Merge branch 'master' into staging-next

84 files changed, 865 insertions, 791 deletions

diff --git a/lib/systems/default.nix b/lib/systems/default.nix
index 0c0cdf1f11b..0d51be4b23b 100644
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@@ -79,6 +79,7 @@ rec {
         else if final.isAarch64 then "arm64"
         else if final.isx86_32 then "x86"
         else if final.isx86_64 then "ia64"
+        else if final.isMips then "mips"
         else final.parsed.cpu.name;
 
       qemuArch =
diff --git a/lib/systems/parse.nix b/lib/systems/parse.nix
index 5e12df32ffd..e923334a11b 100644
--- a/lib/systems/parse.nix
+++ b/lib/systems/parse.nix
@@ -327,6 +327,7 @@ rec {
         }
       ];
     };
+    gnuabi64     = { abi = "64"; };
 
     musleabi     = { float = "soft"; };
     musleabihf   = { float = "hard"; };
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index cacb4b13f41..24912c27245 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -620,7 +620,6 @@
   ./services/networking/iodine.nix
   ./services/networking/iperf3.nix
   ./services/networking/ircd-hybrid/default.nix
-  ./services/networking/jormungandr.nix
   ./services/networking/iwd.nix
   ./services/networking/keepalived/default.nix
   ./services/networking/keybase.nix
diff --git a/nixos/modules/services/misc/matrix-synapse.nix b/nixos/modules/services/misc/matrix-synapse.nix
index 0f4eb2ccfca..50661b873f6 100644
--- a/nixos/modules/services/misc/matrix-synapse.nix
+++ b/nixos/modules/services/misc/matrix-synapse.nix
@@ -407,6 +407,9 @@ in {
           "192.168.0.0/16"
           "100.64.0.0/10"
           "169.254.0.0/16"
+          "::1/128"
+          "fe80::/64"
+          "fc00::/7"
         ];
         description = ''
           List of IP address CIDR ranges that the URL preview spider is denied
diff --git a/nixos/modules/services/networking/jormungandr.nix b/nixos/modules/services/networking/jormungandr.nix
deleted file mode 100644
index 152cceb4bf9..00000000000
--- a/nixos/modules/services/networking/jormungandr.nix
+++ /dev/null
@@ -1,102 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  cfg = config.services.jormungandr;
-
-  inherit (lib) mkEnableOption mkIf mkOption;
-  inherit (lib) optionalString types;
-
-  dataDir = "/var/lib/jormungandr";
-
-  # Default settings so far, as the service matures we will
-  # move these out as separate settings
-  configSettings = {
-    storage = dataDir;
-    p2p = {
-      public_address = "/ip4/127.0.0.1/tcp/8299";
-      topics_of_interest = {
-        messages = "high";
-        blocks = "high";
-      };
-    };
-    rest = {
-      listen = "127.0.0.1:8607";
-    };
-  };
-
-  configFile = if cfg.configFile == null then
-    pkgs.writeText "jormungandr.yaml" (builtins.toJSON configSettings)
-  else cfg.configFile;
-
-in {
-
-  options = {
-
-    services.jormungandr = {
-      enable = mkEnableOption "jormungandr service";
-
-      configFile = mkOption {
-       type = types.nullOr types.path;
-       default = null;
-       example = "/var/lib/jormungandr/node.yaml";
-       description = ''
-         The path of the jormungandr blockchain configuration file in YAML format.
-         If no file is specified, a file is generated using the other options.
-       '';
-     };
-
-      secretFile = mkOption {
-       type = types.nullOr types.path;
-       default = null;
-       example = "/etc/secret/jormungandr.yaml";
-       description = ''
-         The path of the jormungandr blockchain secret node configuration file in
-         YAML format. Do not store this in nix store!
-       '';
-     };
-
-      genesisBlockHash = mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        example = "d70495af81ae8600aca3e642b2427327cb6001ec4d7a0037e96a00dabed163f9";
-        description = ''
-          Set the genesis block hash (the hash of the block0) so we can retrieve
-          the genesis block (and the blockchain configuration) from the existing
-          storage or from the network.
-        '';
-      };
-
-      genesisBlockFile = mkOption {
-        type = types.nullOr types.path;
-        default = null;
-        example = "/var/lib/jormungandr/block-0.bin";
-        description = ''
-          The path of the genesis block file if we are hosting it locally.
-        '';
-      };
-
-    };
-  };
-
-  config = mkIf cfg.enable {
-
-    systemd.services.jormungandr = {
-      description = "jormungandr server";
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network-online.target" ];
-      environment = {
-        RUST_BACKTRACE = "full";
-      };
-      serviceConfig = {
-        DynamicUser = true;
-        StateDirectory = baseNameOf dataDir;
-        ExecStart = ''
-          ${pkgs.jormungandr}/bin/jormungandr --config ${configFile} \
-            ${optionalString (cfg.secretFile != null) " --secret ${cfg.secretFile}"} \
-            ${optionalString (cfg.genesisBlockHash != null) " --genesis-block-hash ${cfg.genesisBlockHash}"} \
-            ${optionalString (cfg.genesisBlockFile != null) " --genesis-block ${cfg.genesisBlockFile}"}
-        '';
-      };
-    };
-  };
-}
diff --git a/nixos/modules/services/security/vault.nix b/nixos/modules/services/security/vault.nix
index d5962ba9af9..b0ab8fadcbe 100644
--- a/nixos/modules/services/security/vault.nix
+++ b/nixos/modules/services/security/vault.nix
@@ -119,9 +119,8 @@ in
     };
     users.groups.vault.gid = config.ids.gids.vault;
 
-    systemd.tmpfiles.rules = optional (cfg.storagePath != null) [
-      "d '${cfg.storagePath}' 0700 vault vault - -"
-    ];
+    systemd.tmpfiles.rules = optional (cfg.storagePath != null)
+      "d '${cfg.storagePath}' 0700 vault vault - -";
 
     systemd.services.vault = {
       description = "Vault server daemon";
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 1d933153ffa..5e7c8a7f4b5 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -135,7 +135,6 @@ in
   jackett = handleTest ./jackett.nix {};
   jellyfin = handleTest ./jellyfin.nix {};
   jenkins = handleTest ./jenkins.nix {};
-  jormungandr = handleTest ./jormungandr.nix {};
   kafka = handleTest ./kafka.nix {};
   kerberos = handleTest ./kerberos/default.nix {};
   kernel-latest = handleTest ./kernel-latest.nix {};
@@ -243,7 +242,6 @@ in
   prosodyMysql = handleTest ./xmpp/prosody-mysql.nix {};
   proxy = handleTest ./proxy.nix {};
   quagga = handleTest ./quagga.nix {};
-  quake3 = handleTest ./quake3.nix {};
   rabbitmq = handleTest ./rabbitmq.nix {};
   radarr = handleTest ./radarr.nix {};
   radicale = handleTest ./radicale.nix {};
diff --git a/nixos/tests/atd.nix b/nixos/tests/atd.nix
index 25db7279924..c3abe5c253d 100644
--- a/nixos/tests/atd.nix
+++ b/nixos/tests/atd.nix
@@ -1,4 +1,4 @@
-import ./make-test.nix ({ pkgs, ... }:
+import ./make-test-python.nix ({ pkgs, ... }:
 
 {
   name = "atd";
@@ -14,18 +14,18 @@ import ./make-test.nix ({ pkgs, ... }:
 
   # "at" has a resolution of 1 minute
   testScript = ''
-    startAll;
+    start_all()
 
-    $machine->waitForUnit('atd.service'); # wait for atd to start
-    $machine->fail("test -f ~root/at-1");
-    $machine->fail("test -f ~alice/at-1");
+    machine.wait_for_unit("atd.service")  # wait for atd to start
+    machine.fail("test -f ~root/at-1")
+    machine.fail("test -f ~alice/at-1")
 
-    $machine->succeed("echo 'touch ~root/at-1' | at now+1min");
-    $machine->succeed("su - alice -c \"echo 'touch at-1' | at now+1min\"");
+    machine.succeed("echo 'touch ~root/at-1' | at now+1min")
+    machine.succeed("su - alice -c \"echo 'touch at-1' | at now+1min\"")
 
-    $machine->succeed("sleep 1.5m");
+    machine.succeed("sleep 1.5m")
 
-    $machine->succeed("test -f ~root/at-1");
-    $machine->succeed("test -f ~alice/at-1");
+    machine.succeed("test -f ~root/at-1")
+    machine.succeed("test -f ~alice/at-1")
   '';
 })
diff --git a/nixos/tests/avahi.nix b/nixos/tests/avahi.nix
index ae4f54d5266..fe027c14d5a 100644
--- a/nixos/tests/avahi.nix
+++ b/nixos/tests/avahi.nix
@@ -1,5 +1,5 @@
 # Test whether `avahi-daemon' and `libnss-mdns' work as expected.
-import ./make-test.nix ({ pkgs, ... } : {
+import ./make-test-python.nix ({ pkgs, ... } : {
   name = "avahi";
   meta = with pkgs.stdenv.lib.maintainers; {
     maintainers = [ eelco ];
@@ -23,45 +23,45 @@ import ./make-test.nix ({ pkgs, ... } : {
     two = cfg;
   };
 
-  testScript =
-    '' startAll;
+  testScript = ''
+    start_all()
 
-       # mDNS.
-       $one->waitForUnit("network.target");
-       $two->waitForUnit("network.target");
+    # mDNS.
+    one.wait_for_unit("network.target")
+    two.wait_for_unit("network.target")
 
-       $one->succeed("avahi-resolve-host-name one.local | tee out >&2");
-       $one->succeed("test \"`cut -f1 < out`\" = one.local");
-       $one->succeed("avahi-resolve-host-name two.local | tee out >&2");
-       $one->succeed("test \"`cut -f1 < out`\" = two.local");
+    one.succeed("avahi-resolve-host-name one.local | tee out >&2")
+    one.succeed('test "`cut -f1 < out`" = one.local')
+    one.succeed("avahi-resolve-host-name two.local | tee out >&2")
+    one.succeed('test "`cut -f1 < out`" = two.local')
 
-       $two->succeed("avahi-resolve-host-name one.local | tee out >&2");
-       $two->succeed("test \"`cut -f1 < out`\" = one.local");
-       $two->succeed("avahi-resolve-host-name two.local | tee out >&2");
-       $two->succeed("test \"`cut -f1 < out`\" = two.local");
+    two.succeed("avahi-resolve-host-name one.local | tee out >&2")
+    two.succeed('test "`cut -f1 < out`" = one.local')
+    two.succeed("avahi-resolve-host-name two.local | tee out >&2")
+    two.succeed('test "`cut -f1 < out`" = two.local')
 
-       # Basic DNS-SD.
-       $one->succeed("avahi-browse -r -t _workstation._tcp | tee out >&2");
-       $one->succeed("test `wc -l < out` -gt 0");
-       $two->succeed("avahi-browse -r -t _workstation._tcp | tee out >&2");
-       $two->succeed("test `wc -l < out` -gt 0");
+    # Basic DNS-SD.
+    one.succeed("avahi-browse -r -t _workstation._tcp | tee out >&2")
+    one.succeed("test `wc -l < out` -gt 0")
+    two.succeed("avahi-browse -r -t _workstation._tcp | tee out >&2")
+    two.succeed("test `wc -l < out` -gt 0")
 
-       # More DNS-SD.
-       $one->execute("avahi-publish -s \"This is a test\" _test._tcp 123 one=1 &");
-       $one->sleep(5);
-       $two->succeed("avahi-browse -r -t _test._tcp | tee out >&2");
-       $two->succeed("test `wc -l < out` -gt 0");
+    # More DNS-SD.
+    one.execute('avahi-publish -s "This is a test" _test._tcp 123 one=1 &')
+    one.sleep(5)
+    two.succeed("avahi-browse -r -t _test._tcp | tee out >&2")
+    two.succeed("test `wc -l < out` -gt 0")
 
-       # NSS-mDNS.
-       $one->succeed("getent hosts one.local >&2");
-       $one->succeed("getent hosts two.local >&2");
-       $two->succeed("getent hosts one.local >&2");
-       $two->succeed("getent hosts two.local >&2");
+    # NSS-mDNS.
+    one.succeed("getent hosts one.local >&2")
+    one.succeed("getent hosts two.local >&2")
+    two.succeed("getent hosts one.local >&2")
+    two.succeed("getent hosts two.local >&2")
 
-       # extra service definitions
-       $one->succeed("avahi-browse -r -t _ssh._tcp | tee out >&2");
-       $one->succeed("test `wc -l < out` -gt 0");
-       $two->succeed("avahi-browse -r -t _ssh._tcp | tee out >&2");
-       $two->succeed("test `wc -l < out` -gt 0");
-    '';
+    # extra service definitions
+    one.succeed("avahi-browse -r -t _ssh._tcp | tee out >&2")
+    one.succeed("test `wc -l < out` -gt 0")
+    two.succeed("avahi-browse -r -t _ssh._tcp | tee out >&2")
+    two.succeed("test `wc -l < out` -gt 0")
+  '';
 })
diff --git a/nixos/tests/babeld.nix b/nixos/tests/babeld.nix
index 5242cf395d7..fafa788ba57 100644
--- a/nixos/tests/babeld.nix
+++ b/nixos/tests/babeld.nix
@@ -1,5 +1,5 @@
 
-import ./make-test.nix ({ pkgs, lib, ...} : {
+import ./make-test-python.nix ({ pkgs, lib, ...} : {
   name = "babeld";
   meta = with pkgs.stdenv.lib.maintainers; {
     maintainers = [ hexa ];
@@ -21,7 +21,7 @@ import ./make-test.nix ({ pkgs, lib, ...} : {
         };
       };
 
-      localRouter = { pkgs, lib, ... }:
+      local_router = { pkgs, lib, ... }:
       {
         virtualisation.vlans = [ 10 20 ];
 
@@ -70,7 +70,7 @@ import ./make-test.nix ({ pkgs, lib, ...} : {
           '';
         };
       };
-      remoteRouter = { pkgs, lib, ... }:
+      remote_router = { pkgs, lib, ... }:
       {
         virtualisation.vlans = [ 20 30 ];
 
@@ -124,25 +124,25 @@ import ./make-test.nix ({ pkgs, lib, ...} : {
 
   testScript =
     ''
-      startAll;
+      start_all()
 
-      $client->waitForUnit("network-online.target");
-      $localRouter->waitForUnit("network-online.target");
-      $remoteRouter->waitForUnit("network-online.target");
+      client.wait_for_unit("network-online.target")
+      local_router.wait_for_unit("network-online.target")
+      remote_router.wait_for_unit("network-online.target")
 
-      $localRouter->waitForUnit("babeld.service");
-      $remoteRouter->waitForUnit("babeld.service");
+      local_router.wait_for_unit("babeld.service")
+      remote_router.wait_for_unit("babeld.service")
 
-      $localRouter->waitUntilSucceeds("ip route get 192.168.30.1");
-      $localRouter->waitUntilSucceeds("ip route get 2001:db8:30::1");
+      local_router.wait_until_succeeds("ip route get 192.168.30.1")
+      local_router.wait_until_succeeds("ip route get 2001:db8:30::1")
 
-      $remoteRouter->waitUntilSucceeds("ip route get 192.168.10.1");
-      $remoteRouter->waitUntilSucceeds("ip route get 2001:db8:10::1");
+      remote_router.wait_until_succeeds("ip route get 192.168.10.1")
+      remote_router.wait_until_succeeds("ip route get 2001:db8:10::1")
 
-      $client->succeed("ping -c1 192.168.30.1");
-      $client->succeed("ping -c1 2001:db8:30::1");
+      client.succeed("ping -c1 192.168.30.1")
+      client.succeed("ping -c1 2001:db8:30::1")
 
-      $remoteRouter->succeed("ping -c1 192.168.10.2");
-      $remoteRouter->succeed("ping -c1 2001:db8:10::2");
+      remote_router.succeed("ping -c1 192.168.10.2")
+      remote_router.succeed("ping -c1 2001:db8:10::2")
     '';
 })
diff --git a/nixos/tests/bcachefs.nix b/nixos/tests/bcachefs.nix
index 658676ef0ab..0541e580322 100644
--- a/nixos/tests/bcachefs.nix
+++ b/nixos/tests/bcachefs.nix
@@ -1,4 +1,4 @@
-import ./make-test.nix ({ pkgs, ... }: {
+import ./make-test-python.nix ({ pkgs, ... }: {
   name = "bcachefs";
   meta.maintainers = with pkgs.stdenv.lib.maintainers; [ chiiruno ];
 
