Merge pull request #76875 from NixOS/staging-next

Staging next

38 files changed, 306 insertions, 138 deletions

diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
index ceecfa73ce4..485f1d0dca3 100644
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "8.1.2407";
+  version = "8.2.0013";
 
   src = fetchFromGitHub {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    sha256 = "1h23lncm8py0ip8p61y8hivmnd8fzf8xpwpkd73d3a3fpiyd2yx8";
+    sha256 = "00sc9zdjdww6f3svwf0nxpx8q2zp1n1r978h7ijapgvn2ysx2z1f";
   };
 
   enableParallelBuilding = true;
@@ -24,7 +24,7 @@ rec {
     description = "The most popular clone of the VI editor";
     homepage    = http://www.vim.org;
     license     = licenses.vim;
-    maintainers = with maintainers; [ lovek323 ];
+    maintainers = with maintainers; [ lovek323 equirosa ];
     platforms   = platforms.unix;
   };
 }
diff --git a/pkgs/development/compilers/llvm/9/clang/default.nix b/pkgs/development/compilers/llvm/9/clang/default.nix
index bf9b1a32a83..12fa33a7f8c 100644
--- a/pkgs/development/compilers/llvm/9/clang/default.nix
+++ b/pkgs/development/compilers/llvm/9/clang/default.nix
@@ -9,11 +9,11 @@ let
     pname = "clang";
     inherit version;
 
-    src = fetch "cfe" "0426ma80i41qsgzm1qdz81mjskck426diygxi2k5vji2gkpixa3v";
+    src = fetch "clang" "0ls2h3iv4finqyflyhry21qhc9cm9ga7g1zq21020p065qmm2y2p";
 
     unpackPhase = ''
       unpackFile $src
-      mv cfe-${version}* clang
+      mv clang-${version}* clang
       sourceRoot=$PWD/clang
       unpackFile ${clang-tools-extra_src}
       mv clang-tools-extra-* $sourceRoot/tools/extra
diff --git a/pkgs/development/compilers/llvm/9/compiler-rt.nix b/pkgs/development/compilers/llvm/9/compiler-rt.nix
index 5826f0fbb35..75d0614b514 100644
--- a/pkgs/development/compilers/llvm/9/compiler-rt.nix
+++ b/pkgs/development/compilers/llvm/9/compiler-rt.nix
@@ -2,7 +2,7 @@
 stdenv.mkDerivation rec {
   pname = "compiler-rt";
   inherit version;
-  src = fetch pname "03ni43lbkp63lr3p6sc94dphqmvnz5av5mml0xmk930xvnbcvr2n";
+  src = fetch pname "0xwh79g3zggdabxgnd0bphry75asm1qz7mv3hcqihqwqr6aspgy2";
 
   nativeBuildInputs = [ cmake python llvm ];
   buildInputs = stdenv.lib.optional stdenv.hostPlatform.isDarwin libcxxabi;
diff --git a/pkgs/development/compilers/llvm/9/default.nix b/pkgs/development/compilers/llvm/9/default.nix
index 1590d180c3f..c9e8ce91f0c 100644
--- a/pkgs/development/compilers/llvm/9/default.nix
+++ b/pkgs/development/compilers/llvm/9/default.nix
@@ -5,15 +5,15 @@
 }:
 
 let
-  release_version = "9.0.0";
+  release_version = "9.0.1";
   version = release_version; # differentiating these is important for rc's
 
   fetch = name: sha256: fetchurl {
-    url = "https://releases.llvm.org/${release_version}/${name}-${version}.src.tar.xz";
+    url = "https://github.com/llvm/llvm-project/releases/download/llvmorg-${release_version}/${name}-${version}.src.tar.xz";
     inherit sha256;
   };
 
-  clang-tools-extra_src = fetch "clang-tools-extra" "045cldmcfd8s33wyjlviifgpnw52yqicd6v4ysvdg4i96p78c77a";
+  clang-tools-extra_src = fetch "clang-tools-extra" "01vgzd4k1q93nfs8gyl83mjlc4x0qsgfqw32lacbjzdxg0mdfvxj";
 
   tools = stdenv.lib.makeExtensible (tools: let
     callPackage = newScope (tools // { inherit stdenv cmake libxml2 python isl release_version version fetch; });
diff --git a/pkgs/development/compilers/llvm/9/libc++/default.nix b/pkgs/development/compilers/llvm/9/libc++/default.nix
index daf8ed5a9ae..1166c7bd76c 100644
--- a/pkgs/development/compilers/llvm/9/libc++/default.nix
+++ b/pkgs/development/compilers/llvm/9/libc++/default.nix
@@ -5,7 +5,7 @@ stdenv.mkDerivation {
   pname = "libc++";
   inherit version;
 
-  src = fetch "libcxx" "136j3v7il9aq8wyp48klx6sifnl5asj4lf5c8yx08cjx5fbn4h9w";
+  src = fetch "libcxx" "0d2bj5i6mk4caq7skd5nsdmz8c2m5w5anximl5wz3x32p08zz089";
 
   postUnpack = ''
     unpackFile ${libcxxabi.src}
diff --git a/pkgs/development/compilers/llvm/9/libc++abi.nix b/pkgs/development/compilers/llvm/9/libc++abi.nix
index 7afff991e75..fbc9a3731ef 100644
--- a/pkgs/development/compilers/llvm/9/libc++abi.nix
+++ b/pkgs/development/compilers/llvm/9/libc++abi.nix
@@ -5,7 +5,7 @@ stdenv.mkDerivation {
   pname = "libc++abi";
   inherit version;
 
-  src = fetch "libcxxabi" "1s9haplqv8ashlsdx2psxiqxh50gqk2jp2vz5yn0djb56mw42l37";
+  src = fetch "libcxxabi" "1b4aiaa8cirx52vk2p5kfk57qmbqf1ipb4nqnjhdgqps9jm7iyg8";
 
   nativeBuildInputs = [ cmake ];
   buildInputs = stdenv.lib.optional (!stdenv.isDarwin && !stdenv.isFreeBSD && !stdenv.hostPlatform.isWasm) libunwind;
diff --git a/pkgs/development/compilers/llvm/9/libunwind.nix b/pkgs/development/compilers/llvm/9/libunwind.nix
index 5eba9e03c78..883c36baf06 100644
--- a/pkgs/development/compilers/llvm/9/libunwind.nix
+++ b/pkgs/development/compilers/llvm/9/libunwind.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
   pname = "libunwind";
   inherit version;
 
