Merge branch 'master' into staging-next

2024-09-22 04:57:56 +03:00 · 2019-11-27 22:57:50 -08:00 · 2019-11-27 22:57:50 -08:00 · 0c1c18ca44
commit 0c1c18ca44
parent 4cc592761d f4f8169021
207 changed files with 4017 additions and 3629 deletions
--- a/doc/stdenv/cross-compilation.xml
+++ b/doc/stdenv/cross-compilation.xml
@ -244,7 +244,7 @@
     </question>
     <answer>
      <para>
-       Many packages assume that an unprefixed <command>ar</command> is available, but Nix doesn't provide one. It only provides a prefixed one, just as it only does for all the other binutils programs. It may be necessary to patch the package to fix the build system to use a prefixed `ar`.
+       Many packages assume that an unprefixed <command>ar</command> is available, but Nix doesn't provide one. It only provides a prefixed one, just as it only does for all the other binutils programs. It may be necessary to patch the package to fix the build system to use a prefixed <command>ar</command>.
      </para>
     </answer>
    </qandaentry>
--- a/doc/stdenv/stdenv.xml
+++ b/doc/stdenv/stdenv.xml
@ -1717,7 +1717,7 @@ someVar=$(stripHash $name)
  </para>

  <para>
-   The most typical use of the setup hook is actually to add other hooks which are then run (i.e. after all the setup hooks) on each dependency. For example, the C compiler wrapper's setup hook feeds itself flags for each dependency that contains relevant libraries and headers. This is done by defining a bash function, and appending its name to one of <envar>envBuildBuildHooks</envar>`, <envar>envBuildHostHooks</envar>`, <envar>envBuildTargetHooks</envar>`, <envar>envHostHostHooks</envar>`, <envar>envHostTargetHooks</envar>`, or <envar>envTargetTargetHooks</envar>`. These 6 bash variables correspond to the 6 sorts of dependencies by platform (there's 12 total but we ignore the propagated/non-propagated axis).
+   The most typical use of the setup hook is actually to add other hooks which are then run (i.e. after all the setup hooks) on each dependency. For example, the C compiler wrapper's setup hook feeds itself flags for each dependency that contains relevant libraries and headers. This is done by defining a bash function, and appending its name to one of <envar>envBuildBuildHooks</envar>, <envar>envBuildHostHooks</envar>, <envar>envBuildTargetHooks</envar>, <envar>envHostHostHooks</envar>, <envar>envHostTargetHooks</envar>, or <envar>envTargetTargetHooks</envar>. These 6 bash variables correspond to the 6 sorts of dependencies by platform (there's 12 total but we ignore the propagated/non-propagated axis).
  </para>

  <para>
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -1484,6 +1484,16 @@
      }
    ];
  };
+  d-goldin = {
+    email = "dgoldin+github@protonmail.ch";
+    github = "d-goldin";
+    githubId = 43349662;
+    name = "Dima";
+    keys = [{
+      longkeyid = "rsa4096/BAB1D15FB7B4D4CE";
+      fingerprint = "1C4E F4FE 7F8E D8B7 1E88 CCDF BAB1 D15F B7B4 D4CE";
+    }];
+  };
  dadada = {
    name = "dadada";
    email = "dadada@dadada.li";
@ -4491,6 +4501,12 @@
    githubId = 16974598;
    name = "Mike Playle";
  };
+  mkaito = {
+    email = "chris@mkaito.net";
+    github = "mkaito";
+    githubId = 20434;
+    name = "Christian Höppner";
+  };
  mkazulak = {
    email = "kazulakm@gmail.com";
    github = "mulderr";
--- a/nixos/doc/manual/release-notes/rl-2003.xml
+++ b/nixos/doc/manual/release-notes/rl-2003.xml
@ -186,6 +186,13 @@
     The osquery module has been removed.
    </para>
   </listitem>
+   <listitem>
+    <para>
+      Going forward, <literal>~/bin</literal> in the users home directory will no longer be in <literal>PATH</literal> by default.
+      If you depend on this you should set the option <literal>environment.homeBinInPath</literal> to <literal>true</literal>.
+      The aforementioned option was added this release.
+    </para>
+   </listitem>
  </itemizedlist>
 </section>

--- a/nixos/modules/config/shells-environment.nix
+++ b/nixos/modules/config/shells-environment.nix
@ -122,7 +122,7 @@ in
      description = ''
        Include ~/bin/ in $PATH.
      '';
-      default = true;
+      default = false;
      type = types.bool;
    };

--- a/nixos/modules/hardware/video/nvidia.nix
+++ b/nixos/modules/hardware/video/nvidia.nix
@ -111,9 +111,10 @@ in
  config = mkIf enabled {
    assertions = [
      {
-        assertion = with config.services.xserver.displayManager; gdm.enable -> !gdm.wayland;
-        message = "NVIDIA drivers don't support wayland, set services.xserver.displayManager.gdm.wayland=false";
+        assertion = with config.services.xserver.displayManager; gdm.nvidiaWayland -> cfg.modesetting.enable;
+        message = "You cannot use wayland with GDM without modesetting enabled for NVIDIA drivers, set `hardware.nvidia.modesetting.enable = true`";
      }
+
      {
        assertion = !optimusCfg.enable ||
          (optimusCfg.nvidiaBusId != "" && optimusCfg.intelBusId != "");
--- a/nixos/modules/services/hardware/bluetooth.nix
+++ b/nixos/modules/services/hardware/bluetooth.nix
@ -36,17 +36,25 @@ in {
        '';
      };

+      config = mkOption {
+        type = with types; attrsOf (attrsOf (oneOf [ bool int str ]));
+        example = {
+          General = {
+            ControllerMode = "bredr";
+          };
+        };
+        description = "Set configuration for system-wide bluetooth (/etc/bluetooth/main.conf).";
+      };
+
      extraConfig = mkOption {
-        type = types.lines;
-        default = "";
+        type = with types; nullOr lines;
+        default = null;
        example = ''
          [General]
          ControllerMode = bredr
        '';
        description = ''
          Set additional configuration for system-wide bluetooth (/etc/bluetooth/main.conf).
-
-          NOTE: We already include [Policy], so any configuration under the Policy group should come first.
        '';
      };
    };
@ -56,16 +64,18 @@ in {
  ###### implementation

  config = mkIf cfg.enable {
+    warnings = optional (cfg.extraConfig != null) "hardware.bluetooth.`extraConfig` is deprecated, please use hardware.bluetooth.`config`.";
+
+    hardware.bluetooth.config = {
+      Policy = {
+        AutoEnable = mkDefault cfg.powerOnBoot;
+      };
+    };

    environment.systemPackages = [ bluez-bluetooth pkgs.openobex pkgs.obexftp ];

    environment.etc = singleton {
-      source = pkgs.writeText "main.conf" ''
-        [Policy]
-        AutoEnable=${lib.boolToString cfg.powerOnBoot}
-
-        ${cfg.extraConfig}
-      '';
+      source = pkgs.writeText "main.conf" (generators.toINI { } cfg.config + optionalString (cfg.extraConfig != null) cfg.extraConfig);
      target = "bluetooth/main.conf";
    };

--- a/nixos/modules/services/monitoring/prometheus/exporters.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters.nix
@ -197,6 +197,9 @@ in
    services.prometheus.exporters.minio.minioAccessSecret = mkDefault config.services.minio.secretKey;
  })] ++ [(mkIf config.services.rspamd.enable {
    services.prometheus.exporters.rspamd.url = mkDefault "http://localhost:11334/stat";
+  })] ++ [(mkIf config.services.nginx.enable {
+    systemd.services.prometheus-nginx-exporter.after = [ "nginx.service" ];
+    systemd.services.prometheus-nginx-exporter.requires = [ "nginx.service" ];
  })] ++ (mapAttrsToList (name: conf:
    mkExporterConf {
      inherit name;
--- a/nixos/modules/services/network-filesystems/samba.nix
+++ b/nixos/modules/services/network-filesystems/samba.nix
@ -115,7 +115,7 @@ in
        type = types.package;
        default = pkgs.samba;
        defaultText = "pkgs.samba";
-        example = literalExample "pkgs.samba3";
+        example = literalExample "pkgs.samba4Full";
        description = ''
          Defines which package should be used for the samba server.
        '';
--- a/nixos/modules/services/networking/wpa_supplicant.nix
+++ b/nixos/modules/services/networking/wpa_supplicant.nix
@ -236,9 +236,12 @@ in {
        ${if ifaces == [] then ''
          for i in $(cd /sys/class/net && echo *); do
            DEVTYPE=
-            source /sys/class/net/$i/uevent
-            if [ "$DEVTYPE" = "wlan" -o -e /sys/class/net/$i/wireless ]; then
-              ifaces="$ifaces''${ifaces:+ -N} -i$i"
+            UEVENT_PATH=/sys/class/net/$i/uevent
+            if [ -e "$UEVENT_PATH" ]; then
+              source "$UEVENT_PATH"
+              if [ "$DEVTYPE" = "wlan" -o -e /sys/class/net/$i/wireless ]; then
+                ifaces="$ifaces''${ifaces:+ -N} -i$i"
+              fi
            fi
          done
        '' else ''
--- a/nixos/modules/services/web-apps/matomo-doc.xml
+++ b/nixos/modules/services/web-apps/matomo-doc.xml
@ -84,12 +84,6 @@ GRANT ALL PRIVILEGES ON matomo.* TO 'matomo'@'localhost';
  <title>Issues</title>

  <itemizedlist>
-   <listitem>
-    <para>
-     Matomo's file integrity check will warn you. This is due to the patches
-     necessary for NixOS, you can safely ignore this.
-    </para>
-   </listitem>
   <listitem>
    <para>
     Matomo will warn you that the JavaScript tracker is not writable. This is
--- a/nixos/modules/services/x11/display-managers/gdm.nix
+++ b/nixos/modules/services/x11/display-managers/gdm.nix
@ -126,11 +126,21 @@ in
      wayland = mkOption {
        default = true;
        description = ''
-          Allow GDM run on Wayland instead of Xserver
+          Allow GDM to run on Wayland instead of Xserver.
+          Note to enable Wayland with Nvidia you need to
+          enable the <option>nvidiaWayland</option>.
        '';
        type = types.bool;
      };

+      nvidiaWayland = mkOption {
+        default = false;
+        description = ''
+          Whether to allow wayland to be used with the proprietary
+          NVidia graphics driver.
+        '';
+      };
+
      autoSuspend = mkOption {
        default = true;
        description = ''
@ -237,6 +247,19 @@ in

    services.dbus.packages = [ gdm ];

+    # We duplicate upstream's udev rules manually to make wayland with nvidia configurable
+    services.udev.extraRules = ''
+      # disable Wayland on Cirrus chipsets
+      ATTR{vendor}=="0x1013", ATTR{device}=="0x00b8", ATTR{subsystem_vendor}=="0x1af4", ATTR{subsystem_device}=="0x1100", RUN+="${gdm}/libexec/gdm-disable-wayland"
+      # disable Wayland on Hi1710 chipsets
+      ATTR{vendor}=="0x19e5", ATTR{device}=="0x1711", RUN+="${gdm}/libexec/gdm-disable-wayland"
+      ${optionalString (!cfg.gdm.nvidiaWayland) ''
+        DRIVER=="nvidia", RUN+="${gdm}/libexec/gdm-disable-wayland"
+      ''}
+      # disable Wayland when modesetting is disabled
+      IMPORT{cmdline}="nomodeset", RUN+="${gdm}/libexec/gdm-disable-wayland"
+    '';
+
    systemd.user.services.dbus.wantedBy = [ "default.target" ];

    programs.dconf.profiles.gdm =
--- a/nixos/modules/system/activation/switch-to-configuration.pl
+++ b/nixos/modules/system/activation/switch-to-configuration.pl
@ -214,7 +214,17 @@ while (my ($unit, $state) = each %{$activePrev}) {
                # Reload the changed mount unit to force a remount.
                $unitsToReload{$unit} = 1;
                recordUnit($reloadListFile, $unit);
-            } elsif ($unit =~ /\.socket$/ || $unit =~ /\.path$/ || $unit =~ /\.slice$/) {
+            } elsif ($unit =~ /\.socket$/) {
+                my $unitInfo = parseUnit($newUnitFile);
+                # If a socket unit has been changed, the corresponding
+                # service unit has to be stopped before the socket can
+                # be restarted. The service will be started again on demand.
+                my $serviceUnit = $unitInfo->{'Unit'} // "$baseName.service";
+                $unitsToStop{$serviceUnit} = 1;
+                $unitsToStop{$unit} = 1;
+                $unitsToStart{$unit} = 1;
+                recordUnit($startListFile, $unit);
+            } elsif ($unit =~ /\.path$/ || $unit =~ /\.slice$/) {
                # FIXME: do something?
            } else {
                my $unitInfo = parseUnit($newUnitFile);
--- a/nixos/release-combined.nix
+++ b/nixos/release-combined.nix
@ -63,8 +63,7 @@ in rec {

        #(all nixos.tests.containers)
        (all nixos.tests.containers-imperative)
-        (all nixos.tests.containers-ipv4)
-        (all nixos.tests.containers-ipv6)
+        (all nixos.tests.containers-ip)
        nixos.tests.chromium.x86_64-linux or []
        (all nixos.tests.firefox)
        (all nixos.tests.firewall)
--- a/nixos/release-small.nix
+++ b/nixos/release-small.nix
@ -32,8 +32,7 @@ in rec {
    tests = {
      inherit (nixos'.tests)
        containers-imperative
-        containers-ipv4
-        containers-ipv6
+        containers-ip
        firewall
        ipv6
        login
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -53,8 +53,7 @@ in
  containers-extra_veth = handleTest ./containers-extra_veth.nix {};
  containers-hosts = handleTest ./containers-hosts.nix {};
  containers-imperative = handleTest ./containers-imperative.nix {};
-  containers-ipv4 = handleTest ./containers-ipv4.nix {};
-  containers-ipv6 = handleTest ./containers-ipv6.nix {};
+  containers-ip = handleTest ./containers-ip.nix {};
  containers-macvlans = handleTest ./containers-macvlans.nix {};
  containers-physical_interfaces = handleTest ./containers-physical_interfaces.nix {};
  containers-restart_networking = handleTest ./containers-restart_networking.nix {};
--- a/nixos/tests/containers-bridge.nix
+++ b/nixos/tests/containers-bridge.nix
@ -7,7 +7,7 @@ let
  containerIp6 = "fc00::2/7";
 in

-import ./make-test.nix ({ pkgs, ...} : {
+import ./make-test-python.nix ({ pkgs, ...} : {
  name = "containers-bridge";
  meta = with pkgs.stdenv.lib.maintainers; {
    maintainers = [ aristid aszlig eelco kampfschlaefer ];
@ -61,43 +61,42 @@ import ./make-test.nix ({ pkgs, ...} : {
      virtualisation.pathsInNixDB = [ pkgs.stdenv ];
    };

-  testScript =
-    ''
-      $machine->waitForUnit("default.target");
-      $machine->succeed("nixos-container list") =~ /webserver/ or die;
+  testScript = ''
+    machine.wait_for_unit("default.target")
+    assert "webserver" in machine.succeed("nixos-container list")

-      # Start the webserver container.
-      $machine->succeed("nixos-container status webserver") =~ /up/ or die;
+    with subtest("Start the webserver container"):
+        assert "up" in machine.succeed("nixos-container status webserver")

-      # Check if bridges exist inside containers
-      $machine->succeed("nixos-container run webserver -- ip link show eth0");
-      $machine->succeed("nixos-container run web-noip -- ip link show eth0");
+    with subtest("Bridges exist inside containers"):
+        machine.succeed(
+            "nixos-container run webserver -- ip link show eth0",
+            "nixos-container run web-noip -- ip link show eth0",
+        )

-      "${containerIp}" =~ /([^\/]+)\/([0-9+])/;
-      my $ip = $1;
-      chomp $ip;
-      $machine->succeed("ping -n -c 1 $ip");
-      $machine->succeed("curl --fail http://$ip/ > /dev/null");
+    ip = "${containerIp}".split("/")[0]
+    machine.succeed(f"ping -n -c 1 {ip}")
+    machine.succeed(f"curl --fail http://{ip}/ > /dev/null")

-      "${containerIp6}" =~ /([^\/]+)\/([0-9+])/;
-      my $ip6 = $1;
-      chomp $ip6;
-      $machine->succeed("ping -n -c 1 $ip6");
-      $machine->succeed("curl --fail http://[$ip6]/ > /dev/null");
+    ip6 = "${containerIp6}".split("/")[0]
+    machine.succeed(f"ping -n -c 1 {ip6}")
+    machine.succeed(f"curl --fail http://[{ip6}]/ > /dev/null")

-      # Check that nixos-container show-ip works in case of an ipv4 address with
-      # subnetmask in CIDR notation.
-      my $result = $machine->succeed("nixos-container show-ip webserver");
-      chomp $result;
-      $result eq $ip or die;
+    with subtest(
+        "nixos-container show-ip works in case of an ipv4 address "
+        + "with subnetmask in CIDR notation."
+    ):
+        result = machine.succeed("nixos-container show-ip webserver").rstrip()
+        assert result == ip

-      # Stop the container.
-      $machine->succeed("nixos-container stop webserver");
-      $machine->fail("curl --fail --connect-timeout 2 http://$ip/ > /dev/null");
-      $machine->fail("curl --fail --connect-timeout 2 http://[$ip6]/ > /dev/null");
-
-      # Destroying a declarative container should fail.
-      $machine->fail("nixos-container destroy webserver");
-    '';
+    with subtest("Stop the container"):
+        machine.succeed("nixos-container stop webserver")
+        machine.fail(
+            f"curl --fail --connect-timeout 2 http://{ip}/ > /dev/null",
+            f"curl --fail --connect-timeout 2 http://[{ip6}]/ > /dev/null",
+        )

+    # Destroying a declarative container should fail.
+    machine.fail("nixos-container destroy webserver")
+  '';
 })
--- a/nixos/tests/containers-ephemeral.nix
+++ b/nixos/tests/containers-ephemeral.nix
@ -1,6 +1,6 @@
 # Test for NixOS' container support.

-import ./make-test.nix ({ pkgs, ...} : {
+import ./make-test-python.nix ({ pkgs, ...} : {
  name = "containers-ephemeral";

  machine = { pkgs, ... }: {
@ -16,10 +16,10 @@ import ./make-test.nix ({ pkgs, ...} : {
        services.nginx = {
          enable = true;
          virtualHosts.localhost = {
-            root = (pkgs.runCommand "localhost" {} ''
+            root = pkgs.runCommand "localhost" {} ''
              mkdir "$out"
              echo hello world > "$out/index.html"
-            '');
+            '';
          };
        };
        networking.firewall.allowedTCPPorts = [ 80 ];
@ -28,29 +28,27 @@ import ./make-test.nix ({ pkgs, ...} : {
  };

  testScript = ''
-    $machine->succeed("nixos-container list") =~ /webserver/ or die;
+    assert "webserver" in machine.succeed("nixos-container list")

-    # Start the webserver container.
-    $machine->succeed("nixos-container start webserver");
+    machine.succeed("nixos-container start webserver")

-    # Check that container got its own root folder
-    $machine->succeed("ls /run/containers/webserver");
+    with subtest("Container got its own root folder"):
+        machine.succeed("ls /run/containers/webserver")

-    # Check that container persistent directory is not created
-    $machine->fail("ls /var/lib/containers/webserver");
+    with subtest("Container persistent directory is not created"):
+        machine.fail("ls /var/lib/containers/webserver")

    # Since "start" returns after the container has reached
    # multi-user.target, we should now be able to access it.
-    my $ip = $machine->succeed("nixos-container show-ip webserver");
-    chomp $ip;
-    $machine->succeed("ping -n -c1 $ip");
-    $machine->succeed("curl --fail http://$ip/ > /dev/null");
+    ip = machine.succeed("nixos-container show-ip webserver").rstrip()
+    machine.succeed(f"ping -n -c1 {ip}")
+    machine.succeed(f"curl --fail http://{ip}/ > /dev/null")

-    # Stop the container.
-    $machine->succeed("nixos-container stop webserver");
-    $machine->fail("curl --fail --connect-timeout 2 http://$ip/ > /dev/null");
+    with subtest("Stop the container"):
+        machine.succeed("nixos-container stop webserver")
+        machine.fail(f"curl --fail --connect-timeout 2 http://{ip}/ > /dev/null")

-    # Check that container's root folder was removed
-    $machine->fail("ls /run/containers/webserver");
+    with subtest("Container's root folder was removed"):
+        machine.fail("ls /run/containers/webserver")
  '';
 })
--- a/nixos/tests/containers-hosts.nix
+++ b/nixos/tests/containers-hosts.nix
@ -1,6 +1,6 @@
 # Test for NixOS' container support.

-import ./make-test.nix ({ pkgs, ...} : {
+import ./make-test-python.nix ({ pkgs, ...} : {
  name = "containers-hosts";
  meta = with pkgs.stdenv.lib.maintainers; {
    maintainers = [ montag451 ];
@ -42,11 +42,11 @@ import ./make-test.nix ({ pkgs, ...} : {
    };

  testScript = ''
-    startAll;
-    $machine->waitForUnit("default.target");
+    start_all()
+    machine.wait_for_unit("default.target")

-    # Ping the containers using the entries added in /etc/hosts
-    $machine->succeed("ping -n -c 1 simple.containers");
-    $machine->succeed("ping -n -c 1 netmask.containers");
+    with subtest("Ping the containers using the entries added in /etc/hosts"):
+        for host in "simple.containers", "netmask.containers":
+            machine.succeed(f"ping -n -c 1 {host}")
  '';
 })
--- a/nixos/tests/containers-imperative.nix
+++ b/nixos/tests/containers-imperative.nix
@ -1,6 +1,6 @@
 # Test for NixOS' container support.

