summary refs log tree commit diff
diff options
context:
space:
mode:
authorFrederik Rietdijk <fridh@fridh.nl>2019-02-16 09:30:46 +0100
committerFrederik Rietdijk <fridh@fridh.nl>2019-02-16 09:30:46 +0100
commitfd48a94b62592c68e7d66329ba33930d3cfe3f37 (patch)
tree4230272708eb350a36c29c08cac98e159d5e65a9
parenta0eb6c1f81e1d294726c644ff47f1e851afb2f10 (diff)
parent6fe10d27799c284c72876f792c7b12d7fa54602b (diff)
downloadnixpkgs-fd48a94b62592c68e7d66329ba33930d3cfe3f37.tar
nixpkgs-fd48a94b62592c68e7d66329ba33930d3cfe3f37.tar.gz
nixpkgs-fd48a94b62592c68e7d66329ba33930d3cfe3f37.tar.bz2
nixpkgs-fd48a94b62592c68e7d66329ba33930d3cfe3f37.tar.lz
nixpkgs-fd48a94b62592c68e7d66329ba33930d3cfe3f37.tar.xz
nixpkgs-fd48a94b62592c68e7d66329ba33930d3cfe3f37.tar.zst
nixpkgs-fd48a94b62592c68e7d66329ba33930d3cfe3f37.zip
Merge staging-next into staging
-rw-r--r--maintainers/maintainer-list.nix15
-rw-r--r--nixos/doc/manual/configuration/wireless.xml5
-rw-r--r--nixos/doc/manual/release-notes/rl-1903.xml17
-rw-r--r--nixos/modules/services/misc/zoneminder.nix8
-rw-r--r--nixos/modules/services/networking/flannel.nix41
-rw-r--r--nixos/modules/services/networking/wpa_supplicant.nix21
-rw-r--r--nixos/modules/services/printing/cupsd.nix4
-rw-r--r--nixos/modules/services/web-apps/matomo-doc.xml32
-rw-r--r--nixos/modules/services/web-apps/matomo.nix99
-rw-r--r--nixos/modules/services/web-apps/tt-rss.nix28
-rw-r--r--nixos/modules/services/web-servers/phpfpm/default.nix9
-rw-r--r--nixos/modules/services/web-servers/phpfpm/pool-options.nix9
-rw-r--r--nixos/tests/all-tests.nix1
-rw-r--r--nixos/tests/flannel.nix5
-rw-r--r--nixos/tests/printing.nix2
-rw-r--r--nixos/tests/switch-test.nix13
-rw-r--r--pkgs/applications/audio/cmus/default.nix4
-rw-r--r--pkgs/applications/audio/deadbeef/default.nix4
-rw-r--r--pkgs/applications/audio/mimic/default.nix13
-rw-r--r--pkgs/applications/editors/android-studio/default.nix12
-rw-r--r--pkgs/applications/editors/atom/default.nix8
-rw-r--r--pkgs/applications/graphics/shotwell/default.nix4
-rw-r--r--pkgs/applications/misc/qmapshack/default.nix4
-rw-r--r--pkgs/applications/misc/safeeyes/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/chromium/default.nix12
-rw-r--r--pkgs/applications/networking/browsers/firefox/packages.nix20
-rw-r--r--pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/terraform-providers/libvirt/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/mikutter/default.nix1
-rw-r--r--pkgs/applications/networking/instant-messengers/riot/riot-web.nix4
-rw-r--r--pkgs/applications/networking/sync/unison/default.nix17
-rw-r--r--pkgs/applications/science/logic/z3/0001-fix-2131.patch66
-rw-r--r--pkgs/applications/science/logic/z3/default.nix4
-rw-r--r--pkgs/applications/science/math/sage/sage-src.nix4
-rw-r--r--pkgs/applications/video/aegisub/default.nix6
-rw-r--r--pkgs/applications/video/bomi/default.nix5
-rw-r--r--pkgs/applications/video/mplayer/default.nix4
-rw-r--r--pkgs/applications/virtualization/qemu/default.nix5
-rw-r--r--pkgs/applications/virtualization/virtualbox/default.nix4
-rw-r--r--pkgs/applications/window-managers/i3/gaps.nix6
-rwxr-xr-xpkgs/common-updater/scripts/update-source-version2
-rw-r--r--pkgs/data/themes/shades-of-gray/default.nix4
-rw-r--r--pkgs/desktops/gnome-3/apps/evolution/default.nix4
-rw-r--r--pkgs/desktops/gnome-3/core/evolution-data-server/default.nix4
-rw-r--r--pkgs/desktops/lxqt/compton-conf/default.nix10
-rw-r--r--pkgs/desktops/lxqt/default.nix4
-rw-r--r--pkgs/desktops/lxqt/libfm-qt/default.nix7
-rw-r--r--pkgs/desktops/lxqt/liblxqt/default.nix10
-rw-r--r--pkgs/desktops/lxqt/libqtxdg/default.nix12
-rw-r--r--pkgs/desktops/lxqt/libsysstat/default.nix14
-rw-r--r--pkgs/desktops/lxqt/lximage-qt/default.nix18
-rw-r--r--pkgs/desktops/lxqt/lxqt-about/default.nix10
-rw-r--r--pkgs/desktops/lxqt/lxqt-admin/default.nix14
-rw-r--r--pkgs/desktops/lxqt/lxqt-build-tools/default.nix12
-rw-r--r--pkgs/desktops/lxqt/lxqt-config/default.nix29
-rw-r--r--pkgs/desktops/lxqt/lxqt-globalkeys/default.nix10
-rw-r--r--pkgs/desktops/lxqt/lxqt-l10n/default.nix32
-rw-r--r--pkgs/desktops/lxqt/lxqt-notificationd/default.nix12
-rw-r--r--pkgs/desktops/lxqt/lxqt-openssh-askpass/default.nix10
-rw-r--r--pkgs/desktops/lxqt/lxqt-panel/default.nix12
-rw-r--r--pkgs/desktops/lxqt/lxqt-policykit/default.nix10
-rw-r--r--pkgs/desktops/lxqt/lxqt-powermanagement/default.nix12
-rw-r--r--pkgs/desktops/lxqt/lxqt-qtplugin/default.nix5
-rw-r--r--pkgs/desktops/lxqt/lxqt-runner/default.nix10
-rw-r--r--pkgs/desktops/lxqt/lxqt-session/default.nix12
-rw-r--r--pkgs/desktops/lxqt/lxqt-sudo/default.nix10
-rw-r--r--pkgs/desktops/lxqt/lxqt-themes/default.nix9
-rw-r--r--pkgs/desktops/lxqt/obconf-qt/default.nix18
-rw-r--r--pkgs/desktops/lxqt/pavucontrol-qt/default.nix10
-rw-r--r--pkgs/desktops/lxqt/pcmanfm-qt/default.nix18
-rw-r--r--pkgs/desktops/lxqt/qlipper/default.nix4
-rw-r--r--pkgs/desktops/lxqt/qps/default.nix12
-rw-r--r--pkgs/desktops/lxqt/qterminal/default.nix16
-rw-r--r--pkgs/desktops/lxqt/qtermwidget/0.7.1.nix26
-rw-r--r--pkgs/desktops/lxqt/qtermwidget/default.nix13
-rw-r--r--pkgs/desktops/lxqt/screengrab/default.nix16
-rwxr-xr-xpkgs/desktops/lxqt/update.sh4
-rw-r--r--pkgs/development/compilers/gnu-cobol/default.nix2
-rw-r--r--pkgs/development/coq-modules/coquelicot/default.nix8
-rw-r--r--pkgs/development/coq-modules/flocq/default.nix8
-rw-r--r--pkgs/development/coq-modules/interval/default.nix20
-rw-r--r--pkgs/development/haskell-modules/configuration-ghc-8.6.x.nix1
-rw-r--r--pkgs/development/libraries/gexiv2/default.nix4
-rw-r--r--pkgs/development/libraries/git2/0.27.nix4
-rw-r--r--pkgs/development/libraries/gtk+/3.x.nix5
-rw-r--r--pkgs/development/libraries/intel-media-driver/default.nix4
-rw-r--r--pkgs/development/libraries/libgxps/default.nix22
-rw-r--r--pkgs/development/libraries/libxmlb/default.nix4
-rw-r--r--pkgs/development/libraries/pcaudiolib/default.nix7
-rw-r--r--pkgs/development/libraries/pybind11/default.nix23
-rw-r--r--pkgs/development/libraries/pybind11/no_test_cmake_build.patch7
-rw-r--r--pkgs/development/libraries/science/math/sympow/default.nix2
-rw-r--r--pkgs/development/libraries/xapian/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/ocaml-migrate-parsetree/default.nix8
-rw-r--r--pkgs/development/python-modules/aiolifx-effects/default.nix31
-rw-r--r--pkgs/development/python-modules/aiolifx/default.nix31
-rw-r--r--pkgs/development/python-modules/cassandra-driver/default.nix18
-rw-r--r--pkgs/development/python-modules/llfuse/default.nix6
-rw-r--r--pkgs/development/python-modules/mail-parser/default.nix4
-rw-r--r--pkgs/development/python-modules/rasterio/default.nix4
-rw-r--r--pkgs/development/python-modules/scikit-build/default.nix43
-rw-r--r--pkgs/development/python-modules/scikit-build/fix_pytestrunner_req.patch13
-rw-r--r--pkgs/development/python-modules/telethon/default.nix4
-rw-r--r--pkgs/development/python-modules/twilio/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/conan/default.nix4
-rw-r--r--pkgs/development/tools/kind/default.nix4
-rw-r--r--pkgs/development/tools/kustomize/default.nix15
-rw-r--r--pkgs/development/tools/misc/elfutils/default.nix4
-rw-r--r--pkgs/development/tools/ocaml/utop/default.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/interpreter-trunc.patch44
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.14.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.19.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.20.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.9.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix6
-rw-r--r--pkgs/os-specific/linux/kernel/patches.nix7
-rw-r--r--pkgs/os-specific/linux/syslinux/default.nix36
-rw-r--r--pkgs/os-specific/linux/syslinux/perl-deps.patch81
-rw-r--r--pkgs/servers/consul/default.nix4
-rw-r--r--pkgs/servers/home-assistant/component-packages.nix6
-rw-r--r--pkgs/servers/rippled/default.nix141
-rw-r--r--pkgs/servers/web-apps/matomo/default.nix4
-rw-r--r--pkgs/servers/web-apps/matomo/make-localhost-default-database-host.patch16
-rw-r--r--pkgs/tools/backup/restic/default.nix4
-rw-r--r--pkgs/tools/filesystems/bcachefs-tools/default.nix6
-rw-r--r--pkgs/tools/filesystems/fuse-overlayfs/default.nix44
-rw-r--r--pkgs/tools/graphics/wkhtmltopdf/default.nix2
-rw-r--r--pkgs/tools/misc/bbe/default.nix22
-rw-r--r--pkgs/tools/misc/brltty/default.nix4
-rw-r--r--pkgs/tools/misc/broot/default.nix23
-rw-r--r--pkgs/tools/misc/direnv/default.nix4
-rw-r--r--pkgs/tools/misc/fd/default.nix19
-rw-r--r--pkgs/tools/misc/slurp/default.nix6
-rw-r--r--pkgs/tools/misc/yubikey-manager-qt/default.nix78
-rw-r--r--pkgs/tools/networking/lldpd/default.nix5
-rw-r--r--pkgs/tools/networking/network-manager/openvpn/default.nix4
-rw-r--r--pkgs/tools/security/mkp224o/default.nix47
-rw-r--r--pkgs/tools/security/vault/default.nix4
-rw-r--r--pkgs/tools/system/osquery/default.nix14
-rw-r--r--pkgs/top-level/all-packages.nix61
-rw-r--r--pkgs/top-level/python-packages.nix6
141 files changed, 1308 insertions, 691 deletions
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index cc121c15ac8..9e07e7c9033 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -793,6 +793,11 @@
     github = "caugner";
     name = "Claas Augner";
   };
+  cbley = {
+    email = "claudio.bley@gmail.com";
+    github = "avdv";
+    name = "Claudio Bley";
+  };
   cdepillabout = {
     email = "cdep.illabout@gmail.com";
     github = "cdepillabout";
@@ -1565,6 +1570,11 @@
     github = "flokli";
     name = "Florian Klink";
   };
+  FlorianFranzen = {
+    email = "Florian.Franzen@gmail.com";
+    github = "FlorianFranzen";
+    name = "Florian Franzen";
+  };
   florianjacob = {
     email = "projects+nixos@florianjacob.de";
     github = "florianjacob";
@@ -3228,6 +3238,11 @@
     github = "nequissimus";
     name = "Tim Steinbach";
   };
+  netixx = {
+    email = "dev.espinetfrancois@gmail.com";
+    github = "netixx";
+    name = "François Espinet";
+  };
   nikitavoloboev = {
     email = "nikita.voloboev@gmail.com";
     github = "nikitavoloboev";
diff --git a/nixos/doc/manual/configuration/wireless.xml b/nixos/doc/manual/configuration/wireless.xml
index 999447234ad..f7e99ff0e35 100644
--- a/nixos/doc/manual/configuration/wireless.xml
+++ b/nixos/doc/manual/configuration/wireless.xml
@@ -29,7 +29,10 @@
   networks are set, it will default to using a configuration file at
   <literal>/etc/wpa_supplicant.conf</literal>. You should edit this file
   yourself to define wireless networks, WPA keys and so on (see
-  wpa_supplicant.conf(5)).
+  <citerefentry>
+    <refentrytitle>wpa_supplicant.conf</refentrytitle>
+    <manvolnum>5</manvolnum>
+  </citerefentry>).
  </para>
 
  <para>
diff --git a/nixos/doc/manual/release-notes/rl-1903.xml b/nixos/doc/manual/release-notes/rl-1903.xml
index 270acda9b04..6f78983d482 100644
--- a/nixos/doc/manual/release-notes/rl-1903.xml
+++ b/nixos/doc/manual/release-notes/rl-1903.xml
@@ -444,6 +444,23 @@
      <option>services.matomo.package</option> which determines the used
      Matomo version.
     </para>
+    <para>
+     The Matomo module now also comes with the systemd service <literal>matomo-archive-processing.service</literal>
+     and a timer that automatically triggers archive processing every hour.
+     This means that you can safely
+     <link xlink:href="https://matomo.org/docs/setup-auto-archiving/#disable-browser-triggers-for-matomo-archiving-and-limit-matomo-reports-to-updating-every-hour">
+      disable browser triggers for Matomo archiving
+     </link> at <literal>Administration > System > General Settings</literal>.
+    </para>
+    <para>
+     Additionally, you can enable to
+     <link xlink:href="https://matomo.org/docs/privacy/#step-2-delete-old-visitors-logs">
+      delete old visitor logs
+     </link> at <literal>Administration > System > Privacy</literal>,
+     but make sure that you run <literal>systemctl start matomo-archive-processing.service</literal>
+     at least once without errors if you have already collected data before,
+     so that the reports get archived before the source data gets deleted.
+    </para>
    </listitem>
    <listitem>
     <para>
diff --git a/nixos/modules/services/misc/zoneminder.nix b/nixos/modules/services/misc/zoneminder.nix
index a40e9e84613..ae7de7850d9 100644
--- a/nixos/modules/services/misc/zoneminder.nix
+++ b/nixos/modules/services/misc/zoneminder.nix
@@ -205,15 +205,13 @@ in {
 
       mysql = lib.mkIf cfg.database.createLocally {
         ensureDatabases = [ cfg.database.name ];
-        ensureUsers = {
+        ensureUsers = [{
           name = cfg.database.username;
-          ensurePermissions = [
-            { "${cfg.database.name}.*" = "ALL PRIVILEGES"; }
-          ];
+          ensurePermissions = { "${cfg.database.name}.*" = "ALL PRIVILEGES"; };
           initialDatabases = [
             { inherit (cfg.database) name; schema = "${pkg}/share/zoneminder/db/zm_create.sql"; }
           ];
-        };
+        }];
       };
 
       nginx = lib.mkIf useNginx {
diff --git a/nixos/modules/services/networking/flannel.nix b/nixos/modules/services/networking/flannel.nix
index b93e28e34ef..6c43573851b 100644
--- a/nixos/modules/services/networking/flannel.nix
+++ b/nixos/modules/services/networking/flannel.nix
@@ -73,11 +73,35 @@ in {
       };
     };
 
+    kubeconfig = mkOption {
+      description = ''
+        Path to kubeconfig to use for storing flannel config using the
+        Kubernetes API
+      '';
+      type = types.nullOr types.path;
+      default = null;
+    };
+
     network = mkOption {
       description = " IPv4 network in CIDR format to use for the entire flannel network.";
       type = types.str;
     };
 
+    nodeName = mkOption {
+      description = ''
+        Needed when running with Kubernetes as backend as this cannot be auto-detected";
+      '';
+      type = types.nullOr types.str;
+      default = with config.networking; (hostName + optionalString (!isNull domain) ".${domain}");
+      example = "node1.example.com";
+    };
+
+    storageBackend = mkOption {
+      description = "Determines where flannel stores its configuration at runtime";
+      type = types.enum ["etcd" "kubernetes"];
+      default = "etcd";
+    };
+
     subnetLen = mkOption {
       description = ''
         The size of the subnet allocated to each host. Defaults to 24 (i.e. /24)
@@ -122,17 +146,22 @@ in {
       after = [ "network.target" ];
       environment = {
         FLANNELD_PUBLIC_IP = cfg.publicIp;
+        FLANNELD_IFACE = cfg.iface;
+      } // optionalAttrs (cfg.storageBackend == "etcd") {
         FLANNELD_ETCD_ENDPOINTS = concatStringsSep "," cfg.etcd.endpoints;
         FLANNELD_ETCD_KEYFILE = cfg.etcd.keyFile;
         FLANNELD_ETCD_CERTFILE = cfg.etcd.certFile;
         FLANNELD_ETCD_CAFILE = cfg.etcd.caFile;
-        FLANNELD_IFACE = cfg.iface;
         ETCDCTL_CERT_FILE = cfg.etcd.certFile;
         ETCDCTL_KEY_FILE = cfg.etcd.keyFile;
         ETCDCTL_CA_FILE = cfg.etcd.caFile;
         ETCDCTL_PEERS = concatStringsSep "," cfg.etcd.endpoints;
+      } // optionalAttrs (cfg.storageBackend == "kubernetes") {
+        FLANNELD_KUBE_SUBNET_MGR = "true";
+        FLANNELD_KUBECONFIG_FILE = cfg.kubeconfig;
+        NODE_NAME = cfg.nodeName;
       };
-      preStart = ''
+      preStart = mkIf (cfg.storageBackend == "etcd") ''
         echo "setting network configuration"
         until ${pkgs.etcdctl.bin}/bin/etcdctl set /coreos.com/network/config '${builtins.toJSON networkConfig}'
         do
@@ -149,6 +178,12 @@ in {
       serviceConfig.ExecStart = "${cfg.package}/bin/flannel";
     };
 
-    services.etcd.enable = mkDefault (cfg.etcd.endpoints == ["http://127.0.0.1:2379"]);
+    services.etcd.enable = mkDefault (cfg.storageBackend == "etcd" && cfg.etcd.endpoints == ["http://127.0.0.1:2379"]);
+
+    # for some reason, flannel doesn't let you configure this path
+    # see: https://github.com/coreos/flannel/blob/master/Documentation/configuration.md#configuration
+    environment.etc."kube-flannel/net-conf.json" = mkIf (cfg.storageBackend == "kubernetes") {
+      source = pkgs.writeText "net-conf.json" (builtins.toJSON networkConfig);
+    };
   };
 }
diff --git a/nixos/modules/services/networking/wpa_supplicant.nix b/nixos/modules/services/networking/wpa_supplicant.nix
index 8622212f085..cdfe98aa034 100644
--- a/nixos/modules/services/networking/wpa_supplicant.nix
+++ b/nixos/modules/services/networking/wpa_supplicant.nix
@@ -86,7 +86,12 @@ in {
               '';
               description = ''
                 Use this option to configure advanced authentication methods like EAP.
-                See wpa_supplicant.conf(5) for example configurations.
+                See
+                <citerefentry>
+                  <refentrytitle>wpa_supplicant.conf</refentrytitle>
+                  <manvolnum>5</manvolnum>
+                </citerefentry>
+                for example configurations.
 
                 Mutually exclusive with <varname>psk</varname> and <varname>pskRaw</varname>.
               '';
@@ -122,7 +127,12 @@ in {
               '';
               description = ''
                 Extra configuration lines appended to the network block.
-                See wpa_supplicant.conf(5) for available options.
+                See
+                <citerefentry>
+                  <refentrytitle>wpa_supplicant.conf</refentrytitle>
+                  <manvolnum>5</manvolnum>
+                </citerefentry>
+                for available options.
               '';
             };
 
@@ -174,7 +184,12 @@ in {
         '';
         description = ''
           Extra lines appended to the configuration file.
-          See wpa_supplicant.conf(5) for available options.
+          See
+          <citerefentry>
+            <refentrytitle>wpa_supplicant.conf</refentrytitle>
+            <manvolnum>5</manvolnum>
+          </citerefentry>
+          for available options.
         '';
       };
     };
diff --git a/nixos/modules/services/printing/cupsd.nix b/nixos/modules/services/printing/cupsd.nix
index 1031d6f3d7e..3a43ebbb889 100644
--- a/nixos/modules/services/printing/cupsd.nix
+++ b/nixos/modules/services/printing/cupsd.nix
@@ -316,6 +316,10 @@ in
             mkdir -m 0755 -p ${cfg.tempDir}
 
             mkdir -m 0755 -p /var/lib/cups
+            # While cups will automatically create self-signed certificates if accessed via TLS,
+            # this directory to store the certificates needs to be created manually.
+            mkdir -m 0700 -p /var/lib/cups/ssl
+
             # Backwards compatibility
             if [ ! -L /etc/cups ]; then
               mv /etc/cups/* /var/lib/cups
diff --git a/nixos/modules/services/web-apps/matomo-doc.xml b/nixos/modules/services/web-apps/matomo-doc.xml
index 510a335edc3..20d2de9f418 100644
--- a/nixos/modules/services/web-apps/matomo-doc.xml
+++ b/nixos/modules/services/web-apps/matomo-doc.xml
@@ -12,15 +12,15 @@
   An automatic setup is not suported by Matomo, so you need to configure Matomo
   itself in the browser-based Matomo setup.
  </para>
+
  <section xml:id="module-services-matomo-database-setup">
   <title>Database Setup</title>
-
   <para>
    You also need to configure a MariaDB or MySQL database and -user for Matomo
    yourself, and enter those credentials in your browser. You can use
    passwordless database authentication via the UNIX_SOCKET authentication
    plugin with the following SQL commands:
-<programlisting>
+   <programlisting>
         # For MariaDB
         INSTALL PLUGIN unix_socket SONAME 'auth_socket';
         CREATE DATABASE matomo;
@@ -32,7 +32,7 @@
         CREATE DATABASE matomo;
         CREATE USER 'matomo'@'localhost' IDENTIFIED WITH auth_socket;
         GRANT ALL PRIVILEGES ON matomo.* TO 'matomo'@'localhost';
-      </programlisting>
+   </programlisting>
    Then fill in <literal>matomo</literal> as database user and database name,
    and leave the password field blank. This authentication works by allowing
    only the <literal>matomo</literal> unix user to authenticate as the
@@ -46,9 +46,30 @@
    database is not on the same host.
   </para>
  </section>
+
+ <section xml:id="module-services-matomo-archive-processing">
+  <title>Archive Processing</title>
+  <para>
+   This module comes with the systemd service <literal>matomo-archive-processing.service</literal>
+   and a timer that automatically triggers archive processing every hour.
+   This means that you can safely
+   <link xlink:href="https://matomo.org/docs/setup-auto-archiving/#disable-browser-triggers-for-matomo-archiving-and-limit-matomo-reports-to-updating-every-hour">
+    disable browser triggers for Matomo archiving
+   </link> at <literal>Administration > System > General Settings</literal>.
+  </para>
+  <para>
+   With automatic archive processing, you can now also enable to
+   <link xlink:href="https://matomo.org/docs/privacy/#step-2-delete-old-visitors-logs">
+    delete old visitor logs
+   </link> at <literal>Administration > System > Privacy</literal>,
+   but make sure that you run <literal>systemctl start matomo-archive-processing.service</literal>
+   at least once without errors if you have already collected data before,
+   so that the reports get archived before the source data gets deleted.
+  </para>
+ </section>
+
  <section xml:id="module-services-matomo-backups">
   <title>Backup</title>
-
   <para>
    You only need to take backups of your MySQL database and the
    <filename>/var/lib/matomo/config/config.ini.php</filename> file. Use a user
@@ -57,9 +78,9 @@
    <link xlink:href="https://matomo.org/faq/how-to-install/faq_138/" />.
   </para>
  </section>
+
  <section xml:id="module-services-matomo-issues">
   <title>Issues</title>
-
   <itemizedlist>
    <listitem>
     <para>
@@ -76,6 +97,7 @@
    </listitem>
   </itemizedlist>
  </section>
+
  <section xml:id="module-services-matomo-other-web-servers">
   <title>Using other Web Servers than nginx</title>
 
diff --git a/nixos/modules/services/web-apps/matomo.nix b/nixos/modules/services/web-apps/matomo.nix
index 9fddf832074..14aca45a342 100644
--- a/nixos/modules/services/web-apps/matomo.nix
+++ b/nixos/modules/services/web-apps/matomo.nix
@@ -23,20 +23,24 @@ in {
   options = {
     services.matomo = {
       # NixOS PR for database setup: https://github.com/NixOS/nixpkgs/pull/6963
-      # matomo issue for automatic matomo setup: https://github.com/matomo-org/matomo/issues/10257
-      # TODO: find a nice way to do this when more NixOS MySQL and / or matomo automatic setup stuff is implemented.
+      # Matomo issue for automatic Matomo setup: https://github.com/matomo-org/matomo/issues/10257
+      # TODO: find a nice way to do this when more NixOS MySQL and / or Matomo automatic setup stuff is implemented.
       enable = mkOption {
         type = types.bool;
         default = false;
         description = ''
-          Enable matomo web analytics with php-fpm backend.
+          Enable Matomo web analytics with php-fpm backend.
           Either the nginx option or the webServerUser option is mandatory.
         '';
       };
 
       package = mkOption {
         type = types.package;
-        description = "Matomo package to use";
+        description = ''
+          Matomo package for the service to use.
+          This can be used to point to newer releases from nixos-unstable,
+          as they don't get backported if they are not security-relevant.
+        '';
         default = pkgs.matomo;
         defaultText = "pkgs.matomo";
       };
@@ -45,12 +49,25 @@ in {
         type = types.nullOr types.str;
         default = null;
         example = "lighttpd";
-        # TODO: piwik.php might get renamed to matomo.php in future releases
         description = ''
-          Name of the web server user that forwards requests to the ${phpSocket} fastcgi socket for matomo if the nginx
+          Name of the web server user that forwards requests to the ${phpSocket} fastcgi socket for Matomo if the nginx
           option is not used. Either this option or the nginx option is mandatory.
           If you want to use another webserver than nginx, you need to set this to that server's user
-          and pass fastcgi requests to `index.php` and `piwik.php` to this socket.
+          and pass fastcgi requests to `index.php`, `matomo.php` and `piwik.php` (legacy name) to this socket.
+        '';
+      };
+
+      periodicArchiveProcessing = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Enable periodic archive processing, which generates aggregated reports from the visits.
+
+          This means that you can safely disable browser triggers for Matomo archiving,
+          and safely enable to delete old visitor logs.
+          Before deleting visitor logs,
+          make sure though that you run <literal>systemctl start matomo-archive-processing.service</literal>
+          at least once without errors if you have already collected data before.
         '';
       };
 
