Merge staging-next into staging

2024-11-25 16:33:15 +00:00 · 2020-05-11 22:09:27 +02:00 · 2020-05-11 22:09:27 +02:00 · a0b4e664c0
commit a0b4e664c0
parent 629fa8a2d4 568cef433d
178 changed files with 4983 additions and 3297 deletions
--- a/lib/kernel.nix
+++ b/lib/kernel.nix
@ -14,7 +14,7 @@ with lib;
  freeform = x: { freeform = x; };

  /*
-    Common patterns/legacy used in common-config/hardened-config.nix
+    Common patterns/legacy used in common-config/hardened/config.nix
   */
  whenHelpers = version: {
    whenAtLeast = ver: mkIf (versionAtLeast version ver);
--- a/lib/lists.nix
+++ b/lib/lists.nix
@ -73,8 +73,8 @@ rec {
       lconcat [ "a" "b" "c" ]
       => "zabc"
       # different types
-       lstrange = foldl (str: int: str + toString (int + 1)) ""
-       strange [ 1 2 3 4 ]
+       lstrange = foldl (str: int: str + toString (int + 1)) "a"
+       lstrange [ 1 2 3 4 ]
       => "a2345"
  */
  foldl = op: nul: list:
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -5796,6 +5796,12 @@
    githubId = 15930073;
    name = "Moritz Scheuren";
  };
+  pablovsky = {
+    email = "dealberapablo07@gmail.com";
+    github = "pablo1107";
+    githubId = 17091659;
+    name = "Pablo Andres Dealbera";
+  };
  pacien = {
    email = "b4gx3q.nixpkgs@pacien.net";
    github = "pacien";
--- a/nixos/doc/manual/release-notes/rl-2009.xml
+++ b/nixos/doc/manual/release-notes/rl-2009.xml
@ -77,7 +77,9 @@

  <itemizedlist>
   <listitem>
-    <para />
+    <para>
+      There is a new <xref linkend="opt-security.doas.enable"/> module that provides <command>doas</command>, a lighter alternative to <command>sudo</command> with many of the same features.
+    </para>
   </listitem>
  </itemizedlist>

@ -277,6 +279,13 @@ php.override {
 </programlisting>
    </para>
   </listitem>
+   <listitem>
+    <para>
+      The Nginx log directory has been moved to <literal>/var/log/nginx</literal>, the cache directory
+      to <literal>/var/cache/nginx</literal>. The option <literal>services.nginx.stateDir</literal> has
+      been removed.
+    </para>
+   </listitem>
   <listitem>
    <para>
     The httpd web server previously started its main process as root
--- a/nixos/lib/test-driver/test-driver.py
+++ b/nixos/lib/test-driver/test-driver.py
@ -369,7 +369,7 @@ class Machine:
            q = q.replace("'", "\\'")
            return self.execute(
                (
-                    "su -l {} -c "
+                    "su -l {} --shell /bin/sh -c "
                    "$'XDG_RUNTIME_DIR=/run/user/`id -u` "
                    "systemctl --user {}'"
                ).format(user, q)
--- a/nixos/modules/hardware/device-tree.nix
+++ b/nixos/modules/hardware/device-tree.nix
@ -19,7 +19,7 @@ in {
        base = mkOption {
          default = "${config.boot.kernelPackages.kernel}/dtbs";
          defaultText = "\${config.boot.kernelPackages.kernel}/dtbs";
-          example = literalExample "pkgs.deviceTree_rpi";
+          example = literalExample "pkgs.device-tree_rpi";
          type = types.path;
          description = ''
            The package containing the base device-tree (.dtb) to boot. Contains
@ -30,7 +30,7 @@ in {
        overlays = mkOption {
          default = [];
          example = literalExample
-            "[\"\${pkgs.deviceTree_rpi.overlays}/w1-gpio.dtbo\"]";
+            "[\"\${pkgs.device-tree_rpi.overlays}/w1-gpio.dtbo\"]";
          type = types.listOf types.path;
          description = ''
            A path containing device tree overlays (.dtbo) to be applied to all
--- a/nixos/modules/hardware/video/nvidia.nix
+++ b/nixos/modules/hardware/video/nvidia.nix
@ -34,10 +34,12 @@ let
  enabled = nvidia_x11 != null;

  cfg = config.hardware.nvidia;
+
  pCfg = cfg.prime;
  syncCfg = pCfg.sync;
  offloadCfg = pCfg.offload;
  primeEnabled = syncCfg.enable || offloadCfg.enable;
+  nvidiaPersistencedEnabled =  cfg.nvidiaPersistenced;
 in

 {
@ -129,6 +131,15 @@ in
        <option>hardware.nvidia.prime.intelBusId</option>).
      '';
    };
+
+    hardware.nvidia.nvidiaPersistenced = mkOption {
+      default = false;
+      type = types.bool;
+      description = ''
+        Update for NVIDA GPU headless mode, i.e. nvidia-persistenced. It ensures all
+        GPUs stay awake even during headless mode.
+      '';
+    };
  };

  config = mkIf enabled {
@ -220,6 +231,18 @@ in
      ++ optional (nvidia_x11.persistenced != null && config.virtualisation.docker.enableNvidia)
        "L+ /run/nvidia-docker/extras/bin/nvidia-persistenced - - - - ${nvidia_x11.persistenced}/origBin/nvidia-persistenced";

+    systemd.services."nvidia-persistenced" = mkIf nvidiaPersistencedEnabled {
+      description = "NVIDIA Persistence Daemon";
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "forking";
+        Restart = "always";
+        PIDFile = "/var/run/nvidia-persistenced/nvidia-persistenced.pid";
+        ExecStart = "${nvidia_x11.persistenced}/bin/nvidia-persistenced --verbose";
+        ExecStopPost = "${pkgs.coreutils}/bin/rm -rf /var/run/nvidia-persistenced";
+      };
+    };
+
    boot.extraModulePackages = [ nvidia_x11.bin ];

    # nvidia-uvm is required by CUDA applications.
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -200,6 +200,7 @@
  ./security/rtkit.nix
  ./security/wrappers/default.nix
  ./security/sudo.nix
+  ./security/doas.nix
  ./security/systemd-confinement.nix
  ./security/tpm2.nix
  ./services/admin/oxidized.nix
--- a/nixos/modules/security/doas.nix
+++ b/nixos/modules/security/doas.nix
@ -0,0 +1,274 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+  cfg = config.security.doas;
+
+  inherit (pkgs) doas;
+
+  mkUsrString = user: toString user;
+
+  mkGrpString = group: ":${toString group}";
+
+  mkOpts = rule: concatStringsSep " " [
+    (optionalString rule.noPass "nopass")
+    (optionalString rule.persist "persist")
+    (optionalString rule.keepEnv "keepenv")
+    "setenv { SSH_AUTH_SOCK ${concatStringsSep " " rule.setEnv} }"
+  ];
+
+  mkArgs = rule:
+    if (isNull rule.args) then ""
+    else if (length rule.args == 0) then "args"
+    else "args ${concatStringsSep " " rule.args}";
+
+  mkRule = rule:
+    let
+      opts = mkOpts rule;
+
+      as = optionalString (!isNull rule.runAs) "as ${rule.runAs}";
+
+      cmd = optionalString (!isNull rule.cmd) "cmd ${rule.cmd}";
+
+      args = mkArgs rule;
+    in
+    optionals (length cfg.extraRules > 0) [
+      (
+        optionalString (length rule.users > 0)
+          (map (usr: "permit ${opts} ${mkUsrString usr} ${as} ${cmd} ${args}") rule.users)
+      )
+      (
+        optionalString (length rule.groups > 0)
+          (map (grp: "permit ${opts} ${mkGrpString grp} ${as} ${cmd} ${args}") rule.groups)
+      )
+    ];
+in
+{
+
+  ###### interface
+
+  options.security.doas = {
+
+    enable = mkOption {
+      type = with types; bool;
+      default = false;
+      description = ''
+        Whether to enable the <command>doas</command> command, which allows
+        non-root users to execute commands as root.
+      '';
+    };
+
+    wheelNeedsPassword = mkOption {
+      type = with types; bool;
+      default = true;
+      description = ''
+        Whether users of the <code>wheel</code> group must provide a password to
+        run commands as super user via <command>doas</command>.
+      '';
+    };
+
+    extraRules = mkOption {
+      default = [];
+      description = ''
+        Define specific rules to be set in the
+        <filename>/etc/doas.conf</filename> file. More specific rules should
+        come after more general ones in order to yield the expected behavior.
+        You can use <code>mkBefore</code> and/or <code>mkAfter</code> to ensure
+        this is the case when configuration options are merged.
+      '';
+      example = literalExample ''
+        [
+          # Allow execution of any command by any user in group doas, requiring
+          # a password and keeping any previously-defined environment variables.
+          { groups = [ "doas" ]; noPass = false; keepEnv = true; }
+
+          # Allow execution of "/home/root/secret.sh" by user `backup` OR user
+          # `database` OR any member of the group with GID `1006`, without a
+          # password.
+          { users = [ "backup" "database" ]; groups = [ 1006 ];
+            cmd = "/home/root/secret.sh"; noPass = true; }
+
+          # Allow any member of group `bar` to run `/home/baz/cmd1.sh` as user
+          # `foo` with argument `hello-doas`.
+          { groups = [ "bar" ]; runAs = "foo";
+            cmd = "/home/baz/cmd1.sh"; args = [ "hello-doas" ]; }
+
+          # Allow any member of group `bar` to run `/home/baz/cmd2.sh` as user
+          # `foo` with no arguments.
+          { groups = [ "bar" ]; runAs = "foo";
+            cmd = "/home/baz/cmd2.sh"; args = [ ]; }
+
+          # Allow user `abusers` to execute "nano" and unset the value of
+          # SSH_AUTH_SOCK, override the value of ALPHA to 1, and inherit the
+          # value of BETA from the current environment.
+          { users = [ "abusers" ]; cmd = "nano";
+            setEnv = [ "-SSH_AUTH_SOCK" "ALPHA=1" "BETA" ]; }
+        ]
+      '';
+      type = with types; listOf (
+        submodule {
+          options = {
+
+            noPass = mkOption {
+              type = with types; bool;
+              default = false;
+              description = ''
+                If <code>true</code>, the user is not required to enter a
+                password.
+              '';
+            };
+
+            persist = mkOption {
+              type = with types; bool;
+              default = false;
+              description = ''
+                If <code>true</code>, do not ask for a password again for some
+                time after the user successfully authenticates.
+              '';
+            };
+
+            keepEnv = mkOption {
+              type = with types; bool;
+              default = false;
+              description = ''
+                If <code>true</code>, environment variables other than those
+                listed in
+                <citerefentry><refentrytitle>doas</refentrytitle><manvolnum>1</manvolnum></citerefentry>
+                are kept when creating the environment for the new process.
+              '';
+            };
+
+            setEnv = mkOption {
+              type = with types; listOf str;
+              default = [];
+              description = ''
+                Keep or set the specified variables. Variables may also be
+                removed with a leading '-' or set using
+                <code>variable=value</code>. If the first character of
+                <code>value</code> is a '$', the value to be set is taken from
+                the existing environment variable of the indicated name. This
+                option is processed after the default environment has been
+                created.
+
+                NOTE: All rules have <code>setenv { SSH_AUTH_SOCK }</code> by
+                default. To prevent <code>SSH_AUTH_SOCK</code> from being
+                inherited, add <code>"-SSH_AUTH_SOCK"</code> anywhere in this
+                list.
+              '';
+            };
+
+            users = mkOption {
+              type = with types; listOf (either str int);
+              default = [];
+              description = "The usernames / UIDs this rule should apply for.";
+            };
+
+            groups = mkOption {
+              type = with types; listOf (either str int);
+              default = [];
+              description = "The groups / GIDs this rule should apply for.";
+            };
+
+            runAs = mkOption {
+              type = with types; nullOr str;
+              default = null;
+              description = ''
+                Which user or group the specified command is allowed to run as.
+                When set to <code>null</code> (the default), all users are
+                allowed.
+
+                A user can be specified using just the username:
+                <code>"foo"</code>. It is also possible to only allow running as
+                a specific group with <code>":bar"</code>.
+              '';
+            };
+
+            cmd = mkOption {
+              type = with types; nullOr str;
+              default = null;
+              description = ''
+                The command the user is allowed to run. When set to
+                <code>null</code> (the default), all commands are allowed.
+
+                NOTE: It is best practice to specify absolute paths. If a
+                relative path is specified, only a restricted PATH will be
+                searched.
+              '';
+            };
+
+            args = mkOption {
+              type = with types; nullOr (listOf str);
+              default = null;
+              description = ''
+                Arguments that must be provided to the command. When set to
+                <code>[]</code>, the command must be run without any arguments.
+              '';
+            };
+          };
+        }
+      );
+    };
+
+    extraConfig = mkOption {
+      type = with types; lines;
+      default = "";
+      description = ''
+        Extra configuration text appended to <filename>doas.conf</filename>.
+      '';
+    };
+  };
+
+
+  ###### implementation
+
+  config = mkIf cfg.enable {
+
+    security.doas.extraRules = [
+      {
+        groups = [ "wheel" ];
+        noPass = !cfg.wheelNeedsPassword;
+      }
+    ];
+
+    security.wrappers = {
+      doas.source = "${doas}/bin/doas";
+    };
+
+    environment.systemPackages = [
+      doas
+    ];
+
+    security.pam.services.doas = {
+      allowNullPassword = true;
+      sshAgentAuth = true;
+    };
+
+    environment.etc."doas.conf" = {
+      source = pkgs.runCommand "doas-conf"
+        {
+          src = pkgs.writeText "doas-conf-in" ''
+            # To modify this file, set the NixOS options
+            # `security.doas.extraRules` or `security.doas.extraConfig`. To
+            # completely replace the contents of this file, use
+            # `environment.etc."doas.conf"`.
+
+            # "root" is allowed to do anything.
+            permit nopass keepenv root
+
+            # extraRules
+            ${concatStringsSep "\n" (lists.flatten (map mkRule cfg.extraRules))}
+
+            # extraConfig
+            ${cfg.extraConfig}
+          '';
+          preferLocalBuild = true;
+        }
+        # Make sure that the doas.conf file is syntactically valid.
+        "${pkgs.buildPackages.doas}/bin/doas -C $src && cp $src $out";
+      mode = "0440";
+    };
+
+  };
+
+  meta.maintainers = with maintainers; [ cole-h ];
+}
--- a/nixos/modules/security/systemd-confinement.nix
+++ b/nixos/modules/security/systemd-confinement.nix
@ -160,6 +160,11 @@ in {
              + " the 'users.users' option instead as this combination is"
              + " currently not supported.";
    }
+    { assertion = !cfg.serviceConfig.ProtectSystem or false;
+      message = "${whatOpt "ProtectSystem"}. ProtectSystem is not compatible"
+              + " with service confinement as it fails to remount /usr within"
+              + " our chroot. Please disable the option.";
+    }
  ]) config.systemd.services);

  config.systemd.packages = lib.concatLists (lib.mapAttrsToList (name: cfg: let
--- a/nixos/modules/services/audio/mpd.nix
+++ b/nixos/modules/services/audio/mpd.nix
@ -18,8 +18,6 @@ let
    ''}
    state_file          "${cfg.dataDir}/state"
    sticker_file        "${cfg.dataDir}/sticker.sql"
-    user                "${cfg.user}"
-    group               "${cfg.group}"

    ${optionalString (cfg.network.listenAddress != "any") ''bind_to_address "${cfg.network.listenAddress}"''}
    ${optionalString (cfg.network.port != 6600)  ''port "${toString cfg.network.port}"''}
--- a/nixos/modules/services/logging/awstats.nix
+++ b/nixos/modules/services/logging/awstats.nix
@ -24,7 +24,7 @@ let

      logFile = mkOption {
        type = types.str;
-        example = "/var/spool/nginx/logs/access.log";
+        example = "/var/log/nginx/access.log";
        description = ''
          The log file to be scanned.

