summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--nixos/doc/manual/release-notes/rl-2003.xml9
-rw-r--r--nixos/modules/system/boot/systemd.nix2
-rw-r--r--nixos/tests/all-tests.nix1
-rw-r--r--nixos/tests/systemd-nspawn.nix58
-rw-r--r--pkgs/applications/audio/i-score/default.nix2
-rw-r--r--pkgs/applications/audio/mpg123/default.nix4
-rw-r--r--pkgs/applications/audio/mpg321/default.nix10
-rw-r--r--pkgs/applications/editors/vim/common.nix4
-rw-r--r--pkgs/applications/office/zotero/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/git/default.nix6
-rw-r--r--pkgs/applications/video/kodi/default.nix4
-rw-r--r--pkgs/build-support/bintools-wrapper/default.nix13
-rw-r--r--pkgs/build-support/bintools-wrapper/setup-hook.sh3
-rw-r--r--pkgs/build-support/build-dotnet-package/default.nix8
-rw-r--r--pkgs/build-support/cc-wrapper/default.nix4
-rw-r--r--pkgs/build-support/cc-wrapper/setup-hook.sh3
-rw-r--r--pkgs/build-support/emacs/setup-hook.sh6
-rw-r--r--pkgs/build-support/ocaml/default.nix2
-rw-r--r--pkgs/build-support/setup-hooks/audit-tmpdir.sh2
-rw-r--r--pkgs/build-support/setup-hooks/auto-patchelf.sh2
-rw-r--r--pkgs/build-support/setup-hooks/compress-man-pages.sh2
-rw-r--r--pkgs/build-support/setup-hooks/find-xml-catalogs.sh4
-rw-r--r--pkgs/build-support/setup-hooks/move-lib64.sh2
-rw-r--r--pkgs/build-support/setup-hooks/move-sbin.sh2
-rw-r--r--pkgs/build-support/setup-hooks/multiple-outputs.sh6
-rw-r--r--pkgs/build-support/setup-hooks/patch-shebangs.sh2
-rw-r--r--pkgs/build-support/setup-hooks/prune-libtool-files.sh2
-rw-r--r--pkgs/build-support/setup-hooks/strip.sh4
-rw-r--r--pkgs/build-support/setup-hooks/update-autotools-gnu-config-scripts.sh2
-rw-r--r--pkgs/build-support/setup-hooks/wrap-gapps-hook.sh2
-rw-r--r--pkgs/desktops/gnome-3/core/mutter/3.28.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/mutter/default.nix5
-rw-r--r--pkgs/desktops/gnome-3/core/mutter/libglvnd-328.patch63
-rw-r--r--pkgs/desktops/plasma-5/default.nix2
-rw-r--r--pkgs/development/compilers/adoptopenjdk-bin/jdk-darwin-base.nix2
-rw-r--r--pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix2
-rw-r--r--pkgs/development/compilers/graalvm/default.nix2
-rw-r--r--pkgs/development/compilers/graalvm/enterprise-edition.nix2
-rw-r--r--pkgs/development/compilers/llvm/7/libc++/default.nix6
-rw-r--r--pkgs/development/compilers/llvm/7/libc++abi.nix14
-rw-r--r--pkgs/development/compilers/openjdk/11.nix2
-rw-r--r--pkgs/development/compilers/openjdk/8.nix2
-rw-r--r--pkgs/development/compilers/openjdk/darwin/11.nix2
-rw-r--r--pkgs/development/compilers/openjdk/darwin/8.nix2
-rw-r--r--pkgs/development/compilers/openjdk/darwin/default.nix2
-rw-r--r--pkgs/development/compilers/openjdk/default.nix2
-rw-r--r--pkgs/development/compilers/oraclejdk/jdk-linux-base.nix2
-rw-r--r--pkgs/development/compilers/reason/default.nix4
-rw-r--r--pkgs/development/compilers/rust/rustc.nix10
-rw-r--r--pkgs/development/compilers/rust/setup-hook.sh2
-rw-r--r--pkgs/development/compilers/zulu/8.nix2
-rw-r--r--pkgs/development/compilers/zulu/default.nix2
-rw-r--r--pkgs/development/interpreters/guile/setup-hook-2.0.sh8
-rw-r--r--pkgs/development/interpreters/guile/setup-hook-2.2.sh8
-rw-r--r--pkgs/development/interpreters/guile/setup-hook.sh2
-rw-r--r--pkgs/development/interpreters/lua-5/setup-hook.sh2
-rw-r--r--pkgs/development/interpreters/octave/default.nix4
-rw-r--r--pkgs/development/interpreters/perl/default.nix26
-rw-r--r--pkgs/development/interpreters/python/hooks/flit-build-hook.sh2
-rw-r--r--pkgs/development/interpreters/python/hooks/pip-build-hook.sh4
-rw-r--r--pkgs/development/interpreters/python/hooks/pip-install-hook.sh2
-rw-r--r--pkgs/development/interpreters/python/hooks/pytest-check-hook.sh2
-rw-r--r--pkgs/development/interpreters/python/hooks/python-catch-conflicts-hook.sh2
-rw-r--r--pkgs/development/interpreters/python/hooks/python-imports-check-hook.sh2
-rw-r--r--pkgs/development/interpreters/python/hooks/python-remove-bin-bytecode-hook.sh2
-rw-r--r--pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh4
-rw-r--r--pkgs/development/interpreters/python/hooks/setuptools-check-hook.sh2
-rw-r--r--pkgs/development/interpreters/python/hooks/wheel-unpack-hook.sh2
-rw-r--r--pkgs/development/libraries/SDL/setup-hook.sh6
-rw-r--r--pkgs/development/libraries/SDL2/default.nix16
-rw-r--r--pkgs/development/libraries/SDL2/setup-hook.sh2
-rw-r--r--pkgs/development/libraries/clutter/default.nix4
-rw-r--r--pkgs/development/libraries/cogl/default.nix12
-rw-r--r--pkgs/development/libraries/coin3d/default.nix4
-rw-r--r--pkgs/development/libraries/dleyna-core/setup-hook.sh2
-rw-r--r--pkgs/development/libraries/ffmpeg/generic.nix8
-rw-r--r--pkgs/development/libraries/fltk/default.nix4
-rw-r--r--pkgs/development/libraries/ftgl/default.nix4
-rw-r--r--pkgs/development/libraries/gcr/default.nix71
-rw-r--r--pkgs/development/libraries/gdk-pixbuf/setup-hook.sh6
-rw-r--r--pkgs/development/libraries/gettext/CVE-2018-18751-bison.patch323
-rw-r--r--pkgs/development/libraries/gettext/default.nix28
-rw-r--r--pkgs/development/libraries/gettext/gettext-setup-hook.sh2
-rw-r--r--pkgs/development/libraries/gettext/gettext.git-2336451ed68d91ff4b5ae1acbc1eca30e47a86a9.patch82
-rw-r--r--pkgs/development/libraries/gle/default.nix4
-rw-r--r--pkgs/development/libraries/glib/setup-hook.sh8
-rw-r--r--pkgs/development/libraries/gnu-efi/default.nix10
-rw-r--r--pkgs/development/libraries/gstreamer/core/setup-hook.sh2
-rw-r--r--pkgs/development/libraries/gstreamer/legacy/gst-plugins-base/default.nix6
-rw-r--r--pkgs/development/libraries/gstreamer/legacy/gstreamer/setup-hook.sh2
-rw-r--r--pkgs/development/libraries/gtk/hooks/drop-icon-theme-cache.sh2
-rw-r--r--pkgs/development/libraries/icu/base.nix12
-rw-r--r--pkgs/development/libraries/kde-frameworks/default.nix2
-rw-r--r--pkgs/development/libraries/leptonica/default.nix4
-rw-r--r--pkgs/development/libraries/libglvnd/default.nix16
-rw-r--r--pkgs/development/libraries/libiconv/setup-hook.sh2
-rw-r--r--pkgs/development/libraries/libmad/001-mips_removal_h_constraint.patch73
-rw-r--r--pkgs/development/libraries/libmad/default.nix56
-rw-r--r--pkgs/development/libraries/libmad/optimize.diff77
-rw-r--r--pkgs/development/libraries/libmad/pkgconfig.patch117
-rw-r--r--pkgs/development/libraries/libtiff/CVE-2019-14973.patch384
-rw-r--r--pkgs/development/libraries/libtiff/default.nix14
-rw-r--r--pkgs/development/libraries/libtxc_dxtn/default.nix4
-rw-r--r--pkgs/development/libraries/libtxc_dxtn_s2tc/default.nix4
-rw-r--r--pkgs/development/libraries/mesa/default.nix4
-rw-r--r--pkgs/development/libraries/mesa/stubs.nix4
-rw-r--r--pkgs/development/libraries/ncurses/default.nix1
-rw-r--r--pkgs/development/libraries/openscenegraph/default.nix4
-rw-r--r--pkgs/development/libraries/p11-kit/default.nix4
-rw-r--r--pkgs/development/libraries/phonon/default.nix4
-rw-r--r--pkgs/development/libraries/qt-5/5.12/default.nix1
-rw-r--r--pkgs/development/libraries/qt-5/5.12/qtbase.patch.d/0013-define-kiosurfacesuccess.patch16
-rw-r--r--pkgs/development/libraries/qt-5/hooks/qmake-hook.sh4
-rw-r--r--pkgs/development/libraries/qt-5/hooks/qtbase-setup-hook.sh4
-rw-r--r--pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh6
-rw-r--r--pkgs/development/libraries/qt-5/modules/qtbase.nix2
-rw-r--r--pkgs/development/libraries/vtk/default.nix6
-rw-r--r--pkgs/development/libraries/webkitgtk/default.nix6
-rw-r--r--pkgs/development/libraries/webkitgtk/libglvnd-headers.patch586
-rw-r--r--pkgs/development/lisp-modules/clwrapper/setup-hook.sh2
-rw-r--r--pkgs/development/node-packages/node-env.nix2
-rw-r--r--pkgs/development/ocaml-modules/bap/default.nix6
-rw-r--r--pkgs/development/ocaml-modules/ocsigen-server/default.nix2
-rw-r--r--pkgs/development/python-modules/cfn-lint/default.nix2
-rw-r--r--pkgs/development/python-modules/mpi4py/default.nix4
-rw-r--r--pkgs/development/python-modules/mwoauth/default.nix4
-rw-r--r--pkgs/development/python-modules/myfitnesspal/default.nix4
-rw-r--r--pkgs/development/python-modules/mysqlclient/default.nix4
-rw-r--r--pkgs/development/python-modules/nbconvert/default.nix4
-rw-r--r--pkgs/development/python-modules/nbdime/default.nix4
-rw-r--r--pkgs/development/python-modules/notebook/default.nix4
-rw-r--r--pkgs/development/python-modules/numcodecs/default.nix4
-rw-r--r--pkgs/development/python-modules/numpy/default.nix4
-rw-r--r--pkgs/development/python-modules/pandas/2.nix4
-rw-r--r--pkgs/development/python-modules/pandas/default.nix4
-rw-r--r--pkgs/development/python-modules/persistent/default.nix4
-rw-r--r--pkgs/development/python-modules/phonenumbers/default.nix4
-rw-r--r--pkgs/development/python-modules/pipdate/default.nix4
-rw-r--r--pkgs/development/python-modules/plac/default.nix4
-rw-r--r--pkgs/development/python-modules/psutil/default.nix4
-rw-r--r--pkgs/development/python-modules/pyatmo/default.nix4
-rw-r--r--pkgs/development/python-modules/pybase64/default.nix4
-rw-r--r--pkgs/development/python-modules/pybids/default.nix4
-rw-r--r--pkgs/development/python-modules/pybullet/default.nix4
-rw-r--r--pkgs/development/python-modules/pycryptodome/default.nix4
-rw-r--r--pkgs/development/python-modules/pycryptodomex/default.nix4
-rw-r--r--pkgs/development/python-modules/pymupdf/default.nix4
-rw-r--r--pkgs/development/python-modules/pyopencl/default.nix4
-rw-r--r--pkgs/development/python-modules/pyparsing/default.nix4
-rw-r--r--pkgs/development/python-modules/pyrsistent/default.nix4
-rw-r--r--pkgs/development/python-modules/pyside/default.nix4
-rw-r--r--pkgs/development/python-modules/pytest-mypy/default.nix4
-rw-r--r--pkgs/development/python-modules/pytest/default.nix4
-rw-r--r--pkgs/development/python-modules/python-daemon/default.nix4
-rw-r--r--pkgs/development/python-modules/pythonnet/default.nix4
-rw-r--r--pkgs/development/python-modules/reportlab/default.nix4
-rw-r--r--pkgs/development/python-modules/rethinkdb/default.nix4
-rw-r--r--pkgs/development/python-modules/runway-python/default.nix4
-rw-r--r--pkgs/development/python-modules/scipy/default.nix4
-rw-r--r--pkgs/development/python-modules/sentry-sdk/default.nix4
-rw-r--r--pkgs/development/python-modules/soupsieve/default.nix4
-rw-r--r--pkgs/development/python-modules/sqlmap/default.nix4
-rw-r--r--pkgs/development/python-modules/starlette/default.nix4
-rw-r--r--pkgs/development/python-modules/strictyaml/default.nix4
-rw-r--r--pkgs/development/python-modules/tables/3.5.nix4
-rw-r--r--pkgs/development/python-modules/tenacity/default.nix4
-rw-r--r--pkgs/development/python-modules/testfixtures/default.nix4
-rw-r--r--pkgs/development/python-modules/testpath/default.nix4
-rw-r--r--pkgs/development/python-modules/tld/default.nix4
-rw-r--r--pkgs/development/python-modules/trustme/default.nix4
-rw-r--r--pkgs/development/python-modules/typing-extensions/default.nix4
-rw-r--r--pkgs/development/python-modules/unittest-xml-reporting/default.nix4
-rw-r--r--pkgs/development/python-modules/uproot/default.nix4
-rw-r--r--pkgs/development/python-modules/vcrpy/default.nix4
-rw-r--r--pkgs/development/python-modules/whisper/default.nix4
-rw-r--r--pkgs/development/python-modules/wxPython/4.0.nix4
-rw-r--r--pkgs/development/python-modules/zstd/default.nix4
-rw-r--r--pkgs/development/ruby-modules/gem/default.nix2
-rw-r--r--pkgs/development/tools/build-managers/apache-ant/1.9.nix4
-rw-r--r--pkgs/development/tools/build-managers/apache-ant/default.nix4
-rwxr-xr-xpkgs/development/tools/build-managers/cmake/setup-hook.sh24
-rw-r--r--pkgs/development/tools/build-managers/gn/setup-hook.sh2
-rw-r--r--pkgs/development/tools/build-managers/meson/setup-hook.sh4
-rw-r--r--pkgs/development/tools/build-managers/ninja/setup-hook.sh6
-rw-r--r--pkgs/development/tools/build-managers/scons/setup-hook.sh6
-rw-r--r--pkgs/development/tools/misc/patchelf/setup-hook.sh2
-rw-r--r--pkgs/development/tools/misc/premake/setup-hook.sh2
-rw-r--r--pkgs/development/tools/ocaml/camlidl/default.nix2
-rw-r--r--pkgs/development/tools/ocaml/findlib/default.nix6
-rw-r--r--pkgs/development/tools/ocaml/opam/opam-shebangs.patch2
-rw-r--r--pkgs/development/tools/ocaml/utop/default.nix1
-rw-r--r--pkgs/development/tools/xcbuild/setup-hook.sh2
-rw-r--r--pkgs/misc/emulators/retroarch/cores.nix32
-rw-r--r--pkgs/os-specific/darwin/apple-sdk/cf-setup-hook.sh2
-rw-r--r--pkgs/os-specific/darwin/apple-sdk/private-frameworks-setup-hook.sh2
-rw-r--r--pkgs/os-specific/darwin/apple-sdk/security-setup-hook.sh2
-rw-r--r--pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix25
-rw-r--r--pkgs/os-specific/linux/kernel/manual-config.nix2
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix33
-rw-r--r--pkgs/servers/sql/mariadb/connector-c/3_1.nix4
-rw-r--r--pkgs/servers/sql/mariadb/connector-c/default.nix9
-rw-r--r--pkgs/servers/x11/xorg/default.nix2
-rw-r--r--pkgs/servers/x11/xorg/imake-setup-hook.sh2
-rw-r--r--pkgs/servers/x11/xorg/overrides.nix12
-rw-r--r--pkgs/stdenv/cygwin/rebase-i686.sh2
-rw-r--r--pkgs/stdenv/cygwin/rebase-x86_64.sh2
-rw-r--r--pkgs/stdenv/generic/setup.sh91
-rw-r--r--pkgs/tools/archivers/cpio/CVE-2016-2037-out-of-bounds-write.patch29
-rw-r--r--pkgs/tools/archivers/cpio/default.nix20
-rw-r--r--pkgs/tools/archivers/unzip/default.nix15
-rw-r--r--pkgs/tools/graphics/maim/default.nix4
-rw-r--r--pkgs/tools/misc/desktop-file-utils/setup-hook.sh2
-rw-r--r--pkgs/tools/networking/curl/default.nix4
-rw-r--r--pkgs/tools/networking/network-manager/default.nix9
-rw-r--r--pkgs/tools/security/gnupg/22.nix23
-rw-r--r--pkgs/tools/security/sudo/default.nix6
-rw-r--r--pkgs/tools/text/sgml/opensp/setup-hook.sh2
-rw-r--r--pkgs/top-level/all-packages.nix20
218 files changed, 1506 insertions, 1553 deletions
diff --git a/nixos/doc/manual/release-notes/rl-2003.xml b/nixos/doc/manual/release-notes/rl-2003.xml
index 7812f4dee42..c0e7a00d757 100644
--- a/nixos/doc/manual/release-notes/rl-2003.xml
+++ b/nixos/doc/manual/release-notes/rl-2003.xml
@@ -137,10 +137,17 @@
    </listitem>
    <listitem>
     <para>
+      The stdenv now runs all bash with <literal>set -u</literal>, to catch the use of undefined variables.
+      Before, it itself used <literal>set -u</literal> but was careful to unset it so other packages' code ran as before.
+      Now, all bash code is held to the same high standard, and the rather complex stateful manipulation of the options can be discarded.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
      The SLIM Display Manager has been removed, as it has been unmaintained since 2013.
      Consider migrating to a different display manager such as LightDM (current default in NixOS),
      SDDM, GDM, or using the startx module which uses Xinitrc.
-     </para>
+    </para>
    </listitem>
    <listitem>
     <para>
diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index 33b350902a1..9e3c6149f92 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -63,6 +63,7 @@ let
       "systemd-logind.service"
       "autovt@.service"
       "systemd-user-sessions.service"
+      "dbus-org.freedesktop.import1.service"
       "dbus-org.freedesktop.machine1.service"
       "user@.service"
       "user-runtime-dir@.service"
@@ -145,6 +146,7 @@ let
       "user.slice"
       "machine.slice"
       "machines.target"
+      "systemd-importd.service"
       "systemd-machined.service"
       "systemd-nspawn@.service"
 
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index fc1f91c3a0d..a2129ef7076 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -263,6 +263,7 @@ in
   systemd-confinement = handleTest ./systemd-confinement.nix {};
   systemd-timesyncd = handleTest ./systemd-timesyncd.nix {};
   systemd-networkd-wireguard = handleTest ./systemd-networkd-wireguard.nix {};
+  systemd-nspawn = handleTest ./systemd-nspawn.nix {};
   pdns-recursor = handleTest ./pdns-recursor.nix {};
   taskserver = handleTest ./taskserver.nix {};
   telegraf = handleTest ./telegraf.nix {};
diff --git a/nixos/tests/systemd-nspawn.nix b/nixos/tests/systemd-nspawn.nix
new file mode 100644
index 00000000000..c2039bb5980
--- /dev/null
+++ b/nixos/tests/systemd-nspawn.nix
@@ -0,0 +1,58 @@
+import ./make-test.nix ({pkgs, lib, ...}:
+let
+  gpgKeyring = (pkgs.runCommand "gpg-keyring" { buildInputs = [ pkgs.gnupg ]; } ''
+    mkdir -p $out
+    export GNUPGHOME=$out
+    cat > foo <<EOF
+      %echo Generating a basic OpenPGP key
+      %no-protection
+      Key-Type: DSA
+      Key-Length: 1024
+      Subkey-Type: ELG-E
+      Subkey-Length: 1024
+      Name-Real: Joe Tester
+      Name-Email: joe@foo.bar
+      Expire-Date: 0
+      # Do a commit here, so that we can later print "done"
+      %commit
+      %echo done
+    EOF
+    gpg --batch --generate-key foo
+    rm $out/S.gpg-agent $out/S.gpg-agent.*
+    gpg --export joe@foo.bar -a > $out/pubkey.gpg
+  '');
+
+  nspawnImages = (pkgs.runCommand "localhost" { buildInputs = [ pkgs.coreutils pkgs.gnupg ]; } ''
+    mkdir -p $out
+    cd $out
+    dd if=/dev/urandom of=$out/testimage.raw bs=$((1024*1024+7)) count=5
+    sha256sum testimage.raw > SHA256SUMS
+    export GNUPGHOME="$(mktemp -d)"
+    cp -R ${gpgKeyring}/* $GNUPGHOME
+    gpg --batch --sign --detach-sign --output SHA256SUMS.gpg SHA256SUMS
+  '');
+in {
+  name = "opensmtpd";
+
+  nodes = {
+    server = { pkgs, ... }: {
+      networking.firewall.allowedTCPPorts = [ 80 ];
+      services.nginx = {
+        enable = true;
+        virtualHosts."server".root = nspawnImages;
+      };
+    };
+    client = { pkgs, ... }: {
+      environment.etc."systemd/import-pubring.gpg".source = "${gpgKeyring}/pubkey.gpg";
+    };
+  };
+
+  testScript = ''
+    startAll;
+
+    $server->waitForUnit("nginx.service");
+    $client->waitForUnit("network-online.target");
+    $client->succeed("machinectl pull-raw --verify=signature http://server/testimage.raw");
+    $client->succeed("cmp /var/lib/machines/testimage.raw ${nspawnImages}/testimage.raw");
+  '';
+})
diff --git a/pkgs/applications/audio/i-score/default.nix b/pkgs/applications/audio/i-score/default.nix
index 2cc39e64943..f3928499413 100644
--- a/pkgs/applications/audio/i-score/default.nix
+++ b/pkgs/applications/audio/i-score/default.nix
@@ -70,7 +70,7 @@ stdenv.mkDerivation rec {
   ];
 
   preConfigure = ''
-    export CMAKE_PREFIX_PATH="$CMAKE_PREFIX_PATH:$(echo "${jamomacore}/jamoma/share/cmake/Jamoma")"
+    export CMAKE_PREFIX_PATH="''${CMAKE_PREFIX_PATH-}:$(echo "${jamomacore}/jamoma/share/cmake/Jamoma")"
   '';
 
   postInstall = ''rm $out/bin/i-score.sh'';
diff --git a/pkgs/applications/audio/mpg123/default.nix b/pkgs/applications/audio/mpg123/default.nix
index 0d5445650a0..6c4b9a43176 100644
--- a/pkgs/applications/audio/mpg123/default.nix
+++ b/pkgs/applications/audio/mpg123/default.nix
@@ -3,11 +3,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "mpg123-1.25.12";
+  name = "mpg123-1.25.13";
 
   src = fetchurl {
     url = "mirror://sourceforge/mpg123/${name}.tar.bz2";
-    sha256 = "1l9iwwgqzw6yg5zk9pqmlbfyq6d8dqysbmj0j3m8dyrxd34wgzhz";
+    sha256 = "02l915jq0ymndb082g6w89bpf66z04ifa1lr7ga3yycw6m46hc4h";
   };
 
   buildInputs = stdenv.lib.optional (!stdenv.isDarwin) alsaLib;
diff --git a/pkgs/applications/audio/mpg321/default.nix b/pkgs/applications/audio/mpg321/default.nix
index 65dfe3484b6..fdefcf7e77d 100644
--- a/pkgs/applications/audio/mpg321/default.nix
+++ b/pkgs/applications/audio/mpg321/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl, libao, libmad, libid3tag, zlib, alsaLib
+{stdenv, fetchurl, fetchpatch, libao, libmad, libid3tag, zlib, alsaLib
 # Specify default libao output plugin to use (e.g. "alsa", "pulse" …).
 # If null, it will use the libao system default.
 , defaultAudio ? null
@@ -13,6 +13,14 @@ stdenv.mkDerivation rec {
     sha256 = "0ki8mh76bbmdh77qsiw682dvi8y468yhbdabqwg05igmwc1wqvq5";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2018-7263.patch";
+      url = "https://sources.debian.org/data/main/m/mpg321/0.3.2-3/debian/patches/handle_illegal_bitrate_value.patch";
+      sha256 = "15simp5fjvm9b024ryfh441rkh2d5bcrizqkzlrh07n9sm7fkw6x";
+    })
+  ];
+
   hardeningDisable = [ "format" ];
 
   configureFlags =
diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
index 9d22cdbf4a8..0a099ea630d 100644
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "8.1.2188";
+  version = "8.1.2237";
 
   src = fetchFromGitHub {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    sha256 = "0ixq96l991b84sj66v63ds61yr75gx5zz411213yn6bz3s2fvlcv";
+    sha256 = "1qwh3cw5zmjmnk07g0nc8nz8k5nlq9ilvvygnfdjy1fqg69q8p0h";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/office/zotero/default.nix b/pkgs/applications/office/zotero/default.nix
index 334a380d914..34dace1cadb 100644
--- a/pkgs/applications/office/zotero/default.nix
+++ b/pkgs/applications/office/zotero/default.nix
@@ -34,11 +34,11 @@
 
 stdenv.mkDerivation rec {
   pname = "zotero";
-  version = "5.0.73";
+  version = "5.0.77";
 
   src = fetchurl {
     url = "https://download.zotero.org/client/release/${version}/Zotero-${version}_linux-x86_64.tar.bz2";
-    sha256 = "0m2i3l0gy22h6c7rk39cd17vyksyz5l5py2fn9pza8lcbypkwf3l";
+    sha256 = "1dgxzprpb8f5wpmvlvkxix0xxckfgjsi3wfcy9mb221a17cv0029";
   };
 
   buildInputs= [ wrapGAppsHook gsettings-desktop-schemas gtk3 gnome3.adwaita-icon-theme gnome3.dconf ];
diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index 46bbc72fb3b..a6b53561771 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -21,7 +21,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.23.0";
+  version = "2.24.0";
   svn = subversionClient.override { perlBindings = perlSupport; };
 
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
@@ -33,7 +33,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "0rv0y45gcd3h191isppn77acih695v4pipdj031jvs9rd1ds0kr3";
+    sha256 = "06rpakbwzck85ncfsgv4xmq3iwab9d4f5y6dqhl8nvb2fccxcwcz";
   };
 
   outputs = [ "out" ];
@@ -93,7 +93,7 @@ stdenv.mkDerivation {
   ++ (if perlSupport then ["PERL_PATH=${perlPackages.perl}/bin/perl"] else ["NO_PERL=1"])
   ++ (if pythonSupport then ["PYTHON_PATH=${python}/bin/python"] else ["NO_PYTHON=1"])
   ++ stdenv.lib.optionals stdenv.isSunOS ["INSTALL=install" "NO_INET_NTOP=" "NO_INET_PTON="]
-  ++ (if stdenv.isDarwin then ["NO_APPLE_COMMON_CRYPTO=1"] else ["sysconfdir=/etc/"])
+  ++ (if stdenv.isDarwin then ["NO_APPLE_COMMON_CRYPTO=1"] else ["sysconfdir=/etc"])
   ++ stdenv.lib.optionals stdenv.hostPlatform.isMusl ["NO_SYS_POLL_H=1" "NO_GETTEXT=YesPlease"]
   ++ stdenv.lib.optional withpcre2 "USE_LIBPCRE2=1";
 
diff --git a/pkgs/applications/video/kodi/default.nix b/pkgs/applications/video/kodi/default.nix
index 7953cde2413..8edc99c5f02 100644
--- a/pkgs/applications/video/kodi/default.nix
+++ b/pkgs/applications/video/kodi/default.nix
@@ -8,7 +8,7 @@
 , libXt, libXmu, libXext
 , libXinerama, libXrandr
 , libXtst, libXfixes, systemd
-, alsaLib, libGLU_combined, glew, fontconfig, freetype, ftgl
+, alsaLib, libGLU, libGL, glew, fontconfig, freetype, ftgl
 , libjpeg, jasper, libpng, libtiff
 , libmpeg2, libsamplerate, libmad
 , libogg, libvorbis, flac, libxslt
@@ -156,7 +156,7 @@ in stdenv.mkDerivation {
       openssl gperf tinyxml2 taglib libssh swig jre
       libX11 xorgproto libXt libXmu libXext
       libXinerama libXrandr libXtst libXfixes
-      alsaLib libGLU_combined glew fontconfig freetype ftgl
+      alsaLib libGL libGLU glew fontconfig freetype ftgl
       libjpeg jasper libpng libtiff
       libmpeg2 libsamplerate libmad
       libogg libvorbis flac libxslt systemd
diff --git a/pkgs/build-support/bintools-wrapper/default.nix b/pkgs/build-support/bintools-wrapper/default.nix
index e02e77de45e..4a56f00db49 100644
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@@ -111,17 +111,13 @@ stdenv.mkDerivation {
 
   installPhase =
     ''
-      set -u
-
       mkdir -p $out/bin $out/nix-support
 
       wrap() {
         local dst="$1"
         local wrapper="$2"
         export prog="$3"
-        set +u
         substituteAll "$wrapper" "$out/bin/$dst"
-        set -u
         chmod +x "$out/bin/$dst"
       }
     ''
@@ -163,8 +159,6 @@ stdenv.mkDerivation {
         [[ -e "$underlying" ]] || continue
         wrap ${targetPrefix}$variant ${./ld-wrapper.sh} $underlying
       done
-
-      set +u
     '';
 
   emulation = let
@@ -205,11 +199,7 @@ stdenv.mkDerivation {
   ];
 
   postFixup =
-    ''
-      set -u
-    ''
-
-    + optionalString (libc != null) (''
+    optionalString (libc != null) (''
       ##
       ## General libc support
       ##
@@ -307,7 +297,6 @@ stdenv.mkDerivation {
     ''
 
     + ''
-      set +u
       substituteAll ${./add-flags.sh} $out/nix-support/add-flags.sh
       substituteAll ${./add-hardening.sh} $out/nix-support/add-hardening.sh
       substituteAll ${../wrapper-common/utils.bash} $out/nix-support/utils.bash
diff --git a/pkgs/build-support/bintools-wrapper/setup-hook.sh b/pkgs/build-support/bintools-wrapper/setup-hook.sh
index 2e15fa95c79..a714bd151c9 100644
--- a/pkgs/build-support/bintools-wrapper/setup-hook.sh
+++ b/pkgs/build-support/bintools-wrapper/setup-hook.sh
@@ -2,8 +2,6 @@
 #
 # See comments in cc-wrapper's setup hook. This works exactly the same way.
 
-set -u
-
 # Skip setup hook if we're neither a build-time dep, nor, temporarily, doing a
 # native compile.
 #
@@ -73,4 +71,3 @@ export NIX_HARDENING_ENABLE
 
 # No local scope in sourced file
 unset -v role_pre role_post cmd upper_case
-set +u
diff --git a/pkgs/build-support/build-dotnet-package/default.nix b/pkgs/build-support/build-dotnet-package/default.nix
index f36c69e4339..dae9ed888c7 100644
--- a/pkgs/build-support/build-dotnet-package/default.nix
+++ b/pkgs/build-support/build-dotnet-package/default.nix
@@ -29,9 +29,9 @@ attrsOrig @
       configurePhase = ''
         runHook preConfigure
 
-        [ -z "$dontPlacateNuget" ] && placate-nuget.sh
-        [ -z "$dontPlacatePaket" ] && placate-paket.sh
-        [ -z "$dontPatchFSharpTargets" ] && patch-fsharp-targets.sh
+        [ -z "''${dontPlacateNuget-}" ] && placate-nuget.sh
+        [ -z "''${dontPlacatePaket-}" ] && placate-paket.sh
+        [ -z "''${dontPatchFSharpTargets-}" ] && patch-fsharp-targets.sh
 
         runHook postConfigure
       '';
@@ -69,7 +69,7 @@ attrsOrig @
 
         cp -rv ${arrayToShell outputFiles} "''${outputFilesArray[@]}" "$target"
 
-        if [ -z "$dontRemoveDuplicatedDlls" ]
+        if [ -z "''${dontRemoveDuplicatedDlls-}" ]
         then
           pushd "$out"
           remove-duplicated-dlls.sh
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index cf2d38cd997..d6037552ef6 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -134,8 +134,6 @@ stdenv.mkDerivation {
 
   installPhase =
     ''
-      set -u
-
       mkdir -p $out/bin $out/nix-support
 
       wrap() {
@@ -224,8 +222,6 @@ stdenv.mkDerivation {
 
   postFixup =
     ''
-      set -u
-
       # Backwards compatability for packages expecting this file, e.g. with
       # `$NIX_CC/nix-support/dynamic-linker`.
       #
diff --git a/pkgs/build-support/cc-wrapper/setup-hook.sh b/pkgs/build-support/cc-wrapper/setup-hook.sh
index 211b5063291..5b13f268309 100644
--- a/pkgs/build-support/cc-wrapper/setup-hook.sh
+++ b/pkgs/build-support/cc-wrapper/setup-hook.sh
@@ -54,8 +54,6 @@
 # For more details, read the individual files where the mechanisms used to
 # accomplish this will be individually documented.
 
-set -u
-
 # Skip setup hook if we're neither a build-time dep, nor, temporarily, doing a
 # native compile.
 #
@@ -120,4 +118,3 @@ export NIX_HARDENING_ENABLE
 
 # No local scope in sourced file
 unset -v role_pre role_post
-set +u
diff --git a/pkgs/build-support/emacs/setup-hook.sh b/pkgs/build-support/emacs/setup-hook.sh
index e1db3e828fd..b55c1873802 100644
--- a/pkgs/build-support/emacs/setup-hook.sh
+++ b/pkgs/build-support/emacs/setup-hook.sh
@@ -1,11 +1,11 @@
 addEmacsVars () {
-  if test -d $1/share/emacs/site-lisp; then
-      export EMACSLOADPATH="$1/share/emacs/site-lisp:$EMACSLOADPATH"
+  if [[ -d "$1/share/emacs/site-lisp" ]]; then
+      export EMACSLOADPATH="$1/share/emacs/site-lisp${EMACSLOADPATH:+:}${EMACSLOADPATH-}"
   fi
 }
 
 # If this is for a wrapper derivation, emacs and the dependencies are all
 # run-time dependencies. If this is for precompiling packages into bytecode,
 # emacs is a compile-time dependency of the package.
-addEnvHooks "$targetOffset" addEmacsVars
+addEnvHooks "$hostOffset" addEmacsVars
 addEnvHooks "$targetOffset" addEmacsVars
diff --git a/pkgs/build-support/ocaml/default.nix b/pkgs/build-support/ocaml/default.nix
index cc2001c66e2..3957b955a2c 100644
--- a/pkgs/build-support/ocaml/default.nix
+++ b/pkgs/build-support/ocaml/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation (args // {
 
   setupHook = if setupHook == null && hasSharedObjects
   then writeText "setupHook.sh" ''
-    export CAML_LD_LIBRARY_PATH="''${CAML_LD_LIBRARY_PATH}''${CAML_LD_LIBRARY_PATH:+:}''$1/lib/ocaml/${ocaml.version}/site-lib/${name}/"
+    export CAML_LD_LIBRARY_PATH="''${CAML_LD_LIBRARY_PATH-}''${CAML_LD_LIBRARY_PATH:+:}''$1/lib/ocaml/${ocaml.version}/site-lib/${name}/"
     ''
   else setupHook;
 
diff --git a/pkgs/build-support/setup-hooks/audit-tmpdir.sh b/pkgs/build-support/setup-hooks/audit-tmpdir.sh
index 5264ce39851..c9dd32d1dd2 100644
--- a/pkgs/build-support/setup-hooks/audit-tmpdir.sh
+++ b/pkgs/build-support/setup-hooks/audit-tmpdir.sh
@@ -7,7 +7,7 @@
 # the moment that would produce too many spurious errors (e.g. debug
 # info or assertion messages that refer to $TMPDIR).
 
