Recover the complicated situation after my bad merge

I made a mistake merge.  Reverting it in c778945806b undid the state
on master, but now I realize it crippled the git merge mechanism.
As the merge contained a mix of commits from `master..staging-next`
and other commits from `staging-next..staging`, it got the
`staging-next` branch into a state that was difficult to recover.

I reconstructed the "desired" state of staging-next tree by:
 - checking out the last commit of the problematic range: 4effe769e2b
 - `git rebase -i --preserve-merges a8a018ddc0` - dropping the mistaken
   merge commit and its revert from that range (while keeping
   reapplication from 4effe769e2)
 - merging the last unaffected staging-next commit (803ca85c209)
 - fortunately no other commits have been pushed to staging-next yet
 - applying a diff on staging-next to get it into that state

52 files changed, 667 insertions, 1750 deletions

diff --git a/doc/stdenv/stdenv.xml b/doc/stdenv/stdenv.xml
index 4c069b57edd..46ee97927ea 100644
--- a/doc/stdenv/stdenv.xml
+++ b/doc/stdenv/stdenv.xml
@@ -2070,7 +2070,7 @@ nativeBuildInputs = [ breakpointHook ];
        The <literal>installManPage</literal> function takes one or more paths to manpages to install. The manpages must have a section suffix, and may optionally be compressed (with <literal>.gz</literal> suffix). This function will place them into the correct directory.
       </para>
       <para>
-       The <literal>installShellCompletion</literal> function takes one or more paths to shell completion files. By default it will autodetect the shell type from the completion file extension, but you may also specify it by passing one of <literal>--bash</literal>, <literal>--fish</literal>, or <literal>--zsh</literal>. These flags apply to all paths listed after them (up until another shell flag is given). Each path may also have a custom installation name provided by providing a flag <literal>--name NAME</literal> before the path. If this flag is not provided, zsh completions will be renamed automatically such that <literal>foobar.zsh</literal> becomes <literal>_foobar</literal>.
+       The <literal>installShellCompletion</literal> function takes one or more paths to shell completion files. By default it will autodetect the shell type from the completion file extension, but you may also specify it by passing one of <literal>--bash</literal>, <literal>--fish</literal>, or <literal>--zsh</literal>. These flags apply to all paths listed after them (up until another shell flag is given). Each path may also have a custom installation name provided by providing a flag <literal>--name NAME</literal> before the path. If this flag is not provided, zsh completions will be renamed automatically such that <literal>foobar.zsh</literal> becomes <literal>_foobar</literal>. A root name may be provided for all paths using the flag <literal>--cmd NAME</literal>; this synthesizes the appropriate name depending on the shell (e.g. <literal>--cmd foo</literal> will synthesize the name <literal>foo.bash</literal> for bash and <literal>_foo</literal> for zsh). The path may also be a fifo or named fd (such as produced by <literal>&lt;(cmd)</literal>), in which case the shell and name must be provided.
 <programlisting>
 nativeBuildInputs = [ installShellFiles ];
 postInstall = ''
@@ -2081,6 +2081,11 @@ postInstall = ''
   installShellCompletion --zsh --name _foobar share/completions.zsh
   # implicit behavior
   installShellCompletion share/completions/foobar.{bash,fish,zsh}
+  # using named fd
+  installShellCompletion --cmd foobar \
+    --bash &lt;($out/bin/foobar --bash-completion) \
+    --fish &lt;($out/bin/foobar --fish-completion) \
+    --zsh &lt;($out/bin/foobar --zsh-completion)
 '';
 </programlisting>
       </para>
diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index 7e40366142a..49dc7866dbd 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -22,7 +22,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.28.0";
+  version = "2.29.0";
   svn = subversionClient.override { perlBindings = perlSupport; };
 
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
@@ -34,7 +34,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "17a311vzimqn1glc9d7x82rhb1mb81m5rr4g8xji8idaafid39fz";
+    sha256 = "KEMtmVJXxGJv4PsgkfWI327tmOlXFBnnLIO8Izcua4k=";
   };
 
   outputs = [ "out" ] ++ stdenv.lib.optional withManual "doc";
diff --git a/pkgs/build-support/install-shell-files/default.nix b/pkgs/build-support/install-shell-files/default.nix
index e1f2e24dd87..d50661ddc65 100644
--- a/pkgs/build-support/install-shell-files/default.nix
+++ b/pkgs/build-support/install-shell-files/default.nix
@@ -1,4 +1,12 @@
-{ makeSetupHook }:
+{ makeSetupHook, tests }:
 
 # See the header comment in ../setup-hooks/install-shell-files.sh for example usage.
-makeSetupHook { name = "install-shell-files"; } ../setup-hooks/install-shell-files.sh
+let
+  setupHook = makeSetupHook { name = "install-shell-files"; } ../setup-hooks/install-shell-files.sh;
+in
+
+setupHook.overrideAttrs (oldAttrs: {
+  passthru = (oldAttrs.passthru or {}) // {
+    tests = tests.install-shell-files;
+  };
+})
diff --git a/pkgs/build-support/setup-hooks/install-shell-files.sh b/pkgs/build-support/setup-hooks/install-shell-files.sh
index e0ea1f7f30a..194b408b105 100644
--- a/pkgs/build-support/setup-hooks/install-shell-files.sh
+++ b/pkgs/build-support/setup-hooks/install-shell-files.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+# shellcheck shell=bash
 # Setup hook for the `installShellFiles` package.
 #
 # Example usage in a derivation:
@@ -19,8 +19,8 @@
 # installManPage <path> [...<path>]
 #
 # Each argument is checked for its man section suffix and installed into the appropriate
-# share/man<n>/ directory. The function returns an error if any paths don't have the man section
-# suffix (with optional .gz compression).
+# share/man/man<n>/ directory. The function returns an error if any paths don't have the man
+# section suffix (with optional .gz compression).
 installManPage() {
     local path
     for path in "$@"; do
@@ -49,7 +49,7 @@ installManPage() {
     done
 }
 
-# installShellCompletion [--bash|--fish|--zsh] ([--name <name>] <path>)...
+# installShellCompletion [--cmd <name>] ([--bash|--fish|--zsh] [--name <name>] <path>)...
 #
 # Each path is installed into the appropriate directory for shell completions for the given shell.
 # If one of `--bash`, `--fish`, or `--zsh` is given the path is assumed to belong to that shell.
@@ -61,9 +61,20 @@ installManPage() {
 # If the shell completion needs to be renamed before installing the optional `--name <name>` flag
 # may be given. Any name provided with this flag only applies to the next path.
 #
+# If all shell completions need to be renamed before installing the optional `--cmd <name>` flag
+# may be given. This will synthesize a name for each file, unless overridden with an explicit
+# `--name` flag. For example, `--cmd foobar` will synthesize the name `_foobar` for zsh and
+# `foobar.bash` for bash.
+#
 # For zsh completions, if the `--name` flag is not given, the path will be automatically renamed
 # such that `foobar.zsh` becomes `_foobar`.
 #
+# A path may be a named fd, such as produced by the bash construct `<(cmd)`. When using a named fd,
+# the shell type flag must be provided, and either the `--name` or `--cmd` flag must be provided.
+# This might look something like:
+#
+#   installShellCompletion --zsh --name _foobar <($out/bin/foobar --zsh-completion)
+#
 # This command accepts multiple shell flags in conjunction with multiple paths if you wish to
 # install them all in one command:
 #
@@ -76,9 +87,16 @@ installManPage() {
 #   installShellCompletion --fish --name foobar.fish share/completions.fish
 #   installShellCompletion --zsh --name _foobar share/completions.zsh
 #
+# Or to use shell newline escaping to split a single invocation across multiple lines:
+#
+#   installShellCompletion --cmd foobar \
+#     --bash <($out/bin/foobar --bash-completion) \
+#     --fish <($out/bin/foobar --fish-completion) \
+#     --zsh <($out/bin/foobar --zsh-completion)
+#
 # If any argument is `--` the remaining arguments will be treated as paths.
 installShellCompletion() {
-    local shell='' name='' retval=0 parseArgs=1 arg
+    local shell='' name='' cmdname='' retval=0 parseArgs=1 arg
     while { arg=$1; shift; }; do
         # Parse arguments
         if (( parseArgs )); then
@@ -97,6 +115,17 @@ installShellCompletion() {
                 # treat `--name=foo` the same as `--name foo`
                 name=${arg#--name=}
                 continue;;
+            --cmd)
+                cmdname=$1
+                shift || {
+                    echo 'installShellCompletion: error: --cmd flag expected an argument' >&2
+                    return 1
+                }
+                continue;;
+            --cmd=*)
+                # treat `--cmd=foo` the same as `--cmd foo`
+                cmdname=${arg#--cmd=}
+                continue;;
             --?*)
                 echo "installShellCompletion: warning: unknown flag ${arg%%=*}" >&2
                 retval=2
@@ -110,39 +139,67 @@ installShellCompletion() {
         if (( "${NIX_DEBUG:-0}" >= 1 )); then
             echo "installShellCompletion: installing $arg${name:+ as $name}"
         fi
-        # if we get here, this is a path
-        # Identify shell
-        local basename
-        basename=$(stripHash "$arg")
+        # if we get here, this is a path or named pipe
+        # Identify shell and output name
         local curShell=$shell
-        if [[ -z "$curShell" ]]; then
-            # auto-detect the shell
-            case "$basename" in
-            ?*.bash) curShell=bash;;
-            ?*.fish) curShell=fish;;
-            ?*.zsh) curShell=zsh;;
+        local outName=''
+        if [[ -z "$arg" ]]; then
+            echo "installShellCompletion: error: empty path is not allowed" >&2
+            return 1
+        elif [[ -p "$arg" ]]; then
+            # this is a named fd or fifo
+            if [[ -z "$curShell" ]]; then
+                echo "installShellCompletion: error: named pipe requires one of --bash, --fish, or --zsh" >&2
+                return 1
+            elif [[ -z "$name" && -z "$cmdname" ]]; then
+                echo "installShellCompletion: error: named pipe requires one of --cmd or --name" >&2
+                return 1
+            fi
+        else
+            # this is a path
+            local argbase
+            argbase=$(stripHash "$arg")
+            if [[ -z "$curShell" ]]; then
+                # auto-detect the shell
+                case "$argbase" in
+                ?*.bash) curShell=bash;;
+                ?*.fish) curShell=fish;;
+                ?*.zsh) curShell=zsh;;
+                *)
+                    if [[ "$argbase" = _* && "$argbase" != *.* ]]; then
+                        # probably zsh
+                        echo "installShellCompletion: warning: assuming path \`$arg' is zsh; please specify with --zsh" >&2
+                        curShell=zsh
+                    else
+                        echo "installShellCompletion: warning: unknown shell for path: $arg" >&2
+                        retval=2
+                        continue
+                    fi;;
+                esac
+            fi
+            outName=$argbase
+        fi
+        # Identify output path
+        if [[ -n "$name" ]]; then
+            outName=$name
+        elif [[ -n "$cmdname" ]]; then
+            case "$curShell" in
+            bash|fish) outName=$cmdname.$curShell;;
+            zsh) outName=_$cmdname;;
             *)
-                if [[ "$basename" = _* && "$basename" != *.* ]]; then
-                    # probably zsh
-                    echo "installShellCompletion: warning: assuming path \`$arg' is zsh; please specify with --zsh" >&2
-                    curShell=zsh
-                else
-                    echo "installShellCompletion: warning: unknown shell for path: $arg" >&2
-                    retval=2
-                    continue
-                fi;;
+                # Our list of shells is out of sync with the flags we accept or extensions we detect.
+                echo 'installShellCompletion: internal error' >&2
+                return 1;;
             esac
         fi
-        # Identify output path
-        local outName sharePath
-        outName=${name:-$basename}
+        local sharePath
         case "$curShell" in
         bash) sharePath=bash-completion/completions;;
         fish) sharePath=fish/vendor_completions.d;;
         zsh)
             sharePath=zsh/site-functions
             # only apply automatic renaming if we didn't have a manual rename
-            if test -z "$name"; then
+            if [[ -z "$name" && -z "$cmdname" ]]; then
                 # convert a name like `foo.zsh` into `_foo`
                 outName=${outName%.zsh}
                 outName=_${outName#_}
@@ -153,8 +210,16 @@ installShellCompletion() {
             return 1;;
         esac
         # Install file
-        install -Dm644 -T "$arg" "${!outputBin:?}/share/$sharePath/$outName" || return
-        # Clear the name, it only applies to one path
+        local outDir="${!outputBin:?}/share/$sharePath"
+        local outPath="$outDir/$outName"
+        if [[ -p "$arg" ]]; then
+            # install handles named pipes on NixOS but not on macOS
+            mkdir -p "$outDir" \
+            && cat "$arg" > "$outPath"
+        else
+            install -Dm644 -T "$arg" "$outPath"
+        fi || return
+        # Clear the per-path flags
         name=
     done
     if [[ -n "$name" ]]; then
diff --git a/pkgs/data/misc/tzdata/default.nix b/pkgs/data/misc/tzdata/default.nix
index 367ee06390c..dc80580ff5e 100644
--- a/pkgs/data/misc/tzdata/default.nix
+++ b/pkgs/data/misc/tzdata/default.nix
@@ -2,16 +2,16 @@
 
 stdenv.mkDerivation rec {
   pname = "tzdata";
-  version = "2019c";
+  version = "2020c";
 
   srcs =
     [ (fetchurl {
         url = "https://data.iana.org/time-zones/releases/tzdata${version}.tar.gz";
-        sha256 = "0z7w1yv37cfk8yhix2cillam091vgp1j4g8fv84261q9mdnq1ivr";
+        sha256 = "1nab36g5ibs88wg2mzpzygi1wh5gh2al1qjvbk8sb90sbw8ar43q";
       })
       (fetchurl {
         url = "https://data.iana.org/time-zones/releases/tzcode${version}.tar.gz";
-        sha256 = "1m3y2rnf1nggxxhxplab5zdd5whvar3ijyrv7lifvm82irkd7szn";
+        sha256 = "1r5zrk1k3jhhilkhrx82fd19rvysji8jk05gq5v0rndmyx07zacs";
       })
     ];
 
diff --git a/pkgs/development/compilers/gcc/builder.sh b/pkgs/development/compilers/gcc/builder.sh
index 2204744a4b5..e1c4768413f 100644
--- a/pkgs/development/compilers/gcc/builder.sh
+++ b/pkgs/development/compilers/gcc/builder.sh
@@ -287,7 +287,12 @@ postInstall() {
     done
 
     # Two identical man pages are shipped (moving and compressing is done later)
-    ln -sf gcc.1 "$out"/share/man/man1/g++.1
+    for i in "$out"/share/man/man1/*g++.1; do
+        if test -e "$i"; then
+            man_prefix=`echo "$i" | sed "s,.*/\(.*\)g++.1,\1,"`
+            ln -sf "$man_prefix"gcc.1 "$i"
+        fi
+    done
 }
 
 genericBuild
diff --git a/pkgs/development/compilers/purescript/psc-package/default.nix b/pkgs/development/compilers/purescript/psc-package/default.nix
index 0bebd5d2f50..88f7adce5a1 100644
--- a/pkgs/development/compilers/purescript/psc-package/default.nix
+++ b/pkgs/development/compilers/purescript/psc-package/default.nix
@@ -44,12 +44,10 @@ stdenv.mkDerivation rec {
   '' + ''
     chmod u-w $PSC_PACKAGE
 
-    $PSC_PACKAGE --bash-completion-script $PSC_PACKAGE > psc-package.bash
-    $PSC_PACKAGE --fish-completion-script $PSC_PACKAGE > psc-package.fish
-    $PSC_PACKAGE --zsh-completion-script $PSC_PACKAGE > _psc-package
-    installShellCompletion \
-      psc-package.{bash,fish} \
-      --zsh _psc-package
+    installShellCompletion --cmd psc-package \
+      --bash <($PSC_PACKAGE --bash-completion-script $PSC_PACKAGE) \
+      --fish <($PSC_PACKAGE --fish-completion-script $PSC_PACKAGE) \
+      --zsh <($PSC_PACKAGE --zsh-completion-script $PSC_PACKAGE)
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/compilers/rust/1_46.nix b/pkgs/development/compilers/rust/1_47.nix
index c999b346ee6..e5cbae193bf 100644
--- a/pkgs/development/compilers/rust/1_46.nix
+++ b/pkgs/development/compilers/rust/1_47.nix
@@ -19,24 +19,24 @@
 } @ args:
 
 import ./default.nix {
-  rustcVersion = "1.46.0";
-  rustcSha256 = "0a17jby2pd050s24cy4dfc0gzvgcl585v3vvyfilniyvjrqknsid";
+  rustcVersion = "1.47.0";
+  rustcSha256 = "sha256-MYXfBkxHR/LIubuMRGjt1Y/0rW0HiAyHmsGxc7do2B0=";
 
   # Note: the version MUST be one version prior to the version we're
   # building
-  bootstrapVersion = "1.45.2";
+  bootstrapVersion = "1.46.0";
 
   # fetch hashes by running `print-hashes.sh 1.45.2`
   bootstrapHashes = {
-    i686-unknown-linux-gnu = "5b2050dde23152750de89f7e59acaab6bf088d0beb5854c69c9a545fd254b936";
-    x86_64-unknown-linux-gnu = "860feed955726a4d96ffe40758a110053326b9ae11c9e1ee059e9c6222f25643";
-    arm-unknown-linux-gnueabihf = "ddb5f59bbdef84e0b7c83049461e003ed031dd881a4622365c3d475102535c60";
-    armv7-unknown-linux-gnueabihf = "7a556581f87602705f9c89b04cce621cfbba9050b6fbe478166e91d164567531";
-    aarch64-unknown-linux-gnu = "151fad66442d28a4e4786753d1afb559c4a3d359081c64769273a31c2f0f4d30";
-    x86_64-apple-darwin = "6e8067624ede10aa23081d62e0086c6f42f7228cc0d00fb5ff24d4dac65249d6";
+    i686-unknown-linux-gnu = "6ebd7e04dc18a36d08b9731cdb42d5caf8460e1eb41b75f3a8596c39f5e71206";
+    x86_64-unknown-linux-gnu = "e3b98bc3440fe92817881933f9564389eccb396f5f431f33d48b979fa2fbdcf5";
+    arm-unknown-linux-gnueabihf = "bb8af68565321f54608e918597083eb016ed0f9f4f3cc23f7cc5f467b934ce7f";
+    armv7-unknown-linux-gnueabihf = "7c0640879d7f2c38db60352e3c0f09e3fc6fa3bac6ca8f22cbccb1eb5e950121";
+    aarch64-unknown-linux-gnu = "f0c6d630f3dedb3db69d69ed9f833aa6b472363096f5164f1068c7001ca42aeb";
+    x86_64-apple-darwin = "82d61582a3772932432a99789c3b3bd4abe6baca339e355048ca9efb9ea5b4db";
   };
 
-  selectRustPackage = pkgs: pkgs.rust_1_46;
+  selectRustPackage = pkgs: pkgs.rust_1_47;
 
   rustcPatches = [
   ];
diff --git a/pkgs/development/compilers/rust/binary.nix b/pkgs/development/compilers/rust/binary.nix
index 9ae7e51e5fe..b84e390e0b0 100644
--- a/pkgs/development/compilers/rust/binary.nix
+++ b/pkgs/development/compilers/rust/binary.nix
@@ -1,4 +1,4 @@
-{ stdenv, makeWrapper, bash, curl, darwin
+{ stdenv, makeWrapper, bash, curl, darwin, zlib
 , version
 , src
 , platform
@@ -42,17 +42,23 @@ rec {
       ./install.sh --prefix=$out \
         --components=${installComponents}
 
-      ${optionalString (stdenv.isLinux && bootstrapping) ''
+      ${optionalString (stdenv.isLinux && bootstrapping) (''
         patchelf \
           --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
           "$out/bin/rustc"
+        '' + optionalString (stdenv.lib.versionAtLeast version "1.46")
+        # rustc bootstrap needs libz starting from 1.46
+        ''
+          ln -s ${zlib}/lib/libz.so.1 $out/lib/libz.so.1
+          ln -s ${zlib}/lib/libz.so $out/lib/libz.so
+        '' + ''
         patchelf \
           --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
           "$out/bin/rustdoc"
         patchelf \
           --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
           "$out/bin/cargo"
-      ''}
+      '')}
 
       # Do NOT, I repeat, DO NOT use `wrapProgram` on $out/bin/rustc
       # (or similar) here. It causes strange effects where rustc loads
diff --git a/pkgs/development/interpreters/ruby/rubygems/default.nix b/pkgs/development/interpreters/ruby/rubygems/default.nix
index 0bbcadba3f5..8263a987d63 100644
--- a/pkgs/development/interpreters/ruby/rubygems/default.nix
+++ b/pkgs/development/interpreters/ruby/rubygems/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "rubygems";
-  version = "3.1.2";
+  version = "3.1.3";
 
   src = fetchurl {
     url = "https://rubygems.org/rubygems/rubygems-${version}.tgz";
-    sha256 = "0h7ij4jpj8rgnpkl63cwh2lnav73pw5wpfqra3va7077lsyadlgd";
+    sha256 = "181wjclxnq5lrwnr53famy9pg8911hi9w2v0vy7dqgjqnc4iy1hp";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/enchant/2.x.nix b/pkgs/development/libraries/enchant/2.x.nix
index b7b86de92c0..cbc3f217326 100644
--- a/pkgs/development/libraries/enchant/2.x.nix
+++ b/pkgs/development/libraries/enchant/2.x.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "enchant";
-  version = "2.2.11";
+  version = "2.2.12";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://github.com/AbiWord/${pname}/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "opxXd8TkX8rCWVwVxJ1tKqQ0+l58mT3/P582e2X+Ryo=";
+    sha256 = "0zi20s62gax9rkhwj318kqrxa62pmks6dsdd6m9pzvhlwy5cb6vb";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/expat/default.nix b/pkgs/development/libraries/expat/default.nix
index a356d7be1a9..29d2c2b3acb 100644
--- a/pkgs/development/libraries/expat/default.nix
+++ b/pkgs/development/libraries/expat/default.nix
@@ -1,16 +1,18 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchurl, lib }:
 
 # Note: this package is used for bootstrapping fetchurl, and thus
 # cannot use fetchpatch! All mutable patches (generated by GitHub or
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.
 
