Merge staging-next into master

28 files changed, 115 insertions, 60 deletions

diff --git a/pkgs/tools/admin/awscli/default.nix b/pkgs/tools/admin/awscli/default.nix
index 663dfa40e23..c36b6d2fbd6 100644
--- a/pkgs/tools/admin/awscli/default.nix
+++ b/pkgs/tools/admin/awscli/default.nix
@@ -14,16 +14,23 @@ let
           sha256 = "25df4e10c263fb88b5ace923dd84bf9aa7f5019687b5e55382ffcdb8bede9db5";
         };
       });
+      colorama = super.colorama.overridePythonAttrs (oldAttrs: rec {
+        version = "0.3.9";
+        src = oldAttrs.src.override {
+          inherit version;
+          sha256 = "48eb22f4f8461b1df5734a074b57042430fb06e1d61bd1e11b078c0fe6d7a1f1";
+        };
+      });
     };
   };
 
 in py.pkgs.buildPythonApplication rec {
   pname = "awscli";
-  version = "1.16.90"; # N.B: if you change this, change botocore to a matching version too
+  version = "1.16.106"; # N.B: if you change this, change botocore to a matching version too
 
   src = py.pkgs.fetchPypi {
     inherit pname version;
-    sha256 = "1e2c776ca47ca18ee5ad3d481c0410800b8155342fe73099bc702b17625d7a2d";
+    sha256 = "169810cb895ac8608747e81480aebd2712f654ad2e49e1f1315f34d6052d5e2d";
   };
 
   # No tests included
diff --git a/pkgs/tools/audio/beets/default.nix b/pkgs/tools/audio/beets/default.nix
index c9a369ce4f7..21e748cc79d 100644
--- a/pkgs/tools/audio/beets/default.nix
+++ b/pkgs/tools/audio/beets/default.nix
@@ -141,19 +141,22 @@ in pythonPackages.buildPythonApplication rec {
     ++ optional enableAlternatives  plugins.alternatives
     ++ optional enableCopyArtifacts plugins.copyartifacts;
 
-  buildInputs = with pythonPackages; [
-    beautifulsoup4
+  buildInputs = [
     imagemagick
-    mock
-    nose
-    rarfile
-    responses
   ] ++ (with gst_all_1; [
     gst-plugins-base
     gst-plugins-good
     gst-plugins-ugly
   ]);
 
+  checkInputs = with pythonPackages; [
+    beautifulsoup4
+    mock
+    nose
+    rarfile
+    responses
+  ];
+
   patches = [
     ./replaygain-default-bs1770gain.patch
     ./keyfinder-default-bin.patch
@@ -213,9 +216,7 @@ in pythonPackages.buildPythonApplication rec {
     LOCALE_ARCHIVE=${assert stdenv.isLinux; glibcLocales}/lib/locale/locale-archive \
     BEETS_TEST_SHELL="${testShell}" \
     BASH_COMPLETION_SCRIPT="${completion}" \
-    HOME="$(mktemp -d)" \
-      # Exclude failing test https://github.com/beetbox/beets/issues/2652
-      nosetests -v --exclude=test_single_month_nonmatch_ --exclude=test_asciify_variable --exclude=test_asciify_character_expanding_to_slash
+    HOME="$(mktemp -d)" nosetests -v
 
     runHook postCheck
   '';
diff --git a/pkgs/tools/audio/gvolicon/default.nix b/pkgs/tools/audio/gvolicon/default.nix
index 8fed569f140..f611055a434 100644
--- a/pkgs/tools/audio/gvolicon/default.nix
+++ b/pkgs/tools/audio/gvolicon/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    makeWrapper alsaLib gnome3.gtk gdk_pixbuf gnome3.defaultIconTheme
+    makeWrapper alsaLib gnome3.gtk gdk_pixbuf gnome3.adwaita-icon-theme
     librsvg wrapGAppsHook
   ];
 