@@ -10,29 +10,25 @@ import ./make-test.nix ({ pkgs, ... }: {
   };
 
   testScript = ''
-    $machine->succeed("modprobe bcachefs");
-    $machine->succeed("bcachefs version");
-    $machine->succeed("ls /dev");
+    machine.succeed("modprobe bcachefs")
+    machine.succeed("bcachefs version")
+    machine.succeed("ls /dev")
     
-    $machine->succeed(
-      "mkdir /tmp/mnt",
-
-      "udevadm settle",
-      "parted --script /dev/vdb mklabel msdos",
-      "parted --script /dev/vdb -- mkpart primary 1024M -1s",
-      "udevadm settle",
-
-      # Due to #32279, we cannot use encryption for this test yet
-      # "echo password | bcachefs format --encrypted /dev/vdb1",
-      # "echo password | bcachefs unlock /dev/vdb1",
-      "bcachefs format /dev/vdb1",
-      "mount -t bcachefs /dev/vdb1 /tmp/mnt",
-      "udevadm settle",
-
-      "bcachefs fs usage /tmp/mnt",
-
-      "umount /tmp/mnt",
-      "udevadm settle"
-    );
+    machine.succeed(
+        "mkdir /tmp/mnt",
+        "udevadm settle",
+        "parted --script /dev/vdb mklabel msdos",
+        "parted --script /dev/vdb -- mkpart primary 1024M -1s",
+        "udevadm settle",
+        # Due to #32279, we cannot use encryption for this test yet
+        # "echo password | bcachefs format --encrypted /dev/vdb1",
+        # "echo password | bcachefs unlock /dev/vdb1",
+        "bcachefs format /dev/vdb1",
+        "mount -t bcachefs /dev/vdb1 /tmp/mnt",
+        "udevadm settle",
+        "bcachefs fs usage /tmp/mnt",
+        "umount /tmp/mnt",
+        "udevadm settle",
+    )
   '';
 })
diff --git a/nixos/tests/beanstalkd.nix b/nixos/tests/beanstalkd.nix
index fa2fbc2c92a..4f4a454fb47 100644
--- a/nixos/tests/beanstalkd.nix
+++ b/nixos/tests/beanstalkd.nix
@@ -1,4 +1,4 @@
-import ./make-test.nix ({ pkgs, lib, ... }:
+import ./make-test-python.nix ({ pkgs, lib, ... }:
 
 let
   pythonEnv = pkgs.python3.withPackages (p: [p.beanstalkc]);
@@ -34,12 +34,16 @@ in
     };
 
   testScript = ''
-    startAll;
+    start_all()
 
-    $machine->waitForUnit('beanstalkd.service');
+    machine.wait_for_unit("beanstalkd.service")
 
-    $machine->succeed("${produce}");
-    $machine->succeed("${consume}") eq "this is a job\n" or die;
-    $machine->succeed("${consume}") eq "this is another job\n" or die;
+    machine.succeed("${produce}")
+    assert "this is a job\n" == machine.succeed(
+        "${consume}"
+    )
+    assert "this is another job\n" == machine.succeed(
+        "${consume}"
+    )
   '';
 })
diff --git a/nixos/tests/bind.nix b/nixos/tests/bind.nix
index 1f8c1dc7be4..09917b15a8e 100644
--- a/nixos/tests/bind.nix
+++ b/nixos/tests/bind.nix
@@ -1,4 +1,4 @@
-import ./make-test.nix {
+import ./make-test-python.nix {
   name = "bind";
 
   machine = { pkgs, lib, ... }: {
@@ -20,8 +20,8 @@ import ./make-test.nix {
   };
 
   testScript = ''
-    $machine->waitForUnit('bind.service');
-    $machine->waitForOpenPort(53);
-    $machine->succeed('host 192.168.0.1 127.0.0.1 | grep -qF ns.example.org');
+    machine.wait_for_unit("bind.service")
+    machine.wait_for_open_port(53)
+    machine.succeed("host 192.168.0.1 127.0.0.1 | grep -qF ns.example.org")
   '';
 }
diff --git a/nixos/tests/boot-stage1.nix b/nixos/tests/boot-stage1.nix
index b2e74bff6fc..cfb2ccb8285 100644
--- a/nixos/tests/boot-stage1.nix
+++ b/nixos/tests/boot-stage1.nix
@@ -1,4 +1,4 @@
-import ./make-test.nix ({ pkgs, ... }: {
+import ./make-test-python.nix ({ pkgs, ... }: {
   name = "boot-stage1";
 
   machine = { config, pkgs, lib, ... }: {
@@ -150,12 +150,12 @@ import ./make-test.nix ({ pkgs, ... }: {
   };
 
   testScript = ''
-    $machine->waitForUnit("multi-user.target");
-    $machine->succeed('test -s /run/canary2.pid');
-    $machine->fail('pgrep -a canary1');
-    $machine->fail('kill -0 $(< /run/canary2.pid)');
-    $machine->succeed('pgrep -a -f \'^@canary3$\''');
-    $machine->succeed('pgrep -a -f \'^kcanary$\''');
+    machine.wait_for_unit("multi-user.target")
+    machine.succeed("test -s /run/canary2.pid")
+    machine.fail("pgrep -a canary1")
+    machine.fail("kill -0 $(< /run/canary2.pid)")
+    machine.succeed('pgrep -a -f "^@canary3$"')
+    machine.succeed('pgrep -a -f "^kcanary$"')
   '';
 
   meta.maintainers = with pkgs.stdenv.lib.maintainers; [ aszlig ];
diff --git a/nixos/tests/borgbackup.nix b/nixos/tests/borgbackup.nix
index 165f64b0d6d..d97471e293e 100644
--- a/nixos/tests/borgbackup.nix
+++ b/nixos/tests/borgbackup.nix
@@ -1,4 +1,4 @@
-import ./make-test.nix ({ pkgs, ... }:
+import ./make-test-python.nix ({ pkgs, ... }:
 
 let
   passphrase = "supersecret";
@@ -106,60 +106,70 @@ in {
   };
 
   testScript = ''
-    startAll;
-
-    $client->fail('test -d "${remoteRepo}"');
-
-    $client->succeed("cp ${privateKey} /root/id_ed25519");
-    $client->succeed("chmod 0600 /root/id_ed25519");
-    $client->succeed("cp ${privateKeyAppendOnly} /root/id_ed25519.appendOnly");
-    $client->succeed("chmod 0600 /root/id_ed25519.appendOnly");
-
-    $client->succeed("mkdir -p ${dataDir}");
-    $client->succeed("touch ${dataDir}/${excludeFile}");
-    $client->succeed("echo '${keepFileData}' > ${dataDir}/${keepFile}");
-
-    subtest "local", sub {
-      my $borg = "BORG_PASSPHRASE='${passphrase}' borg";
-      $client->systemctl("start --wait borgbackup-job-local");
-      $client->fail("systemctl is-failed borgbackup-job-local");
-      # Make sure exactly one archive has been created
-      $client->succeed("c=\$($borg list '${localRepo}' | wc -l) && [[ \$c == '1' ]]");
-      # Make sure excludeFile has been excluded
-      $client->fail("$borg list '${localRepo}::${archiveName}' | grep -qF '${excludeFile}'");
-      # Make sure keepFile has the correct content
-      $client->succeed("$borg extract '${localRepo}::${archiveName}'");
-      $client->succeed('c=$(cat ${dataDir}/${keepFile}) && [[ "$c" == "${keepFileData}" ]]');
-      # Make sure the same is true when using `borg mount`
-      $client->succeed("mkdir -p /mnt/borg && $borg mount '${localRepo}::${archiveName}' /mnt/borg");
-      $client->succeed('c=$(cat /mnt/borg/${dataDir}/${keepFile}) && [[ "$c" == "${keepFileData}" ]]');
-    };
-
-    subtest "remote", sub {
-      my $borg = "BORG_RSH='ssh -oStrictHostKeyChecking=no -i /root/id_ed25519' borg";
-      $server->waitForUnit("sshd.service");
-      $client->waitForUnit("network.target");
-      $client->systemctl("start --wait borgbackup-job-remote");
-      $client->fail("systemctl is-failed borgbackup-job-remote");
-
-      # Make sure we can't access repos other than the specified one
-      $client->fail("$borg list borg\@server:wrong");
-
-      #TODO: Make sure that data is actually deleted
-    };
-
-    subtest "remoteAppendOnly", sub {
-      my $borg = "BORG_RSH='ssh -oStrictHostKeyChecking=no -i /root/id_ed25519.appendOnly' borg";
-      $server->waitForUnit("sshd.service");
-      $client->waitForUnit("network.target");
-      $client->systemctl("start --wait borgbackup-job-remoteAppendOnly");
-      $client->fail("systemctl is-failed borgbackup-job-remoteAppendOnly");
-
-      # Make sure we can't access repos other than the specified one
-      $client->fail("$borg list borg\@server:wrong");
-
-      #TODO: Make sure that data is not actually deleted
-    };
-
+    start_all()
+
+    client.fail('test -d "${remoteRepo}"')
+
+    client.succeed(
+        "cp ${privateKey} /root/id_ed25519"
+    )
+    client.succeed("chmod 0600 /root/id_ed25519")
+    client.succeed(
+        "cp ${privateKeyAppendOnly} /root/id_ed25519.appendOnly"
+    )
+    client.succeed("chmod 0600 /root/id_ed25519.appendOnly")
+
+    client.succeed("mkdir -p ${dataDir}")
+    client.succeed("touch ${dataDir}/${excludeFile}")
+    client.succeed("echo '${keepFileData}' > ${dataDir}/${keepFile}")
+
+    with subtest("local"):
+        borg = "BORG_PASSPHRASE='${passphrase}' borg"
+        client.systemctl("start --wait borgbackup-job-local")
+        client.fail("systemctl is-failed borgbackup-job-local")
+        # Make sure exactly one archive has been created
+        assert int(client.succeed("{} list '${localRepo}' | wc -l".format(borg))) > 0
+        # Make sure excludeFile has been excluded
+        client.fail(
+            "{} list '${localRepo}::${archiveName}' | grep -qF '${excludeFile}'".format(borg)
+        )
+        # Make sure keepFile has the correct content
+        client.succeed("{} extract '${localRepo}::${archiveName}'".format(borg))
+        assert "${keepFileData}" in client.succeed("cat ${dataDir}/${keepFile}")
+        # Make sure the same is true when using `borg mount`
+        client.succeed(
+            "mkdir -p /mnt/borg && {} mount '${localRepo}::${archiveName}' /mnt/borg".format(
+                borg
+            )
+        )
+        assert "${keepFileData}" in client.succeed(
+            "cat /mnt/borg/${dataDir}/${keepFile}"
+        )
+
+    with subtest("remote"):
+        borg = "BORG_RSH='ssh -oStrictHostKeyChecking=no -i /root/id_ed25519' borg"
+        server.wait_for_unit("sshd.service")
+        client.wait_for_unit("network.target")
+        client.systemctl("start --wait borgbackup-job-remote")
+        client.fail("systemctl is-failed borgbackup-job-remote")
+
+        # Make sure we can't access repos other than the specified one
+        client.fail("{} list borg\@server:wrong".format(borg))
+
+        # TODO: Make sure that data is actually deleted
+
+    with subtest("remoteAppendOnly"):
+        borg = (
+            "BORG_RSH='ssh -oStrictHostKeyChecking=no -i /root/id_ed25519.appendOnly' borg"
+        )
+        server.wait_for_unit("sshd.service")
+        client.wait_for_unit("network.target")
+        client.systemctl("start --wait borgbackup-job-remoteAppendOnly")
+        client.fail("systemctl is-failed borgbackup-job-remoteAppendOnly")
+
+        # Make sure we can't access repos other than the specified one
+        client.fail("{} list borg\@server:wrong".format(borg))
+
+        # TODO: Make sure that data is not actually deleted
   '';
 })
diff --git a/nixos/tests/gjs.nix b/nixos/tests/gjs.nix
index e6002ef98dd..87c8d7f2817 100644
--- a/nixos/tests/gjs.nix
+++ b/nixos/tests/gjs.nix
@@ -3,13 +3,13 @@ import ./make-test.nix ({ pkgs, ... }: {
   name = "gjs";
 
   meta = {
-    maintainers = pkgs.gnome3.gjs.meta.maintainers;
+    maintainers = pkgs.gjs.meta.maintainers;
   };
 
   machine = { pkgs, ... }: {
     imports = [ ./common/x11.nix ];
     environment.systemPackages = with pkgs; [ gnome-desktop-testing ];
-    environment.variables.XDG_DATA_DIRS = [ "${pkgs.gnome3.gjs.installedTests}/share" ];
+    environment.variables.XDG_DATA_DIRS = [ "${pkgs.gjs.installedTests}/share" ];
   };
 
   testScript = ''
diff --git a/nixos/tests/jormungandr.nix b/nixos/tests/jormungandr.nix
deleted file mode 100644
index 2abafc53ce5..00000000000
--- a/nixos/tests/jormungandr.nix
+++ /dev/null
@@ -1,77 +0,0 @@
-import ./make-test.nix ({ pkgs, ... }: {
-  name = "jormungandr";
-  meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = [ mmahut ];
-  };
-
-  nodes = {
-    # Testing the Byzantine Fault Tolerant protocol
-    bft = { ... }: {
-      environment.systemPackages = [ pkgs.jormungandr ];
-      services.jormungandr.enable = true;
-      services.jormungandr.genesisBlockFile = "/var/lib/jormungandr/block-0.bin";
-      services.jormungandr.secretFile = "/etc/secrets/jormungandr.yaml";
-    };
-
-    # Testing the Ouroboros Genesis Praos protocol
-    genesis = { ... }: {
-      environment.systemPackages = [ pkgs.jormungandr ];
-      services.jormungandr.enable = true;
-      services.jormungandr.genesisBlockFile = "/var/lib/jormungandr/block-0.bin";
-      services.jormungandr.secretFile = "/etc/secrets/jormungandr.yaml";
-    };
-  };
-
-  testScript = ''
-    startAll;
-
-    ## Testing BFT
-    # Let's wait for the StateDirectory
-    $bft->waitForFile("/var/lib/jormungandr/");
-
-    # First, we generate the genesis file for our new blockchain
-    $bft->succeed("jcli genesis init > /root/genesis.yaml");
-
-    # We need to generate our secret key
-    $bft->succeed("jcli key generate --type=Ed25519 > /root/key.prv");
-
-    # We include the secret key into our services.jormungandr.secretFile
-    $bft->succeed("mkdir -p /etc/secrets");
-    $bft->succeed("echo -e \"bft:\\n signing_key:\" \$(cat /root/key.prv) > /etc/secrets/jormungandr.yaml");
-
-    # After that, we generate our public key from it
-    $bft->succeed("cat /root/key.prv | jcli key to-public > /root/key.pub");
-
-    # We add our public key as a consensus leader in the genesis configration file
-    $bft->succeed("sed -ie \"s/ed25519_pk1vvwp2s0n5jl5f4xcjurp2e92sj2awehkrydrlas4vgqr7xzt33jsadha32/\$(cat /root/key.pub)/\" /root/genesis.yaml");
-
-    # Now we can generate the genesis block from it
-    $bft->succeed("jcli genesis encode --input /root/genesis.yaml --output /var/lib/jormungandr/block-0.bin");
-
-    # We should have everything to start the service now
-    $bft->succeed("systemctl restart jormungandr");
-    $bft->waitForUnit("jormungandr.service");
-
-    # Now we can test if we are able to reach the REST API
-    $bft->waitUntilSucceeds("curl -L http://localhost:8607/api/v0/node/stats | grep uptime");
-
-    ## Testing Genesis
-    # Let's wait for the StateDirectory
-    $genesis->waitForFile("/var/lib/jormungandr/");
-
-    # Bootstraping the configuration
-    $genesis->succeed("jormungandr-bootstrap -g -p 8607 -s 1");
-
-    # Moving generated files in place
-    $genesis->succeed("mkdir -p /etc/secrets");
-    $genesis->succeed("mv pool-secret1.yaml /etc/secrets/jormungandr.yaml");
-    $genesis->succeed("mv block-0.bin /var/lib/jormungandr/");
-
-    # We should have everything to start the service now
-    $genesis->succeed("systemctl restart jormungandr");
-    $genesis->waitForUnit("jormungandr.service");
-
-    # Now we can create and delegate an account
-    $genesis->succeed("./create-account-and-delegate.sh | tee -a /tmp/delegate.log");
-  '';
-})
diff --git a/nixos/tests/knot.nix b/nixos/tests/knot.nix
index e46159836cc..0588cf86ac0 100644
--- a/nixos/tests/knot.nix
+++ b/nixos/tests/knot.nix
@@ -1,4 +1,4 @@
-import ./make-test.nix ({ pkgs, lib, ...} :
+import ./make-test-python.nix ({ pkgs, lib, ...} :
 let
   common = {
     networking.firewall.enable = false;
@@ -30,6 +30,10 @@ let
   };
 in {
   name = "knot";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ hexa ];
+  };
+
 