-fixupOutputHooks+=('if [ -z "$noAuditTmpdir" -a -e "$prefix" ]; then auditTmpdir "$prefix"; fi')
+fixupOutputHooks+=('if [[ -z "${noAuditTmpdir-}" && -e "$prefix" ]]; then auditTmpdir "$prefix"; fi')
 
 auditTmpdir() {
     local dir="$1"
diff --git a/pkgs/build-support/setup-hooks/auto-patchelf.sh b/pkgs/build-support/setup-hooks/auto-patchelf.sh
index 6af8eb1aed9..52c50091d08 100644
--- a/pkgs/build-support/setup-hooks/auto-patchelf.sh
+++ b/pkgs/build-support/setup-hooks/auto-patchelf.sh
@@ -228,7 +228,7 @@ autoPatchelf() {
 # behaviour as fixupOutputHooks because the setup hook for patchelf is run in
 # fixupOutput and the postFixup hook runs later.
 postFixupHooks+=('
-    if [ -z "$dontAutoPatchelf" ]; then
+    if [ -z "${dontAutoPatchelf-}" ]; then
         autoPatchelf -- $(for output in $outputs; do
             [ -e "${!output}" ] || continue
             echo "${!output}"
diff --git a/pkgs/build-support/setup-hooks/compress-man-pages.sh b/pkgs/build-support/setup-hooks/compress-man-pages.sh
index d10a898d6e4..82e48cd8aa7 100644
--- a/pkgs/build-support/setup-hooks/compress-man-pages.sh
+++ b/pkgs/build-support/setup-hooks/compress-man-pages.sh
@@ -1,4 +1,4 @@
-fixupOutputHooks+=('if [ -z "$dontGzipMan" ]; then compressManPages "$prefix"; fi')
+fixupOutputHooks+=('if [ -z "${dontGzipMan-}" ]; then compressManPages "$prefix"; fi')
 
 compressManPages() {
     local dir="$1"
diff --git a/pkgs/build-support/setup-hooks/find-xml-catalogs.sh b/pkgs/build-support/setup-hooks/find-xml-catalogs.sh
index 85364a61f61..f446a6f27fd 100644
--- a/pkgs/build-support/setup-hooks/find-xml-catalogs.sh
+++ b/pkgs/build-support/setup-hooks/find-xml-catalogs.sh
@@ -11,12 +11,12 @@ addXMLCatalogs () {
     done
 }
 
-if [ -z "$libxmlHookDone" ]; then
+if [ -z "${libxmlHookDone-}" ]; then
     libxmlHookDone=1
 
     # Set up XML_CATALOG_FILES.  An empty initial value prevents
     # xmllint and xsltproc from looking in /etc/xml/catalog.
-    export XML_CATALOG_FILES
+    export XML_CATALOG_FILES=''
     if [ -z "$XML_CATALOG_FILES" ]; then XML_CATALOG_FILES=" "; fi
     addEnvHooks "$hostOffset" addXMLCatalogs
 fi
diff --git a/pkgs/build-support/setup-hooks/move-lib64.sh b/pkgs/build-support/setup-hooks/move-lib64.sh
index 7724be369c9..9517af79732 100644
--- a/pkgs/build-support/setup-hooks/move-lib64.sh
+++ b/pkgs/build-support/setup-hooks/move-lib64.sh
@@ -8,7 +8,7 @@
 fixupOutputHooks+=(_moveLib64)
 
 _moveLib64() {
-    if [ "$dontMoveLib64" = 1 ]; then return; fi
+    if [ "${dontMoveLib64-}" = 1 ]; then return; fi
     if [ ! -e "$prefix/lib64" -o -L "$prefix/lib64" ]; then return; fi
     echo "moving $prefix/lib64/* to $prefix/lib"
     mkdir -p $prefix/lib
diff --git a/pkgs/build-support/setup-hooks/move-sbin.sh b/pkgs/build-support/setup-hooks/move-sbin.sh
index cc51c27cafd..1c0c4dc9f2d 100644
--- a/pkgs/build-support/setup-hooks/move-sbin.sh
+++ b/pkgs/build-support/setup-hooks/move-sbin.sh
@@ -5,7 +5,7 @@
 fixupOutputHooks+=(_moveSbin)
 
 _moveSbin() {
-    if [ "$dontMoveSbin" = 1 ]; then return; fi
+    if [ "${dontMoveSbin-}" = 1 ]; then return; fi
     if [ ! -e "$prefix/sbin" -o -L "$prefix/sbin" ]; then return; fi
     echo "moving $prefix/sbin/* to $prefix/bin"
     mkdir -p $prefix/bin
diff --git a/pkgs/build-support/setup-hooks/multiple-outputs.sh b/pkgs/build-support/setup-hooks/multiple-outputs.sh
index d43b1877674..2e95495c96f 100644
--- a/pkgs/build-support/setup-hooks/multiple-outputs.sh
+++ b/pkgs/build-support/setup-hooks/multiple-outputs.sh
@@ -9,8 +9,8 @@ _assignFirst() {
     local varName="$1"
     local REMOVE=REMOVE # slightly hacky - we allow REMOVE (i.e. not a variable name)
     shift
-    while [ $# -ge 1 ]; do
-        if [ -n "${!1}" ]; then eval "${varName}"="$1"; return; fi
+    while (( $# )); do
+        if [ -n "${!1-}" ]; then eval "${varName}"="$1"; return; fi
         shift
     done
     echo "Error: _assignFirst found no valid variant!"
@@ -19,7 +19,7 @@ _assignFirst() {
 
 # Same as _assignFirst, but only if "$1" = ""
 _overrideFirst() {
-    if [ -z "${!1}" ]; then
+    if [ -z "${!1-}" ]; then
         _assignFirst "$@"
     fi
 }
diff --git a/pkgs/build-support/setup-hooks/patch-shebangs.sh b/pkgs/build-support/setup-hooks/patch-shebangs.sh
index 3e900d0704c..29fed7ad794 100644
--- a/pkgs/build-support/setup-hooks/patch-shebangs.sh
+++ b/pkgs/build-support/setup-hooks/patch-shebangs.sh
@@ -105,7 +105,7 @@ patchShebangs() {
 }
 
 patchShebangsAuto () {
-    if [ -z "$dontPatchShebangs" -a -e "$prefix" ]; then
+    if [ -z "${dontPatchShebangs-}" -a -e "$prefix" ]; then
 
         # Dev output will end up being run on the build platform. An
         # example case of this is sdl2-config. Otherwise, we can just
diff --git a/pkgs/build-support/setup-hooks/prune-libtool-files.sh b/pkgs/build-support/setup-hooks/prune-libtool-files.sh
index 5d7432e8f09..0ec56549645 100644
--- a/pkgs/build-support/setup-hooks/prune-libtool-files.sh
+++ b/pkgs/build-support/setup-hooks/prune-libtool-files.sh
@@ -8,7 +8,7 @@
 fixupOutputHooks+=(_pruneLibtoolFiles)
 
 _pruneLibtoolFiles() {
-    if [ "$dontPruneLibtoolFiles" ] || [ ! -e "$prefix" ]; then
+    if [ "${dontPruneLibtoolFiles-}" ] || [ ! -e "$prefix" ]; then
        return
     fi
 
diff --git a/pkgs/build-support/setup-hooks/strip.sh b/pkgs/build-support/setup-hooks/strip.sh
index fc4c7bfbaf9..f5fa9378fd7 100644
--- a/pkgs/build-support/setup-hooks/strip.sh
+++ b/pkgs/build-support/setup-hooks/strip.sh
@@ -10,7 +10,7 @@ _doStrip() {
     local -ra stripCmds=(STRIP TARGET_STRIP)
 
     # Optimization
-    if [[ "$STRIP" == "$TARGET_STRIP" ]]; then
+    if [[ "${STRIP-}" == "${TARGET_STRIP-}" ]]; then
         dontStripTarget+=1
     fi
 
@@ -20,7 +20,7 @@ _doStrip() {
         local -n stripCmd="${stripCmds[$i]}"
 
         # `dontStrip` disables them all
-        if [[ "$dontStrip" || "$flag" ]] || ! type -f "$stripCmd" 2>/dev/null
+        if [[ "${dontStrip-}" || "${flag-}" ]] || ! type -f "${stripCmd-}" 2>/dev/null
         then continue; fi
 
         stripDebugList=${stripDebugList:-lib lib32 lib64 libexec bin sbin}
diff --git a/pkgs/build-support/setup-hooks/update-autotools-gnu-config-scripts.sh b/pkgs/build-support/setup-hooks/update-autotools-gnu-config-scripts.sh
index 66f4e91c7bb..ebd3afa05d9 100644
--- a/pkgs/build-support/setup-hooks/update-autotools-gnu-config-scripts.sh
+++ b/pkgs/build-support/setup-hooks/update-autotools-gnu-config-scripts.sh
@@ -1,7 +1,7 @@
 preConfigurePhases+=" updateAutotoolsGnuConfigScriptsPhase"
 
 updateAutotoolsGnuConfigScriptsPhase() {
-    if [ -n "$dontUpdateAutotoolsGnuConfigScripts" ]; then return; fi
+    if [ -n "${dontUpdateAutotoolsGnuConfigScripts-}" ]; then return; fi
 
     for script in config.sub config.guess; do
         for f in $(find . -type f -name "$script"); do
diff --git a/pkgs/build-support/setup-hooks/wrap-gapps-hook.sh b/pkgs/build-support/setup-hooks/wrap-gapps-hook.sh
index 717740f1f20..a05d4f689db 100644
--- a/pkgs/build-support/setup-hooks/wrap-gapps-hook.sh
+++ b/pkgs/build-support/setup-hooks/wrap-gapps-hook.sh
@@ -15,7 +15,7 @@ wrapGApp() {
     wrapProgram "$program" "${gappsWrapperArgs[@]}" "$@"
 }
 
-# Note: $gappsWrapperArgs still gets defined even if $dontWrapGApps is set.
+# Note: $gappsWrapperArgs still gets defined even if ${dontWrapGApps-} is set.
 wrapGAppsHook() {
   # guard against running multiple times (e.g. due to propagation)
   [ -z "$wrapGAppsHookHasRun" ] || return 0
diff --git a/pkgs/desktops/gnome-3/core/mutter/3.28.nix b/pkgs/desktops/gnome-3/core/mutter/3.28.nix
index cc00fc5ece4..85208163415 100644
--- a/pkgs/desktops/gnome-3/core/mutter/3.28.nix
+++ b/pkgs/desktops/gnome-3/core/mutter/3.28.nix
@@ -56,6 +56,8 @@ stdenv.mkDerivation rec {
     })
     # See patch commit message
     ./0001-Revert-ClutterActor-Preserve-valid-paint-volumes-til.patch
+    # Fix build with libglvnd provided headers
+    ./libglvnd-328.patch
   ];
 
   configureFlags = [
diff --git a/pkgs/desktops/gnome-3/core/mutter/default.nix b/pkgs/desktops/gnome-3/core/mutter/default.nix
index d2745c2a90d..8fad9e3c288 100644
--- a/pkgs/desktops/gnome-3/core/mutter/default.nix
+++ b/pkgs/desktops/gnome-3/core/mutter/default.nix
@@ -66,6 +66,11 @@ stdenv.mkDerivation rec {
       src = ./fix-paths.patch;
       inherit zenity;
     })
+    # Fix build with libglvnd provided headers
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/mutter/commit/a444a4c5f58ea516ad3cd9d6ddc0056c3ca9bc90.patch";
+      sha256 = "0imy2j8af9477jliwdq4jc40yw1cifsjjf196gnmwxr9rkj0hbrd";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/desktops/gnome-3/core/mutter/libglvnd-328.patch b/pkgs/desktops/gnome-3/core/mutter/libglvnd-328.patch
new file mode 100644
index 00000000000..96e27559828
--- /dev/null
+++ b/pkgs/desktops/gnome-3/core/mutter/libglvnd-328.patch
@@ -0,0 +1,63 @@
+diff --git a/cogl/configure.ac b/cogl/configure.ac
+index 3be282f..d338cd1 100644
+--- a/cogl/configure.ac
++++ b/cogl/configure.ac
+@@ -490,6 +490,11 @@ AS_IF([test "x$enable_gles1" = "xyes"],
+ #include <EGL/eglext.h>"],
+                              [],
+                              [$COGL_EGL_INCLUDES])
++            AC_CHECK_HEADERS([EGL/eglmesaext.h],
++                             [COGL_EGL_INCLUDES="$COGL_EGL_INCLUDE
++#include <EGL/eglmesaext.h>"],
++                             [],
++                             [$COGL_EGL_INCLUDES])
+ 
+             # Check for a GLES 1.x Common Profile library with/without EGL.
+             #
+@@ -759,7 +764,9 @@ AS_IF([test "x$NEED_EGL" = "xyes" && test "x$EGL_CHECKED" != "xyes"],
+           )
+ 
+         COGL_EGL_INCLUDES="#include <EGL/egl.h>
+-#include <EGL/eglext.h>"
++#include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
++"
+         AC_SUBST([COGL_EGL_INCLUDES])
+       ])
+ 
+diff --git a/src/backends/meta-egl-ext.h b/src/backends/meta-egl-ext.h
+index 8705e7d..db0b74f 100644
+--- a/src/backends/meta-egl-ext.h
++++ b/src/backends/meta-egl-ext.h
+@@ -29,6 +29,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ /*
+  * This is a little different to the tests shipped with EGL implementations,
+diff --git a/src/backends/meta-egl.c b/src/backends/meta-egl.c
+index 755ec49..bd253c9 100644
+--- a/src/backends/meta-egl.c
++++ b/src/backends/meta-egl.c
+@@ -31,6 +31,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <gio/gio.h>
+ #include <glib.h>
+ #include <glib-object.h>
+diff --git a/src/backends/meta-egl.h b/src/backends/meta-egl.h
+index 060c7cd..2fef264 100644
+--- a/src/backends/meta-egl.h
++++ b/src/backends/meta-egl.h
+@@ -27,6 +27,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <glib-object.h>
+ 
+ #define META_EGL_ERROR meta_egl_error_quark ()
diff --git a/pkgs/desktops/plasma-5/default.nix b/pkgs/desktops/plasma-5/default.nix
index e188e4e3fcd..4a8c3f40831 100644
--- a/pkgs/desktops/plasma-5/default.nix
+++ b/pkgs/desktops/plasma-5/default.nix
@@ -43,7 +43,7 @@ let
       propagate = out:
         let setupHook = { writeScript }:
               writeScript "setup-hook" ''
-                if [ "$hookName" != postHook ]; then
+                if [ "${hookName:-}" != postHook ]; then
                     postHooks+=("source @dev@/nix-support/setup-hook")
                 else
                     # Propagate $${out} output
diff --git a/pkgs/development/compilers/adoptopenjdk-bin/jdk-darwin-base.nix b/pkgs/development/compilers/adoptopenjdk-bin/jdk-darwin-base.nix
index 03857627952..3b9cb752b9b 100644
--- a/pkgs/development/compilers/adoptopenjdk-bin/jdk-darwin-base.nix
+++ b/pkgs/development/compilers/adoptopenjdk-bin/jdk-darwin-base.nix
@@ -37,7 +37,7 @@ let cpuName = stdenv.hostPlatform.parsed.cpu.name;
 
     # Set JAVA_HOME automatically.
     cat <<EOF >> $out/nix-support/setup-hook
-    if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out; fi
+    if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
     EOF
   '';
 
diff --git a/pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix b/pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix
index 509050209fb..fe38f2b2163 100644
--- a/pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix
+++ b/pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix
@@ -54,7 +54,7 @@ let result = stdenv.mkDerivation rec {
 
     # Set JAVA_HOME automatically.
     cat <<EOF >> "$out/nix-support/setup-hook"
-    if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out; fi
+    if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
     EOF
   '';
 
diff --git a/pkgs/development/compilers/graalvm/default.nix b/pkgs/development/compilers/graalvm/default.nix
index 41cf956cd9f..11a94ebcce5 100644
--- a/pkgs/development/compilers/graalvm/default.nix
+++ b/pkgs/development/compilers/graalvm/default.nix
@@ -270,7 +270,7 @@ in rec {
       # Set JAVA_HOME automatically.
       mkdir -p $out/nix-support
       cat <<EOF > $out/nix-support/setup-hook
-      if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out; fi
+      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
       EOF
     '';
     postFixup = openjdk.postFixup or null;
diff --git a/pkgs/development/compilers/graalvm/enterprise-edition.nix b/pkgs/development/compilers/graalvm/enterprise-edition.nix
index 84cb38aa8d1..e180455cb7c 100644
--- a/pkgs/development/compilers/graalvm/enterprise-edition.nix
+++ b/pkgs/development/compilers/graalvm/enterprise-edition.nix
@@ -72,7 +72,7 @@ let
       # Set JAVA_HOME automatically.
       mkdir -p $out/nix-support
       cat <<EOF > $out/nix-support/setup-hook
-      if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out; fi
+      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
       EOF
     '';
 
diff --git a/pkgs/development/compilers/llvm/7/libc++/default.nix b/pkgs/development/compilers/llvm/7/libc++/default.nix
index 7a0716a6eb3..f6f9970d7a6 100644
--- a/pkgs/development/compilers/llvm/7/libc++/default.nix
+++ b/pkgs/development/compilers/llvm/7/libc++/default.nix
@@ -1,4 +1,5 @@
-{ lib, stdenv, fetch, cmake, python, libcxxabi, fixDarwinDylibNames, version }:
+{ lib, stdenv, fetch, cmake, python, libcxxabi, fixDarwinDylibNames, version
+, enableShared ? ! stdenv.hostPlatform.isMusl }:
 
 stdenv.mkDerivation {
   pname = "libc++";
@@ -31,7 +32,8 @@ stdenv.mkDerivation {
     "-DLIBCXX_LIBCXXABI_LIB_PATH=${libcxxabi}/lib"
     "-DLIBCXX_LIBCPPABI_VERSION=2"
     "-DLIBCXX_CXX_ABI=libcxxabi"
-  ] ++ stdenv.lib.optional stdenv.hostPlatform.isMusl "-DLIBCXX_HAS_MUSL_LIBC=1";
+  ] ++ stdenv.lib.optional stdenv.hostPlatform.isMusl "-DLIBCXX_HAS_MUSL_LIBC=1"
+  ++ stdenv.lib.optional (!enableShared) "-DLIBCXX_ENABLE_SHARED=OFF" ;
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/compilers/llvm/7/libc++abi.nix b/pkgs/development/compilers/llvm/7/libc++abi.nix
index 522c8d1a163..9067bf43a8f 100644
--- a/pkgs/development/compilers/llvm/7/libc++abi.nix
+++ b/pkgs/development/compilers/llvm/7/libc++abi.nix
@@ -1,4 +1,6 @@
-{ stdenv, cmake, fetch, libcxx, llvm, version }:
+{ stdenv, cmake, fetch, libcxx, llvm, version
+  # on musl the shared objects don't build
+, enableShared ? ! stdenv.hostPlatform.isMusl }:
 
 stdenv.mkDerivation {
   pname = "libc++abi";
@@ -11,13 +13,15 @@ stdenv.mkDerivation {
   postUnpack = ''
     unpackFile ${libcxx.src}
     unpackFile ${llvm.src}
-    export cmakeFlags="-DLLVM_PATH=$PWD/$(ls -d llvm-*) -DLIBCXXABI_LIBCXX_PATH=$PWD/$(ls -d libcxx-*)"
+    cmakeFlagsArray=($cmakeFlagsArray -DLLVM_PATH=$PWD/$(ls -d llvm-*) -DLIBCXXABI_LIBCXX_PATH=$PWD/$(ls -d libcxx-*) )
   '' + stdenv.lib.optionalString stdenv.isDarwin ''
     export TRIPLE=x86_64-apple-darwin
   '' + stdenv.lib.optionalString stdenv.hostPlatform.isMusl ''
     patch -p1 -d $(ls -d libcxx-*) -i ${../libcxx-0001-musl-hacks.patch}
   '';
 
+  cmakeFlags = stdenv.lib.optional (!enableShared) "-DLIBCXXABI_ENABLE_SHARED=OFF";
+
   installPhase = if stdenv.isDarwin
     then ''
       for file in lib/*.dylib; do
@@ -34,10 +38,10 @@ stdenv.mkDerivation {
     else ''
       install -d -m 755 $out/include $out/lib
       install -m 644 lib/libc++abi.a $out/lib
-      install -m 644 lib/libc++abi.so.1.0 $out/lib
+      ${stdenv.lib.optionalString enableShared "install -m 644 lib/libc++abi.so.1.0 $out/lib"}
       install -m 644 ../include/cxxabi.h $out/include
-      ln -s libc++abi.so.1.0 $out/lib/libc++abi.so
-      ln -s libc++abi.so.1.0 $out/lib/libc++abi.so.1
+      ${stdenv.lib.optionalString enableShared "ln -s libc++abi.so.1.0 $out/lib/libc++abi.so"}
+      ${stdenv.lib.optionalString enableShared "ln -s libc++abi.so.1.0 $out/lib/libc++abi.so.1"}
     '';
 
   meta = {
diff --git a/pkgs/development/compilers/openjdk/11.nix b/pkgs/development/compilers/openjdk/11.nix
index 57911f2d58e..e365b9b28b3 100644
--- a/pkgs/development/compilers/openjdk/11.nix
+++ b/pkgs/development/compilers/openjdk/11.nix
@@ -106,7 +106,7 @@ let
       # Set JAVA_HOME automatically.
       mkdir -p $out/nix-support
       cat <<EOF > $out/nix-support/setup-hook
-      if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out/lib/openjdk; fi
+      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out/lib/openjdk; fi
       EOF
     '';
 
diff --git a/pkgs/development/compilers/openjdk/8.nix b/pkgs/development/compilers/openjdk/8.nix
index 1a5848cd1a6..ff3d03321e2 100644
--- a/pkgs/development/compilers/openjdk/8.nix
+++ b/pkgs/development/compilers/openjdk/8.nix
@@ -231,7 +231,7 @@ let
       # Set JAVA_HOME automatically.
       mkdir -p $out/nix-support
       cat <<EOF > $out/nix-support/setup-hook
-      if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out/lib/openjdk; fi
+      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out/lib/openjdk; fi
       EOF
     '';
 
diff --git a/pkgs/development/compilers/openjdk/darwin/11.nix b/pkgs/development/compilers/openjdk/darwin/11.nix
index 4c808302b4f..0b659b95aa8 100644
--- a/pkgs/development/compilers/openjdk/darwin/11.nix
+++ b/pkgs/development/compilers/openjdk/darwin/11.nix
@@ -44,7 +44,7 @@ let
 
       # Set JAVA_HOME automatically.
       cat <<EOF >> $out/nix-support/setup-hook
-      if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out; fi
+      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
       EOF
     '';
 
diff --git a/pkgs/development/compilers/openjdk/darwin/8.nix b/pkgs/development/compilers/openjdk/darwin/8.nix
index d2fef9bb481..bc7a33932b2 100644
--- a/pkgs/development/compilers/openjdk/darwin/8.nix
+++ b/pkgs/development/compilers/openjdk/darwin/8.nix
@@ -44,7 +44,7 @@ let
 
       # Set JAVA_HOME automatically.
       cat <<EOF >> $out/nix-support/setup-hook
-      if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out; fi
+      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
       EOF
     '';
 
diff --git a/pkgs/development/compilers/openjdk/darwin/default.nix b/pkgs/development/compilers/openjdk/darwin/default.nix
index 58e4ba99014..c954a8e2cf8 100644
--- a/pkgs/development/compilers/openjdk/darwin/default.nix
+++ b/pkgs/development/compilers/openjdk/darwin/default.nix
@@ -44,7 +44,7 @@ let
 
       # Set JAVA_HOME automatically.
       cat <<EOF >> $out/nix-support/setup-hook
-      if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out; fi
+      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
       EOF
     '';
 
diff --git a/pkgs/development/compilers/openjdk/default.nix b/pkgs/development/compilers/openjdk/default.nix
index 094bd57e6e9..03121daf961 100644
--- a/pkgs/development/compilers/openjdk/default.nix
+++ b/pkgs/development/compilers/openjdk/default.nix
@@ -114,7 +114,7 @@ let
       # Set JAVA_HOME automatically.
       mkdir -p $out/nix-support
       cat <<EOF > $out/nix-support/setup-hook
-      if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out/lib/openjdk; fi
+      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out/lib/openjdk; fi
       EOF
     '';
 
diff --git a/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix b/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix
index 549395232f9..a96e703b28c 100644
--- a/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix
+++ b/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix
@@ -156,7 +156,7 @@ let result = stdenv.mkDerivation rec {
 
     # Set JAVA_HOME automatically.
     cat <<EOF >> $out/nix-support/setup-hook
-    if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out; fi
+    if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
     EOF
   '';
 
diff --git a/pkgs/development/compilers/reason/default.nix b/pkgs/development/compilers/reason/default.nix
index 5d7d0ce6684..20286dcc43c 100644
--- a/pkgs/development/compilers/reason/default.nix
+++ b/pkgs/development/compilers/reason/default.nix
@@ -27,8 +27,8 @@ stdenv.mkDerivation rec {
   postInstall = ''
     wrapProgram $out/bin/rtop \
       --prefix PATH : "${utop}/bin" \
-      --set CAML_LD_LIBRARY_PATH ${ocaml_lwt}/lib/ocaml/${ocaml.version}/site-lib:$CAML_LD_LIBRARY_PATH \
-      --set OCAMLPATH $out/lib/ocaml/${ocaml.version}/site-lib:$OCAMLPATH
+      --prefix CAML_LD_LIBRARY_PATH : "${ocaml_lwt}/lib/ocaml/${ocaml.version}/site-lib" \
+      --prefix OCAMLPATH : "$out/lib/ocaml/${ocaml.version}/site-lib"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index 8a7d680010d..ceaf6f4c225 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -1,6 +1,6 @@
 { stdenv, removeReferencesTo, pkgsBuildBuild, pkgsBuildHost, pkgsBuildTarget
 , fetchurl, file, python2
-, llvm_7, darwin, git, cmake, rustPlatform
+, llvm_9, darwin, git, cmake, rustPlatform
 , pkgconfig, openssl
 , which, libffi
 , withBundledLLVM ? false
@@ -12,12 +12,12 @@ let
   inherit (stdenv.lib) optional optionalString;
   inherit (darwin.apple_sdk.frameworks) Security;
 
-  llvmSharedForBuild = pkgsBuildBuild.llvm_7.override { enableSharedLibraries = true; };
-  llvmSharedForHost = pkgsBuildHost.llvm_7.override { enableSharedLibraries = true; };
-  llvmSharedForTarget = pkgsBuildTarget.llvm_7.override { enableSharedLibraries = true; };
+  llvmSharedForBuild = pkgsBuildBuild.llvm_9.override { enableSharedLibraries = true; };
+  llvmSharedForHost = pkgsBuildHost.llvm_9.override { enableSharedLibraries = true; };
+  llvmSharedForTarget = pkgsBuildTarget.llvm_9.override { enableSharedLibraries = true; };
 
   # For use at runtime
-  llvmShared = llvm_7.override { enableSharedLibraries = true; };
+  llvmShared = llvm_9.override { enableSharedLibraries = true; };
 in stdenv.mkDerivation rec {
   pname = "rustc";
   inherit version;
diff --git a/pkgs/development/compilers/rust/setup-hook.sh b/pkgs/development/compilers/rust/setup-hook.sh
index 7078ec7060b..5d4eb642fec 100644
--- a/pkgs/development/compilers/rust/setup-hook.sh
+++ b/pkgs/development/compilers/rust/setup-hook.sh
@@ -1,4 +1,4 @@
 # Fix 'failed to open: /homeless-shelter/.cargo/.package-cache' in rust 1.36.
-if [[ -z $IN_NIX_SHELL && -z $CARGO_HOME ]]; then
+if [[ -z ${IN_NIX_SHELL-} && -z ${CARGO_HOME-} ]]; then
     export CARGO_HOME=$TMPDIR
 fi
diff --git a/pkgs/development/compilers/zulu/8.nix b/pkgs/development/compilers/zulu/8.nix
index d4caabc6cb8..d05ec1a682a 100644
--- a/pkgs/development/compilers/zulu/8.nix
+++ b/pkgs/development/compilers/zulu/8.nix
@@ -58,7 +58,7 @@ in stdenv.mkDerivation {
 
     # Set JAVA_HOME automatically.
     cat <<EOF >> $out/nix-support/setup-hook
-    if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out; fi
+    if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
     EOF
   '';
 
diff --git a/pkgs/development/compilers/zulu/default.nix b/pkgs/development/compilers/zulu/default.nix
index 5f345c87355..5fe2473bac6 100644
--- a/pkgs/development/compilers/zulu/default.nix
+++ b/pkgs/development/compilers/zulu/default.nix
@@ -55,7 +55,7 @@ in stdenv.mkDerivation {
 
     # Set JAVA_HOME automatically.
     cat <<EOF >> $out/nix-support/setup-hook
-    if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out; fi
+    if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
     EOF
   '';
 
diff --git a/pkgs/development/interpreters/guile/setup-hook-2.0.sh b/pkgs/development/interpreters/guile/setup-hook-2.0.sh
index c7fb4f70fc6..6bb3910aaff 100644
--- a/pkgs/development/interpreters/guile/setup-hook-2.0.sh
+++ b/pkgs/development/interpreters/guile/setup-hook-2.0.sh
@@ -1,12 +1,12 @@
 addGuileLibPath () {
     if test -d "$1/share/guile/site/2.0"
     then
-        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH}${GUILE_LOAD_PATH:+:}$1/share/guile/site/2.0"
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site/2.0"
+        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site/2.0"
+        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site/2.0"
     elif test -d "$1/share/guile/site"
     then
-        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH}${GUILE_LOAD_PATH:+:}$1/share/guile/site"
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site"
+        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site"
+        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site"
     fi
 }
 
diff --git a/pkgs/development/interpreters/guile/setup-hook-2.2.sh b/pkgs/development/interpreters/guile/setup-hook-2.2.sh
index 73e700bde02..4b3541fcc7f 100644
--- a/pkgs/development/interpreters/guile/setup-hook-2.2.sh
+++ b/pkgs/development/interpreters/guile/setup-hook-2.2.sh
@@ -1,12 +1,12 @@
 addGuileLibPath () {
     if test -d "$1/share/guile/site/2.2"
     then
-        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH}${GUILE_LOAD_PATH:+:}$1/share/guile/site/2.2"
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site/2.2"
+        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site/2.2"
+        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site/2.2"
     elif test -d "$1/share/guile/site"
     then
-        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH}${GUILE_LOAD_PATH:+:}$1/share/guile/site"
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site"
+        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site"
+        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site"
     fi
 }
 
diff --git a/pkgs/development/interpreters/guile/setup-hook.sh b/pkgs/development/interpreters/guile/setup-hook.sh
index bf04fee1e89..d006b50ce8e 100644
--- a/pkgs/development/interpreters/guile/setup-hook.sh
+++ b/pkgs/development/interpreters/guile/setup-hook.sh
@@ -1,7 +1,7 @@
 addGuileLibPath () {
     if test -d "$1/share/guile/site"
     then
-        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH}${GUILE_LOAD_PATH:+:}$1/share/guile/site"
+        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site"
     fi
 }
 
diff --git a/pkgs/development/interpreters/lua-5/setup-hook.sh b/pkgs/development/interpreters/lua-5/setup-hook.sh
index f7e56b62ac9..1c445b82afd 100644
--- a/pkgs/development/interpreters/lua-5/setup-hook.sh
+++ b/pkgs/development/interpreters/lua-5/setup-hook.sh
@@ -20,7 +20,7 @@ addToLuaSearchPathWithCustomDelimiter() {
   if [[ ! -d "$topDir" ]]; then return; fi
 
   # export only if we haven't already got this dir in the search path
-  if [[ ${!varName} == *"$absPattern"* ]]; then return; fi
+  if [[ ${!varName-} == *"$absPattern"* ]]; then return; fi
 
   export "${varName}=${!varName:+${!varName};}${absPattern}"
 }
diff --git a/pkgs/development/interpreters/octave/default.nix b/pkgs/development/interpreters/octave/default.nix
index cc9f6fcc3c9..66f71738537 100644
--- a/pkgs/development/interpreters/octave/default.nix
+++ b/pkgs/development/interpreters/octave/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, gfortran, readline, ncurses, perl, flex, texinfo, qhull
-, libsndfile, portaudio, libX11, graphicsmagick, pcre, pkgconfig, libGLU_combined, fltk
+, libsndfile, portaudio, libX11, graphicsmagick, pcre, pkgconfig, libGL, libGLU, fltk
 , fftw, fftwSinglePrec, zlib, curl, qrupdate, openblas, arpack, libwebp
 , qt ? null, qscintilla ? null, ghostscript ? null, llvm ? null, hdf5 ? null,glpk ? null
 , suitesparse ? null, gnuplot ? null, jdk ? null, python ? null, overridePlatforms ? null
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     ++ (stdenv.lib.optional (jdk != null) jdk)
     ++ (stdenv.lib.optional (gnuplot != null) gnuplot)
     ++ (stdenv.lib.optional (python != null) python)
-    ++ (stdenv.lib.optionals (!stdenv.isDarwin) [ libGLU_combined libX11 ])
+    ++ (stdenv.lib.optionals (!stdenv.isDarwin) [ libGL libGLU libX11 ])
     ;
 
   # makeinfo is required by Octave at runtime to display help
diff --git a/pkgs/development/interpreters/perl/default.nix b/pkgs/development/interpreters/perl/default.nix
index 2ecc5cbb2ef..4503fd0bf49 100644
--- a/pkgs/development/interpreters/perl/default.nix
+++ b/pkgs/development/interpreters/perl/default.nix
@@ -1,5 +1,5 @@
 { config, lib, stdenv, fetchurl, pkgs, buildPackages, callPackage
-, enableThreading ? stdenv ? glibc, makeWrapper
+, enableThreading ? stdenv ? glibc, coreutils, makeWrapper
 }:
 
 with lib;
@@ -35,7 +35,7 @@ let
 
     # TODO: Add a "dev" output containing the header files.
     outputs = [ "out" "man" "devdoc" ] ++
-      stdenv.lib.optional crossCompiling "dev";
+      optional crossCompiling "dev";
     setOutputFlags = false;
 
     disallowedReferences = [ stdenv.cc ];
@@ -57,12 +57,20 @@ let
       ++ optionals stdenv.isDarwin [ ./cpp-precomp.patch ./sw_vers.patch ]
       ++ optional crossCompiling ./MakeMaker-cross.patch;
 
-    postPatch = ''
-      pwd="$(type -P pwd)"
+    # This is not done for native builds because pwd may need to come from
+    # bootstrap tools when building bootstrap perl.
+    postPatch = (if crossCompiling then ''
       substituteInPlace dist/PathTools/Cwd.pm \
-        --replace "/bin/pwd" "$pwd"
-    '' + stdenv.lib.optionalString crossCompiling ''
+        --replace "/bin/pwd" '${coreutils}/bin/pwd'
       substituteInPlace cnf/configure_tool.sh --replace "cc -E -P" "cc -E"
+    '' else ''
+      substituteInPlace dist/PathTools/Cwd.pm \
+        --replace "/bin/pwd" "$(type -P pwd)"
+    '') +
+    # Perl's build system uses the src variable, and its value may end up in
+    # the output in some cases (when cross-compiling)
+    ''
+      unset src
     '';
 
     # Build a thread-safe Perl with a dynamic libperls.o.  We need the
@@ -85,7 +93,7 @@ let
       ++ optional stdenv.isSunOS "-Dcc=gcc"
       ++ optional enableThreading "-Dusethreads";
 
-    configureScript = stdenv.lib.optionalString (!crossCompiling) "${stdenv.shell} ./Configure";
+    configureScript = optionalString (!crossCompiling) "${stdenv.shell} ./Configure";
 
     dontAddPrefix = !crossCompiling;
 
@@ -140,7 +148,7 @@ let
             }" /no-such-path \
           --replace "${stdenv.cc}" /no-such-path \
           --replace "$man" /no-such-path
-      '' + stdenv.lib.optionalString crossCompiling
+      '' + optionalString crossCompiling
       ''
         mkdir -p $dev/lib/perl5/cross_perl/${version}
         for dir in cnf/{stub,cpan}; do
@@ -172,7 +180,7 @@ let
       platforms = platforms.all;
       priority = 6; # in `buildEnv' (including the one inside `perl.withPackages') the library files will have priority over files in `perl`
     };
-  } // stdenv.lib.optionalAttrs (stdenv.buildPlatform != stdenv.hostPlatform) rec {
+  } // optionalAttrs (stdenv.buildPlatform != stdenv.hostPlatform) rec {
     crossVersion = "980998f7d11baf97284426ca91f84681d49a08f5"; # Jul 20, 2019
 
     perl-cross-src = fetchurl {
diff --git a/pkgs/development/interpreters/python/hooks/flit-build-hook.sh b/pkgs/development/interpreters/python/hooks/flit-build-hook.sh
index 48295dc3643..45893aae00f 100644
--- a/pkgs/development/interpreters/python/hooks/flit-build-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/flit-build-hook.sh
@@ -9,7 +9,7 @@ flitBuildPhase () {
     echo "Finished executing flitBuildPhase"
 }
 
-if [ -z "$dontUseFlitBuild" ] && [ -z "$buildPhase" ]; then
+if [ -z "${dontUseFlitBuild-}" ] && [ -z "${buildPhase-}" ]; then
     echo "Using flitBuildPhase"
     buildPhase=flitBuildPhase
 fi
diff --git a/pkgs/development/interpreters/python/hooks/pip-build-hook.sh b/pkgs/development/interpreters/python/hooks/pip-build-hook.sh
index c297bfffb1e..292f13d3015 100644
--- a/pkgs/development/interpreters/python/hooks/pip-build-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/pip-build-hook.sh
@@ -31,12 +31,12 @@ pipShellHook() {
     echo "Finished executing pipShellHook"
 }
 
-if [ -z "$dontUsePipBuild" ] && [ -z "$buildPhase" ]; then
+if [ -z "${dontUsePipBuild-}" ] && [ -z "${buildPhase-}" ]; then
     echo "Using pipBuildPhase"
     buildPhase=pipBuildPhase
 fi
 
-if [ -z "$shellHook" ]; then
+if [ -z "${shellHook-}" ]; then
     echo "Using pipShellHook"
     shellHook=pipShellHook
 fi
diff --git a/pkgs/development/interpreters/python/hooks/pip-install-hook.sh b/pkgs/development/interpreters/python/hooks/pip-install-hook.sh
index f528ec63cb8..4eefe22d3f2 100644
--- a/pkgs/development/interpreters/python/hooks/pip-install-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/pip-install-hook.sh
@@ -18,7 +18,7 @@ pipInstallPhase() {
     echo "Finished executing pipInstallPhase"
 }
 
-if [ -z "$dontUsePipInstall" ] && [ -z "$installPhase" ]; then
+if [ -z "${dontUsePipInstall-}" ] && [ -z "${installPhase-}" ]; then
     echo "Using pipInstallPhase"
     installPhase=pipInstallPhase
 fi
diff --git a/pkgs/development/interpreters/python/hooks/pytest-check-hook.sh b/pkgs/development/interpreters/python/hooks/pytest-check-hook.sh
index 24510b9f993..18f05b6d218 100644
--- a/pkgs/development/interpreters/python/hooks/pytest-check-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/pytest-check-hook.sh
@@ -43,7 +43,7 @@ function pytestCheckPhase() {
     echo "Finished executing pytestCheckPhase"
 }
 
-if [ -z "$dontUsePytestCheck" ] && [ -z "$installCheckPhase" ]; then
+if [ -z "${dontUsePytestCheck-}" ] && [ -z "${installCheckPhase-}" ]; then
     echo "Using pytestCheckPhase"
     preDistPhases+=" pytestCheckPhase"
 fi
diff --git a/pkgs/development/interpreters/python/hooks/python-catch-conflicts-hook.sh b/pkgs/development/interpreters/python/hooks/python-catch-conflicts-hook.sh
index e9065cf1793..374a2eddb40 100644
--- a/pkgs/development/interpreters/python/hooks/python-catch-conflicts-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/python-catch-conflicts-hook.sh
@@ -5,6 +5,6 @@ pythonCatchConflictsPhase() {
     @pythonInterpreter@ @catchConflicts@
 }
 
-if [ -z "$dontUsePythonCatchConflicts" ]; then
+if [ -z "${dontUsePythonCatchConflicts-}" ]; then
     preDistPhases+=" pythonCatchConflictsPhase"
 fi
diff --git a/pkgs/development/interpreters/python/hooks/python-imports-check-hook.sh b/pkgs/development/interpreters/python/hooks/python-imports-check-hook.sh
index 7e2b3f69d6d..0fc55145a8e 100644
--- a/pkgs/development/interpreters/python/hooks/python-imports-check-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/python-imports-check-hook.sh
@@ -10,7 +10,7 @@ pythonImportsCheckPhase () {
     fi
 }
 