-import ./make-test.nix ({ pkgs, ...} : {
+import ./make-test-python.nix ({ pkgs, ...} : {
  name = "containers-imperative";
  meta = with pkgs.stdenv.lib.maintainers; {
    maintainers = [ aristid aszlig eelco kampfschlaefer ];
@ -36,95 +36,99 @@ import ./make-test.nix ({ pkgs, ...} : {
    };

  testScript = let
-    tmpfilesContainerConfig = pkgs.writeText "container-config-tmpfiles" ''
-      {
-        systemd.tmpfiles.rules = [ "d /foo - - - - -" ];
-        systemd.services.foo = {
-          serviceConfig.Type = "oneshot";
-          script = "ls -al /foo";
-          wantedBy = [ "multi-user.target" ];
-        };
-      }
-    ''; in
-    ''
-      # Make sure we have a NixOS tree (required by ‘nixos-container create’).
-      $machine->succeed("PAGER=cat nix-env -qa -A nixos.hello >&2");
+      tmpfilesContainerConfig = pkgs.writeText "container-config-tmpfiles" ''
+        {
+          systemd.tmpfiles.rules = [ "d /foo - - - - -" ];
+          systemd.services.foo = {
+            serviceConfig.Type = "oneshot";
+            script = "ls -al /foo";
+            wantedBy = [ "multi-user.target" ];
+          };
+        }
+      '';
+    in ''
+      with subtest("Make sure we have a NixOS tree (required by ‘nixos-container create’)"):
+          machine.succeed("PAGER=cat nix-env -qa -A nixos.hello >&2")

-      # Create some containers imperatively.
-      my $id1 = $machine->succeed("nixos-container create foo --ensure-unique-name");
-      chomp $id1;
-      $machine->log("created container $id1");
+      id1, id2 = None, None

-      my $id2 = $machine->succeed("nixos-container create foo --ensure-unique-name");
-      chomp $id2;
-      $machine->log("created container $id2");
+      with subtest("Create some containers imperatively"):
+          id1 = machine.succeed("nixos-container create foo --ensure-unique-name").rstrip()
+          machine.log(f"created container {id1}")

-      die if $id1 eq $id2;
+          id2 = machine.succeed("nixos-container create foo --ensure-unique-name").rstrip()
+          machine.log(f"created container {id2}")

-      # Put the root of $id2 into a bind mount.
-      $machine->succeed(
-        "mv /var/lib/containers/$id2 /id2-bindmount",
-        "mount --bind /id2-bindmount /var/lib/containers/$id1"
-      );
+          assert id1 != id2

-      my $ip1 = $machine->succeed("nixos-container show-ip $id1");
-      chomp $ip1;
-      my $ip2 = $machine->succeed("nixos-container show-ip $id2");
-      chomp $ip2;
-      die if $ip1 eq $ip2;
+      with subtest(f"Put the root of {id2} into a bind mount"):
+          machine.succeed(
+              f"mv /var/lib/containers/{id2} /id2-bindmount",
+              f"mount --bind /id2-bindmount /var/lib/containers/{id1}",
+          )

-      # Create a directory and a file we can later check if it still exists
-      # after destruction of the container.
-      $machine->succeed(
-        "mkdir /nested-bindmount",
-        "echo important data > /nested-bindmount/dummy",
-      );
+          ip1 = machine.succeed(f"nixos-container show-ip {id1}").rstrip()
+          ip2 = machine.succeed(f"nixos-container show-ip {id2}").rstrip()
+          assert ip1 != ip2

-      # Create a directory with a dummy file and bind-mount it into both
-      # containers.
-      foreach ($id1, $id2) {
-        my $importantPath = "/var/lib/containers/$_/very/important/data";
-        $machine->succeed(
-          "mkdir -p $importantPath",
-          "mount --bind /nested-bindmount $importantPath"
-        );
-      }
+      with subtest(
+          "Create a directory and a file we can later check if it still exists "
+          + "after destruction of the container"
+      ):
+          machine.succeed("mkdir /nested-bindmount")
+          machine.succeed("echo important data > /nested-bindmount/dummy")

-      # Start one of them.
-      $machine->succeed("nixos-container start $id1");
+      with subtest(
+          "Create a directory with a dummy file and bind-mount it into both containers."
+      ):
+          for id in id1, id2:
+              important_path = f"/var/lib/containers/{id}/very/important/data"
+              machine.succeed(
+                  f"mkdir -p {important_path}",
+                  f"mount --bind /nested-bindmount {important_path}",
+              )

-      # Execute commands via the root shell.
-      $machine->succeed("nixos-container run $id1 -- uname") =~ /Linux/ or die;
+      with subtest("Start one of them"):
+          machine.succeed(f"nixos-container start {id1}")

-      # Execute a nix command via the root shell. (regression test for #40355)
-      $machine->succeed("nixos-container run $id1 -- nix-instantiate -E 'derivation { name = \"empty\"; builder = \"false\"; system = \"false\"; }'");
+      with subtest("Execute commands via the root shell"):
+          assert "Linux" in machine.succeed(f"nixos-container run {id1} -- uname")

-      # Stop and start (regression test for #4989)
-      $machine->succeed("nixos-container stop $id1");
-      $machine->succeed("nixos-container start $id1");
+      with subtest("Execute a nix command via the root shell. (regression test for #40355)"):
+          machine.succeed(
+              f"nixos-container run {id1} -- nix-instantiate -E "
+              + '\'derivation { name = "empty"; builder = "false"; system = "false"; }\' '
+          )

-      # Ensure tmpfiles are present
-      $machine->log("creating container tmpfiles");
-      $machine->succeed("nixos-container create tmpfiles --config-file ${tmpfilesContainerConfig}");
-      $machine->log("created, starting…");
-      $machine->succeed("nixos-container start tmpfiles");
-      $machine->log("done starting, investigating…");
-      $machine->succeed("echo \$(nixos-container run tmpfiles -- systemctl is-active foo.service) | grep -q active;");
-      $machine->succeed("nixos-container destroy tmpfiles");
+      with subtest("Stop and start (regression test for #4989)"):
+          machine.succeed(f"nixos-container stop {id1}")
+          machine.succeed(f"nixos-container start {id1}")

-      # Execute commands via the root shell.
-      $machine->succeed("nixos-container run $id1 -- uname") =~ /Linux/ or die;
+      with subtest("tmpfiles are present"):
+          machine.log("creating container tmpfiles")
+          machine.succeed(
+              "nixos-container create tmpfiles --config-file ${tmpfilesContainerConfig}"
+          )
+          machine.log("created, starting…")
+          machine.succeed("nixos-container start tmpfiles")
+          machine.log("done starting, investigating…")
+          machine.succeed(
+              "echo $(nixos-container run tmpfiles -- systemctl is-active foo.service) | grep -q active;"
+          )
+          machine.succeed("nixos-container destroy tmpfiles")

-      # Destroy the containers.
-      $machine->succeed("nixos-container destroy $id1");
-      $machine->succeed("nixos-container destroy $id2");
+      with subtest("Execute commands via the root shell"):
+          assert "Linux" in machine.succeed(f"nixos-container run {id1} -- uname")

-      $machine->succeed(
-        # Check whether destruction of any container has killed important data
-        "grep -qF 'important data' /nested-bindmount/dummy",
-        # Ensure that the container path is gone
-        "test ! -e /var/lib/containers/$id1"
-      );
+      with subtest("Destroy the containers"):
+          for id in id1, id2:
+              machine.succeed(f"nixos-container destroy {id}")
+
+      with subtest("Check whether destruction of any container has killed important data"):
+          machine.succeed("grep -qF 'important data' /nested-bindmount/dummy")
+
+      with subtest("Ensure that the container path is gone"):
+          print(machine.succeed("ls -lsa /var/lib/containers"))
+          machine.succeed(f"test ! -e /var/lib/containers/{id1}")
    '';
-
 })
--- a/nixos/tests/containers-ip.nix
+++ b/nixos/tests/containers-ip.nix
@ -0,0 +1,77 @@
+# Test for NixOS' container support.
+
+let
+  webserverFor = hostAddress: localAddress: {
+    inherit hostAddress localAddress;
+    privateNetwork = true;
+    config = {
+      services.httpd = {
+        enable = true;
+        adminAddr = "foo@example.org";
+      };
+      networking.firewall.allowedTCPPorts = [ 80 ];
+    };
+  };
+
+in import ./make-test-python.nix ({ pkgs, ...} : {
+  name = "containers-ipv4-ipv6";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ aristid aszlig eelco kampfschlaefer ];
+  };
+
+  machine =
+    { pkgs, ... }: {
+      imports = [ ../modules/installer/cd-dvd/channel.nix ];
+      virtualisation = {
+        writableStore = true;
+        memorySize = 768;
+      };
+
+      containers.webserver4 = webserverFor "10.231.136.1" "10.231.136.2";
+      containers.webserver6 = webserverFor "fc00::2" "fc00::1";
+      virtualisation.pathsInNixDB = [ pkgs.stdenv ];
+    };
+
+  testScript = { nodes, ... }: ''
+    import time
+
+
+    def curl_host(ip):
+        # put [] around ipv6 addresses for curl
+        host = ip if ":" not in ip else f"[{ip}]"
+        return f"curl --fail --connect-timeout 2 http://{host}/ > /dev/null"
+
+
+    def get_ip(container):
+        # need to distinguish because show-ip won't work for ipv6
+        if container == "webserver4":
+            ip = machine.succeed(f"nixos-container show-ip {container}").rstrip()
+            assert ip == "${nodes.machine.config.containers.webserver4.localAddress}"
+            return ip
+        return "${nodes.machine.config.containers.webserver6.localAddress}"
+
+
+    for container in "webserver4", "webserver6":
+        assert container in machine.succeed("nixos-container list")
+
+        with subtest(f"Start container {container}"):
+            machine.succeed(f"nixos-container start {container}")
+            # wait 2s for container to start and network to be up
+            time.sleep(2)
+
+        # Since "start" returns after the container has reached
+        # multi-user.target, we should now be able to access it.
+
+        ip = get_ip(container)
+        with subtest(f"{container} reacts to pings and HTTP requests"):
+            machine.succeed(f"ping -n -c1 {ip}")
+            machine.succeed(curl_host(ip))
+
+        with subtest(f"Stop container {container}"):
+            machine.succeed(f"nixos-container stop {container}")
+            machine.fail(curl_host(ip))
+
+        # Destroying a declarative container should fail.
+        machine.fail(f"nixos-container destroy {container}")
+  '';
+})
--- a/nixos/tests/containers-ipv4.nix
+++ b/nixos/tests/containers-ipv4.nix
@ -1,55 +0,0 @@
-# Test for NixOS' container support.
-
-import ./make-test.nix ({ pkgs, ...} : {
-  name = "containers-ipv4";
-  meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = [ aristid aszlig eelco kampfschlaefer ];
-  };
-
-  machine =
-    { pkgs, ... }:
-    { imports = [ ../modules/installer/cd-dvd/channel.nix ];
-      virtualisation.writableStore = true;
-      virtualisation.memorySize = 768;
-
-      containers.webserver =
-        { privateNetwork = true;
-          hostAddress = "10.231.136.1";
-          localAddress = "10.231.136.2";
-          config =
-            { services.httpd.enable = true;
-              services.httpd.adminAddr = "foo@example.org";
-              networking.firewall.allowedTCPPorts = [ 80 ];
-              system.stateVersion = "18.03";
-            };
-        };
-
-      virtualisation.pathsInNixDB = [ pkgs.stdenv ];
-    };
-
-  testScript =
-    ''
-      $machine->succeed("nixos-container list") =~ /webserver/ or die;
-
-      # Start the webserver container.
-      $machine->succeed("nixos-container start webserver");
-
-      # wait two seconds for the container to start and the network to be up
-      sleep 2;
-
-      # Since "start" returns after the container has reached
-      # multi-user.target, we should now be able to access it.
-      my $ip = $machine->succeed("nixos-container show-ip webserver");
-      chomp $ip;
-      $machine->succeed("ping -n -c1 $ip");
-      $machine->succeed("curl --fail http://$ip/ > /dev/null");
-
-      # Stop the container.
-      $machine->succeed("nixos-container stop webserver");
-      $machine->fail("curl --fail --connect-timeout 2 http://$ip/ > /dev/null");
-
-      # Destroying a declarative container should fail.
-      $machine->fail("nixos-container destroy webserver");
-    '';
-
-})
--- a/nixos/tests/containers-ipv6.nix
+++ b/nixos/tests/containers-ipv6.nix
@ -1,60 +0,0 @@
-# Test for NixOS' container support.
-
-let
-  hostIp = "fc00::2";
-  localIp = "fc00::1";
-in
-
-import ./make-test.nix ({ pkgs, ...} : {
-  name = "containers-ipv6";
-  meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = [ aristid aszlig eelco kampfschlaefer ];
-  };
-
-  machine =
-    { pkgs, ... }:
-    { imports = [ ../modules/installer/cd-dvd/channel.nix ];
-      virtualisation.writableStore = true;
-      virtualisation.memorySize = 768;
-
-      containers.webserver =
-        { privateNetwork = true;
-          hostAddress6 = hostIp;
-          localAddress6 = localIp;
-          config =
-            { services.httpd.enable = true;
-              services.httpd.adminAddr = "foo@example.org";
-              networking.firewall.allowedTCPPorts = [ 80 ];
-            };
-        };
-
-      virtualisation.pathsInNixDB = [ pkgs.stdenv ];
-    };
-
-  testScript =
-    ''
-      $machine->waitForUnit("default.target");
-      $machine->succeed("nixos-container list") =~ /webserver/ or die;
-
-      # Start the webserver container.
-      $machine->succeed("nixos-container start webserver");
-
-      # wait two seconds for the container to start and the network to be up
-      sleep 2;
-
-      # Since "start" returns after the container has reached
-      # multi-user.target, we should now be able to access it.
-      my $ip = "${localIp}";
-      chomp $ip;
-      $machine->succeed("ping -n -c 1 $ip");
-      $machine->succeed("curl --fail http://[$ip]/ > /dev/null");
-
-      # Stop the container.
-      $machine->succeed("nixos-container stop webserver");
-      $machine->fail("curl --fail --connect-timeout 2 http://[$ip]/ > /dev/null");
-
-      # Destroying a declarative container should fail.
-      $machine->fail("nixos-container destroy webserver");
-    '';
-
-})
--- a/nixos/tests/containers-reloadable.nix
+++ b/nixos/tests/containers-reloadable.nix
@ -1,7 +1,7 @@
-import ./make-test.nix ({ pkgs, lib, ...} :
+import ./make-test-python.nix ({ pkgs, lib, ...} :
 let
  client_base = {
-    
+
    containers.test1 = {
      autoStart = true;
      config = {
@ -48,18 +48,25 @@ in {
    c1System = nodes.client_c1.config.system.build.toplevel;
    c2System = nodes.client_c2.config.system.build.toplevel;
  in ''
-    $client->start();
-    $client->waitForUnit("default.target");
-    $client->succeed("[[ \$(nixos-container run test1 cat /etc/check) == client_base ]] >&2");
+    client.start()
+    client.wait_for_unit("default.target")

-    $client->succeed("${c1System}/bin/switch-to-configuration test >&2");
-    $client->succeed("[[ \$(nixos-container run test1 cat /etc/check) == client_c1 ]] >&2");
-    $client->succeed("systemctl status httpd -M test1 >&2");
+    assert "client_base" in client.succeed("nixos-container run test1 cat /etc/check")

-    $client->succeed("${c2System}/bin/switch-to-configuration test >&2");
-    $client->succeed("[[ \$(nixos-container run test1 cat /etc/check) == client_c2 ]] >&2");
-    $client->fail("systemctl status httpd -M test1 >&2");
-    $client->succeed("systemctl status nginx -M test1 >&2");
+    with subtest("httpd is available after activating config1"):
+        client.succeed(
+            "${c1System}/bin/switch-to-configuration test >&2",
+            "[[ $(nixos-container run test1 cat /etc/check) == client_c1 ]] >&2",
+            "systemctl status httpd -M test1 >&2",
+        )
+
+    with subtest("httpd is not available any longer after switching to config2"):
+        client.succeed(
+            "${c2System}/bin/switch-to-configuration test >&2",
+            "[[ $(nixos-container run test1 cat /etc/check) == client_c2 ]] >&2",
+            "systemctl status nginx -M test1 >&2",
+        )
+        client.fail("systemctl status httpd -M test1 >&2")
  '';

 })
--- a/nixos/tests/containers-tmpfs.nix
+++ b/nixos/tests/containers-tmpfs.nix
@ -1,6 +1,6 @@
 # Test for NixOS' container support.

-import ./make-test.nix ({ pkgs, ...} : {
+import ./make-test-python.nix ({ pkgs, ...} : {
  name = "containers-tmpfs";
  meta = with pkgs.stdenv.lib.maintainers; {
    maintainers = [ kampka ];
@ -31,49 +31,63 @@ import ./make-test.nix ({ pkgs, ...} : {
      virtualisation.pathsInNixDB = [ pkgs.stdenv ];
    };

-  testScript =
-    ''
-      $machine->waitForUnit("default.target");
-      $machine->succeed("nixos-container list") =~ /tmpfs/ or die;
+  testScript = ''
+      machine.wait_for_unit("default.target")
+      assert "tmpfs" in machine.succeed("nixos-container list")

-      # Start the tmpfs container.
-      #$machine->succeed("nixos-container status tmpfs") =~ /up/ or die;
-
-      # Verify that /var is mounted as a tmpfs
-      #$machine->succeed("nixos-container run tmpfs -- systemctl status var.mount --no-pager 2>/dev/null") =~ /What: tmpfs/ or die;
-      $machine->succeed("nixos-container run tmpfs -- mountpoint -q /var 2>/dev/null");
-
-      # Verify that /var/log is mounted as a tmpfs
-      $machine->succeed("nixos-container run tmpfs -- systemctl status var-log.mount --no-pager 2>/dev/null") =~ /What: tmpfs/ or die;
-      $machine->succeed("nixos-container run tmpfs -- mountpoint -q /var/log 2>/dev/null");
-
-      # Verify that /some/random/path is mounted as a tmpfs
-      $machine->succeed("nixos-container run tmpfs -- systemctl status some-random-path.mount --no-pager 2>/dev/null") =~ /What: tmpfs/ or die;
-      $machine->succeed("nixos-container run tmpfs -- mountpoint -q /some/random/path 2>/dev/null");
-
-      # Verify that files created in the container in a non-tmpfs directory are visible on the host.
-      # This establishes legitimacy for the following tests
-      $machine->succeed("nixos-container run tmpfs -- touch /root/test.file 2>/dev/null");
-      $machine->succeed("nixos-container run tmpfs -- ls -l  /root | grep -q test.file 2>/dev/null");
-      $machine->succeed("test -e /var/lib/containers/tmpfs/root/test.file");
+      with subtest("tmpfs container is up"):
+          assert "up" in machine.succeed("nixos-container status tmpfs")


-      # Verify that /some/random/path is writable and that files created there
-      # are not in the hosts container dir but in the tmpfs
-      $machine->succeed("nixos-container run tmpfs -- touch /some/random/path/test.file 2>/dev/null");
-      $machine->succeed("nixos-container run tmpfs -- test -e /some/random/path/test.file 2>/dev/null");
+      def tmpfs_cmd(command):
+          return f"nixos-container run tmpfs -- {command} 2>/dev/null"

-      $machine->fail("test -e /var/lib/containers/tmpfs/some/random/path/test.file");

-      # Verify that files created in the hosts container dir in a path where a tmpfs file system has been mounted
-      # are not visible to the container as the do not exist in the tmpfs
-      $machine->succeed("touch /var/lib/containers/tmpfs/var/test.file");
+      with subtest("/var is mounted as a tmpfs"):
+          machine.succeed(tmpfs_cmd("mountpoint -q /var"))

-      $machine->succeed("test -e /var/lib/containers/tmpfs/var/test.file");
-      $machine->succeed("ls -l /var/lib/containers/tmpfs/var/ | grep -q test.file 2>/dev/null");
+      with subtest("/var/log is mounted as a tmpfs"):
+          assert "What: tmpfs" in machine.succeed(
+              tmpfs_cmd("systemctl status var-log.mount --no-pager")
+          )
+          machine.succeed(tmpfs_cmd("mountpoint -q /var/log"))

-      $machine->fail("nixos-container run tmpfs -- ls -l /var | grep -q test.file 2>/dev/null");
+      with subtest("/some/random/path is mounted as a tmpfs"):
+          assert "What: tmpfs" in machine.succeed(
+              tmpfs_cmd("systemctl status some-random-path.mount --no-pager")
+          )
+          machine.succeed(tmpfs_cmd("mountpoint -q /some/random/path"))

+      with subtest(
+          "files created in the container in a non-tmpfs directory are visible on the host."
+      ):
+          # This establishes legitimacy for the following tests
+          machine.succeed(
+              tmpfs_cmd("touch /root/test.file"),
+              tmpfs_cmd("ls -l  /root | grep -q test.file"),
+              "test -e /var/lib/containers/tmpfs/root/test.file",
+          )
+
+      with subtest(
+          "/some/random/path is writable and that files created there are not "
+          + "in the hosts container dir but in the tmpfs"
+      ):
+          machine.succeed(
+              tmpfs_cmd("touch /some/random/path/test.file"),
+              tmpfs_cmd("test -e /some/random/path/test.file"),
+          )
+          machine.fail("test -e /var/lib/containers/tmpfs/some/random/path/test.file")
+
+      with subtest(
+          "files created in the hosts container dir in a path where a tmpfs "
+          + "file system has been mounted are not visible to the container as "
+          + "the do not exist in the tmpfs"
+      ):
+          machine.succeed(
+              "touch /var/lib/containers/tmpfs/var/test.file",
+              "test -e /var/lib/containers/tmpfs/var/test.file",
+              "ls -l /var/lib/containers/tmpfs/var/ | grep -q test.file 2>/dev/null",
+          )
+          machine.fail(tmpfs_cmd("ls -l /var | grep -q test.file"))
    '';
-
 })
--- a/nixos/tests/iftop.nix
+++ b/nixos/tests/iftop.nix
@ -1,4 +1,4 @@
-import ./make-test.nix ({ pkgs, lib, ... }:
+import ./make-test-python.nix ({ pkgs, lib, ... }:

 with lib;

@ -18,17 +18,16 @@ with lib;
  };

  testScript = ''
-    subtest "machine with iftop enabled", sub {
-      $withIftop->waitForUnit("default.target");
-      # limit to eth1 (eth0 is the test driver's control interface)
-      # and don't try name lookups
-      $withIftop->succeed("su -l alice -c 'iftop -t -s 1 -n -i eth1'");
-    };
-    subtest "machine without iftop", sub {
-      $withoutIftop->waitForUnit("default.target");
-      # check that iftop is there but user alice lacks capabilities
-      $withoutIftop->succeed("iftop -t -s 1 -n -i eth1");
-      $withoutIftop->fail("su -l alice -c 'iftop -t -s 1 -n -i eth1'");
-    };
+    with subtest("machine with iftop enabled"):
+        withIftop.wait_for_unit("default.target")
+        # limit to eth1 (eth0 is the test driver's control interface)
+        # and don't try name lookups
+        withIftop.succeed("su -l alice -c 'iftop -t -s 1 -n -i eth1'")
+
+    with subtest("machine without iftop"):
+        withoutIftop.wait_for_unit("default.target")
+        # check that iftop is there but user alice lacks capabilitie
+        withoutIftop.succeed("iftop -t -s 1 -n -i eth1")
+        withoutIftop.fail("su -l alice -c 'iftop -t -s 1 -n -i eth1'")
  '';
 })
--- a/nixos/tests/kernel-latest.nix
+++ b/nixos/tests/kernel-latest.nix
@ -1,4 +1,4 @@
-import ./make-test.nix ({ pkgs, ...} : {
+import ./make-test-python.nix ({ pkgs, ...} : {
  name = "kernel-latest";
  meta = with pkgs.stdenv.lib.maintainers; {
    maintainers = [ nequissimus ];
@ -11,7 +11,7 @@ import ./make-test.nix ({ pkgs, ...} : {

  testScript =
    ''
-      $machine->succeed("uname -s | grep 'Linux'");
-      $machine->succeed("uname -a | grep '${pkgs.linuxPackages_latest.kernel.version}'");
+      assert "Linux" in machine.succeed("uname -s")
+      assert "${pkgs.linuxPackages_latest.kernel.version}" in machine.succeed("uname -a")
    '';
 })
--- a/nixos/tests/kernel-lts.nix
+++ b/nixos/tests/kernel-lts.nix
@ -1,4 +1,4 @@
-import ./make-test.nix ({ pkgs, ...} : {
+import ./make-test-python.nix ({ pkgs, ...} : {
  name = "kernel-lts";
  meta = with pkgs.stdenv.lib.maintainers; {
    maintainers = [ nequissimus ];
@ -11,7 +11,7 @@ import ./make-test.nix ({ pkgs, ...} : {

  testScript =
    ''
-      $machine->succeed("uname -s | grep 'Linux'");
-      $machine->succeed("uname -a | grep '${pkgs.linuxPackages.kernel.version}'");
+      assert "Linux" in machine.succeed("uname -s")
+      assert "${pkgs.linuxPackages.kernel.version}" in machine.succeed("uname -a")
    '';
 })
--- a/nixos/tests/kernel-testing.nix
+++ b/nixos/tests/kernel-testing.nix
@ -1,4 +1,4 @@
-import ./make-test.nix ({ pkgs, ...} : {
+import ./make-test-python.nix ({ pkgs, ...} : {
  name = "kernel-testing";
  meta = with pkgs.stdenv.lib.maintainers; {
    maintainers = [ nequissimus ];
@ -11,7 +11,7 @@ import ./make-test.nix ({ pkgs, ...} : {

  testScript =
    ''
-      $machine->succeed("uname -s | grep 'Linux'");
-      $machine->succeed("uname -a | grep '${pkgs.linuxPackages_testing.kernel.modDirVersion}'");
+      assert "Linux" in machine.succeed("uname -s")
+      assert "${pkgs.linuxPackages_testing.kernel.modDirVersion}" in machine.succeed("uname -a")
    '';
 })
--- a/nixos/tests/memcached.nix
+++ b/nixos/tests/memcached.nix
@ -1,28 +1,24 @@
-import ./make-test.nix ({ pkgs, ...} : {
+import ./make-test-python.nix ({ pkgs, ... }: {
  name = "memcached";

