Merge branch 'master' into staging-next

Fixes eval on darwin after #69072 Resolved conflict in pkgs/tools/security/thc-hydra/default.nix Basically had to revert a1c0e10564 which adapts #69210 to master that doesn't yet have 329a88efa7 Tested using maintainers/scripts/eval-release.sh before and after to see that the fix works
2024-12-26 12:53:59 +03:00 · 2019-09-25 18:52:30 -04:00 · 2019-09-25 18:52:30 -04:00 · c455adcc42
commit c455adcc42
parent eab41878ac 96ac71d680
106 changed files with 2823 additions and 5605 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -1480,6 +1480,16 @@
    github = "davidrusu";
    name = "David Rusu";
  };
+  davidtwco = {
+    email = "nix@david.davidtw.co";
+    github = "davidtwco";
+    githubId = 1295100;
+    name = "David Wood";
+    keys = [{
+      longkeyid = "rsa4096/0x01760B4F9F53F154";
+      fingerprint = "5B08 313C 6853 E5BF FA91  A817 0176 0B4F 9F53 F154";
+    }];
+  };
  davorb = {
    email = "davor@davor.se";
    github = "davorb";
@ -5370,6 +5380,12 @@
    github = "rickynils";
    name = "Rickard Nilsson";
  };
+  rileyinman = {
+    email = "rileyminman@gmail.com";
+    github = "rileyinman";
+    githubId = 37246692;
+    name = "Riley Inman";
+  };
  ris = {
    email = "code@humanleg.org.uk";
    github = "risicle";
--- a/maintainers/scripts/nix-generate-from-cpan.pl
+++ b/maintainers/scripts/nix-generate-from-cpan.pl
@ -226,7 +226,7 @@ sub pkg_to_attr {

 sub get_pkg_name {
    my ($module) = @_;
-    return $module->package_name . '-' . $module->package_version;
+    return ( $module->package_name, $module->package_version =~ s/^v(\d)/$1/r );
 }

 sub read_meta {
@ -375,13 +375,13 @@ die "module $module_name not found\n" if scalar @modules == 0;
 die "multiple packages that match module $module_name\n" if scalar @modules > 1;
 my $module = $modules[0];

-my $pkg_name  = get_pkg_name $module;
+my ($pkg_name, $pkg_version) = get_pkg_name $module;
 my $attr_name = pkg_to_attr $module;

 INFO( "attribute name: ", $attr_name );
 INFO( "module: ",         $module->module );
 INFO( "version: ",        $module->version );
-INFO( "package: ", $module->package, " (", $pkg_name, ", ", $attr_name, ")" );
+INFO( "package: ", $module->package, " (", "$pkg_name-$pkg_version", ", ", $attr_name, ")" );
 INFO( "path: ",    $module->path );

 my $tar_path = $module->fetch();
@ -436,10 +436,11 @@ my $build_fun = -e "$pkg_path/Build.PL"
 print STDERR "===\n";

 print <<EOF;
-  ${\(is_reserved($attr_name) ? "\"$attr_name\"" : $attr_name)} = $build_fun rec {
-    name = "$pkg_name";
+  ${\(is_reserved($attr_name) ? "\"$attr_name\"" : $attr_name)} = $build_fun {
+    pname = "$pkg_name";
+    version = "$pkg_version";
    src = fetchurl {
-      url = "mirror://cpan/${\$module->path}/\${name}.${\$module->package_extension}";
+      url = "mirror://cpan/${\$module->path}/${\$module->package}";
      sha256 = "${\$module->status->checksum_value}";
    };
 EOF
--- a/nixos/doc/manual/installation/installing-nspawn-container.xml
+++ b/nixos/doc/manual/installation/installing-nspawn-container.xml
@ -0,0 +1,37 @@
+<section xmlns="http://docbook.org/ns/docbook"
+         version="5.0"
+         xml:id="sec-installing-nspawn-container">
+ <title>Installing into a nspawn container</title>
+
+ <para>
+  For installing a NixOS into a systemd nspawn container the NixOS installation tools are needed.
+  If you run another distribution than NixOS on your host,
+  please follow <xref linkend="sec-installing-from-other-distro"/> steps 1, 2, and 3.
+ </para>
+
+ <para>
+  Create a NixOS configuration file <filename>/var/lib/machines/my-container/etc/nixos/configuration.nix</filename>.
+  It is important that the container root file system is under <filename>/var/lib/machines</filename>.
+  This is the standard location where <command>machinectl</command> will look for containers.
+  If you choose place the root into another location you need to start the container directly with <command>systemd-nspawn</command>.
+  The file needs to have at least following options enabled:
+<programlisting>
+<xref linkend="opt-boot.isContainer"/> = true;
+<xref linkend="opt-boot.loader.initScript.enable"/> = true;
+</programlisting>
+  If your host uses <command>systemd-networkd</command> to configure the network,
+  you can also enable <xref linkend="opt-networking.useNetworkd"/> to use networkd default network configuration for your host and container.
+ </para>
+
+ <para>
+  Install the container by running following command:
+   <screen>nixos-install --root /var/lib/machines/my-container \
+     --no-channel-copy --no-root-passwd --no-bootloader</screen>
+ </para>
+
+ <para>
+  Start the container by running following command:
+  <screen>machinectl start my-container</screen>
+ </para>
+
+</section>
--- a/nixos/doc/manual/installation/installing.xml
+++ b/nixos/doc/manual/installation/installing.xml
@ -563,5 +563,8 @@ Retype new UNIX password: ***</screen>
  <xi:include href="installing-from-other-distro.xml" />

  <xi:include href="installing-behind-a-proxy.xml" />
+
+  <xi:include href="installing-nspawn-container.xml" />
+
 </section>
 </chapter>
--- a/nixos/doc/manual/release-notes/rl-1909.xml
+++ b/nixos/doc/manual/release-notes/rl-1909.xml
@ -484,6 +484,35 @@
       (<literal>citrix_workspace</literal>).
     </para>
   </listitem>
+   <listitem>
+     <para>
+       The <literal>services.gitlab</literal> module has had its literal secret options (<option>services.gitlab.smtp.password</option>,
+       <option>services.gitlab.databasePassword</option>,
+       <option>services.gitlab.initialRootPassword</option>,
+       <option>services.gitlab.secrets.secret</option>,
+       <option>services.gitlab.secrets.db</option>,
+       <option>services.gitlab.secrets.otp</option> and
+       <option>services.gitlab.secrets.jws</option>) replaced by file-based versions (<option>services.gitlab.smtp.passwordFile</option>,
+       <option>services.gitlab.databasePasswordFile</option>,
+       <option>services.gitlab.initialRootPasswordFile</option>,
+       <option>services.gitlab.secrets.secretFile</option>,
+       <option>services.gitlab.secrets.dbFile</option>,
+       <option>services.gitlab.secrets.otpFile</option> and
+       <option>services.gitlab.secrets.jwsFile</option>). This was done so that secrets aren't stored
+       in the world-readable nix store, but means that for each option you'll have to create a file with
+       the same exact string, add "File" to the end of the option name, and change the definition to a
+       string pointing to the corresponding file; e.g. <literal>services.gitlab.databasePassword = "supersecurepassword"</literal>
+       becomes <literal>services.gitlab.databasePasswordFile = "/path/to/secret_file"</literal> where the
+       file <literal>secret_file</literal> contains the string <literal>supersecurepassword</literal>.
+     </para>
+     <para>
+       The state path (<option>services.gitlab.statePath</option>) now has the following restriction:
+       no parent directory can be owned by any other user than <literal>root</literal> or the user
+       specified in <option>services.gitlab.user</option>; i.e. if <option>services.gitlab.statePath</option>
+       is set to <literal>/var/lib/gitlab/state</literal>, <literal>gitlab</literal> and all parent directories
+       must be owned by either <literal>root</literal> or the user specified in <option>services.gitlab.user</option>.
+     </para>
+   </listitem>
  </itemizedlist>
 </section>

--- a/nixos/modules/installer/tools/nixos-install.sh
+++ b/nixos/modules/installer/tools/nixos-install.sh
@ -132,8 +132,9 @@ if [[ -z $noBootLoader ]]; then
    echo "installing the boot loader..."
    # Grub needs an mtab.
    ln -sfn /proc/mounts $mountPoint/etc/mtab
-    NIXOS_INSTALL_BOOTLOADER=1 nixos-enter --root "$mountPoint" -- /run/current-system/bin/switch-to-configuration boot
+    export NIXOS_INSTALL_BOOTLOADER=1
 fi
+nixos-enter --root "$mountPoint" -- /run/current-system/bin/switch-to-configuration boot

 # Ask the user to set a root password, but only if the passwd command
 # exists (i.e. when mutable user accounts are enabled).
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -328,6 +328,7 @@
  ./services/hardware/bluetooth.nix
  ./services/hardware/bolt.nix
  ./services/hardware/brltty.nix
+  ./services/hardware/fancontrol.nix
  ./services/hardware/freefall.nix
  ./services/hardware/fwupd.nix
  ./services/hardware/illum.nix
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@ -66,6 +66,8 @@ with lib;

    (mkRenamedOptionModule [ "services" "clamav" "updater" "config" ] [ "services" "clamav" "updater" "extraConfig" ])

+    (mkRemovedOptionModule [ "services" "pykms" "verbose" ] "Use services.pykms.logLevel instead")
+
    (mkRemovedOptionModule [ "security" "setuidOwners" ] "Use security.wrappers instead")
    (mkRemovedOptionModule [ "security" "setuidPrograms" ] "Use security.wrappers instead")

--- a/nixos/modules/services/amqp/rabbitmq.nix
+++ b/nixos/modules/services/amqp/rabbitmq.nix
@ -80,12 +80,10 @@ in {
      configItems = mkOption {
        default = {};
        type = types.attrsOf types.str;
-        example = ''
-          {
-            "auth_backends.1.authn" = "rabbit_auth_backend_ldap";
-            "auth_backends.1.authz" = "rabbit_auth_backend_internal";
-          }
-        '';
+        example = {
+          "auth_backends.1.authn" = "rabbit_auth_backend_ldap";
+          "auth_backends.1.authz" = "rabbit_auth_backend_internal";
+        };
        description = ''
          Configuration options in RabbitMQ's new config file format,
          which is a simple key-value format that can not express nested
--- a/nixos/modules/services/hardware/fancontrol.nix
+++ b/nixos/modules/services/hardware/fancontrol.nix
@ -0,0 +1,46 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.hardware.fancontrol;
+  configFile = pkgs.writeText "fan.conf" cfg.config;
+
+in {
+
+  options.hardware.fancontrol = {
+    enable = mkEnableOption "fancontrol (requires fancontrol.config)";
+
+    config = mkOption {
+      type = types.lines;
+      default = null;
+      example = ''
+        # Configuration file generated by pwmconfig
+        INTERVAL=1
+        DEVPATH=hwmon0=devices/platform/nct6775.656 hwmon1=devices/pci0000:00/0000:00:18.3
+        DEVNAME=hwmon0=nct6779 hwmon1=k10temp
+        FCTEMPS=hwmon0/pwm2=hwmon1/temp1_input
+        FCFANS=hwmon0/pwm2=hwmon0/fan2_input
+        MINTEMP=hwmon0/pwm2=25
+        MAXTEMP=hwmon0/pwm2=60
+        MINSTART=hwmon0/pwm2=25
+        MINSTOP=hwmon0/pwm2=10
+        MINPWM=hwmon0/pwm2=0
+        MAXPWM=hwmon0/pwm2=255
+      '';
+      description = "Contents for configuration file. See <citerefentry><refentrytitle>pwmconfig</refentrytitle><manvolnum>8</manvolnum></citerefentry>.";
+    };
+  };
+
+
+  config = mkIf cfg.enable {
+    systemd.services.fancontrol = {
+      description = "Fan speed control from lm_sensors";
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = "${pkgs.lm_sensors}/bin/fancontrol ${configFile}";
+      };
+    };
+  };
+}
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@ -223,7 +223,15 @@ in {
      statePath = mkOption {
        type = types.str;
        default = "/var/gitlab/state";
-        description = "Gitlab state directory, logs are stored here.";
+        description = ''
+          Gitlab state directory. Configuration, repositories and
+          logs, among other things, are stored here.
+
+          The directory will be created automatically if it doesn't
+          exist already. Its parent directories must be owned by
+          either <literal>root</literal> or the user set in
+          <option>services.gitlab.user</option>.
+        '';
      };

      backupPath = mkOption {
--- a/nixos/modules/services/misc/home-assistant.nix
+++ b/nixos/modules/services/misc/home-assistant.nix
@ -224,6 +224,7 @@ in {
        KillSignal = "SIGINT";
        PrivateTmp = true;
        RemoveIPC = true;
+        AmbientCapabilities = "cap_net_raw,cap_net_admin+eip";
      };
      path = [
        "/run/wrappers" # needed for ping
--- a/nixos/modules/services/misc/pykms.nix
+++ b/nixos/modules/services/misc/pykms.nix
@ -4,6 +4,7 @@ with lib;

 let
  cfg = config.services.pykms;
+  libDir = "/var/lib/pykms";

 in {
  meta.maintainers = with lib.maintainers; [ peterhoeg ];
@ -28,12 +29,6 @@ in {
        description = "The port on which to listen.";
      };

-      verbose = mkOption {
-        type = types.bool;
-        default = false;
-        description = "Show verbose output.";
-      };
-
      openFirewallPort = mkOption {
        type = types.bool;
        default = false;
@ -45,30 +40,44 @@ in {
        default = "64M";
        description = "How much memory to use at most.";
      };
+
+      logLevel = mkOption {
+        type = types.enum [ "CRITICAL" "ERROR" "WARNING" "INFO" "DEBUG" "MINI" ];
+        default = "INFO";
+        description = "How much to log";
+      };
+
+      extraArgs = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        description = "Additional arguments";
+      };
    };
  };

  config = mkIf cfg.enable {
    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewallPort [ cfg.port ];

-    systemd.services.pykms = let
-      home = "/var/lib/pykms";
-    in {
+    systemd.services.pykms = {
      description = "Python KMS";
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];
      # python programs with DynamicUser = true require HOME to be set
-      environment.HOME = home;
+      environment.HOME = libDir;
      serviceConfig = with pkgs; {
        DynamicUser = true;
-        StateDirectory = baseNameOf home;
-        ExecStartPre = "${getBin pykms}/bin/create_pykms_db.sh ${home}/clients.db";
+        StateDirectory = baseNameOf libDir;
+        ExecStartPre = "${getBin pykms}/libexec/create_pykms_db.sh ${libDir}/clients.db";
        ExecStart = lib.concatStringsSep " " ([
-          "${getBin pykms}/bin/server.py"
+          "${getBin pykms}/bin/server"
+          "--logfile STDOUT"
+          "--loglevel ${cfg.logLevel}"
+        ] ++ cfg.extraArgs ++ [
          cfg.listenAddress
          (toString cfg.port)
-        ] ++ lib.optional cfg.verbose "--verbose");
-        WorkingDirectory = home;
+        ]);
+        ProtectHome = "tmpfs";
+        WorkingDirectory = libDir;
        Restart = "on-failure";
        MemoryLimit = cfg.memoryLimit;
      };
--- a/nixos/modules/services/monitoring/zabbix-server.nix
+++ b/nixos/modules/services/monitoring/zabbix-server.nix
@ -30,6 +30,7 @@ let
    DBUser = ${cfg.database.user}
    ${optionalString (cfg.database.passwordFile != null) "Include ${passwordFile}"}
    ${optionalString (mysqlLocal && cfg.database.socket != null) "DBSocket = ${cfg.database.socket}"}
+    PidFile = ${runtimeDir}/zabbix_server.pid
    SocketDir = ${runtimeDir}
    FpingLocation = /run/wrappers/bin/fping
    ${optionalString (cfg.modules != {}) "LoadModulePath = ${moduleEnv}/lib"}
--- a/nixos/modules/system/activation/activation-script.nix
+++ b/nixos/modules/system/activation/activation-script.nix
@ -184,7 +184,14 @@ in
        find /var/empty -mindepth 1 -delete
        chmod 0555 /var/empty
        chown root:root /var/empty
+
+        ${ # reasons for not setting immutable flag:
+           # 1. flag is not changeable inside a container
+           # 2. systemd-nspawn can not perform chown in case of --private-users-chown
+           #    then the owner is nobody and ssh will not start
+          optionalString (!config.boot.isContainer) ''
        ${pkgs.e2fsprogs}/bin/chattr -f +i /var/empty || true
+          ''}
      '';

    system.activationScripts.usrbinenv = if config.environment.usrbinenv != null
--- a/nixos/modules/tasks/network-interfaces-systemd.nix
+++ b/nixos/modules/tasks/network-interfaces-systemd.nix
@ -12,7 +12,7 @@ let
    i.ipv4.addresses
    ++ optionals cfg.enableIPv6 i.ipv6.addresses;

-  dhcpStr = useDHCP: if useDHCP == true || useDHCP == null then "both" else "no";
+  dhcpStr = useDHCP: if useDHCP == true || useDHCP == null then "yes" else "no";

  slaves =
    concatLists (map (bond: bond.interfaces) (attrValues cfg.bonds))
--- a/nixos/modules/virtualisation/container-config.nix
+++ b/nixos/modules/virtualisation/container-config.nix
@ -10,7 +10,7 @@ with lib;
    services.udisks2.enable = mkDefault false;
    powerManagement.enable = mkDefault false;

-    networking.useHostResolvConf = mkDefault true;
+    networking.useHostResolvConf = mkDefault (!config.services.resolved.enable);