diff --git a/pkgs/tools/audio/pasystray/default.nix b/pkgs/tools/audio/pasystray/default.nix
index 41b3b15738d..cb6853c9a44 100644
--- a/pkgs/tools/audio/pasystray/default.nix
+++ b/pkgs/tools/audio/pasystray/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig autoreconfHook wrapGAppsHook ];
   buildInputs = [
-    gnome3.defaultIconTheme
+    gnome3.adwaita-icon-theme
     avahi gtk3 libappindicator-gtk3 libnotify libpulseaudio xlibsWrapper
     gnome3.gsettings-desktop-schemas
   ];
diff --git a/pkgs/tools/backup/borg/default.nix b/pkgs/tools/backup/borg/default.nix
index d30eaf12f91..42e88f8d07a 100644
--- a/pkgs/tools/backup/borg/default.nix
+++ b/pkgs/tools/backup/borg/default.nix
@@ -1,22 +1,36 @@
-{ stdenv, fetchpatch, python3Packages, acl, libb2, lz4, zstd, openssl, openssh }:
+{ stdenv, fetchpatch, python3, acl, libb2, lz4, zstd, openssl, openssh }:
 
-python3Packages.buildPythonApplication rec {
+let
+  python = python3.override {
+    packageOverrides = self: super: {
+      # https://github.com/borgbackup/borg/issues/3753#issuecomment-454011810
+      msgpack-python = super.msgpack-python.overridePythonAttrs (oldAttrs: rec {
+        version = "0.5.6";
+        src = oldAttrs.src.override {
+          inherit version;
+          sha256 = "0ee8c8c85aa651be3aa0cd005b5931769eaa658c948ce79428766f1bd46ae2c3";
+        };
+      });
+    };
+  };
+
+in python.pkgs.buildPythonApplication rec {
   pname = "borgbackup";
   version = "1.1.9";
 
-  src = python3Packages.fetchPypi {
+  src = python.pkgs.fetchPypi {
     inherit pname version;
     sha256 = "7d0ff84e64c4be35c43ae2c047bb521a94f15b278c2fe63b43950c4836b42575";
   };
 
-  nativeBuildInputs = with python3Packages; [
+  nativeBuildInputs = with python.pkgs; [
     # For building documentation:
     sphinx guzzle_sphinx_theme
   ];
   buildInputs = [
-    libb2 lz4 zstd openssl python3Packages.setuptools_scm
+    libb2 lz4 zstd openssl python.pkgs.setuptools_scm
   ] ++ stdenv.lib.optionals stdenv.isLinux [ acl ];
-  propagatedBuildInputs = with python3Packages; [
+  propagatedBuildInputs = with python.pkgs; [
     cython msgpack-python
   ] ++ stdenv.lib.optionals (!stdenv.isDarwin) [ llfuse ];
 
@@ -50,7 +64,7 @@ python3Packages.buildPythonApplication rec {
     cp scripts/shell_completions/zsh/_borg $out/share/zsh/site-functions/
   '';
 
-  checkInputs = with python3Packages; [
+  checkInputs = with python.pkgs; [
     pytest
   ];
 
diff --git a/pkgs/tools/backup/ddar/default.nix b/pkgs/tools/backup/ddar/default.nix
index 3855152880e..de501659b08 100644
--- a/pkgs/tools/backup/ddar/default.nix
+++ b/pkgs/tools/backup/ddar/default.nix
@@ -23,6 +23,7 @@ python2.pkgs.buildPythonApplication rec {
     make -f Makefile.prep synctus/ddar_pb2.py
   '';
 
+  nativeBuildInputs = with python2.pkgs; [ protobuf.protobuf ];
   propagatedBuildInputs = with python2.pkgs; [ protobuf ];
 
   checkInputs = [ roundup ];
diff --git a/pkgs/tools/compression/xar/default.nix b/pkgs/tools/compression/xar/default.nix
index 69d4284b795..3421045fe4c 100644
--- a/pkgs/tools/compression/xar/default.nix
+++ b/pkgs/tools/compression/xar/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, libxml2, openssl, zlib, bzip2, fts }:
+{ stdenv, fetchurl, libxml2, lzma, openssl, zlib, bzip2, fts }:
 
 stdenv.mkDerivation rec {
   version = "1.6.1";
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "0ghmsbs6xwg1092v7pjcibmk5wkyifwxw6ygp08gfz25d2chhipf";
   };
 
