Merge staging-next into staging

2024-12-28 06:14:26 +03:00 · 2019-01-19 09:24:01 +01:00 · 2019-01-19 09:24:01 +01:00 · f8b45e2d84
commit f8b45e2d84
parent e7f86448c5 bd538d6bb0
107 changed files with 2541 additions and 1803 deletions
--- a/doc/configuration.xml
+++ b/doc/configuration.xml
@ -180,7 +180,11 @@
     code:
 <programlisting>
 {
-  allowUnfreePredicate = (pkg: builtins.elem (builtins.parseDrvName pkg.name).name [ "flashplayer" "vscode" ]);
+  allowUnfreePredicate = (pkg: builtins.elem
+    (builtins.parseDrvName pkg.name).name [
+      "flashplayer"
+      "vscode"
+    ]);
 }
 </programlisting>
    </para>
@ -322,7 +326,18 @@
  packageOverrides = pkgs: with pkgs; {
    myPackages = pkgs.buildEnv {
      name = "my-packages";
-      paths = [ aspell bc coreutils gdb ffmpeg nixUnstable emscripten jq nox silver-searcher ];
+      paths = [
+        aspell
+        bc
+        coreutils
+        gdb
+        ffmpeg
+        nixUnstable
+        emscripten
+        jq
+        nox
+        silver-searcher
+      ];
    };
  };
 }
@ -343,7 +358,18 @@
  packageOverrides = pkgs: with pkgs; {
    myPackages = pkgs.buildEnv {
      name = "my-packages";
-      paths = [ aspell bc coreutils gdb ffmpeg nixUnstable emscripten jq nox silver-searcher ];
+      paths = [
+        aspell
+        bc
+        coreutils
+        gdb
+        ffmpeg
+        nixUnstable
+        emscripten
+        jq
+        nox
+        silver-searcher
+      ];
      pathsToLink = [ "/share" "/bin" ];
    };
  };
@ -378,7 +404,17 @@
  packageOverrides = pkgs: with pkgs; {
    myPackages = pkgs.buildEnv {
      name = "my-packages";
-      paths = [ aspell bc coreutils ffmpeg nixUnstable emscripten jq nox silver-searcher ];
+      paths = [
+        aspell
+        bc
+        coreutils
+        ffmpeg
+        nixUnstable
+        emscripten
+        jq
+        nox
+        silver-searcher
+      ];
      pathsToLink = [ "/share/man" "/share/doc" "/bin" ];
      extraOutputsToInstall = [ "man" "doc" ];
    };
--- a/doc/reviewing-contributions.xml
+++ b/doc/reviewing-contributions.xml
@ -605,11 +605,11 @@ policy.
 -->

  <para>
-   In a case a contributor leaves definitively the Nix community, he should
+   In a case a contributor definitively leaves the Nix community, they should
   create an issue or post on
   <link
   xlink:href="https://discourse.nixos.org">Discourse</link> with
-   references of packages and modules he maintains so the maintainership can be
+   references of packages and modules they maintain so the maintainership can be
   taken over by other contributors.
  </para>
 </section>
--- a/doc/style.css
+++ b/doc/style.css
@ -9,6 +9,7 @@
 body
 {
    font-family: "Nimbus Sans L", sans-serif;
+    font-size: 1em;
    background: white;
    margin: 2em 1em 2em 1em;
 }
@ -28,6 +29,25 @@ h2 /* chapters, appendices, subtitle */
    font-size: 180%;
 }

+div.book
+{
+    text-align: center;
+}
+
+div.book > div
+{
+    /*
+     * based on https://medium.com/@zkareemz/golden-ratio-62b3b6d4282a
+     * we do 70 characters per line to fit code listings better
+     * 70 * (font-size / 1.618)
+     * expression for emacs:
+     * (* 70 (/ 1 1.618))
+     */
+    max-width: 43.2em;
+    text-align: left;
+    margin: auto;
+}
+
 /* Extra space between chapters, appendices. */
 div.chapter > div.titlepage h2, div.appendix > div.titlepage h2
 {
@ -102,8 +122,8 @@ pre.screen, pre.programlisting
 {
    border: 1px solid #b0b0b0;
    padding: 3px 3px;
-    margin-left: 1.5em;
-    margin-right: 1.5em;
+    margin-left: 0.5em;
+    margin-right: 0.5em;

    background: #f4f4f8;
    font-family: monospace;
--- a/lib/default.nix
+++ b/lib/default.nix
@ -94,7 +94,7 @@ let
      callPackageWith callPackagesWith extendDerivation hydraJob
      makeScope;
    inherit (meta) addMetaAttrs dontDistribute setName updateName
-      appendToName mapDerivationAttrset lowPrio lowPrioSet hiPrio
+      appendToName mapDerivationAttrset setPrio lowPrio lowPrioSet hiPrio
      hiPrioSet;
    inherit (sources) pathType pathIsDirectory cleanSourceFilter
      cleanSource sourceByRegex sourceFilesBySuffices
--- a/lib/meta.nix
+++ b/lib/meta.nix
@ -41,16 +41,18 @@ rec {
    let x = builtins.parseDrvName name; in "${x.name}-${suffix}-${x.version}");


-  /* Apply a function to each derivation and only to derivations in an attrset
+  /* Apply a function to each derivation and only to derivations in an attrset.
  */
  mapDerivationAttrset = f: set: lib.mapAttrs (name: pkg: if lib.isDerivation pkg then (f pkg) else pkg) set;

+  /* Set the nix-env priority of the package.
+  */
+  setPrio = priority: addMetaAttrs { inherit priority; };

  /* Decrease the nix-env priority of the package, i.e., other
     versions/variants of the package will be preferred.
  */
-  lowPrio = drv: addMetaAttrs { priority = 10; } drv;
-
+  lowPrio = setPrio 10;

  /* Apply lowPrio to an attrset with derivations
  */
@ -60,8 +62,7 @@ rec {
  /* Increase the nix-env priority of the package, i.e., this
     version/variant of the package will be preferred.
  */
-  hiPrio = drv: addMetaAttrs { priority = -10; } drv;
-
+  hiPrio = setPrio (-10);

  /* Apply hiPrio to an attrset with derivations
  */
--- a/nixos/doc/manual/configuration/x-windows.xml
+++ b/nixos/doc/manual/configuration/x-windows.xml
@ -35,11 +35,11 @@
 </para>
 <para>
  NixOS’s default <emphasis>display manager</emphasis> (the program that
-  provides a graphical login prompt and manages the X server) is SLiM. You can
+  provides a graphical login prompt and manages the X server) is LightDM. You can
  select an alternative one by picking one of the following lines:
 <programlisting>
 <xref linkend="opt-services.xserver.displayManager.sddm.enable"/> = true;
-<xref linkend="opt-services.xserver.displayManager.lightdm.enable"/> = true;
+<xref linkend="opt-services.xserver.displayManager.slim.enable"/> = true;
 </programlisting>
 </para>
 <para>
--- a/nixos/doc/manual/installation/installing-usb.xml
+++ b/nixos/doc/manual/installation/installing-usb.xml
@ -23,7 +23,7 @@ $ diskutil list
 [..]
 $ diskutil unmountDisk diskN
 Unmount of all volumes on diskN was successful
-$ sudo dd bs=1m if=nix.iso of=/dev/rdiskN
+$ sudo dd bs=1000000 if=nix.iso of=/dev/rdiskN
 </programlisting>
    Using the 'raw' <command>rdiskN</command> device instead of
    <command>diskN</command> completes in minutes instead of hours. After
--- a/nixos/doc/manual/installation/installing-virtualbox-guest.xml
+++ b/nixos/doc/manual/installation/installing-virtualbox-guest.xml
@ -77,18 +77,22 @@
  Shared folders can be given a name and a path in the host system in the
  VirtualBox settings (Machine / Settings / Shared Folders, then click on the
  "Add" icon). Add the following to the
-  <literal>/etc/nixos/configuration.nix</literal> to auto-mount them:
+  <literal>/etc/nixos/configuration.nix</literal> to auto-mount them. If you 
+   do not add <literal>"nofail"</literal>, the system will no boot properly. 
+   The same goes for disabling <literal>rngd</literal> which is normally used 
+   to get randomness but this does not work in virtual machines.
 </para>

 <programlisting>
 { config, pkgs, ...} :
 {
+  security.rngd.enable = false; // otherwise vm will not boot
  ...

  fileSystems."/virtualboxshare" = {
    fsType = "vboxsf";
    device = "nameofthesharedfolder";
-    options = [ "rw" ];
+    options = [ "rw" "nofail" ];
  };
 }
 </programlisting>
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@ -306,7 +306,7 @@
      rslsync = 279;
      minio = 280;
      kanboard = 281;
-      pykms = 282;
+      # pykms = 282; # DynamicUser = true
      kodi = 283;
      restya-board = 284;
      mighttpd2 = 285;
@ -338,6 +338,7 @@
      minetest = 311;
      rss2email = 312;
      cockroachdb = 313;
+      zoneminder = 314;

      # When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!

@ -604,7 +605,7 @@
      rslsync = 279;
      minio = 280;
      kanboard = 281;
-      pykms = 282;
+      # pykms = 282; # DynamicUser = true
      kodi = 283;
      restya-board = 284;
      mighttpd2 = 285;
@ -636,6 +637,7 @@
      minetest = 311;
      rss2email = 312;
      cockroachdb = 313;
+      zoneminder = 314;

      # When adding a gid, make sure it doesn't match an existing
      # uid. Users and groups with the same name should have equal
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -248,6 +248,7 @@
  ./services/desktops/gnome3/at-spi2-core.nix
  ./services/desktops/gnome3/chrome-gnome-shell.nix
  ./services/desktops/gnome3/evolution-data-server.nix
+  ./services/desktops/gnome3/file-roller.nix
  ./services/desktops/gnome3/gnome-disks.nix
  ./services/desktops/gnome3/gnome-documents.nix
  ./services/desktops/gnome3/gnome-keyring.nix
@ -432,6 +433,7 @@
  ./services/misc/uhub.nix
  ./services/misc/weechat.nix
  ./services/misc/xmr-stak.nix
+  ./services/misc/zoneminder.nix
  ./services/misc/zookeeper.nix
  ./services/monitoring/alerta.nix
  ./services/monitoring/apcupsd.nix
--- a/nixos/modules/services/desktops/gnome3/file-roller.nix
+++ b/nixos/modules/services/desktops/gnome3/file-roller.nix
@ -0,0 +1,32 @@
+# File Roller.
+
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+{
+
+  ###### interface
+
+  options = {
+
+    services.gnome3.file-roller = {
+
+      enable = mkEnableOption "File Roller, an archive manager for GNOME";
+
+    };
+
+  };
+
+
+  ###### implementation
+
+  config = mkIf config.services.gnome3.file-roller.enable {
+
+    environment.systemPackages = [ pkgs.gnome3.file-roller ];
+
+    services.dbus.packages = [ pkgs.gnome3.file-roller ];
+
+  };
+
+}
--- a/nixos/modules/services/misc/pykms.nix
+++ b/nixos/modules/services/misc/pykms.nix
@ -5,20 +5,8 @@ with lib;
 let
  cfg = config.services.pykms;

-  home = "/var/lib/pykms";
-
-  services = {
-    serviceConfig = {
-      Restart = "on-failure";
-      RestartSec = "10s";
-      StartLimitInterval = "1min";
-      PrivateTmp = true;
-      ProtectSystem = "full";
-      ProtectHome = true;
-    };
-  };
-
 in {
+  meta.maintainers = with lib.maintainers; [ peterhoeg ];

  options = {
    services.pykms = rec {
@ -51,39 +39,38 @@ in {
        default = false;
        description = "Whether the listening port should be opened automatically.";
      };
+
+      memoryLimit = mkOption {
+        type = types.str;
+        default = "64M";
+        description = "How much memory to use at most.";
+      };
    };
  };

  config = mkIf cfg.enable {
    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewallPort [ cfg.port ];