    # Containers should be light-weight, so start sshd on demand.
    services.openssh.startWhenNeeded = mkDefault true;
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -262,6 +262,7 @@ in
  syncthing-relay = handleTest ./syncthing-relay.nix {};
  systemd = handleTest ./systemd.nix {};
  systemd-confinement = handleTest ./systemd-confinement.nix {};
+  systemd-machinectl = handleTest ./systemd-machinectl.nix {};
  systemd-timesyncd = handleTest ./systemd-timesyncd.nix {};
  systemd-networkd-wireguard = handleTest ./systemd-networkd-wireguard.nix {};
  pdns-recursor = handleTest ./pdns-recursor.nix {};
--- a/nixos/tests/systemd-machinectl.nix
+++ b/nixos/tests/systemd-machinectl.nix
@ -0,0 +1,52 @@
+import ./make-test.nix (let
+
+  container = { ... }: {
+    boot.isContainer = true;
+
+    # use networkd to obtain systemd network setup
+    networking.useNetworkd = true;
+
+    # systemd-nspawn expects /sbin/init
+    boot.loader.initScript.enable = true;
+
+    imports = [ ../modules/profiles/minimal.nix ];
+  };
+
+  containerSystem = (import ../lib/eval-config.nix {
+    modules = [ container ];
+  }).config.system.build.toplevel;
+
+  containerName = "container";
+  containerRoot = "/var/lib/machines/${containerName}";
+
+in {
+  name = "systemd-machinectl";
+
+  machine = { lib, ... }: {
+    # use networkd to obtain systemd network setup
+    networking.useNetworkd = true;
+
+    # open DHCP server on interface to container
+    networking.firewall.trustedInterfaces = [ "ve-+" ];
+
+    # do not try to access cache.nixos.org
+    nix.binaryCaches = lib.mkForce [];
+
+    virtualisation.pathsInNixDB = [ containerSystem ];
+  };
+
+  testScript = ''
+    startAll;
+
+    $machine->waitForUnit("default.target");
+    $machine->succeed("mkdir -p ${containerRoot}");
+    $machine->succeed("nixos-install --root ${containerRoot} --system ${containerSystem} --no-channel-copy --no-root-passwd --no-bootloader");
+
+    $machine->succeed("machinectl start ${containerName}");
+    $machine->waitUntilSucceeds("systemctl -M ${containerName} is-active default.target");
+    $machine->succeed("ping -n -c 1 ${containerName}");
+    $machine->succeed("test `stat ${containerRoot}/var/empty -c %u%g` != 00");
+
+    $machine->succeed("machinectl stop ${containerName}");
+  '';
+})
--- a/pkgs/applications/audio/paulstretch/default.nix
+++ b/pkgs/applications/audio/paulstretch/default.nix
@ -1,5 +1,7 @@
-{ stdenv, fetchFromGitHub, audiofile, libvorbis, fltk, fftw, fftwFloat,
-minixml, pkgconfig, libmad, libjack2, portaudio, libsamplerate }:
+{ stdenv, fetchFromGitHub, fetchpatch
+, audiofile, libvorbis, fltk, fftw, fftwFloat
+, minixml, pkgconfig, libmad, libjack2, portaudio, libsamplerate
+}:

 stdenv.mkDerivation {
  pname = "paulstretch";
@ -27,6 +29,13 @@ stdenv.mkDerivation {
    libsamplerate
  ];

+  patches = [
+    (fetchpatch {
+      url = "https://github.com/paulnasca/paulstretch_cpp/pull/12.patch";
+      sha256 = "0lx1rfrs53afkiz1drp456asqgj5yv6hx3lkc01165cv1jsbw6q4";
+    })
+  ];
+
  buildPhase = ''
    bash compile_linux_fftw_jack.sh
  '';
--- a/pkgs/applications/audio/picard/default.nix
+++ b/pkgs/applications/audio/picard/default.nix
@ -4,13 +4,13 @@ let
  pythonPackages = python3Packages;
 in pythonPackages.buildPythonApplication rec {
  pname = "picard";
-  version = "2.1.3";
+  version = "2.2.1";

  src = fetchFromGitHub {
    owner = "metabrainz";
    repo = pname;
    rev = "release-${version}";
-    sha256 = "1armg8vpvnbpk7rrfk9q7nj5gm56rza00ni9qwdyqpxp1xaz6apj";
+    sha256 = "1g7pbicf65hswbqmhrwlba9jm4r2vnggy7vy75z4256y7qcpwdfd";
  };

  nativeBuildInputs = [ gettext qt5.wrapQtAppsHook qt5.qtbase ];
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@ -201,11 +201,11 @@ let
        platforms = platforms.linux;
      };
    }) (attrs: {
-      patchPhase = attrs.patchPhase + ''
+      patchPhase = lib.optionalString (!stdenv.isDarwin) (attrs.patchPhase + ''
        # Patch built-in mono for ReSharperHost to start successfully
        interpreter=$(echo ${stdenv.glibc.out}/lib/ld-linux*.so.2)
        patchelf --set-interpreter "$interpreter" lib/ReSharperHost/linux-x64/mono/bin/mono-sgen
-      '';
+      '');
    });

  buildRubyMine = { name, version, src, license, description, wmClass, ... }:
--- a/pkgs/applications/graphics/djview/default.nix
+++ b/pkgs/applications/graphics/djview/default.nix
@ -1,8 +1,16 @@
-{ stdenv, fetchurl, pkgconfig
-, djvulibre, qt4, xorg, libtiff
-, darwin }:
+{ stdenv
+, mkDerivation
+, fetchurl
+, pkgconfig
+, djvulibre
+, qtbase
+, qttools
+, xorg
+, libtiff
+, darwin
+}:

-stdenv.mkDerivation rec {
+mkDerivation rec {
  pname = "djview";
  version = "4.10.6";

@ -11,20 +19,56 @@ stdenv.mkDerivation rec {
    sha256 = "08bwv8ppdzhryfcnifgzgdilb12jcnivl4ig6hd44f12d76z6il4";
  };

-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [
+    pkgconfig
+    qttools
+  ];

-  buildInputs = [ djvulibre qt4 xorg.libXt libtiff ]
-  ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.AGL ];
+  buildInputs = [
+    djvulibre
+    qtbase
+    xorg.libXt
+    libtiff
+  ] ++ stdenv.lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.AGL;
+
+  configureFlags = [
+    "--disable-silent-rules"
+    "--disable-dependency-tracking"
+    "--with-x"
+    "--with-tiff"
+    # NOTE: 2019-09-19: experimental "--enable-npdjvu" fails
+  ] ++ stdenv.lib.optional stdenv.isDarwin "--enable-mac";

  passthru = {
    mozillaPlugin = "/lib/mozilla/plugins";
  };

  meta = with stdenv.lib; {
-    homepage = http://djvu.sourceforge.net/djview4.html;
-    description = "A portable DjVu viewer and browser plugin";
+    description = "A portable DjVu viewer (Qt5) and browser (nsdejavu) plugin";
+    homepage = "http://djvu.sourceforge.net/djview4.html";
    license = licenses.gpl2;
    platforms = platforms.unix;
-    maintainers = [ ];
+    maintainers = with maintainers; [ Anton-Latukha ];
+    longDescription = ''
+      The portable DjVu viewer (Qt5) and browser (nsdejavu) plugin.
+
+      Djview highlights:
+        - entirely based on the public DjVulibre api.
+        - entirely written in portable Qt5.
+        - works natively under Unix/X11, MS Windows, and macOS X.
+        - continuous scrolling of pages
+        - side-by-side display of pages
+        - ability to specify a url to the djview command
+        - all plugin and cgi options available from the command line
+        - all silly annotations implemented
+        - display thumbnails as a grid
+        - display outlines
+        - page names supported (see djvused command set-page-title)
+        - metadata dialog (see djvused command set-meta)
+        - implemented as reusable Qt widgets
+
+      nsdejavu: browser plugin for DjVu. It internally uses djview.
+      Has CGI-style arguments to configure the view of document (see man).
+    '';
  };
 }
--- a/pkgs/applications/misc/dbeaver/default.nix
+++ b/pkgs/applications/misc/dbeaver/default.nix
@ -7,7 +7,7 @@

 stdenv.mkDerivation rec {
  pname = "dbeaver-ce";
-  version = "6.1.5";
+  version = "6.2.1";

  desktopItem = makeDesktopItem {
    name = "dbeaver";
@ -30,7 +30,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://dbeaver.io/files/${version}/dbeaver-ce-${version}-linux.gtk.x86_64.tar.gz";
-    sha256 = "0lkycm1152wd56i1hjq7q3sd05h51fyz99qr2n65lwi33vz2qk9m";
+    sha256 = "1ix6isahpk7zk741wdx5cf4i13wc5gp0j1gj4ja80bzfswbc38na";
  };

  installPhase = ''
--- a/pkgs/applications/misc/ipmiview/default.nix
+++ b/pkgs/applications/misc/ipmiview/default.nix
@ -1,33 +1,72 @@
-{ stdenv, fetchurl, patchelf, makeWrapper, xorg, gcc, gcc-unwrapped }:
+{ stdenv
+, fetchurl
+, makeDesktopItem
+, makeWrapper
+, patchelf
+, fontconfig
+, freetype
+, gcc
+, gcc-unwrapped
+, iputils
+, psmisc
+, xorg }:

 stdenv.mkDerivation rec {
-   pname = "IPMIView";
-   version = "2.14.0";
-   buildVersion = "180213";
+  pname = "IPMIView";
+  version = "2.16.0";
+  buildVersion = "190815";

-   src = fetchurl {
-    url = "ftp://ftp.supermicro.com/utility/IPMIView/Linux/IPMIView_${version}_build.${buildVersion}_bundleJRE_Linux_x64.tar.gz";
-    sha256 = "1wp22wm7smlsb25x0cck4p660cycfczxj381930crd1qrf68mw4h";
+  src = fetchurl {
+    url = "https://www.supermicro.com/wftp/utility/IPMIView/Linux/IPMIView_${version}_build.${buildVersion}_bundleJRE_Linux_x64.tar.gz";
+    sha256 = "0qw9zfnj0cyvab7ndamlw2y0gpczjhh1jkz8340kl42r2xmhkvpl";
  };

-   nativeBuildInputs = [ patchelf makeWrapper ];
+  nativeBuildInputs = [ patchelf makeWrapper ];
+  buildPhase = with xorg;
+    let
+      stunnelBinary = if stdenv.hostPlatform.system == "x86_64-linux" then "linux/stunnel64"
+      else if stdenv.hostPlatform.system == "i686-linux" then "linux/stunnel32"
+      else throw "IPMIView is not supported on this platform";
+    in
+  ''
+    patchelf --set-rpath "${stdenv.lib.makeLibraryPath [ libX11 libXext libXrender libXtst libXi ]}" ./jre/lib/amd64/libawt_xawt.so
+    patchelf --set-rpath "${stdenv.lib.makeLibraryPath [ freetype ]}" ./jre/lib/amd64/libfontmanager.so
+    patchelf --set-rpath "${gcc-unwrapped.lib}/lib" ./libiKVM64.so
+    patchelf --set-rpath "${gcc.cc}/lib:$out/jre/lib/amd64/jli" --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" ./jre/bin/java
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" ./BMCSecurity/${stunnelBinary}
+  '';

-   buildPhase = with xorg; ''
-     patchelf --set-rpath "${stdenv.lib.makeLibraryPath [ libX11 libXext libXrender libXtst libXi ]}" ./jre/lib/amd64/xawt/libmawt.so
-     patchelf --set-rpath "${gcc-unwrapped.lib}/lib" ./libiKVM64.so
-     patchelf --set-rpath "${stdenv.lib.makeLibraryPath [ libXcursor libX11 libXext libXrender libXtst libXi ]}" --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" ./jre/bin/javaws
-     patchelf --set-rpath "${gcc.cc}/lib:$out/jre/lib/amd64/jli" --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" ./jre/bin/java
-   '';
+  desktopItem = makeDesktopItem rec {
+    name = "IPMIView";
+    exec = "IPMIView";
+    desktopName = name;
+    genericName = "Supermicro BMC manager";
+    categories = "Network;Configuration";
+  };

-   installPhase = ''
-     mkdir -p $out/bin
-     cp -R . $out/
-     makeWrapper $out/jre/bin/java $out/bin/IPMIView \
-       --prefix PATH : "$out/jre/bin" \
-       --add-flags "-jar $out/IPMIView20.jar"
-   '';
+  installPhase = ''
+    mkdir -p $out/bin
+    cp -R . $out/

-   meta = with stdenv.lib; {
+    ln -s ${desktopItem}/share $out/share
+
+    # LD_LIBRARY_PATH: fontconfig is used from java code
+    # PATH: iputils is used for ping, and psmisc is for killall
+    # WORK_DIR: unfortunately the ikvm related binaries are loaded from
+    #           and user configuration is written to files in the CWD
+    makeWrapper $out/jre/bin/java $out/bin/IPMIView \
+      --set LD_LIBRARY_PATH "${stdenv.lib.makeLibraryPath [ fontconfig ]}" \
+      --prefix PATH : "$out/jre/bin:${iputils}/bin:${psmisc}/bin" \
+      --add-flags "-jar $out/IPMIView20.jar" \
+      --run 'WORK_DIR=''${XDG_DATA_HOME:-~/.local/share}/ipmiview
+             mkdir -p $WORK_DIR
+             ln -snf '$out'/iKVM.jar '$out'/libiKVM* '$out'/libSharedLibrary* $WORK_DIR
+             cd $WORK_DIR'
+  '';
+
+  meta = with stdenv.lib; {
    license = licenses.unfree;
-   };
-  }
+    maintainers = with maintainers; [ vlaci ];
+    platforms = [ "x86_64-linux" "i686-linux" ];
+  };
+}
--- a/pkgs/applications/misc/pastel/default.nix
+++ b/pkgs/applications/misc/pastel/default.nix
@ -0,0 +1,25 @@
+{ stdenv, fetchFromGitHub, rustPlatform, Security }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "pastel";
+  version = "0.5.3";
+
+  src = fetchFromGitHub {
+    owner = "sharkdp";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0f54p3pzfp7xrwlqn61l7j41vmgcfph3bhq2khxh5apfwwdx9nng";
+  };
+
+  cargoSha256 = "05yvlm7z3zfn8qd8nb9zpch9xsfzidrpyrgg2vij3h3q095mdm66";
+
+  buildInputs = stdenv.lib.optional stdenv.isDarwin Security;
+
+  meta = with stdenv.lib; {
+    description = "A command-line tool to generate, analyze, convert and manipulate colors";
+    homepage = https://github.com/sharkdp/pastel;
+    license = with licenses; [ asl20 /* or */ mit ];
+    maintainers = with maintainers; [ davidtwco ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/applications/networking/browsers/vivaldi/default.nix
+++ b/pkgs/applications/networking/browsers/vivaldi/default.nix
@ -17,11 +17,11 @@ let
  vivaldiName = if isSnapshot then "vivaldi-snapshot" else "vivaldi";
 in stdenv.mkDerivation rec {
  pname = "vivaldi";
-  version = "2.8.1664.35-1";
+  version = "2.8.1664.38-1";

  src = fetchurl {
    url = "https://downloads.vivaldi.com/${branch}/vivaldi-${branch}_${version}_amd64.deb";
-    sha256 = "0wrpn2figljvq9xldpqb1wf81fpwj91ppi2lzvcg5ycpl2a90x7j";
+    sha256 = "1znhlwwgq4k0fplr4l8ixgn6g5k26ns77j2dm0pjg3a2jgjq6rdr";
  };

  unpackPhase = ''
--- a/pkgs/applications/networking/cluster/kops/default.nix
+++ b/pkgs/applications/networking/cluster/kops/default.nix
@ -43,7 +43,7 @@ let
          description = "Easiest way to get a production Kubernetes up and running";
          homepage = https://github.com/kubernetes/kops;
          license = licenses.asl20;
-          maintainers = with maintainers; [offline zimbatm];
+          maintainers = with maintainers; [offline zimbatm kampka];
          platforms = platforms.unix;
        };
      } // attrs';
@ -57,7 +57,7 @@ in rec {
  };

  kops_1_13 = mkKops {
-    version = "1.13.0";
-    sha256 = "04kbbg3gqzwzzzq1lmnpw2gqky3pfwfk7pc0laxv2yssk9wac5k1";
+    version = "1.13.1";
+    sha256 = "0knypbrpipxplgdg6r0r6ycsj7w46virmzwn5s4sdim0y8d2ppyb";
  };
 }
--- a/pkgs/applications/networking/instant-messengers/gajim/default.nix
+++ b/pkgs/applications/networking/instant-messengers/gajim/default.nix
@ -44,7 +44,7 @@ python3.pkgs.buildPythonApplication rec {
  ];

  propagatedBuildInputs = with python3.pkgs; [
-    nbxmpp pyasn1 pygobject3 dbus-python pillow cssutils precis-i18n keyring
+    nbxmpp pyasn1 pygobject3 dbus-python pillow cssutils precis-i18n keyring setuptools
  ] ++ lib.optionals enableE2E [ pycrypto python-gnupg ]
    ++ lib.optional enableRST docutils
    ++ lib.optionals enableOmemoPluginDependencies [ python-axolotl qrcode ]
--- a/pkgs/applications/networking/instant-messengers/teamspeak/client.nix
+++ b/pkgs/applications/networking/instant-messengers/teamspeak/client.nix
@ -1,6 +1,6 @@
 { stdenv, fetchurl, makeWrapper, makeDesktopItem, zlib, glib, libpng, freetype, openssl
 , xorg, fontconfig, qtbase, qtwebengine, qtwebchannel, qtsvg, xkeyboard_config, alsaLib
-, libpulseaudio ? null, libredirect, quazip, less, which, unzip, llvmPackages
+, libpulseaudio ? null, libredirect, quazip, which, unzip, llvmPackages, writeShellScriptBin
 }:

 let
@ -26,6 +26,8 @@ let
    categories = "Network";
  };

+  fakeLess = writeShellScriptBin "less" "cat";
+
 in

 stdenv.mkDerivation rec {
@ -46,11 +48,11 @@ stdenv.mkDerivation rec {
    sha256 = "1bywmdj54glzd0kffvr27r84n4dsd0pskkbmh59mllbxvj0qwy7f";
  };