   nodes = {
     master = { lib, ... }: {
@@ -161,37 +165,35 @@ in {
     slave4 = (lib.head nodes.slave.config.networking.interfaces.eth1.ipv4.addresses).address;
     slave6 = (lib.head nodes.slave.config.networking.interfaces.eth1.ipv6.addresses).address;
   in ''
-    startAll;
-
-    $client->waitForUnit("network.target");
-    $master->waitForUnit("knot.service");
-    $slave->waitForUnit("knot.service");
-
-    sub assertResponse {
-      my ($knot, $query_type, $query, $expected) = @_;
-      my $out = $client->succeed("khost -t $query_type $query $knot");
-      $client->log("$knot replies with: $out");
-      chomp $out;
-      die "DNS query for $query ($query_type) against $knot gave '$out' instead of '$expected'"
-        if ($out !~ $expected);
-    }
-
-    foreach ("${master4}", "${master6}", "${slave4}", "${slave6}") {
-      subtest $_, sub {
-        assertResponse($_, "SOA", "example.com", qr/start of authority.*?noc\.example\.com/);
-        assertResponse($_, "A", "example.com", qr/has no [^ ]+ record/);
-        assertResponse($_, "AAAA", "example.com", qr/has no [^ ]+ record/);
-
-        assertResponse($_, "A", "www.example.com", qr/address 192.0.2.1$/);
-        assertResponse($_, "AAAA", "www.example.com", qr/address 2001:db8::1$/);
-
-        assertResponse($_, "NS", "sub.example.com", qr/nameserver is ns\d\.example\.com.$/);
-        assertResponse($_, "A", "sub.example.com", qr/address 192.0.2.2$/);
-        assertResponse($_, "AAAA", "sub.example.com", qr/address 2001:db8::2$/);
-
-        assertResponse($_, "RRSIG", "www.example.com", qr/RR set signature is/);
-        assertResponse($_, "DNSKEY", "example.com", qr/DNSSEC key is/);
-      };
-    }
+    import re
+
+    start_all()
+
+    client.wait_for_unit("network.target")
+    master.wait_for_unit("knot.service")
+    slave.wait_for_unit("knot.service")
+
+
+    def test(host, query_type, query, pattern):
+        out = client.succeed(f"khost -t {query_type} {query} {host}").strip()
+        client.log(f"{host} replied with: {out}")
+        assert re.search(pattern, out), f'Did not match "{pattern}"'
+
+
+    for host in ("${master4}", "${master6}", "${slave4}", "${slave6}"):
+        with subtest(f"Interrogate {host}"):
+            test(host, "SOA", "example.com", r"start of authority.*noc\.example\.com\.")
+            test(host, "A", "example.com", r"has no [^ ]+ record")
+            test(host, "AAAA", "example.com", r"has no [^ ]+ record")
+
+            test(host, "A", "www.example.com", r"address 192.0.2.1$")
+            test(host, "AAAA", "www.example.com", r"address 2001:db8::1$")
+
+            test(host, "NS", "sub.example.com", r"nameserver is ns\d\.example\.com.$")
+            test(host, "A", "sub.example.com", r"address 192.0.2.2$")
+            test(host, "AAAA", "sub.example.com", r"address 2001:db8::2$")
+
+            test(host, "RRSIG", "www.example.com", r"RR set signature is")
+            test(host, "DNSKEY", "example.com", r"DNSSEC key is")
   '';
 })
diff --git a/nixos/tests/metabase.nix b/nixos/tests/metabase.nix
index be9e5ed5b1e..1450a4e9086 100644
--- a/nixos/tests/metabase.nix
+++ b/nixos/tests/metabase.nix
@@ -1,4 +1,4 @@
-import ./make-test.nix ({ pkgs, ... }: {
+import ./make-test-python.nix ({ pkgs, ... }: {
   name = "metabase";
   meta = with pkgs.stdenv.lib.maintainers; {
     maintainers = [ mmahut ];
@@ -12,9 +12,9 @@ import ./make-test.nix ({ pkgs, ... }: {
   };
 
   testScript = ''
-    startAll;
-    $machine->waitForUnit("metabase.service");
-    $machine->waitForOpenPort(3000);
-    $machine->waitUntilSucceeds("curl -L http://localhost:3000/setup | grep Metabase");
+    start_all()
+    machine.wait_for_unit("metabase.service")
+    machine.wait_for_open_port(3000)
+    machine.wait_until_succeeds("curl -L http://localhost:3000/setup | grep Metabase")
   '';
 })
diff --git a/nixos/tests/quake3.nix b/nixos/tests/quake3.nix
deleted file mode 100644
index 4d57e219790..00000000000
--- a/nixos/tests/quake3.nix
+++ /dev/null
@@ -1,95 +0,0 @@
-import ./make-test-python.nix ({ pkgs, ...} :
-
-let
-
-  # Build Quake with coverage instrumentation.
-  overrides = pkgs:
-    {
-      quake3game = pkgs.quake3game.override (args: {
-        stdenv = pkgs.stdenvAdapters.addCoverageInstrumentation args.stdenv;
-      });
-    };
-
-  # Only allow the demo data to be used (only if it's unfreeRedistributable).
-  unfreePredicate = pkg: with pkgs.lib; let
-    allowPackageNames = [ "quake3-demodata" "quake3-pointrelease" ];
-    allowLicenses = [ pkgs.lib.licenses.unfreeRedistributable ];
-  in elem pkg.pname allowPackageNames &&
-     elem (pkg.meta.license or null) allowLicenses;
-
-in
-
-rec {
-  name = "quake3";
-  meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = [ domenkozar eelco ];
-  };
-
-  # TODO: lcov doesn't work atm
-  #makeCoverageReport = true;
-
-  client =
-    { pkgs, ... }:
-
-    { imports = [ ./common/x11.nix ];
-      hardware.opengl.driSupport = true;
-      environment.systemPackages = [ pkgs.quake3demo ];
-      nixpkgs.config.packageOverrides = overrides;
-      nixpkgs.config.allowUnfreePredicate = unfreePredicate;
-    };
-
-  nodes =
-    { server =
-        { pkgs, ... }:
-
-        { systemd.services.quake3-server =
-            { wantedBy = [ "multi-user.target" ];
-              script =
-                "${pkgs.quake3demo}/bin/quake3-server +set g_gametype 0 " +
-                "+map q3dm7 +addbot grunt +addbot daemia 2> /tmp/log";
-            };
-          nixpkgs.config.packageOverrides = overrides;
-          nixpkgs.config.allowUnfreePredicate = unfreePredicate;
-          networking.firewall.allowedUDPPorts = [ 27960 ];
-        };
-
-      client1 = client;
-      client2 = client;
-    };
-
-  testScript =
-    ''
-      start_all()
-
-      server.wait_for_unit("quake3-server")
-      client1.wait_for_x()
-      client2.wait_for_x()
-
-      client1.execute("quake3 +set r_fullscreen 0 +set name Foo +connect server &")
-      client2.execute("quake3 +set r_fullscreen 0 +set name Bar +connect server &")
-
-      server.wait_until_succeeds("grep -q 'Foo.*entered the game' /tmp/log")
-      server.wait_until_succeeds("grep -q 'Bar.*entered the game' /tmp/log")
-
-      server.sleep(10)  # wait for a while to get a nice screenshot
-
-      client1.block()
-
-      server.sleep(20)
-
-      client1.screenshot("screen1")
-      client2.screenshot("screen2")
-
-      client1.unblock()
-
-      server.sleep(10)
-
-      client1.screenshot("screen3")
-      client2.screenshot("screen4")
-
-      client1.shutdown()
-      client2.shutdown()
-      server.stop_job("quake3-server")
-    '';
-
-})
diff --git a/nixos/tests/trac.nix b/nixos/tests/trac.nix
index 643095d947e..7953f8d41f7 100644
--- a/nixos/tests/trac.nix
+++ b/nixos/tests/trac.nix
@@ -1,4 +1,4 @@
-import ./make-test.nix ({ pkgs, ... }: {
+import ./make-test-python.nix ({ pkgs, ... }: {
   name = "trac";
   meta = with pkgs.stdenv.lib.maintainers; {
     maintainers = [ mmahut ];
@@ -11,9 +11,9 @@ import ./make-test.nix ({ pkgs, ... }: {
   };
 
   testScript = ''
-    startAll;
-    $machine->waitForUnit("trac.service");
-    $machine->waitForOpenPort(8000);
-    $machine->waitUntilSucceeds("curl -L http://localhost:8000/ | grep 'Trac Powered'");
+    start_all()
+    machine.wait_for_unit("trac.service")
+    machine.wait_for_open_port(8000)
+    machine.wait_until_succeeds("curl -L http://localhost:8000/ | grep 'Trac Powered'")
   '';
 })
diff --git a/nixos/tests/trezord.nix b/nixos/tests/trezord.nix
index 1c85bf53934..8d908a52249 100644
--- a/nixos/tests/trezord.nix
+++ b/nixos/tests/trezord.nix
@@ -1,7 +1,7 @@
-import ./make-test.nix ({ pkgs, ... }: {
+import ./make-test-python.nix ({ pkgs, ... }: {
   name = "trezord";
   meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = [ mmahut ];
+    maintainers = [ mmahut "1000101" ];
   };
 
   nodes = {
@@ -12,9 +12,9 @@ import ./make-test.nix ({ pkgs, ... }: {
   };
 
   testScript = ''
-    startAll;
-    $machine->waitForUnit("trezord.service");
-    $machine->waitForOpenPort(21325);
-    $machine->waitUntilSucceeds("curl -L http://localhost:21325/status/ | grep Version");
+    start_all()
+    machine.wait_for_unit("trezord.service")
+    machine.wait_for_open_port(21325)
+    machine.wait_until_succeeds("curl -L http://localhost:21325/status/ | grep Version")
   '';
 })
diff --git a/nixos/tests/vault.nix b/nixos/tests/vault.nix
index caf0cbb2abf..ac8cf0703da 100644
--- a/nixos/tests/vault.nix
+++ b/nixos/tests/vault.nix
@@ -1,4 +1,4 @@
-import ./make-test.nix ({ pkgs, ... }:
+import ./make-test-python.nix ({ pkgs, ... }:
 {
   name = "vault";
   meta = with pkgs.stdenv.lib.maintainers; {
@@ -12,12 +12,12 @@ import ./make-test.nix ({ pkgs, ... }:
 
   testScript =
     ''
-      startAll;
+      start_all()
 
-      $machine->waitForUnit('multi-user.target');
-      $machine->waitForUnit('vault.service');
-      $machine->waitForOpenPort(8200);
-      $machine->succeed('vault operator init');
-      $machine->succeed('vault status | grep Sealed | grep true');
+      machine.wait_for_unit("multi-user.target")
+      machine.wait_for_unit("vault.service")
+      machine.wait_for_open_port(8200)
+      machine.succeed("vault operator init")
+      machine.succeed("vault status | grep Sealed | grep true")
     '';
 })
diff --git a/pkgs/applications/audio/radiotray-ng/default.nix b/pkgs/applications/audio/radiotray-ng/default.nix
index c0186a146be..a64e407b39b 100644
--- a/pkgs/applications/audio/radiotray-ng/default.nix
+++ b/pkgs/applications/audio/radiotray-ng/default.nix
@@ -21,7 +21,7 @@
 # User-agent info
 , lsb-release
 # rt2rtng
-, python2
+, python3
 # Testing
 , gtest
 # Fixup
@@ -36,17 +36,17 @@ let
     gst-libav
   ];
   # For the rt2rtng utility for converting bookmark file to -ng format
-  pythonInputs = with python2.pkgs; [ python2 lxml ];
+  pythonInputs = with python3.pkgs; [ python lxml ];
 in
 stdenv.mkDerivation rec {
   pname = "radiotray-ng";
-  version = "0.2.6";
+  version = "0.2.7";
 
   src = fetchFromGitHub {
     owner = "ebruck";
-    repo = "radiotray-ng";
+    repo = pname;
     rev = "v${version}";
-    sha256 = "0khrfxjas2ldh0kksq7l811srqy16ahjxchvz0hhykx5hykymxlb";
+    sha256 = "1v2nsz7s0jj0wmqabzk6akcf1353rachm1lfq77hxbq9z5pw8pgb";
   };
 
   nativeBuildInputs = [ cmake pkgconfig wrapGAppsHook makeWrapper ];
diff --git a/pkgs/applications/audio/reaper/default.nix b/pkgs/applications/audio/reaper/default.nix
index 4a6cdc44f44..3b780ee2b36 100644
--- a/pkgs/applications/audio/reaper/default.nix
+++ b/pkgs/applications/audio/reaper/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "reaper";
-  version = "5.983";
+  version = "5.984";
 
   src = fetchurl {
     url = "https://www.reaper.fm/files/${stdenv.lib.versions.major version}.x/reaper${builtins.replaceStrings ["."] [""] version}_linux_x86_64.tar.xz";
-    sha256 = "16xw3gsxgjfdxd1ldm8zxd48qh6lgxacnj9yjryy0brhw51dw1q4";
+    sha256 = "01yy0s9b9mkl6v66vgdfxl2zhr36abridih1d4ajbrdn60vppykw";
   };
 
   nativeBuildInputs = [ autoPatchelfHook makeWrapper ];
diff --git a/pkgs/applications/audio/synthv1/default.nix b/pkgs/applications/audio/synthv1/default.nix
index 6d650abfb97..349c7acc3db 100644
--- a/pkgs/applications/audio/synthv1/default.nix
+++ b/pkgs/applications/audio/synthv1/default.nix
@@ -1,15 +1,15 @@
-{ stdenv, fetchurl, pkgconfig, qt5, libjack2, alsaLib, liblo, lv2 }:
+{ mkDerivation, stdenv, fetchurl, pkgconfig, qtbase, qttools, libjack2, alsaLib, liblo, lv2 }:
 
-stdenv.mkDerivation rec {
+mkDerivation rec {
   pname = "synthv1";
-  version = "0.9.10";
+  version = "0.9.11";
 
   src = fetchurl {
     url = "mirror://sourceforge/synthv1/${pname}-${version}.tar.gz";
-    sha256 = "1ssdm7aiaz908ydqwdx9khxnnd0yfacjgvbxg5p9s9xhkbqqc2f2";
+    sha256 = "116k2vca9dygvsd684wvxm61p0l1xrrgdph4qrrprlsr6vj0llgm";
   };
 
