-rails (0.3.6)
      pry (>= 0.10.4)
-    public_suffix (3.0.3)
+    public_suffix (3.1.0)
    puma (3.12.0)
    puma_worker_killer (0.1.0)
      get_process_mem (~> 0.2)
@ -636,26 +684,25 @@ GEM
      rack
    rack-proxy (0.6.0)
      rack
-    rack-test (0.6.3)
-      rack (>= 1.0)
-    rails (5.0.7.2)
-      actioncable (= 5.0.7.2)
-      actionmailer (= 5.0.7.2)
-      actionpack (= 5.0.7.2)
-      actionview (= 5.0.7.2)
-      activejob (= 5.0.7.2)
-      activemodel (= 5.0.7.2)
-      activerecord (= 5.0.7.2)
-      activesupport (= 5.0.7.2)
+    rack-test (1.1.0)
+      rack (>= 1.0, < 3)
+    rack-timeout (0.5.1)
+    rails (5.1.7)
+      actioncable (= 5.1.7)
+      actionmailer (= 5.1.7)
+      actionpack (= 5.1.7)
+      actionview (= 5.1.7)
+      activejob (= 5.1.7)
+      activemodel (= 5.1.7)
+      activerecord (= 5.1.7)
+      activesupport (= 5.1.7)
      bundler (>= 1.3.0)
-      railties (= 5.0.7.2)
+      railties (= 5.1.7)
      sprockets-rails (>= 2.0.0)
    rails-controller-testing (1.0.2)
      actionpack (~> 5.x, >= 5.0.1)
      actionview (~> 5.x, >= 5.0.1)
      activesupport (~> 5.x)
-    rails-deprecated_sanitizer (1.0.3)
-      activesupport (>= 4.2.0.alpha)
    rails-dom-testing (2.0.3)
      activesupport (>= 4.2.0)
      nokogiri (>= 1.6)
@ -664,9 +711,9 @@ GEM
    rails-i18n (5.1.1)
      i18n (>= 0.7, < 2)
      railties (>= 5.0, < 6)
-    railties (5.0.7.2)
-      actionpack (= 5.0.7.2)
-      activesupport (= 5.0.7.2)
+    railties (5.1.7)
+      actionpack (= 5.1.7)
+      activesupport (= 5.1.7)
      method_source
      rake (>= 0.8.7)
      thor (>= 0.18.1, < 2.0)
@ -706,7 +753,7 @@ GEM
      redis-store (>= 1.2, < 2)
    redis-store (1.6.0)
      redis (>= 2.2, < 5)
-    regexp_parser (1.3.0)
+    regexp_parser (1.5.1)
    regexp_property_values (0.3.4)
    representable (3.0.4)
      declarative (< 0.1.0)
@ -740,8 +787,8 @@ GEM
    rspec-mocks (3.7.0)
      diff-lcs (>= 1.2.0, < 2.0)
      rspec-support (~> 3.7.0)
-    rspec-parameterized (0.4.1)
-      binding_ninja (>= 0.2.1)
+    rspec-parameterized (0.4.2)
+      binding_ninja (>= 0.2.3)
      parser
      proc_to_ast
      rspec (>= 2.13, < 4)
@ -754,8 +801,8 @@ GEM
      rspec-expectations (~> 3.7.0)
      rspec-mocks (~> 3.7.0)
      rspec-support (~> 3.7.0)
-    rspec-retry (0.4.5)
-      rspec-core
+    rspec-retry (0.6.1)
+      rspec-core (> 3.3)
    rspec-set (0.1.3)
    rspec-support (3.7.1)
    rspec_junit_formatter (0.4.1)
@ -765,15 +812,17 @@ GEM
      pg
      rails
      sqlite3
-    rubocop (0.54.0)
+    rubocop (0.69.0)
+      jaro_winkler (~> 1.5.1)
      parallel (~> 1.10)
-      parser (>= 2.5)
-      powerpack (~> 0.1)
+      parser (>= 2.6)
      rainbow (>= 2.2.2, < 4.0)
      ruby-progressbar (~> 1.7)
-      unicode-display_width (~> 1.0, >= 1.0.1)
+      unicode-display_width (>= 1.4.0, < 1.7)
    rubocop-gitlab-security (0.1.1)
      rubocop (>= 0.51)
+    rubocop-performance (1.1.0)
+      rubocop (>= 0.67.0)
    rubocop-rspec (1.22.2)
      rubocop (>= 0.52.1)
    ruby-enum (0.7.2)
@ -781,10 +830,10 @@ GEM
    ruby-fogbugz (0.2.1)
      crack (~> 0.4)
    ruby-prof (0.17.0)
-    ruby-progressbar (1.9.0)
+    ruby-progressbar (1.10.0)
    ruby-saml (1.7.2)
      nokogiri (>= 1.5.10)
-    ruby_parser (3.11.0)
+    ruby_parser (3.13.1)
      sexp_processor (~> 4.9)
    rubyntlm (0.6.2)
    rubypants (0.2.0)
@ -800,12 +849,15 @@ GEM
    sass-listen (4.0.0)
      rb-fsevent (~> 0.9, >= 0.9.4)
      rb-inotify (~> 0.9, >= 0.9.7)
-    sass-rails (5.0.6)
-      railties (>= 4.0.0, < 6)
-      sass (~> 3.1)
-      sprockets (>= 2.8, < 4.0)
-      sprockets-rails (>= 2.0, < 4.0)
-      tilt (>= 1.1, < 3)
+    sassc (2.0.1)
+      ffi (~> 1.9)
+      rake
+    sassc-rails (2.1.0)
+      railties (>= 4.0.0)
+      sassc (>= 2.0)
+      sprockets (> 3.0)
+      sprockets-rails
+      tilt
    sawyer (0.8.1)
      addressable (>= 2.3.5, < 2.6)
      faraday (~> 0.8, < 1.0)
@ -815,18 +867,18 @@ GEM
    seed-fu (2.3.7)
      activerecord (>= 3.1)
      activesupport (>= 3.1)
-    selenium-webdriver (3.12.0)
+    selenium-webdriver (3.141.0)
      childprocess (~> 0.5)
-      rubyzip (~> 1.2)
+      rubyzip (~> 1.2, >= 1.2.2)
    sentry-raven (2.9.0)
      faraday (>= 0.7.6, < 1.0)
    settingslogic (2.0.9)
-    sexp_processor (4.11.0)
+    sexp_processor (4.12.0)
    sham_rack (1.3.6)
      rack
-    shoulda-matchers (3.1.2)
-      activesupport (>= 4.0.0)
-    sidekiq (5.2.5)
+    shoulda-matchers (4.0.1)
+      activesupport (>= 4.2.0)
+    sidekiq (5.2.7)
      connection_pool (~> 2.2, >= 2.2.2)
      rack (>= 1.5.0)
      rack-protection (>= 1.5.0)
@ -840,11 +892,11 @@ GEM
      jwt (>= 1.5, < 3.0)
      multi_json (~> 1.10)
    simple_po_parser (1.1.2)
-    simplecov (0.14.1)
-      docile (~> 1.1.0)
+    simplecov (0.16.1)
+      docile (~> 1.1)
      json (>= 1.8, < 3)
      simplecov-html (~> 0.10.0)
-    simplecov-html (0.10.0)
+    simplecov-html (0.10.2)
    slack-notifier (1.5.1)
    spring (2.0.2)
      activesupport (>= 4.2)
@ -867,6 +919,10 @@ GEM
    state_machines-activerecord (0.5.1)
      activerecord (>= 4.1, < 6.0)
      state_machines-activemodel (>= 0.5.0)
+    swd (1.1.2)
+      activesupport (>= 3)
+      attr_required (>= 0.0.5)
+      httpclient (>= 2.4)
    sys-filesystem (1.1.6)
      ffi
    sysexits (1.2.0)
@ -900,7 +956,7 @@ GEM
    unf (0.1.4)
      unf_ext
    unf_ext (0.0.7.5)
-    unicode-display_width (1.3.2)
+    unicode-display_width (1.6.0)
    unicorn (5.4.1)
      kgio (~> 2.6)
      raindrops (~> 0.7)
@ -908,14 +964,20 @@ GEM
      get_process_mem (~> 0)
      unicorn (>= 4, < 6)
    uniform_notifier (1.10.0)
-    unparser (0.4.2)
+    unparser (0.4.5)
      abstract_type (~> 0.0.7)
      adamantium (~> 0.2.0)
      concord (~> 0.1.5)
      diff-lcs (~> 1.3)
      equalizer (~> 0.0.9)
-      parser (>= 2.3.1.2, < 2.6)
+      parser (~> 2.6.3)
      procto (~> 0.0.2)
+    validate_email (0.1.6)
+      activemodel (>= 3.0)
+      mail (>= 2.2.5)
+    validate_url (1.0.8)
+      activemodel (>= 3.0.0)
+      public_suffix
    validates_hostname (1.0.6)
      activerecord (>= 3.0)
      activesupport (>= 3.0)
@ -928,6 +990,9 @@ GEM
    vmstat (2.3.0)
    warden (1.2.7)
      rack (>= 1.0)
+    webfinger (1.1.0)
+      activesupport
+      httpclient (>= 2.4)
    webmock (3.5.1)
      addressable (>= 2.3.6)
      crack (>= 0.3.2)
@ -943,8 +1008,8 @@ GEM
      rinku
    with_env (1.1.0)
    xml-simple (1.1.5)
-    xpath (2.1.0)
-      nokogiri (~> 1.3)
+    xpath (3.2.0)
+      nokogiri (~> 1.8)

 PLATFORMS
  ruby
@ -952,20 +1017,25 @@ PLATFORMS
 DEPENDENCIES
  RedCloth (~> 4.3.2)
  ace-rails-ap (~> 4.1.0)
+  acme-client (~> 2.0.2)
+  activerecord-explain-analyze (~> 0.1)
  activerecord_sane_schema_dumper (= 1.0)
  acts-as-taggable-on (~> 6.0)
  addressable (~> 2.5.2)
  akismet (~> 2.0)
+  apollo_upload_server (~> 2.0.0.beta3)
  asana (~> 0.8.1)
  asciidoctor (~> 1.5.8)
+  asciidoctor-include-ext (~> 0.3.1)
  asciidoctor-plantuml (= 0.0.8)
  attr_encrypted (~> 3.1.0)
  awesome_print
  babosa (~> 1.0.2)
  base32 (~> 0.3.0)
-  batch-loader (~> 1.2.2)
+  batch-loader (~> 1.4.0)
  bcrypt_pbkdf (~> 1.0)
  benchmark-ips (~> 2.3.0)
+  benchmark-memory (~> 0.1)
  better_errors (~> 2.5.0)
  binding_of_caller (~> 0.8.0)
  bootsnap (~> 1.4)
@ -974,8 +1044,8 @@ DEPENDENCIES
  browser (~> 2.5)
  bullet (~> 5.5.0)
  bundler-audit (~> 0.5.0)
-  capybara (~> 2.16.1)
-  capybara-screenshot (~> 1.0.18)
+  capybara (~> 3.22.0)
+  capybara-screenshot (~> 1.0.22)
  carrierwave (~> 1.3)
  charlock_holmes (~> 0.7.5)
  chronic (~> 0.10.2)
@ -986,8 +1056,9 @@ DEPENDENCIES
  creole (~> 0.5.0)
  database_cleaner (~> 1.7.0)
  deckar01-task_list (= 2.2.0)
+  derailed_benchmarks
  device_detector
-  devise (~> 4.4)
+  devise (~> 4.6)
  devise-two-factor (~> 3.0.0)
  diffy (~> 3.1.0)
  discordrb-webhooks-blackst0ne (~> 3.3)
@ -1014,31 +1085,32 @@ DEPENDENCIES
  fog-rackspace (~> 0.1.1)
  font-awesome-rails (~> 4.7)
  foreman (~> 0.84.0)
-  fugit (~> 1.1)
+  fugit (~> 1.2.1)
  fuubar (~> 2.2.0)
  gemojione (~> 3.3)
  gettext (~> 3.2.2)
  gettext_i18n_rails (~> 1.8.0)
  gettext_i18n_rails_js (~> 1.3)
-  gitaly-proto (~> 1.22.1)
+  gitaly-proto (~> 1.32.0)
  github-markup (~> 1.7.0)
  gitlab-default_value_for (~> 3.1.1)
+  gitlab-labkit (~> 0.3.0)
  gitlab-markup (~> 1.7.0)
  gitlab-sidekiq-fetcher (~> 0.4.0)
-  gitlab-styles (~> 2.4)
+  gitlab-styles (~> 2.7)
  gitlab_omniauth-ldap (~> 2.1.1)
  gon (~> 6.2)
  google-api-client (~> 0.23)
-  google-protobuf (~> 3.6)
+  google-protobuf (~> 3.7.1)
  gpgme (~> 2.0.18)
  grape (~> 1.1.0)
  grape-entity (~> 0.7.1)
-  grape-path-helpers (~> 1.0)
+  grape-path-helpers (~> 1.1)
  grape_logging (~> 1.7)
  graphiql-rails (~> 1.4.10)
  graphql (~> 1.8.0)
-  grpc (~> 1.15.0)
-  haml_lint (~> 0.28.0)
+  grpc (~> 1.19.0)
+  haml_lint (~> 0.31.0)
  hamlit (~> 2.8.8)
  hangouts-chat (~> 0.0.5)
  hashie-forbidden_attributes
@ -1049,7 +1121,6 @@ DEPENDENCIES
  httparty (~> 0.16.4)
  icalendar
  influxdb (~> 0.2)
-  jaeger-client (~> 0.10.0)
  jira-ruby (~> 1.4)
  js_regex (~> 3.1)
  json-schema (~> 2.8.0)
@ -1057,12 +1128,13 @@ DEPENDENCIES
  kaminari (~> 1.0)
  knapsack (~> 1.17)
  kubeclient (~> 4.2.2)
-  letter_opener_web (~> 1.3.0)
+  letter_opener_web (~> 1.3.4)
  license_finder (~> 5.4)
  licensee (~> 8.9)
  lograge (~> 0.5)
  loofah (~> 2.2)
  mail_room (~> 0.9.1)
+  memory_profiler (~> 0.9)
  method_source (~> 0.8)
  mimemagic (~> 0.3.2)
  mini_magick
@ -1071,7 +1143,7 @@ DEPENDENCIES
  nakayoshi_fork (~> 0.0.4)
  net-ldap
  net-ssh (~> 5.0)
-  nokogiri (~> 1.10.1)
+  nokogiri (~> 1.10.3)
  oauth2 (~> 1.4)
  octokit (~> 4.9)
  omniauth (~> 1.8)
@ -1085,11 +1157,13 @@ DEPENDENCIES
  omniauth-google-oauth2 (~> 0.6.0)
  omniauth-kerberos (~> 0.3.0)
  omniauth-oauth2-generic (~> 0.2.2)
+  omniauth-salesforce (~> 1.0.5)
  omniauth-saml (~> 1.10)
  omniauth-shibboleth (~> 1.3.0)
  omniauth-twitter (~> 1.4)
+  omniauth-ultraauth (~> 0.0.2)
  omniauth_crowd (~> 2.2.0)
-  opentracing (~> 0.4.3)
+  omniauth_openid_connect (~> 0.3.1)
  org-ruby (~> 0.9.12)
  peek (~> 1.0.1)
  peek-gc (~> 0.0.2)
@ -1109,9 +1183,9 @@ DEPENDENCIES
  rack-cors (~> 1.0.0)
  rack-oauth2 (~> 1.9.3)
  rack-proxy (~> 0.6.0)
-  rails (= 5.0.7.2)
+  rack-timeout
+  rails (= 5.1.7)
  rails-controller-testing
-  rails-deprecated_sanitizer (~> 1.0.3)
  rails-i18n (~> 5.1)
  rainbow (~> 3.0)
  raindrops (~> 0.18)
@ -1129,11 +1203,12 @@ DEPENDENCIES
  rqrcode-rails3 (~> 0.1.7)
  rspec-parameterized
  rspec-rails (~> 3.7.0)
-  rspec-retry (~> 0.4.5)
+  rspec-retry (~> 0.6.1)
  rspec-set (~> 0.1.3)
  rspec_junit_formatter
  rspec_profiling (~> 0.0.5)
-  rubocop (~> 0.54.0)
+  rubocop (~> 0.69.0)
+  rubocop-performance (~> 1.1.0)
  rubocop-rspec (~> 1.22.1)
  ruby-fogbugz (~> 0.2.1)
  ruby-prof (~> 0.17.0)
@ -1142,19 +1217,18 @@ DEPENDENCIES
  rubyzip (~> 1.2.2)
  rugged (~> 0.28)
  sanitize (~> 4.6)
-  sass (~> 3.5)
-  sass-rails (~> 5.0.6)
+  sassc-rails (~> 2.1.0)
  scss_lint (~> 0.56.0)
  seed-fu (~> 2.3.7)
-  selenium-webdriver (~> 3.12)
-  sentry-raven (~> 2.7)
+  selenium-webdriver (~> 3.141)
+  sentry-raven (~> 2.9)
  settingslogic (~> 2.0.9)
  sham_rack (~> 1.3.6)
-  shoulda-matchers (~> 3.1.2)
-  sidekiq (~> 5.2.1)
+  shoulda-matchers (~> 4.0.1)
+  sidekiq (~> 5.2.7)
  sidekiq-cron (~> 1.0)
  simple_po_parser (~> 1.1.2)
-  simplecov (~> 0.14.0)
+  simplecov (~> 0.16.1)
  slack-notifier (~> 1.5.1)
  spring (~> 2.0.0)
  spring-commands-rspec (~> 1.0.4)
--- a/pkgs/applications/version-management/gitlab/rubyEnv-ce/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/rubyEnv-ce/gemset.nix
--- a/pkgs/applications/version-management/gitlab/rubyEnv-ee/Gemfile
+++ b/pkgs/applications/version-management/gitlab/rubyEnv-ee/Gemfile
@ -1,7 +1,6 @@
 source 'https://rubygems.org'