-  buildInputs = [ libxml2 openssl zlib bzip2 fts ];
+  buildInputs = [ libxml2 lzma openssl zlib bzip2 fts ];
 
   meta = {
     homepage    = https://mackyle.github.io/xar/;
diff --git a/pkgs/tools/graphics/luxcorerender/default.nix b/pkgs/tools/graphics/luxcorerender/default.nix
index 85713a300ec..3115b1b7243 100644
--- a/pkgs/tools/graphics/luxcorerender/default.nix
+++ b/pkgs/tools/graphics/luxcorerender/default.nix
@@ -33,7 +33,7 @@ in stdenv.mkDerivation rec {
      # needed for GSETTINGS_SCHEMAS_PATH
      gsettings-desktop-schemas glib gnome3.gtk
      # needed for XDG_ICON_DIRS
-     gnome3.defaultIconTheme
+     gnome3.adwaita-icon-theme
      makeWrapper
      (stdenv.lib.getLib gnome3.dconf)
    ] ++ stdenv.lib.optionals withOpenCL [opencl-headers ocl-icd opencl-clhpp];
@@ -65,7 +65,7 @@ in stdenv.mkDerivation rec {
   preFixup = ''
     wrapProgram "$out/bin/luxcoreui" \
       --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH" \
-      --suffix XDG_DATA_DIRS : '${gnome3.defaultIconTheme}/share' \
+      --suffix XDG_DATA_DIRS : '${gnome3.adwaita-icon-theme}/share' \
       --prefix GIO_EXTRA_MODULES : "${stdenv.lib.getLib gnome3.dconf}/lib/gio/modules"
   '';
 
diff --git a/pkgs/tools/inputmethods/fcitx/fcitx-configtool.nix b/pkgs/tools/inputmethods/fcitx/fcitx-configtool.nix
index 7943903d6f7..e10ffae4a51 100644
--- a/pkgs/tools/inputmethods/fcitx/fcitx-configtool.nix
+++ b/pkgs/tools/inputmethods/fcitx/fcitx-configtool.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ makeWrapper fcitx cmake isocodes gtk3
-    gnome3.defaultIconTheme ];
+    gnome3.adwaita-icon-theme ];
 
   preFixup = ''
     wrapProgram $out/bin/fcitx-config-gtk3 \
diff --git a/pkgs/tools/misc/papis/default.nix b/pkgs/tools/misc/papis/default.nix
index f1589fc8c3b..c3a0164d7b6 100644
--- a/pkgs/tools/misc/papis/default.nix
+++ b/pkgs/tools/misc/papis/default.nix
@@ -14,6 +14,19 @@ python3.pkgs.buildPythonApplication rec {
     sha256 = "0sa4hpgjvqkjcmp9bjr27b5m5jg4pfspdc8nf1ny80sr0kzn72hb";
   };
 
+  patches = [
+    # Update click version to 7.0.0
+    (fetchpatch {
+      url = https://github.com/papis/papis/commit/fddb80978a37a229300b604c26e992e2dc90913f.patch;
+      sha256 = "0cmagfdaaml1pxhnxggifpb47z5g1p231qywnvnqpd3dm93382w1";
+    })
+    # Allow python-slugify >= 2.0.0
+    (fetchpatch {
+      url = https://github.com/papis/papis/commit/b023ca0e551a29c0c15f73fa071addd3e61fa36d.patch;
+      sha256 = "0ybfzr5v1zg9m201jq4hyc6imqd8l4mx9azgjjxkgxcwd3ib1ymq";
+    })
+  ];
+
   propagatedBuildInputs = with python3.pkgs; [
     requests filetype pyparsing configparser arxiv2bib
     pyyaml chardet beautifulsoup4 colorama bibtexparser
diff --git a/pkgs/tools/misc/vdirsyncer/default.nix b/pkgs/tools/misc/vdirsyncer/default.nix
index f538fcbe4ec..37441f85e1a 100644
--- a/pkgs/tools/misc/vdirsyncer/default.nix
+++ b/pkgs/tools/misc/vdirsyncer/default.nix
@@ -49,6 +49,12 @@ python3Packages.buildPythonApplication rec {
   ];
 
   postPatch = ''
+    # Invalid argument: 'perform_health_check' is not a valid setting
+    substituteInPlace tests/conftest.py \
+      --replace "perform_health_check=False" ""
+    substituteInPlace tests/unit/test_repair.py \
+      --replace $'@settings(perform_health_check=False)  # Using the random module for UIDs\n' ""
+
     # for setuptools_scm:
     echo 'Version: ${version}' >PKG-INFO
 