@ -110,7 +110,7 @@ in
        {
          "mysite" = {
            domain = "example.com";
-            logFile = "/var/spool/nginx/logs/access.log";
+            logFile = "/var/log/nginx/access.log";
          };
        }
      '';
--- a/nixos/modules/services/networking/monero.nix
+++ b/nixos/modules/services/networking/monero.nix
@ -26,7 +26,7 @@ let
      rpc-login=${rpc.user}:${rpc.password}
    ''}
    ${optionalString rpc.restricted ''
-      restrict-rpc=1
+      restricted-rpc=1
    ''}

    limit-rate-up=${toString limits.upload}
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@ -187,7 +187,7 @@ let
    then "/etc/nginx/nginx.conf"
    else configFile;

-  execCommand = "${cfg.package}/bin/nginx -c '${configPath}' -p '${cfg.stateDir}'";
+  execCommand = "${cfg.package}/bin/nginx -c '${configPath}'";

  vhosts = concatStringsSep "\n" (mapAttrsToList (vhostName: vhost:
    let
@ -463,13 +463,6 @@ in
        '';
      };

-      stateDir = mkOption {
-        default = "/var/spool/nginx";
-        description = "
-          Directory holding all state for nginx to run.
-        ";
-      };
-
      user = mkOption {
        type = types.str;
        default = "nginx";
@ -636,6 +629,13 @@ in
    };
  };

+  imports = [
+    (mkRemovedOptionModule [ "services" "nginx" "stateDir" ] ''
+      The Nginx log directory has been moved to /var/log/nginx, the cache directory
+      to /var/cache/nginx. The option services.nginx.stateDir has been removed.
+    '')
+  ];
+
  config = mkIf cfg.enable {
    # TODO: test user supplied config file pases syntax test

@ -680,12 +680,6 @@ in
      }
    ];

-    systemd.tmpfiles.rules = [
-      "d '${cfg.stateDir}' 0750 ${cfg.user} ${cfg.group} - -"
-      "d '${cfg.stateDir}/logs' 0750 ${cfg.user} ${cfg.group} - -"
-      "Z '${cfg.stateDir}' - ${cfg.user} ${cfg.group} - -"
-    ];
-
    systemd.services.nginx = {
      description = "Nginx Web Server";
      wantedBy = [ "multi-user.target" ];
@ -708,6 +702,12 @@ in
        # Runtime directory and mode
        RuntimeDirectory = "nginx";
        RuntimeDirectoryMode = "0750";
+        # Cache directory and mode
+        CacheDirectory = "nginx";
+        CacheDirectoryMode = "0750";
+        # Logs directory and mode
+        LogsDirectory = "nginx";
+        LogsDirectoryMode = "0750";
        # Capabilities
        AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" "CAP_SYS_RESOURCE" ];
      };
--- a/nixos/modules/system/boot/loader/raspberrypi/raspberrypi-builder.nix
+++ b/nixos/modules/system/boot/loader/raspberrypi/raspberrypi-builder.nix
@ -3,8 +3,8 @@
 pkgs.substituteAll {
  src = ./raspberrypi-builder.sh;
  isExecutable = true;
-  inherit (pkgs) bash;
-  path = [pkgs.coreutils pkgs.gnused pkgs.gnugrep];
+  inherit (pkgs.buildPackages) bash;
+  path = with pkgs.buildPackages; [coreutils gnused gnugrep];
  firmware = pkgs.raspberrypifw;
  inherit configTxt;
 }
--- a/nixos/modules/system/boot/loader/raspberrypi/uboot-builder.nix
+++ b/nixos/modules/system/boot/loader/raspberrypi/uboot-builder.nix
@ -20,7 +20,7 @@ let

  extlinuxConfBuilder =
    import ../generic-extlinux-compatible/extlinux-conf-builder.nix {
-      inherit pkgs;
+      pkgs = pkgs.buildPackages;
    };
 in
 pkgs.substituteAll {
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -68,6 +68,7 @@ in
  deluge = handleTest ./deluge.nix {};
  dhparams = handleTest ./dhparams.nix {};
  dnscrypt-proxy2 = handleTestOn ["x86_64-linux"] ./dnscrypt-proxy2.nix {};
+  doas = handleTest ./doas.nix {};
  docker = handleTestOn ["x86_64-linux"] ./docker.nix {};
  oci-containers = handleTestOn ["x86_64-linux"] ./oci-containers.nix {};
  docker-edge = handleTestOn ["x86_64-linux"] ./docker-edge.nix {};
--- a/nixos/tests/doas.nix
+++ b/nixos/tests/doas.nix
@ -0,0 +1,83 @@
+# Some tests to ensure doas is working properly.
+import ./make-test-python.nix (
+  { lib, ... }: {
+    name = "doas";
+    meta = with lib.maintainers; {
+      maintainers = [ cole-h ];
+    };
+
+    machine =
+      { ... }:
+        {
+          users.groups = { foobar = {}; barfoo = {}; baz = { gid = 1337; }; };
+          users.users = {
+            test0 = { isNormalUser = true; extraGroups = [ "wheel" ]; };
+            test1 = { isNormalUser = true; };
+            test2 = { isNormalUser = true; extraGroups = [ "foobar" ]; };
+            test3 = { isNormalUser = true; extraGroups = [ "barfoo" ]; };
+            test4 = { isNormalUser = true; extraGroups = [ "baz" ]; };
+            test5 = { isNormalUser = true; };
+            test6 = { isNormalUser = true; };
+            test7 = { isNormalUser = true; };
+          };
+
+          security.doas = {
+            enable = true;
+            wheelNeedsPassword = false;
+
+            extraRules = [
+              { users = [ "test1" ]; groups = [ "foobar" ]; }
+              { users = [ "test2" ]; noPass = true; setEnv = [ "CORRECT" "HORSE=BATTERY" ]; }
+              { groups = [ "barfoo" 1337 ]; noPass = true; }
+              { users = [ "test5" ]; noPass = true; keepEnv = true; runAs = "test1"; }
+              { users = [ "test6" ]; noPass = true; keepEnv = true; setEnv = [ "-STAPLE" ]; }
+              { users = [ "test7" ]; noPass = true; setEnv = [ "-SSH_AUTH_SOCK" ]; }
+            ];
+          };
+        };
+
+    testScript = ''
+      with subtest("users in wheel group should have passwordless doas"):
+          machine.succeed('su - test0 -c "doas -u root true"')
+
+      with subtest("test1 user should not be able to use doas without password"):
+          machine.fail('su - test1 -c "doas -n -u root true"')
+
+      with subtest("test2 user should be able to keep some env"):
+          if "CORRECT=1" not in machine.succeed('su - test2 -c "CORRECT=1 doas env"'):
+              raise Exception("failed to keep CORRECT")
+
+          if "HORSE=BATTERY" not in machine.succeed('su - test2 -c "doas env"'):
+              raise Exception("failed to setenv HORSE=BATTERY")
+
+      with subtest("users in group 'barfoo' shouldn't require password"):
+          machine.succeed("doas -u test3 doas -n -u root true")
+
+      with subtest("users in group 'baz' (GID 1337) shouldn't require password"):
+          machine.succeed("doas -u test4 doas -n -u root echo true")
+
+      with subtest("test5 user should be able to run commands under test1"):
+          machine.succeed("doas -u test5 doas -n -u test1 true")
+
+      with subtest("test5 user should not be able to run commands under root"):
+          machine.fail("doas -u test5 doas -n -u root true")
+
+      with subtest("test6 user should be able to keepenv"):
+          envs = ["BATTERY=HORSE", "CORRECT=false"]
+          out = machine.succeed(
+              'su - test6 -c "BATTERY=HORSE CORRECT=false STAPLE=Tr0ub4dor doas env"'
+          )
+
+          if not all(env in out for env in envs):
+              raise Exception("failed to keep BATTERY or CORRECT")
+          if "STAPLE=Tr0ub4dor" in out:
+              raise Exception("failed to exclude STAPLE")
+
+      with subtest("test7 should not have access to SSH_AUTH_SOCK"):
+          if "SSH_AUTH_SOCK=HOLEY" in machine.succeed(
+              'su - test7 -c "SSH_AUTH_SOCK=HOLEY doas env"'
+          ):
+              raise Exception("failed to exclude SSH_AUTH_SOCK")
+    '';
+  }
+)
--- a/nixos/tests/gitdaemon.nix
+++ b/nixos/tests/gitdaemon.nix
@ -55,6 +55,9 @@ in {
    with subtest("git daemon starts"):
        server.wait_for_unit("git-daemon.service")

+    server.wait_for_unit("network-online.target")
+    client.wait_for_unit("network-online.target")
+
    with subtest("client can clone project.git"):
        client.succeed(
            "git clone git://server/project.git /project",
--- a/nixos/tests/service-runner.nix
+++ b/nixos/tests/service-runner.nix
@ -23,7 +23,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
        machine.fail(f"curl {url}")
        machine.succeed(
            """
-            mkdir -p /run/nginx /var/spool/nginx/logs
+            mkdir -p /run/nginx /var/log/nginx /var/cache/nginx
            ${nodes.machine.config.systemd.services.nginx.runner} &
            echo $!>my-nginx.pid
            """
--- a/pkgs/applications/audio/qmmp/default.nix
+++ b/pkgs/applications/audio/qmmp/default.nix
@ -29,11 +29,11 @@
 # handle that.

 mkDerivation rec {
-  name = "qmmp-1.3.7";
+  name = "qmmp-1.4.0";

  src = fetchurl {
    url = "http://qmmp.ylsoftware.com/files/${name}.tar.bz2";
-    sha256 = "13mk8p7bfl3fkavpqyhpcxkxb8a4f5d4qc1lasyf7wls3ghrdag7";
+    sha256 = "13rhnk55d44svksl13w23w2qkfpkq4mc0jy5mi89nzqkzshwvfd8";
  };

  nativeBuildInputs = [ cmake pkgconfig ];
--- a/pkgs/applications/audio/sooperlooper/default.nix
+++ b/pkgs/applications/audio/sooperlooper/default.nix
@ -1,17 +1,32 @@
-{ stdenv, fetchFromGitHub, liblo, libxml2, libjack2, libsndfile, wxGTK, libsigcxx
-, libsamplerate, rubberband, pkgconfig, libtool, gettext, ncurses, which
+{ stdenv
+, fetchFromGitHub
 , autoreconfHook
+, pkgconfig
+, which
+, libtool
+, liblo
+, libxml2
+, libjack2
+, libsndfile
+, wxGTK30
+, libsigcxx
+, libsamplerate
+, rubberband
+, gettext
+, ncurses
+, alsaLib
+, fftw
 }:

 stdenv.mkDerivation rec {
-  pname = "sooperlooper-git";
-  version = "2016-07-19";
+  pname = "sooperlooper";
+  version = "unstable-2019-09-30";

  src = fetchFromGitHub {
    owner = "essej";
    repo = "sooperlooper";
-    rev = "3bdfe184cd59b51c757b8048536abc1146fb0de4";
-    sha256 = "0qz25h4idv79m97ici2kzx72fwzks3lysyksk3p3rx72lsijhf3g";
+    rev = "4d1da14176e16b0f56b727bb1e6c2e8957515625";
+    sha256 = "1gsgqa7hdymzw2al1ymzv0f33y161dyhh3fmy88lpjwv3bfchamg";
  };

  autoreconfPhase = ''
@ -22,11 +37,21 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ autoreconfHook pkgconfig which libtool ];

  buildInputs = [
-    liblo libxml2 libjack2 libsndfile wxGTK libsigcxx
-    libsamplerate rubberband gettext ncurses
+    liblo
+    libxml2
+    libjack2
+    libsndfile
+    wxGTK30
+    libsigcxx
+    libsamplerate
+    rubberband
+    gettext
+    ncurses
+    alsaLib
+    fftw
  ];

-  meta = {
+  meta = with stdenv.lib; {
    description = "A live looping sampler capable of immediate loop recording, overdubbing, multiplying, reversing and more";
    longDescription = ''
      It allows for multiple simultaneous multi-channel loops limited only by your computer's available memory.
@ -35,11 +60,9 @@ stdenv.mkDerivation rec {
      However, this kind of live performance looping tool is most effectively used via hardware (midi footpedals, etc)
      and the engine can be run standalone on a computer without a monitor.
    '';
-
-    version = version;
-    homepage = "http://essej.net/sooperlooper/index.html";
-    license = stdenv.lib.licenses.gpl2;
-    maintainers = [ stdenv.lib.maintainers.magnetophon ];
-    platforms = stdenv.lib.platforms.linux;
+    homepage = "http://essej.net/sooperlooper/"; # https is broken
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ magnetophon ];
+    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/editors/mg/default.nix
+++ b/pkgs/applications/editors/mg/default.nix
@ -1,12 +1,14 @@
-{ stdenv, fetchurl, pkgconfig, libbsd, ncurses, buildPackages }:
+{ stdenv, fetchFromGitHub, pkgconfig, ncurses, buildPackages }:

 stdenv.mkDerivation rec {
  pname = "mg";
-  version = "20171014";
+  version = "6.7";

-  src = fetchurl {
-    url = "http://homepage.boetes.org/software/mg/${pname}-${version}.tar.gz";
-    sha256 = "0hakfikzsml7z0hja8m8mcahrmfy2piy81bq9nccsjplyfc9clai";
+  src = fetchFromGitHub {
+    owner = "ibara";
+    repo = "mg";
+    rev = "mg-6.7";
+    sha256 = "15adwibq6xrfxbrxzk765g9250iyfn4wbcxd7kcsabiwn6apm0ai";
  };

  enableParallelBuilding = true;
@ -17,14 +19,13 @@ stdenv.mkDerivation rec {
    install -m 555 -Dt $out/bin mg
    install -m 444 -Dt $out/share/man/man1 mg.1
  '';
-
  nativeBuildInputs = [ pkgconfig ];

-  buildInputs = [ libbsd ncurses ];
+  buildInputs = [ ncurses ];

  meta = with stdenv.lib; {
    description = "Micro GNU/emacs, a portable version of the mg maintained by the OpenBSD team";
-    homepage = "https://homepage.boetes.org/software/mg";
+    homepage = "https://man.openbsd.org/OpenBSD-current/man1/mg.1";
    license = licenses.publicDomain;
    platforms = platforms.all;
  };
--- a/pkgs/applications/editors/rednotebook/default.nix
+++ b/pkgs/applications/editors/rednotebook/default.nix
@ -5,13 +5,13 @@

 buildPythonApplication rec {
  pname = "rednotebook";
-  version = "2.18";
+  version = "2.19";

  src = fetchFromGitHub {
    owner = "jendrikseipp";
    repo = "rednotebook";
    rev = "v${version}";
-    sha256 = "1m75ns6vgycyi3zjlc9w2gnry1gyfz1jxhrklcxxi6aap0jxlgnr";
+    sha256 = "1y5slcwgs6p5n52whhhjg0c7053688311wnc9wqrk7vjk10qkx9d";
  };

  # We have not packaged tests.
--- a/pkgs/applications/graphics/yed/default.nix
+++ b/pkgs/applications/graphics/yed/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "yEd";
-  version = "3.19.1.1";
+  version = "3.20";

  src = fetchzip {
    url = "https://www.yworks.com/resources/yed/demo/${pname}-${version}.zip";
-    sha256 = "0px88rc1slf7n1n8lpk56hf29ppbnnd4lrqfyggihcr0pxmw157c";
+    sha256 = "08j8lpn2nd41gavgrj03rlrxl04wcamq1y02f1x1569ykbhycb3m";
  };

  nativeBuildInputs = [ makeWrapper unzip ];
--- a/pkgs/applications/kde/kdegraphics-thumbnailers.nix
+++ b/pkgs/applications/kde/kdegraphics-thumbnailers.nix
@ -1,5 +1,5 @@
 {
-  mkDerivation, lib,
+  mkDerivation, lib, fetchpatch,
  extra-cmake-modules, karchive, kio, libkexiv2, libkdcraw
 }:

@ -9,6 +9,14 @@ mkDerivation {
    license = [ lib.licenses.lgpl21 ];
    maintainers = [ lib.maintainers.ttuegel ];
  };
+  patches = [
+    # Fix a bug with thumbnail.so processes hanging:
+    # https://bugs.kde.org/show_bug.cgi?id=404652
+    (fetchpatch {
+      url = "https://phabricator.kde.org/file/data/tnk4b6roouixzifi6vre/PHID-FILE-qkkedevt7svx7lv56ea5/D26635.diff";
+      sha256 = "0fq85zhymmrq8vl0y6vgh87qf4c6fhcq704p4kpkaq7y0isxj4h1";
+    })
+  ];
  nativeBuildInputs = [ extra-cmake-modules ];
  buildInputs = [ karchive kio libkexiv2 libkdcraw ];
 }
--- a/pkgs/applications/misc/bemenu/default.nix
+++ b/pkgs/applications/misc/bemenu/default.nix
@ -1,32 +1,33 @@
-{ stdenv, fetchFromGitHub, cairo, cmake, libxkbcommon
+{ stdenv, lib, fetchFromGitHub, cairo, libxkbcommon
 , pango, fribidi, harfbuzz, pcre, pkgconfig
 , ncursesSupport ? true, ncurses ? null
-, waylandSupport ? true, wayland ? null
+, waylandSupport ? true, wayland ? null, wayland-protocols ? null
 , x11Support ? true, xlibs ? null, xorg ? null
 }:

 assert ncursesSupport -> ncurses != null;
-assert waylandSupport -> wayland != null;
+assert waylandSupport -> ! lib.elem null [wayland wayland-protocols];
 assert x11Support -> xlibs != null && xorg != null;

 stdenv.mkDerivation rec {
  pname = "bemenu";
-  version = "0.3.0";
+  version = "0.4.1";

  src = fetchFromGitHub {
    owner = "Cloudef";
    repo = pname;
    rev = version;
-    sha256 = "03k8wijdgj5nwmvgjhsrlh918n719789fhs4dqm23pd00rapxipk";
+    sha256 = "1fjcs9d3533ay3nz79cx3c0lmy2chgragr2lhsy0xl2ckr0iins0";
  };

-  nativeBuildInputs = [ cmake pkgconfig pcre ];
+  nativeBuildInputs = [ pkgconfig pcre ];

-  cmakeFlags =  [
-    "-DBEMENU_CURSES_RENDERER=${if ncursesSupport then "ON" else "OFF"}"
-    "-DBEMENU_WAYLAND_RENDERER=${if waylandSupport then "ON" else "OFF"}"
-    "-DBEMENU_X11_RENDERER=${if x11Support then "ON" else "OFF"}"
-  ];
+  makeFlags = ["PREFIX=$(out)"];
+
+  buildFlags = ["clients"]
+    ++ lib.optional ncursesSupport "curses"
+    ++ lib.optional waylandSupport "wayland"
+    ++ lib.optional x11Support "x11";

  buildInputs = with stdenv.lib; [
    cairo
@ -34,18 +35,18 @@ stdenv.mkDerivation rec {
    harfbuzz
    libxkbcommon
    pango
-  ] ++ optionals ncursesSupport [ ncurses ]
-    ++ optionals waylandSupport [ wayland ]
+  ] ++ optional ncursesSupport ncurses
+    ++ optionals waylandSupport [ wayland wayland-protocols ]
    ++ optionals x11Support [
      xlibs.libX11 xlibs.libXinerama xlibs.libXft
      xorg.libXdmcp xorg.libpthreadstubs xorg.libxcb
    ];

-  meta = with stdenv.lib; {
+  meta = with lib; {
    homepage = "https://github.com/Cloudef/bemenu";
    description = "Dynamic menu library and client program inspired by dmenu";
    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ thiagokokada ];
+    maintainers = with maintainers; [ lheckemann ];
    platforms = with platforms; linux;
  };
 }
--- a/pkgs/applications/misc/cura/default.nix
+++ b/pkgs/applications/misc/cura/default.nix
@ -2,25 +2,26 @@

 mkDerivation rec {
  pname = "cura";
-  version = "4.5.0";
+  version = "4.6.1";

  src = fetchFromGitHub {
    owner = "Ultimaker";
    repo = "Cura";
    rev = version;
-    sha256 = "0fm04s912sgmr66wyb55ly4jh39ijsj6lx4fx9wn7hchlqmw5jxi";
+    sha256 = "0h1r9caa579d3gfpcmch54rdbkg5df64ds2v84iqsbxwjp0rmn4n";
  };

  materials = fetchFromGitHub {
    owner = "Ultimaker";
    repo = "fdm_materials";
    rev = version;
-    sha256 = "0fgkwz1anw49macq1jxjhjr79slhmx7g3zwij7g9fqyzzhrrmwqn";
+    sha256 = "1k5c3qmixhpz3z2yi0fysxcyyf1yhcwmdlrcypkw827lhsialqp4";
  };

  buildInputs = [ qtbase qtquickcontrols2 qtgraphicaleffects ];
  propagatedBuildInputs = with python3.pkgs; [
    libsavitar numpy-stl pyserial requests uranium zeroconf
+    sentry-sdk trimesh
  ] ++ plugins;
  nativeBuildInputs = [ cmake python3.pkgs.wrapPython ];

