Merge master into staging-next

2024-11-11 04:02:55 +03:00 · 2018-10-27 09:04:53 +02:00 · 2018-10-27 09:04:53 +02:00 · a64058e205
commit a64058e205
parent d3d6159046 549b61cc59
205 changed files with 3215 additions and 2188 deletions
--- a/doc/languages-frameworks/coq.xml
+++ b/doc/languages-frameworks/coq.xml
@ -12,8 +12,8 @@

 <para>
  Some extensions (plugins) might require OCaml and sometimes other OCaml
-  packages. The <literal>coq.ocamlPackages</literal> attribute can be used
-  to depend on the same package set Coq was built against.
+  packages. The <literal>coq.ocamlPackages</literal> attribute can be used to
+  depend on the same package set Coq was built against.
 </para>

 <para>
--- a/doc/languages-frameworks/vim.section.md
+++ b/doc/languages-frameworks/vim.section.md
@ -23,6 +23,7 @@ Adding custom .vimrc lines can be done using the following code:

 ```
 vim_configurable.customize {
+  # `name` specifies the name of the executable and package
  name = "vim-with-plugins";

  vimrcConfig.customRC = ''
@ -31,6 +32,8 @@ vim_configurable.customize {
 }
 ```

+This configuration is used when vim is invoked with the command specified as name, in this case `vim-with-plugins`.
+
 For Neovim the `configure` argument can be overridden to achieve the same:

 ```
@ -83,6 +86,7 @@ The resulting package can be added to `packageOverrides` in `~/.nixpkgs/config.n
 {
  packageOverrides = pkgs: with pkgs; {
    myVim = vim_configurable.customize {
+      # `name` specifies the name of the executable and package
      name = "vim-with-plugins";
      # add here code from the example section
    };
--- a/doc/stdenv.xml
+++ b/doc/stdenv.xml
@ -372,7 +372,7 @@ let f(h, h + 1, i) = i + h
      They are programs/libraries used at build time that furthermore produce
      programs/libraries also used at build time. If the dependency doesn't
      care about the target platform (i.e. isn't a compiler or similar tool),
-      put it in <varname>nativeBuildInputs</varname>instead. The most common
+      put it in <varname>nativeBuildInputs</varname> instead. The most common
      use for this <literal>buildPackages.stdenv.cc</literal>, the default C
      compiler for this role. That example crops up more than one might think
      in old commonly used C libraries.
@ -2099,13 +2099,13 @@ someVar=$(stripHash $name)
  </para>

  <para>
-   In order to alleviate this burden, the <firstterm>setup
-   hook></firstterm>mechanism was written, where any package can include a
-   shell script that [by convention rather than enforcement by Nix], any
-   downstream reverse-dependency will source as part of its build process. That
-   allows the downstream dependency to merely specify its dependencies, and
-   lets those dependencies effectively initialize themselves. No boilerplate
-   mirroring the list of dependencies is needed.
+   In order to alleviate this burden, the <firstterm>setup hook</firstterm>
+   mechanism was written, where any package can include a shell script that [by
+   convention rather than enforcement by Nix], any downstream
+   reverse-dependency will source as part of its build process. That allows the
+   downstream dependency to merely specify its dependencies, and lets those
+   dependencies effectively initialize themselves. No boilerplate mirroring the
+   list of dependencies is needed.
  </para>

  <para>
@ -2445,6 +2445,28 @@ addEnvHooks "$hostOffset" myBashFunction
      </para>
     </listitem>
    </varlistentry>
+    <varlistentry>
+     <term>
+      breakpointHook
+     </term>
+     <listitem>
+      <para>
+       This hook will make a build pause instead of stopping when a failure
+       happen. It prevents nix to cleanup the build environment immediatly and
+       allows the user to attach to a build environment using the
+       <command>cntr</command> command. On build error it will print the
+       instruction that are neccessary for <command>cntr</command>. Installing
+       cntr and running the command will provide shell access to the build
+       sandbox of failed build. At <filename>/var/lib/cntr</filename> the
+       sandbox filesystem is mounted. All commands and files of the system are
+       still accessible within the shell. To execute commands from the sandbox
+       use the cntr exec subcommand. Note that <command>cntr</command> also
+       needs to be executed on the machine that is doing the build, which might
+       be not the case when remote builders are enabled.
+       <command>cntr</command> is only supported on linux based platforms.
+      </para>
+     </listitem>
+    </varlistentry>
   </variablelist>
  </para>
 </section>
--- a/nixos/modules/config/users-groups.nix
+++ b/nixos/modules/config/users-groups.nix
@ -266,7 +266,7 @@ let
        (mkIf config.isNormalUser {
          group = mkDefault "users";
          createHome = mkDefault true;
-          home = mkDefault "/home/${name}";
+          home = mkDefault "/home/${config.name}";
          useDefaultShell = mkDefault true;
          isSystemUser = mkDefault false;
        })
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -120,6 +120,7 @@
  ./programs/sysdig.nix
  ./programs/systemtap.nix
  ./programs/sway.nix
+  ./programs/sway-beta.nix
  ./programs/thefuck.nix
  ./programs/tmux.nix
  ./programs/udevil.nix
@ -233,6 +234,7 @@
  ./services/desktops/dleyna-server.nix
  ./services/desktops/flatpak.nix
  ./services/desktops/geoclue2.nix
+  ./services/desktops/gsignond.nix
  ./services/desktops/pipewire.nix
  ./services/desktops/gnome3/at-spi2-core.nix
  ./services/desktops/gnome3/chrome-gnome-shell.nix
@ -503,6 +505,7 @@
  ./services/networking/dnsmasq.nix
  ./services/networking/ejabberd.nix
  ./services/networking/epmd.nix
+  ./services/networking/eternal-terminal.nix
  ./services/networking/fakeroute.nix
  ./services/networking/ferm.nix
  ./services/networking/firefox/sync-server.nix
--- a/nixos/modules/programs/sway-beta.nix
+++ b/nixos/modules/programs/sway-beta.nix
@ -0,0 +1,54 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.programs.sway-beta;
+  swayPackage = cfg.package;
+in {
+  options.programs.sway-beta = {
+    enable = mkEnableOption ''
+      Sway, the i3-compatible tiling Wayland compositor. This module will be removed after the final release of Sway 1.0
+    '';
+
+    package = mkOption {
+      type = types.package;
+      default = pkgs.sway-beta;
+      defaultText = "pkgs.sway-beta";
+      description = ''
+        The package to be used for `sway`.
+      '';
+    };
+
+    extraPackages = mkOption {
+      type = with types; listOf package;
+      default = with pkgs; [
+        xwayland dmenu
+      ];
+      defaultText = literalExample ''
+        with pkgs; [ xwayland dmenu ];
+      '';
+      example = literalExample ''
+        with pkgs; [
+          xwayland
+          i3status i3status-rust
+          termite rofi light
+        ]
+      '';
+      description = ''
+        Extra packages to be installed system wide.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ swayPackage ] ++ cfg.extraPackages;
+    security.pam.services.swaylock = {};
+    hardware.opengl.enable = mkDefault true;
+    fonts.enableDefaultFonts = mkDefault true;
+    programs.dconf.enable = mkDefault true;
+  };
+
+  meta.maintainers = with lib.maintainers; [ gnidorah primeos colemickens ];
+}
+
--- a/nixos/modules/security/rngd.nix
+++ b/nixos/modules/security/rngd.nix
@ -30,7 +30,7 @@ with lib;

      description = "Hardware RNG Entropy Gatherer Daemon";

-      serviceConfig.ExecStart = "${pkgs.rng_tools}/sbin/rngd -f -v" +
+      serviceConfig.ExecStart = "${pkgs.rng-tools}/sbin/rngd -f -v" +
        (if config.services.tcsd.enable then " --no-tpm=1" else "");
    };
  };
--- a/nixos/modules/services/desktops/gsignond.nix
+++ b/nixos/modules/services/desktops/gsignond.nix
@ -0,0 +1,43 @@
+# Accounts-SSO gSignOn daemon
+
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  package = pkgs.gsignond.override { plugins = config.services.gsignond.plugins; };
+in
+{
+
+  ###### interface
+
+  options = {
+
+    services.gsignond = {
+
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to enable gSignOn daemon, a DBus service
+          which performs user authentication on behalf of its clients.
+        '';
+      };
+
+      plugins = mkOption {
+        type = types.listOf types.package;
+        default = [];
+        description = ''
+          What plugins to use with the gSignOn daemon.
+        '';
+      };
+    };
+  };
+
+  ###### implementation
+  config = mkIf config.services.gsignond.enable {
+    environment.etc."gsignond.conf".source = "${package}/etc/gsignond.conf";
+    services.dbus.packages = [ package ];
+  };
+
+}
--- a/nixos/modules/services/hardware/trezord.nix
+++ b/nixos/modules/services/hardware/trezord.nix
@ -27,13 +27,13 @@ in {
      destination = "/etc/udev/rules.d/51-trezor.rules";
      text = ''
        # TREZOR v1 (One)
-        SUBSYSTEM=="usb", ATTR{idVendor}=="534c", ATTR{idProduct}=="0001", MODE="0666", GROUP="dialout", TAG+="uaccess", TAG+="udev-acl", SYMLINK+="trezor%n"
-        KERNEL=="hidraw*", ATTRS{idVendor}=="534c", ATTRS{idProduct}=="0001",  MODE="0666", GROUP="dialout", TAG+="uaccess", TAG+="udev-acl"
+        SUBSYSTEM=="usb", ATTR{idVendor}=="534c", ATTR{idProduct}=="0001", MODE="0660", GROUP="trezord", TAG+="uaccess", SYMLINK+="trezor%n"
+        KERNEL=="hidraw*", ATTRS{idVendor}=="534c", ATTRS{idProduct}=="0001", MODE="0660", GROUP="trezord", TAG+="uaccess"

        # TREZOR v2 (T)
-        SUBSYSTEM=="usb", ATTR{idVendor}=="1209", ATTR{idProduct}=="53c0", MODE="0661", GROUP="dialout", TAG+="uaccess", TAG+="udev-acl", SYMLINK+="trezor%n"
-        SUBSYSTEM=="usb", ATTR{idVendor}=="1209", ATTR{idProduct}=="53c1", MODE="0666", GROUP="dialout", TAG+="uaccess", TAG+="udev-acl", SYMLINK+="trezor%n"
-        KERNEL=="hidraw*", ATTRS{idVendor}=="1209", ATTRS{idProduct}=="53c1", MODE="0666", GROUP="dialout", TAG+="uaccess", TAG+="udev-acl"
+        SUBSYSTEM=="usb", ATTR{idVendor}=="1209", ATTR{idProduct}=="53c0", MODE="0660", GROUP="trezord", TAG+="uaccess", SYMLINK+="trezor%n"
+        SUBSYSTEM=="usb", ATTR{idVendor}=="1209", ATTR{idProduct}=="53c1", MODE="0660", GROUP="trezord", TAG+="uaccess", SYMLINK+="trezor%n"
+        KERNEL=="hidraw*", ATTRS{idVendor}=="1209", ATTRS{idProduct}=="53c1", MODE="0660", GROUP="trezord", TAG+="uaccess"
      '';
    });

--- a/nixos/modules/services/networking/ddclient.nix
+++ b/nixos/modules/services/networking/ddclient.nix
@ -182,9 +182,10 @@ with lib;
      serviceConfig = rec {
        DynamicUser = true;
        RuntimeDirectory = StateDirectory;
+        RuntimeDirectoryMode = "0750";
        StateDirectory = builtins.baseNameOf dataDir;
        Type = "oneshot";
-        ExecStartPre = "!${lib.getBin pkgs.coreutils}/bin/install -m666 ${cfg.configFile} /run/${RuntimeDirectory}/ddclient.conf";
+        ExecStartPre = "!${lib.getBin pkgs.coreutils}/bin/install -m660 ${cfg.configFile} /run/${RuntimeDirectory}/ddclient.conf";
        ExecStart = "${lib.getBin pkgs.ddclient}/bin/ddclient -file /run/${RuntimeDirectory}/ddclient.conf";
      };
    };
--- a/nixos/modules/services/networking/eternal-terminal.nix
+++ b/nixos/modules/services/networking/eternal-terminal.nix
@ -0,0 +1,89 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+  cfg = config.services.eternal-terminal;
+
+in
+
+{
+
+  ###### interface
+
+  options = {
+
+    services.eternal-terminal = {
+
+      enable = mkEnableOption "Eternal Terminal server";
+
+      port = mkOption {
+        default = 2022;
+        type = types.int;
+        description = ''
+          The port the server should listen on. Will use the server's default (2022) if not specified.
+        '';
+      };
+
+      verbosity = mkOption {
+        default = 0;
+        type = types.enum (lib.range 0 9);
+        description = ''
+          The verbosity level (0-9).
+        '';
+      };
+
+      silent = mkOption {
+        default = false;
+        type = types.bool;
+        description = ''
+          If enabled, disables all logging.
+        '';
+      };
+
+      logSize = mkOption {
+        default = 20971520;
+        type = types.int;
+        description = ''
+          The maximum log size.
+        '';
+      };
+    };
+  };
+
+  ###### implementation
+
+  config = mkIf cfg.enable {
+
+    # We need to ensure the et package is fully installed because
+    # the (remote) et client runs the `etterminal` binary when it
+    # connects.
+    environment.systemPackages = [ pkgs.eternal-terminal ];
+
+    systemd.services = {
+      eternal-terminal = {
+        description = "Eternal Terminal server.";
+        wantedBy = [ "multi-user.target" ];
+        after = [ "syslog.target" "network.target" ];
+        serviceConfig = {
+          Type = "forking";
+          ExecStart = "${pkgs.eternal-terminal}/bin/etserver --daemon --cfgfile=${pkgs.writeText "et.cfg" ''
+            ; et.cfg : Config file for Eternal Terminal
+            ;
+
+            [Networking]
+            port = ${toString cfg.port}
+
+            [Debug]
+            verbose = ${toString cfg.verbosity}
+            silent = ${if cfg.silent then "1" else "0"}
+            logsize = ${toString cfg.logSize}
+          ''}";
+          Restart = "on-failure";
+          KillMode = "process";
+        };
+      };
+    };
+  };
+}
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@ -192,7 +192,7 @@ in {
        type = types.nullOr types.str;
        default = null;
        description = ''
-          Database password.  Use <literal>adminpassFile</literal> to avoid this
+          Admin password.  Use <literal>adminpassFile</literal> to avoid this
          being world-readable in the <literal>/nix/store</literal>.
        '';
      };
--- a/pkgs/applications/audio/lollypop/default.nix
+++ b/pkgs/applications/audio/lollypop/default.nix
@ -4,7 +4,7 @@
 , gobjectIntrospection, wrapGAppsHook }:

 python3.pkgs.buildPythonApplication rec  {
-  version = "0.9.605";
+  version = "0.9.607";
  name = "lollypop-${version}";

  format = "other";
@ -14,7 +14,7 @@ python3.pkgs.buildPythonApplication rec  {
    url = "https://gitlab.gnome.org/World/lollypop";
    rev = "refs/tags/${version}";
    fetchSubmodules = true;
-    sha256 = "10d9k7ssh4snrrjy1hb3y39by6175493cmn50aq88xby2mdy3p74";
+    sha256 = "04giwp4i7j1qad41fiqlb8s3w03f1ww0p2mhi8n162sajnflr1rd";
  };

  nativeBuildInputs = with python3.pkgs; [
--- a/pkgs/applications/audio/mopidy/iris.nix
+++ b/pkgs/applications/audio/mopidy/iris.nix
@ -2,11 +2,11 @@

 pythonPackages.buildPythonApplication rec {
  pname = "Mopidy-Iris";
-  version = "3.27.1";
+  version = "3.28.1";

  src = pythonPackages.fetchPypi {
    inherit pname version;
-    sha256 = "00qlvfwfn7kybrx6rlj5h862syw3d5yak4sjqpxvacp7i5n1arsk";
+    sha256 = "0yph01z8lw0r5bw3aa14w0l7z1ymxvpmb131gbaw3ib0srssgz64";
  };

  propagatedBuildInputs = [
--- a/pkgs/applications/audio/pulseeffects/default.nix
+++ b/pkgs/applications/audio/pulseeffects/default.nix
@ -44,13 +44,13 @@ let
  ];
 in stdenv.mkDerivation rec {
  name = "pulseeffects-${version}";
-  version = "4.3.7";
+  version = "4.3.9";

  src = fetchFromGitHub {
    owner = "wwmm";
    repo = "pulseeffects";
    rev = "v${version}";
-    sha256 = "1x1jnbpbc9snya9k2xq39gssf0k4lnd1hr4cjrnwscg5rqybxqsk";
+    sha256 = "1vir05hy2n0nk0gaqbn680bx53ixcyi2y0hq4grgm73bbb1jzqq6";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/display-managers/sddm/default.nix
+++ b/pkgs/applications/display-managers/sddm/default.nix
@ -4,7 +4,7 @@
 }:

 let
-  version = "0.17.0";
+  version = "0.18.0";

 in mkDerivation rec {
  name = "sddm-${version}";
@ -13,12 +13,11 @@ in mkDerivation rec {
    owner = "sddm";
    repo = "sddm";
    rev = "v${version}";
-    sha256 = "1m35ly6miwy8ivsln3j1bfv0nxbc4gyqnj7f847zzp53jsqrm3mq";
+    sha256 = "16xnm02iqgy4hydzd6my0widq981glbazbhxnihhclgsaczh8mfq";
  };

  patches = [
    ./sddm-ignore-config-mtime.patch
-    ./qt511.patch
  ];

  postPatch =
--- a/pkgs/applications/display-managers/sddm/qt511.patch
+++ b/pkgs/applications/display-managers/sddm/qt511.patch
@ -1,28 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 005c9ad..71b46d7 100644
--- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -93,7 +93,7 @@ find_package(XCB REQUIRED)
- find_package(XKB REQUIRED)
- 
- # Qt 5
-find_package(Qt5 5.6.0 CONFIG REQUIRED Core DBus Gui Qml Quick LinguistTools)
-+find_package(Qt5 5.6.0 CONFIG REQUIRED Core DBus Gui Qml Quick LinguistTools Test)
- 
- # find qt5 imports dir
- get_target_property(QMAKE_EXECUTABLE Qt5::qmake LOCATION)
-diff --git a/test/CMakeLists.txt b/test/CMakeLists.txt
-index c9d935a..bb85ddd 100644
--- a/test/CMakeLists.txt
-+++ b/test/CMakeLists.txt
-@@ -2,9 +2,8 @@ set(QT_USE_QTTEST TRUE)
- 
- include_directories(../src/common)
- 
-
- set(ConfigurationTest_SRCS ConfigurationTest.cpp ../src/common/ConfigReader.cpp)
- add_executable(ConfigurationTest ${ConfigurationTest_SRCS})
- add_test(NAME Configuration COMMAND ConfigurationTest)
- 
-qt5_use_modules(ConfigurationTest Test)
-+target_link_libraries(ConfigurationTest Qt5::Core Qt5::Test)
--- a/pkgs/applications/editors/featherpad/default.nix
+++ b/pkgs/applications/editors/featherpad/default.nix
@ -0,0 +1,23 @@
+{ stdenv, fetchurl, pkgconfig, qt5, fetchFromGitHub }:
+
+with qt5;
+
+stdenv.mkDerivation rec {
+  version = "0.9.1";
+  name = "featherpad-${version}";
+  src = fetchFromGitHub {
+    owner = "tsujan";
+    repo = "FeatherPad";
+    rev = "V${version}";
+    sha256 = "053j14f6fw31cdnfr8hqpxw6jh2v65z43qchdsymbrk5zji8gxla";
+  };
+  nativeBuildInputs = [ qmake pkgconfig qttools ];
+  buildInputs = [ qtbase qtsvg qtx11extras ];
+  meta = with stdenv.lib; {
+    description = "Lightweight Qt5 Plain-Text Editor for Linux";
+    homepage = https://github.com/tsujan/FeatherPad;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.flosse ];
+    license = licenses.gpl3;
+  };
+}
--- a/pkgs/applications/editors/kile/default.nix
+++ b/pkgs/applications/editors/kile/default.nix
@ -1,6 +1,6 @@
 { mkDerivation
 , lib
-, fetchgit
+, fetchurl
 , extra-cmake-modules
 , kdoctools
 , wrapGAppsHook
@ -22,13 +22,11 @@
 }:

 mkDerivation rec {
-  name = "kile-${version}";
-  version = "2017-02-09";
+  name = "kile-2.9.92";

-  src = fetchgit {
-    url = git://anongit.kde.org/kile.git;
-    rev = "f77f6e627487c152f111e307ad6dc71699ade746";
-    sha256 = "0wpqaix9ssa28cm7qqjj0zfrscjgk8s3kmi5b4kk8h583gsrikib";
+  src = fetchurl {
+    url = "mirror://sourceforge/kile/${name}.tar.bz2";
+    sha256 = "177372dc25b1d109e037a7dbfc64b5dab2efe538320c87f4a8ceada21e9097f2";

  };

--- a/pkgs/applications/editors/neovim/neovim-remote.nix
+++ b/pkgs/applications/editors/neovim/neovim-remote.nix
@ -4,14 +4,14 @@ with stdenv.lib;

 pythonPackages.buildPythonPackage rec {
  pname = "neovim-remote";
-  version = "2.0.5";
+  version = "2.1.0";
  disabled = !pythonPackages.isPy3k;

  src = fetchFromGitHub {
    owner = "mhinz";
    repo = "neovim-remote";
    rev = "v${version}";
-    sha256 = "08qsi61ba5d69ca77layypzvi7nalx4niy97xn4w88jibnbmbrxw";
+    sha256 = "0gri4d8gg5hvywffvj8r123d06x006qhink7d54yk6lvplw64gyc";
  };

  propagatedBuildInputs = with pythonPackages; [ neovim psutil ];
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "8.1.0450";
+  version = "8.1.0490";

  src = fetchFromGitHub {
    owner = "vim";
    repo = "vim";
    rev = "v${version}";
-    sha256 = "1zhggpn4i704apfqn2kqr717kz9dvkjwnbmc3ydza621zjyrnxb2";
+    sha256 = "0gmlz2w066pcrn0jzpv3gk1qwx148f33gvgf5nkfy4nl1ljki81r";
  };

  enableParallelBuilding = true;
--- a/pkgs/applications/graphics/batik/default.nix
+++ b/pkgs/applications/graphics/batik/default.nix
@ -15,5 +15,11 @@ stdenv.mkDerivation {
    homepage = https://xmlgraphics.apache.org/batik;
    license = licenses.asl20;
    platforms = platforms.unix;
+    knownVulnerabilities = [
+      # vulnerabilities as of 16th October 2018 from https://xmlgraphics.apache.org/security.html:
+      "CVE-2018-8013"
+      "CVE-2017-5662"
+      "CVE-2015-0250"
+    ];
  };
 }
--- a/pkgs/applications/misc/dmrconfig/default.nix
+++ b/pkgs/applications/misc/dmrconfig/default.nix
@ -0,0 +1,37 @@
+{ stdenv, fetchFromGitHub
+, libusb1, systemd }:
+
+stdenv.mkDerivation rec {
+  name = "dmrconfig-${version}";
+  version = "2018-10-20";
+
+  src = fetchFromGitHub {
+    owner = "sergev";
+    repo = "dmrconfig";
+    rev = "a4c5f893d2749727493427320c7f01768966ba51";
+    sha256 = "0h7hv6fv6v5g922nvgrb0w7hsqbhaw7xmdc6vydh2p3l7sp31vg2";
+  };
+
+  buildInputs = [
+    libusb1 systemd
+  ];
+
+  preConfigure = ''
+    substituteInPlace Makefile --replace /usr/local/bin/dmrconfig $out/bin/dmrconfig
+  '';
+
+  preInstall = ''
+    mkdir -p $out/bin
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Configuration utility for DMR radios";
+    longDescription = ''
+      DMRconfig is a utility for programming digital radios via USB programming cable.