-  buildInputs = [ makeWrapper less which unzip ];
+  nativeBuildInputs = [ makeWrapper fakeLess which unzip ];

  unpackPhase =
    ''
-      echo -e 'q\ny' | sh -xe $src
+      echo -e '\ny' | sh -xe $src
      cd TeamSpeak*
    '';

--- a/pkgs/applications/networking/mailreaders/trojita/default.nix
+++ b/pkgs/applications/networking/mailreaders/trojita/default.nix
@ -1,37 +1,50 @@
-{ mkDerivation
-, lib
-, fetchurl
+{ akonadi-contacts
 , cmake
+, fetchgit
+, gpgme
+, kcontacts
+, lib
+, mimetic
+, mkDerivation
+, pkgconfig
+, qgpgme
 , qtbase
-, qtwebkit
+, qtkeychain
 , qttools
+, qtwebkit
 }:

 mkDerivation rec {
  pname = "trojita";
-  version = "0.7";
+  version = "0.7.20190618";

-  src = fetchurl {
-    url = "mirror://sourceforge/trojita/trojita/${pname}-${version}.tar.xz";
-    sha256 = "1n9n07md23ny6asyw0xpih37vlwzp7vawbkprl7a1bqwfa0si3g0";
+  src = fetchgit {
+    url = "https://anongit.kde.org/trojita.git";
+    rev = "90b417b131853553c94ff93aef62abaf301aa8f1";
+    sha256 = "0xpxq5bzqaa68lkz90wima5q2m0mdcn0rvnigb66lylb4n20mnql";
  };

  buildInputs = [
+    akonadi-contacts
+    gpgme
+    kcontacts
+    mimetic
+    qgpgme
    qtbase
+    qtkeychain
    qtwebkit
  ];

  nativeBuildInputs = [
    cmake
+    pkgconfig
    qttools
  ];

-
  meta = with lib; {
    description = "A Qt IMAP e-mail client";
-    homepage = http://trojita.flaska.net/;
+    homepage = "http://trojita.flaska.net/";
    license = with licenses; [ gpl2 gpl3 ];
    platforms = platforms.linux;
  };
-
 }
--- a/pkgs/applications/science/logic/tamarin-prover/default.nix
+++ b/pkgs/applications/science/logic/tamarin-prover/default.nix
@ -104,4 +104,6 @@ mkDerivation (common "tamarin-prover" src // {
          tamarin-prover-term
          tamarin-prover-theory
        ];
+
+  broken = true;
 })
--- a/pkgs/applications/video/shotcut/default.nix
+++ b/pkgs/applications/video/shotcut/default.nix
@ -1,10 +1,23 @@
-{ stdenv, fetchFromGitHub, SDL2, frei0r, gettext, mlt, jack1, mkDerivation
-, pkgconfig, qtbase, qtmultimedia, qtwebkit, qtx11extras, qtwebsockets
-, qtquickcontrols, qtgraphicaleffects, libmlt, qmake, qttools }:
+{ stdenv, fetchFromGitHub, fetchpatch, mkDerivation, SDL2, frei0r, gettext, mlt
+, jack1, pkgconfig, qtbase, qtmultimedia, qtwebkit, qtx11extras, qtwebsockets
+, qtquickcontrols, qtgraphicaleffects, libmlt, qmake, qttools
+}:

 assert stdenv.lib.versionAtLeast libmlt.version "6.8.0";
 assert stdenv.lib.versionAtLeast mlt.version "6.8.0";

+let
+  # https://github.com/mltframework/shotcut/issues/771
+  fixVaapiRendering1 = fetchpatch {
+    url = "https://github.com/peti/shotcut/commit/038f6839298fc1e9e80ddf84fe168a78118bc625.patch";
+    sha256 = "153z1g6criszd6gdkw4f5zk0gmh0jar6l2g8fzwjhhcvkdz30vbp";
+  };
+  fixVaapiRendering2 = fetchpatch {
+    url = "https://github.com/peti/shotcut/commit/653c485f92d2847fdac517e3f797c9254826ffab.patch";
+    sha256 = "1qd0zgyahda72xh3avlg7lg0jq94wq5847154qlrgzj8b4n7vizw";
+  };
+in
+
 mkDerivation rec {
  pname = "shotcut";
  version = "19.09.14";
@ -16,6 +29,8 @@ mkDerivation rec {
    sha256 = "1cl8ba1n0h450r4n5mfqmyjaxvczs3m19blwxslqskvmxy5my3cn";
  };

+  patches = [ fixVaapiRendering1 fixVaapiRendering2 ];
+
  enableParallelBuilding = true;
  nativeBuildInputs = [ pkgconfig qmake ];
  buildInputs = [
@ -33,8 +48,6 @@ mkDerivation rec {
    sed 's_qApp->applicationDirPath(), "ffmpeg"_"${mlt.ffmpeg}/bin/ffmpeg"_' -i src/docks/encodedock.cpp
    NICE=$(type -P nice)
    sed "s_/usr/bin/nice_''${NICE}_" -i src/jobs/meltjob.cpp src/jobs/ffmpegjob.cpp
-    # Fix VAAPI auto-config: https://github.com/mltframework/shotcut/issues/771
-    sed 's#"-vaapi_device" << ":0"#"-vaapi_device" << "/dev/dri/renderD128"#' -i src/docks/encodedock.cpp
  '';

  qtWrapperArgs = [
--- a/pkgs/applications/virtualization/virtualbox/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/default.nix
@ -92,6 +92,9 @@ in stdenv.mkDerivation {
    })
  ++ [
    ./qtx11extras.patch
+    # Kernel 5.3 fix, should be fixed with VirtualBox 6.0.14
+    # https://www.virtualbox.org/ticket/18911
+    ./kernel-5.3-fix.patch
  ];

  postPatch = ''
--- a/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
@ -12,9 +12,16 @@ let
  # It's likely to work again in some future update.
  xserverABI = let abi = xserverVListFunc 0 + xserverVListFunc 1;
    in if abi == "119" || abi == "120" then "118" else abi;
-in

-stdenv.mkDerivation {
+  # Specifies how to patch binaries to make sure that libraries loaded using
+  # dlopen are found. We grep binaries for specific library names and patch
+  # RUNPATH in matching binaries to contain the needed library paths.
+  dlopenLibs = [
+    { name = "libdbus-1.so"; pkg = dbus; }
+    { name = "libXfixes.so"; pkg = xorg.libXfixes; }
+  ];
+
+in stdenv.mkDerivation {
  name = "VirtualBox-GuestAdditions-${version}-${kernel.version}";

  src = fetchurl {
@ -134,13 +141,13 @@ stdenv.mkDerivation {
  # Stripping breaks these binaries for some reason.
  dontStrip = true;

-  # Some code dlopen() libdbus, patch RUNPATH in fixupPhase so it isn't stripped.
-  postFixup = ''
-    for i in $(grep -F libdbus-1.so -l -r $out/{lib,bin}); do
+  # Patch RUNPATH according to dlopenLibs (see the comment there).
+  postFixup = lib.concatMapStrings (library: ''
+    for i in $(grep -F ${lib.escapeShellArg library.name} -l -r $out/{lib,bin}); do
      origRpath=$(patchelf --print-rpath "$i")
-      patchelf --set-rpath "$origRpath:${lib.makeLibraryPath [ dbus ]}" "$i"
+      patchelf --set-rpath "$origRpath:${lib.makeLibraryPath [ library.pkg ]}" "$i"
    done
-  '';
+  '') dlopenLibs;

  meta = {
    description = "Guest additions for VirtualBox";
--- a/pkgs/applications/virtualization/virtualbox/kernel-5.3-fix.patch
+++ b/pkgs/applications/virtualization/virtualbox/kernel-5.3-fix.patch
@ -0,0 +1,72 @@
+--- a/src/VBox/HostDrivers/VBoxNetFlt/linux/VBoxNetFlt-linux.c
+++ b/src/VBox/HostDrivers/VBoxNetFlt/linux/VBoxNetFlt-linux.c
+@@ -2123,7 +2123,9 @@
+ #endif
+     if (in_dev != NULL)
+     {
+-        for_ifa(in_dev) {
+        struct in_ifaddr *ifa;
+
+        for (ifa = in_dev->ifa_list; ifa; ifa = ifa->ifa_next) {
+             if (VBOX_IPV4_IS_LOOPBACK(ifa->ifa_address))
+                 return NOTIFY_OK;
+
+@@ -2137,7 +2139,7 @@
+
+             pThis->pSwitchPort->pfnNotifyHostAddress(pThis->pSwitchPort,
+                 /* :fAdded */ true, kIntNetAddrType_IPv4, &ifa->ifa_address);
+-        } endfor_ifa(in_dev);
+        }
+     }
+
+     /*
+--- a/src/VBox/Runtime/r0drv/linux/mp-r0drv-linux.c
+++ a/src/VBox/Runtime/r0drv/linux/mp-r0drv-linux.c
+@@ -283,12 +283,15 @@
+     if (RTCpuSetCount(&OnlineSet) > 1)
+     {
+         /* Fire the function on all other CPUs without waiting for completion. */
+-# if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
+# if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0)
+        smp_call_function(rtmpLinuxAllWrapper, &Args, 0 /* wait */);
+# elif LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
+         int rc = smp_call_function(rtmpLinuxAllWrapper, &Args, 0 /* wait */);
+        Assert(!rc); NOREF(rc);
+ # else
+         int rc = smp_call_function(rtmpLinuxAllWrapper, &Args, 0 /* retry */, 0 /* wait */);
+-# endif
+         Assert(!rc); NOREF(rc);
+# endif
+     }
+ #endif
+
+@@ -326,7 +329,6 @@
+ {
+ #ifdef CONFIG_SMP
+     IPRT_LINUX_SAVE_EFL_AC();
+-    int rc;
+     RTMPARGS Args;
+
+     RTTHREADPREEMPTSTATE PreemptState = RTTHREADPREEMPTSTATE_INITIALIZER;
+@@ -337,14 +339,17 @@
+     Args.cHits = 0;
+
+     RTThreadPreemptDisable(&PreemptState);
+-# if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
+-    rc = smp_call_function(rtmpLinuxWrapper, &Args, 1 /* wait */);
+# if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0)
+    smp_call_function(rtmpLinuxWrapper, &Args, 1 /* wait */);
+# elif LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
+    int rc = smp_call_function(rtmpLinuxWrapper, &Args, 1 /* wait */);
+    Assert(rc == 0); NOREF(rc);
+ # else /* older kernels */
+-    rc = smp_call_function(rtmpLinuxWrapper, &Args, 0 /* retry */, 1 /* wait */);
+    int rc = smp_call_function(rtmpLinuxWrapper, &Args, 0 /* retry */, 1 /* wait */);
+    Assert(rc == 0); NOREF(rc);
+ # endif /* older kernels */
+     RTThreadPreemptRestore(&PreemptState);
+
+-    Assert(rc == 0); NOREF(rc);
+     IPRT_LINUX_RESTORE_EFL_AC();
+ #else
+     RT_NOREF(pfnWorker, pvUser1, pvUser2);
--- a/pkgs/data/fonts/iosevka/default.nix
+++ b/pkgs/data/fonts/iosevka/default.nix
@ -1,83 +1,70 @@
-{
-  stdenv, lib, pkgs,
-  fetchFromGitHub, fetchurl,
-  nodejs, ttfautohint-nox, otfcc,
+{ stdenv, lib, pkgs, fetchFromGitHub
+, nodejs, nodePackages, remarshal, ttfautohint-nox, otfcc

-  # Custom font set options.
-  # See https://github.com/be5invis/Iosevka#build-your-own-style
-  design ? [], upright ? [], italic ? [], oblique ? [],
-  family ? null, weights ? [],
-  # Custom font set name. Required if any custom settings above.
-  set ? null,
-  # Extra parameters. Can be used for ligature mapping.
-  extraParameters ? null
+# Custom font set options.
+# See https://github.com/be5invis/Iosevka#build-your-own-style
+# Ex:
+# privateBuildPlan = {
+#   family = "Iosevka Expanded";
+#
+#   design = [
+#     "sans"
+#     "expanded"
+#   ];
+# };
+, privateBuildPlan ? null
+# Extra parameters. Can be used for ligature mapping.
+, extraParameters ? null
+# Custom font set name. Required if any custom settings above.
+, set ? null
 }:

-assert (design != []) -> set != null;
-assert (upright != []) -> set != null;
-assert (italic != []) -> set != null;
-assert (oblique != []) -> set != null;
-assert (family != null) -> set != null;
-assert (weights != []) -> set != null;
+assert (privateBuildPlan != null) -> set != null;

-let
-  system = builtins.currentSystem;
-  nodePackages = import ./node-packages.nix { inherit pkgs system nodejs; };
-in
+stdenv.mkDerivation rec {
+  pname =
+    if set != null
+    then "iosevka-${set}"
+    else "iosevka";

-let pname = if set != null then "iosevka-${set}" else "iosevka"; in
-
-let
  version = "2.3.0";
-  name = "${pname}-${version}";
+
  src = fetchFromGitHub {
    owner = "be5invis";
-    repo ="Iosevka";
+    repo = "Iosevka";
    rev = "v${version}";
    sha256 = "1qnbxhx9wvij9zia226mc3sy8j7bfsw5v1cvxvsbbwjskwqdamvv";
  };
-in

-with lib;
-let quote = str: "\"" + str + "\""; in
-let toTomlList = list: "[" + (concatMapStringsSep ", " quote list) +"]"; in
-let unlines = concatStringsSep "\n"; in
+  nativeBuildInputs = [
+    nodejs
+    nodePackages."iosevka-build-deps-../../data/fonts/iosevka"
+    remarshal
+    otfcc
+    ttfautohint-nox
+  ];

-let
-  param = name: options:
-    if options != [] then "${name}=${toTomlList options}" else null;
-  config = unlines (lib.filter (x: x != null) [
-    "[buildPlans.${pname}]"
-    (param "design" design)
-    (param "upright" upright)
-    (param "italic" italic)
-    (param "oblique" oblique)
-    (if family != null then "family=\"${family}\"" else null)
-    (param "weights" weights)
-  ]);
-  installNodeModules = unlines (lib.mapAttrsToList
-    (name: value: "mkdir -p node_modules/${name}\n cp -r ${value.outPath}/lib/node_modules/. node_modules")
-    nodePackages);
-in
-
-stdenv.mkDerivation {
-  inherit name pname version src;
-
-  nativeBuildInputs = [ nodejs ttfautohint-nox otfcc ];
-
-  passAsFile = [ "config" "extraParameters" ];
-  config = config;
-  extraParameters = extraParameters;
+  privateBuildPlanJSON = builtins.toJSON { buildPlans.${pname} = privateBuildPlan; };
+  extraParametersJSON = builtins.toJSON { ${pname} = extraParameters; };
+  passAsFile = [ "privateBuildPlanJSON" "extraParametersJSON" ];

  configurePhase = ''
-    mkdir -p node_modules/.bin
-    ${installNodeModules}
-    ${optionalString (set != null) ''mv "$configPath" private-build-plans.toml''}
-    ${optionalString (extraParameters != null) ''cat "$extraParametersPath" >> parameters.toml''}
+    runHook preConfigure
+    ${lib.optionalString (privateBuildPlan != null) ''
+      remarshal -i "$privateBuildPlanJSONPath" -o private-build-plans.toml -if json -of toml
+    ''}
+    ${lib.optionalString (extraParameters != null) ''
+      echo -e "\n" >> parameters.toml
+      remarshal -i "$extraParametersJSONPath" -if json -of toml >> parameters.toml
+    ''}
+    ln -s ${nodePackages."iosevka-build-deps-../../data/fonts/iosevka"}/lib/node_modules/iosevka-build-deps/node_modules .
+    runHook postConfigure
  '';

  buildPhase = ''
-    npm run build -- ttf::${pname}
+    runHook preBuild
+    npm run build -- ttf::$pname
+    runHook postBuild
  '';

  installPhase = ''
@ -89,14 +76,20 @@ stdenv.mkDerivation {
  enableParallelBuilding = true;

