summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--doc/languages-frameworks/go.xml2
-rw-r--r--nixos/modules/services/x11/extra-layouts.nix2
-rw-r--r--pkgs/applications/audio/adlplug/default.nix10
-rw-r--r--pkgs/applications/audio/aeolus/default.nix2
-rw-r--r--pkgs/applications/audio/airwave/default.nix2
-rw-r--r--pkgs/applications/audio/audacity/default.nix2
-rw-r--r--pkgs/applications/audio/avldrums-lv2/default.nix2
-rw-r--r--pkgs/applications/audio/cd-discid/default.nix2
-rw-r--r--pkgs/applications/audio/chuck/default.nix4
-rw-r--r--pkgs/applications/audio/clementine/default.nix2
-rw-r--r--pkgs/applications/audio/cmus/default.nix2
-rw-r--r--pkgs/applications/audio/distrho/default.nix2
-rw-r--r--pkgs/applications/audio/eq10q/default.nix4
-rw-r--r--pkgs/applications/audio/foo-yc20/default.nix2
-rw-r--r--pkgs/applications/audio/freewheeling/default.nix3
-rw-r--r--pkgs/applications/audio/jack-rack/default.nix6
-rw-r--r--pkgs/applications/audio/jamin/default.nix2
-rw-r--r--pkgs/applications/audio/lash/default.nix6
-rw-r--r--pkgs/applications/audio/lsp-plugins/default.nix2
-rw-r--r--pkgs/applications/audio/moc/default.nix2
-rw-r--r--pkgs/applications/audio/mpg321/default.nix2
-rw-r--r--pkgs/applications/audio/openmpt123/default.nix2
-rw-r--r--pkgs/applications/audio/pianobar/default.nix2
-rw-r--r--pkgs/applications/audio/pianobooster/default.nix2
-rw-r--r--pkgs/applications/audio/sndpeek/default.nix2
-rw-r--r--pkgs/applications/audio/svox/default.nix2
-rw-r--r--pkgs/applications/audio/timemachine/default.nix4
-rw-r--r--pkgs/applications/audio/vcv-rack/default.nix2
-rw-r--r--pkgs/applications/blockchains/aeon/default.nix4
-rw-r--r--pkgs/applications/blockchains/monero-gui/default.nix2
-rw-r--r--pkgs/applications/display-managers/lightdm/gtk-greeter.nix2
-rw-r--r--pkgs/applications/editors/bviplus/default.nix2
-rw-r--r--pkgs/applications/editors/codeblocks/default.nix2
-rw-r--r--pkgs/applications/editors/edbrowse/default.nix4
-rw-r--r--pkgs/applications/editors/emacs-modes/libgenerated.nix2
-rw-r--r--pkgs/applications/editors/emacs/25.nix2
-rw-r--r--pkgs/applications/editors/fte/default.nix4
-rw-r--r--pkgs/applications/editors/hexcurse/default.nix3
-rw-r--r--pkgs/applications/editors/jucipp/default.nix2
-rw-r--r--pkgs/applications/editors/nedit/default.nix7
-rw-r--r--pkgs/applications/editors/texmacs/default.nix2
-rw-r--r--pkgs/applications/editors/yi/wrapper.nix2
-rw-r--r--pkgs/applications/gis/grass/default.nix2
-rw-r--r--pkgs/applications/graphics/ahoviewer/default.nix4
-rw-r--r--pkgs/applications/graphics/gimp/plugins/default.nix4
-rw-r--r--pkgs/applications/graphics/gnuclad/default.nix2
-rw-r--r--pkgs/applications/graphics/goxel/default.nix4
-rw-r--r--pkgs/applications/graphics/gqview/default.nix4
-rw-r--r--pkgs/applications/graphics/k3d/default.nix4
-rw-r--r--pkgs/applications/graphics/openimageio/default.nix4
-rw-r--r--pkgs/applications/graphics/smartdeblur/default.nix2
-rw-r--r--pkgs/applications/graphics/xournal/default.nix4
-rw-r--r--pkgs/applications/graphics/zgv/default.nix2
-rw-r--r--pkgs/applications/kde/print-manager.nix5
-rw-r--r--pkgs/applications/misc/bibletime/default.nix20
-rw-r--r--pkgs/applications/misc/cbatticon/default.nix2
-rw-r--r--pkgs/applications/misc/ddgr/default.nix2
-rw-r--r--pkgs/applications/misc/doomseeker/default.nix2
-rw-r--r--pkgs/applications/misc/fbreader/default.nix4
-rw-r--r--pkgs/applications/misc/getxbook/default.nix6
-rw-r--r--pkgs/applications/misc/golden-cheetah/default.nix2
-rw-r--r--pkgs/applications/misc/gollum/default.nix14
-rw-r--r--pkgs/applications/misc/googler/default.nix2
-rw-r--r--pkgs/applications/misc/grip/default.nix2
-rw-r--r--pkgs/applications/misc/gxneur/default.nix2
-rw-r--r--pkgs/applications/misc/hugo/default.nix2
-rw-r--r--pkgs/applications/misc/jp2a/default.nix2
-rw-r--r--pkgs/applications/misc/k2pdfopt/default.nix4
-rw-r--r--pkgs/applications/misc/merkaartor/default.nix2
-rw-r--r--pkgs/applications/misc/mlterm/default.nix4
-rw-r--r--pkgs/applications/misc/mysql-workbench/default.nix4
-rw-r--r--pkgs/applications/misc/navit/default.nix4
-rw-r--r--pkgs/applications/misc/netsurf/libcss/default.nix2
-rw-r--r--pkgs/applications/misc/notify-osd-customizable/default.nix2
-rw-r--r--pkgs/applications/misc/oneko/default.nix2
-rw-r--r--pkgs/applications/misc/osm2xmap/default.nix2
-rw-r--r--pkgs/applications/misc/pdfpc/default.nix2
-rw-r--r--pkgs/applications/misc/ranger/default.nix2
-rw-r--r--pkgs/applications/misc/redis-desktop-manager/default.nix2
-rw-r--r--pkgs/applications/misc/slmenu/default.nix4
-rw-r--r--pkgs/applications/misc/stupidterm/default.nix2
-rw-r--r--pkgs/applications/misc/tangogps/default.nix2
-rw-r--r--pkgs/applications/misc/taskjuggler/2.x/default.nix5
-rw-r--r--pkgs/applications/misc/xsw/default.nix2
-rw-r--r--pkgs/applications/misc/xxkb/default.nix2
-rw-r--r--pkgs/applications/networking/browsers/firefox/common.nix9
-rw-r--r--pkgs/applications/networking/feedreaders/newsboat/default.nix4
-rw-r--r--pkgs/applications/networking/ids/suricata/default.nix8
-rw-r--r--pkgs/applications/networking/instant-messengers/ekiga/default.nix73
-rw-r--r--pkgs/applications/networking/instant-messengers/mikutter/default.nix16
-rw-r--r--pkgs/applications/networking/instant-messengers/pidgin-plugins/pidgin-latex/default.nix2
-rw-r--r--pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-matrix/default.nix2
-rw-r--r--pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-vk-plugin/default.nix2
-rw-r--r--pkgs/applications/networking/instant-messengers/pidgin-plugins/telegram-purple/default.nix2
-rw-r--r--pkgs/applications/networking/instant-messengers/pond/default.nix2
-rw-r--r--pkgs/applications/networking/instant-messengers/signal-cli/default.nix2
-rw-r--r--pkgs/applications/networking/instant-messengers/skype-call-recorder/default.nix2
-rw-r--r--pkgs/applications/networking/instant-messengers/swift-im/default.nix8
-rw-r--r--pkgs/applications/networking/irc/bip/default.nix14
-rw-r--r--pkgs/applications/networking/irc/quassel/default.nix2
-rw-r--r--pkgs/applications/networking/irc/sic/default.nix2
-rw-r--r--pkgs/applications/networking/mailreaders/mblaze/default.nix2
-rw-r--r--pkgs/applications/networking/mailreaders/sylpheed/default.nix6
-rw-r--r--pkgs/applications/networking/mailreaders/thunderbird/default.nix2
-rw-r--r--pkgs/applications/networking/p2p/frostwire/frostwire-bin.nix6
-rw-r--r--pkgs/applications/networking/remote/putty/default.nix2
-rw-r--r--pkgs/applications/networking/sipcmd/default.nix34
-rw-r--r--pkgs/applications/networking/sync/casync/default.nix6
-rw-r--r--pkgs/applications/office/antiword/default.nix2
-rw-r--r--pkgs/applications/office/gnucash/default.nix2
-rw-r--r--pkgs/applications/office/libreoffice/default.nix4
-rw-r--r--pkgs/applications/office/libreoffice/src-fresh/override.nix5
-rw-r--r--pkgs/applications/office/libreoffice/src-still/override.nix1
-rw-r--r--pkgs/applications/office/notes-up/default.nix2
-rw-r--r--pkgs/applications/office/planner/default.nix2
-rw-r--r--pkgs/applications/office/trilium/default.nix2
-rw-r--r--pkgs/applications/radio/dmrconfig/default.nix2
-rw-r--r--pkgs/applications/radio/gnuradio/default.nix4
-rw-r--r--pkgs/applications/radio/xlog/default.nix2
-rw-r--r--pkgs/applications/science/astronomy/xearth/default.nix4
-rw-r--r--pkgs/applications/science/biology/megahit/default.nix13
-rw-r--r--pkgs/applications/science/biology/niftyreg/default.nix2
-rw-r--r--pkgs/applications/science/biology/strelka/default.nix5
-rw-r--r--pkgs/applications/science/biology/sumatools/default.nix2
-rw-r--r--pkgs/applications/science/logic/avy/default.nix4
-rw-r--r--pkgs/applications/science/logic/coq/default.nix2
-rw-r--r--pkgs/applications/science/logic/minisat/clang.diff45
-rw-r--r--pkgs/applications/science/logic/minisat/darwin.patch26
-rw-r--r--pkgs/applications/science/logic/minisat/default.nix24
-rw-r--r--pkgs/applications/science/logic/minisat/unstable.nix23
-rw-r--r--pkgs/applications/science/logic/prover9/default.nix2
-rw-r--r--pkgs/applications/science/logic/stp/default.nix5
-rw-r--r--pkgs/applications/science/math/calculix/default.nix4
-rw-r--r--pkgs/applications/science/math/msieve/default.nix2
-rw-r--r--pkgs/applications/science/math/polymake/default.nix2
-rw-r--r--pkgs/applications/science/math/ries/default.nix2
-rw-r--r--pkgs/applications/science/math/scilab/default.nix2
-rw-r--r--pkgs/applications/science/misc/colmap/default.nix13
-rw-r--r--pkgs/applications/science/misc/megam/default.nix2
-rw-r--r--pkgs/applications/science/misc/simgrid/default.nix42
-rw-r--r--pkgs/applications/science/physics/xfitter/default.nix7
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-imerge/default.nix2
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-remote-hg/default.nix2
-rw-r--r--pkgs/applications/version-management/git-and-tools/git/default.nix2
-rw-r--r--pkgs/applications/version-management/git-and-tools/stgit/default.nix2
-rw-r--r--pkgs/applications/version-management/git-and-tools/svn-all-fast-export/default.nix4
-rw-r--r--pkgs/applications/version-management/gogs/default.nix2
-rw-r--r--pkgs/applications/version-management/mr/default.nix2
-rw-r--r--pkgs/applications/version-management/nbstripout/default.nix6
-rw-r--r--pkgs/applications/version-management/rcs/default.nix2
-rw-r--r--pkgs/applications/video/aegisub/default.nix4
-rw-r--r--pkgs/applications/video/handbrake/default.nix4
-rw-r--r--pkgs/applications/video/kino/default.nix5
-rw-r--r--pkgs/applications/video/kodi/default.nix4
-rw-r--r--pkgs/applications/video/mplayer/default.nix4
-rw-r--r--pkgs/applications/video/obs-studio/default.nix8
-rw-r--r--pkgs/applications/video/openshot-qt/libopenshot.nix4
-rw-r--r--pkgs/applications/virtualization/containerd/default.nix2
-rw-r--r--pkgs/applications/virtualization/cri-o/default.nix8
-rw-r--r--pkgs/applications/virtualization/docker/default.nix4
-rw-r--r--pkgs/applications/virtualization/open-vm-tools/default.nix12
-rw-r--r--pkgs/applications/virtualization/spice-vdagent/default.nix9
-rw-r--r--pkgs/applications/virtualization/tini/default.nix5
-rw-r--r--pkgs/applications/virtualization/virtualbox/default.nix12
-rw-r--r--pkgs/applications/virtualization/xen/4.10.nix6
-rw-r--r--pkgs/applications/virtualization/xen/4.8.nix6
-rw-r--r--pkgs/applications/virtualization/xen/generic.nix4
-rw-r--r--pkgs/applications/window-managers/compton/default.nix2
-rw-r--r--pkgs/applications/window-managers/i3/blocks-gaps.nix4
-rw-r--r--pkgs/applications/window-managers/i3/lock-color.nix4
-rw-r--r--pkgs/applications/window-managers/i3/lock.nix4
-rw-r--r--pkgs/applications/window-managers/ion-3/default.nix4
-rw-r--r--pkgs/applications/window-managers/larswm/default.nix2
-rw-r--r--pkgs/applications/window-managers/notion/default.nix4
-rw-r--r--pkgs/applications/window-managers/spectrwm/default.nix2
-rw-r--r--pkgs/applications/window-managers/wmii-hg/default.nix2
-rw-r--r--pkgs/data/fonts/dejavu-fonts/default.nix2
-rw-r--r--pkgs/data/themes/qtcurve/default.nix8
-rw-r--r--pkgs/desktops/deepin/deepin-icon-theme/default.nix2
-rw-r--r--pkgs/desktops/enlightenment/efl.nix2
-rw-r--r--pkgs/desktops/gnome-2/desktop/mail-notification/default.nix2
-rw-r--r--pkgs/desktops/gnome-2/platform/gtkhtml/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-settings-daemon/default.nix8
-rw-r--r--pkgs/desktops/gnome-3/misc/gnome-screensaver/default.nix2
-rw-r--r--pkgs/desktops/mate/mate-screensaver/default.nix2
-rw-r--r--pkgs/desktops/pantheon/services/elementary-settings-daemon/default.nix4
-rw-r--r--pkgs/desktops/rox/rox-filer/default.nix4
-rw-r--r--pkgs/desktops/xfce/core/xfce4-panel/default.nix2
-rw-r--r--pkgs/desktops/xfce/panel-plugins/xfce4-pulseaudio-plugin/default.nix2
-rw-r--r--pkgs/development/beam-modules/webdriver/default.nix2
-rw-r--r--pkgs/development/compilers/arachne-pnr/default.nix6
-rw-r--r--pkgs/development/compilers/chez/default.nix2
-rw-r--r--pkgs/development/compilers/chicken/4/chicken.nix4
-rw-r--r--pkgs/development/compilers/chicken/5/chicken.nix4
-rw-r--r--pkgs/development/compilers/cmdstan/default.nix2
-rw-r--r--pkgs/development/compilers/dev86/default.nix2
-rw-r--r--pkgs/development/compilers/eli/default.nix2
-rw-r--r--pkgs/development/compilers/elm/makeDotElm.nix3
-rw-r--r--pkgs/development/compilers/eql/default.nix2
-rw-r--r--pkgs/development/compilers/fpc/default.nix4
-rw-r--r--pkgs/development/compilers/fstar/default.nix4
-rw-r--r--pkgs/development/compilers/gcc/4.8/default.nix5
-rw-r--r--pkgs/development/compilers/gcc/4.9/default.nix5
-rw-r--r--pkgs/development/compilers/gcc/5/default.nix5
-rw-r--r--pkgs/development/compilers/gcc/6/default.nix5
-rw-r--r--pkgs/development/compilers/gcc/7/default.nix5
-rw-r--r--pkgs/development/compilers/gcc/8/default.nix5
-rw-r--r--pkgs/development/compilers/gcc/9/default.nix5
-rw-r--r--pkgs/development/compilers/gcc/common/configure-flags.nix2
-rw-r--r--pkgs/development/compilers/gerbil/build.nix2
-rw-r--r--pkgs/development/compilers/ghc/8.4.4.nix6
-rw-r--r--pkgs/development/compilers/ghc/8.6.5.nix6
-rw-r--r--pkgs/development/compilers/ghc/8.8.1.nix6
-rw-r--r--pkgs/development/compilers/ghc/head.nix8
-rw-r--r--pkgs/development/compilers/graalvm/default.nix5
-rw-r--r--pkgs/development/compilers/hhvm/default.nix2
-rw-r--r--pkgs/development/compilers/iasl/default.nix10
-rw-r--r--pkgs/development/compilers/ldc/default.nix68
-rw-r--r--pkgs/development/compilers/llvm/3.9/clang/0001-Fix-compilation-w-gcc9.patch63
-rw-r--r--pkgs/development/compilers/llvm/3.9/clang/default.nix5
-rw-r--r--pkgs/development/compilers/llvm/4/clang/0001-Fix-compilation-w-gcc9.patch59
-rw-r--r--pkgs/development/compilers/llvm/4/clang/default.nix5
-rw-r--r--pkgs/development/compilers/llvm/4/fix-gcc9.patch33
-rw-r--r--pkgs/development/compilers/llvm/4/llvm.nix7
-rw-r--r--pkgs/development/compilers/llvm/5/fix-gcc9.patch33
-rw-r--r--pkgs/development/compilers/llvm/5/llvm.nix7
-rw-r--r--pkgs/development/compilers/nim/default.nix8
-rw-r--r--pkgs/development/compilers/ocaml/3.10.0.nix2
-rw-r--r--pkgs/development/compilers/ocaml/3.11.2.nix6
-rw-r--r--pkgs/development/compilers/ocaml/3.12.1.nix6
-rw-r--r--pkgs/development/compilers/ocaml/4.00.1.nix10
-rw-r--r--pkgs/development/compilers/ocaml/generic.nix4
-rw-r--r--pkgs/development/compilers/ocaml/metaocaml-3.09.nix2
-rw-r--r--pkgs/development/compilers/openjdk/11.nix6
-rw-r--r--pkgs/development/compilers/openjdk/8.nix8
-rw-r--r--pkgs/development/compilers/openjdk/default.nix6
-rw-r--r--pkgs/development/compilers/openjdk/openjfx/11.nix2
-rw-r--r--pkgs/development/compilers/openjdk/openjfx/12.nix2
-rw-r--r--pkgs/development/compilers/ponyc/default.nix2
-rw-r--r--pkgs/development/compilers/rgbds/default.nix2
-rw-r--r--pkgs/development/compilers/rust/1_39_0.nix29
-rw-r--r--pkgs/development/compilers/rust/1_40_0.nix29
-rw-r--r--pkgs/development/compilers/rust/rustc.nix10
-rw-r--r--pkgs/development/compilers/yap/default.nix2
-rw-r--r--pkgs/development/compilers/z88dk/default.nix4
-rw-r--r--pkgs/development/coq-modules/Cheerios/default.nix2
-rw-r--r--pkgs/development/coq-modules/InfSeqExt/default.nix2
-rw-r--r--pkgs/development/coq-modules/StructTact/default.nix2
-rw-r--r--pkgs/development/coq-modules/Verdi/default.nix2
-rw-r--r--pkgs/development/coq-modules/autosubst/default.nix2
-rw-r--r--pkgs/development/coq-modules/bignums/default.nix2
-rw-r--r--pkgs/development/coq-modules/coq-elpi/default.nix2
-rw-r--r--pkgs/development/coq-modules/coq-ext-lib/default.nix2
-rw-r--r--pkgs/development/coq-modules/coqprime/default.nix2
-rw-r--r--pkgs/development/coq-modules/corn/default.nix2
-rw-r--r--pkgs/development/coq-modules/dpdgraph/default.nix8
-rw-r--r--pkgs/development/coq-modules/equations/default.nix2
-rw-r--r--pkgs/development/coq-modules/heq/default.nix2
-rw-r--r--pkgs/development/coq-modules/ltac2/default.nix2
-rw-r--r--pkgs/development/coq-modules/math-classes/default.nix2
-rw-r--r--pkgs/development/coq-modules/mathcomp/extra.nix4
-rw-r--r--pkgs/development/coq-modules/paramcoq/default.nix2
-rw-r--r--pkgs/development/coq-modules/tlc/default.nix2
-rw-r--r--pkgs/development/haskell-modules/configuration-common.nix2
-rw-r--r--pkgs/development/haskell-modules/configuration-nix.nix6
-rw-r--r--pkgs/development/interpreters/erlang/generic-builder.nix4
-rw-r--r--pkgs/development/interpreters/gnu-apl/default.nix4
-rw-r--r--pkgs/development/interpreters/jimtcl/default.nix2
-rw-r--r--pkgs/development/interpreters/kona/default.nix2
-rw-r--r--pkgs/development/interpreters/love/0.10.nix2
-rw-r--r--pkgs/development/interpreters/love/0.8.nix2
-rw-r--r--pkgs/development/interpreters/love/11.1.nix2
-rw-r--r--pkgs/development/interpreters/metamath/default.nix2
-rw-r--r--pkgs/development/interpreters/perl/default.nix12
-rw-r--r--pkgs/development/interpreters/php/default.nix14
-rw-r--r--pkgs/development/interpreters/pure/default.nix2
-rw-r--r--pkgs/development/interpreters/python/default.nix4
-rw-r--r--pkgs/development/interpreters/python/wrap.sh10
-rw-r--r--pkgs/development/interpreters/ruby/default.nix4
-rw-r--r--pkgs/development/interpreters/ruby/rubygems/default.nix7
-rw-r--r--pkgs/development/interpreters/spidermonkey/1.8.5.nix2
-rw-r--r--pkgs/development/interpreters/tcl/generic.nix6
-rw-r--r--pkgs/development/libraries/argp-standalone/default.nix2
-rw-r--r--pkgs/development/libraries/audiofile/default.nix5
-rw-r--r--pkgs/development/libraries/aws-c-common/default.nix6
-rw-r--r--pkgs/development/libraries/aws-sdk-cpp/default.nix3
-rw-r--r--pkgs/development/libraries/bamf/default.nix4
-rw-r--r--pkgs/development/libraries/bctoolbox/default.nix2
-rw-r--r--pkgs/development/libraries/belle-sip/default.nix2
-rw-r--r--pkgs/development/libraries/blitz/default.nix2
-rw-r--r--pkgs/development/libraries/boost/generic.nix2
-rw-r--r--pkgs/development/libraries/buddy/default.nix4
-rw-r--r--pkgs/development/libraries/ccrtp/1.8.nix24
-rw-r--r--pkgs/development/libraries/ccrtp/gcc-4.6-fix.patch20
-rw-r--r--pkgs/development/libraries/cfitsio/default.nix2
-rw-r--r--pkgs/development/libraries/commoncpp2/default.nix38
-rw-r--r--pkgs/development/libraries/cpp-hocon/default.nix2
-rw-r--r--pkgs/development/libraries/cppdb/default.nix2
-rw-r--r--pkgs/development/libraries/crc32c/default.nix2
-rw-r--r--pkgs/development/libraries/crypto++/default.nix2
-rw-r--r--pkgs/development/libraries/cutee/default.nix2
-rw-r--r--pkgs/development/libraries/cwiid/default.nix4
-rw-r--r--pkgs/development/libraries/czmq/3.x.nix26
-rw-r--r--pkgs/development/libraries/czmq/czmq3-gcc7.patch26
-rw-r--r--pkgs/development/libraries/czmq/default.nix (renamed from pkgs/development/libraries/czmq/4.x.nix)0
-rw-r--r--pkgs/development/libraries/czmqpp/default.nix28
-rw-r--r--pkgs/development/libraries/czmqpp/socket.patch17
-rw-r--r--pkgs/development/libraries/dirac/default.nix31
-rw-r--r--pkgs/development/libraries/dirac/dirac-1.0.2.patch362
-rw-r--r--pkgs/development/libraries/farbfeld/default.nix2
-rw-r--r--pkgs/development/libraries/ffmpeg/generic.nix14
-rw-r--r--pkgs/development/libraries/filter-audio/default.nix2
-rw-r--r--pkgs/development/libraries/flatbuffers/default.nix4
-rw-r--r--pkgs/development/libraries/flatpak/default.nix4
-rw-r--r--pkgs/development/libraries/flint/default.nix2
-rw-r--r--pkgs/development/libraries/fontconfig/2.10.nix2
-rw-r--r--pkgs/development/libraries/fontconfig/default.nix2
-rw-r--r--pkgs/development/libraries/gdal/gdal-1_11.nix4
-rw-r--r--pkgs/development/libraries/gdbm/default.nix3
-rw-r--r--pkgs/development/libraries/gegl/4.0.nix2
-rw-r--r--pkgs/development/libraries/geis/default.nix2
-rw-r--r--pkgs/development/libraries/gettext/default.nix2
-rw-r--r--pkgs/development/libraries/giflib/default.nix4
-rw-r--r--pkgs/development/libraries/glib-networking/default.nix4
-rw-r--r--pkgs/development/libraries/glib/default.nix6
-rw-r--r--pkgs/development/libraries/glibc/default.nix16
-rw-r--r--pkgs/development/libraries/glm/default.nix4
-rw-r--r--pkgs/development/libraries/gperftools/default.nix5
-rw-r--r--pkgs/development/libraries/gpgme/default.nix4
-rw-r--r--pkgs/development/libraries/gsl/default.nix2
-rw-r--r--pkgs/development/libraries/gsl/gsl-1_16.nix2
-rw-r--r--pkgs/development/libraries/gtk/2.x.nix2
-rw-r--r--pkgs/development/libraries/gtk/3.x.nix8
-rw-r--r--pkgs/development/libraries/hspell/dicts.nix18
-rw-r--r--pkgs/development/libraries/http-parser/default.nix2
-rw-r--r--pkgs/development/libraries/icu/58.nix2
-rw-r--r--pkgs/development/libraries/icu/base.nix2
-rw-r--r--pkgs/development/libraries/ilmbase/default.nix2
-rw-r--r--pkgs/development/libraries/itk/4.x.nix6
-rw-r--r--pkgs/development/libraries/java/swt/default.nix4
-rw-r--r--pkgs/development/libraries/leatherman/default.nix9
-rw-r--r--pkgs/development/libraries/libav/default.nix2
-rw-r--r--pkgs/development/libraries/libbluray/default.nix2
-rw-r--r--pkgs/development/libraries/libcaca/default.nix4
-rw-r--r--pkgs/development/libraries/libcbor/default.nix2
-rw-r--r--pkgs/development/libraries/libcef/default.nix2
-rw-r--r--pkgs/development/libraries/libcouchbase/default.nix2
-rw-r--r--pkgs/development/libraries/libde265/default.nix4
-rw-r--r--pkgs/development/libraries/libdynd/default.nix5
-rw-r--r--pkgs/development/libraries/libev/default.nix4
-rw-r--r--pkgs/development/libraries/libexecinfo/default.nix2
-rw-r--r--pkgs/development/libraries/libf2c/default.nix2
-rw-r--r--pkgs/development/libraries/libfakekey/default.nix4
-rw-r--r--pkgs/development/libraries/libfpx/default.nix2
-rw-r--r--pkgs/development/libraries/libftdi/default.nix2
-rw-r--r--pkgs/development/libraries/libgdiplus/default.nix2
-rw-r--r--pkgs/development/libraries/libglvnd/default.nix4
-rw-r--r--pkgs/development/libraries/libguestfs/default.nix2
-rw-r--r--pkgs/development/libraries/libheif/default.nix4
-rw-r--r--pkgs/development/libraries/libical/default.nix4
-rw-r--r--pkgs/development/libraries/libjpeg-drop/default.nix2
-rw-r--r--pkgs/development/libraries/libmatchbox/default.nix4
-rw-r--r--pkgs/development/libraries/libmbim/default.nix4
-rw-r--r--pkgs/development/libraries/libmemcached/default.nix2
-rw-r--r--pkgs/development/libraries/libmicrohttpd/default.nix4
-rw-r--r--pkgs/development/libraries/libmpeg2/default.nix2
-rw-r--r--pkgs/development/libraries/liboping/default.nix2
-rw-r--r--pkgs/development/libraries/libosmpbf/default.nix2
-rw-r--r--pkgs/development/libraries/libowfat/default.nix2
-rw-r--r--pkgs/development/libraries/libpfm/default.nix2
-rw-r--r--pkgs/development/libraries/libqtav/default.nix2
-rw-r--r--pkgs/development/libraries/libscrypt/default.nix2
-rw-r--r--pkgs/development/libraries/libspotify/default.nix6
-rw-r--r--pkgs/development/libraries/libunique/default.nix2
-rw-r--r--pkgs/development/libraries/libvdpau/default.nix2
-rw-r--r--pkgs/development/libraries/libwhereami/default.nix2
-rw-r--r--pkgs/development/libraries/libwps/default.nix2
-rw-r--r--pkgs/development/libraries/libxml2/default.nix6
-rw-r--r--pkgs/development/libraries/libyaml-cpp/default.nix2
-rw-r--r--pkgs/development/libraries/lmdb/default.nix2
-rw-r--r--pkgs/development/libraries/mediastreamer/default.nix4
-rw-r--r--pkgs/development/libraries/mlt/qt-5.nix2
-rw-r--r--pkgs/development/libraries/mps/default.nix2
-rw-r--r--pkgs/development/libraries/nss/default.nix2
-rw-r--r--pkgs/development/libraries/ntrack/default.nix2
-rw-r--r--pkgs/development/libraries/ois/default.nix2
-rw-r--r--pkgs/development/libraries/olm/default.nix6
-rw-r--r--pkgs/development/libraries/oniguruma/default.nix4
-rw-r--r--pkgs/development/libraries/opae/default.nix5
-rw-r--r--pkgs/development/libraries/opal/default.nix43
-rw-r--r--pkgs/development/libraries/opal/disable-samples-ftbfs.diff14
-rw-r--r--pkgs/development/libraries/opal/libav10.patch208
-rw-r--r--pkgs/development/libraries/opal/libav9.patch543
-rw-r--r--pkgs/development/libraries/openal-soft/default.nix4
-rw-r--r--pkgs/development/libraries/opencv/3.x.nix2
-rw-r--r--pkgs/development/libraries/opencv/4.x.nix2
-rw-r--r--pkgs/development/libraries/opencv/default.nix2
-rw-r--r--pkgs/development/libraries/openvdb/default.nix25
-rw-r--r--pkgs/development/libraries/ortp/default.nix2
-rw-r--r--pkgs/development/libraries/phonon/backends/gstreamer.nix2
-rw-r--r--pkgs/development/libraries/physics/qcdnum/default.nix4
-rw-r--r--pkgs/development/libraries/portaudio/default.nix2
-rw-r--r--pkgs/development/libraries/prometheus-cpp/default.nix2
-rw-r--r--pkgs/development/libraries/ptlib/default.nix59
-rw-r--r--pkgs/development/libraries/ptlib/ptlib-2.10.11-glibc-2.26.patch13
-rw-r--r--pkgs/development/libraries/qoauth/default.nix4
-rw-r--r--pkgs/development/libraries/qrupdate/default.nix4
-rw-r--r--pkgs/development/libraries/qt-4.x/4.8/default.nix10
-rw-r--r--pkgs/development/libraries/qt-4.x/4.8/qt4-gcc6.patch4
-rw-r--r--pkgs/development/libraries/qt-5/5.11/default.nix179
-rw-r--r--pkgs/development/libraries/qt-5/mkDerivation.nix4
-rw-r--r--pkgs/development/libraries/qt-5/modules/qtbase.nix26
-rw-r--r--pkgs/development/libraries/qtkeychain/default.nix6
-rw-r--r--pkgs/development/libraries/quickder/default.nix12
-rw-r--r--pkgs/development/libraries/readline/6.2.nix2
-rw-r--r--pkgs/development/libraries/readline/6.3.nix10
-rw-r--r--pkgs/development/libraries/readline/7.0.nix2
-rw-r--r--pkgs/development/libraries/readline/8.0.nix2
-rw-r--r--pkgs/development/libraries/rocksdb/default.nix2
-rw-r--r--pkgs/development/libraries/schroedinger/default.nix2
-rw-r--r--pkgs/development/libraries/science/benchmark/papi/default.nix2
-rw-r--r--pkgs/development/libraries/science/biology/htslib/default.nix2
-rw-r--r--pkgs/development/libraries/science/biology/mirtk/default.nix6
-rw-r--r--pkgs/development/libraries/science/math/fenics/default.nix41
-rw-r--r--pkgs/development/libraries/science/math/osi/default.nix6
-rw-r--r--pkgs/development/libraries/shhmsg/default.nix2
-rw-r--r--pkgs/development/libraries/shhopt/default.nix2
-rw-r--r--pkgs/development/libraries/smpeg/default.nix2
-rw-r--r--pkgs/development/libraries/sord/default.nix4
-rw-r--r--pkgs/development/libraries/spatialite-tools/default.nix2
-rw-r--r--pkgs/development/libraries/spdk/default.nix2
-rw-r--r--pkgs/development/libraries/sqlite/default.nix6
-rw-r--r--pkgs/development/libraries/srt/default.nix4
-rw-r--r--pkgs/development/libraries/t1lib/default.nix2
-rw-r--r--pkgs/development/libraries/tachyon/default.nix2
-rw-r--r--pkgs/development/libraries/tinyxml/2.6.2.nix2
-rw-r--r--pkgs/development/libraries/unixODBCDrivers/default.nix10
-rw-r--r--pkgs/development/libraries/uri/default.nix2
-rw-r--r--pkgs/development/libraries/usbredir/default.nix2
-rw-r--r--pkgs/development/libraries/v8/default.nix2
-rw-r--r--pkgs/development/libraries/vxl/default.nix19
-rw-r--r--pkgs/development/libraries/wxwidgets/2.8/default.nix2
-rw-r--r--pkgs/development/libraries/xmlsec/default.nix2
-rw-r--r--pkgs/development/libraries/zeroc-ice/default.nix2
-rw-r--r--pkgs/development/libraries/zeromq/4.x.nix2
-rw-r--r--pkgs/development/libraries/zookeeper_mt/default.nix2
-rw-r--r--pkgs/development/lua-modules/overrides.nix5
-rw-r--r--pkgs/development/misc/amdapp-sdk/default.nix2
-rw-r--r--pkgs/development/misc/qmk_firmware/default.nix2
-rw-r--r--pkgs/development/mobile/androidenv/build-tools.nix2
-rw-r--r--pkgs/development/mobile/androidenv/platform-tools.nix2
-rw-r--r--pkgs/development/ocaml-modules/biniou/1.0.nix2
-rw-r--r--pkgs/development/ocaml-modules/bolt/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/camlzip/default.nix6
-rw-r--r--pkgs/development/ocaml-modules/cohttp/0.19.3.nix2
-rw-r--r--pkgs/development/ocaml-modules/cryptokit/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/curses/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/dolmen/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/dypgen/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/fontconfig/default.nix5
-rw-r--r--pkgs/development/ocaml-modules/frontc/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/functory/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/lablgl/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/lablgtk/2.14.0.nix2
-rw-r--r--pkgs/development/ocaml-modules/lablgtk/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/llvm/default.nix4
-rw-r--r--pkgs/development/ocaml-modules/ocaml-cairo/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/ocplib-simplex/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/pprint/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/psmt2-frontend/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/twt/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/ulex/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/yojson/default.nix2
-rw-r--r--pkgs/development/pure-modules/audio/default.nix2
-rw-r--r--pkgs/development/pure-modules/avahi/default.nix2
-rw-r--r--pkgs/development/pure-modules/csv/default.nix2
-rw-r--r--pkgs/development/pure-modules/doc/default.nix2
-rw-r--r--pkgs/development/pure-modules/fastcgi/default.nix2
-rw-r--r--pkgs/development/pure-modules/faust/default.nix2
-rw-r--r--pkgs/development/pure-modules/ffi/default.nix2
-rw-r--r--pkgs/development/pure-modules/gen/default.nix2
-rw-r--r--pkgs/development/pure-modules/gl/default.nix5
-rw-r--r--pkgs/development/pure-modules/glpk/default.nix2
-rw-r--r--pkgs/development/pure-modules/gplot/default.nix2
-rw-r--r--pkgs/development/pure-modules/gsl/default.nix2
-rw-r--r--pkgs/development/pure-modules/gtk/default.nix2
-rw-r--r--pkgs/development/pure-modules/liblo/default.nix2
-rw-r--r--pkgs/development/pure-modules/lilv/default.nix2
-rw-r--r--pkgs/development/pure-modules/lv2/default.nix2
-rw-r--r--pkgs/development/pure-modules/midi/default.nix2
-rw-r--r--pkgs/development/pure-modules/mpfr/default.nix2
-rw-r--r--pkgs/development/pure-modules/octave/default.nix2
-rw-r--r--pkgs/development/pure-modules/odbc/default.nix2
-rw-r--r--pkgs/development/pure-modules/pandoc/default.nix2
-rw-r--r--pkgs/development/pure-modules/rational/default.nix2
-rw-r--r--pkgs/development/pure-modules/readline/default.nix2
-rw-r--r--pkgs/development/pure-modules/sockets/default.nix2
-rw-r--r--pkgs/development/pure-modules/sql3/default.nix2
-rw-r--r--pkgs/development/pure-modules/stldict/default.nix2
-rw-r--r--pkgs/development/pure-modules/stllib/default.nix2
-rw-r--r--pkgs/development/pure-modules/tk/default.nix2
-rw-r--r--pkgs/development/pure-modules/xml/default.nix2
-rw-r--r--pkgs/development/python-modules/Babel/default.nix6
-rw-r--r--pkgs/development/python-modules/JPype1/default.nix4
-rw-r--r--pkgs/development/python-modules/Pygments/default.nix4
-rw-r--r--pkgs/development/python-modules/Rtree/default.nix4
-rw-r--r--pkgs/development/python-modules/absl-py/default.nix4
-rw-r--r--pkgs/development/python-modules/aioesphomeapi/default.nix4
-rw-r--r--pkgs/development/python-modules/aiohttp/default.nix1
-rw-r--r--pkgs/development/python-modules/aiohue/default.nix4
-rw-r--r--pkgs/development/python-modules/alembic/default.nix4
-rw-r--r--pkgs/development/python-modules/altair/default.nix7
-rw-r--r--pkgs/development/python-modules/annoy/default.nix4
-rw-r--r--pkgs/development/python-modules/ansible-lint/default.nix5
-rw-r--r--pkgs/development/python-modules/apispec/default.nix4
-rw-r--r--pkgs/development/python-modules/argon2_cffi/default.nix7
-rw-r--r--pkgs/development/python-modules/ase/3.17.nix4
-rw-r--r--pkgs/development/python-modules/ase/default.nix4
-rw-r--r--pkgs/development/python-modules/astropy-helpers/default.nix4
-rw-r--r--pkgs/development/python-modules/astropy/default.nix4
-rw-r--r--pkgs/development/python-modules/astunparse/default.nix4
-rw-r--r--pkgs/development/python-modules/asyncssh/default.nix4
-rw-r--r--pkgs/development/python-modules/audio-metadata/default.nix2
-rw-r--r--pkgs/development/python-modules/autobahn/default.nix4
-rw-r--r--pkgs/development/python-modules/awkward/default.nix4
-rw-r--r--pkgs/development/python-modules/awkward1/default.nix4
-rw-r--r--pkgs/development/python-modules/aws-adfs/default.nix4
-rw-r--r--pkgs/development/python-modules/aws-sam-translator/default.nix4
-rw-r--r--pkgs/development/python-modules/azure-common/default.nix4
-rw-r--r--pkgs/development/python-modules/azure-core/default.nix48
-rw-r--r--pkgs/development/python-modules/azure-keyvault-keys/default.nix47
-rw-r--r--pkgs/development/python-modules/azure-keyvault-secrets/default.nix33
-rw-r--r--pkgs/development/python-modules/azure-keyvault/default.nix38
-rw-r--r--pkgs/development/python-modules/azure-mgmt-cdn/default.nix4
-rw-r--r--pkgs/development/python-modules/azure-mgmt-consumption/default.nix5
-rw-r--r--pkgs/development/python-modules/azure-mgmt-containerservice/default.nix4
-rw-r--r--pkgs/development/python-modules/azure-mgmt-cosmosdb/default.nix4
-rw-r--r--pkgs/development/python-modules/azure-mgmt-datamigration/default.nix9
-rw-r--r--pkgs/development/python-modules/azure-mgmt-devtestlabs/default.nix5
-rw-r--r--pkgs/development/python-modules/azure-mgmt-dns/default.nix5
-rw-r--r--pkgs/development/python-modules/azure-mgmt-hanaonazure/default.nix4
-rw-r--r--pkgs/development/python-modules/azure-mgmt-hdinsight/default.nix4
-rw-r--r--pkgs/development/python-modules/azure-mgmt-keyvault/default.nix5
-rw-r--r--pkgs/development/python-modules/azure-mgmt-media/default.nix4
-rw-r--r--pkgs/development/python-modules/azure-mgmt-msi/default.nix5
-rw-r--r--pkgs/development/python-modules/azure-mgmt-relay/default.nix5
-rw-r--r--pkgs/development/python-modules/azure-mgmt-resource/default.nix4
-rw-r--r--pkgs/development/python-modules/azure-mgmt-servicefabric/default.nix5
-rw-r--r--pkgs/development/python-modules/azure-mgmt-sql/default.nix4
-rw-r--r--pkgs/development/python-modules/azure-mgmt-storage/default.nix4
-rw-r--r--pkgs/development/python-modules/azure-servicebus/default.nix4
-rw-r--r--pkgs/development/python-modules/azure-servicefabric/default.nix4
-rw-r--r--pkgs/development/python-modules/backports_functools_lru_cache/default.nix18
-rw-r--r--pkgs/development/python-modules/bayespy/default.nix4
-rw-r--r--pkgs/development/python-modules/beautifulsoup4/default.nix4
-rw-r--r--pkgs/development/python-modules/bids-validator/default.nix4
-rw-r--r--pkgs/development/python-modules/bitarray/default.nix4
-rw-r--r--pkgs/development/python-modules/bjoern/default.nix4
-rw-r--r--pkgs/development/python-modules/bleach/default.nix5
-rw-r--r--pkgs/development/python-modules/bokeh/default.nix17
-rw-r--r--pkgs/development/python-modules/boltztrap2/default.nix4
-rw-r--r--pkgs/development/python-modules/breathe/default.nix7
-rw-r--r--pkgs/development/python-modules/broadlink/default.nix4
-rw-r--r--pkgs/development/python-modules/browser-cookie3/default.nix4
-rw-r--r--pkgs/development/python-modules/buildbot/default.nix5
-rw-r--r--pkgs/development/python-modules/cachecontrol/default.nix4
-rw-r--r--pkgs/development/python-modules/cachetools/default.nix7
-rw-r--r--pkgs/development/python-modules/cachy/default.nix4
-rw-r--r--pkgs/development/python-modules/caldav/default.nix1
-rw-r--r--pkgs/development/python-modules/celery/default.nix10
-rw-r--r--pkgs/development/python-modules/certifi/default.nix4
-rw-r--r--pkgs/development/python-modules/cffi/default.nix3
-rw-r--r--pkgs/development/python-modules/cfn-lint/default.nix9
-rw-r--r--pkgs/development/python-modules/channels/default.nix4
-rw-r--r--pkgs/development/python-modules/cld2-cffi/default.nix2
-rw-r--r--pkgs/development/python-modules/cliff/default.nix4
-rw-r--r--pkgs/development/python-modules/clifford/default.nix4
-rw-r--r--pkgs/development/python-modules/clikit/default.nix4
-rw-r--r--pkgs/development/python-modules/clize/default.nix14
-rw-r--r--pkgs/development/python-modules/clustershell/default.nix4
-rw-r--r--pkgs/development/python-modules/cma/default.nix33
-rw-r--r--pkgs/development/python-modules/colorcet/default.nix3
-rw-r--r--pkgs/development/python-modules/colored/default.nix4
-rw-r--r--pkgs/development/python-modules/confluent-kafka/default.nix4
-rw-r--r--pkgs/development/python-modules/cornice/default.nix4
-rw-r--r--pkgs/development/python-modules/coveralls/default.nix4
-rw-r--r--pkgs/development/python-modules/cupy/default.nix4
-rw-r--r--pkgs/development/python-modules/cx_oracle/default.nix4
-rw-r--r--pkgs/development/python-modules/cymem/default.nix5
-rw-r--r--pkgs/development/python-modules/dask/default.nix41
-rw-r--r--pkgs/development/python-modules/datadog/default.nix8
-rw-r--r--pkgs/development/python-modules/datashader/default.nix4
-rw-r--r--pkgs/development/python-modules/deluge-client/default.nix4
-rw-r--r--pkgs/development/python-modules/diff_cover/default.nix4
-rw-r--r--pkgs/development/python-modules/distributed/default.nix4
-rw-r--r--pkgs/development/python-modules/django-auth-ldap/default.nix4
-rw-r--r--pkgs/development/python-modules/django-configurations/default.nix4
-rw-r--r--pkgs/development/python-modules/django-cors-headers/default.nix4
-rw-r--r--pkgs/development/python-modules/django-multiselectfield/default.nix4
-rw-r--r--pkgs/development/python-modules/django-pglocks/default.nix4
-rw-r--r--pkgs/development/python-modules/django-versatileimagefield/default.nix4
-rw-r--r--pkgs/development/python-modules/django_contrib_comments/default.nix3
-rw-r--r--pkgs/development/python-modules/django_redis/default.nix4
-rw-r--r--pkgs/development/python-modules/django_taggit/default.nix4
-rw-r--r--pkgs/development/python-modules/django_treebeard/default.nix4
-rw-r--r--pkgs/development/python-modules/djangorestframework/default.nix8
-rw-r--r--pkgs/development/python-modules/dkimpy/default.nix4
-rw-r--r--pkgs/development/python-modules/dnslib/default.nix4
-rw-r--r--pkgs/development/python-modules/easy-thumbnails/default.nix4
-rw-r--r--pkgs/development/python-modules/easyprocess/default.nix4
-rw-r--r--pkgs/development/python-modules/ecdsa/default.nix6
-rw-r--r--pkgs/development/python-modules/effect/default.nix4
-rw-r--r--pkgs/development/python-modules/elasticsearch/default.nix4
-rw-r--r--pkgs/development/python-modules/ephem/default.nix2
-rw-r--r--pkgs/development/python-modules/eve/default.nix4
-rw-r--r--pkgs/development/python-modules/eyed3/default.nix4
-rw-r--r--pkgs/development/python-modules/faker/default.nix4
-rw-r--r--pkgs/development/python-modules/flask-api/default.nix4
-rw-r--r--pkgs/development/python-modules/flask-caching/default.nix8
-rw-r--r--pkgs/development/python-modules/fonttools/default.nix6
-rw-r--r--pkgs/development/python-modules/foolscap/default.nix4
-rw-r--r--pkgs/development/python-modules/fsspec/default.nix4
-rw-r--r--pkgs/development/python-modules/genanki/default.nix4
-rw-r--r--pkgs/development/python-modules/gidgethub/default.nix4
-rw-r--r--pkgs/development/python-modules/glom/default.nix4
-rw-r--r--pkgs/development/python-modules/google-music/default.nix4
-rw-r--r--pkgs/development/python-modules/google_api_core/default.nix4
-rw-r--r--pkgs/development/python-modules/google_cloud_asset/default.nix4
-rw-r--r--pkgs/development/python-modules/google_cloud_automl/default.nix4
-rw-r--r--pkgs/development/python-modules/google_cloud_bigquery/default.nix4
-rw-r--r--pkgs/development/python-modules/google_cloud_bigtable/default.nix4
-rw-r--r--pkgs/development/python-modules/google_cloud_core/default.nix4
-rw-r--r--pkgs/development/python-modules/google_cloud_dataproc/default.nix4
-rw-r--r--pkgs/development/python-modules/google_cloud_dlp/default.nix4
-rw-r--r--pkgs/development/python-modules/google_cloud_firestore/default.nix4
-rw-r--r--pkgs/development/python-modules/google_cloud_monitoring/default.nix4
-rw-r--r--pkgs/development/python-modules/google_cloud_pubsub/default.nix4
-rw-r--r--pkgs/development/python-modules/google_cloud_spanner/default.nix4
-rw-r--r--pkgs/development/python-modules/google_cloud_speech/default.nix4
-rw-r--r--pkgs/development/python-modules/google_cloud_storage/default.nix4
-rw-r--r--pkgs/development/python-modules/google_cloud_tasks/default.nix4
-rw-r--r--pkgs/development/python-modules/google_cloud_videointelligence/default.nix4
-rw-r--r--pkgs/development/python-modules/google_cloud_vision/default.nix4
-rw-r--r--pkgs/development/python-modules/google_resumable_media/default.nix4
-rw-r--r--pkgs/development/python-modules/gunicorn/default.nix7
-rw-r--r--pkgs/development/python-modules/gym/default.nix4
-rw-r--r--pkgs/development/python-modules/hmmlearn/default.nix4
-rw-r--r--pkgs/development/python-modules/holidays/default.nix4
-rw-r--r--pkgs/development/python-modules/html5lib/default.nix6
-rw-r--r--pkgs/development/python-modules/httplib2/default.nix4
-rw-r--r--pkgs/development/python-modules/hypothesis/default.nix2
-rw-r--r--pkgs/development/python-modules/identify/default.nix4
-rw-r--r--pkgs/development/python-modules/imbalanced-learn/default.nix4
-rw-r--r--pkgs/development/python-modules/importlib-metadata/default.nix7
-rw-r--r--pkgs/development/python-modules/inflect/default.nix10
-rw-r--r--pkgs/development/python-modules/intake/default.nix4
-rw-r--r--pkgs/development/python-modules/ipykernel/default.nix5
-rw-r--r--pkgs/development/python-modules/ipython/7.9.nix69
-rw-r--r--pkgs/development/python-modules/ipython/default.nix6
-rw-r--r--pkgs/development/python-modules/isbnlib/default.nix4
-rw-r--r--pkgs/development/python-modules/jaraco_classes/default.nix13
-rw-r--r--pkgs/development/python-modules/jaraco_stream/default.nix4
-rw-r--r--pkgs/development/python-modules/jedi/default.nix4
-rw-r--r--pkgs/development/python-modules/jsonschema/default.nix4
-rw-r--r--pkgs/development/python-modules/jupyter_console/default.nix7
-rw-r--r--pkgs/development/python-modules/jupyterlab/default.nix4
-rw-r--r--pkgs/development/python-modules/jupytext/default.nix4
-rw-r--r--pkgs/development/python-modules/kconfiglib/default.nix4
-rw-r--r--pkgs/development/python-modules/keyring/default.nix22
-rw-r--r--pkgs/development/python-modules/keyrings-alt/default.nix13
-rw-r--r--pkgs/development/python-modules/koji/default.nix2
-rw-r--r--pkgs/development/python-modules/labelbox/default.nix4
-rw-r--r--pkgs/development/python-modules/leveldb/default.nix2
-rw-r--r--pkgs/development/python-modules/libcloud/default.nix12
-rw-r--r--pkgs/development/python-modules/limits/default.nix4
-rw-r--r--pkgs/development/python-modules/limnoria/default.nix4
-rw-r--r--pkgs/development/python-modules/lmdb/default.nix4
-rw-r--r--pkgs/development/python-modules/lmtpd/default.nix4
-rw-r--r--pkgs/development/python-modules/logilab/common.nix7
-rw-r--r--pkgs/development/python-modules/loguru/default.nix4
-rw-r--r--pkgs/development/python-modules/m2crypto/default.nix2
-rw-r--r--pkgs/development/python-modules/magic-wormhole-mailbox-server/default.nix8
-rw-r--r--pkgs/development/python-modules/magic-wormhole/default.nix4
-rw-r--r--pkgs/development/python-modules/marionette-harness/mozdevice.nix3
-rw-r--r--pkgs/development/python-modules/marionette-harness/mozprofile.nix4
-rw-r--r--pkgs/development/python-modules/marshmallow-sqlalchemy/default.nix4
-rw-r--r--pkgs/development/python-modules/marshmallow/default.nix7
-rw-r--r--pkgs/development/python-modules/maxminddb/default.nix4
-rw-r--r--pkgs/development/python-modules/measurement/default.nix4
-rw-r--r--pkgs/development/python-modules/mecab-python3/default.nix4
-rw-r--r--pkgs/development/python-modules/mechanize/default.nix4
-rw-r--r--pkgs/development/python-modules/mlrose/default.nix4
-rw-r--r--pkgs/development/python-modules/mockito/default.nix9
-rw-r--r--pkgs/development/python-modules/monty/default.nix2
-rw-r--r--pkgs/development/python-modules/more-itertools/default.nix4
-rw-r--r--pkgs/development/python-modules/msrestazure/default.nix2
-rw-r--r--pkgs/development/python-modules/mt-940/default.nix4
-rw-r--r--pkgs/development/python-modules/multidict/default.nix4
-rw-r--r--pkgs/development/python-modules/munch/default.nix7
-rw-r--r--pkgs/development/python-modules/nameparser/default.nix4
-rw-r--r--pkgs/development/python-modules/natsort/default.nix7
-rw-r--r--pkgs/development/python-modules/nbsmoke/default.nix6
-rw-r--r--pkgs/development/python-modules/nbval/default.nix4
-rw-r--r--pkgs/development/python-modules/ncclient/default.nix4
-rw-r--r--pkgs/development/python-modules/nevow/default.nix12
-rw-r--r--pkgs/development/python-modules/nibabel/default.nix6
-rw-r--r--pkgs/development/python-modules/nilearn/default.nix4
-rw-r--r--pkgs/development/python-modules/nipype/default.nix4
-rw-r--r--pkgs/development/python-modules/numcodecs/default.nix2
-rw-r--r--pkgs/development/python-modules/numpydoc/default.nix4
-rw-r--r--pkgs/development/python-modules/oauthenticator/default.nix4
-rw-r--r--pkgs/development/python-modules/optuna/default.nix27
-rw-r--r--pkgs/development/python-modules/panel/default.nix4
-rw-r--r--pkgs/development/python-modules/paramiko/default.nix12
-rw-r--r--pkgs/development/python-modules/parsedatetime/default.nix4
-rw-r--r--pkgs/development/python-modules/parso/default.nix4
-rw-r--r--pkgs/development/python-modules/partd/default.nix8
-rw-r--r--pkgs/development/python-modules/pep8-naming/default.nix4
-rw-r--r--pkgs/development/python-modules/pex/default.nix4
-rw-r--r--pkgs/development/python-modules/pglast/default.nix4
-rw-r--r--pkgs/development/python-modules/phonenumbers/default.nix4
-rw-r--r--pkgs/development/python-modules/phonopy/default.nix4
-rw-r--r--pkgs/development/python-modules/pipdate/default.nix4
-rw-r--r--pkgs/development/python-modules/pivy/default.nix2
-rw-r--r--pkgs/development/python-modules/plone-testing/default.nix4
-rw-r--r--pkgs/development/python-modules/plotly/default.nix4
-rw-r--r--pkgs/development/python-modules/portend/default.nix8
-rw-r--r--pkgs/development/python-modules/ppft/default.nix7
-rw-r--r--pkgs/development/python-modules/prance/default.nix4
-rw-r--r--pkgs/development/python-modules/protobuf/default.nix5
-rw-r--r--pkgs/development/python-modules/psd-tools/default.nix26
-rw-r--r--pkgs/development/python-modules/pulp/default.nix4
-rw-r--r--pkgs/development/python-modules/purepng/default.nix2
-rw-r--r--pkgs/development/python-modules/pvlib/default.nix4
-rw-r--r--pkgs/development/python-modules/py/default.nix4
-rw-r--r--pkgs/development/python-modules/py3status/default.nix4
-rw-r--r--pkgs/development/python-modules/pyaml/default.nix4
-rw-r--r--pkgs/development/python-modules/pyatmo/default.nix4
-rw-r--r--pkgs/development/python-modules/pybids/default.nix4
-rw-r--r--pkgs/development/python-modules/pybind11/0001-Find-include-directory.patch53
-rw-r--r--pkgs/development/python-modules/pybind11/default.nix12
-rw-r--r--pkgs/development/python-modules/pybullet/default.nix4
-rw-r--r--pkgs/development/python-modules/pycares/default.nix4
-rw-r--r--pkgs/development/python-modules/pycurl/default.nix2
-rw-r--r--pkgs/development/python-modules/pyelftools/default.nix4
-rw-r--r--pkgs/development/python-modules/pyfakefs/default.nix8
-rw-r--r--pkgs/development/python-modules/pykeepass/default.nix4
-rw-r--r--pkgs/development/python-modules/pymatgen/default.nix4
-rw-r--r--pkgs/development/python-modules/pymavlink/default.nix4
-rw-r--r--pkgs/development/python-modules/pymc3/default.nix4
-rw-r--r--pkgs/development/python-modules/pymongo/default.nix4
-rw-r--r--pkgs/development/python-modules/pymssql/default.nix4
-rw-r--r--pkgs/development/python-modules/pymupdf/default.nix4
-rw-r--r--pkgs/development/python-modules/pyobjc/default.nix4
-rw-r--r--pkgs/development/python-modules/pyodbc/default.nix4
-rw-r--r--pkgs/development/python-modules/pyopenssl/default.nix4
-rw-r--r--pkgs/development/python-modules/pyparsing/default.nix4
-rw-r--r--pkgs/development/python-modules/pyperf/default.nix4
-rw-r--r--pkgs/development/python-modules/pyro-ppl/default.nix4
-rw-r--r--pkgs/development/python-modules/pyscreenshot/default.nix4
-rw-r--r--pkgs/development/python-modules/pyside/default.nix2
-rw-r--r--pkgs/development/python-modules/pysocks/default.nix4
-rw-r--r--pkgs/development/python-modules/pytest-django/default.nix4
-rw-r--r--pkgs/development/python-modules/pytest-doctestplus/default.nix4
-rw-r--r--pkgs/development/python-modules/pytest-mock/default.nix4
-rw-r--r--pkgs/development/python-modules/pytest-mpl/default.nix6
-rw-r--r--pkgs/development/python-modules/pytest-qt/default.nix4
-rw-r--r--pkgs/development/python-modules/pytest-services/default.nix6
-rw-r--r--pkgs/development/python-modules/pytest-testmon/default.nix11
-rw-r--r--pkgs/development/python-modules/pytest/4.nix4
-rw-r--r--pkgs/development/python-modules/pytest/default.nix4
-rw-r--r--pkgs/development/python-modules/pytestrunner/default.nix4
-rw-r--r--pkgs/development/python-modules/python-gitlab/default.nix4
-rw-r--r--pkgs/development/python-modules/python-rapidjson/default.nix4
-rw-r--r--pkgs/development/python-modules/python-redis-lock/default.nix4
-rw-r--r--pkgs/development/python-modules/python-socketio/default.nix4
-rw-r--r--pkgs/development/python-modules/python-uinput/default.nix2
-rw-r--r--pkgs/development/python-modules/python2-pythondialog/default.nix4
-rw-r--r--pkgs/development/python-modules/pythondialog/default.nix4
-rw-r--r--pkgs/development/python-modules/pythonirclib/default.nix2
-rw-r--r--pkgs/development/python-modules/pyunifi/default.nix4
-rw-r--r--pkgs/development/python-modules/pyvcd/default.nix4
-rw-r--r--pkgs/development/python-modules/pywbem/default.nix4
-rw-r--r--pkgs/development/python-modules/pywinrm/default.nix4
-rw-r--r--pkgs/development/python-modules/pyxattr/default.nix4
-rw-r--r--pkgs/development/python-modules/pyxl3/default.nix4
-rw-r--r--pkgs/development/python-modules/pyyaml/default.nix4
-rw-r--r--pkgs/development/python-modules/qimage2ndarray/default.nix4
-rw-r--r--pkgs/development/python-modules/qiskit/default.nix4
-rw-r--r--pkgs/development/python-modules/qtconsole/default.nix4
-rw-r--r--pkgs/development/python-modules/rainbowstream/default.nix4
-rw-r--r--pkgs/development/python-modules/readme_renderer/default.nix3
-rw-r--r--pkgs/development/python-modules/regex/default.nix4
-rw-r--r--pkgs/development/python-modules/remotecv/default.nix1
-rw-r--r--pkgs/development/python-modules/responses/default.nix4
-rw-r--r--pkgs/development/python-modules/rlp/default.nix4
-rw-r--r--pkgs/development/python-modules/rpy2/default.nix4
-rw-r--r--pkgs/development/python-modules/runway-python/default.nix4
-rw-r--r--pkgs/development/python-modules/s3fs/default.nix4
-rw-r--r--pkgs/development/python-modules/scapy/default.nix14
-rw-r--r--pkgs/development/python-modules/scipy/default.nix23
-rw-r--r--pkgs/development/python-modules/scrapy/default.nix4
-rw-r--r--pkgs/development/python-modules/semantic-version/default.nix4
-rw-r--r--pkgs/development/python-modules/shodan/default.nix4
-rw-r--r--pkgs/development/python-modules/simplejson/default.nix4
-rw-r--r--pkgs/development/python-modules/six/default.nix4
-rw-r--r--pkgs/development/python-modules/slicedimage/default.nix4
-rw-r--r--pkgs/development/python-modules/slither-analyzer/default.nix4
-rw-r--r--pkgs/development/python-modules/solo-python/default.nix1
-rw-r--r--pkgs/development/python-modules/sparqlwrapper/default.nix4
-rw-r--r--pkgs/development/python-modules/sphinx/default.nix6
-rw-r--r--pkgs/development/python-modules/sphinxcontrib-blockdiag/default.nix4
-rw-r--r--pkgs/development/python-modules/splinter/default.nix4
-rw-r--r--pkgs/development/python-modules/spyder-kernels/default.nix4
-rw-r--r--pkgs/development/python-modules/spyder/default.nix4
-rw-r--r--pkgs/development/python-modules/sqlalchemy-utils/default.nix4
-rw-r--r--pkgs/development/python-modules/sqlobject/default.nix4
-rw-r--r--pkgs/development/python-modules/squaremap/default.nix10
-rw-r--r--pkgs/development/python-modules/starfish/default.nix4
-rw-r--r--pkgs/development/python-modules/starlette/default.nix12
-rw-r--r--pkgs/development/python-modules/stripe/default.nix4
-rw-r--r--pkgs/development/python-modules/svg-path/default.nix4
-rw-r--r--pkgs/development/python-modules/tblib/default.nix4
-rw-r--r--pkgs/development/python-modules/tenacity/default.nix4
-rw-r--r--pkgs/development/python-modules/tensorflow/default.nix2
-rw-r--r--pkgs/development/python-modules/thrift/default.nix4
-rw-r--r--pkgs/development/python-modules/tifffile/default.nix4
-rw-r--r--pkgs/development/python-modules/tld/default.nix4
-rw-r--r--pkgs/development/python-modules/tox/default.nix4
-rw-r--r--pkgs/development/python-modules/transaction/default.nix4
-rw-r--r--pkgs/development/python-modules/treq/default.nix4
-rw-r--r--pkgs/development/python-modules/trio/default.nix4
-rw-r--r--pkgs/development/python-modules/trustme/default.nix4
-rw-r--r--pkgs/development/python-modules/twine/default.nix27
-rw-r--r--pkgs/development/python-modules/twisted/default.nix4
-rw-r--r--pkgs/development/python-modules/txtorcon/default.nix2
-rw-r--r--pkgs/development/python-modules/typeguard/default.nix4
-rw-r--r--pkgs/development/python-modules/uamqp/default.nix4
-rw-r--r--pkgs/development/python-modules/uncompyle6/default.nix4
-rw-r--r--pkgs/development/python-modules/uproot-methods/default.nix4
-rw-r--r--pkgs/development/python-modules/uproot/default.nix9
-rw-r--r--pkgs/development/python-modules/uritemplate/default.nix4
-rw-r--r--pkgs/development/python-modules/uritools/default.nix9
-rw-r--r--pkgs/development/python-modules/urwid/default.nix10
-rw-r--r--pkgs/development/python-modules/urwidtrees/default.nix4
-rw-r--r--pkgs/development/python-modules/vcrpy/default.nix4
-rw-r--r--pkgs/development/python-modules/vega_datasets/default.nix4
-rw-r--r--pkgs/development/python-modules/venusian/default.nix7
-rw-r--r--pkgs/development/python-modules/virtual-display/default.nix4
-rw-r--r--pkgs/development/python-modules/virtualenv/default.nix4
-rw-r--r--pkgs/development/python-modules/vowpalwabbit/default.nix4
-rw-r--r--pkgs/development/python-modules/whitenoise/default.nix7
-rw-r--r--pkgs/development/python-modules/xdis/default.nix6
-rw-r--r--pkgs/development/python-modules/xml2rfc/default.nix4
-rw-r--r--pkgs/development/python-modules/yapf/default.nix4
-rw-r--r--pkgs/development/python-modules/yappi/default.nix4
-rw-r--r--pkgs/development/python-modules/yarl/default.nix4
-rw-r--r--pkgs/development/python-modules/yubico-client/default.nix4
-rw-r--r--pkgs/development/python-modules/zeroconf/default.nix4
-rw-r--r--pkgs/development/python-modules/zha-quirks/default.nix4
-rw-r--r--pkgs/development/python-modules/zm-py/default.nix4
-rw-r--r--pkgs/development/python-modules/zope_component/default.nix4
-rw-r--r--pkgs/development/python-modules/zope_contenttype/default.nix4
-rw-r--r--pkgs/development/python-modules/zope_i18nmessageid/default.nix4
-rw-r--r--pkgs/development/python-modules/zope_interface/default.nix4
-rw-r--r--pkgs/development/ruby-modules/gem-config/default.nix24
-rw-r--r--pkgs/development/tools/analysis/ikos/default.nix2
-rw-r--r--pkgs/development/tools/build-managers/cmake/application-services.patch4
-rw-r--r--pkgs/development/tools/build-managers/cmake/default.nix12
-rw-r--r--pkgs/development/tools/build-managers/cmake/libuv-application-services.patch4
-rwxr-xr-xpkgs/development/tools/build-managers/cmake/setup-hook.sh4
-rw-r--r--pkgs/development/tools/build-managers/gnumake/4.2/default.nix2
-rw-r--r--pkgs/development/tools/build-managers/scons/default.nix4
-rw-r--r--pkgs/development/tools/database/pgcli/default.nix5
-rw-r--r--pkgs/development/tools/database/sqlitebrowser/default.nix4
-rw-r--r--pkgs/development/tools/devpi-server/default.nix5
-rw-r--r--pkgs/development/tools/diesel-cli/default.nix2
-rw-r--r--pkgs/development/tools/documentation/doxygen/default.nix2
-rw-r--r--pkgs/development/tools/erlang/cuter/default.nix2
-rw-r--r--pkgs/development/tools/imatix_gsl/default.nix2
-rw-r--r--pkgs/development/tools/literate-programming/noweb/default.nix4
-rw-r--r--pkgs/development/tools/misc/ddd/default.nix2
-rw-r--r--pkgs/development/tools/misc/dialog/default.nix2
-rw-r--r--pkgs/development/tools/misc/doclifter/default.nix2
-rw-r--r--pkgs/development/tools/misc/hydra/default.nix2
-rw-r--r--pkgs/development/tools/misc/intel-gpu-tools/default.nix2
-rw-r--r--pkgs/development/tools/misc/openocd/default.nix5
-rw-r--r--pkgs/development/tools/misc/sipp/default.nix18
-rw-r--r--pkgs/development/tools/misc/sloccount/default.nix2
-rw-r--r--pkgs/development/tools/misc/srecord/default.nix4
-rw-r--r--pkgs/development/tools/misc/texinfo/common.nix6
-rw-r--r--pkgs/development/tools/misc/trv/default.nix2
-rw-r--r--pkgs/development/tools/misc/watson-ruby/default.nix17
-rw-r--r--pkgs/development/tools/nrpl/default.nix4
-rw-r--r--pkgs/development/tools/nsis/default.nix2
-rw-r--r--pkgs/development/tools/ocaml/camlp4/default.nix4
-rw-r--r--pkgs/development/tools/ocaml/camlp5/default.nix2
-rw-r--r--pkgs/development/tools/ocaml/cppo/default.nix2
-rw-r--r--pkgs/development/tools/ocaml/dune/default.nix2
-rw-r--r--pkgs/development/tools/ocaml/ocamlscript/default.nix4
-rw-r--r--pkgs/development/tools/ocaml/omake/0.9.8.6-rc1.nix4
-rw-r--r--pkgs/development/tools/parsing/ragel/default.nix2
-rw-r--r--pkgs/development/tools/simavr/default.nix2
-rw-r--r--pkgs/development/tools/spirv-tools/default.nix9
-rw-r--r--pkgs/development/tools/sslmate/default.nix2
-rw-r--r--pkgs/development/tools/stagit/default.nix2
-rw-r--r--pkgs/development/tools/tora/default.nix9
-rw-r--r--pkgs/development/tools/tychus/default.nix2
-rw-r--r--pkgs/development/web/wml/default.nix2
-rw-r--r--pkgs/games/0ad/game.nix2
-rw-r--r--pkgs/games/airstrike/default.nix4
-rw-r--r--pkgs/games/angband/default.nix2
-rw-r--r--pkgs/games/armagetronad/default.nix2
-rw-r--r--pkgs/games/cataclysm-dda/default.nix2
-rw-r--r--pkgs/games/eboard/default.nix7
-rw-r--r--pkgs/games/eduke32/default.nix5
-rw-r--r--pkgs/games/egoboo/default.nix4
-rw-r--r--pkgs/games/exult/default.nix2
-rw-r--r--pkgs/games/globulation/default.nix4
-rw-r--r--pkgs/games/gmad/default.nix2
-rw-r--r--pkgs/games/gnujump/default.nix4
-rw-r--r--pkgs/games/gzdoom/default.nix2
-rw-r--r--pkgs/games/macopix/default.nix2
-rw-r--r--pkgs/games/minetest/default.nix4
-rw-r--r--pkgs/games/onscripter-en/default.nix2
-rw-r--r--pkgs/games/opendungeons/default.nix4
-rw-r--r--pkgs/games/openra/common.nix2
-rw-r--r--pkgs/games/openspades/default.nix2
-rw-r--r--pkgs/games/openttd/default.nix2
-rw-r--r--pkgs/games/pingus/default.nix2
-rw-r--r--pkgs/games/pokerth/default.nix2
-rw-r--r--pkgs/games/rogue/default.nix2
-rw-r--r--pkgs/games/scorched3d/default.nix2
-rw-r--r--pkgs/games/stockfish/default.nix2
-rw-r--r--pkgs/games/tdm/default.nix2
-rw-r--r--pkgs/games/tome4/default.nix6
-rw-r--r--pkgs/games/tremulous/default.nix2
-rw-r--r--pkgs/games/vitetris/default.nix2
-rw-r--r--pkgs/games/xbill/default.nix2
-rw-r--r--pkgs/games/xpilot/bloodspilot-client.nix2
-rw-r--r--pkgs/games/xskat/default.nix2
-rw-r--r--pkgs/games/zoom/default.nix12
-rw-r--r--pkgs/misc/beep/default.nix2
-rw-r--r--pkgs/misc/cups/drivers/cups-bjnp/default.nix2
-rw-r--r--pkgs/misc/drivers/epkowa/default.nix2
-rw-r--r--pkgs/misc/drivers/foomatic-filters/default.nix11
-rw-r--r--pkgs/misc/drivers/utsushi/default.nix6
-rw-r--r--pkgs/misc/drivers/xboxdrv/default.nix2
-rw-r--r--pkgs/misc/emulators/blastem/default.nix2
-rw-r--r--pkgs/misc/emulators/citra/default.nix8
-rw-r--r--pkgs/misc/emulators/dlx/default.nix2
-rw-r--r--pkgs/misc/emulators/emulationstation/default.nix17
-rw-r--r--pkgs/misc/emulators/hatari/default.nix2
-rw-r--r--pkgs/misc/emulators/retroarch/cores.nix2
-rw-r--r--pkgs/misc/emulators/retroarch/default.nix4
-rw-r--r--pkgs/misc/emulators/wine/base.nix4
-rw-r--r--pkgs/misc/ghostscript/default.nix18
-rw-r--r--pkgs/misc/screensavers/slock/default.nix2
-rw-r--r--pkgs/misc/screensavers/xautolock/default.nix2
-rw-r--r--pkgs/misc/uboot/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-sdk/default.nix9
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/PowerManagement/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Security/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/dtrace/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/libutil/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix4
-rw-r--r--pkgs/os-specific/darwin/libtapi/default.nix2
-rw-r--r--pkgs/os-specific/darwin/reattach-to-user-namespace/default.nix2
-rw-r--r--pkgs/os-specific/linux/alsa-oss/default.nix2
-rw-r--r--pkgs/os-specific/linux/alsa-utils/default.nix2
-rw-r--r--pkgs/os-specific/linux/brillo/default.nix2
-rw-r--r--pkgs/os-specific/linux/broadcom-sta/default.nix2
-rw-r--r--pkgs/os-specific/linux/cifs-utils/default.nix2
-rw-r--r--pkgs/os-specific/linux/consoletools/default.nix2
-rw-r--r--pkgs/os-specific/linux/dmidecode/default.nix2
-rw-r--r--pkgs/os-specific/linux/drbd/default.nix8
-rw-r--r--pkgs/os-specific/linux/dropwatch/default.nix5
-rw-r--r--pkgs/os-specific/linux/extrace/default.nix2
-rw-r--r--pkgs/os-specific/linux/firmware/fwupdate/default.nix2
-rw-r--r--pkgs/os-specific/linux/jool/cli.nix2
-rw-r--r--pkgs/os-specific/linux/kernel/perf.nix19
-rw-r--r--pkgs/os-specific/linux/ldm/default.nix2
-rw-r--r--pkgs/os-specific/linux/libaio/default.nix4
-rw-r--r--pkgs/os-specific/linux/libcap/default.nix2
-rw-r--r--pkgs/os-specific/linux/libselinux/default.nix2
-rw-r--r--pkgs/os-specific/linux/libsepol/default.nix2
-rw-r--r--pkgs/os-specific/linux/lttng-modules/default.nix2
-rw-r--r--pkgs/os-specific/linux/lvm2/default.nix2
-rw-r--r--pkgs/os-specific/linux/mmc-utils/default.nix2
-rw-r--r--pkgs/os-specific/linux/mstpd/default.nix14
-rw-r--r--pkgs/os-specific/linux/numad/default.nix2
-rw-r--r--pkgs/os-specific/linux/nvme-cli/default.nix2
-rw-r--r--pkgs/os-specific/linux/open-isns/default.nix4
-rw-r--r--pkgs/os-specific/linux/pam_mount/default.nix2
-rw-r--r--pkgs/os-specific/linux/paxtest/default.nix2
-rw-r--r--pkgs/os-specific/linux/pcmciautils/default.nix4
-rw-r--r--pkgs/os-specific/linux/pktgen/default.nix2
-rw-r--r--pkgs/os-specific/linux/procps-ng/default.nix4
-rw-r--r--pkgs/os-specific/linux/rdma-core/default.nix4
-rw-r--r--pkgs/os-specific/linux/rfkill/default.nix2
-rw-r--r--pkgs/os-specific/linux/rtkit/default.nix2
-rw-r--r--pkgs/os-specific/linux/rtl8192eu/default.nix2
-rw-r--r--pkgs/os-specific/linux/rtl8723bs/default.nix2
-rw-r--r--pkgs/os-specific/linux/rtlwifi_new/default.nix2
-rw-r--r--pkgs/os-specific/linux/sysdig/default.nix7
-rw-r--r--pkgs/os-specific/linux/sysklogd/default.nix2
-rw-r--r--pkgs/os-specific/linux/sysstat/default.nix4
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix20
-rw-r--r--pkgs/os-specific/linux/tiptop/default.nix2
-rw-r--r--pkgs/os-specific/linux/untie/default.nix2
-rw-r--r--pkgs/os-specific/linux/usbip/default.nix8
-rw-r--r--pkgs/os-specific/linux/usbip/fix-strncpy-truncation.patch37
-rw-r--r--pkgs/os-specific/linux/usermount/default.nix2
-rw-r--r--pkgs/os-specific/windows/jom/default.nix2
-rw-r--r--pkgs/servers/amqp/qpid-cpp/default.nix10
-rw-r--r--pkgs/servers/amqp/rabbitmq-server/default.nix4
-rw-r--r--pkgs/servers/computing/torque/default.nix4
-rw-r--r--pkgs/servers/fileshare/default.nix2
-rw-r--r--pkgs/servers/gpsd/default.nix2
-rw-r--r--pkgs/servers/http/apache-httpd/2.4.nix5
-rw-r--r--pkgs/servers/http/apache-modules/mod_python/default.nix3
-rw-r--r--pkgs/servers/http/nginx/generic.nix10
-rw-r--r--pkgs/servers/http/openresty/default.nix2
-rw-r--r--pkgs/servers/http/tengine/default.nix16
-rw-r--r--pkgs/servers/http/unit/default.nix6
-rw-r--r--pkgs/servers/mail/archiveopteryx/default.nix5
-rw-r--r--pkgs/servers/mail/opensmtpd/extras.nix21
-rw-r--r--pkgs/servers/mail/postfix/default.nix2
-rw-r--r--pkgs/servers/mail/postfix/pfixtools.nix7
-rw-r--r--pkgs/servers/mail/spamassassin/default.nix4
-rw-r--r--pkgs/servers/monitoring/munin/default.nix20
-rw-r--r--pkgs/servers/monitoring/nagios/default.nix2
-rw-r--r--pkgs/servers/nosql/aerospike/default.nix7
-rw-r--r--pkgs/servers/nosql/arangodb/default.nix2
-rw-r--r--pkgs/servers/nosql/mongodb/default.nix2
-rw-r--r--pkgs/servers/nosql/redis/default.nix3
-rw-r--r--pkgs/servers/osrm-backend/default.nix2
-rw-r--r--pkgs/servers/sql/cockroachdb/default.nix6
-rw-r--r--pkgs/servers/sql/percona/5.6.x.nix1
-rw-r--r--pkgs/servers/sql/postgresql/default.nix2
-rw-r--r--pkgs/servers/tvheadend/default.nix2
-rw-r--r--pkgs/servers/uhub/default.nix8
-rw-r--r--pkgs/servers/uwsgi/default.nix2
-rw-r--r--pkgs/servers/varnish/default.nix2
-rw-r--r--pkgs/servers/web-apps/fileshelter/default.nix4
-rw-r--r--pkgs/servers/x11/xorg/overrides.nix48
-rw-r--r--pkgs/shells/bash/4.4.nix2
-rw-r--r--pkgs/shells/bash/5.0.nix2
-rw-r--r--pkgs/shells/ksh/default.nix18
-rw-r--r--pkgs/shells/zsh/grml-zsh-config/default.nix2
-rw-r--r--pkgs/shells/zsh/zsh-syntax-highlighting/default.nix2
-rw-r--r--pkgs/tools/X11/hsetroot/default.nix2
-rw-r--r--pkgs/tools/X11/setroot/default.nix4
-rw-r--r--pkgs/tools/X11/srandrd/default.nix2
-rw-r--r--pkgs/tools/X11/xbrightness/default.nix2
-rw-r--r--pkgs/tools/X11/xcwd/default.nix2
-rw-r--r--pkgs/tools/X11/xdotool/default.nix2
-rw-r--r--pkgs/tools/X11/xnee/default.nix2
-rw-r--r--pkgs/tools/X11/xpointerbarrier/default.nix2
-rw-r--r--pkgs/tools/X11/xpra/default.nix4
-rw-r--r--pkgs/tools/X11/xzoom/default.nix2
-rw-r--r--pkgs/tools/admin/aws_shell/default.nix5
-rw-r--r--pkgs/tools/admin/awscli/default.nix22
-rw-r--r--pkgs/tools/admin/azure-cli/default.nix4
-rw-r--r--pkgs/tools/admin/azure-cli/python-packages.nix31
-rw-r--r--pkgs/tools/admin/bubblewrap/default.nix4
-rw-r--r--pkgs/tools/admin/fastlane/default.nix14
-rw-r--r--pkgs/tools/admin/salt/default.nix2
-rw-r--r--pkgs/tools/archivers/afio/default.nix2
-rw-r--r--pkgs/tools/archivers/undmg/default.nix2
-rw-r--r--pkgs/tools/archivers/unzip/default.nix14
-rw-r--r--pkgs/tools/archivers/zip/default.nix7
-rw-r--r--pkgs/tools/audio/gvolicon/default.nix2
-rw-r--r--pkgs/tools/audio/trx/default.nix15
-rw-r--r--pkgs/tools/backup/lvmsync/default.nix25
-rw-r--r--pkgs/tools/cd-dvd/cdrdao/default.nix2
-rw-r--r--pkgs/tools/cd-dvd/cdrkit/default.nix2
-rw-r--r--pkgs/tools/cd-dvd/isomd5sum/default.nix2
-rw-r--r--pkgs/tools/cd-dvd/vobcopy/default.nix2
-rw-r--r--pkgs/tools/compression/pbzip2/default.nix2
-rw-r--r--pkgs/tools/filesystems/bees/default.nix4
-rw-r--r--pkgs/tools/filesystems/blobfuse/default.nix2
-rw-r--r--pkgs/tools/filesystems/ciopfs/default.nix2
-rw-r--r--pkgs/tools/filesystems/glusterfs/default.nix2
-rw-r--r--pkgs/tools/filesystems/irods/default.nix7
-rw-r--r--pkgs/tools/filesystems/nixpart/0.4/lvm2.nix2
-rw-r--r--pkgs/tools/filesystems/sasquatch/default.nix2
-rw-r--r--pkgs/tools/filesystems/squashfs/default.nix2
-rw-r--r--pkgs/tools/filesystems/sshfs-fuse/default.nix2
-rw-r--r--pkgs/tools/graphics/appleseed/default.nix3
-rw-r--r--pkgs/tools/graphics/argyllcms/default.nix6
-rw-r--r--pkgs/tools/graphics/asymptote/default.nix2
-rw-r--r--pkgs/tools/graphics/dpic/default.nix2
-rw-r--r--pkgs/tools/graphics/fim/default.nix2
-rw-r--r--pkgs/tools/graphics/gifsicle/default.nix7
-rw-r--r--pkgs/tools/graphics/graphviz/base.nix2
-rw-r--r--pkgs/tools/graphics/kst/default.nix2
-rw-r--r--pkgs/tools/graphics/pfstools/default.nix4
-rw-r--r--pkgs/tools/graphics/pngcheck/default.nix2
-rw-r--r--pkgs/tools/graphics/quirc/default.nix2
-rw-r--r--pkgs/tools/graphics/zbar/default.nix2
-rw-r--r--pkgs/tools/misc/automirror/default.nix2
-rw-r--r--pkgs/tools/misc/bibtool/default.nix2
-rw-r--r--pkgs/tools/misc/bonfire/default.nix7
-rw-r--r--pkgs/tools/misc/dylibbundler/default.nix2
-rw-r--r--pkgs/tools/misc/fdupes/default.nix2
-rw-r--r--pkgs/tools/misc/file/default.nix3
-rw-r--r--pkgs/tools/misc/fondu/default.nix2
-rw-r--r--pkgs/tools/misc/fontforge/default.nix2
-rw-r--r--pkgs/tools/misc/fzy/default.nix2
-rw-r--r--pkgs/tools/misc/ldmtool/default.nix52
-rw-r--r--pkgs/tools/misc/lf/default.nix4
-rw-r--r--pkgs/tools/misc/memtest86+/default.nix2
-rw-r--r--pkgs/tools/misc/mktorrent/default.nix10
-rw-r--r--pkgs/tools/misc/moreutils/default.nix4
-rw-r--r--pkgs/tools/misc/multitail/default.nix2
-rw-r--r--pkgs/tools/misc/osm2pgsql/default.nix2
-rw-r--r--pkgs/tools/misc/pal/default.nix2
-rw-r--r--pkgs/tools/misc/parcellite/default.nix2
-rw-r--r--pkgs/tools/misc/pws/default.nix18
-rw-r--r--pkgs/tools/misc/qjoypad/default.nix2
-rw-r--r--pkgs/tools/misc/snapper/default.nix4
-rw-r--r--pkgs/tools/misc/svtplay-dl/default.nix2
-rw-r--r--pkgs/tools/misc/teleconsole/default.nix2
-rw-r--r--pkgs/tools/misc/timidity/default.nix2
-rw-r--r--pkgs/tools/misc/tmpwatch/default.nix2
-rw-r--r--pkgs/tools/misc/toybox/default.nix2
-rw-r--r--pkgs/tools/misc/tty-clock/default.nix2
-rw-r--r--pkgs/tools/misc/vmtouch/default.nix2
-rw-r--r--pkgs/tools/misc/wyrd/default.nix2
-rw-r--r--pkgs/tools/misc/xdo/default.nix2
-rw-r--r--pkgs/tools/misc/xsel/default.nix6
-rw-r--r--pkgs/tools/networking/altermime/default.nix3
-rw-r--r--pkgs/tools/networking/atinout/default.nix2
-rw-r--r--pkgs/tools/networking/bwm-ng/default.nix4
-rw-r--r--pkgs/tools/networking/chrony/default.nix2
-rw-r--r--pkgs/tools/networking/cjdns/default.nix2
-rw-r--r--pkgs/tools/networking/dhcp/default.nix8
-rw-r--r--pkgs/tools/networking/iodine/default.nix2
-rw-r--r--pkgs/tools/networking/ipv6calc/default.nix10
-rw-r--r--pkgs/tools/networking/libreswan/default.nix3
-rw-r--r--pkgs/tools/networking/maphosts/default.nix6
-rw-r--r--pkgs/tools/networking/network-manager/iodine/default.nix2
-rw-r--r--pkgs/tools/networking/network-manager/strongswan.nix2
-rw-r--r--pkgs/tools/networking/nfstrace/default.nix4
-rw-r--r--pkgs/tools/networking/ntopng/default.nix4
-rw-r--r--pkgs/tools/networking/openresolv/default.nix2
-rw-r--r--pkgs/tools/networking/packetdrill/default.nix6
-rw-r--r--pkgs/tools/networking/ratools/default.nix2
-rw-r--r--pkgs/tools/networking/shadowfox/default.nix2
-rw-r--r--pkgs/tools/networking/snabb/default.nix2
-rw-r--r--pkgs/tools/networking/ssmtp/default.nix4
-rw-r--r--pkgs/tools/networking/tracebox/default.nix2
-rw-r--r--pkgs/tools/networking/traceroute/default.nix2
-rw-r--r--pkgs/tools/networking/vde2/default.nix2
-rw-r--r--pkgs/tools/networking/wrk/default.nix6
-rw-r--r--pkgs/tools/package-management/clib/default.nix2
-rw-r--r--pkgs/tools/package-management/nix/default.nix4
-rw-r--r--pkgs/tools/package-management/xbps/default.nix2
-rw-r--r--pkgs/tools/security/aws-okta/default.nix2
-rw-r--r--pkgs/tools/security/crunch/default.nix2
-rw-r--r--pkgs/tools/security/fwknop/default.nix4
-rw-r--r--pkgs/tools/security/gpgstats/default.nix4
-rw-r--r--pkgs/tools/security/meo/default.nix2
-rw-r--r--pkgs/tools/security/monkeysphere/default.nix8
-rw-r--r--pkgs/tools/security/nitrokey-app/default.nix2
-rw-r--r--pkgs/tools/security/pass/extensions/genphrase.nix2
-rw-r--r--pkgs/tools/security/pbis/default.nix2
-rw-r--r--pkgs/tools/security/phrasendrescher/default.nix2
-rw-r--r--pkgs/tools/security/rarcrack/default.nix4
-rw-r--r--pkgs/tools/security/rhash/default.nix7
-rw-r--r--pkgs/tools/security/sudo/default.nix10
-rw-r--r--pkgs/tools/security/super/default.nix2
-rw-r--r--pkgs/tools/security/tboot/default.nix4
-rw-r--r--pkgs/tools/system/clinfo/default.nix2
-rw-r--r--pkgs/tools/system/daemon/default.nix2
-rw-r--r--pkgs/tools/system/efivar/default.nix10
-rw-r--r--pkgs/tools/system/facter/default.nix4
-rw-r--r--pkgs/tools/system/fcron/default.nix2
-rw-r--r--pkgs/tools/system/gdmap/default.nix4
-rw-r--r--pkgs/tools/system/ioping/default.nix2
-rw-r--r--pkgs/tools/system/lr/default.nix2
-rw-r--r--pkgs/tools/system/netdata/default.nix2
-rw-r--r--pkgs/tools/system/nq/default.nix2
-rw-r--r--pkgs/tools/system/opencl-info/default.nix2
-rw-r--r--pkgs/tools/system/pciutils/default.nix2
-rw-r--r--pkgs/tools/system/rowhammer-test/default.nix2
-rw-r--r--pkgs/tools/system/rsyslog/default.nix4
-rw-r--r--pkgs/tools/system/setserial/default.nix2
-rw-r--r--pkgs/tools/system/stress-ng/default.nix2
-rw-r--r--pkgs/tools/system/testdisk/default.nix2
-rw-r--r--pkgs/tools/system/vboot_reference/default.nix3
-rw-r--r--pkgs/tools/system/xe/default.nix2
-rw-r--r--pkgs/tools/text/ansifilter/default.nix2
-rw-r--r--pkgs/tools/text/gawk/default.nix4
-rw-r--r--pkgs/tools/text/mdcat/default.nix2
-rw-r--r--pkgs/tools/text/multitran/libmtquery/default.nix4
-rw-r--r--pkgs/tools/text/reckon/default.nix14
-rw-r--r--pkgs/tools/text/replace/default.nix2
-rw-r--r--pkgs/tools/text/sgml/jade/default.nix2
-rw-r--r--pkgs/tools/text/untex/default.nix4
-rw-r--r--pkgs/tools/text/zimreader/default.nix2
-rw-r--r--pkgs/tools/typesetting/asciidoc/default.nix2
-rw-r--r--pkgs/tools/typesetting/hevea/default.nix2
-rw-r--r--pkgs/tools/video/mjpegtools/default.nix2
-rw-r--r--pkgs/tools/video/vncrec/default.nix2
-rw-r--r--pkgs/tools/video/yamdi/default.nix2
-rw-r--r--pkgs/top-level/all-packages.nix126
-rw-r--r--pkgs/top-level/perl-packages.nix8
-rw-r--r--pkgs/top-level/python-packages.nix16
1210 files changed, 3500 insertions, 4224 deletions
diff --git a/doc/languages-frameworks/go.xml b/doc/languages-frameworks/go.xml
index 53c891e66f8..e8cf27d0565 100644
--- a/doc/languages-frameworks/go.xml
+++ b/doc/languages-frameworks/go.xml
@@ -103,7 +103,7 @@ deis = buildGoPackage rec {
 
   goDeps = ./deps.nix; <co xml:id='ex-buildGoPackage-3' />
 
-  buildFlags = "--tags release"; <co xml:id='ex-buildGoPackage-4' />
+  buildFlags = [ "--tags" "release" ]; <co xml:id='ex-buildGoPackage-4' />
 }
 </programlisting>
   </example>
diff --git a/nixos/modules/services/x11/extra-layouts.nix b/nixos/modules/services/x11/extra-layouts.nix
index b06bed7c09c..f48216ff446 100644
--- a/nixos/modules/services/x11/extra-layouts.nix
+++ b/nixos/modules/services/x11/extra-layouts.nix
@@ -141,7 +141,7 @@ in
         });
 
         xkbcomp = super.xorg.xkbcomp.overrideAttrs (old: {
-          configureFlags = "--with-xkb-config-root=${self.xkb_patched}/share/X11/xkb";
+          configureFlags = [ "--with-xkb-config-root=${self.xkb_patched}/share/X11/xkb" ];
         });
 
       };
diff --git a/pkgs/applications/audio/adlplug/default.nix b/pkgs/applications/audio/adlplug/default.nix
index 631e0c9cca5..bc626cbad11 100644
--- a/pkgs/applications/audio/adlplug/default.nix
+++ b/pkgs/applications/audio/adlplug/default.nix
@@ -1,5 +1,6 @@
 { stdenv, fetchFromGitHub, cmake, pkgconfig, libjack2, alsaLib
 , freetype, libX11, libXrandr, libXinerama, libXext, libXcursor
+, fetchpatch
 , adlplugChip ? "-DADLplug_CHIP=OPL3"
 , pname ? "ADLplug" }:
 
@@ -15,6 +16,15 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/jpcima/ADLplug/83636c55bec1b86cabf634b9a6d56d07f00ecc61/resources/patch/juce-gcc9.patch";
+      sha256 = "15hkdb76n9lgjsrpczj27ld9b4804bzrgw89g95cj4sc8wwkplyy";
+      extraPrefix = "thirdparty/JUCE/";
+      stripLen = 1;
+    })
+  ];
+
   cmakeFlags = [ adlplugChip ];
 
   buildInputs = [
diff --git a/pkgs/applications/audio/aeolus/default.nix b/pkgs/applications/audio/aeolus/default.nix
index 389052d30e1..ee9932a7aa3 100644
--- a/pkgs/applications/audio/aeolus/default.nix
+++ b/pkgs/applications/audio/aeolus/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   preBuild = "cd source";
 
-  makeFlags = "DESTDIR= PREFIX=$(out)";
+  makeFlags = [ "DESTDIR=" "PREFIX=$(out)" ];
 
   meta = {
     description = "Synthetized (not sampled) pipe organ emulator";
diff --git a/pkgs/applications/audio/airwave/default.nix b/pkgs/applications/audio/airwave/default.nix
index 737e73421c9..dde2c5e44b3 100644
--- a/pkgs/applications/audio/airwave/default.nix
+++ b/pkgs/applications/audio/airwave/default.nix
@@ -62,7 +62,7 @@ multiStdenv.mkDerivation {
   # Cf. https://github.com/phantom-code/airwave/issues/57
   hardeningDisable = [ "format" ];
 
-  cmakeFlags = "-DVSTSDK_PATH=${vst-sdk}/VST2_SDK";
+  cmakeFlags = [ "-DVSTSDK_PATH=${vst-sdk}/VST2_SDK" ];
 
   postInstall = ''
     mv $out/bin $out/libexec
diff --git a/pkgs/applications/audio/audacity/default.nix b/pkgs/applications/audio/audacity/default.nix
index 2fd3e5c27fe..57e0c52e640 100644
--- a/pkgs/applications/audio/audacity/default.nix
+++ b/pkgs/applications/audio/audacity/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   ];
 
   # audacity only looks for lame and ffmpeg at runtime, so we need to link them in manually
-  NIX_LDFLAGS = [
+  NIX_LDFLAGS = toString [
     # LAME
     "-lmp3lame"
     # ffmpeg
diff --git a/pkgs/applications/audio/avldrums-lv2/default.nix b/pkgs/applications/audio/avldrums-lv2/default.nix
index eeb0f67d193..d71718c32a8 100644
--- a/pkgs/applications/audio/avldrums-lv2/default.nix
+++ b/pkgs/applications/audio/avldrums-lv2/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
-  installFlags = "PREFIX=$(out)";
+  installFlags = [ "PREFIX=$(out)" ];
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
diff --git a/pkgs/applications/audio/cd-discid/default.nix b/pkgs/applications/audio/cd-discid/default.nix
index 76f76c1e750..864e04d88f3 100644
--- a/pkgs/applications/audio/cd-discid/default.nix
+++ b/pkgs/applications/audio/cd-discid/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "0qrcvn7227qaayjcd5rm7z0k5q89qfy5qkdgwr5pd7ih0va8rmpz";
   };
 
-  installFlags = "PREFIX=$(out) INSTALL=install";
+  installFlags = [ "PREFIX=$(out)" "INSTALL=install" ];
 
   buildInputs = []
     ++ stdenv.lib.optional stdenv.isDarwin IOKit;
diff --git a/pkgs/applications/audio/chuck/default.nix b/pkgs/applications/audio/chuck/default.nix
index 692485d0dcf..04b31ae2c0b 100644
--- a/pkgs/applications/audio/chuck/default.nix
+++ b/pkgs/applications/audio/chuck/default.nix
@@ -19,8 +19,8 @@ stdenv.mkDerivation rec {
 
   patches = [ ./darwin-limits.patch ];
 
-  NIX_CFLAGS_COMPILE = lib.optional stdenv.isDarwin "-Wno-missing-sysroot";
-  NIX_LDFLAGS = lib.optional stdenv.isDarwin "-framework MultitouchSupport";
+  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-Wno-missing-sysroot";
+  NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-framework MultitouchSupport";
 
   postPatch = ''
     substituteInPlace src/core/makefile.x/makefile.osx \
diff --git a/pkgs/applications/audio/clementine/default.nix b/pkgs/applications/audio/clementine/default.nix
index 0a374c26142..3fdf98da325 100644
--- a/pkgs/applications/audio/clementine/default.nix
+++ b/pkgs/applications/audio/clementine/default.nix
@@ -77,7 +77,7 @@ let
     inherit src patches nativeBuildInputs postPatch;
 
     # gst_plugins needed for setup-hooks
-    buildInputs = buildInputs ++ [ makeWrapper gst_plugins ];
+    buildInputs = buildInputs ++ [ makeWrapper ] ++ gst_plugins;
 
     cmakeFlags = [ "-DUSE_SYSTEM_PROJECTM=ON" ];
 
diff --git a/pkgs/applications/audio/cmus/default.nix b/pkgs/applications/audio/cmus/default.nix
index b88951c0fc5..023e35bd787 100644
--- a/pkgs/applications/audio/cmus/default.nix
+++ b/pkgs/applications/audio/cmus/default.nix
@@ -122,7 +122,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ ncurses ]
     ++ stdenv.lib.optional stdenv.cc.isClang clangGCC
     ++ stdenv.lib.optionals stdenv.isDarwin [ libiconv CoreAudio ]
-    ++ concatMap (a: a.deps) opts;
+    ++ flatten (concatMap (a: a.deps) opts);
 
   makeFlags = [ "LD=$(CC)" ];
 
diff --git a/pkgs/applications/audio/distrho/default.nix b/pkgs/applications/audio/distrho/default.nix
index 054fc758d64..0d2858713eb 100644
--- a/pkgs/applications/audio/distrho/default.nix
+++ b/pkgs/applications/audio/distrho/default.nix
@@ -37,7 +37,7 @@ in stdenv.mkDerivation rec {
     libXinerama libXrender ladspa-sdk
   ];
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with stdenv.lib; {
     homepage = http://distrho.sourceforge.net;
diff --git a/pkgs/applications/audio/eq10q/default.nix b/pkgs/applications/audio/eq10q/default.nix
index 0308fad831d..b4ad1505320 100644
--- a/pkgs/applications/audio/eq10q/default.nix
+++ b/pkgs/applications/audio/eq10q/default.nix
@@ -19,9 +19,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  installFlags = ''
-    DESTDIR=$(out)
-  '';
+  installFlags = [ "DESTDIR=$(out)" ];
 
   fixupPhase = ''
     cp -r $out/var/empty/local/lib $out
diff --git a/pkgs/applications/audio/foo-yc20/default.nix b/pkgs/applications/audio/foo-yc20/default.nix
index b17561e1567..e514032f44e 100644
--- a/pkgs/applications/audio/foo-yc20/default.nix
+++ b/pkgs/applications/audio/foo-yc20/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libjack2 gtk2 lv2 faust ];
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   # remove lv2 until https://github.com/sampov2/foo-yc20/issues/6 is resolved
   postInstallFixup = "rm -rf $out/lib/lv2";
diff --git a/pkgs/applications/audio/freewheeling/default.nix b/pkgs/applications/audio/freewheeling/default.nix
index a2588093309..34494871f29 100644
--- a/pkgs/applications/audio/freewheeling/default.nix
+++ b/pkgs/applications/audio/freewheeling/default.nix
@@ -25,7 +25,8 @@ stdenv.mkDerivation rec {
       configureFlags = oldAttrs.configureFlags ++ [ "--enable-openssl-compatibility" ];
     }))
   ];
-  NIX_CFLAGS_COMPILE = makeSDLFlags [ SDL SDL_ttf SDL_gfx ] ++ [ "-I${libxml2.dev}/include/libxml2" ];
+  NIX_CFLAGS_COMPILE = toString
+    (makeSDLFlags [ SDL SDL_ttf SDL_gfx ] ++ [ "-I${libxml2.dev}/include/libxml2" ]);
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/applications/audio/jack-rack/default.nix b/pkgs/applications/audio/jack-rack/default.nix
index 26a717dbd6e..41b40223b87 100644
--- a/pkgs/applications/audio/jack-rack/default.nix
+++ b/pkgs/applications/audio/jack-rack/default.nix
@@ -7,11 +7,7 @@ stdenv.mkDerivation rec {
   };
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libjack2 ladspaH gtk2 alsaLib libxml2 librdf ];
-  NIX_LDFLAGS = [
-    "-ldl"
-    "-lm"
-    "-lpthread"
-  ];
+  NIX_LDFLAGS = "-ldl -lm -lpthread";
 
   meta = {
     description = ''An effects "rack" for the JACK low latency audio API'';
diff --git a/pkgs/applications/audio/jamin/default.nix b/pkgs/applications/audio/jamin/default.nix
index 3511a08682c..818630585cf 100644
--- a/pkgs/applications/audio/jamin/default.nix
+++ b/pkgs/applications/audio/jamin/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation {
   buildInputs = [ fftwFloat gtk2 ladspaPlugins libjack2 liblo libxml2 makeWrapper ]
     ++ (with perlPackages; [ perl XMLParser ]);
 
-  NIX_LDFLAGS = [ "-ldl" ];
+  NIX_LDFLAGS = "-ldl";
 
   postInstall = ''
     wrapProgram $out/bin/jamin --set LADSPA_PATH ${ladspaPlugins}/lib/ladspa
diff --git a/pkgs/applications/audio/lash/default.nix b/pkgs/applications/audio/lash/default.nix
index e96972b0d1b..0dbe60b6a61 100644
--- a/pkgs/applications/audio/lash/default.nix
+++ b/pkgs/applications/audio/lash/default.nix
@@ -18,11 +18,7 @@ stdenv.mkDerivation  rec {
   buildInputs = [ alsaLib gtk2 libjack2 libxml2 makeWrapper
     pkgconfig readline ];
   propagatedBuildInputs = [ libuuid ];
-  NIX_LDFLAGS = [
-    "-lm"
-    "-lpthread"
-    "-luuid"
-  ];
+  NIX_LDFLAGS = "-lm -lpthread -luuid";
 
   postInstall = ''
     for i in lash_control lash_panel
diff --git a/pkgs/applications/audio/lsp-plugins/default.nix b/pkgs/applications/audio/lsp-plugins/default.nix
index d5d893891ff..b146fcecc8e 100644
--- a/pkgs/applications/audio/lsp-plugins/default.nix
+++ b/pkgs/applications/audio/lsp-plugins/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     "PREFIX=${placeholder ''out''}"
   ];
 
-  NIX_CFLAGS_COMPILE = [ "-DLSP_NO_EXPERIMENTAL" ];
+  NIX_CFLAGS_COMPILE = "-DLSP_NO_EXPERIMENTAL";
 
   doCheck = true;
 
diff --git a/pkgs/applications/audio/moc/default.nix b/pkgs/applications/audio/moc/default.nix
index 89d062d584e..5615f4cace3 100644
--- a/pkgs/applications/audio/moc/default.nix
+++ b/pkgs/applications/audio/moc/default.nix
@@ -57,7 +57,7 @@ in stdenv.mkDerivation rec {
     ++ opt midiSupport timidity
     ++ opt modplugSupport libmodplug
     ++ opt mp3Support libmad
-    ++ opt musepackSupport [ libmpc libmpcdec taglib ]
+    ++ stdenv.lib.optionals musepackSupport [ libmpc libmpcdec taglib ]
     ++ opt vorbisSupport libvorbis
     ++ opt speexSupport speex
     ++ opt (ffmpegSupport && !withffmpeg4) ffmpeg
diff --git a/pkgs/applications/audio/mpg321/default.nix b/pkgs/applications/audio/mpg321/default.nix
index fdefcf7e77d..08fe9b4f9af 100644
--- a/pkgs/applications/audio/mpg321/default.nix
+++ b/pkgs/applications/audio/mpg321/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
   buildInputs = [libao libid3tag libmad zlib]
     ++ stdenv.lib.optional stdenv.isLinux alsaLib;
 
-  installTargets = "install install-man";
+  installTargets = [ "install" "install-man" ];
 
   meta = with stdenv.lib; {
     description = "Command-line MP3 player";
diff --git a/pkgs/applications/audio/openmpt123/default.nix b/pkgs/applications/audio/openmpt123/default.nix
index 58e0887163d..0e52d144e51 100644
--- a/pkgs/applications/audio/openmpt123/default.nix
+++ b/pkgs/applications/audio/openmpt123/default.nix
@@ -19,7 +19,7 @@ in stdenv.mkDerivation {
   buildInputs = [ zlib mpg123 libogg libvorbis portaudio libsndfile flac ]
   ++ stdenv.lib.optional usePulseAudio libpulseaudio;
 
-  configureFlags = stdenv.lib.optional (!usePulseAudio) [ "--without-pulseaudio" ];
+  configureFlags = stdenv.lib.optional (!usePulseAudio) "--without-pulseaudio";
 
   meta = with stdenv.lib; {
     description = "A cross-platform command-line based module file player";
diff --git a/pkgs/applications/audio/pianobar/default.nix b/pkgs/applications/audio/pianobar/default.nix
index 26b94f306bc..811952f845f 100644
--- a/pkgs/applications/audio/pianobar/default.nix
+++ b/pkgs/applications/audio/pianobar/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     libao json_c libgcrypt ffmpeg curl
   ];
 
-  makeFlags="PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   CC = "gcc";
   CFLAGS = "-std=c99";
diff --git a/pkgs/applications/audio/pianobooster/default.nix b/pkgs/applications/audio/pianobooster/default.nix
index fee456ae717..f2130fe5559 100644
--- a/pkgs/applications/audio/pianobooster/default.nix
+++ b/pkgs/applications/audio/pianobooster/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation  {
   preConfigure = "cd src";
 
   buildInputs = [ alsaLib cmake makeWrapper libGLU libGL qt4 ];
-  NIX_LDFLAGS = [ "-lGL" "-lpthread" ];
+  NIX_LDFLAGS = "-lGL -lpthread";
 
   postInstall = ''
     wrapProgram $out/bin/pianobooster \
diff --git a/pkgs/applications/audio/sndpeek/default.nix b/pkgs/applications/audio/sndpeek/default.nix
index ecdafdaeadd..376aadc7385 100644
--- a/pkgs/applications/audio/sndpeek/default.nix
+++ b/pkgs/applications/audio/sndpeek/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     libXext
     libXi
   ];
-  buildFlags = "linux-alsa";
+  buildFlags = [ "linux-alsa" ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/applications/audio/svox/default.nix b/pkgs/applications/audio/svox/default.nix
index 8acd8e0b88b..3e9fe4725af 100644
--- a/pkgs/applications/audio/svox/default.nix
+++ b/pkgs/applications/audio/svox/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation {
     cp lang/*.bin $out/share/pico/lang
   '';
 
-  NIX_CFLAGS_COMPILE = [ "-include stdint.h" ];
+  NIX_CFLAGS_COMPILE = "-include stdint.h";
 
   meta = with stdenv.lib; {
     description = "Text-to-speech engine";
diff --git a/pkgs/applications/audio/timemachine/default.nix b/pkgs/applications/audio/timemachine/default.nix
index 8c7ed20e748..48dd3f39e88 100644
--- a/pkgs/applications/audio/timemachine/default.nix
+++ b/pkgs/applications/audio/timemachine/default.nix
@@ -19,9 +19,7 @@ stdenv.mkDerivation rec {
 
   preConfigure = "./autogen.sh";
 
-  NIX_LDFLAGS =  [
-    "-lm"
-  ];
+  NIX_LDFLAGS = "-lm";
 
   meta = {
     description = "JACK audio recorder";
diff --git a/pkgs/applications/audio/vcv-rack/default.nix b/pkgs/applications/audio/vcv-rack/default.nix
index c0bbd6e71db..11daabbf810 100644
--- a/pkgs/applications/audio/vcv-rack/default.nix
+++ b/pkgs/applications/audio/vcv-rack/default.nix
@@ -79,7 +79,7 @@ with stdenv.lib; stdenv.mkDerivation rec {
   nativeBuildInputs = [ makeWrapper pkgconfig ];
   buildInputs = [ alsaLib curl glew glfw gtk2-x11 jansson libjack2 libsamplerate libzip rtaudio rtmidi speex ];
 
-  buildFlags = "Rack";
+  buildFlags = [ "Rack" ];
 
   installPhase = ''
     install -D -m755 -t $out/bin Rack
diff --git a/pkgs/applications/blockchains/aeon/default.nix b/pkgs/applications/blockchains/aeon/default.nix
index d65889be3ac..db9e68ae905 100644
--- a/pkgs/applications/blockchains/aeon/default.nix
+++ b/pkgs/applications/blockchains/aeon/default.nix
@@ -4,7 +4,7 @@
 }:
 
 let
-  version = "0.12.9.0";
+  version = "0.13.0.0";
 in
 stdenv.mkDerivation {
   pname = "aeon";
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
     repo = "aeon";
     rev = "v${version}-aeon";
     fetchSubmodules = true;
-    sha256 = "194nxf8c8ihkmdsxyhkhrxc2xiinipifk0ng1rmxiiyr2gjgxzga";
+    sha256 = "07d87n1j4dc9gfwj6xy5jdpryn45095xdh961g6xjnjzc5fivjch";
   };
 
   nativeBuildInputs = [ cmake pkgconfig git doxygen graphviz ];
diff --git a/pkgs/applications/blockchains/monero-gui/default.nix b/pkgs/applications/blockchains/monero-gui/default.nix
index 7082794bba7..0311169deb2 100644
--- a/pkgs/applications/blockchains/monero-gui/default.nix
+++ b/pkgs/applications/blockchains/monero-gui/default.nix
@@ -33,6 +33,8 @@ stdenv.mkDerivation rec {
     cppzmq hidapi randomx
   ];
 