@@ -69,7 +86,7 @@ in {
           catch_workers_output = yes
         '';
         description = ''
-          Settings for phpfpm's process manager. You might need to change this depending on the load for matomo.
+          Settings for phpfpm's process manager. You might need to change this depending on the load for Matomo.
         '';
       };
 
@@ -79,7 +96,7 @@ in {
             (import ../web-servers/nginx/vhost-options.nix { inherit config lib; })
             {
               # enable encryption by default,
-              # as sensitive login and matomo data should not be transmitted in clear text.
+              # as sensitive login and Matomo data should not be transmitted in clear text.
               options.forceSSL.default = true;
               options.enableACME.default = true;
             }
@@ -94,7 +111,7 @@ in {
           enableACME = false;
         };
         description = ''
-            With this option, you can customize an nginx virtualHost which already has sensible defaults for matomo.
+            With this option, you can customize an nginx virtualHost which already has sensible defaults for Matomo.
             Either this option or the webServerUser option is mandatory.
             Set this to {} to just enable the virtualHost if you don't need any customization.
             If enabled, then by default, the <option>serverName</option> is
@@ -124,29 +141,30 @@ in {
     };
     users.groups.${user} = {};
 
-    systemd.services.matomo_setup_update = {
-      # everything needs to set up and up to date before matomo php files are executed
+    systemd.services.matomo-setup-update = {
+      # everything needs to set up and up to date before Matomo php files are executed
       requiredBy = [ "${phpExecutionUnit}.service" ];
       before = [ "${phpExecutionUnit}.service" ];
       # the update part of the script can only work if the database is already up and running
       requires = [ databaseService ];
       after = [ databaseService ];
       path = [ cfg.package ];
+      environment.PIWIK_USER_PATH = dataDir;
       serviceConfig = {
         Type = "oneshot";
         User = user;
         # hide especially config.ini.php from other
         UMask = "0007";
         # TODO: might get renamed to MATOMO_USER_PATH in future versions
-        Environment = "PIWIK_USER_PATH=${dataDir}";
         # chown + chmod in preStart needs root
         PermissionsStartOnly = true;
       };
+
       # correct ownership and permissions in case they're not correct anymore,
       # e.g. after restoring from backup or moving from another system.
       # Note that ${dataDir}/config/config.ini.php might contain the MySQL password.
       preStart = ''
-        # migrate data from piwik to matomo folder
+        # migrate data from piwik to Matomo folder
         if [ -d ${deprecatedDataDir} ]; then
           echo "Migrating from ${deprecatedDataDir} to ${dataDir}"
           mv -T ${deprecatedDataDir} ${dataDir}
@@ -155,7 +173,7 @@ in {
         chmod -R ug+rwX,o-rwx ${dataDir}
         '';
       script = ''
-            # Use User-Private Group scheme to protect matomo data, but allow administration / backup via matomo group
+            # Use User-Private Group scheme to protect Matomo data, but allow administration / backup via 'matomo' group
             # Copy config folder
             chmod g+s "${dataDir}"
             cp -r "${cfg.package}/config" "${dataDir}/"
@@ -169,8 +187,39 @@ in {
       '';
     };
 
+    # If this is run regularly via the timer,
+    # 'Browser trigger archiving' can be disabled in Matomo UI > Settings > General Settings.
+    systemd.services.matomo-archive-processing = {
+      description = "Archive Matomo reports";
+      # the archiving can only work if the database is already up and running
+      requires = [ databaseService ];
+      after = [ databaseService ];
+
+      # TODO: might get renamed to MATOMO_USER_PATH in future versions
+      environment.PIWIK_USER_PATH = dataDir;
+      serviceConfig = {
+        Type = "oneshot";
+        User = user;
+        UMask = "0007";
+        CPUSchedulingPolicy = "idle";
+        IOSchedulingClass = "idle";
+        ExecStart = "${cfg.package}/bin/matomo-console core:archive --url=https://${user}.${fqdn}";
+      };
+    };
+
+    systemd.timers.matomo-archive-processing = mkIf cfg.periodicArchiveProcessing {
+      description = "Automatically archive Matomo reports every hour";
+
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnCalendar = "hourly";
+        Persistent = "yes";
+        AccuracySec = "10m";
+      };
+    };
+
     systemd.services.${phpExecutionUnit} = {
-      # stop phpfpm on package upgrade, do database upgrade via matomo_setup_update, and then restart
+      # stop phpfpm on package upgrade, do database upgrade via matomo-setup-update, and then restart
       restartTriggers = [ cfg.package ];
       # stop config.ini.php from getting written with read permission for others
       serviceConfig.UMask = "0007";
@@ -200,13 +249,13 @@ in {
       # https://fralef.me/piwik-hardening-with-nginx-and-php-fpm.html
       # https://github.com/perusio/piwik-nginx
       "${user}.${fqdn}" = mkMerge [ cfg.nginx {
-        # don't allow to override the root easily, as it will almost certainly break matomo.
+        # don't allow to override the root easily, as it will almost certainly break Matomo.
         # disadvantage: not shown as default in docs.
         root = mkForce "${cfg.package}/share";
 
         # define locations here instead of as the submodule option's default
         # so that they can easily be extended with additional locations if required
-        # without needing to redefine the matomo ones.
+        # without needing to redefine the Matomo ones.
         # disadvantage: not shown as default in docs.
         locations."/" = {
           index = "index.php";
@@ -215,8 +264,11 @@ in {
         locations."= /index.php".extraConfig = ''
           fastcgi_pass unix:${phpSocket};
         '';
-        # TODO: might get renamed to matomo.php in future versions
-        # allow piwik.php for tracking
+        # allow matomo.php for tracking
+        locations."= /matomo.php".extraConfig = ''
+          fastcgi_pass unix:${phpSocket};
+        '';
+        # allow piwik.php for tracking (deprecated name)
         locations."= /piwik.php".extraConfig = ''
           fastcgi_pass unix:${phpSocket};
         '';
@@ -237,8 +289,11 @@ in {
         locations."= /robots.txt".extraConfig = ''
           return 200 "User-agent: *\nDisallow: /\n";
         '';
-        # TODO: might get renamed to matomo.js in future versions
-        # let browsers cache piwik.js
+        # let browsers cache matomo.js
+        locations."= /matomo.js".extraConfig = ''
+          expires 1M;
+        '';
+        # let browsers cache piwik.js (deprecated name)
         locations."= /piwik.js".extraConfig = ''
           expires 1M;
         '';
diff --git a/nixos/modules/services/web-apps/tt-rss.nix b/nixos/modules/services/web-apps/tt-rss.nix
index e043ce4b581..cf6f79c92f4 100644
--- a/nixos/modules/services/web-apps/tt-rss.nix
+++ b/nixos/modules/services/web-apps/tt-rss.nix
@@ -53,7 +53,17 @@ let
       define('SINGLE_USER_MODE', ${boolToString cfg.singleUserMode});
 
       define('SIMPLE_UPDATE_MODE', ${boolToString cfg.simpleUpdateMode});
-      define('CHECK_FOR_UPDATES', ${boolToString cfg.checkForUpdates});
+
+      // Never check for updates - the running version of the code should be
+      // controlled entirely by the version of TT-RSS active in the current Nix
+      // profile. If TT-RSS updates itself to a version requiring a database
+      // schema upgrade, and then the SystemD tt-rss.service is restarted, the
+      // old code copied from the Nix store will overwrite the updated version,
+      // causing the code to detect the need for a schema "upgrade" (since the
+      // schema version in the database is different than in the code), but the
+      // update schema operation in TT-RSS will do nothing because the schema
+      // version in the database is newer than that in the code.
+      define('CHECK_FOR_UPDATES', false);
 
       define('FORCE_ARTICLE_PURGE', ${toString cfg.forceArticlePurge});
       define('SESSION_COOKIE_LIFETIME', ${toString cfg.sessionCookieLifetime});
@@ -414,14 +424,6 @@ let
         '';
       };
 
-      checkForUpdates = mkOption {
-        type = types.bool;
-        default = true;
-        description = ''
-          Check for updates automatically if running Git version
-        '';
-      };
-
       enableGZipOutput = mkOption {
         type = types.bool;
         default = true;
@@ -489,6 +491,14 @@ let
     };
   };
 
+  imports = [
+    (mkRemovedOptionModule ["services" "tt-rss" "checkForUpdates"] ''
+      This option was removed because setting this to true will cause TT-RSS
+      to be unable to start if an automatic update of the code in
+      services.tt-rss.root leads to a database schema upgrade that is not
+      supported by the code active in the Nix store.
+    '')
+  ];
 
   ###### implementation
 
diff --git a/nixos/modules/services/web-servers/phpfpm/default.nix b/nixos/modules/services/web-servers/phpfpm/default.nix
index 152c89a2cae..97c730061bd 100644
--- a/nixos/modules/services/web-servers/phpfpm/default.nix
+++ b/nixos/modules/services/web-servers/phpfpm/default.nix
@@ -14,11 +14,13 @@ let
 
   mapPoolConfig = n: p: {
     phpPackage = cfg.phpPackage;
+    phpOptions = cfg.phpOptions;
     config = p;
   };
 
   mapPool = n: p: {
     phpPackage = p.phpPackage;
+    phpOptions = p.phpOptions;
     config = ''
       listen = ${p.listen}
       ${p.extraConfig}
@@ -35,8 +37,8 @@ let
     ${conf}
   '';
 
-  phpIni = pkgs.runCommand "php.ini" {
-    inherit (cfg) phpPackage phpOptions;
+  phpIni = pool: pkgs.runCommand "php.ini" {
+    inherit (pool) phpPackage phpOptions;
     nixDefaults = ''
       sendmail_path = "/run/wrappers/bin/sendmail -t -i"
     '';
@@ -156,6 +158,7 @@ in {
         '';
         serviceConfig = let
           cfgFile = fpmCfgFile pool poolConfig.config;
+          iniFile = phpIni poolConfig;
         in {
           Slice = "phpfpm.slice";
           PrivateDevices = true;
@@ -164,7 +167,7 @@ in {
           # XXX: We need AF_NETLINK to make the sendmail SUID binary from postfix work
           RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6 AF_NETLINK";
           Type = "notify";
-          ExecStart = "${poolConfig.phpPackage}/bin/php-fpm -y ${cfgFile} -c ${phpIni}";
+          ExecStart = "${poolConfig.phpPackage}/bin/php-fpm -y ${cfgFile} -c ${iniFile}";
           ExecReload = "${pkgs.coreutils}/bin/kill -USR2 $MAINPID";
         };
       }
diff --git a/nixos/modules/services/web-servers/phpfpm/pool-options.nix b/nixos/modules/services/web-servers/phpfpm/pool-options.nix
index 40c83cddb95..d9ad7eff71f 100644
--- a/nixos/modules/services/web-servers/phpfpm/pool-options.nix
+++ b/nixos/modules/services/web-servers/phpfpm/pool-options.nix
@@ -25,6 +25,15 @@ with lib; {
       '';
     };
 
+    phpOptions = mkOption {
+      type = types.lines;
+      default = fpmCfg.phpOptions;
+      defaultText = "config.services.phpfpm.phpOptions";
+      description = ''
+        "Options appended to the PHP configuration file <filename>php.ini</filename> used for this PHP-FPM pool."
+      '';
+    };
+
     extraConfig = mkOption {
       type = types.lines;
       example = ''
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index fe4ca5772c6..3d8fea95a50 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -73,6 +73,7 @@ in
   ferm = handleTest ./ferm.nix {};
   firefox = handleTest ./firefox.nix {};
   firewall = handleTest ./firewall.nix {};
+  flannel = handleTestOn ["x86_64-linux"] ./flannel.nix {};
   flatpak = handleTest ./flatpak.nix {};
   fsck = handleTest ./fsck.nix {};
   fwupd = handleTestOn ["x86_64-linux"] ./fwupd.nix {}; # libsmbios is unsupported on aarch64
diff --git a/nixos/tests/flannel.nix b/nixos/tests/flannel.nix
index fb66fe28209..0b261a68477 100644
--- a/nixos/tests/flannel.nix
+++ b/nixos/tests/flannel.nix
@@ -21,8 +21,9 @@ import ./make-test.nix ({ pkgs, ...} : rec {
       services = {
         etcd = {
           enable = true;
-          listenClientUrls = ["http://etcd:2379"];
-          listenPeerUrls = ["http://etcd:2380"];
+          listenClientUrls = ["http://0.0.0.0:2379"]; # requires ip-address for binding
+          listenPeerUrls = ["http://0.0.0.0:2380"]; # requires ip-address for binding
+          advertiseClientUrls = ["http://etcd:2379"];
           initialAdvertisePeerUrls = ["http://etcd:2379"];
           initialCluster = ["etcd=http://etcd:2379"];
         };
diff --git a/nixos/tests/printing.nix b/nixos/tests/printing.nix
index d85abf3c105..7026637ead1 100644
--- a/nixos/tests/printing.nix
+++ b/nixos/tests/printing.nix
@@ -39,6 +39,8 @@ import ./make-test.nix ({pkgs, ... }: {
       $client->waitForUnit("cups.service");
       $client->sleep(10); # wait until cups is fully initialized
       $client->succeed("lpstat -r") =~ /scheduler is running/ or die;
+      # check local encrypted connections work without error
+      $client->succeed("lpstat -E -r") =~ /scheduler is running/ or die;
       # Test that UNIX socket is used for connections.
       $client->succeed("lpstat -H") =~ "/var/run/cups/cups.sock" or die;
       # Test that HTTP server is available too.
diff --git a/nixos/tests/switch-test.nix b/nixos/tests/switch-test.nix
index 32010838e67..0dba3697980 100644
--- a/nixos/tests/switch-test.nix
+++ b/nixos/tests/switch-test.nix
@@ -18,8 +18,17 @@ import ./make-test.nix ({ pkgs, ...} : {
   testScript = {nodes, ...}: let
     originalSystem = nodes.machine.config.system.build.toplevel;
     otherSystem = nodes.other.config.system.build.toplevel;
+
+    # Ensures failures pass through using pipefail, otherwise failing to
+    # switch-to-configuration is hidden by the success of `tee`.
+    stderrRunner = pkgs.writeScript "stderr-runner" ''
+      #! ${pkgs.stdenv.shell}
+      set -e
+      set -o pipefail
+      exec env -i "$@" | tee /dev/stderr
+    '';
   in ''
-    $machine->succeed("env -i ${originalSystem}/bin/switch-to-configuration test | tee /dev/stderr");
-    $machine->succeed("env -i ${otherSystem}/bin/switch-to-configuration test | tee /dev/stderr");
+    $machine->succeed("${stderrRunner} ${originalSystem}/bin/switch-to-configuration test");
+    $machine->succeed("${stderrRunner} ${otherSystem}/bin/switch-to-configuration test");
   '';
 })
diff --git a/pkgs/applications/audio/cmus/default.nix b/pkgs/applications/audio/cmus/default.nix
index e36d01b8d2e..9f69e305f24 100644
--- a/pkgs/applications/audio/cmus/default.nix
+++ b/pkgs/applications/audio/cmus/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, runCommand, ncurses, pkgconfig
+{ config, stdenv, fetchFromGitHub, runCommand, ncurses, pkgconfig
 , libiconv, CoreAudio
 
 , alsaSupport ? stdenv.isLinux, alsaLib ? null
@@ -7,7 +7,7 @@
 , jackSupport ? false, libjack ? null
 , samplerateSupport ? jackSupport, libsamplerate ? null
 , ossSupport ? false, alsaOss ? null
-, pulseaudioSupport ? false, libpulseaudio ? null
+, pulseaudioSupport ? config.pulseaudio or false, libpulseaudio ? null
 
 # TODO: add these
 #, artsSupport
diff --git a/pkgs/applications/audio/deadbeef/default.nix b/pkgs/applications/audio/deadbeef/default.nix
index e2fcc3c4626..0212560cd03 100644
--- a/pkgs/applications/audio/deadbeef/default.nix
+++ b/pkgs/applications/audio/deadbeef/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, intltool, pkgconfig, jansson
+{ config, stdenv, fetchurl, intltool, pkgconfig, jansson
 # deadbeef can use either gtk2 or gtk3
 , gtk2Support ? false, gtk2 ? null
 , gtk3Support ? true, gtk3 ? null, gsettings-desktop-schemas ? null, wrapGAppsHook ? null
@@ -20,7 +20,7 @@
 , osdSupport ? true, dbus ? null
 # output plugins
 , alsaSupport ? true, alsaLib ? null
-, pulseSupport ? true, libpulseaudio ? null
+, pulseSupport ? config.pulseaudio or stdenv.isLinux, libpulseaudio ? null
 # effect plugins
 , resamplerSupport ? true, libsamplerate ? null
 , overloadSupport ? true, zlib ? null
diff --git a/pkgs/applications/audio/mimic/default.nix b/pkgs/applications/audio/mimic/default.nix
index a4cd0c944dc..dcaffe3eb9b 100644
--- a/pkgs/applications/audio/mimic/default.nix
+++ b/pkgs/applications/audio/mimic/default.nix
@@ -1,6 +1,6 @@
-{ stdenv, autoreconfHook, fetchFromGitHub, pkgconfig
+{ config, stdenv, autoreconfHook, fetchFromGitHub, pkgconfig
 , alsaLib, libtool, icu
-, pulseaudioSupport ? true, libpulseaudio }:
+, pulseaudioSupport ? config.pulseaudio or false, libpulseaudio }:
 
 stdenv.mkDerivation rec {
   name = "mimic-${version}";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "1wkpbwk88lsahzkc7pzbznmyy0lc02vsp0vkj8f1ags1gh0lc52j";
   };
 
-  nativeBuildInputs = [ 
+  nativeBuildInputs = [
     autoreconfHook
     pkgconfig
   ];
@@ -21,15 +21,14 @@ stdenv.mkDerivation rec {
   buildInputs = [
     alsaLib
     libtool
-    icu 
+    icu
   ] ++ stdenv.lib.optional pulseaudioSupport libpulseaudio;
 
   meta = {
     description = "Mycroft's TTS engine, based on CMU's Flite (Festival Lite)";
-    homepage = https://mimic.mycroft.ai/; 
+    homepage = https://mimic.mycroft.ai/;
     license = stdenv.lib.licenses.free;
     platforms = stdenv.lib.platforms.linux;
-    maintainers = [ stdenv.lib.maintainers.noneucat ]; 
+    maintainers = [ stdenv.lib.maintainers.noneucat ];
   };
 }
-
diff --git a/pkgs/applications/editors/android-studio/default.nix b/pkgs/applications/editors/android-studio/default.nix
index 2d5028cf83b..cb0aa393380 100644
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -13,14 +13,14 @@ let
     sha256Hash = "0fghqkc8pkb7waxclm0qq4nlnsvmv9d3fcj5nnvgbfkjyw032q42";
   };
   betaVersion = {
-    version = "3.4.0.12"; # "Android Studio 3.4 Beta 3"
-    build = "183.5256591";
-    sha256Hash = "1yab2sgabgk3wa3wrzv9z1dc2k7x0079v0mlwrp32jwx8r9byvcw";
+    version = "3.4.0.13"; # "Android Studio 3.4 Beta 4"
+    build = "183.5304277";
+    sha256Hash = "01x7xba0f5js213wgw0h1vw297vwz5q7dprnilcdydfjxwqsbr8f";
   };
   latestVersion = { # canary & dev
-    version = "3.5.0.2"; # "Android Studio 3.5 Canary 3"
-    build = "183.5256920";
-    sha256Hash = "09bd80ld21hq743xjacsq0nkxwl5xzr253p86n71n580yn4rgmlb";
+    version = "3.5.0.3"; # "Android Studio 3.5 Canary 4"
+    build = "183.5290690";
+    sha256Hash = "0d1cl78b25pksaj0scv3hxb14bjxk3591zbc0v7dykk1gf4pvxd1";
   };
 in rec {
   # Old alias (TODO @primeos: Remove after 19.03 is branched off):
diff --git a/pkgs/applications/editors/atom/default.nix b/pkgs/applications/editors/atom/default.nix
index 13dc9e1285b..e5a71b134f1 100644
--- a/pkgs/applications/editors/atom/default.nix
+++ b/pkgs/applications/editors/atom/default.nix
@@ -3,14 +3,14 @@
 let
   versions = {
     atom = {
-      version = "1.33.0";
-      sha256 = "0f6m6zwgz94m3q11ipyiliap3s5a3zlrg3ldjwkqnxjl6gwlxc2r";
+      version = "1.34.0";
+      sha256 = "16hrjymrc43izg7frcrk7cwjwwrclcxzcwb5iw2llzjc6iadzlkb";
     };
 
     atom-beta = {
-      version = "1.34.0";
+      version = "1.35.0";
       beta = 0;
-      sha256 = "1xnrr4z55sj46hqr0il26sfs6s3knv60m340cw3rzzic271b3ifw";
+      sha256 = "0gm5k573dq1hhnyw3719f5k1c6rsz872mhzg8q53n89y0g2r5xmw";
     };
   };
 
diff --git a/pkgs/applications/graphics/shotwell/default.nix b/pkgs/applications/graphics/shotwell/default.nix
index da9fae2441c..354e9725a43 100644
--- a/pkgs/applications/graphics/shotwell/default.nix
+++ b/pkgs/applications/graphics/shotwell/default.nix
@@ -7,13 +7,13 @@
 
 let
   pname = "shotwell";
-  version = "0.30.1";
+  version = "0.30.2";
 in stdenv.mkDerivation rec {
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "01hsmig06hjv34yf9y60hv2gml593xfkza4ilq4b22gr8l4v2qip";
+    sha256 = "0pam0si110vkc65kh59lrmgkv91f9zxmf1gpfm99ixjgw25rfi8r";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/qmapshack/default.nix b/pkgs/applications/misc/qmapshack/default.nix
index 7b2e8bed10e..f4983ad9442 100644
--- a/pkgs/applications/misc/qmapshack/default.nix
+++ b/pkgs/applications/misc/qmapshack/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "qmapshack-${version}";
-  version = "1.12.1";
+  version = "1.12.3";
 
   src = fetchurl {
     url = "https://bitbucket.org/maproom/qmapshack/downloads/${name}.tar.gz";
-    sha256 = "1d6n7xk0ksxb1fw43s5lb08vgxf6h93k3rb401cbka1inpyf2232";
+    sha256 = "1yp5gw4q4gwiwr9w4dz19am0bhsla9n2l3bdlk98a7f46kxgnkrx";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/misc/safeeyes/default.nix b/pkgs/applications/misc/safeeyes/default.nix
index dfacdc75f1c..f4918565f35 100644
--- a/pkgs/applications/misc/safeeyes/default.nix
+++ b/pkgs/applications/misc/safeeyes/default.nix
@@ -6,12 +6,12 @@ let inherit (python3Packages) python buildPythonApplication fetchPypi;
 in buildPythonApplication rec {
   name = "${pname}-${version}";
   pname = "safeeyes";
-  version = "2.0.8";
+  version = "2.0.8.1";
   namePrefix = "";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "08acrf9sngjjmplszjxzfq3af9xg4xscga94q0lkck2l1kqckc2l";
+    sha256 = "1x52ym8n4r6h38n4mcydxkvz71hhrd9wbiq4gzvwrai0xzl6qqsq";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix
index a909759bedf..4b9a747811f 100644
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@@ -1,4 +1,5 @@
-{ newScope, stdenv, llvmPackages, makeWrapper, makeDesktopItem, ed
+{ newScope, config, stdenv, llvmPackages, gcc8Stdenv, llvmPackages_7
+, makeWrapper, makeDesktopItem, ed
 , glib, gtk3, gnome3, gsettings-desktop-schemas
 
 # package customization
@@ -10,12 +11,17 @@
 , enablePepperFlash ? false
 , enableWideVine ? false
 , cupsSupport ? true
-, pulseSupport ? false
+, pulseSupport ? config.pulseaudio or stdenv.isLinux
 , commandLineArgs ? ""
 }:
 
-assert stdenv.cc.isClang -> (stdenv == llvmPackages.stdenv);
 let
+  stdenv_ = if stdenv.isAarch64 then gcc8Stdenv else llvmPackages_7.stdenv;
+  llvmPackages_ = if stdenv.isAarch64 then llvmPackages else llvmPackages_7;
+in let
+  stdenv = stdenv_;
+  llvmPackages = llvmPackages_;
+
   callPackage = newScope chromium;
 
   chromium = {
diff --git a/pkgs/applications/networking/browsers/firefox/packages.nix b/pkgs/applications/networking/browsers/firefox/packages.nix
index 6a2f2ed4efd..09c1e5dd8f8 100644
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@@ -10,10 +10,10 @@ rec {
 
   firefox = common rec {
     pname = "firefox";
-    ffversion = "65.0";
+    ffversion = "65.0.1";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${ffversion}/source/firefox-${ffversion}.source.tar.xz";
-      sha512 = "39bx76whgf53rkfqqy8gfhd44wikh89zpnqr930v4grqg3v0pfr8mbvp7xzjjlf5r7bski0wxibn9vyyy273fp99zyj1w2m5ihh9aqh";
+      sha512 = "2crb46l5r0rwmzr1m8cn9f6xgajwcvansnplqg4kg91rf6x8q0zqzfnmyli9ccsbqvh7bqd31dmy14gwjskasqc4v103x9hchzshxnc";
     };
 
     patches = [
@@ -25,7 +25,7 @@ rec {
     meta = {
       description = "A web browser built from Firefox source tree";
       homepage = http://www.mozilla.com/en-US/firefox/;
-      maintainers = with lib.maintainers; [ eelco ];
+      maintainers = with lib.maintainers; [ eelco andir ];
       platforms = lib.platforms.unix;
       license = lib.licenses.mpl20;
     };
@@ -67,10 +67,10 @@ rec {
 
   firefox-esr-60 = common rec {
     pname = "firefox-esr";
-    ffversion = "60.5.0esr";
+    ffversion = "60.5.1esr";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${ffversion}/source/firefox-${ffversion}.source.tar.xz";
-      sha512 = "3n7l146gdjwhi0iq85awc0yykvi4x5m91mcylxa5mrq911bv6xgn2i92nzhgnhdilqap5218778vgvnalikzsh67irrncx1hy5f6iyx";
+      sha512 = "0fvjw5zd8a9ki0a8phavi6xxfxbck21vj0k8415c5sxv48fwhqdhlnv3wx7riss4rjy9dylhr5xpa99dj9q98z735r8fxb7s3x3vrjz";
     };
 
     patches = [
@@ -237,16 +237,16 @@ in rec {
   };
 
   tor-browser-8-0 = tbcommon rec {
-    ffversion = "60.5.0esr";
-    tbversion = "8.0.5";
+    ffversion = "60.5.1esr";
+    tbversion = "8.0.6";
 