-  nodes = {
-    machine =
-      { ... }:
-      {
-        imports = [ ../modules/profiles/minimal.nix ];
-        services.memcached.enable = true;
-      };
+  machine = {
+    imports = [ ../modules/profiles/minimal.nix ];
+    services.memcached.enable = true;
  };

  testScript = let
-    testScript = pkgs.writeScript "testScript.py" ''
-      #!${pkgs.python3.withPackages (p: [p.memcached])}/bin/python
-
+    testScript = pkgs.writers.writePython3 "test_memcache" {
+      libraries = with pkgs.python3Packages; [ memcached ];
+    } ''
      import memcache
      c = memcache.Client(['localhost:11211'])
      c.set('key', 'value')
      assert 'value' == c.get('key')
    '';
  in ''
-    startAll;
-    $machine->waitForUnit("memcached.service");
-    $machine->waitForOpenPort("11211");
-    $machine->succeed("${testScript}");
+    machine.start()
+    machine.wait_for_unit("memcached.service")
+    machine.wait_for_open_port(11211)
+    machine.succeed("${testScript}")
  '';
 })
--- a/nixos/tests/ndppd.nix
+++ b/nixos/tests/ndppd.nix
@ -1,4 +1,4 @@
-import ./make-test.nix ({ pkgs, lib, ...} : {
+import ./make-test-python.nix ({ pkgs, lib, ...} : {
  name = "ndppd";
  meta = with pkgs.stdenv.lib.maintainers; {
    maintainers = [ fpletz ];
@ -52,9 +52,9 @@ import ./make-test.nix ({ pkgs, lib, ...} : {
  };

  testScript = ''
-    startAll;
-    $server->waitForUnit("multi-user.target");
-    $upstream->waitForUnit("multi-user.target");
-    $upstream->waitUntilSucceeds("ping -c5 fd42::2");
+    start_all()
+    server.wait_for_unit("multi-user.target")
+    upstream.wait_for_unit("multi-user.target")
+    upstream.wait_until_succeeds("ping -c5 fd42::2")
  '';
 })
--- a/nixos/tests/nextcloud/basic.nix
+++ b/nixos/tests/nextcloud/basic.nix
@ -1,4 +1,4 @@
-import ../make-test.nix ({ pkgs, ...}: let
+import ../make-test-python.nix ({ pkgs, ...}: let
  adminpass = "notproduction";
  adminuser = "root";
 in {
@ -50,11 +50,15 @@ in {
      diff <(echo 'hi') <(${pkgs.rclone}/bin/rclone cat nextcloud:test-shared-file)
    '';
  in ''
-    startAll();
-    $nextcloud->waitForUnit("multi-user.target");
-    $nextcloud->succeed("curl -sSf http://nextcloud/login");
-    $nextcloud->succeed("${withRcloneEnv} ${copySharedFile}");
-    $client->waitForUnit("multi-user.target");
-    $client->succeed("${withRcloneEnv} ${diffSharedFile}");
+    start_all()
+    nextcloud.wait_for_unit("multi-user.target")
+    nextcloud.succeed("curl -sSf http://nextcloud/login")
+    nextcloud.succeed(
+        "${withRcloneEnv} ${copySharedFile}"
+    )
+    client.wait_for_unit("multi-user.target")
+    client.succeed(
+        "${withRcloneEnv} ${diffSharedFile}"
+    )
  '';
 })
--- a/nixos/tests/nextcloud/with-mysql-and-memcached.nix
+++ b/nixos/tests/nextcloud/with-mysql-and-memcached.nix
@ -1,4 +1,4 @@
-import ../make-test.nix ({ pkgs, ...}: let
+import ../make-test-python.nix ({ pkgs, ...}: let
  adminpass = "hunter2";
  adminuser = "root";
 in {
@ -85,13 +85,16 @@ in {
      diff <(echo 'hi') <(${pkgs.rclone}/bin/rclone cat nextcloud:test-shared-file)
    '';
  in ''
-    startAll();
-    $nextcloud->waitForUnit("multi-user.target");
-    $nextcloud->succeed("${configureMemcached}");
-    $nextcloud->succeed("curl -sSf http://nextcloud/login");
-    $nextcloud->succeed("${withRcloneEnv} ${copySharedFile}");
-    $client->waitForUnit("multi-user.target");
-    $client->succeed("${withRcloneEnv} ${diffSharedFile}");
-
+    start_all()
+    nextcloud.wait_for_unit("multi-user.target")
+    nextcloud.succeed("${configureMemcached}")
+    nextcloud.succeed("curl -sSf http://nextcloud/login")
+    nextcloud.succeed(
+        "${withRcloneEnv} ${copySharedFile}"
+    )
+    client.wait_for_unit("multi-user.target")
+    client.succeed(
+        "${withRcloneEnv} ${diffSharedFile}"
+    )
  '';
 })
--- a/nixos/tests/nextcloud/with-postgresql-and-redis.nix
+++ b/nixos/tests/nextcloud/with-postgresql-and-redis.nix
@ -1,4 +1,4 @@
-import ../make-test.nix ({ pkgs, ...}: let
+import ../make-test-python.nix ({ pkgs, ...}: let
  adminpass = "hunter2";
  adminuser = "custom-admin-username";
 in {
@ -85,12 +85,16 @@ in {
      diff <(echo 'hi') <(${pkgs.rclone}/bin/rclone cat nextcloud:test-shared-file)
    '';
  in ''
-    startAll();
-    $nextcloud->waitForUnit("multi-user.target");
-    $nextcloud->succeed("${configureRedis}");
-    $nextcloud->succeed("curl -sSf http://nextcloud/login");
-    $nextcloud->succeed("${withRcloneEnv} ${copySharedFile}");
-    $client->waitForUnit("multi-user.target");
-    $client->succeed("${withRcloneEnv} ${diffSharedFile}");
+    start_all()
+    nextcloud.wait_for_unit("multi-user.target")
+    nextcloud.succeed("${configureRedis}")
+    nextcloud.succeed("curl -sSf http://nextcloud/login")
+    nextcloud.succeed(
+        "${withRcloneEnv} ${copySharedFile}"
+    )
+    client.wait_for_unit("multi-user.target")
+    client.succeed(
+        "${withRcloneEnv} ${diffSharedFile}"
+    )
  '';
 })
--- a/nixos/tests/pantheon.nix
+++ b/nixos/tests/pantheon.nix
@ -28,7 +28,8 @@ import ./make-test-python.nix ({ pkgs, ...} :

    with subtest("Test we can see usernames in elementary-greeter"):
        machine.wait_for_text("${user.description}")
-        machine.wait_for_text("${bob.description}")
+        # OCR was struggling with this one.
+        # machine.wait_for_text("${bob.description}")
        machine.screenshot("elementary_greeter_lightdm")

    with subtest("Login with elementary-greeter"):
--- a/nixos/tests/rabbitmq.nix
+++ b/nixos/tests/rabbitmq.nix
@ -1,21 +1,21 @@
 # This test runs rabbitmq and checks if rabbitmq is up and running.

-import ./make-test.nix ({ pkgs, ... }: {
+import ./make-test-python.nix ({ pkgs, ... }: {
  name = "rabbitmq";
  meta = with pkgs.stdenv.lib.maintainers; {
    maintainers = [ eelco offline ];
  };

-  nodes = {
-    one = { ... }: {
-      services.rabbitmq.enable = true;
-    };
+  machine = {
+    services.rabbitmq.enable = true;
  };

  testScript = ''
-    startAll;
+    machine.start()

-    $one->waitForUnit("rabbitmq.service");
-    $one->waitUntilSucceeds("su -s ${pkgs.stdenv.shell} rabbitmq -c \"rabbitmqctl status\"");
+    machine.wait_for_unit("rabbitmq.service")
+    machine.wait_until_succeeds(
+        'su -s ${pkgs.stdenv.shell} rabbitmq -c "rabbitmqctl status"'
+    )
  '';
 })
--- a/nixos/tests/xmpp/ejabberd.nix
+++ b/nixos/tests/xmpp/ejabberd.nix
@ -1,4 +1,4 @@
-import ../make-test.nix ({ pkgs, ... }: {
+import ../make-test-python.nix ({ pkgs, ... }: {
  name = "ejabberd";
  meta = with pkgs.stdenv.lib.maintainers; {
    maintainers = [ ajs124 ];
@ -248,13 +248,21 @@ import ../make-test.nix ({ pkgs, ... }: {
  };

  testScript = { nodes, ... }: ''
-    $server->waitForUnit('ejabberd.service');
-    $server->succeed('su ejabberd -s $(which ejabberdctl) status|grep started') =~ /ejabberd is running/;
-    $server->succeed('su ejabberd -s $(which ejabberdctl) register azurediamond example.com hunter2');
-    $server->succeed('su ejabberd -s $(which ejabberdctl) register cthon98 example.com nothunter2');
-    $server->fail('su ejabberd -s $(which ejabberdctl) register asdf wrong.domain');
-    $client->succeed('send-message');
-    $server->succeed('su ejabberd -s $(which ejabberdctl) unregister cthon98 example.com');
-    $server->succeed('su ejabberd -s $(which ejabberdctl) unregister azurediamond example.com');
+    ejabberd_prefix = "su ejabberd -s $(which ejabberdctl) "
+
+    server.wait_for_unit("ejabberd.service")
+
+    assert "status: started" in server.succeed(ejabberd_prefix + "status")
+
+    server.succeed(
+        ejabberd_prefix + "register azurediamond example.com hunter2",
+        ejabberd_prefix + "register cthon98 example.com nothunter2",
+    )
+    server.fail(ejabberd_prefix + "register asdf wrong.domain")
+    client.succeed("send-message")
+    server.succeed(
+        ejabberd_prefix + "unregister cthon98 example.com",
+        ejabberd_prefix + "unregister azurediamond example.com",
+    )
  '';
 })
--- a/nixos/tests/xss-lock.nix
+++ b/nixos/tests/xss-lock.nix
@ -1,4 +1,4 @@
-import ./make-test.nix ({ pkgs, lib, ... }:
+import ./make-test-python.nix ({ pkgs, lib, ... }:

 with lib;

@ -26,15 +26,19 @@ with lib;
  };

  testScript = ''
-    startAll;
+    def perform_xsslock_test(machine, lockCmd):
+        machine.start()
+        machine.wait_for_x()
+        machine.wait_for_unit("xss-lock.service", "alice")
+        machine.fail(f"pgrep {lockCmd}")
+        machine.succeed("su -l alice -c 'xset dpms force standby'")
+        machine.wait_until_succeeds(f"pgrep {lockCmd}")

-    ${concatStringsSep "\n" (mapAttrsToList (name: lockCmd: ''
-      ${"$"+name}->start;
-      ${"$"+name}->waitForX;
-      ${"$"+name}->waitForUnit("xss-lock.service", "alice");
-      ${"$"+name}->fail("pgrep ${lockCmd}");
-      ${"$"+name}->succeed("su -l alice -c 'xset dpms force standby'");
-      ${"$"+name}->waitUntilSucceeds("pgrep ${lockCmd}");
-    '') { simple = "i3lock"; custom_lockcmd = "xlock"; })}
+
+    with subtest("simple"):
+        perform_xsslock_test(simple, "i3lock")
+
+    with subtest("custom_cmd"):
+        perform_xsslock_test(custom_lockcmd, "xlock")
  '';
 })
--- a/pkgs/applications/audio/bsequencer/default.nix
+++ b/pkgs/applications/audio/bsequencer/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "BSEQuencer";
-  version = "0.4";
+  version = "1.2.0";

  src = fetchFromGitHub {
    owner = "sjaehn";
    repo = pname;
-    rev = "v${version}";
-    sha256 = "0c3bm2z6z2bjjv1cy50383zr81h99rcb2frmxad0r7lhi27mjyqn";
+    rev = "${version}";
+    sha256 = "08xwz5v8wrar0rx7qdr9pkpjz2k9sw6bn5glhpn6sp6453fabf8q";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/applications/audio/bslizr/default.nix
+++ b/pkgs/applications/audio/bslizr/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "BSlizr";
-  version = "1.2.0";
+  version = "1.2.2";

  src = fetchFromGitHub {
    owner = "sjaehn";
    repo = pname;
    rev = "${version}";
-    sha256 = "1xqhpppfj47nzmyksbqgfvvi5j807g96hqla544w2f752zz4yi0s";
+    sha256 = "0q92ygz17iiriwzqylmaxd5ml2bhqy3n6c3f7g71n4hn9z3bl3s1";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/applications/audio/ncspot/default.nix
+++ b/pkgs/applications/audio/ncspot/default.nix
@ -11,17 +11,17 @@ let
    ++ lib.optional withPortAudio "portaudio_backend";
 in
 rustPlatform.buildRustPackage rec {
-  pname = "ncspot-unstable";
-  version = "2019-10-12";
+  pname = "ncspot";
+  version = "0.1.1";

  src = fetchFromGitHub {
    owner = "hrkfdn";
    repo = "ncspot";
-    rev = "4defded54646958268a20787917e4721ae96407d";
-    sha256 = "1w3cmilwjzk3pfnq97qgz6hzxgjgi27dm8jq7maw87qyl3v17gyg";
+    rev = "v${version}";
+    sha256 = "0ldisr45w6ys1j62qv99ssqfg5q9dwrrzxh2maggyrx1zqdlsk6m";
  };

-  cargoSha256 = "1w1fk39pragfy2i2myw99mqf63w6fw4nr2kri8ily2iqc6g9xpgw";
+  cargoSha256 = "0k765hinqxfm30li1z66m1chsv69v6hiz109q2zlkxzg937qbnjh";

  cargoBuildFlags = [ "--no-default-features" "--features" "${lib.concatStringsSep "," features}" ];

--- a/pkgs/applications/audio/noise-repellent/default.nix
+++ b/pkgs/applications/audio/noise-repellent/default.nix
@ -0,0 +1,29 @@
+{ stdenv, fetchFromGitHub, meson, ninja, pkgconfig, fftwFloat, lv2 }:
+
+stdenv.mkDerivation rec {
+  pname = "noise-repellent";
+  version = "unstable-2018-12-29";
+
+  src = fetchFromGitHub {
+    owner = "lucianodato";
+    repo = pname;
+    rev = "9efdd0b41ec184a792087c87cbf5382f455e33ec";
+    sha256 = "0pn9cxapfvb5l62q86bchyfll1290vi0rhrzarb1jpc4ix7kz53c";
+    fetchSubmodules = true;
+  };
+
+  mesonFlags = ("--prefix=${placeholder "out"}/lib/lv2");
+
+  nativeBuildInputs = [ meson ninja pkgconfig ];
+  buildInputs = [
+    fftwFloat lv2
+  ];
+
+  meta = with stdenv.lib; {
+    description = "An lv2 plugin for broadband noise reduction";
+    homepage    = https://github.com/lucianodato/noise-repellent;
+    license     = licenses.gpl3;
+    maintainers = [ maintainers.magnetophon ];
+    platforms = [ "x86_64-linux" "i686-linux" "x86_64-darwin" "i686-darwin"  ];
+  };
+}
--- a/pkgs/applications/blockchains/bitcoin-abc.nix
+++ b/pkgs/applications/blockchains/bitcoin-abc.nix
@ -7,13 +7,13 @@ with stdenv.lib;
 stdenv.mkDerivation rec {

  name = "bitcoin" + (toString (optional (!withGui) "d")) + "-abc-" + version;
-  version = "0.20.5";
+  version = "0.20.6";

  src = fetchFromGitHub {
    owner = "bitcoin-ABC";
    repo = "bitcoin-abc";
    rev = "v${version}";
-    sha256 = "1adps3g99m7cxs58c48g2dgyihfv0v8d198klzcbbf4dq0s5v45c";
+    sha256 = "1a65pykdjkiic67fcs8cg2qrvzzrqifa93r1bzza3gdyfdvgv3ww";
  };

  patches = [ ./fix-bitcoin-qt-build.patch ];
--- a/pkgs/applications/blockchains/dogecoin.nix
+++ b/pkgs/applications/blockchains/dogecoin.nix
@ -7,13 +7,13 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
  name = "dogecoin" + (toString (optional (!withGui) "d")) + "-" + version;
-  version = "1.14.1";
+  version = "1.14.2";

  src = fetchFromGitHub {
    owner = "dogecoin";
    repo = "dogecoin";
    rev = "v${version}";
-    sha256 = "0nmbi5gmms16baqs3fmdp2xm0yf8wawnyz80gcmca4j5ph2zka1v";
+    sha256 = "1gw46q63mjzwvb17ck6p1bap2xpdrap08szw2kjhasa3yvd5swyy";
  };

  nativeBuildInputs = [ pkgconfig autoreconfHook ];
--- a/pkgs/applications/blockchains/go-ethereum.nix
+++ b/pkgs/applications/blockchains/go-ethereum.nix
@ -1,22 +1,39 @@
-{ stdenv, buildGoPackage, fetchFromGitHub, libobjc, IOKit }:
+{ stdenv, buildGoModule, fetchFromGitHub, libobjc, IOKit }:

-buildGoPackage rec {
+buildGoModule rec {
  pname = "go-ethereum";
-  version = "1.9.7";
-
-  goPackagePath = "github.com/ethereum/go-ethereum";
-
-  # Fix for usb-related segmentation faults on darwin
-  propagatedBuildInputs =
-    stdenv.lib.optionals stdenv.isDarwin [ libobjc IOKit ];
+  version = "1.9.8";

  src = fetchFromGitHub {
    owner = "ethereum";
    repo = pname;
    rev = "v${version}";
-    sha256 = "07110dj91wmkpwz7iy0lmxx3y9wjxjrhk3rhkfdil74cxm0wkkn2";
+    sha256 = "0v4hchy6h3282347ps11iv7klcr60bmghha78rnp0iqpx2k8pqb4";
  };

+  modSha256 = "1l10p6a4qq77pfx7jmipkcg2qg6w3hg83q5a37yid3apily2scfa";
+
+  subPackages = [
+    "cmd/abigen"
+    "cmd/bootnode"
+    "cmd/checkpoint-admin"
+    "cmd/clef"
+    "cmd/devp2p"
+    "cmd/ethkey"
+    "cmd/evm"
+    "cmd/faucet"
+    "cmd/geth"
+    "cmd/p2psim"
+    "cmd/puppeth"
+    "cmd/rlpdump"
+    "cmd/utils"
+    "cmd/wnode"
+  ];
+
+  # Fix for usb-related segmentation faults on darwin
+  propagatedBuildInputs =
+    stdenv.lib.optionals stdenv.isDarwin [ libobjc IOKit ];
+
  meta = with stdenv.lib; {
    homepage = "https://geth.ethereum.org/";
    description = "Official golang implementation of the Ethereum protocol";
--- a/pkgs/applications/blockchains/zcash/default.nix
+++ b/pkgs/applications/blockchains/zcash/default.nix
@ -1,37 +1,29 @@
-{ stdenv, libsodium, fetchFromGitHub, wget, pkgconfig, autoreconfHook, openssl, db62, boost
-, zlib, gtest, gmock, callPackage, gmp, qt4, utillinux, protobuf, qrencode, libevent
-, libsnark, withGui }:
+{ stdenv, libsodium, fetchFromGitHub, wget, pkgconfig, autoreconfHook, openssl, db62, boost17x
+, zlib, gtest, gmock, callPackage, gmp, qt4, utillinux, protobuf, qrencode, libevent }:

 let librustzcash = callPackage ./librustzcash {};
 in
 with stdenv.lib;
 stdenv.mkDerivation rec {

-  name = "zcash" + (toString (optional (!withGui) "d")) + "-" + version;
-  version = "1.0.13";
+  pname = "zcash";
+  version = "2.1.0-1";

  src = fetchFromGitHub {
    owner = "zcash";
    repo  = "zcash";
    rev = "v${version}";
-    sha256 = "05y7wxs66anxr5akbf05r36mmjfzqpwawn6vyh3jhpva51hzzzyz";
+    sha256 = "05bnn4lxrrcv1ha3jdfrgwg4ar576161n3j9d4gpc14ww3zgf9vz";
  };

-  # Dependencies are underspecified: "make -C src gtest/zcash_gtest-test_merkletree.o"
-  # fails with "fatal error: test/data/merkle_roots.json.h: No such file or directory"
-  enableParallelBuilding = false;
-
  nativeBuildInputs = [ autoreconfHook pkgconfig ];
-  buildInputs = [ gtest gmock gmp openssl wget db62 boost zlib
-                  protobuf libevent libsodium librustzcash libsnark ]
-                  ++ optionals stdenv.isLinux [ utillinux ]
-                  ++ optionals withGui [ qt4 qrencode ];
+  buildInputs = [ gtest gmock gmp openssl wget db62 boost17x zlib
+                  protobuf libevent libsodium librustzcash ]
+                  ++ optionals stdenv.isLinux [ utillinux ];

-  configureFlags = [ "--with-boost-libdir=${boost.out}/lib"
-                   ] ++ optionals withGui [ "--with-gui=qt4" ];
+  configureFlags = [ "--with-boost-libdir=${boost17x.out}/lib" ];

  patchPhase = ''
-    sed -i"" 's,-lboost_system-mt,-lboost_system,' configure.ac
    sed -i"" 's,-fvisibility=hidden,,g'            src/Makefile.am
  '';

@ -42,7 +34,7 @@ stdenv.mkDerivation rec {
  meta = {
    description = "Peer-to-peer, anonymous electronic cash system";
    homepage = https://z.cash/;
-    maintainers = with maintainers; [ rht ];
+    maintainers = with maintainers; [ rht tkerber ];
    license = licenses.mit;
    platforms = platforms.linux;
  };
--- a/pkgs/applications/blockchains/zcash/librustzcash/default.nix
+++ b/pkgs/applications/blockchains/zcash/librustzcash/default.nix
@ -2,28 +2,30 @@

 rustPlatform.buildRustPackage rec {
  pname = "librustzcash-unstable";
-  version = "2017-03-17";
+  version = "2018-10-27";

  src = fetchFromGitHub {
    owner = "zcash";
    repo = "librustzcash";
-    rev = "91348647a86201a9482ad4ad68398152dc3d635e";
-    sha256 = "02l1f46frpvw1r6k1wfh77mrsnmsdvifqx0vnscxz4xgb9ia9d1c";
+    rev = "06da3b9ac8f278e5d4ae13088cf0a4c03d2c13f5";
+    sha256 = "0md0pp3k97iv7kfjpfkg14pjanhrql4vafa8ggbxpkajv1j4xldv";
  };

-  cargoSha256 = "1xlq8vkzfyr5q8gxvzkwi8r1kxg4rg8l1ckdwfdxlkhnw0yscbra";
+  cargoSha256 = "166v8cxlpfslbs5gljbh7wp0lxqakayw47ikxm9r9a39n7j36mq1";

  installPhase = ''
    mkdir -p $out/lib
    cp target/release/librustzcash.a $out/lib/
    mkdir -p $out/include
-    cp include/librustzcash.h $out/include/
+    cp librustzcash/include/librustzcash.h $out/include/
  '';

+  doCheck = false;
+
  meta = with stdenv.lib; {
    description = "Rust-language assets for Zcash";
    homepage = https://github.com/zcash/librustzcash;
-    maintainers = with maintainers; [ rht ];
+    maintainers = with maintainers; [ rht tkerber ];
    license = with licenses; [ mit asl20 ];
    platforms = platforms.unix;
  };
--- a/pkgs/applications/graphics/avocode/default.nix
+++ b/pkgs/applications/graphics/avocode/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  pname = "avocode";
-  version = "3.9.6";
+  version = "4.0.1";

  src = fetchurl {
    url = "https://media.avocode.com/download/avocode-app/${version}/avocode-${version}-linux.zip";
-    sha256 = "0jnl461dg2s5panrw12707bv34g6wxc1pxc90awnja13yq0z6bfc";
+    sha256 = "13jwxwvwb9nnjxcnh9vfi22n4c00bhdypl84wrpdg5xw9325zhvy";
  };

  libPath = stdenv.lib.makeLibraryPath (with xorg; [
--- a/pkgs/applications/graphics/pdfcpu/default.nix
+++ b/pkgs/applications/graphics/pdfcpu/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "pdfcpu";
-  version = "0.2.5";
+  version = "0.3";

  src = fetchFromGitHub {
    owner = "pdfcpu";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0fgdq8byb9pp9wiq3dm0vxw32kbspczqnk41agxpzjf303zmv75y";
+    sha256 = "03v4wc531dwmbjqgs3y3ncdn6g3xirv1w6h1mfgglb6sjll8jxp5";
  };

  modSha256 = "1nagb3k2ghfw27g4vcmn7v8s5flg387jpf1l18gw6c44a1xjcivs";
--- a/pkgs/applications/misc/alacritty/default.nix
+++ b/pkgs/applications/misc/alacritty/default.nix
@ -52,16 +52,16 @@ let
  ];
 in buildRustPackage rec {
  pname = "alacritty";
-  version = "0.3.3";
+  version = "0.4.0";

  src = fetchFromGitHub {
    owner = "jwilm";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1h9zid7bi19qga3a8a2d4x3ma9wf1njmj74s4xnw7nzqqf3dh750";
+    sha256 = "0adaqdbma6gskb2g14yscrgr9gch5wf2g2clchplv72c2qr1k427";
  };

-  cargoSha256 = "1rxb5ljgvn881jkxm8772kf815mmp08ci7sqmn2x1jwdcrphhxr1";
+  cargoSha256 = "1r267g8f986nxh8ms5yhp50qy1yl8gly2jr78p738qqc6frlxlhv";

  nativeBuildInputs = [
    cmake
@ -76,10 +76,6 @@ in buildRustPackage rec {
    ++ lib.optionals stdenv.isDarwin [ AppKit CoreGraphics CoreServices CoreText Foundation OpenGL ];

  outputs = [ "out" "terminfo" ];
-  postPatch = ''
-    substituteInPlace alacritty_terminal/src/config/mouse.rs \
-      --replace xdg-open ${xdg_utils}/bin/xdg-open
-  '';

  postBuild = lib.optionalString stdenv.isDarwin "make app";

@ -118,7 +114,7 @@ in buildRustPackage rec {
    description = "GPU-accelerated terminal emulator";
    homepage = https://github.com/jwilm/alacritty;
    license = with licenses; [ asl20 ];
-    maintainers = with maintainers; [ mic92 ];
+    maintainers = with maintainers; [ filalex77 mic92 ];
    platforms = [ "x86_64-linux" "i686-linux" "x86_64-darwin" "aarch64-linux" ];
  };
 }
--- a/pkgs/applications/misc/gallery-dl/default.nix
+++ b/pkgs/applications/misc/gallery-dl/default.nix
@ -2,11 +2,11 @@

 python3Packages.buildPythonApplication rec {
  pname = "gallery_dl";
-  version = "1.10.6";
+  version = "1.11.1";

  src = python3Packages.fetchPypi {
    inherit pname version;
-    sha256 = "0jbfp072rnb3pkqp10xds57bnlcn87vqjaz68nhpzkwvwhs3hr4w";
+    sha256 = "08py1f48ylw83712h8313rxz55igbszxcwr2yxkchpr4233avzph";
  };

  doCheck = false;
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@ -2,7 +2,7 @@

 buildGoModule rec {
  pname = "hugo";
-  version = "0.58.3";
+  version = "0.60.0";

  goPackagePath = "github.com/gohugoio/hugo";