-    systemd.services = {
-      pykms = services // {
-        description = "Python KMS";
-        wantedBy = [ "multi-user.target" ];
-        serviceConfig = with pkgs; {
-          User = "pykms";
-          Group = "pykms";
-          ExecStartPre = "${getBin pykms}/bin/create_pykms_db.sh ${home}/clients.db";
-          ExecStart = "${getBin pykms}/bin/server.py ${optionalString cfg.verbose "--verbose"} ${cfg.listenAddress} ${toString cfg.port}";
-          WorkingDirectory = home;
-          MemoryLimit = "64M";
-        };
-      };
-    };
-
-    users = {
-      users.pykms = {
-        name = "pykms";
-        group = "pykms";
-        home  = home;
-        createHome = true;
-        uid = config.ids.uids.pykms;
-        description = "PyKMS daemon user";
-      };
-
-      groups.pykms = {
-        gid = config.ids.gids.pykms;
+    systemd.services.pykms = let
+      home = "/var/lib/pykms";
+    in {
+      description = "Python KMS";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      # python programs with DynamicUser = true require HOME to be set
+      environment.HOME = home;
+      serviceConfig = with pkgs; {
+        DynamicUser = true;
+        StateDirectory = baseNameOf home;
+        ExecStartPre = "${getBin pykms}/bin/create_pykms_db.sh ${home}/clients.db";
+        ExecStart = lib.concatStringsSep " " ([
+          "${getBin pykms}/bin/server.py"
+          cfg.listenAddress
+          (toString cfg.port)
+        ] ++ lib.optional cfg.verbose "--verbose");
+        WorkingDirectory = home;
+        Restart = "on-failure";
+        MemoryLimit = cfg.memoryLimit;
      };
    };
  };
--- a/nixos/modules/services/misc/zoneminder.nix
+++ b/nixos/modules/services/misc/zoneminder.nix
@ -0,0 +1,362 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.zoneminder;
+  pkg = pkgs.zoneminder;
+
+  dirName = pkg.dirName;
+
+  user = "zoneminder";
+  group = {
+    nginx = config.services.nginx.group;
+    none  = user;
+  }."${cfg.webserver}";
+
+  useNginx = cfg.webserver == "nginx";
+
+  defaultDir = "/var/lib/${user}";
+  home = if useCustomDir then cfg.storageDir else defaultDir;
+
+  useCustomDir = !(builtins.isNull cfg.storageDir);
+
+  socket = "/run/phpfpm/${dirName}.sock";
+
+  zms = "/cgi-bin/zms";
+
+  dirs = dirList: [ dirName ] ++ map (e: "${dirName}/${e}") dirList;
+
+  cacheDirs = [ "swap" ];
+  libDirs   = [ "events" "exports" "images" "sounds" ];
+
+  dirStanzas = baseDir:
+    lib.concatStringsSep "\n" (map (e:
+      "ZM_DIR_${lib.toUpper e}=${baseDir}/${e}"
+      ) libDirs);
+
+  defaultsFile = pkgs.writeText "60-defaults.conf" ''
+    # 01-system-paths.conf
+    ${dirStanzas home}
+    ZM_PATH_ARP=${lib.getBin pkgs.nettools}/bin/arp
+    ZM_PATH_LOGS=/var/log/${dirName}
+    ZM_PATH_MAP=/dev/shm
+    ZM_PATH_SOCKS=/run/${dirName}
+    ZM_PATH_SWAP=/var/cache/${dirName}/swap
+    ZM_PATH_ZMS=${zms}
+
+    # 02-multiserver.conf
+    ZM_SERVER_HOST=
+
+    # Database
+    ZM_DB_TYPE=mysql
+    ZM_DB_HOST=${cfg.database.host}
+    ZM_DB_NAME=${cfg.database.name}
+    ZM_DB_USER=${cfg.database.username}
+    ZM_DB_PASS=${cfg.database.password}
+
+    # Web
+    ZM_WEB_USER=${user}
+    ZM_WEB_GROUP=${group}
+  '';
+
+  configFile = pkgs.writeText "80-nixos.conf" ''
+    # You can override defaults here
+
+    ${cfg.extraConfig}
+  '';
+
+  phpExtensions = with pkgs.phpPackages; [
+    { pkg = apcu; name = "apcu"; }
+  ];
+
+in {
+  options = {
+    services.zoneminder = with lib; {
+      enable = lib.mkEnableOption ''
+        ZoneMinder
+        </para><para>
+        If you intend to run the database locally, you should set
+        `config.services.zoneminder.database.createLocally` to true. Otherwise,
+        when set to `false` (the default), you will have to create the database
+        and database user as well as populate the database yourself.
+      '';
+
+      webserver = mkOption {
+        type = types.enum [ "nginx" "none" ];
+        default = "nginx";
+        description = ''
+          The webserver to configure for the PHP frontend.
+          </para>
+          <para>
+
+          Set it to `none` if you want to configure it yourself. PRs are welcome
+          for support for other web servers.
+        '';
+      };
+
+      hostname = mkOption {
+        type = types.str;
+        default = "localhost";
+        description = ''
+          The hostname on which to listen.
+        '';
+      };
+
+      port = mkOption {
+        type = types.int;
+        default = 8095;
+        description = ''
+          The port on which to listen.
+        '';
+      };
+
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Open the firewall port(s).
+        '';
+      };
+
+      database = {
+        createLocally = mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            Create the database and database user locally.
+          '';
+        };
+
+        host = mkOption {
+          type = types.str;
+          default = "localhost";
+          description = ''
+            Hostname hosting the database.
+          '';
+        };
+
+        name = mkOption {
+          type = types.str;
+          default = "zm";
+          description = ''
+            Name of database.
+          '';
+        };
+
+        username = mkOption {
+          type = types.str;
+          default = "zmuser";
+          description = ''
+            Username for accessing the database.
+          '';
+        };
+
+        password = mkOption {
+          type = types.str;
+          default = "zmpass";
+          description = ''
+            Username for accessing the database.
+          '';
+        };
+      };
+
+      cameras = mkOption {
+        type = types.int;
+        default = 1;
+        description = ''
+          Set this to the number of cameras you expect to support.
+        '';
+      };
+
+      storageDir = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        example = "/storage/tank";
+        description = ''
+          ZoneMinder can generate quite a lot of data, so in case you don't want
+          to use the default ${home}, you can override the path here.
+        '';
+      };
+
+      extraConfig = mkOption {
+        type = types.lines;
+        default = "";
+        description = ''
+          Additional configuration added verbatim to the configuration file.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+
+    environment.etc = {
+      "zoneminder/60-defaults.conf".source = defaultsFile;
+      "zoneminder/80-nixos.conf".source    = configFile;
+    };
+
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ cfg.port ];
+
+    services = {
+      fcgiwrap = lib.mkIf useNginx {
+        enable = true;
+        preforkProcesses = cfg.cameras;
+        inherit user group;
+      };
+
+      mysql = lib.mkIf cfg.database.createLocally {
+        ensureDatabases = [ cfg.database.name ];
+        ensureUsers = {
+          name = cfg.database.username;
+          ensurePermissions = [
+            { "${cfg.database.name}.*" = "ALL PRIVILEGES"; }
+          ];
+          initialDatabases = [
+            { inherit (cfg.database) name; schema = "${pkg}/share/zoneminder/db/zm_create.sql"; }
+          ];
+        };
+      };
+
+      nginx = lib.mkIf useNginx {
+        enable = true;
+        virtualHosts = {
+          "${cfg.hostname}" = {
+            default = true;
+            root = "${pkg}/share/zoneminder/www";
+            listen = [ { addr = "0.0.0.0"; inherit (cfg) port; } ];
+            extraConfig = let
+              fcgi = config.services.fcgiwrap;
+            in ''
+              index index.php;
+
+              location / {
+                try_files $uri $uri/ /index.php?$args =404;
+
+                location ~ /api/(css|img|ico) {
+                  rewrite ^/api(.+)$ /api/app/webroot/$1 break;
+                  try_files $uri $uri/ =404;
+                }
+
+                location ~ \.(gif|ico|jpg|jpeg|png)$ {
+                  access_log off;
+                  expires 30d;
+                }
+
+                location /api {
+                  rewrite ^/api(.+)$ /api/app/webroot/index.php?p=$1 last;
+                }
+
+                location /cgi-bin {
+                  gzip off;
+
+                  include ${pkgs.nginx}/conf/fastcgi_params;
+                  fastcgi_param SCRIPT_FILENAME ${pkg}/libexec/zoneminder/${zms};
+                  fastcgi_param HTTP_PROXY "";
+                  fastcgi_intercept_errors on;
+
+                  fastcgi_pass ${fcgi.socketType}:${fcgi.socketAddress};
+                }
+
+                location /cache {
+                  alias /var/cache/${dirName};
+                }
+
+                location ~ \.php$ {
+                  try_files $uri =404;
+                  fastcgi_index index.php;
+
+                  include ${pkgs.nginx}/conf/fastcgi_params;
+                  fastcgi_param SCRIPT_FILENAME $request_filename;
+                  fastcgi_param HTTP_PROXY "";
+
+                  fastcgi_pass unix:${socket};
+                }
+              }
+            '';
+          };
+        };
+      };
+
+      phpfpm = lib.mkIf useNginx {
+        phpOptions = ''
+          date.timezone = "${config.time.timeZone}"
+
+          ${lib.concatStringsSep "\n" (map (e:
+          "extension=${e.pkg}/lib/php/extensions/${e.name}.so") phpExtensions)}
+        '';
+        pools.zoneminder = {
+          listen = socket;
+          extraConfig = ''
+            user = ${user}
+            group = ${group}
+
+            listen.owner = ${user}
+            listen.group = ${group}
+            listen.mode = 0660
+
+            pm = dynamic
+            pm.start_servers = 1
+            pm.min_spare_servers = 1
+            pm.max_spare_servers = 2
+            pm.max_requests = 500
+            pm.max_children = 5
+            pm.status_path = /$pool-status
+            ping.path = /$pool-ping
+          '';
+        };
+      };
+    };
+
+    systemd.services = {
+      zoneminder = with pkgs; rec {
+        inherit (zoneminder.meta) description;
+        documentation = [ "https://zoneminder.readthedocs.org/en/latest/" ];
+        path = [
+          coreutils
+          procps
+          psmisc
+        ];
+        after = [ "mysql.service" "nginx.service" ];
+        wantedBy = [ "multi-user.target" ];
+        restartTriggers = [ defaultsFile configFile ];
+        preStart = lib.mkIf useCustomDir ''
+          install -dm775 -o ${user} -g ${group} ${cfg.storageDir}/{${lib.concatStringsSep "," libDirs}}
+        '';
+        serviceConfig = {
+          User = user;
+          Group = group;
+          SupplementaryGroups = [ "video" ];
+          ExecStart  = "${zoneminder}/bin/zmpkg.pl start";
+          ExecStop   = "${zoneminder}/bin/zmpkg.pl stop";
+          ExecReload = "${zoneminder}/bin/zmpkg.pl restart";
+          PIDFile = "/run/${dirName}/zm.pid";
+          Type = "forking";
+          Restart = "on-failure";
+          RestartSec = "10s";
+          CacheDirectory = dirs cacheDirs;
+          RuntimeDirectory = dirName;
+          ReadWriteDirectories = lib.mkIf useCustomDir [ cfg.storageDir ];
+          StateDirectory = dirs (if useCustomDir then [] else libDirs);
+          LogsDirectory = dirName;
+          PrivateTmp = true;
+          ProtectSystem = "strict";
+          ProtectKernelTunables = true;
+          SystemCallArchitectures = "native";
+          NoNewPrivileges = true;
+        };
+      };
+    };
+
+    users.groups."${user}" = {
+      gid = config.ids.gids.zoneminder;
+    };
+
+    users.users."${user}" = {
+      uid = config.ids.uids.zoneminder;
+      group = user;
+      inherit home;
+      inherit (pkgs.zoneminder.meta) description;
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ peterhoeg ];
+}
--- a/nixos/modules/services/x11/desktop-managers/gnome3.nix
+++ b/nixos/modules/services/x11/desktop-managers/gnome3.nix
@ -95,6 +95,7 @@ in {
    services.dleyna-server.enable = mkDefault true;
    services.gnome3.at-spi2-core.enable = true;
    services.gnome3.evolution-data-server.enable = true;
+    services.gnome3.file-roller.enable = mkDefault true;
    services.gnome3.gnome-disks.enable = mkDefault true;
    services.gnome3.gnome-documents.enable = mkDefault true;
    services.gnome3.gnome-keyring.enable = true;
--- a/pkgs/applications/editors/gnome-builder/default.nix
+++ b/pkgs/applications/editors/gnome-builder/default.nix
@ -32,14 +32,14 @@
 , wrapGAppsHook
 }:
 let
-  version = "3.30.2";
+  version = "3.30.3";
  pname = "gnome-builder";
 in stdenv.mkDerivation {
  name = "${pname}-${version}";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "05yax7iv9g831xvw9xdc01qc0l7qpmh6rfd692x8cbg76hljxdrr";
+    sha256 = "11h6apjyah91djf77m8xkl5rvdz7mwpp3bjc4yzzs9lm3pag764r";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/electrum/default.nix
+++ b/pkgs/applications/misc/electrum/default.nix
@ -14,11 +14,11 @@ in

 python3Packages.buildPythonApplication rec {
  name = "electrum-${version}";
-  version = "3.2.3";
+  version = "3.2.4";

  src = fetchurl {
    url = "https://download.electrum.org/${version}/Electrum-${version}.tar.gz";
-    sha256 = "139kzapas1l61w1in9f7c6ybricid4fzryfnvsrfhpaqh83ydn2c";
+    sha256 = "0nwipn1alk3r54zpsv2bdwsqxw4f08bxnfmygnwakfkiaifmmhxg";
  };

  propagatedBuildInputs = with python3Packages; [
--- a/pkgs/applications/misc/gnuradio/osmosdr.nix
+++ b/pkgs/applications/misc/gnuradio/osmosdr.nix
@ -1,24 +1,33 @@
-{ stdenv, fetchgit, cmake, pkgconfig, boost, gnuradio, rtl-sdr, uhd
-, makeWrapper, hackrf, airspy
+{ stdenv, fetchgit, cmake, pkgconfig, makeWrapper
+, boost
 , pythonSupport ? true, python, swig
+, airspy
+, gnuradio
+, hackrf
+, libbladeRF
+, rtl-sdr
+, soapysdr-with-plugins
+, uhd
 }:

 assert pythonSupport -> python != null && swig != null;

 stdenv.mkDerivation rec {
  name = "gnuradio-osmosdr-${version}";
-  version = "0.1.4";
+  version = "2018-08-15";

  src = fetchgit {
    url = "git://git.osmocom.org/gr-osmosdr";
-    rev = "refs/tags/v${version}";
-    sha256 = "0vyzr4fhkblf2v3d7m0ch5hws4c493jw3ydl4y6b2dfbfzchhsz8";
+    rev = "4d83c6067f059b0c5015c3f59f8117bbd361e877";
+    sha256 = "1d5nb47506qry52bg4cn02d3l4lwxwz44g2fz1ph0q93c7892j60";
  };

  nativeBuildInputs = [ pkgconfig ];
  buildInputs = [
-    cmake boost gnuradio rtl-sdr uhd makeWrapper hackrf airspy
-  ] ++ stdenv.lib.optionals pythonSupport [ python swig ];
+    cmake makeWrapper boost
+    airspy gnuradio hackrf libbladeRF rtl-sdr uhd
+  ] ++ stdenv.lib.optionals stdenv.isLinux [ soapysdr-with-plugins ]
+    ++ stdenv.lib.optionals pythonSupport [ python swig ];

  postInstall = ''
    for prog in "$out"/bin/*; do
--- a/pkgs/applications/misc/gnuradio/rds.nix
+++ b/pkgs/applications/misc/gnuradio/rds.nix
@ -6,13 +6,13 @@ assert pythonSupport -> python != null && swig != null;

 stdenv.mkDerivation rec {
  name = "gnuradio-rds-${version}";
-  version = "1.0.0";
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner = "bastibl";
    repo = "gr-rds";
    rev = "v${version}";
-    sha256 = "008284ya464q4h4fd0zvcn6g7bym231p8fl3kdxncz9ks4zsbsxs";
+    sha256 = "0jkzchvw0ivcxsjhi1h0mf7k13araxf5m4wi5v9xdgqxvipjzqfy";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/applications/misc/img2pdf/default.nix
+++ b/pkgs/applications/misc/img2pdf/default.nix
@ -4,11 +4,11 @@ with python3Packages;

 buildPythonApplication rec {
  pname = "img2pdf";
-  version = "0.3.2";
+  version = "0.3.3";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "07wxgn5khmy94zqqv8l84q9b3yy84ddvwr2f7j4pjycrj2gg7si8";
+    sha256 = "1ksn33j9d9df04n4jx7dli70d700rafbm37gjaz6lwsswrzc2xwx";
  };

  doCheck = false; # needs pdfrw
--- a/pkgs/applications/misc/tdrop/default.nix
+++ b/pkgs/applications/misc/tdrop/default.nix
@ -0,0 +1,33 @@
+{ stdenv, lib, fetchFromGitHub, makeWrapper
+, xwininfo, xdotool, xprop }:
+
+stdenv.mkDerivation rec {
+  pname = "tdrop";
+  version = "unstable-2018-11-13";
+
+  src = fetchFromGitHub {
+    owner = "noctuid";
+    repo = "tdrop";
+    rev = "198795c0d2573a31979330d6a2ae946eb81deebf";
+    sha256 = "1fhibqgmls64mylcb6q46ipmg1q6pvaqm26vz933gqav6cqsbdzs";
+  };
+
+  dontBuild = true;
+
+  installFlags = [ "PREFIX=$(out)" ];
+
+  postInstall = ''
+    wrapProgram $out/bin/tdrop \
+      --prefix PATH : ${lib.makeBinPath [ xwininfo xdotool xprop ]}
+  '';
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  meta = with stdenv.lib; {
+    description = "A Glorified WM-Independent Dropdown Creator";
+    homepage = https://github.com/noctuid/tdrop;
+    license = licenses.bsd2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ wedens ];
+  };
+}
--- a/pkgs/applications/misc/xpad/default.nix
+++ b/pkgs/applications/misc/xpad/default.nix
@ -4,11 +4,11 @@

 stdenv.mkDerivation rec {
  name = "xpad-${version}";
-  version = "5.3.0";
+  version = "5.4.0";

  src = fetchurl {
    url = "https://launchpad.net/xpad/trunk/${version}/+download/xpad-${version}.tar.bz2";
-    sha256 = "0gv9indihr2kbv9iqdqq4mfj6l6qgzwc06jm08gmg10f262sni34";
+    sha256 = "1qpmlwn0bcw1q73ag0l0fdnlzmwawfvsy4g9y5b0vyrc58lcp5d3";
  };

  nativeBuildInputs = [ autoreconfHook pkgconfig wrapGAppsHook ];
--- a/pkgs/applications/misc/yubioath-desktop/default.nix
+++ b/pkgs/applications/misc/yubioath-desktop/default.nix
@ -1,41 +1,56 @@
-{ stdenv, fetchurl,  python27Packages, pcsclite, yubikey-personalization }:
+{ stdenv, fetchurl, fetchFromGitHub
+, qmake, qtbase, qtquickcontrols, qtsvg
+, python3, pyotherside, ncurses
+, pcsclite, yubikey-personalization
+, yubikey-manager, makeWrapper }:

-python27Packages.buildPythonApplication rec {
-    namePrefix = "";
-    name = "yubioath-desktop-${version}";
-    version = "3.1.0";
+stdenv.mkDerivation rec {
+  pname = "yubioath-desktop";
+  version = "4.3.4";

-    src = fetchurl {
-      url = "https://developers.yubico.com/yubioath-desktop/Releases/yubioath-desktop-${version}.tar.gz";
-      sha256 = "0jfvllgh88g2vwd8sg6willlnn2hq05nd9d3xmv98lhl7gyy1akw";
-    };
+  src = fetchurl {
+    url = "https://developers.yubico.com/yubioath-desktop/Releases/yubioath-desktop-${version}.tar.gz";
+    sha256 = "0hb7j71032sigs8zd5r8yr0m59sjkb24vhs2l4jarpvj8q7hv30d";
+  };

-    doCheck = false;
+  doCheck = false;

-    buildInputs = [ stdenv ];
+  buildInputs = [ stdenv qtbase qtquickcontrols pyotherside python3 ];