     # FIXME: fetchFromGitHub is not ideal, unpacked source is >900Mb
     src = fetchFromGitHub {
       owner = "SLNOS";
       repo  = "tor-browser";
-      # branch "tor-browser-60.5.0esr-8.0-1-slnos"
-      rev   = "7f113a4ea0539bd2ea9687fe4296c880f2b006c4";
-      sha256 = "11qbhwy2q9rinfw8337b9f78x0r26lnxg25581z85vxshp2jszdq";
+      # branch "tor-browser-60.5.1esr-8.0-1-slnos"
+      rev   = "89be91fc7cbc420b7c4a3bfc36d2b0d500dd3ccf";
+      sha256 = "022zjfwsdl0dkg6ck2kha4nf91xm3j9ag5n21zna98szg3x82dj1";
     };
   };
 
diff --git a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
index 99c70f01241..3c127387600 100644
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@@ -89,7 +89,7 @@ let
   fteLibPath = makeLibraryPath [ stdenv.cc.cc gmp ];
 
   # Upstream source
-  version = "8.0.5";
+  version = "8.0.6";
 
   lang = "en-US";
 
@@ -99,7 +99,7 @@ let
         "https://github.com/TheTorProject/gettorbrowser/releases/download/v${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
         "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
       ];
-      sha256 = "0afrq5vy6rxj4p2dm7kaiq3d3iv4g8ivn7nfqx0z8h1wikyaf5di";
+      sha256 = "14i32r8pw749ghigqblnbr5622jh5wp1ivnwi71vycbgp9pds4f7";
     };
 
     "i686-linux" = fetchurl {
@@ -107,7 +107,7 @@ let
         "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
         "https://github.com/TheTorProject/gettorbrowser/releases/download/v${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
       ];
-      sha256 = "113vn2fyw9sjxz24b2m6z4kw46rqgxglrna1lg9ji6zhkfb044vv";
+      sha256 = "0g9sd104b6xnbl2j3gbq1ga6j2h0x3jccays0gpbd235bxpjs39a";
     };
   };
 in
diff --git a/pkgs/applications/networking/cluster/terraform-providers/libvirt/default.nix b/pkgs/applications/networking/cluster/terraform-providers/libvirt/default.nix
index d24a5780315..96b5c8a0fa1 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/libvirt/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/libvirt/default.nix
@@ -19,7 +19,7 @@
 
 buildGoPackage rec {
   name = "terraform-provider-libvirt-${version}";
-  version = "0.4";
+  version = "0.5.1";
 
   goPackagePath = "github.com/dmacvicar/terraform-provider-libvirt";
 
@@ -27,7 +27,7 @@ buildGoPackage rec {
     owner = "dmacvicar";
     repo = "terraform-provider-libvirt";
     rev = "v${version}";
-    sha256 = "05jkjp1kis4ncryv34pkb9cz2yhzbwg62x9qmlqsqlxwz9hqny3r";
+    sha256 = "0shnj5byqj3qzyqniiy1dcygd8xw1h2bx9z6mgcydw8k64fkm4bw";
   };
 
   buildInputs = [ libvirt pkgconfig makeWrapper ];
diff --git a/pkgs/applications/networking/instant-messengers/mikutter/default.nix b/pkgs/applications/networking/instant-messengers/mikutter/default.nix
index 3c267e612a6..42888da842c 100644
--- a/pkgs/applications/networking/instant-messengers/mikutter/default.nix
+++ b/pkgs/applications/networking/instant-messengers/mikutter/default.nix
@@ -56,7 +56,6 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     description = "An extensible Twitter client";
     homepage = https://mikutter.hachune.net;
-    maintainers = with maintainers; [ midchildan ];
     platforms = ruby.meta.platforms;
     license = licenses.mit;
   };
diff --git a/pkgs/applications/networking/instant-messengers/riot/riot-web.nix b/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
index d9f26fa72b0..53f93b01b1f 100644
--- a/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
@@ -3,11 +3,11 @@
 let configFile = writeText "riot-config.json" conf; in
 stdenv.mkDerivation rec {
   name= "riot-web-${version}";
-  version = "0.17.9";
+  version = "1.0.0";
 
   src = fetchurl {
     url = "https://github.com/vector-im/riot-web/releases/download/v${version}/riot-v${version}.tar.gz";
-    sha256 = "1k7664b0yxvzc7l8mnh9a0kqi8qfj6rdjblfksrd3wg8hdrb7wb1";
+    sha256 = "1rnr6c8qwf8hy1d197xb40f5ajhqdm9sd65n1d9h2x036dqiic7i";
   };
 
   installPhase = ''
diff --git a/pkgs/applications/networking/sync/unison/default.nix b/pkgs/applications/networking/sync/unison/default.nix
index ed48bce7b2e..7862cc1e6e4 100644
--- a/pkgs/applications/networking/sync/unison/default.nix
+++ b/pkgs/applications/networking/sync/unison/default.nix
@@ -1,20 +1,23 @@
-{stdenv, fetchurl, ocaml, lablgtk, fontschumachermisc, xset, makeWrapper, ncurses
+{stdenv, fetchFromGitHub, ocaml, lablgtk, fontschumachermisc, xset, makeWrapper, ncurses
 , enableX11 ? true}:
 
 stdenv.mkDerivation (rec {
 
-  name = "unison-2.48.4";
-  src = fetchurl {
-    url = "http://www.seas.upenn.edu/~bcpierce/unison/download/releases/stable/${name}.tar.gz";
-    sha256 = "30aa53cd671d673580104f04be3cf81ac1e20a2e8baaf7274498739d59e99de8";
+  name = "unison-${version}";
+  version = "2.51.2";
+  src = fetchFromGitHub {
+    owner = "bcpierce00";
+    repo = "unison";
+    rev = "v${version}";
+    sha256 = "1bykiyc0dc5pkw8x370qkg2kygq9pq7yqzsgczd3y13b6ivm4sdq";
   };
 
   buildInputs = [ ocaml makeWrapper ncurses ];
 
   preBuild = (if enableX11 then ''
-    sed -i "s|\(OCAMLOPT=.*\)$|\1 -I $(echo "${lablgtk}"/lib/ocaml/*/site-lib/lablgtk2)|" Makefile.OCaml
+    sed -i "s|\(OCAMLOPT=.*\)$|\1 -I $(echo "${lablgtk}"/lib/ocaml/*/site-lib/lablgtk2)|" src/Makefile.OCaml
   '' else "") + ''
-  echo -e '\ninstall:\n\tcp $(FSMONITOR)$(EXEC_EXT) $(INSTALLDIR)' >> fsmonitor/linux/Makefile
+  echo -e '\ninstall:\n\tcp $(FSMONITOR)$(EXEC_EXT) $(INSTALLDIR)' >> src/fsmonitor/linux/Makefile
   '';
 
   makeFlags = "INSTALLDIR=$(out)/bin/" + (if enableX11 then " UISTYLE=gtk2" else "")
diff --git a/pkgs/applications/science/logic/z3/0001-fix-2131.patch b/pkgs/applications/science/logic/z3/0001-fix-2131.patch
new file mode 100644
index 00000000000..0b21b8fffd4
--- /dev/null
+++ b/pkgs/applications/science/logic/z3/0001-fix-2131.patch
@@ -0,0 +1,66 @@
+From c5df6ce96e068eceb77019e48634721c6a5bb607 Mon Sep 17 00:00:00 2001
+From: Nikolaj Bjorner <nbjorner@microsoft.com>
+Date: Sun, 10 Feb 2019 10:07:24 -0800
+Subject: [PATCH 1/1] fix #2131
+
+Signed-off-by: Nikolaj Bjorner <nbjorner@microsoft.com>
+---
+ src/api/python/README.txt    | 10 +++-------
+ src/api/python/setup.py      |  2 +-
+ src/ast/recfun_decl_plugin.h |  2 +-
+ 3 files changed, 5 insertions(+), 9 deletions(-)
+
+diff --git a/src/api/python/README.txt b/src/api/python/README.txt
+index 9312b1119..561b8dedc 100644
+--- a/src/api/python/README.txt
++++ b/src/api/python/README.txt
+@@ -1,8 +1,4 @@
+-You can learn more about Z3Py at:
+-http://rise4fun.com/Z3Py/tutorial/guide
+-
+-On Windows, you must build Z3 before using Z3Py.
+-To build Z3, you should executed the following command
++On Windows, to build Z3, you should executed the following command
+ in the Z3 root directory at the Visual Studio Command Prompt
+ 
+        msbuild /p:configuration=external
+@@ -12,8 +8,8 @@ If you are using a 64-bit Python interpreter, you should use
+        msbuild /p:configuration=external /p:platform=x64
+ 
+ 
+-On Linux and macOS, you must install Z3Py, before trying example.py.
+-To install Z3Py on Linux and macOS, you should execute the following
++On Linux and macOS, you must install python bindings, before trying example.py.
++To install python on Linux and macOS, you should execute the following
+ command in the Z3 root directory
+ 
+         sudo make install-z3py
+diff --git a/src/api/python/setup.py b/src/api/python/setup.py
+index 2a750fee6..063680e2b 100644
+--- a/src/api/python/setup.py
++++ b/src/api/python/setup.py
+@@ -178,7 +178,7 @@ setup(
+     name='z3-solver',
+     version=_z3_version(),
+     description='an efficient SMT solver library',
+-    long_description='Z3 is a theorem prover from Microsoft Research with support for bitvectors, booleans, arrays, floating point numbers, strings, and other data types.\n\nFor documentation, please read http://z3prover.github.io/api/html/z3.html\n\nIn the event of technical difficulties related to configuration, compiliation, or installation, please submit issues to https://github.com/angr/angr-z3',
++    long_description='Z3 is a theorem prover from Microsoft Research with support for bitvectors, booleans, arrays, floating point numbers, strings, and other data types.\n\nFor documentation, please read http://z3prover.github.io/api/html/z3.html\n\nIn the event of technical difficulties related to configuration, compilation, or installation, please submit issues to https://github.com/angr/angr-z3',
+     author="The Z3 Theorem Prover Project",
+     maintainer="Audrey Dutcher",
+     maintainer_email="audrey@rhelmot.io",
+diff --git a/src/ast/recfun_decl_plugin.h b/src/ast/recfun_decl_plugin.h
+index 0247335e8..b294cdfce 100644
+--- a/src/ast/recfun_decl_plugin.h
++++ b/src/ast/recfun_decl_plugin.h
+@@ -56,7 +56,7 @@ namespace recfun {
+         friend class def;
+         func_decl_ref       m_pred; //<! predicate used for this case
+         expr_ref_vector     m_guards; //<! conjunction that is equivalent to this case
+-        expr_ref            m_rhs; //<! if guard is true, `f(t1…tn) = rhs` holds
++        expr_ref            m_rhs; //<! if guard is true, `f(t1...tn) = rhs` holds
+         def *               m_def; //<! definition this is a part of
+         bool                m_immediate; //<! does `rhs` contain no defined_fun/case_pred?
+ 
+-- 
+2.19.2
+
diff --git a/pkgs/applications/science/logic/z3/default.nix b/pkgs/applications/science/logic/z3/default.nix
index a4a55e3e851..8c1c0ca2302 100644
--- a/pkgs/applications/science/logic/z3/default.nix
+++ b/pkgs/applications/science/logic/z3/default.nix
@@ -11,6 +11,10 @@ stdenv.mkDerivation rec {
     sha256 = "014igqm5vwswz0yhz0cdxsj3a6dh7i79hvhgc3jmmmz3z0xm1gyn";
   };
 
+  patches = [
+    ./0001-fix-2131.patch
+  ];
+
   buildInputs = [ python fixDarwinDylibNames ];
   propagatedBuildInputs = [ python.pkgs.setuptools ];
   enableParallelBuilding = true;
diff --git a/pkgs/applications/science/math/sage/sage-src.nix b/pkgs/applications/science/math/sage/sage-src.nix
index 4ef88e34f03..b9d0a9ef448 100644
--- a/pkgs/applications/science/math/sage/sage-src.nix
+++ b/pkgs/applications/science/math/sage/sage-src.nix
@@ -64,10 +64,10 @@ stdenv.mkDerivation rec {
     fetchSageDiff = { base, rev, name ? "sage-diff-${base}-${rev}.patch", ...}@args: (
       fetchpatch ({
         inherit name;
-        url = "https://git.sagemath.org/sage.git/rawdiff?id2=${base}&id=${rev}";
+        url = "https://git.sagemath.org/sage.git/patch?id2=${base}&id=${rev}";
         # We don't care about sage's own build system (which builds all its dependencies).
         # Exclude build system changes to avoid conflicts.
-        excludes = [ "/build/*" ];
+        excludes = [ "build/*" ];
       } // builtins.removeAttrs args [ "rev" "base" ])
     );
   in [
diff --git a/pkgs/applications/video/aegisub/default.nix b/pkgs/applications/video/aegisub/default.nix
index d4208aee62e..a613ad1c584 100644
--- a/pkgs/applications/video/aegisub/default.nix
+++ b/pkgs/applications/video/aegisub/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl
+{ config, stdenv, fetchurl
 , libX11, wxGTK
 , libiconv, fontconfig, freetype
 , libGLU_combined
@@ -8,8 +8,8 @@
 , spellcheckSupport ? true, hunspell ? null
 , automationSupport ? true, lua ? null
 , openalSupport ? false, openal ? null
-, alsaSupport ? true, alsaLib ? null
-, pulseaudioSupport ? true, libpulseaudio ? null
+, alsaSupport ? stdenv.isLinux, alsaLib ? null
+, pulseaudioSupport ? config.pulseaudio or stdenv.isLinux, libpulseaudio ? null
 , portaudioSupport ? false, portaudio ? null }:
 
 assert spellcheckSupport -> (hunspell != null);
diff --git a/pkgs/applications/video/bomi/default.nix b/pkgs/applications/video/bomi/default.nix
index 671d6794635..bbac1014034 100644
--- a/pkgs/applications/video/bomi/default.nix
+++ b/pkgs/applications/video/bomi/default.nix
@@ -1,4 +1,5 @@
-{ stdenv, fetchFromGitHub, fetchpatch, pkgconfig, perl, python, which
+{ config, stdenv, fetchFromGitHub
+, fetchpatch, pkgconfig, perl, python, which
 , libX11, libxcb, libGLU_combined
 , qtbase, qtdeclarative, qtquickcontrols, qttools, qtx11extras, qmake, makeWrapper
 , libchardet
@@ -15,7 +16,7 @@
 , libbluray
 , jackSupport ? false, jack ? null
 , portaudioSupport ? false, portaudio ? null
-, pulseSupport ? true, libpulseaudio ? null
+, pulseSupport ? config.pulseaudio or stdenv.isLinux, libpulseaudio ? null
 , cddaSupport ? false, libcdda ? null
 , youtubeSupport ? true, youtube-dl ? null
 }:
diff --git a/pkgs/applications/video/mplayer/default.nix b/pkgs/applications/video/mplayer/default.nix
index e017e7cc001..c77486a30cf 100644
--- a/pkgs/applications/video/mplayer/default.nix
+++ b/pkgs/applications/video/mplayer/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, freetype, yasm, ffmpeg
+{ config, stdenv, fetchurl, pkgconfig, freetype, yasm, ffmpeg
 , aalibSupport ? true, aalib ? null
 , fontconfigSupport ? true, fontconfig ? null, freefont_ttf ? null
 , fribidiSupport ? true, fribidi ? null
@@ -19,7 +19,7 @@
 , theoraSupport ? true, libtheora ? null
 , x264Support ? false, x264 ? null
 , jackaudioSupport ? false, libjack2 ? null
-, pulseSupport ? false, libpulseaudio ? null
+, pulseSupport ? config.pulseaudio or false, libpulseaudio ? null
 , bs2bSupport ? false, libbs2b ? null
 # For screenshots
 , libpngSupport ? true, libpng ? null
diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index 301a9211cf6..67a863b6fb7 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -3,7 +3,7 @@
 , bison, lzo, snappy, libaio, gnutls, nettle, curl
 , makeWrapper
 , attr, libcap, libcap_ng
-, CoreServices, Cocoa, rez, setfile
+, CoreServices, Cocoa, Hypervisor, rez, setfile
 , numaSupport ? stdenv.isLinux && !stdenv.isAarch32, numactl
 , seccompSupport ? stdenv.isLinux, libseccomp
 , pulseSupport ? !stdenv.isDarwin, libpulseaudio
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
       vde2 texinfo flex bison makeWrapper lzo snappy
       gnutls nettle curl
     ]
-    ++ optionals stdenv.isDarwin [ CoreServices Cocoa rez setfile ]
+    ++ optionals stdenv.isDarwin [ CoreServices Cocoa Hypervisor rez setfile ]
     ++ optionals seccompSupport [ libseccomp ]
     ++ optionals numaSupport [ numactl ]
     ++ optionals pulseSupport [ libpulseaudio ]
@@ -116,6 +116,7 @@ stdenv.mkDerivation rec {
     ++ optional usbredirSupport "--enable-usb-redir"
     ++ optional (hostCpuTargets != null) "--target-list=${stdenv.lib.concatStringsSep "," hostCpuTargets}"
     ++ optional stdenv.isDarwin "--enable-cocoa"
+    ++ optional stdenv.isDarwin "--enable-hvf"
     ++ optional stdenv.isLinux "--enable-linux-aio"
     ++ optional gtkSupport "--enable-gtk"
     ++ optional xenSupport "--enable-xen"
diff --git a/pkgs/applications/virtualization/virtualbox/default.nix b/pkgs/applications/virtualization/virtualbox/default.nix
index 828db24c325..8304dd15597 100644
--- a/pkgs/applications/virtualization/virtualbox/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, lib, fetchpatch, iasl, dev86, pam, libxslt, libxml2
+{ config, stdenv, fetchurl, lib, fetchpatch, iasl, dev86, pam, libxslt, libxml2
 , libX11, xorgproto, libXext, libXcursor, libXmu, qt5, libIDL, SDL, libcap
 , libpng, glib, lvm2, libXrandr, libXinerama, libopus
 , pkgconfig, which, docbook_xsl, docbook_xml_dtd_43
@@ -7,7 +7,7 @@
 , javaBindings ? false, jdk ? null
 , pythonBindings ? false, python2 ? null
 , extensionPack ? null, fakeroot ? null
-, pulseSupport ? false, libpulseaudio ? null
+, pulseSupport ? config.pulseaudio or stdenv.isLinux, libpulseaudio ? null
 , enableHardening ? false
 , headless ? false
 , enable32bitGuests ? true
diff --git a/pkgs/applications/window-managers/i3/gaps.nix b/pkgs/applications/window-managers/i3/gaps.nix
index 01a89b49e71..f2dc023c81d 100644
--- a/pkgs/applications/window-managers/i3/gaps.nix
+++ b/pkgs/applications/window-managers/i3/gaps.nix
@@ -3,12 +3,12 @@
 i3.overrideAttrs (oldAttrs : rec {
 
   name = "i3-gaps-${version}";
-  version = "4.16";
-  releaseDate = "2018-03-13";
+  version = "4.16.1";
+  releaseDate = "2019-01-27";
 
   src = fetchurl {
     url = "https://github.com/Airblader/i3/archive/${version}.tar.gz";
-    sha256 = "16d215y9g27b75rifm1cgznxg73fmg5ksigi0gbj7pfd6x6bqcy9";
+    sha256 = "1jvyd8p8dfsidfy2yy7adydynzvaf72lx67x71r13hrk8w77hp0k";
   };
 
   nativeBuildInputs = oldAttrs.nativeBuildInputs ++ [ autoreconfHook ];
diff --git a/pkgs/common-updater/scripts/update-source-version b/pkgs/common-updater/scripts/update-source-version
index 57b52553c2b..117e8724cd8 100755
--- a/pkgs/common-updater/scripts/update-source-version
+++ b/pkgs/common-updater/scripts/update-source-version
@@ -96,7 +96,7 @@ fi
 if [ -z "$newHash" ]; then
     nix-build --no-out-link -A "$attr.src" 2>"$attr.fetchlog" >/dev/null || true
     # FIXME: use nix-build --hash here once https://github.com/NixOS/nix/issues/1172 is fixed
-    newHash=$(egrep -v "killing process|dependencies couldn't be built" "$attr.fetchlog" | tail -n2 | sed "s~output path .* has .* hash ‘\(.*\)’ when .* was expected\|fixed-output derivation produced path '.*' with .* hash '\(.*\)' instead of the expected hash '.*'~\1\2~" | head -n1)
+    newHash=$(egrep -v "killing process|dependencies couldn't be built|wanted: " "$attr.fetchlog" | tail -n2 | sed "s~output path .* has .* hash ‘\(.*\)’ when .* was expected\|fixed-output derivation produced path '.*' with .* hash '\(.*\)' instead of the expected hash '.*'\|  got:    .*:\(.*\)~\1\2\3~" | head -n1)
 fi
 
 if [ -z "$newHash" ]; then
diff --git a/pkgs/data/themes/shades-of-gray/default.nix b/pkgs/data/themes/shades-of-gray/default.nix
index 391c99c0ab9..af73ec322d0 100644
--- a/pkgs/data/themes/shades-of-gray/default.nix
+++ b/pkgs/data/themes/shades-of-gray/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "shades-of-gray-theme-${version}";
-  version = "1.1.4";
+  version = "1.1.5";
 
   src = fetchFromGitHub {
     owner = "WernerFP";
     repo = "Shades-of-gray-theme";
     rev = version;
-    sha256 = "1i5mra1ib3c8xqnhwjh8yzjcdnhvqdmccw5x52sfh9xq797px39l";
+    sha256 = "1ql8rkbm5l94b842hg53cwf02vbw2785rlrs4cr60d4kn2c0lj2y";
   };
 
   buildInputs = [ gtk_engines ];
diff --git a/pkgs/desktops/gnome-3/apps/evolution/default.nix b/pkgs/desktops/gnome-3/apps/evolution/default.nix
index 0b86cfbf86a..fa406e6f4db 100644
--- a/pkgs/desktops/gnome-3/apps/evolution/default.nix
+++ b/pkgs/desktops/gnome-3/apps/evolution/default.nix
@@ -7,13 +7,13 @@
 , libcanberra-gtk3, bogofilter, gst_all_1, procps, p11-kit, openldap }:
 
 let
-  version = "3.30.4";
+  version = "3.30.5";
 in stdenv.mkDerivation rec {
   name = "evolution-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "10dy08xpizvvj7r8xgs3lr6migm3ipr199yryqz7wgkycq6nf53b";
+    sha256 = "1hhxj3rh921pp3l3c5k33bdypcas1p66krzs65k1qn82c5fpgl2h";
   };
 
   propagatedUserEnvPkgs = [ evolution-data-server ];
diff --git a/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix b/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix
index 3daeb8d6155..806c3f32d2b 100644
--- a/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix
+++ b/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   name = "evolution-data-server-${version}";
-  version = "3.30.4";
+  version = "3.30.5";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution-data-server/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "1j8lwl04zz59sg7k3hpkzp829z8xyd1isz8xavm9vzxfvw5w776y";
+    sha256 = "1s952wyhgcbmq9nfgk75v15zdy1h3wy5p5rmkqibaavmc0pk3mli";
   };
 
   patches = [
diff --git a/pkgs/desktops/lxqt/compton-conf/default.nix b/pkgs/desktops/lxqt/compton-conf/default.nix
index 9c36b523207..479491b35d8 100644
--- a/pkgs/desktops/lxqt/compton-conf/default.nix
+++ b/pkgs/desktops/lxqt/compton-conf/default.nix
@@ -1,15 +1,15 @@
-{ stdenv, fetchFromGitHub, cmake, pkgconfig, qtbase, qttools, lxqt, libconfig }:
+{ stdenv, fetchFromGitHub, cmake, pkgconfig, qtbase, qttools, lxqt,
+  libconfig }:
 
 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
   pname = "compton-conf";
-  version = "0.4.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "1r187fx1vivzq1gcwwawax36mnlmfig5j1ba4s4wfdi3q2wcq7mw";
+    sha256 = "1vxbh0vr7wknr7rbmdbmy5md1fdkw3zwlgpbv16cwdplbv9m97xi";
   };
 
   nativeBuildInputs = [
@@ -24,8 +24,6 @@ stdenv.mkDerivation rec {
     libconfig
   ];
 
-  cmakeFlags = [ "-DPULL_TRANSLATIONS=NO" ];
-
   preConfigure = ''
     substituteInPlace autostart/CMakeLists.txt \
       --replace "DESTINATION \"\''${LXQT_ETC_XDG_DIR}" "DESTINATION \"etc/xdg" \
diff --git a/pkgs/desktops/lxqt/default.nix b/pkgs/desktops/lxqt/default.nix
index 62b8aaf25ab..db21a72cb9b 100644
--- a/pkgs/desktops/lxqt/default.nix
+++ b/pkgs/desktops/lxqt/default.nix
@@ -18,7 +18,6 @@ let
     lxqt-admin = callPackage ./lxqt-admin { };
     lxqt-config = callPackage ./lxqt-config { };
     lxqt-globalkeys = callPackage ./lxqt-globalkeys { };
-    lxqt-l10n = callPackage ./lxqt-l10n { };
     lxqt-notificationd = callPackage ./lxqt-notificationd { };
     lxqt-openssh-askpass = callPackage ./lxqt-openssh-askpass { };
     lxqt-policykit = callPackage ./lxqt-policykit { };
@@ -29,8 +28,6 @@ let
     lxqt-themes = callPackage ./lxqt-themes { };
     pavucontrol-qt = libsForQt5.callPackage ./pavucontrol-qt { };
     qtermwidget = callPackage ./qtermwidget { };
-    # for now keep version 0.7.1 because virt-manager-qt currently does not compile with qtermwidget-0.8.0
-    qtermwidget_0_7_1 = callPackage ./qtermwidget/0.7.1.nix { };
 