-  buildInputs = [ qt5.qtbase qt5.qttools libjack2 alsaLib liblo lv2 ];
+  buildInputs = [ qtbase qttools libjack2 alsaLib liblo lv2 ];
 
   nativeBuildInputs = [ pkgconfig ];
 
diff --git a/pkgs/applications/blockchains/jormungandr/default.nix b/pkgs/applications/blockchains/jormungandr/default.nix
deleted file mode 100644
index 0898e469a6f..00000000000
--- a/pkgs/applications/blockchains/jormungandr/default.nix
+++ /dev/null
@@ -1,56 +0,0 @@
-{ stdenv
-, lib
-, fetchgit
-, rustPlatform
-, openssl
-, pkgconfig
-, protobuf
-, darwin
-}:
-
-rustPlatform.buildRustPackage rec {
-  pname = "jormungandr";
-  version = "0.7.0-rc4";
-
-  src = fetchgit {
-    url = "https://github.com/input-output-hk/${pname}";
-    rev = "v${version}";
-    sha256 = "1cjdapy0r2bikqck64cl09vzs307wcfi628hfmpczrg33i81pr3g";
-    fetchSubmodules = true;
-  };
-
-  cargoSha256 = "0546ahgwcczaxda1hc1r20skzi93s40isq2ys40y9165sgdydn4i";
-
-  nativeBuildInputs = [ pkgconfig protobuf ];
-  buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];
-
-  patchPhase = ''
-    sed -i "s~SCRIPTPATH=.*~SCRIPTPATH=$out/templates/~g" scripts/bootstrap
-  '';
-
-  installPhase = ''
-    install -d $out/bin $out/templates
-    install -m755 target/*/release/jormungandr $out/bin/
-    install -m755 target/*/release/jcli $out/bin/
-    install -m755 target/*/release/jormungandr-scenario-tests	$out/bin/
-    install -m755 scripts/send-transaction $out/templates
-    install -m755 scripts/jcli-helpers $out/bin/
-    install -m755 scripts/bootstrap $out/bin/jormungandr-bootstrap
-    install -m644 scripts/faucet-send-money.shtempl $out/templates/
-    install -m644 scripts/create-account-and-delegate.shtempl $out/templates/
-    install -m644 scripts/faucet-send-certificate.shtempl $out/templates/
-  '';
-
-  PROTOC = "${protobuf}/bin/protoc";
-
-  # Disabling integration tests
-  doCheck = false;
-
-  meta = with stdenv.lib; {
-    description = "An aspiring blockchain node";
-    homepage = "https://input-output-hk.github.io/jormungandr/";
-    license = licenses.mit;
-    maintainers = [ maintainers.mmahut ];
-    platforms = platforms.all;
-  };
-}
diff --git a/pkgs/applications/editors/android-studio/common.nix b/pkgs/applications/editors/android-studio/common.nix
index 93c9b4c04fb..05a997c62ff 100644
--- a/pkgs/applications/editors/android-studio/common.nix
+++ b/pkgs/applications/editors/android-studio/common.nix
@@ -3,6 +3,7 @@
 { alsaLib
 , bash
 , buildFHSUserEnv
+, cacert
 , coreutils
 , dbus
 , expat
@@ -152,7 +153,16 @@ let
   # environment is used as a work around for that.
   fhsEnv = buildFHSUserEnv {
     name = "${drvName}-fhs-env";
-    multiPkgs = pkgs: [ pkgs.ncurses5 ];
+    multiPkgs = pkgs: [
+      pkgs.ncurses5
+
+      # Flutter can only search for certs Fedora-way.
+      (runCommand "fedoracert" {}
+        ''
+        mkdir -p $out/etc/pki/tls/
+        ln -s ${cacert}/etc/ssl/certs $out/etc/pki/tls/certs
+        '')
+    ];
   };
 in runCommand
   drvName
diff --git a/pkgs/applications/editors/emacs-modes/org-generated.nix b/pkgs/applications/editors/emacs-modes/org-generated.nix
index c1fad2dc865..f1833225013 100644
--- a/pkgs/applications/editors/emacs-modes/org-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/org-generated.nix
@@ -4,10 +4,10 @@
       elpaBuild {
         pname = "org";
         ename = "org";
-        version = "20190527";
+        version = "20190904";
         src = fetchurl {
-          url = "http://orgmode.org/elpa/org-20190527.tar";
-          sha256 = "1fc2nyylzpikjikyb24xq2mcilridcahmjwmg0s426dqrgqpm9ij";
+          url = "http://orgmode.org/elpa/org-20190904.tar";
+          sha256 = "0ah5zgbxp4j3mfgriw9liamy73npp9zbkq0zrg6cfhf8l3xwbnxn";
         };
         packageRequires = [];
         meta = {
@@ -19,10 +19,10 @@
       elpaBuild {
         pname = "org-plus-contrib";
         ename = "org-plus-contrib";
-        version = "20190527";
+        version = "20190904";
         src = fetchurl {
-          url = "http://orgmode.org/elpa/org-plus-contrib-20190527.tar";
-          sha256 = "16kf47ij25fijf6pbfxzq9xzildj1asdzhnkf5zv5pn4312pvgnq";
+          url = "http://orgmode.org/elpa/org-plus-contrib-20190904.tar";
+          sha256 = "08s3fk3jim0y2v00l6ah8y08ba8wbcf29z6fxqzyaxj58a5sq81a";
         };
         packageRequires = [];
         meta = {
diff --git a/pkgs/applications/editors/emacs/default.nix b/pkgs/applications/editors/emacs/default.nix
index 29a6a8773ef..2862ba7184f 100644
--- a/pkgs/applications/editors/emacs/default.nix
+++ b/pkgs/applications/editors/emacs/default.nix
@@ -60,9 +60,9 @@ stdenv.mkDerivation rec {
     [ ncurses gconf libxml2 gnutls alsaLib acl gpm gettext ]
     ++ lib.optionals stdenv.isLinux [ dbus libselinux systemd ]
     ++ lib.optionals withX
-      [ xlibsWrapper libXaw Xaw3d libXpm libpng libjpeg libungif libtiff librsvg libXft
+      [ xlibsWrapper libXaw Xaw3d libXpm libpng libjpeg libungif libtiff libXft
         gconf ]
-    ++ lib.optionals (withX || withNS) [ imagemagick ]
+    ++ lib.optionals (withX || withNS) [ imagemagick librsvg ]
     ++ lib.optionals (stdenv.isLinux && withX) [ m17n_lib libotf ]
     ++ lib.optional (withX && withGTK2) gtk2-x11
     ++ lib.optionals (withX && withGTK3) [ gtk3-x11 gsettings-desktop-schemas ]
diff --git a/pkgs/applications/editors/kdevelop5/kdev-php.nix b/pkgs/applications/editors/kdevelop5/kdev-php.nix
index e367b586f30..7805234a70c 100644
--- a/pkgs/applications/editors/kdevelop5/kdev-php.nix
+++ b/pkgs/applications/editors/kdevelop5/kdev-php.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "kdev-php";
-  version = "5.4.2";
+  version = "5.4.3";
 
   src = fetchurl {
     url = "https://github.com/KDE/${pname}/archive/v${version}.tar.gz";
-    sha256 = "1ilazq2y671wifcrh7pa0zf9yqymqxwj1m2kd389ik2p6wm68jx8";
+    sha256 = "0nf9nlykdq40yxdda0as16pd0c5rahwba1fbwni8g19w8mf2y3h5";
   };
 
   nativeBuildInputs = [ cmake extra-cmake-modules ];
diff --git a/pkgs/applications/editors/kdevelop5/kdev-python.nix b/pkgs/applications/editors/kdevelop5/kdev-python.nix
index 1052c5e1ba3..50740e24aca 100644
--- a/pkgs/applications/editors/kdevelop5/kdev-python.nix
+++ b/pkgs/applications/editors/kdevelop5/kdev-python.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "kdev-python";
-  version = "5.4.2";
+  version = "5.4.3";
 
   src = fetchurl {
     url = "https://github.com/KDE/${pname}/archive/v${version}.tar.gz";
-    sha256 = "1nnspa1mixdb5z0a8m4nbpsk6c4s81iwrirhrl7091hsw02bsx3f";
+    sha256 = "16928a0p5m5mm38j39sxzfqy6rx9pv01aihk2kscdd93z7001b81";
   };
 
   cmakeFlags = [
diff --git a/pkgs/applications/editors/kdevelop5/kdevelop.nix b/pkgs/applications/editors/kdevelop5/kdevelop.nix
index 4c2011b5b03..1f28c2a4af2 100644
--- a/pkgs/applications/editors/kdevelop5/kdevelop.nix
+++ b/pkgs/applications/editors/kdevelop5/kdevelop.nix
@@ -1,3 +1,4 @@
+
 { mkDerivation, lib, fetchurl, cmake, gettext, pkgconfig, extra-cmake-modules
 , qtquickcontrols, qtwebkit, qttools, kde-cli-tools, qtbase
 , kconfig, kdeclarative, kdoctools, kiconthemes, ki18n, kitemmodels, kitemviews
@@ -9,11 +10,11 @@
 
 mkDerivation rec {
   pname = "kdevelop";
-  version = "5.4.2";
+  version = "5.4.3";
 
   src = fetchurl {
     url = "mirror://kde/stable/${pname}/${version}/src/${pname}-${version}.tar.xz";
-    sha256 = "1i665m4jd1r5bl77pcfybpn9szxzccrajs4m0prqwhlj93d57qjj";
+    sha256 = "0h07gdmg24d517im40b9kl1kzkkzwc9ig4crbl3y9iy0mbpm0hv8";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/editors/texmacs/default.nix b/pkgs/applications/editors/texmacs/default.nix
index 31160c0916c..8ca3f8cb2a9 100644
--- a/pkgs/applications/editors/texmacs/default.nix
+++ b/pkgs/applications/editors/texmacs/default.nix
@@ -16,7 +16,7 @@
 
 let
   pname = "TeXmacs";
-  version = "1.99.10";
+  version = "1.99.11";
   common = callPackage ./common.nix {
     inherit tex extraFonts chineseFonts japaneseFonts koreanFonts;
   };
@@ -26,7 +26,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.texmacs.org/Download/ftp/tmftp/source/TeXmacs-${version}-src.tar.gz";
-    sha256 = "1k12bkcik7mv93q0j7q3b77x8s6rmvlb23s3v7nnzdwjxlp5lph2";
+    sha256 = "12bp0f34izzqimz49lfpgf4lyz3h45s9xbmk8v6zsawdjki76alg";
   };
 
   cmakeFlags = [
diff --git a/pkgs/applications/graphics/drawpile/default.nix b/pkgs/applications/graphics/drawpile/default.nix
index 5744aeb462e..b4f6776e02c 100644
--- a/pkgs/applications/graphics/drawpile/default.nix
+++ b/pkgs/applications/graphics/drawpile/default.nix
@@ -60,11 +60,11 @@ let
 
 in mkDerivation rec {
   pname = "drawpile";
-  version = "2.1.12";
+  version = "2.1.13";
 
   src = fetchurl {
     url = "https://drawpile.net/files/src/drawpile-${version}.tar.gz";
-    sha256 = "0jvy21xmlidyfkk1p47rgyf4c1ksizcpm8s17n8mwdbnjrf6m55n";
+    sha256 = "0r56hkzjdlg4615zvrjv60i3f06pv7ssh6bs6jb46qs8wbsawsxf";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/graphics/paraview/default.nix b/pkgs/applications/graphics/paraview/default.nix
index 13a00991265..fdda8062a43 100644
--- a/pkgs/applications/graphics/paraview/default.nix
+++ b/pkgs/applications/graphics/paraview/default.nix
@@ -2,11 +2,12 @@
 stdenv, fetchFromGitHub, cmake, makeWrapper
 ,qtbase, qttools, python, libGLU_combined
 ,libXt, qtx11extras, qtxmlpatterns
+, mkDerivation
 }:
 
-stdenv.mkDerivation rec {
+mkDerivation rec {
   pname = "paraview";
-  version = "5.6.0";
+  version = "5.6.3";
 
   # fetching from GitHub instead of taking an "official" source
   # tarball because of missing submodules there
@@ -14,7 +15,7 @@ stdenv.mkDerivation rec {
     owner = "Kitware";
     repo = "ParaView";
     rev = "v${version}";
-    sha256 = "1j13yfdgcv4yzfr449i4c8r4rs1c9zr6qd3igr4vv3ani8zixkzi";
+    sha256 = "0zcij59pg47c45gfddnpbin13w16smzhcbivzm1k4pg4366wxq1q";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/misc/sidequest/default.nix b/pkgs/applications/misc/sidequest/default.nix
index f47f2b4e9eb..c403f475168 100644
--- a/pkgs/applications/misc/sidequest/default.nix
+++ b/pkgs/applications/misc/sidequest/default.nix
@@ -1,7 +1,7 @@
 { stdenv, lib, fetchurl, buildFHSUserEnv, makeDesktopItem, makeWrapper, atomEnv, libuuid, at-spi2-atk, icu, openssl, zlib }:
 	let
 		pname = "sidequest";
-		version = "0.7.2";
+		version = "0.7.5";
 
 		desktopItem = makeDesktopItem rec {
 			name = "SideQuest";
@@ -16,7 +16,7 @@
 
 			src = fetchurl {
 				url = "https://github.com/the-expanse/SideQuest/releases/download/v${version}/SideQuest-${version}.tar.xz";
-				sha256 = "035grhzqm3qdfcq5vn4a85lgb188rg60wlgc02r44cnj4sbsyyzj";
+				sha256 = "1a77slpm7yga5vh3j1y440dq2xgv4pa6h8xg29rdcs6zig55pa97";
 			};
 
 			buildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/networking/instant-messengers/mattermost-desktop/default.nix b/pkgs/applications/networking/instant-messengers/mattermost-desktop/default.nix
index f5f8414c870..e5b962b2493 100644
--- a/pkgs/applications/networking/instant-messengers/mattermost-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/mattermost-desktop/default.nix
@@ -1,10 +1,14 @@
 { stdenv, fetchurl, gnome2, gtk3, pango, atk, cairo, gdk-pixbuf, glib,
 freetype, fontconfig, dbus, libX11, xorg, libXi, libXcursor, libXdamage,
 libXrandr, libXcomposite, libXext, libXfixes, libXrender, libXtst,
-libXScrnSaver, nss, nspr, alsaLib, cups, expat, udev }:
+libXScrnSaver, nss, nspr, alsaLib, cups, expat, udev, wrapGAppsHook,
+hicolor-icon-theme, libuuid, at-spi2-core, at-spi2-atk }:
+
 let
   rpath = stdenv.lib.makeLibraryPath [
     alsaLib
+    at-spi2-atk
+    at-spi2-core
     atk
     cairo
     cups
@@ -17,6 +21,7 @@ let
     gnome2.GConf
     gtk3
     pango
+    libuuid
     libX11
     libXScrnSaver
     libXcomposite
@@ -38,18 +43,18 @@ let
 in
   stdenv.mkDerivation rec {
     pname = "mattermost-desktop";
-    version = "4.2.3";
+    version = "4.3.1";
 
     src =
       if stdenv.hostPlatform.system == "x86_64-linux" then
         fetchurl {
           url = "https://releases.mattermost.com/desktop/${version}/${pname}-${version}-linux-x64.tar.gz";
-          sha256 = "14xyn8dp0xxl4j9xdsjik9p6srqdxbirgcgym2sv64p01w3kc9wf";
+          sha256 = "076nv5h6xscbw1987az00x493qhqgrli87gnn57zbvz0acgvlhfv";
         }
       else if stdenv.hostPlatform.system == "i686-linux" then
         fetchurl {
           url = "https://releases.mattermost.com/desktop/${version}/${pname}-${version}-linux-ia32.tar.gz";
-          sha256 = "063rrxw76mjz71wp9xd3ppkq3s017vrzms879r2cilypmay7fhgs";
+          sha256 = "19ps9g8j6kp4haj6r3yfy4ma2wm6isq5fa8zlcz6g042ajkqq0ij";
         }
       else
         throw "Mattermost-Desktop is not currently supported on ${stdenv.hostPlatform.system}";
@@ -58,6 +63,8 @@ in
     dontConfigure = true;
     dontPatchELF = true;
 
+    buildInputs = [ wrapGAppsHook gtk3 hicolor-icon-theme ];
+
     installPhase = ''
       mkdir -p $out/share/mattermost-desktop
       cp -R . $out/share/mattermost-desktop
diff --git a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
index cbab67e5e1a..f29e62a1006 100644
--- a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
@@ -7,7 +7,7 @@ let
 
   # Please keep the version x.y.0.z and do not update to x.y.76.z because the
   # source of the latter disappears much faster.
-  version = "8.51.0.72";
+  version = "8.54.0.85";
 
   rpath = stdenv.lib.makeLibraryPath [
     alsaLib
@@ -60,7 +60,7 @@ let
     if stdenv.hostPlatform.system == "x86_64-linux" then
       fetchurl {
         url = "https://repo.skype.com/deb/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb";
-        sha256 = "1rv3jxirlfy0gvphw8cxmwmghbak5m5wj0y3bgamcvma48mzdfk3";
+        sha256 = "09k260g9qy4n8vy6wr2jb5mm27cvqyapmv8vj4ff2j72f3ad31vm";
       }
     else
       throw "Skype for linux is not supported on ${stdenv.hostPlatform.system}";
diff --git a/pkgs/applications/networking/ipfs-cluster/default.nix b/pkgs/applications/networking/ipfs-cluster/default.nix
index 426619908d6..76cc393f26a 100644
--- a/pkgs/applications/networking/ipfs-cluster/default.nix
+++ b/pkgs/applications/networking/ipfs-cluster/default.nix
@@ -1,35 +1,19 @@
-{ stdenv, buildGoPackage, fetchFromGitHub, fetchgx, gx-go }:
+{ stdenv, buildGoModule, fetchFromGitHub, fetchgx, gx-go }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "ipfs-cluster";
-  version = "0.9.0";
+  version = "0.11.0";
   rev = "v${version}";
 