+    '';
+    homepage = https://github.com/sergev/dmrconfig;
+    license = licenses.asl20;
+    maintainers = [ maintainers.etu ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/misc/kiwix/default.nix
+++ b/pkgs/applications/misc/kiwix/default.nix
@ -103,5 +103,8 @@ stdenv.mkDerivation rec {
    license = licenses.gpl3;
    platforms = platforms.linux;
    maintainers = with maintainers; [ robbinch ];
+    knownVulnerabilities = [
+      "CVE-2015-1032"
+    ];
  };
 }
--- a/pkgs/applications/misc/slic3r/prusa3d.nix
+++ b/pkgs/applications/misc/slic3r/prusa3d.nix
@ -33,7 +33,7 @@ let
 in
 stdenv.mkDerivation rec {
  name = "slic3r-prusa-edition-${version}";
-  version = "1.41.0";
+  version = "1.41.1";

  enableParallelBuilding = true;

@ -114,7 +114,7 @@ stdenv.mkDerivation rec {
  src = fetchFromGitHub {
    owner = "prusa3d";
    repo = "Slic3r";
-    sha256 = "1al60hrqbhl05dnsr99hzbmxmn26fyx19sc5zxv816x3q6px9n2d";
+    sha256 = "0068wwsjwmnxql7653vy3labcyslzf17kr8xdr4lg2jplm022hvy";
    rev = "version_${version}";
  };

--- a/pkgs/applications/misc/soapysdr/default.nix
+++ b/pkgs/applications/misc/soapysdr/default.nix
@ -6,7 +6,7 @@
 } :

 let
-  version = "0.6.1";
+  version = "0.7.0";

 in stdenv.mkDerivation {
  name = "soapysdr-${version}";
@ -15,7 +15,7 @@ in stdenv.mkDerivation {
    owner = "pothosware";
    repo = "SoapySDR";
    rev = "soapy-sdr-${version}";
-    sha256 = "1azbb2j6dv0b2dd5ks6yqd31j17sdhi9p82czwc8zy2isymax0l9";
+    sha256 = "14fjwnfj7jz9ixvim2gy4f52y6s7d4xggzxn2ck7g4q35d879x13";
  };

  nativeBuildInputs = [ cmake pkgconfig ];
--- a/pkgs/applications/misc/urh/default.nix
+++ b/pkgs/applications/misc/urh/default.nix
@ -2,13 +2,13 @@

 python3Packages.buildPythonApplication rec {
  name = "urh-${version}";
-  version = "2.3.0";
+  version = "2.4.0";

  src = fetchFromGitHub {
    owner = "jopohl";
    repo = "urh";
    rev = "v${version}";
-    sha256 = "1n105lwz8w5fiw93w9amasq0f4gknihl3x9kj0q77lw7ha1lvdfz";
+    sha256 = "0cwbqcv0yffg6fa3g4zknwffa6119i6827w6jm74fhlfa9kwy34c";
  };

  buildInputs = [ hackrf rtl-sdr ];
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@ -92,11 +92,6 @@ let
  buildPath = "out/${buildType}";
  libExecPath = "$out/libexec/${packageName}";

-  freetype_source = fetchurl {
-    url = http://anduin.linuxfromscratch.org/BLFS/other/chromium-freetype.tar.xz;
-    sha256 = "1vhslc4xg0d6wzlsi99zpah2xzjziglccrxn55k7qna634wyxg77";
-  };
-
  versionRange = min-version: upto-version:
    let inherit (upstream-info) version;
        result = versionAtLeast version min-version && versionOlder version upto-version;
@ -132,22 +127,26 @@ let
      ++ optional pulseSupport libpulseaudio
      ++ optional (versionAtLeast version "71") at-spi2-core;

-    patches = [
-      # As major versions are added, you can trawl the gentoo and arch repos at
-      # https://gitweb.gentoo.org/repo/gentoo.git/plain/www-client/chromium/
-      # https://git.archlinux.org/svntogit/packages.git/tree/trunk?h=packages/chromium
-      # for updated patches and hints about build flags
-    # (gentooPatch "<patch>" "0000000000000000000000000000000000000000000000000000000000000000")
-      ./patches/fix-freetype.patch
+    patches = optional enableWideVine ./patches/widevine.patch ++ [
      ./patches/nix_plugin_paths_68.patch
      ./patches/remove-webp-include-69.patch
-    ] ++ optional enableWideVine ./patches/widevine.patch
-      ++ optional ((versionRange "69" "70") && stdenv.isAarch64)
-           (fetchpatch {
-              url    = https://raw.githubusercontent.com/OSSystems/meta-browser/e4a667deaaf9a26a3a1aeb355770d1f29da549ad/recipes-browser/chromium/files/0001-vpx_sum_squares_2d_i16_neon-Make-s2-a-uint64x1_t.patch;
-              sha256 = "0f37rsjx7jcvdngkj8y6600091nwgn4jci0ny7bxlapq0zx2a4x7";
-            })
-      ++ optional stdenv.isAarch64
+      # Unfortunately, chromium regularly breaks on major updates and
+      # then needs various patches backported. Good sources for such patches and other hints:
+      # - https://gitweb.gentoo.org/repo/gentoo.git/plain/www-client/chromium/
+      # - https://git.archlinux.org/svntogit/packages.git/tree/trunk?h=packages/chromium
+      # - https://github.com/chromium/chromium/search?q=GCC&s=committer-date&type=Commits
+      #
+      # ++ optional (versionRange "68" "72") ( githubPatch "<patch>" "0000000000000000000000000000000000000000000000000000000000000000" )
+    ]  ++ optionals (versionOlder version "71") [
+       ( githubPatch "cbdb8bd6567c8143dc8c1e5e86a21a8ea064eea4" "0258qlffp6f6izswczb11p8zdpn550z5yqa9z7gdg2rg5171n5i8" )
+       ( githubPatch "e98f8ef8b2f236ecbb01df8c39e6ee1c8fbe8d7d" "1ky5xrzch6aya87kn0bgb31lksl3g8kh2v8k676ks7pdl2v132p9" )
+       ( githubPatch "a4de8da116585357c123d71e5f54d1103824c6df" "1y7afnjrsz6j2l3vy1ms8mrkbb51xhcafw9r371algi48il7rajm" )
+       ( githubPatch "b033d2ba32da5ea237656568c25908d4f12b7bac" "008dg8vk822wyrinirx4nh92yq9bki4mwfwvcwnxdjmvz3y0jfcc" )
+       ( githubPatch "2f9563e49f6c28dfe52940901417a4031b95a49b" "1q8qhpzx611yzrxa8lgpw0bad9bxx84rsrvczl4xvk5qh93zna7i" )
+       ( githubPatch "a66e0a3f3f57eb045639e2752a99ade348dc17e9" "1c5x9856b167z270357wr8l6m1wrznxcx89ykj6kfz5djqmv251g" )
+       ( githubPatch "4d9714247f617bf9e1cf95f735148f5e598a9529" "1423jf3lzbljzgbcwvfrrfyhyl3fab988hsyjvk95zyclxff7iij" )
+       ( githubPatch "87902b3202f81d689dd314c17006ffc907fe12a1" "15q37cd26s73girq1imcs52fb1irh0qlfvhksh6g0l0jjrdyzk6r" )
+    ] ++ optional stdenv.isAarch64
           (if (versionOlder version "71") then
              fetchpatch {
                url       = https://raw.githubusercontent.com/OSSystems/meta-browser/e4a667deaaf9a26a3a1aeb355770d1f29da549ad/recipes-browser/chromium/files/aarch64-skia-build-fix.patch;
@ -193,11 +192,6 @@ let
      mkdir -p third_party/node/linux/node-linux-x64/bin
      ln -s $(which node) third_party/node/linux/node-linux-x64/bin/node

-      # use patched freetype
-      # FIXME https://bugs.chromium.org/p/pdfium/issues/detail?id=733
-      # FIXME http://savannah.nongnu.org/bugs/?51156
-      tar -xJf ${freetype_source}
-
      # remove unused third-party
      # in third_party/crashpad third_party/zlib contains just a header-adapter
      for lib in ${toString gnSystemLibraries}; do
@ -243,8 +237,6 @@ let
      google_api_key = "AIzaSyDGi15Zwl11UNe6Y-5XW_upsfyw31qwZPI";
      google_default_client_id = "404761575300.apps.googleusercontent.com";
      google_default_client_secret = "9rIFQjfnkykEmqb6FfjJQD1D";
-    } // optionalAttrs (versionRange "60" "70") {
-      use_gtk3 = true;
    } // optionalAttrs proprietaryCodecs {
      # enable support for the H.264 codec
      proprietary_codecs = true;
--- a/pkgs/applications/networking/browsers/chromium/patches/fix-freetype.patch
+++ b/pkgs/applications/networking/browsers/chromium/patches/fix-freetype.patch
@ -1,15 +0,0 @@
--- a/third_party/freetype/BUILD.gn
-+++ b/third_party/freetype/BUILD.gn
-@@ -63,10 +63,12 @@ source_set("freetype_source") {
-     "src/src/base/ftbase.c",
-     "src/src/base/ftbbox.c",
-     "src/src/base/ftbitmap.c",
-+    "src/src/base/ftfntfmt.c",
-     "src/src/base/ftfstype.c",
-     "src/src/base/ftgasp.c",
-     "src/src/base/ftglyph.c",
-     "src/src/base/ftinit.c",
-+    "src/src/base/ftlcdfil.c",
-     "src/src/base/ftmm.c",
-     "src/src/base/ftstroke.c",
-     "src/src/base/fttype1.c",
--- a/pkgs/applications/networking/browsers/chromium/patches/nix_plugin_paths_68.patch
+++ b/pkgs/applications/networking/browsers/chromium/patches/nix_plugin_paths_68.patch
@ -50,15 +50,6 @@ index f4e119d..d9775bd 100644
         return false;
       cur = cur.Append(kPepperFlashBaseDirectory);
       break;
-@@ -323,7 +316,7 @@ bool PathProvider(int key, base::FilePath* result) {
-     // We currently need a path here to look up whether the plugin is disabled
-     // and what its permissions are.
-     case chrome::FILE_NACL_PLUGIN:
-      if (!GetInternalPluginsDirectory(&cur))
-+      if (!GetInternalPluginsDirectory(&cur, "NACL"))
-         return false;
-       cur = cur.Append(kInternalNaClPluginFileName);
-       break;
@@ -358,7 +351,7 @@ bool PathProvider(int key, base::FilePath* result) {
         cur = cur.DirName();
       }
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@ -1,18 +1,18 @@
 # This file is autogenerated from update.sh in the same directory.
 {
  beta = {
-    sha256 = "16biicw86mnjrmjazfbml2pf4rykhbvsz854cyfnpjhcvmlh24jp";
-    sha256bin64 = "07jr1sqsxfdy3rymylkbpbgi79j9b2pax4igdzj943d0nbka84y5";
-    version = "70.0.3538.35";
+    sha256 = "0dqfwghl73gcmbnl9wb3i5wz8q65y1vhg7n0m2nh0hv33w1w4mp9";
+    sha256bin64 = "0x7npns1ng7p4w1qswcj889v9lplvy2wv1ccxrk4ilyqiwzvwy1z";
+    version = "70.0.3538.67";
  };
  dev = {
-    sha256 = "0fmkhvvydinv5f543n7rrmsv99rf0skwwhlpmszvspx6y4wz9smv";
-    sha256bin64 = "0plr8ph78kfg2dpyacjy3aw3msfif95fqpb8xx0n8whkkpbl9968";
-    version = "71.0.3559.6";
+    sha256 = "1kw0rn58s4nd43z2qkjph7aid0s3jnmm650d7k1yxppgmfsal246";
+    sha256bin64 = "0518qrghjk5jlzhmynk6nngp5i81bpxi3880gimpbd7bblj6dg7y";
+    version = "71.0.3578.10";
  };
  stable = {
-    sha256 = "0dcyzsb70ssx5hd2b25ab3ydpqh7crhxab9zzi5gn99ywxh1afg3";
-    sha256bin64 = "0w56k7hmdi9knjaw67kdmyz0fdkjmk2ldh2n4l1c6szkr66vq30q";
-    version = "69.0.3497.100";
+    sha256 = "0dqfwghl73gcmbnl9wb3i5wz8q65y1vhg7n0m2nh0hv33w1w4mp9";
+    sha256bin64 = "0ihs2xfb2zn8aq11kg7miw9rnjwc6l4k5jgf24dm661463xmd3ha";
+    version = "70.0.3538.67";
  };
 }
--- a/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@ -10,6 +10,7 @@
 , hunspell, libevent, libstartup_notification, libvpx
 , icu, libpng, jemalloc, glib
 , autoconf213, which, gnused, cargo, rustc, llvmPackages
+, rust-cbindgen, nodejs
 , debugBuild ? false

 ### optionals
@ -111,7 +112,6 @@ stdenv.mkDerivation rec {
    "-I${glib.dev}/include/gio-unix-2.0"
  ]
  ++ lib.optionals (!isTorBrowserLike) [
-    "-I${nspr.dev}/include/nspr"
    "-I${nss.dev}/include/nss"
  ]
  ++ lib.optional stdenv.isDarwin [
@ -121,12 +121,15 @@ stdenv.mkDerivation rec {

  postPatch = lib.optionalString stdenv.isDarwin ''
    substituteInPlace js/src/jsmath.cpp --replace 'defined(HAVE___SINCOS)' 0
+  '' + lib.optionalString (lib.versionAtLeast ffversion "63.0" && !isTorBrowserLike) ''
+    substituteInPlace third_party/prio/prio/rand.c --replace 'nspr/prinit.h' 'prinit.h'
  '';

  nativeBuildInputs =
    [ autoconf213 which gnused pkgconfig perl python2 cargo rustc ]
    ++ lib.optional gtk3Support wrapGAppsHook
    ++ lib.optionals stdenv.isDarwin [ xcbuild rsync ]
+    ++ lib.optionals (lib.versionAtLeast ffversion "63.0") [ rust-cbindgen nodejs ]
    ++ extraNativeBuildInputs;

  preConfigure = ''
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@ -26,10 +26,10 @@ rec {

  firefox = common rec {
    pname = "firefox";
-    ffversion = "62.0.3";
+    ffversion = "63.0";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${ffversion}/source/firefox-${ffversion}.source.tar.xz";
-      sha512 = "0kvb664s47bmmdq2ppjsnyqy8yaiig1xj81r25s36c3i8igfq3zxvws10k2dlmmmrwyc5k4g9i9imgkxj7r3xwwqxc72dl429wvfys8";
+      sha512 = "095nn50g72l4ihbv26qqqs2jg4ahnmd54vxvm7nxwrnkx901aji7pph6c91zfpf7df26ib1b0pqyir9vsac40sdxc8yrzm6d0lyl1m2";
    };

    patches = nixpkgsPatches ++ [
--- a/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
@ -3,11 +3,11 @@
 let configFile = writeText "riot-config.json" conf; in
 stdenv.mkDerivation rec {
  name= "riot-web-${version}";
-  version = "0.16.5";
+  version = "0.17.0";

  src = fetchurl {
    url = "https://github.com/vector-im/riot-web/releases/download/v${version}/riot-v${version}.tar.gz";
-    sha256 = "1b82d82pfv4kjdxghc8y78zwmnc89hi7arvql2bx0zyfhzxj6drl";
+    sha256 = "1ffbwz7wp1xhfv8a5nhrhw97nl5ybf0j97dkk2sy9cdlribzxs04";
  };

  installPhase = ''
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@ -56,11 +56,11 @@ let

 in stdenv.mkDerivation rec {
  name = "signal-desktop-${version}";
-  version = "1.17.0";
+  version = "1.17.1";

  src = fetchurl {
    url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "0daxp8ychvvr4lqz8wni8lkalk3w409pzwnikvf92f1whxs76xj0";
+    sha256 = "1cvgjllnbdsr61pz6r4dkbbz58cf69k7p8wriyp1vpzkdi7k5bpl";
  };

  phases = [ "unpackPhase" "installPhase" ];
--- a/pkgs/applications/networking/irc/weechat/default.nix
+++ b/pkgs/applications/networking/irc/weechat/default.nix
@ -30,12 +30,12 @@ let
  weechat =
    assert lib.all (p: p.enabled -> ! (builtins.elem null p.buildInputs)) plugins;
    stdenv.mkDerivation rec {
-      version = "2.2";
+      version = "2.3";
      name = "weechat-${version}";

      src = fetchurl {
-        url = "http://weechat.org/files/src/weechat-${version}.tar.bz2";
-        sha256 = "0p4nhh7f7w4q77g7jm9i6fynndqlgjkc9dk5g1xb4gf9imiisqlg";
+        url = "https://weechat.org/files/src/weechat-${version}.tar.bz2";
+        sha256 = "0mi4pfnyny0vqc35r0scn6yy21y790a5iwq8ms7kch7b7z11jn9w";
      };

      outputs = [ "out" "man" ] ++ map (p: p.name) enabledPlugins;
@ -70,13 +70,6 @@ let
        done
      '';

-      # remove when bumping to the latest version.