-stdenv.mkDerivation rec {
-  name = "expat-2.2.8";
+let
+  version = "2.2.10";
+in stdenv.mkDerivation rec {
+  name = "expat-${version}";
 
   src = fetchurl {
-    url = "https://github.com/libexpat/libexpat/releases/download/R_2_2_8/${name}.tar.xz";
-    sha256 = "16vpj5mk3lps3x7fr8cs03rffx3ir4jilyqw0frayn6q94daijk1";
+    url = "https://github.com/libexpat/libexpat/releases/download/R_${lib.replaceStrings ["."] ["_"] version}/${name}.tar.xz";
+    sha256 = "sha256-Xf5Tj4tbY/A+mO2sUg19mmpNIuSC5cltTQb8xUhcJfI=";
   };
 
   outputs = [ "out" "dev" ]; # TODO: fix referrers
diff --git a/pkgs/development/libraries/freetype/default.nix b/pkgs/development/libraries/freetype/default.nix
index 24757af09e3..b87e64c2afb 100644
--- a/pkgs/development/libraries/freetype/default.nix
+++ b/pkgs/development/libraries/freetype/default.nix
@@ -14,7 +14,7 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "freetype";
-  version = "2.10.2";
+  version = "2.10.4";
 
   meta = with stdenv.lib; {
     description = "A font rendering engine";
@@ -33,7 +33,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://savannah/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "12rd181yzz6952cyjqaa4253f5szam93cmhw18p33rnj4l8dchqm";
+    sha256 = "112pyy215chg7f7fmp2l9374chhhpihbh8wgpj5nj6avj3c59a46";
   };
 
   propagatedBuildInputs = [ zlib bzip2 libpng ]; # needed when linking against freetype
diff --git a/pkgs/development/libraries/gamin/abstract-socket-namespace.patch b/pkgs/development/libraries/gamin/abstract-socket-namespace.patch
new file mode 100644
index 00000000000..ff161055972
--- /dev/null
+++ b/pkgs/development/libraries/gamin/abstract-socket-namespace.patch
@@ -0,0 +1,73 @@
+From 737452159d521aef2041a2767f3ebf9f68f4b6a9 Mon Sep 17 00:00:00 2001
+From: Christian Kampka <christian@kampka.net>
+Date: Tue, 1 Sep 2020 13:54:35 +0200
+Subject: [PATCH] Pin abstract namespace sockets to host_os
+
+Running programs with AC_RUN_IFELSE fails when cross-compiling.
+Since abstract namespace sockets are linux feature, we can easily
+assume it is available for linux and not for darwin.
+---
+ configure.in | 47 ++++++-----------------------------------------
+ 1 file changed, 6 insertions(+), 41 deletions(-)
+
+diff --git a/configure.in b/configure.in
+index eb129db..0ed82ba 100644
+--- a/configure.in
++++ b/configure.in
+@@ -387,47 +387,12 @@ fi
+ 
+ #### Abstract sockets
+ 
+-AC_MSG_CHECKING(abstract socket namespace)
+-AC_LANG_PUSH(C)
+-AC_RUN_IFELSE([AC_LANG_PROGRAM(
+-[[
+-#include <sys/types.h>
+-#include <stdlib.h>
+-#include <string.h>
+-#include <stdio.h>
+-#include <sys/socket.h>
+-#include <sys/un.h>
+-#include <errno.h>
+-]],
+-[[
+-  int listen_fd;
+-  struct sockaddr_un addr;
+-  
+-  listen_fd = socket (PF_UNIX, SOCK_STREAM, 0);
+-  
+-  if (listen_fd < 0)
+-    {
+-      fprintf (stderr, "socket() failed: %s\n", strerror (errno));
+-      exit (1);
+-    }
+-
+-  memset (&addr, '\0', sizeof (addr));
+-  addr.sun_family = AF_UNIX;
+-  strcpy (addr.sun_path, "X/tmp/dbus-fake-socket-path-used-in-configure-test");
+-  addr.sun_path[0] = '\0'; /* this is what makes it abstract */
+-  
+-  if (bind (listen_fd, (struct sockaddr*) &addr, SUN_LEN (&addr)) < 0)
+-    {
+-       fprintf (stderr, "Abstract socket namespace bind() failed: %s\n", 
+-                strerror (errno));
+-       exit (1);
+-    }
+-  else 
+-    exit (0);
+-]])],
+-              [have_abstract_sockets=yes],
+-              [have_abstract_sockets=no])
+-AC_LANG_POP(C)
++AC_MSG_CHECKING([whether target os has abstract socket namespace])
++if test x$target_os = xlinux-gnu ; then
++    have_abstract_sockets=yes
++else
++    have_abstract_sockets=no
++fi	
+ AC_MSG_RESULT($have_abstract_sockets)
+ 
+ if test x$enable_abstract_sockets = xyes; then
+-- 
+2.25.4
+
diff --git a/pkgs/development/libraries/gamin/default.nix b/pkgs/development/libraries/gamin/default.nix
index 38451571d8b..89096c88745 100644
--- a/pkgs/development/libraries/gamin/default.nix
+++ b/pkgs/development/libraries/gamin/default.nix
@@ -1,6 +1,8 @@
-{ stdenv, fetchurl, fetchpatch, pkgconfig, glib }:
+{ stdenv, fetchurl, fetchpatch, pkgconfig, glib, autoreconfHook }:
 
-stdenv.mkDerivation (rec {
+let
+  cross = stdenv.hostPlatform != stdenv.buildPlatform;
+in stdenv.mkDerivation (rec {
   name = "gamin-0.1.10";
 
   src = fetchurl {
@@ -8,7 +10,7 @@ stdenv.mkDerivation (rec {
     sha256 = "18cr51y5qacvs2fc2p1bqv32rs8bzgs6l67zhasyl45yx055y218";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig autoreconfHook ];
 
   buildInputs = [ glib ];
 
@@ -27,7 +29,7 @@ stdenv.mkDerivation (rec {
       name = "fix-pthread-mutex.patch";
       url = "https://git.alpinelinux.org/aports/plain/main/gamin/fix-pthread-mutex.patch?h=3.4-stable&id=a1a836b089573752c1b0da7d144c0948b04e8ea8";
       sha256 = "13igdbqsxb3sz0h417k6ifmq2n4siwqspj6slhc7fdl5wd1fxmdz";
-    });
+    }) ++ stdenv.lib.optional (cross) ./abstract-socket-namespace.patch ;
 
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/harfbuzz/default.nix b/pkgs/development/libraries/harfbuzz/default.nix
index 8110f13d14c..6c5703f521d 100644
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@@ -11,7 +11,7 @@
 }:
 
 let
-  version = "2.7.1";
+  version = "2.7.2";
   inherit (stdenv.lib) optional optionals optionalString;
   mesonFeatureFlag = opt: b:
     "-D${opt}=${if b then "enabled" else "disabled"}";
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
     owner  = "harfbuzz";
     repo   = "harfbuzz";
     rev    = version;
-    sha256 = "172jmwp666xbs6yy1pc2495gnkz8xw11b8zkz3j19jxlvvp4mxcs";
+    sha256 = "0vfyxr3lvzp80j1347nrwpr1ndv265p15rj2q8rj31lb26nyz4dm";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/libinput/default.nix b/pkgs/development/libraries/libinput/default.nix
index 576a2fec921..3a651087510 100644
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, meson, ninja
+{ stdenv, fetchFromGitLab, pkgconfig, meson, ninja
 , libevdev, mtdev, udev, libwacom
 , documentationSupport ? false, doxygen ? null, graphviz ? null # Documentation
 , eventGUISupport ? false, cairo ? null, glib ? null, gtk3 ? null # GUI event viewer support
@@ -27,11 +27,14 @@ in
 with stdenv.lib;
 stdenv.mkDerivation rec {
   pname = "libinput";
-  version = "1.16.1";
-
-  src = fetchurl {
-    url = "https://www.freedesktop.org/software/libinput/${pname}-${version}.tar.xz";
-    sha256 = "e6fRru3RUWi7IdF+nmKKocJ5V5Y6Qjo/6jk4pQF1hTk=";
+  version = "1.16.2";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = pname;
+    repo = pname;
+    rev = version;
+    sha256 = "0qii6yh3dlhgv9z970cpzbz19ii8zjvq4k7pg75sy2gmia7smwd1";
   };
 
   outputs = [ "bin" "out" "dev" ];
@@ -80,7 +83,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Handles input devices in Wayland compositors and provides a generic X.Org input driver";
-    homepage    = "http://www.freedesktop.org/wiki/Software/libinput";
+    homepage    = "https://www.freedesktop.org/wiki/Software/libinput/";
     license     = licenses.mit;
     platforms   = platforms.unix;
     maintainers = with maintainers; [ codyopel ];
diff --git a/pkgs/development/libraries/libvpx/CVE-2019-9232.CVE-2019-9325.CVE-2019-9371.CVE-2019-9433.patch b/pkgs/development/libraries/libvpx/CVE-2019-9232.CVE-2019-9325.CVE-2019-9371.CVE-2019-9433.patch
deleted file mode 100644
index 552c4e08d5f..00000000000
--- a/pkgs/development/libraries/libvpx/CVE-2019-9232.CVE-2019-9325.CVE-2019-9371.CVE-2019-9433.patch
+++ /dev/null
@@ -1,211 +0,0 @@
-Backports of
-
-From 46e17f0cb4a80b36755c84b8bf15731d3386c08f Mon Sep 17 00:00:00 2001
-From: kyslov <kyslov@google.com>
-Date: Fri, 4 Jan 2019 17:04:09 -0800
-Subject: [PATCH] Fix OOB memory access on fuzzed data
-
-From 0681cff1ad36b3ef8ec242f59b5a6c4234ccfb88 Mon Sep 17 00:00:00 2001
-From: James Zern <jzern@google.com>
-Date: Tue, 24 Jul 2018 21:36:50 -0700
-Subject: [PATCH] vp9: fix OOB read in decoder_peek_si_internal
-
-From f00890eecdf8365ea125ac16769a83aa6b68792d Mon Sep 17 00:00:00 2001
-From: James Zern <jzern@google.com>
-Date: Tue, 11 Dec 2018 18:06:20 -0800
-Subject: [PATCH] update libwebm to libwebm-1.0.0.27-352-g6ab9fcf
-
-From 34d54b04e98dd0bac32e9aab0fbda0bf501bc742 Mon Sep 17 00:00:00 2001
-From: James Zern <jzern@google.com>
-Date: Tue, 9 Apr 2019 18:37:44 -0700
-Subject: [PATCH] update libwebm to libwebm-1.0.0.27-358-gdbf1d10
-
-From 52add5896661d186dec284ed646a4b33b607d2c7 Mon Sep 17 00:00:00 2001
-From: Jerome Jiang <jianj@google.com>
-Date: Wed, 23 May 2018 15:43:00 -0700
-Subject: [PATCH] VP8: Fix use-after-free in postproc.
-
-to address CVE-2019-9232 CVE-2019-9325 CVE-2019-9371 CVE-2019-9433
-
---- libvpx-1.7.0.orig/test/decode_api_test.cc
-+++ libvpx-1.7.0/test/decode_api_test.cc
-@@ -138,8 +138,30 @@ TEST(DecodeAPI, Vp9InvalidDecode) {
-   EXPECT_EQ(VPX_CODEC_OK, vpx_codec_destroy(&dec));
- }
- 
--TEST(DecodeAPI, Vp9PeekSI) {
-+void TestPeekInfo(const uint8_t *const data, uint32_t data_sz,
-+                  uint32_t peek_size) {
-   const vpx_codec_iface_t *const codec = &vpx_codec_vp9_dx_algo;
-+  // Verify behavior of vpx_codec_decode. vpx_codec_decode doesn't even get
-+  // to decoder_peek_si_internal on frames of size < 8.
-+  if (data_sz >= 8) {
-+    vpx_codec_ctx_t dec;
-+    EXPECT_EQ(VPX_CODEC_OK, vpx_codec_dec_init(&dec, codec, NULL, 0));
-+    EXPECT_EQ((data_sz < peek_size) ? VPX_CODEC_UNSUP_BITSTREAM
-+                                    : VPX_CODEC_CORRUPT_FRAME,
-+              vpx_codec_decode(&dec, data, data_sz, NULL, 0));
-+    vpx_codec_iter_t iter = NULL;
-+    EXPECT_EQ(NULL, vpx_codec_get_frame(&dec, &iter));
-+    EXPECT_EQ(VPX_CODEC_OK, vpx_codec_destroy(&dec));
-+  }
-+
-+  // Verify behavior of vpx_codec_peek_stream_info.
-+  vpx_codec_stream_info_t si;
-+  si.sz = sizeof(si);
-+  EXPECT_EQ((data_sz < peek_size) ? VPX_CODEC_UNSUP_BITSTREAM : VPX_CODEC_OK,
-+            vpx_codec_peek_stream_info(codec, data, data_sz, &si));
-+}
-+
-+TEST(DecodeAPI, Vp9PeekStreamInfo) {
-   // The first 9 bytes are valid and the rest of the bytes are made up. Until
-   // size 10, this should return VPX_CODEC_UNSUP_BITSTREAM and after that it
-   // should return VPX_CODEC_CORRUPT_FRAME.
-@@ -150,24 +172,18 @@ TEST(DecodeAPI, Vp9PeekSI) {
-   };
- 
-   for (uint32_t data_sz = 1; data_sz <= 32; ++data_sz) {
--    // Verify behavior of vpx_codec_decode. vpx_codec_decode doesn't even get
--    // to decoder_peek_si_internal on frames of size < 8.
--    if (data_sz >= 8) {
--      vpx_codec_ctx_t dec;
--      EXPECT_EQ(VPX_CODEC_OK, vpx_codec_dec_init(&dec, codec, NULL, 0));
--      EXPECT_EQ(
--          (data_sz < 10) ? VPX_CODEC_UNSUP_BITSTREAM : VPX_CODEC_CORRUPT_FRAME,
--          vpx_codec_decode(&dec, data, data_sz, NULL, 0));
--      vpx_codec_iter_t iter = NULL;
--      EXPECT_EQ(NULL, vpx_codec_get_frame(&dec, &iter));
--      EXPECT_EQ(VPX_CODEC_OK, vpx_codec_destroy(&dec));
--    }
--
--    // Verify behavior of vpx_codec_peek_stream_info.
--    vpx_codec_stream_info_t si;
--    si.sz = sizeof(si);
--    EXPECT_EQ((data_sz < 10) ? VPX_CODEC_UNSUP_BITSTREAM : VPX_CODEC_OK,
--              vpx_codec_peek_stream_info(codec, data, data_sz, &si));
-+    TestPeekInfo(data, data_sz, 10);
-+  }
-+}
-+
-+TEST(DecodeAPI, Vp9PeekStreamInfoTruncated) {
-+  // This profile 1 header requires 10.25 bytes, ensure
-+  // vpx_codec_peek_stream_info doesn't over read.
-+  const uint8_t profile1_data[10] = { 0xa4, 0xe9, 0x30, 0x68, 0x53,
-+                                      0xe9, 0x30, 0x68, 0x53, 0x04 };
-+
-+  for (uint32_t data_sz = 1; data_sz <= 10; ++data_sz) {
-+    TestPeekInfo(profile1_data, data_sz, 11);
-   }
- }
- #endif  // CONFIG_VP9_DECODER
---- libvpx-1.7.0.orig/third_party/libwebm/mkvparser/mkvparser.cc
-+++ libvpx-1.7.0/third_party/libwebm/mkvparser/mkvparser.cc
-@@ -5307,8 +5307,8 @@ long VideoTrack::Parse(Segment* pSegment
- 
-   const long long stop = pos + s.size;
- 
--  Colour* colour = NULL;
--  Projection* projection = NULL;
-+  std::unique_ptr<Colour> colour_ptr;
-+  std::unique_ptr<Projection> projection_ptr;
- 
-   while (pos < stop) {
-     long long id, size;
-@@ -5357,11 +5357,19 @@ long VideoTrack::Parse(Segment* pSegment
-       if (rate <= 0)
-         return E_FILE_FORMAT_INVALID;
-     } else if (id == libwebm::kMkvColour) {
--      if (!Colour::Parse(pReader, pos, size, &colour))
-+      Colour* colour = NULL;
-+      if (!Colour::Parse(pReader, pos, size, &colour)) {
-         return E_FILE_FORMAT_INVALID;
-+      } else {
-+        colour_ptr.reset(colour);
-+      }
-     } else if (id == libwebm::kMkvProjection) {
--      if (!Projection::Parse(pReader, pos, size, &projection))
-+      Projection* projection = NULL;
-+      if (!Projection::Parse(pReader, pos, size, &projection)) {
-         return E_FILE_FORMAT_INVALID;
-+      } else {
-+        projection_ptr.reset(projection);
-+      }
-     }
- 
-     pos += size;  // consume payload
-@@ -5392,8 +5400,8 @@ long VideoTrack::Parse(Segment* pSegment
-   pTrack->m_display_unit = display_unit;
-   pTrack->m_stereo_mode = stereo_mode;
-   pTrack->m_rate = rate;
--  pTrack->m_colour = colour;
--  pTrack->m_projection = projection;
-+  pTrack->m_colour = colour_ptr.release();
-+  pTrack->m_projection = projection_ptr.release();
- 
-   pResult = pTrack;
-   return 0;  // success
---- libvpx-1.7.0.orig/vp8/common/postproc.c
-+++ libvpx-1.7.0/vp8/common/postproc.c
-@@ -65,7 +65,7 @@ void vp8_deblock(VP8_COMMON *cm, YV12_BU
-   double level = 6.0e-05 * q * q * q - .0067 * q * q + .306 * q + .0065;
-   int ppl = (int)(level + .5);
- 
--  const MODE_INFO *mode_info_context = cm->show_frame_mi;
-+  const MODE_INFO *mode_info_context = cm->mi;
-   int mbr, mbc;
- 
-   /* The pixel thresholds are adjusted according to if or not the macroblock
---- libvpx-1.7.0.orig/vp8/decoder/dboolhuff.h
-+++ libvpx-1.7.0/vp8/decoder/dboolhuff.h
-@@ -76,7 +76,7 @@ static int vp8dx_decode_bool(BOOL_DECODE
-   }
- 
-   {
--    register int shift = vp8_norm[range];
-+    const unsigned char shift = vp8_norm[(unsigned char)range];
-     range <<= shift;
-     value <<= shift;
-     count -= shift;
---- libvpx-1.7.0.orig/vp9/vp9_dx_iface.c
-+++ libvpx-1.7.0/vp9/vp9_dx_iface.c
-@@ -97,7 +97,7 @@ static vpx_codec_err_t decoder_peek_si_i
-     const uint8_t *data, unsigned int data_sz, vpx_codec_stream_info_t *si,
-     int *is_intra_only, vpx_decrypt_cb decrypt_cb, void *decrypt_state) {
-   int intra_only_flag = 0;
--  uint8_t clear_buffer[10];
-+  uint8_t clear_buffer[11];
- 
-   if (data + data_sz <= data) return VPX_CODEC_INVALID_PARAM;
- 
-@@ -158,6 +158,9 @@ static vpx_codec_err_t decoder_peek_si_i
-         if (profile > PROFILE_0) {
-           if (!parse_bitdepth_colorspace_sampling(profile, &rb))
-             return VPX_CODEC_UNSUP_BITSTREAM;
-+          // The colorspace info may cause vp9_read_frame_size() to need 11
-+          // bytes.
-+          if (data_sz < 11) return VPX_CODEC_UNSUP_BITSTREAM;
-         }
-         rb.bit_offset += REF_FRAMES;  // refresh_frame_flags
-         vp9_read_frame_size(&rb, (int *)&si->w, (int *)&si->h);
---- libvpx-1.7.0.orig/vpx_dsp/bitreader.h
-+++ libvpx-1.7.0/vpx_dsp/bitreader.h
-@@ -94,7 +94,7 @@ static INLINE int vpx_read(vpx_reader *r
-   }
- 
-   {
--    register int shift = vpx_norm[range];
-+    const unsigned char shift = vpx_norm[(unsigned char)range];
-     range <<= shift;
-     value <<= shift;
-     count -= shift;
---- libvpx-1.7.0.orig/vpx_dsp/bitreader_buffer.c
-+++ libvpx-1.7.0/vpx_dsp/bitreader_buffer.c
-@@ -23,7 +23,7 @@ int vpx_rb_read_bit(struct vpx_read_bit_
-     rb->bit_offset = off + 1;
-     return bit;
-   } else {
--    rb->error_handler(rb->error_handler_data);
-+    if (rb->error_handler != NULL) rb->error_handler(rb->error_handler_data);
-     return 0;
-   }
- }
diff --git a/pkgs/development/libraries/libvpx/default.nix b/pkgs/development/libraries/libvpx/default.nix
index 007df403ff7..83e60466c14 100644
--- a/pkgs/development/libraries/libvpx/default.nix
+++ b/pkgs/development/libraries/libvpx/default.nix
@@ -56,20 +56,16 @@ assert isCygwin -> unitTestsSupport && webmIOSupport && libyuvSupport;
 
 stdenv.mkDerivation rec {
   pname = "libvpx";
-  version = "1.7.0";
+  version = "1.9.0";
 
   src = fetchFromGitHub {
     owner = "webmproject";
-    repo = "libvpx";
+    repo = pname;
     rev = "v${version}";
-    sha256 = "0vvh89hvp8qg9an9vcmwb7d9k3nixhxaz6zi65qdjnd0i56kkcz6";
+    sha256 = "16xv6ambc82g14h1y0q1vyy57wp6j9fbp0nk0wd5csnrw407rhry";
   };
 
