Merge master into staging-next

2019-05-12 19:59:09 +02:00 · 2019-05-12 19:59:09 +02:00 · ef0dbef7f1
commit ef0dbef7f1
parent e8f4ad0169 e9b7e01828
118 changed files with 1983 additions and 1205 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -1747,6 +1747,11 @@
    github = "freepotion";
    name = "Free Potion";
  };
+  freezeboy = {
+    email = "freezeboy@users.noreply.github.com";
+    github = "freezeboy";
+    name = "freezeboy";
+  };
  Fresheyeball = {
    email = "fresheyeball@gmail.com";
    github = "fresheyeball";
@ -3208,6 +3213,11 @@
    github = "mimadrid";
    name = "Miguel Madrid";
  };
+  minijackson = {
+    email = "minijackson@riseup.net";
+    github = "minijackson";
+    name = "Rémi Nicole";
+  };
  mirdhyn = {
    email = "mirdhyn@gmail.com";
    github = "mirdhyn";
@ -3338,6 +3348,11 @@
    github = "fstamour";
    name = "Francis St-Amour";
  };
+  mredaelli = {
+    email = "massimo@typish.io";
+    github = "mredaelli";
+    name = "Massimo Redaelli";
+  };
  mrkkrp = {
    email = "markkarpov92@gmail.com";
    github = "mrkkrp";
@ -4474,6 +4489,11 @@
    github = "shawndellysse";
    name = "Shawn Dellysse";
  };
+  shazow = {
+    email = "andrey.petrov@shazow.net";
+    github = "shazow";
+    name = "Andrey Petrov";
+  };
  sheenobu = {
    email = "sheena.artrip@gmail.com";
    github = "sheenobu";
@ -4494,6 +4514,11 @@
    github = "shlevy";
    name = "Shea Levy";
  };
+  shmish111 = {
+    email = "shmish111@gmail.com";
+    github = "shmish111";
+    name = "David Smith";
+  };
  shou = {
    email = "x+g@shou.io";
    github = "Shou";
@ -4659,6 +4684,11 @@
    github = "srghma";
    name = "Sergei Khoma";
  };
+  srgom = {
+    email = "srgom@users.noreply.github.com";
+    github = "srgom";
+    name = "SRGOM";
+  };
  srhb = {
    email = "sbrofeldt@gmail.com";
    github = "srhb";
@ -4883,6 +4913,11 @@
    github = "terlar";
    name = "Terje Larsen";
  };
+  tesq0 = {
+    email = "mikolaj.galkowski@gmail.com";
+    github = "tesq0";
+    name = "Mikolaj Galkowski";
+  };
  teto = {
    email = "mcoudron@hotmail.com";
    github = "teto";
@ -5366,6 +5401,11 @@
    github = "xaverdh";
    name = "Dominik Xaver Hörl";
  };
+  xbreak = {
+    email = "xbreak@alphaware.se";
+    github = "xbreak";
+    name = "Calle Rosenquist";
+  };
  xeji = {
    email = "xeji@cat3.de";
    github = "xeji";
@ -5550,34 +5590,4 @@
    github = "zzamboni";
    name = "Diego Zamboni";
  };
-  mredaelli = {
-    email = "massimo@typish.io";
-    github = "mredaelli";
-    name = "Massimo Redaelli";
-  };
-  shmish111 = {
-    email = "shmish111@gmail.com";
-    github = "shmish111";
-    name = "David Smith";
-  };
-  minijackson = {
-    email = "minijackson@riseup.net";
-    github = "minijackson";
-    name = "Rémi Nicole";
-  };
-  shazow = {
-    email = "andrey.petrov@shazow.net";
-    github = "shazow";
-    name = "Andrey Petrov";
-  };
-  freezeboy = {
-    email = "freezeboy@users.noreply.github.com";
-    github = "freezeboy";
-    name = "freezeboy";
-  };
-  tesq0 = {
-  	email = "mikolaj.galkowski@gmail.com";
-    github = "tesq0";
-    name = "Mikolaj Galkowski";
-	};
 }
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@ -2,8 +2,10 @@
 ansicolors,
 argparse,
 basexx,
+binaryheap,
 dkjson
 fifo
+http
 inspect
 ldoc
 lgi
--- a/nixos/modules/config/malloc.nix
+++ b/nixos/modules/config/malloc.nix
@ -0,0 +1,91 @@
+{ config, lib, pkgs, ... }:
+with lib;
+
+let
+  cfg = config.environment.memoryAllocator;
+
+  # The set of alternative malloc(3) providers.
+  providers = {
+    "graphene-hardened" = rec {
+      libPath = "${pkgs.graphene-hardened-malloc}/lib/libhardened_malloc.so";
+      description = ''
+        An allocator designed to mitigate memory corruption attacks, such as
+        those caused by use-after-free bugs.
+      '';
+    };
+
+    "jemalloc" = {
+      libPath = "${pkgs.jemalloc}/lib/libjemalloc.so";
+      description = ''
+        A general purpose allocator that emphasizes fragmentation avoidance
+        and scalable concurrency support.
+      '';
+    };
+  };
+
+  providerConf = providers."${cfg.provider}";
+
+  # An output that contains only the shared library, to avoid
+  # needlessly bloating the system closure
+  mallocLib = pkgs.runCommand "malloc-provider-${cfg.provider}"
+    rec {
+      preferLocalBuild = true;
+      allowSubstitutes = false;
+      origLibPath = providerConf.libPath;
+      libName = baseNameOf origLibPath;
+    }
+    ''
+      mkdir -p $out/lib
+      cp -L $origLibPath $out/lib/$libName
+    '';
+
+  # The full path to the selected provider shlib.
+  providerLibPath = "${mallocLib}/lib/${mallocLib.libName}";
+in
+
+{
+  meta = {
+    maintainers = [ maintainers.joachifm ];
+  };
+
+  options = {
+    environment.memoryAllocator.provider = mkOption {
+      type = types.enum ([ "libc" ] ++ attrNames providers);
+      default = "libc";
+      description = ''
+        The system-wide memory allocator.
+        </para>
+
+        <para>
+        Briefly, the system-wide memory allocator providers are:
+        <itemizedlist>
+        <listitem><para><literal>libc</literal>: the standard allocator provided by libc</para></listitem>
+        ${toString (mapAttrsToList
+            (name: value: "<listitem><para><literal>${name}</literal>: ${value.description}</para></listitem>")
+            providers)}
+        </itemizedlist>
+        </para>
+
+        <warning>
+        <para>
+        Selecting an alternative allocator (i.e., anything other than
+        <literal>libc</literal>) may result in instability, data loss,
+        and/or service failure.
+        </para>
+        </warning>
+
+        <note>
+        <para>
+        Changing this option does not affect the current session.
+        </para>
+        </note>
+
+        <para>
+      '';
+    };
+  };
+
+  config = mkIf (cfg.provider != "libc") {
+    environment.variables.LD_PRELOAD = providerLibPath;
+  };
+}
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -19,6 +19,7 @@
  ./config/iproute2.nix
  ./config/krb5/default.nix
  ./config/ldap.nix
+  ./config/malloc.nix
  ./config/networking.nix
  ./config/no-x-libs.nix
  ./config/nsswitch.nix
--- a/nixos/modules/profiles/hardened.nix
+++ b/nixos/modules/profiles/hardened.nix
@ -14,6 +14,8 @@ with lib;

  nix.allowedUsers = mkDefault [ "@users" ];

+  environment.memoryAllocator.provider = mkDefault "graphene-hardened";
+
  security.hideProcessInformation = mkDefault true;

  security.lockKernelModules = mkDefault true;
--- a/nixos/modules/programs/xss-lock.nix
+++ b/nixos/modules/programs/xss-lock.nix
@ -8,12 +8,23 @@ in
 {
  options.programs.xss-lock = {
    enable = mkEnableOption "xss-lock";
+
    lockerCommand = mkOption {
      default = "${pkgs.i3lock}/bin/i3lock";
      example = literalExample ''''${pkgs.i3lock-fancy}/bin/i3lock-fancy'';
      type = types.string;
      description = "Locker to be used with xsslock";
    };
+
+    extraOptions = mkOption {
+      default = [ ];
+      example = [ "--ignore-sleep" ];
+      type = types.listOf types.str;
+      description = ''
+        Additional command-line arguments to pass to
+        <command>xss-lock</command>.
+      '';
+    };
  };

  config = mkIf cfg.enable {
@ -21,7 +32,13 @@ in
      description = "XSS Lock Daemon";
      wantedBy = [ "graphical-session.target" ];
      partOf = [ "graphical-session.target" ];
-      serviceConfig.ExecStart = "${pkgs.xss-lock}/bin/xss-lock ${cfg.lockerCommand}";
+      serviceConfig.ExecStart = with lib;
+        strings.concatStringsSep " " ([
+            "${pkgs.xss-lock}/bin/xss-lock"
+          ] ++ (map escapeShellArg cfg.extraOptions) ++ [
+            "--"
+            cfg.lockerCommand
+        ]);
    };
  };
 }
--- a/nixos/modules/security/apparmor.nix
+++ b/nixos/modules/security/apparmor.nix
@ -29,6 +29,8 @@ in
   config = mkIf cfg.enable {
     environment.systemPackages = [ pkgs.apparmor-utils ];

+     boot.kernelParams = [ "apparmor=1" "security=apparmor" ];
+
     systemd.services.apparmor = let
       paths = concatMapStrings (s: " -I ${s}/etc/apparmor.d")
         ([ pkgs.apparmor-profiles ] ++ cfg.packages);
--- a/nixos/modules/security/rngd.nix
+++ b/nixos/modules/security/rngd.nix
@ -42,6 +42,11 @@ in
      serviceConfig = {
        ExecStart = "${pkgs.rng-tools}/sbin/rngd -f"
          + optionalString cfg.debug " -d";
+        NoNewPrivileges = true;
+        PrivateNetwork = true;
+        PrivateTmp = true;
+        ProtectSystem = "full";
+        ProtectHome = true;
      };
    };
  };
--- a/nixos/tests/hardened.nix
+++ b/nixos/tests/hardened.nix
@ -27,9 +27,33 @@ import ./make-test.nix ({ pkgs, ...} : {
    };

  testScript =
+    let
+      hardened-malloc-tests = pkgs.stdenv.mkDerivation rec {
+        name = "hardened-malloc-tests-${pkgs.graphene-hardened-malloc.version}";
+        src = pkgs.graphene-hardened-malloc.src;
+        buildPhase = ''
+          cd test/simple-memory-corruption
+          make -j4
+        '';
+
+        installPhase = ''
+          find . -type f -executable -exec install -Dt $out/bin '{}' +
+        '';
+      };
+    in
    ''
      $machine->waitForUnit("multi-user.target");

+      subtest "apparmor-loaded", sub {
+          $machine->succeed("systemctl status apparmor.service");
+      };
+
+      # AppArmor securityfs
+      subtest "apparmor-securityfs", sub {
+          $machine->succeed("mountpoint -q /sys/kernel/security");
+          $machine->succeed("cat /sys/kernel/security/apparmor/profiles");
+      };
+
      # Test loading out-of-tree modules
      subtest "extra-module-packages", sub {
          $machine->succeed("grep -Fq wireguard /proc/modules");
@ -83,5 +107,18 @@ import ./make-test.nix ({ pkgs, ...} : {
        $machine->fail("systemctl hibernate");
        $machine->fail("systemctl kexec");
      };
+
+      # Test hardened memory allocator
+      sub runMallocTestProg {
+          my ($progName, $errorText) = @_;
+          my $text = "fatal allocator error: " . $errorText;
+          $machine->fail("${hardened-malloc-tests}/bin/" . $progName) =~ $text;
+      };
+
+      subtest "hardenedmalloc", sub {
+        runMallocTestProg("double_free_large", "invalid free");
+        runMallocTestProg("unaligned_free_small", "invalid unaligned free");
+        runMallocTestProg("write_after_free_small", "detected write after free");
+      };
    '';
 })
--- a/nixos/tests/xss-lock.nix
+++ b/nixos/tests/xss-lock.nix
@ -6,19 +6,35 @@ with lib;
  name = "xss-lock";
  meta.maintainers = with pkgs.stdenv.lib.maintainers; [ ma27 ];

-  machine = {
-    imports = [ ./common/x11.nix ./common/user-account.nix ];
-    programs.xss-lock.enable = true;
-    services.xserver.displayManager.auto.user = "alice";
+  nodes = {
+    simple = {
+      imports = [ ./common/x11.nix ./common/user-account.nix ];
+      programs.xss-lock.enable = true;
+      services.xserver.displayManager.auto.user = "alice";
+    };
+
+    custom_lockcmd = { pkgs, ... }: {
+      imports = [ ./common/x11.nix ./common/user-account.nix ];
+      services.xserver.displayManager.auto.user = "alice";
+
+      programs.xss-lock = {
+        enable = true;
+        extraOptions = [ "-n" "${pkgs.libnotify}/bin/notify-send 'About to sleep!'"];
+        lockerCommand = "${pkgs.xlockmore}/bin/xlock -mode ant";
+      };
+    };
  };

  testScript = ''
-    $machine->start;
-    $machine->waitForX;
-    $machine->waitForUnit("xss-lock.service", "alice");
+    startAll;

-    $machine->fail("pgrep xlock");
-    $machine->succeed("su -l alice -c 'xset dpms force standby'");
-    $machine->waitUntilSucceeds("pgrep i3lock");
+    ${concatStringsSep "\n" (mapAttrsToList (name: lockCmd: ''
+      ${"$"+name}->start;
+      ${"$"+name}->waitForX;
+      ${"$"+name}->waitForUnit("xss-lock.service", "alice");
+      ${"$"+name}->fail("pgrep ${lockCmd}");
+      ${"$"+name}->succeed("su -l alice -c 'xset dpms force standby'");
+      ${"$"+name}->waitUntilSucceeds("pgrep ${lockCmd}");
+    '') { simple = "i3lock"; custom_lockcmd = "xlock"; })}
  '';
 })
--- a/pkgs/applications/graphics/ipe/default.nix
+++ b/pkgs/applications/graphics/ipe/default.nix
@ -3,11 +3,11 @@
 }:

 stdenv.mkDerivation rec {
-  name = "ipe-7.2.11";
+  name = "ipe-7.2.12";

  src = fetchurl {
    url = "https://dl.bintray.com/otfried/generic/ipe/7.2/${name}-src.tar.gz";
-    sha256 = "09d71fdpiz359mcnb57460w2mcfizvlnidd6g1k4c3v6rglwlbd2";
+    sha256 = "1qw1cmwzi3wxk4x916i9y4prhi9brnwl14i9a1cbw23x1sr7i6kw";
  };

  sourceRoot = "${name}/src";
--- a/pkgs/applications/misc/calcurse/default.nix
+++ b/pkgs/applications/misc/calcurse/default.nix
@ -9,17 +9,13 @@ stdenv.mkDerivation rec {
    sha256 = "0vw2xi6a2lrhrb8n55zq9lv4mzxhby4xdf3hmi1vlfpyrpdwkjzd";
  };