-  goPackagePath = "github.com/ipfs/ipfs-cluster";
-
-  extraSrcPaths = [
-    (fetchgx {
-      inherit  src;name = "${pname}-${version}";
-      sha256 = "1k7xcirvi07p5g9gr9jcx5h39wk7jxfsyjrn5yraa8xdqhn6b6nx";
-    })
-  ];
+  modSha256 = "03bqwg9nqh7w6j887gzxr2mcn14jc8f07z896b3swg5wzaz1i6hs";
 
   src = fetchFromGitHub {
     owner = "ipfs";
     repo = "ipfs-cluster";
     inherit rev;
-    sha256 = "1bxwcp0355f1ykjcidbxv218zp9d20nma7lnpn9xcjqc8vaq03kn";
+    sha256 = "0q5lanm2zdwwhdwv05fssb34y4y4dha3dq7x1iaabbf70lpqv6yx";
   };
 
-  nativeBuildInputs = [ gx-go ];
-
-  preBuild = ''
-    # fetchgx stores packages by their ipfs hash
-    # this will rewrite github.com/ imports to gx/ipfs/
-    cd go/src/${goPackagePath}
-    gx-go rewrite
-  '';
-
   meta = with stdenv.lib; {
     description = "Allocate, replicate, and track Pins across a cluster of IPFS daemons";
     homepage = https://cluster.ipfs.io/;
diff --git a/pkgs/applications/science/math/sage/patches/ignore-cmp-deprecation.patch b/pkgs/applications/science/math/sage/patches/ignore-cmp-deprecation.patch
index 5c1073e13e9..11ca7481961 100644
--- a/pkgs/applications/science/math/sage/patches/ignore-cmp-deprecation.patch
+++ b/pkgs/applications/science/math/sage/patches/ignore-cmp-deprecation.patch
@@ -1,13 +1,24 @@
 diff --git a/src/sage/tests/cmdline.py b/src/sage/tests/cmdline.py
-index bd6b76ab82..f8340a8c66 100644
+index bd6b76ab82..ccf1203dec 100644
 --- a/src/sage/tests/cmdline.py
 +++ b/src/sage/tests/cmdline.py
-@@ -872,7 +872,7 @@ def test_executable(args, input="", timeout=100.0, **kwds):
+@@ -837,8 +837,6 @@ def test_executable(args, input="", timeout=100.0, **kwds):
+         ///
+         4
+         }}}
+-        sage: err # py2
+-        ''
+         sage: ret
+         0
+ 
+@@ -871,8 +869,8 @@ def test_executable(args, input="", timeout=100.0, **kwds):
+         sage: output = tmp_filename(ext='.sws')
          sage: with open(input, 'w') as F:
          ....:     _ = F.write(s)
-         sage: test_executable(["sage", "--rst2sws", input, output]) # py2
+-        sage: test_executable(["sage", "--rst2sws", input, output]) # py2
 -        ('', '', 0)
-+        ('', '...', 0)
++        sage: test_executable(["sage", "--rst2sws", input, output])[2] # py2
++        0
          sage: import tarfile # py2
          sage: f = tarfile.open(output, 'r') # py2
          sage: print(f.extractfile('sage_worksheet/worksheet.html').read()) # py2
diff --git a/pkgs/applications/science/math/sage/patches/ignore-werkzeug-immutable-dict-deprecation.patch b/pkgs/applications/science/math/sage/patches/ignore-werkzeug-immutable-dict-deprecation.patch
new file mode 100644
index 00000000000..c5f95b498d5
--- /dev/null
+++ b/pkgs/applications/science/math/sage/patches/ignore-werkzeug-immutable-dict-deprecation.patch
@@ -0,0 +1,12 @@
+diff --git a/src/sage/all.py b/src/sage/all.py
+index c87c9372e9..862fca4fcc 100644
+--- a/src/sage/all.py
++++ b/src/sage/all.py
+@@ -306,6 +306,7 @@ warnings.filters.remove(('ignore', None, DeprecationWarning, None, 0))
+ # Ignore all deprecations from IPython etc.
+ warnings.filterwarnings('ignore', category=DeprecationWarning,
+     module='.*(IPython|ipykernel|jupyter_client|jupyter_core|nbformat|notebook|ipywidgets|storemagic)')
++warnings.filterwarnings('ignore', category=DeprecationWarning, message=r".*The import 'werkzeug.ImmutableDict' is deprecated")
+ # Ignore collections.abc warnings, there are a lot of them but they are
+ # harmless.
+ warnings.filterwarnings('ignore', category=DeprecationWarning,
diff --git a/pkgs/applications/science/math/sage/patches/sagenb-cmp-deprecation.patch b/pkgs/applications/science/math/sage/patches/sagenb-cmp-deprecation.patch
new file mode 100644
index 00000000000..9f502a66951
--- /dev/null
+++ b/pkgs/applications/science/math/sage/patches/sagenb-cmp-deprecation.patch
@@ -0,0 +1,13 @@
+diff --git a/sagenb/__init__.py b/sagenb/__init__.py
+index 4db0d2cb..2fc5f01e 100644
+--- a/sagenb/__init__.py
++++ b/sagenb/__init__.py
+@@ -1,3 +1,8 @@
+ # -*- coding: utf-8 -*
+   # init
++import warnings
+ from . import storage
++
++# deprecation in attrs, needs to be fixed in twisted
++warnings.filterwarnings('ignore', category=DeprecationWarning,
++    message=r'The usage of `cmp` is deprecated and will be removed.*')
diff --git a/pkgs/applications/science/math/sage/sage-env.nix b/pkgs/applications/science/math/sage/sage-env.nix
index 0b67b3cff12..00397239876 100644
--- a/pkgs/applications/science/math/sage/sage-env.nix
+++ b/pkgs/applications/science/math/sage/sage-env.nix
@@ -18,6 +18,12 @@
 , ecl
 , maxima-ecl
 , singular
+, fflas-ffpack
+, givaro
+, gd
+, libpng
+, linbox
+, m4ri
 , giac
 , palp
 , rWrapper
@@ -101,14 +107,21 @@ writeTextFile rec {
   name = "sage-env";
   destination = "/${name}";
   text = ''
-    export PKG_CONFIG_PATH='${lib.concatStringsSep ":" (map (pkg: "${pkg}/lib/pkgconfig") [
-        # This is only needed in the src/sage/misc/cython.py test and I'm not
-        # sure if there's really a usecase for it outside of the tests. However
-        # since singular and openblas are runtime dependencies anyways, it doesn't
-        # really hurt to include.
+    export PKG_CONFIG_PATH='${lib.makeSearchPathOutput "dev" "lib/pkgconfig" [
+        # This should only be needed during build. However, since the  doctests
+        # also test the cython build (for example in src/sage/misc/cython.py),
+        # it is also needed for the testsuite to pass. We could fix the
+        # testsuite instead, but since all the packages are also runtime
+        # dependencies it doesn't really hurt to include them here.
         singular
         openblasCompat
-      ])
+        fflas-ffpack givaro
+        gd
+        libpng zlib
+        gsl
+        linbox
+        m4ri
+      ]
     }'
     export SAGE_ROOT='${sagelib.src}'
     export SAGE_LOCAL='@sage-local@'
diff --git a/pkgs/applications/science/math/sage/sage-src.nix b/pkgs/applications/science/math/sage/sage-src.nix
index c7a3da68b15..dc8ba48e45e 100644
--- a/pkgs/applications/science/math/sage/sage-src.nix
+++ b/pkgs/applications/science/math/sage/sage-src.nix
@@ -107,6 +107,17 @@ stdenv.mkDerivation rec {
 
     # ignore a deprecation warning for usage of `cmp` in the attrs library in the doctests
     ./patches/ignore-cmp-deprecation.patch
+
+    # Werkzeug has deprecated ImmutableDict, but it is still used in legacy
+    # sagenb. That's no big issue since sagenb will be removed soon anyways.
+    ./patches/ignore-werkzeug-immutable-dict-deprecation.patch
+
+    # threejs r109 (#28560)
+    (fetchpatch {
+      name = "threejs-r109.patch";
+      url = "https://git.sagemath.org/sage.git/patch?id=fcc11d6effa39f375bc5f4ea5831fb7a2f2767da";
+      sha256 = "0hnmc8ld3bblks0hcjvjjaydkgwdr1cs3dbl2ys4gfq964pjgqwc";
+    })
   ];
 
   patches = nixPatches ++ bugfixPatches ++ packageUpgradePatches;
diff --git a/pkgs/applications/science/math/sage/sagenb.nix b/pkgs/applications/science/math/sage/sagenb.nix
index 03b5b7a3bbf..77b2168ad97 100644
--- a/pkgs/applications/science/math/sage/sagenb.nix
+++ b/pkgs/applications/science/math/sage/sagenb.nix
@@ -26,6 +26,11 @@ buildPythonPackage rec {
     sha256 = "0bxvhr03qh2nsjdfc4pyfiqrn9jhp3vf7irsc9gqx0185jlblbxs";
   };
 
+  patches = [
+    # cmp deprecation in attrs needs to be handled in twisted
+    ./patches/sagenb-cmp-deprecation.patch
+  ];
+
   propagatedBuildInputs = [
     twisted
     flask
diff --git a/pkgs/applications/version-management/git-sizer/default.nix b/pkgs/applications/version-management/git-sizer/default.nix
index 7a92679583b..6d41098ee1a 100644
--- a/pkgs/applications/version-management/git-sizer/default.nix
+++ b/pkgs/applications/version-management/git-sizer/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "git-sizer";
-  version = "1.0.0";
+  version = "1.3.0";
 
   goPackagePath = "github.com/github/git-sizer";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     owner = "github";
     repo = pname;
     rev = "v${version}";
-    sha256 = "11rvqpsyl41ph0fgm62k5q2p33zgnwj1jd91rd4lkaarpcd1sg5h";
+    sha256 = "0kmyvai5xfalm56ywa6mhdvvjnacdzwcyz28bw0pz9a4gyf1mgvh";
   };
 
   meta = with lib; {
diff --git a/pkgs/applications/virtualization/podman/default.nix b/pkgs/applications/virtualization/podman/default.nix
index fa48c8b5e5e..9d94ced0bf2 100644
--- a/pkgs/applications/virtualization/podman/default.nix
+++ b/pkgs/applications/virtualization/podman/default.nix
@@ -5,13 +5,13 @@
 
 buildGoPackage rec {
   pname = "podman";
-  version = "1.6.2";
+  version = "1.6.3";
 
   src = fetchFromGitHub {
     owner  = "containers";
     repo   = "libpod";
     rev    = "v${version}";
-    sha256 = "0cwyrzjjgxclnzc1yx6vm2bvq73mldwxfwalkprzlg8vpqbxji8y";
+    sha256 = "0y87pylpff2xl796n5s2vrm90pspzqfw8h4a5gndn1mx18s09s69";
   };
 
   goPackagePath = "github.com/containers/libpod";
diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index 5aa1f2e1f55..f90873c6e33 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -36,11 +36,10 @@ in
 
 stdenv.mkDerivation rec {
   version = "4.1.0";
-  name = "qemu-"
-    + stdenv.lib.optionalString xenSupport "xen-"
-    + stdenv.lib.optionalString hostCpuOnly "host-cpu-only-"
-    + stdenv.lib.optionalString nixosTestRunner "for-vm-tests-"
-    + version;
+  pname = "qemu"
+    + stdenv.lib.optionalString xenSupport "-xen"
+    + stdenv.lib.optionalString hostCpuOnly "-host-cpu-only"
+    + stdenv.lib.optionalString nixosTestRunner "-for-vm-tests";
 
   src = fetchurl {
     url = "https://wiki.qemu.org/download/qemu-${version}.tar.bz2";
diff --git a/pkgs/data/fonts/comic-neue/default.nix b/pkgs/data/fonts/comic-neue/default.nix
index 2615d0260f0..6dcefe90055 100644
--- a/pkgs/data/fonts/comic-neue/default.nix
+++ b/pkgs/data/fonts/comic-neue/default.nix
@@ -1,7 +1,7 @@
 { lib, fetchzip }:
 
 let
-  version = "2.2";
+  version = "2.3";
 in fetchzip rec {
   name = "comic-neue-${version}";
 
@@ -9,15 +9,15 @@ in fetchzip rec {
 
   postFetch = ''
     mkdir -vp $out/share/{doc,fonts}
-    unzip -j $downloadedFile comic-neue-2.2/\*.otf   -d $out/share/fonts/opentype
-    unzip -j $downloadedFile comic-neue-2.2/\*.ttf   -d $out/share/fonts/truetype
-    unzip -j $downloadedFile comic-neue-2.2/\*.eot   -d $out/share/fonts/EOT
-    unzip -j $downloadedFile comic-neue-2.2/\*.woff  -d $out/share/fonts/WOFF
-    unzip -j $downloadedFile comic-neue-2.2/\*.woff2 -d $out/share/fonts/WOFF2
-    unzip -j $downloadedFile comic-neue-2.2/\*.pdf comic-neue-2.2/FONTLOG.txt comic-neue-2.2/OFL-FAQ.txt comic-neue-2.2/SIL-License.txt -d $out/share/doc/${name}
+    unzip -j $downloadedFile OTF/\*.otf   -d $out/share/fonts/opentype
+    unzip -j $downloadedFile Web/\*.ttf   -d $out/share/fonts/truetype
+    unzip -j $downloadedFile Web/\*.eot   -d $out/share/fonts/EOT
+    unzip -j $downloadedFile Web/\*.woff  -d $out/share/fonts/WOFF
+    unzip -j $downloadedFile Web/\*.woff2 -d $out/share/fonts/WOFF2
+    unzip -j $downloadedFile \*.pdf FONTLOG.txt OFL-FAQ.txt SIL-License.txt -d $out/share/doc/${name}
   '';
 
-  sha256 = "1yypq5aqqzv3q1c6vx5130mi2iwihzzvrawhwqpwsfjl0p25sq9q";
+  sha256 = "1gs4vhys0m3qsw06qaxzyi81f06w5v66kbyl64yw3pq2rb656779";
 
   meta = with lib; {
     homepage = http://comicneue.com/;
diff --git a/pkgs/desktops/gnome-3/apps/gnome-boxes/default.nix b/pkgs/desktops/gnome-3/apps/gnome-boxes/default.nix
index c48e6a7446f..ce8215d6391 100644
--- a/pkgs/desktops/gnome-3/apps/gnome-boxes/default.nix
+++ b/pkgs/desktops/gnome-3/apps/gnome-boxes/default.nix
@@ -1,16 +1,57 @@
-{ stdenv, fetchurl, meson, ninja, wrapGAppsHook, pkgconfig, gettext, itstool, libvirt-glib
-, glib, gobject-introspection, libxml2, gtk3, gtk-vnc, freerdp, libvirt, spice-gtk, python3
-, spice-protocol, libsoup, libosinfo, systemd, tracker, tracker-miners, vala
-, libcap, yajl, gmp, gdbm, cyrus_sasl, gnome3, librsvg, desktop-file-utils
-, mtools, cdrkit, libcdio, libusb, libarchive, acl, libgudev, libsecret
-, libcap_ng, numactl, xen, libapparmor, json-glib, webkitgtk, vte
+{ stdenv
+, fetchurl
+, meson
+, ninja
+, wrapGAppsHook
+, pkgconfig
+, gettext
+, itstool
+, libvirt-glib
+, glib
+, gobject-introspection
+, libxml2
+, gtk3
+, gtk-vnc
+, freerdp
+, libvirt
+, spice-gtk
+, python3
+, spice-protocol
+, libsoup
+, libosinfo
+, systemd
+, tracker
+, tracker-miners
+, vala
+, libcap
+, yajl
+, gmp
+, gdbm
+, cyrus_sasl
+, gnome3
+, librsvg
+, desktop-file-utils
+, mtools
+, cdrkit
+, libcdio
+, libusb
+, libarchive
+, acl
+, libgudev
+, libsecret
+, libcap_ng
+, numactl
+, xen
+, libapparmor
+, json-glib
+, webkitgtk
+, vte
+, glib-networking
 }:
 
-let
-  version = "3.34.1";
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "gnome-boxes";
-  inherit version;
+  version = "3.34.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-boxes/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
@@ -20,18 +61,58 @@ in stdenv.mkDerivation rec {
   doCheck = true;
 
   nativeBuildInputs = [
-    meson ninja vala pkgconfig gettext itstool wrapGAppsHook gobject-introspection desktop-file-utils python3
+    desktop-file-utils
+    gettext
+    gobject-introspection
+    itstool
+    meson
+    ninja
+    pkgconfig
+    python3
+    vala
+    wrapGAppsHook
   ];
 