@ -10,10 +10,10 @@ buildGoModule rec {
    owner  = "gohugoio";
    repo   = pname;
    rev    = "v${version}";
-    sha256 = "00dhb6xilkwr9yhncpyc6alzqw77ch3vd85dc7lzsmhw1c80n0lc";
+    sha256 = "0g8rq79xp7c9p31xc0anfjyz7xp8n7qzv3vmvg2nmzl7nayg88aa";
  };

-  modSha256 = "0d6zc7hxb246zsvwsjz4ds6gdd2m95x6l3djh3mmciwfg9cd7prx";
+  modSha256 = "12h1ik1hgs4lkmk699wpa34rnycnm03qyr2vp1y5lywz1h93by20";

  buildFlags = "-tags extended";

--- a/pkgs/applications/misc/josm/default.nix
+++ b/pkgs/applications/misc/josm/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "josm";
-  version = "15390";
+  version = "15492";

  src = fetchurl {
    url = "https://josm.openstreetmap.de/download/josm-snapshot-${version}.jar";
-    sha256 = "1wxncd3mjd4j14svgpmvrxc0nkzfkpn0xlci7m7wp9hfp1l81v9f";
+    sha256 = "0x7ndcrlvrvk2fd4pyn10npr3778khcwg6xzzh19vdw4glh5zfcl";
  };

  buildInputs = [ jdk11 makeWrapper ];
--- a/pkgs/applications/misc/kitty/default.nix
+++ b/pkgs/applications/misc/kitty/default.nix
@ -21,14 +21,14 @@
 with python3Packages;
 buildPythonApplication rec {
  pname = "kitty";
-  version = "0.14.6";
+  version = "0.15.0";
  format = "other";

  src = fetchFromGitHub {
    owner = "kovidgoyal";
    repo = "kitty";
    rev = "v${version}";
-    sha256 = "1rb5ys9xsdhd2qa3kz5gqzz111c6b14za98va6hlglk69wqlmb51";
+    sha256 = "1gh8lcyqpkwvmjxwiq5d43sd43bg3c49fyy2x8drqdzj34gc49qg";
  };

  buildInputs = [
--- a/pkgs/applications/misc/slic3r/boost-compile-error.patch
+++ b/pkgs/applications/misc/slic3r/boost-compile-error.patch
@ -0,0 +1,12 @@
+diff --git a/xs/src/libslic3r/GCodeSender.hpp b/xs/src/libslic3r/GCodeSender.hpp
+index cc0b2983..0f39f5a3 100644
+--- a/xs/src/libslic3r/GCodeSender.hpp
+++ b/xs/src/libslic3r/GCodeSender.hpp
+@@ -9,6 +9,7 @@
+ #include <boost/asio.hpp>
+ #include <boost/bind.hpp>
+ #include <boost/thread.hpp>
+#include <boost/core/noncopyable.hpp>
+ 
+ namespace Slic3r {
+ 
--- a/pkgs/applications/misc/slic3r/default.nix
+++ b/pkgs/applications/misc/slic3r/default.nix
@ -1,5 +1,5 @@
-{ stdenv, fetchgit, perl, makeWrapper, makeDesktopItem
-, which, perlPackages, boost
+{ lib, stdenv, fetchgit, perl, makeWrapper
+, makeDesktopItem, which, perlPackages, boost
 }:

 stdenv.mkDerivation rec {
@ -40,6 +40,11 @@ stdenv.mkDerivation rec {
    sed -i 's|"/usr/include/asm-generic/ioctls.h"|<asm-generic/ioctls.h>|g' xs/src/libslic3r/GCodeSender.cpp
  '';

+  # note the boost-compile-error is fixed in
+  # https://github.com/slic3r/Slic3r/commit/90f108ae8e7a4315f82e317f2141733418d86a68
+  # this patch can be probably be removed in the next version after 1.3.0
+  patches = lib.optional (lib.versionAtLeast boost.version "1.56.0") ./boost-compile-error.patch;
+
  buildPhase = ''
    export SLIC3R_NO_AUTO=true
    export LD=$CXX
--- a/pkgs/applications/misc/syncthingtray/default.nix
+++ b/pkgs/applications/misc/syncthingtray/default.nix
@ -20,14 +20,14 @@
 }:

 mkDerivation rec {
-  version = "0.10.2";
+  version = "0.10.3";
  pname = "syncthingtray";

  src = fetchFromGitHub {
    owner = "Martchus";
    repo = "syncthingtray";
    rev = "v${version}";
-    sha256 = "09iq1rr70wwy5xk0jmfnwzvnigq409hvs2viy1j0khn9jhvnk6z0";
+    sha256 = "12s1v65h4z051k4gi1b5f3z4hpbgqnhkjnz2xv5bdwhs24zxrrif";
  };

  buildInputs = [ qtbase cpp-utilities qtutilities ]
--- a/pkgs/applications/networking/browsers/qutebrowser/default.nix
+++ b/pkgs/applications/networking/browsers/qutebrowser/default.nix
@ -10,23 +10,23 @@ assert withMediaPlayback -> gst_all_1 != null;

 let
  pdfjs = let
-    version = "2.2.228";
+    version = "2.3.200";
  in
  fetchzip rec {
    name = "pdfjs-${version}";
    url = "https://github.com/mozilla/pdf.js/releases/download/v${version}/${name}-dist.zip";
-    sha256 = "0yik4vfnz46j844jfw1gq5cshgzry42kpy2d5rr7fbn9fjf98bw6";
+    sha256 = "1fpxsw0hzahccyng08acvc7g0gk29j2x701p6w6fg1718mvcrm1q";
    stripRoot = false;
  };

 in mkDerivationWith python3Packages.buildPythonApplication rec {
  pname = "qutebrowser";
-  version = "1.8.1";
+  version = "1.8.2";

  # the release tarballs are different from the git checkout!
  src = fetchurl {
    url = "https://github.com/qutebrowser/qutebrowser/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "0ckffbw2zlg0afz4rgyywzdprnqs74va5qj0xqlaqc14ziiypxnw";
+    sha256 = "0walddppjb61k3dyq22cngkaw6alzn75k5npvnawla2l153irw5s";
  };

  # Needs tox
--- a/pkgs/applications/networking/cawbird/default.nix
+++ b/pkgs/applications/networking/cawbird/default.nix
@ -1,6 +1,23 @@
-{ stdenv, fetchFromGitHub, glib, gtk3, json-glib, sqlite, libsoup, gettext, vala
-, meson, ninja, pkgconfig, gnome3, gst_all_1, wrapGAppsHook, gobject-introspection
-, glib-networking, python3 }:
+{ stdenv
+, fetchFromGitHub
+, glib
+, gtk3
+, json-glib
+, sqlite
+, libsoup
+, gettext
+, gspell
+, vala
+, meson
+, ninja
+, pkgconfig
+, gnome3
+, gst_all_1
+, wrapGAppsHook
+, gobject-introspection
+, glib-networking
+, python3
+}:

 stdenv.mkDerivation rec {
  version = "1.0.3.1";
@ -14,13 +31,34 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [
-    meson ninja vala pkgconfig wrapGAppsHook python3
+    meson
+    ninja
+    vala
+    pkgconfig
+    wrapGAppsHook
+    python3
    gobject-introspection # for setup hook
  ];

  buildInputs = [
-    glib gtk3 json-glib sqlite libsoup gettext gnome3.dconf gnome3.gspell glib-networking
-  ] ++ (with gst_all_1; [ gstreamer gst-plugins-base gst-plugins-bad (gst-plugins-good.override { gtkSupport = true; }) gst-libav ]);
+    glib
+    gtk3
+    json-glib
+    sqlite
+    libsoup
+    gettext
+    gnome3.dconf
+    gspell
+    glib-networking
+  ] ++ (with gst_all_1; [
+    gstreamer
+    gst-plugins-base
+    gst-plugins-bad
+    (gst-plugins-good.override {
+      gtkSupport = true;
+    })
+    gst-libav
+  ]);

  postPatch = ''
    chmod +x data/meson_post_install.py # patchShebangs requires executable file
@ -30,7 +68,7 @@ stdenv.mkDerivation rec {
  meta = with stdenv.lib; {
    description = "Native GTK Twitter client for the Linux desktop";
    longDescription = "Cawbird is a modern, easy and fun Twitter client. Fork of the discontinued Corebird.";
-    homepage = https://ibboard.co.uk/cawbird/;
+    homepage = "https://ibboard.co.uk/cawbird/";
    license = licenses.gpl3;
    platforms = platforms.linux;
    maintainers = with stdenv.lib.maintainers; [ jonafato schmittlauch ];
--- a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
@ -7,7 +7,7 @@ let

  # Please keep the version x.y.0.z and do not update to x.y.76.z because the
  # source of the latter disappears much faster.
-  version = "8.54.0.85";
+  version = "8.54.0.91";

  rpath = stdenv.lib.makeLibraryPath [
    alsaLib
@ -63,7 +63,7 @@ let
          "https://repo.skype.com/deb/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
          "https://web.archive.org/web/https://repo.skype.com/deb/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
        ];
-        sha256 = "09k260g9qy4n8vy6wr2jb5mm27cvqyapmv8vj4ff2j72f3ad31vm";
+        sha256 = "1hnha8sqk78zxkjqg62npmg6dymi5fnyj2bmxlwpgi61v3pyxj94";
      }
    else
      throw "Skype for linux is not supported on ${stdenv.hostPlatform.system}";
--- a/pkgs/applications/networking/mailreaders/balsa/default.nix
+++ b/pkgs/applications/networking/mailreaders/balsa/default.nix
@ -6,11 +6,11 @@

 stdenv.mkDerivation rec {
  pname = "balsa";
-  version = "2.5.7";
+  version = "2.5.9";

  src = fetchurl {
    url = "https://pawsa.fedorapeople.org/balsa/${pname}-${version}.tar.bz2";
-    sha256 = "0yfqhfpwm1qnwmbpr6dfn2f5w8a8xxq51pn8ypgg0fw973l1c1nx";
+    sha256 = "19gs1qfvbk9qx4rjmgrmvid00kl9k153zjjx8zjii2lz09w7g19i";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/mailreaders/imapfilter.nix
+++ b/pkgs/applications/networking/mailreaders/imapfilter.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "imapfilter";
-  version = "2.6.14";
+  version = "2.6.16";

  src = fetchFromGitHub {
    owner = "lefcha";
    repo = "imapfilter";
    rev = "v${version}";
-    sha256 = "09aq9gw1vz0zl6k4fb4zdm6cpjhddsl13asfjx3qy21pbw0azmj6";
+    sha256 = "0f65sg6hhv6778fxwsz4hvarbm97dsb8jj0mg7a9qs273r35pqck";
  };

  makeFlagsArray = "PREFIX=$(out)";
--- a/pkgs/applications/science/logic/coq/default.nix
+++ b/pkgs/applications/science/logic/coq/default.nix
@ -124,7 +124,7 @@ self = stdenv.mkDerivation {
  setupHook = writeText "setupHook.sh" ''
    addCoqPath () {
      if test -d "''$1/lib/coq/${coq-version}/user-contrib"; then
-        export COQPATH="''${COQPATH}''${COQPATH:+:}''$1/lib/coq/${coq-version}/user-contrib/"
+        export COQPATH="''${COQPATH-}''${COQPATH:+:}''$1/lib/coq/${coq-version}/user-contrib/"
      fi
    }

--- a/pkgs/applications/science/misc/root/setup-hook.sh
+++ b/pkgs/applications/science/misc/root/setup-hook.sh
@ -1,9 +1,13 @@
 thisroot () {
    # Workaround thisroot.sh dependency on man
-    if [ -z "${MANPATH}" ]; then
+    if [ -z "${MANPATH-}" ]; then
        MANPATH=:
    fi
+    local oldOpts="-u"
+    shopt -qo nounset || oldOpts="+u"
+    set +u
    source @out@/bin/thisroot.sh
+    set "$oldOpts"
 }

 postHooks+=(thisroot)
--- a/pkgs/applications/version-management/git-and-tools/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/default.nix
@ -129,6 +129,8 @@ let

  git-subrepo = callPackage ./git-subrepo { };

+  git-subtrac = callPackage ./git-subtrac { };
+
  git-sync = callPackage ./git-sync { };

  git-test = callPackage ./git-test { };
--- a/pkgs/applications/version-management/git-and-tools/git-machete/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-machete/default.nix
@ -4,11 +4,11 @@

 buildPythonApplication rec {
  pname = "git-machete";
-  version = "2.12.1";
+  version = "2.12.2";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "114kq396zq45jlibn1lp0nk4lmanj4w1bcn48gi7xzdm0y1nkzfq";
+    sha256 = "0kmwm9rwngxm2qdlv6nvxyhwpfa0i95kbrmasrj1qqdz7rmyyzmi";
  };

  nativeBuildInputs = [ installShellFiles pbr ];
--- a/pkgs/applications/version-management/git-and-tools/git-subtrac/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-subtrac/default.nix
@ -0,0 +1,22 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "git-subtrac";
+  version = "0.01";
+
+  src = fetchFromGitHub {
+    owner = "apenwarr";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1w6gd0x1902lzpqr74gsdrnxq36f6v14bv8h0vhlrfhbwbsih7n6";
+  };
+
+  modSha256 = "147vzllp1gydk2156hif313vwykagrj35vaiqy1swqczxs7p9hhs";
+
+  meta = with lib; {
+    description = "Keep the content for your git submodules all in one place: the parent repo";
+    homepage = "https://github.com/apenwarr/git-subtrac";
+    license = licenses.asl20;
+    maintainers = [ maintainers.marsam ];
+  };
+}
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@ -1,13 +1,13 @@
 {
-  "version": "12.4.3",
-  "repo_hash": "1qsd3qxvvb3rbyrlyrqvrday4c9s2krgics99ch7v74hprj3xfq9",
+  "version": "12.5.2",
+  "repo_hash": "18mviak37rkpj92m0hzh79rjbfsk8p91r5zzjp7y3y4qjnsf2a8p",
  "owner": "gitlab-org",
  "repo": "gitlab",
-  "rev": "v12.4.3-ee",
+  "rev": "v12.5.2-ee",
  "passthru": {
-    "GITALY_SERVER_VERSION": "1.67.0",
-    "GITLAB_PAGES_VERSION": "1.11.0",
+    "GITALY_SERVER_VERSION": "1.72.1",
+    "GITLAB_PAGES_VERSION": "1.12.0",
    "GITLAB_SHELL_VERSION": "10.2.0",
-    "GITLAB_WORKHORSE_VERSION": "8.14.0"
+    "GITLAB_WORKHORSE_VERSION": "8.14.1"
  }
 }
--- a/pkgs/applications/version-management/gitlab/default.nix
+++ b/pkgs/applications/version-management/gitlab/default.nix
@ -64,6 +64,11 @@ let
      # Fixup "resolved"-entries in yarn.lock to match our offline cache
      ${fixup_yarn_lock}/bin/fixup_yarn_lock yarn.lock

+      # fixup_yarn_lock currently doesn't correctly fix the dagre-d3
+      # url, so we have to do it manually
+      ${replace}/bin/replace-literal -f -e '"https://codeload.github.com/dagrejs/dagre-d3/tar.gz/e1a00e5cb518f5d2304a35647e024f31d178e55b"' \
+                                           '"https___codeload.github.com_dagrejs_dagre_d3_tar.gz_e1a00e5cb518f5d2304a35647e024f31d178e55b"' yarn.lock
+
      yarn install --offline --frozen-lockfile --ignore-scripts --no-progress --non-interactive

      patchShebangs node_modules/
--- a/pkgs/applications/version-management/gitlab/gitaly/Gemfile
+++ b/pkgs/applications/version-management/gitlab/gitaly/Gemfile
@ -4,13 +4,13 @@ source 'https://rubygems.org'
 gem 'bundler', '>= 1.17.3'

 gem 'rugged', '~> 0.28'
-gem 'github-linguist', '~> 6.1', require: 'linguist'
+gem 'github-linguist', '~> 7.5', require: 'linguist'
 gem 'gitlab-markup', '~> 1.7.0'
 gem 'activesupport', '~> 5.2.3'
-gem 'rdoc', '~> 4.2'
+gem 'rdoc', '~> 6.0'
 gem 'gitlab-gollum-lib', '~> 4.2.7.7', require: false
 gem 'gitlab-gollum-rugged_adapter', '~> 0.4.4.2', require: false
-gem 'grpc', '~> 1.19.0'
+gem 'grpc', '~> 1.24.0'
 gem 'sentry-raven', '~> 2.9.0', require: false
 gem 'faraday', '~> 0.12'
 gem 'rbtrace', require: false
@ -22,7 +22,7 @@ gem 'gitlab-labkit', '~> 0.5.0'
 # This version needs to be in sync with GitLab CE/EE
 gem 'licensee', '~> 8.9.0'

-gem 'google-protobuf', '~> 3.7.1'
+gem 'google-protobuf', '~> 3.8.0'

 group :development, :test do
  gem 'rubocop', '~> 0.69', require: false
--- a/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock
@ -49,10 +49,10 @@ GEM
    ffi (1.11.1)
    gemojione (3.3.0)
      json
-    github-linguist (6.4.1)
+    github-linguist (7.5.1)
      charlock_holmes (~> 0.7.6)
      escape_utils (~> 1.2.0)
-      mime-types (>= 1.19)
+      mini_mime (~> 1.0)
      rugged (>= 0.25.1)
    github-markup (1.7.0)
    gitlab-gollum-lib (4.2.7.7)
@ -81,12 +81,12 @@ GEM
    gitlab-markup (1.7.0)
    gollum-grit_adapter (1.0.1)
      gitlab-grit (~> 2.7, >= 2.7.1)
-    google-protobuf (3.7.1)
+    google-protobuf (3.8.0)
    googleapis-common-protos-types (1.0.4)
      google-protobuf (~> 3.0)
-    grpc (1.19.0)
-      google-protobuf (~> 3.1)
-      googleapis-common-protos-types (~> 1.0.0)
+    grpc (1.24.0)
+      google-protobuf (~> 3.8)
+      googleapis-common-protos-types (~> 1.0)
    hashdiff (0.3.9)
    i18n (1.6.0)
      concurrent-ruby (~> 1.0)
@ -99,7 +99,7 @@ GEM
    licensee (8.9.2)
      rugged (~> 0.24)
    listen (0.5.3)
-    loofah (2.2.3)
+    loofah (2.3.0)
      crass (~> 1.0.2)
      nokogiri (>= 1.5.9)
    memoizable (0.4.2)
@ -108,12 +108,13 @@ GEM
    mime-types (3.2.2)
      mime-types-data (~> 3.2015)
    mime-types-data (3.2019.0331)
+    mini_mime (1.0.2)
    mini_portile2 (2.4.0)
    minitest (5.11.3)
    msgpack (1.3.0)
    multi_json (1.13.1)
    multipart-post (2.0.0)
-    nokogiri (1.10.4)
+    nokogiri (1.10.5)
      mini_portile2 (~> 2.4.0)
    nokogumbo (1.5.0)
      nokogiri
@ -138,14 +139,14 @@ GEM
    rails-dom-testing (2.0.3)
      activesupport (>= 4.2.0)
      nokogiri (>= 1.6)
-    rails-html-sanitizer (1.2.0)
-      loofah (~> 2.2, >= 2.2.2)
+    rails-html-sanitizer (1.3.0)
+      loofah (~> 2.3)
    rainbow (3.0.0)
    rbtrace (0.4.11)
      ffi (>= 1.0.6)
      msgpack (>= 0.4.3)
      optimist (>= 3.0.0)
-    rdoc (4.3.0)
+    rdoc (6.2.0)
    redis (4.1.2)
    rouge (3.11.0)
    rspec (3.8.0)
@ -217,18 +218,18 @@ DEPENDENCIES
  bundler (>= 1.17.3)
  factory_bot
  faraday (~> 0.12)
-  github-linguist (~> 6.1)
+  github-linguist (~> 7.5)
  gitlab-gollum-lib (~> 4.2.7.7)
  gitlab-gollum-rugged_adapter (~> 0.4.4.2)
  gitlab-labkit (~> 0.5.0)
  gitlab-markup (~> 1.7.0)
-  google-protobuf (~> 3.7.1)
-  grpc (~> 1.19.0)
+  google-protobuf (~> 3.8.0)
+  grpc (~> 1.24.0)
  licensee (~> 8.9.0)
  listen (~> 0.5.0)
  pry (~> 0.12.2)
  rbtrace
-  rdoc (~> 4.2)
+  rdoc (~> 6.0)
  rspec
  rspec-parameterized
  rubocop (~> 0.69)
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@ -17,14 +17,14 @@ let
      };
  };
 in buildGoPackage rec {
-  version = "1.67.0";
+  version = "1.72.1";
  pname = "gitaly";

  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitaly";
    rev = "v${version}";
-    sha256 = "1mj2l15hnxwqmyc8xn79d6qpmpqbqw2ishalr8qvn83nzdsbk8l3";
+    sha256 = "0gnhw7p8fgy3w15828qjgkkxcd4dg7gf1hpanc3xqawb8jqpfc91";
  };

