Merge staging into staging-next

README.md

@@ -51,9 +51,7 @@ system, [Hydra](https://hydra.nixos.org/).
 Artifacts successfully built with Hydra are published to cache at
 https://cache.nixos.org/. When successful build and test criteria are
 met, the Nixpkgs expressions are distributed via [Nix
-channels](https://nixos.org/nix/manual/#sec-channels). The channels
-are provided via a read-only mirror of the Nixpkgs repository called
-[nixpkgs-channels](https://github.com/NixOS/nixpkgs-channels).
+channels](https://nixos.org/nix/manual/#sec-channels).
 
 # Contributing
 

doc/introduction.chapter.md

@@ -47,5 +47,5 @@ which also builds binary packages from the Nix expressions in Nixpkgs for
 The binaries are made available via a [binary cache](https://cache.nixos.org).
 
 The current Nix expressions of the channels are available in the
-[`nixpkgs-channels`](https://github.com/NixOS/nixpkgs-channels) repository,
-which has branches corresponding to the available channels.
+[`nixpkgs`](https://github.com/NixOS/nixpkgs) repository in branches
+that correspond to the channel names (e.g. `nixos-19.09-small`).

doc/reviewing-contributions.xml

@@ -115,19 +115,12 @@
       <para>
        It is possible to rebase the changes on nixos-unstable or nixpkgs-unstable for easier review by running the following commands from a nixpkgs clone.
 <screen>
-<prompt>$ </prompt>git remote add channels https://github.com/NixOS/nixpkgs-channels.git <co
-  xml:id='reviewing-rebase-1' />
-<prompt>$ </prompt>git fetch channels nixos-unstable <co xml:id='reviewing-rebase-2' />
+<prompt>$ </prompt>git fetch origin nixos-unstable <co xml:id='reviewing-rebase-2' />
 <prompt>$ </prompt>git fetch origin pull/PRNUMBER/head <co xml:id='reviewing-rebase-3' />
 <prompt>$ </prompt>git rebase --onto nixos-unstable BASEBRANCH FETCH_HEAD <co
   xml:id='reviewing-rebase-4' />
 </screen>
        <calloutlist>
-        <callout arearefs='reviewing-rebase-1'>
-         <para>
-          This should be done only once to be able to fetch channel branches from the nixpkgs-channels repository.
-         </para>
-        </callout>
         <callout arearefs='reviewing-rebase-2'>
          <para>
           Fetching the nixos-unstable branch.

nixos/doc/manual/development/sources.xml

@@ -13,17 +13,16 @@
 <screen>
 <prompt>$ </prompt>git clone https://github.com/NixOS/nixpkgs
 <prompt>$ </prompt>cd nixpkgs
-<prompt>$ </prompt>git remote add channels https://github.com/NixOS/nixpkgs-channels
-<prompt>$ </prompt>git remote update channels
+<prompt>$ </prompt>git remote update origin
 </screen>
   This will check out the latest Nixpkgs sources to
   <filename>./nixpkgs</filename> the NixOS sources to
   <filename>./nixpkgs/nixos</filename>. (The NixOS source tree lives in a
-  subdirectory of the Nixpkgs repository.) The remote
-  <literal>channels</literal> refers to a read-only repository that tracks the
-  Nixpkgs/NixOS channels (see <xref linkend="sec-upgrading"/> for more
+  subdirectory of the Nixpkgs repository.) The
+  <literal>nixpkgs</literal> repository has branches that correspond
+  to each Nixpkgs/NixOS channel (see <xref linkend="sec-upgrading"/> for more
   information about channels). Thus, the Git branch
-  <literal>channels/nixos-17.03</literal> will contain the latest built and
+  <literal>origin/nixos-17.03</literal> will contain the latest built and
   tested version available in the <literal>nixos-17.03</literal> channel.
  </para>
  <para>
@@ -40,15 +39,15 @@
   Or, to base your local branch on the latest version available in a NixOS
   channel:
 <screen>
-<prompt>$ </prompt>git remote update channels
-<prompt>$ </prompt>git checkout -b local channels/nixos-17.03
+<prompt>$ </prompt>git remote update origin
+<prompt>$ </prompt>git checkout -b local origin/nixos-17.03
 </screen>
   (Replace <literal>nixos-17.03</literal> with the name of the channel you want
   to use.) You can use <command>git merge</command> or <command>git
   rebase</command> to keep your local branch in sync with the channel, e.g.
 <screen>
-<prompt>$ </prompt>git remote update channels
-<prompt>$ </prompt>git merge channels/nixos-17.03
+<prompt>$ </prompt>git remote update origin
+<prompt>$ </prompt>git merge origin/nixos-17.03
 </screen>
   You can use <command>git cherry-pick</command> to copy commits from your
   local branch to the upstream branch.

nixos/doc/manual/release-notes/rl-2003.xml

@@ -84,6 +84,16 @@
   </para>
 
   <itemizedlist>
+   <listitem>
+    <para>
+      GnuPG is now built without support for a graphical passphrase entry
+      by default. Please enable the <literal>gpg-agent</literal> user service
+      via the NixOS option <literal>programs.gnupg.agent.enable</literal>.
+      Note that upstream recommends using <literal>gpg-agent</literal> and
+      will spawn a <literal>gpg-agent</literal> on the first invocation of
+      GnuPG anyway.
+    </para>
+   </listitem>
    <listitem>
     <para>
      The <literal>dynamicHosts</literal> option has been removed from the
@@ -113,6 +123,14 @@
    <listitem>
      <para>SD images are now compressed by default using <literal>bzip2</literal>.</para>
    </listitem>
+   <listitem>
+    <para>
+     OpenSSH has been upgraded from 7.9 to 8.1, improving security and adding features
+     but with potential incompatibilities.  Consult the
+     <link xlink:href="https://www.openssh.com/txt/release-8.1">
+     release announcement</link> for more information.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 </section>

nixos/modules/config/no-x-libs.nix

@@ -34,7 +34,6 @@ with lib;
       networkmanager-openvpn = super.networkmanager-openvpn.override { withGnome = false; };
       networkmanager-vpnc = super.networkmanager-vpnc.override { withGnome = false; };
       networkmanager-iodine = super.networkmanager-iodine.override { withGnome = false; };
-      pinentry = super.pinentry.override { gtk2 = null; gcr = null; qt4 = null; qt5 = null; };
       gobject-introspection = super.gobject-introspection.override { x11Support = false; };
     }));
   };

nixos/modules/installer/tools/tools.nix

@@ -120,7 +120,11 @@ in
         # Some programs need SUID wrappers, can be configured further or are
         # started in user sessions.
         # programs.mtr.enable = true;
-        # programs.gnupg.agent = { enable = true; enableSSHSupport = true; };
+        # programs.gnupg.agent = {
+        #   enable = true;
+        #   enableSSHSupport = true;
+        #   flavour = "gnome3";
+        # };
 
         # List services that you want to enable:
 

nixos/modules/profiles/installation-device.nix

@@ -31,9 +31,6 @@ with lib;
     # Let the user play Rogue on TTY 8 during the installation.
     #services.rogue.enable = true;
 
-    # Disable some other stuff we don't need.
-    services.udisks2.enable = mkDefault false;
-
     # Use less privileged nixos user
     users.users.nixos = {
       isNormalUser = true;

nixos/modules/programs/gnupg.nix

@@ -6,6 +6,19 @@ let
 
   cfg = config.programs.gnupg;
 
+  xserverCfg = config.services.xserver;
+
+  defaultPinentryFlavor =
+    if xserverCfg.desktopManager.lxqt.enable
+    || xserverCfg.desktopManager.plasma5.enable then
+      "qt"
+    else if xserverCfg.desktopManager.xfce.enable then
+      "gtk2"
+    else if xserverCfg.enable then
+      "gnome3"
+    else
+      null;
+
 in
 
 {
@@ -54,6 +67,20 @@ in
       '';
     };
 
+    agent.pinentryFlavor = mkOption {
+      type = types.nullOr (types.enum pkgs.pinentry.flavors);
+      example = "gnome3";
+      description = ''
+        Which pinentry interface to use. If not null, the path to the
+        pinentry binary will be passed to gpg-agent via commandline and
+        thus overrides the pinentry option in gpg-agent.conf in the user's
+        home directory.
+        If not set at all, it'll pick an appropriate flavor depending on the
+        system configuration (qt flavor for lxqt and plasma5, gtk2 for xfce
+        4.12, gnome3 on all other systems with X enabled, ncurses otherwise).
+      '';
+    };
+
     dirmngr.enable = mkOption {
       type = types.bool;
       default = false;
@@ -64,6 +91,16 @@ in
   };
 
   config = mkIf cfg.agent.enable {
+    programs.gnupg.agent.pinentryFlavor = mkDefault defaultPinentryFlavor;
+
+    # This overrides the systemd user unit shipped with the gnupg package
+    systemd.user.services.gpg-agent = mkIf (cfg.agent.pinentryFlavor != null) {
+      serviceConfig.ExecStart = [ "" ''
+        ${pkgs.gnupg}/bin/gpg-agent --supervised \
+          --pinentry-program ${pkgs.pinentry.${cfg.agent.pinentryFlavor}}/bin/pinentry
+      '' ];
+    };
+
     systemd.user.sockets.gpg-agent = {
       wantedBy = [ "sockets.target" ];
     };
@@ -83,7 +120,7 @@ in
     systemd.user.sockets.dirmngr = mkIf cfg.dirmngr.enable {
       wantedBy = [ "sockets.target" ];
     };
-    
+
     environment.systemPackages = with pkgs; [ cfg.package ];
     systemd.packages = [ cfg.package ];
 

nixos/modules/services/hardware/udisks2.nix

@@ -34,10 +34,7 @@ with lib;
 
     services.dbus.packages = [ pkgs.udisks2 ];
 
-    system.activationScripts.udisks2 =
-      ''
-        mkdir -m 0755 -p /var/lib/udisks2
-      '';
+    systemd.tmpfiles.rules = [ "d /var/lib/udisks2 0755 root root -" ];
 
     services.udev.packages = [ pkgs.udisks2 ];
 

nixos/tests/installer.nix

@@ -54,8 +54,6 @@ let
 
         hardware.enableAllFirmware = lib.mkForce false;
 
-        services.udisks2.enable = lib.mkDefault false;
-
         ${replaceChars ["\n"] ["\n  "] extraConfig}
       }
     '';
@@ -295,8 +293,6 @@ let
               ++ optional (bootLoader == "grub" && grubVersion == 1) pkgs.grub
               ++ optionals (bootLoader == "grub" && grubVersion == 2) [ pkgs.grub2 pkgs.grub2_efi ];
 
-            services.udisks2.enable = mkDefault false;
-
             nix.binaryCaches = mkForce [ ];
             nix.extraOptions =
               ''

nixos/tests/os-prober.nix

@@ -51,12 +51,11 @@ let
       hashed-mirrors =
       connect-timeout = 1
     '';
-    services.udisks2.enable = lib.mkForce false;
   };
   # /etc/nixos/configuration.nix for the vm
   configFile = pkgs.writeText "configuration.nix"  ''
     {config, pkgs, ...}: ({
-    imports = 
+    imports =
           [ ./hardware-configuration.nix
             <nixpkgs/nixos/modules/testing/test-instrumentation.nix>
           ];

pkgs/applications/networking/browsers/firefox/packages.nix

@@ -17,10 +17,10 @@ rec {
 
   firefox = common rec {
     pname = "firefox";
-    ffversion = "69.0.2";
+    ffversion = "70.0";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${ffversion}/source/firefox-${ffversion}.source.tar.xz";
-      sha512 = "2ag1syrvlkch7vl151hkq8abf86p9v6b6gmgcbh26b8wfva1p1ss1x09h4w50zmcc6jq4q5mcxgf1sd9zna552jl90k1y4rqvrrzwl6";
+      sha512 = "1rjji7w0rf4b7h6hyllwav1xcbaiv37jmf5s0n0c3cwf9b76yhf8nhygm1a97m26f6rvbmhcv0dx4l8bh06cz9mcbbxy4lhsn43sr62";
     };
 
     patches = [

pkgs/development/compilers/go/1.13.nix

@@ -30,11 +30,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.13.1";
+  version = "1.13.3";
 
   src = fetchurl {
     url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "0n4k42bbrj5g9b1kczkfsih049v43vqzaps7n69gmfa4jpk59wc1";
+    sha256 = "1pz3423gw3z2zwcmk9l2c6v68w5is39gndq7502c9mbm8c226wag";
   };
 
   # perl is used for testing go vet

pkgs/development/interpreters/python/cpython/2.7/default.nix

@@ -79,12 +79,6 @@ let
         sha256 = "0l9rw6r5r90iybdkp3hhl2pf0h0s1izc68h5d3ywrm92pq32wz57";
       })
 