-  src = fetch pname "1chd1nz4bscrs6qa7p8sqgk5df86ll0frv0f451vhks2w44qsslp";
+  src = fetch pname "1wb02ha3gl6p0a321hwpll74pz5qvjr11xmjqx62g288f1m10njk";
 
   nativeBuildInputs = [ cmake ];
 
diff --git a/pkgs/development/compilers/llvm/9/lld.nix b/pkgs/development/compilers/llvm/9/lld.nix
index c5baef4357e..775dc2e1905 100644
--- a/pkgs/development/compilers/llvm/9/lld.nix
+++ b/pkgs/development/compilers/llvm/9/lld.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   pname = "lld";
   inherit version;
 
-  src = fetch pname "14cgd34gr826qpxzhrkbz6qgm8ymds0hrsiznwzp42ax4f5p9iii";
+  src = fetch pname "10hckfxpapfnh6y9apjiya2jpw9nmbbmh8ayijx89mrg7snjn9l6";
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ llvm libxml2 ];
diff --git a/pkgs/development/compilers/llvm/9/lldb.nix b/pkgs/development/compilers/llvm/9/lldb.nix
index ee281384c40..64f111502cc 100644
--- a/pkgs/development/compilers/llvm/9/lldb.nix
+++ b/pkgs/development/compilers/llvm/9/lldb.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   pname = "lldb";
   inherit version;
 
-  src = fetch pname "1507dl0xw03nppxpz2xsq4s30jdbkplx4w14za54ngqm3xm2yk0y";
+  src = fetch pname "02gb3fbz09kyw8n71218v5v77ip559x3gqbcp8y3w6n3jpbryywa";
 
   patches = [ ./lldb-procfs.patch ];
 
diff --git a/pkgs/development/compilers/llvm/9/llvm.nix b/pkgs/development/compilers/llvm/9/llvm.nix
index d4af41ee436..acd3ec92897 100644
--- a/pkgs/development/compilers/llvm/9/llvm.nix
+++ b/pkgs/development/compilers/llvm/9/llvm.nix
@@ -31,8 +31,8 @@ in stdenv.mkDerivation (rec {
   pname = "llvm";
   inherit version;
 
-  src = fetch pname "117ymdz1by2nkfq1c2p9m4050dp848kbjbiv6nsfj8hzy9f5d86n";
-  polly_src = fetch "polly" "0cyl2gsibf1dhqvkyw1qb0f8q58ib6cihzyh4f9kj9g77ll95ym4";
+  src = fetch pname "16hwp3qa54c3a3v7h8nlw0fh5criqh0hlr1skybyk0cz70gyx880";
+  polly_src = fetch "polly" "1kqg0isv0kicnylrdp5iajlgd6alc0zx1l3cxc9hs8r3z6fwcjls";
 
   unpackPhase = ''
     unpackFile $src
diff --git a/pkgs/development/compilers/llvm/9/openmp.nix b/pkgs/development/compilers/llvm/9/openmp.nix
index a511aed2eb8..4e0a5535ae3 100644
--- a/pkgs/development/compilers/llvm/9/openmp.nix
+++ b/pkgs/development/compilers/llvm/9/openmp.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   pname = "openmp";
   inherit version;
 
-  src = fetch pname "0nrv9np134b7c483jnq786spy3hbpj11d7g21g67cqq66c8ynycr";
+  src = fetch pname "1knafnpp0f7hylx8q20lkd6g1sf0flly572dayc5d5kghh7hd52w";
 
   nativeBuildInputs = [ cmake perl ];
   buildInputs = [ llvm ];
diff --git a/pkgs/development/libraries/apr/default.nix b/pkgs/development/libraries/apr/default.nix
index d9409636bd0..2ce4b77927f 100644
--- a/pkgs/development/libraries/apr/default.nix
+++ b/pkgs/development/libraries/apr/default.nix
@@ -23,10 +23,18 @@ stdenv.mkDerivation rec {
       configureFlagsArray+=("--with-installbuilddir=$dev/share/build")
     '';
 
-  configureFlags =
+  configureFlags = stdenv.lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "ac_cv_file__dev_zero=yes"
+    "ac_cv_func_setpgrp_void=0"
+    "apr_cv_process_shared_works=1"
+    "apr_cv_tcp_nodelay_with_cork=1"
+  ] ++ stdenv.lib.optionals (stdenv.hostPlatform.system == "i686-cygwin") [
     # Including the Windows headers breaks unistd.h.
     # Based on ftp://sourceware.org/pub/cygwin/release/libapr1/libapr1-1.3.8-2-src.tar.bz2
-    stdenv.lib.optional (stdenv.hostPlatform.system == "i686-cygwin") "ac_cv_header_windows_h=no";
+    "ac_cv_header_windows_h=no"
+  ];
+
+  CPPFLAGS=stdenv.lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "-DAPR_IOVEC_DEFINED";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/arrow-cpp/default.nix b/pkgs/development/libraries/arrow-cpp/default.nix
index f6f3493002a..87684a4bbe4 100644
--- a/pkgs/development/libraries/arrow-cpp/default.nix
+++ b/pkgs/development/libraries/arrow-cpp/default.nix
@@ -1,6 +1,7 @@
-{ stdenv, fetchurl, fetchFromGitHub, fixDarwinDylibNames, autoconf, boost
+{ stdenv, lib, fetchurl, fetchFromGitHub, fixDarwinDylibNames, autoconf, boost
 , brotli, cmake, double-conversion, flatbuffers, gflags, glog, gtest, lz4, perl
-, python, rapidjson, snappy, thrift, uriparser, which, zlib, zstd }:
+, python, rapidjson, snappy, thrift, uriparser, which, zlib, zstd
+, enableShared ? true }:
 
 let
   parquet-testing = fetchFromGitHub {
@@ -34,13 +35,16 @@ in stdenv.mkDerivation rec {
   patches = [
     # patch to fix python-test
     ./darwin.patch
+  ] ++ lib.optionals (!enableShared) [
+    # The shared jemalloc lib is unused and breaks in static mode due to missing -fpic.
+    ./jemalloc-disable-shared.patch
   ];
 
   nativeBuildInputs = [
     cmake
     autoconf # for vendored jemalloc
     flatbuffers
-  ] ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
+  ] ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
   buildInputs = [
     boost
     brotli
@@ -71,21 +75,26 @@ in stdenv.mkDerivation rec {
     "-DARROW_DEPENDENCY_SOURCE=SYSTEM"
     "-DARROW_PARQUET=ON"
     "-DARROW_PLASMA=ON"
-    "-DARROW_PYTHON=ON"
+    # Disable Python for static mode because openblas is currently broken there.
+    "-DARROW_PYTHON=${if enableShared then "ON" else "OFF"}"
     "-Duriparser_SOURCE=SYSTEM"
-  ] ++ stdenv.lib.optional (!stdenv.isx86_64) "-DARROW_USE_SIMD=OFF";
+  ] ++ lib.optionals (!enableShared) [
+    "-DARROW_BUILD_SHARED=OFF"
+    "-DARROW_TEST_LINKAGE=static"
+    "-DOPENSSL_USE_STATIC_LIBS=ON"
+  ] ++ lib.optional (!stdenv.isx86_64) "-DARROW_USE_SIMD=OFF";
 