-      # This patch basically rebases `fcf7469d7664f37e94d5f6d0b3fe6fce6413f88c`
-      # from weechat upstream to weechat-2.2.
-      patches = [
-        ./aggregate-commands.patch
-      ];
-
      meta = {
        homepage = http://www.weechat.org/;
        description = "A fast, light and extensible chat client";
--- a/pkgs/applications/version-management/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitaly/default.nix
@ -7,14 +7,14 @@ let
    gemdir = ./.;
  };
 in buildGoPackage rec {
-  version = "0.125.0";
+  version = "0.125.1";
  name = "gitaly-${version}";

  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitaly";
    rev = "v${version}";
-    sha256 = "14a4qgpnspzw9cjqh6gbw3771bxfm789ibvmvb8jc4pklvbyl4mi";
+    sha256 = "0vbxjqjs1r5c350r67812andasby5zk25xlaqp201lmlvamiv0ni";
  };

  goPackagePath = "gitlab.com/gitlab-org/gitaly";
--- a/pkgs/applications/version-management/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab-workhorse/default.nix
@ -1,14 +1,15 @@
 { stdenv, fetchFromGitLab, git, go }:
+
 stdenv.mkDerivation rec {
  name = "gitlab-workhorse-${version}";

-  version = "6.1.1";
+  version = "7.0.0";

  srcs = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-workhorse";
    rev = "v${version}";
-    sha256 = "1dwvk86bfsqgkp0mwz71yis3i7aypjf96r3hsjkgpd27hwbjgxbr";
+    sha256 = "1mmfb7h5sbva2kv9h9cxfg7dyksxrwwikq7jwggfawqaadzwm677";
  };

  buildInputs = [ git go ];
--- a/pkgs/applications/version-management/gitlab/default.nix
+++ b/pkgs/applications/version-management/gitlab/default.nix
@ -11,29 +11,29 @@ let
    groups = [ "default" "unicorn" "ed25519" "metrics" ];
  };

-  version = "11.3.4";
+  version = "11.4.0";

  sources = if gitlabEnterprise then {
    gitlabDeb = fetchurl {
      url = "https://packages.gitlab.com/gitlab/gitlab-ee/packages/debian/stretch/gitlab-ee_${version}-ee.0_amd64.deb/download.deb";
-      sha256 = "1cgwm6g1mij1958mdyds8f76qjw39nllsr23dvsqgf60h4vbsdfd";
+      sha256 = "1y2a8acgsgrgcjazijsflhxq4fwqvd9yhrjx5pcncb24vl0x6dg4";
    };
    gitlab = fetchFromGitLab {
      owner = "gitlab-org";
      repo = "gitlab-ee";
      rev = "v${version}-ee";
-      sha256 = "1ifaa879l85d4yfzrgszrgj04bfjxjh3n7v31zfb6lsqmh87xbm4";
+      sha256 = "1pyqk1c5bml7chs4pq1fcxkrhk5r327xx9my6zmp2cb503s5m590";
    };
  } else {
    gitlabDeb = fetchurl {
      url = "https://packages.gitlab.com/gitlab/gitlab-ce/packages/debian/stretch/gitlab-ce_${version}-ce.0_amd64.deb/download.deb";
-      sha256 = "0hls81ns9n10xrzw0b9pn1916445irqrysbicsdl8kdn83ds35p7";
+      sha256 = "0wiizjihn1a6hg6a2wpwmnh5a34n102va4djac3sgx74mwx4bniq";
    };
    gitlab = fetchFromGitLab {
      owner = "gitlab-org";
      repo = "gitlab-ce";
      rev = "v${version}";
-      sha256 = "0dymr706yn917niybg2gj1pkgrzgiirbv4ib9pkgs140kbf3hn0c";
+      sha256 = "1a8pavqc9bblss5z9ikc9b0k0ra33vw73zy7rvn0v1wgvbqpc24k";
    };
  };

--- a/pkgs/applications/version-management/gitlab/rubyEnv-ce/Gemfile
+++ b/pkgs/applications/version-management/gitlab/rubyEnv-ce/Gemfile
@ -80,16 +80,14 @@ gem 'gitlab_omniauth-ldap', '~> 2.0.4', require: 'omniauth-ldap'
 gem 'net-ldap'

 # Git Wiki
-# Required manually in config/initializers/gollum.rb to control load order
+# Only used to compute wiki page slugs
 gem 'gitlab-gollum-lib', '~> 4.2', require: false

-gem 'gitlab-gollum-rugged_adapter', '~> 0.4.4', require: false
-
 # Language detection
 gem 'github-linguist', '~> 5.3.3', require: 'linguist'

 # API
-gem 'grape', '~> 1.0'
+gem 'grape', '~> 1.1'
 gem 'grape-entity', '~> 0.7.1'
 gem 'rack-cors', '~> 1.0.0', require: 'rack/cors'

@ -112,9 +110,6 @@ gem 'hamlit', '~> 2.8.8'
 gem 'carrierwave', '= 1.2.3'
 gem 'mini_magick'

-# Drag and Drop UI
-gem 'dropzonejs-rails', '~> 0.7.1'
-
 # for backups
 gem 'fog-aws', '~> 2.0.1'
 gem 'fog-core', '~> 1.44'
@ -137,6 +132,7 @@ gem 'seed-fu', '~> 2.3.7'
 gem 'html-pipeline', '~> 2.8'
 gem 'deckar01-task_list', '2.0.0'
 gem 'gitlab-markup', '~> 1.6.4'
+gem 'github-markup', '~> 1.7.0', require: 'github/markup'
 gem 'redcarpet', '~> 3.4'
 gem 'commonmarker', '~> 0.17'
 gem 'RedCloth', '~> 4.3.2'
@ -170,10 +166,9 @@ gem 'state_machines-activerecord', '~> 0.5.1'
 gem 'acts-as-taggable-on', '~> 5.0'

 # Background jobs
-gem 'sidekiq', '~> 5.1'
+gem 'sidekiq', '~> 5.2.1'
 gem 'sidekiq-cron', '~> 0.6.0'
 gem 'redis-namespace', '~> 1.6.0'
-gem 'sidekiq-limit_fetch', '~> 3.4', require: false

 # Cron Parser
 gem 'rufus-scheduler', '~> 3.4'
@ -300,7 +295,7 @@ gem 'peek-mysql2', '~> 1.1.0', group: :mysql
 gem 'peek-pg', '~> 1.3.0', group: :postgres
 gem 'peek-rblineprof', '~> 0.2.0'
 gem 'peek-redis', '~> 1.2.0'
-gem 'peek-sidekiq', '~> 1.0.3'
+gem 'gitlab-sidekiq-fetcher', require: 'sidekiq-reliable-fetch'

 # Metrics
 group :metrics do
@ -425,7 +420,7 @@ group :ed25519 do
 end

 # Gitaly GRPC client
-gem 'gitaly-proto', '~> 0.117.0', require: 'gitaly'
+gem 'gitaly-proto', '~> 0.118.1', require: 'gitaly'
 gem 'grpc', '~> 1.11.0'

 # Locked until https://github.com/google/protobuf/issues/4210 is closed
--- a/pkgs/applications/version-management/gitlab/rubyEnv-ce/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/rubyEnv-ce/Gemfile.lock
@ -86,7 +86,7 @@ GEM
    bindata (2.4.3)
    binding_of_caller (0.7.2)
      debug_inspector (>= 0.0.1)
-    bootsnap (1.3.1)
+    bootsnap (1.3.2)
      msgpack (~> 1.0)
    bootstrap_form (2.7.0)
    brakeman (4.2.1)
@ -133,14 +133,14 @@ GEM
    concurrent-ruby (1.0.5)
    concurrent-ruby-ext (1.0.5)
      concurrent-ruby (= 1.0.5)
-    connection_pool (2.2.1)
+    connection_pool (2.2.2)
    crack (0.4.3)
      safe_yaml (~> 1.0.0)
    crass (1.0.4)
    creole (0.5.0)
    css_parser (1.5.0)
      addressable
-    daemons (1.2.3)
+    daemons (1.2.6)
    database_cleaner (1.5.3)
    debug_inspector (0.0.2)
    debugger-ruby_core_source (1.3.8)
@ -175,8 +175,6 @@ GEM
    doorkeeper-openid_connect (1.5.0)
      doorkeeper (~> 4.3)
      json-jwt (~> 1.6)
-    dropzonejs-rails (0.7.2)
-      rails (> 3.1)
    ed25519 (1.2.4)
    email_reply_trimmer (0.1.6)
    email_spec (2.2.0)
@ -189,7 +187,7 @@ GEM
    escape_utils (1.1.1)
    et-orbi (1.0.3)
      tzinfo
-    eventmachine (1.0.8)
+    eventmachine (1.2.7)
    excon (0.62.0)
    execjs (2.6.0)
    expression_parser (0.9.0)
@ -276,7 +274,7 @@ GEM
      gettext_i18n_rails (>= 0.7.1)
      po_to_json (>= 1.0.0)
      rails (>= 3.2.0)
-    gitaly-proto (0.117.0)
+    gitaly-proto (0.118.1)
      google-protobuf (~> 3.1)
      grpc (~> 1.10)
    github-linguist (5.3.3)
@ -297,15 +295,14 @@ GEM
      rouge (~> 3.1)
      sanitize (~> 4.6.4)
      stringex (~> 2.6)
-    gitlab-gollum-rugged_adapter (0.4.4.1)
-      mime-types (>= 1.15)
-      rugged (~> 0.25)
    gitlab-grit (2.8.2)
      charlock_holmes (~> 0.6)
      diff-lcs (~> 1.1)
      mime-types (>= 1.16)
      posix-spawn (~> 0.3)
    gitlab-markup (1.6.4)
+    gitlab-sidekiq-fetcher (0.3.0)
+      sidekiq (~> 5)
    gitlab-styles (2.4.1)
      rubocop (~> 0.54.0)
      rubocop-gitlab-security (~> 0.1.0)
@ -343,7 +340,7 @@ GEM
      signet (~> 0.7)
    gpgme (2.0.13)
      mini_portile2 (~> 2.1)
-    grape (1.0.3)
+    grape (1.1.0)
      activesupport
      builder
      mustermann-grape (~> 1.0.0)
@ -493,7 +490,7 @@ GEM
    mime-types-data (3.2016.0521)
    mimemagic (0.3.0)
    mini_magick (4.8.0)
-    mini_mime (1.0.0)
+    mini_mime (1.0.1)
    mini_portile2 (2.3.0)
    minitest (5.7.0)
    mousetrap-rails (1.4.6)
@ -501,7 +498,7 @@ GEM
    multi_json (1.13.1)
    multi_xml (0.6.0)
    multipart-post (2.0.0)
-    mustermann (1.0.2)
+    mustermann (1.0.3)
    mustermann-grape (1.0.0)
      mustermann (~> 1.0.0)
    mysql2 (0.4.10)
@ -605,10 +602,6 @@ GEM
      atomic (>= 1.0.0)
      peek
      redis
-    peek-sidekiq (1.0.3)
-      atomic (>= 1.0.0)
-      peek
-      sidekiq
    pg (0.18.4)
    po_to_json (1.0.1)
      json (>= 1.6.0)
@ -633,9 +626,9 @@ GEM
    pry-byebug (3.4.3)
      byebug (>= 9.0, < 9.1)
      pry (~> 0.10)
-    pry-rails (0.3.5)
-      pry (>= 0.9.10)
-    public_suffix (3.0.2)
+    pry-rails (0.3.6)
+      pry (>= 0.10.4)
+    public_suffix (3.0.3)
    pyu-ruby-sasl (0.0.3.3)
    rack (1.6.10)
    rack-accept (0.4.5)
@ -649,7 +642,7 @@ GEM
      httpclient (>= 2.4)
      multi_json (>= 1.3.6)
      rack (>= 1.1)
-    rack-protection (2.0.1)
+    rack-protection (2.0.3)
      rack
    rack-proxy (0.6.0)
      rack
@ -735,7 +728,7 @@ GEM
    retriable (3.1.2)
    rinku (2.0.0)
    rotp (2.1.2)
-    rouge (3.2.1)
+    rouge (3.3.0)
    rqrcode (0.7.0)
      chunky_png
    rqrcode-rails3 (0.1.7)
@ -843,16 +836,13 @@ GEM
      rack
    shoulda-matchers (3.1.2)
      activesupport (>= 4.0.0)
-    sidekiq (5.1.3)
-      concurrent-ruby (~> 1.0)
-      connection_pool (~> 2.2, >= 2.2.0)
+    sidekiq (5.2.1)
+      connection_pool (~> 2.2, >= 2.2.2)
      rack-protection (>= 1.5.0)
      redis (>= 3.3.5, < 5)
    sidekiq-cron (0.6.0)
      rufus-scheduler (>= 3.3.0)
      sidekiq (>= 4.2.1)
-    sidekiq-limit_fetch (3.4.0)
-      sidekiq (>= 4)
    signet (0.8.1)
      addressable (~> 2.3)
      faraday (~> 0.9)
@ -865,7 +855,7 @@ GEM
      simplecov-html (~> 0.10.0)
    simplecov-html (0.10.0)
    slack-notifier (1.5.1)
-    spring (2.0.1)
+    spring (2.0.2)
      activesupport (>= 4.2)
    spring-commands-rspec (1.0.4)
      spring (>= 0.9.1)
@ -895,7 +885,7 @@ GEM
    test_after_commit (1.1.0)
      activerecord (>= 3.2)
    text (1.3.1)
-    thin (1.7.0)
+    thin (1.7.2)
      daemons (~> 1.0, >= 1.0.9)
      eventmachine (~> 1.0, >= 1.0.4)
      rack (>= 1, < 3)
@ -954,7 +944,7 @@ GEM
      addressable (>= 2.3.6)
      crack (>= 0.3.2)
      hashdiff
-    webpack-rails (0.9.10)
+    webpack-rails (0.9.11)
      railties (>= 3.2.0)
    wikicloth (0.8.1)
      builder
@ -1013,7 +1003,6 @@ DEPENDENCIES
  diffy (~> 3.1.0)
  doorkeeper (~> 4.3)
  doorkeeper-openid_connect (~> 1.5)
-  dropzonejs-rails (~> 0.7.1)
  ed25519 (~> 1.2)
  email_reply_trimmer (~> 0.1)
  email_spec (~> 2.2.0)
@ -1038,19 +1027,20 @@ DEPENDENCIES
  gettext (~> 3.2.2)
  gettext_i18n_rails (~> 1.8.0)
  gettext_i18n_rails_js (~> 1.3)
-  gitaly-proto (~> 0.117.0)
+  gitaly-proto (~> 0.118.1)
  github-linguist (~> 5.3.3)
+  github-markup (~> 1.7.0)
  gitlab-flowdock-git-hook (~> 1.0.1)
  gitlab-gollum-lib (~> 4.2)
-  gitlab-gollum-rugged_adapter (~> 0.4.4)
  gitlab-markup (~> 1.6.4)
+  gitlab-sidekiq-fetcher
  gitlab-styles (~> 2.4)
  gitlab_omniauth-ldap (~> 2.0.4)
  gon (~> 6.2)
  google-api-client (~> 0.23)
  google-protobuf (= 3.5.1)
  gpgme
-  grape (~> 1.0)
+  grape (~> 1.1)
  grape-entity (~> 0.7.1)
  grape-path-helpers (~> 1.0)
  grape_logging (~> 1.7)
@ -1114,7 +1104,6 @@ DEPENDENCIES
  peek-pg (~> 1.3.0)
  peek-rblineprof (~> 0.2.0)
  peek-redis (~> 1.2.0)
-  peek-sidekiq (~> 1.0.3)
  pg (~> 0.18.2)
  premailer-rails (~> 1.9.7)
  prometheus-client-mmap (~> 0.9.4)
@ -1166,9 +1155,8 @@ DEPENDENCIES
  settingslogic (~> 2.0.9)
  sham_rack (~> 1.3.6)
  shoulda-matchers (~> 3.1.2)
-  sidekiq (~> 5.1)
+  sidekiq (~> 5.2.1)
  sidekiq-cron (~> 0.6.0)
-  sidekiq-limit_fetch (~> 3.4)
  simple_po_parser (~> 1.1.2)
  simplecov (~> 0.14.0)
  slack-notifier (~> 1.5.1)
--- a/pkgs/applications/version-management/gitlab/rubyEnv-ce/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/rubyEnv-ce/gemset.nix
@ -301,10 +301,10 @@
    dependencies = ["msgpack"];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1i3llrdqkndxzhv1a7a2yjpavmdabyq5ps296vmb32hv8fy95xk9";
+      sha256 = "0g6r784lmjfhwi046w82phsk244byq9wkj1q3lddwxg9z559bmhy";
      type = "gem";
    };
-    version = "1.3.1";
+    version = "1.3.2";
  };
  bootstrap_form = {
    source = {
@ -504,10 +504,10 @@
  connection_pool = {
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "17vpaj6kyf2i8bimaxz7rg1kyadf4d10642ja67qiqlhwgczl2w7";
+      sha256 = "0lflx29mlznf1hn0nihkgllzbj8xp5qasn8j7h838465pi399k68";
      type = "gem";
    };
-    version = "2.2.1";
+    version = "2.2.2";
  };
  crack = {
    dependencies = ["safe_yaml"];
@ -546,10 +546,10 @@
  daemons = {
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0b839hryy9sg7x3knsa1d6vfiyvn0mlsnhsb6an8zsalyrz1zgqg";
+      sha256 = "0lxqq6dgb8xhliywar2lvkwqy2ssraf9dk4b501pb4ixc2mvxbp2";
      type = "gem";
    };
-    version = "1.2.3";
+    version = "1.2.6";
  };
  database_cleaner = {
    source = {
@ -695,15 +695,6 @@
    };
    version = "1.5.0";
  };
-  dropzonejs-rails = {
-    dependencies = ["rails"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1vqqxzv6qdqy47m2q28adnmccfvc17p2bmkkaqjvrczrhvkkha64";
-      type = "gem";
-    };
-    version = "0.7.2";
-  };
  ed25519 = {
    source = {
      remotes = ["https://rubygems.org"];
@ -773,10 +764,10 @@
  eventmachine = {
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1frvpk3p73xc64qkn0ymll3flvn4xcycq5yx8a43zd3gyzc1ifjp";
+      sha256 = "0wh9aqb0skz80fhfn66lbpr4f86ya2z5rx6gm5xlfhd05bj1ch4r";
      type = "gem";
    };
-    version = "1.0.8";
+    version = "1.2.7";
  };
  excon = {
    source = {
@ -1078,10 +1069,10 @@
    dependencies = ["google-protobuf" "grpc"];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0ixgzw4clmhjhmv3fy9niq4x16k1yn9iyjbc99z5674xlp7nm40i";
+      sha256 = "19nyx75xnb3lsap6rr3p1avqsw1dcrm8d3ggmmihd58a9s762fki";
      type = "gem";
    };
-    version = "0.117.0";
+    version = "0.118.1";
  };
  github-linguist = {
    dependencies = ["charlock_holmes" "escape_utils" "mime-types" "rugged"];
@ -1118,15 +1109,6 @@
    };