-  buildInputs = [ ncurses gettext python3 ];
+  buildInputs = [ ncurses gettext python3 python3Packages.wrapPython ];
  nativeBuildInputs = [ makeWrapper ];

-  # Build Python environment with httplib2 for calcurse-caldav
-  pythonEnv = python3Packages.python.buildEnv.override {
-    extraLibs = [ python3Packages.httplib2 ];
-  };
-  propagatedBuildInputs = [ pythonEnv ];
-
  postInstall = ''
-    substituteInPlace $out/bin/calcurse-caldav --replace /usr/bin/python3 ${pythonEnv}/bin/python3
+    patchShebangs .
+    buildPythonPath ${python3Packages.httplib2}
+    patchPythonScript $out/bin/calcurse-caldav
  '';

  meta = with stdenv.lib; {
--- a/pkgs/applications/misc/electrum/default.nix
+++ b/pkgs/applications/misc/electrum/default.nix
@ -1,6 +1,8 @@
-{ stdenv, fetchFromGitHub, python3, python3Packages, zbar, secp256k1 }:
+{ stdenv, fetchurl, fetchFromGitHub, python3, python3Packages, zbar, secp256k1 }:

 let
+  version = "3.3.5";
+
  qdarkstyle = python3Packages.buildPythonPackage rec {
    pname = "QDarkStyle";
    version = "2.5.4";
@ -10,19 +12,35 @@ let
    };
    doCheck = false; # no tests
  };
+
+  # Not provided in official source releases, which are what upstream signs.
+  tests = fetchFromGitHub {
+    owner = "spesmilo";
+    repo = "electrum";
+    rev = version;
+    sha256 = "11rzzrv5xxqazcb7q1ig93d6cisqmd1x0jrgvfgzysbzvi51gg11";
+
+    extraPostFetch = ''
+      mv $out ./all
+      mv ./all/electrum/tests $out
+    '';
+  };
 in

 python3Packages.buildPythonApplication rec {
  pname = "electrum";
-  version = "3.3.4";
+  inherit version;

-  src = fetchFromGitHub {
-    owner = "spesmilo";
-    repo = "electrum";
-    rev = version;
-    sha256 = "0yxdpc602jnd14xz3px85ka0b6db98zwbgfi9a3vj8p1k3mmiwaj";
+  src = fetchurl {
+    url = "https://download.electrum.org/${version}/Electrum-${version}.tar.gz";
+    sha256 = "1csj0n96zlajnrs39wsazfj5lmy7v7n77cdz56lr8nkmchh6k9z1";
  };

+  postUnpack = ''
+    # can't symlink, tests get confused
+    cp -ar ${tests} $sourceRoot/electrum/tests
+  '';
+
  propagatedBuildInputs = with python3Packages; [
    aiorpcx
    aiohttp
@ -64,7 +82,10 @@ python3Packages.buildPythonApplication rec {
    rm -rf $out/${python3.sitePackages}/nix

    substituteInPlace $out/share/applications/electrum.desktop \
-      --replace "Exec=electrum %u" "Exec=$out/bin/electrum %u"
+      --replace 'Exec=sh -c "PATH=\"\\$HOME/.local/bin:\\$PATH\"; electrum %u"' \
+                "Exec=$out/bin/electrum %u" \
+      --replace 'Exec=sh -c "PATH=\"\\$HOME/.local/bin:\\$PATH\"; electrum --testnet %u"' \
+                "Exec=$out/bin/electrum --testnet %u"
  '';

  checkInputs = with python3Packages; [ pytest ];
--- a/pkgs/applications/misc/josm/default.nix
+++ b/pkgs/applications/misc/josm/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "josm-${version}";
-  version = "14945";
+  version = "15031";

  src = fetchurl {
    url = "https://josm.openstreetmap.de/download/josm-snapshot-${version}.jar";
-    sha256 = "0kdfdn0i7gjfkkllb93598ywf0qlllzsia5q14szc5b5assl8qpb";
+    sha256 = "19qw1s5v0dha329a7rfnhby0rq5d109b3f1ln2w1dfkmirbl75ir";
  };

  buildInputs = [ jdk11 makeWrapper ];
--- a/pkgs/applications/misc/moonlight-embedded/default.nix
+++ b/pkgs/applications/misc/moonlight-embedded/default.nix
@ -1,18 +1,18 @@
 { stdenv, fetchFromGitHub, cmake, perl
 , alsaLib, libevdev, libopus, udev, SDL2
 , ffmpeg, pkgconfig, xorg, libvdpau, libpulseaudio, libcec
-, curl, expat, avahi, enet, libuuid
+, curl, expat, avahi, enet, libuuid, libva
 }:

 stdenv.mkDerivation rec {
  name = "moonlight-embedded-${version}";
-  version = "2.4.7";
+  version = "2.4.9";

  src = fetchFromGitHub {
    owner = "irtimmer";
    repo = "moonlight-embedded";
    rev = "v${version}";
-    sha256 = "0ihgb0kh4rhbgn55s25rfbs8063zqvcyqn137jn3nsc0is1595a9";
+    sha256 = "1mzs0dr6bg57kjyxjh48hfmlsil7fvgqf9lhjzxxj3llvpxwws86";
    fetchSubmodules = true;
  };

@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
  buildInputs = [
    alsaLib libevdev libopus udev SDL2
    ffmpeg pkgconfig xorg.libxcb libvdpau libpulseaudio libcec
-    xorg.libpthreadstubs curl expat avahi enet libuuid
+    xorg.libpthreadstubs curl expat avahi enet libuuid libva
  ];

  meta = with stdenv.lib; {
--- a/pkgs/applications/networking/cluster/minikube/default.nix
+++ b/pkgs/applications/networking/cluster/minikube/default.nix
@ -14,9 +14,9 @@ let
 in buildGoPackage rec {
  pname   = "minikube";
  name    = "${pname}-${version}";
-  version = "1.0.0";
+  version = "1.0.1";

-  kubernetesVersion = "1.14.0";
+  kubernetesVersion = "1.14.1";

  goPackagePath = "k8s.io/minikube";

@ -24,7 +24,7 @@ in buildGoPackage rec {
    owner  = "kubernetes";
    repo   = "minikube";
    rev    = "v${version}";
-    sha256 = "170iy0h27gkz2hg485rnawdw069gxwgkwsjmfj5yag2kkgl7gxa3";
+    sha256 = "1fgyaq8789wc3h6xmn4iw6if2jxdv5my35yn6ipx3q6i4hagxl4b";
  };

  buildInputs = [ go-bindata makeWrapper gpgme ] ++ stdenv.lib.optional stdenv.hostPlatform.isDarwin vmnet;
--- a/pkgs/applications/networking/instant-messengers/riot/riot-desktop-package.json
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-desktop-package.json
@ -2,7 +2,7 @@
  "name": "riot-web",
  "productName": "Riot",
  "main": "src/electron-main.js",
-  "version": "1.0.8",
+  "version": "1.1.0",
  "description": "A feature-rich client for Matrix.org",
  "author": "New Vector Ltd.",
  "dependencies": {
--- a/pkgs/applications/networking/instant-messengers/riot/riot-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-desktop.nix
@ -7,12 +7,12 @@ with (import ./yarn2nix.nix { inherit pkgs; });

 let
  executableName = "riot-desktop";
-  version = "1.0.8";
+  version = "1.1.0";
  riot-web-src = fetchFromGitHub {
    owner = "vector-im";
    repo = "riot-web";
    rev = "v${version}";
-    sha256 = "1krp608wxff1siih8zknc425n0qb6qjzf854fnp7qyjp1cnfc9sb";
+    sha256 = "0h1rr70jg64v824k31mvb93nfssr572xlyicc8yh91bl7hdh342x";
  };

 in mkYarnPackage rec {
--- a/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
@ -6,11 +6,11 @@
 let configFile = writeText "riot-config.json" conf; in
 stdenv.mkDerivation rec {
  name= "riot-web-${version}";
-  version = "1.0.8";
+  version = "1.1.0";

  src = fetchurl {
    url = "https://github.com/vector-im/riot-web/releases/download/v${version}/riot-v${version}.tar.gz";
-    sha256 = "010m8b4lfnfi70d4v205wk3i4xhnsz7zkrdqrvw3si14xqy6192r";
+    sha256 = "14ap57hv1c5nh17771l39inpa5yacpyckzqcmjlbrb57illakwrd";
  };

  installPhase = ''
--- a/pkgs/applications/science/biology/minimap2/default.nix
+++ b/pkgs/applications/science/biology/minimap2/default.nix
@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
  name = "${pname}-${version}";
  pname = "minimap2";
-  version = "2.16";
+  version = "2.17";

  src = fetchFromGitHub {
    repo = pname;
    owner = "lh3";
    rev = "v${version}";
-    sha256 = "1ggm5psv3gwsz627ik9kl6ry9gzgmfsvya6ni0gv6ahwlrhdim73";
+    sha256 = "0qdwlkib3aa6112372hdgvnvk86hsjjkhjar0p53pq4ajrr2cdlb";
  };

  buildInputs = [ zlib ];
--- a/pkgs/applications/science/math/sage/sage-src.nix
+++ b/pkgs/applications/science/math/sage/sage-src.nix
@ -141,6 +141,14 @@ stdenv.mkDerivation rec {
      url = "https://git.sagemath.org/sage.git/patch/?h=8b7dbd0805d02d0e8674a272e161ceb24a637966";
      sha256 = "1c81f13z1w62s06yvp43gz6vkp8mxcs289n6l4gj9xj10slimzff";
    })
+
+    # https://trac.sagemath.org/ticket/26932
+    (fetchSageDiff {
+      name = "givaro-4.1.0_fflas-ffpack-2.4.0_linbox-1.6.0.patch";
+      base = "8.8.beta4";
+      rev = "c11d9cfa23ff9f77681a8f12742f68143eed4504";
+      sha256 = "0xzra7mbgqvahk9v45bjwir2mqz73hrhhy314jq5nxrb35ysdxyi";
+    })
  ];

  patches = nixPatches ++ bugfixPatches ++ packageUpgradePatches;
--- a/pkgs/applications/science/robotics/apmplanner2/default.nix
+++ b/pkgs/applications/science/robotics/apmplanner2/default.nix
@ -5,13 +5,13 @@

 stdenv.mkDerivation rec {
  name = "apmplanner2-${version}";
-  # TODO revert Qt59 to Qt5 in pkgs/top-level/all-packages.nix on next release
-  version = "2.0.26";
+  # TODO revert Qt511 to Qt5 in pkgs/top-level/all-packages.nix on next release
+  version = "2.0.27-rc1";
  src = fetchFromGitHub {
    owner = "ArduPilot";
    repo = "apm_planner";
    rev = "${version}";
-    sha256 = "0bnyi1r8k8ij5sq2zqv7mfbrxm0xdw97qrx3sk4rinqv2g6h6di4";
+    sha256 = "1k0786mjzi49nb6yw4chh9l4dmkf9gybpxg9zqkr5yg019nyzcvd";
  };

  qtInputs = [
--- a/pkgs/applications/window-managers/awesome/default.nix
+++ b/pkgs/applications/window-managers/awesome/default.nix
@ -6,8 +6,12 @@
 , libxkbcommon, xcbutilxrm, hicolor-icon-theme
 , asciidoctor
 , fontsConf
+, gtk3Support ? false, gtk3 ? null
 }:

+# needed for beautiful.gtk to work
+assert gtk3Support -> gtk3 != null;
+
 with luaPackages; stdenv.mkDerivation rec {
  name = "awesome-${version}";
  version = "4.3";
@ -42,7 +46,8 @@ with luaPackages; stdenv.mkDerivation rec {
                  xorg.libXau xorg.libXdmcp xorg.libxcb xorg.libxshmfence
                  xorg.xcbutil xorg.xcbutilimage xorg.xcbutilkeysyms
                  xorg.xcbutilrenderutil xorg.xcbutilwm libxkbcommon
-                  xcbutilxrm ];
+                  xcbutilxrm ]
+                  ++ stdenv.lib.optional gtk3Support gtk3;

  #cmakeFlags = "-DGENERATE_MANPAGES=ON";
  cmakeFlags = "-DOVERRIDE_VERSION=${version}";
@ -54,7 +59,7 @@ with luaPackages; stdenv.mkDerivation rec {
  LUA_PATH  = "${lgi}/share/lua/${lua.luaversion}/?.lua;;";

  postInstall = ''
-    # Don't use wrapProgram or or the wrapper will duplicate the --search
+    # Don't use wrapProgram or the wrapper will duplicate the --search
    # arguments every restart
    mv "$out/bin/awesome" "$out/bin/.awesome-wrapped"
    makeWrapper "$out/bin/.awesome-wrapped" "$out/bin/awesome" \
--- a/pkgs/build-support/fetchpatch/default.nix
+++ b/pkgs/build-support/fetchpatch/default.nix
@ -5,6 +5,10 @@
 # stripLen acts as the -p parameter when applying a patch.