-      (fetchpatch {
-        url = "https://github.com/python/cpython/commit/979daae300916adb399ab5b51410b6ebd0888f13.patch";
-        name = "CVE-2018-20852.patch";
-        sha256 = "0p838ycssd6abxzby69rhngjqqm59cmlp07910mpjx7lmsz049pb";
-      })
-
       # Fix race-condition during pyc creation. Has a slight backwards
       # incompatible effect: pyc symlinks will now be overridden
       # (https://bugs.python.org/issue17222). Included in python >= 3.4,

pkgs/development/interpreters/python/cpython/2.7/python-2.7-distutils-C++.patch

@@ -93,8 +93,8 @@
                  _osx_support.customize_compiler(_config_vars)
                  _config_vars['CUSTOMIZED_OSX_COMPILER'] = 'True'
  
--        (cc, cxx, opt, cflags, ccshared, ldshared, so_ext, ar, ar_flags) = \
--            get_config_vars('CC', 'CXX', 'OPT', 'CFLAGS',
+-        (cc, cxx, cflags, ccshared, ldshared, so_ext, ar, ar_flags) = \
+-            get_config_vars('CC', 'CXX', 'CFLAGS',
 -                            'CCSHARED', 'LDSHARED', 'SO', 'AR',
 -                            'ARFLAGS')
 +        (cc, cxx, ccshared, ldshared, ldcxxshared, so_ext, ar, ar_flags) = \
@@ -120,8 +120,7 @@
              ldshared = ldshared + ' ' + os.environ['LDFLAGS']
 +            ldcxxshared = ldcxxshared + ' ' + os.environ['LDFLAGS']
          if 'CFLAGS' in os.environ:
--            cflags = opt + ' ' + os.environ['CFLAGS']
-+            cflags = os.environ['CFLAGS']
+             cflags = cflags + ' ' + os.environ['CFLAGS']
              ldshared = ldshared + ' ' + os.environ['CFLAGS']
 +        if 'CXXFLAGS' in os.environ:
 +            cxxflags = os.environ['CXXFLAGS']

pkgs/development/interpreters/python/default.nix

@@ -52,10 +52,10 @@ in {
     sourceVersion = {
       major = "2";
       minor = "7";
-      patch = "16";
+      patch = "17";
       suffix = "";
     };
-    sha256 = "1mqfcqp5y8r0bfyr7ppl74n0lig45p9mc4b8adlcpvj74rhfy8pj";
+    sha256 = "0hds28cg226m8j8sr394nm9yc4gxhvlv109w0avsf2mxrlrz0hsd";
     inherit (darwin) CF configd;
     inherit passthruFun;
   };
@@ -200,4 +200,9 @@ in {
     ncurses = ncurses5;
   };
 
+  graalpython37 = callPackage ./graalpython/default.nix {
+    self = pythonInterpreters.graalpython37;
+    inherit passthruFun;
+  };
+
 })

pkgs/development/interpreters/python/graalpython/default.nix

@@ -0,0 +1,21 @@
+{ pkgs
+, lib
+, graalvm8
+, passthruFun
+, packageOverrides ? (self: super: {})
+, self
+}:
+
+let
+  passthru = passthruFun {
+    inherit self packageOverrides;
+    implementation = "graal";
+    sourceVersion = graalvm8.version;
+    pythonVersion = "3.7";
+    libPrefix = "graalvm";
+    sitePackages = "jre/languages/python/lib-python/3/site-packages";
+    executable = "graalpython";
+    hasDistutilsCxxPatch = false;
+    pythonForBuild = pkgs.buildPackages.pythonInterpreters.graalpython37;
+  };
+in lib.extendDerivation true passthru graalvm8

pkgs/development/interpreters/python/update-python-libraries/update-python-libraries.py

@@ -116,11 +116,45 @@ SEMVER = {
 }
 
 
+def _determine_latest_version(current_version, target, versions):
+    """Determine latest version, given `target`.
+    """
+    current_version = Version(current_version)
+
+    def _parse_versions(versions):
+        for v in versions:
+            try:
+                yield Version(v)
+            except InvalidVersion:
+                pass
+
+    versions = _parse_versions(versions)
+
+    index = SEMVER[target]
+
+    ceiling = list(current_version[0:index])
+    if len(ceiling) == 0:
+        ceiling = None
+    else:
+        ceiling[-1]+=1
+        ceiling = Version(".".join(map(str, ceiling)))
+
+    # We do not want prereleases
+    versions = SpecifierSet(prereleases=PRERELEASES).filter(versions)
+
+    if ceiling is not None:
+        versions = SpecifierSet(f"<{ceiling}").filter(versions)
+
+    return (max(sorted(versions))).raw_version
+
+
 def _get_latest_version_pypi(package, extension, current_version, target):
     """Get latest version and hash from PyPI."""
     url = "{}/{}/json".format(INDEX, package)
     json = _fetch_page(url)
-    version = json['info']['version']
+
+    versions = json['releases'].keys()
+    version = _determine_latest_version(current_version, target, versions)
 
     try:
         releases = json['releases'][version]
@@ -132,7 +166,6 @@ def _get_latest_version_pypi(package, extension, current_version, target):
             sha256 = release['digests']['sha256']
             break
     else:
-        logging.error("Release not found for extension: {}".format(extension))
         sha256 = None
     return version, sha256
 
@@ -194,6 +227,8 @@ def _determine_extension(text, fetcher):
                 src_format = 'setuptools'
             elif src_format == 'flit':
                 raise ValueError("Don't know how to update a Flit package.")
+            elif src_format == 'other':
+                raise ValueError("Don't know how to update a format='other' package.")
             extension = FORMATS[src_format]
 
     elif fetcher == 'fetchurl':
@@ -326,4 +361,4 @@ def main():
 
 
 if __name__ == '__main__':
-    main()
+    main()

pkgs/development/interpreters/spidermonkey/52.nix

@@ -1,82 +0,0 @@
-{ stdenv, fetchurl, fetchpatch, autoconf213, pkgconfig, perl, zip, which, readline, icu, zlib, nspr, buildPackages }:
-
-let
-  version = "52.9.0";
-in stdenv.mkDerivation {
-  pname = "spidermonkey";
-  inherit version;
-
-  src = fetchurl {
-    url = "mirror://mozilla/firefox/releases/${version}esr/source/firefox-${version}esr.source.tar.xz";
-    sha256 = "1mlx34fgh1kaqamrkl5isf0npch3mm6s4lz3jsjb7hakiijhj7f0";
-  };
-
-  outputs = [ "out" "dev" ];
-  setOutputFlags = false; # Configure script only understands --includedir
-
-  buildInputs = [ readline icu zlib nspr ];
-  nativeBuildInputs = [ autoconf213 pkgconfig perl which buildPackages.python2 zip ];
-
-  # Apparently this package fails to build correctly with modern compilers, which at least
-  # on ARMv6 causes polkit testsuite to break with an assertion failure in spidermonkey.
-  # These flags were stolen from:
-  # https://git.archlinux.org/svntogit/packages.git/tree/trunk/PKGBUILD?h=packages/js52
-  NIX_CFLAGS_COMPILE = "-fno-delete-null-pointer-checks -fno-strict-aliasing -fno-tree-vrp";
-
-  patches = [
-    # needed to build gnome3.gjs
-    (fetchpatch {
-      name = "mozjs52-disable-mozglue.patch";
-      url = https://git.archlinux.org/svntogit/packages.git/plain/trunk/mozjs52-disable-mozglue.patch?h=packages/js52&id=4279d2e18d9a44f6375f584911f63d13de7704be;
-      sha256 = "18wkss0agdyff107p5lfflk72qiz350xqw2yqc353alkx4fsfpz0";
-    })
-  ];
-
-  configurePlatforms = [ ];
-
-  preConfigure = ''
-    export CXXFLAGS="-fpermissive"
-    export LIBXUL_DIST=$out
-    export PYTHON="${buildPackages.python2.interpreter}"
-    configureFlagsArray+=("--includedir=$dev/include")
-
-    cd js/src
-
-    autoconf
-  '';
-
-  configureFlags = [
-    "--with-nspr-prefix=${nspr}"
-    "--with-system-zlib"
-    "--with-system-icu"
-    "--with-intl-api"
-    "--enable-readline"
-    "--enable-shared-js"
-  ] ++ stdenv.lib.optional stdenv.hostPlatform.isMusl "--disable-jemalloc"
-    ++ stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-    "--host=${stdenv.buildPlatform.config}"
-    "--target=${stdenv.hostPlatform.config}"
-  ];
-
-  makeFlags = [
-    "HOST_CC=${buildPackages.stdenv.cc}/bin/cc"
-  ];
-
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-
-  enableParallelBuilding = true;
-
-  postInstall = ''
-    moveToOutput bin/js52-config "$dev"
-    # Nuke a static lib.
-    rm $out/lib/libjs_static.ajs
-  '';
-
-  meta = with stdenv.lib; {
-    description = "Mozilla's JavaScript engine written in C/C++";
-    homepage = https://developer.mozilla.org/en/SpiderMonkey;
-    license = licenses.gpl2; # TODO: MPL/GPL/LGPL tri-license.
-    maintainers = [ maintainers.abbradar ];
-    platforms = platforms.linux;
-  };
-}

pkgs/development/interpreters/spidermonkey/60.nix

@@ -4,23 +4,28 @@
 with stdenv.lib;
 
 let
-  version = "60.4.0";
+  version = "60.9.0";
 in stdenv.mkDerivation {
   pname = "spidermonkey";
   inherit version;
 
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}esr/source/firefox-${version}esr.source.tar.xz";
-    sha256 = "11gzxd82grc3kg1ha4yni6ag6b97n46qycvv6x15s91ziia5hli0";
+    sha256 = "0gy5x2rnnbkqmjd9sq93s3q5na9nkba68xwpizild7k6qn63qicz";
   };
 
+  outputs = [ "out" "dev" ];
+  setOutputFlags = false; # Configure script only understands --includedir
+
   buildInputs = [ readline zlib icu ];
   nativeBuildInputs = [ autoconf213 pkgconfig perl which python2 zip ];
 
   patches = [
+    # Fixed in 62.0
+    # https://bugzilla.mozilla.org/show_bug.cgi?id=1415202
     (fetchpatch {
-      url = https://bug1415202.bmoattachments.org/attachment.cgi?id=8926363;
-      sha256 = "082ryrvqa3lvs67v3sq9kf2jshf4qp1fpi195wffc40jdrl8fnin";
+      url = "https://src.fedoraproject.org/rpms/mozjs60/raw/a1b605c73f382db25977cb2d4d70a3ba2ff85b92/f/Always-use-the-equivalent-year-to-determine-the-time-zone.patch";
+      sha256 = "12i225qbzlyfj2disms50zrr5jy8zgn2cc4rgsg58sfgf1bn7150";
     })
   ];
 
@@ -61,7 +66,9 @@ in stdenv.mkDerivation {
 
   # Remove unnecessary static lib
   preFixup = ''
+    moveToOutput bin/js60-config "$dev"
     rm $out/lib/libjs_static.ajs
+    ln -s $out/bin/js60 $out/bin/js
   '';
 
   enableParallelBuilding = true;

pkgs/development/libraries/fribidi/default.nix

@@ -10,23 +10,16 @@
 
 stdenv.mkDerivation rec {
   pname = "fribidi";
-  version = "1.0.5";
+  version = "1.0.7";
 
   outputs = [ "out" "devdoc" ];
 
-  # NOTE: 2018-06-06 v1.0.5: Only URL tarball has "Have pre-generated man pages: true", which works-around upstream usage of some rare ancient `c2man` fossil application.
+  # NOTE: Only URL tarball has "Have pre-generated man pages: true", which works-around upstream usage of some rare ancient `c2man` fossil application.
   src = fetchurl {
     url = "https://github.com/fribidi/fribidi/releases/download/v${version}/${pname}-${version}.tar.bz2";
-    sha256 = "1kp4b1hpx2ky20ixgy2xhj5iygfl7ps5k9kglh1z5i7mhykg4r3a";
+    sha256 = "0pckda4fcn0aw32lpycwdp25r2m7vca8zspq815ppi9gkwgg5das";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/fribidi/fribidi/pull/88.patch";
-      sha256 = "1n4l6333vhbxfckwg101flmvq6bbygg66fjp69ddcjqaqb6gh9k9";
-    })
-  ];
-
   postPatch = ''
     patchShebangs test
   '';

pkgs/development/libraries/gcr/default.nix

@@ -24,11 +24,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig gettext gobject-introspection libxslt makeWrapper vala ];
 
-  buildInputs = let
-    gpg = gnupg.override { guiSupport = false; }; # prevent build cycle with pinentry_gnome
-  in [
-    gpg libgcrypt libtasn1 dbus-glib pango gdk-pixbuf atk
-  ];
+  buildInputs = [ gnupg libgcrypt libtasn1 dbus-glib pango gdk-pixbuf atk ];
 
   propagatedBuildInputs = [ glib gtk3 p11-kit ];
 

pkgs/development/libraries/gtk/3.x.nix

@@ -75,6 +75,8 @@ stdenv.mkDerivation rec {
     ./patches/3.0-darwin-x11.patch
   ];
 
+  separateDebugInfo = stdenv.isLinux;
+
   mesonFlags = [
     "-Dtests=false"
   ];

pkgs/development/libraries/harfbuzz/default.nix

@@ -8,7 +8,7 @@
 }:
 
 let
-  version = "2.6.1";
+  version = "2.6.2";
   inherit (stdenv.lib) optional optionals optionalString;
 in
 