diff --git a/pkgs/tools/networking/dhcpcd/default.nix b/pkgs/tools/networking/dhcpcd/default.nix
index b9aa7156e86..04652ea868d 100644
--- a/pkgs/tools/networking/dhcpcd/default.nix
+++ b/pkgs/tools/networking/dhcpcd/default.nix
@@ -3,11 +3,11 @@
 stdenv.mkDerivation rec {
   # when updating this to >=7, check, see previous reverts:
   # nix-build -A nixos.tests.networking.scripted.macvlan.x86_64-linux nixos/release-combined.nix
-  name = "dhcpcd-7.0.8";
+  name = "dhcpcd-7.1.1";
 
   src = fetchurl {
     url = "mirror://roy/dhcpcd/${name}.tar.xz";
-    sha256 = "1df95lv3cbs3dk718a2vyvzmv7qhpgcxzagb27ylmav96f48x5ln";
+    sha256 = "0h94g5nl9bg3x3qaajqaz6izl6mlvyjgp93nifnlfb7r7n3j8yd2";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/tools/networking/gupnp-tools/default.nix b/pkgs/tools/networking/gupnp-tools/default.nix
index cef5c5538a7..80ea61249c6 100644
--- a/pkgs/tools/networking/gupnp-tools/default.nix
+++ b/pkgs/tools/networking/gupnp-tools/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [ meson ninja pkgconfig gettext wrapGAppsHook ];
-  buildInputs = [ gupnp libuuid gssdp gtk3 gupnp-av gtksourceview4 gnome3.defaultIconTheme ];
+  buildInputs = [ gupnp libuuid gssdp gtk3 gupnp-av gtksourceview4 gnome3.adwaita-icon-theme ];
 
   passthru = {
     updateScript = gnome3.updateScript {
diff --git a/pkgs/tools/networking/linkchecker/default.nix b/pkgs/tools/networking/linkchecker/default.nix
index 6e41de8999b..6e13d7fb94c 100644
--- a/pkgs/tools/networking/linkchecker/default.nix
+++ b/pkgs/tools/networking/linkchecker/default.nix
@@ -18,6 +18,7 @@ python2Packages.buildPythonApplication rec {
   pname = "LinkChecker";
   version = "9.3.1";
 
+  nativeBuildInputs = [ gettext ];
   propagatedBuildInputs = (with python2Packages; [ 
     requests
   ]) ++ [ gettext ];
diff --git a/pkgs/tools/networking/network-manager/applet.nix b/pkgs/tools/networking/network-manager/applet.nix
index 4538728295b..81dc7558d79 100644
--- a/pkgs/tools/networking/network-manager/applet.nix
+++ b/pkgs/tools/networking/network-manager/applet.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, meson, ninja, intltool, gtk-doc, pkgconfig, networkmanager, gnome3
 , libnotify, libsecret, polkit, isocodes, modemmanager, libxml2, docbook_xsl, docbook_xml_dtd_43
 , mobile-broadband-provider-info, glib-networking, gsettings-desktop-schemas
-, libgudev, jansson, wrapGAppsHook, gobject-introspection, python3
+, libgudev, jansson, wrapGAppsHook, gobject-introspection, python3, gtk3
 , libappindicator-gtk3, withGnome ? false, gcr }:
 
 let
@@ -25,10 +25,10 @@ in stdenv.mkDerivation rec {
   outputs = [ "out" "lib" "dev" "devdoc" "man" ];
 
   buildInputs = [
-    gnome3.gtk networkmanager libnotify libsecret gsettings-desktop-schemas
+    gtk3 networkmanager libnotify libsecret gsettings-desktop-schemas
     polkit isocodes mobile-broadband-provider-info libgudev
     modemmanager jansson glib-networking
-    libappindicator-gtk3 gnome3.defaultIconTheme
+    libappindicator-gtk3 gnome3.adwaita-icon-theme
   ] ++ stdenv.lib.optionals withGnome [ gcr ]; # advanced certificate chooser
 
   nativeBuildInputs = [ meson ninja intltool pkgconfig wrapGAppsHook gobject-introspection python3 gtk-doc docbook_xsl docbook_xml_dtd_43 libxml2 ];
diff --git a/pkgs/tools/networking/network-manager/fortisslvpn/default.nix b/pkgs/tools/networking/network-manager/fortisslvpn/default.nix
index facf1b6a667..1fcbce28cc4 100644
--- a/pkgs/tools/networking/network-manager/fortisslvpn/default.nix
+++ b/pkgs/tools/networking/network-manager/fortisslvpn/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, substituteAll, openfortivpn, intltool, pkgconfig,
+{ stdenv, fetchurl, substituteAll, openfortivpn, intltool, pkgconfig, gtk3,
 networkmanager, ppp, libsecret, withGnome ? true, gnome3 }:
 