-if [ -z "$dontUsePythonImportsCheck" ]; then
+if [ -z "${dontUsePythonImportsCheck-}" ]; then
     echo "Using pythonImportsCheckPhase"
     preDistPhases+=" pythonImportsCheckPhase"
 fi
diff --git a/pkgs/development/interpreters/python/hooks/python-remove-bin-bytecode-hook.sh b/pkgs/development/interpreters/python/hooks/python-remove-bin-bytecode-hook.sh
index 960de767be7..2add23f2316 100644
--- a/pkgs/development/interpreters/python/hooks/python-remove-bin-bytecode-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/python-remove-bin-bytecode-hook.sh
@@ -12,6 +12,6 @@ pythonRemoveBinBytecodePhase () {
     fi
 }
 
-if [ -z "$dontUsePythonRemoveBinBytecode" ]; then
+if [ -z "${dontUsePythonRemoveBinBytecode-}" ]; then
     preDistPhases+=" pythonRemoveBinBytecodePhase"
 fi
diff --git a/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh b/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh
index 322a0336df2..2aec9279382 100644
--- a/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh
@@ -36,12 +36,12 @@ setuptoolsShellHook() {
     echo "Finished executing setuptoolsShellHook"
 }
 
-if [ -z "$dontUseSetuptoolsBuild" ] && [ -z "$buildPhase" ]; then
+if [ -z "${dontUseSetuptoolsBuild-}" ] && [ -z "${buildPhase-}" ]; then
     echo "Using setuptoolsBuildPhase"
     buildPhase=setuptoolsBuildPhase
 fi
 
-if [ -z "$dontUseSetuptoolsShellHook" ] && [ -z "$shellHook" ]; then
+if [ -z "${dontUseSetuptoolsShellHook-}" ] && [ -z "${shellHook-}" ]; then
     echo "Using setuptoolsShellHook"
     shellHook=setuptoolsShellHook
 fi
diff --git a/pkgs/development/interpreters/python/hooks/setuptools-check-hook.sh b/pkgs/development/interpreters/python/hooks/setuptools-check-hook.sh
index 71bb036a91a..88b7b11931b 100644
--- a/pkgs/development/interpreters/python/hooks/setuptools-check-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/setuptools-check-hook.sh
@@ -12,7 +12,7 @@ setuptoolsCheckPhase() {
     echo "Finished executing setuptoolsCheckPhase"
 }
 
-if [ -z "$dontUseSetuptoolsCheck" ] && [ -z "$installCheckPhase" ]; then
+if [ -z "${dontUseSetuptoolsCheck-}" ] && [ -z "${installCheckPhase-}" ]; then
     echo "Using setuptoolsCheckPhase"
     preDistPhases+=" setuptoolsCheckPhase"
 fi
diff --git a/pkgs/development/interpreters/python/hooks/wheel-unpack-hook.sh b/pkgs/development/interpreters/python/hooks/wheel-unpack-hook.sh
index 6dd0c5be4cb..fca808a933b 100644
--- a/pkgs/development/interpreters/python/hooks/wheel-unpack-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/wheel-unpack-hook.sh
@@ -12,7 +12,7 @@ wheelUnpackPhase(){
     echo "Finished executing wheelUnpackPhase"
 }
 
-if [ -z "$dontUseWheelUnpack" ] && [ -z "$unpackPhase" ]; then
+if [ -z "${dontUseWheelUnpack-}" ] && [ -z "${unpackPhase-}" ]; then
     echo "Using wheelUnpackPhase"
     unpackPhase=wheelUnpackPhase
 fi
diff --git a/pkgs/development/libraries/SDL/setup-hook.sh b/pkgs/development/libraries/SDL/setup-hook.sh
index e8f96fdd1ac..553e8553a77 100644
--- a/pkgs/development/libraries/SDL/setup-hook.sh
+++ b/pkgs/development/libraries/SDL/setup-hook.sh
@@ -1,7 +1,9 @@
 addSDLPath () {
   if [ -e "$1/include/SDL" ]; then
-    export SDL_PATH="$SDL_PATH $1/include/SDL"
-    export SDL_LIB_PATH="$SDL_LIB_PATH -L$1/lib"
+    export SDL_PATH="${SDL_PATH-}${SDL_PATH:+ }$1/include/SDL"
+  fi
+  if [ -e "$1/lib" ]; then
+    export SDL_LIB_PATH="${SDL_LIB_PATH-}${SDL_LIB_PATH:+ }-L$1/lib"
   fi
 }
 
diff --git a/pkgs/development/libraries/SDL2/default.nix b/pkgs/development/libraries/SDL2/default.nix
index 8fe6bbe6113..e02ea05a726 100644
--- a/pkgs/development/libraries/SDL2/default.nix
+++ b/pkgs/development/libraries/SDL2/default.nix
@@ -75,9 +75,21 @@ stdenv.mkDerivation rec {
     ++ optional alsaSupport "--with-alsa-prefix=${alsaLib.out}/lib"
     ++ optional stdenv.isDarwin "--disable-sdltest";
 
+  # We remove libtool .la files when static libs are requested,
+  # because they make the builds of downstream libs like `SDL_tff`
+  # fail with `cannot find -lXext, `-lXcursor` etc. linker errors
+  # because the `.la` files are not pruned if static libs exist
+  # (see https://github.com/NixOS/nixpkgs/commit/fd97db43bcb05e37f6bb77f363f1e1e239d9de53)
+  # and they also don't carry the necessary `-L` paths of their
+  # X11 dependencies.
+  # For static linking, it is better to rely on `pkg-config` `.pc`
+  # files.
   postInstall = ''
-    moveToOutput lib/libSDL2main.a "$dev"
-    rm $out/lib/*.a
+    if [ "$dontDisableStatic" -eq "1" ]; then
+      rm $out/lib/*.la
+    else
+      rm $out/lib/*.a
+    fi
     moveToOutput bin/sdl2-config "$dev"
   '';
 
diff --git a/pkgs/development/libraries/SDL2/setup-hook.sh b/pkgs/development/libraries/SDL2/setup-hook.sh
index 3acce9d473c..0119926491a 100644
--- a/pkgs/development/libraries/SDL2/setup-hook.sh
+++ b/pkgs/development/libraries/SDL2/setup-hook.sh
@@ -1,6 +1,6 @@
 addSDL2Path () {
   if [ -e "$1/include/SDL2" ]; then
-    export SDL2_PATH="$SDL2_PATH $1/include/SDL2"
+    export SDL2_PATH="${SDL2_PATH-}${SDL2_PATH:+ }$1/include/SDL2"
   fi
 }
 
diff --git a/pkgs/development/libraries/clutter/default.nix b/pkgs/development/libraries/clutter/default.nix
index 7095a808540..32e723671e8 100644
--- a/pkgs/development/libraries/clutter/default.nix
+++ b/pkgs/development/libraries/clutter/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, libGLU_combined, libX11, libXext, libXfixes
+{ stdenv, fetchurl, pkgconfig, libGLU, libGL, libX11, libXext, libXfixes
 , libXdamage, libXcomposite, libXi, libxcb, cogl, pango, atk, json-glib
 , gobject-introspection, gtk3, gnome3, libinput, libgudev, libxkbcommon
 }:
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ gtk3 ];
   nativeBuildInputs = [ pkgconfig ];
   propagatedBuildInputs =
-    [ libX11 libGLU_combined libXext libXfixes libXdamage libXcomposite libXi cogl pango
+    [ libX11 libGL libGLU libXext libXfixes libXdamage libXcomposite libXi cogl pango
       atk json-glib gobject-introspection libxcb libinput libgudev libxkbcommon
     ];
 
diff --git a/pkgs/development/libraries/cogl/default.nix b/pkgs/development/libraries/cogl/default.nix
index 4700d9e2418..e122c1e7b12 100644
--- a/pkgs/development/libraries/cogl/default.nix
+++ b/pkgs/development/libraries/cogl/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, fetchpatch, pkgconfig, libGL, glib, gdk-pixbuf, xorg, libintl
 , pangoSupport ? true, pango, cairo, gobject-introspection, wayland, gnome3
-, mesa
+, mesa, automake, autoconf
 , gstreamerSupport ? true, gst_all_1 }:
 
 let
@@ -29,11 +29,17 @@ in stdenv.mkDerivation rec {
       url = https://bug787443.bugzilla-attachments.gnome.org/attachment.cgi?id=361056;
       sha256 = "09fyrdci4727fg6qm5aaapsbv71sf4wgfaqz8jqlyy61dibgg490";
     })
+
+    # Fix build with libglvnd headers (these headers used to be provided by mesa)
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/cogl/commit/9c4764224aded552fb855b1c2b85b26d2b894adf.patch";
+      sha256 = "1v9drpzgcd5pq2shhdcw5px7mdiggk6ga13qjbklq8xpd92ac0i1";
+    })
   ];
 
   outputs = [ "out" "dev" ];
 
-  nativeBuildInputs = [ pkgconfig libintl ];
+  nativeBuildInputs = [ pkgconfig libintl automake autoconf ];
 
   configureFlags = [
     "--enable-introspection"
@@ -41,7 +47,7 @@ in stdenv.mkDerivation rec {
     "--enable-wayland-egl-platform"
     "--enable-wayland-egl-server"
   ] ++ stdenv.lib.optional gstreamerSupport "--enable-cogl-gst"
-    ++ stdenv.lib.optionals (!stdenv.isDarwin) [ "--enable-gles1" "--enable-gles2" ];
+  ++ stdenv.lib.optionals (!stdenv.isDarwin) [ "--enable-gles1" "--enable-gles2" ];
 
   propagatedBuildInputs = with xorg; [
       glib gdk-pixbuf gobject-introspection wayland mesa
diff --git a/pkgs/development/libraries/coin3d/default.nix b/pkgs/development/libraries/coin3d/default.nix
index 74fd12ffea2..634ac27058b 100644
--- a/pkgs/development/libraries/coin3d/default.nix
+++ b/pkgs/development/libraries/coin3d/default.nix
@@ -1,4 +1,4 @@
-{ fetchFromBitbucket, stdenv, boost, cmake, libGLU_combined }:
+{ fetchFromBitbucket, stdenv, boost, cmake, libGL, libGLU }:
 
 stdenv.mkDerivation {
   pname = "coin";
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
   '';
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ boost libGLU_combined ];
+  buildInputs = [ boost libGL libGLU ];
 
   meta = {
     homepage = "https://bitbucket.org/Coin3D/coin/wiki/Home";
diff --git a/pkgs/development/libraries/dleyna-core/setup-hook.sh b/pkgs/development/libraries/dleyna-core/setup-hook.sh
index 87b5c67dff5..287ad4dc189 100644
--- a/pkgs/development/libraries/dleyna-core/setup-hook.sh
+++ b/pkgs/development/libraries/dleyna-core/setup-hook.sh
@@ -1,7 +1,7 @@
 addDleynaConnectorPath () {
     if test -d "$1/lib/dleyna-1.0/connectors"
     then
-        export DLEYNA_CONNECTOR_PATH="${DLEYNA_CONNECTOR_PATH}${DLEYNA_CONNECTOR_PATH:+:}$1/lib/dleyna-1.0/connectors"
+        export DLEYNA_CONNECTOR_PATH="${DLEYNA_CONNECTOR_PATH-}${DLEYNA_CONNECTOR_PATH:+:}$1/lib/dleyna-1.0/connectors"
     fi
 }
 
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index b3310e44ae0..ccdf4662719 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -3,6 +3,8 @@
 , libssh, libtheora, libva, libdrm, libvorbis, libvpx, lzma, libpulseaudio, soxr
 , x264, x265, xvidcore, zlib, libopus, speex, nv-codec-headers, dav1d
 , openglSupport ? false, libGLU_combined ? null
+, libmfxSupport ? false, intel-media-sdk ? null
+, libaomSupport ? false, libaom ? null
 # Build options
 , runtimeCpuDetectBuild ? true # Detect CPU capabilities at runtime
 , multithreadBuild ? true # Multithreading via pthreads/win32 threads
@@ -62,6 +64,8 @@ let
 in
 
 assert openglSupport -> libGLU_combined != null;
+assert libmfxSupport -> intel-media-sdk != null;
+assert libaomSupport -> libaom != null;
 
 stdenv.mkDerivation rec {
 
@@ -135,6 +139,8 @@ stdenv.mkDerivation rec {
       (ifMinVer "0.6" (enableFeature vpxSupport "libvpx"))
       (ifMinVer "2.4" "--enable-lzma")
       (ifMinVer "2.2" (enableFeature openglSupport "opengl"))
+      (ifMinVer "4.2" (enableFeature libmfxSupport "libmfx"))
+      (ifMinVer "4.2" (enableFeature libaomSupport "libaom"))
       (disDarwinOrArmFix (ifMinVer "0.9" "--enable-libpulse") "0.9" "--disable-libpulse")
       (ifMinVer "2.5" (if sdlSupport && reqMin "3.2" then "--enable-sdl2" else if sdlSupport then "--enable-sdl" else null)) # autodetected before 2.5, SDL1 support removed in 3.2 for SDL2
       (ifMinVer "1.2" "--enable-libsoxr")
@@ -163,6 +169,8 @@ stdenv.mkDerivation rec {
     bzip2 fontconfig freetype gnutls libiconv lame libass libogg libssh libtheora
     libvdpau libvorbis lzma soxr x264 x265 xvidcore zlib libopus speex nv-codec-headers
   ] ++ optional openglSupport libGLU_combined
+    ++ optional libmfxSupport intel-media-sdk
+    ++ optional vpxSupport libaom
     ++ optional vpxSupport libvpx
     ++ optionals (!isDarwin && !isAarch32) [ libpulseaudio ] # Need to be fixed on Darwin and ARM
     ++ optional ((isLinux || isFreeBSD) && !isAarch32) libva
diff --git a/pkgs/development/libraries/fltk/default.nix b/pkgs/development/libraries/fltk/default.nix
index ad317b06bbb..fe7de504b4f 100644
--- a/pkgs/development/libraries/fltk/default.nix
+++ b/pkgs/development/libraries/fltk/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, pkgconfig, xlibsWrapper, xorgproto, libXi
-, freeglut, libGLU_combined, libjpeg, zlib, libXft, libpng
+, freeglut, libGL, libGLU, libjpeg, zlib, libXft, libpng
 , libtiff, freetype, Cocoa, AGL, GLUT
 }:
 
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
   patches = stdenv.lib.optionals stdenv.isDarwin [ ./nsosv.patch ];
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ libGLU_combined libjpeg zlib libpng libXft ]
+  buildInputs = [ libGLU libGL libjpeg zlib libpng libXft ]
     ++ stdenv.lib.optional stdenv.isDarwin [ AGL Cocoa GLUT ];
 
   propagatedBuildInputs = [ xorgproto ]
diff --git a/pkgs/development/libraries/ftgl/default.nix b/pkgs/development/libraries/ftgl/default.nix
index 289a5739985..a99228efcf4 100644
--- a/pkgs/development/libraries/ftgl/default.nix
+++ b/pkgs/development/libraries/ftgl/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, freetype, libGLU_combined, OpenGL }:
+{ stdenv, fetchurl, freetype, libGL, libGLU, OpenGL }:
 
 let
   name = "ftgl-2.1.3-rc5";
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
     ++ (if stdenv.isDarwin then
       [ OpenGL ]
     else
-      [ libGLU_combined ])
+      [ libGL libGLU ])
     ;
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/gcr/default.nix b/pkgs/development/libraries/gcr/default.nix
index 1947d40dc85..cf0f22fdd40 100644
--- a/pkgs/development/libraries/gcr/default.nix
+++ b/pkgs/development/libraries/gcr/default.nix
@@ -1,49 +1,84 @@
-{ stdenv, fetchurl, pkgconfig, gettext, gnupg, p11-kit, glib
-, libgcrypt, libtasn1, dbus-glib, gtk3, pango, gdk-pixbuf, atk
-, gobject-introspection, makeWrapper, libxslt, vala, gnome3
-, python3 }:
+{ stdenv
+, fetchurl
+, pkgconfig
+, gettext
+, gnupg
+, p11-kit
+, glib
+, libgcrypt
+, libtasn1
+, gtk3
+, pango
+, gobject-introspection
+, makeWrapper
+, libxslt
+, vala
+, gnome3
+, python3
+}:
 
 stdenv.mkDerivation rec {
   pname = "gcr";
-  version = "3.33.4";
+  version = "3.34.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1hf06p4qfyywnb6334ysnr6aqxik3srb37glclvr4yhb3wzrjqnm";
-  };
-
-  passthru = {
-    updateScript = gnome3.updateScript { packageName = pname; };
+    sha256 = "0925snsixzkwh49xiayqmj6fcrmklqk8kyy0jkv7m64h9abm1pr9";
   };
 
   postPatch = ''
-    patchShebangs .
+    patchShebangs build/ gcr/fixtures/
   '';
 
   outputs = [ "out" "dev" ];
 
-  nativeBuildInputs = [ pkgconfig gettext gobject-introspection libxslt makeWrapper vala ];
+  nativeBuildInputs = [
+    pkgconfig
+    gettext
+    gobject-introspection
+    libxslt
+    makeWrapper
+    vala
+  ];
+
+  buildInputs = [
+    gnupg
+    libgcrypt
+    libtasn1
+    pango
+  ];
 
-  buildInputs = [ gnupg libgcrypt libtasn1 dbus-glib pango gdk-pixbuf atk ];
+  propagatedBuildInputs = [
+    glib
+    gtk3
+    p11-kit
+  ];
 
-  propagatedBuildInputs = [ glib gtk3 p11-kit ];
+  checkInputs = [
+    python3
+  ];
 
-  checkInputs = [ python3 ];
   doCheck = false; # fails 21 out of 603 tests, needs dbus daemon
 
-  #enableParallelBuilding = true; issues on hydra
+  enableParallelBuilding = true;
 
   preFixup = ''
     wrapProgram "$out/bin/gcr-viewer" \
       --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH"
   '';
 
+  passthru = {
+    updateScript = gnome3.updateScript {
+      packageName = pname;
+    };
+  };
+
   meta = with stdenv.lib; {
     platforms = platforms.linux;
     maintainers = gnome3.maintainers;
     description = "GNOME crypto services (daemon and tools)";
-    homepage    = https://gitlab.gnome.org/GNOME/gcr;
-    license     = licenses.gpl2;
+    homepage = "https://gitlab.gnome.org/GNOME/gcr";
+    license = licenses.lgpl2Plus;
 
     longDescription = ''
       GCR is a library for displaying certificates, and crypto UI, accessing
diff --git a/pkgs/development/libraries/gdk-pixbuf/setup-hook.sh b/pkgs/development/libraries/gdk-pixbuf/setup-hook.sh
index 5a7dcd79299..8b6c80867a0 100644
--- a/pkgs/development/libraries/gdk-pixbuf/setup-hook.sh
+++ b/pkgs/development/libraries/gdk-pixbuf/setup-hook.sh
@@ -2,9 +2,9 @@ findGdkPixbufLoaders() {
 
 	# choose the longest loaders.cache
 	local loadersCache="$1/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache"
-	if [ -f "$loadersCache" ]; then
-		if [ -f "$GDK_PIXBUF_MODULE_FILE" ]; then
-			if [ $(cat "$loadersCache"|wc -l) -gt $(cat "$GDK_PIXBUF_MODULE_FILE"|wc -l) ]; then
+	if [[ -f "$loadersCache" ]]; then
+		if [[ -f "${GDK_PIXBUF_MODULE_FILE-}" ]]; then
+			if [[ "$(cat "$loadersCache" | wc -l)" > "$(cat "$GDK_PIXBUF_MODULE_FILE" | wc -l)" ]]; then
 				export GDK_PIXBUF_MODULE_FILE="$loadersCache"
 			fi
 		else
diff --git a/pkgs/development/libraries/gettext/CVE-2018-18751-bison.patch b/pkgs/development/libraries/gettext/CVE-2018-18751-bison.patch
deleted file mode 100644
index b734c1c8b02..00000000000
--- a/pkgs/development/libraries/gettext/CVE-2018-18751-bison.patch
+++ /dev/null
@@ -1,323 +0,0 @@
-This patch was generated by re-running Bison 3.0.4 on pro-gram-gen.y after
-applying CVE-2018-18751.patch. This patch removes the need to add bison to
-nativeBuildInputs.
-
---- a/gettext-tools/src/po-gram-gen.c
-+++ b/gettext-tools/src/po-gram-gen.c
-@@ -568,9 +568,9 @@ static const yytype_uint8 yytranslate[] =
- static const yytype_uint16 yyrline[] =
- {
-        0,   169,   169,   171,   172,   173,   174,   179,   187,   195,
--     216,   240,   249,   258,   269,   278,   292,   301,   315,   321,
--     332,   338,   350,   361,   372,   376,   391,   414,   422,   434,
--     442
-+     216,   237,   246,   255,   266,   275,   289,   298,   312,   318,
-+     329,   335,   347,   358,   369,   373,   388,   411,   419,   431,
-+     439
- };
- #endif
-
-@@ -1419,14 +1419,11 @@ yyreduce:
-                   check_obsolete ((yyvsp[-3].message_intro), (yyvsp[-1].string));
-                   check_obsolete ((yyvsp[-3].message_intro), (yyvsp[0].rhs));
-                   if (!(yyvsp[-3].message_intro).obsolete || pass_obsolete_entries)
--                    {
--                      do_callback_message ((yyvsp[-3].message_intro).ctxt, string2, &(yyvsp[-3].message_intro).pos, (yyvsp[-1].string).string,
--                                           (yyvsp[0].rhs).rhs.msgstr, (yyvsp[0].rhs).rhs.msgstr_len, &(yyvsp[0].rhs).pos,
--                                           (yyvsp[-3].message_intro).prev_ctxt,
--                                           (yyvsp[-3].message_intro).prev_id, (yyvsp[-3].message_intro).prev_id_plural,
--                                           (yyvsp[-3].message_intro).obsolete);
--                      free ((yyvsp[-1].string).string);
--                    }
-+                    do_callback_message ((yyvsp[-3].message_intro).ctxt, string2, &(yyvsp[-3].message_intro).pos, (yyvsp[-1].string).string,
-+                                         (yyvsp[0].rhs).rhs.msgstr, (yyvsp[0].rhs).rhs.msgstr_len, &(yyvsp[0].rhs).pos,
-+                                         (yyvsp[-3].message_intro).prev_ctxt,
-+                                         (yyvsp[-3].message_intro).prev_id, (yyvsp[-3].message_intro).prev_id_plural,
-+                                         (yyvsp[-3].message_intro).obsolete);
-                   else
-                     {
-                       free_message_intro ((yyvsp[-3].message_intro));
-@@ -1435,11 +1432,11 @@ yyreduce:
-                       free ((yyvsp[0].rhs).rhs.msgstr);
-                     }
-                 }
--#line 1439 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1436 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 11:
--#line 241 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 238 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-2].message_intro), (yyvsp[-1].stringlist));
-                   check_obsolete ((yyvsp[-2].message_intro), (yyvsp[0].string));
-@@ -1448,11 +1445,11 @@ yyreduce:
-                   string_list_destroy (&(yyvsp[-1].stringlist).stringlist);
-                   free ((yyvsp[0].string).string);
-                 }
--#line 1452 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1449 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 12:
--#line 250 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 247 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-2].message_intro), (yyvsp[-1].stringlist));
-                   check_obsolete ((yyvsp[-2].message_intro), (yyvsp[0].rhs));
-@@ -1461,22 +1458,22 @@ yyreduce:
-                   string_list_destroy (&(yyvsp[-1].stringlist).stringlist);
-                   free ((yyvsp[0].rhs).rhs.msgstr);
-                 }
--#line 1465 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1462 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 13:
--#line 259 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 256 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-1].message_intro), (yyvsp[0].stringlist));
-                   po_gram_error_at_line (&(yyvsp[-1].message_intro).pos, _("missing 'msgstr' section"));
-                   free_message_intro ((yyvsp[-1].message_intro));
-                   string_list_destroy (&(yyvsp[0].stringlist).stringlist);
-                 }
--#line 1476 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1473 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 14:
--#line 270 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 267 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   (yyval.message_intro).prev_ctxt = NULL;
-                   (yyval.message_intro).prev_id = NULL;
-@@ -1485,11 +1482,11 @@ yyreduce:
-                   (yyval.message_intro).pos = (yyvsp[0].string).pos;
-                   (yyval.message_intro).obsolete = (yyvsp[0].string).obsolete;
-                 }
--#line 1489 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1486 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 15:
--#line 279 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 276 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-1].prev), (yyvsp[0].string));
-                   (yyval.message_intro).prev_ctxt = (yyvsp[-1].prev).ctxt;
-@@ -1499,11 +1496,11 @@ yyreduce:
-                   (yyval.message_intro).pos = (yyvsp[0].string).pos;
-                   (yyval.message_intro).obsolete = (yyvsp[0].string).obsolete;
-                 }
--#line 1503 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1500 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 16:
--#line 293 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 290 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-1].string), (yyvsp[0].stringlist));
-                   (yyval.prev).ctxt = (yyvsp[-1].string).string;
-@@ -1512,11 +1509,11 @@ yyreduce:
-                   (yyval.prev).pos = (yyvsp[-1].string).pos;
-                   (yyval.prev).obsolete = (yyvsp[-1].string).obsolete;
-                 }
--#line 1516 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1513 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 17:
--#line 302 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 299 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-2].string), (yyvsp[-1].stringlist));
-                   check_obsolete ((yyvsp[-2].string), (yyvsp[0].string));
-@@ -1526,21 +1523,21 @@ yyreduce:
-                   (yyval.prev).pos = (yyvsp[-2].string).pos;
-                   (yyval.prev).obsolete = (yyvsp[-2].string).obsolete;
-                 }
--#line 1530 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1527 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 18:
--#line 316 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 313 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   (yyval.string).string = NULL;
-                   (yyval.string).pos = (yyvsp[0].pos).pos;
-                   (yyval.string).obsolete = (yyvsp[0].pos).obsolete;
-                 }
--#line 1540 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1537 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 19:
--#line 322 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 319 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-2].pos), (yyvsp[-1].stringlist));
-                   check_obsolete ((yyvsp[-2].pos), (yyvsp[0].pos));
-@@ -1548,21 +1545,21 @@ yyreduce:
-                   (yyval.string).pos = (yyvsp[0].pos).pos;
-                   (yyval.string).obsolete = (yyvsp[0].pos).obsolete;
-                 }
--#line 1552 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1549 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 20:
--#line 333 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 330 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   (yyval.string).string = NULL;
-                   (yyval.string).pos = (yyvsp[0].pos).pos;
-                   (yyval.string).obsolete = (yyvsp[0].pos).obsolete;
-                 }
--#line 1562 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1559 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 21:
--#line 339 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 336 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-2].pos), (yyvsp[-1].stringlist));
-                   check_obsolete ((yyvsp[-2].pos), (yyvsp[0].pos));
-@@ -1570,11 +1567,11 @@ yyreduce:
-                   (yyval.string).pos = (yyvsp[0].pos).pos;
-                   (yyval.string).obsolete = (yyvsp[0].pos).obsolete;
-                 }
--#line 1574 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1571 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 22:
--#line 351 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 348 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-1].pos), (yyvsp[0].stringlist));
-                   plural_counter = 0;
-@@ -1582,30 +1579,30 @@ yyreduce:
-                   (yyval.string).pos = (yyvsp[-1].pos).pos;
-                   (yyval.string).obsolete = (yyvsp[-1].pos).obsolete;
-                 }
--#line 1586 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1583 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 23:
--#line 362 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 359 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-1].pos), (yyvsp[0].stringlist));
-                   (yyval.string).string = string_list_concat_destroy (&(yyvsp[0].stringlist).stringlist);
-                   (yyval.string).pos = (yyvsp[-1].pos).pos;
-                   (yyval.string).obsolete = (yyvsp[-1].pos).obsolete;
-                 }
--#line 1597 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1594 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 24:
--#line 373 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 370 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   (yyval.rhs) = (yyvsp[0].rhs);
-                 }
--#line 1605 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1602 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 25:
--#line 377 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 374 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-1].rhs), (yyvsp[0].rhs));
-                   (yyval.rhs).rhs.msgstr = XNMALLOC ((yyvsp[-1].rhs).rhs.msgstr_len + (yyvsp[0].rhs).rhs.msgstr_len, char);
-@@ -1617,11 +1614,11 @@ yyreduce:
-                   (yyval.rhs).pos = (yyvsp[-1].rhs).pos;
-                   (yyval.rhs).obsolete = (yyvsp[-1].rhs).obsolete;
-                 }
--#line 1621 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1618 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 26:
--#line 392 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 389 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-4].pos), (yyvsp[-3].pos));
-                   check_obsolete ((yyvsp[-4].pos), (yyvsp[-2].number));
-@@ -1640,11 +1637,11 @@ yyreduce:
-                   (yyval.rhs).pos = (yyvsp[-4].pos).pos;
-                   (yyval.rhs).obsolete = (yyvsp[-4].pos).obsolete;
-                 }
--#line 1644 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1641 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 27:
--#line 415 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 412 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   string_list_init (&(yyval.stringlist).stringlist);
-                   string_list_append (&(yyval.stringlist).stringlist, (yyvsp[0].string).string);
-@@ -1652,11 +1649,11 @@ yyreduce:
-                   (yyval.stringlist).pos = (yyvsp[0].string).pos;
-                   (yyval.stringlist).obsolete = (yyvsp[0].string).obsolete;
-                 }
--#line 1656 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1653 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 28:
--#line 423 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 420 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-1].stringlist), (yyvsp[0].string));
-                   (yyval.stringlist).stringlist = (yyvsp[-1].stringlist).stringlist;
-@@ -1665,11 +1662,11 @@ yyreduce:
-                   (yyval.stringlist).pos = (yyvsp[-1].stringlist).pos;
-                   (yyval.stringlist).obsolete = (yyvsp[-1].stringlist).obsolete;
-                 }
--#line 1669 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1666 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 29:
--#line 435 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 432 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   string_list_init (&(yyval.stringlist).stringlist);
-                   string_list_append (&(yyval.stringlist).stringlist, (yyvsp[0].string).string);
-@@ -1677,11 +1674,11 @@ yyreduce:
-                   (yyval.stringlist).pos = (yyvsp[0].string).pos;
-                   (yyval.stringlist).obsolete = (yyvsp[0].string).obsolete;
-                 }
--#line 1681 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1678 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 30:
--#line 443 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 440 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-1].stringlist), (yyvsp[0].string));
-                   (yyval.stringlist).stringlist = (yyvsp[-1].stringlist).stringlist;
-@@ -1690,11 +1687,11 @@ yyreduce:
-                   (yyval.stringlist).pos = (yyvsp[-1].stringlist).pos;
-                   (yyval.stringlist).obsolete = (yyvsp[-1].stringlist).obsolete;
-                 }
--#line 1694 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1691 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-
--#line 1698 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1695 "po-gram-gen.c" /* yacc.c:1646  */
-       default: break;
-     }
-   /* User semantic actions sometimes alter yychar, and that requires
diff --git a/pkgs/development/libraries/gettext/default.nix b/pkgs/development/libraries/gettext/default.nix
index 9547c6c31ad..157f801d2f2 100644
--- a/pkgs/development/libraries/gettext/default.nix
+++ b/pkgs/development/libraries/gettext/default.nix
@@ -1,24 +1,16 @@
-{ stdenv, lib, fetchurl, libiconv, xz, bison, automake115x, autoconf }:
+{ stdenv, lib, fetchurl, libiconv, xz }:
 
-let allowBisonDependency = !stdenv.isDarwin; in
 stdenv.mkDerivation rec {
   pname = "gettext";
-  version = "0.19.8.1";
+  version = "0.20.1";
 
   src = fetchurl {
     url = "mirror://gnu/gettext/${pname}-${version}.tar.gz";
-    sha256 = "0hsw28f9q9xaggjlsdp2qmbp2rbd1mp0njzan2ld9kiqwkq2m57z";
+    sha256 = "0p3zwkk27wm2m2ccfqm57nj7vqkmfpn7ja1nf65zmhz8qqs5chb6";
   };
   patches = [
     ./absolute-paths.diff
-    (fetchurl {
-      name = "CVE-2018-18751.patch";
-      url = "https://git.savannah.gnu.org/gitweb/?p=gettext.git;a=patch;h=dce3a16e5e9368245735e29bf498dcd5e3e474a4";
-      sha256 = "1lpjwwcjr1sb879faj0xyzw02kma0ivab6xwn3qciy13qy6fq5xn";
-    })
-  ] ++ lib.optionals (!allowBisonDependency) [
-    # Only necessary for CVE-2018-18751.patch:
-    ./CVE-2018-18751-bison.patch
+    ./gettext.git-2336451ed68d91ff4b5ae1acbc1eca30e47a86a9.patch
   ];
 
   outputs = [ "out" "man" "doc" "info" ];
@@ -29,10 +21,6 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
      "--disable-csharp" "--with-xz"
-     # avoid retaining reference to CF during stdenv bootstrap
-  ] ++ lib.optionals stdenv.isDarwin [
-    "gt_cv_func_CFPreferencesCopyAppValue=no"
-    "gt_cv_func_CFLocaleCopyCurrent=no"
   ] ++ stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     # On cross building, gettext supposes that the wchar.h from libc
     # does not fulfill gettext needs, so it tries to work with its
@@ -54,14 +42,6 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     xz
     xz.bin
-  ]
-  # Only necessary for CVE-2018-18751.patch (unless CVE-2018-18751-bison.patch
-  # is also applied):
-  ++ lib.optional allowBisonDependency bison
-  ++ [
-    # Only necessary for CVE-2018-18751.patch:
-    automake115x
-    autoconf
   ];
   # HACK, see #10874 (and 14664)
   buildInputs = stdenv.lib.optional (!stdenv.isLinux && !stdenv.hostPlatform.isCygwin) libiconv;
diff --git a/pkgs/development/libraries/gettext/gettext-setup-hook.sh b/pkgs/development/libraries/gettext/gettext-setup-hook.sh
index ad3763c29b6..69020146f84 100644
--- a/pkgs/development/libraries/gettext/gettext-setup-hook.sh
+++ b/pkgs/development/libraries/gettext/gettext-setup-hook.sh
@@ -10,7 +10,7 @@ addEnvHooks "$hostOffset" gettextDataDirsHook
 
 # libintl must be listed in load flags on non-Glibc
 # it doesn't hurt to have it in Glibc either though
-if [ -n "@gettextNeedsLdflags@" -a -z "$dontAddExtraLibs" ]; then
+if [ -n "@gettextNeedsLdflags@" -a -z "${dontAddExtraLibs-}" ]; then
     # See pkgs/build-support/setup-hooks/role.bash
     getHostRole
     export NIX_${role_pre}LDFLAGS+=" -lintl"
diff --git a/pkgs/development/libraries/gettext/gettext.git-2336451ed68d91ff4b5ae1acbc1eca30e47a86a9.patch b/pkgs/development/libraries/gettext/gettext.git-2336451ed68d91ff4b5ae1acbc1eca30e47a86a9.patch
new file mode 100644
index 00000000000..4a19b11507a
--- /dev/null
+++ b/pkgs/development/libraries/gettext/gettext.git-2336451ed68d91ff4b5ae1acbc1eca30e47a86a9.patch
@@ -0,0 +1,82 @@
+From 2336451ed68d91ff4b5ae1acbc1eca30e47a86a9 Mon Sep 17 00:00:00 2001
+From: Bruno Haible <bruno@clisp.org>
+Date: Sun, 19 May 2019 13:10:06 +0200
+Subject: [PATCH] msgmerge: Fix behaviour of --for-msgfmt on PO files with no
+ translations.
+
+Reported by Don Lawrence <dlawrence@iecok.com>
+in <https://lists.freedesktop.org/archives/p11-glue/2019-May/000700.html>
+via Daiki Ueno
+in <https://lists.gnu.org/archive/html/bug-gettext/2019-05/msg00124.html>.
+
+* gettext-tools/src/msgmerge.c (main): Treat force_po like true if for_msgfmt
+is true.
+* gettext-tools/tests/msgmerge-26: Add test of PO file with no translations.
+---
+ gettext-tools/src/msgmerge.c    |  4 ++--
+ gettext-tools/tests/msgmerge-26 | 36 +++++++++++++++++++++++++++++++++---
+ 2 files changed, 35 insertions(+), 5 deletions(-)
+
+diff --git a/gettext-tools/src/msgmerge.c b/gettext-tools/src/msgmerge.c
+index cd762c0..92c9b7a 100644
+--- a/gettext-tools/src/msgmerge.c
++++ b/gettext-tools/src/msgmerge.c
+@@ -520,8 +520,8 @@ There is NO WARRANTY, to the extent permitted by law.\n\
+   else
+     {
+       /* Write the merged message list out.  */
+-      msgdomain_list_print (result, output_file, output_syntax, force_po,
+-                            false);
++      msgdomain_list_print (result, output_file, output_syntax,
++                            for_msgfmt || force_po, false);
+     }
+ 
+   exit (EXIT_SUCCESS);
+diff --git a/gettext-tools/tests/msgmerge-26 b/gettext-tools/tests/msgmerge-26
+index cd3862e..b86f7a0 100755
+--- a/gettext-tools/tests/msgmerge-26
++++ b/gettext-tools/tests/msgmerge-26
+@@ -73,7 +73,37 @@ msgstr "Papaya"
+ EOF
+ 
+ : ${DIFF=diff}
+-${DIFF} mm-test26.ok mm-test26.out
+-result=$?
++${DIFF} mm-test26.ok mm-test26.out || Exit 1
+ 
+-exit $result
++# Test with a PO file that has no translated messages.
++
++cat <<\EOF > mm-test26a.in1
++msgid ""
++msgstr ""
++"Content-Type: text/plain; charset=UTF-8\n"
++
++msgid "Hello world"
++msgstr "Hallo Welt"
++EOF
++
++cat <<\EOF > mm-test26a.in2
++msgid ""
++msgstr ""
++"Content-Type: text/plain; charset=ASCII\n"
++
++msgid "Hello, world!"
++msgstr ""
++EOF
++
++: ${MSGMERGE=msgmerge}
++${MSGMERGE} --for-msgfmt -o mm-test26a.tmp mm-test26a.in1 mm-test26a.in2 \
++    || Exit 1
++LC_ALL=C tr -d '\r' < mm-test26a.tmp > mm-test26a.out || Exit 1
++
++cat <<\EOF > mm-test26a.ok
++msgid ""
++msgstr "Content-Type: text/plain; charset=UTF-8\n"
++EOF
++
++: ${DIFF=diff}
++${DIFF} mm-test26a.ok mm-test26a.out || Exit 1
+-- 
+1.9.1
+
diff --git a/pkgs/development/libraries/gle/default.nix b/pkgs/development/libraries/gle/default.nix
index dd72637f2eb..d656473ba80 100644
--- a/pkgs/development/libraries/gle/default.nix
+++ b/pkgs/development/libraries/gle/default.nix
@@ -1,7 +1,7 @@
-{stdenv, fetchurl, libGLU_combined, freeglut, libX11, libXt, libXmu, libXi, libXext}:
+{stdenv, fetchurl, freeglut, libX11, libXt, libXmu, libXi, libXext, libGL, libGLU}:
 stdenv.mkDerivation {
   name = "gle-3.1.0";
-  buildInputs = [libGLU_combined freeglut libX11 libXt libXmu libXi libXext];
+  buildInputs = [libGLU libGL freeglut libX11 libXt libXmu libXi libXext];
   src = fetchurl {
     urls = [
       "mirror://sourceforge/project/gle/gle/gle-3.1.0/gle-3.1.0.tar.gz"
diff --git a/pkgs/development/libraries/glib/setup-hook.sh b/pkgs/development/libraries/glib/setup-hook.sh
index a1cb1f40c58..20714ea7ab8 100644
--- a/pkgs/development/libraries/glib/setup-hook.sh
+++ b/pkgs/development/libraries/glib/setup-hook.sh
@@ -1,9 +1,11 @@
 
 make_glib_find_gsettings_schemas() {
     # For packages that need gschemas of other packages (e.g. empathy)
-    if [ -d "$1"/share/gsettings-schemas/*/glib-2.0/schemas ]; then
-        addToSearchPath GSETTINGS_SCHEMAS_PATH "$1/share/gsettings-schemas/"*
-    fi
+    for maybe_dir in "$1"/share/gsettings-schemas/*/glib-2.0; do
+        if [[ -d "$maybe_dir/schemas" ]]; then
+            addToSearchPath GSETTINGS_SCHEMAS_PATH "$maybe_dir"
+        fi
+    done
 }
 addEnvHooks "$hostOffset" make_glib_find_gsettings_schemas
 
diff --git a/pkgs/development/libraries/gnu-efi/default.nix b/pkgs/development/libraries/gnu-efi/default.nix
index 0d704f74c1e..b5b8add2db5 100644
--- a/pkgs/development/libraries/gnu-efi/default.nix
+++ b/pkgs/development/libraries/gnu-efi/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildPackages, fetchurl, pciutils }:
+{ stdenv, buildPackages, fetchurl, fetchpatch, pciutils }:
 
 with stdenv.lib;
 