   # Required for USB redirection PolicyKit rules file
-  propagatedUserEnvPkgs = [ spice-gtk ];
+  propagatedUserEnvPkgs = [
+    spice-gtk
+  ];
 
   buildInputs = [
-    libvirt-glib glib gtk3 gtk-vnc freerdp libxml2
-    libvirt spice-gtk spice-protocol libsoup json-glib webkitgtk libosinfo systemd
-    tracker tracker-miners libcap yajl gmp gdbm cyrus_sasl libusb libarchive
-    gnome3.adwaita-icon-theme librsvg acl libgudev libsecret
-    libcap_ng numactl xen libapparmor vte
+    acl
+    cyrus_sasl
+    freerdp
+    gdbm
+    glib
+    glib-networking
+    gmp
+    gnome3.adwaita-icon-theme
+    gtk-vnc
+    gtk3
+    json-glib
+    libapparmor
+    libarchive
+    libcap
+    libcap_ng
+    libgudev
+    libosinfo
+    librsvg
+    libsecret
+    libsoup
+    libusb
+    libvirt
+    libvirt-glib
+    libxml2
+    numactl
+    spice-gtk
+    spice-protocol
+    systemd
+    tracker
+    tracker-miners
+    vte
+    webkitgtk
+    xen
+    yajl
   ];
 
   preFixup = ''
@@ -45,8 +126,8 @@ in stdenv.mkDerivation rec {
 
   passthru = {
     updateScript = gnome3.updateScript {
-      packageName = "gnome-boxes";
-      attrPath = "gnome3.gnome-boxes";
+      packageName = pname;
+      attrPath = "gnome3.${pname}";
     };
   };
 
diff --git a/pkgs/desktops/gnome-3/default.nix b/pkgs/desktops/gnome-3/default.nix
index 952f6eaf4f8..6d2ae92ac80 100644
--- a/pkgs/desktops/gnome-3/default.nix
+++ b/pkgs/desktops/gnome-3/default.nix
@@ -49,8 +49,6 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   gdm = callPackage ./core/gdm { };
 
-  gjs = callPackage ./core/gjs { };
-
   gnome-backgrounds = callPackage ./core/gnome-backgrounds { };
 
   gnome-bluetooth = callPackage ./core/gnome-bluetooth { };
@@ -360,4 +358,6 @@ lib.makeScope pkgs.newScope (self: with self; {
   inherit (pkgs) vala; # added 2019-10-10
 
   inherit (pkgs) gegl_0_4; # added 2019-10-31
+
+  inherit (pkgs) gjs; # added 2019-01-05
 })
diff --git a/pkgs/desktops/gnome-3/devtools/anjuta/default.nix b/pkgs/desktops/gnome-3/devtools/anjuta/default.nix
index 4df3ed10a69..4f5562bbffa 100644
--- a/pkgs/desktops/gnome-3/devtools/anjuta/default.nix
+++ b/pkgs/desktops/gnome-3/devtools/anjuta/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, gnome3, gtk3, flex, bison, libxml2, intltool,
+{ stdenv, fetchurl, pkgconfig, gnome3, gtk3, gjs, flex, bison, libxml2, intltool,
   gdl, libgda, gtksourceview, gsettings-desktop-schemas,
   itstool, python3, ncurses, makeWrapper }:
 
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     ncurses
   ];
   buildInputs = [
-    flex bison gtk3 libxml2 gnome3.gjs gdl
+    flex bison gtk3 libxml2 gjs gdl
     libgda gtksourceview
     gsettings-desktop-schemas
   ];
diff --git a/pkgs/desktops/gnome-3/extensions/drop-down-terminal/default.nix b/pkgs/desktops/gnome-3/extensions/drop-down-terminal/default.nix
index c0ecfc29e2c..4e7fa17d495 100644
--- a/pkgs/desktops/gnome-3/extensions/drop-down-terminal/default.nix
+++ b/pkgs/desktops/gnome-3/extensions/drop-down-terminal/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, substituteAll, gnome3, vte }:
+{ stdenv, fetchFromGitHub, substituteAll, gjs, vte }:
 
 stdenv.mkDerivation rec {
   pname = "gnome-shell-extension-drop-down-terminal";
@@ -16,8 +16,7 @@ stdenv.mkDerivation rec {
   patches = [
     (substituteAll {
       src = ./fix_vte_and_gjs.patch;
-      inherit vte;
-      gjs = gnome3.gjs;
+      inherit gjs vte;
     })
   ];
 
diff --git a/pkgs/desktops/gnome-3/extensions/gsconnect/default.nix b/pkgs/desktops/gnome-3/extensions/gsconnect/default.nix
index cb1dd5ceaa8..ca232d090a8 100644
--- a/pkgs/desktops/gnome-3/extensions/gsconnect/default.nix
+++ b/pkgs/desktops/gnome-3/extensions/gsconnect/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, substituteAll, python3, openssl, folks, gsound
 , meson, ninja, libxml2, pkgconfig, gobject-introspection, wrapGAppsHook
-, glib, gtk3, at-spi2-core, upower, openssh, gnome3 }:
+, glib, gtk3, at-spi2-core, upower, openssh, gnome3, gjs }:
 
 stdenv.mkDerivation rec {
   pname = "gnome-shell-gsconnect";
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     gsound
     upower
     gnome3.caribou
-    gnome3.gjs # for running daemon
+    gjs # for running daemon
     gnome3.evolution-data-server # for libebook-contacts typelib
   ];
 
diff --git a/pkgs/development/compilers/cudatoolkit/default.nix b/pkgs/development/compilers/cudatoolkit/default.nix
index 0a7b74b465f..98c0381216a 100644
--- a/pkgs/development/compilers/cudatoolkit/default.nix
+++ b/pkgs/development/compilers/cudatoolkit/default.nix
@@ -53,22 +53,25 @@ let
       unpackPhase = ''
         sh $src --keep --noexec
 
-        cd pkg/run_files
-        sh cuda-linux*.run --keep --noexec
-        sh cuda-samples*.run --keep --noexec
-        mv pkg ../../$(basename $src)
-        cd ../..
-        rm -rf pkg
-
-        for patch in $runPatches; do
-          sh $patch --keep --noexec
-          mv pkg $(basename $patch)
-        done
+        ${lib.optionalString (lib.versionOlder version "10.1") ''
+          cd pkg/run_files
+          sh cuda-linux*.run --keep --noexec
+          sh cuda-samples*.run --keep --noexec
+          mv pkg ../../$(basename $src)
+          cd ../..
+          rm -rf pkg
+
+          for patch in $runPatches; do
+            sh $patch --keep --noexec
+            mv pkg $(basename $patch)
+          done
+        ''}
       '';
 
       installPhase = ''
         runHook preInstall
         mkdir $out
+        ${lib.optionalString (lib.versionOlder version "10.1") ''
         cd $(basename $src)
         export PERL5LIB=.
         perl ./install-linux.pl --prefix="$out"
@@ -78,14 +81,22 @@ let
           perl ./install_patch.pl --silent --accept-eula --installdir="$out"
           cd ..
         done
+        ''}
+        ${lib.optionalString (lib.versionAtLeast version "10.1") ''
+          cd pkg/builds/cuda-toolkit
+          mv * $out/
+        ''}
 
         rm $out/tools/CUDA_Occupancy_Calculator.xls # FIXME: why?
 
+        ${lib.optionalString (lib.versionOlder version "10.1") ''
         # let's remove the 32-bit libraries, they confuse the lib64->lib mover
         rm -rf $out/lib
+        ''}
 
         # Remove some cruft.
-        ${lib.optionalString (lib.versionAtLeast version "7.0") "rm $out/bin/uninstall*"}
+        ${lib.optionalString ((lib.versionAtLeast version "7.0") && (lib.versionOlder version "10.1"))
+          "rm $out/bin/uninstall*"}
 
         # Fixup path to samples (needed for cuda 6.5 or else nsight will not find them)
         if [ -d "$out"/cuda-samples ]; then
@@ -109,6 +120,9 @@ let
 
         # Remove OpenCL libraries as they are provided by ocl-icd and driver.
         rm -f $out/lib64/libOpenCL*
+        ${lib.optionalString (lib.versionAtLeast version "10.1") ''
+          mv $out/lib64 $out/lib
+        ''}
 
         # Set compiler for NVCC.
         wrapProgram $out/bin/nvcc \
@@ -302,5 +316,13 @@ in rec {
     gcc = gcc7;
   };
 
-  cudatoolkit_10 = cudatoolkit_10_0;
+  cudatoolkit_10_1 = common {
+    version = "10.1.243";
+    url = "https://developer.download.nvidia.com/compute/cuda/10.1/Prod/local_installers/cuda_10.1.243_418.87.00_linux.run";
+    sha256 = "0caxhlv2bdq863dfp6wj7nad66ml81vasq2ayf11psvq2b12vhp7";
+
+    gcc = gcc7;
+  };
+
+  cudatoolkit_10 = cudatoolkit_10_1;
 }
diff --git a/pkgs/development/compilers/reason/default.nix b/pkgs/development/compilers/reason/default.nix
index 5ade7fd6fba..5d7d0ce6684 100644
--- a/pkgs/development/compilers/reason/default.nix
+++ b/pkgs/development/compilers/reason/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   name = "ocaml${ocaml.version}-reason-${version}";
-  version = "3.5.0";
+  version = "3.5.1";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "reason";
-    rev = "ea207004e021efef5a92ecd011d9d5b9b16bbded";
-    sha256 = "0cdjy7sw15rlk63prrwy8lavqrz8fqwsgwr19ihvj99x332r98kk";
+    rev = "aea245a43eb44034d2fccac7028b640a437af239";
+    sha256 = "0ff7rjxbsg9zkq6sxlm9bkx7yk8x2cvras7z8436msczgd1wmmyf";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/libraries/arrow-cpp/default.nix b/pkgs/development/libraries/arrow-cpp/default.nix
index aaf228e73a6..e277617c0ff 100644
--- a/pkgs/development/libraries/arrow-cpp/default.nix
+++ b/pkgs/development/libraries/arrow-cpp/default.nix
@@ -12,12 +12,12 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "arrow-cpp";
-  version = "0.15.0";
+  version = "0.15.1";
 
   src = fetchurl {
     url =
       "mirror://apache/arrow/arrow-${version}/apache-arrow-${version}.tar.gz";
-    sha256 = "0n7xrn5490r2snjl45pm2a4pr2x8a29sh8mpyi4nj5pr9f62s1yi";
+    sha256 = "1jbghpppabsix2rkxbnh41inj9lcxfz4q94p96xzxshh4g3mhb4s";
   };
 
   sourceRoot = "apache-arrow-${version}/cpp";
diff --git a/pkgs/desktops/gnome-3/core/gjs/default.nix b/pkgs/development/libraries/gjs/default.nix
index b0c1e2d3077..6430be0b57f 100644
--- a/pkgs/desktops/gnome-3/core/gjs/default.nix
+++ b/pkgs/development/libraries/gjs/default.nix
@@ -1,6 +1,19 @@
-{ fetchurl, stdenv, pkgconfig, gnome3, gtk3, atk, gobject-introspection
-, spidermonkey_60, pango, readline, glib, libxml2, dbus, gdk-pixbuf
-, makeWrapper }:
+{ fetchurl
+, stdenv
+, pkgconfig
+, gnome3
+, gtk3
+, atk
+, gobject-introspection
+, spidermonkey_60
+, pango
+, readline
+, glib
+, libxml2
+, dbus
+, gdk-pixbuf
+, makeWrapper
+}:
 
 stdenv.mkDerivation rec {
   pname = "gjs";
@@ -11,16 +24,25 @@ stdenv.mkDerivation rec {
     sha256 = "1xf68rbagkflb9yi3visfw8cbxqlzd717y8jakgw0y6whzm1dpxl";
   };
 
-  passthru = {
-    updateScript = gnome3.updateScript { packageName = "gjs"; attrPath = "gnome3.gjs"; };
-  };
-
   outputs = [ "out" "installedTests" ];
 
-  nativeBuildInputs = [ pkgconfig makeWrapper ];
-  buildInputs = [ libxml2 gobject-introspection glib pango readline dbus ];
+  nativeBuildInputs = [
+    pkgconfig
+    makeWrapper
+  ];
 
-  propagatedBuildInputs = [ spidermonkey_60 ];
+  buildInputs = [
+    libxml2
+    gobject-introspection
+    glib
+    pango
+    readline
+    dbus
+  ];
+
+  propagatedBuildInputs = [
+    spidermonkey_60
+  ];
 
   configureFlags = [
     "--enable-installed-tests"
@@ -42,10 +64,19 @@ stdenv.mkDerivation rec {
       --prefix GI_TYPELIB_PATH : "${stdenv.lib.makeSearchPath "lib/girepository-1.0" [ gtk3 atk pango.out gdk-pixbuf ]}:$installedTests/libexec/gjs/installed-tests"
   '';
 
+  separateDebugInfo = stdenv.isLinux;
+
+  passthru = {
+    updateScript = gnome3.updateScript {
+      packageName = "gjs";
+    };
+  };
+
   meta = with stdenv.lib; {
     description = "JavaScript bindings for GNOME";
+    homepage = "https://gitlab.gnome.org/GNOME/gjs/blob/master/doc/Home.md";
+    license = licenses.lgpl2Plus;
     maintainers = gnome3.maintainers;
     platforms = platforms.linux;
-    license = licenses.lgpl2Plus;
   };
 }
diff --git a/pkgs/development/libraries/libsecret/default.nix b/pkgs/development/libraries/libsecret/default.nix
index 0a3c110bbbd..ca2449adefd 100644
--- a/pkgs/development/libraries/libsecret/default.nix
+++ b/pkgs/development/libraries/libsecret/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, glib, pkgconfig, gettext, libxslt, python3, docbook_xsl, docbook_xml_dtd_42
-, libgcrypt, gobject-introspection, vala, gtk-doc, gnome3, libintl, dbus, xvfb_run }:
+, libgcrypt, gobject-introspection, vala, gtk-doc, gnome3, gjs, libintl, dbus, xvfb_run }:
 
 stdenv.mkDerivation rec {
   pname = "libsecret";
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  installCheckInputs = [ python3 python3.pkgs.dbus-python python3.pkgs.pygobject3 xvfb_run dbus gnome3.gjs ];
+  installCheckInputs = [ python3 python3.pkgs.dbus-python python3.pkgs.pygobject3 xvfb_run dbus gjs ];
 
   # needs to run after install because typelibs point to absolute paths
   doInstallCheck = false; # Failed to load shared library '/force/shared/libmock_service.so.0' referenced by the typelib
diff --git a/pkgs/development/libraries/libtommath/default.nix b/pkgs/development/libraries/libtommath/default.nix
index 8ce82bcf07c..0fde422b9aa 100644
--- a/pkgs/development/libraries/libtommath/default.nix
+++ b/pkgs/development/libraries/libtommath/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libtommath";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchurl {
     url = "https://github.com/libtom/libtommath/releases/download/v${version}/ltm-${version}.tar.xz";
-    sha256 = "1bbyagqzfdbg37k1n08nsqzdf44z8zsnjjinqbsyj7rxg246qilh";
+    sha256 = "1c8q1qy88cjhdjlk3g24mra94h34c1ldvkjz0n2988c0yvn5xixp";
   };
 
   nativeBuildInputs = [ libtool ];
diff --git a/pkgs/development/libraries/muparser/default.nix b/pkgs/development/libraries/muparser/default.nix
index d058322660c..4d3fe41dff8 100644
--- a/pkgs/development/libraries/muparser/default.nix
+++ b/pkgs/development/libraries/muparser/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl, unzip}:
+{stdenv, fetchurl, unzip, setfile}:
 
 stdenv.mkDerivation rec {
   pname = "muparser";
@@ -10,12 +10,14 @@ stdenv.mkDerivation rec {
     sha256 = "00l92k231yb49wijzkspa2l58mapn6vh2dlxnlg0pawjjfv33s6z";
   };
 