-    propagatedBuildInputs = [ python27Packages.pycrypto python27Packages.click python27Packages.pyscard python27Packages.pyside ];
+  nativeBuildInputs = [ qmake makeWrapper python3.pkgs.wrapPython ];

-    # Need LD_PRELOAD for libykpers as the Nix cpython disables ctypes.cdll.LoadLibrary
-    # support that the yubicommon library uses to load libykpers
-    makeWrapperArgs = ''--prefix LD_LIBRARY_PATH : "${stdenv.lib.getLib pcsclite}/lib:${yubikey-personalization}/lib" --prefix LD_PRELOAD : "${yubikey-personalization}/lib/libykpers-1.so"'';
+  postPatch = ''
+    substituteInPlace deployment.pri \
+      --replace '/usr/bin' "$out/bin"
+  '';
+
+  pythonPath = [ yubikey-manager ];
+
+  # Need LD_PRELOAD for libykpers as the Nix cpython disables ctypes.cdll.LoadLibrary
+  # support that the yubicommon library uses to load libykpers
+
+  postInstall = ''
+    buildPythonPath "$out $pythonPath"
+    wrapProgram $out/bin/yubioath-desktop \
+      --prefix PYTHONPATH : "$program_PYTHONPATH" \
+      --prefix LD_PRELOAD : "${yubikey-personalization}/lib/libykpers-1.so" \
+      --prefix LD_LIBRARY_PATH : "${stdenv.lib.getLib pcsclite}/lib:${yubikey-personalization}/lib"

-    postInstall = ''
      mkdir -p $out/share/applications
-      cp resources/yubioath.desktop $out/share/applications/yubioath.desktop
+      cp resources/yubioath-desktop.desktop \
+        $out/share/applications/yubioath-desktop.desktop
      mkdir -p $out/share/yubioath/icons
-      cp resources/yubioath*.{icns,ico,png,xpm} $out/share/yubioath/icons
-      substituteInPlace $out/share/applications/yubioath.desktop \
-        --replace 'Exec=yubioath-gui' "Exec=$out/bin/yubioath-gui" \
-        --replace 'Icon=yubioath' "Icon=$out/share/yubioath/icons"
+      cp resources/icons/*.{icns,ico,png,xpm} $out/share/yubioath/icons
+      substituteInPlace $out/share/applications/yubioath-desktop.desktop \
+        --replace 'Exec=yubioath-desktop' "Exec=$out/bin/yubioath-desktop" \
+  '';

-    '';
+  meta = with stdenv.lib; {
+    description = "Yubikey Desktop Authenticator";

-    meta = {
-      description = "Yubikey Desktop Authenticator";
+    homepage = https://www.yubico.com/support/knowledge-base/categories/articles/yubico-authenticator-download/;

-      homepage = https://www.yubico.com/support/knowledge-base/categories/articles/yubico-authenticator-download/;
-
-      license = stdenv.lib.licenses.gpl3;
-    };
+    license = stdenv.lib.licenses.gpl3;
+    maintainers = with maintainers; [ mic92 ];
+  };
 }
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@ -76,11 +76,11 @@ let rpath = lib.makeLibraryPath [

 in stdenv.mkDerivation rec {
    pname = "brave";
-    version = "0.58.18";
+    version = "0.58.21";

    src = fetchurl {
        url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-        sha256 = "0xybcgsxjmd8bxi4x4midzw71s23j8icpspqf5sadskhldvshzr3";
+        sha256 = "0mml8zjpm8gjw3krppr57y4p10ky975v0s4wyyx7ixr1lzk2qp11";
    };

    dontConfigure = true;
--- a/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
--- a/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
--- a/pkgs/applications/networking/cluster/kubernetes/default.nix
+++ b/pkgs/applications/networking/cluster/kubernetes/default.nix
@ -15,13 +15,13 @@ with lib;

 stdenv.mkDerivation rec {
  name = "kubernetes-${version}";
-  version = "1.13.1";
+  version = "1.13.2";

  src = fetchFromGitHub {
    owner = "kubernetes";
    repo = "kubernetes";
    rev = "v${version}";
-    sha256 = "048ckirz7v1djari6l9ddkcd9i4yafcv57wk131dv0cs2zady9va";
+    sha256 = "1j5yyzn3c481ba6bbyx6gsa41zhg3x35sdbajlnxmbnid0g21g8g";
  };

  buildInputs = [ removeReferencesTo makeWrapper which go rsync go-bindata ];
--- a/pkgs/applications/networking/cluster/terraform-docs/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-docs/default.nix
@ -2,7 +2,7 @@
 buildGoPackage rec {
  name = "${pname}-${version}";
  pname = "terraform-docs";
-  version = "0.5.0";
+  version = "0.6.0";

  goPackagePath = "github.com/segmentio/${pname}";

@ -10,7 +10,7 @@ buildGoPackage rec {
    owner  = "segmentio";
    repo   = pname;
    rev    = "v${version}";
-    sha256 = "12w2yr669hk5kxdb9rrzsn8hwvx8rzrc1rmn8hs9l8z1bkfhr4gg";
+    sha256 = "1p6prhjf82qnhf1zwl9h92j4ds5g383a6g9pwwnqbc3wdwy5zx7d";
  };

  preBuild = ''
--- a/pkgs/applications/networking/cluster/terraform-providers/data.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/data.nix
@ -11,8 +11,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-alicloud";
-      version = "1.25.0";
-      sha256  = "09f0vdzkifj2mk1qccacpnlqiihbhhb2sfd21rpxbqscmj6a7vj1";
+      version = "1.28.0";
+      sha256  = "1clivywiv41dbdiix5cqghncf782jvpixlh02hlj4hn2cwq2j6mn";
    };
  archive =
    {
@ -39,15 +39,22 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-aws";
-      version = "1.52.0";
-      sha256  = "037n26spp49r4b4f6cyv6d3sgqw2d80g97fqgz1j0hcwi0am56h1";
+      version = "1.56.0";
+      sha256  = "1jsvkqr3l88z2lq89rjw0nrnm8dsm57nydi45mbzjl3k0j7g028m";
+    };
+  azuread =
+    {
+      owner   = "terraform-providers";
+      repo    = "terraform-provider-azuread";
+      version = "0.1.0";
+      sha256  = "0jrsg3a9cb16jinzjhg2pfm65b1bfhdwnyhag1x3x4kffm3gm148";
    };
  azurerm =
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-azurerm";
-      version = "1.20.0";
-      sha256  = "0hfq5gk4bhmw65x1rsdpwv0massgr1sczvcbyh572qlkkhvm59xd";
+      version = "1.21.0";
+      sha256  = "1xvw884nmr3h5ai2ijm2vms12cghas0jbkb52mqbqbaqci7273lc";
    };
  azurestack =
    {
@ -102,8 +109,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-cloudflare";
-      version = "1.9.0";
-      sha256  = "0z11zaii99cilqcq4lgikaanb2zc457qv19sxdh6b3v88n5n8qsf";
+      version = "1.11.0";
+      sha256  = "14v4461bxxr5zdr11v1s89m1x9kpjxa1mff9inx2vwkdz9s02w0i";
    };
  cloudscale =
    {
@ -116,8 +123,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-cloudstack";
-      version = "0.1.5";
-      sha256  = "139wq6rr6fczjz496fqkxh6cmscx5hfnv2hvhfwpkhvqipsnlxmq";
+      version = "0.2.0";
+      sha256  = "1v46da55a8a0hnw319swz3pkd62afy7hdwzybxmp48hxh1i6af74";
    };
  cobbler =
    {
@ -193,15 +200,15 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-fastly";
-      version = "0.4.0";
-      sha256  = "1fkn9b6ibs36cmhknb3x05g31rf73w70xwx05rh9fhybrz5dd9z9";
+      version = "0.5.0";
+      sha256  = "08mnpf5j0pwhd38yl0phy5ipdvk9hwh8q9kcbv997y8mzpn5703g";
    };
  flexibleengine =
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-flexibleengine";
-      version = "1.2.1";
-      sha256  = "000v6fmmnwfibzfssk23s9qwrb8a9l0j1qd14x2dqsc7ql0kbnz8";
+      version = "1.3.1";
+      sha256  = "19jncf24hl448srk4r2vqn8sca1mx8pcql9p5nxn015q6gig510v";
    };
  github =
    {
@ -214,8 +221,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-gitlab";
-      version = "1.0.0";
-      sha256  = "1kxmzdzdb6fc64i2bzch6020zfk0ygms9gh5mm1bypsyqmj4qc6r";
+      version = "1.1.0";
+      sha256  = "07mj69w0bvvkbzgfj17z7j34dg19db1d2m4gxwzjj81qmgmvzs3x";
    };
  google =
    {
@ -224,6 +231,13 @@
      version = "1.20.0";
      sha256  = "1brkq4iz140miai6gzvzxfl28qi4j8gcc22igd7cb4qzafnlbxaj";
    };
+  google-beta =
+    {
+      owner   = "terraform-providers";
+      repo    = "terraform-provider-google-beta";
+      version = "1.20.0";
+      sha256  = "0qbzacfm1ai0lflwrq49sjy5y84n8zvaxsp6yz7ifvylqmirj1j0";
+    };
  grafana =
    {
      owner   = "terraform-providers";
@ -235,8 +249,15 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-hcloud";
-      version = "1.6.0";
-      sha256  = "19kax1l2l6vr8cwgy14ahhafnvlxgkw86xx2g9ajfg70d0q4zs3g";
+      version = "1.7.0";
+      sha256  = "10i043mlcp4vvlsd22zcdj2ma3372cxfklrx30kav7w3lfsqgcl6";
+    };
+  hedvig =
+    {
+      owner   = "terraform-providers";
+      repo    = "terraform-provider-hedvig";
+      version = "1.0.1";
+      sha256  = "1cbvr43qb2kxvsg17cnf91lnfv6cmj0dmc1manxrq1nicsnz6v5f";
    };
  helm =
    {
@ -249,8 +270,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-heroku";
-      version = "1.7.0";
-      sha256  = "0zk5w4xwbg631m7592gfmdbsmrr0r7vla5nd1p5frh6szg6psy6m";
+      version = "1.7.2";
+      sha256  = "0wliiks1cvxai3rca2nzy6dhc763fkrzagsl92c5xsz1zs59vy98";
    };
  http =
    {
@ -263,8 +284,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-huaweicloud";
-      version = "1.2.0";
-      sha256  = "0r05dfgpzci0lpc2ivbrj6ivib8svbks9612by3w3zakzclpv467";
+      version = "1.3.0";
+      sha256  = "1pm2zfss20spfwqidhn04hcq4nxxamjkn6xv8vxm3mgrky1ysvp5";
    };
  icinga2 =
    {
@ -291,8 +312,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-kubernetes";
-      version = "1.4.0";
-      sha256  = "14bhqrpx0z4qn51xwcklafva46ipx05q6myy7xh5wf6wpjz69j9p";
+      version = "1.5.0";
+      sha256  = "1rzydw8bg2rmwvcvjp1h2qd4izkfs96rnmff42h0av22sfxkd7ng";
    };
  librato =
    {
@ -305,8 +326,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-linode";
-      version = "1.3.0";
-      sha256  = "1683nkpq7wnc67pphablcmaifq2l1pz3gc9y5y9jbslllphy92v5";
+      version = "1.4.0";
+      sha256  = "0ak102bmi6yh7x9d3ryyvpck49vgdgwhbk958bbyhfpdr6jrvsrr";
    };
  local =
    {
@ -361,15 +382,15 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-nomad";
-      version = "1.2.0";
-      sha256  = "1z3knyjn5ymbk4vaja4ka9zn57cgl7vr7hqv6ybqw0q9i2ykaici";
+      version = "1.3.0";
+      sha256  = "06kq0qkrgnj7z13xrgb9shid356m55mz0hkdbm4vfz3fx863mvl3";
    };
  ns1 =
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-ns1";
-      version = "1.0.0";
-      sha256  = "0zjdhz6miwlg3b68pbd99c6nw7hhyzxy736734xz8g3w89xn18f5";
+      version = "1.1.0";
+      sha256  = "1qfzm35p6kgamm1ffdvll96br025sj496nqzhsnfh3n3hsxzf0b8";
    };
  nsxt =
    {
@ -382,8 +403,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-null";
-      version = "1.0.0";
-      sha256  = "12vpa09xrq8z1pjq0bwzq3889c4fl6c5kvynwqy0z1pdx21m60ha";
+      version = "2.0.0";
+      sha256  = "1qbb4pyzqys2010g6b4yzdzgalrf6az1s24y4sa577q2bix8x45v";
    };
  nutanix =
    {
@ -396,8 +417,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-oci";
-      version = "3.10.0";
-      sha256  = "0dhz3y62dp66jkn0q4x7v2cnqw8kiq34sgyfx8mw706hg9sdqb0l";
+      version = "3.12.0";
+      sha256  = "00mwyangy7n665wlvvr6jmrlfbhnw5spy47q64rmm4pp66gg9brw";
    };
  oneandone =
    {
@ -410,22 +431,22 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-opc";
-      version = "1.3.1";
-      sha256  = "0rpkhaja6vq1y1xah136vjlp1d5v9adymq300ajssbjkqf93wzs6";
+      version = "1.3.2";
+      sha256  = "0fm53xwgpsmfkqavichxb0vq86bqqpsadlyzqz5jafw3aavx91cb";
    };
  openstack =
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-openstack";
-      version = "1.12.0";
-      sha256  = "1zv5z55yiqvsh5sh26qlyw8fcc7kyw7v4p60kfnw2ds5kd0b51i1";
+      version = "1.14.0";
+      sha256  = "05vlcfnbfs4xwzfx8lihq63zya19gdgq2xh5ddwprzddm42v1i1z";
    };
  opentelekomcloud =
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-opentelekomcloud";
-      version = "1.4.0";
-      sha256  = "0dv756npyhadzr08zlv28ghazaj1fdp3avcld7y6ri99hamncm95";
+      version = "1.5.2";
+      sha256  = "1zprj2k86wad9c35jgv22imld8l8f1jjgv54dj54ry56964nhkh8";
    };
  opsgenie =
    {
@ -438,8 +459,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-oraclepaas";
-      version = "1.4.0";
-      sha256  = "1hhkijxnwmm21b0w9qc3lk5vfcg0ac0sg7v4g0ffjqv68mssrz6x";
+      version = "1.4.1";
+      sha256  = "12jsqsyrkmrxpz8zashjwnvn6nkrd6ya06d58m116a0qija1a4s3";
    };
  ovh =
    {
@ -473,8 +494,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-postgresql";
-      version = "0.1.2";
-      sha256  = "08wv03j70mych4nnamivjihwvca3aksjxgjlj8yasz5292qgl05w";
+      version = "0.1.3";
+      sha256  = "1jx907wrq3b9cvx0z4731d1vkp40g358czgpgmky6k8wg70mhp17";
    };
  powerdns =
    {
@ -543,8 +564,15 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-selvpc";
-      version = "0.3.0";
-      sha256  = "1s1p0qa9x007hq26i4h0gcqpyx54jnwvg8d6ya044gm7gghhviz4";
+      version = "1.1.0";
+      sha256  = "045mp6j5hll0lym9z035swxmdjq43mdpf881qgmk8sz8j2wgvm5f";
+    };
+  skytap =
+    {
+      owner   = "terraform-providers";
+      repo    = "terraform-provider-skytap";
+      version = "0.9.0";
+      sha256  = "15p2rfaqw5iab8fkxcxigp7nxvs4gmgr2v8ysfyjz01mgwidd0rq";
    };
  softlayer =
    {
@ -557,8 +585,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-spotinst";
-      version = "1.4.0";
-      sha256  = "0kb09v18ksh2r4b5k9iv4rzq403zk1shpakk54pmq8s6i5jd085g";
+      version = "1.5.0";
+      sha256  = "15ggn37qsgzb78g0f6bj1l89zy65yqj66abs7xq5kjxsh62h9dij";
    };
  statuscake =
    {
@ -578,8 +606,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-template";
-      version = "1.0.0";
-      sha256  = "0jl6bp6gwg96sdk5j6s13vv1j9gxjpy2yva3barmzv9138i665mz";
+      version = "2.0.0";
+      sha256  = "0rn2qavvx1y0hv25iw8yd6acvrclmz17hzg2jpb161mnlh8q94r4";
    };
  tencentcloud =
    {
@ -599,8 +627,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-tfe";
-      version = "0.5.0";
-      sha256  = "1acmmsb4nj3l4d7zlzjrh97nhrkgm99wlazjrfavxwly253ck283";
+      version = "0.6.0";
+      sha256  = "1p8l034cjpj81vcvnz8mr2yyw3bz4zffmdg9pz9mp62s8rrrvwkw";
    };
  tls =
    {
@ -616,6 +644,13 @@
      version = "0.5.1";
      sha256  = "1bn5x6nmhfkrzpxhyfclls85l9qqffvzx1xsgcb3368lhwzarn2f";
    };
+  ucloud =
+    {
+      owner   = "terraform-providers";
+      repo    = "terraform-provider-ucloud";
+      version = "1.1.0";
+      sha256  = "0v4f7rvyiwmm64v6gwqdz3mn9sjq5y8mlhd7v9saq7rh56pfx3n2";
+    };
  ultradns =
    {
      owner   = "terraform-providers";
@ -641,8 +676,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-vsphere";
-      version = "1.9.0";
-      sha256  = "1by9klwvdw3m854jffimfnsz1lnbaixi4zcv4zzs63dc3flwy2b2";
+      version = "1.9.1";
+      sha256  = "07pxzy8fw0n0kq9mf43bz4cycbwxp8vy0jbl44sknszmzbn4pam7";
    };
  matchbox =
    {
--- a/pkgs/applications/networking/cluster/terraform-providers/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/default.nix
@ -11,10 +11,12 @@ let
      inherit (data) owner repo version sha256;
      name = "${repo}-${version}";
      goPackagePath = "github.com/${owner}/${repo}";
+      subPackages = [ "." ];
      src = fetchFromGitHub {
        inherit owner repo sha256;
        rev = "v${version}";
      };
+      

      # Terraform allow checking the provider versions, but this breaks
      # if the versions are not provided via file paths.
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.txt
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.txt
@ -7,7 +7,7 @@
 #  <organisation>/<repo>                                         - include only the named repository.