-gem 'rails', '5.0.7.2'
-gem 'rails-deprecated_sanitizer', '~> 1.0.3'
+gem 'rails', '5.1.7'

 # Improves copy-on-write performance for MRI
 gem 'nakayoshi_fork', '~> 0.0.4'
@ -19,12 +18,12 @@ gem 'mysql2', '~> 0.4.10', group: :mysql
 gem 'pg', '~> 1.1', group: :postgres

 gem 'rugged', '~> 0.28'
-gem 'grape-path-helpers', '~> 1.0'
+gem 'grape-path-helpers', '~> 1.1'

 gem 'faraday', '~> 0.12'

 # Authentication libraries
-gem 'devise', '~> 4.4'
+gem 'devise', '~> 4.6'
 gem 'doorkeeper', '~> 4.3'
 gem 'doorkeeper-openid_connect', '~> 1.5'
 gem 'omniauth', '~> 1.8'
@ -42,6 +41,9 @@ gem 'omniauth-shibboleth', '~> 1.3.0'
 gem 'omniauth-twitter', '~> 1.4'
 gem 'omniauth_crowd', '~> 2.2.0'
 gem 'omniauth-authentiq', '~> 0.3.3'
+gem 'omniauth_openid_connect', '~> 0.3.1'
+gem "omniauth-ultraauth", '~> 0.0.2'
+gem 'omniauth-salesforce', '~> 1.0.5'
 gem 'rack-oauth2', '~> 1.9.3'
 gem 'jwt', '~> 2.1.0'

@ -61,6 +63,8 @@ gem 'u2f', '~> 0.2.1'
 # GitLab Pages
 gem 'validates_hostname', '~> 1.0.6'
 gem 'rubyzip', '~> 1.2.2', require: 'zip'
+# GitLab Pages letsencrypt support
+gem 'acme-client', '~> 2.0.2'

 # Browser detection
 gem 'browser', '~> 2.5'
@ -82,6 +86,7 @@ gem 'rack-cors', '~> 1.0.0', require: 'rack/cors'
 # GraphQL API
 gem 'graphql', '~> 1.8.0'
 gem 'graphiql-rails', '~> 1.4.10'
+gem 'apollo_upload_server', '~> 2.0.0.beta3'

 # Disable strong_params so that Mash does not respond to :permitted?
 gem 'hashie-forbidden_attributes'
@ -118,7 +123,7 @@ gem 'seed-fu', '~> 2.3.7'

 # Search
 gem 'elasticsearch-model', '~> 0.1.9'
-gem 'elasticsearch-rails', '~> 0.1.9'
+gem 'elasticsearch-rails', '~> 0.1.9', require: 'elasticsearch/rails/instrumentation'
 gem 'elasticsearch-api',   '5.0.3'
 gem 'aws-sdk'
 gem 'faraday_middleware-aws-signers-v4'
@ -135,11 +140,12 @@ gem 'org-ruby', '~> 0.9.12'
 gem 'creole', '~> 0.5.0'
 gem 'wikicloth', '0.8.1'
 gem 'asciidoctor', '~> 1.5.8'
+gem 'asciidoctor-include-ext', '~> 0.3.1', require: false
 gem 'asciidoctor-plantuml', '0.0.8'
 gem 'rouge', '~> 3.1'
 gem 'truncato', '~> 0.7.11'
 gem 'bootstrap_form', '~> 4.2.0'
-gem 'nokogiri', '~> 1.10.1'
+gem 'nokogiri', '~> 1.10.3'
 gem 'escape_utils', '~> 1.1'

 # Calendar rendering
@ -159,6 +165,7 @@ end
 group :puma do
  gem 'puma', '~> 3.12', require: false
  gem 'puma_worker_killer', require: false
+  gem 'rack-timeout', require: false
 end

 # State machine
@ -168,13 +175,13 @@ gem 'state_machines-activerecord', '~> 0.5.1'
 gem 'acts-as-taggable-on', '~> 6.0'

 # Background jobs
-gem 'sidekiq', '~> 5.2.1'
+gem 'sidekiq', '~> 5.2.7'
 gem 'sidekiq-cron', '~> 1.0'
 gem 'redis-namespace', '~> 1.6.0'
 gem 'gitlab-sidekiq-fetcher', '~> 0.4.0', require: 'sidekiq-reliable-fetch'

 # Cron Parser
-gem 'fugit', '~> 1.1'
+gem 'fugit', '~> 1.2.1'

 # HTTP requests
 gem 'httparty', '~> 0.16.4'
@ -267,8 +274,7 @@ gem 'chronic_duration', '~> 0.10.6'
 gem 'webpack-rails', '~> 0.9.10'
 gem 'rack-proxy', '~> 0.6.0'

-gem 'sass-rails', '~> 5.0.6'
-gem 'sass', '~> 3.5'
+gem 'sassc-rails', '~> 2.1.0'
 gem 'uglifier', '~> 2.7.2'

 gem 'addressable', '~> 2.5.2'
@ -282,10 +288,13 @@ gem 'base32', '~> 0.3.0'
 gem "gitlab-license", "~> 1.0"

 # Sentry integration
-gem 'sentry-raven', '~> 2.7'
+gem 'sentry-raven', '~> 2.9'

 gem 'premailer-rails', '~> 1.9.7'

+# LabKit: Tracing and Correlation
+gem 'gitlab-labkit', '~> 0.3.0'
+
 # I18n
 gem 'ruby_parser', '~> 3.8', require: false
 gem 'rails-i18n', '~> 5.1'
@ -293,7 +302,7 @@ gem 'gettext_i18n_rails', '~> 1.8.0'
 gem 'gettext_i18n_rails_js', '~> 1.3'
 gem 'gettext', '~> 3.2.2', require: false, group: :development

-gem 'batch-loader', '~> 1.2.2'
+gem 'batch-loader', '~> 1.4.0'

 # Perf bar
 gem 'peek', '~> 1.0.1'
@ -316,17 +325,11 @@ group :metrics do
  gem 'raindrops', '~> 0.18'
 end

-group :tracing do
-  # OpenTracing
-  gem 'opentracing', '~> 0.4.3'
-  gem 'jaeger-client', '~> 0.10.0'
-end
-
 group :development do
  gem 'foreman', '~> 0.84.0'
  gem 'brakeman', '~> 4.2', require: false

-  gem 'letter_opener_web', '~> 1.3.0'
+  gem 'letter_opener_web', '~> 1.3.4'
  gem 'rblineprof', '~> 0.3.6', platform: :mri, require: false

  # Better errors handler
@ -349,7 +352,7 @@ group :development, :test do
  gem 'database_cleaner', '~> 1.7.0'
  gem 'factory_bot_rails', '~> 4.8.2'
  gem 'rspec-rails', '~> 3.7.0'
-  gem 'rspec-retry', '~> 0.4.5'
+  gem 'rspec-retry', '~> 0.6.1'
  gem 'rspec_profiling', '~> 0.0.5'
  gem 'rspec-set', '~> 0.1.3'
  gem 'rspec-parameterized', require: false
@ -360,21 +363,22 @@ group :development, :test do
  # Generate Fake data
  gem 'ffaker', '~> 2.10'

-  gem 'capybara', '~> 2.16.1'
-  gem 'capybara-screenshot', '~> 1.0.18'
-  gem 'selenium-webdriver', '~> 3.12'
+  gem 'capybara', '~> 3.22.0'
+  gem 'capybara-screenshot', '~> 1.0.22'
+  gem 'selenium-webdriver', '~> 3.141'

  gem 'spring', '~> 2.0.0'
  gem 'spring-commands-rspec', '~> 1.0.4'

-  gem 'gitlab-styles', '~> 2.4', require: false
+  gem 'gitlab-styles', '~> 2.7', require: false
  # Pin these dependencies, otherwise a new rule could break the CI pipelines
-  gem 'rubocop', '~> 0.54.0'
+  gem 'rubocop', '~> 0.69.0'
+  gem 'rubocop-performance', '~> 1.1.0'
  gem 'rubocop-rspec', '~> 1.22.1'

  gem 'scss_lint', '~> 0.56.0', require: false
-  gem 'haml_lint', '~> 0.28.0', require: false
-  gem 'simplecov', '~> 0.14.0', require: false
+  gem 'haml_lint', '~> 0.31.0', require: false
+  gem 'simplecov', '~> 0.16.1', require: false
  gem 'bundler-audit', '~> 0.5.0', require: false

  gem 'benchmark-ips', '~> 2.3.0', require: false
@ -385,6 +389,7 @@ group :development, :test do
  gem 'activerecord_sane_schema_dumper', '1.0'

  gem 'stackprof', '~> 0.2.10', require: false
+  gem 'derailed_benchmarks', require: false

  gem 'simple_po_parser', '~> 1.1.2', require: false

@ -392,7 +397,7 @@ group :development, :test do
 end

 group :test do
-  gem 'shoulda-matchers', '~> 3.1.2', require: false
+  gem 'shoulda-matchers', '~> 4.0.1', require: false
  gem 'email_spec', '~> 2.2.0'
  gem 'json-schema', '~> 2.8.0'
  gem 'webmock', '~> 3.5.1'
@ -412,6 +417,9 @@ gem 'html2text'

 gem 'ruby-prof', '~> 0.17.0'
 gem 'rbtrace', '~> 0.4', require: false
+gem 'memory_profiler', '~> 0.9', require: false
+gem 'benchmark-memory', '~> 0.1', require: false
+gem 'activerecord-explain-analyze', '~> 0.1', require: false

 # OAuth
 gem 'oauth2', '~> 1.4'
@ -437,11 +445,11 @@ group :ed25519 do
 end

 # Gitaly GRPC client
-gem 'gitaly-proto', '~> 1.22.1', require: 'gitaly'
+gem 'gitaly-proto', '~> 1.32.0', require: 'gitaly'

-gem 'grpc', '~> 1.15.0'
+gem 'grpc', '~> 1.19.0'

-gem 'google-protobuf', '~> 3.6'
+gem 'google-protobuf', '~> 3.7.1'