-  buildInputs = [ unzip ];
+  buildInputs = [
+    unzip
+  ] ++ stdenv.lib.optionals stdenv.isDarwin [setfile];
 
   meta = {
     homepage = http://muparser.sourceforge.net;
     description = "An extensible high performance math expression parser library written in C++";
     license = stdenv.lib.licenses.mit;
-    platforms = stdenv.lib.platforms.linux;
+    platforms = stdenv.lib.platforms.linux ++ stdenv.lib.platforms.darwin;
   };
 }
diff --git a/pkgs/development/libraries/onnxruntime/default.nix b/pkgs/development/libraries/onnxruntime/default.nix
index b5549c6735f..33bc4c6e82c 100644
--- a/pkgs/development/libraries/onnxruntime/default.nix
+++ b/pkgs/development/libraries/onnxruntime/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "onnxruntime";
-  version = "0.5.0";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "onnxruntime";
     rev = "v${version}";
-    sha256 = "0s8ylc5xr55490hbz7zn3hnp9dnyp92d320ln8xw5hqkw3mgyr3p";
+    sha256 = "1d28lzrjnq69yl8j9ncxlsxl0bniacn3hnsr9van10zgp527436v";
     # TODO: use nix-versions of grpc, onnx, eigen, googletest, etc.
     # submodules increase src size and compile times significantly
     # not currently feasible due to how integrated cmake build is with git
@@ -43,6 +43,8 @@ stdenv.mkDerivation rec {
     rm -r $out/bin   # ctest runner
   '';
 
+  enableParallelBuilding = true;
+
   meta = with stdenv.lib; {
     description = "Cross-platform, high performance scoring engine for ML models";
     longDescription = ''
@@ -55,6 +57,9 @@ stdenv.mkDerivation rec {
       compatibility.
     '';
     homepage = "https://github.com/microsoft/onnxruntime";
+    changelog = "https://github.com/microsoft/onnxruntime/releases";
+    # https://github.com/microsoft/onnxruntime/blob/master/BUILD.md#architectures
+    platforms = platforms.unix;
     license = licenses.mit;
     maintainers = with maintainers; [ jonringer ];
   };
diff --git a/pkgs/development/libraries/opencv/3.x.nix b/pkgs/development/libraries/opencv/3.x.nix
index d8946dae095..874f9535759 100644
--- a/pkgs/development/libraries/opencv/3.x.nix
+++ b/pkgs/development/libraries/opencv/3.x.nix
@@ -36,20 +36,20 @@
 }:
 
 let
-  version = "3.4.7";
+  version = "3.4.8";
 
   src = fetchFromGitHub {
     owner  = "opencv";
     repo   = "opencv";
     rev    = version;
-    sha256 = "0r5rrcnqx2lsnr1ja5ij2chb7yk9kkamr4p0ik52sqxydwkv3z50";
+    sha256 = "1dnz3gfj70lm1gbrk8pz28apinlqi2x6nvd6xcy5hs08505nqnjp";
   };
 
   contribSrc = fetchFromGitHub {
     owner  = "opencv";
     repo   = "opencv_contrib";
     rev    = version;
-    sha256 = "1ik6acsmgrx66awf19r2y3ijqvv9xg43gaphwszbiyi0jq3r43yw";
+    sha256 = "0psaa1yx36n34l09zd1y8jxgf8q4jzxd3vn06fqmzwzy85hcqn8i";
   };
 
   # Contrib must be built in order to enable Tesseract support:
diff --git a/pkgs/development/libraries/science/math/cudnn/default.nix b/pkgs/development/libraries/science/math/cudnn/default.nix
index a33e3ec2009..8cd74939959 100644
--- a/pkgs/development/libraries/science/math/cudnn/default.nix
+++ b/pkgs/development/libraries/science/math/cudnn/default.nix
@@ -1,4 +1,4 @@
-{ callPackage, cudatoolkit_7, cudatoolkit_7_5, cudatoolkit_8, cudatoolkit_9_0, cudatoolkit_9_1, cudatoolkit_9_2, cudatoolkit_10_0 }:
+{ callPackage, cudatoolkit_7, cudatoolkit_7_5, cudatoolkit_8, cudatoolkit_9_0, cudatoolkit_9_1, cudatoolkit_9_2, cudatoolkit_10_0, cudatoolkit_10_1 }:
 
 let
   generic = args: callPackage (import ./generic.nix (removeAttrs args ["cudatoolkit"])) {
@@ -65,5 +65,12 @@ in rec {
     sha256 = "18ys0apiz9afid2s6lvy9qbyi8g66aimb2a7ikl1f3dm09mciprf";
   };
 
-  cudnn_cudatoolkit_10 = cudnn_cudatoolkit_10_0;
+  cudnn_cudatoolkit_10_1 = generic rec {
+    version = "7.6.3";
+    cudatoolkit = cudatoolkit_10_1;
+    srcName = "cudnn-${cudatoolkit.majorVersion}-linux-x64-v7.6.3.30.tgz";
+    sha256 = "0qc9f1xpyfibwqrpqxxq2v9h6w90j0dbx564akwy44c1dls5f99m";
+  };
+
+  cudnn_cudatoolkit_10 = cudnn_cudatoolkit_10_1;
 }
diff --git a/pkgs/development/python-modules/cytoolz/default.nix b/pkgs/development/python-modules/cytoolz/default.nix
index f95da9b75b2..1a142cae0f0 100644
--- a/pkgs/development/python-modules/cytoolz/default.nix
+++ b/pkgs/development/python-modules/cytoolz/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "cytoolz";
-  version = "0.10.0";
+  version = "0.10.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ed9f6a07c2bac70d6c597df360d0666d11d2adc90141d54c5c2db08b380a4fac";
+    sha256 = "0p4a9nadsy1337gy2cnb5yanbn03j3zm6d9adyqad9bk3nlbpxc2";
   };
 
   # Extension types
diff --git a/pkgs/development/python-modules/pythondialog/default.nix b/pkgs/development/python-modules/pythondialog/default.nix
new file mode 100644
index 00000000000..d2c82cf83f1
--- /dev/null
+++ b/pkgs/development/python-modules/pythondialog/default.nix
@@ -0,0 +1,27 @@
+{ stdenv
+, buildPythonPackage
+, fetchPypi
+, isPy3k
+}:
+
+buildPythonPackage rec {
+  pname = "pythondialog";
+  version = "3.4.0";
+  disabled = !isPy3k;
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1728ghsran47jczn9bhlnkvk5bvqmmbihabgif5h705b84r1272c";
+  };
+
+  patchPhase = ''
+    substituteInPlace dialog.py --replace ":/bin:/usr/bin" ":$out/bin"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A Python interface to the UNIX dialog utility and mostly-compatible programs";
+    homepage = "http://pythondialog.sourceforge.net/";
+    license = licenses.lgpl3;
+  };
+
+}
diff --git a/pkgs/development/tools/analysis/flow/default.nix b/pkgs/development/tools/analysis/flow/default.nix
index b309f559f36..81407a3897f 100644
--- a/pkgs/development/tools/analysis/flow/default.nix
+++ b/pkgs/development/tools/analysis/flow/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "flow";
-  version = "0.111.0";
+  version = "0.111.3";
 
   src = fetchFromGitHub {
     owner  = "facebook";
     repo   = "flow";
     rev    = "refs/tags/v${version}";
-    sha256 = "17w26b17n81kc1igmr6dgm6y2aa1ng0cbhbhwwz3iwsf0dm6db1l";
+    sha256 = "12hfdcm491ylh0a8rhzj76wdbh556r02aj4q6vv86n3lh2120cxm";
   };
 
   installPhase = ''
diff --git a/pkgs/development/tools/clj-kondo/default.nix b/pkgs/development/tools/clj-kondo/default.nix
index 9b2e80c7674..f821ac32fc4 100644
--- a/pkgs/development/tools/clj-kondo/default.nix
+++ b/pkgs/development/tools/clj-kondo/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec{
   pname = "clj-kondo";
-  version = "2019.10.26";
+  version = "2019.11.03";
 
   reflectionJson = fetchurl {
     name = "reflection.json";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec{
 
   src = fetchurl {
     url = "https://github.com/borkdude/${pname}/releases/download/v${version}/${pname}-${version}-standalone.jar";
-    sha256 = "1pq03g4bkslpa3jv7vrnw3sy6wnqdgnavl8qyb4lb1y96pmk9hd1";
+    sha256 = "1chvdfczlxyy1jspyf4yv1kmgz6fq4fih5qvfarvcyw7nlxlj2np";
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/tools/misc/sysbench/default.nix b/pkgs/development/tools/misc/sysbench/default.nix
index 8076925f29b..8feeb13db95 100644
--- a/pkgs/development/tools/misc/sysbench/default.nix
+++ b/pkgs/development/tools/misc/sysbench/default.nix
@@ -1,21 +1,26 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, vim, libmysqlclient
-, libaio }:
+{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig
+, libmysqlclient, libaio
+}:
 
-stdenv.mkDerivation {
-  name = "sysbench-1.0.17";
+stdenv.mkDerivation rec {
+  pname = "sysbench";
+  version = "1.0.18";
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
-  buildInputs = [ vim libmysqlclient libaio ];
+  buildInputs = [ libmysqlclient libaio ];
 
   src = fetchFromGitHub {
     owner = "akopytov";
-    repo = "sysbench";
-    rev = "1.0.17";
-    sha256 = "02i9knvp0bjw6ri848xxiy2dbww2xv70nah9yn67a6zgw617hwa6";
+    repo = pname;
+    rev = version;
+    sha256 = "1r6lkyfp65xqklj1rdfw551srqqyak144agi8x3wjz3wmsbqls19";
   };
 
+  enableParallelBuilding = true;
+
   meta = {
     description = "Modular, cross-platform and multi-threaded benchmark tool";
+    homepage = https://github.com/akopytov/sysbench;
     license = stdenv.lib.licenses.gpl2;
     platforms = stdenv.lib.platforms.linux;
   };
diff --git a/pkgs/development/tools/qtcreator/0001-Fix-clang-libcpp-regexp.patch b/pkgs/development/tools/qtcreator/0001-Fix-clang-libcpp-regexp.patch
index 8744b753a6e..39c5c06a285 100644
--- a/pkgs/development/tools/qtcreator/0001-Fix-clang-libcpp-regexp.patch
+++ b/pkgs/development/tools/qtcreator/0001-Fix-clang-libcpp-regexp.patch
@@ -1,8 +1,8 @@
 diff --git a/src/plugins/cpptools/headerpathfilter.cpp b/src/plugins/cpptools/headerpathfilter.cpp
-index b514c46..5f96358 100644
+index e2d1e6a..1a1d839 100644
 --- a/src/plugins/cpptools/headerpathfilter.cpp
 +++ b/src/plugins/cpptools/headerpathfilter.cpp
-@@ -92,8 +92,8 @@ HeaderPaths::iterator resourceIterator(HeaderPaths &headerPaths, bool isMacOs)
+@@ -96,8 +96,8 @@ HeaderPaths::iterator resourceIterator(HeaderPaths &headerPaths, bool isMacOs)
  {
      // include/c++, include/g++, libc++\include and libc++abi\include
      static const QString cppIncludes = R"((.*\/include\/.*(g\+\+|c\+\+).*))"
diff --git a/pkgs/development/tools/qtcreator/0002-Dont-remove-clang-header-paths.patch b/pkgs/development/tools/qtcreator/0002-Dont-remove-clang-header-paths.patch
new file mode 100644
index 00000000000..5cd34991c39
--- /dev/null
+++ b/pkgs/development/tools/qtcreator/0002-Dont-remove-clang-header-paths.patch
@@ -0,0 +1,13 @@
+diff --git a/src/plugins/cpptools/headerpathfilter.cpp b/src/plugins/cpptools/headerpathfilter.cpp
+index e2d1e6a..1a1d839 100644
+--- a/src/plugins/cpptools/headerpathfilter.cpp
++++ b/src/plugins/cpptools/headerpathfilter.cpp
+@@ -134,8 +134,6 @@ void removeClangSystemHeaderPaths(HeaderPaths &headerPaths)
+ 
+ void HeaderPathFilter::tweakHeaderPaths()
+ {
+-    removeClangSystemHeaderPaths(builtInHeaderPaths);
+-
+     auto split = resourceIterator(builtInHeaderPaths,
+                                   projectPart.toolChainTargetTriple.contains("darwin"));
+ 
diff --git a/pkgs/development/tools/qtcreator/default.nix b/pkgs/development/tools/qtcreator/default.nix
index 7e592bf060a..55eb30ab370 100644
--- a/pkgs/development/tools/qtcreator/default.nix
+++ b/pkgs/development/tools/qtcreator/default.nix
@@ -1,14 +1,11 @@
 { mkDerivation, lib, fetchurl, fetchgit, fetchpatch
 , qtbase, qtquickcontrols, qtscript, qtdeclarative, qmake, llvmPackages_8
-, withDocumentation ? false
+, withDocumentation ? false, withClangPlugins ? true 
 }:
 
 with lib;
 
 let
-  baseVersion = "4.9";
-  revision = "1";
-
   # Fetch clang from qt vendor, this contains submodules like this:
   # clang<-clang-tools-extra<-clazy.
   clang_qt_vendor = llvmPackages_8.clang-unwrapped.overrideAttrs (oldAttrs: {
@@ -23,35 +20,28 @@ in
 
 mkDerivation rec {
   pname = "qtcreator";
-  version = "${baseVersion}.${revision}";
+  version = "4.10.0";
+  baseVersion = builtins.concatStringsSep "." (lib.take 2 (builtins.splitVersion version));
 
   src = fetchurl {
     url = "http://download.qt-project.org/official_releases/${pname}/${baseVersion}/${version}/qt-creator-opensource-src-${version}.tar.xz";
-    sha256 = "10ddp1365rf0z4bs7yzc9hajisp3j6mzjshyd0vpi4ki126j5f3r";
+    sha256 = "12hgxdghz05ms4zl8prz2w8l66vmgw1qw2gsmmwqi2rdaay3lpcg";
   };
 
-  buildInputs = [ qtbase qtscript qtquickcontrols qtdeclarative llvmPackages_8.libclang clang_qt_vendor llvmPackages_8.llvm ];
+  buildInputs = [ qtbase qtscript qtquickcontrols qtdeclarative ] ++ 
+    optionals withClangPlugins [ llvmPackages_8.libclang 
+                                 clang_qt_vendor 
+                                 llvmPackages_8.llvm ];
 
   nativeBuildInputs = [ qmake ];
 
   # 0001-Fix-clang-libcpp-regexp.patch is for fixing regexp that is used to
   # find clang libc++ library include paths. By default it's not covering paths
   # like libc++-version, which is default name for libc++ folder in nixos.
+  # ./0002-Dont-remove-clang-header-paths.patch is for forcing qtcreator to not 
+  # remove system clang include paths.
   patches = [ ./0001-Fix-clang-libcpp-regexp.patch
-
-    # Fix clazy plugin name. This plugin was renamed with clang8
-    # release, and patch didn't make it into 4.9.1 release. Should be removed
-    # on qtcreator update, if this problem is fixed.
-    (fetchpatch {
-      url = "https://code.qt.io/cgit/qt-creator/qt-creator.git/patch/src/plugins/clangcodemodel/clangeditordocumentprocessor.cpp?id=53c407bc0c87e0b65b537bf26836ddd8e00ead82";
-      sha256 = "1lanp7jg0x8jffajb852q8p4r34facg41l410xsz6s1k91jskbi9";
-    })
-
-    (fetchpatch {
-      url = "https://code.qt.io/cgit/qt-creator/qt-creator.git/patch/src/plugins/clangtools/clangtidyclazyrunner.cpp?id=53c407bc0c87e0b65b537bf26836ddd8e00ead82";
-      sha256 = "1rl0rc2l297lpfhhawvkkmj77zb081hhp0bbi7nnykf3q9ch0clh";
-    })
-  ];
+              ./0002-Dont-remove-clang-header-paths.patch ];
 
   doCheck = true;
 