+  NIX_CFLAGS_COMPILE = [ "-Wno-error=format-security" ];
+
   patches = [ ./move-log-file.patch ];
 
   postPatch = ''
diff --git a/pkgs/applications/display-managers/lightdm/gtk-greeter.nix b/pkgs/applications/display-managers/lightdm/gtk-greeter.nix
index 91fe3e5b22f..be586bdac9b 100644
--- a/pkgs/applications/display-managers/lightdm/gtk-greeter.nix
+++ b/pkgs/applications/display-managers/lightdm/gtk-greeter.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
     configureFlagsArray+=( --enable-at-spi-command="${at-spi2-core}/libexec/at-spi-bus-launcher --launch-immediately" )
   '';
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=deprecated-declarations" ];
+  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
 
   installFlags = [
     "localstatedir=\${TMPDIR}"
diff --git a/pkgs/applications/editors/bviplus/default.nix b/pkgs/applications/editors/bviplus/default.nix
index 2c6b153370e..7d70ad14b5d 100644
--- a/pkgs/applications/editors/bviplus/default.nix
+++ b/pkgs/applications/editors/bviplus/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     ncurses
   ];
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   buildFlags = [ "CFLAGS=-fgnu89-inline" ];
 
diff --git a/pkgs/applications/editors/codeblocks/default.nix b/pkgs/applications/editors/codeblocks/default.nix
index 72642cfbe63..cbed08f317f 100644
--- a/pkgs/applications/editors/codeblocks/default.nix
+++ b/pkgs/applications/editors/codeblocks/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   preConfigure = "substituteInPlace ./configure --replace /usr/bin/file ${file}/bin/file";
   postConfigure = optionalString stdenv.isLinux "substituteInPlace libtool --replace ldconfig ${stdenv.cc.libc.bin}/bin/ldconfig";
   configureFlags = [ "--enable-pch=no" ]
-    ++ optional contribPlugins [ "--with-contrib-plugins" "--with-boost-libdir=${boost}/lib" ];
+    ++ optionals contribPlugins [ "--with-contrib-plugins" "--with-boost-libdir=${boost}/lib" ];
 
   meta = {
     maintainers = [ maintainers.linquize ];
diff --git a/pkgs/applications/editors/edbrowse/default.nix b/pkgs/applications/editors/edbrowse/default.nix
index 1161fc8256c..c43640b6524 100644
--- a/pkgs/applications/editors/edbrowse/default.nix
+++ b/pkgs/applications/editors/edbrowse/default.nix
@@ -13,8 +13,8 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  makeFlags = [ 
-    "-C src"
+  makeFlags = [
+    "-C" "src"
     "prefix=${placeholder "out"}"
   ];
 
diff --git a/pkgs/applications/editors/emacs-modes/libgenerated.nix b/pkgs/applications/editors/emacs-modes/libgenerated.nix
index 0529fce2b16..57bccc60818 100644
--- a/pkgs/applications/editors/emacs-modes/libgenerated.nix
+++ b/pkgs/applications/editors/emacs-modes/libgenerated.nix
@@ -77,7 +77,7 @@ in {
                 url = "https://raw.githubusercontent.com/melpa/melpa/${commit}/recipes/${ename}";
                 inherit sha256;
               };
-            packageRequires = lib.optional (! isNull deps)
+            packageRequires = lib.optionals (! isNull deps)
               (map (dep: pkgargs.${dep} or self.${dep} or null)
                    deps);
             meta = (sourceArgs.meta or {}) // {
diff --git a/pkgs/applications/editors/emacs/25.nix b/pkgs/applications/editors/emacs/25.nix
index 42edb7c707e..e4643102f0e 100644
--- a/pkgs/applications/editors/emacs/25.nix
+++ b/pkgs/applications/editors/emacs/25.nix
@@ -97,7 +97,7 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  installTargets = "tags install";
+  installTargets = [ "tags" "install" ];
 
   postInstall = ''
     mkdir -p $out/share/emacs/site-lisp
diff --git a/pkgs/applications/editors/fte/default.nix b/pkgs/applications/editors/fte/default.nix
index d32a3fb5f1b..ab149131b80 100644
--- a/pkgs/applications/editors/fte/default.nix
+++ b/pkgs/applications/editors/fte/default.nix
@@ -15,9 +15,9 @@ stdenv.mkDerivation rec {
   };
   src = [ ftesrc ftecommon ];
 
-  buildFlags = "PREFIX=$(out)";
+  buildFlags = [ "PREFIX=$(out)" ];
 
-  installFlags = "PREFIX=$(out) INSTALL_NONROOT=1";
+  installFlags = [ "PREFIX=$(out)" "INSTALL_NONROOT=1" ];
 
   meta = with stdenv.lib; {
     description = "A free text editor for developers";
diff --git a/pkgs/applications/editors/hexcurse/default.nix b/pkgs/applications/editors/hexcurse/default.nix
index a6437f070b9..c87694321f3 100644
--- a/pkgs/applications/editors/hexcurse/default.nix
+++ b/pkgs/applications/editors/hexcurse/default.nix
@@ -11,6 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "17ckkxfzbqvvfdnh10if4aqdcq98q3vl6dn1v6f4lhr4ifnyjdlk";
   };
   buildInputs = [ ncurses ];
+  NIX_CFLAGS_COMPILE = [ "-Wno-error=stringop-overflow" "-Wno-error=stringop-truncation" ];
   patches = [
     # gcc7 compat
     (fetchpatch {
@@ -23,7 +24,7 @@ stdenv.mkDerivation rec {
       sha256 = "0v6gbp6pjpmnzswlf6d97aywiy015g3kcmfrrkspsbb7lh1y3nix";
     })
   ];
-  
+
   meta = with lib; {
     description = "ncurses-based console hexeditor written in C";
     homepage = https://github.com/LonnyGomes/hexcurse;
diff --git a/pkgs/applications/editors/jucipp/default.nix b/pkgs/applications/editors/jucipp/default.nix
index 70b2d3c148d..2682c1e789b 100644
--- a/pkgs/applications/editors/jucipp/default.nix
+++ b/pkgs/applications/editors/jucipp/default.nix
@@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
     sed -i 's|liblldb LIBLLDB_LIBRARIES|liblldb LIBNOTHING|g' CMakeLists.txt
     sed -i 's|> arguments;|> arguments; ${lintIncludes}|g' src/source_clang.cc
   '';
-  cmakeFlags = "-DLIBLLDB_LIBRARIES=${stdenv.lib.makeLibraryPath [ llvmPackages.lldb ]}/liblldb.so";
+  cmakeFlags = [ "-DLIBLLDB_LIBRARIES=${stdenv.lib.makeLibraryPath [ llvmPackages.lldb ]}/liblldb.so" ];
   postInstall = ''
     mv $out/bin/juci $out/bin/.juci
     makeWrapper "$out/bin/.juci" "$out/bin/juci" \
diff --git a/pkgs/applications/editors/nedit/default.nix b/pkgs/applications/editors/nedit/default.nix
index 4ff8c759a26..e1d1fa3070a 100644
--- a/pkgs/applications/editors/nedit/default.nix
+++ b/pkgs/applications/editors/nedit/default.nix
@@ -3,7 +3,7 @@
 stdenv.mkDerivation rec {
   pname = "nedit";
   version = "5.7";
-  
+
   src = fetchurl {
     url = "mirror://sourceforge/nedit/nedit-source/${pname}-${version}-src.tar.gz";
     sha256 = "0ym1zhjx9976rf2z5nr7dj4mjkxcicimhs686snjhdcpzxwsrndd";
@@ -14,9 +14,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ xlibsWrapper ];
   buildInputs = [ motif libXpm ];
 
-  buildFlags = if stdenv.isLinux then "linux" else
-               # the linux config works fine on darwin too!
-               if stdenv.isDarwin then "linux" else "";
+  # the linux config works fine on darwin too!
+  buildFlags = stdenv.lib.optional (stdenv.isLinux || stdenv.isDarwin) "linux";
 
   NIX_CFLAGS_COMPILE="-DBUILD_UNTESTED_NEDIT -L${motif}/lib";
 
diff --git a/pkgs/applications/editors/texmacs/default.nix b/pkgs/applications/editors/texmacs/default.nix
index 8ca3f8cb2a9..91e2427a6c8 100644
--- a/pkgs/applications/editors/texmacs/default.nix
+++ b/pkgs/applications/editors/texmacs/default.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation {
     git
     python3
   ];
-  NIX_LDFLAGS = [ "-lz" ];
+  NIX_LDFLAGS = "-lz";
 
   postInstall = "wrapProgram $out/bin/texmacs --suffix PATH : " +
         (if ghostscriptX == null then "" else "${ghostscriptX}/bin:") +
diff --git a/pkgs/applications/editors/yi/wrapper.nix b/pkgs/applications/editors/yi/wrapper.nix
index 0f3cd7d136a..243690bc263 100644
--- a/pkgs/applications/editors/yi/wrapper.nix
+++ b/pkgs/applications/editors/yi/wrapper.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
   '';
 
   # For hacking purposes
-  env = yiEnv;
+  passthru.env = yiEnv;
 
   meta = with stdenv.lib; {
     description = "Allows Yi to find libraries and the compiler easily";
diff --git a/pkgs/applications/gis/grass/default.nix b/pkgs/applications/gis/grass/default.nix
index 4000c834602..8734fabfdcf 100644
--- a/pkgs/applications/gis/grass/default.nix
+++ b/pkgs/applications/gis/grass/default.nix
@@ -85,7 +85,7 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  NIX_CFLAGS_COMPILE = [ "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H=1" ];
+  NIX_CFLAGS_COMPILE = "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H=1";
 
   postInstall = ''
     wrapProgram $out/bin/grass76 \
diff --git a/pkgs/applications/graphics/ahoviewer/default.nix b/pkgs/applications/graphics/ahoviewer/default.nix
index fb06266cdc5..87bddf9099e 100644
--- a/pkgs/applications/graphics/ahoviewer/default.nix
+++ b/pkgs/applications/graphics/ahoviewer/default.nix
@@ -29,9 +29,7 @@ stdenv.mkDerivation rec {
     gst_all_1.gst-plugins-base
   ] ++ stdenv.lib.optional useUnrar unrar;
 
-  NIX_LDFLAGS = [
-    "-lpthread"
-  ];
+  NIX_LDFLAGS = "-lpthread";
 
   postPatch = ''patchShebangs version.sh'';
 
diff --git a/pkgs/applications/graphics/gimp/plugins/default.nix b/pkgs/applications/graphics/gimp/plugins/default.nix
index fa29c979b05..0a06c42b5fc 100644
--- a/pkgs/applications/graphics/gimp/plugins/default.nix
+++ b/pkgs/applications/graphics/gimp/plugins/default.nix
@@ -48,7 +48,7 @@ stdenv.lib.makeScope pkgs.newScope (self: with self; {
       url = https://ftp.gimp.org/pub/gimp/plug-ins/v2.6/gap/gimp-gap-2.6.0.tar.bz2;
       sha256 = "1jic7ixcmsn4kx2cn32nc5087rk6g8xsrz022xy11yfmgvhzb0ql";
     };
-    NIX_LDFLAGS = [ "-lm" ];
+    NIX_LDFLAGS = "-lm";
     patchPhase = ''
       sed -e 's,^\(GIMP_PLUGIN_DIR=\).*,\1'"$out/${gimp.name}-plugins", \
        -e 's,^\(GIMP_DATA_DIR=\).*,\1'"$out/share/${gimp.name}", -i configure
@@ -141,7 +141,7 @@ stdenv.lib.makeScope pkgs.newScope (self: with self; {
       Filters/Enhance/Wavelet sharpen
     */
     name = "wavelet-sharpen-0.1.2";
-    NIX_LDFLAGS = [ "-lm" ];
+    NIX_LDFLAGS = "-lm";
     src = fetchurl {
       url = http://registry.gimp.org/files/wavelet-sharpen-0.1.2.tar.gz;
       sha256 = "0vql1k67i21g5ivaa1jh56rg427m0icrkpryrhg75nscpirfxxqw";
diff --git a/pkgs/applications/graphics/gnuclad/default.nix b/pkgs/applications/graphics/gnuclad/default.nix
index 2535f7514f1..5b6dd42e09e 100644
--- a/pkgs/applications/graphics/gnuclad/default.nix
+++ b/pkgs/applications/graphics/gnuclad/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "0ka2kscpjff7gflsargv3r9fdaxhkf3nym9mfaln3pnq6q7fwdki";
   };
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=catch-value" ];
+  NIX_CFLAGS_COMPILE = "-Wno-error=catch-value";
 
   nativeBuildInputs = [ pkgconfig ];
 
diff --git a/pkgs/applications/graphics/goxel/default.nix b/pkgs/applications/graphics/goxel/default.nix
index e4ab5639ba6..e870df4bc6e 100644
--- a/pkgs/applications/graphics/goxel/default.nix
+++ b/pkgs/applications/graphics/goxel/default.nix
@@ -16,9 +16,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ scons pkgconfig wrapGAppsHook ];
   buildInputs = [ glfw3 gtk3 libpng12 ];
-  NIX_LDFLAGS = [
-    "-lpthread"
-  ];
+  NIX_LDFLAGS = "-lpthread";
 
   buildPhase = ''
     make release
diff --git a/pkgs/applications/graphics/gqview/default.nix b/pkgs/applications/graphics/gqview/default.nix
index 205376b1257..d82238f925b 100644
--- a/pkgs/applications/graphics/gqview/default.nix
+++ b/pkgs/applications/graphics/gqview/default.nix
@@ -18,9 +18,7 @@ stdenv.mkDerivation {
 
   hardeningDisable = [ "format" ];
 
-  NIX_LDFLAGS = [
-    "-lm"
-  ];
+  NIX_LDFLAGS = "-lm";
 
   meta = with stdenv.lib; {
     description = "A fast image viewer";
diff --git a/pkgs/applications/graphics/k3d/default.nix b/pkgs/applications/graphics/k3d/default.nix
index d3bc8deb05e..31085cd8023 100644
--- a/pkgs/applications/graphics/k3d/default.nix
+++ b/pkgs/applications/graphics/k3d/default.nix
@@ -39,9 +39,7 @@ stdenv.mkDerivation rec {
 
   #doCheck = false;
 
-  NIX_CFLAGS_COMPILE = [
-    "-Wno-deprecated-declarations"
-  ];
+  NIX_CFLAGS_COMPILE = "-Wno-deprecated-declarations";
 
   meta = with stdenv.lib; {
     description = "A 3D editor with support for procedural editing";
diff --git a/pkgs/applications/graphics/openimageio/default.nix b/pkgs/applications/graphics/openimageio/default.nix
index 7225efadebd..c743f8bd653 100644
--- a/pkgs/applications/graphics/openimageio/default.nix
+++ b/pkgs/applications/graphics/openimageio/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openimageio";
-  version = "1.8.16";
+  version = "1.8.17";
 
   src = fetchFromGitHub {
     owner = "OpenImageIO";
     repo = "oiio";
     rev = "Release-${version}";
-    sha256 = "0isx137c6anvs1xfxi0z35v1cw855xvnq2ca0pakqqpdh0yivrps";
+    sha256 = "0zq34szprgkrrayg5sl3whrsx2l6lr8nw4hdrnwv2qhn70jbi2w2";
   };
 
   outputs = [ "bin" "out" "dev" "doc" ];
diff --git a/pkgs/applications/graphics/smartdeblur/default.nix b/pkgs/applications/graphics/smartdeblur/default.nix
index 377a5ae6168..314b4007aad 100644
--- a/pkgs/applications/graphics/smartdeblur/default.nix
+++ b/pkgs/applications/graphics/smartdeblur/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ cmake qt4 fftw ];
 
-  cmakeFlags = "-DUSE_SYSTEM_FFTW=ON";
+  cmakeFlags = [ "-DUSE_SYSTEM_FFTW=ON" ];
 
   meta = {
     homepage = https://github.com/Y-Vladimir/SmartDeblur;
diff --git a/pkgs/applications/graphics/xournal/default.nix b/pkgs/applications/graphics/xournal/default.nix
index cd9d068b8ac..6d10a7cae23 100644
--- a/pkgs/applications/graphics/xournal/default.nix
+++ b/pkgs/applications/graphics/xournal/default.nix
@@ -26,8 +26,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoconf automake libtool pkgconfig ];
 
-  NIX_LDFLAGS = [ "-lz" ]
-    ++ stdenv.lib.optionals (!isGdkQuartzBackend) [ "-lX11" ];
+  NIX_LDFLAGS = "-lz"
+    + stdenv.lib.optionalString (!isGdkQuartzBackend) " -lX11";
 
   desktopItem = makeDesktopItem {
     name = name;
diff --git a/pkgs/applications/graphics/zgv/default.nix b/pkgs/applications/graphics/zgv/default.nix
index 8ef705f7ef4..7b14d7750c3 100644
--- a/pkgs/applications/graphics/zgv/default.nix
+++ b/pkgs/applications/graphics/zgv/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     ./switch.patch
   ];
 
-  patchFlags = "-p0";
+  patchFlags = [ "-p0" ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/applications/kde/print-manager.nix b/pkgs/applications/kde/print-manager.nix
index f869f984e00..f0501ffadee 100644
--- a/pkgs/applications/kde/print-manager.nix
+++ b/pkgs/applications/kde/print-manager.nix
@@ -22,8 +22,5 @@ mkDerivation {
   outputs = [ "out" "dev" ];
   # Fix build with cups deprecations etc.
   # See: https://github.com/NixOS/nixpkgs/issues/73334
-  NIX_CFLAGS_COMPILE = [
-    "-Wno-error=deprecated-declarations"
-    "-Wno-error=format-security"
-  ];
+  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations -Wno-error=format-security";
 }
diff --git a/pkgs/applications/misc/bibletime/default.nix b/pkgs/applications/misc/bibletime/default.nix
index a3f0a3b84f2..d0af940ac92 100644
--- a/pkgs/applications/misc/bibletime/default.nix
+++ b/pkgs/applications/misc/bibletime/default.nix
@@ -1,28 +1,30 @@
-{stdenv, fetchurl, cmake, sword, qt4, boost, clucene_core}:
+{ stdenv, fetchurl, cmake, pkgconfig, sword, boost, clucene_core
+, qtbase, qttools, qtsvg, qtwebkit
+}:
 
 stdenv.mkDerivation rec {
 
-  version = "2.10.1";
+  version = "2.11.2";
 
   pname = "bibletime";
 
   src = fetchurl {
     url = "mirror://sourceforge/bibletime/${pname}-${version}.tar.xz";
-    sha256 = "14fayy5h1ffjxin669q56fflxn4ij1irgn60cygwx2y02cwxbll6";
+    sha256 = "1s5bvmwbz1gyp3ml8sghpc00h8nhdvx2iyq96iri30kwx1y1jy6i";
   };
 
-  prePatch = ''
-    patchShebangs .;
-  '';
+  nativeBuildInputs = [ cmake pkgconfig ];
+  buildInputs = [
+   sword boost clucene_core
+   qtbase qttools qtsvg qtwebkit
+ ];
 
   preConfigure =  ''
     export CLUCENE_HOME=${clucene_core};
     export SWORD_HOME=${sword};
   '';
 
-  buildInputs = [ cmake sword qt4 boost clucene_core ];
-
-  cmakeFlags = "-DUSE_QT_WEBKIT=ON -DCMAKE_BUILD_TYPE=Debug";
+  cmakeFlags = [ "-DUSE_QT_WEBKIT=ON" "-DCMAKE_BUILD_TYPE=Debug" ];
 
   meta = {
     description = "A Qt4 Bible study tool";
diff --git a/pkgs/applications/misc/cbatticon/default.nix b/pkgs/applications/misc/cbatticon/default.nix
index e506829b575..d6680c61eb9 100644
--- a/pkgs/applications/misc/cbatticon/default.nix
+++ b/pkgs/applications/misc/cbatticon/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     sed -i -e 's/ -Wno-format//g' Makefile
   '';
 
-  makeFlags = "PREFIX=${placeholder "out"}";
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
 
   meta = with stdenv.lib; {
     description = "Lightweight and fast battery icon that sits in the system tray";
diff --git a/pkgs/applications/misc/ddgr/default.nix b/pkgs/applications/misc/ddgr/default.nix
index 9b877c2594b..7d211b26a42 100644
--- a/pkgs/applications/misc/ddgr/default.nix
+++ b/pkgs/applications/misc/ddgr/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ python3 ];
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   preBuild = ''
     # Version 1.7 was released as 1.6
diff --git a/pkgs/applications/misc/doomseeker/default.nix b/pkgs/applications/misc/doomseeker/default.nix
index 1332b265d54..fbe21dd9a5b 100644
--- a/pkgs/applications/misc/doomseeker/default.nix
+++ b/pkgs/applications/misc/doomseeker/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optional stdenv.cc.isClang "-Wno-error=format-security";
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-error=format-security";
 
   meta = with stdenv.lib; {
     homepage = http://doomseeker.drdteam.org/;
diff --git a/pkgs/applications/misc/fbreader/default.nix b/pkgs/applications/misc/fbreader/default.nix
index e7d0e6a63a5..857ef9ac27b 100644
--- a/pkgs/applications/misc/fbreader/default.nix
+++ b/pkgs/applications/misc/fbreader/default.nix
@@ -59,9 +59,9 @@ stdenv.mkDerivation {
   ++ optional (uiType == "gtk") gtk2
   ++ optionals (uiType == "cocoa") [ AppKit Cocoa ];
 
-  makeFlags = "INSTALLDIR=$(out)";
+  makeFlags = [ "INSTALLDIR=$(out)" ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=narrowing" ]; # since gcc-6
+  NIX_CFLAGS_COMPILE = "-Wno-error=narrowing";
 
   meta = with stdenv.lib; {
     description = "An e-book reader for Linux";
diff --git a/pkgs/applications/misc/getxbook/default.nix b/pkgs/applications/misc/getxbook/default.nix
index b2a992b850e..aa901a7ba51 100644
--- a/pkgs/applications/misc/getxbook/default.nix
+++ b/pkgs/applications/misc/getxbook/default.nix
@@ -9,7 +9,11 @@ stdenv.mkDerivation rec {
     sha256 = "0ihwrx4gspj8l7fc8vxch6dpjrw1lvv9z3c19f0wxnmnxhv1cjvs";
   };
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=format-truncation" "-Wno-error=deprecated-declarations" ];
+  NIX_CFLAGS_COMPILE = builtins.toString [
+    "-Wno-error=format-truncation"
+    "-Wno-error=deprecated-declarations"
+    "-Wno-error=stringop-overflow"
+  ];
 
   buildInputs = [ openssl ];
 
diff --git a/pkgs/applications/misc/golden-cheetah/default.nix b/pkgs/applications/misc/golden-cheetah/default.nix
index dde1c32e805..3dffc5c77c2 100644
--- a/pkgs/applications/misc/golden-cheetah/default.nix
+++ b/pkgs/applications/misc/golden-cheetah/default.nix
@@ -31,7 +31,7 @@ in mkDerivation rec {
   ];
   nativeBuildInputs = [ flex makeWrapper qmake yacc ];
 
-  NIX_LDFLAGS = [ "-lz" ];
+  NIX_LDFLAGS = "-lz";
 
   qtWrapperArgs = [ "--set LD_LIBRARY_PATH ${zlib.out}/lib" ];
 
diff --git a/pkgs/applications/misc/gollum/default.nix b/pkgs/applications/misc/gollum/default.nix
index e9a177ee193..251e84f04c3 100644
--- a/pkgs/applications/misc/gollum/default.nix
+++ b/pkgs/applications/misc/gollum/default.nix
@@ -8,15 +8,15 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ makeWrapper ];
 
-  env = bundlerEnv {
-    name = "${pname}-${version}-gems";
-    inherit pname ruby;
-    gemdir = ./.;
-  };
-
   phases = [ "installPhase" ];
 
-  installPhase = ''
+  installPhase = let
+    env = bundlerEnv {
+      name = "${pname}-${version}-gems";
+      inherit pname ruby;
+      gemdir = ./.;
+    };
+  in ''
     mkdir -p $out/bin
     makeWrapper ${env}/bin/gollum $out/bin/gollum \
       --prefix PATH ":" ${stdenv.lib.makeBinPath [ git ]}
diff --git a/pkgs/applications/misc/googler/default.nix b/pkgs/applications/misc/googler/default.nix
index 60feecd665d..3e4c9828ede 100644
--- a/pkgs/applications/misc/googler/default.nix
+++ b/pkgs/applications/misc/googler/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ python ];
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with stdenv.lib; {
     homepage = "https://github.com/jarun/googler";
diff --git a/pkgs/applications/misc/grip/default.nix b/pkgs/applications/misc/grip/default.nix
index 36ca31707c8..4416e1e62c2 100644
--- a/pkgs/applications/misc/grip/default.nix
+++ b/pkgs/applications/misc/grip/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   hardeningDisable = [ "format" ];
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = [ "-DGLIB_DISABLE_DEPRECATION_WARNINGS" ];
+  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   meta = {
     description = "GTK-based audio CD player/ripper";
diff --git a/pkgs/applications/misc/gxneur/default.nix b/pkgs/applications/misc/gxneur/default.nix
index 6e6145e7908..c44523a8b75 100644
--- a/pkgs/applications/misc/gxneur/default.nix
+++ b/pkgs/applications/misc/gxneur/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
   };
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = [ "-DGLIB_DISABLE_DEPRECATION_WARNINGS" ];
+  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   nativeBuildInputs = [ pkgconfig intltool ];
   buildInputs = [
diff --git a/pkgs/applications/misc/hugo/default.nix b/pkgs/applications/misc/hugo/default.nix
index 4251d2c1f36..b5c57054f8b 100644
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
 
   modSha256 = "0dwv5qnglv00jj7vlps76zlfpkzsplf93401j2l03xfvmvadifrs";
 
-  buildFlags = "-tags extended";
+  buildFlags = [ "-tags" "extended" ];
 
   subPackages = [ "." ];
 
diff --git a/pkgs/applications/misc/jp2a/default.nix b/pkgs/applications/misc/jp2a/default.nix
index 2a9e162e7ea..1aece5eb4e2 100644
--- a/pkgs/applications/misc/jp2a/default.nix
+++ b/pkgs/applications/misc/jp2a/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "12a1z9ba2j16y67f41y8ax5sgv1wdjd71pg7circdxkj263n78ql";
   };
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ libjpeg ];
diff --git a/pkgs/applications/misc/k2pdfopt/default.nix b/pkgs/applications/misc/k2pdfopt/default.nix
index aedfff40d70..69d78575e2a 100644
--- a/pkgs/applications/misc/k2pdfopt/default.nix
+++ b/pkgs/applications/misc/k2pdfopt/default.nix
@@ -65,9 +65,7 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [ "-DCMAKE_C_FLAGS=-I${src}/include_mod" ];
 
-  NIX_LDFLAGS = [
-    "-lpthread"
-  ];
+  NIX_LDFLAGS = "-lpthread";
 
   installPhase = ''
     install -D -m 755 k2pdfopt $out/bin/k2pdfopt
diff --git a/pkgs/applications/misc/merkaartor/default.nix b/pkgs/applications/misc/merkaartor/default.nix
index e643c212225..08643577b49 100644
--- a/pkgs/applications/misc/merkaartor/default.nix
+++ b/pkgs/applications/misc/merkaartor/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = [ "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H" ];
+  NIX_CFLAGS_COMPILE = "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H";
 
   postInstall = ''
     wrapProgram $out/bin/merkaartor \
diff --git a/pkgs/applications/misc/mlterm/default.nix b/pkgs/applications/misc/mlterm/default.nix
index 0c8ad9ae1b3..b2012801e17 100644
--- a/pkgs/applications/misc/mlterm/default.nix
+++ b/pkgs/applications/misc/mlterm/default.nix
@@ -61,9 +61,7 @@ stdenv.mkDerivation rec {
     "--with-tools=mlclient,mlconfig,mlcc,mlterm-menu,mlimgloader,registobmp,mlfc"
      #mlterm-menu and mlconfig depend on enabling gnome3.at-spi2-core
      #and configuring ~/.mlterm/key correctly.
- ] ++ stdenv.lib.optional (libssh2 == null) [
-    "--disable-ssh2"
- ];
+ ] ++ stdenv.lib.optional (libssh2 == null) "--disable-ssh2";
 
   postInstall = ''
     install -D contrib/icon/mlterm-icon.svg "$out/share/icons/hicolor/scalable/apps/mlterm.svg"
diff --git a/pkgs/applications/misc/mysql-workbench/default.nix b/pkgs/applications/misc/mysql-workbench/default.nix
index 443fe2f1d6c..531f8d851f1 100644
--- a/pkgs/applications/misc/mysql-workbench/default.nix
+++ b/pkgs/applications/misc/mysql-workbench/default.nix
@@ -62,10 +62,8 @@ in stdenv.mkDerivation rec {
     patchShebangs tools/get_wb_version.sh
   '';
 
-  NIX_CFLAGS_COMPILE = [
     # error: 'OGRErr OGRSpatialReference::importFromWkt(char**)' is deprecated
-    "-Wno-error=deprecated-declarations"
-  ];
+  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
 
   cmakeFlags = [
     "-DMySQL_CONFIG_PATH=${mysql}/bin/mysql_config"
diff --git a/pkgs/applications/misc/navit/default.nix b/pkgs/applications/misc/navit/default.nix
index 29e768c257f..2263dfc1fbc 100644
--- a/pkgs/applications/misc/navit/default.nix
+++ b/pkgs/applications/misc/navit/default.nix
@@ -35,8 +35,8 @@ stdenv.mkDerivation rec {
 
   patches = [ ./CMakeLists.txt.patch ];
 
-  NIX_CFLAGS_COMPILE = optional sdlSupport "-I${SDL.dev}/include/SDL"
-    ++ optional speechdSupport "-I${speechd}/include/speech-dispatcher";
+  NIX_CFLAGS_COMPILE = toString (optional sdlSupport "-I${SDL.dev}/include/SDL"
+    ++ optional speechdSupport "-I${speechd}/include/speech-dispatcher");
 
   # we choose only cmdline and speech-dispatcher speech options.
   # espeak builtins is made for non-cmdline OS as winCE
diff --git a/pkgs/applications/misc/netsurf/libcss/default.nix b/pkgs/applications/misc/netsurf/libcss/default.nix
index 55538925abd..ed0b7b12e98 100644
--- a/pkgs/applications/misc/netsurf/libcss/default.nix
+++ b/pkgs/applications/misc/netsurf/libcss/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     "NSSHARED=${buildsystem}/share/netsurf-buildsystem"
   ];
 
-  NIX_CFLAGS_COMPILE=[ "-Wno-error=implicit-fallthrough" ];
+  NIX_CFLAGS_COMPILE= "-Wno-error=implicit-fallthrough";
 
   meta = with stdenv.lib; {
     homepage = http://www.netsurf-browser.org/;
diff --git a/pkgs/applications/misc/notify-osd-customizable/default.nix b/pkgs/applications/misc/notify-osd-customizable/default.nix
index 4568c3e8acc..d75ec9ef2c2 100644
--- a/pkgs/applications/misc/notify-osd-customizable/default.nix
+++ b/pkgs/applications/misc/notify-osd-customizable/default.nix
@@ -31,7 +31,7 @@ in stdenv.mkDerivation rec {
     libtool
   ];
 
-  configureFlags = "--libexecdir=$(out)/bin";
+  configureFlags = [ "--libexecdir=$(out)/bin" ];
 
   preFixup = ''
     wrapProgram "$out/bin/notify-osd" \
diff --git a/pkgs/applications/misc/oneko/default.nix b/pkgs/applications/misc/oneko/default.nix
index 3a0a548be0b..1c5858b5677 100644
--- a/pkgs/applications/misc/oneko/default.nix
+++ b/pkgs/applications/misc/oneko/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ xlibsWrapper ];
 
   makeFlags = [ "BINDIR=$(out)/bin" "MANPATH=$(out)/share/man" ];
-  installTargets = "install install.man";
+  installTargets = [ "install" "install.man" ];
 
   meta = with stdenv.lib; {
     description = "Creates a cute cat chasing around your mouse cursor";
diff --git a/pkgs/applications/misc/osm2xmap/default.nix b/pkgs/applications/misc/osm2xmap/default.nix
index 1c19238541c..e5838dc1bbe 100644
--- a/pkgs/applications/misc/osm2xmap/default.nix
+++ b/pkgs/applications/misc/osm2xmap/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     "INSTALL_MANDIR=${placeholder ''out''}/share/man/man1"
   ];
 
-  NIX_CFLAGS_COMPILE = [ "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H" ];
+  NIX_CFLAGS_COMPILE = "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H";
 
   buildInputs = [ libroxml proj libyamlcpp boost ];
 
diff --git a/pkgs/applications/misc/pdfpc/default.nix b/pkgs/applications/misc/pdfpc/default.nix
index 1adab6b70a3..a44cccf9a9d 100644
--- a/pkgs/applications/misc/pdfpc/default.nix
+++ b/pkgs/applications/misc/pdfpc/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ gstreamer gst-plugins-base gtk3 libgee poppler
     libpthreadstubs librsvg pcre ];
 
-  cmakeFlags = stdenv.lib.optionalString stdenv.isDarwin "-DMOVIES=OFF";
+  cmakeFlags = stdenv.lib.optional stdenv.isDarwin "-DMOVIES=OFF";
 
   patches = [
     # Fix build vala 0.46
diff --git a/pkgs/applications/misc/ranger/default.nix b/pkgs/applications/misc/ranger/default.nix
index 5d66df350ad..243913d0a09 100644
--- a/pkgs/applications/misc/ranger/default.nix
+++ b/pkgs/applications/misc/ranger/default.nix
@@ -20,7 +20,7 @@ python3Packages.buildPythonApplication rec {
 
   checkInputs = with python3Packages; [ pytest ];
   propagatedBuildInputs = [ file ]
-    ++ lib.optional (imagePreviewSupport) [ python3Packages.pillow ];
+    ++ lib.optionals (imagePreviewSupport) [ python3Packages.pillow ];
 
   checkPhase = ''
     py.test tests
diff --git a/pkgs/applications/misc/redis-desktop-manager/default.nix b/pkgs/applications/misc/redis-desktop-manager/default.nix
index 71d79b88f44..ac62ccc00cb 100644
--- a/pkgs/applications/misc/redis-desktop-manager/default.nix
+++ b/pkgs/applications/misc/redis-desktop-manager/default.nix
@@ -33,6 +33,8 @@ stdenv.mkDerivation rec {
 
   dontUseQmakeConfigure = true;
 
+  NIX_CFLAGS_COMPILE = [ "-Wno-error=deprecated" ];
+
   # Disable annoying update reminder
   postPatch = ''
     sed -i s/'^\s*initUpdater();'/'\/\/initUpdater():'/ src/app/app.cpp
diff --git a/pkgs/applications/misc/slmenu/default.nix b/pkgs/applications/misc/slmenu/default.nix
index 193bcf205f5..55025621fc7 100644
--- a/pkgs/applications/misc/slmenu/default.nix
+++ b/pkgs/applications/misc/slmenu/default.nix
@@ -1,6 +1,6 @@
 {stdenv, fetchhg}:
 let
-  s = 
+  s =
   rec {
     baseName = "slmenu";
     version = "hg-${date}";
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
   src = fetchhg {
     inherit (s) url sha256;
   };
-  makeFlags = ''PREFIX=$(out)'';
+  makeFlags = [ "PREFIX=$(out)" ];
   meta = {
     inherit (s) version;
     description = ''A console dmenu-like tool'';
diff --git a/pkgs/applications/misc/stupidterm/default.nix b/pkgs/applications/misc/stupidterm/default.nix
index a3247b29fb8..b786b34e955 100644
--- a/pkgs/applications/misc/stupidterm/default.nix
+++ b/pkgs/applications/misc/stupidterm/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
     sha256 = "1f73wvqqvj5pr3fvb7jjc4bi1iwgkkknz24k8n69mdb75jnfjipp";
   };
 
-  makeFlags = "PKGCONFIG=${pkgconfig}/bin/pkg-config binary=stupidterm";
+  makeFlags = [ "PKGCONFIG=${pkgconfig}/bin/pkg-config" "binary=stupidterm" ];
 
   installPhase = ''
     install -D stupidterm $out/bin/stupidterm
diff --git a/pkgs/applications/misc/tangogps/default.nix b/pkgs/applications/misc/tangogps/default.nix
index 08bea18d8e9..10b487828ea 100644
--- a/pkgs/applications/misc/tangogps/default.nix
+++ b/pkgs/applications/misc/tangogps/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ gettext gtk2 gconf curl libexif sqlite libxml2 ];
-  NIX_LDFLAGS = [ "-lm" ];
+  NIX_LDFLAGS = "-lm";
 
   # bogus includes fail with newer library version
   postPatch = ''
diff --git a/pkgs/applications/misc/taskjuggler/2.x/default.nix b/pkgs/applications/misc/taskjuggler/2.x/default.nix
index 6b38c3d59c2..a0dc7b7c71e 100644
--- a/pkgs/applications/misc/taskjuggler/2.x/default.nix
+++ b/pkgs/applications/misc/taskjuggler/2.x/default.nix
@@ -56,9 +56,8 @@ stdenv.mkDerivation rec {
     cp Contrib/emacs/taskjug.el $out/share/emacs/site-lisp/
   '';
 
-  installFlags =
-    # kde_locale is not defined when installing without kde.
-    "kde_locale=\${out}/share/locale";
+  # kde_locale is not defined when installing without kde.
+  installFlags = [ "kde_locale=\${out}/share/locale" ];
 
   meta = {
     homepage = http://www.taskjuggler.org;
diff --git a/pkgs/applications/misc/xsw/default.nix b/pkgs/applications/misc/xsw/default.nix
index aa851e14ab5..c7c10254c0c 100644
--- a/pkgs/applications/misc/xsw/default.nix
+++ b/pkgs/applications/misc/xsw/default.nix
@@ -18,7 +18,7 @@ in stdenv.mkDerivation rec {
 
   buildInputs = [ SDL SDL_image SDL_ttf SDL_gfx ];
 
-  NIX_CFLAGS_COMPILE = makeSDLFlags [ SDL SDL_image SDL_ttf SDL_gfx ];
+  NIX_CFLAGS_COMPILE = toString (makeSDLFlags [ SDL SDL_image SDL_ttf SDL_gfx ]);
 
   patches = [
     ./parse.patch # Fixes compilation error by avoiding redundant definitions.
diff --git a/pkgs/applications/misc/xxkb/default.nix b/pkgs/applications/misc/xxkb/default.nix
index db952758f04..612e4a557a7 100644
--- a/pkgs/applications/misc/xxkb/default.nix
+++ b/pkgs/applications/misc/xxkb/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     "MANDIR=${placeholder "man"}/share/man"
   ];
 
-  installTargets = "install install.man";
+  installTargets = [ "install" "install.man" ];
 
   meta = {
     description = "A keyboard layout indicator and switcher";
diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix
index c6dcd20d62f..66d499e779e 100644
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -156,12 +156,15 @@ stdenv.mkDerivation rec {
                                      AVFoundation MediaToolbox CoreLocation
                                      Foundation libobjc AddressBook cups ];
 
-  NIX_CFLAGS_COMPILE = [
+  NIX_CFLAGS_COMPILE = toString ([
     "-I${glib.dev}/include/gio-unix-2.0"
   ]
   ++ lib.optionals (!isTorBrowserLike) [
     "-I${nss.dev}/include/nss"
-  ];
+  ]
+  ++ lib.optional (pname == "firefox-esr" && lib.versionAtLeast ffversion "68"
+                                          && lib.versionOlder ffversion "69")
+    "-Wno-error=format-security");
 
   postPatch = lib.optionalString (lib.versionAtLeast ffversion "63.0" && !isTorBrowserLike) ''
     substituteInPlace third_party/prio/prio/rand.c --replace 'nspr/prinit.h' 'prinit.h'
@@ -173,7 +176,7 @@ stdenv.mkDerivation rec {
     [ autoconf213 which gnused pkgconfig perl python2 cargo rustc ]
     ++ lib.optional gtk3Support wrapGAppsHook
     ++ lib.optionals stdenv.isDarwin [ xcbuild rsync ]
-    ++ lib.optional  (lib.versionAtLeast ffversion "61.0") [ python3 ]
+    ++ lib.optional  (lib.versionAtLeast ffversion "61.0") python3
     ++ lib.optionals (lib.versionAtLeast ffversion "63.0") [ rust-cbindgen nodejs ]
     ++ lib.optionals (lib.versionAtLeast ffversion "67.0") [ llvmPackages.llvm ] # llvm-objdump is required in version >=67.0
     ++ extraNativeBuildInputs;
diff --git a/pkgs/applications/networking/feedreaders/newsboat/default.nix b/pkgs/applications/networking/feedreaders/newsboat/default.nix
index e24e47f2fe7..e01e4c4fc44 100644
--- a/pkgs/applications/networking/feedreaders/newsboat/default.nix
+++ b/pkgs/applications/networking/feedreaders/newsboat/default.nix
@@ -31,8 +31,8 @@ rustPlatform.buildRustPackage rec {
     make
   '';
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=sign-compare" ]
-    ++ stdenv.lib.optional stdenv.isDarwin "-Wno-error=format-security";
+  NIX_CFLAGS_COMPILE = "-Wno-error=sign-compare"
+    + stdenv.lib.optionalString stdenv.isDarwin " -Wno-error=format-security";
 
   doCheck = true;
 
diff --git a/pkgs/applications/networking/ids/suricata/default.nix b/pkgs/applications/networking/ids/suricata/default.nix
index 7f2a9d71fe5..24c088f7f2e 100644
--- a/pkgs/applications/networking/ids/suricata/default.nix
+++ b/pkgs/applications/networking/ids/suricata/default.nix
@@ -109,12 +109,12 @@ stdenv.mkDerivation rec {
     "--with-libnet-includes=${libnet}/include"
     "--with-libnet-libraries=${libnet}/lib"
   ]
-  ++ lib.optional hyperscanSupport [
+  ++ lib.optionals hyperscanSupport [
     "--with-libhs-includes=${hyperscan.dev}/include/hs"
     "--with-libhs-libraries=${hyperscan}/lib"
   ]
-  ++ lib.optional redisSupport [ "--enable-hiredis" ]
-  ++ lib.optional rustSupport [
+  ++ lib.optional redisSupport "--enable-hiredis"
+  ++ lib.optionals rustSupport [
     "--enable-rust"
     "--enable-rust-experimental"
   ];
@@ -139,7 +139,7 @@ stdenv.mkDerivation rec {
     "sysconfdir=\${out}/etc"
   ];
 
-  installTargets = "install install-conf";
+  installTargets = [ "install" "install-conf" ];
 
   postInstall = ''
     wrapProgram "$out/bin/suricatasc" \
diff --git a/pkgs/applications/networking/instant-messengers/ekiga/default.nix b/pkgs/applications/networking/instant-messengers/ekiga/default.nix
deleted file mode 100644
index 9886c2fa2ed..00000000000
--- a/pkgs/applications/networking/instant-messengers/ekiga/default.nix
+++ /dev/null
@@ -1,73 +0,0 @@
-{ stdenv, glib, fetchurl, fetchpatch, cyrus_sasl, gettext, openldap, ptlib, opal, libXv, rarian, intltool
-, perlPackages, evolution-data-server, gnome-doc-utils, avahi, autoreconfHook
-, libsigcxx, gtk2, dbus-glib, libnotify, libXext, xorgproto, gnome3, boost, libsecret
-, pkgconfig, libxml2, unixODBC, db, nspr, nss, zlib
-, libXrandr, which, libxslt, libtasn1, gmp, nettle, sqlite, makeWrapper }:
-
-stdenv.mkDerivation rec {
-  pname = "ekiga";
-  version = "4.0.1";
-
-  src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "5f4f491c9496cf65ba057a9345d6bb0278f4eca07bcda5baeecf50bfcd9a4a3b";
-  };
-
-  buildInputs = [ cyrus_sasl gettext openldap ptlib opal libXv rarian intltool
-                  evolution-data-server gnome-doc-utils avahi
-                  libsigcxx gtk2 dbus-glib libnotify libXext xorgproto sqlite
-                  gnome3.libsoup glib gnome3.adwaita-icon-theme boost
-                  autoreconfHook pkgconfig libxml2 unixODBC db nspr
-                  nss zlib libsecret libXrandr which libxslt libtasn1
-                  gmp nettle makeWrapper ]
-    ++ (with perlPackages; [ perl XMLParser ]);
-
-  preAutoreconf = ''
-    substituteInPlace configure.ac --replace AM_GCONF_SOURCE_2 ""
-    substituteInPlace configure.ac --replace gnome-icon-theme adwaita-icon-theme
-  '';
-
-  configureFlags = [
-    "--with-ldap-dir=${openldap.dev}"
-    "--with-libsasl2-dir=${cyrus_sasl.dev}"
-    "--with-boost-libdir=${boost.out}/lib"
-    "--disable-gconf"
-  ];
-
-  enableParallelBuilding = true;
-
-  patches = [
-    (fetchpatch { url = https://sources.debian.net/data/main/e/ekiga/4.0.1-7/debian/patches/autofoo.patch;
-      sha256 = "1vyagslws4mm9yfz1m5p1kv9sxmk5lls9vxpm6j72q2ahsgydzx4";
-    })
-    (fetchpatch { url = https://sources.debian.net/data/main/e/ekiga/4.0.1-7/debian/patches/boost.patch;
-      sha256 = "01k0rw8ibrrf9zn9lx6dzbrgy58w089hqxqxqdv9whb65cldlj5s";
-    })
-    (fetchpatch { url = https://src.fedoraproject.org/rpms/ekiga/raw/dbf5f5ba449d22bd79f0394cddb7d4d8a88ec6ac/f/ekiga-4.0.1-libresolv.patch;
-      sha256 = "18wc68im8422ibpa0gkrkgjq41m7hikaha3xqmjs2km45i1cwcaz";
-    })
-  ];
-
-  postInstall = ''
-    wrapProgram "$out"/bin/ekiga \
-      --prefix XDG_DATA_DIRS : "$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH"
-  '';
-
-  passthru = {
-    updateInfo = {
-      downloadPage = "mirror://gnome/sources/ekiga";
-    };
-    updateScript = gnome3.updateScript {
-      packageName = pname;
-    };
-  };
-
-  meta = with stdenv.lib; {
-    description = "VOIP/Videoconferencing app with full SIP and H.323 support";
-    homepage = "https://www.ekiga.org/";
-    maintainers = [ maintainers.raskin ];
-    platforms = platforms.linux;
-    license = licenses.gpl2Plus;
-  };
-}
-
diff --git a/pkgs/applications/networking/instant-messengers/mikutter/default.nix b/pkgs/applications/networking/instant-messengers/mikutter/default.nix
index 5778a2dea3b..7d2037d16a7 100644
--- a/pkgs/applications/networking/instant-messengers/mikutter/default.nix
+++ b/pkgs/applications/networking/instant-messengers/mikutter/default.nix
@@ -27,13 +27,6 @@ stdenv.mkDerivation rec {
     sha256 = "0nx14vlp7p69m2vw0s6kbiyymsfq0r2jd4nm0v5c4xb9avkpgc8g";
   };
 
-  env = bundlerEnv {
-    name = "mikutter-${version}-gems";
-    gemdir = ./.;
-
-    inherit ruby;
-  };
-
   buildInputs = [ alsaUtils libnotify which gtk2 ruby atk gobject-introspection ];
   nativeBuildInputs = [ wrapGAppsHook ];
 
@@ -44,7 +37,14 @@ stdenv.mkDerivation rec {
     rm -rf vendor
   '';
 
-  installPhase = ''
+  installPhase = let
+    env = bundlerEnv {
+      name = "mikutter-${version}-gems";
+      gemdir = ./.;
+
+      inherit ruby;
+    };
+  in ''
     install -v -D -m644 README $out/share/doc/mikutter/README
     install -v -D -m644 LICENSE $out/share/doc/mikutter/LICENSE
     rm -v README LICENSE
diff --git a/pkgs/applications/networking/instant-messengers/pidgin-plugins/pidgin-latex/default.nix b/pkgs/applications/networking/instant-messengers/pidgin-plugins/pidgin-latex/default.nix
index eb6d954eb33..bfd4b1abd5e 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin-plugins/pidgin-latex/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin-plugins/pidgin-latex/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [pkgconfig];
   buildInputs = [gtk2 glib pidgin];
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   postPatch = ''
     sed -e 's/-Wl,-soname//' -i Makefile
diff --git a/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-matrix/default.nix b/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-matrix/default.nix
index 44133e777c7..e9a0812e925 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-matrix/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-matrix/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "1gjm0z4wa5vi9x1xk43rany5pffrwg958n180ahdj9a7sa8a4hpm";
   };
 
-  NIX_CFLAGS_COMPILE = [
+  NIX_CFLAGS_COMPILE = builtins.toString [
     # glib-2.62 deprecations
     "-DGLIB_DISABLE_DEPRECATION_WARNINGS"
     # override "-O0 -Werror" set by build system
diff --git a/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-vk-plugin/default.nix b/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-vk-plugin/default.nix
index a2e59f0c0ff..edb4ca3c349 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-vk-plugin/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-vk-plugin/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
     sed -i -e 's|DESTINATION.*PURPLE_PLUGIN_DIR}|DESTINATION lib/purple-2|' CMakeLists.txt
   '';
 
-  cmakeFlags = "-DCMAKE_INSTALL_PREFIX_INITIALIZED_TO_DEFAULT=1";
+  cmakeFlags = [ "-DCMAKE_INSTALL_PREFIX_INITIALIZED_TO_DEFAULT=1" ];
 
   meta = {
     homepage = https://bitbucket.org/olegoandreev/purple-vk-plugin;
diff --git a/pkgs/applications/networking/instant-messengers/pidgin-plugins/telegram-purple/default.nix b/pkgs/applications/networking/instant-messengers/pidgin-plugins/telegram-purple/default.nix
index ef298883b1b..c38ff8f454e 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin-plugins/telegram-purple/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin-plugins/telegram-purple/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "0p93jpjpx7hszwffzgixw04zkrpsiyzz4za3gfr4j07krc4771fp";
   };
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=cast-function-type" ];
+  NIX_CFLAGS_COMPILE = "-Wno-error=cast-function-type";
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ pidgin libwebp libgcrypt gettext ];
diff --git a/pkgs/applications/networking/instant-messengers/pond/default.nix b/pkgs/applications/networking/instant-messengers/pond/default.nix
index 1ddc603dc62..1d70c9641f8 100644
--- a/pkgs/applications/networking/instant-messengers/pond/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pond/default.nix
@@ -23,7 +23,7 @@ buildGoPackage rec {
   buildInputs = [ trousers gtk3 gtkspell3 ]
     ++ stdenv.lib.optional stdenv.hostPlatform.isx86_64 dclxvi
     ++ stdenv.lib.optionals gui [ wrapGAppsHook ];
-  buildFlags = stdenv.lib.optionalString (!gui) "-tags nogui";
+  buildFlags = stdenv.lib.optionals (!gui) [ "-tags" "nogui" ];
   excludedPackages = "\\(appengine\\|bn256cgo\\)";
   postPatch = stdenv.lib.optionalString stdenv.hostPlatform.isx86_64 ''
     grep -r 'bn256' | awk -F: '{print $1}' | xargs sed -i \
diff --git a/pkgs/applications/networking/instant-messengers/signal-cli/default.nix b/pkgs/applications/networking/instant-messengers/signal-cli/default.nix
index c821c4b0f44..8471f43c6dd 100644
--- a/pkgs/applications/networking/instant-messengers/signal-cli/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-cli/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "082kq8kadxbwzf31fmlq4in714id2irk0hhqsl53vsl3wmv45zvv";
   };
 
-  buildInputs = lib.optional stdenv.isLinux [ libmatthew_java dbus dbus_java ];
+  buildInputs = lib.optionals stdenv.isLinux [ libmatthew_java dbus dbus_java ];
   nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
diff --git a/pkgs/applications/networking/instant-messengers/skype-call-recorder/default.nix b/pkgs/applications/networking/instant-messengers/skype-call-recorder/default.nix
index 3ac2b567a8c..8093f91feb3 100644
--- a/pkgs/applications/networking/instant-messengers/skype-call-recorder/default.nix
+++ b/pkgs/applications/networking/instant-messengers/skype-call-recorder/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
   patches = [ ./conference.patch ];
 
   buildInputs = [ cmake lame id3lib libvorbis qt4 libogg ];
-  NIX_LDFLAGS = [ "-lvorbis" ];
+  NIX_LDFLAGS = "-lvorbis";
 
   meta = {
     homepage = http://atdot.ch/scr/;
diff --git a/pkgs/applications/networking/instant-messengers/swift-im/default.nix b/pkgs/applications/networking/instant-messengers/swift-im/default.nix
index db1d0a54dce..d47b7d00af9 100644
--- a/pkgs/applications/networking/instant-messengers/swift-im/default.nix
+++ b/pkgs/applications/networking/instant-messengers/swift-im/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
 
   propagatedUserEnvPkgs = [ GConf ];
 
-  NIX_CFLAGS_COMPILE = [
+  NIX_CFLAGS_COMPILE = toString [
     "-I${libxml2.dev}/include/libxml2"
     "-I${miniupnpc}/include/miniupnpc"
     "-I${qtwebkit.dev}/include/QtWebKit"
@@ -31,10 +31,8 @@ stdenv.mkDerivation rec {
     "-fpermissive"
   ];
 
-  preInstall = ''
-    installTargets="$out"
-    installFlags+=" SWIFT_INSTALLDIR=$out"
-  '';
+  installTargets = [ (placeholder "out") ];
+  installFlags = [ "SWIFT_INSTALLDIR=${placeholder "out"}" ];
 
   meta = with stdenv.lib; {
     homepage = https://swift.im/;
diff --git a/pkgs/applications/networking/irc/bip/default.nix b/pkgs/applications/networking/irc/bip/default.nix
index 249fdc958c8..43ec0910cc2 100644
--- a/pkgs/applications/networking/irc/bip/default.nix
+++ b/pkgs/applications/networking/irc/bip/default.nix
@@ -23,9 +23,21 @@ stdenv.mkDerivation rec {
       url = "https://projects.duckcorp.org/projects/bip/repository/revisions/39414f8ff9df63c8bc2e4eee34f09f829a5bf8f5/diff/src/connection.c?format=diff";
       sha256 = "1hvg58vci6invh0z19wf04jjvnm8w6f6v4c4nk1j5hc3ymxdp1rb";
     })
+    (fetchpatch {
+      url = "https://projects.duckcorp.org/projects/bip/repository/bip/revisions/87192685f55856d2c28021963ab2c308e21faddc/diff?format=diff";
+      sha256 = "0rspzp7q1lq8v0cl0c35xxpgisfk264i648vslgsjax2s0g9svx0";
+    })
+    (fetchpatch {
+      url = "https://projects.duckcorp.org/projects/bip/repository/bip/revisions/814d54c676d5827f6ea37c1cd2d6e846d080c13c/diff?format=diff";
+      sha256 = "137l77kmm6p9p4c4kvw2zc4xkr10ayyc9z5rlpwn67574h47v55i";
+    })
+    (fetchpatch {
+      url = "https://projects.duckcorp.org/projects/bip/repository/bip/revisions/d2dcb0adb1aa8c2c4526aa6ad650483b0e02ab7d/diff?format=diff";
+      sha256 = "1pvywaljdkmy4870xs6gvsk4qwg69h47qr0yjywbcdsfycrgp8aq";
+    })
   ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=unused-result" "-Wno-error=duplicate-decl-specifier" "-Wno-error=format-truncation" ];
+  NIX_CFLAGS_COMPILE = "-Wno-error=unused-result -Wno-error=duplicate-decl-specifier";
 
   meta = {
     description = "An IRC proxy (bouncer)";
diff --git a/pkgs/applications/networking/irc/quassel/default.nix b/pkgs/applications/networking/irc/quassel/default.nix
index d1b950a7757..f78053bdc37 100644
--- a/pkgs/applications/networking/irc/quassel/default.nix
+++ b/pkgs/applications/networking/irc/quassel/default.nix
@@ -46,7 +46,7 @@ in (if !buildClient then stdenv.mkDerivation else mkDerivation) rec {
   enableParallelBuilding = true;
 
   # Prevent ``undefined reference to `qt_version_tag''' in SSL check
-  NIX_CFLAGS_COMPILE = [ "-DQT_NO_VERSION_TAGGING=1" ];
+  NIX_CFLAGS_COMPILE = "-DQT_NO_VERSION_TAGGING=1";
 
   buildInputs =
        [ cmake makeWrapper qtbase ]
diff --git a/pkgs/applications/networking/irc/sic/default.nix b/pkgs/applications/networking/irc/sic/default.nix
index b081a6b3672..40914295597 100644
--- a/pkgs/applications/networking/irc/sic/default.nix
+++ b/pkgs/applications/networking/irc/sic/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
   pname = "sic";
   version = "1.2";
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
   src = fetchurl {
     url = "https://dl.suckless.org/tools/sic-${version}.tar.gz";
     sha256 = "ac07f905995e13ba2c43912d7a035fbbe78a628d7ba1c256f4ca1372fb565185";
diff --git a/pkgs/applications/networking/mailreaders/mblaze/default.nix b/pkgs/applications/networking/mailreaders/mblaze/default.nix
index 6c3b3a69b1d..ba8f272203b 100644
--- a/pkgs/applications/networking/mailreaders/mblaze/default.nix
+++ b/pkgs/applications/networking/mailreaders/mblaze/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   postInstall = ''
     install -Dm644 -t $out/share/zsh/site-functions contrib/_mblaze
diff --git a/pkgs/applications/networking/mailreaders/sylpheed/default.nix b/pkgs/applications/networking/mailreaders/sylpheed/default.nix
index 986ee5fe3c9..8e1f6720120 100644
--- a/pkgs/applications/networking/mailreaders/sylpheed/default.nix
+++ b/pkgs/applications/networking/mailreaders/sylpheed/default.nix
@@ -21,10 +21,8 @@ stdenv.mkDerivation rec {
     ++ optionals gpgSupport [ gpgme ]
     ++ optionals sslSupport [ openssl ];
 
-  configureFlags = [
-    (optional gpgSupport "--enable-gpgme")
-    (optional sslSupport "--enable-ssl")
-  ];
+  configureFlags = optional gpgSupport "--enable-gpgme"
+    ++ optional sslSupport "--enable-ssl";
 
   meta = {
     homepage = http://sylpheed.sraoss.jp/en/;
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/default.nix b/pkgs/applications/networking/mailreaders/thunderbird/default.nix
index d442452df60..a6c743a85ed 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/default.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/default.nix
@@ -156,6 +156,8 @@ stdenv.mkDerivation rec {
     rm -rf obj-x86_64-pc-linux-gnu
   '';
 
+  hardeningDisable = [ "format" ];
+
   preConfigure = ''
     # remove distributed configuration files
     rm -f configure
diff --git a/pkgs/applications/networking/p2p/frostwire/frostwire-bin.nix b/pkgs/applications/networking/p2p/frostwire/frostwire-bin.nix
index 5488baddef4..d4fbb2ceb59 100644
--- a/pkgs/applications/networking/p2p/frostwire/frostwire-bin.nix
+++ b/pkgs/applications/networking/p2p/frostwire/frostwire-bin.nix
@@ -7,8 +7,8 @@ stdenv.mkDerivation rec {
   pname = "frostwire";
 
   src = fetchurl {
-    url = "https://dl.frostwire.com/frostwire/${version}/frostwire-${version}.noarch.tar.gz";
-    sha256 = "03vxg0qas4mz5ggrmi396nkz44x1kgq8bfbhbr9mnal9ay9qmi8m";
+    url = "https://dl.frostwire.com/frostwire/${version}/frostwire-${version}.amd64.tar.gz";
+    sha256 = "0pd9akfq8cx9qkfkzravvrb8pjaxa4b0vgjdwqc1zvkng4wl8848";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -26,6 +26,6 @@ stdenv.mkDerivation rec {
     description = "BitTorrent Client and Cloud File Downloader";
     license = licenses.gpl2;
     maintainers = with maintainers; [ gavin ];
-    platforms = platforms.all;
+    platforms = [ "x86_64-linux"];
   };
 }
diff --git a/pkgs/applications/networking/remote/putty/default.nix b/pkgs/applications/networking/remote/putty/default.nix
index 8c2d9ac36e9..49182ec182f 100644
--- a/pkgs/applications/networking/remote/putty/default.nix
+++ b/pkgs/applications/networking/remote/putty/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   };
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = [ "-DGLIB_DISABLE_DEPRECATION_WARNINGS" ];
+  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   preConfigure = lib.optionalString stdenv.hostPlatform.isUnix ''
     perl mkfiles.pl
diff --git a/pkgs/applications/networking/sipcmd/default.nix b/pkgs/applications/networking/sipcmd/default.nix
deleted file mode 100644
index a36c2286956..00000000000
--- a/pkgs/applications/networking/sipcmd/default.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{ stdenv, fetchFromGitHub, opal, ptlib }:
-
-stdenv.mkDerivation rec {
-
-  rev = "3090e9f";
-
-  name = "sipcmd-${rev}";
-  
-  src = fetchFromGitHub {
-    repo = "sipcmd";
-    owner = "tmakkonen";
-    inherit rev;
-    sha256 = "072h9qapmz46r8pxbzkfmc4ikd7dv9g8cgrfrw21q942icbrvq2c";
-  };
-
-  buildInputs = [ opal ptlib ];
-
-  buildPhase = ''
-    make IFLAGS="-I${opal}/include/opal -I${ptlib}/include -Isrc/ -L${opal}/lib -L${ptlib}/lib"
-  '';
-
-  installPhase = ''
-    mkdir -pv $out/bin
-    cp sipcmd $out/bin/sipcmd
-  '';
-
-  meta = {
-    homepage = https://github.com/tmakkonen/sipcmd;
-    description = "The command line SIP/H.323/RTP softphone";
-    platforms = with stdenv.lib.platforms; linux;
-    license = stdenv.lib.licenses.gpl2;
-  };
-}
-
diff --git a/pkgs/applications/networking/sync/casync/default.nix b/pkgs/applications/networking/sync/casync/default.nix
index cdec695d90f..82a99bf2df1 100644
--- a/pkgs/applications/networking/sync/casync/default.nix
+++ b/pkgs/applications/networking/sync/casync/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation {
   pname = "casync";
-  version = "2-152-ge4a3c5e";
+  version = "2-219-ga8f6c84";
 
   src = fetchFromGitHub {
     owner  = "systemd";
     repo   = "casync";
-    rev    = "e4a3c5efc8f11e0e99f8cc97bd417665d92b40a9";
-    sha256 = "0zx6zvj5a6rr3w9s207rvpfw7gwssiqmp1p3c75bsirmz4nmsdf0";
+    rev    = "a8f6c841ccfe59ca8c68aad64df170b64042dce8";
+    sha256 = "1i3c9wmpabpmx2wfbcyabmwfa66vz92iq5dlbm89v5mvgavz7bws";
   };
 
   buildInputs = [ acl curl xz zstd ]
diff --git a/pkgs/applications/office/antiword/default.nix b/pkgs/applications/office/antiword/default.nix
index 96a518a7a28..e6c939b277e 100644
--- a/pkgs/applications/office/antiword/default.nix
+++ b/pkgs/applications/office/antiword/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
 
   patches = [ ./10_fix_buffer_overflow_wordole_c.patch ];
 
-  installTargets = "global_install";
+  installTargets = [ "global_install" ];
 
   meta = {
     homepage = http://www.winfield.demon.nl/;
diff --git a/pkgs/applications/office/gnucash/default.nix b/pkgs/applications/office/gnucash/default.nix
index d8fbd4392bd..4373278adab 100644
--- a/pkgs/applications/office/gnucash/default.nix
+++ b/pkgs/applications/office/gnucash/default.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
   propagatedUserEnvPkgs = [ dconf ];
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = [ "-DGLIB_DISABLE_DEPRECATION_WARNINGS" ];
+  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   patches = [ ./cmake_check_symbol_exists.patch ];
 
diff --git a/pkgs/applications/office/libreoffice/default.nix b/pkgs/applications/office/libreoffice/default.nix
index 374810138f6..c8bb58d2921 100644
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@@ -57,7 +57,7 @@ in (stdenv.mkDerivation rec {
 
   # For some reason librdf_redland sometimes refers to rasqal.h instead
   # of rasqal/rasqal.h
-  NIX_CFLAGS_COMPILE = [ "-I${librdf_rasqal}/include/rasqal" ] ++ lib.optional stdenv.isx86_64 "-mno-fma";
+  NIX_CFLAGS_COMPILE = "-I${librdf_rasqal}/include/rasqal";
 
   patches = [
     ./xdg-open-brief.patch
@@ -248,7 +248,7 @@ in (stdenv.mkDerivation rec {
     find -name "*.cmd" -exec sed -i s,/lib:/usr/lib,, {} \;
     '';
 
-  makeFlags = "SHELL=${bash}/bin/bash";
+  makeFlags = [ "SHELL=${bash}/bin/bash" ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/applications/office/libreoffice/src-fresh/override.nix b/pkgs/applications/office/libreoffice/src-fresh/override.nix
index fb5a82b1aa8..464965121d9 100644
--- a/pkgs/applications/office/libreoffice/src-fresh/override.nix
+++ b/pkgs/applications/office/libreoffice/src-fresh/override.nix
@@ -1 +1,4 @@
-args: f: {}
+{ stdenv, ... }:
+attrs: {
+  NIX_CFLAGS_COMPILE = attrs.NIX_CFLAGS_COMPILE + stdenv.lib.optionalString stdenv.isx86_64 " -mno-fma";
+}
diff --git a/pkgs/applications/office/libreoffice/src-still/override.nix b/pkgs/applications/office/libreoffice/src-still/override.nix
index 9edf76849e3..7192af01949 100644
--- a/pkgs/applications/office/libreoffice/src-still/override.nix
+++ b/pkgs/applications/office/libreoffice/src-still/override.nix
@@ -1,7 +1,6 @@
 { stdenv, ... }:
 attrs:
 {
-  NIX_CFLAGS_COMPILE = stdenv.lib.lists.remove "-mno-fma" attrs.NIX_CFLAGS_COMPILE;
   configureFlags = stdenv.lib.lists.remove "--without-export-validation" attrs.configureFlags;
   meta = attrs.meta // { description = "Comprehensive, professional-quality productivity suite (Still/Stable release)"; };
 }
diff --git a/pkgs/applications/office/notes-up/default.nix b/pkgs/applications/office/notes-up/default.nix
index 6b8694a91d4..1d2e581f3c9 100644
--- a/pkgs/applications/office/notes-up/default.nix
+++ b/pkgs/applications/office/notes-up/default.nix
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
   ];
 
   # Whether to build with contractor support (Pantheon specific)
-  cmakeFlags = if withPantheon then null else [ "-Dnoele=yes" ];
+  cmakeFlags = stdenv.lib.optional (!withPantheon) "-Dnoele=yes";
 
   passthru = {
     updateScript = pantheon.updateScript {
diff --git a/pkgs/applications/office/planner/default.nix b/pkgs/applications/office/planner/default.nix
index f454d8830cb..6189132d0f9 100644
--- a/pkgs/applications/office/planner/default.nix
+++ b/pkgs/applications/office/planner/default.nix
@@ -46,7 +46,7 @@ in stdenv.mkDerivation {
   ];
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = [ "-DGLIB_DISABLE_DEPRECATION_WARNINGS" ];
+  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   preConfigure = ''./autogen.sh'';
   configureFlags = [
diff --git a/pkgs/applications/office/trilium/default.nix b/pkgs/applications/office/trilium/default.nix
index d44b51861dc..28548091f6e 100644
--- a/pkgs/applications/office/trilium/default.nix
+++ b/pkgs/applications/office/trilium/default.nix
@@ -48,7 +48,7 @@ in {
       wrapGAppsHook
     ];
   
-    buildInputs = [ atomEnv.packages gtk3 ];
+    buildInputs = atomEnv.packages ++ [ gtk3 ];
   
     installPhase = ''
       mkdir -p $out/bin
diff --git a/pkgs/applications/radio/dmrconfig/default.nix b/pkgs/applications/radio/dmrconfig/default.nix
index f718854224c..68b4cfe8af4 100644
--- a/pkgs/applications/radio/dmrconfig/default.nix
+++ b/pkgs/applications/radio/dmrconfig/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
       --replace /usr/local/bin/dmrconfig $out/bin/dmrconfig
   '';
 
-  makeFlags = "VERSION=${version} GITCOUNT=0";
+  makeFlags = [ "VERSION=${version}" "GITCOUNT=0" ];
 
   installPhase = ''
     mkdir -p $out/bin $out/lib/udev/rules.d
diff --git a/pkgs/applications/radio/gnuradio/default.nix b/pkgs/applications/radio/gnuradio/default.nix
index 016540c1e67..f5c89ae51ce 100644
--- a/pkgs/applications/radio/gnuradio/default.nix
+++ b/pkgs/applications/radio/gnuradio/default.nix
@@ -50,9 +50,7 @@ stdenv.mkDerivation rec {
     Mako cheetah numpy scipy matplotlib pyqt4 pygtk wxPython pyopengl
   ];
 
-  NIX_LDFLAGS = [
-    "-lpthread"
-  ];
+  NIX_LDFLAGS = "-lpthread";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/applications/radio/xlog/default.nix b/pkgs/applications/radio/xlog/default.nix
index 3434c0624ed..2268cdf725d 100644
--- a/pkgs/applications/radio/xlog/default.nix
+++ b/pkgs/applications/radio/xlog/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
   };
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = [ "-DGLIB_DISABLE_DEPRECATION_WARNINGS" ];
+  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   buildInputs = [ glib pkgconfig gtk2 hamlib ];
 
diff --git a/pkgs/applications/science/astronomy/xearth/default.nix b/pkgs/applications/science/astronomy/xearth/default.nix
index e9fc0607998..752e25b4d8d 100644
--- a/pkgs/applications/science/astronomy/xearth/default.nix
+++ b/pkgs/applications/science/astronomy/xearth/default.nix
@@ -12,8 +12,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ imake gccmakedep ];
   buildInputs = [ libXt libXext ];
 
-  installFlags=[ "DESTDIR=$(out)/" "BINDIR=bin" "MANDIR=man/man1"];
-  installTargets="install install.man";
+  installFlags = [ "DESTDIR=$(out)/" "BINDIR=bin" "MANDIR=man/man1"];
+  installTargets = [ "install" "install.man" ];
 
   meta = with stdenv.lib; {
     description = "sets the X root window to an image of the Earth";
diff --git a/pkgs/applications/science/biology/megahit/default.nix b/pkgs/applications/science/biology/megahit/default.nix
index 56bb35b64df..86414980177 100644
--- a/pkgs/applications/science/biology/megahit/default.nix
+++ b/pkgs/applications/science/biology/megahit/default.nix
@@ -1,23 +1,20 @@
-{ stdenv, fetchFromGitHub, zlib }:
+{ stdenv, fetchFromGitHub, cmake, zlib }:
 
 stdenv.mkDerivation rec {
   pname    = "megahit";
-  version = "1.1.4";
+  version = "1.2.9";
 
   src = fetchFromGitHub {
     owner = "voutcn";
     repo = "megahit";
     rev = "v${version}";
-    sha256 = "011k0776w76l03zmy70kfd3y9zjmdnspfbs9fcxmnl3bdwd36kcw";
+    sha256 = "1r5d9nkdmgjsbrpj43q9hy3s8jwsabaz3ji561v18hy47v58923c";
   };
 
+  nativeBuildInputs = [ cmake ];
   buildInputs = [ zlib ];
 
-  installPhase = ''
-    for bin in megahit_sdbg_build megahit megahit_asm_core megahit_toolkit; do
-        install -vD $bin $out/bin/$bin
-    done
-  '';
+  enableParallelBuilding = true;
 
   meta = with stdenv.lib; {
     description = "An ultra-fast single-node solution for large and complex metagenomics assembly via succinct de Bruijn graph";
diff --git a/pkgs/applications/science/biology/niftyreg/default.nix b/pkgs/applications/science/biology/niftyreg/default.nix
index 6379f2c3282..48bd1b21ecd 100644
--- a/pkgs/applications/science/biology/niftyreg/default.nix
+++ b/pkgs/applications/science/biology/niftyreg/default.nix
@@ -9,6 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "07v9v9s41lvw72wpb1jgh2nzanyc994779bd35p76vg8mzifmprl";
   };
 
+  NIX_CFLAGS_COMPILE = [ "-Wno-error=narrowing" ];
+
   nativeBuildInputs = [ cmake ];
   buildInputs = [ zlib ];
   enableParallelBuilding = true;
diff --git a/pkgs/applications/science/biology/strelka/default.nix b/pkgs/applications/science/biology/strelka/default.nix
index cb83b19269b..184dcb48a0d 100644
--- a/pkgs/applications/science/biology/strelka/default.nix
+++ b/pkgs/applications/science/biology/strelka/default.nix
@@ -14,7 +14,10 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake ];
   buildInputs = [ zlib python2 ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=maybe-uninitialized" ];
+  NIX_CFLAGS_COMPILE = [
+    "-Wno-error=maybe-uninitialized"
+    "-Wno-error=pessimizing-move"
+  ];
 
   preConfigure = ''
     sed -i 's|/usr/bin/env python|${python2}/bin/python|' src/python/lib/makeRunScript.py
diff --git a/pkgs/applications/science/biology/sumatools/default.nix b/pkgs/applications/science/biology/sumatools/default.nix
index f9042f30011..5230fcd2eb6 100644
--- a/pkgs/applications/science/biology/sumatools/default.nix
+++ b/pkgs/applications/science/biology/sumatools/default.nix
@@ -22,7 +22,7 @@ in rec {
       rev = "sumalib_v${version}";
       sha256 = "0hwkrxzfz7m5wdjvmrhkjg8kis378iaqr5n4nhdhkwwhn8x1jn5a";
     };
-    makeFlags = "PREFIX=$(out)";
+    makeFlags = [ "PREFIX=$(out)" ];
     inherit meta;
   };
 
diff --git a/pkgs/applications/science/logic/avy/default.nix b/pkgs/applications/science/logic/avy/default.nix
index 9b59828ddab..b43e0c6fbf1 100644
--- a/pkgs/applications/science/logic/avy/default.nix
+++ b/pkgs/applications/science/logic/avy/default.nix
@@ -12,14 +12,14 @@ stdenv.mkDerivation {
   };
 
   buildInputs = [ cmake zlib boost.out boost.dev ];
-  NIX_CFLAGS_COMPILE = [ "-Wno-narrowing" ]
+  NIX_CFLAGS_COMPILE = toString ([ "-Wno-narrowing" ]
     # Squelch endless stream of warnings on same few things
     ++ stdenv.lib.optionals stdenv.cc.isClang [
       "-Wno-empty-body"
       "-Wno-tautological-compare"
       "-Wc++11-compat-deprecated-writable-strings"
       "-Wno-deprecated"
-    ];
+    ]);
 
   prePatch = ''
     sed -i -e '1i#include <stdint.h>' abc/src/bdd/dsd/dsd.h
diff --git a/pkgs/applications/science/logic/coq/default.nix b/pkgs/applications/science/logic/coq/default.nix
index 2378cb9408e..ac001540e09 100644
--- a/pkgs/applications/science/logic/coq/default.nix
+++ b/pkgs/applications/science/logic/coq/default.nix
@@ -143,7 +143,7 @@ self = stdenv.mkDerivation {
 
   prefixKey = "-prefix ";
 
-  buildFlags = "revision coq coqide bin/votour";
+  buildFlags = [ "revision" "coq" "coqide" "bin/votour" ];
 
   createFindlibDestdir = true;
 
diff --git a/pkgs/applications/science/logic/minisat/clang.diff b/pkgs/applications/science/logic/minisat/clang.diff
deleted file mode 100644
index 5b5072c71f3..00000000000
--- a/pkgs/applications/science/logic/minisat/clang.diff
+++ /dev/null
@@ -1,45 +0,0 @@
-diff -aur minisat/core/SolverTypes.h minisat.clang/core/SolverTypes.h
---- minisat/core/SolverTypes.h	2010-07-10 18:07:36.000000000 +0200
-+++ minisat.clang/core/SolverTypes.h	2016-05-13 12:14:50.759671959 +0200
-@@ -47,7 +47,7 @@
-     int     x;
- 
-     // Use this as a constructor:
--    friend Lit mkLit(Var var, bool sign = false);
-+    //friend Lit mkLit(Var var, bool sign = false);
- 
-     bool operator == (Lit p) const { return x == p.x; }
-     bool operator != (Lit p) const { return x != p.x; }
-@@ -55,7 +55,7 @@
- };
- 
- 
--inline  Lit  mkLit     (Var var, bool sign) { Lit p; p.x = var + var + (int)sign; return p; }
-+inline  Lit  mkLit     (Var var, bool sign = false) { Lit p; p.x = var + var + (int)sign; return p; }
- inline  Lit  operator ~(Lit p)              { Lit q; q.x = p.x ^ 1; return q; }
- inline  Lit  operator ^(Lit p, bool b)      { Lit q; q.x = p.x ^ (unsigned int)b; return q; }
- inline  bool sign      (Lit p)              { return p.x & 1; }
-diff -aur minisat/utils/Options.h minisat.clang/utils/Options.h
---- minisat/utils/Options.h	2010-07-10 18:07:36.000000000 +0200
-+++ minisat.clang/utils/Options.h	2016-05-13 12:14:50.759671959 +0200
-@@ -282,15 +282,15 @@
-         if (range.begin == INT64_MIN)
-             fprintf(stderr, "imin");
-         else
--            fprintf(stderr, "%4"PRIi64, range.begin);
-+            fprintf(stderr, "%4" PRIi64, range.begin);
- 
-         fprintf(stderr, " .. ");
-         if (range.end == INT64_MAX)
-             fprintf(stderr, "imax");
-         else
--            fprintf(stderr, "%4"PRIi64, range.end);
-+            fprintf(stderr, "%4" PRIi64, range.end);
- 
--        fprintf(stderr, "] (default: %"PRIi64")\n", value);
-+        fprintf(stderr, "] (default: %" PRIi64 ")\n", value);
-         if (verbose){
-             fprintf(stderr, "\n        %s\n", description);
-             fprintf(stderr, "\n");
-Only in minisat.clang/utils: Options.o
-Only in minisat.clang/utils: System.o
diff --git a/pkgs/applications/science/logic/minisat/darwin.patch b/pkgs/applications/science/logic/minisat/darwin.patch
deleted file mode 100644
index f2b618d6bb3..00000000000
--- a/pkgs/applications/science/logic/minisat/darwin.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-https://github.com/fasterthanlime/homebrew-mingw/blob/master/Library/Formula/minisat.rb
-
-diff --git a/utils/System.cc b/utils/System.cc
-index a7cf53f..feeaf3c 100644
---- a/utils/System.cc
-+++ b/utils/System.cc
-@@ -78,16 +78,17 @@ double Minisat::memUsed(void) {
-     struct rusage ru;
-     getrusage(RUSAGE_SELF, &ru);
-     return (double)ru.ru_maxrss / 1024; }
--double MiniSat::memUsedPeak(void) { return memUsed(); }
-+double Minisat::memUsedPeak(void) { return memUsed(); }
- 
- 
- #elif defined(__APPLE__)
- #include <malloc/malloc.h>
- 
--double Minisat::memUsed(void) {
-+double Minisat::memUsed() {
-     malloc_statistics_t t;
-     malloc_zone_statistics(NULL, &t);
-     return (double)t.max_size_in_use / (1024*1024); }
-+double Minisat::memUsedPeak() { return memUsed(); }
- 
- #else
- double Minisat::memUsed() { 
diff --git a/pkgs/applications/science/logic/minisat/default.nix b/pkgs/applications/science/logic/minisat/default.nix
index 34051a1da40..6b642832b83 100644
--- a/pkgs/applications/science/logic/minisat/default.nix
+++ b/pkgs/applications/science/logic/minisat/default.nix
@@ -1,27 +1,19 @@
-{ stdenv, fetchurl, zlib }:
+{ stdenv, fetchFromGitHub, cmake, zlib }:
 
 stdenv.mkDerivation rec {
   pname = "minisat";
-  version = "2.2.0";
+  version = "2.2.1";
 
-  src = fetchurl {
-    url = "http://minisat.se/downloads/${pname}-${version}.tar.gz";
-    sha256 = "023qdnsb6i18yrrawlhckm47q8x0sl7chpvvw3gssfyw3j2pv5cj";
+  src = fetchFromGitHub {
+    owner = "stp";
+    repo = pname;
+    rev = "releases/${version}";
+    sha256 = "14vcbjnlia00lpyv2fhbmw3wbc9bk9h7bln9zpyc3nwiz5cbjz4a";
   };
 
-  patches =
-    [ ./darwin.patch ]
-    ++ stdenv.lib.optionals stdenv.cc.isClang [ ./clang.diff ];
-
+  nativeBuildInputs = [ cmake ];
   buildInputs = [ zlib ];
 
-  preBuild = "cd simp";
-  makeFlags = [ "r" "MROOT=.." ];
-  installPhase = ''
-    mkdir -p $out/bin
-    cp minisat_release $out/bin/minisat
-  '';
-
   meta = with stdenv.lib; {
     description = "Compact and readable SAT solver";
     maintainers = with maintainers; [ gebner raskin ];
diff --git a/pkgs/applications/science/logic/minisat/unstable.nix b/pkgs/applications/science/logic/minisat/unstable.nix
deleted file mode 100644
index ef46c694acb..00000000000
--- a/pkgs/applications/science/logic/minisat/unstable.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-{ stdenv, fetchFromGitHub, zlib, cmake }:
-
-stdenv.mkDerivation {
-  name = "minisat-unstable-2013-09-25";
-
-  src = fetchFromGitHub {
-    owner = "niklasso";
-    repo = "minisat";
-    rev = "37dc6c67e2af26379d88ce349eb9c4c6160e8543";
-    sha256 = "091hf3qkm197s5r7xcr3m07xsdwyz2rqk1hc9kj0hn13imz09irq";
-  };
-
-  buildInputs = [ zlib ];
-  nativeBuildInputs =  [ cmake ];
-
-  meta = with stdenv.lib; {
-    description = "Compact and readable SAT solver";
-    maintainers = with maintainers; [ mic92 ];
-    platforms = platforms.unix;
-    license = licenses.mit;
-    homepage = http://minisat.se/;
-  };
-}
diff --git a/pkgs/applications/science/logic/prover9/default.nix b/pkgs/applications/science/logic/prover9/default.nix
index a4538e1070a..9528a5942a4 100644
--- a/pkgs/applications/science/logic/prover9/default.nix
+++ b/pkgs/applications/science/logic/prover9/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
     done
   '';
 
-  buildFlags = "all";
+  buildFlags = [ "all" ];
 
   checkPhase = "make test1";
 
diff --git a/pkgs/applications/science/logic/stp/default.nix b/pkgs/applications/science/logic/stp/default.nix
index 0ea659d1927..dd00eda1b57 100644
--- a/pkgs/applications/science/logic/stp/default.nix
+++ b/pkgs/applications/science/logic/stp/default.nix
@@ -1,4 +1,5 @@
-{ stdenv, cmake, boost, bison, flex, fetchFromGitHub, perl, python3, python3Packages, zlib, minisatUnstable, cryptominisat }:
+{ stdenv, cmake, boost, bison, flex, fetchFromGitHub, perl
+, python3, python3Packages, zlib, minisat, cryptominisat }:
 
 stdenv.mkDerivation rec {
   pname = "stp";
@@ -11,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "1yg2v4wmswh1sigk47drwsxyayr472mf4i47lqmlcgn9hhbx1q87";
   };
 
-  buildInputs = [ boost zlib minisatUnstable cryptominisat python3 ];
+  buildInputs = [ boost zlib minisat cryptominisat python3 ];
   nativeBuildInputs = [ cmake bison flex perl ];
   preConfigure = ''
     python_install_dir=$out/${python3Packages.python.sitePackages}
diff --git a/pkgs/applications/science/math/calculix/default.nix b/pkgs/applications/science/math/calculix/default.nix
index 24d5f99ec32..6f2d61cd80f 100644
--- a/pkgs/applications/science/math/calculix/default.nix
+++ b/pkgs/applications/science/math/calculix/default.nix
@@ -13,9 +13,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ arpack spooles openblas ];
 
-  NIX_CFLAGS_COMPILE = [
-    "-I${spooles}/include/spooles"
-  ];
+  NIX_CFLAGS_COMPILE = "-I${spooles}/include/spooles";
 
   patches = [
     ./calculix.patch
diff --git a/pkgs/applications/science/math/msieve/default.nix b/pkgs/applications/science/math/msieve/default.nix
index 6e1926810df..643d990feb8 100644
--- a/pkgs/applications/science/math/msieve/default.nix
+++ b/pkgs/applications/science/math/msieve/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
   ECM = if ecm == null then "0" else "1";
 
   # Doesn't hurt Linux but lets clang-based platforms like Darwin work fine too
-  makeFlags = "CC=cc all";
+  makeFlags = [ "CC=cc" "all" ];
 
   installPhase = ''
     mkdir -p $out/bin/
diff --git a/pkgs/applications/science/math/polymake/default.nix b/pkgs/applications/science/math/polymake/default.nix
index fdc4de7b028..d4f13f84f81 100644
--- a/pkgs/applications/science/math/polymake/default.nix
+++ b/pkgs/applications/science/math/polymake/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     makeWrapper ninja ant perl
   ];
 
-  ninjaFlags = "-C build/Opt";
+  ninjaFlags = [ "-C" "build/Opt" ];
 
   postInstall = ''
     for i in "$out"/bin/*; do
diff --git a/pkgs/applications/science/math/ries/default.nix b/pkgs/applications/science/math/ries/default.nix
index 4b237a01a3e..b244ee75b30 100644
--- a/pkgs/applications/science/math/ries/default.nix
+++ b/pkgs/applications/science/math/ries/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation {
     sha256 = "1h2wvd4k7f0l0i1vm9niz453xdbcs3nxccmri50qyrzzzc1b0842";
   };
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with stdenv.lib; {
     homepage = https://mrob.com/pub/ries/;
diff --git a/pkgs/applications/science/math/scilab/default.nix b/pkgs/applications/science/math/scilab/default.nix
index 432280a18fb..02f1f4e58a9 100644
--- a/pkgs/applications/science/math/scilab/default.nix
+++ b/pkgs/applications/science/math/scilab/default.nix
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
     ++ lib.optional (!withXaw3d) "--with-local-xaw"
   ;
 
-  makeFlags = "all";
+  makeFlags = [ "all" ];
 
   meta = {
     homepage = http://www.scilab.org/;
diff --git a/pkgs/applications/science/misc/colmap/default.nix b/pkgs/applications/science/misc/colmap/default.nix
index 672569ed100..da118f6bca5 100644
--- a/pkgs/applications/science/misc/colmap/default.nix
+++ b/pkgs/applications/science/misc/colmap/default.nix
@@ -1,11 +1,11 @@
-{ mkDerivation, lib, fetchFromGitHub, cmake, boost, ceres-solver, eigen,
+{ mkDerivation, lib, fetchpatch, fetchFromGitHub, cmake, boost, ceres-solver, eigen,
   freeimage, glog, libGLU, glew, qtbase,
   cudaSupport ? false, cudatoolkit ? null }:
 
 assert !cudaSupport || cudatoolkit != null;
 
 let boost_static = boost.override { enableStatic = true; };
-in 
+in
 mkDerivation rec {
   version = "3.5";
   pname = "colmap";
@@ -15,7 +15,14 @@ mkDerivation rec {
      rev = version;
      sha256 = "1vnb62p0y2bnga173wmjs0lnyqdjikv0fkcxjzxm8187khk2lly8";
   };
-  
+
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/colmap/colmap/commit/6af3d8b0048cecc3b9fc6f4e78c3214dd038180b.patch";
+      sha256 = "1zv5girmv4hv78w1xn131v8njwhpbyylc1m15731lnhrs8bri0jq";
+    })
+  ];
+
   buildInputs = [
     boost_static ceres-solver eigen
     freeimage glog libGLU glew qtbase
diff --git a/pkgs/applications/science/misc/megam/default.nix b/pkgs/applications/science/misc/megam/default.nix
index f86bed854a2..6cdc86d20eb 100644
--- a/pkgs/applications/science/misc/megam/default.nix
+++ b/pkgs/applications/science/misc/megam/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ makeWrapper ];
 
-  makeFlags = "CAML_INCLUDES=${ocaml}/lib/ocaml/caml";
+  makeFlags = [ "CAML_INCLUDES=${ocaml}/lib/ocaml/caml" ];
 
   # see https://bugzilla.redhat.com/show_bug.cgi?id=435559
   dontStrip = true;
diff --git a/pkgs/applications/science/misc/simgrid/default.nix b/pkgs/applications/science/misc/simgrid/default.nix
index 58f464575b0..44b0f5d84b6 100644
--- a/pkgs/applications/science/misc/simgrid/default.nix
+++ b/pkgs/applications/science/misc/simgrid/default.nix
@@ -54,28 +54,28 @@ stdenv.mkDerivation rec {
   #
   # For more information see:
   # https://simgrid.org/doc/3.22/Installing_SimGrid.html#simgrid-compilation-options)
-  cmakeFlags= ''
-    -Denable_documentation=${optionOnOff buildDocumentation}
-    -Denable_java=${optionOnOff buildJavaBindings}
-    -Denable_fortran=${optionOnOff fortranSupport}
-    -Denable_model-checking=${optionOnOff modelCheckingSupport}
-    -Denable_ns3=off
-    -Denable_lua=off
-    -Denable_lib_in_jar=off
-    -Denable_maintainer_mode=off
-    -Denable_mallocators=on
-    -Denable_debug=on
-    -Denable_smpi=on
-    -Denable_smpi_ISP_testsuite=${optionOnOff moreTests}
-    -Denable_smpi_MPICH3_testsuite=${optionOnOff moreTests}
-    -Denable_compile_warnings=${optionOnOff debug}
-    -Denable_compile_optimizations=${optionOnOff (!debug)}
-    -Denable_lto=${optionOnOff (!debug)}
-  '';
-  # -Denable_lua=${optionOnOff luaSupport}
-  # -Denable_smpi_papi=${optionOnOff moreTests}
+  cmakeFlags = [
+    "-Denable_documentation=${optionOnOff buildDocumentation}"
+    "-Denable_java=${optionOnOff buildJavaBindings}"
+    "-Denable_fortran=${optionOnOff fortranSupport}"
+    "-Denable_model-checking=${optionOnOff modelCheckingSupport}"
+    "-Denable_ns3=off"
+    "-Denable_lua=off"
+    "-Denable_lib_in_jar=off"
+    "-Denable_maintainer_mode=off"
+    "-Denable_mallocators=on"
+    "-Denable_debug=on"
+    "-Denable_smpi=on"
+    "-Denable_smpi_ISP_testsuite=${optionOnOff moreTests}"
+    "-Denable_smpi_MPICH3_testsuite=${optionOnOff moreTests}"
+    "-Denable_compile_warnings=${optionOnOff debug}"
+    "-Denable_compile_optimizations=${optionOnOff (!debug)}"
+    "-Denable_lto=${optionOnOff (!debug)}"
+    # "-Denable_lua=${optionOnOff luaSupport}"
+    # "-Denable_smpi_papi=${optionOnOff moreTests}"
+  ];
 
-  makeFlags = optionalString debug "VERBOSE=1";
+  makeFlags = optional debug "VERBOSE=1";
 
   # Some Perl scripts are called to generate test during build which
   # is before the fixupPhase, so do this manualy here:
diff --git a/pkgs/applications/science/physics/xfitter/default.nix b/pkgs/applications/science/physics/xfitter/default.nix
index 2af93961e02..818bea7d0ff 100644
--- a/pkgs/applications/science/physics/xfitter/default.nix
+++ b/pkgs/applications/science/physics/xfitter/default.nix
@@ -2,19 +2,20 @@
 
 stdenv.mkDerivation rec {
   pname = "xfitter";
-  version = "2.0.0";
+  version = "2.0.1";
 
   src = fetchurl {
     name = "${pname}-${version}.tgz";
     url = "https://www.xfitter.org/xFitter/xFitter/DownloadPage?action=AttachFile&do=get&target=${pname}-${version}.tgz";
-    sha256 = "0j47s8laq3aqjlgp769yicvgyzqjb738a3rqss51d9fjrihi2515";
+    sha256 = "0kmgc67nw5flp92yw5x6l2vsnhwsfi5z2a20404anisdgdjs8zc6";
   };
 
   patches = [
     ./undefined_behavior.patch
   ];
 
-  CXXFLAGS = "-Werror=return-type";
+  # patch needs to updated due to version bump
+  #CXXFLAGS = "-Werror=return-type";
 
   preConfigure =
   # Fix F77LD to workaround for a following build error:
diff --git a/pkgs/applications/version-management/git-and-tools/git-imerge/default.nix b/pkgs/applications/version-management/git-and-tools/git-imerge/default.nix
index 76b29135f66..528a96c9903 100644
--- a/pkgs/applications/version-management/git-and-tools/git-imerge/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-imerge/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ pythonPackages.python pythonPackages.wrapPython ];
 
-  makeFlags = "PREFIX= DESTDIR=$(out)" ; 
+  makeFlags = [ "PREFIX=" "DESTDIR=$(out)" ] ; 
  
   meta = with stdenv.lib; {
     homepage = https://github.com/mhagger/git-imerge;
diff --git a/pkgs/applications/version-management/git-and-tools/git-remote-hg/default.nix b/pkgs/applications/version-management/git-and-tools/git-remote-hg/default.nix
index 6df3a97dbbb..28e63c4f166 100644
--- a/pkgs/applications/version-management/git-and-tools/git-remote-hg/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-remote-hg/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   doCheck = false;
 
-  installFlags = "HOME=\${out} install-doc";
+  installFlags = [ "HOME=\${out}" "install-doc" ];
 
   postInstall = ''
     wrapProgram $out/bin/git-remote-hg \
diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index 312879a49e8..7c46d26bf5b 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -114,7 +114,7 @@ stdenv.mkDerivation {
   # WARNING: Do not `rm` or `mv` files from the source tree; use `cp` instead.
   #          We need many of these files during the installCheckPhase.
 
