Merge master into staging-next

2018-11-24 10:43:33 +01:00 · 2018-11-24 10:43:33 +01:00 · e41154d1ab
commit e41154d1ab
parent 90720d0139 25c562e451
92 changed files with 1146 additions and 386 deletions
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@ -14,6 +14,7 @@
 - [ ] Tested compilation of all pkgs that depend on this change using `nix-shell -p nox --run "nox-review wip"`
 - [ ] Tested execution of all binary files (usually in `./result/bin/`)
 - [ ] Determined the impact on package closure size (by running `nix path-info -S` before and after)
+- [ ] Assured whether relevant documentation is up to date
 - [ ] Fits [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/.github/CONTRIBUTING.md).

 ---
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -1319,6 +1319,11 @@
    github = "ellis";
    name = "Ellis Whitehead";
  };
+  elseym = {
+    email = "elseym@me.com";
+    github = "elseym";
+    name = "Simon Waibl";
+  };
  elvishjerricco = {
    email = "elvishjerricco@gmail.com";
    github = "ElvishJerricco";
@ -2027,6 +2032,11 @@
    github = "jhhuh";
    name = "Ji-Haeng Huh";
  };
+  jhillyerd = {
+    email = "james+nixos@hillyerd.com";
+    github = "jhillyerd";
+    name = "James Hillyerd";
+  };
  jirkamarsik = {
    email = "jiri.marsik89@gmail.com";
    github = "jirkamarsik";
@ -4917,4 +4927,9 @@
    github = "zzamboni";
    name = "Diego Zamboni";
  };
+  mredaelli = {
+    email = "massimo@typish.io";
+    github = "mredaelli";
+    name = "Massimo Redaelli";
+  };
 }
--- a/nixos/doc/manual/release-notes/rl-1903.xml
+++ b/nixos/doc/manual/release-notes/rl-1903.xml
@ -222,6 +222,17 @@
     reset to the default value (<literal>false</literal>).
    </para>
   </listitem>
+   <listitem>
+    <para>
+     Network interface indiscriminate NixOS firewall options
+     (<literal>networking.firewall.allow*</literal>) are now preserved when also
+     setting interface specific rules such as <literal>networking.firewall.interfaces.en0.allow*</literal>.
+     These rules continue to use the pseudo device "default"
+     (<literal>networking.firewall.interfaces.default.*</literal>), and assigning
+     to this pseudo device will override the (<literal>networking.firewall.allow*</literal>)
+     options.
+    </para>
+   </listitem>
  </itemizedlist>
 </section>

--- a/nixos/modules/installer/tools/nixos-build-vms/build-vms.nix
+++ b/nixos/modules/installer/tools/nixos-build-vms/build-vms.nix
@ -7,7 +7,7 @@ let nodes = import networkExpr; in

 with import ../../../../lib/testing.nix {
  inherit system;
-  pkgs = import ../.. { inherit system config; };
+  pkgs = import ../../../../.. { inherit system config; };
 };

 (makeTest { inherit nodes; testScript = ""; }).driver
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@ -336,6 +336,7 @@
      solr = 309;
      alerta = 310;
      minetest = 311;
+      rss2email = 312;

      # When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!

@ -632,6 +633,7 @@
      solr = 309;
      alerta = 310;
      minetest = 311;
+      rss2email = 312;

      # When adding a gid, make sure it doesn't match an existing
      # uid. Users and groups with the same name should have equal
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -330,6 +330,7 @@
  ./services/mail/postgrey.nix
  ./services/mail/spamassassin.nix
  ./services/mail/rspamd.nix
+  ./services/mail/rss2email.nix
  ./services/mail/rmilter.nix
  ./services/mail/nullmailer.nix
  ./services/misc/airsonic.nix
--- a/nixos/modules/services/mail/rss2email.nix
+++ b/nixos/modules/services/mail/rss2email.nix
@ -0,0 +1,136 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.rss2email;
+in {
+
+  ###### interface
+
+  options = {
+
+    services.rss2email = {
+
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Whether to enable rss2email.";
+      };
+
+      to = mkOption {
+        type = types.str;
+        description = "Mail address to which to send emails";
+      };
+
+      interval = mkOption {
+        type = types.str;
+        default = "12h";
+        description = "How often to check the feeds, in systemd interval format";
+      };
+
+      config = mkOption {
+        type = with types; attrsOf (either str (either int bool));
+        default = {};
+        description = ''
+          The configuration to give rss2email.
+
+          Default will use system-wide <literal>sendmail</literal> to send the
+          email. This is rss2email's default when running
+          <literal>r2e new</literal>.
+
+          This set contains key-value associations that will be set in the
+          <literal>[DEFAULT]</literal> block along with the
+          <literal>to</literal> parameter.
+
+          See
+          <literal>https://github.com/rss2email/rss2email/blob/master/r2e.1</literal>
+          for more information on which parameters are accepted.
+        '';
+      };
+
+      feeds = mkOption {
+        description = "The feeds to watch.";
+        type = types.attrsOf (types.submodule {
+          options = {
+            url = mkOption {
+              type = types.str;
+              description = "The URL at which to fetch the feed.";
+            };
+
+            to = mkOption {
+              type = with types; nullOr str;
+              default = null;
+              description = ''
+                Email address to which to send feed items.
+
+                If <literal>null</literal>, this will not be set in the
+                configuration file, and rss2email will make it default to
+                <literal>rss2email.to</literal>.
+              '';
+            };
+          };
+        });
+      };
+    };
+
+  };
+
+
+  ###### implementation
+
+  config = mkIf cfg.enable {
+    users.groups = {
+      rss2email.gid = config.ids.gids.rss2email;
+    };
+
+    users.users = {
+      rss2email = {
+        description = "rss2email user";
+        uid = config.ids.uids.rss2email;
+        group = "rss2email";
+      };
+    };
+
+    services.rss2email.config.to = cfg.to;
+
+    systemd.services.rss2email = let
+      conf = pkgs.writeText "rss2email.cfg" (lib.generators.toINI {} ({
+          DEFAULT = cfg.config;
+        } // lib.mapAttrs' (name: feed: nameValuePair "feed.${name}" (
+          { inherit (feed) url; } //
+          lib.optionalAttrs (feed.to != null) { inherit (feed) to; }
+        )) cfg.feeds
+      ));
+    in
+    {
+      preStart = ''
+        mkdir -p /var/rss2email
+        chmod 700 /var/rss2email
+
+        cp ${conf} /var/rss2email/conf.cfg
+        if [ ! -f /var/rss2email/db.json ]; then
+          echo '{"version":2,"feeds":[]}' > /var/rss2email/db.json
+        fi
+
+        chown -R rss2email:rss2email /var/rss2email
+      '';
+      path = [ pkgs.system-sendmail ];
+      serviceConfig = {
+        ExecStart =
+          "${pkgs.rss2email}/bin/r2e -c /var/rss2email/conf.cfg -d /var/rss2email/db.json run";
+        User = "rss2email";
+        PermissionsStartOnly = "true";
+      };
+    };
+
+    systemd.timers.rss2email = {
+      partOf = [ "rss2email.service" ];
+      wantedBy = [ "timers.target" ];
+      timerConfig.OnBootSec = "0";
+      timerConfig.OnUnitActiveSec = cfg.interval;
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ ekleog ];
+}
--- a/nixos/modules/services/monitoring/prometheus/alertmanager.nix
+++ b/nixos/modules/services/monitoring/prometheus/alertmanager.nix
@ -5,10 +5,18 @@ with lib;
 let
  cfg = config.services.prometheus.alertmanager;
  mkConfigFile = pkgs.writeText "alertmanager.yml" (builtins.toJSON cfg.configuration);
-  alertmanagerYml =
-    if cfg.configText != null then
+
+  checkedConfig = file: pkgs.runCommand "checked-config" { buildInputs = [ cfg.package ]; } ''
+    ln -s ${file} $out
+    amtool check-config $out
+  '';
+
+  alertmanagerYml = let
+    yml = if cfg.configText != null then
        pkgs.writeText "alertmanager.yml" cfg.configText
        else mkConfigFile;
+    in checkedConfig yml;
+
  cmdlineArgs = cfg.extraFlags ++ [
    "--config.file ${alertmanagerYml}"
    "--web.listen-address ${cfg.listenAddress}:${toString cfg.port}"
@ -23,6 +31,15 @@ in {
    services.prometheus.alertmanager = {
      enable = mkEnableOption "Prometheus Alertmanager";

+      package = mkOption {
+        type = types.package;
+        default = pkgs.prometheus-alertmanager;
+        defaultText = "pkgs.alertmanager";
+        description = ''
+          Package that should be used for alertmanager.
+        '';
+      };
+
      user = mkOption {
        type = types.str;
        default = "nobody";
@ -40,8 +57,8 @@ in {
      };

      configuration = mkOption {
-        type = types.attrs;
-        default = {};
+        type = types.nullOr types.attrs;
+        default = null;
        description = ''
          Alertmanager configuration as nix attribute set.
        '';
@ -119,15 +136,22 @@ in {
    };
  };

-
-  config = mkIf cfg.enable {
+  config = mkMerge [
+    (mkIf cfg.enable {
+      assertions = singleton {
+        assertion = cfg.configuration != null || cfg.configText != null;
+        message = "Can not enable alertmanager without a configuration. "
+         + "Set either the `configuration` or `configText` attribute.";
+      };
+    })
+    (mkIf cfg.enable {
      networking.firewall.allowedTCPPorts = optional cfg.openFirewall cfg.port;

      systemd.services.alertmanager = {
        wantedBy = [ "multi-user.target" ];
        after    = [ "network.target" ];
        script = ''
-        ${pkgs.prometheus-alertmanager.bin}/bin/alertmanager \
+          ${cfg.package}/bin/alertmanager \
            ${concatStringsSep " \\\n  " cmdlineArgs}
        '';

@ -140,5 +164,6 @@ in {
          ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
        };
      };
-  };
+    })
+  ];
 }
--- a/nixos/modules/services/networking/firewall.nix
+++ b/nixos/modules/services/networking/firewall.nix
@ -58,6 +58,9 @@ let
    ${text}
  ''; in "${dir}/bin/${name}";

+  defaultInterface = { default = mapAttrs (name: value: cfg."${name}") commonOptions; };
+  allInterfaces = defaultInterface // cfg.interfaces;
+
  startScript = writeShScript "firewall-start" ''
    ${helpers}

@ -154,7 +157,7 @@ let
          ip46tables -A nixos-fw -p tcp --dport ${toString port} -j nixos-fw-accept ${optionalString (iface != "default") "-i ${iface}"}
        ''
      ) cfg.allowedTCPPorts
-    ) cfg.interfaces)}
+    ) allInterfaces)}

    # Accept connections to the allowed TCP port ranges.
    ${concatStrings (mapAttrsToList (iface: cfg:
@ -164,7 +167,7 @@ let
          ip46tables -A nixos-fw -p tcp --dport ${range} -j nixos-fw-accept ${optionalString (iface != "default") "-i ${iface}"}
        ''
      ) cfg.allowedTCPPortRanges
-    ) cfg.interfaces)}
+    ) allInterfaces)}

    # Accept packets on the allowed UDP ports.
    ${concatStrings (mapAttrsToList (iface: cfg:
@ -173,7 +176,7 @@ let
          ip46tables -A nixos-fw -p udp --dport ${toString port} -j nixos-fw-accept ${optionalString (iface != "default") "-i ${iface}"}
        ''
      ) cfg.allowedUDPPorts
-    ) cfg.interfaces)}
+    ) allInterfaces)}

    # Accept packets on the allowed UDP port ranges.
    ${concatStrings (mapAttrsToList (iface: cfg:
@ -183,7 +186,7 @@ let
          ip46tables -A nixos-fw -p udp --dport ${range} -j nixos-fw-accept ${optionalString (iface != "default") "-i ${iface}"}
        ''
      ) cfg.allowedUDPPortRanges
-    ) cfg.interfaces)}
+    ) allInterfaces)}

    # Accept IPv4 multicast.  Not a big security risk since
    # probably nobody is listening anyway.
@ -508,15 +511,11 @@ in
      };