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/harfbuzz/release/harfbuzz-${version}.tar.xz";
-    sha256 = "0kw4c04jd8c8ili3j1glgv0wsr207313fs3jh2rawf53m8zznlf6";
+    sha256 = "097ncrkaawdzpgwlrpp4kwciq4z5pqz2n4f3yra5vc7jyxr6lk1v";
   };
 
   postPatch = ''

pkgs/development/libraries/iso-codes/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "iso-codes";
-  version = "4.3";
+  version = "4.4";
 
   src = fetchurl {
     url = "https://salsa.debian.org/iso-codes-team/iso-codes/-/archive/${pname}-${version}/${pname}-${pname}-${version}.tar.bz2";
-    sha256 = "11n3sccwapfr7npxad8m3xmc7w8i11kk70ffbz25gj82bn8rylvb";
+    sha256 = "02x0wcz783ammkdrmrh31wsmww481xbkbz70vf766ivbnn5sfxn6";
   };
 
   patchPhase = ''

pkgs/development/libraries/jbig2dec/default.nix

@@ -1,19 +1,21 @@
-{ stdenv, fetchurl, python }:
+{ stdenv, fetchurl, python, autoconf }:
 
 stdenv.mkDerivation rec {
-  name = "jbig2dec-0.14";
+  name = "jbig2dec-0.16";
 
   src = fetchurl {
-    url = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs922/${name}.tar.gz";
-    sha256 = "0k01hp0q4275fj4rbr1gy64svfraw5w7wvwl08yjhvsnpb1rid11";
+    url = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs927/${name}.tar.gz";
+    sha256 = "00h61y7bh3z6mqfzxyb318gyh0f8jwarg4hvlrm83rqps8avzxm4";
   };
 
   postPatch = ''
     patchShebangs test_jbig2dec.py
   '';
 
+  buildInputs = [ autoconf ];
+
   checkInputs = [ python ];
-  doCheck = false; # fails 1 of 4 tests
+  doCheck = true;
 
   meta = {
     homepage = https://www.jbig2dec.com/;

pkgs/development/libraries/libevdev/default.nix

@@ -1,11 +1,12 @@
 { stdenv, fetchurl, python }:
 
 stdenv.mkDerivation rec {
-  name = "libevdev-1.7.0";
+  pname = "libevdev";
+  version = "1.8.0";
 
   src = fetchurl {
-    url = "https://www.freedesktop.org/software/libevdev/${name}.tar.xz";
-    sha256 = "0sg3lbjn68qaq3yz2k735h29kaf3fmx7b5m1x7rm2fnhn7rf3nqi";
+    url = "https://www.freedesktop.org/software/${pname}/${pname}-${version}.tar.xz";
+    sha256 = "04a2klvii0in9ln8r85mk2cm73jq8ry2m3yzmf2z8xyjxzjcmlr0";
   };
 
   buildInputs = [ python ];

pkgs/development/libraries/libglvnd/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libglvnd";
-  version = "1.0.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "NVIDIA";
     repo = "libglvnd";
     rev = "v${version}";
-    sha256 = "1a126lzhd2f04zr3rvdl6814lfl0j077spi5dsf2alghgykn5iif";
+    sha256 = "1hyywwjsmvsd7di603f7iznjlccqlc7yvz0j59gax7bljm9wb6ni";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig python2 addOpenGLRunpath ];
@@ -32,17 +32,6 @@ stdenv.mkDerivation rec {
   # Indirectly: https://bugs.freedesktop.org/show_bug.cgi?id=35268
   configureFlags  = stdenv.lib.optional stdenv.hostPlatform.isMusl "--disable-tls";
 
-  # Upstream patch fixing use of libdl, should be in next release.
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/NVIDIA/libglvnd/commit/0177ade40262e31a80608a8e8e52d3da7163dccf.patch";
-      sha256 = "1rnz5jw2gvx4i1lcp0k85jz9xgr3dgzsd583m2dlxkaf2a09j89d";
-    })
-  ] ++ stdenv.lib.optional stdenv.isDarwin
-    (fetchpatch {
-      url = "https://github.com/NVIDIA/libglvnd/commit/294ccb2f49107432567e116e13efac586580a4cc.patch";
-      sha256 = "01339wg27cypv93221rhk3885vxbsg8kvbfyia77jmjdcnwrdwm2";
-    });
   outputs = [ "out" "dev" ];
 
   # Set RUNPATH so that libGLX can find driver libraries in /run/opengl-driver(-32)/lib.

pkgs/development/libraries/libogg/default.nix

@@ -1,11 +1,11 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "libogg-1.3.3";
+  name = "libogg-1.3.4";
 
   src = fetchurl {
     url = "http://downloads.xiph.org/releases/ogg/${name}.tar.xz";
-    sha256 = "022wjlzn8fx7mfby4pcgyjwx8zir7jr7cizichh3jgaki8bwcgsg";
+    sha256 = "1zlk33vxvxr0l9lhkbhkdwvylw96d2n0fnd3d8dl031hph9bqqy1";
   };
 
   outputs = [ "out" "dev" "doc" ];

pkgs/development/libraries/libqmi/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libqmi";
-  version = "1.22.6";
+  version = "1.24.0";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/libqmi/${pname}-${version}.tar.xz";
-    sha256 = "1pnma62kib6zbs4wr7h5g53v3p81jb8cvyvqcvaidb1hlfibwnvm";
+    sha256 = "0yccw97pqn8afy96k5ssk7qi6r3wjshcnxk14k77qikkqa89zdmf";
   };
 
   outputs = [ "out" "dev" "devdoc" ];