 gem 'toml-rb', '~> 1.0.0', require: false

--- a/pkgs/applications/version-management/gitlab/rubyEnv-ee/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/rubyEnv-ee/Gemfile.lock
@ -4,41 +4,46 @@ GEM
    RedCloth (4.3.2)
    abstract_type (0.0.7)
    ace-rails-ap (4.1.2)
-    actioncable (5.0.7.2)
-      actionpack (= 5.0.7.2)
-      nio4r (>= 1.2, < 3.0)
+    acme-client (2.0.2)
+      faraday (~> 0.9, >= 0.9.1)
+    actioncable (5.1.7)
+      actionpack (= 5.1.7)
+      nio4r (~> 2.0)
      websocket-driver (~> 0.6.1)
-    actionmailer (5.0.7.2)
-      actionpack (= 5.0.7.2)
-      actionview (= 5.0.7.2)
-      activejob (= 5.0.7.2)
+    actionmailer (5.1.7)
+      actionpack (= 5.1.7)
+      actionview (= 5.1.7)
+      activejob (= 5.1.7)
      mail (~> 2.5, >= 2.5.4)
      rails-dom-testing (~> 2.0)
-    actionpack (5.0.7.2)
-      actionview (= 5.0.7.2)
-      activesupport (= 5.0.7.2)
+    actionpack (5.1.7)
+      actionview (= 5.1.7)
+      activesupport (= 5.1.7)
      rack (~> 2.0)
-      rack-test (~> 0.6.3)
+      rack-test (>= 0.6.3)
      rails-dom-testing (~> 2.0)
      rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    actionview (5.0.7.2)
-      activesupport (= 5.0.7.2)
+    actionview (5.1.7)
+      activesupport (= 5.1.7)
      builder (~> 3.1)
-      erubis (~> 2.7.0)
+      erubi (~> 1.4)
      rails-dom-testing (~> 2.0)
      rails-html-sanitizer (~> 1.0, >= 1.0.3)
-    activejob (5.0.7.2)
-      activesupport (= 5.0.7.2)
+    activejob (5.1.7)
+      activesupport (= 5.1.7)
      globalid (>= 0.3.6)
-    activemodel (5.0.7.2)
-      activesupport (= 5.0.7.2)
-    activerecord (5.0.7.2)
-      activemodel (= 5.0.7.2)
-      activesupport (= 5.0.7.2)
-      arel (~> 7.0)
+    activemodel (5.1.7)
+      activesupport (= 5.1.7)
+    activerecord (5.1.7)
+      activemodel (= 5.1.7)
+      activesupport (= 5.1.7)
+      arel (~> 8.0)
+    activerecord-explain-analyze (0.1.0)
+      activerecord (>= 4)
+      pg
    activerecord_sane_schema_dumper (1.0)
      rails (>= 5, < 6)
-    activesupport (5.0.7.2)
+    activesupport (5.1.7)
      concurrent-ruby (~> 1.0, >= 1.0.2)
      i18n (>= 0.7, < 2)
      minitest (~> 5.1)
@ -52,13 +57,18 @@ GEM
      public_suffix (>= 2.0.2, < 4.0)
    aes_key_wrap (1.0.1)
    akismet (2.0.0)
-    arel (7.1.4)
+    apollo_upload_server (2.0.0.beta.3)
+      graphql (>= 1.8)
+      rails (>= 4.2)
+    arel (8.0.0)
    asana (0.8.1)
      faraday (~> 0.9)
      faraday_middleware (~> 0.9)
      faraday_middleware-multi_json (~> 0.0)
      oauth2 (~> 1.0)
    asciidoctor (1.5.8)
+    asciidoctor-include-ext (0.3.1)
+      asciidoctor (>= 1.5.6, < 3.0.0)
    asciidoctor-plantuml (0.0.8)
      asciidoctor (~> 1.5)
    ast (2.4.0)
@ -81,16 +91,18 @@ GEM
      thread_safe (~> 0.3, >= 0.3.1)
    babosa (1.0.2)
    base32 (0.3.2)
-    batch-loader (1.2.2)
+    batch-loader (1.4.0)
    bcrypt (3.1.12)
    bcrypt_pbkdf (1.0.0)
    benchmark-ips (2.3.0)
+    benchmark-memory (0.1.2)
+      memory_profiler (~> 0.9)
    better_errors (2.5.0)
      coderay (>= 1.0.0)
      erubi (>= 1.0.0)
      rack (>= 0.9.0)
    bindata (2.4.3)
-    binding_ninja (0.2.2)
+    binding_ninja (0.2.3)
    binding_of_caller (0.8.0)
      debug_inspector (>= 0.0.1)
    bootsnap (1.4.1)
@ -108,13 +120,14 @@ GEM
      bundler (~> 1.2)
      thor (~> 0.18)
    byebug (9.1.0)
-    capybara (2.16.1)
+    capybara (3.22.0)
      addressable
      mini_mime (>= 0.1.3)
-      nokogiri (>= 1.3.3)
-      rack (>= 1.0.0)
-      rack-test (>= 0.5.4)
-      xpath (~> 2.0)
+      nokogiri (~> 1.8)
+      rack (>= 1.6.0)
+      rack-test (>= 0.6.3)
+      regexp_parser (~> 1.5)
+      xpath (~> 3.2)
    capybara-screenshot (1.0.22)
      capybara (>= 1.0, < 4)
      launchy
@ -140,9 +153,9 @@ GEM
    concord (0.1.5)
      adamantium (~> 0.2.0)
      equalizer (~> 0.0.9)
-    concurrent-ruby (1.1.3)
-    concurrent-ruby-ext (1.1.3)
-      concurrent-ruby (= 1.1.3)
+    concurrent-ruby (1.1.5)
+    concurrent-ruby-ext (1.1.5)
+      concurrent-ruby (= 1.1.5)
    connection_pool (2.2.2)
    contracts (0.11.0)
    crack (0.4.3)
@ -159,10 +172,18 @@ GEM
      html-pipeline
    declarative (0.0.10)
    declarative-option (0.1.0)
+    derailed_benchmarks (1.3.5)
+      benchmark-ips (~> 2)
+      get_process_mem (~> 0)
+      heapy (~> 0)
+      memory_profiler (~> 0)
+      rack (>= 1)
+      rake (> 10, < 13)
+      thor (~> 0.19)
    descendants_tracker (0.0.4)
      thread_safe (~> 0.3, >= 0.3.1)
    device_detector (1.0.0)
-    devise (4.4.3)
+    devise (4.6.2)
      bcrypt (~> 3.0)
      orm_adapter (~> 0.1)
      railties (>= 4.1.0, < 6.0)
@ -178,7 +199,7 @@ GEM
    diffy (3.1.0)
    discordrb-webhooks-blackst0ne (3.3.0)
      rest-client (~> 2.0)
-    docile (1.1.5)
+    docile (1.3.1)
    domain_name (0.5.20180417)
      unf (>= 0.0.5, < 1.0.0)
    doorkeeper (4.3.2)
@ -207,10 +228,9 @@ GEM
      mail (~> 2.7)
    encryptor (3.0.0)
    equalizer (0.0.11)
-    erubi (1.7.1)
-    erubis (2.7.0)
+    erubi (1.8.0)
    escape_utils (1.2.1)
-    et-orbi (1.1.7)
+    et-orbi (1.2.1)
      tzinfo
    eventmachine (1.2.7)
    excon (0.62.0)
@ -282,20 +302,20 @@ GEM
    fog-xml (0.1.3)
      fog-core
      nokogiri (>= 1.5.11, < 2.0.0)
-    font-awesome-rails (4.7.0.1)
-      railties (>= 3.2, < 5.1)
+    font-awesome-rails (4.7.0.4)
+      railties (>= 3.2, < 6.0)
    foreman (0.84.0)
      thor (~> 0.19.1)
    formatador (0.2.5)
-    fugit (1.1.9)
-      et-orbi (~> 1.1, >= 1.1.7)
+    fugit (1.2.1)
+      et-orbi (~> 1.1, >= 1.1.8)
      raabro (~> 1.1)
    fuubar (2.2.0)
      rspec-core (~> 3.0)
      ruby-progressbar (~> 1.4)
    gemojione (3.3.0)
      json
-    get_process_mem (0.2.0)
+    get_process_mem (0.2.3)
    gettext (3.2.9)
      locale (>= 2.0.5)
      text (>= 1.3.0)
@ -306,18 +326,25 @@ GEM
      gettext_i18n_rails (>= 0.7.1)
      po_to_json (>= 1.0.0)
      rails (>= 3.2.0)
-    gitaly-proto (1.22.1)
+    gitaly-proto (1.32.0)
      grpc (~> 1.0)
    github-markup (1.7.0)
    gitlab-default_value_for (3.1.1)
      activerecord (>= 3.2.0, < 6.0)
+    gitlab-labkit (0.3.0)
+      actionpack (~> 5)
+      activesupport (~> 5)
+      grpc (~> 1.19.0)
+      jaeger-client (~> 0.10)
+      opentracing (~> 0.4)
    gitlab-license (1.0.0)
    gitlab-markup (1.7.0)
    gitlab-sidekiq-fetcher (0.4.0)
      sidekiq (~> 5)
-    gitlab-styles (2.5.1)
-      rubocop (~> 0.54.0)
+    gitlab-styles (2.7.0)
+      rubocop (~> 0.69.0)
      rubocop-gitlab-security (~> 0.1.0)
+      rubocop-performance (~> 1.1.0)
      rubocop-rspec (~> 1.19)
    gitlab_omniauth-ldap (2.1.1)
      net-ldap (~> 0.16)
@ -337,8 +364,8 @@ GEM
      mime-types (~> 3.0)
      representable (~> 3.0)
      retriable (>= 2.0, < 4.0)
-    google-protobuf (3.6.1)
-    googleapis-common-protos-types (1.0.3)
+    google-protobuf (3.7.1)
+    googleapis-common-protos-types (1.0.4)
      google-protobuf (~> 3.0)
    googleauth (0.6.6)
      faraday (~> 0.12)
@ -359,8 +386,8 @@ GEM
    grape-entity (0.7.1)
      activesupport (>= 4.0)
      multi_json (>= 1.3.2)
-    grape-path-helpers (1.0.6)
-      activesupport (>= 4, < 5.1)
+    grape-path-helpers (1.1.0)
+      activesupport
      grape (~> 1.0)
      rake (~> 12)
    grape_logging (1.7.0)
@ -369,7 +396,7 @@ GEM
      railties
      sprockets-rails
    graphql (1.8.1)
-    grpc (1.15.0)
+    grpc (1.19.0)
      google-protobuf (~> 3.1)
      googleapis-common-protos-types (~> 1.0.0)
    gssapi (1.2.0)
@ -377,7 +404,7 @@ GEM
    haml (5.0.4)
      temple (>= 0.8.0)
      tilt
-    haml_lint (0.28.0)
+    haml_lint (0.31.0)
      haml (>= 4.0, < 5.1)
      rainbow
      rake (>= 10, < 13)
@ -394,6 +421,7 @@ GEM
      hashie (>= 3.0)
    health_check (2.6.0)
      rails (>= 4.0)
+    heapy (0.1.4)
    hipchat (1.5.2)
      httparty
      mimemagic
@ -427,6 +455,7 @@ GEM
    jaeger-client (0.10.0)
      opentracing (~> 0.3)
      thrift
+    jaro_winkler (1.5.2)
    jira-ruby (1.4.1)
      activesupport
      multipart-post
@ -465,9 +494,9 @@ GEM
      rest-client (~> 2.0)
    launchy (2.4.3)
      addressable (~> 2.3)
-    letter_opener (1.4.1)
+    letter_opener (1.7.0)
      launchy (~> 2.2)
-    letter_opener_web (1.3.0)
+    letter_opener_web (1.3.4)
      actionmailer (>= 3.2)
      letter_opener (~> 1.0)
      railties (>= 3.2)
@ -495,16 +524,17 @@ GEM
    memoist (0.16.0)
    memoizable (0.4.2)
      thread_safe (~> 0.3, >= 0.3.1)
+    memory_profiler (0.9.13)
    method_source (0.9.2)
    mime-types (3.2.2)
      mime-types-data (~> 3.2015)
-    mime-types-data (3.2018.0812)
+    mime-types-data (3.2019.0331)
    mimemagic (0.3.2)
    mini_magick (4.8.0)
    mini_mime (1.0.1)
    mini_portile2 (2.4.0)
    minitest (5.11.3)
-    msgpack (1.2.6)
+    msgpack (1.2.10)
    multi_json (1.13.1)
    multi_xml (0.6.0)
    multipart-post (2.0.0)
@ -519,7 +549,7 @@ GEM
    net-ssh (5.0.1)
    netrc (0.11.0)
    nio4r (2.3.1)
-    nokogiri (1.10.1)
+    nokogiri (1.10.3)
      mini_portile2 (~> 2.4.0)
    nokogumbo (1.5.0)
      nokogiri
@ -574,6 +604,9 @@ GEM
      omniauth (~> 1.9)
    omniauth-oauth2-generic (0.2.2)
      omniauth-oauth2 (~> 1.0)
+    omniauth-salesforce (1.0.5)
+      omniauth (~> 1.0)
+      omniauth-oauth2 (~> 1.0)
    omniauth-saml (1.10.0)
      omniauth (~> 1.3, >= 1.3.2)
      ruby-saml (~> 1.7)
@ -582,18 +615,34 @@ GEM
    omniauth-twitter (1.4.0)
      omniauth-oauth (~> 1.1)
      rack
+    omniauth-ultraauth (0.0.2)
+      omniauth_openid_connect (~> 0.3.0)
    omniauth_crowd (2.2.3)
      activesupport
      nokogiri (>= 1.4.4)
      omniauth (~> 1.0)
-    opentracing (0.4.3)
+    omniauth_openid_connect (0.3.1)
+      addressable (~> 2.5)
+      omniauth (~> 1.3)
+      openid_connect (~> 1.1)
+    openid_connect (1.1.6)
+      activemodel
+      attr_required (>= 1.0.0)
+      json-jwt (>= 1.5.0)
+      rack-oauth2 (>= 1.6.1)
+      swd (>= 1.0.0)
+      tzinfo
+      validate_email
+      validate_url
+      webfinger (>= 1.0.1)
+    opentracing (0.5.0)
    optimist (3.0.0)
    org-ruby (0.9.12)
      rubypants (~> 0.2)
    orm_adapter (0.5.0)
    os (1.0.0)
-    parallel (1.12.1)
-    parser (2.5.3.0)
+    parallel (1.17.0)
+    parser (2.6.3.0)
      ast (~> 2.4.0)
    parslet (1.8.2)
    peek (1.0.1)
@ -622,7 +671,6 @@ GEM
    pg (1.1.4)
    po_to_json (1.0.1)
      json (>= 1.6.0)
-    powerpack (0.1.1)
    premailer (1.10.4)
      addressable
      css_parser (>= 1.4.10)
@ -644,7 +692,7 @@ GEM
      pry (~> 0.10)
    pry-rails (0.3.6)
      pry (>= 0.10.4)
-    public_suffix (3.0.3)
+    public_suffix (3.1.0)
    puma (3.12.0)
    puma_worker_killer (0.1.0)
      get_process_mem (~> 0.2)
@ -667,26 +715,25 @@ GEM
      rack
    rack-proxy (0.6.0)
      rack
-    rack-test (0.6.3)
-      rack (>= 1.0)
-    rails (5.0.7.2)
-      actioncable (= 5.0.7.2)
-      actionmailer (= 5.0.7.2)
-      actionpack (= 5.0.7.2)
-      actionview (= 5.0.7.2)
-      activejob (= 5.0.7.2)
-      activemodel (= 5.0.7.2)
-      activerecord (= 5.0.7.2)
-      activesupport (= 5.0.7.2)
+    rack-test (1.1.0)
+      rack (>= 1.0, < 3)
+    rack-timeout (0.5.1)
+    rails (5.1.7)
+      actioncable (= 5.1.7)
+      actionmailer (= 5.1.7)
+      actionpack (= 5.1.7)
+      actionview (= 5.1.7)
+      activejob (= 5.1.7)
+      activemodel (= 5.1.7)
+      activerecord (= 5.1.7)
+      activesupport (= 5.1.7)
      bundler (>= 1.3.0)
-      railties (= 5.0.7.2)
+      railties (= 5.1.7)
      sprockets-rails (>= 2.0.0)
    rails-controller-testing (1.0.2)
      actionpack (~> 5.x, >= 5.0.1)
      actionview (~> 5.x, >= 5.0.1)
      activesupport (~> 5.x)
-    rails-deprecated_sanitizer (1.0.3)
-      activesupport (>= 4.2.0.alpha)
    rails-dom-testing (2.0.3)
      activesupport (>= 4.2.0)
      nokogiri (>= 1.6)
@ -695,9 +742,9 @@ GEM
    rails-i18n (5.1.1)
      i18n (>= 0.7, < 2)
      railties (>= 5.0, < 6)
-    railties (5.0.7.2)
-      actionpack (= 5.0.7.2)
-      activesupport (= 5.0.7.2)
+    railties (5.1.7)
+      actionpack (= 5.1.7)
+      activesupport (= 5.1.7)
      method_source
      rake (>= 0.8.7)
      thor (>= 0.18.1, < 2.0)
@ -737,7 +784,7 @@ GEM
      redis-store (>= 1.2, < 2)
    redis-store (1.6.0)
      redis (>= 2.2, < 5)
-    regexp_parser (1.3.0)
+    regexp_parser (1.5.1)
    regexp_property_values (0.3.4)
    representable (3.0.4)
      declarative (< 0.1.0)
@ -771,8 +818,8 @@ GEM
    rspec-mocks (3.7.0)
      diff-lcs (>= 1.2.0, < 2.0)
      rspec-support (~> 3.7.0)
-    rspec-parameterized (0.4.1)
-      binding_ninja (>= 0.2.1)
+    rspec-parameterized (0.4.2)
+      binding_ninja (>= 0.2.3)
      parser
      proc_to_ast
      rspec (>= 2.13, < 4)
@ -785,8 +832,8 @@ GEM
      rspec-expectations (~> 3.7.0)
      rspec-mocks (~> 3.7.0)
      rspec-support (~> 3.7.0)
-    rspec-retry (0.4.5)
-      rspec-core
+    rspec-retry (0.6.1)
+      rspec-core (> 3.3)
    rspec-set (0.1.3)
    rspec-support (3.7.1)
    rspec_junit_formatter (0.4.1)
@ -796,15 +843,17 @@ GEM
      pg
      rails
      sqlite3
-    rubocop (0.54.0)
+    rubocop (0.69.0)
+      jaro_winkler (~> 1.5.1)
      parallel (~> 1.10)
-      parser (>= 2.5)
-      powerpack (~> 0.1)
+      parser (>= 2.6)
      rainbow (>= 2.2.2, < 4.0)
      ruby-progressbar (~> 1.7)
-      unicode-display_width (~> 1.0, >= 1.0.1)
+      unicode-display_width (>= 1.4.0, < 1.7)
    rubocop-gitlab-security (0.1.1)
      rubocop (>= 0.51)
+    rubocop-performance (1.1.0)
+      rubocop (>= 0.67.0)
    rubocop-rspec (1.22.2)
      rubocop (>= 0.52.1)
    ruby-enum (0.7.2)
@ -812,10 +861,10 @@ GEM
    ruby-fogbugz (0.2.1)
      crack (~> 0.4)
    ruby-prof (0.17.0)
-    ruby-progressbar (1.9.0)
+    ruby-progressbar (1.10.0)
    ruby-saml (1.7.2)
      nokogiri (>= 1.5.10)
-    ruby_parser (3.11.0)
+    ruby_parser (3.13.1)
      sexp_processor (~> 4.9)
    rubyntlm (0.6.2)
    rubypants (0.2.0)
@ -831,12 +880,15 @@ GEM
    sass-listen (4.0.0)
      rb-fsevent (~> 0.9, >= 0.9.4)
      rb-inotify (~> 0.9, >= 0.9.7)
-    sass-rails (5.0.6)
-      railties (>= 4.0.0, < 6)
-      sass (~> 3.1)
-      sprockets (>= 2.8, < 4.0)
-      sprockets-rails (>= 2.0, < 4.0)
-      tilt (>= 1.1, < 3)
+    sassc (2.0.1)
+      ffi (~> 1.9)
+      rake
+    sassc-rails (2.1.0)
+      railties (>= 4.0.0)
+      sassc (>= 2.0)
+      sprockets (> 3.0)
+      sprockets-rails
+      tilt
    sawyer (0.8.1)
      addressable (>= 2.3.5, < 2.6)
      faraday (~> 0.8, < 1.0)
@ -846,18 +898,18 @@ GEM
    seed-fu (2.3.7)
      activerecord (>= 3.1)
      activesupport (>= 3.1)
-    selenium-webdriver (3.12.0)
+    selenium-webdriver (3.141.0)
      childprocess (~> 0.5)
-      rubyzip (~> 1.2)
+      rubyzip (~> 1.2, >= 1.2.2)
    sentry-raven (2.9.0)
      faraday (>= 0.7.6, < 1.0)
    settingslogic (2.0.9)
-    sexp_processor (4.11.0)
+    sexp_processor (4.12.0)
    sham_rack (1.3.6)
      rack
-    shoulda-matchers (3.1.2)
-      activesupport (>= 4.0.0)
-    sidekiq (5.2.5)
+    shoulda-matchers (4.0.1)
+      activesupport (>= 4.2.0)
+    sidekiq (5.2.7)
      connection_pool (~> 2.2, >= 2.2.2)
      rack (>= 1.5.0)
      rack-protection (>= 1.5.0)
@ -871,11 +923,11 @@ GEM
      jwt (>= 1.5, < 3.0)
      multi_json (~> 1.10)
    simple_po_parser (1.1.2)
-    simplecov (0.14.1)
-      docile (~> 1.1.0)
+    simplecov (0.16.1)
+      docile (~> 1.1)
      json (>= 1.8, < 3)
      simplecov-html (~> 0.10.0)
-    simplecov-html (0.10.0)
+    simplecov-html (0.10.2)
    slack-notifier (1.5.1)
    snowplow-tracker (0.6.1)
      contracts (~> 0.7, <= 0.11)
@ -900,10 +952,14 @@ GEM
    state_machines-activerecord (0.5.1)
      activerecord (>= 4.1, < 6.0)
      state_machines-activemodel (>= 0.5.0)
+    swd (1.1.2)
+      activesupport (>= 3)
+      attr_required (>= 0.0.5)
+      httpclient (>= 2.4)
    sys-filesystem (1.1.6)
      ffi
    sysexits (1.2.0)
-    temple (0.8.0)
+    temple (0.8.1)
    test-prof (0.2.5)
    text (1.3.1)
    thin (1.7.2)
@ -913,7 +969,7 @@ GEM
    thor (0.19.4)
    thread_safe (0.3.6)
    thrift (0.11.0.0)
-    tilt (2.0.8)
+    tilt (2.0.9)
    timecop (0.8.1)
    timfel-krb5-auth (0.8.3)
    toml (0.2.0)
@ -933,7 +989,7 @@ GEM
    unf (0.1.4)
      unf_ext
    unf_ext (0.0.7.5)
-    unicode-display_width (1.3.2)
+    unicode-display_width (1.6.0)
    unicorn (5.4.1)
      kgio (~> 2.6)
      raindrops (~> 0.7)
@ -941,14 +997,20 @@ GEM
      get_process_mem (~> 0)
      unicorn (>= 4, < 6)
    uniform_notifier (1.10.0)
-    unparser (0.4.2)
+    unparser (0.4.5)
      abstract_type (~> 0.0.7)
      adamantium (~> 0.2.0)
      concord (~> 0.1.5)
      diff-lcs (~> 1.3)
      equalizer (~> 0.0.9)
-      parser (>= 2.3.1.2, < 2.6)
+      parser (~> 2.6.3)
      procto (~> 0.0.2)
+    validate_email (0.1.6)
+      activemodel (>= 3.0)
+      mail (>= 2.2.5)
+    validate_url (1.0.8)
+      activemodel (>= 3.0.0)
+      public_suffix
    validates_hostname (1.0.6)
      activerecord (>= 3.0)
      activesupport (>= 3.0)
@ -961,6 +1023,9 @@ GEM
    vmstat (2.3.0)
    warden (1.2.7)
      rack (>= 1.0)
+    webfinger (1.1.0)
+      activesupport
+      httpclient (>= 2.4)
    webmock (3.5.1)
      addressable (>= 2.3.6)
      crack (>= 0.3.2)
@ -976,8 +1041,8 @@ GEM
      rinku
    with_env (1.1.0)
    xml-simple (1.1.5)
-    xpath (2.1.0)
-      nokogiri (~> 1.3)
+    xpath (3.2.0)
+      nokogiri (~> 1.8)