      interfaces = mkOption {
-        default = {
-          default = mapAttrs (name: value: cfg."${name}") commonOptions;
-        };
+        default = { };
        type = with types; attrsOf (submodule [ { options = commonOptions; } ]);
        description =
          ''
-            Interface-specific open ports. Setting this value will override
-            all values of the <literal>networking.firewall.allowed*</literal>
-            options.
+            Interface-specific open ports.
          '';
      };
    } // commonOptions;
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -179,6 +179,7 @@ in
  radicale = handleTest ./radicale.nix {};
  redmine = handleTest ./redmine.nix {};
  rspamd = handleTest ./rspamd.nix {};
+  rss2email = handleTest ./rss2email.nix {};
  rsyslogd = handleTest ./rsyslogd.nix {};
  runInMachine = handleTest ./run-in-machine.nix {};
  rxe = handleTest ./rxe.nix {};
--- a/nixos/tests/common/webroot/news-rss.xml
+++ b/nixos/tests/common/webroot/news-rss.xml
@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<rss xmlns:blogChannel="http://backend.userland.com/blogChannelModule" version="2.0"><channel><title>NixOS News</title><link>https://nixos.org</link><description>News for NixOS, the purely functional Linux distribution.</description><image><title>NixOS</title><url>https://nixos.org/logo/nixos-logo-only-hires.png</url><link>https://nixos.org/</link></image><item><title>
+      NixOS 18.09 released
+    </title><link>https://nixos.org/news.html</link><description>
+      <a href="https://github.com/NixOS/nixos-artwork/blob/master/releases/18.09-jellyfish/jellyfish.png">
+        <img class="inline" src="logo/nixos-logo-18.09-jellyfish-lores.png" alt="18.09 Jellyfish logo" with="100" height="87"/>
+      </a>
+      NixOS 18.09 “Jellyfish” has been released, the tenth stable release branch.
+      See the <a href="/nixos/manual/release-notes.html#sec-release-18.09">release notes</a>
+      for details. You can get NixOS 18.09 ISOs and VirtualBox appliances
+      from the <a href="nixos/download.html">download page</a>.
+      For information on how to upgrade from older release branches
+      to 18.09, check out the
+      <a href="/nixos/manual/index.html#sec-upgrading">manual section on upgrading</a>.
+    </description><pubDate>Sat Oct 06 2018 00:00:00 GMT</pubDate></item></channel></rss>
--- a/nixos/tests/prometheus.nix
+++ b/nixos/tests/prometheus.nix
@ -13,6 +13,25 @@ import ./make-test.nix {
          }];
        }];
        rules = [ ''testrule = count(up{job="prometheus"})'' ];
+
+        # a very simple version of the alertmanager configuration just to see if
+        # configuration checks & service startup are working
+        alertmanager = {
+          enable = true;
+          listenAddress = "[::1]";
+          port = 9093;
+          configuration = {
+            route.receiver = "webhook";
+            receivers = [
+              {
+                name = "webhook";
+                webhook_configs = [
+                  { url = "http://localhost"; }
+                ];
+              }
+            ];
+          };
+        };
      };
    };
  };
@ -22,5 +41,8 @@ import ./make-test.nix {
    $one->waitForUnit("prometheus.service");
    $one->waitForOpenPort(9090);
    $one->succeed("curl -s http://127.0.0.1:9090/metrics");
+    $one->waitForUnit("alertmanager.service");
+    $one->waitForOpenPort("9093");
+    $one->succeed("curl -f -s http://localhost:9093/");
  '';
 }
--- a/nixos/tests/rss2email.nix
+++ b/nixos/tests/rss2email.nix
@ -0,0 +1,66 @@
+import ./make-test.nix {
+  name = "opensmtpd";
+
+  nodes = {
+    server = { pkgs, ... }: {
+      imports = [ common/user-account.nix ];
+      services.nginx = {
+        enable = true;
+        virtualHosts."127.0.0.1".root = ./common/webroot;
+      };
+      services.rss2email = {
+        enable = true;
+        to = "alice@localhost";
+        interval = "1";
+        config.from = "test@example.org";
+        feeds = {
+          nixos = { url = "http://127.0.0.1/news-rss.xml"; };
+        };
+      };
+      services.opensmtpd = {
+        enable = true;
+        extraServerArgs = [ "-v" ];
+        serverConfiguration = ''
+          listen on 127.0.0.1
+          action dovecot_deliver mda \
+            "${pkgs.dovecot}/libexec/dovecot/deliver -d %{user.username}"
+          match from any for local action dovecot_deliver
+        '';
+      };
+      services.dovecot2 = {
+        enable = true;
+        enableImap = true;
+        mailLocation = "maildir:~/mail";
+        protocols = [ "imap" ];
+      };
+      environment.systemPackages = let
+        checkMailLanded = pkgs.writeScriptBin "check-mail-landed" ''
+          #!${pkgs.python3.interpreter}
+          import imaplib
+
+          with imaplib.IMAP4('127.0.0.1', 143) as imap:
+            imap.login('alice', 'foobar')
+            imap.select()
+            status, refs = imap.search(None, 'ALL')
+            print("=====> Result of search for all:", status, refs)
+            assert status == 'OK'
+            assert len(refs) > 0
+            status, msg = imap.fetch(refs[0], 'BODY[TEXT]')
+            assert status == 'OK'
+        '';
+      in [ pkgs.opensmtpd checkMailLanded ];
+    };
+  };
+
+  testScript = ''
+    startAll;
+
+    $server->waitForUnit("network-online.target");
+    $server->waitForUnit("opensmtpd");
+    $server->waitForUnit("dovecot2");
+    $server->waitForUnit("nginx");
+    $server->waitForUnit("rss2email");
+
+    $server->waitUntilSucceeds('check-mail-landed >&2');
+  '';
+}
--- a/pkgs/applications/altcoins/clightning.nix
+++ b/pkgs/applications/altcoins/clightning.nix
@ -1,22 +1,23 @@
 { stdenv, python3, pkgconfig, which, libtool, autoconf, automake,
-  autogen, sqlite, gmp, zlib, fetchFromGitHub }:
+  autogen, sqlite, gmp, zlib, fetchFromGitHub, fetchpatch }:

 with stdenv.lib;
 stdenv.mkDerivation rec {
  name = "clightning-${version}";
-  version = "0.6.1";
+  version = "0.6.2";

  src = fetchFromGitHub {
    fetchSubmodules = true;
    owner = "ElementsProject";
    repo = "lightning";
    rev = "v${version}";
-    sha256 = "0qx30i1c97ic4ii8bm0sk9dh76nfg4ihl9381gxjj14i4jr1q8y4";
+    sha256 = "18yns0yyf7kc4p4n1crxdqh37j9faxkx216nh2ip7cxj4x8bf9gx";
  };

  enableParallelBuilding = true;

-  buildInputs = [ which sqlite gmp zlib autoconf libtool automake autogen python3 pkgconfig ];
+  nativeBuildInputs = [ autoconf autogen automake libtool pkgconfig which ];
+  buildInputs = [ sqlite gmp zlib python3 ];

  makeFlags = [ "prefix=$(out)" ];

@ -24,6 +25,15 @@ stdenv.mkDerivation rec {
    ./configure --prefix=$out --disable-developer --disable-valgrind
  '';

+  # NOTE: remove me in 0.6.3
+  patches = [
+    (fetchpatch {
+      name = "clightning_0_6_2-compile-error.patch";
+      url = https://patch-diff.githubusercontent.com/raw/ElementsProject/lightning/pull/2070.patch;
+      sha256 = "1576fqik5zcpz5zsvp2ks939bgiz0jc22yf24iv61000dd5j6na9";
+    })
+  ];
+
  postPatch = ''
    echo "" > tools/refresh-submodules.sh
    patchShebangs tools/generate-wire.py
--- a/pkgs/applications/audio/mopidy/default.nix
+++ b/pkgs/applications/audio/mopidy/default.nix
@ -4,13 +4,13 @@

 pythonPackages.buildPythonApplication rec {
  pname = "mopidy";
-  version = "2.1.0";
+  version = "2.2.1";

  src = fetchFromGitHub {
    owner = "mopidy";
    repo = "mopidy";
    rev = "v${version}";
-    sha256 = "0krq5fbscqxayyc4vxai7iwxm2kdbgs5jicrdb013v04phw2za06";
+    sha256 = "012gg6x6d27adbfnwd4a607dl49bzk74az6h9djfvl2w0rbxzhhr";
  };

  nativeBuildInputs = [ wrapGAppsHook ];
@ -21,7 +21,7 @@ pythonPackages.buildPythonApplication rec {
  ];

  propagatedBuildInputs = with pythonPackages; [
-    gst-python pygobject3 pykka tornado requests
+    gst-python pygobject3 pykka tornado_4 requests
  ] ++ stdenv.lib.optional (!stdenv.isDarwin) dbus-python;

  # There are no tests
--- a/pkgs/applications/audio/mopidy/iris.nix
+++ b/pkgs/applications/audio/mopidy/iris.nix
@ -2,11 +2,11 @@

 pythonPackages.buildPythonApplication rec {
  pname = "Mopidy-Iris";
-  version = "3.29.2";
+  version = "3.31.1";

  src = pythonPackages.fetchPypi {
    inherit pname version;
-    sha256 = "1v767a2j6lzp5yppfjna0ifv8psj60pphzd7njcdkx71dvpswpi2";
+    sha256 = "1djxkgjvfzijvlq3gill1p20l0q64dbv9wd55whbir1l7y8wdga5";
  };

  propagatedBuildInputs = [
--- a/pkgs/applications/audio/ncmpc/default.nix
+++ b/pkgs/applications/audio/ncmpc/default.nix
@ -1,18 +1,18 @@
 { stdenv, fetchFromGitHub, meson, ninja, pkgconfig, glib, ncurses
-, mpd_clientlib, gettext }:
+, mpd_clientlib, gettext, boost }:

 stdenv.mkDerivation rec {
  name = "ncmpc-${version}";
-  version = "0.31";
+  version = "0.33";

  src = fetchFromGitHub {
    owner  = "MusicPlayerDaemon";
    repo   = "ncmpc";
    rev    = "v${version}";
-    sha256 = "09h1m9rkk89729i2d5zsfdc6rxajvikgsi3h99rwz2192gm457rj";
+    sha256 = "1ymnxb85v2pc0qpk0yz5gdxayc0ialk82ba521lgdw66li7fr4as";
  };

-  buildInputs = [ glib ncurses mpd_clientlib ];
+  buildInputs = [ glib ncurses mpd_clientlib boost ];
  nativeBuildInputs = [ meson ninja pkgconfig gettext ];

  meta = with stdenv.lib; {
--- a/pkgs/applications/misc/slic3r/default.nix
+++ b/pkgs/applications/misc/slic3r/default.nix
@ -1,28 +1,27 @@
 { stdenv, fetchgit, perl, makeWrapper, makeDesktopItem
-, which, perlPackages
+, which, perlPackages, boost
 }:

 stdenv.mkDerivation rec {
-  version = "1.2.9";
+  version = "1.3.0";
  name = "slic3r-${version}";

  src = fetchgit {
    url = "git://github.com/alexrj/Slic3r";
-    rev = "refs/tags/${version}";
-    sha256 = "1z8h11k29b7z49z5k8ikyfiijyycy1q3krlzi8hfd0vdybvymw21";
+    rev = version;
+    sha256 = "1pg4jxzb7f58ls5s8mygza8kqdap2c50kwlsdkf28bz1xi611zbi";
  };

-  patches = [
-    ./gcc6.patch
-  ];
-
-  buildInputs = with perlPackages; [ perl makeWrapper which
+  buildInputs = 
+  [boost] ++ 
+  (with perlPackages; [ perl makeWrapper which
    EncodeLocale MathClipper ExtUtilsXSpp threads
    MathConvexHullMonotoneChain MathGeometryVoronoi MathPlanePath Moo
    IOStringy ClassXSAccessor Wx GrowlGNTP NetDBus ImportInto XMLSAX
    ExtUtilsMakeMaker OpenGL WxGLCanvas ModuleBuild LWP
    ExtUtilsCppGuess ModuleBuildWithXSpp ExtUtilsTypemapsDefault
-  ];
+    DevelChecklib locallib
+  ]);

  desktopItem = makeDesktopItem {
    name = "slic3r";
@ -34,6 +33,13 @@ stdenv.mkDerivation rec {
    categories = "Application;Development;";
  };

+  prePatch = ''
+    # In nix ioctls.h isn't available from the standard kernel-headers package
+    # on other distributions. As the copy in glibc seems to be identical to the
+    # one in the kernel, we use that one instead.
+    sed -i 's|"/usr/include/asm-generic/ioctls.h"|<asm-generic/ioctls.h>|g' xs/src/libslic3r/GCodeSender.cpp
+  '';
+
  buildPhase = ''
    export SLIC3R_NO_AUTO=true
    export LD=$CXX
--- a/pkgs/applications/misc/slic3r/gcc6.patch
+++ b/pkgs/applications/misc/slic3r/gcc6.patch
@ -1,40 +0,0 @@
-diff --git i/xs/src/libslic3r/Config.hpp w/xs/src/libslic3r/Config.hpp
-index 49e999b..d9b65d8 100644
--- i/xs/src/libslic3r/Config.hpp
-+++ w/xs/src/libslic3r/Config.hpp
-@@ -65,7 +65,7 @@ class ConfigOptionFloat : public ConfigOption
-     
-     bool deserialize(std::string str) {
-         std::istringstream iss(str);
-        return iss >> this->value;
-+        return bool(iss >> this->value);
-     };
- };
- 
-@@ -124,7 +124,7 @@ class ConfigOptionInt : public ConfigOption
-     
-     bool deserialize(std::string str) {
-         std::istringstream iss(str);
-        return iss >> this->value;
-+        return bool(iss >> this->value);
-     };
- };
- 
-@@ -249,7 +249,7 @@ class ConfigOptionPercent : public ConfigOption
-     bool deserialize(std::string str) {
-         // don't try to parse the trailing % since it's optional
-         std::istringstream iss(str);
-        return iss >> this->value;
-+        return bool(iss >> this->value);
-     };
- };
- 
-@@ -279,7 +279,7 @@ class ConfigOptionFloatOrPercent : public ConfigOption
-     bool deserialize(std::string str) {
-         this->percent = str.find_first_of("%") != std::string::npos;
-         std::istringstream iss(str);
-        return iss >> this->value;
-+        return bool(iss >> this->value);
-     };
- };
- 
--- a/pkgs/applications/misc/xmr-stak/default.nix
+++ b/pkgs/applications/misc/xmr-stak/default.nix
@ -12,13 +12,13 @@ in

 stdenv'.mkDerivation rec {
  name = "xmr-stak-${version}";
-  version = "2.5.2";
+  version = "2.6.0";

  src = fetchFromGitHub {
    owner = "fireice-uk";
    repo = "xmr-stak";
    rev = "${version}";
-    sha256 = "0fk51s0789arwkidgx4c5y4shdvawwc132dzn8z71fpi6kh6ggvm";
+    sha256 = "15vb55bshgjxk77yys7p832mr8qf7fb1dv3l0ppl6cmdcg8k0sx2";
  };