-  installFlags = "NO_INSTALL_HARDLINKS=1";
+  installFlags = [ "NO_INSTALL_HARDLINKS=1" ];
 
   preInstall = (stdenv.lib.optionalString stdenv.isDarwin ''
     mkdir -p $out/bin
diff --git a/pkgs/applications/version-management/git-and-tools/stgit/default.nix b/pkgs/applications/version-management/git-and-tools/stgit/default.nix
index 660c391c0d5..3a354133e87 100644
--- a/pkgs/applications/version-management/git-and-tools/stgit/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/stgit/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ python2 git ];
 
-  makeFlags = "prefix=$$out";
+  makeFlags = [ "prefix=$$out" ];
 
   postInstall = ''
     mkdir -p "$out/etc/bash_completion.d/"
diff --git a/pkgs/applications/version-management/git-and-tools/svn-all-fast-export/default.nix b/pkgs/applications/version-management/git-and-tools/svn-all-fast-export/default.nix
index 3c7784e8506..45b427341a2 100644
--- a/pkgs/applications/version-management/git-and-tools/svn-all-fast-export/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/svn-all-fast-export/default.nix
@@ -23,9 +23,7 @@ stdenv.mkDerivation {
     "SVN_INCLUDE=${subversion.dev}/include/subversion-1"
   ];
 
-  NIX_LDFLAGS = [
-    "-lsvn_fs-1"
-  ];
+  NIX_LDFLAGS = "-lsvn_fs-1";
 
   meta = with stdenv.lib; {
     homepage = https://github.com/svn-all-fast-export/svn2git;
diff --git a/pkgs/applications/version-management/gogs/default.nix b/pkgs/applications/version-management/gogs/default.nix
index c2153ebea89..d06ae234ae9 100644
--- a/pkgs/applications/version-management/gogs/default.nix
+++ b/pkgs/applications/version-management/gogs/default.nix
@@ -27,7 +27,7 @@ buildGoPackage rec {
   nativeBuildInputs = [ makeWrapper ]
     ++ optional pamSupport pam;
 
-  buildFlags = "-tags";
+  buildFlags = [ "-tags" ];
 
   buildFlagsArray =
     (  optional sqliteSupport "sqlite"
diff --git a/pkgs/applications/version-management/mr/default.nix b/pkgs/applications/version-management/mr/default.nix
index a4632399df0..66e63fcc375 100644
--- a/pkgs/applications/version-management/mr/default.nix
+++ b/pkgs/applications/version-management/mr/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ perl ];
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   meta = {
     description = "Multiple Repository management tool";
diff --git a/pkgs/applications/version-management/nbstripout/default.nix b/pkgs/applications/version-management/nbstripout/default.nix
index b0a7108ac07..797bc782496 100644
--- a/pkgs/applications/version-management/nbstripout/default.nix
+++ b/pkgs/applications/version-management/nbstripout/default.nix
@@ -1,6 +1,6 @@
-{lib, python2Packages, git, mercurial, coreutils}:
+{lib, python, git, mercurial, coreutils}:
 
-with python2Packages;
+with python.pkgs;
 buildPythonApplication rec {
   version = "0.3.6";
   pname = "nbstripout";
@@ -8,7 +8,7 @@ buildPythonApplication rec {
   # Mercurial should be added as a build input but because it's a Python
   # application, it would mess up the Python environment. Thus, don't add it
   # here, instead add it to PATH when running unit tests
-  checkInputs = [ pytest pytest-flake8 pytest-cram git ];
+  checkInputs = [ pytest pytest-flake8 git ];
   nativeBuildInputs = [ pytestrunner ];
   propagatedBuildInputs = [ ipython nbformat ];
 
diff --git a/pkgs/applications/version-management/rcs/default.nix b/pkgs/applications/version-management/rcs/default.nix
index 862b9eacd62..3283a3c046a 100644
--- a/pkgs/applications/version-management/rcs/default.nix
+++ b/pkgs/applications/version-management/rcs/default.nix
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
     make $checkFlags check || print_logs_and_fail
   '';
 
-  NIX_CFLAGS_COMPILE = [ "-std=c99" ];
+  NIX_CFLAGS_COMPILE = "-std=c99";
 
   hardeningDisable = stdenv.lib.optional stdenv.cc.isClang "format";
 
diff --git a/pkgs/applications/video/aegisub/default.nix b/pkgs/applications/video/aegisub/default.nix
index 83f7ebc29d1..123308babea 100644
--- a/pkgs/applications/video/aegisub/default.nix
+++ b/pkgs/applications/video/aegisub/default.nix
@@ -108,9 +108,7 @@ stdenv.mkDerivation
 
   # this is fixed upstream though not yet in an officially released version,
   # should be fine remove on next release (if one ever happens)
-  NIX_LDFLAGS = [
-    "-lpthread"
-  ];
+  NIX_LDFLAGS = "-lpthread";
 
   postInstall = "ln -s $out/bin/aegisub-* $out/bin/aegisub";
 
diff --git a/pkgs/applications/video/handbrake/default.nix b/pkgs/applications/video/handbrake/default.nix
index 4341055d084..59a8c2377ce 100644
--- a/pkgs/applications/video/handbrake/default.nix
+++ b/pkgs/applications/video/handbrake/default.nix
@@ -100,9 +100,9 @@ stdenv.mkDerivation rec {
   ];
 
   # NOTE: 2018-12-27: Check NixOS HandBrake test if changing
-  NIX_LDFLAGS = [
+  NIX_LDFLAGS = toString [
     "-lx265"
-    # NOTE: The -ldl flag was fixed upstream for a release after 1.3.0    
+    # NOTE: The -ldl flag was fixed upstream for a release after 1.3.0
     "-ldl"
   ];
 
diff --git a/pkgs/applications/video/kino/default.nix b/pkgs/applications/video/kino/default.nix
index 1b9f0d0997a..2a0af3ed59e 100644
--- a/pkgs/applications/video/kino/default.nix
+++ b/pkgs/applications/video/kino/default.nix
@@ -71,10 +71,7 @@ stdenv.mkDerivation {
 
   hardeningDisable = [ "format" ];
 
-  NIX_LDFLAGS = [
-    "-lavcodec"
-    "-lavutil"
-  ];
+  NIX_LDFLAGS = "-lavcodec -lavutil";
 
   patches = [ ./kino-1.3.4-v4l1.patch ./kino-1.3.4-libav-0.7.patch ./kino-1.3.4-libav-0.8.patch ]; #./kino-1.3.4-libavcodec-pkg-config.patch ];
 
diff --git a/pkgs/applications/video/kodi/default.nix b/pkgs/applications/video/kodi/default.nix
index d47797a3046..4fae93aa1a1 100644
--- a/pkgs/applications/video/kodi/default.nix
+++ b/pkgs/applications/video/kodi/default.nix
@@ -179,7 +179,7 @@ in stdenv.mkDerivation {
     ++ lib.optional  udevSupport     udev
     ++ lib.optional  usbSupport      libusb
     ++ lib.optional  vdpauSupport    libvdpau
-    ++ lib.optional  useWayland [
+    ++ lib.optionals useWayland [
       wayland waylandpp
       # Not sure why ".dev" is needed here, but CMake doesn't find libxkbcommon otherwise
       libxkbcommon.dev
@@ -192,7 +192,7 @@ in stdenv.mkDerivation {
       which
       pkgconfig gnumake
       autoconf automake libtool # still needed for some components. Check if that is the case with 19.0
-    ] ++ lib.optional useWayland [ wayland-protocols ];
+    ] ++ lib.optionals useWayland [ wayland-protocols ];
 
     cmakeFlags = [
       "-Dlibdvdcss_URL=${libdvdcss.src}"
diff --git a/pkgs/applications/video/mplayer/default.nix b/pkgs/applications/video/mplayer/default.nix
index a75a7a11d67..f5559e3fb6c 100644
--- a/pkgs/applications/video/mplayer/default.nix
+++ b/pkgs/applications/video/mplayer/default.nix
@@ -195,11 +195,11 @@ stdenv.mkDerivation rec {
     echo CONFIG_MPEGAUDIODSP=yes >> config.mak
   '';
 
-  NIX_LDFLAGS = with stdenv.lib;
+  NIX_LDFLAGS = with stdenv.lib; toString (
        optional  fontconfigSupport "-lfontconfig"
     ++ optional  fribidiSupport "-lfribidi"
     ++ optionals x11Support [ "-lX11" "-lXext" ]
-    ;
+  );
 
   installTargets = [ "install" ] ++ stdenv.lib.optional x11Support "install-gui";
 
diff --git a/pkgs/applications/video/obs-studio/default.nix b/pkgs/applications/video/obs-studio/default.nix
index fdcfd7e0bec..82462f4e2c2 100644
--- a/pkgs/applications/video/obs-studio/default.nix
+++ b/pkgs/applications/video/obs-studio/default.nix
@@ -34,7 +34,7 @@
 }:
 
 let
-  optional = stdenv.lib.optional;
+  inherit (stdenv.lib) optional optionals;
 in mkDerivation rec {
   pname = "obs-studio";
   version = "24.0.4";
@@ -46,9 +46,7 @@ in mkDerivation rec {
     sha256 = "0m15ch2ix9qrdf1a9mj7wcpl72z3h13zx60c9q72sb1435id2g1q";
   };
 
-  nativeBuildInputs = [ cmake
-                        pkgconfig
-                      ];
+  nativeBuildInputs = [ cmake pkgconfig ];
 
   buildInputs = [ curl
                   fdk_aac
@@ -68,7 +66,7 @@ in mkDerivation rec {
                   makeWrapper
                   mbedtls
                 ]
-                ++ optional scriptingSupport [ luajit swig python3 ]
+                ++ optionals scriptingSupport [ luajit swig python3 ]
                 ++ optional alsaSupport alsaLib
                 ++ optional pulseaudioSupport libpulseaudio;
 
diff --git a/pkgs/applications/video/openshot-qt/libopenshot.nix b/pkgs/applications/video/openshot-qt/libopenshot.nix
index 95f89e0eda5..2ed4b8ce3e3 100644
--- a/pkgs/applications/video/openshot-qt/libopenshot.nix
+++ b/pkgs/applications/video/openshot-qt/libopenshot.nix
@@ -2,7 +2,7 @@
 , pkgconfig, cmake, doxygen
 , libopenshot-audio, imagemagick, ffmpeg
 , swig, python3
-, unittest-cpp, cppzmq, czmqpp
+, unittest-cpp, cppzmq, zeromq
 , qtbase, qtmultimedia }:
 
 with stdenv.lib;
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
 
   buildInputs =
   [ imagemagick ffmpeg swig python3 unittest-cpp
-    cppzmq czmqpp qtbase qtmultimedia ];
+    cppzmq zeromq qtbase qtmultimedia ];
 
   LIBOPENSHOT_AUDIO_DIR = libopenshot-audio;
   "UNITTEST++_INCLUDE_DIR" = "${unittest-cpp}/include/UnitTest++";
diff --git a/pkgs/applications/virtualization/containerd/default.nix b/pkgs/applications/virtualization/containerd/default.nix
index 70865ea848b..9e9e6657291 100644
--- a/pkgs/applications/virtualization/containerd/default.nix
+++ b/pkgs/applications/virtualization/containerd/default.nix
@@ -17,7 +17,7 @@ buildGoPackage rec {
   outputs = [ "bin" "out" "man" ];
 
   buildInputs = [ btrfs-progs go-md2man utillinux ];
-  buildFlags = "VERSION=v${version}";
+  buildFlags = [ "VERSION=v${version}" ];
 
   BUILDTAGS = []
     ++ optional (btrfs-progs == null) "no_btrfs";
diff --git a/pkgs/applications/virtualization/cri-o/default.nix b/pkgs/applications/virtualization/cri-o/default.nix
index 29111399ae9..483c6f8b337 100644
--- a/pkgs/applications/virtualization/cri-o/default.nix
+++ b/pkgs/applications/virtualization/cri-o/default.nix
@@ -15,7 +15,10 @@
 , pkgconfig
 }:
 
-buildGoPackage rec {
+let
+  makeFlags = "BUILDTAGS=\"apparmor seccomp selinux
+    containers_image_ostree_stub\"";
+in buildGoPackage rec {
   project = "cri-o";
   version = "1.16.1";
   name = "${project}-${version}${flavor}";
@@ -35,9 +38,6 @@ buildGoPackage rec {
                  libseccomp libselinux lvm2 ]
                 ++ stdenv.lib.optionals (glibc != null) [ glibc glibc.static ];
 
-  makeFlags = ''BUILDTAGS="apparmor seccomp selinux
-    containers_image_ostree_stub"'';
-
   buildPhase = ''
     pushd go/src/${goPackagePath}
 
diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index 7b4e7787985..603aa68207a 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -53,9 +53,7 @@ rec {
       patchPhase = ''
       '';
 
-      NIX_CFLAGS_COMPILE = [
-        "-DMINIMAL=ON"
-      ];
+      NIX_CFLAGS_COMPILE = "-DMINIMAL=ON";
     });
   in
     stdenv.mkDerivation ((optionalAttrs (stdenv.isLinux) {
diff --git a/pkgs/applications/virtualization/open-vm-tools/default.nix b/pkgs/applications/virtualization/open-vm-tools/default.nix
index 49e77a5ec9d..cf160d8af53 100644
--- a/pkgs/applications/virtualization/open-vm-tools/default.nix
+++ b/pkgs/applications/virtualization/open-vm-tools/default.nix
@@ -46,9 +46,15 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  # igrone glib-2.62 deprecations
-  # Drop in next stable release.
-  NIX_CFLAGS_COMPILE = [ "-DGLIB_DISABLE_DEPRECATION_WARNINGS" ];
+  NIX_CFLAGS_COMPILE = builtins.toString [
+    # igrone glib-2.62 deprecations
+    # Drop in next stable release.
+    "-DGLIB_DISABLE_DEPRECATION_WARNINGS"
+
+    # fix build with gcc9
+    "-Wno-error=address-of-packed-member"
+    "-Wno-error=format-overflow"
+  ];
 
   postInstall = ''
     wrapProgram "$out/etc/vmware-tools/scripts/vmware/network" \
diff --git a/pkgs/applications/virtualization/spice-vdagent/default.nix b/pkgs/applications/virtualization/spice-vdagent/default.nix
index 70ae09aa6ef..6f5cbeb7ed4 100644
--- a/pkgs/applications/virtualization/spice-vdagent/default.nix
+++ b/pkgs/applications/virtualization/spice-vdagent/default.nix
@@ -1,17 +1,18 @@
 {stdenv, fetchurl, pkgconfig, alsaLib, spice-protocol, glib,
- libpciaccess, libxcb, libXrandr, libXinerama, libXfixes, dbus,
+ libpciaccess, libxcb, libXrandr, libXinerama, libXfixes, dbus, libdrm,
  systemd}:
 stdenv.mkDerivation rec {
-  name = "spice-vdagent-0.18.0";
+  name = "spice-vdagent-0.19.0";
   src = fetchurl {
     url = "https://www.spice-space.org/download/releases/${name}.tar.bz2";
-    sha256 = "1bmyvapwj1x0m6y8q0r1df2q37vsnb04qkgnnrfbnzf1qzipxvl0";
+    sha256 = "0r9gjx1vcgb4f7g85b1ib045kqa3dqjk12m7342i5y443ihpr9v3";
   };
+  NIX_CFLAGS_COMPILE = [ "-Wno-error=address-of-packed-member" ];
   postPatch = ''
     substituteInPlace data/spice-vdagent.desktop --replace /usr $out
   '';
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ alsaLib spice-protocol glib
+  buildInputs = [ alsaLib spice-protocol glib libdrm
                   libpciaccess libxcb libXrandr libXinerama libXfixes
                   dbus systemd ] ;
   meta = {
diff --git a/pkgs/applications/virtualization/tini/default.nix b/pkgs/applications/virtualization/tini/default.nix
index 39508412333..fcc599b451f 100644
--- a/pkgs/applications/virtualization/tini/default.nix
+++ b/pkgs/applications/virtualization/tini/default.nix
@@ -13,10 +13,7 @@ stdenv.mkDerivation rec {
 
   patchPhase = "sed -i /tini-static/d CMakeLists.txt";
 
-  NIX_CFLAGS_COMPILE = [
-    "-DPR_SET_CHILD_SUBREAPER=36"
-    "-DPR_GET_CHILD_SUBREAPER=37"
-  ];
+  NIX_CFLAGS_COMPILE = "-DPR_SET_CHILD_SUBREAPER=36 -DPR_GET_CHILD_SUBREAPER=37";
 
   buildInputs = [ cmake glibc glibc.static ];
 
diff --git a/pkgs/applications/virtualization/virtualbox/default.nix b/pkgs/applications/virtualization/virtualbox/default.nix
index 6ecdf1d29bc..6c15b2ea2ce 100644
--- a/pkgs/applications/virtualization/virtualbox/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/default.nix
@@ -23,6 +23,16 @@ let
   # guest-additions/default.nix as well.
   main = "036x2mvkk22lbg72cz6pik9z538j1ag6mmwjjmfikgrq1i7v24jy";
   version = "6.0.14";
+
+  iasl' = iasl.overrideAttrs (old: rec {
+    inherit (old) pname;
+    version = "20190108";
+    src = fetchurl {
+      url = "https://acpica.org/sites/acpica/files/acpica-unix-${version}.tar.gz";
+      sha256 = "0bqhr3ndchvfhxb31147z8gd81dysyz5dwkvmp56832d0js2564q";
+    };
+    NIX_CFLAGS_COMPILE = old.NIX_CFLAGS_COMPILE + " -Wno-error=stringop-truncation";
+  });
 in stdenv.mkDerivation {
   pname = "virtualbox";
   inherit version;
@@ -41,7 +51,7 @@ in stdenv.mkDerivation {
   dontWrapQtApps = true;
 
   buildInputs =
-    [ iasl dev86 libxslt libxml2 xorgproto libX11 libXext libXcursor libIDL
+    [ iasl' dev86 libxslt libxml2 xorgproto libX11 libXext libXcursor libIDL
       libcap glib lvm2 alsaLib curl libvpx pam makeself perl
       libXmu libpng libopus python ]
     ++ optional javaBindings jdk
diff --git a/pkgs/applications/virtualization/xen/4.10.nix b/pkgs/applications/virtualization/xen/4.10.nix
index d3c2ed9060c..f15a7ef0f9d 100644
--- a/pkgs/applications/virtualization/xen/4.10.nix
+++ b/pkgs/applications/virtualization/xen/4.10.nix
@@ -148,7 +148,7 @@ callPackage (import ./generic.nix (rec {
     ++ optional (withOVMF) "--with-system-ovmf=${OVMF.fd}/FV/OVMF.fd"
     ++ optional (withInternalOVMF) "--enable-ovmf";
 
-  NIX_CFLAGS_COMPILE = [
+  NIX_CFLAGS_COMPILE = toString [
     # Fix build on Glibc 2.24.
     "-Wno-error=deprecated-declarations"
     # Fix build with GCC 8
@@ -156,6 +156,10 @@ callPackage (import ./generic.nix (rec {
     "-Wno-error=stringop-truncation"
     "-Wno-error=format-truncation"
     "-Wno-error=array-bounds"
+    # Fix build with GCC 9
+    "-Wno-error=address-of-packed-member"
+    "-Wno-error=format-overflow"
+    "-Wno-error=absolute-value"
   ];
 
   postPatch = ''
diff --git a/pkgs/applications/virtualization/xen/4.8.nix b/pkgs/applications/virtualization/xen/4.8.nix
index c7568d99062..1d0e01fcb82 100644
--- a/pkgs/applications/virtualization/xen/4.8.nix
+++ b/pkgs/applications/virtualization/xen/4.8.nix
@@ -167,7 +167,7 @@ callPackage (import ./generic.nix (rec {
     xenpmdpatch
   ];
 
-  NIX_CFLAGS_COMPILE = [
+  NIX_CFLAGS_COMPILE = toString [
     # Fix build on Glibc 2.24
     "-Wno-error=deprecated-declarations"
     # Fix build with GCC8
@@ -175,6 +175,10 @@ callPackage (import ./generic.nix (rec {
     "-Wno-error=stringop-truncation"
     "-Wno-error=format-truncation"
     "-Wno-error=array-bounds"
+    # Fix build with GCC9
+    "-Wno-error=address-of-packed-member"
+    "-Wno-error=format-overflow"
+    "-Wno-error=absolute-value"
   ];
 
   postPatch = ''
diff --git a/pkgs/applications/virtualization/xen/generic.nix b/pkgs/applications/virtualization/xen/generic.nix
index 8093d4752a0..5a8814fb9e2 100644
--- a/pkgs/applications/virtualization/xen/generic.nix
+++ b/pkgs/applications/virtualization/xen/generic.nix
@@ -187,11 +187,11 @@ stdenv.mkDerivation (rec {
   '';
 
   # TODO: Flask needs more testing before enabling it by default.
-  #makeFlags = "XSM_ENABLE=y FLASK_ENABLE=y PREFIX=$(out) CONFIG_DIR=/etc XEN_EXTFILES_URL=\\$(XEN_ROOT)/xen_ext_files ";
+  #makeFlags = [ "XSM_ENABLE=y" "FLASK_ENABLE=y" "PREFIX=$(out)" "CONFIG_DIR=/etc" "XEN_EXTFILES_URL=\\$(XEN_ROOT)/xen_ext_files" ];
   makeFlags = [ "PREFIX=$(out) CONFIG_DIR=/etc" "XEN_SCRIPT_DIR=/etc/xen/scripts" ]
            ++ (config.makeFlags or []);
 
-  buildFlags = "xen tools";
+  buildFlags = [ "xen" "tools" ];
 
   postBuild = ''
     make -C docs man-pages
diff --git a/pkgs/applications/window-managers/compton/default.nix b/pkgs/applications/window-managers/compton/default.nix
index 0941329bdbe..3f7cfd4864d 100644
--- a/pkgs/applications/window-managers/compton/default.nix
+++ b/pkgs/applications/window-managers/compton/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     libxdg_basedir
   ];
 
-  NIX_CFLAGS_COMPILE = [ "-fno-strict-aliasing" ];
+  NIX_CFLAGS_COMPILE = "-fno-strict-aliasing";
 
   mesonFlags = [
     "-Dbuild_docs=true"
diff --git a/pkgs/applications/window-managers/i3/blocks-gaps.nix b/pkgs/applications/window-managers/i3/blocks-gaps.nix
index c62edd6d71a..acfd06235ac 100644
--- a/pkgs/applications/window-managers/i3/blocks-gaps.nix
+++ b/pkgs/applications/window-managers/i3/blocks-gaps.nix
@@ -22,8 +22,8 @@ stdenv.mkDerivation rec {
     sha256 = "0v9307ij8xzwdaxay3r75sd2cp453s3qb6q7dy9fks2p6wwqpazi";
   };
 
-  makeFlags = "all";
-  installFlags = "PREFIX=\${out} VERSION=${version}";
+  makeFlags = [ "all" ];
+  installFlags = [ "PREFIX=\${out}" "VERSION=${version}" ];
 
   buildInputs = optional (contains_any scripts perlscripts) perl;
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/window-managers/i3/lock-color.nix b/pkgs/applications/window-managers/i3/lock-color.nix
index 2fb6fb44833..7895d8c124a 100644
--- a/pkgs/applications/window-managers/i3/lock-color.nix
+++ b/pkgs/applications/window-managers/i3/lock-color.nix
@@ -18,11 +18,11 @@ stdenv.mkDerivation rec {
   buildInputs = [ libxcb xcbutilkeysyms xcbutilimage pam libX11
     libev cairo libxkbcommon libxkbfile libjpeg_turbo xcbutilxrm ];
 
-  makeFlags = "all";
+  makeFlags = [ "all" ];
   preInstall = ''
     mkdir -p $out/share/man/man1
   '';
-  installFlags = "PREFIX=\${out} SYSCONFDIR=\${out}/etc MANDIR=\${out}/share/man";
+  installFlags = [ "PREFIX=\${out}" "SYSCONFDIR=\${out}/etc" "MANDIR=\${out}/share/man" ];
   postInstall = ''
     mv $out/bin/i3lock $out/bin/i3lock-color
     mv $out/share/man/man1/i3lock.1 $out/share/man/man1/i3lock-color.1
diff --git a/pkgs/applications/window-managers/i3/lock.nix b/pkgs/applications/window-managers/i3/lock.nix
index 3e976f8919f..619345d1b96 100644
--- a/pkgs/applications/window-managers/i3/lock.nix
+++ b/pkgs/applications/window-managers/i3/lock.nix
@@ -14,8 +14,8 @@ stdenv.mkDerivation rec {
   buildInputs = [ which libxcb xcbutilkeysyms xcbutilimage xcbutilxrm
     pam libX11 libev cairo libxkbcommon libxkbfile ];
 
-  makeFlags = "all";
-  installFlags = "PREFIX=\${out} SYSCONFDIR=\${out}/etc";
+  makeFlags = [ "all" ];
+  installFlags = [ "PREFIX=\${out}" "SYSCONFDIR=\${out}/etc" ];
   postInstall = ''
     mkdir -p $out/share/man/man1
     cp *.1 $out/share/man/man1
diff --git a/pkgs/applications/window-managers/ion-3/default.nix b/pkgs/applications/window-managers/ion-3/default.nix
index c13b950599e..073af3bfd05 100644
--- a/pkgs/applications/window-managers/ion-3/default.nix
+++ b/pkgs/applications/window-managers/ion-3/default.nix
@@ -13,6 +13,6 @@ stdenv.mkDerivation {
     sha256 = "1nkks5a95986nyfkxvg2rik6zmwx0lh7szd5fji7yizccwzc9xns";
   };
   buildInputs = [ xlibsWrapper lua gettext groff ];
-  buildFlags = "LUA_DIR=${lua} X11_PREFIX=/no-such-path PREFIX=\${out}";
-  installFlags = "PREFIX=\${out}";
+  buildFlags = [ "LUA_DIR=${lua}" "X11_PREFIX=/no-such-path" "PREFIX=\${out}" ];
+  installFlags = [ "PREFIX=\${out}" ];
 }
diff --git a/pkgs/applications/window-managers/larswm/default.nix b/pkgs/applications/window-managers/larswm/default.nix
index 4ec1a4bcd05..f6f3132178c 100644
--- a/pkgs/applications/window-managers/larswm/default.nix
+++ b/pkgs/applications/window-managers/larswm/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
   buildInputs = [ libX11 libXext libXmu ];
 
   makeFlags = [ "BINDIR=$(out)/bin" "MANPATH=$(out)/share/man" ];
-  installTargets = "install install.man";
+  installTargets = [ "install" "install.man" ];
 
   meta = {
     homepage = http://www.fnurt.net/larswm;
diff --git a/pkgs/applications/window-managers/notion/default.nix b/pkgs/applications/window-managers/notion/default.nix
index eaeb9979c10..60900bd2a3c 100644
--- a/pkgs/applications/window-managers/notion/default.nix
+++ b/pkgs/applications/window-managers/notion/default.nix
@@ -35,8 +35,8 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [makeWrapper xlibsWrapper lua gettext mandoc which libXinerama libXrandr libX11 ] ++ stdenv.lib.optional enableXft libXft;
 
-  buildFlags = "LUA_DIR=${lua} X11_PREFIX=/no-such-path PREFIX=\${out}";
-  installFlags = "PREFIX=\${out}";
+  buildFlags = [ "LUA_DIR=${lua}" "X11_PREFIX=/no-such-path" "PREFIX=\${out}" ];
+  installFlags = [ "PREFIX=\${out}" ];
 
   postInstall = ''
     wrapProgram $out/bin/notion \
diff --git a/pkgs/applications/window-managers/spectrwm/default.nix b/pkgs/applications/window-managers/spectrwm/default.nix
index ba43403d9bb..1eb19e2de6f 100644
--- a/pkgs/applications/window-managers/spectrwm/default.nix
+++ b/pkgs/applications/window-managers/spectrwm/default.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation {
     subdir = if stdenv.isDarwin then "osx" else "linux";
   in "spectrwm-SPECTRWM_2_7_2/${subdir}";
 
-  makeFlags="PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
   installPhase = "PREFIX=$out make install";
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/window-managers/wmii-hg/default.nix b/pkgs/applications/window-managers/wmii-hg/default.nix
index e0f2243827c..426fcfe8efc 100644
--- a/pkgs/applications/window-managers/wmii-hg/default.nix
+++ b/pkgs/applications/window-managers/wmii-hg/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
                   libX11 libXrender libXext libXinerama libXrandr libXft ];
 
   # For some reason including mercurial in buildInputs did not help
-  makeFlags = "WMII_HGVERSION=hg${rev}";
+  makeFlags = [ "WMII_HGVERSION=hg${rev}" ];
 
   meta = {
     homepage = https://suckless.org/; # https://wmii.suckless.org/ does not exist anymore
diff --git a/pkgs/data/fonts/dejavu-fonts/default.nix b/pkgs/data/fonts/dejavu-fonts/default.nix
index 38a2d8fe56c..b14ba6479d9 100644
--- a/pkgs/data/fonts/dejavu-fonts/default.nix
+++ b/pkgs/data/fonts/dejavu-fonts/default.nix
@@ -35,7 +35,7 @@ let
       sha256 = "1xknlg2h287dx34v2n5r33bpcl4biqf0cv7nak657rjki7s0k4bk";
     };
 
-    buildFlags = "full-ttf";
+    buildFlags = [ "full-ttf" ];
 
     preBuild = "patchShebangs scripts";
 
diff --git a/pkgs/data/themes/qtcurve/default.nix b/pkgs/data/themes/qtcurve/default.nix
index 673b97cc137..df8e86bf4c1 100644
--- a/pkgs/data/themes/qtcurve/default.nix
+++ b/pkgs/data/themes/qtcurve/default.nix
@@ -3,6 +3,7 @@
 , karchive, kconfig, kconfigwidgets, kio, frameworkintegration
 , kguiaddons, ki18n, kwindowsystem, kdelibs4support, kiconthemes
 , libpthreadstubs, pcre, libXdmcp, libX11, libXau # X11 dependencies
+, fetchpatch
 }:
 
 let
@@ -15,6 +16,13 @@ in mkDerivation {
     sha256 = "169gdny1cdld0qnx3nqvx568zjzdba4pwp3gxapc1hdh2cymw7r8";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/KDE/qtcurve/commit/ee2228ea2f18ac5da9b434ee6089381df815aa94.patch";
+      sha256 = "1vz5frsrsps93awn84gk8d7injrqfcyhc1rji6s0gsgsp5z9sl34";
+    })
+  ];
+
   enableParallelBuilding = true;
 
   nativeBuildInputs = [ cmake extra-cmake-modules pkgconfig ];
diff --git a/pkgs/desktops/deepin/deepin-icon-theme/default.nix b/pkgs/desktops/deepin/deepin-icon-theme/default.nix
index f8258a1d8cd..b6b9feb410b 100644
--- a/pkgs/desktops/deepin/deepin-icon-theme/default.nix
+++ b/pkgs/desktops/deepin/deepin-icon-theme/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   '';
 
   buildTargets = "all hicolor-links";
-  installTargets = "install-icons install-cursors";
+  installTargets = [ "install-icons" "install-cursors" ];
   installFlags = [ "PREFIX=${placeholder "out"}" ];
 
   postInstall = ''
diff --git a/pkgs/desktops/enlightenment/efl.nix b/pkgs/desktops/enlightenment/efl.nix
index 355cc58f348..183e72565d3 100644
--- a/pkgs/desktops/enlightenment/efl.nix
+++ b/pkgs/desktops/enlightenment/efl.nix
@@ -128,7 +128,7 @@ stdenv.mkDerivation rec {
     source "$setupHook"
   '';
 
-  NIX_CFLAGS_COMPILE = [ "-DluaL_reg=luaL_Reg" ]; # needed since luajit-2.1.0-beta3
+  NIX_CFLAGS_COMPILE = "-DluaL_reg=luaL_Reg"; # needed since luajit-2.1.0-beta3
 
   postInstall = ''
     # fix use of $out variable
diff --git a/pkgs/desktops/gnome-2/desktop/mail-notification/default.nix b/pkgs/desktops/gnome-2/desktop/mail-notification/default.nix
index 10b99e4eb5d..c12d50d792f 100644
--- a/pkgs/desktops/gnome-2/desktop/mail-notification/default.nix
+++ b/pkgs/desktops/gnome-2/desktop/mail-notification/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     ./patches/mail-notification-dont-link-against-bsd-compat.patch
   ];
 
-  patchFlags = "-p0";
+  patchFlags = [ "-p0" ];
   NIX_CFLAGS_COMPILE = "-Wno-error";
 
   preConfigure = "./jb configure prefix=$out";
diff --git a/pkgs/desktops/gnome-2/platform/gtkhtml/default.nix b/pkgs/desktops/gnome-2/platform/gtkhtml/default.nix
index 5ff687adcf6..3c89f9ff0fc 100644
--- a/pkgs/desktops/gnome-2/platform/gtkhtml/default.nix
+++ b/pkgs/desktops/gnome-2/platform/gtkhtml/default.nix
@@ -16,5 +16,5 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ gtk2 intltool GConf enchant isocodes gnome_icon_theme ];
 
-  NIX_LDFLAGS = [ "-lgthread-2.0" ];
+  NIX_LDFLAGS = "-lgthread-2.0";
 }
diff --git a/pkgs/desktops/gnome-3/core/gnome-settings-daemon/default.nix b/pkgs/desktops/gnome-3/core/gnome-settings-daemon/default.nix
index 36da3349c46..c388c4f7211 100644
--- a/pkgs/desktops/gnome-3/core/gnome-settings-daemon/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-settings-daemon/default.nix
@@ -99,11 +99,9 @@ stdenv.mkDerivation rec {
     "-Dudev_dir=${placeholder "out"}/lib/udev"
   ];
 
-  NIX_CFLAGS_COMPILE = [
-    # Default for release buildtype but passed manually because
-    # we're using plain
-    "-DG_DISABLE_CAST_CHECKS"
-  ];
+  # Default for release buildtype but passed manually because
+  # we're using plain
+  NIX_CFLAGS_COMPILE = "-DG_DISABLE_CAST_CHECKS";
 
   # So the polkit policy can reference /run/current-system/sw/bin/gnome-settings-daemon/gsd-backlight-helper
   postFixup = ''
diff --git a/pkgs/desktops/gnome-3/misc/gnome-screensaver/default.nix b/pkgs/desktops/gnome-3/misc/gnome-screensaver/default.nix
index b1e9cde906c..4a530e54de7 100644
--- a/pkgs/desktops/gnome-3/misc/gnome-screensaver/default.nix
+++ b/pkgs/desktops/gnome-3/misc/gnome-screensaver/default.nix
@@ -71,6 +71,8 @@ stdenv.mkDerivation rec {
     systemd
   ];
 
+  NIX_CFLAGS_COMPILE = [ "-Wno-error=return-type" ];
+
   configureFlags = [ "--enable-locking" "--with-systemd=yes" ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/desktops/mate/mate-screensaver/default.nix b/pkgs/desktops/mate/mate-screensaver/default.nix
index 0e99d03c081..23e8080f01f 100644
--- a/pkgs/desktops/mate/mate-screensaver/default.nix
+++ b/pkgs/desktops/mate/mate-screensaver/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--without-console-kit" ];
 
-  makeFlags = "DBUS_SESSION_SERVICE_DIR=$(out)/etc";
+  makeFlags = [ "DBUS_SESSION_SERVICE_DIR=$(out)/etc" ];
 
   meta = with stdenv.lib; {
     description = "Screen saver and locker for the MATE desktop";
diff --git a/pkgs/desktops/pantheon/services/elementary-settings-daemon/default.nix b/pkgs/desktops/pantheon/services/elementary-settings-daemon/default.nix
index d29178b220d..582793ff590 100644
--- a/pkgs/desktops/pantheon/services/elementary-settings-daemon/default.nix
+++ b/pkgs/desktops/pantheon/services/elementary-settings-daemon/default.nix
@@ -148,11 +148,9 @@ stdenv.mkDerivation rec {
     "-Dudev_dir=${placeholder "out"}/lib/udev"
   ];
 
-  NIX_CFLAGS_COMPILE = [
     # Default for release buildtype but passed manually because
     # we're using plain
-    "-DG_DISABLE_CAST_CHECKS"
-  ];
+  NIX_CFLAGS_COMPILE = "-DG_DISABLE_CAST_CHECKS";
 
   passthru = {
     updateScript = gnome3.updateScript {
diff --git a/pkgs/desktops/rox/rox-filer/default.nix b/pkgs/desktops/rox/rox-filer/default.nix
index 05f5936a6cb..b7c40153209 100644
--- a/pkgs/desktops/rox/rox-filer/default.nix
+++ b/pkgs/desktops/rox/rox-filer/default.nix
@@ -13,7 +13,7 @@ in stdenv.mkDerivation {
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libxml2 gtk shared-mime-info libSM ];
-  NIX_LDFLAGS = [ "-ldl" "-lm" ];
+  NIX_LDFLAGS = "-ldl -lm";
 
   patches = [
     ./rox-filer-2.11-in-source-build.patch
@@ -23,7 +23,7 @@ in stdenv.mkDerivation {
   setSourceRoot = "export sourceRoot=rox-filer-${version}/ROX-Filer/";
 
   # patch source with defined patches
-  patchFlags = "-p0";
+  patchFlags = [ "-p0" ];
 
   # patch the main.c to disable the lookup of the APP_DIR environment variable,
   # which is used to lookup the location for certain images when rox-filer
diff --git a/pkgs/desktops/xfce/core/xfce4-panel/default.nix b/pkgs/desktops/xfce/core/xfce4-panel/default.nix
index f7e500bdf54..f4d86247c6c 100644
--- a/pkgs/desktops/xfce/core/xfce4-panel/default.nix
+++ b/pkgs/desktops/xfce/core/xfce4-panel/default.nix
@@ -11,7 +11,7 @@ mkXfceDerivation {
   buildInputs = [ exo garcon gtk2 gtk3 glib glib-networking libxfce4ui libxfce4util libwnck3 xfconf ];
 
   patches = [ ./xfce4-panel-datadir.patch ];
-  patchFlags = "-p1";
+  patchFlags = [ "-p1" ];
 
   postPatch = ''
     for f in $(find . -name \*.sh); do
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-pulseaudio-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-pulseaudio-plugin/default.nix
index 59f282d7411..83778aa8fff 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-pulseaudio-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-pulseaudio-plugin/default.nix
@@ -9,7 +9,7 @@ mkXfceDerivation {
 
   nativeBuildInputs = [ automakeAddFlags ];
 
-  NIX_CFLAGS_COMPILE = [ "-I${dbus-glib.dev}/include/dbus-1.0" "-I${dbus.dev}/include/dbus-1.0" ];
+  NIX_CFLAGS_COMPILE = "-I${dbus-glib.dev}/include/dbus-1.0 -I${dbus.dev}/include/dbus-1.0";
 
   postPatch = ''
     substituteInPlace configure.ac.in --replace gio-2.0 gio-unix-2.0
diff --git a/pkgs/development/beam-modules/webdriver/default.nix b/pkgs/development/beam-modules/webdriver/default.nix
index b6695029f34..d772ad7a3c7 100644
--- a/pkgs/development/beam-modules/webdriver/default.nix
+++ b/pkgs/development/beam-modules/webdriver/default.nix
@@ -23,7 +23,7 @@ let
 
     buildInputs = [ erlang ];
 
-    installFlags = "PREFIX=$(out)/lib/erlang/lib";
+    installFlags = [ "PREFIX=$(out)/lib/erlang/lib" ];
 
     meta = {
       description = "WebDriver implementation in Erlang";
diff --git a/pkgs/development/compilers/arachne-pnr/default.nix b/pkgs/development/compilers/arachne-pnr/default.nix
index 3058e926c3f..0b5ff381730 100644
--- a/pkgs/development/compilers/arachne-pnr/default.nix
+++ b/pkgs/development/compilers/arachne-pnr/default.nix
@@ -4,13 +4,13 @@ with builtins;
 
 stdenv.mkDerivation rec {
   pname = "arachne-pnr";
-  version = "2018.09.09";
+  version = "2019.07.29";
 
   src = fetchFromGitHub {
     owner  = "yosyshq";
     repo   = "arachne-pnr";
-    rev    = "840bdfdeb38809f9f6af4d89dd7b22959b176fdd";
-    sha256 = "1dqvjvgvsridybishv4pnigw9gypxh7r7nrqp9z9qq92v7c5rxzl";
+    rev    = "c40fb2289952f4f120cc10a5a4c82a6fb88442dc";
+    sha256 = "0lg9rccr486cvips3jf289af2b4a2j9chc8iqnkhykgi1hw4pszc";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/compilers/chez/default.nix b/pkgs/development/compilers/chez/default.nix
index a0fc30c8586..c0fd742082f 100644
--- a/pkgs/development/compilers/chez/default.nix
+++ b/pkgs/development/compilers/chez/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optional stdenv.cc.isGNU "-Wno-error=format-truncation";
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isGNU "-Wno-error=format-truncation";
 
   /*
   ** We patch out a very annoying 'feature' in ./configure, which
diff --git a/pkgs/development/compilers/chicken/4/chicken.nix b/pkgs/development/compilers/chicken/4/chicken.nix
index 4112a74d5ee..380755bf01e 100644
--- a/pkgs/development/compilers/chicken/4/chicken.nix
+++ b/pkgs/development/compilers/chicken/4/chicken.nix
@@ -23,8 +23,8 @@ stdenv.mkDerivation {
 
   setupHook = lib.ifEnable (bootstrap-chicken != null) ./setup-hook.sh;
 
-  buildFlags = "PLATFORM=${platform} PREFIX=$(out) VARDIR=$(out)/var/lib";
-  installFlags = "PLATFORM=${platform} PREFIX=$(out) VARDIR=$(out)/var/lib";
+  buildFlags = [ "PLATFORM=${platform}" "PREFIX=$(out)" "VARDIR=$(out)/var/lib" ];
+  installFlags = [ "PLATFORM=${platform}" "PREFIX=$(out)" "VARDIR=$(out)/var/lib" ];
 
   # We need a bootstrap-chicken to regenerate the c-files after
   # applying a patch to add support for CHICKEN_REPOSITORY_EXTRA
diff --git a/pkgs/development/compilers/chicken/5/chicken.nix b/pkgs/development/compilers/chicken/5/chicken.nix
index fb280795d88..3e47e413636 100644
--- a/pkgs/development/compilers/chicken/5/chicken.nix
+++ b/pkgs/development/compilers/chicken/5/chicken.nix
@@ -23,8 +23,8 @@ stdenv.mkDerivation {
 
   setupHook = lib.ifEnable (bootstrap-chicken != null) ./setup-hook.sh;
 
-  buildFlags = "PLATFORM=${platform} PREFIX=$(out)";
-  installFlags = "PLATFORM=${platform} PREFIX=$(out)";
+  buildFlags = [ "PLATFORM=${platform}" "PREFIX=$(out)" ];
+  installFlags = [ "PLATFORM=${platform}" "PREFIX=$(out)" ];
 
   buildInputs = [
     makeWrapper
diff --git a/pkgs/development/compilers/cmdstan/default.nix b/pkgs/development/compilers/cmdstan/default.nix
index 9a01519a881..edde6af615f 100644
--- a/pkgs/development/compilers/cmdstan/default.nix
+++ b/pkgs/development/compilers/cmdstan/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation {
     sha256 = "1vq1cnrkvrvbfl40j6ajc60jdrjcxag1fi6kff5pqmadfdz9564j";
   };
 
-  buildFlags = "build";
+  buildFlags = [ "build" ];
   enableParallelBuilding = true;
 
   doCheck = true;
diff --git a/pkgs/development/compilers/dev86/default.nix b/pkgs/development/compilers/dev86/default.nix
index 839ee821d00..37f79933b77 100644
--- a/pkgs/development/compilers/dev86/default.nix
+++ b/pkgs/development/compilers/dev86/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   meta = {
     description = "Linux 8086 development environment";
diff --git a/pkgs/development/compilers/eli/default.nix b/pkgs/development/compilers/eli/default.nix
index a22862c4292..90c2b8fd23c 100644
--- a/pkgs/development/compilers/eli/default.nix
+++ b/pkgs/development/compilers/eli/default.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
   ];
 
   # skip interactive browser check
-  buildFlags = "nobrowsers";
+  buildFlags = [ "nobrowsers" ];
 
 
   preConfigure=''
diff --git a/pkgs/development/compilers/elm/makeDotElm.nix b/pkgs/development/compilers/elm/makeDotElm.nix
index 3ceaae450f0..0831d382c4b 100644
--- a/pkgs/development/compilers/elm/makeDotElm.nix
+++ b/pkgs/development/compilers/elm/makeDotElm.nix
@@ -11,13 +11,10 @@ ver: deps:
                    inherit (info) sha256;
                  };
 
-                 phases = [ "unpackPhase" "installPhase" ];
-
                  installPhase = ''
                    mkdir -p $out
                    cp -r * $out
                  '';
-
                };
              in ''
                mkdir -p .elm/${ver}/packages/${name}
diff --git a/pkgs/development/compilers/eql/default.nix b/pkgs/development/compilers/eql/default.nix
index cb960227beb..aac61912689 100644
--- a/pkgs/development/compilers/eql/default.nix
+++ b/pkgs/development/compilers/eql/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ ecl qt4 xorgserver xkbcomp xkeyboard_config ];
 
-  NIX_CFLAGS_COMPILE = [ "-fPIC" ];
+  NIX_CFLAGS_COMPILE = "-fPIC";
 
   postPatch = ''
     sed -re 's@[(]in-home "gui/.command-history"[)]@(concatenate '"'"'string (ext:getenv "HOME") "/.eql-gui-command-history")@' -i gui/gui.lisp
diff --git a/pkgs/development/compilers/fpc/default.nix b/pkgs/development/compilers/fpc/default.nix
index a2b73f61c27..7bddafc6ff5 100644
--- a/pkgs/development/compilers/fpc/default.nix
+++ b/pkgs/development/compilers/fpc/default.nix
@@ -19,9 +19,9 @@ stdenv.mkDerivation rec {
       sed -e "s@'/lib64/ld-linux[^']*'@'''@" -i fpcsrc/compiler/systems/t_linux.pas
     '' else "";
 
-  makeFlags = "NOGDB=1 FPC=${startFPC}/bin/fpc";
+  makeFlags = [ "NOGDB=1" "FPC=${startFPC}/bin/fpc" ];
 
-  installFlags = "INSTALL_PREFIX=\${out}";
+  installFlags = [ "INSTALL_PREFIX=\${out}" ];
 
   postInstall = ''
     for i in $out/lib/fpc/*/ppc*; do
diff --git a/pkgs/development/compilers/fstar/default.nix b/pkgs/development/compilers/fstar/default.nix
index 9306eec817f..533140631a5 100644
--- a/pkgs/development/compilers/fstar/default.nix
+++ b/pkgs/development/compilers/fstar/default.nix
@@ -25,12 +25,12 @@ stdenv.mkDerivation rec {
     patchShebangs src/tools
     patchShebangs bin
   '';
-  buildFlags = "-C src/ocaml-output";
+  buildFlags = [ "-C" "src/ocaml-output" ];
 
   preInstall = ''
     mkdir -p $out/lib/ocaml/${ocamlPackages.ocaml.version}/site-lib/fstarlib
   '';
-  installFlags = "-C src/ocaml-output";
+  installFlags = [ "-C" "src/ocaml-output" ];
   postInstall = ''
     wrapProgram $out/bin/fstar.exe --prefix PATH ":" "${z3}/bin"
   '';
diff --git a/pkgs/development/compilers/gcc/4.8/default.nix b/pkgs/development/compilers/gcc/4.8/default.nix
index ae96d5a1ef9..ef697b74bbe 100644
--- a/pkgs/development/compilers/gcc/4.8/default.nix
+++ b/pkgs/development/compilers/gcc/4.8/default.nix
@@ -225,10 +225,7 @@ stdenv.mkDerivation ({
 
   doCheck = false; # requires a lot of tools, causes a dependency cycle for stdenv
 
-  installTargets =
-    if stripped
-    then "install-strip"
-    else "install";
+  installTargets = optional stripped "install-strip";
 
   # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
   ${if hostPlatform.system == "x86_64-solaris" then "CC" else null} = "gcc -m64";
diff --git a/pkgs/development/compilers/gcc/4.9/default.nix b/pkgs/development/compilers/gcc/4.9/default.nix
index 5194f607f3b..2f85fc4b7e8 100644
--- a/pkgs/development/compilers/gcc/4.9/default.nix
+++ b/pkgs/development/compilers/gcc/4.9/default.nix
@@ -231,10 +231,7 @@ stdenv.mkDerivation ({
 
   doCheck = false; # requires a lot of tools, causes a dependency cycle for stdenv
 
-  installTargets =
-    if stripped
-    then "install-strip"
-    else "install";
+  installTargets = optional stripped "install-strip";
 
   # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
   ${if hostPlatform.system == "x86_64-solaris" then "CC" else null} = "gcc -m64";
diff --git a/pkgs/development/compilers/gcc/5/default.nix b/pkgs/development/compilers/gcc/5/default.nix
index cddfd58aa53..f68ddc81f81 100644
--- a/pkgs/development/compilers/gcc/5/default.nix
+++ b/pkgs/development/compilers/gcc/5/default.nix
@@ -242,10 +242,7 @@ stdenv.mkDerivation ({
 
   doCheck = false; # requires a lot of tools, causes a dependency cycle for stdenv
 
-  installTargets =
-    if stripped
-    then "install-strip"
-    else "install";
+  installTargets = optional stripped "install-strip";
 
   # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
   ${if hostPlatform.system == "x86_64-solaris" then "CC" else null} = "gcc -m64";
diff --git a/pkgs/development/compilers/gcc/6/default.nix b/pkgs/development/compilers/gcc/6/default.nix
index 3ac4fa7032a..b1a981cfdf7 100644
--- a/pkgs/development/compilers/gcc/6/default.nix
+++ b/pkgs/development/compilers/gcc/6/default.nix
@@ -250,10 +250,7 @@ stdenv.mkDerivation ({
 
   doCheck = false; # requires a lot of tools, causes a dependency cycle for stdenv
 
-  installTargets =
-    if stripped
-    then "install-strip"
-    else "install";
+  installTargets = optional stripped "install-strip";
 
   # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
   ${if hostPlatform.system == "x86_64-solaris" then "CC" else null} = "gcc -m64";
diff --git a/pkgs/development/compilers/gcc/7/default.nix b/pkgs/development/compilers/gcc/7/default.nix
index 237cb455f9f..22d772cff6d 100644
--- a/pkgs/development/compilers/gcc/7/default.nix
+++ b/pkgs/development/compilers/gcc/7/default.nix
@@ -221,10 +221,7 @@ stdenv.mkDerivation ({
 
   doCheck = false; # requires a lot of tools, causes a dependency cycle for stdenv
 
-  installTargets =
-    if stripped
-    then "install-strip"
-    else "install";
+  installTargets = optional stripped "install-strip";
 
   # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
   ${if hostPlatform.system == "x86_64-solaris" then "CC" else null} = "gcc -m64";
diff --git a/pkgs/development/compilers/gcc/8/default.nix b/pkgs/development/compilers/gcc/8/default.nix
index c9302cc4f74..c6b785f84a4 100644
--- a/pkgs/development/compilers/gcc/8/default.nix
+++ b/pkgs/development/compilers/gcc/8/default.nix
@@ -208,10 +208,7 @@ stdenv.mkDerivation ({
 
   dontStrip = !stripped;
 
-  installTargets =
-    if stripped
-    then "install-strip"
-    else "install";
+  installTargets = optional stripped "install-strip";
 
   # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
   ${if hostPlatform.system == "x86_64-solaris" then "CC" else null} = "gcc -m64";
diff --git a/pkgs/development/compilers/gcc/9/default.nix b/pkgs/development/compilers/gcc/9/default.nix
index 9698f4db286..7ff8d7529ca 100644
--- a/pkgs/development/compilers/gcc/9/default.nix
+++ b/pkgs/development/compilers/gcc/9/default.nix
@@ -207,10 +207,7 @@ stdenv.mkDerivation ({
 
   dontStrip = !stripped;
 
-  installTargets =
-    if stripped
-    then "install-strip"
-    else "install";
+  installTargets = optional stripped "install-strip";
 
   # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
   ${if hostPlatform.system == "x86_64-solaris" then "CC" else null} = "gcc -m64";
diff --git a/pkgs/development/compilers/gcc/common/configure-flags.nix b/pkgs/development/compilers/gcc/common/configure-flags.nix
index 3b96f432e96..aa0fcb50628 100644
--- a/pkgs/development/compilers/gcc/common/configure-flags.nix
+++ b/pkgs/development/compilers/gcc/common/configure-flags.nix
@@ -153,7 +153,7 @@ let
     ++ lib.optional (langJava && javaAntlr != null) "--with-antlr-jar=${javaAntlr}"
 
     ++ (import ../common/platform-flags.nix { inherit (stdenv) lib targetPlatform; })
-    ++ lib.optional (targetPlatform != hostPlatform) crossConfigureFlags
+    ++ lib.optionals (targetPlatform != hostPlatform) crossConfigureFlags
     ++ lib.optional (targetPlatform != hostPlatform) "--disable-bootstrap"
 
     # Platform-specific flags
diff --git a/pkgs/development/compilers/gerbil/build.nix b/pkgs/development/compilers/gerbil/build.nix
index b5ccbca6f7e..e2ab0976482 100644
--- a/pkgs/development/compilers/gerbil/build.nix
+++ b/pkgs/development/compilers/gerbil/build.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ gambit rsync bash ]
     ++ buildInputs_libraries ++ buildInputs_staticLibraries;
 
-  NIX_CFLAGS_COMPILE = [ "-I${libmysqlclient}/include/mysql" "-L${libmysqlclient}/lib/mysql" ];
+  NIX_CFLAGS_COMPILE = "-I${libmysqlclient}/include/mysql -L${libmysqlclient}/lib/mysql";
 
   postPatch = ''
     echo '(define (gerbil-version-string) "v${git-version}")' > src/gerbil/runtime/gx-version.scm
diff --git a/pkgs/development/compilers/ghc/8.4.4.nix b/pkgs/development/compilers/ghc/8.4.4.nix
index 73c7e4708d5..f79200d1199 100644
--- a/pkgs/development/compilers/ghc/8.4.4.nix
+++ b/pkgs/development/compilers/ghc/8.4.4.nix
@@ -69,7 +69,7 @@ let
   '';
 
   # Splicer will pull out correct variations
-  libDeps = platform: stdenv.lib.optional enableTerminfo [ ncurses ]
+  libDeps = platform: stdenv.lib.optional enableTerminfo ncurses
     ++ stdenv.lib.optional (!enableIntegerSimple) gmp
     ++ stdenv.lib.optional (platform.libc != "glibc" && !targetPlatform.isWindows) libiconv;
 
@@ -167,9 +167,9 @@ stdenv.mkDerivation (rec {
   configureFlags = [
     "--datadir=$doc/share/doc/ghc"
     "--with-curses-includes=${ncurses.dev}/include" "--with-curses-libraries=${ncurses.out}/lib"
-  ] ++ stdenv.lib.optional (targetPlatform == hostPlatform && !enableIntegerSimple) [
+  ] ++ stdenv.lib.optionals (targetPlatform == hostPlatform && !enableIntegerSimple) [
     "--with-gmp-includes=${targetPackages.gmp.dev}/include" "--with-gmp-libraries=${targetPackages.gmp.out}/lib"
-  ] ++ stdenv.lib.optional (targetPlatform == hostPlatform && hostPlatform.libc != "glibc" && !targetPlatform.isWindows) [
+  ] ++ stdenv.lib.optionals (targetPlatform == hostPlatform && hostPlatform.libc != "glibc" && !targetPlatform.isWindows) [
     "--with-iconv-includes=${libiconv}/include" "--with-iconv-libraries=${libiconv}/lib"
   ] ++ stdenv.lib.optionals (targetPlatform != hostPlatform) [
     "--enable-bootstrap-with-devel-snapshot"
diff --git a/pkgs/development/compilers/ghc/8.6.5.nix b/pkgs/development/compilers/ghc/8.6.5.nix
index f285e271c62..0b565d3705d 100644
--- a/pkgs/development/compilers/ghc/8.6.5.nix
+++ b/pkgs/development/compilers/ghc/8.6.5.nix
@@ -73,7 +73,7 @@ let
   '';
 
   # Splicer will pull out correct variations
-  libDeps = platform: stdenv.lib.optional enableTerminfo [ ncurses ]
+  libDeps = platform: stdenv.lib.optional enableTerminfo ncurses
     ++ [libffi]
     ++ stdenv.lib.optional (!enableIntegerSimple) gmp
     ++ stdenv.lib.optional (platform.libc != "glibc" && !targetPlatform.isWindows) libiconv;
@@ -167,9 +167,9 @@ stdenv.mkDerivation (rec {
     "--datadir=$doc/share/doc/ghc"
     "--with-curses-includes=${ncurses.dev}/include" "--with-curses-libraries=${ncurses.out}/lib"
   ] ++ stdenv.lib.optionals (libffi != null) ["--with-system-libffi" "--with-ffi-includes=${targetPackages.libffi.dev}/include" "--with-ffi-libraries=${targetPackages.libffi.out}/lib"
-  ] ++ stdenv.lib.optional (targetPlatform == hostPlatform && !enableIntegerSimple) [
+  ] ++ stdenv.lib.optionals (targetPlatform == hostPlatform && !enableIntegerSimple) [
     "--with-gmp-includes=${targetPackages.gmp.dev}/include" "--with-gmp-libraries=${targetPackages.gmp.out}/lib"
-  ] ++ stdenv.lib.optional (targetPlatform == hostPlatform && hostPlatform.libc != "glibc" && !targetPlatform.isWindows) [
+  ] ++ stdenv.lib.optionals (targetPlatform == hostPlatform && hostPlatform.libc != "glibc" && !targetPlatform.isWindows) [
     "--with-iconv-includes=${libiconv}/include" "--with-iconv-libraries=${libiconv}/lib"
   ] ++ stdenv.lib.optionals (targetPlatform != hostPlatform) [
     "--enable-bootstrap-with-devel-snapshot"
diff --git a/pkgs/development/compilers/ghc/8.8.1.nix b/pkgs/development/compilers/ghc/8.8.1.nix
index 6872cea4e2a..9197b80224e 100644
--- a/pkgs/development/compilers/ghc/8.8.1.nix
+++ b/pkgs/development/compilers/ghc/8.8.1.nix
@@ -73,7 +73,7 @@ let
   '';
 
   # Splicer will pull out correct variations
-  libDeps = platform: stdenv.lib.optional enableTerminfo [ ncurses ]
+  libDeps = platform: stdenv.lib.optional enableTerminfo ncurses
     ++ [libffi]
     ++ stdenv.lib.optional (!enableIntegerSimple) gmp
     ++ stdenv.lib.optional (platform.libc != "glibc" && !targetPlatform.isWindows) libiconv;
@@ -152,9 +152,9 @@ stdenv.mkDerivation (rec {
     "--datadir=$doc/share/doc/ghc"
     "--with-curses-includes=${ncurses.dev}/include" "--with-curses-libraries=${ncurses.out}/lib"
   ] ++ stdenv.lib.optionals (libffi != null) ["--with-system-libffi" "--with-ffi-includes=${targetPackages.libffi.dev}/include" "--with-ffi-libraries=${targetPackages.libffi.out}/lib"
-  ] ++ stdenv.lib.optional (targetPlatform == hostPlatform && !enableIntegerSimple) [
+  ] ++ stdenv.lib.optionals (targetPlatform == hostPlatform && !enableIntegerSimple) [
     "--with-gmp-includes=${targetPackages.gmp.dev}/include" "--with-gmp-libraries=${targetPackages.gmp.out}/lib"
-  ] ++ stdenv.lib.optional (targetPlatform == hostPlatform && hostPlatform.libc != "glibc" && !targetPlatform.isWindows) [
+  ] ++ stdenv.lib.optionals (targetPlatform == hostPlatform && hostPlatform.libc != "glibc" && !targetPlatform.isWindows) [
     "--with-iconv-includes=${libiconv}/include" "--with-iconv-libraries=${libiconv}/lib"
   ] ++ stdenv.lib.optionals (targetPlatform != hostPlatform) [
     "--enable-bootstrap-with-devel-snapshot"
diff --git a/pkgs/development/compilers/ghc/head.nix b/pkgs/development/compilers/ghc/head.nix
index 8d22c0a674b..415f6c74ad5 100644
--- a/pkgs/development/compilers/ghc/head.nix
+++ b/pkgs/development/compilers/ghc/head.nix
@@ -74,7 +74,7 @@ let
   '';
 
   # Splicer will pull out correct variations
-  libDeps = platform: stdenv.lib.optional enableTerminfo [ ncurses ]
+  libDeps = platform: stdenv.lib.optional enableTerminfo ncurses
     ++ stdenv.lib.optional (!enableIntegerSimple) gmp
     ++ stdenv.lib.optional (platform.libc != "glibc" && !targetPlatform.isWindows) libiconv
     ++ stdenv.lib.optional enableDwarf elfutils;
@@ -161,9 +161,9 @@ stdenv.mkDerivation (rec {
   configureFlags = [
     "--datadir=$doc/share/doc/ghc"
     "--with-curses-includes=${ncurses.dev}/include" "--with-curses-libraries=${ncurses.out}/lib"
-  ] ++ stdenv.lib.optional (targetPlatform == hostPlatform && !enableIntegerSimple) [
+  ] ++ stdenv.lib.optionals (targetPlatform == hostPlatform && !enableIntegerSimple) [
     "--with-gmp-includes=${targetPackages.gmp.dev}/include" "--with-gmp-libraries=${targetPackages.gmp.out}/lib"
-  ] ++ stdenv.lib.optional (targetPlatform == hostPlatform && hostPlatform.libc != "glibc" && !targetPlatform.isWindows) [
+  ] ++ stdenv.lib.optionals (targetPlatform == hostPlatform && hostPlatform.libc != "glibc" && !targetPlatform.isWindows) [
     "--with-iconv-includes=${libiconv}/include" "--with-iconv-libraries=${libiconv}/lib"
   ] ++ stdenv.lib.optionals (targetPlatform != hostPlatform) [
     "--enable-bootstrap-with-devel-snapshot"
@@ -173,7 +173,7 @@ stdenv.mkDerivation (rec {
     "CONF_GCC_LINKER_OPTS_STAGE2=-fuse-ld=gold"
   ] ++ stdenv.lib.optionals (disableLargeAddressSpace) [
     "--disable-large-address-space"
-  ] ++ stdenv.lib.optional enableDwarf [
+  ] ++ stdenv.lib.optionals enableDwarf [
     "--enable-dwarf-unwind"
     "--with-libdw-includes=${stdenv.lib.getDev elfutils}/include"
     "--with-libdw-libraries=${stdenv.lib.getLib elfutils}/lib"
diff --git a/pkgs/development/compilers/graalvm/default.nix b/pkgs/development/compilers/graalvm/default.nix
index 11a94ebcce5..438c899f516 100644
--- a/pkgs/development/compilers/graalvm/default.nix
+++ b/pkgs/development/compilers/graalvm/default.nix
@@ -242,10 +242,7 @@ in rec {
                   'method->name_and_sig_as_C_string(), p2i(method->native_function()), p2i(entry)' || exit -1
     '';
     hardeningDisable = [ "fortify" ];
-    NIX_CFLAGS_COMPILE = [
-      "-Wno-error=format-overflow" # newly detected by gcc7
-      "-Wno-error=nonnull"
-    ];
+    NIX_CFLAGS_COMPILE = "-Wno-error=format-overflow -Wno-error=nonnull";
     buildPhase = ''
       export MX_ALT_OUTPUT_ROOT=$NIX_BUILD_TOP/mxbuild
       export MX_CACHE_DIR=${makeMxCache jvmci8-mxcache}
diff --git a/pkgs/development/compilers/hhvm/default.nix b/pkgs/development/compilers/hhvm/default.nix
index 7066744bb54..08ba9e46814 100644
--- a/pkgs/development/compilers/hhvm/default.nix
+++ b/pkgs/development/compilers/hhvm/default.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
   # the cmake package does not handle absolute CMAKE_INSTALL_INCLUDEDIR correctly
   # (setting it to an absolute path causes include files to go to $out/$out/include,
   #  because the absolute path is interpreted with root at $out).
-  cmakeFlags = "-DCMAKE_INSTALL_INCLUDEDIR=include";
+  cmakeFlags = [ "-DCMAKE_INSTALL_INCLUDEDIR=include" ];
 
   prePatch = ''
     substituteInPlace ./configure \
diff --git a/pkgs/development/compilers/iasl/default.nix b/pkgs/development/compilers/iasl/default.nix
index fccdf7a978d..e98d7cc27db 100644
--- a/pkgs/development/compilers/iasl/default.nix
+++ b/pkgs/development/compilers/iasl/default.nix
@@ -2,18 +2,16 @@
 
 stdenv.mkDerivation rec {
   pname = "iasl";
-  version = "20190108";
+  version = "20191213";
 
   src = fetchurl {
     url = "https://acpica.org/sites/acpica/files/acpica-unix-${version}.tar.gz";
-    sha256 = "0bqhr3ndchvfhxb31147z8gd81dysyz5dwkvmp56832d0js2564q";
+    sha256 = "1ip684is3dplf7snkn024vv6bg3dv5msx8v7pz6x9lrnk3gk0j9h";
   };
 
-  NIX_CFLAGS_COMPILE = [
-    "-O3"
-  ];
+  NIX_CFLAGS_COMPILE = "-O3";
 
-  buildFlags = "iasl";
+  buildFlags = [ "iasl" ];
 
   buildInputs = [ bison flex ];
 
diff --git a/pkgs/development/compilers/ldc/default.nix b/pkgs/development/compilers/ldc/default.nix
index 03e6fa82b9d..fff6435b29e 100644
--- a/pkgs/development/compilers/ldc/default.nix
+++ b/pkgs/development/compilers/ldc/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
   hardeningDisable = [ "fortify" ];
 
   postUnpack = ''
-      patchShebangs .
+    patchShebangs .
   ''
 
   + stdenv.lib.optionalString (!bootstrapVersion) ''
@@ -76,47 +76,31 @@ stdenv.mkDerivation rec {
   '';
 
   nativeBuildInputs = [ cmake ninja makeWrapper unzip ]
-
-  ++ stdenv.lib.optional (!bootstrapVersion) [
-    bootstrapLdc python lit
-  ]
-
-  ++ stdenv.lib.optional (!bootstrapVersion && stdenv.hostPlatform.isDarwin) [
-    # https://github.com/NixOS/nixpkgs/issues/57120
-    # https://github.com/NixOS/nixpkgs/pull/59197#issuecomment-481972515
-    llvm_5
-  ]
-
-  ++ stdenv.lib.optional (!bootstrapVersion && !stdenv.hostPlatform.isDarwin) [
-    llvm_8
-  ]
-
-  ++ stdenv.lib.optional (!bootstrapVersion && !stdenv.hostPlatform.isDarwin) [
-    # https://github.com/NixOS/nixpkgs/pull/36378#issuecomment-385034818
-    gdb
-  ]
-
-  ++ stdenv.lib.optional (bootstrapVersion) [
-    libconfig llvm_5
-  ]
-
-  ++ stdenv.lib.optional stdenv.hostPlatform.isDarwin (with darwin.apple_sdk.frameworks; [
-    Foundation
-  ]);
+    ++ stdenv.lib.optionals (!bootstrapVersion) [
+      bootstrapLdc python lit
+    ]
+    ++ stdenv.lib.optional (!bootstrapVersion && stdenv.hostPlatform.isDarwin)
+      # https://github.com/NixOS/nixpkgs/issues/57120
+      # https://github.com/NixOS/nixpkgs/pull/59197#issuecomment-481972515
+      llvm_5
+    ++ stdenv.lib.optional (!bootstrapVersion && !stdenv.hostPlatform.isDarwin)
+      llvm_8
+    ++ stdenv.lib.optional (!bootstrapVersion && !stdenv.hostPlatform.isDarwin)
+      # https://github.com/NixOS/nixpkgs/pull/36378#issuecomment-385034818
+      gdb
+    ++ stdenv.lib.optionals (bootstrapVersion) [
+      libconfig llvm_5
+    ]
+    ++ stdenv.lib.optional stdenv.hostPlatform.isDarwin
+      darwin.apple_sdk.frameworks.Foundation;
 
 
   buildInputs = [ curl tzdata ];
 
-  cmakeFlagsString = stdenv.lib.optionalString (!bootstrapVersion) ''
+  cmakeFlags = stdenv.lib.optionals (!bootstrapVersion) [
     "-DD_FLAGS=-d-version=TZDatabaseDir;-d-version=LibcurlPath;-J$PWD"
     "-DCMAKE_BUILD_TYPE=Release"
-  '';
-
-  preConfigure = stdenv.lib.optionalString (!bootstrapVersion) ''
-    cmakeFlagsArray=(
-      ${cmakeFlagsString}
-    )
-  '';
+  ];
 
   postConfigure = ''
     export DMD=$PWD/bin/ldmd2
@@ -124,7 +108,7 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "DMD=$DMD" ];
 
-  fixNames = if stdenv.hostPlatform.isDarwin then ''
+  fixNames = stdenv.lib.optionalString stdenv.hostPlatform.isDarwin  ''
     fixDarwinDylibNames() {
       local flags=()
 
@@ -141,15 +125,11 @@ stdenv.mkDerivation rec {
 
     fixDarwinDylibNames $(find "$(pwd)/lib" -name "*.dylib")
     export DYLD_LIBRARY_PATH=$(pwd)/lib
-  ''
-  else
-    "";
+  '';
 
   # https://github.com/ldc-developers/ldc/issues/2497#issuecomment-459633746
-  additionalExceptions = if stdenv.hostPlatform.isDarwin then
-    "|druntime-test-shared"
-  else
-    "";
+  additionalExceptions = stdenv.lib.optionalString stdenv.hostPlatform.isDarwin
+    "|druntime-test-shared";
 
   doCheck = !bootstrapVersion;
 
diff --git a/pkgs/development/compilers/llvm/3.9/clang/0001-Fix-compilation-w-gcc9.patch b/pkgs/development/compilers/llvm/3.9/clang/0001-Fix-compilation-w-gcc9.patch
new file mode 100644
index 00000000000..1058cd03176
--- /dev/null
+++ b/pkgs/development/compilers/llvm/3.9/clang/0001-Fix-compilation-w-gcc9.patch
@@ -0,0 +1,63 @@
+From 7225c7754cc3431d05df367c60f309f27586f188 Mon Sep 17 00:00:00 2001
+From: Maximilian Bosch <maximilian@mbosch.me>
+Date: Mon, 30 Dec 2019 01:42:52 +0100
+Subject: [PATCH] Fix compilation w/gcc9
+
+Build broken with the following errors:
+
+```
+clang> /build/clang/lib/CodeGen/CGOpenMPRuntime.cpp: In lambda function:
+clang> /build/clang/lib/CodeGen/CGOpenMPRuntime.cpp:6078:55: error: lambda parameter 'CGF' previously declared as a capture
+clang> 6078 |                          &NumOfPtrs](CodeGenFunction &CGF, PrePostActionTy &) {
+clang> |                                      ~~~~~~~~~~~~~~~~~^~~
+clang> /build/clang/lib/CodeGen/CGOpenMPRuntime.cpp: In lambda function:
+clang> /build/clang/lib/CodeGen/CGOpenMPRuntime.cpp:6126:53: error: lambda parameter 'CGF' previously declared as a capture
+clang> 6126 |                        &NumOfPtrs](CodeGenFunction &CGF, PrePostActionTy &) {
+clang> |                                    ~~~~~~~~~~~~~~~~~^~~
+clang> /build/clang/lib/CodeGen/CGOpenMPRuntime.cpp: In lambda function:
+clang> /build/clang/lib/CodeGen/CGOpenMPRuntime.cpp:6191:56: error: lambda parameter 'CGF' previously declared as a capture
+clang> 6191 |   auto &&ThenGen = [&D, &CGF, Device](CodeGenFunction &CGF, PrePostActionTy &) {
+clang> |                                       ~~~~~~~~~~~~~~~~~^~~
+```
+
+This was due to a bug about name-collisions fixed in GCC 9.0[1].
+
+[1] http://www.open-std.org/jtc1/sc22/wg21/docs/cwg_defects.html#2211
+---
+ lib/CodeGen/CGOpenMPRuntime.cpp | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/lib/CodeGen/CGOpenMPRuntime.cpp b/lib/CodeGen/CGOpenMPRuntime.cpp
+index 6a0edbe..96c281c 100644
+--- a/lib/CodeGen/CGOpenMPRuntime.cpp
++++ b/lib/CodeGen/CGOpenMPRuntime.cpp
+@@ -6073,7 +6073,7 @@ void CGOpenMPRuntime::emitTargetDataCalls(CodeGenFunction &CGF,
+   // Generate the code for the opening of the data environment. Capture all the
+   // arguments of the runtime call by reference because they are used in the
+   // closing of the region.
+-  auto &&BeginThenGen = [&D, &CGF, &BasePointersArray, &PointersArray,
++  auto &&BeginThenGen = [&D, &BasePointersArray, &PointersArray,
+                          &SizesArray, &MapTypesArray, Device,
+                          &NumOfPtrs](CodeGenFunction &CGF, PrePostActionTy &) {
+     // Fill up the arrays with all the mapped variables.
+@@ -6121,7 +6121,7 @@ void CGOpenMPRuntime::emitTargetDataCalls(CodeGenFunction &CGF,
+   };
+ 
+   // Generate code for the closing of the data region.
+-  auto &&EndThenGen = [&CGF, &BasePointersArray, &PointersArray, &SizesArray,
++  auto &&EndThenGen = [&BasePointersArray, &PointersArray, &SizesArray,
+                        &MapTypesArray, Device,
+                        &NumOfPtrs](CodeGenFunction &CGF, PrePostActionTy &) {
+     assert(BasePointersArray && PointersArray && SizesArray && MapTypesArray &&
+@@ -6188,7 +6188,7 @@ void CGOpenMPRuntime::emitTargetDataStandAloneCall(
+          "Expecting either target enter, exit data, or update directives.");
+ 
+   // Generate the code for the opening of the data environment.
+-  auto &&ThenGen = [&D, &CGF, Device](CodeGenFunction &CGF, PrePostActionTy &) {
++  auto &&ThenGen = [&D, Device](CodeGenFunction &CGF, PrePostActionTy &) {
+     // Fill up the arrays with all the mapped variables.
+     MappableExprsHandler::MapValuesArrayTy BasePointers;
+     MappableExprsHandler::MapValuesArrayTy Pointers;
+-- 
+2.23.1
+
diff --git a/pkgs/development/compilers/llvm/3.9/clang/default.nix b/pkgs/development/compilers/llvm/3.9/clang/default.nix
index 3d09277ad4c..1666b3d842d 100644
--- a/pkgs/development/compilers/llvm/3.9/clang/default.nix
+++ b/pkgs/development/compilers/llvm/3.9/clang/default.nix
@@ -27,7 +27,10 @@ let
     (stdenv.lib.optional stdenv.isLinux "-DGCC_INSTALL_PREFIX=${gcc}") ++
     (stdenv.lib.optional (stdenv.cc.libc != null) "-DC_INCLUDE_DIRS=${stdenv.cc.libc}/include");
 
-    patches = [ ./purity.patch ];
+    patches = [
+      ./purity.patch
+      ./0001-Fix-compilation-w-gcc9.patch
+    ];
 
     postPatch = ''
       sed -i -e 's/Args.hasArg(options::OPT_nostdlibinc)/true/' lib/Driver/Tools.cpp
diff --git a/pkgs/development/compilers/llvm/4/clang/0001-Fix-compilation-w-gcc9.patch b/pkgs/development/compilers/llvm/4/clang/0001-Fix-compilation-w-gcc9.patch
new file mode 100644
index 00000000000..ea934257408
--- /dev/null
+++ b/pkgs/development/compilers/llvm/4/clang/0001-Fix-compilation-w-gcc9.patch
@@ -0,0 +1,59 @@
+From a2af0b02eba35d0670e3e442ff7c61b3e2304edd Mon Sep 17 00:00:00 2001
+From: Maximilian Bosch <maximilian@mbosch.me>
+Date: Mon, 30 Dec 2019 02:11:35 +0100
+Subject: [PATCH] Fix compilation w/gcc9
+
+Build broken with the following errors:
+
+```
+clang> /build/clang/lib/CodeGen/CGOpenMPRuntime.cpp: In lambda function:
+clang> /build/clang/lib/CodeGen/CGOpenMPRuntime.cpp:6275:24: error: lambda parameter 'CGF' previously declared as a capture
+clang> 6275 |       CodeGenFunction &CGF, PrePostActionTy &) {
+clang> |       ~~~~~~~~~~~~~~~~~^~~
+clang> /build/clang/lib/CodeGen/CGOpenMPRuntime.cpp: In lambda function:
+clang> /build/clang/lib/CodeGen/CGOpenMPRuntime.cpp:6321:62: error: lambda parameter 'CGF' previously declared as a capture
+clang> 6321 |   auto &&EndThenGen = [&CGF, Device, &Info](CodeGenFunction &CGF,
+clang> |                                             ~~~~~~~~~~~~~~~~~^~~
+clang> /build/clang/lib/CodeGen/CGOpenMPRuntime.cpp: In lambda function:
+clang> /build/clang/lib/CodeGen/CGOpenMPRuntime.cpp:6400:56: error: lambda parameter 'CGF' previously declared as a capture
+clang> 6400 |   auto &&ThenGen = [&D, &CGF, Device](CodeGenFunction &CGF, PrePostActionTy &) {
+clang> |                                       ~~~~~~~~~~~~~~~~~^~~
+```
+---
+ lib/CodeGen/CGOpenMPRuntime.cpp | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/lib/CodeGen/CGOpenMPRuntime.cpp b/lib/CodeGen/CGOpenMPRuntime.cpp
+index 4025217..40a73ef 100644
+--- a/lib/CodeGen/CGOpenMPRuntime.cpp
++++ b/lib/CodeGen/CGOpenMPRuntime.cpp
+@@ -6271,7 +6271,7 @@ void CGOpenMPRuntime::emitTargetDataCalls(
+   // Generate the code for the opening of the data environment. Capture all the
+   // arguments of the runtime call by reference because they are used in the
+   // closing of the region.
+-  auto &&BeginThenGen = [&D, &CGF, Device, &Info, &CodeGen, &NoPrivAction](
++  auto &&BeginThenGen = [&D, Device, &Info, &CodeGen, &NoPrivAction](
+       CodeGenFunction &CGF, PrePostActionTy &) {
+     // Fill up the arrays with all the mapped variables.
+     MappableExprsHandler::MapBaseValuesArrayTy BasePointers;
+@@ -6318,7 +6318,7 @@ void CGOpenMPRuntime::emitTargetDataCalls(
+   };
+ 
+   // Generate code for the closing of the data region.
+-  auto &&EndThenGen = [&CGF, Device, &Info](CodeGenFunction &CGF,
++  auto &&EndThenGen = [Device, &Info](CodeGenFunction &CGF,
+                                             PrePostActionTy &) {
+     assert(Info.isValid() && "Invalid data environment closing arguments.");
+ 
+@@ -6397,7 +6397,7 @@ void CGOpenMPRuntime::emitTargetDataStandAloneCall(
+          "Expecting either target enter, exit data, or update directives.");
+ 
+   // Generate the code for the opening of the data environment.
+-  auto &&ThenGen = [&D, &CGF, Device](CodeGenFunction &CGF, PrePostActionTy &) {
++  auto &&ThenGen = [&D, Device](CodeGenFunction &CGF, PrePostActionTy &) {
+     // Fill up the arrays with all the mapped variables.
+     MappableExprsHandler::MapBaseValuesArrayTy BasePointers;
+     MappableExprsHandler::MapValuesArrayTy Pointers;
+-- 
+2.23.1
+
diff --git a/pkgs/development/compilers/llvm/4/clang/default.nix b/pkgs/development/compilers/llvm/4/clang/default.nix
index 6b67e2cc856..a90fbe6ae83 100644
--- a/pkgs/development/compilers/llvm/4/clang/default.nix
+++ b/pkgs/development/compilers/llvm/4/clang/default.nix
@@ -38,7 +38,10 @@ let
     ++ stdenv.lib.optional stdenv.isLinux "-DGCC_INSTALL_PREFIX=${gcc}"
     ++ stdenv.lib.optional (stdenv.cc.libc != null) "-DC_INCLUDE_DIRS=${stdenv.cc.libc}/include";
 
-    patches = [ ./purity.patch ];
+    patches = [
+      ./purity.patch
+      ./0001-Fix-compilation-w-gcc9.patch
+    ];
 
     postPatch = ''
       sed -i -e 's/Args.hasArg(options::OPT_nostdlibinc)/true/' lib/Driver/Tools.cpp
diff --git a/pkgs/development/compilers/llvm/4/fix-gcc9.patch b/pkgs/development/compilers/llvm/4/fix-gcc9.patch
new file mode 100644
index 00000000000..8ea5ca97085
--- /dev/null
+++ b/pkgs/development/compilers/llvm/4/fix-gcc9.patch
@@ -0,0 +1,33 @@
+diff --git a/lib/Target/Mips/MipsFastISel.cpp b/lib/Target/Mips/MipsFastISel.cpp
+index f79cb0e6..c6279046 100644
+--- a/lib/Target/Mips/MipsFastISel.cpp
++++ b/lib/Target/Mips/MipsFastISel.cpp
+@@ -32,6 +32,7 @@
+ #include "llvm/MC/MCSymbol.h"
+ #include "llvm/Target/TargetInstrInfo.h"
+ #include "llvm/Support/Debug.h"
++#include <array>
+ 
+ #define DEBUG_TYPE "mips-fastisel"
+ 
+@@ -1268,13 +1269,13 @@ bool MipsFastISel::fastLowerArguments() {
+     return false;
+   }
+ 
+-  const ArrayRef<MCPhysReg> GPR32ArgRegs = {Mips::A0, Mips::A1, Mips::A2,
+-                                            Mips::A3};
+-  const ArrayRef<MCPhysReg> FGR32ArgRegs = {Mips::F12, Mips::F14};
+-  const ArrayRef<MCPhysReg> AFGR64ArgRegs = {Mips::D6, Mips::D7};
+-  ArrayRef<MCPhysReg>::iterator NextGPR32 = GPR32ArgRegs.begin();
+-  ArrayRef<MCPhysReg>::iterator NextFGR32 = FGR32ArgRegs.begin();
+-  ArrayRef<MCPhysReg>::iterator NextAFGR64 = AFGR64ArgRegs.begin();
++   std::array<MCPhysReg, 4> GPR32ArgRegs = {{Mips::A0, Mips::A1, Mips::A2,
++                                            Mips::A3}};
++   std::array<MCPhysReg, 2> FGR32ArgRegs = {{Mips::F12, Mips::F14}};
++   std::array<MCPhysReg, 2> AFGR64ArgRegs = {{Mips::D6, Mips::D7}};
++   auto NextGPR32 = GPR32ArgRegs.begin();
++   auto NextFGR32 = FGR32ArgRegs.begin();
++   auto NextAFGR64 = AFGR64ArgRegs.begin();
+ 
+   struct AllocatedReg {
+     const TargetRegisterClass *RC;
diff --git a/pkgs/development/compilers/llvm/4/llvm.nix b/pkgs/development/compilers/llvm/4/llvm.nix
index 5b5939e094d..317a5ea06f4 100644
--- a/pkgs/development/compilers/llvm/4/llvm.nix
+++ b/pkgs/development/compilers/llvm/4/llvm.nix
@@ -53,6 +53,13 @@ stdenv.mkDerivation ({
       url = "https://bugzilla.redhat.com/attachment.cgi?id=1389687";
       sha256 = "0ga2123aclq3x9w72d0rm0az12m8c1i4r1106vh701hf4cghgbch";
     })
+    ./fix-gcc9.patch
+    (fetchpatch {
+      name = "llvm4-avoid-undefined-behavior-in-unittest.patch";
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/D32089-Avoid-undefined-behavior-in-unittest.patch?h=llvm40&id=f459b0bad8aa3b94bc2733d79d176071a32846a6";
+      sha256 = "0x5q6a8lk6xg4ns4qh75fxvvmfnifwvyrq17ck85q8c0753i1irf";
+      extraPrefix = "";
+    })
   ];
 
   # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
diff --git a/pkgs/development/compilers/llvm/5/fix-gcc9.patch b/pkgs/development/compilers/llvm/5/fix-gcc9.patch
new file mode 100644
index 00000000000..eaf71f1468d
--- /dev/null
+++ b/pkgs/development/compilers/llvm/5/fix-gcc9.patch
@@ -0,0 +1,33 @@
+diff --git a/lib/Target/Mips/MipsFastISel.cpp b/lib/Target/Mips/MipsFastISel.cpp
+index f79cb0e6..c6279046 100644
+--- a/lib/Target/Mips/MipsFastISel.cpp
++++ b/lib/Target/Mips/MipsFastISel.cpp
+@@ -70,6 +70,7 @@
+ #include <cassert>
+ #include <cstdint>
+ #include <new>
++#include <array>
+ 
+ #define DEBUG_TYPE "mips-fastisel"
+ 
+@@ -1309,13 +1310,13 @@ bool MipsFastISel::fastLowerArguments() {
+     return false;
+   }
+ 
+-  const ArrayRef<MCPhysReg> GPR32ArgRegs = {Mips::A0, Mips::A1, Mips::A2,
+-                                            Mips::A3};
+-  const ArrayRef<MCPhysReg> FGR32ArgRegs = {Mips::F12, Mips::F14};
+-  const ArrayRef<MCPhysReg> AFGR64ArgRegs = {Mips::D6, Mips::D7};
+-  ArrayRef<MCPhysReg>::iterator NextGPR32 = GPR32ArgRegs.begin();
+-  ArrayRef<MCPhysReg>::iterator NextFGR32 = FGR32ArgRegs.begin();
+-  ArrayRef<MCPhysReg>::iterator NextAFGR64 = AFGR64ArgRegs.begin();
++   std::array<MCPhysReg, 4> GPR32ArgRegs = {{Mips::A0, Mips::A1, Mips::A2,
++                                            Mips::A3}};
++   std::array<MCPhysReg, 2> FGR32ArgRegs = {{Mips::F12, Mips::F14}};
++   std::array<MCPhysReg, 2> AFGR64ArgRegs = {{Mips::D6, Mips::D7}};
++   auto NextGPR32 = GPR32ArgRegs.begin();
++   auto NextFGR32 = FGR32ArgRegs.begin();
++   auto NextAFGR64 = AFGR64ArgRegs.begin();
+ 
+   struct AllocatedReg {
+     const TargetRegisterClass *RC;
diff --git a/pkgs/development/compilers/llvm/5/llvm.nix b/pkgs/development/compilers/llvm/5/llvm.nix
index 97d0e0d5d84..d26af8438e7 100644
--- a/pkgs/development/compilers/llvm/5/llvm.nix
+++ b/pkgs/development/compilers/llvm/5/llvm.nix
@@ -50,6 +50,13 @@ stdenv.mkDerivation ({
       name = "llvm-gcc8-type-mismatch.patch";
       sha256 = "0ga2123aclq3x9w72d0rm0az12m8c1i4r1106vh701hf4cghgbch";
     })
+    ./fix-gcc9.patch
+    #(fetchpatch {
+    #  name = "llvm-fix-gcc9.patch";
+    #  url = "https://reviews.llvm.org/file/data/zs3ck5ryvc5n672fd2kw/PHID-FILE-byoqefzwmkd7qnlip4v2/file";
+    #  sha256 = "0injj1hqgrbcbihhwp2nbal88jfykad30r54f2cdcx7gws2fcy8i";
+    #  stripLen = 1;
+    #})
   ];
   postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
     substituteInPlace cmake/modules/AddLLVM.cmake \
diff --git a/pkgs/development/compilers/nim/default.nix b/pkgs/development/compilers/nim/default.nix
index dee0b351a60..bdb16c92207 100644
--- a/pkgs/development/compilers/nim/default.nix
+++ b/pkgs/development/compilers/nim/default.nix
@@ -14,13 +14,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_LDFLAGS = [
-    "-lcrypto"
-    "-lpcre"
-    "-lreadline"
-    "-lgc"
-    "-lsqlite3"
-  ];
+  NIX_LDFLAGS = "-lcrypto -lpcre -lreadline -lgc -lsqlite3";
 
   # we could create a separate derivation for the "written in c" version of nim
   # used for bootstrapping, but koch insists on moving the nim compiler around
diff --git a/pkgs/development/compilers/ocaml/3.10.0.nix b/pkgs/development/compilers/ocaml/3.10.0.nix
index 556aefd3704..a6d2bcd875e 100644
--- a/pkgs/development/compilers/ocaml/3.10.0.nix
+++ b/pkgs/development/compilers/ocaml/3.10.0.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation (rec {
 
   prefixKey = "-prefix ";
   configureFlags = ["-no-tk" "-x11lib" xlibsWrapper];
-  buildFlags = "world bootstrap world.opt";
+  buildFlags = [ "world" "bootstrap" "world.opt" ];
   buildInputs = [xlibsWrapper ncurses];
   installTargets = "install installopt";
   patchPhase = ''
diff --git a/pkgs/development/compilers/ocaml/3.11.2.nix b/pkgs/development/compilers/ocaml/3.11.2.nix
index 4be41490534..f582ef9834a 100644
--- a/pkgs/development/compilers/ocaml/3.11.2.nix
+++ b/pkgs/development/compilers/ocaml/3.11.2.nix
@@ -7,10 +7,10 @@ let
 in
 
 stdenv.mkDerivation rec {
-  
+
   pname = "ocaml";
   version = "3.11.2";
-  
+
   src = fetchurl {
     url = "https://caml.inria.fr/pub/distrib/ocaml-3.11/${pname}-${version}.tar.bz2";
     sha256 = "86f3387a0d7e7c8be2a3c53af083a5a726e333686208d5ea0dd6bb5ac3f58143";
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
 
   prefixKey = "-prefix ";
   configureFlags = ["-no-tk"] ++ optionals useX11 [ "-x11lib" xlibsWrapper ];
-  buildFlags = "world" + optionalString useNativeCompilers " bootstrap world.opt";
+  buildFlags = [ "world" ] ++ optionals useNativeCompilers [ "bootstrap" "world.opt" ];
   buildInputs = [ncurses] ++ optionals useX11 [ xlibsWrapper ];
   installTargets = "install" + optionalString useNativeCompilers " installopt";
   prePatch = ''
diff --git a/pkgs/development/compilers/ocaml/3.12.1.nix b/pkgs/development/compilers/ocaml/3.12.1.nix
index edb3acdbdb1..1026b1bd8d7 100644
--- a/pkgs/development/compilers/ocaml/3.12.1.nix
+++ b/pkgs/development/compilers/ocaml/3.12.1.nix
@@ -7,10 +7,10 @@ let
 in
 
 stdenv.mkDerivation rec {
-  
+
   pname = "ocaml";
   version = "3.12.1";
-  
+
   src = fetchurl {
     url = "https://caml.inria.fr/pub/distrib/ocaml-3.12/${pname}-${version}.tar.bz2";
     sha256 = "13cmhkh7s6srnlvhg3s9qzh3a5dbk2m9qr35jzq922sylwymdkzd";
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   prefixKey = "-prefix ";
   configureFlags = ["-no-tk"] ++ optionals useX11 [ "-x11lib" xlibsWrapper ];
-  buildFlags = "world" + optionalString useNativeCompilers " bootstrap world.opt";
+  buildFlags = [ "world" ] ++ optionals useNativeCompilers [ "bootstrap" "world.opt" ];
   buildInputs = [ncurses] ++ optionals useX11 [ xlibsWrapper ];
   installTargets = "install" + optionalString useNativeCompilers " installopt";
   patches = optionals stdenv.isDarwin [ ./3.12.1-darwin-fix-configure.patch ];
diff --git a/pkgs/development/compilers/ocaml/4.00.1.nix b/pkgs/development/compilers/ocaml/4.00.1.nix
index 2669e8224bf..a4b21251bd1 100644
--- a/pkgs/development/compilers/ocaml/4.00.1.nix
+++ b/pkgs/development/compilers/ocaml/4.00.1.nix
@@ -3,22 +3,22 @@
 let
    useX11 = !stdenv.isAarch32 && !stdenv.isMips;
    useNativeCompilers = !stdenv.isMips;
-   inherit (stdenv.lib) optionals optionalString;
+   inherit (stdenv.lib) optional optionals optionalString;
 in
 
 stdenv.mkDerivation rec {
   pname = "ocaml";
   version = "4.00.1";
-  
+
   src = fetchurl {
     url = "https://caml.inria.fr/pub/distrib/ocaml-4.00/${pname}-${version}.tar.bz2";
     sha256 = "33c3f4acff51685f5bfd7c260f066645e767d4e865877bf1613c176a77799951";
   };
 
   prefixKey = "-prefix ";
-  configureFlags = ["-no-tk"] ++ optionals useX11 [ "-x11lib" xlibsWrapper ];
-  buildFlags = "world" + optionalString useNativeCompilers " bootstrap world.opt";
-  buildInputs = [ncurses] ++ optionals useX11 [ xlibsWrapper ];
+  configureFlags = [ "-no-tk" ] ++ optionals useX11 [ "-x11lib" xlibsWrapper ];
+  buildFlags = [ "world" ] ++ optionals useNativeCompilers [ "bootstrap" "world.opt" ];
+  buildInputs = [ ncurses ] ++ optional useX11 xlibsWrapper;
   installTargets = "install" + optionalString useNativeCompilers " installopt";
   preConfigure = ''
     CAT=$(type -tp cat)
diff --git a/pkgs/development/compilers/ocaml/generic.nix b/pkgs/development/compilers/ocaml/generic.nix
index d39c0d86fd5..6980b6e5ff1 100644
--- a/pkgs/development/compilers/ocaml/generic.nix
+++ b/pkgs/development/compilers/ocaml/generic.nix
@@ -55,10 +55,10 @@ stdenv.mkDerivation (args // {
   ++ optional flambdaSupport (flags "--enable-flambda" "-flambda")
   ;
 
-  buildFlags = "world" + optionalString useNativeCompilers " bootstrap world.opt";
+  buildFlags = [ "world" ] ++ optionals useNativeCompilers [ "bootstrap" "world.opt" ];
   buildInputs = optional (!stdenv.lib.versionAtLeast version "4.07") ncurses
     ++ optionals useX11 [ libX11 xorgproto ];
-  installTargets = "install" + optionalString useNativeCompilers " installopt";
+  installTargets = [ "install" ] ++ optional useNativeCompilers "installopt";
   preConfigure = optionalString (!stdenv.lib.versionAtLeast version "4.04") ''
     CAT=$(type -tp cat)
     sed -e "s@/bin/cat@$CAT@" -i config/auto-aux/sharpbang
diff --git a/pkgs/development/compilers/ocaml/metaocaml-3.09.nix b/pkgs/development/compilers/ocaml/metaocaml-3.09.nix
index aa50cf225ca..1f53c4f0e78 100644
--- a/pkgs/development/compilers/ocaml/metaocaml-3.09.nix
+++ b/pkgs/development/compilers/ocaml/metaocaml-3.09.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation ({
 
   prefixKey = "-prefix ";
   configureFlags = ["-no-tk" "-x11lib" xlibsWrapper];
-  buildFlags = "world bootstrap world.opt";
+  buildFlags = [ "world" "bootstrap" "world.opt" ];
   buildInputs = [xlibsWrapper ncurses];
   installTargets = "install installopt";
   patchPhase = ''
diff --git a/pkgs/development/compilers/openjdk/11.nix b/pkgs/development/compilers/openjdk/11.nix
index e365b9b28b3..b8381feef09 100644
--- a/pkgs/development/compilers/openjdk/11.nix
+++ b/pkgs/development/compilers/openjdk/11.nix
@@ -61,13 +61,13 @@ let
 
     separateDebugInfo = true;
 
-    NIX_CFLAGS_COMPILE = [ "-Wno-error" ];
+    NIX_CFLAGS_COMPILE = "-Wno-error";
 
-    NIX_LDFLAGS = lib.optionals (!headless) [
+    NIX_LDFLAGS = toString (lib.optionals (!headless) [
       "-lfontconfig" "-lcups" "-lXinerama" "-lXrandr" "-lmagic"
     ] ++ lib.optionals (!headless && enableGnome2) [
       "-lgtk-3" "-lgio-2.0" "-lgnomevfs-2" "-lgconf-2"
-    ];
+    ]);
 
     buildFlags = [ "all" ];
 
diff --git a/pkgs/development/compilers/openjdk/8.nix b/pkgs/development/compilers/openjdk/8.nix
index 4debf10c0cb..c6b3644fecc 100644
--- a/pkgs/development/compilers/openjdk/8.nix
+++ b/pkgs/development/compilers/openjdk/8.nix
@@ -140,7 +140,7 @@ let
 
     separateDebugInfo = true;
 
-    NIX_CFLAGS_COMPILE = [
+    NIX_CFLAGS_COMPILE = toString ([
       # glibc 2.24 deprecated readdir_r so we need this
       # See https://www.mail-archive.com/openembedded-devel@lists.openembedded.org/msg49006.html
       "-Wno-error=deprecated-declarations"
@@ -151,13 +151,13 @@ let
       "-fno-delete-null-pointer-checks"
       "-std=gnu++98"
       "-Wno-error"
-    ];
+    ]);
 
-    NIX_LDFLAGS= lib.optionals (!headless) [
+    NIX_LDFLAGS= toString (lib.optionals (!headless) [
       "-lfontconfig" "-lcups" "-lXinerama" "-lXrandr" "-lmagic"
     ] ++ lib.optionals (!headless && enableGnome2) [
       "-lgtk-x11-2.0" "-lgio-2.0" "-lgnomevfs-2" "-lgconf-2"
-    ];
+    ]);
 
     buildFlags = [ "all" ];
 
diff --git a/pkgs/development/compilers/openjdk/default.nix b/pkgs/development/compilers/openjdk/default.nix
index 03121daf961..b2d511173c4 100644
--- a/pkgs/development/compilers/openjdk/default.nix
+++ b/pkgs/development/compilers/openjdk/default.nix
@@ -69,13 +69,13 @@ let
 
     separateDebugInfo = true;
 
-    NIX_CFLAGS_COMPILE = [ "-Wno-error" ];
+    NIX_CFLAGS_COMPILE = "-Wno-error";
 
-    NIX_LDFLAGS = lib.optionals (!headless) [
+    NIX_LDFLAGS = toString (lib.optionals (!headless) [
       "-lfontconfig" "-lcups" "-lXinerama" "-lXrandr" "-lmagic"
     ] ++ lib.optionals (!headless && enableGnome2) [
       "-lgtk-3" "-lgio-2.0" "-lgnomevfs-2" "-lgconf-2"
-    ];
+    ]);
 
     buildFlags = [ "all" ];
 
diff --git a/pkgs/development/compilers/openjdk/openjfx/11.nix b/pkgs/development/compilers/openjdk/openjfx/11.nix
index 43fe8ed8387..c6bff396108 100644
--- a/pkgs/development/compilers/openjdk/openjfx/11.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/11.nix
@@ -84,7 +84,7 @@ in makePackage {
   '';
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = [ "-DGLIB_DISABLE_DEPRECATION_WARNINGS" ];
+  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   stripDebugList = [ "." ];
 
diff --git a/pkgs/development/compilers/openjdk/openjfx/12.nix b/pkgs/development/compilers/openjdk/openjfx/12.nix
index 356ac4800d9..30c8d36fdfc 100644
--- a/pkgs/development/compilers/openjdk/openjfx/12.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/12.nix
@@ -84,7 +84,7 @@ in makePackage {
   '';
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = [ "-DGLIB_DISABLE_DEPRECATION_WARNINGS" ];
+  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   stripDebugList = [ "." ];
 
diff --git a/pkgs/development/compilers/ponyc/default.nix b/pkgs/development/compilers/ponyc/default.nix
index c21bcfb2ecc..f5bcfa20aa0 100644
--- a/pkgs/development/compilers/ponyc/default.nix
+++ b/pkgs/development/compilers/ponyc/default.nix
@@ -54,6 +54,8 @@ stdenv.mkDerivation ( rec {
 
   checkTarget = "test-ci";
 
+  NIX_CFLAGS_COMPILE = [ "-Wno-error=redundant-move" ];
+
   preCheck = ''
     export PONYPATH="$out/lib:${stdenv.lib.makeLibraryPath [ pcre2 libressl ]}"
   '';
diff --git a/pkgs/development/compilers/rgbds/default.nix b/pkgs/development/compilers/rgbds/default.nix
index 99519c53fcd..bf2594b9bf4 100644
--- a/pkgs/development/compilers/rgbds/default.nix
+++ b/pkgs/development/compilers/rgbds/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     sha256 = "0pzd9ig3ahpgq7jbj82grllxx1v01d620insr2m8h0c6jj25n5hv";
   };
   nativeBuildInputs = [ bison flex pkg-config libpng ];
-  installFlags = "PREFIX=\${out}";
+  installFlags = [ "PREFIX=\${out}" ];
 
   meta = with stdenv.lib; {
     homepage = https://rednex.github.io/rgbds/;
diff --git a/pkgs/development/compilers/rust/1_39_0.nix b/pkgs/development/compilers/rust/1_39_0.nix
deleted file mode 100644
index e86be63bf3a..00000000000
--- a/pkgs/development/compilers/rust/1_39_0.nix
+++ /dev/null
@@ -1,29 +0,0 @@
-# New rust versions should first go to staging.
-# Things to check after updating:
-# 1. Rustc should produce rust binaries on x86_64-linux, aarch64-linux and x86_64-darwin:
-#    i.e. nix-shell -p fd or @GrahamcOfBorg build fd on github
-#    This testing can be also done by other volunteers as part of the pull
-#    request review, in case platforms cannot be covered.
-# 2. The LLVM version used for building should match with rust upstream.
-# 3. Firefox and Thunderbird should still build on x86_64-linux.
-import ./default.nix {
-  rustcVersion = "1.39.0";
-  rustcSha256 = "0mwkc1bnil2cfyf6nglpvbn2y0zfbv44zfhsd5qg4c9rm6vgd8dl";
-
-  # Note: the version MUST be one version prior to the version we're
-  # building
-  bootstrapVersion = "1.38.0";
-
-  # fetch hashes by running `print-hashes.sh 1.38.0`
-  bootstrapHashes = {
-    i686-unknown-linux-gnu = "41aed8a350e24a0cac1444ed99b3dd24a90bc581dd88cb420c6e547d6b5f57af";
-    x86_64-unknown-linux-gnu = "adda26b3f0609dbfbdc2019da4a20101879b9db2134fae322a4e863a069ec221";
-    arm-unknown-linux-gnueabihf = "0603a3d3d16ae8f3b3b117eb699e8f3ef7532a6f6d3c29d13e7d4614fc3c9e7a";
-    armv7-unknown-linux-gnueabihf = "8b1bf1680a61a643d6b5c7a3b1a1ce88448652756395e20ba5846739cbd085c4";
-    aarch64-unknown-linux-gnu = "06afd6d525326cea95c3aa658aaa8542eab26f44235565bb16913ac9d12b7bda";
-    i686-apple-darwin = "cdbf2807774bed350a3af6f41d7f7dd7ceff28777cde310c3ba90033188eb2f8";
-    x86_64-apple-darwin = "bd301b78ddcd5d4553962b115e1dca5436dd3755ed323f86f4485769286a8a5a";
-  };
-
-  selectRustPackage = pkgs: pkgs.rust_1_39_0;
-}
diff --git a/pkgs/development/compilers/rust/1_40_0.nix b/pkgs/development/compilers/rust/1_40_0.nix
new file mode 100644
index 00000000000..2280605439f
--- /dev/null
+++ b/pkgs/development/compilers/rust/1_40_0.nix
@@ -0,0 +1,29 @@
+# New rust versions should first go to staging.
+# Things to check after updating:
+# 1. Rustc should produce rust binaries on x86_64-linux, aarch64-linux and x86_64-darwin:
+#    i.e. nix-shell -p fd or @GrahamcOfBorg build fd on github
+#    This testing can be also done by other volunteers as part of the pull
+#    request review, in case platforms cannot be covered.
+# 2. The LLVM version used for building should match with rust upstream.
+# 3. Firefox and Thunderbird should still build on x86_64-linux.
+import ./default.nix {
+  rustcVersion = "1.40.0";
+  rustcSha256 = "1ba9llwhqm49w7sz3z0gqscj039m53ky9wxzhaj11z6yg1ah15yx";
+
+  # Note: the version MUST be one version prior to the version we're
+  # building
+  bootstrapVersion = "1.39.0";
+
+  # fetch hashes by running `print-hashes.sh 1.39.0`
+  bootstrapHashes = {
+    i686-unknown-linux-gnu = "36e31b3069c5be4b1fe3c8f7588ca787f13f91ab7170d2b24c6b07285816d0e5";
+    x86_64-unknown-linux-gnu = "b10a73e5ba90034fe51f0f02cb78f297ed3880deb7d3738aa09dc5a4d9704a25";
+    arm-unknown-linux-gnueabihf = "ea08d78a718cd34e67733526c70f3be460605dec8284bdeda36e0c6dd6222eca";
+    armv7-unknown-linux-gnueabihf = "41186745a97e6b76fb7a3a049882fb4869b526e98a66c05a133518515037f0d7";
+    aarch64-unknown-linux-gnu = "e27dc8112fe577012bd88f30e7c92dffd8c796478ce386c49465c03b6db8209f";
+    i686-apple-darwin = "0ada2ed87cc449ed470dce3b57b15bfd5c8c52b01d6116e6b1edc9a3e97836aa";
+    x86_64-apple-darwin = "3736d49c5e9592844e1a5d5452883aeaf8f1e25d671c1bc8f01e81c1766603b5";
+  };
+
+  selectRustPackage = pkgs: pkgs.rust_1_40_0;
+}
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index 49eaeef0d9c..e5c8a709a90 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -9,7 +9,7 @@
 }:
 
 let
-  inherit (stdenv.lib) optional optionalString;
+  inherit (stdenv.lib) optionals optional optionalString;
   inherit (darwin.apple_sdk.frameworks) Security;
 
   llvmSharedForBuild = pkgsBuildBuild.llvm_9.override { enableSharedLibraries = true; };
@@ -41,11 +41,11 @@ in stdenv.mkDerivation rec {
   # See: https://github.com/NixOS/nixpkgs/pull/56540#issuecomment-471624656
   stripDebugList = [ "bin" ];
 
-  NIX_LDFLAGS =
+  NIX_LDFLAGS = toString (
        # when linking stage1 libstd: cc: undefined reference to `__cxa_begin_catch'
        optional (stdenv.isLinux && !withBundledLLVM) "--push-state --as-needed -lstdc++ --pop-state"
     ++ optional (stdenv.isDarwin && !withBundledLLVM) "-lc++"
-    ++ optional stdenv.isDarwin "-rpath ${llvmSharedForHost}/lib";
+    ++ optional stdenv.isDarwin "-rpath ${llvmSharedForHost}/lib");
 
   # Increase codegen units to introduce parallelism within the compiler.
   RUSTFLAGS = "-Ccodegen-units=10";
@@ -83,12 +83,12 @@ in stdenv.mkDerivation rec {
     "${setBuild}.cxx=${cxxForBuild}"
     "${setHost}.cxx=${cxxForHost}"
     "${setTarget}.cxx=${cxxForTarget}"
-  ] ++ optional (!withBundledLLVM) [
+  ] ++ optionals (!withBundledLLVM) [
     "--enable-llvm-link-shared"
     "${setBuild}.llvm-config=${llvmSharedForBuild}/bin/llvm-config"
     "${setHost}.llvm-config=${llvmSharedForHost}/bin/llvm-config"
     "${setTarget}.llvm-config=${llvmSharedForTarget}/bin/llvm-config"
-  ] ++ optional stdenv.isLinux [
+  ] ++ optionals stdenv.isLinux [
     "--enable-profiler" # build libprofiler_builtins
   ];
 
diff --git a/pkgs/development/compilers/yap/default.nix b/pkgs/development/compilers/yap/default.nix
index 1cc96455be7..e6fdd03bb67 100644
--- a/pkgs/development/compilers/yap/default.nix
+++ b/pkgs/development/compilers/yap/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--enable-tabling=yes" ];
 
-  NIX_CFLAGS_COMPILE = [ "-fpermissive" ];
+  NIX_CFLAGS_COMPILE = "-fpermissive";
 
   meta = {
     homepage = http://www.dcc.fc.up.pt/~vsc/Yap/;
diff --git a/pkgs/development/compilers/z88dk/default.nix b/pkgs/development/compilers/z88dk/default.nix
index 433b6e6b32c..2d62bfede09 100644
--- a/pkgs/development/compilers/z88dk/default.nix
+++ b/pkgs/development/compilers/z88dk/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     # we test in checkPhase
     substituteInPlace Makefile \
       --replace 'testsuite bin/z88dk-lib$(EXESUFFIX)' 'bin/z88dk-lib$(EXESUFFIX)'\
-      --replace 'ALL_EXT = bin/zsdcc$(EXESUFFIX)' 'ALL_EXT ='   
+      --replace 'ALL_EXT = bin/zsdcc$(EXESUFFIX)' 'ALL_EXT ='
   '';
 
   checkPhase = ''
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
     mkdir -p $out/{bin,share}
   '';
 
-  installTargets = "libs install";
+  installTargets = [ "libs" "install" ];
 
   meta = with stdenv.lib; {
     homepage    = "https://www.z88dk.org";
diff --git a/pkgs/development/coq-modules/Cheerios/default.nix b/pkgs/development/coq-modules/Cheerios/default.nix
index 4e75b9407de..14048d1b0d8 100644
--- a/pkgs/development/coq-modules/Cheerios/default.nix
+++ b/pkgs/development/coq-modules/Cheerios/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
 
   preConfigure = "patchShebangs ./configure";
 
-  installFlags = "COQLIB=$(out)/lib/coq/${coq.coq-version}/";
+  installFlags = [ "COQLIB=$(out)/lib/coq/${coq.coq-version}/" ];
 
   passthru = {
     compatibleCoqVersions = v: builtins.elem v [ "8.6" "8.7" "8.8" "8.9" ];
diff --git a/pkgs/development/coq-modules/InfSeqExt/default.nix b/pkgs/development/coq-modules/InfSeqExt/default.nix
index 5df96519e7f..ced2b7ce3db 100644
--- a/pkgs/development/coq-modules/InfSeqExt/default.nix
+++ b/pkgs/development/coq-modules/InfSeqExt/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation {
 
   preConfigure = "patchShebangs ./configure";
 
-  installFlags = "COQLIB=$(out)/lib/coq/${coq.coq-version}/";
+  installFlags = [ "COQLIB=$(out)/lib/coq/${coq.coq-version}/" ];
 
   passthru = {
     compatibleCoqVersions = v: builtins.elem v [ "8.5" "8.6" "8.7" "8.8" "8.9" ];
diff --git a/pkgs/development/coq-modules/StructTact/default.nix b/pkgs/development/coq-modules/StructTact/default.nix
index 2e4d12478b7..798aaabe677 100644
--- a/pkgs/development/coq-modules/StructTact/default.nix
+++ b/pkgs/development/coq-modules/StructTact/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation {
 
   preConfigure = "patchShebangs ./configure";
 
-  installFlags = "COQLIB=$(out)/lib/coq/${coq.coq-version}/";
+  installFlags = [ "COQLIB=$(out)/lib/coq/${coq.coq-version}/" ];
 
   passthru = {
     compatibleCoqVersions = v: stdenv.lib.versionAtLeast v "8.5";
diff --git a/pkgs/development/coq-modules/Verdi/default.nix b/pkgs/development/coq-modules/Verdi/default.nix
index d2e9660a630..3cf3a4e8d4b 100644
--- a/pkgs/development/coq-modules/Verdi/default.nix
+++ b/pkgs/development/coq-modules/Verdi/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation {
 
   preConfigure = "patchShebangs ./configure";
 
-  installFlags = "COQLIB=$(out)/lib/coq/${coq.coq-version}/";
+  installFlags = [ "COQLIB=$(out)/lib/coq/${coq.coq-version}/" ];
 
   passthru = {
     compatibleCoqVersions = v: builtins.elem v [ "8.6" "8.7" "8.8" "8.9" ];
diff --git a/pkgs/development/coq-modules/autosubst/default.nix b/pkgs/development/coq-modules/autosubst/default.nix
index bffa5172b0e..ee08af40c51 100644
--- a/pkgs/development/coq-modules/autosubst/default.nix
+++ b/pkgs/development/coq-modules/autosubst/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   patches = [./0001-changes-to-work-with-Coq-8.6.patch];
 
-  installFlags = "COQLIB=$(out)/lib/coq/${coq.coq-version}/";
+  installFlags = [ "COQLIB=$(out)/lib/coq/${coq.coq-version}/" ];
 
   meta = with stdenv.lib; {
     homepage = https://www.ps.uni-saarland.de/autosubst/;
diff --git a/pkgs/development/coq-modules/bignums/default.nix b/pkgs/development/coq-modules/bignums/default.nix
index fb45e591ec1..0d6d7f17216 100644
--- a/pkgs/development/coq-modules/bignums/default.nix
+++ b/pkgs/development/coq-modules/bignums/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation {
 
   buildInputs = with coq.ocamlPackages; [ ocaml camlp5 findlib coq ];
 
-  installFlags = "COQLIB=$(out)/lib/coq/${coq.coq-version}/";
+  installFlags = [ "COQLIB=$(out)/lib/coq/${coq.coq-version}/" ];
 
   meta = with stdenv.lib; {
     license = licenses.lgpl2;
diff --git a/pkgs/development/coq-modules/coq-elpi/default.nix b/pkgs/development/coq-modules/coq-elpi/default.nix
index defe52987aa..56aa005c4a9 100644
--- a/pkgs/development/coq-modules/coq-elpi/default.nix
+++ b/pkgs/development/coq-modules/coq-elpi/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ which ];
   buildInputs = [ coq coq.ocaml ] ++ (with coq.ocamlPackages; [ findlib elpi ]);
 
-  installFlags = "COQLIB=$(out)/lib/coq/${coq.coq-version}/";
+  installFlags = [ "COQLIB=$(out)/lib/coq/${coq.coq-version}/" ];
 
   meta = {
     description = "Coq plugin embedding ELPI.";
diff --git a/pkgs/development/coq-modules/coq-ext-lib/default.nix b/pkgs/development/coq-modules/coq-ext-lib/default.nix
index 588172aea61..97703922395 100644
--- a/pkgs/development/coq-modules/coq-ext-lib/default.nix
+++ b/pkgs/development/coq-modules/coq-ext-lib/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  installFlags = "COQLIB=$(out)/lib/coq/${coq.coq-version}/";
+  installFlags = [ "COQLIB=$(out)/lib/coq/${coq.coq-version}/" ];
 
   meta = with stdenv.lib; {
     homepage = https://github.com/coq-ext-lib/coq-ext-lib;
diff --git a/pkgs/development/coq-modules/coqprime/default.nix b/pkgs/development/coq-modules/coqprime/default.nix
index 6228bd4be9d..aaf867baf25 100644
--- a/pkgs/development/coq-modules/coqprime/default.nix
+++ b/pkgs/development/coq-modules/coqprime/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ bignums ];
 
-  installFlags = "COQLIB=$(out)/lib/coq/${coq.coq-version}/";
+  installFlags = [ "COQLIB=$(out)/lib/coq/${coq.coq-version}/" ];
 
   meta = with stdenv.lib; {
     description = "Library to certify primality using Pocklington certificate and Elliptic Curve Certificate";
diff --git a/pkgs/development/coq-modules/corn/default.nix b/pkgs/development/coq-modules/corn/default.nix
index e5fa11c5cad..97bb884c92e 100644
--- a/pkgs/development/coq-modules/corn/default.nix
+++ b/pkgs/development/coq-modules/corn/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  installFlags = "COQLIB=$(out)/lib/coq/${coq.coq-version}/";
+  installFlags = [ "COQLIB=$(out)/lib/coq/${coq.coq-version}/" ];
 
   meta = {
     homepage = http://c-corn.github.io/;
diff --git a/pkgs/development/coq-modules/dpdgraph/default.nix b/pkgs/development/coq-modules/dpdgraph/default.nix
index 401cb299497..49288d3cb32 100644
--- a/pkgs/development/coq-modules/dpdgraph/default.nix
+++ b/pkgs/development/coq-modules/dpdgraph/default.nix
@@ -41,10 +41,10 @@ stdenv.mkDerivation {
     mkdir -p $out/bin
   '';
 
-  installFlags = ''
-    COQLIB=$(out)/lib/coq/${coq.coq-version}/
-    BINDIR=$(out)/bin
-  '';
+  installFlags = [
+    "COQLIB=$(out)/lib/coq/${coq.coq-version}/"
+    "BINDIR=$(out)/bin"
+  ];
 
   meta = {
     description = "Build dependency graphs between Coq objects";
diff --git a/pkgs/development/coq-modules/equations/default.nix b/pkgs/development/coq-modules/equations/default.nix
index b6efd3d75a4..9ea9ac21671 100644
--- a/pkgs/development/coq-modules/equations/default.nix
+++ b/pkgs/development/coq-modules/equations/default.nix
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
 
   preBuild = "coq_makefile -f _CoqProject -o Makefile";
 
-  installFlags = "COQLIB=$(out)/lib/coq/${coq.coq-version}/";
+  installFlags = [ "COQLIB=$(out)/lib/coq/${coq.coq-version}/" ];
 
   meta = with stdenv.lib; {
     homepage = https://mattam82.github.io/Coq-Equations/;
diff --git a/pkgs/development/coq-modules/heq/default.nix b/pkgs/development/coq-modules/heq/default.nix
index 03149bab58b..5d3c94c5f5c 100644
--- a/pkgs/development/coq-modules/heq/default.nix
+++ b/pkgs/development/coq-modules/heq/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   preBuild = "cd src";
 
-  installFlags = "COQLIB=$(out)/lib/coq/${coq.coq-version}";
+  installFlags = [ "COQLIB=$(out)/lib/coq/${coq.coq-version}" ];
 
   meta = with stdenv.lib; {
     homepage = https://www.mpi-sws.org/~gil/Heq/;
diff --git a/pkgs/development/coq-modules/ltac2/default.nix b/pkgs/development/coq-modules/ltac2/default.nix
index 67441e9cdd8..92484f169c1 100644
--- a/pkgs/development/coq-modules/ltac2/default.nix
+++ b/pkgs/development/coq-modules/ltac2/default.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
      coq.ocamlPackages.camlp5
   ;
 
-  installFlags = "COQLIB=$(out)/lib/coq/${coq.coq-version}/";
+  installFlags = [ "COQLIB=$(out)/lib/coq/${coq.coq-version}/" ];
 
   meta = {
     description = "A robust and expressive tactic language for Coq";
diff --git a/pkgs/development/coq-modules/math-classes/default.nix b/pkgs/development/coq-modules/math-classes/default.nix
index 82802b8f30e..7aad4261fd3 100644
--- a/pkgs/development/coq-modules/math-classes/default.nix
+++ b/pkgs/development/coq-modules/math-classes/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ coq bignums ];
   enableParallelBuilding = true;
-  installFlags = "COQLIB=$(out)/lib/coq/${coq.coq-version}/";
+  installFlags = [ "COQLIB=$(out)/lib/coq/${coq.coq-version}/" ];
 
   meta = with stdenv.lib; {
     homepage = https://math-classes.github.io;
diff --git a/pkgs/development/coq-modules/mathcomp/extra.nix b/pkgs/development/coq-modules/mathcomp/extra.nix
index c342c25a411..2df9cbe58c7 100644
--- a/pkgs/development/coq-modules/mathcomp/extra.nix
+++ b/pkgs/development/coq-modules/mathcomp/extra.nix
@@ -74,7 +74,7 @@ versions = {
       core-deps = with coqPackages; [ mathcomp-field_1_9 ];
       extra-deps = with coqPackages; [ mathcomp_1_9-bigenough ];
     };
-  }; 
+  };
   "1.8.0" = {
     finmap.version = "1.2.1";
     bigenough.version = "1.0.0";
@@ -154,7 +154,7 @@ packageGen = {
 
     propagatedBuildInputs = [ coq ] ++ mc-core-deps ++ extra-deps;
 
-    installFlags = "-f Makefile.coq COQLIB=$(out)/lib/coq/${coq.coq-version}/";
+    installFlags = [ "-f" "Makefile.coq" "COQLIB=$(out)/lib/coq/${coq.coq-version}/" ];
 
     meta = {
       inherit description;
diff --git a/pkgs/development/coq-modules/paramcoq/default.nix b/pkgs/development/coq-modules/paramcoq/default.nix
index a8dd74dd5fb..a57d1bc9088 100644
--- a/pkgs/development/coq-modules/paramcoq/default.nix
+++ b/pkgs/development/coq-modules/paramcoq/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   ++ (with coq.ocamlPackages; [ ocaml findlib camlp5 ])
   ;
 
-  installFlags = "COQLIB=$(out)/lib/coq/${coq.coq-version}/";
+  installFlags = [ "COQLIB=$(out)/lib/coq/${coq.coq-version}/" ];
 
   passthru = {
     compatibleCoqVersions = v: builtins.hasAttr v params;
diff --git a/pkgs/development/coq-modules/tlc/default.nix b/pkgs/development/coq-modules/tlc/default.nix
index fb966f762bc..119261f412b 100644
--- a/pkgs/development/coq-modules/tlc/default.nix
+++ b/pkgs/development/coq-modules/tlc/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ coq ];
 
-  installFlags = "CONTRIB=$(out)/lib/coq/${coq.coq-version}/user-contrib";
+  installFlags = [ "CONTRIB=$(out)/lib/coq/${coq.coq-version}/user-contrib" ];
 
   meta = {
     homepage = "http://www.chargueraud.org/softs/tlc/";
diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index 52cc2f1e943..7b06628dbc7 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -745,7 +745,7 @@ self: super: {
           substituteInPlace conf.py --replace "'.md': CommonMarkParser," ""
         '';
         nativeBuildInputs = with pkgs.buildPackages.pythonPackages; [ sphinx recommonmark sphinx_rtd_theme ];
-        makeFlags = "html";
+        makeFlags = [ "html" ];
         installPhase = ''
           mv _build/html $out
         '';
diff --git a/pkgs/development/haskell-modules/configuration-nix.nix b/pkgs/development/haskell-modules/configuration-nix.nix
index 6886a35c0a8..9eedb0fed85 100644
--- a/pkgs/development/haskell-modules/configuration-nix.nix
+++ b/pkgs/development/haskell-modules/configuration-nix.nix
@@ -115,18 +115,18 @@ self: super: builtins.intersectAttrs super {
 
   hzk = overrideCabal super.hzk (drv: {
     preConfigure = "sed -i -e /include-dirs/d hzk.cabal";
-    configureFlags =  "--extra-include-dirs=${pkgs.zookeeper_mt}/include/zookeeper";
+    configureFlags = [ "--extra-include-dirs=${pkgs.zookeeper_mt}/include/zookeeper" ];
   });
 
   haskakafka = overrideCabal super.haskakafka (drv: {
     preConfigure = "sed -i -e /extra-lib-dirs/d -e /include-dirs/d haskakafka.cabal";
-    configureFlags =  "--extra-include-dirs=${pkgs.rdkafka}/include/librdkafka";
+    configureFlags = [ "--extra-include-dirs=${pkgs.rdkafka}/include/librdkafka" ];
   });
 
   # library has hard coded directories that need to be removed. Reported upstream here https://github.com/haskell-works/hw-kafka-client/issues/32
   hw-kafka-client = dontCheck (overrideCabal super.hw-kafka-client (drv: {
     preConfigure = "sed -i -e /extra-lib-dirs/d -e /include-dirs/d -e /librdkafka/d hw-kafka-client.cabal";
-    configureFlags =  "--extra-include-dirs=${pkgs.rdkafka}/include/librdkafka";
+    configureFlags = [ "--extra-include-dirs=${pkgs.rdkafka}/include/librdkafka" ];
   }));
 
   # Foreign dependency name clashes with another Haskell package.
diff --git a/pkgs/development/interpreters/erlang/generic-builder.nix b/pkgs/development/interpreters/erlang/generic-builder.nix
index 76f71745f35..c0203e5915f 100644
--- a/pkgs/development/interpreters/erlang/generic-builder.nix
+++ b/pkgs/development/interpreters/erlang/generic-builder.nix
@@ -24,7 +24,7 @@
 , configureFlags ? [], configurePhase ? "", preConfigure ? "", postConfigure ? ""
 , buildPhase ? "", preBuild ? "", postBuild ? ""
 , installPhase ? "", preInstall ? "", postInstall ? ""
-, installTargets ? "install install-docs"
+, installTargets ? [ "install" "install-docs" ]
 , checkPhase ? "", preCheck ? "", postCheck ? ""
 , fixupPhase ? "", preFixup ? "", postFixup ? ""
 , meta ? {}
@@ -141,7 +141,7 @@ in stdenv.mkDerivation ({
 // optionalAttrs (preCheck != "")       { inherit preCheck; }
 // optionalAttrs (postCheck != "")      { inherit postCheck; }
 // optionalAttrs (installPhase != "")   { inherit installPhase; }
-// optionalAttrs (installTargets != "") { inherit installTargets; }
+// optionalAttrs (installTargets != []) { inherit installTargets; }
 // optionalAttrs (preInstall != "")     { inherit preInstall; }
 // optionalAttrs (fixupPhase != "")     { inherit fixupPhase; }
 // optionalAttrs (preFixup != "")       { inherit preFixup; }
diff --git a/pkgs/development/interpreters/gnu-apl/default.nix b/pkgs/development/interpreters/gnu-apl/default.nix
index 94ec0244382..c2a3556cfea 100644
--- a/pkgs/development/interpreters/gnu-apl/default.nix
+++ b/pkgs/development/interpreters/gnu-apl/default.nix
@@ -12,12 +12,12 @@ stdenv.mkDerivation rec {
   buildInputs = [ readline gettext ncurses ];
 