-  patches = [
-    ./CVE-2019-9232.CVE-2019-9325.CVE-2019-9371.CVE-2019-9433.patch
-  ];
-
-  postPatch = ''patchShebangs .'';
+  postPatch = "patchShebangs .";
 
   outputs = [ "bin" "dev" "out" ];
   setOutputFlags = false;
@@ -135,6 +131,12 @@ stdenv.mkDerivation rec {
                     experimentalFpMbStatsSupport ||
                     experimentalEmulateHardwareSupport) "experimental")
   ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    #"--extra-cflags="
+    #"--extra-cxxflags="
+    #"--prefix="
+    #"--libc="
+    #"--libdir="
+    "--enable-external-build"
     # libvpx darwin targets include darwin version (ie. ARCH-darwinXX-gcc, XX being the darwin version)
     # See all_platforms: https://github.com/webmproject/libvpx/blob/master/configure
     # Darwin versions: 10.4=8, 10.5=9, 10.6=10, 10.7=11, 10.8=12, 10.9=13, 10.10=14
@@ -159,6 +161,10 @@ stdenv.mkDerivation rec {
   buildInputs = [ ]
     ++ optionals unitTestsSupport [ coreutils curl ];
 
+  NIX_LDFLAGS = [
+    "-lpthread" # fixes linker errors
+  ];
+
   enableParallelBuilding = true;
 
   postInstall = ''moveToOutput bin "$bin" '';
diff --git a/pkgs/development/libraries/libwebp/default.nix b/pkgs/development/libraries/libwebp/default.nix
index d2a98c4a847..6d24ba7f2ed 100644
--- a/pkgs/development/libraries/libwebp/default.nix
+++ b/pkgs/development/libraries/libwebp/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl
+{ stdenv, fetchFromGitHub, autoreconfHook, libtool
 , threadingSupport ? true # multi-threading
 , openglSupport ? false, freeglut ? null, libGL ? null, libGLU ? null # OpenGL (required for vwebp)
 , pngSupport ? true, libpng ? null # PNG image format
@@ -27,13 +27,17 @@ in
 with stdenv.lib;
 stdenv.mkDerivation rec {
   pname = "libwebp";
-  version = "1.0.3";
+  version = "1.1.0";
 
-  src = fetchurl {
-    url = "http://downloads.webmproject.org/releases/webp/${pname}-${version}.tar.gz";
-    sha256 = "0kxk4sic34bln3k09mml7crvrmhj97swdk7b1ahbp5w6bj30f2p2";
+  src = fetchFromGitHub {
+    owner  = "webmproject";
+    repo   = pname;
+    rev    = version;
+    sha256 = "1kl6qqa29ygqb2fpv140y59v539gdqx4vcf3mlaxhca2bks98qgm";
   };
 
+  prePatch = "patchShebangs .";
+
   configureFlags = [
     (mkFlag threadingSupport "threading")
     (mkFlag openglSupport "gl")
@@ -50,6 +54,7 @@ stdenv.mkDerivation rec {
     (mkFlag libwebpdecoderSupport "libwebpdecoder")
   ];
 
+  nativeBuildInputs = [ autoreconfHook libtool ];
   buildInputs = [ ]
     ++ optionals openglSupport [ freeglut libGL libGLU ]
     ++ optional pngSupport libpng
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index aeeb0514fab..aa180b94d74 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -8,7 +8,7 @@
 , galliumDrivers ? ["auto"]
 , driDrivers ? ["auto"]
 , vulkanDrivers ? ["auto"]
-, eglPlatforms ? [ "x11" "surfaceless" ] ++ lib.optionals stdenv.isLinux [ "wayland" "drm" ]
+, eglPlatforms ? [ "x11" ] ++ lib.optionals stdenv.isLinux [ "wayland" ]
 , OpenGL, Xplugin
 , withValgrind ? stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isAarch32, valgrind-light
 , enableGalliumNine ? stdenv.isLinux
@@ -31,7 +31,7 @@ with stdenv.lib;
 let
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "20.1.9";
+  version = "20.2.1";
   branch  = versions.major version;
 in
 
@@ -46,7 +46,7 @@ stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
     ];
-    sha256 = "10kk8a8k7f4ip8yaiqdyrx162nbw8pw4h3b4hs4ha8mpd43wlldj";
+    sha256 = "0ji4s1gwcvx3fbj9h0x5zbma6kw4b75vs0266zhc06r97yd6v96i";
   };
 
   prePatch = "patchShebangs .";
@@ -58,7 +58,6 @@ stdenv.mkDerivation {
     ./missing-includes.patch # dev_t needs sys/stat.h, time_t needs time.h, etc.-- fixes build w/musl
     ./opencl-install-dir.patch
     ./disk_cache-include-dri-driver-path-in-cache-key.patch
-    ./link-radv-with-ld_args_build_id.patch
   ]
     ++ lib.optionals stdenv.hostPlatform.isMusl [
       # Fix `-Werror=int-conversion` pthread warnings on musl.
diff --git a/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch b/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch
index acf3d827c56..fa78f4ae730 100644
--- a/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch
+++ b/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch
@@ -1,4 +1,4 @@
-From 46b10f2bc28fd79d561c8c49bbae3aee6a4cf0e6 Mon Sep 17 00:00:00 2001
+From 980164fd92f5c2302624cd046d30ff21e6e4ba8a Mon Sep 17 00:00:00 2001
 From: David McFarland <corngood@gmail.com>
 Date: Mon, 6 Aug 2018 15:52:11 -0300
 Subject: [PATCH] disk_cache: include dri driver path in cache key
@@ -12,10 +12,10 @@ timestamps in /nix/store are zero.
  3 files changed, 15 insertions(+), 1 deletion(-)
 
 diff --git a/meson_options.txt b/meson_options.txt
-index 1a2dd8ebd12..2ac741af5a6 100644
+index 2d39d13b6ad..daf06480a60 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
-@@ -348,6 +348,12 @@ option(
+@@ -368,6 +368,12 @@ option(
    value : true,
    description : 'Enable direct rendering in GLX and EGL for DRI',
  )
@@ -26,13 +26,13 @@ index 1a2dd8ebd12..2ac741af5a6 100644
 +  description : 'Mesa cache key.'
 +)
  option(
-   'I-love-half-baked-turnips',
+   'prefer-iris',
    type : 'boolean',
 diff --git a/src/util/disk_cache.c b/src/util/disk_cache.c
-index d1f14736725..2ed328f292e 100644
+index a92d621927a..3bd65c6890c 100644
 --- a/src/util/disk_cache.c
 +++ b/src/util/disk_cache.c
-@@ -402,8 +402,10 @@ disk_cache_create(const char *gpu_name, const char *driver_id,
+@@ -401,8 +401,10 @@ disk_cache_create(const char *gpu_name, const char *driver_id,
  
     /* Create driver id keys */
     size_t id_size = strlen(driver_id) + 1;
@@ -43,7 +43,7 @@ index d1f14736725..2ed328f292e 100644
     cache->driver_keys_blob_size += gpu_name_size;
  
     /* We sometimes store entire structs that contains a pointers in the cache,
-@@ -424,6 +426,7 @@ disk_cache_create(const char *gpu_name, const char *driver_id,
+@@ -423,6 +425,7 @@ disk_cache_create(const char *gpu_name, const char *driver_id,
     uint8_t *drv_key_blob = cache->driver_keys_blob;
     DRV_KEY_CPY(drv_key_blob, &cache_version, cv_size)
     DRV_KEY_CPY(drv_key_blob, driver_id, id_size)
@@ -52,22 +52,23 @@ index d1f14736725..2ed328f292e 100644
     DRV_KEY_CPY(drv_key_blob, &ptr_size, ptr_size_size)
     DRV_KEY_CPY(drv_key_blob, &driver_flags, driver_flags_size)
 diff --git a/src/util/meson.build b/src/util/meson.build
-index 9da29cc7390..5f549bb1d99 100644
+index 0893f64793b..d46ce85a85f 100644
 --- a/src/util/meson.build
 +++ b/src/util/meson.build
-@@ -170,7 +170,12 @@ _libmesa_util = static_library(
-   include_directories : inc_common,
+@@ -179,7 +179,12 @@ _libmesa_util = static_library(
+   include_directories : [inc_include, inc_src, inc_mapi, inc_mesa, inc_gallium, inc_gallium_aux],
    dependencies : deps_for_libmesa_util,
    link_with: libmesa_format,
--  c_args : [c_msvc_compat_args, c_vis_args],
+-  c_args : [c_msvc_compat_args],
 +  c_args : [
-+    c_msvc_compat_args, c_vis_args,
++    c_msvc_compat_args,
 +    '-DDISK_CACHE_KEY="@0@"'.format(
 +      get_option('disk-cache-key')
 +    ),
 +  ],
+   gnu_symbol_visibility : 'hidden',
    build_by_default : false
  )
- 
 -- 
-2.25.1
+2.28.0
+
diff --git a/pkgs/development/libraries/mesa/link-radv-with-ld_args_build_id.patch b/pkgs/development/libraries/mesa/link-radv-with-ld_args_build_id.patch
deleted file mode 100644
index 0a660332392..00000000000
--- a/pkgs/development/libraries/mesa/link-radv-with-ld_args_build_id.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From b49bcb6eece322b70fc2e8b0c8498f5a38ea7b82 Mon Sep 17 00:00:00 2001
-From: David McFarland <corngood@gmail.com>
-Date: Sun, 26 Jul 2020 17:29:49 -0300
-Subject: [PATCH] link radv with ld_args_build_id
-
-This is needed for radv_device_get_cache_uuid to work correctly.
----
- src/amd/vulkan/meson.build | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/amd/vulkan/meson.build b/src/amd/vulkan/meson.build
-index eec026e8f60..a07a0821938 100644
---- a/src/amd/vulkan/meson.build
-+++ b/src/amd/vulkan/meson.build
-@@ -183,7 +183,7 @@ libvulkan_radeon = shared_library(
-   ],
-   c_args : [c_vis_args, no_override_init_args, radv_flags],
-   cpp_args : [cpp_vis_args, radv_flags],
--  link_args : [ld_args_bsymbolic, ld_args_gc_sections, libvulkan_radeon_ld_args],
-+  link_args : [ld_args_build_id, ld_args_bsymbolic, ld_args_gc_sections, libvulkan_radeon_ld_args],
-   link_depends : [libvulkan_radeon_link_depends,],
-   install : true,
- )
---
-2.28.0
diff --git a/pkgs/development/libraries/mesa/missing-includes.patch b/pkgs/development/libraries/mesa/missing-includes.patch
index 9685a1619a5..72488893c6b 100644
--- a/pkgs/development/libraries/mesa/missing-includes.patch
+++ b/pkgs/development/libraries/mesa/missing-includes.patch
@@ -9,18 +9,6 @@
  #include "pipe/p_compiler.h"
  #include "pipe/p_state.h"
  
---- ./src/util/rand_xor.c.orig	2017-06-20 00:38:57.199474067 +0200
-+++ ./src/util/rand_xor.c	2017-06-20 00:40:31.351279557 +0200
-@@ -23,7 +23,9 @@
-  */
- 
- #if defined(__linux__)
-+#include <sys/types.h>
- #include <sys/file.h>
-+#include <sys/stat.h>
- #include <unistd.h>
- #include <fcntl.h>
- #else
 --- ./src/amd/vulkan/winsys/amdgpu/radv_amdgpu_winsys.h
 +++ ./src/amd/vulkan/winsys/amdgpu/radv_amdgpu_winsys.h
 @@ -28,6 +28,8 @@
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 1fc38dd8aaa..c4a9a4a0180 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -160,8 +160,8 @@ in {
   };
 
   openssl_1_1 = common {
-    version = "1.1.1g";
-    sha256 = "0ikdcc038i7jk8h7asq5xcn8b1xc2rrbc88yfm4hqbz3y5s4gc6x";
+    version = "1.1.1h";
+    sha256 = "1ncmcnh5bmxkwrvm0m1q4kdcjjfpwvlyjspjhibkxc6p9dvsi72w";
     patches = [
       ./1.1/nix-ssl-cert-file.patch
 
diff --git a/pkgs/development/libraries/p11-kit/default.nix b/pkgs/development/libraries/p11-kit/default.nix
index 46f520e41e4..31a7e7e9086 100644
--- a/pkgs/development/libraries/p11-kit/default.nix
+++ b/pkgs/development/libraries/p11-kit/default.nix
@@ -36,6 +36,13 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  # Tests run in fakeroot for non-root users
+  preCheck = ''
+    if [ "$(id -u)" != "0" ]; then
+      export FAKED_MODE=1
+    fi
+  '';
+
   doCheck = !stdenv.isDarwin;
 
   installFlags = [
diff --git a/pkgs/development/libraries/zeromq/4.x.nix b/pkgs/development/libraries/zeromq/4.x.nix
index 8302ebbd1e8..d5819ff7ee9 100644
--- a/pkgs/development/libraries/zeromq/4.x.nix
+++ b/pkgs/development/libraries/zeromq/4.x.nix
@@ -1,17 +1,19 @@
-{ stdenv, fetchFromGitHub, cmake, asciidoc, enableDrafts ? false }:
+{ stdenv, fetchFromGitHub, cmake, asciidoc, pkg-config, libsodium
+, enableDrafts ? false }:
 
 stdenv.mkDerivation rec {
   pname = "zeromq";
-  version = "4.3.2";
+  version = "4.3.3";
 
   src = fetchFromGitHub {
     owner = "zeromq";
     repo = "libzmq";
     rev = "v${version}";
-    sha256 = "1q37z05i76ili31j6jlw8988iy6vxadlmd306f99phxfdpqa6bn9";
+    sha256 = "155kb0ih0xj4jvd39bq8d04bgvhy9143r3632ks1m04455z4qdzd";
   };
 
-  nativeBuildInputs = [ cmake asciidoc ];
+  nativeBuildInputs = [ cmake asciidoc pkg-config ];
+  buildInputs = [ libsodium ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/python-modules/arrow/default.nix b/pkgs/development/python-modules/arrow/default.nix
index bc3de37526a..7dbe3b98fca 100644
--- a/pkgs/development/python-modules/arrow/default.nix
+++ b/pkgs/development/python-modules/arrow/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "arrow";
-  version = "0.15.8";
+  version = "0.17.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "edc31dc051db12c95da9bac0271cd1027b8e36912daf6d4580af53b23e62721a";
+    sha256 = "ff08d10cda1d36c68657d6ad20d74fbea493d980f8b2d45344e00d6ed2bf6ed4";
   };
 
   propagatedBuildInputs = [ python-dateutil ]
diff --git a/pkgs/development/python-modules/pycairo/default.nix b/pkgs/development/python-modules/pycairo/default.nix
index d61279e38d5..24e0f9792d7 100644
--- a/pkgs/development/python-modules/pycairo/default.nix
+++ b/pkgs/development/python-modules/pycairo/default.nix
@@ -1,4 +1,13 @@
-{ lib, fetchFromGitHub, meson, ninja, buildPythonPackage, pytest, pkgconfig, cairo, xlibsWrapper, isPy3k }:
+{ lib
+, fetchFromGitHub
+, meson
+, ninja
+, buildPythonPackage
+, pytestCheckHook
+, pkg-config
+, cairo
+, isPy3k
+}:
 
 buildPythonPackage rec {
   pname = "pycairo";
@@ -16,22 +25,25 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     meson
     ninja
-    pkgconfig
+    pkg-config
   ];
 
   buildInputs = [
     cairo
-    xlibsWrapper
   ];
 
-  checkInputs = [ pytest ];
+  checkInputs = [
+    pytestCheckHook
+  ];
 
-  mesonFlags = [ "-Dpython=${if isPy3k then "python3" else "python"}" ];
+  mesonFlags = [
+    "-Dpython=${if isPy3k then "python3" else "python"}"
+  ];
 
   meta = with lib; {
     description = "Python 2/3 bindings for cairo";
     homepage = "https://pycairo.readthedocs.io/";
-    license = with licenses; [ lgpl2 mpl11 ];
+    license = with licenses; [ lgpl21Only mpl11 ];
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
 }
diff --git a/pkgs/development/tools/build-managers/cmake/default.nix b/pkgs/development/tools/build-managers/cmake/default.nix
index 559a4c191b6..010f1d9c6c2 100644
--- a/pkgs/development/tools/build-managers/cmake/default.nix
+++ b/pkgs/development/tools/build-managers/cmake/default.nix
@@ -5,6 +5,7 @@
 , ps
 , isBootstrap ? false
 , useSharedLibraries ? (!isBootstrap && !stdenv.isCygwin)
+, useOpenSSL ? !isBootstrap, openssl
 , useNcurses ? false, ncurses
 , useQt4 ? false, qt4
 , withQt5 ? false, qtbase
@@ -44,15 +45,17 @@ stdenv.mkDerivation rec {
 
   setupHook = ./setup-hook.sh;
 
-  buildInputs =
-    [ setupHook pkgconfig ]
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+
+  nativeBuildInputs = [ setupHook pkgconfig ];
+
+  buildInputs = []
     ++ lib.optionals useSharedLibraries [ bzip2 curl expat libarchive xz zlib libuv rhash ]
+    ++ lib.optional useOpenSSL openssl
     ++ lib.optional useNcurses ncurses
     ++ lib.optional useQt4 qt4
     ++ lib.optional withQt5 qtbase;
 
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-
   propagatedBuildInputs = lib.optional stdenv.isDarwin ps;
 
   preConfigure = ''
@@ -91,13 +94,15 @@ stdenv.mkDerivation rec {
     "-DCMAKE_AR=${lib.getBin stdenv.cc.bintools.bintools}/bin/${stdenv.cc.targetPrefix}ar"
     "-DCMAKE_RANLIB=${lib.getBin stdenv.cc.bintools.bintools}/bin/${stdenv.cc.targetPrefix}ranlib"
     "-DCMAKE_STRIP=${lib.getBin stdenv.cc.bintools.bintools}/bin/${stdenv.cc.targetPrefix}strip"
-  ]
+
+    "-DCMAKE_USE_OPENSSL=${if useOpenSSL then "ON" else "OFF"}"
     # Avoid depending on frameworks.
-    ++ lib.optional (!useNcurses) "-DBUILD_CursesDialog=OFF";
+    "-DBUILD_CursesDialog=${if useNcurses then "ON" else "OFF"}"
+  ];
 