    version = "4.2.7.5";
  };
-  gitlab-gollum-rugged_adapter = {
-    dependencies = ["mime-types" "rugged"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "092i02k3kd4ghk1h1l5yrvi9b180dgfxrvwni26facb2kc9f3wbi";
-      type = "gem";
-    };
-    version = "0.4.4.1";
-  };
  gitlab-grit = {
    dependencies = ["charlock_holmes" "diff-lcs" "mime-types" "posix-spawn"];
    source = {
@ -1144,6 +1126,15 @@
    };
    version = "1.6.4";
  };
+  gitlab-sidekiq-fetcher = {
+    dependencies = ["sidekiq"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0dvrp4iapwfaakc3qgf7mw05blxzfywpjfr7bhswwflih0pm67l7";
+      type = "gem";
+    };
+    version = "0.3.0";
+  };
  gitlab-styles = {
    dependencies = ["rubocop" "rubocop-gitlab-security" "rubocop-rspec"];
    source = {
@ -1237,10 +1228,10 @@
    dependencies = ["activesupport" "builder" "mustermann-grape" "rack" "rack-accept" "virtus"];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1lz17804lpip6cm3g0j9xyzc38lxsn84cl3v3ixn6djnwlmp6427";
+      sha256 = "04bam0iq9sad1df361317zz4knwci905yig502khl8gm1lp1168c";
      type = "gem";
    };
-    version = "1.0.3";
+    version = "1.1.0";
  };
  grape-entity = {
    dependencies = ["activesupport" "multi_json"];
@ -1779,10 +1770,10 @@
  mini_mime = {
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1lwhlvjqaqfm6k3ms4v29sby9y7m518ylsqz2j74i740715yl5c8";
+      sha256 = "1q4pshq387lzv9m39jv32vwb8wrq3wc4jwgl4jk209r4l33v09d3";
      type = "gem";
    };
-    version = "1.0.0";
+    version = "1.0.1";
  };
  mini_portile2 = {
    source = {
@ -1843,10 +1834,10 @@
  mustermann = {
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "07sb7fckrraqh48fjnqf6yl7vxxabfx0qrsrhfdz67pd838g4k8g";
+      sha256 = "0lycgkmnyy0bf29nnd2zql5a6pcf8sp69g9v4xw0gcfcxgpwp7i1";
      type = "gem";
    };
-    version = "1.0.2";
+    version = "1.0.3";
  };
  mustermann-grape = {
    dependencies = ["mustermann"];
@ -2207,15 +2198,6 @@
    };
    version = "1.2.0";
  };
-  peek-sidekiq = {
-    dependencies = ["atomic" "peek" "sidekiq"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0y7s32p6cp66z1hpd1wcv4crmvvvcag5i39aazclckjsfpdfn24x";
-      type = "gem";
-    };
-    version = "1.0.3";
-  };
  pg = {
    source = {
      remotes = ["https://rubygems.org"];
@ -2314,18 +2296,18 @@
    dependencies = ["pry"];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0v8xlzzb535k7wcl0vrpday237xwc04rr9v3gviqzasl7ydw32x6";
+      sha256 = "0k2d43bwmqbswfra4fkadjjbszwb11pr7qdkma91qrcrk62wqxvy";
      type = "gem";
    };
-    version = "0.3.5";
+    version = "0.3.6";
  };
  public_suffix = {
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1x5h1dh1i3gwc01jbg01rly2g6a1qwhynb1s8a30ic507z1nh09s";
+      sha256 = "08q64b5br692dd3v0a9wq9q5dvycc6kmiqmjbdxkxbfizggsvx6l";
      type = "gem";
    };
-    version = "3.0.2";
+    version = "3.0.3";
  };
  pyu-ruby-sasl = {
    source = {
@ -2382,10 +2364,10 @@
    dependencies = ["rack"];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0ywmgh7x8ljf7jfnq5hmfzki3f803waji3fcvi107w7mlyflbng7";
+      sha256 = "1z5598qipilmnf45428jnxi63ykrgvnyywa5ckpr52zv2vpd8jdp";
      type = "gem";
    };
-    version = "2.0.1";
+    version = "2.0.3";
  };
  rack-proxy = {
    dependencies = ["rack"];
@ -2699,10 +2681,10 @@
  rouge = {
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0h79gn2wmn1wix2d27lgiaimccyj8gvizrllyym500pir408x62f";
+      sha256 = "1digsi2s8wyzx8vsqcxasw205lg6s7izx8jypl8rrpjwshmv83ql";
      type = "gem";
    };
-    version = "3.2.1";
+    version = "3.3.0";
  };
  rqrcode = {
    dependencies = ["chunky_png"];
@ -3072,13 +3054,13 @@
    version = "3.1.2";
  };
  sidekiq = {
-    dependencies = ["concurrent-ruby" "connection_pool" "rack-protection" "redis"];
+    dependencies = ["connection_pool" "rack-protection" "redis"];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0af7sh9ckds36wv80azlanw1ch29nbvr1w3m00mlj1hbk2il6cxh";
+      sha256 = "0s57vl2hwfaga73yiscak2rs7byg1q0z44wa9si9vl92qcmbik2j";
      type = "gem";
    };
-    version = "5.1.3";
+    version = "5.2.1";
  };
  sidekiq-cron = {
    dependencies = ["rufus-scheduler" "sidekiq"];
@ -3089,15 +3071,6 @@
    };
    version = "0.6.0";
  };
-  sidekiq-limit_fetch = {
-    dependencies = ["sidekiq"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0ykpqw2nc9fs4v0slk5n4m42n3ihwwkk5mcyw3rz51blrdzj92kr";
-      type = "gem";
-    };
-    version = "3.4.0";
-  };
  signet = {
    dependencies = ["addressable" "faraday" "jwt" "multi_json"];
    source = {
@ -3144,10 +3117,10 @@
    dependencies = ["activesupport"];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1wwbyg2nab2k4hdpd1i65qmnfixry29b4yqynrqfnmjghn0xvc7x";
+      sha256 = "168yz9c1fv21wc5i8q7n43b9nk33ivg3ws1fn6x0afgryz3ssx75";
      type = "gem";
    };
-    version = "2.0.1";
+    version = "2.0.2";
  };
  spring-commands-rspec = {
    dependencies = ["spring"];
@ -3288,10 +3261,10 @@
    dependencies = ["daemons" "eventmachine" "rack"];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1dq9q7qyjyg4444bmn12r2s0mir8dqnvc037y0zidhbyaavrv95q";
+      sha256 = "0nagbf9pwy1vg09k6j4xqhbjjzrg5dwzvkn4ffvlj76fsn6vv61f";
      type = "gem";
    };
-    version = "1.7.0";
+    version = "1.7.2";
  };
  thor = {
    source = {
@ -3518,10 +3491,10 @@
    dependencies = ["railties"];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0l0jzw05yk1c19q874nhkanrn2ik7hjbr2vjcdnk1fqp2f3ypzvv";
+      sha256 = "0fsjxw730bh4k1dfnbjm645fgjyqrh830l1z7brqbsm6306ig1rr";
      type = "gem";
    };
-    version = "0.9.10";
+    version = "0.9.11";
  };
  wikicloth = {
    dependencies = ["builder" "expression_parser" "rinku"];
--- a/pkgs/applications/version-management/gitlab/rubyEnv-ee/Gemfile
+++ b/pkgs/applications/version-management/gitlab/rubyEnv-ee/Gemfile
@ -83,16 +83,14 @@ gem 'gitlab_omniauth-ldap', '~> 2.0.4', require: 'omniauth-ldap'
 gem 'net-ldap'

 # Git Wiki
-# Required manually in config/initializers/gollum.rb to control load order
+# Only used to compute wiki page slugs
 gem 'gitlab-gollum-lib', '~> 4.2', require: false

-gem 'gitlab-gollum-rugged_adapter', '~> 0.4.4', require: false
-
 # Language detection
 gem 'github-linguist', '~> 5.3.3', require: 'linguist'

 # API
-gem 'grape', '~> 1.0'
+gem 'grape', '~> 1.1'
 gem 'grape-entity', '~> 0.7.1'
 gem 'rack-cors', '~> 1.0.0', require: 'rack/cors'

@ -115,9 +113,6 @@ gem 'hamlit', '~> 2.8.8'
 gem 'carrierwave', '= 1.2.3'
 gem 'mini_magick'

-# Drag and Drop UI
-gem 'dropzonejs-rails', '~> 0.7.1'
-
 # for backups
 gem 'fog-aws', '~> 2.0.1'
 gem 'fog-core', '~> 1.44'
@ -147,6 +142,7 @@ gem 'faraday_middleware-aws-signers-v4'
 gem 'html-pipeline', '~> 2.8'
 gem 'deckar01-task_list', '2.0.0'
 gem 'gitlab-markup', '~> 1.6.4'
+gem 'github-markup', '~> 1.7.0', require: 'github/markup'
 gem 'redcarpet', '~> 3.4'
 gem 'commonmarker', '~> 0.17'
 gem 'RedCloth', '~> 4.3.2'
@ -180,10 +176,9 @@ gem 'state_machines-activerecord', '~> 0.5.1'
 gem 'acts-as-taggable-on', '~> 5.0'

 # Background jobs
-gem 'sidekiq', '~> 5.1'
+gem 'sidekiq', '~> 5.2.1'
 gem 'sidekiq-cron', '~> 0.6.0'
 gem 'redis-namespace', '~> 1.6.0'
-gem 'sidekiq-limit_fetch', '~> 3.4', require: false

 # Cron Parser
 gem 'rufus-scheduler', '~> 3.4'
@ -312,7 +307,7 @@ gem 'peek-mysql2', '~> 1.1.0', group: :mysql
 gem 'peek-pg', '~> 1.3.0', group: :postgres
 gem 'peek-rblineprof', '~> 0.2.0'
 gem 'peek-redis', '~> 1.2.0'
-gem 'peek-sidekiq', '~> 1.0.3'
+gem 'gitlab-sidekiq-fetcher', require: 'sidekiq-reliable-fetch'

 # Metrics
 group :metrics do
@ -440,7 +435,7 @@ group :ed25519 do
 end

 # Gitaly GRPC client
-gem 'gitaly-proto', '~> 0.117.0', require: 'gitaly'
+gem 'gitaly-proto', '~> 0.118.1', require: 'gitaly'
 gem 'grpc', '~> 1.11.0'

 # Locked until https://github.com/google/protobuf/issues/4210 is closed
--- a/pkgs/applications/version-management/gitlab/rubyEnv-ee/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/rubyEnv-ee/Gemfile.lock
@ -94,7 +94,7 @@ GEM
    bindata (2.4.3)
    binding_of_caller (0.7.2)
      debug_inspector (>= 0.0.1)
-    bootsnap (1.3.1)
+    bootsnap (1.3.2)
      msgpack (~> 1.0)
    bootstrap_form (2.7.0)
    brakeman (4.2.1)
@ -141,14 +141,14 @@ GEM
    concurrent-ruby (1.0.5)
    concurrent-ruby-ext (1.0.5)
      concurrent-ruby (= 1.0.5)
-    connection_pool (2.2.1)
+    connection_pool (2.2.2)
    crack (0.4.3)
      safe_yaml (~> 1.0.0)
    crass (1.0.4)
    creole (0.5.0)
    css_parser (1.5.0)
      addressable
-    daemons (1.2.3)
+    daemons (1.2.6)
    database_cleaner (1.5.3)
    debug_inspector (0.0.2)
    debugger-ruby_core_source (1.3.8)
@ -183,8 +183,6 @@ GEM
    doorkeeper-openid_connect (1.5.0)
      doorkeeper (~> 4.3)
      json-jwt (~> 1.6)
-    dropzonejs-rails (0.7.2)
-      rails (> 3.1)
    ed25519 (1.2.4)
    elasticsearch (5.0.3)
      elasticsearch-api (= 5.0.3)
@ -210,7 +208,7 @@ GEM
    escape_utils (1.1.1)
    et-orbi (1.0.3)
      tzinfo
-    eventmachine (1.0.8)
+    eventmachine (1.2.7)
    excon (0.62.0)
    execjs (2.6.0)
    expression_parser (0.9.0)
@ -300,7 +298,7 @@ GEM
      gettext_i18n_rails (>= 0.7.1)
      po_to_json (>= 1.0.0)
      rails (>= 3.2.0)
-    gitaly-proto (0.117.0)
+    gitaly-proto (0.118.1)
      google-protobuf (~> 3.1)
      grpc (~> 1.10)
    github-linguist (5.3.3)
@ -321,9 +319,6 @@ GEM
      rouge (~> 3.1)
      sanitize (~> 4.6.4)
      stringex (~> 2.6)
-    gitlab-gollum-rugged_adapter (0.4.4.1)
-      mime-types (>= 1.15)
-      rugged (~> 0.25)
    gitlab-grit (2.8.2)
      charlock_holmes (~> 0.6)
      diff-lcs (~> 1.1)
@ -331,6 +326,8 @@ GEM
      posix-spawn (~> 0.3)
    gitlab-license (1.0.0)
    gitlab-markup (1.6.4)
+    gitlab-sidekiq-fetcher (0.3.0)
+      sidekiq (~> 5)
    gitlab-styles (2.4.1)
      rubocop (~> 0.54.0)
      rubocop-gitlab-security (~> 0.1.0)
@ -368,7 +365,7 @@ GEM
      signet (~> 0.7)
    gpgme (2.0.13)
      mini_portile2 (~> 2.1)
-    grape (1.0.3)
+    grape (1.1.0)
      activesupport
      builder
      mustermann-grape (~> 1.0.0)
@ -521,7 +518,7 @@ GEM
    mime-types-data (3.2016.0521)
    mimemagic (0.3.0)
    mini_magick (4.8.0)
-    mini_mime (1.0.0)
+    mini_mime (1.0.1)
    mini_portile2 (2.3.0)
    minitest (5.7.0)
    mousetrap-rails (1.4.6)
@ -529,7 +526,7 @@ GEM
    multi_json (1.13.1)
    multi_xml (0.6.0)
    multipart-post (2.0.0)
-    mustermann (1.0.2)
+    mustermann (1.0.3)
    mustermann-grape (1.0.0)
      mustermann (~> 1.0.0)
    mysql2 (0.4.10)
@ -634,10 +631,6 @@ GEM
      atomic (>= 1.0.0)
      peek
      redis
-    peek-sidekiq (1.0.3)
-      atomic (>= 1.0.0)
-      peek
-      sidekiq
    pg (0.18.4)
    po_to_json (1.0.1)
      json (>= 1.6.0)
@ -662,9 +655,9 @@ GEM
    pry-byebug (3.4.3)
      byebug (>= 9.0, < 9.1)
      pry (~> 0.10)
-    pry-rails (0.3.5)
-      pry (>= 0.9.10)
-    public_suffix (3.0.2)
+    pry-rails (0.3.6)
+      pry (>= 0.10.4)
+    public_suffix (3.0.3)
    pyu-ruby-sasl (0.0.3.3)
    rack (1.6.10)
    rack-accept (0.4.5)
@ -678,7 +671,7 @@ GEM
      httpclient (>= 2.4)
      multi_json (>= 1.3.6)
      rack (>= 1.1)
-    rack-protection (2.0.1)
+    rack-protection (2.0.3)
      rack
    rack-proxy (0.6.0)
      rack
@ -764,7 +757,7 @@ GEM
    retriable (3.1.2)
    rinku (2.0.0)
    rotp (2.1.2)
-    rouge (3.2.1)
+    rouge (3.3.0)
    rqrcode (0.7.0)
      chunky_png
    rqrcode-rails3 (0.1.7)
@ -872,16 +865,13 @@ GEM
      rack
    shoulda-matchers (3.1.2)
      activesupport (>= 4.0.0)
-    sidekiq (5.1.3)
-      concurrent-ruby (~> 1.0)
-      connection_pool (~> 2.2, >= 2.2.0)
+    sidekiq (5.2.1)
+      connection_pool (~> 2.2, >= 2.2.2)
      rack-protection (>= 1.5.0)
      redis (>= 3.3.5, < 5)
    sidekiq-cron (0.6.0)
      rufus-scheduler (>= 3.3.0)
      sidekiq (>= 4.2.1)
-    sidekiq-limit_fetch (3.4.0)
-      sidekiq (>= 4)
    signet (0.8.1)
      addressable (~> 2.3)
      faraday (~> 0.9)
@ -894,7 +884,7 @@ GEM
      simplecov-html (~> 0.10.0)
    simplecov-html (0.10.0)
    slack-notifier (1.5.1)
-    spring (2.0.1)
+    spring (2.0.2)
      activesupport (>= 4.2)
    spring-commands-rspec (1.0.4)
      spring (>= 0.9.1)
@ -924,7 +914,7 @@ GEM
    test_after_commit (1.1.0)
      activerecord (>= 3.2)
    text (1.3.1)
-    thin (1.7.0)
+    thin (1.7.2)
      daemons (~> 1.0, >= 1.0.9)
      eventmachine (~> 1.0, >= 1.0.4)
      rack (>= 1, < 3)
@ -983,7 +973,7 @@ GEM
      addressable (>= 2.3.6)
      crack (>= 0.3.2)
      hashdiff
-    webpack-rails (0.9.10)
+    webpack-rails (0.9.11)
      railties (>= 3.2.0)
    wikicloth (0.8.1)
      builder
@ -1043,7 +1033,6 @@ DEPENDENCIES
  diffy (~> 3.1.0)
  doorkeeper (~> 4.3)
  doorkeeper-openid_connect (~> 1.5)
-  dropzonejs-rails (~> 0.7.1)
  ed25519 (~> 1.2)
  elasticsearch-api (= 5.0.3)
  elasticsearch-model (~> 0.1.9)
@ -1072,20 +1061,21 @@ DEPENDENCIES
  gettext (~> 3.2.2)
  gettext_i18n_rails (~> 1.8.0)
  gettext_i18n_rails_js (~> 1.3)
-  gitaly-proto (~> 0.117.0)
+  gitaly-proto (~> 0.118.1)
  github-linguist (~> 5.3.3)
+  github-markup (~> 1.7.0)
  gitlab-flowdock-git-hook (~> 1.0.1)
  gitlab-gollum-lib (~> 4.2)
-  gitlab-gollum-rugged_adapter (~> 0.4.4)
  gitlab-license (~> 1.0)
  gitlab-markup (~> 1.6.4)
+  gitlab-sidekiq-fetcher
  gitlab-styles (~> 2.4)
  gitlab_omniauth-ldap (~> 2.0.4)
  gon (~> 6.2)
  google-api-client (~> 0.23)
  google-protobuf (= 3.5.1)
  gpgme
-  grape (~> 1.0)
+  grape (~> 1.1)
  grape-entity (~> 0.7.1)
  grape-path-helpers (~> 1.0)