   doInstallCheck = true;
   PARQUET_TEST_DATA =
     if doInstallCheck then "${parquet-testing}/data" else null;
   installCheckInputs = [ perl which ];
-  installCheckPhase = (stdenv.lib.optionalString stdenv.isDarwin ''
+  installCheckPhase = (lib.optionalString stdenv.isDarwin ''
     for f in release/*test{,s}; do
       install_name_tool -add_rpath "$out"/lib  "$f"
     done
   '')
   + (let
-    excludedTests = stdenv.lib.optionals stdenv.isDarwin [
+    excludedTests = lib.optionals stdenv.isDarwin [
       # Some plasma tests need to be patched to use a shorter AF_UNIX socket
       # path on Darwin. See https://github.com/NixOS/nix/pull/1085
       "plasma-external-store-tests"
@@ -99,8 +108,8 @@ in stdenv.mkDerivation rec {
   meta = {
     description = "A  cross-language development platform for in-memory data";
     homepage = "https://arrow.apache.org/";
-    license = stdenv.lib.licenses.asl20;
-    platforms = stdenv.lib.platforms.unix;
-    maintainers = with stdenv.lib.maintainers; [ tobim veprbl ];
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ tobim veprbl ];
   };
 }
diff --git a/pkgs/development/libraries/arrow-cpp/jemalloc-disable-shared.patch b/pkgs/development/libraries/arrow-cpp/jemalloc-disable-shared.patch
new file mode 100644
index 00000000000..0f7955724e1
--- /dev/null
+++ b/pkgs/development/libraries/arrow-cpp/jemalloc-disable-shared.patch
@@ -0,0 +1,11 @@
+diff --git a/cmake_modules/ThirdpartyToolchain.cmake b/cmake_modules/ThirdpartyToolchain.cmake
+--- a/cmake_modules/ThirdpartyToolchain.cmake
++++ b/cmake_modules/ThirdpartyToolchain.cmake
+@@ -1428,6 +1428,7 @@ if(ARROW_JEMALLOC)
+                       "--with-jemalloc-prefix=je_arrow_"
+                       "--with-private-namespace=je_arrow_private_"
+                       "--without-export"
++                      "--disable-shared"
+                       # Don't override operator new()
+                       "--disable-cxx" "--disable-libdl"
+                       # See https://github.com/jemalloc/jemalloc/issues/1237
diff --git a/pkgs/development/libraries/cyrus-sasl/default.nix b/pkgs/development/libraries/cyrus-sasl/default.nix
index a050dd8d9ca..68f6a7c5d8b 100644
--- a/pkgs/development/libraries/cyrus-sasl/default.nix
+++ b/pkgs/development/libraries/cyrus-sasl/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, openssl, openldap, kerberos, db, gettext
 , pam, fixDarwinDylibNames, autoreconfHook, enableLdap ? false
-, buildPackages, pruneLibtoolFiles }:
+, buildPackages, pruneLibtoolFiles, fetchpatch }:
 
 with stdenv.lib;
 stdenv.mkDerivation rec {
@@ -27,6 +27,11 @@ stdenv.mkDerivation rec {
   patches = [
     ./missing-size_t.patch # https://bugzilla.redhat.com/show_bug.cgi?id=906519
     ./cyrus-sasl-ac-try-run-fix.patch
+    (fetchpatch {
+      name = "CVE-2019-19906.patch";
+      url = "https://sources.debian.org/data/main/c/cyrus-sasl2/2.1.27+dfsg-1+deb10u1/debian/patches/0021-CVE-2019-19906.patch";
+      sha256 = "1n4c5wg7l9j8rlbvx8i605j5d39xmj5wm618k8acxl4fmglcmfls";
+    })
   ];
 
   configureFlags = [
diff --git a/pkgs/development/libraries/double-conversion/default.nix b/pkgs/development/libraries/double-conversion/default.nix
index bc4bc8b2352..4d8f623b36a 100644
--- a/pkgs/development/libraries/double-conversion/default.nix
+++ b/pkgs/development/libraries/double-conversion/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, cmake }:
+{ stdenv, lib, fetchFromGitHub, cmake, static ? false }:
 
 stdenv.mkDerivation rec {
   pname = "double-conversion";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
-  cmakeFlags = [ "-DBUILD_SHARED_LIBS=ON" ];
+  cmakeFlags = [ "-DBUILD_SHARED_LIBS=${if static then "OFF" else "ON"}" ];
 
   # Case sensitivity issue
   preConfigure = lib.optionalString stdenv.isDarwin ''
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Binary-decimal and decimal-binary routines for IEEE doubles";
-    homepage = https://github.com/google/double-conversion;
+    homepage = "https://github.com/google/double-conversion";
     license = licenses.bsd3;
     platforms = platforms.unix;
     maintainers = with maintainers; [ abbradar ];
diff --git a/pkgs/development/libraries/flatbuffers/default.nix b/pkgs/development/libraries/flatbuffers/default.nix
index d43c10c8bf9..11e86703616 100644
--- a/pkgs/development/libraries/flatbuffers/default.nix
+++ b/pkgs/development/libraries/flatbuffers/default.nix
@@ -1,6 +1,6 @@
-{ stdenv, fetchFromGitHub, cmake }:
+{ stdenv, fetchFromGitHub, fetchpatch, cmake }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (rec {
   pname = "flatbuffers";
   version = "1.11.0";
 
@@ -34,4 +34,12 @@ stdenv.mkDerivation rec {
     platforms = stdenv.lib.platforms.unix;
     homepage = https://google.github.io/flatbuffers/;
   };
-}
+} // stdenv.lib.optionalAttrs stdenv.hostPlatform.isMusl {
+  # Remove when updating to the next version.
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/google/flatbuffers/commit/2b52494047fb6e97af03e1801b42adc7ed3fd78a.diff";
+      sha256 = "01k07ws0f4w7nnl8nli795wgjm4p94lxd3kva4yf7nf3pg4p8arx";
+    })
+  ];
+})
diff --git a/pkgs/development/libraries/gflags/default.nix b/pkgs/development/libraries/gflags/default.nix
index 2e818ea94ea..b09936f2924 100644
--- a/pkgs/development/libraries/gflags/default.nix
+++ b/pkgs/development/libraries/gflags/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake }:
+{ stdenv, fetchFromGitHub, cmake, enableShared ? true}:
 
 stdenv.mkDerivation rec {
   pname = "gflags";
@@ -17,8 +17,8 @@ stdenv.mkDerivation rec {
   preConfigure = "rm BUILD";
 
   cmakeFlags = [
-    "-DBUILD_SHARED_LIBS=ON"
-    "-DBUILD_STATIC_LIBS=ON"
+    "-DGFLAGS_BUILD_SHARED_LIBS=${if enableShared then "ON" else "OFF"}"
+    "-DGFLAGS_BUILD_STATIC_LIBS=ON"
   ];
 
   doCheck = false;
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index 0febed9f9c9..4a7d6cce90b 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -138,9 +138,6 @@ stdenv.mkDerivation rec {
     patchShebangs tests/gen-casemap-txt.py
   '';
 