     ### CORE 2
     lxqt-panel = callPackage ./lxqt-panel { };
@@ -70,7 +67,6 @@ let
       lxqt-admin
       lxqt-config
       lxqt-globalkeys
-      lxqt-l10n
       lxqt-notificationd
       lxqt-openssh-askpass
       lxqt-policykit
diff --git a/pkgs/desktops/lxqt/libfm-qt/default.nix b/pkgs/desktops/lxqt/libfm-qt/default.nix
index 4c187f1a07c..70675e1408c 100644
--- a/pkgs/desktops/lxqt/libfm-qt/default.nix
+++ b/pkgs/desktops/lxqt/libfm-qt/default.nix
@@ -5,15 +5,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
   pname = "libfm-qt";
-  version = "0.13.1";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "1g8j1lw74qvagqhqsx45b290fjwh3jfl3i0366m0w4la03v0rw5j";
+    sha256 = "1siqqn4waglymfi7c7lrmlxkylddw8qz0qfwqxr1hnmx3dsj9c36";
   };
 
   nativeBuildInputs = [
@@ -34,8 +33,6 @@ stdenv.mkDerivation rec {
     menu-cache
   ];
 
-  cmakeFlags = [ "-DPULL_TRANSLATIONS=NO" ];
-
   meta = with stdenv.lib; {
     description = "Core library of PCManFM-Qt (Qt binding for libfm)";
     homepage = https://github.com/lxqt/libfm-qt;
diff --git a/pkgs/desktops/lxqt/liblxqt/default.nix b/pkgs/desktops/lxqt/liblxqt/default.nix
index 0762dbad3f8..1b19275ece9 100644
--- a/pkgs/desktops/lxqt/liblxqt/default.nix
+++ b/pkgs/desktops/lxqt/liblxqt/default.nix
@@ -2,15 +2,14 @@
   qttools, qtsvg, libqtxdg, polkit-qt, kwindowsystem, xorg }:
 
 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
   pname = "liblxqt";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "1lbvnx6gg15k7fy1bnv5sjji659f603glblcl8c9psh0m1cjdbll";
+    sha256 = "1cpl6sd2fifpflahm8fvrrscrv03sinfm03m7yc1k59y6nsbwi36";
   };
 
   nativeBuildInputs = [
@@ -29,13 +28,14 @@ stdenv.mkDerivation rec {
   ];
 
   cmakeFlags = [
-    "-DPULL_TRANSLATIONS=NO"
     "-DLXQT_ETC_XDG_DIR=/run/current-system/sw/etc/xdg"
   ];
 
-  patchPhase = ''
+  postPatch = ''
     sed -i 's|set(LXQT_SHARE_DIR .*)|set(LXQT_SHARE_DIR "/run/current-system/sw/share/lxqt")|' CMakeLists.txt
     sed -i "s|\''${POLKITQT-1_POLICY_FILES_INSTALL_DIR}|''${out}/share/polkit-1/actions|" CMakeLists.txt
+    substituteInPlace CMakeLists.txt \
+      --replace "\''${LXQT_TRANSLATIONS_DIR}" "''${out}/share/lxqt/translations"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/desktops/lxqt/libqtxdg/default.nix b/pkgs/desktops/lxqt/libqtxdg/default.nix
index 0b23fb2d04f..852c4bddec8 100644
--- a/pkgs/desktops/lxqt/libqtxdg/default.nix
+++ b/pkgs/desktops/lxqt/libqtxdg/default.nix
@@ -1,19 +1,19 @@
-{ stdenv, fetchFromGitHub, cmake, qt5 }:
+{ stdenv, fetchFromGitHub, cmake, qtbase, qtsvg }:
 
 stdenv.mkDerivation rec {
-  name = "libqtxdg-${version}";
-  version = "3.2.0";
+  pname = "libqtxdg";
+  version = "3.3.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
-    repo = "libqtxdg";
+    repo = pname;
     rev = version;
-    sha256 = "0lkmwnqk314mlr811rdb96p6i7zg67slxdvd4cdkiwakgbzzaa4m";
+    sha256 = "0qgqqgy15h0d1fwk4mnbv2hirz8njjjlng64bv33rc6wwrsaa50b";
   };
 
   nativeBuildInputs = [ cmake ];
 
-  buildInputs = [ qt5.qtbase qt5.qtsvg ];
+  buildInputs = [ qtbase qtsvg ];
 
   preConfigure = ''
     cmakeFlagsArray+=(
diff --git a/pkgs/desktops/lxqt/libsysstat/default.nix b/pkgs/desktops/lxqt/libsysstat/default.nix
index 2e6b79f9769..74fa1b03fa6 100644
--- a/pkgs/desktops/lxqt/libsysstat/default.nix
+++ b/pkgs/desktops/lxqt/libsysstat/default.nix
@@ -1,19 +1,19 @@
-{ stdenv, fetchFromGitHub, cmake, qt5, lxqt }:
+{ stdenv, fetchFromGitHub, cmake, qtbase, lxqt-build-tools }:
 
 stdenv.mkDerivation rec {
-  name = "libsysstat-${version}";
-  version = "0.4.1";
+  pname = "libsysstat";
+  version = "0.4.2";
 
   src = fetchFromGitHub {
     owner = "lxqt";
-    repo = "libsysstat";
+    repo = pname;
     rev = version;
-    sha256 = "0ad5pcr5lq1hvrfijvddvz2fvsmh1phb54wb0f756av0kyiwq0gb";
+    sha256 = "10h9n7km7yx8bnmzxi4nn1yqq03hizjkrx4745j0mczy7niiffsz";
   };
 
-  nativeBuildInputs = [ cmake lxqt.lxqt-build-tools ];
+  nativeBuildInputs = [ cmake lxqt-build-tools ];
 
-  buildInputs = [ qt5.qtbase ];
+  buildInputs = [ qtbase ];
 
   meta = with stdenv.lib; {
     description = "Library used to query system info and statistics";
diff --git a/pkgs/desktops/lxqt/lximage-qt/default.nix b/pkgs/desktops/lxqt/lximage-qt/default.nix
index 7f80e56bc7d..a0a83ad3469 100644
--- a/pkgs/desktops/lxqt/lximage-qt/default.nix
+++ b/pkgs/desktops/lxqt/lximage-qt/default.nix
@@ -1,15 +1,15 @@
-{ stdenv, fetchFromGitHub, cmake, pkgconfig, qt5, xorg, lxqt-build-tools, libfm-qt, libexif }:
+{ stdenv, fetchFromGitHub, cmake, pkgconfig, qtbase, qttools,
+  qtx11extras, qtsvg, xorg, lxqt-build-tools, libfm-qt, libexif }:
 
 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
   pname = "lximage-qt";
-  version = "0.7.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "1slmaic9cmj5lqa5kwc1qfbbycwh8840wnkg0nxc99ls0aazlpzi";
+    sha256 = "0zx9903ym5a9zk4m9khr22fj5sy57mg2v8wnk177wjm11lhic5v8";
   };
 
   nativeBuildInputs = [
@@ -19,18 +19,16 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    qt5.qtbase
-    qt5.qttools
-    qt5.qtx11extras
-    qt5.qtsvg
+    qtbase
+    qttools
+    qtx11extras
+    qtsvg
     libfm-qt
     xorg.libpthreadstubs
     xorg.libXdmcp
     libexif
   ];
 
-  cmakeFlags = [ "-DPULL_TRANSLATIONS=NO" ];
-
   meta = with stdenv.lib; {
     description = "The image viewer and screenshot tool for lxqt";
     homepage = https://github.com/lxqt/lximage-qt;
diff --git a/pkgs/desktops/lxqt/lxqt-about/default.nix b/pkgs/desktops/lxqt/lxqt-about/default.nix
index e109a4f0944..013be8eea4f 100644
--- a/pkgs/desktops/lxqt/lxqt-about/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-about/default.nix
@@ -1,15 +1,14 @@
 { stdenv, fetchFromGitHub, cmake, lxqt-build-tools, qtx11extras, qttools, qtsvg, kwindowsystem, liblxqt, libqtxdg }:
 
 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
   pname = "lxqt-about";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "03f53rnn4rkd1xc2q9abnw37aq4sgvpbwhmcnckqyzc87lj6ici0";
+    sha256 = "14b13v1r5ncz4ycg25ac9ppafiifc37qws8kcw078if72rp9n121";
   };
 
   nativeBuildInputs = [
@@ -26,7 +25,10 @@ stdenv.mkDerivation rec {
     libqtxdg
   ];
 
-  cmakeFlags = [ "-DPULL_TRANSLATIONS=NO" ];
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace "\''${LXQT_TRANSLATIONS_DIR}" "''${out}/share/lxqt/translations"
+  '';
 
   meta = with stdenv.lib; {
     description = "Dialogue window providing information about LXQt and the system it's running on";
diff --git a/pkgs/desktops/lxqt/lxqt-admin/default.nix b/pkgs/desktops/lxqt/lxqt-admin/default.nix
index a92c352087e..528f9a390f9 100644
--- a/pkgs/desktops/lxqt/lxqt-admin/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-admin/default.nix
@@ -1,15 +1,14 @@
 { stdenv, fetchFromGitHub, cmake, lxqt-build-tools, qtx11extras, qttools, qtsvg, kwindowsystem, liblxqt, libqtxdg, polkit-qt }:
 
 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
   pname = "lxqt-admin";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "1nsf8sbgmfanvcxw67drhz1wrizkcd0p87jwr1za5rcgd50bi2yy";
+    sha256 = "0sdb514hgha5yvmbzi6nm1yx1rmbkh5fam09ybidjwpdwl2l4pxx";
   };
 
   nativeBuildInputs = [
@@ -27,12 +26,15 @@ stdenv.mkDerivation rec {
     polkit-qt
   ];
 
-  patchPhase = ''
+  postPatch = ''
     sed "s|\''${POLKITQT-1_POLICY_FILES_INSTALL_DIR}|''${out}/share/polkit-1/actions|" \
       -i lxqt-admin-user/CMakeLists.txt
-  '';
 
-  cmakeFlags = [ "-DPULL_TRANSLATIONS=NO" ];
+    for f in lxqt-admin-{user,time}/CMakeLists.txt; do
+      substituteInPlace $f \
+        --replace "\''${LXQT_TRANSLATIONS_DIR}" "''${out}/share/lxqt/translations"
+    done
+  '';
 
   meta = with stdenv.lib; {
     description = "LXQt system administration tool";
diff --git a/pkgs/desktops/lxqt/lxqt-build-tools/default.nix b/pkgs/desktops/lxqt/lxqt-build-tools/default.nix
index 46f904d0ec7..f55fa579ff4 100644
--- a/pkgs/desktops/lxqt/lxqt-build-tools/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-build-tools/default.nix
@@ -1,19 +1,19 @@
-{ stdenv, fetchFromGitHub, cmake, pkgconfig, pcre, qt5, glib }:
+{ stdenv, fetchFromGitHub, cmake, pkgconfig, pcre, qtbase, glib }:
 
 stdenv.mkDerivation rec {
-  name = "lxqt-build-tools-${version}";
-  version = "0.5.0";
+  pname = "lxqt-build-tools";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
-    repo = "lxqt-build-tools";
+    repo = pname;
     rev = version;
-    sha256 = "0dcwzrijmn4sgivmy2zwz3xa4y69pwhranyw0m90g0pp55di2psz";
+    sha256 = "0i7m9s4g5rsw28vclc9nh0zcapx85cqfwxkx7rrw7wa12svy7pm2";
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];
 
-  buildInputs = [ qt5.qtbase glib pcre ];
+  buildInputs = [ qtbase glib pcre ];
 
   preConfigure = ''cmakeFlags+=" -DLXQT_ETC_XDG_DIR=$out/etc/xdg"'';
 
diff --git a/pkgs/desktops/lxqt/lxqt-config/default.nix b/pkgs/desktops/lxqt/lxqt-config/default.nix
index 3a167996ddb..d2c583b53fa 100644
--- a/pkgs/desktops/lxqt/lxqt-config/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-config/default.nix
@@ -1,15 +1,16 @@
-{ stdenv, fetchFromGitHub, cmake, pkgconfig, lxqt-build-tools, qtbase, qtx11extras, qttools, qtsvg, kwindowsystem, libkscreen, liblxqt, libqtxdg, xorg }:
+{ stdenv, fetchFromGitHub, cmake, pkgconfig, lxqt-build-tools, qtbase,
+  qtx11extras, qttools, qtsvg, kwindowsystem, libkscreen, liblxqt,
+  libqtxdg, xorg }:
 
 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
   pname = "lxqt-config";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "0r5vwkyz0c9b9py3wni4yzkmsvgs6psk9dp1fhfzvbjbknb21bfa";
+    sha256 = "1pp2pw43zh8kwi2cxk909wn6bw7kba95b6bv96l2gmzhdqpfw2a7";
   };
 
   nativeBuildInputs = [
@@ -32,13 +33,29 @@ stdenv.mkDerivation rec {
     xorg.libXScrnSaver
     xorg.libxcb
     xorg.libXcursor
+    xorg.xf86inputlibinput
+    xorg.xf86inputlibinput.dev
   ];
 
-  cmakeFlags = [ "-DPULL_TRANSLATIONS=NO" ];
-
   postPatch = ''
     substituteInPlace src/CMakeLists.txt \
       --replace "DESTINATION \"\''${LXQT_ETC_XDG_DIR}" "DESTINATION \"etc/xdg"
+
+    for f in \
+      lxqt-config-file-associations/CMakeLists.txt \
+      lxqt-config-brightness/CMakeLists.txt \
+      lxqt-config-appearance/CMakeLists.txt \
+      lxqt-config-locale/CMakeLists.txt \
+      lxqt-config-monitor/CMakeLists.txt \
+      lxqt-config-input/CMakeLists.txt \
+      liblxqt-config-cursor/CMakeLists.txt \
+      src/CMakeLists.txt
+    do
+      substituteInPlace $f \
+        --replace "\''${LXQT_TRANSLATIONS_DIR}" "''${out}/share/lxqt/translations"
+    done
+
+    sed -i "/\''${XORG_LIBINPUT_INCLUDE_DIRS}/a ${xorg.xf86inputlibinput.dev}/include/xorg" lxqt-config-input/CMakeLists.txt
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/desktops/lxqt/lxqt-globalkeys/default.nix b/pkgs/desktops/lxqt/lxqt-globalkeys/default.nix
index 1877236bcdd..5382be304ae 100644
--- a/pkgs/desktops/lxqt/lxqt-globalkeys/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-globalkeys/default.nix
@@ -1,15 +1,14 @@
 { stdenv, fetchFromGitHub, cmake, lxqt-build-tools, qtbase, qttools, qtx11extras, qtsvg, kwindowsystem, liblxqt, libqtxdg }:
 
 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
   pname = "lxqt-globalkeys";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "1fmi0n5chnrpbgf7zwzc3hi55r85hkxaq5jylbwaahmxhnb5hdid";
+    sha256 = "14bfkh54mn3jyq8g9ipy3xmc3n9lmlqpvm26kpqig7567hbncv7n";
   };
 
   nativeBuildInputs = [
@@ -27,13 +26,14 @@ stdenv.mkDerivation rec {
     libqtxdg
   ];
 
-  cmakeFlags = [ "-DPULL_TRANSLATIONS=NO" ];
-
   postPatch = ''
     for dir in autostart xdg; do
       substituteInPlace $dir/CMakeLists.txt \
         --replace "DESTINATION \"\''${LXQT_ETC_XDG_DIR}" "DESTINATION \"etc/xdg"
     done
+
+    substituteInPlace config/CMakeLists.txt \
+      --replace "\''${LXQT_TRANSLATIONS_DIR}" "''${out}/share/lxqt/translations"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/desktops/lxqt/lxqt-l10n/default.nix b/pkgs/desktops/lxqt/lxqt-l10n/default.nix
deleted file mode 100644
index 9a79ec16df0..00000000000
--- a/pkgs/desktops/lxqt/lxqt-l10n/default.nix
+++ /dev/null
@@ -1,32 +0,0 @@
-{ stdenv, fetchFromGitHub, cmake, qt5, lxqt }:
-
-stdenv.mkDerivation rec {
-  name = "lxqt-l10n-${version}";
-  version = "0.13.0";
-
-  src = fetchFromGitHub {
-    owner = "lxqt";
-    repo = "lxqt-l10n";
-    rev = version;
-    sha256 = "0q1hzj6sa4wc8sgqqqsqfldjpnvihacfq73agvc2li3q6qi5rr0k";
-  };
-
-  nativeBuildInputs = [
-    cmake
-    qt5.qttools
-    lxqt.lxqt-build-tools
-  ];
-
-  postPatch = ''
-    substituteInPlace CMakeLists.txt \
-      --replace "\''${LXQT_TRANSLATIONS_DIR}" "$out"/share/lxqt/translations
-  '';
-  
-  meta = with stdenv.lib; {
-    description = "Translations of LXQt";
-    homepage = https://github.com/lxqt/lxqt-l10n;
-    license = licenses.lgpl21Plus;
-    platforms = with platforms; unix;
-    maintainers = with maintainers; [ romildo ];
-  };
-}
diff --git a/pkgs/desktops/lxqt/lxqt-notificationd/default.nix b/pkgs/desktops/lxqt/lxqt-notificationd/default.nix
index 32a3c408258..53826f62bcc 100644
--- a/pkgs/desktops/lxqt/lxqt-notificationd/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-notificationd/default.nix
@@ -1,15 +1,14 @@
 { stdenv, fetchFromGitHub, cmake, lxqt-build-tools, qtbase, qttools, qtsvg, kwindowsystem, liblxqt, libqtxdg, qtx11extras }:
 
 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
   pname = "lxqt-notificationd";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "0vjpl3ipc0hrz255snkp99h6xrlid490ml8jb588rdpfina66sp1";
+    sha256 = "1nawcxy2qnrngcxvwjwmmh4fn7mhnfgy1g77rn90243jvy29wv5f";
   };
 
   nativeBuildInputs = [
@@ -20,6 +19,11 @@ stdenv.mkDerivation rec {
   postPatch = ''
     substituteInPlace autostart/CMakeLists.txt \
       --replace "DESTINATION \"\''${LXQT_ETC_XDG_DIR}" "DESTINATION \"etc/xdg"
+
+    for f in {config,src}/CMakeLists.txt; do
+      substituteInPlace $f \
+        --replace "\''${LXQT_TRANSLATIONS_DIR}" "''${out}/share/lxqt/translations"
+    done
   '';
 
   buildInputs = [
@@ -32,8 +36,6 @@ stdenv.mkDerivation rec {
     qtx11extras
   ];
 
-  cmakeFlags = [ "-DPULL_TRANSLATIONS=NO" ];
-
   meta = with stdenv.lib; {
     description = "The LXQt notification daemon";
     homepage = https://github.com/lxqt/lxqt-notificationd;
diff --git a/pkgs/desktops/lxqt/lxqt-openssh-askpass/default.nix b/pkgs/desktops/lxqt/lxqt-openssh-askpass/default.nix
index 56ea7ec7241..f880aed63f8 100644
--- a/pkgs/desktops/lxqt/lxqt-openssh-askpass/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-openssh-askpass/default.nix
@@ -1,15 +1,14 @@
 { stdenv, fetchFromGitHub, cmake, lxqt-build-tools, qtbase, qttools, qtsvg, qtx11extras, kwindowsystem, liblxqt, libqtxdg }:
 
 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
   pname = "lxqt-openssh-askpass";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "19djmqwk4kj3rxs4h7a471ydcz87j5z4yv8a6pgblvqdkkn0ylk9";
+    sha256 = "19xcc6i7jg35780r4dfg4vwfp9x4pz5sqzagxnpzspz61jaj5ibv";
   };
 
   nativeBuildInputs = [
@@ -27,7 +26,10 @@ stdenv.mkDerivation rec {
     libqtxdg
   ];
 
-  cmakeFlags = [ "-DPULL_TRANSLATIONS=NO" ];
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace "\''${LXQT_TRANSLATIONS_DIR}" "''${out}/share/lxqt/translations"
+  '';
 
   meta = with stdenv.lib; {
     description = "GUI to query passwords on behalf of SSH agents";
diff --git a/pkgs/desktops/lxqt/lxqt-panel/default.nix b/pkgs/desktops/lxqt/lxqt-panel/default.nix
index 8cdbf9f9365..f691357f25f 100644
--- a/pkgs/desktops/lxqt/lxqt-panel/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-panel/default.nix
@@ -8,15 +8,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
   pname = "lxqt-panel";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "056khr3smyrdi26zpclwv1qrmk0zxr9cnk65ad9c0xavzk6ya3xz";
+    sha256 = "0jr7ylf6d35m0ckn884arjk4armknnw8iyph00gcphn5bqycbn8l";
   };
 
   nativeBuildInputs = [
@@ -50,8 +49,6 @@ stdenv.mkDerivation rec {
     libXdamage
   ];
 
-  cmakeFlags = [ "-DPULL_TRANSLATIONS=NO" ];
-
   postPatch = ''
     for dir in  autostart menu; do
       substituteInPlace $dir/CMakeLists.txt \
@@ -59,6 +56,11 @@ stdenv.mkDerivation rec {
     done
     substituteInPlace panel/CMakeLists.txt \
       --replace "DESTINATION \''${LXQT_ETC_XDG_DIR}" "DESTINATION etc/xdg"
+
+    for f in cmake/BuildPlugin.cmake panel/CMakeLists.txt; do
+      substituteInPlace $f \
+        --replace "\''${LXQT_TRANSLATIONS_DIR}" "''${out}/share/lxqt/translations"
+    done
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/desktops/lxqt/lxqt-policykit/default.nix b/pkgs/desktops/lxqt/lxqt-policykit/default.nix
index dcf46d09b73..862e0c08ced 100644
--- a/pkgs/desktops/lxqt/lxqt-policykit/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-policykit/default.nix
@@ -5,15 +5,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
   pname = "lxqt-policykit";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "1m9v4hl1hyd8rmlh6z2zy6287qfnavsm9khl526jf8f7bjgpifvd";
+    sha256 = "05k39819nsdyg2pp1vk6g2hdpxqp78h6bhb0hp5rclf9ap5fpvvc";
   };
 
   nativeBuildInputs = [
@@ -34,11 +33,12 @@ stdenv.mkDerivation rec {
     pcre
   ];
 
-  cmakeFlags = [ "-DPULL_TRANSLATIONS=NO" ];
-
   postPatch = ''
     substituteInPlace autostart/CMakeLists.txt \
       --replace "DESTINATION \"\''${LXQT_ETC_XDG_DIR}" "DESTINATION \"etc/xdg"
+
+    substituteInPlace CMakeLists.txt \
+      --replace "\''${LXQT_TRANSLATIONS_DIR}" "''${out}/share/lxqt/translations"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/desktops/lxqt/lxqt-powermanagement/default.nix b/pkgs/desktops/lxqt/lxqt-powermanagement/default.nix
index 3b56a489bee..9ebff5d4de5 100644
--- a/pkgs/desktops/lxqt/lxqt-powermanagement/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-powermanagement/default.nix
@@ -1,15 +1,14 @@
 { stdenv, fetchFromGitHub, cmake, lxqt-build-tools, qtbase, qttools, qtx11extras, qtsvg, kwindowsystem, solid, kidletime, liblxqt, libqtxdg }:
 
 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
   pname = "lxqt-powermanagement";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "04mx1nxqqqjg3wsql4ch4j1a4cbqfvpq0iwi6b9yhaf04n0dwrvn";
+    sha256 = "08xdnb54lji09izzzfip8fw0gp17qkx66jm6i04zby4whx4mqniv";
   };
 
   nativeBuildInputs = [
@@ -29,11 +28,14 @@ stdenv.mkDerivation rec {
     libqtxdg
   ];
 
-  cmakeFlags = [ "-DPULL_TRANSLATIONS=NO" ];
-
   postPatch = ''
     substituteInPlace autostart/CMakeLists.txt \
       --replace "DESTINATION \"\''${LXQT_ETC_XDG_DIR}" "DESTINATION \"etc/xdg"
+
+    for f in {config,src}/CMakeLists.txt; do
+      substituteInPlace $f \
+        --replace "\''${LXQT_TRANSLATIONS_DIR}" "''${out}/share/lxqt/translations"
+    done
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/desktops/lxqt/lxqt-qtplugin/default.nix b/pkgs/desktops/lxqt/lxqt-qtplugin/default.nix
index 972d0a3cb37..82f393cf8d5 100644
--- a/pkgs/desktops/lxqt/lxqt-qtplugin/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-qtplugin/default.nix
@@ -5,15 +5,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
   pname = "lxqt-qtplugin";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "19y5dvbj7gwyh8glc6vi6hb5snvkd3jwvss6j0sn2sy2gp9g9ryb";
+    sha256 = "16n50lxnya03zcviw65sy5dyg9dsrn64k91mrqfvraf6d90md4al";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/lxqt/lxqt-runner/default.nix b/pkgs/desktops/lxqt/lxqt-runner/default.nix
index c0ce6321f6e..dc2d8c58caf 100644
--- a/pkgs/desktops/lxqt/lxqt-runner/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-runner/default.nix
@@ -2,15 +2,14 @@
 menu-cache, muparser, pcre }:
 
 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
   pname = "lxqt-runner";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "0w6r9lby35p0lf5klasa5l2lscx6dmv16kzfhl4lc6w2qfwjb9vi";
+    sha256 = "1qyacig9ksnjrhws8cpk6arlaxn7kl0z39l3c62ql3m89mibsm88";
   };
 
   nativeBuildInputs = [
@@ -33,11 +32,12 @@ stdenv.mkDerivation rec {
     pcre
   ];
 
-  cmakeFlags = [ "-DPULL_TRANSLATIONS=NO" ];
-
   postPatch = ''
     substituteInPlace autostart/CMakeLists.txt \
       --replace "DESTINATION \"\''${LXQT_ETC_XDG_DIR}" "DESTINATION \"etc/xdg"
+
+    substituteInPlace CMakeLists.txt \
+      --replace "\''${LXQT_TRANSLATIONS_DIR}" "''${out}/share/lxqt/translations"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/desktops/lxqt/lxqt-session/default.nix b/pkgs/desktops/lxqt/lxqt-session/default.nix
index e369880b2b4..5b4d7b606c7 100644
--- a/pkgs/desktops/lxqt/lxqt-session/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-session/default.nix
@@ -1,15 +1,14 @@
 { stdenv, fetchFromGitHub, cmake, pkgconfig, lxqt-build-tools, qtbase, qttools, qtsvg, qtx11extras, kwindowsystem, liblxqt, libqtxdg, xorg, xdg-user-dirs }:
 
 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
   pname = "lxqt-session";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "0ngcrkmfpahii4yibsh03b8v8af93hhqm42kk1nnhczc8dg49mhs";
+    sha256 = "0nla1ki23p1bwzw5hbmh9l8yg3b0f55kflgnvyfakmvpivjbz3k6";
   };
 
   nativeBuildInputs = [
@@ -31,13 +30,16 @@ stdenv.mkDerivation rec {
     xdg-user-dirs
   ];
 