 { lib, fetchurl, buildPackages }:
+let
+  # 0.3.4 would change hashes: https://github.com/NixOS/nixpkgs/issues/25154
+  patchutils = buildPackages.patchutils_0_3_3;
+in
 { stripLen ? 0, extraPrefix ? null, excludes ? [], includes ? [], revert ? false, ... }@args:

 fetchurl ({
@ -14,10 +18,10 @@ fetchurl ({
      echo "error: Fetched patch file '$out' is empty!" 1>&2
      exit 1
    fi
-    "${buildPackages.patchutils}/bin/lsdiff" "$out" \
+    "${patchutils}/bin/lsdiff" "$out" \
      | sort -u | sed -e 's/[*?]/\\&/g' \
      | xargs -I{} \
-        "${buildPackages.patchutils}/bin/filterdiff" \
+        "${patchutils}/bin/filterdiff" \
        --include={} \
        --strip=${toString stripLen} \
        ${lib.optionalString (extraPrefix != null) ''
@ -32,7 +36,7 @@ fetchurl ({
      cat "$out" 1>&2
      exit 1
    fi
-    ${buildPackages.patchutils}/bin/filterdiff \
+    ${patchutils}/bin/filterdiff \
      -p1 \
      ${builtins.toString (builtins.map (x: "-x ${lib.escapeShellArg x}") excludes)} \
      ${builtins.toString (builtins.map (x: "-i ${lib.escapeShellArg x}") includes)} \
@ -46,7 +50,7 @@ fetchurl ({
      exit 1
    fi
  '' + lib.optionalString revert ''
-    ${buildPackages.patchutils}/bin/interdiff "$out" /dev/null > "$tmpfile"
+    ${patchutils}/bin/interdiff "$out" /dev/null > "$tmpfile"
    mv "$tmpfile" "$out"
  '' + (args.postFetch or "");
  meta.broken = excludes != [] && includes != [];
--- a/pkgs/build-support/trivial-builders.nix
+++ b/pkgs/build-support/trivial-builders.nix
@ -79,7 +79,6 @@ rec {
        (test -n "$executable" && chmod +x "$n") || true
      '';

-
  /*
   * Writes a text file to nix store with no optional parameters available.
   *
@ -92,6 +91,7 @@ rec {
   *
  */
  writeText = name: text: writeTextFile {inherit name text;};
+
  /*
   * Writes a text file to nix store in a specific directory with no
   * optional parameters available. Name passed is the destination.
@ -105,6 +105,7 @@ rec {
   *
  */
  writeTextDir = name: text: writeTextFile {inherit name text; destination = "/${name}";};
+
  /*
   * Writes a text file to /nix/store/<store path> and marks the file as executable.
   *
@ -117,13 +118,14 @@ rec {
   *
  */
  writeScript = name: text: writeTextFile {inherit name text; executable = true;};
+
  /*
   * Writes a text file to /nix/store/<store path>/bin/<name> and
   * marks the file as executable.
   *
   * Example:
   * # Writes my-file to /nix/store/<store path>/bin/my-file and makes executable.
-   * writeScript "my-file"
+   * writeScriptBin "my-file"
   *   ''
   *   Contents of File
   *   '';
@ -132,12 +134,38 @@ rec {
  writeScriptBin = name: text: writeTextFile {inherit name text; executable = true; destination = "/bin/${name}";};

  /*
-   * Writes a Shell script and check its syntax. Automatically includes interpreter
-   * above the contents passed.
+   * Similar to writeScript. Writes a Shell script and checks its syntax.
+   * Automatically includes interpreter above the contents passed.
+   *
+   * Example:
+   * # Writes my-file to /nix/store/<store path>/my-file and makes executable.
+   * writeShellScript "my-file"
+   *   ''
+   *   Contents of File
+   *   '';
+   *
+  */
+  writeShellScript = name: text:
+    writeTextFile {
+      inherit name;
+      executable = true;
+      text = ''
+        #!${runtimeShell}
+        ${text}
+        '';
+      checkPhase = ''
+        ${stdenv.shell} -n $out
+      '';
+    };
+
+  /*
+   * Similar to writeShellScript and writeScriptBin.
+   * Writes an executable Shell script to /nix/store/<store path>/bin/<name> and checks its syntax.
+   * Automatically includes interpreter above the contents passed.
   *
   * Example:
   * # Writes my-file to /nix/store/<store path>/bin/my-file and makes executable.
-   * writeScript "my-file"
+   * writeShellScriptBin "my-file"
   *   ''
   *   Contents of File
   *   '';
--- a/pkgs/desktops/deepin/dde-polkit-agent/dde-polkit-agent.plugins-dir.patch
+++ b/pkgs/desktops/deepin/dde-polkit-agent/dde-polkit-agent.plugins-dir.patch
@ -0,0 +1,42 @@
+From 4f457d38e9e75bc97ee7dba633bf0cdd61b8cd5b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jos=C3=A9=20Romildo=20Malaquias?= <malaquias@gmail.com>
+Date: Fri, 19 Apr 2019 22:01:16 -0300
+Subject: [PATCH] Use an environment variable to find plugins
+
+---
+ pluginmanager.cpp | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/pluginmanager.cpp b/pluginmanager.cpp
+index 0c03237..79bdf86 100644
+--- a/pluginmanager.cpp
+++ b/pluginmanager.cpp
+@@ -34,13 +34,19 @@ QList<QButtonGroup*> PluginManager::reduceGetOptions(const QString &actionID)
+ void PluginManager::load()
+ {
+ 
+-    QDir dir("/usr/lib/polkit-1-dde/plugins/");
+-    QFileInfoList pluginFiles = dir.entryInfoList((QStringList("*.so")));
+    QStringList pluginsDirs = QProcessEnvironment::systemEnvironment().value("DDE_POLKIT_PLUGINS_DIRS").split(QDir::listSeparator(), QString::SkipEmptyParts);
+    pluginsDirs.append("/usr/lib/polkit-1-dde/plugins/");
+ 
+-    for (const QFileInfo &pluginFile : pluginFiles) {
+-       AgentExtension *plugin = loadFile(pluginFile.absoluteFilePath());
+-       if (plugin)
+-           m_plugins << plugin;
+    for (const QString &dirName : pluginsDirs) {
+        QDir dir(dirName);
+
+        QFileInfoList pluginFiles = dir.entryInfoList((QStringList("*.so")));
+
+        for (const QFileInfo &pluginFile : pluginFiles) {
+            AgentExtension *plugin = loadFile(pluginFile.absoluteFilePath());
+            if (plugin)
+                m_plugins << plugin;
+        }
+     }
+ }
+ 
+-- 
+2.21.0
+
--- a/pkgs/desktops/deepin/dde-polkit-agent/default.nix
+++ b/pkgs/desktops/deepin/dde-polkit-agent/default.nix
@ -27,6 +27,10 @@ stdenv.mkDerivation rec {
    polkit-qt
  ];

+  patches = [
+    ./dde-polkit-agent.plugins-dir.patch
+  ];
+
  postPatch = ''
    searchHardCodedPaths
    patchShebangs translate_generation.sh
--- a/pkgs/desktops/mate/mate-calc/default.nix
+++ b/pkgs/desktops/mate/mate-calc/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "mate-calc-${version}";
-  version = "1.22.0";
+  version = "1.22.1";

  src = fetchurl {
    url = "http://pub.mate-desktop.org/releases/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "1njk6v7z3969ikvcrabr1lw5f5572vb14w064zm3mydj8cc5inlr";
+    sha256 = "0zin3w03zrkpb12rvay23bfk9fnjpybkr5mqzkpn9xfnqamhk8ld";
  };

  nativeBuildInputs = [
--- a/pkgs/development/compilers/dmd/default.nix
+++ b/pkgs/development/compilers/dmd/default.nix
@ -103,8 +103,7 @@ stdenv.mkDerivation rec {

  checkPhase = ''
    cd dmd
-    # https://github.com/NixOS/nixpkgs/pull/55998#issuecomment-465871846
-    #make -j$NIX_BUILD_CORES -C test -f Makefile PIC=1 CC=$CXX DMD=${pathToDmd} BUILD=release SHELL=$SHELL
+    make -j$NIX_BUILD_CORES -C test -f Makefile PIC=1 CC=$CXX DMD=${pathToDmd} BUILD=release SHELL=$SHELL
    cd ../druntime
    make -j$NIX_BUILD_CORES -f posix.mak unittest PIC=1 DMD=${pathToDmd} BUILD=release
    cd ../phobos
--- a/pkgs/development/compilers/graalvm/default.nix
+++ b/pkgs/development/compilers/graalvm/default.nix
@ -270,7 +270,7 @@ in rec {
    '';
    dontFixup = true; # do not nuke path of ffmpeg etc
    dontStrip = true; # why? see in oraclejdk derivation
-    inherit (openjdk) meta;
+    meta = openjdk.meta // { inherit (graalvm8.meta) platforms; };
    inherit (openjdk) postFixup;
  };

--- a/pkgs/development/compilers/ldc/default.nix
+++ b/pkgs/development/compilers/ldc/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, cmake, ninja, llvm, llvm_8, curl, tzdata
+{ stdenv, fetchurl, cmake, ninja, llvm_5, llvm_8, curl, tzdata
 , python, libconfig, lit, gdb, unzip, darwin, bash
 , callPackage, makeWrapper, targetPackages
 , bootstrapVersion ? false
@ -83,7 +83,7 @@ stdenv.mkDerivation rec {
  ++ stdenv.lib.optional (!bootstrapVersion && stdenv.hostPlatform.isDarwin) [
    # https://github.com/NixOS/nixpkgs/issues/57120
    # https://github.com/NixOS/nixpkgs/pull/59197#issuecomment-481972515
-    llvm
+    llvm_5
  ]

  ++ stdenv.lib.optional (!bootstrapVersion && !stdenv.hostPlatform.isDarwin) [
@ -96,7 +96,7 @@ stdenv.mkDerivation rec {
  ]

  ++ stdenv.lib.optional (bootstrapVersion) [
-    libconfig llvm
+    libconfig llvm_5
  ]

  ++ stdenv.lib.optional stdenv.hostPlatform.isDarwin (with darwin.apple_sdk.frameworks; [
@ -150,7 +150,7 @@ stdenv.mkDerivation rec {
  else
    "";

-  doCheck = !bootstrapVersion && !stdenv.isDarwin;
+  doCheck = !bootstrapVersion;

  checkPhase = stdenv.lib.optionalString doCheck ''
    # Build default lib test runners
--- a/pkgs/development/haskell-modules/configuration-ghc-8.8.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-8.8.x.nix
@ -54,11 +54,12 @@ self: super: {
  hashable-time = doJailbreak super.hashable-time;
  integer-logarithms = doJailbreak super.integer-logarithms;
  lucid = doJailbreak super.lucid;
+  parallel = doJailbreak super.parallel;
  quickcheck-instances = doJailbreak super.quickcheck-instances;
  split = doJailbreak super.split;
  tasty-expected-failure = doJailbreak super.tasty-expected-failure;
  test-framework = doJailbreak super.test-framework;
-  th-lift = doJailbreak super.th-lift_0_8;
+  th-lift = self.th-lift_0_8_0_1;

  # These packages don't work and need patching and/or an update.
  primitive = overrideSrc (doJailbreak super.primitive) {
@ -93,7 +94,7 @@ self: super: {
    buildTools = with pkgs; [autoconf];
    preConfigure = "autoreconf --install";
  });
-  dlist = appendPatch super.dlist (pkgs.fetchpatch {
+  dlist = appendPatch (doJailbreak super.dlist) (pkgs.fetchpatch {
    url = "https://raw.githubusercontent.com/hvr/head.hackage/master/patches/dlist-0.8.0.6.patch";
    sha256 = "0lkhibfxfk6mi796mrjgmbb50hbyjgc7xdinci64dahj8325jlpc";
  });
@ -129,7 +130,7 @@ self: super: {
    url = "https://raw.githubusercontent.com/hvr/head.hackage/master/patches/haskell-src-exts-1.21.0.patch";
    sha256 = "0alb28hcsp774c9s73dgrajcb44vgv1xqfg2n5a9y2bpyngqscs3";
  });
-  optparse-applicative = appendPatch super.optparse-applicative (pkgs.fetchpatch {
+  optparse-applicative = appendPatch (doJailbreak super.optparse-applicative) (pkgs.fetchpatch {
    url = "https://raw.githubusercontent.com/hvr/head.hackage/master/patches/optparse-applicative-0.14.3.0.patch";
    sha256 = "068sjj98jqiq3h8h03mg4w2pa11q8lxkx2i4lmxivq77xyhlwq3y";
  });
@ -159,5 +160,9 @@ self: super: {
    url = "https://raw.githubusercontent.com/hvr/head.hackage/master/patches/attoparsec-0.13.2.2.patch";
    sha256 = "13i1p5g0xzxnv966nlyb77mfmxvg9jzbym1d36h1ajn045yf4igl";
  });
+  aeson = appendPatch super.aeson (pkgs.fetchpatch {
+    url = "https://raw.githubusercontent.com/hvr/head.hackage/master/patches/aeson-1.4.3.0.patch";
+    sha256 = "1z6wmsmc682qs3y768r0zx493dxardwbsp0wdc4dsx83c0m5x66f";
+  });

 }
--- a/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
@ -6849,7 +6849,6 @@ broken-packages:
  - median-stream
  - mediawiki
  - medium-sdk-haskell
-  - megaparsec-tests
  - mellon-core
  - mellon-gpio
  - mellon-web
--- a/pkgs/development/haskell-modules/hackage-packages.nix
+++ b/pkgs/development/haskell-modules/hackage-packages.nix
--- a/pkgs/development/interpreters/groovy/default.nix
+++ b/pkgs/development/interpreters/groovy/default.nix
@ -4,11 +4,11 @@

 stdenv.mkDerivation rec {
  name = "groovy-${version}";
-  version = "2.5.6";
+  version = "2.5.7";

  src = fetchurl {
    url = "http://dl.bintray.com/groovy/maven/apache-groovy-binary-${version}.zip";
-    sha256 = "14lfxnc03hmakwagvl3sb6c0b298v3awcdr1gafwnmsqv03hhkdn";
+    sha256 = "1q69xg7p790dfk09wyijpx8y85n8g9lfd0fikl6qr73k9zz5v41x";
  };

  buildInputs = [ unzip makeWrapper ];
--- a/pkgs/development/interpreters/janet/default.nix
+++ b/pkgs/development/interpreters/janet/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "janet";
-  version = "0.4.1";
+  version = "0.5.0";

  src = fetchFromGitHub {
    owner = "janet-lang";
    repo = "janet";
    rev = "v${version}";
-    sha256 = "06iq2y7c9i4pcmmgc8x2fklqkj2i3jrvmq694djiiyd4x81kzcj5";
+    sha256 = "00lrj21k85sqyn4hv2rc5sny9vxghafjxyvs0dq4zp68461s3l7c";
  };

  JANET_BUILD=''\"release\"'';
--- a/pkgs/development/libraries/cfitsio/default.nix
+++ b/pkgs/development/libraries/cfitsio/default.nix
@ -1,15 +1,23 @@
-{ fetchurl, stdenv }:
+{ fetchurl, stdenv

- stdenv.mkDerivation {
-  name = "cfitsio-3.430";
+# Optional dependencies
+, bzip2 ? null }:
+
+stdenv.mkDerivation rec {
+  name = "cfitsio-${version}";
+  version = "3.450";

  src = fetchurl {
-    url = "ftp://heasarc.gsfc.nasa.gov/software/fitsio/c/cfitsio3430.tar.gz";
-    sha256 = "07fghxh5fl8nqk3q0dh8rvc83npnm0hisxzcj16a6r7gj5pmp40l";
+    url = "https://heasarc.gsfc.nasa.gov/FTP/software/fitsio/c/cfitsio${builtins.replaceStrings ["."] [""] version}.tar.gz";
+    sha256 = "0bmrkw6w65zb0k3mszaaqy1f4zjm2hl7njww74nb5v38wvdi4q5z";
  };

+  buildInputs = [ bzip2 ];
+
  patches = [ ./darwin-curl-config.patch ./darwin-rpath-universal.patch ];