   # Needed with GCC 8
-  NIX_CFLAGS_COMPILE = with stdenv.lib; (optionals stdenv.cc.isGNU [
+  NIX_CFLAGS_COMPILE = with stdenv.lib; toString ((optionals stdenv.cc.isGNU [
     "-Wno-error=int-in-bool-context"
     "-Wno-error=class-memaccess"
     "-Wno-error=restrict"
     "-Wno-error=format-truncation"
-   ]) ++ optional stdenv.cc.isClang "-Wno-error=null-dereference";
+   ]) ++ optional stdenv.cc.isClang "-Wno-error=null-dereference");
 
   patchPhase = stdenv.lib.optionalString stdenv.isDarwin ''
     substituteInPlace src/LApack.cc --replace "malloc.h" "malloc/malloc.h"
diff --git a/pkgs/development/interpreters/jimtcl/default.nix b/pkgs/development/interpreters/jimtcl/default.nix
index 09d7fa622fc..d803fe43fd7 100644
--- a/pkgs/development/interpreters/jimtcl/default.nix
+++ b/pkgs/development/interpreters/jimtcl/default.nix
@@ -35,7 +35,7 @@ in stdenv.mkDerivation rec {
     "--ipv6"
   ];
 
-  NIX_CFLAGS_COMPILE = makeSDLFlags [ SDL SDL_gfx ];
+  NIX_CFLAGS_COMPILE = toString (makeSDLFlags [ SDL SDL_gfx ]);
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/interpreters/kona/default.nix b/pkgs/development/interpreters/kona/default.nix
index a9922a38765..9b7f36f4c87 100644
--- a/pkgs/development/interpreters/kona/default.nix
+++ b/pkgs/development/interpreters/kona/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "0c1yf3idqkfq593xgqb25r2ykmfmp83zzh3q7kb8095a069gvri3";
   };
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
   preInstall = ''mkdir -p "$out/bin"'';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/interpreters/love/0.10.nix b/pkgs/development/interpreters/love/0.10.nix
index 6a3aa9f648f..e1ca3ded208 100644
--- a/pkgs/development/interpreters/love/0.10.nix
+++ b/pkgs/development/interpreters/love/0.10.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation {
     "--with-lua=luajit"
   ];
 
-  NIX_CFLAGS_COMPILE = [ "-DluaL_reg=luaL_Reg" ]; # needed since luajit-2.1.0-beta3
+  NIX_CFLAGS_COMPILE = "-DluaL_reg=luaL_Reg"; # needed since luajit-2.1.0-beta3
 
   meta = {
     homepage = http://love2d.org;
diff --git a/pkgs/development/interpreters/love/0.8.nix b/pkgs/development/interpreters/love/0.8.nix
index 57c1a6ce564..3a6c385ee5f 100644
--- a/pkgs/development/interpreters/love/0.8.nix
+++ b/pkgs/development/interpreters/love/0.8.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     } || true
   '';
 
-  NIX_CFLAGS_COMPILE = [
+  NIX_CFLAGS_COMPILE = toString [
     "-I${SDL.dev}/include/SDL"
     "-I${freetype.dev}include/freetype2"
     "-DGL_GLEXT_PROTOTYPES" # https://community.khronos.org/t/glgenbuffers-was-not-declared-in-this-scope/59283/2
diff --git a/pkgs/development/interpreters/love/11.1.nix b/pkgs/development/interpreters/love/11.1.nix
index 0a60a4cacfe..3629345baf6 100644
--- a/pkgs/development/interpreters/love/11.1.nix
+++ b/pkgs/development/interpreters/love/11.1.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation {
     "--with-lua=luajit"
   ];
 
-  NIX_CFLAGS_COMPILE = [ "-DluaL_reg=luaL_Reg" ]; # needed since luajit-2.1.0-beta3
+  NIX_CFLAGS_COMPILE = "-DluaL_reg=luaL_Reg"; # needed since luajit-2.1.0-beta3
 
   meta = {
     homepage = http://love2d.org;
diff --git a/pkgs/development/interpreters/metamath/default.nix b/pkgs/development/interpreters/metamath/default.nix
index 3de21191512..2213ace8f57 100644
--- a/pkgs/development/interpreters/metamath/default.nix
+++ b/pkgs/development/interpreters/metamath/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
   # luckily, they're not really needed so we don't build it.
   makeFlags = [ "DATA=" ];
 
-  installTargets = "install-exec";
+  installTargets = [ "install-exec" ];
 
   meta = with stdenv.lib; {
     description = "Interpreter for the metamath proof language";
diff --git a/pkgs/development/interpreters/perl/default.nix b/pkgs/development/interpreters/perl/default.nix
index 1f3b63625c0..3231c17e8d9 100644
--- a/pkgs/development/interpreters/perl/default.nix
+++ b/pkgs/development/interpreters/perl/default.nix
@@ -91,7 +91,13 @@ let
       ]
       ++ optionals ((builtins.match ''5\.[0-9]*[13579]\..+'' version) != null) [ "-Dusedevel" "-Uversiononly" ]
       ++ optional stdenv.isSunOS "-Dcc=gcc"
-      ++ optional enableThreading "-Dusethreads";
+      ++ optional enableThreading "-Dusethreads"
+      ++ optionals (!crossCompiling) [
+        "-Dprefix=${placeholder "out"}"
+        "-Dman1dir=${placeholder "out"}/share/man/man1"
+        "-Dman3dir=${placeholder "out"}/share/man/man3"
+      ]
+      ++ optional (stdenv.isAarch32 || stdenv.isMips) "-Dldflags=\"-lm -lrt\"";
 
     configureScript = optionalString (!crossCompiling) "${stdenv.shell} ./Configure";
 
@@ -102,10 +108,6 @@ let
     preConfigure = ''
         substituteInPlace ./Configure --replace '`LC_ALL=C; LANGUAGE=C; export LC_ALL; export LANGUAGE; $date 2>&1`' 'Thu Jan  1 00:00:01 UTC 1970'
         substituteInPlace ./Configure --replace '$uname -a' '$uname --kernel-name --machine --operating-system'
-      '' + optionalString (!crossCompiling) ''
-        configureFlags="$configureFlags -Dprefix=$out -Dman1dir=$out/share/man/man1 -Dman3dir=$out/share/man/man3"
-      '' + optionalString (stdenv.isAarch32 || stdenv.isMips) ''
-        configureFlagsArray=(-Dldflags="-lm -lrt")
       '' + optionalString stdenv.isDarwin ''
         substituteInPlace hints/darwin.sh --replace "env MACOSX_DEPLOYMENT_TARGET=10.3" ""
       '' + optionalString (!enableThreading) ''
diff --git a/pkgs/development/interpreters/php/default.nix b/pkgs/development/interpreters/php/default.nix
index 26798d676e0..0fa605a4cac 100644
--- a/pkgs/development/interpreters/php/default.nix
+++ b/pkgs/development/interpreters/php/default.nix
@@ -95,8 +95,8 @@ let
         ++ optional postgresqlSupport postgresql
         ++ optional pdo_odbcSupport unixODBC
         ++ optional pdo_pgsqlSupport postgresql
-        ++ optional pdo_mysqlSupport mysqlBuildInputs
-        ++ optional mysqliSupport mysqlBuildInputs
+        ++ optionals pdo_mysqlSupport mysqlBuildInputs
+        ++ optionals mysqliSupport mysqlBuildInputs
         ++ optional gmpSupport gmp
         ++ optional gettextSupport gettext
         ++ optional intlSupport icu
@@ -109,14 +109,14 @@ let
         ++ optional libzipSupport libzip
         ++ optional valgrindSupport valgrind;
 
-      CXXFLAGS = optional stdenv.cc.isClang "-std=c++11";
+      CXXFLAGS = optionalString stdenv.cc.isClang "-std=c++11";
 
       configureFlags = [
         "--with-config-file-scan-dir=/etc/php.d"
       ]
-      ++ optional (versionOlder version "7.3") "--with-pcre-regex=${pcre.dev} PCRE_LIBDIR=${pcre}"
-      ++ optional (versions.majorMinor version == "7.3") "--with-pcre-regex=${pcre2.dev} PCRE_LIBDIR=${pcre2}"
-      ++ optional (versionAtLeast version "7.4") "--with-external-pcre=${pcre2.dev} PCRE_LIBDIR=${pcre2}"
+      ++ optionals (versionOlder version "7.3") [ "--with-pcre-regex=${pcre.dev}" "PCRE_LIBDIR=${pcre}" ]
+      ++ optionals (versions.majorMinor version == "7.3") [ "--with-pcre-regex=${pcre2.dev}" "PCRE_LIBDIR=${pcre2}" ]
+      ++ optionals (versionAtLeast version "7.4") [ "--with-external-pcre=${pcre2.dev}" "PCRE_LIBDIR=${pcre2}" ]
       ++ optional stdenv.isDarwin "--with-iconv=${libiconv}"
       ++ optional withSystemd "--with-fpm-systemd"
       ++ optionals imapSupport [
@@ -129,7 +129,7 @@ let
         "LDAP_INCDIR=${openldap.dev}/include"
         "LDAP_LIBDIR=${openldap.out}/lib"
       ]
-      ++ optional (ldapSupport && stdenv.isLinux)   "--with-ldap-sasl=${cyrus_sasl.dev}"
+      ++ optional (ldapSupport && stdenv.isLinux) "--with-ldap-sasl=${cyrus_sasl.dev}"
       ++ optional apxs2Support "--with-apxs2=${apacheHttpd.dev}/bin/apxs"
       ++ optional embedSupport "--enable-embed"
       ++ optional mhashSupport "--with-mhash"
diff --git a/pkgs/development/interpreters/pure/default.nix b/pkgs/development/interpreters/pure/default.nix
index 188058a73b5..9c35fc35497 100644
--- a/pkgs/development/interpreters/pure/default.nix
+++ b/pkgs/development/interpreters/pure/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ bison flex makeWrapper ];
   propagatedBuildInputs = [ llvm gmp mpfr readline ];
-  NIX_LDFLAGS = [ "-lLLVMJIT" ];
+  NIX_LDFLAGS = "-lLLVMJIT";
 
   postPatch = ''
     for f in expr.cc matcher.cc printer.cc symtable.cc parserdefs.hh; do
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 76065dcdc29..caf2e13bdf6 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -92,10 +92,10 @@ in {
     sourceVersion = {
       major = "3";
       minor = "7";
-      patch = "5";
+      patch = "6";
       suffix = "";
     };
-    sha256 = "154xc6dxww21qkmphg66pfks8987a17cl3vqq5g4hv1xkzm7cnp8";
+    sha256 = "0gskry19ylw91p38pdq36qcgk6h3x5i4ia0ik977kw2943kwr8jm";
     inherit (darwin) CF configd;
     inherit passthruFun;
   };
diff --git a/pkgs/development/interpreters/python/wrap.sh b/pkgs/development/interpreters/python/wrap.sh
index c7201c7a997..f10ba003432 100644
--- a/pkgs/development/interpreters/python/wrap.sh
+++ b/pkgs/development/interpreters/python/wrap.sh
@@ -81,7 +81,15 @@ wrapPythonProgramsIn() {
 
                     # Add any additional arguments provided by makeWrapperArgs
                     # argument to buildPythonPackage.
-                    local -a user_args="($makeWrapperArgs)"
+                    # We need to support both the case when makeWrapperArgs
+                    # is an array and a IFS-separated string.
+                    # TODO: remove the string branch when __structuredAttrs are used.
+                    if [[ "${makeWrapperArgs+defined}" == "defined" && "$(declare -p makeWrapperArgs)" =~ ^'declare -a makeWrapperArgs=' ]]; then
+                        local -a user_args=("${makeWrapperArgs[@]}")
+                    else
+                        local -a user_args="(${makeWrapperArgs:-})"
+                    fi
+
                     local -a wrapProgramArgs=("${wrap_args[@]}" "${user_args[@]}")
                     wrapProgram "${wrapProgramArgs[@]}"
                 fi
diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index ee9b61259bb..58ccf5ae9b4 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -12,7 +12,7 @@ let
   opString = lib.optionalString;
   patchSet = import ./rvm-patchsets.nix { inherit fetchFromGitHub; };
   config = import ./config.nix { inherit fetchFromSavannah; };
-  rubygems = import ./rubygems { inherit stdenv lib fetchurl; };
+  rubygems = import ./rubygems { inherit stdenv lib fetchurl fetchpatch; };
 
   # Contains the ruby version heuristics
   rubyVersion = import ./ruby-version.nix { inherit lib; };
@@ -151,7 +151,7 @@ let
           export GEM_HOME="$out/${passthru.gemPath}"
         '';
 
-        installFlags = stdenv.lib.optionalString docSupport "install-doc";
+        installFlags = stdenv.lib.optional docSupport "install-doc";
         # Bundler tries to create this directory
         postInstall = ''
           # Remove unnecessary groff reference from runtime closure, since it's big
diff --git a/pkgs/development/interpreters/ruby/rubygems/default.nix b/pkgs/development/interpreters/ruby/rubygems/default.nix
index dd1db5a8450..3caac2447e2 100644
--- a/pkgs/development/interpreters/ruby/rubygems/default.nix
+++ b/pkgs/development/interpreters/ruby/rubygems/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl }:
+{ stdenv, lib, fetchurl, fetchpatch }:
 
 stdenv.mkDerivation rec {
   name = "rubygems";
@@ -13,6 +13,11 @@ stdenv.mkDerivation rec {
     ./0001-add-post-extract-hook.patch
     ./0002-binaries-with-env-shebang.patch
     ./0003-gem-install-default-to-user.patch
+
+    (fetchpatch {
+      url = "https://github.com/rubygems/rubygems/commit/0af4d2d369ff580ef54839ec15a8c7ec419978cb.patch";
+      sha256 = "13gyfxn4rmxq1dbxq5rzphnhagn8n8kpp8lb9h6h4s9d4zaklax9";
+    })
   ];
 
   installPhase = ''
diff --git a/pkgs/development/interpreters/spidermonkey/1.8.5.nix b/pkgs/development/interpreters/spidermonkey/1.8.5.nix
index 97d2b67372a..fe77a27d449 100644
--- a/pkgs/development/interpreters/spidermonkey/1.8.5.nix
+++ b/pkgs/development/interpreters/spidermonkey/1.8.5.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation {
     ./1.8.5-arm-flags.patch
   ];
 
-  patchFlags = "-p3";
+  patchFlags = [ "-p3" ];
 
   # fixes build on gcc8
   postPatch = ''
diff --git a/pkgs/development/interpreters/tcl/generic.nix b/pkgs/development/interpreters/tcl/generic.nix
index 3c585c3f07f..fd84d93ba75 100644
--- a/pkgs/development/interpreters/tcl/generic.nix
+++ b/pkgs/development/interpreters/tcl/generic.nix
@@ -31,10 +31,12 @@ stdenv.mkDerivation {
 
   enableParallelBuilding = true;
 
-  postInstall = ''
+  postInstall = let
+    dllExtension = stdenv.hostPlatform.extensions.sharedLibrary;
+  in ''
     make install-private-headers
     ln -s $out/bin/tclsh${release} $out/bin/tclsh
-    ln -s $out/lib/libtcl${release}.so $out/lib/libtcl.so
+    ln -s $out/lib/libtcl${release}${dllExtension} $out/lib/libtcl${dllExtension}
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/argp-standalone/default.nix b/pkgs/development/libraries/argp-standalone/default.nix
index 8fe3bd287c1..6544c481187 100644
--- a/pkgs/development/libraries/argp-standalone/default.nix
+++ b/pkgs/development/libraries/argp-standalone/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation {
        stdenv.lib.optionals stdenv.hostPlatform.isDarwin [ patch-argp-fmtstream ]
     ++ stdenv.lib.optionals stdenv.hostPlatform.isLinux [ patch-throw-in-funcdef patch-shared ];
 
-  patchFlags = stdenv.lib.optionalString stdenv.hostPlatform.isDarwin "-p0";
+  patchFlags = stdenv.lib.optional stdenv.hostPlatform.isDarwin "-p0";
 
   preConfigure = stdenv.lib.optionalString stdenv.hostPlatform.isLinux "export CFLAGS='-fgnu89-inline'";
 
diff --git a/pkgs/development/libraries/audiofile/default.nix b/pkgs/development/libraries/audiofile/default.nix
index 1ed457aa5fe..680b585643b 100644
--- a/pkgs/development/libraries/audiofile/default.nix
+++ b/pkgs/development/libraries/audiofile/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchpatch, alsaLib, AudioUnit, CoreServices }:
+{ stdenv, lib, fetchurl, fetchpatch, alsaLib, AudioUnit, CoreServices }:
 
 let
 
@@ -25,6 +25,9 @@ stdenv.mkDerivation rec {
     sha256 = "0rb927zknk9kmhprd8rdr4azql4gn2dp75a36iazx2xhkbqhvind";
   };
 
+  # fix build with gcc9
+  NIX_CFLAGS_LINK = lib.optional (stdenv.system == "i686-linux") "-lgcc";
+
   patches = [
     ./gcc-6.patch
     ./CVE-2015-7747.patch
diff --git a/pkgs/development/libraries/aws-c-common/default.nix b/pkgs/development/libraries/aws-c-common/default.nix
index 4286eedc87b..b10797d3d56 100644
--- a/pkgs/development/libraries/aws-c-common/default.nix
+++ b/pkgs/development/libraries/aws-c-common/default.nix
@@ -13,10 +13,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
-  NIX_CFLAGS_COMPILE = lib.optionals stdenv.isDarwin [
-    "-Wno-nullability-extension"
-    "-Wno-typedef-redefinition"
-  ];
+  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin
+    "-Wno-nullability-extension -Wno-typedef-redefinition";
 
   meta = with lib; {
     description = "AWS SDK for C common core";
diff --git a/pkgs/development/libraries/aws-sdk-cpp/default.nix b/pkgs/development/libraries/aws-sdk-cpp/default.nix
index 037fd198fef..8024f310951 100644
--- a/pkgs/development/libraries/aws-sdk-cpp/default.nix
+++ b/pkgs/development/libraries/aws-sdk-cpp/default.nix
@@ -42,6 +42,9 @@ stdenv.mkDerivation rec {
   ] ++ lib.optional (apis != ["*"])
     "-DBUILD_ONLY=${lib.concatStringsSep ";" apis}";
 
+  # fix build with gcc9, can be removed after bumping to current version
+  NIX_CFLAGS_COMPILE = [ "-Wno-error" ];
+
   preConfigure =
     ''
       rm aws-cpp-sdk-core-tests/aws/auth/AWSCredentialsProviderTest.cpp
diff --git a/pkgs/development/libraries/bamf/default.nix b/pkgs/development/libraries/bamf/default.nix
index 1bce315878d..60322f53016 100644
--- a/pkgs/development/libraries/bamf/default.nix
+++ b/pkgs/development/libraries/bamf/default.nix
@@ -88,9 +88,7 @@ stdenv.mkDerivation rec {
   doCheck = false;
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = [
-    "-DGLIB_DISABLE_DEPRECATION_WARNINGS"
-  ];
+  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   meta = with stdenv.lib; {
     description = "Application matching framework";
diff --git a/pkgs/development/libraries/bctoolbox/default.nix b/pkgs/development/libraries/bctoolbox/default.nix
index a9d21a1f5a9..1c81dd608cb 100644
--- a/pkgs/development/libraries/bctoolbox/default.nix
+++ b/pkgs/development/libraries/bctoolbox/default.nix
@@ -14,6 +14,8 @@ stdenv.mkDerivation rec {
     sha256 = "1cxx243wyzkd4xnvpyqf97n0rjhfckpvw1vhwnbwshq3q6fra909";
   };
 
+  NIX_CFLAGS_COMPILE = [ "-Wno-error=stringop-truncation" ];
+
   meta = {
     inherit version;
     description = "Utilities library for Linphone";
diff --git a/pkgs/development/libraries/belle-sip/default.nix b/pkgs/development/libraries/belle-sip/default.nix
index 1745614f741..0d3df37d8e0 100644
--- a/pkgs/development/libraries/belle-sip/default.nix
+++ b/pkgs/development/libraries/belle-sip/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ zlib ];
 
-  NIX_CFLAGS_COMPILE = [
+  NIX_CFLAGS_COMPILE = toString [
     "-Wno-error=deprecated-declarations"
     "-Wno-error=format-truncation"
     "-Wno-error=cast-function-type"
diff --git a/pkgs/development/libraries/blitz/default.nix b/pkgs/development/libraries/blitz/default.nix
index fd0da496fa4..f370e45b5fd 100644
--- a/pkgs/development/libraries/blitz/default.nix
+++ b/pkgs/development/libraries/blitz/default.nix
@@ -55,7 +55,7 @@ stdenv.mkDerivation {
 
   enableParallelBuilding = true;
 
-  buildFlags = "lib info pdf html";
+  buildFlags = [ "lib" "info" "pdf" "html" ];
   installTargets = [ "install" "install-info" "install-pdf" "install-html" ];
 
   inherit doCheck;
diff --git a/pkgs/development/libraries/boost/generic.nix b/pkgs/development/libraries/boost/generic.nix
index 2d0a5a63d6f..82bcd49592d 100644
--- a/pkgs/development/libraries/boost/generic.nix
+++ b/pkgs/development/libraries/boost/generic.nix
@@ -103,7 +103,7 @@ stdenv.mkDerivation {
 
   inherit src version;
 
-  patchFlags = "";
+  patchFlags = [];
 
   patches = patches
   ++ optional stdenv.isDarwin (
diff --git a/pkgs/development/libraries/buddy/default.nix b/pkgs/development/libraries/buddy/default.nix
index fb25b0a5810..9b722602a65 100644
--- a/pkgs/development/libraries/buddy/default.nix
+++ b/pkgs/development/libraries/buddy/default.nix
@@ -11,9 +11,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ bison ];
   patches = [ ./gcc-4.3.3-fixes.patch ];
   configureFlags = [ "CFLAGS=-O3" "CXXFLAGS=-O3" ];
-  NIX_LDFLAGS = [
-    "-lm"
-  ];
+  NIX_LDFLAGS = "-lm";
   doCheck = true;
 
   meta = {
diff --git a/pkgs/development/libraries/ccrtp/1.8.nix b/pkgs/development/libraries/ccrtp/1.8.nix
deleted file mode 100644
index db2d177b710..00000000000
--- a/pkgs/development/libraries/ccrtp/1.8.nix
+++ /dev/null
@@ -1,24 +0,0 @@
-{ stdenv, fetchurl, openssl, pkgconfig, libgcrypt, commoncpp2 }:
-
-stdenv.mkDerivation {
-  name = "ccrtp-1.8.0";
-
-  src = fetchurl {
-    url = mirror://gnu/ccrtp/ccrtp-1.8.0.tar.gz;
-    sha256 = "0wr4dandlfajhmg90nqyvwv61ikn9vdycji001310y3c4zfysprn";
-  };
-
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ openssl libgcrypt commoncpp2 ];
-
-  patches = [ ./gcc-4.6-fix.patch ];
-
-  meta = {
-    description = "GNU ccRTP is an implementation of RTP, the real-time transport protocol from the IETF";
-    homepage = https://www.gnu.org/software/ccrtp/;
-    license = stdenv.lib.licenses.gpl2;
-    maintainers = [ stdenv.lib.maintainers.marcweber ];
-    platforms = stdenv.lib.platforms.linux;
-    broken = true; # fails to compile with libgcrypt >= 1.6
-  };
-}
diff --git a/pkgs/development/libraries/ccrtp/gcc-4.6-fix.patch b/pkgs/development/libraries/ccrtp/gcc-4.6-fix.patch
deleted file mode 100644
index 49d07a89e52..00000000000
--- a/pkgs/development/libraries/ccrtp/gcc-4.6-fix.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-diff -ubr ccrtp-1.8.0-orig/src/ccrtp/sources.h ccrtp-1.8.0/src/ccrtp/sources.h
---- ccrtp-1.8.0-orig/src/ccrtp/sources.h	2010-04-18 20:51:49.000000000 +0200
-+++ ccrtp-1.8.0/src/ccrtp/sources.h	2012-07-07 11:42:50.961179016 +0200
-@@ -45,6 +45,7 @@
- #define CCXX_RTP_SOURCES_H_
- 
- #include <string>
-+#include <cstddef>
- #include <ccrtp/rtcppkt.h>
- 
- #ifdef	CCXX_NAMESPACES
-@@ -406,7 +407,7 @@
- 	public:
- 		typedef std::forward_iterator_tag iterator_category;
- 		typedef Participant value_type;
--		typedef ptrdiff_t difference_type;
-+		typedef std::ptrdiff_t difference_type;
- 		typedef const Participant* pointer;
- 		typedef const Participant& reference;
- 
diff --git a/pkgs/development/libraries/cfitsio/default.nix b/pkgs/development/libraries/cfitsio/default.nix
index 7576c24024a..4b84f73a258 100644
--- a/pkgs/development/libraries/cfitsio/default.nix
+++ b/pkgs/development/libraries/cfitsio/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   hardeningDisable = [ "format" ];
 
   # Shared-only build
-  buildFlags = "shared";
+  buildFlags = [ "shared" ];
   postPatch = '' sed -e '/^install:/s/libcfitsio.a //' -e 's@/bin/@@g' -i Makefile.in
    '';
 
diff --git a/pkgs/development/libraries/commoncpp2/default.nix b/pkgs/development/libraries/commoncpp2/default.nix
deleted file mode 100644
index 0c5ab758583..00000000000
--- a/pkgs/development/libraries/commoncpp2/default.nix
+++ /dev/null
@@ -1,38 +0,0 @@
-{ fetchurl, stdenv }:
-
-stdenv.mkDerivation rec {
-  name = "commoncpp2-1.8.1";
-
-  src = fetchurl {
-    url = "mirror://gnu/commoncpp/${name}.tar.gz";
-    sha256 = "0kmgr5w3b1qwzxnsnw94q6rqs0hr8nbv9clf07ca2a2fyypx9kjk";
-  };
-
-  doCheck = true;
-
-  preBuild = ''
-    echo '#include <sys/stat.h>' >> inc/cc++/config.h
-  '';
-
-  meta = {
-    description = "GNU Common C++, a portable, highly optimized C++ class framework";
-
-    longDescription =
-      '' GNU Common C++ and GNU uCommon are very portable and highly
-         optimized class framework for writing C++ applications that need to
-         use threads and support concurrent sychronization, and that use
-         sockets, XML parsing, object serialization, thread-optimized String
-         and data structure classes, etc.  This framework offers a class
-         foundation that hides platform differences from your C++ application
-         so that you need not write platform specific code.  GNU Common C++
-         has been ported to compile nativily on most platforms which support
-         either posix threads, or on maybe be used with Debian hosted mingw32
-         to build native threading applications for Microsoft Windows.
-      '';
-
-    homepage = https://www.gnu.org/software/commoncpp/;
-    license = stdenv.lib.licenses.gpl2Plus;
-    maintainers = [ stdenv.lib.maintainers.marcweber ];
-    platforms = with stdenv.lib.platforms; linux;
-  };
-}
diff --git a/pkgs/development/libraries/cpp-hocon/default.nix b/pkgs/development/libraries/cpp-hocon/default.nix
index d172ab55fa3..dc742a5c051 100644
--- a/pkgs/development/libraries/cpp-hocon/default.nix
+++ b/pkgs/development/libraries/cpp-hocon/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     owner = "puppetlabs";
   };
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=catch-value" ];
+  NIX_CFLAGS_COMPILE = "-Wno-error=catch-value";
 
   nativeBuildInputs = [ cmake ];
 
diff --git a/pkgs/development/libraries/cppdb/default.nix b/pkgs/development/libraries/cppdb/default.nix
index a21b3cc93fa..bb521ba3ec0 100644
--- a/pkgs/development/libraries/cppdb/default.nix
+++ b/pkgs/development/libraries/cppdb/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ cmake sqlite libmysqlclient postgresql unixODBC ];
 
   cmakeFlags = [ "--no-warn-unused-cli" ];
-  NIX_CFLAGS_COMPILE = [ "-I${libmysqlclient}/include/mysql" "-L${libmysqlclient}/lib/mysql" ];
+  NIX_CFLAGS_COMPILE = "-I${libmysqlclient}/include/mysql -L${libmysqlclient}/lib/mysql";
 
   meta = with stdenv.lib; {
     homepage = http://cppcms.com/sql/cppdb/;
diff --git a/pkgs/development/libraries/crc32c/default.nix b/pkgs/development/libraries/crc32c/default.nix
index 916ec5b703b..a7313c20553 100644
--- a/pkgs/development/libraries/crc32c/default.nix
+++ b/pkgs/development/libraries/crc32c/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ gflags ];
-  NIX_CFLAGS_COMPILE = stdenv.lib.optional stdenv.isAarch64 "-march=armv8-a+crc";
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isAarch64 "-march=armv8-a+crc";
 
   meta = with stdenv.lib; {
     homepage = https://github.com/google/crc32c;
diff --git a/pkgs/development/libraries/crypto++/default.nix b/pkgs/development/libraries/crypto++/default.nix
index b472733f8ee..3fe27748155 100644
--- a/pkgs/development/libraries/crypto++/default.nix
+++ b/pkgs/development/libraries/crypto++/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   doCheck = true;
 
   preInstall = "rm libcryptopp.a"; # built for checks but we don't install static lib into the nix store
-  installTargets = "install-lib";
+  installTargets = [ "install-lib" ];
   installFlags = [ "LDCONF=true" ];
   postInstall = optionalString (!stdenv.hostPlatform.isDarwin) ''
     ln -sr $out/lib/libcryptopp.so.${version} $out/lib/libcryptopp.so.${versions.majorMinor version}
diff --git a/pkgs/development/libraries/cutee/default.nix b/pkgs/development/libraries/cutee/default.nix
index 1658f8a6fa7..1c14454af5c 100644
--- a/pkgs/development/libraries/cutee/default.nix
+++ b/pkgs/development/libraries/cutee/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "18bzvhzx8k24mpcim5669n3wg9hd0sfsxj8zjpbr24hywrlppgc2";
   };
 
-  buildFlags = "cutee";
+  buildFlags = [ "cutee" ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/development/libraries/cwiid/default.nix b/pkgs/development/libraries/cwiid/default.nix
index 246dd009820..d9a17aff941 100644
--- a/pkgs/development/libraries/cwiid/default.nix
+++ b/pkgs/development/libraries/cwiid/default.nix
@@ -23,9 +23,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
 
-  NIX_LDFLAGS = [
-    "-lbluetooth"
-  ];
+  NIX_LDFLAGS = "-lbluetooth";
 
   postInstall = ''
     # Some programs (for example, cabal-install) have problems with the double 0
diff --git a/pkgs/development/libraries/czmq/3.x.nix b/pkgs/development/libraries/czmq/3.x.nix
deleted file mode 100644
index 73a51cd2731..00000000000
--- a/pkgs/development/libraries/czmq/3.x.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-{ stdenv, fetchurl, zeromq }:
-
-stdenv.mkDerivation rec {
-  version = "3.0.2";
-  pname = "czmq";
-
-  src = fetchurl {
-    url = "http://download.zeromq.org/${pname}-${version}.tar.gz";
-    sha256 = "16k9awrhdsymx7dnmvqcnkaq8lz8x8zppy6sh7ls8prpd6mkkjlb";
-  };
-
-  patches = [ ./czmq3-gcc7.patch ];
-
-  # Fix build on Glibc 2.24.
-  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
-
-  # Needs to be propagated for the .pc file to work
-  propagatedBuildInputs = [ zeromq ];
-
-  meta = with stdenv.lib; {
-    homepage = http://czmq.zeromq.org/;
-    description = "High-level C Binding for ZeroMQ";
-    license = licenses.mpl20;
-    platforms = platforms.all;
-  };
-}
diff --git a/pkgs/development/libraries/czmq/czmq3-gcc7.patch b/pkgs/development/libraries/czmq/czmq3-gcc7.patch
deleted file mode 100644
index 4ab14685a6c..00000000000
--- a/pkgs/development/libraries/czmq/czmq3-gcc7.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-diff --git a/src/zgossip_engine.inc b/src/zgossip_engine.inc
-index 37dbb4eb..727aaa9b 100644
---- a/src/zgossip_engine.inc
-+++ b/src/zgossip_engine.inc
-@@ -258,7 +258,7 @@ engine_set_log_prefix (client_t *client, const char *string)
- {
-     if (client) {
-         s_client_t *self = (s_client_t *) client;
--        snprintf (self->log_prefix, sizeof (self->log_prefix) - 1,
-+        snprintf (self->log_prefix, sizeof (self->log_prefix),
-             "%6d:%-33s", self->unique_id, string);
-     }
- }
-diff --git a/src/zsys.c b/src/zsys.c
-index 4d0bb8a1..f07db9c8 100644
---- a/src/zsys.c
-+++ b/src/zsys.c
-@@ -1071,7 +1071,7 @@ zsys_run_as (const char *lockfile, const char *group, const char *user)
-             }
-         }
-         //   We record the current process id in the lock file
--        char pid_buffer [10];
-+        char pid_buffer [32];
-         snprintf (pid_buffer, sizeof (pid_buffer), "%6d\n", getpid ());
-         if (write (handle, pid_buffer, strlen (pid_buffer)) != strlen (pid_buffer)) {
-             zsys_error ("cannot write to lockfile: %s", strerror (errno));
diff --git a/pkgs/development/libraries/czmq/4.x.nix b/pkgs/development/libraries/czmq/default.nix
index 05e499c73d0..05e499c73d0 100644
--- a/pkgs/development/libraries/czmq/4.x.nix
+++ b/pkgs/development/libraries/czmq/default.nix
diff --git a/pkgs/development/libraries/czmqpp/default.nix b/pkgs/development/libraries/czmqpp/default.nix
deleted file mode 100644
index 079eb0806d2..00000000000
--- a/pkgs/development/libraries/czmqpp/default.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, czmq }:
-
-stdenv.mkDerivation rec {
-  pname = "czmqpp";
-  version = "1.2.0";
-
-  src = fetchFromGitHub {
-    owner = "zeromq";
-    repo = "czmqpp";
-    rev = "v${version}";
-    sha256 = "0z8lwq53yk4h7pgibicx3q9idz15qb95r0pjpz0j5vql6qh46rja";
-  };
-
-  nativeBuildInputs = [ autoreconfHook pkgconfig ];
-
-  propagatedBuildInputs = [ czmq ];
-
-  # https://github.com/zeromq/czmqpp/issues/42
-  patches = [ ./socket.patch ];
-
-  meta = with stdenv.lib; {
-    inherit (src.meta) homepage;
-    description = "C++ wrapper for czmq. Aims to be minimal, simple and consistent";
-    license = licenses.lgpl3;
-    platforms = platforms.linux ++ platforms.darwin;
-    maintainers = with maintainers; [ chris-martin ];
-  };
-}
diff --git a/pkgs/development/libraries/czmqpp/socket.patch b/pkgs/development/libraries/czmqpp/socket.patch
deleted file mode 100644
index 0464bcf7797..00000000000
--- a/pkgs/development/libraries/czmqpp/socket.patch
+++ /dev/null
@@ -1,17 +0,0 @@
---- /src/socket.cpp
-+++ /src/socket.cpp
-@@ -60,12 +60,12 @@
- int socket::bind(const std::string& address)
- {
-     // format-security: format not a string literal and no format arguments.
--    return zsocket_bind(self_, address.c_str());
-+    return zsocket_bind(self_, "%s", address.c_str());
- }
- int socket::connect(const std::string& address)
- {
-     // format-security: format not a string literal and no format arguments.
--    return zsocket_connect(self_, address.c_str());
-+    return zsocket_connect(self_, "%s", address.c_str());
- }
-
- bool operator==(const socket& sock_a, const socket& sock_b)
diff --git a/pkgs/development/libraries/dirac/default.nix b/pkgs/development/libraries/dirac/default.nix
deleted file mode 100644
index 93e5da5b792..00000000000
--- a/pkgs/development/libraries/dirac/default.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{ stdenv, fetchurl, doxygen }:
-
-stdenv.mkDerivation rec {
-  version = "1.0.2";
-  pname = "dirac";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/dirac/${pname}-${version}.tar.gz";
-    sha256 = "1z803yzp17cj69wn11iyb13swqdd9xdzr58dsk6ghpr3ipqicsw1";
-  };
-
-  buildInputs = [ doxygen ];
-  enableParallelBuilding = true;
-
-  patches = [ ./dirac-1.0.2.patch ];
-
-  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
-
-  postInstall = ''
-    # keep only necessary binaries
-    find $out/bin \( -name '*RGB*' -or -name '*YUV*' -or -name create_dirac_testfile.pl \) -delete
-  '';
-
-  meta = with stdenv.lib; {
-    homepage = https://sourceforge.net/projects/dirac;
-    description = "A general-purpose video codec based on wavelets";
-    platforms = platforms.linux;
-    license = with licenses; [ mpl11 gpl2 lgpl21 ];
-    maintainers = [ maintainers.igsha ];
-  };
-}
diff --git a/pkgs/development/libraries/dirac/dirac-1.0.2.patch b/pkgs/development/libraries/dirac/dirac-1.0.2.patch
deleted file mode 100644
index 3d253b8f6d6..00000000000
--- a/pkgs/development/libraries/dirac/dirac-1.0.2.patch
+++ /dev/null
@@ -1,362 +0,0 @@
-diff -aur dirac-1.0.2/libdirac_byteio/parseunit_byteio.cpp dirac-1.0.2-modif/libdirac_byteio/parseunit_byteio.cpp
---- dirac-1.0.2/libdirac_byteio/parseunit_byteio.cpp	2008-05-02 09:57:19.000000000 +0400
-+++ dirac-1.0.2-modif/libdirac_byteio/parseunit_byteio.cpp	2016-02-10 19:39:09.838443767 +0300
-@@ -124,12 +124,9 @@
- 
-     if(prefix==PU_PREFIX)
-     {
--        unsigned char next_parse_code;
--
--        next_parse_code = InputUnByte();
-+        (void)InputUnByte();
-         // input next unit parse-offsets
--        int next_unit_next_parse_offset;
--        next_unit_next_parse_offset = ReadUintLit(PU_NEXT_PARSE_OFFSET_SIZE);
-+        (void)ReadUintLit(PU_NEXT_PARSE_OFFSET_SIZE);
- 
-         int next_unit_previous_parse_offset;
-         next_unit_previous_parse_offset = ReadUintLit(PU_PREVIOUS_PARSE_OFFSET_SIZE);
-diff -aur dirac-1.0.2/libdirac_common/mot_comp.cpp dirac-1.0.2-modif/libdirac_common/mot_comp.cpp
---- dirac-1.0.2/libdirac_common/mot_comp.cpp	2008-10-01 05:26:47.000000000 +0400
-+++ dirac-1.0.2-modif/libdirac_common/mot_comp.cpp	2016-02-10 19:50:18.453051800 +0300
-@@ -1064,10 +1064,10 @@
-         // We're doing bounds checking because we'll fall off the edge of the reference otherwise.
- 
-         //weights for doing linear interpolation, calculated from the remainder values
--        const ValueType linear_wts[4] = {  (2 - rmdr.x) * (2 - rmdr.y),    //tl
--                                           rmdr.x * (2 - rmdr.y),          //tr
--                                           (2 - rmdr.x) * rmdr.y,          //bl
--                                           rmdr.x * rmdr.y };              //br
-+        const ValueType linear_wts[4] = {  ValueType((2 - rmdr.x) * (2 - rmdr.y)),    //tl
-+                                           ValueType(rmdr.x * (2 - rmdr.y)),          //tr
-+                                           ValueType((2 - rmdr.x) * rmdr.y),          //bl
-+                                           ValueType(rmdr.x * rmdr.y) };              //br
- 
- 
-        for(int c = 0, uY = ref_start.y,BuY=BChk(uY,trueRefYlen),BuY1=BChk(uY+1,trueRefYlen);
-@@ -1116,10 +1116,10 @@
-     const ImageCoords ref_start( ( start_pos.x<<1 ) + roundvec.x ,( start_pos.y<<1 ) + roundvec.y );
- 
-     //weights for doing linear interpolation, calculated from the remainder values
--    const ValueType linear_wts[4] = {  (4 - rmdr.x) * (4 - rmdr.y),    //tl
--                                    rmdr.x * (4 - rmdr.y),          //tr
--                                    (4 - rmdr.x) * rmdr.y,          //bl
--                                    rmdr.x * rmdr.y };              //br
-+    const ValueType linear_wts[4] = {  ValueType((4 - rmdr.x) * (4 - rmdr.y)),    //tl
-+                                    ValueType(rmdr.x * (4 - rmdr.y)),          //tr
-+                                    ValueType((4 - rmdr.x) * rmdr.y),          //bl
-+                                    ValueType(rmdr.x * rmdr.y) };              //br
- 
-     //An additional stage to make sure the block to be copied does not fall outside
-     //the reference image.
-diff -aur dirac-1.0.2/libdirac_common/mot_comp_mmx.cpp dirac-1.0.2-modif/libdirac_common/mot_comp_mmx.cpp
---- dirac-1.0.2/libdirac_common/mot_comp_mmx.cpp	2008-01-09 13:50:23.000000000 +0300
-+++ dirac-1.0.2-modif/libdirac_common/mot_comp_mmx.cpp	2016-02-10 19:59:51.792793538 +0300
-@@ -244,10 +244,10 @@
-         // We're 2doing bounds checking because we'll fall off the edge of the reference otherwise.
- 
-         //weights for doing linear interpolation, calculated from the remainder values
--        const ValueType linear_wts[4] = {  (2 - rmdr.x) * (2 - rmdr.y),    //tl
--                                           rmdr.x * (2 - rmdr.y),          //tr
--                                           (2 - rmdr.x) * rmdr.y,          //bl
--                                           rmdr.x * rmdr.y };              //br
-+        const ValueType linear_wts[4] = {  ValueType((2 - rmdr.x) * (2 - rmdr.y)),    //tl
-+                                           ValueType(rmdr.x * (2 - rmdr.y)),          //tr
-+                                           ValueType((2 - rmdr.x) * rmdr.y),          //bl
-+                                           ValueType(rmdr.x * rmdr.y) };              //br
- 
-         ValueType act_cols1[4], act_cols2[4];
-         int uX, uY, c, l;
-diff -aur dirac-1.0.2/libdirac_common/mv_codec.cpp dirac-1.0.2-modif/libdirac_common/mv_codec.cpp
---- dirac-1.0.2/libdirac_common/mv_codec.cpp	2008-10-01 05:26:47.000000000 +0400
-+++ dirac-1.0.2-modif/libdirac_common/mv_codec.cpp	2016-02-10 19:51:57.634838245 +0300
-@@ -159,7 +159,7 @@
- // Main code function
- void PredModeCodec::DoWorkCode( MvData& in_data )
- {
--    int step,max; 
-+    int step; 
-     int split_depth;  
- 
-     for (m_sb_yp = 0, m_sb_tlb_y = 0;  m_sb_yp < in_data.SBSplit().LengthY();  ++m_sb_yp, m_sb_tlb_y += 4)
-@@ -169,7 +169,7 @@
-             split_depth = in_data.SBSplit()[m_sb_yp][m_sb_xp]; 
- 
-             step = 4  >>  (split_depth); 
--            max = (1 << split_depth); 
-+            //max = (1 << split_depth); 
-                         
-             //now do all the block modes and mvs in the mb            
-             for (m_b_yp = m_sb_tlb_y; m_b_yp < m_sb_tlb_y+4; m_b_yp += step)
-@@ -334,7 +334,7 @@
- // Main code function
- void VectorElementCodec::DoWorkCode( MvData& in_data )
- {
--    int step,max;
-+    int step;
-     int split_depth;
- 
-     for (m_sb_yp = 0, m_sb_tlb_y = 0;  m_sb_yp < in_data.SBSplit().LengthY();  ++m_sb_yp, m_sb_tlb_y += 4)
-@@ -344,7 +344,7 @@
-             split_depth = in_data.SBSplit()[m_sb_yp][m_sb_xp];
- 
-             step = 4  >>  (split_depth);
--            max = (1 << split_depth);
-+            //max = (1 << split_depth);
-                         
-             //now do all the block modes and mvs in the mb            
-             for (m_b_yp = m_sb_tlb_y; m_b_yp < m_sb_tlb_y+4; m_b_yp += step)
-@@ -500,7 +500,7 @@
- // Main code function
- void DCCodec::DoWorkCode( MvData& in_data )
- {
--    int step,max; 
-+    int step; 
-     int split_depth;  
-     
-     for (m_sb_yp = 0, m_sb_tlb_y = 0;  m_sb_yp < in_data.SBSplit().LengthY();  ++m_sb_yp, m_sb_tlb_y += 4)
-@@ -510,7 +510,7 @@
-             split_depth = in_data.SBSplit()[m_sb_yp][m_sb_xp]; 
- 
-             step = 4  >>  (split_depth); 
--            max = (1 << split_depth); 
-+            //max = (1 << split_depth); 
-                         
-             //now do all the block modes and mvs in the mb            
-             for (m_b_yp = m_sb_tlb_y; m_b_yp < m_sb_tlb_y+4; m_b_yp += step)
-diff -aur dirac-1.0.2/libdirac_common/wavelet_utils.cpp dirac-1.0.2-modif/libdirac_common/wavelet_utils.cpp
---- dirac-1.0.2/libdirac_common/wavelet_utils.cpp	2008-10-20 08:21:02.000000000 +0400
-+++ dirac-1.0.2-modif/libdirac_common/wavelet_utils.cpp	2016-02-10 19:58:16.205006445 +0300
-@@ -198,7 +198,6 @@
-     const bool field_coding = encparams.FieldCoding();
-     const ChromaFormat cformat = pparams.CFormat();
-     const float cpd = encparams.CPD()*cpd_scale_factor;
--    const PictureSort psort = pparams.PicSort();
- 
-     int xlen, ylen, xl, yl, xp, yp;
-     float xfreq, yfreq;
-diff -aur dirac-1.0.2/libdirac_encoder/picture_compress.cpp dirac-1.0.2-modif/libdirac_encoder/picture_compress.cpp
---- dirac-1.0.2/libdirac_encoder/picture_compress.cpp	2009-01-21 08:20:57.000000000 +0300
-+++ dirac-1.0.2-modif/libdirac_encoder/picture_compress.cpp	2016-02-10 20:08:17.935731263 +0300
-@@ -413,14 +413,12 @@
- 
-         const int depth=m_encparams.TransformDepth();
- 
--        PicArray* comp_data[3];
-         CoeffArray* coeff_data[3];
-         OneDArray<unsigned int>* est_bits[3];
-         float lambda[3];
- 
-         // Construction and definition of objects
-         for (int c=0;c<3;++c){
--            comp_data[c] = &my_picture.Data((CompSort) c );
- 	    coeff_data[c] = &my_picture.WltData((CompSort) c );
-             est_bits[c] =  new OneDArray<unsigned int>( Range( 1, 3*depth+1 ) );
-         }// c
-diff -aur dirac-1.0.2/libdirac_encoder/quant_chooser.cpp dirac-1.0.2-modif/libdirac_encoder/quant_chooser.cpp
---- dirac-1.0.2/libdirac_encoder/quant_chooser.cpp	2009-01-21 08:22:05.000000000 +0300
-+++ dirac-1.0.2-modif/libdirac_encoder/quant_chooser.cpp	2016-02-10 20:15:43.792954708 +0300
-@@ -340,7 +340,7 @@
-     {
-         for (int i=cblock.Xstart(); i<cblock.Xend(); ++i )
-         {
--            if ( (std::abs(m_coeff_data[j][i])<<2) >= u_threshold )
-+            if ( (int(std::abs(m_coeff_data[j][i]))<<2) >= u_threshold )
-                 can_skip = false;
-         }   
-     }
-@@ -349,13 +349,13 @@
- 
- CoeffType QuantChooser::BlockAbsMax( const Subband& node )
- {
--    int val( 0 );
-+    CoeffType val( 0 );
- 
-     for (int j=node.Yp() ; j<node.Yp()+node.Yl(); ++j)
-     {
-         for (int i=node.Xp() ; i<node.Xp()+node.Xl(); ++i)
-         {    
--            val = std::max( val , std::abs(m_coeff_data[j][i]) );
-+            val = std::max( val , CoeffType(std::abs(m_coeff_data[j][i])) );
-         }// i
-     }// j
- 
-diff -aur dirac-1.0.2/libdirac_encoder/seq_compress.cpp dirac-1.0.2-modif/libdirac_encoder/seq_compress.cpp
---- dirac-1.0.2/libdirac_encoder/seq_compress.cpp	2008-10-29 05:42:06.000000000 +0300
-+++ dirac-1.0.2-modif/libdirac_encoder/seq_compress.cpp	2016-02-10 20:16:24.108885403 +0300
-@@ -663,7 +663,6 @@
- 
- int FrameSequenceCompressor::CodedToDisplay( const int cnum )
- {
--    int div;
- 
-     if (m_L1_sep>0)
-     {
-@@ -672,7 +671,6 @@
-             return 0;
-         else if ((cnum-1)% m_L1_sep==0)
-         {//we have L1 or subsequent I pictures
--            div=(cnum-1)/m_L1_sep;
-             return cnum+m_L1_sep-1;
-         }
-         else//we have L2 pictures
-diff -aur dirac-1.0.2/libdirac_motionest/me_utils.cpp dirac-1.0.2-modif/libdirac_motionest/me_utils.cpp
---- dirac-1.0.2/libdirac_motionest/me_utils.cpp	2008-10-21 08:55:46.000000000 +0400
-+++ dirac-1.0.2-modif/libdirac_motionest/me_utils.cpp	2016-02-10 20:04:40.068175649 +0300
-@@ -684,10 +684,10 @@
-         // We're doing bounds checking because we'll fall off the edge of the reference otherwise.
- 
-        // weights for doing linear interpolation, calculated from the remainder values
--        const ValueType linear_wts[4] = {  (2 - rmdr.x) * (2 - rmdr.y),    //tl
--                                           rmdr.x * (2 - rmdr.y),          //tr
--                                           (2 - rmdr.x) * rmdr.y,          //bl
--                                           rmdr.x * rmdr.y };              //br
-+        const ValueType linear_wts[4] = {  ValueType((2 - rmdr.x) * (2 - rmdr.y)),    //tl
-+                                           ValueType(rmdr.x * (2 - rmdr.y)),          //tr
-+                                           ValueType((2 - rmdr.x) * rmdr.y),          //bl
-+                                           ValueType(rmdr.x * rmdr.y) };              //br
- 
-         const int refXlen( m_ref_data.LengthX() );
-         const int refYlen( m_ref_data.LengthY() );
-@@ -848,10 +848,10 @@
-         // We're doing bounds checking because we'll fall off the edge of the reference otherwise.
- 
-        // weights for doing linear interpolation, calculated from the remainder values
--        const ValueType linear_wts[4] = {  (2 - rmdr.x) * (2 - rmdr.y),    //tl
--                                           rmdr.x * (2 - rmdr.y),          //tr
--                                           (2 - rmdr.x) * rmdr.y,          //bl
--                                           rmdr.x * rmdr.y };              //br
-+        const ValueType linear_wts[4] = {  ValueType((2 - rmdr.x) * (2 - rmdr.y)),    //tl
-+                                           ValueType(rmdr.x * (2 - rmdr.y)),          //tr
-+                                           ValueType((2 - rmdr.x) * rmdr.y),          //bl
-+                                           ValueType(rmdr.x * rmdr.y) };              //br
- 
-         const int refXlen( m_ref_data.LengthX() );
-         const int refYlen( m_ref_data.LengthY() );
-@@ -908,10 +908,10 @@
-     const int pic_next( m_pic_data.LengthX() - dparams.Xl() );// go down a row and back up
- 
-     //weights for doing linear interpolation, calculated from the remainder values
--    const ValueType linear_wts[4] = {  (4 - rmdr.x) * (4 - rmdr.y),    //tl
--                                       rmdr.x * (4 - rmdr.y),          //tr
--                                       (4 - rmdr.x) * rmdr.y,          //bl
--                                       rmdr.x * rmdr.y };              //br
-+    const ValueType linear_wts[4] = {  ValueType((4 - rmdr.x) * (4 - rmdr.y)),    //tl
-+                                       ValueType(rmdr.x * (4 - rmdr.y)),          //tr
-+                                       ValueType((4 - rmdr.x) * rmdr.y),          //bl
-+                                       ValueType(rmdr.x * rmdr.y) };              //br
- 
-     bool bounds_check( false );
- 
-@@ -1039,10 +1039,10 @@
-     const int pic_next( m_pic_data.LengthX() - dparams.Xl() );// go down a row and back up
- 
-     //weights for doing linear interpolation, calculated from the remainder values
--    const ValueType linear_wts[4] = {  (4 - rmdr.x) * (4 - rmdr.y),    //tl
--                                       rmdr.x * (4 - rmdr.y),          //tr
--                                       (4 - rmdr.x) * rmdr.y,          //bl
--                                       rmdr.x * rmdr.y };              //br
-+    const ValueType linear_wts[4] = {  ValueType((4 - rmdr.x) * (4 - rmdr.y)),    //tl
-+                                       ValueType(rmdr.x * (4 - rmdr.y)),          //tr
-+                                       ValueType((4 - rmdr.x) * rmdr.y),          //bl
-+                                       ValueType(rmdr.x * rmdr.y) };              //br
- 
-     bool bounds_check( false );
- 
-@@ -1403,10 +1403,10 @@
-     }
-     else
-     {
--        const ValueType linear_wts[4] = {  (2 - rmdr1.x) * (2 - rmdr1.y),    //tl
--                                           rmdr1.x * (2 - rmdr1.y),          //tr
--                                           (2 - rmdr1.x) * rmdr1.y,          //bl
--                                           rmdr1.x * rmdr1.y };              //br
-+        const ValueType linear_wts[4] = {  ValueType((2 - rmdr1.x) * (2 - rmdr1.y)),    //tl
-+                                           ValueType(rmdr1.x * (2 - rmdr1.y)),          //tr
-+                                           ValueType((2 - rmdr1.x) * rmdr1.y),          //bl
-+                                           ValueType(rmdr1.x * rmdr1.y) };              //br
- 
-         // We're doing bounds checking because we'll fall off the edge of the reference otherwise.
-         for( int y=dparams.Yl(), ry=ref_start1.y, by=BChk(ry,m_ref_data1.LengthY()), by1=BChk(ry+1,m_ref_data1.LengthY()); 
-@@ -1513,10 +1513,10 @@
-     }
-     else
-     {
--        const ValueType linear_wts[4] = {  (2 - rmdr2.x) * (2 - rmdr2.y),    //tl
--                                           rmdr2.x * (2 - rmdr2.y),          //tr
--                                           (2 - rmdr2.x) * rmdr2.y,          //bl
--                                           rmdr2.x * rmdr2.y };              //br
-+        const ValueType linear_wts[4] = {  ValueType((2 - rmdr2.x) * (2 - rmdr2.y)),    //tl
-+                                           ValueType(rmdr2.x * (2 - rmdr2.y)),          //tr
-+                                           ValueType((2 - rmdr2.x) * rmdr2.y),          //bl
-+                                           ValueType(rmdr2.x * rmdr2.y) };              //br
- 
-         // We're doing bounds checking because we'll fall off the edge of the reference otherwise.
-         for( int y=dparams.Yl(), ry=ref_start2.y, by=BChk(ry,m_ref_data2.LengthY()),by1=BChk(ry+1,m_ref_data2.LengthY()); 
-@@ -1564,14 +1564,14 @@
-     const MVector rmdr2( mv2.x & 3 , mv2.y & 3 );
- 
-     //weights for doing linear interpolation, calculated from the remainder values
--    const ValueType linear_wts1[4] = {  (4 - rmdr1.x) * (4 - rmdr1.y),    //tl
--                                       rmdr1.x * (4 - rmdr1.y),          //tr
--                                       (4 - rmdr1.x) * rmdr1.y,          //bl
--                                       rmdr1.x * rmdr1.y };              //br
--    const ValueType linear_wts2[4] = {  (4 - rmdr2.x) * (4 - rmdr2.y),    //tl
--                                       rmdr2.x * (4 - rmdr2.y),          //tr
--                                       (4 - rmdr2.x) * rmdr2.y,          //bl
--                                       rmdr2.x * rmdr2.y };              //br
-+    const ValueType linear_wts1[4] = {  ValueType((4 - rmdr1.x) * (4 - rmdr1.y)),    //tl
-+                                        ValueType(rmdr1.x * (4 - rmdr1.y)),          //tr
-+                                        ValueType((4 - rmdr1.x) * rmdr1.y),          //bl
-+                                        ValueType(rmdr1.x * rmdr1.y) };              //br
-+    const ValueType linear_wts2[4] = {  ValueType((4 - rmdr2.x) * (4 - rmdr2.y)),    //tl
-+                                        ValueType(rmdr2.x * (4 - rmdr2.y)),          //tr
-+                                        ValueType((4 - rmdr2.x) * rmdr2.y),          //bl
-+                                        ValueType(rmdr2.x * rmdr2.y) };              //br
- 
-     //Where to start in the upconverted images
-     const ImageCoords ref_start1( ( dparams.Xp()<<1 ) + roundvec1.x ,( dparams.Yp()<<1 ) + roundvec1.y );
-diff -aur dirac-1.0.2/util/conversion/common/bitmap.cpp dirac-1.0.2-modif/util/conversion/common/bitmap.cpp
---- dirac-1.0.2/util/conversion/common/bitmap.cpp	2004-06-30 20:44:52.000000000 +0400
-+++ dirac-1.0.2-modif/util/conversion/common/bitmap.cpp	2016-02-10 20:19:58.355494888 +0300
-@@ -142,14 +142,9 @@
-         char signature[2];
-         int fileSize;
-         int dataOffset;
--        int size;
-         int planes;
-         int bitCount;
-         int compression;
--        int imageSize;
--        int xPixelsPerM, yPixelsPerM;
--        int coloursUsed;
--        int coloursImportant;
-         //Define buffer to read bytes into.
-         const int bufferSize = 54;
-         char buffer[bufferSize];
-@@ -175,7 +170,7 @@
-         //Reposition input buffer to skip over extra header data if necessary
-         //Should check success of operation (see The C++ Stand Lib, Josuttis, p665)
-         if (dataOffset>54) inbuf.pubseekoff(dataOffset-54, std::ios_base::cur, std::ios_base::in);
--        size = read4bytes(buffer+14);
-+        (void)read4bytes(buffer+14); // size
-         w = read4bytes(buffer+18);
-         h = read4bytes(buffer+22);
-         if ( fileSize != (dataOffset + height()*lineBufferSize()) ) input.setstate(std::ios::failbit);
-@@ -185,11 +180,11 @@
-         if ( bitCount != 24 ) input.setstate(std::ios::failbit);
-         compression = read4bytes(buffer+30);
-         if ( compression != 0 ) input.setstate(std::ios::failbit);
--        imageSize = read4bytes(buffer+34);
--        xPixelsPerM = read4bytes(buffer+38);
--        yPixelsPerM = read4bytes(buffer+42);
--        coloursUsed = read4bytes(buffer+46);
--        coloursImportant = read4bytes(buffer+50);
-+        (void)read4bytes(buffer+34); // imageSize
-+        (void)read4bytes(buffer+38); // xPixelsPerM
-+        (void)read4bytes(buffer+42); // yPixelsPerM
-+        (void)read4bytes(buffer+46); // coloursUsed
-+        (void)read4bytes(buffer+50); // coloursImportant
-         return input; }
- 
- }  // end namespace dirac_vu
diff --git a/pkgs/development/libraries/farbfeld/default.nix b/pkgs/development/libraries/farbfeld/default.nix
index a29cbb9bbd1..a528ad6f7f6 100644
--- a/pkgs/development/libraries/farbfeld/default.nix
+++ b/pkgs/development/libraries/farbfeld/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ libpng libjpeg ];
   nativeBuildInputs = [ makeWrapper ];
 
-  installFlags = "PREFIX=/ DESTDIR=$(out)";
+  installFlags = [ "PREFIX=/" "DESTDIR=$(out)" ];
   postInstall = ''
     wrapProgram "$out/bin/2ff" --prefix PATH : "${file}/bin"
   '';
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 3424493c209..956d2d7223f 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -44,7 +44,7 @@
 
 let
   inherit (stdenv) isDarwin isFreeBSD isLinux isAarch32;
-  inherit (stdenv.lib) optional optionals optionalString enableFeature;
+  inherit (stdenv.lib) optional optionals optionalString enableFeature filter;
 
   cmpVer = builtins.compareVersions;
   reqMin = requiredVersion: (cmpVer requiredVersion branch != 1);
@@ -85,7 +85,7 @@ stdenv.mkDerivation rec {
   setOutputFlags = false; # doesn't accept all and stores configureFlags in libs!
 
   configurePlatforms = [];
-  configureFlags = [
+  configureFlags = filter (v: v != null) ([
       "--arch=${stdenv.hostPlatform.parsed.cpu.name}"
       "--target_os=${stdenv.hostPlatform.parsed.kernel.name}"
     # License
@@ -96,13 +96,15 @@ stdenv.mkDerivation rec {
       (ifMinVer "0.6" "--enable-pic")
       (enableFeature runtimeCpuDetectBuild "runtime-cpudetect")
       "--enable-hardcoded-tables"
+    ] ++
       (if multithreadBuild then (
          if stdenv.isCygwin then
-           "--disable-pthreads --enable-w32threads"
+           ["--disable-pthreads" "--enable-w32threads"]
          else # Use POSIX threads by default
-           "--enable-pthreads --disable-w32threads")
+           ["--enable-pthreads" "--disable-w32threads"])
        else
-         "--disable-pthreads --disable-w32threads")
+         ["--disable-pthreads" "--disable-w32threads"])
+    ++ [
       (ifMinVer "0.9" "--disable-os2threads") # We don't support OS/2
       "--enable-network"
       (ifMinVer "2.4" "--enable-pixelutils")
@@ -161,7 +163,7 @@ stdenv.mkDerivation rec {
   ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
       "--cross-prefix=${stdenv.cc.targetPrefix}"
       "--enable-cross-compile"
-  ] ++ optional stdenv.cc.isClang "--cc=clang";
+  ] ++ optional stdenv.cc.isClang "--cc=clang");
 
   nativeBuildInputs = [ addOpenGLRunpath perl pkgconfig texinfo yasm ];
 
diff --git a/pkgs/development/libraries/filter-audio/default.nix b/pkgs/development/libraries/filter-audio/default.nix
index 07f1c7ec917..3438bfee07b 100644
--- a/pkgs/development/libraries/filter-audio/default.nix
+++ b/pkgs/development/libraries/filter-audio/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   doCheck = false;
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with stdenv.lib; {
     description = "Lightweight audio filtering library made from webrtc code";
diff --git a/pkgs/development/libraries/flatbuffers/default.nix b/pkgs/development/libraries/flatbuffers/default.nix
index d96ceb5d26b..d43c10c8bf9 100644
--- a/pkgs/development/libraries/flatbuffers/default.nix
+++ b/pkgs/development/libraries/flatbuffers/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "flatbuffers";
-  version = "1.10.0";
+  version = "1.11.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "flatbuffers";
     rev = "v${version}";
-    sha256 = "1b32kc5jp83l43w2gs1dkw2vqm2j0wi7xfxqa86m18n3l41ca734";
+    sha256 = "1gl8pnykzifh7pnnvl80f5prmj5ga60dp44inpv9az2k9zaqx3qr";
   };
 
   preConfigure = stdenv.lib.optional stdenv.buildPlatform.isDarwin ''
diff --git a/pkgs/development/libraries/flatpak/default.nix b/pkgs/development/libraries/flatpak/default.nix
index 945f1d4931f..c0a3d3718f3 100644
--- a/pkgs/development/libraries/flatpak/default.nix
+++ b/pkgs/development/libraries/flatpak/default.nix
@@ -52,9 +52,7 @@ stdenv.mkDerivation rec {
 
   doCheck = false; # TODO: some issues with temporary files
 
-  NIX_LDFLAGS = [
-    "-lpthread"
-  ];
+  NIX_LDFLAGS = "-lpthread";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/flint/default.nix b/pkgs/development/libraries/flint/default.nix
index 20a80119b13..462d186c72d 100644
--- a/pkgs/development/libraries/flint/default.nix
+++ b/pkgs/development/libraries/flint/default.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
   ];
 
   # issues with ntl -- https://github.com/wbhart/flint2/issues/487
-  NIX_CXXSTDLIB_COMPILE = [ "-std=c++11" ];
+  NIX_CXXSTDLIB_COMPILE = "-std=c++11";
 
   patches = [
     (fetchpatch {
diff --git a/pkgs/development/libraries/fontconfig/2.10.nix b/pkgs/development/libraries/fontconfig/2.10.nix
index 1d66735569d..635baff796b 100644
--- a/pkgs/development/libraries/fontconfig/2.10.nix
+++ b/pkgs/development/libraries/fontconfig/2.10.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   doCheck = true;
 
   # Don't try to write to /var/cache/fontconfig at install time.
-  installFlags = "sysconfdir=$(out)/etc fc_cachedir=$(TMPDIR)/dummy RUN_FC_CACHE_TEST=false";
+  installFlags = [ "sysconfdir=$(out)/etc" "fc_cachedir=$(TMPDIR)/dummy" "RUN_FC_CACHE_TEST=false" ];
 
   passthru = {
     # Empty for backward compatibility, there was no versioning before 2.11
diff --git a/pkgs/development/libraries/fontconfig/default.nix b/pkgs/development/libraries/fontconfig/default.nix
index 5c9a0ecc71b..617e058bd8f 100644
--- a/pkgs/development/libraries/fontconfig/default.nix
+++ b/pkgs/development/libraries/fontconfig/default.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
   doCheck = true;
 
   # Don't try to write to /var/cache/fontconfig at install time.
-  installFlags = "fc_cachedir=$(TMPDIR)/dummy RUN_FC_CACHE_TEST=false";
+  installFlags = [ "fc_cachedir=$(TMPDIR)/dummy" "RUN_FC_CACHE_TEST=false" ];
 
   postInstall = ''
     cd "$out/etc/fonts"
diff --git a/pkgs/development/libraries/gdal/gdal-1_11.nix b/pkgs/development/libraries/gdal/gdal-1_11.nix
index a6574053414..6a086d9c998 100644
--- a/pkgs/development/libraries/gdal/gdal-1_11.nix
+++ b/pkgs/development/libraries/gdal/gdal-1_11.nix
@@ -40,9 +40,7 @@ stdenv.mkDerivation rec {
   ];
 
   # Allow use of old proj_api.h
-  NIX_CFLAGS_COMPILE = [
-    "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H=1"
-  ];
+  NIX_CFLAGS_COMPILE = "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H=1";
 
   # Prevent this:
   #
diff --git a/pkgs/development/libraries/gdbm/default.nix b/pkgs/development/libraries/gdbm/default.nix
index 972e9022235..830a311db70 100644
--- a/pkgs/development/libraries/gdbm/default.nix
+++ b/pkgs/development/libraries/gdbm/default.nix
@@ -4,9 +4,6 @@ stdenv.mkDerivation rec {
   pname = "gdbm";
   version = "1.18.1";
 
-  # FIXME: remove on update to > 1.18.1
-  NIX_CFLAGS_COMPILE = if stdenv.cc.isClang then "-Wno-error=return-type" else null;
-
   src = fetchurl {
     url = "mirror://gnu/gdbm/${pname}-${version}.tar.gz";
     sha256 = "1p4ibds6z3ccy65lkmd6lm7js0kwifvl53r0fd759fjxgr917rl6";
diff --git a/pkgs/development/libraries/gegl/4.0.nix b/pkgs/development/libraries/gegl/4.0.nix
index 1bdf557f399..75897b036bf 100644
--- a/pkgs/development/libraries/gegl/4.0.nix
+++ b/pkgs/development/libraries/gegl/4.0.nix
@@ -118,7 +118,7 @@ stdenv.mkDerivation rec {
 
   # TODO: Fix missing math symbols in gegl seamless clone.
   # It only appears when we use packaged poly2tri-c instead of vendored one.
-  NIX_CFLAGS_COMPILE = [ "-lm" ];
+  NIX_CFLAGS_COMPILE = "-lm";
 
   postPatch = ''
     chmod +x tests/opencl/opencl_test.sh tests/buffer/buffer-tests-run.sh
diff --git a/pkgs/development/libraries/geis/default.nix b/pkgs/development/libraries/geis/default.nix
index 97b9ba087e2..1b3d5ba4b7c 100644
--- a/pkgs/development/libraries/geis/default.nix
+++ b/pkgs/development/libraries/geis/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     sha256 = "1svhbjibm448ybq6gnjjzj0ak42srhihssafj0w402aj71lgaq4a";
   };
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=misleading-indentation" "-Wno-error=pointer-compare" ];
+  NIX_CFLAGS_COMPILE = "-Wno-error=misleading-indentation -Wno-error=pointer-compare";
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/development/libraries/gettext/default.nix b/pkgs/development/libraries/gettext/default.nix
index 157f801d2f2..c2165a9d9c7 100644
--- a/pkgs/development/libraries/gettext/default.nix
+++ b/pkgs/development/libraries/gettext/default.nix
@@ -86,5 +86,5 @@ stdenv.mkDerivation rec {
 }
 
 // stdenv.lib.optionalAttrs stdenv.isDarwin {
-  makeFlags = "CFLAGS=-D_FORTIFY_SOURCE=0";
+  makeFlags = [ "CFLAGS=-D_FORTIFY_SOURCE=0" ];
 }
diff --git a/pkgs/development/libraries/giflib/default.nix b/pkgs/development/libraries/giflib/default.nix
index 5d7b95136dd..e2ff96d366a 100644
--- a/pkgs/development/libraries/giflib/default.nix
+++ b/pkgs/development/libraries/giflib/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchpatch, xmlto, docbook_xml_dtd_412, docbook_xsl, libxml2 }:
+{ stdenv, fetchurl, fetchpatch, xmlto, docbook_xml_dtd_412, docbook_xsl, libxml2, fixDarwinDylibNames }:
 
 stdenv.mkDerivation rec {
   name = "giflib-5.2.1";
@@ -21,6 +21,8 @@ stdenv.mkDerivation rec {
       --replace 'PREFIX = /usr/local' 'PREFIX = ${builtins.placeholder "out"}'
   '';
 
+  nativeBuildInputs = stdenv.lib.optionals stdenv.isDarwin [ fixDarwinDylibNames ];
+
   buildInputs = [ xmlto docbook_xml_dtd_412 docbook_xsl libxml2 ];
 
   meta = {
diff --git a/pkgs/development/libraries/glib-networking/default.nix b/pkgs/development/libraries/glib-networking/default.nix
index 802a18dfda5..63a773522a0 100644
--- a/pkgs/development/libraries/glib-networking/default.nix
+++ b/pkgs/development/libraries/glib-networking/default.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "glib-networking";
-  version = "2.62.1";
+  version = "2.62.2";
 
   outputs = [ "out" "installedTests" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "043imcynl3rwdz79wvpdfhkmqmgdhr34z0vac3x7jymdf5kswm9w";
+    sha256 = "0i2mw75297ql72h47vyvff3hqa0kcmqybblj52fqrarb0kfbhi06";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index 706e99179f5..0febed9f9c9 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -48,11 +48,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "glib";
-  version = "2.62.3";
+  version = "2.62.4";
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1i2mlrd351dnmpfi465qmx9rhgyff01j29a2x3lczzyky34ss024";
+    sha256 = "1g2vj9lyh032kcwij7avx5d6a99rcsnkd07sbl9i55zsfw6h712c";
   };
 
   patches = optionals stdenv.isDarwin [
@@ -118,7 +118,7 @@ stdenv.mkDerivation rec {
     "-Ddevbindir=${placeholder ''dev''}/bin"
   ];
 
-  NIX_CFLAGS_COMPILE = [
+  NIX_CFLAGS_COMPILE = toString [
     "-Wno-error=nonnull"
     # Default for release buildtype but passed manually because
     # we're using plain
diff --git a/pkgs/development/libraries/glibc/default.nix b/pkgs/development/libraries/glibc/default.nix
index 50b359da96c..98e579cb7a6 100644
--- a/pkgs/development/libraries/glibc/default.nix
+++ b/pkgs/development/libraries/glibc/default.nix
@@ -5,6 +5,14 @@
 , buildPackages
 }:
 
+let
+  gdCflags = [
+    "-Wno-error=stringop-truncation"
+    "-Wno-error=missing-attributes"
+    "-Wno-error=array-bounds"
+  ];
+in
+
 callPackage ./common.nix { inherit stdenv; } {
     name = "glibc" + stdenv.lib.optionalString withGd "-gd";
 
@@ -47,14 +55,14 @@ callPackage ./common.nix { inherit stdenv; } {
         #       musl-specific flags below.
         #       At next change to non-musl glibc builds, remove this `then`
         #       and the above condition, instead keeping only the `else` below.
-        then (if withGd then "-Wno-error=stringop-truncation" else null)
+        then (if withGd then gdCflags else null)
         else
-          builtins.concatLists [
-            (stdenv.lib.optional withGd "-Wno-error=stringop-truncation")
+          (builtins.concatLists [
+            (stdenv.lib.optionals withGd gdCflags)
             # Fix -Werror build failure when building glibc with musl with GCC >= 8, see:
             # https://github.com/NixOS/nixpkgs/pull/68244#issuecomment-544307798
             (stdenv.lib.optional stdenv.hostPlatform.isMusl "-Wno-error=attribute-alias")
-          ];
+          ]);
 
     # When building glibc from bootstrap-tools, we need libgcc_s at RPATH for
     # any program we run, because the gcc will have been placed at a new
diff --git a/pkgs/development/libraries/glm/default.nix b/pkgs/development/libraries/glm/default.nix
index 88b33601ee7..d39d6f0d7a3 100644
--- a/pkgs/development/libraries/glm/default.nix
+++ b/pkgs/development/libraries/glm/default.nix
@@ -27,9 +27,7 @@ stdenv.mkDerivation rec {
     cp ${gcc7PlatformPatch} glm/simd/platform.h
   '';
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionals stdenv.isDarwin [
-    "-DGLM_COMPILER=0"
-  ];
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin "-DGLM_COMPILER=0";
 
   postInstall = ''
     mkdir -p $doc/share/doc/glm
diff --git a/pkgs/development/libraries/gperftools/default.nix b/pkgs/development/libraries/gperftools/default.nix
index bc10c9f9bdd..0e985754985 100644
--- a/pkgs/development/libraries/gperftools/default.nix
+++ b/pkgs/development/libraries/gperftools/default.nix
@@ -16,9 +16,8 @@ stdenv.mkDerivation rec {
     substituteInPlace libtool --replace stdc++ c++
   '';
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionals stdenv.isDarwin [
-    "-D_XOPEN_SOURCE" "-Wno-aligned-allocation-unavailable"
-  ];
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin
+    "-D_XOPEN_SOURCE -Wno-aligned-allocation-unavailable";
 
   # some packages want to link to the static tcmalloc_minimal
   # to drop the runtime dependency on gperftools
diff --git a/pkgs/development/libraries/gpgme/default.nix b/pkgs/development/libraries/gpgme/default.nix
index 63072273c2e..ed2b5563bd3 100644
--- a/pkgs/development/libraries/gpgme/default.nix
+++ b/pkgs/development/libraries/gpgme/default.nix
@@ -47,12 +47,12 @@ stdenv.mkDerivation rec {
   # fit in the limit. https://github.com/NixOS/nix/pull/1085
     ++ lib.optionals stdenv.isDarwin [ "--disable-gpg-test" ];
 
-  NIX_CFLAGS_COMPILE =
+  NIX_CFLAGS_COMPILE = toString (
     # qgpgme uses Q_ASSERT which retains build inputs at runtime unless
     # debugging is disabled
     lib.optional (qtbase != null) "-DQT_NO_DEBUG"
     # https://www.gnupg.org/documentation/manuals/gpgme/Largefile-Support-_0028LFS_0029.html
-    ++ lib.optional (system == "i686-linux") "-D_FILE_OFFSET_BITS=64";
+    ++ lib.optional (system == "i686-linux") "-D_FILE_OFFSET_BITS=64");
 
   checkInputs = [ which ];
 
diff --git a/pkgs/development/libraries/gsl/default.nix b/pkgs/development/libraries/gsl/default.nix
index 1fd086ca23c..966d6a8ffd5 100644
--- a/pkgs/development/libraries/gsl/default.nix
+++ b/pkgs/development/libraries/gsl/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
   };
 
   # do not let -march=skylake to enable FMA (https://lists.gnu.org/archive/html/bug-gsl/2011-11/msg00019.html)
-  NIX_CFLAGS_COMPILE = stdenv.lib.optional stdenv.isx86_64 "-mno-fma";
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isx86_64 "-mno-fma";
 
   # https://lists.gnu.org/archive/html/bug-gsl/2015-11/msg00012.html
   doCheck = stdenv.hostPlatform.system != "i686-linux" && stdenv.hostPlatform.system != "aarch64-linux";
diff --git a/pkgs/development/libraries/gsl/gsl-1_16.nix b/pkgs/development/libraries/gsl/gsl-1_16.nix
index e5772c8772e..ae102ac6030 100644
--- a/pkgs/development/libraries/gsl/gsl-1_16.nix
+++ b/pkgs/development/libraries/gsl/gsl-1_16.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
   };
 
   # do not let -march=skylake to enable FMA (https://lists.gnu.org/archive/html/bug-gsl/2011-11/msg00019.html)
-  NIX_CFLAGS_COMPILE = stdenv.lib.optional stdenv.isx86_64 "-mno-fma";
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isx86_64 "-mno-fma";
 
   patches = [
     (fetchpatch {
diff --git a/pkgs/development/libraries/gtk/2.x.nix b/pkgs/development/libraries/gtk/2.x.nix
index 4286d6a73fb..932527eed09 100644
--- a/pkgs/development/libraries/gtk/2.x.nix
+++ b/pkgs/development/libraries/gtk/2.x.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     ./hooks/drop-icon-theme-cache.sh
   ];
 
-  nativeBuildInputs = [ setupHooks perl pkgconfig gettext gobject-introspection ];
+  nativeBuildInputs = setupHooks ++ [ perl pkgconfig gettext gobject-introspection ];
 
   patches = [
     ./patches/2.0-immodules.cache.patch
diff --git a/pkgs/development/libraries/gtk/3.x.nix b/pkgs/development/libraries/gtk/3.x.nix
index 7f09b52d51f..60432614433 100644
--- a/pkgs/development/libraries/gtk/3.x.nix
+++ b/pkgs/development/libraries/gtk/3.x.nix
@@ -88,10 +88,7 @@ stdenv.mkDerivation rec {
 
   # These are the defines that'd you'd get with --enable-debug=minimum (default).
   # See: https://developer.gnome.org/gtk3/stable/gtk-building.html#extra-configuration-options
-  NIX_CFLAGS_COMPILE = [
-    "-DG_ENABLE_DEBUG"
-    "-DG_DISABLE_CAST_CHECKS"
-  ];
+  NIX_CFLAGS_COMPILE = "-DG_ENABLE_DEBUG -DG_DISABLE_CAST_CHECKS";
 
   postPatch = ''
     files=(
@@ -118,8 +115,7 @@ stdenv.mkDerivation rec {
     pkgconfig
     python3
     sassc
-    setupHooks
-  ] ++ optionals withGtkDoc [
+  ] ++ setupHooks ++ optionals withGtkDoc [
     docbook_xml_dtd_43
     docbook_xsl
     gtk-doc
diff --git a/pkgs/development/libraries/hspell/dicts.nix b/pkgs/development/libraries/hspell/dicts.nix
index ec6b304dc3c..83942c2c1dd 100644
--- a/pkgs/development/libraries/hspell/dicts.nix
+++ b/pkgs/development/libraries/hspell/dicts.nix
@@ -1,42 +1,38 @@
 { stdenv, hspell }:
 
 let
-  dict = a: stdenv.mkDerivation ({
+  dict = variant: a: stdenv.mkDerivation ({
     inherit (hspell) src patchPhase nativeBuildInputs;
+    buildFlags = [ variant ];
+
     meta = hspell.meta // {
       broken = true;
-      description = "${a.buildFlags} Hebrew dictionary";
+      description = "${variant} Hebrew dictionary";
     } // (if a ? meta then a.meta else {});
   } // (removeAttrs a ["meta"]));
 in
 {
   recurseForDerivations = true;
 
-  aspell = dict {
+  aspell = dict "aspell" {
     name = "aspell-dict-he-${hspell.version}";
 
-    buildFlags = "aspell";
-
     installPhase = ''
       mkdir -p $out/lib/aspell
       cp -v he_affix.dat he.wl $out/lib/aspell'';
   };
 
-  myspell = dict {
+  myspell = dict "myspell" {
     name = "myspell-dict-he-${hspell.version}";
 
-    buildFlags = "myspell";
-
     installPhase = ''
       mkdir -p $out/lib/myspell
       cp -v he.dic he.aff $out/lib/myspell'';
   };
 
-  hunspell = dict {
+  hunspell = dict "hunspell" {
     name = "hunspell-dict-he-${hspell.version}";
 
-    buildFlags = "hunspell";
-
     installPhase = ''
       mkdir -p $out/lib
       cp -rv hunspell $out/lib'';
diff --git a/pkgs/development/libraries/http-parser/default.nix b/pkgs/development/libraries/http-parser/default.nix
index 76173bc5b99..4b1a695ca55 100644
--- a/pkgs/development/libraries/http-parser/default.nix
+++ b/pkgs/development/libraries/http-parser/default.nix
@@ -16,7 +16,7 @@ in stdenv.mkDerivation {
   NIX_CFLAGS_COMPILE = "-Wno-error";
   patches = [ ./build-shared.patch ];
   makeFlags = [ "DESTDIR=" "PREFIX=$(out)" ];
-  buildFlags = "library";
+  buildFlags = [ "library" ];
   doCheck = true;
   checkTarget = "test";
 
diff --git a/pkgs/development/libraries/icu/58.nix b/pkgs/development/libraries/icu/58.nix
index f7763ba49da..e53e4e3737e 100644
--- a/pkgs/development/libraries/icu/58.nix
+++ b/pkgs/development/libraries/icu/58.nix
@@ -10,5 +10,5 @@ import ./base.nix {
   version = "58.2";
   sha256 = "036shcb3f8bm1lynhlsb4kpjm9s9c2vdiir01vg216rs2l8482ib";
   patches = [ keywordFix ];
-  patchFlags = "-p4";
+  patchFlags = [ "-p4" ];
 }
diff --git a/pkgs/development/libraries/icu/base.nix b/pkgs/development/libraries/icu/base.nix
index 47ca63fca99..e51224433e8 100644
--- a/pkgs/development/libraries/icu/base.nix
+++ b/pkgs/development/libraries/icu/base.nix
@@ -1,4 +1,4 @@
-{ version, sha256, patches ? [], patchFlags ? "" }:
+{ version, sha256, patches ? [], patchFlags ? [] }:
 { stdenv, lib, fetchurl, fixDarwinDylibNames
   # Cross-compiled icu4c requires a build-root of a native compile
 , buildRootOnly ? false, nativeBuildRoot
diff --git a/pkgs/development/libraries/ilmbase/default.nix b/pkgs/development/libraries/ilmbase/default.nix
index a25a590b370..00cdda1e570 100644
--- a/pkgs/development/libraries/ilmbase/default.nix
+++ b/pkgs/development/libraries/ilmbase/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ automake autoconf libtool which ];
 
-  NIX_CFLAGS_LINK = [ "-pthread" ];
+  NIX_CFLAGS_LINK = "-pthread";
 
   patches = [
     ./bootstrap.patch
diff --git a/pkgs/development/libraries/itk/4.x.nix b/pkgs/development/libraries/itk/4.x.nix
index df016d9fcac..7e24ba901e5 100644
--- a/pkgs/development/libraries/itk/4.x.nix
+++ b/pkgs/development/libraries/itk/4.x.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, cmake, libX11, libuuid, xz, vtk }:
 
 stdenv.mkDerivation rec {
-  name = "itk-4.13.1";
+  name = "itk-4.13.2";
 
   src = fetchurl {
-    url = mirror://sourceforge/itk/InsightToolkit-4.13.1.tar.xz;
-    sha256 = "0p4cspgbnjsnkjz8nfg092yaxz8qkqi2nkxjdv421d0zrmi0i2al";
+    url = mirror://sourceforge/itk/InsightToolkit-4.13.2.tar.xz;
+    sha256 = "19cgfpd63gqrvc3m27m394gy2d7w79g5y6lvznb5qqr49lihbgns";
   };
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/java/swt/default.nix b/pkgs/development/libraries/java/swt/default.nix
index 6eb5a1f5355..b0fdca11218 100644
--- a/pkgs/development/libraries/java/swt/default.nix
+++ b/pkgs/development/libraries/java/swt/default.nix
@@ -38,8 +38,8 @@ in stdenv.mkDerivation rec {
   nativeBuildInputs = [ unzip pkgconfig ];
   buildInputs = [ jdk gtk2 libXt libXtst libXi libGLU libGL webkitgtk libsoup ];
 
-  NIX_LFLAGS = (map (x: "-L${lib.getLib x}/lib") [ xorg.libX11 pango gdk-pixbuf glib ]) ++
-    [ "-lX11" "-lpango-1.0" "-lgdk_pixbuf-2.0" "-lglib-2.0" ];
+  NIX_LFLAGS = toString (map (x: "-L${lib.getLib x}/lib") [ xorg.libX11 pango gdk-pixbuf glib ]) +
+    " -lX11 -lpango-1.0 -lgdk_pixbuf-2.0 -lglib-2.0";
 
   buildPhase = ''
     unzip src.zip -d src
diff --git a/pkgs/development/libraries/leatherman/default.nix b/pkgs/development/libraries/leatherman/default.nix
index 0af7f29a41f..b7b9b019b63 100644
--- a/pkgs/development/libraries/leatherman/default.nix
+++ b/pkgs/development/libraries/leatherman/default.nix
@@ -11,7 +11,12 @@ stdenv.mkDerivation rec {
     owner = "puppetlabs";
   };
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=ignored-qualifiers" "-Wno-error=class-memaccess" "-Wno-error=catch-value" ];
+  NIX_CFLAGS_COMPILE = builtins.toString [
+    "-Wno-error=ignored-qualifiers"
+    "-Wno-error=class-memaccess"
+    "-Wno-error=catch-value"
+    "-Wno-error=deprecated-copy"
+  ];
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ boost curl ruby ];
@@ -19,7 +24,7 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   meta = with stdenv.lib; {
-    homepage = https://github.com/puppetlabs/leatherman/;  
+    homepage = https://github.com/puppetlabs/leatherman/;
     description = "A collection of C++ and CMake utility libraries";
     license = licenses.asl20;
     maintainers = [ maintainers.womfoo ];
diff --git a/pkgs/development/libraries/libav/default.nix b/pkgs/development/libraries/libav/default.nix
index feeb4de15e1..43cfe2ef251 100644
--- a/pkgs/development/libraries/libav/default.nix
+++ b/pkgs/development/libraries/libav/default.nix
@@ -103,7 +103,7 @@ let
     setOutputFlags = false;
 
     # alltools to build smaller tools, incl. aviocat, ismindex, qt-faststart, etc.
-    buildFlags = "all alltools install-man";
+    buildFlags = [ "all" "alltools" "install-man" ];
 
 
     postInstall = ''
diff --git a/pkgs/development/libraries/libbluray/default.nix b/pkgs/development/libraries/libbluray/default.nix
index 517251e137e..daa349ca630 100644
--- a/pkgs/development/libraries/libbluray/default.nix
+++ b/pkgs/development/libraries/libbluray/default.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = optional withAACS libaacs;
 
-  NIX_LDFLAGS = [
+  NIX_LDFLAGS = toString [
     (optionalString withAACS   "-L${libaacs}/lib -laacs")
     (optionalString withBDplus "-L${libbdplus}/lib -lbdplus")
   ];
diff --git a/pkgs/development/libraries/libcaca/default.nix b/pkgs/development/libraries/libcaca/default.nix
index 8949ea8e390..7773fe46c0c 100644
--- a/pkgs/development/libraries/libcaca/default.nix
+++ b/pkgs/development/libraries/libcaca/default.nix
@@ -19,12 +19,12 @@ stdenv.mkDerivation rec {
     (if x11Support then "--enable-x11" else "--disable-x11")
     ];
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optional (!x11Support) "-DX_DISPLAY_MISSING";
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString (!x11Support) "-DX_DISPLAY_MISSING";
 
   enableParallelBuilding = true;
 
   propagatedBuildInputs = [ ncurses zlib pkgconfig (imlib2.override { inherit x11Support; }) ]
-    ++ stdenv.lib.optionals x11Support [ libX11 libXext];
+    ++ stdenv.lib.optionals x11Support [ libX11 libXext ];
 
   postInstall = ''
     mkdir -p $dev/bin
diff --git a/pkgs/development/libraries/libcbor/default.nix b/pkgs/development/libraries/libcbor/default.nix
index 4d56c0f1403..4949d657669 100644
--- a/pkgs/development/libraries/libcbor/default.nix
+++ b/pkgs/development/libraries/libcbor/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   doCheck = false; # needs "-DWITH_TESTS=ON", but fails w/compilation error
 
-  NIX_CFLAGS_COMPILE = [ "-fno-lto" ];
+  NIX_CFLAGS_COMPILE = "-fno-lto";
 
   meta = with stdenv.lib; {
     description = "CBOR protocol implementation for C and others";
diff --git a/pkgs/development/libraries/libcef/default.nix b/pkgs/development/libraries/libcef/default.nix
index be418125dfb..03cc3b2beb4 100644
--- a/pkgs/development/libraries/libcef/default.nix
+++ b/pkgs/development/libraries/libcef/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ cmake ];
-  makeFlags = "libcef_dll_wrapper";
+  makeFlags = [ "libcef_dll_wrapper" ];
   dontStrip = true;
   dontPatchELF = true;
 
diff --git a/pkgs/development/libraries/libcouchbase/default.nix b/pkgs/development/libraries/libcouchbase/default.nix
index ccfe241324e..53ec231dec9 100644
--- a/pkgs/development/libraries/libcouchbase/default.nix
+++ b/pkgs/development/libraries/libcouchbase/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "1yfmcx65aqd5l87scha6kmm2s38n85ci3gg0h6qfs16s3jfi6bw7";
   };
 
-  cmakeFlags = "-DLCB_NO_MOCK=ON";
+  cmakeFlags = [ "-DLCB_NO_MOCK=ON" ];
 
   nativeBuildInputs = [ cmake pkgconfig ];
   buildInputs = [ libevent openssl ];
diff --git a/pkgs/development/libraries/libde265/default.nix b/pkgs/development/libraries/libde265/default.nix
index 3c31ba805d8..918f7675389 100644
--- a/pkgs/development/libraries/libde265/default.nix
+++ b/pkgs/development/libraries/libde265/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, autoreconfHook, pkgconfig }:
 
 stdenv.mkDerivation rec {
-  version = "1.0.3";
+  version = "1.0.4";
   pname = "libde265";
 
   src = fetchFromGitHub {
     owner = "strukturag";
     repo = "libde265";
     rev = "v${version}";
-    sha256 = "049g77f6c5sbk1h534zi9akj3y5h8zwnca5c9kqqjkn7f17irk10";
+    sha256 = "0svxrhh1pv7xpj75svz0iw1sq5i6z2grj7sc3q11hl63666hzh7d";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
diff --git a/pkgs/development/libraries/libdynd/default.nix b/pkgs/development/libraries/libdynd/default.nix
index 249f3f4f21a..c02a6f9a502 100644
--- a/pkgs/development/libraries/libdynd/default.nix
+++ b/pkgs/development/libraries/libdynd/default.nix
@@ -16,13 +16,14 @@ stdenv.mkDerivation {
     "-DDYND_BUILD_BENCHMARKS=OFF"
   ];
 
-  # added to fix build with gcc7
-  NIX_CFLAGS_COMPILE = [
+  # added to fix build with gcc7+
+  NIX_CFLAGS_COMPILE = builtins.toString [
     "-Wno-error=implicit-fallthrough"
     "-Wno-error=nonnull"
     "-Wno-error=tautological-compare"
     "-Wno-error=class-memaccess"
     "-Wno-error=parentheses"
+    "-Wno-error=deprecated-copy"
   ];
 
   buildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/libev/default.nix b/pkgs/development/libraries/libev/default.nix
index 56710945ecb..42d3b943569 100644
--- a/pkgs/development/libraries/libev/default.nix
+++ b/pkgs/development/libraries/libev/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libev";
-  version="4.27";
+  version="4.31";
 
   src = fetchurl {
     url = "http://dist.schmorp.de/libev/Attic/${pname}-${version}.tar.gz";
-    sha256 = "0kil23cgsp0r5shvnwwbsy7fzxb62sxqzqbkbkfp5w54ipy2cm9d";
+    sha256 = "0nkfqv69wfyy2bpga4d53iqydycpik8jp8x6q70353hia8mmv1gd";
   };
 
   meta = {
diff --git a/pkgs/development/libraries/libexecinfo/default.nix b/pkgs/development/libraries/libexecinfo/default.nix
index 2eee9bafe44..4519cc7dd74 100644
--- a/pkgs/development/libraries/libexecinfo/default.nix
+++ b/pkgs/development/libraries/libexecinfo/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "CC:=$(CC)" "AR:=$(AR)" ];
 
-  patchFlags = "-p0";
+  patchFlags = [ "-p0" ];
 
   installPhase = ''
     install -Dm644 execinfo.h stacktraverse.h -t $out/include
diff --git a/pkgs/development/libraries/libf2c/default.nix b/pkgs/development/libraries/libf2c/default.nix
index 2de407e8f63..10a0d179d3e 100644
--- a/pkgs/development/libraries/libf2c/default.nix
+++ b/pkgs/development/libraries/libf2c/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     unzip ${src}
   '';
 
-  makeFlags = "-f makefile.u";
+  makeFlags = [ "-f" "makefile.u" ];
 
   installPhase = ''
     mkdir -p $out/include $out/lib
diff --git a/pkgs/development/libraries/libfakekey/default.nix b/pkgs/development/libraries/libfakekey/default.nix
index 196f0e50bef..3c243191543 100644
--- a/pkgs/development/libraries/libfakekey/default.nix
+++ b/pkgs/development/libraries/libfakekey/default.nix
@@ -11,9 +11,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libX11 libXi libXtst xorgproto ];
-  NIX_LDFLAGS = [
-    "-lX11"
-  ];
+  NIX_LDFLAGS = "-lX11";
 
   meta = with stdenv.lib; {
     description = "X virtual keyboard library";
diff --git a/pkgs/development/libraries/libfpx/default.nix b/pkgs/development/libraries/libfpx/default.nix
index f4863eb33f2..97df5107409 100644
--- a/pkgs/development/libraries/libfpx/default.nix
+++ b/pkgs/development/libraries/libfpx/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
   };
 
   # Darwin gets misdetected as Windows without this
-  NIX_CFLAGS_COMPILE = if stdenv.isDarwin then "-D__unix" else null;
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin "-D__unix";
 
   patches = [
     (fetchpatch {
diff --git a/pkgs/development/libraries/libftdi/default.nix b/pkgs/development/libraries/libftdi/default.nix
index 08ec1d84a3f..3dffbd075e9 100644
--- a/pkgs/development/libraries/libftdi/default.nix
+++ b/pkgs/development/libraries/libftdi/default.nix
@@ -14,7 +14,7 @@ with stdenv; mkDerivation rec {
 
   # Hack to avoid TMPDIR in RPATHs.
   preFixup = ''rm -rf "$(pwd)" '';
-  configureFlags = lib.optional (!isDarwin) [ "--with-async-mode" ];
+  configureFlags = lib.optional (!isDarwin) "--with-async-mode";
 
   # allow async mode. from ubuntu. see:
   #   https://bazaar.launchpad.net/~ubuntu-branches/ubuntu/trusty/libftdi/trusty/view/head:/debian/patches/04_async_mode.diff
diff --git a/pkgs/development/libraries/libgdiplus/default.nix b/pkgs/development/libraries/libgdiplus/default.nix
index 1a690ca7aa1..54bf091e5ea 100644
--- a/pkgs/development/libraries/libgdiplus/default.nix
+++ b/pkgs/development/libraries/libgdiplus/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
 
-  configureFlags = stdenv.lib.optionalString stdenv.cc.isClang "--host=${stdenv.hostPlatform.system}";
+  configureFlags = stdenv.lib.optional stdenv.cc.isClang "--host=${stdenv.hostPlatform.system}";
 
   buildInputs =
     [ glib cairo fontconfig libtiff giflib
diff --git a/pkgs/development/libraries/libglvnd/default.nix b/pkgs/development/libraries/libglvnd/default.nix
index c2a5cfbed74..55b801b0b0d 100644
--- a/pkgs/development/libraries/libglvnd/default.nix
+++ b/pkgs/development/libraries/libglvnd/default.nix
@@ -39,13 +39,13 @@ stdenv.mkDerivation rec {
       --replace "-Xlinker --version-script=$(VERSION_SCRIPT)" "-Xlinker"
   '';
 
-  NIX_CFLAGS_COMPILE = [
+  NIX_CFLAGS_COMPILE = toString ([
     "-UDEFAULT_EGL_VENDOR_CONFIG_DIRS"
     # FHS paths are added so that non-NixOS applications can find vendor files.
     "-DDEFAULT_EGL_VENDOR_CONFIG_DIRS=\"${addOpenGLRunpath.driverLink}/share/glvnd/egl_vendor.d:/etc/glvnd/egl_vendor.d:/usr/share/glvnd/egl_vendor.d\""
 
     "-Wno-error=array-bounds"
-  ] ++ lib.optional stdenv.cc.isClang "-Wno-error";
+  ] ++ lib.optional stdenv.cc.isClang "-Wno-error");
 
   # Indirectly: https://bugs.freedesktop.org/show_bug.cgi?id=35268
   configureFlags  = stdenv.lib.optional stdenv.hostPlatform.isMusl "--disable-tls";
diff --git a/pkgs/development/libraries/libguestfs/default.nix b/pkgs/development/libraries/libguestfs/default.nix
index 07f2099f11a..8d480c2d882 100644
--- a/pkgs/development/libraries/libguestfs/default.nix
+++ b/pkgs/development/libraries/libguestfs/default.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
     ++ stdenv.lib.optionals (!javaSupport) [ "--disable-java" "--without-java" ];
   patches = [ ./libguestfs-syms.patch ];
   NIX_CFLAGS_COMPILE="-I${libxml2.dev}/include/libxml2/";
-  installFlags = "REALLY_INSTALL=yes";
+  installFlags = [ "REALLY_INSTALL=yes" ];
   enableParallelBuilding = true;
 
   postInstall = ''
diff --git a/pkgs/development/libraries/libheif/default.nix b/pkgs/development/libraries/libheif/default.nix
index 85174e9c3e6..a6e072ef76f 100644
--- a/pkgs/development/libraries/libheif/default.nix
+++ b/pkgs/development/libraries/libheif/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libheif";
-  version = "1.6.0";
+  version = "1.6.1";
 
   outputs = [ "bin" "out" "dev" "man" ];
 
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     owner = "strukturag";
     repo = "libheif";
     rev = "v${version}";
-    sha256 = "0im9k2pqghlsppj165kh3nc26c4wx1brckmncdmpy0mcj56jjmba";
+    sha256 = "0l3mj11lp4974kaym3aidm4wriqzls13gz22s67l6341yhsc42n6";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
diff --git a/pkgs/development/libraries/libical/default.nix b/pkgs/development/libraries/libical/default.nix
index 903a1a26eb7..69c4b3aeb74 100644
--- a/pkgs/development/libraries/libical/default.nix
+++ b/pkgs/development/libraries/libical/default.nix
@@ -15,7 +15,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libical";
-  version = "3.0.6";
+  version = "3.0.7";
 
   outputs = [ "out" "dev" ]; # "devdoc" ];
 
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     owner = "libical";
     repo = "libical";
     rev = "v${version}";
-    sha256 = "181lf07fj36fp0rbcjjmb53yzdvv9i4qxpnbpax8hayjhha8pjh3";
+    sha256 = "1ppf8jlpiclq3jprhx889y5lgf6lc2q4d8wy2zavzsxgnsqf67il";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libjpeg-drop/default.nix b/pkgs/development/libraries/libjpeg-drop/default.nix
index 4e9c165e71f..8ed1c9bf92f 100644
--- a/pkgs/development/libraries/libjpeg-drop/default.nix
+++ b/pkgs/development/libraries/libjpeg-drop/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
   '';
 
   configureFlags = []
-    ++ optional static [ "--enable-static" "--disable-shared" ];
+    ++ optionals static [ "--enable-static" "--disable-shared" ];
 
   outputs = [ "bin" "dev" "out" "man" ];
 
diff --git a/pkgs/development/libraries/libmatchbox/default.nix b/pkgs/development/libraries/libmatchbox/default.nix
index 3786c5e77d3..98875e48f57 100644
--- a/pkgs/development/libraries/libmatchbox/default.nix
+++ b/pkgs/development/libraries/libmatchbox/default.nix
@@ -6,9 +6,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libXft libICE pango libjpeg ];
   propagatedBuildInputs = [ libX11 libXext libpng ];
-  NIX_LDFLAGS = [
-    "-lX11"
-  ];
+  NIX_LDFLAGS = "-lX11";
 
   src = fetchurl {
     url = "https://downloads.yoctoproject.org/releases/matchbox/libmatchbox/${version}/libmatchbox-${version}.tar.bz2";
diff --git a/pkgs/development/libraries/libmbim/default.nix b/pkgs/development/libraries/libmbim/default.nix
index 46255e276f5..a49e0eaaac6 100644
--- a/pkgs/development/libraries/libmbim/default.nix
+++ b/pkgs/development/libraries/libmbim/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libmbim";
-  version = "1.20.2";
+  version = "1.20.4";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/libmbim/${pname}-${version}.tar.xz";
-    sha256 = "16q550sy84izi5ic3sbbhjnnka2fwhj8vvdrirpn9xspbsgbc3sm";
+    sha256 = "1s6k6vm4hyma7nafm1gjssl9lq9nkkiska462xpiz7xh16j0h9xc";
   };
 
   outputs = [ "out" "dev" "man" ];
diff --git a/pkgs/development/libraries/libmemcached/default.nix b/pkgs/development/libraries/libmemcached/default.nix
index 57053103417..5655bfe968b 100644
--- a/pkgs/development/libraries/libmemcached/default.nix
+++ b/pkgs/development/libraries/libmemcached/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation {
   buildInputs = [ libevent ];
   propagatedBuildInputs = [ cyrus_sasl ];
 
-  NIX_CFLAGS_COMPILE = [ "-fpermissive"/*gcc7*/ ];
+  NIX_CFLAGS_COMPILE = "-fpermissive";
 
   meta = with stdenv.lib; {
     homepage = https://libmemcached.org;
diff --git a/pkgs/development/libraries/libmicrohttpd/default.nix b/pkgs/development/libraries/libmicrohttpd/default.nix
index c8340626935..ba4d74e4d48 100644
--- a/pkgs/development/libraries/libmicrohttpd/default.nix
+++ b/pkgs/development/libraries/libmicrohttpd/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libmicrohttpd";
-  version = "0.9.68";
+  version = "0.9.69";
 
   src = fetchurl {
     url = "mirror://gnu/libmicrohttpd/${pname}-${version}.tar.gz";
-    sha256 = "0q8bc4hrxn6llml7w2vam6n833x8injs39wgdkhwkawr50m6wwf5";
+    sha256 = "0zp34zgcahym5kp2r83gfb5wnr8yf643a26k6zk96x3qica6p6zv";
   };
 
   outputs = [ "out" "dev" "devdoc" "info" ];
diff --git a/pkgs/development/libraries/libmpeg2/default.nix b/pkgs/development/libraries/libmpeg2/default.nix
index 321204a0c4f..2351ce2b554 100644
--- a/pkgs/development/libraries/libmpeg2/default.nix
+++ b/pkgs/development/libraries/libmpeg2/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   # Otherwise clang fails with 'duplicate symbol ___sputc'
-  buildFlags = stdenv.lib.optionalString stdenv.isDarwin "CFLAGS=-std=gnu89";
+  buildFlags = stdenv.lib.optional stdenv.isDarwin "CFLAGS=-std=gnu89";
 
   meta = {
     homepage = http://libmpeg2.sourceforge.net/;
diff --git a/pkgs/development/libraries/liboping/default.nix b/pkgs/development/libraries/liboping/default.nix
index ff8f200a3bb..b2594d7c1d7 100644
--- a/pkgs/development/libraries/liboping/default.nix
+++ b/pkgs/development/libraries/liboping/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "1n2wkmvw6n80ybdwkjq8ka43z2x8mvxq49byv61b52iyz69slf7b";
   };
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=format-truncation" ];
+  NIX_CFLAGS_COMPILE = "-Wno-error=format-truncation";
 
   buildInputs = [ ncurses perl ];
 
diff --git a/pkgs/development/libraries/libosmpbf/default.nix b/pkgs/development/libraries/libosmpbf/default.nix
index 4be744e7ba9..416101cad0a 100644
--- a/pkgs/development/libraries/libosmpbf/default.nix
+++ b/pkgs/development/libraries/libosmpbf/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
 
   sourceRoot = "OSM-binary-1.3.3/src";
 
-  installFlags = "PREFIX=$(out)";
+  installFlags = [ "PREFIX=$(out)" ];
 
   meta = {
     homepage = https://github.com/scrosby/OSM-binary;
diff --git a/pkgs/development/libraries/libowfat/default.nix b/pkgs/development/libraries/libowfat/default.nix
index 4f1a5f8a179..73029c76818 100644
--- a/pkgs/development/libraries/libowfat/default.nix
+++ b/pkgs/development/libraries/libowfat/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
       'install -m 644 $(INCLUDES) $(DESTDIR)$(INCLUDEDIR)'
   '';
 
-  makeFlags = "prefix=$(out)";
+  makeFlags = [ "prefix=$(out)" ];
   enableParallelBuilding = true;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/libpfm/default.nix b/pkgs/development/libraries/libpfm/default.nix
index f48c605dafd..3398d3feb94 100644
--- a/pkgs/development/libraries/libpfm/default.nix
+++ b/pkgs/development/libraries/libpfm/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation (rec {
     "SYS=${stdenv.hostPlatform.uname.system}"
   ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error" ];
+  NIX_CFLAGS_COMPILE = "-Wno-error";
 
   meta = with stdenv.lib; {
     description = "Helper library to program the performance monitoring events";
diff --git a/pkgs/development/libraries/libqtav/default.nix b/pkgs/development/libraries/libqtav/default.nix
index 22245f5fa2a..dd6318444e7 100644
--- a/pkgs/development/libraries/libqtav/default.nix
+++ b/pkgs/development/libraries/libqtav/default.nix
@@ -30,7 +30,7 @@ mkDerivation rec {
   # Make sure libqtav finds its libGL dependency at both link and run time
   # by adding libGL to rpath. Not sure why it wasn't done automatically like
   # the other libraries as `libGL` is part of our `buildInputs`.
-  NIX_CFLAGS_LINK = [ "-Wl,-rpath,${libGL}/lib"];
+  NIX_CFLAGS_LINK = "-Wl,-rpath,${libGL}/lib";
 
   preFixup = ''
     mkdir -p "$out/bin"
diff --git a/pkgs/development/libraries/libscrypt/default.nix b/pkgs/development/libraries/libscrypt/default.nix
index b9ae1f829a1..3083136526b 100644
--- a/pkgs/development/libraries/libscrypt/default.nix
+++ b/pkgs/development/libraries/libscrypt/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   buildFlags = stdenv.lib.optional stdenv.isDarwin "LDFLAGS= CFLAGS_EXTRA=";
 
   installFlags = [ "PREFIX=$(out)" ];
-  installTargets = if stdenv.isDarwin then "install-osx" else "install";
+  installTargets = stdenv.lib.optional stdenv.isDarwin "install-osx";
 
   doCheck = true;
 
diff --git a/pkgs/development/libraries/libspotify/default.nix b/pkgs/development/libraries/libspotify/default.nix
index 9ef3d665413..1b0953df4e6 100644
--- a/pkgs/development/libraries/libspotify/default.nix
+++ b/pkgs/development/libraries/libspotify/default.nix
@@ -50,11 +50,11 @@ else stdenv.mkDerivation {
   buildInputs = stdenv.lib.optional (stdenv.hostPlatform.system == "x86_64-darwin") unzip;
 