pkgs/development/libraries/libtiff/CVE-2019-14973.patch

@@ -0,0 +1,384 @@
+diff -ru tiff-4.0.10-orig/libtiff/tif_aux.c tiff-4.0.10/libtiff/tif_aux.c
+--- tiff-4.0.10-orig/libtiff/tif_aux.c	2017-12-02 16:21:47.305709555 +0100
++++ tiff-4.0.10/libtiff/tif_aux.c	2019-10-02 22:35:17.392184463 +0200
+@@ -57,18 +57,57 @@
+ 	return bytes;
+ }
+ 
++tmsize_t
++_TIFFMultiplySSize(TIFF* tif, tmsize_t first, tmsize_t second, const char* where)
++{
++    if( first <= 0 || second <= 0 )
++    {
++        if( tif != NULL && where != NULL )
++        {
++            TIFFErrorExt(tif->tif_clientdata, where,
++                        "Invalid argument to _TIFFMultiplySSize() in %s", where);
++        }
++        return 0;
++    }
++
++    if( first > TIFF_TMSIZE_T_MAX / second )
++    {
++        if( tif != NULL && where != NULL )
++        {
++            TIFFErrorExt(tif->tif_clientdata, where,
++                        "Integer overflow in %s", where);
++        }
++        return 0;
++    }
++    return first * second;
++}
++
++tmsize_t _TIFFCastUInt64ToSSize(TIFF* tif, uint64 val, const char* module)
++{
++    if( val > (uint64)TIFF_TMSIZE_T_MAX )
++    {
++        if( tif != NULL && module != NULL )
++        {
++            TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
++        }
++        return 0;
++    }
++    return (tmsize_t)val;
++}
++
+ void*
+ _TIFFCheckRealloc(TIFF* tif, void* buffer,
+ 		  tmsize_t nmemb, tmsize_t elem_size, const char* what)
+ {
+ 	void* cp = NULL;
+-	tmsize_t bytes = nmemb * elem_size;
+-
++        tmsize_t count = _TIFFMultiplySSize(tif, nmemb, elem_size, NULL);
+ 	/*
+-	 * XXX: Check for integer overflow.
++	 * Check for integer overflow.
+ 	 */
+-	if (nmemb && elem_size && bytes / elem_size == nmemb)
+-		cp = _TIFFrealloc(buffer, bytes);
++	if (count != 0)
++	{
++		cp = _TIFFrealloc(buffer, count);
++	}
+ 
+ 	if (cp == NULL) {
+ 		TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
+diff -ru tiff-4.0.10-orig/libtiff/tiffiop.h tiff-4.0.10/libtiff/tiffiop.h
+--- tiff-4.0.10-orig/libtiff/tiffiop.h	2018-11-03 15:28:37.748910968 +0100
++++ tiff-4.0.10/libtiff/tiffiop.h	2019-10-02 22:35:17.396184535 +0200
+@@ -77,6 +77,9 @@
+ #define	FALSE	0
+ #endif
+ 
++#define TIFF_SIZE_T_MAX ((size_t) ~ ((size_t)0))
++#define TIFF_TMSIZE_T_MAX (tmsize_t)(TIFF_SIZE_T_MAX >> 1)
++
+ typedef struct client_info {
+     struct client_info *next;
+     void *data;
+@@ -258,7 +261,7 @@
+ #define TIFFhowmany8_64(x) (((x)&0x07)?((uint64)(x)>>3)+1:(uint64)(x)>>3)
+ #define TIFFroundup_64(x, y) (TIFFhowmany_64(x,y)*(y))
+ 
+-/* Safe multiply which returns zero if there is an integer overflow */
++/* Safe multiply which returns zero if there is an *unsigned* integer overflow. This macro is not safe for *signed* integer types */
+ #define TIFFSafeMultiply(t,v,m) ((((t)(m) != (t)0) && (((t)(((v)*(m))/(m))) == (t)(v))) ? (t)((v)*(m)) : (t)0)
+ 
+ #define TIFFmax(A,B) ((A)>(B)?(A):(B))
+@@ -368,6 +371,8 @@
+ 
+ extern uint32 _TIFFMultiply32(TIFF*, uint32, uint32, const char*);
+ extern uint64 _TIFFMultiply64(TIFF*, uint64, uint64, const char*);
++extern tmsize_t _TIFFMultiplySSize(TIFF*, tmsize_t, tmsize_t, const char*);
++extern tmsize_t _TIFFCastUInt64ToSSize(TIFF*, uint64, const char*);
+ extern void* _TIFFCheckMalloc(TIFF*, tmsize_t, tmsize_t, const char*);
+ extern void* _TIFFCheckRealloc(TIFF*, void*, tmsize_t, tmsize_t, const char*);
+ 
+diff -ru tiff-4.0.10-orig/libtiff/tif_getimage.c tiff-4.0.10/libtiff/tif_getimage.c
+--- tiff-4.0.10-orig/libtiff/tif_getimage.c	2017-12-02 16:21:47.654716127 +0100
++++ tiff-4.0.10/libtiff/tif_getimage.c	2019-10-02 22:35:17.393184481 +0200
+@@ -755,9 +755,8 @@
+ 	uint32 leftmost_tw;
+ 
+ 	tilesize = TIFFTileSize(tif);  
+-	bufsize = TIFFSafeMultiply(tmsize_t,alpha?4:3,tilesize);
++	bufsize = _TIFFMultiplySSize(tif, alpha?4:3,tilesize, "gtTileSeparate");
+ 	if (bufsize == 0) {
+-		TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtTileSeparate");
+ 		return (0);
+ 	}
+ 
+@@ -1019,9 +1018,8 @@
+         uint16 colorchannels;
+ 
+ 	stripsize = TIFFStripSize(tif);  
+-	bufsize = TIFFSafeMultiply(tmsize_t,alpha?4:3,stripsize);
++	bufsize = _TIFFMultiplySSize(tif,alpha?4:3,stripsize, "gtStripSeparate");
+ 	if (bufsize == 0) {
+-		TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtStripSeparate");
+ 		return (0);
+ 	}
+ 
+diff -ru tiff-4.0.10-orig/libtiff/tif_luv.c tiff-4.0.10/libtiff/tif_luv.c
+--- tiff-4.0.10-orig/libtiff/tif_luv.c	2018-05-05 15:50:35.884596907 +0200
++++ tiff-4.0.10/libtiff/tif_luv.c	2019-10-02 22:35:17.393184481 +0200
+@@ -1264,16 +1264,10 @@
+ 	return (SGILOGDATAFMT_UNKNOWN);
+ }
+ 
+-
+-#define TIFF_SIZE_T_MAX ((size_t) ~ ((size_t)0))
+-#define TIFF_TMSIZE_T_MAX (tmsize_t)(TIFF_SIZE_T_MAX >> 1)
+-
+ static tmsize_t
+ multiply_ms(tmsize_t m1, tmsize_t m2)
+ {
+-        if( m1 == 0 || m2 > TIFF_TMSIZE_T_MAX / m1 )
+-            return 0;
+-        return m1 * m2;
++        return _TIFFMultiplySSize(NULL, m1, m2, NULL);
+ }
+ 
+ static int
+diff -ru tiff-4.0.10-orig/libtiff/tif_pixarlog.c tiff-4.0.10/libtiff/tif_pixarlog.c
+--- tiff-4.0.10-orig/libtiff/tif_pixarlog.c	2017-12-02 16:21:47.841162432 +0100
++++ tiff-4.0.10/libtiff/tif_pixarlog.c	2019-10-02 22:36:01.223970118 +0200
+@@ -634,15 +634,10 @@
+ 	return guess;
+ }
+ 
+-#define TIFF_SIZE_T_MAX ((size_t) ~ ((size_t)0))
+-#define TIFF_TMSIZE_T_MAX (tmsize_t)(TIFF_SIZE_T_MAX >> 1)
+-
+ static tmsize_t
+ multiply_ms(tmsize_t m1, tmsize_t m2)
+ {
+-        if( m1 == 0 || m2 > TIFF_TMSIZE_T_MAX / m1 )
+-            return 0;
+-        return m1 * m2;
++        return _TIFFMultiplySSize(NULL, m1, m2, NULL);
+ }
+ 
+ static tmsize_t
+diff -ru tiff-4.0.10-orig/libtiff/tif_read.c tiff-4.0.10/libtiff/tif_read.c
+--- tiff-4.0.10-orig/libtiff/tif_read.c	2018-10-14 21:15:27.551093695 +0200
++++ tiff-4.0.10/libtiff/tif_read.c	2019-10-02 22:41:09.387290927 +0200
+@@ -29,9 +29,6 @@
+ #include "tiffiop.h"
+ #include <stdio.h>
+ 
+-#define TIFF_SIZE_T_MAX ((size_t) ~ ((size_t)0))
+-#define TIFF_TMSIZE_T_MAX (tmsize_t)(TIFF_SIZE_T_MAX >> 1)
+-
+ int TIFFFillStrip(TIFF* tif, uint32 strip);
+ int TIFFFillTile(TIFF* tif, uint32 tile);
+ static int TIFFStartStrip(TIFF* tif, uint32 strip);
+@@ -49,6 +46,8 @@
+ #define THRESHOLD_MULTIPLIER 10
+ #define MAX_THRESHOLD (THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER * INITIAL_THRESHOLD)
+ 
++#define TIFF_INT64_MAX ((((int64)0x7FFFFFFF) << 32) | 0xFFFFFFFF)
++
+ /* Read 'size' bytes in tif_rawdata buffer starting at offset 'rawdata_offset'
+  * Returns 1 in case of success, 0 otherwise. */
+ static int TIFFReadAndRealloc( TIFF* tif, tmsize_t size,
+@@ -734,23 +733,8 @@
+ 		return ((tmsize_t)(-1));
+ 	}
+ 	bytecount = td->td_stripbytecount[strip];
+-	if ((int64)bytecount <= 0) {
+-#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
+-		TIFFErrorExt(tif->tif_clientdata, module,
+-			     "%I64u: Invalid strip byte count, strip %lu",
+-			     (unsigned __int64) bytecount,
+-			     (unsigned long) strip);
+-#else
+-		TIFFErrorExt(tif->tif_clientdata, module,
+-			     "%llu: Invalid strip byte count, strip %lu",
+-			     (unsigned long long) bytecount,
+-			     (unsigned long) strip);
+-#endif
+-		return ((tmsize_t)(-1));
+-	}
+-	bytecountm = (tmsize_t)bytecount;
+-	if ((uint64)bytecountm!=bytecount) {
+-		TIFFErrorExt(tif->tif_clientdata, module, "Integer overflow");
++	bytecountm =  _TIFFCastUInt64ToSSize(tif, bytecount, module);
++	if (bytecountm == 0) {
+ 		return ((tmsize_t)(-1));
+ 	}
+ 	if (size != (tmsize_t)(-1) && size < bytecountm)
+@@ -774,7 +758,7 @@
+ 	if ((tif->tif_flags&TIFF_NOREADRAW)==0)
+ 	{
+ 		uint64 bytecount = td->td_stripbytecount[strip];
+-		if ((int64)bytecount <= 0) {
++		if( bytecount == 0 || bytecount > (uint64)TIFF_INT64_MAX ) {
+ #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
+ 			TIFFErrorExt(tif->tif_clientdata, module,
+ 				"Invalid strip byte count %I64u, strip %lu",
+@@ -801,7 +785,7 @@
+ 			    (bytecount - 4096) / 10 > (uint64)stripsize  )
+ 			{
+ 				uint64 newbytecount = (uint64)stripsize * 10 + 4096;
+-				if( (int64)newbytecount >= 0 )
++				if( newbytecount == 0 || newbytecount > (uint64)TIFF_INT64_MAX )
+ 				{
+ #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
+ 					TIFFWarningExt(tif->tif_clientdata, module,
+@@ -1196,10 +1180,8 @@
+ 	bytecount64 = td->td_stripbytecount[tile];
+ 	if (size != (tmsize_t)(-1) && (uint64)size < bytecount64)
+ 		bytecount64 = (uint64)size;
+-	bytecountm = (tmsize_t)bytecount64;
+-	if ((uint64)bytecountm!=bytecount64)
+-	{
+-		TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
++	bytecountm = _TIFFCastUInt64ToSSize(tif, bytecount64, module);
++        if( bytecountm == 0 ) {
+ 		return ((tmsize_t)(-1));
+ 	}
+ 	return (TIFFReadRawTile1(tif, tile, buf, bytecountm, module));
+@@ -1221,7 +1203,7 @@
+ 	if ((tif->tif_flags&TIFF_NOREADRAW)==0)
+ 	{
+ 		uint64 bytecount = td->td_stripbytecount[tile];
+-		if ((int64)bytecount <= 0) {
++		if( bytecount == 0 || bytecount > (uint64)TIFF_INT64_MAX ) {
+ #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
+ 			TIFFErrorExt(tif->tif_clientdata, module,
+ 				"%I64u: Invalid tile byte count, tile %lu",
+@@ -1248,7 +1230,7 @@
+ 			    (bytecount - 4096) / 10 > (uint64)stripsize  )
+ 			{
+ 				uint64 newbytecount = (uint64)stripsize * 10 + 4096;
+-				if( (int64)newbytecount >= 0 )
++				if( newbytecount == 0 || newbytecount > (uint64)TIFF_INT64_MAX )
+ 				{
+ #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
+ 					TIFFWarningExt(tif->tif_clientdata, module,
+diff -ru tiff-4.0.10-orig/libtiff/tif_strip.c tiff-4.0.10/libtiff/tif_strip.c
+--- tiff-4.0.10-orig/libtiff/tif_strip.c	2017-12-02 16:21:47.947867167 +0100
++++ tiff-4.0.10/libtiff/tif_strip.c	2019-10-02 22:35:17.395184517 +0200
+@@ -129,15 +129,8 @@
+ {
+ 	static const char module[] = "TIFFVStripSize";
+ 	uint64 m;
+-	tmsize_t n;
+ 	m=TIFFVStripSize64(tif,nrows);
+-	n=(tmsize_t)m;
+-	if ((uint64)n!=m)
+-	{
+-		TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
+-		n=0;
+-	}
+-	return(n);
++        return _TIFFCastUInt64ToSSize(tif, m, module);
+ }
+ 
+ /*
+@@ -211,15 +204,8 @@
+ {
+ 	static const char module[] = "TIFFStripSize";
+ 	uint64 m;
+-	tmsize_t n;
+ 	m=TIFFStripSize64(tif);
+-	n=(tmsize_t)m;
+-	if ((uint64)n!=m)
+-	{
+-		TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
+-		n=0;
+-	}
+-	return(n);
++	return _TIFFCastUInt64ToSSize(tif, m, module);
+ }
+ 
+ /*
+@@ -330,14 +316,8 @@
+ {
+ 	static const char module[] = "TIFFScanlineSize";
+ 	uint64 m;
+-	tmsize_t n;
+ 	m=TIFFScanlineSize64(tif);
+-	n=(tmsize_t)m;
+-	if ((uint64)n!=m) {
+-		TIFFErrorExt(tif->tif_clientdata,module,"Integer arithmetic overflow");
+-		n=0;
+-	}
+-	return(n);
++	return _TIFFCastUInt64ToSSize(tif, m, module);
+ }
+ 
+ /*
+@@ -366,15 +346,8 @@
+ {
+ 	static const char module[] = "TIFFRasterScanlineSize";
+ 	uint64 m;
+-	tmsize_t n;
+ 	m=TIFFRasterScanlineSize64(tif);
+-	n=(tmsize_t)m;
+-	if ((uint64)n!=m)
+-	{
+-		TIFFErrorExt(tif->tif_clientdata,module,"Integer arithmetic overflow");
+-		n=0;
+-	}
+-	return(n);
++	return _TIFFCastUInt64ToSSize(tif, m, module);
+ }
+ 
+ /* vim: set ts=8 sts=8 sw=8 noet: */
+diff -ru tiff-4.0.10-orig/libtiff/tif_tile.c tiff-4.0.10/libtiff/tif_tile.c
+--- tiff-4.0.10-orig/libtiff/tif_tile.c	2017-12-02 16:21:47.993972977 +0100
++++ tiff-4.0.10/libtiff/tif_tile.c	2019-10-02 22:35:17.395184517 +0200
+@@ -181,15 +181,8 @@
+ {
+ 	static const char module[] = "TIFFTileRowSize";
+ 	uint64 m;
+-	tmsize_t n;
+ 	m=TIFFTileRowSize64(tif);
+-	n=(tmsize_t)m;
+-	if ((uint64)n!=m)
+-	{
+-		TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
+-		n=0;
+-	}
+-	return(n);
++	return _TIFFCastUInt64ToSSize(tif, m, module);
+ }
+ 
+ /*
+@@ -248,15 +241,8 @@
+ {
+ 	static const char module[] = "TIFFVTileSize";
+ 	uint64 m;
+-	tmsize_t n;
+ 	m=TIFFVTileSize64(tif,nrows);
+-	n=(tmsize_t)m;
+-	if ((uint64)n!=m)
+-	{
+-		TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
+-		n=0;
+-	}
+-	return(n);
++	return _TIFFCastUInt64ToSSize(tif, m, module);
+ }
+ 
+ /*
+@@ -272,15 +258,8 @@
+ {
+ 	static const char module[] = "TIFFTileSize";
+ 	uint64 m;
+-	tmsize_t n;
+ 	m=TIFFTileSize64(tif);
+-	n=(tmsize_t)m;
+-	if ((uint64)n!=m)
+-	{
+-		TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
+-		n=0;
+-	}
+-	return(n);
++	return _TIFFCastUInt64ToSSize(tif, m, module);
+ }
+ 
+ /*

pkgs/development/libraries/libtiff/default.nix

@@ -17,6 +17,16 @@ stdenv.mkDerivation rec {
     sha256 = "1r4np635gr6zlc0bic38dzvxia6iqzcrary4n1ylarzpr8fd2lic";
   };
 
+  patches = [
+    (fetchurl {
+      url = "https://gitlab.com/libtiff/libtiff/commit/0c74a9f49b8d7a36b17b54a7428b3526d20f88a8.patch";
+      name = "CVE-2019-6128.patch";
+      sha256 = "03yvsfq6dxjd3v8ypfwz6cpz2iymqwcbawqqlmkh40dayi7fgizr";
+    })
+    # Manual backport of https://gitlab.com/libtiff/libtiff/commit/1b5e3b6a23827c33acf19ad50ce5ce78f12b3773.patch
+    ./CVE-2019-14973.patch
+  ];
+
   outputs = [ "bin" "dev" "out" "man" "doc" ];
 
   nativeBuildInputs = [ pkgconfig ];

pkgs/development/libraries/mesa/default.nix

@@ -167,7 +167,7 @@ stdenv.mkDerivation {
     substituteInPlace "$dev/lib/pkgconfig/dri.pc" --replace "$drivers" "${libglvnd.driverLink}"
 
     # remove pkgconfig files for GL/EGL; they are provided by libGL.
-    rm $dev/lib/pkgconfig/{gl,egl}.pc
+    rm -f $dev/lib/pkgconfig/{gl,egl}.pc
 
     # Update search path used by pkg-config
     for pc in $dev/lib/pkgconfig/{d3d,dri,xatracker}.pc; do

pkgs/development/libraries/nspr/default.nix

@@ -2,7 +2,7 @@
 , CoreServices ? null
 , buildPackages }:
 