  NIX_CFLAGS_COMPILE = "-O3";
--- a/pkgs/applications/misc/xmrig/default.nix
+++ b/pkgs/applications/misc/xmrig/default.nix
@ -1,20 +1,20 @@
-{ stdenv, lib, fetchFromGitHub, cmake, libuv, libmicrohttpd
+{ stdenv, lib, fetchFromGitHub, cmake, libuv, libmicrohttpd, openssl
 , donateLevel ? 0
 }:

 stdenv.mkDerivation rec {
  name = "xmrig-${version}";
-  version = "2.6.4";
+  version = "2.8.3";

  src = fetchFromGitHub {
    owner = "xmrig";
    repo = "xmrig";
    rev = "v${version}";
-    sha256 = "1c68qg7433chri6q1yhyggy4mbq2vnn3p2fxs8gqmgij9vpqn3m2";
+    sha256 = "144i24c707fja89iqcc511b4077p53q8w2cq5zd26hry2i4i3abi";
  };

  nativeBuildInputs = [ cmake ];
-  buildInputs = [ libuv libmicrohttpd ];
+  buildInputs = [ libuv libmicrohttpd openssl ];

  postPatch = ''
    substituteInPlace src/donate.h --replace "kDonateLevel = 5;" "kDonateLevel = ${toString donateLevel};"
--- a/pkgs/applications/networking/browsers/opera/default.nix
+++ b/pkgs/applications/networking/browsers/opera/default.nix
@ -27,6 +27,7 @@
 , libXtst
 , libnotify
 , libpulseaudio
+, libuuid
 , nspr
 , nss
 , pango
@ -38,7 +39,7 @@
 let

  mirror = https://get.geo.opera.com/pub/opera/desktop;
-  version = "53.0.2907.99";
+  version = "56.0.3051.99";

  rpath = stdenv.lib.makeLibraryPath [

@ -70,6 +71,7 @@ let
    libXtst.out
    libxcb.out
    libnotify.out
+    libuuid.out
    nspr.out
    nss.out
    pango.out
@ -92,7 +94,7 @@ in stdenv.mkDerivation {

  src = fetchurl {
    url = "${mirror}/${version}/linux/opera-stable_${version}_amd64.deb";
-    sha256 = "0fih5047xv275rmbcr2drji81wxi6p0kyp172mmn328g3pzddmwx";
+    sha256 = "1mf4lpb66w63kafjni5caq9k3lmsqd85161q29z5lr1s2cx9qqm8";
  };

  unpackCmd = "${dpkg}/bin/dpkg-deb -x $curSrc .";
--- a/pkgs/applications/networking/cluster/helm/default.nix
+++ b/pkgs/applications/networking/cluster/helm/default.nix
@ -18,7 +18,7 @@ buildGoPackage rec {

  # Thsese are the original flags from the helm makefile
  buildFlagsArray = ''
-    -ldflags=
+    -ldflags=-X k8s.io/helm/pkg/version.Version=v${version}
    -w
    -s
  '';
--- a/pkgs/applications/networking/cluster/terraform-providers/data.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/data.nix
@ -11,8 +11,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-alicloud";
-      version = "1.22.0";
-      sha256  = "19qn7q280ppsg7hjlmyagbhgb7qw365mk6c4avs0apvpq6n64rn3";
+      version = "1.23.0";
+      sha256  = "14hs58lqlj9vkmr4bxbyga8yz4h6mrx6zla587sqwgj5bjrg5vld";
    };
  archive =
    {
@ -39,15 +39,15 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-aws";
-      version = "1.43.1";
-      sha256  = "0fhw07kqcykfzlfhqh3wdz43kkhz3c63xkymnpw68kqx2vxx8ncv";
+      version = "1.46.0";
+      sha256  = "1xp02cwyl9sf8swl7x3wah3bg0ssm7y0svq8bkfki6632nfw9vzi";
    };
  azurerm =
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-azurerm";
-      version = "1.18.0";
-      sha256  = "03vkpk9kl9zvfrprhqqn739klr9gpps5d6zq5r3qa56k588zcg4p";
+      version = "1.19.0";
+      sha256  = "1b07g90vmdvlfyz2q40sjd14xnbjyf9c7hgg7rzyhnkfi7imjbbf";
    };
  azurestack =
    {
@ -102,8 +102,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-cloudflare";
-      version = "1.8.0";
-      sha256  = "1hsqxi27mwr96k8yn8f1nxwvs1jaq7nr8plxi7y4lqsv6s7mghjk";
+      version = "1.9.0";
+      sha256  = "0z11zaii99cilqcq4lgikaanb2zc457qv19sxdh6b3v88n5n8qsf";
    };
  cloudscale =
    {
@ -228,15 +228,15 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-grafana";
-      version = "1.2.0";
-      sha256  = "1kn2bbdgci6nfl2gyk4w8w203fscqws2748idv9m53ikczg8n573";
+      version = "1.3.0";
+      sha256  = "1gyma31iv05nfy9jrd8zlkls35fbrxx4nrh56gdgwchv054rxzff";
    };
  hcloud =
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-hcloud";
-      version = "1.4.0";
-      sha256  = "00mq6p2y61z4hg9dncf3mj59cp6fx4iqrn86m96wkw346shs6prs";
+      version = "1.5.0";
+      sha256  = "135h811qh1l1kn66n371f00b422xi4zw15cgs3id866za5cavxf3";
    };
  helm =
    {
@ -249,8 +249,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-heroku";
-      version = "1.5.0";
-      sha256  = "0hzzhqd87vkcbzndsn15g4nl3qhv2kvnhs9zv6kbxaxm7p7rm3pz";
+      version = "1.6.0";
+      sha256  = "0byz9prx2x3nz9dl65mjnp0f33in62am35kcsza3538jcvymkhk2";
    };
  http =
    {
@ -396,8 +396,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-oci";
-      version = "3.6.0";
-      sha256  = "0ilg52j6js6bvw9wng5rbcv2n9kp926x4f2q340qwyyna59r5s5l";
+      version = "3.7.0";
+      sha256  = "10d8hvcr019cr8fh54klnr9xhi0y3l5w4nb2h9bny84nv2rznk38";
    };
  oneandone =
    {
@ -417,8 +417,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-openstack";
-      version = "1.11.0";
-      sha256  = "1wqb7q10nyr4jy9ny4giazblwhh3qrn4s1f0xb5q702b5igbfwwm";
+      version = "1.12.0";
+      sha256  = "1zv5z55yiqvsh5sh26qlyw8fcc7kyw7v4p60kfnw2ds5kd0b51i1";
    };
  opentelekomcloud =
    {
@ -592,8 +592,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-tfe";
-      version = "0.2.0";
-      sha256  = "1d3yiaxmmlnnjmx6vnckvdnqgyxakc9i70dgxdbn8ihw5i6anvik";
+      version = "0.3.0";
+      sha256  = "125k1hgpzwlsgslnz2nwz4mc5yl3hqyg48xdcn7bxvmvaf6kw9gd";
    };
  tls =
    {
--- a/pkgs/applications/networking/feedreaders/rss2email/default.nix
+++ b/pkgs/applications/networking/feedreaders/rss2email/default.nix
@ -1,11 +1,13 @@
-{ pythonPackages, fetchurl, lib }:
+{ pythonPackages, fetchurl, lib, nixosTests }:

 with pythonPackages;

 buildPythonApplication rec {
  name = "${pname}-${version}";
  pname = "rss2email";
-  version = "3.9";
+  version = "3.9"; # TODO: on next bump, the manpage will be updated.
+  # Update nixos/modules/services/mail/rss2email.nix to point to it instead of
+  # to the online r2e.1

  propagatedBuildInputs = [ feedparser beautifulsoup4 html2text ];

@ -44,4 +46,7 @@ buildPythonApplication rec {
    license = licenses.gpl2;
    maintainers = with maintainers; [ jb55 Profpatsch ];
  };
+  passthru.tests = {
+    smoke-test = nixosTests.rss2email;
+  };
 }
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@ -14,18 +14,18 @@ let

  packageOverrides = self: super: {
    sqlalchemy = super.sqlalchemy.overridePythonAttrs (old: rec {
-      version = "1.1.10";
+      version = "1.2.6";
      src = old.src.override {
        inherit version;
-        sha256 = "1lvb14qclrx0qf6qqx8a8hkx5akk5lk3dvcqz8760v9hya52pnfv";
+        sha256 = "1nwylglh256mbwwnng6n6bzgxshyz18j12hw76sghbprp74hrc3w";
      };
    });

    guessit = super.guessit.overridePythonAttrs (old: rec {
-      version = "2.1.4";
+      version = "3.0.3";
      src = old.src.override {
        inherit version;
-        sha256 = "90e6f9fb49246ad27f34f8b9984357e22562ccc3059241cbc08b4fac1d401c56";
+        sha256 = "1q06b3k31bfb8cxjimpf1rkcrwnc596a9cppjw15minvdangl32r";
      };
    });
  };
@ -36,11 +36,11 @@ with python'.pkgs;

 buildPythonApplication rec {
  pname = "FlexGet";
-  version = "2.16.2";
+  version = "2.17.14";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "1b9nyrg1r69kmwhpmw9pxdrwa9pnw5mphpdlki85cpxiii2sms9j";
+    sha256 = "1wh12nspjzsgb0a7qp67s4k8wssbhhf500s8x8mx2smb1mgy4xzz";
  };

  postPatch = ''
--- a/pkgs/applications/networking/nextcloud-client/default.nix
+++ b/pkgs/applications/networking/nextcloud-client/default.nix
@ -1,37 +1,31 @@
 { stdenv, fetchgit, cmake, pkgconfig, qtbase, qtwebkit, qtkeychain, qttools, sqlite
-, inotify-tools, withGnomeKeyring ? false, makeWrapper, libgnome-keyring }:
+, inotify-tools, makeWrapper, libgnome-keyring, openssl_1_1, pcre, qtwebengine
+}:

 stdenv.mkDerivation rec {
  name = "nextcloud-client-${version}";
-  version = "2.3.3";
+  version = "2.5.0";

  src = fetchgit {
-    url = "git://github.com/nextcloud/client_theming.git";
-    rev = "ab40efe1e1475efddd636c09251d8917627261da";
-    sha256 = "19a1kqydgx47sa1a917j46zlbc5g9nynsanasyad9c8sqi0qvyip";
+    url = "git://github.com/nextcloud/desktop.git";
+    rev = "refs/tags/v${version}";
+    sha256 = "1wz5bz4nmni0qxzcvgmpg9ywrfixzvdd7ixgqmdm4d8g6dm8pk9k";
    fetchSubmodules = true;
  };

-  patches = [ ./find-sql.patch ];
-  patchFlags = "-d client -p1";
-
  nativeBuildInputs = [ pkgconfig cmake ];

-  buildInputs = [ qtbase qtwebkit qtkeychain qttools sqlite ]
-    ++ stdenv.lib.optional stdenv.isLinux inotify-tools
-    ++ stdenv.lib.optional withGnomeKeyring makeWrapper;
+  buildInputs = [ qtbase qtwebkit qtkeychain qttools qtwebengine sqlite openssl_1_1.out pcre inotify-tools ];

  enableParallelBuilding = true;

-  dontUseCmakeBuildDir = true;
-
-  cmakeDir = "client";
+  NIX_LDFLAGS = "${openssl_1_1.out}/lib/libssl.so ${openssl_1_1.out}/lib/libcrypto.so";

  cmakeFlags = [
    "-UCMAKE_INSTALL_LIBDIR"
    "-DCMAKE_BUILD_TYPE=Release"
-    "-DOEM_THEME_DIR=${src}/nextcloudtheme"
-  ] ++ stdenv.lib.optionals stdenv.isLinux [
+    "-DOPENSSL_LIBRARIES=${openssl_1_1.out}/lib"
+    "-DOPENSSL_INCLUDE_DIR=${openssl_1_1.dev}/include"
    "-DINOTIFY_LIBRARY=${inotify-tools}/lib/libinotifytools.so"
    "-DINOTIFY_INCLUDE_DIR=${inotify-tools}/include"
  ];
@ -39,16 +33,13 @@ stdenv.mkDerivation rec {
  postInstall = ''
    sed -i 's/\(Icon.*\)=nextcloud/\1=Nextcloud/g' \
      $out/share/applications/nextcloud.desktop
-  '' + stdenv.lib.optionalString (withGnomeKeyring) ''
-    wrapProgram "$out/bin/nextcloud" \
-      --prefix LD_LIBRARY_PATH : ${stdenv.lib.makeLibraryPath [ libgnome-keyring ]}
  '';

  meta = with stdenv.lib; {
    description = "Nextcloud themed desktop client";
    homepage = https://nextcloud.com;
    license = licenses.gpl2;
-    maintainers = with maintainers; [ caugner ];
+    maintainers = with maintainers; [ caugner ma27 ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/networking/nextcloud-client/find-sql.patch
+++ b/pkgs/applications/networking/nextcloud-client/find-sql.patch
@ -1,12 +0,0 @@
-diff --git a/cmake/modules/QtVersionAbstraction.cmake b/cmake/modules/QtVersionAbstraction.cmake
-index 5bd853c84..93ddf3cf8 100644
--- a/cmake/modules/QtVersionAbstraction.cmake
-+++ b/cmake/modules/QtVersionAbstraction.cmake
-@@ -17,6 +17,7 @@ if( Qt5Core_FOUND )
-     message(STATUS "Found Qt5 core, checking for further dependencies...")
-     find_package(Qt5Network REQUIRED)
-     find_package(Qt5Xml REQUIRED)
-+    find_package(Qt5Sql REQUIRED)
-     find_package(Qt5Concurrent REQUIRED)
-     if(UNIT_TESTING)
-         find_package(Qt5Test REQUIRED)
--- a/pkgs/applications/networking/nextcloud-client/wrapper.nix
+++ b/pkgs/applications/networking/nextcloud-client/wrapper.nix
@ -0,0 +1,14 @@
+{ lib, nextcloud-client, makeWrapper, symlinkJoin, withGnomeKeyring ? false, libgnome-keyring }:
+
+if (!withGnomeKeyring) then nextcloud-client else symlinkJoin {
+  name = "${nextcloud-client.name}-with-gnome-keyring";
+  paths = [ nextcloud-client ];
+  nativeBuildInputs = [ makeWrapper ];
+
+  postBuild = ''
+    wrapProgram "$out/bin/nextcloud" \
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libgnome-keyring ]}
+  '';
+
+  inherit (nextcloud-client) meta;
+}
--- a/pkgs/applications/science/logic/vampire/default.nix
+++ b/pkgs/applications/science/logic/vampire/default.nix
@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
    owner = "vprover";
    repo = "vampire";
    rev = version;
-    sha256 = "1n0kf0g15yjw3v7z60l51h7fdn880mmvqsbb2szh48vzy20l92il";
+    sha256 = "0d1klprlgqrcn8r5ywgvsahr4qz96ayl67ry5jks946v0k94m1k1";
    fetchSubmodules = true;
    leaveDotGit = true;
  };
--- a/pkgs/applications/science/math/polymake/default.nix
+++ b/pkgs/applications/science/math/polymake/default.nix
@ -0,0 +1,48 @@
+{ stdenv, fetchurl
+, ninja, libxml2, libxslt, readline, perl, gmp, mpfr, boost
+, bliss, ppl, singular, cddlib, lrs, nauty
+, ant, openjdk
+, perlPackages
+, makeWrapper
+}:
+
+stdenv.mkDerivation rec {
+  name = "${pname}-${version}";
+  pname = "polymake";
+  version = "3.2.rc4";
+
+  src = fetchurl {
+    url = "https://polymake.org/lib/exe/fetch.php/download/polymake-3.2r4.tar.bz2";
+    sha256 = "02jpkvy1cc6kc23vkn7nkndzr40fq1gkb3v257bwyi1h5d37fyqy";
+  };
+
+  buildInputs = [
+    libxml2 libxslt readline perl gmp mpfr boost
+    bliss ppl singular cddlib lrs nauty
+    openjdk
+  ] ++
+  (with perlPackages; [
+    XMLLibXML XMLLibXSLT XMLWriter TermReadLineGnu TermReadKey
+  ]);
+
+  nativeBuildInputs = [
+    makeWrapper ninja ant perl
+  ];
+
+  ninjaFlags = "-C build/Opt";
+
+  postInstall = ''
+    for i in "$out"/bin/*; do
+      wrapProgram "$i" --prefix PERL5LIB : "$PERL5LIB"
+    done
+  '';
+
+  meta = {
+    inherit version;
+    description = "Software for research in polyhedral geometry";
+    license = stdenv.lib.licenses.gpl2 ;
+    maintainers = [stdenv.lib.maintainers.raskin];
+    platforms = stdenv.lib.platforms.linux;
+    homepage = "https://www.polymake.org/doku.php";
+  };
+}
--- a/pkgs/applications/virtualization/runc/default.nix
+++ b/pkgs/applications/virtualization/runc/default.nix
@ -5,13 +5,13 @@ with lib;