 let
@@ -20,7 +20,7 @@ in stdenv.mkDerivation rec {
   ];
 
   buildInputs = [ openfortivpn networkmanager ppp ]
-    ++ stdenv.lib.optionals withGnome [ gnome3.gtk libsecret gnome3.networkmanagerapplet ];
+    ++ stdenv.lib.optionals withGnome [ gtk3 libsecret gnome3.networkmanagerapplet ];
 
   nativeBuildInputs = [ intltool pkgconfig ];
 
diff --git a/pkgs/tools/networking/network-manager/iodine/default.nix b/pkgs/tools/networking/network-manager/iodine/default.nix
index ad58dc97b0a..d3eb3f79933 100644
--- a/pkgs/tools/networking/network-manager/iodine/default.nix
+++ b/pkgs/tools/networking/network-manager/iodine/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, substituteAll, iodine, intltool, pkgconfig, networkmanager, libsecret
+{ stdenv, fetchurl, substituteAll, iodine, intltool, pkgconfig, networkmanager, libsecret, gtk3
 , withGnome ? true, gnome3 }:
 
 let
@@ -20,7 +20,7 @@ in stdenv.mkDerivation rec {
   ];
 
   buildInputs = [ iodine networkmanager ]
-    ++ stdenv.lib.optionals withGnome [ gnome3.gtk libsecret gnome3.networkmanagerapplet ];
+    ++ stdenv.lib.optionals withGnome [ gtk3 libsecret gnome3.networkmanagerapplet ];
 
   nativeBuildInputs = [ intltool pkgconfig ];
 
diff --git a/pkgs/tools/networking/network-manager/l2tp/default.nix b/pkgs/tools/networking/network-manager/l2tp/default.nix
index b44933f7f5f..5fc591f0a43 100644
--- a/pkgs/tools/networking/network-manager/l2tp/default.nix
+++ b/pkgs/tools/networking/network-manager/l2tp/default.nix
@@ -1,5 +1,5 @@
 { stdenv, substituteAll, fetchFromGitHub, autoreconfHook, libtool, intltool, pkgconfig
-, networkmanager, ppp, xl2tpd, strongswan, libsecret
+, gtk3, networkmanager, ppp, xl2tpd, strongswan, libsecret
 , withGnome ? true, gnome3, networkmanagerapplet }:
 
 stdenv.mkDerivation rec {
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [ networkmanager ppp ]
-    ++ stdenv.lib.optionals withGnome [ gnome3.gtk libsecret networkmanagerapplet ];
+    ++ stdenv.lib.optionals withGnome [ gtk3 libsecret networkmanagerapplet ];
 
   nativeBuildInputs = [ autoreconfHook libtool intltool pkgconfig ];
 
diff --git a/pkgs/tools/networking/network-manager/openconnect/default.nix b/pkgs/tools/networking/network-manager/openconnect/default.nix
index 0c02569aa27..566179d85b3 100644
--- a/pkgs/tools/networking/network-manager/openconnect/default.nix
+++ b/pkgs/tools/networking/network-manager/openconnect/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, substituteAll, openconnect, intltool, pkgconfig, networkmanager, libsecret
-, withGnome ? true, gnome3, kmod }:
+, gtk3, withGnome ? true, gnome3, kmod }:
 
 let
   pname   = "NetworkManager-openconnect";
@@ -20,7 +20,7 @@ in stdenv.mkDerivation rec {
   ];
 
   buildInputs = [ openconnect networkmanager ]
-    ++ stdenv.lib.optionals withGnome [ gnome3.gtk libsecret ];
+    ++ stdenv.lib.optionals withGnome [ gtk3 libsecret ];
 
   nativeBuildInputs = [ intltool pkgconfig ];
 
diff --git a/pkgs/tools/networking/network-manager/openvpn/default.nix b/pkgs/tools/networking/network-manager/openvpn/default.nix
index afffedac9ee..fa764788e2c 100644
--- a/pkgs/tools/networking/network-manager/openvpn/default.nix
+++ b/pkgs/tools/networking/network-manager/openvpn/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, substituteAll, openvpn, intltool, libxml2, pkgconfig, file, networkmanager, libsecret
-, withGnome ? true, gnome3, kmod }:
+, gtk3, withGnome ? true, gnome3, kmod }:
 