  goPackagePath = "gitlab.com/gitlab-org/gitaly";
--- a/pkgs/applications/version-management/gitlab/gitaly/deps.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/deps.nix
@ -18,6 +18,42 @@
      sha256 = "1fjdwwfzyzllgiwydknf1pwjvy49qxfsczqx5gz3y0izs7as99j6";
    };
  }
+  {
+    goPackagePath = "github.com/Joker/hpp";
+    fetch = {
+      type = "git";
+      url = "https://github.com/Joker/hpp";
+      rev = "6893e659854a";
+      sha256 = "0lsx63c28rzqigv3lwzznqacpk7nr0dn6ig37v023x8lzc728ix5";
+    };
+  }
+  {
+    goPackagePath = "github.com/Joker/jade";
+    fetch = {
+      type = "git";
+      url = "https://github.com/Joker/jade";
+      rev = "v1.0.0";
+      sha256 = "0k9b8dcwwhajw6rzjmakqwmhw9z192pzzdhppcvam6dy63yl4zjf";
+    };
+  }
+  {
+    goPackagePath = "github.com/Shopify/goreferrer";
+    fetch = {
+      type = "git";
+      url = "https://github.com/Shopify/goreferrer";
+      rev = "ec9c9a553398";
+      sha256 = "0d740psj8czks1hl0nr6nlrwfbwq3nc51jj2p91d1wyhhmgn6jmn";
+    };
+  }
+  {
+    goPackagePath = "github.com/ajg/form";
+    fetch = {
+      type = "git";
+      url = "https://github.com/ajg/form";
+      rev = "v1.5.1";
+      sha256 = "1d6sxzzf9yycdf8jm5877y0khmhkmhxfw3sc4xpdcsrdlc7gqh5a";
+    };
+  }
  {
    goPackagePath = "github.com/alecthomas/template";
    fetch = {
@ -36,6 +72,15 @@
      sha256 = "1j65b91qb9sbrml9cpabfrcf07wmgzzghrl7809hjjhrmbzri5bl";
    };
  }
+  {
+    goPackagePath = "github.com/aymerick/raymond";
+    fetch = {
+      type = "git";
+      url = "https://github.com/aymerick/raymond";
+      rev = "v2.0.2";
+      sha256 = "1w6am4142k8lyjnwwcgx94c2d8zviflzi0a9c81gn2j0gyx475i3";
+    };
+  }
  {
    goPackagePath = "github.com/beorn7/perks";
    fetch = {
@ -81,6 +126,15 @@
      sha256 = "1zampgfjbxy192cbwdi7g86l1idxaam96d834wncnpfdwgh5kl57";
    };
  }
+  {
+    goPackagePath = "github.com/codegangsta/inject";
+    fetch = {
+      type = "git";
+      url = "https://github.com/codegangsta/inject";
+      rev = "33e0aa1cb7c0";
+      sha256 = "1jqakr3z9l60qhcgrdzsb6rlk8ikcamisw0g2ndmrf27s0ibfcaj";
+    };
+  }
  {
    goPackagePath = "github.com/davecgh/go-spew";
    fetch = {
@ -90,6 +144,42 @@
      sha256 = "0hka6hmyvp701adzag2g26cxdj47g21x6jz4sc6jjz1mn59d474y";
    };
  }
+  {
+    goPackagePath = "github.com/dgrijalva/jwt-go";
+    fetch = {
+      type = "git";
+      url = "https://github.com/dgrijalva/jwt-go";
+      rev = "v3.2.0";
+      sha256 = "08m27vlms74pfy5z79w67f9lk9zkx6a9jd68k3c4msxy75ry36mp";
+    };
+  }
+  {
+    goPackagePath = "github.com/eknkc/amber";
+    fetch = {
+      type = "git";
+      url = "https://github.com/eknkc/amber";
+      rev = "cdade1c07385";
+      sha256 = "152w97yckwncgw7lwjvgd8d00wy6y0nxzlvx72kl7nqqxs9vhxd9";
+    };
+  }
+  {
+    goPackagePath = "github.com/fatih/structs";
+    fetch = {
+      type = "git";
+      url = "https://github.com/fatih/structs";
+      rev = "v1.1.0";
+      sha256 = "1wrhb8wp8zpzggl61lapb627lw8yv281abvr6vqakmf569nswa9q";
+    };
+  }
+  {
+    goPackagePath = "github.com/flosch/pongo2";
+    fetch = {
+      type = "git";
+      url = "https://github.com/flosch/pongo2";
+      rev = "bbf5a6c351f4";
+      sha256 = "0yqh58phznnxakm64w82gawrpndb0r85vsd1s7h244qqrq7w4avq";
+    };
+  }
  {
    goPackagePath = "github.com/fsnotify/fsnotify";
    fetch = {
@ -99,15 +189,69 @@
      sha256 = "07va9crci0ijlivbb7q57d2rz9h27zgn2fsm60spjsqpdbvyrx4g";
    };
  }
+  {
+    goPackagePath = "github.com/gavv/monotime";
+    fetch = {
+      type = "git";
+      url = "https://github.com/gavv/monotime";
+      rev = "30dba4353424";
+      sha256 = "0w67yyc9y11dp7lp4b712dkcgbiln1qmgfx1nbbrw3mfkzr61d7g";
+    };
+  }
  {
    goPackagePath = "github.com/getsentry/raven-go";
    fetch = {
      type = "git";
      url = "https://github.com/getsentry/raven-go";
-      rev = "v0.1.2";
+      rev = "v0.1.0";
      sha256 = "1dl80kar4lzdcfl3w6jssi1ld6bv0rmx6sp6bz6rzysfr9ilm02z";
    };
  }
+  {
+    goPackagePath = "github.com/getsentry/sentry-go";
+    fetch = {
+      type = "git";
+      url = "https://github.com/getsentry/sentry-go";
+      rev = "v0.3.0";
+      sha256 = "1919lhvg1swcqyfa6mck6nz53c7n4df21jsz46f7x4wncb6f5il1";
+    };
+  }
+  {
+    goPackagePath = "github.com/gin-contrib/sse";
+    fetch = {
+      type = "git";
+      url = "https://github.com/gin-contrib/sse";
+      rev = "5545eab6dad3";
+      sha256 = "0jhcvi66rn7c1wg3rf7q7sylrvlk7c40yk79c5lypnz1dpsdcrb5";
+    };
+  }
+  {
+    goPackagePath = "github.com/gin-gonic/gin";
+    fetch = {
+      type = "git";
+      url = "https://github.com/gin-gonic/gin";
+      rev = "v1.4.0";
+      sha256 = "19nxip48p2s8l7p1p7wpd5li2fcngi4c58rgcg71izdmsmj2iw1d";
+    };
+  }
+  {
+    goPackagePath = "github.com/go-check/check";
+    fetch = {
+      type = "git";
+      url = "https://github.com/go-check/check";
+      rev = "788fd7840127";
+      sha256 = "0v3bim0j375z81zrpr5qv42knqs0y2qv2vkjiqi5axvb78slki1a";
+    };
+  }
+  {
+    goPackagePath = "github.com/go-errors/errors";
+    fetch = {
+      type = "git";
+      url = "https://github.com/go-errors/errors";
+      rev = "v1.0.1";
+      sha256 = "0rznpknk19rxkr7li6dqs52c26pjazp69lh493l4ny4sxn5922lp";
+    };
+  }
  {
    goPackagePath = "github.com/go-kit/kit";
    fetch = {
@ -126,6 +270,15 @@
      sha256 = "1gkgh3k5w1xwb2qbjq52p6azq3h1c1rr6pfwjlwj1zrijpzn2xb9";
    };
  }
+  {
+    goPackagePath = "github.com/go-martini/martini";
+    fetch = {
+      type = "git";
+      url = "https://github.com/go-martini/martini";
+      rev = "22fa46961aab";
+      sha256 = "01ip3mwbnm5isq120ww73yrvbcn6n5944prhhbyf2ggyf6g46ylh";
+    };
+  }
  {
    goPackagePath = "github.com/go-stack/stack";
    fetch = {
@ -153,15 +306,6 @@
      sha256 = "0jb2834rw5sykfr937fxi8hxi2zy80sj2bdn9b3jb4b26ksqng30";
    };
  }
-  {
-    goPackagePath = "github.com/golang/lint";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/lint";
-      rev = "06c8688daad7";
-      sha256 = "0xi94dwvz50a66bq1hp9fyqkym5mcpdxdb1hrfvicldgjf37lc47";
-    };
-  }
  {
    goPackagePath = "github.com/golang/mock";
    fetch = {
@ -176,8 +320,26 @@
    fetch = {
      type = "git";
      url = "https://github.com/golang/protobuf";
-      rev = "v1.3.1";
-      sha256 = "15am4s4646qy6iv0g3kkqq52rzykqjhm4bf08dk0fy2r58knpsyl";
+      rev = "v1.3.2";
+      sha256 = "1k1wb4zr0qbwgpvz9q5ws9zhlal8hq7dmq62pwxxriksayl6hzym";
+    };
+  }
+  {
+    goPackagePath = "github.com/google/go-cmp";
+    fetch = {
+      type = "git";
+      url = "https://github.com/google/go-cmp";
+      rev = "v0.2.0";
+      sha256 = "1fbv0x27k9sn8svafc0hjwsnckk864lv4yi7bvzrxvmd3d5hskds";
+    };
+  }
+  {
+    goPackagePath = "github.com/google/go-querystring";
+    fetch = {
+      type = "git";
+      url = "https://github.com/google/go-querystring";
+      rev = "v1.0.0";
+      sha256 = "0xl12bqyvmn4xcnf8p9ksj9rmnr7s40pvppsdmy8n9bzw1db0iwz";
    };
  }
  {
@ -189,6 +351,24 @@
      sha256 = "0hfxcf9frkb57k6q0rdkrmnfs78ms21r1qfk9fhlqga2yh5xg8zb";
    };
  }
+  {
+    goPackagePath = "github.com/gopherjs/gopherjs";
+    fetch = {
+      type = "git";
+      url = "https://github.com/gopherjs/gopherjs";
+      rev = "0766667cb4d1";
+      sha256 = "13pfc9sxiwjky2lm1xb3i3lcisn8p6mgjk2d927l7r92ysph8dmw";
+    };
+  }
+  {
+    goPackagePath = "github.com/gorilla/schema";
+    fetch = {
+      type = "git";
+      url = "https://github.com/gorilla/schema";
+      rev = "v1.1.0";
+      sha256 = "14d31i3h6bg83r7ncmwm2pirab66z9hza38in18l89pbazxyh2n9";
+    };
+  }
  {
    goPackagePath = "github.com/grpc-ecosystem/go-grpc-middleware";
    fetch = {
@ -216,6 +396,51 @@
      sha256 = "1njpzc0pi1acg5zx9y6vj9xi6ksbsc5d387rd6904hy6rh2m6kn0";
    };
  }
+  {
+    goPackagePath = "github.com/imkira/go-interpol";
+    fetch = {
+      type = "git";
+      url = "https://github.com/imkira/go-interpol";
+      rev = "v1.1.0";
+      sha256 = "180h3pf2p0pch6hmqf45wk7wd87md83d3p122f8ll43x5nja5mph";
+    };
+  }
+  {
+    goPackagePath = "github.com/iris-contrib/blackfriday";
+    fetch = {
+      type = "git";
+      url = "https://github.com/iris-contrib/blackfriday";
+      rev = "v2.0.0";
+      sha256 = "1gkizavajqmxm79il8r6cbi0g9ls3vwdh9wr0zy89vc9sq17p3im";
+    };
+  }
+  {
+    goPackagePath = "github.com/iris-contrib/formBinder";
+    fetch = {
+      type = "git";
+      url = "https://github.com/iris-contrib/formBinder";
+      rev = "v5.0.0";
+      sha256 = "0mqk6j7a9d3y28ad4ylqc7z5w4hmn1ws5wwnyll918xn1wkzr5rg";
+    };
+  }
+  {
+    goPackagePath = "github.com/iris-contrib/go.uuid";
+    fetch = {
+      type = "git";
+      url = "https://github.com/iris-contrib/go.uuid";
+      rev = "v2.0.0";
+      sha256 = "0nc0ggn0a6bcwdrwinnx3z6889x65c20a2dwja0n8can3xblxs35";
+    };
+  }
+  {
+    goPackagePath = "github.com/iris-contrib/httpexpect";
+    fetch = {
+      type = "git";
+      url = "https://github.com/iris-contrib/httpexpect";
+      rev = "ebe99fcebbce";
+      sha256 = "126c50c6r5l2gdn60jirpb54pqwswxag3wgrv6wcn998h9w9gv8c";
+    };
+  }
  {
    goPackagePath = "github.com/json-iterator/go";
    fetch = {
@ -225,6 +450,42 @@
      sha256 = "08caswxvdn7nvaqyj5kyny6ghpygandlbw9vxdj7l5vkp7q0s43r";
    };
  }
+  {
+    goPackagePath = "github.com/jtolds/gls";
+    fetch = {
+      type = "git";
+      url = "https://github.com/jtolds/gls";
+      rev = "v4.20.0";
+      sha256 = "1k7xd2q2ysv2xsh373qs801v6f359240kx0vrl0ydh7731lngvk6";
+    };
+  }
+  {
+    goPackagePath = "github.com/juju/errors";
+    fetch = {
+      type = "git";
+      url = "https://github.com/juju/errors";
+      rev = "089d3ea4e4d5";
+      sha256 = "056za75j1zgksky7pbf0pkjqz5ha15g3wj3p4ma10m9sywdyq79r";
+    };
+  }
+  {
+    goPackagePath = "github.com/juju/loggo";
+    fetch = {
+      type = "git";
+      url = "https://github.com/juju/loggo";
+      rev = "584905176618";
+      sha256 = "0hzi0652y74jf62wwyi9gf8bzrs7ynvhjfqc8rwr4l799d7i5gd4";
+    };
+  }
+  {
+    goPackagePath = "github.com/juju/testing";
+    fetch = {
+      type = "git";
+      url = "https://github.com/juju/testing";
+      rev = "472a3e8b2073";
+      sha256 = "05wjc2k0kwbam7anaxwnj30pl03dcdbrsz32icd70zl70ipsqsw4";
+    };
+  }
  {
    goPackagePath = "github.com/julienschmidt/httprouter";
    fetch = {
@ -234,6 +495,42 @@
      sha256 = "1k8bylc9s4vpvf5xhqh9h246dl1snxrzzz0614zz88cdh8yzs666";
    };
  }
+  {
+    goPackagePath = "github.com/k0kubun/colorstring";
+    fetch = {
+      type = "git";
+      url = "https://github.com/k0kubun/colorstring";
+      rev = "9440f1994b88";
+      sha256 = "0isskya7ky4k9znrh85crfc2pxwyfz2s8j1a5cbjb8b8zf2v0qbj";
+    };
+  }
+  {
+    goPackagePath = "github.com/kataras/golog";
+    fetch = {
+      type = "git";
+      url = "https://github.com/kataras/golog";
+      rev = "99c81de45f40";
+      sha256 = "1dgrsvhzymgj7da54ldv8plkxk3n8zh3kc995qxl6mrpz65j801p";
+    };
+  }
+  {
+    goPackagePath = "github.com/kataras/iris";
+    fetch = {
+      type = "git";
+      url = "https://github.com/kataras/iris";
+      rev = "v11.1.1";
+      sha256 = "1rxpr5hdj9mji26mlfp4zic0pc6nh93akzccw24a5kynj07g68wg";
+    };
+  }
+  {
+    goPackagePath = "github.com/kataras/pio";
+    fetch = {
+      type = "git";
+      url = "https://github.com/kataras/pio";
+      rev = "ea782b38602d";
+      sha256 = "0ca29wmkpx19qwnvi4fja3avkxkzz14x9wyzmg1l9074bxbj8cgj";
+    };
+  }
  {
    goPackagePath = "github.com/kelseyhightower/envconfig";
    fetch = {
@ -244,12 +541,21 @@
    };
  }
  {
-    goPackagePath = "github.com/kisielk/gotool";
+    goPackagePath = "github.com/klauspost/compress";
    fetch = {
      type = "git";
-      url = "https://github.com/kisielk/gotool";
-      rev = "v1.0.0";
-      sha256 = "14af2pa0ssyp8bp2mvdw184s5wcysk6akil3wzxmr05wwy951iwn";
+      url = "https://github.com/klauspost/compress";
+      rev = "v1.4.0";
+      sha256 = "1y7951q0ji894d111lqqbacq64cxyi2dxsni5sqi9488zsasgw8s";
+    };
+  }
+  {
+    goPackagePath = "github.com/klauspost/cpuid";
+    fetch = {
+      type = "git";
+      url = "https://github.com/klauspost/cpuid";
+      rev = "e7e905edc00e";
+      sha256 = "0cmyv3rwv5r5iqvvfhbiwp3jsfa40c6xfm42nxbngd5lygjcwwgf";
    };
  }
  {
@ -270,6 +576,51 @@
      sha256 = "02ldzxgznrfdzvghfraslhgp19la1fczcbzh7wm2zdc6lmpd1qq9";
    };
  }
+  {
+    goPackagePath = "github.com/kr/pretty";
+    fetch = {
+      type = "git";
+      url = "https://github.com/kr/pretty";
+      rev = "v0.1.0";
+      sha256 = "18m4pwg2abd0j9cn5v3k2ksk9ig4vlwxmlw9rrglanziv9l967qp";
+    };
+  }
+  {
+    goPackagePath = "github.com/kr/pty";
+    fetch = {
+      type = "git";
+      url = "https://github.com/kr/pty";
+      rev = "v1.1.1";
+      sha256 = "0383f0mb9kqjvncqrfpidsf8y6ns5zlrc91c6a74xpyxjwvzl2y6";
+    };
+  }
+  {
+    goPackagePath = "github.com/kr/text";
+    fetch = {
+      type = "git";
+      url = "https://github.com/kr/text";
+      rev = "v0.1.0";
+      sha256 = "1gm5bsl01apvc84bw06hasawyqm4q84vx1pm32wr9jnd7a8vjgj1";
+    };
+  }
+  {
+    goPackagePath = "github.com/labstack/echo";
+    fetch = {
+      type = "git";
+      url = "https://github.com/labstack/echo";
+      rev = "v4.1.10";
+      sha256 = "0qg9ykmhgldiv2v1w8sz8x0j0bgqf11ghzrim59fb6pxz8qgg25h";
+    };
+  }
+  {
+    goPackagePath = "github.com/labstack/gommon";
+    fetch = {
+      type = "git";
+      url = "https://github.com/labstack/gommon";
+      rev = "v0.3.0";
+      sha256 = "18z7akyzm75p6anm4b8qkqgm4iivx50z07hi5wf50w1pbsvbcdi0";
+    };
+  }
  {
    goPackagePath = "github.com/libgit2/git2go";
    fetch = {
@ -288,6 +639,33 @@
      sha256 = "10n5r66g44s6rnz5kf86s4a3p1g55kc1kxqhnk7bx7mlayndgpmb";
    };
  }
+  {
+    goPackagePath = "github.com/mattn/go-colorable";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mattn/go-colorable";
+      rev = "v0.1.2";
+      sha256 = "0512jm3wmzkkn7d99x9wflyqf48n5ri3npy1fqkq6l6adc5mni3n";
+    };
+  }
+  {
+    goPackagePath = "github.com/mattn/go-isatty";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mattn/go-isatty";
+      rev = "v0.0.9";
+      sha256 = "0i3km37lajahh1y2392g4hpgvq05arcgiiv93yhzxxyv0fpqj72m";
+    };
+  }
+  {
+    goPackagePath = "github.com/mattn/goveralls";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mattn/goveralls";
+      rev = "v0.0.2";
+      sha256 = "13ffdikvc594g1mryhi94m87skr7irwkjnpxp8ad2kprn6syfslp";
+    };
+  }
  {
    goPackagePath = "github.com/matttproud/golang_protobuf_extensions";
    fetch = {
@ -297,6 +675,15 @@
      sha256 = "1d0c1isd2lk9pnfq2nk0aih356j30k3h1gi2w0ixsivi5csl7jya";
    };
  }
+  {
+    goPackagePath = "github.com/microcosm-cc/bluemonday";
+    fetch = {
+      type = "git";
+      url = "https://github.com/microcosm-cc/bluemonday";
+      rev = "v1.0.2";
+      sha256 = "0j0aylsxqjcj49w7ph8cmpaqjlpvg7mb5mrcrd9bg71dlb9z9ir2";
+    };
+  }
  {
    goPackagePath = "github.com/modern-go/concurrent";
    fetch = {
@ -315,6 +702,15 @@
      sha256 = "06a3sablw53n1dqqbr2f53jyksbxdmmk8axaas4yvnhyfi55k4lf";
    };
  }
+  {
+    goPackagePath = "github.com/moul/http2curl";
+    fetch = {
+      type = "git";
+      url = "https://github.com/moul/http2curl";
+      rev = "v1.0.0";
+      sha256 = "15bpx33d3ygya8dg8hbsn24h7acpajl27006pj8lw1c0bfvbnrl0";
+    };
+  }
  {
    goPackagePath = "github.com/mwitkow/go-conntrack";
    fetch = {
@ -329,8 +725,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/onsi/ginkgo";
-      rev = "v1.7.0";
-      sha256 = "14wgpdrvpc35rdz3859bz53sc1g4vpr1fysy15wy3ff9gmqs14yg";
+      rev = "v1.10.1";
+      sha256 = "033a42h1wzmji57p86igg9whvsbp6nvfdsypskw738ys903n3z4d";
    };
  }
  {
@ -338,8 +734,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/onsi/gomega";
-      rev = "v1.4.3";
-      sha256 = "1c8rqg5i2hz3snmq7s41yar1zjnzilb0fyiyhkg83v97afcfx79v";
+      rev = "v1.7.0";
+      sha256 = "09j6wq425wgzzsbwm9ckhfgl2capv3yyqbrf45qyrjwkzm49i02y";
    };
  }
  {
@ -360,13 +756,22 @@
      sha256 = "1pg84khadh79v42y8sjsdgfb54vw2kzv7hpapxkifgj0yvcp30g2";
    };
  }
+  {
+    goPackagePath = "github.com/pingcap/errors";
+    fetch = {
+      type = "git";
+      url = "https://github.com/pingcap/errors";
+      rev = "v0.11.1";
+      sha256 = "00wr0l4cwq0qx8jw51j0n7pbh9l7hdq2874x9rf1mz5svz1wbmcp";
+    };
+  }
  {
    goPackagePath = "github.com/pkg/errors";
    fetch = {
      type = "git";
      url = "https://github.com/pkg/errors";
-      rev = "v0.8.0";
-      sha256 = "001i6n71ghp2l6kdl3qq1v2vmghcz3kicv9a5wgcihrzigm75pp5";
+      rev = "v0.8.1";
+      sha256 = "0g5qcb4d4fd96midz0zdk8b9kz8xkzwfa8kr1cliqbg8sxsy5vd1";
    };
  }
  {
@ -414,6 +819,33 @@
      sha256 = "0s7pvs7fgnfpmym3cd0k219av321h9sf3yvdlnn3qy0ps280lg7k";
    };
  }
+  {
+    goPackagePath = "github.com/ryanuber/columnize";
+    fetch = {
+      type = "git";
+      url = "https://github.com/ryanuber/columnize";
+      rev = "v2.1.0";
+      sha256 = "0m9jhagb1k44zfcdai76xdf9vpi3bqdl7p078ffyibmz0z9jfap6";
+    };
+  }
+  {
+    goPackagePath = "github.com/sergi/go-diff";
+    fetch = {
+      type = "git";
+      url = "https://github.com/sergi/go-diff";
+      rev = "v1.0.0";
+      sha256 = "0swiazj8wphs2zmk1qgq75xza6m19snif94h2m6fi8dqkwqdl7c7";
+    };
+  }
+  {
+    goPackagePath = "github.com/shurcooL/sanitized_anchor_name";
+    fetch = {
+      type = "git";
+      url = "https://github.com/shurcooL/sanitized_anchor_name";
+      rev = "v1.0.0";
+      sha256 = "1gv9p2nr46z80dnfjsklc6zxbgk96349sdsxjz05f3z6wb6m5l8f";
+    };
+  }
  {
    goPackagePath = "github.com/sirupsen/logrus";
    fetch = {
@ -423,6 +855,24 @@
      sha256 = "0r6334x2bls8ddznvzaldx4g88msjjns4mlks95rqrrg7h0ijigg";
    };
  }
+  {
+    goPackagePath = "github.com/smartystreets/assertions";
+    fetch = {
+      type = "git";
+      url = "https://github.com/smartystreets/assertions";
+      rev = "b2de0cb4f26d";
+      sha256 = "1i7ldgavgl35c7gk25p7bvdr282ckng090zr4ch9mk1705akx09y";
+    };
+  }
+  {
+    goPackagePath = "github.com/smartystreets/goconvey";
+    fetch = {
+      type = "git";
+      url = "https://github.com/smartystreets/goconvey";
+      rev = "505e41936337";
+      sha256 = "07zjxwszayal88z1j2bwnqrsa32vg8l4nivks5yfr9j8xfsw7n6m";
+    };
+  }
  {
    goPackagePath = "github.com/stretchr/objx";
    fetch = {
@ -437,8 +887,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/stretchr/testify";
-      rev = "v1.3.0";
-      sha256 = "0wjchp2c8xbgcbbq32w3kvblk6q6yn533g78nxl6iskq6y95lxsy";
+      rev = "v1.4.0";
+      sha256 = "187i5g88sxfy4vxpm7dw1gwv29pa2qaq475lxrdh5livh69wqfjb";
    };
  }
  {
@ -477,6 +927,123 @@
      sha256 = "113fwpn80ylx970w8h7nfqnhh18dpx1jadbk7rbr8k68q4di4y0q";
    };
  }
+  {
+    goPackagePath = "github.com/ugorji/go";
+    fetch = {
+      type = "git";
+      url = "https://github.com/ugorji/go";
+      rev = "v1.1.4";
+      sha256 = "0ma2qvn5wqvjidpdz74x832a813qnr1cxbx6n6n125ak9b3wbn5w";
+    };
+  }
+  {
+    goPackagePath = "github.com/urfave/negroni";
+    fetch = {
+      type = "git";
+      url = "https://github.com/urfave/negroni";
+      rev = "v1.0.0";
+      sha256 = "1gp6j74adi1cn8fq5v3wzlzhwl4zg43n2746m4fzdcdimihk3ccp";
+    };
+  }
+  {
+    goPackagePath = "github.com/valyala/bytebufferpool";
+    fetch = {
+      type = "git";
+      url = "https://github.com/valyala/bytebufferpool";
+      rev = "v1.0.0";
+      sha256 = "01lqzjddq6kz9v41nkky7wbgk7f1cw036sa7ldz10d82g5klzl93";
+    };
+  }
+  {
+    goPackagePath = "github.com/valyala/fasthttp";
+    fetch = {
+      type = "git";
+      url = "https://github.com/valyala/fasthttp";
+      rev = "v1.4.0";
+      sha256 = "0kypc7r91n61fm6qsadza1aiy9n6byghvcxzvx7agi6yzrllk956";
+    };
+  }
+  {
+    goPackagePath = "github.com/valyala/fasttemplate";
+    fetch = {
+      type = "git";
+      url = "https://github.com/valyala/fasttemplate";
+      rev = "v1.0.1";
+      sha256 = "0l131znbv8v67y20s4q361mwiww2c33zdc68mwvxchzk1gpy5ywq";
+    };
+  }
+  {
+    goPackagePath = "github.com/valyala/tcplisten";
+    fetch = {
+      type = "git";
+      url = "https://github.com/valyala/tcplisten";
+      rev = "ceec8f93295a";
+      sha256 = "0ksbj1gsdqanbnhly5w1wcc107bib4w0zpnyl00prr89zch3imnf";
+    };
+  }
+  {
+    goPackagePath = "github.com/xeipuuv/gojsonpointer";
+    fetch = {
+      type = "git";
+      url = "https://github.com/xeipuuv/gojsonpointer";
+      rev = "df4f5c81cb3b";
+      sha256 = "0dfwc66z5gq75m3z7va80c10c22ijiq99bahq86l26ki71g286xn";
+    };
+  }
+  {
+    goPackagePath = "github.com/xeipuuv/gojsonreference";
+    fetch = {
+      type = "git";
+      url = "https://github.com/xeipuuv/gojsonreference";
+      rev = "bd5ef7bd5415";
+      sha256 = "1xby79padc7bmyb8rfbad8wfnfdzpnh51b1n8c0kibch0kwc1db5";
+    };
+  }
+  {
+    goPackagePath = "github.com/xeipuuv/gojsonschema";
+    fetch = {
+      type = "git";
+      url = "https://github.com/xeipuuv/gojsonschema";
+      rev = "v1.1.0";
+      sha256 = "10gn5y4l72zknj21mff29d9vnk4pz7jnw39xnlsb373lsiih91xg";
+    };
+  }
+  {
+    goPackagePath = "github.com/yalp/jsonpath";
+    fetch = {
+      type = "git";
+      url = "https://github.com/yalp/jsonpath";
+      rev = "5cc68e5049a0";
+      sha256 = "0kkyxp1cg3kfxy5hhwzxg132jin4xb492z5jpqq94ix15v6rdf4b";
+    };
+  }
+  {
+    goPackagePath = "github.com/yudai/gojsondiff";
+    fetch = {
+      type = "git";
+      url = "https://github.com/yudai/gojsondiff";
+      rev = "v1.0.0";
+      sha256 = "0qnymi0027mb8kxm24mmd22bvjrdkc56c7f4q3lbdf93x1vxbbc2";
+    };
+  }
+  {
+    goPackagePath = "github.com/yudai/golcs";
+    fetch = {
+      type = "git";
+      url = "https://github.com/yudai/golcs";
+      rev = "ecda9a501e82";
+      sha256 = "0mx6wc5fz05yhvg03vvps93bc5mw4vnng98fhmixd47385qb29pq";
+    };
+  }
+  {
+    goPackagePath = "github.com/yudai/pp";
+    fetch = {
+      type = "git";
+      url = "https://github.com/yudai/pp";
+      rev = "v2.0.1";
+      sha256 = "18vbc7jagnjw1wpvhqjffl0np7bzzqdd9jpdcisvj5h85lbyn5gk";
+    };
+  }
  {
    goPackagePath = "gitlab.com/gitlab-org/labkit";
    fetch = {
@ -500,8 +1067,8 @@
    fetch = {
      type = "git";
      url = "https://go.googlesource.com/crypto";
-      rev = "20be4c3c3ed5";
-      sha256 = "1ph7y8v30hc95h1dwr7vrhg1nzs47a261qin6zg8mhf12g5k2lxb";
+      rev = "4def268fd1a4";
+      sha256 = "1bfsnari529gw34cz0zqk3d9mrkcj1ay35kangri8kbgll0ss5a6";
    };
  }
  {
@ -509,8 +1076,8 @@
    fetch = {
      type = "git";
      url = "https://go.googlesource.com/lint";
-      rev = "06c8688daad7";
-      sha256 = "0xi94dwvz50a66bq1hp9fyqkym5mcpdxdb1hrfvicldgjf37lc47";
+      rev = "d0100b6bd8b3";
+      sha256 = "0b0amr9x4ji66iv9ayfx7zrfx52k1m5g66qfcxkgj80qrb1y2yn7";
    };
  }
  {
@ -536,8 +1103,8 @@
    fetch = {
      type = "git";
      url = "https://go.googlesource.com/sync";
-      rev = "37e7f081c4d4";
-      sha256 = "1bb0mw6ckb1k7z8v3iil2qlqwfj408fvvp8m1cik2b46p7snyjhm";
+      rev = "112230192c58";
+      sha256 = "05i2k43j2d0llq768hg5pf3hb2yhfzp9la1w5wp0rsnnzblr0lfn";
    };
  }
  {
@ -545,8 +1112,8 @@
    fetch = {
      type = "git";
      url = "https://go.googlesource.com/sys";
-      rev = "953cdadca894";
-      sha256 = "0gkha4whk8xkcv3isigbs250akag99isxnd3v9xmy0kl3g88hxy1";
+      rev = "fde4db37ae7a";
+      sha256 = "16k4w4pzziq1kln18k5fg01qgk4hpzb5xsm7175kaky6d6gwyhg3";
    };
  }
  {
@ -563,8 +1130,8 @@
    fetch = {
      type = "git";
      url = "https://go.googlesource.com/tools";
-      rev = "6cd1fcedba52";
-      sha256 = "00hl0vkmy8impsnmc2dmm55sdhia95k0kqcrjbdpynryn1lamn5d";
+      rev = "2c0ae7006135";
+      sha256 = "1lsi2ssxajclj3bciz2a41v1vjv768ja3v6wnbyhxy8xphwkp4fk";
    };
  }
  {
@ -590,8 +1157,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/grpc/grpc-go";
-      rev = "v1.16.0";
-      sha256 = "0a9xl6c5j7lvsb4q6ry5p892rjm86p47d4f8xrf0r8lxblf79qbg";
+      rev = "v1.24.0";
+      sha256 = "0h8mwv74vzcfb7p4ai247x094skxca71vjp4wpj2wzmri0x9p4v6";
    };
  }
  {
@ -630,6 +1197,33 @@
      sha256 = "07va9crci0ijlivbb7q57d2rz9h27zgn2fsm60spjsqpdbvyrx4g";
    };
  }
+  {
+    goPackagePath = "gopkg.in/go-playground/assert.v1";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/go-playground/assert.v1";
+      rev = "v1.2.1";
+      sha256 = "1h4amgykpa0djwi619llr3g55p75ia0mi184h9s5zdl8l4rhn9pm";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/go-playground/validator.v8";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/go-playground/validator.v8";
+      rev = "v8.18.2";
+      sha256 = "1m2i48ph5a3kw9nlw2srx8i04v7chicds2hlzlrfm15045crga55";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/mgo.v2";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/mgo.v2";
+      rev = "9856a29383ce";
+      sha256 = "1gfbcmvpwwf1lydxj3g42wv2g9w3pf0y02igqk4f4f21h02sazkw";
+    };
+  }
  {
    goPackagePath = "gopkg.in/tomb.v1";
    fetch = {
@ -653,8 +1247,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/dominikh/go-tools";
-      rev = "88497007e858";
-      sha256 = "0rinkyx3r2bq45mgcasnn5jb07cwbv3p3s2wwcrzxsarsj6wa5lc";
+      rev = "ea95bdfd59fc";
+      sha256 = "1763nw7pwpzkvzfnm63dgzcgbq9hwmq5l1nffchnhh77vgkaq4ic";
    };
  }
 ]
--- a/pkgs/applications/version-management/gitlab/gitaly/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/gemset.nix
@ -224,15 +224,15 @@
    version = "3.3.0";
  };
  github-linguist = {
-    dependencies = ["charlock_holmes" "escape_utils" "mime-types" "rugged"];
+    dependencies = ["charlock_holmes" "escape_utils" "mini_mime" "rugged"];
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0nqsprsy4xd6yxzk3b54815hv0gk2r1xn0vsm81pkyy61bbm35hf";
+      sha256 = "092bq7bjfj2yvss2ig6jb71j0h04cigq79xxfis37j315iixl12j";
      type = "gem";
    };
-    version = "6.4.1";
+    version = "7.5.1";
  };
  github-markup = {
    source = {
@ -308,10 +308,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "04988m3hmllg4sl4syjb35x0wzsg7rj1nmvhx3d9ihml22w76gb2";
+      sha256 = "0by3289irdklb9gjqw41fq6mg6yja3iyzh99dj8p8z9l4brllqn4";
      type = "gem";
    };
-    version = "3.7.1";
+    version = "3.8.0";
  };
  googleapis-common-protos-types = {
    dependencies = ["google-protobuf"];
@ -330,10 +330,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1rdywzism5vxz8pnml6xjb9f19diclyy74014z69q01jzqwi1wgs";
+      sha256 = "18wikj9qd4jb4lks55cs2cf3q7fifnanm9z9ywnxhpj57vbnilpf";
      type = "gem";
    };
-    version = "1.19.0";
+    version = "1.24.0";
  };
  hashdiff = {
    groups = ["default" "development" "test"];
@ -418,10 +418,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1ccsid33xjajd0im2xv941aywi58z7ihwkvaf1w2bv89vn5bhsjg";
+      sha256 = "06kfq90vi38gv6i128f4zg462kj32szs5vsgm25hxgw9zd12pj9x";
      type = "gem";
    };
-    version = "2.2.3";
+    version = "2.3.0";
  };
  memoizable = {
    dependencies = ["thread_safe"];
@ -459,6 +459,16 @@
    };
    version = "3.2019.0331";
  };
+  mini_mime = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1axm0rxyx3ss93wbmfkm78a6x03l8y4qy60rhkkiq0aza0vwq3ha";
+      type = "gem";
+    };
+    version = "1.0.2";
+  };
  mini_portile2 = {
    source = {
      remotes = ["https://rubygems.org"];
@ -507,10 +517,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0nmdrqqz1gs0fwkgzxjl4wr554gr8dc1fkrqjc2jpsvwgm41rygv";
+      sha256 = "185g3dwba73jqxjr94bd2zk6fil6n9hmcfnfyzh3p1w47vm296r7";
      type = "gem";
    };
-    version = "1.10.4";
+    version = "1.10.5";
  };
  nokogumbo = {
    dependencies = ["nokogiri"];
@ -640,10 +650,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0ilwxzm3a7bql5c9q2n9g9nb1hax7vd8d65a5yp3d967ld97nvrq";
+      sha256 = "1icpqmxbppl4ynzmn6dx7wdil5hhq6fz707m9ya6d86c7ys8sd4f";
      type = "gem";
    };
-    version = "1.2.0";
+    version = "1.3.0";
  };
  rainbow = {
    source = {
@ -663,12 +673,14 @@
    version = "0.4.11";
  };
  rdoc = {
+    groups = ["default"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "13ba2mhqqcsp3k97x3iz9x29xk26rv4561lfzzzibcy41vvj1n4c";
+      sha256 = "1gh7sc3xd4rgl9z90181cq580r1xqn063mmv51wdrhhsrkkw2bi9";
      type = "gem";
    };
-    version = "4.3.0";
+    version = "6.2.0";
  };
  redis = {
    groups = ["default"];
--- a/pkgs/applications/version-management/gitlab/gitlab-shell/deps.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-shell/deps.nix
@ -162,15 +162,6 @@
      sha256 = "0jb2834rw5sykfr937fxi8hxi2zy80sj2bdn9b3jb4b26ksqng30";
    };
  }
-  {
-    goPackagePath = "github.com/golang/lint";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/lint";
-      rev = "06c8688daad7";
-      sha256 = "0xi94dwvz50a66bq1hp9fyqkym5mcpdxdb1hrfvicldgjf37lc47";
-    };
-  }
  {
    goPackagePath = "github.com/golang/mock";
    fetch = {
@ -261,15 +252,6 @@
      sha256 = "1zcq480ig7wbg4378qcfxznp2gzqmk7x6rbxizflvg9v2f376vrw";
    };
  }
-  {
-    goPackagePath = "github.com/kisielk/gotool";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kisielk/gotool";
-      rev = "v1.0.0";
-      sha256 = "14af2pa0ssyp8bp2mvdw184s5wcysk6akil3wzxmr05wwy951iwn";
-    };
-  }
  {
    goPackagePath = "github.com/konsorten/go-windows-terminal-sequences";
    fetch = {
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@ -3,13 +3,13 @@
 buildGoPackage rec {
  pname = "gitlab-workhorse";