 stdenv.mkDerivation rec {
  name = "runc-${version}";
-  version = "1.0.0-rc5";
+  version = "1.0.0-rc6";

  src = fetchFromGitHub {
    owner = "opencontainers";
    repo = "runc";
    rev = "v${version}";
-    sha256 = "1ikqw39jn8dzb4snc4pcg3z85jb67ivskdhx028k17ss29bf4062";
+    sha256 = "1jwacb8xnmx5fr86gximhbl9dlbdwj3rpf27hav9q1si86w5pb1j";
  };

  outputs = [ "out" "man" ];
--- a/pkgs/build-support/fetchurl/mirrors.nix
+++ b/pkgs/build-support/fetchurl/mirrors.nix
@ -10,26 +10,26 @@ rec {

  # SourceForge.
  sourceforge = [
-    http://downloads.sourceforge.net/
-    http://prdownloads.sourceforge.net/
-    http://heanet.dl.sourceforge.net/sourceforge/
-    http://surfnet.dl.sourceforge.net/sourceforge/
-    http://dfn.dl.sourceforge.net/sourceforge/
-    http://osdn.dl.sourceforge.net/sourceforge/
-    http://kent.dl.sourceforge.net/sourceforge/
+    https://downloads.sourceforge.net/
+    https://prdownloads.sourceforge.net/
+    https://heanet.dl.sourceforge.net/sourceforge/
+    https://surfnet.dl.sourceforge.net/sourceforge/
+    https://dfn.dl.sourceforge.net/sourceforge/
+    https://osdn.dl.sourceforge.net/sourceforge/
+    https://kent.dl.sourceforge.net/sourceforge/
  ];

  # SourceForge.jp.
  sourceforgejp = [
-    http://osdn.dl.sourceforge.jp/
-    http://jaist.dl.sourceforge.jp/
+    https://osdn.dl.sourceforge.jp/
+    https://jaist.dl.sourceforge.jp/
  ];

-  # GNU (http://www.gnu.org/prep/ftp.html).
+  # GNU (https://www.gnu.org/prep/ftp.html).
  gnu = [
    # This one redirects to a (supposedly) nearby and (supposedly) up-to-date
    # mirror.
-    http://ftpmirror.gnu.org/
+    https://ftpmirror.gnu.org/

    http://ftp.nluug.nl/pub/gnu/
    http://mirrors.kernel.org/gnu/
@ -157,12 +157,12 @@ rec {

  # CPAN mirrors.
  cpan = [
-    http://ftp.gwdg.de/pub/languages/perl/CPAN/
-    ftp://download.xs4all.nl/pub/mirror/CPAN/
+    https://ftp.gwdg.de/pub/languages/perl/CPAN/
+    https://download.xs4all.nl/mirror/CPAN/
+    https://cpan.metacpan.org/
+    https://cpan.perl.org/
    http://ftp.tuwien.ac.at/pub/CPAN/
    http://ftp.funet.fi/pub/CPAN/
-    https://cpan.metacpan.org/
-    http://cpan.perl.org/
    http://backpan.perl.org/  # for old releases
  ];

--- a/pkgs/data/fonts/inter-ui/default.nix
+++ b/pkgs/data/fonts/inter-ui/default.nix
@ -1,7 +1,7 @@
 { stdenv, fetchzip }:

 let
-  version = "2.5";
+  version = "3.0";
 in fetchzip {
  name = "inter-ui-${version}";

@ -12,7 +12,7 @@ in fetchzip {
    unzip -j $downloadedFile \*.otf -d $out/share/fonts/opentype
  '';

-  sha256 = "1d88y6c9vbjz5siazhavnpfpazfkvpbcbb4pdycbnj03mmx6y07v";
+  sha256 = "16qmb8farkh41i56f0vvbxcg32rbg7my64amwz5y8gyy73i3320q";

  meta = with stdenv.lib; {
    homepage = https://rsms.me/inter/;
--- a/pkgs/development/compilers/ghcjs-ng/8.4/git.json
+++ b/pkgs/development/compilers/ghcjs-ng/8.4/git.json
@ -1,6 +1,6 @@
 {
  "url": "https://github.com/ghcjs/ghcjs",
-  "rev": "d20da90a4819faad1c6309a06363b34edac0374c",
-  "sha256": "0jmxgfm1zwg6xscjcaycfam7zss8ik4ql4ii5lpryh4h6cdhvkbr",
+  "rev": "81bf5f31dabaa711aab234cb119eb9c998ccb129",
+  "sha256": "1bgnc71kjqicqv2xq8p70nck600yi2p7g4k9r1jclv21ib7i5hmx",
  "fetchSubmodules": true
 }
--- a/pkgs/development/compilers/ghcjs-ng/8.4/stage0.nix
+++ b/pkgs/development/compilers/ghcjs-ng/8.4/stage0.nix
@ -156,6 +156,7 @@
        tree-diff
      ];
      testToolDepends = [ hspec-discover ];
+      doHaddock = false;
      homepage = "http://www.haskell.org/haddock/";
      description = "Library exposing some functionality of Haddock";
      license = stdenv.lib.licenses.bsd3;
--- a/pkgs/development/compilers/urweb/default.nix
+++ b/pkgs/development/compilers/urweb/default.nix
@ -4,11 +4,11 @@

 stdenv.mkDerivation rec {
  name = "urweb-${version}";
-  version = "20170720";
+  version = "20180616";

  src = fetchurl {
-    url = "http://www.impredicative.com/ur/${name}.tgz";
-    sha256 = "17qh9mcmlhbv6r52yij8l9ik7j7x6x7c09lf6pznnbdh4sf8p5wb";
+    url = "https://github.com/urweb/urweb/releases/download/${version}/${name}.tar.gz";
+    sha256 = "04iy2ky78q6w0d2xyfz2a1k26g2yrwsh1hw1bgs5ia9v3ih965r1";
  };

  buildInputs = [ openssl mlton mysql.connector-c postgresql sqlite ];
--- a/pkgs/development/haskell-modules/make-package-set.nix
+++ b/pkgs/development/haskell-modules/make-package-set.nix
@ -125,6 +125,7 @@ let
      name = "cabal2nix-${name}";
      nativeBuildInputs = [ pkgs.buildPackages.cabal2nix ];
      preferLocalBuild = true;
+      allowSubstitutes = false;
      phases = ["installPhase"];
      LANG = "en_US.UTF-8";
      LOCALE_ARCHIVE = pkgs.lib.optionalString (buildPlatform.libc == "glibc") "${buildPackages.glibcLocales}/lib/locale/locale-archive";
--- a/pkgs/development/libraries/keybinder3/default.nix
+++ b/pkgs/development/libraries/keybinder3/default.nix
@ -4,19 +4,19 @@

 stdenv.mkDerivation rec {
  name = "keybinder3-${version}";
-  version = "0.3.0";
+  version = "0.3.2";

  src = fetchFromGitHub {
-    owner = "engla";
+    owner = "kupferlauncher";
    repo = "keybinder";
    rev = "keybinder-3.0-v${version}";
-    sha256 = "1jdcrfhvqffhc2h69197wkpc5j5synk5mm8rqhz27qfrfhh4vf0q";
+    sha256 = "196ibn86j54fywfwwgyh89i9wygm4vh7ls19fn20vrnm6ijlzh9r";
  };

-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ autoconf automake libtool pkgconfig ];
  buildInputs = [
-    autoconf automake libtool gnome3.gnome-common gtk-doc
-    libX11 libXext libXrender gobjectIntrospection gtk3
+    gnome3.gnome-common gtk-doc gtk3
+    libX11 libXext libXrender gobjectIntrospection
  ];

  preConfigure = ''
@ -25,7 +25,7 @@ stdenv.mkDerivation rec {

  meta = with stdenv.lib; {
    description = "Library for registering global key bindings";
-    homepage = https://github.com/engla/keybinder/;
+    homepage = https://github.com/kupferlauncher/keybinder/;
    license = licenses.mit;
    platforms = platforms.linux;
    maintainers = [ maintainers.cstrahan ];
--- a/pkgs/development/libraries/libxkbcommon/libxkbcommon_7.nix
+++ b/pkgs/development/libraries/libxkbcommon/libxkbcommon_7.nix
@ -0,0 +1,32 @@
+{ stdenv, fetchurl, pkgconfig, yacc, flex, xkeyboard_config, libxcb, libX11 }:
+
+stdenv.mkDerivation rec {
+  name = "libxkbcommon-0.7.2";
+
+  src = fetchurl {
+    url = "http://xkbcommon.org/download/${name}.tar.xz";
+    sha256 = "1n5rv5n210kjnkyrvbh04gfwaa7zrmzy1393p8nyqfw66lkxr918";
+  };
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ yacc flex xkeyboard_config libxcb ];
+
+  configureFlags = [
+    "--with-xkb-config-root=${xkeyboard_config}/etc/X11/xkb"
+    "--with-x-locale-root=${libX11.out}/share/X11/locale"
+  ];
+
+  preBuild = stdenv.lib.optionalString stdenv.isDarwin ''
+    sed -i 's/,--version-script=.*$//' Makefile
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A library to handle keyboard descriptions";
+    homepage = http://xkbcommon.org;
+    license = licenses.mit;
+    maintainers = with maintainers; [ garbas ttuegel ];
+    platforms = with platforms; unix;
+  };
+}
--- a/pkgs/development/libraries/mbedtls/1.3.nix
+++ b/pkgs/development/libraries/mbedtls/1.3.nix
@ -1,11 +1,11 @@
 { stdenv, fetchurl, perl }:

 stdenv.mkDerivation rec {
-  name = "mbedtls-1.3.20";
+  name = "mbedtls-1.3.22";

  src = fetchurl {
    url = "https://tls.mbed.org/download/${name}-gpl.tgz";
-    sha256 = "0vv69c1c5rr7jcwwivx06fbfixgig90pjznh2c6cn841hgwm9z00";
+    sha256 = "0ms4s41z88mz7b6gsnp7jslms4v0115k7gw51i6kx6ng9am43l6y";
  };

  nativeBuildInputs = [ perl ];
--- a/pkgs/development/libraries/mbedtls/default.nix
+++ b/pkgs/development/libraries/mbedtls/default.nix
@ -4,22 +4,23 @@
 , cmake
 , ninja
 , perl # Project uses Perl for scripting and testing
+, python

 , enableThreading ? true # Threading can be disabled to increase security https://tls.mbed.org/kb/development/thread-safety-and-multi-threading
 }:

 stdenv.mkDerivation rec {
  name = "mbedtls-${version}";
-  version = "2.12.0";
+  version = "2.14.0";

  src = fetchFromGitHub {
    owner = "ARMmbed";
    repo = "mbedtls";
    rev = name;
-    sha256 = "09snlzlbn8yq95dnfbj2g5bh6y4q82xkaph7qp9ddnlqiaqcji2h";
+    sha256 = "0115qk69j4dvkvw5ci34zlajzhk2hbkiqbjyzr0lxf0mnqacl03i";
  };

-  nativeBuildInputs = [ cmake ninja perl ];
+  nativeBuildInputs = [ cmake ninja perl python ];

  postConfigure = stdenv.lib.optionals enableThreading ''
    perl scripts/config.pl set MBEDTLS_THREADING_C    # Threading abstraction layer
--- a/pkgs/development/libraries/openssl/chacha.nix
+++ b/pkgs/development/libraries/openssl/chacha.nix
@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, perl, zlib
-, withCryptodev ? false, cryptodevHeaders
+, withCryptodev ? false, cryptodev
 }:

 with stdenv.lib;
@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
  setOutputFlags = false;

  nativeBuildInputs = [ perl zlib ];
-  buildInputs = stdenv.lib.optional withCryptodev cryptodevHeaders;
+  buildInputs = stdenv.lib.optional withCryptodev cryptodev;

  configureScript = "./config";

--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@ -1,5 +1,5 @@
 { stdenv, fetchurl, buildPackages, perl, coreutils
-, withCryptodev ? false, cryptodevHeaders
+, withCryptodev ? false, cryptodev
 , enableSSL2 ? false
 , static ? false
 }:
@ -44,7 +44,7 @@ let
    separateDebugInfo = stdenv.hostPlatform.isLinux;

    nativeBuildInputs = [ perl ];
-    buildInputs = stdenv.lib.optional withCryptodev cryptodevHeaders;
+    buildInputs = stdenv.lib.optional withCryptodev cryptodev;