-  LIBELF_CFLAGS = optional stdenv.isFreeBSD "-I${libelf}";
-  LIBELF_LIBS = optional stdenv.isFreeBSD "-L${libelf} -lelf";
-
   DETERMINISTIC_BUILD = 1;
 
   postInstall = ''
diff --git a/pkgs/development/libraries/glibc/default.nix b/pkgs/development/libraries/glibc/default.nix
index 98e579cb7a6..1a17595a1a3 100644
--- a/pkgs/development/libraries/glibc/default.nix
+++ b/pkgs/development/libraries/glibc/default.nix
@@ -48,21 +48,21 @@ callPackage ./common.nix { inherit stdenv; } {
     #      limit rebuilds by only disabling pie w/musl
       ++ stdenv.lib.optional stdenv.hostPlatform.isMusl "pie";
 
-    NIX_CFLAGS_COMPILE =
-      if !stdenv.hostPlatform.isMusl
+    NIX_CFLAGS_COMPILE = stdenv.lib.concatStringsSep " "
+      (if !stdenv.hostPlatform.isMusl
         # TODO: This (returning a string or `null`, instead of a list) is to
         #       not trigger a mass rebuild due to the introduction of the
         #       musl-specific flags below.
         #       At next change to non-musl glibc builds, remove this `then`
         #       and the above condition, instead keeping only the `else` below.
-        then (if withGd then gdCflags else null)
+        then (stdenv.lib.optionals withGd gdCflags)
         else
           (builtins.concatLists [
             (stdenv.lib.optionals withGd gdCflags)
             # Fix -Werror build failure when building glibc with musl with GCC >= 8, see:
             # https://github.com/NixOS/nixpkgs/pull/68244#issuecomment-544307798
             (stdenv.lib.optional stdenv.hostPlatform.isMusl "-Wno-error=attribute-alias")
-          ]);
+          ]));
 
     # When building glibc from bootstrap-tools, we need libgcc_s at RPATH for
     # any program we run, because the gcc will have been placed at a new
diff --git a/pkgs/development/libraries/glog/default.nix b/pkgs/development/libraries/glog/default.nix
index 792217043da..7809dc08842 100644
--- a/pkgs/development/libraries/glog/default.nix
+++ b/pkgs/development/libraries/glog/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, fetchpatch, autoreconfHook, perl }:
+{ stdenv, lib, fetchFromGitHub, fetchpatch, cmake, perl, static ? false }:
 
 stdenv.mkDerivation rec {
   pname = "glog";
@@ -20,13 +20,15 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  nativeBuildInputs = [ autoreconfHook ];
+  nativeBuildInputs = [ cmake ];
+
+  cmakeFlags = [ "-DBUILD_SHARED_LIBS=${if static then "OFF" else "ON"}" ];
 
   checkInputs = [ perl ];
   doCheck = false; # fails with "Mangled symbols (28 out of 380) found in demangle.dm"
 
   meta = with stdenv.lib; {
-    homepage = https://github.com/google/glog;
+    homepage = "https://github.com/google/glog";
     license = licenses.bsd3;
     description = "Library for application-level logging";
     platforms = platforms.unix;
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 9582e1bf1bf..761d6594bd0 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -27,7 +27,7 @@
 with stdenv.lib;
 
 let
-  version = "19.2.7";
+  version = "19.3.1";
   branch  = versions.major version;
 in
 
@@ -42,7 +42,7 @@ stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
       "https://mesa.freedesktop.org/archive/mesa-${version}.tar.xz"
     ];
-    sha256 = "17jp8ghipgz62vqqz5llskxypkcmgf8gnlgnj0pyvnbgi6vryyg3";
+    sha256 = "0ndfpqry08s74yw4x3ydyhim6v4ywg0b4yhaazq7zaankjv1v5fd";
   };
 
   prePatch = "patchShebangs .";
diff --git a/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch b/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch
index 1e280b64ee5..8ce3473dd32 100644
--- a/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch
+++ b/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch
@@ -1,4 +1,4 @@
-From 2a1e32b4105fe95413a615a44d40938920ea1a19 Mon Sep 17 00:00:00 2001
+From 6d22383149e4cdc646c68e29238f41d895a4705b Mon Sep 17 00:00:00 2001
 From: David McFarland <corngood@gmail.com>
 Date: Mon, 6 Aug 2018 15:52:11 -0300
 Subject: [PATCH] disk_cache: include dri driver path in cache key
@@ -12,10 +12,10 @@ timestamps in /nix/store are zero.
  3 files changed, 15 insertions(+), 1 deletion(-)
 
 diff --git a/meson_options.txt b/meson_options.txt
-index a723b5406cf..65a8954291f 100644
+index 626baf3..579c15b 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
-@@ -330,3 +330,9 @@ option(
+@@ -341,6 +341,12 @@ option(
    value : true,
    description : 'Enable direct rendering in GLX and EGL for DRI',
  )
@@ -25,11 +25,14 @@ index a723b5406cf..65a8954291f 100644
 +  value : '',
 +  description : 'Mesa cache key.'
 +)
+ option(
+   'I-love-half-baked-turnips',
+   type : 'boolean',
 diff --git a/src/util/disk_cache.c b/src/util/disk_cache.c
-index 0aa2646a9bb..bd784d38e21 100644
+index 0cd92ca..fc1c173 100644
 --- a/src/util/disk_cache.c
 +++ b/src/util/disk_cache.c
-@@ -389,8 +389,10 @@ disk_cache_create(const char *gpu_name, const char *driver_id,
+@@ -395,8 +395,10 @@ disk_cache_create(const char *gpu_name, const char *driver_id,
  
     /* Create driver id keys */
     size_t id_size = strlen(driver_id) + 1;
@@ -40,7 +43,7 @@ index 0aa2646a9bb..bd784d38e21 100644
     cache->driver_keys_blob_size += gpu_name_size;
  