  meta = with stdenv.lib; {
-    homepage = https://be5invis.github.io/Iosevka/;
-    downloadPage = "https://github.com/be5invis/Iosevka/releases";
+    homepage = https://be5invis.github.io/Iosevka;
+    downloadPage = https://github.com/be5invis/Iosevka/releases;
    description = ''
      Slender monospace sans-serif and slab-serif typeface inspired by Pragmata
      Pro, M+ and PF DIN Mono, designed to be the ideal font for programming.
    '';
    license = licenses.ofl;
    platforms = platforms.all;
-    maintainers = with maintainers; [ cstrahan jfrankenau ttuegel babariviere ];
+    maintainers = with maintainers; [
+      cstrahan
+      jfrankenau
+      ttuegel
+      babariviere
+      rileyinman
+    ];
  };
 }
--- a/pkgs/data/fonts/iosevka/generate.sh
+++ b/pkgs/data/fonts/iosevka/generate.sh
@ -1,6 +0,0 @@
-#!/bin/sh
-
-node2nix --nodejs-10 --input node-packages.json \
-              --output node-packages-generated.nix \
-              --composition node-packages.nix \
-              --node-env ./../../../development/node-packages/node-env.nix
--- a/pkgs/data/fonts/iosevka/node-packages-generated.nix
+++ b/pkgs/data/fonts/iosevka/node-packages-generated.nix
--- a/pkgs/data/fonts/iosevka/node-packages.json
+++ b/pkgs/data/fonts/iosevka/node-packages.json
@ -1,20 +0,0 @@
-[
-    "caryll-shapeops",
-    "libspiro-js",
-    "megaminx",
-    "object-assign",
-    "otfcc-ttcize",
-    "primitive-quadify-off-curves",
-    "toml",
-    "topsort",
-    "ttf2woff",
-    "ttf2woff2",
-    "unorm",
-    "verda",
-    "yargs",
-    "colors",
-    "patel",
-    "patrisika-scopes",
-    "eslint",
-    "stylus"
-]
--- a/pkgs/data/fonts/iosevka/node-packages.nix
+++ b/pkgs/data/fonts/iosevka/node-packages.nix
@ -1,17 +0,0 @@
-# This file has been generated by node2nix 1.7.0. Do not edit!
-
-{pkgs ? import <nixpkgs> {
-    inherit system;
-  }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs-10_x"}:
-
-let
-  nodeEnv = import ../../../development/node-packages/node-env.nix {
-    inherit (pkgs) stdenv python2 utillinux runCommand writeTextFile;
-    inherit nodejs;
-    libtool = if pkgs.stdenv.isDarwin then pkgs.darwin.cctools else null;
-  };
-in
-import ./node-packages-generated.nix {
-  inherit (pkgs) fetchurl fetchgit;
-  inherit nodeEnv;
-}
--- a/pkgs/data/fonts/iosevka/package.json
+++ b/pkgs/data/fonts/iosevka/package.json
@ -0,0 +1,26 @@
+{
+	"name": "iosevka-build-deps",
+	"version": "2.3.0",
+	"scripts": {
+		"build": "verda -f verdafile.js"
+	},
+	"dependencies": {
+		"caryll-shapeops": "^0.3.1",
+		"colors": "^1.3.3",
+		"libspiro-js": "^0.3.1",
+		"megaminx": "^0.9.0",
+		"object-assign": "^4.1.1",
+		"otfcc-ttcize": "^0.8.0",
+		"patel": "^0.33.1",
+		"patrisika-scopes": "^0.11.1",
+		"primitive-quadify-off-curves": "^0.4.0",
+		"stylus": "^0.54.5",
+		"toml": "^2.3.2",
+		"topsort": "0.0.2",
+		"ttf2woff": "^2.0.1",
+		"ttf2woff2": "^2.0.3",
+		"unorm": "^1.4.1",
+		"verda": "^1.0.0-0",
+		"yargs": "^12.0.0"
+	}
+}
--- a/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix
+++ b/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix
@ -103,6 +103,6 @@ rec {
    cp -r ${buildAndroidndk}/libexec/android-sdk/ndk-bundle/sysroot/usr/include $out/include
    chmod +w $out/include
    cp -r ${buildAndroidndk}/libexec/android-sdk/ndk-bundle/sysroot/usr/include/${targetInfo.triple}/* $out/include
-    ln -s ${buildAndroidndk}/libexec/android-sdk/ndk-bundle/platforms/android-${stdenv.hostPlatform.sdkVer}/arch-${hostInfo.arch}/usr/lib $out/lib
+    ln -s ${buildAndroidndk}/libexec/android-sdk/ndk-bundle/platforms/android-${stdenv.hostPlatform.sdkVer}/arch-${hostInfo.arch}/usr/${if hostInfo.arch == "x86_64" then "lib64" else "lib"} $out/lib
  '';
 }
--- a/pkgs/development/compilers/manticore/default.nix
+++ b/pkgs/development/compilers/manticore/default.nix
@ -1,15 +1,15 @@
 { stdenv, fetchFromGitHub, coreutils, autoreconfHook, smlnj }:

 let
-  rev= "47273c463fc3c5d0a0ae655cf75a4700bdb020b4";
+  rev= "4528ccacdfd53d36f5959c005b27cd7ab6175b83";
 in stdenv.mkDerivation {
  pname = "manticore";
-  version = "2018.09.29";
+  version = "2019.09.20";
 
  src = fetchFromGitHub {
    owner = "ManticoreProject";
    repo = "manticore";
-    sha256 = "1prrgp7ldkdnrdbj224qqkirw8bj72460ix97c96fy264j9c97cn";
+    sha256 = "1xz7msiq5x2c56zjxydbxlj6r001mm5zszcda6f6v5qfmmd1bakz";
    inherit rev;
  };

--- a/pkgs/development/compilers/terra/default.nix
+++ b/pkgs/development/compilers/terra/default.nix
@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
      --replace '-lcurses' '-lncurses'

    substituteInPlace src/terralib.lua \
-      --subst-var-by NIX_LIBC_INCLUDE ${stdenv.cc.libc.dev}/include
+      --subst-var-by NIX_LIBC_INCLUDE ${stdenv.lib.getDev stdenv.cc.libc}/include
  '';

  preBuild = ''
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@ -322,7 +322,6 @@ self: super: {
  lvmrun = disableHardening (dontCheck super.lvmrun) ["format"];
  matplotlib = dontCheck super.matplotlib;
  memcache = dontCheck super.memcache;
-  MemoTrie = dontHaddock (dontCheck super.MemoTrie);
  metrics = dontCheck super.metrics;
  milena = dontCheck super.milena;
  modular-arithmetic = dontCheck super.modular-arithmetic; # tests require a very old Glob (0.7.*)
--- a/pkgs/development/haskell-modules/configuration-ghc-8.6.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-8.6.x.nix
@ -95,4 +95,7 @@ self: super: {
  # Newer versions don't compile.
  resolv = self.resolv_0_1_1_2;

+  # cabal2nix needs the latest version of Cabal.
+  cabal2nix = super.cabal2nix.overrideScope (self: super: { Cabal = self.Cabal_3_0_0_0; });
+
 }
--- a/pkgs/development/haskell-modules/configuration-ghc-8.8.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-8.8.x.nix
@ -42,6 +42,7 @@ self: super: {
  xhtml = null;

  # Ignore overly restrictive upper version bounds.
+  aeson-diff = doJailbreak super.aeson-diff;
  async = doJailbreak super.async;
  cabal-install = doJailbreak super.cabal-install;
  ChasingBottoms = doJailbreak super.ChasingBottoms;
@ -57,8 +58,11 @@ self: super: {
  quickcheck-instances = doJailbreak super.quickcheck-instances;
  setlocale = doJailbreak super.setlocale;
  split = doJailbreak super.split;
+  system-fileio = doJailbreak super.system-fileio;
  tasty-expected-failure = doJailbreak super.tasty-expected-failure;
+  tasty-hedgehog = doJailbreak super.tasty-hedgehog;
  test-framework = doJailbreak super.test-framework;
+  th-expand-syns = doJailbreak super.th-expand-syns;

  # These packages don't work and need patching and/or an update.
  primitive = overrideSrc (doJailbreak super.primitive) {
@ -96,8 +100,6 @@ self: super: {
    url = "https://gitlab.haskell.org/ghc/head.hackage/raw/master/patches/hedgehog-1.0.patch";
    sha256 = "16gadh1hb74jqvzc9c893sffb1y2vjglblyrqjwp7xfhccq7g8yw";
  });
-  easytest = markBroken super.easytest;
-  easytest_0_3 = markBroken super.easytest_0_3;
  regex-tdfa = appendPatch super.regex-tdfa (pkgs.fetchpatch {
    url = "https://raw.githubusercontent.com/hvr/head.hackage/master/patches/regex-tdfa-1.2.3.1.patch";
    sha256 = "1lhas4s2ms666prb475gaw2bqw1v4y8cxi66sy20j727sx7ppjs7";
@ -106,38 +108,14 @@ self: super: {
    url = "https://raw.githubusercontent.com/hvr/head.hackage/master/patches/socks-0.6.0.patch";
    sha256 = "1dsqmx0sw62x4glh43c0sbizd2y00v5xybiqadn96v6pmfrap5cp";
  });
-  lens = self.lens_4_18_1;
-  xmonad-contrib = self.xmonad-contrib_0_16;
  polyparse = appendPatch (doJailbreak super.polyparse) (pkgs.fetchpatch {
    url = "https://raw.githubusercontent.com/hvr/head.hackage/master/patches/polyparse-1.12.1.patch";
    sha256 = "01b2gnsq0x4fd9na8zpk6pajym55mbz64hgzawlwxdw0y6681kr5";
  });
  foundation = dontCheck super.foundation;
-  memory = overrideCabal (appendPatch super.memory (pkgs.fetchpatch {
-    url = "https://raw.githubusercontent.com/hvr/head.hackage/master/patches/memory-0.14.18.patch";
-    sha256 = "16ar8921s3bi31y1az9zgyg0iaxxc2wvvwqjnl11a17p03wi6b29";
-  })) (drv: {
-    editedCabalFile = null;
-    preConfigure = ''
-      cp -v ${pkgs.fetchurl {url = "https://raw.githubusercontent.com/hvr/head.hackage/master/patches/memory-0.14.18.cabal"; sha256 = "1325wny0irnq51rz0f4xgkvm01p6n4z5jid2jgpkhjac8a2sdgwl";}} memory.cabal
-    '';
-  });
  chell = overrideCabal (doJailbreak super.chell) (_drv: {
    broken = false;
  });
-  th-expand-syns = doJailbreak super.th-expand-syns;
-  shelly = overrideCabal (appendPatch (doJailbreak super.shelly) (pkgs.fetchpatch {
-    url = "https://raw.githubusercontent.com/hvr/head.hackage/master/patches/shelly-1.8.1.patch";
-    sha256 = "1kglbwrr4ra81v9x3bfsk5l6pyl0my2a1zkr3qjjx7acn0dfpgbc";
-  })) (drv: {
-    editedCabalFile = null;
-    preConfigure = ''
-      cp -v ${pkgs.fetchurl {url = "https://raw.githubusercontent.com/hvr/head.hackage/master/patches/shelly-1.8.1.cabal"; sha256 = "0crf0m077wky76f5nav2p9q4fa5q4yhv5l4bq9hd073dzdaywhz0";}} shelly.cabal
-      sed -i -e 's/< 1.9,/< 2,/' shelly.cabal # bump time version
-    '';
-  });
-  system-fileio = doJailbreak super.system-fileio;
-  tasty-hedgehog = doJailbreak super.tasty-hedgehog;
  haskell-src-meta = appendPatch (dontCheck (doJailbreak super.haskell-src-meta)) (pkgs.fetchpatch {
    url = "https://gitlab.haskell.org/ghc/head.hackage/raw/master/patches/haskell-src-meta-0.8.3.patch";
    sha256 = "1asl932mibr5y057xx8v1a7n3qy87lcnclsfh8pbxq1m3iwjkxy8";
@ -146,7 +124,6 @@ self: super: {
    url = "https://gitlab.haskell.org/ghc/head.hackage/raw/master/patches/asn1-encoding-0.9.5.patch";
    sha256 = "0a3159rnaw6shjzdm46799crd4pxh33s23qy51xa7z6nv5q8wsb5";
  });
-  tls = self.tls_1_5_1;
  vault = dontHaddock super.vault;
  monad-par = dontCheck super.monad-par;   # test suite does not compile in monad-par-0.3.4.8

@ -162,23 +139,29 @@ self: super: {
    sha256 = "0zsgzn0nvdxvqi5z0za3gzlhql2x5d5cr0kkr19j5c67fy177w6b";
  });

-  # over-specified version constraints
-  aeson-diff = doJailbreak super.aeson-diff;
-
  # https://github.com/sol/hpack/issues/371
-  hpack = markBrokenVersion "0.32.0" super.hpack;
+  hpack = appendPatch super.hpack (pkgs.fetchpatch {
+    url = "https://gitlab.haskell.org/ghc/head.hackage/raw/master/patches/hpack-0.32.0.patch";
+    sha256 = "11ccl9f7vwbf5cpzknlyvrwgkzpajk4vq9jk9yb5f9la9ggwb244";
+  });

  # Upstream ships a broken Setup.hs file.
  csv = overrideCabal super.csv (drv: { prePatch = "rm Setup.hs"; });

-  # Upstream ships a broken Setup.hs file.
-  string-qq = overrideSrc (dontCheck super.string-qq) {
-    src = pkgs.fetchFromGitHub {
-      owner = "dmwit";
-      repo = "string-qq";
-      rev = "b396f5ef36a9b23f1d3fafcc91f2222cd1ad24fe";
-      sha256 = "1z2f1yry8wi0jb38dgz7rl89zl63fhngf7xk4ljw240vn315jj8s";
-    };
-  };
+  # mark broken packages
+  bencode = markBrokenVersion "0.6.0.0" super.bencode;
+  easytest = markBroken super.easytest;
+  easytest_0_3 = markBroken super.easytest_0_3;
+  haskell-src = markBrokenVersion "1.0.3.0" super.haskell-src;
+
+  # use latest version to fix the build
+  hackage-db = self.hackage-db_2_1_0;
+  lens = self.lens_4_18_1;
+  memory = self.memory_0_15_0;
+  microlens = self.microlens_0_4_11_2;
+  shelly = self.shelly_1_9_0;
+  string-qq = self.string-qq_0_0_4;
+  tls = self.tls_1_5_1;
+  xmonad-contrib = self.xmonad-contrib_0_16;

 }
--- a/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
@ -43,7 +43,7 @@ core-packages:
  - ghcjs-base-0

 default-package-overrides:
-  # LTS Haskell 14.6
+  # LTS Haskell 14.7
  - abstract-deque ==0.3
  - abstract-deque-tests ==0.3
  - abstract-par ==0.3.3
@ -370,7 +370,7 @@ default-package-overrides:
  - concurrent-supply ==0.1.8
  - cond ==0.4.1.1
  - conduit ==1.3.1.1
-  - conduit-algorithms ==0.0.10.1
+  - conduit-algorithms ==0.0.11.0
  - conduit-combinators ==1.3.0
  - conduit-concurrent-map ==0.1.1
  - conduit-extra ==1.3.4
@ -393,7 +393,7 @@ default-package-overrides:
  - control-bool ==0.2.1
  - control-dsl ==0.2.1.3
  - control-monad-free ==0.6.2
-  - control-monad-omega ==0.3.1
+  - control-monad-omega ==0.3.2
  - convertible ==1.1.1.0
  - cookie ==0.4.4
  - core-data ==0.2.0.0
@ -646,7 +646,7 @@ default-package-overrides:
  - failable ==1.2.2.0
  - fakedata ==0.2.2
  - farmhash ==0.1.0.5
-  - fast-builder ==0.1.1.0
+  - fast-builder ==0.1.2.0
  - fast-digits ==0.2.1.0
  - fast-logger ==2.4.17
  - fast-math ==1.0.2
@ -796,7 +796,7 @@ default-package-overrides:
  - ginger ==0.9.1.0
  - gingersnap ==0.3.1.0
  - gi-pango ==1.0.22
-  - githash ==0.1.3.2
+  - githash ==0.1.3.3
  - github-release ==1.2.4
  - github-types ==0.2.1
  - github-webhooks ==0.10.1
@ -890,7 +890,7 @@ default-package-overrides:
  - heap ==1.0.4
  - heaps ==0.3.6.1
  - hebrew-time ==0.1.2
-  - hedgehog ==1.0
+  - hedgehog ==1.0.1
  - hedgehog-corpus ==0.1.0
  - hedgehog-fn ==1.0
  - hedis ==0.12.8
@ -1045,7 +1045,7 @@ default-package-overrides:
  - hw-mquery ==0.2.0.1
  - hw-packed-vector ==0.0.0.3
  - hw-parser ==0.1.0.1
-  - hw-prim ==0.6.2.31
+  - hw-prim ==0.6.2.32
  - hw-rankselect ==0.13.0.0
  - hw-rankselect-base ==0.3.2.1
  - hw-simd ==0.1.1.4
@ -1176,7 +1176,7 @@ default-package-overrides:
  - lackey ==1.0.9
  - LambdaHack ==0.9.5.0
  - lame ==0.2.0
-  - language-c ==0.8.2
+  - language-c ==0.8.3
  - language-c-quote ==0.12.2
  - language-docker ==8.0.2
  - language-ecmascript ==0.19
@ -1250,7 +1250,7 @@ default-package-overrides:
  - log-domain ==0.12
  - logfloat ==0.13.3.3
  - logger-thread ==0.1.0.2
-  - logging-effect ==1.3.4
+  - logging-effect ==1.3.6
  - logging-facade ==0.3.0
  - logging-facade-syslog ==1
  - logict ==0.7.0.2
@ -1714,7 +1714,7 @@ default-package-overrides:
  - Ranged-sets ==0.4.0
  - range-set-list ==0.1.3.1
  - rank1dynamic ==0.4.0
-  - rank2classes ==1.3
+  - rank2classes ==1.3.1
  - Rasterific ==0.7.4.4
  - rasterific-svg ==0.3.3.2
  - ratel ==1.0.8
@ -1731,7 +1731,7 @@ default-package-overrides:
  - read-editor ==0.1.0.2
  - read-env-var ==1.0.0.0
  - reanimate ==0.1.5.0
-  - reanimate-svg ==0.9.1.1
+  - reanimate-svg ==0.9.2.1
  - rebase ==1.3.1.1
  - record-dot-preprocessor ==0.2
  - record-hasfield ==1.0
@ -1767,12 +1767,10 @@ default-package-overrides:
  - repa ==3.4.1.4
  - repa-algorithms ==3.4.1.3
  - repa-io ==3.4.1.1
-  - replace-attoparsec ==1.0.1.0
-  - replace-megaparsec ==1.1.3.0
  - repline ==0.2.1.0
  - req ==2.1.0
  - req-conduit ==1.0.0
-  - require ==0.4.2
+  - require ==0.4.3
  - rerebase ==1.3.1.1
  - resistor-cube ==0.0.1.2
  - resource-pool ==0.2.3.2
@ -1826,7 +1824,7 @@ default-package-overrides:
  - scalpel ==0.6.0
  - scalpel-core ==0.6.0
  - scanf ==0.1.0.0
-  - scanner ==0.3
+  - scanner ==0.3.1
  - scheduler ==1.4.2
  - scientific ==0.3.6.2
  - scotty ==0.11.5
@ -1836,10 +1834,10 @@ default-package-overrides:
  - sdl2-image ==2.0.0
  - sdl2-mixer ==1.1.0
  - sdl2-ttf ==2.1.0
-  - secp256k1-haskell ==0.1.4
+  - secp256k1-haskell ==0.1.5
  - securemem ==0.1.10
  - selda ==0.4.0.0
-  - selda-json ==0.1.0.0
+  - selda-json ==0.1.1.0
  - selda-postgresql ==0.1.8.0
  - selda-sqlite ==0.1.7.0
  - selective ==0.3
@ -1866,13 +1864,13 @@ default-package-overrides:
  - servant-checked-exceptions ==2.2.0.0
  - servant-checked-exceptions-core ==2.2.0.0
  - servant-cli ==0.1.0.1
-  - servant-client ==0.16
+  - servant-client ==0.16.0.1
  - servant-client-core ==0.16
  - servant-conduit ==0.15
-  - servant-docs ==0.11.3
-  - servant-elm ==0.6.0.2
+  - servant-docs ==0.11.4
+  - servant-elm ==0.6.1
  - servant-foreign ==0.15
-  - servant-http-streams ==0.16
+  - servant-http-streams ==0.16.0.1
  - servant-js ==0.9.4
  - servant-JuicyPixels ==0.3.0.4
  - servant-kotlin ==0.1.1.9
@ -1880,7 +1878,7 @@ default-package-overrides:
  - servant-machines ==0.15
  - servant-mock ==0.8.5
  - servant-multipart ==0.11.4
-  - servant-pipes ==0.15
+  - servant-pipes ==0.15.1
  - servant-ruby ==0.9.0.0
  - servant-server ==0.16.2
  - servant-static-th ==0.2.2.1
@ -1982,7 +1980,7 @@ default-package-overrides:
  - statestack ==0.2.0.5
  - StateVar ==1.2
  - static-text ==0.2.0.4
-  - statistics ==0.15.0.0
+  - statistics ==0.15.1.1
  - stb-image-redux ==0.2.1.2
  - step-function ==0.2
  - stm-chans ==3.0.0.4
@ -2201,7 +2199,7 @@ default-package-overrides:
  - tuples-homogenous-h98 ==0.1.1.0
  - tuple-sop ==0.3.1.0
  - tuple-th ==0.2.5
-  - turtle ==1.5.14
+  - turtle ==1.5.15
  - TypeCompose ==0.9.14
  - typed-process ==0.2.6.0
  - type-errors ==0.2.0.0
@ -2309,7 +2307,7 @@ default-package-overrides:
  - verbosity ==0.3.0.0
  - versions ==3.5.1.1
  - ViennaRNAParser ==1.3.3
-  - viewprof ==0.0.0.30
+  - viewprof ==0.0.0.31
  - vinyl ==0.11.0
  - vivid ==0.4.2.3
  - vivid-osc ==0.5.0.0
@ -2355,7 +2353,7 @@ default-package-overrides:
  - websockets ==0.12.5.3
  - websockets-snap ==0.10.3.1
  - weigh ==0.0.14
-  - wide-word ==0.1.0.8
+  - wide-word ==0.1.0.9
  - wikicfp-scraper ==0.1.0.11
  - wild-bind ==0.1.2.4
  - wild-bind-x11 ==0.2.0.7
@ -5220,7 +5218,6 @@ broken-packages:
  - haddock-leksah
  - haddock-test
  - haddocset
-  - hadolint
  - hadoop-formats
  - hadoop-rpc
  - hadoop-tools
@ -8098,7 +8095,6 @@ broken-packages:
  - puzzle-draw
  - puzzle-draw-cmdline
  - pvd
-  - PyF
  - pyffi
  - pyfi
  - python-pickle
--- a/pkgs/development/haskell-modules/configuration-nix.nix
+++ b/pkgs/development/haskell-modules/configuration-nix.nix
@ -593,4 +593,8 @@ self: super: builtins.intersectAttrs super {
  http-download = dontCheck super.http-download;
  pantry = dontCheck super.pantry;