    # TODO(@Ericson2314): Improve with mass rebuild
    configurePlatforms = [];
--- a/pkgs/development/libraries/uriparser/default.nix
+++ b/pkgs/development/libraries/uriparser/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, gtest, pkgconfig, doxygen, graphviz }:
+{ lib, stdenv, fetchurl, gtest, pkgconfig, doxygen, graphviz }:

 stdenv.mkDerivation rec {
  name = "uriparser-${version}";
@ -10,9 +10,11 @@ stdenv.mkDerivation rec {
    sha256 = "0b2yagxzhq9ghpszci6a9xlqg0yl7vq9j5r8dwbar3nszqsfnrzc";
  };

-  nativeBuildInputs = [ pkgconfig gtest doxygen graphviz ];
+  nativeBuildInputs = [ pkgconfig doxygen graphviz ];
+  buildInputs = lib.optional doCheck gtest;
+  configureFlags = lib.optional (!doCheck) "--disable-tests";

-  doCheck = true;
+  doCheck = stdenv.targetPlatform.system == stdenv.hostPlatform.system;

  meta = with stdenv.lib; {
    homepage = https://uriparser.github.io/;
--- a/pkgs/development/libraries/webkitgtk/2.22.nix
+++ b/pkgs/development/libraries/webkitgtk/2.22.nix
@ -15,7 +15,7 @@ assert stdenv.isDarwin -> !enableGtk2Plugins;
 with stdenv.lib;
 stdenv.mkDerivation rec {
  name = "webkitgtk-${version}";
-  version = "2.22.3";
+  version = "2.22.4";

  meta = {
    description = "Web content rendering engine, GTK+ port";
@ -28,7 +28,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://webkitgtk.org/releases/${name}.tar.xz";
-    sha256 = "0wnddhm2bihmmkmi919lyxskvjk2wrzx6azkiypyjfwm08lm9zcx";
+    sha256 = "1f2335hjzsvjxjf6hy5cyypsn65wykpx2pbk1sp548w0hclbxdgs";
  };

  patches = optionals stdenv.isDarwin [
--- a/pkgs/development/python-modules/libmr/default.nix
+++ b/pkgs/development/python-modules/libmr/default.nix
@ -0,0 +1,25 @@
+{ stdenv, buildPythonPackage, fetchPypi, numpy, cython }:
+
+buildPythonPackage rec {
+  pname = "libmr";
+  version = "0.1.9";
+
+  src = fetchPypi {
+    inherit pname version;
+    extension = "zip";
+    sha256 = "43ccd86693b725fa3abe648c8cdcef17ba5fa46b5528168829e5f9b968dfeb70";
+  };
+
+  propagatedBuildInputs = [ numpy cython ];
+
+  # No tests in the pypi tarball
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "libMR provides core MetaRecognition and Weibull fitting functionality";
+    homepage = https://github.com/Vastlab/libMR;
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ psyanticy ];
+  };
+}
+
--- a/pkgs/development/python-modules/nanoleaf/default.nix
+++ b/pkgs/development/python-modules/nanoleaf/default.nix
@ -0,0 +1,25 @@
+{ stdenv, buildPythonPackage, fetchPypi, requests }:
+
+buildPythonPackage rec {
+  pname = "nanoleaf";
+  version = "0.4.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "17dmxibfjmwnrs6ng5cmvfis3cv6iw267xb8n1pijy15y9dz0s8s";
+  };
+
+  prePatch = ''
+    sed -i '/^gitVersion =/d' setup.py
+    substituteInPlace setup.py --replace 'gitVersion' '"${version}"'
+  '';
+
+  propagatedBuildInputs = [ requests ];
+
+  meta = with stdenv.lib; {
+    description = "A python interface for Nanoleaf Aurora lighting";
+    homepage = https://github.com/software-2/nanoleaf;
+    license = licenses.mit;
+    maintainers = with maintainers; [ elseym ];
+  };
+}
--- a/pkgs/development/python-modules/prettytable/default.nix
+++ b/pkgs/development/python-modules/prettytable/default.nix
@ -22,7 +22,7 @@ buildPythonPackage rec {
  meta = with stdenv.lib; {
    description = "Simple Python library for easily displaying tabular data in a visually appealing ASCII table format";
    homepage = http://code.google.com/p/prettytable/;
-    license = licenses.bsd0;
+    license = licenses.bsd3;
  };

 }
--- a/pkgs/development/python-modules/pyjwt/default.nix
+++ b/pkgs/development/python-modules/pyjwt/default.nix
@ -1,6 +1,6 @@
 { lib, buildPythonPackage, fetchPypi
 , cryptography, ecdsa
-, pytestrunner, pytestcov, pytest }:
+, pytestrunner, pytestcov, pytest_37 }:

 buildPythonPackage rec {
  pname = "PyJWT";
@ -13,7 +13,7 @@ buildPythonPackage rec {

  propagatedBuildInputs = [ cryptography ecdsa ];

-  checkInputs = [ pytestrunner pytestcov pytest ];
+  checkInputs = [ pytestrunner pytestcov pytest_37 ];

  meta = with lib; {
    description = "JSON Web Token implementation in Python";
--- a/pkgs/development/python-modules/pymssql/default.nix
+++ b/pkgs/development/python-modules/pymssql/default.nix
@ -0,0 +1,26 @@
+{ lib, buildPythonPackage, fetchPypi, freetds, cython, setuptools-git }:
+
+buildPythonPackage rec {
+  pname = "pymssql";
+  version = "2.1.4";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1yvs3azd8dkf40lybr9wvswvf4hbxn5ys9ypansmbbb328dyn09j";
+  };
+
+  buildInputs = [cython setuptools-git];
+  propagatedBuildInputs = [freetds];
+
+  # The tests require a running instance of SQLServer, so we skip them
+  doCheck = false;
+
+  meta = with lib; {
+    homepage = http://pymssql.org/en/stable/;
+    description = "A simple database interface for Python that builds on top
+      of FreeTDS to provide a Python DB-API (PEP-249) interface to Microsoft
+      SQL Server";
+    license = licenses.lgpl21;
+    maintainers = with maintainers; [ mredaelli ];
+  };
+}
--- a/pkgs/development/python-modules/pytesseract/default.nix
+++ b/pkgs/development/python-modules/pytesseract/default.nix
@ -0,0 +1,31 @@
+{ buildPythonPackage, fetchPypi, lib, pillow, tesseract, substituteAll }:
+
+buildPythonPackage rec {
+  pname = "pytesseract";
+  version = "0.2.5";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0wlz1vbg1k8cdrpzvrahjnbsfs4ki6xqhbkv17ycfchh7h6kfkfm";
+  };
+
+  patches = [
+    (substituteAll {
+      src = ./tesseract-binary.patch;
+      drv = "${tesseract}";
+    })
+  ];
+
+  buildInputs = [ tesseract ];
+  propagatedBuildInputs = [ pillow ];
+
+  # the package doesn't have any tests.
+  doCheck = false;
+
+  meta = with lib; {
+    homepage = https://pypi.org/project/pytesseract/;
+    license = licenses.gpl3;
+    description = "A Python wrapper for Google Tesseract";
+    maintainers = with maintainers; [ ma27 ];
+  };
+}
--- a/pkgs/development/python-modules/pytesseract/tesseract-binary.patch
+++ b/pkgs/development/python-modules/pytesseract/tesseract-binary.patch
@ -0,0 +1,13 @@
+diff --git a/src/pytesseract.py b/src/pytesseract.py
+index 32713cf..5f9209d 100755
+--- a/src/pytesseract.py
+++ b/src/pytesseract.py
+@@ -25,7 +25,7 @@ if numpy_installed:
+     from numpy import ndarray
+ 
+ # CHANGE THIS IF TESSERACT IS NOT IN YOUR PATH, OR IS NAMED DIFFERENTLY
+-tesseract_cmd = 'tesseract'
+tesseract_cmd = '@drv@/bin/tesseract'
+ RGB_MODE = 'RGB'
+ OSD_KEYS = {
+     'Page number': ('page_num', int),
--- a/pkgs/development/python-modules/pytest/default.nix
+++ b/pkgs/development/python-modules/pytest/default.nix
@ -2,9 +2,11 @@
 , setuptools_scm, setuptools, six, pluggy, funcsigs, isPy3k, more-itertools
 , atomicwrites, mock, writeText, pathlib2
 }:
-buildPythonPackage rec {
-  version = "3.9.3";
+
+let generic = { version, sha256 }:
+  buildPythonPackage rec {
    pname = "pytest";
+    inherit version;

    preCheck = ''
      # don't test bash builtins
@ -12,8 +14,7 @@ buildPythonPackage rec {
    '';

    src = fetchPypi {
-    inherit pname version;
-    sha256 = "a9e5e8d7ab9d5b0747f37740276eb362e6a76275d76cebbb52c6049d93b475db";
+      inherit pname version sha256;
    };

    checkInputs = [ hypothesis mock ];
@ -44,4 +45,16 @@ buildPythonPackage rec {
      license = licenses.mit;
      platforms = platforms.unix;
    };
+  };
+
+in {
+  pytest_39 = generic {
+    version = "3.9.3";
+    sha256 = "a9e5e8d7ab9d5b0747f37740276eb362e6a76275d76cebbb52c6049d93b475db";
+  };
+
+  pytest_37 = generic {
+    version = "3.7.4";
+    sha256 = "2d7c49e931316cc7d1638a3e5f54f5d7b4e5225972b3c9838f3584788d27f349";
+  };
 }
--- a/pkgs/development/tools/continuous-integration/jenkins/default.nix
+++ b/pkgs/development/tools/continuous-integration/jenkins/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "jenkins-${version}";
-  version = "2.138.2";
+  version = "2.138.3";

  src = fetchurl {
    url = "http://mirrors.jenkins.io/war-stable/${version}/jenkins.war";
-    sha256 = "10qyr8izngnhlr1b03a9vdnbmwprbqsjnd55hjdalmxy6dq5mvfq";
+    sha256 = "0z8yfnqg43vqhhnp27wb28686zq9kqkyicqn0162hr9h5pd4sglm";
  };

  buildCommand = ''
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {

  meta = with stdenv.lib; {
    description = "An extendable open source continuous integration server";
-    homepage = http://jenkins-ci.org;
+    homepage = https://jenkins-ci.org;
    license = licenses.mit;
    platforms = platforms.all;
    maintainers = with maintainers; [ coconnor fpletz earldouglas ];
--- a/pkgs/development/tools/golint/default.nix
+++ b/pkgs/development/tools/golint/default.nix
@ -2,17 +2,29 @@

 buildGoPackage rec {
  name = "lint-${version}";
-  version = "20180208-${stdenv.lib.strings.substring 0 7 rev}";
-  rev = "e14d9b0f1d332b1420c1ffa32562ad2dc84d645d";
+  version = "20181026-${stdenv.lib.strings.substring 0 7 rev}";
+  rev = "c67002cb31c3a748b7688c27f20d8358b4193582";
  
-  goPackagePath = "github.com/golang/lint";
+  goPackagePath = "golang.org/x/lint";
  excludedPackages = "testdata";

+  # we must allow references to the original `go` package, as golint uses
+  # compiler go/build package to load the packages it's linting.
+  allowGoReference = true;
+
  src = fetchgit {
    inherit rev;
-    url = "https://github.com/golang/lint";
-    sha256 = "15ynf78v39n71aplrhbqvzfblhndp8cd6lnknm586sdl81wama6p";
+    url = "https://go.googlesource.com/lint";
+    sha256 = "0gymbggskjmphqxqcx4s0vnlcz7mygbix0vhwcwv5r67c0bf6765";
  };

  goDeps = ./deps.nix;
+
+  meta = with stdenv.lib; {
+    homepage = https://golang.org;
+    description = "Linter for Go source code";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ jhillyerd ];
+    platforms = platforms.all;
+  };
 }
--- a/pkgs/development/tools/golint/deps.nix
+++ b/pkgs/development/tools/golint/deps.nix
@ -1,11 +1,12 @@
+# This file was generated by https://github.com/kamilchm/go2nix v1.2.1
 [
  {
    goPackagePath = "golang.org/x/tools";
    fetch = {
      type = "git";
      url = "https://go.googlesource.com/tools";
-      rev = "66487607e2081c7c2af2281c62c14ee000d5024b";
-      sha256 = "03wiraqkms4jb5gi7vmp52mpmp4av08yw4gr2nk31c2rnhyd3jv4";
+      rev = "91f80e683c10fea00e7f965a1a7cac482ce52541";
+      sha256 = "16a2vppy5hnp663f28yak6592l8p968ihsc91pigamxx3vk1qh5d";
    };
  }
 ]
--- a/pkgs/development/tools/minizinc/default.nix
+++ b/pkgs/development/tools/minizinc/default.nix
@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, cmake, flex, bison }:
 let
-  version = "2.2.1";
+  version = "2.2.3";
 in
 stdenv.mkDerivation {
  name = "minizinc-${version}";
@ -8,13 +8,12 @@ stdenv.mkDerivation {
  buildInputs = [ cmake flex bison ];

  src = fetchFromGitHub {
-    rev = "${version}";
    owner = "MiniZinc";
    repo = "libminizinc";
-    sha256 = "1i11lan7fqs3lg0s6jfr8sflzwn5nk1ln5j6afjrkrdb08291dr7";
+    rev = "3d66971a0cad6edbe796f4dd940229d38e5bfe3d"; # tags on the repo are disappearing: See https://github.com/MiniZinc/libminizinc/issues/257
+    sha256 = "1q31y9131aj2lsm34srm8i1s0271qcaaknzvym3r8awynm14saq5";
  };

-  # meta is all the information about the package..
  meta = with stdenv.lib; {
    homepage = http://www.minizinc.org/;
    description = "MiniZinc is a medium-level constraint modelling language.";
--- a/pkgs/development/tools/misc/hound/default.nix
+++ b/pkgs/development/tools/misc/hound/default.nix
@ -2,8 +2,8 @@

 buildGoPackage rec {
  name = "hound-unstable-${version}";
-  version = "20170324";
-  rev = "effbe5873f329fcdf982e906b756b535e2804ebc";
+  version = "2018-11-02";
+  rev = "74ec7448a234d8d09e800b92e52c92e378c07742";

  goPackagePath = "github.com/etsy/hound";