 # include all terraform-providers
-terraform-providers terraform-provider- terraform-provider-\\(azure-classic\\|scaffolding\\|google-beta\\|skytap\\)
+terraform-providers terraform-provider- terraform-provider-\\(azure-classic\\|scaffolding\\)

 # include terraform-provider-matchbox
 coreos/terraform-provider-matchbox
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@ -97,8 +97,8 @@ in rec {
  terraform_0_11-full = terraform_0_11.full;

  terraform_0_12 = pluggable (generic {
-    version = "0.12.0-alpha2";
-    sha256 = "1rnxgwfk10b1g3jnh9gv4lqrcszhxq8shaqslml30hafs3dkg71q";
+    version = "0.12.0-alpha4";
+    sha256 = "16cwqxxb19m91d7rx7awri1awz7d8cfnrv0rbql9rbg5qjyqxcp9";
    patches = [ ./provider-path.patch ];
    passthru = { inherit plugins; };
  });
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@ -56,11 +56,11 @@ let

 in stdenv.mkDerivation rec {
  name = "signal-desktop-${version}";
-  version = "1.19.0";
+  version = "1.20.0";

  src = fetchurl {
    url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "19a585mylbwrxd2m75hgp77ys1r350xkvawq2ysp0cxzr04l46z7";
+    sha256 = "1w75g7i7hf9b3yilnd6ivhd4xgp4z000x9wnrqcba2dgbr5pz7c7";
  };

  phases = [ "unpackPhase" "installPhase" ];
--- a/pkgs/applications/networking/instant-messengers/wavebox/default.nix
+++ b/pkgs/applications/networking/instant-messengers/wavebox/default.nix
@ -8,7 +8,7 @@ with stdenv.lib;
 let
  bits = "x86_64";

-  version = "4.5.9";
+  version = "4.5.10";

  desktopItem = makeDesktopItem rec {
    name = "Wavebox";
@ -25,7 +25,7 @@ in stdenv.mkDerivation rec {
  name = "wavebox-${version}";
  src = fetchurl {
    url = "https://github.com/wavebox/waveboxapp/releases/download/v${version}/${tarball}";
-    sha256 = "158kj7r5p4p3xk5pwzvbd51h543panmgkr64knv418ksyqjdi16g";
+    sha256 = "0863x3gyzzbm6qs26j821b4iy596cc2h7ppdj6hq5rgr7c01ac9k";
  };

  # don't remove runtime deps
--- a/pkgs/applications/office/zotero/default.nix
+++ b/pkgs/applications/office/zotero/default.nix
@ -1,7 +1,7 @@
 { stdenv, fetchurl, buildFHSUserEnv, makeDesktopItem, runCommand, bash, wrapGAppsHook, gsettings-desktop-schemas, gtk3, gnome3 }:

 let
-version = "5.0.35.1";
+version = "5.0.60";
 meta = with stdenv.lib; {
  homepage = https://www.zotero.org;
  description = "Collect, organize, cite, and share your research sources";
@ -15,7 +15,7 @@ zoteroSrc = stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://download.zotero.org/client/release/${version}/Zotero-${version}_linux-x86_64.tar.bz2";
-    sha256 = "0d2imvp84svllrnja1dl4nldp634z632g5xkm2q9v7j3dwbzw1hw";
+    sha256 = "0753xk95shhxma4dvdxrj2q6y81z8lianxg7jnab9m17fb67jy2d";
  };

  buildInputs= [ wrapGAppsHook gsettings-desktop-schemas gtk3 gnome3.adwaita-icon-theme gnome3.dconf ];
@ -32,7 +32,7 @@ zoteroSrc = stdenv.mkDerivation rec {
 fhsEnv = buildFHSUserEnv {
  name = "zotero-fhs-env";
  targetPkgs = pkgs: with pkgs; with xorg; [
-    gtk3 dbus-glib
+    gtk3 dbus-glib glib
    libXt nss
    libX11
  ];
--- a/pkgs/applications/science/biology/picard-tools/default.nix
+++ b/pkgs/applications/science/biology/picard-tools/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "picard-tools-${version}";
-  version = "2.18.21";
+  version = "2.18.23";

  src = fetchurl {
    url = "https://github.com/broadinstitute/picard/releases/download/${version}/picard.jar";
-    sha256 = "0p1na79p0kz1x1nd88100487s4f306p8k4m7dq5r4m2kdsc1dqin";
+    sha256 = "13521lcblbcb4vshcrrw6qlqlzvm88grp4vm8d0b3hwbl3rr0py4";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/science/math/gmsh/default.nix
+++ b/pkgs/applications/science/math/gmsh/default.nix
@ -1,14 +1,14 @@
 { stdenv, fetchurl, cmake, openblasCompat, gfortran, gmm, fltk, libjpeg
 , zlib, libGLU_combined, libGLU, xorg }:

-let version = "4.0.7"; in
+let version = "4.1.0"; in

 stdenv.mkDerivation {
  name = "gmsh-${version}";

  src = fetchurl {
    url = "http://gmsh.info/src/gmsh-${version}-source.tgz";
-    sha256 = "c6572320d0ffdf7d2488e113861bc4bd9c38a29f7fc5b67957f6fbcb63fbdbd5";
+    sha256 = "0k53k6s4hmciakhrb3ka109vk06ckdbyms5ixizijlfh1dvh7iim";
  };

  buildInputs = [ cmake openblasCompat gmm fltk libjpeg zlib libGLU_combined
--- a/pkgs/applications/science/math/sage/patches/fix-ecl-race.patch
+++ b/pkgs/applications/science/math/sage/patches/fix-ecl-race.patch
@ -0,0 +1,19 @@
+diff --git a/src/sage/doctest/forker.py b/src/sage/doctest/forker.py
+index 02e18e67e7..2ebf6eb35f 100644
+--- a/src/sage/doctest/forker.py
+++ b/src/sage/doctest/forker.py
+@@ -1075,6 +1075,14 @@ class SageDocTestRunner(doctest.DocTestRunner, object):
+             sage: set(ex2.predecessors) == set([ex0,ex1])
+             True
+         """
+
+        # Fix ECL dir race conditions by using a separate dir for each process
+        # (https://trac.sagemath.org/ticket/26968)
+        os.environ['MAXIMA_USERDIR'] = "{}/sage-maxima-{}".format(
+            tempfile.gettempdir(),
+            os.getpid()
+        )
+
+         if isinstance(globs, RecordingDict):
+             globs.start()
+         example.sequence_number = len(self.history)
--- a/pkgs/applications/science/math/sage/sage-src.nix
+++ b/pkgs/applications/science/math/sage/sage-src.nix
@ -46,6 +46,9 @@ stdenv.mkDerivation rec {
    # tests) are also run. That is necessary to test dochtml individually. See
    # https://trac.sagemath.org/ticket/26110 for an upstream discussion.
    ./patches/Only-test-py2-py3-optional-tests-when-all-of-sage-is.patch
+
+    # Fixes a potential race condition which can lead to transient doctest failures.
+    ./patches/fix-ecl-race.patch
  ];

  # Patches needed because of package updates. We could just pin the versions of
--- a/pkgs/applications/version-management/git-and-tools/git-secret/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-secret/default.nix
@ -1,7 +1,7 @@
 { stdenv, lib, fetchFromGitHub, makeWrapper, git, gnupg, gawk }:

 let
-  version = "0.2.4";
+  version = "0.2.5";
  repo = "git-secret";

 in stdenv.mkDerivation {
@ -11,7 +11,7 @@ in stdenv.mkDerivation {
    inherit repo;
    owner = "sobolevn";
    rev = "v${version}";
-    sha256 = "0lx2rjyhy3xh6ik755lbbl40v7a7ayyqk68jj8mnv42f2vhd66xl";
+    sha256 = "1caxdx1ps662vfa79f7l1bwgwgwf974ahzii0hzaqfnkxy45i520";
  };

  buildInputs = [ makeWrapper ];
--- a/pkgs/data/fonts/agave/default.nix
+++ b/pkgs/data/fonts/agave/default.nix
@ -0,0 +1,28 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  name = "agave-${version}";
+  version = "008";
+
+  src = fetchurl {
+    url = "https://github.com/agarick/agave/releases/download/v${version}/${name}.tar.gz";
+    sha256 = "0g50mqpffn4dq761vibaf8dwfkbcl5da1cc89qz6pq35ircipbns";
+  };
+
+  sourceRoot = ".";
+
+  dontBuild = true;
+  installPhase = ''
+    mkdir -p $out/share/fonts/truetype
+    cp *.ttf $out/share/fonts/truetype
+  '';
+
+  meta = with stdenv.lib; {
+    description = "truetype monospaced typeface designed for X environments";
+    homepage = https://b.agaric.net/page/agave;
+    license = licenses.mit;
+    maintainers = with maintainers; [ dtzWill ];
+    platforms = platforms.all;
+  };
+}
+
--- a/pkgs/data/fonts/ankacoder/condensed.nix
+++ b/pkgs/data/fonts/ankacoder/condensed.nix
@ -0,0 +1,24 @@
+{ stdenv, fetchzip }:
+
+let version = "1.100"; in
+fetchzip rec {
+  name = "ankacoder-condensed-${version}";
+  url = "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/anka-coder-fonts/AnkaCoderCondensed.${version}.zip";
+
+  postFetch = ''
+    unzip $downloadedFile
+    mkdir -p $out/share/fonts/truetype
+    cp *.ttf $out/share/fonts/truetype
+  '';
+
+  sha256 = "0i80zpr2y9368rg2i6x8jv0g7d03kdyr5h7w9yz7pjd7i9xd8439";
+
+  meta = with stdenv.lib; {
+    description = "Anka/Coder Condensed font";
+    homepage = https://code.google.com/archive/p/anka-coder-fonts;
+    license = licenses.ofl;
+    maintainers = with maintainers; [ dtzWill ];
+    platforms = platforms.all;
+  };
+}
+
--- a/pkgs/data/fonts/ankacoder/default.nix
+++ b/pkgs/data/fonts/ankacoder/default.nix
@ -0,0 +1,24 @@
+{ stdenv, fetchzip }:
+
+let version = "1.100"; in
+fetchzip rec {
+  name = "ankacoder-${version}";
+  url = "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/anka-coder-fonts/AnkaCoder.${version}.zip";
+
+  postFetch = ''
+    unzip $downloadedFile
+    mkdir -p $out/share/fonts/truetype
+    cp *.ttf $out/share/fonts/truetype
+  '';
+
+  sha256 = "1jqx9micfmiarqh9xp330gl96v3vxbwzz9cmg2vi845n9md4im85";
+
+  meta = with stdenv.lib; {
+    description = "Anka/Coder fonts";
+    homepage = https://code.google.com/archive/p/anka-coder-fonts;
+    license = licenses.ofl;
+    maintainers = with maintainers; [ dtzWill ];
+    platforms = platforms.all;
+  };
+}
+
--- a/pkgs/data/fonts/cherry/default.nix
+++ b/pkgs/data/fonts/cherry/default.nix
@ -0,0 +1,35 @@
+{ stdenv, fetchFromGitHub, bdftopcf }:
+
+stdenv.mkDerivation rec {
+  name = "${pname}-${version}";
+  pname = "cherry";
+  version = "1.2";
+
+  src = fetchFromGitHub {
+    owner = "turquoise-hexagon";
+    repo = pname;
+    rev = version;
+    sha256 = "1sfajzndv78v8hb156876i2rw3zw8xys6qi8zr4yi0isgsqj5yx5";
+  };
+
+  nativeBuildInputs = [ bdftopcf ];
+
+  buildPhase = ''
+    patchShebangs make.sh
+    ./make.sh
+  '';
+
+  installPhase = ''
+    mkdir -p $out/share/fonts/misc
+    cp *.pcf $out/share/fonts/misc
+  '';
+
+  meta = with stdenv.lib; {
+    description = "cherry font";
+    homepage = https://github.com/turquoise-hexagon/cherry;
+    license = licenses.mit;
+    maintainers = with maintainers; [ dtzWill ];
+    platforms = platforms.all;
+  };
+}
+
--- a/pkgs/data/fonts/hermit/default.nix
+++ b/pkgs/data/fonts/hermit/default.nix
@ -0,0 +1,28 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  pname = "hermit";
+  version = "2.0";
+
+  src = fetchurl {
+    url = "https://pcaro.es/d/otf-${pname}-${version}.tar.gz";
+    sha256 = "09rmy3sbf1j1hr8zidighjgqc8kp0wsra115y27vrnlf10ml6jy0";
+  };
+
+  sourceRoot = ".";
+
+  dontBuild = true;
+  installPhase = ''
+    mkdir -p $out/share/fonts/opentype
+    cp *.otf $out/share/fonts/opentype/
+  '';
+
+  meta = with stdenv.lib; {
+    description = "monospace font designed to be clear, pragmatic and very readable";
+    homepage = https://pcaro.es/p/hermit;
+    license = licenses.ofl;
+    maintainers = with maintainers; [ dtzWill ];
+    platforms = platforms.all;
+  };
+}
+
--- a/pkgs/data/fonts/luculent/default.nix
+++ b/pkgs/data/fonts/luculent/default.nix
@ -0,0 +1,23 @@
+{ lib, fetchzip }:
+
+let version = "2.0.0"; in
+fetchzip rec {
+  name = "luculent-${version}";
+  url =  http://www.eastfarthing.com/luculent/luculent.tar.xz;
+
+  postFetch = ''
+    tar -xJf $downloadedFile --strip-components=1
+    mkdir -p $out/share/fonts/truetype
+    cp *.ttf $out/share/fonts/truetype
+  '';
+
+  sha256 = "1m3g64galwna1xjxb1fczmfplm6c1fn3ra1ln7f0vkm0ah5m4lbv";
+
+  meta = with lib; {
+    description = "luculent font";
+    homepage = http://www.eastfarthing.com/luculent/;
+    license = licenses.ofl;
+    maintainers = with maintainers; [ dtzWill ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/data/icons/zafiro-icons/default.nix
+++ b/pkgs/data/icons/zafiro-icons/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "zafiro-icons";
-  version = "0.8.1";
+  version = "0.8.3";

  src = fetchFromGitHub {
    owner = "zayronxio";
    repo = pname;
    rev = "v${version}";
-    sha256 = "121fpg74vra8kfvgxi3i7p09qxhck45kv270x6cv5dq1fp2hdm8k";
+    sha256 = "1hflpnliww5fkk7bsgmi8hlrbqvkijjjmbzjqnnl991nqsqxqxpl";
  };

  nativeBuildInputs = [ gtk3 ];
--- a/pkgs/desktops/gnome-3/apps/gnome-documents/default.nix
+++ b/pkgs/desktops/gnome-3/apps/gnome-documents/default.nix
@ -1,4 +1,4 @@
-{ stdenv, meson, ninja, gettext, fetchurl, evince, gjs
+{ stdenv, meson, ninja, gettext, fetchurl, fetchpatch, evince, gjs
 , pkgconfig, gtk3, glib, tracker, tracker-miners
 , itstool, libxslt, webkitgtk, libgdata
 , gnome-desktop, libzapojit, libgepub
@ -31,6 +31,14 @@ stdenv.mkDerivation rec {
    gnome-desktop libzapojit libgepub
  ];