  grape_logging (~> 1.7)
@ -1151,7 +1141,6 @@ DEPENDENCIES
  peek-pg (~> 1.3.0)
  peek-rblineprof (~> 0.2.0)
  peek-redis (~> 1.2.0)
-  peek-sidekiq (~> 1.0.3)
  pg (~> 0.18.2)
  premailer-rails (~> 1.9.7)
  prometheus-client-mmap (~> 0.9.4)
@ -1203,9 +1192,8 @@ DEPENDENCIES
  settingslogic (~> 2.0.9)
  sham_rack (~> 1.3.6)
  shoulda-matchers (~> 3.1.2)
-  sidekiq (~> 5.1)
+  sidekiq (~> 5.2.1)
  sidekiq-cron (~> 0.6.0)
-  sidekiq-limit_fetch (~> 3.4)
  simple_po_parser (~> 1.1.2)
  simplecov (~> 0.14.0)
  slack-notifier (~> 1.5.1)
--- a/pkgs/applications/version-management/gitlab/rubyEnv-ee/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/rubyEnv-ee/gemset.nix
@ -336,10 +336,10 @@
    dependencies = ["msgpack"];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1i3llrdqkndxzhv1a7a2yjpavmdabyq5ps296vmb32hv8fy95xk9";
+      sha256 = "0g6r784lmjfhwi046w82phsk244byq9wkj1q3lddwxg9z559bmhy";
      type = "gem";
    };
-    version = "1.3.1";
+    version = "1.3.2";
  };
  bootstrap_form = {
    source = {
@ -539,10 +539,10 @@
  connection_pool = {
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "17vpaj6kyf2i8bimaxz7rg1kyadf4d10642ja67qiqlhwgczl2w7";
+      sha256 = "0lflx29mlznf1hn0nihkgllzbj8xp5qasn8j7h838465pi399k68";
      type = "gem";
    };
-    version = "2.2.1";
+    version = "2.2.2";
  };
  crack = {
    dependencies = ["safe_yaml"];
@ -581,10 +581,10 @@
  daemons = {
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0b839hryy9sg7x3knsa1d6vfiyvn0mlsnhsb6an8zsalyrz1zgqg";
+      sha256 = "0lxqq6dgb8xhliywar2lvkwqy2ssraf9dk4b501pb4ixc2mvxbp2";
      type = "gem";
    };
-    version = "1.2.3";
+    version = "1.2.6";
  };
  database_cleaner = {
    source = {
@ -730,15 +730,6 @@
    };
    version = "1.5.0";
  };
-  dropzonejs-rails = {
-    dependencies = ["rails"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1vqqxzv6qdqy47m2q28adnmccfvc17p2bmkkaqjvrczrhvkkha64";
-      type = "gem";
-    };
-    version = "0.7.2";
-  };
  ed25519 = {
    source = {
      remotes = ["https://rubygems.org"];
@ -852,10 +843,10 @@
  eventmachine = {
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1frvpk3p73xc64qkn0ymll3flvn4xcycq5yx8a43zd3gyzc1ifjp";
+      sha256 = "0wh9aqb0skz80fhfn66lbpr4f86ya2z5rx6gm5xlfhd05bj1ch4r";
      type = "gem";
    };
-    version = "1.0.8";
+    version = "1.2.7";
  };
  excon = {
    source = {
@ -1166,10 +1157,10 @@
    dependencies = ["google-protobuf" "grpc"];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0ixgzw4clmhjhmv3fy9niq4x16k1yn9iyjbc99z5674xlp7nm40i";
+      sha256 = "19nyx75xnb3lsap6rr3p1avqsw1dcrm8d3ggmmihd58a9s762fki";
      type = "gem";
    };
-    version = "0.117.0";
+    version = "0.118.1";
  };
  github-linguist = {
    dependencies = ["charlock_holmes" "escape_utils" "mime-types" "rugged"];
@ -1206,15 +1197,6 @@
    };
    version = "4.2.7.5";
  };
-  gitlab-gollum-rugged_adapter = {
-    dependencies = ["mime-types" "rugged"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "092i02k3kd4ghk1h1l5yrvi9b180dgfxrvwni26facb2kc9f3wbi";
-      type = "gem";
-    };
-    version = "0.4.4.1";
-  };
  gitlab-grit = {
    dependencies = ["charlock_holmes" "diff-lcs" "mime-types" "posix-spawn"];
    source = {
@ -1240,6 +1222,15 @@
    };
    version = "1.6.4";
  };
+  gitlab-sidekiq-fetcher = {
+    dependencies = ["sidekiq"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0dvrp4iapwfaakc3qgf7mw05blxzfywpjfr7bhswwflih0pm67l7";
+      type = "gem";
+    };
+    version = "0.3.0";
+  };
  gitlab-styles = {
    dependencies = ["rubocop" "rubocop-gitlab-security" "rubocop-rspec"];
    source = {
@ -1333,10 +1324,10 @@
    dependencies = ["activesupport" "builder" "mustermann-grape" "rack" "rack-accept" "virtus"];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1lz17804lpip6cm3g0j9xyzc38lxsn84cl3v3ixn6djnwlmp6427";
+      sha256 = "04bam0iq9sad1df361317zz4knwci905yig502khl8gm1lp1168c";
      type = "gem";
    };
-    version = "1.0.3";
+    version = "1.1.0";
  };
  grape-entity = {
    dependencies = ["activesupport" "multi_json"];
@ -1892,10 +1883,10 @@
  mini_mime = {
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1lwhlvjqaqfm6k3ms4v29sby9y7m518ylsqz2j74i740715yl5c8";
+      sha256 = "1q4pshq387lzv9m39jv32vwb8wrq3wc4jwgl4jk209r4l33v09d3";
      type = "gem";
    };
-    version = "1.0.0";
+    version = "1.0.1";
  };
  mini_portile2 = {
    source = {
@ -1956,10 +1947,10 @@
  mustermann = {
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "07sb7fckrraqh48fjnqf6yl7vxxabfx0qrsrhfdz67pd838g4k8g";
+      sha256 = "0lycgkmnyy0bf29nnd2zql5a6pcf8sp69g9v4xw0gcfcxgpwp7i1";
      type = "gem";
    };
-    version = "1.0.2";
+    version = "1.0.3";
  };
  mustermann-grape = {
    dependencies = ["mustermann"];
@ -2328,15 +2319,6 @@
    };
    version = "1.2.0";
  };
-  peek-sidekiq = {
-    dependencies = ["atomic" "peek" "sidekiq"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0y7s32p6cp66z1hpd1wcv4crmvvvcag5i39aazclckjsfpdfn24x";
-      type = "gem";
-    };
-    version = "1.0.3";
-  };
  pg = {
    source = {
      remotes = ["https://rubygems.org"];
@ -2435,18 +2417,18 @@
    dependencies = ["pry"];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0v8xlzzb535k7wcl0vrpday237xwc04rr9v3gviqzasl7ydw32x6";
+      sha256 = "0k2d43bwmqbswfra4fkadjjbszwb11pr7qdkma91qrcrk62wqxvy";
      type = "gem";
    };
-    version = "0.3.5";
+    version = "0.3.6";
  };
  public_suffix = {
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1x5h1dh1i3gwc01jbg01rly2g6a1qwhynb1s8a30ic507z1nh09s";
+      sha256 = "08q64b5br692dd3v0a9wq9q5dvycc6kmiqmjbdxkxbfizggsvx6l";
      type = "gem";
    };
-    version = "3.0.2";
+    version = "3.0.3";
  };
  pyu-ruby-sasl = {
    source = {
@ -2503,10 +2485,10 @@
    dependencies = ["rack"];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0ywmgh7x8ljf7jfnq5hmfzki3f803waji3fcvi107w7mlyflbng7";
+      sha256 = "1z5598qipilmnf45428jnxi63ykrgvnyywa5ckpr52zv2vpd8jdp";
      type = "gem";
    };
-    version = "2.0.1";
+    version = "2.0.3";
  };
  rack-proxy = {
    dependencies = ["rack"];
@ -2820,10 +2802,10 @@
  rouge = {
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0h79gn2wmn1wix2d27lgiaimccyj8gvizrllyym500pir408x62f";
+      sha256 = "1digsi2s8wyzx8vsqcxasw205lg6s7izx8jypl8rrpjwshmv83ql";
      type = "gem";
    };
-    version = "3.2.1";
+    version = "3.3.0";
  };
  rqrcode = {
    dependencies = ["chunky_png"];
@ -3193,13 +3175,13 @@
    version = "3.1.2";
  };
  sidekiq = {
-    dependencies = ["concurrent-ruby" "connection_pool" "rack-protection" "redis"];
+    dependencies = ["connection_pool" "rack-protection" "redis"];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0af7sh9ckds36wv80azlanw1ch29nbvr1w3m00mlj1hbk2il6cxh";
+      sha256 = "0s57vl2hwfaga73yiscak2rs7byg1q0z44wa9si9vl92qcmbik2j";
      type = "gem";
    };
-    version = "5.1.3";
+    version = "5.2.1";
  };
  sidekiq-cron = {
    dependencies = ["rufus-scheduler" "sidekiq"];
@ -3210,15 +3192,6 @@
    };
    version = "0.6.0";
  };
-  sidekiq-limit_fetch = {
-    dependencies = ["sidekiq"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0ykpqw2nc9fs4v0slk5n4m42n3ihwwkk5mcyw3rz51blrdzj92kr";
-      type = "gem";
-    };
-    version = "3.4.0";
-  };
  signet = {
    dependencies = ["addressable" "faraday" "jwt" "multi_json"];
    source = {
@ -3265,10 +3238,10 @@
    dependencies = ["activesupport"];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1wwbyg2nab2k4hdpd1i65qmnfixry29b4yqynrqfnmjghn0xvc7x";
+      sha256 = "168yz9c1fv21wc5i8q7n43b9nk33ivg3ws1fn6x0afgryz3ssx75";
      type = "gem";
    };
-    version = "2.0.1";
+    version = "2.0.2";
  };
  spring-commands-rspec = {
    dependencies = ["spring"];
@ -3409,10 +3382,10 @@
    dependencies = ["daemons" "eventmachine" "rack"];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1dq9q7qyjyg4444bmn12r2s0mir8dqnvc037y0zidhbyaavrv95q";
+      sha256 = "0nagbf9pwy1vg09k6j4xqhbjjzrg5dwzvkn4ffvlj76fsn6vv61f";
      type = "gem";
    };
-    version = "1.7.0";
+    version = "1.7.2";
  };
  thor = {
    source = {
@ -3639,10 +3612,10 @@
    dependencies = ["railties"];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0l0jzw05yk1c19q874nhkanrn2ik7hjbr2vjcdnk1fqp2f3ypzvv";
+      sha256 = "0fsjxw730bh4k1dfnbjm645fgjyqrh830l1z7brqbsm6306ig1rr";
      type = "gem";
    };
-    version = "0.9.10";
+    version = "0.9.11";
  };
  wikicloth = {
    dependencies = ["builder" "expression_parser" "rinku"];
--- a/pkgs/applications/video/mapmap/default.nix
+++ b/pkgs/applications/video/mapmap/default.nix
@ -57,6 +57,8 @@ mkDerivation rec {
    license = licenses.gpl3;
    maintainers = [ maintainers.erictapen ];
    platforms = platforms.linux;
+    # binary segfaults at the moment
+    broken = true;
  };

 }
--- a/pkgs/applications/virtualization/cntr/default.nix
+++ b/pkgs/applications/virtualization/cntr/default.nix
@ -0,0 +1,24 @@
+{ stdenv, rustPlatform, fetchFromGitHub }:
+
+rustPlatform.buildRustPackage rec {
+  name = "cntr-${version}";
+  version = "1.2.0";
+
+  src = fetchFromGitHub {
+    owner = "Mic92";
+    repo = "cntr";
+    rev = version;
+    sha256 = "0lmbsnjia44h4rskqkv9yc7xb6f3qjgbg8kcr9zqnr7ivr5fjcxg";
+  };
+
+  cargoSha256 = "0gainr5gfy0bbhr6078zvgx0kzp53slxjp37d3da091ikgzgfn51";
+
+  meta = with stdenv.lib; {
+    description = "A container debugging tool based on FUSE";
+    homepage = https://github.com/Mic92/cntr;
+    license = licenses.mit;
+    # aarch64 support will be fixed soon
+    platforms = [ "x86_64-linux" ];
+    maintainers = [ maintainers.mic92 ];
+  };
+}
--- a/pkgs/applications/virtualization/containerd/default.nix
+++ b/pkgs/applications/virtualization/containerd/default.nix
@ -5,13 +5,13 @@ with lib;

 stdenv.mkDerivation rec {
  name = "containerd-${version}";
-  version = "1.1.4";
+  version = "1.2.0";

  src = fetchFromGitHub {
    owner = "containerd";
    repo = "containerd";
    rev = "v${version}";
-    sha256 = "1d4qnviv20zi3zk17zz8271mlfqqgfrxblw86izwwfvj3cvsyrah";
+    sha256 = "03d244v85975bavmlg66kd283jdb22yyvwkwcgy91n63jhvvbadk";
  };

  hardeningDisable = [ "fortify" ];
--- a/pkgs/build-support/setup-hooks/breakpoint-hook.sh
+++ b/pkgs/build-support/setup-hooks/breakpoint-hook.sh
@ -0,0 +1,9 @@
+breakpointHook() {
+    local red='\033[0;31m'
+    local no_color='\033[0m'
+
+    echo -e "${red}build failed in ${curPhase} with exit code ${exitCode}${no_color}"
+    printf "To attach install cntr and run the following command as root:\n\n"
+    sh -c "echo '   cntr attach -t command cntr-${out}'; while true; do sleep 99999999; done"
+}
+failureHooks+=(breakpointHook)
--- a/pkgs/data/misc/hackage/default.nix
+++ b/pkgs/data/misc/hackage/default.nix
@ -1,6 +1,6 @@
 { fetchurl }:

 fetchurl {
-  url = "https://github.com/commercialhaskell/all-cabal-hashes/archive/70f02ad82349a18e1eff41eea4949be532486f7b.tar.gz";
-  sha256 = "1ajqybsl8hfzbhziww57zp9a8kgypj96ngxrargk916v3xpf3x15";
+  url = "https://github.com/commercialhaskell/all-cabal-hashes/archive/420a405e4dbccd78b2a471b632b9fe1a1e04502b.tar.gz";
+  sha256 = "01vdbp1yh2s0afijz9ap4590mlpiica7l6k0mpfc0jwzymn9w86n";
 }
--- a/pkgs/desktops/gnome-3/core/libgxps/default.nix
+++ b/pkgs/desktops/gnome-3/core/libgxps/default.nix
@ -1,5 +1,5 @@
 { stdenv, fetchurl, meson, ninja, pkgconfig, glib, gobjectIntrospection, cairo
-, libarchive, freetype, libjpeg, libtiff, gnome3
+, libarchive, freetype, libjpeg, libtiff, gnome3, fetchpatch
 }:

 let
@ -13,6 +13,19 @@ in stdenv.mkDerivation rec {
    sha256 = "412b1343bd31fee41f7204c47514d34c563ae34dafa4cc710897366bd6cd0fae";
  };

+  patches = [
+    (fetchpatch {
+      name = "CVE-2018-10733-1.patch";
+      url = https://gitlab.gnome.org/GNOME/libgxps/commit/b458226e162fe1ffe7acb4230c114a52ada5131b.patch;
+      sha256 = "0pqg9iwkg69qknj7vkgn26c32fndy55byxivd4km0vjfhfyx69hd";
+    })
+    (fetchpatch {
+      name = "CVE-2018-10733-2.patch";
+      url = https://gitlab.gnome.org/GNOME/libgxps/commit/133fe2a96e020d4ca65c6f64fb28a404050ebbfd.patch;
+      sha256 = "19n01x8zs05wf801mkz4mypvapph7h941md3hr3rj0ry6r88pkir";
+    })
+  ];
+
  nativeBuildInputs = [ meson ninja pkgconfig gobjectIntrospection ];
  buildInputs = [ glib cairo freetype libjpeg libtiff ];
  propagatedBuildInputs = [ libarchive ];
--- a/pkgs/desktops/mate/python-caja/default.nix
+++ b/pkgs/desktops/mate/python-caja/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "python-caja-${version}";
-  version = "1.20.0";
+  version = "1.20.1";

  src = fetchurl {
    url = "http://pub.mate-desktop.org/releases/${mate.getRelease version}/${name}.tar.xz";
-    sha256 = "0bcgg3p01zik53l5ns48575yw0k88fyc044yvp9fvwy5jqqg1ykk";
+    sha256 = "16y9xri92x7a40db2qakf20c80a6vqy21nwnjhwrki5rqk7nwbgx";
  };

  nativeBuildInputs = [
--- a/pkgs/development/compilers/ghc/8.6.1.nix
+++ b/pkgs/development/compilers/ghc/8.6.1.nix
@ -215,7 +215,7 @@ stdenv.mkDerivation (rec {
    inherit enableShared;

    # Our Cabal compiler name
-    haskellCompilerName = "ghc-8.4.3";
+    haskellCompilerName = "ghc-8.6.1";
  };

  meta = {
--- a/pkgs/development/compilers/mono/generic-cmake.nix
+++ b/pkgs/development/compilers/mono/generic-cmake.nix
@ -86,7 +86,5 @@ stdenv.mkDerivation rec {
    platforms = with platforms; darwin ++ linux;
    maintainers = with maintainers; [ thoughtpolice obadz vrthra ];
    license = licenses.free; # Combination of LGPL/X11/GPL ?