   # linux-specific
-  installFlags = stdenv.lib.optionalString (isLinux)
+  installFlags = stdenv.lib.optional isLinux
     "prefix=$(out)";
-  patchPhase = stdenv.lib.optionalString (isLinux)
+  patchPhase = stdenv.lib.optionalString isLinux
     "${gnused}/bin/sed -i 's/ldconfig//' Makefile";
-  postInstall = stdenv.lib.optionalString (isLinux)
+  postInstall = stdenv.lib.optionalString isLinux
     "mv -v share $out";
 
   passthru = {
diff --git a/pkgs/development/libraries/libunique/default.nix b/pkgs/development/libraries/libunique/default.nix
index e0022411221..d6566978a6b 100644
--- a/pkgs/development/libraries/libunique/default.nix
+++ b/pkgs/development/libraries/libunique/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = [ "-DGLIB_DISABLE_DEPRECATION_WARNINGS" ];
+  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   # Patches from Gentoo portage
   patches = [
diff --git a/pkgs/development/libraries/libvdpau/default.nix b/pkgs/development/libraries/libvdpau/default.nix
index 792a31bcf9f..e6a57f1e38c 100644
--- a/pkgs/development/libraries/libvdpau/default.nix
+++ b/pkgs/development/libraries/libvdpau/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   configureFlags = stdenv.lib.optional stdenv.isLinux
     "--with-module-dir=${mesa.drivers.driverLink}/lib/vdpau";
 
-  NIX_LDFLAGS = if stdenv.isDarwin then "-lX11" else null;
+  NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isDarwin "-lX11";
 
   installFlags = [ "moduledir=$(out)/lib/vdpau" ];
 
diff --git a/pkgs/development/libraries/libwhereami/default.nix b/pkgs/development/libraries/libwhereami/default.nix
index 84bd1847faa..8e190f998d5 100644
--- a/pkgs/development/libraries/libwhereami/default.nix
+++ b/pkgs/development/libraries/libwhereami/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     owner = "puppetlabs";
   };
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=catch-value" ];
+  NIX_CFLAGS_COMPILE = "-Wno-error=catch-value";
 
   nativeBuildInputs = [ cmake ];
 
diff --git a/pkgs/development/libraries/libwps/default.nix b/pkgs/development/libraries/libwps/default.nix
index e8f39754885..61b777a5243 100644
--- a/pkgs/development/libraries/libwps/default.nix
+++ b/pkgs/development/libraries/libwps/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ boost librevenge zlib ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=implicit-fallthrough" ]; # newly detected by gcc-7
+  NIX_CFLAGS_COMPILE = "-Wno-error=implicit-fallthrough";
 
   meta = with stdenv.lib; {
     homepage = http://libwps.sourceforge.net/;
diff --git a/pkgs/development/libraries/libxml2/default.nix b/pkgs/development/libraries/libxml2/default.nix
index f5dcb3357f7..57a7294c887 100644
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   outputs = [ "bin" "dev" "out" "man" "doc" ]
     ++ lib.optional pythonSupport "py"
     ++ lib.optional (enableStatic && enableShared) "static";
-  propagatedBuildOutputs = "out bin" + lib.optionalString pythonSupport " py";
+  propagatedBuildOutputs = [ "out" "bin" ] ++ lib.optional pythonSupport "py";
 
   buildInputs = lib.optional pythonSupport python
     ++ lib.optional (pythonSupport && python?isPy3 && python.isPy3) ncurses
@@ -64,8 +64,8 @@ stdenv.mkDerivation rec {
 
   preInstall = lib.optionalString pythonSupport
     ''substituteInPlace python/libxml2mod.la --replace "${python}" "$py"'';
-  installFlags = lib.optionalString pythonSupport
-    ''pythondir="$(py)/lib/${python.libPrefix}/site-packages"'';
+  installFlags = lib.optional pythonSupport
+    "pythondir=\"${placeholder ''py''}/lib/${python.libPrefix}/site-packages\"";
 
   postFixup = ''
     moveToOutput bin/xml2-config "$dev"
diff --git a/pkgs/development/libraries/libyaml-cpp/default.nix b/pkgs/development/libraries/libyaml-cpp/default.nix
index 6d782543099..0dec9daee6a 100644
--- a/pkgs/development/libraries/libyaml-cpp/default.nix
+++ b/pkgs/development/libraries/libyaml-cpp/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
-  cmakeFlags = "-DBUILD_SHARED_LIBS=ON -DYAML_CPP_BUILD_TESTS=OFF";
+  cmakeFlags = [ "-DBUILD_SHARED_LIBS=ON" "-DYAML_CPP_BUILD_TESTS=OFF" ];
 
   meta = with stdenv.lib; {
     inherit (src.meta) homepage;
diff --git a/pkgs/development/libraries/lmdb/default.nix b/pkgs/development/libraries/lmdb/default.nix
index 830ec7bdaee..25bac68faf6 100644
--- a/pkgs/development/libraries/lmdb/default.nix
+++ b/pkgs/development/libraries/lmdb/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   postUnpack = "sourceRoot=\${sourceRoot}/libraries/liblmdb";
 
   patches = [ ./hardcoded-compiler.patch ];
-  patchFlags = "-p3";
+  patchFlags = [ "-p3" ];
 
   outputs = [ "bin" "out" "dev" ];
 
diff --git a/pkgs/development/libraries/mediastreamer/default.nix b/pkgs/development/libraries/mediastreamer/default.nix
index 1605ec355cc..0204223d127 100644
--- a/pkgs/development/libraries/mediastreamer/default.nix
+++ b/pkgs/development/libraries/mediastreamer/default.nix
@@ -32,10 +32,12 @@ stdenv.mkDerivation rec {
     ortp libv4l libpcap srtp bctoolbox libXext libmatroska
   ];
 
-  NIX_CFLAGS_COMPILE = [
+  NIX_CFLAGS_COMPILE = toString [
     "-DGIT_VERSION=\"v${version}\""
     "-Wno-error=deprecated-declarations"
     "-Wno-error=cast-function-type"
+    "-Wno-error=stringop-truncation"
+    "-Wno-error=stringop-overflow"
   ];
   NIX_LDFLAGS = "-lXext";
 
diff --git a/pkgs/development/libraries/mlt/qt-5.nix b/pkgs/development/libraries/mlt/qt-5.nix
index f017e4452a6..0e3750df415 100644
--- a/pkgs/development/libraries/mlt/qt-5.nix
+++ b/pkgs/development/libraries/mlt/qt-5.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
 
   # mlt is unable to cope with our multi-prefix Qt build
   # because it does not use CMake or qmake.
-  NIX_CFLAGS_COMPILE = [ "-I${getDev qtsvg}/include/QtSvg" ];
+  NIX_CFLAGS_COMPILE = "-I${getDev qtsvg}/include/QtSvg";
 
   CXXFLAGS = "-std=c++11";
 
diff --git a/pkgs/development/libraries/mps/default.nix b/pkgs/development/libraries/mps/default.nix
index ec3b4e20147..8c1f3aea466 100644
--- a/pkgs/development/libraries/mps/default.nix
+++ b/pkgs/development/libraries/mps/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ sqlite ];
 
   # needed for 1.116.0 to build with gcc7
-  NIX_CFLAGS_COMPILE = [
+  NIX_CFLAGS_COMPILE = toString [
     "-Wno-implicit-fallthrough"
     "-Wno-error=clobbered"
     "-Wno-error=cast-function-type"
diff --git a/pkgs/development/libraries/nss/default.nix b/pkgs/development/libraries/nss/default.nix
index 7499750c1f0..df9c3260878 100644
--- a/pkgs/development/libraries/nss/default.nix
+++ b/pkgs/development/libraries/nss/default.nix
@@ -38,7 +38,7 @@ in stdenv.mkDerivation rec {
       ./ckpem.patch
     ];
 
-  patchFlags = "-p0";
+  patchFlags = [ "-p0" ];
 
   postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
     substituteInPlace nss/coreconf/Darwin.mk --replace '@executable_path/$(notdir $@)' "$out/lib/\$(notdir \$@)"
diff --git a/pkgs/development/libraries/ntrack/default.nix b/pkgs/development/libraries/ntrack/default.nix
index b79f940affa..803906b1343 100644
--- a/pkgs/development/libraries/ntrack/default.nix
+++ b/pkgs/development/libraries/ntrack/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig python ];
 
   # error: ISO C does not support '__FUNCTION__' predefined identifier [-Werror=pedantic]
-  NIX_CFLAGS_COMPILE = [ "-Wno-error" ];
+  NIX_CFLAGS_COMPILE = "-Wno-error";
 
   configureFlags = [ "--without-gobject" "CFLAGS=--std=gnu99" ];
 
diff --git a/pkgs/development/libraries/ois/default.nix b/pkgs/development/libraries/ois/default.nix
index 15e83cf9d76..c1b065dbf2b 100644
--- a/pkgs/development/libraries/ois/default.nix
+++ b/pkgs/development/libraries/ois/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  patchFlags = "-p0";
+  patchFlags = [ "-p0" ];
 
   buildInputs = [
     autoconf automake libtool libX11 xorgproto libXi libXaw
diff --git a/pkgs/development/libraries/olm/default.nix b/pkgs/development/libraries/olm/default.nix
index 224c01e2c50..8fbdf28965b 100644
--- a/pkgs/development/libraries/olm/default.nix
+++ b/pkgs/development/libraries/olm/default.nix
@@ -15,9 +15,11 @@ stdenv.mkDerivation rec {
   # requires optimisation but memory operations are compiled with -O0
   hardeningDisable = ["fortify"];
 
-  makeFlags = if stdenv.cc.isClang then [ "CC=cc" ] else null;
+  makeFlags = stdenv.lib.optional stdenv.cc.isClang "CC=cc";
 
-  installFlags = "PREFIX=$(out)";
+  installFlags = [
+    "PREFIX=${placeholder ''out''}"
+  ];
 
   meta = {
     description = "Implements double cryptographic ratchet and Megolm ratchet";
diff --git a/pkgs/development/libraries/oniguruma/default.nix b/pkgs/development/libraries/oniguruma/default.nix
index e9041993657..e4cbfc7f0b4 100644
--- a/pkgs/development/libraries/oniguruma/default.nix
+++ b/pkgs/development/libraries/oniguruma/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "onig";
-  version = "6.9.3";
+  version = "6.9.4";
 
   src = fetchFromGitHub {
     owner = "kkos";
     repo = "oniguruma";
     rev = "v${version}";
-    sha256 = "0wzmqpjmxpryk83acbyhl9gwgm43ixbwraga2g5li9kx88mv4k0n";
+    sha256 = "11imbhj4p5w8lvrmcczccm1zq014h9j85r51z2ibb8jhf5p3lslh";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/opae/default.nix b/pkgs/development/libraries/opae/default.nix
index 32b13115957..46b03720d16 100644
--- a/pkgs/development/libraries/opae/default.nix
+++ b/pkgs/development/libraries/opae/default.nix
@@ -20,6 +20,11 @@ stdenv.mkDerivation rec {
 
   doCheck = false;
 
+  NIX_CFLAGS_COMPILE = [
+    "-Wno-error=format-truncation"
+    "-Wno-error=address-of-packed-member"
+  ];
+
   nativeBuildInputs = [ cmake doxygen perl python2Packages.sphinx ];
   buildInputs = [ libuuid json_c python2 ];
 
diff --git a/pkgs/development/libraries/opal/default.nix b/pkgs/development/libraries/opal/default.nix
deleted file mode 100644
index dd19fccd822..00000000000
--- a/pkgs/development/libraries/opal/default.nix
+++ /dev/null
@@ -1,43 +0,0 @@
-{ stdenv, fetchurl, pkgconfig, ptlib, srtp, libtheora, speex, gnome3
-, ffmpeg, x264, cyrus_sasl, openldap, openssl, expat, unixODBC }:
-
-stdenv.mkDerivation rec {
-  pname = "opal";
-  version = "3.10.10";
-
-  src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "f208985003461b2743575eccac13ad890b3e5baac35b68ddef17162460aff864";
-  };
-
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ ptlib srtp libtheora speex
-                  ffmpeg x264 cyrus_sasl openldap openssl expat unixODBC ];
-  propagatedBuildInputs = [ speex ];
-
-  configureFlags = [ "--enable-h323" ];
-
-  enableParallelBuilding = true;
-
-  NIX_CFLAGS_COMPILE = "-D__STDC_CONSTANT_MACROS=1 -std=gnu++98";
-
-  patches = [ ./disable-samples-ftbfs.diff ./libav9.patch ./libav10.patch ];
-
-  meta = with stdenv.lib; {
-    description = "VoIP library";
-    maintainers = [ maintainers.raskin ];
-    platforms = platforms.linux;
-    homepage = "http://www.opalvoip.org/";
-    license = with licenses; [ bsdOriginal mpl10 gpl2Plus lgpl21 ];
-  };
-
-  passthru = {
-    updateInfo = {
-      downloadPage = "http://ftp.gnome.org/pub/GNOME/sources/opal";
-    };
-    updateScript = gnome3.updateScript {
-      packageName = pname;
-    };
-  };
-}
-
diff --git a/pkgs/development/libraries/opal/disable-samples-ftbfs.diff b/pkgs/development/libraries/opal/disable-samples-ftbfs.diff
deleted file mode 100644
index 1b073821607..00000000000
--- a/pkgs/development/libraries/opal/disable-samples-ftbfs.diff
+++ /dev/null
@@ -1,14 +0,0 @@
-Index: opal-3.10.4~dfsg/Makefile.in
-===================================================================
---- opal-3.10.4~dfsg.orig/Makefile.in	2012-02-22 10:08:36.000000000 +1100
-+++ opal-3.10.4~dfsg/Makefile.in	2012-03-08 08:32:44.000000000 +1100
-@@ -45,8 +45,7 @@
-            samples/codectest \
-            samples/callgen \
-            samples/opalecho \
--           samples/faxopal \
--           samples/c_api
-+           samples/faxopal 
- ifeq ($(OPAL_IVR),yes)
- SUBDIRS += samples/opalmcu \
-            samples/ivropal \
diff --git a/pkgs/development/libraries/opal/libav10.patch b/pkgs/development/libraries/opal/libav10.patch
deleted file mode 100644
index 3e02704f899..00000000000
--- a/pkgs/development/libraries/opal/libav10.patch
+++ /dev/null
@@ -1,208 +0,0 @@
-Description: Fix compilation against libav10 
-Author: Reinhard Tartler <siretart@tauware.de>
-Bug-Debian: http://bugs.debian.org/739439
-
---- a/plugins/video/H.263-1998/h263-1998.cxx
-+++ b/plugins/video/H.263-1998/h263-1998.cxx
-@@ -94,7 +94,7 @@ static struct StdSizes {
-   { CIF16_WIDTH, CIF16_HEIGHT, PLUGINCODEC_CIF16_MPI },
- };
- 
--static FFMPEGLibrary FFMPEGLibraryInstance(CODEC_ID_H263P);
-+static FFMPEGLibrary FFMPEGLibraryInstance(AV_CODEC_ID_H263P);
- 
- 
- /////////////////////////////////////////////////////////////////////////////
-@@ -203,7 +203,7 @@ H263_Base_EncoderContext::~H263_Base_Enc
-   PTRACE(4, m_prefix, "Encoder closed");
- }
- 
--bool H263_Base_EncoderContext::Init(CodecID codecId)
-+bool H263_Base_EncoderContext::Init(AVCodecID codecId)
- {
-   PTRACE(5, m_prefix, "Opening encoder");
- 
-@@ -589,7 +589,7 @@ void H263_RFC2190_EncoderContext::RTPCal
- 
- bool H263_RFC2190_EncoderContext::Init()
- {
--  if (!H263_Base_EncoderContext::Init(CODEC_ID_H263))
-+  if (!H263_Base_EncoderContext::Init(AV_CODEC_ID_H263))
-     return false;
- 
- #if LIBAVCODEC_RTP_MODE
-@@ -632,7 +632,7 @@ H263_RFC2429_EncoderContext::~H263_RFC24
- 
- bool H263_RFC2429_EncoderContext::Init()
- {
--  return H263_Base_EncoderContext::Init(CODEC_ID_H263P);
-+  return H263_Base_EncoderContext::Init(AV_CODEC_ID_H263P);
- }
- 
- 
-@@ -656,7 +656,7 @@ H263_Base_DecoderContext::H263_Base_Deco
-   if (!FFMPEGLibraryInstance.Load())
-     return;
- 
--  if ((m_codec = FFMPEGLibraryInstance.AvcodecFindDecoder(CODEC_ID_H263)) == NULL) {
-+  if ((m_codec = FFMPEGLibraryInstance.AvcodecFindDecoder(AV_CODEC_ID_H263)) == NULL) {
-     PTRACE(1, m_prefix, "Codec not found for decoder");
-     return;
-   }
---- a/plugins/video/H.264/h264-x264.cxx
-+++ b/plugins/video/H.264/h264-x264.cxx
-@@ -105,7 +105,7 @@ static struct PluginCodec_information Li
- 
- ///////////////////////////////////////////////////////////////////////////////
- 
--FFMPEGLibrary FFMPEGLibraryInstance(CODEC_ID_H264);
-+FFMPEGLibrary FFMPEGLibraryInstance(AV_CODEC_ID_H264);
- 
- PLUGINCODEC_CONTROL_LOG_FUNCTION_DEF
- 
-@@ -1065,17 +1065,17 @@ class MyDecoder : public PluginCodec<MY_
-          allows you to fail the create operation (return false), which cannot
-          be done in the normal C++ constructor. */
- 
--      if ((m_codec = FFMPEGLibraryInstance.AvcodecFindDecoder(CODEC_ID_H264)) == NULL)
-+      if ((m_codec = FFMPEGLibraryInstance.AvcodecFindDecoder(AV_CODEC_ID_H264)) == NULL)
-         return false;
- 
-       if ((m_context = FFMPEGLibraryInstance.AvcodecAllocContext(m_codec)) == NULL)
-         return false;
- 
-       m_context->workaround_bugs = FF_BUG_AUTODETECT;
--      m_context->idct_algo = FF_IDCT_H264;
-+      m_context->idct_algo = FF_IDCT_AUTO;
-       m_context->error_concealment = FF_EC_GUESS_MVS | FF_EC_DEBLOCK;
-       m_context->flags = CODEC_FLAG_INPUT_PRESERVED | CODEC_FLAG_EMU_EDGE;
--      m_context->flags2 = CODEC_FLAG2_SKIP_RD |
-+      m_context->flags2 = 
- #ifdef CODEC_FLAG2_DROP_FRAME_TIMECODE
-                           CODEC_FLAG2_DROP_FRAME_TIMECODE |
- #endif
---- a/plugins/video/MPEG4-ffmpeg/mpeg4.cxx
-+++ b/plugins/video/MPEG4-ffmpeg/mpeg4.cxx
-@@ -205,7 +205,7 @@ const static struct mpeg4_resolution {
-     { 0 }
- };
- 
--FFMPEGLibrary FFMPEGLibraryInstance(CODEC_ID_MPEG4);
-+FFMPEGLibrary FFMPEGLibraryInstance(AV_CODEC_ID_MPEG4);
- 
- 
- static bool mpeg4IsIframe (BYTE * frameBuffer, unsigned int frameLen )
-@@ -688,7 +688,7 @@ void MPEG4EncoderContext::ResizeEncoding
- 
- bool MPEG4EncoderContext::OpenCodec()
- {
--  if((m_avcodec = FFMPEGLibraryInstance.AvcodecFindEncoder(CODEC_ID_MPEG4)) == NULL){
-+  if((m_avcodec = FFMPEGLibraryInstance.AvcodecFindEncoder(AV_CODEC_ID_MPEG4)) == NULL){
-     PTRACE(1, "MPEG4", "Encoder not found");
-     return false;
-   }
-@@ -1390,7 +1390,7 @@ void MPEG4DecoderContext::ResizeDecoding
- 
- bool MPEG4DecoderContext::OpenCodec()
- {
--    if ((m_avcodec = FFMPEGLibraryInstance.AvcodecFindDecoder(CODEC_ID_MPEG4)) == NULL) {
-+    if ((m_avcodec = FFMPEGLibraryInstance.AvcodecFindDecoder(AV_CODEC_ID_MPEG4)) == NULL) {
-         PTRACE(1, "MPEG4", "Decoder not found for encoder");
-         return false;
-     }
---- a/plugins/video/H.263-1998/h263-1998.h
-+++ b/plugins/video/H.263-1998/h263-1998.h
-@@ -115,7 +115,7 @@ class H263_Base_EncoderContext
-     virtual ~H263_Base_EncoderContext();
- 
-     virtual bool Init() = 0;
--    virtual bool Init(CodecID codecId);
-+    virtual bool Init(AVCodecID codecId);
- 
-     virtual bool SetOptions(const char * const * options);
-     virtual void SetOption(const char * option, const char * value);
---- a/plugins/video/common/dyna.cxx
-+++ b/plugins/video/common/dyna.cxx
-@@ -217,14 +217,14 @@ static void logCallbackFFMPEG(void * avc
- #endif
- 
- 
--FFMPEGLibrary::FFMPEGLibrary(CodecID codec)
-+FFMPEGLibrary::FFMPEGLibrary(AVCodecID codec)
- {
-   m_codec = codec;
--  if (m_codec==CODEC_ID_H264)
-+  if (m_codec==AV_CODEC_ID_H264)
-       snprintf( m_codecString, sizeof(m_codecString), "H264");
--  if (m_codec==CODEC_ID_H263P)
-+  if (m_codec==AV_CODEC_ID_H263P)
-       snprintf( m_codecString, sizeof(m_codecString), "H263+");
--  if (m_codec==CODEC_ID_MPEG4)
-+  if (m_codec==AV_CODEC_ID_MPEG4)
-       snprintf( m_codecString, sizeof(m_codecString), "MPEG4");
-   m_isLoadedOK = false;
- }
-@@ -268,12 +268,12 @@ bool FFMPEGLibrary::Load()
-   return true;
- }
- 
--AVCodec *FFMPEGLibrary::AvcodecFindEncoder(enum CodecID id)
-+AVCodec *FFMPEGLibrary::AvcodecFindEncoder(enum AVCodecID id)
- {
-   return avcodec_find_encoder(id);
- }
- 
--AVCodec *FFMPEGLibrary::AvcodecFindDecoder(enum CodecID id)
-+AVCodec *FFMPEGLibrary::AvcodecFindDecoder(enum AVCodecID id)
- {
-   WaitAndSignal m(processLock);
- 
-@@ -308,13 +308,18 @@ int FFMPEGLibrary::AvcodecClose(AVCodecC
-   return avcodec_close(ctx);
- }
- 
-+#undef  FFMAX
-+#define FFMAX(a,b) ((a) > (b) ? (a) : (b)) 
- int FFMPEGLibrary::AvcodecEncodeVideo(AVCodecContext *ctx, BYTE *buf, int buf_size, const AVFrame *pict)
- {
-+  AVPacket pkt = { 0 };
-+  int ret, got_output;
-   int res;
- 
--  res = avcodec_encode_video(ctx, buf, buf_size, pict);
-+  ret = avcodec_encode_video2(ctx, &pkt, pict, &got_output);
- 
--  PTRACE(6, m_codecString, "DYNA\tEncoded into " << res << " bytes, max " << buf_size);
-+  PTRACE(6, m_codecString, "DYNA\tEncoded into " << ret << " bytes, max " << buf_size);
-+  memcpy(buf, pkt.data, FFMAX(pkt.size, buf_size));
-   return res;
- }
- 
---- a/plugins/video/common/dyna.h
-+++ b/plugins/video/common/dyna.h
-@@ -88,13 +88,13 @@ class DynaLink
- class FFMPEGLibrary 
- {
-   public:
--    FFMPEGLibrary(CodecID codec);
-+    FFMPEGLibrary(AVCodecID codec);
-     ~FFMPEGLibrary();
- 
-     bool Load();
- 
--    AVCodec *AvcodecFindEncoder(enum CodecID id);
--    AVCodec *AvcodecFindDecoder(enum CodecID id);
-+    AVCodec *AvcodecFindEncoder(enum AVCodecID id);
-+    AVCodec *AvcodecFindDecoder(enum AVCodecID id);
-     AVCodecContext *AvcodecAllocContext(AVCodec*);
-     AVFrame *AvcodecAllocFrame(void);
-     int AvcodecOpen(AVCodecContext *ctx, AVCodec *codec);
-@@ -117,7 +117,7 @@ class FFMPEGLibrary
-     DynaLink m_libAvcodec;
-     DynaLink m_libAvutil;
- 
--    CodecID m_codec;
-+    AVCodecID m_codec;
-     char m_codecString[32];
- 
-     bool m_isLoadedOK;
diff --git a/pkgs/development/libraries/opal/libav9.patch b/pkgs/development/libraries/opal/libav9.patch
deleted file mode 100644
index f91a8c033fe..00000000000
--- a/pkgs/development/libraries/opal/libav9.patch
+++ /dev/null
@@ -1,543 +0,0 @@
-Description: Backport changes for the libav 9 API
- Also replace loading of libavcodec and libavutil via dlopen by linking against
- it.
-Author: Sebastian Ramacher <sramacher@debian.org>
-Bug-Debian: http://bugs.debian.org/720824
-Last-Update: 2013-09-12
-
---- a/plugins/video/H.263-1998/h263-1998.cxx
-+++ b/plugins/video/H.263-1998/h263-1998.cxx
-@@ -216,7 +216,7 @@
-     return false;
-   }
- 
--  m_context = FFMPEGLibraryInstance.AvcodecAllocContext();
-+  m_context = FFMPEGLibraryInstance.AvcodecAllocContext(m_codec);
-   if (m_context == NULL) {
-     PTRACE(1, m_prefix, "Failed to allocate context for encoder");
-     return false;
-@@ -312,6 +312,7 @@
-     return;
-   }
- 
-+#ifdef CODEC_FLAG_H263P_UMV
-   if (STRCMPI(option, H263_ANNEX_D) == 0) {
-     // Annex D: Unrestructed Motion Vectors
-     // Level 2+ 
-@@ -322,6 +323,7 @@
-       m_context->flags &= ~CODEC_FLAG_H263P_UMV; 
-     return;
-   }
-+#endif
- 
- #if 0 // DO NOT ENABLE THIS FLAG. FFMPEG IS NOT THREAD_SAFE WHEN THIS FLAG IS SET
-   if (STRCMPI(option, H263_ANNEX_F) == 0) {
-@@ -356,6 +358,7 @@
-     return;
-   }
- 
-+#ifdef CODEC_FLAG_H263P_SLICE_STRUCT
-   if (STRCMPI(option, H263_ANNEX_K) == 0) {
-     // Annex K: Slice Structure
-     // does not work with eyeBeam
-@@ -365,7 +368,9 @@
-       m_context->flags &= ~CODEC_FLAG_H263P_SLICE_STRUCT; 
-     return;
-   }
-+#endif
- 
-+#ifdef CODEC_FLAG_H263P_AIV
-   if (STRCMPI(option, H263_ANNEX_S) == 0) {
-     // Annex S: Alternative INTER VLC mode
-     // does not work with eyeBeam
-@@ -375,6 +380,7 @@
-       m_context->flags &= ~CODEC_FLAG_H263P_AIV; 
-     return;
-   }
-+#endif
- 
-   if (STRCMPI(option, PLUGINCODEC_MEDIA_PACKETIZATION) == 0 ||
-       STRCMPI(option, PLUGINCODEC_MEDIA_PACKETIZATIONS) == 0) {
-@@ -450,15 +456,6 @@
-   PTRACE(5, m_prefix, "qmax set to " << m_context->qmax);
-   PTRACE(5, m_prefix, "payload size set to " << m_context->rtp_payload_size);
- 
--  #define CODEC_TRACER_FLAG(tracer, flag) \
--    PTRACE(4, m_prefix, #flag " is " << ((m_context->flags & flag) ? "enabled" : "disabled"));
--  CODEC_TRACER_FLAG(tracer, CODEC_FLAG_H263P_UMV);
--  CODEC_TRACER_FLAG(tracer, CODEC_FLAG_OBMC);
--  CODEC_TRACER_FLAG(tracer, CODEC_FLAG_AC_PRED);
--  CODEC_TRACER_FLAG(tracer, CODEC_FLAG_H263P_SLICE_STRUCT)
--  CODEC_TRACER_FLAG(tracer, CODEC_FLAG_LOOP_FILTER);
--  CODEC_TRACER_FLAG(tracer, CODEC_FLAG_H263P_AIV);
--
-   return FFMPEGLibraryInstance.AvcodecOpen(m_context, m_codec) == 0;
- }
- 
-@@ -521,7 +518,7 @@
- 
-     // Need to copy to local buffer to guarantee 16 byte alignment
-     memcpy(m_inputFrame->data[0], OPAL_VIDEO_FRAME_DATA_PTR(header), header->width*header->height*3/2);
--    m_inputFrame->pict_type = (flags & PluginCodec_CoderForceIFrame) ? FF_I_TYPE : AV_PICTURE_TYPE_NONE;
-+    m_inputFrame->pict_type = (flags & PluginCodec_CoderForceIFrame) ? AV_PICTURE_TYPE_I : AV_PICTURE_TYPE_NONE;
- 
-     /*
-     m_inputFrame->pts = (int64_t)srcRTP.GetTimestamp()*m_context->time_base.den/m_context->time_base.num/VIDEO_CLOCKRATE;
-@@ -603,13 +600,19 @@
-   m_context->rtp_callback = &H263_RFC2190_EncoderContext::RTPCallBack;
-   m_context->opaque = this; // used to separate out packets from different encode threads
- 
-+#ifdef CODEC_FLAG_H263P_UMV
-   m_context->flags &= ~CODEC_FLAG_H263P_UMV;
-+#endif
-   m_context->flags &= ~CODEC_FLAG_4MV;
- #if LIBAVCODEC_RTP_MODE
-   m_context->flags &= ~CODEC_FLAG_H263P_AIC;
- #endif
-+#ifdef CODEC_FLAG_H263P_AIV
-   m_context->flags &= ~CODEC_FLAG_H263P_AIV;
-+#endif
-+#ifdef CODEC_FLAG_H263P_SLICE_STRUCT
-   m_context->flags &= ~CODEC_FLAG_H263P_SLICE_STRUCT;
-+#endif
- 
-   return true;
- }
-@@ -658,7 +661,7 @@
-     return;
-   }
- 
--  m_context = FFMPEGLibraryInstance.AvcodecAllocContext();
-+  m_context = FFMPEGLibraryInstance.AvcodecAllocContext(m_codec);
-   if (m_context == NULL) {
-     PTRACE(1, m_prefix, "Failed to allocate context for decoder");
-     return;
---- a/plugins/video/H.264/h264-x264.cxx
-+++ b/plugins/video/H.264/h264-x264.cxx
-@@ -48,6 +48,7 @@
- #include "shared/h264frame.h"
- #include "shared/x264wrap.h"
- 
-+#include <cstdio>
- 
- #define MY_CODEC      x264                                  // Name of codec (use C variable characters)
- #define MY_CODEC_LOG "x264"
-@@ -1067,18 +1068,17 @@
-       if ((m_codec = FFMPEGLibraryInstance.AvcodecFindDecoder(CODEC_ID_H264)) == NULL)
-         return false;
- 
--      if ((m_context = FFMPEGLibraryInstance.AvcodecAllocContext()) == NULL)
-+      if ((m_context = FFMPEGLibraryInstance.AvcodecAllocContext(m_codec)) == NULL)
-         return false;
- 
-       m_context->workaround_bugs = FF_BUG_AUTODETECT;
--      m_context->error_recognition = FF_ER_AGGRESSIVE;
-       m_context->idct_algo = FF_IDCT_H264;
-       m_context->error_concealment = FF_EC_GUESS_MVS | FF_EC_DEBLOCK;
-       m_context->flags = CODEC_FLAG_INPUT_PRESERVED | CODEC_FLAG_EMU_EDGE;
--      m_context->flags2 = CODEC_FLAG2_BRDO |
--                          CODEC_FLAG2_MEMC_ONLY |
-+      m_context->flags2 = CODEC_FLAG2_SKIP_RD |
-+#ifdef CODEC_FLAG2_DROP_FRAME_TIMECODE
-                           CODEC_FLAG2_DROP_FRAME_TIMECODE |
--                          CODEC_FLAG2_SKIP_RD |
-+#endif
-                           CODEC_FLAG2_CHUNKS;
- 
-       if ((m_picture = FFMPEGLibraryInstance.AvcodecAllocFrame()) == NULL)
---- a/plugins/video/MPEG4-ffmpeg/mpeg4.cxx
-+++ b/plugins/video/MPEG4-ffmpeg/mpeg4.cxx
-@@ -589,17 +589,14 @@
-     m_avpicture->quality = m_videoQMin;
- 
- #ifdef USE_ORIG
--    m_avcontext->flags |= CODEC_FLAG_PART;   // data partitioning
-     m_avcontext->flags |= CODEC_FLAG_4MV;    // 4 motion vectors
- #else
-     m_avcontext->max_b_frames=0; /*don't use b frames*/
-     m_avcontext->flags|=CODEC_FLAG_AC_PRED;
--    m_avcontext->flags|=CODEC_FLAG_H263P_UMV;
-     /*c->flags|=CODEC_FLAG_QPEL;*/ /*don't enable this one: this forces profile_level to advanced simple profile */
-     m_avcontext->flags|=CODEC_FLAG_4MV;
-     m_avcontext->flags|=CODEC_FLAG_GMC;
-     m_avcontext->flags|=CODEC_FLAG_LOOP_FILTER;
--    m_avcontext->flags|=CODEC_FLAG_H263P_SLICE_STRUCT;
- #endif
-     m_avcontext->opaque = this;              // for use in RTP callback
- }
-@@ -691,7 +688,12 @@
- 
- bool MPEG4EncoderContext::OpenCodec()
- {
--  m_avcontext = FFMPEGLibraryInstance.AvcodecAllocContext();
-+  if((m_avcodec = FFMPEGLibraryInstance.AvcodecFindEncoder(CODEC_ID_MPEG4)) == NULL){
-+    PTRACE(1, "MPEG4", "Encoder not found");
-+    return false;
-+  }
-+
-+  m_avcontext = FFMPEGLibraryInstance.AvcodecAllocContext(m_avcodec);
-   if (m_avcontext == NULL) {
-     PTRACE(1, "MPEG4", "Encoder failed to allocate context for encoder");
-     return false;
-@@ -703,11 +705,6 @@
-     return false;
-   }
- 
--  if((m_avcodec = FFMPEGLibraryInstance.AvcodecFindEncoder(CODEC_ID_MPEG4)) == NULL){
--    PTRACE(1, "MPEG4", "Encoder not found");
--    return false;
--  }
--
- #if PLUGINCODEC_TRACING
-   // debugging flags
-   if (PTRACE_CHECK(4)) {
-@@ -804,7 +801,7 @@
-         // Should the next frame be an I-Frame?
-         if ((flags & PluginCodec_CoderForceIFrame) || (m_frameNum == 0))
-         {
--            m_avpicture->pict_type = FF_I_TYPE;
-+            m_avpicture->pict_type = AV_PICTURE_TYPE_I;
-         }
-         else // No IFrame requested, let avcodec decide what to do
-         {
-@@ -1325,7 +1322,6 @@
- 
- void MPEG4DecoderContext::SetStaticDecodingParams() {
-     m_avcontext->flags |= CODEC_FLAG_4MV; 
--    m_avcontext->flags |= CODEC_FLAG_PART;
-     m_avcontext->workaround_bugs = 0; // no workaround for buggy implementations
- }
- 
-@@ -1399,7 +1395,7 @@
-         return false;
-     }
-         
--    m_avcontext = FFMPEGLibraryInstance.AvcodecAllocContext();
-+    m_avcontext = FFMPEGLibraryInstance.AvcodecAllocContext(m_avcodec);
-     if (m_avcontext == NULL) {
-         PTRACE(1, "MPEG4", "Decoder failed to allocate context");
-         return false;
---- a/plugins/video/common/dyna.cxx
-+++ b/plugins/video/common/dyna.cxx
-@@ -38,6 +38,13 @@
-  *                 Matthias Schneider (ma30002000@yahoo.de)
-  */
- #include "dyna.h"
-+#include <cstdio>
-+#include <cstdarg>
-+
-+extern "C" {
-+#include <libavcodec/avcodec.h>
-+#include <libavutil/mem.h>
-+}
- 
- bool DynaLink::Open(const char *name)
- {
-@@ -228,101 +235,15 @@
-   m_libAvutil.Close();
- }
- 
--#define CHECK_AVUTIL(name, func) \
--      (seperateLibAvutil ? \
--        m_libAvutil.GetFunction(name,  (DynaLink::Function &)func) : \
--        m_libAvcodec.GetFunction(name, (DynaLink::Function &)func) \
--       ) \
--
--
- bool FFMPEGLibrary::Load()
- {
-   WaitAndSignal m(processLock);
-   if (IsLoaded())
-     return true;
- 
--  bool seperateLibAvutil = false;
--
--#ifdef LIBAVCODEC_LIB_NAME
--  if (m_libAvcodec.Open(LIBAVCODEC_LIB_NAME))
--    seperateLibAvutil = true;
--  else
--#endif
--  if (m_libAvcodec.Open("libavcodec"))
--    seperateLibAvutil = false;
--  else if (m_libAvcodec.Open("avcodec-" AV_STRINGIFY(LIBAVCODEC_VERSION_MAJOR)))
--    seperateLibAvutil = true;
--  else {
--    PTRACE(1, m_codecString, "Failed to load FFMPEG libavcodec library");
--    return false;
--  }
--
--  if (seperateLibAvutil &&
--        !(
--#ifdef LIBAVUTIL_LIB_NAME
--          m_libAvutil.Open(LIBAVUTIL_LIB_NAME) ||
--#endif
--          m_libAvutil.Open("libavutil") ||
--          m_libAvutil.Open("avutil-" AV_STRINGIFY(LIBAVUTIL_VERSION_MAJOR))
--        ) ) {
--    PTRACE(1, m_codecString, "Failed to load FFMPEG libavutil library");
--    return false;
--  }
--
--  strcpy(m_libAvcodec.m_codecString, m_codecString);
--  strcpy(m_libAvutil.m_codecString,  m_codecString);
--
--  if (!m_libAvcodec.GetFunction("avcodec_init", (DynaLink::Function &)Favcodec_init))
--    return false;
--
--  if (!m_libAvcodec.GetFunction("av_init_packet", (DynaLink::Function &)Fav_init_packet))
--    return false;
--
--  if (!m_libAvcodec.GetFunction("avcodec_register_all", (DynaLink::Function &)Favcodec_register_all))
--    return false;
--
--  if (!m_libAvcodec.GetFunction("avcodec_find_encoder", (DynaLink::Function &)Favcodec_find_encoder))
--    return false;
--
--  if (!m_libAvcodec.GetFunction("avcodec_find_decoder", (DynaLink::Function &)Favcodec_find_decoder))
--    return false;
--
--  if (!m_libAvcodec.GetFunction("avcodec_alloc_context", (DynaLink::Function &)Favcodec_alloc_context))
--    return false;
--
--  if (!m_libAvcodec.GetFunction("avcodec_alloc_frame", (DynaLink::Function &)Favcodec_alloc_frame))
--    return false;
--
--  if (!m_libAvcodec.GetFunction("avcodec_open", (DynaLink::Function &)Favcodec_open))
--    return false;
--
--  if (!m_libAvcodec.GetFunction("avcodec_close", (DynaLink::Function &)Favcodec_close))
--    return false;
--
--  if (!m_libAvcodec.GetFunction("avcodec_encode_video", (DynaLink::Function &)Favcodec_encode_video))
--    return false;
--
--  if (!m_libAvcodec.GetFunction("avcodec_decode_video2", (DynaLink::Function &)Favcodec_decode_video))
--    return false;
--
--  if (!m_libAvcodec.GetFunction("avcodec_set_dimensions", (DynaLink::Function &)Favcodec_set_dimensions))
--    return false;
--
--  if (!CHECK_AVUTIL("av_free", Favcodec_free))
--    return false;
--
--  if(!m_libAvcodec.GetFunction("avcodec_version", (DynaLink::Function &)Favcodec_version))
--    return false;
--
--  if (!CHECK_AVUTIL("av_log_set_level", FAv_log_set_level))
--    return false;
--
--  if (!CHECK_AVUTIL("av_log_set_callback", FAv_log_set_callback))
--    return false;
--
-   // must be called before using avcodec lib
- 
--  unsigned libVer = Favcodec_version();
-+  unsigned libVer = avcodec_version();
-   if (libVer != LIBAVCODEC_VERSION_INT) {
-     PTRACE(2, m_codecString, "Warning: compiled against libavcodec headers from version "
-            << LIBAVCODEC_VERSION_MAJOR << '.' << LIBAVCODEC_VERSION_MINOR << '.' << LIBAVCODEC_VERSION_MICRO
-@@ -334,8 +255,7 @@
-            << (libVer >> 16) << ((libVer>>8) & 0xff) << (libVer & 0xff));
-   }
- 
--  Favcodec_init();
--  Favcodec_register_all ();
-+  avcodec_register_all();
- 
- #if PLUGINCODEC_TRACING
-   AvLogSetLevel(AV_LOG_DEBUG);
-@@ -350,49 +270,49 @@
- 
- AVCodec *FFMPEGLibrary::AvcodecFindEncoder(enum CodecID id)
- {
--  return Favcodec_find_encoder(id);
-+  return avcodec_find_encoder(id);
- }
- 
- AVCodec *FFMPEGLibrary::AvcodecFindDecoder(enum CodecID id)
- {
-   WaitAndSignal m(processLock);
- 
--  return Favcodec_find_decoder(id);
-+  return avcodec_find_decoder(id);
- }
- 
--AVCodecContext *FFMPEGLibrary::AvcodecAllocContext(void)
-+AVCodecContext *FFMPEGLibrary::AvcodecAllocContext(AVCodec *codec)
- {
-   WaitAndSignal m(processLock);
- 
--  return Favcodec_alloc_context();
-+  return avcodec_alloc_context3(codec);
- }
- 
- AVFrame *FFMPEGLibrary::AvcodecAllocFrame(void)
- {
-   WaitAndSignal m(processLock);
- 
--  return Favcodec_alloc_frame();
-+  return avcodec_alloc_frame();
- }
- 
- int FFMPEGLibrary::AvcodecOpen(AVCodecContext *ctx, AVCodec *codec)
- {
-   WaitAndSignal m(processLock);
- 
--  return Favcodec_open(ctx, codec);
-+  return avcodec_open2(ctx, codec, NULL);
- }
- 
- int FFMPEGLibrary::AvcodecClose(AVCodecContext *ctx)
- {
-   WaitAndSignal m(processLock);
- 
--  return Favcodec_close(ctx);
-+  return avcodec_close(ctx);
- }
- 
- int FFMPEGLibrary::AvcodecEncodeVideo(AVCodecContext *ctx, BYTE *buf, int buf_size, const AVFrame *pict)
- {
-   int res;
- 
--  res = Favcodec_encode_video(ctx, buf, buf_size, pict);
-+  res = avcodec_encode_video(ctx, buf, buf_size, pict);
- 
-   PTRACE(6, m_codecString, "DYNA\tEncoded into " << res << " bytes, max " << buf_size);
-   return res;
-@@ -401,35 +321,35 @@
- int FFMPEGLibrary::AvcodecDecodeVideo(AVCodecContext *ctx, AVFrame *pict, int *got_picture_ptr, BYTE *buf, int buf_size)
- {
-   AVPacket avpkt;
--  Fav_init_packet(&avpkt);
-+  av_init_packet(&avpkt);
-   avpkt.data = buf;
-   avpkt.size = buf_size;
- 
--  return Favcodec_decode_video(ctx, pict, got_picture_ptr, &avpkt);
-+  return avcodec_decode_video2(ctx, pict, got_picture_ptr, &avpkt);
- }
- 
- void FFMPEGLibrary::AvcodecFree(void * ptr)
- {
-   WaitAndSignal m(processLock);
- 
--  Favcodec_free(ptr);
-+  av_free(ptr);
- }
- 
- void FFMPEGLibrary::AvSetDimensions(AVCodecContext *s, int width, int height)
- {
-   WaitAndSignal m(processLock);
- 
--  Favcodec_set_dimensions(s, width, height);
-+  avcodec_set_dimensions(s, width, height);
- }
- 
- void FFMPEGLibrary::AvLogSetLevel(int level)
- {
--  FAv_log_set_level(level);
-+  av_log_set_level(level);
- }
- 
- void FFMPEGLibrary::AvLogSetCallback(void (*callback)(void*, int, const char*, va_list))
- {
--  FAv_log_set_callback(callback);
-+  av_log_set_callback(callback);
- }
- 
- bool FFMPEGLibrary::IsLoaded()
---- a/plugins/video/common/dyna.h
-+++ b/plugins/video/common/dyna.h
-@@ -95,7 +95,7 @@
- 
-     AVCodec *AvcodecFindEncoder(enum CodecID id);
-     AVCodec *AvcodecFindDecoder(enum CodecID id);
--    AVCodecContext *AvcodecAllocContext(void);
-+    AVCodecContext *AvcodecAllocContext(AVCodec*);
-     AVFrame *AvcodecAllocFrame(void);
-     int AvcodecOpen(AVCodecContext *ctx, AVCodec *codec);
-     int AvcodecClose(AVCodecContext *ctx);
-@@ -120,26 +120,6 @@
-     CodecID m_codec;
-     char m_codecString[32];
- 
--    void (*Favcodec_init)(void);
--    void (*Fav_init_packet)(AVPacket *pkt);
--
--    void (*Favcodec_register_all)(void);
--    AVCodec *(*Favcodec_find_encoder)(enum CodecID id);
--    AVCodec *(*Favcodec_find_decoder)(enum CodecID id);
--    AVCodecContext *(*Favcodec_alloc_context)(void);
--    AVFrame *(*Favcodec_alloc_frame)(void);
--    int (*Favcodec_open)(AVCodecContext *ctx, AVCodec *codec);
--    int (*Favcodec_close)(AVCodecContext *ctx);
--    int (*Favcodec_encode_video)(AVCodecContext *ctx, BYTE *buf, int buf_size, const AVFrame *pict);
--    int (*Favcodec_decode_video)(AVCodecContext *ctx, AVFrame *pict, int *got_picture_ptr, AVPacket *avpkt);
--    unsigned (*Favcodec_version)(void);
--    void (*Favcodec_set_dimensions)(AVCodecContext *ctx, int width, int height);
--
--    void (*Favcodec_free)(void *);
--
--    void (*FAv_log_set_level)(int level);
--    void (*FAv_log_set_callback)(void (*callback)(void*, int, const char*, va_list));
--
-     bool m_isLoadedOK;
- };
- 
---- a/plugins/video/common/ffmpeg.h
-+++ b/plugins/video/common/ffmpeg.h
-@@ -45,11 +45,13 @@
- 
- #include "platform.h"
- 
--#include "libavcodec/avcodec.h"
-+extern "C" {
-+#include <libavcodec/avcodec.h>
- // AVPacket was declared in avformat.h before April 2009
- #if LIBAVCODEC_VERSION_INT <= AV_VERSION_INT(52, 25, 0)
--#include "libavformat/avformat.h"
-+#include <libavformat/avformat.h>
- #endif
-+}
- 
- #ifndef LIBAVCODEC_VERSION_INT
- #error Libavcodec include is not correct
---- a/plugins/video/H.263-1998/Makefile.in
-+++ b/plugins/video/H.263-1998/Makefile.in
-@@ -34,8 +34,8 @@
-              $(COMMONDIR)/mpi.cxx \
-              $(COMMONDIR)/dyna.cxx
- 
--CFLAGS += @LIBAVCODEC_CFLAGS@ -I$(COMMONDIR)
--LIBS   += @DL_LIBS@
-+CFLAGS += @LIBAVCODEC_CFLAGS@ @LIBAVUTIL_CFLAGS@ -I$(COMMONDIR)
-+LIBS   += @DL_LIBS@ @LIBAVCODEC_LIBS@ @LIBAVUTIL_LIBS@
- 
- HAVE_LIBAVCODEC_RTP_MODE=@HAVE_LIBAVCODEC_RTP_MODE@
- ifeq ($(HAVE_LIBAVCODEC_RTP_MODE),yes)
---- a/plugins/video/H.264/Makefile.in
-+++ b/plugins/video/H.264/Makefile.in
-@@ -34,8 +34,8 @@
-            $(SHAREDDIR)/x264wrap.cxx \
-            $(COMMONDIR)/dyna.cxx \
- 
--CFLAGS += @LIBAVCODEC_CFLAGS@ -I$(COMMONDIR) -DLIB_DIR='"$(libdir)"' -DVC_PLUGIN_DIR='"@VC_PLUGIN_DIR@"'
--LIBS   += @DL_LIBS@
-+CFLAGS += @LIBAVCODEC_CFLAGS@ @LIBAVUTIL_CFLAGS@ -I$(COMMONDIR) -DLIB_DIR='"$(libdir)"' -DVC_PLUGIN_DIR='"@VC_PLUGIN_DIR@"'
-+LIBS   += @DL_LIBS@ @LIBAVCODEC_LIBS@ @LIBAVUTIL_LIBS@
- 
- IS_H264_LICENSED:=@IS_H264_LICENSED@
- ifeq ($(IS_H264_LICENSED),yes)
---- a/plugins/video/MPEG4-ffmpeg/Makefile.in
-+++ b/plugins/video/MPEG4-ffmpeg/Makefile.in
-@@ -30,8 +30,8 @@
- SRCDIR    := .
- SRCS      := mpeg4.cxx $(COMMONDIR)/dyna.cxx
- 
--CFLAGS += @LIBAVCODEC_CFLAGS@ -I$(COMMONDIR)
--LIBS   += @DL_LIBS@
-+CFLAGS += @LIBAVCODEC_CFLAGS@ @LIBAVUTIL_CFLAGS@ -I$(COMMONDIR)
-+LIBS   += @DL_LIBS@ @LIBAVCODEC_LIBS@ @LIBAVUTIL_LIBS@
- 
- # Add LIBAVCODEC_SOURCE_DIR to the include path so we can #include <libavcodec/...h>
- # Also add libavutil, so ffmpeg headers can #include "log.h".
diff --git a/pkgs/development/libraries/openal-soft/default.nix b/pkgs/development/libraries/openal-soft/default.nix
index 76f2861428d..20528ac9284 100644
--- a/pkgs/development/libraries/openal-soft/default.nix
+++ b/pkgs/development/libraries/openal-soft/default.nix
@@ -35,9 +35,9 @@ stdenv.mkDerivation rec {
     ++ optional pulseSupport libpulseaudio
     ++ optionals stdenv.isDarwin [ CoreServices AudioUnit AudioToolbox ];
 
-  NIX_LDFLAGS = []
+  NIX_LDFLAGS = toString ([]
     ++ optional alsaSupport "-lasound"
-    ++ optional pulseSupport "-lpulse";
+    ++ optional pulseSupport "-lpulse");
 
   meta = {
     description = "OpenAL alternative";
diff --git a/pkgs/development/libraries/opencv/3.x.nix b/pkgs/development/libraries/opencv/3.x.nix
index 97df84637ef..642facf166a 100644
--- a/pkgs/development/libraries/opencv/3.x.nix
+++ b/pkgs/development/libraries/opencv/3.x.nix
@@ -208,7 +208,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ cmake pkgconfig unzip ];
 
-  NIX_CFLAGS_COMPILE = lib.optional enableEXR "-I${ilmbase.dev}/include/OpenEXR";
+  NIX_CFLAGS_COMPILE = lib.optionalString enableEXR "-I${ilmbase.dev}/include/OpenEXR";
 
   # Configure can't find the library without this.
   OpenBLAS_HOME = lib.optionalString enableOpenblas openblas;
diff --git a/pkgs/development/libraries/opencv/4.x.nix b/pkgs/development/libraries/opencv/4.x.nix
index 408368b89c4..9fffd3d9477 100644
--- a/pkgs/development/libraries/opencv/4.x.nix
+++ b/pkgs/development/libraries/opencv/4.x.nix
@@ -221,7 +221,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ cmake pkgconfig unzip ];
 
-  NIX_CFLAGS_COMPILE = lib.optional enableEXR "-I${ilmbase.dev}/include/OpenEXR";
+  NIX_CFLAGS_COMPILE = lib.optionalString enableEXR "-I${ilmbase.dev}/include/OpenEXR";
 
   # Configure can't find the library without this.
   OpenBLAS_HOME = lib.optionalString enableOpenblas openblas;
diff --git a/pkgs/development/libraries/opencv/default.nix b/pkgs/development/libraries/opencv/default.nix
index db8a5e5a41b..ad27742d0b4 100644
--- a/pkgs/development/libraries/opencv/default.nix
+++ b/pkgs/development/libraries/opencv/default.nix
@@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake pkgconfig unzip ];
 
-  NIX_CFLAGS_COMPILE = lib.optional enableEXR "-I${ilmbase.dev}/include/OpenEXR";
+  NIX_CFLAGS_COMPILE = lib.optionalString enableEXR "-I${ilmbase.dev}/include/OpenEXR";
 
   cmakeFlags = [
     (opencvFlag "TIFF" enableTIFF)
diff --git a/pkgs/development/libraries/openvdb/default.nix b/pkgs/development/libraries/openvdb/default.nix
index 483b3d788e2..840da046170 100644
--- a/pkgs/development/libraries/openvdb/default.nix
+++ b/pkgs/development/libraries/openvdb/default.nix
@@ -20,21 +20,22 @@ stdenv.mkDerivation rec
     sourceRoot=$(echo */openvdb)
   '';
 
-  installTargets = "install_lib";
+  installTargets = [ "install_lib" ];
 
   enableParallelBuilding = true;
 
-  buildFlags = ''lib
-    DESTDIR=$(out)
-    HALF_LIB=-lHalf
-    TBB_LIB=-ltbb
-    BLOSC_LIB=-lblosc
-    LOG4CPLUS_LIB=
-    BLOSC_INCLUDE_DIR=${c-blosc}/include/
-    BLOSC_LIB_DIR=${c-blosc}/lib/
-  '';
-
-  installFlags = ''DESTDIR=$(out)'';
+  buildFlags = [
+    "lib"
+    "DESTDIR=$(out)"
+    "HALF_LIB=-lHalf"
+    "TBB_LIB=-ltbb"
+    "BLOSC_LIB=-lblosc"
+    "LOG4CPLUS_LIB="
+    "BLOSC_INCLUDE_DIR=${c-blosc}/include/"
+    "BLOSC_LIB_DIR=${c-blosc}/lib/"
+  ];
+
+  installFlags = [ "DESTDIR=$(out)" ];
 
   NIX_CFLAGS_COMPILE="-I${openexr.dev}/include/OpenEXR -I${ilmbase.dev}/include/OpenEXR/";
   NIX_LDFLAGS="-lboost_iostreams";
diff --git a/pkgs/development/libraries/ortp/default.nix b/pkgs/development/libraries/ortp/default.nix
index 7be0e4bb06a..68e890e3368 100644
--- a/pkgs/development/libraries/ortp/default.nix
+++ b/pkgs/development/libraries/ortp/default.nix
@@ -11,6 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "12cwv593bsdnxs0zfcp07vwyk7ghlz2wv7vdbs1ksv293w3vj2rv";
   };
 
+  NIX_CFLAGS_COMPILE = "-Wno-error=stringop-truncation";
+
   buildInputs = [ bctoolbox ];
   nativeBuildInputs = [ cmake ];
 
diff --git a/pkgs/development/libraries/phonon/backends/gstreamer.nix b/pkgs/development/libraries/phonon/backends/gstreamer.nix
index 20723322c1d..d79078c2836 100644
--- a/pkgs/development/libraries/phonon/backends/gstreamer.nix
+++ b/pkgs/development/libraries/phonon/backends/gstreamer.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
             gst-plugins-bad
             gst-libav
           ]);
-    in [
+    in toString [
       # This flag should be picked up through pkgconfig, but it isn't.
       "-I${gst_all_1.gstreamer.dev}/lib/gstreamer-1.0/include"
 
diff --git a/pkgs/development/libraries/physics/qcdnum/default.nix b/pkgs/development/libraries/physics/qcdnum/default.nix
index 8b002ce8195..e962303f5f0 100644
--- a/pkgs/development/libraries/physics/qcdnum/default.nix
+++ b/pkgs/development/libraries/physics/qcdnum/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "QCDNUM";
-  version = "17-01-13";
+  version = "17-01-15";
 
   src = fetchurl {
     url = "http://www.nikhef.nl/user/h24/qcdnum-files/download/qcdnum${builtins.replaceStrings ["-"] [""] version}.tar.gz";
-    sha256 = "0568rjviwvjkfihq2ka7g91vmialr31ryn7c69iqf13rcv5vzcw7";
+    sha256 = "0ibk1sppss45qh0g8i2c99alkx82xdbss3p55f5367bxjx4iqvvg";
   };
 
   nativeBuildInputs = [ gfortran ];
diff --git a/pkgs/development/libraries/portaudio/default.nix b/pkgs/development/libraries/portaudio/default.nix
index 92b56467aee..68daece490f 100644
--- a/pkgs/development/libraries/portaudio/default.nix
+++ b/pkgs/development/libraries/portaudio/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
   buildInputs = [ libjack2 ]
     ++ stdenv.lib.optional (!stdenv.isDarwin) alsaLib;
 
-  configureFlags = [ "--disable-mac-universal --enable-cxx" ];
+  configureFlags = [ "--disable-mac-universal" "--enable-cxx" ];
 
   NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-error=nullability-inferred-on-nested-type -Wno-error=nullability-completeness-on-arrays";
 
diff --git a/pkgs/development/libraries/prometheus-cpp/default.nix b/pkgs/development/libraries/prometheus-cpp/default.nix
index e238ca790be..624b23f4d60 100644
--- a/pkgs/development/libraries/prometheus-cpp/default.nix
+++ b/pkgs/development/libraries/prometheus-cpp/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     "-DBUILD_SHARED_LIBS=ON"
   ];
 
-  NIX_LDFLAGS = [ "-ldl" ];
+  NIX_LDFLAGS = "-ldl";
 
   meta = {
     description = "Prometheus Client Library for Modern C++";
diff --git a/pkgs/development/libraries/ptlib/default.nix b/pkgs/development/libraries/ptlib/default.nix
deleted file mode 100644
index e7abedf3121..00000000000
--- a/pkgs/development/libraries/ptlib/default.nix
+++ /dev/null
@@ -1,59 +0,0 @@
-{ stdenv, fetchurl, fetchpatch, pkgconfig, bison, flex, unixODBC, gnome3
-, openssl, openldap, cyrus_sasl, kerberos, expat, SDL, libdv, libv4l, alsaLib }:
-
-stdenv.mkDerivation rec {
-  pname = "ptlib";
-  version = "2.10.11";
-
-  src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1jf27mjz8vqnclhrhrpn7niz4c177kcjbd1hc7vn65ihcqfz05rs";
-  };
-
-  NIX_CFLAGS_COMPILE = "-std=gnu++98";
-
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ bison flex unixODBC openssl openldap
-                  cyrus_sasl kerberos expat SDL libdv libv4l alsaLib ];
-
-  enableParallelBuilding = true;
-
-  patches = [
-    (fetchpatch { url = http://sources.debian.net/data/main/p/ptlib/2.10.11~dfsg-2.1/debian/patches/bison-fix;
-      sha256 = "0vzv9kyn9s628z8wy2gva380gi1rmhxilwlg5pikl5a0wn8p46nw";
-    })
-    (fetchpatch { url = http://sources.debian.net/data/main/p/ptlib/2.10.11~dfsg-2.1/debian/patches/no-sslv3;
-      sha256 = "172s1dnnrl54p9sf1nl7s475sm78rpw3p8jxi0pdx6izzl8hcdr0";
-    })
-    (fetchpatch {
-      name = "openssl-1.1.patch";
-      url = "https://git.archlinux.org/svntogit/packages.git/plain/trunk/openssl-1.1.0.patch?h=packages/ptlib&id=1dfa9f55e7e030d261228fca27dda82979ca7f30";
-      sha256 = "11hdgyyibycg0wf5ls0wk9hksa4jd434i86xqiccbyg17n4l6lc1";
-    })
-    ./ptlib-2.10.11-glibc-2.26.patch
-  ];
-
-  # fix typedef clashes with unixODBC>=2.3.5
-  postPatch = ''
-    substituteInPlace include/ptlib/unix/ptlib/contain.h \
-      --replace "typedef uintptr_t    UINT" "typedef unsigned int    UINT" \
-      --replace "typedef wchar_t                 WCHAR" "typedef unsigned short          WCHAR"
-  '';
-
-  meta = with stdenv.lib; {
-    description = "Portable Tools from OPAL VoIP";
-    maintainers = [ maintainers.raskin ];
-    homepage = "http://www.opalvoip.org/";
-    platforms = platforms.linux;
-    license = with licenses; [ beerware bsdOriginal mpl10 ];
-  };
-
-  passthru = {
-    updateInfo = {
-      downloadPage = "http://ftp.gnome.org/sources/ptlib/";
-    };
-    updateScript = gnome3.updateScript {
-      packageName = pname;
-    };
-  };
-}
diff --git a/pkgs/development/libraries/ptlib/ptlib-2.10.11-glibc-2.26.patch b/pkgs/development/libraries/ptlib/ptlib-2.10.11-glibc-2.26.patch
deleted file mode 100644
index 300c3736abf..00000000000
--- a/pkgs/development/libraries/ptlib/ptlib-2.10.11-glibc-2.26.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/src/ptlib/unix/channel.cxx b/src/ptlib/unix/channel.cxx
-index 3b17dda..2dcaa18 100644
---- a/src/ptlib/unix/channel.cxx
-+++ b/src/ptlib/unix/channel.cxx
-@@ -36,7 +36,7 @@
- 
- #include <ptlib.h>
- #include <sys/ioctl.h>
--
-+#include <sys/uio.h>
- 
- #include "../common/pchannel.cxx"
- 
diff --git a/pkgs/development/libraries/qoauth/default.nix b/pkgs/development/libraries/qoauth/default.nix
index 0d9ae21e87e..83e904e53eb 100644
--- a/pkgs/development/libraries/qoauth/default.nix
+++ b/pkgs/development/libraries/qoauth/default.nix
@@ -18,8 +18,8 @@ stdenv.mkDerivation {
   buildInputs = [ qt5.qtbase qca2-qt5 ];
   nativeBuildInputs = [ qt5.qmake ];
 
-  NIX_CFLAGS_COMPILE = [ "-I${qca2-qt5}/include/Qca-qt5/QtCrypto" ];
-  NIX_LDFLAGS = [ "-lqca-qt5" ];
+  NIX_CFLAGS_COMPILE = "-I${qca2-qt5}/include/Qca-qt5/QtCrypto";
+  NIX_LDFLAGS = "-lqca-qt5";
 
   meta = with stdenv.lib; {
     description = "Qt library for OAuth authentication";
diff --git a/pkgs/development/libraries/qrupdate/default.nix b/pkgs/development/libraries/qrupdate/default.nix
index 85e45d3fad0..3e0dc99f81f 100644
--- a/pkgs/development/libraries/qrupdate/default.nix
+++ b/pkgs/development/libraries/qrupdate/default.nix
@@ -28,9 +28,7 @@ stdenv.mkDerivation {
 
   buildFlags = [ "lib" "solib" ];
 
-  installTargets = if stdenv.isDarwin
-                   then ["install-staticlib" "install-shlib"]
-                   else "install";
+  installTargets = stdenv.lib.optionals stdenv.isDarwin [ "install-staticlib" "install-shlib" ];
 
   buildInputs = [ gfortran openblas ];
 
diff --git a/pkgs/development/libraries/qt-4.x/4.8/default.nix b/pkgs/development/libraries/qt-4.x/4.8/default.nix
index 7c7f8f51de7..25953949eb7 100644
--- a/pkgs/development/libraries/qt-4.x/4.8/default.nix
+++ b/pkgs/development/libraries/qt-4.x/4.8/default.nix
@@ -93,6 +93,12 @@ stdenv.mkDerivation rec {
       #})
       ./qt4-gcc6.patch
       ./qt4-openssl-1.1.patch
+      (fetchpatch {
+        name = "gcc9-foreach.patch";
+        url = "https://salsa.debian.org/qt-kde-team/qt/qt4-x11/raw/"
+          + "0d4a3dd61ccb156dee556c214dbe91c04d44a717/debian/patches/gcc9-qforeach.patch";
+        sha256 = "0dzn6qxrgxb75rvck9kmy5gspawdn970wsjw56026dhkih8cp3pg";
+      })
     ]
     ++ lib.optional gtkStyle (substituteAll ({
         src = ./dlopen-gtkstyle.diff;
@@ -200,13 +206,13 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE =
+  NIX_CFLAGS_COMPILE = toString (
     # with gcc7 the warnings blow the log over Hydra's limit
     [ "-Wno-expansion-to-defined" "-Wno-unused-local-typedefs" ]
     ++ lib.optional stdenv.isLinux "-std=gnu++98" # gnu++ in (Obj)C flags is no good on Darwin
     ++ lib.optionals (stdenv.isFreeBSD || stdenv.isDarwin)
       [ "-I${glib.dev}/include/glib-2.0" "-I${glib.out}/lib/glib-2.0/include" ]
-    ++ lib.optional stdenv.isDarwin "-I${libcxx}/include/c++/v1";
+    ++ lib.optional stdenv.isDarwin "-I${libcxx}/include/c++/v1");
 
   NIX_LDFLAGS = lib.optionalString (stdenv.isFreeBSD || stdenv.isDarwin) "-lglib-2.0";
 
diff --git a/pkgs/development/libraries/qt-4.x/4.8/qt4-gcc6.patch b/pkgs/development/libraries/qt-4.x/4.8/qt4-gcc6.patch
index 000e345cf13..dfd1d8b893b 100644
--- a/pkgs/development/libraries/qt-4.x/4.8/qt4-gcc6.patch
+++ b/pkgs/development/libraries/qt-4.x/4.8/qt4-gcc6.patch
@@ -5,7 +5,7 @@
  	# Check gcc's version
  	case "$(${QMAKE_CONF_COMPILER} -dumpversion)" in
 -	    5*|4*|3.4*)
-+	    8*|7*|6*|5*|4*|3.4*)
++	    9*|8*|7*|6*|5*|4*|3.4*)
  		;;
              3.3*)
                  canBuildWebKit="no"
@@ -14,7 +14,7 @@
          COMPILER_VERSION="3.*"
          ;;
 -    5*|4.*)
-+    8*|7*|6*|5*|4.*)
++    9*|8*|7*|6*|5*|4.*)
          COMPILER_VERSION="4"
          ;;
      *)
diff --git a/pkgs/development/libraries/qt-5/5.11/default.nix b/pkgs/development/libraries/qt-5/5.11/default.nix
new file mode 100644
index 00000000000..a10c50c9946
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.11/default.nix
@@ -0,0 +1,179 @@
+/*
+
+# Updates
+
+Before a major version update, make a copy of this directory. (We like to
+keep the old version around for a short time after major updates.) Add a
+top-level attribute to `top-level/all-packages.nix`.
+
+1. Update the URL in `pkgs/development/libraries/qt-5/$VERSION/fetch.sh`.
+2. From the top of the Nixpkgs tree, run
+   `./maintainers/scripts/fetch-kde-qt.sh > pkgs/development/libraries/qt-5/$VERSION/srcs.nix`.
+3. Check that the new packages build correctly.
+4. Commit the changes and open a pull request.
+
+*/
+
+{
+  newScope,
+  stdenv, fetchurl, fetchFromGitHub, fetchpatch, makeSetupHook, makeWrapper,
+  bison, cups ? null, harfbuzz, libGL, perl,
+  gstreamer, gst-plugins-base, gtk3, dconf,
+  llvmPackages_5,
+
+  # options
+  developerBuild ? false,
+  decryptSslTraffic ? false,
+  debug ? false,
+}:
+
+with stdenv.lib;
+
+let
+
+  qtCompatVersion = srcs.qtbase.version;
+
+  stdenvActual = if stdenv.cc.isClang then llvmPackages_5.stdenv else stdenv;
+
+  mirror = "https://download.qt.io";
+  srcs = import ./srcs.nix { inherit fetchurl; inherit mirror; } // {
+    # Community port of the now unmaintained upstream qtwebkit.
+    qtwebkit = {
+      src = fetchFromGitHub {
+        owner = "annulen";
+        repo = "webkit";
+        rev = "4ce8ebc4094512b9916bfa5984065e95ac97c9d8";
+        sha256 = "05h1xnxzbf7sp3plw5dndsvpf6iigh0bi4vlj4svx0hkf1giakjf";
+      };
+      version = "5.212-alpha-01-26-2018";
+    };
+  };
+
+  patches = {
+    qtbase = [
+      ./qtbase.patch
+      ./qtbase-fixguicmake.patch
+      (fetchpatch {
+        url = "https://code.qt.io/cgit/qt/qtbase.git/patch/?id=a52d7861edfb5956";
+        sha256 = "0as047qybh6w9xz2wd569kixwsibj3qid5nkd3l5w5v3lk80af3v";
+      })
+    ];
+    qtdeclarative = [ ./qtdeclarative.patch ];
+    qtscript = [
+      ./qtscript.patch
+      # needed due to changes in gcc 8.3, see https://bugreports.qt.io/browse/QTBUG-74196
+      # fixed in qtscript 5.12.2
+      (fetchpatch {
+        url = "https://github.com/qt/qtscript/commit/97ec1d1882a83c23c91f0f7daea48e05858d8c32.diff";
+        sha256 = "0khrapq13xzvxckzc9l7gqyjwibyd98vyqy6gmyhvsbm2kq8n6wi";
+      })
+    ];
+    qtserialport = [ ./qtserialport.patch ];
+    qttools = [ ./qttools.patch ];
+    qtwebengine = [
+      ./qtwebengine-no-build-skip.patch
+      ./qtwebengine-darwin-no-platform-check.patch
+      # https://gitlab.freedesktop.org/pulseaudio/pulseaudio/issues/707
+      # https://bugreports.qt.io/browse/QTBUG-77037
+      (fetchpatch {
+        name = "fix-build-with-pulseaudio-13.0.patch";
+        url = "https://git.archlinux.org/svntogit/packages.git/plain/trunk/qtbug-77037-workaround.patch?h=packages/qt5-webengine&id=fc77d6b3d5ec74e421b58f199efceb2593cbf951";
+        sha256 = "1gv733qfdn9746nbqqxzyjx4ijjqkkb7zb71nxax49nna5bri3am";
+      })
+    ];
+    qtwebkit = [ ./qtwebkit.patch ];
+  };
+
+  qtModule =
+    import ../qtModule.nix
+    {
+      inherit perl;
+      inherit (stdenv) lib;
+      # Use a variant of mkDerivation that does not include wrapQtApplications
+      # to avoid cyclic dependencies between Qt modules.
+      mkDerivation =
+        import ../mkDerivation.nix
+        { inherit (stdenv) lib; inherit debug; wrapQtAppsHook = null; }
+        stdenvActual.mkDerivation;
+    }
+    { inherit self srcs patches; };
+
+  addPackages = self: with self;
+    let
+      callPackage = self.newScope { inherit qtCompatVersion qtModule srcs; };
+    in {
+
+      mkDerivationWith =
+        import ../mkDerivation.nix
+        { inherit (stdenv) lib; inherit debug; inherit (self) wrapQtAppsHook; };
+
+      mkDerivation = mkDerivationWith stdenvActual.mkDerivation;
+
+      qtbase = callPackage ../modules/qtbase.nix {
+        inherit (srcs.qtbase) src version;
+        patches = patches.qtbase;
+        inherit bison cups harfbuzz libGL;
+        withGtk3 = true; inherit dconf gtk3;
+        inherit developerBuild decryptSslTraffic;
+      };
+
+      qtcharts = callPackage ../modules/qtcharts.nix {};
+      qtconnectivity = callPackage ../modules/qtconnectivity.nix {};
+      qtdeclarative = callPackage ../modules/qtdeclarative.nix {};
+      qtdoc = callPackage ../modules/qtdoc.nix {};
+      qtgraphicaleffects = callPackage ../modules/qtgraphicaleffects.nix {};
+      qtimageformats = callPackage ../modules/qtimageformats.nix {};
+      qtlocation = callPackage ../modules/qtlocation.nix { };
+      qtmacextras = callPackage ../modules/qtmacextras.nix {};
+      qtmultimedia = callPackage ../modules/qtmultimedia.nix {
+        inherit gstreamer gst-plugins-base;
+      };
+      qtnetworkauth = callPackage ../modules/qtnetworkauth.nix {};
+      qtquick1 = null;
+      qtquickcontrols = callPackage ../modules/qtquickcontrols.nix {};
+      qtquickcontrols2 = callPackage ../modules/qtquickcontrols2.nix {};
+      qtscript = callPackage ../modules/qtscript.nix {};
+      qtsensors = callPackage ../modules/qtsensors.nix {};
+      qtserialport = callPackage ../modules/qtserialport.nix {};
+      qtspeech = callPackage ../modules/qtspeech.nix {};
+      qtsvg = callPackage ../modules/qtsvg.nix {};
+      qttools = callPackage ../modules/qttools.nix {};
+      qttranslations = callPackage ../modules/qttranslations.nix {};
+      qtvirtualkeyboard = callPackage ../modules/qtvirtualkeyboard.nix {};
+      qtwayland = callPackage ../modules/qtwayland.nix {};
+      qtwebchannel = callPackage ../modules/qtwebchannel.nix {};
+      qtwebengine = callPackage ../modules/qtwebengine.nix {};
+      qtwebglplugin = callPackage ../modules/qtwebglplugin.nix {};
+      qtwebkit = callPackage ../modules/qtwebkit.nix {};
+      qtwebsockets = callPackage ../modules/qtwebsockets.nix {};
+      qtwebview = callPackage ../modules/qtwebview.nix {};
+      qtx11extras = callPackage ../modules/qtx11extras.nix {};
+      qtxmlpatterns = callPackage ../modules/qtxmlpatterns.nix {};
+
+      env = callPackage ../qt-env.nix {};
+      full = env "qt-full-${qtbase.version}" ([
+        qtcharts qtconnectivity qtdeclarative qtdoc qtgraphicaleffects
+        qtimageformats qtlocation qtmultimedia qtquickcontrols qtquickcontrols2
+        qtscript qtsensors qtserialport qtsvg qttools qttranslations
+        qtvirtualkeyboard qtwebchannel qtwebengine qtwebkit qtwebsockets
+        qtwebview qtx11extras qtxmlpatterns
+      ] ++ optional (!stdenv.isDarwin) qtwayland
+        ++ optional (stdenv.isDarwin) qtmacextras);
+
+      qmake = makeSetupHook {
+        deps = [ self.qtbase.dev ];
+        substitutions = {
+          fix_qmake_libtool = ../hooks/fix-qmake-libtool.sh;
+        };
+      } ../hooks/qmake-hook.sh;
+
+      wrapQtAppsHook = makeSetupHook {
+        deps =
+          [ self.qtbase.dev makeWrapper ]
+          ++ optional stdenv.isLinux self.qtwayland.dev;
+      } ../hooks/wrap-qt-apps-hook.sh;
+    };
+
+   self = makeScope newScope addPackages;
+
+in self
diff --git a/pkgs/development/libraries/qt-5/mkDerivation.nix b/pkgs/development/libraries/qt-5/mkDerivation.nix
index 95357c096df..2c6333cb020 100644
--- a/pkgs/development/libraries/qt-5/mkDerivation.nix
+++ b/pkgs/development/libraries/qt-5/mkDerivation.nix
@@ -12,9 +12,9 @@ let
     qmakeFlags = [ ("CONFIG+=" + (if debug then "debug" else "release")) ]
               ++ (args.qmakeFlags or []);
 
-    NIX_CFLAGS_COMPILE =
+    NIX_CFLAGS_COMPILE = toString (
       optional (!debug) "-DQT_NO_DEBUG"
-      ++ lib.toList (args.NIX_CFLAGS_COMPILE or []);
+      ++ lib.toList (args.NIX_CFLAGS_COMPILE or []));
 
     cmakeFlags =
       (args.cmakeFlags or [])
diff --git a/pkgs/development/libraries/qt-5/modules/qtbase.nix b/pkgs/development/libraries/qt-5/modules/qtbase.nix
index c7cb6d509dc..bc23d0f9caf 100644
--- a/pkgs/development/libraries/qt-5/modules/qtbase.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtbase.nix
@@ -170,11 +170,6 @@ stdenv.mkDerivation {
     export LD=$CXX
     ''}
 
-    configureFlags+="\
-        -plugindir $out/$qtPluginPrefix \
-        -qmldir $out/$qtQmlPrefix \
-        -docdir $out/$qtDocPrefix"
-
     NIX_CFLAGS_COMPILE+=" -DNIXPKGS_QT_PLUGIN_PREFIX=\"$qtPluginPrefix\""
   '';
 
@@ -200,20 +195,17 @@ stdenv.mkDerivation {
     done
   '';
 
-  NIX_CFLAGS_COMPILE =
-    [
-      "-Wno-error=sign-compare" # freetype-2.5.4 changed signedness of some struct fields
-      ''-DNIXPKGS_QTCOMPOSE="${libX11.out}/share/X11/locale"''
-      ''-D${if compareVersion "5.11.0" >= 0 then "LIBRESOLV_SO" else "NIXPKGS_LIBRESOLV"}="${stdenv.cc.libc.out}/lib/libresolv"''
-      ''-DNIXPKGS_LIBXCURSOR="${libXcursor.out}/lib/libXcursor"''
-    ]
-
-    ++ lib.optional libGLSupported ''-DNIXPKGS_MESA_GL="${libGL.out}/lib/libGL"''
+  NIX_CFLAGS_COMPILE = toString ([
+    "-Wno-error=sign-compare" # freetype-2.5.4 changed signedness of some struct fields
+    ''-DNIXPKGS_QTCOMPOSE="${libX11.out}/share/X11/locale"''
+    ''-D${if compareVersion "5.11.0" >= 0 then "LIBRESOLV_SO" else "NIXPKGS_LIBRESOLV"}="${stdenv.cc.libc.out}/lib/libresolv"''
+    ''-DNIXPKGS_LIBXCURSOR="${libXcursor.out}/lib/libXcursor"''
+  ] ++ lib.optional libGLSupported ''-DNIXPKGS_MESA_GL="${libGL.out}/lib/libGL"''
     ++ lib.optionals withGtk3 [
          ''-DNIXPKGS_QGTK3_XDG_DATA_DIRS="${gtk3}/share/gsettings-schemas/${gtk3.name}"''
          ''-DNIXPKGS_QGTK3_GIO_EXTRA_MODULES="${dconf.lib}/lib/gio/modules"''
        ]
-    ++ lib.optional decryptSslTraffic "-DQT_DECRYPT_SSL_TRAFFIC";
+    ++ lib.optional decryptSslTraffic "-DQT_DECRYPT_SSL_TRAFFIC");
 
   prefixKey = "-prefix ";
 
@@ -225,6 +217,10 @@ stdenv.mkDerivation {
   # TODO Remove obsolete and useless flags once the build will be totally mastered
   configureFlags =
     [
+      "-plugindir $(out)/$(qtPluginPrefix)"
+      "-qmldir $(out)/$(qtQmlPrefix)"
+      "-docdir $(out)/$(qtDocPrefix)"
+
       "-verbose"
       "-confirm-license"
       "-opensource"
diff --git a/pkgs/development/libraries/qtkeychain/default.nix b/pkgs/development/libraries/qtkeychain/default.nix
index 4951670f896..5b963255b65 100644
--- a/pkgs/development/libraries/qtkeychain/default.nix
+++ b/pkgs/development/libraries/qtkeychain/default.nix
@@ -24,12 +24,12 @@ stdenv.mkDerivation rec {
   cmakeFlags = [ "-DQT_TRANSLATIONS_DIR=share/qt/translations" ];
 
   nativeBuildInputs = [ cmake ]
-    ++ stdenv.lib.optional (!stdenv.isDarwin) [ pkgconfig ] # for finding libsecret
+    ++ stdenv.lib.optionals (!stdenv.isDarwin) [ pkgconfig ] # for finding libsecret
   ;
 
-  buildInputs = stdenv.lib.optional (!stdenv.isDarwin) [ libsecret ]
+  buildInputs = stdenv.lib.optionals (!stdenv.isDarwin) [ libsecret ]
     ++ (if withQt5 then [ qtbase qttools ] else [ qt4 ])
-    ++ stdenv.lib.optional stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
+    ++ stdenv.lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
       CoreFoundation Security
     ])
   ;
diff --git a/pkgs/development/libraries/quickder/default.nix b/pkgs/development/libraries/quickder/default.nix
index 14bfd40a593..529d361f206 100644
--- a/pkgs/development/libraries/quickder/default.nix
+++ b/pkgs/development/libraries/quickder/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, python2Packages, hexio
-, which, cmake, bash, arpa2cm, git, asn2quickder, pkgconfig }:
+, cmake, bash, arpa2cm, git, asn2quickder }:
 
 stdenv.mkDerivation rec {
   pname = "quickder";
@@ -12,20 +12,17 @@ stdenv.mkDerivation rec {
     repo = "quick-der";
   };
 
+  nativeBuildInputs = [ cmake ];
+
   buildInputs = with python2Packages; [
     arpa2cm
     asn1ate
-    bash
-    cmake
-    git
     hexio
     pyparsing
     python
     six
-    which
     asn1ate
     asn2quickder
-    pkgconfig
   ];
 
   postPatch = ''
@@ -39,9 +36,6 @@ stdenv.mkDerivation rec {
   cmakeFlags = [
     "-DNO_TESTING=ON"
     "-DARPA2CM_TOOLCHAIN_DIR=$out/share/ARPA2CM/toolchain/"
-    "-DCMAKE_EXPORT_NO_PACKAGE_REGISTRY=ON"
-    "-DCMAKE_FIND_PACKAGE_NO_PACKAGE_REGISTRY=ON"
-    "-DPACKAGE_NO_PACKAGE_REGISTRY=ON"
   ];
 
   preConfigure = ''
diff --git a/pkgs/development/libraries/readline/6.2.nix b/pkgs/development/libraries/readline/6.2.nix
index 54aa42439d9..af59e50ec5e 100644
--- a/pkgs/development/libraries/readline/6.2.nix
+++ b/pkgs/development/libraries/readline/6.2.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation (rec {
 
   propagatedBuildInputs = [ncurses];
 
-  patchFlags = "-p0";
+  patchFlags = [ "-p0" ];
   patches =
     [ ./link-against-ncurses.patch
       ./no-arch_only.patch
diff --git a/pkgs/development/libraries/readline/6.3.nix b/pkgs/development/libraries/readline/6.3.nix
index 73ed823d2be..1e5d9a0a664 100644
--- a/pkgs/development/libraries/readline/6.3.nix
+++ b/pkgs/development/libraries/readline/6.3.nix
@@ -12,13 +12,11 @@ stdenv.mkDerivation {
 
   propagatedBuildInputs = [ncurses];
 
-  patchFlags = "-p0";
+  patchFlags = [ "-p0" ];
 
-  configureFlags =
-    stdenv.lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
-    [ # This test requires running host code
-      "bash_cv_wcwidth_broken=no"
-    ];
+  configureFlags = stdenv.lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
+    # This test requires running host code
+    "bash_cv_wcwidth_broken=no";
 
   patches =
     [ ./link-against-ncurses.patch
diff --git a/pkgs/development/libraries/readline/7.0.nix b/pkgs/development/libraries/readline/7.0.nix
index 11d5c378015..065d6544986 100644
--- a/pkgs/development/libraries/readline/7.0.nix
+++ b/pkgs/development/libraries/readline/7.0.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ncurses];
 
-  patchFlags = "-p0";
+  patchFlags = [ "-p0" ];
 
   upstreamPatches =
     (let
diff --git a/pkgs/development/libraries/readline/8.0.nix b/pkgs/development/libraries/readline/8.0.nix
index cdc36617c52..7fbef9a986a 100644
--- a/pkgs/development/libraries/readline/8.0.nix
+++ b/pkgs/development/libraries/readline/8.0.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ncurses];
 
-  patchFlags = "-p0";
+  patchFlags = [ "-p0" ];
 
   upstreamPatches =
     (let
diff --git a/pkgs/development/libraries/rocksdb/default.nix b/pkgs/development/libraries/rocksdb/default.nix
index ac70d6ec0f2..2d3d1e8d722 100644
--- a/pkgs/development/libraries/rocksdb/default.nix
+++ b/pkgs/development/libraries/rocksdb/default.nix
@@ -30,6 +30,8 @@ stdenv.mkDerivation rec {
     substituteInPlace CMakeLists.txt --replace "find_package(zlib " "find_package(ZLIB "
   '';
 
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isGNU "-Wno-error=deprecated-copy -Wno-error=pessimizing-move";
+
   cmakeFlags = [
     "-DPORTABLE=1"
     "-DWITH_JEMALLOC=0"
diff --git a/pkgs/development/libraries/schroedinger/default.nix b/pkgs/development/libraries/schroedinger/default.nix
index f78ed0f7925..1831161979d 100644
--- a/pkgs/development/libraries/schroedinger/default.nix
+++ b/pkgs/development/libraries/schroedinger/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
 
   doCheck = (!stdenv.isDarwin);
 
-  patchFlags = "-p0";
+  patchFlags = [ "-p0" ];
   patches = [
     (fetchpatch {
       url = "https://raw.githubusercontent.com/macports/macports-ports/master/multimedia/schroedinger/files/patch-testsuite-Makefile.am.diff";
diff --git a/pkgs/development/libraries/science/benchmark/papi/default.nix b/pkgs/development/libraries/science/benchmark/papi/default.nix
index 35d0914e3f7..53ae70f5bf8 100644
--- a/pkgs/development/libraries/science/benchmark/papi/default.nix
+++ b/pkgs/development/libraries/science/benchmark/papi/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
     sha256 = "13mngf9kl0y2wfxqvkad0smdaag7k8fvw82b4312gx62nwhc1i6r";
   };
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=format-truncation" ];
+  NIX_CFLAGS_COMPILE = "-Wno-error=format-truncation";
 
   preConfigure = ''
     cd src
diff --git a/pkgs/development/libraries/science/biology/htslib/default.nix b/pkgs/development/libraries/science/biology/htslib/default.nix
index 0b13696ad5f..7d771414fb0 100644
--- a/pkgs/development/libraries/science/biology/htslib/default.nix
+++ b/pkgs/development/libraries/science/biology/htslib/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--enable-libcurl" ]; # optional but strongly recommended
 
-  installFlags = "prefix=$(out)";
+  installFlags = [ "prefix=$(out)" ];
 
   preCheck = ''
     patchShebangs test/
diff --git a/pkgs/development/libraries/science/biology/mirtk/default.nix b/pkgs/development/libraries/science/biology/mirtk/default.nix
index fb93961e1bc..4291e11ed33 100644
--- a/pkgs/development/libraries/science/biology/mirtk/default.nix
+++ b/pkgs/development/libraries/science/biology/mirtk/default.nix
@@ -12,7 +12,11 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
-  cmakeFlags = "-DWITH_VTK=ON -DBUILD_ALL_MODULES=ON -DWITH_TBB=ON";
+  cmakeFlags = [
+    "-DWITH_VTK=ON"
+    "-DBUILD_ALL_MODULES=ON"
+    "-DWITH_TBB=ON"
+  ];
 
   doCheck = true;
 
diff --git a/pkgs/development/libraries/science/math/fenics/default.nix b/pkgs/development/libraries/science/math/fenics/default.nix
index a93ede63a26..2bb284477e6 100644
--- a/pkgs/development/libraries/science/math/fenics/default.nix
+++ b/pkgs/development/libraries/science/math/fenics/default.nix
@@ -142,26 +142,27 @@ stdenv.mkDerivation {
     numpy pkgconfig six sphinx suitesparse sympy ufl vtk zlib
     ] ++ stdenv.lib.optionals pythonBindings [ ply python numpy swig ];
   patches = [ ./unicode.patch ];
-  cmakeFlags = "-DDOLFIN_CXX_FLAGS=-std=c++11"
-    + " -DDOLFIN_AUTO_DETECT_MPI=OFF"
-    + " -DDOLFIN_ENABLE_CHOLMOD=" + (if suitesparse != null then "ON" else "OFF")
-    + " -DDOLFIN_ENABLE_DOCS=" + (if docs then "ON" else "OFF")
-    + " -DDOLFIN_ENABLE_GTEST=" + (if gtest != null then "ON" else "OFF")
-    + " -DDOLFIN_ENABLE_HDF5=" + (if hdf5 != null then "ON" else "OFF")
-    + " -DDOLFIN_ENABLE_MPI=" + (if mpi != null then "ON" else "OFF")
-    + " -DDOLFIN_ENABLE_PARMETIS=OFF"
-    + " -DDOLFIN_ENABLE_PETSC4PY=OFF"
-    + " -DDOLFIN_ENABLE_PETSC=OFF"
-    + " -DDOLFIN_ENABLE_PYTHON=" + (if pythonBindings then "ON" else "OFF")
-    + " -DDOLFIN_ENABLE_SCOTCH=OFF"
-    + " -DDOLFIN_ENABLE_SLEPC4PY=OFF"
-    + " -DDOLFIN_ENABLE_SLEPC=OFF"
-    + " -DDOLFIN_ENABLE_SPHINX=" + (if sphinx != null then "ON" else "OFF")
-    + " -DDOLFIN_ENABLE_TESTING=" + (if doCheck then "ON" else "OFF")
-    + " -DDOLFIN_ENABLE_TRILINOS=OFF"
-    + " -DDOLFIN_ENABLE_UMFPACK=" + (if suitesparse != null then "ON" else "OFF")
-    + " -DDOLFIN_ENABLE_VTK=" + (if vtk != null then "ON" else "OFF")
-    + " -DDOLFIN_ENABLE_ZLIB=" + (if zlib != null then "ON" else "OFF");
+  cmakeFlags = [ "-DDOLFIN_CXX_FLAGS=-std=c++11"
+    "-DDOLFIN_AUTO_DETECT_MPI=OFF"
+    ("-DDOLFIN_ENABLE_CHOLMOD=" + (if suitesparse != null then "ON" else "OFF"))
+    ("-DDOLFIN_ENABLE_DOCS=" + (if docs then "ON" else "OFF"))
+    ("-DDOLFIN_ENABLE_GTEST=" + (if gtest != null then "ON" else "OFF"))
+    ("-DDOLFIN_ENABLE_HDF5=" + (if hdf5 != null then "ON" else "OFF"))
+    ("-DDOLFIN_ENABLE_MPI=" + (if mpi != null then "ON" else "OFF"))
+    "-DDOLFIN_ENABLE_PARMETIS=OFF"
+    "-DDOLFIN_ENABLE_PETSC4PY=OFF"
+    "-DDOLFIN_ENABLE_PETSC=OFF"
+    ("-DDOLFIN_ENABLE_PYTHON=" + (if pythonBindings then "ON" else "OFF"))
+    "-DDOLFIN_ENABLE_SCOTCH=OFF"
+    "-DDOLFIN_ENABLE_SLEPC4PY=OFF"
+    "-DDOLFIN_ENABLE_SLEPC=OFF"
+    ("-DDOLFIN_ENABLE_SPHINX=" + (if sphinx != null then "ON" else "OFF"))
+    ("-DDOLFIN_ENABLE_TESTING=" + (if doCheck then "ON" else "OFF"))
+    "-DDOLFIN_ENABLE_TRILINOS=OFF"
+    ("-DDOLFIN_ENABLE_UMFPACK=" + (if suitesparse != null then "ON" else "OFF"))
+    ("-DDOLFIN_ENABLE_VTK=" + (if vtk != null then "ON" else "OFF"))
+    ("-DDOLFIN_ENABLE_ZLIB=" + (if zlib != null then "ON" else "OFF"))
+  ];
   checkPhase = ''
     make runtests
   '';
diff --git a/pkgs/development/libraries/science/math/osi/default.nix b/pkgs/development/libraries/science/math/osi/default.nix
index 1cc80e78a10..6dc7e746fd3 100644
--- a/pkgs/development/libraries/science/math/osi/default.nix
+++ b/pkgs/development/libraries/science/math/osi/default.nix
@@ -22,10 +22,10 @@ stdenv.mkDerivation rec {
     ++ lib.optionals withCplex [ "--with-cplex-incdir=${cplex}/cplex/include/ilcplex" "--with-cplex-lib=-lcplex${cplex.libSuffix}" ];
 
   NIX_LDFLAGS =
-    lib.optional withCplex "-L${cplex}/cplex/bin/${cplex.libArch}";
+    lib.optionalString withCplex "-L${cplex}/cplex/bin/${cplex.libArch}";
 
-  # Compile errors 
-  NIX_CFLAGS_COMPILE = [ "-Wno-cast-qual" ];
+  # Compile errors
+  NIX_CFLAGS_COMPILE = "-Wno-cast-qual";
   hardeningDisable = [ "format" ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/shhmsg/default.nix b/pkgs/development/libraries/shhmsg/default.nix
index 5f14a7bb5ee..596ea1cfaf8 100644
--- a/pkgs/development/libraries/shhmsg/default.nix
+++ b/pkgs/development/libraries/shhmsg/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "0ax02fzqpaxr7d30l5xbndy1s5vgg1ag643c7zwiw2wj1czrxil8";
   };
 
-  installFlags = "INSTBASEDIR=$(out)";
+  installFlags = [ "INSTBASEDIR=$(out)" ];
 
   meta = with stdenv.lib; {
     description = "A library for displaying messages";
diff --git a/pkgs/development/libraries/shhopt/default.nix b/pkgs/development/libraries/shhopt/default.nix
index dbac4c85961..985ee59348b 100644
--- a/pkgs/development/libraries/shhopt/default.nix
+++ b/pkgs/development/libraries/shhopt/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "0yd6bl6qw675sxa81nxw6plhpjf9d2ywlm8a5z66zyjf28sl7sds";
   };
 
-  installFlags = "INSTBASEDIR=$(out)";
+  installFlags = [ "INSTBASEDIR=$(out)" ];
 
   meta = with stdenv.lib; {
     description = "A library for parsing command line options";
diff --git a/pkgs/development/libraries/smpeg/default.nix b/pkgs/development/libraries/smpeg/default.nix
index a7ffc146f41..4d74ee7ca06 100644
--- a/pkgs/development/libraries/smpeg/default.nix
+++ b/pkgs/development/libraries/smpeg/default.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
       --prefix PKG_CONFIG_PATH ":" "${SDL.dev}/lib/pkgconfig"
   '';
 
-  NIX_LDFLAGS = [ "-lX11" ];
+  NIX_LDFLAGS = "-lX11";
 
   meta = {
     homepage = http://icculus.org/smpeg/;
diff --git a/pkgs/development/libraries/sord/default.nix b/pkgs/development/libraries/sord/default.nix
index 38636776e9d..2113d7bd49b 100644
--- a/pkgs/development/libraries/sord/default.nix
+++ b/pkgs/development/libraries/sord/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "sord";
-  version = "0.16.2";
+  version = "0.16.4";
 
   src = fetchurl {
     url = "https://download.drobilla.net/${pname}-${version}.tar.bz2";
-    sha256 = "13fshxwpipjrvsah1m2jw1kf022z2q5vpw24bzcznglgvms13x89";
+    sha256 = "1mwh4qvp9q4vgrgg5bz9sgjhxscncrylf2b06h0q55ddwzs9hndi";
   };
 
   nativeBuildInputs = [ pkgconfig python3 wafHook ];
diff --git a/pkgs/development/libraries/spatialite-tools/default.nix b/pkgs/development/libraries/spatialite-tools/default.nix
index 2708e49eb2b..83eef355f2d 100644
--- a/pkgs/development/libraries/spatialite-tools/default.nix
+++ b/pkgs/development/libraries/spatialite-tools/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_LDFLAGS = [ "-lsqlite3" ];
+  NIX_LDFLAGS = "-lsqlite3";
 
   meta = {
     description = "A complete sqlite3-compatible CLI front-end for libspatialite";
diff --git a/pkgs/development/libraries/spdk/default.nix b/pkgs/development/libraries/spdk/default.nix
index e70980afac6..51583fdbbcd 100644
--- a/pkgs/development/libraries/spdk/default.nix
+++ b/pkgs/development/libraries/spdk/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--with-dpdk=${dpdk}" ];
 
-  NIX_CFLAGS_COMPILE = [ "-mssse3" ]; # Necessary to compile.
+  NIX_CFLAGS_COMPILE = "-mssse3"; # Necessary to compile.
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index 529b3ba9e71..d904637fcd3 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -10,12 +10,12 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sqlite";
-  version = "3.30.0";
+  version = "3.30.1";
 
   # NB! Make sure to update analyzer.nix src (in the same directory).
   src = fetchurl {
     url = "https://sqlite.org/2019/sqlite-autoconf-${archiveVersion version}.tar.gz";
-    sha256 = "0n7w839y55dc3qqf2zv8xk6238cc6mpx24q4w5amwic7g96cza70";
+    sha256 = "0q4f57a5995wz9c7dfiqy9zwl0kn0b900nxwinqa3llv13dm0nlc";
   };
 
   outputs = [ "bin" "dev" "out" ];
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--enable-threadsafe" ] ++ optional interactive "--enable-readline";
 
-  NIX_CFLAGS_COMPILE = [
+  NIX_CFLAGS_COMPILE = toString [
     "-DSQLITE_ENABLE_COLUMN_METADATA"
     "-DSQLITE_ENABLE_DBSTAT_VTAB"
     "-DSQLITE_ENABLE_JSON1"
diff --git a/pkgs/development/libraries/srt/default.nix b/pkgs/development/libraries/srt/default.nix
index cf8bffe0736..953ba9484fa 100644
--- a/pkgs/development/libraries/srt/default.nix
+++ b/pkgs/development/libraries/srt/default.nix
@@ -4,13 +4,13 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
   pname = "srt";
-  version = "1.4.0";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "Haivision";
     repo = "srt";
     rev = "v${version}";
-    sha256 = "1rmswx4x3p9pdgnd7vvl3vwgh9rynakjhv1mipy2yid5rb61ajlj";
+    sha256 = "01xaq44j95kbgqfl41pnybvqy0yq6wd4wdw88ckylzf0nzp977xz";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/t1lib/default.nix b/pkgs/development/libraries/t1lib/default.nix
index b8e7518cd33..010838efab5 100644
--- a/pkgs/development/libraries/t1lib/default.nix
+++ b/pkgs/development/libraries/t1lib/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation {
   inherit patches;
 
   buildInputs = [ libX11 libXaw ];
-  buildFlags = "without_doc";
+  buildFlags = [ "without_doc" ];
 
   postInstall = stdenv.lib.optional (!stdenv.isDarwin) "chmod +x $out/lib/*.so.*"; # ??
 
diff --git a/pkgs/development/libraries/tachyon/default.nix b/pkgs/development/libraries/tachyon/default.nix
index 5e0f37bbb52..d1d4ee806b8 100644
--- a/pkgs/development/libraries/tachyon/default.nix
+++ b/pkgs/development/libraries/tachyon/default.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
          if stdenv.hostPlatform.system == "x86_64-freebsd" then "bsd"           else
          if stdenv.hostPlatform.system == "x686-freebsd"   then "bsd"           else
          throw "Don't know what arch to select for tachyon build";
-  makeFlags = arch;
+  makeFlags = [ arch ];
   patches = [
     # Remove absolute paths in Make-config (and unset variables so they can be set in preBuild)
     ./no-absolute-paths.patch
diff --git a/pkgs/development/libraries/tinyxml/2.6.2.nix b/pkgs/development/libraries/tinyxml/2.6.2.nix
index cc7c996f7c3..0cc4038b64e 100644
--- a/pkgs/development/libraries/tinyxml/2.6.2.nix
+++ b/pkgs/development/libraries/tinyxml/2.6.2.nix
@@ -28,7 +28,7 @@ in stdenv.mkDerivation {
   hardeningDisable = [ "format" ];
 
   NIX_CFLAGS_COMPILE =
-    stdenv.lib.optional stdenv.isDarwin "-mmacosx-version-min=10.9";
+    stdenv.lib.optionalString stdenv.isDarwin "-mmacosx-version-min=10.9";
 
   buildInputs = [ unzip ];
   buildPhase = ''
diff --git a/pkgs/development/libraries/unixODBCDrivers/default.nix b/pkgs/development/libraries/unixODBCDrivers/default.nix
index 78f85afca91..6cfaef5ef99 100644
--- a/pkgs/development/libraries/unixODBCDrivers/default.nix
+++ b/pkgs/development/libraries/unixODBCDrivers/default.nix
@@ -100,16 +100,16 @@
   sqlite = stdenv.mkDerivation rec {
     pname = "sqlite-connector-odbc";
     version = "0.9993";
- 
+
     src = fetchurl {
       url = "http://www.ch-werner.de/sqliteodbc/sqliteodbc-${version}.tar.gz";
       sha256 = "0dgsj28sc7f7aprmdd0n5a1rmcx6pv7170c8dfjl0x1qsjxim6hs";
     };
- 
+
     buildInputs = [ unixODBC sqlite zlib libxml2 ];
- 
+
     configureFlags = [ "--with-odbc=${unixODBC}" ];
- 
+
     installTargets = [ "install-3" ];
 
     # move libraries to $out/lib where they're expected to be
@@ -117,7 +117,7 @@
       mkdir -p "$out/lib"
       mv "$out"/*.* "$out/lib"
     '';
- 
+
     passthru = {
       fancyName = "SQLite";
       driver = "lib/libsqlite3odbc.so";
diff --git a/pkgs/development/libraries/uri/default.nix b/pkgs/development/libraries/uri/default.nix
index 61246748ac7..5e5f4c9e8ca 100644
--- a/pkgs/development/libraries/uri/default.nix
+++ b/pkgs/development/libraries/uri/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "148361pixrm94q6v04k13s1msa04bx9yc3djb0lxpa7dlw19vhcd";
   };
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=parentheses" ];
+  NIX_CFLAGS_COMPILE = "-Wno-error=parentheses";
 
   nativeBuildInputs = [ cmake doxygen ];
 
diff --git a/pkgs/development/libraries/usbredir/default.nix b/pkgs/development/libraries/usbredir/default.nix
index 2eee80a7696..8e43135196c 100644
--- a/pkgs/development/libraries/usbredir/default.nix
+++ b/pkgs/development/libraries/usbredir/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "002yik1x7kn0427xahvnhjby2np14a6xqw7c3dx530n9h5d9rg47";
   };
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error" ];
+  NIX_CFLAGS_COMPILE = "-Wno-error";
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libusb ];
diff --git a/pkgs/development/libraries/v8/default.nix b/pkgs/development/libraries/v8/default.nix
index 4e9336172ad..a02e540173d 100644
--- a/pkgs/development/libraries/v8/default.nix
+++ b/pkgs/development/libraries/v8/default.nix
@@ -99,7 +99,7 @@ stdenv.mkDerivation rec {
 
   # with gcc8, -Wclass-memaccess became part of -Wall and causes logging limit
   # to be exceeded
-  NIX_CFLAGS_COMPILE = stdenv.lib.optional stdenv.cc.isGNU "-Wno-class-memaccess";
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isGNU "-Wno-class-memaccess";
 
   nativeBuildInputs = [ gn ninja pkgconfig python ]
     ++ stdenv.lib.optionals stdenv.isDarwin [ xcbuild darwin.DarwinTools ];
diff --git a/pkgs/development/libraries/vxl/default.nix b/pkgs/development/libraries/vxl/default.nix
index 9651e9a5f80..17d11d4fb74 100644
--- a/pkgs/development/libraries/vxl/default.nix
+++ b/pkgs/development/libraries/vxl/default.nix
@@ -11,14 +11,17 @@ stdenv.mkDerivation {
 
   buildInputs = [ cmake unzip libtiff expat zlib libpng libjpeg ];
 
-  # BUILD_OUL wants old linux headers for videodev.h, not available
-  # in stdenv linux headers
-  # BUILD_BRL fails to find open()
-  cmakeFlags = "-DBUILD_OUL=OFF -DBUILD_BRL=OFF -DBUILD_CONTRIB=OFF "
-    + (if stdenv.hostPlatform.system == "x86_64-linux" then
-      "-DCMAKE_CXX_FLAGS=-fPIC -DCMAKE_C_FLAGS=-fPIC"
-    else
-      "");
+  cmakeFlags = [
+    # BUILD_OUL wants old linux headers for videodev.h, not available
+    # in stdenv linux headers
+    "-DBUILD_OUL=OFF"
+    # BUILD_BRL fails to find open()
+    "-DBUILD_BRL=OFF"
+    "-DBUILD_CONTRIB=OFF"
+  ] ++ stdenv.lib.optionals (stdenv.hostPlatform.system == "x86_64-linux") [
+    "-DCMAKE_CXX_FLAGS=-fPIC"
+    "-DCMAKE_C_FLAGS=-fPIC"
+  ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/wxwidgets/2.8/default.nix b/pkgs/development/libraries/wxwidgets/2.8/default.nix
index 38ee4376ac2..73dac47307a 100644
--- a/pkgs/development/libraries/wxwidgets/2.8/default.nix
+++ b/pkgs/development/libraries/wxwidgets/2.8/default.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
     + optionalString withMesa "${libGLU.out}/lib ${libGL.out}/lib ";
 
   # Work around a bug in configure.
-  NIX_CFLAGS_COMPILE = [ "-DHAVE_X11_XLIB_H=1" "-lX11" "-lcairo" "-Wno-narrowing" ];
+  NIX_CFLAGS_COMPILE = "-DHAVE_X11_XLIB_H=1 -lX11 -lcairo -Wno-narrowing";
 
   preConfigure = "
     substituteInPlace configure --replace 'SEARCH_INCLUDE=' 'DUMMY_SEARCH_INCLUDE='
diff --git a/pkgs/development/libraries/xmlsec/default.nix b/pkgs/development/libraries/xmlsec/default.nix
index 25c5bf45888..a8c751330b7 100644
--- a/pkgs/development/libraries/xmlsec/default.nix
+++ b/pkgs/development/libraries/xmlsec/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation {
   configureFlags = [ "--enable-soap" ];
 
   # otherwise libxmlsec1-gnutls.so won't find libgcrypt.so, after #909
-  NIX_LDFLAGS = [ "-lgcrypt" ];
+  NIX_LDFLAGS = "-lgcrypt";
 
   postInstall = ''
     moveToOutput "bin/xmlsec1-config" "$dev"
diff --git a/pkgs/development/libraries/zeroc-ice/default.nix b/pkgs/development/libraries/zeroc-ice/default.nix
index e4d0c0fde17..3a5b1690f2d 100644
--- a/pkgs/development/libraries/zeroc-ice/default.nix
+++ b/pkgs/development/libraries/zeroc-ice/default.nix
@@ -32,7 +32,7 @@ in stdenv.mkDerivation rec {
   buildInputs = [ zeroc_mcpp bzip2 expat openssl lmdb ]
     ++ lib.optionals stdenv.isDarwin [ darwin.cctools libiconv Security ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=class-memaccess" ];
+  NIX_CFLAGS_COMPILE = "-Wno-error=class-memaccess -Wno-error=deprecated-copy";
 
   prePatch = lib.optional stdenv.isDarwin ''
     substituteInPlace Make.rules.Darwin \
diff --git a/pkgs/development/libraries/zeromq/4.x.nix b/pkgs/development/libraries/zeromq/4.x.nix
index db5d90e2f02..1a8f07a3ae0 100644
--- a/pkgs/development/libraries/zeromq/4.x.nix
+++ b/pkgs/development/libraries/zeromq/4.x.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   doCheck = false; # fails all the tests (ctest)
 
-  cmakeFlags = if enableDrafts then [ "-DENABLE_DRAFTS=ON" ] else null;
+  cmakeFlags = stdenv.lib.optional enableDrafts "-DENABLE_DRAFTS=ON";
 
   meta = with stdenv.lib; {
     branch = "4";
diff --git a/pkgs/development/libraries/zookeeper_mt/default.nix b/pkgs/development/libraries/zookeeper_mt/default.nix
index 22d2ab333ca..127ea4f7162 100644
--- a/pkgs/development/libraries/zookeeper_mt/default.nix
+++ b/pkgs/development/libraries/zookeeper_mt/default.nix
@@ -7,7 +7,7 @@ stdenv.mkDerivation rec {
 
   setSourceRoot = "export sourceRoot=${zookeeper.name}/src/c";
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionals (!stdenv.isDarwin) [ "-Wno-error=format-overflow" ];
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString (!stdenv.isDarwin) "-Wno-error=format-overflow -Wno-error=stringop-truncation";
 
   buildInputs = [ zookeeper bash ];
 
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index 9139befe020..fd99a70de3a 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -42,7 +42,8 @@ with super;
     ];
 
     # https://github.com/wahern/cqueues/issues/227
-    NIX_CFLAGS_COMPILE = if pkgs.stdenv.hostPlatform.isDarwin then [ "-DCLOCK_MONOTONIC" "-DCLOCK_REALTIME" ] else null;
+    NIX_CFLAGS_COMPILE = with pkgs.stdenv; lib.optionalString hostPlatform.isDarwin
+      "-DCLOCK_MONOTONIC -DCLOCK_REALTIME";
 
     disabled = luaOlder "5.1" || luaAtLeast "5.4";
     # Upstream rockspec is pointlessly broken into separate rockspecs, per Lua
@@ -253,7 +254,7 @@ with super;
     # Upstreams:
     # 5.1: http://webserver2.tecgraf.puc-rio.br/~lhf/ftp/lua/5.1/luuid.tar.gz
     # 5.2: http://webserver2.tecgraf.puc-rio.br/~lhf/ftp/lua/5.2/luuid.tar.gz
-    patchFlags = "-p2";
+    patchFlags = [ "-p2" ];
     patches = [
       ./luuid.patch
     ];
diff --git a/pkgs/development/misc/amdapp-sdk/default.nix b/pkgs/development/misc/amdapp-sdk/default.nix
index c3bf3217b6a..a3a4573c0ae 100644
--- a/pkgs/development/misc/amdapp-sdk/default.nix
+++ b/pkgs/development/misc/amdapp-sdk/default.nix
@@ -46,7 +46,7 @@ in stdenv.mkDerivation {
 
   patches = stdenv.lib.attrByPath [version "patches"] [] src_info;
 