+  configureFlags = stdenv.lib.optional (bzip2 != null) "--with-bzip2=${bzip2.out}";
+
  # Shared-only build
  buildFlags = "shared";
  postPatch = '' sed -e '/^install:/s/libcfitsio.a //' -e 's@/bin/@@g' -i Makefile.in
@ -27,8 +35,8 @@
         advanced features for manipulating and filtering the information in
         FITS files.
      '';
-    # Permissive BSD-style license.
-    license = "permissive";
+    license = licenses.mit;
+    maintainers = [ maintainers.xbreak ];
    platforms = with platforms; linux ++ darwin;
  };
 }
--- a/pkgs/development/libraries/dav1d/default.nix
+++ b/pkgs/development/libraries/dav1d/default.nix
@ -2,14 +2,14 @@

 stdenv.mkDerivation rec {
  pname = "dav1d";
-  version = "0.3.0";
+  version = "0.3.1";

  src = fetchFromGitLab {
    domain = "code.videolan.org";
    owner = "videolan";
    repo = pname;
    rev = version;
-    sha256 = "08vysa3naqjfvld9w1k6l6hby4xfn4l2gvnfnan498g5nss4050h";
+    sha256 = "1m5vdg64iqxpi37l84mcfiq313g9z55zf66s85j2rqik6asmxbqg";
  };

  nativeBuildInputs = [ meson ninja nasm ];
--- a/pkgs/development/libraries/eccodes/default.nix
+++ b/pkgs/development/libraries/eccodes/default.nix
@ -6,11 +6,11 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
  name = "eccodes-${version}";
-  version = "2.12.0";
+  version = "2.12.5";

  src = fetchurl {
    url = "https://confluence.ecmwf.int/download/attachments/45757960/eccodes-${version}-Source.tar.gz";
-    sha256 = "0rqkx6p85b0v6zdkm4q2r516b7ldkxhkfc0cwkl24djlkv7fanpp";
+    sha256 = "0576fccng4nvmq5gma1nb1v00if5cwl81w4nv5zkb80q5wicn50c";
  };

  postPatch = ''
--- a/pkgs/development/libraries/fflas-ffpack/default.nix
+++ b/pkgs/development/libraries/fflas-ffpack/default.nix
@ -1,28 +1,18 @@
 { stdenv, fetchFromGitHub, autoreconfHook, givaro, pkgconfig, blas
-, fetchpatch
 , gmpxx
 }:
 stdenv.mkDerivation rec {
  name = "${pname}-${version}";
  pname = "fflas-ffpack";
-  version = "2.3.2";
+  version = "2.4.0";

  src = fetchFromGitHub {
    owner = "linbox-team";
    repo = "${pname}";
    rev = "v${version}";
-    sha256 = "1cqhassj2dny3gx0iywvmnpq8ca0d6m82xl5rz4mb8gaxr2kwddl";
+    sha256 = "1q1ala88ysz14pb5cn2kskv829nc1qif7zfzjwzhd5nnzwyivmc4";
  };

-  patches = [
-    # https://github.com/linbox-team/fflas-ffpack/issues/146
-    (fetchpatch {
-      name = "fix-flaky-test-fgemm-check.patch";
-      url = "https://github.com/linbox-team/fflas-ffpack/commit/d8cd67d91a9535417a5cb193cf1540ad6758a3db.patch";
-      sha256 = "1gnfc616fvnlr0smvz6lb2d445vn8fgv6vqcr6pwm3dj4wa6v3b3";
-    })
-  ];
-
  checkInputs = [
    gmpxx
  ];
--- a/pkgs/development/libraries/ffmpeg-full/default.nix
+++ b/pkgs/development/libraries/ffmpeg-full/default.nix
@ -97,8 +97,7 @@
 , libXv ? null # Xlib support
 , libXext ? null # Xlib support
 , lzma ? null # xz-utils
-, nvenc ? false, nvidia-video-sdk ? null, nv-codec-headers ? null # NVIDIA NVENC support
-, callPackage # needed for NVENC to access external ffmpeg nvidia headers
+, nvenc ? true, nv-codec-headers ? null # NVIDIA NVENC support
 , openal ? null # OpenAL 1.1 capture support
 #, opencl ? null # OpenCL code
 , opencore-amr ? null # AMR-NB de/encoder & AMR-WB decoder
@ -228,15 +227,14 @@ assert libxcbxfixesExtlib -> libxcb != null;
 assert libxcbshapeExtlib -> libxcb != null;
 assert openglExtlib -> libGLU_combined != null;
 assert opensslExtlib -> gnutls == null && openssl != null && nonfreeLicensing;
-assert nvenc -> nvidia-video-sdk != null && nonfreeLicensing;

 stdenv.mkDerivation rec {
  name = "ffmpeg-full-${version}";
-  version = "4.1.2";
+  version = "4.1.3";

  src = fetchurl {
    url = "https://www.ffmpeg.org/releases/ffmpeg-${version}.tar.xz";
-    sha256 = "0yrl6nij4b1pk1c4nbi80857dsd760gziiss2ls19awq8zj0lpxr";
+    sha256 = "0gdnprc7gk4b7ckq8wbxbrj7i00r76r9a5g9mj7iln40512j0c0c";
  };

  prePatch = ''
@ -418,13 +416,13 @@ stdenv.mkDerivation rec {
    ++ optional ((isLinux || isFreeBSD) && libva != null) libva
    ++ optionals isLinux [ alsaLib libraw1394 libv4l ]
    ++ optional (isLinux && libmfx != null) libmfx
-    ++ optionals nvenc [ nvidia-video-sdk nv-codec-headers ]
+    ++ optional nvenc nv-codec-headers
    ++ optionals stdenv.isDarwin [ Cocoa CoreServices CoreAudio AVFoundation
                                   MediaToolbox VideoDecodeAcceleration
                                   libiconv cf-private /* For _OBJC_EHTYPE_$_NSException */ ];

-  # Build qt-faststart executable
-  buildPhase = optional qtFaststartProgram ''make tools/qt-faststart'';
+  buildFlags = [ "all" ]
+    ++ optional qtFaststartProgram "tools/qt-faststart"; # Build qt-faststart executable

  # Hacky framework patching technique borrowed from the phantomjs2 package
  postInstall = optionalString qtFaststartProgram ''
--- a/pkgs/development/libraries/ffmpeg/4.nix
+++ b/pkgs/development/libraries/ffmpeg/4.nix
@ -6,7 +6,7 @@

 callPackage ./generic.nix (args // rec {
  version = "${branch}";
-  branch = "4.1.2";
-  sha256 = "00yzwc2g97h8ws0haz1p0ahaavhgrbha6xjdc53a5vyfy3zyy3i0";
+  branch = "4.1.3";
+  sha256 = "0aka5pibjhpks1wrsvqpy98v8cbvyvnngwqhh4ajkg6pbdl7k9i9";
  darwinFrameworks = [ Cocoa CoreMedia VideoToolbox ];
 })
--- a/pkgs/development/libraries/givaro/default.nix
+++ b/pkgs/development/libraries/givaro/default.nix
@ -2,12 +2,12 @@
 stdenv.mkDerivation rec {
  name = "${pname}-${version}";
  pname = "givaro";
-  version = "4.0.4";
+  version = "4.1.0";
  src = fetchFromGitHub {
    owner = "linbox-team";
    repo = "${pname}";
    rev = "v${version}";
-    sha256 = "199p8wyj5i63jbnk7j8qbdbfp5rm2lpmcxyk3mdjy9bz7ygx3hhy";
+    sha256 = "1l1172c964hni66mjdmhr7766l5k7y63zs3hgcpr10a8f1nx3iwp";
  };

  enableParallelBuilding = true;
--- a/pkgs/development/libraries/hyperscan/default.nix
+++ b/pkgs/development/libraries/hyperscan/default.nix
@ -1,5 +1,7 @@
-{ lib, stdenv, fetchFromGitHub, cmake, ragel, python27
+{ stdenv, fetchFromGitHub, cmake, ragel, python3
+, coreutils, gnused, utillinux
 , boost
+, withStatic ? false # build only shared libs by default, build static+shared if true
 }:

 # NOTICE: pkgconfig, pcap and pcre intentionally omitted from build inputs
@ -8,45 +10,41 @@
 #         I not see any reason (for now) to backport 8.41.

 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
  pname = "hyperscan";
-  version = "5.1.0";
+  version = "5.1.1";

  src = fetchFromGitHub {
    owner = "intel";
-    repo = "hyperscan";
-    sha256 = "0r2c7s7alnq14yhbfhpkq6m28a3pyfqd427115k0754afxi82vbq";
+    repo = pname;
+    sha256 = "11adkz5ln2d2jywwlmixfnwqp5wxskq1104hmmcpws590lhkjv6j";
    rev = "v${version}";
  };

  outputs = [ "out" "dev" ];

  buildInputs = [ boost ];
-  nativeBuildInputs = [ cmake ragel python27 ];
+  nativeBuildInputs = [
+    cmake ragel python3
+    # Consider simply using busybox for these
+    # Need at least: rev, sed, cut, nm
+    coreutils gnused utillinux
+  ];

  cmakeFlags = [
    "-DFAT_RUNTIME=ON"
    "-DBUILD_AVX512=ON"
-    "-DBUILD_STATIC_AND_SHARED=ON"
-  ];
+  ]
+  ++ stdenv.lib.optional (withStatic) "-DBUILD_STATIC_AND_SHARED=ON"
+  ++ stdenv.lib.optional (!withStatic) "-DBUILD_SHARED_LIBS=ON";

-  prePatch = ''
+  postPatch = ''
    sed -i '/examples/d' CMakeLists.txt
+    substituteInPlace libhs.pc.in \
+      --replace "libdir=@CMAKE_INSTALL_PREFIX@/@CMAKE_INSTALL_LIBDIR@" "libdir=@CMAKE_INSTALL_LIBDIR@" \
+      --replace "includedir=@CMAKE_INSTALL_PREFIX@/@CMAKE_INSTALL_INCLUDEDIR@" "includedir=@CMAKE_INSTALL_INCLUDEDIR@"
  '';

-  postInstall = ''
-    mkdir -p $dev/lib
-    mv $out/lib/*.a $dev/lib/
-    ln -sf $out/lib/libhs.so $dev/lib/
-    ln -sf $out/lib/libhs_runtime.so $dev/lib/
-  '';
-
-  postFixup = ''
-    sed -i "s,$out/include,$dev/include," $dev/lib/pkgconfig/libhs.pc
-    sed -i "s,$out/lib,$dev/lib," $dev/lib/pkgconfig/libhs.pc
-  '';
-
-  meta = {
+  meta = with stdenv.lib; {
    description = "High-performance multiple regex matching library";
    longDescription = ''
      Hyperscan is a high-performance multiple regex matching library.
@ -61,9 +59,9 @@ stdenv.mkDerivation rec {
      Hyperscan is typically used in a DPI library stack.
    '';

-    homepage = https://www.hyperscan.io/;
-    maintainers = with lib.maintainers; [ avnik ];
-    platforms = [ "x86_64-linux" "x86_64-darwin" ];
-    license = lib.licenses.bsd3;
+    homepage = "https://www.hyperscan.io/";
+    maintainers = with maintainers; [ avnik ];
+    platforms = [ "x86_64-linux" ]; # can't find nm on darwin ; might build on aarch64 but untested
+    license = licenses.bsd3;
  };
 }
--- a/pkgs/development/libraries/leptonica/default.nix
+++ b/pkgs/development/libraries/leptonica/default.nix
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
  enableParallelBuilding = true;

  checkInputs = [ which gnuplot ];
-  doCheck = true;
+  doCheck = !stdenv.isDarwin;

  meta = {
    description = "Image processing and analysis library";
--- a/pkgs/development/libraries/libnsl/cdefs.patch
+++ b/pkgs/development/libraries/libnsl/cdefs.patch
@ -1,30 +0,0 @@
--- a/src/rpcsvc/nislib.h
-+++ b/src/rpcsvc/nislib.h
-@@ -19,6 +19,7 @@
- #ifndef	__RPCSVC_NISLIB_H__
- #define	__RPCSVC_NISLIB_H__
- 
-+#include <sys/cdefs.h>
- #include <features.h>
- 
- __BEGIN_DECLS
--- a/src/rpcsvc/ypclnt.h
-+++ b/src/rpcsvc/ypclnt.h
-@@ -20,6 +20,7 @@
- #ifndef	__RPCSVC_YPCLNT_H__
- #define	__RPCSVC_YPCLNT_H__
- 
-+#include <sys/cdefs.h>
- #include <features.h>
- 
- /* Some defines */
--- a/src/rpcsvc/ypupd.h
-+++ b/src/rpcsvc/ypupd.h
-@@ -33,6 +33,7 @@
- #ifndef __RPCSVC_YPUPD_H__
- #define __RPCSVC_YPUPD_H__
- 
-+#include <sys/cdefs.h>
- #include <features.h>
- 
- #include <rpc/rpc.h>
--- a/pkgs/development/libraries/libnsl/default.nix
+++ b/pkgs/development/libraries/libnsl/default.nix
@ -1,21 +1,19 @@
 { stdenv, fetchFromGitHub, autoreconfHook, libtirpc, pkgconfig }:

 stdenv.mkDerivation rec {
-  name = "libnsl-${version}";
-  version = "1.1.0";
+  pname = "libnsl";
+  version = "1.2.0";

  src = fetchFromGitHub {
    owner = "thkukuk";
-    repo = "libnsl";
-    rev = "libnsl-${version}";
-    sha256 = "0h8br0gmgw3fp5fmy6bfbj1qlk9hry1ssg25ssjgxbd8spczpscs";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1chzqhcgh0yia9js8mh92cmhyka7rh32ql6b3mgdk26n94dqzs8b";
  };

  nativeBuildInputs = [ autoreconfHook pkgconfig ];
  buildInputs = [ libtirpc ];

-  patches = stdenv.lib.optionals stdenv.hostPlatform.isMusl [ ./cdefs.patch ./nis_h.patch ];
-
  meta = with stdenv.lib; {
    description = "Client interface library for NIS(YP) and NIS+";
    homepage = https://github.com/thkukuk/libnsl;
--- a/pkgs/development/libraries/libnsl/nis_h.patch
+++ b/pkgs/development/libraries/libnsl/nis_h.patch
@ -1,45 +0,0 @@
--- a/src/rpcsvc/nis.h
-+++ b/src/rpcsvc/nis.h
-@@ -32,6 +32,7 @@
- #ifndef _RPCSVC_NIS_H
- #define _RPCSVC_NIS_H 1
- 
-+#include <sys/cdefs.h>
- #include <features.h>
- #include <rpc/rpc.h>
- #include <rpcsvc/nis_tags.h>
-@@ -56,6 +57,34 @@
-  *                                              <kukuk@suse.de>
-  */
- 
-+#ifndef rawmemchr
-+#define rawmemchr(s,c) memchr((s),(size_t)-1,(c))
-+#endif
-+
-+#ifndef __asprintf
-+#define __asprintf asprintf
-+#endif
-+
-+#ifndef __mempcpy
-+#define __mempcpy mempcpy
-+#endif
-+
-+#ifndef __strtok_r
-+#define __strtok_r strtok_r
-+#endif
-+
-+#ifndef __always_inline
-+#define __always_inline __attribute__((__always_inline__))
-+#endif
-+
-+#ifndef TEMP_FAILURE_RETRY
-+#define TEMP_FAILURE_RETRY(exp) ({ \
-+typeof (exp) _rc; \
-+ do { \
-+  _rc = (exp); \
-+ } while (_rc == -1 && errno == EINTR); \
-+ _rc; })
-+#endif
- 
- #ifndef __nis_object_h
- #define __nis_object_h
--- a/pkgs/development/libraries/libxmlb/default.nix
+++ b/pkgs/development/libraries/libxmlb/default.nix
@ -2,7 +2,7 @@

 stdenv.mkDerivation rec {
  name = "libxmlb-${version}";
-  version = "0.1.8";
+  version = "0.1.9";

  outputs = [ "out" "lib" "dev" "devdoc" ];