-let version = "4.21"; in
+let version = "4.22"; in
 
 stdenv.mkDerivation {
   pname = "nspr";
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "mirror://mozilla/nspr/releases/v${version}/src/nspr-${version}.tar.gz";
-    sha256 = "0nkbgk0x31nfm4xl8la0a3vrnpa8gzkh7g4k65p7n880n73k5shm";
+    sha256 = "0c6ljv3bdqhc169srbpjy0cs52xk715p04zy08rcjvl54k6bdr69";
   };
 
   patches = [

pkgs/development/libraries/nss/default.nix

@@ -5,7 +5,7 @@ let
     url = http://dev.gentoo.org/~polynomial-c/mozilla/nss-3.15.4-pem-support-20140109.patch.xz;
     sha256 = "10ibz6y0hknac15zr6dw4gv9nb5r5z9ym6gq18j3xqx7v7n3vpdw";
   };
-  version = "3.46";
+  version = "3.46.1";
   underscoreVersion = builtins.replaceStrings ["."] ["_"] version;
 
 in stdenv.mkDerivation rec {
@@ -14,7 +14,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/${pname}-${version}.tar.gz";
-    sha256 = "1vqcl6wxn2nsm2fmlwzmxyagrsj1p1y9bc54b2i2nq45s94rcsbb";
+    sha256 = "0l9ns44rlkp1bpblplspfbqmyhb8rhvc89y56kqh725rgpny1xrv";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];

pkgs/development/libraries/openssl/default.nix

@@ -44,10 +44,12 @@ let
     # TODO(@Ericson2314): Improve with mass rebuild
     configurePlatforms = [];
     configureScript = {
-        x86_64-darwin  = "./Configure darwin64-x86_64-cc";
-        x86_64-solaris = "./Configure solaris64-x86_64-gcc";
         armv6l-linux = "./Configure linux-armv4 -march=armv6";
         armv7l-linux = "./Configure linux-armv4 -march=armv7-a";
+        i686-linux = "./Configure linux-x86";
+        x86_64-darwin  = "./Configure darwin64-x86_64-cc";
+        x86_64-linux = "./Configure linux-x86_64";
+        x86_64-solaris = "./Configure solaris64-x86_64-gcc";
       }.${stdenv.hostPlatform.system} or (
         if stdenv.hostPlatform == stdenv.buildPlatform
           then "./config"

pkgs/development/libraries/sqlite/analyzer.nix

@@ -6,11 +6,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sqlite-analyzer";
-  version = "3.28.0";
+  version = "3.30.0";
 
   src = assert version == sqlite.version; fetchurl {
     url = "https://sqlite.org/2019/sqlite-src-${archiveVersion version}.zip";
-    sha256 = "15v57b113bpgcshfsx5jw93szar3da94rr03i053xhl15la7jllh";
+    sha256 = "0d4i87q0f618pmrgax0mr5x7m8bywikrwjvixag3biyhgl5rx7fd";
   };
 
   nativeBuildInputs = [ unzip ];

pkgs/development/libraries/sqlite/default.nix

@@ -10,12 +10,12 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sqlite";
-  version = "3.28.0";
+  version = "3.30.0";
 
   # NB! Make sure to update analyzer.nix src (in the same directory).
   src = fetchurl {
     url = "https://sqlite.org/2019/sqlite-autoconf-${archiveVersion version}.tar.gz";
-    sha256 = "1hxpi45crbqp6lacl7z611lna02k956m9bsy2bjzrbb2y23546yn";
+    sha256 = "0n7w839y55dc3qqf2zv8xk6238cc6mpx24q4w5amwic7g96cza70";
   };
 
   outputs = [ "bin" "dev" "out" ];

pkgs/development/perl-modules/BerkeleyDB/default.nix

@@ -1,16 +0,0 @@
-{buildPerlPackage, fetchurl, db}:
-
-buildPerlPackage {
-  pname = "BerkeleyDB";
-  version = "0.61";
-
-  src = fetchurl {
-    url = "mirror://cpan/authors/id/P/PM/PMQS/BerkeleyDB-0.61.tar.gz";
-    sha256 = "0l65v301cz6a9dxcw6a4ps2mnr5zq358yn81favap6i092krggiz";
-  };
-
-  preConfigure = ''
-    echo "LIB = ${db.out}/lib" > config.in
-    echo "INCLUDE = ${db.dev}/include" >> config.in
-  '';
-}

pkgs/development/perl-modules/Compress-Raw-Zlib/default.nix

@@ -1,27 +0,0 @@
-{ fetchurl, buildPerlPackage, zlib, stdenv }:
-
-buildPerlPackage {
-  pname = "Compress-Raw-Zlib";
-  version = "2.086";
-
-  src = fetchurl {
-    url = mirror://cpan/authors/id/P/PM/PMQS/Compress-Raw-Zlib-2.086.tar.gz;
-    sha256 = "0va93wc968p4l2ql0k349bz189l2vbs09bpn865cvc36amqxwv9z";
-  };
-
-  preConfigure = ''
-    cat > config.in <<EOF
-      BUILD_ZLIB   = False
-      INCLUDE      = ${zlib.dev}/include
-      LIB          = ${zlib.out}/lib
-      OLD_ZLIB     = False
-      GZIP_OS_CODE = AUTO_DETECT
-    EOF
-  '';
-
-  doCheck = !stdenv.isDarwin;
-
-  meta = {
-    license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
-  };
-}

pkgs/development/perl-modules/DBD-Oracle/default.nix

@@ -1,20 +0,0 @@
-{ stdenv, fetchurl, buildPerlPackage, DBI, TestNoWarnings, oracle-instantclient }:
-
-buildPerlPackage {
-  pname = "DBD-Oracle";
-  version = "1.80";
-
-  src = fetchurl {
-    url = mirror://cpan/authors/id/Z/ZA/ZARQUON/DBD-Oracle-1.76.tar.gz;
-    sha256 = "1wym2kc8b31qa1zb0dgyy3w4iqlk1faw36gy9hkpj895qr1pznxn";
-  };
-
-  ORACLE_HOME = "${oracle-instantclient.lib}/lib";
-
-  buildInputs = [ TestNoWarnings oracle-instantclient ] ;
-  propagatedBuildInputs = [ DBI ];
-
-  postBuild = stdenv.lib.optionalString stdenv.isDarwin ''
-    install_name_tool -add_rpath "${oracle-instantclient.lib}/lib" blib/arch/auto/DBD/Oracle/Oracle.bundle
-  '';
-}

pkgs/development/perl-modules/DBD-Pg/default.nix

@@ -1,25 +0,0 @@
-{ stdenv, fetchurl, buildPerlPackage, DBI, postgresql }:
-
-buildPerlPackage {
-  pname = "DBD-Pg";
-  version = "3.7.4";
-
-  src = fetchurl {
-    url = "mirror://cpan/authors/id/T/TU/TURNSTEP/DBD-Pg-3.7.4.tar.gz";
-    sha256 = "0gkqlvbmzbdm0g4k328nlkjdg3wrjm5i2n9jxj1i8sqxkm79rylz";
-  };
-
-  buildInputs = [ postgresql ];
-  propagatedBuildInputs = [ DBI ];
-
-  makeMakerFlags = "POSTGRES_HOME=${postgresql}";
-
-  # tests freeze in a sandbox
-  doCheck = false;
-
-  meta = {
-    description = "DBI PostgreSQL interface";
-    license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
-    platforms = stdenv.lib.platforms.unix;
-  };
-}

pkgs/development/perl-modules/DBD-SQLite/default.nix

@@ -1,32 +0,0 @@
-{ stdenv, fetchurl, buildPerlPackage, perl, DBI, sqlite }:
-
-buildPerlPackage {
-  pname = "DBD-SQLite";
-  version = "1.62";
-
-  src = fetchurl {
-    url = mirror://cpan/authors/id/I/IS/ISHIGAKI/DBD-SQLite-1.62.tar.gz;
-    sha256 = "0p78ri1q6xpc1i98i6mlriv8n66iz8r5r11dlsknjm4y58rfz0mx";
-  };
-
-  propagatedBuildInputs = [ DBI ];
-  buildInputs = [ sqlite ];
-
-  patches = [
-    # Support building against our own sqlite.
-    ./external-sqlite.patch
-  ];
-
-  makeMakerFlags = "SQLITE_INC=${sqlite.dev}/include SQLITE_LIB=${sqlite.out}/lib";
-
-  postInstall = ''
-    # Get rid of a pointless copy of the SQLite sources.
-    rm -rf $out/${perl.libPrefix}/*/*/auto/share
-  '';
-
-  meta = with stdenv.lib; {
-    description = "Self Contained SQLite RDBMS in a DBI Driver";
-    license = with licenses; [ artistic1 gpl1Plus ];
-    platforms = platforms.unix;
-  };
-}

pkgs/development/perl-modules/DBD-mysql/default.nix

@@ -1,18 +0,0 @@
-{ fetchurl, buildPerlPackage, DBI, DevelChecklib, libmysqlclient }:
-
-buildPerlPackage {
-  pname = "DBD-mysql";
-  version = "4.050";
-
-  src = fetchurl {
-    url = mirror://cpan/authors/id/D/DV/DVEEDEN/DBD-mysql-4.050.tar.gz;
-    sha256 = "0y4djb048i09dk19av7mzfb3khr72vw11p3ayw2p82jsy4gm8j2g";
-  };
-
-  buildInputs = [ libmysqlclient DevelChecklib ] ;
-  propagatedBuildInputs = [ DBI ];
-
-  doCheck = false;
-
-#  makeMakerFlags = "MYSQL_HOME=${mysql}";
-}

pkgs/development/perl-modules/DBD-sybase/default.nix

@@ -1,18 +0,0 @@
-{ fetchurl, buildPerlPackage, DBI, freetds }:
-
-buildPerlPackage {
-  pname = "DBD-Sybase";
-  version = "1.16";
-
-  src = fetchurl {
-    url = mirror://cpan/authors/id/M/ME/MEWP/DBD-Sybase-1.16.tar.gz;
-    sha256 = "1k6n261nrrcll9wxn5xwi4ibpavqv1il96687k62mbpznzl2gx37";
-  };
-
-  SYBASE = freetds;
-
-  buildInputs = [ freetds ] ;
-  propagatedBuildInputs = [ DBI ];
-
-  doCheck = false;
-}

pkgs/development/perl-modules/DB_File/default.nix

@@ -1,20 +0,0 @@
-{fetchurl, buildPerlPackage, db}:
-
-buildPerlPackage {
-  pname = "DB_File";
-  version = "1.851";
-
-  src = fetchurl {
-    url = "mirror://cpan/authors/id/P/PM/PMQS/DB_File-1.851.tar.gz";
-    sha256 = "1j276mng1nwxxdxnb3my427s5lb6zlnssizcnxricnvaa170kdv8";
-  };
-
-  preConfigure = ''
-    cat > config.in <<EOF
-    PREFIX = size_t
-    HASH = u_int32_t
-    LIB = ${db.out}/lib
-    INCLUDE = ${db.dev}/include
-    EOF
-  '';
-}

pkgs/development/perl-modules/Mozilla-LDAP/default.nix

@@ -0,0 +1,17 @@
+{ lib, fetchurl, openldap, buildPerlPackage }:
+
+buildPerlPackage rec {
+  pname = "Mozilla-Ldap";
+  version = "1.5.3";
+  USE_OPENLDAP = 1;
+  LDAPSDKDIR = openldap.dev;
+  LDAPSDKLIBDIR = "${openldap.out}/lib";
+  src = fetchurl {
+    url = "https://ftp.mozilla.org/pub/directory/perldap/releases/${version}/src/perl-mozldap-${version}.tar.gz";
+    sha256 = "0s0albdw0zvg3w37s7is7gddr4mqwicjxxsy400n1p96l7ipnw4x";
+  };
+  meta = {
+    description = "Mozilla's ldap client library";
+    license = with lib.licenses; [ mpl20 lgpl21Plus gpl2Plus ];
+  };
+}

pkgs/development/perl-modules/Percona-Toolkit/default.nix

@@ -0,0 +1,20 @@
+{ lib, fetchFromGitHub, buildPerlPackage, DBDmysql, DBI, IOSocketSSL, TermReadKey }:
+
+buildPerlPackage {
+  pname = "Percona-Toolkit";
+  version = "3.0.12";
+  src = fetchFromGitHub {
+    owner = "percona";
+    repo = "percona-toolkit";
+    rev = "3.0.12";
+    sha256 = "0xk4h4dzl80kf97lbx0nznx9ajrb6kkg7k3iwca3rj6f3rqggv9y";
+  };
+  outputs = [ "out" ];
+  buildInputs = [ DBDmysql DBI IOSocketSSL TermReadKey ];
+  meta = {
+    description = ''Collection of advanced command-line tools to perform a variety of MySQL and system tasks.'';
+    homepage = http://www.percona.com/software/percona-toolkit;
+    license = with lib.licenses; [ gpl2 ];
+    maintainers = with lib.maintainers; [ izorkin ];
+  };
+}

pkgs/development/perl-modules/Po4a/default.nix

@@ -0,0 +1,36 @@
+{ lib, fetchurl, docbook_xsl, docbook_xsl_ns, gettext, libxslt, glibcLocales, docbook_xml_dtd_412, docbook_sgml_dtd_41, texlive, opensp
+, perl, buildPerlPackage, ModuleBuild, TextWrapI18N, LocaleGettext, TermReadKey, SGMLSpm, UnicodeLineBreak, PodParser, YAMLTiny }:
+
+buildPerlPackage rec {
+  pname = "po4a";
+  version = "0.55";
+  src = fetchurl {
+    url = "https://github.com/mquinson/po4a/releases/download/v${version}/po4a-${version}.tar.gz";
+    sha256 = "1qss4q5df3nsydsbggb7gg50bn0kdxq5wn8riqm9zwkiq6a4bifg";
+  };
+  nativeBuildInputs = [ docbook_xsl docbook_xsl_ns ModuleBuild ];
+  propagatedBuildInputs = [ TextWrapI18N LocaleGettext TermReadKey SGMLSpm UnicodeLineBreak PodParser YAMLTiny ];
+  buildInputs = [ gettext libxslt glibcLocales docbook_xml_dtd_412 docbook_sgml_dtd_41 texlive.combined.scheme-basic opensp ];
+  LC_ALL = "en_US.UTF-8";
+  SGML_CATALOG_FILES = "${docbook_xml_dtd_412}/xml/dtd/docbook/catalog.xml";
+  preConfigure = ''
+    touch Makefile.PL
+    export PERL_MB_OPT="--install_base=$out --prefix=$out"
+  '';
+  buildPhase = "perl Build.PL --install_base=$out --install_path=\"lib=$out/${perl.libPrefix}\"; ./Build build";
+  checkPhase = ''
+    export SGML_CATALOG_FILES=${docbook_sgml_dtd_41}/sgml/dtd/docbook-4.1/docbook.cat
+    ./Build test
+  '';
+  installPhase = ''
+    ./Build install
+    for f in $out/bin/*; do
+      substituteInPlace $f --replace "#! /usr/bin/env perl" "#!${perl}/bin/perl"
+    done
+  '';
+  meta = {
+    homepage = "https://po4a.org/";
+    description = "Tools for helping translation of documentation";
+    license = lib.licenses.gpl2;
+  };
+}