 PLATFORMS
  ruby
@ -985,21 +1050,26 @@ PLATFORMS
 DEPENDENCIES
  RedCloth (~> 4.3.2)
  ace-rails-ap (~> 4.1.0)
+  acme-client (~> 2.0.2)
+  activerecord-explain-analyze (~> 0.1)
  activerecord_sane_schema_dumper (= 1.0)
  acts-as-taggable-on (~> 6.0)
  addressable (~> 2.5.2)
  akismet (~> 2.0)
+  apollo_upload_server (~> 2.0.0.beta3)
  asana (~> 0.8.1)
  asciidoctor (~> 1.5.8)
+  asciidoctor-include-ext (~> 0.3.1)
  asciidoctor-plantuml (= 0.0.8)
  attr_encrypted (~> 3.1.0)
  awesome_print
  aws-sdk
  babosa (~> 1.0.2)
  base32 (~> 0.3.0)
-  batch-loader (~> 1.2.2)
+  batch-loader (~> 1.4.0)
  bcrypt_pbkdf (~> 1.0)
  benchmark-ips (~> 2.3.0)
+  benchmark-memory (~> 0.1)
  better_errors (~> 2.5.0)
  binding_of_caller (~> 0.8.0)
  bootsnap (~> 1.4)
@ -1008,8 +1078,8 @@ DEPENDENCIES
  browser (~> 2.5)
  bullet (~> 5.5.0)
  bundler-audit (~> 0.5.0)
-  capybara (~> 2.16.1)
-  capybara-screenshot (~> 1.0.18)
+  capybara (~> 3.22.0)
+  capybara-screenshot (~> 1.0.22)
  carrierwave (~> 1.3)
  charlock_holmes (~> 0.7.5)
  chronic (~> 0.10.2)
@ -1020,8 +1090,9 @@ DEPENDENCIES
  creole (~> 0.5.0)
  database_cleaner (~> 1.7.0)
  deckar01-task_list (= 2.2.0)
+  derailed_benchmarks
  device_detector
-  devise (~> 4.4)
+  devise (~> 4.6)
  devise-two-factor (~> 3.0.0)
  diffy (~> 3.1.0)
  discordrb-webhooks-blackst0ne (~> 3.3)
@ -1052,33 +1123,34 @@ DEPENDENCIES
  fog-rackspace (~> 0.1.1)
  font-awesome-rails (~> 4.7)
  foreman (~> 0.84.0)
-  fugit (~> 1.1)
+  fugit (~> 1.2.1)
  fuubar (~> 2.2.0)
  gemojione (~> 3.3)
  gettext (~> 3.2.2)
  gettext_i18n_rails (~> 1.8.0)
  gettext_i18n_rails_js (~> 1.3)
-  gitaly-proto (~> 1.22.1)
+  gitaly-proto (~> 1.32.0)
  github-markup (~> 1.7.0)
  gitlab-default_value_for (~> 3.1.1)
+  gitlab-labkit (~> 0.3.0)
  gitlab-license (~> 1.0)
  gitlab-markup (~> 1.7.0)
  gitlab-sidekiq-fetcher (~> 0.4.0)
-  gitlab-styles (~> 2.4)
+  gitlab-styles (~> 2.7)
  gitlab_omniauth-ldap (~> 2.1.1)
  gon (~> 6.2)
  google-api-client (~> 0.23)
-  google-protobuf (~> 3.6)
+  google-protobuf (~> 3.7.1)
  gpgme (~> 2.0.18)
  grape (~> 1.1.0)
  grape-entity (~> 0.7.1)
-  grape-path-helpers (~> 1.0)
+  grape-path-helpers (~> 1.1)
  grape_logging (~> 1.7)
  graphiql-rails (~> 1.4.10)
  graphql (~> 1.8.0)
-  grpc (~> 1.15.0)
+  grpc (~> 1.19.0)
  gssapi
-  haml_lint (~> 0.28.0)
+  haml_lint (~> 0.31.0)
  hamlit (~> 2.8.8)
  hangouts-chat (~> 0.0.5)
  hashie-forbidden_attributes
@ -1089,7 +1161,6 @@ DEPENDENCIES
  httparty (~> 0.16.4)
  icalendar
  influxdb (~> 0.2)
-  jaeger-client (~> 0.10.0)
  jira-ruby (~> 1.4)
  js_regex (~> 3.1)
  json-schema (~> 2.8.0)
@ -1097,12 +1168,13 @@ DEPENDENCIES
  kaminari (~> 1.0)
  knapsack (~> 1.17)
  kubeclient (~> 4.2.2)
-  letter_opener_web (~> 1.3.0)
+  letter_opener_web (~> 1.3.4)
  license_finder (~> 5.4)
  licensee (~> 8.9)
  lograge (~> 0.5)
  loofah (~> 2.2)
  mail_room (~> 0.9.1)
+  memory_profiler (~> 0.9)
  method_source (~> 0.8)
  mimemagic (~> 0.3.2)
  mini_magick
@ -1113,7 +1185,7 @@ DEPENDENCIES
  net-ldap
  net-ntp
  net-ssh (~> 5.0)
-  nokogiri (~> 1.10.1)
+  nokogiri (~> 1.10.3)
  oauth2 (~> 1.4)
  octokit (~> 4.9)
  omniauth (~> 1.8)
@ -1127,11 +1199,13 @@ DEPENDENCIES
  omniauth-google-oauth2 (~> 0.6.0)
  omniauth-kerberos (~> 0.3.0)
  omniauth-oauth2-generic (~> 0.2.2)
+  omniauth-salesforce (~> 1.0.5)
  omniauth-saml (~> 1.10)
  omniauth-shibboleth (~> 1.3.0)
  omniauth-twitter (~> 1.4)
+  omniauth-ultraauth (~> 0.0.2)
  omniauth_crowd (~> 2.2.0)
-  opentracing (~> 0.4.3)
+  omniauth_openid_connect (~> 0.3.1)
  org-ruby (~> 0.9.12)
  peek (~> 1.0.1)
  peek-gc (~> 0.0.2)
@ -1151,9 +1225,9 @@ DEPENDENCIES
  rack-cors (~> 1.0.0)
  rack-oauth2 (~> 1.9.3)
  rack-proxy (~> 0.6.0)
-  rails (= 5.0.7.2)
+  rack-timeout
+  rails (= 5.1.7)
  rails-controller-testing
-  rails-deprecated_sanitizer (~> 1.0.3)
  rails-i18n (~> 5.1)
  rainbow (~> 3.0)
  raindrops (~> 0.18)
@ -1171,11 +1245,12 @@ DEPENDENCIES
  rqrcode-rails3 (~> 0.1.7)
  rspec-parameterized
  rspec-rails (~> 3.7.0)
-  rspec-retry (~> 0.4.5)
+  rspec-retry (~> 0.6.1)
  rspec-set (~> 0.1.3)
  rspec_junit_formatter
  rspec_profiling (~> 0.0.5)
-  rubocop (~> 0.54.0)
+  rubocop (~> 0.69.0)
+  rubocop-performance (~> 1.1.0)
  rubocop-rspec (~> 1.22.1)
  ruby-fogbugz (~> 0.2.1)
  ruby-prof (~> 0.17.0)
@ -1184,19 +1259,18 @@ DEPENDENCIES
  rubyzip (~> 1.2.2)
  rugged (~> 0.28)
  sanitize (~> 4.6)
-  sass (~> 3.5)
-  sass-rails (~> 5.0.6)
+  sassc-rails (~> 2.1.0)
  scss_lint (~> 0.56.0)
  seed-fu (~> 2.3.7)
-  selenium-webdriver (~> 3.12)
-  sentry-raven (~> 2.7)
+  selenium-webdriver (~> 3.141)
+  sentry-raven (~> 2.9)
  settingslogic (~> 2.0.9)
  sham_rack (~> 1.3.6)
-  shoulda-matchers (~> 3.1.2)
-  sidekiq (~> 5.2.1)
+  shoulda-matchers (~> 4.0.1)
+  sidekiq (~> 5.2.7)
  sidekiq-cron (~> 1.0)
  simple_po_parser (~> 1.1.2)
-  simplecov (~> 0.14.0)
+  simplecov (~> 0.16.1)
  slack-notifier (~> 1.5.1)
  snowplow-tracker (~> 0.6.1)
  spring (~> 2.0.0)
--- a/pkgs/applications/version-management/gitlab/rubyEnv-ee/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/rubyEnv-ee/gemset.nix
--- a/pkgs/applications/version-management/gitlab/update.py
+++ b/pkgs/applications/version-management/gitlab/update.py
@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#! nix-shell -i python3 -p bundix common-updater-scripts nix nix-prefetch-git python3 python3Packages.requests python3Packages.lxml python3Packages.click python3Packages.click-log
+#! nix-shell -i python3 -p bundix common-updater-scripts nix nix-prefetch-git python3 python3Packages.requests python3Packages.lxml python3Packages.click python3Packages.click-log vgo2nix

 import click
 import click_log
@ -35,8 +35,8 @@ class GitLabRepo:
        tree = ElementTree.fromstring(r.content)
        versions = [e.text for e in tree.findall('{http://www.w3.org/2005/Atom}entry/{http://www.w3.org/2005/Atom}title')]
        # filter out versions not matching version_regex
-        versions = filter(self.version_regex.match, versions)
-        
+        versions = list(filter(self.version_regex.match, versions))
+
        # sort, but ignore v and -ee for sorting comparisons
        versions.sort(key=lambda x: LooseVersion(x.replace("v", "").replace("-ee", "")), reverse=True)
        return versions
@ -194,13 +194,21 @@ def update_gitaly():
    data = _get_data_json()
    gitaly_server_version = data['ce']['passthru']['GITALY_SERVER_VERSION']
    r = GitLabRepo('gitlab-org', 'gitaly')
-    rubyenv_dir = pathlib.Path(__file__).parent / 'gitaly'
+    gitaly_dir = pathlib.Path(__file__).parent / 'gitaly'

    for fn in ['Gemfile.lock', 'Gemfile']:
-        with open(rubyenv_dir / fn, 'w') as f:
+        with open(gitaly_dir / fn, 'w') as f:
            f.write(r.get_file(f"ruby/{fn}", f"v{gitaly_server_version}"))

-    subprocess.check_output(['bundix'], cwd=rubyenv_dir)
+    for fn in ['go.mod', 'go.sum']:
+        with open(gitaly_dir / fn, 'w') as f:
+            f.write(r.get_file(fn, f"v{gitaly_server_version}"))
+
+    subprocess.check_output(['bundix'], cwd=gitaly_dir)
+    subprocess.check_output(['vgo2nix'], cwd=gitaly_dir)
+
+    for fn in ['go.mod', 'go.sum']:
+        os.unlink(gitaly_dir / fn)
    # currently broken, as `gitaly.meta.position` returns
    # pkgs/development/go-modules/generic/default.nix
    # so update-source-version doesn't know where to update hashes
--- a/pkgs/applications/window-managers/i3/status-rust.nix
+++ b/pkgs/applications/window-managers/i3/status-rust.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "i3status-rust";
-  version = "0.9.0.2019-04-27";
+  version = "0.10.0";

  src = fetchFromGitHub {
    owner = "greshake";
    repo = pname;
-    rev = "d04d08cbd4d13c64b1e3b7a8d21c46acee3bc281";
-    sha256 = "0x23qv7kwsqy1yx25fn1z56fx8w865qarr5xdx8s22x42ym4zyha";
+    rev = "v${version}";
+    sha256 = "0i1k884ha08w7r5q5z012q2w7hs333b3c18hkbrhamknpvy6c2i0";
  };

-  cargoSha256 = "0vl2zn9n7ijmjxi2lyglnghvaw4qi2bah5i6km15schlsm8c641g";
+  cargoSha256 = "1w43k3ld9ra7blbn593mpi8qg5pgcglwqwddkrb55yxnpnkaxvzy";

  nativeBuildInputs = [ pkgconfig ];

--- a/pkgs/data/fonts/fira-code/default.nix
+++ b/pkgs/data/fonts/fira-code/default.nix
@ -1,7 +1,7 @@
 { stdenv, fetchzip }:

 let
-  version = "1.206";
+  version = "1.207";
 in fetchzip {
  name = "fira-code-${version}";

@ -12,7 +12,7 @@ in fetchzip {
    unzip -j $downloadedFile \*.otf -d $out/share/fonts/opentype
  '';

-  sha256 = "0074d8q4m802f5yms8yxdx4rdz5xnpgv1w5hs330zg2p9ksicgzy";
+  sha256 = "13w2jklqndria2plgangl5gi56v1cj5ja9vznh9079kqnvq0cffz";

  meta = with stdenv.lib; {
    homepage = https://github.com/tonsky/FiraCode;
--- a/pkgs/data/fonts/victor-mono/default.nix
+++ b/pkgs/data/fonts/victor-mono/default.nix
@ -3,27 +3,37 @@
 let
  pname = "victor-mono";
  version = "1.2.1";
-in fetchFromGitHub {
+in fetchFromGitHub rec {
  name = "${pname}-${version}";

  owner = "rubjo";
  repo = pname;
  rev = "v${version}";

+  # Upstream prefers we download from the website,
+  # but we really insist on a more versioned resource.
+  # Happily, tagged releases on github contain the same
+  # file `VictorMonoAll.zip` as from the website,
+  # so we extract it from the tagged release.
+  # Both methods produce the same file, but this way
+  # we can safely reason about what version it is.
  postFetch = ''
-    tar xf $downloadedFile --strip=1
-    unzip public/VictorMonoAll.zip TTF/\*
-    mkdir -p $out/share/fonts/truetype/${pname}
-    cp TTF/*.ttf $out/share/fonts/truetype/${pname}
+    tar xvf $downloadedFile --strip-components=2 ${name}/public/VictorMonoAll.zip
+
+    mkdir -p $out/share/fonts/{true,open}type/${pname}
+
+    unzip -j VictorMonoAll.zip \*.ttf -d $out/share/fonts/truetype/${pname}
+    unzip -j VictorMonoAll.zip \*.otf -d $out/share/fonts/opentype/${pname}
  '';