   # make install attempts to use the just-built cmake
   preInstall = lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) ''
-    sed -i 's|bin/cmake|${buildPackages.cmake}/bin/cmake|g' Makefile
+    sed -i 's|bin/cmake|${buildPackages.cmakeMinimal}/bin/cmake|g' Makefile
   '';
 
   dontUseCmakeConfigure = true;
diff --git a/pkgs/development/tools/build-managers/meson/boost-Do-not-add-system-paths-on-nix.patch b/pkgs/development/tools/build-managers/meson/boost-Do-not-add-system-paths-on-nix.patch
new file mode 100644
index 00000000000..5b9020b3d54
--- /dev/null
+++ b/pkgs/development/tools/build-managers/meson/boost-Do-not-add-system-paths-on-nix.patch
@@ -0,0 +1,40 @@
+From 536108b10271f2f42d41c7d9ddb4ce2ea1851f4f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Niklas=20Hamb=C3=BCchen?= <mail@nh2.me>
+Date: Sat, 17 Oct 2020 19:27:08 +0200
+Subject: [PATCH] boost: Do not add system paths on nix
+
+---
+ mesonbuild/dependencies/boost.py | 17 +----------------
+ 1 file changed, 1 insertion(+), 16 deletions(-)
+
+diff --git a/mesonbuild/dependencies/boost.py b/mesonbuild/dependencies/boost.py
+index 907c0c275..ecaf11b18 100644
+--- a/mesonbuild/dependencies/boost.py
++++ b/mesonbuild/dependencies/boost.py
+@@ -643,22 +643,7 @@ class BoostDependency(ExternalDependency):
+             roots += [x for x in candidates if x.name.lower().startswith('boost') and x.is_dir()]
+         else:
+             tmp = []  # type: T.List[Path]
+-
+-            # Homebrew
+-            brew_boost = Path('/usr/local/Cellar/boost')
+-            if brew_boost.is_dir():
+-                tmp += [x for x in brew_boost.iterdir()]
+-
+-            # Add some default system paths
+-            tmp += [Path('/opt/local')]
+-            tmp += [Path('/usr/local/opt/boost')]
+-            tmp += [Path('/usr/local')]
+-            tmp += [Path('/usr')]
+-
+-            # Cleanup paths
+-            tmp = [x for x in tmp if x.is_dir()]
+-            tmp = [x.resolve() for x in tmp]
+-            roots += tmp
++            # Do not add any non-explicit paths on nix
+ 
+         return roots
+ 
+-- 
+2.25.4
+
diff --git a/pkgs/development/tools/build-managers/meson/default.nix b/pkgs/development/tools/build-managers/meson/default.nix
index 8421fb7d70a..1b9c3ef6477 100644
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@@ -52,6 +52,11 @@ python3.pkgs.buildPythonApplication rec {
     # cut-in-half-by-\0 store path references.
     # Let’s just clear the whole rpath and hope for the best.
     ./clear-old-rpath.patch
+
+    # Patch out default boost search paths to avoid impure builds on
+    # unsandboxed non-NixOS builds, see:
+    # https://github.com/NixOS/nixpkgs/issues/86131#issuecomment-711051774
+    ./boost-Do-not-add-system-paths-on-nix.patch
   ];
 
   setupHook = ./setup-hook.sh;
diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix
index 0e10add5561..64fa92be865 100644
--- a/pkgs/os-specific/linux/apparmor/default.nix
+++ b/pkgs/os-specific/linux/apparmor/default.nix
@@ -14,7 +14,7 @@
 
 let
   apparmor-series = "2.13";
-  apparmor-patchver = "4";
+  apparmor-patchver = "5";
   apparmor-version = apparmor-series + "." + apparmor-patchver;
 
   apparmor-meta = component: with stdenv.lib; {
@@ -27,19 +27,10 @@ let
 
   apparmor-sources = fetchurl {
     url = "https://launchpad.net/apparmor/${apparmor-series}/${apparmor-version}/+download/apparmor-${apparmor-version}.tar.gz";
-    sha256 = "03nislxccnbxld89giak2s8xa4mdbwscfxbdwhmw5qpvgz08dgwh";
-  };
-
-  # See <https://gitlab.com/apparmor/apparmor/-/issues/74> This and the
-  # accompanying application in prePatchCommon should be removed in 2.13.5
-  gnumake43Patch = fetchpatch {
-    url = "https://gitlab.com/apparmor/apparmor/-/merge_requests/465.patch";
-    name = "2-23-fix-build-with-make-4.3.patch";
-    sha256 = "0xw028iqp69j9mxv0kbwraplgkj5i5djdlgf0anpkc5cdbsf96r9";
+    sha256 = "05x7r99k00r97v1cq2f711lv6yqzhbl8zp1i1c7kxra4v0a2lzk3";
   };
 
   prePatchCommon = ''
-    patch -p1 < ${gnumake43Patch}
     chmod a+x ./common/list_capabilities.sh ./common/list_af_names.sh
     patchShebangs ./common/list_capabilities.sh ./common/list_af_names.sh
     substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2man" "${buildPackages.perl}/bin/pod2man"
diff --git a/pkgs/os-specific/linux/iproute/default.nix b/pkgs/os-specific/linux/iproute/default.nix
index a9fcf455ee4..b3de7ceedaa 100644
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@@ -5,19 +5,19 @@
 
 stdenv.mkDerivation rec {
   pname = "iproute2";
-  version = "5.8.0";
+  version = "5.9.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0vk4vickrpahdhl3zazr2qn2bf99v5549ncirjpwiy4h0a4izkfg";
+    sha256 = "1kys6dmhrl43iaq95n5sh02p39d7bq8i5y672qrzgwnwpjaaqpd2";
   };
 
   preConfigure = ''
     # Don't try to create /var/lib/arpd:
     sed -e '/ARPDDIR/d' -i Makefile
-    # TODO: Drop temporary version fix for 5.8 (53159d81) once 5.9 is out:
+    # TODO: Drop temporary version fix for 5.9 once 5.10 is out:
     substituteInPlace include/version.h \
-      --replace "v5.7.0-77-gb687d1067169" "5.8.0"
+      --replace "5.8.0" "${version}"
   '';
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/os-specific/linux/libcap/default.nix b/pkgs/os-specific/linux/libcap/default.nix
index 174f1be99db..7931e35a844 100644
--- a/pkgs/os-specific/linux/libcap/default.nix
+++ b/pkgs/os-specific/linux/libcap/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libcap";
-  version = "2.27";
+  version = "2.44";
 
   src = fetchurl {
     url = "mirror://kernel/linux/libs/security/linux-privs/libcap2/${pname}-${version}.tar.xz";
-    sha256 = "0sj8kidl7qgf2qwxcbw1vadnlb30y4zvjzxswsmfdghq04npkhfs";
+    sha256 = "1qf80lifygbnxwvqjf8jz5j24n6fqqx4ixnkbf76xs2vrmcq664j";
   };
 
   outputs = [ "out" "dev" "lib" "man" "doc" "pam" ];
@@ -54,6 +54,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Library for working with POSIX capabilities";
+    homepage = "https://sites.google.com/site/fullycapable";
     platforms = stdenv.lib.platforms.linux;
     license = stdenv.lib.licenses.bsd3;
   };
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index cef9d96ae6e..da99280f63b 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -1,27 +1,61 @@
-{ stdenv, lib, fetchFromGitHub, pkgconfig, intltool, gperf, libcap
-, curl, kmod, gnupg, gnutar, xz, pam, acl, libuuid, m4, e2fsprogs, utillinux, libffi
-, glib, kbd, libxslt, coreutils, libgcrypt, libgpgerror, libidn2, libapparmor
-, audit, lz4, bzip2, pcre2
-, linuxHeaders ? stdenv.cc.libc.linuxHeaders
-, iptables, gnu-efi, bashInteractive
-, gettext, docbook_xsl, docbook_xml_dtd_42, docbook_xml_dtd_45
-, ninja, meson, python3Packages, glibcLocales
-, patchelf
-, substituteAll
-, getent
-, cryptsetup, lvm2
+{ stdenv, lib, fetchFromGitHub
 , buildPackages
-, perl
+, ninja, meson, m4, pkgconfig, coreutils, gperf, getent
+, patchelf, perl, glibcLocales, glib, substituteAll
+, gettext, python3Packages
+
+# Mandatory dependencies
+, libcap
+, utillinux
+, kbd
+, kmod
+
+# Optional dependencies
+, pam, cryptsetup, lvm2, audit, acl
+, lz4, libgcrypt, libgpgerror, libidn2
+, curl, gnutar, gnupg, zlib
+, xz, libuuid, libffi
+, libapparmor, intltool
+, bzip2, pcre2, e2fsprogs
+, linuxHeaders ? stdenv.cc.libc.linuxHeaders
+, gnu-efi
+, iptables
 , withSelinux ? false, libselinux
 , withLibseccomp ? lib.any (lib.meta.platformMatch stdenv.hostPlatform) libseccomp.meta.platforms, libseccomp
 , withKexectools ? lib.any (lib.meta.platformMatch stdenv.hostPlatform) kexectools.meta.platforms, kexectools
+, bashInteractive
+
+, withResolved ? true
+, withLogind ? true
+, withHostnamed ? true
+, withLocaled ? true
+, withNetworkd ? true
+, withTimedated ? true
+, withTimesyncd ? true
+, withHwdb ? true
+, withEfi ? stdenv.hostPlatform.isEfi
+, withImportd ? true
+, withCryptsetup ? true
+
+# name argument
+, pname ? "systemd"
+
+
+, libxslt, docbook_xsl, docbook_xml_dtd_42, docbook_xml_dtd_45
 }:
 
+assert withResolved -> (libgcrypt != null && libgpgerror != null);
+assert withImportd ->
+  ( curl.dev != null && zlib != null && xz != null && libgcrypt != null
+  && gnutar != null && gnupg != null);
+
+assert withCryptsetup ->
+  ( cryptsetup != null );
+
 let
   version = "246.6";
 in stdenv.mkDerivation {
-  inherit version;
-  pname = "systemd";
+  inherit version pname;
 
   # We use systemd/systemd-stable for src, and ship NixOS-specific patches inside nixpkgs directly
   # This has proven to be less error-prone than the previous systemd fork.
@@ -71,13 +105,17 @@ in stdenv.mkDerivation {
   outputs = [ "out" "man" "dev" ];
 
   nativeBuildInputs =
-    [ pkgconfig intltool gperf libxslt gettext docbook_xsl docbook_xml_dtd_42 docbook_xml_dtd_45
+    [ pkgconfig gperf
       ninja meson
       coreutils # meson calls date, stat etc.
       glibcLocales
       patchelf getent m4
       perl # to patch the libsystemd.so and remove dependencies on aarch64
 
+      intltool
+      gettext
+
+      libxslt docbook_xsl docbook_xml_dtd_42 docbook_xml_dtd_45
       (buildPackages.python3Packages.python.withPackages ( ps: with ps; [ python3Packages.lxml ]))
     ];
   buildInputs =
@@ -86,9 +124,10 @@ in stdenv.mkDerivation {
       pcre2 ] ++
       stdenv.lib.optional withKexectools kexectools ++
       stdenv.lib.optional withLibseccomp libseccomp ++
-    [ libffi audit lz4 bzip2 libapparmor
-      iptables gnu-efi
-    ] ++ stdenv.lib.optional withSelinux libselinux;
+      [ libffi audit lz4 bzip2 libapparmor iptables ] ++
+      stdenv.lib.optional withEfi gnu-efi ++
+      stdenv.lib.optional withSelinux libselinux ++
+      stdenv.lib.optional withCryptsetup cryptsetup.dev;
 
   #dontAddPrefix = true;
 
@@ -106,19 +145,23 @@ in stdenv.mkDerivation {
     "-Ddebug-shell=${bashInteractive}/bin/bash"
     # while we do not run tests we should also not build them. Removes about 600 targets
     "-Dtests=false"
-    "-Dimportd=true"
+    "-Dimportd=${stdenv.lib.boolToString withImportd}"
     "-Dlz4=true"
     "-Dhomed=false"
-    "-Dhostnamed=true"
-    "-Dnetworkd=true"
+    "-Dlogind=${stdenv.lib.boolToString withLogind}"
+    "-Dlocaled=${stdenv.lib.boolToString withLocaled}"
+    "-Dhostnamed=${stdenv.lib.boolToString withHostnamed}"
+    "-Dnetworkd=${stdenv.lib.boolToString withNetworkd}"
+    "-Dcryptsetup=${stdenv.lib.boolToString withCryptsetup}"
     "-Dportabled=false"
+    "-Dhwdb=${stdenv.lib.boolToString withHwdb}"
     "-Dremote=false"
     "-Dsysusers=false"
-    "-Dtimedated=true"
-    "-Dtimesyncd=true"
+    "-Dtimedated=${stdenv.lib.boolToString withTimedated}"
+    "-Dtimesyncd=${stdenv.lib.boolToString withTimesyncd}"
     "-Dfirstboot=false"
     "-Dlocaled=true"
-    "-Dresolve=true"
+    "-Dresolve=${stdenv.lib.boolToString withResolved}"
     "-Dsplit-usr=false"
     "-Dlibcurl=true"
     "-Dlibidn=false"
@@ -141,11 +184,6 @@ in stdenv.mkDerivation {
     "-Dsystem-gid-max=999"
     # "-Dtime-epoch=1"
 
-    (if !stdenv.hostPlatform.isEfi then "-Dgnu-efi=false" else "-Dgnu-efi=true")
-    "-Defi-libdir=${toString gnu-efi}/lib"
-    "-Defi-includedir=${toString gnu-efi}/include/efi"
-    "-Defi-ldsdir=${toString gnu-efi}/lib"
-
     "-Dsysvinit-path="
     "-Dsysvrcnd-path="
 
@@ -161,6 +199,12 @@ in stdenv.mkDerivation {
     # Upstream defaulted to disable manpages since they optimize for the much
     # more frequent development builds
     "-Dman=true"
+
+    "-Dgnu-efi=${stdenv.lib.boolToString (withEfi && gnu-efi != null)}"
+  ] ++ stdenv.lib.optionals (withEfi && gnu-efi != null) [
+    "-Defi-libdir=${toString gnu-efi}/lib"
+    "-Defi-includedir=${toString gnu-efi}/include/efi"
+    "-Defi-ldsdir=${toString gnu-efi}/lib"
   ];
 
   preConfigure = ''
@@ -284,6 +328,6 @@ in stdenv.mkDerivation {
     license = licenses.lgpl21Plus;
     platforms = platforms.linux;
     priority = 10;
-    maintainers = with maintainers; [ andir eelco flokli ];
+    maintainers = with maintainers; [ andir eelco flokli kloenk ];
   };
 }
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index efc2cb2acbd..96f40649c0f 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -703,11 +703,11 @@ lib.makeScope newScope (self: with self; {
   }) {};
 
   libX11 = callPackage ({ stdenv, pkgconfig, fetchurl, xorgproto, libxcb, xtrans }: stdenv.mkDerivation {
-    name = "libX11-1.6.8";
+    name = "libX11-1.6.12";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/lib/libX11-1.6.8.tar.bz2";
-      sha256 = "1mbkwhhprhf49s2iwx7kiliprsdvd690zk44x3h53ql9q52si2dj";
+      url = "mirror://xorg/individual/lib/libX11-1.6.12.tar.bz2";
+      sha256 = "1ivfzl1qwk8zh7gc0m5vb58gdxz11jwg7w3d356w16j1d5s2427i";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     nativeBuildInputs = [ pkgconfig ];
@@ -1054,11 +1054,11 @@ lib.makeScope newScope (self: with self; {
   }) {};
 
   libXvMC = callPackage ({ stdenv, pkgconfig, fetchurl, xorgproto, libX11, libXext, libXv }: stdenv.mkDerivation {
-    name = "libXvMC-1.0.11";
+    name = "libXvMC-1.0.12";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/lib/libXvMC-1.0.11.tar.bz2";
-      sha256 = "0bb2c996p0smp2lwckffcfh4701bzv7266xh230ag0x68ka38bja";
+      url = "mirror://xorg/individual/lib/libXvMC-1.0.12.tar.bz2";
+      sha256 = "1kbdjsvkm5l7axv7g477qj18sab2wnqhliy6197syzizgfbsfgbb";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     nativeBuildInputs = [ pkgconfig ];
@@ -1158,11 +1158,11 @@ lib.makeScope newScope (self: with self; {
   }) {};
 
   libxcb = callPackage ({ stdenv, pkgconfig, fetchurl, libxslt, libpthreadstubs, libXau, xcbproto, libXdmcp, python }: stdenv.mkDerivation {
-    name = "libxcb-1.13.1";
+    name = "libxcb-1.14";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "https://xcb.freedesktop.org/dist/libxcb-1.13.1.tar.bz2";
-      sha256 = "1i27lvrcsygims1pddpl5c4qqs6z715lm12ax0n3vx0igapvg7x8";
+      url = "mirror://xorg/individual/lib/libxcb-1.14.tar.xz";
+      sha256 = "0d2chjgyn5lr9sfhacfvqgnj9l9faz11vn322a06jd6lk3dxcpm5";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     nativeBuildInputs = [ pkgconfig python ];
@@ -1431,11 +1431,11 @@ lib.makeScope newScope (self: with self; {
   }) {};
 
   xcbproto = callPackage ({ stdenv, pkgconfig, fetchurl, python }: stdenv.mkDerivation {
-    name = "xcb-proto-1.13";
+    name = "xcb-proto-1.14.1";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "https://xcb.freedesktop.org/dist/xcb-proto-1.13.tar.bz2";
-      sha256 = "1qdxw9syhbvswiqj5dvj278lrmfhs81apzmvx6205s4vcqg7563v";
+      url = "mirror://xorg/individual/proto/xcb-proto-1.14.1.tar.xz";
+      sha256 = "1hzwazgyywd9mz4mjj1yv8ski27qqx7ypmyr27m39hrajyddsjph";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     nativeBuildInputs = [ pkgconfig python ];
@@ -1717,11 +1717,11 @@ lib.makeScope newScope (self: with self; {
   }) {};
 
   xf86inputlibinput = callPackage ({ stdenv, pkgconfig, fetchurl, xorgproto, libinput, xorgserver }: stdenv.mkDerivation {
-    name = "xf86-input-libinput-0.28.2";
+    name = "xf86-input-libinput-0.30.0";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/driver/xf86-input-libinput-0.28.2.tar.bz2";
-      sha256 = "0818vr0yhk9j1y1wcbxzcd458vrvp06rrhi8k43bhqkb5jb4dcxq";
+      url = "mirror://xorg/individual/driver/xf86-input-libinput-0.30.0.tar.bz2";
+      sha256 = "1h4np66p87jf0c85ig524w8f5rbhl5gx8fww1qg0c55f87yzkizr";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     nativeBuildInputs = [ pkgconfig ];
@@ -2679,11 +2679,11 @@ lib.makeScope newScope (self: with self; {
   }) {};
 
   xorgproto = callPackage ({ stdenv, pkgconfig, fetchurl, libXt }: stdenv.mkDerivation {
-    name = "xorgproto-2019.1";
+    name = "xorgproto-2020.1";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/proto/xorgproto-2019.1.tar.bz2";
-      sha256 = "16yll1kaffnslik5sizlw3qrigj1gpsgfgyq6903g3mwdixamnm6";
+      url = "mirror://xorg/individual/proto/xorgproto-2020.1.tar.bz2";
+      sha256 = "1llrnrkq6iprgiqakmwlv89745s9h02xsiaq0xn3fnh377qm78al";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 80ea5553ad6..e6047458cf2 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -82,13 +82,6 @@ self: super:
 
   libX11 = super.libX11.overrideAttrs (attrs: {
     outputs = [ "out" "dev" "man" ];
-    patches = [
-      # Fixes an issue that happens when cross-compiling for us.
-      (fetchpatch {
-        url = "https://cgit.freedesktop.org/xorg/lib/libX11/patch/?id=0327c427d62f671eced067c6d9b69f4e216a8cac";
-        sha256 = "11k2mx56hjgw886zf1cdf2nhv7052d5rggimfshg6lq20i38vpza";
-      })
-    ];
     configureFlags = attrs.configureFlags or []
       ++ malloc0ReturnsNullCrossFlag;
     depsBuildBuild = [ buildPackages.stdenv.cc ];
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index ecc477980b8..cd294604884 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -1,7 +1,5 @@
 https://invisible-mirror.net/archives/luit/luit-20190106.tgz
 https://xcb.freedesktop.org/dist/libpthread-stubs-0.4.tar.bz2
-https://xcb.freedesktop.org/dist/libxcb-1.13.1.tar.bz2
-https://xcb.freedesktop.org/dist/xcb-proto-1.13.tar.bz2
 https://xcb.freedesktop.org/dist/xcb-util-0.4.0.tar.bz2
 https://xcb.freedesktop.org/dist/xcb-util-cursor-0.1.3.tar.bz2
 https://xcb.freedesktop.org/dist/xcb-util-errors-1.0.tar.bz2
@@ -83,7 +81,7 @@ mirror://xorg/individual/doc/xorg-sgml-doctools-1.11.tar.bz2
 mirror://xorg/individual/driver/xf86-input-evdev-2.10.6.tar.bz2
 mirror://xorg/individual/driver/xf86-input-joystick-1.6.3.tar.bz2
 mirror://xorg/individual/driver/xf86-input-keyboard-1.9.0.tar.bz2
-mirror://xorg/individual/driver/xf86-input-libinput-0.28.2.tar.bz2
+mirror://xorg/individual/driver/xf86-input-libinput-0.30.0.tar.bz2
 mirror://xorg/individual/driver/xf86-input-mouse-1.9.3.tar.bz2
 mirror://xorg/individual/driver/xf86-input-synaptics-1.9.1.tar.bz2
 mirror://xorg/individual/driver/xf86-input-vmmouse-13.1.0.tar.bz2
@@ -177,10 +175,11 @@ mirror://xorg/individual/lib/libICE-1.0.10.tar.bz2
 mirror://xorg/individual/lib/libpciaccess-0.16.tar.bz2
 mirror://xorg/individual/lib/libSM-1.2.3.tar.bz2
 mirror://xorg/individual/lib/libWindowsWM-1.0.1.tar.bz2
-mirror://xorg/individual/lib/libX11-1.6.8.tar.bz2
+mirror://xorg/individual/lib/libX11-1.6.12.tar.bz2
 mirror://xorg/individual/lib/libXau-1.0.9.tar.bz2
 mirror://xorg/individual/lib/libXaw-1.0.13.tar.bz2
 mirror://xorg/individual/lib/libXaw3d-1.6.3.tar.bz2
+mirror://xorg/individual/lib/libxcb-1.14.tar.xz
 mirror://xorg/individual/lib/libXcomposite-0.4.5.tar.bz2
 mirror://xorg/individual/lib/libXcursor-1.2.0.tar.bz2
 mirror://xorg/individual/lib/libXdamage-1.1.5.tar.bz2
@@ -206,12 +205,13 @@ mirror://xorg/individual/lib/libXTrap-1.0.1.tar.bz2
 mirror://xorg/individual/lib/libXt-1.2.0.tar.bz2
 mirror://xorg/individual/lib/libXtst-1.2.3.tar.bz2
 mirror://xorg/individual/lib/libXv-1.0.11.tar.bz2
-mirror://xorg/individual/lib/libXvMC-1.0.11.tar.bz2
+mirror://xorg/individual/lib/libXvMC-1.0.12.tar.bz2
 mirror://xorg/individual/lib/libXxf86dga-1.1.5.tar.bz2
 mirror://xorg/individual/lib/libXxf86misc-1.0.4.tar.bz2
 mirror://xorg/individual/lib/libXxf86vm-1.1.4.tar.bz2
 mirror://xorg/individual/lib/xtrans-1.4.0.tar.bz2
-mirror://xorg/individual/proto/xorgproto-2019.1.tar.bz2
+mirror://xorg/individual/proto/xcb-proto-1.14.1.tar.xz
+mirror://xorg/individual/proto/xorgproto-2020.1.tar.bz2
 mirror://xorg/individual/util/gccmakedep-1.0.3.tar.bz2
 mirror://xorg/individual/util/imake-1.0.8.tar.bz2
 mirror://xorg/individual/util/lndir-1.0.3.tar.bz2
diff --git a/pkgs/shells/bash/bash-completion/default.nix b/pkgs/shells/bash/bash-completion/default.nix
index eeb175a5e78..5fda5704812 100644
--- a/pkgs/shells/bash/bash-completion/default.nix
+++ b/pkgs/shells/bash/bash-completion/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bash-completion";
-  version = "2.10";
+  version = "2.11";
 