--- a/pkgs/applications/misc/cura/plugins.nix
+++ b/pkgs/applications/misc/cura/plugins.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, fetchpatch, cmake, python3Packages }:
+{ stdenv, fetchFromGitHub, fetchpatch, python3Packages }:

 let

@ -6,21 +6,24 @@ let

    octoprint = stdenv.mkDerivation rec {
      pname = "Cura-OctoPrintPlugin";
-      version = "3.5.11";
+      version = "3.5.12";

      src = fetchFromGitHub {
        owner = "fieldOfView";
        repo = pname;
-        rev = "3cef0a955ae7ccfa5c07d20d9d147c530cc9d6ec";
-        sha256 = "0q9bkwgpsbfwkp1bfaxq3wm9pbwx5d7ji0jr7cwc4y5nizji81is";
+        rev = "ad522c0b7ead5fbe28da686a3cc75e351274c2bc";
+        sha256 = "0ln11ng32bh0smfsk54mv2j3sadh0gwf031nmm95zrvbj9cr6yc0";
      };

-      nativeBuildInputs = [ cmake ];
-
      propagatedBuildInputs = with python3Packages; [
        netifaces
      ];

+      installPhase = ''
+        mkdir -p $out/lib/cura/plugins/OctoPrintPlugin
+        cp -rv . $out/lib/cura/plugins/OctoPrintPlugin/
+      '';
+
      meta = with stdenv.lib; {
        description = "Enables printing directly to OctoPrint and monitoring the process";
        homepage = "https://github.com/fieldOfView/Cura-OctoPrintPlugin";
--- a/pkgs/applications/misc/genxword/default.nix
+++ b/pkgs/applications/misc/genxword/default.nix
@ -0,0 +1,54 @@
+{ lib
+, python3
+, fetchFromGitHub
+, gettext
+, gobject-introspection
+, wrapGAppsHook
+, pango
+, gtksourceview3
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "genxword";
+  version = "2.0.1";
+
+  src = fetchFromGitHub {
+    owner = "riverrun";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "00czdvyb5wnrk3x0g529afisl8v4frfys9ih0nzf1fs4jkzjcijg";
+  };
+
+  nativeBuildInputs = [
+    gettext
+    gobject-introspection
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    gobject-introspection
+    pango
+    gtksourceview3
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    pycairo
+    pygobject3
+  ];
+
+  # to prevent double wrapping
+  dontWrapGApps = true;
+  preFixup = ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
+
+  # there are no tests
+  doCheck = false;
+
+  meta = with lib; {
+    inherit (src.meta) homepage;
+    description = "Crossword generator";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}
--- a/pkgs/applications/misc/jekyll/basic/Gemfile.lock
+++ b/pkgs/applications/misc/jekyll/basic/Gemfile.lock
@ -1,12 +1,12 @@
 GEM
  remote: https://rubygems.org/
  specs:
-    activesupport (6.0.2.1)
+    activesupport (6.0.3)
      concurrent-ruby (~> 1.0, >= 1.0.2)
      i18n (>= 0.7, < 2)
      minitest (~> 5.1)
      tzinfo (~> 1.1)
-      zeitwerk (~> 2.2)
+      zeitwerk (~> 2.2, >= 2.2.2)
    addressable (2.7.0)
      public_suffix (>= 2.0.2, < 5.0)
    colorator (1.1.0)
@ -24,7 +24,7 @@ GEM
    http_parser.rb (0.6.0)
    i18n (1.8.2)
      concurrent-ruby (~> 1.0)
-    jekyll (4.0.0)
+    jekyll (4.0.1)
      addressable (~> 2.4)
      colorator (~> 1.0)
      em-websocket (~> 0.5)
@ -41,7 +41,7 @@ GEM
      terminal-table (~> 1.8)
    jekyll-avatar (0.7.0)
      jekyll (>= 3.0, < 5.0)
-    jekyll-mentions (1.5.1)
+    jekyll-mentions (1.6.0)
      html-pipeline (~> 2.3)
      jekyll (>= 3.7, < 5.0)
    jekyll-sass-converter (2.1.0)
@ -52,11 +52,12 @@ GEM
      jekyll (>= 3.7, < 5.0)
    jekyll-watch (2.2.1)
      listen (~> 3.0)
-    jemoji (0.11.1)
+    jemoji (0.12.0)
      gemoji (~> 3.0)
      html-pipeline (~> 2.2)
      jekyll (>= 3.0, < 5.0)
-    kramdown (2.1.0)
+    kramdown (2.2.1)
+      rexml
    kramdown-parser-gfm (1.1.0)
      kramdown (~> 2.0)
    liquid (4.0.3)
@ -66,25 +67,26 @@ GEM
    mercenary (0.3.6)
    mini_portile2 (2.4.0)
    minitest (5.14.0)
-    nokogiri (1.10.8)
+    nokogiri (1.10.9)
      mini_portile2 (~> 2.4.0)
    pathutil (0.16.2)
      forwardable-extended (~> 2.6)
-    public_suffix (4.0.3)
-    rb-fsevent (0.10.3)
+    public_suffix (4.0.5)
+    rb-fsevent (0.10.4)
    rb-inotify (0.10.1)
      ffi (~> 1.0)
-    rouge (3.16.0)
+    rexml (3.2.4)
+    rouge (3.18.0)
    safe_yaml (1.0.5)
-    sassc (2.2.1)
+    sassc (2.3.0)
      ffi (~> 1.9)
    terminal-table (1.8.0)
      unicode-display_width (~> 1.1, >= 1.1.1)
    thread_safe (0.3.6)
-    tzinfo (1.2.6)
+    tzinfo (1.2.7)
      thread_safe (~> 0.1)
-    unicode-display_width (1.6.1)
-    zeitwerk (2.2.2)
+    unicode-display_width (1.7.0)
+    zeitwerk (2.3.0)

 PLATFORMS
  ruby
--- a/pkgs/applications/misc/jekyll/basic/gemset.nix
+++ b/pkgs/applications/misc/jekyll/basic/gemset.nix
@ -5,10 +5,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1dd6gh66ffdbhsxv33rxxsiciqyhhkm69l1yqspwdj2brvh1jzl1";
+      sha256 = "0shh34xx9ygxb57s8mag8l22klvjfnk1c4jbjvchk16r6z0ps326";
      type = "gem";
    };
-    version = "6.0.2.1";
+    version = "6.0.3";
  };
  addressable = {
    dependencies = ["public_suffix"];
@ -130,10 +130,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0fpckw5nf4hfr5vhhdlmaxxp5lkdmc1vyqnmijwvy9fmjn4c87aa";
+      sha256 = "1gw05bh9iidnx2lxw0h5aiknbly818cmndc4a9nhq28fiafizi82";
      type = "gem";
    };
-    version = "4.0.0";
+    version = "4.0.1";
  };
  jekyll-avatar = {
    dependencies = ["jekyll"];
@ -152,10 +152,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1r81nbw598s485jsppbpy9kwa471w1rdkpdn3a1mq0swg87cp67v";
+      sha256 = "1n8y67plydfmay3jn865igvgb3h6s2crk8kq7ydk3wmn9h103s1r";
      type = "gem";
    };
-    version = "1.5.1";
+    version = "1.6.0";
  };
  jekyll-sass-converter = {
    dependencies = ["sassc"];
@ -207,20 +207,21 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1yd77r5jvh9chf5qcp6z63gg40yp5n1sr7nv1hlmbq3xjzlhs6h6";
+      sha256 = "09sxbnrqz5vf6rxmh6lzism31gz2g3hw86ymg37r1ccknclv3cp9";
      type = "gem";
    };
-    version = "0.11.1";
+    version = "0.12.0";
  };
  kramdown = {
+    dependencies = ["rexml"];
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1dl840bvx8d9nq6lg3mxqyvbiqnr6lk3jfsm6r8zhz7p5srmd688";
+      sha256 = "059mk8lmddp2a2aa6s4pp7x2yyqbqg5crx5jkn32dzlnqi2j5cn6";
      type = "gem";
    };
-    version = "2.1.0";
+    version = "2.2.1";
  };
  kramdown-parser-gfm = {
    dependencies = ["kramdown"];
@ -290,10 +291,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1yi8j8hwrlc3rg5v3w52gxndmwifyk7m732q9yfbal0qajqbh1h8";
+      sha256 = "12j76d0bp608932xkzmfi638c7aqah57l437q8494znzbj610qnm";
      type = "gem";
    };
-    version = "1.10.8";
+    version = "1.10.9";
  };
  pathutil = {
    dependencies = ["forwardable-extended"];
@ -311,20 +312,20 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1c6kq6s13idl2036b5lch8r7390f8w82cal8hcp4ml76fm2vdac7";
+      sha256 = "0vywld400fzi17cszwrchrzcqys4qm6sshbv73wy5mwcixmrgg7g";
      type = "gem";
    };
-    version = "4.0.3";
+    version = "4.0.5";
  };
  rb-fsevent = {
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1lm1k7wpz69jx7jrc92w3ggczkjyjbfziq5mg62vjnxmzs383xx8";
+      sha256 = "1k9bsj7ni0g2fd7scyyy1sk9dy2pg9akniahab0iznvjmhn54h87";
      type = "gem";
    };
-    version = "0.10.3";
+    version = "0.10.4";
  };
  rb-inotify = {
    dependencies = ["ffi"];
@ -337,15 +338,25 @@
    };
    version = "0.10.1";
  };
+  rexml = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1mkvkcw9fhpaizrhca0pdgjcrbns48rlz4g6lavl5gjjq3rk2sq3";
+      type = "gem";
+    };
+    version = "3.2.4";
+  };
  rouge = {
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1ivsvkwdxl44q4xl8bnf6kqmvy47n98akcvlfmhaz0614zlf4bxi";
+      sha256 = "1n9h0ls2a2zq0bcsw31wxci1wdxb8s3vglfadxpcs6b04vkf6nqq";
      type = "gem";
    };
-    version = "3.16.0";
+    version = "3.18.0";
  };
  safe_yaml = {
    groups = ["default"];
@ -363,10 +374,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "09bnid7r5z5hcin5hykvpvv8xig27wbbckxwis60z2aaxq4j9siz";
+      sha256 = "1qzfnvb8khvc6w2sn3k91mndc2w50xxx5c84jkr6xdxlmaq1a3kg";
      type = "gem";
    };
-    version = "2.2.1";
+    version = "2.3.0";
  };
  terminal-table = {
    dependencies = ["unicode-display_width"];
@ -395,29 +406,29 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "04f18jdv6z3zn3va50rqq35nj3izjpb72fnf21ixm7vanq6nc4fp";
+      sha256 = "1i3jh086w1kbdj3k5l60lc3nwbanmzdf8yjj3mlrx9b2gjjxhi9r";
      type = "gem";
    };
-    version = "1.2.6";
+    version = "1.2.7";
  };
  unicode-display_width = {
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1pppclzq4qb26g321553nm9xqca3zgllvpwb2kqxsdadwj51s09x";
+      sha256 = "06i3id27s60141x6fdnjn5rar1cywdwy64ilc59cz937303q3mna";
      type = "gem";
    };
-    version = "1.6.1";
+    version = "1.7.0";
  };
  zeitwerk = {
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0jywi63w1m2b2w9fj9rjb9n3imf6p5bfijfmml1xzdnsrdrjz0x1";
+      sha256 = "1akpm3pwvyiack2zk6giv9yn3cqb8pw6g40p4394pdc3xmy3s4k0";
      type = "gem";
    };
-    version = "2.2.2";
+    version = "2.3.0";
  };
 }
--- a/pkgs/applications/misc/jekyll/default.nix
+++ b/pkgs/applications/misc/jekyll/default.nix
@ -47,6 +47,7 @@ in bundlerApp {
      host sites right from your GitHub repositories.
    '';
    homepage    = "https://jekyllrb.com/";
+    #changelog   = "https://raw.githubusercontent.com/jekyll/jekyll/v${version}/History.markdown";
    license     = licenses.mit;
    maintainers = with maintainers; [ primeos pesterhazy ];
    platforms   = platforms.unix;
--- a/pkgs/applications/misc/jekyll/full/Gemfile.lock
+++ b/pkgs/applications/misc/jekyll/full/Gemfile.lock
@ -1,12 +1,12 @@
 GEM
  remote: https://rubygems.org/
  specs:
-    activesupport (6.0.2.1)
+    activesupport (6.0.3)
      concurrent-ruby (~> 1.0, >= 1.0.2)
      i18n (>= 0.7, < 2)
      minitest (~> 5.1)
      tzinfo (~> 1.1)
-      zeitwerk (~> 2.2)
+      zeitwerk (~> 2.2, >= 2.2.2)
    addressable (2.7.0)
      public_suffix (>= 2.0.2, < 5.0)
    classifier-reborn (2.2.0)
@ -23,7 +23,7 @@ GEM
      http_parser.rb (~> 0.6.0)
    eventmachine (1.2.7)
    execjs (2.7.0)
-    faraday (1.0.0)
+    faraday (1.0.1)
      multipart-post (>= 1.2, < 3)
    fast-stemmer (1.0.2)
    ffi (1.12.2)
@ -35,7 +35,7 @@ GEM
    http_parser.rb (0.6.0)
    i18n (1.8.2)
      concurrent-ruby (~> 1.0)
-    jekyll (4.0.0)
+    jekyll (4.0.1)
      addressable (~> 2.4)
      colorator (~> 1.0)
      em-websocket (~> 0.5)
@ -59,7 +59,7 @@ GEM
      jekyll (>= 3.7, < 5.0)
    jekyll-gist (1.5.0)
      octokit (~> 4.2)
-    jekyll-mentions (1.5.1)
+    jekyll-mentions (1.6.0)
      html-pipeline (~> 2.3)
      jekyll (>= 3.7, < 5.0)
    jekyll-paginate (1.1.0)
@ -73,11 +73,12 @@ GEM
      jekyll (>= 3.7, < 5.0)
    jekyll-watch (2.2.1)
      listen (~> 3.0)
-    jemoji (0.11.1)
+    jemoji (0.12.0)
      gemoji (~> 3.0)
      html-pipeline (~> 2.2)
      jekyll (>= 3.0, < 5.0)
-    kramdown (2.1.0)
+    kramdown (2.2.1)
+      rexml
    kramdown-parser-gfm (1.1.0)
      kramdown (~> 2.0)
    kramdown-syntax-coderay (1.0.1)
@ -92,25 +93,26 @@ GEM
    mercenary (0.3.6)
    mime-types (3.3.1)
      mime-types-data (~> 3.2015)
-    mime-types-data (3.2019.1009)
+    mime-types-data (3.2020.0425)
    mini_portile2 (2.4.0)
    minitest (5.14.0)
    multipart-post (2.1.1)
-    nokogiri (1.10.8)
+    nokogiri (1.10.9)
      mini_portile2 (~> 2.4.0)
-    octokit (4.16.0)
+    octokit (4.18.0)
      faraday (>= 0.9)
      sawyer (~> 0.8.0, >= 0.5.3)
    pathutil (0.16.2)
      forwardable-extended (~> 2.6)
-    public_suffix (4.0.3)
-    rb-fsevent (0.10.3)
+    public_suffix (4.0.5)
+    rb-fsevent (0.10.4)
    rb-inotify (0.10.1)
      ffi (~> 1.0)
    rdoc (6.2.1)
-    rouge (3.16.0)
+    rexml (3.2.4)
+    rouge (3.18.0)
    safe_yaml (1.0.5)
-    sassc (2.2.1)
+    sassc (2.3.0)
      ffi (~> 1.9)
    sawyer (0.8.2)
      addressable (>= 2.3.5)
@ -118,12 +120,12 @@ GEM
    terminal-table (1.8.0)
      unicode-display_width (~> 1.1, >= 1.1.1)
    thread_safe (0.3.6)
-    tomlrb (1.2.9)
-    tzinfo (1.2.6)
+    tomlrb (1.3.0)
+    tzinfo (1.2.7)
      thread_safe (~> 0.1)
-    unicode-display_width (1.6.1)
+    unicode-display_width (1.7.0)
    yajl-ruby (1.4.1)
-    zeitwerk (2.2.2)
+    zeitwerk (2.3.0)