@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
    owner = "hughsie";
    repo = "libxmlb";
    rev = version;
-    sha256 = "0nry2a4vskfklykd20smp4maqpzibc65rzyv4i71nrc55dyjpy7x";
+    sha256 = "1rdpsssrwpx24snqb82hisjybnpz9fq91wbmxfi2s63xllzi14b6";
  };

  nativeBuildInputs = [ meson ninja python3 pkgconfig gobject-introspection gtk-doc shared-mime-info docbook_xsl docbook_xml_dtd_43 ];
@ -33,6 +33,6 @@ stdenv.mkDerivation rec {
    homepage = https://github.com/hughsie/libxmlb;
    license = licenses.lgpl21Plus;
    maintainers = with maintainers; [ jtojnar ];
-    platforms = platforms.unix;
+    platforms = platforms.linux;
  };
 }
--- a/pkgs/development/libraries/linbox/default.nix
+++ b/pkgs/development/libraries/linbox/default.nix
@ -12,13 +12,13 @@
 stdenv.mkDerivation rec {
  name = "${pname}-${version}";
  pname = "linbox";
-  version = "1.5.2";
+  version = "1.6.0";

  src = fetchFromGitHub {
    owner = "linbox-team";
    repo = "${pname}";
    rev = "v${version}";
-    sha256 = "1wfivlwp30mzdy1697w7rzb8caajim50mc8h27k82yipn2qc5n4i";
+    sha256 = "0rmk474hvgkggmhxwa5i52wdnbvipx9n8mpsc41j1c96q4v8fl22";
  };

  nativeBuildInputs = [
@ -51,16 +51,6 @@ stdenv.mkDerivation rec {
    "--enable-sage"
  ];

-  patches = stdenv.lib.optionals withSage [
-    # https://trac.sagemath.org/ticket/24214#comment:39
-    # Will be resolved by
-    # https://github.com/linbox-team/linbox/issues/69
-    (fetchpatch {
-      url = "https://raw.githubusercontent.com/sagemath/sage/a843f48b7a4267e44895a3dfa892c89c85b85611/build/pkgs/linbox/patches/linbox_charpoly_fullCRA.patch";
-      sha256 = "16nxfzfknra3k2yk3xy0k8cq9rmnmsch3dnkb03kx15h0y0jmibk";
-    })
-  ];
-
  doCheck = true;

  enableParallelBuilding = true;
--- a/pkgs/development/libraries/nv-codec-headers/default.nix
+++ b/pkgs/development/libraries/nv-codec-headers/default.nix
@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
  meta = {
    description = "FFmpeg version of headers for NVENC";
    homepage = http://ffmpeg.org/;
-    license = stdenv.lib.licenses.gpl3Plus;
+    license = stdenv.lib.licenses.mit;
    maintainers = [ stdenv.lib.maintainers.MP2E ];
    platforms = stdenv.lib.platforms.all;
  };
--- a/pkgs/development/libraries/qscintilla/default.nix
+++ b/pkgs/development/libraries/qscintilla/default.nix
@ -20,8 +20,10 @@ stdenv.mkDerivation rec {
    sha256 = "04678skipydx68zf52vznsfmll2v9aahr66g50lcqbr6xsmgr1yi";
  };

-  buildInputs = [ (if withQt5 then qtbase else qt4) ]
-    ++ lib.optional (withQt5 && stdenv.isDarwin) qtmacextras;
+  buildInputs = [ (if withQt5 then qtbase else qt4) ];
+
+  propagatedBuildInputs = lib.optional (withQt5 && stdenv.isDarwin) qtmacextras;
+
  nativeBuildInputs = [ unzip ]
    ++ (if withQt5 then [ qmake ] else [ qmake4Hook ])
    ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@ -76,6 +76,26 @@ basexx = buildLuarocksPackage {
    };
  };
 };
+binaryheap = buildLuarocksPackage {
+  pname = "binaryheap";
+  version = "0.4-1";
+
+  src = fetchurl {
+      url    = https://luarocks.org/binaryheap-0.4-1.src.rock;
+      sha256 = "11rd8r3bpinfla2965jgjdv1hilqdc1q6g1qla5978d7vzg19kpc";
+  };
+  disabled = ( luaOlder "5.1");
+  propagatedBuildInputs = [ lua ];  
+  buildType = "builtin";
+
+  meta = {
+    homepage = "https://github.com/Tieske/binaryheap.lua";
+    description="Binary heap implementation in pure Lua";
+    license = {
+      fullName = "MIT/X11";
+    };
+  };
+};
 dkjson = buildLuarocksPackage {
  pname = "dkjson";
  version = "2.5-2";
@ -116,6 +136,26 @@ fifo = buildLuarocksPackage {
    };
  };
 };
+http = buildLuarocksPackage {
+  pname = "http";
+  version = "0.3-0";
+
+  src = fetchurl {
+      url    = https://luarocks.org/http-0.3-0.src.rock;
+      sha256 = "0vvl687bh3cvjjwbyp9cphqqccm3slv4g7y3h03scp3vpq9q4ccq";
+  };
+  disabled = ( luaOlder "5.1");
+  propagatedBuildInputs = [ lua compat53 bit32 cqueues luaossl basexx lpeg lpeg_patterns binaryheap fifo ];  
+  buildType = "builtin";
+
+  meta = {
+    homepage = "https://github.com/daurnimator/lua-http";
+    description="HTTP library for Lua";
+    license = {
+      fullName = "MIT";
+    };
+  };
+};
 inspect = buildLuarocksPackage {
  pname = "inspect";
  version = "3.1.1-0";
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@ -56,7 +56,7 @@ with super;
    '';
  });

-  luuid = super.luuid.override({
+  luuid = super.luuid.override(oa: {
    buildInputs = [ pkgs.libuuid ];
    extraConfig = ''
      variables = {
@ -64,7 +64,7 @@ with super;
        LIBUUID_LIBDIR="${pkgs.lib.getLib pkgs.libuuid}/lib";
      }
    '';
-    meta = {
+    meta = oa.meta // {
      platforms = pkgs.lib.platforms.linux;
    };
  });
@ -75,4 +75,27 @@ with super;
      sed -i '/set(CMAKE_C_FLAGS/d' CMakeLists.txt
    '';
  });
- }
+
+  binaryheap = super.binaryheap.overrideAttrs(oa: {
+    meta = oa.meta // {
+      maintainers = with pkgs.lib.maintainers; oa.meta.maintainers ++ [ vcunat ];
+    };
+  });
+
+  http = super.http.overrideAttrs(oa: {
+    patches = oa.patches or [] ++ [
+      (pkgs.fetchpatch {
+        name = "invalid-state-progression.patch";
+        url = "https://github.com/daurnimator/lua-http/commit/cb7b59474a.diff";
+        sha256 = "1vmx039n3nqfx50faqhs3wgiw28ws416rhw6vh6srmh9i826dac7";
+      })
+    ];
+    /* TODO: separate docs derivation? (pandoc is heavy)
+    nativeBuildInputs = [ pandoc ];
+    makeFlags = [ "-C doc" "lua-http.html" "lua-http.3" ];
+    */
+    meta = oa.meta // {
+      maintainers = with pkgs.lib.maintainers; oa.meta.maintainers ++ [ vcunat ];
+    };
+  });
+}
--- a/pkgs/development/ocaml-modules/cairo2/default.nix
+++ b/pkgs/development/ocaml-modules/cairo2/default.nix
@ -4,11 +4,11 @@

 buildDunePackage rec {
  pname = "cairo2";
-  version = "0.6";
+  version = "0.6.1";

  src = fetchurl {
    url = "https://github.com/Chris00/ocaml-cairo/releases/download/${version}/cairo2-${version}.tbz";
-    sha256 = "1k2q7ipmddqnd2clybj4qb5xwzzrnl2fxnd6kv60dlzgya18lchs";
+    sha256 = "1ik4qf4b9443sliq2z7x9acd40rmzvyzjh3bh98wvjklxbb84a9i";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/development/ocaml-modules/elpi/default.nix
+++ b/pkgs/development/ocaml-modules/elpi/default.nix
@ -2,14 +2,18 @@
 , ppx_tools_versioned, ppx_deriving, re
 }:

+if !stdenv.lib.versionAtLeast ocaml.version "4.03"
+then throw "elpi is not available for OCaml ${ocaml.version}"
+else
+
 stdenv.mkDerivation rec {
  name = "ocaml${ocaml.version}-elpi-${version}";
-  version = "1.1.0";
+  version = "1.2.0";
  src = fetchFromGitHub {
    owner = "LPCIC";
    repo = "elpi";
    rev = "v${version}";
-    sha256 = "1fd4mqggdcnbhqwrg8r0ikb1j2lv0fc9hv9xfbyjzbzxbjggf5zc";
+    sha256 = "1n4jpidx0vk4y66bhd704ajn8n6f1fd5wsi1shj6wijfmjl14h7s";
  };

  buildInputs = [ ocaml findlib ppx_tools_versioned ];
--- a/pkgs/development/ocaml-modules/lablgtk3/default.nix
+++ b/pkgs/development/ocaml-modules/lablgtk3/default.nix
@ -1,16 +1,14 @@
-{ lib, fetchFromGitHub, pkgconfig, buildDunePackage, gtk3, cairo2 }:
+{ lib, fetchurl, pkgconfig, buildDunePackage, gtk3, cairo2 }:

 buildDunePackage rec {
-  version = "3.0.beta5";
+  version = "3.0.beta6";
  pname = "lablgtk3";

  minimumOCamlVersion = "4.05";

-  src = fetchFromGitHub {
-    owner = "garrigue";
-    repo = "lablgtk";
-    rev = version;
-    sha256 = "05n3pjy4496gbgxwbypfm2462njv6dgmvkcv26az53ianpwa4vzz";
+  src = fetchurl {
+    url = "https://github.com/garrigue/lablgtk/releases/download/${version}/lablgtk3-${version}.tbz";
+    sha256 = "1jni5cbp54qs7y0dc5zkm28v2brpfwy5miighv7cy0nmmxrsq520";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/development/python-modules/aiorpcx/default.nix
+++ b/pkgs/development/python-modules/aiorpcx/default.nix
@ -2,12 +2,12 @@

 buildPythonPackage rec {
  pname = "aiorpcx";
-  version = "0.10.5";
+  version = "0.17.0";

  src = fetchPypi {
    inherit version;
    pname = "aiorpcX";
-    sha256 = "0c4kan020s09ap5qai7p1syxjz2wk6g9ydhxj6fc35s4103x7b91";
+    sha256 = "14np5r75rs0v45vsv20vbzmnv3qisvm9mdllj1j9s1633cvcik0k";
  };

  propagatedBuildInputs = [ attrs ];
--- a/pkgs/development/python-modules/asgiref/default.nix
+++ b/pkgs/development/python-modules/asgiref/default.nix
@ -1,6 +1,6 @@
 { stdenv, buildPythonPackage, pythonOlder, fetchFromGitHub, async-timeout, pytest, pytest-asyncio }:
 buildPythonPackage rec {
-  version = "2.3.2";
+  version = "3.1.2";
  pname = "asgiref";

  disabled = pythonOlder "3.5";
@ -10,7 +10,7 @@ buildPythonPackage rec {
    owner = "django";
    repo = pname;
    rev = version;
-    sha256 = "1ljymmcscyp3bz33kjbhf99k04fbama87vg4069gbgj6lnxjpzav";
+    sha256 = "1y32ys1q07nyri0b053mx24qvkw305iwvqvqgi2fdhx0va8d7qfy";
  };

  propagatedBuildInputs = [ async-timeout ];
--- a/pkgs/development/python-modules/aws-sam-translator/default.nix
+++ b/pkgs/development/python-modules/aws-sam-translator/default.nix
@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, isPy3k
+, pythonOlder
 , boto3
 , enum34
 , jsonschema
@ -10,11 +10,11 @@

 buildPythonPackage rec {
  pname = "aws-sam-translator";
-  version = "1.10.0";
+  version = "1.11.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0axr4598b1h9kyb5mv104cpn5q667s0g1wkkbqzj66vrqsaa07qf";
+    sha256 = "db872c43bdfbbae9fc8c9201e6a7aeb9a661cda116a94708ab0577b46a38b962";
  };

  # Tests are not included in the PyPI package
@ -22,10 +22,9 @@ buildPythonPackage rec {

  propagatedBuildInputs = [
    boto3
-    enum34
    jsonschema
    six
-  ];
+  ] ++ lib.optionals (pythonOlder "3.4") [ enum34 ];

  meta = {
    homepage = https://github.com/awslabs/serverless-application-model;
--- a/pkgs/development/python-modules/cassandra-driver/default.nix
+++ b/pkgs/development/python-modules/cassandra-driver/default.nix
@ -21,11 +21,11 @@

 buildPythonPackage rec {
  pname = "cassandra-driver";
-  version = "3.17.0";
+  version = "3.17.1";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "1z49z6f9rj9kp1v03s1hs1rg8cj49rh0yk0fc2qi57w7slgy2hkd";
+    sha256 = "1y6pnm7vzg9ip1nbly3i8mmwqmcy8g38ix74vdzvvaxwxil9bmvi";
  };

  buildInputs = [
--- a/pkgs/development/python-modules/channels/default.nix
+++ b/pkgs/development/python-modules/channels/default.nix
@ -3,11 +3,11 @@
 }:
 buildPythonPackage rec {
  pname = "channels";
-  version = "2.1.7";
+  version = "2.2.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "e13ba874d854ac493ece329dcd9947e82357c15437ac1a90ed1040d0e5b87aad";
+    sha256 = "af7cdba9efb3f55b939917d1b15defb5d40259936013e60660e5e9aff98db4c5";
  };