-    # 2018-08-21: mono 5.x is broken on aarch64 since at least 2017-07-06
-    broken = stdenv.isAarch64 && (versionAtLeast version "5");
  };
 }
--- a/pkgs/development/compilers/rust/bootstrap.nix
+++ b/pkgs/development/compilers/rust/bootstrap.nix
@ -3,16 +3,16 @@
 let
  # Note: the version MUST be one version prior to the version we're
  # building
-  version = "1.28.0";
+  version = "1.29.2";

-  # fetch hashes by running `print-hashes.sh 1.24.1`
+  # fetch hashes by running `print-hashes.sh 1.29.2`
  hashes = {
-    i686-unknown-linux-gnu = "de7cdb4e665e897ea9b10bf6fd545f900683296456d6a11d8510397bb330455f";
-    x86_64-unknown-linux-gnu = "2a1390340db1d24a9498036884e6b2748e9b4b057fc5219694e298bdaa37b810";
-    armv7-unknown-linux-gnueabihf = "346558d14050853b87049e5e1fbfae0bf0360a2f7c57433c6985b1a879c349a2";
-    aarch64-unknown-linux-gnu = "9b6fbcee73070332c811c0ddff399fa31965bec62ef258656c0c90354f6231c1";
-    i686-apple-darwin = "752e2c9182e057c4a54152d1e0b3949482c225d02bb69d9d9a4127dc2a65fb68";
-    x86_64-apple-darwin = "5d7a70ed4701fe9410041c1eea025c95cad97e5b3d8acc46426f9ac4f9f02393";
+    i686-unknown-linux-gnu = "fd67338c32348fc0cf09dd066975acc221e062fdc3b052912baef93b39a0b27e";
+    x86_64-unknown-linux-gnu = "e9809825c546969a9609ff94b2793c9107d7d9bed67d557ed9969e673137e8d8";
+    armv7-unknown-linux-gnueabihf = "943ee757d96be97baccb84b0c2a5da368f8f3adf082805b0f0323240e80975c0";
+    aarch64-unknown-linux-gnu = "e11461015ca7106ef8ebf00859842bf4be518ee170226cb8eedaaa666946509f";
+    i686-apple-darwin = "aadec39efcbc476e00722b527dcc587003ab05194efd06ba1b91c1e0f7512d3f";
+    x86_64-apple-darwin = "63f54e3013406b39fcb5b84bcf5e8ce85860d0b97a1e156700e467bf5fb5d5f2";
  };

  platform =
--- a/pkgs/development/compilers/rust/cargo.nix
+++ b/pkgs/development/compilers/rust/cargo.nix
@ -1,13 +1,10 @@
 { stdenv, file, curl, pkgconfig, python, openssl, cmake, zlib
-, makeWrapper, libiconv, cacert, rustPlatform, rustc, libgit2, darwin
+, makeWrapper, libiconv, cacert, rustPlatform, rustc, libgit2
+, CoreFoundation, Security
 , version
 , patches ? []
 , src }:

-let
-  inherit (darwin.apple_sdk.frameworks) CoreFoundation;
-in
-
 rustPlatform.buildRustPackage rec {
  name = "cargo-${version}";
  inherit version src patches;
@ -24,7 +21,7 @@ rustPlatform.buildRustPackage rec {

  nativeBuildInputs = [ pkgconfig ];
  buildInputs = [ cacert file curl python openssl cmake zlib makeWrapper libgit2 ]
-    ++ stdenv.lib.optionals stdenv.isDarwin [ CoreFoundation libiconv ];
+    ++ stdenv.lib.optionals stdenv.isDarwin [ CoreFoundation Security libiconv ];

  LIBGIT2_SYS_USE_PKG_CONFIG=1;

--- a/pkgs/development/compilers/rust/default.nix
+++ b/pkgs/development/compilers/rust/default.nix
@ -1,4 +1,5 @@
 { stdenv, callPackage, recurseIntoAttrs, makeRustPlatform, llvm, fetchurl
+, CoreFoundation, Security
 , targets ? []
 , targetToolchains ? []
 , targetPatches ? []
@ -6,11 +7,11 @@

 let
  rustPlatform = recurseIntoAttrs (makeRustPlatform (callPackage ./bootstrap.nix {}));
-  version = "1.29.1";
-  cargoVersion = "1.29.1";
+  version = "1.30.0";
+  cargoVersion = "1.30.0";
  src = fetchurl {
    url = "https://static.rust-lang.org/dist/rustc-${version}-src.tar.gz";
-    sha256 = "0jd3c57x3yndizns4pb68nh25si47agfmrdvf9nwwsyfcs5p5c7i";
+    sha256 = "1vh8q5i273xyjvpipqisny11iz0xfgz30cgjr7068nx5rhzsh2yd";
  };
 in rec {
  rustc = callPackage ./rustc.nix {
@ -44,8 +45,7 @@ in rec {

  cargo = callPackage ./cargo.nix rec {
    version = cargoVersion;
-    inherit src;
-    inherit stdenv;
+    inherit src stdenv CoreFoundation Security;
    inherit rustc; # the rustc that will be wrapped by cargo
    inherit rustPlatform; # used to build cargo
  };
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@ -92,15 +92,15 @@ stdenv.mkDerivation {
    #[ -f src/liballoc/heap.rs ] && sed -i 's,je_,,g' src/liballoc/heap.rs # Remove for 1.4.0+

    # Disable fragile tests.
-    rm -vr src/test/run-make/linker-output-non-utf8 || true
-    rm -vr src/test/run-make/issue-26092 || true
+    rm -vr src/test/run-make-fulldeps/linker-output-non-utf8 || true
+    rm -vr src/test/run-make-fulldeps/issue-26092 || true

    # Remove test targeted at LLVM 3.9 - https://github.com/rust-lang/rust/issues/36835
-    rm -vr src/test/run-pass/issue-36023.rs || true
+    rm -vr src/test/ui/run-pass/issue-36023.rs || true

    # Disable test getting stuck on hydra - possible fix:
    # https://reviews.llvm.org/rL281650
-    rm -vr src/test/run-pass/issue-36474.rs || true
+    rm -vr src/test/ui/run-pass/issue-36474.rs || true

    # On Hydra: `TcpListener::bind(&addr)`: Address already in use (os error 98)'
    sed '/^ *fn fast_rebind()/i#[ignore]' -i src/libstd/net/tcp.rs
@ -116,18 +116,18 @@ stdenv.mkDerivation {
    # Disable all lldb tests.
    # error: Can't run LLDB test because LLDB's python path is not set
    rm -vr src/test/debuginfo/*
-    rm -v src/test/run-pass/backtrace-debuginfo.rs
+    rm -v src/test/run-pass/backtrace-debuginfo.rs || true

    # error: No such file or directory
-    rm -v src/test/run-pass/issue-45731.rs
+    rm -v src/test/ui/run-pass/issues/issue-45731.rs || true

    # Disable tests that fail when sandboxing is enabled.
    substituteInPlace src/libstd/sys/unix/ext/net.rs \
        --replace '#[test]' '#[test] #[ignore]'
    substituteInPlace src/test/run-pass/env-home-dir.rs \
        --replace 'home_dir().is_some()' true
-    rm -v src/test/run-pass/fds-are-cloexec.rs  # FIXME: pipes?
-    rm -v src/test/run-pass/sync-send-in-std.rs  # FIXME: ???
+    rm -v src/test/run-pass/fds-are-cloexec.rs || true  # FIXME: pipes?
+    rm -v src/test/ui/run-pass/threads-sendsync/sync-send-in-std.rs || true  # FIXME: ???
  '';

  # rustc unfortunately need cmake for compiling llvm-rt but doesn't
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@ -1147,9 +1147,6 @@ self: super: {

  arbtt = doJailbreak super.arbtt;

-  # https://github.com/yesodweb/yesod/issues/1563
-  yesod-core = self.yesod-core_1_6_8_1;
-
  # https://github.com/danfran/cabal-macosx/issues/13
  cabal-macosx = dontCheck super.cabal-macosx;

--- a/pkgs/development/haskell-modules/configuration-ghc-8.4.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-8.4.x.nix
@ -56,8 +56,19 @@ self: super: {
          };
    in appendPatch super.hadoop-rpc patch;

-  # Version 1.9.1 needs Cabal 2.4.x or later, so
-  # we use the one from the ghc-8.6.1 package set.
-  stack = markBroken super.stack;
+  # stack-1.9.1 needs Cabal 2.4.x, a recent version of hpack, and a non-recent
+  # version of yaml. Go figure. We avoid overrideScope here because using it to
+  # change Cabal would re-compile every single package instead of just those
+  # that have it as an actual library dependency. The explicit overrides are
+  # more verbose but friendlier for Hydra.
+  stack = (doJailbreak super.stack).override {
+    Cabal = self.Cabal_2_4_0_1;
+    hpack = self.hpack_0_31_0.override { Cabal = self.Cabal_2_4_0_1; };
+    yaml = self.yaml_0_11_0_0;
+    hackage-security = self.hackage-security.override { Cabal = self.Cabal_2_4_0_1; };
+  };
+  hpack_0_31_0 = super.hpack_0_31_0.override {
+    yaml = self.yaml_0_11_0_0;
+  };

 }
--- a/pkgs/development/haskell-modules/configuration-ghc-8.6.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-8.6.x.nix
@ -90,7 +90,6 @@ self: super: {
  data-clist = doJailbreak super.data-clist;  # won't cope with QuickCheck 2.12.x
  Diff = dontCheck super.Diff;
  http-api-data = doJailbreak super.http-api-data;
-  lucid = doJailbreak super.lucid;
  persistent-sqlite = dontCheck super.persistent-sqlite;
  psqueues = dontCheck super.psqueues;    # won't cope with QuickCheck 2.12.x
  system-fileio = dontCheck super.system-fileio;  # avoid dependency on broken "patience"
@ -109,10 +108,7 @@ self: super: {
  # https://github.com/skogsbaer/HTF/issues/69
  HTF = markBrokenVersion "0.13.2.4" super.HTF;

-  # https://github.com/jgm/pandoc-types/issues/52
-  pandoc-types = doJailbreak super.pandoc-types;
-
-  #
+  # https://github.com/jgm/skylighting/issues/55
  skylighting-core = dontCheck super.skylighting-core;

  # https://github.com/joelburget/easytest/issues/12
--- a/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
@ -45,7 +45,7 @@ default-package-overrides:
  - base-compat-batteries ==0.10.1
  # Newer versions don't work in LTS-12.x
  - cassava-megaparsec < 2
-  # LTS Haskell 12.13
+  # LTS Haskell 12.14
  - abstract-deque ==0.3
  - abstract-deque-tests ==0.3
  - abstract-par ==0.3.3
@ -78,7 +78,7 @@ default-package-overrides:
  - alarmclock ==0.5.0.2
  - alerts ==0.1.0.0
  - alex ==3.2.4
-  - alg ==0.2.7.0
+  - alg ==0.2.8.0
  - algebra ==4.3.1
  - algebraic-graphs ==0.2
  - Allure ==0.8.3.0
@ -233,7 +233,7 @@ default-package-overrides:
  - base64-bytestring ==1.0.0.1
  - base64-bytestring-type ==1
  - base64-string ==0.2
-  - base-compat ==0.10.4
+  - base-compat ==0.10.5
  - base-compat-batteries ==0.10.1
  - basement ==0.0.8
  - base-orphans ==0.7
@ -253,7 +253,7 @@ default-package-overrides:
  - bimap ==0.3.3
  - bimap-server ==0.1.0.1
  - binary-bits ==0.5
-  - binary-conduit ==1.3
+  - binary-conduit ==1.3.1
  - binary-ext ==2.0.4
  - binary-ieee754 ==0.1.0.0
  - binary-list ==1.1.1.2
@ -335,7 +335,7 @@ default-package-overrides:
  - Cabal ==2.2.0.1
  - cabal2spec ==2.1.1
  - cabal-doctest ==1.0.6
-  - cabal-rpm ==0.12.5
+  - cabal-rpm ==0.12.6
  - cache ==0.1.1.1
  - cachix ==0.1.2
  - cachix-api ==0.1.0.2
@ -404,7 +404,7 @@ default-package-overrides:
  - clr-marshal ==0.2.0.0
  - clumpiness ==0.17.0.0
  - ClustalParser ==1.2.3
-  - cmark-gfm ==0.1.5
+  - cmark-gfm ==0.1.6
  - cmdargs ==0.10.20
  - code-builder ==0.1.3
  - codec ==0.2.1
@ -461,7 +461,7 @@ default-package-overrides:
  - contravariant ==1.4.1
  - contravariant-extras ==0.3.4
  - control-bool ==0.2.1
-  - control-dsl ==0.2.1.1
+  - control-dsl ==0.2.1.3
  - control-monad-free ==0.6.2
  - control-monad-omega ==0.3.1
  - convertible ==1.1.1.0
@ -486,7 +486,7 @@ default-package-overrides:
  - crypto-cipher-tests ==0.0.11
  - crypto-cipher-types ==0.0.9
  - cryptocompare ==0.1.1
-  - crypto-enigma ==0.0.2.13
+  - crypto-enigma ==0.0.2.14
  - cryptohash ==0.11.9
  - cryptohash-cryptoapi ==0.1.4
  - cryptohash-md5 ==0.11.100.1
@ -576,7 +576,7 @@ default-package-overrides:
  - dhall ==1.15.1
  - dhall-bash ==1.0.15
  - dhall-json ==1.2.3
-  - dhall-text ==1.0.12
+  - dhall-text ==1.0.13
  - di ==1.0.1
  - diagrams ==1.4
  - diagrams-builder ==0.8.0.3
@ -659,7 +659,7 @@ default-package-overrides:
  - eliminators ==0.4.1
  - elm-core-sources ==1.0.0
  - elm-export ==0.6.0.1
-  - email-validate ==2.3.2.7
+  - email-validate ==2.3.2.8
  - enclosed-exceptions ==1.0.3
  - entropy ==0.4.1.3
  - enummapset ==0.5.2.2
@ -702,7 +702,7 @@ default-package-overrides:
  - exp-pairs ==0.1.6.0
  - extensible ==0.4.9
  - extensible-exceptions ==0.1.1.4
-  - extra ==1.6.12
+  - extra ==1.6.13
  - extractable-singleton ==0.0.1
  - extrapolate ==0.3.3
  - facts ==0.0.1.0
@ -784,7 +784,7 @@ default-package-overrides:
  - fuzzcheck ==0.1.1
  - fuzzy-dates ==0.1.1.1
  - fuzzyset ==0.1.0.6
-  - gauge ==0.2.3
+  - gauge ==0.2.4
  - gc ==0.0.2
  - gd ==3000.7.3
  - gdax ==0.6.0.0
@ -896,7 +896,7 @@ default-package-overrides:
  - hamtsolo ==1.0.3
  - HandsomeSoup ==0.4.2
  - handwriting ==0.1.0.3
-  - hapistrano ==0.3.6.0
+  - hapistrano ==0.3.6.1
  - happstack-server ==7.5.1.1
  - happy ==1.19.9
  - hasbolt ==0.1.3.0
@ -982,7 +982,7 @@ default-package-overrides:
  - hmpfr ==0.4.4
  - Hoed ==0.5.1
  - hoopl ==3.10.2.2
-  - hOpenPGP ==2.7.3
+  - hOpenPGP ==2.7.4.1
  - hopenpgp-tools ==0.21.2
  - hopfli ==0.2.2.1
  - hostname ==1.0
@ -1004,8 +1004,8 @@ default-package-overrides:
  - hsdns ==1.7.1
  - hsebaysdk ==0.4.0.0
  - hsemail ==2
-  - hset ==2.2.0
  - HSet ==0.0.1
+  - hset ==2.2.0
  - hsexif ==0.6.1.6
  - hs-functors ==0.1.3.0
  - hs-GeoIP ==0.3
@ -1044,7 +1044,7 @@ default-package-overrides:
  - htaglib ==1.2.0
  - HTF ==0.13.2.4
  - html ==1.0.1.2
-  - html-conduit ==1.3.1
+  - html-conduit ==1.3.2
  - html-email-validate ==0.2.0.0
  - html-entities ==1.1.4.2
  - html-entity-map ==0.1.0.0
@ -1118,7 +1118,7 @@ default-package-overrides:
  - Imlib ==0.1.2
  - immortal ==0.3
  - include-file ==0.1.0.3
-  - incremental-parser ==0.3.1.1
+  - incremental-parser ==0.3.2
  - indentation-core ==0.0.0.2
  - indentation-parsec ==0.0.0.2
  - indents ==0.5.0.0
@ -1136,7 +1136,7 @@ default-package-overrides:
  - integration ==0.2.1
  - intern ==0.9.2
  - interpolate ==0.2.0
-  - interpolatedstring-perl6 ==1.0.0
+  - interpolatedstring-perl6 ==1.0.1
  - interpolation ==0.1.0.3
  - IntervalMap ==0.6.0.0
  - intervals ==0.8.1
@ -1154,7 +1154,7 @@ default-package-overrides:
  - io-streams-haproxy ==1.0.0.2
  - ip ==1.3.0
  - ip6addr ==1.0.0
-  - iproute ==1.7.5
+  - iproute ==1.7.6
  - IPv6Addr ==1.1.1
  - IPv6DB ==0.3.1
  - ipython-kernel ==0.9.1.0
@ -1228,7 +1228,7 @@ default-package-overrides:
  - lawful ==0.1.0.0
  - lazyio ==0.1.0.4
  - lca ==0.3.1
-  - leancheck ==0.7.5
+  - leancheck ==0.7.7
  - leapseconds-announced ==2017.1.0.1
  - learn-physics ==0.6.3
  - lens ==4.16.1
@ -1283,7 +1283,7 @@ default-package-overrides:
  - loop ==0.3.0
  - lrucache ==1.2.0.0
  - lrucaching ==0.3.3
-  - lucid ==2.9.10
+  - lucid ==2.9.11
  - lucid-extras ==0.1.0.1
  - lxd-client-config ==0.1.0.1
  - lz4 ==0.2.3.1
@ -1303,7 +1303,7 @@ default-package-overrides:
  - markdown-unlit ==0.5.0
  - markov-chain ==0.0.3.4
  - marvin-interpolate ==1.1.2
-  - massiv ==0.2.1.0
+  - massiv ==0.2.2.0
  - massiv-io ==0.1.4.0
  - mathexpr ==0.3.0.0
  - math-functions ==0.2.1.0
@ -1351,7 +1351,7 @@ default-package-overrides:
  - mintty ==0.1.2
  - miso ==0.21.2.0
  - missing-foreign ==0.1.1
-  - MissingH ==1.4.0.1
+  - MissingH ==1.4.1.0
  - mixed-types-num ==0.3.1.4
  - mltool ==0.2.0.1
  - mmap ==0.5.9
@ -1370,7 +1370,7 @@ default-package-overrides:
  - monadic-arrays ==0.2.2
  - monad-journal ==0.8.1
  - monadlist ==0.0.2
-  - monad-logger ==0.3.29
+  - monad-logger ==0.3.30
  - monad-logger-json ==0.1.0.0
  - monad-logger-prefix ==0.1.10
  - monad-logger-syslog ==0.1.4.0
@ -1522,8 +1522,8 @@ default-package-overrides:
  - pagination ==0.2.1
  - palette ==0.3.0.1
  - pandoc ==2.2.1
-  - pandoc-citeproc ==0.14.5
-  - pandoc-types ==1.17.5.1
+  - pandoc-citeproc ==0.14.8
+  - pandoc-types ==1.17.5.2
  - pango ==0.13.5.0
  - papillon ==0.1.0.6
  - parallel ==3.2.2.0
@ -1754,7 +1754,7 @@ default-package-overrides:
  - rethinkdb-client-driver ==0.0.25
  - retry ==0.7.7.0
  - rev-state ==0.1.2
-  - rfc5051 ==0.1.0.3
+  - rfc5051 ==0.1.0.4
  - rhine ==0.4.0.1
  - riak ==1.1.2.5
  - riak-protobuf ==0.23.0.0
@ -1841,7 +1841,7 @@ default-package-overrides:
  - servant-streaming ==0.3.0.0
  - servant-streaming-client ==0.3.0.0
  - servant-streaming-server ==0.3.0.0
-  - servant-swagger ==1.1.5
+  - servant-swagger ==1.1.6
  - servant-swagger-ui ==0.3.0.3.13.2
  - servant-swagger-ui-core ==0.3.1
  - servant-tracing ==0.1.0.2
@ -1859,7 +1859,7 @@ default-package-overrides:
  - SHA ==1.6.4.4
  - shake ==0.16.4
  - shake-language-c ==0.12.0
-  - shakespeare ==2.0.18
+  - shakespeare ==2.0.19
  - shell-conduit ==4.7.0
  - shell-escape ==0.2.0
  - shelltestrunner ==1.9
@ -1871,6 +1871,7 @@ default-package-overrides:
  - siggy-chardust ==1.0.0
  - signal ==0.1.0.4
  - silently ==1.2.5
+  - simple-cmd ==0.1.1
  - simple-reflect ==0.3.3
  - simple-sendfile ==0.2.27
  - simplest-sqlite ==0.1.0.0
@ -1880,11 +1881,11 @@ default-package-overrides:
  - singleton-nats ==0.4.2
  - singletons ==2.4.1
  - siphash ==1.0.3
-  - size-based ==0.1.1.0
+  - size-based ==0.1.2.0
  - skein ==1.0.9.4
  - skylighting ==0.7.4
  - skylighting-core ==0.7.4
-  - slack-web ==0.2.0.6
+  - slack-web ==0.2.0.7
  - slave-thread ==1.0.2
  - smallcheck ==1.1.5
  - smoothie ==0.4.2.9
@ -2152,7 +2153,7 @@ default-package-overrides:
  - unicode-show ==0.1.0.3
  - unicode-transforms ==0.3.4
  - unification-fd ==0.10.0.1
-  - union ==0.1.1.2
+  - union ==0.1.2
  - union-find ==0.2
  - uniplate ==1.6.12
  - uniprot-kb ==0.1.2.0
@ -2332,29 +2333,29 @@ default-package-overrides:
  - xxhash-ffi ==0.2.0.0
  - yaml ==0.8.32
  - yeshql ==4.1.0.1
-  - yeshql-core ==4.1.0.1
-  - yeshql-hdbc ==4.1.0.1
+  - yeshql-core ==4.1.0.2
+  - yeshql-hdbc ==4.1.0.2
  - yesod ==1.6.0
  - yesod-alerts ==0.1.2.0
-  - yesod-auth ==1.6.4.1
+  - yesod-auth ==1.6.5
  - yesod-auth-fb ==1.9.1
  - yesod-auth-hashdb ==1.7
  - yesod-bin ==1.6.0.3
-  - yesod-core ==1.6.8
+  - yesod-core ==1.6.8.1
  - yesod-csp ==0.2.4.0
  - yesod-eventsource ==1.6.0
  - yesod-fb ==0.5.0
-  - yesod-form ==1.6.2
+  - yesod-form ==1.6.3
  - yesod-form-bootstrap4 ==1.0.2
  - yesod-gitrepo ==0.3.0
  - yesod-gitrev ==0.2.0.0
  - yesod-newsfeed ==1.6.1.0
  - yesod-paginator ==1.1.0.1
-  - yesod-persistent ==1.6.0
+  - yesod-persistent ==1.6.0.1
  - yesod-recaptcha2 ==0.2.4
  - yesod-sitemap ==1.6.0
-  - yesod-static ==1.6.0
-  - yesod-test ==1.6.5
+  - yesod-static ==1.6.0.1
+  - yesod-test ==1.6.5.1
  - yesod-text-markdown ==0.1.10
  - yesod-websockets ==0.3.0.1
  - yes-precure5-command ==5.5.3
--- a/pkgs/development/haskell-modules/hackage-packages.nix
+++ b/pkgs/development/haskell-modules/hackage-packages.nix
--- a/pkgs/development/haskell-modules/lib.nix
+++ b/pkgs/development/haskell-modules/lib.nix
@ -245,12 +245,13 @@ rec {
     on hackage. This can be used as a test for the source distribution,
     assuming the build fails when packaging mistakes are in the cabal file.