 PLATFORMS
  ruby
--- a/pkgs/applications/misc/jekyll/full/gemset.nix
+++ b/pkgs/applications/misc/jekyll/full/gemset.nix
@ -5,10 +5,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1dd6gh66ffdbhsxv33rxxsiciqyhhkm69l1yqspwdj2brvh1jzl1";
+      sha256 = "0shh34xx9ygxb57s8mag8l22klvjfnk1c4jbjvchk16r6z0ps326";
      type = "gem";
    };
-    version = "6.0.2.1";
+    version = "6.0.3";
  };
  addressable = {
    dependencies = ["public_suffix"];
@ -132,10 +132,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "11yn7mhi4rl24brs2qfwysas14csjf1zmb835cfklqz5ka032xp6";
+      sha256 = "0wwks9652xwgjm7yszcq5xr960pjypc07ivwzbjzpvy9zh2fw6iq";
      type = "gem";
    };
-    version = "1.0.0";
+    version = "1.0.1";
  };
  fast-stemmer = {
    groups = ["default"];
@ -227,10 +227,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0fpckw5nf4hfr5vhhdlmaxxp5lkdmc1vyqnmijwvy9fmjn4c87aa";
+      sha256 = "1gw05bh9iidnx2lxw0h5aiknbly818cmndc4a9nhq28fiafizi82";
      type = "gem";
    };
-    version = "4.0.0";
+    version = "4.0.1";
  };
  jekyll-avatar = {
    dependencies = ["jekyll"];
@ -282,10 +282,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1r81nbw598s485jsppbpy9kwa471w1rdkpdn3a1mq0swg87cp67v";
+      sha256 = "1n8y67plydfmay3jn865igvgb3h6s2crk8kq7ydk3wmn9h103s1r";
      type = "gem";
    };
-    version = "1.5.1";
+    version = "1.6.0";
  };
  jekyll-paginate = {
    groups = ["default"];
@ -358,20 +358,21 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1yd77r5jvh9chf5qcp6z63gg40yp5n1sr7nv1hlmbq3xjzlhs6h6";
+      sha256 = "09sxbnrqz5vf6rxmh6lzism31gz2g3hw86ymg37r1ccknclv3cp9";
      type = "gem";
    };
-    version = "0.11.1";
+    version = "0.12.0";
  };
  kramdown = {
+    dependencies = ["rexml"];
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1dl840bvx8d9nq6lg3mxqyvbiqnr6lk3jfsm6r8zhz7p5srmd688";
+      sha256 = "059mk8lmddp2a2aa6s4pp7x2yyqbqg5crx5jkn32dzlnqi2j5cn6";
      type = "gem";
    };
-    version = "2.1.0";
+    version = "2.2.1";
  };
  kramdown-parser-gfm = {
    dependencies = ["kramdown"];
@ -477,10 +478,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "18x61fc36951vw7f74gq8cyybdpxvyg5d0azvqhrs82ddw3v16xh";
+      sha256 = "1zin0q26wc5p7zb7glpwary7ms60s676vcq987yv22jgm6hnlwlh";
      type = "gem";
    };
-    version = "3.2019.1009";
+    version = "3.2020.0425";
  };
  mini_portile2 = {
    groups = ["default"];
@ -518,10 +519,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1yi8j8hwrlc3rg5v3w52gxndmwifyk7m732q9yfbal0qajqbh1h8";
+      sha256 = "12j76d0bp608932xkzmfi638c7aqah57l437q8494znzbj610qnm";
      type = "gem";
    };
-    version = "1.10.8";
+    version = "1.10.9";
  };
  octokit = {
    dependencies = ["faraday" "sawyer"];
@ -529,10 +530,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "06kx258qa5k24q5pv8i4daaw3g57gif6p5k5h3gndj3q2jk6vhkn";
+      sha256 = "0zvfr9njmj5svi39fcsi2b0g7pcxb0vamw9dlyas8bg814jlzhi6";
      type = "gem";
    };
-    version = "4.16.0";
+    version = "4.18.0";
  };
  pathutil = {
    dependencies = ["forwardable-extended"];
@ -550,20 +551,20 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1c6kq6s13idl2036b5lch8r7390f8w82cal8hcp4ml76fm2vdac7";
+      sha256 = "0vywld400fzi17cszwrchrzcqys4qm6sshbv73wy5mwcixmrgg7g";
      type = "gem";
    };
-    version = "4.0.3";
+    version = "4.0.5";
  };
  rb-fsevent = {
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1lm1k7wpz69jx7jrc92w3ggczkjyjbfziq5mg62vjnxmzs383xx8";
+      sha256 = "1k9bsj7ni0g2fd7scyyy1sk9dy2pg9akniahab0iznvjmhn54h87";
      type = "gem";
    };
-    version = "0.10.3";
+    version = "0.10.4";
  };
  rb-inotify = {
    dependencies = ["ffi"];
@ -586,15 +587,25 @@
    };
    version = "6.2.1";
  };
+  rexml = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1mkvkcw9fhpaizrhca0pdgjcrbns48rlz4g6lavl5gjjq3rk2sq3";
+      type = "gem";
+    };
+    version = "3.2.4";
+  };
  rouge = {
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1ivsvkwdxl44q4xl8bnf6kqmvy47n98akcvlfmhaz0614zlf4bxi";
+      sha256 = "1n9h0ls2a2zq0bcsw31wxci1wdxb8s3vglfadxpcs6b04vkf6nqq";
      type = "gem";
    };
-    version = "3.16.0";
+    version = "3.18.0";
  };
  safe_yaml = {
    groups = ["default"];
@ -612,10 +623,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "09bnid7r5z5hcin5hykvpvv8xig27wbbckxwis60z2aaxq4j9siz";
+      sha256 = "1qzfnvb8khvc6w2sn3k91mndc2w50xxx5c84jkr6xdxlmaq1a3kg";
      type = "gem";
    };
-    version = "2.2.1";
+    version = "2.3.0";
  };
  sawyer = {
    dependencies = ["addressable" "faraday"];
@ -654,10 +665,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0njkyq5csj4km8spmw33b5902v254wvyvqq1b0f0kky5hs7bvrgg";
+      sha256 = "00x5y9h4fbvrv4xrjk4cqlkm4vq8gv73ax4alj3ac2x77zsnnrk8";
      type = "gem";
    };
-    version = "1.2.9";
+    version = "1.3.0";
  };
  tzinfo = {
    dependencies = ["thread_safe"];
@ -665,20 +676,20 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "04f18jdv6z3zn3va50rqq35nj3izjpb72fnf21ixm7vanq6nc4fp";
+      sha256 = "1i3jh086w1kbdj3k5l60lc3nwbanmzdf8yjj3mlrx9b2gjjxhi9r";
      type = "gem";
    };
-    version = "1.2.6";
+    version = "1.2.7";
  };
  unicode-display_width = {
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1pppclzq4qb26g321553nm9xqca3zgllvpwb2kqxsdadwj51s09x";
+      sha256 = "06i3id27s60141x6fdnjn5rar1cywdwy64ilc59cz937303q3mna";
      type = "gem";
    };
-    version = "1.6.1";
+    version = "1.7.0";
  };
  yajl-ruby = {
    groups = ["default"];
@ -707,9 +718,9 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0jywi63w1m2b2w9fj9rjb9n3imf6p5bfijfmml1xzdnsrdrjz0x1";
+      sha256 = "1akpm3pwvyiack2zk6giv9yn3cqb8pw6g40p4394pdc3xmy3s4k0";
      type = "gem";
    };
-    version = "2.2.2";
+    version = "2.3.0";
  };
 }
--- a/pkgs/applications/misc/kitty/default.nix
+++ b/pkgs/applications/misc/kitty/default.nix
@ -20,14 +20,14 @@
 with python3Packages;
 buildPythonApplication rec {
  pname = "kitty";
-  version = "0.17.3";
+  version = "0.17.4";
  format = "other";

  src = fetchFromGitHub {
    owner = "kovidgoyal";
    repo = "kitty";
    rev = "v${version}";
-    sha256 = "1nx8gjavq8kc656ayh3wign1f68b46jbnmy8zyks25wg0p9gid8l";
+    sha256 = "1rbyj84y8r6h7qd6w7cw58v2abspippignj458ihv2m26i4als2x";
  };

  buildInputs = [
--- a/pkgs/applications/misc/kitty/library-paths.patch
+++ b/pkgs/applications/misc/kitty/library-paths.patch
@ -12,21 +12,27 @@

 --- a/kitty/desktop.c
 +++ b/kitty/desktop.c
-@@ -30,7 +30,7 @@
- static PyObject*
- init_x11_startup_notification(PyObject UNUSED *self, PyObject *args) {
-     static bool done = false;
-    static const char* libname = "libstartup-notification-1.so";
-+    static const char* libname = "@libstartup_notification@";
-     // some installs are missing the .so symlink, so try the full name
-     static const char* libname2 = "libstartup-notification-1.so.0";
-     static const char* libname3 = "libstartup-notification-1.so.0.0.0";
-@@ -105,7 +105,7 @@ load_libcanberra_functions(void) {
+@@ -34,10 +34,7 @@ init_x11_startup_notification(PyObject UNUSED *self, PyObject *args) {
+         done = true;
 
- static void
- load_libcanberra(void) {
-    static const char* libname = "libcanberra.so";
-+    static const char* libname = "@libcanberra@";
-     // some installs are missing the .so symlink, so try the full name
-     static const char* libname2 = "libcanberra.so.0";
-     static const char* libname3 = "libcanberra.so.0.2.5";
+         const char* libnames[] = {
+-            "libstartup-notification-1.so",
+-            // some installs are missing the .so symlink, so try the full name
+-            "libstartup-notification-1.so.0",
+-            "libstartup-notification-1.so.0.0.0",
+            "@libstartup_notification@",
+             NULL
+         };
+         for (int i = 0; libnames[i]; i++) {
+@@ -113,10 +110,7 @@ load_libcanberra(void) {
+     if (done) return;
+     done = true;
+     const char* libnames[] = {
+-        "libcanberra.so",
+-        // some installs are missing the .so symlink, so try the full name
+-        "libcanberra.so.0",
+-        "libcanberra.so.0.2.5",
+        "@libcanberra@",
+         NULL
+     };
+     for (int i = 0; libnames[i]; i++) {
--- a/pkgs/applications/misc/termdown/default.nix
+++ b/pkgs/applications/misc/termdown/default.nix
@ -1,27 +1,29 @@
-{ stdenv, fetchFromGitHub, buildPythonApplication,
-click, pyfiglet, dateutil}:
-
-with stdenv.lib;
+{ stdenv
+, fetchFromGitHub
+, buildPythonApplication
+, click
+, pyfiglet
+, dateutil
+, setuptools
+}:

 buildPythonApplication rec {
-
  pname = "termdown";
-  version = "1.16.0";
+  version = "1.17.0";

  src = fetchFromGitHub {
-    rev    = version;
-    sha256 = "0k429ss1xifm9vbgyzpp71r79byn9jclvr0rm77bai2r8nz3s2vf";
-    repo   = "termdown";
-    owner  = "trehn";
+    rev = version;
+    sha256 = "1sd9z5n2a4ir35832wgxs68vwav7wxhq39b5h8pq934mp8sl3v2k";
+    repo = "termdown";
+    owner = "trehn";
  };

-  propagatedBuildInputs = [ dateutil click pyfiglet ];
+  propagatedBuildInputs = [ dateutil click pyfiglet setuptools ];

  meta = with stdenv.lib; {
-    description     = "Starts a countdown to or from TIMESPEC";
+    description = "Starts a countdown to or from TIMESPEC";
    longDescription = "Countdown timer and stopwatch in your terminal";
-    homepage        = "https://github.com/trehn/termdown";
-    license         = licenses.gpl3;
-    platforms       = platforms.all;
+    homepage = "https://github.com/trehn/termdown";
+    license = licenses.gpl3;
  };
 }
--- a/pkgs/applications/misc/yubioath-desktop/default.nix
+++ b/pkgs/applications/misc/yubioath-desktop/default.nix
@ -6,11 +6,11 @@

 mkDerivation rec {
  pname = "yubioath-desktop";
-  version = "5.0.2";
+  version = "5.0.3";

  src = fetchurl {
    url = "https://developers.yubico.com/yubioath-desktop/Releases/yubioath-desktop-${version}.tar.gz";
-    sha256 = "19ingk0ab88a22s04apcw8kx9xygxlbk8kp4xnb8pmf8z3k6l2gf";
+    sha256 = "1g0jd7mmch6a6n8k5pp3w27qd5cijnvzk05lwraf0i96m68h7x1k";
  };

  doCheck = false;
@ -38,13 +38,13 @@ mkDerivation rec {
      --prefix LD_LIBRARY_PATH : "${stdenv.lib.getLib pcsclite}/lib:${yubikey-personalization}/lib"

      mkdir -p $out/share/applications
-      cp resources/yubioath-desktop.desktop \
-        $out/share/applications/yubioath-desktop.desktop
+      cp resources/com.yubico.yubioath.desktop \
+        $out/share/applications/com.yubico.yubioath.desktop
      mkdir -p $out/share/yubioath/icons
-      cp resources/icons/*.{icns,ico,png,xpm} $out/share/yubioath/icons
-      substituteInPlace $out/share/applications/yubioath-desktop.desktop \
+      cp resources/icons/*.{icns,ico,png,svg} $out/share/yubioath/icons
+      substituteInPlace $out/share/applications/com.yubico.yubioath.desktop \
        --replace 'Exec=yubioath-desktop' "Exec=$out/bin/yubioath-desktop" \
-        --replace 'Icon=yubioath' "Icon=$out/share/yubioath/icons/yubioath.png"
+        --replace 'Icon=yubioath' "Icon=$out/share/yubioath/icons/com.yubico.yubioath.png"
  '';

  meta = with stdenv.lib; {
--- a/pkgs/applications/networking/gns3/default.nix
+++ b/pkgs/applications/networking/gns3/default.nix
@ -1,7 +1,7 @@
 { callPackage }:

 let
-  stableVersion = "2.2.7";
+  stableVersion = "2.2.8";
  previewVersion = stableVersion;
  addVersion = args:
    let version = if args.stable then stableVersion else previewVersion;
@ -25,8 +25,8 @@ let
  };
  mkGui = args: callPackage (import ./gui.nix (addVersion args // extraArgs)) { };
  mkServer = args: callPackage (import ./server.nix (addVersion args // extraArgs)) { };
-  guiSrcHash = "1rq1cb07mvakqny848nvwgasp8f6pxdy790gd98xh55xrbi8jvxp";
-  serverSrcHash = "1cf3inppj2050mgmx5sgf540iz3m3nbh53p26dx8m67x2xfyb934";
+  guiSrcHash = "1qgzad9hdbvkdalzdnlg5gnlzn2f9qlpd1aj8djmi6w1mmdkf9q7";
+  serverSrcHash = "1kg38dh0xk4yvi7hz0d5dq9k0wany0sfd185l0zxs3nz78zd23an";
 in {
  guiStable = mkGui {
    stable = true;
--- a/pkgs/applications/networking/google-drive-ocamlfuse/default.nix
+++ b/pkgs/applications/networking/google-drive-ocamlfuse/default.nix
@ -1,23 +1,19 @@
-{ stdenv, fetchFromGitHub, zlib
-, ocaml, dune, ocamlfuse, findlib, gapi_ocaml, ocaml_sqlite3, camlidl }:
+{ stdenv, buildDunePackage, fetchFromGitHub
+, ocamlfuse, gapi_ocaml, ocaml_sqlite3
+}:

-stdenv.mkDerivation rec {
+buildDunePackage rec {
  pname = "google-drive-ocamlfuse";
-  version = "0.7.2";
+  version = "0.7.21";

  src = fetchFromGitHub {
    owner = "astrada";
    repo = "google-drive-ocamlfuse";
    rev = "v${version}";
-    sha256 = "1l6b4bs5x373pw210nl8xal03ns2ib1ls49y64s3lqjfh5wjmnjy";
+    sha256 = "0by3qnjrr1mbxyl2n99zggx8dxnqlicsq2b2hhhxb2d0k8qn47sw";
  };

-  nativeBuildInputs = [ dune ];
-
-  buildInputs = [ zlib ocaml ocamlfuse findlib gapi_ocaml ocaml_sqlite3 camlidl ];
-
-  buildPhase = "jbuilder build @install";
-  installPhase = "mkdir $out && dune install --prefix $out";
+  buildInputs = [ ocamlfuse gapi_ocaml ocaml_sqlite3 ];

  meta = {
    homepage = "http://gdfuse.forge.ocamlcore.org/";
--- a/pkgs/applications/networking/ids/suricata/default.nix
+++ b/pkgs/applications/networking/ids/suricata/default.nix
@ -34,11 +34,11 @@
 in
 stdenv.mkDerivation rec {
  pname = "suricata";
-  version = "5.0.2";
+  version = "5.0.3";

  src = fetchurl {
    url = "https://www.openinfosecfoundation.org/download/${pname}-${version}.tar.gz";
-    sha256 = "1ryfa3bzd8mrq2k5kjfwmblxqqziz6b9n1dnh692mazf5z4wlc3z";
+    sha256 = "1nv5aq5lpkpskkzw05hr2lshkzcs4zqj5kfv4qjlbwigmp6kwh9l";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/instant-messengers/dino/default.nix
+++ b/pkgs/applications/networking/instant-messengers/dino/default.nix
@ -4,6 +4,7 @@
 , xorg, libXdmcp, libxkbcommon
 , libnotify, libsoup, libgee
 , librsvg, libsignal-protocol-c
+, fetchpatch
 , libgcrypt
 , epoxy
 , at-spi2-core
@ -26,6 +27,15 @@ stdenv.mkDerivation rec {
    sha256 = "1k5cgj5n8s40i71wqdh6m1q0njl45ichfdbbywx9rga5hljz1c54";
  };

+  patches = [
+    (fetchpatch {
+      # Allow newer versions of libsignal-protocol-c
+      url = "https://github.com/dino/dino/commit/fbd70ceaac5ebbddfa21a580c61165bf5b861303.patch";
+      sha256 = "0ydpwsmwrzfsry89fsffkfalhki4n1dw99ixjvpiingdrhjmwyl2";
+      excludes = [ "plugins/signal-protocol/libsignal-protocol-c" ];
+    })
+  ];
+
  nativeBuildInputs = [
    vala
    cmake
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
@ -19,12 +19,12 @@ with lib;

 mkDerivation rec {
  pname = "telegram-desktop";
-  version = "2.1.2";
+  version = "2.1.4";

  # Telegram-Desktop with submodules
  src = fetchurl {
    url = "https://github.com/telegramdesktop/tdesktop/releases/download/v${version}/tdesktop-${version}-full.tar.gz";
-    sha256 = "0n387scs5kmc5jrypyxkc9cj4c7nb5761bdb8qxw8j342sm5ai24";
+    sha256 = "1swmmklw2mcgag0c8zh4rk5cjfx6z2yl0nxd5yc43hg9hx76yqqi";
  };

  postPatch = ''
--- a/pkgs/applications/networking/p2p/deluge/2/default.nix
+++ b/pkgs/applications/networking/p2p/deluge/2/default.nix
@ -1,5 +1,5 @@
 { stdenv, fetchurl, intltool, libtorrentRasterbar, pythonPackages
-, gtk3, gobject-introspection, librsvg, wrapGAppsHook }:
+, gtk3, glib, gobject-introspection, librsvg, wrapGAppsHook }:

 pythonPackages.buildPythonPackage rec {
  pname = "deluge";
@ -18,7 +18,7 @@ pythonPackages.buildPythonPackage rec {
    gtk3 gobject-introspection librsvg
  ];