@@ -11,6 +11,14 @@ stdenv.mkDerivation rec {
     sha256 = "1ffnc4xbzfggs37ymrgfx76j56kk2644c081ivhr2bjkla9ag3gj";
   };
 
+  patches = [
+    # Fix build on armv6l
+    (fetchpatch {
+      url = "https://sourceforge.net/p/gnu-efi/patches/_discuss/thread/25bb273a18/9c4d/attachment/0001-Fix-ARCH-on-armv6-and-other-32-bit-ARM-platforms.patch";
+      sha256 = "0pj03h20g2bbz6fr753bj1scry6919h57l1h86z3b6q7hqfj0b4r";
+    })
+  ];
+
   buildInputs = [ pciutils ];
 
   hardeningDisable = [ "stackprotector" ];
diff --git a/pkgs/development/libraries/gstreamer/core/setup-hook.sh b/pkgs/development/libraries/gstreamer/core/setup-hook.sh
index b8c741af578..026a4e5f55a 100644
--- a/pkgs/development/libraries/gstreamer/core/setup-hook.sh
+++ b/pkgs/development/libraries/gstreamer/core/setup-hook.sh
@@ -1,7 +1,7 @@
 addGstreamer1LibPath () {
     if test -d "$1/lib/gstreamer-1.0"
     then
-        export GST_PLUGIN_SYSTEM_PATH_1_0="${GST_PLUGIN_SYSTEM_PATH_1_0}${GST_PLUGIN_SYSTEM_PATH_1_0:+:}$1/lib/gstreamer-1.0"
+        export GST_PLUGIN_SYSTEM_PATH_1_0="${GST_PLUGIN_SYSTEM_PATH_1_0-}${GST_PLUGIN_SYSTEM_PATH_1_0:+:}$1/lib/gstreamer-1.0"
     fi
 }
 
diff --git a/pkgs/development/libraries/gstreamer/legacy/gst-plugins-base/default.nix b/pkgs/development/libraries/gstreamer/legacy/gst-plugins-base/default.nix
index 5a942b49cc0..eed9d423fdb 100644
--- a/pkgs/development/libraries/gstreamer/legacy/gst-plugins-base/default.nix
+++ b/pkgs/development/libraries/gstreamer/legacy/gst-plugins-base/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, stdenv, pkgconfig, gstreamer, xorg, alsaLib, cdparanoia
+{ fetchurl, fetchpatch, stdenv, pkgconfig, gstreamer, xorg, alsaLib, cdparanoia
 , libogg, libtheora, libvorbis, freetype, pango, liboil, glib, cairo, orc
 , libintl
 , ApplicationServices
@@ -20,10 +20,10 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./gcc-4.9.patch
-    (fetchurl {
+    (fetchpatch {
       url = "https://gitlab.freedesktop.org/gstreamer/gst-plugins-base/commit/f672277509705c4034bc92a141eefee4524d15aa.patch";
       name = "CVE-2019-9928.patch";
-      sha256 = "0hz3lsq3ppmaf329sbyi05y1qniqfj9vlp2f3z918383pvrcms4i";
+      sha256 = "1dlamsmyr7chrb6vqqmwikqvvqcx5l7k72p98448qm6k59ndnimc";
     })
   ];
 
diff --git a/pkgs/development/libraries/gstreamer/legacy/gstreamer/setup-hook.sh b/pkgs/development/libraries/gstreamer/legacy/gstreamer/setup-hook.sh
index 65ce2611251..636e20b732b 100644
--- a/pkgs/development/libraries/gstreamer/legacy/gstreamer/setup-hook.sh
+++ b/pkgs/development/libraries/gstreamer/legacy/gstreamer/setup-hook.sh
@@ -1,7 +1,7 @@
 addGstreamerLibPath () {
     if test -d "$1/lib/gstreamer-0.10"
     then
-        export GST_PLUGIN_SYSTEM_PATH="${GST_PLUGIN_SYSTEM_PATH}${GST_PLUGIN_SYSTEM_PATH:+:}$1/lib/gstreamer-0.10"
+        export GST_PLUGIN_SYSTEM_PATH="${GST_PLUGIN_SYSTEM_PATH-}${GST_PLUGIN_SYSTEM_PATH:+:}$1/lib/gstreamer-0.10"
     fi
 }
 
diff --git a/pkgs/development/libraries/gtk/hooks/drop-icon-theme-cache.sh b/pkgs/development/libraries/gtk/hooks/drop-icon-theme-cache.sh
index 8f2cb8a334a..f28a856c4f5 100644
--- a/pkgs/development/libraries/gtk/hooks/drop-icon-theme-cache.sh
+++ b/pkgs/development/libraries/gtk/hooks/drop-icon-theme-cache.sh
@@ -16,4 +16,4 @@ dropIconThemeCache() {
     fi
 }
 
-preFixupPhases="$preFixupPhases dropIconThemeCache"
+preFixupPhases="${preFixupPhases-} dropIconThemeCache"
diff --git a/pkgs/development/libraries/icu/base.nix b/pkgs/development/libraries/icu/base.nix
index 0a8cb7d4684..47ca63fca99 100644
--- a/pkgs/development/libraries/icu/base.nix
+++ b/pkgs/development/libraries/icu/base.nix
@@ -63,10 +63,16 @@ let
     # remove dependency on bootstrap-tools in early stdenv build
     postInstall = stdenv.lib.optionalString stdenv.isDarwin ''
       sed -i 's/INSTALL_CMD=.*install/INSTALL_CMD=install/' $out/lib/icu/${version}/pkgdata.inc
-    '' + ''
+    '' + (let
+      replacements = [
+        { from = "\${prefix}/include"; to = "${placeholder "dev"}/include"; } # --cppflags-searchpath
+        { from = "\${pkglibdir}/Makefile.inc"; to = "${placeholder "dev"}/lib/icu/Makefile.inc"; } # --incfile
+        { from = "\${pkglibdir}/pkgdata.inc"; to = "${placeholder "dev"}/lib/icu/pkgdata.inc"; } # --incpkgdatafile
+      ];
+    in ''
       substituteInPlace "$dev/bin/icu-config" \
-        --replace \''${pkglibdir}/Makefile.inc "$dev/lib/icu/Makefile.inc"
-    '';
+        ${lib.concatMapStringsSep " " (r: "--replace '${r.from}' '${r.to}'") replacements}
+    '');
 
     postFixup = ''moveToOutput lib/icu "$dev" '';
   };
diff --git a/pkgs/development/libraries/kde-frameworks/default.nix b/pkgs/development/libraries/kde-frameworks/default.nix
index ef1171b1760..aa9f95eebd3 100644
--- a/pkgs/development/libraries/kde-frameworks/default.nix
+++ b/pkgs/development/libraries/kde-frameworks/default.nix
@@ -42,7 +42,7 @@ let
       propagate = out:
         let setupHook = { writeScript }:
               writeScript "setup-hook" ''
-                if [ "$hookName" != postHook ]; then
+                if [ "${hookName:-}" != postHook ]; then
                     postHooks+=("source @dev@/nix-support/setup-hook")
                 else
                     # Propagate $dev so that this setup hook is propagated
diff --git a/pkgs/development/libraries/leptonica/default.nix b/pkgs/development/libraries/leptonica/default.nix
index 62c01e4f356..e26f4f6022a 100644
--- a/pkgs/development/libraries/leptonica/default.nix
+++ b/pkgs/development/libraries/leptonica/default.nix
@@ -16,7 +16,9 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   checkInputs = [ which gnuplot ];
-  doCheck = !stdenv.isDarwin;
+
+  # Fails on pngio_reg for unknown reason
+  doCheck = false; # !stdenv.isDarwin;
 
   meta = {
     description = "Image processing and analysis library";
diff --git a/pkgs/development/libraries/libglvnd/default.nix b/pkgs/development/libraries/libglvnd/default.nix
index 30b27d9329a..5df1246a0eb 100644
--- a/pkgs/development/libraries/libglvnd/default.nix
+++ b/pkgs/development/libraries/libglvnd/default.nix
@@ -14,6 +14,22 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook pkgconfig python2 addOpenGLRunpath ];
   buildInputs = [ libX11 libXext xorgproto ];
 
+  # The following 3 patches should be removed once libglvnd >1.2.0 is released
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/NVIDIA/libglvnd/commit/6f52473dac08c44b081b792874b4ce73122096da.patch";
+      sha256 = "0rd9ihl8n33cm0rya5a7ki0hn31fh52r0gaj5d4w80jrsah2ayij";
+    })
+    (fetchpatch {
+      url = "https://github.com/NVIDIA/libglvnd/commit/51233cc52cbcbe25f8461830913c06f5b5bc9508.patch";
+      sha256 = "1qx3nw8vq5xcrixmi7xw1vpy4gbf7kmx38rx8wg8x046g4mv8ijj";
+    })
+    (fetchpatch {
+      url = "https://github.com/NVIDIA/libglvnd/commit/5dfdc5a6dc60a3bdc63cd4510dabacba388da13a.patch";
+      sha256 = "0gmb3619yz3z7n22afjh8p2y13bmsky4r0z0csm14is3wvdi64ya";
+    })
+  ];
+
   postPatch = lib.optionalString stdenv.isDarwin ''
     substituteInPlace src/GLX/Makefile.am \
       --replace "-Wl,-Bsymbolic " ""
diff --git a/pkgs/development/libraries/libiconv/setup-hook.sh b/pkgs/development/libraries/libiconv/setup-hook.sh
index f89361a6299..120cf06c61b 100644
--- a/pkgs/development/libraries/libiconv/setup-hook.sh
+++ b/pkgs/development/libraries/libiconv/setup-hook.sh
@@ -2,7 +2,7 @@
 # it doesn't hurt to have it in Glibc either though
 
 # See pkgs/build-support/setup-hooks/role.bash
-if [ -z "$dontAddExtraLibs" ]; then
+if [ -z "${dontAddExtraLibs-}" ]; then
     getHostRole
     export NIX_${role_pre}LDFLAGS+=" -liconv"
 fi
diff --git a/pkgs/development/libraries/libmad/001-mips_removal_h_constraint.patch b/pkgs/development/libraries/libmad/001-mips_removal_h_constraint.patch
deleted file mode 100644
index 1d8b385e0c5..00000000000
--- a/pkgs/development/libraries/libmad/001-mips_removal_h_constraint.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-Taken from openwrt:
-https://dev.openwrt.org/browser/packages/libs/libmad/patches/001-mips_removal_h_constraint.patch?rev=18548
-
-diff -ur libmad-0.15.1b-orig/fixed.h libmad-0.15.1b/fixed.h
---- libmad-0.15.1b-orig/fixed.h	2004-02-17 12:32:03.000000000 +1030
-+++ libmad-0.15.1b/fixed.h	2009-08-05 10:46:30.000000000 +0930
-@@ -299,6 +299,23 @@
- 
- # elif defined(FPM_MIPS)
- 
-+/* Test for gcc >= maj.min, as per __GNUC_PREREQ in glibc */
-+#if defined (__GNUC__) && defined (__GNUC_MINOR__)
-+#define __GNUC_PREREQ(maj, min) \
-+	((__GNUC__ << 16) + __GNUC_MINOR__ >= ((maj) << 16) + (min))
-+#else
-+#define __GNUC_PREREQ(maj, min)  0
-+#endif
-+
-+#if __GNUC_PREREQ(4,4)
-+  typedef unsigned int u64_di_t __attribute__ ((mode (DI)));
-+# define MAD_F_MLX(hi, lo, x, y) \
-+   do { \
-+      u64_di_t __ll = (u64_di_t) (x) * (y); \
-+      hi = __ll >> 32; \
-+      lo = __ll; \
-+   } while (0) 
-+#else
- /*
-  * This MIPS version is fast and accurate; the disposition of the least
-  * significant bit depends on OPT_ACCURACY via mad_f_scale64().
-@@ -328,6 +345,7 @@
- 	 : "%r" ((x) >> 12), "r" ((y) >> 16))
- #  define MAD_F_MLZ(hi, lo)  ((mad_fixed_t) (lo))
- # endif
-+#endif /* __GNU_PREREQ(4,4) */
- 
- # if defined(OPT_SPEED)
- #  define mad_f_scale64(hi, lo)  \
-diff -ur libmad-0.15.1b-orig/mad.h libmad-0.15.1b/mad.h
---- libmad-0.15.1b-orig/mad.h	2004-02-17 13:25:44.000000000 +1030
-+++ libmad-0.15.1b/mad.h	2009-08-05 10:42:40.000000000 +0930
-@@ -344,6 +344,23 @@
- 
- # elif defined(FPM_MIPS)
- 
-+/* Test for gcc >= maj.min, as per __GNUC_PREREQ in glibc */
-+#if defined (__GNUC__) && defined (__GNUC_MINOR__)
-+#define __GNUC_PREREQ(maj, min) \
-+	((__GNUC__ << 16) + __GNUC_MINOR__ >= ((maj) << 16) + (min))
-+#else
-+#define __GNUC_PREREQ(maj, min)  0
-+#endif
-+
-+#if __GNUC_PREREQ(4,4)
-+  typedef unsigned int u64_di_t __attribute__ ((mode (DI)));
-+# define MAD_F_MLX(hi, lo, x, y) \
-+   do { \
-+      u64_di_t __ll = (u64_di_t) (x) * (y); \
-+      hi = __ll >> 32; \
-+      lo = __ll; \
-+   } while (0) 
-+#else
- /*
-  * This MIPS version is fast and accurate; the disposition of the least
-  * significant bit depends on OPT_ACCURACY via mad_f_scale64().
-@@ -373,6 +390,7 @@
- 	 : "%r" ((x) >> 12), "r" ((y) >> 16))
- #  define MAD_F_MLZ(hi, lo)  ((mad_fixed_t) (lo))
- # endif
-+#endif /* __GNU_PREREQ(4,4) */
- 
- # if defined(OPT_SPEED)
- #  define mad_f_scale64(hi, lo)  \
diff --git a/pkgs/development/libraries/libmad/default.nix b/pkgs/development/libraries/libmad/default.nix
index f6df090e8b5..40d90f46288 100644
--- a/pkgs/development/libraries/libmad/default.nix
+++ b/pkgs/development/libraries/libmad/default.nix
@@ -1,28 +1,58 @@
-{stdenv, fetchurl, autoconf}:
+{ stdenv, fetchurl, fetchpatch, autoconf }:
 
 stdenv.mkDerivation rec {
-  name = "libmad-0.15.1b";
-  
+  pname = "libmad";
+  version = "0.15.1b";
+
   src = fetchurl {
-    url = "mirror://sourceforge/mad/${name}.tar.gz";
-    sha256 = "bbfac3ed6bfbc2823d3775ebb931087371e142bb0e9bb1bee51a76a6e0078690";
+    url = "mirror://sourceforge/mad/${pname}-${version}.tar.gz";
+    sha256 = "14460zhacxhswnzb36qfpd1f2wbk10qvksvm6wyq5hpvdgnw7ymv";
   };
 
-  patches = [ ./001-mips_removal_h_constraint.patch ./pkgconfig.patch ]
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/openwrt/packages/raw/openwrt-19.07/libs/libmad/patches/001-mips_removal_h_constraint.patch";
+      sha256 = "0layswr6qg6axf4vyz6xrv73jwga34mkma3ifk9w9vrk41454hr5";
+    })
+    (fetchpatch {
+      url = "https://github.com/KaOSx/main/raw/1270b8080f37fb6cca562829a521991800b0a497/libmad/libmad.patch";
+      sha256 = "0rysq0sn3dfdz6pa6bfqkmk4ymc4rzk5ym7p16dyk37sldg1pbzs";
+    })
+    (fetchpatch {
+      url = "https://github.com/KaOSx/main/raw/1270b8080f37fb6cca562829a521991800b0a497/libmad/amd64-64bit.diff";
+      sha256 = "0mx56dmkbvw3zxnqd2hjng48q0d7q7473pns4n0ksdam29b0c5ar";
+    })
+    (fetchpatch {
+      name = "CVE-2017-8372-CVE-2017-8373.patch";
+      url = "https://github.com/openwrt/packages/raw/openwrt-19.07/libs/libmad/patches/102-CVE-2017-8373-CVE-2017-8372-md-size.patch";
+      sha256 = "0p6mkpn66h1ds8jvww28q4vlr58jwm58m9vb7pkvvyvy764agqnk";
+    })
+    (fetchpatch {
+      name = "CVE-2017-8374.patch";
+      url = "https://github.com/openwrt/packages/raw/openwrt-19.07/libs/libmad/patches/101-CVE-2017-8374-length-check.patch";
+      sha256 = "1j1ssxwmx9nfahzl62frbzck93xrjc2v3w30c12vmk29iflf1890";
+    })
+  ]
   # optimize.diff is taken from https://projects.archlinux.org/svntogit/packages.git/tree/trunk/optimize.diff?h=packages/libmad
   # It is included here in order to fix a build failure in Clang
   # But it may be useful to fix other, currently unknown problems as well
-  ++ stdenv.lib.optional stdenv.cc.isClang [ ./optimize.diff ];
-
-  nativeBuildInputs = [ autoconf ];
+  ++ stdenv.lib.optionals stdenv.cc.isClang [
+    (fetchpatch {
+      url = "https://github.com/KaOSx/main/raw/1270b8080f37fb6cca562829a521991800b0a497/libmad/optimize.diff";
+      sha256 = "0ciyaj1acg08g8hpzqx6whayq206fvf4whksz2pjgxlv207lqgjh";
+    })
+  ];
 
   # The -fforce-mem flag has been removed in GCC 4.3.
-  preConfigure = ''
-    autoconf
-    substituteInPlace configure --replace "-fforce-mem" ""
-    substituteInPlace configure --replace "arch=\"-march=i486\"" ""
+  postPatch = ''
+    substituteInPlace configure.ac --replace "-fforce-mem" ""
+    substituteInPlace configure.ac --replace "arch=\"-march=i486\"" ""
   '';
 
+  nativeBuildInputs = [ autoconf ];
+
+  preConfigure = "autoconf";
+
   meta = with stdenv.lib; {
     homepage    = https://sourceforge.net/projects/mad/;
     description = "A high-quality, fixed-point MPEG audio decoder supporting MPEG-1 and MPEG-2";
diff --git a/pkgs/development/libraries/libmad/optimize.diff b/pkgs/development/libraries/libmad/optimize.diff
deleted file mode 100644
index 1418dc92707..00000000000
--- a/pkgs/development/libraries/libmad/optimize.diff
+++ /dev/null
@@ -1,77 +0,0 @@
-Index: libmad-0.15.1b/configure.ac
-===================================================================
---- libmad-0.15.1b.orig/configure.ac	2008-03-07 20:31:23.000000000 +0000
-+++ libmad-0.15.1b/configure.ac	2008-03-07 20:34:26.000000000 +0000
-@@ -124,71 +124,7 @@
- 
- if test "$GCC" = yes
- then
--    if test -z "$arch"
--    then
--	case "$host" in
--	    i386-*)           ;;
--	    i?86-*)           arch="-march=i486" ;;
--	    arm*-empeg-*)     arch="-march=armv4 -mtune=strongarm1100" ;;
--	    armv4*-*)         arch="-march=armv4 -mtune=strongarm" ;;
--	    powerpc-*)        ;;
--	    mips*-agenda-*)   arch="-mcpu=vr4100" ;;
--	    mips*-luxsonor-*) arch="-mips1 -mcpu=r3000 -Wa,-m4010" ;;
--	esac
--    fi
--
--    case "$optimize" in
--	-O|"-O "*)
--	    optimize="-O"
--	    optimize="$optimize -fforce-mem"
--	    optimize="$optimize -fforce-addr"
--	    : #x optimize="$optimize -finline-functions"
--	    : #- optimize="$optimize -fstrength-reduce"
--	    optimize="$optimize -fthread-jumps"
--	    optimize="$optimize -fcse-follow-jumps"
--	    optimize="$optimize -fcse-skip-blocks"
--	    : #x optimize="$optimize -frerun-cse-after-loop"
--	    : #x optimize="$optimize -frerun-loop-opt"
--	    : #x optimize="$optimize -fgcse"
--	    optimize="$optimize -fexpensive-optimizations"
--	    optimize="$optimize -fregmove"
--	    : #* optimize="$optimize -fdelayed-branch"
--	    : #x optimize="$optimize -fschedule-insns"
--	    optimize="$optimize -fschedule-insns2"
--	    : #? optimize="$optimize -ffunction-sections"
--	    : #? optimize="$optimize -fcaller-saves"
--	    : #> optimize="$optimize -funroll-loops"
--	    : #> optimize="$optimize -funroll-all-loops"
--	    : #x optimize="$optimize -fmove-all-movables"
--	    : #x optimize="$optimize -freduce-all-givs"
--	    : #? optimize="$optimize -fstrict-aliasing"
--	    : #* optimize="$optimize -fstructure-noalias"
--
--	    case "$host" in
--		arm*-*)
--		    optimize="$optimize -fstrength-reduce"
--		    ;;
--		mips*-*)
--		    optimize="$optimize -fstrength-reduce"
--		    optimize="$optimize -finline-functions"
--		    ;;
--		i?86-*)
--		    optimize="$optimize -fstrength-reduce"
--		    ;;
--		powerpc-apple-*)
--		    # this triggers an internal compiler error with gcc2
--		    : #optimize="$optimize -fstrength-reduce"
--
--		    # this is really only beneficial with gcc3
--		    : #optimize="$optimize -finline-functions"
--		    ;;
--		*)
--		    # this sometimes provokes bugs in gcc 2.95.2
--		    : #optimize="$optimize -fstrength-reduce"
--		    ;;
--	    esac
--	    ;;
--    esac
-+    optimize="-O2"
- fi
- 
- case "$host" in
diff --git a/pkgs/development/libraries/libmad/pkgconfig.patch b/pkgs/development/libraries/libmad/pkgconfig.patch
deleted file mode 100644
index 0ac88acb841..00000000000
--- a/pkgs/development/libraries/libmad/pkgconfig.patch
+++ /dev/null
@@ -1,117 +0,0 @@
-diff -ruN libmad-0.15.1b.orig/Makefile.am libmad-0.15.1b/Makefile.am
---- libmad-0.15.1b.orig/Makefile.am	2004-02-17 02:02:03.000000000 +0000
-+++ libmad-0.15.1b/Makefile.am	2005-08-25 12:08:04.000000000 +0000
-@@ -33,9 +33,12 @@
- minimad_INCLUDES =	
- minimad_LDADD =		libmad.la
- 
--EXTRA_DIST =		mad.h.sed  \
-+EXTRA_DIST =		mad.h.sed mad.pc.in \
- 			CHANGES COPYRIGHT CREDITS README TODO VERSION
- 
-+pkgconfigdir = $(libdir)/pkgconfig
-+pkgconfig_DATA= mad.pc
-+
- exported_headers =	version.h fixed.h bit.h timer.h stream.h frame.h  \
- 			synth.h decoder.h
- 
-diff -ruN libmad-0.15.1b.orig/Makefile.in libmad-0.15.1b/Makefile.in
---- libmad-0.15.1b.orig/Makefile.in	2004-02-17 02:33:23.000000000 +0000
-+++ libmad-0.15.1b/Makefile.in	2005-08-25 12:09:34.000000000 +0000
-@@ -14,6 +14,8 @@
- 
- @SET_MAKE@
- 
-+pkgconfigdir = $(libdir)/pkgconfig
-+pkgconfig_DATA = mad.pc
- 
- SOURCES = $(libmad_la_SOURCES) $(EXTRA_libmad_la_SOURCES) $(minimad_SOURCES)
- 
-@@ -43,7 +45,7 @@
- 	$(srcdir)/Makefile.am $(srcdir)/Makefile.in \
- 	$(srcdir)/config.h.in $(srcdir)/libmad.list.in \
- 	$(top_srcdir)/configure COPYING INSTALL TODO config.guess \
--	config.sub depcomp install-sh ltmain.sh missing mkinstalldirs
-+	config.sub depcomp install-sh ltmain.sh missing mkinstalldirs mad.pc.in
- subdir = .
- ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
- am__aclocal_m4_deps = $(top_srcdir)/configure.ac
-@@ -53,7 +55,7 @@
-  configure.lineno configure.status.lineno
- mkinstalldirs = $(SHELL) $(top_srcdir)/mkinstalldirs
- CONFIG_HEADER = config.h
--CONFIG_CLEAN_FILES = libmad.list
-+CONFIG_CLEAN_FILES = libmad.list mad.pc
- am__installdirs = $(DESTDIR)$(libdir) $(DESTDIR)$(includedir)
- libLTLIBRARIES_INSTALL = $(INSTALL)
- LTLIBRARIES = $(lib_LTLIBRARIES)
-@@ -218,7 +220,7 @@
- minimad_SOURCES = minimad.c
- minimad_INCLUDES = 
- minimad_LDADD = libmad.la
--EXTRA_DIST = mad.h.sed  \
-+EXTRA_DIST = mad.h.sed  mad.pc.in \
- 			CHANGES COPYRIGHT CREDITS README TODO VERSION
- 
- exported_headers = version.h fixed.h bit.h timer.h stream.h frame.h  \
-@@ -298,6 +300,28 @@
- 	rm -f stamp-h1
- 	touch $@
- 
-+mad.pc: $(top_builddir)/config.status mad.pc.in
-+	cd $(top_builddir) && CONFIG_FILES=$@ CONFIG_HEADERS= $(SHELL) ./config.status
-+
-+install-pkgconfigDATA: $(pkgconfig_DATA)
-+	@$(NORMAL_INSTALL)
-+	$(mkinstalldirs) $(DESTDIR)$(pkgconfigdir)
-+	@list='$(pkgconfig_DATA)'; for p in $$list; do \
-+	  if test -f $(srcdir)/$$p; then \
-+	    echo " $(INSTALL_DATA) $(srcdir)/$$p $(DESTDIR)$(pkgconfigdir)/$$p"; \
-+	    $(INSTALL_DATA) $(srcdir)/$$p $(DESTDIR)$(pkgconfigdir)/$$p; \
-+	  else if test -f $$p; then \
-+	    echo " $(INSTALL_DATA) $$p $(DESTDIR)$(pkgconfigdir)/$$p"; \
-+	    $(INSTALL_DATA) $$p $(DESTDIR)$(pkgconfigdir)/$$p; \
-+	  fi; fi; \
-+	done
-+
-+uninstall-pkgconfigDATA:
-+	@$(NORMAL_UNINSTALL)
-+	list='$(pkgconfig_DATA)'; for p in $$list; do \
-+	  rm -f $(DESTDIR)$(pkgconfigdir)/$$p; \
-+	done
-+
- distclean-hdr:
- 	-rm -f config.h stamp-h1
- libmad.list: $(top_builddir)/config.status $(srcdir)/libmad.list.in
-@@ -726,7 +750,7 @@
- 
- info-am:
- 
--install-data-am: install-includeHEADERS
-+install-data-am: install-includeHEADERS install-pkgconfigDATA
- 
- install-exec-am: install-libLTLIBRARIES
- 
-@@ -757,7 +781,7 @@
- ps-am:
- 
- uninstall-am: uninstall-includeHEADERS uninstall-info-am \
--	uninstall-libLTLIBRARIES
-+	uninstall-libLTLIBRARIES install-pkgconfigDATA
- 
- uninstall-info: uninstall-info-recursive
- 
-diff -ruN libmad-0.15.1b.orig/mad.pc.in libmad-0.15.1b/mad.pc.in
---- libmad-0.15.1b.orig/mad.pc.in	1970-01-01 00:00:00.000000000 +0000
-+++ libmad-0.15.1b/mad.pc.in	2005-08-25 12:08:04.000000000 +0000
-@@ -0,0 +1,10 @@
-+prefix=@prefix@
-+exec_prefix=@exec_prefix@
-+libdir=@libdir@
-+includedir=@includedir@
-+
-+Name: MAD
-+Description: libmad - MPEG audio decoder library
-+Version: @VERSION@
-+Libs: -L${libdir} -lmad
-+Cflags:
diff --git a/pkgs/development/libraries/libtiff/CVE-2019-14973.patch b/pkgs/development/libraries/libtiff/CVE-2019-14973.patch
deleted file mode 100644
index 1dc75246902..00000000000
--- a/pkgs/development/libraries/libtiff/CVE-2019-14973.patch
+++ /dev/null
@@ -1,384 +0,0 @@
-diff -ru tiff-4.0.10-orig/libtiff/tif_aux.c tiff-4.0.10/libtiff/tif_aux.c
---- tiff-4.0.10-orig/libtiff/tif_aux.c	2017-12-02 16:21:47.305709555 +0100
-+++ tiff-4.0.10/libtiff/tif_aux.c	2019-10-02 22:35:17.392184463 +0200
-@@ -57,18 +57,57 @@
- 	return bytes;
- }
- 
-+tmsize_t
-+_TIFFMultiplySSize(TIFF* tif, tmsize_t first, tmsize_t second, const char* where)
-+{
-+    if( first <= 0 || second <= 0 )
-+    {
-+        if( tif != NULL && where != NULL )
-+        {
-+            TIFFErrorExt(tif->tif_clientdata, where,
-+                        "Invalid argument to _TIFFMultiplySSize() in %s", where);
-+        }
-+        return 0;
-+    }
-+
-+    if( first > TIFF_TMSIZE_T_MAX / second )
-+    {
-+        if( tif != NULL && where != NULL )
-+        {
-+            TIFFErrorExt(tif->tif_clientdata, where,
-+                        "Integer overflow in %s", where);
-+        }
-+        return 0;
-+    }
-+    return first * second;
-+}
-+
-+tmsize_t _TIFFCastUInt64ToSSize(TIFF* tif, uint64 val, const char* module)
-+{
-+    if( val > (uint64)TIFF_TMSIZE_T_MAX )
-+    {
-+        if( tif != NULL && module != NULL )
-+        {
-+            TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
-+        }
-+        return 0;
-+    }
-+    return (tmsize_t)val;
-+}
-+
- void*
- _TIFFCheckRealloc(TIFF* tif, void* buffer,
- 		  tmsize_t nmemb, tmsize_t elem_size, const char* what)
- {
- 	void* cp = NULL;
--	tmsize_t bytes = nmemb * elem_size;
--
-+        tmsize_t count = _TIFFMultiplySSize(tif, nmemb, elem_size, NULL);
- 	/*
--	 * XXX: Check for integer overflow.
-+	 * Check for integer overflow.
- 	 */
--	if (nmemb && elem_size && bytes / elem_size == nmemb)
--		cp = _TIFFrealloc(buffer, bytes);
-+	if (count != 0)
-+	{
-+		cp = _TIFFrealloc(buffer, count);
-+	}
- 
- 	if (cp == NULL) {
- 		TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
-diff -ru tiff-4.0.10-orig/libtiff/tiffiop.h tiff-4.0.10/libtiff/tiffiop.h
---- tiff-4.0.10-orig/libtiff/tiffiop.h	2018-11-03 15:28:37.748910968 +0100
-+++ tiff-4.0.10/libtiff/tiffiop.h	2019-10-02 22:35:17.396184535 +0200
-@@ -77,6 +77,9 @@
- #define	FALSE	0
- #endif
- 
-+#define TIFF_SIZE_T_MAX ((size_t) ~ ((size_t)0))
-+#define TIFF_TMSIZE_T_MAX (tmsize_t)(TIFF_SIZE_T_MAX >> 1)
-+
- typedef struct client_info {
-     struct client_info *next;
-     void *data;
-@@ -258,7 +261,7 @@
- #define TIFFhowmany8_64(x) (((x)&0x07)?((uint64)(x)>>3)+1:(uint64)(x)>>3)
- #define TIFFroundup_64(x, y) (TIFFhowmany_64(x,y)*(y))
- 
--/* Safe multiply which returns zero if there is an integer overflow */
-+/* Safe multiply which returns zero if there is an *unsigned* integer overflow. This macro is not safe for *signed* integer types */
- #define TIFFSafeMultiply(t,v,m) ((((t)(m) != (t)0) && (((t)(((v)*(m))/(m))) == (t)(v))) ? (t)((v)*(m)) : (t)0)
- 
- #define TIFFmax(A,B) ((A)>(B)?(A):(B))
-@@ -368,6 +371,8 @@
- 
- extern uint32 _TIFFMultiply32(TIFF*, uint32, uint32, const char*);
- extern uint64 _TIFFMultiply64(TIFF*, uint64, uint64, const char*);
-+extern tmsize_t _TIFFMultiplySSize(TIFF*, tmsize_t, tmsize_t, const char*);
-+extern tmsize_t _TIFFCastUInt64ToSSize(TIFF*, uint64, const char*);
- extern void* _TIFFCheckMalloc(TIFF*, tmsize_t, tmsize_t, const char*);
- extern void* _TIFFCheckRealloc(TIFF*, void*, tmsize_t, tmsize_t, const char*);
- 
-diff -ru tiff-4.0.10-orig/libtiff/tif_getimage.c tiff-4.0.10/libtiff/tif_getimage.c
---- tiff-4.0.10-orig/libtiff/tif_getimage.c	2017-12-02 16:21:47.654716127 +0100
-+++ tiff-4.0.10/libtiff/tif_getimage.c	2019-10-02 22:35:17.393184481 +0200
-@@ -755,9 +755,8 @@
- 	uint32 leftmost_tw;
- 
- 	tilesize = TIFFTileSize(tif);  
--	bufsize = TIFFSafeMultiply(tmsize_t,alpha?4:3,tilesize);
-+	bufsize = _TIFFMultiplySSize(tif, alpha?4:3,tilesize, "gtTileSeparate");
- 	if (bufsize == 0) {
--		TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtTileSeparate");
- 		return (0);
- 	}
- 
-@@ -1019,9 +1018,8 @@
-         uint16 colorchannels;
- 
- 	stripsize = TIFFStripSize(tif);  
--	bufsize = TIFFSafeMultiply(tmsize_t,alpha?4:3,stripsize);
-+	bufsize = _TIFFMultiplySSize(tif,alpha?4:3,stripsize, "gtStripSeparate");
- 	if (bufsize == 0) {
--		TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtStripSeparate");
- 		return (0);
- 	}
- 
-diff -ru tiff-4.0.10-orig/libtiff/tif_luv.c tiff-4.0.10/libtiff/tif_luv.c
---- tiff-4.0.10-orig/libtiff/tif_luv.c	2018-05-05 15:50:35.884596907 +0200
-+++ tiff-4.0.10/libtiff/tif_luv.c	2019-10-02 22:35:17.393184481 +0200
-@@ -1264,16 +1264,10 @@
- 	return (SGILOGDATAFMT_UNKNOWN);
- }
- 
--
--#define TIFF_SIZE_T_MAX ((size_t) ~ ((size_t)0))
--#define TIFF_TMSIZE_T_MAX (tmsize_t)(TIFF_SIZE_T_MAX >> 1)
--
- static tmsize_t
- multiply_ms(tmsize_t m1, tmsize_t m2)
- {
--        if( m1 == 0 || m2 > TIFF_TMSIZE_T_MAX / m1 )
--            return 0;
--        return m1 * m2;
-+        return _TIFFMultiplySSize(NULL, m1, m2, NULL);
- }
- 
- static int
-diff -ru tiff-4.0.10-orig/libtiff/tif_pixarlog.c tiff-4.0.10/libtiff/tif_pixarlog.c
---- tiff-4.0.10-orig/libtiff/tif_pixarlog.c	2017-12-02 16:21:47.841162432 +0100
-+++ tiff-4.0.10/libtiff/tif_pixarlog.c	2019-10-02 22:36:01.223970118 +0200
-@@ -634,15 +634,10 @@
- 	return guess;
- }
- 
--#define TIFF_SIZE_T_MAX ((size_t) ~ ((size_t)0))
--#define TIFF_TMSIZE_T_MAX (tmsize_t)(TIFF_SIZE_T_MAX >> 1)
--
- static tmsize_t
- multiply_ms(tmsize_t m1, tmsize_t m2)
- {
--        if( m1 == 0 || m2 > TIFF_TMSIZE_T_MAX / m1 )
--            return 0;
--        return m1 * m2;
-+        return _TIFFMultiplySSize(NULL, m1, m2, NULL);
- }
- 
- static tmsize_t
-diff -ru tiff-4.0.10-orig/libtiff/tif_read.c tiff-4.0.10/libtiff/tif_read.c
---- tiff-4.0.10-orig/libtiff/tif_read.c	2018-10-14 21:15:27.551093695 +0200
-+++ tiff-4.0.10/libtiff/tif_read.c	2019-10-02 22:41:09.387290927 +0200
-@@ -29,9 +29,6 @@
- #include "tiffiop.h"
- #include <stdio.h>
- 
--#define TIFF_SIZE_T_MAX ((size_t) ~ ((size_t)0))
--#define TIFF_TMSIZE_T_MAX (tmsize_t)(TIFF_SIZE_T_MAX >> 1)
--
- int TIFFFillStrip(TIFF* tif, uint32 strip);
- int TIFFFillTile(TIFF* tif, uint32 tile);
- static int TIFFStartStrip(TIFF* tif, uint32 strip);
-@@ -49,6 +46,8 @@
- #define THRESHOLD_MULTIPLIER 10
- #define MAX_THRESHOLD (THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER * THRESHOLD_MULTIPLIER * INITIAL_THRESHOLD)
- 
-+#define TIFF_INT64_MAX ((((int64)0x7FFFFFFF) << 32) | 0xFFFFFFFF)
-+
- /* Read 'size' bytes in tif_rawdata buffer starting at offset 'rawdata_offset'
-  * Returns 1 in case of success, 0 otherwise. */
- static int TIFFReadAndRealloc( TIFF* tif, tmsize_t size,
-@@ -734,23 +733,8 @@
- 		return ((tmsize_t)(-1));
- 	}
- 	bytecount = td->td_stripbytecount[strip];
--	if ((int64)bytecount <= 0) {
--#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
--		TIFFErrorExt(tif->tif_clientdata, module,
--			     "%I64u: Invalid strip byte count, strip %lu",
--			     (unsigned __int64) bytecount,
--			     (unsigned long) strip);
--#else
--		TIFFErrorExt(tif->tif_clientdata, module,
--			     "%llu: Invalid strip byte count, strip %lu",
--			     (unsigned long long) bytecount,
--			     (unsigned long) strip);
--#endif
--		return ((tmsize_t)(-1));
--	}
--	bytecountm = (tmsize_t)bytecount;
--	if ((uint64)bytecountm!=bytecount) {
--		TIFFErrorExt(tif->tif_clientdata, module, "Integer overflow");
-+	bytecountm =  _TIFFCastUInt64ToSSize(tif, bytecount, module);
-+	if (bytecountm == 0) {
- 		return ((tmsize_t)(-1));
- 	}
- 	if (size != (tmsize_t)(-1) && size < bytecountm)
-@@ -774,7 +758,7 @@
- 	if ((tif->tif_flags&TIFF_NOREADRAW)==0)
- 	{
- 		uint64 bytecount = td->td_stripbytecount[strip];
--		if ((int64)bytecount <= 0) {
-+		if( bytecount == 0 || bytecount > (uint64)TIFF_INT64_MAX ) {
- #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
- 			TIFFErrorExt(tif->tif_clientdata, module,
- 				"Invalid strip byte count %I64u, strip %lu",
-@@ -801,7 +785,7 @@
- 			    (bytecount - 4096) / 10 > (uint64)stripsize  )
- 			{
- 				uint64 newbytecount = (uint64)stripsize * 10 + 4096;
--				if( (int64)newbytecount >= 0 )
-+				if( newbytecount == 0 || newbytecount > (uint64)TIFF_INT64_MAX )
- 				{
- #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
- 					TIFFWarningExt(tif->tif_clientdata, module,
-@@ -1196,10 +1180,8 @@
- 	bytecount64 = td->td_stripbytecount[tile];
- 	if (size != (tmsize_t)(-1) && (uint64)size < bytecount64)
- 		bytecount64 = (uint64)size;
--	bytecountm = (tmsize_t)bytecount64;
--	if ((uint64)bytecountm!=bytecount64)
--	{
--		TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
-+	bytecountm = _TIFFCastUInt64ToSSize(tif, bytecount64, module);
-+        if( bytecountm == 0 ) {
- 		return ((tmsize_t)(-1));
- 	}
- 	return (TIFFReadRawTile1(tif, tile, buf, bytecountm, module));
-@@ -1221,7 +1203,7 @@
- 	if ((tif->tif_flags&TIFF_NOREADRAW)==0)
- 	{
- 		uint64 bytecount = td->td_stripbytecount[tile];
--		if ((int64)bytecount <= 0) {
-+		if( bytecount == 0 || bytecount > (uint64)TIFF_INT64_MAX ) {
- #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
- 			TIFFErrorExt(tif->tif_clientdata, module,
- 				"%I64u: Invalid tile byte count, tile %lu",
-@@ -1248,7 +1230,7 @@
- 			    (bytecount - 4096) / 10 > (uint64)stripsize  )
- 			{
- 				uint64 newbytecount = (uint64)stripsize * 10 + 4096;
--				if( (int64)newbytecount >= 0 )
-+				if( newbytecount == 0 || newbytecount > (uint64)TIFF_INT64_MAX )
- 				{
- #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
- 					TIFFWarningExt(tif->tif_clientdata, module,
-diff -ru tiff-4.0.10-orig/libtiff/tif_strip.c tiff-4.0.10/libtiff/tif_strip.c
---- tiff-4.0.10-orig/libtiff/tif_strip.c	2017-12-02 16:21:47.947867167 +0100
-+++ tiff-4.0.10/libtiff/tif_strip.c	2019-10-02 22:35:17.395184517 +0200
-@@ -129,15 +129,8 @@
- {
- 	static const char module[] = "TIFFVStripSize";
- 	uint64 m;
--	tmsize_t n;
- 	m=TIFFVStripSize64(tif,nrows);
--	n=(tmsize_t)m;
--	if ((uint64)n!=m)
--	{
--		TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
--		n=0;
--	}
--	return(n);
-+        return _TIFFCastUInt64ToSSize(tif, m, module);
- }
- 
- /*
-@@ -211,15 +204,8 @@
- {
- 	static const char module[] = "TIFFStripSize";
- 	uint64 m;
--	tmsize_t n;
- 	m=TIFFStripSize64(tif);
--	n=(tmsize_t)m;
--	if ((uint64)n!=m)
--	{
--		TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
--		n=0;
--	}
--	return(n);
-+	return _TIFFCastUInt64ToSSize(tif, m, module);
- }
- 
- /*
-@@ -330,14 +316,8 @@
- {
- 	static const char module[] = "TIFFScanlineSize";
- 	uint64 m;
--	tmsize_t n;
- 	m=TIFFScanlineSize64(tif);
--	n=(tmsize_t)m;
--	if ((uint64)n!=m) {
--		TIFFErrorExt(tif->tif_clientdata,module,"Integer arithmetic overflow");
--		n=0;
--	}
--	return(n);
-+	return _TIFFCastUInt64ToSSize(tif, m, module);
- }
- 
- /*
-@@ -366,15 +346,8 @@
- {
- 	static const char module[] = "TIFFRasterScanlineSize";
- 	uint64 m;
--	tmsize_t n;
- 	m=TIFFRasterScanlineSize64(tif);
--	n=(tmsize_t)m;
--	if ((uint64)n!=m)
--	{
--		TIFFErrorExt(tif->tif_clientdata,module,"Integer arithmetic overflow");
--		n=0;
--	}
--	return(n);
-+	return _TIFFCastUInt64ToSSize(tif, m, module);
- }
- 
- /* vim: set ts=8 sts=8 sw=8 noet: */
-diff -ru tiff-4.0.10-orig/libtiff/tif_tile.c tiff-4.0.10/libtiff/tif_tile.c
---- tiff-4.0.10-orig/libtiff/tif_tile.c	2017-12-02 16:21:47.993972977 +0100
-+++ tiff-4.0.10/libtiff/tif_tile.c	2019-10-02 22:35:17.395184517 +0200
-@@ -181,15 +181,8 @@
- {
- 	static const char module[] = "TIFFTileRowSize";
- 	uint64 m;
--	tmsize_t n;
- 	m=TIFFTileRowSize64(tif);
--	n=(tmsize_t)m;
--	if ((uint64)n!=m)
--	{
--		TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
--		n=0;
--	}
--	return(n);
-+	return _TIFFCastUInt64ToSSize(tif, m, module);
- }
- 
- /*
-@@ -248,15 +241,8 @@
- {
- 	static const char module[] = "TIFFVTileSize";
- 	uint64 m;
--	tmsize_t n;
- 	m=TIFFVTileSize64(tif,nrows);
--	n=(tmsize_t)m;
--	if ((uint64)n!=m)
--	{
--		TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
--		n=0;
--	}
--	return(n);
-+	return _TIFFCastUInt64ToSSize(tif, m, module);
- }
- 
- /*
-@@ -272,15 +258,8 @@
- {
- 	static const char module[] = "TIFFTileSize";
- 	uint64 m;
--	tmsize_t n;
- 	m=TIFFTileSize64(tif);
--	n=(tmsize_t)m;
--	if ((uint64)n!=m)
--	{
--		TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
--		n=0;
--	}
--	return(n);
-+	return _TIFFCastUInt64ToSSize(tif, m, module);
- }
- 
- /*
diff --git a/pkgs/development/libraries/libtiff/default.nix b/pkgs/development/libraries/libtiff/default.nix
index c35923071b0..795ed439093 100644
--- a/pkgs/development/libraries/libtiff/default.nix
+++ b/pkgs/development/libraries/libtiff/default.nix
@@ -9,24 +9,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "4.0.10";
+  version = "4.1.0";
   pname = "libtiff";
 