+  patches = [
+    # fix RPATH to libgd
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gnome-documents/commit/d18a92e0a940073ac766f609937539e4fc6cdbb7.patch";
+      sha256 = "0s3mk8vrl1gzk93yvgqbnz44i27qw1d9yvvmnck3fv23phrxkzk9";
+    })
+  ];
+
  postPatch = ''
    chmod +x meson_post_install.py # patchShebangs requires executable file
    patchShebangs meson_post_install.py
--- a/pkgs/desktops/gnome-3/apps/gnome-sound-recorder/default.nix
+++ b/pkgs/desktops/gnome-3/apps/gnome-sound-recorder/default.nix
@ -1,16 +1,22 @@
-{ stdenv, fetchurl, pkgconfig, intltool, gobject-introspection, wrapGAppsHook, gjs, glib, gtk3, gdk_pixbuf, gst_all_1, gnome3 }:
+{ stdenv, fetchurl, fetchpatch, pkgconfig, intltool, gobject-introspection, wrapGAppsHook, gjs, glib, gtk3, gdk_pixbuf, gst_all_1, gnome3 }:

-let
+stdenv.mkDerivation rec {
  pname = "gnome-sound-recorder";
-  version = "3.28.1";
-in stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
+  version = "3.28.2";

  src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "0y0srj1hvr1waa35p6dj1r1mlgcsscc0i99jni50ijp4zb36fjqy";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    sha256 = "1k63xr3d16qbzi88md913ndaf2mzwmhmi6hipj0123sm7nsz1p94";
  };

+  patches = [
+    # Fix crash when trying to play recordings
+    (fetchpatch {
+      url = https://gitlab.gnome.org/GNOME/gnome-sound-recorder/commit/2b311ef67909bc20d0e87f334fe37bf5c4e9f29f.patch;
+      sha256 = "0hqmk846bxma0p66cqp94zd02zc1if836ywjq3sv5dsfwnz7jv3f";
+    })
+  ];
+
  nativeBuildInputs = [ pkgconfig intltool gobject-introspection wrapGAppsHook ];
  buildInputs = [ gjs glib gtk3 gdk_pixbuf ] ++ (with gst_all_1; [ gstreamer.dev gstreamer gst-plugins-base gst-plugins-good gst-plugins-bad ]);

--- a/pkgs/desktops/gnome-3/core/eog/default.nix
+++ b/pkgs/desktops/gnome-3/core/eog/default.nix
@ -25,6 +25,15 @@ in stdenv.mkDerivation rec {
    patchShebangs meson_post_install.py
  '';

+  preFixup = ''
+    gappsWrapperArgs+=(
+      # Thumbnailers
+      --prefix XDG_DATA_DIRS : "${gdk_pixbuf}/share"
+      --prefix XDG_DATA_DIRS : "${librsvg}/share"
+      --prefix XDG_DATA_DIRS : "${shared-mime-info}/share"
+    )
+  '';
+
  passthru = {
    updateScript = gnome3.updateScript {
      packageName = pname;
--- a/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix
+++ b/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix
@ -5,13 +5,13 @@

 stdenv.mkDerivation rec {
  name = "evolution-data-server-${version}";
-  version = "3.30.3";
+  version = "3.30.4";

  outputs = [ "out" "dev" ];

  src = fetchurl {
    url = "mirror://gnome/sources/evolution-data-server/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "1q1wpsc3p6b1cacwgkgqbni7rdx3skvb2fm6fyjs2wjgq6zi5753";
+    sha256 = "1j8lwl04zz59sg7k3hpkzp829z8xyd1isz8xavm9vzxfvw5w776y";
  };

  patches = [
--- a/pkgs/desktops/gnome-3/core/gnome-settings-daemon/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-settings-daemon/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  name = "gnome-settings-daemon-${version}";
-  version = "3.30.1.2";
+  version = "3.30.2";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-settings-daemon/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "079dh609rvpwfyzg4m898q8km9g7x04hg18rwwb1izj1dr7zdp2w";
+    sha256 = "0c663csa3gnsr6wm0xfll6aani45snkdj7zjwjfzcwfh8w4a3z12";
  };

  patches = [
--- a/pkgs/development/compilers/fasm/bin.nix
+++ b/pkgs/development/compilers/fasm/bin.nix
@ -3,11 +3,11 @@
 stdenvNoCC.mkDerivation rec {
  name = "fasm-bin-${version}";

-  version = "1.73.05";
+  version = "1.73.06";

  src = fetchurl {
    url = "https://flatassembler.net/fasm-${version}.tgz";
-    sha256 = "0qpj6cs9rp1bg2rqxg1k8j71918rh86hplyw4n82n11ndwk23ni5";
+    sha256 = "02wqkqxpn3p0iwcagsm92qd9cdfcnbx8a09qg03b3pjppp30hmp6";
  };

  installPhase = ''
--- a/pkgs/development/coq-modules/QuickChick/default.nix
+++ b/pkgs/development/coq-modules/QuickChick/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, coq, ssreflect }:
+{ stdenv, fetchFromGitHub, coq, ssreflect, coq-ext-lib, simple-io }:

 let params =
  {
@ -19,6 +19,14 @@ let params =
      rev = "195e550a1cf0810497734356437a1720ebb6d744";
      sha256 = "0zm23y89z0h4iamy74qk9qi2pz2cj3ga6ygav0w79n0qyqwhxcq1";
    };
+    "8.8" = rec {
+      preConfigure = "substituteInPlace Makefile --replace quickChickTool.byte quickChickTool.native";
+      version = "1.0.2";
+      rev = "v${version}";
+      sha256 = "1mcbsp07ra3gdcmir36pf27ig3xv8nagyfp7w5pwqi4gj9w81ffn";
+      buildInputs = with coq.ocamlPackages; [ ocamlbuild num ];
+      propagatedBuildInputs = [ coq-ext-lib simple-io ];
+    };
  };
  param = params."${coq.coq-version}";
 in
@ -33,11 +41,16 @@ stdenv.mkDerivation rec {
    inherit (param) rev sha256;
  };

-  buildInputs = with coq.ocamlPackages; [ ocaml camlp5 findlib ];
-  propagatedBuildInputs = [ coq ssreflect ];
+  buildInputs = [ coq ]
+  ++ (with coq.ocamlPackages; [ ocaml camlp5 findlib ])
+  ++ (param.buildInputs or [])
+  ;
+  propagatedBuildInputs = [ ssreflect ] ++ (param.propagatedBuildInputs or []);

  enableParallelBuilding = false;

+  preConfigure = param.preConfigure or null;
+
  installPhase = ''
    make -f Makefile.coq COQLIB=$out/lib/coq/${coq.coq-version}/ install
  '';
--- a/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
@ -39,7 +39,7 @@ core-packages:

  # Hack: The following package is a core package of GHCJS. If we don't declare
  # it, then hackage2nix will generate a Hackage database where all dependants
-  # of this library are maked as "broken".
+  # of this library are marked as "broken".
  - ghcjs-base-0

 default-package-overrides:
--- a/pkgs/development/interpreters/racket/default.nix
+++ b/pkgs/development/interpreters/racket/default.nix
@ -10,6 +10,7 @@
 , disableDocs ? false
 , CoreFoundation
 , gsettings-desktop-schemas
+, wrapGAppsHook
 }:

 let
@ -59,7 +60,9 @@ stdenv.mkDerivation rec {
    (stdenv.lib.optionalString stdenv.isDarwin "-framework CoreFoundation")
  ];

-  buildInputs = [ fontconfig libffi libtool makeWrapper sqlite gsettings-desktop-schemas gtk3 ]
+  nativeBuildInputs = [ wrapGAppsHook ];
+
+  buildInputs = [ fontconfig libffi libtool sqlite gsettings-desktop-schemas gtk3 ]
    ++ stdenv.lib.optionals stdenv.isDarwin [ libiconv CoreFoundation ];

  preConfigure = ''
@ -69,6 +72,8 @@ stdenv.mkDerivation rec {
    done
    mkdir src/build
    cd src/build
+
+    gappsWrapperArgs+=("--prefix" "LD_LIBRARY_PATH" ":" $LD_LIBRARY_PATH)
  '';

  shared = if stdenv.isDarwin then "dylib" else "shared";
@ -80,13 +85,6 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = false;

-  postInstall = ''
-    for p in $(ls $out/bin/) ; do
-      wrapProgram $out/bin/$p \
-        --prefix LD_LIBRARY_PATH ":" "${LD_LIBRARY_PATH}" \
-        --prefix XDG_DATA_DIRS ":" "$GSETTINGS_SCHEMAS_PATH";
-    done
-  '';

  meta = with stdenv.lib; {
    description = "A programmable programming language";
--- a/pkgs/development/libraries/armadillo/default.nix
+++ b/pkgs/development/libraries/armadillo/default.nix
@ -1,12 +1,12 @@
 { stdenv, fetchurl, cmake, openblasCompat, superlu, hdf5 }:

 stdenv.mkDerivation rec {
-  version = "9.200.6";
+  version = "9.200.7";
  name = "armadillo-${version}";

  src = fetchurl {
    url = "mirror://sourceforge/arma/armadillo-${version}.tar.xz";
-    sha256 = "1gm8dysb29f3p96bzjgdb5r70dc6y5jq1avg18sdixz0hgnxqq14";
+    sha256 = "1y3xrchykwddlrnzgf7xjdmbkf6c4gayz92vyrqdyvnlpi07sy72";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/box2d/default.nix
+++ b/pkgs/development/libraries/box2d/default.nix
@ -3,11 +3,11 @@

 stdenv.mkDerivation rec {
  name = "box2d-${version}";
-  version = "2.3.0";
+  version = "2.3.1";

  src = fetchurl {
    url = "https://github.com/erincatto/Box2D/archive/v${version}.tar.gz";
-    sha256 = "1dmbswh4x2n5l3c9h0k72m0z4rdpzfy1xl8m8p3rf5rwkvk3bkg2";
+    sha256 = "0llpcifl8zbjbpxdwz87drd01m3lwnv82xb4av6kca1xn4w2gmkm";
  };

  sourceRoot = "Box2D-${version}/Box2D";
--- a/pkgs/development/libraries/capstone/default.nix
+++ b/pkgs/development/libraries/capstone/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name    = "capstone-${version}";
-  version = "4.0";
+  version = "4.0.1";

  src = fetchurl {
    url    = "https://github.com/aquynh/capstone/archive/${version}.tar.gz";
-    sha256 = "0yp6y5m3v674i2pq6s804ikvz43gzgsjwq1maqhmj3b730b4dii6";
+    sha256 = "1isxw2qwy1fi3m3w7igsr5klzczxc5cxndz0a78dfss6ps6ymfvr";
  };

  configurePhase = '' patchShebangs make.sh '';
--- a/pkgs/development/libraries/gtkd/default.nix
+++ b/pkgs/development/libraries/gtkd/default.nix
@ -3,11 +3,11 @@

 stdenv.mkDerivation rec {
  name = "gtkd-${version}";
-  version = "3.8.4";
+  version = "3.8.5";

  src = fetchzip {
    url = "https://gtkd.org/Downloads/sources/GtkD-${version}.zip";
-    sha256 = "0q2kf1jwr89i8ajjzyf3b4bbla33djvnwrvljq17y206q7qknfyz";
+    sha256 = "12n2njsaplra7x15nqwrj2hrf8a27pfjj2mck4mkzxv03qk6mqky";
    stripRoot = false;
  };

--- a/pkgs/development/libraries/netcdf-fortran/default.nix
+++ b/pkgs/development/libraries/netcdf-fortran/default.nix
@ -1,11 +1,11 @@
 { stdenv, fetchurl, netcdf, hdf5, curl, gfortran }:
 stdenv.mkDerivation rec {
  name = "netcdf-fortran-${version}";
-  version = "4.4.4";
+  version = "4.4.5";

  src = fetchurl {
    url = "https://github.com/Unidata/netcdf-fortran/archive/v${version}.tar.gz";
-    sha256 = "0rwybszj1jjb25cx8vfyrd77x5qsdjzwspcjz56n12br89n9ica4";
+    sha256 = "00qwg4v250yg8kxp68srrnvfbfim241fnlm071p9ila2mihk8r01";
  };

  buildInputs = [ netcdf hdf5 curl gfortran ];
--- a/pkgs/development/libraries/pyotherside/default.nix
+++ b/pkgs/development/libraries/pyotherside/default.nix
@ -0,0 +1,29 @@
+{ stdenv, fetchFromGitHub
+, python3, qmake, qtbase, qtquickcontrols, qtsvg, ncurses }:
+
+stdenv.mkDerivation rec {
+  pname = "pyotherside";
+  version = "1.5.3";
+
+  src = fetchFromGitHub {
+    owner = "thp";
+    repo = "pyotherside";
+    rev = version;
+    sha256 = "1xaw1aarj8gpgpm4z3lk8klbssadrsf3xdyzqx10zcwy16amka7k";
+  };
+
+  nativeBuildInputs = [ qmake ];
+  buildInputs = [
+    python3 qtbase qtquickcontrols qtsvg ncurses
+  ];
+
+  patches = [ ./qml-path.patch ];
+  installTargets = [ "sub-src-install_subtargets" ];
+
+  meta = with stdenv.lib; {
+    description = "Asynchronous Python 3 Bindings for Qt 5";
+    homepage = https://thp.io/2011/pyotherside/;
+    license = licenses.isc;
+    maintainers = [ maintainers.mic92 ];
+  };
+}
--- a/pkgs/development/libraries/pyotherside/qml-path.patch
+++ b/pkgs/development/libraries/pyotherside/qml-path.patch
@ -0,0 +1,12 @@
+diff -Naur --strip-trailing-cr source.org/src/src.pro source/src/src.pro
+--- source.org/src/src.pro	1970-01-01 01:00:01.000000000 +0100
+++ source/src/src.pro	2019-01-17 19:14:46.256821852 +0000
+@@ -10,7 +10,7 @@
+ CONFIG += qt plugin
+ QT += qml quick svg
+ 
+-target.path = $$[QT_INSTALL_QML]/$$PLUGIN_IMPORT_PATH
+target.path = $$NIX_OUTPUT_QML/$$PLUGIN_IMPORT_PATH
+ INSTALLS += target
+ 
+ qmldir.files += $$_PRO_FILE_PWD_/qmldir $$_PRO_FILE_PWD_/pyotherside.qmltypes
--- a/pkgs/development/libraries/qt-5/modules/qtdeclarative.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtdeclarative.nix
@ -1,10 +1,10 @@
-{ qtModule, lib, python2, qtbase, qtsvg, qtxmlpatterns }:
+{ qtModule, lib, python2, qtbase, qtsvg }:

 with lib;

 qtModule {
  name = "qtdeclarative";
-  qtInputs = [ qtbase qtsvg qtxmlpatterns ];
+  qtInputs = [ qtbase qtsvg ];
  nativeBuildInputs = [ python2 ];
  outputs = [ "out" "dev" "bin" ];
  preConfigure = ''
--- a/pkgs/development/libraries/qt-5/modules/qtxmlpatterns.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtxmlpatterns.nix
@ -1,7 +1,7 @@
-{ qtModule, qtbase }:
+{ qtModule, qtbase, qtdeclarative }:

 qtModule {
  name = "qtxmlpatterns";
-  qtInputs = [ qtbase ];
+  qtInputs = [ qtbase qtdeclarative ];
  devTools = [ "bin/xmlpatterns" "bin/xmlpatternsvalidator" ];
 }
--- a/pkgs/development/perl-modules/generic/default.nix
+++ b/pkgs/development/perl-modules/generic/default.nix
@ -28,6 +28,7 @@ stdenv.mkDerivation (
    PERL_USE_UNSAFE_INC = "1";

    meta.homepage = "https://metacpan.org/release/${(builtins.parseDrvName name).name}";
+    meta.platforms = perl.meta.platforms;
  }
  attrs
  )
--- a/pkgs/development/python-modules/beancount/default.nix
+++ b/pkgs/development/python-modules/beancount/default.nix
@ -4,14 +4,14 @@
 , pytest, requests }:

 buildPythonPackage rec {
-  version = "2.1.3";
+  version = "2.2.0";
  pname = "beancount";

  disabled = !isPy3k;

  src = fetchPypi {
    inherit pname version;
-    sha256 = "4b7b0d3633c82ca88d3cb3d31ad2fd2e45a42401cfa94eaa1cb938ffece34f22";
+    sha256 = "1j3fyyqnr5gq71rmkb9q3im8pqppa134zzhmmp4hk4b274g18w31";
  };