pkgs/development/perl-modules/WWW-YoutubeViewer/default.nix

@@ -0,0 +1,31 @@
+{ stdenv, fetchFromGitHub, buildPerlPackage, shortenPerlShebang, LWP, LWPProtocolHttps, DataDump, JSON }:
+
+buildPerlPackage rec {
+  pname = "WWW-YoutubeViewer";
+  version = "3.3.0";
+
+  src = fetchFromGitHub {
+    owner  = "trizen";
+    repo   = "youtube-viewer";
+    rev    = version;
+    sha256 = "15xyrwv08fw8jmpydwzks26ipxnzliwddgyjcfqiaj0p7lwlhmx1";
+  };
+
+  nativeBuildInputs = stdenv.lib.optional stdenv.isDarwin shortenPerlShebang;
+  propagatedBuildInputs = [
+    LWP
+    LWPProtocolHttps
+    DataDump
+    JSON
+  ];
+  postInstall = stdenv.lib.optionalString stdenv.isDarwin ''
+    shortenPerlShebang $out/bin/youtube-viewer
+  '';
+
+  meta = {
+    description = "A lightweight application for searching and streaming videos from YouTube";
+    homepage = https://github.com/trizen/youtube-viewer;
+    maintainers = with stdenv.lib.maintainers; [ woffs ];
+    license = with stdenv.lib.licenses; [ artistic2 ];
+  };
+}

pkgs/development/perl-modules/generic/builder.sh

@@ -25,17 +25,6 @@ preConfigure() {
     perl Makefile.PL PREFIX=$out INSTALLDIRS=site $makeMakerFlags PERL=$(type -P perl) FULLPERL=\"$fullperl/bin/perl\"
 }
 
-
-postFixup() {
-    # If a user installs a Perl package, she probably also wants its
-    # dependencies in the user environment (since Perl modules don't
-    # have something like an RPATH, so the only way to find the
-    # dependencies is to have them in the PERL5LIB variable).
-    if test -e $out/nix-support/propagated-build-inputs; then
-        ln -s $out/nix-support/propagated-build-inputs $out/nix-support/propagated-user-env-packages
-    fi
-}
-
 if test -n "$perlPreHook"; then
     eval "$perlPreHook"
 fi

pkgs/development/perl-modules/ham/default.nix

@@ -0,0 +1,42 @@
+{ lib, buildPerlPackage, fetchFromGitHub, makeWrapper, openssh, GitRepository, URI, XMLMini }:
+
+buildPerlPackage {
+  pname = "ham-unstable";
+  version = "2019-01-22";
+
+  src = fetchFromGitHub {
+    owner = "kernkonzept";
+    repo = "ham";
+    rev = "37c2e4e8b8bd779ba0f8c48a3c6ba34bad860b92";
+    sha256 = "0h5r5256niskypl4g1j2573wqi0nn0mai5p04zsa06xrgyjqcy2j";
+  };
+
+  outputs = [ "out" ];
+
+  buildInputs = [ makeWrapper ];
+  propagatedBuildInputs = [ openssh GitRepository URI XMLMini ];
+
+  preConfigure = ''
+    patchShebangs .
+    touch Makefile.PL
+    rm -f Makefile
+  '';
+
+  installPhase = ''
+    mkdir -p $out/lib $out/bin
+    cp -r . $out/lib/ham
+
+    makeWrapper $out/lib/ham/ham $out/bin/ham --argv0 ham \
+      --prefix PATH : ${openssh}/bin
+  '';
+
+  doCheck = false;
+
+  meta = {
+    description = "A tool to manage big projects consisting of multiple loosely-coupled git repositories";
+    homepage = https://github.com/kernkonzept/ham;
+    license = "unknown"; # should be gpl2, but not quite sure
+    maintainers = with lib.maintainers; [ aw ];
+    platforms = lib.platforms.unix;
+  };
+}

pkgs/development/perl-modules/net-amazon-ec2-ipv6.patch

@@ -1,51 +0,0 @@
-diff -ru stanaka-net-amazon-ec2-bc66577-orig/lib/Net/Amazon/EC2/RunningInstances.pm stanaka-net-amazon-ec2-bc66577/lib/Net/Amazon/EC2/RunningInstances.pm
---- stanaka-net-amazon-ec2-bc66577-orig/lib/Net/Amazon/EC2/RunningInstances.pm	2011-06-13 19:45:30.000000000 -0400
-+++ stanaka-net-amazon-ec2-bc66577/lib/Net/Amazon/EC2/RunningInstances.pm	2011-10-27 17:25:29.000000000 -0400
-@@ -25,6 +25,10 @@
- This element remains empty until the instance enters a 
- running state.
- 
-+=item dns_name_v6 (optional)
-+
-+The public IPv6 address of the instance.
-+
- =item image_id (required)
- 
- The image id of the AMI currently running in this instance.
-@@ -134,6 +138,7 @@
- 
- has 'ami_launch_index'  	=> ( is => 'ro', isa => 'Str', required => 0 );
- has 'dns_name'          	=> ( is => 'ro', isa => 'Maybe[Str]', required => 0 );
-+has 'dns_name_v6'          	=> ( is => 'ro', isa => 'Maybe[Str]', required => 0 );
- has 'image_id'          	=> ( is => 'ro', isa => 'Str', required => 1 );
- has 'kernel_id'         	=> ( is => 'ro', isa => 'Maybe[Str]', required => 1 );
- has 'ramdisk_id'        	=> ( is => 'ro', isa => 'Maybe[Str]', required => 1 );
-diff -ru stanaka-net-amazon-ec2-bc66577-orig/lib/Net/Amazon/EC2.pm stanaka-net-amazon-ec2-bc66577/lib/Net/Amazon/EC2.pm
---- stanaka-net-amazon-ec2-bc66577-orig/lib/Net/Amazon/EC2.pm	2011-06-13 19:45:30.000000000 -0400
-+++ stanaka-net-amazon-ec2-bc66577/lib/Net/Amazon/EC2.pm	2011-10-27 17:25:29.000000000 -0400
-@@ -1691,6 +1691,7 @@
- 	my $self = shift;
- 	my %args = validate( @_, {
- 		InstanceId => { type => SCALAR | ARRAYREF, optional => 1 },
-+		Action => { default => "DescribeInstances" },
- 	});
- 	
- 	# If we have a array ref of instances lets split them out into their InstanceId.n format
-@@ -1703,7 +1704,8 @@
- 		}
- 	}
- 	
--	my $xml = $self->_sign(Action  => 'DescribeInstances', %args);
-+	my $xml = $self->_sign(Action => $args{Action}, %args);
-+	delete $args{Action};
- 	my $reservations;
- 	
- 	if ( grep { defined && length } $xml->{Errors} ) {
-@@ -1791,6 +1793,7 @@
- 				my $running_instance = Net::Amazon::EC2::RunningInstances->new(
- 					ami_launch_index		=> $instance_elem->{amiLaunchIndex},
- 					dns_name				=> $instance_elem->{dnsName},
-+					dns_name_v6			=> $instance_elem->{dnsNameV6},
- 					image_id				=> $instance_elem->{imageId},
- 					kernel_id				=> $instance_elem->{kernelId},
- 					ramdisk_id				=> $instance_elem->{ramdiskId},

pkgs/development/perl-modules/net-amazon-ec2-nova-compat.patch

@@ -1,21 +0,0 @@
-diff -ru -x '*~' Net-Amazon-EC2-0.14-orig/lib/Net/Amazon/EC2.pm Net-Amazon-EC2-0.14/lib/Net/Amazon/EC2.pm
---- Net-Amazon-EC2-0.14-orig/lib/Net/Amazon/EC2.pm	2010-02-02 02:26:58.000000000 +0100
-+++ Net-Amazon-EC2-0.14/lib/Net/Amazon/EC2.pm	2011-06-16 16:11:53.861341300 +0200
-@@ -1552,6 +1552,8 @@
- 			$args{"InstanceId." . $count} = $instance_id;
- 			$count++;
- 		}
-+	} else {
-+		$args{"InstanceId.1"} = delete $args{InstanceId};
- 	}
- 	
- 	my $xml = $self->_sign(Action  => 'DescribeInstances', %args);
-@@ -3739,6 +3741,8 @@
- 			$args{"InstanceId." . $count} = $instance_id;
- 			$count++;
- 		}
-+	} else {
-+		$args{"InstanceId.1"} = delete $args{InstanceId};
- 	}
- 	
- 	my $xml = $self->_sign(Action  => 'TerminateInstances', %args);	

pkgs/development/perl-modules/strip-nondeterminism/default.nix

@@ -0,0 +1,33 @@
+{ lib, file, fetchFromGitLab, buildPerlPackage, ArchiveZip, ArchiveCpio }:
+
+buildPerlPackage rec {
+  pname = "strip-nondeterminism";
+  version = "1.0.0";
+
+  outputs = [ "out" "dev" ]; # no "devdoc"
+
+  src = fetchFromGitLab {
+    owner = "reproducible-builds";
+    repo = "strip-nondeterminism";
+    domain = "salsa.debian.org";
+    rev = version;
+    sha256 = "1pwar1fyadqxmvb7x4zyw2iawbi5lsfjcg0ps9n9rdjb6an7vv64";
+  };
+
+  # stray test failure
+  doCheck = false;
+
+  buildInputs = [ ArchiveZip ArchiveCpio file ];
+
+  perlPostHook = ''
+    # we don’t need the debhelper script
+    rm $out/bin/dh_strip_nondeterminism
+    rm $out/share/man/man1/dh_strip_nondeterminism.1.gz
+  '';
+
+  meta = with lib; {
+    description = "A Perl module for stripping bits of non-deterministic information";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ pSub ];
+  };
+}

pkgs/development/python-modules/GitPython/default.nix

@@ -1,12 +1,12 @@
 { lib, buildPythonPackage, fetchPypi, isPy27, substituteAll, git, gitdb2, mock, nose, ddt }:
 
 buildPythonPackage rec {
-  version = "2.1.11";
+  version = "2.1.14";
   pname = "GitPython";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8237dc5bfd6f1366abeee5624111b9d6879393d84745a507de0fda86043b65a8";
+    sha256 = "392f31eaadc19db35a54e3ab7285577fb4a86d96ecee08cf22a573f06633baab";
   };
 
   patches = [

pkgs/development/python-modules/Mako/default.nix

@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "Mako";
-  version = "1.0.12";
+  version = "1.0.14";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0cfa65de3a835e87eeca6ac856b3013aade55f49e32515f65d999f91a2324162";
+    sha256 = "f5a642d8c5699269ab62a68b296ff990767eb120f51e2e8f3d6afb16bdb57f4b";
   };
 
   checkInputs = [ markupsafe nose mock pytest ];

pkgs/development/python-modules/adal/default.nix

@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "adal";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b6edd095be66561382bdaa59d40b04490e93149fb3b7fa44c1fa5504eed5b8b9";
+    sha256 = "5a7f1e037c6290c6d7609cab33a9e5e988c2fbec5c51d1c4c649ee3faff37eaf";
   };
 
   propagatedBuildInputs =  [ requests pyjwt dateutil ];

pkgs/development/python-modules/aenum/default.nix

@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "aenum";
-  version = "2.1.2";
+  version = "2.2.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a3208e4b28db3a7b232ff69b934aef2ea1bf27286d9978e1e597d46f490e4687";
+    sha256 = "b12a7be3d89b270f266f8643aaa126404e5cdc0929bd6f09548b8eaed85e2aa1";
   };
 
   # For Python 3, locale has to be set to en_US.UTF-8 for

pkgs/development/python-modules/aiohttp/default.nix

@@ -19,29 +19,41 @@
 , pytest-mock
 , trustme
 , brotlipy
+, freezegun
 }:
 
 buildPythonPackage rec {
   pname = "aiohttp";
-  version = "3.5.4";
+  version = "3.6.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9c4c83f4fa1938377da32bc2d59379025ceeee8e24b89f72fcbccd8ca22dc9bf";
+    sha256 = "09pkw6f1790prnrq0k8cqgnf1qy57ll8lpmc6kld09q7zw4vi6i5";
   };
 
   disabled = pythonOlder "3.5";
 
   checkInputs = [
     pytestrunner pytest gunicorn pytest-timeout async_generator pytest_xdist
-    pytest-mock pytestcov trustme brotlipy
+    pytest-mock pytestcov trustme brotlipy freezegun
   ];
 
   propagatedBuildInputs = [ attrs chardet multidict async-timeout yarl ]
     ++ lib.optionals (pythonOlder "3.7") [ idna-ssl typing-extensions ];
 