   src = fetchurl {
     url = "https://download.osgeo.org/libtiff/tiff-${version}.tar.gz";
-    sha256 = "1r4np635gr6zlc0bic38dzvxia6iqzcrary4n1ylarzpr8fd2lic";
+    sha256 = "0d46bdvxdiv59lxnb0xz9ywm8arsr6xsapi5s6y6vnys2wjz6aax";
   };
 
-  patches = [
-    (fetchurl {
-      url = "https://gitlab.com/libtiff/libtiff/commit/0c74a9f49b8d7a36b17b54a7428b3526d20f88a8.patch";
-      name = "CVE-2019-6128.patch";
-      sha256 = "03yvsfq6dxjd3v8ypfwz6cpz2iymqwcbawqqlmkh40dayi7fgizr";
-    })
-    # Manual backport of https://gitlab.com/libtiff/libtiff/commit/1b5e3b6a23827c33acf19ad50ce5ce78f12b3773.patch
-    ./CVE-2019-14973.patch
-  ];
-
   outputs = [ "bin" "dev" "out" "man" "doc" ];
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/development/libraries/libtxc_dxtn/default.nix b/pkgs/development/libraries/libtxc_dxtn/default.nix
index 5ac456a60f6..600b1fb510a 100644
--- a/pkgs/development/libraries/libtxc_dxtn/default.nix
+++ b/pkgs/development/libraries/libtxc_dxtn/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, autoreconfHook, libGLU_combined }:
+{ stdenv, fetchurl, autoreconfHook, libGL, libGLU }:
 
 let version = "1.0.1"; in
 
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ autoreconfHook ];
-  buildInputs = [ libGLU_combined ];
+  buildInputs = [ libGL libGLU ];
 
   meta = with stdenv.lib; {
     homepage = http://dri.freedesktop.org/wiki/S3TC;
diff --git a/pkgs/development/libraries/libtxc_dxtn_s2tc/default.nix b/pkgs/development/libraries/libtxc_dxtn_s2tc/default.nix
index 4959674f0ad..f9f44f5a653 100644
--- a/pkgs/development/libraries/libtxc_dxtn_s2tc/default.nix
+++ b/pkgs/development/libraries/libtxc_dxtn_s2tc/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, autoreconfHook, libGLU_combined }:
+{ stdenv, fetchurl, autoreconfHook, libGL, libGLU }:
 
 let version = "1.0"; in
 
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
   };
 
   nativeBuildInputs = [ autoreconfHook ];
-  buildInputs = [ libGLU_combined ];
+  buildInputs = [ libGL libGLU ];
 
   meta = {
     description = "A patent-free S3TC compatible implementation";
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index caeb8dba8a6..ca73f3bdeb6 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -27,7 +27,7 @@
 with stdenv.lib;
 
 let
-  version = "19.2.1";
+  version = "19.2.4";
   branch  = versions.major version;
 in
 
@@ -42,7 +42,7 @@ stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
       "https://mesa.freedesktop.org/archive/mesa-${version}.tar.xz"
     ];
-    sha256 = "4cc53ca1a8d12c6ff0e5ea44a5213c05c88447ab50d7e28bb350cd29199f01e9";
+    sha256 = "03z393jrd1cnh68k5h3mm5yap3hi1jzz3a417ccjxn5vgl7hl009";
   };
 
   prePatch = "patchShebangs .";
diff --git a/pkgs/development/libraries/mesa/stubs.nix b/pkgs/development/libraries/mesa/stubs.nix
index 5cb6ac3d4d1..a53f2dc28e7 100644
--- a/pkgs/development/libraries/mesa/stubs.nix
+++ b/pkgs/development/libraries/mesa/stubs.nix
@@ -51,7 +51,7 @@ stdenv.mkDerivation {
     ln -s ${libglvnd.out}/lib $out/lib
 
     mkdir -p $dev/{,lib/pkgconfig,nix-support}
-    echo "$out" > $dev/nix-support/propagated-build-inputs
+    echo "$out ${libglvnd} ${libglvnd.dev}" > $dev/nix-support/propagated-build-inputs
     ln -s ${mesa.dev}/include $dev/include
 
     genPkgConfig() {
@@ -63,7 +63,7 @@ stdenv.mkDerivation {
     Description: $lib library
     Version: ${mesa.version}
     Libs: -L${libglvnd.out}/lib -l$lib
-    Cflags: -I${mesa.dev}/include
+    Cflags: -I${mesa.dev}/include -I${libglvnd.dev}/include
     EOF
     }
 
diff --git a/pkgs/development/libraries/ncurses/default.nix b/pkgs/development/libraries/ncurses/default.nix
index 708ba46b42e..540ea71abfb 100644
--- a/pkgs/development/libraries/ncurses/default.nix
+++ b/pkgs/development/libraries/ncurses/default.nix
@@ -141,6 +141,7 @@ stdenv.mkDerivation rec {
     moveToOutput "bin/tset" "$out"
     moveToOutput "bin/captoinfo" "$out"
     moveToOutput "bin/infotocap" "$out"
+    moveToOutput "bin/infocmp" "$out"
   '';
 
   preFixup = lib.optionalString (!stdenv.hostPlatform.isCygwin && !enableStatic) ''
diff --git a/pkgs/development/libraries/openscenegraph/default.nix b/pkgs/development/libraries/openscenegraph/default.nix
index 1398e829dd5..9be5018dc29 100644
--- a/pkgs/development/libraries/openscenegraph/default.nix
+++ b/pkgs/development/libraries/openscenegraph/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchFromGitHub, cmake, pkgconfig, doxygen,
-  libX11, libXinerama, libXrandr, libGLU_combined,
+  libX11, libXinerama, libXrandr, libGLU, libGL,
   glib, ilmbase, libxml2, pcre, zlib,
   jpegSupport ? true, libjpeg,
   jasperSupport ? true, jasper,
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig cmake doxygen ];
 
   buildInputs = [
-    libX11 libXinerama libXrandr libGLU_combined
+    libX11 libXinerama libXrandr libGLU libGL
     glib ilmbase libxml2 pcre zlib
   ] ++ lib.optional jpegSupport libjpeg
     ++ lib.optional jasperSupport jasper
diff --git a/pkgs/development/libraries/p11-kit/default.nix b/pkgs/development/libraries/p11-kit/default.nix
index 9ca329c6761..f13ae141a81 100644
--- a/pkgs/development/libraries/p11-kit/default.nix
+++ b/pkgs/development/libraries/p11-kit/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "p11-kit";
-  version = "0.23.16.1";
+  version = "0.23.18.1";
 
   src = fetchFromGitHub {
     owner = "p11-glue";
     repo = pname;
     rev = version;
-    sha256 = "0jr62qkbqxp3iawgksk1qc3gp8p6x09sg5v7xac80ghyfxil15wy";
+    sha256 = "0l4ndipcbikblfjz729zkscvni5lzdzvbvsar2538pylw556rx73";
   };
 
   outputs = [ "out" "dev"];
diff --git a/pkgs/development/libraries/phonon/default.nix b/pkgs/development/libraries/phonon/default.nix
index dc32c4ebfb0..dd163571a1b 100644
--- a/pkgs/development/libraries/phonon/default.nix
+++ b/pkgs/development/libraries/phonon/default.nix
@@ -6,7 +6,7 @@
 with lib;
 
 let
-  v = "4.10.3";
+  v = "4.11.1";
 
   soname = if withQt5 then "phonon4qt5" else "phonon";
   buildsystemdir = "share/cmake/${soname}";
@@ -28,7 +28,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "mirror://kde/stable/phonon/${v}/phonon-${v}.tar.xz";
-    sha256 = "15f2vndpqfcivifzl1s07r0wkavpfrjln1p46cwfk85gd5b192rf";
+    sha256 = "0bfy8iqmjhlg3ma3iqd3kxjc2zkzpjgashbpf5x17y0dc2i1whxl";
   };
 
   buildInputs =
diff --git a/pkgs/development/libraries/qt-5/5.12/default.nix b/pkgs/development/libraries/qt-5/5.12/default.nix
index 9b6534c01b2..0a37b1ce39a 100644
--- a/pkgs/development/libraries/qt-5/5.12/default.nix
+++ b/pkgs/development/libraries/qt-5/5.12/default.nix
@@ -54,6 +54,7 @@ let
       optionals stdenv.isDarwin [
         ./qtbase.patch.d/0001-qtbase-mkspecs-mac.patch
         ./qtbase.patch.d/0002-qtbase-mac.patch
+        ./qtbase.patch.d/0013-define-kiosurfacesuccess.patch
       ]
       ++ [
         ./qtbase.patch.d/0003-qtbase-mkspecs.patch
diff --git a/pkgs/development/libraries/qt-5/5.12/qtbase.patch.d/0013-define-kiosurfacesuccess.patch b/pkgs/development/libraries/qt-5/5.12/qtbase.patch.d/0013-define-kiosurfacesuccess.patch
new file mode 100644
index 00000000000..a43a46d8a69
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.12/qtbase.patch.d/0013-define-kiosurfacesuccess.patch
@@ -0,0 +1,16 @@
+diff --git a/src/plugins/platforms/cocoa/qiosurfacegraphicsbuffer.mm b/src/plugins/platforms/cocoa/qiosurfacegraphicsbuffer.mm
+index a367487e..c3aeca1d 100644
+--- a/src/plugins/platforms/cocoa/qiosurfacegraphicsbuffer.mm
++++ b/src/plugins/platforms/cocoa/qiosurfacegraphicsbuffer.mm
+@@ -49,6 +49,11 @@
+ // but was only added in the 10.14 SDK, so declare it just in case.
+ extern "C" CFPropertyListRef CGColorSpaceCopyPropertyList(CGColorSpaceRef space);
+ 
++// Introduced in 10.13: http://codeworkshop.net/objc-diff/sdkdiffs/macos/10.13/IOSurface.html
++#if !defined(kIOSurfaceSuccess)
++#define kIOSurfaceSuccess KERN_SUCCESS
++#endif
++
+ QT_BEGIN_NAMESPACE
+ 
+ Q_LOGGING_CATEGORY(lcQpaIOSurface, "qt.qpa.backingstore.iosurface");
diff --git a/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh b/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh
index c3373983e32..7f6ddb76ad5 100644
--- a/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh
+++ b/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh
@@ -1,6 +1,6 @@
 . @fix_qmake_libtool@
 
-qmakeFlags=( $qmakeFlags )
+qmakeFlags=( ${qmakeFlags-} )
 
 qmakePrePhase() {
     qmakeFlags=( \
@@ -31,6 +31,6 @@ qmakeConfigurePhase() {
     runHook postConfigure
 }
 
-if [ -z "$dontUseQmakeConfigure" -a -z "$configurePhase" ]; then
+if [ -z "${dontUseQmakeConfigure-}" -a -z "${configurePhase-}" ]; then
     configurePhase=qmakeConfigurePhase
 fi
diff --git a/pkgs/development/libraries/qt-5/hooks/qtbase-setup-hook.sh b/pkgs/development/libraries/qt-5/hooks/qtbase-setup-hook.sh
index 436c2e1d032..9f2a9f06f1a 100644
--- a/pkgs/development/libraries/qt-5/hooks/qtbase-setup-hook.sh
+++ b/pkgs/development/libraries/qt-5/hooks/qtbase-setup-hook.sh
@@ -61,6 +61,6 @@ postPatchMkspecs() {
         fixQtBuiltinPaths "$dev/mkspecs" '*.pr?'
     fi
 }
-if [ -z "$dontPatchMkspecs" ]; then
-    postPhases="${postPhases}${postPhases:+ }postPatchMkspecs"
+if [ -z "${dontPatchMkspecs-}" ]; then
+    postPhases="${postPhases-}${postPhases:+ }postPatchMkspecs"
 fi
diff --git a/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh b/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh
index d2aadbd956a..f591ef2fb42 100644
--- a/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh
+++ b/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh
@@ -1,5 +1,5 @@
 # Inherit arguments given in mkDerivation
-qtWrapperArgs=( $qtWrapperArgs )
+qtWrapperArgs=( ${qtWrapperArgs-} )
 
 qtHostPathSeen=()
 
@@ -64,10 +64,10 @@ qtOwnPathsHook() {
 
 preFixupPhases+=" qtOwnPathsHook"
 
-# Note: $qtWrapperArgs still gets defined even if $dontWrapQtApps is set.
+# Note: $qtWrapperArgs still gets defined even if ${dontWrapQtApps-} is set.
 wrapQtAppsHook() {
     # skip this hook when requested
-    [ -z "$dontWrapQtApps" ] || return 0
+    [ -z "${dontWrapQtApps-}" ] || return 0
 
     # guard against running multiple times (e.g. due to propagation)
     [ -z "$wrapQtAppsHookHasRun" ] || return 0
diff --git a/pkgs/development/libraries/qt-5/modules/qtbase.nix b/pkgs/development/libraries/qt-5/modules/qtbase.nix
index d1ec209c95d..3dbdb2a9770 100644
--- a/pkgs/development/libraries/qt-5/modules/qtbase.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtbase.nix
@@ -58,7 +58,7 @@ stdenv.mkDerivation {
           # TODO: move to buildInputs, this should not be propagated.
           AGL AppKit ApplicationServices Carbon Cocoa CoreAudio CoreBluetooth
           CoreLocation CoreServices DiskArbitration Foundation OpenGL
-          darwin.libobjc libiconv MetalKit
+          darwin.libobjc libiconv MetalKit IOKit
         ]
       else
         [
diff --git a/pkgs/development/libraries/vtk/default.nix b/pkgs/development/libraries/vtk/default.nix
index 3cb8998485a..482d691fc7c 100644
--- a/pkgs/development/libraries/vtk/default.nix
+++ b/pkgs/development/libraries/vtk/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, cmake, libGLU_combined, libX11, xorgproto, libXt, libtiff
+{ stdenv, fetchurl, cmake, libGLU, libGL, libX11, xorgproto, libXt, libtiff
 , qtLib ? null
 # Darwin support
 , Cocoa, CoreServices, DiskArbitration, IOKit, CFNetwork, Security, GLUT, OpenGL
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libtiff ]
     ++ optional (qtLib != null) qtLib
-    ++ optionals stdenv.isLinux [ libGLU_combined libX11 xorgproto libXt ]
+    ++ optionals stdenv.isLinux [ libGLU libGL libX11 xorgproto libXt ]
     ++ optionals stdenv.isDarwin [ xpc Cocoa CoreServices DiskArbitration IOKit
                                    CFNetwork Security ApplicationServices CoreText
                                    IOSurface ImageIO OpenGL GLUT ];
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
   # built and requiring one of the shared objects.
   # At least, we use -fPIC for other packages to be able to use this in shared
   # objects.
-  cmakeFlags = [ "-DCMAKE_C_FLAGS=-fPIC" "-DCMAKE_CXX_FLAGS=-fPIC" "-DVTK_USE_SYSTEM_TIFF=1" ]
+  cmakeFlags = [ "-DCMAKE_C_FLAGS=-fPIC" "-DCMAKE_CXX_FLAGS=-fPIC" "-DVTK_USE_SYSTEM_TIFF=1" "-DOPENGL_INCLUDE_DIR=${libGL}/include" ]
     ++ optional (qtLib != null) [ "-DVTK_USE_QT:BOOL=ON" ]
     ++ optional stdenv.isDarwin "-DOPENGL_INCLUDE_DIR=${OpenGL}/Library/Frameworks";
 
diff --git a/pkgs/development/libraries/webkitgtk/default.nix b/pkgs/development/libraries/webkitgtk/default.nix
index f20d12359c9..e8fe798476c 100644
--- a/pkgs/development/libraries/webkitgtk/default.nix
+++ b/pkgs/development/libraries/webkitgtk/default.nix
@@ -2,7 +2,7 @@
 , pkgconfig, gettext, gobject-introspection, libnotify, gnutls, libgcrypt
 , gtk3, wayland, libwebp, enchant2, xorg, libxkbcommon, epoxy, at-spi2-core
 , libxml2, libsoup, libsecret, libxslt, harfbuzz, libpthreadstubs, pcre, nettle, libtasn1, p11-kit
-, libidn, libedit, readline, libGLU_combined, libintl, openjpeg
+, libidn, libedit, readline, libGL, libGLU, libintl, openjpeg
 , enableGeoLocation ? true, geoclue2, sqlite
 , enableGtk2Plugins ? false, gtk2 ? null
 , gst-plugins-base, gst-plugins-bad, woff2
@@ -37,6 +37,7 @@ stdenv.mkDerivation rec {
       src = ./fix-bubblewrap-paths.patch;
       inherit (builtins) storeDir;
     })
+    ./libglvnd-headers.patch
   ];
 
   postPatch = ''
@@ -74,10 +75,11 @@ stdenv.mkDerivation rec {
     libintl libwebp enchant2 libnotify gnutls pcre nettle libidn libgcrypt woff2
     libxml2 libsecret libxslt harfbuzz libpthreadstubs libtasn1 p11-kit openjpeg
     sqlite gst-plugins-base gst-plugins-bad libxkbcommon epoxy at-spi2-core
+    libGL libGLU
   ] ++ optional enableGeoLocation geoclue2
     ++ optional enableGtk2Plugins gtk2
     ++ (with xorg; [ libXdmcp libXt libXtst libXdamage ])
-    ++ optionals stdenv.isDarwin [ libedit readline libGLU_combined ]
+    ++ optionals stdenv.isDarwin [ libedit readline ]
     ++ optionals stdenv.isLinux [
       wayland bubblewrap libseccomp xdg-dbus-proxy
   ];
diff --git a/pkgs/development/libraries/webkitgtk/libglvnd-headers.patch b/pkgs/development/libraries/webkitgtk/libglvnd-headers.patch
new file mode 100644
index 00000000000..17264f3b588
--- /dev/null
+++ b/pkgs/development/libraries/webkitgtk/libglvnd-headers.patch
@@ -0,0 +1,586 @@
+diff --git a/Source/ThirdParty/ANGLE/scripts/generate_loader.py b/Source/ThirdParty/ANGLE/scripts/generate_loader.py
+index a408dac4..92ddca90 100644
+--- a/Source/ThirdParty/ANGLE/scripts/generate_loader.py
++++ b/Source/ThirdParty/ANGLE/scripts/generate_loader.py
+@@ -201,6 +201,8 @@ def main():
+ 
+ libegl_preamble = """#include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
++#include <EGL/eglmesaext.h>
+ """
+ 
+ util_gles_preamble = """#if defined(GL_GLES_PROTOTYPES) && GL_GLES_PROTOTYPES
+@@ -215,6 +217,8 @@ util_egl_preamble = """#include "util/util_export.h"
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
++#include <EGL/eglmesaext.h>
+ """
+ 
+ util_wgl_preamble = """
+diff --git a/Source/ThirdParty/ANGLE/src/common/PackedEGLEnums_autogen.h b/Source/ThirdParty/ANGLE/src/common/PackedEGLEnums_autogen.h
+index 68c65d8b..0dc9c8e3 100644
+--- a/Source/ThirdParty/ANGLE/src/common/PackedEGLEnums_autogen.h
++++ b/Source/ThirdParty/ANGLE/src/common/PackedEGLEnums_autogen.h
+@@ -14,6 +14,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <angle_gl.h>
+ 
+ #include <cstdint>
+diff --git a/Source/ThirdParty/ANGLE/src/common/PackedGLEnums_autogen.h b/Source/ThirdParty/ANGLE/src/common/PackedGLEnums_autogen.h
+index cd651150..17719bc2 100644
+--- a/Source/ThirdParty/ANGLE/src/common/PackedGLEnums_autogen.h
++++ b/Source/ThirdParty/ANGLE/src/common/PackedGLEnums_autogen.h
+@@ -14,6 +14,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <angle_gl.h>
+ 
+ #include <cstdint>
+diff --git a/Source/ThirdParty/ANGLE/src/common/gen_packed_gl_enums.py b/Source/ThirdParty/ANGLE/src/common/gen_packed_gl_enums.py
+index 2f77e725..5ea54f1f 100644
+--- a/Source/ThirdParty/ANGLE/src/common/gen_packed_gl_enums.py
++++ b/Source/ThirdParty/ANGLE/src/common/gen_packed_gl_enums.py
+@@ -71,6 +71,7 @@ header_template = """// GENERATED FILE - DO NOT EDIT.
+ #include <angle_gl.h>
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ #include <cstdint>
+ 
+diff --git a/Source/ThirdParty/ANGLE/src/common/utilities.h b/Source/ThirdParty/ANGLE/src/common/utilities.h
+index 7a1429a4..dd20bcca 100644
+--- a/Source/ThirdParty/ANGLE/src/common/utilities.h
++++ b/Source/ThirdParty/ANGLE/src/common/utilities.h
+@@ -11,6 +11,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ #include <math.h>
+ #include <string>
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/Config.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/Config.cpp
+index 4134226d..5dd1065f 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/Config.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/Config.cpp
+@@ -15,6 +15,7 @@
+ #include <vector>
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include "angle_gl.h"
+ 
+ #include "common/debug.h"
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/Device.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/Device.cpp
+index 13ae4e61..b964b755 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/Device.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/Device.cpp
+@@ -12,6 +12,7 @@
+ #include <iterator>
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <platform/Platform.h>
+ 
+ #include "common/debug.h"
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/Display.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/Display.cpp
+index 21064073..a46628bd 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/Display.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/Display.cpp
+@@ -17,6 +17,7 @@
+ #include <vector>
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <platform/Platform.h>
+ 
+ #include "common/debug.h"
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/Error.h b/Source/ThirdParty/ANGLE/src/libANGLE/Error.h
+index 37df5b0c..b2e3885b 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/Error.h
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/Error.h
+@@ -11,6 +11,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include "angle_gl.h"
+ #include "common/angleutils.h"
+ #include "common/debug.h"
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/Stream.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/Stream.cpp
+index b7bc84c8..538cb3e0 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/Stream.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/Stream.cpp
+@@ -10,6 +10,7 @@
+ #include "libANGLE/Stream.h"
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <platform/Platform.h>
+ 
+ #include "common/debug.h"
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/Stream.h b/Source/ThirdParty/ANGLE/src/libANGLE/Stream.h
+index 9157aa51..d8e58f2d 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/Stream.h
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/Stream.h
+@@ -14,6 +14,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ #include "common/angleutils.h"
+ #include "libANGLE/AttributeMap.h"
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/Surface.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/Surface.cpp
+index 6daec4f6..941f34ca 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/Surface.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/Surface.cpp
+@@ -11,6 +11,7 @@
+ #include "libANGLE/Surface.h"
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ #include "libANGLE/Config.h"
+ #include "libANGLE/Context.h"
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/SurfaceImpl.h b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/SurfaceImpl.h
+index ea1a0510..db7cf0c8 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/SurfaceImpl.h
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/SurfaceImpl.h
+@@ -11,6 +11,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ #include "common/angleutils.h"
+ #include "libANGLE/Error.h"
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/DeviceD3D.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/DeviceD3D.cpp
+index ba5cf532..43304da5 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/DeviceD3D.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/DeviceD3D.cpp
+@@ -13,6 +13,7 @@
+ #include "libANGLE/Display.h"
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ namespace rx
+ {
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/DisplayD3D.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/DisplayD3D.cpp
+index de60dfff..93b5bdf8 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/DisplayD3D.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/DisplayD3D.cpp
+@@ -9,6 +9,7 @@
+ #include "libANGLE/renderer/d3d/DisplayD3D.h"
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ #include "libANGLE/Config.h"
+ #include "libANGLE/Context.h"
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/EGLImageD3D.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/EGLImageD3D.cpp
+index a7255d0d..a7e37777 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/EGLImageD3D.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/EGLImageD3D.cpp
+@@ -20,6 +20,7 @@
+ #include "libANGLE/renderer/d3d/TextureStorage.h"
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ namespace rx
+ {
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/SurfaceD3D.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/SurfaceD3D.cpp
+index 61dc8ffa..87276514 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/SurfaceD3D.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/SurfaceD3D.cpp
+@@ -19,6 +19,7 @@
+ #include "libANGLE/renderer/d3d/d3d11/formatutils11.h"
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <tchar.h>
+ #include <algorithm>
+ 
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/SwapChainD3D.h b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/SwapChainD3D.h
+index 443cadd6..e64bdfc4 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/SwapChainD3D.h
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/SwapChainD3D.h
+@@ -12,6 +12,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <GLES2/gl2.h>
+ 
+ #include "common/angleutils.h"
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/Renderer11.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/Renderer11.cpp
+index 33dfa6b0..eb3393d2 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/Renderer11.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/Renderer11.cpp
+@@ -9,6 +9,7 @@
+ #include "libANGLE/renderer/d3d/d3d11/Renderer11.h"
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <versionhelpers.h>
+ #include <sstream>
+ 
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/SwapChain11.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/SwapChain11.cpp
+index fe4def6e..2550b52c 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/SwapChain11.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/SwapChain11.cpp
+@@ -9,6 +9,7 @@
+ #include "libANGLE/renderer/d3d/d3d11/SwapChain11.h"
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ #include "libANGLE/features.h"
+ #include "libANGLE/renderer/d3d/DisplayD3D.h"
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d9/Renderer9.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d9/Renderer9.cpp
+index f4a4ce43..0cad5540 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d9/Renderer9.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d9/Renderer9.cpp
+@@ -9,6 +9,7 @@
+ #include "libANGLE/renderer/d3d/d3d9/Renderer9.h"
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <sstream>
+ 
+ #include "common/utilities.h"
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/DisplayGL.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/DisplayGL.cpp
+index a89e1365..0fe4fa98 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/DisplayGL.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/DisplayGL.cpp
+@@ -18,6 +18,7 @@
+ #include "libANGLE/renderer/gl/SurfaceGL.h"
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ namespace rx
+ {
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/RendererGL.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/RendererGL.cpp
+index 10b15594..7ae1ac6b 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/RendererGL.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/RendererGL.cpp
+@@ -9,6 +9,7 @@
+ #include "libANGLE/renderer/gl/RendererGL.h"
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ #include "common/debug.h"
+ #include "libANGLE/AttributeMap.h"
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/egl/FunctionsEGL.h b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/egl/FunctionsEGL.h
+index 115a7afb..abb200e6 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/egl/FunctionsEGL.h
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/egl/FunctionsEGL.h
+@@ -11,6 +11,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ #include <string>
+ #include <vector>
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/egl/ozone/DisplayOzone.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/egl/ozone/DisplayOzone.cpp
+index 47ed6ce0..9d11560c 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/egl/ozone/DisplayOzone.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/egl/ozone/DisplayOzone.cpp
+@@ -14,6 +14,7 @@
+ #include <unistd.h>
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ #include <drm_fourcc.h>
+ #include <gbm.h>
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/glx/DisplayGLX.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/glx/DisplayGLX.cpp
+index 23b4a5c5..daeb5789 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/glx/DisplayGLX.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/glx/DisplayGLX.cpp
+@@ -9,6 +9,7 @@
+ #include "libANGLE/renderer/gl/glx/DisplayGLX.h"
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <algorithm>
+ #include <cstring>
+ #include <fstream>
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/renderergl_utils.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/renderergl_utils.cpp
+index 698b51e2..32e6126f 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/renderergl_utils.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/renderergl_utils.cpp
+@@ -27,6 +27,7 @@
+ #include "libANGLE/renderer/gl/formatutilsgl.h"
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <algorithm>
+ #include <sstream>
+ 
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/wgl/DXGISwapChainWindowSurfaceWGL.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/wgl/DXGISwapChainWindowSurfaceWGL.cpp
+index 5b686321..16ae890f 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/wgl/DXGISwapChainWindowSurfaceWGL.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/wgl/DXGISwapChainWindowSurfaceWGL.cpp
+@@ -18,6 +18,7 @@
+ #include "libANGLE/renderer/gl/wgl/FunctionsWGL.h"
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ namespace rx
+ {
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/wgl/DisplayWGL.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/wgl/DisplayWGL.cpp
+index 12679ba7..93503812 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/wgl/DisplayWGL.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/wgl/DisplayWGL.cpp
+@@ -28,6 +28,7 @@
+ #include "platform/Platform.h"
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <sstream>
+ #include <string>
+ 
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/RendererVk.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/RendererVk.cpp
+index df900f4d..4385be88 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/RendererVk.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/RendererVk.cpp
+@@ -13,6 +13,7 @@
+ #include "libANGLE/renderer/vulkan/vk_utils.h"
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ #include "common/debug.h"
+ #include "common/platform.h"
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/validationEGL.cpp b/Source/ThirdParty/ANGLE/src/libANGLE/validationEGL.cpp
+index 1c0b25f4..64e96f73 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/validationEGL.cpp
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/validationEGL.cpp
+@@ -22,6 +22,7 @@
+ #include "libANGLE/formatutils.h"
+ 
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ namespace egl
+ {
+diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/validationEGL.h b/Source/ThirdParty/ANGLE/src/libANGLE/validationEGL.h
+index a671bb0d..248f0ae8 100644
+--- a/Source/ThirdParty/ANGLE/src/libANGLE/validationEGL.h
++++ b/Source/ThirdParty/ANGLE/src/libANGLE/validationEGL.h
+@@ -15,6 +15,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ namespace gl
+ {
+diff --git a/Source/ThirdParty/ANGLE/src/libEGL/egl_loader_autogen.h b/Source/ThirdParty/ANGLE/src/libEGL/egl_loader_autogen.h
+index ae4a427c..a802b65d 100644
+--- a/Source/ThirdParty/ANGLE/src/libEGL/egl_loader_autogen.h
++++ b/Source/ThirdParty/ANGLE/src/libEGL/egl_loader_autogen.h
+@@ -13,6 +13,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ extern PFNEGLCHOOSECONFIGPROC EGL_ChooseConfig;
+ extern PFNEGLCOPYBUFFERSPROC EGL_CopyBuffers;
+diff --git a/Source/ThirdParty/ANGLE/src/libGLESv2/entry_points_egl_ext.h b/Source/ThirdParty/ANGLE/src/libGLESv2/entry_points_egl_ext.h
+index 3c64b290..96201b31 100644
+--- a/Source/ThirdParty/ANGLE/src/libGLESv2/entry_points_egl_ext.h
++++ b/Source/ThirdParty/ANGLE/src/libGLESv2/entry_points_egl_ext.h
+@@ -11,6 +11,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <export.h>
+ 
+ extern "C" {
+diff --git a/Source/ThirdParty/ANGLE/src/tests/deqp_support/tcuANGLENativeDisplayFactory.cpp b/Source/ThirdParty/ANGLE/src/tests/deqp_support/tcuANGLENativeDisplayFactory.cpp
+index 777b09e1..dbb0bd2f 100644
+--- a/Source/ThirdParty/ANGLE/src/tests/deqp_support/tcuANGLENativeDisplayFactory.cpp
++++ b/Source/ThirdParty/ANGLE/src/tests/deqp_support/tcuANGLENativeDisplayFactory.cpp
+@@ -24,6 +24,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ #include "deClock.h"
+ #include "deMemory.h"
+diff --git a/Source/ThirdParty/ANGLE/src/tests/deqp_support/tcuANGLEPlatform.cpp b/Source/ThirdParty/ANGLE/src/tests/deqp_support/tcuANGLEPlatform.cpp
+index 6b4a25bf..1c4ac864 100644
+--- a/Source/ThirdParty/ANGLE/src/tests/deqp_support/tcuANGLEPlatform.cpp
++++ b/Source/ThirdParty/ANGLE/src/tests/deqp_support/tcuANGLEPlatform.cpp
+@@ -22,6 +22,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ #include "egluGLContextFactory.hpp"
+ #include "tcuANGLENativeDisplayFactory.h"
+diff --git a/Source/ThirdParty/ANGLE/src/tests/egl_tests/EGLX11VisualTest.cpp b/Source/ThirdParty/ANGLE/src/tests/egl_tests/EGLX11VisualTest.cpp
+index 90abb931..aea4e153 100644
+--- a/Source/ThirdParty/ANGLE/src/tests/egl_tests/EGLX11VisualTest.cpp
++++ b/Source/ThirdParty/ANGLE/src/tests/egl_tests/EGLX11VisualTest.cpp
+@@ -10,6 +10,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <X11/Xlib.h>
+ 
+ #include "test_utils/ANGLETest.h"
+diff --git a/Source/ThirdParty/ANGLE/src/tests/gles_conformance_tests/gles_conformance_tests.h b/Source/ThirdParty/ANGLE/src/tests/gles_conformance_tests/gles_conformance_tests.h
+index e888a239..71606b8c 100644
+--- a/Source/ThirdParty/ANGLE/src/tests/gles_conformance_tests/gles_conformance_tests.h
++++ b/Source/ThirdParty/ANGLE/src/tests/gles_conformance_tests/gles_conformance_tests.h
+@@ -11,6 +11,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ #include <string>
+ 
+diff --git a/Source/ThirdParty/ANGLE/src/tests/gles_conformance_tests/gles_conformance_tests_main.cpp b/Source/ThirdParty/ANGLE/src/tests/gles_conformance_tests/gles_conformance_tests_main.cpp
+index 7fdddcc6..e40b8905 100644
+--- a/Source/ThirdParty/ANGLE/src/tests/gles_conformance_tests/gles_conformance_tests_main.cpp
++++ b/Source/ThirdParty/ANGLE/src/tests/gles_conformance_tests/gles_conformance_tests_main.cpp
+@@ -10,6 +10,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ #include <map>
+ #include <string>
+diff --git a/Source/ThirdParty/ANGLE/src/tests/test_utils/angle_test_configs.h b/Source/ThirdParty/ANGLE/src/tests/test_utils/angle_test_configs.h
+index 7bc7a027..ebb2827b 100644
+--- a/Source/ThirdParty/ANGLE/src/tests/test_utils/angle_test_configs.h
++++ b/Source/ThirdParty/ANGLE/src/tests/test_utils/angle_test_configs.h
+@@ -16,6 +16,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ #include "GLSLANG/ShaderLang.h"
+ #include "angle_test_instantiate.h"
+diff --git a/Source/ThirdParty/ANGLE/util/OSPixmap.h b/Source/ThirdParty/ANGLE/util/OSPixmap.h
+index ba6ccf4a..563d2578 100644
+--- a/Source/ThirdParty/ANGLE/util/OSPixmap.h
++++ b/Source/ThirdParty/ANGLE/util/OSPixmap.h
+@@ -13,6 +13,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ #include "util/Event.h"
+ #include "util/util_export.h"
+diff --git a/Source/ThirdParty/ANGLE/util/OSWindow.h b/Source/ThirdParty/ANGLE/util/OSWindow.h
+index 3cdb458c..3178fa44 100644
+--- a/Source/ThirdParty/ANGLE/util/OSWindow.h
++++ b/Source/ThirdParty/ANGLE/util/OSWindow.h
+@@ -15,6 +15,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ #include "util/Event.h"
+ #include "util/util_export.h"
+diff --git a/Source/ThirdParty/ANGLE/util/egl_loader_autogen.h b/Source/ThirdParty/ANGLE/util/egl_loader_autogen.h
+index 5fbec82f..77a30330 100644
+--- a/Source/ThirdParty/ANGLE/util/egl_loader_autogen.h
++++ b/Source/ThirdParty/ANGLE/util/egl_loader_autogen.h
+@@ -15,6 +15,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ ANGLE_UTIL_EXPORT extern PFNEGLCHOOSECONFIGPROC eglChooseConfig;
+ ANGLE_UTIL_EXPORT extern PFNEGLCOPYBUFFERSPROC eglCopyBuffers;
+diff --git a/Source/WebCore/platform/graphics/egl/GLContextEGL.cpp b/Source/WebCore/platform/graphics/egl/GLContextEGL.cpp
+index a8a82d70..050893a9 100644
+--- a/Source/WebCore/platform/graphics/egl/GLContextEGL.cpp
++++ b/Source/WebCore/platform/graphics/egl/GLContextEGL.cpp
+@@ -29,6 +29,7 @@
+ #else
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #endif
+ 
+ #if USE(CAIRO)
+diff --git a/Source/WebCore/platform/graphics/wayland/PlatformDisplayWayland.cpp b/Source/WebCore/platform/graphics/wayland/PlatformDisplayWayland.cpp
+index 05f92c22..636df34a 100644
+--- a/Source/WebCore/platform/graphics/wayland/PlatformDisplayWayland.cpp
++++ b/Source/WebCore/platform/graphics/wayland/PlatformDisplayWayland.cpp
+@@ -35,6 +35,7 @@
+ #include <wayland-egl.h>
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <wtf/Assertions.h>
+ 
+ namespace WebCore {
+diff --git a/Source/WebCore/platform/graphics/x11/PlatformDisplayX11.cpp b/Source/WebCore/platform/graphics/x11/PlatformDisplayX11.cpp
+index 8c81119b..bf9ed4bd 100644
+--- a/Source/WebCore/platform/graphics/x11/PlatformDisplayX11.cpp
++++ b/Source/WebCore/platform/graphics/x11/PlatformDisplayX11.cpp
+@@ -38,6 +38,7 @@
+ #if USE(EGL)
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #endif
+ 
+ namespace WebCore {
+diff --git a/Source/WebKit/UIProcess/gtk/AcceleratedBackingStoreWayland.cpp b/Source/WebKit/UIProcess/gtk/AcceleratedBackingStoreWayland.cpp
+index 973b3168..5586236a 100644
+--- a/Source/WebKit/UIProcess/gtk/AcceleratedBackingStoreWayland.cpp
++++ b/Source/WebKit/UIProcess/gtk/AcceleratedBackingStoreWayland.cpp
+@@ -35,6 +35,7 @@
+ #include <gdk/gdkwayland.h>
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <WebCore/CairoUtilities.h>
+ #include <WebCore/GLContext.h>
+ 
+diff --git a/Source/WebKit/UIProcess/gtk/WaylandCompositor.cpp b/Source/WebKit/UIProcess/gtk/WaylandCompositor.cpp
+index 8d848ce4..46d42c11 100644
+--- a/Source/WebKit/UIProcess/gtk/WaylandCompositor.cpp
++++ b/Source/WebKit/UIProcess/gtk/WaylandCompositor.cpp
+@@ -31,6 +31,7 @@
+ #include "WebKitWaylandServerProtocol.h"
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <WebCore/GLContext.h>
+ #include <WebCore/PlatformDisplayWayland.h>
+ #include <WebCore/Region.h>
diff --git a/pkgs/development/lisp-modules/clwrapper/setup-hook.sh b/pkgs/development/lisp-modules/clwrapper/setup-hook.sh
index 8975ada5320..da2303a18bf 100644
--- a/pkgs/development/lisp-modules/clwrapper/setup-hook.sh
+++ b/pkgs/development/lisp-modules/clwrapper/setup-hook.sh
@@ -27,7 +27,7 @@ setLisp () {
 