   */
-  buildFromSdist = pkg: lib.overrideDerivation pkg (drv: {
-    unpackPhase = let src = sdistTarball pkg; tarname = "${pkg.pname}-${pkg.version}"; in ''
-      echo "Source tarball is at ${src}/${tarname}.tar.gz"
-      tar xf ${src}/${tarname}.tar.gz
-      cd ${pkg.pname}-*
-    '';
+  buildFromSdist = pkg: overrideCabal pkg (drv: {
+    src = "${sdistTarball pkg}/${pkg.pname}-${pkg.version}.tar.gz";
+
+    # Revising and jailbreaking the cabal file has been handled in sdistTarball
+    revision = null;
+    editedCabalFile = null;
+    jailbreak = false;
  });

  /* Build the package in a strict way to uncover potential problems.
--- a/pkgs/development/idris-modules/categories.nix
+++ b/pkgs/development/idris-modules/categories.nix
@ -6,11 +6,10 @@ build-idris-package  {
  name = "categories";
  version = "2018-07-02";

-  # https://github.com/danilkolikov/categories/pull/5
  src = fetchFromGitHub {
-    owner = "infinisil";
+    owner = "danilkolikov";
    repo = "categories";
-    rev = "9722d62297e5025431e91b271ab09c5d14867236";
+    rev = "a1e0ac0f0da2e336a7d3900051892ff7ed504c35";
    sha256 = "1bbmm8zif5d5wckdaddw6q3c39w6ms1cxrlrmkdn7bik88dawff2";
  };

--- a/pkgs/development/idris-modules/derive.nix
+++ b/pkgs/development/idris-modules/derive.nix
@ -10,12 +10,11 @@ build-idris-package  {

  idrisDeps = [ contrib pruviloj ];

-  # https://github.com/david-christiansen/derive-all-the-instances/pull/9
  src = fetchFromGitHub {
-    owner = "infinisil";
+    owner = "david-christiansen";
    repo = "derive-all-the-instances";
-    rev = "61c3e12e26f599379299fcbb9c40a81bfc3e0604";
-    sha256 = "0g2lb8nrwqwf3gm5fir43cxz6db84n19xiwkv8cmmqc1fgy6v0qn";
+    rev = "0a9a5082d4ab6f879a2c141d1a7b645fa73fd950";
+    sha256 = "06za15m1kv9mijzll5712crry4iwx3b0fjv76gy9vv1p10gy2g4m";
  };

  meta = {
--- a/pkgs/development/interpreters/elixir/1.7.nix
+++ b/pkgs/development/interpreters/elixir/1.7.nix
@ -1,7 +1,7 @@
 { mkDerivation }:

 mkDerivation rec {
-  version = "1.7.3";
-  sha256 = "0d7rj4khmvy76z12njzwzknm1j9rhjadgj9k1chjd4gnjffkb1aa";
+  version = "1.7.4";
+  sha256 = "0f8j4pib13kffiihagdwl3xqs3a1ak19qz3z8fpyfxn9dnjiinla";
  minimumOTPVersion = "19";
 }
--- a/pkgs/development/libraries/eccodes/default.nix
+++ b/pkgs/development/libraries/eccodes/default.nix
@ -3,7 +3,7 @@
 , enablePython ? false, pythonPackages
 , enablePosixThreads ? false
 , enableOpenMPThreads ? false}:
-with stdenv.lib; 
+with stdenv.lib;
 stdenv.mkDerivation rec {
  name = "eccodes-${version}";
  version = "2.9.0";
@ -13,6 +13,10 @@ stdenv.mkDerivation rec {
    sha256 = "1mh9zkfb5dj3j8fk3gdhz2bp6z13nik5pmynpf5l6qy3lhgyn17z";
  };

+  postPatch = ''
+    substituteInPlace cmake/FindOpenJPEG.cmake --replace openjpeg-2.1 ${openjpeg.incDir}
+  '';
+
  nativeBuildInputs = [ cmake ];

  buildInputs = [ netcdf
--- a/pkgs/development/libraries/gsignond/conf.patch
+++ b/pkgs/development/libraries/gsignond/conf.patch
@ -0,0 +1,12 @@
+diff --git a/meson.build b/meson.build
+index cb1e0df..d90c85c 100644
+--- a/meson.build
+++ b/meson.build
+@@ -95,6 +95,6 @@ endif
+ configure_file(
+     input: 'gsignond.conf.in',
+     configuration: conf_data,
+-    install_dir: sysconf_dir,
+    install_dir: 'etc/',
+     output: 'gsignond.conf'
+ )
--- a/pkgs/development/libraries/gsignond/default.nix
+++ b/pkgs/development/libraries/gsignond/default.nix
@ -0,0 +1,69 @@
+{ stdenv, fetchFromGitLab, pkgconfig, meson, ninja, glib, glib-networking
+, sqlite, gobjectIntrospection, vala, gtk-doc, libsecret, docbook_xsl
+, docbook_xml_dtd_43, docbook_xml_dtd_45, glibcLocales, makeWrapper
+, symlinkJoin, gsignondPlugins, plugins }:
+
+let
+unwrapped = stdenv.mkDerivation rec {
+  pname = "gsignond";
+  version = "39022c86ddb5062a10fb0503ad9d81a8e532d527";
+
+  name = "${pname}-2018-10-04";
+
+  outputs = [ "out" "dev" "devdoc" ];
+
+  src = fetchFromGitLab {
+    owner = "accounts-sso";
+    repo = pname;
+    rev = version;
+    sha256 = "1gw8vbj3j6wxqy759z97arm8lnqhmraw9s2frv3ar6crnfhlidff";
+  };
+
+  nativeBuildInputs = [
+    docbook_xml_dtd_43
+    docbook_xml_dtd_45
+    docbook_xsl
+    glibcLocales
+    gobjectIntrospection
+    gtk-doc
+    meson
+    ninja
+    pkgconfig
+    vala
+  ];
+
+  buildInputs = [
+    glib
+    glib-networking
+    libsecret
+  ];
+
+  propagatedBuildInputs = [ sqlite ];
+
+  mesonFlags = [
+    "-Dbus_type=session"
+    "-Dextension=desktop"
+  ];
+
+  LC_ALL = "en_US.UTF-8";
+
+  patches = [
+    ./conf.patch
+    ./plugin-load-env.patch
+  ];
+
+  meta = with stdenv.lib; {
+    description = "D-Bus service which performs user authentication on behalf of its clients";
+    homepage = https://gitlab.com/accounts-sso/gsignond;
+    license = licenses.lgpl21Plus;
+    maintainers = with maintainers; [ worldofpeace ];
+    platforms = platforms.linux;
+  };
+};
+
+in if plugins == [] then unwrapped
+    else import ./wrapper.nix {
+      inherit stdenv makeWrapper symlinkJoin gsignondPlugins plugins;
+      gsignond = unwrapped;
+    }
+
--- a/pkgs/development/libraries/gsignond/plugin-load-env.patch
+++ b/pkgs/development/libraries/gsignond/plugin-load-env.patch
@ -0,0 +1,35 @@
+diff --git a/src/gplugind/gsignond-plugin-loader.c b/src/gplugind/gsignond-plugin-loader.c
+index 5497b32..979e1b4 100644
+--- a/src/gplugind/gsignond-plugin-loader.c
+++ b/src/gplugind/gsignond-plugin-loader.c
+@@ -38,11 +38,10 @@ gsignond_load_plugin (
+     gchar *plugin_filename;
+     GSignondPlugin *plugin;
+ 
+-#   ifdef ENABLE_DEBUG
+     const gchar *env_val = g_getenv("SSO_GPLUGINS_DIR");
+     if (env_val)
+         plugin_path = env_val;
+-#   endif
+
+     plugin_filename = g_module_build_path (plugin_path, plugin_type);
+     plugin = gsignond_load_plugin_with_filename (plugin_type,
+                                                  plugin_filename);
+diff --git a/src/gplugind/main.c b/src/gplugind/main.c
+index 1c6cdb6..c85c623 100644
+--- a/src/gplugind/main.c
+++ b/src/gplugind/main.c
+@@ -93,11 +93,11 @@ _install_sighandlers (GMainLoop *main_loop)
+ static const gchar* _plugin_path(void)
+ {
+     const gchar *plugin_path = GSIGNOND_GPLUGINS_DIR;
+-#   ifdef ENABLE_DEBUG
+
+     const gchar *env_val = g_getenv("SSO_GPLUGINS_DIR");
+     if (env_val)
+         plugin_path = env_val;
+-#   endif
+
+     return plugin_path;
+ }
+ 
--- a/pkgs/development/libraries/gsignond/plugins/lastfm.nix
+++ b/pkgs/development/libraries/gsignond/plugins/lastfm.nix
@ -0,0 +1,38 @@
+{ stdenv, fetchFromGitLab, pkgconfig, meson, ninja, vala, glib, gsignond, json-glib, libsoup, gobjectIntrospection }:
+
+stdenv.mkDerivation rec {
+  name = "gsignond-plugin-lastfm-${version}";
+  version = "2018-05-07";
+
+  src = fetchFromGitLab {
+    owner = "accounts-sso";
+    repo = "gsignond-plugin-lastfm";
+    rev = "0a7a5f8511282e45cfe35987b81f27f158f0648c";
+    sha256 = "0ay6ir9zg9l0264x5xwd7c6j8qmwlhrifkkkjd1yrjh9sqxyfj7f";
+  };
+
+  nativeBuildInputs = [
+    gobjectIntrospection
+    meson
+    ninja
+    pkgconfig
+    vala
+  ];
+
+  buildInputs = [
+    glib
+    gsignond
+    json-glib
+    libsoup
+  ];
+
+  PKG_CONFIG_GSIGNOND_GPLUGINSDIR = "${placeholder "out"}/lib/gsignond/gplugins";
+
+  meta = with stdenv.lib; {
+    description = "Plugin for the Accounts-SSO gSignOn daemon handles the Last.FM credentials.";
+    homepage = https://gitlab.com/accounts-sso/gsignond-plugin-lastfm;
+    license = licenses.lgpl21Plus;
+    maintainers = with maintainers; [ worldofpeace ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/development/libraries/gsignond/plugins/mail.nix
+++ b/pkgs/development/libraries/gsignond/plugins/mail.nix
@ -0,0 +1,36 @@
+{ stdenv, fetchFromGitLab, pkgconfig, meson, ninja, vala, glib, gsignond, gobjectIntrospection }:
+
+stdenv.mkDerivation rec {
+  name = "gsignond-plugin-mail-${version}";
+  version = "2018-10-04";
+
+  src = fetchFromGitLab {
+    owner = "accounts-sso";
+    repo = "gsignond-plugin-mail";
+    rev = "fbc6f34b246fec4ad2b37c696f8de7fdb9bde346";
+    sha256 = "1wvwz7qiwvj8iixprip3qd8lplzfnwcjfrbg2vd8xfsvid2zbviw";
+  };
+
+  nativeBuildInputs = [
+    gobjectIntrospection
+    meson
+    ninja
+    pkgconfig
+    vala
+  ];
+
+  buildInputs = [
+    glib
+    gsignond
+  ];
+
+  PKG_CONFIG_GSIGNOND_GPLUGINSDIR = "${placeholder "out"}/lib/gsignond/gplugins";
+
+  meta = with stdenv.lib; {
+    description = "Plugin for the Accounts-SSO gSignOn daemon that handles the E-Mail credentials.";
+    homepage = https://gitlab.com/accounts-sso/gsignond-plugin-mail;
+    license = licenses.lgpl21Plus;
+    maintainers = with maintainers; [ worldofpeace ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/development/libraries/gsignond/plugins/oauth.nix
+++ b/pkgs/development/libraries/gsignond/plugins/oauth.nix
@ -0,0 +1,48 @@
+{ stdenv, fetchFromGitLab, fetchpatch, pkgconfig, meson, ninja, glib, gsignond, check
+, json-glib, libsoup, gnutls, gtk-doc, docbook_xml_dtd_43, docbook_xml_dtd_45
+, docbook_xsl, glibcLocales, gobjectIntrospection }:
+
+stdenv.mkDerivation rec {
+  name = "gsignond-plugin-oauth-${version}";
+  version = "2018-10-15";
+
+  src = fetchFromGitLab {
+    owner = "accounts-sso";
+    repo = "gsignond-plugin-oa";
+    rev = "d471cebfd7c50567b1244277a9559f18f8d58691";
+    sha256 = "00axl8wwp2arc6h4bpr4m3ik2hy8an0lbm48q2a9r94krmq56hnx";
+  };
+
+  nativeBuildInputs = [
+    check
+    docbook_xml_dtd_43
+    docbook_xml_dtd_45
+    docbook_xsl
+    glibcLocales
+    gobjectIntrospection
+    gtk-doc
+    meson
+    ninja
+    pkgconfig
+  ];
+
+  buildInputs = [
+    glib
+    gnutls
+    gsignond
+    json-glib
+    libsoup
+  ];
+
+  LC_ALL = "en_US.UTF-8";
+
+  PKG_CONFIG_GSIGNOND_GPLUGINSDIR = "${placeholder "out"}/lib/gsignond/gplugins";
+
+  meta = with stdenv.lib; {
+    description = "Plugin for the Accounts-SSO gSignOn daemon that handles the OAuth 1.0 and 2.0 authentication protocols.";
+    homepage = https://gitlab.com/accounts-sso/gsignond-plugin-oa;
+    license = licenses.lgpl21Plus;
+    maintainers = with maintainers; [ worldofpeace ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/development/libraries/gsignond/plugins/sasl.nix
+++ b/pkgs/development/libraries/gsignond/plugins/sasl.nix
@ -0,0 +1,45 @@
+{ stdenv, fetchFromGitLab, fetchpatch, pkgconfig, meson, ninja, glib, gsignond, gsasl, check
+, gtk-doc, docbook_xml_dtd_43, docbook_xml_dtd_45, docbook_xsl, glibcLocales, gobjectIntrospection }:
+
+stdenv.mkDerivation rec {
+  name = "gsignond-plugin-sasl-${version}";
+  version = "2018-10-15";
+
+  src = fetchFromGitLab {
+    owner = "accounts-sso";
+    repo = "gsignond-plugin-sasl";
+    rev = "b304c70b7dad9368b23b1205122d10de684c896a";
+    sha256 = "0knzw7c2fm2kzs1gxbrm4kk67522w9cpwqj7xvn86473068k90va";
+  };
+
+  nativeBuildInputs = [
+    check
+    docbook_xml_dtd_43
+    docbook_xml_dtd_45
+    docbook_xsl
+    glibcLocales
+    gobjectIntrospection
+    gtk-doc
+    meson
+    ninja
+    pkgconfig
+  ];
+
+  buildInputs = [
+    glib
+    gsasl
+    gsignond
+  ];
+
+  LC_ALL = "en_US.UTF-8";
+
+  PKG_CONFIG_GSIGNOND_GPLUGINSDIR = "${placeholder "out"}/lib/gsignond/gplugins";
+
+  meta = with stdenv.lib; {
+    description = "Plugin for the Accounts-SSO gSignOn daemon that handles the SASL authentication protocol.";
+    homepage = https://gitlab.com/accounts-sso/gsignond-plugin-sasl;
+    license = licenses.lgpl21Plus;
+    maintainers = with maintainers; [ worldofpeace ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/development/libraries/gsignond/wrapper.nix
+++ b/pkgs/development/libraries/gsignond/wrapper.nix
@ -0,0 +1,23 @@
+{ stdenv, makeWrapper, symlinkJoin, gsignond, gsignondPlugins, plugins }:
+
+symlinkJoin {
+  name = "gsignond-with-plugins-${gsignond.version}";
+
+  paths = [ gsignond ] ++ plugins;
+
+  buildInputs = [ makeWrapper ];
+
+  postBuild = ''
+    wrapProgram $out/bin/gsignond \
+      --set SSO_GPLUGINS_DIR "$out/lib/gsignond/gplugins"
+
+    rm $out/share/dbus-1/services/com.google.code.AccountsSSO.gSingleSignOn.service
+    rm $out/share/dbus-1/services/com.google.code.AccountsSSO.SingleSignOn.service
+
+    substitute ${gsignond}/share/dbus-1/services/com.google.code.AccountsSSO.gSingleSignOn.service $out/share/dbus-1/services/com.google.code.AccountsSSO.gSingleSignOn.service \
+      --replace ${gsignond} $out
+
+    substitute ${gsignond}/share/dbus-1/services/com.google.code.AccountsSSO.SingleSignOn.service $out/share/dbus-1/services/com.google.code.AccountsSSO.SingleSignOn.service \
+      --replace ${gsignond} $out
+  '';
+}
--- a/pkgs/development/libraries/gusb/default.nix
+++ b/pkgs/development/libraries/gusb/default.nix
@ -1,30 +1,38 @@
-{stdenv, fetchurl
-, automake, autoconf, libtool, which, gtkdoc, gettext, pkgconfig, gobjectIntrospection, libxslt
-, glib, systemd, libusb1, vala_0_38
+{ stdenv, fetchurl, meson, ninja, pkgconfig, gettext, gobjectIntrospection
+, gtk-doc, docbook_xsl, docbook_xml_dtd_412, docbook_xml_dtd_44
+, glib, systemd, libusb1, vala, hwdata
 }:
 stdenv.mkDerivation rec {
  name = "gusb-${version}";
-  version = "0.2.11";
-  enableParallelBuilding = true;
+  version = "0.3.0";
+
+  outputs = [ "bin" "out" "dev" "devdoc" ];

  src = fetchurl {
    url = "https://people.freedesktop.org/~hughsient/releases/libgusb-${version}.tar.xz";
-    sha256 = "1pppz17lw3khyz8by1dddxdqrv6qn4a23fpxs38c67db7x4l7ccw";
+    sha256 = "1p4f6jdjw6zl986f93gzdjg2hdcn5dlz6rcckcz4rbmnk47rbryq";