     /* We sometimes store entire structs that contains a pointers in the cache,
-@@ -411,6 +413,7 @@ disk_cache_create(const char *gpu_name, const char *driver_id,
+@@ -417,6 +419,7 @@ disk_cache_create(const char *gpu_name, const char *driver_id,
     uint8_t *drv_key_blob = cache->driver_keys_blob;
     DRV_KEY_CPY(drv_key_blob, &cache_version, cv_size)
     DRV_KEY_CPY(drv_key_blob, driver_id, id_size)
@@ -49,13 +52,13 @@ index 0aa2646a9bb..bd784d38e21 100644
     DRV_KEY_CPY(drv_key_blob, &ptr_size, ptr_size_size)
     DRV_KEY_CPY(drv_key_blob, &driver_flags, driver_flags_size)
 diff --git a/src/util/meson.build b/src/util/meson.build
-index 397c2228129..77013563e5d 100644
+index f69ebe9..e2bd8e2 100644
 --- a/src/util/meson.build
 +++ b/src/util/meson.build
-@@ -120,7 +120,12 @@ libmesa_util = static_library(
+@@ -158,7 +158,12 @@ _libmesa_util = static_library(
    [files_mesa_util, format_srgb],
    include_directories : inc_common,
-   dependencies : [dep_zlib, dep_clock, dep_thread, dep_atomic, dep_m],
+   dependencies : deps_for_libmesa_util,
 -  c_args : [c_msvc_compat_args, c_vis_args],
 +  c_args : [
 +    c_msvc_compat_args, c_vis_args,
@@ -67,5 +70,5 @@ index 397c2228129..77013563e5d 100644
  )
  
 -- 
-2.19.2
+2.24.1
 
diff --git a/pkgs/development/libraries/science/math/openblas/default.nix b/pkgs/development/libraries/science/math/openblas/default.nix
index f8d392691ab..a26cf38a9d0 100644
--- a/pkgs/development/libraries/science/math/openblas/default.nix
+++ b/pkgs/development/libraries/science/math/openblas/default.nix
@@ -8,6 +8,7 @@
 # See https://github.com/xianyi/OpenBLAS/blob/develop/TargetList.txt
 , target ? null
 , enableStatic ? false
+, enableShared ? true
 }:
 
 with stdenv.lib;
@@ -60,7 +61,7 @@ let
       TARGET = setTarget "ATHLON";
       DYNAMIC_ARCH = true;
       NO_AVX512 = true;
-      USE_OPENMP = true;
+      USE_OPENMP = !stdenv.hostPlatform.isMusl;
     };
   };
 in
@@ -115,6 +116,9 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     perl
     which
+  ];
+
+  depsBuildBuild = [
     buildPackages.gfortran
     buildPackages.stdenv.cc
   ];
@@ -126,6 +130,7 @@ stdenv.mkDerivation rec {
     NUM_THREADS = 64;
     INTERFACE64 = blas64;
     NO_STATIC = !enableStatic;
+    NO_SHARED = !enableShared;
     CROSS = stdenv.hostPlatform != stdenv.buildPlatform;
     HOSTCC = "cc";
     # Makefile.system only checks defined status
diff --git a/pkgs/development/libraries/snappy/default.nix b/pkgs/development/libraries/snappy/default.nix
index f35f5bfc55a..0ad1a4b2898 100644
--- a/pkgs/development/libraries/snappy/default.nix
+++ b/pkgs/development/libraries/snappy/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake }:
+{ stdenv, fetchFromGitHub, cmake, static ? false }:
 
 stdenv.mkDerivation rec {
   pname = "snappy";
@@ -17,7 +17,10 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
-  cmakeFlags = [ "-DBUILD_SHARED_LIBS=ON" "-DCMAKE_SKIP_BUILD_RPATH=OFF" ];
+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=${if static then "OFF" else "ON"}"
+    "-DCMAKE_SKIP_BUILD_RPATH=OFF"
+  ];
 
   postInstall = ''
     substituteInPlace "$out"/lib/cmake/Snappy/SnappyTargets.cmake \
@@ -29,7 +32,7 @@ stdenv.mkDerivation rec {
   doCheck = true;
 
   meta = with stdenv.lib; {
-    homepage = https://google.github.io/snappy/;
+    homepage = "https://google.github.io/snappy/";
     license = licenses.bsd3;
     description = "Compression/decompression library for very high speeds";
     platforms = platforms.all;
diff --git a/pkgs/development/libraries/thrift/default.nix b/pkgs/development/libraries/thrift/default.nix
index ecdb831fcfa..b1b66ed052f 100644
--- a/pkgs/development/libraries/thrift/default.nix
+++ b/pkgs/development/libraries/thrift/default.nix
@@ -1,6 +1,5 @@
-{ stdenv, fetchurl, boost, zlib, libevent, openssl, python, pkgconfig, bison
-, flex, twisted
-}:
+{ stdenv, fetchurl, boost, zlib, libevent, openssl, python, cmake, pkgconfig
+, bison, flex, twisted, static ? false }:
 
 stdenv.mkDerivation rec {
   pname = "thrift";
@@ -11,27 +10,36 @@ stdenv.mkDerivation rec {
     sha256 = "0yai9c3bdsrkkjshgim7zk0i7malwfprg00l9774dbrkh2w4ilvs";
   };
 
-  #enableParallelBuilding = true; problems on hydra
-
   # Workaround to make the python wrapper not drop this package:
   # pythonFull.buildEnv.override { extraLibs = [ thrift ]; }
   pythonPath = [];
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [
-    boost zlib libevent openssl python bison flex twisted
-  ];
+  nativeBuildInputs = [ cmake pkgconfig ];
+  buildInputs = [ boost zlib libevent openssl python bison flex ]
+    ++ stdenv.lib.optional (!static) twisted;
 
   preConfigure = "export PY_PREFIX=$out";
 
-  # TODO: package boost-test, so we can run the test suite. (Currently it fails
-  # to find libboost_unit_test_framework.a.)
-  configureFlags = [ "--enable-tests=no" ];
-  doCheck = false;
+  cmakeFlags = [
+    # FIXME: Fails to link in static mode with undefined reference to
+    # `boost::unit_test::unit_test_main(bool (*)(), int, char**)'
+    "-DBUILD_TESTING:BOOL=${if static then "OFF" else "ON"}"
+  ] ++ stdenv.lib.optionals static [
+    "-DWITH_STATIC_LIB:BOOL=ON"
+    "-DOPENSSL_USE_STATIC_LIBS=ON"
+  ];
+
+  doCheck = !static;
+  checkPhase = ''
+    runHook preCheck
+    LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/lib ctest -E PythonTestSSLSocket
+    runHook postCheck
+  '';
+  enableParallelChecking = false;
 