+  # disable tests which attempt to do loopback connections
   checkPhase = ''
-    pytest -k "not test__get_valid_log_format_exc and not test_access_logger_atoms"
+    cd tests
+    pytest -k "not get_valid_log_format_exc \
+               and not test_access_logger_atoms \
+               and not aiohttp_request_coroutine \
+               and not server_close_keepalive_connection \
+               and not connector \
+               and not client_disconnect \
+               and not handle_keepalive_on_closed_connection \
+               and not partially_applied_handler \
+               and not middleware" \
+      --ignore=test_connector.py
   '';
 
   meta = with lib; {

pkgs/development/python-modules/aiohue/default.nix

@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "aiohue";
-  version = "1.9.1";
+  version = "1.9.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3c23aed8e82f398b732279f5f7ee7ed00949ff2db7009f7a2dc705f7c2d16783";
+    sha256 = "a7e545ae17658c10f2c5321e40b85426a8c284e5b33b5dfbe9171f9bdf37aa3e";
   };
 
   propagatedBuildInputs = [ aiohttp ];

pkgs/development/python-modules/aioresponses/default.nix

@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "aioresponses";
-  version = "0.6.0";
+  version = "0.6.1";
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0ii1jiwb8qa2y8cqa1zqn7mjax9l8bpf16k4clv616mxw1l0bvs6";
+    sha256 = "fab9607d11a2e05050ef766006b8fdd9424e7122c2bd6f34a5376be4c728e242";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/alembic/default.nix

@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "alembic";
-  version = "1.0.10";
+  version = "1.0.11";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "828dcaa922155a2b7166c4f36ec45268944e4055c86499bd14319b4c8c0094b7";
+    sha256 = "cdb7d98bd5cbf65acd38d70b1c05573c432e6473a82f955cdea541b5c153b0cc";
   };
 
   buildInputs = [ pytest pytestcov mock coverage ];

pkgs/development/python-modules/amqp/default.nix

@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "amqp";
-  version = "2.5.1";
+  version = "2.5.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0s2yxnnhhx9hww0n33yn22q6sgnbd6n2nw92050qv2qpc3i1ga8r";
+    sha256 = "77f1aef9410698d20eaeac5b73a87817365f457a507d82edf292e12cbb83b08d";
   };
 
   checkInputs = [ pytest case pytest-sugar ];

pkgs/development/python-modules/annoy/default.nix

@@ -5,12 +5,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "1.16.0";
+  version = "1.16.2";
   pname = "annoy";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0jnm38kg7aw63mkd5113i3pb2p9fp5cia91jwhyg9sazb45bzpv9";
+    sha256 = "41348e813fe7125eda3e2229a075eba3d065173ba6c5f20c545bb9c2932633fa";
   };
 
   checkInputs = [

pkgs/development/python-modules/ansible-runner/default.nix

@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "ansible-runner";
-  version = "1.4.1";
+  version = "1.4.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1j3jisiy93026ivd28j0c3p2j7ij6zm2k765yjknfx2gg3m5pk14";
+    sha256 = "9db56a69ad5d43fe7656ad8efb4083cb1800ea400f7828af6b20f44c0882404f";
   };
 
   checkInputs = [ pytest mock ];

pkgs/development/python-modules/ansible/default.nix

@@ -38,7 +38,7 @@ buildPythonPackage rec {
   '';
 
   propagatedBuildInputs = [
-    pycrypto paramiko jinja2 pyyaml httplib2 boto
+    pycrypto paramiko jinja2 pyyaml httplib2
     six netaddr dnspython jmespath dopy
   ] ++ lib.optional windowsSupport pywinrm;
 

pkgs/development/python-modules/apprise/default.nix

@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "apprise";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "02apbzckj158995k9ls0gr1m9hfk7nw3ck0bp7k41srl5wdys72i";
+    sha256 = "7a26fa03c4b83f03f17e8f8fc0b94d5502a12dc2e39b48e93a0ab0fd93151a95";
   };
 
   nativeBuildInputs = [ Babel ];

pkgs/development/python-modules/approvaltests/default.nix

@@ -1,7 +1,7 @@
 { stdenv, buildPythonPackage, fetchFromGitHub, isPy37, pyperclip }:
 
 buildPythonPackage rec {
-  version = "0.2.4";
+  version = "0.2.6";
   pname = "approvaltests";
 
   # no tests included in PyPI tarball
@@ -9,7 +9,7 @@ buildPythonPackage rec {
     owner = "approvals";
     repo = "ApprovalTests.Python";
     rev = version;
-    sha256 = "05lj5i13zpkgw1wdc1v81wj4zqj8bpzqiwycdnwlg08azcy7k7j1";
+    sha256 = "1k1bj8q1qm89a8xm4az6qk4qswwmgxw5jpdjcxmf93zh5hrcy9h9";
   };
 
   propagatedBuildInputs = [ pyperclip ];
@@ -19,16 +19,6 @@ buildPythonPackage rec {
       --replace "pyperclip==1.5.27" "pyperclip>=1.5.27"
   '';
 
-  # Tests fail on Python 3.7
-  # https://github.com/approvals/ApprovalTests.Python/issues/36
-  doCheck = !isPy37;
-
-  # Disable Linux failing test, because tries to use darwin/windows specific reporters
-  preCheck = stdenv.lib.optionalString stdenv.isLinux ''
-    substituteInPlace tests/test_genericdiffreporter.py \
-      --replace "test_find_working_reporter" "_find_working_reporter"
-  '';
-
   meta = with stdenv.lib; {
     description = "Assertion/verification library to aid testing";
     homepage = https://github.com/approvals/ApprovalTests.Python;

pkgs/development/python-modules/arpeggio/default.nix

@@ -2,21 +2,31 @@
 , buildPythonPackage
 , fetchPypi
 , glibcLocales
+, pytestrunner
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "Arpeggio";
-  version = "1.9.0";
+  version = "1.9.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a5258b84f76661d558492fa87e42db634df143685a0e51802d59cae7daad8732";
+    sha256 = "948ce06163a48a72c97f4fe79ad3d1c1330b6fec4f22ece182fb60ef60bd022b";
   };
 
   # Shall not be needed for next release
   LC_ALL = "en_US.UTF-8";
   buildInputs = [ glibcLocales ];
 
+  nativeBuildInputs = [ pytestrunner ];
+
+  checkInputs = [ pytestCheckHook ];
+
+  disabledTests = [ "test_examples" "test_issue_22" ];
+
+  dontUseSetuptoolsCheck = true;
+
   meta = {
     description = "Packrat parser interpreter";
     license = lib.licenses.mit;

pkgs/development/python-modules/astor/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, buildPythonPackage, fetchPypi, pytest }:
+{ stdenv, buildPythonPackage, fetchPypi, isPy27, pytest, fetchpatch }:
 
 buildPythonPackage rec {
   pname = "astor";
@@ -9,6 +9,14 @@ buildPythonPackage rec {
     sha256 = "0qkq5bf13fqcwablg0nk7rx83izxdizysd42n26j5wbingcfx9ip";
   };
 
+  # fix packaging for setuptools>=41.4
+  patches = [
+    ( fetchpatch {
+        url = "https://github.com/berkerpeksag/astor/pull/163/commits/c908d1136cdfb058f5e9d81b4d3687931aa1ebfb.patch";
+        sha256 = "06mrx3qxfjyx9v76kxsj2b7zyqwrwlyd5z1fh77jbb8yl6m0nacd";
+    })
+  ];
+
   # disable tests broken with python3.6: https://github.com/berkerpeksag/astor/issues/89
   checkInputs = [ pytest ];
   checkPhase = ''

pkgs/development/python-modules/astroid/default.nix

@@ -5,13 +5,13 @@
 
 buildPythonPackage rec {
   pname = "astroid";
-  version = "2.2.5";
+  version = "2.3.1";
 
   disabled = pythonOlder "3.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1x5c8fiqa18frwwfdsw41lpqsyff3w4lxvjx9d5ccs4zfkhy2q35";
+    sha256 = "b7546ffdedbf7abcfbff93cd1de9e9980b1ef744852689decc5aeada324238c6";
   };
 
   # From astroid/__pkginfo__.py

pkgs/development/python-modules/astropy/default.nix

@@ -10,13 +10,13 @@
 
 buildPythonPackage rec {
   pname = "astropy";
-  version = "3.2.1";
+  version = "3.2.2";
 
   disabled = !isPy3k; # according to setup.py
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "706c0457789c78285e5464a5a336f5f0b058d646d60f4e5f5ba1f7d5bf424b28";
+    sha256 = "8553f4a95e9938a0c7ae520633f7172356824b8eb324dd967fca6baf00ac19bf";
   };
 
   nativeBuildInputs = [ astropy-helpers ];

pkgs/development/python-modules/astroquery/default.nix

@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "astroquery";
-  version = "0.3.9";
+  version = "0.3.10";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0zw3xp2rfc6h2v569iqsyvzhfnzp7bfjb7jrj61is1hrqw1cqjrb";
+    sha256 = "1ce57a8792c7d5d74206d797d379de6da35d56be433ea5840c41a49f202e2fab";
   };
 
   # Fix tests using conftest.py from HEAD in the upstream GitHub

pkgs/development/python-modules/atomman/default.nix

@@ -13,12 +13,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "1.2.6";
+  version = "1.2.8";
   pname = "atomman";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "19501bfdf7e66090764a0ccbecf85a128b46333ea232c2137fa4345512b8b502";
+    sha256 = "0ed099fdceca2d733e81afb08d777e8e852a6e53660d6d268f3739b8d323ced9";
   };
 
   checkInputs = [ pytest ];

pkgs/development/python-modules/attrs/default.nix

@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "attrs";
-  version = "18.2.0";
+  version = "19.3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "10cbf6e27dbce8c30807caf056c8eb50917e0eaafe86347671b57254006c3e69";
+    sha256 = "f7b7ce16570fe9965acd6d30101a28f62fb4a7f9e926b3bbc9b61f8b04247e72";
   };
 
   # macOS needs clang for testing

pkgs/development/python-modules/aws-lambda-builders/default.nix

@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "aws-lambda-builders";
-  version = "0.3.0";
+  version = "0.4.0";
 
   # No tests available in PyPI tarball
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-lambda-builders";
     rev = "v${version}";
-    sha256 = "1c3r3iz29s68mlmdsxbl65x5zqx25b89d40rir6729ck4gll4dyd";
+    sha256 = "1z2l9qm6mxp90zl64i9j2cmlzn8n7sc8yfpqh14fi9ay887ayjs1";
   };
 
   # Package is not compatible with Python 3.5
@@ -35,7 +35,7 @@ buildPythonPackage rec {
 
   checkPhase = ''
     export PATH=$out/bin:$PATH
-    pytest tests/functional
+    pytest tests/functional -k 'not can_invoke_pip'
   '';
 
   meta = with lib; {

pkgs/development/python-modules/azure-cli-core/default.nix

@@ -33,11 +33,11 @@
 
 buildPythonPackage rec {
   pname = "azure-cli-core";
-  version = "2.0.71";
+  version = "2.0.75";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "01pqdh16l2c9a6b1az9galmm1szvhg7fyf9shq872wanw1xx88dj";
+    sha256 = "6fde38f4448542c0cf7b13201b702c6927180e7294221b8f67e2c834f22ae1bc";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/azure-cli-telemetry/default.nix

@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "azure-cli-telemetry";
-  version = "1.0.3";
+  version = "1.0.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0sf27pcz653h0cnxsg47nndilhqlw9fl019aqbnji2vn967r9rnl";
+    sha256 = "1f239d544d309c29e827982cc20113eb57037dba16db6cdd2e0283e437e0e577";
   };
 
   propagatedBuildInputs = [
@@ -28,10 +28,10 @@ buildPythonPackage rec {
   # Remove overly restrictive version contraints and obsolete namespace setup
   prePatch = ''
     substituteInPlace setup.py \
-      --replace "applicationinsights>=0.11.1,<0.11.8" "applicationinsights" \
-      --replace "portalocker==1.2.1" "portalocker"
+      --replace "applicationinsights>=0.11.1,<0.12" "applicationinsights"
     substituteInPlace setup.cfg \
       --replace "azure-namespace-package = azure-cli-nspkg" ""
+    rm azure_bdist_wheel.py # we'll fix PEP420 namespacing
   '';
 
   # Prevent these __init__'s from violating PEP420, only needed for python2

pkgs/development/python-modules/azure-common/default.nix

@@ -9,14 +9,14 @@
 }:
 
 buildPythonPackage rec {
-  version = "1.1.21";
+  version = "1.1.23";
   pname = "azure-common";
   disabled = isPyPy;
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "25d696d2affbf5fe9b13aebe66271fce545e673e7e1eeaaec2d73599ba639d63";
+    sha256 = "53b1195b8f20943ccc0e71a17849258f7781bc6db1c72edc7d6c055f79bd54e3";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/backports_lzma/default.nix