-  patchFlags = "-p0";
+  patchFlags = [ "-p0" ];
   buildInputs = [ makeWrapper perl libGLU libGL xorg.libX11 xorg.libXext xorg.libXaw xorg.libXi xorg.libXxf86vm ];
   propagatedBuildInputs = [ stdenv.cc ];
   NIX_LDFLAGS = "-lX11 -lXext -lXmu -lXi -lXxf86vm";
diff --git a/pkgs/development/misc/qmk_firmware/default.nix b/pkgs/development/misc/qmk_firmware/default.nix
index 8abe4b2550e..38b1df3ca3b 100644
--- a/pkgs/development/misc/qmk_firmware/default.nix
+++ b/pkgs/development/misc/qmk_firmware/default.nix
@@ -20,7 +20,7 @@ in stdenv.mkDerivation {
       --replace arm-none-eabi arm-none-eabihf
     rm keyboards/handwired/frenchdev/rules.mk keyboards/dk60/rules.mk
   '';
-  buildFlags = "all:default";
+  buildFlags = [ "all:default" ];
   doCheck = true;
   checkTarget = "test:all";
   installPhase = ''
diff --git a/pkgs/development/mobile/androidenv/build-tools.nix b/pkgs/development/mobile/androidenv/build-tools.nix
index 976ef141627..9e273468cd3 100644
--- a/pkgs/development/mobile/androidenv/build-tools.nix
+++ b/pkgs/development/mobile/androidenv/build-tools.nix
@@ -3,7 +3,7 @@
 deployAndroidPackage {
   inherit package os;
   buildInputs = [ autoPatchelfHook makeWrapper ] ++
-    lib.optional (os == "linux") [ pkgs.glibc pkgs.zlib pkgs.ncurses5 pkgs_i686.glibc pkgs_i686.zlib pkgs_i686.ncurses5 ];
+    lib.optionals (os == "linux") [ pkgs.glibc pkgs.zlib pkgs.ncurses5 pkgs_i686.glibc pkgs_i686.zlib pkgs_i686.ncurses5 ];
   patchInstructions = ''
     ${lib.optionalString (os == "linux") ''
       addAutoPatchelfSearchPath $packageBaseDir/lib
diff --git a/pkgs/development/mobile/androidenv/platform-tools.nix b/pkgs/development/mobile/androidenv/platform-tools.nix
index 5b4cad1f264..c39d966959a 100644
--- a/pkgs/development/mobile/androidenv/platform-tools.nix
+++ b/pkgs/development/mobile/androidenv/platform-tools.nix
@@ -3,7 +3,7 @@
 deployAndroidPackage {
   inherit package os;
   buildInputs = [ autoPatchelfHook ]
-    ++ lib.optional (os == "linux") [ pkgs.glibc pkgs.zlib pkgs.ncurses5 ];
+    ++ lib.optionals (os == "linux") [ pkgs.glibc pkgs.zlib pkgs.ncurses5 ];
   patchInstructions = lib.optionalString (os == "linux") ''
     addAutoPatchelfSearchPath $packageBaseDir/lib64
     autoPatchelf --no-recurse $packageBaseDir/lib64
diff --git a/pkgs/development/ocaml-modules/biniou/1.0.nix b/pkgs/development/ocaml-modules/biniou/1.0.nix
index 2584c5ad8b3..ed216d8236a 100644
--- a/pkgs/development/ocaml-modules/biniou/1.0.nix
+++ b/pkgs/development/ocaml-modules/biniou/1.0.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   createFindlibDestdir = true;
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   preBuild = ''
     mkdir $out/bin
diff --git a/pkgs/development/ocaml-modules/bolt/default.nix b/pkgs/development/ocaml-modules/bolt/default.nix
index b5a4f179b17..7b8103efac8 100644
--- a/pkgs/development/ocaml-modules/bolt/default.nix
+++ b/pkgs/development/ocaml-modules/bolt/default.nix
@@ -45,7 +45,7 @@ EOF
 
   createFindlibDestdir = true;
 
-  buildFlags = "all";
+  buildFlags = [ "all" ];
 
   doCheck = true;
   checkTarget = "tests";
diff --git a/pkgs/development/ocaml-modules/camlzip/default.nix b/pkgs/development/ocaml-modules/camlzip/default.nix
index d0bc2f5a375..7de8968e061 100644
--- a/pkgs/development/ocaml-modules/camlzip/default.nix
+++ b/pkgs/development/ocaml-modules/camlzip/default.nix
@@ -8,14 +8,14 @@ let
       url = "https://github.com/xavierleroy/camlzip/archive/rel107.tar.gz";
       sha256 = "1pdz3zyiczm6c46zfgag2frwq3ljlq044p3a2y4wm2wb4pgz8k9g";
       patches = [];
-      installTargets = "install-findlib";
+      installTargets = [ "install-findlib" ];
     } else {
       version = "1.05";
       download_id = "1037";
       url = "http://forge.ocamlcore.org/frs/download.php/${param.download_id}/camlzip-${param.version}.tar.gz";
       sha256 = "930b70c736ab5a7ed1b05220102310a0a2241564786657abe418e834a538d06b";
       patches = [./makefile_1_05.patch];
-      installTargets = "install";
+      installTargets = [ "install" ];
     };
 in
 
@@ -42,7 +42,7 @@ stdenv.mkDerivation {
       --subst-var-by ZLIB_INCLUDE "${zlib.dev}/include"
   '';
 
-  buildFlags = "all allopt";
+  buildFlags = [ "all" "allopt" ];
 
   inherit (param) installTargets;
 
diff --git a/pkgs/development/ocaml-modules/cohttp/0.19.3.nix b/pkgs/development/ocaml-modules/cohttp/0.19.3.nix
index 99f101010f3..24547a03a08 100644
--- a/pkgs/development/ocaml-modules/cohttp/0.19.3.nix
+++ b/pkgs/development/ocaml-modules/cohttp/0.19.3.nix
@@ -19,7 +19,7 @@ buildOcaml rec {
   ++ stdenv.lib.optionals asyncSupport [ async_p4 async_ssl_p4 ];
   propagatedBuildInputs = [ re stringext uri_p4 fieldslib_p4 sexplib_p4 base64 ];
 
-  buildFlags = "PREFIX=$(out)";
+  buildFlags = [ "PREFIX=$(out)" ];
 
   meta = with stdenv.lib; {
     homepage = https://github.com/mirage/ocaml-cohttp;
diff --git a/pkgs/development/ocaml-modules/cryptokit/default.nix b/pkgs/development/ocaml-modules/cryptokit/default.nix
index 50857e159dd..1c7a0ccb0fa 100644
--- a/pkgs/development/ocaml-modules/cryptokit/default.nix
+++ b/pkgs/development/ocaml-modules/cryptokit/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation {
   buildInputs = [ ocaml findlib ocamlbuild ncurses ];
   propagatedBuildInputs = [ param.zarith zlib ];
 
-  buildFlags = "setup.data build";
+  buildFlags = [ "setup.data" "build" ];
 
   preBuild = "mkdir -p $out/lib/ocaml/${ocaml.version}/site-lib/stublibs";
 
diff --git a/pkgs/development/ocaml-modules/curses/default.nix b/pkgs/development/ocaml-modules/curses/default.nix
index dc6b1751283..9bcf4fc411f 100644
--- a/pkgs/development/ocaml-modules/curses/default.nix
+++ b/pkgs/development/ocaml-modules/curses/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ ocaml findlib ];
 
   # Fix build for recent ncurses versions
-  NIX_CFLAGS_COMPILE = [ "-DNCURSES_INTERNALS=1" ];
+  NIX_CFLAGS_COMPILE = "-DNCURSES_INTERNALS=1";
 
   createFindlibDestdir = true;
 
diff --git a/pkgs/development/ocaml-modules/dolmen/default.nix b/pkgs/development/ocaml-modules/dolmen/default.nix
index 26876cad8c8..824da303068 100644
--- a/pkgs/development/ocaml-modules/dolmen/default.nix
+++ b/pkgs/development/ocaml-modules/dolmen/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 	buildInputs = [ ocaml findlib ocamlbuild ];
 	propagatedBuildInputs = [ menhir ];
 
-	makeFlags = "-C src";
+	makeFlags = [ "-C" "src" ];
 
 	createFindlibDestdir = true;
 
diff --git a/pkgs/development/ocaml-modules/dypgen/default.nix b/pkgs/development/ocaml-modules/dypgen/default.nix
index 1abf387bdd3..62e63592566 100644
--- a/pkgs/development/ocaml-modules/dypgen/default.nix
+++ b/pkgs/development/ocaml-modules/dypgen/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     make
   '';
 
-  makeFlags = "BINDIR=$(out)/bin  MANDIR=$(out)/usr/share/man/man1 DYPGENLIBDIR=$(out)/lib/ocaml/${ocaml.version}/site-lib";
+  makeFlags = [ "BINDIR=$(out)/bin" "MANDIR=$(out)/usr/share/man/man1" "DYPGENLIBDIR=$(out)/lib/ocaml/${ocaml.version}/site-lib" ];
 
   meta = {
     homepage = http://dypgen.free.fr;
diff --git a/pkgs/development/ocaml-modules/fontconfig/default.nix b/pkgs/development/ocaml-modules/fontconfig/default.nix
index 4f586f2f99e..ce17cc60ebf 100644
--- a/pkgs/development/ocaml-modules/fontconfig/default.nix
+++ b/pkgs/development/ocaml-modules/fontconfig/default.nix
@@ -11,7 +11,10 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ ocaml fontconfig ];
-  makeFlags = "OCAML_STDLIB_DIR=$(out)/lib/ocaml/${stdenv.lib.getVersion ocaml}/site-lib/ OCAML_HAVE_OCAMLOPT=yes";
+  makeFlags = [
+    "OCAML_STDLIB_DIR=$(out)/lib/ocaml/${stdenv.lib.getVersion ocaml}/site-lib/"
+    "OCAML_HAVE_OCAMLOPT=yes"
+  ];
 
   meta = {
     description = "Fontconfig bindings for OCaml";
diff --git a/pkgs/development/ocaml-modules/frontc/default.nix b/pkgs/development/ocaml-modules/frontc/default.nix
index 39ec4c011f8..979c364e496 100644
--- a/pkgs/development/ocaml-modules/frontc/default.nix
+++ b/pkgs/development/ocaml-modules/frontc/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  makeFlags = "PREFIX=$(out) OCAML_SITE=$(OCAMLFIND_DESTDIR)";
+  makeFlags = [ "PREFIX=$(out)" "OCAML_SITE=$(OCAMLFIND_DESTDIR)" ];
 
   postInstall = "cp ${meta_file} $OCAMLFIND_DESTDIR/FrontC/META";
 }
diff --git a/pkgs/development/ocaml-modules/functory/default.nix b/pkgs/development/ocaml-modules/functory/default.nix
index c8b29759b97..18b5fb39776 100644
--- a/pkgs/development/ocaml-modules/functory/default.nix
+++ b/pkgs/development/ocaml-modules/functory/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ ocaml findlib ];
 
-  installTargets = "ocamlfind-install";
+  installTargets = [ "ocamlfind-install" ];
 
   createFindlibDestdir = true;
 
diff --git a/pkgs/development/ocaml-modules/lablgl/default.nix b/pkgs/development/ocaml-modules/lablgl/default.nix
index ae85847b58b..847322b1a10 100644
--- a/pkgs/development/ocaml-modules/lablgl/default.nix
+++ b/pkgs/development/ocaml-modules/lablgl/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
 
   createFindlibDestdir = true;
 
-  buildFlags = "lib libopt glut glutopt";
+  buildFlags = [ "lib" "libopt" "glut" "glutopt" ];
 
   postInstall = ''
     cp ./META $out/lib/ocaml/${ocaml.version}/site-lib/lablgl
diff --git a/pkgs/development/ocaml-modules/lablgtk/2.14.0.nix b/pkgs/development/ocaml-modules/lablgtk/2.14.0.nix
index d0349de4db3..e2ebb76397c 100644
--- a/pkgs/development/ocaml-modules/lablgtk/2.14.0.nix
+++ b/pkgs/development/ocaml-modules/lablgtk/2.14.0.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation (rec {
   buildInputs = [ ocaml findlib gtk2 libgnomecanvas libglade gtksourceview camlp4 ];
 
   configureFlags = [ "--with-libdir=$(out)/lib/ocaml/${ocaml.version}/site-lib" ];
-  buildFlags = "world";
+  buildFlags = [ "world" ];
 
   preInstall = ''
     mkdir -p $out/lib/ocaml/${ocaml.version}/site-lib
diff --git a/pkgs/development/ocaml-modules/lablgtk/default.nix b/pkgs/development/ocaml-modules/lablgtk/default.nix
index 217af54040f..46b76abd268 100644
--- a/pkgs/development/ocaml-modules/lablgtk/default.nix
+++ b/pkgs/development/ocaml-modules/lablgtk/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
   buildInputs = [ ocaml findlib gtk2 libgnomecanvas libglade gtksourceview ];
 
   configureFlags = [ "--with-libdir=$(out)/lib/ocaml/${ocaml.version}/site-lib" ];
-  buildFlags = "world";
+  buildFlags = [ "world" ];
 
   preInstall = ''
     mkdir -p $out/lib/ocaml/${ocaml.version}/site-lib
diff --git a/pkgs/development/ocaml-modules/llvm/default.nix b/pkgs/development/ocaml-modules/llvm/default.nix
index fff4cff7802..b74501fdd68 100644
--- a/pkgs/development/ocaml-modules/llvm/default.nix
+++ b/pkgs/development/ocaml-modules/llvm/default.nix
@@ -22,9 +22,9 @@ stdenv.mkDerivation {
     "-DLLVM_OCAML_EXTERNAL_LLVM_LIBDIR=${stdenv.lib.getLib llvm}/lib"
   ];
 
-  buildFlags = "ocaml_all";
+  buildFlags = [ "ocaml_all" ];
 
-  installFlags = "-C bindings/ocaml";
+  installFlags = [ "-C" "bindings/ocaml" ];
 
   postInstall = ''
     mkdir -p $OCAMLFIND_DESTDIR/
diff --git a/pkgs/development/ocaml-modules/ocaml-cairo/default.nix b/pkgs/development/ocaml-modules/ocaml-cairo/default.nix
index cd9d9f2d150..da68c811df1 100644
--- a/pkgs/development/ocaml-modules/ocaml-cairo/default.nix
+++ b/pkgs/development/ocaml-modules/ocaml-cairo/default.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     cp META $out/lib/ocaml/${ocaml.version}/site-lib/cairo/
   '';
 
-  makeFlags = "INSTALLDIR=$(out)/lib/ocaml/${ocaml.version}/site-lib/cairo";
+  makeFlags = [ "INSTALLDIR=$(out)/lib/ocaml/${ocaml.version}/site-lib/cairo" ];
 
   meta = {
     homepage = http://cairographics.org/cairo-ocaml;
diff --git a/pkgs/development/ocaml-modules/ocplib-simplex/default.nix b/pkgs/development/ocaml-modules/ocplib-simplex/default.nix
index 1c09edf3a7e..50c63ef718a 100644
--- a/pkgs/development/ocaml-modules/ocplib-simplex/default.nix
+++ b/pkgs/development/ocaml-modules/ocplib-simplex/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ ocaml findlib ];
 
-  installFlags = "LIBDIR=$(OCAMLFIND_DESTDIR)";
+  installFlags = [ "LIBDIR=$(OCAMLFIND_DESTDIR)" ];
 
   createFindlibDestdir = true;
 
diff --git a/pkgs/development/ocaml-modules/pprint/default.nix b/pkgs/development/ocaml-modules/pprint/default.nix
index 899806c4dae..d618f90e541 100644
--- a/pkgs/development/ocaml-modules/pprint/default.nix
+++ b/pkgs/development/ocaml-modules/pprint/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation {
   createFindlibDestdir = true;
 
   dontBuild = true;
-  installFlags = "-C src";
+  installFlags = [ "-C" "src" ];
 
   meta = with stdenv.lib; {
     homepage = http://gallium.inria.fr/~fpottier/pprint/;
diff --git a/pkgs/development/ocaml-modules/psmt2-frontend/default.nix b/pkgs/development/ocaml-modules/psmt2-frontend/default.nix
index 57f1a832f56..485620514e4 100644
--- a/pkgs/development/ocaml-modules/psmt2-frontend/default.nix
+++ b/pkgs/development/ocaml-modules/psmt2-frontend/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   createFindlibDestdir = true;
 
-  installFlags = "LIBDIR=$(OCAMLFIND_DESTDIR)";
+  installFlags = [ "LIBDIR=$(OCAMLFIND_DESTDIR)" ];
 
   meta = {
     description = "A simple parser and type-checker for polomorphic extension of the SMT-LIB 2 language";
diff --git a/pkgs/development/ocaml-modules/twt/default.nix b/pkgs/development/ocaml-modules/twt/default.nix
index 207a7b183e6..940f6cf5107 100644
--- a/pkgs/development/ocaml-modules/twt/default.nix
+++ b/pkgs/development/ocaml-modules/twt/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
 
   dontBuild = true;
 
-  installFlags = "PREFIX=$(out)";
+  installFlags = [ "PREFIX=$(out)" ];
 
   dontStrip = true;
 
diff --git a/pkgs/development/ocaml-modules/ulex/default.nix b/pkgs/development/ocaml-modules/ulex/default.nix
index ed868c30a44..d32fcf07b6c 100644
--- a/pkgs/development/ocaml-modules/ulex/default.nix
+++ b/pkgs/development/ocaml-modules/ulex/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ ocaml findlib ocamlbuild ];
   propagatedBuildInputs = [ camlp4 ];
 
-  buildFlags = "all all.opt";
+  buildFlags = [ "all" "all.opt" ];
 
   meta = {
     inherit (src.meta) homepage;
diff --git a/pkgs/development/ocaml-modules/yojson/default.nix b/pkgs/development/ocaml-modules/yojson/default.nix
index 24942da0072..dca97a53cbf 100644
--- a/pkgs/development/ocaml-modules/yojson/default.nix
+++ b/pkgs/development/ocaml-modules/yojson/default.nix
@@ -15,7 +15,7 @@ let
     extra = {
       createFindlibDestdir = true;
 
-      makeFlags = "PREFIX=$(out)";
+      makeFlags = [ "PREFIX=$(out)" ];
 
       preBuild = "mkdir $out/bin";
     };
diff --git a/pkgs/development/pure-modules/audio/default.nix b/pkgs/development/pure-modules/audio/default.nix
index 2cdab404c5f..cd1435d6599 100644
--- a/pkgs/development/pure-modules/audio/default.nix
+++ b/pkgs/development/pure-modules/audio/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ pure portaudio fftw libsndfile libsamplerate ];
-  makeFlags = "libdir=$(out)/lib prefix=$(out)/";
+  makeFlags = [ "libdir=$(out)/lib" "prefix=$(out)/" ];
   setupHook = ../generic-setup-hook.sh;
 
   meta = {
diff --git a/pkgs/development/pure-modules/avahi/default.nix b/pkgs/development/pure-modules/avahi/default.nix
index f94ee8d7637..8ce33e67efe 100644
--- a/pkgs/development/pure-modules/avahi/default.nix
+++ b/pkgs/development/pure-modules/avahi/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ pure avahi ];
-  makeFlags = "libdir=$(out)/lib prefix=$(out)/";
+  makeFlags = [ "libdir=$(out)/lib" "prefix=$(out)/" ];
   setupHook = ../generic-setup-hook.sh;
 
   meta = {
diff --git a/pkgs/development/pure-modules/csv/default.nix b/pkgs/development/pure-modules/csv/default.nix
index 846fb7e3730..7524823a5dc 100644
--- a/pkgs/development/pure-modules/csv/default.nix
+++ b/pkgs/development/pure-modules/csv/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ pure ];
-  makeFlags = "libdir=$(out)/lib prefix=$(out)/";
+  makeFlags = [ "libdir=$(out)/lib" "prefix=$(out)/" ];
   setupHook = ../generic-setup-hook.sh;
 
   meta = {
diff --git a/pkgs/development/pure-modules/doc/default.nix b/pkgs/development/pure-modules/doc/default.nix
index 54f99bf8afc..1a006c9eb8f 100644
--- a/pkgs/development/pure-modules/doc/default.nix
+++ b/pkgs/development/pure-modules/doc/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ pure ];
-  makeFlags = "libdir=$(out)/lib prefix=$(out)/";
+  makeFlags = [ "libdir=$(out)/lib" "prefix=$(out)/" ];
 
   meta = {
     description = "A simple utility for literate programming and documenting source code written in the Pure programming language";
diff --git a/pkgs/development/pure-modules/fastcgi/default.nix b/pkgs/development/pure-modules/fastcgi/default.nix
index ebd13743442..e41110386d7 100644
--- a/pkgs/development/pure-modules/fastcgi/default.nix
+++ b/pkgs/development/pure-modules/fastcgi/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ pure fcgi ];
-  makeFlags = "libdir=$(out)/lib prefix=$(out)/";
+  makeFlags = [ "libdir=$(out)/lib" "prefix=$(out)/" ];
   setupHook = ../generic-setup-hook.sh;
 
   meta = {
diff --git a/pkgs/development/pure-modules/faust/default.nix b/pkgs/development/pure-modules/faust/default.nix
index 74ec8e49343..e1c1b4d2d4b 100644
--- a/pkgs/development/pure-modules/faust/default.nix
+++ b/pkgs/development/pure-modules/faust/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ pure faust libtool ];
-  makeFlags = "libdir=$(out)/lib prefix=$(out)/";
+  makeFlags = [ "libdir=$(out)/lib" "prefix=$(out)/" ];
   setupHook = ../generic-setup-hook.sh;
 
   meta = {
diff --git a/pkgs/development/pure-modules/ffi/default.nix b/pkgs/development/pure-modules/ffi/default.nix
index efea0b4182c..4d019b5b699 100644
--- a/pkgs/development/pure-modules/ffi/default.nix
+++ b/pkgs/development/pure-modules/ffi/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ pure libffi ];
-  makeFlags = "libdir=$(out)/lib prefix=$(out)/";
+  makeFlags = [ "libdir=$(out)/lib" "prefix=$(out)/" ];
   setupHook = ../generic-setup-hook.sh;
 
   meta = {
diff --git a/pkgs/development/pure-modules/gen/default.nix b/pkgs/development/pure-modules/gen/default.nix
index 22bbb4d3be4..54ac78fd6c4 100644
--- a/pkgs/development/pure-modules/gen/default.nix
+++ b/pkgs/development/pure-modules/gen/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   hsEnv = haskellPackages.ghcWithPackages (hsPkgs : [hsPkgs.language-c]);
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ hsEnv pure ];
-  makeFlags = "libdir=$(out)/lib prefix=$(out)/";
+  makeFlags = [ "libdir=$(out)/lib" "prefix=$(out)/" ];
 
   meta = {
     description = "Pure interface generator";
diff --git a/pkgs/development/pure-modules/gl/default.nix b/pkgs/development/pure-modules/gl/default.nix
index b67a972b00b..34c13f99f92 100644
--- a/pkgs/development/pure-modules/gl/default.nix
+++ b/pkgs/development/pure-modules/gl/default.nix
@@ -12,7 +12,10 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ pure freeglut libGLU libGL xlibsWrapper ];
-  makeFlags = "libdir=$(out)/lib prefix=$(out)/";
+  makeFlags = [
+    "libdir=${placeholder ''out''}/lib"
+    "prefix=${placeholder ''out''}/"
+  ];
   setupHook = ../generic-setup-hook.sh;
 
   meta = {
diff --git a/pkgs/development/pure-modules/glpk/default.nix b/pkgs/development/pure-modules/glpk/default.nix
index 34d12f1471f..838e81b20ba 100644
--- a/pkgs/development/pure-modules/glpk/default.nix
+++ b/pkgs/development/pure-modules/glpk/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ pure glpkWithExtras ];
-  makeFlags = "libdir=$(out)/lib prefix=$(out)/";
+  makeFlags = [ "libdir=$(out)/lib" "prefix=$(out)/" ];
   setupHook = ../generic-setup-hook.sh;
 
   meta = {
diff --git a/pkgs/development/pure-modules/gplot/default.nix b/pkgs/development/pure-modules/gplot/default.nix
index d1657cdd445..c45f51509b7 100644
--- a/pkgs/development/pure-modules/gplot/default.nix
+++ b/pkgs/development/pure-modules/gplot/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ pure gnuplot ];
-  makeFlags = "libdir=$(out)/lib prefix=$(out)/";
+  makeFlags = [ "libdir=$(out)/lib" "prefix=$(out)/" ];
   setupHook = ../generic-setup-hook.sh;
 
   meta = {
diff --git a/pkgs/development/pure-modules/gsl/default.nix b/pkgs/development/pure-modules/gsl/default.nix
index 08aa674eb6b..847fe7538e9 100644
--- a/pkgs/development/pure-modules/gsl/default.nix
+++ b/pkgs/development/pure-modules/gsl/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ pure gsl ];
-  makeFlags = "libdir=$(out)/lib prefix=$(out)/";
+  makeFlags = [ "libdir=$(out)/lib" "prefix=$(out)/" ];
   setupHook = ../generic-setup-hook.sh;
 
   meta = {
diff --git a/pkgs/development/pure-modules/gtk/default.nix b/pkgs/development/pure-modules/gtk/default.nix
index a6a93f9ec95..1e7957ae382 100644
--- a/pkgs/development/pure-modules/gtk/default.nix
+++ b/pkgs/development/pure-modules/gtk/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ pure pure-ffi gtk2 ];
-  makeFlags = "libdir=$(out)/lib prefix=$(out)/";
+  makeFlags = [ "libdir=$(out)/lib" "prefix=$(out)/" ];
   setupHook = ../generic-setup-hook.sh;
 
   meta = {
diff --git a/pkgs/development/pure-modules/liblo/default.nix b/pkgs/development/pure-modules/liblo/default.nix
index 2dd0865f6ea..94ceef78908 100644
--- a/pkgs/development/pure-modules/liblo/default.nix
+++ b/pkgs/development/pure-modules/liblo/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ pure liblo ];
-  makeFlags = "libdir=$(out)/lib prefix=$(out)/";
+  makeFlags = [ "libdir=$(out)/lib" "prefix=$(out)/" ];
   setupHook = ../generic-setup-hook.sh;
 
   meta = {
diff --git a/pkgs/development/pure-modules/lilv/default.nix b/pkgs/development/pure-modules/lilv/default.nix
index 7f3638fe5c9..c0f50812946 100644
--- a/pkgs/development/pure-modules/lilv/default.nix
+++ b/pkgs/development/pure-modules/lilv/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ pure lilv lv2 serd sord sratom ];
-  makeFlags = "CFLAGS=-I${lilv}/include/lilv-0 libdir=$(out)/lib prefix=$(out)/";
+  makeFlags = [ "CFLAGS=-I${lilv}/include/lilv-0" "libdir=$(out)/lib" "prefix=$(out)/" ];
   setupHook = ../generic-setup-hook.sh;
 
   meta = {
diff --git a/pkgs/development/pure-modules/lv2/default.nix b/pkgs/development/pure-modules/lv2/default.nix
index 98556acbf28..b4a63eb7020 100644
--- a/pkgs/development/pure-modules/lv2/default.nix
+++ b/pkgs/development/pure-modules/lv2/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ pure lv2 ];
-  makeFlags = "libdir=$(out)/lib prefix=$(out)/";
+  makeFlags = [ "libdir=$(out)/lib" "prefix=$(out)/" ];
   setupHook = ../generic-setup-hook.sh;
 
   meta = {
diff --git a/pkgs/development/pure-modules/midi/default.nix b/pkgs/development/pure-modules/midi/default.nix
index 950c536e760..e55d4994455 100644
--- a/pkgs/development/pure-modules/midi/default.nix
+++ b/pkgs/development/pure-modules/midi/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ pure portmidi ];
-  makeFlags = "libdir=$(out)/lib prefix=$(out)/";
+  makeFlags = [ "libdir=$(out)/lib" "prefix=$(out)/" ];
   setupHook = ../generic-setup-hook.sh;
 
   meta = {
diff --git a/pkgs/development/pure-modules/mpfr/default.nix b/pkgs/development/pure-modules/mpfr/default.nix
index 63196fadf46..59617beb461 100644
--- a/pkgs/development/pure-modules/mpfr/default.nix
+++ b/pkgs/development/pure-modules/mpfr/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ pure ];
-  makeFlags = "libdir=$(out)/lib prefix=$(out)/";
+  makeFlags = [ "libdir=$(out)/lib" "prefix=$(out)/" ];
   setupHook = ../generic-setup-hook.sh;
 
   meta = {
diff --git a/pkgs/development/pure-modules/octave/default.nix b/pkgs/development/pure-modules/octave/default.nix
index 8fbb1dac320..e117d04a4cc 100644
--- a/pkgs/development/pure-modules/octave/default.nix
+++ b/pkgs/development/pure-modules/octave/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ pure octave ];
-  makeFlags = "libdir=$(out)/lib prefix=$(out)/";
+  makeFlags = [ "libdir=$(out)/lib" "prefix=$(out)/" ];
   setupHook = ../generic-setup-hook.sh;
 
   meta = {
diff --git a/pkgs/development/pure-modules/odbc/default.nix b/pkgs/development/pure-modules/odbc/default.nix
index 4ae1e58a7bc..69808d1aaf0 100644
--- a/pkgs/development/pure-modules/odbc/default.nix
+++ b/pkgs/development/pure-modules/odbc/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ pure libiodbc ];
-  makeFlags = "libdir=$(out)/lib prefix=$(out)/";
+  makeFlags = [ "libdir=$(out)/lib" "prefix=$(out)/" ];
   setupHook = ../generic-setup-hook.sh;
 
   meta = {
diff --git a/pkgs/development/pure-modules/pandoc/default.nix b/pkgs/development/pure-modules/pandoc/default.nix
index d5b0a7dbde5..17a16229b57 100644
--- a/pkgs/development/pure-modules/pandoc/default.nix
+++ b/pkgs/development/pure-modules/pandoc/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ pure ];
   propagatedBuildInputs = [ pandoc gawk getopt ];
-  makeFlags = "libdir=$(out)/lib prefix=$(out)/";
+  makeFlags = [ "libdir=$(out)/lib" "prefix=$(out)/" ];
   preInstall = ''
     mkdir -p $out/bin
     mkdir -p $out/share/man/man1
diff --git a/pkgs/development/pure-modules/rational/default.nix b/pkgs/development/pure-modules/rational/default.nix
index 20d61e5c362..547610fdf01 100644
--- a/pkgs/development/pure-modules/rational/default.nix
+++ b/pkgs/development/pure-modules/rational/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ pure ];
-  makeFlags = "libdir=$(out)/lib prefix=$(out)/";
+  makeFlags = [ "libdir=$(out)/lib" "prefix=$(out)/" ];
   setupHook = ../generic-setup-hook.sh;
 
   meta = {
diff --git a/pkgs/development/pure-modules/readline/default.nix b/pkgs/development/pure-modules/readline/default.nix
index a6bb2ed6167..d145788c552 100644
--- a/pkgs/development/pure-modules/readline/default.nix
+++ b/pkgs/development/pure-modules/readline/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ pure readline ];
-  makeFlags = "libdir=$(out)/lib prefix=$(out)/";
+  makeFlags = [ "libdir=$(out)/lib" "prefix=$(out)/" ];
   setupHook = ../generic-setup-hook.sh;
 
   meta = {
diff --git a/pkgs/development/pure-modules/sockets/default.nix b/pkgs/development/pure-modules/sockets/default.nix
index 235478a1776..aa8245bb12d 100644
--- a/pkgs/development/pure-modules/sockets/default.nix
+++ b/pkgs/development/pure-modules/sockets/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ pure ];
-  makeFlags = "libdir=$(out)/lib prefix=$(out)/";
+  makeFlags = [ "libdir=$(out)/lib" "prefix=$(out)/" ];
   setupHook = ../generic-setup-hook.sh;
 
   meta = {
diff --git a/pkgs/development/pure-modules/sql3/default.nix b/pkgs/development/pure-modules/sql3/default.nix
index 91ff3a446c2..aa3b2544af0 100644
--- a/pkgs/development/pure-modules/sql3/default.nix
+++ b/pkgs/development/pure-modules/sql3/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ pure sqlite ];
-  makeFlags = "libdir=$(out)/lib prefix=$(out)/";
+  makeFlags = [ "libdir=$(out)/lib" "prefix=$(out)/" ];
   setupHook = ../generic-setup-hook.sh;
 
   meta = {
diff --git a/pkgs/development/pure-modules/stldict/default.nix b/pkgs/development/pure-modules/stldict/default.nix
index 8c39b9791e0..b248a0084ff 100644
--- a/pkgs/development/pure-modules/stldict/default.nix
+++ b/pkgs/development/pure-modules/stldict/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ pure ];
-  makeFlags = "libdir=$(out)/lib prefix=$(out)/";
+  makeFlags = [ "libdir=$(out)/lib" "prefix=$(out)/" ];
   setupHook = ../generic-setup-hook.sh;
 
   meta = {
diff --git a/pkgs/development/pure-modules/stllib/default.nix b/pkgs/development/pure-modules/stllib/default.nix
index dd7a945182b..d29719891d2 100644
--- a/pkgs/development/pure-modules/stllib/default.nix
+++ b/pkgs/development/pure-modules/stllib/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ pure ];
-  makeFlags = "libdir=$(out)/lib prefix=$(out)/";
+  makeFlags = [ "libdir=$(out)/lib" "prefix=$(out)/" ];
   setupHook = ../generic-setup-hook.sh;
 
   meta = {
diff --git a/pkgs/development/pure-modules/tk/default.nix b/pkgs/development/pure-modules/tk/default.nix
index 03e322d74c0..d939a3b3ad4 100644
--- a/pkgs/development/pure-modules/tk/default.nix
+++ b/pkgs/development/pure-modules/tk/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ pure tcl tk xlibsWrapper ];
-  makeFlags = "libdir=$(out)/lib prefix=$(out)/";
+  makeFlags = [ "libdir=$(out)/lib" "prefix=$(out)/" ];
   setupHook = ../generic-setup-hook.sh;
 
   meta = {
diff --git a/pkgs/development/pure-modules/xml/default.nix b/pkgs/development/pure-modules/xml/default.nix
index 8e268611035..73753a5d34f 100644
--- a/pkgs/development/pure-modules/xml/default.nix
+++ b/pkgs/development/pure-modules/xml/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ pure libxml2 libxslt ];
-  makeFlags = "libdir=$(out)/lib prefix=$(out)/";
+  makeFlags = [ "libdir=$(out)/lib" "prefix=$(out)/" ];
   setupHook = ../generic-setup-hook.sh;
 
   meta = {
diff --git a/pkgs/development/python-modules/Babel/default.nix b/pkgs/development/python-modules/Babel/default.nix
index 97b35257820..ef86aedc527 100644
--- a/pkgs/development/python-modules/Babel/default.nix
+++ b/pkgs/development/python-modules/Babel/default.nix
@@ -11,14 +11,10 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ pytz ];
 
-  checkInputs = [ pytest freezegun glibcLocales ];
+  checkInputs = [ pytest freezegun ];
 
   doCheck = !stdenv.isDarwin;
 
-  preCheck = ''
-    export LC_ALL="en_US.UTF-8"
-  '';
-
   meta = with lib; {
     homepage = http://babel.edgewall.org;
     description = "A collection of tools for internationalizing Python applications";
diff --git a/pkgs/development/python-modules/JPype1/default.nix b/pkgs/development/python-modules/JPype1/default.nix
index 3e3d90f09d2..9198970cc42 100644
--- a/pkgs/development/python-modules/JPype1/default.nix
+++ b/pkgs/development/python-modules/JPype1/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "JPype1";
-  version = "0.7.0";
+  version = "0.7.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1630439d5b0fb49e2878b43a1a1f074f9d4f46520f525569e14f1f0f9399f871";
+    sha256 = "c16d01cde9c2c955d76d45675e64b06c3255784d49cea4147024e99a01fbbb18";
   };
 
   patches = [ ./set-compiler-language.patch ];
diff --git a/pkgs/development/python-modules/Pygments/default.nix b/pkgs/development/python-modules/Pygments/default.nix
index cb0986e1d7f..38636c9e31d 100644
--- a/pkgs/development/python-modules/Pygments/default.nix
+++ b/pkgs/development/python-modules/Pygments/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "Pygments";
-  version = "2.4.2";
+  version = "2.5.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "15v2sqm5g12bqa0c7wikfh9ck2nl97ayizy1hpqhmws5gqalq748";
+    sha256 = "98c8aa5a9f778fcd1026a17361ddaf7330d1b7c62ae97c3bb0ae73e0b9b6b0fe";
   };
 
   propagatedBuildInputs = [ docutils ];
diff --git a/pkgs/development/python-modules/Rtree/default.nix b/pkgs/development/python-modules/Rtree/default.nix
index 1ac721874da..867c771350c 100644
--- a/pkgs/development/python-modules/Rtree/default.nix
+++ b/pkgs/development/python-modules/Rtree/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "Rtree";
-  version = "0.9.2";
+  version = "0.9.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "6a34b25f588e1563e45af251a8469b43a125d972eb2fa66e9ce96ed29f06c454";
+    sha256 = "55c046a98e8d84235792de1f18635f680d7b4085264fbced6b073f28fcbe353a";
   };
 
   propagatedBuildInputs = [ libspatialindex ];
diff --git a/pkgs/development/python-modules/absl-py/default.nix b/pkgs/development/python-modules/absl-py/default.nix
index 5b0b9d19570..e7a2f120c1b 100644
--- a/pkgs/development/python-modules/absl-py/default.nix
+++ b/pkgs/development/python-modules/absl-py/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "absl-py";
-  version = "0.8.1";
+  version = "0.9.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d9129186431e150d7fe455f1cb1ecbb92bb5dba9da9bc3ef7b012d98c4db2526";
+    sha256 = "75e737d6ce7723d9ff9b7aa1ba3233c34be62ef18d5859e706b8fdc828989830";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/aioesphomeapi/default.nix b/pkgs/development/python-modules/aioesphomeapi/default.nix
index 5be6f9d86fd..dee85117406 100644
--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "aioesphomeapi";
-  version = "2.4.2";
+  version = "2.6.1";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e43e0fd628506f95752e90ab1579e5495183cc3c46915d0b0a062975cb5d181b";
+    sha256 = "139d1d348fcfe2f34926a210a32dff069935d17167c4e1cb66e8b039cbb4d6c1";
   };
 
   propagatedBuildInputs = [ attrs protobuf zeroconf ];
diff --git a/pkgs/development/python-modules/aiohttp/default.nix b/pkgs/development/python-modules/aiohttp/default.nix
index 6ac46b744a5..40dec3e1c1e 100644
--- a/pkgs/development/python-modules/aiohttp/default.nix
+++ b/pkgs/development/python-modules/aiohttp/default.nix
@@ -51,6 +51,7 @@ buildPythonPackage rec {
                and not connector \
                and not client_disconnect \
                and not handle_keepalive_on_closed_connection \
+               and not proxy_https_bad_response \
                and not partially_applied_handler \
                and not middleware" \
       --ignore=test_connector.py
diff --git a/pkgs/development/python-modules/aiohue/default.nix b/pkgs/development/python-modules/aiohue/default.nix
index 258d5f10c95..ede51da9ef1 100644
--- a/pkgs/development/python-modules/aiohue/default.nix
+++ b/pkgs/development/python-modules/aiohue/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "aiohue";
-  version = "1.9.2";
+  version = "1.10.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a7e545ae17658c10f2c5321e40b85426a8c284e5b33b5dfbe9171f9bdf37aa3e";
+    sha256 = "d95e51f15c442d769004774e7b4220155e32dc6c8ae834b035a2f0d8ff783ff0";
   };
 
   propagatedBuildInputs = [ aiohttp ];
diff --git a/pkgs/development/python-modules/alembic/default.nix b/pkgs/development/python-modules/alembic/default.nix
index da958cd8d97..72e7ae6417a 100644
--- a/pkgs/development/python-modules/alembic/default.nix
+++ b/pkgs/development/python-modules/alembic/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "alembic";
-  version = "1.2.1";
+  version = "1.3.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9f907d7e8b286a1cfb22db9084f9ce4fde7ad7956bb496dc7c952e10ac90e36a";
+    sha256 = "3b0cb1948833e062f4048992fbc97ecfaaaac24aaa0d83a1202a99fb58af8c6d";
   };
 
   buildInputs = [ pytest pytestcov mock coverage ];
diff --git a/pkgs/development/python-modules/altair/default.nix b/pkgs/development/python-modules/altair/default.nix
index 344a724756e..9cb362a7bd1 100644
--- a/pkgs/development/python-modules/altair/default.nix
+++ b/pkgs/development/python-modules/altair/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildPythonPackage, fetchPypi
+{ stdenv, buildPythonPackage, fetchPypi, isPy27
 , entrypoints
 , glibcLocales
 , ipython
@@ -18,11 +18,12 @@
 
 buildPythonPackage rec {
   pname = "altair";
-  version = "3.2.0";
+  version = "4.0.0";
+  disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "098macm0sw54xqijdy1c8cppcgw79wn52qdc71qqb51nibc17gls";
+    sha256 = "92dcd7b84c715f8e02bbdf37e36193a4af8138b5b064c05f237e6ed41573880a";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/annoy/default.nix b/pkgs/development/python-modules/annoy/default.nix
index e3d32e6a069..b836d4c93b5 100644
--- a/pkgs/development/python-modules/annoy/default.nix
+++ b/pkgs/development/python-modules/annoy/default.nix
@@ -5,12 +5,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "1.16.2";
+  version = "1.16.3";
   pname = "annoy";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "41348e813fe7125eda3e2229a075eba3d065173ba6c5f20c545bb9c2932633fa";
+    sha256 = "fe2779664bd8846f2d67191a7e6010b8df890ac4586336748fd0697f31654379";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/ansible-lint/default.nix b/pkgs/development/python-modules/ansible-lint/default.nix
index 50addec97c2..757ece55ead 100644
--- a/pkgs/development/python-modules/ansible-lint/default.nix
+++ b/pkgs/development/python-modules/ansible-lint/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "ansible-lint";
-  version = "4.1.1a0";
+  version = "4.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "00mw56a3lmdb5xvrzhahrzqv3wvxfz0mxl4n0qbkxzggf2pg0i8d";
+    sha256 = "eb925d8682d70563ccb80e2aca7b3edf84fb0b768cea3edc6846aac7abdc414a";
   };
 
   nativeBuildInputs = [ setuptools_scm ];
@@ -42,5 +42,6 @@ buildPythonPackage rec {
     description = "Best practices checker for Ansible";
     license = licenses.mit;
     maintainers = [ maintainers.sengaya ];
+    broken = true; # requires new flit to build
   };
 }
diff --git a/pkgs/development/python-modules/apispec/default.nix b/pkgs/development/python-modules/apispec/default.nix
index 217a921a634..1ed984fc718 100644
--- a/pkgs/development/python-modules/apispec/default.nix
+++ b/pkgs/development/python-modules/apispec/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "apispec";
-  version = "3.1.0";
+  version = "3.1.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0rr32z9hbf8w4w1fs5gj2v0ixcq2vq7a3wssrlxagi5ii7ygap7y";
+    sha256 = "24b8490c22310b0779a058ccb24ec2fef33d571bb5aba1f525ab5963b0eabcdd";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/argon2_cffi/default.nix b/pkgs/development/python-modules/argon2_cffi/default.nix
index 187e795416c..130a2c18917 100644
--- a/pkgs/development/python-modules/argon2_cffi/default.nix
+++ b/pkgs/development/python-modules/argon2_cffi/default.nix
@@ -12,11 +12,12 @@
 
 buildPythonPackage rec {
   pname = "argon2_cffi";
-  version = "19.1.0";
+  version = "19.2.0";
 
   src = fetchPypi {
-    inherit pname version;
-    sha256 = "81548a27b919861040cb928a350733f4f9455dd67c7d1ba92eb5960a1d7f8b26";
+    pname = "argon2-cffi";
+    inherit version;
+    sha256 = "ffaa623eea77b497ffbdd1a51e941b33d3bf552c60f14dbee274c4070677bda3";
   };
 
   propagatedBuildInputs = [ cffi six ] ++ lib.optional (!isPy3k) enum34;
diff --git a/pkgs/development/python-modules/ase/3.17.nix b/pkgs/development/python-modules/ase/3.17.nix
index dc251ac2ab2..3a466170c77 100644
--- a/pkgs/development/python-modules/ase/3.17.nix
+++ b/pkgs/development/python-modules/ase/3.17.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "ase";
-  version = "3.18.1";
+  version = "3.17.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e21948dbf79011cc796d772885a8aafb255a6f365d112fe6a3bd26198c6cac7f";
+    sha256 = "1d4gxypaahby45zcpl0rffcn2z7n55dg9lcd8sv6jjsmbbf9vr4g";
   };
 
   propagatedBuildInputs = [ numpy scipy matplotlib flask pillow psycopg2 ];
diff --git a/pkgs/development/python-modules/ase/default.nix b/pkgs/development/python-modules/ase/default.nix
index c84672e8abc..3aa5a432c4b 100644
--- a/pkgs/development/python-modules/ase/default.nix
+++ b/pkgs/development/python-modules/ase/default.nix
@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "ase";
-  version = "3.18.1";
+  version = "3.19.0";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0zxcdj61j9mxlgk2y4ax6rpml9gvmal8aa3pdmwwq4chyzdlh6g2";
+    sha256 = "a8378ab57e91cfe1ba09b3639d8409bb7fc1a40b59479c7822d206e673ad93f9";
   };
 
   propagatedBuildInputs = [ numpy scipy matplotlib flask pillow psycopg2 ];
diff --git a/pkgs/development/python-modules/astropy-helpers/default.nix b/pkgs/development/python-modules/astropy-helpers/default.nix
index fac97d2d368..93b2784902f 100644
--- a/pkgs/development/python-modules/astropy-helpers/default.nix
+++ b/pkgs/development/python-modules/astropy-helpers/default.nix
@@ -6,7 +6,7 @@
 
 buildPythonPackage rec {
   pname = "astropy-helpers";
-  version = "3.2.2";
+  version = "4.0.1";
 
   disabled = !isPy3k;
 
@@ -14,7 +14,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "cf32cb008b19597a1fe1a4d97f59734f30cd513aa3369a321e7b5b86cdb623fb";
+    sha256 = "f1096414d108778218d6bea06d4d9c7b2ff7c83856a451331ac194e74de9f413";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/astropy/default.nix b/pkgs/development/python-modules/astropy/default.nix
index fce2ecd392a..c23c15e1d4d 100644
--- a/pkgs/development/python-modules/astropy/default.nix
+++ b/pkgs/development/python-modules/astropy/default.nix
@@ -10,13 +10,13 @@
 
 buildPythonPackage rec {
   pname = "astropy";
-  version = "3.2.3";
+  version = "4.0";
 
   disabled = !isPy3k; # according to setup.py
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "47f00816c2978fdd10f448c8f0337d6dca7b8cbeaab4bf272b5fd37cb4b890d3";
+    sha256 = "404200e0baa84de09ac563ad9ccab3817e9b9669d0025cee74a8752f4bc2771b";
   };
 
   nativeBuildInputs = [ astropy-helpers ];
diff --git a/pkgs/development/python-modules/astunparse/default.nix b/pkgs/development/python-modules/astunparse/default.nix
index 8dbb4da7060..56570295dee 100644
--- a/pkgs/development/python-modules/astunparse/default.nix
+++ b/pkgs/development/python-modules/astunparse/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "astunparse";
-  version =  "1.6.2";
+  version =  "1.6.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "dab3e426715373fd76cd08bb1abe64b550f5aa494cf1e32384f26fd60961eb67";
+    sha256 = "5ad93a8456f0d084c3456d059fd9a92cce667963232cbf763eac3bc5b7940872";
   };
 
   propagatedBuildInputs = [ six wheel ];
diff --git a/pkgs/development/python-modules/asyncssh/default.nix b/pkgs/development/python-modules/asyncssh/default.nix
index da222f7e615..3d225079441 100644
--- a/pkgs/development/python-modules/asyncssh/default.nix
+++ b/pkgs/development/python-modules/asyncssh/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "asyncssh";
-  version = "1.18.0";
+  version = "2.1.0";
   disabled = pythonOlder "3.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1d9x7xpsqqd5scdk7f1c76lycgrxylaaf5qn4p46i8clfvm5a435";
+    sha256 = "19d0b4c65115d09b42ed21c748884157babfb3055a6e130ea349dfdcbcef3380";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/audio-metadata/default.nix b/pkgs/development/python-modules/audio-metadata/default.nix
index e21e04af6f5..d1ccef1ece4 100644
--- a/pkgs/development/python-modules/audio-metadata/default.nix
+++ b/pkgs/development/python-modules/audio-metadata/default.nix
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   postPatch = ''
     substituteInPlace setup.py \
       --replace "bidict>=0.17,<0.18" "bidict" \
-      --replace "more-itertools>=4.0,<5.0" "more-itertools"
+      --replace "more-itertools>=4.0,<8.0" "more-itertools"
   '';
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/autobahn/default.nix b/pkgs/development/python-modules/autobahn/default.nix
index bcda2b4b617..c3d95f8915c 100644
--- a/pkgs/development/python-modules/autobahn/default.nix
+++ b/pkgs/development/python-modules/autobahn/default.nix
@@ -4,11 +4,11 @@
 }:
 buildPythonPackage rec {
   pname = "autobahn";
-  version = "19.10.1";
+  version = "19.11.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "734385b00547448b3f30a752cbfd2900d15924d77dc4a1699b8bce1ea8899f39";
+    sha256 = "201b9879b49c6e259d4126dbafe9e3c73807de0c242d50065fbebc62c6ccb181";
   };
 
   propagatedBuildInputs = [ six txaio twisted zope_interface cffi cryptography pynacl ] ++
diff --git a/pkgs/development/python-modules/awkward/default.nix b/pkgs/development/python-modules/awkward/default.nix
index 2c5d562657b..8b375d16203 100644
--- a/pkgs/development/python-modules/awkward/default.nix
+++ b/pkgs/development/python-modules/awkward/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "awkward";
-  version = "0.12.17";
+  version = "0.12.18";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f794c926e726b3545035ffcb8e6defe6a4ea975c6266c0154024e4591739a253";
+    sha256 = "9b3df4f2be92ac7d16709f15769c97591f25f0442061f1a4cc8715feb268e45c";
   };
 
   nativeBuildInputs = [ pytestrunner ];
diff --git a/pkgs/development/python-modules/awkward1/default.nix b/pkgs/development/python-modules/awkward1/default.nix
index 6b515b56713..a35a97c5e02 100644
--- a/pkgs/development/python-modules/awkward1/default.nix
+++ b/pkgs/development/python-modules/awkward1/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "awkward1";
-  version = "0.1.28";
+  version = "0.1.38";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2269aca04c827549435e24f9976d27e904d02b74a30caa9a2a463225a8ba1609";
+    sha256 = "1c87defa8c1661ffe36f8a785fa9a60ae3b70484984a935e710cd8cb1f763fd7";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/python-modules/aws-adfs/default.nix b/pkgs/development/python-modules/aws-adfs/default.nix
index 0c16480e9c4..0f80b03811c 100644
--- a/pkgs/development/python-modules/aws-adfs/default.nix
+++ b/pkgs/development/python-modules/aws-adfs/default.nix
@@ -4,12 +4,12 @@
 
 buildPythonPackage rec {
   pname = "aws-adfs";
-  version = "1.20.0";
+  version = "1.21.2";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1j18ffq5z8bcajavnlpbfhxrcadld5iv5gsfxg543yvdsp6hn2dg";
+    sha256 = "ba96e71404474350b2c3ae4d5cb2dd25e9267b6d0680933c5711a51ea364e3bc";
   };
 
   # Relax version constraint
diff --git a/pkgs/development/python-modules/aws-sam-translator/default.nix b/pkgs/development/python-modules/aws-sam-translator/default.nix
index 298ce22daa6..732d5fba528 100644
--- a/pkgs/development/python-modules/aws-sam-translator/default.nix
+++ b/pkgs/development/python-modules/aws-sam-translator/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "aws-sam-translator";
-  version = "1.16.0";
+  version = "1.19.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0xvfbhiqdqy4qs4z8v2p7z3l01w5af948bmf400s5jsq2hnxl6nv";
+    sha256 = "a62f31ac81a9f36a89ba61b147c5df5819e73af3562859711191354d86836326";
   };
 
   # Tests are not included in the PyPI package
diff --git a/pkgs/development/python-modules/azure-common/default.nix b/pkgs/development/python-modules/azure-common/default.nix
index 0b46506960c..b842a66cd27 100644
--- a/pkgs/development/python-modules/azure-common/default.nix
+++ b/pkgs/development/python-modules/azure-common/default.nix
@@ -9,14 +9,14 @@
 }:
 
 buildPythonPackage rec {
-  version = "1.1.23";
+  version = "1.1.24";
   pname = "azure-common";
   disabled = isPyPy;
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "53b1195b8f20943ccc0e71a17849258f7781bc6db1c72edc7d6c055f79bd54e3";
+    sha256 = "184ad6a05a3089dfdc1ce07c1cbfa489bbc45b5f6f56e848cac0851e6443da21";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/azure-core/default.nix b/pkgs/development/python-modules/azure-core/default.nix
new file mode 100644
index 00000000000..ee134762149
--- /dev/null
+++ b/pkgs/development/python-modules/azure-core/default.nix
@@ -0,0 +1,48 @@
+{ lib, buildPythonPackage, fetchPypi, isPy27
+, aiodns
+, aiohttp
+, msrest
+, pytest
+, pytestCheckHook
+, requests
+, six
+, trio
+, typing-extensions
+}:
+
+buildPythonPackage rec {
+  version = "1.1.1";
+  pname = "azure-core";
+  disabled = isPy27;
+
+  src = fetchPypi {
+    inherit pname version;
+    extension = "zip";
+    sha256 = "00jm43gw89n446zdm18qziwd85lsx1gandxpmw62dc1bdnsfakxl";
+  };
+
+  propagatedBuildInputs = [
+    requests
+    six
+  ];
+
+  checkInputs = [
+    aiodns
+    aiohttp
+    msrest
+    pytest
+    pytestCheckHook
+    trio
+    typing-extensions
+  ];
+
+  pytestFlagsArray = [ "tests/" ];
+  disabledTests = [ "response" "request" "timeout" ];
+
+  meta = with lib; {
+    description = "Microsoft Azure Core Library for Python";
+    homepage = "https://github.com/Azure/azure-sdk-for-python";
+    license = licenses.mit;
+    maintainers = with maintainers; [ jonringer ];
+  };
+}
diff --git a/pkgs/development/python-modules/azure-keyvault-keys/default.nix b/pkgs/development/python-modules/azure-keyvault-keys/default.nix
new file mode 100644
index 00000000000..34629e6eb48
--- /dev/null
+++ b/pkgs/development/python-modules/azure-keyvault-keys/default.nix
@@ -0,0 +1,47 @@
+{ lib, buildPythonPackage, isPy27, fetchPypi
+, aiohttp
+, azure-common
+, azure-core
+, azure-nspkg
+, cryptography
+, msrest
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "azure-keyvault-keys";
+  version = "4.0.0";
+  disabled = isPy27;
+
+  src = fetchPypi {
+    inherit pname version;
+    extension = "zip";
+    sha256 = "1l1fwm8plzr5zbv02nlvs0i8ssmd88cxm5lb19i54b3scci77hiq";
+  };
+
+  propagatedBuildInputs = [
+    azure-common
+    azure-core
+    msrest
+    cryptography
+  ];
+
+  # requires relative paths to utilities in the mono-repo
+  doCheck = false;
+  checkInputs = [ aiohttp pytestCheckHook ];
+
+  pythonImportsCheck = [
+    "azure"
+    "azure.core"
+    "azure.common"
+    "azure.keyvault"
+    "azure.keyvault.keys"
+  ];
+
+  meta = with lib; {
+    description = "Microsoft Azure Key Vault Keys Client Library for Python";
+    homepage = "https://github.com/Azure/azure-sdk-for-python";
+    license = licenses.mit;
+    maintainers = with maintainers; [ jonringer ];
+  };
+}
diff --git a/pkgs/development/python-modules/azure-keyvault-secrets/default.nix b/pkgs/development/python-modules/azure-keyvault-secrets/default.nix
new file mode 100644
index 00000000000..e2b40c29d85
--- /dev/null
+++ b/pkgs/development/python-modules/azure-keyvault-secrets/default.nix
@@ -0,0 +1,33 @@
+{ lib, buildPythonPackage, fetchPypi, isPy27
+, azure-common
+, azure-core
+, msrest
+}:
+
+buildPythonPackage rec {
+  pname = "azure-keyvault-secrets";
+  version = "4.0.0";
+  disabled = isPy27;
+
+  src = fetchPypi {
+    inherit pname version;
+    extension = "zip";
+    sha256 = "066p4x2ixasz6qbxss2ilchl73w1kh2nc32lgh8qygl3d90059lp";
+  };
+
+  propagatedBuildInputs = [
+    azure-common
+    azure-core
+    msrest
+  ];
+
+  # requires checkout from mono-repo
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Microsoft Azure Key Vault Secrets Client Library for Python";
+    homepage = "https://github.com/Azure/azure-sdk-for-python";
+    license = licenses.mit;
+    maintainers = with maintainers; [ jonringer ];
+  };
+}
diff --git a/pkgs/development/python-modules/azure-keyvault/default.nix b/pkgs/development/python-modules/azure-keyvault/default.nix
index 91f31ec0a01..b6f7f1d70d4 100644
--- a/pkgs/development/python-modules/azure-keyvault/default.nix
+++ b/pkgs/development/python-modules/azure-keyvault/default.nix
@@ -1,44 +1,36 @@
-{ lib
-, buildPythonPackage
-, python
-, isPy3k
-, fetchPypi
-, azure-common
-, azure-nspkg
-, msrest
-, msrestazure
-, cryptography
+{ lib, buildPythonPackage, isPy27, fetchPypi
+, azure-keyvault-keys
+, azure-keyvault-secrets
 }:
 
 buildPythonPackage rec {
   pname = "azure-keyvault";
-  version = "1.1.0";
+  version = "4.0.0";
+  disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "37a8e5f376eb5a304fcd066d414b5d93b987e68f9212b0c41efa37d429aadd49";
+    sha256 = "e85f5bd6cb4f10b3248b99bbf02e3acc6371d366846897027d4153f18025a2d7";
   };
 
   propagatedBuildInputs = [
-    azure-common
-    azure-nspkg
-    msrest
-    msrestazure
-    cryptography
+    azure-keyvault-keys
+    azure-keyvault-secrets
   ];
 
-  postInstall = lib.optionalString isPy3k ''
-    rm $out/${python.sitePackages}/azure/__init__.py
-  '';
-
-  # has no tests
+  # this is just a meta package, which contains keys and secrets
   doCheck = false;
 
+  pythonImportsCheck = [
+    "azure.keyvault.keys"
+    "azure.keyvault.secrets"
+  ];
+
   meta = with lib; {
     description = "This is the Microsoft Azure Key Vault Client Library";
     homepage = "https://github.com/Azure/azure-sdk-for-python";
     license = licenses.mit;
-    maintainers = with maintainers; [ mwilsoninsight ];
+    maintainers = with maintainers; [ jonringer ];
   };
 }
diff --git a/pkgs/development/python-modules/azure-mgmt-cdn/default.nix b/pkgs/development/python-modules/azure-mgmt-cdn/default.nix
index bbee8b39993..da6d1639a13 100644
--- a/pkgs/development/python-modules/azure-mgmt-cdn/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-cdn/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-cdn";
-  version = "3.1.0";
+  version = "4.0.0";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "0cdbe0914aec544884ef681e31950efa548d9bec6d6dc354e00c3dbdab9e76e3";
+    sha256 = "a53e9e09e2711ce9109329538fe9a8a1a5d0809efb231d7df481e55d09c4f02a";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/azure-mgmt-consumption/default.nix b/pkgs/development/python-modules/azure-mgmt-consumption/default.nix
index b69e4b649de..de4a1338611 100644
--- a/pkgs/development/python-modules/azure-mgmt-consumption/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-consumption/default.nix
@@ -24,9 +24,10 @@ buildPythonPackage rec {
     azure-mgmt-nspkg
   ];
 
+  # still needed when overriding to previous versions
+  # E.g. azure-cli
   postInstall = lib.optionalString isPy3k ''
-    rm $out/${python.sitePackages}/azure/__init__.py
-    rm $out/${python.sitePackages}/azure/mgmt/__init__.py
+    rm -f $out/${python.sitePackages}/azure/{,mgmt/}__init__.py
   '';
 
   # has no tests
diff --git a/pkgs/development/python-modules/azure-mgmt-containerservice/default.nix b/pkgs/development/python-modules/azure-mgmt-containerservice/default.nix
index 2d98f57f1ba..5d1e3e6e3a9 100644
--- a/pkgs/development/python-modules/azure-mgmt-containerservice/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-containerservice/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-containerservice";
-  version = "8.0.0";
+  version = "8.1.0";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "8fa3d3ac8a88ad6fd25f87966c27049864780d88b7b946d06da310d945a8772a";
+    sha256 = "21fabdd393ba2ff1162a490cfa0d2b72a715da8462b1645bd986241137fc771f";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/azure-mgmt-cosmosdb/default.nix b/pkgs/development/python-modules/azure-mgmt-cosmosdb/default.nix
index aef56be79c0..45542c8e9d5 100644
--- a/pkgs/development/python-modules/azure-mgmt-cosmosdb/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-cosmosdb/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-cosmosdb";
-  version = "0.9.0";
+  version = "0.11.0";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "0y28z30g7y2pj7rfxyxmqpr19z24d01g9qhafvjxry748im1961h";
+    sha256 = "3f6c1369903856864c7e4a05c2c261563153597172b182382d6332f3acd04016";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/azure-mgmt-datamigration/default.nix b/pkgs/development/python-modules/azure-mgmt-datamigration/default.nix
index 7fc7c568301..93c294e4be9 100644
--- a/pkgs/development/python-modules/azure-mgmt-datamigration/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-datamigration/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-datamigration";
-  version = "3.0.0";
+  version = "4.0.0";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "0pc5pf7jpkpdrad5hafh2hki01dpx5773whp6kpxp71gh265mm5n";
+    sha256 = "1efda568d67af911156591eb308432b5f9a56075b57ac0a5dd9f7aee17d79217";
   };
 
   propagatedBuildInputs = [
@@ -27,9 +27,10 @@ buildPythonPackage rec {
     azure-mgmt-nspkg
   ];
 
+  # still needed when overriding to previous versions
+  # E.g. azure-cli
   postInstall = lib.optionalString isPy3k ''
-    rm $out/${python.sitePackages}/azure/__init__.py
-    rm $out/${python.sitePackages}/azure/mgmt/__init__.py
+    rm -f $out/${python.sitePackages}/azure/{,mgmt/}__init__.py
   '';
 
   # has no tests
diff --git a/pkgs/development/python-modules/azure-mgmt-devtestlabs/default.nix b/pkgs/development/python-modules/azure-mgmt-devtestlabs/default.nix
index 546ec5ab840..756af164a71 100644
--- a/pkgs/development/python-modules/azure-mgmt-devtestlabs/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-devtestlabs/default.nix
@@ -27,9 +27,10 @@ buildPythonPackage rec {
     azure-mgmt-nspkg
   ];
 
+  # still needed when overriding to previous versions
+  # E.g. azure-cli
   postInstall = lib.optionalString isPy3k ''
-    rm $out/${python.sitePackages}/azure/__init__.py
-    rm $out/${python.sitePackages}/azure/mgmt/__init__.py
+    rm -f $out/${python.sitePackages}/azure/{,mgmt/}__init__.py
   '';
 
   # has no tests
diff --git a/pkgs/development/python-modules/azure-mgmt-dns/default.nix b/pkgs/development/python-modules/azure-mgmt-dns/default.nix
index 89ae5912b39..0f1527f688b 100644
--- a/pkgs/development/python-modules/azure-mgmt-dns/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-dns/default.nix
@@ -26,9 +26,10 @@ buildPythonPackage rec {
     azure-mgmt-nspkg
   ];
 
+  # this is still needed for when the version is overrided
+  # to previous versions. E.g azure-cli
   postInstall = lib.optionalString isPy3k ''
-    rm $out/${python.sitePackages}/azure/__init__.py
-    rm $out/${python.sitePackages}/azure/mgmt/__init__.py
+    rm -f $out/${python.sitePackages}/azure/{,mgmt/}__init__.py
   '';
 
   # has no tests
diff --git a/pkgs/development/python-modules/azure-mgmt-hanaonazure/default.nix b/pkgs/development/python-modules/azure-mgmt-hanaonazure/default.nix
index c8b6ebfba63..789784babfb 100644
--- a/pkgs/development/python-modules/azure-mgmt-hanaonazure/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-hanaonazure/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-hanaonazure";
-  version = "0.10.0";
+  version = "0.12.0";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "01gnrhwi3nswjdxk9fjjwbyyx83agpdksrksk0c4d7bm9p2871g6";
+    sha256 = "cc844a152079e0d18fb5f47663a24cb204982925425c1fb51bac53894885000b";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/azure-mgmt-hdinsight/default.nix b/pkgs/development/python-modules/azure-mgmt-hdinsight/default.nix
index 82955674c4b..6cda959448c 100644
--- a/pkgs/development/python-modules/azure-mgmt-hdinsight/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-hdinsight/default.nix
@@ -5,13 +5,13 @@
 }:
 
 buildPythonPackage rec {
-  version = "1.2.0";
+  version = "1.3.0";
   pname = "azure-mgmt-hdinsight";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1yq9s7a2ch8j84af3hzj350jnjq5s3ysiqvmypvcb7vl6rkkd2lm";
+    sha256 = "55e129da3c3750cd5a26b91035990590a3f97aef4971de62d84de00f4fd6f1e4";
     extension = "zip";
   };
 
diff --git a/pkgs/development/python-modules/azure-mgmt-keyvault/default.nix b/pkgs/development/python-modules/azure-mgmt-keyvault/default.nix
index e3529bda8d2..26918fbd7db 100644
--- a/pkgs/development/python-modules/azure-mgmt-keyvault/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-keyvault/default.nix
@@ -26,9 +26,10 @@ buildPythonPackage rec {
     azure-mgmt-nspkg
   ];
 
+  # this is still need when overriding to prevoius versions
+  # E.g. azure-cli
   postInstall = lib.optionalString isPy3k ''
-    rm $out/${python.sitePackages}/azure/__init__.py
-    rm $out/${python.sitePackages}/azure/mgmt/__init__.py
+    rm -f $out/${python.sitePackages}/azure/{,mgmt/}__init__.py
   '';
 
   # has no tests
diff --git a/pkgs/development/python-modules/azure-mgmt-media/default.nix b/pkgs/development/python-modules/azure-mgmt-media/default.nix
index d86b7f40d4b..90b45d0e3f0 100644
--- a/pkgs/development/python-modules/azure-mgmt-media/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-media/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-media";
-  version = "1.1.1";
+  version = "2.0.0";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "5d0c6b3a0f882dde8ae3d42467f03ea6c4e3f62613936087d54c67e6f504939b";
+    sha256 = "b144e66cb8b947b871354edbcee15b78e107fb8f3a337d46d04cd8b73300741b";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/azure-mgmt-msi/default.nix b/pkgs/development/python-modules/azure-mgmt-msi/default.nix
index 87e70c2fdcc..328e81c8fe7 100644
--- a/pkgs/development/python-modules/azure-mgmt-msi/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-msi/default.nix
@@ -26,9 +26,10 @@ buildPythonPackage rec {
     azure-mgmt-nspkg
   ];
 
+  # still needed when overriding to previous versions
+  # E.g. azure-cli
   postInstall = lib.optionalString isPy3k ''
-    rm $out/${python.sitePackages}/azure/__init__.py
-    rm $out/${python.sitePackages}/azure/mgmt/__init__.py
+    rm -f $out/${python.sitePackages}/azure/{,mgmt/}__init__.py
   '';
 
   # has no tests
diff --git a/pkgs/development/python-modules/azure-mgmt-relay/default.nix b/pkgs/development/python-modules/azure-mgmt-relay/default.nix
index 5046bf8740f..b60a82a7b1a 100644
--- a/pkgs/development/python-modules/azure-mgmt-relay/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-relay/default.nix
@@ -24,9 +24,10 @@ buildPythonPackage rec {
     azure-mgmt-nspkg
   ];
 
+  # still needed when overriding to previous versions
+  # E.g. azure-cli
   postInstall = lib.optionalString isPy3k ''
-    rm $out/${python.sitePackages}/azure/__init__.py
-    rm $out/${python.sitePackages}/azure/mgmt/__init__.py
+    rm -f $out/${python.sitePackages}/azure/{,mgmt/}__init__.py
   '';
 
   # has no tests
diff --git a/pkgs/development/python-modules/azure-mgmt-resource/default.nix b/pkgs/development/python-modules/azure-mgmt-resource/default.nix
index 4f2481097e1..8f9128a62a0 100644
--- a/pkgs/development/python-modules/azure-mgmt-resource/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-resource/default.nix
@@ -8,13 +8,13 @@
 
 
 buildPythonPackage rec {
-  version = "6.0.0";
+  version = "7.0.0";
   pname = "azure-mgmt-resource";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "08n6r6ja7p20qlhb9pp51nwwxz2mal19an98zry276i8z5x8ckp0";
+    sha256 = "eaea8b5d05495d1b74220052275d46b6bed93b59245bcaa747279a52e41c3bdf";
   };
 
   postInstall = if isPy3k then "" else ''
diff --git a/pkgs/development/python-modules/azure-mgmt-servicefabric/default.nix b/pkgs/development/python-modules/azure-mgmt-servicefabric/default.nix
index 9c849829a12..03084e11cf3 100644
--- a/pkgs/development/python-modules/azure-mgmt-servicefabric/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-servicefabric/default.nix
@@ -26,9 +26,10 @@ buildPythonPackage rec {
     azure-mgmt-nspkg
   ];
 
+  # this is still needed for overriding to previous versions
+  # E.g azure-cli
   postInstall = lib.optionalString isPy3k ''
-    rm $out/${python.sitePackages}/azure/__init__.py
-    rm $out/${python.sitePackages}/azure/mgmt/__init__.py
+    rm -f $out/${python.sitePackages}/azure/{,mgmt/}__init__.py
   '';
 
   # has no tests
diff --git a/pkgs/development/python-modules/azure-mgmt-sql/default.nix b/pkgs/development/python-modules/azure-mgmt-sql/default.nix
index 5a5a708a5dd..0929ca3ff5c 100644
--- a/pkgs/development/python-modules/azure-mgmt-sql/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-sql/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-sql";
-  version = "0.15.0";
+  version = "0.16.0";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "0qv58xraznv2ldhd34cvznhz045x3ncfgam9c12gxyj4q0k3pyc9";
+    sha256 = "ddbdc29c1dca437275b0cb5a6fe2d86fa6886ccefb2270287357f07afe80a4ac";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/azure-mgmt-storage/default.nix b/pkgs/development/python-modules/azure-mgmt-storage/default.nix
index c2b172e6c49..552b1c88792 100644
--- a/pkgs/development/python-modules/azure-mgmt-storage/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-storage/default.nix
@@ -7,13 +7,13 @@
 }:
 
 buildPythonPackage rec {
-  version = "6.0.0";
+  version = "7.0.0";
   pname = "azure-mgmt-storage";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "0pgmxr8shz6rmgbacfy1xb99y9ja38ck1lap0n58m6jjy1mgxk2w";
+    sha256 = "7f5e6b18dee267c99f08f6a716a93173bbae433c8665f5c59153fb1a963bc105";
   };
 
   postInstall = if isPy3k then "" else ''
diff --git a/pkgs/development/python-modules/azure-servicebus/default.nix b/pkgs/development/python-modules/azure-servicebus/default.nix
index 7656e7c6376..02460b27952 100644
--- a/pkgs/development/python-modules/azure-servicebus/default.nix
+++ b/pkgs/development/python-modules/azure-servicebus/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "azure-servicebus";
-  version = "0.50.1";
+  version = "0.50.2";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "0i8ls5h2ny12h9gnqwyq13ysvxgdq7b1kxirj4n58dfy94a182gv";
+    sha256 = "836649d510aa2b7467bc87d8dab18f2db917b63aa2fe8f3e5d0bb44011e465f5";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/azure-servicefabric/default.nix b/pkgs/development/python-modules/azure-servicefabric/default.nix
index 79d303a4652..19420b0526d 100644
--- a/pkgs/development/python-modules/azure-servicefabric/default.nix
+++ b/pkgs/development/python-modules/azure-servicefabric/default.nix
@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "azure-servicefabric";
-  version = "6.5.0.0";
+  version = "7.0.0.0";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "02q32rc3vmg3kpi92s2y2ic47s3mi9qjcvzvrpjdlzji8lhd9w45";
+    sha256 = "27712658fed7f5db6965d1035bbc0f3b16964fc88d6f3ad3e86cf4fae2b01bb9";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/backports_functools_lru_cache/default.nix b/pkgs/development/python-modules/backports_functools_lru_cache/default.nix
index 2a8b5e7960d..8cb84c02b37 100644
--- a/pkgs/development/python-modules/backports_functools_lru_cache/default.nix
+++ b/pkgs/development/python-modules/backports_functools_lru_cache/default.nix
@@ -4,23 +4,27 @@
 , setuptools_scm
 , isPy3k
 , pytest
+, pytest-black
+, pytest-flake8
+, pytestcov
 }:
 
 buildPythonPackage rec {
   pname = "backports.functools_lru_cache";
-  version = "1.5";
+  version = "1.6.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9d98697f088eb1b0fa451391f91afb5e3ebde16bbdb272819fd091151fda4f1a";
+    sha256 = "8fde5f188da2d593bd5bc0be98d9abc46c95bb8a9dde93429570192ee6cc2d4a";
   };
 
-  buildInputs = [ setuptools_scm ];
-
-  checkInputs = [ pytest ];
+  nativeBuildInputs = [ setuptools_scm ];
 
+  checkInputs = [ pytest pytest-flake8 pytest-black pytestcov ];
+  # ironically, they fail a linting test, and pytest.ini forces that test suite
   checkPhase = ''
-    pytest
+    rm backports/functools_lru_cache.py
+    pytest -k 'not format'
   '';
 
   # Test fail on Python 2
@@ -31,4 +35,4 @@ buildPythonPackage rec {
     homepage = https://github.com/jaraco/backports.functools_lru_cache;
     license = lib.licenses.mit;
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/development/python-modules/bayespy/default.nix b/pkgs/development/python-modules/bayespy/default.nix
index 430e7c3da8a..210fbbe2176 100644
--- a/pkgs/development/python-modules/bayespy/default.nix
+++ b/pkgs/development/python-modules/bayespy/default.nix
@@ -4,7 +4,7 @@
 
 buildPythonPackage rec {
   pname = "bayespy";
-  version = "0.5.18";
+  version = "0.5.19";
 
   # Python 2 not supported and not some old Python 3 because MPL doesn't support
   # them properly.
@@ -12,7 +12,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "86c453d827b8d6c3574ec306f6fadfc5028614e1cd46676841336e6787a7496a";
+    sha256 = "24e1327ce241a0113abf217fbaf41ac25e04f5a01f9ed606610f2f1f2d82d34f";
   };
 
   checkInputs = [ pytest glibcLocales ];
diff --git a/pkgs/development/python-modules/beautifulsoup4/default.nix b/pkgs/development/python-modules/beautifulsoup4/default.nix
index c8e8c100616..1720738b169 100644
--- a/pkgs/development/python-modules/beautifulsoup4/default.nix
+++ b/pkgs/development/python-modules/beautifulsoup4/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "beautifulsoup4";
-  version = "4.8.1";
+  version = "4.8.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "6135db2ba678168c07950f9a16c4031822c6f4aec75a65e0a97bc5ca09789931";
+    sha256 = "05fd825eb01c290877657a56df4c6e4c311b3965bda790c613a3d6fb01a5462a";
   };
 
   checkInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/bids-validator/default.nix b/pkgs/development/python-modules/bids-validator/default.nix
index ec66124e3c7..6b7bad58bc4 100644
--- a/pkgs/development/python-modules/bids-validator/default.nix
+++ b/pkgs/development/python-modules/bids-validator/default.nix
@@ -4,12 +4,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "1.2.4";
+  version = "1.3.12";
   pname = "bids-validator";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1mvp1mi1k6yqgyj7rxij8mlwclqlyfzq08s67v0qaycw44l68ifg";
+    sha256 = "7a244b09adfd083292ed1f7ff335676a1e2effbbffe62b02a4abaf377d33ef86";
   };
 
   propagatedBuildInputs = [ ];
diff --git a/pkgs/development/python-modules/bitarray/default.nix b/pkgs/development/python-modules/bitarray/default.nix
index 3c84366c9d1..f119aedc4b8 100644
--- a/pkgs/development/python-modules/bitarray/default.nix
+++ b/pkgs/development/python-modules/bitarray/default.nix
@@ -1,12 +1,12 @@
 { lib, buildPythonPackage, fetchPypi }:
 
 buildPythonPackage rec {
-  version = "1.1.0";
+  version = "1.2.0";
   pname = "bitarray";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0nv1283qcfilhnb4q6znlijply6lfxwpvp10cr0v33l0qwa86mwz";
+    sha256 = "4f8706b651243c9faa981f075bcbdef2fab83e9b9bc9211ed2cb5849f9a68342";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/bjoern/default.nix b/pkgs/development/python-modules/bjoern/default.nix
index ddbb2f0d27e..08caabef3bd 100644
--- a/pkgs/development/python-modules/bjoern/default.nix
+++ b/pkgs/development/python-modules/bjoern/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "bjoern";
-  version = "3.0.1";
+  version = "3.1.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1ajmmfzr6fm8h8s7m69f2ffx0wk6snjvdx527hhj00bzn7zybnmn";
+    sha256 = "01f3b601cf0ab0a9c7cb9c8f944ab7c738baaa6043ca82db20e9bd7a9be5767b";
   };
 
   buildInputs = [ libev ];
diff --git a/pkgs/development/python-modules/bleach/default.nix b/pkgs/development/python-modules/bleach/default.nix
index 86b253a72c9..1033f9def76 100644
--- a/pkgs/development/python-modules/bleach/default.nix
+++ b/pkgs/development/python-modules/bleach/default.nix
@@ -24,10 +24,9 @@ buildPythonPackage rec {
     substituteInPlace setup.py --replace ",<3dev" ""
   '';
 
-  # Disable a test
-  # https://github.com/mozilla/bleach/issues/467
+  # Disable network tests
   checkPhase = ''
-    pytest -k "not test_only_text_is_cleaned"
+    pytest -k "not protocols"
   '';
 
   meta = {
diff --git a/pkgs/development/python-modules/bokeh/default.nix b/pkgs/development/python-modules/bokeh/default.nix
index c92f299f919..18f59b05288 100644
--- a/pkgs/development/python-modules/bokeh/default.nix
+++ b/pkgs/development/python-modules/bokeh/default.nix
@@ -1,7 +1,7 @@
 { buildPythonPackage
 , fetchPypi
 , futures
-, isPy3k
+, isPy27
 , isPyPy
 , jinja2
 , lib
@@ -22,11 +22,11 @@
 
 buildPythonPackage rec {
   pname = "bokeh";
-  version = "1.3.4";
+  version = "1.4.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0m27j29jpi977y95k272xc24qkl5bkniy046cil116hrbgnppng2";
+    sha256 = "1rywd6c6hi0c6yg18j5zxssjd07a5hafcd21xr3q2yvp3aj3h3f6";
   };
 
   patches = [
@@ -39,7 +39,12 @@ buildPythonPackage rec {
 
   disabled = isPyPy;
 
-  checkInputs = [ mock pytest pillow selenium ];
+  checkInputs = [
+    mock
+    pytest
+    pillow
+    selenium
+  ];
 
   propagatedBuildInputs = [
     pillow
@@ -51,7 +56,9 @@ buildPythonPackage rec {
     numpy
     packaging
   ]
-  ++ lib.optionals ( !isPy3k ) [ futures ];
+  ++ lib.optionals ( isPy27 ) [
+    futures
+  ];
 
   checkPhase = ''
     ${python.interpreter} -m unittest discover -s bokeh/tests
diff --git a/pkgs/development/python-modules/boltztrap2/default.nix b/pkgs/development/python-modules/boltztrap2/default.nix
index df10288905d..d89cf3c615d 100644
--- a/pkgs/development/python-modules/boltztrap2/default.nix
+++ b/pkgs/development/python-modules/boltztrap2/default.nix
@@ -14,13 +14,13 @@
 }:
 
 buildPythonPackage rec {
-  version = "19.7.3";
+  version = "19.11.1";
   pname = "BoltzTraP2";
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1hambr925ml2v2zcxnmnpi39395gl2928yac4p2kghk9xicymraw";
+    sha256 = "3927ae782b7329dede2bf85ff5ff328c88f0514ecb592267e28912340f395d3e";
   };
 
   dontUseCmakeConfigure = true;
diff --git a/pkgs/development/python-modules/breathe/default.nix b/pkgs/development/python-modules/breathe/default.nix
index 08e37e2773c..d2b19ae8650 100644
--- a/pkgs/development/python-modules/breathe/default.nix
+++ b/pkgs/development/python-modules/breathe/default.nix
@@ -1,12 +1,13 @@
-{ lib, fetchPypi, buildPythonPackage, docutils, six, sphinx, isPy3k }:
+{ lib, fetchPypi, buildPythonPackage, docutils, six, sphinx, isPy3k, isPy27 }:
 
 buildPythonPackage rec {
-  version = "4.13.1";
+  version = "4.14.0";
   pname = "breathe";
+  disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c6752345252f48092bf72a450fd9e84367bd5b4af99d86c92047f82c6c2287ab";
+    sha256 = "178848e4088faf8c2c60f000379fcabfb3411b260e0fbddc08fb57e0e5caea08";
   };
 
   propagatedBuildInputs = [ docutils six sphinx ];
diff --git a/pkgs/development/python-modules/broadlink/default.nix b/pkgs/development/python-modules/broadlink/default.nix
index af03e1ad665..99d7641c07e 100644
--- a/pkgs/development/python-modules/broadlink/default.nix
+++ b/pkgs/development/python-modules/broadlink/default.nix
@@ -1,5 +1,5 @@
 { lib, fetchPypi, buildPythonPackage
-, pyaes, pycrc }:
+, cryptography, pyaes, pycrc }:
 
 buildPythonPackage rec {
   pname = "broadlink";
@@ -15,7 +15,7 @@ buildPythonPackage rec {
       --replace pyaes==1.6.0 pyaes
     '';
 
-  propagatedBuildInputs = [ pyaes pycrc ];
+  propagatedBuildInputs = [ cryptography pyaes pycrc ];
 
   # no tests available
   doCheck = false;
diff --git a/pkgs/development/python-modules/browser-cookie3/default.nix b/pkgs/development/python-modules/browser-cookie3/default.nix
index 807dafab436..13eea3e21fd 100644
--- a/pkgs/development/python-modules/browser-cookie3/default.nix
+++ b/pkgs/development/python-modules/browser-cookie3/default.nix
@@ -1,11 +1,11 @@
 { lib, fetchPypi, buildPythonPackage, isPy3k, keyring, pbkdf2, pyaes}:
 buildPythonPackage rec {
   pname = "browser-cookie3";
-  version = "0.7.6";
+  version = "0.9.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1f24hsclg1wz2i8aiam91l06qqy0plxhwl615l4qkg35mbw4ry7h";
+    sha256 = "42e73e0276083ff162080860cd039138760921a56a0f316775cecee37d444c3f";
   };
 
   disabled = !isPy3k;
diff --git a/pkgs/development/python-modules/buildbot/default.nix b/pkgs/development/python-modules/buildbot/default.nix
index 7385a329551..e627667f3ec 100644
--- a/pkgs/development/python-modules/buildbot/default.nix
+++ b/pkgs/development/python-modules/buildbot/default.nix
@@ -44,10 +44,9 @@ let
       autobahn
       pyjwt
       pyyaml
-
+    ]
       # tls
-      twisted.extras.tls
-    ];
+      ++ twisted.extras.tls;
 
     checkInputs = [
       treq
diff --git a/pkgs/development/python-modules/cachecontrol/default.nix b/pkgs/development/python-modules/cachecontrol/default.nix
index 7fedf8c5461..693646c80a4 100644
--- a/pkgs/development/python-modules/cachecontrol/default.nix
+++ b/pkgs/development/python-modules/cachecontrol/default.nix
@@ -7,12 +7,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "0.12.5";
+  version = "0.12.6";
   pname = "CacheControl";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "cef77effdf51b43178f6a2d3b787e3734f98ade253fa3187f3bb7315aaa42ff7";
+    sha256 = "be9aa45477a134aee56c8fac518627e1154df063e85f67d4f83ce0ccc23688e8";
   };
 
   checkInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/cachetools/default.nix b/pkgs/development/python-modules/cachetools/default.nix
index 51bf0e753a9..dabd5cee60e 100644
--- a/pkgs/development/python-modules/cachetools/default.nix
+++ b/pkgs/development/python-modules/cachetools/default.nix
@@ -1,12 +1,13 @@
-{ stdenv, buildPythonPackage, fetchPypi }:
+{ stdenv, buildPythonPackage, fetchPypi, isPy27 }:
 
 buildPythonPackage rec {
   pname = "cachetools";
-  version = "3.1.1";
+  version = "4.0.0";
+  disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8ea2d3ce97850f31e4a08b0e2b5e6c34997d7216a9d2c98e0f3978630d4da69a";
+    sha256 = "9a52dd97a85f257f4e4127f15818e71a0c7899f121b34591fcc1173ea79a0198";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/python-modules/cachy/default.nix b/pkgs/development/python-modules/cachy/default.nix
index d5c3428fcc1..e66bef51d03 100644
--- a/pkgs/development/python-modules/cachy/default.nix
+++ b/pkgs/development/python-modules/cachy/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "cachy";
-  version = "0.2.0";
+  version = "0.3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0v6mjyhgx6j7ya20bk69cr3gdzdkdf6psay0h090rscclgji65dp";
+    sha256 = "186581f4ceb42a0bbe040c407da73c14092379b1e4c0e327fdb72ae4a9b269b1";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/caldav/default.nix b/pkgs/development/python-modules/caldav/default.nix
index 1cb3c2070ec..895775eb87f 100644
--- a/pkgs/development/python-modules/caldav/default.nix
+++ b/pkgs/development/python-modules/caldav/default.nix
@@ -17,5 +17,6 @@ buildPythonPackage rec {
     homepage = "https://pythonhosted.org/caldav/";
     license = licenses.asl20;
     maintainers = with maintainers; [ marenz ];
+    broken = true; # missing xandikos package
   };
 }
diff --git a/pkgs/development/python-modules/celery/default.nix b/pkgs/development/python-modules/celery/default.nix
index 19eaeaf8d82..4522379fa64 100644
--- a/pkgs/development/python-modules/celery/default.nix
+++ b/pkgs/development/python-modules/celery/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "celery";
-  version = "4.3.0";
+  version = "4.4.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4c4532aa683f170f40bd76f928b70bc06ff171a959e06e71bf35f2f9d6031ef9";
+    sha256 = "d3363bb5df72d74420986a435449f3c3979285941dff57d5d97ecba352a0e3e2";
   };
 
   postPatch = ''
@@ -19,9 +19,11 @@ buildPythonPackage rec {
 
   # ignore test that's incompatible with pytest5
   # test_eventlet touches network
+  # test_mongodb requires pymongo
   checkPhase = ''
-    pytest -k 'not restore_current_app_fallback' \
-      --ignore=t/unit/concurrency/test_eventlet.py
+    pytest -k 'not restore_current_app_fallback and not msgpack' \
+      --ignore=t/unit/concurrency/test_eventlet.py \
+      --ignore=t/unit/backends/test_mongodb.py
   '';
 
   checkInputs = [ case pytest boto3 moto ];
diff --git a/pkgs/development/python-modules/certifi/default.nix b/pkgs/development/python-modules/certifi/default.nix
index 40e74328572..7ffc50ea520 100644
--- a/pkgs/development/python-modules/certifi/default.nix
+++ b/pkgs/development/python-modules/certifi/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "certifi";
-  version = "2019.9.11";
+  version = "2019.11.28";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0l0yw94ypd117bl7f0fx8sqw9wsnrpcsn92vr7nkxy54zq665wz4";
+    sha256 = "25b64c7da4cd7479594d035c08c2d809eb4aab3a26e5a990ea98cc450c320f1f";
   };
 
   meta = {
diff --git a/pkgs/development/python-modules/cffi/default.nix b/pkgs/development/python-modules/cffi/default.nix
index 15d15c23a8d..b05aeebf9d4 100644
--- a/pkgs/development/python-modules/cffi/default.nix
+++ b/pkgs/development/python-modules/cffi/default.nix
@@ -29,7 +29,8 @@ if isPyPy then null else buildPythonPackage rec {
   '';
 
   # The tests use -Werror but with python3.6 clang detects some unreachable code.
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionals stdenv.cc.isClang [ "-Wno-unused-command-line-argument" "-Wno-unreachable-code" ];
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang
+    "-Wno-unused-command-line-argument -Wno-unreachable-code";
 
   doCheck = !stdenv.hostPlatform.isMusl && !stdenv.isDarwin; # TODO: Investigate
   checkPhase = ''
diff --git a/pkgs/development/python-modules/cfn-lint/default.nix b/pkgs/development/python-modules/cfn-lint/default.nix
index eeccaedf5f6..7b1ef63767d 100644
--- a/pkgs/development/python-modules/cfn-lint/default.nix
+++ b/pkgs/development/python-modules/cfn-lint/default.nix
@@ -1,10 +1,13 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pythonOlder
 , pyyaml
 , six
 , requests
 , aws-sam-translator
+, importlib-metadata
+, importlib-resources
 , jsonpatch
 , jsonschema
 , pathlib2
@@ -13,11 +16,11 @@
 
 buildPythonPackage rec {
   pname = "cfn-lint";
-  version = "0.24.8";
+  version = "0.26.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5aa1540ee9a7efc23ebe54a22f1a505766a4bb44f64a0f4fe79574a156a9b43e";
+    sha256 = "5449313b5f176024bd5fd6ebe69ce986a2d9b8a9d6a147b2d442c8d9fa99a6c5";
   };
 
   propagatedBuildInputs = [
@@ -29,7 +32,7 @@ buildPythonPackage rec {
     jsonschema
     pathlib2
     setuptools
-  ];
+  ] ++ lib.optionals (pythonOlder "3.8") [ importlib-metadata importlib-resources ];
 
   # No tests included in archive
   doCheck = false;
diff --git a/pkgs/development/python-modules/channels/default.nix b/pkgs/development/python-modules/channels/default.nix
index 9cdbd0dac11..b7c83b3b3ff 100644
--- a/pkgs/development/python-modules/channels/default.nix
+++ b/pkgs/development/python-modules/channels/default.nix
@@ -3,11 +3,11 @@
 }:
 buildPythonPackage rec {
   pname = "channels";
-  version = "2.3.1";
+  version = "2.4.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "6b8ebd93fe0041a23e31c9f4130d92fadb9c0040c0eb377a004540631325a31d";
+    sha256 = "08e756406d7165cb32f6fc3090c0643f41ca9f7e0f7fada0b31194662f20f414";
   };
 
   # Files are missing in the distribution
diff --git a/pkgs/development/python-modules/cld2-cffi/default.nix b/pkgs/development/python-modules/cld2-cffi/default.nix
index a38d4c0866e..7775fee5ba0 100644
--- a/pkgs/development/python-modules/cld2-cffi/default.nix
+++ b/pkgs/development/python-modules/cld2-cffi/default.nix
@@ -13,7 +13,7 @@ buildPythonPackage rec {
   checkInputs = [ nose ];
 
   # gcc doesn't approve of this code, so disable -Werror
-  NIX_CFLAGS_COMPILE = [ "-w" ] ++ stdenv.lib.optional stdenv.cc.isClang "-Wno-error=c++11-narrowing";
+  NIX_CFLAGS_COMPILE = "-w" + stdenv.lib.optionalString stdenv.cc.isClang " -Wno-error=c++11-narrowing";
 
   checkPhase = "nosetests -v";
 
diff --git a/pkgs/development/python-modules/cliff/default.nix b/pkgs/development/python-modules/cliff/default.nix
index 7882c98e524..46ac5be03ce 100644
--- a/pkgs/development/python-modules/cliff/default.nix
+++ b/pkgs/development/python-modules/cliff/default.nix
@@ -17,11 +17,11 @@
 
 buildPythonPackage rec {
   pname = "cliff";
-  version = "2.16.0";
+  version = "2.17.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "622e777b8ac2eb479708fe53893c37b2fd5469ce2c6c5b794a658246f05c6b81";
+    sha256 = "f5a1c6b32047aa0d272398d311fd711d41dd5e1cd5195ebe36ebb47f464416fa";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/clifford/default.nix b/pkgs/development/python-modules/clifford/default.nix
index ca95ebbf1f3..961f6b5bc1d 100644
--- a/pkgs/development/python-modules/clifford/default.nix
+++ b/pkgs/development/python-modules/clifford/default.nix
@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "clifford";
-  version = "1.0.4";
+  version = "1.2.0";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "7fc5aa76b4f73c697c0ebd2f86c5233e7ca0a5109b80147f4e711bc3de4b3f2c";
+    sha256 = "b27fdec70574ac928c91fe333a70ece153d75cd0499cce09acea5980ae349bee";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/clikit/default.nix b/pkgs/development/python-modules/clikit/default.nix
index 37a41c7fba4..94f3fa08b13 100644
--- a/pkgs/development/python-modules/clikit/default.nix
+++ b/pkgs/development/python-modules/clikit/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "clikit";
-  version = "0.3.2";
+  version = "0.4.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1pvzq3glf4sjgrm0wyxln3s6vicdc9q8r5sgaiqmxdmd9pylw0xm";
+    sha256 = "8ae4766b974d7b1983e39d501da9a0aadf118a907a0c9b50714d027c8b59ea81";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/clize/default.nix b/pkgs/development/python-modules/clize/default.nix
index ce1ad60a532..72b6a2fa30a 100644
--- a/pkgs/development/python-modules/clize/default.nix
+++ b/pkgs/development/python-modules/clize/default.nix
@@ -8,8 +8,9 @@
 , od
 , docutils
 , repeated_test
-, unittest2
 , pygments
+, unittest2
+, pytest
 }:
 
 buildPythonPackage rec {
@@ -21,14 +22,15 @@ buildPythonPackage rec {
     sha256 = "f54dedcf6fea90a3e75c30cb65e0ab1e832760121f393b8d68edd711dbaf7187";
   };
 
-  checkInputs = [ 
+  checkInputs = [
     dateutil
     pygments
     repeated_test
     unittest2
+    pytest
   ];
-  
-  propagatedBuildInputs = [ 
+
+  propagatedBuildInputs = [
     attrs
     docutils
     od
@@ -36,6 +38,10 @@ buildPythonPackage rec {
     six
   ];
 
+  checkPhase = ''
+    pytest
+  '';
+
   meta = with stdenv.lib; {
     description = "Command-line argument parsing for Python";
     homepage = "https://github.com/epsy/clize";
diff --git a/pkgs/development/python-modules/clustershell/default.nix b/pkgs/development/python-modules/clustershell/default.nix
index 4120dda5460..75a77d4c63c 100644
--- a/pkgs/development/python-modules/clustershell/default.nix
+++ b/pkgs/development/python-modules/clustershell/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "ClusterShell";
-  version = "1.8.1";
+  version = "1.8.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e913efb4fe017eed9731d5ad8be397509e7f1966e6cb6441ee2bce074b16b310";
+    sha256 = "0ebc1925c1aed94f99d74cbc0230215127ade80a25240133204094faa74bc41b";
   };
 
   propagatedBuildInputs = [ pyyaml ];
diff --git a/pkgs/development/python-modules/cma/default.nix b/pkgs/development/python-modules/cma/default.nix
new file mode 100644
index 00000000000..1743e23942f
--- /dev/null
+++ b/pkgs/development/python-modules/cma/default.nix
@@ -0,0 +1,33 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, numpy
+, python
+}:
+
+buildPythonPackage rec {
+  pname = "cma";
+  version = "2.7.0";
+
+  src = fetchFromGitHub {
+    owner = "CMA-ES";
+    repo = "pycma";
+    rev = "r${version}";
+    sha256 = "0c26969pcqj047axksfffd9pj77n16k4r9h6pyid9q3ah5zk0xg3";
+  };
+
+  propagatedBuildInputs = [
+    numpy
+  ];
+
+  checkPhase = ''
+    ${python.executable} -m cma.test
+  '';
+
+  meta = with lib; {
+    description = "CMA-ES, Covariance Matrix Adaptation Evolution Strategy for non-linear numerical optimization in Python";
+    homepage = https://github.com/CMA-ES/pycma;
+    license = licenses.bsd3;
+    maintainers = [ maintainers.costrouc ];
+  };
+}
diff --git a/pkgs/development/python-modules/colorcet/default.nix b/pkgs/development/python-modules/colorcet/default.nix
index 4ae6dd8e479..e4288745d96 100644
--- a/pkgs/development/python-modules/colorcet/default.nix
+++ b/pkgs/development/python-modules/colorcet/default.nix
@@ -36,7 +36,8 @@ buildPythonPackage rec {
     echo "backend: ps" > $HOME/.config/matplotlib/matplotlibrc
     ln -s $HOME/.config/matplotlib $HOME/.matplotlib
 
-    pytest colorcet
+    # requires other backends to be available
+    pytest colorcet -k 'not matplotlib_default_colormap_plot'
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/python-modules/colored/default.nix b/pkgs/development/python-modules/colored/default.nix
index 2ccdb03bc22..b62d80600c7 100644
--- a/pkgs/development/python-modules/colored/default.nix
+++ b/pkgs/development/python-modules/colored/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "colored";
-  version = "1.4.1";
+  version = "1.4.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0qf9470fsasimsmsri13jw1d2zpn3g24fv6vss64jq3ifwfkcs14";
+    sha256 = "056fac09d9e39b34296e7618897ed1b8c274f98423770c2980d829fd670955ed";
   };
 
   # No proper test suite
diff --git a/pkgs/development/python-modules/confluent-kafka/default.nix b/pkgs/development/python-modules/confluent-kafka/default.nix
index 8d992f71f33..f32a6bfd1ac 100644
--- a/pkgs/development/python-modules/confluent-kafka/default.nix
+++ b/pkgs/development/python-modules/confluent-kafka/default.nix
@@ -1,12 +1,12 @@
 { stdenv, buildPythonPackage, fetchPypi, isPy3k, rdkafka, requests, avro3k, avro, futures, enum34 }:
 
 buildPythonPackage rec {
-  version = "1.2.0";
+  version = "1.3.0";
   pname = "confluent-kafka";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1nn8z7ggjj04v97jm33dxh2cv2azy4xi1hwkj9qwbbc68vasc3cp";
+    sha256 = "4025ccddbc79443a4e2342de0d770f669558eb737fca2e7851558cd45f78ef78";
   };
 
   buildInputs = [ rdkafka requests ] ++ (if isPy3k then [ avro3k ] else [ enum34 avro futures ]) ;
diff --git a/pkgs/development/python-modules/cornice/default.nix b/pkgs/development/python-modules/cornice/default.nix
index 4ac38986245..598c3bd1c08 100644
--- a/pkgs/development/python-modules/cornice/default.nix
+++ b/pkgs/development/python-modules/cornice/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "cornice";
-  version = "3.6.1";
+  version = "4.0.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d3d608b9ff405e7ba5e9629ef0c09b7605997e1aea0dafb2aaa66761ff7cab08";
+    sha256 = "d083832e9db65da4784436deabd7d37959de88c3b8ba51d539fa1e1f8313439d";
   };
 
   propagatedBuildInputs = [ pyramid simplejson six venusian ];
diff --git a/pkgs/development/python-modules/coveralls/default.nix b/pkgs/development/python-modules/coveralls/default.nix
index aaa6192f2d5..dbf6616c22d 100644
--- a/pkgs/development/python-modules/coveralls/default.nix
+++ b/pkgs/development/python-modules/coveralls/default.nix
@@ -16,12 +16,12 @@
 buildPythonPackage rec {
   pname = "coveralls";
   name = "${pname}-python-${version}";
-  version = "1.8.2";
+  version = "1.9.2";
 
   # wanted by tests
   src = fetchPypi {
     inherit pname version;
-    sha256 = "fb51cddef4bc458de347274116df15d641a735d3f0a580a9472174e2e62f408c";
+    sha256 = "8e3315e8620bb6b3c6f3179a75f498e7179c93b3ddc440352404f941b1f70524";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/cupy/default.nix b/pkgs/development/python-modules/cupy/default.nix
index f949120db0c..5426a609449 100644
--- a/pkgs/development/python-modules/cupy/default.nix
+++ b/pkgs/development/python-modules/cupy/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "cupy";
-  version = "6.4.0";
+  version = "7.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "126waa1jiynq00glr1hq86sgwwmakq009crfsn8qqgrj4c4clw6a";
+    sha256 = "7230b25052b2b9074cc338b44338b4bd43575a48ad7b9c2ce7f36d7e0d117012";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/cx_oracle/default.nix b/pkgs/development/python-modules/cx_oracle/default.nix
index 7064e81a5d2..6ba8f338638 100644
--- a/pkgs/development/python-modules/cx_oracle/default.nix
+++ b/pkgs/development/python-modules/cx_oracle/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "cx_Oracle";
-  version = "7.2.3";
+  version = "7.3.0";
 
   buildInputs = [ odpic ];
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1b1zarb6g1b2nl3bj9m5ph1sxqc44bscwq30300q78hm666sbf6z";
+    sha256 = "2e0da54e948b55e5c75fab14b391d58aa8b9be1eddfd9ec9a8a0e500bc8bfc7e";
   };
 
   preConfigure = ''
diff --git a/pkgs/development/python-modules/cymem/default.nix b/pkgs/development/python-modules/cymem/default.nix
index b3d4a40bf66..1ca86f3d9d0 100644
--- a/pkgs/development/python-modules/cymem/default.nix
+++ b/pkgs/development/python-modules/cymem/default.nix
@@ -4,15 +4,16 @@
 , cython
 , python
 }:
+
 buildPythonPackage rec {
   pname = "cymem";
-  version = "2.0.2";
+  version = "2.0.3";
 
   src = fetchFromGitHub {
     owner = "explosion";
     repo = "cymem";
     rev = "v${version}";
-    sha256 = "109i67vwgql9za8mfvgbrd6rgraz4djkvpzb4gqvzl13214s6ava";
+    sha256 = "0cqz6whq4zginxjnh4cfqlsh535p4qz295ymvjchp71fv8mz11f6";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/dask/default.nix b/pkgs/development/python-modules/dask/default.nix
index a857925d7b7..beef26ec5be 100644
--- a/pkgs/development/python-modules/dask/default.nix
+++ b/pkgs/development/python-modules/dask/default.nix
@@ -1,7 +1,7 @@
 { lib
 , bokeh
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
 , fsspec
 , pytest
 , pythonOlder
@@ -15,25 +15,44 @@
 
 buildPythonPackage rec {
   pname = "dask";
-  version = "2.9.0";
+  version = "2.9.1";
 
   disabled = pythonOlder "3.5";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "1w1hqr8vyx6ygwflj2737dcy0mmgvrc0s602gnny8pzlcbs9m76b";
+  src = fetchFromGitHub {
+    owner = "dask";
+    repo = pname;
+    rev = version;
+    sha256 = "1xayr4gkp4slvmh2ksdr0d196giz3yhknqjjg1vw2j0la9gwfwxs";
   };
 
-  checkInputs = [ pytest ];
+  checkInputs = [
+    pytest
+  ];
+
   propagatedBuildInputs = [
-    bokeh cloudpickle dill fsspec numpy pandas partd toolz ];
+    bokeh
+    cloudpickle
+    dill
+    fsspec
+    numpy
+    pandas
+    partd
+    toolz
+  ];
 
-  checkPhase = ''
-    py.test dask
+  postPatch = ''
+    # versioneer hack to set version of github package
+    echo "def get_versions(): return {'dirty': False, 'error': None, 'full-revisionid': None, 'version': '${version}'}" > dask/_version.py
+
+    substituteInPlace setup.py \
+      --replace "version=versioneer.get_version()," "version='${version}'," \
+      --replace "cmdclass=versioneer.get_cmdclass()," ""
   '';
 
-  # URLError
-  doCheck = false;
+  checkPhase = ''
+    pytest
+  '';
 
   meta = {
     description = "Minimal task scheduling abstraction";
diff --git a/pkgs/development/python-modules/datadog/default.nix b/pkgs/development/python-modules/datadog/default.nix
index 53a33037d16..6dc19a17462 100644
--- a/pkgs/development/python-modules/datadog/default.nix
+++ b/pkgs/development/python-modules/datadog/default.nix
@@ -1,14 +1,14 @@
 { lib, buildPythonPackage, fetchPypi
 , decorator, requests, simplejson, pillow
-, nose, mock, pytest }:
+, nose, mock, pytest, freezegun }:
 
 buildPythonPackage rec {
   pname = "datadog";
-  version = "0.30.0";
+  version = "0.33.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "07c053e39c6509023d69bc2f3b8e3d5d101b4e75baf2da2b9fc707391c3e773d";
+    sha256 = "bce73f33a4496b004402baa502251150e3b48a48f610ff89d4cd110b366ee0ab";
   };
 
   postPatch = ''
@@ -17,7 +17,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ decorator requests simplejson pillow ];
 
-  checkInputs = [ nose mock pytest ];
+  checkInputs = [ nose mock pytest freezegun ];
   checkPhase = ''
     pytest tests/unit
   '';
diff --git a/pkgs/development/python-modules/datashader/default.nix b/pkgs/development/python-modules/datashader/default.nix
index 2039283771e..789e488e461 100644
--- a/pkgs/development/python-modules/datashader/default.nix
+++ b/pkgs/development/python-modules/datashader/default.nix
@@ -29,11 +29,11 @@
 
 buildPythonPackage rec {
   pname = "datashader";
-  version = "0.8.0";
+  version = "0.9.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "59ac9e3830167d07b350992402a9f547f26eca45cd69a0fb04061a4047e7ff2a";
+    sha256 = "3a423d61014ae8d2668848edab6c12a6244be6f249570bd7811dd5698d5ff633";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/deluge-client/default.nix b/pkgs/development/python-modules/deluge-client/default.nix
index 6f82adc94ca..a2a986828b5 100644
--- a/pkgs/development/python-modules/deluge-client/default.nix
+++ b/pkgs/development/python-modules/deluge-client/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "deluge-client";
-  version = "1.7.1";
+  version = "1.8.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1ragmpihjr9p6n27hw7gy83qyc68csqpn18m9kvwsby1vi7mgdy8";
+    sha256 = "4eac169b4b08008cacf4e5e26e82302a7ccd43c07846d1a1228f3e271a128de2";
   };
 
   # it will try to connect to a running instance
diff --git a/pkgs/development/python-modules/diff_cover/default.nix b/pkgs/development/python-modules/diff_cover/default.nix
index 0d49f627821..ed16f7f95e5 100644
--- a/pkgs/development/python-modules/diff_cover/default.nix
+++ b/pkgs/development/python-modules/diff_cover/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "diff_cover";
-  version = "2.4.1";
+  version = "2.5.0";
 
   preCheck = ''
     export LC_ALL=en_US.UTF-8;
@@ -25,7 +25,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "12h91rvbrf9qmdmj5nfqhcd3bpwq1pvk990bag4hyxcf86qlzds4";
+    sha256 = "2ba4e8dcd5439a245287fac056db02a9261432b1a44a5cffbe593032de86f1c7";
   };
 
   propagatedBuildInputs = [ jinja2 jinja2_pluralize pygments six inflect ];
diff --git a/pkgs/development/python-modules/distributed/default.nix b/pkgs/development/python-modules/distributed/default.nix
index 4179499eaf3..951593bac97 100644
--- a/pkgs/development/python-modules/distributed/default.nix
+++ b/pkgs/development/python-modules/distributed/default.nix
@@ -28,12 +28,12 @@
 
 buildPythonPackage rec {
   pname = "distributed";
-  version = "2.6.0";
+  version = "2.9.1";
 