-  sha256 = "0gisjcywmn3kjgwfmzcv8ibxqd126s93id2w0zjly0c7m3ckamh8";
+  sha256 = "0347n3kdyrbg42rxcgnyghi21qz5iz6w30v7ms2vjal7pfm6h2vn";

  meta = with lib; {
-    homepage = https://rubjo.github.io/victor-mono;
-    description = "A free programming font with cursive italics and ligatures";
+    description = "Free programming font with cursive italics and ligatures";
+    homepage = "https://rubjo.github.io/victor-mono";
    license = with licenses; [ mit ];
-    maintainers = with maintainers; [ jpotier ];
+    maintainers = with maintainers; [ jpotier dtzWill ];
    platforms = platforms.all;
  };
 }
+
--- a/pkgs/desktops/gnome-3/apps/gnome-getting-started-docs/default.nix
+++ b/pkgs/desktops/gnome-3/apps/gnome-getting-started-docs/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "gnome-getting-started-docs-${version}";
-  version = "3.32.1";
+  version = "3.32.2";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-getting-started-docs/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "0g4zaafj442gpir0hxv5hya37ax1ai40slls7sa2a02fdarilrjf";
+    sha256 = "1v4k465mlzrhgcdddzs6bmm0yliyrfx6jg3gh0s17a08i0w5rbwq";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/apps/switchboard-plugs/pantheon-shell/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard-plugs/pantheon-shell/default.nix
@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, pantheon, meson, ninja, pkgconfig, vala
 , libgee, granite, gexiv2, elementary-settings-daemon, gtk3, gnome-desktop
-, gala, wingpanel, plank, switchboard, gettext, bamf }:
+, gala, wingpanel, plank, switchboard, gettext, bamf, fetchpatch }:

 stdenv.mkDerivation rec {
  pname = "switchboard-plug-pantheon-shell";
@ -42,6 +42,11 @@ stdenv.mkDerivation rec {
  patches = [
    ./backgrounds.patch # Having https://github.com/elementary/switchboard-plug-pantheon-shell/issues/166 would make this patch uneeded
    ./hardcode-gsettings.patch
+    # Fixes https://github.com/elementary/switchboard-plug-pantheon-shell/issues/172
+    (fetchpatch {
+      url = "https://github.com/elementary/switchboard-plug-pantheon-shell/commit/e4f86df6a6be402db4c979a4b005573618b744d1.patch";
+      sha256 = "0sa8611k6sqg96mnp2plmxd30w6zq76bfwszl8ankr9kwsgyc66y";
+    })
  ];

  postPatch = ''
--- a/pkgs/development/beam-modules/default.nix
+++ b/pkgs/development/beam-modules/default.nix
@ -41,7 +41,7 @@ let
        buildMix = callPackage ./build-mix.nix {};

        # BEAM-based languages.
-        elixir = elixir_1_7;
+        elixir = elixir_1_9;

        elixir_1_9 = lib.callElixir ../interpreters/elixir/1.9.nix {
          inherit rebar erlang;
--- a/pkgs/development/compilers/go/1.11.nix
+++ b/pkgs/development/compilers/go/1.11.nix
@ -30,11 +30,11 @@ in

 stdenv.mkDerivation rec {
  pname = "go";
-  version = "1.11.11";
+  version = "1.11.12";

  src = fetchurl {
    url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "130g5lhg4h5xwa6chvxfi80nvdx8qb26xfbamzgyc8i5xwrprzqz";
+    sha256 = "09k9zmq7hhgg0bf1y7rwa0kn7q1vkkr94cmg2iv9lq3najh5nykd";
  };

  # perl is used for testing go vet
@ -226,7 +226,7 @@ stdenv.mkDerivation rec {
    homepage = http://golang.org/;
    description = "The Go Programming language";
    license = licenses.bsd3;
-    maintainers = with maintainers; [ cstrahan orivej velovix mic92 ];
+    maintainers = with maintainers; [ cstrahan orivej velovix mic92 rvolosatovs ];
    platforms = platforms.linux ++ platforms.darwin;
  };
 }
--- a/pkgs/development/compilers/go/1.12.nix
+++ b/pkgs/development/compilers/go/1.12.nix
@ -30,11 +30,11 @@ in

 stdenv.mkDerivation rec {
  pname = "go";
-  version = "1.12.6";
+  version = "1.12.7";

  src = fetchurl {
    url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "1jmlj8pygg4hjpkziicihcf76lz61w1qljdpm3hqlqsmfk65qv69";
+    sha256 = "04rvwj69gmw3bz8pw5pf10r21ar0pgpnswp15nkddf04dxyl9s4m";
  };

  # perl is used for testing go vet
@ -233,7 +233,7 @@ stdenv.mkDerivation rec {
    homepage = http://golang.org/;
    description = "The Go Programming language";
    license = licenses.bsd3;
-    maintainers = with maintainers; [ cstrahan orivej velovix mic92 ];
+    maintainers = with maintainers; [ cstrahan orivej velovix mic92 rvolosatovs ];
    platforms = platforms.linux ++ platforms.darwin;
  };
 }
--- a/pkgs/development/interpreters/elixir/1.9.nix
+++ b/pkgs/development/interpreters/elixir/1.9.nix
@ -1,7 +1,7 @@
 { mkDerivation }:

 mkDerivation rec {
-  version = "1.9.0";
-  sha256 = "0yfqh07wjgm10v6acn5pw8l8jndjly5kpzgw4harlj81wcaymlsw";
+  version = "1.9.1";
+  sha256 = "106s2a3dykc5iwfrd5icqd737yfzaz1dw4x5v1j5z2fvf46h96dx";
  minimumOTPVersion = "20";
 }
--- a/pkgs/development/interpreters/erlang/generic-builder.nix
+++ b/pkgs/development/interpreters/erlang/generic-builder.nix
@ -18,7 +18,7 @@
 , enableKernelPoll ? true
 , javacSupport ? false, javacPackages ? [ openjdk ]
 , odbcSupport ? false, odbcPackages ? [ unixODBC ]
-, wxSupport ? !stdenv.isDarwin, wxPackages ? [ libGLU_combined wxGTK xorg.libX11 ]
+, wxSupport ? true, wxPackages ? [ libGLU_combined wxGTK xorg.libX11 ]
 , preUnpack ? "", postUnpack ? ""
 , patches ? [], patchPhase ? "", prePatch ? "", postPatch ? ""
 , configureFlags ? [], configurePhase ? "", preConfigure ? "", postConfigure ? ""
--- a/pkgs/development/interpreters/janet/default.nix
+++ b/pkgs/development/interpreters/janet/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "janet";
-  version = "1.0.0";
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner = "janet-lang";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1n91xsq9c3x99pb3a964873kksavs223hhy62l8yiylbl81b8vix";
+    sha256 = "0ncyg594fixvvkgk0k89b40v9hy36lcr2gniks3ac6cyqy2iixx5";
  };

  nativeBuildInputs = [ meson ninja ];
--- a/pkgs/development/libraries/armadillo/default.nix
+++ b/pkgs/development/libraries/armadillo/default.nix
@ -1,12 +1,12 @@
 { stdenv, fetchurl, cmake, openblasCompat, superlu, hdf5 }:

 stdenv.mkDerivation rec {
-  version = "9.500.2";
+  version = "9.600.4";
  name = "armadillo-${version}";

  src = fetchurl {
    url = "mirror://sourceforge/arma/armadillo-${version}.tar.xz";
-    sha256 = "17npgyavzrbf4d3m28f9j7j8hk2pc91ai9nkkp39hkdflq3kw6hb";
+    sha256 = "1gph9acmk8wqs6n00csvbs94rh153y7ml0w2zlbk9ia8xbgbdbbx";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/cfitsio/darwin-curl-config.patch
+++ b/pkgs/development/libraries/cfitsio/darwin-curl-config.patch
@ -1,25 +0,0 @@
-diff -ruN cfitsio/configure cfitsio-curl-config/configure
--- cfitsio/configure	2018-05-09 21:16:00.000000000 +0200
-+++ cfitsio-curl-config/configure	2018-05-30 13:28:58.000000000 +0200
-@@ -4783,13 +4783,6 @@
- CURL_LIB=""
- CURL_INC=""
- # Use curl-config to get compiler & linker flags, if available.
-# On Macs, prefer XCode curl-config, and reject MacPorts version
-# until further notice to prevent build errors:
-if test "x$EXT" = xdarwin -a -x /usr/bin/curl-config; then
-  CURLCONFIG="/usr/bin/curl-config"
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: checking for curl-config... choosing /usr/bin/curl-config on Mac" >&5
-$as_echo "checking for curl-config... choosing /usr/bin/curl-config on Mac" >&6; }
-else
-   # Extract the first word of "curl-config", so it can be a program name with args.
- set dummy curl-config; ac_word=$2
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-@@ -4833,7 +4826,6 @@
-   fi
- fi
- fi
-fi
- CURLCONFIG=$ac_cv_prog_CURLCONFIG
- if test -n "$CURLCONFIG"; then
-   { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CURLCONFIG" >&5
--- a/pkgs/development/libraries/cfitsio/default.nix
+++ b/pkgs/development/libraries/cfitsio/default.nix
@ -2,22 +2,23 @@

 # Optional dependencies
 , bzip2 ? null }:
-
 stdenv.mkDerivation rec {
-  name = "cfitsio-${version}";
-  version = "3.450";
+  pname = "cfitsio";
+  version = "3.47";

  src = fetchurl {
-    url = "https://heasarc.gsfc.nasa.gov/FTP/software/fitsio/c/cfitsio${builtins.replaceStrings ["."] [""] version}.tar.gz";
-    sha256 = "0bmrkw6w65zb0k3mszaaqy1f4zjm2hl7njww74nb5v38wvdi4q5z";
+    url = "https://heasarc.gsfc.nasa.gov/FTP/software/fitsio/c/cfitsio-${version}.tar.gz";
+    sha256 = "1vzlxnrjckz78p2wf148v2z3krkwnykfqvlj42sz3q711vqid1a1";
  };

  buildInputs = [ bzip2 ];

-  patches = [ ./darwin-curl-config.patch ./darwin-rpath-universal.patch ];
+  patches = [ ./darwin-rpath-universal.patch ];

  configureFlags = stdenv.lib.optional (bzip2 != null) "--with-bzip2=${bzip2.out}";

+  hardeningDisable = [ "format" ];
+
  # Shared-only build
  buildFlags = "shared";
  postPatch = '' sed -e '/^install:/s/libcfitsio.a //' -e 's@/bin/@@g' -i Makefile.in
--- a/pkgs/development/libraries/graphene-hardened-malloc/default.nix
+++ b/pkgs/development/libraries/graphene-hardened-malloc/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "graphene-hardened-malloc-${version}";
-  version = "190405.003.2019.04.01.19";
+  version = "1";

  src = fetchurl {
-    url = "https://github.com/GrapheneOS/hardened_malloc/archive/PQ2A.${version}.tar.gz";
-    sha256 = "1qczmajy3q07jd236dmal4iq5xxcsrkyw26gc9r4vs4wj4m42d11";
+    url = "https://github.com/GrapheneOS/hardened_malloc/archive/${version}.tar.gz";
+    sha256 = "1z3kb9fr6w9fcdc42bh8k5b4r10sn5hrwwk4m691qjdgk5hlj3aa";
  };

  installPhase = ''
@ -17,6 +17,8 @@ stdenv.mkDerivation rec {
    chmod 0555 $out/bin/preload-hardened-malloc
  '';

+  separateDebugInfo = true;
+
  doInstallCheck = true;
  installCheckPhase = ''
    pushd test
@ -27,7 +29,7 @@ stdenv.mkDerivation rec {
    make

    # these tests don't actually appear to generate overflows currently
-    rm read_after_free_small string_overflow
+    rm read_after_free_small string_overflow eight_byte_overflow_large

    for t in `find . -regex ".*/[a-z_]+"` ; do
      echo "Running $t..."
--- a/pkgs/development/libraries/gtk+/01-build-Fix-path-handling-in-pkgconfig.patch
+++ b/pkgs/development/libraries/gtk+/01-build-Fix-path-handling-in-pkgconfig.patch
@ -0,0 +1,30 @@
+From 7b692e618c4183a51af3d3b0037f106c4fec2355 Mon Sep 17 00:00:00 2001
+From: worldofpeace <worldofpeace@protonmail.ch>
+Date: Fri, 19 Jul 2019 13:32:57 -0400
+Subject: [PATCH] build: Fix path handling in pkgconfig
+
+---
+ meson.build | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/meson.build b/meson.build
+index 36913b3f04..161b378ba5 100644
+--- a/meson.build
+++ b/meson.build
+@@ -834,10 +834,10 @@ configure_file(input: 'config.h.meson',
+ # pkg-config files - bit of a mess all of this
+ pkgconf = configuration_data()
+ 
+-pkgconf.set('prefix', get_option('prefix'))
+pkgconf.set('prefix', gtk_prefix)
+ pkgconf.set('exec_prefix', '${prefix}')
+-pkgconf.set('libdir', '${prefix}/@0@'.format(get_option('libdir')))
+-pkgconf.set('includedir', '${prefix}/@0@'.format(get_option('includedir')))
+pkgconf.set('libdir', gtk_libdir)
+pkgconf.set('includedir', join_paths('${prefix}', gtk_includedir))
+ pkgconf.set('GTK_API_VERSION', gtk_api_version)
+ pkgconf.set('VERSION', meson.project_version())
+ pkgconf.set('GTK_BINARY_VERSION', gtk_binary_version)
+-- 
+2.22.0
+
--- a/pkgs/development/libraries/gtk+/3.x.nix
+++ b/pkgs/development/libraries/gtk+/3.x.nix
@ -64,6 +64,8 @@ stdenv.mkDerivation rec {
      url = "https://bug757142.bugzilla-attachments.gnome.org/attachment.cgi?id=344123";
      sha256 = "0g6fhqcv8spfy3mfmxpyji93k8d4p4q4fz1v9a1c1cgcwkz41d7p";
    })
+    # https://gitlab.gnome.org/GNOME/gtk/merge_requests/1002
+    ./01-build-Fix-path-handling-in-pkgconfig.patch
  ] ++ optionals stdenv.isDarwin [
    # X11 module requires <gio/gdesktopappinfo.h> which is not installed on Darwin
    # let’s drop that dependency in similar way to how other parts of the library do it
--- a/pkgs/development/libraries/libargon2/default.nix
+++ b/pkgs/development/libraries/libargon2/default.nix
@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub }:

 stdenv.mkDerivation rec {
-  name = "libargon2-${version}";
-  version = "20171227";
+  pname = "libargon2";
+  version = "20190702";

  src = fetchFromGitHub {
    owner = "P-H-C";
    repo = "phc-winner-argon2";
-    rev = "${version}";
-    sha256 = "0sc9zca1anqk41017vjpas4kxi4cbn0zvicv8vj8p2sb2gy94bh8";
+    rev = version;
+    sha256 = "0p4ry9dn0mi9js0byijxdyiwx74p1nr8zj7wjpd1fjgqva4sk23i";
  };

  installPhase = ''
@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
      --replace @HOST_MULTIARCH@ ""                         \
      --replace 'prefix=/usr' "prefix=$out"

-    make install PREFIX=$out
+    make install PREFIX=$out LIBRARY_REL=lib
    ln -s $out/lib/libargon2.so $out/lib/libargon2.so.0
    runHook postInstall
  '';
@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
      Catena, Lyra2, Makwa and yescrypt were given special recognition. The PHC
      recommends using Argon2 rather than legacy algorithms.
    '';
-    homepage = https://www.argon2.com/;
+    homepage = "https://www.argon2.com/";
    license = with licenses; [ asl20 cc0 ];
    maintainers = with maintainers; [ taeer olynch ];
    platforms = platforms.linux ++ platforms.darwin;
--- a/pkgs/development/libraries/libbytesize/default.nix
+++ b/pkgs/development/libraries/libbytesize/default.nix
@ -4,7 +4,7 @@
 }:

 let
-  version = "2.0";
+  version = "2.1";
 in stdenv.mkDerivation rec {
  name = "libbytesize-${version}";