-  cmakeFlags = [ "-DPULL_TRANSLATIONS=NO" ];
-
   postPatch = ''
     for dir in autostart config; do
       substituteInPlace $dir/CMakeLists.txt \
         --replace "DESTINATION \"\''${LXQT_ETC_XDG_DIR}" "DESTINATION \"etc/xdg"
     done
+
+    for f in lxqt-{config-session,leave,session}/CMakeLists.txt; do
+      substituteInPlace $f \
+        --replace "\''${LXQT_TRANSLATIONS_DIR}" "''${out}/share/lxqt/translations"
+    done
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/desktops/lxqt/lxqt-sudo/default.nix b/pkgs/desktops/lxqt/lxqt-sudo/default.nix
index 4dddd7de09b..7e3ca84109f 100644
--- a/pkgs/desktops/lxqt/lxqt-sudo/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-sudo/default.nix
@@ -1,15 +1,14 @@
 { stdenv, fetchFromGitHub, cmake, lxqt-build-tools, qtbase, qttools, qtx11extras, qtsvg, kwindowsystem, liblxqt, libqtxdg, sudo }:
 
 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
   pname = "lxqt-sudo";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "1gpn3dhmzabx0jrqxq63549sah03kf6bmdc9d9kmg6hyr5xg3i1h";
+    sha256 = "0l8fq06kfsrmvg2fr8lqdsxr6fwxmxsa9zwaa3fs9inzaylm0jkh";
   };
 
   nativeBuildInputs = [
@@ -28,7 +27,10 @@ stdenv.mkDerivation rec {
     sudo
   ];
 
-  cmakeFlags = [ "-DPULL_TRANSLATIONS=NO" ];
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace "\''${LXQT_TRANSLATIONS_DIR}" "''${out}/share/lxqt/translations"
+  '';
 
   meta = with stdenv.lib; {
     description = "GUI frontend for sudo/su";
diff --git a/pkgs/desktops/lxqt/lxqt-themes/default.nix b/pkgs/desktops/lxqt/lxqt-themes/default.nix
index 1d2301d4a3b..02591b9eb86 100644
--- a/pkgs/desktops/lxqt/lxqt-themes/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-themes/default.nix
@@ -1,20 +1,19 @@
-{ stdenv, fetchFromGitHub, cmake, lxqt }:
+{ stdenv, fetchFromGitHub, cmake, lxqt-build-tools }:
 
 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
   pname = "lxqt-themes";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "026hbblxdbq48n9691b1z1xiak99khsk3wf09vn4iaj5zi7dwhw5";
+    sha256 = "09dkcgnf3lmfly8v90p6wjlj5rin83pbailvvpx2jr8a48a8zb9f";
   };
 
   nativeBuildInputs = [
     cmake
-    lxqt.lxqt-build-tools
+    lxqt-build-tools
   ];
 
   postPatch = ''
diff --git a/pkgs/desktops/lxqt/obconf-qt/default.nix b/pkgs/desktops/lxqt/obconf-qt/default.nix
index 5ddb87ab55d..a0d0a973ad7 100644
--- a/pkgs/desktops/lxqt/obconf-qt/default.nix
+++ b/pkgs/desktops/lxqt/obconf-qt/default.nix
@@ -1,28 +1,28 @@
-{ stdenv, fetchFromGitHub, cmake, pkgconfig, pcre, qt5, xorg, lxqt, openbox, hicolor-icon-theme }:
+{ stdenv, fetchFromGitHub, cmake, pkgconfig, pcre, qtbase, qttools,
+  qtx11extras, xorg, lxqt-build-tools, openbox, hicolor-icon-theme }:
 
 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
   pname = "obconf-qt";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "0mixf35p7b563f77vnikk9b1wqhbdawp723sd30rfql76gkjwjcn";
+    sha256 = "00v5w8qr3vs0k91flij9lz7y1cpp2g8ivgnmmm43ymjfiz5j6l27";
   };
 
   nativeBuildInputs = [
     cmake
     pkgconfig
-    lxqt.lxqt-build-tools
+    lxqt-build-tools
   ];
 
   buildInputs = [
     pcre
-    qt5.qtbase
-    qt5.qttools
-    qt5.qtx11extras
+    qtbase
+    qttools
+    qtx11extras
     xorg.libpthreadstubs
     xorg.libXdmcp
     xorg.libSM
@@ -30,8 +30,6 @@ stdenv.mkDerivation rec {
     hicolor-icon-theme
   ];
 
-  cmakeFlags = [ "-DPULL_TRANSLATIONS=NO" ];
-
   meta = with stdenv.lib; {
     description = "The Qt port of obconf, the Openbox configuration tool";
     homepage = https://github.com/lxqt/obconf-qt;
diff --git a/pkgs/desktops/lxqt/pavucontrol-qt/default.nix b/pkgs/desktops/lxqt/pavucontrol-qt/default.nix
index efd5fde1666..dcc3ead31bf 100644
--- a/pkgs/desktops/lxqt/pavucontrol-qt/default.nix
+++ b/pkgs/desktops/lxqt/pavucontrol-qt/default.nix
@@ -1,15 +1,15 @@
-{ stdenv, fetchFromGitHub, cmake, pkgconfig, lxqt, libpulseaudio, pcre, qtbase, qttools, qtx11extras }:
+{ stdenv, fetchFromGitHub, cmake, pkgconfig, lxqt, libpulseaudio,
+  pcre, qtbase, qttools, qtx11extras }:
 
 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
   pname = "pavucontrol-qt";
-  version = "0.4.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "1bxqpasfvaagbq8azl7536z2zk2725xg7jkvad5xh95zq1gb4hgk";
+    sha256 = "1vyjm6phgbxglk65c889bd73b0p2ffb5bsc89dmb07qzllyrjb4h";
   };
 
   nativeBuildInputs = [
@@ -26,8 +26,6 @@ stdenv.mkDerivation rec {
     pcre
   ];
 
-  cmakeFlags = [ "-DPULL_TRANSLATIONS=NO" ];
-
   meta = with stdenv.lib; {
     description = "A Pulseaudio mixer in Qt (port of pavucontrol)";
     homepage = https://github.com/lxqt/pavucontrol-qt;
diff --git a/pkgs/desktops/lxqt/pcmanfm-qt/default.nix b/pkgs/desktops/lxqt/pcmanfm-qt/default.nix
index 99dace0e42e..aa7479b02f8 100644
--- a/pkgs/desktops/lxqt/pcmanfm-qt/default.nix
+++ b/pkgs/desktops/lxqt/pcmanfm-qt/default.nix
@@ -1,35 +1,33 @@
-{ stdenv, fetchFromGitHub, cmake, pkgconfig, lxqt-build-tools, qt5, libfm-qt, menu-cache, lxmenu-data }:
+{ stdenv, fetchFromGitHub, cmake, pkgconfig, lxqt, qtbase, qttools,
+  qtx11extras, libfm-qt, menu-cache, lxmenu-data }:
 
 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
   pname = "pcmanfm-qt";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "0xnhdxx45fmbi5dqic3j2f7yq01s0xysimafj5zqs0a29zw3i4m0";
+    sha256 = "0hf4qyn12mpr6rrla9mf6ka5gb4y36amk7d14ayr7yka1r16p8lz";
   };
 
   nativeBuildInputs = [
     cmake
     pkgconfig
-    lxqt-build-tools
+    lxqt.lxqt-build-tools
   ];
 
   buildInputs = [
-    qt5.qtbase
-    qt5.qttools
-    qt5.qtx11extras
+    qtbase
+    qttools
+    qtx11extras
     libfm-qt
     libfm-qt
     menu-cache
     lxmenu-data
   ];
 
-  cmakeFlags = [ "-DPULL_TRANSLATIONS=NO" ];
-
   postPatch = ''
     for dir in autostart config; do
       substituteInPlace $dir/CMakeLists.txt \
diff --git a/pkgs/desktops/lxqt/qlipper/default.nix b/pkgs/desktops/lxqt/qlipper/default.nix
index e09c8bc09d5..f5bdcf064fd 100644
--- a/pkgs/desktops/lxqt/qlipper/default.nix
+++ b/pkgs/desktops/lxqt/qlipper/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, qt5 }:
+{ stdenv, fetchFromGitHub, cmake, qtbase, qttools }:
 
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
-  buildInputs = [ qt5.qtbase qt5.qttools ];
+  buildInputs = [ qtbase qttools ];
 
   meta = with stdenv.lib; {
     description = "Cross-platform clipboard history applet";
diff --git a/pkgs/desktops/lxqt/qps/default.nix b/pkgs/desktops/lxqt/qps/default.nix
index a8ee18daf3c..d46b7e14e33 100644
--- a/pkgs/desktops/lxqt/qps/default.nix
+++ b/pkgs/desktops/lxqt/qps/default.nix
@@ -1,20 +1,20 @@
-{ stdenv, fetchFromGitHub, cmake, qt5 }:
+{ stdenv, fetchFromGitHub, cmake, qtbase, qtx11extras, qttools,
+  lxqt-build-tools }:
 
 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
   pname = "qps";
-  version = "1.10.18";
+  version = "1.10.19";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "1cq5z4w2n119z2bq0njn508g5582jljdx2n38cv5b3cf35k91a49";
+    sha256 = "1vyi1vw4z5j2sp9yhhv91wl2sbg4fh0djqslg1ssc7fww2ka6dx3";
   };
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [ cmake lxqt-build-tools ];
 
-  buildInputs = [ qt5.qtbase qt5.qtx11extras qt5.qttools ];
+  buildInputs = [ qtbase qtx11extras qttools ];
 
   meta = with stdenv.lib; {
     description = "The Qt process manager";
diff --git a/pkgs/desktops/lxqt/qterminal/default.nix b/pkgs/desktops/lxqt/qterminal/default.nix
index 3d5a25634d7..f9a2e5ff0a1 100644
--- a/pkgs/desktops/lxqt/qterminal/default.nix
+++ b/pkgs/desktops/lxqt/qterminal/default.nix
@@ -1,15 +1,15 @@
-{ stdenv, fetchFromGitHub, cmake, lxqt-build-tools, qtermwidget, qt5 }:
+{ stdenv, fetchFromGitHub, cmake, lxqt-build-tools, qtermwidget,
+  qtbase, qttools, qtx11extras }:
 
 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
   pname = "qterminal";
-  version = "0.9.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "1z9wlyj5i192jfq3dcxjf8wzx9x332f19c9ll7zv69cq21kyy9wn";
+    sha256 = "071qz248j9gcqzchnrz8xamm07g4r2xyrmnb0a2vjkjd63pk2r8f";
   };
 
   nativeBuildInputs = [
@@ -18,14 +18,12 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    qt5.qtbase
-    qt5.qttools
-    qt5.qtx11extras
+    qtbase
+    qttools
+    qtx11extras
     qtermwidget
   ];
 
-  cmakeFlags = [ "-DPULL_TRANSLATIONS=NO" ];
-
   meta = with stdenv.lib; {
     description = "A lightweight Qt-based terminal emulator";
     homepage = https://github.com/lxqt/qterminal;
diff --git a/pkgs/desktops/lxqt/qtermwidget/0.7.1.nix b/pkgs/desktops/lxqt/qtermwidget/0.7.1.nix
deleted file mode 100644
index 93c93d2c6ba..00000000000
--- a/pkgs/desktops/lxqt/qtermwidget/0.7.1.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-{ stdenv, fetchFromGitHub, cmake, qt5 }:
-
-stdenv.mkDerivation rec {
-  name = "${pname}_0_7_1-${version}";
-  pname = "qtermwidget";
-  version = "0.7.1";
-
-  srcs = fetchFromGitHub {
-    owner = "lxqt";
-    repo = pname;
-    rev = version;
-    sha256 = "0awp33cnkpi9brpx01mz5hwj7j2lq1wdi8cabk3wassd99vvxdxz";
-  };
-
-  nativeBuildInputs = [ cmake ];
-
-  buildInputs = [ qt5.qtbase ];
-
-  meta = with stdenv.lib; {
-    description = "A terminal emulator widget for Qt 5";
-    homepage = https://github.com/lxqt/qtermwidget;
-    license = licenses.gpl2;
-    platforms = with platforms; unix;
-    maintainers = with maintainers; [ romildo ];
-  };
-}
diff --git a/pkgs/desktops/lxqt/qtermwidget/default.nix b/pkgs/desktops/lxqt/qtermwidget/default.nix
index eae53cefc58..9e0798ecb52 100644
--- a/pkgs/desktops/lxqt/qtermwidget/default.nix
+++ b/pkgs/desktops/lxqt/qtermwidget/default.nix
@@ -1,22 +1,19 @@
-{ stdenv, fetchFromGitHub, cmake, qt5, lxqt }:
+{ stdenv, fetchFromGitHub, cmake, qtbase, qttools, lxqt-build-tools }:
 
 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
   pname = "qtermwidget";
-  version = "0.9.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "05gbdjzgmcr3ljs9ba3qvh7a3v6yn6vakwfy8avld9gy5bdd76rg";
+    sha256 = "0wv8fssbc2w7kkpq9ngsa8wyjraggdhsbz36gyxyv8fy5m78jq0n";
   };
 
-  nativeBuildInputs = [ cmake lxqt.lxqt-build-tools ];
+  nativeBuildInputs = [ cmake lxqt-build-tools ];
 
-  buildInputs = [ qt5.qtbase qt5.qttools];
-
-  cmakeFlags = [ "-DPULL_TRANSLATIONS=NO" ];
+  buildInputs = [ qtbase qttools];
 
   meta = with stdenv.lib; {
     description = "A terminal emulator widget for Qt 5";
diff --git a/pkgs/desktops/lxqt/screengrab/default.nix b/pkgs/desktops/lxqt/screengrab/default.nix
index 8890d3f4780..cc7f113b7d1 100644
--- a/pkgs/desktops/lxqt/screengrab/default.nix
+++ b/pkgs/desktops/lxqt/screengrab/default.nix
@@ -1,17 +1,21 @@
-{ stdenv, fetchFromGitHub, cmake, pkgconfig, qtbase, qttools, qtx11extras, qtsvg, kwindowsystem, libqtxdg, xorg }:
+{ stdenv, fetchFromGitHub, cmake, pkgconfig, qtbase, qttools, qtx11extras, qtsvg, kwindowsystem, libqtxdg, xorg, autoPatchelfHook }:
 
 stdenv.mkDerivation rec {
-  name = "screengrab-${version}";
-  version = "1.98";
+  pname = "screengrab";
+  version = "1.100";
 
   src = fetchFromGitHub {
     owner = "lxqt";
-    repo = "screengrab";
+    repo = pname;
     rev = version;
-    sha256 = "1y3r29220z6y457cajpad3pjnr883smbvh0kai8hc5hh4k4kxs6v";
+    sha256 = "1iqrmf581x9ab6zzjxm2509gg6fkn7hwril4v0aki7n7dgxw1c4g";
   };
 
-  nativeBuildInputs = [ cmake pkgconfig ];
+  nativeBuildInputs = [
+    cmake
+    pkgconfig
+    autoPatchelfHook # fix libuploader.so and libextedit.so not found
+  ];
 
   buildInputs = [
     qtbase
diff --git a/pkgs/desktops/lxqt/update.sh b/pkgs/desktops/lxqt/update.sh
index bad78f7c1ff..f3dfc4d5975 100755
--- a/pkgs/desktops/lxqt/update.sh
+++ b/pkgs/desktops/lxqt/update.sh
@@ -7,7 +7,7 @@ cd "$(dirname "${BASH_SOURCE[0]}")"
 root=../../..
 export NIXPKGS_ALLOW_UNFREE=1
 
-lxqt_version=0.13.0
+lxqt_version=0.14.0
 lxqtrepo=https://downloads.lxqt.org/${lxqt_version}.html
 
 version() {
@@ -28,7 +28,7 @@ update_lxqt() {
                  local pfile=$(EDITOR=echo nix edit -f. lxqt.$pname 2>/dev/null)
                  update-source-version lxqt.$pname "$pversion"
                  git add $pfile
-                 git commit -m "$pname: $pversionold -> $pversion"
+                 git commit -m "lxqt.$pname: $pversionold -> $pversion"
                 )
             fi
             echo
diff --git a/pkgs/development/compilers/gnu-cobol/default.nix b/pkgs/development/compilers/gnu-cobol/default.nix
index 3ac14565946..ae27964ae8f 100644
--- a/pkgs/development/compilers/gnu-cobol/default.nix
+++ b/pkgs/development/compilers/gnu-cobol/default.nix
@@ -35,6 +35,6 @@ stdenv.mkDerivation rec {
     homepage = https://sourceforge.net/projects/open-cobol/;
     license = licenses.gpl3;
     maintainers = with maintainers; [ ericsagnes the-kenny ];
-    platforms = platforms.linux;
+    platforms = with platforms; linux ++ darwin;
   };
 }
diff --git a/pkgs/development/coq-modules/coquelicot/default.nix b/pkgs/development/coq-modules/coquelicot/default.nix
index baad637cbb7..e316a8b792d 100644
--- a/pkgs/development/coq-modules/coquelicot/default.nix
+++ b/pkgs/development/coq-modules/coquelicot/default.nix
@@ -1,10 +1,10 @@
 { stdenv, fetchurl, which, coq, ssreflect }:
 
 stdenv.mkDerivation {
-  name = "coq${coq.coq-version}-coquelicot-3.0.1";
+  name = "coq${coq.coq-version}-coquelicot-3.0.2";
   src = fetchurl {
-    url = "https://gforge.inria.fr/frs/download.php/file/37045/coquelicot-3.0.1.tar.gz";
-    sha256 = "0hsyhsy2lwqxxx2r8xgi5csmirss42lp9bkb9yy35mnya0w78c8r";
+    url = "https://gforge.inria.fr/frs/download.php/file/37523/coquelicot-3.0.2.tar.gz";
+    sha256 = "1biia7nfqf7vaqq5gmykl4rwjyvrcwss6r2jdf0in5pvp2rnrj2w";
   };
 
   nativeBuildInputs = [ which ];
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
   };
 
   passthru = {
-    compatibleCoqVersions = v: builtins.elem v [ "8.5" "8.6" "8.7" ];
+    compatibleCoqVersions = v: builtins.elem v [ "8.5" "8.6" "8.7" "8.8" "8.9" ];
   };
 
 }
diff --git a/pkgs/development/coq-modules/flocq/default.nix b/pkgs/development/coq-modules/flocq/default.nix
index 6c0be377bc0..09fbd580845 100644
--- a/pkgs/development/coq-modules/flocq/default.nix
+++ b/pkgs/development/coq-modules/flocq/default.nix
@@ -2,9 +2,9 @@
 
 let params =
   if stdenv.lib.versionAtLeast coq.coq-version "8.7" then {
-    version = "3.0.0";
-    uid = "37477";
-    sha256 = "1h05ji5cmyqyv2i1l83xgkm7vfvcnl8r1dzvbp5yncm1jr9kf6nn";
+    version = "3.1.0";
+    uid = "37901";
+    sha256 = "02szrgz9m0ac51la1lqpiv6i2g0zbgx9gz5rp0q1g00ajldyna5c";
   } else {
     version = "2.6.1";
     uid = "37454";
@@ -46,6 +46,6 @@ stdenv.mkDerivation rec {
   };
 
   passthru = {
-    compatibleCoqVersions = v: builtins.elem v [ "8.5" "8.6" "8.7" "8.8" ];
+    compatibleCoqVersions = v: builtins.elem v [ "8.5" "8.6" "8.7" "8.8" "8.9" ];
   };
 }
diff --git a/pkgs/development/coq-modules/interval/default.nix b/pkgs/development/coq-modules/interval/default.nix
index 6797a71703b..0b97358d863 100644
--- a/pkgs/development/coq-modules/interval/default.nix
+++ b/pkgs/development/coq-modules/interval/default.nix
@@ -1,12 +1,24 @@
 { stdenv, fetchurl, which, coq, coquelicot, flocq, mathcomp
 , bignums ? null }:
 
+let params =
+  if stdenv.lib.versionAtLeast coq.coq-version "8.7" then {
+    version = "3.4.0";
+    uid = "37524";
+    sha256 = "023j9sd64brqvjdidqkn5m8d7a93zd9r86ggh573z9nkjm2m7vvg";
+  } else {
+    version = "3.3.0";
+    uid = "37077";
+    sha256 = "08fdcf3hbwqphglvwprvqzgkg0qbimpyhnqsgv3gac4y1ap0f903";
+  }
+; in
+
 stdenv.mkDerivation {
-  name = "coq${coq.coq-version}-interval-3.3.0";
+  name = "coq${coq.coq-version}-interval-${params.version}";
 
   src = fetchurl {
-    url = "https://gforge.inria.fr/frs/download.php/file/37077/interval-3.3.0.tar.gz";
-    sha256 = "08fdcf3hbwqphglvwprvqzgkg0qbimpyhnqsgv3gac4y1ap0f903";
+    url = "https://gforge.inria.fr/frs/download.php/file/${params.uid}/interval-${params.version}.tar.gz";
+    inherit (params) sha256;
   };
 
   nativeBuildInputs = [ which ];
@@ -26,7 +38,7 @@ stdenv.mkDerivation {
   };
 
   passthru = {
-    compatibleCoqVersions = v: builtins.elem v [ "8.5" "8.6" "8.7" ];
+    compatibleCoqVersions = v: builtins.elem v [ "8.5" "8.6" "8.7" "8.8" ];
   };
 
 
diff --git a/pkgs/development/haskell-modules/configuration-ghc-8.6.x.nix b/pkgs/development/haskell-modules/configuration-ghc-8.6.x.nix
index b6aae3d8e73..b5d325e42b3 100644
--- a/pkgs/development/haskell-modules/configuration-ghc-8.6.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-8.6.x.nix
@@ -49,6 +49,7 @@ self: super: {
   data-clist = doJailbreak super.data-clist;  # won't cope with QuickCheck 2.12.x
   dates = doJailbreak super.dates; # base >=4.9 && <4.12
   Diff = dontCheck super.Diff;
+  equivalence = dontCheck super.equivalence; # test suite doesn't compile https://github.com/pa-ba/equivalence/issues/5
   HaTeX = doJailbreak super.HaTeX; # containers >=0.4 && <0.6 is too tight; https://github.com/Daniel-Diaz/HaTeX/issues/126
   hpc-coveralls = doJailbreak super.hpc-coveralls; # https://github.com/guillaume-nargeot/hpc-coveralls/issues/82
   http-api-data = doJailbreak super.http-api-data;
diff --git a/pkgs/development/libraries/gexiv2/default.nix b/pkgs/development/libraries/gexiv2/default.nix
index 74311525f1e..350f38d8703 100644
--- a/pkgs/development/libraries/gexiv2/default.nix
+++ b/pkgs/development/libraries/gexiv2/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gexiv2";
-  version = "0.10.9";
+  version = "0.10.10";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1vf0zv92p9hybdhn7zx53h3ia53ph97a21xz8rfk877xlr5261l8";
+    sha256 = "1qbcwq89g4r67k1dj4laqj441pj4195c8hzhxn8vc6mmg8adg6kx";
   };
 
   nativeBuildInputs = [ meson ninja pkgconfig gobject-introspection vala gtk-doc docbook_xsl docbook_xml_dtd_43 ];
diff --git a/pkgs/development/libraries/git2/0.27.nix b/pkgs/development/libraries/git2/0.27.nix
index 93948a1b0d6..510f53f24b1 100644
--- a/pkgs/development/libraries/git2/0.27.nix
+++ b/pkgs/development/libraries/git2/0.27.nix
@@ -4,14 +4,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "0.27.7";
+  version = "0.27.8";
   name = "libgit2-${version}";
 
   src = fetchFromGitHub {
     owner = "libgit2";
     repo = "libgit2";
     rev = "v${version}";
-    sha256 = "1q3mp7xjpbmdsnk4sdzf2askbb4pgbxcmr1h7y7zk2738dndwkha";
+    sha256 = "0wzx8nkyy9m7mx6cks58chjd4289vjsw97mxm9w6f1ggqsfnmbr9";
   };
 
   cmakeFlags = [ "-DTHREADSAFE=ON" ];
diff --git a/pkgs/development/libraries/gtk+/3.x.nix b/pkgs/development/libraries/gtk+/3.x.nix
index bb0c21f7739..52f1f5574dd 100644
--- a/pkgs/development/libraries/gtk+/3.x.nix
+++ b/pkgs/development/libraries/gtk+/3.x.nix
@@ -35,6 +35,11 @@ stdenv.mkDerivation rec {
       url = "https://bug757142.bugzilla-attachments.gnome.org/attachment.cgi?id=344123";
       sha256 = "0g6fhqcv8spfy3mfmxpyji93k8d4p4q4fz1v9a1c1cgcwkz41d7p";
     })
+    # 3.24.3: https://gitlab.gnome.org/GNOME/gtk/merge_requests/505
+    (fetchpatch {
+      url = https://gitlab.gnome.org/GNOME/gtk/commit/95c0f07295fd300ab7f3416a39290ae33585ea6c.patch;
+      sha256 = "0z9w7f39xcn1cbcd8jhx731vq64nvi5q6kyc86bq8r00daysjwnl";
+    })
   ] ++ optionals stdenv.isDarwin [
     # X11 module requires <gio/gdesktopappinfo.h> which is not installed on Darwin
     # let’s drop that dependency in similar way to how other parts of the library do it
diff --git a/pkgs/development/libraries/intel-media-driver/default.nix b/pkgs/development/libraries/intel-media-driver/default.nix
index c15a42e3f40..b1c9f59b019 100644
--- a/pkgs/development/libraries/intel-media-driver/default.nix
+++ b/pkgs/development/libraries/intel-media-driver/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   name = "intel-media-driver-${version}";
-  version = "18.4.0";
+  version = "18.4.1";
 
   src = fetchFromGitHub {
     owner  = "intel";
     repo   = "media-driver";
     rev    = "intel-media-${version}";
-    sha256 = "0mvb1dq2014gc60lz22dag230flqw859dcqi08hdmmci30qgw88x";
+    sha256 = "192rfv6dk9jagx0q92jq6n1slc1pllgcc7rm85fgachq9rjl7szh";
   };
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/libgxps/default.nix b/pkgs/development/libraries/libgxps/default.nix
index 3b7f29de573..30e5e247ab2 100644
--- a/pkgs/development/libraries/libgxps/default.nix
+++ b/pkgs/development/libraries/libgxps/default.nix
@@ -1,36 +1,22 @@
 { stdenv, fetchurl, meson, ninja, pkgconfig, glib, gobject-introspection, cairo
-, libarchive, freetype, libjpeg, libtiff, gnome3, fetchpatch
+, libarchive, freetype, libjpeg, libtiff, gnome3, lcms2
 }:
 
 stdenv.mkDerivation rec {
   pname = "libgxps";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "412b1343bd31fee41f7204c47514d34c563ae34dafa4cc710897366bd6cd0fae";
+    sha256 = "157s4c9gjjss6yd7qp7n4q6s72gz1k4ilsx4xjvp357azk49z4qs";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "CVE-2018-10733-1.patch";
-      url = https://gitlab.gnome.org/GNOME/libgxps/commit/b458226e162fe1ffe7acb4230c114a52ada5131b.patch;
-      sha256 = "0pqg9iwkg69qknj7vkgn26c32fndy55byxivd4km0vjfhfyx69hd";
-    })
-    (fetchpatch {
-      name = "CVE-2018-10733-2.patch";
-      url = https://gitlab.gnome.org/GNOME/libgxps/commit/133fe2a96e020d4ca65c6f64fb28a404050ebbfd.patch;
-      sha256 = "19n01x8zs05wf801mkz4mypvapph7h941md3hr3rj0ry6r88pkir";
-    })
-  ];
-
   nativeBuildInputs = [ meson ninja pkgconfig gobject-introspection ];
-  buildInputs = [ glib cairo freetype libjpeg libtiff ];
+  buildInputs = [ glib cairo freetype libjpeg libtiff lcms2 ];
   propagatedBuildInputs = [ libarchive ];
 
   mesonFlags = [
     "-Denable-test=false"
-    "-Dwith-liblcms2=false"
   ];
 
   passthru = {
diff --git a/pkgs/development/libraries/libxmlb/default.nix b/pkgs/development/libraries/libxmlb/default.nix
index cce73ba89bc..bdf210a061a 100644
--- a/pkgs/development/libraries/libxmlb/default.nix
+++ b/pkgs/development/libraries/libxmlb/default.nix
@@ -22,6 +22,10 @@ stdenv.mkDerivation rec {
     "-Dgtkdoc=true"
   ];
 