+  # Hadolint wants to build a statically linked binary by default.
+  hadolint = overrideCabal super.hadolint (drv: {
+    preConfigure = "sed -i -e /ld-options:/d hadolint.cabal";
+  });
 }
--- a/pkgs/development/haskell-modules/hackage-packages.nix
+++ b/pkgs/development/haskell-modules/hackage-packages.nix
--- a/pkgs/development/idris-modules/default.nix
+++ b/pkgs/development/idris-modules/default.nix
@ -103,8 +103,6 @@

    html = callPackage ./html.nix {};

-    heyting-algebra = callPackage ./heyting-algebra.nix {};
-
    hezarfen = callPackage ./hezarfen.nix {};

    hrtime = callPackage ./hrtime.nix {};
--- a/pkgs/development/idris-modules/heyting-algebra.nix
+++ b/pkgs/development/idris-modules/heyting-algebra.nix
@ -1,25 +0,0 @@
-{ build-idris-package
-, fetchFromGitHub
-, contrib
-, lib
-}:
-build-idris-package  {
-  name = "heyting-algebra";
-  version = "2017-08-18";
-
-  idrisDeps = [ contrib ];
-
-  src = fetchFromGitHub {
-    owner = "Risto-Stevcev";
-    repo = "idris-heyting-algebra";
-    rev = "2c814c48246a5e19bff66e64a753208c7d59d397";
-    sha256 = "199cvhxiimlhchvsc66zwn0dls78f9lamam256ad65mv4cjmxv40";
-  };
-
-  meta = {
-    description = "Interfaces for heyting algebras and verified bounded join and meet semilattices";
-    homepage = https://github.com/Risto-Stevcev/idris-heyting-algebra;
-    license = lib.licenses.mit;
-    maintainers = [ lib.maintainers.brainrape ];
-  };
-}
--- a/pkgs/development/libraries/gmp/6.x.nix
+++ b/pkgs/development/libraries/gmp/6.x.nix
@ -37,7 +37,7 @@ let self = stdenv.mkDerivation rec {
    "--build=${stdenv.buildPlatform.config}"
  ] ++ optional (cxx && stdenv.isDarwin) "CPPFLAGS=-fexceptions"
    ++ optional (stdenv.isDarwin && stdenv.is64bit) "ABI=64"
-    ++ optional (with stdenv.hostPlatform; useAndroidPrebuilt || useiOSPrebuilt) "--disable-assembly"
+    ++ optional (with stdenv.hostPlatform; (useAndroidPrebuilt || useiOSPrebuilt) && !isx86) "--disable-assembly"
    ;

  doCheck = true; # not cross;
--- a/pkgs/development/libraries/vtk/default.nix
+++ b/pkgs/development/libraries/vtk/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, cmake, libGLU_combined, libX11, xorgproto, libXt
+{ stdenv, fetchurl, cmake, libGLU_combined, libX11, xorgproto, libXt, libtiff
 , qtLib ? null
 # Darwin support
 , Cocoa, CoreServices, DiskArbitration, IOKit, CFNetwork, Security, GLUT, OpenGL
@ -20,7 +20,9 @@ stdenv.mkDerivation rec {
    sha256 = "0nm7xwwj7rnsxjdv2ssviys8nhci4n9iiiqm2y14s520hl2dsp1d";
  };

-  buildInputs = [ cmake ]
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [ libtiff ]
    ++ optional (qtLib != null) qtLib
    ++ optionals stdenv.isLinux [ libGLU_combined libX11 xorgproto libXt ]
    ++ optionals stdenv.isDarwin [ xpc Cocoa CoreServices DiskArbitration IOKit
@ -38,7 +40,7 @@ stdenv.mkDerivation rec {
  # built and requiring one of the shared objects.
  # At least, we use -fPIC for other packages to be able to use this in shared
  # objects.
-  cmakeFlags = [ "-DCMAKE_C_FLAGS=-fPIC" "-DCMAKE_CXX_FLAGS=-fPIC" ]
+  cmakeFlags = [ "-DCMAKE_C_FLAGS=-fPIC" "-DCMAKE_CXX_FLAGS=-fPIC" "-DVTK_USE_SYSTEM_TIFF=1" ]
    ++ optional (qtLib != null) [ "-DVTK_USE_QT:BOOL=ON" ]
    ++ optional stdenv.isDarwin "-DOPENGL_INCLUDE_DIR=${OpenGL}/Library/Frameworks";

--- a/pkgs/development/node-packages/node-packages-v10.json
+++ b/pkgs/development/node-packages/node-packages-v10.json
@ -57,6 +57,7 @@
 , "indium"
 , "ionic"
 , "ios-deploy"
+, { "iosevka-build-deps": "../../data/fonts/iosevka" }
 , "jake"
 , "javascript-typescript-langserver"
 , "joplin"
--- a/pkgs/development/node-packages/node-packages-v10.nix
+++ b/pkgs/development/node-packages/node-packages-v10.nix
--- a/pkgs/development/ocaml-modules/containers/default.nix
+++ b/pkgs/development/ocaml-modules/containers/default.nix
@ -1,53 +1,26 @@
-{ stdenv, fetchFromGitHub, ocaml, findlib, ocamlbuild, cppo, gen, sequence, qtest, ounit, result
-, qcheck }:
+{ lib, fetchFromGitHub, buildDunePackage, ocaml
+, iter, result, uchar
+, gen, mdx, ounit, qcheck, uutf
+}:

-let
-
-  mkpath = p:
-      "${p}/lib/ocaml/${ocaml.version}/site-lib";
-
-  version = "1.4";
-
-in
-
-stdenv.mkDerivation {
-  name = "ocaml${ocaml.version}-containers-${version}";
+buildDunePackage rec {
+  version = "2.6.1";
+  pname = "containers";

  src = fetchFromGitHub {
    owner = "c-cube";
    repo = "ocaml-containers";
    rev = version;
-    sha256 = "1wbarxphdrxvy7qsdp4p837h1zrv0z83pgs5lbz2h3kdnyvz2f1i";
+    sha256 = "02iq01pq6047hab5s8zpprwr21cygvzfcfj2lpsyj823f28crhmv";
  };

-  buildInputs = [ ocaml findlib ocamlbuild cppo gen sequence qtest ounit qcheck ];
+  buildInputs = [ iter ];

-  propagatedBuildInputs = [ result ];
+  checkInputs = lib.optionals doCheck [ gen mdx ounit qcheck uutf ];

-  preConfigure = ''
-    # The following is done so that the '#use "topfind"' directive works in the ocaml top-level
-    export HOME="$(mktemp -d)"
-    export OCAML_TOPLEVEL_PATH="${mkpath findlib}"
-    cat <<EOF > $HOME/.ocamlinit
-let () =
-  try Topdirs.dir_directory (Sys.getenv "OCAML_TOPLEVEL_PATH")
-  with Not_found -> ()
-;;
-EOF
-  '';
+  propagatedBuildInputs = [ result uchar ];

-  configureFlags = [
-    "--enable-unix"
-    "--enable-thread"
-    "--enable-tests"
-    "--enable-docs"
-    "--disable-bench"
-  ];
-
-  doCheck = true;
-  checkTarget = "test";
-
-  createFindlibDestdir = true;
+  doCheck = !lib.versionAtLeast ocaml.version "4.08";

  meta = {
    homepage = https://github.com/c-cube/ocaml-containers;
@ -62,7 +35,6 @@ EOF
      It also features optional libraries for dealing with strings, and
      helpers for unix and threads.
    '';
-    license = stdenv.lib.licenses.bsd2;
-    platforms = ocaml.meta.platforms or [];
+    license = lib.licenses.bsd2;
  };
 }
--- a/pkgs/development/ocaml-modules/sequence/default.nix
+++ b/pkgs/development/ocaml-modules/sequence/default.nix
@ -1,22 +1,20 @@
-{ stdenv, fetchFromGitHub, buildDunePackage, qtest, result }:
+{ lib, fetchFromGitHub, buildDunePackage, ocaml, mdx, qtest, result }:

 buildDunePackage rec {
-  pname = "sequence";
-  version = "1.1";
-
-  minimumOCamlVersion = "4.02";
+  pname = "iter";
+  version = "1.2.1";

  src = fetchFromGitHub {
    owner = "c-cube";
    repo = pname;
    rev = version;
-    sha256 = "08j37nldw47syq3yw4mzhhvya43knl0d7biddp0q9hwbaxhzgi44";
+    sha256 = "0j2sg50byn0ppmf6l36ksip7zx1d3gv7sc4hbbxs2rmx39jr7vxh";
  };

-  buildInputs = [ qtest ];
+  buildInputs = lib.optionals doCheck [ mdx qtest ];
  propagatedBuildInputs = [ result ];

-  doCheck = true;
+  doCheck = lib.versionAtLeast ocaml.version "4.04";

  meta = {
    homepage = https://github.com/c-cube/sequence;
@ -27,6 +25,6 @@ buildDunePackage rec {
      like `filter`, `map`, `take`, `drop` and `append` can be performed before the
      sequence is iterated/folded on.
    '';
-    license = stdenv.lib.licenses.bsd2;
+    license = lib.licenses.bsd2;
  };
 }
--- a/pkgs/development/ocaml-modules/mdx/default.nix
+++ b/pkgs/development/ocaml-modules/mdx/default.nix
@ -1,11 +1,9 @@
-{ stdenv, fetchFromGitHub, buildDunePackage, astring, cmdliner, cppo, fmt, logs, ocaml-migrate-parsetree, ocaml_lwt, pandoc, re }:
+{ lib, fetchFromGitHub, buildDunePackage, ocaml, astring, cmdliner, cppo, fmt, logs, ocaml-migrate-parsetree, ocaml_lwt, pandoc, re }:

 buildDunePackage rec {
  pname = "mdx";
  version = "1.4.0";

-  minimumOCamlVersion = "4.05";
-
  src = fetchFromGitHub {
    owner = "realworldocaml";
    repo = pname;
@ -15,14 +13,16 @@ buildDunePackage rec {

  nativeBuildInputs = [ cppo ];
  buildInputs = [ astring cmdliner fmt logs ocaml-migrate-parsetree re ];
-  checkInputs = [ ocaml_lwt pandoc ];
+  checkInputs = lib.optionals doCheck [ ocaml_lwt pandoc ];

-  doCheck = true;
+  doCheck = !lib.versionAtLeast ocaml.version "4.08";
+
+  dontStrip = lib.versions.majorMinor ocaml.version == "4.04";

  meta = {
    homepage = https://github.com/realworldocaml/mdx;
    description = "Executable OCaml code blocks inside markdown files";
-    license = stdenv.lib.licenses.isc;
-    maintainers = [ stdenv.lib.maintainers.romildo ];
+    license = lib.licenses.isc;
+    maintainers = [ lib.maintainers.romildo ];
  };
 }
--- a/pkgs/development/ocaml-modules/printbox/default.nix
+++ b/pkgs/development/ocaml-modules/printbox/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, buildDunePackage, mdx }:
+{ lib, fetchFromGitHub, buildDunePackage, ocaml, mdx }:

 buildDunePackage rec {
  pname = "printbox";
@ -13,14 +13,14 @@ buildDunePackage rec {
    sha256 = "16nwwpp13hzlcm9xqfxc558afm3i5s802dkj69l9s2vp04lgms5n";
  };

-  checkInputs = [ mdx ];
+  checkInputs = lib.optional doCheck mdx;

-  doCheck = true;
+  doCheck = !lib.versionAtLeast ocaml.version "4.08";

  meta = {
    homepage = https://github.com/c-cube/printbox/;
    description = "Allows to print nested boxes, lists, arrays, tables in several formats";
-    license = stdenv.lib.licenses.isc;
-    maintainers = [ stdenv.lib.maintainers.romildo ];
+    license = lib.licenses.isc;
+    maintainers = [ lib.maintainers.romildo ];
  };
 }
--- a/pkgs/development/python-modules/astropy/default.nix
+++ b/pkgs/development/python-modules/astropy/default.nix
@ -39,6 +39,9 @@ buildPythonPackage rec {
    pytest
  '';

+  # 368 failed, 10889 passed, 978 skipped, 69 xfailed in 196.24s
+  doCheck = false;
+
  meta = {
    description = "Astronomy/Astrophysics library for Python";
    homepage = https://www.astropy.org;
--- a/pkgs/development/python-modules/cairosvg/default.nix
+++ b/pkgs/development/python-modules/cairosvg/default.nix
@ -4,24 +4,15 @@

 buildPythonPackage rec {
  pname = "CairoSVG";
-  version = "2.3.0";
+  version = "2.4.2";

  disabled = !isPy3k;

  src = fetchPypi {
    inherit pname version;
-    sha256 = "66f333ef5dc79fdfbd3bbe98adc791b1f854e0461067d202fa7b15de66d517ec";
+    sha256 = "1bb7irxbaxxb9ahm3z5wsx1q96mm5gzskc7b6q07h9ikcnb8yrjf";
  };