  # No tests in archive
--- a/pkgs/development/python-modules/cfgv/default.nix
+++ b/pkgs/development/python-modules/cfgv/default.nix
@ -2,11 +2,11 @@

 buildPythonPackage rec {
  pname = "cfgv";
-  version = "1.1.0";
+  version = "1.4.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "1akm5xdbi5kckgnhhfj6qavjwakm44cwqzhfx2ycgh7mkym1qyfi";
+    sha256 = "01mpw8kx0f2py2jwf0fv60k01p11gs0dbar5zq42k4z38xf0bn9r";
  };

  propagatedBuildInputs = [ six ];
--- a/pkgs/development/python-modules/cmd2/default.nix
+++ b/pkgs/development/python-modules/cmd2/default.nix
@ -1,5 +1,5 @@
 { stdenv, fetchPypi, buildPythonPackage, pythonOlder, isPy3k
-, pyperclip, six, pyparsing, vim, wcwidth, colorama
+, pyperclip, six, pyparsing, vim, wcwidth, colorama, attrs
 , contextlib2 ? null, typing ? null, setuptools_scm
 , pytest, mock ? null, pytest-mock
 , which, glibcLocales
@ -36,6 +36,7 @@ buildPythonPackage rec {
    six
    pyparsing
    wcwidth
+    attrs
  ]
  ++ stdenv.lib.optionals (pythonOlder "3.5") [contextlib2 typing]
  ;
--- a/pkgs/development/python-modules/irc/default.nix
+++ b/pkgs/development/python-modules/irc/default.nix
@ -1,4 +1,4 @@
-{ buildPythonPackage, fetchPypi
+{ buildPythonPackage, fetchPypi, isPy3k
 , six, jaraco_logging, jaraco_text, jaraco_stream, pytz, jaraco_itertools
 , setuptools_scm }:

@ -6,6 +6,8 @@ buildPythonPackage rec {
  pname = "irc";
  version = "17.0";

+  disabled = !isPy3k;
+
  src = fetchPypi {
    inherit pname version;
    sha256 = "f9c5fcb72dd230e1387fd4a0114a1935605e0f59ac09dec962313baed74e1365";
--- a/pkgs/development/python-modules/jaraco_itertools/default.nix
+++ b/pkgs/development/python-modules/jaraco_itertools/default.nix
@ -1,14 +1,26 @@
-{ buildPythonPackage, fetchPypi, setuptools_scm
-, inflect, more-itertools, six }:
+{ lib, buildPythonPackage, fetchPypi, setuptools_scm
+, inflect, more-itertools, six, pytest, pytest-flake8 }:

 buildPythonPackage rec {
  pname = "jaraco.itertools";
-  version = "3.0.0";
+  version = "4.0.0";
+
  src = fetchPypi {
    inherit pname version;
-    sha256 = "19d8557a25c08f7a7b8f1cfa456ebfd615bafa0f045f89bbda55f99661b0626d";
+    sha256 = "1d09zpi593bhr56rwm41kzffr18wif98plgy6xdy0zrbdwfarrxl";
  };
-  doCheck = false;
+
  buildInputs = [ setuptools_scm ];
  propagatedBuildInputs = [ inflect more-itertools six ];
+  checkInputs = [ pytest pytest-flake8 ];
+
+  checkPhase = ''
+    pytest
+  '';
+
+  meta = with lib; {
+    description = "Tools for working with iterables";
+    homepage = https://github.com/jaraco/jaraco.itertools;
+    license = licenses.mit;
+  };
 }
--- a/pkgs/development/python-modules/jaraco_logging/default.nix
+++ b/pkgs/development/python-modules/jaraco_logging/default.nix
@ -1,14 +1,26 @@
-{ buildPythonPackage, fetchPypi, setuptools_scm
-, tempora, six }:
+{ lib, buildPythonPackage, fetchPypi, setuptools_scm
+, tempora, six, pytest, pytest-flake8 }:

 buildPythonPackage rec {
  pname = "jaraco.logging";
-  version = "1.5.2";
+  version = "2.0";
+
  src = fetchPypi {
    inherit pname version;
-    sha256 = "199pgwx9ziab3gxg6p0c24z8dp3bjpsvvshnmlph9zjsssq0xc93";
+    sha256 = "1lb846j7qs1hgqwkyifv51nhl3f8jimbc4lk8yn9nkaynw0vyzcg";
  };
-  doCheck = false;
+
  buildInputs = [ setuptools_scm ];
  propagatedBuildInputs = [ tempora six ];
+  checkInputs = [ pytest pytest-flake8 ];
+
+  checkPhase = ''
+    PYTHONPATH=".:$PYTHONPATH" pytest
+  '';
+
+  meta = with lib; {
+    description = "Support for Python logging facility";
+    homepage = https://github.com/jaraco/jaraco.logging;
+    license = licenses.mit;
+  };
 }
--- a/pkgs/development/python-modules/jq/default.nix
+++ b/pkgs/development/python-modules/jq/default.nix
@ -0,0 +1,27 @@
+{ buildPythonPackage, fetchPypi, lib, cython, jq }:
+
+buildPythonPackage rec {
+  pname = "jq";
+  version = "0.1.6";
+
+  srcs = fetchPypi {
+    inherit pname version;
+    sha256 = "34bdf9f9e49e522e1790afc03f3584c6b57329215ea0567fb2157867d6d6f602";
+  };
+  patches = [ ./jq-py-setup.patch ];
+
+  nativeBuildInputs = [ cython ];
+
+  preBuild = ''
+    cython jq.pyx
+  '';
+
+  buildInputs = [ jq ];
+
+  meta = {
+    description = "Python bindings for jq, the flexible JSON processor";
+    homepage = "https://github.com/mwilliamson/jq.py";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ benley ];
+  };
+}
--- a/pkgs/development/python-modules/jq/jq-py-setup.patch
+++ b/pkgs/development/python-modules/jq/jq-py-setup.patch
@ -0,0 +1,130 @@
+From 3f369cf8b9f7134d0792f6b141d39b5342a8274f Mon Sep 17 00:00:00 2001
+From: Benjamin Staffin <benley@gmail.com>
+Date: Mon, 14 Jan 2019 17:27:06 -0500
+Subject: [PATCH] Vastly simplify setup.py for distro compatibility
+
+---
+ setup.py | 81 +-------------------------------------------------------
+ 1 file changed, 1 insertion(+), 80 deletions(-)
+
+diff --git a/setup.py b/setup.py
+index 77933f2..2b71e25 100644
+--- a/setup.py
+++ b/setup.py
+@@ -1,10 +1,6 @@
+ #!/usr/bin/env python
+ 
+ import os
+-import platform
+-import subprocess
+-import tarfile
+-import shutil
+ 
+ try:
+     import sysconfig
+@@ -14,88 +10,15 @@ except ImportError:
+ 
+ from setuptools import setup
+ from distutils.extension import Extension
+-from distutils.command.build_ext import build_ext
+-
+-try:
+-    from urllib import urlretrieve
+-except ImportError:
+-    from urllib.request import urlretrieve
+-
+-def path_in_dir(relative_path):
+-    return os.path.abspath(os.path.join(os.path.dirname(__file__), relative_path))
+ 
+ def read(fname):
+     return open(os.path.join(os.path.dirname(__file__), fname)).read()
+ 
+ 
+-jq_lib_tarball_path = path_in_dir("_jq-lib-1.5.tar.gz")
+-jq_lib_dir = path_in_dir("jq-jq-1.5")
+-
+-oniguruma_lib_tarball_path = path_in_dir("_onig-5.9.6.tar.gz")
+-oniguruma_lib_build_dir = path_in_dir("onig-5.9.6")
+-oniguruma_lib_install_dir = path_in_dir("onig-install-5.9.6")
+-
+-class jq_build_ext(build_ext):
+-    def run(self):
+-        self._build_oniguruma()
+-        self._build_libjq()
+-        build_ext.run(self)
+-    
+-    def _build_oniguruma(self):
+-        self._build_lib(
+-            source_url="https://github.com/kkos/oniguruma/releases/download/v5.9.6/onig-5.9.6.tar.gz",
+-            tarball_path=oniguruma_lib_tarball_path,
+-            lib_dir=oniguruma_lib_build_dir,
+-            commands=[
+-                ["./configure", "CFLAGS=-fPIC", "--prefix=" + oniguruma_lib_install_dir],
+-                ["make"],
+-                ["make", "install"],
+-            ])
+-        
+-    
+-    def _build_libjq(self):
+-        self._build_lib(
+-            source_url="https://github.com/stedolan/jq/archive/jq-1.5.tar.gz",
+-            tarball_path=jq_lib_tarball_path,
+-            lib_dir=jq_lib_dir,
+-            commands=[
+-                ["autoreconf", "-i"],
+-                ["./configure", "CFLAGS=-fPIC", "--disable-maintainer-mode", "--with-oniguruma=" + oniguruma_lib_install_dir],
+-                ["make"],
+-            ])
+-        
+-    def _build_lib(self, source_url, tarball_path, lib_dir, commands):
+-        self._download_tarball(source_url, tarball_path)
+-
+-        macosx_deployment_target = sysconfig.get_config_var("MACOSX_DEPLOYMENT_TARGET")
+-        if macosx_deployment_target:
+-            os.environ['MACOSX_DEPLOYMENT_TARGET'] = macosx_deployment_target
+-
+-        def run_command(args):
+-            print("Executing: %s" % ' '.join(args))
+-            subprocess.check_call(args, cwd=lib_dir)
+-            
+-        for command in commands:
+-            run_command(command)
+-    
+-    def _download_tarball(self, source_url, tarball_path):
+-        if os.path.exists(tarball_path):
+-            os.unlink(tarball_path)
+-        urlretrieve(source_url, tarball_path)
+-        
+-        if os.path.exists(jq_lib_dir):
+-            shutil.rmtree(jq_lib_dir)
+-        tarfile.open(tarball_path, "r:gz").extractall(path_in_dir("."))
+-
+-
+ jq_extension = Extension(
+     "jq",
+     sources=["jq.c"],
+-    include_dirs=[jq_lib_dir],
+-    extra_objects=[
+-        os.path.join(jq_lib_dir, ".libs/libjq.a"),
+-        os.path.join(oniguruma_lib_install_dir, "lib/libonig.a"),
+-    ],
+    libraries=["jq"],
+ )
+ 
+ setup(
+@@ -107,7 +30,6 @@ setup(
+     url='http://github.com/mwilliamson/jq.py',
+     license='BSD 2-Clause',
+     ext_modules = [jq_extension],
+-    cmdclass={"build_ext": jq_build_ext},
+     classifiers=[
+         'Development Status :: 4 - Beta',
+         'Intended Audience :: Developers',
+@@ -123,4 +45,3 @@ setup(
+         'Programming Language :: Python :: 3.5',
+     ],
+ )
+-
+-- 
+2.19.2
+
--- a/pkgs/development/python-modules/jsonrpclib-pelix/default.nix
+++ b/pkgs/development/python-modules/jsonrpclib-pelix/default.nix
@ -5,11 +5,11 @@

 buildPythonPackage rec {
  pname = "jsonrpclib-pelix";
-  version = "0.3.2";
+  version = "0.4.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "14d288d1b3d3273cf96a729dd21a2470851c4962be8509f3dd62f0137ff90339";
+    sha256 = "1pimyq95w99ik5av96j0n9i6n12mr9kk0y28jnrq0555d7hmii8r";
  };

  doCheck = false; # test_suite="tests" in setup.py but no tests in pypi.
--- a/pkgs/development/python-modules/pytest-benchmark/default.nix
+++ b/pkgs/development/python-modules/pytest-benchmark/default.nix
@ -11,13 +11,13 @@

 buildPythonPackage rec {
  pname = "pytest-benchmark";
-  version = "3.1.1";
+  version = "3.2.2";

  src = fetchFromGitHub {
    owner = "ionelmc";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1ch079dlc6c9ag74dh4dg6plkmh0h8kn78ari3fgadc75bald71m";
+    sha256 = "1hslzzinpwc1zqhbpllqh3sllmiyk69pcycl7ahr0rz3micgwczj";
  };

  propagatedBuildInputs = [ pytest py-cpuinfo ] ++ lib.optional (pythonOlder "3.4") [ pathlib statistics ];
--- a/pkgs/development/python-modules/python-gitlab/default.nix
+++ b/pkgs/development/python-modules/python-gitlab/default.nix
@ -2,11 +2,11 @@

 buildPythonPackage rec {
  pname   = "python-gitlab";
-  version = "1.6.0";
+  version = "1.7.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "20ceb9232f9a412ce6554056a6b5039013d0755261d57b5c8ada7035773de795";
+    sha256 = "17nh09c28vf2daamyq97bdzgr685lyh668haisqbbp5lkn9gh7j0";
  };

  propagatedBuildInputs = [ requests six ];
--- a/pkgs/development/python-modules/recommonmark/default.nix
+++ b/pkgs/development/python-modules/recommonmark/default.nix
@ -1,26 +1,30 @@
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
 , pytest
-, sphinx
-, CommonMark_54
+, CommonMark
 , docutils
+, sphinx
 }:

 buildPythonPackage rec {
  pname = "recommonmark";
-  version = "0.4.0";
+  version = "0.5.0";

-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "6e29c723abcf5533842376d87c4589e62923ecb6002a8e059eb608345ddaff9d";
+  # PyPI tarball is missing some test files: https://github.com/rtfd/recommonmark/pull/128
+  src = fetchFromGitHub {
+    owner = "rtfd";
+    repo = pname;
+    rev = version;
+    sha256 = "04bjqx2hczmg7rnj2rpsjk7h24diwk83s6fhgrxk00k40w2bpz5j";
  };

-  checkInputs = [ pytest sphinx ];
-  propagatedBuildInputs = [ CommonMark_54 docutils ];
+  checkInputs = [ pytest ];
+  propagatedBuildInputs = [ CommonMark docutils sphinx ];

-  # No tests in archive
-  doCheck = false;
+  checkPhase = ''
+    py.test
+  '';

  meta = {
    description = "A docutils-compatibility bridge to CommonMark";
@ -28,4 +32,4 @@ buildPythonPackage rec {
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ fridh ];
  };
-}
+}
--- a/pkgs/development/python-modules/trio/default.nix
+++ b/pkgs/development/python-modules/trio/default.nix
@ -15,12 +15,12 @@

 buildPythonPackage rec {
  pname = "trio";
-  version = "0.9.0";
+  version = "0.10.0";
  disabled = pythonOlder "3.5";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "6d905d950dfa1db3fad6b5ef5637c221947123fd2b0e112033fecfc582318c3b";
+    sha256 = "1c1snnhjg8l87ygf5p9z2qjcq090mws5w7pr9aaiava0yqawq8yk";
  };

  checkInputs = [ pytest pyopenssl trustme jedi pylint ];
--- a/pkgs/development/ruby-modules/gem-config/default.nix
+++ b/pkgs/development/ruby-modules/gem-config/default.nix
@ -297,13 +297,16 @@ in
    buildInputs = [ rainbow_rake ];
  };