 let
   pname = "NetworkManager-openvpn";
@@ -20,7 +20,7 @@ in stdenv.mkDerivation rec {
   ];
 
   buildInputs = [ openvpn networkmanager ]
-    ++ stdenv.lib.optionals withGnome [ gnome3.gtk libsecret gnome3.networkmanagerapplet ];
+    ++ stdenv.lib.optionals withGnome [ gtk3 libsecret gnome3.networkmanagerapplet ];
 
   nativeBuildInputs = [ intltool pkgconfig file libxml2 ];
 
diff --git a/pkgs/tools/networking/network-manager/vpnc/default.nix b/pkgs/tools/networking/network-manager/vpnc/default.nix
index 5d77be86dff..3231c276be5 100644
--- a/pkgs/tools/networking/network-manager/vpnc/default.nix
+++ b/pkgs/tools/networking/network-manager/vpnc/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, substituteAll, vpnc, intltool, pkgconfig, networkmanager, libsecret
-, withGnome ? true, gnome3, kmod, file }:
+, gtk3, withGnome ? true, gnome3, kmod, file }:
 let
   pname = "NetworkManager-vpnc";
   version = "1.2.6";
@@ -19,7 +19,7 @@ in stdenv.mkDerivation rec {
   ];
 
   buildInputs = [ vpnc networkmanager ]
-    ++ stdenv.lib.optionals withGnome [ gnome3.gtk libsecret gnome3.networkmanagerapplet ];
+    ++ stdenv.lib.optionals withGnome [ gtk3 libsecret gnome3.networkmanagerapplet ];
 
   nativeBuildInputs = [ intltool pkgconfig file ];
 
diff --git a/pkgs/tools/networking/openconnect/default.nix b/pkgs/tools/networking/openconnect/default.nix
index 132ae3cf0da..b0c4a0199c4 100644
--- a/pkgs/tools/networking/openconnect/default.nix
+++ b/pkgs/tools/networking/openconnect/default.nix
@@ -3,23 +3,18 @@
 assert (openssl != null) == (gnutls == null);
 
 stdenv.mkDerivation rec {
-  name = "openconnect-7.08";
+  pname = "openconnect";
+  version = "8.02";
 
   src = fetchurl {
     urls = [
-      "ftp://ftp.infradead.org/pub/openconnect/${name}.tar.gz"
+      "ftp://ftp.infradead.org/pub/openconnect/${pname}-${version}.tar.gz"
     ];
-    sha256 = "00wacb79l2c45f94gxs63b9z25wlciarasvjrb8jb8566wgyqi0w";
+    sha256 = "04p0vzc1791h68hd9803wsyb64zrwm8qpdqx0szhj9pig71g5a0w";
   };
 
   outputs = [ "out" "dev" ];
 
-  preConfigure = ''
-      export PKG_CONFIG=${pkgconfig}/bin/pkg-config
-      export LIBXML2_CFLAGS="-I ${libxml2.dev}/include/libxml2"
-      export LIBXML2_LIBS="-L${libxml2.out}/lib -lxml2"
-    '';
-
   configureFlags = [
     "--with-vpnc-script=${vpnc}/etc/vpnc/vpnc-script"
     "--disable-nls"
diff --git a/pkgs/tools/networking/unbound/default.nix b/pkgs/tools/networking/unbound/default.nix
index 0c7acaad49f..25e03d80369 100644
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "unbound-${version}";
-  version = "1.8.3";
+  version = "1.9.0";
 
   src = fetchurl {
     url = "https://unbound.net/downloads/${name}.tar.gz";
-    sha256 = "1k6fljr7k721vg2ivn5dfr0hs1kn8p1sm003glgd9ypd261jns9b";
+    sha256 = "05xrb8havr2vgjsdy7n85kgnvk1mg7qwhjp4a8n6pg4jhd5zjnj1";
   };
 
   outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB
diff --git a/pkgs/tools/security/gnupg/22.nix b/pkgs/tools/security/gnupg/22.nix
index ad4eae9578c..254a345839b 100644
--- a/pkgs/tools/security/gnupg/22.nix
+++ b/pkgs/tools/security/gnupg/22.nix
@@ -15,11 +15,11 @@ assert guiSupport -> pinentry != null;
 stdenv.mkDerivation rec {
   name = "gnupg-${version}";
 