-  patches = [
-    # fix isort-check
-    (fetchpatch {
-      url = https://github.com/Kozea/CairoSVG/commit/b2534b0fc80b9f24a2bff2c938ac5da73ff1e478.patch;
-      excludes = [ "test_non_regression/__init__.py" ];
-      sha256 = "1bms75dd0fd978yhlr0k565zq45lzxf0vkihryb7gcwnd42bl6yf";
-    })
-  ];
-
  propagatedBuildInputs = [ cairocffi cssselect2 defusedxml pillow tinycss2 ];

  checkInputs = [ pytest pytestrunner pytestcov pytest-flake8 pytest-isort ];
--- a/pkgs/development/python-modules/dict2xml/default.nix
+++ b/pkgs/development/python-modules/dict2xml/default.nix
@ -0,0 +1,20 @@
+{ lib, fetchPypi, buildPythonPackage, six }:
+
+buildPythonPackage rec {
+  pname = "dict2xml";
+  version = "1.6.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "17wsybqq0916i1yh7bpf2cmicldn7d0y2b9mzlgs503fkcpxda5w";
+  };
+
+  propagatedBuildInputs = [ six ];
+
+  meta = with lib; {
+    description = "Super simple library to convert a Python dictionary into an xml string";
+    homepage = "https://github.com/delfick/python-dict2xml";
+    license = licenses.mit;
+    maintainers = with maintainers; [ johnazoidberg ];
+  };
+}
--- a/pkgs/development/python-modules/dotnetcore2/default.nix
+++ b/pkgs/development/python-modules/dotnetcore2/default.nix
@ -0,0 +1,59 @@
+{ stdenv, lib, buildPythonPackage, fetchPypi, python, isPy27
+, dotnet-sdk
+, substituteAll
+, distro
+, unzip
+}:
+
+buildPythonPackage rec {
+  pname = "dotnetcore2";
+  version = "2.1.8.1";
+  format = "wheel";
+  disabled = isPy27;
+
+  src = fetchPypi {
+    inherit pname version format;
+    python = "py3";
+    platform = "manylinux1_x86_64";
+    sha256 = "13zrff5j767d3f8drl397sjhl28winsrfa8pa20svf00xfcsy34s";
+  };
+
+  nativeBuildInputs = [ unzip ];
+
+  propagatedBuildInputs = [ distro ];
+
+  # needed to apply patches
+  prePatch = ''
+    unzip dist/dotnet*
+  '';
+
+  patches = [
+    ( substituteAll {
+        src = ./runtime.patch;
+        dotnet = dotnet-sdk;
+      }
+    )
+  ];
+
+  # unfortunately the noraml pip install fails because the manylinux1 format check fails with NixOS
+  installPhase = ''
+    mkdir -p $out/${python.sitePackages}/${pname}
+    # copy metadata
+    cp -r dotnetcore2-2* $out/${python.sitePackages}
+    # copy non-dotnetcore related files
+    cp -r dotnetcore2/{__init__.py,runtime.py} $out/${python.sitePackages}/${pname}
+  '';
+
+  # no tests, ensure it's one useful function works
+  checkPhase = ''
+    ${python.interpreter} -c 'from dotnetcore2 import runtime; print(runtime.get_runtime_path())'
+  '';
+
+  meta = with lib; {
+    description = "DotNet Core runtime";
+    homepage = "https://github.com/dotnet/core";
+    license = licenses.mit;
+    platforms = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ jonringer ];
+  };
+}
--- a/pkgs/development/python-modules/dotnetcore2/runtime.patch
+++ b/pkgs/development/python-modules/dotnetcore2/runtime.patch
@ -0,0 +1,19 @@
+diff a/dotnetcore2/runtime.py b/dotnetcore2/runtime.py
+--- a/dotnetcore2/runtime.py
+++ b/dotnetcore2/runtime.py
+@@ -39,13 +39,13 @@ def _get_bin_folder() -> str:
+ 
+ 
+ def get_runtime_path():
+    return "@dotnet@/dotnet"
+     search_string = os.path.join(_get_bin_folder(), 'dotnet*')
+     matches = [f for f in glob.glob(search_string, recursive=True)]
+     return matches[0]
+ 
+ def ensure_dependencies() -> Optional[str]:
+-    if dist is None:
+-        return None
+    return None
+ 
+     bin_folder = _get_bin_folder()
+     deps_path = os.path.join(bin_folder, 'deps')
--- a/pkgs/development/python-modules/impacket/default.nix
+++ b/pkgs/development/python-modules/impacket/default.nix
@ -0,0 +1,24 @@
+{ lib, buildPythonPackage, fetchPypi, isPy3k }:
+
+buildPythonPackage rec {
+  pname = "impacket";
+  version = "0.9.15";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1sq1698g7wqj731h24f7gr4lc0fz0mxrqv6mm3j4hm2j6h3rrbr6";
+  };
+
+  disabled = isPy3k;
+
+  # no tests
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Network protocols Constructors and Dissectors";
+    homepage = "https://github.com/CoreSecurity/impacket";
+    # Modified Apache Software License, Version 1.1
+    license = licenses.free;
+    maintainers = with maintainers; [ peterhoeg ];
+  };
+}
--- a/pkgs/development/python-modules/pycountry/default.nix
+++ b/pkgs/development/python-modules/pycountry/default.nix
@ -6,11 +6,11 @@

 buildPythonPackage rec {
  pname = "pycountry";
-  version = "19.7.15";
+  version = "19.8.18";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "15lhv18za0zv36laksr86rszjhp0slmqzcylm6ds9vpd7gyqprb8";
+    sha256 = "1jxkdjffrhn0il0nm14dlzxpd6f3v1hbxzxsprcksafgmm0almrw";
  };

  meta = with stdenv.lib; {
--- a/pkgs/development/python-modules/pycurl2/default.nix
+++ b/pkgs/development/python-modules/pycurl2/default.nix
@ -1,6 +1,4 @@
-{ stdenv
-, buildPythonPackage
-, fetchgit
+{ lib, buildPythonPackage, fetchFromGitHub
 , isPy3k
 , simplejson
 , unittest2
@ -13,8 +11,9 @@ buildPythonPackage {
  version = "7.20.0";
  disabled = isPy3k;

-  src = fetchgit {
-    url = "https://github.com/Lispython/pycurl.git";
+  src = fetchFromGitHub {
+    owner = "Lispython";
+    repo = "pycurl";
    rev = "0f00109950b883d680bd85dc6e8a9c731a7d0d13";
    sha256 = "1qmw3cm93kxj94s71a8db9lwv2cxmr2wjv7kp1r8zildwdzhaw7j";
  };
@ -22,9 +21,10 @@ buildPythonPackage {
  # error: (6, "Couldn't resolve host 'h.wrttn.me'")
  doCheck = false;

-  buildInputs = [ pkgs.curl simplejson unittest2 nose ];
+  nativeBuildInputs = [ pkgs.curl.dev ];
+  buildInputs = [ simplejson unittest2 nose ];

-  meta = with stdenv.lib; {
+  meta = with lib; {
    homepage = https://pypi.python.org/pypi/pycurl2;
    description = "A fork from original PycURL library that no maintained from 7.19.0";
    license = licenses.mit;
--- a/pkgs/development/python-modules/qiskit/default.nix
+++ b/pkgs/development/python-modules/qiskit/default.nix
@ -59,5 +59,7 @@ buildPythonPackage rec {
    maintainers = with stdenv.lib.maintainers; [
      pandaman
    ];
+    # Needs to be updated and have its new dependencies added
+    broken = true;
  };
 }
--- a/pkgs/development/python-modules/weasyprint/default.nix
+++ b/pkgs/development/python-modules/weasyprint/default.nix
@ -23,11 +23,15 @@

 buildPythonPackage rec {
  pname = "weasyprint";
-  version = "47";
+  version = "50";
  disabled = !isPy3k;

-  # ignore failing pytest
-  checkPhase = "pytest -k 'not test_font_stretch'";
+  # excluded test needs the Ahem font
+  checkPhase = ''
+    runHook preCheck
+    pytest -k 'not test_font_stretch'
+    runHook postCheck
+  '';

  # ignore failing flake8-test
  prePatch = ''
@ -55,7 +59,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    inherit version;
    pname = "WeasyPrint";
-    sha256 = "0hd1zwrkfnj7g0jaaf6jvarlj6l5imar6ar78zxdgv17a3s3k3dg";
+    sha256 = "0invs96zvmcr6wh5klj52jrcnr9qg150v9wpmbhcsf3vv1d1hbcw";
  };

  meta = with stdenv.lib; {
--- a/pkgs/development/python-modules/xml2rfc/default.nix
+++ b/pkgs/development/python-modules/xml2rfc/default.nix
@ -1,15 +1,15 @@
 { lib, fetchPypi, buildPythonPackage, intervaltree, pyflakes, requests, lxml, google-i18n-address
-, pycountry, html5lib, six
+, pycountry, html5lib, six, kitchen, pypdf2, dict2xml, weasyprint
 , stdenv
 }:

 buildPythonPackage rec {
  pname = "xml2rfc";
-  version = "2.18.0";
+  version = "2.27.1";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "e192236798615f34479a9bb9f30df72ce0e5f319df75ecc0473d896713a17451";
+    sha256 = "00v5gsshy1rmjd334d2awh0mvri949lmyk8f02wfr20rq6fc3xqd";
  };

  propagatedBuildInputs = [
@ -21,13 +21,18 @@ buildPythonPackage rec {
    pycountry
    html5lib
    six
+    kitchen
+    pypdf2
+    dict2xml
+    weasyprint
  ];

  preCheck = ''
    export HOME=$(mktemp -d)
  '';

-  doCheck = !stdenv.isDarwin;
+  # lxml tries to fetch from the internet
+  doCheck = false;

  meta = with lib; {
    description = "Tool generating IETF RFCs and drafts from XML sources";
@ -35,6 +40,6 @@ buildPythonPackage rec {
    # Well, parts might be considered unfree, if being strict; see:
    # http://metadata.ftp-master.debian.org/changelogs/non-free/x/xml2rfc/xml2rfc_2.9.6-1_copyright
    license = licenses.bsd3;
-    maintainers = [ maintainers.vcunat ];
+    maintainers = with maintainers; [ vcunat yrashk ];
  };
 }
--- a/pkgs/development/tools/build-managers/apache-maven/default.nix
+++ b/pkgs/development/tools/build-managers/apache-maven/default.nix
@ -2,7 +2,7 @@

 assert jdk != null;

-let version = "3.6.1"; in
+let version = "3.6.2"; in
 stdenv.mkDerivation rec {
  pname = "apache-maven";
  inherit version;
@ -11,7 +11,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "mirror://apache/maven/maven-3/${version}/binaries/${pname}-${version}-bin.tar.gz";
-    sha256 = "1rv97g9qr6sifl88rxbsqnz5i79m6ifs36srri08j3y3k5dc6a15";
+    sha256 = "1p6z6bmjfzda8kxy73jjg03yfkbssbb3vgvzspxxd0hljv8r5g1z";
  };

  buildInputs = [ makeWrapper ];
--- a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
@ -1,16 +1,16 @@
 { lib, buildGoPackage, fetchFromGitLab, fetchurl }:

 let
-  version = "12.2.0";
+  version = "12.3.0";
  # Gitlab runner embeds some docker images these are prebuilt for arm and x86_64
  docker_x86_64 = fetchurl {
    url = "https://gitlab-runner-downloads.s3.amazonaws.com/v${version}/helper-images/prebuilt-x86_64.tar.xz";
-    sha256 = "0r0jy571dxcspsl0q31wyw4017rfq7i4rxsgf83jqdjqaigas8dk";
+    sha256 = "11xbz24811vi3l1dwhyqv3mypawrky85qjsg6aaigfv8zj9l2xmi";
  };

  docker_arm = fetchurl {
    url = "https://gitlab-runner-downloads.s3.amazonaws.com/v${version}/helper-images/prebuilt-arm.tar.xz";
-    sha256 = "1pbzyfvfgwp9r67a148nr4gh2p9lrmnn4hxap37abb5q5209pjir";
+    sha256 = "04gfhlm32wrdq0s9blmfknpcnmr30vrnd7afib1lfbzbdl99g4sx";
  };
 in
 buildGoPackage rec {
@ -29,7 +29,7 @@ buildGoPackage rec {
    owner = "gitlab-org";
    repo = "gitlab-runner";
    rev = "v${version}";
-    sha256 = "0id0ivysn0396dwi357iig28d4xr2wd7q05r6ksgml8xyfijdgd3";
+    sha256 = "155im9sybkldh0rx34j9fm3qg95dm5q3jcjjx635b7fwq1wyl7c7";
  };

  patches = [ ./fix-shell-path.patch ];
--- a/pkgs/development/tools/ocaml/camlp5/default.nix
+++ b/pkgs/development/tools/ocaml/camlp5/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation {

-  name = "camlp5-7.08";
+  name = "camlp5-7.10";

  src = fetchzip {
-    url = "https://github.com/camlp5/camlp5/archive/rel708.tar.gz";
-    sha256 = "0b39bvr1aa7kzjhbyycmvcrwil2yjbxc84cb43zfzahx4p2aqr76";
+    url = "https://github.com/camlp5/camlp5/archive/rel710.tar.gz";
+    sha256 = "1a1lgsc8350afdwmsznsys7m0c0cks4nw6irqz2f92g8g4vkk9b7";
  };

  buildInputs = [ ocaml ];
--- a/pkgs/development/tools/ocaml/ocamlformat/default.nix
+++ b/pkgs/development/tools/ocaml/ocamlformat/default.nix
@ -1,35 +1,33 @@
-{ stdenv, fetchFromGitHub, ocamlPackages }:
+{ lib, fetchFromGitHub, ocamlPackages }:

 with ocamlPackages; buildDunePackage rec {
  pname = "ocamlformat";
-  version = "0.8";
+  version = "0.11.0";

-  minimumOCamlVersion = "4.05";
+  minimumOCamlVersion = "4.06";

  src = fetchFromGitHub {
    owner = "ocaml-ppx";
    repo = pname;
    rev = version;
-    sha256 = "1i7rsbs00p43362yv7z7dw0qsnv7vjf630qk676qvfg7kg422w6j";
+    sha256 = "0zvjn71jd4d3znnpgh0yphb2w8ggs457b6bl6cg1fmpdgxnds6yx";
  };

  buildInputs = [
-    base
    cmdliner
    fpath
    ocaml-migrate-parsetree
+    odoc
+    re
    stdio
+    uuseg
+    uutf
  ];

-  configurePhase = ''
-    patchShebangs tools/gen_version.sh
-    tools/gen_version.sh src/Version.ml version
-  '';
-
  meta = {
    inherit (src.meta) homepage;
    description = "Auto-formatter for OCaml code";
-    maintainers = [ stdenv.lib.maintainers.Zimmi48 ];
-    license = stdenv.lib.licenses.mit;
+    maintainers = [ lib.maintainers.Zimmi48 ];
+    license = lib.licenses.mit;
  };
 }
--- a/pkgs/games/dxx-rebirth/default.nix
+++ b/pkgs/games/dxx-rebirth/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchpatch, scons, pkgconfig
+{ gcc6Stdenv, fetchurl, fetchpatch, scons, pkgconfig
 , SDL, SDL_mixer, libGLU_combined, physfs
 }:

@ -8,7 +8,7 @@ let
    sha256 = "05mz77vml396mff43dbs50524rlm4fyds6widypagfbh5hc55qdc";
  };

-in stdenv.mkDerivation rec {
+in gcc6Stdenv.mkDerivation rec {
  pname = "dxx-rebirth";
  version = "0.59.100";

@ -44,9 +44,9 @@ in stdenv.mkDerivation rec {
    install -Dm644 -t $out/share/doc/dxx-rebirth *.txt
  '';

-  meta = with stdenv.lib; {
+  meta = with gcc6Stdenv.lib; {
    description = "Source Port of the Descent 1 and 2 engines";
-    homepage = https://www.dxx-rebirth.com/;
+    homepage = "https://www.dxx-rebirth.com/";
    license = licenses.free;
    maintainers = with maintainers; [ peterhoeg ];
    platforms = with platforms; linux;
--- a/pkgs/misc/gnuk/default.nix
+++ b/pkgs/misc/gnuk/default.nix
@ -1,11 +1,11 @@
 { callPackage, fetchgit, ... } @ args:

 callPackage ./generic.nix (args // {
-  version = "1.0.4";
+  version = "1.2.14";

  src = fetchgit {
    url = "git://git.gniibe.org/gnuk/gnuk.git";
-    rev = "93867d0c8b90c485f9832c0047c3a2e17a029aca";
-    sha256 = "0ah2gc772kdq7gdwpqwdmfh5nzbx2wgpk5ljnhwc4i3mrkafdiih";
+    rev = "177ef67edfa2306c2a369a037362385c354083e1";
+    sha256 = "16wa3xsaq4r8caw6c24hnv4j78bklacix4in2y66j35h68ggr3j1";
  };
 })
--- a/pkgs/misc/vim-plugins/generated.nix
+++ b/pkgs/misc/vim-plugins/generated.nix
@ -2003,6 +2003,17 @@ let
    };
  };

+  plantuml-syntax = buildVimPluginFrom2Nix {
+    pname = "plantuml-syntax";
+    version = "2019-07-18";
+    src = fetchFromGitHub {
+      owner = "aklt";
+      repo = "plantuml-syntax";
+      rev = "0024021f01c349c2828aeb50a1e131997adea066";
+      sha256 = "1abqpbgz0d0ik4w5frha62i0s3f2w5xsgfa34c0jbwzzq0fkvkk7";
+    };
+  };
+
  pony-vim-syntax = buildVimPluginFrom2Nix {
    pname = "pony-vim-syntax";
    version = "2017-09-26";
--- a/pkgs/misc/vim-plugins/vim-plugin-names
+++ b/pkgs/misc/vim-plugins/vim-plugin-names
@ -2,6 +2,7 @@
 airblade/vim-gitgutter
 airblade/vim-rooter
 ajh17/Spacegray.vim
+aklt/plantuml-syntax
 albfan/nerdtree-git-plugin
 altercation/vim-colors-solarized
 alvan/vim-closetag
--- a/pkgs/os-specific/linux/hyperv-daemons/default.nix
+++ b/pkgs/os-specific/linux/hyperv-daemons/default.nix
@ -1,7 +1,10 @@
-{ stdenv, lib, python, kernel, makeWrapper, writeText }:
+{ stdenv, lib, python, kernel, makeWrapper, writeText
+, gawk, iproute }:

 let
-  daemons = stdenv.mkDerivation {
+  libexec = "libexec/hypervkvpd";
+
+  daemons = stdenv.mkDerivation rec {
    pname = "hyperv-daemons-bin";
    inherit (kernel) src version;

@ -10,10 +13,15 @@ let
    # as of 4.9 compilation will fail due to -Werror=format-security
    hardeningDisable = [ "format" ];

-    preConfigure = ''
+    postPatch = ''
      cd tools/hv
+      substituteInPlace hv_kvp_daemon.c \
+        --replace /usr/libexec/hypervkvpd/ $out/${libexec}/
    '';