+  preCheck = ''
+    export XDG_DATA_DIRS=$XDG_DATA_DIRS:${shared-mime-info}/share
+  '';
+
   doCheck = true;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/pcaudiolib/default.nix b/pkgs/development/libraries/pcaudiolib/default.nix
index efaf2cfd429..2050e5cdfe7 100644
--- a/pkgs/development/libraries/pcaudiolib/default.nix
+++ b/pkgs/development/libraries/pcaudiolib/default.nix
@@ -1,6 +1,7 @@
-{ stdenv, lib, fetchFromGitHub, autoconf, automake, which, libtool, pkgconfig,
-  alsaLib, portaudio, 
-  pulseaudioSupport ? true, libpulseaudio }:
+{ config, stdenv, lib, fetchFromGitHub
+, autoconf, automake, which, libtool, pkgconfig
+, portaudio, alsaLib
+, pulseaudioSupport ? config.pulseaudio or stdenv.isLinux, libpulseaudio }:
 
 stdenv.mkDerivation rec {
   name = "pcaudiolib-${version}";
diff --git a/pkgs/development/libraries/pybind11/default.nix b/pkgs/development/libraries/pybind11/default.nix
index d7bca0de249..0a8972d4876 100644
--- a/pkgs/development/libraries/pybind11/default.nix
+++ b/pkgs/development/libraries/pybind11/default.nix
@@ -1,23 +1,29 @@
-{ stdenv, fetchFromGitHub, cmake, python }:
+{ stdenv, fetchFromGitHub, cmake, catch, python, eigen }:
 
 stdenv.mkDerivation rec {
   name = "pybind-${version}";
-  version = "2.2.2";
+  version = "2.2.4";
+
   src = fetchFromGitHub {
     owner = "pybind";
     repo = "pybind11";
     rev = "v${version}";
-    sha256 = "0x71i1n5d02hjbdcnkscrwxs9pb8kplmdpqddhsimabfp84fip48";
+    sha256 = "0pa79ymcasv8br5ifbx7878id5py2jpjac3i20cqxr6gs9l6ivlv";
   };
 
   nativeBuildInputs = [ cmake ];
+  checkInputs = with python.pkgs; [ catch eigen pytest numpy scipy ];
+
+  # Disable test_cmake_build test, as it fails in sandbox
+  # https://github.com/pybind/pybind11/issues/1355
+  patches = [ ./no_test_cmake_build.patch ];
 
-  # disable tests as some tests (test_embed/test_interpreter) are failing at the moment
-  cmakeFlags = [
-     "-DPYTHON_EXECUTABLE=${python.interpreter}"
-     "-DPYBIND11_TEST=0"
+  doCheck = true;
+
+  cmakeFlags = [ 
+    "-DPYTHON_EXECUTABLE=${python.interpreter}" 
+    "-DPYBIND11_TEST=${if doCheck then "ON" else "OFF"}"
   ];
-  doCheck = false;
 
   meta = {
     homepage = https://github.com/pybind/pybind11;
@@ -31,5 +37,4 @@ stdenv.mkDerivation rec {
     license = stdenv.lib.licenses.bsd3;
     maintainers = with stdenv.lib.maintainers; [ yuriaisaka ];
   };
-
 }
diff --git a/pkgs/development/libraries/pybind11/no_test_cmake_build.patch b/pkgs/development/libraries/pybind11/no_test_cmake_build.patch
new file mode 100644
index 00000000000..c5d6ecc4481
--- /dev/null
+++ b/pkgs/development/libraries/pybind11/no_test_cmake_build.patch
@@ -0,0 +1,7 @@
+--- a/tests/CMakeLists.txt	2019-01-28 14:13:55.822119328 +0100
++++ b/tests/CMakeLists.txt	2019-01-28 14:14:06.741161928 +0100
+@@ -233,4 +233,3 @@
+ add_subdirectory(test_embed)
+ 
+ # Test CMake build using functions and targets from subdirectory or installed location
+-add_subdirectory(test_cmake_build)
diff --git a/pkgs/development/libraries/science/math/sympow/default.nix b/pkgs/development/libraries/science/math/sympow/default.nix
index f421755b618..080cab86ca4 100644
--- a/pkgs/development/libraries/science/math/sympow/default.nix
+++ b/pkgs/development/libraries/science/math/sympow/default.nix
@@ -71,7 +71,7 @@ stdenv.mkDerivation rec {
     })
     (fetchpatch {
       name = "fix_pointer_initialization2.patch";
-      url = "https://git.archlinux.org/svntogit/community.git/plain/trunk/sympow-datafiles.patch?h=packages/sympow";
+      url = "https://git.archlinux.org/svntogit/community.git/plain/trunk/sympow-datafiles.patch?h=packages/sympow&id=5088e641a45b23d0385d8e63be65315129b4cf58";
       sha256 = "1m0vz048layb47r1jjf7fplw650ccc9x0w3l322iqmppzmv3022a";
     })
   ];
diff --git a/pkgs/development/libraries/xapian/default.nix b/pkgs/development/libraries/xapian/default.nix
index 2d7289ca664..cf331f01456 100644
--- a/pkgs/development/libraries/xapian/default.nix
+++ b/pkgs/development/libraries/xapian/default.nix
@@ -36,5 +36,5 @@ let
 in {
   # xapian-ruby needs 1.2.22 as of 2017-05-06
   xapian_1_2_22 = generic "1.2.22" "0zsji22n0s7cdnbgj0kpil05a6bgm5cfv0mvx12d8ydg7z58g6r6";
-  xapian_1_4 = generic "1.4.9" "1k7m7m9jld96k16ansfw2w3c354pvd8ibhnrb6dw012g06fw7sfd";
+  xapian_1_4 = generic "1.4.10" "1f4vf1w1yvsn9mn462q6snc8wkmfpifp8wrlzs4aqi45w0kr6rk8";
 }
diff --git a/pkgs/development/ocaml-modules/ocaml-migrate-parsetree/default.nix b/pkgs/development/ocaml-modules/ocaml-migrate-parsetree/default.nix
index a9496576875..38050bc09a1 100644
--- a/pkgs/development/ocaml-modules/ocaml-migrate-parsetree/default.nix
+++ b/pkgs/development/ocaml-modules/ocaml-migrate-parsetree/default.nix
@@ -1,17 +1,17 @@
-{ stdenv, fetchFromGitHub, buildDunePackage, result }:
+{ stdenv, fetchFromGitHub, buildDunePackage, result, ppx_derivers }:
 
 buildDunePackage rec {
    pname = "ocaml-migrate-parsetree";
-   version = "1.1.0";
+   version = "1.2.0";
 
    src = fetchFromGitHub {
      owner = "ocaml-ppx";
      repo = pname;
      rev = "v${version}";
-     sha256 = "1d2n349d1cqm3dr09mwy5m9rfd4bkkqvri5i94wknpsrr35vnrr1";
+     sha256 = "16kas19iwm4afijv3yxd250s08absabmdcb4yj57wc8r4fmzv5dm";
    };
 
-   propagatedBuildInputs = [ result ];
+   propagatedBuildInputs = [ ppx_derivers result ];
 
    meta = {
      description = "Convert OCaml parsetrees between different major versions";
diff --git a/pkgs/development/python-modules/aiolifx-effects/default.nix b/pkgs/development/python-modules/aiolifx-effects/default.nix
new file mode 100644
index 00000000000..bbe2b538ac5
--- /dev/null
+++ b/pkgs/development/python-modules/aiolifx-effects/default.nix
@@ -0,0 +1,31 @@
+{ lib
+, fetchPypi
+, buildPythonPackage
+, isPy3k
+, aiolifx
+}:
+
+buildPythonPackage rec {
+  pname = "aiolifx-effects";
+  version = "0.2.1";
+
+  src = fetchPypi {
+    inherit version;
+    pname = "aiolifx_effects";
+    sha256 = "cb4ac52deeb220783fc6449251cf40833fcffa28648270be64b1b3e83e06b503";
+  };
+
+  # tests are not implemented
+  doCheck = false;
+
+  disabled = !isPy3k;
+
+  propagatedBuildInputs = [ aiolifx ];
+
+  meta = with lib; {
+    homepage = https://github.com/amelchio/aiolifx_effects;
+    license = licenses.mit;
+    description = "Light effects (pulse, colorloop ...) for LIFX lights running on aiolifx";
+    maintainers = with maintainers; [ netixx ];
+  };
+}
diff --git a/pkgs/development/python-modules/aiolifx/default.nix b/pkgs/development/python-modules/aiolifx/default.nix
new file mode 100644
index 00000000000..b7855bee72d
--- /dev/null
+++ b/pkgs/development/python-modules/aiolifx/default.nix
@@ -0,0 +1,31 @@
+{ lib
+, fetchPypi
+, buildPythonPackage
+, isPy3k
+, ifaddr
+, bitstring
+}:
+
+buildPythonPackage rec {
+  pname = "aiolifx";
+  version = "0.6.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "cf53c9faea6eee25a466e73eef1753b82a75c7497648149c19c15342df2678f2";
+  };
+
+  # tests are not implemented
+  doCheck = false;
+
+  disabled = !isPy3k;
+
+  propagatedBuildInputs = [ bitstring ifaddr ];
+
+  meta = with lib; {
+    homepage = http://github.com/frawau/aiolifx;
+    license = licenses.mit;
+    description = "API for local communication with LIFX devices over a LAN with asyncio";
+    maintainers = with maintainers; [ netixx ];
+  };
+}
diff --git a/pkgs/development/python-modules/cassandra-driver/default.nix b/pkgs/development/python-modules/cassandra-driver/default.nix
index c445c21478b..9a89fff08f8 100644
--- a/pkgs/development/python-modules/cassandra-driver/default.nix
+++ b/pkgs/development/python-modules/cassandra-driver/default.nix
@@ -20,14 +20,26 @@
 
 buildPythonPackage rec {
   pname = "cassandra-driver";
-  version = "3.15.1";
+  version = "3.16.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1xcirbvlj00id8269akhk8gy2sv0mlnbgy3nagi32648jwsrcadg";
+    sha256 = "1gjs2lqy0ba6zhh13a1dhirk59i7lc4zcbl7h50619hdm5kv3g22";
   };
 
-  buildInputs = [ pkgs.libev cython ];
+  buildInputs = [
+    pkgs.libev
+    # NOTE: next version will work with cython 0.29
+    # Requires 'Cython!=0.25,<0.29,>=0.20'
+    (cython.overridePythonAttrs(old: rec {
+      pname = "Cython";
+      version = "0.28.3";
+      src = fetchPypi {
+        inherit pname version;
+        sha256 = "1aae6d6e9858888144cea147eb5e677830f45faaff3d305d77378c3cba55f526";
+      };
+    }))
+  ];
 
   propagatedBuildInputs = [ six ]
     ++ stdenv.lib.optionals (pythonOlder "3.4") [ futures ];
diff --git a/pkgs/development/python-modules/llfuse/default.nix b/pkgs/development/python-modules/llfuse/default.nix
index 21ea6de02f1..7f9aa3fa2e4 100644
--- a/pkgs/development/python-modules/llfuse/default.nix
+++ b/pkgs/development/python-modules/llfuse/default.nix
@@ -4,12 +4,12 @@
 
 buildPythonPackage rec {
   pname = "llfuse";
-  version = "1.3.5";
+  version = "1.3.6";
   name = pname + "-" + version;
 
   src = fetchurl {
     url = "mirror://pypi/l/llfuse/${name}.tar.bz2";
-    sha256 = "6e412a3d9be69162d49b8a4d6fb3c343d1c1fba847f4535d229e0ece2548ead8";
+    sha256 = "1j9fzxpgmb4rxxyl9jcf84zvznhgi3hnh4hg5vb0qaslxkvng8ii";
   };
 
   nativeBuildInputs = [ pkgconfig ];
@@ -24,7 +24,7 @@ buildPythonPackage rec {
 
   meta = with stdenv.lib; {
     description = "Python bindings for the low-level FUSE API";
-    homepage = https://code.google.com/p/python-llfuse/;
+    homepage = https://github.com/python-llfuse/python-llfuse;
     license = licenses.lgpl2Plus;
     platforms = platforms.unix;
     maintainers = with maintainers; [ bjornfor ];
diff --git a/pkgs/development/python-modules/mail-parser/default.nix b/pkgs/development/python-modules/mail-parser/default.nix
index da74830f879..42162d62aac 100644
--- a/pkgs/development/python-modules/mail-parser/default.nix
+++ b/pkgs/development/python-modules/mail-parser/default.nix
@@ -2,14 +2,14 @@
 
 buildPythonPackage rec {
   pname = "mail-parser";
-  version = "3.4.1";
+  version = "3.9.2";
 
   # no tests in PyPI tarball
   src = fetchFromGitHub {
     owner = "SpamScope";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0nxilshq4gwpicdklja9p275yf8l5kr1lk620c3cx9w4qai4cmbv";
+    sha256 = "0f515a8r3qz3i2cm4lvs5aw59193jl9mk7bmaj9545n4miyar4nr";
   };
 
   LC_ALL = "en_US.utf-8";
diff --git a/pkgs/development/python-modules/rasterio/default.nix b/pkgs/development/python-modules/rasterio/default.nix
index 6b9ed24488f..9717a9cda23 100644
--- a/pkgs/development/python-modules/rasterio/default.nix
+++ b/pkgs/development/python-modules/rasterio/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "rasterio";
-  version = "1.0.15";
+  version = "1.0.18";
 
   # Pypi doesn't ship the tests, so we fetch directly from GitHub
   src = fetchFromGitHub {
     owner = "mapbox";
     repo = "rasterio";
     rev = version;
-    sha256 = "0waxkqdkaxxmqnkpj397niq193l2bg8s9isal4c7q12jbm6mf7f7";
+    sha256 = "05miivbn2c5slc5nn7fpdn1da42qwzg4z046i71f4r70bc49vsj9";
   };
 
   checkInputs = [ boto3 pytest pytestcov packaging hypothesis ];
diff --git a/pkgs/development/python-modules/scikit-build/default.nix b/pkgs/development/python-modules/scikit-build/default.nix
new file mode 100644
index 00000000000..b0300744b5c
--- /dev/null
+++ b/pkgs/development/python-modules/scikit-build/default.nix
@@ -0,0 +1,43 @@
+{ lib, buildPythonPackage, fetchPypi, wheel, setuptools, packaging
+, cmake, ninja, cython, codecov, coverage, six, virtualenv, pathpy
+, pytest, pytestcov, pytest-virtualenv, pytest-mock, pytestrunner
+, requests, flake8 }:
+
+buildPythonPackage rec {
+  pname = "scikit-build";
+  version = "0.8.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1hh275lj98wgwi53mr9fqk8wh1dajjksch52xjax6a79gld4391a";
+  };
+
+  # Fixes incorrect specified requirement (part of next release)
+  patches = [ ./fix_pytestrunner_req.patch ];
+
+  propagatedBuildInputs = [ wheel setuptools packaging ];
+  checkInputs = [ 
+    cmake ninja cython codecov coverage six virtualenv pathpy
+    pytest pytestcov pytest-mock pytest-virtualenv pytestrunner
+    requests flake8
+  ];
+
+  disabledTests = lib.concatMapStringsSep " and " (s: "not " + s) ([
+    "test_hello_develop" # tries setuptools develop install
+    "test_wheel" # pip has no way to install missing dependencies
+    "test_fortran_compiler" # passes if gfortran is available
+    "test_install_command" # tries to alter out path
+    "test_test_command" # tries to alter out path
+  ]);
+
+  checkPhase = ''
+    py.test -k '${disabledTests}'
+  '';
+
+  meta = with lib; {
+    homepage = http://scikit-build.org/;
+    description = "Improved build system generator for CPython C/C++/Fortran/Cython extensions";
+    license = with licenses; [ mit bsd2 ]; # BSD due to reuses of PyNE code
+    maintainers = [ maintainers.FlorianFranzen ];
+  };
+}
diff --git a/pkgs/development/python-modules/scikit-build/fix_pytestrunner_req.patch b/pkgs/development/python-modules/scikit-build/fix_pytestrunner_req.patch
new file mode 100644
index 00000000000..e8e19f84a5d
--- /dev/null
+++ b/pkgs/development/python-modules/scikit-build/fix_pytestrunner_req.patch
@@ -0,0 +1,13 @@
+diff --git a/setup.py b/setup.py
+index dd348fa..4de89c6 100755
+--- a/setup.py
++++ b/setup.py
+@@ -22,7 +22,7 @@ with open('requirements-dev.txt', 'r') as fp:
+     dev_requirements = list(filter(bool, (line.strip() for line in fp)))
+ 
+ # Require pytest-runner only when running tests
+-pytest_runner = (['pytest-runner>=2.0,<3dev']
++pytest_runner = (['pytest-runner>=2.0']
+                  if any(arg in sys.argv for arg in ('pytest', 'test'))
+                  else [])
+ 
diff --git a/pkgs/development/python-modules/telethon/default.nix b/pkgs/development/python-modules/telethon/default.nix
index d847a494201..23a06c0cd25 100644
--- a/pkgs/development/python-modules/telethon/default.nix
+++ b/pkgs/development/python-modules/telethon/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "telethon";
-  version = "1.5.4";
+  version = "1.5.5";
 
   src = fetchPypi {
     inherit version;
     pname = "Telethon";
-    sha256 = "52cb4929bf37c98ab5f3e173325dbb3cb9c1ca3f4fe6ba87d35c43e2f98858ce";
+    sha256 = "1qpc4vc3lidhlp1c7521nxizjr6y5c3l9x41knqv02x8n3l9knxa";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/twilio/default.nix b/pkgs/development/python-modules/twilio/default.nix
index ba37373e8ea..c9b80f3699b 100644
--- a/pkgs/development/python-modules/twilio/default.nix
+++ b/pkgs/development/python-modules/twilio/default.nix
@@ -3,13 +3,13 @@
 
 buildPythonPackage rec {
   pname = "twilio";
-  version = "6.23.1";
+  version = "6.24.0";
   # tests not included in PyPi, so fetch from github instead
   src = fetchFromGitHub {
     owner = "twilio";
     repo = "twilio-python";
     rev = version;
-    sha256 = "0f6r2qcgcg4pnnsgf9d1k03ri7h7k8kpasp9mdgv421a4rvqh8lm";
+    sha256 = "16lxns59fms75swfjz46484464q4b1fw3ybf8f2k56aas9gyzb2j";
   };
 
   buildInputs = [ nose mock ];
diff --git a/pkgs/development/tools/build-managers/conan/default.nix b/pkgs/development/tools/build-managers/conan/default.nix
index 2ec33980caa..72d9f631afb 100644
--- a/pkgs/development/tools/build-managers/conan/default.nix
+++ b/pkgs/development/tools/build-managers/conan/default.nix
@@ -34,12 +34,12 @@ let newPython = python3.override {
 };
 
 in newPython.pkgs.buildPythonApplication rec {
-  version = "1.11.2";
+  version = "1.12.0";
   pname = "conan";
 
   src = newPython.pkgs.fetchPypi {
     inherit pname version;
-    sha256 = "0b4r9n6541jjp2lsdzc1nc6mk1a953w0d4ynjss3ns7pp89y4nd4";
+    sha256 = "0hgy3wfy96likdchz42h9mawfjw4dxx7k2iinrrlhph7128kji1j";
   };
   checkInputs = [
     git
diff --git a/pkgs/development/tools/kind/default.nix b/pkgs/development/tools/kind/default.nix
index bf73e436fa7..8cf08a93750 100644
--- a/pkgs/development/tools/kind/default.nix
+++ b/pkgs/development/tools/kind/default.nix
@@ -4,13 +4,13 @@ with stdenv.lib;
 
 buildGoPackage rec {
   name = "kind-${version}";
-  version = "0.0.1";
+  version = "0.1.0";
 
   src = fetchFromGitHub {
     rev = "${version}";
     owner = "kubernetes-sigs";
     repo = "kind";
-    sha256 = "1jldj864ip8hrk3zhkjifr4gzgc8kxmxxwvklxglymhv8cxc179f";
+    sha256 = "01ifmnv3jid4ls6qw9d6j9vldjbbnrwclzv8spnh6fnzb2wprln2";
   };
 
   goPackagePath = "sigs.k8s.io/kind";
diff --git a/pkgs/development/tools/kustomize/default.nix b/pkgs/development/tools/kustomize/default.nix
index cbe37cec3c7..2b2930a61b4 100644
--- a/pkgs/development/tools/kustomize/default.nix
+++ b/pkgs/development/tools/kustomize/default.nix
@@ -1,23 +1,22 @@
-# This file was generated by https://github.com/kamilchm/go2nix v1.2.1
 { lib, stdenv, buildGoPackage, fetchFromGitHub }:
 
 buildGoPackage rec {
   name = "kustomize-${version}";
-  version = "1.0.11";
-  # rev is the 1.0.11 commit, mainly for kustomize version command output
-  rev = "8f701a00417a812558a7b785e8354957afa469ae";
+  version = "2.0.1";
+  # rev is the 2.0.1 commit, mainly for kustomize version command output
+  rev = "ce7e5ee2c30cc5856fea01fe423cf167f2a2d0c3";
 
   goPackagePath = "sigs.k8s.io/kustomize";
 
-  buildFlagsArray = let t = "${goPackagePath}/pkg/commands"; in ''
+  buildFlagsArray = let t = "${goPackagePath}/pkg/commands/misc"; in ''
     -ldflags=
       -s -X ${t}.kustomizeVersion=${version}
          -X ${t}.gitCommit=${rev}
-         -X ${t}.buildDate=unknow
+         -X ${t}.buildDate=unknown
   '';
 
   src = fetchFromGitHub {
-  sha256 = "18kc23l6r2di35md9jbinyzxr791vvdjyklaf3k725imqksikwri";
+    sha256 = "1ljllx2gd329lnq6mdsgh8zzr517ji80b0j21pgr23y0xmd43ijf";
     rev = "v${version}";
     repo = "kustomize";
     owner = "kubernetes-sigs";
@@ -32,6 +31,6 @@ buildGoPackage rec {
     '';
     homepage = https://github.com/kubernetes-sigs/kustomize;
     license = licenses.asl20;
-    maintainers = with maintainers; [ carlosdagos vdemeester periklis ];
+    maintainers = with maintainers; [ carlosdagos vdemeester periklis zaninime ];
   };
 }
diff --git a/pkgs/development/tools/misc/elfutils/default.nix b/pkgs/development/tools/misc/elfutils/default.nix
index 477a5aa415d..424032e21af 100644
--- a/pkgs/development/tools/misc/elfutils/default.nix
+++ b/pkgs/development/tools/misc/elfutils/default.nix
@@ -3,11 +3,11 @@
 # TODO: Look at the hardcoded paths to kernel, modules etc.
 stdenv.mkDerivation rec {
   name = "elfutils-${version}";
-  version = "0.175";
+  version = "0.176";
 
   src = fetchurl {
     url = "https://sourceware.org/elfutils/ftp/${version}/${name}.tar.bz2";
-    sha256 = "0nx6nzbk0rw3pxbzxsfvrjjh37hibzd2gjz5bb8wccpf85ar5vzp";
+    sha256 = "08qhrl4g6qqr4ga46jhh78y56a47p3msa5b2x1qhzbxhf71lfmzb";
   };
 
   patches = [ ./debug-info-from-env.patch ];
diff --git a/pkgs/development/tools/ocaml/utop/default.nix b/pkgs/development/tools/ocaml/utop/default.nix
index 434f8b3af2e..be6bb73aab8 100644
--- a/pkgs/development/tools/ocaml/utop/default.nix
+++ b/pkgs/development/tools/ocaml/utop/default.nix
@@ -7,12 +7,12 @@ then throw "utop is not available for OCaml ${ocaml.version}"
 else
 
 stdenv.mkDerivation rec {
-  version = "2.2.0";
+  version = "2.3.0";
   name = "utop-${version}";
 