-  version = "8.14.0";
+  version = "8.14.1";

  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-workhorse";
    rev = "v${version}";
-    sha256 = "1cqx75h4x4chjvp72kzbln8qkm5p7p2w7x8bdd99g38kf21wxxaq";
+    sha256 = "19flb9b9l9214ykwgjphcqrinncnfvhis7nrvcr4ns6rlpxnc9dl";
  };

  goPackagePath = "gitlab.com/gitlab-org/gitlab-workhorse";
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
@ -8,12 +8,12 @@ gem 'bootsnap', '~> 1.4'
 gem 'nakayoshi_fork', '~> 0.0.4'

 # Responders respond_to and respond_with
-gem 'responders', '~> 2.0'
+gem 'responders', '~> 3.0'

 gem 'sprockets', '~> 3.7.0'

 # Default values for AR models
-gem 'default_value_for', '~> 3.2.0'
+gem 'default_value_for', '~> 3.3.0'

 # Supported DBs
 gem 'pg', '~> 1.1'
@ -42,7 +42,7 @@ gem 'omniauth-shibboleth', '~> 1.3.0'
 gem 'omniauth-twitter', '~> 1.4'
 gem 'omniauth_crowd', '~> 2.2.0'
 gem 'omniauth-authentiq', '~> 0.3.3'
-gem 'omniauth_openid_connect', '~> 0.3.1'
+gem 'omniauth_openid_connect', '~> 0.3.3'
 gem "omniauth-ultraauth", '~> 0.0.2'
 gem 'omniauth-salesforce', '~> 1.0.5'
 gem 'rack-oauth2', '~> 1.9.3'
@ -64,7 +64,7 @@ gem 'u2f', '~> 0.2.1'

 # GitLab Pages
 gem 'validates_hostname', '~> 1.0.6'
-gem 'rubyzip', '~> 1.2.2', require: 'zip'
+gem 'rubyzip', '~> 1.3.0', require: 'zip'
 # GitLab Pages letsencrypt support
 gem 'acme-client', '~> 2.0.2'

@ -72,7 +72,7 @@ gem 'acme-client', '~> 2.0.2'
 gem 'browser', '~> 2.5'

 # GPG
-gem 'gpgme', '~> 2.0.18'
+gem 'gpgme', '~> 2.0.19'

 # LDAP Auth
 # GitLab fork with several improvements to original library. For full list of changes
@ -136,7 +136,7 @@ gem 'faraday_middleware-aws-signers-v4'

 # Markdown and HTML processing
 gem 'html-pipeline', '~> 2.8'
-gem 'deckar01-task_list', '2.2.0'
+gem 'deckar01-task_list', '2.2.1'
 gem 'gitlab-markup', '~> 1.7.0'
 gem 'github-markup', '~> 1.7.0', require: 'github/markup'
 gem 'commonmarker', '~> 0.17'
@ -151,7 +151,7 @@ gem 'asciidoctor-plantuml', '0.0.9'
 gem 'rouge', '~> 3.11.0'
 gem 'truncato', '~> 0.7.11'
 gem 'bootstrap_form', '~> 4.2.0'
-gem 'nokogiri', '~> 1.10.4'
+gem 'nokogiri', '~> 1.10.5'
 gem 'escape_utils', '~> 1.1'

 # Calendar rendering
@ -159,6 +159,7 @@ gem 'icalendar'

 # Diffs
 gem 'diffy', '~> 3.1.0'
+gem 'diff_match_patch', '~> 0.1.0'

 # Application server
 gem 'rack', '~> 2.0.7'
@ -175,7 +176,7 @@ group :puma do
 end

 # State machine
-gem 'state_machines-activerecord', '~> 0.5.1'
+gem 'state_machines-activerecord', '~> 0.6.0'

 # Issue tags
 gem 'acts-as-taggable-on', '~> 6.0'
@ -259,9 +260,6 @@ gem 'loofah', '~> 2.2'
 # Working with license
 gem 'licensee', '~> 8.9'

-# Protect against bruteforcing
-gem 'rack-attack', '~> 4.4.1'
-
 # Ace editor
 gem 'ace-rails-ap', '~> 4.1.0'

@ -293,10 +291,13 @@ gem 'base32', '~> 0.3.0'

 gem "gitlab-license", "~> 1.0"

+# Protect against bruteforcing
+gem 'rack-attack', '~> 6.2.0'
+
 # Sentry integration
 gem 'sentry-raven', '~> 2.9'

-gem 'premailer-rails', '~> 1.9.7'
+gem 'premailer-rails', '~> 1.10.3'

 # LabKit: Tracing and Correlation
 gem 'gitlab-labkit', '~> 0.5'
@ -331,7 +332,6 @@ group :metrics do
 end

 group :development do
-  gem 'foreman', '~> 0.84.0'
  gem 'brakeman', '~> 4.2', require: false
  gem 'danger', '~> 6.0', require: false

@ -388,7 +388,6 @@ group :development, :test do

  gem 'benchmark-ips', '~> 2.3.0', require: false

-  gem 'license_finder', '~> 5.4', require: false
  gem 'knapsack', '~> 1.17'

  gem 'stackprof', '~> 0.2.10', require: false
@ -398,6 +397,11 @@ group :development, :test do
  gem 'timecop', '~> 0.8.0'
 end

+# Gems required in omnibus-gitlab pipeline
+group :development, :test, :omnibus do
+  gem 'license_finder', '~> 5.4', require: false
+end
+
 group :test do
  gem 'shoulda-matchers', '~> 4.0.1', require: false
  gem 'email_spec', '~> 2.2.0'
@ -407,6 +411,7 @@ group :test do
  gem 'concurrent-ruby', '~> 1.1'
  gem 'test-prof', '~> 0.10.0'
  gem 'rspec_junit_formatter'
+  gem 'guard-rspec'
 end

 gem 'octokit', '~> 4.9'
@ -446,18 +451,18 @@ group :ed25519 do
 end

 # Gitaly GRPC protocol definitions
-gem 'gitaly', '~> 1.65.0'
+gem 'gitaly', '~> 1.70.0'

-gem 'grpc', '~> 1.19.0'
+gem 'grpc', '~> 1.24.0'

-gem 'google-protobuf', '~> 3.7.1'
+gem 'google-protobuf', '~> 3.8.0'

 gem 'toml-rb', '~> 1.0.0', require: false

 # Feature toggles
-gem 'flipper', '~> 0.13.0'
-gem 'flipper-active_record', '~> 0.13.0'
-gem 'flipper-active_support_cache_store', '~> 0.13.0'
+gem 'flipper', '~> 0.17.1'
+gem 'flipper-active_record', '~> 0.17.1'
+gem 'flipper-active_support_cache_store', '~> 0.17.1'
 gem 'unleash', '~> 0.1.5'