   src = fetchFromGitHub {
     owner = "scop";
     repo = "bash-completion";
     rev = version;
-    sha256 = "047yjryy9d6hp18wkigbfrw9r0sm31inlsp8l28fhxg8ii032sgq";
+    sha256 = "0m3brd5jx7w07h8vxvvcmbyrlnadrx6hra3cvx6grzv6rin89liv";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index a040e6ab242..58da8b71b65 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -190,10 +190,7 @@ in rec {
 
   stage1 = prevStage: let
     persistent = self: super: with prevStage; {
-      cmake = super.cmake.override {
-        isBootstrap = true;
-        useSharedLibraries = false;
-      };
+      cmake = super.cmakeMinimal;
 
       python3 = super.python3Minimal;
 
diff --git a/pkgs/test/default.nix b/pkgs/test/default.nix
index 85142090dd4..d9befb9350a 100644
--- a/pkgs/test/default.nix
+++ b/pkgs/test/default.nix
@@ -27,6 +27,8 @@ with pkgs;
   cc-multilib-gcc = callPackage ./cc-wrapper/multilib.nix { stdenv = gccMultiStdenv; };
   cc-multilib-clang = callPackage ./cc-wrapper/multilib.nix { stdenv = clangMultiStdenv; };
 
+  install-shell-files = callPackage ./install-shell-files {};
+
   kernel-config = callPackage ./kernel.nix {};
 
   ld-library-path = callPackage ./ld-library-path {};
diff --git a/pkgs/test/install-shell-files/default.nix b/pkgs/test/install-shell-files/default.nix
new file mode 100644
index 00000000000..e3729c7d250
--- /dev/null
+++ b/pkgs/test/install-shell-files/default.nix
@@ -0,0 +1,125 @@
+{ stdenv, runCommandLocal, recurseIntoAttrs, installShellFiles }:
+
+let
+  runTest = name: env: buildCommand:
+    runCommandLocal "install-shell-files--${name}" ({
+      nativeBuildInputs = [ installShellFiles ];
+      meta.platforms = stdenv.lib.platforms.all;
+    } // env) buildCommand;
+in
+
+recurseIntoAttrs {
+  # installManPage
+
+  install-manpage = runTest "install-manpage" {} ''
+    mkdir -p doc
+    echo foo > doc/foo.1
+    echo bar > doc/bar.2.gz
+    echo baz > doc/baz.3
+
+    installManPage doc/*
+
+    cmp doc/foo.1 $out/share/man/man1/foo.1
+    cmp doc/bar.2.gz $out/share/man/man2/bar.2.gz
+    cmp doc/baz.3 $out/share/man/man3/baz.3
+  '';
+  install-manpage-outputs = runTest "install-manpage-outputs" {
+    outputs = [ "out" "man" "devman" ];
+  } ''
+    mkdir -p doc
+    echo foo > doc/foo.1
+    echo bar > doc/bar.3
+
+    installManPage doc/*
+
+    # assert they didn't go into $out
+    [[ ! -f $out/share/man/man1/foo.1 && ! -f $out/share/man/man3/bar.3 ]]
+
+    # foo.1 alone went into man
+    cmp doc/foo.1 ''${!outputMan:?}/share/man/man1/foo.1
+    [[ ! -f ''${!outputMan:?}/share/man/man3/bar.3 ]]
+
+    # bar.3 alone went into devman
+    cmp doc/bar.3 ''${!outputDevman:?}/share/man/man3/bar.3
+    [[ ! -f ''${!outputDevman:?}/share/man/man1/foo.1 ]]
+
+    touch $out
+  '';
+
+  # installShellCompletion
+
+  install-completion = runTest "install-completion" {} ''
+    echo foo > foo
+    echo bar > bar
+    echo baz > baz
+    echo qux > qux.zsh
+    echo quux > quux
+
+    installShellCompletion --bash foo bar --zsh baz qux.zsh --fish quux
+
+    cmp foo $out/share/bash-completion/completions/foo
+    cmp bar $out/share/bash-completion/completions/bar
+    cmp baz $out/share/zsh/site-functions/_baz
+    cmp qux.zsh $out/share/zsh/site-functions/_qux
+    cmp quux $out/share/fish/vendor_completions.d/quux
+  '';
+  install-completion-output = runTest "install-completion-output" {
+    outputs = [ "out" "bin" ];
+  } ''
+    echo foo > foo
+
+    installShellCompletion --bash foo
+
+    # assert it didn't go into $out
+    [[ ! -f $out/share/bash-completion/completions/foo ]]
+
+    cmp foo ''${!outputBin:?}/share/bash-completion/completions/foo
+
+    touch $out
+  '';
+  install-completion-name = runTest "install-completion-name" {} ''
+    echo foo > foo
+    echo bar > bar
+    echo baz > baz
+
+    installShellCompletion --bash --name foobar.bash foo --zsh --name _foobar bar --fish baz
+
+    cmp foo $out/share/bash-completion/completions/foobar.bash
+    cmp bar $out/share/zsh/site-functions/_foobar
+    cmp baz $out/share/fish/vendor_completions.d/baz
+  '';
+  install-completion-inference = runTest "install-completion-inference" {} ''
+    echo foo > foo.bash
+    echo bar > bar.zsh
+    echo baz > baz.fish
+
+    installShellCompletion foo.bash bar.zsh baz.fish
+
+    cmp foo.bash $out/share/bash-completion/completions/foo.bash
+    cmp bar.zsh $out/share/zsh/site-functions/_bar
+    cmp baz.fish $out/share/fish/vendor_completions.d/baz.fish
+  '';
+  install-completion-cmd = runTest "install-completion-cmd" {} ''
+    echo foo > foo.bash
+    echo bar > bar.zsh
+    echo baz > baz.fish
+    echo qux > qux.fish
+
+    installShellCompletion --cmd foobar --bash foo.bash --zsh bar.zsh --fish baz.fish --name qux qux.fish
+
+    cmp foo.bash $out/share/bash-completion/completions/foobar.bash
+    cmp bar.zsh $out/share/zsh/site-functions/_foobar
+    cmp baz.fish $out/share/fish/vendor_completions.d/foobar.fish
+    cmp qux.fish $out/share/fish/vendor_completions.d/qux
+  '';
+  install-completion-fifo = runTest "install-completion-fifo" {} ''
+    installShellCompletion \
+      --bash --name foo.bash <(echo foo) \
+      --zsh --name _foo <(echo bar) \
+      --fish --name foo.fish <(echo baz)
+
+    [[ $(<$out/share/bash-completion/completions/foo.bash) == foo ]] || { echo "foo.bash comparison failed"; exit 1; }
+    [[ $(<$out/share/zsh/site-functions/_foo) == bar ]] || { echo "_foo comparison failed"; exit 1; }
+    [[ $(<$out/share/fish/vendor_completions.d/foo.fish) == baz ]] || { echo "foo.fish comparison failed"; exit 1; }
+  '';
+}
diff --git a/pkgs/tools/compression/brotli/default.nix b/pkgs/tools/compression/brotli/default.nix
index bf20e0119ec..fd4872cf844 100644
--- a/pkgs/tools/compression/brotli/default.nix
+++ b/pkgs/tools/compression/brotli/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "brotli";
-  version = "1.0.7";
+  version = "1.0.9";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "brotli";
     rev = "v" + version;
-    sha256 = "1811b55wdfg4kbsjcgh1kc938g118jpvif97ilgrmbls25dfpvvw";
+    sha256 = "z6Dhrabav1MDQ4rAcXaDv0aN+qOoh9cvoXZqEWBB13c=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -32,7 +32,14 @@ stdenv.mkDerivation rec {
 
   # This breaks on Darwin because our cmake hook tries to make a build folder
   # and the wonderful bazel BUILD file is already there (yay case-insensitivity?)
-  prePatch = "rm BUILD";
+  prePatch = ''
+      rm BUILD
+
+      # Upstream fixed this reference to runtime-path after the release
+      # and with this references g++ complains about invalid option -R
+      sed -i 's/ -R''${libdir}//' scripts/libbrotli*.pc.in
+      cat scripts/libbrotli*.pc.in
+    '';
 