   src = fetchurl {
     url = "https://github.com/diml/utop/archive/${version}.tar.gz";
-    sha256 = "1414snwmqaxs1x8wbpjf6fn3jsl01hq0phrr7639xmb5vh15mgd4";
+    sha256 = "1g1xf19fhzwsikp33pv1wf6wb2qdc5y7dzqi46h8c4l850cwscjh";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/os-specific/linux/kernel/interpreter-trunc.patch b/pkgs/os-specific/linux/kernel/interpreter-trunc.patch
new file mode 100644
index 00000000000..a0eceec2258
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/interpreter-trunc.patch
@@ -0,0 +1,44 @@
+From cb5b020a8d38f77209d0472a0fea755299a8ec78 Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Thu, 14 Feb 2019 15:02:18 -0800
+Subject: Revert "exec: load_script: don't blindly truncate shebang string"
+
+This reverts commit 8099b047ecc431518b9bb6bdbba3549bbecdc343.
+
+It turns out that people do actually depend on the shebang string being
+truncated, and on the fact that an interpreter (like perl) will often
+just re-interpret it entirely to get the full argument list.
+
+Reported-by: Samuel Dionne-Riel <samuel@dionne-riel.com>
+Acked-by: Kees Cook <keescook@chromium.org>
+Cc: Oleg Nesterov <oleg@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+---
+ fs/binfmt_script.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/fs/binfmt_script.c b/fs/binfmt_script.c
+index d0078cbb718b..7cde3f46ad26 100644
+--- a/fs/binfmt_script.c
++++ b/fs/binfmt_script.c
+@@ -42,14 +42,10 @@ static int load_script(struct linux_binprm *bprm)
+ 	fput(bprm->file);
+ 	bprm->file = NULL;
+ 
+-	for (cp = bprm->buf+2;; cp++) {
+-		if (cp >= bprm->buf + BINPRM_BUF_SIZE)
+-			return -ENOEXEC;
+-		if (!*cp || (*cp == '\n'))
+-			break;
+-	}
++	bprm->buf[BINPRM_BUF_SIZE - 1] = '\0';
++	if ((cp = strchr(bprm->buf, '\n')) == NULL)
++		cp = bprm->buf+BINPRM_BUF_SIZE-1;
+ 	*cp = '\0';
+-
+ 	while (cp > bprm->buf) {
+ 		cp--;
+ 		if ((*cp == ' ') || (*cp == '\t'))
+-- 
+cgit 1.2-0.3.lf.el7
+
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index 78448b4bc38..95050a37d28 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.14.98";
+  version = "4.14.101";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0pqc04ij6qdfhh3rpakas0qc0vqj8mm120z64q9v9vxin5qi20lg";
+    sha256 = "16mnrn2lb6xhcmpqx8brk2w4g6igfb1cwkqkpvlnc7003g2zfbql";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index 200264df22a..ac6b3dad86b 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.19.21";
+  version = "4.19.23";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1hdvk1lz9gi8b6gahqqb1r5zzndfw86qzsg1fji0shgy4vkys26v";
+    sha256 = "02hkiz5vlx2qhyi1hxar9d1cr2gfnrpjdrjjkh83yzxci9kjb6rd";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.20.nix b/pkgs/os-specific/linux/kernel/linux-4.20.nix
index 799f36f7dc2..382747b69d9 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.20.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.20.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.20.8";
+  version = "4.20.10";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0qnh0h7c7ni7j1cgm20sqsfkbri98bckxms494w9ig539b2ac35n";
+    sha256 = "1y1w3j65n2k4ibn9clapbhy5m2rbyspg2maql7q9k27vmplnppjk";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index 334fb6e81b6..cdebebc7482 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.156";
+  version = "4.9.158";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "05m82x2zg0nkc6ayk6akgpfhz31zp6dhhlklcfmi419p8fxbkcay";
+    sha256 = "1vvm2gw5cddy40amxxr1hcw0bis2zldzyicvjhy11wg6j3snk2lc";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix b/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
index a3275786b33..82326a2ee73 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
@@ -1,13 +1,13 @@
 { stdenv, buildPackages, fetchgit, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.20.2019.01.23";
+  version = "4.20.2019.02.09";
   modDirVersion = "4.20.0";
 
   src = fetchgit {
     url = "https://evilpiepirate.org/git/bcachefs.git";
-    rev = "99750eab4d583132cf61f071082c7cf21f5295c0";
-    sha256 = "05wg9w5f68qg02yrciir9h1wx448869763hg3w7j23wc2qywhwqb";
+    rev = "09a546543006b60d44c4c51e7b40cd3ec7837a5e";
+    sha256 = "0p187vp9df0nnhawql0f2bj2sdim0f2b424106d41yxc8ayhz0d9";
   };
 
   extraConfig = "BCACHEFS_FS m";
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index 4c338b37dec..18fd311ca06 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -57,4 +57,11 @@ rec {
       sha256 = "1l8xq02rd7vakxg52xm9g4zng0ald866rpgm8kjlh88mwwyjkrwv";
     };
   };
+
+  # https://github.com/NixOS/nixpkgs/issues/53672
+  # https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cb5b020a8d38f77209d0472a0fea755299a8ec78
+  interpreter-trunc = {
+    name = "interpreter-trunc";
+    patch = ./interpreter-trunc.patch;
+  };
 }
diff --git a/pkgs/os-specific/linux/syslinux/default.nix b/pkgs/os-specific/linux/syslinux/default.nix
index 4b8ff89cb7a..2562bb7e260 100644
--- a/pkgs/os-specific/linux/syslinux/default.nix
+++ b/pkgs/os-specific/linux/syslinux/default.nix
@@ -1,40 +1,19 @@
-{ stdenv, fetchFromGitHub, fetchurl, nasm, perl, python, libuuid, mtools, makeWrapper }:
+{ stdenv, fetchFromRepoOrCz, fetchpatch, nasm, perl, python, libuuid, mtools, makeWrapper }:
 
 stdenv.mkDerivation rec {
-  name = "syslinux-2015-11-09";
+  # This is syslinux-6.04-pre3^1; syslinux-6.04-pre3 fails to run.
+  # Same issue here https://www.syslinux.org/archives/2019-February/026330.html
+  name = "syslinux-2019-02-07";
 
-  src = fetchFromGitHub {
-    owner = "geneC";
+  src = fetchFromRepoOrCz {
     repo = "syslinux";
-    rev = "0cc9a99e560a2f52bcf052fd85b1efae35ee812f";
-    sha256 = "0wk3r5ki4lc334f9jpml07wpl8d0bnxi9h1l4h4fyf9a0d7n4kmw";
+    rev = "b40487005223a78c3bb4c300ef6c436b3f6ec1f7";
+    sha256 = "1qrxl1114sr2i2791z9rf8v53g200aq30f08808d7i8qnmgvxl2w";
   };
 
-  patches = let
-    mkURL = commit: patchName:
-      "https://salsa.debian.org/images-team/syslinux/raw/${commit}/debian/patches/"
-      + patchName;
-  in [
-    ./perl-deps.patch
-    (fetchurl {
-      # ldlinux.elf: Not enough room for program headers, try linking with -N
-      name = "not-enough-room.patch";
-      url = mkURL "a556ad7" "0014_fix_ftbfs_no_dynamic_linker.patch";
-      sha256 = "0ijqjsjmnphmvsx0z6ppnajsfv6xh6crshy44i2a5klxw4nlvrsw";
-    })
-    (fetchurl {
-      # mbr.bin: too big (452 > 440)
-      # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=906414
-      url = mkURL "7468ef0e38c43" "0016-strip-gnu-property.patch";
-      sha256 = "17n63b8wz6szv8npla1234g1ip7lqgzx2whrpv358ppf67lq8vwm";
-    })
-  ];
-
   postPatch = ''
     substituteInPlace Makefile --replace /bin/pwd $(type -P pwd)
-    substituteInPlace gpxe/src/Makefile.housekeeping --replace /bin/echo $(type -P echo)
     substituteInPlace utils/ppmtolss16 --replace /usr/bin/perl $(type -P perl)
-    substituteInPlace gpxe/src/Makefile --replace /usr/bin/perl $(type -P perl)
 
     # fix tests
     substituteInPlace tests/unittest/include/unittest/unittest.h \
@@ -74,6 +53,7 @@ stdenv.mkDerivation rec {
     homepage = http://www.syslinux.org/;
     description = "A lightweight bootloader";
     license = licenses.gpl2;
+    maintainers = [ maintainers.samueldr ];
     platforms = [ "i686-linux" "x86_64-linux" ];
   };
 }
diff --git a/pkgs/os-specific/linux/syslinux/perl-deps.patch b/pkgs/os-specific/linux/syslinux/perl-deps.patch
deleted file mode 100644
index 82c9820809e..00000000000
--- a/pkgs/os-specific/linux/syslinux/perl-deps.patch
+++ /dev/null
@@ -1,81 +0,0 @@
-http://git.ipxe.org/ipxe.git/commitdiff/719b498
-
-diff -ru -x '*~' -x '*.orig' -x '*.rej' syslinux-4.02-orig/gpxe/src/arch/i386/Makefile.pcbios syslinux-4.02/gpxe/src/arch/i386/Makefile.pcbios
---- syslinux-4.02-orig/gpxe/src/arch/i386/Makefile.pcbios	2010-07-21 21:33:13.000000000 +0200
-+++ syslinux-4.02/gpxe/src/arch/i386/Makefile.pcbios	2010-08-06 23:32:57.000000000 +0200
-@@ -24,11 +24,11 @@
- 
- # Padding rules
- #
--PAD_rom		= $(PADIMG) --blksize=512 --byte=0xff $@
-+PAD_rom		= $(PERL) $(PADIMG) --blksize=512 --byte=0xff $@
- PAD_hrom	= $(PAD_rom)
- PAD_xrom	= $(PAD_rom)
--PAD_dsk		= $(PADIMG) --blksize=512 $@
--PAD_hd		= $(PADIMG) --blksize=32768 $@
-+PAD_dsk		= $(PERL) $(PADIMG) --blksize=512 $@
-+PAD_hd		= $(PERL) $(PADIMG) --blksize=32768 $@
- 
- # rule to make a non-emulation ISO boot image
- NON_AUTO_MEDIA	+= iso
-diff -ru -x '*~' -x '*.orig' -x '*.rej' syslinux-4.02-orig/gpxe/src/Makefile syslinux-4.02/gpxe/src/Makefile
---- syslinux-4.02-orig/gpxe/src/Makefile	2010-07-21 21:33:13.000000000 +0200
-+++ syslinux-4.02/gpxe/src/Makefile	2010-08-06 23:31:15.000000000 +0200
-@@ -31,12 +31,12 @@
- OBJCOPY		:= $(CROSS_COMPILE)objcopy
- NM		:= $(CROSS_COMPILE)nm
- OBJDUMP		:= $(CROSS_COMPILE)objdump
--PARSEROM	:= $(PERL) ./util/parserom.pl
--MAKEROM		:= $(PERL) ./util/makerom.pl
--SYMCHECK	:= $(PERL) ./util/symcheck.pl
--SORTOBJDUMP	:= $(PERL) ./util/sortobjdump.pl
--PADIMG		:= $(PERL) ./util/padimg.pl
--LICENCE		:= $(PERL) ./util/licence.pl
-+PARSEROM	:= ./util/parserom.pl
-+MAKEROM		:= ./util/makerom.pl
-+SYMCHECK	:= ./util/symcheck.pl
-+SORTOBJDUMP	:= ./util/sortobjdump.pl
-+PADIMG		:= ./util/padimg.pl
-+LICENCE		:= ./util/licence.pl
- NRV2B		:= ./util/nrv2b
- ZBIN		:= ./util/zbin
- ELF2EFI32	:= ./util/elf2efi32
-diff -ru -x '*~' -x '*.orig' -x '*.rej' syslinux-4.02-orig/gpxe/src/Makefile.housekeeping syslinux-4.02/gpxe/src/Makefile.housekeeping
---- syslinux-4.02-orig/gpxe/src/Makefile.housekeeping	2010-07-21 21:33:13.000000000 +0200
-+++ syslinux-4.02/gpxe/src/Makefile.housekeeping	2010-08-06 23:31:49.000000000 +0200
-@@ -456,7 +456,7 @@
- 		 '\n$(2) : $$($(4)_DEPS)\n' \
- 		 '\nTAGS : $$($(4)_DEPS)\n' \
- 		>> $(2)
--	@$(PARSEROM) $(1) >> $(2)
-+	@$(PERL) $(PARSEROM) $(1) >> $(2)
- 
- endef
- 
-@@ -657,7 +657,7 @@
- 	$(QM)$(ECHO) "  [LD] $@"
- 	$(Q)$(LD) $(LDFLAGS) -T $(LDSCRIPT) $(TGT_LD_FLAGS) $(BLIB) -o $@ \
- 		-Map $(BIN)/$*.tmp.map
--	$(Q)$(OBJDUMP) -ht $@ | $(SORTOBJDUMP) >> $(BIN)/$*.tmp.map
-+	$(Q)$(OBJDUMP) -ht $@ | $(PERL) $(SORTOBJDUMP) >> $(BIN)/$*.tmp.map
- 
- # Keep intermediate object file (useful for debugging)
- .PRECIOUS : $(BIN)/%.tmp
-@@ -714,7 +714,7 @@
- 		echo "files are missing a licence declaration:" ;\
- 		echo $(call unlicensed_deps_list,$<);\
- 		exit 1,\
--		$(LICENCE) $(call licence_list,$<))
-+		$(PERL) $(LICENCE) $(call licence_list,$<))
- 
- # Extract compression information from intermediate object file
- #
-@@ -941,7 +941,7 @@
- CLEANUP	+= $(BIN)/symtab
- 
- symcheck : $(SYMTAB)
--	$(SYMCHECK) $<
-+	$(PERL) $(SYMCHECK) $<
- 
- endif # defined(BIN)
- 
diff --git a/pkgs/servers/consul/default.nix b/pkgs/servers/consul/default.nix
index d1dcd78667f..38d79eb2ba4 100644
--- a/pkgs/servers/consul/default.nix
+++ b/pkgs/servers/consul/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "consul-${version}";
-  version = "1.3.0";
+  version = "1.4.1";
   rev = "v${version}";
 
   goPackagePath = "github.com/hashicorp/consul";
@@ -19,7 +19,7 @@ buildGoPackage rec {
     owner = "hashicorp";
     repo = "consul";
     inherit rev;
-    sha256 = "1zv84snvrjm74w3v3rr27linsbxj00m73xd047sb78a4766xs2h0";
+    sha256 = "1xd2chx69jdbq2r82d4cgyc8pf1cmmxqvbfz29bf3nvvi6bgq7d5";
   };
 
   preBuild = ''
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 7e5eb47953e..3b3d997e6aa 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -559,7 +559,7 @@
     "konnected" = ps: with ps; [ aiohttp-cors ];
     "lametric" = ps: with ps; [  ];
     "lcn" = ps: with ps; [  ];
-    "lifx" = ps: with ps; [  ];
+    "lifx" = ps: with ps; [ aiolifx ];
     "light" = ps: with ps; [  ];
     "light.abode" = ps: with ps; [  ];
     "light.ads" = ps: with ps; [  ];
@@ -589,7 +589,7 @@
     "light.isy994" = ps: with ps; [  ];
     "light.knx" = ps: with ps; [  ];
     "light.lcn" = ps: with ps; [  ];
-    "light.lifx" = ps: with ps; [  ];
+    "light.lifx" = ps: with ps; [ aiolifx aiolifx-effects ];
     "light.lifx_legacy" = ps: with ps; [  ];
     "light.lightwave" = ps: with ps; [  ];
     "light.limitlessled" = ps: with ps; [ limitlessled ];
@@ -1144,7 +1144,7 @@
     "sensor.serial" = ps: with ps; [  ];
     "sensor.serial_pm" = ps: with ps; [  ];
     "sensor.seventeentrack" = ps: with ps; [  ];
-    "sensor.shodan" = ps: with ps; [  ];
+    "sensor.shodan" = ps: with ps; [ shodan ];
     "sensor.sht31" = ps: with ps; [  ];
     "sensor.sigfox" = ps: with ps; [  ];
     "sensor.simulated" = ps: with ps; [  ];
diff --git a/pkgs/servers/rippled/default.nix b/pkgs/servers/rippled/default.nix
index af25da7ae45..75aced300ed 100644
--- a/pkgs/servers/rippled/default.nix
+++ b/pkgs/servers/rippled/default.nix
@@ -1,26 +1,142 @@
-{ stdenv, fetchFromGitHub, scons, pkgconfig, openssl, protobuf, boost, zlib}:
+{ stdenv, fetchFromGitHub, fetchgit, fetchurl, git, cmake, pkgconfig
+, openssl, boost, zlib }:
 
-stdenv.mkDerivation rec {
+let
+  sqlite3 = fetchurl {
+    url = "https://www.sqlite.org/2018/sqlite-amalgamation-3260000.zip";
+    sha256 = "0vh9aa5dyvdwsyd8yp88ss300mv2c2m40z79z569lcxa6fqwlpfy";
+  };
+
+  beast = fetchgit {
+    url = "https://github.com/boostorg/beast.git";
+    rev = "2f9a8440c2432d8a196571d6300404cb76314125";
+    sha256 = "1n9ms5cn67b0p0mhldz5psgylds22sm5x22q7knrsf20856vlk5a";
+    fetchSubmodules = false;
+    leaveDotGit = true;
+  };
+
+  docca = fetchgit {
+    url = "https://github.com/vinniefalco/docca.git";
+    rev = "335dbf9c3613e997ed56d540cc8c5ff2e28cab2d";
+    sha256 = "09cb90k0ygmnlpidybv6nzf6is51i80lnwlvad6ijc3gf1z6i1yh";
+    fetchSubmodules = false;
+    leaveDotGit = true;
+  };
+
+  rocksdb = fetchgit {
+    url = "https://github.com/facebook/rocksdb.git";
+    rev = "a297643f2e327a8bc7061bfc838fdf11935a2cf2";
+    sha256 = "00z8i4fwr27j9d4ymnls7rcgfvm6xh36a4hy2m2njx4x513pgyzw";
+    fetchSubmodules = false;
+    leaveDotGit = true;
+  };
+
+  lz4 = fetchgit rec {
+    url = "https://github.com/lz4/lz4.git";
+    rev = "v1.8.2";
+    sha256 = "1niv553q60hwn95yflzmrqkp1046hrid13h0yr36lm4fjza21h9w";
+    leaveDotGit = true;
+    fetchSubmodules = false;
+    postFetch = "cd $out && git tag ${rev}";
+  };
+
+  libarchive = fetchgit rec {
+    url = "https://github.com/libarchive/libarchive.git";
+    rev = "v3.3.3";
+    sha256 = "165imgfmizpi4ffpiwfs8gxysn6lw3y1fxj5rga98filkl7hxs31";
+    leaveDotGit = true;
+    fetchSubmodules = false;
+    postFetch = "cd $out && git tag ${rev}";
+  };
+
+  soci = fetchgit rec {
+    url = "https://github.com/SOCI/soci.git";
+    rev = "3a1f602b3021b925d38828e3ff95f9e7f8887ff7";
+    sha256 = "0lnps42cidlrn43h13b9yc8cs3fwgz7wb6a1kfc9rnw7swkh757f";
+    leaveDotGit = true;
+    fetchSubmodules = false;
+  };
+
+  snappy = fetchgit rec {
+    url = "https://github.com/google/snappy.git";
+    rev = "1.1.7";
+    sha256 = "1f0i0sz5gc8aqd594zn3py6j4w86gi1xry6qaz2vzyl4w7cb4v35";
+    leaveDotGit = true;
+    fetchSubmodules = false;
+    postFetch = "cd $out && git tag ${rev}";
+  };
+
+  nudb = fetchgit rec {
+    url = "https://github.com/vinniefalco/NuDB.git";
+    rev = "1.0.0";
+    sha256 = "142bxicv25xaw4fmpw8bbblb1grdw30wyj181xl4a5734zw3qgmz";
+    leaveDotGit = true;
+    fetchSubmodules = false;
+    postFetch = "cd $out && git tag ${rev}";
+  };
+
+  protobuf = fetchgit rec {
+    url = "https://github.com/protocolbuffers/protobuf.git";
+    rev = "v3.6.1";
+    sha256 = "0zl09q25ggfw95lakcs3mkq5pvsj17mx29b4nqr09g0mnbw9709c";
+    leaveDotGit = true;
+    fetchSubmodules = false;
+    postFetch = "cd $out && git tag ${rev}";
+  };
+
+  google-test = fetchgit rec {
+    url = "https://github.com/google/googletest.git";
+    rev = "c3bb0ee2a63279a803aaad956b9b26d74bf9e6e2";
+    sha256 = "0pj5b6jnrj5lrccz2disr8hklbnzd8hwmrwbfqmvhiwb9q9p0k2k";
+    leaveDotGit = true;
+    fetchSubmodules = false;
+  };
+
+  google-benchmark = fetchgit rec {
+    url = "https://github.com/google/benchmark.git";
+    rev = "5b7683f49e1e9223cf9927b24f6fd3d6bd82e3f8";
+    sha256 = "0qg70j47zqnrbszlgrzmxpr4g88kq0gyq6v16bhaggfm83c6mg6i";
+    leaveDotGit = true;
+    fetchSubmodules = false;
+  };
+in stdenv.mkDerivation rec {
   name = "rippled-${version}";
-  version = "0.30.0-rc1";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "ripple";
     repo = "rippled";
     rev = version;
-    sha256 = "0l1dg29mg6wsdkh0lwi2znpl2wcm6bs6d3lswk5g1m1nk2mk7lr7";
+    sha256 = "1zx8qs32v5ibkwm9nm6m0qh0gcr0vcigr2wbxpd40pqqk73cqb3q";
   };
 
-  postPatch = ''
-    sed -i -e "s@ENV = dict.*@ENV = os.environ@g" SConstruct
-  '';
+  hardeningDisable = ["format"];
+  cmakeFlags = ["-Dstatic=OFF"];
+
+  nativeBuildInputs = [ pkgconfig cmake git ];
+  buildInputs = [ openssl openssl.dev boost zlib ];
 
-  nativeBuildInputs = [ pkgconfig scons ];
-  buildInputs = [ openssl protobuf boost zlib ];
+  preConfigure = ''
+    export HOME=$PWD
+
+    git config --global url."file://${beast}".insteadOf "https://github.com/vinniefalco/Beast.git"
+    git config --global url."file://${docca}".insteadOf "https://github.com/vinniefalco/docca.git"
+    git config --global url."file://${rocksdb}".insteadOf "https://github.com/facebook/rocksdb.git"
+    git config --global url."file://${lz4}".insteadOf "${lz4.url}"
+    git config --global url."file://${libarchive}".insteadOf "${libarchive.url}"
+    git config --global url."file://${soci}".insteadOf "${soci.url}"
+    git config --global url."file://${snappy}".insteadOf "${snappy.url}"
+    git config --global url."file://${nudb}".insteadOf "${nudb.url}"
+    git config --global url."file://${protobuf}".insteadOf "${protobuf.url}"
+    git config --global url."file://${google-benchmark}".insteadOf "${google-benchmark.url}"
+    git config --global url."file://${google-test}".insteadOf "${google-test.url}"
+
+    substituteInPlace CMakeLists.txt --replace "URL https://www.sqlite.org/2018/sqlite-amalgamation-3260000.zip" "URL ${sqlite3}"
+  '';
 
-  postInstall = ''
-    mkdir -p $out/bin
-    cp build/rippled $out/bin/
+  doCheck = true;
+  checkPhase = ''
+    ./rippled --unittest
   '';
 
   meta = with stdenv.lib; {
@@ -29,6 +145,5 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ ehmry offline ];
     license = licenses.isc;
     platforms = [ "x86_64-linux" ];
-    broken = true;
   };
 }
diff --git a/pkgs/servers/web-apps/matomo/default.nix b/pkgs/servers/web-apps/matomo/default.nix
index 9c1180ffb49..89de2500811 100644
--- a/pkgs/servers/web-apps/matomo/default.nix
+++ b/pkgs/servers/web-apps/matomo/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "matomo-${version}";
-  version = "3.7.0";
+  version = "3.8.1";
 
   src = fetchurl {
     # TODO: As soon as the tarballs are renamed as well on future releases, this should be enabled again
     # url = "https://builds.matomo.org/${name}.tar.gz";
     url = "https://builds.matomo.org/piwik-${version}.tar.gz";
-    sha256 = "17ihsmwdfrx1c1v8cp5pc3swx3h0i0l9pjrc8jyww08kavfbfly6";
+    sha256 = "0ca4fkg2jpkfg0r9hxl45ad5xzz0gxhf404i96j059bn3c41kfi0";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/servers/web-apps/matomo/make-localhost-default-database-host.patch b/pkgs/servers/web-apps/matomo/make-localhost-default-database-host.patch
index 48808ac2ccc..5af8ef860b2 100644
--- a/pkgs/servers/web-apps/matomo/make-localhost-default-database-host.patch
+++ b/pkgs/servers/web-apps/matomo/make-localhost-default-database-host.patch
@@ -1,13 +1,13 @@
 diff --git a/plugins/Installation/FormDatabaseSetup.php b/plugins/Installation/FormDatabaseSetup.php
-index 9364f49870..2625cbb91b 100644
+index 74de2535b4..bc172ad0eb 100644
 --- a/plugins/Installation/FormDatabaseSetup.php
 +++ b/plugins/Installation/FormDatabaseSetup.php
 @@ -82,7 +82,7 @@ class FormDatabaseSetup extends QuickForm2
  
-         // default values
-         $this->addDataSource(new HTML_QuickForm2_DataSource_Array(array(
--                                                                       'host'          => '127.0.0.1',
-+                                                                       'host'          => 'localhost',
-                                                                        'type'          => $defaultDatabaseType,
-                                                                        'tables_prefix' => 'matomo_',
-                                                                   )));
+ 
+         $defaults = array(
+-            'host'          => '127.0.0.1',
++            'host'          => 'localhost',
+             'type'          => $defaultDatabaseType,
+             'tables_prefix' => 'matomo_',
+         );
diff --git a/pkgs/tools/backup/restic/default.nix b/pkgs/tools/backup/restic/default.nix
index 453e31f5d13..7b039f93a03 100644
--- a/pkgs/tools/backup/restic/default.nix
+++ b/pkgs/tools/backup/restic/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "restic-${version}";
-  version = "0.9.2";
+  version = "0.9.4";
 
   goPackagePath = "github.com/restic/restic";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     owner = "restic";
     repo = "restic";
     rev = "v${version}";
-    sha256 = "0kl8yk636i3y7f2kd43pydjh4pv7hhq09p5k54jlysnrbf2kjb4h";
+    sha256 = "15lx01w46bwn3hjwpmm8xy71m7ml9wdwddbbfvmk5in61gv1acr5";
   };
 
   buildPhase = ''
diff --git a/pkgs/tools/filesystems/bcachefs-tools/default.nix b/pkgs/tools/filesystems/bcachefs-tools/default.nix
index eefc0beb1fc..fc55352fa12 100644
--- a/pkgs/tools/filesystems/bcachefs-tools/default.nix
+++ b/pkgs/tools/filesystems/bcachefs-tools/default.nix
@@ -3,12 +3,12 @@
 
 stdenv.mkDerivation rec {
   pname = "bcachefs-tools";
-  version = "2019-01-23";
+  version = "2019-02-09";
 
   src = fetchgit {
     url = "https://evilpiepirate.org/git/bcachefs-tools.git";
-    rev = "35fca2f044d375b1590f499cfd34bef38ca0f8f1";
-    sha256 = "1mmpwksszdi4n7zv3fm7qnmfk94m56d65lfw30553bnfm3yaz3k7";
+    rev = "17c5215c1c542dd7b6b4f891a0da16d8c98e0591";
+    sha256 = "1zm2lnvijfmz483m2nhxz1rhk7ghgh0c450nyiwi6wa7lc1y3339";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/tools/filesystems/fuse-overlayfs/default.nix b/pkgs/tools/filesystems/fuse-overlayfs/default.nix
index 515fdd4e260..c4d52462906 100644
--- a/pkgs/tools/filesystems/fuse-overlayfs/default.nix
+++ b/pkgs/tools/filesystems/fuse-overlayfs/default.nix
@@ -1,27 +1,25 @@
-{ pkgs, lib, autoreconfHook, pkgconfig, fuse3 }:
+{ stdenv, lib, fetchFromGitHub, autoreconfHook, pkgconfig, fuse3 }:
 