@ -12,7 +12,7 @@ in stdenv.mkDerivation rec {
    owner = "storaged-project";
    repo = "libbytesize";
    rev = version;
-    sha256 = "0m950idlyv6mbkhr8ngnda5l5wwb5lzs4wn4kxl73cvdlcvklmwj";
+    sha256 = "0qb6zx2fdghm21lishlcrhnwf4wwy5p69dsgp0504kn93ii7mw3m";
  };

  outputs = [ "out" "dev" "devdoc" ];
--- a/pkgs/development/libraries/libxkbcommon/default.nix
+++ b/pkgs/development/libraries/libxkbcommon/default.nix
@ -20,6 +20,12 @@ stdenv.mkDerivation rec {
    "-Dx-locale-root=${libX11.out}/share/X11/locale"
  ];

+  # Remove example program which fail on Darwin
+  postPatch = if stdenv.isDarwin then ''
+    substituteInPlace meson.build \
+      --replace "executable('rmlvo-to-keymap', 'test/rmlvo-to-keymap.c', dependencies: test_dep)" ""
+  '' else null;
+
  doCheck = false; # fails, needs unicode locale

  meta = with stdenv.lib; {
--- a/pkgs/development/libraries/nco/default.nix
+++ b/pkgs/development/libraries/nco/default.nix
@ -1,17 +1,17 @@
-{ stdenv, fetchurl, netcdf, netcdfcxx4, gsl, udunits, antlr, which, curl }:
+{ stdenv, fetchurl, netcdf, netcdfcxx4, gsl, udunits, antlr, which, curl, flex }:

 stdenv.mkDerivation rec {
-  version = "4.5.5";
+  version = "4.8.1";
  name = "nco-${version}";

-  buildInputs = [ netcdf netcdfcxx4 gsl udunits antlr which curl ];
+  buildInputs = [ netcdf netcdfcxx4 gsl udunits antlr which curl flex ];

  src = fetchurl {
    url = "https://github.com/nco/nco/archive/${version}.tar.gz";
-    sha256 = "bc6f5b976fdfbdec51f2ebefa158fa54672442c2fd5f042ba884f9f32c2ad666";
+    sha256 = "0s1ww78p4cb2d9qkr4zs439x4xk3ndq6lv8ps677jrn28vnkzbnx";
  };

-  meta = { 
+  meta = {
    description = "NetCDF Operator toolkit";
    longDescription = "The NCO (netCDF Operator) toolkit manipulates and analyzes data stored in netCDF-accessible formats, including DAP, HDF4, and HDF5";
    homepage = http://nco.sourceforge.net/;
--- a/pkgs/development/libraries/qtutilities/default.nix
+++ b/pkgs/development/libraries/qtutilities/default.nix
@ -0,0 +1,24 @@
+{ stdenv, fetchFromGitHub, cpp-utilities, qttools, qtbase, cmake, pkgconfig }:
+
+stdenv.mkDerivation rec {
+  pname = "qtutilities";
+  version = "5.13.0";
+
+  src = fetchFromGitHub {
+    owner = "Martchus";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "03drxwpr3xdh4hm8pkd5mhjs0mzhz6634ldyq78pml39ciqm51nl";
+  };
+
+  buildInputs = [ qtbase cpp-utilities ];
+  nativeBuildInputs = [ cmake qttools ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/Martchus/qtutilities";
+    description = "Common C++ classes and routines used by @Martchus' applications featuring argument parser, IO and conversion utilities";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ doronbehar ];
+    platforms   = platforms.linux;
+  };
+}
--- a/pkgs/development/libraries/science/math/nccl/default.nix
+++ b/pkgs/development/libraries/science/math/nccl/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  name = "nccl-${version}-cuda-${cudatoolkit.majorVersion}";
-  version = "2.4.2-1";
+  version = "2.4.8-1";

  src = fetchFromGitHub {
    owner = "NVIDIA";
    repo = "nccl";
    rev = "v${version}";
-    sha256 = "0aa4gv51nbmmdhx6vp40l249m4arp30sijrn6kwxdfi1k9kajiq5";
+    sha256 = "05m66y64rgsdyybvjybhy6clikwv438b1m484ikai78fb2b7mvyq";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/development/libraries/wasilibc/default.nix
+++ b/pkgs/development/libraries/wasilibc/default.nix
@ -1,12 +1,12 @@
 { stdenv, fetchFromGitHub, lib }:

 stdenv.mkDerivation {
-  name = "wasilibc-20190413";
+  name = "wasilibc-20190712";
  src = fetchFromGitHub {
    owner = "CraneStation";
-    repo = "wasi-sysroot";
-    rev = "079d7bda78bc0ad8f69c1594444b54786545ce57";
-    sha256 = "09s906bc9485wzkgibnpfh0mii7jkldzr1a6g8k7ch0si8rshi5r";
+    repo = "wasi-libc";
+    rev = "8df0d4cd6a559b58d4a34b738a5a766b567448cf";
+    sha256 = "1n4gvgzacpagar2mx8g9950q0brnhwz7jg2q44sa5mnjmlnkiqhh";
  };
  makeFlags = [
    "WASM_CC=${stdenv.cc.targetPrefix}cc"
--- a/pkgs/development/python-modules/azure-cli-core/default.nix
+++ b/pkgs/development/python-modules/azure-cli-core/default.nix
@ -33,11 +33,11 @@

 buildPythonPackage rec {
  pname = "azure-cli-core";
-  version = "2.0.66";
+  version = "2.0.69";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0fp6b2x1l9bg07pca7asm80rnjlc4kkm061s3nrb55yj6awsnim5";
+    sha256 = "797c4fab2285aa2ac316daf692c1e8f6b14186c059805e8a57332b4d83d7bb23";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/facedancer/default.nix
+++ b/pkgs/development/python-modules/facedancer/default.nix
@ -0,0 +1,26 @@
+{ lib, buildPythonPackage, fetchPypi, isPy3k, pyusb, pyserial }:
+
+buildPythonPackage rec {
+  pname = "facedancer";
+  version = "2019.3.2";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1zhwnlfksblgp54njd9gjsrr5ibg12cx1x9xxcqkcdfhn3m2kmm0";
+  };
+
+  disabled = !isPy3k;
+
+  propagatedBuildInputs = [ pyusb pyserial ];
+
+  preBuild = ''
+    echo "$version" > VERSION
+  '';
+
+  meta = with lib; {
+    description = "library for emulating usb devices";
+    homepage = https://greatscottgadgets.com/greatfet/;
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ mog ];
+  };
+}
--- a/pkgs/development/python-modules/glances/default.nix
+++ b/pkgs/development/python-modules/glances/default.nix
@ -1,28 +1,33 @@
 { buildPythonPackage, fetchFromGitHub, isPyPy, lib
 , psutil, setuptools, bottle, batinfo, pysnmp
-, hddtemp
+, hddtemp, future
+# Optional dependencies:
+, netifaces # IP module
+# Tests:
 , unittest2
 }:

 buildPythonPackage rec {
  name = "glances-${version}";
-  version = "3.1.0";
+  version = "3.1.1";
  disabled = isPyPy;

  src = fetchFromGitHub {
    owner = "nicolargo";
    repo = "glances";
    rev = "v${version}";
-    sha256 = "0zjpp017i8b8bijdaj85rya7rmdqh4g8vkb42q14q2sw6agxz3zi";
+    sha256 = "1x9gw7hzw3p8zki82wdf359yxj0ylfw2096a4y621kj0p4xqsr4q";
  };

+  # Some tests fail in the sandbox (they e.g. require access to /sys/class/power_supply):
  patches = lib.optional doCheck ./skip-failing-tests.patch;

-  # Requires access to /sys/class/power_supply
  doCheck = true;
+  checkInputs = [ unittest2 ];

-  buildInputs = [ unittest2 ];
-  propagatedBuildInputs = [ psutil setuptools bottle batinfo pysnmp hddtemp ];
+  propagatedBuildInputs = [ psutil setuptools bottle batinfo pysnmp hddtemp future
+    netifaces
+  ];

  preConfigure = ''
    sed -i 's/data_files\.append((conf_path/data_files.append(("etc\/glances"/' setup.py;
--- a/pkgs/development/python-modules/glances/skip-failing-tests.patch
+++ b/pkgs/development/python-modules/glances/skip-failing-tests.patch
@ -50,3 +50,11 @@ diff --git a/unitest.py b/unitest.py
     def test_006_swap(self):
         """Check MEMSWAP plugin."""
         stats_to_check = ['used', 'free', 'total']
+@@ -191,6 +196,7 @@ class TestGlances(unittest.TestCase):
+         self.assertTrue(type(stats_grab) is list, msg='Folders stats is not a list')
+         print('INFO: Folders stats: %s' % stats_grab)
+ 
+    @unittest.skip("Fails on NixOS (TODO)")
+     def test_012_ip(self):
+         """Check IP plugin."""
+         print('INFO: [TEST_012] Check IP stats')
--- a/pkgs/development/python-modules/greatfet/default.nix
+++ b/pkgs/development/python-modules/greatfet/default.nix
@ -0,0 +1,34 @@
+{ lib, fetchFromGitHub, buildPythonPackage, isPy3k, future, pyusb, ipython, pygreat }:
+
+buildPythonPackage rec {
+  pname = "GreatFET";
+  version = "2019.5.1.dev0";
+
+  src = fetchFromGitHub {
+    owner = "greatscottgadgets";
+    repo = "greatfet";
+    rev = "a927f21d59ccface00635146103a807c1d2b0ad8";
+    sha256 = "054vkx4xkbhxhh5grjbs9kw3pjkv1zapp91ysrqr0c8mg1pc7zxv";
+  };
+
+  disabled = !isPy3k;
+
+  propagatedBuildInputs = [ future pyusb ipython pygreat ];
+
+  doCheck = false;
+
+  preBuild = ''
+    cd host
+    echo "$version" > ../VERSION
+  '';
+
+  meta = {
+    description = "Hardware hacking with the greatfet";
+    homepage = https://greatscottgadgets.com/greatfet;
+    license = lib.licenses.bsd3;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ mog ];
+  };
+}
+
+
--- a/pkgs/development/python-modules/ibis-framework/default.nix
+++ b/pkgs/development/python-modules/ibis-framework/default.nix
@ -0,0 +1,57 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, multipledispatch
+, numpy
+, pandas
+, pytz
+, regex
+, toolz
+, isPy27
+, pytest
+, sqlalchemy
+, requests
+, tables
+, pyarrow
+, graphviz
+}:
+
+buildPythonPackage rec {
+  pname = "ibis-framework";
+  version = "1.2.0";
+  disabled = isPy27;
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "3a0b79dae6924be0a79669c881a9a1d4817997ad2f81a0f3b1cd03d70aebb071";
+  };
+
+  propagatedBuildInputs = [
+    multipledispatch
+    numpy
+    pandas
+    pytz
+    regex
+    toolz
+    sqlalchemy
+    requests
+    graphviz
+    tables
+    pyarrow
+  ];
+
+  checkInputs = [
+    pytest
+  ];
+
+  checkPhase = ''
+    pytest ibis
+  '';
+
+  meta = with lib; {
+    description = "Productivity-centric Python Big Data Framework";
+    homepage = https://github.com/ibis-project/ibis;
+    license = licenses.asl20;
+    maintainers = [ maintainers.costrouc ];
+  };
+}
--- a/pkgs/development/python-modules/ibis/default.nix
+++ b/pkgs/development/python-modules/ibis/default.nix
@ -0,0 +1,30 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, python
+, isPy27
+}:
+
+buildPythonPackage rec {
+  pname = "ibis";
+  version = "1.6.0";
+  disabled = isPy27;
+
+  src = fetchFromGitHub {
+    owner = "dmulholl";
+    repo = pname;
+    rev = version;
+    sha256 = "0xqhk397gzanvj2znwcgy4n5l1lc9r310smxkhjbm1xwvawpixx0";
+  };
+
+  checkPhase = ''
+    ${python.interpreter} test_ibis.py
+  '';
+
+  meta = with lib; {
+    description = "A lightweight template engine";
+    homepage = https://github.com/dmulholland/ibis;
+    license = licenses.publicDomain;
+    maintainers = [ maintainers.costrouc ];
+  };
+}
--- a/pkgs/development/python-modules/magic-wormhole/default.nix
+++ b/pkgs/development/python-modules/magic-wormhole/default.nix
@ -37,6 +37,10 @@ buildPythonPackage rec {
    sed -i -e "s|'ifconfig'|'${nettools}/bin/ifconfig'|" src/wormhole/ipaddrs.py
  '';

+  postInstall = ''
+    install -Dm644 docs/wormhole.1 $out/share/man/man1/wormhole.1
+  '';
+
  preCheck = ''
    export PATH=$out/bin:$PATH
    export LANG="en_US.UTF-8"
--- a/pkgs/development/python-modules/pygreat/default.nix
+++ b/pkgs/development/python-modules/pygreat/default.nix
@ -0,0 +1,31 @@
+{ stdenv, buildPythonPackage, isPy3k, fetchFromGitHub, future, pyusb }:
+
+buildPythonPackage rec {
+  pname = "pygreat";
+  version = "2019.5.1.dev0";
+
+  src = fetchFromGitHub {
+    owner = "greatscottgadgets";
+    repo = "libgreat";
+    rev = "14c00b7c8f036f4d467e4b1a324ffa3566b126fa";
+    sha256 = "1h0z83k1k4z8j36z936h61l8j3cjr3wsxr86k91v5c5h93g9dkqh";
+  };
+
+  propagatedBuildInputs = [ future pyusb ];
+
+  disabled = !isPy3k;
+
+  preBuild = ''
+    cd host
+    substituteInPlace setup.py --replace "'backports.functools_lru_cache'" ""
+    substituteInPlace pygreat/comms.py --replace "from backports.functools_lru_cache import lru_cache as memoize_with_lru_cache" "from functools import lru_cache as memoize_with_lru_cache"
+    echo "$version" > ../VERSION
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Python library for talking with libGreat devices";
+    homepage = https://greatscottgadgets.com/greatfet/;
+    license = with licenses; [ bsd3 ];
+  };
+
+}
--- a/pkgs/development/python-modules/scrapy/default.nix
+++ b/pkgs/development/python-modules/scrapy/default.nix
@ -1,8 +1,8 @@
-{ stdenv, buildPythonPackage, fetchPypi, glibcLocales, mock, pytest, botocore,
+{ stdenv, buildPythonPackage, fetchPypi, fetchpatch, glibcLocales, mock, pytest, botocore,
  testfixtures, pillow, six, twisted, w3lib, lxml, queuelib, pyopenssl,
  service-identity, parsel, pydispatcher, cssselect, lib }:
 buildPythonPackage rec {
-  version = "1.6.0";
+  version = "1.7.1";
  pname = "Scrapy";

  checkInputs = [ glibcLocales mock pytest botocore testfixtures pillow ];
@ -16,6 +16,12 @@ buildPythonPackage rec {
    # root and readonly. As a consequence scrapy can't edit the
    # project templates.
    ./permissions-fix.patch
+
+    # Fix configparser import for python2. See: https://github.com/scrapy/scrapy/pull/3887
+    (fetchpatch {
+      url = "https://github.com/scrapy/scrapy/commit/21345dc9ec60dcc1cd2e5c0eace5788aa502ce23.patch";
+      sha256 = "09834rcjyggvyj6zignvfga2xbqkknygly5p4a96k2mvz0xn3v6z";
+    })
  ];

  LC_ALL="en_US.UTF-8";
@ -25,12 +31,13 @@ buildPythonPackage rec {
  # Ignore test_retry_dns_error because tries to resolve an invalid dns and weirdly fails with "Reactor was unclean"
  # Ignore xml encoding test on darwin because lxml can't find encodings https://bugs.launchpad.net/lxml/+bug/707396
  checkPhase = ''
-    pytest -p no:doctest --ignore=tests/test_linkextractors_deprecated.py --ignore=tests/test_proxy_connect.py --deselect tests/test_crawl.py::CrawlTestCase::test_retry_dns_error ${lib.optionalString stdenv.isDarwin "--deselect tests/test_utils_iterators.py::LxmlXmliterTestCase::test_xmliter_encoding"}
+    substituteInPlace pytest.ini --replace "addopts = --doctest-modules" "addopts ="
+    pytest --ignore=tests/test_linkextractors_deprecated.py --ignore=tests/test_proxy_connect.py --deselect tests/test_crawl.py::CrawlTestCase::test_retry_dns_error ${lib.optionalString stdenv.isDarwin "--deselect tests/test_utils_iterators.py::LxmlXmliterTestCase::test_xmliter_encoding"}
  '';

  src = fetchPypi {
    inherit pname version;
-    sha256 = "558dfd10ac53cb324ecd7eefd3eac412161c7507c082b01b0bcd2c6e2e9f0766";
+    sha256 = "da8987d199092c3bb33d4d1d021507cd933aa67f5177e2d36f31343e8a6bd7f1";
  };

  postInstall = ''
--- a/pkgs/development/tools/analysis/flow/default.nix
+++ b/pkgs/development/tools/analysis/flow/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "flow";
-  version = "0.102.0";
+  version = "0.103.0";

  src = fetchFromGitHub {
    owner  = "facebook";
    repo   = "flow";
    rev    = "refs/tags/v${version}";
-    sha256 = "1c49pjzrpcymkvs8vcmb16wd9h1mm62k6w82mibywvhhy8hva1gf";
+    sha256 = "09hv483ika2h2jrix4wxb82i4lby6kkqk20yk70vb6xarqb267i7";
  };

  installPhase = ''
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
    install -Dm644 resources/shell/bash-completion $out/share/bash-completion/completions/flow
  '';