-  rbnacl = spec: {
-    postInstall = ''
-    sed -i $(cat $out/nix-support/gem-meta/install-path)/lib/rbnacl.rb -e "2a \
-    RBNACL_LIBSODIUM_GEM_LIB_PATH = '${libsodium.out}/lib/libsodium${stdenv.hostPlatform.extensions.sharedLibrary}'
-    "
-    '';
-  };
+  rbnacl = spec:
+    if lib.versionOlder spec.version "6.0.0" then {
+      postInstall = ''
+        sed -i $(cat $out/nix-support/gem-meta/install-path)/lib/rbnacl.rb -e "2a \
+        RBNACL_LIBSODIUM_GEM_LIB_PATH = '${libsodium.out}/lib/libsodium${stdenv.hostPlatform.extensions.sharedLibrary}'
+        "
+      '';
+    } else {
+      buildInputs = [ libsodium ];
+    };

  re2 = attrs: {
    buildInputs = [ re2 ];
--- a/pkgs/development/tools/ammonite/default.nix
+++ b/pkgs/development/tools/ammonite/default.nix
@ -5,12 +5,12 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
  name = "ammonite-${version}";
-  version = "1.6.0";
+  version = "1.6.2";
  scalaVersion = "2.12";

  src = fetchurl {
    url = "https://github.com/lihaoyi/Ammonite/releases/download/${version}/${scalaVersion}-${version}";
-    sha256 = "17c6ps5i48hcjj7r6xw8mrqhy4cs7qsa787l36f30757hi1cx4qy";
+    sha256 = "0am21zrnl48d397ll4pfsrgk079jb7x8z9kpfm6fz9hznrbl12hl";
  };

  propagatedBuildInputs = [ jre ] ;
--- a/pkgs/development/tools/analysis/brakeman/default.nix
+++ b/pkgs/development/tools/analysis/brakeman/default.nix
@ -4,8 +4,8 @@ buildRubyGem rec {
  inherit ruby;
  name = "${gemName}-${version}";
  gemName = "brakeman";
-  version = "4.3.1";
-  source.sha256 = "1y4i4vw7hawypvgg04s544fqx52ml67h9zxsaqm8w5hvxmb20wkh";
+  version = "4.4.0";
+  source.sha256 = "1fg37qknz1f10v4fgbn1s98gks0iimsgs1c8xra2jy16kpz4q86k";

  meta = with lib; {
    description = "Static analysis security scanner for Ruby on Rails";
--- a/pkgs/development/tools/build-managers/bloop/default.nix
+++ b/pkgs/development/tools/build-managers/bloop/default.nix
@ -2,7 +2,7 @@

 let
  baseName = "bloop";
-  version = "1.2.1";
+  version = "1.2.3";
  deps = stdenv.mkDerivation {
    name = "${baseName}-deps-${version}";
    buildCommand = ''
@ -16,14 +16,14 @@ let
    '';
    outputHashMode = "recursive";
    outputHashAlgo = "sha256";
-    outputHash     = "1hr9d9fzp1vd60iqxbn316vzgayhsx9cffl1jclmdycqv0yzgfx3";
+    outputHash     = "0d0q4rzz21afzfclm3sjp940wk7p8cllbxsidr6rg3r1qqhzawlr";
  };
 in
 stdenv.mkDerivation rec {
  name = "${baseName}-${version}";

  # Fetched from https://github.com/scalacenter/bloop/releases/download/v${version}/install.py
-  nailgunCommit = "933f482b";
+  nailgunCommit = "0c325237";

  buildInputs = [ jdk makeWrapper deps ];

--- a/pkgs/development/tools/flatpak-builder/default.nix
+++ b/pkgs/development/tools/flatpak-builder/default.nix
@ -37,7 +37,7 @@
 }:

 let
-  version = "1.0.1";
+  version = "1.0.2";
 in stdenv.mkDerivation rec {
  name = "flatpak-builder-${version}";

@ -45,7 +45,7 @@ in stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://github.com/flatpak/flatpak-builder/releases/download/${version}/${name}.tar.xz";
-    sha256 = "01p3j8ndk9bimnqibw3dyny0ysv6nw2f7z5im19s9jlhlzdqb48w";
+    sha256 = "0z5aaw9zvgp26szbysa3059gqsivq5ah8b6l29mqxx6ryp1nhrc1";
  };

  nativeBuildInputs = [
--- a/pkgs/games/0ad/data.nix
+++ b/pkgs/games/0ad/data.nix
@ -6,7 +6,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "http://releases.wildfiregames.com/0ad-${version}-alpha-unix-data.tar.xz";
-    sha256 = "1b6qcvd8yyyxavgdwpcs7asmln3xgnvjkglz6ggvwb956x37ggzx";
+    sha256 = "04x7729hk6zw1xj3n4s4lvaviijsnbjf5rhzvjxlr5fygvg4l6z1";
  };

  installPhase = ''
--- a/pkgs/games/0ad/game.nix
+++ b/pkgs/games/0ad/game.nix
@ -10,11 +10,11 @@ assert withEditor -> wxGTK != null;

 stdenv.mkDerivation rec {
  name = "0ad-${version}";
-  version = "0.0.23";
+  version = "0.0.23b";

  src = fetchurl {
    url = "http://releases.wildfiregames.com/0ad-${version}-alpha-unix-build.tar.xz";
-    sha256 = "0qz1sg4n5y766qwgi63drrrx6k17kk0rcnn9a4a9crllk2vf78fg";
+    sha256 = "0draa53xg69i5qhqym85658m45xhwkbiimaldj4sr3703rjgggq1";
  };

  nativeBuildInputs = [ python2 perl pkgconfig ];
--- a/pkgs/os-specific/linux/android-udev-rules/default.nix
+++ b/pkgs/os-specific/linux/android-udev-rules/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  name = "android-udev-rules-${version}";
-  version = "20181031";
+  version = "20190114";

  src = fetchFromGitHub {
    owner = "M0Rf30";
    repo = "android-udev-rules";
    rev = version;
-    sha256 = "175js0vimv6b92cxl0sc4ihdj1k8yq3jrpbjy0zsvrm2367z7xqp";
+    sha256 = "1x3vaq8jpnfhxc2lzz5jnlz219w66sn151v5fkdgv68pya4nzhjj";
  };

  installPhase = ''
--- a/pkgs/os-specific/linux/atop/default.nix
+++ b/pkgs/os-specific/linux/atop/default.nix
@ -1,12 +1,12 @@
 {stdenv, fetchurl, zlib, ncurses}:

 stdenv.mkDerivation rec {
-  version = "2.3.0";
+  version = "2.4.0";
  name = "atop-${version}";

  src = fetchurl {
    url = "https://www.atoptool.nl/download/atop-${version}.tar.gz";
-    sha256 = "0r5j9q89wpylmg0px5xymxi3jpihw9wq8bh37g3ciymsw1fp5r3k";
+    sha256 = "0s9xlxlzz688a80zxld840zkrmzw998rdkkg6yc7ssq8fw50275y";
  };

  buildInputs = [zlib ncurses];
--- a/pkgs/os-specific/linux/busybox/default.nix
+++ b/pkgs/os-specific/linux/busybox/default.nix
@ -106,5 +106,6 @@ stdenv.mkDerivation rec {
    license = licenses.gpl2;
    maintainers = with maintainers; [ ];
    platforms = platforms.linux;
+    priority = 10;
  };
 }
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@ -22,14 +22,10 @@ rec {
  beta = stable;

  stable_415 = generic {
-    version = "415.25";
-    sha256_64bit = "0jck3sjhkdf9j40fqa6hpm2m9i11bfka9diaxmk2apni4f4mpdk4";
-    settingsSha256 = "0x5a9dhr29g67rbgl1w973fzgjfg1lyn3dpq7fpc7chfp91vxzrp";
-    persistencedSha256 = "0z1d7hrz7zvi4x3ir1c3gcfpsj57wdr5pylvmjhdi3x47cb1w34f";
-
-    patches = lib.optional (kernel.meta.branch == "4.20") [
-      ./atomic64_t.patch
-    ];
+    version = "415.27";
+    sha256_64bit = "12ylf1h1wpgkd0g7r30c33hhhialn315k5sbxyzks0rm42k7cay8";
+    settingsSha256 = "0m8hfxb6fhanqlkkk4ayn1blgdsvnn0ipxdl19ifdl200ln6j053";
+    persistencedSha256 = "0i6ik6xv6rnwcd6vg5xrxcd9g7nzca3vkiy2srbv0simw86nwgdz";
  };

  # Last one supporting x86
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@ -158,7 +158,7 @@ in {
  # to be adapted
  zfsStable = common {
    # comment/uncomment if breaking kernel versions are known
-    # incompatibleKernelVersion = "4.19";
+    incompatibleKernelVersion = "4.20";

    # this package should point to the latest release.
    version = "0.7.12";
--- a/pkgs/servers/ftp/vsftpd/default.nix
+++ b/pkgs/servers/ftp/vsftpd/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, openssl, sslEnable ? false, libcap, pam }:
+{ stdenv, fetchurl, libcap, openssl, pam }:

 stdenv.mkDerivation rec {
  name = "vsftpd-3.0.3";
@ -8,44 +8,29 @@ stdenv.mkDerivation rec {
    sha256 = "1xsyjn68k3fgm2incpb3lz2nikffl9by2safp994i272wvv2nkcx";
  };

+  buildInputs = [ libcap openssl pam ];
+
  patches = [ ./CVE-2015-1419.patch ];

-  preConfigure = stdenv.lib.optionalString sslEnable ''
-    echo "Will enable SSL"
+  postPatch = ''
    sed -i "/VSF_BUILD_SSL/s/^#undef/#define/" builddefs.h
+
+    substituteInPlace Makefile \
+      --replace -dirafter "" \
+      --replace /usr $out \
+      --replace /etc $out/etc
+
+    mkdir -p $out/sbin $out/man/man{5,8}
  '';

-  # The gcc-wrappers use -idirafter for glibc, and vsftpd also, and
-  # their dummyinc come before those of glibc, then the build works bad.
-  prePatch = ''
-    sed -i -e 's/-idirafter.*//' Makefile
-  '';
+  NIX_LDFLAGS = "-lcrypt -lssl -lcrypto -lpam -lcap";

-  preBuild =
-    let
-      sslLibs = if sslEnable then "-lcrypt -lssl -lcrypto" else "";
-    in ''
-      makeFlagsArray=( "LIBS=${sslLibs} -lpam -lcap -fstack-protector" )
-    '';
+  enableParallelBuilding = true;