-  nativeBuildInputs = [ intltool wrapGAppsHook ];
+  nativeBuildInputs = [ intltool wrapGAppsHook glib ];

  checkInputs = with pythonPackages; [
    pytest /* pytest-twisted */ pytestcov mock
--- a/pkgs/applications/networking/p2p/qbittorrent/default.nix
+++ b/pkgs/applications/networking/p2p/qbittorrent/default.nix
@ -10,13 +10,13 @@ with lib;

 mkDerivation rec {
  pname = "qbittorrent";
-  version = "4.2.2";
+  version = "4.2.5";

  src = fetchFromGitHub {
    owner = "qbittorrent";
    repo = "qbittorrent";
    rev = "release-${version}";
-    sha256 = "1iqgwhgwa2kx85zj1rwfnnclr1433a7m2gbs3j7w6rx39vxnzhcc";
+    sha256 = "1n613ylg6i9gisgk0dbr2kpfasyizrkdjff1r8smd4vri2qrdksn";
  };

  # NOTE: 2018-05-31: CMake is working but it is not officially supported
--- a/pkgs/applications/networking/p2p/tixati/default.nix
+++ b/pkgs/applications/networking/p2p/tixati/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "tixati";
-  version = "2.72";
+  version = "2.73";

  src = fetchurl {
    url = "https://download2.tixati.com/download/tixati-${version}-1.x86_64.manualinstall.tar.gz";
-    sha256 = "04si7xwbpvljdbngmzlfvkn51wih3aqcb5g6r76wdh3pfpppskhr";
+    sha256 = "1ncrfc4wgf02la2h3zpdcz07b980n9232lg5f62q7ab79fjrcrfr";
  };

  installPhase = ''
--- a/pkgs/applications/networking/remote/remmina/default.nix
+++ b/pkgs/applications/networking/remote/remmina/default.nix
@ -13,13 +13,13 @@ with stdenv.lib;

 stdenv.mkDerivation rec {
  pname = "remmina";
-  version = "1.4.1";
+  version = "1.4.3";

  src = fetchFromGitLab {
    owner  = "Remmina";
    repo   = "Remmina";
    rev    = "v${version}";
-    sha256 = "084yw0fd3qmzzd6xinhf4plv5bg8gfj4jnfac7zi1nif8zilf456";
+    sha256 = "11s39xcy80rarkddw31v621zpai1vdr52iam367l69mcbc40xg36";
  };

  nativeBuildInputs = [ cmake ninja pkgconfig wrapGAppsHook ];
--- a/pkgs/applications/networking/resilio-sync/default.nix
+++ b/pkgs/applications/networking/resilio-sync/default.nix
@ -9,13 +9,13 @@ let

 in stdenv.mkDerivation rec {
  pname = "resilio-sync";
-  version = "2.6.4";
+  version = "2.7.0";

  src = fetchurl {
    url = "https://download-cdn.resilio.com/${version}/linux-${arch}/resilio-sync_${arch}.tar.gz";
    sha256 = {
-      x86_64-linux = "1c1yksjag58p7yjm72iiz82p2r01lq7kxvq7z5phmq5z6gxdg4a8";
-      i686-linux   = "167baz9fzmzk50jffzvgmgyw1zw3955r3cb73z23qvw8zqzdqydc";
+      x86_64-linux = "17vw4kyggmi8phm91jx1skkd7vrdhbahibv6d6zm14q87r01a56f";
+      i686-linux   = "0yvy3lif2g4jchcp5q1r5b8ndj8009pcq5js7r0kl20bmmcmzklg";
    }.${stdenv.hostPlatform.system};
  };

--- a/pkgs/applications/networking/testssl/default.nix
+++ b/pkgs/applications/networking/testssl/default.nix
@ -3,13 +3,13 @@

 stdenv.mkDerivation rec {
  pname = "testssl.sh";
-  version = "3.0";
+  version = "3.0.1";

  src = fetchFromGitHub {
    owner = "drwetter";
    repo = pname;
    rev = version;
-    sha256 = "08i1l835zlzb3qmsnsd5vhsrr82li6fnp5jqxiybbqr5wjz67ssd";
+    sha256 = "13vvkn1hna1d1mj8ffg7psrv6ha2jcjrf50qrsb0v0p8hszibavy";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/radio/xlog/default.nix
+++ b/pkgs/applications/radio/xlog/default.nix
@ -1,11 +1,11 @@
 { stdenv, fetchurl, glib, gtk2, pkgconfig, hamlib }:
 stdenv.mkDerivation rec {
  pname = "xlog";
-  version = "2.0.17";
+  version = "2.0.19";

  src = fetchurl {
    url = "https://download.savannah.gnu.org/releases/xlog/${pname}-${version}.tar.gz";
-    sha256 = "0vmn8518zk7qk1mbp1h8dm0f8fx0z0jvmy42c1n15il714lj7vsl";
+    sha256 = "0y38gkcm4mgv6wn31pjq6d5bm22m63rpwa55qjmrlywrmw76rppy";
  };

  # glib-2.62 deprecations
--- a/pkgs/applications/science/biology/stacks/default.nix
+++ b/pkgs/applications/science/biology/stacks/default.nix
@ -2,10 +2,10 @@
    
 stdenv.mkDerivation rec {
  pname = "stacks";
-  version = "2.52";
+  version = "2.53";
  src = fetchurl {
    url = "http://catchenlab.life.illinois.edu/stacks/source/${pname}-${version}.tar.gz";
-    sha256 = "0gq3kbj910jsq591wylzjmd23srjlsssmrckmf46m4ysjqdqd8vm";
+    sha256 = "1zchds205nwdqch1246953dr8c0019yas178qbq3jypbxvmgq7pf";
  };

  buildInputs = [ zlib ];
--- a/pkgs/applications/science/electronics/kicad/base.nix
+++ b/pkgs/applications/science/electronics/kicad/base.nix
@ -2,7 +2,6 @@
 , libX11, gettext, glew, glm, cairo, curl, openssl, boost, pkgconfig
 , doxygen, pcre, libpthreadstubs, libXdmcp, fetchpatch, lndir, callPackages

-, pname ? "kicad"
 , stable ? true
 , baseName ? "kicad"
 , versions ? { }
@ -20,26 +19,26 @@ with lib;
 let

  versionConfig = versions.${baseName};
-  baseVersion = "${versions.${baseName}.kicadVersion.version}";

  # oce on aarch64 fails a test
  withOCE = oceSupport && !stdenv.isAarch64;
  withOCC = (withOCCT && !withOCE) || (oceSupport && stdenv.isAarch64);

-  kicad-libraries = callPackages ./libraries.nix versionConfig.libVersion;
+  libraries = callPackages ./libraries.nix versionConfig.libVersion;

 in
 stdenv.mkDerivation rec {

-  inherit pname;
-  version = "base-${baseVersion}";
+  i18n = libraries.i18n;
+
+  pname = "kicad-base";
+  version = "${versions.${baseName}.kicadVersion.version}";

  src = fetchFromGitLab (
    {
      group = "kicad";
      owner = "code";
      repo = "kicad";
-      rev = baseVersion;
    } // versionConfig.kicadVersion.src
  );

@ -57,9 +56,11 @@ stdenv.mkDerivation rec {
  # tagged releases don't have "unknown"
  # kicad nightlies use git describe --dirty
  # nix removes .git, so its approximated here
+  # "-1" appended to indicate we're adding a patch
  postPatch = ''
    substituteInPlace CMakeModules/KiCadVersion.cmake \
-      --replace "unknown" ${builtins.substring 0 10 src.rev}
+      --replace "unknown" "${builtins.substring 0 10 src.rev}-1" \
+      --replace "${version}" "${version}-1"
  '';

  makeFlags = optional (debug) [ "CFLAGS+=-Og" "CFLAGS+=-ggdb" ];
@ -113,7 +114,7 @@ stdenv.mkDerivation rec {

  postInstall = optional (withI18n) ''
    mkdir -p $out/share
-    lndir ${kicad-libraries.i18n}/share $out/share
+    lndir ${i18n}/share $out/share
  '';

  meta = {
@ -124,7 +125,6 @@ stdenv.mkDerivation rec {
    '';
    homepage = "https://www.kicad-pcb.org/";
    license = licenses.agpl3;
-    maintainers = with maintainers; [ evils kiwi berce ];
-    platforms = with platforms; linux;
+    platforms = platforms.all;
  };
 }
--- a/pkgs/applications/science/electronics/kicad/default.nix
+++ b/pkgs/applications/science/electronics/kicad/default.nix
@ -4,6 +4,7 @@
 , librsvg, cups

 , pname ? "kicad"
+, stable ? true
 , oceSupport ? false, opencascade
 , withOCCT ? true, opencascade-occt
 , ngspiceSupport ? true, libngspice
@ -18,7 +19,6 @@ assert ngspiceSupport -> libngspice != null;
 with lib;
 let

-  stable = pname != "kicad-unstable";
  baseName = if (stable) then "kicad" else "kicad-unstable";

  versions =  import ./versions.nix;
@ -35,17 +35,16 @@ let
  python = python3;
  wxPython = python3Packages.wxPython_4_0;

-  libraries = callPackages ./libraries.nix versionConfig.libVersion;
+in
+stdenv.mkDerivation rec {
+
+  passthru.libraries = callPackages ./libraries.nix versionConfig.libVersion;
  base = callPackage ./base.nix {
-    pname = baseName;
    inherit versions stable baseName;
    inherit wxGTK python wxPython;
    inherit debug withI18n withOCCT oceSupport ngspiceSupport scriptingSupport;
  };

-in
-stdenv.mkDerivation rec {
-
  inherit pname;
  version = versions.${baseName}.kicadVersion.version;

@ -63,7 +62,7 @@ stdenv.mkDerivation rec {

  # wrapGAppsHook added the equivalent to ${base}/share
  # though i noticed no difference without it
-  makeWrapperArgs = [
+  makeWrapperArgs = with passthru.libraries; [
    "--prefix XDG_DATA_DIRS : ${base}/share"
    "--prefix XDG_DATA_DIRS : ${hicolor-icon-theme}/share"
    "--prefix XDG_DATA_DIRS : ${gnome3.defaultIconTheme}/share"
@ -73,47 +72,40 @@ stdenv.mkDerivation rec {
    "--prefix XDG_DATA_DIRS : ${cups}/share"
    "--prefix GIO_EXTRA_MODULES : ${gnome3.dconf}/lib/gio/modules"

-    "--set KISYSMOD ${libraries.footprints}/share/kicad/modules"
-    "--set KICAD_SYMBOL_DIR ${libraries.symbols}/share/kicad/library"
-    "--set KICAD_TEMPLATE_DIR ${libraries.templates}/share/kicad/template"
-    "--prefix KICAD_TEMPLATE_DIR : ${libraries.symbols}/share/kicad/template"
-    "--prefix KICAD_TEMPLATE_DIR : ${libraries.footprints}/share/kicad/template"
+    "--set KISYSMOD ${footprints}/share/kicad/modules"
+    "--set KICAD_SYMBOL_DIR ${symbols}/share/kicad/library"
+    "--set KICAD_TEMPLATE_DIR ${templates}/share/kicad/template"
+    "--prefix KICAD_TEMPLATE_DIR : ${symbols}/share/kicad/template"
+    "--prefix KICAD_TEMPLATE_DIR : ${footprints}/share/kicad/template"
  ]
-  ++ optionals (with3d) [ "--set KISYS3DMOD ${libraries.packages3d}/share/kicad/modules/packages3d" ]
+  ++ optionals (with3d) [ "--set KISYS3DMOD ${packages3d}/share/kicad/modules/packages3d" ]
  ++ optionals (ngspiceSupport) [ "--prefix LD_LIBRARY_PATH : ${libngspice}/lib" ]

  # infinisil's workaround for #39493
  ++ [ "--set GDK_PIXBUF_MODULE_FILE ${librsvg}/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache" ]
  ;

-  # dunno why i have to add $makeWrapperArgs manually...
+  # why does $makeWrapperArgs have to be added explicitly?
  # $out and $program_PYTHONPATH don't exist when makeWrapperArgs gets set?
-  # not sure if anything has to be done with the other stuff in base/bin
-  # dxf2idf, idf2vrml, idfcyl, idfrect, kicad2step, kicad-ogltest
-  installPhase =
-    optionalString (scriptingSupport) '' buildPythonPath "${base} $pythonPath"
-    '' +
-    '' makeWrapper ${base}/bin/kicad $out/bin/kicad $makeWrapperArgs ''
-    + optionalString (scriptingSupport) '' --set PYTHONPATH "$program_PYTHONPATH"
-    '' +
-    '' makeWrapper ${base}/bin/pcbnew $out/bin/pcbnew $makeWrapperArgs ''
-    + optionalString (scriptingSupport) '' --set PYTHONPATH "$program_PYTHONPATH"
-    '' +
-    '' makeWrapper ${base}/bin/eeschema $out/bin/eeschema $makeWrapperArgs ''
-    + optionalString (scriptingSupport) '' --set PYTHONPATH "$program_PYTHONPATH"
-    '' +
-    '' makeWrapper ${base}/bin/gerbview $out/bin/gerbview $makeWrapperArgs ''
-    + optionalString (scriptingSupport) '' --set PYTHONPATH "$program_PYTHONPATH"
-    '' +
-    '' makeWrapper ${base}/bin/pcb_calculator $out/bin/pcb_calculator $makeWrapperArgs ''
-    + optionalString (scriptingSupport) '' --set PYTHONPATH "$program_PYTHONPATH"
-    '' +
-    '' makeWrapper ${base}/bin/pl_editor $out/bin/pl_editor $makeWrapperArgs ''
-    + optionalString (scriptingSupport) '' --set PYTHONPATH "$program_PYTHONPATH"
-    '' +
-    '' makeWrapper ${base}/bin/bitmap2component $out/bin/bitmap2component $makeWrapperArgs ''
-    + optionalString (scriptingSupport) '' --set PYTHONPATH "$program_PYTHONPATH"
-    ''
+  # kicad-ogltest's source seems to indicate that crashing is expected behaviour...
+  installPhase = with lib;
+    let
+      tools = [ "kicad" "pcbnew" "eeschema" "gerbview" "pcb_calculator" "pl_editor" "bitmap2component" ];
+      utils = [ "dxf2idf" "idf2vrml" "idfcyl" "idfrect" "kicad2step" "kicad-ogltest" ];
+    in
+    ( concatStringsSep "\n"
+      ( flatten [
+        ( optionalString (scriptingSupport) "buildPythonPath \"${base} $pythonPath\" \n" )
+
+        # wrap each of the directly usable tools
+        ( map ( tool: "makeWrapper ${base}/bin/${tool} $out/bin/${tool} $makeWrapperArgs"
+          + optionalString (scriptingSupport) " --set PYTHONPATH \"$program_PYTHONPATH\""
+            ) tools )
+
+        # link in the CLI utils
+        ( map ( util: "ln -s ${base}/bin/${util} $out/bin/${util}" ) utils )
+      ])
+    )
  ;

  # can't run this for each pname
@ -123,10 +115,11 @@ stdenv.mkDerivation rec {
  # and can't git commit if this could be running in parallel with other scripts
  passthru.updateScript = [ ./update.sh "all" ];

-  meta = {
-    description = if (stable)
-      then "Open Source Electronics Design Automation Suite"
-      else "Open Source EDA Suite, Development Build";
+  meta = rec {
+    description = (if (stable)
+      then "Open Source Electronics Design Automation suite"
+      else "Open Source EDA suite, development build")
+      + (if (!with3d) then ", without 3D models" else "");
    homepage = "https://www.kicad-pcb.org/";
    longDescription = ''
      KiCad is an open source software suite for Electronic Design Automation.
@ -134,12 +127,20 @@ stdenv.mkDerivation rec {
    '';
    license = licenses.agpl3;
    # berce seems inactive...
-    maintainers = with maintainers; [ evils kiwi berce ];
-    # kicad's cross-platform, not sure what to fill in here
-    platforms = with platforms; linux;
-  } // optionalAttrs with3d {
-    # We can't download the 3d models on Hydra - they are a ~1 GiB download and
-    # they occupy ~5 GiB in store.
-    hydraPlatforms = [];
+    maintainers = with stdenv.lib.maintainers; [ evils kiwi berce ];
+    # kicad is cross platform
+    platforms = stdenv.lib.platforms.all;
+    # despite that, nipkgs' wxGTK for darwin is "wxmac"
+    # and wxPython_4_0 does not account for this
+    # adjusting this package to downgrade to python2Packages.wxPython (wxPython 3),
+    # seems like more trouble than fixing wxPython_4_0 would be
+    # additionally, libngspice is marked as linux only, though it should support darwin
+
+    hydraPlatforms = if (with3d) then [ ] else platforms;
+    # We can't download the 3d models on Hydra,
+    # they are a ~1 GiB download and they occupy ~5 GiB in store.
+    # as long as the base and libraries (minus 3d) are build,
+    # this wrapper does not need to get built
+    # the kicad-*small "packages" cause this to happen
  };
 }
--- a/pkgs/applications/science/electronics/kicad/libraries.nix
+++ b/pkgs/applications/science/electronics/kicad/libraries.nix
@ -13,21 +13,27 @@
 with lib;
 let
  mkLib = name:
-    stdenv.mkDerivation
-      {
-        pname = "kicad-${name}";
-        version = "${version}";
-        src = fetchFromGitHub (
-          {
-            owner = "KiCad";
-            repo = "kicad-${name}";
-            rev = version;
-            inherit name;
-          } // (libSources.${name} or { })
-        );
-        nativeBuildInputs = [ cmake ];
-        meta.license = licenses.cc-by-sa-40;
+    stdenv.mkDerivation {
+      pname = "kicad-${name}";
+      version = "${version}";
+      src = fetchFromGitHub (
+        {
+          owner = "KiCad";
+          repo = "kicad-${name}";
+          rev = version;
+          inherit name;
+        } // (libSources.${name} or { })
+      );
+      nativeBuildInputs = [ cmake ];
+
+      meta = rec {
+        license = licenses.cc-by-sa-40;
+        platforms = stdenv.lib.platforms.all;
+        # the 3d models are a ~1 GiB download and occupy ~5 GiB in store.
+        # this would exceed the hydra output limit
+        hydraPlatforms = if (name == "packages3d" ) then [ ] else platforms;
      };
+    };
 in
 {
  symbols = mkLib "symbols";
@ -56,6 +62,9 @@ in
      );
      buildInputs = [ gettext ];
      nativeBuildInputs = [ cmake ];
-      meta.license = licenses.gpl2; # https://github.com/KiCad/kicad-i18n/issues/3
+      meta = {
+        license = licenses.gpl2; # https://github.com/KiCad/kicad-i18n/issues/3
+        platforms = stdenv.lib.platforms.all;
+      };
    };
 }
--- a/pkgs/applications/science/electronics/kicad/versions.nix
+++ b/pkgs/applications/science/electronics/kicad/versions.nix
@ -27,25 +27,25 @@
  };
  "kicad-unstable" = {
    kicadVersion = {
-      version =			"2020-04-25";
+      version =			"2020-05-06";
      src = {
-        rev =			"3759799d1e03b2da6a0dcd72273e4978880fc8f1";
-        sha256 =		"0ba14fla8m5zli68wfjkfc4ymvj4j8z92y3jigxs8hys0450bybi";
+        rev =			"c92181621e2e51dc8aae1bd9f4483bb3301ffaa5";
+        sha256 =		"0s50xn5gbjy7yxnp9yiynxvxi2mkcrp6yghgdzclpm40rnfyi0v5";
      };
    };
    libVersion = {
-      version =			"2020-04-25";
+      version =			"2020-05-06";
      libSources = {
-        i18n.rev =		"fc14baa52ca56a58b0048ab860bf31887d3cf8eb";
-        i18n.sha256 =		"05nayab7dkjyq7g3i9q7k55hcckpc0cmq4bbklmxx16rx4rbhzc6";
-        symbols.rev =		"0f9ff2d17237f90bb649bf0a52b6d454f68197e8";
-        symbols.sha256 =	"1a54428syn2xksc00n2bvh1alrx2vrqmp7cg7d2rn8nlq8yk4qd5";
+        i18n.rev =		"f29cab831eb823165fa2c5efab5d9c9b443e62e2";
+        i18n.sha256 =		"0cc0zvpml75yxphay3281f762ls08fzvv538cd5hmkr8xqlj3vbi";
+        symbols.rev =		"d4245ae8cf633095a0994ab01492bd56cd124112";
+        symbols.sha256 =	"11pynjgji3skw42q5mryz98f8z418k43jy6s2k90w6jv638z3cb0";
        templates.rev =		"7db8d4d0ea0711f1961d117853547fb3edbc3857";
        templates.sha256 =	"1hppcsrkn4dk6ggby6ckh0q65qxkywrbyxa4lwpaf7pxjyv498xg";
-        footprints.rev =	"61df6d8853b4c68cca0ac87784c0a33cff9394d3";
-        footprints.sha256 =	"0blmhk8pwd4mi6rlsr4lf4lq7j01h6xbpbvr3pm8pmw8zylhi54v";
-        packages3d.rev =	"88bcf2e817fe000bb2c05e14489afc3b1a4e10ed";
-        packages3d.sha256 =	"0z9p1fn5xbz940kr5jz2ibzf09hpdi1c9izmabkffvrnfy6408x6";
+        footprints.rev =	"3bff23ee339bc48490bb39deba5d8b2f1f42733e";
+        footprints.sha256 =	"0430r8k49ib6w1sjr8fx42szbz960yhlzg4w80jl5bwasq67nqwd";
+        packages3d.rev =	"889a3dd550233ec51baed4a04a01d4cc64a8d747";
+        packages3d.sha256 =	"152zv4j51v8skqlvrabblpcqpbn5yf3grisjj8vnwf7kdd41chb2";
      };
    };
  };
--- a/pkgs/applications/science/misc/snakemake/default.nix
+++ b/pkgs/applications/science/misc/snakemake/default.nix
@ -2,7 +2,7 @@