@@ -63,8 +53,8 @@ mkDerivation rec {
 
   preConfigure = ''
     substituteInPlace src/plugins/plugins.pro \
-      --replace '$$[QT_INSTALL_QML]/QtQuick/Controls' '${qtquickcontrols}/${qtbase.qtQmlPrefix}/QtQuick/Controls'
-
+      --replace '$$[QT_INSTALL_QML]/QtQuick/Controls' '${qtquickcontrols}/${qtbase.qtQmlPrefix}/QtQuick/Controls' 
+    '' + optionalString withClangPlugins ''
     # Fix paths for llvm/clang includes directories.
     substituteInPlace src/shared/clang/clang_defines.pri \
       --replace '$$clean_path($${LLVM_LIBDIR}/clang/$${LLVM_VERSION}/include)' '${clang_qt_vendor}/lib/clang/8.0.0/include' \
@@ -77,7 +67,9 @@ mkDerivation rec {
     # Fix paths to libclang library.
     substituteInPlace src/shared/clang/clang_installation.pri \
       --replace 'LIBCLANG_LIBS = -L$${LLVM_LIBDIR}' 'LIBCLANG_LIBS = -L${llvmPackages_8.libclang}/lib' \
-      --replace 'LIBCLANG_LIBS += $${CLANG_LIB}' 'LIBCLANG_LIBS += -lclang'
+      --replace 'LIBCLANG_LIBS += $${CLANG_LIB}' 'LIBCLANG_LIBS += -lclang' \
+      --replace 'LIBTOOLING_LIBS = -L$${LLVM_LIBDIR}' 'LIBTOOLING_LIBS = -L${clang_qt_vendor}/lib' \
+      --replace 'LLVM_CXXFLAGS ~= s,-gsplit-dwarf,' '${lib.concatStringsSep "\n" ["LLVM_CXXFLAGS ~= s,-gsplit-dwarf," "    LLVM_CXXFLAGS += -fno-rtti"]}'
   '';
 
   preBuild = optional withDocumentation ''
diff --git a/pkgs/servers/http/apache-modules/mod_tile/default.nix b/pkgs/servers/http/apache-modules/mod_tile/default.nix
new file mode 100644
index 00000000000..397e0dfe0bb
--- /dev/null
+++ b/pkgs/servers/http/apache-modules/mod_tile/default.nix
@@ -0,0 +1,35 @@
+{ stdenv, fetchFromGitHub, autoreconfHook, apacheHttpd, apr, cairo, iniparser, mapnik }:
+
+stdenv.mkDerivation rec {
+  pname = "mod_tile";
+  version = "unstable-2017-01-08";
+
+  src = fetchFromGitHub {
+    owner = "openstreetmap";
+    repo = "mod_tile";
+    rev = "e25bfdba1c1f2103c69529f1a30b22a14ce311f1";
+    sha256 = "12c96avka1dfb9wxqmjd57j30w9h8yx4y4w34kyq6xnf6lwnkcxp";
+  };
+
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ apacheHttpd apr cairo iniparser mapnik ];
+
+  configureFlags = [
+    "--with-apxs=${apacheHttpd.dev}/bin/apxs"
+  ];
+
+  installPhase = ''
+    mkdir -p $out/modules
+    make install-mod_tile DESTDIR=$out
+    mv $out${apacheHttpd}/* $out
+    rm -rf $out/nix
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/openstreetmap/mod_tile";
+    description = "Efficiently render and serve OpenStreetMap tiles using Apache and Mapnik";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ jglukasik ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/servers/matrix-synapse/default.nix b/pkgs/servers/matrix-synapse/default.nix
index 0c0a2c1908b..b9f4cb38742 100644
--- a/pkgs/servers/matrix-synapse/default.nix
+++ b/pkgs/servers/matrix-synapse/default.nix
@@ -23,11 +23,11 @@ let
 
 in buildPythonApplication rec {
   pname = "matrix-synapse";
-  version = "1.5.0";
+  version = "1.5.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0skhzbwzq2985frnd86fn2hxhsmy0q1l5p9aich8l2gyg1dd3wb8";
+    sha256 = "14c9wjp3w9m8hnm91r2a33lvd3avq5xx759dy23wmmh0z8xf0k4a";
   };
 
   patches = [
diff --git a/pkgs/tools/admin/pulumi/data.nix b/pkgs/tools/admin/pulumi/data.nix
new file mode 100644
index 00000000000..1edc80c24e2
--- /dev/null
+++ b/pkgs/tools/admin/pulumi/data.nix
@@ -0,0 +1,51 @@
+# DO NOT EDIT! This file is generated automatically by update.sh
+{ }:
+{
+  version = "1.4.0";
+  pulumiPkgs = {
+    x86_64-linux = [
+      {
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v1.4.0-linux-x64.tar.gz";
+        sha256 = "00ywy2ba4xha6gwd42i3fdrk1myivkd1r6ijdr2vkianmg524k6f";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v0.2.0-linux-amd64.tar.gz";
+        sha256 = "1hj4gysjipd091f106a7xz02g9cail5d11rn6j08m0xphg9cf3fn";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v1.4.1-linux-amd64.tar.gz";
+        sha256 = "0r6xpsb2riqmxwxw28lbi3xd7w4ds510gw99j1rr57h5b9bq19jj";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v1.2.3-linux-amd64.tar.gz";
+        sha256 = "0m7fajy3cy1agsz787ak548khwj8rwahs1ibaswqfyyw092iyzb9";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v1.7.0-linux-amd64.tar.gz";
+        sha256 = "1qw90l7h8yn06bz2l2995nbrc3svs223dm3ys1807amj4n2jyfwb";
+      }
+    ];
+    x86_64-darwin = [
+      {
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v1.4.0-darwin-x64.tar.gz";
+        sha256 = "02vqw9gn17dy3rfh0j00k9f827l42g3nl3rhlcbc8jbgx3n9c9qy";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v0.2.0-darwin-amd64.tar.gz";
+        sha256 = "077j9fp8ix00rcqrq8qxk3kvz6gz6sknzb2iv3qjvkh6yh292mz3";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v1.4.1-darwin-amd64.tar.gz";
+        sha256 = "1i2vf3bxwf8awvw183hq9bbnmznda1jpv1zqghgz2ybx4s0915nx";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v1.2.3-darwin-amd64.tar.gz";
+        sha256 = "123czx1c31r5r91k2jhdgmnffypnl8w1a6h9mr2rdhwgbx8hzq40";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v1.7.0-darwin-amd64.tar.gz";
+        sha256 = "0cl0vakppxi0v8ym8b4fzhzb10nl84wd0vfik8gpfwsg7zwdzhlp";
+      }
+    ];
+  };
+}
diff --git a/pkgs/tools/admin/pulumi/default.nix b/pkgs/tools/admin/pulumi/default.nix
index bba5c7e09cf..977c1991fab 100644
--- a/pkgs/tools/admin/pulumi/default.nix
+++ b/pkgs/tools/admin/pulumi/default.nix
@@ -3,26 +3,16 @@
 with lib;
 
 let
-
-  version = "1.4.0";
-
-  # switch the dropdown to “manual” on https://pulumi.io/quickstart/install.html # TODO: update script
-  pulumiArchPackage = {
-    x86_64-linux = {
-      url = "https://get.pulumi.com/releases/sdk/pulumi-v${version}-linux-x64.tar.gz";
-      sha256 = "00ywy2ba4xha6gwd42i3fdrk1myivkd1r6ijdr2vkianmg524k6f";
-    };
-    x86_64-darwin = {
-      url = "https://get.pulumi.com/releases/sdk/pulumi-v${version}-darwin-x64.tar.gz";
-      sha256 = "02vqw9gn17dy3rfh0j00k9f827l42g3nl3rhlcbc8jbgx3n9c9qy";
-    };
-  };
-
+  data = import ./data.nix {};
 in stdenv.mkDerivation {
-  inherit version;
   pname = "pulumi";
+  version = data.version;
+
+  postUnpack = ''
+    mv pulumi-* pulumi
+  '';
 
-  src = fetchurl pulumiArchPackage.${stdenv.hostPlatform.system};
+  srcs = map (x: fetchurl x) data.pulumiPkgs.${stdenv.hostPlatform.system};
 
   installPhase = ''
     mkdir -p $out/bin
@@ -35,9 +25,10 @@ in stdenv.mkDerivation {
     homepage = https://pulumi.io/;
     description = "Pulumi is a cloud development platform that makes creating cloud programs easy and productive";
     license = with licenses; [ asl20 ];
-    platforms = builtins.attrNames pulumiArchPackage;
+    platforms = builtins.attrNames data.pulumiPkgs;
     maintainers = with maintainers; [
       peterromfeldhk
+      jlesquembre
     ];
   };
 }
diff --git a/pkgs/tools/admin/pulumi/update.sh b/pkgs/tools/admin/pulumi/update.sh
new file mode 100644
index 00000000000..7cb500ee9d3
--- /dev/null
+++ b/pkgs/tools/admin/pulumi/update.sh
@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+
+VERSION="1.4.0"
+
+declare -A plugins
+plugins=(
+    ["aws"]="1.7.0"
+    ["gcp"]="1.4.1"
+    ["kubernetes"]="1.2.3"
+    ["random"]="0.2.0"
+)
+
+function genMainSrc() {
+    local url="https://get.pulumi.com/releases/sdk/pulumi-v${VERSION}-$1-x64.tar.gz"
+    local sha256
+    sha256=$(nix-prefetch-url "$url")
+    echo "      {"
+    echo "        url = \"${url}\";"
+    echo "        sha256 = \"$sha256\";"
+    echo "      }"
+}
+
+function genSrcs() {
+    for plug in "${!plugins[@]}"; do
+        local version=${plugins[$plug]}
+        # url as defined here
+        # https://github.com/pulumi/pulumi/blob/06d4dde8898b2a0de2c3c7ff8e45f97495b89d82/pkg/workspace/plugins.go#L197
+        local url="https://api.pulumi.com/releases/plugins/pulumi-resource-${plug}-v${version}-$1-amd64.tar.gz"
+        local sha256
+        sha256=$(nix-prefetch-url "$url")
+        echo "      {"
+        echo "        url = \"${url}\";"
+        echo "        sha256 = \"$sha256\";"
+        echo "      }"
+    done
+}
+
+cat <<EOF
+# DO NOT EDIT! This file is generated automatically by update.sh
+{ }:
+{
+  version = "${VERSION}";
+  pulumiPkgs = {
+    x86_64-linux = [
+EOF
+genMainSrc "linux"
+genSrcs "linux"
+echo "    ];"
+
+echo "    x86_64-darwin = ["
+genMainSrc "darwin"
+genSrcs "darwin"
+echo "    ];"
+echo "  };"
+echo "}"
diff --git a/pkgs/tools/compression/zstd/default.nix b/pkgs/tools/compression/zstd/default.nix
index 5a153393ccd..01e8525fe8f 100644
--- a/pkgs/tools/compression/zstd/default.nix
+++ b/pkgs/tools/compression/zstd/default.nix
@@ -5,10 +5,10 @@
 
 stdenv.mkDerivation rec {
   pname = "zstd";
-  version = "1.4.3";
+  version = "1.4.4";
 
   src = fetchFromGitHub {
-    sha256 = "0mmgs98cfh92gcbjyv37vz8nq7x4x7fbzymlxyqd9awwpv9v0i5n";
+    sha256 = "0zn7r8d4m8w2lblnjalqpz18na0spzkdiw3fwq2fzb7drhb32v54";
     rev = "v${version}";
     repo = "zstd";
     owner = "facebook";
diff --git a/pkgs/tools/misc/ostree/default.nix b/pkgs/tools/misc/ostree/default.nix
index 9f423cf6a4d..4c5e4a50ef6 100644
--- a/pkgs/tools/misc/ostree/default.nix
+++ b/pkgs/tools/misc/ostree/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchpatch, pkgconfig, gtk-doc, gobject-introspection, gnome3
+{ stdenv, fetchurl, fetchpatch, pkgconfig, gtk-doc, gobject-introspection, gjs
 , glib, systemd, xz, e2fsprogs, libsoup, gpgme, which, autoconf, automake, libtool, fuse, utillinuxMinimal, libselinux
 , libarchive, libcap, bzip2, yacc, libxslt, docbook_xsl, docbook_xml_dtd_42, python3
 }:
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     glib systemd e2fsprogs libsoup gpgme fuse libselinux libcap
     libarchive bzip2 xz
     utillinuxMinimal # for libmount
-    (python3.withPackages (p: with p; [ pyyaml ])) gnome3.gjs # for tests
+    (python3.withPackages (p: with p; [ pyyaml ])) gjs # for tests
   ];
 
   preConfigure = ''
diff --git a/pkgs/tools/misc/youtube-dl/default.nix b/pkgs/tools/misc/youtube-dl/default.nix
index 610738daebd..bc198eb595b 100644
--- a/pkgs/tools/misc/youtube-dl/default.nix
+++ b/pkgs/tools/misc/youtube-dl/default.nix
@@ -18,11 +18,11 @@ buildPythonPackage rec {
   # The websites youtube-dl deals with are a very moving target. That means that
   # downloads break constantly. Because of that, updates should always be backported
   # to the latest stable release.
-  version = "2019.10.29";
+  version = "2019.11.05";
 
   src = fetchurl {
     url = "https://yt-dl.org/downloads/${version}/${pname}-${version}.tar.gz";
-    sha256 = "1lq6ycjbx07831s24yx42q6m6svas4mf02vbszw0965dbbzs7vp4";
+    sha256 = "129461i4103slqj3nq69djnlmgjj3lfgmazn41avc5g967w29b85";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/text/coloursum/default.nix b/pkgs/tools/text/coloursum/default.nix
index 212f071f276..133b9968850 100644
--- a/pkgs/tools/text/coloursum/default.nix
+++ b/pkgs/tools/text/coloursum/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "coloursum";
-  version = "0.1.0";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "ticky";
     repo = "coloursum";
     rev = "v${version}";
-    sha256 = "18ikwi0ihn0vadazrkh85jfz8a2f0dkfb3zns5jzh7p7mb0ylrr2";
+    sha256 = "1piz0l7qdcvjzfykm6rzqc8s1daxp3cj3923v9cmm41bc2v0p5q0";
   };
 
-  cargoSha256 = "0f73vqa82w4ccr0cc95mxga3r8jgd92jnksshxzaffbpx4s334p3";
+  cargoSha256 = "091flc5ymx0y43ld6bdmig5cy479b90bkmwv3yaysi5kpr28skvh";
 
   meta = with stdenv.lib; {
     description = "Colourise your checksum output";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index caa0e13e4f8..c274c71dc38 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -877,6 +877,8 @@ in
 
   gitter = callPackage  ../applications/networking/instant-messengers/gitter { };
 
+  gjs = callPackage ../development/libraries/gjs { };
+
   glasgow = with python3Packages; toPythonApplication glasgow;
 
   gucci = callPackage ../tools/text/gucci { };
@@ -2554,9 +2556,10 @@ in
     cudatoolkit_9_1
     cudatoolkit_9_2
     cudatoolkit_10
-    cudatoolkit_10_0;
+    cudatoolkit_10_0
+    cudatoolkit_10_1;
 
-  cudatoolkit = cudatoolkit_9;
+  cudatoolkit = cudatoolkit_10;
 
   inherit (callPackages ../development/libraries/science/math/cudnn { })
     cudnn_cudatoolkit_7
@@ -2568,9 +2571,10 @@ in
     cudnn_cudatoolkit_9_1
     cudnn_cudatoolkit_9_2
     cudnn_cudatoolkit_10
-    cudnn_cudatoolkit_10_0;
+    cudnn_cudatoolkit_10_0
+    cudnn_cudatoolkit_10_1;
 
-  cudnn = cudnn_cudatoolkit_9;
+  cudnn = cudnn_cudatoolkit_10;
 
   curlFull = curl.override {
     idnSupport = true;
@@ -12993,7 +12997,9 @@ in
 
   mumlib = callPackage ../development/libraries/mumlib { };
 
-  muparser = callPackage ../development/libraries/muparser { };
+  muparser = callPackage ../development/libraries/muparser {
+    inherit (darwin.stubs) setfile;
+  };
 
   mutest = callPackage ../development/libraries/mutest { };
 
@@ -14753,6 +14759,8 @@ in
 
     mod_python = callPackage ../servers/http/apache-modules/mod_python { };
 
+    mod_tile = callPackage ../servers/http/apache-modules/mod_tile { };
+
     mod_wsgi  = self.mod_wsgi2;
     mod_wsgi2 = callPackage ../servers/http/apache-modules/mod_wsgi { python = python2; ncurses = null; };
     mod_wsgi3 = callPackage ../servers/http/apache-modules/mod_wsgi { python = python3; };
@@ -22181,8 +22189,6 @@ in
     inherit (darwin.apple_sdk.frameworks) IOKit;
   };
 
-  jormungandr = callPackage ../applications/blockchains/jormungandr { };
-
   ledger-live-desktop = callPackage ../applications/blockchains/ledger-live-desktop { };
 
   litecoin  = callPackage ../applications/blockchains/litecoin.nix {
@@ -22911,7 +22917,7 @@ in
 
   superTuxKart = callPackage ../games/super-tux-kart { };
 
-  synthv1 = callPackage ../applications/audio/synthv1 { };
+  synthv1 = libsForQt5.callPackage ../applications/audio/synthv1 { };
 
   system-syzygy = callPackage ../games/system-syzygy { };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 5f07364ddcc..cbdfee0c334 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3264,6 +3264,8 @@ in {
     cudaSupport = false;
   };
 
+  pythondialog = callPackage ../development/python-modules/pythondialog { };
+
   python2-pythondialog = callPackage ../development/python-modules/python2-pythondialog { };
 
   pyRFC3339 = callPackage ../development/python-modules/pyrfc3339 { };