   meta = with stdenv.lib; {
     description = "Library for scalable cross-language services";
-    homepage = http://thrift.apache.org/;
+    homepage = "http://thrift.apache.org/";
     license = licenses.asl20;
     platforms = platforms.linux ++ platforms.darwin;
     maintainers = [ maintainers.bjornfor ];
diff --git a/pkgs/development/perl-modules/timedate-2020.patch b/pkgs/development/perl-modules/timedate-2020.patch
new file mode 100644
index 00000000000..ea4d8307f03
--- /dev/null
+++ b/pkgs/development/perl-modules/timedate-2020.patch
@@ -0,0 +1,12 @@
+Index: TimeDate-2.30/t/getdate.t
+===================================================================
+--- TimeDate-2.30.orig/t/getdate.t
++++ TimeDate-2.30/t/getdate.t
+@@ -156,7 +156,7 @@ Jul 22 10:00:00 UTC 2002         ;102733200
+ !;
+ 
+ require Time::Local;
+-my $offset = Time::Local::timegm(0,0,0,1,0,70);
++my $offset = Time::Local::timegm(0,0,0,1,0,1970);
+ 
+ @data = split(/\n/, $data);
diff --git a/pkgs/development/python-modules/numpy/default.nix b/pkgs/development/python-modules/numpy/default.nix
index 61f85773949..bdd76696885 100644
--- a/pkgs/development/python-modules/numpy/default.nix
+++ b/pkgs/development/python-modules/numpy/default.nix
@@ -1,4 +1,15 @@
-{ lib, fetchPypi, python, buildPythonPackage, gfortran, pytest, blas, writeTextFile, isPyPy }:
+{ lib
+, fetchPypi
+, python
+, buildPythonPackage
+, gfortran
+, pytest
+, blas
+, writeTextFile
+, isPyPy
+, cython
+, setuptoolsBuildHook
+ }:
 
 let
   blasImplementation = lib.nameFromURL blas.name "-";
@@ -16,15 +27,16 @@ let
   };
 in buildPythonPackage rec {
   pname = "numpy";
-  version = "1.17.4";
+  version = "1.18.0";
+  format = "pyproject.toml";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "f58913e9227400f1395c7b800503ebfdb0772f1c33ff8cb4d6451c06cabdf316";
+    sha256 = "a9d72d9abaf65628f0f31bbb573b7d9304e43b1e6bbae43149c17737a42764c4";
   };
 
-  nativeBuildInputs = [ gfortran pytest ];
+  nativeBuildInputs = [ gfortran pytest cython setuptoolsBuildHook ];
   buildInputs = [ blas ];
 
   patches = lib.optionals python.hasDistutilsCxxPatch [
diff --git a/pkgs/development/python-modules/pyopenssl/default.nix b/pkgs/development/python-modules/pyopenssl/default.nix
index 4e643257a0c..8d5f6291c26 100644
--- a/pkgs/development/python-modules/pyopenssl/default.nix
+++ b/pkgs/development/python-modules/pyopenssl/default.nix
@@ -10,6 +10,7 @@
 , flaky
 , glibcLocales
 , six
+, fetchpatch
 }:
 
 with stdenv.lib;
@@ -80,6 +81,27 @@ buildPythonPackage rec {
     runHook postCheck
   '';
 
+  patches = [
+    # 4 patches for 2020 bug
+    # https://github.com/pyca/pyopenssl/pull/828
+    (fetchpatch {
+      url = https://github.com/pyca/pyopenssl/commit/0d2fd1a24b30077ead6960bd63b4a9893a57c101.patch;
+      sha256 = "1c27g53qrwxddyx04sxf8yvj7xgbaabla7mc1cgbfd426rncbqf3";
+    })
+    (fetchpatch {
+      url = https://github.com/pyca/pyopenssl/commit/d08a742573c3205348a4eec9a65abaf6c16110c4.patch;
+      sha256 = "18xn8s1wpycz575ivrbsbs0qd2q48z8pdzsjzh8i60xba3f8yj2f";
+    })
+    (fetchpatch {
+      url = https://github.com/pyca/pyopenssl/commit/60b9e10e6da7ccafaf722def630285f54510ed12.patch;
+      sha256 = "0aw8qvy8m0bhgp39lmbcrpprpg4bhpssm327hyrk476wwgajk01j";
+    })
+    (fetchpatch {
+      url = https://github.com/pyca/pyopenssl/commit/7a37cc23fcbe43abe785cd4badd14bdc7acfb175.patch;
+      sha256 = "1c7zb568rs71rsl16p6dq7aixwlkgzfnba4vzmfvbmy3zsnaslq2";
+    })
+  ];
+
   # Seems to fail unpredictably on Darwin. See http://hydra.nixos.org/build/49877419/nixlog/1
   # for one example, but I've also seen ContextTests.test_set_verify_callback_exception fail.
   doCheck = !stdenv.isDarwin;
diff --git a/pkgs/development/tools/parsing/bison/3.x.nix b/pkgs/development/tools/parsing/bison/3.x.nix
index 5382ec421b7..0253fa27dc0 100644
--- a/pkgs/development/tools/parsing/bison/3.x.nix
+++ b/pkgs/development/tools/parsing/bison/3.x.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bison";
-  version = "3.4.2";
+  version = "3.5";
 
   src = fetchurl {
     url = "mirror://gnu/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "1kzsb6fmmpq00l2s55hyb4dbsmz8f3a64ria6354wlbx6ypj4fgz";
+    sha256 = "1l8k2fcklwy0y57yidxvk5lbf0kb96ci3zffg2djivk8k05j0dhb";
   };
 
   nativeBuildInputs = [ m4 perl ] ++ stdenv.lib.optional stdenv.isSunOS help2man;
diff --git a/pkgs/development/web/woff2/brotli-static.patch b/pkgs/development/web/woff2/brotli-static.patch
new file mode 100644
index 00000000000..4ed6d7e741a
--- /dev/null
+++ b/pkgs/development/web/woff2/brotli-static.patch
@@ -0,0 +1,36 @@
+diff a/cmake/FindBrotliDec.cmake b/cmake/FindBrotliDec.cmake
+--- a/cmake/FindBrotliDec.cmake
++++ b/cmake/FindBrotliDec.cmake
+@@ -18,10 +18,10 @@ find_path(BROTLIDEC_INCLUDE_DIRS
+     HINTS ${PC_BROTLIDEC_INCLUDEDIR}
+ )
+ 
+-find_library(BROTLIDEC_LIBRARIES
+-    NAMES brotlidec
+-    HINTS ${PC_BROTLIDEC_LIBDIR}
+-)
++if(NOT BUILD_SHARED_LIBS)
++  set(_S "STATIC_")
++endif()
++set(BROTLIDEC_LIBRARIES ${PC_BROTLIDEC_${_S}LIBRARIES})
+ 
+ include(FindPackageHandleStandardArgs)
+ find_package_handle_standard_args(BrotliDec
+diff a/cmake/FindBrotliEnc.cmake b/cmake/FindBrotliEnc.cmake
+--- a/cmake/FindBrotliEnc.cmake
++++ b/cmake/FindBrotliEnc.cmake
+@@ -18,10 +18,10 @@ find_path(BROTLIENC_INCLUDE_DIRS
+     HINTS ${PC_BROTLIENC_INCLUDEDIR}
+ )
+ 
+-find_library(BROTLIENC_LIBRARIES
+-    NAMES brotlienc
+-    HINTS ${PC_BROTLIENC_LIBDIR}
+-)
++if(NOT BUILD_SHARED_LIBS)
++  set(_S "STATIC_")
++endif()
++set(BROTLIENC_LIBRARIES ${PC_BROTLIENC_${_S}LIBRARIES})
+ 
+ include(FindPackageHandleStandardArgs)
+ find_package_handle_standard_args(BrotliEnc
diff --git a/pkgs/development/web/woff2/default.nix b/pkgs/development/web/woff2/default.nix
index b77184e5652..ff0484547fc 100644
--- a/pkgs/development/web/woff2/default.nix
+++ b/pkgs/development/web/woff2/default.nix
@@ -1,4 +1,4 @@
-{ brotli, cmake, fetchFromGitHub, stdenv }:
+{ brotli, cmake, pkgconfig, fetchFromGitHub, stdenv, static ? false }:
 