 collectNixLispLDLP () {
      if echo "$1/lib"/lib*.so* | grep . > /dev/null; then
-	 export NIX_LISP_LD_LIBRARY_PATH="$NIX_LISP_LD_LIBRARY_PATH${NIX_LISP_LD_LIBRARY_PATH:+:}$1/lib"
+	 export NIX_LISP_LD_LIBRARY_PATH="${NIX_LISP_LD_LIBRARY_PATH-}${NIX_LISP_LD_LIBRARY_PATH:+:}$1/lib"
      fi
 }
 
diff --git a/pkgs/development/node-packages/node-env.nix b/pkgs/development/node-packages/node-env.nix
index 670556bf271..7cc212c41bd 100644
--- a/pkgs/development/node-packages/node-env.nix
+++ b/pkgs/development/node-packages/node-env.nix
@@ -363,7 +363,7 @@ let
 
         npm ${forceOfflineFlag} --nodedir=${nodeSources} ${npmFlags} ${stdenv.lib.optionalString production "--production"} rebuild
 
-        if [ "$dontNpmInstall" != "1" ]
+        if [ "''${dontNpmInstall-}" != "1" ]
         then
             # NPM tries to download packages even when they already exist if npm-shrinkwrap is used.
             rm -f npm-shrinkwrap.json
diff --git a/pkgs/development/ocaml-modules/bap/default.nix b/pkgs/development/ocaml-modules/bap/default.nix
index 0766e6e8a8c..a988582ce6c 100644
--- a/pkgs/development/ocaml-modules/bap/default.nix
+++ b/pkgs/development/ocaml-modules/bap/default.nix
@@ -28,8 +28,8 @@ stdenv.mkDerivation rec {
   createFindlibDestdir = true;
 
   setupHook = writeText "setupHook.sh" ''
-    export CAML_LD_LIBRARY_PATH="''${CAML_LD_LIBRARY_PATH}''${CAML_LD_LIBRARY_PATH:+:}''$1/lib/ocaml/${ocaml.version}/site-lib/${name}/"
-    export CAML_LD_LIBRARY_PATH="''${CAML_LD_LIBRARY_PATH}''${CAML_LD_LIBRARY_PATH:+:}''$1/lib/ocaml/${ocaml.version}/site-lib/${name}-llvm-plugins/"
+    export CAML_LD_LIBRARY_PATH="''${CAML_LD_LIBRARY_PATH-}''${CAML_LD_LIBRARY_PATH:+:}''$1/lib/ocaml/${ocaml.version}/site-lib/${name}/"
+    export CAML_LD_LIBRARY_PATH="''${CAML_LD_LIBRARY_PATH-}''${CAML_LD_LIBRARY_PATH:+:}''$1/lib/ocaml/${ocaml.version}/site-lib/${name}-llvm-plugins/"
   '';
 
   nativeBuildInputs = [ which makeWrapper ];
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
   installPhase = ''
     export OCAMLPATH=$OCAMLPATH:$OCAMLFIND_DESTDIR;
     export PATH=$PATH:$out/bin
-    export CAML_LD_LIBRARY_PATH=$CAML_LD_LIBRARY_PATH:$OCAMLFIND_DESTDIR/bap-plugin-llvm/:$OCAMLFIND_DESTDIR/bap/
+    export CAML_LD_LIBRARY_PATH=''${CAML_LD_LIBRARY_PATH-}''${CAML_LD_LIBRARY_PATH:+:}$OCAMLFIND_DESTDIR/bap-plugin-llvm/:$OCAMLFIND_DESTDIR/bap/
     mkdir -p $out/lib/bap
     make install
     rm $out/bin/baptop
diff --git a/pkgs/development/ocaml-modules/ocsigen-server/default.nix b/pkgs/development/ocaml-modules/ocsigen-server/default.nix
index 426fecf3915..9b0b8c433c2 100644
--- a/pkgs/development/ocaml-modules/ocsigen-server/default.nix
+++ b/pkgs/development/ocaml-modules/ocsigen-server/default.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
   ''
   rm -rf $out/var/run
   wrapProgram $out/bin/ocsigenserver \
-    --prefix CAML_LD_LIBRARY_PATH : "$CAML_LD_LIBRARY_PATH:${mkpath ssl "ssl"}:${mkpath ocamlnet "netsys"}:${mkpath ocamlnet "netstring"}:${mkpath ocaml_pcre "pcre"}:${mkpath ocaml_sqlite3 "sqlite3"}"
+    --suffix CAML_LD_LIBRARY_PATH : "${mkpath ssl "ssl"}:${mkpath ocamlnet "netsys"}:${mkpath ocamlnet "netstring"}:${mkpath ocaml_pcre "pcre"}:${mkpath ocaml_sqlite3 "sqlite3"}"
   '';
 
   dontPatchShebangs = true;
diff --git a/pkgs/development/python-modules/cfn-lint/default.nix b/pkgs/development/python-modules/cfn-lint/default.nix
index 15133257738..5dc84e07eb0 100644
--- a/pkgs/development/python-modules/cfn-lint/default.nix
+++ b/pkgs/development/python-modules/cfn-lint/default.nix
@@ -8,6 +8,7 @@
 , jsonpatch
 , jsonschema
 , pathlib2
+, setuptools
 }:
 
 buildPythonPackage rec {
@@ -27,6 +28,7 @@ buildPythonPackage rec {
     jsonpatch
     jsonschema
     pathlib2
+    setuptools
   ];
 
   # No tests included in archive
diff --git a/pkgs/development/python-modules/mpi4py/default.nix b/pkgs/development/python-modules/mpi4py/default.nix
index e2028d9332b..8cd639e520c 100644
--- a/pkgs/development/python-modules/mpi4py/default.nix
+++ b/pkgs/development/python-modules/mpi4py/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "mpi4py";
-  version = "3.0.2";
+  version = "3.0.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1q28xl36difma1wq0acq111cqxjya32kn3lxp6fbidz3wg8jkmpq";
+    sha256 = "012d716c8b9ed1e513fcc4b18e5af16a8791f51e6d1716baccf988ad355c5a1f";
   };
 
   passthru = {
diff --git a/pkgs/development/python-modules/mwoauth/default.nix b/pkgs/development/python-modules/mwoauth/default.nix
index d643e71f258..778a081992c 100644
--- a/pkgs/development/python-modules/mwoauth/default.nix
+++ b/pkgs/development/python-modules/mwoauth/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "mwoauth";
-  version = "0.3.5";
+  version = "0.3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c7e4c56561a280e14ca4cc20b79ba4a9dd4ec752ff4c797cf29dad4460fb7832";
+    sha256 = "9e0d70a1fa6f452584de1cb853ae6c11f41233549f7839cfb879f99410f6ad46";
   };
 
   # package has no tests
diff --git a/pkgs/development/python-modules/myfitnesspal/default.nix b/pkgs/development/python-modules/myfitnesspal/default.nix
index b839fd2633e..570d0c3e749 100644
--- a/pkgs/development/python-modules/myfitnesspal/default.nix
+++ b/pkgs/development/python-modules/myfitnesspal/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "myfitnesspal";
-  version = "1.13.3";
+  version = "1.13.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4f785341f0499bad8d3400cfcfffd99b7fcf8aac3971390f8ec3dfaed8361b20";
+    sha256 = "552cc696e170f12f75fd12b1447be01fa2d0bfd85e14da5928afd9aab2277b98";
   };
 
   # Remove overly restrictive version constraints on keyring and keyrings.alt
diff --git a/pkgs/development/python-modules/mysqlclient/default.nix b/pkgs/development/python-modules/mysqlclient/default.nix
index b37f191286e..b2af7bded1c 100644
--- a/pkgs/development/python-modules/mysqlclient/default.nix
+++ b/pkgs/development/python-modules/mysqlclient/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonPackage rec {
   pname = "mysqlclient";
-  version = "1.4.4";
+  version = "1.4.5";
 
   nativeBuildInputs = [
     libmysqlclient
@@ -17,7 +17,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1379hab7spjp9v5fypqgy0b8vr8vnalxahm9hcsxvj2xbb2pqwww";
+    sha256 = "e80109b0ae8d952b900b31b623181532e5e89376d707dcbeb63f99e69cefe559";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/python-modules/nbconvert/default.nix b/pkgs/development/python-modules/nbconvert/default.nix
index 965d3df0e91..b0357c16165 100644
--- a/pkgs/development/python-modules/nbconvert/default.nix
+++ b/pkgs/development/python-modules/nbconvert/default.nix
@@ -22,11 +22,11 @@
 
 buildPythonPackage rec {
   pname = "nbconvert";
-  version = "5.6.0";
+  version = "5.6.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "427a468ec26e7d68a529b95f578d5cbf018cb4c1f889e897681c2b6d11897695";
+    sha256 = "21fb48e700b43e82ba0e3142421a659d7739b65568cc832a13976a77be16b523";
   };
 
   checkInputs = [ nose pytest glibcLocales ];
diff --git a/pkgs/development/python-modules/nbdime/default.nix b/pkgs/development/python-modules/nbdime/default.nix
index 25605a21727..5bff17ee895 100644
--- a/pkgs/development/python-modules/nbdime/default.nix
+++ b/pkgs/development/python-modules/nbdime/default.nix
@@ -24,12 +24,12 @@
 
 buildPythonPackage rec {
   pname = "nbdime";
-  version = "1.0.6";
+  version = "1.0.7";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "00nywb69kp9i0wl5mczgwqc5db8v70ihr9cjbwqppd2jkx4vf34j";
+    sha256 = "28615cb92d59e0511026bac4c916f16dc15981bcad4ddc3f7fdd6a289ea01242";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/notebook/default.nix b/pkgs/development/python-modules/notebook/default.nix
index d196b6a6947..3c174288b82 100644
--- a/pkgs/development/python-modules/notebook/default.nix
+++ b/pkgs/development/python-modules/notebook/default.nix
@@ -25,12 +25,12 @@
 
 buildPythonPackage rec {
   pname = "notebook";
-  version = "6.0.1";
+  version = "6.0.2";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "660976fe4fe45c7aa55e04bf4bccb9f9566749ff637e9020af3422f9921f9a5d";
+    sha256 = "399a4411e171170173344761e7fd4491a3625659881f76ce47c50231ed714d9b";
   };
 
   LC_ALL = "en_US.utf8";
diff --git a/pkgs/development/python-modules/numcodecs/default.nix b/pkgs/development/python-modules/numcodecs/default.nix
index 775cfeded8b..e49e6e19239 100644
--- a/pkgs/development/python-modules/numcodecs/default.nix
+++ b/pkgs/development/python-modules/numcodecs/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "numcodecs";
-  version = "0.6.3";
+  version = "0.6.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "086qwlyi01rpgyyyy8bmhh9i7hpksyz33ldci3wdwmhiblyl362y";
+    sha256 = "ef4843d5db4d074e607e9b85156835c10d006afc10e175bda62ff5412fca6e4d";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/numpy/default.nix b/pkgs/development/python-modules/numpy/default.nix
index f5ce093cb49..fdc5e9b8f13 100644
--- a/pkgs/development/python-modules/numpy/default.nix
+++ b/pkgs/development/python-modules/numpy/default.nix
@@ -16,12 +16,12 @@ let
   };
 in buildPythonPackage rec {
   pname = "numpy";
-  version = "1.17.3";
+  version = "1.17.4";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "a0678793096205a4d784bd99f32803ba8100f639cf3b932dc63b21621390ea7e";
+    sha256 = "f58913e9227400f1395c7b800503ebfdb0772f1c33ff8cb4d6451c06cabdf316";
   };
 
   nativeBuildInputs = [ gfortran pytest ];
diff --git a/pkgs/development/python-modules/pandas/2.nix b/pkgs/development/python-modules/pandas/2.nix
index 0ea27b04dcb..42e6fe845e0 100644
--- a/pkgs/development/python-modules/pandas/2.nix
+++ b/pkgs/development/python-modules/pandas/2.nix
@@ -32,11 +32,11 @@ let
 
 in buildPythonPackage rec {
   pname = "pandas";
-  version = "0.25.2";
+  version = "0.25.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ca91a19d1f0a280874a24dca44aadce42da7f3a7edb7e9ab7c7baad8febee2be";
+    sha256 = "52da74df8a9c9a103af0a72c9d5fdc8e0183a90884278db7f386b5692a2220a4";
   };
 
   checkInputs = [ pytest glibcLocales moto hypothesis ];
diff --git a/pkgs/development/python-modules/pandas/default.nix b/pkgs/development/python-modules/pandas/default.nix
index b3dcec637fe..218194812b8 100644
--- a/pkgs/development/python-modules/pandas/default.nix
+++ b/pkgs/development/python-modules/pandas/default.nix
@@ -30,11 +30,11 @@ let
 
 in buildPythonPackage rec {
   pname = "pandas";
-  version = "0.25.2";
+  version = "0.25.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ca91a19d1f0a280874a24dca44aadce42da7f3a7edb7e9ab7c7baad8febee2be";
+    sha256 = "52da74df8a9c9a103af0a72c9d5fdc8e0183a90884278db7f386b5692a2220a4";
   };
 
   checkInputs = [ pytest glibcLocales moto hypothesis ];
diff --git a/pkgs/development/python-modules/persistent/default.nix b/pkgs/development/python-modules/persistent/default.nix
index 88008cd9530..76d5441c048 100644
--- a/pkgs/development/python-modules/persistent/default.nix
+++ b/pkgs/development/python-modules/persistent/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "persistent";
-  version = "4.5.0";
+  version = "4.5.1";
 
   nativeBuildInputs = [ sphinx manuel ];
   propagatedBuildInputs = [ zope_interface cffi ];
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0slbvq1m3rilgyhj6i522rsyv592xv9pmvm61mrmgkgf40kfnz69";
+    sha256 = "73862779577cb8637f2b68e7edee9a9b95cf33d0b83cb6e762f0f3fc12897aa6";
   };
 
   meta = {
diff --git a/pkgs/development/python-modules/phonenumbers/default.nix b/pkgs/development/python-modules/phonenumbers/default.nix
index 288e33e0506..d37be90099c 100644
--- a/pkgs/development/python-modules/phonenumbers/default.nix
+++ b/pkgs/development/python-modules/phonenumbers/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "phonenumbers";
-  version = "8.10.21";
+  version = "8.10.22";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "162301aa2ce7c1a7196d7b5b084e3263a0a5f55e3129fe2429f2a115c3ef16c3";
+    sha256 = "705dc7bbaa0d5932e9c010437c718bb3c0d7c93ab25b9710b4d9ae7370cc0121";
   };
 
   meta = {
diff --git a/pkgs/development/python-modules/pipdate/default.nix b/pkgs/development/python-modules/pipdate/default.nix
index 8628705ed4d..08ed0c43a22 100644
--- a/pkgs/development/python-modules/pipdate/default.nix
+++ b/pkgs/development/python-modules/pipdate/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "pipdate";
-  version = "0.3.2";
+  version = "0.3.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a27f64d13269adfd8594582f5a62c9f2151b426e701afdfc3b4f4019527b4121";
+    sha256 = "26bd12075e63ef7f8094da36c27bf5539d298f4ef2af6acba20e98b502439d6d";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/plac/default.nix b/pkgs/development/python-modules/plac/default.nix
index 0622e41fa7e..77bcf6cf4fc 100644
--- a/pkgs/development/python-modules/plac/default.nix
+++ b/pkgs/development/python-modules/plac/default.nix
@@ -5,11 +5,11 @@
 }:
 buildPythonPackage rec {
   pname = "plac";
-  version = "1.1.0";
+  version = "1.1.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "10f0blwxn7k2qvd0vs4300jxb8n9r7jhngf9bx9bfxia8akwy5kw";
+    sha256 = "398cb947c60c4c25e275e1f1dadf027e7096858fb260b8ece3b33bcff90d985f";
   };
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/psutil/default.nix b/pkgs/development/python-modules/psutil/default.nix
index 37c19f5c14b..a3d909bb3d4 100644
--- a/pkgs/development/python-modules/psutil/default.nix
+++ b/pkgs/development/python-modules/psutil/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "psutil";
-  version = "5.6.3";
+  version = "5.6.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "863a85c1c0a5103a12c05a35e59d336e1d665747e531256e061213e2e90f63f3";
+    sha256 = "d051532ac944f1be0179e0506f6889833cf96e466262523e57a871de65a15147";
   };
 
   # No tests in archive
diff --git a/pkgs/development/python-modules/pyatmo/default.nix b/pkgs/development/python-modules/pyatmo/default.nix
index 56467d1e4a5..795f623ba53 100644
--- a/pkgs/development/python-modules/pyatmo/default.nix
+++ b/pkgs/development/python-modules/pyatmo/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "pyatmo";
-  version = "2.3.2";
+  version = "2.3.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2c76740e5adbf8b14d8f41d4f84ce23c0e8e738b18b926dc60858c35bf2fa8f2";
+    sha256 = "b884402c62d589a38444e8f4b3892b18312e8f9442cd8d12e7ec01c698328f54";
   };
 
   propagatedBuildInputs = [ requests ];
diff --git a/pkgs/development/python-modules/pybase64/default.nix b/pkgs/development/python-modules/pybase64/default.nix
index 544ce1826f3..6c32de593c1 100644
--- a/pkgs/development/python-modules/pybase64/default.nix
+++ b/pkgs/development/python-modules/pybase64/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "pybase64";
-  version = "1.0.0";
+  version = "1.0.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "71a729b10232b38cba001e621dbaa6dbba2302dc44a93706295f1ff760f40876";
+    sha256 = "6ced40531bffc81bafc790d5c0d2f752e281b3b00fd6ff4e79385c625e5dbab1";
   };
 
   propagatedBuildInputs = [ six ];
diff --git a/pkgs/development/python-modules/pybids/default.nix b/pkgs/development/python-modules/pybids/default.nix
index 38108e6e659..84f5a41c45b 100644
--- a/pkgs/development/python-modules/pybids/default.nix
+++ b/pkgs/development/python-modules/pybids/default.nix
@@ -15,12 +15,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "0.9.4";
+  version = "0.9.5";
   pname = "pybids";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "08abd3573e823e536990caf54405ffef573a88ef9d019c2d94e0be995e21885f";
+    sha256 = "0e8f8466067ff3023f53661c390c02702fcd5fe712bdd5bf167ffb0c2b920430";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pybullet/default.nix b/pkgs/development/python-modules/pybullet/default.nix
index 93be1fe4a03..f72f09a3328 100644
--- a/pkgs/development/python-modules/pybullet/default.nix
+++ b/pkgs/development/python-modules/pybullet/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "pybullet";
-  version = "2.5.6";
+  version = "2.5.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ffeb00f393dcddc11d195a72623e3b06767a37e4fdfa06ef88fbd74c8d326adb";
+    sha256 = "82a235a8fe3c8dee753d765c295ff0da92bcb5096209d26a0cfc3f5c6054e374";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/pycryptodome/default.nix b/pkgs/development/python-modules/pycryptodome/default.nix
index f07b33cf477..c3b807ce43c 100644
--- a/pkgs/development/python-modules/pycryptodome/default.nix
+++ b/pkgs/development/python-modules/pycryptodome/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchPypi, buildPythonPackage }:
 
 buildPythonPackage rec {
-  version = "3.9.0";
+  version = "3.9.2";
   pname = "pycryptodome";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "dbeb08ad850056747aa7d5f33273b7ce0b9a77910604a1be7b7a6f2ef076213f";
+    sha256 = "e1e007d072d50844188c067c325af8b3ad31e4b87792381469b821e95bf14cd8";
   };
 
   meta = {
diff --git a/pkgs/development/python-modules/pycryptodomex/default.nix b/pkgs/development/python-modules/pycryptodomex/default.nix
index 1ec636f9f32..7d3204e021a 100644
--- a/pkgs/development/python-modules/pycryptodomex/default.nix
+++ b/pkgs/development/python-modules/pycryptodomex/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonPackage rec {
   pname = "pycryptodomex";
-  version = "3.9.0";
+  version = "3.9.2";
 
   meta = {
     description = "A self-contained cryptographic library for Python";
@@ -12,6 +12,6 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8b604f4fa1de456d6d19771b01c2823675a75a2c60e51a6b738f71fdfe865370";
+    sha256 = "137e8e2c7438184dae0b940cdf5d0d4f639b1df564a95dadbb7c4ec188850921";
   };
 }
diff --git a/pkgs/development/python-modules/pymupdf/default.nix b/pkgs/development/python-modules/pymupdf/default.nix
index f6c1cc61ebb..dc9b38eec9b 100644
--- a/pkgs/development/python-modules/pymupdf/default.nix
+++ b/pkgs/development/python-modules/pymupdf/default.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPythonPackage, fetchPypi, mupdf, swig }:
 buildPythonPackage rec {
   pname = "PyMuPDF";
-  version = "1.16.5";
+  version = "1.16.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9909b1db81952abb09a2c17cca8ffa17f4a05a864653d6e702ce86bfa70c6a23";
+    sha256 = "b16c85b2f89cc89e36b59fe734f14e5c939c8b24697bf33ff7a19584e8334976";
   };
 
   patchPhase = ''
diff --git a/pkgs/development/python-modules/pyopencl/default.nix b/pkgs/development/python-modules/pyopencl/default.nix
index cbe9b111a2c..0fd6253e5fd 100644
--- a/pkgs/development/python-modules/pyopencl/default.nix
+++ b/pkgs/development/python-modules/pyopencl/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "pyopencl";
-  version = "2019.1.1";
+  version = "2019.1.2";
 
   checkInputs = [ pytest ];
   buildInputs = [ opencl-headers ocl-icd pybind11 ];
@@ -25,7 +25,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0g5n1c8gfqhfrfpzdypzwfj1q1nlqzcfjrx397cs6qqw67mg095k";
+    sha256 = "7803f3128dbd28ae6f5b851a80ef586a35b9575406ea7bb068b8e1516f8043f0";
   };
 
   # py.test is not needed during runtime, so remove it from `install_requires`
diff --git a/pkgs/development/python-modules/pyparsing/default.nix b/pkgs/development/python-modules/pyparsing/default.nix
index 2fd3ca60ad8..854ca4d90ee 100644
--- a/pkgs/development/python-modules/pyparsing/default.nix
+++ b/pkgs/development/python-modules/pyparsing/default.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPythonPackage, fetchPypi }:
 buildPythonPackage rec {
     pname = "pyparsing";
-    version = "2.4.2";
+    version = "2.4.5";
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "6f98a7b9397e206d78cc01df10131398f1c8b8510a2f4d97d9abd82e1aacdd80";
+      sha256 = "4ca62001be367f01bd3e92ecbb79070272a9d4964dce6a48a82ff0b8bc7e683a";
     };
 
     # Not everything necessary to run the tests is included in the distribution
diff --git a/pkgs/development/python-modules/pyrsistent/default.nix b/pkgs/development/python-modules/pyrsistent/default.nix
index c8310c39441..b4edb02258a 100644
--- a/pkgs/development/python-modules/pyrsistent/default.nix
+++ b/pkgs/development/python-modules/pyrsistent/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "pyrsistent";
-  version = "0.15.4";
+  version = "0.15.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0cv5xvhfhlj88pb0ghdwivkfcmgi6503qjwxx4r6n06nd6hpzd1l";
+    sha256 = "eb6545dbeb1aa69ab1fb4809bfbf5a8705e44d92ef8fc7c2361682a47c46c778";
   };
 
   propagatedBuildInputs = [ six ];
diff --git a/pkgs/development/python-modules/pyside/default.nix b/pkgs/development/python-modules/pyside/default.nix
index 37ffd8e76e3..3f20a6ae478 100644
--- a/pkgs/development/python-modules/pyside/default.nix
+++ b/pkgs/development/python-modules/pyside/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchurl, cmake, buildPythonPackage, pysideGeneratorrunner, pysideShiboken, qt4, mesa }:
+{ lib, fetchurl, cmake, buildPythonPackage, pysideGeneratorrunner, pysideShiboken, qt4, mesa, libGL }:
 
 # This derivation provides a Python module and should therefore be called via `python-packages.nix`.
 buildPythonPackage rec {
@@ -15,7 +15,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [ cmake pysideGeneratorrunner pysideShiboken qt4 ];
 
-  buildInputs = [ mesa ];
+  buildInputs = [ mesa libGL ];
 
   makeFlags = "QT_PLUGIN_PATH=" + pysideShiboken + "/lib/generatorrunner";
 
diff --git a/pkgs/development/python-modules/pytest-mypy/default.nix b/pkgs/development/python-modules/pytest-mypy/default.nix
index bca04ab7b36..4fb2146d7a7 100644
--- a/pkgs/development/python-modules/pytest-mypy/default.nix
+++ b/pkgs/development/python-modules/pytest-mypy/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "pytest-mypy";
-  version = "0.4.1";
+  version = "0.4.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f6348a3aa08d7b38b05c12ed0965415e1b60d402d7ceb353f5116f6eaf7dac28";
+    sha256 = "5a5338cecff17f005b181546a13e282761754b481225df37f33d37f86ac5b304";
   };
 
   propagatedBuildInputs = [ pytest mypy ];
diff --git a/pkgs/development/python-modules/pytest/default.nix b/pkgs/development/python-modules/pytest/default.nix
index 6088d78bba5..39eed4f13c6 100644
--- a/pkgs/development/python-modules/pytest/default.nix
+++ b/pkgs/development/python-modules/pytest/default.nix
@@ -3,7 +3,7 @@
 , atomicwrites, mock, writeText, pathlib2, wcwidth, packaging, isPyPy, python
 }:
 buildPythonPackage rec {
-  version = "5.2.1";
+  version = "5.2.2";
   pname = "pytest";
 
   disabled = !isPy3k;
@@ -15,7 +15,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ca563435f4941d0cb34767301c27bc65c510cb82e90b9ecf9cb52dc2c63caaa0";
+    sha256 = "27abc3fef618a01bebb1f0d6d303d2816a99aa87a5968ebc32fe971be91eb1e6";
   };
 
   checkInputs = [ hypothesis mock ];
diff --git a/pkgs/development/python-modules/python-daemon/default.nix b/pkgs/development/python-modules/python-daemon/default.nix
index 93c05106404..41b7aa78bab 100644
--- a/pkgs/development/python-modules/python-daemon/default.nix
+++ b/pkgs/development/python-modules/python-daemon/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "python-daemon";
-  version = "2.2.3";
+  version = "2.2.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "affeca9e5adfce2666a63890af9d6aff79f670f7511899edaddca7f96593cc25";
+    sha256 = "57c84f50a04d7825515e4dbf3a31c70cc44414394a71608dee6cfde469e81766";
   };
 
   # A test fail within chroot builds.
diff --git a/pkgs/development/python-modules/pythonnet/default.nix b/pkgs/development/python-modules/pythonnet/default.nix
index 9bcbaf3e6f7..f916ec63b30 100644
--- a/pkgs/development/python-modules/pythonnet/default.nix
+++ b/pkgs/development/python-modules/pythonnet/default.nix
@@ -43,8 +43,8 @@ buildPythonPackage rec {
   '';
 
   preConfigure = ''
-    [ -z "$dontPlacateNuget" ] && placate-nuget.sh
-    [ -z "$dontPlacatePaket" ] && placate-paket.sh
+    [ -z "''${dontPlacateNuget-}" ] && placate-nuget.sh
+    [ -z "''${dontPlacatePaket-}" ] && placate-paket.sh
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/reportlab/default.nix b/pkgs/development/python-modules/reportlab/default.nix
index eaa691a6b75..2286ebbc4cc 100644
--- a/pkgs/development/python-modules/reportlab/default.nix
+++ b/pkgs/development/python-modules/reportlab/default.nix
@@ -11,11 +11,11 @@ let
   ft = freetype.overrideAttrs (oldArgs: { dontDisableStatic = true; });
 in buildPythonPackage rec {
   pname = "reportlab";
-  version = "3.5.31";
+  version = "3.5.32";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3e2d2ea8ac3d63c918a2b40476c2745704d0364abe2b9c844c75992132a5eac7";
+    sha256 = "83ef44936ef4e9c432d62bc2b72ec8d772b87af319d123e827a72e9b6884c851";
   };
 
   checkInputs = [ glibcLocales ];
diff --git a/pkgs/development/python-modules/rethinkdb/default.nix b/pkgs/development/python-modules/rethinkdb/default.nix
index a6087c9859c..7eea5d2c39f 100644
--- a/pkgs/development/python-modules/rethinkdb/default.nix
+++ b/pkgs/development/python-modules/rethinkdb/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "rethinkdb";
-  version = "2.4.4";
+  version = "2.4.4.post1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d01b39c1921498e22e3c9cae1adb39c37b68e4438ef77218abc0166fdfd2ea7a";
+    sha256 = "e1c1f8ad93bc1c6f2aaa73afc333c57d505d8cc08c437d78a5c1eb8dc4b7e8c2";
   };
 
   doCheck = false;
diff --git a/pkgs/development/python-modules/runway-python/default.nix b/pkgs/development/python-modules/runway-python/default.nix
index f46a35004ab..62e0d2f0beb 100644
--- a/pkgs/development/python-modules/runway-python/default.nix
+++ b/pkgs/development/python-modules/runway-python/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "runway-python";
-  version = "0.5.0";
+  version = "0.5.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d3573a003899eb33c0edbc1d59c16c8c19c092512da0c75ceb1f46063a18c7e9";
+    sha256 = "00cf6fa9ea3b6a195e9eca96216a9d206b6884624d0214bd776f8654cd5e8fea";
   };
 
   propagatedBuildInputs = [ flask flask-cors numpy pillow gevent wget six colorcet ];
diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index 93488917017..dd561c54853 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "scipy";
-  version = "1.3.1";
+  version = "1.3.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2643cfb46d97b7797d1dbdb6f3c23fe3402904e3c90e6facfe6a9b98d808c1b5";
+    sha256 = "a03939b431994289f39373c57bbe452974a7da724ae7f9620a1beee575434da4";
   };
 
   checkInputs = [ nose pytest ];
diff --git a/pkgs/development/python-modules/sentry-sdk/default.nix b/pkgs/development/python-modules/sentry-sdk/default.nix
index 0705ed4bc83..da729f5ab0b 100644
--- a/pkgs/development/python-modules/sentry-sdk/default.nix
+++ b/pkgs/development/python-modules/sentry-sdk/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "sentry-sdk";
-  version = "0.13.0";
+  version = "0.13.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ff14935cc3053de0650128f124c36f34a4be120b8cc522c149f5cba342c1fd05";
+    sha256 = "ff1fa7fb85703ae9414c8b427ee73f8363232767c9cd19158f08f6e4f0b58fc7";
   };
 
   checkInputs = [ django flask tornado bottle rq falcon ]
diff --git a/pkgs/development/python-modules/soupsieve/default.nix b/pkgs/development/python-modules/soupsieve/default.nix
index 737e9e0803a..8995e98ca78 100644
--- a/pkgs/development/python-modules/soupsieve/default.nix
+++ b/pkgs/development/python-modules/soupsieve/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "soupsieve";
-  version = "1.9.4";
+  version = "1.9.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "605f89ad5fdbfefe30cdc293303665eff2d188865d4dbe4eb510bba1edfbfce3";
+    sha256 = "e2c1c5dee4a1c36bcb790e0fabd5492d874b8ebd4617622c4f6a731701060dda";
   };
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/sqlmap/default.nix b/pkgs/development/python-modules/sqlmap/default.nix
index 74d73638b1e..56d2c6799b4 100644
--- a/pkgs/development/python-modules/sqlmap/default.nix
+++ b/pkgs/development/python-modules/sqlmap/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "sqlmap";
-  version = "1.3.10";
+  version = "1.3.11";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3f045e8e9ee1293e2d0ab4396950deed71f095a7762f063f3e5f54a839b8d5b4";
+    sha256 = "27ef900b1116776128d0d09bff21f8d2f6bb2ea887cd59fe1a32aec5563aacb0";
   };
 