   # get full repository need conftest.py to run tests
   src = fetchPypi {
     inherit pname version;
-    sha256 = "30b0ca195ace1e39bdd278bf1ad257f7674b3e2b8e7a2a37ce7e2ade4aecccf3";
+    sha256 = "d37a5c5be992f3b16db24b54d2801cbe370990fbc63089c6e7ef40d6f03cf5dd";
   };
 
   checkInputs = [ pytest pytest-repeat pytest-faulthandler pytest-timeout mock joblib ];
diff --git a/pkgs/development/python-modules/django-auth-ldap/default.nix b/pkgs/development/python-modules/django-auth-ldap/default.nix
index 4e2377ffb0f..3e95e7ff16b 100644
--- a/pkgs/development/python-modules/django-auth-ldap/default.nix
+++ b/pkgs/development/python-modules/django-auth-ldap/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "django-auth-ldap";
-  version = "2.0.0";
+  version = "2.1.0";
   disabled = isPy27;
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1samrxf8lic6a4c0lgw31b38s97l8hnaknd7ilyy2plahmm0h03i";
+    sha256 = "5f48232c85ddfa33e3573153e6080526ac2eef5e7ec9cf42b5c4ba3c62afb96d";
   };
 
   propagatedBuildInputs = [ ldap django_2_2 ]; 
diff --git a/pkgs/development/python-modules/django-configurations/default.nix b/pkgs/development/python-modules/django-configurations/default.nix
index 0ca6c400df2..c31036c1814 100644
--- a/pkgs/development/python-modules/django-configurations/default.nix
+++ b/pkgs/development/python-modules/django-configurations/default.nix
@@ -12,12 +12,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "2.1";
+  version = "2.2";
   pname = "django-configurations";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "71d9acdff33aa034f0157b0b3d23629fe0cd499bf4d0b6d699b9ca0701d952e8";
+    sha256 = "9e3bcea1355ac50a4c9f854f751d214cb17e5f8adf18405a4488d0a1e8945915";
   };
 
   checkInputs = [ django-discover-runner mock dj-database-url dj-email-url dj-search-url django-cache-url six ];
diff --git a/pkgs/development/python-modules/django-cors-headers/default.nix b/pkgs/development/python-modules/django-cors-headers/default.nix
index 358f2ab1be4..005dc65a499 100644
--- a/pkgs/development/python-modules/django-cors-headers/default.nix
+++ b/pkgs/development/python-modules/django-cors-headers/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "django-cors-headers";
-  version = "3.1.1";
+  version = "3.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5762ec9c2d59f38c76828dc1d4308baca4bc0d3e1d6f217683e7a24a1c4611a3";
+    sha256 = "84933651fbbde8f2bc084bef2f077b79db1ec1389432f21dd661eaae6b3d6a95";
   };
 
   propagatedBuildInputs = [ django ];
diff --git a/pkgs/development/python-modules/django-multiselectfield/default.nix b/pkgs/development/python-modules/django-multiselectfield/default.nix
index acf49d74167..a4dcb57fe43 100644
--- a/pkgs/development/python-modules/django-multiselectfield/default.nix
+++ b/pkgs/development/python-modules/django-multiselectfield/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "django-multiselectfield";
-  version = "0.1.10";
+  version = "0.1.11";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ec305ca79b6e16fb6d699d3159258f9f680ead8ea5ef9b419e7faf13f31355df";
+    sha256 = "043fa1aaddceb9b170c64c0745dc3a059165dcbc74946a434340778f63efa3c2";
   };
 
   propagatedBuildInputs = [ django ];
diff --git a/pkgs/development/python-modules/django-pglocks/default.nix b/pkgs/development/python-modules/django-pglocks/default.nix
index cb8c5f52630..da1dfe21df2 100644
--- a/pkgs/development/python-modules/django-pglocks/default.nix
+++ b/pkgs/development/python-modules/django-pglocks/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonPackage rec {
   pname = "django-pglocks";
-  version = "1.0.3";
+  version = "1.0.4";
 
   meta = {
     description = "PostgreSQL locking context managers and functions for Django.";
@@ -12,7 +12,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "daa3323de355b9057d8f37143e2ae8d283925fd25128ab66bb8c700d000111d9";
+    sha256 = "3c47c66fbfbd268ef46269673a0516a039539b0972b8ed2ec9cfee44c4b65523";
   };
 
   buildInputs = [ django ];
diff --git a/pkgs/development/python-modules/django-versatileimagefield/default.nix b/pkgs/development/python-modules/django-versatileimagefield/default.nix
index d4f46e0355f..90993db4c5b 100644
--- a/pkgs/development/python-modules/django-versatileimagefield/default.nix
+++ b/pkgs/development/python-modules/django-versatileimagefield/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "django-versatileimagefield";
-  version = "1.10";
+  version = "1.11";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0y0r6ssxyg9x1rylpyxg2ha2hl18080k5xp308k4ankpjm50hvc8";
+    sha256 = "8322ee9d7bf5ffa5360990320d2cc2efc7017feff35422636d49f625721edf82";
   };
   propagatedBuildInputs = [ pillow ];
 
diff --git a/pkgs/development/python-modules/django_contrib_comments/default.nix b/pkgs/development/python-modules/django_contrib_comments/default.nix
index 9603929406c..12d8c220aff 100644
--- a/pkgs/development/python-modules/django_contrib_comments/default.nix
+++ b/pkgs/development/python-modules/django_contrib_comments/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , django
+, six
 }:
 
 buildPythonPackage rec {
@@ -13,7 +14,7 @@ buildPythonPackage rec {
     sha256 = "d1232bade3094de07dcc205fc833204384e71ba9d30caadcb5bb2882ce8e8d31";
   };
 
-  propagatedBuildInputs = [ django ];
+  propagatedBuildInputs = [ django six ];
 
   meta = with stdenv.lib; {
     homepage = https://github.com/django/django-contrib-comments;
diff --git a/pkgs/development/python-modules/django_redis/default.nix b/pkgs/development/python-modules/django_redis/default.nix
index 85761be9ba5..c19ca255319 100644
--- a/pkgs/development/python-modules/django_redis/default.nix
+++ b/pkgs/development/python-modules/django_redis/default.nix
@@ -2,11 +2,11 @@
   mock, django, redis, msgpack }:
 buildPythonPackage rec {
   pname = "django-redis";
-  version = "4.10.0";
+  version = "4.11.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1rxcwnv9ik0swkwvfqdi9i9baw6n8if5pj6q63fjh4p9chw3j2xg";
+    sha256 = "a5b1e3ffd3198735e6c529d9bdf38ca3fcb3155515249b98dc4d966b8ddf9d2b";
   };
 
   doCheck = false;
diff --git a/pkgs/development/python-modules/django_taggit/default.nix b/pkgs/development/python-modules/django_taggit/default.nix
index 6ca498ce5e9..2851894b6b6 100644
--- a/pkgs/development/python-modules/django_taggit/default.nix
+++ b/pkgs/development/python-modules/django_taggit/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "django-taggit";
-  version = "1.1.0";
+  version = "1.2.0";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "044fzcpmns90kaxdi49qczlam4xsi8rl73rpfwvxx1gkcqzidgq1";
+    sha256 = "4186a6ce1e1e9af5e2db8dd3479c5d31fa11a87d216a2ce5089ba3afde24a2c5";
   };
 
   propagatedBuildInputs = [ isort django ];
diff --git a/pkgs/development/python-modules/django_treebeard/default.nix b/pkgs/development/python-modules/django_treebeard/default.nix
index 5c45b18be64..d4b3464b6ae 100644
--- a/pkgs/development/python-modules/django_treebeard/default.nix
+++ b/pkgs/development/python-modules/django_treebeard/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "django-treebeard";
-  version = "4.3";
+  version = "4.3.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c21db06a8d4943bf2a28d9d7a119058698fb76116df2679ecbf15a46a501de42";
+    sha256 = "83aebc34a9f06de7daaec330d858d1c47887e81be3da77e3541fe7368196dd8a";
   };
 
   buildInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/djangorestframework/default.nix b/pkgs/development/python-modules/djangorestframework/default.nix
index addff19853d..60e5760b524 100644
--- a/pkgs/development/python-modules/djangorestframework/default.nix
+++ b/pkgs/development/python-modules/djangorestframework/default.nix
@@ -1,11 +1,13 @@
-{ stdenv, buildPythonPackage, fetchPypi, django }:
+{ stdenv, buildPythonPackage, fetchPypi, django, isPy27 }:
+
 buildPythonPackage rec {
-  version = "3.10.3";
+  version = "3.11.0";
   pname = "djangorestframework";
+  disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "140hwz52rlqqc10gbw5bhyyi4zbpqj3z7wgnh2jrhs2wfzwwp0fw";
+    sha256 = "e782087823c47a26826ee5b6fa0c542968219263fb3976ec3c31edab23a4001f";
   };
 
   # Test settings are missing
diff --git a/pkgs/development/python-modules/dkimpy/default.nix b/pkgs/development/python-modules/dkimpy/default.nix
index 60c5dc24b11..9c061e9523a 100644
--- a/pkgs/development/python-modules/dkimpy/default.nix
+++ b/pkgs/development/python-modules/dkimpy/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "dkimpy";
-  version = "0.9.5";
+  version = "1.0.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "6bf47aa71bc466f5d6a201042317fb415fbc45f3cae4f5dbe1e337e235549ff2";
+    sha256 = "5d5ba1a15dd8c980d4183989f383bd5522a88dafde4eee5e4eebf9ee6942d94e";
 };
 
   checkInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/dnslib/default.nix b/pkgs/development/python-modules/dnslib/default.nix
index 65f45ca86f6..e6ec04bb79e 100644
--- a/pkgs/development/python-modules/dnslib/default.nix
+++ b/pkgs/development/python-modules/dnslib/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "dnslib";
-  version = "0.9.10";
+  version = "0.9.12";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "666bf55274a630a2925411c4ea9ca724529299bbe70f91979ad99c72c5e5099e";
+    sha256 = "c206f09948f3ad17884adffdb552b700072c6022fa59744a0f0606114c475e19";
   };
 
   checkPhase = "VERSIONS=${python.interpreter} ./run_tests.sh";
diff --git a/pkgs/development/python-modules/easy-thumbnails/default.nix b/pkgs/development/python-modules/easy-thumbnails/default.nix
index dae1df69562..894363237f5 100644
--- a/pkgs/development/python-modules/easy-thumbnails/default.nix
+++ b/pkgs/development/python-modules/easy-thumbnails/default.nix
@@ -4,7 +4,7 @@
 
 buildPythonPackage rec {
   pname = "easy-thumbnails";
-  version = "2.6";
+  version = "2.7";
 
   meta = {
     description = "Easy thumbnails for Django";
@@ -14,7 +14,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "23fbe3415c93b2369ece8ebdfb5faa05540943bef8b941b3118ce769ba95e275";
+    sha256 = "e4e7a0dd4001f56bfd4058428f2c91eafe27d33ef3b8b33ac4e013b159b9ff91";
   };
 
   propagatedBuildInputs = [ django pillow ];
diff --git a/pkgs/development/python-modules/easyprocess/default.nix b/pkgs/development/python-modules/easyprocess/default.nix
index 7f8a803740d..32acb1213a8 100644
--- a/pkgs/development/python-modules/easyprocess/default.nix
+++ b/pkgs/development/python-modules/easyprocess/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "EasyProcess";
-  version = "0.2.7";
+  version = "0.2.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f757cd16cdab5b87117b4ee6cf197f99bfa109253364c7bd717ad0bcd39218a0";
+    sha256 = "da7f67a006e2eb63d86a8f3f4baa9d6752dab9676009a67193a4e433f2f41c2a";
   };
 
   # No tests
diff --git a/pkgs/development/python-modules/ecdsa/default.nix b/pkgs/development/python-modules/ecdsa/default.nix
index 825cc0df56c..aa69b7e2fcd 100644
--- a/pkgs/development/python-modules/ecdsa/default.nix
+++ b/pkgs/development/python-modules/ecdsa/default.nix
@@ -2,17 +2,19 @@
 , buildPythonPackage
 , fetchPypi
 , pkgs
+, six
 }:
 
 buildPythonPackage rec {
   pname = "ecdsa";
-  version = "0.13.3";
+  version = "0.14.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "163c80b064a763ea733870feb96f9dd9b92216cfcacd374837af18e4e8ec3d4d";
+    sha256 = "64c613005f13efec6541bb0a33290d0d03c27abab5f15fbab20fb0ee162bdd8e";
   };
 
+  propagatedBuildInputs = [ six ];
   # Only needed for tests
   checkInputs = [ pkgs.openssl ];
 
diff --git a/pkgs/development/python-modules/effect/default.nix b/pkgs/development/python-modules/effect/default.nix
index 6b8329550da..fec5518f0e8 100644
--- a/pkgs/development/python-modules/effect/default.nix
+++ b/pkgs/development/python-modules/effect/default.nix
@@ -7,12 +7,12 @@
 , testtools
 }:
 buildPythonPackage rec {
-  version = "0.12.0";
+  version = "1.1.0";
   pname = "effect";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0s8zsncq4l0ar2b4dijf8yzrk13x2swr1w2nb30s1p5jd6r24czl";
+    sha256 = "7affb603707c648b07b11781ebb793a4b9aee8acf1ac5764c3ed2112adf0c9ea";
   };
   checkInputs = [
     pytest
diff --git a/pkgs/development/python-modules/elasticsearch/default.nix b/pkgs/development/python-modules/elasticsearch/default.nix
index e9c65018f67..ccef465eca1 100644
--- a/pkgs/development/python-modules/elasticsearch/default.nix
+++ b/pkgs/development/python-modules/elasticsearch/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage (rec {
   pname = "elasticsearch";
-  version = "7.0.5";
+  version = "7.1.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "693935914d59a517dfffdaab547ff906712a386d9e25027517464960221cbd4c";
+    sha256 = "0140787216646e1eb7eb001f8146aff7071d7ca438854249787b6cc221ddd266";
   };
 
   # Check is disabled because running them destroy the content of the local cluster!
diff --git a/pkgs/development/python-modules/ephem/default.nix b/pkgs/development/python-modules/ephem/default.nix
index 9069bef68e0..2b7815c6978 100644
--- a/pkgs/development/python-modules/ephem/default.nix
+++ b/pkgs/development/python-modules/ephem/default.nix
@@ -10,7 +10,7 @@ buildPythonPackage rec {
     sha256 = "0dj4kk325b01s7q1zkwpm9rrzl7n1jf7fr92wcajjhc5kx14hwb0";
   };
 
-  patchFlags = "-p0";
+  patchFlags = [ "-p0" ];
   checkInputs = [ pytest glibcLocales ];
   # JPLTest uses assets not distributed in package
   checkPhase = ''
diff --git a/pkgs/development/python-modules/eve/default.nix b/pkgs/development/python-modules/eve/default.nix
index 73813d34c5a..a8ac610855d 100644
--- a/pkgs/development/python-modules/eve/default.nix
+++ b/pkgs/development/python-modules/eve/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "Eve";
-  version = "0.9.2";
+  version = "1.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0191ed42ef85d747758bba29df5ff1e296b8152fefddb2f75c3d778c2e6fb9d3";
+    sha256 = "ebde455e631b8eb9d38783eedfbd7e416b4477cce3d9988880eb3e477256a11e";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/eyed3/default.nix b/pkgs/development/python-modules/eyed3/default.nix
index 8ac7b597a4c..47602afa07d 100644
--- a/pkgs/development/python-modules/eyed3/default.nix
+++ b/pkgs/development/python-modules/eyed3/default.nix
@@ -13,13 +13,13 @@
 }:
 
 buildPythonPackage rec {
-  version = "0.8.11";
+  version = "0.8.12";
   pname    = "eyeD3";
   disabled = isPyPy;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0e4c9b9b42257deb9c38c112dbe44e1203dea686d454dc76adb72ded25ac878c";
+    sha256 = "e54eec0a03fb8e7e9e8b509546c6d92efbc871ea7597611fe2c16f03e1c94b6d";
   };
 
   # https://github.com/nicfit/eyeD3/pull/284
diff --git a/pkgs/development/python-modules/faker/default.nix b/pkgs/development/python-modules/faker/default.nix
index 8daa637724d..0d8c77f557f 100644
--- a/pkgs/development/python-modules/faker/default.nix
+++ b/pkgs/development/python-modules/faker/default.nix
@@ -17,11 +17,11 @@ assert pythonOlder "3.3" -> ipaddress != null;
 
 buildPythonPackage rec {
   pname = "Faker";
-  version = "2.0.5";
+  version = "3.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "29093e61f12745150774fd05ab499e87252a4fa51ed51e45c40179e854f87925";
+    sha256 = "92c84a10bec81217d9cb554ee12b3838c8986ce0b5d45f72f769da22e4bb5432";
   };
 
   nativeBuildInputs = [ pytestrunner ];
diff --git a/pkgs/development/python-modules/flask-api/default.nix b/pkgs/development/python-modules/flask-api/default.nix
index b0f9682ed85..8bb6a472c9f 100644
--- a/pkgs/development/python-modules/flask-api/default.nix
+++ b/pkgs/development/python-modules/flask-api/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "Flask-API";
-  version = "1.1";
+  version = "2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0r23pdlaz6ibz9vml3m7v6v3firvykbrsi1zzxkdhls0zi9jq560";
+    sha256 = "6986642e5b25b7def710ca9489ed2b88c94006bfc06eca01c78da7cf447e66e5";
   };
 
   propagatedBuildInputs = [ flask markdown ];
diff --git a/pkgs/development/python-modules/flask-caching/default.nix b/pkgs/development/python-modules/flask-caching/default.nix
index bd528af6bfa..64c3e3384dc 100644
--- a/pkgs/development/python-modules/flask-caching/default.nix
+++ b/pkgs/development/python-modules/flask-caching/default.nix
@@ -1,17 +1,17 @@
-{ lib, buildPythonPackage, fetchPypi, flask, pytest, pytestcov, pytest-xprocess }:
+{ lib, buildPythonPackage, fetchPypi, flask, pytest, pytestcov, pytest-xprocess, pytestcache }:
 
 buildPythonPackage rec {
   pname = "Flask-Caching";
-  version = "1.7.2";
+  version = "1.8.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "17jnnmnpdflv120yhsfbnpick06iias6f2hcxmf1mi1nr35kdqjj";
+    sha256 = "3d0bd13c448c1640334131ed4163a12aff7df2155e73860f07fc9e5e75de7126";
   };
 
   propagatedBuildInputs = [ flask ];
 
-  checkInputs = [ pytest pytestcov pytest-xprocess ];
+  checkInputs = [ pytest pytestcov pytest-xprocess pytestcache ];
 
   # backend_cache relies on pytest-cache, which is a stale package from 2013
   checkPhase = ''
diff --git a/pkgs/development/python-modules/fonttools/default.nix b/pkgs/development/python-modules/fonttools/default.nix
index eb59eaa0f1c..f85afa77021 100644
--- a/pkgs/development/python-modules/fonttools/default.nix
+++ b/pkgs/development/python-modules/fonttools/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, isPy27
 , numpy
 , pytest
 , pytestrunner
@@ -9,11 +10,12 @@
 
 buildPythonPackage rec {
   pname = "fonttools";
-  version = "4.0.2";
+  version = "4.2.2";
+  disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "bb9bf6b5b4ded33e0d9f823e5ae2e1fa643af4d614915660abe3853a9a6931cd";
+    sha256 = "66bb3dfe7efe5972b0145339c063ffaf9539e973f7ff8791df84366eafc65804";
     extension = "zip";
   };
 
diff --git a/pkgs/development/python-modules/foolscap/default.nix b/pkgs/development/python-modules/foolscap/default.nix
index 8680ff2d2aa..a9ab0db1ed9 100644
--- a/pkgs/development/python-modules/foolscap/default.nix
+++ b/pkgs/development/python-modules/foolscap/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "foolscap";
-  version = "0.13.1";
+  version = "0.13.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0sqxp4fshnpcv69c2j04v8c22pjak28iwscxv998h2s3054knxz2";
+    sha256 = "8498c7e9eaecb5b19be74b18d55c2086440be08de29f2bb507f9b505757467ff";
   };
 
   propagatedBuildInputs = [ mock twisted pyopenssl service-identity ];
diff --git a/pkgs/development/python-modules/fsspec/default.nix b/pkgs/development/python-modules/fsspec/default.nix
index 8c2f87c8a40..7e0ed8b9712 100644
--- a/pkgs/development/python-modules/fsspec/default.nix
+++ b/pkgs/development/python-modules/fsspec/default.nix
@@ -1,14 +1,14 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, isPy27
+, pythonOlder
 , pytest
 }:
 
 buildPythonPackage rec {
   pname = "fsspec";
   version = "0.6.2";
-  disabled = isPy27;
+  disabled = pythonOlder "3.5";
 
   src = fetchFromGitHub {
     owner = "intake";
diff --git a/pkgs/development/python-modules/genanki/default.nix b/pkgs/development/python-modules/genanki/default.nix
index f4f3821afa3..bab5b26635d 100644
--- a/pkgs/development/python-modules/genanki/default.nix
+++ b/pkgs/development/python-modules/genanki/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "genanki";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "32ee8063b1d3b5cd95c117c5a4aa812940e3d3c0daa3d535cd6633c1025a59bc";
+    sha256 = "c7c6c276f182a63a807b52a95f197df12794ff014f48dd287cb51ca2dcbe1b34";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/gidgethub/default.nix b/pkgs/development/python-modules/gidgethub/default.nix
index 140f93f33f8..341d08d95ed 100644
--- a/pkgs/development/python-modules/gidgethub/default.nix
+++ b/pkgs/development/python-modules/gidgethub/default.nix
@@ -15,13 +15,13 @@
 
 buildPythonPackage rec {
   pname = "gidgethub";
-  version = "3.1.0";
+  version = "3.2.0";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "52119435ba73ddd5e697dae7bec8b93a048bc738720b81691ebd4b4d81d2d762";
+    sha256 = "8f4b69063a256994d38243cc0eba4e1453017b5b8b04a173216d02d47ffc3989";
   };
 
   nativeBuildInputs = [ setuptools pytestrunner ];
diff --git a/pkgs/development/python-modules/glom/default.nix b/pkgs/development/python-modules/glom/default.nix
index 2a89fb262ff..739ef7d95e4 100644
--- a/pkgs/development/python-modules/glom/default.nix
+++ b/pkgs/development/python-modules/glom/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "glom";
-  version = "19.2.0";
+  version = "19.10.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c277f34e5e498834a63c2114a25a6c67b5cf0b92f96bb65cba063d861c3d1da6";
+    sha256 = "c8a50cb9fcf0c84807836c6a73cf61285557834b9050d7bde7732b936aceb7dd";
   };
 
   propagatedBuildInputs = [ boltons attrs face ];
diff --git a/pkgs/development/python-modules/google-music/default.nix b/pkgs/development/python-modules/google-music/default.nix
index 94fe6d5e0a1..0a3f145f131 100644
--- a/pkgs/development/python-modules/google-music/default.nix
+++ b/pkgs/development/python-modules/google-music/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "google-music";
-  version = "3.1.0";
+  version = "3.2.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5c6cb11d56dfe2cfb95f3083ed4c1347dafbf15a88fc9a7aab3ed5ee4c75cc40";
+    sha256 = "15d543ab31c981bcb9bfb10f588159848ef570fafb6b9d1347f1429a9b1f531a";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/google_api_core/default.nix b/pkgs/development/python-modules/google_api_core/default.nix
index 3a6b49e4e9f..6bfc10f0a09 100644
--- a/pkgs/development/python-modules/google_api_core/default.nix
+++ b/pkgs/development/python-modules/google_api_core/default.nix
@@ -3,12 +3,12 @@
 
 buildPythonPackage rec {
   pname = "google-api-core";
-  version = "1.14.3";
+  version = "1.15.0";
   disabled = isPy27; # google namespace no longer works on python2
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "df8adc4b97f5ab4328a0e745bee77877cf4a7d4601cb1cd5959d2bbf8fba57aa";
+    sha256 = "2d661c8d650a1df5805d0e360121cb55c55d8bd29f858fa62cbe943e59ce89f7";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google_cloud_asset/default.nix b/pkgs/development/python-modules/google_cloud_asset/default.nix
index e73f1e86613..934af49462b 100644
--- a/pkgs/development/python-modules/google_cloud_asset/default.nix
+++ b/pkgs/development/python-modules/google_cloud_asset/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-asset";
-  version = "0.4.1";
+  version = "0.6.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e6c02a6709d13490c73450f3b1ac3436bd26795fa04d9711d7cad973a71eb118";
+    sha256 = "35eeb50c101968b4b5eecc840002a6f83af6789b6a947f27f0b2787e30cc1835";
   };
 
   checkInputs = [ pytest mock ];
diff --git a/pkgs/development/python-modules/google_cloud_automl/default.nix b/pkgs/development/python-modules/google_cloud_automl/default.nix
index 52248605c75..3fc0fc8598d 100644
--- a/pkgs/development/python-modules/google_cloud_automl/default.nix
+++ b/pkgs/development/python-modules/google_cloud_automl/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-automl";
-  version = "0.7.1";
+  version = "0.9.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "fa92a77fcc79032dba756b82196a29f63a7b374379bacdb78be128e09b8abc03";
+    sha256 = "6541245cdee3e3ba5d98bb3ecd0b343fd5d3de1e880cfc5daf59f4a69a045171";
   };
 
   checkInputs = [ pytest mock ];
diff --git a/pkgs/development/python-modules/google_cloud_bigquery/default.nix b/pkgs/development/python-modules/google_cloud_bigquery/default.nix
index f81663b407d..e361b4436ee 100644
--- a/pkgs/development/python-modules/google_cloud_bigquery/default.nix
+++ b/pkgs/development/python-modules/google_cloud_bigquery/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-bigquery";
-  version = "1.21.0";
+  version = "1.23.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b38d5669235583ee4334d468b3719ea4a381da4b2abbedbf13cb926d893a11ab";
+    sha256 = "99c341592d711d8f131fe80d842f7e1b04b2ca1faefa1ffedf4dec1b382cebf6";
   };
 
   checkInputs = [ pytest mock ipython ];
diff --git a/pkgs/development/python-modules/google_cloud_bigtable/default.nix b/pkgs/development/python-modules/google_cloud_bigtable/default.nix
index 3dae6bfdadc..a71d2e493dd 100644
--- a/pkgs/development/python-modules/google_cloud_bigtable/default.nix
+++ b/pkgs/development/python-modules/google_cloud_bigtable/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-bigtable";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5bfa5db942ddb491a62198e690754dbed80228e5cb2c389d809be33464f6cb31";
+    sha256 = "eea9d4aca54499b555a893fa441deac1bd7ae9cbc8e03bdd681fd33fad72e170";
   };
 
   checkInputs = [ pytest mock ];
diff --git a/pkgs/development/python-modules/google_cloud_core/default.nix b/pkgs/development/python-modules/google_cloud_core/default.nix
index 0b0914b1480..139ce85a319 100644
--- a/pkgs/development/python-modules/google_cloud_core/default.nix
+++ b/pkgs/development/python-modules/google_cloud_core/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-core";
-  version = "1.0.3";
+  version = "1.1.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "10750207c1a9ad6f6e082d91dbff3920443bdaf1c344a782730489a9efa802f1";
+    sha256 = "49036087c1170c3fad026e45189f17092b8c584a9accb2d73d1854f494e223ae";
   };
 
   propagatedBuildInputs = [ google_api_core grpcio setuptools ];
diff --git a/pkgs/development/python-modules/google_cloud_dataproc/default.nix b/pkgs/development/python-modules/google_cloud_dataproc/default.nix
index a08a1c4fd10..becc2678dc1 100644
--- a/pkgs/development/python-modules/google_cloud_dataproc/default.nix
+++ b/pkgs/development/python-modules/google_cloud_dataproc/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-dataproc";
-  version = "0.5.0";
+  version = "0.6.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "24c28e9383e714b1447e5b4a2282beda2c94714e78cbb6cfc5f8ccbfcfdb3ffa";
+    sha256 = "302bc448e77f1de958ba7413fb85819eda911043f219d8fc030a356848bc6f31";
   };
 
   checkInputs = [ pytest mock ];
diff --git a/pkgs/development/python-modules/google_cloud_dlp/default.nix b/pkgs/development/python-modules/google_cloud_dlp/default.nix
index 6c7388b4cf1..30990938435 100644
--- a/pkgs/development/python-modules/google_cloud_dlp/default.nix
+++ b/pkgs/development/python-modules/google_cloud_dlp/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-dlp";
-  version = "0.12.1";
+  version = "0.13.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "acf2b1f8388b0baf3286bd2a67e3adad70a28d0fa768fd2196a96710637c4b72";
+    sha256 = "844f5e63597c2a15561eec68397ee5f425e9be7728d2d7072f50f983fab31b9a";
   };
 
   checkInputs = [ pytest mock ];
diff --git a/pkgs/development/python-modules/google_cloud_firestore/default.nix b/pkgs/development/python-modules/google_cloud_firestore/default.nix
index 697e2b2d7c9..e6211d844fa 100644
--- a/pkgs/development/python-modules/google_cloud_firestore/default.nix
+++ b/pkgs/development/python-modules/google_cloud_firestore/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-firestore";
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "201fa86bbc76cf7ccbfac293bb7ed2dfba9bb9e5244b2785f619d083a8b2b51d";
+    sha256 = "7fec7b523ab5e1f87721ca61181114818579bb4d17de768a3993811c9d2aacfe";
   };
 
   checkInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/google_cloud_monitoring/default.nix b/pkgs/development/python-modules/google_cloud_monitoring/default.nix
index 5bc612ad188..a556fb95568 100644
--- a/pkgs/development/python-modules/google_cloud_monitoring/default.nix
+++ b/pkgs/development/python-modules/google_cloud_monitoring/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-monitoring";
-  version = "0.33.0";
+  version = "0.34.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "cba63744faeea3b0167a752268955df127736e453820f01cc24e97bf4ae83c24";
+    sha256 = "75370af645dd815c234561e7b356fa5d99b0ee6448c0e5d013455c72af961d0b";
   };
 
   checkInputs = [ pytest mock ];
diff --git a/pkgs/development/python-modules/google_cloud_pubsub/default.nix b/pkgs/development/python-modules/google_cloud_pubsub/default.nix
index 8860578b207..99723450866 100644
--- a/pkgs/development/python-modules/google_cloud_pubsub/default.nix
+++ b/pkgs/development/python-modules/google_cloud_pubsub/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-pubsub";
-  version = "1.0.2";
+  version = "1.1.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "afb08eb558f3e4d836e6f77443f81555d6921ffc888c7c3085acd1205fba6e8c";
+    sha256 = "bdead87e40eba93043c6704578e946cf2794366312f936da0a2b3754234dde29";
   };
 
   checkInputs = [ pytest mock ];
diff --git a/pkgs/development/python-modules/google_cloud_spanner/default.nix b/pkgs/development/python-modules/google_cloud_spanner/default.nix
index 0fad7cbdbfa..80e88d53f1f 100644
--- a/pkgs/development/python-modules/google_cloud_spanner/default.nix
+++ b/pkgs/development/python-modules/google_cloud_spanner/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-spanner";
-  version = "1.11.0";
+  version = "1.13.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "58b0c324296986d2f308d1b9917341d5c1e8e72253349e3ba5163b99bf7fc840";
+    sha256 = "eafa09cc344339a23702ee74eac5713974fefafdfd56afb589bd25548c79c80d";
   };
 
   checkInputs = [ pytest mock ];
diff --git a/pkgs/development/python-modules/google_cloud_speech/default.nix b/pkgs/development/python-modules/google_cloud_speech/default.nix
index b14c48cbf08..c00ea653900 100644
--- a/pkgs/development/python-modules/google_cloud_speech/default.nix
+++ b/pkgs/development/python-modules/google_cloud_speech/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-speech";
-  version = "1.2.0";
+  version = "1.3.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f8a1f67b01b5b8bd22fa3ba95a4b99ae4a55b6299665d5ae1afa3db7f6706c32";
+    sha256 = "21b597b18ee2b9b9a5e2e05a7a1d47173f8f3adeada36b5bdf6cb816114430bf";
   };
 
   propagatedBuildInputs = [ google_api_core ];
diff --git a/pkgs/development/python-modules/google_cloud_storage/default.nix b/pkgs/development/python-modules/google_cloud_storage/default.nix
index 1d68197364b..ff750602465 100644
--- a/pkgs/development/python-modules/google_cloud_storage/default.nix
+++ b/pkgs/development/python-modules/google_cloud_storage/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-storage";
-  version = "1.20.0";
+  version = "1.23.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2e7e2435978bda1c209b70a9a00b8cbc53c3b00d6f09eb2c991ebba857babf24";
+    sha256 = "c66e876ae9547884fa42566a2ebfec51d280f488d7a058af9611ba90c78bed78";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google_cloud_tasks/default.nix b/pkgs/development/python-modules/google_cloud_tasks/default.nix
index 9a139399ccd..95bcb0d4d57 100644
--- a/pkgs/development/python-modules/google_cloud_tasks/default.nix
+++ b/pkgs/development/python-modules/google_cloud_tasks/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-tasks";
-  version = "1.2.1";
+  version = "1.3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "93f57f5ee273b4efcb3d7cc9d1c0b9a63dc9fd61d1fb47b861182364cfd51f94";
+    sha256 = "221388d1dd4bf21ba46ead499bbb3dfba9151b852c4fdca70935ba36e5c3631a";
   };
 
   checkInputs = [ pytest mock ];
diff --git a/pkgs/development/python-modules/google_cloud_videointelligence/default.nix b/pkgs/development/python-modules/google_cloud_videointelligence/default.nix
index a6010969409..57e106fcfbe 100644
--- a/pkgs/development/python-modules/google_cloud_videointelligence/default.nix
+++ b/pkgs/development/python-modules/google_cloud_videointelligence/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-videointelligence";
-  version = "1.11.0";
+  version = "1.12.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ef5c53772500bb30b546889ba8823a8d21217153544800f31a9bfd6f514643cb";
+    sha256 = "66d0a63d27e83656b1b4e0205d32725e4c58db174118badba164bb7d05a66981";
   };
 
   checkInputs = [ pytest mock ];
diff --git a/pkgs/development/python-modules/google_cloud_vision/default.nix b/pkgs/development/python-modules/google_cloud_vision/default.nix
index 10c8792b9c8..39dfc123650 100644
--- a/pkgs/development/python-modules/google_cloud_vision/default.nix
+++ b/pkgs/development/python-modules/google_cloud_vision/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-vision";
-  version = "0.39.0";
+  version = "0.41.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f33aea6721d453901ded268dee61a01ab77d4cd215a76edc3cc61b6028299d3e";
+    sha256 = "fd7adcfd8f1bddc19797b25ba3287a4f0cf42e208f330fffb7f1cd125e4d6cd3";
   };
 
   checkInputs = [ mock ];
diff --git a/pkgs/development/python-modules/google_resumable_media/default.nix b/pkgs/development/python-modules/google_resumable_media/default.nix
index a7fc28623fc..8486eba68c1 100644
--- a/pkgs/development/python-modules/google_resumable_media/default.nix
+++ b/pkgs/development/python-modules/google_resumable_media/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "google-resumable-media";
-  version = "0.4.1";
+  version = "0.5.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "cdeb8fbb3551a665db921023603af2f0d6ac59ad8b48259cb510b8799505775f";
+    sha256 = "2a8fd188afe1cbfd5998bf20602f76b0336aa892de88fe842a806b9a3ed78d2a";
   };
 
   checkInputs = [ pytest mock ];
diff --git a/pkgs/development/python-modules/gunicorn/default.nix b/pkgs/development/python-modules/gunicorn/default.nix
index 16c6921cdd6..75a3d745a3f 100644
--- a/pkgs/development/python-modules/gunicorn/default.nix
+++ b/pkgs/development/python-modules/gunicorn/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildPythonPackage, fetchPypi
+{ stdenv, buildPythonPackage, fetchPypi, isPy27
 , coverage
 , mock
 , pytest
@@ -8,11 +8,12 @@
 
 buildPythonPackage rec {
   pname = "gunicorn";
-  version = "19.9.0";
+  version = "20.0.4";
+  disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "fa2662097c66f920f53f70621c6c58ca4a3c4d3434205e608e121b5b3b71f4f3";
+    sha256 = "1904bb2b8a43658807108d59c3f3d56c2b6121a701161de0ddf9ad140073c626";
   };
 
   propagatedBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/gym/default.nix b/pkgs/development/python-modules/gym/default.nix
index 52171470c27..d90ded1fb5f 100644
--- a/pkgs/development/python-modules/gym/default.nix
+++ b/pkgs/development/python-modules/gym/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "gym";
-  version = "0.15.3";
+  version = "0.15.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "18381e13bbd1e2f206a1b88a2af4fb87affd7d06ee7955a6e5e6a79478a9adfc";
+    sha256 = "3b930cbe1c76bbd30455b5e82ba723dea94159a5f988e927f443324bf7cc7ddd";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/hmmlearn/default.nix b/pkgs/development/python-modules/hmmlearn/default.nix
index 32c79b17136..e29c31e6fa7 100644
--- a/pkgs/development/python-modules/hmmlearn/default.nix
+++ b/pkgs/development/python-modules/hmmlearn/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "hmmlearn";
-  version = "0.2.2";
+  version = "0.2.3";
 
   src = fetchurl {
     url = "mirror://pypi/h/hmmlearn/${pname}-${version}.tar.gz";
-    sha256 = "081c53xs5wn5vikwslallwdv0am09w9cbbggl5dbkqpnic9zx4h4";
+    sha256 = "8003d5dc55612de8016156abdc7aa1dd995abc2431adb1ef33dd84a6d29e56bf";
   };
 
   buildInputs = [ setuptools_scm cython ];
diff --git a/pkgs/development/python-modules/holidays/default.nix b/pkgs/development/python-modules/holidays/default.nix
index 3909651ff26..ebde21a4821 100644
--- a/pkgs/development/python-modules/holidays/default.nix
+++ b/pkgs/development/python-modules/holidays/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "holidays";
-  version = "0.9.11";
+  version = "0.9.12";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1g0irhh4kq3zy1disc9i5746p72a72s5j1q1cxhbdkwnnn9dnpwi";
+    sha256 = "3182c4a6fef8d01a829468362ace9c3bba7645873610535fef53454dbb4ea092";
   };
 
   propagatedBuildInputs = [ six dateutil ];
diff --git a/pkgs/development/python-modules/html5lib/default.nix b/pkgs/development/python-modules/html5lib/default.nix
index 5a59b63cea4..82b48180709 100644
--- a/pkgs/development/python-modules/html5lib/default.nix
+++ b/pkgs/development/python-modules/html5lib/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , flake8
-, pytest
+, pytest_4
 , pytest-expect
 , mock
 , six
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     sha256 = "66cb0dcfdbbc4f9c3ba1a63fdb511ffdbd4f513b2b6d81b80cd26ce6b3fb3736";
   };
 
-  checkInputs = [ flake8 pytest pytest-expect mock ];
+  checkInputs = [ flake8 pytest_4 pytest-expect mock ];
   propagatedBuildInputs = [
     six webencodings
   ];
@@ -42,4 +42,4 @@ buildPythonPackage rec {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ domenkozar prikhi ];
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/development/python-modules/httplib2/default.nix b/pkgs/development/python-modules/httplib2/default.nix
index 77350b09941..c40f3453d6b 100644
--- a/pkgs/development/python-modules/httplib2/default.nix
+++ b/pkgs/development/python-modules/httplib2/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "httplib2";
-  version = "0.14.0";
+  version = "0.15.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "34537dcdd5e0f2386d29e0e2c6d4a1703a3b982d34c198a5102e6e5d6194b107";
+    sha256 = "a5f914f18f99cb9541660454a159e3b3c63241fc3ab60005bb88d97cc7a4fb58";
   };
 
   # Needs setting up
diff --git a/pkgs/development/python-modules/hypothesis/default.nix b/pkgs/development/python-modules/hypothesis/default.nix
index 9e3b0cdc894..fdb5a69ddd7 100644
--- a/pkgs/development/python-modules/hypothesis/default.nix
+++ b/pkgs/development/python-modules/hypothesis/default.nix
@@ -9,7 +9,7 @@ buildPythonPackage rec {
   # pytz fake_factory django numpy pytest
   # If you need these, you can just add them to your environment.
 
-  version = "4.41.0";
+  version = "4.56.1";
   pname = "hypothesis";
 
   # Use github tarballs that includes tests
diff --git a/pkgs/development/python-modules/identify/default.nix b/pkgs/development/python-modules/identify/default.nix
index e5822349bac..bfe039382ac 100644
--- a/pkgs/development/python-modules/identify/default.nix
+++ b/pkgs/development/python-modules/identify/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "identify";
-  version = "1.4.8";
+  version = "1.4.9";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "7782115794ec28b011702815d9f5e532244560cd2bf0789c4f09381d43befd90";
+    sha256 = "6f44e637caa40d1b4cb37f6ed3b262ede74901d28b1cc5b1fc07360871edd65d";
   };
 
   # Tests not included in PyPI tarball
diff --git a/pkgs/development/python-modules/imbalanced-learn/default.nix b/pkgs/development/python-modules/imbalanced-learn/default.nix
index d8e35d3fcea..568fc825ab6 100644
--- a/pkgs/development/python-modules/imbalanced-learn/default.nix
+++ b/pkgs/development/python-modules/imbalanced-learn/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "imbalanced-learn";
-  version = "0.5.0";
+  version = "0.6.1";
   disabled = isPy27; # scikit-learn>=0.21 doesn't work on python2
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1m8r055mvkws0s449s1dyrkgricls6basnszwbwqwrw6g19n1xsx";
+    sha256 = "94f846ff8d19ee9ea42ba6feddfbc85d5b42098bd3b62318f8d3bc5c7133b274";
   };
 
   propagatedBuildInputs = [ scikitlearn ];
diff --git a/pkgs/development/python-modules/importlib-metadata/default.nix b/pkgs/development/python-modules/importlib-metadata/default.nix
index bae5d232d0e..5b7a249d65a 100644
--- a/pkgs/development/python-modules/importlib-metadata/default.nix
+++ b/pkgs/development/python-modules/importlib-metadata/default.nix
@@ -13,12 +13,12 @@
 
 buildPythonPackage rec {
   pname = "importlib-metadata";
-  version = "0.23";
+  version = "1.3.0";
 
   src = fetchPypi {
     pname = "importlib_metadata";
     inherit version;
-    sha256 = "09mdqdfv5rdrwz80jh9m379gxmvk2vhjfz0fg53hid00icvxf65a";
+    sha256 = "0ibvvqajphwdclbr236gikvyja0ynvqjlix38kvsabgrf0jqafh7";
   };
 
   nativeBuildInputs = [ setuptools_scm ];
@@ -28,9 +28,6 @@ buildPythonPackage rec {
 
   checkInputs = [ importlib-resources packaging ];
 
-  # Two failing tests: https://gitlab.com/python-devs/importlib_metadata/issues/72
-  doCheck = false;
-
   meta = with lib; {
     description = "Read metadata from Python packages";
     homepage = https://importlib-metadata.readthedocs.io/;
diff --git a/pkgs/development/python-modules/inflect/default.nix b/pkgs/development/python-modules/inflect/default.nix
index 147cc8753eb..2b856b35f7c 100644
--- a/pkgs/development/python-modules/inflect/default.nix
+++ b/pkgs/development/python-modules/inflect/default.nix
@@ -1,15 +1,15 @@
-{ buildPythonPackage, fetchPypi, setuptools_scm, nose, six }:
+{ buildPythonPackage, fetchPypi, setuptools_scm, nose, six, importlib-metadata }:
 
 buildPythonPackage rec {
   pname = "inflect";
-  version = "2.1.0";
+  version = "3.0.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4ded1b2a6fcf0fc0397419c7727f131a93b67b80d899f2973be7758628e12b73";
+    sha256 = "ee7c9b7c3376d06828b205460afb3c447b5d25dd653171db249a238f3fc2c18a";
   };
 
-  buildInputs = [ setuptools_scm ];
+  nativeBuildInputs = [ setuptools_scm ];
+  propagatedBuildInputs = [ six importlib-metadata ];
   checkInputs = [ nose ];
-  propagatedBuildInputs = [ six ];
 }
diff --git a/pkgs/development/python-modules/intake/default.nix b/pkgs/development/python-modules/intake/default.nix
index f670d8f01e0..487ffc35b1a 100644
--- a/pkgs/development/python-modules/intake/default.nix
+++ b/pkgs/development/python-modules/intake/default.nix
@@ -22,13 +22,13 @@
 
 buildPythonPackage rec {
   pname = "intake";
-  version = "0.5.3";
+  version = "0.5.4";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1mbjr4xl4i523bg8k08s5986v2289fznd8cr3j3czn5adi8519j7";
+    sha256 = "81c3bdadbb81ec10c923b89e118c229d977a584ccbe27466f8fde41c0c274c3f";
   };
 
   checkInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/ipykernel/default.nix b/pkgs/development/python-modules/ipykernel/default.nix
index 215177d4b8a..f4e7a109074 100644
--- a/pkgs/development/python-modules/ipykernel/default.nix
+++ b/pkgs/development/python-modules/ipykernel/default.nix
@@ -3,6 +3,7 @@
 , buildPythonPackage
 , fetchPypi
 , fetchpatch
+, flaky
 , ipython
 , jupyter_client
 , traitlets
@@ -14,12 +15,12 @@
 
 buildPythonPackage rec {
   pname = "ipykernel";
-  version = "5.1.2";
+  version = "5.1.3";
   disabled = pythonOlder "3.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "04jx6ihj3zpj4c7acqa14gl37mpdnbgmfm4nvv97xkjc1cz920xm";
+    sha256 = "1a08y677lpn80qzvv7z0smgggmr5m5ayf0bs6vds47xpxl9sss5k";
   };
 
   propagatedBuildInputs = [ ipython jupyter_client traitlets tornado ];
diff --git a/pkgs/development/python-modules/ipython/7.9.nix b/pkgs/development/python-modules/ipython/7.9.nix
new file mode 100644
index 00000000000..c097bdbe9e1
--- /dev/null
+++ b/pkgs/development/python-modules/ipython/7.9.nix
@@ -0,0 +1,69 @@
+{ lib
+, stdenv
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+# Build dependencies
+, glibcLocales
+# Test dependencies
+, nose
+, pygments
+# Runtime dependencies
+, jedi
+, decorator
+, pickleshare
+, traitlets
+, prompt_toolkit
+, pexpect
+, appnope
+, backcall
+, fetchpatch
+}:
+
+buildPythonPackage rec {
+  pname = "ipython";
+  version = "7.9.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "103jkw18z7fnwdal1mdbijjxi1fndzn31g887lmj7ddpf2r07lyz";
+  };
+
+  prePatch = lib.optionalString stdenv.isDarwin ''
+    substituteInPlace setup.py --replace "'gnureadline'" " "
+  '';
+
+  buildInputs = [ glibcLocales ];
+
+  checkInputs = [ nose pygments ];
+
+  propagatedBuildInputs = [
+    jedi
+    decorator
+    pickleshare
+    traitlets
+    prompt_toolkit
+    pygments
+    pexpect
+    backcall
+  ] ++ lib.optionals stdenv.isDarwin [appnope];
+
+  LC_ALL="en_US.UTF-8";
+
+  doCheck = false; # Circular dependency with ipykernel
+
+  checkPhase = ''
+    nosetests
+  '';
+
+  pythonImportsCheck = [
+    "IPython"
+  ];
+
+  meta = with lib; {
+    description = "IPython: Productive Interactive Computing";
+    homepage = http://ipython.org/;
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ bjornfor fridh ];
+  };
+}
diff --git a/pkgs/development/python-modules/ipython/default.nix b/pkgs/development/python-modules/ipython/default.nix
index f67c5ea941a..6b9da6e882f 100644
--- a/pkgs/development/python-modules/ipython/default.nix
+++ b/pkgs/development/python-modules/ipython/default.nix
@@ -22,12 +22,12 @@
 
 buildPythonPackage rec {
   pname = "ipython";
-  version = "7.10.1";
-  disabled = pythonOlder "3.5";
+  version = "7.10.2";
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "03h3m64k8jq0cc48i34g8xq0r68cx3w7wz721mfhr7k06qdv11pi";
+    sha256 = "762d79a62b6aa96b04971e920543f558dfbeedc0468b899303c080c8068d4ac2";
   };
 
   prePatch = lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/python-modules/isbnlib/default.nix b/pkgs/development/python-modules/isbnlib/default.nix
index 7ad81da27d2..af12ba587d4 100644
--- a/pkgs/development/python-modules/isbnlib/default.nix
+++ b/pkgs/development/python-modules/isbnlib/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "isbnlib";
-  version = "3.9.9";
+  version = "3.9.10";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ba2d5a86a70db0f1951df479205e9144d9e55b8af4995b3857a79a30c6ff16ab";
+    sha256 = "1a389556cc5cf82b7ad95924710101e3bd06d809d6f889a3f437975b275af944";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/jaraco_classes/default.nix b/pkgs/development/python-modules/jaraco_classes/default.nix
index dadbb810465..8e5458509c4 100644
--- a/pkgs/development/python-modules/jaraco_classes/default.nix
+++ b/pkgs/development/python-modules/jaraco_classes/default.nix
@@ -1,13 +1,16 @@
-{ buildPythonPackage, fetchPypi, setuptools_scm, six }:
+{ buildPythonPackage, fetchPypi, setuptools_scm, six, more-itertools }:
 
 buildPythonPackage rec {
   pname = "jaraco.classes";
-  version = "2.0";
+  version = "3.0.0";
+
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1xfal9085bjh4fv57d6v9ibr5wf4llj73gp1ybdlqd2bralc9hnw";
+    sha256 = "886ad165d495e7d18781142d6dda4f0045053a038f9e63c38ef03e2f7127bafc";
   };
+
+  nativeBuildInputs = [ setuptools_scm ];
+  propagatedBuildInputs = [ six more-itertools ];
+
   doCheck = false;
-  buildInputs = [ setuptools_scm ];
-  propagatedBuildInputs = [ six ];
 }
diff --git a/pkgs/development/python-modules/jaraco_stream/default.nix b/pkgs/development/python-modules/jaraco_stream/default.nix
index 492d903f24d..324eb625014 100644
--- a/pkgs/development/python-modules/jaraco_stream/default.nix
+++ b/pkgs/development/python-modules/jaraco_stream/default.nix
@@ -2,10 +2,10 @@
 
 buildPythonPackage rec {
   pname = "jaraco.stream";
-  version = "2.0";
+  version = "3.0.0";
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c2e9d507d8cf04a3ff916b57eaf46bacb8a9f8895b55ead853de9c47b8f5daa4";
+    sha256 = "287e1cba9f278e0146fdded6bc40518930813a5584579769aeaa1d0bfd178a73";
   };
   doCheck = false;
   buildInputs = [ setuptools_scm ];
diff --git a/pkgs/development/python-modules/jedi/default.nix b/pkgs/development/python-modules/jedi/default.nix
index 0df9404f156..eb3cdfaadd8 100644
--- a/pkgs/development/python-modules/jedi/default.nix
+++ b/pkgs/development/python-modules/jedi/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "jedi";
-  version = "0.15.1";
+  version = "0.15.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ba859c74fa3c966a22f2aeebe1b74ee27e2a462f56d3f5f7ca4a59af61bfe42e";
+    sha256 = "e909527104a903606dd63bea6e8e888833f0ef087057829b89a18364a856f807";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/jsonschema/default.nix b/pkgs/development/python-modules/jsonschema/default.nix
index d94a7742f9e..9ff267b6fce 100644
--- a/pkgs/development/python-modules/jsonschema/default.nix
+++ b/pkgs/development/python-modules/jsonschema/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "jsonschema";
-  version = "3.1.1";
+  version = "3.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2fa0684276b6333ff3c0b1b27081f4b2305f0a36cf702a23db50edb141893c3f";
+    sha256 = "c8a85b28d377cc7737e46e2d9f2b4f44ee3c0e1deac6bf46ddefc7187d30797a";
   };
 
   nativeBuildInputs = [ setuptools_scm ];
diff --git a/pkgs/development/python-modules/jupyter_console/default.nix b/pkgs/development/python-modules/jupyter_console/default.nix
index f8cf8b3076a..9200e004d0c 100644
--- a/pkgs/development/python-modules/jupyter_console/default.nix
+++ b/pkgs/development/python-modules/jupyter_console/default.nix
@@ -20,7 +20,6 @@ buildPythonPackage rec {
     sha256 = "308ce876354924fb6c540b41d5d6d08acfc946984bf0c97777c1ddcb42e0b2f5";
   };
 
-  checkInputs = [ nose ];
   propagatedBuildInputs = [
     jupyter_client
     ipython
@@ -28,6 +27,12 @@ buildPythonPackage rec {
     prompt_toolkit
     pygments
   ];
+  checkInputs = [ nose ];
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "prompt_toolkit>=2.0.0,<2.1.0" "prompt_toolkit"
+  '';
 
   # ValueError: underlying buffer has been detached
   doCheck = false;
diff --git a/pkgs/development/python-modules/jupyterlab/default.nix b/pkgs/development/python-modules/jupyterlab/default.nix
index 520f342cc1d..32d3ad0bada 100644
--- a/pkgs/development/python-modules/jupyterlab/default.nix
+++ b/pkgs/development/python-modules/jupyterlab/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "jupyterlab";
-  version = "1.2.3";
+  version = "1.2.4";
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2188a9bcaaf0b6a68ff9098a481f37ece8231634b862fd3c9adedc466aac79f2";
+    sha256 = "6adb88acd05b51512c37df477a18c36240823a591c2a51bf6556198414026d8f";
   };
 
   propagatedBuildInputs = [ jupyterlab_server notebook ];
diff --git a/pkgs/development/python-modules/jupytext/default.nix b/pkgs/development/python-modules/jupytext/default.nix
index 2bb7e22b097..961eb43f03b 100644
--- a/pkgs/development/python-modules/jupytext/default.nix
+++ b/pkgs/development/python-modules/jupytext/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "jupytext";
-  version = "1.2.4";
+  version = "1.3.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "490e1127033fceed5c49f7b1cde6aabffb059fe0a778a0e8b10d28d9eecef1f0";
+    sha256 = "132bad60c63debfb371a691cb6668a19938ec268599e9c49f1531a3bf0be7b1c";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/kconfiglib/default.nix b/pkgs/development/python-modules/kconfiglib/default.nix
index ace5b862825..74e56880ee9 100644
--- a/pkgs/development/python-modules/kconfiglib/default.nix
+++ b/pkgs/development/python-modules/kconfiglib/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "kconfiglib";
-  version = "13.2.0";
+  version = "13.6.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "045yjmn6xqbyb68l1jqlgi3c8cwlw1krsrlfwrrgjijkmbx6yqmd";
+    sha256 = "5bd148042654788a30ead478208abd44d5df971013a226b0aabae3c4243561bd";
   };
 
   # doesnt work out of the box but might be possible
diff --git a/pkgs/development/python-modules/keyring/default.nix b/pkgs/development/python-modules/keyring/default.nix
index 65f8697e124..8f7ae56de04 100644
--- a/pkgs/development/python-modules/keyring/default.nix
+++ b/pkgs/development/python-modules/keyring/default.nix
@@ -1,27 +1,35 @@
-{ stdenv, buildPythonPackage, fetchPypi, isPy27
-, dbus-python, setuptools_scm, entrypoints, secretstorage
-, pytest, pytest-flake8 }:
+{ lib, stdenv, buildPythonPackage, fetchPypi, isPy27, pythonOlder
+, dbus-python
+, entrypoints
+, importlib-metadata
+, pytest
+, pytest-flake8
+, secretstorage
+, setuptools_scm
+}:
 
 buildPythonPackage rec {
   pname = "keyring";
-  version = "19.2.0";
+  version = "20.0.1";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1cvlm48fggl12m19j9vcnrlplidr2sjf8h3pdyki58f9y357q0wi";
+    sha256 = "963bfa7f090269d30bdc5e25589e5fd9dad2cf2a7c6f176a7f2386910e5d0d8d";
   };
 
   nativeBuildInputs = [ setuptools_scm ];
 
   checkInputs = [ pytest pytest-flake8 ];
 
-  propagatedBuildInputs = [ dbus-python entrypoints ] ++ stdenv.lib.optional stdenv.isLinux secretstorage;
+  propagatedBuildInputs = [ dbus-python entrypoints ]
+  ++ lib.optional stdenv.isLinux secretstorage
+  ++ lib.optionals (pythonOlder "3.8") [ importlib-metadata ];
 
   # checks try to access a darwin path on linux
   doCheck = false;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Store and access your passwords safely";
     homepage    = "https://pypi.python.org/pypi/keyring";
     license     = licenses.psfl;
diff --git a/pkgs/development/python-modules/keyrings-alt/default.nix b/pkgs/development/python-modules/keyrings-alt/default.nix
index 3fe986fc335..aa873b63ab9 100644
--- a/pkgs/development/python-modules/keyrings-alt/default.nix
+++ b/pkgs/development/python-modules/keyrings-alt/default.nix
@@ -1,14 +1,15 @@
-{ stdenv, buildPythonPackage, fetchPypi, pythonOlder, six
+{ stdenv, buildPythonPackage, fetchPypi, pythonOlder, isPy27, six
 , pytest, backports_unittest-mock, keyring, setuptools_scm
 }:
 
 buildPythonPackage rec {
   pname = "keyrings.alt";
-  version = "3.1.1";
+  version = "3.4.0";
+  disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0lgp2d3hrpvbb2rfz18vrv5lrck72k3l2f2cpkbks2kigrfbgiqb";
+    sha256 = "91328ac4229e70b1d0061d21bf61d36b031a6b4828f2682e38c741812f6eb23d";
   };
 
   postPatch = ''
@@ -21,10 +22,16 @@ buildPythonPackage rec {
 
   checkInputs = [ pytest keyring ] ++ stdenv.lib.optional (pythonOlder "3.3") backports_unittest-mock;
 
+  # heavily relies on importing tests from keyring package
+  doCheck = false;
   checkPhase = ''
     py.test
   '';
 
+  pythonImportsCheck = [
+    "keyrings.alt"
+  ];
+
   meta = with stdenv.lib; {
     license = licenses.mit;
     description = "Alternate keyring implementations";
diff --git a/pkgs/development/python-modules/koji/default.nix b/pkgs/development/python-modules/koji/default.nix
index 47c42a1df45..aec1916c1ff 100644
--- a/pkgs/development/python-modules/koji/default.nix
+++ b/pkgs/development/python-modules/koji/default.nix
@@ -15,7 +15,7 @@ buildPythonPackage rec {
   # Judging from SyntaxError
   disabled = isPy3k;
 
-  makeFlags = "DESTDIR=$(out)";
+  makeFlags = [ "DESTDIR=$(out)" ];
 
   postInstall = ''
     mv $out/usr/* $out/
diff --git a/pkgs/development/python-modules/labelbox/default.nix b/pkgs/development/python-modules/labelbox/default.nix
index 18578da764e..c8279835c92 100644
--- a/pkgs/development/python-modules/labelbox/default.nix
+++ b/pkgs/development/python-modules/labelbox/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "labelbox";
-  version = "2.1";
+  version = "2.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f97f01bf030b115d8b7f7b12a10ec5efe54750ad66b6b3567550b517a543ad11";
+    sha256 = "6b515dc29329e8a3adac9d6b4fef84d80c513743be57ae66b54bcb30060172c6";
   };
 
   propagatedBuildInputs = [ jinja2 requests pillow rasterio shapely ];
diff --git a/pkgs/development/python-modules/leveldb/default.nix b/pkgs/development/python-modules/leveldb/default.nix
index c375194a89a..212f13d00cf 100644
--- a/pkgs/development/python-modules/leveldb/default.nix
+++ b/pkgs/development/python-modules/leveldb/default.nix
@@ -6,7 +6,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1gzc5x3i76d2gv8iprfvpnp3chf6arcfmmiv0ygy05r9hivfgzqw";
+    sha256 = "1cffe776842917e09f073bd6ea5856c64136aebddbe51bd17ea29913472fecbf";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/libcloud/default.nix b/pkgs/development/python-modules/libcloud/default.nix
index 381c3a2731a..3d505166e4a 100644
--- a/pkgs/development/python-modules/libcloud/default.nix
+++ b/pkgs/development/python-modules/libcloud/default.nix
@@ -1,32 +1,34 @@
-{ stdenv
+{ lib
 , buildPythonPackage
 , fetchPypi
+, isPy27
 , mock
 , pycrypto
 , requests
 , pytestrunner
 , pytest
 , requests-mock
+, typing
 }:
 
 buildPythonPackage rec {
   pname = "apache-libcloud";
-  version = "2.6.1";
+  version = "2.7.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "fcc165f2cc2db9a379c6d3a17b3beb9081bb64ba5c0bf7bbb58da864810092f0";
+    sha256 = "29ee7d13b9b12d1335e752a489c01eed0c270940147f418cfff89ab66faf1305";
   };
 
   checkInputs = [ mock pytest pytestrunner requests-mock ];
-  propagatedBuildInputs = [ pycrypto requests ];
+  propagatedBuildInputs = [ pycrypto requests ] ++ lib.optionals isPy27 [ typing ];
 
   preConfigure = "cp libcloud/test/secrets.py-dist libcloud/test/secrets.py";
 
   # requires a certificates file
   doCheck = false;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A unified interface to many cloud providers";
     homepage = http://incubator.apache.org/libcloud/;
     license = licenses.asl20;
diff --git a/pkgs/development/python-modules/limits/default.nix b/pkgs/development/python-modules/limits/default.nix
index 57f47ff5fd8..614945d1364 100644
--- a/pkgs/development/python-modules/limits/default.nix
+++ b/pkgs/development/python-modules/limits/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "limits";
-  version = "1.3";
+  version = "1.4.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a017b8d9e9da6761f4574642149c337f8f540d4edfe573fb91ad2c4001a2bc76";
+    sha256 = "c071295307c447f85aaa3c3ab3ce058e29d67010f4fabf278a8e163916e4deab";
   };
 
   propagatedBuildInputs = [ six ];
diff --git a/pkgs/development/python-modules/limnoria/default.nix b/pkgs/development/python-modules/limnoria/default.nix
index 9bcc95ddc30..7cd3ef85822 100644
--- a/pkgs/development/python-modules/limnoria/default.nix
+++ b/pkgs/development/python-modules/limnoria/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "limnoria";
-  version = "2019.11.09";
+  version = "2019.11.22";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1ni25jmri0928jj2c24xw5f2fzljjla54zh80fimks1aa5752j29";
+    sha256 = "6ccc6906fd644444a1edd0984d10bddf5abf4dd91c94eeeaa4660f7dc3eca320";
   };
 
   patchPhase = ''
diff --git a/pkgs/development/python-modules/lmdb/default.nix b/pkgs/development/python-modules/lmdb/default.nix
index 13adad603d1..5f31511451d 100644
--- a/pkgs/development/python-modules/lmdb/default.nix
+++ b/pkgs/development/python-modules/lmdb/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "lmdb";
-  version = "0.97";
+  version = "0.98";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0jw3n14x6qg5wps2w4qkqf4pyan949h1s2nbkrz2qh7xwnnp2g8p";
+    sha256 = "0625bc28bf0893e6000a83be7234f915ca078c32f9e73d8ae48b3508db7af708";
   };
 
   checkInputs = [ pytest cffi ];
diff --git a/pkgs/development/python-modules/lmtpd/default.nix b/pkgs/development/python-modules/lmtpd/default.nix
index bc91139728b..d05acd21c10 100644
--- a/pkgs/development/python-modules/lmtpd/default.nix
+++ b/pkgs/development/python-modules/lmtpd/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "lmtpd";
-  version = "6.0.0";
+  version = "6.1.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "192d1j9lj9i6f4llwg51817am4jj8pjvlqmkx03spmsay6f832bm";
+    sha256 = "256e23a3292818ecccf9a76ef52e0064c6f7e1f8602904e15337c8917ed0fafe";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/python-modules/logilab/common.nix b/pkgs/development/python-modules/logilab/common.nix
index 99ff8d45e6a..8a23b69cf67 100644
--- a/pkgs/development/python-modules/logilab/common.nix
+++ b/pkgs/development/python-modules/logilab/common.nix
@@ -1,12 +1,13 @@
-{ stdenv, buildPythonPackage, fetchPypi, unittest2, six }:
+{ stdenv, buildPythonPackage, fetchPypi, isPy27, unittest2, six }:
 
 buildPythonPackage rec {
   pname = "logilab-common";
-  version = "1.4.4";
+  version = "1.5.2";
+  disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8c1bf26431a3b487940cd4a7c0eefde328f5ff7098222ee695805752dae94aa6";
+    sha256 = "1n20znamai7jksimbdshy03rgw235qwa9vbx3lyajzwysblq4s4d";
   };
 
   propagatedBuildInputs = [ unittest2 six ];
diff --git a/pkgs/development/python-modules/loguru/default.nix b/pkgs/development/python-modules/loguru/default.nix
index 67134fdfd95..ed2c8992b7d 100644
--- a/pkgs/development/python-modules/loguru/default.nix
+++ b/pkgs/development/python-modules/loguru/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "loguru";
-  version = "0.3.2";
+  version = "0.4.0";
   
   disabled = isPy27;
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0apd3wcjbyhwzgw0fgzzn4dcgy10pqa8f1vf58d4hmszxvyqn4z3";
+    sha256 = "d5ddf363b7e0e562652f283f74a89bf35601baf16b70f2cd2736a2f8c6638748";
   };
 
   checkInputs = [ pytest colorama ];
diff --git a/pkgs/development/python-modules/m2crypto/default.nix b/pkgs/development/python-modules/m2crypto/default.nix
index 56e1de49f20..0ccf55e5bc4 100644
--- a/pkgs/development/python-modules/m2crypto/default.nix
+++ b/pkgs/development/python-modules/m2crypto/default.nix
@@ -25,7 +25,7 @@ buildPythonPackage rec {
       sha256 = "0z5qnkndg6ma5f5qqrid5m95i9kybsr000v3fdy1ab562kf65a27";
     })
   ];
-  patchFlags = "-p0";
+  patchFlags = [ "-p0" ];
 
   nativeBuildInputs = [ swig2 ];
   buildInputs = [ swig2 openssl ];
diff --git a/pkgs/development/python-modules/magic-wormhole-mailbox-server/default.nix b/pkgs/development/python-modules/magic-wormhole-mailbox-server/default.nix
index e2662e7e5dd..28d09672584 100644
--- a/pkgs/development/python-modules/magic-wormhole-mailbox-server/default.nix
+++ b/pkgs/development/python-modules/magic-wormhole-mailbox-server/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildPythonPackage, fetchPypi, six, attrs, twisted, pyopenssl, service-identity, autobahn, treq, mock }:
+{ stdenv, buildPythonPackage, fetchPypi, isPy27, six, attrs, twisted, pyopenssl, service-identity, autobahn, treq, mock, pytest }:
 
 buildPythonPackage rec {
   version = "0.4.1";
@@ -10,10 +10,12 @@ buildPythonPackage rec {
   };
 
   propagatedBuildInputs = [ six attrs twisted pyopenssl service-identity autobahn ];
-  checkInputs = [ treq mock ];
 
+  # zope.interface import issue
+  doCheck = !isPy27;
+  checkInputs = [ treq mock pytest ];
   checkPhase = ''
-    trial wormhole_mailbox_server
+    pytest
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/python-modules/magic-wormhole/default.nix b/pkgs/development/python-modules/magic-wormhole/default.nix
index 557d3f157ed..5db5c28a4cb 100644
--- a/pkgs/development/python-modules/magic-wormhole/default.nix
+++ b/pkgs/development/python-modules/magic-wormhole/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , buildPythonPackage
 , fetchPypi
+, isPy27
 , spake2
 , pynacl
 , six
@@ -18,7 +19,6 @@
 , mock
 , magic-wormhole-transit-relay
 , magic-wormhole-mailbox-server
-, isPy27
 }:
 
 buildPythonPackage rec {
@@ -42,6 +42,8 @@ buildPythonPackage rec {
     install -Dm644 docs/wormhole.1 $out/share/man/man1/wormhole.1
   '';
 
+  # zope.interface issue
+  doCheck = !isPy27;
   preCheck = ''
     export PATH=$out/bin:$PATH
     export LANG="en_US.UTF-8"
diff --git a/pkgs/development/python-modules/marionette-harness/mozdevice.nix b/pkgs/development/python-modules/marionette-harness/mozdevice.nix
index 8954f579c7f..9b521689936 100644
--- a/pkgs/development/python-modules/marionette-harness/mozdevice.nix
+++ b/pkgs/development/python-modules/marionette-harness/mozdevice.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, mozlog
 , moznetwork
 , mozprocess
 }:
@@ -16,7 +17,7 @@ buildPythonPackage rec {
     format = "wheel";
   };
 
-  propagatedBuildInputs = [ moznetwork mozprocess ];
+  propagatedBuildInputs = [ mozlog moznetwork mozprocess ];
 
   meta = {
     description = "Mozilla-authored device management";
diff --git a/pkgs/development/python-modules/marionette-harness/mozprofile.nix b/pkgs/development/python-modules/marionette-harness/mozprofile.nix
index 9c8e10c7fd0..dda9e07d5e5 100644
--- a/pkgs/development/python-modules/marionette-harness/mozprofile.nix
+++ b/pkgs/development/python-modules/marionette-harness/mozprofile.nix
@@ -16,7 +16,9 @@ buildPythonPackage rec {
     sha256 = "09l18x72vahq7il9nj6qj7la2d21vvbcn9szlm3vsvsbkz68w0yk";
   };
 
-  propagatedBuildInputs = [ mozlog mozfile mozhttpd wptserve ];
+  propagatedBuildInputs = [ mozlog mozfile mozhttpd ];
+
+  checkInputs = [ wptserve ];
 
   meta = {
     description = "Mozilla application profile handling library";
diff --git a/pkgs/development/python-modules/marshmallow-sqlalchemy/default.nix b/pkgs/development/python-modules/marshmallow-sqlalchemy/default.nix
index 76e641bae2c..2f85c33e757 100644
--- a/pkgs/development/python-modules/marshmallow-sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/marshmallow-sqlalchemy/default.nix
@@ -4,7 +4,7 @@
 
 buildPythonPackage rec {
   pname = "marshmallow-sqlalchemy";
-  version = "0.19.0";
+  version = "0.21.0";
 
   meta = {
     homepage = "https://github.com/marshmallow-code/marshmallow-sqlalchemy";
@@ -14,7 +14,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "175ydlxmj8pbkrv3wcrsd9jg7smnxhln2y0i691yafhidxgy8fmm";
+    sha256 = "93fd8fad2b33d92a1ae58328eeb0f39ed174858d82f9e7084a174df7b41fd3a4";
   };
 
   propagatedBuildInputs = [ marshmallow sqlalchemy ];
diff --git a/pkgs/development/python-modules/marshmallow/default.nix b/pkgs/development/python-modules/marshmallow/default.nix
index 5b07fe24441..7b7cadc9889 100644
--- a/pkgs/development/python-modules/marshmallow/default.nix
+++ b/pkgs/development/python-modules/marshmallow/default.nix
@@ -1,10 +1,11 @@
 { lib, buildPythonPackage, fetchPypi,
-  dateutil, simplejson
+  dateutil, simplejson, isPy27
 }:
 
 buildPythonPackage rec {
   pname = "marshmallow";
-  version = "3.2.2";
+  version = "3.3.0";
+  disabled = isPy27;
 
   meta = {
     homepage = "https://github.com/marshmallow-code/marshmallow";
@@ -17,7 +18,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1a358beb89c2b4d5555272065a9533591a3eb02f1b854f3c4002d88d8f2a1ddb";
+    sha256 = "0ba81b6da4ae69eb229b74b3c741ff13fe04fb899824377b1aff5aaa1a9fd46e";
   };
 
   propagatedBuildInputs = [ dateutil simplejson ];
diff --git a/pkgs/development/python-modules/maxminddb/default.nix b/pkgs/development/python-modules/maxminddb/default.nix
index 645ecddd163..6556ade818a 100644
--- a/pkgs/development/python-modules/maxminddb/default.nix
+++ b/pkgs/development/python-modules/maxminddb/default.nix
@@ -5,12 +5,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "1.5.1";
+  version = "1.5.2";
   pname = "maxminddb";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0y9giw81k4wdmpryr4k42w50z292mf364a6vs1vxf83ksc9ig6j4";
+    sha256 = "d0ce131d901eb11669996b49a59f410efd3da2c6dbe2c0094fe2fef8d85b6336";
   };
 
   propagatedBuildInputs = [ ipaddress ];
diff --git a/pkgs/development/python-modules/measurement/default.nix b/pkgs/development/python-modules/measurement/default.nix
index b342086d655..260d6262102 100644
--- a/pkgs/development/python-modules/measurement/default.nix
+++ b/pkgs/development/python-modules/measurement/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "measurement";
-  version = "2.0.1";
+  version = "3.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "36ca385ffdccf140a75a7e1d816a4df97a6dd255f16fd2f53dd7ab43632a8835";
+    sha256 = "352b20f7f0e553236af7c5ed48d091a51cf26061c1a063f46b31706ff7c0d57a";
   };
 
   propagatedBuildInputs = [ pbr six sympy ];
diff --git a/pkgs/development/python-modules/mecab-python3/default.nix b/pkgs/development/python-modules/mecab-python3/default.nix
index df691fb05c8..263a71254ed 100644
--- a/pkgs/development/python-modules/mecab-python3/default.nix
+++ b/pkgs/development/python-modules/mecab-python3/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "mecab-python3";
-  version = "0.996.2";
+  version = "0.996.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a80383fba343dad247b486a9afa486b7f0ec6244cb8bbf2d6a24d2fab5f19180";
+    sha256 = "1cedc968ef5bcbb2a6ece3bb4eb26e9569d89f3277dc2066ea0ce1341ab7d3b9";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/mechanize/default.nix b/pkgs/development/python-modules/mechanize/default.nix
index 9669bcc30e7..1d63a6e2b6a 100644
--- a/pkgs/development/python-modules/mechanize/default.nix
+++ b/pkgs/development/python-modules/mechanize/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "mechanize";
-  version = "0.4.4";
+  version = "0.4.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9fff89e973bdf1aee75a351bd4dde53ca51a7e76944ddeae3ea3b6ad6c46045c";
+    sha256 = "6355c11141f6d4b54a17fc2106944806b5db2711e60b120d15d83db438c333fd";
   };
 
   propagatedBuildInputs = [ html5lib ];
diff --git a/pkgs/development/python-modules/mlrose/default.nix b/pkgs/development/python-modules/mlrose/default.nix
index 6222921db74..5fd39d9b347 100644
--- a/pkgs/development/python-modules/mlrose/default.nix
+++ b/pkgs/development/python-modules/mlrose/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "mlrose";
-  version = "1.2.0";
+  version = "1.3.0";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0vsvqrf1wbbj8i198rqd87hf8rlq7fmv8mmibv8f9rhj0w8729p5";
+    sha256 = "cec83253bf6da67a7fb32b2c9ae13e9dbc6cfbcaae2aa3107993e69e9788f15e";
   };
 
   propagatedBuildInputs = [ scikitlearn ];
diff --git a/pkgs/development/python-modules/mockito/default.nix b/pkgs/development/python-modules/mockito/default.nix
index bfef79b0f72..f0673b64ef3 100644
--- a/pkgs/development/python-modules/mockito/default.nix
+++ b/pkgs/development/python-modules/mockito/default.nix
@@ -1,20 +1,19 @@
 { stdenv, buildPythonPackage, fetchPypi, isPy3k, funcsigs, pytest, numpy }:
 
 buildPythonPackage rec {
-  version = "1.1.1";
+  version = "1.2.0";
   pname = "mockito";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "142f5e8865a422ad2d67b9c67a382e3296e8f1633dbccd0e322180fba7d5303d";
+    sha256 = "2a1cbae9d0aef4ae7586b03f2a463e8c5ba96aa937c0535ced4a5621f851feeb";
   };
 
-  # Failing tests due 2to3
-  doCheck = !isPy3k;
-
   propagatedBuildInputs = stdenv.lib.optionals (!isPy3k) [ funcsigs ];
   checkInputs = [ pytest numpy ];
 
+  # tests are no longer packaged in pypi tarball
+  doCheck = false;
   checkPhase = ''
     pytest
   '';
diff --git a/pkgs/development/python-modules/monty/default.nix b/pkgs/development/python-modules/monty/default.nix
index 361be1bf184..427f0af4573 100644
--- a/pkgs/development/python-modules/monty/default.nix
+++ b/pkgs/development/python-modules/monty/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, isPy27
 , nose
 , numpy
 , six
@@ -15,6 +16,7 @@
 buildPythonPackage rec {
   pname = "monty";
   version = "3.0.2";
+  disabled = isPy27; # uses type annotations
 
   # No tests in Pypi
   src = fetchFromGitHub {
diff --git a/pkgs/development/python-modules/more-itertools/default.nix b/pkgs/development/python-modules/more-itertools/default.nix
index ad41043496a..37152b3a502 100644
--- a/pkgs/development/python-modules/more-itertools/default.nix
+++ b/pkgs/development/python-modules/more-itertools/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "more-itertools";
-  version = "7.2.0";
+  version = "8.0.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "409cd48d4db7052af495b09dec721011634af3753ae1ef92d2b32f73a745f832";
+    sha256 = "b84b238cce0d9adad5ed87e745778d20a3f8487d0f0cb8b8a586816c7496458d";
   };
 
   checkInputs = [ nose ];
diff --git a/pkgs/development/python-modules/msrestazure/default.nix b/pkgs/development/python-modules/msrestazure/default.nix
index a820dd89f51..04f7428e6b6 100644
--- a/pkgs/development/python-modules/msrestazure/default.nix
+++ b/pkgs/development/python-modules/msrestazure/default.nix
@@ -27,7 +27,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [ adal msrest ];
 
   checkInputs = [ httpretty mock pytest ]
-                ++ lib.optional isPy3k [ pytest-asyncio ];
+                ++ lib.optionals isPy3k [ pytest-asyncio ];
 
   checkPhase = ''
     pytest tests/
diff --git a/pkgs/development/python-modules/mt-940/default.nix b/pkgs/development/python-modules/mt-940/default.nix
index e7f382f8ac7..f31bb4c064e 100644
--- a/pkgs/development/python-modules/mt-940/default.nix
+++ b/pkgs/development/python-modules/mt-940/default.nix
@@ -3,12 +3,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "4.18.0";
+  version = "4.19.0";
   pname = "mt-940";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e5b6469e9bc64522125efae1de0e557f76884c961f122028098533d6f2a98f23";
+    sha256 = "5d109e8dc4b490a4b92ec0153713710eb067b36b350ce1ff60c406afddc7d3cd";
   };
 
   propagatedBuildInputs = lib.optional (!isPy3k) enum34;
diff --git a/pkgs/development/python-modules/multidict/default.nix b/pkgs/development/python-modules/multidict/default.nix
index 1539592dc6b..4673f841ee3 100644
--- a/pkgs/development/python-modules/multidict/default.nix
+++ b/pkgs/development/python-modules/multidict/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "multidict";
-  version = "4.5.2";
+  version = "4.7.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "024b8129695a952ebd93373e45b5d341dbb87c17ce49637b34000093f243dd4f";
+    sha256 = "d4dafdcfbf0ac80fc5f00603f0ce43e487c654ae34a656e4749f175d9832b1b5";
   };
 
   checkInputs = [ pytest pytestrunner pytestcov ];
diff --git a/pkgs/development/python-modules/munch/default.nix b/pkgs/development/python-modules/munch/default.nix
index f4ecc2ff306..764523e0cf7 100644
--- a/pkgs/development/python-modules/munch/default.nix
+++ b/pkgs/development/python-modules/munch/default.nix
@@ -2,18 +2,19 @@
 , buildPythonPackage
 , fetchPypi
 , six
+, pbr
 }:
 
 buildPythonPackage rec {
   pname = "munch";
-  version = "2.3.2";
+  version = "2.5.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "6ae3d26b837feacf732fb8aa5b842130da1daf221f5af9f9d4b2a0a6414b0d51";
+    sha256 = "2d735f6f24d4dba3417fa448cae40c6e896ec1fdab6cdb5e6510999758a4dbd2";
   };
 
-  propagatedBuildInputs = [ six ];
+  propagatedBuildInputs = [ six pbr ];
 
   # No tests in archive
   doCheck = false;
diff --git a/pkgs/development/python-modules/nameparser/default.nix b/pkgs/development/python-modules/nameparser/default.nix
index e8d2c209eb5..984304e9ccb 100644
--- a/pkgs/development/python-modules/nameparser/default.nix
+++ b/pkgs/development/python-modules/nameparser/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "nameparser";
-  version = "1.0.4";
+  version = "1.0.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1kc2phcz22r7vim3hmq0vrp2zqxl6v49hq40jmp4p81pdvgh5c6b";
+    sha256 = "79b5f81b9315b03ac3744d12448032490f5028b5117b721775ba97118ecd5e45";
   };
 
   LC_ALL="en_US.UTF-8";
diff --git a/pkgs/development/python-modules/natsort/default.nix b/pkgs/development/python-modules/natsort/default.nix
index da8e953826f..8bdfdb9d720 100644
--- a/pkgs/development/python-modules/natsort/default.nix
+++ b/pkgs/development/python-modules/natsort/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "natsort";
-  version = "6.0.0";
+  version = "6.2.0";
 
   checkInputs = [
     pytest
@@ -26,13 +26,14 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ff3effb5618232866de8d26e5af4081a4daa9bb0dfed49ac65170e28e45f2776";
+    sha256 = "58c6fb2f355117e88a19808394ec1ed30a2ff881bdd2c81c436952caebd30668";
   };
 
   # testing based on project's tox.ini
+  # natsort_keygen has pytest mock issues
   checkPhase = ''
     pytest --doctest-modules natsort
-    pytest
+    pytest --ignore=tests/test_natsort_keygen.py
   '';
 
   meta = {
diff --git a/pkgs/development/python-modules/nbsmoke/default.nix b/pkgs/development/python-modules/nbsmoke/default.nix
index ee4434c1d1d..6fff7857565 100644
--- a/pkgs/development/python-modules/nbsmoke/default.nix
+++ b/pkgs/development/python-modules/nbsmoke/default.nix
@@ -4,6 +4,7 @@
 , pytest
 , jupyter_client
 , ipykernel
+, holoviews
 , nbformat
 , nbconvert
 , pyflakes
@@ -13,15 +14,16 @@
 
 buildPythonPackage rec {
   pname = "nbsmoke";
-  version = "0.2.8";
+  version = "0.3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "eeda6c59b61130b9116a3d935e7c80ec5f617d7db8918d23289b2426efa229eb";
+    sha256 = "070e999db3902a0c62a94d76de8fb98da21eaee22d9e90eb42f1636c87e1b805";
   };
 
   propagatedBuildInputs = [
     pytest
+    holoviews
     jupyter_client
     ipykernel
     nbformat
diff --git a/pkgs/development/python-modules/nbval/default.nix b/pkgs/development/python-modules/nbval/default.nix
index 812f68d5c4e..ff9d6f134e0 100644
--- a/pkgs/development/python-modules/nbval/default.nix
+++ b/pkgs/development/python-modules/nbval/default.nix
@@ -15,11 +15,11 @@
 
 buildPythonPackage rec {
   pname = "nbval";
-  version = "0.9.3";
+  version = "0.9.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0613drjl740ppam3spm4b8mdcwwvl1lfmqy3vkgznbvzfxfpb3zj";
+    sha256 = "5273c2d958335e24b170fe59b689b13e4b1855b569626e18b1c7e420f5110cc6";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/ncclient/default.nix b/pkgs/development/python-modules/ncclient/default.nix
index 58d88e8dbf8..ca0a9d34b3e 100644
--- a/pkgs/development/python-modules/ncclient/default.nix
+++ b/pkgs/development/python-modules/ncclient/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "ncclient";
-  version = "0.6.6";
+  version = "0.6.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2b367354d1cd25b79b8798a0b4c1949590d890057f2a252e6e970a9ab744e009";
+    sha256 = "efdf3c868cd9f104d4e9fe4c233df78bfbbed4b3d78ba19dc27cec3cf6a63680";
   };
 
   checkInputs = [ nose rednose ];
diff --git a/pkgs/development/python-modules/nevow/default.nix b/pkgs/development/python-modules/nevow/default.nix
index 74b8f7e29da..6054e6d3a73 100644
--- a/pkgs/development/python-modules/nevow/default.nix
+++ b/pkgs/development/python-modules/nevow/default.nix
@@ -2,22 +2,14 @@
 
 buildPythonPackage rec {
   pname = "Nevow";
-  version = "0.14.4";
+  version = "0.14.5";
   disabled = isPy3k;
 
   src = fetchPypi {
     inherit version pname;
-    sha256 = "2299a0d2a0c1312040705599d5d571acfea74df82b968c0b9264f6f45266cf6e";
+    sha256 = "afb6ba85a5351953578c018fcdb9dfbd62f29a8d46c58bc9652bc000a27223f3";
   };
 
-  patches = [
-    # Fix builds against recent Twisted.
-    (fetchpatch {
-      url = "https://github.com/twisted/nevow/commit/f1b366f1a73009b6a1df12fa6f4dc464c564c944.patch";
-      sha256 = "147fibcbqh715in8cbkp7jlkh4b3qvn95v1mv9si0ln1747wbby2";
-    })
-  ];
-
   propagatedBuildInputs = [ twisted ];
 
   checkInputs = [ twisted ];
diff --git a/pkgs/development/python-modules/nibabel/default.nix b/pkgs/development/python-modules/nibabel/default.nix
index f118e4d5a43..979f12c8d98 100644
--- a/pkgs/development/python-modules/nibabel/default.nix
+++ b/pkgs/development/python-modules/nibabel/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , isPy3k
+, isPy27
 , bz2file
 , mock
 , nose
@@ -11,11 +12,12 @@
 
 buildPythonPackage rec {
   pname = "nibabel";
-  version = "2.5.1";
+  version = "3.0.0";
+  disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "83ecac4773ece02c49c364d99b465644c17cc66f1719560117e74991d9eb566b";
+    sha256 = "0f5bc325c9cb203c6f0ab876ba1a5ada811284bb3a4c5d063eeaafaefbad873d";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/nilearn/default.nix b/pkgs/development/python-modules/nilearn/default.nix
index 2da580abd92..9158ee77e50 100644
--- a/pkgs/development/python-modules/nilearn/default.nix
+++ b/pkgs/development/python-modules/nilearn/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "nilearn";
-  version = "0.5.2";
+  version = "0.6.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "18b763d641e6903bdf8512e0ec5cdc14133fb4679e9a15648415e9be62c81b56";
+    sha256 = "07eb764f2b7b39b487f806a067e394d8ebffff21f57cd1ecdb5c4030b7210210";
   };
 
   # disable some failing tests
diff --git a/pkgs/development/python-modules/nipype/default.nix b/pkgs/development/python-modules/nipype/default.nix
index ee3c16f01b6..ab81b2b190b 100644
--- a/pkgs/development/python-modules/nipype/default.nix
+++ b/pkgs/development/python-modules/nipype/default.nix
@@ -48,11 +48,11 @@ in
 
 buildPythonPackage rec {
   pname = "nipype";
-  version = "1.2.3";
+  version = "1.3.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a79c7a72897d81985d20a8c805465285400b59a45ddc527cda44026795fd1c47";
+    sha256 = "bb190964b568d64b04b73d2aa7eae31061fdbc3051d8c27bb34b1632db07ec71";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/numcodecs/default.nix b/pkgs/development/python-modules/numcodecs/default.nix
index e49e6e19239..9725f131111 100644
--- a/pkgs/development/python-modules/numcodecs/default.nix
+++ b/pkgs/development/python-modules/numcodecs/default.nix
@@ -7,6 +7,7 @@
 , msgpack
 , pytest
 , python
+, gcc8
 }:
 
 buildPythonPackage rec {
@@ -21,6 +22,7 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     setuptools_scm
     cython
+    gcc8
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/numpydoc/default.nix b/pkgs/development/python-modules/numpydoc/default.nix
index e965f332fc9..fb3b9af76f6 100644
--- a/pkgs/development/python-modules/numpydoc/default.nix
+++ b/pkgs/development/python-modules/numpydoc/default.nix
@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "numpydoc";
-  version = "0.9.1";
+  version = "0.9.2";
 
   src = fetchPypi {
     inherit pname;
     inherit version;
-    sha256 = "09x6l1a4dcvj7001bvcmcayg1nwqwhaxlwbp6kzj9qrk57lqx3z0";
+    sha256 = "9140669e6b915f42c6ce7fef704483ba9b0aaa9ac8e425ea89c76fe40478f642";
   };
 
   checkInputs = [ nose pytest ];
diff --git a/pkgs/development/python-modules/oauthenticator/default.nix b/pkgs/development/python-modules/oauthenticator/default.nix
index 81c6daaf2de..d8a97692976 100644
--- a/pkgs/development/python-modules/oauthenticator/default.nix
+++ b/pkgs/development/python-modules/oauthenticator/default.nix
@@ -16,11 +16,11 @@
 
 buildPythonPackage rec {
   pname = "oauthenticator";
-  version = "0.9.0";
+  version = "0.10.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0ce31c929bb456ad8734b9b8a7f539e44ab3afff07169e25e974ca576f4c836c";
+    sha256 = "cb4e23fcfe8dc9099c4ca005f8991b0f605b03a3e1cf4fed654b2470f6065bdf";
   };
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/optuna/default.nix b/pkgs/development/python-modules/optuna/default.nix
index bc96c4a2d47..26c72899317 100644
--- a/pkgs/development/python-modules/optuna/default.nix
+++ b/pkgs/development/python-modules/optuna/default.nix
@@ -1,6 +1,6 @@
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
 , pytest
 , mock
 , bokeh
@@ -13,6 +13,7 @@
 , mxnet
 , scikit-optimize
 , tensorflow
+, cma
 , sqlalchemy
 , numpy
 , scipy
@@ -21,6 +22,7 @@
 , colorlog
 , pandas
 , alembic
+, tqdm
 , typing
 , pythonOlder
 , isPy27
@@ -28,12 +30,14 @@
 
 buildPythonPackage rec {
   pname = "optuna";
-  version = "0.17.1";
+  version = "0.19.0";
   disabled = isPy27;
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "3d1d3547340c47f34f3a416a2e0761a0ff887ae8ce06474e84ebcc8600afd438";
+  src = fetchFromGitHub {
+    owner = "optuna";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "179x2lsckpmkrkkdnvvbzky86g1ba882z677qwbayhsc835wbp0y";
   };
 
   checkInputs = [
@@ -49,6 +53,7 @@ buildPythonPackage rec {
     mxnet
     scikit-optimize
     tensorflow
+    cma
   ];
 
   propagatedBuildInputs = [
@@ -60,16 +65,22 @@ buildPythonPackage rec {
     colorlog
     pandas
     alembic
-  ] ++ lib.optionals (pythonOlder "3.5") [ typing ];
+    tqdm
+  ] ++ lib.optionals (pythonOlder "3.5") [
+    typing
+  ];
 
   configurePhase = if !(pythonOlder "3.5") then ''
     substituteInPlace setup.py \
-      --replace "'typing'" ""
+      --replace "'typing'," ""
   '' else "";
 
   checkPhase = ''
     pytest --ignore tests/test_cli.py \
-           --ignore tests/integration_tests/test_chainermn.py
+           --ignore tests/integration_tests/test_chainermn.py \
+           --ignore tests/integration_tests/test_pytorch_lightning.py \
+           --ignore tests/integration_tests/test_pytorch_ignite.py \
+           --ignore tests/integration_tests/test_fastai.py
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/panel/default.nix b/pkgs/development/python-modules/panel/default.nix
index aefab404668..0047548779c 100644
--- a/pkgs/development/python-modules/panel/default.nix
+++ b/pkgs/development/python-modules/panel/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "panel";
-  version = "0.6.4";
+  version = "0.7.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9b86a827f24dcfd1b6d821836e691fca7aab21b79a293031297f83cf2f8d6cef";
+    sha256 = "71d446f469b424cb190bc896e78d0415b2bbebf17c6e5b024ed1a73b4448f8f4";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/paramiko/default.nix b/pkgs/development/python-modules/paramiko/default.nix
index 7ea4a5ee533..2fefbde7448 100644
--- a/pkgs/development/python-modules/paramiko/default.nix
+++ b/pkgs/development/python-modules/paramiko/default.nix
@@ -3,6 +3,7 @@
 , fetchPypi
 , cryptography
 , bcrypt
+, invoke
 , pynacl
 , pyasn1
 , pytest
@@ -12,21 +13,24 @@
 
 buildPythonPackage rec {
   pname = "paramiko";
-  version = "2.6.0";
+  version = "2.7.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0h9hb2kp07zdfbanad527ll90n9ji7isf7m39jyp0sr21pxfvcpl";
+    sha256 = "920492895db8013f6cc0179293147f830b8c7b21fdfc839b6bad760c27459d9f";
   };
 
-  checkInputs = [ pytest mock pytest-relaxed ];
+  checkInputs = [ invoke pytest mock pytest-relaxed ];
   propagatedBuildInputs = [ bcrypt cryptography pynacl pyasn1 ];
 
   __darwinAllowLocalNetworking = true;
 
   # 2 sftp tests fail (skip for now)
+  # test_config relies on artifacts to be to downloaded
   checkPhase = ''
-    pytest tests --ignore=tests/test_sftp.py
+    pytest tests \
+      --ignore=tests/test_sftp.py \
+      --ignore=tests/test_config.py
   '';
 
   meta = with pkgs.lib; {
diff --git a/pkgs/development/python-modules/parsedatetime/default.nix b/pkgs/development/python-modules/parsedatetime/default.nix
index 32247fcc388..914d5e2680f 100644
--- a/pkgs/development/python-modules/parsedatetime/default.nix
+++ b/pkgs/development/python-modules/parsedatetime/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "parsedatetime";
-  version = "2.4";
+  version = "2.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3d817c58fb9570d1eec1dd46fa9448cd644eeed4fb612684b02dfda3a79cb84b";
+    sha256 = "d2e9ddb1e463de871d32088a3f3cea3dc8282b1b2800e081bd0ef86900451667";
   };
 
   buildInputs = [ pytest pytestrunner ];
diff --git a/pkgs/development/python-modules/parso/default.nix b/pkgs/development/python-modules/parso/default.nix
index da42b279c75..24fc5789405 100644
--- a/pkgs/development/python-modules/parso/default.nix
+++ b/pkgs/development/python-modules/parso/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "parso";
-  version = "0.5.1";
+  version = "0.5.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "171a9ivhxwsd52h1cgsz40zgzpgzscn7yqb7sdjhy8m1lzj0wsv6";
+    sha256 = "55cf25df1a35fd88b878715874d2c4dc1ad3f0eebd1e0266a67e1f55efccfbe1";
   };
 
   checkInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/partd/default.nix b/pkgs/development/python-modules/partd/default.nix
index b400e8030f9..e8a148edb23 100644
--- a/pkgs/development/python-modules/partd/default.nix
+++ b/pkgs/development/python-modules/partd/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, isPy27
 , pytest
 , locket
 , numpy
@@ -11,11 +12,12 @@
 
 buildPythonPackage rec {
   pname = "partd";
-  version = "1.0.0";
+  version = "1.1.0";
+  disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "54fd91bc3b9c38159c790cd16950dbca6b019a2ead4c51dee4f9efc884f8ce0e";
+    sha256 = "6e258bf0810701407ad1410d63d1a15cfd7b773fd9efe555dac6bb82cc8832b0";
   };
 
   checkInputs = [ pytest ];
@@ -32,4 +34,4 @@ buildPythonPackage rec {
     license = with lib.licenses; [ bsd3 ];
     homepage = https://github.com/dask/partd/;
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/development/python-modules/pep8-naming/default.nix b/pkgs/development/python-modules/pep8-naming/default.nix
index 20da40560e2..5c66eb6cad0 100644
--- a/pkgs/development/python-modules/pep8-naming/default.nix
+++ b/pkgs/development/python-modules/pep8-naming/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "pep8-naming";
-  version = "0.8.2";
+  version = "0.9.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1aff4g3i2z08cx7z17nbxbf32ddrnvqlk16h6d8h9s9w5ymivjq1";
+    sha256 = "a33d38177056321a167decd6ba70b890856ba5025f0a8eca6a3eda607da93caf";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pex/default.nix b/pkgs/development/python-modules/pex/default.nix
index fec9de45f68..10001d1d602 100644
--- a/pkgs/development/python-modules/pex/default.nix
+++ b/pkgs/development/python-modules/pex/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "pex";
-  version = "1.6.12";
+  version = "2.0.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "13q83yba01hzm9mlk5y1klqirxdmsm2yx1yll5zdik9fd8hg0rf6";
+    sha256 = "a8a35e7eb212616b2964d70d8a134d41d16649c943ab206b90c749c005e60999";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/pglast/default.nix b/pkgs/development/python-modules/pglast/default.nix
index eef72793776..bc54c18ac81 100644
--- a/pkgs/development/python-modules/pglast/default.nix
+++ b/pkgs/development/python-modules/pglast/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "pglast";
-  version = "1.6";
+  version = "1.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "dcbd8061c553b90440741b77fbb274beca84716641a50be8675a6afe6dfbcea2";
+    sha256 = "115067100fbb9eb36f530d94b64b4e1e36a8d304537af0847d562ff9ed399c05";
   };
 
   disabled = !isPy3k;
diff --git a/pkgs/development/python-modules/phonenumbers/default.nix b/pkgs/development/python-modules/phonenumbers/default.nix
index d9b3cb6b172..461d70497bf 100644
--- a/pkgs/development/python-modules/phonenumbers/default.nix
+++ b/pkgs/development/python-modules/phonenumbers/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "phonenumbers";
-  version = "8.11.0";
+  version = "8.11.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1gc38v26hp638vnx4hmyv2gfyjs8k8lbvnlxfixgm60v4v7wykln";
+    sha256 = "239507184ee5b1b83557005af1d5fcce70f83ae18f5dff45b94a67226db10d63";
   };
 
   meta = {
diff --git a/pkgs/development/python-modules/phonopy/default.nix b/pkgs/development/python-modules/phonopy/default.nix
index e8f92bd8d78..e67932f4a88 100644
--- a/pkgs/development/python-modules/phonopy/default.nix
+++ b/pkgs/development/python-modules/phonopy/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "phonopy";
-  version = "2.3.2.post11";
+  version = "2.4.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4b4ef1c11bafa161a409ad018cbf8469aacd42fc77fd954442760161f63dd345";
+    sha256 = "6e6ce41ce8a51723b94d974adfee032cddce5b9300984dd23b59e101ed0a2861";
   };
 
   propagatedBuildInputs = [ numpy pyyaml matplotlib h5py ];
diff --git a/pkgs/development/python-modules/pipdate/default.nix b/pkgs/development/python-modules/pipdate/default.nix
index 08ed0c43a22..93f38fb3779 100644
--- a/pkgs/development/python-modules/pipdate/default.nix
+++ b/pkgs/development/python-modules/pipdate/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "pipdate";
-  version = "0.3.4";
+  version = "0.3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "26bd12075e63ef7f8094da36c27bf5539d298f4ef2af6acba20e98b502439d6d";
+    sha256 = "240c0f270ddb7470ad7b8c8fba4106e3dbd8817a370624fd8c32cf19155c9547";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pivy/default.nix b/pkgs/development/python-modules/pivy/default.nix
index 93aa5ad144c..f7ec55bba05 100644
--- a/pkgs/development/python-modules/pivy/default.nix
+++ b/pkgs/development/python-modules/pivy/default.nix
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     libXi libXext libSM libICE libX11
   ];
 
-  NIX_CFLAGS_COMPILE = [
+  NIX_CFLAGS_COMPILE = toString [
     "-I${pkgs.qt5.qtbase.dev}/include/QtCore"
     "-I${pkgs.qt5.qtbase.dev}/include/QtGui"
     "-I${pkgs.qt5.qtbase.dev}/include/QtOpenGL"
diff --git a/pkgs/development/python-modules/plone-testing/default.nix b/pkgs/development/python-modules/plone-testing/default.nix
index 37ca1a33d65..91592596ed4 100644
--- a/pkgs/development/python-modules/plone-testing/default.nix
+++ b/pkgs/development/python-modules/plone-testing/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "plone.testing";
-  version = "7.0.2";
+  version = "7.0.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2533c48b7bd54ff19da2b4f0c3ccd0a8878c46f03fadbf5f933baaf749d17690";
+    sha256 = "160f130f641578fbede2e47686f1b58179efa9ff98ccdd1ad198b5d0c7e02474";
   };
 
   propagatedBuildInputs = [ six setuptools zope_testing ];
diff --git a/pkgs/development/python-modules/plotly/default.nix b/pkgs/development/python-modules/plotly/default.nix
index 9bf22b939d1..a71506c6197 100644
--- a/pkgs/development/python-modules/plotly/default.nix
+++ b/pkgs/development/python-modules/plotly/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "plotly";
-  version = "4.2.1";
+  version = "4.4.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "6650ddb4da3aa94dcaa32e0779e611c6b17f371b5250ffdbf5ece6d66ba4483b";
+    sha256 = "acc94f17452471ca3446c2ce491c4d1affb99b9ddd9eac4e05614ac4318f8780";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/portend/default.nix b/pkgs/development/python-modules/portend/default.nix
index 9cc88983a30..6d7d7b2563d 100644
--- a/pkgs/development/python-modules/portend/default.nix
+++ b/pkgs/development/python-modules/portend/default.nix
@@ -1,13 +1,13 @@
 { stdenv, buildPythonPackage, fetchPypi
-, pytest, setuptools_scm, tempora, pytest-black }:
+, pytest, setuptools_scm, tempora, pytest-black, pytestcov }:
 
 buildPythonPackage rec {
   pname = "portend";
-  version = "2.5";
+  version = "2.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "19dc27bfb3c72471bd30a235a4d5fbefef8a7e31cab367744b5d87a205e7bfd9";
+    sha256 = "600dd54175e17e9347e5f3d4217aa8bcf4bf4fa5ffbc4df034e5ec1ba7cdaff5";
   };
 
   patches = [ ./black-19.10b0.patch ];
@@ -19,7 +19,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ tempora ];
 
-  checkInputs = [ pytest pytest-black ];
+  checkInputs = [ pytest pytest-black pytestcov ];
 
   checkPhase = ''
     py.test --deselect=test_portend.py::TestChecker::test_check_port_listening
diff --git a/pkgs/development/python-modules/ppft/default.nix b/pkgs/development/python-modules/ppft/default.nix
index 5beed26cb20..101c10b1d12 100644
--- a/pkgs/development/python-modules/ppft/default.nix
+++ b/pkgs/development/python-modules/ppft/default.nix
@@ -13,12 +13,11 @@ buildPythonPackage rec {
     sha256 = "9e2173042edd5cc9c7bee0d7731873f17fcdce0e42e4b7ab68857d0de7b631fc";
   };
 
-  checkPhase = ''
-    python -m ppft.tests
-  '';
-
   propagatedBuildInputs = [ six ];
 
+  # tests no longer packages on pypi
+  doCheck = false;
+
   meta = with stdenv.lib; {
     description = "Distributed and parallel python";
     homepage = https://github.com/uqfoundation;
diff --git a/pkgs/development/python-modules/prance/default.nix b/pkgs/development/python-modules/prance/default.nix
index 38133172ecf..972520793a4 100644
--- a/pkgs/development/python-modules/prance/default.nix
+++ b/pkgs/development/python-modules/prance/default.nix
@@ -15,11 +15,11 @@
 
 buildPythonPackage rec {
   pname = "prance";
-  version = "0.15.0";
+  version = "0.17.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "793f96dc8bba73bf4342f57b3570f5e0a94c30e60f0c802a2aaa302759dd8610";
+    sha256 = "a128d0d5f639a6a19eefedd787a6ce9603634c3908927b1215653e4a8375195f";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/protobuf/default.nix b/pkgs/development/python-modules/protobuf/default.nix
index 73216f63f82..e414dff8aa1 100644
--- a/pkgs/development/python-modules/protobuf/default.nix
+++ b/pkgs/development/python-modules/protobuf/default.nix
@@ -9,10 +9,11 @@ buildPythonPackage {
   inherit disabled;
   doCheck = doCheck && !isPy27; # setuptools>=41.4 no longer collects correctly on python2
 
-  NIX_CFLAGS_COMPILE =
+  NIX_CFLAGS_COMPILE = toString (
     # work around python distutils compiling C++ with $CC
     optional stdenv.isDarwin "-I${libcxx}/include/c++/v1"
-    ++ optional (versionOlder protobuf.version "2.7.0") "-std=c++98";
+    ++ optional (versionOlder protobuf.version "2.7.0") "-std=c++98"
+  );
 
   propagatedBuildInputs = [ google_apputils ];
   propagatedNativeBuildInputs = [ protobuf ];  # For protoc.
diff --git a/pkgs/development/python-modules/psd-tools/default.nix b/pkgs/development/python-modules/psd-tools/default.nix
index 38285b68563..edf502171e7 100644
--- a/pkgs/development/python-modules/psd-tools/default.nix
+++ b/pkgs/development/python-modules/psd-tools/default.nix
@@ -1,21 +1,27 @@
-{ lib, buildPythonPackage, fetchPypi,
-  docopt, pillow
+{ lib, buildPythonPackage, fetchPypi, isPy27
+, docopt
+, pillow
+, enum34
 }:
 
 buildPythonPackage rec {
   pname = "psd-tools";
-  version = "1.8.32";
+  version = "1.8.35";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "379211cf98ebafbe129088a5c92f575e1ccd7987c40bad9520c209e51008df00";
+  };
+
+  propagatedBuildInputs = [
+    docopt
+    pillow
+  ] ++ lib.optionals isPy27 [ enum34 ];
 
   meta = {
     description = "Python package for reading Adobe Photoshop PSD files";
     homepage = https://github.com/kmike/psd-tools;
     license = lib.licenses.mit;
+    broken = true; # missing packbits from nixpkgs
   };
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "fff16658c9ca6bc586adbe0ab060a7d0b7d057eb2a600c3b2001c0558873fb94";
-  };
-
-  propagatedBuildInputs = [ docopt pillow ];
 }
diff --git a/pkgs/development/python-modules/pulp/default.nix b/pkgs/development/python-modules/pulp/default.nix
index 09fddad0158..414c21b263c 100644
--- a/pkgs/development/python-modules/pulp/default.nix
+++ b/pkgs/development/python-modules/pulp/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "PuLP";
-  version = "1.6.8";
+  version = "2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1irzpfnnm5f0qf8y9ddxi489nwixyj0q4zlvqafm621bijkxdv6g";
+    sha256 = "fb0b0e8073aa82f3459c4241b9625e0ccd26c0838ad8253c6bc67e041901b765";
   };
 
   propagatedBuildInputs = [ pyparsing ];
diff --git a/pkgs/development/python-modules/purepng/default.nix b/pkgs/development/python-modules/purepng/default.nix
index fbaa1cfad71..c6f28067bf6 100644
--- a/pkgs/development/python-modules/purepng/default.nix
+++ b/pkgs/development/python-modules/purepng/default.nix
@@ -25,7 +25,7 @@ buildPythonPackage {
       sha256 = "1ag0pji3p012hmj8kadcd0vydv9702188c0isizsi964qcl4va6m";
     })
   ];
-  patchFlags = "-p1 -d code";
+  patchFlags = [ "-p1" "-d" "code" ];
 
   # cython is optional - if not supplied, the "pure python" implementation will be used
   nativeBuildInputs = [ cython ];
diff --git a/pkgs/development/python-modules/pvlib/default.nix b/pkgs/development/python-modules/pvlib/default.nix
index cdd6011aba2..7e561089a18 100644
--- a/pkgs/development/python-modules/pvlib/default.nix
+++ b/pkgs/development/python-modules/pvlib/default.nix
@@ -3,14 +3,14 @@
 
 buildPythonPackage rec {
   pname = "pvlib";
-  version = "0.6.3";
+  version = "0.7.0";
 
   # Support for Python <3.5 dropped in 0.6.3 on June 1, 2019.
   disabled = pythonOlder "3.5";
 
   src = fetchPypi{
     inherit pname version;
-    sha256 = "03nvgpmnscd7rh9jwm2h579zvriq5lva6rsdhb6jckpra5wjkn69";
+    sha256 = "ee935ba52f1d4a514cc3baa743db0377af732952faf800f20ffd8071fa2107c2";
   };
 
   checkInputs = [ pytest mock pytest-mock ];
diff --git a/pkgs/development/python-modules/py/default.nix b/pkgs/development/python-modules/py/default.nix
index 9c5ada22b14..7b84d72fde4 100644
--- a/pkgs/development/python-modules/py/default.nix
+++ b/pkgs/development/python-modules/py/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "py";
-  version = "1.8.0";
+  version = "1.8.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0lsy1gajva083pzc7csj1cvbmminb7b4l6a0prdzyb3fd829nqyw";
+    sha256 = "5e27081401262157467ad6e7f851b7aa402c5852dbcb3dae06768434de5752aa";
   };
 