   # Don't bother with "man" output for now,
   # it currently only makes the manpages hard to use.
diff --git a/pkgs/tools/misc/coreutils/avoid-false-positive-in-date-debug-test.patch b/pkgs/tools/misc/coreutils/avoid-false-positive-in-date-debug-test.patch
deleted file mode 100644
index ae1a02d4d20..00000000000
--- a/pkgs/tools/misc/coreutils/avoid-false-positive-in-date-debug-test.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From 0251229bfd9617e8a35cf9dd7d338d63fff74a0c Mon Sep 17 00:00:00 2001
-From: Assaf Gordon <assafgordon@gmail.com>
-Date: Mon, 13 May 2019 16:37:40 -0600
-Subject: [PATCH] tests: avoid false-positive in date-debug test
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-When debugging an invalid date due to DST switching, the intermediate
-'normalized time' should not be checked - its value can differ between
-systems (e.g. glibc vs musl).
-
-Reported by Niklas Hambüchen in
-https://lists.gnu.org/r/coreutils/2019-05/msg00031.html
-Analyzed by Rich Felker in
-https://lists.gnu.org/r/coreutils/2019-05/msg00039.html
-
-* tests/misc/date-debug.sh: Replace the exact normalized time
-with 'XX:XX:XX' so different values would not trigger test failure.
----
- tests/misc/date-debug.sh | 11 +++++++++--
- 1 file changed, 9 insertions(+), 2 deletions(-)
-
-diff --git a/tests/misc/date-debug.sh b/tests/misc/date-debug.sh
-index aa47f1abb..2ce6f4ce8 100755
---- a/tests/misc/date-debug.sh
-+++ b/tests/misc/date-debug.sh
-@@ -71,7 +71,7 @@ date: input timezone: TZ="America/Edmonton" in date string
- date: using specified time as starting value: '02:30:00'
- date: error: invalid date/time value:
- date:     user provided time: '(Y-M-D) 2006-04-02 02:30:00'
--date:        normalized time: '(Y-M-D) 2006-04-02 03:30:00'
-+date:        normalized time: '(Y-M-D) 2006-04-02 XX:XX:XX'
- date:                                             --
- date:      possible reasons:
- date:        non-existing due to daylight-saving time;
-@@ -81,7 +81,14 @@ date: invalid date 'TZ="America/Edmonton" 2006-04-02 02:30:00'
- EOF
- 
- # date should return 1 (error) for invalid date
--returns_ 1 date --debug -d "$in2" >out2 2>&1 || fail=1
-+returns_ 1 date --debug -d "$in2" >out2-t 2>&1 || fail=1
-+
-+# The output line of "normalized time" can differ between systems
-+# (e.g. glibc vs musl) and should not be checked.
-+# See: https://lists.gnu.org/archive/html/coreutils/2019-05/msg00039.html
-+sed '/normalized time:/s/ [0-9][0-9]:[0-9][0-9]:[0-9][0-9]/ XX:XX:XX/' \
-+    out2-t > out2 || framework_failure_
-+
- compare exp2 out2 || fail=1
- 
- ##
diff --git a/pkgs/tools/misc/coreutils/coreutils-8.31-android-cross.patch b/pkgs/tools/misc/coreutils/coreutils-8.31-android-cross.patch
deleted file mode 100644
index 97d95d1c5b1..00000000000
--- a/pkgs/tools/misc/coreutils/coreutils-8.31-android-cross.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From 3bd82a82cf4ba693d2c31c7b95aaec4e56dc92a4 Mon Sep 17 00:00:00 2001
-From: Paul Eggert <eggert@cs.ucla.edu>
-Date: Mon, 11 Mar 2019 16:40:29 -0700
-Subject: [PATCH 1/1] strtod: fix clash with strtold
-
-Problem reported for RHEL 5 by Jesse Caldwell (Bug#34817).
-* lib/strtod.c (compute_minus_zero, minus_zero):
-Simplify by remving the macro / external variable,
-and having just a function.  User changed.  This avoids
-the need for an external variable that might clash.
----
- ChangeLog    |  9 +++++++++
- lib/strtod.c | 11 +++++------
- 2 files changed, 14 insertions(+), 6 deletions(-)
-
-diff --git a/lib/strtod.c b/lib/strtod.c
-index b9eaa51..69b1564 100644
---- a/lib/strtod.c
-+++ b/lib/strtod.c
-@@ -294,16 +294,15 @@ parse_number (const char *nptr,
-    ICC 10.0 has a bug when optimizing the expression -zero.
-    The expression -MIN * MIN does not work when cross-compiling
-    to PowerPC on Mac OS X 10.5.  */
--#if defined __hpux || defined __sgi || defined __ICC
- static DOUBLE
--compute_minus_zero (void)
-+minus_zero (void)
- {
-+#if defined __hpux || defined __sgi || defined __ICC
-   return -MIN * MIN;
--}
--# define minus_zero compute_minus_zero ()
- #else
--DOUBLE minus_zero = -0.0;
-+  return -0.0;
- #endif
-+}
- 
- /* Convert NPTR to a DOUBLE.  If ENDPTR is not NULL, a pointer to the
-    character after the last one used in the number is put in *ENDPTR.  */
-@@ -479,6 +478,6 @@ STRTOD (const char *nptr, char **endptr)
-   /* Special case -0.0, since at least ICC miscompiles negation.  We
-      can't use copysign(), as that drags in -lm on some platforms.  */
-   if (!num && negative)
--    return minus_zero;
-+    return minus_zero ();
-   return negative ? -num : num;
- }
--- 
-1.9.1
-
diff --git a/pkgs/tools/misc/coreutils/coreutils-8.31-musl-cross.patch b/pkgs/tools/misc/coreutils/coreutils-8.31-musl-cross.patch
deleted file mode 100644
index 02b0b85db31..00000000000
--- a/pkgs/tools/misc/coreutils/coreutils-8.31-musl-cross.patch
+++ /dev/null
@@ -1,1153 +0,0 @@
-From 453ff940449bbbde9ec00f0bbf82a359c5598fc7 Mon Sep 17 00:00:00 2001
-From: Bruno Haible <bruno@clisp.org>
-Date: Sat, 23 Mar 2019 23:00:52 +0100
-Subject: [PATCH 1/1] Support cross-compilation to musl libc.
-
-Reported by Necktwi Ozfguah <necktwi@ferryfair.com>.
-
-* m4/calloc.m4 (_AC_FUNC_CALLOC_IF): Add cross-compilation guesses for
-musl libc.
-* m4/canonicalize.m4 (gl_FUNC_REALPATH_WORKS): Likewise.
-* m4/chown.m4 (gl_FUNC_CHOWN): Likewise.
-* m4/d-ino.m4 (gl_CHECK_TYPE_STRUCT_DIRENT_D_INO): Likewise.
-* m4/fdopendir.m4 (gl_FUNC_FDOPENDIR): Likewise.
-* m4/fnmatch.m4 (gl_FUNC_FNMATCH_POSIX): Likewise.
-* m4/fpurge.m4 (gl_FUNC_FPURGE): Likewise.
-* m4/getcwd.m4 (gl_FUNC_GETCWD_NULL): Likewise.
-* m4/getcwd-abort-bug.m4 (gl_FUNC_GETCWD_ABORT_BUG): Likewise.
-* m4/getdelim.m4 (gl_FUNC_GETDELIM): Likewise.
-* m4/getgroups.m4 (AC_FUNC_GETGROUPS, gl_FUNC_GETGROUPS): Likewise.
-* m4/getline.m4 (gl_FUNC_GETLINE): Likewise.
-* m4/gettimeofday.m4 (gl_FUNC_GETTIMEOFDAY_CLOBBER): Likewise.
-* m4/hypot.m4 (gl_FUNC_HYPOT): Likewise.  // removed
-* m4/hypotf.m4 (gl_FUNC_HYPOTF): Likewise.  // removed
-* m4/hypotl.m4 (gl_FUNC_HYPOTL): Likewise.  // removed
-* m4/iconv_open-utf.m4 (gl_FUNC_ICONV_OPEN_UTF_SUPPORT): Likewise.  // removed
-* m4/link-follow.m4 (gl_FUNC_LINK_FOLLOWS_SYMLINK): Likewise.
-* m4/log.m4 (gl_FUNC_LOG): Likewise.  // removed
-* m4/logf.m4 (gl_FUNC_LOGF): Likewise.  // removed
-* m4/logl.m4 (gl_FUNC_LOGL_WORKS): Likewise.  // removed
-* m4/log10.m4 (gl_FUNC_LOG10): Likewise.  // removed
-* m4/log10f.m4 (gl_FUNC_LOG10F): Likewise.  // removed
-* m4/log10l.m4 (gl_FUNC_LOG10L): Likewise.  // removed
-* m4/log1p.m4 (gl_FUNC_LOG1P): Likewise.  // removed
-* m4/log1pf.m4 (gl_FUNC_LOG1PF): Likewise.  // removed
-* m4/log1pl.m4 (gl_FUNC_LOG1PL): Likewise.  // removed
-* m4/log2.m4 (gl_FUNC_LOG2): Likewise.  // removed
-* m4/log2f.m4 (gl_FUNC_LOG2F): Likewise.  // removed
-* m4/malloc.m4 (_AC_FUNC_MALLOC_IF): Likewise.
-* m4/mkdir.m4 (gl_FUNC_MKDIR): Likewise.
-* m4/mkstemp.m4 (gl_FUNC_MKSTEMP): Likewise.
-* m4/modf.m4 (gl_FUNC_MODF): Likewise.  // removed
-* m4/modff.m4 (gl_FUNC_MODFF): Likewise.  // removed
-* m4/modfl.m4 (gl_FUNC_MODFL): Likewise.  // removed
-* m4/perror.m4 (gl_FUNC_PERROR): Likewise.
-* m4/printf.m4 (gl_PRINTF_SIZES_C99, gl_PRINTF_INFINITE,
-gl_PRINTF_INFINITE_LONG_DOUBLE, gl_PRINTF_DIRECTIVE_A,
-gl_PRINTF_DIRECTIVE_F, gl_PRINTF_FLAG_ZERO, gl_SNPRINTF_TRUNCATION_C99,
-gl_SNPRINTF_RETVAL_C99, gl_SNPRINTF_DIRECTIVE_N,
-gl_VSNPRINTF_ZEROSIZE_C99): Likewise.
-* m4/ptsname.m4 (gl_FUNC_PTSNAME): Likewise.  // removed
-* m4/putenv.m4 (gl_FUNC_PUTENV): Likewise.
-* m4/realloc.m4 (_AC_FUNC_REALLOC_IF): Likewise.
-* m4/remainder.m4 (gl_FUNC_REMAINDER): Likewise.  // removed
-* m4/remainderf.m4 (gl_FUNC_REMAINDERF): Likewise.  // removed
-* m4/remainderl.m4 (gl_FUNC_REMAINDERL): Likewise.  // removed
-* m4/rintl.m4 (gl_FUNC_RINTL): Likewise.  // removed
-* m4/round.m4 (gl_FUNC_ROUND): Likewise.  // removed
-* m4/roundf.m4 (gl_FUNC_ROUNDF): Likewise.  // removed
-* m4/roundl.m4 (gl_FUNC_ROUNDL): Likewise.  // removed
-* m4/setenv.m4 (gl_FUNC_SETENV): Likewise.
-* m4/signbit.m4 (gl_SIGNBIT): Likewise.
-* m4/sleep.m4 (gl_FUNC_SLEEP): Likewise.
-* m4/stpncpy.m4 (gl_FUNC_STPNCPY): Likewise.
-* m4/strerror.m4 (gl_FUNC_STRERROR, gl_FUNC_STRERROR_0): Likewise.
-* m4/strtod.m4 (gl_FUNC_STRTOD): Likewise.
-* m4/strtold.m4 (gl_FUNC_STRTOLD): Likewise.
-* m4/trunc.m4 (gl_FUNC_TRUNC): Likewise.    // removed
-* m4/truncf.m4 (gl_FUNC_TRUNCF): Likewise.  // removed
-* m4/truncl.m4 (gl_FUNC_TRUNCL): Likewise.  // removed
-* m4/tzset.m4 (gl_FUNC_TZSET_CLOBBER): Likewise.
-* m4/ungetc.m4 (gl_FUNC_UNGETC_WORKS): Likewise.
-* m4/usleep.m4 (gl_FUNC_USLEEP): Likewise.
-* m4/utimes.m4 (gl_FUNC_UTIMES): Likewise.
-* m4/wcwidth.m4 (gl_FUNC_WCWIDTH): Likewise.
----
- m4/calloc.m4           |  4 ++-
- m4/canonicalize.m4     |  4 ++-
- m4/chown.m4            | 22 +++++++------
- m4/d-ino.m4            | 16 +++++-----
- m4/fdopendir.m4        | 12 ++++---
- m4/fnmatch.m4          | 18 ++++++++---
- m4/fpurge.m4           | 24 +++++++++-----
- m4/getcwd-abort-bug.m4 | 11 +++++--
- m4/getcwd.m4           |  4 ++-
- m4/getdelim.m4         | 40 ++++++++++++++----------
- m4/getgroups.m4        |  6 +++-
- m4/getline.m4          | 38 +++++++++++++---------
- m4/gettimeofday.m4     |  4 ++-
- m4/link-follow.m4      |  4 ++-
- m4/malloc.m4           |  4 +--
- m4/mkdir.m4            |  4 ++-
- m4/mkstemp.m4          |  4 ++-
- m4/perror.m4           | 12 ++++---
- m4/printf.m4           | 22 ++++++++++++-
- m4/putenv.m4           |  4 ++-
- m4/realloc.m4          |  4 +--
- m4/setenv.m4           |  4 ++-
- m4/signbit.m4          |  6 +++-
- m4/sleep.m4            |  4 ++-
- m4/stpncpy.m4          | 14 +++++++--
- m4/strerror.m4         |  6 +++-
- m4/strtod.m4           | 10 +++---
- m4/strtold.m4          |  9 ++++--
- m4/tzset.m4            |  4 ++-
- m4/ungetc.m4           | 18 ++++++-----
- m4/usleep.m4           |  4 ++-
- m4/utimes.m4           | 10 +++---
- m4/wcwidth.m4          | 12 ++++---
- 76 files changed, 461 insertions(+), 157 deletions(-)
-
-diff --git a/m4/calloc.m4 b/m4/calloc.m4
-index 012a5bf..d76535d 100644
---- a/m4/calloc.m4
-+++ b/m4/calloc.m4
-@@ -1,4 +1,4 @@
--# calloc.m4 serial 18
-+# calloc.m4 serial 19
-
- # Copyright (C) 2004-2019 Free Software Foundation, Inc.
- # This file is free software; the Free Software Foundation
-@@ -40,6 +40,8 @@ AC_DEFUN([_AC_FUNC_CALLOC_IF],
-        [case "$host_os" in
-                          # Guess yes on glibc systems.
-           *-gnu* | gnu*) ac_cv_func_calloc_0_nonnull="guessing yes" ;;
-+                         # Guess yes on musl systems.
-+          *-musl*)       ac_cv_func_calloc_0_nonnull="guessing yes" ;;
-                          # Guess yes on native Windows.
-           mingw*)        ac_cv_func_calloc_0_nonnull="guessing yes" ;;
-                          # If we don't know, assume the worst.
-diff --git a/m4/canonicalize.m4 b/m4/canonicalize.m4
-index 5b6e25d..b61747b 100644
---- a/m4/canonicalize.m4
-+++ b/m4/canonicalize.m4
-@@ -1,4 +1,4 @@
--# canonicalize.m4 serial 29
-+# canonicalize.m4 serial 30
-
- dnl Copyright (C) 2003-2007, 2009-2019 Free Software Foundation, Inc.
-
-@@ -113,6 +113,8 @@ AC_DEFUN([gl_FUNC_REALPATH_WORKS],
-      [case "$host_os" in
-                        # Guess yes on glibc systems.
-         *-gnu* | gnu*) gl_cv_func_realpath_works="guessing yes" ;;
-+                       # Guess yes on musl systems.
-+        *-musl*)       gl_cv_func_realpath_works="guessing yes" ;;
-                        # Guess no on native Windows.
-         mingw*)        gl_cv_func_realpath_works="guessing no" ;;
-                        # If we don't know, assume the worst.
-diff --git a/m4/chown.m4 b/m4/chown.m4
-index ecfc0c0..b798325 100644
---- a/m4/chown.m4
-+++ b/m4/chown.m4
-@@ -1,4 +1,4 @@
--# serial 30
-+# serial 32
- # Determine whether we need the chown wrapper.
-
- dnl Copyright (C) 1997-2001, 2003-2005, 2007, 2009-2019 Free Software
-@@ -109,10 +109,12 @@ AC_DEFUN_ONCE([gl_FUNC_CHOWN],
-         [gl_cv_func_chown_slash_works=yes],
-         [gl_cv_func_chown_slash_works=no],
-         [case "$host_os" in
--                   # Guess yes on glibc systems.
--           *-gnu*) gl_cv_func_chown_slash_works="guessing yes" ;;
--                   # If we don't know, assume the worst.
--           *)      gl_cv_func_chown_slash_works="guessing no" ;;
-+                    # Guess yes on glibc systems.
-+           *-gnu*)  gl_cv_func_chown_slash_works="guessing yes" ;;
-+                    # Guess yes on musl systems.
-+           *-musl*) gl_cv_func_chown_slash_works="guessing yes" ;;
-+                    # If we don't know, assume the worst.
-+           *)       gl_cv_func_chown_slash_works="guessing no" ;;
-          esac
-         ])
-       rm -f conftest.link conftest.file])
-@@ -145,10 +147,12 @@ AC_DEFUN_ONCE([gl_FUNC_CHOWN],
-         [gl_cv_func_chown_ctime_works=yes],
-         [gl_cv_func_chown_ctime_works=no],
-         [case "$host_os" in
--                   # Guess yes on glibc systems.
--           *-gnu*) gl_cv_func_chown_ctime_works="guessing yes" ;;
--                   # If we don't know, assume the worst.
--           *)      gl_cv_func_chown_ctime_works="guessing no" ;;
-+                    # Guess yes on glibc systems.
-+           *-gnu*)  gl_cv_func_chown_ctime_works="guessing yes" ;;
-+                    # Guess yes on musl systems.
-+           *-musl*) gl_cv_func_chown_ctime_works="guessing yes" ;;
-+                    # If we don't know, assume the worst.
-+           *)       gl_cv_func_chown_ctime_works="guessing no" ;;
-          esac
-         ])
-       rm -f conftest.file])
-diff --git a/m4/d-ino.m4 b/m4/d-ino.m4
-index f1420cc..87dcacc 100644
---- a/m4/d-ino.m4
-+++ b/m4/d-ino.m4
-@@ -1,4 +1,4 @@
--# serial 18
-+# serial 19
-
- dnl From Jim Meyering.
- dnl
-@@ -40,12 +40,14 @@ AC_DEFUN([gl_CHECK_TYPE_STRUCT_DIRENT_D_INO],
-            [gl_cv_struct_dirent_d_ino=yes],
-            [gl_cv_struct_dirent_d_ino=no],
-            [case "$host_os" in
--                           # Guess yes on glibc systems with Linux kernel.
--              linux*-gnu*) gl_cv_struct_dirent_d_ino="guessing yes" ;;
--                           # Guess no on native Windows.
--              mingw*)      gl_cv_struct_dirent_d_ino="guessing no" ;;
--                           # If we don't know, assume the worst.
--              *)           gl_cv_struct_dirent_d_ino="guessing no" ;;
-+                            # Guess yes on glibc systems with Linux kernel.
-+              linux*-gnu*)  gl_cv_struct_dirent_d_ino="guessing yes" ;;
-+                            # Guess yes on musl systems with Linux kernel.
-+              linux*-musl*) gl_cv_struct_dirent_d_ino="guessing yes" ;;
-+                            # Guess no on native Windows.
-+              mingw*)       gl_cv_struct_dirent_d_ino="guessing no" ;;
-+                            # If we don't know, assume the worst.
-+              *)            gl_cv_struct_dirent_d_ino="guessing no" ;;
-             esac
-            ])])
-    case "$gl_cv_struct_dirent_d_ino" in
-diff --git a/m4/fdopendir.m4 b/m4/fdopendir.m4
-index 0490551..b2b3b03 100644
---- a/m4/fdopendir.m4
-+++ b/m4/fdopendir.m4
-@@ -1,4 +1,4 @@
--# serial 10
-+# serial 11
- # See if we need to provide fdopendir.
-
- dnl Copyright (C) 2009-2019 Free Software Foundation, Inc.
-@@ -45,10 +45,12 @@ DIR *fdopendir (int);
-          [gl_cv_func_fdopendir_works=yes],
-          [gl_cv_func_fdopendir_works=no],
-          [case "$host_os" in
--                    # Guess yes on glibc systems.
--            *-gnu*) gl_cv_func_fdopendir_works="guessing yes" ;;
--                    # If we don't know, assume the worst.
--            *)      gl_cv_func_fdopendir_works="guessing no" ;;
-+                     # Guess yes on glibc systems.
-+            *-gnu*)  gl_cv_func_fdopendir_works="guessing yes" ;;
-+                     # Guess yes on musl systems.
-+            *-musl*) gl_cv_func_fdopendir_works="guessing yes" ;;
-+                     # If we don't know, assume the worst.
-+            *)       gl_cv_func_fdopendir_works="guessing no" ;;
-           esac
-          ])])
-     case "$gl_cv_func_fdopendir_works" in
-diff --git a/m4/fnmatch.m4 b/m4/fnmatch.m4
-index c264ca7..75ba55b 100644
---- a/m4/fnmatch.m4
-+++ b/m4/fnmatch.m4
-@@ -1,4 +1,4 @@
--# Check for fnmatch - serial 13.  -*- coding: utf-8 -*-
-+# Check for fnmatch - serial 14.  -*- coding: utf-8 -*-
-
- # Copyright (C) 2000-2007, 2009-2019 Free Software Foundation, Inc.
- # This file is free software; the Free Software Foundation
-@@ -14,6 +14,7 @@ AC_DEFUN([gl_FUNC_FNMATCH_POSIX],
-   m4_divert_text([DEFAULTS], [gl_fnmatch_required=POSIX])
-
-   AC_REQUIRE([gl_FNMATCH_H])
-+  AC_REQUIRE([AC_CANONICAL_HOST]) dnl for cross-compiles
-   gl_fnmatch_required_lowercase=`
-     echo $gl_fnmatch_required | LC_ALL=C tr '[[A-Z]]' '[[a-z]]'
-   `
-@@ -117,12 +118,19 @@ AC_DEFUN([gl_FUNC_FNMATCH_POSIX],
-             ]])],
-          [eval "$gl_fnmatch_cache_var=yes"],
-          [eval "$gl_fnmatch_cache_var=no"],
--         [eval "$gl_fnmatch_cache_var=\"guessing no\""])
-+         [case "$host_os" in
-+                     # Guess yes on musl systems.
-+            *-musl*) eval "$gl_fnmatch_cache_var=\"guessing yes\"" ;;
-+                     # Guess no otherwise, even on glibc systems.
-+            *)       eval "$gl_fnmatch_cache_var=\"guessing no\"" ;;
-+          esac
-+         ])
-       ])
-     eval "gl_fnmatch_result=\"\$$gl_fnmatch_cache_var\""
--    if test "$gl_fnmatch_result" != yes; then
--      REPLACE_FNMATCH=1
--    fi
-+    case "$gl_fnmatch_result" in
-+      *yes) ;;
-+      *) REPLACE_FNMATCH=1 ;;
-+    esac
-   fi
-   if test $HAVE_FNMATCH = 0 || test $REPLACE_FNMATCH = 1; then
-     gl_REPLACE_FNMATCH_H
-diff --git a/m4/fpurge.m4 b/m4/fpurge.m4
-index cb21f56..6c5b3e9 100644
---- a/m4/fpurge.m4
-+++ b/m4/fpurge.m4
-@@ -1,4 +1,4 @@
--# fpurge.m4 serial 8
-+# fpurge.m4 serial 9
- dnl Copyright (C) 2007, 2009-2019 Free Software Foundation, Inc.
- dnl This file is free software; the Free Software Foundation
- dnl gives unlimited permission to copy and/or distribute it,
-@@ -7,12 +7,13 @@ dnl with or without modifications, as long as this notice is preserved.
- AC_DEFUN([gl_FUNC_FPURGE],
- [
-   AC_REQUIRE([gl_STDIO_H_DEFAULTS])
-+  AC_REQUIRE([AC_CANONICAL_HOST]) dnl for cross-compiles
-   AC_CHECK_FUNCS_ONCE([fpurge])
-   AC_CHECK_FUNCS_ONCE([__fpurge])
-   AC_CHECK_DECLS([fpurge], , , [[#include <stdio.h>]])
-   if test "x$ac_cv_func_fpurge" = xyes; then
-     HAVE_FPURGE=1
--    # Detect BSD bug.  Only cygwin 1.7 is known to be immune.
-+    # Detect BSD bug.  Only cygwin 1.7 and musl are known to be immune.
-     AC_CACHE_CHECK([whether fpurge works], [gl_cv_func_fpurge_works],
-       [AC_RUN_IFELSE(
-          [AC_LANG_PROGRAM(
-@@ -48,11 +49,20 @@ AC_DEFUN([gl_FUNC_FPURGE],
-                return 13;
-              return 0;
-             ])],
--      [gl_cv_func_fpurge_works=yes], [gl_cv_func_fpurge_works=no],
--      [gl_cv_func_fpurge_works='guessing no'])])
--    if test "x$gl_cv_func_fpurge_works" != xyes; then
--      REPLACE_FPURGE=1
--    fi
-+         [gl_cv_func_fpurge_works=yes],
-+         [gl_cv_func_fpurge_works=no],
-+         [case "$host_os" in
-+                     # Guess yes on musl systems.
-+            *-musl*) gl_cv_func_fpurge_works="guessing yes" ;;
-+                     # Guess no otherwise.
-+            *)       gl_cv_func_fpurge_works="guessing no" ;;
-+          esac
-+         ])
-+      ])
-+    case "$gl_cv_func_fpurge_works" in
-+      *yes) ;;
-+      *) REPLACE_FPURGE=1 ;;
-+    esac
-   else
-     HAVE_FPURGE=0
-   fi
-diff --git a/m4/getcwd-abort-bug.m4 b/m4/getcwd-abort-bug.m4
-index f0f24a5..7227f08 100644
---- a/m4/getcwd-abort-bug.m4
-+++ b/m4/getcwd-abort-bug.m4
-@@ -1,4 +1,4 @@
--# serial 9
-+# serial 11
- # Determine whether getcwd aborts when the length of the working directory
- # name is unusually large.  Any length between 4k and 16k trigger the bug
- # when using glibc-2.4.90-9 or older.
-@@ -13,6 +13,7 @@
- # gl_FUNC_GETCWD_ABORT_BUG([ACTION-IF-FOUND[, ACTION-IF-NOT-FOUND]])
- AC_DEFUN([gl_FUNC_GETCWD_ABORT_BUG],
- [
-+  AC_REQUIRE([AC_CANONICAL_HOST]) dnl for cross-compiles
-   AC_CHECK_DECLS_ONCE([getcwd])
-   AC_CHECK_HEADERS_ONCE([unistd.h])
-   AC_REQUIRE([gl_PATHMAX_SNIPPET_PREREQ])
-@@ -142,7 +143,13 @@ main ()
-         else
-           gl_cv_func_getcwd_abort_bug=no
-         fi],
--       [gl_cv_func_getcwd_abort_bug=yes])
-+       [case "$host_os" in
-+                   # Guess no on musl systems.
-+          *-musl*) gl_cv_func_getcwd_abort_bug="guessing no" ;;
-+                   # Guess yes otherwise, even on glibc systems.
-+          *)       gl_cv_func_getcwd_abort_bug="guessing yes"
-+        esac
-+       ])
-     ])
-   AS_IF([test $gl_cv_func_getcwd_abort_bug = yes], [$1], [$2])
- ])
-diff --git a/m4/getcwd.m4 b/m4/getcwd.m4
-index 4929b51..625171a 100644
---- a/m4/getcwd.m4
-+++ b/m4/getcwd.m4
-@@ -6,7 +6,7 @@
- # with or without modifications, as long as this notice is preserved.
-
- # Written by Paul Eggert.
--# serial 16
-+# serial 17
-
- AC_DEFUN([gl_FUNC_GETCWD_NULL],
-   [
-@@ -50,6 +50,8 @@ AC_DEFUN([gl_FUNC_GETCWD_NULL],
-         [[case "$host_os" in
-                            # Guess yes on glibc systems.
-             *-gnu* | gnu*) gl_cv_func_getcwd_null="guessing yes";;
-+                           # Guess yes on musl systems.
-+            *-musl*)       gl_cv_func_getcwd_null="guessing yes";;
-                            # Guess yes on Cygwin.
-             cygwin*)       gl_cv_func_getcwd_null="guessing yes";;
-                            # If we don't know, assume the worst.
-diff --git a/m4/getdelim.m4 b/m4/getdelim.m4
-index bf17c57..e77c379 100644
---- a/m4/getdelim.m4
-+++ b/m4/getdelim.m4
-@@ -1,4 +1,4 @@
--# getdelim.m4 serial 12
-+# getdelim.m4 serial 13
-
- dnl Copyright (C) 2005-2007, 2009-2019 Free Software Foundation, Inc.
- dnl
-@@ -11,6 +11,7 @@ AC_PREREQ([2.59])
- AC_DEFUN([gl_FUNC_GETDELIM],
- [
-   AC_REQUIRE([gl_STDIO_H_DEFAULTS])
-+  AC_REQUIRE([AC_CANONICAL_HOST]) dnl for cross-compiles
-
-   dnl Persuade glibc <stdio.h> to declare getdelim().
-   AC_REQUIRE([AC_USE_SYSTEM_EXTENSIONS])
-@@ -21,9 +22,10 @@ AC_DEFUN([gl_FUNC_GETDELIM],
-   if test $ac_cv_func_getdelim = yes; then
-     HAVE_GETDELIM=1
-     dnl Found it in some library.  Verify that it works.
--    AC_CACHE_CHECK([for working getdelim function], [gl_cv_func_working_getdelim],
--    [echo fooNbarN | tr -d '\012' | tr N '\012' > conftest.data
--    AC_RUN_IFELSE([AC_LANG_SOURCE([[
-+    AC_CACHE_CHECK([for working getdelim function],
-+      [gl_cv_func_working_getdelim],
-+      [echo fooNbarN | tr -d '\012' | tr N '\012' > conftest.data
-+       AC_RUN_IFELSE([AC_LANG_SOURCE([[
- #    include <stdio.h>
- #    include <stdlib.h>
- #    include <string.h>
-@@ -53,25 +55,31 @@ AC_DEFUN([gl_FUNC_GETDELIM],
-       fclose (in);
-       return 0;
-     }
--    ]])], [gl_cv_func_working_getdelim=yes] dnl The library version works.
--    , [gl_cv_func_working_getdelim=no] dnl The library version does NOT work.
--    , dnl We're cross compiling. Assume it works on glibc2 systems.
--      [AC_EGREP_CPP([Lucky GNU user],
--         [
-+    ]])],
-+         [gl_cv_func_working_getdelim=yes],
-+         [gl_cv_func_working_getdelim=no],
-+         [dnl We're cross compiling.
-+          dnl Guess it works on glibc2 systems and musl systems.
-+          AC_EGREP_CPP([Lucky GNU user],
-+            [
- #include <features.h>
- #ifdef __GNU_LIBRARY__
-  #if (__GLIBC__ >= 2) && !defined __UCLIBC__
-   Lucky GNU user
-  #endif
- #endif
--         ],
--         [gl_cv_func_working_getdelim="guessing yes"],
--         [gl_cv_func_working_getdelim="guessing no"])]
--    )])
-+            ],
-+            [gl_cv_func_working_getdelim="guessing yes"],
-+            [case "$host_os" in
-+               *-musl*) gl_cv_func_working_getdelim="guessing yes" ;;
-+               *)       gl_cv_func_working_getdelim="guessing no" ;;
-+             esac
-+            ])
-+         ])
-+      ])
-     case "$gl_cv_func_working_getdelim" in
--      *no)
--        REPLACE_GETDELIM=1
--        ;;
-+      *yes) ;;
-+      *) REPLACE_GETDELIM=1 ;;
-     esac
-   else
-     HAVE_GETDELIM=0
-diff --git a/m4/getgroups.m4 b/m4/getgroups.m4
-index 2ce986e..c93447b 100644
---- a/m4/getgroups.m4
-+++ b/m4/getgroups.m4
-@@ -1,4 +1,4 @@
--# serial 21
-+# serial 22
-
- dnl From Jim Meyering.
- dnl A wrapper around AC_FUNC_GETGROUPS.
-@@ -42,6 +42,8 @@ AC_DEFUN([AC_FUNC_GETGROUPS],
-          [case "$host_os" in # ((
-                            # Guess yes on glibc systems.
-             *-gnu* | gnu*) ac_cv_func_getgroups_works="guessing yes" ;;
-+                           # Guess yes on musl systems.
-+            *-musl*)       ac_cv_func_getgroups_works="guessing yes" ;;
-                            # If we don't know, assume the worst.
-             *)             ac_cv_func_getgroups_works="guessing no" ;;
-           esac
-@@ -95,6 +97,8 @@ AC_DEFUN([gl_FUNC_GETGROUPS],
-           [case "$host_os" in
-                             # Guess yes on glibc systems.
-              *-gnu* | gnu*) gl_cv_func_getgroups_works="guessing yes" ;;
-+                            # Guess yes on musl systems.
-+             *-musl*)       gl_cv_func_getgroups_works="guessing yes" ;;
-                             # If we don't know, assume the worst.
-              *)             gl_cv_func_getgroups_works="guessing no" ;;
-            esac
-diff --git a/m4/getline.m4 b/m4/getline.m4
-index 5b2ead2..32f771c 100644
---- a/m4/getline.m4
-+++ b/m4/getline.m4
-@@ -1,4 +1,4 @@
--# getline.m4 serial 28
-+# getline.m4 serial 29
-
- dnl Copyright (C) 1998-2003, 2005-2007, 2009-2019 Free Software Foundation,
- dnl Inc.
-@@ -16,6 +16,7 @@ dnl to do with the function we need.
- AC_DEFUN([gl_FUNC_GETLINE],
- [
-   AC_REQUIRE([gl_STDIO_H_DEFAULTS])
-+  AC_REQUIRE([AC_CANONICAL_HOST]) dnl for cross-compiles
-
-   dnl Persuade glibc <stdio.h> to declare getline().
-   AC_REQUIRE([AC_USE_SYSTEM_EXTENSIONS])
-@@ -28,9 +29,10 @@ AC_DEFUN([gl_FUNC_GETLINE],
-                  gl_getline_needs_run_time_check=yes],
-                 [am_cv_func_working_getline=no])
-   if test $gl_getline_needs_run_time_check = yes; then
--    AC_CACHE_CHECK([for working getline function], [am_cv_func_working_getline],
--    [echo fooNbarN | tr -d '\012' | tr N '\012' > conftest.data
--    AC_RUN_IFELSE([AC_LANG_SOURCE([[
-+    AC_CACHE_CHECK([for working getline function],
-+      [am_cv_func_working_getline],
-+      [echo fooNbarN | tr -d '\012' | tr N '\012' > conftest.data
-+       AC_RUN_IFELSE([AC_LANG_SOURCE([[
- #    include <stdio.h>
- #    include <stdlib.h>
- #    include <string.h>
-@@ -61,21 +63,28 @@ AC_DEFUN([gl_FUNC_GETLINE],
-       fclose (in);
-       return 0;
-     }
--    ]])], [am_cv_func_working_getline=yes] dnl The library version works.
--    , [am_cv_func_working_getline=no] dnl The library version does NOT work.
--    , dnl We're cross compiling. Assume it works on glibc2 systems.
--      [AC_EGREP_CPP([Lucky GNU user],
--         [
-+    ]])],
-+         [am_cv_func_working_getline=yes],
-+         [am_cv_func_working_getline=no],
-+         [dnl We're cross compiling.
-+          dnl Guess it works on glibc2 systems and musl systems.
-+          AC_EGREP_CPP([Lucky GNU user],
-+            [
- #include <features.h>
- #ifdef __GNU_LIBRARY__
-  #if (__GLIBC__ >= 2) && !defined __UCLIBC__
-   Lucky GNU user
-  #endif
- #endif
--         ],
--         [am_cv_func_working_getline="guessing yes"],
--         [am_cv_func_working_getline="guessing no"])]