@@ -9,13 +9,13 @@
 
 if !(pythonOlder "3.3") then null else buildPythonPackage rec {
   pname = "backports.lzma";
-  version = "0.0.13";
+  version = "0.0.14";
 
   disabled = isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "50829db66f0445442f6c796bba0ca62d1f87f54760c4682b6d1489e729a43744";
+    sha256 = "16d8b68e4d3cd4e6c9ddb059850452946da3914c8a8e197a7f2b0954559f2df4";
   };
 
   buildInputs = [ lzma ];

pkgs/development/python-modules/bidict/default.nix

@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "bidict";
-  version = "0.18.2";
+  version = "0.18.3";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0br3ljvd56nqifr1mbwksvl5jjk40pihrrjlyn7hmc40yq6m5bvh";
+    sha256 = "1742a25a9ef1b1ac4000683406879a3e1a6577faa02f31e482e6c84e2e3bf628";
   };
 
   nativeBuildInputs = [ setuptools_scm ];

pkgs/development/python-modules/billiard/default.nix

@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "billiard";
-  version = "3.6.0.0";
+  version = "3.6.1.0";
   disabled = isPyPy;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "756bf323f250db8bf88462cd042c992ba60d8f5e07fc5636c24ba7d6f4261d84";
+    sha256 = "b8809c74f648dfe69b973c8e660bcec00603758c9db8ba89d7719f88d5f01f26";
   };
 
   checkInputs = [ pytest case psutil ];

pkgs/development/python-modules/blis/default.nix

@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "blis";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1khh02z6wryrnrxlx2wrxzhaqsg5hlgypy0643rvi4zcqanvdpym";
+    sha256 = "d69257d317e86f34a7f230a2fd1f021fd2a1b944137f40d8cdbb23bd334cd0c4";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/bootstrapped-pip/default.nix

@@ -1,35 +1,19 @@
 { stdenv, python, fetchPypi, makeWrapper, unzip, makeSetupHook
 , pipInstallHook
 , setuptoolsBuildHook
-
+, wheel, pip, setuptools
 }:
 
-let
-  wheel_source = fetchPypi {
-    pname = "wheel";
-    version = "0.33.6";
-    format = "wheel";
-    sha256 = "f4da1763d3becf2e2cd92a14a7c920f0f00eca30fdde9ea992c836685b9faf28";
-  };
-  setuptools_source = fetchPypi {
-    pname = "setuptools";
-    version = "41.2.0";
-    format = "wheel";
-    sha256 = "4380abcf2a4ffd1a5ba22d687c6d690dce83b2b51c70e9c6d09f7e8c7e8040dc";
-  };
-
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "pip";
-  version = "19.2.3";
+  inherit (pip) version;
   name = "${python.libPrefix}-bootstrapped-${pname}-${version}";
 
-  src = fetchPypi {
-    inherit pname version;
-    format = "wheel";
-    sha256 = "340a0ba40fdeb16413914c0fcd8e0b4ebb0bf39a900ec80e11c05d836c05103f";
-  };
+  srcs = [ wheel.src pip.src setuptools.src ];
+  sourceRoot = ".";
 
   dontUseSetuptoolsBuild = true;
+  dontUsePipInstall = true;
 
   # Should be propagatedNativeBuildInputs
   propagatedBuildInputs = [
@@ -38,13 +22,6 @@ in stdenv.mkDerivation rec {
     (setuptoolsBuildHook.override{setuptools=null; wheel=null;})
   ];
 
-  unpackPhase = ''
-    mkdir -p $out/${python.sitePackages}
-    unzip -d $out/${python.sitePackages} $src
-    unzip -d $out/${python.sitePackages} ${setuptools_source}
-    unzip -d $out/${python.sitePackages} ${wheel_source}
-  '';
-
   postPatch = ''
     mkdir -p $out/bin
   '';
@@ -52,18 +29,38 @@ in stdenv.mkDerivation rec {
   nativeBuildInputs = [ makeWrapper unzip ];
   buildInputs = [ python ];
 
-  installPhase = ''
+  buildPhase = ":";
 
-    # install pip binary
-    echo '#!${python.interpreter}' > $out/bin/pip
-    echo 'import sys;from pip._internal import main' >> $out/bin/pip
-    echo 'sys.exit(main())' >> $out/bin/pip
-    chmod +x $out/bin/pip
+  installPhase = stdenv.lib.strings.optionalString (!stdenv.hostPlatform.isWindows) ''
+    export SETUPTOOLS_INSTALL_WINDOWS_SPECIFIC_FILES=0
+  '' + ''
+    # Give folders a known name
+    mv pip* pip
+    mv setuptools* setuptools
+    mv wheel* wheel
+    # Set up PYTHONPATH. The above folders need to be on PYTHONPATH
+    # $out is where we are installing to and takes precedence
+    export PYTHONPATH="$out/${python.sitePackages}:$(pwd)/pip/src:$(pwd)/setuptools:$(pwd)/setuptools/pkg_resources:$(pwd)/wheel"
 
-    # wrap binaries with PYTHONPATH
-    for f in $out/bin/*; do
-      wrapProgram $f --prefix PYTHONPATH ":" $out/${python.sitePackages}/
-    done
+    echo "Building setuptools wheel..."
+    pushd setuptools
+    ${python.pythonForBuild.interpreter} -m pip install --no-build-isolation --no-index --prefix=$out  --ignore-installed --no-dependencies --no-cache --build tmpbuild .
+    popd
+
+    echo "Building wheel wheel..."
+    pushd wheel
+    ${python.pythonForBuild.interpreter} -m pip install --no-build-isolation --no-index --prefix=$out  --ignore-installed --no-dependencies --no-cache --build tmpbuild .
+    popd
+
+    echo "Building pip wheel..."
+    pushd pip
+    ${python.pythonForBuild.interpreter} -m pip install --no-build-isolation --no-index --prefix=$out  --ignore-installed --no-dependencies --no-cache --build tmpbuild .
+    popd
   '';
 
+  meta = {
+    description = "Version of pip used for bootstrapping";
+    license = stdenv.lib.unique (pip.meta.license ++ setuptools.meta.license ++ wheel.meta.license);
+    homepage = pip.meta.homepage;
+  };
 }

pkgs/development/python-modules/boto3/default.nix

@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname =  "boto3";
-  version = "1.9.205"; # N.B: if you change this, change botocore too
+  version = "1.9.250"; # N.B: if you change this, change botocore too
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1zxz1d6w3f4ip04bm26xplpxjhblc2vfmqcs5n63a9y1h43mk171";
+    sha256 = "95f70eda4bd6756e297a7c89739571cbc5cd474620142e5cbe19810529d6ec1f";
   };
 
   propagatedBuildInputs = [ botocore jmespath s3transfer ] ++ lib.optionals (!isPy3k) [ futures ];

pkgs/development/python-modules/botocore/default.nix

@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "botocore";
-  version = "1.12.205"; # N.B: if you change this, change boto3 and awscli to a matching version
+  version = "1.12.251"; # N.B: if you change this, change boto3 and awscli to a matching version
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "19ls7hdmcaqrrq8przqy05s8chsy8315ic2zg185k6m64pvr0qhd";
+    sha256 = "887a57b3dcfb1d29ae11e504a486cd8dbe1af4f5678980a804dbf02b36d1c4f8";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/python-modules/bottle/default.nix

@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "bottle";
-  version = "0.12.16";
+  version = "0.12.17";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9c310da61e7df2b6ac257d8a90811899ccb3a9743e77e947101072a2e3186726";
+    sha256 = "e9eaa412a60cc3d42ceb42f58d15864d9ed1b92e9d630b8130c871c5bb16107c";
   };
 
   propagatedBuildInputs = [ setuptools ];

pkgs/development/python-modules/breathe/default.nix

@@ -1,12 +1,12 @@
 { lib, fetchPypi, buildPythonPackage, docutils, six, sphinx, isPy3k }:
 
 buildPythonPackage rec {
-  version = "4.13.0";
+  version = "4.13.1";
   pname = "breathe";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "08xs1cqpvcv7735j19c35br34gbwzfn89rkg12n2yfz4af0x3xfp";
+    sha256 = "c6752345252f48092bf72a450fd9e84367bd5b4af99d86c92047f82c6c2287ab";
   };
 
   propagatedBuildInputs = [ docutils six sphinx ];

pkgs/development/python-modules/buildout-nix/default.nix

@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "zc.buildout";
-  version = "2.13.1";
+  version = "2.13.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3d14d07226963a517295dfad5879d2799e2e3b65b2c61c71b53cb80f5ab11484";
+    sha256 = "5dd4de86dda684c46ef8ee9cc84e335ca7f6275d4363a684de82225270d1e328";
   };
 
   patches = [ ./nix.patch ];

pkgs/development/python-modules/bumps/default.nix

@@ -2,7 +2,7 @@
 
 buildPythonPackage rec {
   pname = "bumps";
-  version = "0.7.12";
+  version = "0.7.13";
 
   propagatedBuildInputs = [six];
 
@@ -12,7 +12,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0a8m56bwyi0gdrf3kgkdw3cajyxlr40qrj1xlh5yn4qqjbz7ym02";
+    sha256 = "fdcf335b800d892edfdbc87fdd539cb45166d8667edbec3dfbb1a3b5c3a35547";
   };
 
   meta = with stdenv.lib; {

pkgs/development/python-modules/can/default.nix

@@ -16,11 +16,11 @@
 
 buildPythonPackage rec {
   pname = "python-can";
-  version = "3.3.1";
+  version = "3.3.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1giv9s6w90lalxsijgnxzynygkckcfyaxnxsldbwv0784vwy1jcd";
+    sha256 = "5fefb5c1e7e7f07faefc02c6eac79f9b58376f007048a04d8e7f325d48ec6b2e";
   };
 
   propagatedBuildInputs = [ wrapt pyserial aenum ] ++ lib.optional (pythonOlder "3.5") typing;

pkgs/development/python-modules/cerberus/default.nix

@@ -11,6 +11,10 @@ buildPythonPackage rec {
 
   checkInputs = [ pytestrunner pytest ];
 
+  checkPhase = ''
+    pytest -k 'not nested_oneofs'
+  '';
+
   meta = with stdenv.lib; {
     homepage = http://python-cerberus.org/;
     description = "Lightweight, extensible schema and data validation tool for Python dictionaries";

pkgs/development/python-modules/certifi/default.nix

@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "certifi";
-  version = "2019.6.16";
+  version = "2019.9.11";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "945e3ba63a0b9f577b1395204e13c3a231f9bc0223888be653286534e5873695";
+    sha256 = "0l0yw94ypd117bl7f0fx8sqw9wsnrpcsn92vr7nkxy54zq665wz4";
   };
 
   meta = {

pkgs/development/python-modules/cheroot/default.nix

@@ -8,11 +8,11 @@ let inherit (stdenv) lib; in
 
 buildPythonPackage rec {
   pname = "cheroot";
-  version = "6.5.6";
+  version = "6.5.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b824f9961eb447809badeb051820a05770354e2f9ae5c355eecc21f22633c217";
+    sha256 = "427e7e3ce51ad5a6e5cf953252b5782d5dfbeb544c09910634971bc06df6621b";
   };
 
   patches = [ ./tests.patch ];

pkgs/development/python-modules/click-completion/default.nix

@@ -4,12 +4,12 @@
 
 buildPythonPackage rec {
   pname = "click-completion";
-  version = "0.5.1";
+  version = "0.5.2";
   disabled = (!isPy3k);
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1ysn6kzv3fgakn0y06i3cxynd8iaybarrygabk9a0pp2spn2w1vq";
+    sha256 = "5bf816b81367e638a190b6e91b50779007d14301b3f9f3145d68e3cade7bce86";
   };
 
   propagatedBuildInputs = [ click jinja2 shellingham six ];

pkgs/development/python-modules/cmd2/default.nix

@@ -6,11 +6,11 @@
 }:
 buildPythonPackage rec {
   pname = "cmd2";
-  version = "0.9.17";
+  version = "0.9.19";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0sp4m5xg8ms3ikps0c6qd51f9cab4ca9byl865bklm9vxc1adgkp";
+    sha256 = "c81284083d993af18b8fef57d89d854d49d051d4c2c8a8e12d0281e369ac3682";
   };
 
   LC_ALL="en_US.UTF-8";

pkgs/development/python-modules/coloredlogs/default.nix

@@ -19,7 +19,8 @@ buildPythonPackage rec {
   });
 
   checkPhase = ''
-    PATH=$PATH:$out/bin pytest . -k "not test_plain_text_output_format"
+    PATH=$PATH:$out/bin pytest . -k "not test_plain_text_output_format \
+                                     and not test_auto_install"
   '';
   checkInputs = [ pytest mock utillinux ];
 

pkgs/development/python-modules/commonmark/default.nix

@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "commonmark";
-  version = "0.8.1";
+  version = "0.9.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "abcbc854e0eae5deaf52ae5e328501b78b4a0758bf98ac8bb792fce993006084";
+    sha256 = "452f9dc859be7f06631ddcb328b6919c67984aca654e5fefb3914d54691aed60";
   };
 
   preCheck = ''