-  # It won't link without this flag, used in CFLAGS
-
-  buildInputs = [ openssl libcap pam ];
-
-  installPhase = ''
-    mkdir -pv $out/sbin
-    install -v -m 755 vsftpd $out/sbin/vsftpd
-
-    mkdir -pv $out/share/man/man{5,8}
-    install -v -m 644 vsftpd.8 $out/share/man/man8/vsftpd.8
-    install -v -m 644 vsftpd.conf.5 $out/share/man/man5/vsftpd.conf.5
-
-    mkdir -pv $out/etc/xinetd.d
-    install -v -m 644 xinetd.d/vsftpd $out/etc/xinetd.d/vsftpd
-  '';
-
-  meta = {
-    platforms = stdenv.lib.platforms.linux;
-    license = stdenv.lib.licenses.gpl2;
+  meta = with stdenv.lib; {
+    description = "A very secure FTP daemon";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ peterhoeg ];
+    platforms = platforms.linux;
  };
 }
--- a/pkgs/servers/home-assistant/dont-import-platformio-esptool.patch
+++ b/pkgs/servers/home-assistant/dont-import-platformio-esptool.patch
@ -0,0 +1,119 @@
+diff --git a/esphomeyaml/__main__.py b/esphomeyaml/__main__.py
+index 26f42c1..529d2e0 100644
+--- a/esphomeyaml/__main__.py
+++ b/esphomeyaml/__main__.py
+@@ -167,13 +167,10 @@ def compile_program(args, config):
+ 
+ 
+ def upload_using_esptool(config, port):
+-    import esptool
+-
+     path = os.path.join(CORE.build_path, '.pioenvs', CORE.name, 'firmware.bin')
+-    cmd = ['esptool.py', '--before', 'default_reset', '--after', 'hard_reset',
+    cmd = ['@esptool@/bin/esptool.py', '--before', 'default_reset', '--after', 'hard_reset',
+            '--chip', 'esp8266', '--port', port, 'write_flash', '0x0', path]
+-    # pylint: disable=protected-access
+-    return run_external_command(esptool._main, *cmd)
+    return run_external_command(*cmd)
+ 
+ 
+ def upload_program(config, args, host):
+diff --git a/esphomeyaml/platformio_api.py b/esphomeyaml/platformio_api.py
+index df29491..f991701 100644
+--- a/esphomeyaml/platformio_api.py
+++ b/esphomeyaml/platformio_api.py
+@@ -13,12 +13,9 @@ _LOGGER = logging.getLogger(__name__)
+ 
+ 
+ def run_platformio_cli(*args, **kwargs):
+-    import platformio.__main__
+-
+     os.environ["PLATFORMIO_FORCE_COLOR"] = "true"
+-    cmd = ['platformio'] + list(args)
+-    return run_external_command(platformio.__main__.main,
+-                                *cmd, **kwargs)
+    cmd = ['@platformio@/bin/platformio'] + list(args)
+    return run_external_command(*cmd, **kwargs)
+ 
+ 
+ def run_platformio_cli_run(config, verbose, *args, **kwargs):
+diff --git a/esphomeyaml/util.py b/esphomeyaml/util.py
+index eebb4b7..9e9e58f 100644
+--- a/esphomeyaml/util.py
+++ b/esphomeyaml/util.py
+@@ -4,6 +4,7 @@ import io
+ import logging
+ import re
+ import sys
+import subprocess
+ 
+ _LOGGER = logging.getLogger(__name__)
+ 
+@@ -79,42 +80,25 @@ class RedirectText(object):
+         return True
+ 
+ 
+-def run_external_command(func, *cmd, **kwargs):
+-    def mock_exit(return_code):
+-        raise SystemExit(return_code)
+-
+-    orig_argv = sys.argv
+-    orig_exit = sys.exit  # mock sys.exit
+def run_external_command(*cmd, **kwargs):
+     full_cmd = u' '.join(shlex_quote(x) for x in cmd)
+     _LOGGER.info(u"Running:  %s", full_cmd)
+ 
+-    orig_stdout = sys.stdout
+-    sys.stdout = RedirectText(sys.stdout)
+-    orig_stderr = sys.stderr
+-    sys.stderr = RedirectText(sys.stderr)
+-
+     capture_stdout = kwargs.get('capture_stdout', False)
+     if capture_stdout:
+-        cap_stdout = sys.stdout = io.BytesIO()
+        cap_stdout = io.BytesIO()
+    else:
+        cap_stdout = sys.stdout
+ 
+     try:
+-        sys.argv = list(cmd)
+-        sys.exit = mock_exit
+-        return func() or 0
+-    except KeyboardInterrupt:
+-        return 1
+-    except SystemExit as err:
+-        return err.args[0]
+        completed_process = subprocess.run(cmd,
+                                           stdout=RedirectText(cap_stdout),
+                                           stderr=RedirectText(sys.stderr))
+        return completed_process.returncode
+     except Exception as err:  # pylint: disable=broad-except
+         _LOGGER.error(u"Running command failed: %s", err)
+         _LOGGER.error(u"Please try running %s locally.", full_cmd)
+     finally:
+-        sys.argv = orig_argv
+-        sys.exit = orig_exit
+-
+-        sys.stdout = orig_stdout
+-        sys.stderr = orig_stderr
+-
+         if capture_stdout:
+             # pylint: disable=lost-exception
+             return cap_stdout.getvalue()
+diff --git a/setup.py b/setup.py
+index 78a5378..8ce80de 100755
+--- a/setup.py
+++ b/setup.py
+@@ -23,12 +23,10 @@ DOWNLOAD_URL = '{}/archive/{}.zip'.format(GITHUB_URL, const.__version__)
+ 
+ REQUIRES = [
+     'voluptuous>=0.11.1',
+-    'platformio>=3.5.3',
+     'pyyaml>=3.12',
+     'paho-mqtt>=1.3.1',
+     'colorlog>=3.1.2',
+     'tornado>=5.0.0',
+-    'esptool>=2.3.1',
+     'typing>=3.0.0',
+     'protobuf>=3.4',
+     'tzlocal>=1.4',
--- a/pkgs/servers/home-assistant/esphome.nix
+++ b/pkgs/servers/home-assistant/esphome.nix
@ -0,0 +1,43 @@
+{ lib, python3, fetchpatch, substituteAll, platformio, esptool }:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "esphomeyaml";
+  version = "1.10.1";
+
+  src = python3.pkgs.fetchPypi {
+    inherit pname version;
+    sha256 = "426cd545b4e9505ce5b4f5c63d2d54cb038f93fe3ba9d4d56b6b6431b222485d";
+  };
+
+  patches = [
+    (substituteAll {
+      src = ./dont-import-platformio-esptool.patch;
+      inherit platformio esptool;
+    })
+  ];
+
+  postPatch = ''
+     # typing is part of the standard library since Python 3.5
+     substituteInPlace setup.py --replace "'typing>=3.0.0'," ""
+  '';
+
+  propagatedBuildInputs = with python3.pkgs; [
+    voluptuous pyyaml paho-mqtt colorlog
+    tornado protobuf tzlocal pyserial
+  ];
+
+  checkPhase = ''
+    $out/bin/esphomeyaml tests/test1.yaml compile
+    $out/bin/esphomeyaml tests/test2.yaml compile
+  '';
+
+  # Platformio will try to access the network
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Make creating custom firmwares for ESP32/ESP8266 super easy";
+    homepage = https://esphomelib.com/esphomeyaml;
+    license = licenses.mit;
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}
--- a/pkgs/servers/zoneminder/default-to-http-1dot1.patch
+++ b/pkgs/servers/zoneminder/default-to-http-1dot1.patch
@ -0,0 +1,13 @@
+diff --git a/scripts/ZoneMinder/lib/ZoneMinder/ConfigData.pm.in b/scripts/ZoneMinder/lib/ZoneMinder/ConfigData.pm.in
+index fa7b86079..c9d3c6f6c 100644
+--- a/scripts/ZoneMinder/lib/ZoneMinder/ConfigData.pm.in
+++ b/scripts/ZoneMinder/lib/ZoneMinder/ConfigData.pm.in
+@@ -877,7 +877,7 @@ our @options = (
+   },
+   {
+     name        => 'ZM_HTTP_VERSION',
+-    default     => '1.0',
+    default     => '1.1',
+     description => 'The version of HTTP that ZoneMinder will use to connect',
+     help        => q`
+       ZoneMinder can communicate with network cameras using either of
--- a/pkgs/servers/zoneminder/default.nix
+++ b/pkgs/servers/zoneminder/default.nix
@ -0,0 +1,192 @@
+{ stdenv, lib, fetchFromGitHub, fetchurl, cmake, makeWrapper, pkgconfig
+, curl, ffmpeg, glib, libjpeg, libselinux, libsepol, mp4v2, mysql, nettools, pcre, perl, perlPackages
+, polkit, utillinuxMinimal, x264, zlib
+, avahi, dbus, gettext, git, gnutar, gzip, bzip2, libiconv, openssl, python
+, coreutils, procps, psmisc }:
+
+# NOTES:
+#
+# 1. ZM_CONFIG_DIR is set to $out/etc/zoneminder as the .conf file distributed
+# by upstream contains defaults and is not supposed to be edited so it is fine
+# to keep it read-only.
+#
+# 2. ZM_CONFIG_SUBDIR is where we place our configuration from the NixOS module
+# but as the installer will try to put files there, we patch Config.pm after the
+# install.
+#
+# 3. ZoneMinder is run with -T passed to the perl interpreter which makes perl
+# ignore PERL5LIB. We therefore have to do the substitution into -I parameters
+# ourselves which results in ugly wrappers.
+#
+# 4. The makefile for the perl modules needs patching to put things into the
+# right place. That also means we have to not run "make install" for them.
+#
+# 5. In principal the various ZM_xx variables should be overridable from the
+# config file but some of them are baked into the perl scripts, so we *have* to
+# set them here instead of in the configuration in the NixOS module.
+#
+# 6. I am no PolicyKit expert but the .policy file looks fishy:
+#   a. The user needs to be known at build-time so we should probably throw
+#   upstream's policy file away and generate it from the NixOS module
+#   b. I *think* we may have to substitute the store paths with
+#   /run/current-system/sw/bin paths for it to work.
+#
+# 7. we manually fix up the perl paths in the scripts as fixupPhase will only
+# handle pkexec and not perl if both are present.
+#
+# 8. There are several perl modules needed at runtime which are not checked when
+# building so if a new version stops working, check if there is a missing
+# dependency by running the failing component manually.
+#
+# 9. Parts of the web UI has a hardcoded /zm path so we create a symlink to work
+# around it.
+
+let
+  modules = [
+    {
+      path = "web/api/app/Plugin/Crud";
+      src = fetchFromGitHub {
+        owner = "ZoneMinder";
+        repo = "crud";
+        rev = "3.1.0-zm";
+        sha256 = "061avzyml7mla4hlx057fm8a9yjh6m6qslgyzn74cv5p2y7f463l";
+      };
+    }
+    {
+      path = "web/api/app/Plugin/CakePHP-Enum-Behavior";
+      src = fetchFromGitHub {
+        owner = "ZoneMinder";
+        repo = "CakePHP-Enum-Behavior";
+        rev = "1.0-zm";
+        sha256 = "0zsi6s8xymb183kx3szspbrwfjqcgga7786zqvydy6hc8c909cgx";
+      };
+    }
+  ];
+
+  addons = [
+    {
+      path = "scripts/ZoneMinder/lib/ZoneMinder/Control/Xiaomi.pm";
+      src = fetchurl {
+        url = "https://gist.githubusercontent.com/joshstrange/73a2f24dfaf5cd5b470024096ce2680f/raw/e964270c5cdbf95e5b7f214f7f0fc6113791530e/Xiaomi.pm";
+        sha256 = "04n1ap8fx66xfl9q9rypj48pzbgzikq0gisfsfm8wdsmflarz43v";
+      };
+    }
+  ];
+
+  user    = "zoneminder";
+  dirName = "zoneminder";
+  perlBin = "${perl}/bin/perl";
+
+in stdenv.mkDerivation rec {
+  name = "zoneminder-${version}";
+  version = "1.32.3";
+
+  src = fetchFromGitHub {
+    owner  = "ZoneMinder";
+    repo   = "zoneminder";
+    rev    = version;
+    sha256 = "1sx2fn99861zh0gp8g53ynr1q6yfmymxamn82y54jqj6nv475njz";
+  };
+
+  patches = [
+    ./default-to-http-1dot1.patch
+  ];
+
+  postPatch = ''
+    ${lib.concatStringsSep "\n" (map (e: ''
+      rm -rf ${e.path}/*
+      cp -r ${e.src}/* ${e.path}/
+    '') modules)}
+
+    rm -rf web/api/lib/Cake/Test
+
+    ${lib.concatStringsSep "\n" (map (e: ''
+      cp ${e.src} ${e.path}
+    '') addons)}
+
+    for d in scripts/ZoneMinder onvif/{modules,proxy} ; do
+      substituteInPlace $d/CMakeLists.txt \
+        --replace 'DESTDIR="''${CMAKE_CURRENT_BINARY_DIR}/output"' "PREFIX=$out INSTALLDIRS=site"
+      sed -i '/^install/d' $d/CMakeLists.txt
+    done
+
+    substituteInPlace misc/CMakeLists.txt \
+      --replace '"''${PC_POLKIT_PREFIX}/''${CMAKE_INSTALL_DATAROOTDIR}' "\"$out/share"
+
+    for f in misc/*.policy.in \
+             scripts/*.pl* \
+             scripts/ZoneMinder/lib/ZoneMinder/Memory.pm.in ; do
+      substituteInPlace $f \
+        --replace '/usr/bin/perl' '${perlBin}' \
+        --replace '/bin:/usr/bin' "$out/bin:${lib.makeBinPath [ coreutils procps psmisc ]}"
+    done
+
+    substituteInPlace scripts/zmdbbackup.in \
+      --replace /usr/bin/mysqldump ${mysql}/bin/mysqldump
+
+    for f in scripts/ZoneMinder/lib/ZoneMinder/Config.pm.in \
+             scripts/zmupdate.pl.in \
+             src/zm_config.h.in \
+             web/api/app/Config/bootstrap.php.in \
+             web/includes/config.php.in ; do
+      substituteInPlace $f --replace @ZM_CONFIG_SUBDIR@ /etc/zoneminder
+    done
+
+   for f in includes/Event.php views/image.php skins/classic/views/image-ffmpeg.php ; do
+     substituteInPlace web/$f \
+       --replace "'ffmpeg " "'${ffmpeg}/bin/ffmpeg "
+   done
+  '';
+
+  buildInputs = [
+    curl ffmpeg glib libjpeg libselinux libsepol mp4v2 mysql pcre perl polkit x264 zlib
+    utillinuxMinimal # for libmount
+  ] ++ (with perlPackages; [
+    DateManip DBI DBDmysql LWP SysMmap
+    # runtime dependencies not checked at build-time
+    JSONMaybeXS LWPProtocolHttps NumberBytesHuman SysCPU SysMemInfo TimeDate
+  ]);
+
+  nativeBuildInputs = [ cmake makeWrapper pkgconfig ];
+
+  enableParallelBuilding = true;
+
+  cmakeFlags = [
+    "-DWITH_SYSTEMD=ON"
+    "-DZM_LOGDIR=/var/log/${dirName}"
+    "-DZM_RUNDIR=/run/${dirName}"
+    "-DZM_SOCKDIR=/run/${dirName}"
+    "-DZM_TMPDIR=/tmp/${dirName}"
+    "-DZM_CONFIG_DIR=${placeholder "out"}/etc/zoneminder"
+    "-DZM_WEB_USER=${user}"
+    "-DZM_WEB_GROUP=${user}"
+  ];
+
+  passthru = { inherit dirName; };
+
+  postInstall = ''
+    PERL5LIB="$PERL5LIB''${PERL5LIB:+:}$out/${perl.libPrefix}"
+
+    perlFlags="-wT"
+    for i in $(IFS=$'\n'; echo $PERL5LIB | tr ':' "\n" | sort -u); do
+      perlFlags="$perlFlags -I$i"
+    done
+
+    for f in $out/bin/*.pl ; do
+      mv $f $out/libexec/
+      makeWrapper ${perlBin} $f \
+        --prefix PATH : $out/bin \
+        --add-flags "$perlFlags $out/libexec/$(basename $f)"
+    done
+
+    ln -s $out/share/zoneminder/www $out/share/zoneminder/www/zm
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Video surveillance software system";
+    homepage = https://zoneminder.com;
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ peterhoeg ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/tools/admin/pulumi/default.nix
+++ b/pkgs/tools/admin/pulumi/default.nix
@ -1,18 +1,20 @@
-{ stdenv, fetchurl }:
+{ lib, stdenv, fetchurl, autoPatchelfHook }:
+
+with lib;

 let

-  version = "0.16.7";
+  version = "0.16.11";

  # switch the dropdown to “manual” on https://pulumi.io/quickstart/install.html # TODO: update script
  pulumiArchPackage = {
    "x86_64-linux" = {
      url = "https://get.pulumi.com/releases/sdk/pulumi-v${version}-linux-x64.tar.gz";
-      sha256 = "1l1cn8pk05vl7vpmhny9rlz1hj0iqclqjj1r2q12qip7f4qkgsfw";
+      sha256 = "176nwqp1dd8vdpl4qajaq2w458f8pgavwvwd93lgnccqw3cznv75";
    };
    "x86_64-darwin" = {
      url = "https://get.pulumi.com/releases/sdk/pulumi-v${version}-darwin-x64.tar.gz";
-      sha256 = "0p07jvgy0xl524fgb5d9wijxa91isv4h4mcn9qghycqj90yqnjhx";
+      sha256 = "1mkz9bkkvpvbpzfnvwpx4892zd05bvjz5rbfwhwzm3wzfcjjs16i";
    };
  };

@ -27,7 +29,9 @@ in stdenv.mkDerivation rec {
    cp * $out/bin/
  '';

-  meta = with stdenv.lib; {
+  buildInputs = optionals stdenv.isLinux [ autoPatchelfHook ];
+
+  meta = {
    homepage = https://pulumi.io/;
    description = "Pulumi is a cloud development platform that makes creating cloud programs easy and productive";
    license = with licenses; [ asl20 ];
--- a/pkgs/tools/bluetooth/blueman/default.nix
+++ b/pkgs/tools/bluetooth/blueman/default.nix
@ -9,11 +9,11 @@ let

 in stdenv.mkDerivation rec {
  name = "blueman-${version}";
-  version = "2.0.7";
+  version = "2.0.8";

  src = fetchurl {
    url = "https://github.com/blueman-project/blueman/releases/download/${version}/${name}.tar.xz";
-    sha256 = "15q253081ahmb8k3yaqy99pc7ppbq3pxrx35bg4q9jmn6xv2kj63";
+    sha256 = "0kkh6jppqcn3yf70vnny1l015kxrz3dxw4g774gl02lh9ixx1bq4";
  };

  nativeBuildInputs = [
--- a/pkgs/tools/misc/youtube-dl/default.nix
+++ b/pkgs/tools/misc/youtube-dl/default.nix
@ -19,11 +19,11 @@ buildPythonPackage rec {
  # The websites youtube-dl deals with are a very moving target. That means that
  # downloads break constantly. Because of that, updates should always be backported
  # to the latest stable release.
-  version = "2019.01.16";
+  version = "2019.01.17";

  src = fetchurl {
    url = "https://yt-dl.org/downloads/${version}/${pname}-${version}.tar.gz";
-    sha256 = "1dhbr5n0l6dgjp1620jp30kaizrzagacrj64gd9pwy1916kjm7si";
+    sha256 = "0fxajwv81b0bjw9qlwmxd4r93yp5nnqll79vhic0vy72ii0093r7";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/tools/misc/yubikey-manager/default.nix
+++ b/pkgs/tools/misc/yubikey-manager/default.nix
@ -1,17 +1,16 @@
-{ pythonPackages, fetchurl, lib,
+{ python3Packages, fetchurl, lib,
  yubikey-personalization, libu2f-host, libusb1 }:

-pythonPackages.buildPythonPackage rec {
-  name = "yubikey-manager-1.0.1";
+python3Packages.buildPythonPackage rec {
+  name = "yubikey-manager-2.0.0";

  srcs = fetchurl {
    url = "https://developers.yubico.com/yubikey-manager/Releases/${name}.tar.gz";
-    sha256 = "0i7w1f89hqlw7g800fjhbb6yvq9wjmj5d7w7p6v8bkyvk645v48z";
+    sha256 = "1x36pyg9g3by2pa11j6d73d79sdlb7qy98lwwn05f43fjm74qnz9";
  };

  propagatedBuildInputs =
-    with pythonPackages;
-    lib.optional (!pythonPackages.pythonAtLeast "3.4") enum34 ++ [
+    with python3Packages; [
      click
      cryptography
      pyscard
@ -44,6 +43,6 @@ pythonPackages.buildPythonPackage rec {

    license = licenses.bsd2;
    platforms = platforms.unix;
-    maintainers = with maintainers; [ benley ];
+    maintainers = with maintainers; [ benley mic92 ];
  };
 }
--- a/pkgs/tools/security/clamav/default.nix
+++ b/pkgs/tools/security/clamav/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  name = "clamav-${version}";
-  version = "0.101.0";
+  version = "0.101.1";

  src = fetchurl {
    url = "https://www.clamav.net/downloads/production/${name}.tar.gz";
-    sha256 = "1ljs799xkd9ljj833rkwp961iaysqx4hrlyjrbkbvq64dgc5lapi";
+    sha256 = "01mq3z04fjbq5iq8wfwfim72iv3dn04d3ishc5lkhxpmnalqydps";
  };

  # don't install sample config files into the absolute sysconfdir folder
--- a/Show More
+++ b/Show More