--    )])
-+            ],
-+            [am_cv_func_working_getline="guessing yes"],
-+            [case "$host_os" in
-+               *-musl*) am_cv_func_working_getline="guessing yes" ;;
-+               *)       am_cv_func_working_getline="guessing no" ;;
-+             esac
-+            ])
-+         ])
-+      ])
-   fi
-
-   if test $ac_cv_have_decl_getline = no; then
-@@ -83,7 +92,8 @@ AC_DEFUN([gl_FUNC_GETLINE],
-   fi
-
-   case "$am_cv_func_working_getline" in
--    *no)
-+    *yes) ;;
-+    *)
-       dnl Set REPLACE_GETLINE always: Even if we have not found the broken
-       dnl getline function among $LIBS, it may exist in libinet and the
-       dnl executable may be linked with -linet.
-diff --git a/m4/gettimeofday.m4 b/m4/gettimeofday.m4
-index d29b4bf..5e2ef6f 100644
---- a/m4/gettimeofday.m4
-+++ b/m4/gettimeofday.m4
-@@ -1,4 +1,4 @@
--# serial 25
-+# serial 26
-
- # Copyright (C) 2001-2003, 2005, 2007, 2009-2019 Free Software Foundation, Inc.
- # This file is free software; the Free Software Foundation
-@@ -105,6 +105,8 @@ AC_DEFUN([gl_FUNC_GETTIMEOFDAY_CLOBBER],
-       case "$host_os" in
-                        # Guess all is fine on glibc systems.
-         *-gnu* | gnu*) gl_cv_func_gettimeofday_clobber="guessing no" ;;
-+                       # Guess all is fine on musl systems.
-+        *-musl*)       gl_cv_func_gettimeofday_clobber="guessing no" ;;
-                        # Guess no on native Windows.
-         mingw*)        gl_cv_func_gettimeofday_clobber="guessing no" ;;
-                        # If we don't know, assume the worst.
-diff --git a/m4/link-follow.m4 b/m4/link-follow.m4
-index cbd2dca..8ac7301 100644
---- a/m4/link-follow.m4
-+++ b/m4/link-follow.m4
-@@ -1,4 +1,4 @@
--# serial 20
-+# serial 21
- dnl Run a program to determine whether link(2) follows symlinks.
- dnl Set LINK_FOLLOWS_SYMLINKS accordingly.
-
-@@ -88,6 +88,8 @@ AC_DEFUN([gl_FUNC_LINK_FOLLOWS_SYMLINK],
-             case "$host_os" in
-                                   # On glibc/Linux we know the result.
-               linux*-gnu* | gnu*) gl_cv_func_link_follows_symlink="guessing no" ;;
-+                                  # On musl/Linux we know the result.
-+              linux*-musl*)       gl_cv_func_link_follows_symlink="guessing no" ;;
-                                   # Otherwise, we don't know.
-               *)                  gl_cv_func_link_follows_symlink=unknown ;;
-             esac
-diff --git a/m4/malloc.m4 b/m4/malloc.m4
-index b9b8d4b..c469c45 100644
---- a/m4/malloc.m4
-+++ b/m4/malloc.m4
-@@ -1,4 +1,4 @@
--# malloc.m4 serial 17
-+# malloc.m4 serial 19
- dnl Copyright (C) 2007, 2009-2019 Free Software Foundation, Inc.
- dnl This file is free software; the Free Software Foundation
- dnl gives unlimited permission to copy and/or distribute it,
-@@ -32,7 +32,7 @@ AC_DEFUN([_AC_FUNC_MALLOC_IF],
-        [ac_cv_func_malloc_0_nonnull=no],
-        [case "$host_os" in
-           # Guess yes on platforms where we know the result.
--          *-gnu* | gnu* | freebsd* | netbsd* | openbsd* \
-+          *-gnu* | gnu* | *-musl* | freebsd* | netbsd* | openbsd* \
-           | hpux* | solaris* | cygwin* | mingw*)
-             ac_cv_func_malloc_0_nonnull="guessing yes" ;;
-           # If we don't know, assume the worst.
-diff --git a/m4/mkdir.m4 b/m4/mkdir.m4
-index 4cd9590..366a3cd 100644
---- a/m4/mkdir.m4
-+++ b/m4/mkdir.m4
-@@ -1,4 +1,4 @@
--# serial 14
-+# serial 15
-
- # Copyright (C) 2001, 2003-2004, 2006, 2008-2019 Free Software Foundation, Inc.
- # This file is free software; the Free Software Foundation
-@@ -62,6 +62,8 @@ AC_DEFUN([gl_FUNC_MKDIR],
-       [case "$host_os" in
-                         # Guess yes on glibc systems.
-          *-gnu* | gnu*) gl_cv_func_mkdir_trailing_dot_works="guessing yes" ;;
-+                        # Guess yes on musl systems.
-+         *-musl*)       gl_cv_func_mkdir_trailing_dot_works="guessing yes" ;;
-                         # Guess no on native Windows.
-          mingw*)        gl_cv_func_mkdir_trailing_dot_works="guessing no" ;;
-                         # If we don't know, assume the worst.
-diff --git a/m4/mkstemp.m4 b/m4/mkstemp.m4
-index ae24c3b..1b15c2e 100644
---- a/m4/mkstemp.m4
-+++ b/m4/mkstemp.m4
-@@ -1,4 +1,4 @@
--#serial 25
-+#serial 26
-
- # Copyright (C) 2001, 2003-2007, 2009-2019 Free Software Foundation, Inc.
- # This file is free software; the Free Software Foundation
-@@ -59,6 +59,8 @@ AC_DEFUN([gl_FUNC_MKSTEMP],
-           [case "$host_os" in
-                             # Guess yes on glibc systems.
-              *-gnu* | gnu*) gl_cv_func_working_mkstemp="guessing yes" ;;
-+                            # Guess yes on musl systems.
-+             *-musl*)       gl_cv_func_working_mkstemp="guessing yes" ;;
-                             # Guess no on native Windows.
-              mingw*)        gl_cv_func_working_mkstemp="guessing no" ;;
-                             # If we don't know, assume the worst.
-diff --git a/m4/perror.m4 b/m4/perror.m4
-index 335be72..08e2db1 100644
---- a/m4/perror.m4
-+++ b/m4/perror.m4
-@@ -1,4 +1,4 @@
--# perror.m4 serial 7
-+# perror.m4 serial 8
- dnl Copyright (C) 2008-2019 Free Software Foundation, Inc.
- dnl This file is free software; the Free Software Foundation
- dnl gives unlimited permission to copy and/or distribute it,
-@@ -48,10 +48,12 @@ AC_DEFUN([gl_FUNC_PERROR],
-             rm -rf conftest.txt1 conftest.txt2],
-            [gl_cv_func_perror_works=no],
-            [case "$host_os" in
--                      # Guess yes on native Windows.
--              mingw*) gl_cv_func_perror_works="guessing yes" ;;
--                      # Otherwise guess no.
--              *)      gl_cv_func_perror_works="guessing no" ;;
-+                       # Guess yes on musl systems.
-+              *-musl*) gl_cv_func_perror_works="guessing yes" ;;
-+                       # Guess yes on native Windows.
-+              mingw*)  gl_cv_func_perror_works="guessing yes" ;;
-+                       # Otherwise guess no.
-+              *)       gl_cv_func_perror_works="guessing no" ;;
-             esac
-            ])
-         ])
-diff --git a/m4/printf.m4 b/m4/printf.m4
-index cbf6ae4..6d2280e 100644
---- a/m4/printf.m4
-+++ b/m4/printf.m4
-@@ -1,4 +1,4 @@
--# printf.m4 serial 60
-+# printf.m4 serial 61
- dnl Copyright (C) 2003, 2007-2019 Free Software Foundation, Inc.
- dnl This file is free software; the Free Software Foundation
- dnl gives unlimited permission to copy and/or distribute it,
-@@ -62,6 +62,8 @@ int main ()
- changequote(,)dnl
-                                  # Guess yes on glibc systems.
-            *-gnu* | gnu*)        gl_cv_func_printf_sizes_c99="guessing yes";;
-+                                 # Guess yes on musl systems.
-+           *-musl*)              gl_cv_func_printf_sizes_c99="guessing yes";;
-                                  # Guess yes on FreeBSD >= 5.
-            freebsd[1-4].*)       gl_cv_func_printf_sizes_c99="guessing no";;
-            freebsd* | kfreebsd*) gl_cv_func_printf_sizes_c99="guessing yes";;
-@@ -240,6 +242,8 @@ int main ()
- changequote(,)dnl
-                                  # Guess yes on glibc systems.
-            *-gnu* | gnu*)        gl_cv_func_printf_infinite="guessing yes";;
-+                                 # Guess yes on musl systems.
-+           *-musl*)              gl_cv_func_printf_infinite="guessing yes";;
-                                  # Guess yes on FreeBSD >= 6.
-            freebsd[1-5].*)       gl_cv_func_printf_infinite="guessing no";;
-            freebsd* | kfreebsd*) gl_cv_func_printf_infinite="guessing yes";;
-@@ -457,6 +461,8 @@ int main ()
- changequote(,)dnl
-                                          # Guess yes on glibc systems.
-                    *-gnu* | gnu*)        gl_cv_func_printf_infinite_long_double="guessing yes";;
-+                                         # Guess yes on musl systems.
-+                   *-musl*)              gl_cv_func_printf_infinite_long_double="guessing yes";;
-                                          # Guess yes on FreeBSD >= 6.
-                    freebsd[1-5].*)       gl_cv_func_printf_infinite_long_double="guessing no";;
-                    freebsd* | kfreebsd*) gl_cv_func_printf_infinite_long_double="guessing yes";;
-@@ -575,6 +581,8 @@ int main ()
-                [gl_cv_func_printf_directive_a="guessing yes"],
-                [gl_cv_func_printf_directive_a="guessing no"])
-              ;;
-+                                 # Guess yes on musl systems.
-+           *-musl*)              gl_cv_func_printf_directive_a="guessing yes";;
-                                  # Guess no on Android.
-            linux*-android*)      gl_cv_func_printf_directive_a="guessing no";;
-                                  # Guess no on native Windows.
-@@ -625,6 +633,8 @@ int main ()
- changequote(,)dnl
-                                  # Guess yes on glibc systems.
-            *-gnu* | gnu*)        gl_cv_func_printf_directive_f="guessing yes";;
-+                                 # Guess yes on musl systems.
-+           *-musl*)              gl_cv_func_printf_directive_f="guessing yes";;
-                                  # Guess yes on FreeBSD >= 6.
-            freebsd[1-5].*)       gl_cv_func_printf_directive_f="guessing no";;
-            freebsd* | kfreebsd*) gl_cv_func_printf_directive_f="guessing yes";;
-@@ -960,6 +970,8 @@ changequote(,)dnl
-          case "$host_os" in
-                             # Guess yes on glibc systems.
-            *-gnu* | gnu*)   gl_cv_func_printf_flag_zero="guessing yes";;
-+                            # Guess yes on musl systems.
-+           *-musl*)         gl_cv_func_printf_flag_zero="guessing yes";;
-                             # Guess yes on BeOS.
-            beos*)           gl_cv_func_printf_flag_zero="guessing yes";;
-                             # Guess no on Android.
-@@ -1206,6 +1218,8 @@ changequote(,)dnl
-          case "$host_os" in
-                                  # Guess yes on glibc systems.
-            *-gnu* | gnu*)        gl_cv_func_snprintf_truncation_c99="guessing yes";;
-+                                 # Guess yes on musl systems.
-+           *-musl*)              gl_cv_func_snprintf_truncation_c99="guessing yes";;
-                                  # Guess yes on FreeBSD >= 5.
-            freebsd[1-4].*)       gl_cv_func_snprintf_truncation_c99="guessing no";;
-            freebsd* | kfreebsd*) gl_cv_func_snprintf_truncation_c99="guessing yes";;
-@@ -1308,6 +1322,8 @@ int main ()
- changequote(,)dnl
-                                  # Guess yes on glibc systems.
-            *-gnu* | gnu*)        gl_cv_func_snprintf_retval_c99="guessing yes";;
-+                                 # Guess yes on musl systems.
-+           *-musl*)              gl_cv_func_snprintf_retval_c99="guessing yes";;
-                                  # Guess yes on FreeBSD >= 5.
-            freebsd[1-4].*)       gl_cv_func_snprintf_retval_c99="guessing no";;
-            freebsd* | kfreebsd*) gl_cv_func_snprintf_retval_c99="guessing yes";;
-@@ -1400,6 +1416,8 @@ changequote(,)dnl
-          case "$host_os" in
-                                  # Guess yes on glibc systems.
-            *-gnu* | gnu*)        gl_cv_func_snprintf_directive_n="guessing yes";;
-+                                 # Guess yes on musl systems.
-+           *-musl*)              gl_cv_func_snprintf_directive_n="guessing yes";;
-                                  # Guess yes on FreeBSD >= 5.
-            freebsd[1-4].*)       gl_cv_func_snprintf_directive_n="guessing no";;
-            freebsd* | kfreebsd*) gl_cv_func_snprintf_directive_n="guessing yes";;
-@@ -1554,6 +1572,8 @@ changequote(,)dnl
-          case "$host_os" in
-                                  # Guess yes on glibc systems.
-            *-gnu* | gnu*)        gl_cv_func_vsnprintf_zerosize_c99="guessing yes";;
-+                                 # Guess yes on musl systems.
-+           *-musl*)              gl_cv_func_vsnprintf_zerosize_c99="guessing yes";;
-                                  # Guess yes on FreeBSD >= 5.
-            freebsd[1-4].*)       gl_cv_func_vsnprintf_zerosize_c99="guessing no";;
-            freebsd* | kfreebsd*) gl_cv_func_vsnprintf_zerosize_c99="guessing yes";;
-diff --git a/m4/putenv.m4 b/m4/putenv.m4
-index f8960f6..342ba26 100644
---- a/m4/putenv.m4
-+++ b/m4/putenv.m4
-@@ -1,4 +1,4 @@
--# putenv.m4 serial 22
-+# putenv.m4 serial 23
- dnl Copyright (C) 2002-2019 Free Software Foundation, Inc.
- dnl This file is free software; the Free Software Foundation
- dnl gives unlimited permission to copy and/or distribute it,
-@@ -36,6 +36,8 @@ AC_DEFUN([gl_FUNC_PUTENV],
-              [case "$host_os" in
-                                # Guess yes on glibc systems.
-                 *-gnu* | gnu*) gl_cv_func_svid_putenv="guessing yes" ;;
-+                               # Guess yes on musl systems.
-+                *-musl*)       gl_cv_func_svid_putenv="guessing yes" ;;
-                                # Guess no on native Windows.
-                 mingw*)        gl_cv_func_svid_putenv="guessing no" ;;
-                                # If we don't know, assume the worst.
-diff --git a/m4/realloc.m4 b/m4/realloc.m4
-index f9f15ad..93066e8 100644
---- a/m4/realloc.m4
-+++ b/m4/realloc.m4
-@@ -1,4 +1,4 @@
--# realloc.m4 serial 15
-+# realloc.m4 serial 17
- dnl Copyright (C) 2007, 2009-2019 Free Software Foundation, Inc.
- dnl This file is free software; the Free Software Foundation
- dnl gives unlimited permission to copy and/or distribute it,
-@@ -32,7 +32,7 @@ AC_DEFUN([_AC_FUNC_REALLOC_IF],
-        [ac_cv_func_realloc_0_nonnull=no],
-        [case "$host_os" in
-           # Guess yes on platforms where we know the result.
--          *-gnu* | gnu* | freebsd* | netbsd* | openbsd* \
-+          *-gnu* | gnu* | *-musl* | freebsd* | netbsd* | openbsd* \
-           | hpux* | solaris* | cygwin* | mingw*)
-             ac_cv_func_realloc_0_nonnull="guessing yes" ;;
-           # If we don't know, assume the worst.
-diff --git a/m4/setenv.m4 b/m4/setenv.m4
-index 6101274..a8f83d6 100644
---- a/m4/setenv.m4
-+++ b/m4/setenv.m4
-@@ -1,4 +1,4 @@
--# setenv.m4 serial 27
-+# setenv.m4 serial 28
- dnl Copyright (C) 2001-2004, 2006-2019 Free Software Foundation, Inc.
- dnl This file is free software; the Free Software Foundation
- dnl gives unlimited permission to copy and/or distribute it,
-@@ -37,6 +37,8 @@ AC_DEFUN([gl_FUNC_SETENV],
-       [case "$host_os" in
-                         # Guess yes on glibc systems.
-          *-gnu* | gnu*) gl_cv_func_setenv_works="guessing yes" ;;
-+                        # Guess yes on musl systems.
-+         *-musl*)       gl_cv_func_setenv_works="guessing yes" ;;
-                         # If we don't know, assume the worst.
-          *)             gl_cv_func_setenv_works="guessing no" ;;
-        esac
-diff --git a/m4/signbit.m4 b/m4/signbit.m4
-index bf5bce5..f7f2f3d 100644
---- a/m4/signbit.m4
-+++ b/m4/signbit.m4
-@@ -1,4 +1,4 @@
--# signbit.m4 serial 16
-+# signbit.m4 serial 17
- dnl Copyright (C) 2007-2019 Free Software Foundation, Inc.
- dnl This file is free software; the Free Software Foundation
- dnl gives unlimited permission to copy and/or distribute it,
-@@ -31,6 +31,8 @@ AC_DEFUN([gl_SIGNBIT],
-         [case "$host_os" in
-                           # Guess yes on glibc systems.
-            *-gnu* | gnu*) gl_cv_func_signbit="guessing yes" ;;
-+                          # Guess yes on musl systems.
-+           *-musl*)       gl_cv_func_signbit="guessing yes" ;;
-                           # Guess yes on native Windows.
-            mingw*)        gl_cv_func_signbit="guessing yes" ;;
-                           # If we don't know, assume the worst.
-@@ -62,6 +64,8 @@ AC_DEFUN([gl_SIGNBIT],
-         [case "$host_os" in
-                           # Guess yes on glibc systems.
-            *-gnu* | gnu*) gl_cv_func_signbit_gcc="guessing yes" ;;
-+                          # Guess yes on musl systems.
-+           *-musl*)       gl_cv_func_signbit_gcc="guessing yes" ;;
-                           # Guess yes on mingw, no on MSVC.
-            mingw*)        if test -n "$GCC"; then
-                             gl_cv_func_signbit_gcc="guessing yes"
-diff --git a/m4/sleep.m4 b/m4/sleep.m4
-index 5f71cc7..7bab467 100644
---- a/m4/sleep.m4
-+++ b/m4/sleep.m4
-@@ -1,4 +1,4 @@
--# sleep.m4 serial 9
-+# sleep.m4 serial 10
- dnl Copyright (C) 2007-2019 Free Software Foundation, Inc.
- dnl This file is free software; the Free Software Foundation
- dnl gives unlimited permission to copy and/or distribute it,
-@@ -48,6 +48,8 @@ handle_alarm (int sig)
-       [case "$host_os" in
-                         # Guess yes on glibc systems.
-          *-gnu* | gnu*) gl_cv_func_sleep_works="guessing yes" ;;
-+                        # Guess yes on musl systems.
-+         *-musl*)       gl_cv_func_sleep_works="guessing yes" ;;
-                         # Guess no on native Windows.
-          mingw*)        gl_cv_func_sleep_works="guessing no" ;;
-                         # If we don't know, assume the worst.
-diff --git a/m4/stpncpy.m4 b/m4/stpncpy.m4
-index 83425dd..f8e1a7c 100644
---- a/m4/stpncpy.m4
-+++ b/m4/stpncpy.m4
-@@ -1,4 +1,4 @@
--# stpncpy.m4 serial 16
-+# stpncpy.m4 serial 17
- dnl Copyright (C) 2002-2003, 2005-2007, 2009-2019 Free Software Foundation,
- dnl Inc.
- dnl This file is free software; the Free Software Foundation
-@@ -7,6 +7,8 @@ dnl with or without modifications, as long as this notice is preserved.
-
- AC_DEFUN([gl_FUNC_STPNCPY],
- [
-+  AC_REQUIRE([AC_CANONICAL_HOST]) dnl for cross-compiles
-+
-   dnl Persuade glibc <string.h> to declare stpncpy().
-   AC_REQUIRE([AC_USE_SYSTEM_EXTENSIONS])
-
-@@ -69,12 +71,18 @@ int main ()
- ]])],
-         [gl_cv_func_stpncpy=yes],
-         [gl_cv_func_stpncpy=no],
--        [AC_EGREP_CPP([Thanks for using GNU], [
-+        [dnl Guess yes on glibc systems and musl systems.
-+         AC_EGREP_CPP([Thanks for using GNU], [
- #include <features.h>
- #ifdef __GNU_LIBRARY__
-   Thanks for using GNU
- #endif
--], [gl_cv_func_stpncpy="guessing yes"], [gl_cv_func_stpncpy="guessing no"])
-+],         [gl_cv_func_stpncpy="guessing yes"],
-+           [case "$host_os" in
-+              *-musl*) gl_cv_func_stpncpy="guessing yes" ;;
-+              *)       gl_cv_func_stpncpy="guessing no" ;;
-+            esac
-+           ])
-         ])
-     ])
-     case "$gl_cv_func_stpncpy" in
-diff --git a/m4/strerror.m4 b/m4/strerror.m4
-index b452f7f..2c90f31 100644
---- a/m4/strerror.m4
-+++ b/m4/strerror.m4
-@@ -1,4 +1,4 @@
--# strerror.m4 serial 19
-+# strerror.m4 serial 20
- dnl Copyright (C) 2002, 2007-2019 Free Software Foundation, Inc.
- dnl This file is free software; the Free Software Foundation
- dnl gives unlimited permission to copy and/or distribute it,
-@@ -26,6 +26,8 @@ AC_DEFUN([gl_FUNC_STRERROR],
-         [case "$host_os" in
-                           # Guess yes on glibc systems.
-            *-gnu* | gnu*) gl_cv_func_working_strerror="guessing yes" ;;
-+                          # Guess yes on musl systems.
-+           *-musl*)       gl_cv_func_working_strerror="guessing yes" ;;
-                           # If we don't know, assume the worst.
-            *)             gl_cv_func_working_strerror="guessing no" ;;
-          esac
-@@ -80,6 +82,8 @@ AC_DEFUN([gl_FUNC_STRERROR_0],
-       [case "$host_os" in
-                         # Guess yes on glibc systems.
-          *-gnu* | gnu*) gl_cv_func_strerror_0_works="guessing yes" ;;
-+                        # Guess yes on musl systems.
-+         *-musl*)       gl_cv_func_strerror_0_works="guessing yes" ;;
-                         # Guess yes on native Windows.
-          mingw*)        gl_cv_func_strerror_0_works="guessing yes" ;;
-                         # If we don't know, assume the worst.
-diff --git a/m4/strtod.m4 b/m4/strtod.m4
-index 9912217..d68ab75 100644
---- a/m4/strtod.m4
-+++ b/m4/strtod.m4
-@@ -1,4 +1,4 @@
--# strtod.m4 serial 24
-+# strtod.m4 serial 25
- dnl Copyright (C) 2002-2003, 2006-2019 Free Software Foundation, Inc.
- dnl This file is free software; the Free Software Foundation
- dnl gives unlimited permission to copy and/or distribute it,
-@@ -115,9 +115,11 @@ numeric_equal (double x, double y)
-            ],
-            [gl_cv_func_strtod_works="guessing yes"],
-            [case "$host_os" in
--                      # Guess yes on native Windows.
--              mingw*) gl_cv_func_strtod_works="guessing yes" ;;
--              *)      gl_cv_func_strtod_works="guessing no" ;;
-+                       # Guess yes on musl systems.
-+              *-musl*) gl_cv_func_strtod_works="guessing yes" ;;
-+                       # Guess yes on native Windows.
-+              mingw*)  gl_cv_func_strtod_works="guessing yes" ;;
-+              *)       gl_cv_func_strtod_works="guessing no" ;;
-             esac
-            ])
-         ])
-diff --git a/m4/strtold.m4 b/m4/strtold.m4
-index 16b4eda..17125fe 100644
---- a/m4/strtold.m4
-+++ b/m4/strtold.m4
-@@ -1,4 +1,4 @@
--# strtold.m4 serial 2
-+# strtold.m4 serial 4
- dnl Copyright (C) 2002-2003, 2006-2019 Free Software Foundation, Inc.
- dnl This file is free software; the Free Software Foundation
- dnl gives unlimited permission to copy and/or distribute it,
-@@ -98,7 +98,12 @@ numeric_equal (long double x, long double y)
- #endif
-            ],
-            [gl_cv_func_strtold_works="guessing yes"],
--           [gl_cv_func_strtod_works="guessing no"])
-+           [case "$host_os" in
-+                       # Guess yes on musl systems.
-+              *-musl*) gl_cv_func_strtold_works="guessing yes" ;;
-+              *)       gl_cv_func_strtold_works="guessing no" ;;
-+            esac
-+           ])
-         ])
-       ])
-     case "$gl_cv_func_strtold_works" in
-diff --git a/m4/tzset.m4 b/m4/tzset.m4
-index 1278801..afdfa8e 100644
---- a/m4/tzset.m4
-+++ b/m4/tzset.m4
-@@ -1,4 +1,4 @@
--# serial 11
-+# serial 12
-
- # Copyright (C) 2003, 2007, 2009-2019 Free Software Foundation, Inc.
- # This file is free software; the Free Software Foundation
-@@ -70,6 +70,8 @@ main ()
-        [case "$host_os" in
-                          # Guess all is fine on glibc systems.
-           *-gnu* | gnu*) gl_cv_func_tzset_clobber="guessing no" ;;
-+                         # Guess all is fine on musl systems.
-+          *-musl*)       gl_cv_func_tzset_clobber="guessing no" ;;
-                          # Guess no on native Windows.
-           mingw*)        gl_cv_func_tzset_clobber="guessing no" ;;
-                          # If we don't know, assume the worst.
-diff --git a/m4/ungetc.m4 b/m4/ungetc.m4
-index ab8757b..08baf33 100644
---- a/m4/ungetc.m4
-+++ b/m4/ungetc.m4
-@@ -1,4 +1,4 @@
--# ungetc.m4 serial 6
-+# ungetc.m4 serial 7
- dnl Copyright (C) 2009-2019 Free Software Foundation, Inc.
- dnl This file is free software; the Free Software Foundation
- dnl gives unlimited permission to copy and/or distribute it,
-@@ -41,12 +41,16 @@ AC_DEFUN_ONCE([gl_FUNC_UNGETC_WORKS],
-            remove ("conftest.tmp");])],
-         [gl_cv_func_ungetc_works=yes], [gl_cv_func_ungetc_works=no],
-         [case "$host_os" in
--                                       # Guess yes on glibc and bionic systems.
--           *-gnu* | gnu* | *-android*) gl_cv_func_ungetc_works="guessing yes" ;;
--                                       # Guess yes on native Windows.
--           mingw*)                     gl_cv_func_ungetc_works="guessing yes" ;;
--                                       # If we don't know, assume the worst.
--           *)                          gl_cv_func_ungetc_works="guessing no" ;;
-+                          # Guess yes on glibc systems.
-+           *-gnu* | gnu*) gl_cv_func_ungetc_works="guessing yes" ;;
-+                          # Guess yes on musl systems.
-+           *-musl*)       gl_cv_func_ungetc_works="guessing yes" ;;
-+                          # Guess yes on bionic systems.
-+           *-android*)    gl_cv_func_ungetc_works="guessing yes" ;;
-+                          # Guess yes on native Windows.
-+           mingw*)        gl_cv_func_ungetc_works="guessing yes" ;;
-+                          # If we don't know, assume the worst.
-+           *)             gl_cv_func_ungetc_works="guessing no" ;;
-          esac
-         ])
-     ])
-diff --git a/m4/usleep.m4 b/m4/usleep.m4
-index 59605a8..4a6bff0 100644
---- a/m4/usleep.m4
-+++ b/m4/usleep.m4
-@@ -1,4 +1,4 @@
--# usleep.m4 serial 5
-+# usleep.m4 serial 6
- dnl Copyright (C) 2009-2019 Free Software Foundation, Inc.
- dnl This file is free software; the Free Software Foundation
- dnl gives unlimited permission to copy and/or distribute it,
-@@ -31,6 +31,8 @@ AC_DEFUN([gl_FUNC_USLEEP],
-         [case "$host_os" in
-                           # Guess yes on glibc systems.
-            *-gnu* | gnu*) gl_cv_func_usleep_works="guessing yes" ;;
-+                          # Guess yes on musl systems.
-+           *-musl*)       gl_cv_func_usleep_works="guessing yes" ;;
-                           # Guess no on native Windows.
-            mingw*)        gl_cv_func_usleep_works="guessing no" ;;
-                           # If we don't know, assume the worst.
-diff --git a/m4/utimes.m4 b/m4/utimes.m4
-index 7209b6d..5806d8f 100644
---- a/m4/utimes.m4
-+++ b/m4/utimes.m4
-@@ -1,5 +1,5 @@
- # Detect some bugs in glibc's implementation of utimes.
--# serial 5
-+# serial 6
-
- dnl Copyright (C) 2003-2005, 2009-2019 Free Software Foundation, Inc.
- dnl This file is free software; the Free Software Foundation
-@@ -143,9 +143,11 @@ main ()
-        [gl_cv_func_working_utimes=yes],
-        [gl_cv_func_working_utimes=no],
-        [case "$host_os" in
--                  # Guess no on native Windows.
--          mingw*) gl_cv_func_working_utimes="guessing no" ;;
--          *)      gl_cv_func_working_utimes="guessing no" ;;
-+                   # Guess yes on musl systems.
-+          *-musl*) gl_cv_func_working_utimes="guessing yes" ;;
-+                   # Guess no on native Windows.
-+          mingw*)  gl_cv_func_working_utimes="guessing no" ;;
-+          *)       gl_cv_func_working_utimes="guessing no" ;;
-         esac
-        ])
-     ])
-diff --git a/m4/wcwidth.m4 b/m4/wcwidth.m4
-index baa2002..3952fd2 100644
---- a/m4/wcwidth.m4
-+++ b/m4/wcwidth.m4
-@@ -1,4 +1,4 @@
--# wcwidth.m4 serial 27
-+# wcwidth.m4 serial 28
- dnl Copyright (C) 2006-2019 Free Software Foundation, Inc.
- dnl This file is free software; the Free Software Foundation
- dnl gives unlimited permission to copy and/or distribute it,
-@@ -98,9 +98,13 @@ int main ()
-           [
- changequote(,)dnl
-            case "$host_os" in
--                                        # Guess yes on glibc and AIX 7 systems.
--             *-gnu* | gnu* | aix[7-9]*) gl_cv_func_wcwidth_works="guessing yes";;
--             *)                         gl_cv_func_wcwidth_works="guessing no";;
-+                            # Guess yes on glibc systems.
-+             *-gnu* | gnu*) gl_cv_func_wcwidth_works="guessing yes";;
-+                            # Guess yes on musl systems.
-+             *-musl*)       gl_cv_func_wcwidth_works="guessing yes";;
-+                            # Guess yes on AIX 7 systems.
-+             aix[7-9]*)     gl_cv_func_wcwidth_works="guessing yes";;
-+             *)             gl_cv_func_wcwidth_works="guessing no";;
-            esac
- changequote([,])dnl
-           ])
---
-1.9.1
-
-
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index e7162673a78..e3e2e167e33 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -22,21 +22,16 @@ with lib;
 