@ -11,7 +11,7 @@ buildGoPackage rec {
    inherit rev;
    owner = "etsy";
    repo = "hound";
-    sha256 = "0zc769lygad5an63z5mivaggbmm07d9ynngi2jx3f7651wpji4aw";
+    sha256 = "0g6nvgqjabprcl9z5ci5frhbam1dzq978h1d6aanf8vvzslfgdpq";
  };

  goDeps = ./deps.nix;
--- a/pkgs/development/tools/skaffold/default.nix
+++ b/pkgs/development/tools/skaffold/default.nix
@ -2,9 +2,9 @@

 buildGoPackage rec {
  name = "skaffold-${version}";
-  version = "0.16.0";
-  # rev is the 0.16.0 commit, mainly for skaffold version command output
-  rev = "78e443973ee7475ee66d227431596351cf5e2caf";
+  version = "0.18.0";
+  # rev is the 0.18.0 commit, mainly for skaffold version command output
+  rev = "34651689be78b2c6bcfbace5072b00b93661f895";

  goPackagePath = "github.com/GoogleContainerTools/skaffold";
  subPackages = ["cmd/skaffold"];
@ -20,7 +20,7 @@ buildGoPackage rec {
    owner = "GoogleContainerTools";
    repo = "skaffold";
    rev = "v${version}";
-    sha256 = "0vpjxyqppyj4zs02n8b0k0qd8zidrrcks60x6qd5a4bbqa0c1zld";
+    sha256 = "0an3g4jqch7a6ckh8yhia7lykpvb5lvz4kd5kqfmw9479kygv9sa";
  };

  meta = {
--- a/pkgs/development/web/insomnia/default.nix
+++ b/pkgs/development/web/insomnia/default.nix
@ -1,30 +1,70 @@
-{ stdenv, lib, makeWrapper, fetchurl, dpkg
+{ stdenv, makeWrapper, fetchurl, dpkg
 , alsaLib, atk, cairo, cups, dbus, expat, fontconfig, freetype
-, gdk_pixbuf, glib, gnome2, gtk2-x11, nspr, nss
+, gdk_pixbuf, glib, gnome2, nspr, nss, gtk3, gtk2, at-spi2-atk 
 , libX11, libXScrnSaver, libXcomposite, libXcursor, libXdamage, libXext
 , libXfixes, libXi, libXrandr, libXrender, libXtst, libxcb, nghttp2
-, libudev0-shim, glibc, curl, openssl
+, libudev0-shim, glibc, curl, openssl, autoPatchelfHook
 }:

 let
-  libPath = lib.makeLibraryPath [
-    alsaLib atk cairo cups dbus expat fontconfig freetype gdk_pixbuf glib gnome2.GConf gnome2.pango
-    gtk2-x11 nspr nss stdenv.cc.cc libX11 libXScrnSaver libXcomposite libXcursor libXdamage libXext libXfixes
-    libXi libXrandr libXrender libXtst libxcb
+  runtimeLibs = stdenv.lib.makeLibraryPath [
+    curl
+    glibc
+    libudev0-shim
+    nghttp2
+    openssl
+    stdenv.cc.cc
  ];
-  runtimeLibs = lib.makeLibraryPath [ libudev0-shim glibc curl openssl nghttp2 ];
 in stdenv.mkDerivation rec {
  name = "insomnia-${version}";
-  version = "6.0.2";
+  version = "6.2.0";

  src = fetchurl {
    url = "https://github.com/getinsomnia/insomnia/releases/download/v${version}/insomnia_${version}_amd64.deb";
-    sha256 = "18xspbaal945bmrwjnsz1sjba53040wxrzvig40nnclwj8h671ms";
+    sha256 = "1wxgcriszsbgpicaj4h1ycyykgwsjr8m7x5xi02y5bs5k6l7gcva";
  };

-  nativeBuildInputs = [ makeWrapper dpkg ];
+  nativeBuildInputs = [ 
+    autoPatchelfHook
+    dpkg
+    makeWrapper
+  ];
  
-  buildPhase = ":";
+  buildInputs = [
+    alsaLib
+    at-spi2-atk
+    atk
+    cairo
+    cups
+    dbus
+    expat
+    fontconfig
+    freetype
+    gdk_pixbuf
+    glib
+    gnome2.GConf
+    gnome2.pango
+    gtk2
+    gtk3
+    libX11
+    libXScrnSaver
+    libXcomposite
+    libXcursor
+    libXdamage
+    libXext
+    libXfixes
+    libXi
+    libXrandr
+    libXrender
+    libXtst
+    libxcb
+    nspr
+    nss
+    stdenv.cc.cc
+  ];
+
+  dontBuild = true;
+  dontConfigure = true;

  unpackPhase = "dpkg-deb -x $src .";

@ -39,23 +79,13 @@ in stdenv.mkDerivation rec {
  '';

  preFixup = ''
-    for lib in $out/lib/*.so; do
-      patchelf --set-rpath "$out/lib:${libPath}" $lib
-    done
-
-    for bin in $out/bin/insomnia; do
-      patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
-               --set-rpath "$out/lib:${libPath}" \
-               $bin
-    done
-
    wrapProgram "$out/bin/insomnia" --prefix LD_LIBRARY_PATH : ${runtimeLibs}
  '';

  meta = with stdenv.lib; {
    homepage = https://insomnia.rest/;
    description = "The most intuitive cross-platform REST API Client";
-    license = stdenv.lib.licenses.mit;
+    license = licenses.mit;
    platforms = [ "x86_64-linux" ];
    maintainers = with maintainers; [ markus1189 ];
  };
--- a/pkgs/games/minetest/default.nix
+++ b/pkgs/games/minetest/default.nix
@ -4,13 +4,13 @@
 }:

 let
-  version = "0.4.17";
+  version = "0.4.17.1";
  sources = {
    src = fetchFromGitHub {
      owner = "minetest";
      repo = "minetest";
      rev = "${version}";
-      sha256 = "0ri9hyhvcnyyy2k83qvv543s10476g9fn3vcbjwvxjfqap9mkc5m";
+      sha256 = "19sfblgh9mchkgw32n7gdvm7a8a9jxsl9cdlgmxn9bk9m939a2sg";
    };
    data = fetchFromGitHub {
      owner = "minetest";
--- a/pkgs/misc/themes/nordic/default.nix
+++ b/pkgs/misc/themes/nordic/default.nix
@ -0,0 +1,35 @@
+{ stdenv, fetchurl, gtk-engine-murrine }:
+
+stdenv.mkDerivation rec {
+  name = "nordic-${version}";
+  version = "1.2.1";
+
+  srcs = [
+    (fetchurl {
+      url = "https://github.com/EliverLara/Nordic/releases/download/v${version}/Nordic.tar.xz";
+      sha256 = "1k8fzvjb92wcqha378af5hk6r75xanff9iwlx51jmi67ny8z28pn";
+    })
+    (fetchurl {
+      url = "https://github.com/EliverLara/Nordic/releases/download/v${version}/Nordic-standard-buttons.tar.xz";
+      sha256 = "12w01z88rqkds1wm2kskql1x5c6prpgpc9cxxnl0b11knsfhi6jn";
+    })
+  ];
+
+  sourceRoot = ".";
+
+  propagatedUserEnvPkgs = [ gtk-engine-murrine ];
+
+  installPhase = ''
+    mkdir -p $out/share/themes
+    cp -a Nordic* $out/share/themes
+    rm $out/share/themes/*/{LICENSE,README.md}
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Dark Gtk theme created using the awesome Nord color pallete";
+    homepage = https://github.com/EliverLara/Nordic;
+    license = licenses.gpl3;
+    platforms = platforms.all;
+    maintainers = [ maintainers.romildo ];
+  };
+}
--- a/pkgs/os-specific/linux/iwd/default.nix
+++ b/pkgs/os-specific/linux/iwd/default.nix
@ -32,7 +32,8 @@ in stdenv.mkDerivation rec {
    python3Packages.pygobject3
  ];

-  enableParallelBuilding = true;
+  # Enable when it works again
+  enableParallelBuilding = false;

  configureFlags = [
    "--with-dbus-datadir=$(out)/etc/"
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@ -3,7 +3,7 @@
 with stdenv.lib;

 buildLinux (args // rec {
-  version = "4.14.82";
+  version = "4.14.83";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1b8x77kf3q7nf2h3s9vnn0hzi45srxxin7f9rvg70vd7yvka5457";
+    sha256 = "081zxc7ikcn1hy22pw5af0dql9pq24h2anfgnykc83jfjbg2h5vh";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@ -3,7 +3,7 @@
 with stdenv.lib;

 buildLinux (args // rec {
-  version = "4.19.3";
+  version = "4.19.4";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0834k2lsflp6mgxv1vs1gr4fykg5z0hd4sbbrw3z7zfhsh95fg0y";
+    sha256 = "1aj7zwrjwrjb3m3nfccykmcvhrrjsk1zchc5g4f63xd1pc35d3x3";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:

 buildLinux (args // rec {
-  version = "4.9.138";
+  version = "4.9.140";
  extraMeta.branch = "4.9";

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1dr1mf7i1mwy780048gkhvy283j8331xwgrs2x5qal0xc1114c4j";
+    sha256 = "0hzrha3rh90jwxjmrh4npd0q56pf512nmb8i2p484k9cikssx27q";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/sysdig/default.nix
+++ b/pkgs/os-specific/linux/sysdig/default.nix
@ -1,19 +1,22 @@
-{stdenv, fetchFromGitHub, cmake, luajit, kernel, zlib, ncurses, perl, jsoncpp, libb64, openssl, curl, jq, gcc, elfutils}:
+{ stdenv, fetchFromGitHub, cmake, kernel
+, luajit, zlib, ncurses, perl, jsoncpp, libb64, openssl, curl, jq, gcc, elfutils, tbb
+}:

 with stdenv.lib;
 stdenv.mkDerivation rec {
  name = "sysdig-${version}";
-  version = "0.23.1";
+  version = "0.24.1";

  src = fetchFromGitHub {
    owner = "draios";
    repo = "sysdig";
    rev = version;
-    sha256 = "0q52yfag97n6cvrnzgx7inx11zdg7bgwkvqn2idsg9874fd2wkzh";
+    sha256 = "04y6cqi2j0qpr5bgxyn6zz9f33v5v4lmkcl21c3sg5hmpjwibg3w";
  };

+  nativeBuildInputs = [ cmake perl ];
  buildInputs = [
-    cmake zlib luajit ncurses perl jsoncpp libb64 openssl curl jq gcc elfutils
+    zlib luajit ncurses jsoncpp libb64 openssl curl jq gcc elfutils tbb
  ] ++ optional (kernel != null) kernel.moduleBuildDependencies;

  hardeningDisable = [ "pic" ];
@ -51,9 +54,11 @@ stdenv.mkDerivation rec {

  meta = {
    description = "A tracepoint-based system tracing tool for Linux (with clients for other OSes)";
-    license = licenses.gpl2;
+    license = with licenses; [ asl20 gpl2 mit ];
    maintainers = [maintainers.raskin];
    platforms = ["x86_64-linux"] ++ platforms.darwin;
+    broken = kernel != null && (versionOlder kernel.version "4.14" || versionAtLeast kernel.version "4.20");
+    homepage = "https://sysdig.com/opensource/";
    downloadPage = "https://github.com/draios/sysdig/releases";
  };
 }
--- a/pkgs/os-specific/linux/wireguard/default.nix
+++ b/pkgs/os-specific/linux/wireguard/default.nix
@ -1,4 +1,4 @@
-{ stdenv, kernel, wireguard-tools }:
+{ stdenv, kernel, wireguard-tools, perl }:

 # module requires Linux >= 3.10 https://www.wireguard.io/install/#kernel-requirements
 assert stdenv.lib.versionAtLeast kernel.version "3.10";
@ -19,7 +19,7 @@ stdenv.mkDerivation rec {

  NIX_CFLAGS = ["-Wno-error=cpp"];

-  nativeBuildInputs = kernel.moduleBuildDependencies;
+  nativeBuildInputs = [ perl ] ++ kernel.moduleBuildDependencies;

  buildPhase = "make module";

--- a/pkgs/os-specific/linux/wpa_supplicant/default.nix
+++ b/pkgs/os-specific/linux/wpa_supplicant/default.nix
@ -64,6 +64,9 @@ stdenv.mkDerivation rec {
  '');

  preBuild = ''
+    for manpage in wpa_supplicant/doc/docbook/wpa_supplicant.conf* ; do
+      substituteInPlace "$manpage" --replace /usr/share/doc $out/share/doc
+    done
    cd wpa_supplicant
    cp -v defconfig .config
    echo "$extraConfig" >> .config
@ -132,6 +135,7 @@ stdenv.mkDerivation rec {
    cp -v dbus/dbus-wpa_supplicant.conf $out/etc/dbus-1/system.d
    cp -v "systemd/"*.service $out/etc/systemd/system
    rm $out/share/man/man8/wpa_priv.8
+    install -Dm444 wpa_supplicant.conf $out/share/doc/wpa_supplicant/wpa_supplicant.conf.example
  '';

  meta = with stdenv.lib; {
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@ -562,7 +562,7 @@
    "light.mqtt_template" = ps: with ps; [ paho-mqtt ];
    "light.mysensors" = ps: with ps; [  ];
    "light.mystrom" = ps: with ps; [  ];
-    "light.nanoleaf_aurora" = ps: with ps; [  ];
+    "light.nanoleaf_aurora" = ps: with ps; [ nanoleaf ];
    "light.opple" = ps: with ps; [  ];
    "light.osramlightify" = ps: with ps; [  ];
    "light.piglow" = ps: with ps; [  ];
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, fetchpatch, python3
+{ lib, fetchFromGitHub, fetchpatch, python

 # Look up dependencies of specified components in component-packages.nix
 , extraComponents ? []
@ -52,7 +52,7 @@ let
    (mkOverride "colorlog" "3.1.4"
      "418db638c9577f37f0fae4914074f395847a728158a011be2a193ac491b9779d")

-    # hass-frontend does not exist in python3.pkgs
+    # hass-frontend does not exist in python.pkgs
    (self: super: {
      hass-frontend = self.callPackage ./frontend.nix { };
    })
@ -68,7 +68,7 @@ let
      });
    };
    