   # No tests in archive
diff --git a/pkgs/development/python-modules/starlette/default.nix b/pkgs/development/python-modules/starlette/default.nix
index 1ccb8bcaf70..6580a87b2fe 100644
--- a/pkgs/development/python-modules/starlette/default.nix
+++ b/pkgs/development/python-modules/starlette/default.nix
@@ -18,12 +18,12 @@
 
 buildPythonPackage rec {
   pname = "starlette";
-  version = "0.12.10";
+  version = "0.12.13";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e41ef52e711a82ef95c195674e5d8d41c75c6b1d6f5a275637eedd4cc2150a7f";
+    sha256 = "9597bc28e3c4659107c1c4a45ec32dc45e947d78fe56230222be673b2c36454a";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/strictyaml/default.nix b/pkgs/development/python-modules/strictyaml/default.nix
index 496ed66c1ac..bb4824b5c02 100644
--- a/pkgs/development/python-modules/strictyaml/default.nix
+++ b/pkgs/development/python-modules/strictyaml/default.nix
@@ -6,12 +6,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "1.0.5";
+  version = "1.0.6";
   pname = "strictyaml";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "aad8d90c4d300c5bfa7678b9680ce456406319859c7279e98110548b596b5ae7";
+    sha256 = "dd687a32577e0b832619ce0552eac86d6afad5fa7b61ab041bb765881c6a1f36";
   };
 
   propagatedBuildInputs = [ ruamel_yaml python-dateutil ];
diff --git a/pkgs/development/python-modules/tables/3.5.nix b/pkgs/development/python-modules/tables/3.5.nix
index 1123d4626c9..b27584d25d0 100644
--- a/pkgs/development/python-modules/tables/3.5.nix
+++ b/pkgs/development/python-modules/tables/3.5.nix
@@ -4,12 +4,12 @@
 with stdenv.lib;
 
 buildPythonPackage rec {
-  version = "3.6.0";
+  version = "3.6.1";
   pname = "tables";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "db3488214864fb313a611fca68bf1c9019afe4e7877be54d0e61c84416603d4d";
+    sha256 = "49a972b8a7c27a8a173aeb05f67acb45fe608b64cd8e9fa667c0962a60b71b49";
   };
 
   buildInputs = [ hdf5 cython bzip2 lzo c-blosc ];
diff --git a/pkgs/development/python-modules/tenacity/default.nix b/pkgs/development/python-modules/tenacity/default.nix
index c03c2e1a30d..254b91891c7 100644
--- a/pkgs/development/python-modules/tenacity/default.nix
+++ b/pkgs/development/python-modules/tenacity/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "tenacity";
-  version = "5.1.1";
+  version = "5.1.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a4eb168dbf55ed2cae27e7c6b2bd48ab54dabaf294177d998330cf59f294c112";
+    sha256 = "e664bd94f088b17f46da33255ae33911ca6a0fe04b156d334b601a4ef66d3c5f";
   };
 
   nativeBuildInputs = [ pbr setuptools_scm ];
diff --git a/pkgs/development/python-modules/testfixtures/default.nix b/pkgs/development/python-modules/testfixtures/default.nix
index a08241332dc..f429f72cc01 100644
--- a/pkgs/development/python-modules/testfixtures/default.nix
+++ b/pkgs/development/python-modules/testfixtures/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "testfixtures";
-  version = "6.10.0";
+  version = "6.10.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1kiv60i0s67v34x28j6cshby7n7mbhd7a7val639yvvlh1f0q8wx";
+    sha256 = "abbca7ed381d34a77699c6cb68be67919a1e7f5cf8728b57396145417fa34110";
   };
 
   checkInputs = [ pytest mock sybil zope_component twisted ];
diff --git a/pkgs/development/python-modules/testpath/default.nix b/pkgs/development/python-modules/testpath/default.nix
index 8bdd50f52d2..c9d0e8f0ad2 100644
--- a/pkgs/development/python-modules/testpath/default.nix
+++ b/pkgs/development/python-modules/testpath/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "testpath";
-  version = "0.4.2";
+  version = "0.4.4";
   format = "wheel";
 
   src = fetchPypi {
     inherit pname version format;
-    sha256 = "46c89ebb683f473ffe2aab0ed9f12581d4d078308a3cb3765d79c6b2317b0109";
+    sha256 = "bfcf9411ef4bf3db7579063e0546938b1edda3d69f4e1fb8756991f5951f85d4";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/python-modules/tld/default.nix b/pkgs/development/python-modules/tld/default.nix
index 470a4bb40dd..95c3756dade 100644
--- a/pkgs/development/python-modules/tld/default.nix
+++ b/pkgs/development/python-modules/tld/default.nix
@@ -2,11 +2,11 @@
 
 python.pkgs.buildPythonPackage rec {
   pname   = "tld";
-  version = "0.9.6";
+  version = "0.9.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0figmf80y715zv6viqan2nyzpg9aia5dyl25nskirpm5lh1s99w9";
+    sha256 = "cef15360ec42547a583d49ef5246936b3ace424a95c00b59c09dcbe44b289961";
   };
 
   propagatedBuildInputs = with python.pkgs; [ six ];
diff --git a/pkgs/development/python-modules/trustme/default.nix b/pkgs/development/python-modules/trustme/default.nix
index 601e49759fd..8784dad7ad1 100644
--- a/pkgs/development/python-modules/trustme/default.nix
+++ b/pkgs/development/python-modules/trustme/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "trustme";
-  version = "0.5.2";
+  version = "0.5.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "103f8n0c60593r0z8hh1zvk1bagxwnhrv3203xpiiddwqxalr04b";
+    sha256 = "f0f96a21b430cc29661644d3569a1112a397ca9cc8595b964d4ae71e5e957529";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/typing-extensions/default.nix b/pkgs/development/python-modules/typing-extensions/default.nix
index ef5fed68912..6c1e85eb93c 100644
--- a/pkgs/development/python-modules/typing-extensions/default.nix
+++ b/pkgs/development/python-modules/typing-extensions/default.nix
@@ -4,11 +4,11 @@ let
 
 in buildPythonPackage rec {
   pname = "typing_extensions";
-  version = "3.7.4";
+  version = "3.7.4.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "15bx773a5zkk4hkwjl8nb5f8y5741vyyqb9q3jac6kxm1frk5mif";
+    sha256 = "091ecc894d5e908ac75209f10d5b4f118fbdb2eb1ede6a63544054bb1edb41f2";
   };
 
   checkInputs = lib.optional (pythonOlder "3.5") typing;
diff --git a/pkgs/development/python-modules/unittest-xml-reporting/default.nix b/pkgs/development/python-modules/unittest-xml-reporting/default.nix
index 624ff585c36..8d815833a40 100644
--- a/pkgs/development/python-modules/unittest-xml-reporting/default.nix
+++ b/pkgs/development/python-modules/unittest-xml-reporting/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonPackage rec {
   pname = "unittest-xml-reporting";
-  version = "2.5.1";
+  version = "2.5.2";
 
   propagatedBuildInputs = [six];
 
@@ -11,7 +11,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0v6xcs8nx82yw037h296zk0vz5ka4idm4xdpxkcm4h4fnpj8428l";
+    sha256 = "9d28ddf6524cf0ff9293f61bd12e792de298f8561a5c945acea63fb437789e0e";
   };
   meta = with lib; {
     homepage = https://github.com/xmlrunner/unittest-xml-reporting/tree/master/;
diff --git a/pkgs/development/python-modules/uproot/default.nix b/pkgs/development/python-modules/uproot/default.nix
index ff0e5d61482..6fd90fc3a18 100644
--- a/pkgs/development/python-modules/uproot/default.nix
+++ b/pkgs/development/python-modules/uproot/default.nix
@@ -15,11 +15,11 @@
 
 buildPythonPackage rec {
   pname = "uproot";
-  version = "3.10.8";
+  version = "3.10.10";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "cf9b9a6824e82f2e45d44e2c9d8a230ce9f83972e74427543862fdff462fb121";
+    sha256 = "2c780472c5c328d2e34508db1da399038653142572fc3d0b5777b2311edabd83";
   };
 
   nativeBuildInputs = [ pytestrunner ];
diff --git a/pkgs/development/python-modules/vcrpy/default.nix b/pkgs/development/python-modules/vcrpy/default.nix
index 507a082f9a0..ef3e92f01a7 100644
--- a/pkgs/development/python-modules/vcrpy/default.nix
+++ b/pkgs/development/python-modules/vcrpy/default.nix
@@ -15,11 +15,11 @@
 
 buildPythonPackage rec {
   pname = "vcrpy";
-  version = "2.1.0";
+  version = "2.1.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0e79239441fb4c731da9f05aecbd062223ef1f4ab668d2400c63c347a7071414";
+    sha256 = "27cc696df66d77703eab5cdfa041b2f9877bbf2b54bcd390de89a4be964ca536";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/whisper/default.nix b/pkgs/development/python-modules/whisper/default.nix
index 407bb88fa2a..134d797ecf8 100644
--- a/pkgs/development/python-modules/whisper/default.nix
+++ b/pkgs/development/python-modules/whisper/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "whisper";
-  version = "1.1.5";
+  version = "1.1.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "14013e7563102d808aae0cb5b3b2326979236d4bcd54c343ea636761629920cd";
+    sha256 = "8dbb3b7cf4a02a080162467fff5cd38bf77940c3e2b25f7c4f78529427ca9cfe";
   };
 
   propagatedBuildInputs = [ six ];
diff --git a/pkgs/development/python-modules/wxPython/4.0.nix b/pkgs/development/python-modules/wxPython/4.0.nix
index f03d1fb1e87..bac478561f7 100644
--- a/pkgs/development/python-modules/wxPython/4.0.nix
+++ b/pkgs/development/python-modules/wxPython/4.0.nix
@@ -28,11 +28,11 @@
 
 buildPythonPackage rec {
   pname = "wxPython";
-  version = "4.0.7";
+  version = "4.0.7.post1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0cq2iyqm08ihazh5xzdsha5h22mba0w4a0y7iikn6c6yvszhiriv";
+    sha256 = "da43eaa2eea32c34a52531331b0a69bd791c237803a7c5df451509624766f7ca";
   };
 
   doCheck = false;
diff --git a/pkgs/development/python-modules/zstd/default.nix b/pkgs/development/python-modules/zstd/default.nix
index 3f9dac6d42c..6c1b9c2bb5b 100644
--- a/pkgs/development/python-modules/zstd/default.nix
+++ b/pkgs/development/python-modules/zstd/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "zstd";
-  version = "1.4.3.2";
+  version = "1.4.4.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1h4wvzikar4ryhawm7clh29bvhbpy0ix1rlxhg9x195fpq56vsh7";
+    sha256 = "33f2c1fd8d3f9ac8e35fb3e199896afc54cceb68878570c6d4b72985dc6584a5";
   };
 
   postPatch = ''
diff --git a/pkgs/development/ruby-modules/gem/default.nix b/pkgs/development/ruby-modules/gem/default.nix
index 7b92a586b54..af38160a5fa 100644
--- a/pkgs/development/ruby-modules/gem/default.nix
+++ b/pkgs/development/ruby-modules/gem/default.nix
@@ -99,7 +99,7 @@ stdenv.mkDerivation ((builtins.removeAttrs attrs ["source"]) // {
     runHook preUnpack
 
     if [[ -f $src && $src == *.gem ]]; then
-      if [[ -z "$dontBuild" ]]; then
+      if [[ -z "''${dontBuild-}" ]]; then
         # we won't know the name of the directory that RubyGems creates,
         # so we'll just use a glob to find it and move it over.
         gempkg="$src"
diff --git a/pkgs/development/tools/build-managers/apache-ant/1.9.nix b/pkgs/development/tools/build-managers/apache-ant/1.9.nix
index 0a86aaeb6ca..661e16d83e8 100644
--- a/pkgs/development/tools/build-managers/apache-ant/1.9.nix
+++ b/pkgs/development/tools/build-managers/apache-ant/1.9.nix
@@ -46,14 +46,14 @@ stdenv.mkDerivation {
       # JRE by looking for java.  The latter allows just the JRE to be
       # used with (say) ECJ as the compiler.  Finally, allow the GNU
       # JVM.
-      if [ -z "\$JAVA_HOME" ]; then
+      if [ -z "\''${JAVA_HOME-}" ]; then
           for i in javac java gij; do
               if p="\$(type -p \$i)"; then
                   export JAVA_HOME="\$(${coreutils}/bin/dirname \$(${coreutils}/bin/dirname \$(${coreutils}/bin/readlink -f \$p)))"
                   break
               fi
           done
-          if [ -z "\$JAVA_HOME" ]; then
+          if [ -z "\''${JAVA_HOME-}" ]; then
               echo "\$0: cannot find the JDK or JRE" >&2
               exit 1
           fi
diff --git a/pkgs/development/tools/build-managers/apache-ant/default.nix b/pkgs/development/tools/build-managers/apache-ant/default.nix
index 8d1e09eeb33..28e86e29175 100644
--- a/pkgs/development/tools/build-managers/apache-ant/default.nix
+++ b/pkgs/development/tools/build-managers/apache-ant/default.nix
@@ -46,14 +46,14 @@ stdenv.mkDerivation {
       # JRE by looking for java.  The latter allows just the JRE to be
       # used with (say) ECJ as the compiler.  Finally, allow the GNU
       # JVM.
-      if [ -z "\$JAVA_HOME" ]; then
+      if [ -z "\''${JAVA_HOME-}" ]; then
           for i in javac java gij; do
               if p="\$(type -p \$i)"; then
                   export JAVA_HOME="\$(${coreutils}/bin/dirname \$(${coreutils}/bin/dirname \$(${coreutils}/bin/readlink -f \$p)))"
                   break
               fi
           done
-          if [ -z "\$JAVA_HOME" ]; then
+          if [ -z "\''${JAVA_HOME-}" ]; then
               echo "\$0: cannot find the JDK or JRE" >&2
               exit 1
           fi
diff --git a/pkgs/development/tools/build-managers/cmake/setup-hook.sh b/pkgs/development/tools/build-managers/cmake/setup-hook.sh
index b8716c5251e..52b9c3ab5f5 100755
--- a/pkgs/development/tools/build-managers/cmake/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/cmake/setup-hook.sh
@@ -20,17 +20,17 @@ cmakeConfigurePhase() {
         export CTEST_PARALLEL_LEVEL=$NIX_BUILD_CORES
     fi
 
-    if [ -z "$dontFixCmake" ]; then
+    if [ -z "${dontFixCmake-}" ]; then
         fixCmakeFiles .
     fi
 
-    if [ -z "$dontUseCmakeBuildDir" ]; then
+    if [ -z "${dontUseCmakeBuildDir-}" ]; then
         mkdir -p build
         cd build
         cmakeDir=${cmakeDir:-..}
     fi
 
-    if [ -z "$dontAddPrefix" ]; then
+    if [ -z "${dontAddPrefix-}" ]; then
         cmakeFlags="-DCMAKE_INSTALL_PREFIX=$prefix $cmakeFlags"
     fi
 
@@ -84,7 +84,7 @@ cmakeConfigurePhase() {
     cmakeFlags="-DCMAKE_INSTALL_LOCALEDIR=${!outputLib}/share/locale $cmakeFlags"
 
     # Don’t build tests when doCheck = false
-    if [ -z "$doCheck" ]; then
+    if [ -z "${doCheck-}" ]; then
         cmakeFlags="-DBUILD_TESTING=OFF $cmakeFlags"
     fi
 
@@ -99,7 +99,7 @@ cmakeConfigurePhase() {
     cmakeFlags="-DCMAKE_FIND_PACKAGE_NO_PACKAGE_REGISTRY=ON $cmakeFlags"
     cmakeFlags="-DCMAKE_FIND_PACKAGE_NO_SYSTEM_PACKAGE_REGISTRY=ON $cmakeFlags"
 
-    if [ "$buildPhase" = ninjaBuildPhase ]; then
+    if [ "${buildPhase-}" = ninjaBuildPhase ]; then
         cmakeFlags="-GNinja $cmakeFlags"
     fi
 
@@ -115,7 +115,7 @@ cmakeConfigurePhase() {
     runHook postConfigure
 }
 
-if [ -z "$dontUseCmakeConfigure" -a -z "$configurePhase" ]; then
+if [ -z "${dontUseCmakeConfigure-}" -a -z "${configurePhase-}" ]; then
     setOutputFlags=
     configurePhase=cmakeConfigurePhase
 fi
@@ -125,25 +125,25 @@ addEnvHooks "$targetOffset" addCMakeParams
 makeCmakeFindLibs(){
   isystem_seen=
   iframework_seen=
-  for flag in $NIX_CFLAGS_COMPILE $NIX_LDFLAGS; do
+  for flag in ${NIX_CFLAGS_COMPILE-} ${NIX_LDFLAGS-}; do
     if test -n "$isystem_seen" && test -d "$flag"; then
       isystem_seen=
-      export CMAKE_INCLUDE_PATH="$CMAKE_INCLUDE_PATH${CMAKE_INCLUDE_PATH:+:}${flag}"
+      export CMAKE_INCLUDE_PATH="${CMAKE_INCLUDE_PATH-}${CMAKE_INCLUDE_PATH:+:}${flag}"
     elif test -n "$iframework_seen" && test -d "$flag"; then
       iframework_seen=
-      export CMAKE_FRAMEWORK_PATH="$CMAKE_FRAMEWORK_PATH${CMAKE_FRAMEWORK_PATH:+:}${flag}"
+      export CMAKE_FRAMEWORK_PATH="${CMAKE_FRAMEWORK_PATH-}${CMAKE_FRAMEWORK_PATH:+:}${flag}"
     else
       isystem_seen=
       iframework_seen=
       case $flag in
         -I*)
-          export CMAKE_INCLUDE_PATH="$CMAKE_INCLUDE_PATH${CMAKE_INCLUDE_PATH:+:}${flag:2}"
+          export CMAKE_INCLUDE_PATH="${CMAKE_INCLUDE_PATH-}${CMAKE_INCLUDE_PATH:+:}${flag:2}"
           ;;
         -L*)
-          export CMAKE_LIBRARY_PATH="$CMAKE_LIBRARY_PATH${CMAKE_LIBRARY_PATH:+:}${flag:2}"
+          export CMAKE_LIBRARY_PATH="${CMAKE_LIBRARY_PATH-}${CMAKE_LIBRARY_PATH:+:}${flag:2}"
           ;;
         -F*)
-          export CMAKE_FRAMEWORK_PATH="$CMAKE_FRAMEWORK_PATH${CMAKE_FRAMEWORK_PATH:+:}${flag:2}"
+          export CMAKE_FRAMEWORK_PATH="${CMAKE_FRAMEWORK_PATH-}${CMAKE_FRAMEWORK_PATH:+:}${flag:2}"
           ;;
         -isystem)
           isystem_seen=1
diff --git a/pkgs/development/tools/build-managers/gn/setup-hook.sh b/pkgs/development/tools/build-managers/gn/setup-hook.sh
index 75d2edcaf1c..850f18948ca 100644
--- a/pkgs/development/tools/build-managers/gn/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/gn/setup-hook.sh
@@ -9,6 +9,6 @@ gnConfigurePhase() {
     runHook postConfigure
 }
 
-if [ -z "$dontUseGnConfigure" -a -z "$configurePhase" ]; then
+if [ -z "${dontUseGnConfigure-}" -a -z "${configurePhase-}" ]; then
     configurePhase=gnConfigurePhase
 fi
diff --git a/pkgs/development/tools/build-managers/meson/setup-hook.sh b/pkgs/development/tools/build-managers/meson/setup-hook.sh
index 6e8d94523e1..8d76ecdaf32 100644
--- a/pkgs/development/tools/build-managers/meson/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/meson/setup-hook.sh
@@ -1,7 +1,7 @@
 mesonConfigurePhase() {
     runHook preConfigure
 
-    if [ -z "$dontAddPrefix" ]; then
+    if [ -z "${dontAddPrefix-}" ]; then
         mesonFlags="--prefix=$prefix $mesonFlags"
     fi
 
@@ -36,7 +36,7 @@ mesonConfigurePhase() {
     runHook postConfigure
 }
 
-if [ -z "$dontUseMesonConfigure" -a -z "$configurePhase" ]; then
+if [ -z "${dontUseMesonConfigure-}" -a -z "${configurePhase-}" ]; then
     setOutputFlags=
     configurePhase=mesonConfigurePhase
 fi
diff --git a/pkgs/development/tools/build-managers/ninja/setup-hook.sh b/pkgs/development/tools/build-managers/ninja/setup-hook.sh
index e3c67bd139d..7d8087ad134 100644
--- a/pkgs/development/tools/build-managers/ninja/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/ninja/setup-hook.sh
@@ -19,7 +19,7 @@ ninjaBuildPhase() {
     runHook postBuild
 }
 
-if [ -z "$dontUseNinjaBuild" -a -z "$buildPhase" ]; then
+if [ -z "${dontUseNinjaBuild-}" -a -z "${buildPhase-}" ]; then
     buildPhase=ninjaBuildPhase
 fi
 
@@ -38,7 +38,7 @@ ninjaInstallPhase() {
     runHook postInstall
 }
 
-if [ -z "$dontUseNinjaInstall" -a -z "$installPhase" ]; then
+if [ -z "${dontUseNinjaInstall-}" -a -z "${installPhase-}" ]; then
     installPhase=ninjaInstallPhase
 fi
 
@@ -73,6 +73,6 @@ ninjaCheckPhase() {
     runHook postCheck
 }
 
-if [ -z "$dontUseNinjaCheck" -a -z "$checkPhase" ]; then
+if [ -z "${dontUseNinjaCheck-}" -a -z "${checkPhase-}" ]; then
     checkPhase=ninjaCheckPhase
 fi
diff --git a/pkgs/development/tools/build-managers/scons/setup-hook.sh b/pkgs/development/tools/build-managers/scons/setup-hook.sh
index 55159aa5a93..0b908f68286 100644
--- a/pkgs/development/tools/build-managers/scons/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/scons/setup-hook.sh
@@ -71,14 +71,14 @@ sconsCheckPhase() {
     runHook postCheck
 }
 
-if [ -z "$buildPhase" ]; then
+if [ -z "${buildPhase-}" ]; then
     buildPhase=sconsBuildPhase
 fi
 
-if [ -z "$dontUseSconsInstall" -a -z "$installPhase" ]; then
+if [ -z "${dontUseSconsInstall-}" -a -z "${installPhase-}" ]; then
     installPhase=sconsInstallPhase
 fi
 
-if [ -z "$checkPhase" ]; then
+if [ -z "${checkPhase-}" ]; then
     checkPhase=sconsCheckPhase
 fi
diff --git a/pkgs/development/tools/misc/patchelf/setup-hook.sh b/pkgs/development/tools/misc/patchelf/setup-hook.sh
index bc1cddd4879..576b9ca2103 100644
--- a/pkgs/development/tools/misc/patchelf/setup-hook.sh
+++ b/pkgs/development/tools/misc/patchelf/setup-hook.sh
@@ -2,7 +2,7 @@
 # directories from the RPATH of every library or executable in every
 # output.
 
-fixupOutputHooks+=('if [ -z "$dontPatchELF" ]; then patchELF "$prefix"; fi')
+fixupOutputHooks+=('if [ -z "${dontPatchELF-}" ]; then patchELF "$prefix"; fi')
 
 patchELF() {
     local dir="$1"
diff --git a/pkgs/development/tools/misc/premake/setup-hook.sh b/pkgs/development/tools/misc/premake/setup-hook.sh
index ba06ea2c761..6e65e9e8c73 100644
--- a/pkgs/development/tools/misc/premake/setup-hook.sh
+++ b/pkgs/development/tools/misc/premake/setup-hook.sh
@@ -14,6 +14,6 @@ premakeConfigurePhase() {
     runHook postConfigure
 }
 
-if [ -z "$configurePhase" ]; then
+if [ -z "${configurePhase-}" ]; then
     configurePhase=premakeConfigurePhase
 fi
diff --git a/pkgs/development/tools/ocaml/camlidl/default.nix b/pkgs/development/tools/ocaml/camlidl/default.nix
index 09de5b02737..309c44d6d46 100644
--- a/pkgs/development/tools/ocaml/camlidl/default.nix
+++ b/pkgs/development/tools/ocaml/camlidl/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
   '';
 
   setupHook = writeText "setupHook.sh" ''
-    export CAML_LD_LIBRARY_PATH="''${CAML_LD_LIBRARY_PATH}''${CAML_LD_LIBRARY_PATH:+:}''$1/lib/ocaml/${ocaml.version}/site-lib/${name}/"
+    export CAML_LD_LIBRARY_PATH="''${CAML_LD_LIBRARY_PATH-}''${CAML_LD_LIBRARY_PATH:+:}''$1/lib/ocaml/${ocaml.version}/site-lib/${name}/"
     export NIX_CFLAGS_COMPILE+=" -isystem $1/lib/ocaml/${ocaml.version}/site-lib/camlidl"
     export NIX_LDFLAGS+=" -L $1/lib/ocaml/${ocaml.version}/site-lib/camlidl"
   '';
diff --git a/pkgs/development/tools/ocaml/findlib/default.nix b/pkgs/development/tools/ocaml/findlib/default.nix
index cb81a29af8c..9db5ed10c84 100644
--- a/pkgs/development/tools/ocaml/findlib/default.nix
+++ b/pkgs/development/tools/ocaml/findlib/default.nix
@@ -32,13 +32,13 @@ stdenv.mkDerivation rec {
   setupHook = writeText "setupHook.sh" ''
     addOCamlPath () {
         if test -d "''$1/lib/ocaml/${ocaml.version}/site-lib"; then
-            export OCAMLPATH="''${OCAMLPATH}''${OCAMLPATH:+:}''$1/lib/ocaml/${ocaml.version}/site-lib/"
+            export OCAMLPATH="''${OCAMLPATH-}''${OCAMLPATH:+:}''$1/lib/ocaml/${ocaml.version}/site-lib/"
         fi
         if test -d "''$1/lib/ocaml/${ocaml.version}/site-lib/stublibs"; then
-            export CAML_LD_LIBRARY_PATH="''${CAML_LD_LIBRARY_PATH}''${CAML_LD_LIBRARY_PATH:+:}''$1/lib/ocaml/${ocaml.version}/site-lib/stublibs"
+            export CAML_LD_LIBRARY_PATH="''${CAML_LD_LIBRARY_PATH-}''${CAML_LD_LIBRARY_PATH:+:}''$1/lib/ocaml/${ocaml.version}/site-lib/stublibs"
         fi
         export OCAMLFIND_DESTDIR="''$out/lib/ocaml/${ocaml.version}/site-lib/"
-        if test -n "$createFindlibDestdir"; then
+        if test -n "''${createFindlibDestdir-}"; then
           mkdir -p $OCAMLFIND_DESTDIR
         fi
     }
diff --git a/pkgs/development/tools/ocaml/opam/opam-shebangs.patch b/pkgs/development/tools/ocaml/opam/opam-shebangs.patch
index f74ac84ca6b..13aa7a89570 100644
--- a/pkgs/development/tools/ocaml/opam/opam-shebangs.patch
+++ b/pkgs/development/tools/ocaml/opam/opam-shebangs.patch
@@ -64,7 +64,7 @@ index 00000000..3ea84e2d
 +header() { echo "$1"; }
 +stopNest() { true; }
 +
-+fixupOutputHooks+=('if [ -z "$dontPatchShebangs" -a -e "$prefix" ]; then patchShebangs "$prefix"; fi')
++fixupOutputHooks+=('if [ -z "${dontPatchShebangs-}" -a -e "$prefix" ]; then patchShebangs "$prefix"; fi')
 +
 +patchShebangs() {
 +    local dir="$1"
diff --git a/pkgs/development/tools/ocaml/utop/default.nix b/pkgs/development/tools/ocaml/utop/default.nix
index 290ab9b571f..f154b94ae33 100644
--- a/pkgs/development/tools/ocaml/utop/default.nix
+++ b/pkgs/development/tools/ocaml/utop/default.nix
@@ -39,6 +39,7 @@ stdenv.mkDerivation rec {
        installPhase = ''
          mkdir -p "$out"/${path}
          for e in OCAMLPATH CAML_LD_LIBRARY_PATH; do
+           [[ -v "$e" ]] || continue
            printf %s "''${!e}" > "$out"/${path}/$e
          done
        '';
diff --git a/pkgs/development/tools/xcbuild/setup-hook.sh b/pkgs/development/tools/xcbuild/setup-hook.sh
index 9dc03a61f62..f4b5abf2d8d 100644
--- a/pkgs/development/tools/xcbuild/setup-hook.sh
+++ b/pkgs/development/tools/xcbuild/setup-hook.sh
@@ -20,7 +20,7 @@ xcbuildInstallPhase () {
 }
 
 buildPhase=xcbuildBuildPhase
-if [ -z "$installPhase" ]; then
+if [ -z "${installPhase-}" ]; then
     installPhase=xcbuildInstallPhase
 fi
 
diff --git a/pkgs/misc/emulators/retroarch/cores.nix b/pkgs/misc/emulators/retroarch/cores.nix
index ced26333f4c..c8171f6c233 100644
--- a/pkgs/misc/emulators/retroarch/cores.nix
+++ b/pkgs/misc/emulators/retroarch/cores.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchgit, fetchFromGitHub, fetchFromGitLab, cmake, pkgconfig, makeWrapper, python27, python37, retroarch
-, alsaLib, fluidsynth, curl, hidapi, libGLU_combined, gettext, glib, gtk2, portaudio, SDL
+, alsaLib, fluidsynth, curl, hidapi, libGLU, gettext, glib, gtk2, portaudio, SDL, libGL
 , ffmpeg, pcre, libevdev, libpng, libjpeg, udev, libvorbis
 , miniupnpc, sfml, xorg, zlib, nasm, libpcap, boost }:
 
@@ -152,7 +152,7 @@ in with stdenv.lib.licenses;
     buildPhase = "make";
     name = "beetle-pce-fast-${der.version}";
   };
-  
+
   beetle-pcfx = (mkLibRetroCore rec {
     core = "mednafen-pcfx";
     src = fetchRetro {
@@ -197,7 +197,7 @@ in with stdenv.lib.licenses;
     name = "beetle-saturn-${der.version}";
     meta.platforms = [ "x86_64-linux" "aarch64-linux" ];
   };
-  
+
   beetle-supergrafx = (mkLibRetroCore rec {
     core = "mednafen-supergrafx";
     src = fetchRetro {
@@ -276,7 +276,7 @@ in with stdenv.lib.licenses;
     };
     description = "libretro wrapper for desmume NDS emulator";
     license = gpl2;
-    extraBuildInputs = [ libpcap libGLU_combined xorg.libX11 ];
+    extraBuildInputs = [ libpcap libGLU libGL xorg.libX11 ];
   }).override {
     makefile = "desmume/src/frontend/libretro/Makefile.libretro";
     configurePhase = "cd desmume/src/frontend/libretro";
@@ -292,7 +292,7 @@ in with stdenv.lib.licenses;
     };
     description = "libretro wrapper for desmume NDS emulator from 2015";
     license = gpl2;
-    extraBuildInputs = [ libpcap libGLU_combined xorg.libX11 ];
+    extraBuildInputs = [ libpcap libGLU libGL xorg.libX11 ];
   }).override {
     makefile = "desmume/Makefile.libretro";
     configurePhase = "cd desmume";
@@ -311,7 +311,7 @@ in with stdenv.lib.licenses;
     broken = true;
 
     extraBuildInputs = [
-      cmake curl libGLU_combined pcre pkgconfig sfml
+      cmake curl libGLU libGL pcre pkgconfig sfml
       gettext hidapi
       libevdev udev
     ] ++ (with xorg; [ libSM libX11 libXi libpthreadstubs libxcb xcbutil libXext libXrandr libXinerama libXxf86vm ]);
@@ -323,7 +323,7 @@ in with stdenv.lib.licenses;
       "-DENABLE_QT=OFF"
       "-DENABLE_LTO=OFF"
       "-DUSE_UPNP=OFF"
-      "-DUSE_DISCORD_PRESENCE=OFF" 
+      "-DUSE_DISCORD_PRESENCE=OFF"
     ];
     dontUseCmakeBuildDir = "yes";
     buildPhase = "make";
@@ -380,7 +380,7 @@ in with stdenv.lib.licenses;
     };
     description = "Flycast libretro port";
     license = gpl2;
-    extraBuildInputs = [ libGLU_combined ];
+    extraBuildInputs = [ libGL libGLU ];
   }).override {
     makefile = "Makefile";
     buildPhase = "make";
@@ -478,7 +478,7 @@ in with stdenv.lib.licenses;
     description = "Port of MAME to libretro";
     license = gpl2Plus;
 
-    extraBuildInputs = [ alsaLib libGLU_combined portaudio python27 xorg.libX11 ];
+    extraBuildInputs = [ alsaLib libGLU libGL portaudio python27 xorg.libX11 ];
   }).override {
     postPatch = ''
       # Prevent the failure during the parallel building of:
@@ -614,7 +614,7 @@ in with stdenv.lib.licenses;
     description = "Libretro port of Mupen64 Plus, GL only";
     license = gpl2;
 
-    extraBuildInputs = [ libGLU_combined libpng nasm xorg.libX11 ];
+    extraBuildInputs = [ libGLU libGL libpng nasm xorg.libX11 ];
   }).override {
     makefile = "Makefile";
     buildPhase = "make";
@@ -633,7 +633,7 @@ in with stdenv.lib.licenses;
     makefile = "libretro/Makefile";
     buildPhase = "cd libretro && make";
   };
- 
+
   o2em = (mkLibRetroCore rec {
     core = "o2em";
     src = fetchRetro {
@@ -647,7 +647,7 @@ in with stdenv.lib.licenses;
     makefile = "Makefile";
     buildPhase = "make";
   };
- 
+
   parallel-n64 = (mkLibRetroCore rec {
     core = "parallel-n64";
     src = fetchRetro {
@@ -658,7 +658,7 @@ in with stdenv.lib.licenses;
     description = "Parallel Mupen64plus rewrite for libretro.";
     license = gpl2;
 
-    extraBuildInputs = [ libGLU_combined libpng ];
+    extraBuildInputs = [ libGLU libGL libpng ];
   }).override {
     makefile = "Makefile";
     buildPhase = "make";
@@ -677,7 +677,7 @@ in with stdenv.lib.licenses;
     configurePhase = "rm configure";
     buildPhase = "make -f Makefile.libretro";
   };
-  
+
   picodrive = (mkLibRetroCore rec {
     core = "picodrive";
     src = fetchRetro {
@@ -718,7 +718,7 @@ in with stdenv.lib.licenses;
     };
     description = "ppsspp libretro port";
     license = gpl2;
-    extraBuildInputs = [ cmake libGLU_combined ffmpeg python37 xorg.libX11 ];
+    extraBuildInputs = [ cmake libGLU libGL ffmpeg python37 xorg.libX11 ];
   }).override {
     cmakeFlags = "-DLIBRETRO=ON";
     makefile = "Makefile";
@@ -778,7 +778,7 @@ in with stdenv.lib.licenses;
     };
     description = "Libretro port of ScummVM";
     license = gpl2;
-    extraBuildInputs = [ fluidsynth libjpeg libvorbis libGLU_combined SDL ];
+    extraBuildInputs = [ fluidsynth libjpeg libvorbis libGLU libGL SDL ];
   }).override {
     makefile = "backends/platform/libretro/build/Makefile";
     buildPhase = "cd backends/platform/libretro/build && make";
diff --git a/pkgs/os-specific/darwin/apple-sdk/cf-setup-hook.sh b/pkgs/os-specific/darwin/apple-sdk/cf-setup-hook.sh
index 66e24fe5877..86c241cd0f5 100644
--- a/pkgs/os-specific/darwin/apple-sdk/cf-setup-hook.sh
+++ b/pkgs/os-specific/darwin/apple-sdk/cf-setup-hook.sh
@@ -1,5 +1,5 @@
 linkSystemCoreFoundationFramework() {
-  NIX_CFLAGS_COMPILE="-F@out@/Library/Frameworks $NIX_CFLAGS_COMPILE"
+  NIX_CFLAGS_COMPILE="-F@out@/Library/Frameworks${NIX_CFLAGS_COMPILE:+ }${NIX_CFLAGS_COMPILE-}"
   # gross! many symbols (such as _OBJC_CLASS_$_NSArray) are defined in system CF, but not
   # in the opensource release
   # if the package needs private headers, we assume they also want to link with system CF
diff --git a/pkgs/os-specific/darwin/apple-sdk/private-frameworks-setup-hook.sh b/pkgs/os-specific/darwin/apple-sdk/private-frameworks-setup-hook.sh
index fbd977f8552..a351c39de13 100644
--- a/pkgs/os-specific/darwin/apple-sdk/private-frameworks-setup-hook.sh
+++ b/pkgs/os-specific/darwin/apple-sdk/private-frameworks-setup-hook.sh
@@ -1,6 +1,6 @@
 addPrivateFrameworks() {
     flag="-F/System/Library/PrivateFrameworks"
-    if [[ "$NIX_CFLAGS_COMPILE" != *$flag* ]]; then
+    if [[ "${NIX_CFLAGS_COMPILE-}" != *$flag* ]]; then
         NIX_CFLAGS_COMPILE+=" $flag"
     fi
 }
diff --git a/pkgs/os-specific/darwin/apple-sdk/security-setup-hook.sh b/pkgs/os-specific/darwin/apple-sdk/security-setup-hook.sh
index ed9bdbd912d..35cea773f98 100644
--- a/pkgs/os-specific/darwin/apple-sdk/security-setup-hook.sh
+++ b/pkgs/os-specific/darwin/apple-sdk/security-setup-hook.sh
@@ -2,7 +2,7 @@ noDeprecatedDeclarations() {
   # Security.framework has about 2000 deprecated constants, all of which the user will be
   # warned about at compilation time
   flag="-Wno-deprecated-declarations"
-  if [[ "$NIX_CFLAGS_COMPILE" != *$flag* ]]; then
+  if [[ "${NIX_CFLAGS_COMPILE-}" != *$flag* ]]; then
     NIX_CFLAGS_COMPILE+=" $flag"
   fi
 }
diff --git a/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix b/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
index 6f7caa8ec02..1df7070e7a3 100644
--- a/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
+++ b/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
@@ -63,10 +63,31 @@ stdenv.mkDerivation {
   # I'm guessing at the version here. https://github.com/apple/swift-corelibs-foundation/commit/df3ec55fe6c162d590a7653d89ad669c2b9716b1 imported "high sierra"
   # and this version is a version from there. No idea how accurate it is.
   LDFLAGS = "-current_version 1454.90.0 -compatibility_version 150.0.0 -init ___CFInitialize";
-  configurePhase = "../configure release --sysroot UNUSED";
+
+  configurePhase = ''
+    ../configure release --sysroot UNUSED
+  '';
 
   enableParallelBuilding = true;
-  buildPhase = "ninja -j $NIX_BUILD_CORES";
+
+  # FIXME: Workaround for intermittent build failures of CFRuntime.c.
+  # Based on testing this issue seems to only occur with clang_7, so
+  # please remove this when updating the default llvm versions to 8 or
+  # later.
+  buildPhase = stdenv.lib.optionalString true ''
+    for i in {1..512}; do
+        if ninjaBuildPhase; then
+          break
+        fi
+
+        echo >&2
+        echo "[$i/512] retrying build, workaround for #66811" >&2
+        echo "  With clang_7 the build of CFRuntime.c fails intermittently." >&2
+        echo "  See https://github.com/NixOS/nixpkgs/issues/66811 for more details." >&2
+        echo >&2
+        continue
+    done
+  '';
 