  # Files are missing in the distribution
--- a/pkgs/development/python-modules/confluent-kafka/default.nix
+++ b/pkgs/development/python-modules/confluent-kafka/default.nix
@ -1,18 +1,18 @@
-{ stdenv, buildPythonPackage, fetchPypi, isPy3k, rdkafka, requests, avro3k, avro, futures}:
+{ stdenv, buildPythonPackage, fetchPypi, isPy3k, rdkafka, requests, avro3k, avro, futures, enum34 }:

 buildPythonPackage rec {
-  version = "0.11.6";
+  version = "1.0.0";
  pname = "confluent-kafka";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "1dvzlafgr4g0n7382s5bgbls3f9wrgr0yxd70yyxl59wddwzfii7";
+    sha256 = "a7427944af963410479c2aaae27cc9d28db39c9a93299f14dcf16df80092c63a";
  };

-  buildInputs = [ rdkafka requests ] ++ (if isPy3k then [ avro3k ] else [ avro futures ]) ;
+  buildInputs = [ rdkafka requests ] ++ (if isPy3k then [ avro3k ] else [ enum34 avro futures ]) ;

-  # Tests fail for python3 under this pypi release
-  doCheck = if isPy3k then false else true;
+  # No tests in PyPi Tarball
+  doCheck = false;

  meta = with stdenv.lib; {
    description = "Confluent's Apache Kafka client for Python";
--- a/pkgs/development/python-modules/daphne/default.nix
+++ b/pkgs/development/python-modules/daphne/default.nix
@ -1,10 +1,10 @@
-{ stdenv, buildPythonPackage, isPy3k, fetchFromGitHub
+{ stdenv, buildPythonPackage, isPy3k, fetchFromGitHub, fetchpatch
 , asgiref, autobahn, twisted, pytestrunner
 , hypothesis, pytest, pytest-asyncio
 }:
 buildPythonPackage rec {
  pname = "daphne";
-  version = "2.2.5";
+  version = "2.3.0";

  disabled = !isPy3k;

@ -12,9 +12,17 @@ buildPythonPackage rec {
    owner = "django";
    repo = pname;
    rev = version;
-    sha256 = "0ixgq1rr3s60bmrwx8qwvlvs3lag1c2nrmg4iy7wcmb8i1ddylqr";
+    sha256 = "020afrvbnid13gkgjpqznl025zpynisa96kybmf8q7m3wp1iq1nl";
  };

+  patches = [
+    # Fix compatibility with Hypothesis 4. See: https://github.com/django/daphne/pull/261
+    (fetchpatch {
+      url = "https://github.com/django/daphne/commit/2df5096c5b63a791c209e12198ad89c998869efd.patch";
+      sha256 = "0046krzcn02mihqmsjd80kk5h5flv44nqxpapa17g6dvq3jnb97n";
+    })
+  ];
+
  nativeBuildInputs = [ pytestrunner ];

  propagatedBuildInputs = [ asgiref autobahn twisted ];
--- a/pkgs/development/python-modules/django_guardian/default.nix
+++ b/pkgs/development/python-modules/django_guardian/default.nix
@ -1,14 +1,14 @@
-{ stdenv, buildPythonPackage, fetchPypi, isPy3k
+{ stdenv, buildPythonPackage, fetchPypi
 , django_environ, mock, django, six
 , pytest, pytestrunner, pytest-django
 }:
 buildPythonPackage rec {
  pname = "django-guardian";
-  version = "1.5.0";
+  version = "1.5.1";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "9e144bbdfa67f523dc6f70768653a19c0aac29394f947a80dcb8eb7900840637";
+    sha256 = "0fixr2g5amdgqzh0rvfvd7hbxyfd5ra3y3s0fsmp8i1b68p97930";
  };

  checkInputs = [ pytest pytestrunner pytest-django django_environ mock ];
@ -18,6 +18,5 @@ buildPythonPackage rec {
    description = "Per object permissions for Django";
    homepage = https://github.com/django-guardian/django-guardian;
    license = [ licenses.mit licenses.bsd2 ];
-    broken = !isPy3k; # https://github.com/django-guardian/django-guardian/pull/605
  };
 }
--- a/pkgs/development/python-modules/fs/default.nix
+++ b/pkgs/development/python-modules/fs/default.nix
@ -19,11 +19,11 @@

 buildPythonPackage rec {
  pname = "fs";
-  version = "2.4.4";
+  version = "2.4.5";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0krf632nz24v2da7g9xivq6l2w9za3vph4vix7mm1k3byzwjnawk";
+    sha256 = "1gv23ns9szdh1dgqzvc0r94qrv8fpjqj0xv99sniy2x3rxs2n0j2";
  };

  buildInputs = [ glibcLocales ];
--- a/pkgs/development/python-modules/gensim/default.nix
+++ b/pkgs/development/python-modules/gensim/default.nix
@ -10,11 +10,11 @@

 buildPythonPackage rec {
  pname = "gensim";
-  version = "3.7.2";
+  version = "3.7.3";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "1la4y935sdah8ywa7krwy80hcl4n2k8cdx4ncy3dg3y2mdg3vq24";
+    sha256 = "0mp1hbj7ciwpair7z445zj1grfv8c75gby9lih01c3mvw4pff7v2";
  };

  propagatedBuildInputs = [ smart_open numpy six scipy ];
--- a/pkgs/development/python-modules/geopandas/default.nix
+++ b/pkgs/development/python-modules/geopandas/default.nix
@ -4,14 +4,14 @@

 buildPythonPackage rec {
  pname = "geopandas";
-  version = "0.4.1";
+  version = "0.5.0";
  name = pname + "-" + version;

  src = fetchFromGitHub {
    owner = "geopandas";
    repo = "geopandas";
    rev = "v${version}";
-    sha256 = "02v3lszxvhpsb0qrqk0kcnf9jss9gdj8az2r97aqx7ya8cwaccxa";
+    sha256 = "0gmqksjgxrng52jvjk0ylkpsg0qriygb10b7n80l28kdz6c0givj";
  };

  checkInputs = [ pytest Rtree ];
--- a/pkgs/development/python-modules/google_cloud_speech/default.nix
+++ b/pkgs/development/python-modules/google_cloud_speech/default.nix
@ -3,11 +3,11 @@

 buildPythonPackage rec {
  pname = "google-cloud-speech";
-  version = "0.36.3";
+  version = "1.0.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "3d77da6086c01375908c8b800808ff83748a34b98313f885bd86df95448304fc";
+    sha256 = "1d0ysapqrcwcyiil7nyh8vbj4i6hk9v23rrm4rdhgm0lwax7i0aj";
  };

  propagatedBuildInputs = [ google_api_core ];
--- a/pkgs/development/python-modules/j2cli/default.nix
+++ b/pkgs/development/python-modules/j2cli/default.nix
@ -9,12 +9,12 @@

 buildPythonPackage rec {
  pname = "j2cli";
-  version = "0.3.7";
+  version = "0.3.8";
  disabled = isPy3k;

  src = fetchPypi {
    inherit pname version;
-    sha256 = "a7b0bdb02a3afb6d2eff40228b2216306332ace4341372310dafd15f938e1afa";
+    sha256 = "1f1a5fzap4ji5l7x8bprrgcpy1071lpa9g5h8jz7iqzgqynkaygi";
  };

  buildInputs = [ nose ];
--- a/pkgs/development/python-modules/lark-parser/default.nix
+++ b/pkgs/development/python-modules/lark-parser/default.nix
@ -15,12 +15,11 @@ buildPythonPackage rec {
    sha256 = "1zynj09w361yvbxr4hir681dfnlq1hzniws9dzgmlkvd6jnhjgx3";
  };

-  checkPhase = ''
-    ${python.interpreter} -m unittest
+  # tests of Nearley support require js2py
+  preCheck = ''
+    rm -r tests/test_nearley
  '';

-  doCheck = false; # Requires js2py
-
  meta = {
    description = "A modern parsing library for Python, implementing Earley & LALR(1) and an easy interface";
    homepage = https://github.com/lark-parser/lark;
--- a/pkgs/development/python-modules/netcdf4/default.nix
+++ b/pkgs/development/python-modules/netcdf4/default.nix
@ -3,13 +3,13 @@
 }:
 buildPythonPackage rec {
  pname = "netCDF4";
-  version = "1.5.0.1";
+  version = "1.5.1.2";

  disabled = isPyPy;

  src = fetchPypi {
    inherit pname version;
-    sha256 = "db24f7ca724e791574774b2a1e323ce0dfb544957fc6fbdb5d4c368f382b2de9";
+    sha256 = "161pqb7xc9nj0dlnp6ply8c6zv68y1frq619xqfrpmc9s1932jzk";
  };

  checkInputs = [ pytest ];
--- a/pkgs/development/python-modules/pyaxmlparser/default.nix
+++ b/pkgs/development/python-modules/pyaxmlparser/default.nix
@ -1,7 +1,7 @@
 { buildPythonPackage, stdenv, lxml, click, fetchFromGitHub, pytest, isPy3k }:

 buildPythonPackage rec {
-  version = "0.3.13";
+  version = "0.3.15";
  pname = "pyaxmlparser";

  # the PyPI tarball doesn't ship tests.
@ -9,7 +9,7 @@ buildPythonPackage rec {
    owner = "appknox";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0jfjhxc6b57npsidknxmhj1x813scg47aaw90ybyr90fpdz5rlwk";
+    sha256 = "0p4x21rg8h7alrg2zk6rbgc3fj77fiyky4zzvziz2bp5jpx1pvzp";
  };

  disabled = !isPy3k;
--- a/pkgs/development/python-modules/ropper/default.nix
+++ b/pkgs/development/python-modules/ropper/default.nix
@ -8,11 +8,11 @@

 buildPythonApplication rec {
  pname = "ropper";
-  version = "1.11.13";
+  version = "1.12.1";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "245c6a1c8b294209bed039cd6a389f1e298d3fe6783d48ad9c6b2df3a41f51ee";
+    sha256 = "1aignpxz6rcbf6yxy1gjr708p56i6nqrbgblq24nanssz9rhkyzg";
  };
  # XXX tests rely on user-writeable /dev/shm to obtain process locks and return PermissionError otherwise
  # workaround: sudo chmod 777 /dev/shm
@ -25,7 +25,7 @@ buildPythonApplication rec {
  propagatedBuildInputs = [ capstone filebytes ];
  meta = with stdenv.lib; {
    homepage = https://scoding.de/ropper/;
-    license = licenses.gpl2;
+    license = licenses.bsd3;
    description = "Show information about files in different file formats";
    maintainers = with maintainers; [ bennofs ];
  };
--- a/pkgs/development/python-modules/streamz/default.nix
+++ b/pkgs/development/python-modules/streamz/default.nix
@ -14,19 +14,13 @@

 buildPythonPackage rec {
  pname = "streamz";
-  version = "0.5.0";
+  version = "0.5.1";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "cfdd42aa62df299f550768de5002ec83112136a34b44441db9d633b2df802fb4";
+    sha256 = "80c9ded1d6e68d3b78339deb6e9baf93a633d84b4a8875221e337ac06890103f";
  };

-  # Pytest 4.x fails to collect streamz-dataframe tests.
-  # Removing them in v0.5.0. TODO: re-enable in a future release
-  postPatch = ''
-    rm -rf streamz/dataframe/tests/*.py
-  '';
-
  checkInputs = [ pytest networkx distributed confluent-kafka graphviz ];
  propagatedBuildInputs = [
    tornado
@ -35,8 +29,9 @@ buildPythonPackage rec {
    six
  ];

+  # Disable test_tcp_async because fails on sandbox build
  checkPhase = ''
-    pytest
+    pytest --deselect=streamz/tests/test_sources.py::test_tcp_async
  '';

  meta = with lib; {
--- a/pkgs/development/python-modules/zstd/default.nix
+++ b/pkgs/development/python-modules/zstd/default.nix
@ -3,11 +3,11 @@

 buildPythonPackage rec {
  pname = "zstd";
-  version = "1.3.8.1";
+  version = "1.4.0.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "d89e884da59c35e480439f1663cb3cb4cf372e42ba0eb0bdf22b9625414702a3";
+    sha256 = "01prq9rwz1gh42idnj2162w79dzs8gf3ac8pn12lz347w280kjbk";
  };

  postPatch = ''
--- a/pkgs/development/tools/continuous-integration/jenkins/default.nix
+++ b/pkgs/development/tools/continuous-integration/jenkins/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "jenkins-${version}";
-  version = "2.164.2";
+  version = "2.164.3";

  src = fetchurl {
    url = "http://mirrors.jenkins.io/war-stable/${version}/jenkins.war";
-    sha256 = "1pmya8g3gs5f9ibbgacdh5f6828jcrydw7v7xmg2j86kwc1vclf8";
+    sha256 = "03m5ykl6kqih9li2fhyq9rf8x8djaj2rgjd2p897zzw5j0grkbx8";
  };

  buildCommand = ''
--- a/pkgs/development/tools/icr/default.nix
+++ b/pkgs/development/tools/icr/default.nix
@ -1,15 +1,15 @@
-{ stdenv, fetchFromGitHub, crystal, shards, which
-, openssl, readline }:
+{ stdenv, fetchFromGitHub, crystal, shards, which, makeWrapper
+, openssl, readline, libyaml }:

 stdenv.mkDerivation rec {
  pname = "icr";
-  version = "0.5.0";
+  version = "0.6.0";

  src = fetchFromGitHub {
    owner  = "crystal-community";
-    repo   = "icr";
+    repo   = pname;
    rev    = "v${version}";
-    sha256 = "1vavdzgm06ssnxm6mylki6xma0mfsj63n5kivhk1v4pg4xj966w5";
+    sha256 = "0kkdqrxk4f4bqbb84mgjrk9r0fz1hsz95apvjsc49gav4c8xx3mb";
  };

  postPatch = ''
@ -17,17 +17,20 @@ stdenv.mkDerivation rec {
      --replace /usr/local $out
  '';

-  buildInputs = [ openssl readline ];
+  buildInputs = [ crystal libyaml openssl readline ];

-  nativeBuildInputs = [ crystal shards which ];
+  nativeBuildInputs = [ makeWrapper shards which ];

  doCheck = true;
-
  checkTarget = "test";

+  postInstall = ''
+    wrapProgram $out/bin/icr --prefix PATH : "${stdenv.lib.makeBinPath [ crystal ]}"
+  '';
+
  meta = with stdenv.lib; {
    description = "Interactive console for the Crystal programming language";
-    homepage = https://github.com/crystal-community/icr;
+    homepage = "https://github.com/crystal-community/icr";
    license = licenses.mit;
    maintainers = with maintainers; [ peterhoeg ];
  };
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@ -3,7 +3,9 @@
 # Enabling all targets increases output size to a multiple.
 , withAllTargets ? false, libbfd, libopcodes
 , enableShared ? true
-, noSysDirs, gold ? true, bison ? null
+, noSysDirs
+, gold ? !stdenv.buildPlatform.isDarwin || stdenv.hostPlatform == stdenv.targetPlatform
+, bison ? null
 , fetchpatch
 }:

@ -61,14 +63,7 @@ stdenv.mkDerivation rec {
    ./0001-x86-Add-a-GNU_PROPERTY_X86_ISA_1_USED-note-if-needed.patch
    ./0001-x86-Properly-merge-GNU_PROPERTY_X86_ISA_1_USED.patch
    ./0001-x86-Properly-add-X86_ISA_1_NEEDED-property.patch
-  ] ++ lib.optional stdenv.targetPlatform.isiOS ./support-ios.patch
-    ++ lib.optional (stdenv.hostPlatform.isDarwin && stdenv.targetPlatform != stdenv.hostPlatform) [
-    (fetchpatch {
-      url = "https://sourceware.org/bugzilla/attachment.cgi?id=11141";
-      name = "gold-threads.patch";
-      sha256 = "0p26dxpba8n7z3pwjg7qf94f0gzbvwkjq0j9ng1w3sljj0gyaf1j";
-    })
-  ];
+  ] ++ lib.optional stdenv.targetPlatform.isiOS ./support-ios.patch;

  outputs = [ "out" "info" "man" ];

--- a/pkgs/development/tools/proto-contrib/default.nix
+++ b/pkgs/development/tools/proto-contrib/default.nix
@ -0,0 +1,23 @@
+{ buildGoModule, fetchFromGitHub, lib }:
+
+buildGoModule rec {
+  pname = "proto-contrib";
+  version = "0.9.0";
+
+  src = fetchFromGitHub {
+    owner = "emicklei";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0ksxic7cypv9gg8q5lkl5bla1n9i65z7b03cx9lwq6252glmf2jk";
+  };
+
+  modSha256 = "19cqz13jd95d5vibd10420gg69ldgf6afc51mkglhafgmmif56b0";
+
+  meta = with lib; {
+    description = "Contributed tools and other packages on top of the Go proto package";
+    homepage = https://github.com/emicklei/proto-contrib;
+    license = licenses.mit;
+    maintainers = with maintainers; [ kalbasit ];
+    platforms = platforms.linux ++ platforms.darwin;
+  };
+}
--- a/pkgs/development/tools/yarn/default.nix
+++ b/pkgs/development/tools/yarn/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "yarn";
-  version = "1.15.2";
+  version = "1.16.0";

  src = fetchzip {
    url = "https://github.com/yarnpkg/yarn/releases/download/v${version}/yarn-v${version}.tar.gz";
-    sha256 = "0gvg6m0mdppgjp5lg3mz1w19c1zsflhgldzx4hgm3rlrbx3rzmvr";
+    sha256 = "1ki518ppw7bka4bfgvsv9s8x785vy23nvi7ihsw6ivisrg5v0w7w";
  };

  buildInputs = [ nodejs ];
--- a/pkgs/development/web/twitter-bootstrap/3.nix
+++ b/pkgs/development/web/twitter-bootstrap/3.nix
@ -0,0 +1,26 @@
+{ stdenv, fetchurl, unzip }:
+
+stdenv.mkDerivation rec {
+  name = "bootstrap-${version}";
+  version = "3.4.1";
+
+  src = fetchurl {
+    url = "https://github.com/twbs/bootstrap/releases/download/v${version}/bootstrap-${version}-dist.zip";
+    sha256 = "0bnrxyryl4kyq250k4n2lxgkddfs9lxhqd6gq8x3kg9wfz7r75yl";
+  };
+
+  buildInputs = [ unzip ];
+
+  dontBuild = true;
+  installPhase = ''
+    mkdir $out
+    cp -r * $out/
+  '';
+
+  meta = {
+    description = "Front-end framework for faster and easier web development";
+    homepage = https://getbootstrap.com/;
+    license = stdenv.lib.licenses.mit;
+  };
+
+}
--- a/pkgs/development/web/twitter-bootstrap/default.nix
+++ b/pkgs/development/web/twitter-bootstrap/default.nix
@ -1,12 +1,12 @@
 { stdenv, fetchurl, unzip }:

 stdenv.mkDerivation rec {
-  name = "bootstrap-${version}";
-  version = "3.3.7";
+  pname = "bootstrap";
+  version = "4.3.1";

  src = fetchurl {
-    url = "https://github.com/twbs/bootstrap/releases/download/v${version}/bootstrap-${version}-dist.zip";
-    sha256 = "0yqvg72knl7a0rlszbpk7xf7f0cs3aqf9xbl42ff41yh5pzsi67l";
+    url = "https://github.com/twbs/bootstrap/releases/download/v${version}/${pname}-${version}-dist.zip";
+    sha256 = "08rkg4q8x36k03g1d81brhncrzb98sh8r53a5wg3i4p1nwqgv3w8";
  };

  buildInputs = [ unzip ];
--- a/pkgs/games/chessx/default.nix
+++ b/pkgs/games/chessx/default.nix
@ -4,11 +4,11 @@

 stdenv.mkDerivation rec {
  name = "chessx-${version}";
-  version = "1.4.6";
+  version = "1.5.0";

  src = fetchurl {
    url = "mirror://sourceforge/chessx/chessx-${version}.tgz";
-    sha256 = "1vb838byzmnyglm9mq3khh3kddb9g4g111cybxjzalxxlc81k5dd";
+    sha256 = "09rqyra28w3z9ldw8sx07k5ap3sjlli848p737maj7c240rasc6i";
  };

  buildInputs = [
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@ -3,7 +3,7 @@
 with stdenv.lib;

 buildLinux (args // rec {
-  version = "4.14.117";
+  version = "4.14.118";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0gzjp731fgasi3nq39zz27h1x6mkvc0hbwjhmn9gyzd7wwsa2md8";
+    sha256 = "05csfas10b3kfj6pn72skxpk211y36bdzk5x63n6dbxrsjmp6zb8";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@ -3,7 +3,7 @@
 with stdenv.lib;

 buildLinux (args // rec {
-  version = "4.19.41";
+  version = "4.19.42";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "10j7f78220rswdvng2fpmsvri2pqx2hm7q3z2k2cnr2ca2b65plh";
+    sha256 = "09ns4qskl2drg0p9fajy7nbh55anj0qxl7smca9rfxfm21hdf2gq";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:

 buildLinux (args // rec {
-  version = "4.9.174";
+  version = "4.9.175";
  extraMeta.branch = "4.9";

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0n2qhvvphv45fckrhvcf58va8mv2j7pg7yvr2yxmbzvz0xlgv17w";
+    sha256 = "032h0zd3rxg34vyp642978pbx66gnx3sfv49qwvbzwlx3zwk916r";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-5.0.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.0.nix
@ -3,7 +3,7 @@
 with stdenv.lib;

 buildLinux (args // rec {
-  version = "5.0.14";
+  version = "5.0.15";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0qbcczrrg3v7gm5x534h8fzasp53kimca3x3dzwc084arxv60drf";
+    sha256 = "01zb8lz1lxcff2j8yxzm0ayfazi07c2n7v1i3v8wbq8k9r2vhgjw";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-5.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.1.nix
@ -3,7 +3,7 @@
 with stdenv.lib;

 buildLinux (args // rec {
-  version = "5.1";
+  version = "5.1.1";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0hghjkxgf1p8mfm04a9ckjvyrnp71jp3pbbp0qsx35rzwzk7nsnh";
+    sha256 = "1pcd0npnrjbc01rzmm58gh135w9nm5mf649asqlw50772qa9jkd0";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/spl/default.nix
+++ b/pkgs/os-specific/linux/spl/default.nix
@ -21,6 +21,11 @@ stdenv.mkDerivation rec {

  patches = [ ./install_prefix.patch ];

+  # Backported fix for 0.7.13 to build with 5.1, please remove when updating to 0.7.14
+  postPatch = optionalString (versionAtLeast kernel.version "5.1") ''
+    sed -i 's/get_ds()/KERNEL_DS/g' module/spl/spl-vnode.c
+  '';
+
  nativeBuildInputs = [ autoreconfHook ] ++ kernel.moduleBuildDependencies;

  hardeningDisable = [ "fortify" "stackprotector" "pic" ];
--- a/pkgs/servers/demoit/default.nix
+++ b/pkgs/servers/demoit/default.nix
@ -5,14 +5,14 @@

 buildGoPackage rec {
  pname = "demoit";
-  version = "unstable-2019-03-29";
+  version = "unstable-2019-05-10";
  goPackagePath = "github.com/dgageot/demoit";

  src = fetchFromGitHub {
    owner = "dgageot";
    repo = "demoit";
-    rev = "ec70fbdf5a5e92fa1c06d8f039f7d388e0237ba2";
-    sha256 = "01584cxlnrc928sw7ldmi0sm7gixmwnawy3c5hd79rqkw8r0gbk0";
+    rev = "c1d4780620ebf083cb4a81b83c80e7547ff7bc23";
+    sha256 = "0l0pw0kzgnrk6a6f4ls3s82icjp7q9djbaxwfpjswbcfdzrsk4p2";
  };

  meta = with stdenv.lib; {
--- a/pkgs/servers/dns/knot-resolver/default.nix
+++ b/pkgs/servers/dns/knot-resolver/default.nix
@ -75,26 +75,24 @@ unwrapped = stdenv.mkDerivation rec {
  };
 };

-wrapped-full = with luajitPackages; let
-    luaPkgs =  [
-      luasec luasocket # trust anchor bootstrap, prefill module
-      lfs # prefill module
-      # Almost all is for the 'http' module:
-      http cqueues fifo lpeg lpeg_patterns luaossl compat53 basexx
-    ];
-  in runCommand unwrapped.name
+wrapped-full = runCommand unwrapped.name
  {
    nativeBuildInputs = [ makeWrapper ];
+    buildInputs = with luajitPackages; [
+      luasec luasocket # trust anchor bootstrap, prefill module
+      lfs # prefill module
+      http # for http module; brings lots of deps; some are useful elsewhere
+    ];
    preferLocalBuild = true;
    allowSubstitutes = false;
  }
  ''
-    mkdir -p "$out/sbin" "$out/share"
-    makeWrapper '${unwrapped}/sbin/kresd' "$out"/sbin/kresd \
-      --set LUA_PATH  '${concatStringsSep ";" (map getLuaPath  luaPkgs)}' \
-      --set LUA_CPATH '${concatStringsSep ";" (map getLuaCPath luaPkgs)}'
+    mkdir -p "$out"/{bin,share}
+    makeWrapper '${unwrapped}/bin/kresd' "$out"/bin/kresd \
+      --set LUA_PATH  "$LUA_PATH" \
+      --set LUA_CPATH "$LUA_CPATH"
    ln -sr '${unwrapped}/share/man' "$out"/share/
-    ln -sr "$out"/{sbin,bin}
+    ln -sr "$out"/{bin,sbin}
  '';

 in result
--- a/pkgs/servers/nosql/apache-jena/fuseki-binary.nix
+++ b/pkgs/servers/nosql/apache-jena/fuseki-binary.nix
@ -3,10 +3,10 @@ let
  s = # Generated upstream information
  rec {
    baseName="apache-jena-fuseki";
-    version = "3.10.0";
+    version = "3.11.0";
    name="${baseName}-${version}";
    url="http://archive.apache.org/dist/jena/binaries/apache-jena-fuseki-${version}.tar.gz";
-    sha256 = "0v7srssivhx0bswvbr8ifaahcknlajwqqhr449v5zzi6nbyc613a";
+    sha256 = "05krsd0arhcl2yqmdp3iq2gwl1sc2adv44xpq9w06cps8bxj6yrb";
  };
  buildInputs = [
    makeWrapper
--- a/pkgs/servers/openafs/1.8/module.nix
+++ b/pkgs/servers/openafs/1.8/module.nix
@ -11,36 +11,6 @@ in stdenv.mkDerivation rec {
  name = "openafs-${version}-${kernel.modDirVersion}";
  inherit version src;

-  patches = [
-    # Linux 4.20
-    (fetchpatch {
-      name = "openafs_1_8-do_settimeofday.patch";
-      url = "http://git.openafs.org/?p=openafs.git;a=patch;h=aa80f892ec39e2984818090a6bb2047430836ee2";
-      sha256 = "11zw676zqi9sj3vhp7n7ndxcxhp17cq9g2g41n030mcd3ap4g53h";
-    })
-    (fetchpatch {
-      name = "openafs_1_8-current_kernel_time.patch";
-      url = "http://git.openafs.org/?p=openafs.git;a=patch;h=3c454b39d04f4886536267c211171dae30dc0344";
-      sha256 = "16fl9kp0l95dqm166jx3x4ijbzhf2bc9ilnipn3k1j00mfy4lnia";
-    })
-    # Linux 5.0
-    (fetchpatch {
-      name = "openafs_1_8-ktime_get_coarse_real_ts64.patch";
-      url = "http://git.openafs.org/?p=openafs.git;a=patch;h=21ad6a0c826c150c4227ece50554101641ab4626";
-      sha256 = "0cd2bzfn4gkb68qf27wpgcg9kvaky7kll22b8p2vmw5x4xkckq2y";
-    })
-    (fetchpatch {
-      name = "openafs_1_8-ktime_get_real_ts64.patch";
-      url = "http://git.openafs.org/?p=openafs.git;a=patch;h=b892fb127815bdf72103ae41ee70aadd87931b0c";
-      sha256 = "1xmf2l4g5nb9rhca7zn0swynvq8f9pd0k9drsx9bpnwp662y9l8m";
-    })
-    (fetchpatch {
-      name = "openafs_1_8-super_block.patch";
-      url = "http://git.openafs.org/?p=openafs.git;a=patch;h=3969bbca6017eb0ce6e1c3099b135f210403f661";
-      sha256 = "0cdd76s1h1bhxj0hl7r6mcha1jcy5vhlvc5dc8m2i83a6281yjsa";
-    })
-  ];
-
  nativeBuildInputs = [ autoconf automake flex libtool_2 perl which yacc ]
    ++ kernel.moduleBuildDependencies;