-  py = python3.override {
+  py = python.override {
    # Put packageOverrides at the start so they are applied after defaultOverrides
    packageOverrides = lib.foldr lib.composeExtensions (self: super: { }) ([ packageOverrides ] ++ defaultOverrides);
  };
--- a/pkgs/servers/mail/system-sendmail/default.nix
+++ b/pkgs/servers/mail/system-sendmail/default.nix
@ -0,0 +1,36 @@
+{ stdenv, writeText }:
+
+let script = writeText "script" ''
+  #!/bin/sh
+
+  if command -v sendmail > /dev/null 2>&1 && [ "$(command -v sendmail)" != "{{MYPATH}}" ]; then
+    exec sendmail "$@"
+  elif [ -x /run/wrappers/bin/sendmail ]; then
+    exec /run/wrappers/bin/sendmail "$@"
+  elif [ -x /run/current-system/sw/bin/sendmail ]; then
+    exec /run/current-system/sw/bin/sendmail "$@"
+  else
+    echo "Unable to find system sendmail." >&2
+    exit 1
+  fi
+''; in
+stdenv.mkDerivation {
+  name = "system-sendmail-1.0";
+
+  src = script;
+
+  phases = [ "buildPhase" ];
+  buildPhase = ''
+    mkdir -p $out/bin
+    < $src sed "s#{{MYPATH}}#$out/bin/sendmail#" > $out/bin/sendmail
+    chmod +x $out/bin/sendmail
+  '';
+
+  meta = with stdenv.lib; {
+    description = ''
+      A sendmail wrapper that calls the system sendmail. Do not install as system-wide sendmail!
+    '';
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ ekleog ];
+  };
+}
--- a/pkgs/servers/matrix-synapse/default.nix
+++ b/pkgs/servers/matrix-synapse/default.nix
@ -37,11 +37,11 @@ let

 in buildPythonApplication rec {
  pname = "matrix-synapse";
-  version = "0.33.8";
+  version = "0.33.9";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0j8knnqpkidkmpwr2i1k9cwlnwfqpzn3q6ysjvrwpa76hpfcg40l";
+    sha256 = "1wdpywqi1xd6dy3hxnnjnh2amlmhljf8s0bff9v55jyh42bj1vpn";
  };

  patches = [
--- a/pkgs/servers/squid/4.nix
+++ b/pkgs/servers/squid/4.nix
@ -2,11 +2,11 @@
 , expat, libxml2, openssl }:

 stdenv.mkDerivation rec {
-  name = "squid-4.0.24";
+  name = "squid-4.4";

  src = fetchurl {
    url = "http://www.squid-cache.org/Versions/v4/${name}.tar.xz";
-    sha256 = "01vayx86sakfy9zz2q5cvzv97865l1zb0jkqbh7wqz9hcgbs0789";
+    sha256 = "10pfx44mps5ng1806rqdwx8jv8b2n25kjvx37dcd4x2mgzdfc1a9";
  };

  buildInputs = [
--- a/pkgs/servers/squid/default.nix
+++ b/pkgs/servers/squid/default.nix
@ -1,31 +1,18 @@
-{ stdenv, fetchurl, fetchpatch, perl, openldap, pam, db, cyrus_sasl, libcap
+{ stdenv, fetchurl, perl, openldap, pam, db, cyrus_sasl, libcap
 , expat, libxml2, openssl }:

 stdenv.mkDerivation rec {
-  name = "squid-3.5.27";
+  name = "squid-3.5.28";

  src = fetchurl {
    url = "http://www.squid-cache.org/Versions/v3/3.5/${name}.tar.xz";
-    sha256 = "1v7hzvwwghrs751iag90z8909nvyp3c5jynaz4hmjqywy9kl7nsx";
+    sha256 = "1n4f55g56b11qz4fazrnvgzx5wp6b6637c4qkbd1lrjwwqibchgx";
  };

  buildInputs = [
    perl openldap db cyrus_sasl expat libxml2 openssl
  ] ++ stdenv.lib.optionals stdenv.isLinux [ libcap pam ];

-  patches = [
-    (fetchpatch {
-      name = "CVE-2018-1000024.patch";
-      url = http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-2018_1.patch;
-      sha256 = "0vzxr4rmybz0w4c1hi3szvqawbzl4r4b8wyvq9vgq1mzkk5invpg";
-    })
-    (fetchpatch {
-      name = "CVE-2018-1000027.patch";
-      url = http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-2018_2.patch;
-      sha256 = "1a8hwk9z7h1j0c57anfzp3bwjd4pjbyh8aks4ca79nwz4d0y6wf3";
-    })
-  ];
-
  configureFlags = [
    "--enable-ipv6"
    "--disable-strict-error-checking"
--- a/pkgs/servers/sslh/default.nix
+++ b/pkgs/servers/sslh/default.nix
@ -2,25 +2,27 @@

 stdenv.mkDerivation rec {
  name = "sslh-${version}";
-  version = "1.19c";
+  version = "1.20";

  src = fetchurl {
    url = "https://www.rutschle.net/tech/sslh/sslh-v${version}.tar.gz";
-    sha256 = "1wvvqj9r293skgqi28q4ixz7zwf301h1bf514p41xbi7ifldy4dv";
+    sha256 = "05jihpjxx094h7hqzgd9v5jmy77ipwrakzzmjyfvpdzw3h59px57";
  };

  postPatch = "patchShebangs *.sh";

  buildInputs = [ libcap libconfig perl tcp_wrappers pcre ];

-  makeFlags = "USELIBCAP=1 USELIBWRAP=1";
+  makeFlags = [ "USELIBCAP=1" "USELIBWRAP=1" ];

-  installFlags = "PREFIX=$(out)";
+  installFlags = [ "PREFIX=$(out)" ];
+
+  hardeningDisable = [ "format" ];

  meta = with stdenv.lib; {
    description = "Applicative Protocol Multiplexer (e.g. share SSH and HTTPS on the same port)";
    license = licenses.gpl2Plus;
-    homepage = http://www.rutschle.net/tech/sslh.shtml;
+    homepage = https://www.rutschle.net/tech/sslh/README.html;
    maintainers = with maintainers; [ koral fpletz ];
    platforms = platforms.all;
  };
--- a/pkgs/shells/powershell/default.nix
+++ b/pkgs/shells/powershell/default.nix
@ -1,20 +1,21 @@
-{ stdenv, autoPatchelfHook, fetchzip, libunwind, libuuid, icu, curl,
-  makeWrapper, less, openssl, pam, lttng-ust }:
+{ stdenv, autoPatchelfHook, fetchzip, libunwind, libuuid, icu, curl
+, darwin, makeWrapper, less, openssl, pam, lttng-ust }:

 let platformString = if stdenv.isDarwin then "osx"
                     else if stdenv.isLinux then "linux"
                     else throw "unsupported platform";
-    platformSha = if stdenv.isDarwin then "0jngmqxjiiz5dpgky027wl0s3nn321rxs6kxab27kmp031j65x8g"
-                     else if stdenv.isLinux then "0nmqv32mck16b7zljfpb9ydg3h2jvcqrid9ga2i5wac26x3ix531"
+    platformSha = if stdenv.isDarwin then "1zm5q25ny2x6wvdqfrc380467zq0nbrzh2rzldwdkdpkb6wbvpj8"
+                     else if stdenv.isLinux then "0wh5vvh8pk75fy37bm5av4xvp76slqyjhb6a0al55vw9rlg5q3xw"
                     else throw "unsupported platform";
    platformLdLibraryPath = if stdenv.isDarwin then "DYLD_FALLBACK_LIBRARY_PATH"
                     else if stdenv.isLinux then "LD_LIBRARY_PATH"
                     else throw "unsupported platform";
-    libraries = [ libunwind libuuid icu curl openssl lttng-ust ] ++ (if stdenv.isLinux then [ pam ] else []);
+                     libraries = [ libunwind libuuid icu curl openssl ] ++
+                       (if stdenv.isLinux then [ pam lttng-ust ] else [ darwin.Libsystem ]);
 in
 stdenv.mkDerivation rec {
  name = "powershell-${version}";
-  version = "6.1.0";
+  version = "6.1.1";

  src = fetchzip {
    url = "https://github.com/PowerShell/PowerShell/releases/download/v${version}/powershell-${version}-${platformString}-x64.tar.gz";
--- a/pkgs/tools/X11/imwheel/default.nix
+++ b/pkgs/tools/X11/imwheel/default.nix
@ -0,0 +1,25 @@
+{ stdenv, fetchurl, libX11, libXext, libXi, libXmu, libXt, libXtst }:
+
+stdenv.mkDerivation rec {
+  name = "imwheel-1.0.0pre12";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/imwheel/${name}.tar.gz";
+    sha256 = "2320ed019c95ca4d922968e1e1cbf0c075a914e865e3965d2bd694ca3d57cfe3";
+  };
+
+  buildInputs = [ libX11 libXext libXi libXmu libXt libXtst ];
+
+  postPatch = ''
+    substituteInPlace Makefile.in --replace "ETCDIR = " "ETCDIR = $out"
+    substituteInPlace util.c --replace "/etc/X11/imwheel" "$out/etc/X11/imwheel"
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "http://imwheel.sourceforge.net/";
+    description = "Mouse wheel configuration tool for XFree86/Xorg";
+    maintainers = with maintainers; [ jhillyerd ];
+    platforms = platforms.linux;
+    license = licenses.gpl2;
+  };
+}
--- a/pkgs/tools/X11/xidlehook/default.nix
+++ b/pkgs/tools/X11/xidlehook/default.nix
@ -1,9 +1,9 @@
 { lib, stdenv, rustPlatform, fetchFromGitLab
-, xlibsWrapper, xorg, libpulseaudio, pkgconfig, patchelf }:
+, xlibsWrapper, xorg, libpulseaudio, pkgconfig, patchelf, Security }:

 rustPlatform.buildRustPackage rec {
  name = "xidlehook-${version}";
-  version = "0.6.0";
+  version = "0.6.1";

  doCheck = false;

@ -12,13 +12,13 @@ rustPlatform.buildRustPackage rec {
    repo = "xidlehook";
    rev = version;

-    sha256 = "0rmc0g5cizyzwpk4yyh7bda70x9ybaivc6iw441k6abxmzbh358g";
+    sha256 = "04h6j66wif202x4kssagb66nnrz9m9ccs1d0dfh92955yix1ln23";
  };

  cargoBuildFlags = lib.optionals (!stdenv.isLinux) ["--no-default-features" "--features" "pulse"];
  cargoSha256 = "1pdhbqnkgwp2v5zyin8z8049aq8c3kfk04v9wsbz8qla34rgi99s";

-  buildInputs = [ xlibsWrapper xorg.libXScrnSaver libpulseaudio ];
+  buildInputs = [ xlibsWrapper xorg.libXScrnSaver libpulseaudio ] ++ lib.optional stdenv.isDarwin Security;
  nativeBuildInputs = [ pkgconfig patchelf ];

  postFixup = lib.optionalString stdenv.isLinux ''
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-table-chinese/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-table-chinese/default.nix
@ -0,0 +1,64 @@
+{ stdenv, fetchgit, fetchFromGitHub, pkgconfig,  ibus, ibus-table, python3, cmake }:
+
+let
+  src = fetchFromGitHub {
+    owner = "definite";
+    repo = "ibus-table-chinese";
+    rev = "f1f6a3384f021caa3b84c517e2495086f9c34507";
+    sha256 = "14wpw3pvyrrqvg7al37jk2dxqfj9r4zf88j8k2n2lmdc50f3xs7k";
+  };
+
+  cmakeFedoraSrc = fetchgit {
+    url = "https://pagure.io/cmake-fedora.git";
+    rev = "7d5297759aef4cd086bdfa30cf6d4b2ad9446992";
+    sha256 = "0mx9jvxpiva9v2ffaqlyny48iqr073h84yw8ln43z2avv11ipr7n";
+  };
+in stdenv.mkDerivation rec {
+  name = "ibus-table-chinese-${version}";
+  version = "1.8.2";
+
+  srcs = [ src cmakeFedoraSrc ];
+  sourceRoot = src.name;
+
+  postUnpack = ''
+    chmod u+w -R ${cmakeFedoraSrc.name}
+    mv ${cmakeFedoraSrc.name}/* source/cmake-fedora
+  '';
+
+  preConfigure = ''
+    # cmake script needs ./Modules folder to link to cmake-fedora
+    ln -s cmake-fedora/Modules ./
+  '';
+
+  # Fails when writing to /prj_info.cmake in https://pagure.io/cmake-fedora/blob/master/f/Modules/ManageVersion.cmake
+  cmakeFlags = [ "-DPRJ_INFO_CMAKE_FILE=/dev/null" "-DPRJ_DOC_DIR=REPLACE" "-DDATA_DIR=share" ];
+  # Must replace PRJ_DOC_DIR with actual share/ folder for ibus-table-chinese
+  # Otherwise it tries to write to /ibus-table-chinese if not defined (!)
+  postConfigure = ''
+    substituteInPlace cmake_install.cmake --replace '/build/source/REPLACE' $out/share/ibus-table-chinese
+  '';
+  # Fails otherwise with "no such file or directory: <table>.txt"
+  dontUseCmakeBuildDir = true;
+  # Fails otherwise sometimes with
+  # FileExistsError: [Errno 17] File exists: '/build/tmp.BfVAUM4llr/ibus-table-chinese/.local/share/ibus-table'
+  enableParallelBuilding = false;
+
+  preBuild = ''
+    export HOME=$(mktemp -d)/ibus-table-chinese
+  '';
+
+  postFixup = ''
+    rm -rf $HOME
+  '';
+
+  buildInputs = [ pkgconfig ibus ibus-table python3 cmake ];
+
+  meta = with stdenv.lib; {
+    isIbusEngine = true;
+    description  = "Chinese tables for IBus-Table";
+    homepage     = https://github.com/definite/ibus-table-chinese;
+    license      = licenses.gpl3;
+    platforms    = platforms.linux;
+    maintainers  = with maintainers; [ pneumaticat ];
+  };
+}
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-table/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-table/default.nix
@ -26,6 +26,7 @@ stdenv.mkDerivation rec {
        -e "/export IBUS_DATAROOTDIR=/ s/^.$//" \
        -e "/export IBUS_LOCALEDIR=/ s/^.$//" \
        -i "setup/ibus-setup-table.in"
+    substituteInPlace engine/tabcreatedb.py --replace '/usr/share/ibus-table' $out/share/ibus-table
  '';

  buildInputs = [
--- a/pkgs/tools/misc/direnv/default.nix
+++ b/pkgs/tools/misc/direnv/default.nix
@ -2,14 +2,14 @@

 buildGoPackage rec {
  name = "direnv-${version}";
-  version = "2.17.0";
+  version = "2.18.2";
  goPackagePath = "github.com/direnv/direnv";

  src = fetchFromGitHub {
    owner = "direnv";
    repo = "direnv";
    rev = "v${version}";
-    sha256 = "1dmanqpifx27cz41yc3ijpij0wrbgw9qny2d4n6jppfwf2qzyq4s";
+    sha256 = "011isxsc3byg8jd4jhi4pdfqrxa1acnzirhcv7lvw3jl0v7xnma8";
  };

  postConfigure = ''
--- a/pkgs/tools/misc/hyperfine/default.nix
+++ b/pkgs/tools/misc/hyperfine/default.nix
@ -4,16 +4,16 @@

 rustPlatform.buildRustPackage rec {
  name = "hyperfine-${version}";
-  version = "1.3.0";
+  version = "1.4.0";

  src = fetchFromGitHub {
    owner  = "sharkdp";
    repo   = "hyperfine";
    rev    = "refs/tags/v${version}";
-    sha256 = "06kghk3gmi47c8g28n8srpb578yym104fa30s4m33ajb60fvwlld";
+    sha256 = "1mn5nv3zljj2wz40imf62gknv84f7igslsf59gg1qvhgvgsd98sp";
  };