+    # We don't actually need the hv_get_{dhcp,dns}_info scripts on NixOS in
+    # their current incarnation but with them in place, we stop the spam of
+    # errors in the log.
    installPhase = ''
      runHook preInstall

@ -21,7 +29,9 @@ let
        install -Dm755 hv_''${f}_daemon -t $out/bin
      done

-      install -Dm755 hv_get_dns_info.sh lsvmbus -t $out/bin
+      install -Dm755 lsvmbus             $out/bin/lsvmbus
+      install -Dm755 hv_get_dhcp_info.sh $out/${libexec}/hv_get_dhcp_info
+      install -Dm755 hv_get_dns_info.sh  $out/${libexec}/hv_get_dns_info

      # I don't know why this isn't being handled automatically by fixupPhase
      substituteInPlace $out/bin/lsvmbus \
@ -31,8 +41,8 @@ let
    '';

    postFixup = ''
-      # kvp needs to be able to find the script(s)
-      wrapProgram $out/bin/hv_kvp_daemon --prefix PATH : $out/bin
+      wrapProgram $out/bin/hv_kvp_daemon \
+        --prefix PATH : $out/bin:${lib.makeBinPath [ gawk iproute ]}
    '';
  };

@ -56,24 +66,19 @@ let

 in stdenv.mkDerivation {
  pname = "hyperv-daemons";
-
  inherit (kernel) version;

  # we just stick the bins into out as well as it requires "out"
  outputs = [ "bin" "lib" "out" ];

-  phases = [ "installPhase" ];
-
  buildInputs = [ daemons ];

-  installPhase = ''
+  buildCommand = ''
    system=$lib/lib/systemd/system

-    mkdir -p $system
-
-    cp ${service "fcopy" "file copy (FCOPY)" "hv_fcopy" } $system/hv-fcopy.service
-    cp ${service "kvp"   "key-value pair (KVP)"     ""  } $system/hv-kvp.service
-    cp ${service "vss"   "volume shadow copy (VSS)" ""  } $system/hv-vss.service
+    install -Dm444 ${service "fcopy" "file copy (FCOPY)" "hv_fcopy" } $system/hv-fcopy.service
+    install -Dm444 ${service "kvp"   "key-value pair (KVP)"     ""  } $system/hv-kvp.service
+    install -Dm444 ${service "vss"   "volume shadow copy (VSS)" ""  } $system/hv-vss.service

    cat > $system/hyperv-daemons.target <<EOF
    [Unit]
@ -102,7 +107,7 @@ in stdenv.mkDerivation {
      Microsoft calls their guest agents "Integration Services" which is why
      we use that name here.
    '';
-    homepage = https://kernel.org;
+    homepage = "https://kernel.org";
    maintainers = with maintainers; [ peterhoeg ];
    platforms = kernel.meta.platforms;
  };
--- a/pkgs/os-specific/linux/jool/source.nix
+++ b/pkgs/os-specific/linux/jool/source.nix
@ -1,11 +1,11 @@
 { fetchFromGitHub }:

 rec {
-  version = "4.0.0";
+  version = "4.0.5";
  src = fetchFromGitHub {
    owner = "NICMx";
    repo = "Jool";
    rev = "v${version}";
-    sha256 = "1ivnx7ijqf41kxmi2bmsf9qfcv6b1rvag35754ddlndry3sgvimr";
+    sha256 = "0zfda8mbcg4mgg39shxdx5n2bq6zi9w3v8bcx03b3dp09lmq45y3";
  };
 }
--- a/pkgs/os-specific/linux/ply/default.nix
+++ b/pkgs/os-specific/linux/ply/default.nix
@ -1,4 +1,4 @@
-{ stdenv, kernel, fetchFromGitHub, autoreconfHook, yacc, flex, p7zip }:
+{ stdenv, kernel, fetchFromGitHub, autoreconfHook, yacc, flex, p7zip, rsync }:

 assert kernel != null -> stdenv.lib.versionAtLeast kernel.version "4.0";

@ -7,7 +7,7 @@ let
 in stdenv.mkDerivation {
  pname = "ply";
  inherit version;
-  nativeBuildInputs = [ autoreconfHook flex yacc p7zip ];
+  nativeBuildInputs = [ autoreconfHook flex yacc p7zip rsync ];

  src = fetchFromGitHub {
    owner = "iovisor";
--- a/pkgs/os-specific/linux/r8168/default.nix
+++ b/pkgs/os-specific/linux/r8168/default.nix
@ -6,7 +6,7 @@ let modDestDir = "$out/lib/modules/${kernel.modDirVersion}/kernel/drivers/net/wi
 in stdenv.mkDerivation rec {
  name = "r8168-${kernel.version}-${version}";
  # on update please verify that the source matches the realtek version
-  version = "8.046.00";
+  version = "8.047.04";

  # This is a mirror. The original website[1] doesn't allow non-interactive
  # downloads, instead emailing you a download link.
@ -17,7 +17,7 @@ in stdenv.mkDerivation rec {
    owner = "mtorromeo";
    repo = "r8168";
    rev = version;
-    sha256 = "0y8w3biw5mshn5bvl24b9rybfh67f1s9gfzkcv9p4m7s7nchj2dg";
+    sha256 = "1rni8jimwdhyx75603mdcylrdxgfwfpyprf1lf5x5cli2i4bbijg";
  };

  hardeningDisable = [ "pic" ];
--- a/pkgs/servers/dns/knot-dns/default.nix
+++ b/pkgs/servers/dns/knot-dns/default.nix
@ -7,11 +7,11 @@ let inherit (stdenv.lib) optional optionals; in
 # Note: ATM only the libraries have been tested in nixpkgs.
 stdenv.mkDerivation rec {
  pname = "knot-dns";
-  version = "2.8.3";
+  version = "2.8.4";

  src = fetchurl {
    url = "https://secure.nic.cz/files/knot-dns/knot-${version}.tar.xz";
-    sha256 = "8a62d81e5cf3df938f469b60ed4e46d9161007c2b89fbf7ae07525fa68368bad";
+    sha256 = "541e7e43503765c91405c5797b3838103bb656154712e69b3f959c6ab0e700a9";
  };

  outputs = [ "bin" "out" "dev" ];
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@ -2,7 +2,7 @@
 # Do not edit!

 {
-  version = "0.96.2";
+  version = "0.99.2";
  components = {
    "abode" = ps: with ps; [  ];
    "acer_projector" = ps: with ps; [ pyserial ];
@ -28,6 +28,7 @@
    "androidtv" = ps: with ps; [  ];
    "anel_pwrctrl" = ps: with ps; [  ];
    "anthemav" = ps: with ps; [  ];
+    "apache_kafka" = ps: with ps; [  ];
    "apcupsd" = ps: with ps; [  ];
    "api" = ps: with ps; [ aiohttp-cors ];
    "apns" = ps: with ps; [  ];
@ -44,12 +45,14 @@
    "asterisk_cdr" = ps: with ps; [  ];
    "asterisk_mbox" = ps: with ps; [  ];
    "asuswrt" = ps: with ps; [  ];
+    "atome" = ps: with ps; [  ];
    "august" = ps: with ps; [  ];
    "aurora" = ps: with ps; [  ];
    "aurora_abb_powerone" = ps: with ps; [  ];
    "auth" = ps: with ps; [ aiohttp-cors ];
    "automatic" = ps: with ps; [ aiohttp-cors ];
    "automation" = ps: with ps; [ aiohttp-cors ];
+    "avea" = ps: with ps; [  ];
    "avion" = ps: with ps; [  ];
    "awair" = ps: with ps; [  ];
    "aws" = ps: with ps; [  ];
@ -59,6 +62,7 @@
    "bayesian" = ps: with ps; [  ];
    "bbb_gpio" = ps: with ps; [  ];
    "bbox" = ps: with ps; [  ];
+    "beewi_smartclim" = ps: with ps; [  ];
    "bh1750" = ps: with ps; [  ];
    "binary_sensor" = ps: with ps; [  ];
    "bitcoin" = ps: with ps; [  ];
@ -131,6 +135,7 @@
    "decora" = ps: with ps; [  ];
    "decora_wifi" = ps: with ps; [  ];
    "default_config" = ps: with ps; [ pynacl aiohttp-cors distro netdisco sqlalchemy zeroconf ];
+    "delijn" = ps: with ps; [  ];
    "deluge" = ps: with ps; [ deluge-client ];
    "demo" = ps: with ps; [ aiohttp-cors ];
    "denon" = ps: with ps; [  ];
@ -173,7 +178,6 @@
    "ecovacs" = ps: with ps; [  ];
    "eddystone_temperature" = ps: with ps; [ construct ];
    "edimax" = ps: with ps; [  ];
-    "edp_redy" = ps: with ps; [  ];
    "ee_brightbox" = ps: with ps; [  ];
    "efergy" = ps: with ps; [  ];
    "egardia" = ps: with ps; [  ];
@ -222,6 +226,7 @@
    "fints" = ps: with ps; [ fints ];
    "fitbit" = ps: with ps; [ aiohttp-cors fitbit ];
    "fixer" = ps: with ps; [  ];
+    "fleetgo" = ps: with ps; [  ];
    "flexit" = ps: with ps; [  ];
    "flic" = ps: with ps; [  ];
    "flock" = ps: with ps; [  ];
@ -231,6 +236,8 @@
    "folder" = ps: with ps; [  ];
    "folder_watcher" = ps: with ps; [ watchdog ];
    "foobot" = ps: with ps; [  ];
+    "fortigate" = ps: with ps; [  ];
+    "fortios" = ps: with ps; [  ];
    "foscam" = ps: with ps; [  ];
    "foursquare" = ps: with ps; [ aiohttp-cors ];
    "free_mobile" = ps: with ps; [  ];
@ -256,6 +263,7 @@
    "geo_location" = ps: with ps; [  ];
    "geo_rss_events" = ps: with ps; [  ];
    "geofency" = ps: with ps; [ aiohttp-cors ];
+    "geonetnz_quakes" = ps: with ps; [  ];
    "github" = ps: with ps; [ PyGithub ];
    "gitlab_ci" = ps: with ps; [ python-gitlab ];
    "gitter" = ps: with ps; [  ];
@ -272,7 +280,6 @@
    "google_translate" = ps: with ps; [ gtts-token ];
    "google_travel_time" = ps: with ps; [  ];
    "google_wifi" = ps: with ps; [  ];
-    "googlehome" = ps: with ps; [  ];
    "gpmdp" = ps: with ps; [ websocket_client ];
    "gpsd" = ps: with ps; [  ];
    "gpslogger" = ps: with ps; [ aiohttp-cors ];
@ -280,6 +287,7 @@
    "greeneye_monitor" = ps: with ps; [  ];
    "greenwave" = ps: with ps; [  ];
    "group" = ps: with ps; [  ];
+    "growatt_server" = ps: with ps; [  ];
    "gstreamer" = ps: with ps; [  ];
    "gtfs" = ps: with ps; [  ];
    "gtt" = ps: with ps; [  ];
@ -323,6 +331,7 @@
    "hydroquebec" = ps: with ps; [  ];
    "hyperion" = ps: with ps; [  ];
    "ialarm" = ps: with ps; [  ];
+    "iaqualink" = ps: with ps; [  ];
    "icloud" = ps: with ps; [  ];
    "idteck_prox" = ps: with ps; [  ];
    "ifttt" = ps: with ps; [ aiohttp-cors pyfttt ];
@ -357,6 +366,7 @@
    "joaoapps_join" = ps: with ps; [  ];
    "juicenet" = ps: with ps; [  ];
    "kankun" = ps: with ps; [  ];
+    "keba" = ps: with ps; [  ];
    "keenetic_ndms2" = ps: with ps; [  ];
    "keyboard" = ps: with ps; [  ];
    "keyboard_remote" = ps: with ps; [ evdev ];
@ -402,7 +412,7 @@
    "london_underground" = ps: with ps; [  ];
    "loopenergy" = ps: with ps; [  ];
    "lovelace" = ps: with ps; [  ];
-    "luci" = ps: with ps; [  ];
+    "luci" = ps: with ps; [ packaging ];
    "luftdaten" = ps: with ps; [ luftdaten ];
    "lupusec" = ps: with ps; [  ];
    "lutron" = ps: with ps; [  ];
@ -440,6 +450,7 @@
    "mikrotik" = ps: with ps; [  ];
    "mill" = ps: with ps; [  ];
    "min_max" = ps: with ps; [  ];
+    "minio" = ps: with ps; [ minio ];
    "mitemp_bt" = ps: with ps; [  ];
    "mjpeg" = ps: with ps; [  ];
    "mobile_app" = ps: with ps; [ pynacl aiohttp-cors ];
@ -497,9 +508,11 @@
    "nuimo_controller" = ps: with ps; [  ];
    "nuki" = ps: with ps; [  ];
    "nut" = ps: with ps; [  ];
+    "nws" = ps: with ps; [  ];
    "nx584" = ps: with ps; [  ];
    "nzbget" = ps: with ps; [  ];
    "oasa_telematics" = ps: with ps; [  ];
+    "obihai" = ps: with ps; [  ];
    "octoprint" = ps: with ps; [  ];
    "oem" = ps: with ps; [  ];
    "ohmconnect" = ps: with ps; [ defusedxml ];
@ -546,6 +559,7 @@
    "plaato" = ps: with ps; [ aiohttp-cors ];
    "plant" = ps: with ps; [  ];
    "plex" = ps: with ps; [  ];
+    "plugwise" = ps: with ps; [  ];
    "plum_lightpad" = ps: with ps; [  ];
    "pocketcasts" = ps: with ps; [  ];
    "point" = ps: with ps; [ aiohttp-cors ];
@ -578,6 +592,7 @@
    "radiotherm" = ps: with ps; [  ];
    "rainbird" = ps: with ps; [  ];
    "raincloud" = ps: with ps; [  ];
+    "rainforest_eagle" = ps: with ps; [  ];
    "rainmachine" = ps: with ps; [  ];
    "random" = ps: with ps; [  ];
    "raspihats" = ps: with ps; [  ];
@ -597,7 +612,6 @@
    "rfxtrx" = ps: with ps; [  ];
    "ring" = ps: with ps; [ ha-ffmpeg ];
    "ripple" = ps: with ps; [  ];
-    "ritassist" = ps: with ps; [  ];
    "rmvtransport" = ps: with ps; [  ];
    "rocketchat" = ps: with ps; [  ];
    "roku" = ps: with ps; [  ];
@ -613,7 +627,6 @@
    "rtorrent" = ps: with ps; [  ];
    "russound_rio" = ps: with ps; [  ];
    "russound_rnet" = ps: with ps; [  ];
-    "ruter" = ps: with ps; [  ];
    "sabnzbd" = ps: with ps; [  ];
    "samsungtv" = ps: with ps; [ wakeonlan ];
    "satel_integra" = ps: with ps; [  ];
@ -647,6 +660,7 @@
    "skybell" = ps: with ps; [  ];
    "slack" = ps: with ps; [  ];
    "sleepiq" = ps: with ps; [  ];
+    "slide" = ps: with ps; [  ];
    "sma" = ps: with ps; [  ];
    "smappee" = ps: with ps; [  ];
    "smarthab" = ps: with ps; [  ];
@ -689,6 +703,7 @@
    "stream" = ps: with ps; [ aiohttp-cors av ];
    "streamlabswater" = ps: with ps; [  ];
    "stride" = ps: with ps; [  ];
+    "suez_water" = ps: with ps; [  ];
    "sun" = ps: with ps; [  ];
    "supervisord" = ps: with ps; [  ];
    "supla" = ps: with ps; [  ];
@ -724,7 +739,7 @@
    "telnet" = ps: with ps; [  ];
    "temper" = ps: with ps; [  ];
    "template" = ps: with ps; [  ];
-    "tensorflow" = ps: with ps; [ numpy pillow protobuf ];
+    "tensorflow" = ps: with ps; [ numpy pillow protobuf tensorflow ];
    "tesla" = ps: with ps; [  ];
    "tfiac" = ps: with ps; [  ];
    "thermoworks_smoke" = ps: with ps; [ stringcase ];
@ -748,7 +763,7 @@
    "touchline" = ps: with ps; [  ];
    "tplink" = ps: with ps; [  ];
    "tplink_lte" = ps: with ps; [  ];
-    "traccar" = ps: with ps; [ stringcase ];
+    "traccar" = ps: with ps; [ aiohttp-cors stringcase ];
    "trackr" = ps: with ps; [  ];
    "tradfri" = ps: with ps; [  ];
    "trafikverket_train" = ps: with ps; [  ];
@ -759,6 +774,7 @@
    "trend" = ps: with ps; [ numpy ];
    "tts" = ps: with ps; [ aiohttp-cors mutagen ];
    "tuya" = ps: with ps; [  ];
+    "twentemilieu" = ps: with ps; [  ];
    "twilio" = ps: with ps; [ aiohttp-cors twilio ];
    "twilio_call" = ps: with ps; [ aiohttp-cors twilio ];
    "twilio_sms" = ps: with ps; [ aiohttp-cors twilio ];
@ -771,7 +787,7 @@
    "unifi" = ps: with ps; [ aiounifi ];
    "unifi_direct" = ps: with ps; [ pexpect ];
    "universal" = ps: with ps; [  ];
-    "upc_connect" = ps: with ps; [ defusedxml ];
+    "upc_connect" = ps: with ps; [  ];
    "upcloud" = ps: with ps; [  ];
    "updater" = ps: with ps; [ distro ];
    "upnp" = ps: with ps; [  ];
@ -794,6 +810,8 @@
    "version" = ps: with ps; [  ];
    "vesync" = ps: with ps; [  ];
    "viaggiatreno" = ps: with ps; [  ];
+    "vicare" = ps: with ps; [  ];
+    "vivotek" = ps: with ps; [  ];
    "vizio" = ps: with ps; [  ];
    "vlc" = ps: with ps; [  ];
    "vlc_telnet" = ps: with ps; [  ];
@ -819,6 +837,7 @@
    "whois" = ps: with ps; [  ];
    "wink" = ps: with ps; [  ];
    "wirelesstag" = ps: with ps; [  ];
+    "withings" = ps: with ps; [ aiohttp-cors ];
    "workday" = ps: with ps; [  ];
    "worldclock" = ps: with ps; [  ];
    "worldtidesinfo" = ps: with ps; [  ];
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@ -98,7 +98,7 @@ let
  extraBuildInputs = extraPackages py.pkgs;