 stdenv.mkDerivation rec {
   pname = "woff2";
@@ -13,18 +13,24 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" "lib" ];
 
-  nativeBuildInputs = [ cmake ];
+  # Need to explicitly link to brotlicommon
+  patches = stdenv.lib.optional static ./brotli-static.patch;
+
+  nativeBuildInputs = [ cmake pkgconfig ];
+
+  cmakeFlags = [ "-DBUILD_SHARED_LIBS=${if static then "OFF" else "ON"}" ]
+    ++ stdenv.lib.optional static "-DCMAKE_SKIP_RPATH:BOOL=TRUE";
 
   propagatedBuildInputs = [ brotli ];
 
-  # without this binaries only get built if shared libs are disable
-  patchPhase = ''
+  postPatch = ''
+    # without this binaries only get built if shared libs are disable
     sed 's@^if (NOT BUILD_SHARED_LIBS)$@if (TRUE)@g' -i CMakeLists.txt
   '';
 
   meta = with stdenv.lib; {
     description = "Webfont compression reference code";
-    homepage = https://github.com/google/woff2;
+    homepage = "https://github.com/google/woff2";
     license = licenses.mit;
     maintainers = [ maintainers.hrdinka ];
     platforms = platforms.unix;
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 3462801c07c..214c9b75cea 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -36,10 +36,10 @@ in stdenv.mkDerivation {
   # When updating, use https://github.com/systemd/systemd-stable tree, not the development one!
   # Also fresh patches should be cherry-picked from that tree to our current one.
   src = fetchFromGitHub {
-    owner = "NixOS";
+    owner = "nixos";
     repo = "systemd";
-    rev = "491a247eff9b7ce1e5877f5f3431517c95f3222f";
-    sha256 = "1xqiahapg480m165glrwqbfmc1fxw5sacdlm933cwyi1q8x4537g";
+    rev = "d8853d39a28b9884e0acd3ae5732a1e7caaf08af";
+    sha256 = "1wqm51i2czbbb3nara11mnxzqng4na1l8fvz7qnbxcrjsqm7hz18";
   };
 
   outputs = [ "out" "lib" "man" "dev" ];
@@ -263,6 +263,6 @@ in stdenv.mkDerivation {
     license = licenses.lgpl21Plus;
     platforms = platforms.linux;
     priority = 10;
-    maintainers = with maintainers; [ eelco andir mic92 ];
+    maintainers = with maintainers; [ andir eelco flokli mic92 ];
   };
 }
diff --git a/pkgs/tools/compression/zstd/default.nix b/pkgs/tools/compression/zstd/default.nix
index a3aecf88c90..82a6a3a8a53 100644
--- a/pkgs/tools/compression/zstd/default.nix
+++ b/pkgs/tools/compression/zstd/default.nix
@@ -1,7 +1,8 @@
-{ stdenv, fetchFromGitHub, fetchpatch, gnugrep
+{ stdenv, fetchFromGitHub, fetchpatch, cmake, gnugrep
 , fixDarwinDylibNames
 , file
-, legacySupport ? false }:
+, legacySupport ? false
+, enableShared ? true }:
 
 stdenv.mkDerivation rec {
   pname = "zstd";
@@ -14,56 +15,46 @@ stdenv.mkDerivation rec {
     owner = "facebook";
   };
 
+  nativeBuildInputs = [ cmake ]
+   ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
+
   patches = [
-    # All 3 from https://github.com/facebook/zstd/pull/1883
+    # From https://github.com/facebook/zstd/pull/1883
     (fetchpatch {
       url = "https://github.com/facebook/zstd/commit/106278e7e5fafaea3b7deb4147bdc8071562d2f0.diff";
       sha256 = "13z7id1qbc05cv1rmak7c8xrchp7jh1i623bq5pwcihg57wzcyr8";
     })
-    (fetchpatch {
-      url = "https://github.com/facebook/zstd/commit/0ede342acc2c26f87ae962fa88e158904d4198c4.diff";
-      sha256 = "12l5xbvnzkvr76mvl1ls767paqfwbd9q1pzq44ckacfpz4f6iaap";
-      excludes = [
-        # I think line endings are causing problems, or something like that
-        "programs/windres/generate_res.bat"
-      ];
-    })
-    (fetchpatch {
-      url = "https://github.com/facebook/zstd/commit/10552eaffef84c011f67af0e04f0780b50a5ab26.diff";
-      sha256 = "1s27ravar3rn7q8abybp9733jhpsfcaci51k04da94ahahvxwiqw";
-    })
   ] # This I didn't upstream because if you use posix threads with MinGW it will
     # work find, and I'm not sure how to write the condition.
     ++ stdenv.lib.optional stdenv.hostPlatform.isWindows ./mcfgthreads-no-pthread.patch;
 
-  nativeBuildInputs = stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
-
-  makeFlags = [
-    "ZSTD_LEGACY_SUPPORT=${if legacySupport then "1" else "0"}"
-  ] ++ stdenv.lib.optional stdenv.hostPlatform.isWindows "OS=Windows";
+  cmakeFlags = [
+    "-DZSTD_BUILD_SHARED:BOOL=${if enableShared then "ON" else "OFF"}"
+    "-DZSTD_LEGACY_SUPPORT:BOOL=${if legacySupport then "ON" else "OFF"}"
+    "-DZSTD_BUILD_TESTS:BOOL=ON"
+  ];
+  cmakeDir = "../build/cmake";
+  dontUseCmakeBuildDir = true;
+  preConfigure = ''
+    mkdir -p build_ && cd $_
+  '';
 
   checkInputs = [ file ];
   doCheck = true;
   preCheck = ''
-    substituteInPlace tests/playTests.sh \
+    substituteInPlace ../tests/playTests.sh \
       --replace 'MD5SUM="md5 -r"' 'MD5SUM="md5sum"'
   '';
 