   # TODO: their build system sorta kinda can do this, but it doesn't seem to work right now
   # Also, this includes a bunch of private headers in the framework, which is not what we want
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 87fa9c8f08e..d206910732c 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -179,7 +179,7 @@ let
       '' else "") + (if isModular then ''
         mkdir -p $dev
         cp vmlinux $dev/
-        if [ -z "$dontStrip" ]; then
+        if [ -z "''${dontStrip-}" ]; then
           installFlagsArray+=("INSTALL_MOD_STRIP=1")
         fi
         make modules_install $makeFlags "''${makeFlagsArray[@]}" \
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index a9fc0c6f4b5..d14985d07ed 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -1,5 +1,5 @@
-{ stdenv, lib, fetchFromGitHub, fetchpatch, pkgconfig, intltool, gperf, libcap, kmod
-, xz, pam, acl, libuuid, m4, utillinux, libffi
+{ stdenv, lib, fetchFromGitHub, fetchpatch, pkgconfig, intltool, gperf, libcap
+, curl, kmod, gnupg, gnutar, xz, pam, acl, libuuid, m4, utillinux, libffi
 , glib, kbd, libxslt, coreutils, libgcrypt, libgpgerror, libidn2, libapparmor
 , audit, lz4, bzip2, libmicrohttpd, pcre2
 , linuxHeaders ? stdenv.cc.libc.linuxHeaders
@@ -15,7 +15,21 @@
 , withKexectools ? lib.any (lib.meta.platformMatch stdenv.hostPlatform) kexectools.meta.platforms, kexectools
 }:
 
-stdenv.mkDerivation {
+let gnupg-minimal = gnupg.override {
+  enableMinimal = true;
+  guiSupport = false;
+  pcsclite = null;
+  sqlite = null;
+  pinentry = null;
+  adns = null;
+  gnutls = null;
+  libusb = null;
+  openldap = null;
+  readline = null;
+  zlib = null;
+  bzip2 = null;
+};
+in stdenv.mkDerivation {
   version = "243";
   pname = "systemd";
 
@@ -41,7 +55,7 @@ stdenv.mkDerivation {
       (buildPackages.python3Packages.python.withPackages ( ps: with ps; [ python3Packages.lxml ]))
     ];
   buildInputs =
-    [ linuxHeaders libcap kmod xz pam acl
+    [ linuxHeaders libcap curl.dev kmod xz pam acl
       /* cryptsetup */ libuuid glib libgcrypt libgpgerror libidn2
       libmicrohttpd pcre2 ] ++
       stdenv.lib.optional withKexectools kexectools ++
@@ -67,6 +81,7 @@ stdenv.mkDerivation {
     "-Ddebug-shell=${bashInteractive}/bin/bash"
     # while we do not run tests we should also not build them. Removes about 600 targets
     "-Dtests=false"
+    "-Dimportd=true"
     "-Dlz4=true"
     "-Dhostnamed=true"
     "-Dnetworkd=true"
@@ -77,7 +92,7 @@ stdenv.mkDerivation {
     "-Dlocaled=true"
     "-Dresolve=true"
     "-Dsplit-usr=false"
-    "-Dlibcurl=false"
+    "-Dlibcurl=true"
     "-Dlibidn=false"
     "-Dlibidn2=true"
     "-Dquotacheck=false"
@@ -144,6 +159,14 @@ stdenv.mkDerivation {
       patchShebangs $dir
     done
 
+    # absolute paths to gpg & tar
+    substituteInPlace src/import/pull-common.c \
+      --replace '"gpg"' '"${gnupg-minimal}/bin/gpg"'
+    for file in src/import/{{export,import,pull}-tar,import-common}.c; do
+      substituteInPlace $file \
+        --replace '"tar"' '"${gnutar}/bin/tar"'
+    done
+
     substituteInPlace src/journal/catalog.c \
       --replace /usr/lib/systemd/catalog/ $out/lib/systemd/catalog/
   '';
diff --git a/pkgs/servers/sql/mariadb/connector-c/3_1.nix b/pkgs/servers/sql/mariadb/connector-c/3_1.nix
index cac300cf15a..257fa93d2b5 100644
--- a/pkgs/servers/sql/mariadb/connector-c/3_1.nix
+++ b/pkgs/servers/sql/mariadb/connector-c/3_1.nix
@@ -1,6 +1,6 @@
 { callPackage, ... } @ args:
 
 callPackage ./. (args // {
-  version = "3.1.4";
-  sha256 = "05jkaq151a45rqpyh0vrn6xcpawayfxyzhwn1w32hk0fw3z746ks";
+  version = "3.1.5";
+  sha256 = "1mfrm595kfnpjladaq6m184npa3rxff9pr1vwa35r057s7nmzpm9";
 })
diff --git a/pkgs/servers/sql/mariadb/connector-c/default.nix b/pkgs/servers/sql/mariadb/connector-c/default.nix
index 01cf015c825..af344d63721 100644
--- a/pkgs/servers/sql/mariadb/connector-c/default.nix
+++ b/pkgs/servers/sql/mariadb/connector-c/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, cmake, fetchpatch
+{ stdenv, fetchurl, cmake
 , curl, openssl, zlib
 , libiconv
 , version, sha256, ...
@@ -18,13 +18,6 @@ stdenv.mkDerivation {
     inherit sha256;
   };
 
-  patches = stdenv.lib.optionals stdenv.isDarwin [
-    (fetchpatch {
-      url = "https://github.com/MariaDB/mariadb-connector-c/commit/ee91b2c98a63acb787114dee4f2694e154630928.patch";
-      sha256 = "05mlyv20kzn9bax4byv2ph1cf42541fcl1zcqzbfwqmynnisvdah";
-    })
-  ];
-
   cmakeFlags = [
     "-DMARIADB_UNIX_ADDR=/run/mysqld/mysqld.sock"
     "-DWITH_CURL=ON"
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 8ad6867a890..ec7246c4eb0 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -2691,7 +2691,7 @@ lib.makeScope newScope (self: with self; {
     meta.platforms = stdenv.lib.platforms.unix;
   }) {};
 
-  xorgserver = callPackage ({ stdenv, pkgconfig, fetchurl, xorgproto, openssl, libX11, libXau, libXaw, libxcb, xcbutil, xcbutilwm, xcbutilimage, xcbutilkeysyms, xcbutilrenderutil, libXdmcp, libXfixes, libxkbfile, libXmu, libXpm, libXrender, libXres, libXt }: stdenv.mkDerivation {
+  xorgserver = callPackage ({ stdenv, fetchpatch, pkgconfig, fetchurl, xorgproto, openssl, libX11, libXau, libXaw, libxcb, xcbutil, xcbutilwm, xcbutilimage, xcbutilkeysyms, xcbutilrenderutil, libXdmcp, libXfixes, libxkbfile, libXmu, libXpm, libXrender, libXres, libXt }: stdenv.mkDerivation {
     name = "xorg-server-1.20.5";
     builder = ./builder.sh;
     src = fetchurl {
diff --git a/pkgs/servers/x11/xorg/imake-setup-hook.sh b/pkgs/servers/x11/xorg/imake-setup-hook.sh
index 10f54198f7f..351ffab34d0 100644
--- a/pkgs/servers/x11/xorg/imake-setup-hook.sh
+++ b/pkgs/servers/x11/xorg/imake-setup-hook.sh
@@ -14,6 +14,6 @@ imakeConfigurePhase() {
     runHook postConfigure
 }
 
-if [ -z "$dontUseImakeConfigure" -a -z "$configurePhase" ]; then
+if [ -z "${dontUseImakeConfigure-}" -a -z "${configurePhase-}" ]; then
     configurePhase=imakeConfigurePhase
 fi
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index e6a94daee10..71ac752a6cf 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -592,6 +592,16 @@ self: super:
         propagatedBuildInputs = [ libpciaccess epoxy ] ++ commonPropagatedBuildInputs ++ lib.optionals stdenv.isLinux [
           udev
         ];
+        # patchPhase is not working, this is a hack but we can remove it in the next xorg-server release
+        preConfigure = let
+          headerFix = fetchpatch {
+            url = "https://gitlab.freedesktop.org/xorg/xserver/commit/741bd73429e337071f49509ddcc5fb392e20b0f6.patch";
+            sha256 = "0qjiin9pkggl3c33lfkpn9a9z8ldjpb3y47cflsjkfn868gsk8ri";
+            excludes = [ "hw/xwayland/xwayland-glx.c" ];  # File not in release yet
+          };
+        in ''
+          patch -p1 < ${headerFix}
+        '';
         prePatch = stdenv.lib.optionalString stdenv.hostPlatform.isMusl ''
           export CFLAGS+=" -D__uid_t=uid_t -D__gid_t=gid_t"
         '';
@@ -629,8 +639,8 @@ self: super:
           libAppleWM xorgproto
         ];
 
-        # XQuartz patchset
         patches = [
+          # XQuartz patchset
           (fetchpatch {
             url = "https://github.com/XQuartz/xorg-server/commit/e88fd6d785d5be477d5598e70d105ffb804771aa.patch";
             sha256 = "1q0a30m1qj6ai924afz490xhack7rg4q3iig2gxsjjh98snikr1k";
diff --git a/pkgs/stdenv/cygwin/rebase-i686.sh b/pkgs/stdenv/cygwin/rebase-i686.sh
index 091c9044d93..6b8ec441ca7 100644
--- a/pkgs/stdenv/cygwin/rebase-i686.sh
+++ b/pkgs/stdenv/cygwin/rebase-i686.sh
@@ -1,7 +1,7 @@
 fixupOutputHooks+=(_cygwinFixAutoImageBase)
 
 _cygwinFixAutoImageBase() {
-    if [ "$dontRebase" == 1 ] || [ ! -d "$prefix" ]; then
+    if [ "${dontRebase-}" == 1 ] || [ ! -d "$prefix" ]; then
         return
     fi
     find "$prefix" -name "*.dll" -type f | while read DLL; do
diff --git a/pkgs/stdenv/cygwin/rebase-x86_64.sh b/pkgs/stdenv/cygwin/rebase-x86_64.sh
index 4c8f8ebd7eb..6dccdc40c72 100644
--- a/pkgs/stdenv/cygwin/rebase-x86_64.sh
+++ b/pkgs/stdenv/cygwin/rebase-x86_64.sh
@@ -1,7 +1,7 @@
 fixupOutputHooks+=(_cygwinFixAutoImageBase)
 
 _cygwinFixAutoImageBase() {
-    if [ "$dontRebase" == 1 ] || [ ! -d "$prefix" ]; then
+    if [ "${dontRebase-}" == 1 ] || [ ! -d "$prefix" ]; then
         return
     fi
     find "$prefix" -name "*.dll" -type f | while read DLL; do
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index 0962a1ec2fc..5b8fdde5796 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -17,10 +17,6 @@ fi
 # code). The hooks for <hookName> are the shell function or variable
 # <hookName>, and the values of the shell array ‘<hookName>Hooks’.
 runHook() {
-    local oldOpts="-u"
-    shopt -qo nounset || oldOpts="+u"
-    set -u # May be called from elsewhere, so do `set -u`.
-
     local hookName="$1"
     shift
     local hooksSlice="${hookName%Hook}Hooks[@]"
@@ -30,10 +26,8 @@ runHook() {
     # undefined.
     for hook in "_callImplicitHook 0 $hookName" ${!hooksSlice+"${!hooksSlice}"}; do
         _eval "$hook" "$@"
-        set -u # To balance `_eval`
     done
 
-    set "$oldOpts"
     return 0
 }
 
@@ -41,10 +35,6 @@ runHook() {
 # Run all hooks with the specified name, until one succeeds (returns a
 # zero exit code). If none succeed, return a non-zero exit code.
 runOneHook() {
-    local oldOpts="-u"
-    shopt -qo nounset || oldOpts="+u"
-    set -u # May be called from elsewhere, so do `set -u`.
-
     local hookName="$1"
     shift
     local hooksSlice="${hookName%Hook}Hooks[@]"
@@ -56,10 +46,8 @@ runOneHook() {
             ret=0
             break
         fi
-        set -u # To balance `_eval`
     done
 
-    set "$oldOpts"
     return "$ret"
 }
 
@@ -70,17 +58,13 @@ runOneHook() {
 # environment variables) and from shell scripts (as functions). If you
 # want to allow multiple hooks, use runHook instead.
 _callImplicitHook() {
-    set -u
     local def="$1"
     local hookName="$2"
     if declare -F "$hookName" > /dev/null; then
-        set +u
         "$hookName"
     elif type -p "$hookName" > /dev/null; then
-        set +u
         source "$hookName"
     elif [ -n "${!hookName:-}" ]; then
-        set +u
         eval "${!hookName}"
     else
         return "$def"
@@ -96,13 +80,10 @@ _callImplicitHook() {
 # command can take them
 _eval() {
     if declare -F "$1" > /dev/null 2>&1; then
-        set +u
         "$@" # including args
     else
-        set +u
         eval "$1"
     fi
-    # `run*Hook` reenables `set -u`
 }
 
 
@@ -190,12 +171,12 @@ addToSearchPath() {
 # so it is defined here but tried after the hook.
 _addRpathPrefix() {
     if [ "${NIX_NO_SELF_RPATH:-0}" != 1 ]; then
-        export NIX_LDFLAGS="-rpath $1/lib $NIX_LDFLAGS"
+        export NIX_LDFLAGS="-rpath $1/lib ${NIX_LDFLAGS-}"
         if [ -n "${NIX_LIB64_IN_SELF_RPATH:-}" ]; then
-            export NIX_LDFLAGS="-rpath $1/lib64 $NIX_LDFLAGS"
+            export NIX_LDFLAGS="-rpath $1/lib64 ${NIX_LDFLAGS-}"
         fi
         if [ -n "${NIX_LIB32_IN_SELF_RPATH:-}" ]; then
-            export NIX_LDFLAGS="-rpath $1/lib32 $NIX_LDFLAGS"
+            export NIX_LDFLAGS="-rpath $1/lib32 ${NIX_LDFLAGS-}"
         fi
     fi
 }
@@ -267,6 +248,8 @@ for i in $initialPath; do
     fi
 done
 
+unset i
+
 if (( "${NIX_DEBUG:-0}" >= 1 )); then
     echo "initial path: $PATH"
 fi
@@ -296,11 +279,11 @@ declare -a pkgsBuildBuild pkgsBuildHost pkgsBuildTarget
 declare -a pkgsHostHost pkgsHostTarget
 declare -a pkgsTargetTarget
 
-declare -ra pkgBuildAccumVars=(pkgsBuildBuild pkgsBuildHost pkgsBuildTarget)
-declare -ra pkgHostAccumVars=(pkgsHostHost pkgsHostTarget)
-declare -ra pkgTargetAccumVars=(pkgsTargetTarget)
+declare -a pkgBuildAccumVars=(pkgsBuildBuild pkgsBuildHost pkgsBuildTarget)
+declare -a pkgHostAccumVars=(pkgsHostHost pkgsHostTarget)
+declare -a pkgTargetAccumVars=(pkgsTargetTarget)
 
-declare -ra pkgAccumVarVars=(pkgBuildAccumVars pkgHostAccumVars pkgTargetAccumVars)
+declare -a pkgAccumVarVars=(pkgBuildAccumVars pkgHostAccumVars pkgTargetAccumVars)
 
 
 # Hooks
@@ -309,11 +292,11 @@ declare -a envBuildBuildHooks envBuildHostHooks envBuildTargetHooks
 declare -a envHostHostHooks envHostTargetHooks
 declare -a envTargetTargetHooks
 
-declare -ra pkgBuildHookVars=(envBuildBuildHook envBuildHostHook envBuildTargetHook)
-declare -ra pkgHostHookVars=(envHostHostHook envHostTargetHook)
-declare -ra pkgTargetHookVars=(envTargetTargetHook)
+declare -a pkgBuildHookVars=(envBuildBuildHook envBuildHostHook envBuildTargetHook)
+declare -a pkgHostHookVars=(envHostHostHook envHostTargetHook)
+declare -a pkgTargetHookVars=(envTargetTargetHook)
 
-declare -ra pkgHookVarVars=(pkgBuildHookVars pkgHostHookVars pkgTargetHookVars)
+declare -a pkgHookVarVars=(pkgBuildHookVars pkgHostHookVars pkgTargetHookVars)
 
 # Add env hooks for all sorts of deps with the specified host offset.
 addEnvHooks() {
@@ -329,26 +312,26 @@ addEnvHooks() {
 
 # Propagated dep files
 
-declare -ra propagatedBuildDepFiles=(
+declare -a propagatedBuildDepFiles=(
     propagated-build-build-deps
     propagated-native-build-inputs # Legacy name for back-compat
     propagated-build-target-deps
 )
-declare -ra propagatedHostDepFiles=(
+declare -a propagatedHostDepFiles=(
     propagated-host-host-deps
     propagated-build-inputs # Legacy name for back-compat
 )
-declare -ra propagatedTargetDepFiles=(
+declare -a propagatedTargetDepFiles=(
     propagated-target-target-deps
 )
-declare -ra propagatedDepFilesVars=(
+declare -a propagatedDepFilesVars=(
     propagatedBuildDepFiles
     propagatedHostDepFiles
     propagatedTargetDepFiles
 )
 
 # Platform offsets: build = -1, host = 0, target = 1
-declare -ra allPlatOffsets=(-1 0 1)
+declare -a allPlatOffsets=(-1 0 1)
 
 
 # Mutually-recursively find all build inputs. See the dependency section of the
@@ -489,11 +472,7 @@ activatePackage() {
     (( "$hostOffset" <= "$targetOffset" )) || exit -1
 
     if [ -f "$pkg" ]; then
-        local oldOpts="-u"
-        shopt -qo nounset || oldOpts="+u"
-        set +u
         source "$pkg"
-        set "$oldOpts"
     fi
 
     # Only dependencies whose host platform is guaranteed to match the
@@ -512,11 +491,7 @@ activatePackage() {
     fi
 
     if [[ -f "$pkg/nix-support/setup-hook" ]]; then
-        local oldOpts="-u"
-        shopt -qo nounset || oldOpts="+u"
-        set +u
         source "$pkg/nix-support/setup-hook"
-        set "$oldOpts"
     fi
 }
 
@@ -596,6 +571,13 @@ _addToEnv() {
 _addToEnv
 
 
+# Unset setup-specific declared variables
+unset allPlatOffsets
+unset pkgBuildAccumVars pkgHostAccumVars pkgTargetAccumVars pkgAccumVarVars
+unset pkgBuildHookVars pkgHostHookVars pkgTargetHookVars pkgHookVarVars
+unset propagatedDepFilesVars
+
+
 _addRpathPrefix "$out"
 
 
@@ -805,14 +787,17 @@ dumpVars() {
 # Utility function: echo the base name of the given path, with the
 # prefix `HASH-' removed, if present.
 stripHash() {
-    local strippedName
+    local strippedName casematchOpt=0
     # On separate line for `set -e`
-    strippedName="$(basename "$1")"
-    if echo "$strippedName" | grep -q '^[a-z0-9]\{32\}-'; then
-        echo "$strippedName" | cut -c34-
+    strippedName="$(basename -- "$1")"
+    shopt -q nocasematch && casematchOpt=1
+    shopt -u nocasematch
+    if [[ "$strippedName" =~ ^[a-z0-9]{32}- ]]; then
+        echo "${strippedName:33}"
     else
         echo "$strippedName"
     fi
+    if (( casematchOpt )); then shopt -s nocasematch; fi
 }
 
 
@@ -1264,19 +1249,11 @@ showPhaseHeader() {
 
 genericBuild() {
     if [ -f "${buildCommandPath:-}" ]; then
-        local oldOpts="-u"
-        shopt -qo nounset || oldOpts="+u"
-        set +u
         source "$buildCommandPath"
-        set "$oldOpts"
         return
     fi
     if [ -n "${buildCommand:-}" ]; then
-        local oldOpts="-u"
-        shopt -qo nounset || oldOpts="+u"
-        set +u
         eval "$buildCommand"
-        set "$oldOpts"
         return
     fi
 
@@ -1306,11 +1283,7 @@ genericBuild() {
 
         # Evaluate the variable named $curPhase if it exists, otherwise the
         # function named $curPhase.
-        local oldOpts="-u"
-        shopt -qo nounset || oldOpts="+u"
-        set +u
         eval "${!curPhase:-$curPhase}"
-        set "$oldOpts"
 
         if [ "$curPhase" = unpackPhase ]; then
             cd "${sourceRoot:-.}"
diff --git a/pkgs/tools/archivers/cpio/CVE-2016-2037-out-of-bounds-write.patch b/pkgs/tools/archivers/cpio/CVE-2016-2037-out-of-bounds-write.patch
deleted file mode 100644
index 90ddeff9790..00000000000
--- a/pkgs/tools/archivers/cpio/CVE-2016-2037-out-of-bounds-write.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-diff --git a/src/copyin.c b/src/copyin.c
-index cde911e..032d35f 100644
---- a/src/copyin.c
-+++ b/src/copyin.c
-@@ -1385,6 +1385,8 @@ process_copy_in ()
-          break;
-        }
-
-+      if (file_hdr.c_namesize <= 1)
-+        file_hdr.c_name = xrealloc(file_hdr.c_name, 2);
-       cpio_safer_name_suffix (file_hdr.c_name, false, !no_abs_paths_flag,
-                              false);
-
-diff --git a/src/util.c b/src/util.c
-index 6ff6032..2763ac1 100644
---- a/src/util.c
-+++ b/src/util.c
-@@ -1411,7 +1411,10 @@ set_file_times (int fd,
- }
-
- /* Do we have to ignore absolute paths, and if so, does the filename
--   have an absolute path?  */
-+   have an absolute path?
-+   Before calling this function make sure that the allocated NAME buffer has
-+   capacity at least 2 bytes to allow us to store the "." string inside.  */
-+
- void
- cpio_safer_name_suffix (char *name, bool link_target, bool absolute_names,
-                        bool strip_leading_dots)
diff --git a/pkgs/tools/archivers/cpio/default.nix b/pkgs/tools/archivers/cpio/default.nix
index 44943109ee1..3f6b3ba4598 100644
--- a/pkgs/tools/archivers/cpio/default.nix
+++ b/pkgs/tools/archivers/cpio/default.nix
@@ -1,30 +1,16 @@
-{ stdenv, fetchurl, fetchpatch }:
+{ stdenv, fetchurl }:
 
 let
-  version = "2.12";
+  version = "2.13";
   name = "cpio-${version}";
 in stdenv.mkDerivation {
   inherit name;
 
   src = fetchurl {
     url = "mirror://gnu/cpio/${name}.tar.bz2";
-    sha256 = "0vi9q475h1rki53100zml75vxsykzyhrn70hidy41s5c2rc8r6bh";
+    sha256 = "0vbgnhkawdllgnkdn6zn1f56fczwk0518krakz2qbwhxmv2vvdga";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "CVE-2015-1197-cpio-2.12.patch";
-      url = "https://gist.github.com/nckx/70b0bfa80ddfb86c2967/"
-        + "raw/e9b40d4d4b701f584f826775b75beb10751dc884/"
-        + "CVE-2015-1197-cpio-2.12.patch";
-      sha256 = "0ph43m4lavwkc4gnl5h9p3da4kb1pnhwk5l2qsky70dqri8pcr8v";
-    })
-
-    # Report: http://www.openwall.com/lists/oss-security/2016/01/19/4
-    # Patch from https://lists.gnu.org/archive/html/bug-cpio/2016-01/msg00005.html
-    ./CVE-2016-2037-out-of-bounds-write.patch
-  ];
-
   preConfigure = if stdenv.isCygwin then ''
     sed -i gnu/fpending.h -e 's,include <stdio_ext.h>,,'
   '' else null;
diff --git a/pkgs/tools/archivers/unzip/default.nix b/pkgs/tools/archivers/unzip/default.nix
index cdf189e82df..7bbcc906292 100644
--- a/pkgs/tools/archivers/unzip/default.nix
+++ b/pkgs/tools/archivers/unzip/default.nix
@@ -26,6 +26,21 @@ stdenv.mkDerivation {
     ./CVE-2016-9844.patch
     ./CVE-2018-18384.patch
     ./dont-hardcode-cc.patch
+    (fetchurl {
+      url = "https://github.com/madler/unzip/commit/41beb477c5744bc396fa1162ee0c14218ec12213.patch";
+      name = "CVE-2019-13232-1.patch";
+      sha256 = "04jzd6chg9fw4l5zadkfsrfm5llrd7vhd1dgdjjd29nrvkrjyn14";
+    })
+    (fetchurl {
+      url = "https://github.com/madler/unzip/commit/47b3ceae397d21bf822bc2ac73052a4b1daf8e1c.patch";
+      name = "CVE-2019-13232-2.patch";
+      sha256 = "0iy2wcjyvzwrjk02iszwcpg85fkjxs1bvb9isvdiywszav4yjs32";
+    })
+    (fetchurl {
+      url = "https://github.com/madler/unzip/commit/6d351831be705cc26d897db44f878a978f4138fc.patch";
+      name = "CVE-2019-13232-3.patch";
+      sha256 = "1jvs7dkdqs97qnsqc6hk088alhv8j4c638k65dbib9chh40jd7pf";
+    })
   ] ++ stdenv.lib.optional enableNLS
     (fetchurl {
       url = "http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/app-arch/unzip/files/unzip-6.0-natspec.patch?revision=1.1";
diff --git a/pkgs/tools/graphics/maim/default.nix b/pkgs/tools/graphics/maim/default.nix
index 63758e23b15..8f3a4dc5c65 100644
--- a/pkgs/tools/graphics/maim/default.nix
+++ b/pkgs/tools/graphics/maim/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, cmake, pkgconfig
-, zlib, libpng, libjpeg, libGLU_combined, glm
+, zlib, libpng, libjpeg, libGLU, libGL, glm
 , libX11, libXext, libXfixes, libXrandr, libXcomposite, slop, icu
 }:
 
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake pkgconfig ];
   buildInputs =
-    [ zlib libpng libjpeg libGLU_combined glm
+    [ zlib libpng libjpeg libGLU libGL glm
       libX11 libXext libXfixes libXrandr libXcomposite slop icu ];
 
   doCheck = false;
diff --git a/pkgs/tools/misc/desktop-file-utils/setup-hook.sh b/pkgs/tools/misc/desktop-file-utils/setup-hook.sh
index 004d635cff0..728070e3458 100644
--- a/pkgs/tools/misc/desktop-file-utils/setup-hook.sh
+++ b/pkgs/tools/misc/desktop-file-utils/setup-hook.sh
@@ -3,4 +3,4 @@ mimeinfoPreFixupPhase() {
     rm -f $out/share/applications/mimeinfo.cache
 }
 
-preFixupPhases="$preFixupPhases mimeinfoPreFixupPhase"
+preFixupPhases="${preFixupPhases-} mimeinfoPreFixupPhase"
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index 817f3ccf19b..24c3145c7db 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -24,14 +24,14 @@ assert brotliSupport -> brotli != null;
 assert gssSupport -> libkrb5 != null;
 
 stdenv.mkDerivation rec {
-  name = "curl-7.66.0";
+  name = "curl-7.67.0";
 
   src = fetchurl {
     urls = [
       "https://curl.haxx.se/download/${name}.tar.bz2"
       "https://github.com/curl/curl/releases/download/${lib.replaceStrings ["."] ["_"] name}/${name}.tar.bz2"
     ];
-    sha256 = "0hd1wwplw357hn876s4n2gk7dpmd1gfw5d2c3yi21i1m09726636";
+    sha256 = "0v2qb1c82m3qzkiyglsg1745qi791i9pl1jgnks8nm0sh9b6jpyx";
   };
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
diff --git a/pkgs/tools/networking/network-manager/default.nix b/pkgs/tools/networking/network-manager/default.nix
index e18b5970370..4805d01dead 100644
--- a/pkgs/tools/networking/network-manager/default.nix
+++ b/pkgs/tools/networking/network-manager/default.nix
@@ -61,6 +61,13 @@ in stdenv.mkDerivation rec {
     # Meson does not support using different directories during build and
     # for installation like Autotools did with flags passed to make install.
     ./fix-install-paths.patch
+
+    # Fixes https://github.com/NixOS/nixpkgs/issues/72330
+    # Upstream MR: https://gitlab.freedesktop.org/NetworkManager/NetworkManager/merge_requests/323
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/NetworkManager/NetworkManager/commit/4c11364201c094ad19ab9980ea6051a82bd2a550.patch";
+      sha256 = "14dgb6ijxyzcglrk67is2fn49iwrhljf2sld8w557i6zkypilmsv";
+    })
   ];
 
   buildInputs = [
@@ -104,7 +111,7 @@ in stdenv.mkDerivation rec {
     homepage = https://wiki.gnome.org/Projects/NetworkManager;
     description = "Network configuration and management tool";
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ phreedom domenkozar obadz ];
+    maintainers = with maintainers; [ phreedom domenkozar obadz worldofpeace ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/security/gnupg/22.nix b/pkgs/tools/security/gnupg/22.nix
index f62f10c8cf9..e54a1e1c5db 100644
--- a/pkgs/tools/security/gnupg/22.nix
+++ b/pkgs/tools/security/gnupg/22.nix
@@ -1,17 +1,17 @@
 { fetchurl, fetchpatch, stdenv, pkgconfig, libgcrypt, libassuan, libksba
-, libgpgerror, libiconv, npth, gettext, texinfo, pcsclite, sqlite
-, buildPackages
+, libgpgerror, libiconv, npth, gettext, texinfo, buildPackages
 
 # Each of the dependencies below are optional.
 # Gnupg can be built without them at the cost of reduced functionality.
-, pinentry ? null, guiSupport ? false
-, adns ? null, gnutls ? null, libusb ? null, openldap ? null
-, readline ? null, zlib ? null, bzip2 ? null
+, guiSupport ? true, enableMinimal ? false
+, adns ? null , bzip2 ? null , gnutls ? null , libusb ? null , openldap ? null
+, pcsclite ? null , pinentry ? null , readline ? null , sqlite ? null , zlib ?
+null
 }:
 
 with stdenv.lib;
 
-assert guiSupport -> pinentry != null;
+assert guiSupport -> pinentry != null && enableMinimal == false;
 
 stdenv.mkDerivation rec {
   pname = "gnupg";
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
   postPatch = ''
     sed -i 's,hkps://hkps.pool.sks-keyservers.net,hkps://keys.openpgp.org,g' \
         configure doc/dirmngr.texi doc/gnupg.info-1
-  '' + stdenv.lib.optionalString stdenv.isLinux ''
+  '' + stdenv.lib.optionalString ( stdenv.isLinux && pcsclite != null) ''
     sed -i 's,"libpcsclite\.so[^"]*","${stdenv.lib.getLib pcsclite}/lib/libpcsclite.so",g' scd/scdaemon.c
   ''; #" fix Emacs syntax highlighting :-(
 
@@ -50,7 +50,14 @@ stdenv.mkDerivation rec {
     "--with-npth-prefix=${npth}"
   ] ++ optional guiSupport "--with-pinentry-pgm=${pinentry}/${pinentryBinaryPath}";
 
-  postInstall = ''
+  postInstall = if enableMinimal
+  then ''
+    rm -r $out/{libexec,sbin,share}
+    for f in `find $out/bin -type f -not -name gpg`
+    do
+      rm $f
+    done
+  '' else ''
     mkdir -p $out/lib/systemd/user
     for f in doc/examples/systemd-user/*.{service,socket} ; do
       substitute $f $out/lib/systemd/user/$(basename $f) \
diff --git a/pkgs/tools/security/sudo/default.nix b/pkgs/tools/security/sudo/default.nix
index c3e464da516..a0922f4df73 100644
--- a/pkgs/tools/security/sudo/default.nix
+++ b/pkgs/tools/security/sudo/default.nix
@@ -5,14 +5,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "sudo-1.8.28";
+  name = "sudo-1.8.29";
 
   src = fetchurl {
     urls =
       [ "ftp://ftp.sudo.ws/pub/sudo/${name}.tar.gz"
         "ftp://ftp.sudo.ws/pub/sudo/OLD/${name}.tar.gz"
       ];
-    sha256 = "188k3w67aflbmi4b5z23pxrvzfcfndi22b84w86gzjh8b9sglaci";
+    sha256 = "0z4wyadh9cks17gdpfgx4kvbrlnyb6nai2sd6chk7qh4jsngylyf";
   };
 
   prePatch = ''
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
       #define _PATH_MV "${coreutils}/bin/mv"
     EOF
     makeFlags="install_uid=$(id -u) install_gid=$(id -g)"
-    installFlags="sudoers_uid=$(id -u) sudoers_gid=$(id -g) sysconfdir=$out/etc rundir=$TMPDIR/dummy vardir=$TMPDIR/dummy"
+    installFlags="sudoers_uid=$(id -u) sudoers_gid=$(id -g) sysconfdir=$out/etc rundir=$TMPDIR/dummy vardir=$TMPDIR/dummy DESTDIR=/"
     '';
 
   nativeBuildInputs = [ groff ];
diff --git a/pkgs/tools/text/sgml/opensp/setup-hook.sh b/pkgs/tools/text/sgml/opensp/setup-hook.sh
index 753a3ea6428..5bace3c6688 100644
--- a/pkgs/tools/text/sgml/opensp/setup-hook.sh
+++ b/pkgs/tools/text/sgml/opensp/setup-hook.sh
@@ -6,7 +6,7 @@ addSGMLCatalogs () {
       fi
 }
 
-if test -z "$sgmlHookDone"; then
+if test -z "${sgmlHookDone-}"; then
     sgmlHookDone=1
 
     # Set http_proxy and ftp_proxy to a invalid host to prevent
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3123bf13b3a..fa353be07e8 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4006,9 +4006,7 @@ in
 
   i2p = callPackage ../tools/networking/i2p {};
 
-  i2pd = callPackage ../tools/networking/i2pd {
-    boost = boost165;
-  };
+  i2pd = callPackage ../tools/networking/i2pd { };
 
   i-score = libsForQt5.callPackage ../applications/audio/i-score { };
 
@@ -4619,9 +4617,7 @@ in
 
   file-rename = callPackage ../tools/filesystems/file-rename { };
 
-  kea = callPackage ../tools/networking/kea {
-    boost = boost165;
-  };
+  kea = callPackage ../tools/networking/kea { };
 
   ispell = callPackage ../tools/text/ispell {};
 
@@ -10746,7 +10742,7 @@ in
   boost167 = callPackage ../development/libraries/boost/1.67.nix { };
   boost168 = callPackage ../development/libraries/boost/1.68.nix { };
   boost169 = callPackage ../development/libraries/boost/1.69.nix { };
-  boost16x = boost167;
+  boost16x = boost169;
   boost170 = callPackage ../development/libraries/boost/1.70.nix { };
   boost171 = callPackage ../development/libraries/boost/1.71.nix { };
   boost17x = boost171;
@@ -13631,8 +13627,8 @@ in
   libsForQt512 = recurseIntoAttrs (lib.makeScope qt512.newScope mkLibsForQt5);
 
   # TODO bump to 5.12 on darwin once it's not broken
-  qt5 = if stdenv.isDarwin then qt511 else qt512;
-  libsForQt5 = if stdenv.isDarwin then libsForQt511 else libsForQt512;
+  qt5 = qt512;
+  libsForQt5 = libsForQt512;
 
   qt5ct = libsForQt5.callPackage ../tools/misc/qt5ct { };
 
@@ -15550,9 +15546,7 @@ in
     libtool = darwin.cctools;
   };
 
-  rippled = callPackage ../servers/rippled {
-    boost = boost167;
-  };
+  rippled = callPackage ../servers/rippled { };
 
   rippled-validator-keys-tool = callPackage ../servers/rippled/validator-keys-tool.nix {
     boost = boost167.override {
@@ -19527,7 +19521,7 @@ in
   k3d = callPackage ../applications/graphics/k3d {
     inherit (pkgs.gnome2) gtkglext;
     stdenv = gcc6Stdenv;
-    boost = boost166.override { enablePython = true; };
+    boost = boost.override { enablePython = true; };
   };
 
   k9copy = libsForQt5.callPackage ../applications/video/k9copy {};