 # Structured logging
@ -469,3 +474,5 @@ gem 'gitlab-net-dns', '~> 0.9.1'

 # Countries list
 gem 'countries', '~> 3.0'
+
+gem 'retriable', '~> 3.1.2'
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
@ -50,8 +50,8 @@ GEM
      i18n (>= 0.7, < 2)
      minitest (~> 5.1)
      tzinfo (~> 1.1)
-    acts-as-taggable-on (6.0.0)
-      activerecord (~> 5.0)
+    acts-as-taggable-on (6.5.0)
+      activerecord (>= 5.0, < 6.1)
    adamantium (0.2.0)
      ice_nine (~> 0.11.0)
      memoizable (~> 0.4.0)
@ -80,14 +80,16 @@ GEM
      encryptor (~> 3.0.0)
    attr_required (1.0.1)
    awesome_print (1.8.0)
-    aws-sdk (2.9.32)
-      aws-sdk-resources (= 2.9.32)
-    aws-sdk-core (2.9.32)
+    aws-eventstream (1.0.3)
+    aws-sdk (2.11.374)
+      aws-sdk-resources (= 2.11.374)
+    aws-sdk-core (2.11.374)
      aws-sigv4 (~> 1.0)
      jmespath (~> 1.0)
-    aws-sdk-resources (2.9.32)
-      aws-sdk-core (= 2.9.32)
-    aws-sigv4 (1.0.0)
+    aws-sdk-resources (2.11.374)
+      aws-sdk-core (= 2.11.374)
+    aws-sigv4 (1.1.0)
+      aws-eventstream (~> 1.0, >= 1.0.2)
    axiom-types (0.1.1)
      descendants_tracker (~> 0.0.4)
      ice_nine (~> 0.11.0)
@ -171,9 +173,9 @@ GEM
      unicode_utils (~> 1.4)
    crack (0.4.3)
      safe_yaml (~> 1.0.0)
-    crass (1.0.4)
+    crass (1.0.5)
    creole (0.5.0)
-    css_parser (1.5.0)
+    css_parser (1.7.0)
      addressable
    daemons (1.2.6)
    danger (6.0.9)
@ -192,12 +194,12 @@ GEM
    database_cleaner (1.7.0)
    debug_inspector (0.0.3)
    debugger-ruby_core_source (1.3.8)
-    deckar01-task_list (2.2.0)
+    deckar01-task_list (2.2.1)
      html-pipeline
    declarative (0.0.10)
    declarative-option (0.1.0)
-    default_value_for (3.2.0)
-      activerecord (>= 3.2.0, < 6.0)
+    default_value_for (3.3.0)
+      activerecord (>= 3.2.0, < 6.1)
    derailed_benchmarks (1.3.5)
      benchmark-ips (~> 2)
      get_process_mem (~> 0)
@ -222,6 +224,7 @@ GEM
      railties
      rotp (~> 2.0)
    diff-lcs (1.3)
+    diff_match_patch (0.1.0)
    diffy (3.1.0)
    discordrb-webhooks-blackst0ne (3.3.0)
      rest-client (~> 2.0)
@ -285,13 +288,13 @@ GEM
    fast_gettext (1.6.0)
    ffaker (2.10.0)
    ffi (1.11.1)
-    flipper (0.13.0)
-    flipper-active_record (0.13.0)
-      activerecord (>= 3.2, < 6)
-      flipper (~> 0.13.0)
-    flipper-active_support_cache_store (0.13.0)
-      activesupport (>= 3.2, < 6)
-      flipper (~> 0.13.0)
+    flipper (0.17.1)
+    flipper-active_record (0.17.1)
+      activerecord (>= 4.2, < 7)
+      flipper (~> 0.17.1)
+    flipper-active_support_cache_store (0.17.1)
+      activesupport (>= 4.2, < 7)
+      flipper (~> 0.17.1)
    flowdock (0.7.1)
      httparty (~> 0.7)
      multi_json
@ -332,10 +335,8 @@ GEM
    fog-xml (0.1.3)
      fog-core
      nokogiri (>= 1.5.11, < 2.0.0)
-    font-awesome-rails (4.7.0.4)
-      railties (>= 3.2, < 6.0)
-    foreman (0.84.0)
-      thor (~> 0.19.1)
+    font-awesome-rails (4.7.0.5)
+      railties (>= 3.2, < 6.1)
    formatador (0.2.5)
    fugit (1.2.1)
      et-orbi (~> 1.1, >= 1.1.8)
@ -358,12 +359,12 @@ GEM
      po_to_json (>= 1.0.0)
      rails (>= 3.2.0)
    git (1.5.0)
-    gitaly (1.65.0)
+    gitaly (1.70.0)
      grpc (~> 1.0)
    github-markup (1.7.0)
-    gitlab-labkit (0.5.2)
-      actionpack (~> 5)
-      activesupport (~> 5)
+    gitlab-labkit (0.7.0)
+      actionpack (>= 5.0.0, < 6.1.0)
+      activesupport (>= 5.0.0, < 6.1.0)
      grpc (~> 1.19)
      jaeger-client (~> 0.10)
      opentracing (~> 0.4)
@ -400,7 +401,7 @@ GEM
      mime-types (~> 3.0)
      representable (~> 3.0)
      retriable (>= 2.0, < 4.0)
-    google-protobuf (3.7.1)
+    google-protobuf (3.8.0)
    googleapis-common-protos-types (1.0.4)
      google-protobuf (~> 3.0)
    googleauth (0.6.6)
@ -410,7 +411,7 @@ GEM
      multi_json (~> 1.11)
      os (>= 0.9, < 2.0)
      signet (~> 0.7)
-    gpgme (2.0.18)
+    gpgme (2.0.19)
      mini_portile2 (~> 2.3)
    grape (1.1.0)
      activesupport
@ -440,11 +441,25 @@ GEM
      graphql (~> 1.6)
      html-pipeline (~> 2.8)
      sass (~> 3.4)
-    grpc (1.19.0)
-      google-protobuf (~> 3.1)
-      googleapis-common-protos-types (~> 1.0.0)
+    grpc (1.24.0)
+      google-protobuf (~> 3.8)
+      googleapis-common-protos-types (~> 1.0)
    gssapi (1.2.0)
      ffi (>= 1.0.1)
+    guard (2.15.1)
+      formatador (>= 0.2.4)
+      listen (>= 2.7, < 4.0)
+      lumberjack (>= 1.0.12, < 2.0)
+      nenv (~> 0.1)
+      notiffany (~> 0.0)
+      pry (>= 0.9.12)
+      shellany (~> 0.0)
+      thor (>= 0.18.1)
+    guard-compat (1.2.1)
+    guard-rspec (4.7.3)
+      guard (~> 2.1)
+      guard-compat (~> 1.1)
+      rspec (>= 2.99.0, < 4.0)
    haml (5.0.4)
      temple (>= 0.8.0)
      tilt
@ -508,7 +523,7 @@ GEM
      atlassian-jwt
      multipart-post
      oauth (~> 0.5, >= 0.5.0)
-    jmespath (1.3.1)
+    jmespath (1.4.0)
    js_regex (3.1.1)
      character_set (~> 1.1)
      regexp_parser (~> 1.1)
@ -560,15 +575,20 @@ GEM
      xml-simple
    licensee (8.9.2)
      rugged (~> 0.24)
+    listen (3.1.5)
+      rb-fsevent (~> 0.9, >= 0.9.4)
+      rb-inotify (~> 0.9, >= 0.9.7)
+      ruby_dep (~> 1.2)
    locale (2.1.2)
    lograge (0.10.0)
      actionpack (>= 4)
      activesupport (>= 4)
      railties (>= 4)
      request_store (~> 1.0)
-    loofah (2.3.0)
+    loofah (2.3.1)
      crass (~> 1.0.2)
      nokogiri (>= 1.5.9)
+    lumberjack (1.0.13)
    mail (2.7.1)
      mini_mime (>= 0.1.1)
    mail_room (0.9.1)
@ -584,7 +604,7 @@ GEM
    mime-types-data (3.2019.0331)
    mimemagic (0.3.2)
    mini_magick (4.9.5)
-    mini_mime (1.0.1)
+    mini_mime (1.0.2)
    mini_portile2 (2.4.0)
    minitest (5.11.3)
    msgpack (1.3.1)
@ -597,16 +617,20 @@ GEM
      mustermann (~> 1.0.0)
    nakayoshi_fork (0.0.4)
    nap (1.1.0)
+    nenv (0.3.0)
    net-ldap (0.16.0)
    net-ntp (2.1.3)
    net-ssh (5.2.0)
    netrc (0.11.0)
    nio4r (2.3.1)
    no_proxy_fix (0.1.2)
-    nokogiri (1.10.4)
+    nokogiri (1.10.5)
      mini_portile2 (~> 2.4.0)
    nokogumbo (1.5.0)
      nokogiri
+    notiffany (0.1.3)
+      nenv (~> 0.1)
+      shellany (~> 0.0)
    numerizer (0.1.1)
    oauth (0.5.4)
    oauth2 (1.4.1)
@ -675,12 +699,12 @@ GEM
      activesupport
      nokogiri (>= 1.4.4)
      omniauth (~> 1.0)
-    omniauth_openid_connect (0.3.1)
+    omniauth_openid_connect (0.3.3)
      addressable (~> 2.5)
-      omniauth (~> 1.3)
+      omniauth (~> 1.9)
      openid_connect (~> 1.1)
    open4 (1.3.4)
-    openid_connect (1.1.6)
+    openid_connect (1.1.8)
      activemodel
      attr_required (>= 1.0.0)
      json-jwt (>= 1.5.0)
@ -703,12 +727,12 @@ GEM
    pg (1.1.4)
    po_to_json (1.0.1)
      json (>= 1.6.0)
-    premailer (1.10.4)
+    premailer (1.11.1)
      addressable
-      css_parser (>= 1.4.10)
+      css_parser (>= 1.6.0)
      htmlentities (>= 4.0.0)
-    premailer-rails (1.9.7)
-      actionmailer (>= 3, < 6)
+    premailer-rails (1.10.3)
+      actionmailer (>= 3)
      premailer (~> 1.7, >= 1.7.9)
    proc_to_ast (0.1.0)
      coderay
@ -724,7 +748,7 @@ GEM
      pry (~> 0.10)
    pry-rails (0.3.6)
      pry (>= 0.10.4)
-    public_suffix (3.1.0)
+    public_suffix (3.1.1)
    puma (3.12.0)
    puma_worker_killer (0.1.0)
      get_process_mem (~> 0.2)
@ -734,8 +758,8 @@ GEM
    rack (2.0.7)
    rack-accept (0.4.5)
      rack (>= 0.4)
-    rack-attack (4.4.1)
-      rack
+    rack-attack (6.2.0)
+      rack (>= 1.0, < 3)
    rack-cors (1.0.2)
    rack-oauth2 (1.9.3)
      activesupport
@ -763,10 +787,10 @@ GEM
      bundler (>= 1.3.0)
      railties (= 5.2.3)
      sprockets-rails (>= 2.0.0)
-    rails-controller-testing (1.0.2)
-      actionpack (~> 5.x, >= 5.0.1)
-      actionview (~> 5.x, >= 5.0.1)
-      activesupport (~> 5.x)
+    rails-controller-testing (1.0.4)
+      actionpack (>= 5.0.1.x)
+      actionview (>= 5.0.1.x)
+      activesupport (>= 5.0.1.x)
    rails-dom-testing (2.0.3)
      activesupport (>= 4.2.0)
      nokogiri (>= 1.6)
@ -798,25 +822,25 @@ GEM
    recaptcha (4.13.1)
      json
    recursive-open-struct (1.1.0)
-    redis (4.1.2)
-    redis-actionpack (5.0.2)
-      actionpack (>= 4.0, < 6)
+    redis (4.1.3)
+    redis-actionpack (5.1.0)
+      actionpack (>= 4.0, < 7)
      redis-rack (>= 1, < 3)
      redis-store (>= 1.1.0, < 2)
-    redis-activesupport (5.0.7)
-      activesupport (>= 3, < 6)
+    redis-activesupport (5.2.0)
+      activesupport (>= 3, < 7)
      redis-store (>= 1.3, < 2)
    redis-namespace (1.6.0)
      redis (>= 3.0.4)
-    redis-rack (2.0.5)
+    redis-rack (2.0.6)
      rack (>= 1.5, < 3)
      redis-store (>= 1.2, < 2)
    redis-rails (5.0.2)
      redis-actionpack (>= 5.0, < 6)
      redis-activesupport (>= 5.0, < 6)
      redis-store (>= 1.2, < 2)
-    redis-store (1.6.0)
-      redis (>= 2.2, < 5)
+    redis-store (1.8.1)
+      redis (>= 4, < 5)
    regexp_parser (1.5.1)
    regexp_property_values (0.3.4)
    representable (3.0.4)
@ -824,9 +848,9 @@ GEM
      declarative-option (< 0.2.0)
      uber (< 0.2.0)
    request_store (1.3.1)
-    responders (2.4.1)
-      actionpack (>= 4.2.0, < 6.0)
-      railties (>= 4.2.0, < 6.0)
+    responders (3.0.0)
+      actionpack (>= 5.0)
+      railties (>= 5.0)
    rest-client (2.0.2)
      http-cookie (>= 1.0.2, < 2.0)
      mime-types (>= 1.16, < 4.0)
@ -897,11 +921,12 @@ GEM
    ruby-progressbar (1.10.1)
    ruby-saml (1.7.2)
      nokogiri (>= 1.5.10)
+    ruby_dep (1.5.0)
    ruby_parser (3.13.1)
      sexp_processor (~> 4.9)
    rubyntlm (0.6.2)
    rubypants (0.2.0)
-    rubyzip (1.2.2)
+    rubyzip (1.3.0)
    rugged (0.28.3.1)
    safe_yaml (1.0.4)
    sanitize (4.6.6)
@ -938,6 +963,7 @@ GEM
      faraday (>= 0.7.6, < 1.0)
    settingslogic (2.0.9)
    sexp_processor (4.12.0)
+    shellany (0.0.1)
    shoulda-matchers (4.0.1)
      activesupport (>= 4.2.0)
    sidekiq (5.2.7)
@ -978,11 +1004,11 @@ GEM
    sshkey (2.0.0)
    stackprof (0.2.10)
    state_machines (0.5.0)
-    state_machines-activemodel (0.5.1)
-      activemodel (>= 4.1, < 6.0)
+    state_machines-activemodel (0.7.1)
+      activemodel (>= 4.1)
      state_machines (>= 0.5.0)
-    state_machines-activerecord (0.5.1)
-      activerecord (>= 4.1, < 6.0)
+    state_machines-activerecord (0.6.0)
+      activerecord (>= 4.1)
      state_machines-activemodel (>= 0.5.0)
    swd (1.1.2)
      activesupport (>= 3)
@ -1127,12 +1153,13 @@ DEPENDENCIES
  creole (~> 0.5.0)
  danger (~> 6.0)
  database_cleaner (~> 1.7.0)
-  deckar01-task_list (= 2.2.0)
-  default_value_for (~> 3.2.0)
+  deckar01-task_list (= 2.2.1)
+  default_value_for (~> 3.3.0)
  derailed_benchmarks
  device_detector
  devise (~> 4.6)
  devise-two-factor (~> 3.0.0)
+  diff_match_patch (~> 0.1.0)
  diffy (~> 3.1.0)
  discordrb-webhooks-blackst0ne (~> 3.3)
  doorkeeper (~> 4.3)
@ -1149,9 +1176,9 @@ DEPENDENCIES
  faraday_middleware-aws-signers-v4
  fast_blank
  ffaker (~> 2.10)
-  flipper (~> 0.13.0)
-  flipper-active_record (~> 0.13.0)
-  flipper-active_support_cache_store (~> 0.13.0)
+  flipper (~> 0.17.1)
+  flipper-active_record (~> 0.17.1)
+  flipper-active_support_cache_store (~> 0.17.1)
  flowdock (~> 0.7)
  fog-aliyun (~> 0.3)
  fog-aws (~> 3.5)
@ -1161,14 +1188,13 @@ DEPENDENCIES
  fog-openstack (~> 1.0)
  fog-rackspace (~> 0.1.1)
  font-awesome-rails (~> 4.7)
-  foreman (~> 0.84.0)
  fugit (~> 1.2.1)
  fuubar (~> 2.2.0)
  gemojione (~> 3.3)
  gettext (~> 3.2.2)
  gettext_i18n_rails (~> 1.8.0)
  gettext_i18n_rails_js (~> 1.3)
-  gitaly (~> 1.65.0)
+  gitaly (~> 1.70.0)
  github-markup (~> 1.7.0)
  gitlab-labkit (~> 0.5)
  gitlab-license (~> 1.0)
@ -1181,8 +1207,8 @@ DEPENDENCIES
  gitlab_omniauth-ldap (~> 2.1.1)
  gon (~> 6.2)
  google-api-client (~> 0.23)
-  google-protobuf (~> 3.7.1)
-  gpgme (~> 2.0.18)
+  google-protobuf (~> 3.8.0)
+  gpgme (~> 2.0.19)
  grape (~> 1.1.0)
  grape-entity (~> 0.7.1)
  grape-path-helpers (~> 1.1)
@ -1190,8 +1216,9 @@ DEPENDENCIES
  graphiql-rails (~> 1.4.10)
  graphql (~> 1.9.11)
  graphql-docs (~> 1.6.0)
-  grpc (~> 1.19.0)
+  grpc (~> 1.24.0)
  gssapi
+  guard-rspec
  haml_lint (~> 0.31.0)
  hamlit (~> 2.8.8)
  hangouts-chat (~> 0.0.5)
@ -1226,7 +1253,7 @@ DEPENDENCIES
  net-ldap
  net-ntp
  net-ssh (~> 5.2)
-  nokogiri (~> 1.10.4)
+  nokogiri (~> 1.10.5)
  oauth2 (~> 1.4)
  octokit (~> 4.9)
  omniauth (~> 1.8)
@ -1246,17 +1273,17 @@ DEPENDENCIES
  omniauth-twitter (~> 1.4)
  omniauth-ultraauth (~> 0.0.2)
  omniauth_crowd (~> 2.2.0)
-  omniauth_openid_connect (~> 0.3.1)
+  omniauth_openid_connect (~> 0.3.3)
  org-ruby (~> 0.9.12)
  pg (~> 1.1)
-  premailer-rails (~> 1.9.7)
+  premailer-rails (~> 1.10.3)
  prometheus-client-mmap (~> 0.9.10)
  pry-byebug (~> 3.5.1)
  pry-rails (~> 0.3.4)
  puma (~> 3.12)
  puma_worker_killer
  rack (~> 2.0.7)
-  rack-attack (~> 4.4.1)
+  rack-attack (~> 6.2.0)
  rack-cors (~> 1.0.0)
  rack-oauth2 (~> 1.9.3)
  rack-proxy (~> 0.6.0)
@ -1275,7 +1302,8 @@ DEPENDENCIES
  redis-namespace (~> 1.6.0)
  redis-rails (~> 5.0.2)
  request_store (~> 1.3)
-  responders (~> 2.0)
+  responders (~> 3.0)
+  retriable (~> 3.1.2)
  rouge (~> 3.11.0)
  rqrcode-rails3 (~> 0.1.7)
  rspec-parameterized
@ -1291,7 +1319,7 @@ DEPENDENCIES
  ruby-prof (~> 1.0.0)
  ruby-progressbar
  ruby_parser (~> 3.8)
-  rubyzip (~> 1.2.2)
+  rubyzip (~> 1.3.0)
  rugged (~> 0.28)
  sanitize (~> 4.6)
  sassc-rails (~> 2.1.0)
@ -1312,7 +1340,7 @@ DEPENDENCIES
  sprockets (~> 3.7.0)
  sshkey (~> 2.0)
  stackprof (~> 0.2.10)
-  state_machines-activerecord (~> 0.5.1)
+  state_machines-activerecord (~> 0.6.0)
  sys-filesystem (~> 1.1.6)
  test-prof (~> 0.10.0)
  thin (~> 1.7.0)
--- a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
@ -146,10 +146,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0hl52pjgfzy3acdwnbxfqy08m808vlv9dmsyp03d5x7x0y499kvl";
+      sha256 = "1nvhd986xa6llyjnhikq4h1nrcf5b9r9s11if25qsj8358inrpga";
      type = "gem";
    };
-    version = "6.0.0";
+    version = "6.5.0";
  };
  adamantium = {
    dependencies = ["ice_nine" "memoizable"];
@ -309,16 +309,26 @@
    };
    version = "1.8.0";
  };
+  aws-eventstream = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "100g77a5ixg4p5zwq77f28n2pdkk0y481f7v83qrlmnj22318qq6";
+      type = "gem";
+    };
+    version = "1.0.3";
+  };
  aws-sdk = {
    dependencies = ["aws-sdk-resources"];
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "03r754cqa0jayf1nxpcmp1anaypxwpcjyjaq5cz7i04l9jdxvsnn";
+      sha256 = "1yvl9bxzaxgcyzix2yw46cgll9nl0xfg5qx1j6y3xc1i78rk7vy0";
      type = "gem";
    };
-    version = "2.9.32";
+    version = "2.11.374";
  };
  aws-sdk-core = {
    dependencies = ["aws-sigv4" "jmespath"];
@ -326,10 +336,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1pq09wwb74y4m5adk4hi4zlz05q6sxjxij6g71v6nkd0z83hi34x";
+      sha256 = "1d7nw1jihv7rglcmkd3hhidjflbzq5ik63n43q27pmx8ki108rd9";
      type = "gem";
    };
-    version = "2.9.32";
+    version = "2.11.374";
  };
  aws-sdk-resources = {
    dependencies = ["aws-sdk-core"];
@ -337,20 +347,21 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "15m56k12x9gzkcyhwrab1qhi3wqla0qmv84dkqcjwp44d7c2xjyi";
+      sha256 = "0qx2a67vsw8rz1y0m04f97p1q4zx7miy06a5ck78hm77nvsigjj4";
      type = "gem";
    };
-    version = "2.9.32";
+    version = "2.11.374";
  };
  aws-sigv4 = {
+    dependencies = ["aws-eventstream"];
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0cnrfxbaxn86qrxhfidg10f89ka1hddihakdhcvnri0dljaw7dsz";
+      sha256 = "1dfc8i5cxjwlvi4b665lbpbwvks8a6wfy3vfmwr3pjdmxwdmc2cs";
      type = "gem";
    };
-    version = "1.0.0";
+    version = "1.1.0";
  };
  axiom-types = {
    dependencies = ["descendants_tracker" "ice_nine" "thread_safe"];
@ -814,10 +825,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0bpxzy6gjw9ggjynlxschbfsgmx8lv3zw1azkjvnb8b9i895dqfi";
+      sha256 = "030sc98kjrb36rh7g21qsbdfxrj6knsjkx0mn3b7gig8zknwhp2f";
      type = "gem";
    };
-    version = "1.0.4";
+    version = "1.0.5";
  };
  creole = {
    groups = ["default"];
@ -835,10 +846,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0jlr17cn044yaq4l3d9p42g3bghnamwsprq9c39xn6pxjrn5k1hy";
+      sha256 = "1y4vc018b5mzp7winw4pbb22jk0dpxp22pzzxq7w0rgvfxzi89pd";
      type = "gem";
    };
-    version = "1.5.0";
+    version = "1.7.0";
  };
  daemons = {
    groups = ["default" "development"];
@ -901,10 +912,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0s637v5pi5ipmv0gn9g2wwjpxdm27dvppfjd8ml0dc1m0jsm7964";
+      sha256 = "09k7rlxsl7pd5kn3wyswgqi0hhbmlj40b66l4mf8v9mqf3c7v0yk";
      type = "gem";
    };
-    version = "2.2.0";
+    version = "2.2.1";
  };
  declarative = {
    groups = ["default"];
@ -932,10 +943,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1xj9d1y2fk3kxfm1kyiwasjpw6r1w7c1xjx26sm3c33xhmz57fla";
+      sha256 = "08hwnnqm3bxd4n627isliq79zysdlmfkf813403v0b4mkhika5my";
      type = "gem";
    };
-    version = "3.2.0";
+    version = "3.3.0";
  };
  derailed_benchmarks = {
    dependencies = ["benchmark-ips" "get_process_mem" "heapy" "memory_profiler" "rack" "rake" "thor"];
@ -1001,6 +1012,16 @@
    };
    version = "1.3";
  };
+  diff_match_patch = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "03n4g4w2pwiygmqq5lfhqrpbs9g6kv0jhb3vrffz3vgaryzmfq5k";
+      type = "gem";
+    };
+    version = "0.1.0";
+  };
  diffy = {
    groups = ["default"];
    platforms = [];
@ -1374,10 +1395,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1pdj9y3k6padiicfraxw9ibx9fm8yi2ihh608736lq5nnbf3k6gw";
+      sha256 = "01gbn1qmcvn49gjcbvd5fga57qc8l3915kb04ikkffvb6n09q7f7";
      type = "gem";
    };
-    version = "0.13.0";
+    version = "0.17.1";
  };
  flipper-active_record = {
    dependencies = ["activerecord" "flipper"];
@ -1385,10 +1406,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0rgm4h5h6xcbf17z47sw8ancaxva8x4hwlxmyqpm0vzj1pnc47c1";
+      sha256 = "154q9xajqs64gxa9fv4hwpad44x3rmwgpldrb941i8wi37dpzskg";
      type = "gem";
    };
-    version = "0.13.0";
+    version = "0.17.1";
  };
  flipper-active_support_cache_store = {
    dependencies = ["activesupport" "flipper"];
@ -1396,10 +1417,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0zpikmfhadb7l1ny6xbhk5d4840im6yq0wvfsnlw718spxi4ccgk";
+      sha256 = "0mkbyn3mx3f411x4z1l1djc9vix3wrfzd5rhrmxb83iqp60r42hg";
      type = "gem";
    };
-    version = "0.13.0";
+    version = "0.17.1";
  };
  flowdock = {
    dependencies = ["httparty" "multi_json"];
@ -1517,21 +1538,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "11mf7bk2737pyxjwba3a9lpgcxzbp0vgq01n2dn30774zysc90hj";
+      sha256 = "0a32q69rdsdw9zhmf2cflvvnikg20amidhn40sv2afw2qk91fcrz";
      type = "gem";
    };
-    version = "4.7.0.4";
-  };
-  foreman = {
-    dependencies = ["thor"];
-    groups = ["development"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "06mq39lpmc17bxzlwhad9d8i0lcnbb08xr18smh2x79mm631wsw0";
-      type = "gem";
-    };
-    version = "0.84.0";
+    version = "4.7.0.5";
  };
  formatador = {
    groups = ["default"];
@ -1645,10 +1655,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0h8jzwifqgkrgh9d05g0vsdkyrnk75i53lmm3pfp9rj47gvn1z1j";
+      sha256 = "0b705d2fmdisirf3hydakswdr8jq786wbqn053gvxgssrwcdlrq3";
      type = "gem";
    };
-    version = "1.65.0";
+    version = "1.70.0";
  };
  github-markup = {
    groups = ["default"];
@ -1666,10 +1676,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1j06gl4ksd83rycg3fb46bb77iw74i1ivs5li6pyf5klrxjq8k3h";
+      sha256 = "0r2zkxkj2l78c6qgr6k9lgcp7w6x7r703259rbsbrg7cfnjm43b7";
      type = "gem";
    };
-    version = "0.5.2";
+    version = "0.7.0";
  };
  gitlab-license = {
    groups = ["default"];
@ -1794,10 +1804,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "04988m3hmllg4sl4syjb35x0wzsg7rj1nmvhx3d9ihml22w76gb2";
+      sha256 = "0by3289irdklb9gjqw41fq6mg6yja3iyzh99dj8p8z9l4brllqn4";
      type = "gem";
    };
-    version = "3.7.1";
+    version = "3.8.0";
  };
  googleapis-common-protos-types = {
    dependencies = ["google-protobuf"];
@ -1827,10 +1837,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "12fqirxr964mc8jwsfl5nif6q4wcckrmj7w4c9ci4xg9xy2b9v6m";
+      sha256 = "0jbqajngi5ndqfarw9dxkhbphva0j71jav5wfym3fsiisvk5gg6p";
      type = "gem";
    };
-    version = "2.0.18";
+    version = "2.0.19";
  };
  grape = {
    dependencies = ["activesupport" "builder" "mustermann-grape" "rack" "rack-accept" "virtus"];
@ -1914,10 +1924,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1rdywzism5vxz8pnml6xjb9f19diclyy74014z69q01jzqwi1wgs";
+      sha256 = "18wikj9qd4jb4lks55cs2cf3q7fifnanm9z9ywnxhpj57vbnilpf";
      type = "gem";
    };
-    version = "1.19.0";
+    version = "1.24.0";
  };
  gssapi = {
    dependencies = ["ffi"];
@ -1930,6 +1940,38 @@
    };
    version = "1.2.0";
  };
+  guard = {
+    dependencies = ["formatador" "listen" "lumberjack" "nenv" "notiffany" "pry" "shellany" "thor"];
+    groups = ["default" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "000hn5cdqz3wl99b245q958c5byi2dlsqi814q5gmyljv7i47zwf";
+      type = "gem";
+    };
+    version = "2.15.1";
+  };
+  guard-compat = {
+    groups = ["default" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1zj6sr1k8w59mmi27rsii0v8xyy2rnsi09nqvwpgj1q10yq1mlis";
+      type = "gem";
+    };
+    version = "1.2.1";
+  };
+  guard-rspec = {
+    dependencies = ["guard" "guard-compat" "rspec"];
+    groups = ["test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1jkm5xp90gm4c5s51pmf92i9hc10gslwwic6mvk72g0yplya0yx4";
+      type = "gem";
+    };
+    version = "4.7.3";
+  };
  haml = {
    dependencies = ["temple" "tilt"];
    groups = ["default" "development" "test"];
@ -2241,10 +2283,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "07w8ipjg59qavijq59hl82zs74jf3jsp7vxl9q3a2d0wpv5akz3y";
+      sha256 = "1d4wac0dcd1jf6kc57891glih9w57552zgqswgy74d1xhgnk0ngf";
      type = "gem";
    };
-    version = "1.3.1";
+    version = "1.4.0";
  };
  js_regex = {
    dependencies = ["character_set" "regexp_parser" "regexp_property_values"];
@ -2450,6 +2492,17 @@
    };
    version = "8.9.2";
  };
+  listen = {
+    dependencies = ["rb-fsevent" "rb-inotify" "ruby_dep"];
+    groups = ["default" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "01v5mrnfqm6sgm8xn2v5swxsn1wlmq7rzh2i48d4jzjsc7qvb6mx";
+      type = "gem";
+    };
+    version = "3.1.5";
+  };
  locale = {
    groups = ["default" "development"];
    platforms = [];
@ -2477,10 +2530,20 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "06kfq90vi38gv6i128f4zg462kj32szs5vsgm25hxgw9zd12pj9x";
+      sha256 = "0npqav026zd7r4qdidq9x5nxcp2dzg71bnp421xxx7sngbxf2xbd";
      type = "gem";
    };
-    version = "2.3.0";
+    version = "2.3.1";
+  };
+  lumberjack = {
+    groups = ["default" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "06im7gcg42x77yhz2w5da2ly9xz0n0c36y5ks7xs53v0l9g0vf5n";
+      type = "gem";
+    };
+    version = "1.0.13";
  };
  mail = {
    dependencies = ["mini_mime"];
@ -2605,10 +2668,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1q4pshq387lzv9m39jv32vwb8wrq3wc4jwgl4jk209r4l33v09d3";
+      sha256 = "1axm0rxyx3ss93wbmfkm78a6x03l8y4qy60rhkkiq0aza0vwq3ha";
      type = "gem";
    };
-    version = "1.0.1";
+    version = "1.0.2";
  };
  mini_portile2 = {
    groups = ["default" "development" "test"];
@ -2721,6 +2784,16 @@
    };
    version = "1.1.0";
  };
+  nenv = {
+    groups = ["default" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0r97jzknll9bhd8yyg2bngnnkj8rjhal667n7d32h8h7ny7nvpnr";
+      type = "gem";
+    };
+    version = "0.3.0";
+  };
  net-ldap = {
    groups = ["default"];
    platforms = [];
@ -2787,10 +2860,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0nmdrqqz1gs0fwkgzxjl4wr554gr8dc1fkrqjc2jpsvwgm41rygv";
+      sha256 = "185g3dwba73jqxjr94bd2zk6fil6n9hmcfnfyzh3p1w47vm296r7";
      type = "gem";
    };
-    version = "1.10.4";
+    version = "1.10.5";
  };
  nokogumbo = {
    dependencies = ["nokogiri"];
@ -2803,6 +2876,17 @@
    };
    version = "1.5.0";
  };
+  notiffany = {
+    dependencies = ["nenv" "shellany"];
+    groups = ["default" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0f47h3bmg1apr4x51szqfv3rh2vq58z3grh4w02cp3bzbdh6jxnk";
+      type = "gem";
+    };
+    version = "0.1.3";
+  };
  numerizer = {
    groups = ["default"];
    platforms = [];
@ -3071,10 +3155,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0ja7cjlm4z0k0pwwy64djl58pay3lzkw7im565fybs4a8q4wmacb";
+      sha256 = "0awybp2jnai0w2qfgqnr3f478g3nbg5r0vcm6pa5g8k5f4rs19qr";
      type = "gem";
    };
-    version = "0.3.1";
+    version = "0.3.3";
  };
  open4 = {
    groups = ["default" "development"];
@ -3092,10 +3176,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1r13bv18nyvw0g1nw3fzffvv2si99zj24w0k5zgawf4q6nn5f7vd";
+      sha256 = "0r50vwf9hsf6r8gx5mwqs3w3w92l864ikiz9d0fcibqsr1489pbg";
      type = "gem";
    };
-    version = "1.1.6";
+    version = "1.1.8";
  };
  opentracing = {
    groups = ["default"];
@ -3206,10 +3290,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "10w6f7r6snpkcnv3byxma9b08lyqzcfxkm083scb2dr2ly4xkzyf";
+      sha256 = "1xrhmialxn5vlp1nmf40a4db9gji4h2wbzd7f43sz64z8lvrjj6h";
      type = "gem";
    };
-    version = "1.10.4";
+    version = "1.11.1";
  };
  premailer-rails = {
    dependencies = ["actionmailer" "premailer"];
@ -3217,10 +3301,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "05czxmx6hnykg6g23hy2ww2bf86a69njbi02sv7lrds4w776jhim";
+      sha256 = "0bqi7d4f15vy3f1g0xb3bxmncfbzv9dd3ilhqj0plvw64xqbkp3w";
      type = "gem";
    };
-    version = "1.9.7";
+    version = "1.10.3";
  };
  proc_to_ast = {
    dependencies = ["coderay" "parser" "unparser"];
@ -3299,10 +3383,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1c7c5xxkx91hwj4572hbnyvxmydb90q69wlpr2l0dxrmwx2p365l";
+      sha256 = "0g9ds2ffzljl6jjmkjffwxc1z6lh5nkqqmhhkxjk71q5ggv0rkpm";
      type = "gem";
    };
-    version = "3.1.0";
+    version = "3.1.1";
  };
  puma = {
    groups = ["puma"];
@ -3372,10 +3456,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1czx68p70x98y21dkdndsb64lrxf9qrv09wl1dbcxrypcjnpsdl1";
+      sha256 = "1sqjqwa18c0l59zdymcvvvnh5nk3pjggnzaydb2q1qbrk3rypcnq";
      type = "gem";
    };
-    version = "4.4.1";
+    version = "6.2.0";
  };
  rack-cors = {
    groups = ["default"];
@ -3458,10 +3542,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "16kdkk73mhhs73iz3i1i0ryjm84dadiyh817b3nh8acdi490jyhy";
+      sha256 = "1m1rklj6pvzi4fydxcmcv4q0xd7913hhhw1hw530nfz1wkl7vjlf";
      type = "gem";
    };
-    version = "1.0.2";
+    version = "1.0.4";
  };
  rails-dom-testing = {
    dependencies = ["activesupport" "nokogiri"];
@ -3640,10 +3724,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1mymdx7s5sr4mablklaipz679ckczsiigswm1g2v5mc93yj5amw3";
+      sha256 = "08v2y91q1pmv12g9zsvwj66w3s8j9d82yrmxgyv4y4gz380j3wyh";
      type = "gem";
    };
-    version = "4.1.2";
+    version = "4.1.3";
  };
  redis-actionpack = {
    dependencies = ["actionpack" "redis-rack" "redis-store"];
@ -3651,10 +3735,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "15k41gz7nygd4yydk2yd25gghya1j7q6zifk4mdrra6bwnwjbm63";
+      sha256 = "1hvai5ygkyii9wq8h98wim8shgrm7vkv0js62zpm85vdl1xzvphz";
      type = "gem";
    };
-    version = "5.0.2";
+    version = "5.1.0";
  };
  redis-activesupport = {
    dependencies = ["activesupport" "redis-store"];
@ -3662,10 +3746,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0y1df62gpqgy0yrlmgl05rp4kb0xvn0kylprhv1k32bs33dgpv62";
+      sha256 = "14a3z8810j02ysvg53f3mvcfb4rw34m91yfd19zy9y5lb3yv2g59";
      type = "gem";
    };
-    version = "5.0.7";
+    version = "5.2.0";
  };
  redis-namespace = {
    dependencies = ["redis"];
@ -3684,10 +3768,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "03xgdmq4fh187aqlh8z05idbxrmgddcarlb8x1kw4wjfcsf5afqi";
+      sha256 = "1pa19ydbk0l6wilwbxcjn6knfs4ffgj0rhaaldrlhf76pjgkaiqb";
      type = "gem";
    };
-    version = "2.0.5";
+    version = "2.0.6";
  };
  redis-rails = {
    dependencies = ["redis-actionpack" "redis-activesupport" "redis-store"];
@ -3706,10 +3790,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1mrcnjgkbmx1zf569mly82agdizqayjvnp2k6055k1iy07in3j8b";
+      sha256 = "1isqzzds9kszc2nn8jiy8ikry01qspn7637ba9z2k6sk7vky46d9";
      type = "gem";
    };
-    version = "1.6.0";
+    version = "1.8.1";
  };
  regexp_parser = {
    groups = ["default" "development" "test"];
@ -3758,10 +3842,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "18lqbiyc7234vd6iwxia5yvvzg6bdvdwl2nm4a5y7ia5fxjl3kqm";
+      sha256 = "1p7pqcfq33q1z4xlp4qm94w4h3fzc1yvr3cny16d00i8b20v4rx2";
      type = "gem";
    };
-    version = "2.4.1";
+    version = "3.0.0";
  };
  rest-client = {
    dependencies = ["http-cookie" "mime-types" "netrc"];
@ -4052,6 +4136,16 @@
    };
    version = "1.7.2";
  };
+  ruby_dep = {
+    groups = ["default" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1c1bkl97i9mkcvkn1jks346ksnvnnp84cs22gwl0vd7radybrgy5";
+      type = "gem";
+    };
+    version = "1.5.0";
+  };
  ruby_parser = {
    dependencies = ["sexp_processor"];
    groups = ["default"];
@ -4084,14 +4178,14 @@
    version = "0.2.0";
  };
  rubyzip = {
-    groups = ["default" "development" "test"];
+    groups = ["default" "development" "omnibus" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1n1lb2sdwh9h27y244hxzg1lrxxg2m53pk1vq7p33bna003qkyrj";
+      sha256 = "1qxc2zxwwipm6kviiar4gfhcakpx1jdcs89v6lvzivn5hq1xk78l";
      type = "gem";
    };
-    version = "1.2.2";
+    version = "1.3.0";
  };
  rugged = {
    groups = ["default"];
@ -4243,6 +4337,16 @@
    };
    version = "4.12.0";
  };
+  shellany = {
+    groups = ["default" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1ryyzrj1kxmnpdzhlv4ys3dnl2r5r3d2rs2jwzbnd1v96a8pl4hf";
+      type = "gem";
+    };
+    version = "0.0.1";
+  };
  shoulda-matchers = {
    dependencies = ["activesupport"];
    groups = ["test"];
@ -4439,10 +4543,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0chhm5hs1y83dq8haff10m66r3yrm7jab35r9xg6adn6qd8ynv2l";
+      sha256 = "05c2dw3115zj3pmyyqh2iypc7afj8ibhrghisg0d61z7gzmir1rd";
      type = "gem";
    };
-    version = "0.5.1";
+    version = "0.7.1";
  };
  state_machines-activerecord = {
    dependencies = ["activerecord" "state_machines-activemodel"];
@ -4450,10 +4554,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "00h07gd4kb22ahgv61r8zca9hqxaw44fnk2sc28j00c1nmwsw6r3";
+      sha256 = "12g7yqy11fpfiprzc86pwa9jjky1h3haxj37kg47467fgg43p511";
      type = "gem";
    };
-    version = "0.5.1";
+    version = "0.6.0";
  };
  swd = {
    dependencies = ["activesupport" "attr_required" "httpclient"];
--- a/pkgs/applications/version-management/gitlab/update.py
+++ b/pkgs/applications/version-management/gitlab/update.py
@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#! nix-shell -i python3 -p bundix common-updater-scripts nix nix-prefetch-git python3 python3Packages.requests python3Packages.lxml python3Packages.click python3Packages.click-log vgo2nix yarn2nix
+#! nix-shell -i python3 -p bundix common-updater-scripts nix nix-prefetch-git python3 python3Packages.requests python3Packages.lxml python3Packages.click python3Packages.click-log vgo2nix yarn2nix-moretea.yarn2nix