-  version = "2.2.12";
+  version = "2.2.13";
 
   src = fetchurl {
     url = "mirror://gnupg/gnupg/${name}.tar.bz2";
-    sha256 = "1jw282iy27j1qygym52aa44zxy7ly4bdadhd628hwr4q9j5hy0yv";
+    sha256 = "1n0igfn9nwdajzkcgdx7apwm9m5rpw0fg6vwskmf1rpranlqgivn";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/tools/security/onioncircuits/default.nix b/pkgs/tools/security/onioncircuits/default.nix
index 81164c1eb77..898bfb599a3 100644
--- a/pkgs/tools/security/onioncircuits/default.nix
+++ b/pkgs/tools/security/onioncircuits/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchgit, pythonPackages, intltool, gtk3, gobject-introspection, defaultIconTheme }:
+{ stdenv, fetchgit, pythonPackages, intltool, gtk3, gobject-introspection, gnome3 }:
 
 pythonPackages.buildPythonApplication rec {
   name = "onioncircuits-${version}";
@@ -10,13 +10,14 @@ pythonPackages.buildPythonApplication rec {
     sha256 = "13mqif9b9iajpkrl9ijspdnvy82kxhprxd5mw3njk68rcn4z2pcm";
   };
 
+  nativeBuildInputs = [ intltool ];
   buildInputs = [ intltool gtk3 gobject-introspection ];
   propagatedBuildInputs =  with pythonPackages; [ stem distutils_extra pygobject3 ];
 
   postFixup = ''
     wrapProgram "$out/bin/onioncircuits" \
       --prefix GI_TYPELIB_PATH : "$GI_TYPELIB_PATH" \
-      --prefix XDG_DATA_DIRS : "$out/share:${defaultIconTheme}/share"
+      --prefix XDG_DATA_DIRS : "$out/share:${gnome3.adwaita-icon-theme}/share"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/security/vulnix/default.nix b/pkgs/tools/security/vulnix/default.nix
index ed55fa26451..1c5466db363 100644
--- a/pkgs/tools/security/vulnix/default.nix
+++ b/pkgs/tools/security/vulnix/default.nix
@@ -9,7 +9,7 @@ pythonPackages.buildPythonApplication rec {
     sha256 = "15c32976sgb5clixngi6z1fk5h02v1kn1a89h8rkbkvyhfnjgg8m";
   };
 
-  buildInputs = [ ronn ];
+  nativeBuildInputs = [ ronn ];
 
   checkInputs = with pythonPackages; [
     freezegun
diff --git a/pkgs/tools/text/groff/default.nix b/pkgs/tools/text/groff/default.nix
index 88d487da9b9..082c61635ba 100644
--- a/pkgs/tools/text/groff/default.nix
+++ b/pkgs/tools/text/groff/default.nix
@@ -18,7 +18,10 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = false;
 
-  patches = [ ./look-for-ar.patch ];
+  patches = [
+    ./look-for-ar.patch
+    ./mdate-determinism.patch
+  ];
 
   postPatch = stdenv.lib.optionalString (psutils != null) ''
     substituteInPlace src/preproc/html/pre-html.cpp \
diff --git a/pkgs/tools/text/groff/mdate-determinism.patch b/pkgs/tools/text/groff/mdate-determinism.patch
new file mode 100644
index 00000000000..1253d113394
--- /dev/null
+++ b/pkgs/tools/text/groff/mdate-determinism.patch
@@ -0,0 +1,13 @@
+diff --git a/Makefile.comm b/Makefile.comm
+index 75efc22..b757000 100644
+--- a/Makefile.comm
++++ b/Makefile.comm
+@@ -155,7 +155,7 @@ extraclean: distclean
+ 	     -e "s|@MAN1EXT@|$(man1ext)|g" \
+ 	     -e "s|@MAN5EXT@|$(man5ext)|g" \
+ 	     -e "s|@MAN7EXT@|$(man7ext)|g" \
+-	     -e "s|@MDATE@|`$(SHELL) $(top_srcdir)/mdate.sh $<`|g" \
++	     -e "s|@MDATE@|`date +'%-d %B %Y' -r $(top_srcdir)/ChangeLog`|g" \
+ 	     -e "s|@OLDFONTDIR@|$(oldfontdir)|g" \
+ 	     -e "s|@PDFDOCDIR@|$(pdfdocdir)|g" \
+ 	     -e "s|@SYSTEMMACRODIR@|$(systemtmacdir)|g" \