--- a/pkgs/servers/openafs/1.8/srcs.nix
+++ b/pkgs/servers/openafs/1.8/srcs.nix
@ -1,14 +1,14 @@
 { fetchurl }:
 rec {
-  version = "1.8.2";
+  version = "1.8.3";
  src = fetchurl {
    url = "http://www.openafs.org/dl/openafs/${version}/openafs-${version}-src.tar.bz2";
-    sha256 = "13hksffp7k5f89c9lc5g5b1q0pc9h7wyarq3sjyjqam7c513xz95";
+    sha256 = "19ffchxwgqg4wl98l456jdpgq2w8b5izn8hxdsq9hjs0a1nc3nga";
  };

  srcs = [ src
    (fetchurl {
      url = "http://www.openafs.org/dl/openafs/${version}/openafs-${version}-doc.tar.bz2";
-      sha256 = "09n8nymrhpyb0fhahpln2spzhy9pn48hvry35ccqif2jd4wsxdmr";
+      sha256 = "14smdhn1f6f3cbvvwxgjjld0m4b17vqh3rzkxf5apmjsdda21njq";
    })];
 }
--- a/pkgs/servers/search/elasticsearch/plugins.nix
+++ b/pkgs/servers/search/elasticsearch/plugins.nix
@ -1,12 +1,18 @@
-{ pkgs,  stdenv, fetchurl, unzip, elasticsearch-oss, javaPackages, elk6Version }:
+{ pkgs, lib, stdenv, fetchurl, unzip, javaPackages, elasticsearch }:

 let
+  esVersion = elasticsearch.version;
+
+  majorVersion = lib.head (builtins.splitVersion esVersion);
+
  esPlugin = a@{
    pluginName,
    installPhase ? ''
      mkdir -p $out/config
      mkdir -p $out/plugins
-      ES_HOME=$out ${elasticsearch-oss}/bin/elasticsearch-plugin install --batch -v file://$src
+      ln -s ${elasticsearch}/lib $out/lib
+      ES_HOME=$out ${elasticsearch}/bin/elasticsearch-plugin install --batch -v file://$src
+      rm $out/lib
    '',
    ...
  }:
@ -15,37 +21,41 @@ let
      unpackPhase = "true";
      buildInputs = [ unzip ];
      meta = a.meta // {
-        platforms = elasticsearch-oss.meta.platforms;
+        platforms = elasticsearch.meta.platforms;
        maintainers = (a.meta.maintainers or []) ++ (with stdenv.lib.maintainers; [ offline ]);
      };
    });
 in {

-  elasticsearch_analysis_lemmagen = esPlugin rec {
+  analysis-lemmagen = esPlugin rec {
    name = "elasticsearch-analysis-lemmagen-${version}";
    pluginName = "elasticsearch-analysis-lemmagen";
-    version = "6.7.1"; # elk6Version;
+    version = esVersion;
    src = fetchurl {
-      url = "https://github.com/vhyza/elasticsearch-analysis-lemmagen/releases/download/v${version}/${name}-plugin.zip";
-      sha256 = "0mf8lpf40bjpzfj9lkhrg7c3xinzvg7aby3vd6h92g9i676xs8ri";
+      url = "https://github.com/vhyza/${pluginName}/releases/download/v${version}/${name}-plugin.zip";
+      sha256 =
+        if version == "7.0.1" then "155zj9zw81msx976c952nk926ndav1zqhmy2xih6nr82qf0p71hm"
+        else if version == "6.7.2" then "1r176ncjbilkmri2c5rdxh5xqsrn77m1f0p98zs47czwlqh230iq"
+        else throw "unsupported version ${version} for plugin ${pluginName}";
    };
    meta = with stdenv.lib; {
      homepage = https://github.com/vhyza/elasticsearch-analysis-lemmagen;
      description = "LemmaGen Analysis plugin provides jLemmaGen lemmatizer as Elasticsearch token filter";
      license = licenses.asl20;
-      # TODO: remove the following when there's a release compatible with elasticsearch-6.7.2.
-      # See: https://github.com/vhyza/elasticsearch-analysis-lemmagen/issues/14
-      broken = true;
    };
  };

  discovery-ec2 = esPlugin rec {
    name = "elasticsearch-discovery-ec2-${version}";
    pluginName = "discovery-ec2";
-    version = "${elk6Version}";
+    version = esVersion;
    src = pkgs.fetchurl {
-      url = "https://artifacts.elastic.co/downloads/elasticsearch-plugins/discovery-ec2/discovery-ec2-${elk6Version}.zip";
-      sha256 = "1p0cdz3lfksfd2kvlcj0syxhbx27mimsaw8q4kgjpjjjwqayg523";
+      url = "https://artifacts.elastic.co/downloads/elasticsearch-plugins/${pluginName}/${pluginName}-${version}.zip";
+      sha256 =
+        if version == "7.0.1" then "0nrvralh4fygs0ys2ikg3x08jdyh9276d5w7yfncbbi0xrg9hk6g"
+        else if version == "6.7.2" then "1p0cdz3lfksfd2kvlcj0syxhbx27mimsaw8q4kgjpjjjwqayg523"
+        else if version == "5.6.16" then "1300pfmnlpfm1hh2jgas8j2kqjqiqkxhr8czshj9lx0wl4ciknin"
+        else throw "unsupported version ${version} for plugin ${pluginName}";
    };
    meta = with stdenv.lib; {
      homepage = https://github.com/elastic/elasticsearch/tree/master/plugins/discovery-ec2;
@ -54,17 +64,65 @@ in {
    };
  };

-  search_guard = esPlugin rec {
-    name = "elastic-search-guard-${version}";
+  repository-s3 = esPlugin rec {
+    name = "elasticsearch-repository-s3-${version}";
+    pluginName = "repository-s3";
+    version = esVersion;
+    src = pkgs.fetchurl {
+      url = "https://artifacts.elastic.co/downloads/elasticsearch-plugins/${pluginName}/${pluginName}-${esVersion}.zip";
+      sha256 =
+        if version == "7.0.1" then "17bf8m1q92j5yhgldckl4hlsfv6qgwwqdc1da9kzgidgky7jwkbc"
+        else if version == "6.7.2" then "1l353zfyv3qziz8xkann9cbzx4wj5s14wnknfw351j6vgdq26l12"
+        else if version == "5.6.16" then "0k3li5xv1270ygb9lqk6ji3nngngl2im3z38k08nd627vxdrzij2"
+        else throw "unsupported version ${version} for plugin ${pluginName}";
+    };
+    meta = with stdenv.lib; {
+      homepage = https://github.com/elastic/elasticsearch/tree/master/plugins/repository-s3;
+      description = "The S3 repository plugin adds support for using AWS S3 as a repository for Snapshot/Restore.";
+      license = licenses.asl20;
+    };
+  };
+
+  repository-gcs = esPlugin rec {
+    name = "elasticsearch-repository-gcs-${version}";
+    pluginName = "repository-gcs";
+    version = esVersion;
+    src = pkgs.fetchurl {
+      url = "https://artifacts.elastic.co/downloads/elasticsearch-plugins/${pluginName}/${pluginName}-${esVersion}.zip";
+      sha256 =
+        if version == "7.0.1" then "0a3rc2gggsj7xfncil1s53dmq799lcm82h0yncs94jnb182sbmzc"
+        else if version == "6.7.2" then "0afccbvb7x6y3nrwmal09vpgxyz4lar6lffw4mngalcppsk8irvv"
+        else if version == "5.6.16" then "0hwqx4yhdn4c0ccdpvgrg30ag8hy3mgxgk7h7pibdmzvy7qw7501"
+        else throw "unsupported version ${version} for plugin ${pluginName}";
+    };
+    meta = with stdenv.lib; {
+      homepage = https://github.com/elastic/elasticsearch/tree/master/plugins/repository-gcs;
+      description = "The GCS repository plugin adds support for using Google Cloud Storage as a repository for Snapshot/Restore.";
+      license = licenses.asl20;
+    };
+  };
+
+  search-guard = let
+    majorVersion = lib.head (builtins.splitVersion esVersion);
+  in esPlugin rec {
+    name = "elasticsearch-search-guard-${version}";
    pluginName = "search-guard";
-    version = "${elk6Version}-25.1";
-    src = fetchurl rec {
-      url = "mirror://maven/com/floragunn/search-guard-6/${version}/search-guard-6-${version}.zip";
-      sha256 = "119r1zibi0z40mfxrpkx0zzay0yz6c7syqmmw8i2681wmz4nksda";
+    version =
+      if esVersion == "7.0.1" then "${esVersion}-35.0.0"
+      else if esVersion == "6.7.2" then "${esVersion}-25.1"
+      else if esVersion == "5.6.16" then "${esVersion}-19.3"
+      else throw "unsupported version ${esVersion} for plugin ${pluginName}";
+    src = fetchurl {
+      url = "mirror://maven/com/floragunn/${pluginName}-${majorVersion}/${version}/${pluginName}-${majorVersion}-${version}.zip";
+      sha256 =
+        if version == "7.0.1-35.0.0" then "0wsiqq7j7ph9g2vhhvjmwrh5a2q1wzlysgr75gc35zcvqz6cq8ha"
+        else if version == "6.7.2-25.1" then "119r1zibi0z40mfxrpkx0zzay0yz6c7syqmmw8i2681wmz4nksda"
+        else if version == "5.6.16-19.3" then "1q70anihh89c53fnk8wlq9z5dx094j0f9a0y0v2zsqx18lz9ikmx"
+        else throw "unsupported version ${version} for plugin ${pluginName}";
    };
    meta = with stdenv.lib; {
      homepage = https://github.com/floragunncom/search-guard;
-      description = "Plugin to fetch data from JDBC sources for indexing into Elasticsearch";
+      description = "Elasticsearch plugin that offers encryption, authentication, and authorisation. ";
      license = licenses.asl20;
    };
  };
--- a/pkgs/shells/zsh/oh-my-zsh/default.nix
+++ b/pkgs/shells/zsh/oh-my-zsh/default.nix
@ -4,13 +4,13 @@
 { stdenv, fetchgit }:

 stdenv.mkDerivation rec {
-  version = "2019-05-09";
+  version = "2019-05-11";
  name = "oh-my-zsh-${version}";
-  rev = "f5f630ff342571097fd92f069ea5fe006599703d";
+  rev = "486fa1010df847bfd8823b4492623afc7c935709";

  src = fetchgit { inherit rev;
    url = "https://github.com/robbyrussell/oh-my-zsh";
-    sha256 = "1ndrampjzkrd4myc1gv733zvgag25zgby9mxny9jzj99mlqajzac";
+    sha256 = "097n64xzdqgqdbgcqnzsk0s9r9yn8ncqbixbsxgpcj29x9hi1dkn";
  };

  pathsToLink = [ "/share/oh-my-zsh" ];
--- a/pkgs/tools/audio/mp3cat/default.nix
+++ b/pkgs/tools/audio/mp3cat/default.nix
@ -0,0 +1,34 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  pname = "mp3cat";
+  version = "0.5";
+
+  src = fetchFromGitHub {
+    owner = "tomclegg";
+    repo = pname;
+    rev = version;
+    sha256 = "0n6hjg2wgd06m561zc3ib5w2m3pwpf74njv2b2w4sqqh5md2ymfr";
+  };
+
+  makeFlags = [
+    "PREFIX=${placeholder ''out''}"
+  ];
+
+  installTargets = [
+    "install_bin"
+  ];
+
+  meta = with stdenv.lib; {
+    description = "A command line program which concatenates MP3 files";
+    longDescription = ''
+      A command line program which concatenates MP3 files, mp3cat
+      only outputs MP3 frames with valid headers, even if there is extra garbage
+      in its input stream
+    '';
+    homepage = https://github.com/tomclegg/mp3cat;
+    license = licenses.gpl2;
+    maintainers = [ maintainers.omnipotententity ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix
@ -13,13 +13,13 @@ in

 stdenv.mkDerivation rec {
  name = "ibus-typing-booster-${version}";
-  version = "2.6.0";
+  version = "2.6.1";

  src = fetchFromGitHub {
    owner = "mike-fabian";
    repo = "ibus-typing-booster";
    rev = version;
-    sha256 = "1d32p9k9vp64rpmj2cs3552ak9jn54vyi2hqdpzag33v16cydsl4";
+    sha256 = "09zlrkbv1bh6h08an5wihbsl8qqawxhdp2vcbjqrx2v8gqm1zidm";
  };

  patches = [ ./hunspell-dirs.patch ];
--- a/pkgs/tools/misc/grub/2.0x.nix
+++ b/pkgs/tools/misc/grub/2.0x.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchpatch, flex, bison, python
+{ stdenv, fetchgit, flex, bison, python, autoconf, automake, gnulib, libtool
 , gettext, ncurses, libusb, freetype, qemu, lvm2, unifont, pkgconfig
 , fuse # only needed for grub-mount
 , zfs ? null
@ -31,7 +31,7 @@ let
  canEfi = any (system: stdenv.hostPlatform.system == system) (mapAttrsToList (name: _: name) efiSystemsBuild);
  inPCSystems = any (system: stdenv.hostPlatform.system == system) (mapAttrsToList (name: _: name) pcSystems);

-  version = "2.02";
+  version = "2.04-rc1";

 in (

@ -42,28 +42,18 @@ assert !(efiSupport && xenSupport);
 stdenv.mkDerivation rec {
  name = "grub-${version}";

-  src = fetchurl {
-    url = "mirror://gnu/grub/${name}.tar.xz";
-    sha256 = "03vvdfhdmf16121v7xs8is2krwnv15wpkhkf16a4yf8nsfc3f2w1";
+  src = fetchgit {
+    url = "git://git.savannah.gnu.org/grub.git";
+    rev = name;
+    sha256 = "0xkcfxs0hbzvi33kg4abkayl8b7gym9sv8ljbwlh2kpz8i4kmnk0";
  };

  patches = [
    ./fix-bash-completion.patch
-    # This patch makes grub compatible with the XFS sparse inode
-    # feature introduced by xfsprogs-4.16.
-    # to be removed in grub-2.03
-    (fetchpatch {
-      url = https://git.savannah.gnu.org/cgit/grub.git/patch/?id=cda0a857dd7a27cd5d621747464bfe71e8727fff;
-      sha256 = "0k9qrkdxwdqk6sz05q9smqwjr6pvgc9adx1mlf0807g4im91xnm0";
-    })
-    ./relocation-not-implemented.diff
  ];
-  postPatch = ''
-    substituteInPlace ./configure --replace '/usr/share/fonts/unifont' '${unifont}/share/fonts'
-  '';

-  nativeBuildInputs = [ bison flex python pkgconfig ];
-  buildInputs = [ ncurses libusb freetype gettext lvm2 fuse ]
+  nativeBuildInputs = [ bison flex python pkgconfig autoconf automake ];
+  buildInputs = [ ncurses libusb freetype gettext lvm2 fuse libtool ]
    ++ optional doCheck qemu
    ++ optional zfsSupport zfs;

@ -91,6 +81,15 @@ stdenv.mkDerivation rec {
           -e's/qemu-system-i386/qemu-system-x86_64 -nodefaults/g'

      unset CPP # setting CPP intereferes with dependency calculation
+
+      cp -r ${gnulib} $PWD/gnulib
+      chmod u+w -R $PWD/gnulib
+
+      patchShebangs .
+
+      ./bootstrap --no-git --gnulib-srcdir=$PWD/gnulib
+
+      substituteInPlace ./configure --replace '/usr/share/fonts/unifont' '${unifont}/share/fonts'
    '';

  configureFlags = [ "--enable-grub-mount" ] # dep of os-prober
--- a/Show More
+++ b/Show More