-  buildInputs = (with ocamlPackages; [ ocaml findlib ocamlbuild dtoa core_kernel sedlex ocaml_lwt lwt_log lwt_ppx ppx_deriving ppx_gen_rec ppx_tools_versioned visitors wtf8 ])
+  buildInputs = (with ocamlPackages; [ ocaml findlib ocamlbuild dtoa core_kernel sedlex ocaml_lwt lwt_log lwt_ppx ppx_deriving ppx_gen_rec ppx_tools_versioned visitors wtf8 ocaml-migrate-parsetree ])
    ++ stdenv.lib.optionals stdenv.isDarwin [ CoreServices ];

  meta = with stdenv.lib; {
--- a/pkgs/development/tools/cachix/default.nix
+++ b/pkgs/development/tools/cachix/default.nix
@ -1,8 +1,6 @@
 { haskellPackages, haskell }:

-haskell.lib.justStaticExecutables (haskellPackages.override {
-  overrides = self: super: {
+haskell.lib.justStaticExecutables (haskellPackages.extend (self: super: {
    cachix = haskell.lib.doDistribute (self.cachix_0_2_1 or self.cachix);
    cachix-api = self.cachix-api_0_2_1 or self.cachix-api;
-  };
-}).cachix
+})).cachix
--- a/pkgs/development/tools/continuous-integration/jenkins/default.nix
+++ b/pkgs/development/tools/continuous-integration/jenkins/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "jenkins-${version}";
-  version = "2.176.1";
+  version = "2.176.2";

  src = fetchurl {
    url = "http://mirrors.jenkins.io/war-stable/${version}/jenkins.war";
-    sha256 = "130f9x4fvnf9a9ykf48axj9fgqaj2ssr9jhsflpi1gg78ch6xg4b";
+    sha256 = "19chl7dq25hjn73qgx5cd4azs68kg16r30zx563rrppq3hbc79ik";
  };

  buildCommand = ''
--- a/pkgs/development/tools/electron/5.x.nix
+++ b/pkgs/development/tools/electron/5.x.nix
@ -1,4 +1,4 @@
-{ stdenv, libXScrnSaver, makeWrapper, fetchurl, unzip, atomEnv, libuuid, at-spi2-atk, at-spi2-core }:
+{ stdenv, libXScrnSaver, makeWrapper, fetchurl, wrapGAppsHook, gtk3, unzip, atomEnv, libuuid, at-spi2-atk, at-spi2-core }:

 let
  version = "5.0.0";
@ -35,7 +35,15 @@ let
      };
    }.${stdenv.hostPlatform.system} or throwSystem;

-    buildInputs = [ unzip makeWrapper ];
+    buildInputs = [ gtk3 ];
+
+    nativeBuildInputs = [
+      unzip
+      makeWrapper
+      wrapGAppsHook
+    ];
+
+    dontWrapGApps = true; # electron is in lib, we need to wrap it manually

    buildCommand = ''
      mkdir -p $out/lib/electron $out/bin
@ -50,7 +58,8 @@ let
        $out/lib/electron/electron

      wrapProgram $out/lib/electron/electron \
-        --prefix LD_PRELOAD : ${stdenv.lib.makeLibraryPath [ libXScrnSaver ]}/libXss.so.1
+        --prefix LD_PRELOAD : ${stdenv.lib.makeLibraryPath [ libXScrnSaver ]}/libXss.so.1 \
+        "''${gappsWrapperArgs[@]}"
    '';
  };

--- a/pkgs/development/tools/erlang/hex2nix/default.nix
+++ b/pkgs/development/tools/erlang/hex2nix/default.nix
@ -2,20 +2,20 @@

 rebar3Relx rec {
    name = "hex2nix";
-    version = "0.0.6-a31eadd7";
+    version = "0.0.6-42d7b2ec";

    releaseType = "escript";

    checkouts = fetchRebar3Deps {
      inherit name version;
      src = "${src}/rebar.config";
-      sha256 = "1b59vk6ynakdiwqd1s6axaj9bvkaaq7ll28b48nv613z892h7nm5";
+      sha256 = "0z6v1f6hagl3qyj97frqr2ww3adrwgfwdyb2zshaai0d3xchg3ly";
    };

    src = fetchFromGitHub {
      owner  = "erlang-nix";
      repo   = "hex2nix";
-      rev    = "a31eadd7af2cbdac1b87991b378e98ea4fb40ae0";
-      sha256 = "1hnkrksyrbpq2gq25rfsrnm86n0g3biab88gswm3zj88ddrz6dyk";
+      rev    = "42d7b2ec64f61f21061066b192003cf7f460bf43";
+      sha256 = "0ac1fmckvid5077djg3ajycxn7gwbf7pdk1knhfp8yva3c5qq58r";
    };
 }
--- a/pkgs/development/tools/erlang/relx-exe/default.nix
+++ b/pkgs/development/tools/erlang/relx-exe/default.nix
@ -2,18 +2,18 @@

 rebar3Relx rec {
  name = "relx-exe";
-  version = "3.23.1";
+  version = "3.32.1";
  releaseType = "escript";

  src = fetchHex {
    pkg = "relx";
-    sha256 = "13j7wds2d7b8v3r9pwy3zhwhzywgwhn6l9gm3slqzyrs1jld0a9d";
-    version = "3.23.1";
+    sha256 = "0693k8ac7hvpm9jd3ysbdn8bk97d68ini22p1fsqdsi9qv9f7nq7";
+    inherit version;
  };

  checkouts = fetchRebar3Deps {
    inherit name version;
    src = "${src}/rebar.lock";
-    sha256 = "046b1lb9rymndlvzmin3ppa3vkssjqspyfp98869k11s5avg76hd";
+    sha256 = "0l7r3x7zwcz49013zv8z5v2i06p7wqkgzdyzrl8jk0hglscvhpf6";
  };
 }
--- a/pkgs/development/tools/misc/ccache/default.nix
+++ b/pkgs/development/tools/misc/ccache/default.nix
@ -27,12 +27,10 @@ let ccache = stdenv.mkDerivation rec {

  doCheck = !stdenv.isDarwin;

-  passthru = let
-      unwrappedCC = stdenv.cc.cc;
-    in {
+  passthru = {
    # A derivation that provides gcc and g++ commands, but that
    # will end up calling ccache for the given cacheDir
-    links = extraConfig: stdenv.mkDerivation rec {
+    links = {unwrappedCC, extraConfig}: stdenv.mkDerivation rec {
      name = "ccache-links";
      passthru = {
        isClang = unwrappedCC.isClang or false;
--- a/pkgs/development/tools/rust/cargo-xbuild/default.nix
+++ b/pkgs/development/tools/rust/cargo-xbuild/default.nix
@ -2,13 +2,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-xbuild";
-  version = "0.5.14";
+  version = "0.5.15";

  src = fetchFromGitHub {
    owner = "rust-osdev";
    repo = pname;
-    rev = version;
-    sha256 = "1f87rz17bdpdipc9x2j4gq1zq181gcshhn7vc9pnn6f487hz0bgq";
+    rev = "v${version}";
+    sha256 = "0ck3gwgxbg03z864bhqy8vwcpm7al17fm380zsb6ijb1q2sk2r2n";
  };

  cargoSha256 = "1r9i79lymfwpbcx2lp509v435qpkl9bqly1ya369p41n5yprrcjv";
--- a/pkgs/misc/drivers/hplip/3.16.11.nix
+++ b/pkgs/misc/drivers/hplip/3.16.11.nix
@ -142,8 +142,6 @@ pythonPackages.buildPythonApplication {

    mkdir -p $out/etc/sane.d/dll.d
    mv $out/etc/sane.d/dll.conf $out/etc/sane.d/dll.d/hpaio.conf
-
-    rm $out/etc/udev/rules.d/56-hpmud.rules
  '';

  # The installed executables are just symlinks into $out/share/hplip,
@ -171,12 +169,12 @@ pythonPackages.buildPythonApplication {

  postFixup = ''
    substituteInPlace $out/etc/hp/hplip.conf --replace /usr $out
-  '' + stdenv.lib.optionalString (!withPlugin) ''
-    # A udev rule to notify users that they need the binary plugin.
-    # Needs a lot of patching but might save someone a bit of confusion:
+    # Patch udev rules:
+    # with plugin, they upload firmware to printers,
+    # without plugin, they complain about the missing plugin.
    substituteInPlace $out/etc/udev/rules.d/56-hpmud.rules \
      --replace {,${bash}}/bin/sh \
-      --replace {/usr,${coreutils}}/bin/nohup \
+      --replace /usr/bin/nohup "" \
      --replace {,${utillinux}/bin/}logger \
      --replace {/usr,$out}/bin
  '';
@ -184,6 +182,7 @@ pythonPackages.buildPythonApplication {
  meta = with stdenv.lib; {
    description = "Print, scan and fax HP drivers for Linux";
    homepage = http://hplipopensource.com/;
+    downloadPage = https://sourceforge.net/projects/hplip/files/hplip/;
    license = if withPlugin
      then licenses.unfree
      else with licenses; [ mit bsd2 gpl2Plus ];
--- a/pkgs/misc/drivers/hplip/3.18.5.nix
+++ b/pkgs/misc/drivers/hplip/3.18.5.nix
@ -174,8 +174,6 @@ pythonPackages.buildPythonApplication {

    mkdir -p $out/var/lib/hp
    cp ${hplipState} $out/var/lib/hp/hplip.state
-
-    rm $out/etc/udev/rules.d/56-hpmud.rules
  '';

  # The installed executables are just symlinks into $out/share/hplip,
@ -203,12 +201,12 @@ pythonPackages.buildPythonApplication {

  postFixup = ''
    substituteInPlace $out/etc/hp/hplip.conf --replace /usr $out
-  '' + stdenv.lib.optionalString (!withPlugin) ''
-    # A udev rule to notify users that they need the binary plugin.
-    # Needs a lot of patching but might save someone a bit of confusion:
+    # Patch udev rules:
+    # with plugin, they upload firmware to printers,
+    # without plugin, they complain about the missing plugin.
    substituteInPlace $out/etc/udev/rules.d/56-hpmud.rules \
      --replace {,${bash}}/bin/sh \
-      --replace {/usr,${coreutils}}/bin/nohup \
+      --replace /usr/bin/nohup "" \
      --replace {,${utillinux}/bin/}logger \
      --replace {/usr,$out}/bin
  '';
@ -216,6 +214,7 @@ pythonPackages.buildPythonApplication {
  meta = with stdenv.lib; {
    description = "Print, scan and fax HP drivers for Linux";
    homepage = https://developers.hp.com/hp-linux-imaging-and-printing;
+    downloadPage = https://sourceforge.net/projects/hplip/files/hplip/;
    license = if withPlugin
      then licenses.unfree
      else with licenses; [ mit bsd2 gpl2Plus ];
--- a/pkgs/misc/drivers/hplip/default.nix
+++ b/pkgs/misc/drivers/hplip/default.nix
@ -12,16 +12,16 @@
 let

  name = "hplip-${version}";
-  version = "3.19.1";
+  version = "3.19.6";

  src = fetchurl {
    url = "mirror://sourceforge/hplip/${name}.tar.gz";
-    sha256 = "1kl1q4753xx1w76dhp92wgrhn5k1yx1ib35pyi0vi3mw0njbhrzm";
+    sha256 = "0vfnc6pg7wzs68qn5mlk3cyl969d8n55bydgydq2wzfikvpfvnpw";
  };

  plugin = fetchurl {
    url = "https://www.openprinting.org/download/printdriver/auxfiles/HP/plugins/${name}-plugin.run";
-    sha256 = "1fwjypy1ycyi7rr1vk1yxhbdhx51n7fxhvjb36mzw8qz71dif2i3";
+    sha256 = "1b5gys04kh41gg7r7rzlpdbc2f4jirl2ik22cd935mm85k7abfwq";
  };

  hplipState = substituteAll {
@ -82,6 +82,13 @@ pythonPackages.buildPythonApplication {

  makeWrapperArgs = [ "--prefix" "PATH" ":" "${nettools}/bin" ];

+  patches = [
+    # remove ImageProcessor usage, it causes segfaults, see
+    # https://bugs.launchpad.net/hplip/+bug/1788706
+    # https://bugs.launchpad.net/hplip/+bug/1787289
+    ./image-processor.patch
+  ];
+
  prePatch = ''
    # HPLIP hardcodes absolute paths everywhere. Nuke from orbit.
    find . -type f -exec sed -i \
@ -174,8 +181,6 @@ pythonPackages.buildPythonApplication {

    mkdir -p $out/var/lib/hp
    cp ${hplipState} $out/var/lib/hp/hplip.state
-
-    rm $out/etc/udev/rules.d/56-hpmud.rules
  '';

  # The installed executables are just symlinks into $out/share/hplip,
@ -203,12 +208,12 @@ pythonPackages.buildPythonApplication {

  postFixup = ''
    substituteInPlace $out/etc/hp/hplip.conf --replace /usr $out
-  '' + stdenv.lib.optionalString (!withPlugin) ''
-    # A udev rule to notify users that they need the binary plugin.
-    # Needs a lot of patching but might save someone a bit of confusion:
+    # Patch udev rules:
+    # with plugin, they upload firmware to printers,
+    # without plugin, they complain about the missing plugin.
    substituteInPlace $out/etc/udev/rules.d/56-hpmud.rules \
      --replace {,${bash}}/bin/sh \
-      --replace {/usr,${coreutils}}/bin/nohup \
+      --replace /usr/bin/nohup "" \
      --replace {,${utillinux}/bin/}logger \
      --replace {/usr,$out}/bin
  '';
@ -216,6 +221,7 @@ pythonPackages.buildPythonApplication {
  meta = with stdenv.lib; {
    description = "Print, scan and fax HP drivers for Linux";
    homepage = https://developers.hp.com/hp-linux-imaging-and-printing;
+    downloadPage = https://sourceforge.net/projects/hplip/files/hplip/;
    license = if withPlugin
      then licenses.unfree
      else with licenses; [ mit bsd2 gpl2Plus ];
--- a/pkgs/misc/drivers/hplip/image-processor.patch
+++ b/pkgs/misc/drivers/hplip/image-processor.patch
@ -0,0 +1,62 @@
+diff --git i/prnt/hpcups/HPCupsFilter.cpp w/prnt/hpcups/HPCupsFilter.cpp
+index 5b282d8..153ee3a 100644
+--- i/prnt/hpcups/HPCupsFilter.cpp
+++ w/prnt/hpcups/HPCupsFilter.cpp
+@@ -31,7 +31,6 @@
+ \*****************************************************************************/
+ 
+ #include "HPCupsFilter.h"
+-#include "ImageProcessor.h"
+ 
+ #include <signal.h>
+ #include <sys/wait.h>
+@@ -637,16 +636,10 @@ int HPCupsFilter::processRasterData(cups_raster_t *cups_raster)
+ 
+ 
+     sprintf(hpPreProcessedRasterFile, "%s/hp_%s_cups_SwapedPagesXXXXXX",CUPS_TMP_DIR, m_JA.user_name);
+-    image_processor_t* imageProcessor = imageProcessorCreate();
+ 
+     while (cupsRasterReadHeader2(cups_raster, &cups_header))
+     {
+ 
+-        IMAGE_PROCESSOR_ERROR result = imageProcessorStartPage(imageProcessor, &cups_header);
+-        if (result != IPE_SUCCESS){
+-            dbglog("DEBUG: imageProcessorStartPage failed result = %d\n", result);
+-        }
+-
+         current_page_number++;
+ 
+         if (current_page_number == 1) {
+@@ -745,11 +738,6 @@ int HPCupsFilter::processRasterData(cups_raster_t *cups_raster)
+             color_raster = rgbRaster;
+             black_raster = kRaster;
+ 
+-            result = imageProcessorProcessLine(imageProcessor, m_pPrinterBuffer, cups_header.cupsBytesPerLine);
+-            if (result != IPE_SUCCESS){
+-                dbglog("DEBUG: imageProcessorProcessLine failed result = %d\n", result);
+-            }
+-
+ 
+             if ((y == 0) && !is_ljmono) {
+                 //For ljmono, make sure that first line is not a blankRaster line.Otherwise printer
+@@ -780,11 +768,6 @@ int HPCupsFilter::processRasterData(cups_raster_t *cups_raster)
+             }
+         }  // for() loop end
+ 
+-        result = imageProcessorEndPage(imageProcessor);
+-        if (result != IPE_SUCCESS){
+-                dbglog("DEBUG: imageProcessorEndPage failed result = %d\n", result);
+-        }
+-
+ 
+         m_Job.NewPage();
+         if (err != NO_ERROR) {
+@@ -800,8 +783,6 @@ int HPCupsFilter::processRasterData(cups_raster_t *cups_raster)
+         rgbRaster = NULL;
+     }
+ 
+-    imageProcessorDestroy(imageProcessor);
+-
+     unlink(hpPreProcessedRasterFile);
+     return ret_status;
+ }
--- a/pkgs/misc/emulators/dosbox/default.nix
+++ b/pkgs/misc/emulators/dosbox/default.nix
@ -1,11 +1,11 @@
 { stdenv, lib, fetchurl, makeDesktopItem, SDL, SDL_net, SDL_sound, libGLU_combined, libpng, graphicsmagick }:

 stdenv.mkDerivation rec {
-  name = "dosbox-0.74-2";
+  name = "dosbox-0.74-3";

  src = fetchurl {
    url = "mirror://sourceforge/dosbox/${name}.tar.gz";
-    sha256 = "1ksp1b5szi0vy4x55rm3j1y9wq5mlslpy8llpg87rpdyjlsk0xvh";
+    sha256 = "02i648i50dwicv1vaql15rccv4g8h5blf5g6inv67lrfxpbkvlf0";
  };

  hardeningDisable = [ "format" ];
--- a/pkgs/misc/vim-plugins/generated.nix
+++ b/pkgs/misc/vim-plugins/generated.nix
@ -61,12 +61,12 @@ let

  ale = buildVimPluginFrom2Nix {
    pname = "ale";
-    version = "2019-07-06";
+    version = "2019-07-14";
    src = fetchFromGitHub {
      owner = "w0rp";
      repo = "ale";
-      rev = "6c47d7fc352659cd2dc869a9a46a04a8492fc829";
-      sha256 = "1xk69prw20d37zw6q83yiv31nw9hrlqprrs9yxrqrlh0zdgn7cn9";
+      rev = "aae6d30b1ec135e37ec3bea1885d161c6174572b";
+      sha256 = "1irh5l3y5sm00d5n13zl0a2v45r299bfxqsci3f98zw2m7kxhp5a";
    };
  };

@ -380,12 +380,12 @@ let

  coc-lists = buildVimPluginFrom2Nix {
    pname = "coc-lists";
-    version = "2019-07-08";
+    version = "2019-07-14";
    src = fetchFromGitHub {
      owner = "neoclide";
      repo = "coc-lists";
-      rev = "1f9583616b426267db941ea23ef3cef5b780b9c6";
-      sha256 = "0ldvx2skl9ln04jpz84nyvyrp1im5mw4dri1m8x1ayzvzrvqig5d";
+      rev = "5f8666ce03218f16e92d813767c2c6dd86dae175";
+      sha256 = "1azxjdb75han6b3mvaqczzwxhaxr6qax4vy6zw7zqwqcskrakwzq";
    };
  };

@ -413,12 +413,12 @@ let

  coc-prettier = buildVimPluginFrom2Nix {
    pname = "coc-prettier";
-    version = "2019-06-30";
+    version = "2019-07-15";
    src = fetchFromGitHub {
      owner = "neoclide";
      repo = "coc-prettier";
-      rev = "6f30d4c5f0b6c4cf1ff0f5f7229377fc95fe249a";
-      sha256 = "0882ppaa69fp2hcncd54znaff944iraypxilr31nr51a6d9lbcs9";
+      rev = "9a2c2ebb03134a2dfc059a662a59b6d799609373";
+      sha256 = "0mivdca8gicli6c87qy12nw18m4qcf29hb5y49falnpp2104prji";
    };
  };

@ -457,23 +457,23 @@ let

  coc-smartf = buildVimPluginFrom2Nix {
    pname = "coc-smartf";
-    version = "2019-07-11";
+    version = "2019-07-14";
    src = fetchFromGitHub {
      owner = "neoclide";
      repo = "coc-smartf";
-      rev = "56252948dc0839765a9b57adbf52c293b599fe05";
-      sha256 = "1mabawpfmlhhlkc5f0h15dci6b1i9ndpiry6fi0gcl3j6m76w02d";
+      rev = "340fc45a48a70b3f150fb385e9d6d10979132a78";
+      sha256 = "1srnicdvm0l50qjx108vw8rkylp9yl29pbz890mfnp9ryz64qk06";
    };
  };

  coc-snippets = buildVimPluginFrom2Nix {
    pname = "coc-snippets";
-    version = "2019-07-12";
+    version = "2019-07-14";
    src = fetchFromGitHub {
      owner = "neoclide";
      repo = "coc-snippets";
-      rev = "bbc7ce11471cb48751d436193e4bacafed65e773";
-      sha256 = "1imhjb6djy66zx5qj9spg2nddg77c4ygxs0jx3z9kiddqsajg7af";
+      rev = "d1619fa8c4bb0a1ef3bffadecccb7ec8fd332b90";
+      sha256 = "04bfn9aws3kqkvd4q5r963jb1rqxpayf6qxa4yxwsnkcvma2zk7y";
    };
  };

@ -505,8 +505,8 @@ let
    src = fetchFromGitHub {
      owner = "neoclide";
      repo = "coc-tabnine";
-      rev = "f94a00ecb957fb7537dc68179c78adea0f1c4aca";
-      sha256 = "0s0jip0prapizq4pp46dayq21v4mjqkkv9x2hi3xmxrc7w8g5ndq";
+      rev = "65d8c479cc31fb906c10fa2762f98db8826295e1";
+      sha256 = "04a07v9cwbid32zzj4zxq8xmhhxjdbi627mk9dfyj024z0nyw801";
    };
  };

@ -598,17 +598,6 @@ let
    };
  };

-  coc-nvim = buildVimPluginFrom2Nix {
-    pname = "coc-nvim";
-    version = "2019-07-13";
-    src = fetchFromGitHub {
-      owner = "neoclide";
-      repo = "coc.nvim";
-      rev = "f3072ec53565b6725504a37f19617ce7d2c8f0ed";
-      sha256 = "0v41wh9qd5gvvi345yk2ajq5xbrwb56gziycqa9pgwa9b9bxck7k";
-    };
-  };
-
  Colour-Sampler-Pack = buildVimPluginFrom2Nix {
    pname = "Colour-Sampler-Pack";
    version = "2012-11-30";
@ -788,12 +777,12 @@ let

  denite-nvim = buildVimPluginFrom2Nix {
    pname = "denite-nvim";
-    version = "2019-07-12";
+    version = "2019-07-15";
    src = fetchFromGitHub {
      owner = "Shougo";
      repo = "denite.nvim";
-      rev = "f80fc06a5455dbfb3691dce4f224c8cf8d9ffde2";
-      sha256 = "09x0rhv4aplgpbhjqms6w9xwhx1w5zlpprxzx0yjx554mrc0lhia";
+      rev = "3a1b508116652a6c9b4b174ddafaee7852a15fc4";
+      sha256 = "18af8d9rmb0x3ln03ph2m0msaji7wvyvyn3xck12y99mpsf1l50w";
    };
  };

@ -868,12 +857,12 @@ let

  deoplete-lsp = buildVimPluginFrom2Nix {
    pname = "deoplete-lsp";
-    version = "2018-12-05";
+    version = "2019-07-15";
    src = fetchFromGitHub {
      owner = "Shougo";
      repo = "deoplete-lsp";
-      rev = "c4837884f61a7699f328fb05b93bed0b6395dd70";
-      sha256 = "0ahfffpmc62pqnplm0lmzpam420i578rvyi7zda21nqlir9a53ij";
+      rev = "c0172e8d458054b8dea037bbcfef523cde7add93";
+      sha256 = "1j6904wk4qr4i4h8qn2rikzw1kp6r5dc4475x38i8xngx1ap4x24";
    };
  };

@ -901,12 +890,12 @@ let

  deoplete-nvim = buildVimPluginFrom2Nix {
    pname = "deoplete-nvim";
-    version = "2019-07-06";
+    version = "2019-07-15";
    src = fetchFromGitHub {
      owner = "Shougo";
      repo = "deoplete.nvim";
-      rev = "fc55354e8521599ae509a8ed7c05438199933c8b";
-      sha256 = "0zk390jybshd10fzg5r2bfc7gj0n3cr28wdpbzri4lvddnj7x3wa";
+      rev = "7d28b9230e8db9ce9e6be566402a92612e0732e7";
+      sha256 = "01krxg7va2x39bqs8mh0c7mdy56nzj84avmj4nn6xf5pz1ycdiv1";
    };
  };

@ -1013,12 +1002,12 @@ let

  falcon = buildVimPluginFrom2Nix {
    pname = "falcon";
-    version = "2019-07-02";
+    version = "2019-07-15";
    src = fetchFromGitHub {
      owner = "fenetikm";
      repo = "falcon";
-      rev = "66886096df65c4510726a815b6a8c75b281024b1";
-      sha256 = "1w3xg0zvi7b561ykasf51j8qn06zpi9g2a044r6gz06cbipdhiw6";
+      rev = "d82e93a171e61129ba04a8d9dfed75f2b892b3a5";
+      sha256 = "16gys01i808111s4bd2k8la1fmj8p7l7y9vbig0x0qvd3klbhmm8";
    };
  };

@ -1333,12 +1322,12 @@ let

  jedi-vim = buildVimPluginFrom2Nix {
    pname = "jedi-vim";
-    version = "2019-06-22";
+    version = "2019-07-13";
    src = fetchFromGitHub {
      owner = "davidhalter";
      repo = "jedi-vim";
-      rev = "016fb7c78e3971ab662796d2abf5f2f4a227e1a1";
-      sha256 = "1zzidg4n7ir00q9l4y8g7dqfdzph0f7j7022n032vlfj8yr5mc92";
+      rev = "b9f83175951654256cff41737841b4abc0c9266d";
+      sha256 = "0w24zqs1026khdzr7v283yx9yc3sp5rw4kzsjwalclg5xnyy55c0";
      fetchSubmodules = true;
    };
  };
@ -1444,12 +1433,12 @@ let

  lightline-vim = buildVimPluginFrom2Nix {
    pname = "lightline-vim";
-    version = "2019-06-12";
+    version = "2019-07-15";
    src = fetchFromGitHub {
      owner = "itchyny";
      repo = "lightline.vim";
-      rev = "80c242c3c5394fd5143b5d7e2741989ba04ae46a";
-      sha256 = "0k42wzwwhiqj6i1s2zdkmdnay85kwl4aw129nwcrrc4ahqhhh9fy";
+      rev = "284d3ee0dbdfe7b07a6a927a742d203851215ca4";
+      sha256 = "05cmwnfky66p0i6jk7rc2qs5l6n0d89is3kwymg9qag2v6k8cz80";
    };
  };

@ -1763,12 +1752,12 @@ let

  nerdtree = buildVimPluginFrom2Nix {
    pname = "nerdtree";
-    version = "2019-07-10";
+    version = "2019-07-14";
    src = fetchFromGitHub {
      owner = "scrooloose";
      repo = "nerdtree";
-      rev = "4ac07f52a312a24d82deba715ee489e6c5b00259";
-      sha256 = "0fwaf38064qawclay95ncydj2faz3krhiz23ghzikdxzx8bvjrmg";
+      rev = "63c59208c1f9eef7068a944f5c3033bd1a348b97";
+      sha256 = "11531x591dw99mf3ladsim6cv162ypb421q60kljg0hg7fvjml8y";
    };
  };

@ -3226,12 +3215,12 @@ let

  vim-fugitive = buildVimPluginFrom2Nix {
    pname = "vim-fugitive";
-    version = "2019-07-12";
+    version = "2019-07-13";
    src = fetchFromGitHub {
      owner = "tpope";
      repo = "vim-fugitive";
-      rev = "d0049b4417cf20af6d98b8f1e0febcc7c6a6f2bb";
-      sha256 = "1j27kbwlfbsymd1aqa0zb8hp4v7ks927x2256qwp2f87a8j14bq0";
+      rev = "4da9fb8f43869125f6e1bb1ff8dd27f315623835";
+      sha256 = "001jl2cvdwszhhjfjmb4mkvffkq28mqc72bgy12119zprc8z3kaa";
    };
  };

@ -3303,12 +3292,12 @@ let

  vim-go = buildVimPluginFrom2Nix {
    pname = "vim-go";
-    version = "2019-07-12";
+    version = "2019-07-15";
    src = fetchFromGitHub {
      owner = "fatih";
      repo = "vim-go";
-      rev = "b5874d4b7c3a612351187c24deaf628276f6cece";
-      sha256 = "1rdvjzcd8wm1v1x86gr3hj5zbfyk867hdpcs05wgh1bjl6ymbbxx";
+      rev = "d42c9586ce9fe170baa62fe22ea3ecf66417f908";
+      sha256 = "15x6wh8yvysrryj18dpzr6l0x06jnc6llh0shg3mcgb1vlfwl8v2";
    };
  };

@ -4096,12 +4085,12 @@ let

  vim-ruby = buildVimPluginFrom2Nix {
    pname = "vim-ruby";
-    version = "2019-04-04";
+    version = "2019-07-13";
    src = fetchFromGitHub {
      owner = "vim-ruby";
      repo = "vim-ruby";
-      rev = "96d5db458f868255393fdc2732d6bef21a45c68f";
-      sha256 = "1nv51c441d44igjcb3hlib1zbd65h98ywkjyp50hbz5rjkx17mvv";
+      rev = "1aa8f0cd0411c093d81f4139d151f93808e53966";
+      sha256 = "04ng7mjjdacajkmx20pfwlfh1h43sh6sx58id830q9jjl7kvyhhp";
    };
  };

@ -4239,12 +4228,12 @@ let

  vim-snippets = buildVimPluginFrom2Nix {
    pname = "vim-snippets";
-    version = "2019-07-06";
+    version = "2019-07-13";
    src = fetchFromGitHub {
      owner = "honza";
      repo = "vim-snippets";
-      rev = "c8e8b35e9a56aab5b1ef871a164b6e8d6ea79ad0";
-      sha256 = "0lb6kmg4ckrxhys0k9gss3hp60x0mik10sm0y5g8yf74a1vzysvf";
+      rev = "d693695ae9375794a3a0b572fd65e86bfb56ed61";
+      sha256 = "0xlhkmaxssifqjq6cgi35iwrckasqszpn54ji8rjmhi9wm9w4p57";
    };
  };

@ -4679,12 +4668,12 @@ let

  vimtex = buildVimPluginFrom2Nix {
    pname = "vimtex";
-    version = "2019-07-11";
+    version = "2019-07-14";
    src = fetchFromGitHub {
      owner = "lervag";
      repo = "vimtex";
-      rev = "407ca82011b6d99ec84932730f21491b954b3d29";
-      sha256 = "15mcj3kv8iiyphgzv7gzzpqwlrz7r05fzwpqm1sb38fazklcvg2q";
+      rev = "363a8c5dc3be3decd1e8060040f268b238a39689";
+      sha256 = "1plflcw41nvkwd3lvqkb9z666h78kgd16mb020pi16v4v6zniw9n";
    };
  };

@ -4822,12 +4811,12 @@ let

  yats-vim = buildVimPluginFrom2Nix {
    pname = "yats-vim";
-    version = "2019-06-18";
+    version = "2019-07-14";
    src = fetchFromGitHub {
      owner = "HerringtonDarkholme";
      repo = "yats.vim";
-      rev = "c0995dfebaebf4abaaae7d6c71b912bec2de9596";
-      sha256 = "0q0hxscwqwn2xwfvah9hlbzb416gzi7pzsl7rniw7qsy3pp5m3sn";
+      rev = "632bed9406fe891da8ec7b86320ff1c274d8318e";
+      sha256 = "19g2ppq0ircmbj6vv5rs00fqa8vq1faw4hv1asq2ym31f3y3ccax";
      fetchSubmodules = true;
    };
  };
--- a/Show More
+++ b/Show More