  # Don't forget to run parse-requirements.py after updating
-  hassVersion = "0.96.2";
+  hassVersion = "0.99.2";

 in with py.pkgs; buildPythonApplication rec {
  pname = "homeassistant";
--- a/pkgs/servers/home-assistant/parse-requirements.py
+++ b/pkgs/servers/home-assistant/parse-requirements.py
@ -33,7 +33,9 @@ PKG_SET = 'python3Packages'
 # the following can be used to choose one of them
 PKG_PREFERENCES = {
    # Use python3Packages.youtube-dl-light instead of python3Packages.youtube-dl
-    'youtube-dl': 'youtube-dl-light'
+    'youtube-dl': 'youtube-dl-light',
+    'tensorflow-bin': 'tensorflow',
+    'tensorflowWithoutCuda': 'tensorflow'
 }

 def get_version():
--- a/pkgs/servers/monitoring/plugins/openvpn.nix
+++ b/pkgs/servers/monitoring/plugins/openvpn.nix
@ -0,0 +1,22 @@
+{ lib, fetchFromGitHub, python3Packages }:
+
+python3Packages.buildPythonApplication rec {
+  pname = "check-openvpn";
+  version = "0.0.1";
+
+  src = fetchFromGitHub {
+    owner = "liquidat";
+    repo = "nagios-icinga-openvpn";
+    rev = version;
+    sha256 = "1vz3p7nckc5k5f06nm1xfzpykhyndh2dzyagmifrzg5k478p1lpm";
+  };
+
+  # no tests
+  doCheck = false;
+
+  meta = with lib; {
+    description = "A nagios/icinga/sensu check plugin for OpenVPN";
+    license = licenses.mit;
+    maintainers = with maintainers; [ peterhoeg ];
+  };
+}
--- a/pkgs/servers/monitoring/plugins/wmiplus/default.nix
+++ b/pkgs/servers/monitoring/plugins/wmiplus/default.nix
@ -0,0 +1,77 @@
+{ stdenv, fetchFromGitHub, makeWrapper, perlPackages, txt2man
+, monitoring-plugins
+, wmic-bin ? null }:
+
+stdenv.mkDerivation rec {
+  pname = "check-wmiplus";
+  version = "1.64";
+
+  # We fetch from github.com instead of the proper upstream as nix-build errors
+  # out with 406 when trying to fetch the sources
+  src = fetchFromGitHub {
+    owner = "speartail";
+    repo = "checkwmiplus";
+    rev = "v${version}";
+    sha256 = "1m36rd2wnc5dk4mm9q4ch67w19144dl112p9s6lhc1sh6h25ln6r";
+  };
+
+  patches = [
+    ./wmiplus_fix_manpage.patch
+  ];
+
+  propagatedBuildInputs = with perlPackages; [
+    BHooksEndOfScope ClassDataInheritable ClassInspector ClassSingleton
+    ConfigIniFiles DateTime DateTimeLocale DateTimeTimeZone DevelStackTrace
+    EvalClosure ExceptionClass FileShareDir ModuleImplementation ModuleRuntime
+    MROCompat namespaceautoclean namespaceclean NumberFormat PackageStash
+    ParamsValidate ParamsValidationCompiler RoleTiny Specio
+    SubExporterProgressive SubIdentify TryTiny
+  ];
+
+  nativeBuildInputs = [ makeWrapper txt2man ];
+
+  dontConfigure = true;
+  dontBuild = true;
+  doCheck = false; # no checks
+
+  postPatch = ''
+    substituteInPlace check_wmi_plus.pl \
+      --replace /usr/bin/wmic                      ${wmic-bin}/bin/wmic \
+      --replace /etc/check_wmi_plus                $out/etc/check_wmi_plus \
+      --replace /opt/nagios/bin/plugins            $out/etc/check_wmi_plus \
+      --replace /usr/lib/nagios/plugins            ${monitoring-plugins}/libexec \
+      --replace '$base_dir/check_wmi_plus_help.pl' "$out/bin/check_wmi_plus_help.pl"
+
+    for f in *.pl ; do
+      substituteInPlace $f --replace /usr/bin/perl ${perlPackages.perl}/bin/perl
+    done
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 -t $out/bin *.pl
+    install -Dm644 -t $out/share/doc/${pname} *.txt
+    cp -r etc $out/
+
+    runHook postInstall
+  '';
+
+  # 1. we need to wait until the main binary has been fixed up with proper perl paths before we can run it to generate the man page
+  # 2. txt2man returns exit code 3 even if it works, so we add the || true bit
+  postFixup = ''
+    wrapProgram $out/bin/check_wmi_plus.pl \
+      --set PERL5LIB "${perlPackages.makePerlPath propagatedBuildInputs}"
+
+    mkdir -p $out/share/man/man1
+    $out/bin/check_wmi_plus.pl --help | txt2man -d 1970-01-01 -s 1 -t check_wmi_plus -r "Check WMI Plus ${version}" > $out/share/man/man1/check_wmi_plus.1 || true
+    gzip $out/share/man/man1/check_wmi_plus.1
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A sensu/nagios plugin using WMI to query Windows hosts";
+    homepage = "http://edcint.co.nz/checkwmiplus";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ peterhoeg ];
+  };
+}
--- a/pkgs/servers/monitoring/plugins/wmiplus/wmiplus_fix_manpage.patch
+++ b/pkgs/servers/monitoring/plugins/wmiplus/wmiplus_fix_manpage.patch
@ -0,0 +1,40 @@
+diff --git a/check_wmi_plus.makeman.sh b/check_wmi_plus.makeman.sh
+index 38dc7a4..3fe4369 100755
+--- a/check_wmi_plus.makeman.sh
+++ b/check_wmi_plus.makeman.sh
+@@ -19,15 +19,6 @@ mkdir -p "$manpage_dir/man1"
+ # the full path to the manpage file
+ manfile="$manpage_dir/man1/check_wmi_plus.1"
+ 
+-# if we are not running in a terminal then only show the text-based help
+-if [ ! -t 0 ]; then
+-   # we are not running in a terminal
+-   echo "Not running in a terminal - showing text-based help"
+-   echo
+-   exec $check_wmi_plus_text_help
+-fi
+-
+-
+ usage()
+ {
+ cat << EOT
+diff --git a/check_wmi_plus_help.pl b/check_wmi_plus_help.pl
+index 3440db2..2982da2 100755
+--- a/check_wmi_plus_help.pl
+++ b/check_wmi_plus_help.pl
+@@ -24,7 +24,7 @@ if ($opt_help) {
+       # we have the script to make the manpage and have not been asked to show text only help
+       exec ("$make_manpage_script \"$0 --itexthelp\" \"$manpage_dir\"") or print STDERR "couldn't exec $make_manpage_script: $!";
+    } else {
+-      print "Warning: Can not access/execute Manpage script ($make_manpage_script).\nShowing help in text-only format.\n\n";
+     # print "Warning: Can not access/execute Manpage script ($make_manpage_script).\nShowing help in text-only format.\n\n";
+    }
+ }
+ 
+@@ -692,4 +692,4 @@ show_ini_help_overview(1);
+ finish_program($ERRORS{'UNKNOWN'});
+ }
+ 
+-1;
+\ No newline at end of file
+1;
--- a/pkgs/servers/monitoring/prometheus/wireguard-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/wireguard-exporter.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "wireguard-exporter";
-  version = "3.0.1";
+  version = "3.1.0";

  src = fetchFromGitHub {
    owner = "MindFlavor";
    repo = "prometheus_wireguard_exporter";
    rev = version;
-    sha256 = "0wfv54ny557mjajjdf0lyq5sbf9m7y50ggm7s2v30c639i0swyrc";
+    sha256 = "0hl82cg6cijk3xf35cgi4v14gmxk3fj4c3z1x5hrs2i0j1i26ilw";
  };

-  cargoSha256 = "06s9194lvwd7lynxnsrjfbjfj87ngvjbqjhx3idf7d1w9mgi4ysw";
+  cargoSha256 = "1ndb33bi08j40b4jkj4q7d3k0cw5fscz2gc2cc3134nbs2r7jamk";

  buildInputs = lib.optional stdenv.isDarwin Security;

--- a/pkgs/tools/filesystems/xtreemfs/default.nix
+++ b/pkgs/tools/filesystems/xtreemfs/default.nix
@ -66,5 +66,6 @@ stdenv.mkDerivation {
    maintainers = with lib.maintainers; [ raskin matejc ];
    platforms = lib.platforms.linux;
    license = lib.licenses.bsd3;
+    broken = true;  # does not support openssl 1.1
  };
 }
--- a/pkgs/tools/misc/goaccess/default.nix
+++ b/pkgs/tools/misc/goaccess/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, geoipWithDatabase, ncurses, glib }:
+{ stdenv, fetchurl, pkgconfig, ncurses, glib, libmaxminddb }:

 stdenv.mkDerivation rec {
  version = "1.3";
@ -10,13 +10,13 @@ stdenv.mkDerivation rec {
  };

  configureFlags = [
-    "--enable-geoip"
+    "--enable-geoip=mmdb"
    "--enable-utf8"
  ];

  nativeBuildInputs = [ pkgconfig ];
  buildInputs = [
-    geoipWithDatabase
+    libmaxminddb
    ncurses
    glib
  ];
--- a/pkgs/tools/misc/graylog/default.nix
+++ b/pkgs/tools/misc/graylog/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "graylog";
-  version = "3.1.0";
+  version = "3.1.2";

  src = fetchurl {
    url = "https://packages.graylog2.org/releases/graylog/graylog-${version}.tgz";
-    sha256 = "0zv64cnd5nrn2hgbjmcwjam8dx5y2a7gz5x7xb9kr134132dm0yd";
+    sha256 = "14zr1aln34j5wifhg6ak3f83l959vic8i11jr90ibmnxl5v4hcqp";
  };

  dontBuild = true;
--- a/pkgs/tools/misc/graylog/plugins.nix
+++ b/pkgs/tools/misc/graylog/plugins.nix
@ -38,10 +38,10 @@ in {
  auth_sso = glPlugin rec {
    name = "graylog-auth-sso-${version}";
    pluginName = "graylog-plugin-auth-sso";
-    version = "3.0.0";
+    version = "3.1.0";
    src = fetchurl {
      url = "https://github.com/Graylog2/${pluginName}/releases/download/${version}/${pluginName}-${version}.jar";
-      sha256 = "09y1s71mk8fm6lsghla7mrh9z5y230r8zpv84klhavh2dacs8gq5";
+      sha256 = "0hwgpq1j3qk0j1zgap5f1avh2nvkcscgds81x8xr0gamphgps8y2";
    };
    meta = {
      homepage = https://github.com/Graylog2/graylog-plugin-auth-sso;
--- a/pkgs/tools/networking/grpcui/default.nix
+++ b/pkgs/tools/networking/grpcui/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "grpcui";
-  version = "0.2.0";
+  version = "0.2.1";

  src = fetchFromGitHub {
    owner = "fullstorydev";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0h4xpyd6phj3svjzxh6nd98ym81x4a2v6jxcnqj4psjinwd4p3md";
+    sha256 = "0dcah6bamjqyp9354qrd1cykdr5k5l93hh7qcy5b4nkag9531gl0";
  };
-  
-  modSha256 = "1hsq2gfhscl4wvld346xrp018sb1g3xvga3d8chlbgw93rmhhszb";
+
+  modSha256 = "1yq8484cjxad72nqsrim3zppr8hmn7dc6f8rgkw8fg952lqy5jjb";

  meta = with lib; {
    description = "An interactive web UI for gRPC, along the lines of postman";
--- a/pkgs/tools/networking/py-wmi-client/default.nix
+++ b/pkgs/tools/networking/py-wmi-client/default.nix
@ -0,0 +1,25 @@
+{ lib, pythonPackages, fetchFromGitHub }:
+
+pythonPackages.buildPythonApplication rec {
+  pname = "py-wmi-client";
+  version = "unstable-20160601";
+
+  src = fetchFromGitHub {
+    owner = "dlundgren";
+    repo = pname;
+    rev = "9702b036df85c3e0ecdde84a753b353069f58208";
+    sha256 = "1kd12gi1knqv477f1shzqr0h349s5336vzp3fpfp3xl0b502ld8d";
+  };
+
+  propagatedBuildInputs = with pythonPackages; [ impacket natsort pyasn1 pycrypto ];
+
+  # no tests
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Python WMI Client implementation";
+    homepage = "https://github.com/dlundgren/py-wmi-client";
+    license = licenses.mit;
+    maintainers = with maintainers; [ peterhoeg ];
+  };
+}
--- a/pkgs/tools/networking/pykms/default.nix
+++ b/pkgs/tools/networking/pykms/default.nix
@ -1,7 +1,7 @@
-{ stdenv, fetchFromGitHub, python3Packages, writeText, writeScript
+{ stdenv, runtimeShell, fetchFromGitHub, python3, writeText, writeScript
 , coreutils, sqlite }:

-with python3Packages;
+with python3.pkgs;

 let
  dbSql = writeText "create_pykms_db.sql" ''
@ -18,38 +18,45 @@ let
  '';

  dbScript = writeScript "create_pykms_db.sh" (with stdenv.lib; ''
-    #!${stdenv.shell} -eu
+    #!${runtimeShell}
+
+    set -eEuo pipefail

    db=$1

-    ${getBin coreutils}/bin/install -d $(dirname $db)
-
    if [ ! -e $db ] ; then
      ${getBin sqlite}/bin/sqlite3 $db < ${dbSql}
    fi
  '');

-in buildPythonApplication {
+in buildPythonApplication rec {
  pname = "pykms";
-  version = "20180208";
+  version = "20190611";

  src = fetchFromGitHub {
-    owner  = "ThunderEX";
+    owner  = "SystemRage";
    repo   = "py-kms";
-    rev    = "a1666a0ee5b404569a234afd05b164accc9a8845";
-    sha256 = "17yj5n8byxp09l5zkap73hpphjy35px84wy68ps824w8l0l8kcd4";
+    rev    = "dead208b1593655377fe8bc0d74cc4bead617103";
+    sha256 = "065qpkfqrahsam1rb43vnasmzrangan5z1pr3p6s0sqjz5l2jydp";
  };

-  propagatedBuildInputs = [ pytz ];
+  sourceRoot = "source/py-kms";

-  prePatch = ''
-    siteDir=$out/${python.sitePackages}
+  propagatedBuildInputs = [ systemd pytz tzlocal ];

-    substituteInPlace kmsBase.py \
+  postPatch = ''
+    siteDir=$out/${python3.sitePackages}
+
+    substituteInPlace pykms_DB2Dict.py \
      --replace "'KmsDataBase.xml'" "'$siteDir/KmsDataBase.xml'"
+
+    # we are logging to journal
+    sed -i pykms_Misc.py \
+      -e '6ifrom systemd import journal' \
+      -e 's/log_obj.addHandler(log_handler)/log_obj.addHandler(journal.JournalHandler())/'
  '';

-  dontBuild = true;
+  format = "other";

  # there are no tests
  doCheck = false;
@ -57,18 +64,19 @@ in buildPythonApplication {
  installPhase = ''
    runHook preInstall

-    mkdir -p $out/{bin,share/doc/pykms} $siteDir
+    mkdir -p $siteDir

    mv * $siteDir
-    for b in client server ; do
-      makeWrapper ${python.interpreter} $out/bin/$b.py \
-        --argv0 $b \
-        --add-flags $siteDir/$b.py
+    for b in Client Server ; do
+      makeWrapper ${python.interpreter} $out/bin/''${b,,} \
+        --argv0 ''${b,,} \
+        --add-flags $siteDir/pykms_$b.py \
+        --prefix PYTHONPATH : "$(toPythonPath ${systemd})"
    done

-    install -m755 ${dbScript} $out/bin/create_pykms_db.sh
+    install -Dm755 ${dbScript} $out/libexec/create_pykms_db.sh

-    mv $siteDir/README.md $out/share/doc/pykms/
+    install -Dm644 ../README.md -t $out/share/doc/pykms

    ${python.interpreter} -m compileall $siteDir

@ -77,7 +85,7 @@ in buildPythonApplication {

  meta = with stdenv.lib; {
    description = "Windows KMS (Key Management Service) server written in Python";
-    homepage    = https://github.com/ThunderEX/py-kms;
+    homepage    = "https://github.com/SystemRage/py-kms";
    license     = licenses.mit;
    maintainers = with maintainers; [ peterhoeg ];
  };
--- a/pkgs/tools/package-management/home-manager/default.nix
+++ b/pkgs/tools/package-management/home-manager/default.nix
@ -6,13 +6,13 @@
 stdenv.mkDerivation rec {

  pname = "home-manager";
-  version = "2019-09-04";
+  version = "2019-09-20";

  src = fetchFromGitHub {
    owner = "rycee";
    repo = "home-manager";
-    rev = "1923ac3358cbd2d75352c2db2178314eb4623818";
-    sha256 = "1xdsz62sjh8j3p8jfz449gv9vl01adk3qdyjvbpgi7y5c09ymwg7";
+    rev = "3f4563018010e2ad180d99d9cd876187e2905cee";
+    sha256 = "1bj7i9yslynhbmn4w5ilm7554zn8pgd0npvy2b0z8n98hlc2d30c";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/Show More
+++ b/Show More