 import click
 import click_log
--- a/pkgs/applications/version-management/gitlab/yarnPkgs.nix
+++ b/pkgs/applications/version-management/gitlab/yarnPkgs.nix
--- a/pkgs/applications/version-management/gource/default.nix
+++ b/pkgs/applications/version-management/gource/default.nix
@ -3,12 +3,12 @@
 }:

 stdenv.mkDerivation rec {
-  version = "0.49";
+  version = "0.51";
  pname = "gource";

  src = fetchurl {
    url = "https://github.com/acaudwell/Gource/releases/download/${pname}-${version}/${pname}-${version}.tar.gz";
-    sha256 = "12hf5ipcsp9dxsqn84n4kr63xaiskrnf5a084wr29qk171lj7pd9";
+    sha256 = "16p7b1x4r0915w883lp374jcdqqja37fnb7m8vnsfnl2n64gi8qr";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/applications/virtualization/cntr/default.nix
+++ b/pkgs/applications/virtualization/cntr/default.nix
@ -2,13 +2,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "cntr";
-  version = "1.2.0";
+  version = "1.2.1";

  src = fetchFromGitHub {
    owner = "Mic92";
    repo = "cntr";
    rev = version;
-    sha256 = "0lmbsnjia44h4rskqkv9yc7xb6f3qjgbg8kcr9zqnr7ivr5fjcxg";
+    sha256 = "0dhfz7aj3cqi974ybf0axchih40rzrs9m8bxhwz1hgig57aisfc0";
  };

  cargoSha256 = "0xkwza9fx61pvlsm0s3dxc9i09mqp6c9df8w63fyiq7174vjxryx";
--- a/pkgs/applications/virtualization/cri-o/default.nix
+++ b/pkgs/applications/virtualization/cri-o/default.nix
@ -17,7 +17,7 @@

 buildGoPackage rec {
  project = "cri-o";
-  version = "1.16.0";
+  version = "1.16.1";
  name = "${project}-${version}${flavor}";

  goPackagePath = "github.com/${project}/${project}";
@ -26,7 +26,7 @@ buildGoPackage rec {
    owner = "cri-o";
    repo = "cri-o";
    rev = "v${version}";
-    sha256 = "1kbg544v7c1apaxrpndgrap0pb5c67d8fazbkgykg6ynskx6n344";
+    sha256 = "0w690zhc55gdqzc31jc34nrzwd253pfb3rq23z51q22nqwmlsh9p";
  };

  outputs = [ "bin" "out" ];
--- a/pkgs/applications/virtualization/docker-compose/default.nix
+++ b/pkgs/applications/virtualization/docker-compose/default.nix
@ -7,12 +7,12 @@
 }:

 buildPythonApplication rec {
-  version = "1.24.1";
+  version = "1.25.0";
  pname = "docker-compose";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0lx7bx6jvhydbab8vwry0bclhdf0dfj6jrns1m5y45yp9ybqxmd5";
+    sha256 = "0zlprmsgmj4z627snsl0qmq8y7ggcyqrqm5vxvrvcigl7zywnprc";
  };

  # lots of networking and other fails
--- a/pkgs/build-support/build-bazel-package/default.nix
+++ b/pkgs/build-support/build-bazel-package/default.nix
@ -4,10 +4,30 @@
 , lib
 }:

-args@{ name, bazelFlags ? [], bazelBuildFlags ? [], bazelFetchFlags ? [], bazelTarget, buildAttrs, fetchAttrs, ... }:
+args@{
+  name
+, bazelFlags ? []
+, bazelBuildFlags ? []
+, bazelFetchFlags ? []
+, bazelTarget
+, buildAttrs
+, fetchAttrs
+
+# Newer versions of Bazel are moving away from built-in rules_cc and instead
+# allow fetching it as an external dependency in a WORKSPACE file[1]. If
+# removed in the fixed-output fetch phase, building will fail to download it.
+# This can be seen e.g. in #73097
+#
+# This option allows configuring the removal of rules_cc in cases where a
+# project depends on it via an external dependency.
+#
+# [1]: https://github.com/bazelbuild/rules_cc
+, removeRulesCC ? true
+, ...
+}:

 let
-  fArgs = removeAttrs args [ "buildAttrs" "fetchAttrs" ];
+  fArgs = removeAttrs args [ "buildAttrs" "fetchAttrs" "removeRulesCC" ];
  fBuildAttrs = fArgs // buildAttrs;
  fFetchAttrs = fArgs // removeAttrs fetchAttrs [ "sha256" ];

@ -60,7 +80,7 @@ in stdenv.mkDerivation (fBuildAttrs // {

      # Remove all built in external workspaces, Bazel will recreate them when building
      rm -rf $bazelOut/external/{bazel_tools,\@bazel_tools.marker}
-      rm -rf $bazelOut/external/{rules_cc,\@rules_cc.marker}
+      ${if removeRulesCC then "rm -rf $bazelOut/external/{rules_cc,\\@rules_cc.marker}" else ""}
      rm -rf $bazelOut/external/{embedded_jdk,\@embedded_jdk.marker}
      rm -rf $bazelOut/external/{local_*,\@local_*.marker}

--- a/pkgs/build-support/fetchgit/nix-prefetch-git
+++ b/pkgs/build-support/fetchgit/nix-prefetch-git
@ -42,6 +42,7 @@ Options:
      --url url       Any url understood by 'git clone'.
      --rev ref       Any sha1 or references (such as refs/heads/master)
      --hash h        Expected hash.
+      --branch-name   Branch name to check out into
      --deepClone     Clone the entire repository.
      --no-deepClone  Make a shallow clone of just the required ref.
      --leave-dotGit  Keep the .git directories.
--- a/pkgs/common-updater/scripts/update-source-version
+++ b/pkgs/common-updater/scripts/update-source-version
@ -93,7 +93,7 @@ if [ -z "$oldUrl" ]; then
 fi

 drvName=$(nix-instantiate $systemArg --eval -E "with import ./. {}; lib.getName $attr" | tr -d '"')
-oldVersion=$(nix-instantiate $systemArg --eval -E "with import ./. {}; $attr.${versionKey} or lib.getVersion $attr" | tr -d '"')
+oldVersion=$(nix-instantiate $systemArg --eval -E "with import ./. {}; $attr.${versionKey} or (lib.getVersion $attr)" | tr -d '"')

 if [ -z "$drvName" -o -z "$oldVersion" ]; then
    die "Couldn't evaluate name and version from '$attr.name'!"
--- a/pkgs/data/fonts/iosevka/bin.nix
+++ b/pkgs/data/fonts/iosevka/bin.nix
@ -1,7 +1,7 @@
 { stdenv, fetchzip }:

 let
-  version = "2.3.2";
+  version = "2.3.3";
 in fetchzip {
  name = "iosevka-bin-${version}";

@ -12,7 +12,7 @@ in fetchzip {
    unzip -j $downloadedFile \*.ttc -d $out/share/fonts/iosevka
  '';

-  sha256 = "1dkfh354scjgzq7kgy4cn70z030wmfgxixqp8p9m6i0ps8gccjgs";
+  sha256 = "1dfm1888rii5kfmkxp5hnx8ycji57cbs5gazpgkxg1mnmn7i35wl";

  meta = with stdenv.lib; {
    homepage = https://be5invis.github.io/Iosevka/;
--- a/pkgs/data/fonts/overpass/default.nix
+++ b/pkgs/data/fonts/overpass/default.nix
@ -1,7 +1,7 @@
 { lib, fetchzip }:

 let
-  version = "3.0.3";
+  version = "3.0.4";
 in fetchzip rec {
  name = "overpass-${version}";

@ -12,10 +12,10 @@ in fetchzip rec {
    mkdir -p $out/share/doc/${name}    ; unzip -j $downloadedFile \*.md  -d $out/share/doc/${name}
  '';

-  sha256 = "1m6p7rrlyqikjvypp4698sn0lp3a4z0z5al4swblfhg8qaxzv5pg";
+  sha256 = "13b4yam0nycclccxidzj2fa3nwms5qji7gfkixdnl4ybf0f56b64";

  meta = with lib; {
-    homepage = http://overpassfont.org/;
+    homepage = "https://overpassfont.org/";
    description = "Font heavily inspired by Highway Gothic";
    license = licenses.ofl;
    platforms = platforms.all;
--- a/pkgs/data/fonts/rhodium-libre/default.nix
+++ b/pkgs/data/fonts/rhodium-libre/default.nix
@ -0,0 +1,28 @@
+{ lib, fetchFromGitHub }:
+
+let
+  pname = "RhodiumLibre";
+  version = "1.2.0";
+in fetchFromGitHub {
+  name = "${pname}-${version}";
+
+  owner = "DunwichType";
+  repo = pname;
+  rev = version;
+
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
+    install -Dm444 -t $out/share/fonts/opentype/ RhodiumLibre-Regular.otf
+    install -Dm444 -t $out/share/fonts/truetype/ RhodiumLibre-Regular.ttf
+  '';
+
+  sha256 = "04ax6bri5vsji465806p8d7zbdf12r5bpvcm9nb8isfqm81ggj0r";
+
+  meta = with lib; {
+    description = "F/OSS/Libre font for Latin and Devanagari";
+    homepage = "https://github.com/DunwichType/RhodiumLibre";
+    license = licenses.ofl;
+    platforms = platforms.all;
+    maintainers = [ maintainers.marsam ];
+  };
+}
--- a/pkgs/data/icons/flat-remix-icon-theme/default.nix
+++ b/pkgs/data/icons/flat-remix-icon-theme/default.nix
@ -0,0 +1,35 @@
+{ stdenv, fetchFromGitHub , gtk3 }:
+
+stdenv.mkDerivation rec  {
+  pname = "flat-remix-icon-theme";
+  version = "20191018";
+
+  src = fetchFromGitHub  {
+    owner = "daniruiz";
+    repo = "flat-remix";
+    rev = version;
+    sha256 = "13ibxvrvri04lb5phm49b6d553jh0aigm57z5i0nsins405gixn9";
+  };
+
+  nativeBuildInputs = [ gtk3 ];
+
+  installPhase = ''
+    mkdir -p $out/share/icons
+    mv Flat-Remix* $out/share/icons/
+  '';
+
+  postFixup = ''
+    for theme in $out/share/icons/*; do
+      gtk-update-icon-cache $theme
+    done
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Flat remix is a pretty simple icon theme inspired on material design";
+    homepage = https://drasite.com/flat-remix;
+    license = with licenses; [ gpl3 ];
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ mschneider ];
+  };
+}
+ 
--- a/pkgs/desktops/gnome-3/apps/gedit/default.nix
+++ b/pkgs/desktops/gnome-3/apps/gedit/default.nix
@ -6,11 +6,11 @@

 stdenv.mkDerivation rec {
  pname = "gedit";
-  version = "3.34.0";
+  version = "3.34.1";

  src = fetchurl {
    url = "mirror://gnome/sources/gedit/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0zjh3p3lns7a7kx3g3v7gkgcqdzyx1zyv8ssr6d5ljfb7hfyb59y";
+    sha256 = "1inm50sdfw63by1lf4f1swb59mpyxlly0g5rdg99j5l3357fzygb";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/gnome-3/apps/gnome-boxes/default.nix
+++ b/pkgs/desktops/gnome-3/apps/gnome-boxes/default.nix
@ -51,11 +51,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-boxes";
-  version = "3.34.1";
+  version = "3.34.2";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-boxes/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1758k5b79kyywdg67b4byqhva9045i13lzg5r62my950c4c2p0pc";
+    sha256 = "1rqdjf61cbi3zcpzr6cfkj3lcfrdlhs20bl65lxw2xrwk4jn0ph5";
  };

  doCheck = true;
--- a/pkgs/desktops/gnome-3/apps/gnome-maps/default.nix
+++ b/pkgs/desktops/gnome-3/apps/gnome-maps/default.nix
@ -5,13 +5,13 @@

 let
  pname = "gnome-maps";
-  version = "3.34.1";
+  version = "3.34.2";
 in stdenv.mkDerivation rec {
  name = "${pname}-${version}";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "03nswj60lqznr2j3ld2lgjzr4j9x2gblqx2ip4l2yxnm9kgbm14s";
+    sha256 = "00xslcnhhwslqglgfv2im7vq3awa49y2jxzr8wsby7f713k28vf5";
  };

  doCheck = true;
--- a/pkgs/desktops/gnome-3/core/evince/default.nix
+++ b/pkgs/desktops/gnome-3/core/evince/default.nix
@ -43,13 +43,13 @@

 stdenv.mkDerivation rec {
  pname = "evince";
-  version = "3.34.1";
+  version = "3.34.2";

  outputs = [ "out" "dev" "devdoc" ];

  src = fetchurl {
    url = "mirror://gnome/sources/evince/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1pr6fvbaam1mzxjwyqd53hcxzdjzf73idn10j4j7n54nwg6hgr45";
+    sha256 = "05q6v9lssd21623mnj2p49clj9v9csw9kay7n4nklki025grbh1w";
  };

  postPatch = ''
--- a/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix
+++ b/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "evolution-data-server";
-  version = "3.34.1";
+  version = "3.34.2";

  outputs = [ "out" "dev" ];

  src = fetchurl {
    url = "mirror://gnome/sources/evolution-data-server/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1gisymfjhkibqy73pmd0d3fwl43a23d0lvlxzqkycfdn9jh6pxbg";
+    sha256 = "16z85y6hhazcrp5ngw47w4x9r0j8zrj7awv5im58hhp0xs19zf1y";
  };

  patches = [
--- a/pkgs/desktops/gnome-3/core/mutter/default.nix
+++ b/pkgs/desktops/gnome-3/core/mutter/default.nix
@ -10,6 +10,7 @@
 , sysprof
 , desktop-file-utils
 , libcap_ng
+, egl-wayland
 }:

 stdenv.mkDerivation rec {
@ -26,6 +27,8 @@ stdenv.mkDerivation rec {
  mesonFlags = [
    "-Dxwayland-path=${xwayland}/bin/Xwayland"
    "-Dinstalled_tests=false" # TODO: enable these
+    "-Dwayland_eglstream=true"
+    "-Degl_device=true"
  ];

  propagatedBuildInputs = [
@ -52,7 +55,7 @@ stdenv.mkDerivation rec {
    gnome-desktop cairo pango cogl zenity libstartup_notification
    geocode-glib libinput libgudev libwacom
    libcanberra-gtk3 zenity xkeyboard_config libxkbfile
-    libxkbcommon pipewire xwayland
+    libxkbcommon pipewire xwayland egl-wayland
    gnome-settings-daemon sysprof
  ];

--- a/pkgs/desktops/gnome-3/games/gnome-taquin/default.nix
+++ b/pkgs/desktops/gnome-3/games/gnome-taquin/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-taquin";
-  version = "3.34.1";
+  version = "3.34.2";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-taquin/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0vyrfhkfpx83n9p70jssykbndvb3sxwdihqvvvb94rbw7n6c4q4r";
+    sha256 = "1ff3h57wr26np3dlh7smpslba2awxasmhv3y45bn498i3n1vyvsk";
  };

  passthru = {
--- a/pkgs/desktops/gnome-3/games/iagno/default.nix
+++ b/pkgs/desktops/gnome-3/games/iagno/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  pname = "iagno";
-  version = "3.34.2";
+  version = "3.34.3";

  src = fetchurl {
    url = "mirror://gnome/sources/iagno/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0r31k6b8mqgn5c55hi94gpdr776ykq7ww55vq6pmp5irhdwb3gn9";
+    sha256 = "1m9654dbi4vrl59wvbyxz7jf81v4mn4n5lcq7abb42lba965d2z2";
  };

  nativeBuildInputs = [
--- a/Show More
+++ b/Show More