-  cargoSha256 = "1rwh8kyrkk5jza4lx7sf1pln68ljwsv4ccyfvzcvc140y7ya8ps0";
+  cargoSha256 = "1kyx1fhz8l5m8dhwd7j3hic86xx71216775m9bslmm2z4csl7r1s";

  buildInputs = stdenv.lib.optional stdenv.isDarwin Security;

--- a/pkgs/tools/misc/timidity/default.nix
+++ b/pkgs/tools/misc/timidity/default.nix
@ -1,11 +1,11 @@
 { stdenv, fetchurl, alsaLib, libjack2, ncurses, pkgconfig }:

 stdenv.mkDerivation {
-  name = "timidity-2.14.0";
+  name = "timidity-2.15.0";

  src = fetchurl {
-    url = mirror://sourceforge/timidity/TiMidity++-2.14.0.tar.bz2;
-    sha256 = "0xk41w4qbk23z1fvqdyfblbz10mmxsllw0svxzjw5sa9y11vczzr";
+    url = mirror://sourceforge/timidity/TiMidity++-2.15.0.tar.bz2;
+    sha256 = "1xf8n6dqzvi6nr2asags12ijbj1lwk1hgl3s27vm2szib8ww07qn";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/tools/misc/youtube-dl/default.nix
+++ b/pkgs/tools/misc/youtube-dl/default.nix
@ -19,11 +19,11 @@ buildPythonPackage rec {
  # The websites youtube-dl deals with are a very moving target. That means that
  # downloads break constantly. Because of that, updates should always be backported
  # to the latest stable release.
-  version = "2018.11.07";
+  version = "2018.11.18";

  src = fetchurl {
    url = "https://yt-dl.org/downloads/${version}/${pname}-${version}.tar.gz";
-    sha256 = "1rvc2m2kbm2kycqsa7fkcg5gql9f0w3hn1a7jg48zzl06ayggxk9";
+    sha256 = "1wvvwyvxg9aadgpbcz0p6nzqmvnxzlbsqja3j6487l41s1ky1fyq";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/tools/networking/kea/default.nix
+++ b/pkgs/tools/networking/kea/default.nix
@ -4,11 +4,11 @@
 stdenv.mkDerivation rec {
  name = "${pname}-${version}";
  pname = "kea";
-  version = "1.4.0";
+  version = "1.4.0-P1";

  src = fetchurl {
    url = "https://ftp.isc.org/isc/${pname}/${version}/${name}.tar.gz";
-    sha256 = "0a0inchisrjry59z14w4ha210q2ffl31gjbhp5dgrbap6swyry60";
+    sha256 = "0484h26ffdc1vmiznxllx69fax1lqi140wlsf5lx4wsab7a6nda6";
  };

  patches = [ ./dont-create-var.patch ];
--- a/pkgs/tools/networking/ssh-agents/default.nix
+++ b/pkgs/tools/networking/ssh-agents/default.nix
@ -0,0 +1,43 @@
+{ fetchFromGitHub
+, lib
+, stdenvNoCC
+}:
+
+stdenvNoCC.mkDerivation rec {
+  name = "ssh-agents-${version}";
+  version = "1.0.1";
+
+  src = fetchFromGitHub {
+    owner = "kalbasit";
+    repo = "ssh-agents";
+    rev = "v${version}";
+    sha256 = "1l09zy87033v7hd17lhkxikwikqz5nj9x6c2w80rqpad4lp9ihwz";
+  };
+
+  installFlags = [ "PREFIX=$(out)" ];
+
+  meta = with lib; {
+    description = "ssh-agents capable of spawning and maintaining multiple ssh-agents across terminals";
+    longDescription = ''
+      The SSH agent is usually spawned by running eval $(ssh-agent), however this
+      spawns a new SSH agent at every invocation. This project provides an
+      ssh-agent wrapper called ssh-agents that is capable of spawning an SSH
+      agent and caching the environment variables for later invocation.
+
+      Features
+      - One SSH agent across all terminals
+      - Add all un-encrypted SSH keys to the agent upon spawning. Please note
+        that encrypted SSH keys can only be added via ssh-add after having
+        started the agent.
+      - Ability to have different keys in different agents for security purposes.
+      - Multiple SSH agents
+      - To use multi-SSH agents, start ssh agent with the --name flag. The
+        given name is expected to be a folder under ~/.ssh/name containing the
+        keys to include in the agent.
+    '';
+    homepage = https://github.com/kalbasit/ssh-agents;
+    license = licenses.mit;
+    maintainers = with maintainers; [ kalbasit ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/tools/security/browserpass/default.nix
+++ b/pkgs/tools/security/browserpass/default.nix
@ -3,7 +3,7 @@

 buildGoPackage rec {
  name = "browserpass-${version}";
-  version = "2.0.18";
+  version = "2.0.22";

  goPackagePath = "github.com/dannyvankooten/browserpass";

@ -13,7 +13,7 @@ buildGoPackage rec {
    repo = "browserpass";
    owner = "dannyvankooten";
    rev = version;
-    sha256 = "0wszjpxfa0krr2zdx7a33vl1r86k74dpy5c940r6ww1zbgqzcibg";
+    sha256 = "05cacrx08k99c5zra7ksdik9xxn3vih3x6in7536zs5gm55mkbfx";
  };

  postPatch = ''
--- a/pkgs/tools/security/nsjail/default.nix
+++ b/pkgs/tools/security/nsjail/default.nix
@ -3,14 +3,14 @@

 stdenv.mkDerivation rec {
  name = "nsjail-${version}";
-  version = "2.7";
+  version = "2.8";

  src = fetchFromGitHub {
    owner           = "google";
    repo            = "nsjail";
    rev             = version;
    fetchSubmodules = true;
-    sha256          = "13s1bi2b80rlwrgls1bx4bk140qhncwdamm9q51jd677s0i3xg3s";
+    sha256          = "0cgycj0cz74plmz4asxryqprg6mkzpmnxzqbfsp1wwackinxq5fq";
  };

  nativeBuildInputs = [ autoconf bison flex libtool pkgconfig which ];
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -786,6 +786,8 @@ with pkgs;

  xcodeenv = callPackage ../development/mobile/xcodeenv { };

+  ssh-agents = callPackage ../tools/networking/ssh-agents { };
+
  titaniumenv = callPackage ../development/mobile/titaniumenv { };

  abootimg = callPackage ../development/mobile/abootimg {};
@ -1997,6 +1999,10 @@ with pkgs;
      inherit (gnome3) dconf;
    };

+    table-chinese = callPackage ../tools/inputmethods/ibus-engines/ibus-table-chinese {
+      ibus-table = ibus-engines.table;
+    };
+
    table-others = callPackage ../tools/inputmethods/ibus-engines/ibus-table-others {
      ibus-table = ibus-engines.table;
    };
@ -4370,7 +4376,11 @@ with pkgs;

  nextcloud = callPackage ../servers/nextcloud { };

-  nextcloud-client = libsForQt5.callPackage ../applications/networking/nextcloud-client { };
+  nextcloud-client-unwrapped = libsForQt5.callPackage ../applications/networking/nextcloud-client { };
+
+  nextcloud-client = callPackage ../applications/networking/nextcloud-client/wrapper.nix {
+    nextcloud-client = nextcloud-client-unwrapped;
+  };

  nextcloud-news-updater = callPackage ../servers/nextcloud/news-updater.nix { };

@ -6314,7 +6324,9 @@ with pkgs;

  xiccd = callPackage ../tools/misc/xiccd { };

-  xidlehook = callPackage ../tools/X11/xidlehook {};
+  xidlehook = callPackage ../tools/X11/xidlehook {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };

  xorriso = callPackage ../tools/cd-dvd/xorriso { };

@ -11285,7 +11297,9 @@ with pkgs;

  libxdg_basedir = callPackage ../development/libraries/libxdg-basedir { };

-  libxkbcommon = callPackage ../development/libraries/libxkbcommon { };
+  libxkbcommon = libxkbcommon_8;
+  libxkbcommon_8 = callPackage ../development/libraries/libxkbcommon { };
+  libxkbcommon_7 = callPackage ../development/libraries/libxkbcommon/libxkbcommon_7.nix { };

  libxklavier = callPackage ../development/libraries/libxklavier { };

@ -11687,20 +11701,11 @@ with pkgs;

  inherit (callPackages ../development/libraries/openssl {
      fetchurl = fetchurlBoot;
-      cryptodevHeaders = linuxPackages.cryptodev.override {
-        fetchurl = fetchurlBoot;
-        onlyHeaders = true;
-      };
    })
    openssl_1_0_2
    openssl_1_1;

-  openssl-chacha = callPackage ../development/libraries/openssl/chacha.nix {
-    cryptodevHeaders = linuxPackages.cryptodev.override {
-      fetchurl = fetchurlBoot;
-      onlyHeaders = true;
-    };
-  };
+  openssl-chacha = callPackage ../development/libraries/openssl/chacha.nix { };

  opensubdiv = callPackage ../development/libraries/opensubdiv {
    cudaSupport = config.cudaSupport or false;
@ -13354,7 +13359,9 @@ with pkgs;

  hiawatha = callPackage ../servers/http/hiawatha {};

-  home-assistant = callPackage ../servers/home-assistant { };
+  home-assistant = callPackage ../servers/home-assistant {
+    python = python36;
+  };

  hydron = callPackage ../servers/hydron { };

@ -13507,6 +13514,8 @@ with pkgs;

  pshs = callPackage ../servers/http/pshs { };

+  system-sendmail = lowPrio (callPackage ../servers/mail/system-sendmail { });
+
  # PulseAudio daemons

  pulseaudio = callPackage ../servers/pulseaudio {
@ -14628,6 +14637,8 @@ with pkgs;

  buildLinux = attrs: callPackage ../os-specific/linux/kernel/generic.nix attrs;

+  cryptodev = linuxPackages_4_9.cryptodev;
+
  dpdk = callPackage ../os-specific/linux/dpdk {
    kernel = null; # dpdk modules are in linuxPackages.dpdk.kmod
  };
@ -15922,6 +15933,7 @@ with pkgs;

  bitwig-studio1 =  callPackage ../applications/audio/bitwig-studio/bitwig-studio1.nix {
    inherit (gnome3) zenity;
+    libxkbcommon = libxkbcommon_7;
  };
  bitwig-studio2 =  callPackage ../applications/audio/bitwig-studio/bitwig-studio2.nix {
    inherit (gnome3) zenity;
@ -18548,6 +18560,8 @@ with pkgs;

  pommed_light = callPackage ../os-specific/linux/pommed-light {};

+  polymake = callPackage ../applications/science/math/polymake { };
+
  pond = callPackage ../applications/networking/instant-messengers/pond { };

  ponymix = callPackage ../applications/audio/ponymix { };
@ -20963,6 +20977,8 @@ with pkgs;

  hsetroot = callPackage ../tools/X11/hsetroot { };

+  imwheel = callPackage ../tools/X11/imwheel { };
+
  kakasi = callPackage ../tools/text/kakasi { };

  lumina = libsForQt5.callPackage ../desktops/lumina { };
@ -21009,6 +21025,8 @@ with pkgs;

  gnome-themes-extra = gnome3.gnome-themes-extra;

+  nordic = callPackage ../misc/themes/nordic { };
+
  numix-gtk-theme = callPackage ../misc/themes/numix { };

  numix-solarized-gtk-theme = callPackage ../misc/themes/numix-solarized { };
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -412,6 +412,8 @@ in {
    mpi = pkgs.openmpi;
  };

+  libmr = callPackage ../development/python-modules/libmr { };
+
  lmtpd = callPackage ../development/python-modules/lmtpd { };

  logster = callPackage ../development/python-modules/logster { };
@ -609,6 +611,8 @@ in {

  pystache = callPackage ../development/python-modules/pystache { };

+  pytesseract = callPackage ../development/python-modules/pytesseract { };
+
  pytest-tornado = callPackage ../development/python-modules/pytest-tornado { };

  python-binance = callPackage ../development/python-modules/python-binance { };
@ -1345,10 +1349,10 @@ in {

  pytest = self.pytest_39;

-  pytest_39 = callPackage ../development/python-modules/pytest {
+  inherit (callPackage ../development/python-modules/pytest {
    # hypothesis tests require pytest that causes dependency cycle
    hypothesis = self.hypothesis.override { doCheck = false; };
-  };
+  }) pytest_39 pytest_37;

  pytest-httpbin = callPackage ../development/python-modules/pytest-httpbin { };

@ -4991,6 +4995,10 @@ in {

  scour = callPackage ../development/python-modules/scour { };

+  pymssql = callPackage ../development/python-modules/pymssql { };
+
+  nanoleaf = callPackage ../development/python-modules/nanoleaf { };
+
 });

 in fix' (extends overrides packages)