 python3Packages.buildPythonApplication rec {
  pname = "snakemake";
-  version = "5.15.0";
+  version = "5.16.0";

  propagatedBuildInputs = with python3Packages; [
    appdirs
@ -22,7 +22,7 @@ python3Packages.buildPythonApplication rec {

  src = python3Packages.fetchPypi {
    inherit pname version;
-    sha256 = "10cd1k5vg8ra5fnpqpdbl04qwx6h2mmmqbn71pl8j69w9110dkys";
+    sha256 = "0jlf3y8b1gdv5xz37yk9b5g2b65zkk45p15x0ypvd2blpzy80537";
  };

  doCheck = false; # Tests depend on Google Cloud credentials at ${HOME}/gcloud-service-key.json
--- a/pkgs/applications/version-management/git-and-tools/svn-all-fast-export/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/svn-all-fast-export/default.nix
@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub, qmake, qtbase, qttools, subversion, apr }:

 let
-  version = "1.0.17";
+  version = "1.0.18";
 in
 stdenv.mkDerivation {
  pname = "svn-all-fast-export";
@ -11,7 +11,7 @@ stdenv.mkDerivation {
    owner = "svn-all-fast-export";
    repo = "svn2git";
    rev = version;
-    sha256 = "13gmrxh4i34scv51h9x38v8jqfjykbbd9w7zzqjnxzvzpzsczg9a";
+    sha256 = "1b5yx2316hbyvw3v30vn1ljma9yd21nd59wis1gi34g92lgvqcd6";
  };

  nativeBuildInputs = [ qmake qttools ];
--- a/pkgs/applications/version-management/gitkraken/default.nix
+++ b/pkgs/applications/version-management/gitkraken/default.nix
@ -13,11 +13,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "gitkraken";
-  version = "6.5.4";
+  version = "6.6.0";

  src = fetchzip {
    url = "https://release.axocdn.com/linux/GitKraken-v${version}.tar.gz";
-    sha256 = "0hrxkhxp6kp82jg1pkcl6vxa5mjpgncx0k353bcnm4986ysizhj4";
+    sha256 = "1k94dyynsnm90mp7q9h6baq6q9zi539b1qszf3mqvd5i0id9kjcw";
  };

  dontBuild = true;
--- a/pkgs/applications/virtualization/virt-viewer/default.nix
+++ b/pkgs/applications/virtualization/virt-viewer/default.nix
@ -11,12 +11,12 @@ with stdenv.lib;

 stdenv.mkDerivation rec {
  baseName = "virt-viewer";
-  version = "8.0";
+  version = "9.0";
  name = "${baseName}-${version}";

  src = fetchurl {
    url = "http://virt-manager.org/download/sources/${baseName}/${name}.tar.gz";
-    sha256 = "1vdnjmhrva7r1n9nv09j8gc12hy0j9j5l4rka4hh0jbsbpnmiwyw";
+    sha256 = "09a83mzyn3b4nd7wpa659g1zf1fjbzb79rk968bz6k5xl21k7d4i";
  };

  nativeBuildInputs = [ pkgconfig intltool shared-mime-info wrapGAppsHook glib ];
--- a/pkgs/build-support/build-pecl.nix
+++ b/pkgs/build-support/build-pecl.nix
@ -3,6 +3,7 @@
 { pname
 , version
 , internalDeps ? []
+, peclDeps ? []
 , buildInputs ? []
 , nativeBuildInputs ? []
 , postPhpize ? ""
@ -16,11 +17,12 @@

 stdenv.mkDerivation (args // {
  name = "php-${pname}-${version}";
+  extensionName = pname;

  inherit src;

  nativeBuildInputs = [ autoreconfHook re2c ] ++ nativeBuildInputs;
-  buildInputs = [ php ] ++ buildInputs;
+  buildInputs = [ php ] ++ peclDeps ++ buildInputs;

  makeFlags = [ "EXTENSION_DIR=$(out)/lib/php/extensions" ] ++ makeFlags;

--- a/pkgs/data/themes/nordic-polar/default.nix
+++ b/pkgs/data/themes/nordic-polar/default.nix
@ -2,16 +2,16 @@

 stdenv.mkDerivation rec {
  pname = "nordic-polar";
-  version = "1.6.0";
+  version = "1.9.0";

  srcs = [
    (fetchurl {
      url = "https://github.com/EliverLara/Nordic-Polar/releases/download/v${version}/Nordic-Polar.tar.xz";
-      sha256 = "0cym8rcg8jpfraqlfrmymkm0jrsk1s9p7z6vcil4vxbyim9q9w16";
+      sha256 = "1583mx8frkl5w26myczbyrggrp07lmpsfj00h1bzicw6lz8jbxf1";
    })
    (fetchurl {
      url = "https://github.com/EliverLara/Nordic-Polar/releases/download/v${version}/Nordic-Polar-standard-buttons.tar.xz";
-      sha256 = "0s4wf9nqpa75km905jh03gl2d2hjcdvfacmkdz3njviqm6pwqxsv";
+      sha256 = "1n2qys0xcg1k28bwfrrr44cqz7q2rnfj6ry6qgd67ivgh63kmcq6";
    })
  ];

--- a/pkgs/data/themes/nordic/default.nix
+++ b/pkgs/data/themes/nordic/default.nix
@ -2,32 +2,32 @@

 stdenv.mkDerivation rec {
  pname = "nordic";
-  version = "1.8.1";
+  version = "1.9.0";

  srcs = [
    (fetchurl {
-      url = "https://github.com/EliverLara/Nordic/releases/download/V${version}/Nordic.tar.xz";
-      sha256 = "0jvc6l093gj9azkrjswdc1kqlyc6drnhsxgpzylzcgjxvxyi9vmd";
+      url = "https://github.com/EliverLara/Nordic/releases/download/v${version}/Nordic.tar.xz";
+      sha256 = "12x13h9w4yqk56a009zpj1kq3vn2hn290xryfv1b0vyf2r45rsn7";
    })
    (fetchurl {
-      url = "https://github.com/EliverLara/Nordic/releases/download/V${version}/Nordic-standard-buttons.tar.xz";
-      sha256 = "049hcvccjds465v78sk3cjg7zck36l1zpyrf4p8xinj2h3b74zr8";
+      url = "https://github.com/EliverLara/Nordic/releases/download/v${version}/Nordic-standard-buttons.tar.xz";
+      sha256 = "0f38nx1rvp9l6xz62yx6cbab4im8d425gxr52jkc8gfqpl5lrf0q";
    })
    (fetchurl {
-      url = "https://github.com/EliverLara/Nordic/releases/download/V${version}/Nordic-darker.tar.xz";
-      sha256 = "1qaj4x451ic8mx4aak1axw29jm6ymwgh5w3n3mw5kjm1fwg4b5dz";
+      url = "https://github.com/EliverLara/Nordic/releases/download/v${version}/Nordic-darker.tar.xz";
+      sha256 = "0frp0jf7hbiapl3m67av7rbm3sx8db52zi3j01k2hysh6kba7x33";
    })
    (fetchurl {
-      url = "https://github.com/EliverLara/Nordic/releases/download/V${version}/Nordic-darker-standard-buttons.tar.xz";
-      sha256 = "19wczzppimp7sql9v0sq1sc5j0ix51270c58j22mg01kd2h2iivy";
+      url = "https://github.com/EliverLara/Nordic/releases/download/v${version}/Nordic-darker-standard-buttons.tar.xz";
+      sha256 = "0grfsjr9kq0lszmqxvjvpgvf4avm34446nqykz1zfpdg50j7r54b";
    })
    (fetchurl {
-      url = "https://github.com/EliverLara/Nordic/releases/download/V${version}/Nordic-bluish-accent.tar.xz";
-      sha256 = "1jvjjxiz8q9583f3gidky65s2g5pd5bkvbx0jvwn0p0kz8vlzmzk";
+      url = "https://github.com/EliverLara/Nordic/releases/download/v${version}/Nordic-bluish-accent.tar.xz";
+      sha256 = "0zndldwavir22ay2r0jazpikzzww3hc09gsmbiyjmw54v29qhl9r";
    })
    (fetchurl {
-      url = "https://github.com/EliverLara/Nordic/releases/download/V${version}/Nordic-bluish-accent-standard-buttons.tar.xz";
-      sha256 = "0wqn0aszddq8nbh6c667rwhy7c1zky23a9q3d8gci421n20l6lyd";
+      url = "https://github.com/EliverLara/Nordic/releases/download/v${version}/Nordic-bluish-accent-standard-buttons.tar.xz";
+      sha256 = "1b9d2fvdndyh7lh3xhmc75csfbapl4gv59y7wy15k2awisvlvz07";
    })
  ];

--- a/pkgs/data/themes/obsidian2/default.nix
+++ b/pkgs/data/themes/obsidian2/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "theme-obsidian2";
-  version = "2.11";
+  version = "2.12";

  src = fetchFromGitHub {
    owner = "madmaxms";
    repo = "theme-obsidian-2";
    rev = "v${version}";
-    sha256 = "0n64cml2h8dw2m2m6j90d515saqapqzjz6xcv4kr544ibv62hn61";
+    sha256 = "1srl6wm6fjdc5pi9fjl5nghn4q40hn5jcxxl8qjvz8lkczylynnb";
  };

  propagatedUserEnvPkgs = [ gtk-engine-murrine ];
--- a/pkgs/data/themes/shades-of-gray/default.nix
+++ b/pkgs/data/themes/shades-of-gray/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "shades-of-gray-theme";
-  version = "1.2.1";
+  version = "1.3.0";

  src = fetchFromGitHub {
    owner = "WernerFP";
    repo = pname;
    rev = version;
-    sha256 = "153isyxly7nvivaz87zk2v1bqzcb3wk0j9vhgxzcz6qkf754q61s";
+    sha256 = "13ydym0i3032g5dyrnl5wxpvxv57b43q7iaq5achpmaixgn58gs8";
  };

  buildInputs = [ gtk_engines ];
--- a/pkgs/desktops/gnome-3/extensions/clipboard-indicator/default.nix
+++ b/pkgs/desktops/gnome-3/extensions/clipboard-indicator/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "gnome-shell-extension-clipboard-indicator";
-  version = "30";
+  version = "34";

  src = fetchFromGitHub {
    owner = "Tudmotu";
    repo = "gnome-shell-extension-clipboard-indicator";
    rev = "v${version}";
-    sha256 = "1fmgmxv2y678bj0kmymkgnnglcpqk8ww053izlq46xg7s27jjdf6";
+    sha256 = "0i00psc1ky70zljd14jzr627y7nd8xwnwrh4xpajl1f6djabh12s";
  };

  uuid = "clipboard-indicator@tudmotu.com";
--- a/pkgs/desktops/plasma-5/kwin/default.nix
+++ b/pkgs/desktops/plasma-5/kwin/default.nix
@ -11,11 +11,10 @@
  kcoreaddons, kcrash, kdeclarative, kdecoration, kglobalaccel, ki18n,
  kiconthemes, kidletime, kinit, kio, knewstuff, knotifications, kpackage,
  kscreenlocker, kservice, kwayland, kwidgetsaddons, kwindowsystem, kxmlgui,
-  plasma-framework, qtsensors, libcap, libdrm
+  plasma-framework, qtsensors, libcap, libdrm, mesa
 }:

 # TODO (ttuegel): investigate qmlplugindump failure
-# TODO (ttuegel): investigate gbm dependency

 mkDerivation {
  name = "kwin";
@ -30,7 +29,7 @@ mkDerivation {
    kcoreaddons kcrash kdeclarative kdecoration kglobalaccel ki18n kiconthemes
    kidletime kinit kio knewstuff knotifications kpackage kscreenlocker kservice
    kwayland kwidgetsaddons kwindowsystem kxmlgui plasma-framework
-    libcap libdrm
+    libcap libdrm mesa
  ];
  outputs = [ "bin" "dev" "out" ];
  patches = [
--- a/pkgs/development/compilers/llvm/10/compiler-rt-armv7l.patch
+++ b/pkgs/development/compilers/llvm/10/compiler-rt-armv7l.patch
@ -0,0 +1,32 @@
+diff -ur compiler-rt-10.0.0.src/cmake/builtin-config-ix.cmake compiler-rt-10.0.0.src-patched/cmake/builtin-config-ix.cmake
+--- compiler-rt-10.0.0.src/cmake/builtin-config-ix.cmake	2020-03-24 00:01:02.000000000 +0900
+++ compiler-rt-10.0.0.src-patched/cmake/builtin-config-ix.cmake	2020-05-10 03:42:00.883450706 +0900
+@@ -24,7 +24,7 @@
+ 
+ 
+ set(ARM64 aarch64)
+-set(ARM32 arm armhf armv6m armv7m armv7em armv7 armv7s armv7k)
+set(ARM32 arm armhf armv6m armv7m armv7em armv7 armv7s armv7k armv7l)
+ set(HEXAGON hexagon)
+ set(X86 i386)
+ set(X86_64 x86_64)
+diff -ur compiler-rt-10.0.0.src/lib/builtins/CMakeLists.txt compiler-rt-10.0.0.src-patched/lib/builtins/CMakeLists.txt
+--- compiler-rt-10.0.0.src/lib/builtins/CMakeLists.txt	2020-03-24 00:01:02.000000000 +0900
+++ compiler-rt-10.0.0.src-patched/lib/builtins/CMakeLists.txt	2020-05-10 03:44:49.468579650 +0900
+@@ -474,6 +474,7 @@
+ set(armv7_SOURCES ${arm_SOURCES})
+ set(armv7s_SOURCES ${arm_SOURCES})
+ set(armv7k_SOURCES ${arm_SOURCES})
+set(armv7l_SOURCES ${arm_SOURCES})
+ set(arm64_SOURCES ${aarch64_SOURCES})
+ 
+ # macho_embedded archs
+@@ -595,7 +596,7 @@
+   foreach (arch ${BUILTIN_SUPPORTED_ARCH})
+     if (CAN_TARGET_${arch})
+       # For ARM archs, exclude any VFP builtins if VFP is not supported
+-      if (${arch} MATCHES "^(arm|armhf|armv7|armv7s|armv7k|armv7m|armv7em)$")
+      if (${arch} MATCHES "^(arm|armhf|armv7|armv7s|armv7k|armv7l|armv7m|armv7em)$")
+         string(REPLACE ";" " " _TARGET_${arch}_CFLAGS "${TARGET_${arch}_CFLAGS}")
+         check_compile_definition(__VFP_FP__ "${CMAKE_C_FLAGS} ${_TARGET_${arch}_CFLAGS}" COMPILER_RT_HAS_${arch}_VFP)
+         if(NOT COMPILER_RT_HAS_${arch}_VFP)
--- a/pkgs/development/compilers/llvm/10/compiler-rt.nix
+++ b/pkgs/development/compilers/llvm/10/compiler-rt.nix
@ -48,7 +48,9 @@ stdenv.mkDerivation rec {
  patches = [
    ./compiler-rt-codesign.patch # Revert compiler-rt commit that makes codesign mandatory
    ./find-darwin-sdk-version.patch # don't test for macOS being >= 10.15
-  ];# ++ stdenv.lib.optional stdenv.hostPlatform.isMusl ./sanitizers-nongnu.patch
+  ]# ++ stdenv.lib.optional stdenv.hostPlatform.isMusl ./sanitizers-nongnu.patch
+    ++ stdenv.lib.optional stdenv.hostPlatform.isAarch32 ./compiler-rt-armv7l.patch;
+

  # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
  # to get it, but they're unfree. Since LLVM is rather central to the stdenv, we patch out TSAN support so that Hydra
--- a/pkgs/development/compilers/llvm/5/compiler-rt-armv7l.patch
+++ b/pkgs/development/compilers/llvm/5/compiler-rt-armv7l.patch
@ -0,0 +1,23 @@
+diff -ur compiler-rt-5.0.2.src/cmake/builtin-config-ix.cmake compiler-rt-5.0.2.src-patched/cmake/builtin-config-ix.cmake
+--- compiler-rt-5.0.2.src/cmake/builtin-config-ix.cmake	2017-05-25 00:53:24.000000000 +0900
+++ compiler-rt-5.0.2.src-patched/cmake/builtin-config-ix.cmake	2020-05-10 03:24:24.937433155 +0900
+@@ -24,7 +24,7 @@
+ 
+ 
+ set(ARM64 aarch64)
+-set(ARM32 arm armhf armv6m armv7m armv7em armv7 armv7s armv7k)
+set(ARM32 arm armhf armv6m armv7m armv7em armv7 armv7s armv7k armv7l)
+ set(X86 i386 i686)
+ set(X86_64 x86_64)
+ set(MIPS32 mips mipsel)
+diff -ur compiler-rt-5.0.2.src/lib/builtins/CMakeLists.txt compiler-rt-5.0.2.src-patched/lib/builtins/CMakeLists.txt
+--- compiler-rt-5.0.2.src/lib/builtins/CMakeLists.txt	2017-07-13 04:33:30.000000000 +0900
+++ compiler-rt-5.0.2.src-patched/lib/builtins/CMakeLists.txt	2020-05-10 03:24:45.945075423 +0900
+@@ -444,6 +444,7 @@
+ set(armv7_SOURCES ${arm_SOURCES})
+ set(armv7s_SOURCES ${arm_SOURCES})
+ set(armv7k_SOURCES ${arm_SOURCES})
+set(armv7l_SOURCES ${arm_SOURCES})
+ set(arm64_SOURCES ${aarch64_SOURCES})
+ 
+ # macho_embedded archs
--- a/pkgs/development/compilers/llvm/5/compiler-rt.nix
+++ b/pkgs/development/compilers/llvm/5/compiler-rt.nix
@ -48,7 +48,8 @@ stdenv.mkDerivation {
  patches = [
    ./compiler-rt-codesign.patch # Revert compiler-rt commit that makes codesign mandatory
  ] ++ stdenv.lib.optional stdenv.hostPlatform.isMusl ./sanitizers-nongnu.patch
-    ++ stdenv.lib.optional (stdenv.hostPlatform.libc == "glibc") ./compiler-rt-sys-ustat.patch;
+    ++ stdenv.lib.optional (stdenv.hostPlatform.libc == "glibc") ./compiler-rt-sys-ustat.patch
+    ++ stdenv.lib.optional stdenv.hostPlatform.isAarch32 ./compiler-rt-armv7l.patch;

  # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
  # to get it, but they're unfree. Since LLVM is rather central to the stdenv, we patch out TSAN support so that Hydra
--- a/pkgs/development/compilers/llvm/6/compiler-rt-armv7l.patch
+++ b/pkgs/development/compilers/llvm/6/compiler-rt-armv7l.patch
@ -0,0 +1,32 @@
+diff -ur compiler-rt-6.0.1.src/cmake/builtin-config-ix.cmake compiler-rt-6.0.1.src-patched/cmake/builtin-config-ix.cmake
+--- compiler-rt-6.0.1.src/cmake/builtin-config-ix.cmake	2017-12-01 06:04:11.000000000 +0900
+++ compiler-rt-6.0.1.src-patched/cmake/builtin-config-ix.cmake	2020-05-10 03:30:01.939694303 +0900
+@@ -24,7 +24,7 @@
+ 
+ 
+ set(ARM64 aarch64)
+-set(ARM32 arm armhf armv6m armv7m armv7em armv7 armv7s armv7k)
+set(ARM32 arm armhf armv6m armv7m armv7em armv7 armv7s armv7k armv7l)
+ set(X86 i386)
+ set(X86_64 x86_64)
+ set(MIPS32 mips mipsel)
+diff -ur compiler-rt-6.0.1.src/lib/builtins/CMakeLists.txt compiler-rt-6.0.1.src-patched/lib/builtins/CMakeLists.txt
+--- compiler-rt-6.0.1.src/lib/builtins/CMakeLists.txt	2017-12-25 06:11:32.000000000 +0900
+++ compiler-rt-6.0.1.src-patched/lib/builtins/CMakeLists.txt	2020-05-10 03:30:44.814964156 +0900
+@@ -452,6 +452,7 @@
+ set(armv7_SOURCES ${arm_SOURCES})
+ set(armv7s_SOURCES ${arm_SOURCES})
+ set(armv7k_SOURCES ${arm_SOURCES})
+set(armv7l_SOURCES ${arm_SOURCES})
+ set(arm64_SOURCES ${aarch64_SOURCES})
+ 
+ # macho_embedded archs
+@@ -521,7 +522,7 @@
+       set(_arch ${arch})
+       if("${arch}" STREQUAL "armv6m")
+         set(_arch "arm|armv6m")
+-      elseif("${arch}" MATCHES "^(armhf|armv7|armv7s|armv7k|armv7m|armv7em)$")
+      elseif("${arch}" MATCHES "^(armhf|armv7|armv7s|armv7k|armv7l|armv7m|armv7em)$")
+         set(_arch "arm")
+       endif()
+ 
--- a/pkgs/development/compilers/llvm/6/compiler-rt.nix
+++ b/pkgs/development/compilers/llvm/6/compiler-rt.nix
@ -47,7 +47,8 @@ stdenv.mkDerivation {

  patches = [
    ./compiler-rt-codesign.patch # Revert compiler-rt commit that makes codesign mandatory
-  ] ++ stdenv.lib.optional stdenv.hostPlatform.isMusl ./sanitizers-nongnu.patch;
+  ] ++ stdenv.lib.optional stdenv.hostPlatform.isMusl ./sanitizers-nongnu.patch
+    ++ stdenv.lib.optional stdenv.hostPlatform.isAarch32 ./compiler-rt-armv7l.patch;

  # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
  # to get it, but they're unfree. Since LLVM is rather central to the stdenv, we patch out TSAN support so that Hydra
--- a/pkgs/development/compilers/llvm/7/compiler-rt-armv7l.patch
+++ b/pkgs/development/compilers/llvm/7/compiler-rt-armv7l.patch
@ -0,0 +1,38 @@
+diff -ur compiler-rt-7.1.0.src/cmake/builtin-config-ix.cmake compiler-rt-7.1.0.src-patched/cmake/builtin-config-ix.cmake
+--- compiler-rt-7.1.0.src/cmake/builtin-config-ix.cmake	2018-05-25 06:36:27.000000000 +0900
+++ compiler-rt-7.1.0.src-patched/cmake/builtin-config-ix.cmake	2020-05-09 20:26:33.030608692 +0900
+@@ -24,7 +24,7 @@
+ 
+ 
+ set(ARM64 aarch64)
+-set(ARM32 arm armhf armv6m armv7m armv7em armv7 armv7s armv7k)
+set(ARM32 arm armhf armv6m armv7m armv7em armv7 armv7s armv7k armv7l)
+ set(HEXAGON hexagon)
+ set(X86 i386)
+ set(X86_64 x86_64)
+diff -ur compiler-rt-7.1.0.src/lib/builtins/CMakeLists.txt compiler-rt-7.1.0.src-patched/lib/builtins/CMakeLists.txt
+--- compiler-rt-7.1.0.src/lib/builtins/CMakeLists.txt	2018-07-31 03:18:59.000000000 +0900
+++ compiler-rt-7.1.0.src-patched/lib/builtins/CMakeLists.txt	2020-05-09 20:27:38.893409318 +0900
+@@ -453,6 +453,7 @@
+ set(armv7_SOURCES ${arm_SOURCES})
+ set(armv7s_SOURCES ${arm_SOURCES})
+ set(armv7k_SOURCES ${arm_SOURCES})
+set(armv7l_SOURCES ${arm_SOURCES})
+ set(arm64_SOURCES ${aarch64_SOURCES})
+ 
+ # macho_embedded archs
+@@ -563,12 +564,12 @@
+       set(_arch ${arch})
+       if("${arch}" STREQUAL "armv6m")
+         set(_arch "arm|armv6m")
+-      elseif("${arch}" MATCHES "^(armhf|armv7|armv7s|armv7k|armv7m|armv7em)$")
+      elseif("${arch}" MATCHES "^(armhf|armv7|armv7s|armv7k|armv7l|armv7m|armv7em)$")
+         set(_arch "arm")
+       endif()
+ 
+       # For ARM archs, exclude any VFP builtins if VFP is not supported
+-      if (${arch} MATCHES "^(arm|armhf|armv7|armv7s|armv7k|armv7m|armv7em)$")
+      if (${arch} MATCHES "^(arm|armhf|armv7|armv7s|armv7k|armv7l|armv7m|armv7em)$")
+         string(REPLACE ";" " " _TARGET_${arch}_CFLAGS "${TARGET_${arch}_CFLAGS}")
+         check_compile_definition(__VFP_FP__ "${CMAKE_C_FLAGS} ${_TARGET_${arch}_CFLAGS}" COMPILER_RT_HAS_${arch}_VFP)
+         if(NOT COMPILER_RT_HAS_${arch}_VFP)
--- a/pkgs/development/compilers/llvm/7/compiler-rt.nix
+++ b/pkgs/development/compilers/llvm/7/compiler-rt.nix
@ -48,7 +48,8 @@ stdenv.mkDerivation {
  patches = [
    ./compiler-rt-codesign.patch # Revert compiler-rt commit that makes codesign mandatory
  ] ++ stdenv.lib.optional (useLLVM) ./crtbegin-and-end.patch
-    ++ stdenv.lib.optional stdenv.hostPlatform.isMusl ./sanitizers-nongnu.patch;
+    ++ stdenv.lib.optional stdenv.hostPlatform.isMusl ./sanitizers-nongnu.patch
+    ++ stdenv.lib.optional stdenv.hostPlatform.isAarch32 ./compiler-rt-armv7l.patch;

  # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
  # to get it, but they're unfree. Since LLVM is rather central to the stdenv, we patch out TSAN support so that Hydra
--- a/pkgs/development/compilers/llvm/8/compiler-rt-armv7l.patch
+++ b/pkgs/development/compilers/llvm/8/compiler-rt-armv7l.patch
@ -0,0 +1,38 @@
+diff -ur compiler-rt-7.1.0.src/cmake/builtin-config-ix.cmake compiler-rt-7.1.0.src-patched/cmake/builtin-config-ix.cmake
+--- compiler-rt-7.1.0.src/cmake/builtin-config-ix.cmake	2018-05-25 06:36:27.000000000 +0900
+++ compiler-rt-7.1.0.src-patched/cmake/builtin-config-ix.cmake	2020-05-09 20:26:33.030608692 +0900
+@@ -24,7 +24,7 @@
+ 
+ 
+ set(ARM64 aarch64)
+-set(ARM32 arm armhf armv6m armv7m armv7em armv7 armv7s armv7k)
+set(ARM32 arm armhf armv6m armv7m armv7em armv7 armv7s armv7k armv7l)
+ set(HEXAGON hexagon)
+ set(X86 i386)
+ set(X86_64 x86_64)
+diff -ur compiler-rt-7.1.0.src/lib/builtins/CMakeLists.txt compiler-rt-7.1.0.src-patched/lib/builtins/CMakeLists.txt
+--- compiler-rt-7.1.0.src/lib/builtins/CMakeLists.txt	2018-07-31 03:18:59.000000000 +0900
+++ compiler-rt-7.1.0.src-patched/lib/builtins/CMakeLists.txt	2020-05-09 20:27:38.893409318 +0900
+@@ -453,6 +453,7 @@
+ set(armv7_SOURCES ${arm_SOURCES})
+ set(armv7s_SOURCES ${arm_SOURCES})
+ set(armv7k_SOURCES ${arm_SOURCES})
+set(armv7l_SOURCES ${arm_SOURCES})
+ set(arm64_SOURCES ${aarch64_SOURCES})
+ 
+ # macho_embedded archs
+@@ -563,12 +564,12 @@
+       set(_arch ${arch})
+       if("${arch}" STREQUAL "armv6m")
+         set(_arch "arm|armv6m")
+-      elseif("${arch}" MATCHES "^(armhf|armv7|armv7s|armv7k|armv7m|armv7em)$")
+      elseif("${arch}" MATCHES "^(armhf|armv7|armv7s|armv7k|armv7l|armv7m|armv7em)$")
+         set(_arch "arm")
+       endif()
+ 
+       # For ARM archs, exclude any VFP builtins if VFP is not supported
+-      if (${arch} MATCHES "^(arm|armhf|armv7|armv7s|armv7k|armv7m|armv7em)$")
+      if (${arch} MATCHES "^(arm|armhf|armv7|armv7s|armv7k|armv7l|armv7m|armv7em)$")
+         string(REPLACE ";" " " _TARGET_${arch}_CFLAGS "${TARGET_${arch}_CFLAGS}")
+         check_compile_definition(__VFP_FP__ "${CMAKE_C_FLAGS} ${_TARGET_${arch}_CFLAGS}" COMPILER_RT_HAS_${arch}_VFP)
+         if(NOT COMPILER_RT_HAS_${arch}_VFP)
--- a/pkgs/development/compilers/llvm/8/compiler-rt.nix
+++ b/pkgs/development/compilers/llvm/8/compiler-rt.nix
@ -48,7 +48,8 @@ stdenv.mkDerivation {
  patches = [
    ./compiler-rt-codesign.patch # Revert compiler-rt commit that makes codesign mandatory
  ]# ++ stdenv.lib.optional stdenv.hostPlatform.isMusl ./sanitizers-nongnu.patch
-    ++ stdenv.lib.optional (useLLVM) ./crtbegin-and-end.patch;
+    ++ stdenv.lib.optional (useLLVM) ./crtbegin-and-end.patch
+    ++ stdenv.lib.optional stdenv.hostPlatform.isAarch32 ./compiler-rt-armv7l.patch;

  # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
  # to get it, but they're unfree. Since LLVM is rather central to the stdenv, we patch out TSAN support so that Hydra
--- a/pkgs/development/compilers/llvm/9/compiler-rt-armv7l.patch
+++ b/pkgs/development/compilers/llvm/9/compiler-rt-armv7l.patch
@ -0,0 +1,38 @@
+diff -ur compiler-rt-7.1.0.src/cmake/builtin-config-ix.cmake compiler-rt-7.1.0.src-patched/cmake/builtin-config-ix.cmake
+--- compiler-rt-7.1.0.src/cmake/builtin-config-ix.cmake	2018-05-25 06:36:27.000000000 +0900
+++ compiler-rt-7.1.0.src-patched/cmake/builtin-config-ix.cmake	2020-05-09 20:26:33.030608692 +0900
+@@ -24,7 +24,7 @@
+ 
+ 
+ set(ARM64 aarch64)
+-set(ARM32 arm armhf armv6m armv7m armv7em armv7 armv7s armv7k)
+set(ARM32 arm armhf armv6m armv7m armv7em armv7 armv7s armv7k armv7l)
+ set(HEXAGON hexagon)
+ set(X86 i386)
+ set(X86_64 x86_64)
+diff -ur compiler-rt-7.1.0.src/lib/builtins/CMakeLists.txt compiler-rt-7.1.0.src-patched/lib/builtins/CMakeLists.txt
+--- compiler-rt-7.1.0.src/lib/builtins/CMakeLists.txt	2018-07-31 03:18:59.000000000 +0900
+++ compiler-rt-7.1.0.src-patched/lib/builtins/CMakeLists.txt	2020-05-09 20:27:38.893409318 +0900
+@@ -453,6 +453,7 @@
+ set(armv7_SOURCES ${arm_SOURCES})
+ set(armv7s_SOURCES ${arm_SOURCES})
+ set(armv7k_SOURCES ${arm_SOURCES})
+set(armv7l_SOURCES ${arm_SOURCES})
+ set(arm64_SOURCES ${aarch64_SOURCES})
+ 
+ # macho_embedded archs
+@@ -563,12 +564,12 @@
+       set(_arch ${arch})
+       if("${arch}" STREQUAL "armv6m")
+         set(_arch "arm|armv6m")
+-      elseif("${arch}" MATCHES "^(armhf|armv7|armv7s|armv7k|armv7m|armv7em)$")
+      elseif("${arch}" MATCHES "^(armhf|armv7|armv7s|armv7k|armv7l|armv7m|armv7em)$")
+         set(_arch "arm")
+       endif()
+ 
+       # For ARM archs, exclude any VFP builtins if VFP is not supported
+-      if (${arch} MATCHES "^(arm|armhf|armv7|armv7s|armv7k|armv7m|armv7em)$")
+      if (${arch} MATCHES "^(arm|armhf|armv7|armv7s|armv7k|armv7l|armv7m|armv7em)$")
+         string(REPLACE ";" " " _TARGET_${arch}_CFLAGS "${TARGET_${arch}_CFLAGS}")
+         check_compile_definition(__VFP_FP__ "${CMAKE_C_FLAGS} ${_TARGET_${arch}_CFLAGS}" COMPILER_RT_HAS_${arch}_VFP)
+         if(NOT COMPILER_RT_HAS_${arch}_VFP)
--- a/pkgs/development/compilers/llvm/9/compiler-rt.nix
+++ b/pkgs/development/compilers/llvm/9/compiler-rt.nix
@ -47,7 +47,8 @@ stdenv.mkDerivation rec {

  patches = [
    ./compiler-rt-codesign.patch # Revert compiler-rt commit that makes codesign mandatory
-  ];# ++ stdenv.lib.optional stdenv.hostPlatform.isMusl ./sanitizers-nongnu.patch
+  ]# ++ stdenv.lib.optional stdenv.hostPlatform.isMusl ./sanitizers-nongnu.patch
+    ++ stdenv.lib.optional stdenv.hostPlatform.isAarch32 ./compiler-rt-armv7l.patch;

  # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
  # to get it, but they're unfree. Since LLVM is rather central to the stdenv, we patch out TSAN support so that Hydra
--- a/pkgs/development/compilers/scala/2.13.nix
+++ b/pkgs/development/compilers/scala/2.13.nix
@ -1,11 +1,11 @@
 { stdenv, fetchurl, makeWrapper, jre, gnugrep, coreutils }:

 stdenv.mkDerivation rec {
-  name = "scala-2.13.1";
+  name = "scala-2.13.2";

  src = fetchurl {
    url = "https://www.scala-lang.org/files/archive/${name}.tgz";
-    sha256 = "1nq49acx3j6vnw0lhyrfqa23f671y3kc9lja4nki0j73jk2cq639";
+    sha256 = "1gvdxwlhgjmn8i5a8kcp19700rscjq9ylb35p8vj7nqys94zjkap";
  };

  propagatedBuildInputs = [ jre ] ;
--- a/pkgs/development/interpreters/php/default.nix
+++ b/pkgs/development/interpreters/php/default.nix
@ -67,7 +67,7 @@ let
              getDepsRecursively = extensions:
                let
                  deps = lib.concatMap
-                           (ext: ext.internalDeps or [])
+                           (ext: (ext.internalDeps or []) ++ (ext.peclDeps or []))
                           extensions;
                in
                  if ! (deps == []) then
@ -86,12 +86,12 @@ let
                  (map (ext:
                    let
                      extName = getExtName ext;
+                      phpDeps = (ext.internalDeps or []) ++ (ext.peclDeps or []);
                      type = "${lib.optionalString (ext.zendExtension or false) "zend_"}extension";
                    in
                      lib.nameValuePair extName {
                        text = "${type}=${ext}/lib/php/extensions/${extName}.so";
-                        deps = lib.optionals (ext ? internalDeps)
-                          (map getExtName ext.internalDeps);
+                        deps = map getExtName phpDeps;
                      })
                    (enabledExtensions ++ (getDepsRecursively enabledExtensions)));

@ -112,7 +112,7 @@ let
                  phpIni = "${phpWithExtensions}/lib/php.ini";
                  unwrapped = php;
                  tests = nixosTests.php;
-                  inherit (php-packages) packages extensions;
+                  inherit (php-packages) packages extensions buildPecl;
                  meta = php.meta // {
                    outputsToInstall = [ "out" ];
                  };
--- a/pkgs/development/libraries/libfm/default.nix
+++ b/pkgs/development/libraries/libfm/default.nix
@ -28,6 +28,11 @@ stdenv.mkDerivation rec {
    "sysconfdir=${placeholder "out"}/etc"
  ];

+  # libfm-extra is pulled in by menu-cache and thus leads to a collision for libfm
+  postInstall = optional (!extraOnly) ''
+     rm $out/lib/libfm-extra.so $out/lib/libfm-extra.so.* $out/lib/libfm-extra.la $out/lib/pkgconfig/libfm-extra.pc
+  '';
+
  enableParallelBuilding = true;

  meta = with stdenv.lib; {
--- a/pkgs/development/libraries/libsignal-protocol-c/default.nix
+++ b/pkgs/development/libraries/libsignal-protocol-c/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "libsignal-protocol-c";
-  version = "2.3.2";
+  version = "2.3.3";

  src = fetchFromGitHub {
    owner = "signalapp";
    repo = "libsignal-protocol-c";
    rev = "v${version}";
-    sha256 = "1qj2w4csy6j9jg1jy66n1qwysx7hgjywk4n35hlqcnh1kpa14k3p";
+    sha256 = "0z5p03vk15i6h870azfjgyfgxhv31q2vq6rfhnybrnkxq2wqzwhk";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/qtpbfimageplugin/default.nix
+++ b/pkgs/development/libraries/qtpbfimageplugin/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "qtpbfimageplugin";
-  version = "2.1";
+  version = "2.2";

  src = fetchFromGitHub {
    owner = "tumic0";
    repo = "QtPBFImagePlugin";
    rev = version;
-    sha256 = "05l28xf7pf9mxm6crrdx5i7d2ri3hlg5iva0fqc8wxnj8pf2m38r";
+    sha256 = "1w2d33g13vkjasabmcgvhsmfqv3jmwbxhqxm1jnyc7d4nlk4jwmb";
  };

  nativeBuildInputs = [ qmake ];
--- a/pkgs/development/ocaml-modules/async/default.nix
+++ b/pkgs/development/ocaml-modules/async/default.nix
@ -1,23 +0,0 @@
-{stdenv, buildOcaml, fetchurl, async_kernel_p4,
- async_unix_p4, async_extra_p4, pa_ounit}:
-
-buildOcaml rec {
-  name = "async";
-  version = "112.24.00";
-
-  minimumSupportedOcamlVersion = "4.02";
-
-  src = fetchurl {
-    url = "https://github.com/janestreet/async/archive/${version}.tar.gz";
-    sha256 = "ecc4ca939ab098e689332921b110dbaacd06d9f8d8bf697023dfff3ca37dc1e9";
-  };
-
-  propagatedBuildInputs = [ async_kernel_p4 async_unix_p4 async_extra_p4 pa_ounit ];
-
-  meta = with stdenv.lib; {
-    homepage = "https://github.com/janestreet/async";
-    description = "Jane Street Capital's asynchronous execution library";
-    license = licenses.asl20;
-    maintainers = [ maintainers.ericbmerritt ];
-  };
-}
--- a/pkgs/development/ocaml-modules/janestreet/async.nix
+++ b/pkgs/development/ocaml-modules/janestreet/async.nix
@ -1,16 +0,0 @@
-{stdenv, buildOcamlJane, async_kernel,
- async_unix, async_extra}:
-
-buildOcamlJane {
-  name = "async";
-  version = "113.33.03";
-  hash = "0wyspkp8k833fh03r3h016nbfn6kjfhvb2bg42cly6agcak59fmr";
-  propagatedBuildInputs = [ async_kernel async_unix async_extra ];
-
-  meta = with stdenv.lib; {
-    homepage = "https://github.com/janestreet/async";
-    description = "Jane Street Capital's asynchronous execution library";
-    license = licenses.asl20;
-    maintainers = [ maintainers.maurer maintainers.ericbmerritt ];
-  };
-}
--- a/pkgs/development/ocaml-modules/lablgtk3/default.nix
+++ b/pkgs/development/ocaml-modules/lablgtk3/default.nix
@ -1,14 +1,14 @@
 { lib, fetchurl, pkgconfig, buildDunePackage, gtk3, cairo2 }:

 buildDunePackage rec {
-  version = "3.0.beta6";
+  version = "3.1.0";
  pname = "lablgtk3";

  minimumOCamlVersion = "4.05";

  src = fetchurl {
    url = "https://github.com/garrigue/lablgtk/releases/download/${version}/lablgtk3-${version}.tbz";
-    sha256 = "1jni5cbp54qs7y0dc5zkm28v2brpfwy5miighv7cy0nmmxrsq520";
+    sha256 = "1fn04qwgkwc86jndlrnv4vxcmasjsp1mmcgfznahj1ccc7bv47sv";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/development/ocaml-modules/ocamlfuse/default.nix
+++ b/pkgs/development/ocaml-modules/ocamlfuse/default.nix
@ -1,22 +1,17 @@
-{ stdenv, fetchFromGitHub, ocaml, camlidl, fuse, findlib }:
+{ stdenv, buildDunePackage, fetchFromGitHub, camlidl, fuse }:

-stdenv.mkDerivation rec {
+buildDunePackage {
  pname = "ocamlfuse";
-  version = "2.7.1_cvs5";
+  version = "2.7.1_cvs6_e35e76b";

  src = fetchFromGitHub {
    owner = "astrada";
    repo = "ocamlfuse";
-    rev = "v${version}";
-    sha256 = "01ayw2hzpxan95kncbxh9isj9g149cs8scq3xim1vy8bz085wb0m";
+    rev = "e35e76bee3b06806256b5bfca108b7697267cd5c";
+    sha256 = "1v9g0wh7rnjkrjrnw50145g6ry38plyjs8fq8w0nlzwizhf3qhff";
  };

-  buildInputs = [ocaml findlib];
-  propagatedBuildInputs = [camlidl fuse];
-  configurePhase = '' ocaml setup.ml -configure --prefix $out '';
-  buildPhase = "ocaml setup.ml -build";
-  installPhase = "ocaml setup.ml -install";
-  createFindlibDestdir = true;
+  propagatedBuildInputs = [ camlidl fuse ];

  meta = {
    homepage = "https://sourceforge.net/projects/ocamlfuse";
--- a/pkgs/development/ocaml-modules/wasm/default.nix
+++ b/pkgs/development/ocaml-modules/wasm/default.nix
@ -1,19 +1,18 @@
 { stdenv, fetchFromGitHub, ocaml, findlib, ocamlbuild }:

 if !stdenv.lib.versionAtLeast ocaml.version "4.02"
- || stdenv.lib.versionAtLeast ocaml.version "4.08"
 then throw "wasm is not available for OCaml ${ocaml.version}"
 else

 stdenv.mkDerivation rec {
  name = "ocaml${ocaml.version}-wasm-${version}";
-  version = "1.0";
+  version = "1.1";

  src = fetchFromGitHub {
    owner = "WebAssembly";
    repo = "spec";
    rev = "v${version}";
-    sha256 = "0r0wj31s2yg4vn4hyw2afc8wp8b0k3q130yiypwq3dlvfxrr70m6";
+    sha256 = "1jsgrjqzsdmm6f5pgd947nikj7pnxx1mqdnz16j7s62rg8x06h7d";
  };

  buildInputs = [ ocaml findlib ocamlbuild ];
--- a/pkgs/development/python-modules/ROPGadget/default.nix
+++ b/pkgs/development/python-modules/ROPGadget/default.nix
@ -3,11 +3,11 @@

 buildPythonPackage rec {
  pname = "ROPGadget";
-  version = "6.2";
+  version = "6.3";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0idiicgpijar9l9kqmfdh865c2mkfgxg0q7lpz77jc09l6q0afjh";
+    sha256 = "0v34w88if3p4vn46aby24msfnxj6znmkf4848n4d24jnykxcsqk9";
  };

  propagatedBuildInputs = [ capstone ];
--- a/pkgs/development/python-modules/fastapi/default.nix
+++ b/pkgs/development/python-modules/fastapi/default.nix
@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "fastapi";
-  version = "0.54.0";
+  version = "0.54.1";
  format = "flit";
  disabled = !isPy3k;

@ -24,9 +24,14 @@ buildPythonPackage rec {
    owner = "tiangolo";
    repo = "fastapi";
    rev = version;
-    sha256 = "17bicrpr801z71wrn9iimvh7qk6iwyxvr89ialf0s2rxxa2s0yb5";
+    sha256 = "0k0lss8x6lzf0szcli48v28r269fsx1jdkr9q78liz47dz5x03d8";
  };

+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "starlette ==0.13.2" "starlette"
+  '';
+
  propagatedBuildInputs = [
    uvicorn
    starlette
--- a/pkgs/development/python-modules/jc/default.nix
+++ b/pkgs/development/python-modules/jc/default.nix
@ -1,6 +1,6 @@
 { stdenv
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
 , ruamel_yaml
 , xmltodict
 , pygments
@ -9,12 +9,14 @@

 buildPythonPackage rec {
  pname = "jc";
-  version = "1.10.7";
+  version = "1.10.10";
  disabled = isPy27;

-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "198vsnh6j0nv9d7msnvw6qr1bzf0nffjsz7clm11bs7fh3ri3qxp";
+  src = fetchFromGitHub {
+    owner = "kellyjonbrazil";
+    repo = "jc";
+    rev = "v${version}";
+    sha256 = "1rkgk1d1gijic6l6rsvz5mpfhdj8l7qc60aqafj27s4yi5bbqrc7";
  };

  propagatedBuildInputs = [ ruamel_yaml xmltodict pygments ];
--- a/pkgs/development/python-modules/ldap3/default.nix
+++ b/pkgs/development/python-modules/ldap3/default.nix
@ -2,11 +2,11 @@

 buildPythonPackage rec {
  pname = "ldap3";
-  version = "2.6.1";
+  version = "2.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0ag5xqlki6pjk3f50b8ar8vynx2fmkna7rfampv3kdgwg8z6gjr7";
+    sha256 = "1h1q8g1c2nkhx8p5n91bzkvjx5js5didi9xqbnmfrxqbnyc45w0p";
  };

  propagatedBuildInputs = [ pyasn1 ];
--- a/pkgs/development/python-modules/libarcus/default.nix
+++ b/pkgs/development/python-modules/libarcus/default.nix
@ -3,7 +3,7 @@

 buildPythonPackage rec {
  pname = "libarcus";
-  version = "4.5.0";
+  version = "4.6.1";
  format = "other";

  src = fetchFromGitHub {
--- a/pkgs/development/python-modules/libsavitar/default.nix
+++ b/pkgs/development/python-modules/libsavitar/default.nix
@ -2,14 +2,14 @@

 buildPythonPackage rec {
  pname = "libsavitar";
-  version = "4.5.0";
+  version = "4.6.1";
  format = "other";

  src = fetchFromGitHub {
    owner = "Ultimaker";
    repo = "libSavitar";
    rev = version;
-    sha256 = "1l3l8cgaxzqdk93880p2ijrabshdj5sq05cwj1i6jpmhlqc5b9rx";
+    sha256 = "0nk8zl5b0b36wrrkj271ck4phzxsigkjsazndscjslc9nkldmnpq";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/onnx/default.nix
+++ b/pkgs/development/python-modules/onnx/default.nix
@ -18,29 +18,18 @@

 buildPythonPackage rec {
  pname = "onnx";
-  version = "1.6.0";
+  version = "1.7.0";

  # Due to Protobuf packaging issues this build of Onnx with Python 2 gives
-  # errors on import
+  # errors on import.
+  # Also support for Python 2 will be deprecated from Onnx v1.8.
  disabled = isPy27;

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0ig33jl3591041lyylxp52yi20rfrcqx3i030hd6al8iabzc721v";
+    sha256 = "0j6rgfbhsw3a8id8pyg18y93k68lbjbj1kq6qia36h69f6pvlyjy";
  };

-  # Remove the unqualified requirement for the typing package for running the
-  # tests. typing is already required for the installation, where it is
-  # correctly qualified so as to only be required for sufficiently old Python
-  # versions.
-  # This patch should be in the next release (>1.6).
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/onnx/onnx/commit/c963586d0f8dd5740777b2fd06f04ec60816de9f.patch";
-      sha256 = "1hl26cw5zckc91gmh0bdah87jyprccxiw0f4i5h1gwkq28hm6wbj";
-    })
-  ];
-
  nativeBuildInputs = [ cmake ];

  propagatedBuildInputs = [
@ -61,13 +50,17 @@ buildPythonPackage rec {
    patchShebangs tools/protoc-gen-mypy.py
  '';

+  preBuild = ''
+    export MAX_JOBS=$NIX_BUILD_CORES
+  '';
+
  # The executables are just utility scripts that aren't too important
  postInstall = ''
    rm -r $out/bin
  '';

-  # The setup.py does all the configuration (running CMake)
-  dontConfigure = true;
+  # The setup.py does all the configuration
+  dontUseCmakeConfigure = true;

  meta = {
    homepage    = "http://onnx.ai";
--- a/pkgs/development/python-modules/parver/default.nix
+++ b/pkgs/development/python-modules/parver/default.nix
@ -11,11 +11,11 @@

 buildPythonPackage rec {
  pname = "parver";
-  version = "0.2.1";
+  version = "0.3.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0jzyylcmjxb0agc4fpdnzdnv2ajvp99rs9pz7qcklnhlmy8scdqv";
+    sha256 = "0a6jp17c1ag6b9yp5xgy9wvznk3g0v2f8gpwkcwxpyc9ygk98zdm";
  };

  propagatedBuildInputs = [ six attrs arpeggio ];
--- a/pkgs/development/python-modules/plotly/default.nix
+++ b/pkgs/development/python-modules/plotly/default.nix
@ -11,11 +11,11 @@

 buildPythonPackage rec {
  pname = "plotly";
-  version = "4.4.1";
+  version = "4.6.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "acc94f17452471ca3446c2ce491c4d1affb99b9ddd9eac4e05614ac4318f8780";
+    sha256 = "0br996lqbyq1prq9hhrzkgpicz5fgvxamzjrrpms20a2y1alkwv1";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pyGithub/default.nix
+++ b/pkgs/development/python-modules/pyGithub/default.nix
@ -12,14 +12,14 @@

 buildPythonPackage rec {
  pname = "PyGithub";
-  version = "1.47";
+  version = "1.51";
  disabled = !isPy3k;

  src = fetchFromGitHub {
    owner = "PyGithub";
    repo = "PyGithub";
    rev = "v${version}";
-    sha256 = "0zvp1gib2lryw698vxkbdv40n3lsmdlhwp7vdcg41dqqa5nfryhn";
+    hash = "sha256-8uQCFiw1ByPOX8ZRUlSLYPIibjmd19r/JtTnmQdz5cM=";
  };

  checkInputs = [ httpretty parameterized pytestCheckHook ];
--- a/pkgs/development/python-modules/pyenchant/default.nix
+++ b/pkgs/development/python-modules/pyenchant/default.nix
@ -1,16 +1,18 @@
 { stdenv
 , buildPythonPackage
+, isPy27
 , fetchPypi
 , enchant2
 }:

 buildPythonPackage rec {
  pname = "pyenchant";
-  version = "2.0.0";
+  version = "3.0.1";
+  disabled = isPy27;

  src = fetchPypi {
    inherit pname version;
-    sha256 = "fc31cda72ace001da8fe5d42f11c26e514a91fa8c70468739216ddd8de64e2a0";
+    sha256 = "0nfmckqm45fbfz795qw5hgvygdxgxchdiwp3kmm1k05z99j6mlhv";
  };

  propagatedBuildInputs = [ enchant2 ];
--- a/Show More
+++ b/Show More