-let
-  version = "0.2";
-in
-  pkgs.stdenv.mkDerivation {
-    name = "fuse-overlayfs-${version}";
+stdenv.mkDerivation rec {
+  name = "fuse-overlayfs-${version}";
+  version = "0.3";
 
-    src = pkgs.fetchFromGitHub {
-      owner = "containers";
-      repo = "fuse-overlayfs";
-      rev = "1e2b65baa2f75eea0e4bab90b5ac81dd8471256c";
-      sha256 = "0a9ix8rqjs5r28jsriyiv4yq7iilmv69x05kf23s1ihzrvrfkl08";
-    };
+  src = fetchFromGitHub {
+    owner = "containers";
+    repo = "fuse-overlayfs";
+    rev = "v${version}";
+    sha256 = "1cch2j397hydrhh62faqa663vas75qbmylqd06fk6nafasa3ri0l";
+  };
 
-    nativeBuildInputs = [ autoreconfHook pkgconfig ];
-    buildInputs = [ fuse3 ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ fuse3 ];
 
-    meta = with lib; {
-      homepage = https://github.com/containers/fuse-overlayfs;
-      description = "FUSE implementation for overlayfs";
-      longDescription = "An implementation of overlay+shiftfs in FUSE for rootless containers.";
-      license = licenses.gpl3;
-      platforms = platforms.unix;
-      maintainers = [ maintainers.ma9e ];
-    };
-  }
+  meta = with lib; {
+    homepage = https://github.com/containers/fuse-overlayfs;
+    description = "FUSE implementation for overlayfs";
+    longDescription = "An implementation of overlay+shiftfs in FUSE for rootless containers.";
+    license = licenses.gpl3;
+    platforms = platforms.unix;
+    maintainers = [ maintainers.ma9e ];
+  };
+}
diff --git a/pkgs/tools/graphics/wkhtmltopdf/default.nix b/pkgs/tools/graphics/wkhtmltopdf/default.nix
index 14ba0f8c2a9..237c9bb398b 100644
--- a/pkgs/tools/graphics/wkhtmltopdf/default.nix
+++ b/pkgs/tools/graphics/wkhtmltopdf/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     fontconfig freetype libpng zlib libjpeg openssl
     libX11 libXext libXrender
-    qt5.qtwebkit qt5.qtsvg
+    qt5.qtwebkit qt5.qtsvg qt5.qtxmlpatterns
   ];
 
   prePatch = ''
diff --git a/pkgs/tools/misc/bbe/default.nix b/pkgs/tools/misc/bbe/default.nix
new file mode 100644
index 00000000000..ecff2459ef2
--- /dev/null
+++ b/pkgs/tools/misc/bbe/default.nix
@@ -0,0 +1,22 @@
+{ stdenv , fetchurl, autoreconfHook }:
+stdenv.mkDerivation rec {
+  name = "bbe-${version}";
+  version = "0.2.2";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/bbe-/${version}/bbe-${version}.tar.gz";
+    sha256 = "1nyxdqi4425sffjrylh7gl57lrssyk4018afb7mvrnd6fmbszbms";
+  };
+
+  nativeBuildInputs = [ autoreconfHook ];
+
+  outputs = [ "out" "doc" ];
+
+  meta = with stdenv.lib; {
+    description = "A sed-like editor for binary files";
+    homepage = "http://bbe-.sourceforge.net/";
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.hhm ];
+  };
+}
diff --git a/pkgs/tools/misc/brltty/default.nix b/pkgs/tools/misc/brltty/default.nix
index 6635f293195..99ba8e5e515 100644
--- a/pkgs/tools/misc/brltty/default.nix
+++ b/pkgs/tools/misc/brltty/default.nix
@@ -1,4 +1,6 @@
-{ stdenv, fetchurl, pkgconfig, python3, alsaSupport, alsaLib ? null, bluez, systemdSupport, systemd ? null }:
+{ stdenv, fetchurl, pkgconfig, python3, bluez
+, alsaSupport ? stdenv.isLinux, alsaLib ? null
+, systemdSupport ? stdenv.isLinux, systemd ? null }:
 
 assert alsaSupport -> alsaLib != null;
 assert systemdSupport -> systemd != null;
diff --git a/pkgs/tools/misc/broot/default.nix b/pkgs/tools/misc/broot/default.nix
new file mode 100644
index 00000000000..d09f313e147
--- /dev/null
+++ b/pkgs/tools/misc/broot/default.nix
@@ -0,0 +1,23 @@
+{ stdenv, rustPlatform, fetchFromGitHub }:
+
+rustPlatform.buildRustPackage rec {
+  name = "broot-${version}";
+  version = "0.6.0";
+
+  src = fetchFromGitHub {
+    owner = "Canop";
+    repo = "broot";
+    rev = "v${version}";
+    sha256 = "192qqlqym8lpskh6f7sf5fanybjwhdqs1cgl6mqm35763fa5jrdj";
+  };
+
+  cargoSha256 = "059iylnkjb7lxxs9v2b6h05nidwgcj6kqyhcq58lalkhb63srb1q";
+
+  meta = with stdenv.lib; {
+    description = "An interactive tree view, a fuzzy search, a balanced BFS descent and customizable commands";
+    homepage = "https://github.com/Canop/broot";
+    maintainers = with maintainers; [ magnetophon ];
+    license = with licenses; [ mit ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/tools/misc/direnv/default.nix b/pkgs/tools/misc/direnv/default.nix
index 2a02b0391ae..de8130ff3f1 100644
--- a/pkgs/tools/misc/direnv/default.nix
+++ b/pkgs/tools/misc/direnv/default.nix
@@ -2,14 +2,14 @@
 
 buildGoPackage rec {
   name = "direnv-${version}";
-  version = "2.19.0";
+  version = "2.19.2";
   goPackagePath = "github.com/direnv/direnv";
 
   src = fetchFromGitHub {
     owner = "direnv";
     repo = "direnv";
     rev = "v${version}";
-    sha256 = "0v5r07b5r0wmmf8wndi0z1fp979pyqg6xpx7w847bkyn4pvgpscm";
+    sha256 = "1iq9wmc63x1c7g1ixdhd6q3w1sx8xl8kf1bprxwq26n9zpd0g13g";
   };
 
   postConfigure = ''
diff --git a/pkgs/tools/misc/fd/default.nix b/pkgs/tools/misc/fd/default.nix
index 75c7897ac84..70bbbea7288 100644
--- a/pkgs/tools/misc/fd/default.nix
+++ b/pkgs/tools/misc/fd/default.nix
@@ -2,25 +2,26 @@
 
 rustPlatform.buildRustPackage rec {
   name = "fd-${version}";
-  version = "7.2.0";
+  version = "7.3.0";
 
   src = fetchFromGitHub {
     owner = "sharkdp";
     repo = "fd";
     rev = "v${version}";
-    sha256 = "1h7ar1m7w3vmakg9rp1nfmz7q5pqwvd8yyxwj335ixb49gph1zi5";
+    sha256 = "0y4657w1pi4x9nmbv551dj00dyiv935m8ph7jlv00chwy3hrb3yi";
   };
 
-  cargoSha256 = "0y6xp7fdjfmjfqf9avbq9bdvzvwkf3v1dv7a4k03w5279vxafzi4";
+  cargoSha256 = "0dfv6nia3v3f3rwbjh2h3zdqd48vw8gwilhq0z4n6xvjzk7qydj5";
 
   preFixup = ''
-    mkdir -p "$out/man/man1"
-    cp "$src/doc/fd.1" "$out/man/man1"
+    install -Dm644 "$src/doc/fd.1" "$out/man/man1/fd.1"
 
-    mkdir -p "$out/share/"{bash-completion/completions,fish/vendor_completions.d,zsh/site-functions}
-    cp target/release/build/fd-find-*/out/fd.bash "$out/share/bash-completion/completions/"
-    cp target/release/build/fd-find-*/out/fd.fish "$out/share/fish/vendor_completions.d/"
-    cp target/release/build/fd-find-*/out/_fd "$out/share/zsh/site-functions/"
+    install -Dm644 target/release/build/fd-find-*/out/fd.bash \
+      "$out/share/bash-completion/completions/fd.bash"
+    install -Dm644 target/release/build/fd-find-*/out/fd.fish \
+      "$out/share/fish/vendor_completions.d/fd.fish"
+    install -Dm644 target/release/build/fd-find-*/out/_fd \
+      "$out/share/zsh/site-functions/_fd"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/slurp/default.nix b/pkgs/tools/misc/slurp/default.nix
index a729ea6381a..8b7f1d38744 100644
--- a/pkgs/tools/misc/slurp/default.nix
+++ b/pkgs/tools/misc/slurp/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "slurp-${version}";
-  version = "1.0";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "emersion";
     repo = "slurp";
     rev = "v${version}";
-    sha256 = "03igv8r8n772xb0y7whhs1pa298l3d94jbnknaxpwp2n4fi04syb";
+    sha256 = "072lkwhpvr753wfqzmd994bnhbrgfavxcgqcyml7abab28sdhs1y";
   };
 
   nativeBuildInputs = [
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   ];
 
   meta = with stdenv.lib; {
-    description = "Grab images from a Wayland compositor";
+    description = "Select a region in a Wayland compositor";
     homepage = https://github.com/emersion/slurp;
     license = licenses.mit;
     platforms = platforms.linux;
diff --git a/pkgs/tools/misc/yubikey-manager-qt/default.nix b/pkgs/tools/misc/yubikey-manager-qt/default.nix
new file mode 100644
index 00000000000..c8521efb28d
--- /dev/null
+++ b/pkgs/tools/misc/yubikey-manager-qt/default.nix
@@ -0,0 +1,78 @@
+{ stdenv
+, fetchurl
+, makeWrapper
+, pcsclite
+, pyotherside
+, pythonPackages
+, python3
+, qmake
+, qtbase
+, qtgraphicaleffects
+, qtquickcontrols
+, qtquickcontrols2
+, qtdeclarative
+, qtsvg
+, yubikey-manager
+, yubikey-personalization
+}:
+
+let
+  qmlPath = qmlLib: "${qmlLib}/${qtbase.qtQmlPrefix}";
+
+  inherit (stdenv) lib;
+
+  qml2ImportPath = lib.concatMapStringsSep ":" qmlPath [
+    qtbase.bin qtdeclarative.bin pyotherside qtquickcontrols qtquickcontrols2.bin qtgraphicaleffects
+  ];
+
+in stdenv.mkDerivation rec {
+  pname = "yubikey-manager-qt";
+  version = "1.1.0";
+
+  src = fetchurl {
+    url = "https://developers.yubico.com/yubikey-manager-qt/Releases/${pname}-${version}.tar.gz";
+    sha256 = "8049a233a8cca07543d745a9f619c0fc3afb324f5d0030b93f037b34ac1c5e66";
+  };
+
+  nativeBuildInputs = [ makeWrapper python3.pkgs.wrapPython qmake ];
+
+  sourceRoot = ".";
+
+  postPatch = ''
+    substituteInPlace ykman-gui/deployment.pri --replace '/usr/bin' "$out/bin"
+  '';
+
+  buildInputs = [ pythonPackages.python qtbase qtgraphicaleffects qtquickcontrols qtquickcontrols2 pyotherside ];
+
+  enableParallelBuilding = true;
+
+  pythonPath = [ yubikey-manager ];
+
+  # Need LD_PRELOAD for libykpers as the Nix cpython disables ctypes.cdll.LoadLibrary
+  # support that the yubicommon library uses to load libykpers
+  postInstall = ''
+    buildPythonPath "$pythonPath"
+
+    wrapProgram $out/bin/ykman-gui \
+      --prefix PYTHONPATH : "$program_PYTHONPATH" \
+      --set QML2_IMPORT_PATH "${qml2ImportPath}" \
+      --set QT_QPA_PLATFORM_PLUGIN_PATH ${qtbase.bin}/lib/qt-*/plugins/platforms \
+      --prefix QT_PLUGIN_PATH : "${qtsvg.bin}/${qtbase.qtPluginPrefix}"
+
+      mkdir -p $out/share/applications
+      cp resources/ykman-gui.desktop $out/share/applications/ykman-gui.desktop
+      mkdir -p $out/share/ykman-gui/icons
+      cp resources/icons/*.{icns,ico,png,xpm} $out/share/ykman-gui/icons
+      substituteInPlace $out/share/applications/ykman-gui.desktop \
+        --replace 'Exec=ykman-gui' "Exec=$out/bin/ykman-gui" \
+  '';
+
+  meta = with lib; {
+    inherit version;
+    description = "Cross-platform application for configuring any YubiKey over all USB interfaces.";
+    homepage = https://developers.yubico.com/yubikey-manager-qt/;
+    license = licenses.bsd2;
+    maintainers = [ maintainers.cbley ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/tools/networking/lldpd/default.nix b/pkgs/tools/networking/lldpd/default.nix
index 193f44a62e2..d4ded1142d8 100644
--- a/pkgs/tools/networking/lldpd/default.nix
+++ b/pkgs/tools/networking/lldpd/default.nix
@@ -1,5 +1,6 @@
 { stdenv, lib, fetchurl, pkgconfig, removeReferencesTo
-, libevent, readline, net_snmp }:
+, libevent, readline, net_snmp, openssl
+}:
 
 stdenv.mkDerivation rec {
   name = "lldpd-${version}";
@@ -18,7 +19,7 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [ pkgconfig removeReferencesTo ];
-  buildInputs = [ libevent readline net_snmp ];
+  buildInputs = [ libevent readline net_snmp openssl ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/tools/networking/network-manager/openvpn/default.nix b/pkgs/tools/networking/network-manager/openvpn/default.nix
index 3fe4db87036..fa764788e2c 100644
--- a/pkgs/tools/networking/network-manager/openvpn/default.nix
+++ b/pkgs/tools/networking/network-manager/openvpn/default.nix
@@ -3,13 +3,13 @@
 
 let
   pname = "NetworkManager-openvpn";
-  version = "1.8.8";
+  version = "1.8.10";
 in stdenv.mkDerivation rec {
   name = "${pname}${if withGnome then "-gnome" else ""}-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "19qdl7x5x7f9mj8vm25mck6gg8ljbixi0dw2rqngwl2nzpcxwg52";
+    sha256 = "1vri49yff4lj13dnzkpq9nx3a4z1bmbrv807r151plj8m1mwhg5g";
   };
 
   patches = [
diff --git a/pkgs/tools/security/mkp224o/default.nix b/pkgs/tools/security/mkp224o/default.nix
new file mode 100644
index 00000000000..b649c57b346
--- /dev/null
+++ b/pkgs/tools/security/mkp224o/default.nix
@@ -0,0 +1,47 @@
+{ stdenv, lib, fetchFromGitHub, autoreconfHook, libsodium }:
+
+stdenv.mkDerivation rec {
+  name = "mkp224o-${version}";
+  version = "1.2.0";
+
+  src = fetchFromGitHub {
+    owner = "cathugger";
+    repo = "mkp224o";
+    rev = "v${version}";
+    sha256 = "1m7r0jfm6na6rk75v1kals3bx2cs6jsfxdgpxdljn39j3qr4mxvd";
+  };
+
+  buildCommand =
+    let
+      # compile few variants with different implementation of crypto
+      # the fastest depends on a particular cpu
+      variants = [
+        { suffix = "ref10";         configureFlags = ["--enable-ref10"]; }
+        { suffix = "donna";         configureFlags = ["--enable-donna"]; }
+      ] ++ lib.optionals (stdenv.isi686 || stdenv.isx86_64) [
+        { suffix = "donna-sse2";    configureFlags = ["--enable-donna-sse2"]; }
+      ] ++ lib.optionals stdenv.isx86_64 [
+        { suffix = "amd64-51-30k";  configureFlags = ["--enable-amd64-51-30k"]; }
+        { suffix = "amd64-64-20k";  configureFlags = ["--enable-amd64-64-24k"]; }
+      ];
+    in
+      lib.concatMapStrings ({suffix, configureFlags}: ''
+        install -D ${
+          stdenv.mkDerivation {
+            name = "mkp224o-${suffix}-${version}";
+            inherit version src configureFlags;
+            nativeBuildInputs = [ autoreconfHook ];
+            buildInputs = [ libsodium ];
+            installPhase = "install -D mkp224o $out";
+          }
+        } $out/bin/mkp224o-${suffix}
+      '') variants;
+
+  meta = with lib; {
+    description = "Vanity address generator for tor onion v3 (ed25519) hidden services";
+    homepage = http://cathug2kyi4ilneggumrenayhuhsvrgn6qv2y47bgeet42iivkpynqad.onion/;
+    license = licenses.cc0;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ volth ];
+  };
+}
diff --git a/pkgs/tools/security/vault/default.nix b/pkgs/tools/security/vault/default.nix
index c21064c708d..35b39196b33 100644
--- a/pkgs/tools/security/vault/default.nix
+++ b/pkgs/tools/security/vault/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "vault-${version}";
-  version = "1.0.2";
+  version = "1.0.3";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "vault";
     rev = "v${version}";
-    sha256 = "1nrqwgxfs6n2bjhjndqvwzn9c62pb5ky9biyh47i0wvbxhdh0hfj";
+    sha256 = "1c5v1m8b6nm28mjwpsgc73n8q475pkzpdvyx46rf3xyrh01rfrnz";
   };
 
   nativeBuildInputs = [ go gox removeReferencesTo ];
diff --git a/pkgs/tools/system/osquery/default.nix b/pkgs/tools/system/osquery/default.nix
index 32c085e2ec5..1e2882e1f1f 100644
--- a/pkgs/tools/system/osquery/default.nix
+++ b/pkgs/tools/system/osquery/default.nix
@@ -4,7 +4,7 @@
 , beecrypt, augeas, libxml2, sleuthkit, yara, lldpd, google-gflags
 , thrift, boost, rocksdb_lite, glog, gbenchmark, snappy
 , openssl, file, doxygen
-, gtest, sqlite, fpm, zstd, rdkafka, rapidjson, fetchgit
+, gtest, sqlite, fpm, zstd, rdkafka, rapidjson, fetchgit, fetchurl
 }:
 
 let
@@ -61,6 +61,16 @@ stdenv.mkDerivation rec {
         sha256 = "1ny3srcsxd6kj59zq1cman5myj8kzw010wbyc6mrpk4kp823r5nx";
       };
     });
+
+    # dpkg 1.19.2 dropped api in `<dpkg/dpkg-db.h>` which breaks compilation.
+    dpkg' = dpkg.overrideAttrs (old: rec {
+      name = "dpkg-${version}";
+      version = "1.19.0.5";
+      src = fetchurl {
+        url = "mirror://debian/pool/main/d/dpkg/dpkg_${version}.tar.xz";
+        sha256 = "1dc5kp3fqy1k66fly6jfxkkg7w6d0jy8szddpfyc2xvzga94d041";
+      };
+    });
   in [
     udev audit
 
@@ -69,7 +79,7 @@ stdenv.mkDerivation rec {
       customMemoryManagement = false;
     })
 
-    lvm2' libgcrypt libarchive libgpgerror libuuid iptables dpkg
+    lvm2' libgcrypt libarchive libgpgerror libuuid iptables dpkg'
     lzma bzip2 rpm beecrypt augeas libxml2 sleuthkit
     yara lldpd gflags' thrift boost
     glog gbenchmark snappy openssl
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3c0b7c8e297..c1e09af79ff 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -413,15 +413,9 @@ in
 
   aefs = callPackage ../tools/filesystems/aefs { };
 
-  aegisub = callPackage ../applications/video/aegisub {
+  aegisub = callPackage ../applications/video/aegisub ({
     wxGTK = wxGTK30;
-    spellcheckSupport = config.aegisub.spellcheckSupport or true;
-    automationSupport = config.aegisub.automationSupport or true;
-    openalSupport     = config.aegisub.openalSupport or false;
-    alsaSupport       = config.aegisub.alsaSupport or true;
-    pulseaudioSupport = config.aegisub.pulseaudioSupport or true;
-    portaudioSupport  = config.aegisub.portaudioSupport or false;
-  };
+  } // (config.aegisub or {}));
 
   aerospike = callPackage ../servers/nosql/aerospike { };
 
@@ -988,12 +982,12 @@ in
 
   brigand = callPackage ../development/libraries/brigand { };
 
-  brltty = callPackage ../tools/misc/brltty {
-    alsaSupport = (!stdenv.isDarwin);
-    systemdSupport = stdenv.isLinux;
-  };
+  brltty = callPackage ../tools/misc/brltty { };
+
   bro = callPackage ../applications/networking/ids/bro { };
 
+  broot = callPackage ../tools/misc/broot { };
+
   bruteforce-luks = callPackage ../tools/security/bruteforce-luks { };
 
   breakpointHook = assert stdenv.isLinux;
@@ -1724,6 +1718,8 @@ in
 
   bats = callPackage ../development/interpreters/bats { };
 
+  bbe = callPackage ../tools/misc/bbe { };
+
   bdsync = callPackage ../tools/backup/bdsync { };
 
   beanstalkd = callPackage ../servers/beanstalkd { };
@@ -4205,6 +4201,8 @@ in
 
   mkcue = callPackage ../tools/cd-dvd/mkcue { };
 
+  mkp224o = callPackage ../tools/security/mkp224o { };
+
   mkpasswd = hiPrio (callPackage ../tools/security/mkpasswd { });
 
   mkrand = callPackage ../tools/security/mkrand { };
@@ -11930,9 +11928,7 @@ in
 
   pangoxsl = callPackage ../development/libraries/pangoxsl { };
 
-  pcaudiolib = callPackage ../development/libraries/pcaudiolib {
-    pulseaudioSupport = config.pulseaudio or true;
-  };
+  pcaudiolib = callPackage ../development/libraries/pcaudiolib { };
 
   pcg_c = callPackage ../development/libraries/pcg-c { };
 
@@ -13088,6 +13084,10 @@ in
 
   yubikey-manager = callPackage ../tools/misc/yubikey-manager { };
 
+  yubikey-manager-qt = libsForQt5.callPackage ../tools/misc/yubikey-manager-qt {
+    pythonPackages = python3Packages;
+  };
+
   yubikey-neo-manager = callPackage ../tools/misc/yubikey-neo-manager { };
 
   yubikey-personalization = callPackage ../tools/misc/yubikey-personalization {
@@ -13977,7 +13977,7 @@ in
   };
 
   rippled = callPackage ../servers/rippled {
-    boost = boost159;
+    boost = boost167;
   };
 
   s6 = skawarePackages.s6;
@@ -14586,6 +14586,7 @@ in
     kernelPatches = [
       kernelPatches.bridge_stp_helper
       kernelPatches.modinst_arg_list_too_long
+      kernelPatches.interpreter-trunc
     ];
   };
 
@@ -16267,7 +16268,6 @@ in
   bombono = callPackage ../applications/video/bombono {};
 
   bomi = libsForQt5.callPackage ../applications/video/bomi {
-    pulseSupport = config.pulseaudio or true;
     ffmpeg = ffmpeg_2;
   };
 
@@ -16356,18 +16356,7 @@ in
 
   bookworm = callPackage ../applications/office/bookworm { };
 
-  chromium = callPackage ../applications/networking/browsers/chromium ({
-    channel = "stable";
-    pulseSupport = config.pulseaudio or true;
-    enablePepperFlash = config.chromium.enablePepperFlash or false;
-    enableWideVine = config.chromium.enableWideVine or false;
-  } // (if stdenv.isAarch64 then {
-          stdenv = gcc8Stdenv;
-        } else {
-          llvmPackages = llvmPackages_7;
-          stdenv = llvmPackages_7.stdenv;
-        })
-   );
+  chromium = callPackage ../applications/networking/browsers/chromium (config.chromium or {});
 
   chronos = callPackage ../applications/networking/cluster/chronos { };
 
@@ -16407,8 +16396,6 @@ in
     inherit (darwin.apple_sdk.frameworks) CoreAudio;
     libjack = libjack2;
     ffmpeg = ffmpeg_2;
-
-    pulseaudioSupport = config.pulseaudio or false;
   };
 
   cmusfm = callPackage ../applications/audio/cmusfm { };
@@ -16517,9 +16504,7 @@ in
 
   ddgr = callPackage ../applications/misc/ddgr { };
 
-  deadbeef = callPackage ../applications/audio/deadbeef {
-    pulseSupport = config.pulseaudio or true;
-  };
+  deadbeef = callPackage ../applications/audio/deadbeef { };
 
   deadbeefPlugins = {
     headerbar-gtk3 = callPackage ../applications/audio/deadbeef/plugins/headerbar-gtk3.nix { };
@@ -18200,9 +18185,7 @@ in
 
   minitube = libsForQt5.callPackage ../applications/video/minitube { };
 
-  mimic = callPackage ../applications/audio/mimic {
-    pulseaudioSupport = config.pulseaudio or false;
-  };
+  mimic = callPackage ../applications/audio/mimic { };
 
   mimms = callPackage ../applications/audio/mimms {};
 
@@ -18334,7 +18317,6 @@ in
   mpc-qt = libsForQt5.callPackage ../applications/video/mpc-qt { };
 
   mplayer = callPackage ../applications/video/mplayer ({
-    pulseSupport = config.pulseaudio or false;
     libdvdnav = libdvdnav_4_2_1;
   } // (config.mplayer or {}));
 
@@ -18924,7 +18906,7 @@ in
   qdirstat = libsForQt5.callPackage ../applications/misc/qdirstat {};
 
   qemu = callPackage ../applications/virtualization/qemu {
-    inherit (darwin.apple_sdk.frameworks) CoreServices Cocoa;
+    inherit (darwin.apple_sdk.frameworks) CoreServices Cocoa Hypervisor;
     inherit (darwin.stubs) rez setfile;
   };
 
@@ -19815,7 +19797,6 @@ in
   virtualbox = callPackage ../applications/virtualization/virtualbox {
     stdenv = stdenv_32bit;
     inherit (gnome2) libIDL;
-    pulseSupport = config.pulseaudio or true;
   };
 
   virtualboxHardened = lowPrio (virtualbox.override {
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 33b9645a8a1..7b4748041cc 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -168,6 +168,10 @@ in {
 
   aioimaplib = callPackage ../development/python-modules/aioimaplib { };
 
+  aiolifx = callPackage ../development/python-modules/aiolifx { };
+
+  aiolifx-effects = callPackage ../development/python-modules/aiolifx-effects { };
+
   aioamqp = callPackage ../development/python-modules/aioamqp { };
 
   ansicolor = callPackage ../development/python-modules/ansicolor { };
@@ -4057,6 +4061,8 @@ in {
 
   scikit-bio = callPackage ../development/python-modules/scikit-bio { };
 
+  scikit-build = callPackage ../development/python-modules/scikit-build { };
+
   scp = callPackage ../development/python-modules/scp {};
 
   seaborn = callPackage ../development/python-modules/seaborn { };