  };

-  preConfigure = "./autogen.sh";
-
-  nativeBuildInputs = [ pkgconfig autoconf automake libtool which gtkdoc gettext
-                        gobjectIntrospection libxslt vala_0_38 ];
-  buildInputs = [ systemd  glib ];
+  nativeBuildInputs = [
+    meson ninja pkgconfig gettext
+    gtk-doc docbook_xsl docbook_xml_dtd_412 docbook_xml_dtd_44
+    gobjectIntrospection vala
+  ];
+  buildInputs = [ systemd glib ];

  propagatedBuildInputs = [ libusb1 ];

-  meta = {
+  mesonFlags = [
+    "-Dusb_ids=${hwdata}/share/hwdata/usb.ids"
+  ];
+
+  doCheck = false; # tests try to access USB
+
+  meta = with stdenv.lib; {
    description = "GLib libusb wrapper";
-    homepage = https://people.freedesktop.org/~hughsient/releases/;
-    license = stdenv.lib.licenses.lgpl21;
-    maintainers = [stdenv.lib.maintainers.marcweber];
-    platforms = stdenv.lib.platforms.linux;
+    homepage = https://github.com/hughsie/libgusb;
+    license = licenses.lgpl21;
+    maintainers = [ maintainers.marcweber ];
+    platforms = platforms.unix;
  };
 }
--- a/pkgs/development/libraries/jitterentropy/default.nix
+++ b/pkgs/development/libraries/jitterentropy/default.nix
@ -0,0 +1,30 @@
+{ stdenv, fetchFromGitHub }:
+stdenv.mkDerivation rec {
+  name = "jitterentropy-${version}";
+  version = "2.1.2";
+
+  src = fetchFromGitHub {
+    owner = "smuellerDD";
+    repo = "jitterentropy-library";
+    rev = "v${version}";
+    sha256 = "10yl1hi0hysr53wzy2i8brs0qqnxh46mz3dcjh5mk0ad03wvbfsl";
+  };
+
+  enableParallelBuilding = true;
+
+  preInstall = ''
+    mkdir -p $out/include
+  '';
+
+  installFlags = [
+    "PREFIX=$(out)"
+  ];
+
+  meta = {
+    description = "Provides a noise source using the CPU execution timing jitter";
+    homepage = https://github.com/smuellerDD/jitterentropy-library;
+    license = with stdenv.lib.licenses; [ gpl2 bsd3 ];
+    platforms = stdenv.lib.platforms.linux;
+    maintainers = with stdenv.lib.maintainers; [ johnazoidberg ];
+  };
+}
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@ -16,11 +16,11 @@ in
 with stdenv.lib;
 stdenv.mkDerivation rec {
  name = "libinput-${version}";
-  version = "1.12.1";
+  version = "1.12.2";

  src = fetchurl {
    url = "https://www.freedesktop.org/software/libinput/${name}.tar.xz";
-    sha256 = "14l6bvgq76ls63qc9c448r435q9xiig0rv8ilx6rnjvlgg64h32p";
+    sha256 = "1w8wkh03j5zdgbamyj7wv2f6k76kd0w4z04abxxf5b0mnplrb6vb";
  };

  outputs = [ "bin" "out" "dev" ];
--- a/pkgs/development/libraries/libosinfo/default.nix
+++ b/pkgs/development/libraries/libosinfo/default.nix
@ -38,8 +38,8 @@ stdenv.mkDerivation rec {
  '';

  configureFlags = [
-    "--with-usb-ids-path=${hwdata}/data/hwdata/usb.ids"
-    "--with-pci-ids-path=${hwdata}/data/hwdata/pci.ids"
+    "--with-usb-ids-path=${hwdata}/share/hwdata/usb.ids"
+    "--with-pci-ids-path=${hwdata}/share/hwdata/pci.ids"
    "--enable-gtk-doc"
  ];

--- a/pkgs/development/libraries/libsignon-glib/default.nix
+++ b/pkgs/development/libraries/libsignon-glib/default.nix
@ -0,0 +1,57 @@
+{ stdenv, fetchgit, pkgconfig, meson, ninja, vala, python3, gtk-doc, docbook_xsl, docbook_xml_dtd_43, docbook_xml_dtd_412, glib, check, gobjectIntrospection }:
+
+stdenv.mkDerivation rec {
+  pname = "libsignon-glib";
+  version = "3639a2e90447e4640a03a44972560afe8f61aa48";
+
+  name = "${pname}-2018-10-24";
+
+  outputs = [ "out" "dev" "devdoc" "py" ];
+
+  src = fetchgit {
+    url = "https://gitlab.com/accounts-sso/${pname}";
+    rev = version;
+    fetchSubmodules = true;
+    sha256 = "1cq19zbsx4c57dc5gp3shp8lzcr1hw2ynylpn1nkvfyyrx80m60w";
+  };
+
+  nativeBuildInputs = [
+    check
+    docbook_xml_dtd_412
+    docbook_xml_dtd_43
+    docbook_xsl
+    gobjectIntrospection
+    gtk-doc
+    meson
+    ninja
+    pkgconfig
+    python3
+    vala
+  ];
+
+  buildInputs = [
+    glib
+    python3.pkgs.pygobject3
+  ];
+
+  mesonFlags = [
+    "-Dintrospection=true"
+    "-Dpy-overrides-dir=${placeholder "py"}/${python3.sitePackages}/gi/overrides"
+  ];
+
+  postPatch = ''
+    chmod +x build-aux/gen-error-map.py
+    patchShebangs build-aux/gen-error-map.py
+  '';
+
+  meta = with stdenv.lib; {
+    description = ''
+      A library for managing single signon credentials which can be used from GLib applications
+    '';
+    homepage = https://gitlab.com/accounts-sso/libsignon-glib;
+    license = licenses.lgpl21;
+    maintainers = with maintainers; [ worldofpeace ];
+    platforms = platforms.linux;
+  };
+}
+
--- a/pkgs/development/libraries/nanomsg/default.nix
+++ b/pkgs/development/libraries/nanomsg/default.nix
@ -1,14 +1,14 @@
 { stdenv, cmake, fetchFromGitHub }:

 stdenv.mkDerivation rec {
-  version = "1.1.4";
+  version = "1.1.5";
  name = "nanomsg-${version}";

  src = fetchFromGitHub {
    owner = "nanomsg";
    repo = "nanomsg";
    rev = version;
-    sha256 = "11mxbhkxkzqwdmpl79mfiiqby7zawgkalips7zr0bbdfyhq7jyrl";
+    sha256 = "01ddfzjlkf2dgijrmm3j3j8irccsnbgfvjcnwslsfaxnrmrq5s64";
  };

  buildInputs = [ cmake ];
--- a/pkgs/development/libraries/neon/0.29.nix
+++ b/pkgs/development/libraries/neon/0.29.nix
@ -40,9 +40,10 @@ stdenv.mkDerivation rec {
  checkInputs = [ perl ];
  doCheck = false; # fails, needs the net

-  meta = {
+  meta = with stdenv.lib; {
    description = "An HTTP and WebDAV client library";
    homepage = http://www.webdav.org/neon/;
-    platforms = stdenv.lib.platforms.unix;
+    platforms = platforms.unix;
+    license = licenses.lgpl2;
  };
 }
--- a/pkgs/development/libraries/neon/default.nix
+++ b/pkgs/development/libraries/neon/default.nix
@ -40,9 +40,10 @@ stdenv.mkDerivation rec {
  checkInputs = [ perl ];
  doCheck = false; # fails, needs the net

-  meta = {
+  meta = with stdenv.lib; {
    description = "An HTTP and WebDAV client library";
    homepage = http://www.webdav.org/neon/;
-    platforms = stdenv.lib.platforms.unix;
+    platforms = platforms.unix;
+    license = licenses.lgpl2;
  };
 }
--- a/pkgs/development/libraries/netcdf/default.nix
+++ b/pkgs/development/libraries/netcdf/default.nix
@ -43,5 +43,8 @@ in stdenv.mkDerivation rec {
  meta = {
      platforms = stdenv.lib.platforms.unix;
      homepage = https://www.unidata.ucar.edu/software/netcdf/;
+      license = {
+        url = https://www.unidata.ucar.edu/software/netcdf/docs/copyright.html;
+      };
  };
 }
--- a/pkgs/development/libraries/notify-sharp/default.nix
+++ b/pkgs/development/libraries/notify-sharp/default.nix
@ -31,5 +31,6 @@ stdenv.mkDerivation rec {
  meta = with stdenv.lib; {
    description = "D-Bus for .NET";
    platforms = platforms.linux;
+    license = licenses.mit;
  };
 }
--- a/pkgs/development/libraries/nspr/default.nix
+++ b/pkgs/development/libraries/nspr/default.nix
@ -35,9 +35,10 @@ stdenv.mkDerivation {

  enableParallelBuilding = true;

-  meta = {
+  meta = with stdenv.lib; {
    homepage = http://www.mozilla.org/projects/nspr/;
    description = "Netscape Portable Runtime, a platform-neutral API for system-level and libc-like functions";
-    platforms = stdenv.lib.platforms.all;
+    platforms = platforms.all;
+    license = licenses.mpl20;
  };
 }
--- a/pkgs/development/libraries/nss/default.nix
+++ b/pkgs/development/libraries/nss/default.nix
@ -8,11 +8,11 @@ let

 in stdenv.mkDerivation rec {
  name = "nss-${version}";
-  version = "3.38";
+  version = "3.39";

  src = fetchurl {
-    url = "mirror://mozilla/security/nss/releases/NSS_3_38_RTM/src/${name}.tar.gz";
-    sha256 = "0qigcy3d169cf67jzv3rbai0m6dn34vp8h2z696mz4yn10y3sr1c";
+    url = "mirror://mozilla/security/nss/releases/NSS_3_39_RTM/src/${name}.tar.gz";
+    sha256 = "0jw6qlfl2g47hhx056nvnj6h92bk3sn46hy3ig61a911dzblvrkb";
  };

  buildInputs = [ perl zlib sqlite ]
@ -42,7 +42,7 @@ in stdenv.mkDerivation rec {
  preConfigure = "cd nss";

  makeFlags = [
-    "NSPR_INCLUDE_DIR=${nspr.dev}/include/nspr"
+    "NSPR_INCLUDE_DIR=${nspr.dev}/include"
    "NSPR_LIB_DIR=${nspr.out}/lib"
    "NSDISTMODE=copy"
    "BUILD_OPT=1"
--- a/pkgs/development/libraries/ntrack/default.nix
+++ b/pkgs/development/libraries/ntrack/default.nix
@ -25,10 +25,10 @@ stdenv.mkDerivation rec {
    sed -e "s@/usr\(/lib/ntrack/modules/\)@$out&@" -i common/ntrack.c
  '';

-  meta = {
+  meta = with stdenv.lib; {
    description = "Network Connectivity Tracking library for Desktop Applications";
    homepage = https://launchpad.net/ntrack;
-    platforms = stdenv.lib.platforms.linux;
-    maintainers = [ ];
+    platforms = platforms.linux;
+    license = licenses.lgpl3Plus;
  };
 }
--- a/pkgs/development/libraries/ode/default.nix
+++ b/pkgs/development/libraries/ode/default.nix
@ -9,8 +9,10 @@ stdenv.mkDerivation rec {
    sha256 = "0l63ymlkgfp5cb0ggqwm386lxmc3al21nb7a07dd49f789d33ib5";
  };

-  meta = {
+  meta = with stdenv.lib; {
    description = "Open Dynamics Engine";
-    platforms = stdenv.lib.platforms.linux;
+    homepage = https://sourceforge.net/projects/opende;
+    platforms = platforms.linux;
+    license = with licenses; [ bsd3 lgpl21 lgpl3 zlib ];
  };
 }
--- a/pkgs/development/libraries/opal/default.nix
+++ b/pkgs/development/libraries/opal/default.nix
@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ pkgconfig ];
  buildInputs = [ ptlib srtp libtheora speex
                  ffmpeg x264 cyrus_sasl openldap openssl expat unixODBC ];
-  propagatedBuildInputs = [ speex ]; 
+  propagatedBuildInputs = [ speex ];

  configureFlags = [ "--enable-h323" ];

@ -21,11 +21,12 @@ stdenv.mkDerivation rec {
  NIX_CFLAGS_COMPILE = "-D__STDC_CONSTANT_MACROS=1 -std=gnu++98";

  patches = [ ./disable-samples-ftbfs.diff ./libav9.patch ./libav10.patch ];
-      
+
  meta = with stdenv.lib; {
    description = "VoIP library";
    maintainers = [ maintainers.raskin ];
    platforms = platforms.linux;
+    license = with licenses; [ bsdOriginal mpl10 gpl2Plus lgpl21 ];
  };

  passthru = {
--- a/pkgs/development/libraries/opencascade/default.nix
+++ b/pkgs/development/libraries/opencascade/default.nix
@ -25,10 +25,11 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

-  meta = {
+  meta = with stdenv.lib; {
    description = "Open CASCADE Technology, libraries for 3D modeling and numerical simulation";
    homepage = http://www.opencascade.org/;
-    maintainers = with stdenv.lib.maintainers; [viric];
-    platforms = with stdenv.lib.platforms; linux;
+    maintainers = [ maintainers.viric ];
+    platforms = platforms.linux;
+    license = licenses.lgpl21;
  };
 }
--- a/pkgs/development/libraries/opencsg/default.nix
+++ b/pkgs/development/libraries/opencsg/default.nix
@ -26,13 +26,12 @@ stdenv.mkDerivation rec {
    cp license.txt "$out/share/doc/opencsg"
  '';

-  meta = {
+  meta = with stdenv.lib; {
    description = "Constructive Solid Geometry library";
    homepage = http://www.opencsg.org/;
-    platforms = with stdenv.lib.platforms;
-      linux;
-    maintainers = with stdenv.lib.maintainers; 
-      [raskin];
+    platforms = platforms.linux;
+    maintainers = [ maintainers.raskin ];
+    license = licenses.gpl2;
  };
 }

--- a/pkgs/development/libraries/opendbx/default.nix
+++ b/pkgs/development/libraries/opendbx/default.nix
@ -15,4 +15,10 @@ stdenv.mkDerivation rec {
  '';

  buildInputs = [ readline mysql.connector-c postgresql sqlite ];
+
+  meta = with stdenv.lib; {
+    description = "Extremely lightweight but extensible database access library written in C";
+    license = licenses.lgpl21;
+    platforms = platforms.all;
+  };
 }
--- a/pkgs/development/libraries/openjpeg/2.x.nix
+++ b/pkgs/development/libraries/openjpeg/2.x.nix
--- a/pkgs/development/libraries/openpam/default.nix
+++ b/pkgs/development/libraries/openpam/default.nix
@ -9,10 +9,11 @@ stdenv.mkDerivation rec {
    sha256 = "0pz8kf9mxj0k8yp8jgmhahddz58zv2b7gnyjwng75xgsx4i55xi2";
  };

-  meta = {
+  meta = with lib; {
    homepage = https://www.openpam.org;
    description = "An open source PAM library that focuses on simplicity, correctness, and cleanliness";
-    platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [ matthewbauer ];
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ matthewbauer ];
+    license = licenses.bsd3;
  };
 }
--- a/pkgs/development/libraries/openssl/chacha.nix
+++ b/pkgs/development/libraries/openssl/chacha.nix
@ -76,6 +76,7 @@ stdenv.mkDerivation rec {
    description = "A cryptographic library that implements the SSL and TLS protocols";
    platforms = [ "x86_64-linux" ];
    maintainers = [ stdenv.lib.maintainers.cstrahan ];
+    license = licenses.openssl;
    priority = 10; # resolves collision with ‘man-pages’
  };
 }
--- a/pkgs/development/libraries/pangoxsl/default.nix
+++ b/pkgs/development/libraries/pangoxsl/default.nix
@ -13,7 +13,10 @@ stdenv.mkDerivation {
    pango
  ];

-  meta = {
-    platforms = stdenv.lib.platforms.unix;
+  meta = with stdenv.lib; {
+    description = "Implements several of the inline properties defined by XSL that are not currently implemented by Pango.";
+    homepage = https://sourceforge.net/projects/pangopdf;
+    platforms = platforms.unix;
+    license = licenses.lgpl2;
  };
 }
--- a/pkgs/development/libraries/phonon/backends/gstreamer.nix
+++ b/pkgs/development/libraries/phonon/backends/gstreamer.nix
@ -22,6 +22,7 @@ stdenv.mkDerivation rec {
    description = "GStreamer backend for Phonon";
    platforms = platforms.linux;
    maintainers = with maintainers; [ ttuegel ];
+    license = licenses.lgpl21;
  };

  src = fetchurl {
--- a/Show More
+++ b/Show More