 stdenv.mkDerivation (rec {
   pname = "coreutils";
-  version = "8.31";
+  version = "8.32";
 
   src = fetchurl {
     url = "mirror://gnu/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1zg9m79x1i2nifj4kb0waf9x3i5h6ydkypkjnbsb9rnwis8rqypz";
+    sha256 = "sha256-RFjY3nhJ30TMqxXhaxVIsoUiTbul8I+sBwwcDgvMTPo=";
   };
 
   patches = optional stdenv.hostPlatform.isCygwin ./coreutils-8.23-4.cygwin.patch
-         # included on coreutils master; TODO: apply unconditionally, I guess
-         ++ optional stdenv.hostPlatform.isAarch64 ./sys-getdents-undeclared.patch
-         ++ optional stdenv.hostPlatform.isMusl ./avoid-false-positive-in-date-debug-test.patch
-         # Fix compilation in musl-cross environments. To be removed in coreutils-8.32.
-         ++ optional stdenv.hostPlatform.isMusl ./coreutils-8.31-musl-cross.patch
-         # Fix compilation in android-cross environments. To be removed in coreutils-8.32.
-         ++ [ ./coreutils-8.31-android-cross.patch ];
+    # included on coreutils master; TODO: apply unconditionally, I guess
+    ++ optional stdenv.hostPlatform.isAarch64 ./sys-getdents-undeclared.patch;
 
   postPatch = ''
     # The test tends to fail on btrfs,f2fs and maybe other unusual filesystems.
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index 8e151bc2ead..c466a48434f 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -34,14 +34,14 @@ assert gssSupport -> libkrb5 != null;
 
 stdenv.mkDerivation rec {
   pname = "curl";
-  version = "7.72.0";
+  version = "7.73.0";
 
   src = fetchurl {
     urls = [
       "https://curl.haxx.se/download/${pname}-${version}.tar.bz2"
       "https://github.com/curl/curl/releases/download/${lib.replaceStrings ["."] ["_"] pname}-${version}/${pname}-${version}.tar.bz2"
     ];
-    sha256 = "1vq3ay87vayfrv67l7s7h79nm7gwdqhidki0brv5jahhch49g4dd";
+    sha256 = "sha256-zzT+Cwe4APHAGkmabosq9Uj20OBE3KSinYikvuFG0TE=";
   };
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
diff --git a/pkgs/tools/networking/unbound/default.nix b/pkgs/tools/networking/unbound/default.nix
index 9b33d53e54f..d2fa0deca00 100644
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "unbound";
-  version = "1.11.0";
+  version = "1.12.0";
 
   src = fetchurl {
     url = "https://unbound.net/downloads/${pname}-${version}.tar.gz";
-    sha256 = "1xqywn2qdmjjq0csrqxh9p2rnizdrr1f99zdx87z7f3fyyc0fbwz";
+    sha256 = "0daqxzvknvcz7sgag3wcrxhp4a39ik93lsrfpwcl9whjg2lm74jv";
   };
 
   outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e53a98e0aa9..12b0bc0a578 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8346,9 +8346,7 @@ in
   zssh = callPackage ../tools/networking/zssh { };
 
   zstd = callPackage ../tools/compression/zstd {
-    cmake = buildPackages.cmake.override {
-      libarchive = buildPackages.libarchive.override { zstd = null; };
-    };
+    cmake = buildPackages.cmakeMinimal;
   };
 
   zsync = callPackage ../tools/compression/zsync { };
@@ -9676,15 +9674,15 @@ in
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
     llvmPackages = if stdenv.cc.isClang then llvmPackages_5 else llvmPackages_10;
   };
-  rust_1_46 = callPackage ../development/compilers/rust/1_46.nix {
+  rust_1_47 = callPackage ../development/compilers/rust/1_47.nix {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
-    llvmPackages = if stdenv.cc.isClang then llvmPackages_5 else llvmPackages_10;
+    llvmPackages = if stdenv.cc.isClang then llvmPackages_5 else llvmPackages_11;
   };
-  rust = rust_1_46;
+  rust = rust_1_47;
 
   rustPackages_1_45 = rust_1_45.packages.stable;
-  rustPackages_1_46 = rust_1_46.packages.stable;
-  rustPackages = rustPackages_1_46;
+  rustPackages_1_47 = rust_1_47.packages.stable;
+  rustPackages = rustPackages_1_47;
 
   inherit (rustPackages) cargo clippy rustc rustPlatform;
 
@@ -10860,6 +10858,10 @@ in
 
   cmake = libsForQt5.callPackage ../development/tools/build-managers/cmake { };
 
+  cmakeMinimal = libsForQt5.callPackage ../development/tools/build-managers/cmake {
+    isBootstrap = true;
+  };
+
   cmakeCurses = cmake.override { useNcurses = true; };
 
   cmakeWithGui = cmakeCurses.override { withQt5 = true; };
@@ -18290,7 +18292,7 @@ in
     # udev is the same package as systemd which depends on cryptsetup
     # which depends on lvm2 again.  But we only need the libudev part
     # which does not depend on cryptsetup.
-    udev = udev.override { cryptsetup = null; };
+    udev = systemdMinimal;
   };
   lvm2_dmeventd = callPackage ../os-specific/linux/lvm2 {
     enableDmeventd = true;
@@ -18641,8 +18643,23 @@ in
       bzip2 = null;
     };
   };
+  systemdMinimal = systemd.override {
+    pname = "systemd-minimal";
+    withResolved = false;
+    withLogind = false;
+    withHostnamed = false;
+    withLocaled = false;
+    withTimedated = false;
+    withHwdb = false;
+    withEfi = false;
+    withImportd = false;
+    withCryptsetup = false;
+    cryptsetup = null;
+    lvm2 = null;
+  };
+
 
-  udev = systemd; # TODO: move to aliases.nix
+  udev = systemd; # TODO: change to systemdMinimal
 
   systemd-wait = callPackage ../os-specific/linux/systemd-wait { };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 945f55adc70..0961e3c264d 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4828,7 +4828,7 @@ in {
 
   pybullet = callPackage ../development/python-modules/pybullet { };
 
-  pycairo = callPackage ../development/python-modules/pycairo { inherit (pkgs) meson pkgconfig; };
+  pycairo = callPackage ../development/python-modules/pycairo { inherit (pkgs) meson pkg-config; };
 
   pycallgraph = callPackage ../development/python-modules/pycallgraph { };