-  installFlags = [
-    "PREFIX=$(out)"
-  ];
-
-  preInstall = ''
-    substituteInPlace programs/zstdgrep \
+  preInstall = stdenv.lib.optionalString enableShared ''
+    substituteInPlace ../programs/zstdgrep \
       --replace ":-grep" ":-${gnugrep}/bin/grep" \
       --replace ":-zstdcat" ":-$out/bin/zstdcat"
 
-    substituteInPlace programs/zstdless \
+    substituteInPlace ../programs/zstdless \
       --replace "zstdcat" "$out/bin/zstdcat"
   '';
 
-  enableParallelBuilding = true;
-
   meta = with stdenv.lib; {
     description = "Zstandard real-time compression algorithm";
     longDescription = ''
diff --git a/pkgs/tools/misc/file/default.nix b/pkgs/tools/misc/file/default.nix
index 9dd3970bbb2..24a7143d8e1 100644
--- a/pkgs/tools/misc/file/default.nix
+++ b/pkgs/tools/misc/file/default.nix
@@ -1,25 +1,17 @@
-{ stdenv, fetchurl, fetchpatch, file, zlib, libgnurx }:
+{ stdenv, fetchurl, file, zlib, libgnurx }:
 
 stdenv.mkDerivation rec {
   pname = "file";
-  version = "5.37";
+  version = "5.38";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.astron.com/pub/file/${pname}-${version}.tar.gz"
       "https://distfiles.macports.org/file/${pname}-${version}.tar.gz"
     ];
-    sha256 = "0zz0p9bqnswfx0c16j8k62ivjq1m16x10xqv4hy9lcyxyxkkkhg9";
+    sha256 = "0d7s376b4xqymnrsjxi3nsv3f5v89pzfspzml2pcajdk5by2yg2r";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "CVE-2019-18218.patch";
-      url = "https://sources.debian.org/data/main/f/file/1:5.37-6/debian/patches/cherry-pick.FILE5_37-67-g46a8443f.limit-the-number-of-elements-in-a-vector-found-by-oss-fuzz.patch";
-      sha256 = "1i22y91yndc3n2p2ngczp1lwil8l05sp8ciicil74xrc5f91y6mj";
-    })
-  ];
-
   nativeBuildInputs = stdenv.lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) file;
   buildInputs = [ zlib ]
               ++ stdenv.lib.optional stdenv.hostPlatform.isWindows libgnurx;
diff --git a/pkgs/tools/misc/man-db/default.nix b/pkgs/tools/misc/man-db/default.nix
index 49e4ab44836..918e8372dcb 100644
--- a/pkgs/tools/misc/man-db/default.nix
+++ b/pkgs/tools/misc/man-db/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, pkgconfig, libpipeline, db, groff, libiconv, makeWrapper, buildPackages }:
 
 stdenv.mkDerivation rec {
-  name = "man-db-2.8.7";
+  name = "man-db-2.9.0";
 
   src = fetchurl {
     url = "mirror://savannah/man-db/${name}.tar.xz";
-    sha256 = "09mkpvwirv9kh2pqhfq90zl7pjdl63f4w4g1x6zhhp9hjswmpkdr";
+    sha256 = "0qg2sdn8mayya0ril484iz1r7hi46l68d2d80cr6lvc7x3csqjjx";
   };
 
   outputs = [ "out" "doc" ];
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 94ef3224998..db9c412877f 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -19541,6 +19541,8 @@ let
       url = mirror://cpan/authors/id/G/GB/GBARR/TimeDate-2.30.tar.gz;
       sha256 = "11lf54akr9nbivqkjrhvkmfdgkbhw85sq0q4mak56n6bf542bgbm";
     };
+    # https://rt.cpan.org/Public/Bug/Display.html?id=124509
+    patches = [ ../development/perl-modules/timedate-2020.patch ];
   };
 
   TimeDuration = buildPerlPackage {
diff --git a/pkgs/top-level/static.nix b/pkgs/top-level/static.nix
index 7736a265b94..40673426136 100644
--- a/pkgs/top-level/static.nix
+++ b/pkgs/top-level/static.nix
@@ -143,6 +143,9 @@ in {
     static = true;
     shared = false;
   };
+  fmt = super.fmt.override {
+    enableShared = false;
+  };
   gifsicle = super.gifsicle.override {
     static = true;
   };
@@ -152,7 +155,10 @@ in {
   optipng = super.optipng.override {
     static = true;
   };
-  openblas = super.openblas.override { enableStatic = true; };
+  openblas = super.openblas.override {
+    enableStatic = true;
+    enableShared = false;
+  };
   mkl = super.mkl.override { enableStatic = true; };
   nix = super.nix.override { withAWS = false; };
   # openssl 1.1 doesn't compile
@@ -163,6 +169,10 @@ in {
     # --disable-shared flag
     stdenv = super.stdenv;
   };
+  arrow-cpp = super.arrow-cpp.override {
+    enableShared = false;
+    python = { pkgs = { python = null; numpy = null; }; };
+  };
   boost = super.boost.override {
     enableStatic = true;
     enableShared = false;
@@ -171,9 +181,25 @@ in {
     # --disable-shared flag
     stdenv = super.stdenv;
   };
+  thrift = super.thrift.override {
+    static = true;
+    twisted = null;
+  };
+  double-conversion = super.double-conversion.override {
+    static = true;
+  };
   gmp = super.gmp.override {
     withStatic = true;
   };
+  gflags = super.gflags.override {
+    enableShared = false;
+  };
+  glog = super.glog.override {
+    static = true;
+  };
+  gtest = super.gtest.override {
+    static = true;
+  };
   cdo = super.cdo.override {
     enable_all_static = true;
   };
@@ -192,6 +218,12 @@ in {
     # it doesn’t like the --disable-shared flag
     stdenv = super.stdenv;
   };
+  woff2 = super.woff2.override {
+    static = true;
+  };
+  snappy = super.snappy.override {
+    static = true;
+  };
   lz4 = super.lz4.override {
     enableShared = false;
     enableStatic = true;
@@ -224,6 +256,10 @@ in {
     staticOnly = true;
   };
 
+  zstd = super.zstd.override {
+    enableShared = false;
+  };
+
   llvmPackages_8 = super.llvmPackages_8 // {
     libraries = super.llvmPackages_8.libraries // rec {
       libcxxabi = super.llvmPackages_8.libraries.libcxxabi.override {