   # Circular dependency on pytest
diff --git a/pkgs/development/python-modules/py3status/default.nix b/pkgs/development/python-modules/py3status/default.nix
index 79b80fb11f0..d2a2b50d3c0 100644
--- a/pkgs/development/python-modules/py3status/default.nix
+++ b/pkgs/development/python-modules/py3status/default.nix
@@ -24,11 +24,11 @@
 
 buildPythonPackage rec {
   pname = "py3status";
-  version = "3.21";
+  version = "3.22";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c208c680d1511e8c1dc950a930d3ee1b83f2dbfaac1308cd43c4773810fee89b";
+    sha256 = "5e9884dde128e1bd82f8746e8f8806c8d7d89d95ce9ed7bacf7cc5fdb094aa21";
   };
 
   doCheck = false;
diff --git a/pkgs/development/python-modules/pyaml/default.nix b/pkgs/development/python-modules/pyaml/default.nix
index 8601488bcf4..6aeb37cfff6 100644
--- a/pkgs/development/python-modules/pyaml/default.nix
+++ b/pkgs/development/python-modules/pyaml/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "pyaml";
-  version = "19.4.1";
+  version = "19.12.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c79ae98ececda136a034115ca178ee8bf3aa7df236c488c2f55d12f177b88f1e";
+    sha256 = "b3f636b467864319d7ded1558f86bb305b8612a274f5d443a62dc5eceb1b7176";
   };
 
   propagatedBuildInputs = [ pyyaml ];
diff --git a/pkgs/development/python-modules/pyatmo/default.nix b/pkgs/development/python-modules/pyatmo/default.nix
index 795f623ba53..5036307982b 100644
--- a/pkgs/development/python-modules/pyatmo/default.nix
+++ b/pkgs/development/python-modules/pyatmo/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "pyatmo";
-  version = "2.3.3";
+  version = "3.1.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b884402c62d589a38444e8f4b3892b18312e8f9442cd8d12e7ec01c698328f54";
+    sha256 = "8fbcc3a88f8c51d190b697c80515e67530143de71f89cc6ecf99bbf2cbf3ef30";
   };
 
   propagatedBuildInputs = [ requests ];
diff --git a/pkgs/development/python-modules/pybids/default.nix b/pkgs/development/python-modules/pybids/default.nix
index 84f5a41c45b..dc9cbefe0b5 100644
--- a/pkgs/development/python-modules/pybids/default.nix
+++ b/pkgs/development/python-modules/pybids/default.nix
@@ -15,12 +15,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "0.9.5";
+  version = "0.10.0";
   pname = "pybids";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0e8f8466067ff3023f53661c390c02702fcd5fe712bdd5bf167ffb0c2b920430";
+    sha256 = "b37ba89eb7407bbfdf8e26e1230b6ef452da3d986df5eed21aab96be61b6e844";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pybind11/0001-Find-include-directory.patch b/pkgs/development/python-modules/pybind11/0001-Find-include-directory.patch
new file mode 100644
index 00000000000..d5b669dab7a
--- /dev/null
+++ b/pkgs/development/python-modules/pybind11/0001-Find-include-directory.patch
@@ -0,0 +1,53 @@
+From a027e2590d5d2d384d23568a8d47b7095054b6b7 Mon Sep 17 00:00:00 2001
+From: Frederik Rietdijk <fridh@fridh.nl>
+Date: Thu, 19 Dec 2019 19:51:07 +0100
+Subject: [PATCH] Find include directory
+
+---
+ pybind11/__init__.py | 33 +--------------------------------
+ 1 file changed, 1 insertion(+), 32 deletions(-)
+
+diff --git a/pybind11/__init__.py b/pybind11/__init__.py
+index c625e8c..c8a707b 100644
+--- a/pybind11/__init__.py
++++ b/pybind11/__init__.py
+@@ -2,35 +2,4 @@ from ._version import version_info, __version__  # noqa: F401 imported but unuse
+ 
+ 
+ def get_include(user=False):
+-    from distutils.dist import Distribution
+-    import os
+-    import sys
+-
+-    # Are we running in a virtual environment?
+-    virtualenv = hasattr(sys, 'real_prefix') or \
+-        sys.prefix != getattr(sys, "base_prefix", sys.prefix)
+-
+-    # Are we running in a conda environment?
+-    conda = os.path.exists(os.path.join(sys.prefix, 'conda-meta'))
+-
+-    if virtualenv:
+-        return os.path.join(sys.prefix, 'include', 'site',
+-                            'python' + sys.version[:3])
+-    elif conda:
+-        if os.name == 'nt':
+-            return os.path.join(sys.prefix, 'Library', 'include')
+-        else:
+-            return os.path.join(sys.prefix, 'include')
+-    else:
+-        dist = Distribution({'name': 'pybind11'})
+-        dist.parse_config_files()
+-
+-        dist_cobj = dist.get_command_obj('install', create=True)
+-
+-        # Search for packages in user's home directory?
+-        if user:
+-            dist_cobj.user = user
+-            dist_cobj.prefix = ""
+-        dist_cobj.finalize_options()
+-
+-        return os.path.dirname(dist_cobj.install_headers)
++    return "@include@"
+-- 
+2.23.0
+
diff --git a/pkgs/development/python-modules/pybind11/default.nix b/pkgs/development/python-modules/pybind11/default.nix
index 0f386a7c42f..76e60fda86a 100644
--- a/pkgs/development/python-modules/pybind11/default.nix
+++ b/pkgs/development/python-modules/pybind11/default.nix
@@ -28,7 +28,7 @@ buildPythonPackage rec {
 
   cmakeFlags = [
     "-DEIGEN3_INCLUDE_DIR=${eigen}/include/eigen3"
-  ] ++ lib.optionals (!python.isPy2) [
+  ] ++ lib.optionals (python.isPy3k) [
   # Enable some tests only on Python 3. The "test_string_view" test
   # 'testTypeError: string_view16_chars(): incompatible function arguments'
   # fails on Python 2.
@@ -39,6 +39,14 @@ buildPythonPackage rec {
   dontUsePipInstall = true;
   dontUseSetuptoolsCheck = true;
 
+  patches = [
+    ./0001-Find-include-directory.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace pybind11/__init__.py --subst-var-by include "$out/include"
+  '';
+
   preFixup = ''
     pushd ..
     export PYBIND11_USE_CMAKE=1
@@ -50,8 +58,6 @@ buildPythonPackage rec {
     popd
   '';
 
-  installCheckTarget = "pytest";
-  doInstallCheck = true;
   checkInputs = [
     pytest
     numpy
diff --git a/pkgs/development/python-modules/pybullet/default.nix b/pkgs/development/python-modules/pybullet/default.nix
index b17e8a5aa94..d7b46f07749 100644
--- a/pkgs/development/python-modules/pybullet/default.nix
+++ b/pkgs/development/python-modules/pybullet/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "pybullet";
-  version = "2.5.8";
+  version = "2.6.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5824e902e0dd8bf7177ce5d9e038c6b04be65f72621fe13f93ec15c9d9c85a49";
+    sha256 = "c6da064687ae481c73b744b9f3a62d8231349a6bf368d7a2e564f71ef73e9403";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/pycares/default.nix b/pkgs/development/python-modules/pycares/default.nix
index f68a10d6186..22f519c0486 100644
--- a/pkgs/development/python-modules/pycares/default.nix
+++ b/pkgs/development/python-modules/pycares/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "pycares";
-  version = "3.0.0";
+  version = "3.1.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b253f5dcaa0ac7076b79388a3ac80dd8f3bd979108f813baade40d3a9b8bf0bd";
+    sha256 = "663c000625725d3a63466a674df4ee7f62bf8ca1ae8a0b87a6411eb811e0e794";
   };
 
   buildInputs = [ c-ares ];
diff --git a/pkgs/development/python-modules/pycurl/default.nix b/pkgs/development/python-modules/pycurl/default.nix
index ce11b8497cf..153a6e0377d 100644
--- a/pkgs/development/python-modules/pycurl/default.nix
+++ b/pkgs/development/python-modules/pycurl/default.nix
@@ -36,7 +36,7 @@ buildPythonPackage rec {
   ];
 
   checkPhase = ''
-    pytest tests -k "not test_ssl_in_static_libs \
+    HOME=$TMPDIR pytest tests -k "not test_ssl_in_static_libs \
                      and not test_keyfunction \
                      and not test_keyfunction_bogus_return \
                      and not test_libcurl_ssl_gnutls \
diff --git a/pkgs/development/python-modules/pyelftools/default.nix b/pkgs/development/python-modules/pyelftools/default.nix
index 1715749fa2d..c619df297fe 100644
--- a/pkgs/development/python-modules/pyelftools/default.nix
+++ b/pkgs/development/python-modules/pyelftools/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "pyelftools";
-  version = "0.25";
+  version = "0.26";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "89c6da6f56280c37a5ff33468591ba9a124e17d71fe42de971818cbff46c1b24";
+    sha256 = "86ac6cee19f6c945e8dedf78c6ee74f1112bd14da5a658d8c9d4103aed5756a2";
   };
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/pyfakefs/default.nix b/pkgs/development/python-modules/pyfakefs/default.nix
index b2dbfdba819..6bc2be39fd3 100644
--- a/pkgs/development/python-modules/pyfakefs/default.nix
+++ b/pkgs/development/python-modules/pyfakefs/default.nix
@@ -1,12 +1,12 @@
-{ stdenv, buildPythonPackage, fetchPypi, python, pytest, glibcLocales }:
+{ stdenv, buildPythonPackage, fetchPypi, python, pytest, glibcLocales, isPy37 }:
 
 buildPythonPackage rec {
-  version = "3.6.1";
+  version = "3.7.1";
   pname = "pyfakefs";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2654c665500ea8117b55cab51d4683a83ec1c76ddfae13640e509e4aac64b308";
+    sha256 = "1eb68bb250cc14310a6e33c197cbe2c8d93832b543f534e29b58286712f7e2b2";
   };
 
   postPatch = ''
@@ -24,6 +24,8 @@ buildPythonPackage rec {
       --replace "test_rename_dir_to_existing_dir" "notest_rename_dir_to_existing_dir"
   '');
 
+  # https://github.com/jmcgeheeiv/pyfakefs/issues/508
+  doCheck = !isPy37;
   checkInputs = [ pytest glibcLocales ];
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/pykeepass/default.nix b/pkgs/development/python-modules/pykeepass/default.nix
index bb1f60025db..1467783d76a 100644
--- a/pkgs/development/python-modules/pykeepass/default.nix
+++ b/pkgs/development/python-modules/pykeepass/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname   = "pykeepass";
-  version = "3.0.3";
+  version = "3.1.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2c9e2ddb03ee696ed8aa72c2cddfb81280614864e003226141d68b975aa56f6f";
+    sha256 = "280b0884243d059df888a61fd3fc77b2ea76dce4fdb1c1f60f3ab9139ca1259c";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pymatgen/default.nix b/pkgs/development/python-modules/pymatgen/default.nix
index b60aea364c6..ecc35d35736 100644
--- a/pkgs/development/python-modules/pymatgen/default.nix
+++ b/pkgs/development/python-modules/pymatgen/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "pymatgen";
-  version = "2019.10.16";
+  version = "2019.12.22";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a8e8b169001737cdf16bb89b26c391963ba2bead54ea510530a52586e2072234";
+    sha256 = "0ffc6efcc2ba15bff22cca29c07b93b01fac400f649c41d5dd01bfff7915f80b";
   };
 
   nativeBuildInputs = [ glibcLocales ];
diff --git a/pkgs/development/python-modules/pymavlink/default.nix b/pkgs/development/python-modules/pymavlink/default.nix
index 56a5bf07989..b909886ddb5 100644
--- a/pkgs/development/python-modules/pymavlink/default.nix
+++ b/pkgs/development/python-modules/pymavlink/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "pymavlink";
-  version = "2.4.2";
+  version = "2.4.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0vxqn36wldvpzag399a54r37bdgx052gv1k7akbnddcwry0n9vl0";
+    sha256 = "332d3d0291b4482641a5b3cd97e879817f50eb9c2b2ddcc30d51d619bad01b51";
   };
 
   propagatedBuildInputs = [ future lxml ];
diff --git a/pkgs/development/python-modules/pymc3/default.nix b/pkgs/development/python-modules/pymc3/default.nix
index 35e5f7aa69a..39472bb3177 100644
--- a/pkgs/development/python-modules/pymc3/default.nix
+++ b/pkgs/development/python-modules/pymc3/default.nix
@@ -16,12 +16,12 @@
 
 buildPythonPackage rec {
   pname = "pymc3";
-  version = "3.7";
+  version = "3.8";
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0ijna2ghvniryllr56qr4vi4k9q58mq21yx36nj5kg2j17f7rkbr";
+    sha256 = "1bb2915e4a29877c681ead13932b0b7d276f7f496e9c3f09ba96b977c99caf00";
   };
 
   # No need for coverage stats in Nix builds
diff --git a/pkgs/development/python-modules/pymongo/default.nix b/pkgs/development/python-modules/pymongo/default.nix
index 8748b0e559d..a10bb9169ed 100644
--- a/pkgs/development/python-modules/pymongo/default.nix
+++ b/pkgs/development/python-modules/pymongo/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "pymongo";
-  version = "3.9.0";
+  version = "3.10.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4249c6ba45587b959292a727532826c5032d59171f923f7f823788f413c2a5a3";
+    sha256 = "c43879fe427ea6aa6e84dae9fbdc5aa14428a4cfe613fe0fee2cc004bf3f307c";
   };
 
   # Tests call a running mongodb instance
diff --git a/pkgs/development/python-modules/pymssql/default.nix b/pkgs/development/python-modules/pymssql/default.nix
index c162f065b79..954be3f40e2 100644
--- a/pkgs/development/python-modules/pymssql/default.nix
+++ b/pkgs/development/python-modules/pymssql/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "pymssql";
-  version = "2.1.4";
+  version = "3.0.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1yvs3azd8dkf40lybr9wvswvf4hbxn5ys9ypansmbbb328dyn09j";
+    sha256 = "4d0ed31c76983d723c0c979b18e2273623621e630ca4901f17a86128aca13f84";
   };
 
   buildInputs = [cython setuptools-git];
diff --git a/pkgs/development/python-modules/pymupdf/default.nix b/pkgs/development/python-modules/pymupdf/default.nix
index c3f36c9c219..4ff50ad7b96 100644
--- a/pkgs/development/python-modules/pymupdf/default.nix
+++ b/pkgs/development/python-modules/pymupdf/default.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPythonPackage, fetchPypi, mupdf, swig }:
 buildPythonPackage rec {
   pname = "PyMuPDF";
-  version = "1.16.9";
+  version = "1.16.10";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "09h960ns42bbrv10bg99fad193yvg64snhw8x7d78wg3qqvnnicc";
+    sha256 = "d7893954f97fa6087629f3875f3be066dab51302e7c73f4c98c0516a8e2893fb";
   };
 
   patchPhase = ''
diff --git a/pkgs/development/python-modules/pyobjc/default.nix b/pkgs/development/python-modules/pyobjc/default.nix
index e71ab630b84..8576de1b379 100644
--- a/pkgs/development/python-modules/pyobjc/default.nix
+++ b/pkgs/development/python-modules/pyobjc/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonPackage rec {
   pname = "pyobjc";
-  version = "6.0.1";
+  version = "6.1";
 
   # Gives "No matching distribution found for
   # pyobjc-framework-Collaboration==4.0b1 (from pyobjc==4.0b1)"
@@ -10,7 +10,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f19dcd668473d61e500440569936b2272333ec385a603730c39f68a8d42b474b";
+    sha256 = "53ae86caaedc48350c6e93d6e778a0c5044e802340b6d6a679e55014758be540";
   };
 
   meta = {
diff --git a/pkgs/development/python-modules/pyodbc/default.nix b/pkgs/development/python-modules/pyodbc/default.nix
index 8064d9b6d57..bef4969d7d2 100644
--- a/pkgs/development/python-modules/pyodbc/default.nix
+++ b/pkgs/development/python-modules/pyodbc/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "pyodbc";
-  version = "4.0.27";
+  version = "4.0.28";
   disabled = isPyPy;  # use pypypdbc instead
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1kd2i7hc1330cli72vawzby17c3039cqn1aba4i0zrjnpghjhmib";
+    sha256 = "510643354c4c687ed96bf7e7cec4d02d6c626ecf3e18696f5a0228dd6d11b769";
   };
 
   buildInputs = [ unixODBC ];
diff --git a/pkgs/development/python-modules/pyopenssl/default.nix b/pkgs/development/python-modules/pyopenssl/default.nix
index 018463ead54..4e643257a0c 100644
--- a/pkgs/development/python-modules/pyopenssl/default.nix
+++ b/pkgs/development/python-modules/pyopenssl/default.nix
@@ -64,11 +64,11 @@ in
 
 buildPythonPackage rec {
   pname = "pyOpenSSL";
-  version = "19.0.0";
+  version = "19.1.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "aeca66338f6de19d1aa46ed634c3b9ae519a64b458f8468aec688e7e3c20f200";
+    sha256 = "9a24494b2602aaf402be5c9e30a0b82d4a5c67528fe8fb475e3f3bc00dd69507";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/python-modules/pyparsing/default.nix b/pkgs/development/python-modules/pyparsing/default.nix
index 854ca4d90ee..a47c271b76f 100644
--- a/pkgs/development/python-modules/pyparsing/default.nix
+++ b/pkgs/development/python-modules/pyparsing/default.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPythonPackage, fetchPypi }:
 buildPythonPackage rec {
     pname = "pyparsing";
-    version = "2.4.5";
+    version = "2.4.6";
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "4ca62001be367f01bd3e92ecbb79070272a9d4964dce6a48a82ff0b8bc7e683a";
+      sha256 = "4c830582a84fb022400b85429791bc551f1f4871c33f23e44f353119e92f969f";
     };
 
     # Not everything necessary to run the tests is included in the distribution
diff --git a/pkgs/development/python-modules/pyperf/default.nix b/pkgs/development/python-modules/pyperf/default.nix
index 51a08e1f7ea..4b14e2e5cc6 100644
--- a/pkgs/development/python-modules/pyperf/default.nix
+++ b/pkgs/development/python-modules/pyperf/default.nix
@@ -15,11 +15,11 @@
 
 buildPythonPackage rec {
   pname = "pyperf";
-  version = "1.6.1";
+  version = "1.7.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8d0143a22a13ee10c997a648f30b82cdc40175d5a20b11055ae058a82e45d371";
+    sha256 = "0d214aa65e085d3e4108a36152cb12f7cd0f4e7fda93b5134b43a9687c975786";
   };
 
   checkInputs = [ nose psutil ] ++
diff --git a/pkgs/development/python-modules/pyro-ppl/default.nix b/pkgs/development/python-modules/pyro-ppl/default.nix
index daed808deb1..a0545ece74a 100644
--- a/pkgs/development/python-modules/pyro-ppl/default.nix
+++ b/pkgs/development/python-modules/pyro-ppl/default.nix
@@ -1,12 +1,12 @@
 { buildPythonPackage, fetchPypi, lib, pytorch, contextlib2
 , graphviz, networkx, six, opt-einsum, tqdm }:
 buildPythonPackage rec {
-  version = "0.5.1";
+  version = "1.1.0";
   pname = "pyro-ppl";
 
   src = fetchPypi {
     inherit version pname;
-    sha256 = "cac2cb2a283c65d4187b7e19f0ff3b10a0ded1f377caba4f279c7898b206cd42";
+    sha256 = "5ca2fd19276fcfcf52babb48d22892a41d6238d7a6c65e63f704b070a3816479";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyscreenshot/default.nix b/pkgs/development/python-modules/pyscreenshot/default.nix
index 9e9d15e5295..2865380076a 100644
--- a/pkgs/development/python-modules/pyscreenshot/default.nix
+++ b/pkgs/development/python-modules/pyscreenshot/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "pyscreenshot";
-  version = "0.5.1";
+  version = "0.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "19ec6d17a61c0cd4e7fcf3ab2685598a54b53dc781755393cc5f76dcb7bf359c";
+    sha256 = "7322ad9454652b1702a3689646ce53ef01ed2b14869ea557030bd4e03a06fc0e";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyside/default.nix b/pkgs/development/python-modules/pyside/default.nix
index 3f20a6ae478..df309c5c68a 100644
--- a/pkgs/development/python-modules/pyside/default.nix
+++ b/pkgs/development/python-modules/pyside/default.nix
@@ -17,7 +17,7 @@ buildPythonPackage rec {
 
   buildInputs = [ mesa libGL ];
 
-  makeFlags = "QT_PLUGIN_PATH=" + pysideShiboken + "/lib/generatorrunner";
+  makeFlags = [ "QT_PLUGIN_PATH=${pysideShiboken}/lib/generatorrunner" ];
 
   meta = {
     description = "LGPL-licensed Python bindings for the Qt cross-platform application and UI framework";
diff --git a/pkgs/development/python-modules/pysocks/default.nix b/pkgs/development/python-modules/pysocks/default.nix
index ae17ed35105..e8d853d625d 100644
--- a/pkgs/development/python-modules/pysocks/default.nix
+++ b/pkgs/development/python-modules/pysocks/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "pysocks";
-  version = "1.7.0";
+  version = "1.7.1";
 
   src = fetchPypi {
     pname = "PySocks";
     inherit version;
-    sha256 = "0z4p31bpqm893cf87qqgb30k7nwd8kqfjwwjm5cvxb6zbyj1w0yr";
+    sha256 = "184sg65mbmih6ljblfsxcmq5js5l7dj3gpn618w9q5dy3rbh921z";
   };
 
   doCheck = false;
diff --git a/pkgs/development/python-modules/pytest-django/default.nix b/pkgs/development/python-modules/pytest-django/default.nix
index 4480cc1afcf..6b60eb6d3c5 100644
--- a/pkgs/development/python-modules/pytest-django/default.nix
+++ b/pkgs/development/python-modules/pytest-django/default.nix
@@ -10,11 +10,11 @@
 }:
 buildPythonPackage rec {
   pname = "pytest-django";
-  version = "3.6.0";
+  version = "3.7.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b6c900461a6a7c450dcf11736cabc289a90f5d6f28ef74c46e32e86ffd16a4bd";
+    sha256 = "17592f06d51c2ef4b7a0fb24aa32c8b6998506a03c8439606cb96db160106659";
   };
 
   nativeBuildInputs = [ pytest setuptools_scm ];
diff --git a/pkgs/development/python-modules/pytest-doctestplus/default.nix b/pkgs/development/python-modules/pytest-doctestplus/default.nix
index aa155e6b6ff..cdf60b7b07c 100644
--- a/pkgs/development/python-modules/pytest-doctestplus/default.nix
+++ b/pkgs/development/python-modules/pytest-doctestplus/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "pytest-doctestplus";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8872b9c236924af20c39c2813d7f1bde50a1edca7c4aba5a8bfbae3a32360e87";
+    sha256 = "41386187b9261cd59a3ffe4cf9df58d517288a1d3f11d96749b39b4e38b0a02c";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pytest-mock/default.nix b/pkgs/development/python-modules/pytest-mock/default.nix
index c6c8b6f4f5c..c4ef0d81111 100644
--- a/pkgs/development/python-modules/pytest-mock/default.nix
+++ b/pkgs/development/python-modules/pytest-mock/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "pytest-mock";
-  version = "1.11.2";
+  version = "1.13.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "04fgqm06vkg3k1ngha65g1k5a80x1g7pr11s78j2d72rj4w2ql7a";
+    sha256 = "e24a911ec96773022ebcc7030059b57cd3480b56d4f5d19b7c370ec635e6aed5";
   };
 
   propagatedBuildInputs = lib.optional (!isPy3k) mock;
diff --git a/pkgs/development/python-modules/pytest-mpl/default.nix b/pkgs/development/python-modules/pytest-mpl/default.nix
index edf0450366c..d86647b7503 100644
--- a/pkgs/development/python-modules/pytest-mpl/default.nix
+++ b/pkgs/development/python-modules/pytest-mpl/default.nix
@@ -4,15 +4,16 @@
 , pytest
 , matplotlib
 , nose
+, pillow
 }:
 
 buildPythonPackage rec {
   pname = "pytest-mpl";
-  version = "0.10";
+  version = "0.11";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "7006e63bf1ca9c50bea3d189c0f862751a16ce40bb373197b218f57af5b837c0";
+    sha256 = "26c5a47a8fdbc04652f18b65c587da642c6cc0354680ee44b16c161d9800a2ce";
   };
 
   buildInputs = [ pytest ];
@@ -20,6 +21,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     matplotlib
     nose
+    pillow
   ];
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/pytest-qt/default.nix b/pkgs/development/python-modules/pytest-qt/default.nix
index 4ce0241f415..201da93b018 100644
--- a/pkgs/development/python-modules/pytest-qt/default.nix
+++ b/pkgs/development/python-modules/pytest-qt/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "pytest-qt";
-  version = "3.2.2";
+  version = "3.3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f6ecf4b38088ae1092cbd5beeaf714516d1f81f8938626a2eac546206cdfe7fa";
+    sha256 = "714b0bf86c5313413f2d300ac613515db3a1aef595051ab8ba2ffe619dbe8925";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pytest-services/default.nix b/pkgs/development/python-modules/pytest-services/default.nix
index 2a4c5591a5f..c940dcadc7e 100644
--- a/pkgs/development/python-modules/pytest-services/default.nix
+++ b/pkgs/development/python-modules/pytest-services/default.nix
@@ -6,21 +6,23 @@
 , psutil
 , pytest
 , subprocess32
+, zc_lockfile
 }:
 
 buildPythonPackage rec {
   pname = "pytest-services";
-  version = "1.3.1";
+  version = "2.0.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "035bc9ce8addb33f7c2ec95a9c0c88926d213a6c2e12b2c57da31a4ec0765f2c";
+    sha256 = "0848cead86d3816b9c4e37cecfda31d21a4366f0dca2313ea29f3ca375c6295d";
   };
 
   propagatedBuildInputs = [
     requests
     psutil
     pytest
+    zc_lockfile
   ] ++ lib.optional (!isPy3k) subprocess32;
 
   # no tests in PyPI tarball
diff --git a/pkgs/development/python-modules/pytest-testmon/default.nix b/pkgs/development/python-modules/pytest-testmon/default.nix
index ed1b754a996..b8535da4c7a 100644
--- a/pkgs/development/python-modules/pytest-testmon/default.nix
+++ b/pkgs/development/python-modules/pytest-testmon/default.nix
@@ -7,21 +7,22 @@
 
 buildPythonPackage rec {
   pname = "pytest-testmon";
-  version = "0.9.19";
+  version = "1.0.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f622fd9d0f5a0df253f0e6773713c3df61306b64abdfb202d39a85dcba1d1f59";
+    sha256 = "b823b03faf5778d1e15fb9f52e104df4da9c1021daeb313b339fccbbfb8dbd5f";
   };
 
-  buildInputs = [ pytest ];
-
   propagatedBuildInputs = [ coverage ];
 
   checkInputs = [ pytest ];
 
+  # avoid tests which try to import unittest_mixins
+  # unittest_mixins doesn't seem to be very active
   checkPhase = ''
-    pytest --deselect=test/test_testmon.py::TestmonDeselect::test_dependent_testmodule
+    cd test
+    pytest test_{core,process_code,pytest_assumptions}.py
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pytest/4.nix b/pkgs/development/python-modules/pytest/4.nix
index 1148c87f0ba..2524dc61afd 100644
--- a/pkgs/development/python-modules/pytest/4.nix
+++ b/pkgs/development/python-modules/pytest/4.nix
@@ -3,7 +3,7 @@
 , atomicwrites, mock, writeText, pathlib2, wcwidth, packaging, isPyPy
 }:
 buildPythonPackage rec {
-  version = "4.6.7";
+  version = "4.6.8";
   pname = "pytest";
 
   preCheck = ''
@@ -13,7 +13,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9ea149066f566c943d3122f4b1cf1b577cab73189d11f490b54703fa5fa9df50";
+    sha256 = "6192875be8af57b694b7c4904e909680102befcb99e610ef3d9f786952f795aa";
   };
 
   checkInputs = [ hypothesis mock ];
diff --git a/pkgs/development/python-modules/pytest/default.nix b/pkgs/development/python-modules/pytest/default.nix
index a0e26b44201..48b6e89a10e 100644
--- a/pkgs/development/python-modules/pytest/default.nix
+++ b/pkgs/development/python-modules/pytest/default.nix
@@ -3,7 +3,7 @@
 , atomicwrites, mock, writeText, pathlib2, wcwidth, packaging, isPyPy, python
 }:
 buildPythonPackage rec {
-  version = "5.2.4";
+  version = "5.3.2";
   pname = "pytest";
 
   disabled = !isPy3k;
@@ -15,7 +15,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ff0090819f669aaa0284d0f4aad1a6d9d67a6efdc6dd4eb4ac56b704f890a0d6";
+    sha256 = "6b571215b5a790f9b41f19f3531c53a45cf6bb8ef2988bc1ff9afb38270b25fa";
   };
 
   checkInputs = [ hypothesis mock ];
diff --git a/pkgs/development/python-modules/pytestrunner/default.nix b/pkgs/development/python-modules/pytestrunner/default.nix
index ebe1c588faa..fa937e9626c 100644
--- a/pkgs/development/python-modules/pytestrunner/default.nix
+++ b/pkgs/development/python-modules/pytestrunner/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "pytest-runner";
-  version = "5.1";
+  version = "5.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "25a013c8d84f0ca60bb01bd11913a3bcab420f601f0f236de4423074af656e7a";
+    sha256 = "96c7e73ead7b93e388c5d614770d2bae6526efd997757d3543fe17b557a0942b";
   };
 
   nativeBuildInputs = [ setuptools_scm pytest ];
diff --git a/pkgs/development/python-modules/python-gitlab/default.nix b/pkgs/development/python-modules/python-gitlab/default.nix
index 4858ef8f8a6..bbdf7aa6033 100644
--- a/pkgs/development/python-modules/python-gitlab/default.nix
+++ b/pkgs/development/python-modules/python-gitlab/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname   = "python-gitlab";
-  version = "1.13.0";
+  version = "1.15.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "125zimbdprfx2j90dp19hyh60lzj11264bm494awc585pr6v9d3k";
+    sha256 = "45125a0ed4d0027d4317bdbd71ca02fc52b0ac160b9d2c3c5be131b4d19f867e";
   };
 
   propagatedBuildInputs = [ requests six ];
diff --git a/pkgs/development/python-modules/python-rapidjson/default.nix b/pkgs/development/python-modules/python-rapidjson/default.nix
index 213a1386a9b..9c2b18ba006 100644
--- a/pkgs/development/python-modules/python-rapidjson/default.nix
+++ b/pkgs/development/python-modules/python-rapidjson/default.nix
@@ -8,13 +8,13 @@
 }:
 
 buildPythonPackage rec {
-  version = "0.8.0";
+  version = "0.9.1";
   pname = "python-rapidjson";
   disabled = pythonOlder "3.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "13fgy5bqslx913p9gachj9djk3g6wx1igwaccfnxjl2msrbwclwp";
+    sha256 = "ad80bd7e4bb15d9705227630037a433e2e2a7982b54b51de2ebabdd1611394a1";
   };
 
   LC_ALL="en_US.utf-8";
diff --git a/pkgs/development/python-modules/python-redis-lock/default.nix b/pkgs/development/python-modules/python-redis-lock/default.nix
index 65c5e08d934..8aad5a1a7d2 100644
--- a/pkgs/development/python-modules/python-redis-lock/default.nix
+++ b/pkgs/development/python-modules/python-redis-lock/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "python-redis-lock";
-  version = "3.3.1";
+  version = "3.4.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5316d473ce6ce86a774b9f9c110d84c3a9bd1a2abfda5d99e9c0c8a872a8e6d6";
+    sha256 = "8e3ef458b9424daf35d587e69b63416a0c55ac46303f3aaff1bab4fe5a8f1e92";
   };
 
   checkInputs = [ pytest process-tests pkgs.redis ];
diff --git a/pkgs/development/python-modules/python-socketio/default.nix b/pkgs/development/python-modules/python-socketio/default.nix
index a666a6428e7..8f85f991534 100644
--- a/pkgs/development/python-modules/python-socketio/default.nix
+++ b/pkgs/development/python-modules/python-socketio/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "python-socketio";
-  version = "4.3.1";
+  version = "4.4.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "506b2cf7a520b40ea0b3f25e1272eff8de134dce6f471c1f6bc0de8c90fe8c57";
+    sha256 = "48cba5b827ac665dbf923a4f5ec590812aed5299a831fc43576a9af346272534";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/python-uinput/default.nix b/pkgs/development/python-modules/python-uinput/default.nix
index ba5a527fdb0..8f6c7c54cb2 100644
--- a/pkgs/development/python-modules/python-uinput/default.nix
+++ b/pkgs/development/python-modules/python-uinput/default.nix
@@ -12,7 +12,7 @@ buildPythonPackage rec {
 
   buildInputs = [ udev ];
 
-  NIX_CFLAGS_LINK = [ "-ludev" ];
+  NIX_CFLAGS_LINK = "-ludev";
 
   meta = with stdenv.lib; {
     description = "Pythonic API to Linux uinput kernel module";
diff --git a/pkgs/development/python-modules/python2-pythondialog/default.nix b/pkgs/development/python-modules/python2-pythondialog/default.nix
index 144887c75b3..a19156d1018 100644
--- a/pkgs/development/python-modules/python2-pythondialog/default.nix
+++ b/pkgs/development/python-modules/python2-pythondialog/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "python2-pythondialog";
-  version = "3.4.0";
+  version = "3.5.1";
   disabled = isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a96d9cea9a371b5002b5575d1ec351233112519268d382ba6f3582323b3d1335";
+    sha256 = "ad159c7b455d9cb2a5173590656d19a26e9cc208264cfab755f5827070d18613";
   };
 
   patchPhase = ''
diff --git a/pkgs/development/python-modules/pythondialog/default.nix b/pkgs/development/python-modules/pythondialog/default.nix
index d19fbd27116..4f54c5a8fad 100644
--- a/pkgs/development/python-modules/pythondialog/default.nix
+++ b/pkgs/development/python-modules/pythondialog/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "pythondialog";
-  version = "3.5.0";
+  version = "3.5.1";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "11ydvllwll23qmcd3saachcxzn1dj5if3kc36p37ncf06xc5c0m4";
+    sha256 = "34a0687290571f37d7d297514cc36bd4cd044a3a4355271549f91490d3e7ece8";
   };
 
   patchPhase = ''
diff --git a/pkgs/development/python-modules/pythonirclib/default.nix b/pkgs/development/python-modules/pythonirclib/default.nix
index d4f81a82546..6074b76d300 100644
--- a/pkgs/development/python-modules/pythonirclib/default.nix
+++ b/pkgs/development/python-modules/pythonirclib/default.nix
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     sha256 = "5fb8d95d6c95c93eaa400b38447c63e7a176b9502bc49b2f9b788c9905f4ec5e";
   })];
 
-  patchFlags = "irclib.py";
+  patchFlags = [ "irclib.py" ];
 
   propagatedBuildInputs = [ paver ];
 
diff --git a/pkgs/development/python-modules/pyunifi/default.nix b/pkgs/development/python-modules/pyunifi/default.nix
index f2395605d3a..c87d9d465bc 100644
--- a/pkgs/development/python-modules/pyunifi/default.nix
+++ b/pkgs/development/python-modules/pyunifi/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "pyunifi";
-  version = "2.18";
+  version = "2.19.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0875b830db93ed3270aee38ea24d3da9328672f0c499f0e432c895e0b02eadc9";
+    sha256 = "f022eb2135b88a9d391f4553fac1bf90f3808d660fd0058203f6f9e57214626b";
   };
 
   propagatedBuildInputs = [ requests ];
diff --git a/pkgs/development/python-modules/pyvcd/default.nix b/pkgs/development/python-modules/pyvcd/default.nix
index 0f97616e640..aff3280e86c 100644
--- a/pkgs/development/python-modules/pyvcd/default.nix
+++ b/pkgs/development/python-modules/pyvcd/default.nix
@@ -6,12 +6,12 @@
 , pytest }:
 
 buildPythonPackage rec {
-  version = "0.1.5";
+  version = "0.1.6";
   pname = "pyvcd";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9e796f8d00d8392716bef9759f118231f5d77d2fff79d8a32151e3bb5579ff25";
+    sha256 = "285fcd96c3ee482e7b222bdd01d5dd19c2f5a0ad9b8e950baa98d386a2758c8f";
   };
 
   buildInputs = [ setuptools_scm ];
diff --git a/pkgs/development/python-modules/pywbem/default.nix b/pkgs/development/python-modules/pywbem/default.nix
index d87d772db14..c5ffb79a5d6 100644
--- a/pkgs/development/python-modules/pywbem/default.nix
+++ b/pkgs/development/python-modules/pywbem/default.nix
@@ -5,14 +5,14 @@
 
 buildPythonPackage rec {
   pname = "pywbem";
-  version = "0.14.6";
+  version = "0.15.0";
 
   # Support added in master https://github.com/pywbem/pywbem/commit/b2f2f1a151a30355bbc6652dca69a7b30bfe941e awaiting release
   disabled = isPy37;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5ed6ac486a0a363848f2091a49ddc1c4e0871c6feb71766cc0e266e9c6fd084f";
+    sha256 = "6f4304518b2ba89a97bd4f5f0decc8ad382b38a9303032ae17a1a601d95d24b8";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pywinrm/default.nix b/pkgs/development/python-modules/pywinrm/default.nix
index 3bdc5efaaa5..9ed44c83b60 100644
--- a/pkgs/development/python-modules/pywinrm/default.nix
+++ b/pkgs/development/python-modules/pywinrm/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "pywinrm";
-  version = "0.3.0";
+  version = "0.4.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "799fc3e33fec8684443adf5778860388289102ea4fa1458f1bf307d167855573";
+    sha256 = "4ede5c6c85b53780ad0dbf9abef2fa2ea58f44c82256a84a63eae5f1205cea81";
   };
 
   checkInputs = [ mock pytest ];
diff --git a/pkgs/development/python-modules/pyxattr/default.nix b/pkgs/development/python-modules/pyxattr/default.nix
index 7a137f5204c..cba29c5cc9e 100644
--- a/pkgs/development/python-modules/pyxattr/default.nix
+++ b/pkgs/development/python-modules/pyxattr/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
     pname = "pyxattr";
-    version = "0.6.1";
+    version = "0.7.1";
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "b525843f6b51036198b3b87c4773a5093d6dec57d60c18a1f269dd7059aa16e3";
+      sha256 = "965388dd629334e850aa989a67d2360ec8257cfe8f67d07c29f980d3152f2882";
     };
 
     # IOError: [Errno 95] Operation not supported (expected)
diff --git a/pkgs/development/python-modules/pyxl3/default.nix b/pkgs/development/python-modules/pyxl3/default.nix
index 2f73a85db7b..c30dd0f024f 100644
--- a/pkgs/development/python-modules/pyxl3/default.nix
+++ b/pkgs/development/python-modules/pyxl3/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "pyxl3";
-  version = "1.2";
+  version = "1.3";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f1fc74d2ab59073ef6bf0ce01b4f2891366bbf89a8187de85433486b284df758";
+    sha256 = "23831c6d60b2ce3fbb39966f6fb21a5e053d6ce0bd08b00bb50fa388631b69ee";
   };
 
   checkInputs = [ unittest2 ];
diff --git a/pkgs/development/python-modules/pyyaml/default.nix b/pkgs/development/python-modules/pyyaml/default.nix
index a5cf530a300..316e9974cfe 100644
--- a/pkgs/development/python-modules/pyyaml/default.nix
+++ b/pkgs/development/python-modules/pyyaml/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "PyYAML";
-  version = "5.1.2";
+  version = "5.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "01adf0b6c6f61bd11af6e10ca52b7d4057dd0be0343eb9283c878cf3af56aee4";
+    sha256 = "c0ee8eca2c582d29c3c2ec6e2c4f703d1b7f1fb10bc72317355a746057e7346c";
   };
 
   # force regeneration using Cython
diff --git a/pkgs/development/python-modules/qimage2ndarray/default.nix b/pkgs/development/python-modules/qimage2ndarray/default.nix
index 73a0004e654..646d326fede 100644
--- a/pkgs/development/python-modules/qimage2ndarray/default.nix
+++ b/pkgs/development/python-modules/qimage2ndarray/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "qimage2ndarray";
-  version = "1.8";
+  version = "1.8.2";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "7b9eb08a9be27f5439289d90d7d5a5942aad403d5634fe336eb915678c65db48";
+    sha256 = "0f792693a0f1cd5f93fbf73bc3fb2d511fb9cceed3c9308bfb200f38c19a5545";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/qiskit/default.nix b/pkgs/development/python-modules/qiskit/default.nix
index 4d84ac07a04..89d02f7b803 100644
--- a/pkgs/development/python-modules/qiskit/default.nix
+++ b/pkgs/development/python-modules/qiskit/default.nix
@@ -21,13 +21,13 @@
 
 buildPythonPackage rec {
   pname = "qiskit";
-  version = "0.13.0";
+  version = "0.14.0";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e9c0f23dddb0af27e2bfb920f6ea8600516fa68ec9ae97639faf858ba5d28020";
+    sha256 = "d086a21d0eee61bb12e1f2cd6148a7292005fd10584ca33d6c404dd5c53ba95f";
   };
 
   buildInputs = [ cmake ]
diff --git a/pkgs/development/python-modules/qtconsole/default.nix b/pkgs/development/python-modules/qtconsole/default.nix
index 95ee3a864e6..885eee8d4b6 100644
--- a/pkgs/development/python-modules/qtconsole/default.nix
+++ b/pkgs/development/python-modules/qtconsole/default.nix
@@ -14,11 +14,11 @@
 
 buildPythonPackage rec {
   pname = "qtconsole";
-  version = "4.5.5";
+  version = "4.6.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1nf64wl3ni0q69ihcm5y6zl12mmg7gvkhrb98hbgwv3yb09787mr";
+    sha256 = "654f423662e7dfe6a9b26fac8ec76aedcf742c339909ac49f1f0c1a1b744bcd1";
   };
 
   checkInputs = [ nose ] ++ lib.optionals isPy27 [mock];
diff --git a/pkgs/development/python-modules/rainbowstream/default.nix b/pkgs/development/python-modules/rainbowstream/default.nix
index ca6e4614f33..7fc7f057009 100644
--- a/pkgs/development/python-modules/rainbowstream/default.nix
+++ b/pkgs/development/python-modules/rainbowstream/default.nix
@@ -15,11 +15,11 @@
 
 buildPythonPackage rec {
   pname = "rainbowstream";
-  version = "1.4.0";
+  version = "1.5.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "16881d8bb15416389eeaf4ceee7a588069060c216b55e7602dbcff5134feb7cc";
+    sha256 = "527d39778c55d88300fe2017913341bfa1b1f0ffdc1fe5eab57a82bf4cd2edb3";
   };
 
   patches = [ ./image.patch ];
diff --git a/pkgs/development/python-modules/readme_renderer/default.nix b/pkgs/development/python-modules/readme_renderer/default.nix
index df943cfcca4..8369c3df943 100644
--- a/pkgs/development/python-modules/readme_renderer/default.nix
+++ b/pkgs/development/python-modules/readme_renderer/default.nix
@@ -28,7 +28,8 @@ buildPythonPackage rec {
 
   checkPhase = ''
     # disable one failing test case
-    py.test -k "not test_invalid_link"
+    # fixtures test is failing for incorrect class name
+    py.test -k "not test_invalid_link and not fixtures"
   '';
 
   meta = {
diff --git a/pkgs/development/python-modules/regex/default.nix b/pkgs/development/python-modules/regex/default.nix
index ec2b872c7f8..5a0cb50903a 100644
--- a/pkgs/development/python-modules/regex/default.nix
+++ b/pkgs/development/python-modules/regex/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "regex";
-  version = "2019.08.19";
+  version = "2019.12.20";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "587b62d48ca359d2d4f02d486f1f0aa9a20fbaf23a9d4198c4bed72ab2f6c849";
+    sha256 = "106e25a841921d8259dcef2a42786caae35bc750fb996f830065b3dfaa67b77e";
   };
 
   postCheck = ''
diff --git a/pkgs/development/python-modules/remotecv/default.nix b/pkgs/development/python-modules/remotecv/default.nix
index a4d1dcc485e..5c401fe799b 100644
--- a/pkgs/development/python-modules/remotecv/default.nix
+++ b/pkgs/development/python-modules/remotecv/default.nix
@@ -34,5 +34,6 @@ buildPythonPackage rec {
     homepage = https://github.com/thumbor/remotecv/wiki;
     license = licenses.mit;
     maintainers = with maintainers; [ jluttine ];
+    broken = true; # no longer compatible with latest pillow
   };
 }
diff --git a/pkgs/development/python-modules/responses/default.nix b/pkgs/development/python-modules/responses/default.nix
index 98cf19a8f0a..e98aad824b6 100644
--- a/pkgs/development/python-modules/responses/default.nix
+++ b/pkgs/development/python-modules/responses/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "responses";
-  version = "0.10.7";
+  version = "0.10.9";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "46d4e546a19fc6106bc7e804edd4551ef04690405e41e7e750ebc295d042623b";
+    sha256 = "8ce8cb4e7e1ad89336f8865af152e0563d2e7f0e0b86d2cf75f015f819409243";
   };
 
   propagatedBuildInputs = [ cookies mock requests six ];
diff --git a/pkgs/development/python-modules/rlp/default.nix b/pkgs/development/python-modules/rlp/default.nix
index c8c4315b66b..303a8bc6d7f 100644
--- a/pkgs/development/python-modules/rlp/default.nix
+++ b/pkgs/development/python-modules/rlp/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "rlp";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0742hdnhwcx1bm7pdk83290rxfcb0i2xskgl8yn6lg8fql1hms7b";
+    sha256 = "27273fc2dbc3513c1e05ea6b8af28aac8745fb09c164e39e2ed2807bf7e1b342";
   };
 
   checkInputs = [ pytest hypothesis ];
diff --git a/pkgs/development/python-modules/rpy2/default.nix b/pkgs/development/python-modules/rpy2/default.nix
index bc4bc0bcb5b..5a00b18557a 100644
--- a/pkgs/development/python-modules/rpy2/default.nix
+++ b/pkgs/development/python-modules/rpy2/default.nix
@@ -24,13 +24,13 @@
 }:
 
 buildPythonPackage rec {
-    version = "3.2.2";
+    version = "3.2.4";
     pname = "rpy2";
 
     disabled = isPyPy;
     src = fetchPypi {
       inherit version pname;
-      sha256 = "0b3jpn9x7m2pccriyzgfsdb68qp6nq4ffhvjy1q2ar8wdxvmf5xp";
+      sha256 = "3daf1a4b28c4e354ef989093f03b066908bf6e5082a6f4af72cc3fd928a28dc6";
     };
 
     buildInputs = [
diff --git a/pkgs/development/python-modules/runway-python/default.nix b/pkgs/development/python-modules/runway-python/default.nix
index c54c5d73cf6..5c60b6379e9 100644
--- a/pkgs/development/python-modules/runway-python/default.nix
+++ b/pkgs/development/python-modules/runway-python/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "runway-python";
-  version = "0.5.4";
+  version = "0.5.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c5293bca6589747db687c593b81f52dc9df8155367ffa57ddc1993a6f9d95bde";
+    sha256 = "06e0138cc4cf2ddb7304502f5c7b53269ce73679c5784c8d6b423db04d179c18";
   };
 
   propagatedBuildInputs = [ flask flask-cors numpy pillow gevent wget six colorcet ];
diff --git a/pkgs/development/python-modules/s3fs/default.nix b/pkgs/development/python-modules/s3fs/default.nix
index f04274d6b50..5c0d34a3e90 100644
--- a/pkgs/development/python-modules/s3fs/default.nix
+++ b/pkgs/development/python-modules/s3fs/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "s3fs";
-  version = "0.3.5";
+  version = "0.4.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f1d8d80ae7789e6c95f8432e3ec12d1c28e624aecf8c84afed373fb182b505ab";
+    sha256 = "504a41ecb9edf0bd7798847b61839954e50508c5235ec7ee48c539ce46b4fa18";
   };
 
   buildInputs = [ docutils ];
diff --git a/pkgs/development/python-modules/scapy/default.nix b/pkgs/development/python-modules/scapy/default.nix
index 8f51b1eda21..4f058a0761b 100644
--- a/pkgs/development/python-modules/scapy/default.nix
+++ b/pkgs/development/python-modules/scapy/default.nix
@@ -34,13 +34,13 @@ buildPythonPackage rec {
   '';
 
   propagatedBuildInputs = [ pycrypto ecdsa ]
-    ++ lib.optional withOptionalDeps [ tcpdump ipython ]
-    ++ lib.optional withCryptography [ cryptography ]
-    ++ lib.optional withVoipSupport [ sox ]
-    ++ lib.optional withPlottingSupport [ matplotlib ]
-    ++ lib.optional withGraphicsSupport [ pyx texlive.combined.scheme-minimal graphviz imagemagick ]
-    ++ lib.optional (isPy3k && pythonOlder "3.4") [ enum34 ]
-    ++ lib.optional doCheck [ mock ];
+    ++ lib.optionals withOptionalDeps [ tcpdump ipython ]
+    ++ lib.optional withCryptography cryptography
+    ++ lib.optional withVoipSupport sox
+    ++ lib.optional withPlottingSupport matplotlib
+    ++ lib.optionals withGraphicsSupport [ pyx texlive.combined.scheme-minimal graphviz imagemagick ]
+    ++ lib.optional (isPy3k && pythonOlder "3.4") enum34
+    ++ lib.optional doCheck mock;
 
   # Tests fail with Python 3.6 (seems to be an upstream bug, I'll investigate)
   doCheck = if isPy3k then false else true;
diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index 682d70df393..6c62adb7821 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -1,17 +1,24 @@
-{lib, fetchPypi, python, buildPythonPackage, gfortran, nose, pytest, numpy}:
-
-buildPythonPackage rec {
+{lib, fetchPypi, python, buildPythonPackage, gfortran, nose, pytest, numpy, pybind11}:
+
+let
+  pybind = pybind11.overridePythonAttrs(oldAttrs: {
+    cmakeFlags = oldAttrs.cmakeFlags ++ [
+      "-DPYBIND11_TEST=off"
+    ];
+    doCheck = false; # Circular test dependency
+  });
+in buildPythonPackage rec {
   pname = "scipy";
-  version = "1.3.3";
+  version = "1.4.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "64bf4e8ae0db2d42b58477817f648d81e77f0b381d0ea4427385bba3f959380a";
+    sha256 = "dee1bbf3a6c8f73b6b218cb28eed8dd13347ea2f87d572ce19b289d6fd3fbc59";
   };
 
   checkInputs = [ nose pytest ];
   nativeBuildInputs = [ gfortran ];
-  buildInputs = [ numpy.blas ];
+  buildInputs = [ numpy.blas pybind ];
   propagatedBuildInputs = [ numpy ];
 
   # Remove tests because of broken wrapper
@@ -19,9 +26,7 @@ buildPythonPackage rec {
     rm scipy/linalg/tests/test_lapack.py
   '';
 
-  # INTERNALERROR, solved with https://github.com/scipy/scipy/pull/8871
-  # however, it does not apply cleanly.
-  doCheck = false;
+  doCheck = true;
 
   preConfigure = ''
     sed -i '0,/from numpy.distutils.core/s//import setuptools;from numpy.distutils.core/' setup.py
diff --git a/pkgs/development/python-modules/scrapy/default.nix b/pkgs/development/python-modules/scrapy/default.nix
index 14ab6e51582..8fee4b6631a 100644
--- a/pkgs/development/python-modules/scrapy/default.nix
+++ b/pkgs/development/python-modules/scrapy/default.nix
@@ -2,7 +2,7 @@
   testfixtures, pillow, six, twisted, w3lib, lxml, queuelib, pyopenssl,
   service-identity, parsel, pydispatcher, cssselect, lib }:
 buildPythonPackage rec {
-  version = "1.7.4";
+  version = "1.8.0";
   pname = "Scrapy";
 
   checkInputs = [ glibcLocales mock pytest botocore testfixtures pillow ];
@@ -31,7 +31,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f0813d23a3f5659f403f469b11488ecd81e989e834205c4366cd231536496513";
+    sha256 = "fe06576f9a4971de9dc0175c60fd92561e8275f2bad585c1cb5d65c5181b2db0";
   };
 
   postInstall = ''
diff --git a/pkgs/development/python-modules/semantic-version/default.nix b/pkgs/development/python-modules/semantic-version/default.nix
index 66499224564..f2df3c99b2a 100644
--- a/pkgs/development/python-modules/semantic-version/default.nix
+++ b/pkgs/development/python-modules/semantic-version/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "semantic_version";
-  version = "2.8.3";
+  version = "2.8.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9dcc6fbad58da3c4d5eee2287025e226bb05c39463f14b741357801baae9dcce";
+    sha256 = "352459f640f3db86551d8054d1288608b29a96e880c7746f0a59c92879d412a3";
   };
 
   # ModuleNotFoundError: No module named 'tests'
diff --git a/pkgs/development/python-modules/shodan/default.nix b/pkgs/development/python-modules/shodan/default.nix
index 8cad6885570..52dc89e3a96 100644
--- a/pkgs/development/python-modules/shodan/default.nix
+++ b/pkgs/development/python-modules/shodan/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "shodan";
-  version = "1.20.0";
+  version = "1.21.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "163fbz06xg4ncvmgsg85x2689zd1bvycc3506xqvcgh8xcz3izif";
+    sha256 = "834dfd084fed290b2b445545b0d1cac7822f3c0ed6ba09707efb1716bb485ede";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/simplejson/default.nix b/pkgs/development/python-modules/simplejson/default.nix
index abd4854c73f..54e19d2e604 100644
--- a/pkgs/development/python-modules/simplejson/default.nix
+++ b/pkgs/development/python-modules/simplejson/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "simplejson";
-  version = "3.16.1";
+  version = "3.17.0";
   doCheck = !stdenv.isDarwin;
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "1v80dbk3ajhgz7q5cc8k0dd22zj9rrlz838c90l5g3w1i280r1iq";
+    sha256 = "1b1hhh1dia673vhq3jl2br1iqwb9yjii6iak56w96s9972vjbz3z";
   };
 
   # Package does not need pytest, but its a bit easier debugging.
diff --git a/pkgs/development/python-modules/six/default.nix b/pkgs/development/python-modules/six/default.nix
index 78e7a5f0538..8bfd32aa093 100644
--- a/pkgs/development/python-modules/six/default.nix
+++ b/pkgs/development/python-modules/six/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "six";
-  version = "1.12.0";
+  version = "1.13.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d16a0141ec1a18405cd4ce8b4613101da75da0e9a7aec5bdd4fa804d0e0eba73";
+    sha256 = "30f610279e8b2578cab6db20741130331735c781b56053c59c4076da27f06b66";
   };
 
   checkInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/slicedimage/default.nix b/pkgs/development/python-modules/slicedimage/default.nix
index edc21e3292d..3273e5fe3a3 100644
--- a/pkgs/development/python-modules/slicedimage/default.nix
+++ b/pkgs/development/python-modules/slicedimage/default.nix
@@ -17,11 +17,11 @@
 
 buildPythonPackage rec {
   pname = "slicedimage";
-  version = "4.0.5";
+  version = "4.1.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c8e8759a013a0936ec9f7ffcd37fc64df69af913b4f26342c2501b8c3663d9bb";
+    sha256 = "7369f1d7fa09f6c9969625c4b76a8a63d2507a94c6fc257183da1c10261703e9";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/slither-analyzer/default.nix b/pkgs/development/python-modules/slither-analyzer/default.nix
index 1619d9e112c..0f12dbb8850 100644
--- a/pkgs/development/python-modules/slither-analyzer/default.nix
+++ b/pkgs/development/python-modules/slither-analyzer/default.nix
@@ -6,7 +6,7 @@
 
 buildPythonPackage rec {
   pname = "slither-analyzer";
-  version = "0.3.0";
+  version = "0.6.9";
 
   disabled = pythonOlder "3.6";
 
@@ -15,7 +15,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "10vrcqm371kqmf702xmqmzimv3xgrn3k3ip06nr1l6gnj3jk138g";
+    sha256 = "fb057eb7f5416ac76b6ab03bb5c20c39cb7b97c7689ce1e7244c9088bd28f513";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/python-modules/solo-python/default.nix b/pkgs/development/python-modules/solo-python/default.nix
index 829874f25ad..52d7d7539f9 100644
--- a/pkgs/development/python-modules/solo-python/default.nix
+++ b/pkgs/development/python-modules/solo-python/default.nix
@@ -48,5 +48,6 @@
     homepage = "https://github.com/solokeys/solo-python";
     maintainers = with maintainers; [ wucke13 ];
     license = with licenses; [ asl20 mit ];
+    broken = true; # no longer compatible with fido2
   };
 }
diff --git a/pkgs/development/python-modules/sparqlwrapper/default.nix b/pkgs/development/python-modules/sparqlwrapper/default.nix
index 0a51bb5f9e8..fe400630507 100644
--- a/pkgs/development/python-modules/sparqlwrapper/default.nix
+++ b/pkgs/development/python-modules/sparqlwrapper/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "SPARQLWrapper";
-  version = "1.8.4";
+  version = "1.8.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "21928e7a97f565e772cdeeb0abad428960f4307e3a13dbdd8f6d3da8a6a506c9";
+    sha256 = "d6a66b5b8cda141660e07aeb00472db077a98d22cb588c973209c7336850fb3c";
   };
 
   # break circular dependency loop
diff --git a/pkgs/development/python-modules/sphinx/default.nix b/pkgs/development/python-modules/sphinx/default.nix
index 307232903e8..d9f64a93813 100644
--- a/pkgs/development/python-modules/sphinx/default.nix
+++ b/pkgs/development/python-modules/sphinx/default.nix
@@ -16,7 +16,6 @@
 , Babel
 , snowballstemmer
 , six
-, sqlalchemy
 , whoosh
 , imagesize
 , requests
@@ -33,11 +32,11 @@
 
 buildPythonPackage rec {
   pname = "sphinx";
-  version = "2.2.0";
+  version = "2.2.2";
   src = fetchPypi {
     pname = "Sphinx";
     inherit version;
-    sha256 = "0d586b0f8c2fc3cc6559c5e8fd6124628110514fda0e5d7c82e682d749d2e845";
+    sha256 = "1wjcm382824rq8ijls9mlqwl2h8l26s201v5fwprhnins671m72m";
   };
   LC_ALL = "en_US.UTF-8";
 
@@ -56,7 +55,6 @@ buildPythonPackage rec {
     setuptools
     snowballstemmer
     six
-    sqlalchemy
     whoosh
     imagesize
     requests
diff --git a/pkgs/development/python-modules/sphinxcontrib-blockdiag/default.nix b/pkgs/development/python-modules/sphinxcontrib-blockdiag/default.nix
index 1eeb40ddbc2..b8f23afabcd 100644
--- a/pkgs/development/python-modules/sphinxcontrib-blockdiag/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-blockdiag/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "sphinxcontrib-blockdiag";
-  version = "1.5.5";
+  version = "2.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1w7q2hhpzk159wd35hlbwkh80hnglqa475blcd9vjwpkv1kgkpvw";
+    sha256 = "91fd35b64f1f25db59d80b8a5196ed4ffadf57a81f63ee207e34d53ec36d8f97";
   };
 
   buildInputs = [ mock sphinx-testing ];
diff --git a/pkgs/development/python-modules/splinter/default.nix b/pkgs/development/python-modules/splinter/default.nix
index 274a5148d8a..fac73dc8715 100644
--- a/pkgs/development/python-modules/splinter/default.nix
+++ b/pkgs/development/python-modules/splinter/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "splinter";
-  version = "0.11.0";
+  version = "0.13.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0ddv80dv54rraa18lg9v7m9z61wzfwv6ww9ld83mr32gy3a2238p";
+    sha256 = "9e92535f273622507ac157612c3bb0e9cee7b5ccd2aa097d47b408e34c2ca356";
   };
 
   propagatedBuildInputs = [ selenium ];
diff --git a/pkgs/development/python-modules/spyder-kernels/default.nix b/pkgs/development/python-modules/spyder-kernels/default.nix
index 86daec23d95..f4d57ce579e 100644
--- a/pkgs/development/python-modules/spyder-kernels/default.nix
+++ b/pkgs/development/python-modules/spyder-kernels/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "spyder-kernels";
-  version = "0.5.2";
+  version = "1.8.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "01354b7fa180a87212cc005553b31a7300159b108d36828e301d3782291323f7";
+    sha256 = "a782fc5961a9dd48d520ddc1c868b960d54b8edb1116c21fc2e3c347fe5a4474";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/spyder/default.nix b/pkgs/development/python-modules/spyder/default.nix
index b707d4a0abc..47094fcb993 100644
--- a/pkgs/development/python-modules/spyder/default.nix
+++ b/pkgs/development/python-modules/spyder/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "spyder";
-  version = "3.3.6";
+  version = "4.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1z7qw1h3rhca12ycv8xrzw6z2gf81v0j6lfq9kpwh472w4vk75v1";
+    sha256 = "f2bfece9743188e3d1da68f02271a7c6eb7f0a3b692c3df4952458ab96b037a8";
   };
 
   nativeBuildInputs = [ pyqtwebengine.wrapQtAppsHook ];
diff --git a/pkgs/development/python-modules/sqlalchemy-utils/default.nix b/pkgs/development/python-modules/sqlalchemy-utils/default.nix
index 3db00057c90..c58ec72498a 100644
--- a/pkgs/development/python-modules/sqlalchemy-utils/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy-utils/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "sqlalchemy-utils";
-  version = "0.35.0";
+  version = "0.36.0";
 
   src = fetchPypi {
     inherit version;
     pname = "SQLAlchemy-Utils";
-    sha256 = "0phsdcnm21qvxd00zmjd6yxbm1s0i7b1q8zrgfy8cqv9xpmz1w01";
+    sha256 = "1wkk6jj0jkp2hi3ziqw95q0b19zabpvzm6v5kixgnssj027hq0yv";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/sqlobject/default.nix b/pkgs/development/python-modules/sqlobject/default.nix
index 52b2fad62a2..05dab8d0265 100644
--- a/pkgs/development/python-modules/sqlobject/default.nix
+++ b/pkgs/development/python-modules/sqlobject/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "SQLObject";
-  version = "3.7.3";
+  version = "3.8.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0dgzmzdv3alfdqcrl4x0xf9161ls80h33rnqbz0yhmfpkjg99b9n";
+    sha256 = "00fb93313067cdbe52fe436eef1e79038b42c969cf44016b24f9eae0511db2d7";
   };
 
   checkInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/squaremap/default.nix b/pkgs/development/python-modules/squaremap/default.nix
index f237d982abb..fb339550062 100644
--- a/pkgs/development/python-modules/squaremap/default.nix
+++ b/pkgs/development/python-modules/squaremap/default.nix
@@ -2,6 +2,8 @@
 , buildPythonPackage
 , isPy3k
 , fetchPypi
+, six
+, wxPython
 }:
 
 buildPythonPackage rec {
@@ -10,14 +12,18 @@ buildPythonPackage rec {
   disabled = isPy3k;
 
   src = fetchPypi {
-    inherit pname version;
-    sha256 = "b16ce5950cbfa63e3284015095293cd26ed5e26045fd14d488fb825b4f95e9a8";
+    pname = "SquareMap";
+    inherit version;
+    sha256 = "1a79jm7mp0pvi3a19za5c3idavnj7hlral01hhr3x9mz1jayav5i";
   };
 
+  propagatedBuildInputs = [ six wxPython ];
+
   meta = with stdenv.lib; {
     description = "Hierarchic visualization control for wxPython";
     homepage = https://launchpad.net/squaremap;
     license = licenses.bsd3;
+    broken = true; # wxPython doesn't seem to be able to be detected by pip
   };
 
 }
diff --git a/pkgs/development/python-modules/starfish/default.nix b/pkgs/development/python-modules/starfish/default.nix
index 38934d9497a..8fc0a23b065 100644
--- a/pkgs/development/python-modules/starfish/default.nix
+++ b/pkgs/development/python-modules/starfish/default.nix
@@ -26,11 +26,11 @@
 
 buildPythonPackage rec {
   pname = "starfish";
-  version = "0.1.9";
+  version = "0.1.10";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "02002b908572fcd2c7471475936a6c375f143d15df871399ce86ced6d7aef865";
+    sha256 = "0340e37b732e184081b150f21bbbd4eed3643ab49f74633b9c4d827bda663235";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/starlette/default.nix b/pkgs/development/python-modules/starlette/default.nix
index 9fd1d56ea1a..a2170db1bd4 100644
--- a/pkgs/development/python-modules/starlette/default.nix
+++ b/pkgs/development/python-modules/starlette/default.nix
@@ -1,7 +1,7 @@
 { lib
 , stdenv
 , buildPythonPackage
-, fetchFromGitHub
+, fetchPypi
 , aiofiles
 , graphene
 , itsdangerous
@@ -20,14 +20,12 @@
 
 buildPythonPackage rec {
   pname = "starlette";
-  version = "0.12.9";
+  version = "0.13.0";
   disabled = isPy27;
 
-  src = fetchFromGitHub {
-    owner = "encode";
-    repo = "starlette";
-    rev = version;
-    sha256 = "0w44s8ynzy8w8dgm755c8jina9i4dd87vqkcv7jc1kwkg384w9i5";
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "6bd414152d40d000ccbf6aa40ed89718b40868366a0f69fb83034f416303acef";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/stripe/default.nix b/pkgs/development/python-modules/stripe/default.nix
index b60aa7666fb..d564adbc6e2 100644
--- a/pkgs/development/python-modules/stripe/default.nix
+++ b/pkgs/development/python-modules/stripe/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonPackage rec {
   pname = "stripe";
-  version = "2.37.2";
+  version = "2.41.0";
 
   # Tests require network connectivity and there's no easy way to disable
   # them. ~ C.
@@ -10,7 +10,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "7ad8ee6d9bdca86d6ed38c4eb48b1b67b9529ac4fee6c26d3f9aa4d5e98b50d6";
+    sha256 = "2f0ec677136985ece9cca232f106c2a87193261cac1fe58d4e959215310a0da8";
   };
 
   propagatedBuildInputs = [ requests ];
diff --git a/pkgs/development/python-modules/svg-path/default.nix b/pkgs/development/python-modules/svg-path/default.nix
index 3a11bf67e13..ac62b8b415d 100644
--- a/pkgs/development/python-modules/svg-path/default.nix
+++ b/pkgs/development/python-modules/svg-path/default.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPythonPackage, fetchPypi }:
 buildPythonPackage rec {
   pname = "svg.path";
-  version = "3.0";
+  version = "4.0.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "7b568f90f67fd25413c8da9f8bc9f9f8ab089425c20fa03330e97e77d13880ee";
+    sha256 = "4bd627ec6526cd5da14f3c6a51205d930187db2d8992aed626825492c033b195";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/python-modules/tblib/default.nix b/pkgs/development/python-modules/tblib/default.nix
index 62e7faa121f..55a164773ca 100644
--- a/pkgs/development/python-modules/tblib/default.nix
+++ b/pkgs/development/python-modules/tblib/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "tblib";
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1735ff8fd6217446384b5afabead3b142cf1a52d242cfe6cab4240029d6d131a";
+    sha256 = "229bee3754cb5d98b4837dd5c4405e80cfab57cb9f93220410ad367f8b352344";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/python-modules/tenacity/default.nix b/pkgs/development/python-modules/tenacity/default.nix
index 254b91891c7..fa039e7b170 100644
--- a/pkgs/development/python-modules/tenacity/default.nix
+++ b/pkgs/development/python-modules/tenacity/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "tenacity";
-  version = "5.1.5";
+  version = "6.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e664bd94f088b17f46da33255ae33911ca6a0fe04b156d334b601a4ef66d3c5f";
+    sha256 = "72f397c2bb1887e048726603f3f629ea16f88cb3e61e4ed3c57e98582b8e3571";
   };
 
   nativeBuildInputs = [ pbr setuptools_scm ];
diff --git a/pkgs/development/python-modules/tensorflow/default.nix b/pkgs/development/python-modules/tensorflow/default.nix
index cc64e49e1b7..34282a5ec93 100644
--- a/pkgs/development/python-modules/tensorflow/default.nix
+++ b/pkgs/development/python-modules/tensorflow/default.nix
@@ -266,7 +266,7 @@ let
     '';
 
     # FIXME: Tensorflow uses dlopen() for CUDA libraries.
-    NIX_LDFLAGS = lib.optionals cudaSupport [ "-lcudart" "-lcublas" "-lcufft" "-lcurand" "-lcusolver" "-lcusparse" "-lcudnn" ];
+    NIX_LDFLAGS = lib.optionalString cudaSupport "-lcudart -lcublas -lcufft -lcurand -lcusolver -lcusparse -lcudnn";
 
     hardeningDisable = [ "format" ];
 
diff --git a/pkgs/development/python-modules/thrift/default.nix b/pkgs/development/python-modules/thrift/default.nix
index d5a83832cb2..7d80be987f7 100644
--- a/pkgs/development/python-modules/thrift/default.nix
+++ b/pkgs/development/python-modules/thrift/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "thrift";
-  version = "0.11.0";
+  version = "0.13.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "7d59ac4fdcb2c58037ebd4a9da5f9a49e3e034bf75b3f26d9fe48ba3d8806e6b";
+    sha256 = "9af1c86bf73433afc6010ed376a6c6aca2b54099cc0d61895f640870a9ae7d89";
   };
 
   propagatedBuildInputs = [ six ];
diff --git a/pkgs/development/python-modules/tifffile/default.nix b/pkgs/development/python-modules/tifffile/default.nix
index 2220c806929..fbf36b4ef97 100644
--- a/pkgs/development/python-modules/tifffile/default.nix
+++ b/pkgs/development/python-modules/tifffile/default.nix
@@ -2,6 +2,7 @@
 , fetchPypi
 , buildPythonPackage
 , isPy27
+, isPy3k
 , numpy
 , imagecodecs-lite
 , enum34
@@ -35,6 +36,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     numpy
+  ] ++ lib.optionals isPy3k [
     imagecodecs-lite
   ] ++ lib.optionals isPy27 [
     futures
@@ -44,7 +46,7 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Read and write image data from and to TIFF files.";
-    homepage = https://www.lfd.uci.edu/~gohlke/;
+    homepage = "https://www.lfd.uci.edu/~gohlke/";
     maintainers = [ maintainers.lebastr ];
     license = licenses.bsd3;
   };
diff --git a/pkgs/development/python-modules/tld/default.nix b/pkgs/development/python-modules/tld/default.nix
index 719ea78b732..5e7380f7bb3 100644
--- a/pkgs/development/python-modules/tld/default.nix
+++ b/pkgs/development/python-modules/tld/default.nix
@@ -2,11 +2,11 @@
 
 python.pkgs.buildPythonPackage rec {
   pname   = "tld";
-  version = "0.9.8";
+  version = "0.11.9";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5963b22029e632a17bde87e35a19dc8c5b17266fb8c58e4d550d5593307e3a72";
+    sha256 = "c5fe79df74b68ebc33406dfadc69f6484dee8005035a129fdb40b8fabfd06e9f";
   };
 
   propagatedBuildInputs = with python.pkgs; [ six ];
diff --git a/pkgs/development/python-modules/tox/default.nix b/pkgs/development/python-modules/tox/default.nix
index 87dc5130a9c..5cec769decc 100644
--- a/pkgs/development/python-modules/tox/default.nix
+++ b/pkgs/development/python-modules/tox/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "tox";
-  version = "3.14.2";
+  version = "3.14.3";
 
   buildInputs = [ setuptools_scm ];
   propagatedBuildInputs = [ packaging pluggy py six virtualenv toml filelock ];
@@ -22,7 +22,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "7efd010a98339209f3a8292f02909b51c58417bfc6838ab7eca14cf90f96117a";
+    sha256 = "06ba73b149bf838d5cd25dc30c2dd2671ae5b2757cf98e5c41a35fe449f131b3";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/transaction/default.nix b/pkgs/development/python-modules/transaction/default.nix
index 20f12485435..0ed6f84ff30 100644
--- a/pkgs/development/python-modules/transaction/default.nix
+++ b/pkgs/development/python-modules/transaction/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "transaction";
-  version = "2.4.0";
+  version = "3.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "17wz1y524ca07vr03yddy8dv0gbscs06dbdywmllxv5rc725jq3j";
+    sha256 = "3b0ad400cb7fa25f95d1516756c4c4557bb78890510f69393ad0bd15869eaa2d";
   };
 
   propagatedBuildInputs = [ zope_interface mock ];
diff --git a/pkgs/development/python-modules/treq/default.nix b/pkgs/development/python-modules/treq/default.nix
index f49c7a0d243..1d488eed4e1 100644
--- a/pkgs/development/python-modules/treq/default.nix
+++ b/pkgs/development/python-modules/treq/default.nix
@@ -17,9 +17,9 @@ buildPythonPackage rec {
     incremental
     service-identity
     twisted
+  ]
     # twisted [tls] requirements (we should find a way to list "extras")
-    twisted.extras.tls
-  ];
+    ++ twisted.extras.tls;
 
   checkInputs = [
     pep8
diff --git a/pkgs/development/python-modules/trio/default.nix b/pkgs/development/python-modules/trio/default.nix
index 458a580a170..11f3c94aece 100644
--- a/pkgs/development/python-modules/trio/default.nix
+++ b/pkgs/development/python-modules/trio/default.nix
@@ -18,12 +18,12 @@
 
 buildPythonPackage rec {
   pname = "trio";
-  version = "0.12.1";
+  version = "0.13.0";
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0wnnrs36arvimrfgrlbpjw3nx7lppx43yvk2b380ivv69h52i6hl";
+    sha256 = "f1cf00054ad974c86d9b7afa187a65d79fd5995340abe01e8e4784d86f4acb30";
   };
 
   checkInputs = [ astor pytest pyopenssl trustme jedi pylint yapf ];
diff --git a/pkgs/development/python-modules/trustme/default.nix b/pkgs/development/python-modules/trustme/default.nix
index 8784dad7ad1..42cbf23e56f 100644
--- a/pkgs/development/python-modules/trustme/default.nix
+++ b/pkgs/development/python-modules/trustme/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "trustme";
-  version = "0.5.3";
+  version = "0.6.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f0f96a21b430cc29661644d3569a1112a397ca9cc8595b964d4ae71e5e957529";
+    sha256 = "9dfb18b568729d0219f758cddca1a91bab59f62ca41ee0e8acce5e657ec97b6c";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/twine/default.nix b/pkgs/development/python-modules/twine/default.nix
index 92288b6c774..762df433f97 100644
--- a/pkgs/development/python-modules/twine/default.nix
+++ b/pkgs/development/python-modules/twine/default.nix
@@ -1,26 +1,35 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, pythonOlder
+{ lib, buildPythonPackage, fetchPypi, pythonOlder
+, importlib-metadata
+, keyring
 , pkginfo
+, pyblake2
+, readme_renderer
 , requests
 , requests_toolbelt
+, setuptools_scm
 , tqdm
-, pyblake2
-, readme_renderer
 }:
 
 buildPythonPackage rec {
   pname = "twine";
-  version = "2.0.0";
+  version = "3.1.1";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9fe7091715c7576df166df8ef6654e61bada39571783f2fd415bdcba867c6993";
+    sha256 = "d561a5e511f70275e5a485a6275ff61851c16ffcb3a95a602189161112d9f160";
   };
 
-  propagatedBuildInputs = [ pkginfo requests requests_toolbelt tqdm pyblake2 readme_renderer ];
+  nativeBuildInputs = [ setuptools_scm ];
+  propagatedBuildInputs = [
+    keyring
+    pkginfo
+    pyblake2
+    readme_renderer
+    requests
+    requests_toolbelt
+    tqdm
+  ] ++ lib.optionals (pythonOlder "3.8") [ importlib-metadata ];
 
   # Requires network
   doCheck = false;
diff --git a/pkgs/development/python-modules/twisted/default.nix b/pkgs/development/python-modules/twisted/default.nix
index a87cacdc29e..5c4fea3f9b1 100644
--- a/pkgs/development/python-modules/twisted/default.nix
+++ b/pkgs/development/python-modules/twisted/default.nix
@@ -16,12 +16,12 @@
 }:
 buildPythonPackage rec {
   pname = "Twisted";
-  version = "19.7.0";
+  version = "19.10.0";
 
   src = fetchPypi {
     inherit pname version;
     extension = "tar.bz2";
-    sha256 = "d5db93026568f60cacdc0615fcd21d46f694a6bfad0ef3ff53cde2b4bb85a39d";
+    sha256 = "7394ba7f272ae722a74f3d969dcf599bc4ef093bc392038748a490f1724a515d";
   };
 
   propagatedBuildInputs = [ zope_interface incremental automat constantly hyperlink pyhamcrest attrs setuptools ];
diff --git a/pkgs/development/python-modules/txtorcon/default.nix b/pkgs/development/python-modules/txtorcon/default.nix
index c2c0fb941fa..3b60c63d964 100644
--- a/pkgs/development/python-modules/txtorcon/default.nix
+++ b/pkgs/development/python-modules/txtorcon/default.nix
@@ -18,6 +18,8 @@ buildPythonPackage rec {
     sha256 = "19ayn5w9ayxbb1m84l1s9qlb6kv7sz6sg34mzy8bnidc7qnfbn15";
   };
 
+  # zope.interface issue
+  doCheck = isPy3k;
   # Skip a failing test until fixed upstream:
   # https://github.com/meejah/txtorcon/issues/250
   checkPhase = ''
diff --git a/pkgs/development/python-modules/typeguard/default.nix b/pkgs/development/python-modules/typeguard/default.nix
index af9301571de..51dc3555250 100644
--- a/pkgs/development/python-modules/typeguard/default.nix
+++ b/pkgs/development/python-modules/typeguard/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "typeguard";
-  version = "2.5.1";
+  version = "2.7.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5269435c8c98f4c4861dd69f3de755aaab5e163991b7ce1e0eff7ae6472957dd";
+    sha256 = "2d545c71e9439c21bcd7c28f5f55b3606e6106f7031ab58375656a1aed483ef2";
   };
 
   buildInputs = [ setuptools_scm ];
diff --git a/pkgs/development/python-modules/uamqp/default.nix b/pkgs/development/python-modules/uamqp/default.nix
index b4bbc84f372..8e74c6460fe 100644
--- a/pkgs/development/python-modules/uamqp/default.nix
+++ b/pkgs/development/python-modules/uamqp/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "uamqp";
-  version = "1.2.4";
+  version = "1.2.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "efb53d244bbe336557bad206f9e48159661934baeb0bfe0addfadc1f69796137";
+    sha256 = "02d78242fcd0a58489aaf275964a6cf7581d7a2334ee240d2d547f8aca8607c6";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/uncompyle6/default.nix b/pkgs/development/python-modules/uncompyle6/default.nix
index d4e8d1505d6..366af37c20e 100644
--- a/pkgs/development/python-modules/uncompyle6/default.nix
+++ b/pkgs/development/python-modules/uncompyle6/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "uncompyle6";
-  version = "3.5.1";
+  version = "3.6.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "af6aea84ca42c889986f8baf86ccb9e3faae5ac1eaef470d2317dfe4131708b3";
+    sha256 = "f8c7ba2fd486d40d9a9fc1d6ab438588d7ce1be123aabf488736ff68a05f57f7";
   };
 
   checkInputs = [ nose pytest hypothesis six ];
diff --git a/pkgs/development/python-modules/uproot-methods/default.nix b/pkgs/development/python-modules/uproot-methods/default.nix
index b0caaf3d96a..7bb8d4a16ea 100644
--- a/pkgs/development/python-modules/uproot-methods/default.nix
+++ b/pkgs/development/python-modules/uproot-methods/default.nix
@@ -6,12 +6,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "0.7.1";
+  version = "0.7.2";
   pname = "uproot-methods";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d7bfcc84c28a0b61669232ad43b86bbb944504f6bf4612fd395f4e5cc45d0ba5";
+    sha256 = "4382983e4e6c5e1aeb3013d04334907f87f62b0d7c19a29968e5a0aac1653ae1";
   };
 
   propagatedBuildInputs = [ numpy awkward ];
diff --git a/pkgs/development/python-modules/uproot/default.nix b/pkgs/development/python-modules/uproot/default.nix
index f98b3411242..812ff15242c 100644
--- a/pkgs/development/python-modules/uproot/default.nix
+++ b/pkgs/development/python-modules/uproot/default.nix
@@ -16,11 +16,11 @@
 
 buildPythonPackage rec {
   pname = "uproot";
-  version = "3.10.12";
+  version = "3.11.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "34953903abe09bbab3ec1a9a4843b05c75b218daa6132c8275d871e88b6e3447";
+    sha256 = "a9521786d0e16d00a457807e364229ba844ea5f8b0ac6653b00277351f12ab49";
   };
 
   nativeBuildInputs = [ pytestrunner ];
@@ -43,8 +43,11 @@ buildPythonPackage rec {
   ];
 
   # skip tests which do network calls
+  # test_compression.py is missing zstandard package
   checkPhase = ''
-    pytest tests -k 'not hist_in_tree and not branch_auto_interpretation'
+    pytest tests -k 'not hist_in_tree \
+      and not branch_auto_interpretation' \
+      --ignore=tests/test_compression.py
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/uritemplate/default.nix b/pkgs/development/python-modules/uritemplate/default.nix
index c469fd8dd1c..64a2fd51ee3 100644
--- a/pkgs/development/python-modules/uritemplate/default.nix
+++ b/pkgs/development/python-modules/uritemplate/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "uritemplate";
-  version = "3.0.0";
+  version = "3.0.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c02643cebe23fc8adb5e6becffe201185bf06c40bda5c0b4028a93f1527d011d";
+    sha256 = "5af8ad10cec94f215e3f48112de2022e1d5a37ed427fbd88652fa908f2ab7cae";
   };
 
   propagatedBuildInputs = [ simplejson ];
diff --git a/pkgs/development/python-modules/uritools/default.nix b/pkgs/development/python-modules/uritools/default.nix
index cf3d36c3e5d..570fc5dc718 100644
--- a/pkgs/development/python-modules/uritools/default.nix
+++ b/pkgs/development/python-modules/uritools/default.nix
@@ -1,16 +1,15 @@
-{ stdenv, buildPythonPackage, fetchPypi, ipaddress }:
+{ stdenv, buildPythonPackage, fetchPypi, isPy27 }:
 
 buildPythonPackage rec {
   pname = "uritools";
-  version = "2.2.0";
+  version = "3.0.0";
+  disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "80e8e23cafad54fd85811b5d9ba0fc595d933f5727c61c3937945eec09f99e2b";
+    sha256 = "405917a31ce58a57c8ccd0e4ea290f38baf2f4823819c3688f5331f1aee4ccb0";
   };
 
-  propagatedBuildInputs = [ ipaddress ];
-
   meta = with stdenv.lib; {
     description = "RFC 3986 compliant, Unicode-aware, scheme-agnostic replacement for urlparse";
     license = licenses.mit;
diff --git a/pkgs/development/python-modules/urwid/default.nix b/pkgs/development/python-modules/urwid/default.nix
index 885595ef6d4..8e255dc69dc 100644
--- a/pkgs/development/python-modules/urwid/default.nix
+++ b/pkgs/development/python-modules/urwid/default.nix
@@ -1,14 +1,18 @@
-{ stdenv, buildPythonPackage, fetchPypi }:
+{ stdenv, buildPythonPackage, fetchPypi, glibcLocales }:
 
 buildPythonPackage rec {
   pname = "urwid";
-  version = "2.0.1";
+  version = "2.1.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1g6cpicybvbananpjikmjk8npmjk4xvak1wjzji62wc600wkwkb4";
+    sha256 = "0896f36060beb6bf3801cb554303fef336a79661401797551ba106d23ab4cd86";
   };
 
+  # tests need to be able to set locale
+  LC_ALL = "en_US.UTF-8";
+  checkInputs = [ glibcLocales ];
+
   meta = with stdenv.lib; {
     description = "A full-featured console (xterm et al.) user interface library";
     homepage = http://excess.org/urwid;
diff --git a/pkgs/development/python-modules/urwidtrees/default.nix b/pkgs/development/python-modules/urwidtrees/default.nix
index b69bb62a875..468420f0e5c 100644
--- a/pkgs/development/python-modules/urwidtrees/default.nix
+++ b/pkgs/development/python-modules/urwidtrees/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , buildPythonPackage
 , fetchFromGitHub
+, glibcLocales
 , urwid
 }:
 
@@ -17,6 +18,9 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ urwid ];
 
+  checkInputs = [ glibcLocales ];
+  LC_ALL="en_US.UTF-8";
+
   meta = with stdenv.lib; {
     description = "Tree widgets for urwid";
     homepage = https://github.com/pazz/urwidtrees;
diff --git a/pkgs/development/python-modules/vcrpy/default.nix b/pkgs/development/python-modules/vcrpy/default.nix
index ef3e92f01a7..c518314d964 100644
--- a/pkgs/development/python-modules/vcrpy/default.nix
+++ b/pkgs/development/python-modules/vcrpy/default.nix
@@ -15,11 +15,11 @@
 
 buildPythonPackage rec {
   pname = "vcrpy";
-  version = "2.1.1";
+  version = "3.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "27cc696df66d77703eab5cdfa041b2f9877bbf2b54bcd390de89a4be964ca536";
+    sha256 = "21168d5ae14263a833d4b71acfd8278d8841114f24be1b4ab4a5719d0c7f07bc";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/vega_datasets/default.nix b/pkgs/development/python-modules/vega_datasets/default.nix
index 2d3dda551fb..f028f85f3ec 100644
--- a/pkgs/development/python-modules/vega_datasets/default.nix
+++ b/pkgs/development/python-modules/vega_datasets/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "vega_datasets";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "20d490b417f84607eb5079400f608f2e9c135b7092bee10f6857f6d23136e459";
+    sha256 = "db8883dab72b6f414e1fafdbf1e8db7543bba6ed77912a4e0c197d74fcfa1c20";
   };
 
   propagatedBuildInputs = [ pandas ];
diff --git a/pkgs/development/python-modules/venusian/default.nix b/pkgs/development/python-modules/venusian/default.nix
index f420d88e816..fb81a79f10e 100644
--- a/pkgs/development/python-modules/venusian/default.nix
+++ b/pkgs/development/python-modules/venusian/default.nix
@@ -2,18 +2,19 @@
 , buildPythonPackage
 , fetchPypi
 , pytest
+, pytestcov
 }:
 
 buildPythonPackage rec {
   pname = "venusian";
-  version = "1.2.0";
+  version = "3.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "64ec8285b80b110d0ae5db4280e90e31848a59db98db1aba4d7d46f48ce91e3e";
+    sha256 = "f6842b7242b1039c0c28f6feef29016e7e7dd3caaeb476a193acf737db31ee38";
   };
 
-  checkInputs = [ pytest ];
+  checkInputs = [ pytest pytestcov ];
 
   checkPhase = ''
     pytest
diff --git a/pkgs/development/python-modules/virtual-display/default.nix b/pkgs/development/python-modules/virtual-display/default.nix
index 130c94bc170..1b56f046610 100644
--- a/pkgs/development/python-modules/virtual-display/default.nix
+++ b/pkgs/development/python-modules/virtual-display/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "PyVirtualDisplay";
-  version = "0.2.4";
+  version = "0.2.5";
 
   propagatedBuildInputs = [ EasyProcess ];
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0nybvd7sajig6vya2v3fd20dls6f3nnf12x8anrfxnjs41chgx87";
+    sha256 = "5b267c8ffc98fcbd084ba852ab4caef3f22e9362bc5d117e1697e767553eaf41";
   };
 
   # requires X server
diff --git a/pkgs/development/python-modules/virtualenv/default.nix b/pkgs/development/python-modules/virtualenv/default.nix
index cd434bb6e3b..62c86567655 100644
--- a/pkgs/development/python-modules/virtualenv/default.nix
+++ b/pkgs/development/python-modules/virtualenv/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "virtualenv";
-  version = "16.7.8";
+  version = "16.7.9";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "116655188441670978117d0ebb6451eb6a7526f9ae0796cc0dee6bd7356909b0";
+    sha256 = "0d62c70883c0342d59c11d0ddac0d954d0431321a41ab20851facf2b222598f3";
   };
 
   # Doubt this is needed - FRidh 2017-07-07
diff --git a/pkgs/development/python-modules/vowpalwabbit/default.nix b/pkgs/development/python-modules/vowpalwabbit/default.nix
index b9fae783074..d23f45b122f 100644
--- a/pkgs/development/python-modules/vowpalwabbit/default.nix
+++ b/pkgs/development/python-modules/vowpalwabbit/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "vowpalwabbit";
-  version = "8.7.0.post1";
+  version = "8.8.0";
 
   src = fetchPypi{
     inherit pname version;
-    sha256 = "de9529660858b380127b2bea335b41a29e8f264551315042300022eb4e6524ea";
+    sha256 = "bd4c7e49a6ddaa1afedf97b22b822c7322328d686d45151b47a5127fc409c2af";
   };
 
   # Should be fixed in next Python release after 8.5.0:
diff --git a/pkgs/development/python-modules/whitenoise/default.nix b/pkgs/development/python-modules/whitenoise/default.nix
index 8d5f8b8813a..565032ad523 100644
--- a/pkgs/development/python-modules/whitenoise/default.nix
+++ b/pkgs/development/python-modules/whitenoise/default.nix
@@ -1,12 +1,13 @@
-{ stdenv, fetchPypi, buildPythonPackage }:
+{ stdenv, fetchPypi, buildPythonPackage, isPy27 }:
 
 buildPythonPackage rec {
   pname = "whitenoise";
-  version = "4.1.4";
+  version = "5.0.1";
+  disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "22f79cf8f1f509639330f93886acaece8ec5ac5e9600c3b981d33c34e8a42dfd";
+    sha256 = "0f9137f74bd95fa54329ace88d8dc695fbe895369a632e35f7a136e003e41d73";
   };
 
   # No tests
diff --git a/pkgs/development/python-modules/xdis/default.nix b/pkgs/development/python-modules/xdis/default.nix
index 533e8d8b577..636b7c5045c 100644
--- a/pkgs/development/python-modules/xdis/default.nix
+++ b/pkgs/development/python-modules/xdis/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "xdis";
-  version = "4.1.3";
+  version = "4.2.1";
   disabled = isPy27;
 
   src = fetchFromGitHub {
     owner = "rocky";
     repo = "python-xdis";
     rev = version;
-    sha256 = "0ixx9svyi0kw3z2i51cv1cyg4l5z8hy432kxgsvz20mr9a8z5c91";
+    sha256 = "19mnx746k9ls2f1321fl8nkps7x9by80f753f3c5wh1j91zivq6b";
   };
 
   checkInputs = [ pytest ];
@@ -27,6 +27,6 @@ buildPythonPackage rec {
     description = "Python cross-version byte-code disassembler and marshal routines";
     homepage = https://github.com/rocky/python-xdis/;
     license = licenses.gpl2;
+    broken = true; # doesn't support latest python3 interpreters
   };
-
 }
diff --git a/pkgs/development/python-modules/xml2rfc/default.nix b/pkgs/development/python-modules/xml2rfc/default.nix
index 1a54b8b4049..cf4eadd99d8 100644
--- a/pkgs/development/python-modules/xml2rfc/default.nix
+++ b/pkgs/development/python-modules/xml2rfc/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "xml2rfc";
-  version = "2.35.0";
+  version = "2.37.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0jpg9rxxw28n66wzznlhzdgv7b7gd1crcffjhlw7lam93ils4ah5";
+    sha256 = "4ae4e99a4b482caac89d8ffd93d16a4510db36907475b1879713a1dc885646ad";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/yapf/default.nix b/pkgs/development/python-modules/yapf/default.nix
index abff04f2372..f4e154f2cbc 100644
--- a/pkgs/development/python-modules/yapf/default.nix
+++ b/pkgs/development/python-modules/yapf/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "yapf";
-  version = "0.28.0";
+  version = "0.29.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "06x409cgr5im9cppzypj1kqy1fsry906vn5slv7i9hd7fshvd53g";
+    sha256 = "712e23c468506bf12cadd10169f852572ecc61b266258422d45aaf4ad7ef43de";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/python-modules/yappi/default.nix b/pkgs/development/python-modules/yappi/default.nix
index c98bc1f303e..f7a18bba903 100644
--- a/pkgs/development/python-modules/yappi/default.nix
+++ b/pkgs/development/python-modules/yappi/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "yappi";
-  version = "1.0";
+  version = "1.2.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1gs48c5sy771lsjhca3m4j8ljc6yhk5qnim3n5idnlaxa4ql30bz";
+    sha256 = "b8db9bc607610d6da4e27e87ec828ebddec4bdaac89ca07ebfe9a153b0641580";
   };
 
   patches = [ ./tests.patch ];
diff --git a/pkgs/development/python-modules/yarl/default.nix b/pkgs/development/python-modules/yarl/default.nix
index d07690503f3..19314e19611 100644
--- a/pkgs/development/python-modules/yarl/default.nix
+++ b/pkgs/development/python-modules/yarl/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "yarl";
-  version = "1.3.0";
+  version = "1.4.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "024ecdc12bc02b321bc66b41327f930d1c2c543fa9a561b39861da9388ba7aa9";
+    sha256 = "58cd9c469eced558cd81aa3f484b2924e8897049e06889e8ff2510435b7ef74b";
   };
 
   checkInputs = [ pytest pytestrunner ];
diff --git a/pkgs/development/python-modules/yubico-client/default.nix b/pkgs/development/python-modules/yubico-client/default.nix
index e39b11f6200..99aedd4e681 100644
--- a/pkgs/development/python-modules/yubico-client/default.nix
+++ b/pkgs/development/python-modules/yubico-client/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "yubico-client";
-  version = "1.11.0";
+  version = "1.12.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c1d1c1f918c058932493c5a50341583e48487264129ed5b973c327ae48afed87";
+    sha256 = "1d74c6341210c94b639f7c7c8930550e73d5c1be60402e418e9dc95e038f8527";
   };
 
   propagatedBuildInputs = [ requests ];
diff --git a/pkgs/development/python-modules/zeroconf/default.nix b/pkgs/development/python-modules/zeroconf/default.nix
index dbf84aa182b..ef45f663ceb 100644
--- a/pkgs/development/python-modules/zeroconf/default.nix
+++ b/pkgs/development/python-modules/zeroconf/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "zeroconf";
-  version = "0.23.0";
+  version = "0.24.3";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1xgfs38wv52a73p9gmyz0vxj6c49516isjn9bhp8p3y4cywk7hz0";
+    sha256 = "de62e5067ea7ab356f7168a3562d79fececa8632ed0fad0e82f505e01fafbc6d";
   };
 
   propagatedBuildInputs = [ ifaddr ]
diff --git a/pkgs/development/python-modules/zha-quirks/default.nix b/pkgs/development/python-modules/zha-quirks/default.nix
index 1f490fea05f..d819a881f9f 100644
--- a/pkgs/development/python-modules/zha-quirks/default.nix
+++ b/pkgs/development/python-modules/zha-quirks/default.nix
@@ -4,14 +4,14 @@
 
 buildPythonPackage rec {
   pname = "zha-quirks";
-  version = "0.0.28";
+  version = "0.0.30";
 
   nativeBuildInputs = [ pytest ];
   buildInputs = [ aiohttp zigpy ];
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "021z5f5dm74amxkqnz4s1690ydprciqg23jz3n4mpjlxyxbdfj73";
+    sha256 = "00731a9b9c58c4e59f6765ac0cec5e2301bdda28ef19e00e2ba752be457a61b9";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/python-modules/zm-py/default.nix b/pkgs/development/python-modules/zm-py/default.nix
index 72c32ef8277..4cd5e9b1d20 100644
--- a/pkgs/development/python-modules/zm-py/default.nix
+++ b/pkgs/development/python-modules/zm-py/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "zm-py";
-  version = "0.3.3";
+  version = "0.4.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "7cac73bd4f5e729fd8b3cff6f456652c3fd76b1a11f5d539bc7e14ffc7a87e9a";
+    sha256 = "f9693ca046de4ea12c1afb5c67709ec0c2a48744566c0a1a9327348e1a1617b0";
   };
 
   disabled = !isPy3k;
diff --git a/pkgs/development/python-modules/zope_component/default.nix b/pkgs/development/python-modules/zope_component/default.nix
index bbe635b712f..25452fdd070 100644
--- a/pkgs/development/python-modules/zope_component/default.nix
+++ b/pkgs/development/python-modules/zope_component/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "zope.component";
-  version = "4.5";
+  version = "4.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "6edfd626c3b593b72895a8cfcf79bff41f4619194ce996a85bce31ac02b94e55";
+    sha256 = "ec2afc5bbe611dcace98bb39822c122d44743d635dafc7315b9aef25097db9e6";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/zope_contenttype/default.nix b/pkgs/development/python-modules/zope_contenttype/default.nix
index fc28a740d62..6db39d6c5b5 100644
--- a/pkgs/development/python-modules/zope_contenttype/default.nix
+++ b/pkgs/development/python-modules/zope_contenttype/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "zope.contenttype";
-  version = "4.4";
+  version = "4.5.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "08c0408f515668e6f0c4fd492b66fbe87a074c1aa21cfc6be8c6292482d8b2f4";
+    sha256 = "c12d929c67ab3eaef9b8a7fba3d19cce8500c8fd25afed8058c8e15f324cbd5b";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/python-modules/zope_i18nmessageid/default.nix b/pkgs/development/python-modules/zope_i18nmessageid/default.nix
index cddcad00774..fe9a6b56ed8 100644
--- a/pkgs/development/python-modules/zope_i18nmessageid/default.nix
+++ b/pkgs/development/python-modules/zope_i18nmessageid/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "zope.i18nmessageid";
-  version = "4.3.1";
+  version = "5.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e511edff8e75d3a6f84d8256e1e468c85a4aa9d89c2ea264a919334fae7081e3";
+    sha256 = "03318270df5320c57b3416744f9cb2a85160a8d00345c07ac35d2b7ac01ff50c";
   };
 
   propagatedBuildInputs = [ six ];
diff --git a/pkgs/development/python-modules/zope_interface/default.nix b/pkgs/development/python-modules/zope_interface/default.nix
index a5855697ad6..d208d4a3529 100644
--- a/pkgs/development/python-modules/zope_interface/default.nix
+++ b/pkgs/development/python-modules/zope_interface/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "zope.interface";
-  version = "4.6.0";
+  version = "4.7.1";
   
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1b3d0dcabc7c90b470e59e38a9acaa361be43b3a6ea644c0063951964717f0e5";
+    sha256 = "4bb937e998be9d5e345f486693e477ba79e4344674484001a0b646be1d530487";
   };
 
   propagatedBuildInputs = [ zope_event ];
diff --git a/pkgs/development/ruby-modules/gem-config/default.nix b/pkgs/development/ruby-modules/gem-config/default.nix
index de9d06f7ce0..c1eb82c5fa8 100644
--- a/pkgs/development/ruby-modules/gem-config/default.nix
+++ b/pkgs/development/ruby-modules/gem-config/default.nix
@@ -236,7 +236,7 @@ in
     nativeBuildInputs = [ pkgconfig ];
     buildInputs = [ openssl ];
     hardeningDisable = [ "format" ];
-    NIX_CFLAGS_COMPILE = [
+    NIX_CFLAGS_COMPILE = toString [
       "-Wno-error=stringop-overflow"
       "-Wno-error=implicit-fallthrough"
       "-Wno-error=sizeof-pointer-memaccess"
@@ -244,6 +244,7 @@ in
       "-Wno-error=class-memaccess"
       "-Wno-error=ignored-qualifiers"
       "-Wno-error=tautological-compare"
+      "-Wno-error=stringop-truncation"
     ];
     dontBuild = false;
     postPatch = ''
@@ -495,23 +496,22 @@ in
   sassc = attrs: {
     nativeBuildInputs = [ rake ];
     dontBuild = false;
-    SASS_LIBSASS_PATH = libsass;
+    SASS_LIBSASS_PATH = toString libsass;
     postPatch = ''
       substituteInPlace lib/sassc/native.rb \
         --replace 'gem_root = spec.gem_dir' 'gem_root = File.join(__dir__, "../../")'
     '';
-  } // (if stdenv.isDarwin then {
+  } // (lib.optionalAttrs stdenv.isDarwin {
     # https://github.com/NixOS/nixpkgs/issues/19098
-    buildFlags = "--disable-lto";
-  } else {});
+    buildFlags = [ "--disable-lto" ];
+  });
 
-  scrypt = attrs:
-    if stdenv.isDarwin then {
-      dontBuild = false;
-      postPatch = ''
-        sed -i -e "s/-arch i386//" Rakefile ext/scrypt/Rakefile
-      '';
-    } else {};
+  scrypt = attrs: lib.optionalAttrs stdenv.isDarwin {
+    dontBuild = false;
+    postPatch = ''
+      sed -i -e "s/-arch i386//" Rakefile ext/scrypt/Rakefile
+    '';
+  };
 
   semian = attrs: {
     buildInputs = [ openssl ];
diff --git a/pkgs/development/tools/analysis/ikos/default.nix b/pkgs/development/tools/analysis/ikos/default.nix
index 6f3df32f3c0..a882d158f32 100644
--- a/pkgs/development/tools/analysis/ikos/default.nix
+++ b/pkgs/development/tools/analysis/ikos/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ cmake boost gmp clang llvm sqlite python
                   ocamlPackages.apron mpfr ppl doxygen graphviz ];
 
-  cmakeFlags = "-DAPRON_ROOT=${ocamlPackages.apron}";
+  cmakeFlags = [ "-DAPRON_ROOT=${ocamlPackages.apron}" ];
 
   postBuild = "make doc";
 
diff --git a/pkgs/development/tools/build-managers/cmake/application-services.patch b/pkgs/development/tools/build-managers/cmake/application-services.patch
index 0373ca2d67c..e0399d0a6c6 100644
--- a/pkgs/development/tools/build-managers/cmake/application-services.patch
+++ b/pkgs/development/tools/build-managers/cmake/application-services.patch
@@ -23,12 +23,12 @@ index e353a37..b06f842 100644
  
  struct cmLinkImplementation;
  
--#if defined(CMAKE_BUILD_WITH_CMAKE) && defined(__APPLE__)
+-#if !defined(CMAKE_BOOTSTRAP) && defined(__APPLE__)
 -#  define HAVE_APPLICATION_SERVICES
 -#  include <ApplicationServices/ApplicationServices.h>
 -#endif
 -
- #if defined(CMAKE_BUILD_WITH_CMAKE)
+ #if !defined(CMAKE_BOOTSTRAP)
  #  include "cmXMLParser.h"
  
 diff --git a/Utilities/cmlibarchive/CMakeLists.txt b/Utilities/cmlibarchive/CMakeLists.txt
diff --git a/pkgs/development/tools/build-managers/cmake/default.nix b/pkgs/development/tools/build-managers/cmake/default.nix
index 37a44f15e9c..93e75a855d3 100644
--- a/pkgs/development/tools/build-managers/cmake/default.nix
+++ b/pkgs/development/tools/build-managers/cmake/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, fetchpatch, pkgconfig
+{ stdenv, lib, fetchurl, pkgconfig
 , bzip2, curl, expat, libarchive, xz, zlib, libuv, rhash
 , buildPackages
 # darwin attributes
@@ -19,12 +19,12 @@ stdenv.mkDerivation rec {
           + lib.optionalString useNcurses "-cursesUI"
           + lib.optionalString withQt5 "-qt5UI"
           + lib.optionalString useQt4 "-qt4UI";
-  version = "3.15.5";
+  version = "3.16.2";
 
   src = fetchurl {
     url = "${meta.homepage}files/v${lib.versions.majorMinor version}/cmake-${version}.tar.gz";
     # compare with https://cmake.org/files/v${lib.versions.majorMinor version}/cmake-${version}-SHA-256.txt
-    sha256 = "1d5y8d92axcc6rfqlsxamayfs3fc1vdby91hn5mx1kn02ppprpgv";
+    sha256 = "1ag65ignli58kpmji6gjhj8xw4w1qdr910i99hsvx8hcqrp7h2cc";
   };
 
   patches = [
@@ -37,12 +37,6 @@ stdenv.mkDerivation rec {
     # Derived from https://github.com/libuv/libuv/commit/1a5d4f08238dd532c3718e210078de1186a5920d
     ./libuv-application-services.patch
 
-    # Fix for harfbuzz with pango versions > 1.43.
-    # Should be removed with cmake >= 3.16
-    (fetchpatch {
-      url = "https://gitlab.kitware.com/cmake/cmake/commit/effafca77eacbb4988006b1f3f4d9154df6c33f8.diff";
-      sha256 = "0vxam5kka1dffygp1nd0g21ib9qk8kds8iprbfga2gimzyrlfmfr";
-    })
   ] ++ lib.optional stdenv.isCygwin ./3.2.2-cygwin.patch;
 
   outputs = [ "out" ];
diff --git a/pkgs/development/tools/build-managers/cmake/libuv-application-services.patch b/pkgs/development/tools/build-managers/cmake/libuv-application-services.patch
index c5b9cdff1d0..eb3df1e4ff6 100644
--- a/pkgs/development/tools/build-managers/cmake/libuv-application-services.patch
+++ b/pkgs/development/tools/build-managers/cmake/libuv-application-services.patch
@@ -31,8 +31,8 @@ diff -ur cmake-3.12.1/Utilities/cmlibuv/src/unix/fsevents.c cmake-3.12.1-patched
  #include "uv.h"
  #include "internal.h"
  
--#if TARGET_OS_IPHONE
-+#if !HAVE_CORESERVICES_CORESERVICES_H
+-#if TARGET_OS_IPHONE || MAC_OS_X_VERSION_MAX_ALLOWED < 1070
++#if !HAVE_CORESERVICES_CORESERVICES_H || MAC_OS_X_VERSION_MAX_ALLOWED < 1070
  
  /* iOS (currently) doesn't provide the FSEvents-API (nor CoreServices) */
  
diff --git a/pkgs/development/tools/build-managers/cmake/setup-hook.sh b/pkgs/development/tools/build-managers/cmake/setup-hook.sh
index 52b9c3ab5f5..6f3d33bcaa7 100755
--- a/pkgs/development/tools/build-managers/cmake/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/cmake/setup-hook.sh
@@ -96,8 +96,8 @@ cmakeConfigurePhase() {
     # and unecessary attempts to access non-existent home folder
     # https://cmake.org/cmake/help/latest/manual/cmake-packages.7.html#disabling-the-package-registry
     cmakeFlags="-DCMAKE_EXPORT_NO_PACKAGE_REGISTRY=ON $cmakeFlags"
-    cmakeFlags="-DCMAKE_FIND_PACKAGE_NO_PACKAGE_REGISTRY=ON $cmakeFlags"
-    cmakeFlags="-DCMAKE_FIND_PACKAGE_NO_SYSTEM_PACKAGE_REGISTRY=ON $cmakeFlags"
+    cmakeFlags="-DCMAKE_FIND_USE_PACKAGE_REGISTRY=OFF $cmakeFlags"
+    cmakeFlags="-DCMAKE_FIND_USE_SYSTEM_PACKAGE_REGISTRY=OFF $cmakeFlags"
 
     if [ "${buildPhase-}" = ninjaBuildPhase ]; then
         cmakeFlags="-GNinja $cmakeFlags"
diff --git a/pkgs/development/tools/build-managers/gnumake/4.2/default.nix b/pkgs/development/tools/build-managers/gnumake/4.2/default.nix
index b543565758c..37467f225ea 100644
--- a/pkgs/development/tools/build-managers/gnumake/4.2/default.nix
+++ b/pkgs/development/tools/build-managers/gnumake/4.2/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation {
     sha256 = "12f5zzyq2w56g95nni65hc0g5p7154033y2f3qmjvd016szn5qnn";
   };
 
-  patchFlags = "-p0";
+  patchFlags = [ "-p0" ];
   patches = [
     # Purity: don't look for library dependencies (of the form `-lfoo') in /lib
     # and /usr/lib. It's a stupid feature anyway. Likewise, when searching for
diff --git a/pkgs/development/tools/build-managers/scons/default.nix b/pkgs/development/tools/build-managers/scons/default.nix
index 1655c154d4e..0afe2fbe928 100644
--- a/pkgs/development/tools/build-managers/scons/default.nix
+++ b/pkgs/development/tools/build-managers/scons/default.nix
@@ -8,7 +8,7 @@ in {
     sha256 = "0wzid419mlwqw9llrg8gsx4nkzhqy16m4m40r0xnh6cwscw5wir4";
   };
   scons_latest = mkScons {
-    version = "3.1.1";
-    sha256 = "19a3j6x7xkmr2srk2yzxx3wv003h9cxx08vr81ps76blvmzl3sjc";
+    version = "3.1.2";
+    sha256 = "1yzq2gg9zwz9rvfn42v5jzl3g4qf1khhny6zfbi2hib55zvg60bq";
   };
 }
diff --git a/pkgs/development/tools/database/pgcli/default.nix b/pkgs/development/tools/database/pgcli/default.nix
index 03f0ae3c444..4038ad7010f 100644
--- a/pkgs/development/tools/database/pgcli/default.nix
+++ b/pkgs/development/tools/database/pgcli/default.nix
@@ -19,6 +19,11 @@ buildPythonApplication rec {
     pygments sqlparse pgspecial setproctitle keyring
   ];
 
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "prompt_toolkit>=2.0.6,<3.0.0" "prompt_toolkit"
+  '';
+
   checkInputs = [ pytest mock ];
 
   # `test_application_name_db_uri` fails: https://github.com/dbcli/pgcli/issues/1104
diff --git a/pkgs/development/tools/database/sqlitebrowser/default.nix b/pkgs/development/tools/database/sqlitebrowser/default.nix
index 8cdcdd6f79d..0ec4b1510e9 100644
--- a/pkgs/development/tools/database/sqlitebrowser/default.nix
+++ b/pkgs/development/tools/database/sqlitebrowser/default.nix
@@ -16,9 +16,7 @@ mkDerivation rec {
 
   nativeBuildInputs = [ cmake qttools ];
 
-  NIX_LDFLAGS = [
-    "-lQt5PrintSupport"
-  ];
+  NIX_LDFLAGS = "-lQt5PrintSupport";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/tools/devpi-server/default.nix b/pkgs/development/tools/devpi-server/default.nix
index 0408c8ed01b..4c8d0276d1a 100644
--- a/pkgs/development/tools/devpi-server/default.nix
+++ b/pkgs/development/tools/devpi-server/default.nix
@@ -33,8 +33,11 @@ python3Packages.buildPythonApplication rec {
   ] ++ stdenv.lib.optionals isPy27 [ mock ];
 
   # test_genconfig.py needs devpi-server on PATH
+  # root_passwd_hash tries to write to store
   checkPhase = ''
-    PATH=$PATH:$out/bin pytest ./test_devpi_server --slow -rfsxX
+    PATH=$PATH:$out/bin HOME=$TMPDIR pytest \
+      ./test_devpi_server --slow -rfsxX \
+      -k 'not root_passwd_hash_option'
   '';
 
   meta = with stdenv.lib;{
diff --git a/pkgs/development/tools/diesel-cli/default.nix b/pkgs/development/tools/diesel-cli/default.nix
index f6a67b05114..e5f7a50476e 100644
--- a/pkgs/development/tools/diesel-cli/default.nix
+++ b/pkgs/development/tools/diesel-cli/default.nix
@@ -65,7 +65,7 @@ rustPlatform.buildRustPackage rec {
 
   # Fix the build with mariadb, which otherwise shows "error adding symbols:
   # DSO missing from command line" errors for libz and libssl.
-  NIX_LDFLAGS = lib.optional mysqlSupport "-lz -lssl -lcrypto";
+  NIX_LDFLAGS = lib.optionalString mysqlSupport "-lz -lssl -lcrypto";
 
   meta = with lib; {
     description = "Database tool for working with Rust projects that use Diesel";
diff --git a/pkgs/development/tools/documentation/doxygen/default.nix b/pkgs/development/tools/documentation/doxygen/default.nix
index 0e20d690fd7..af73ce25d42 100644
--- a/pkgs/development/tools/documentation/doxygen/default.nix
+++ b/pkgs/development/tools/documentation/doxygen/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     stdenv.lib.optional (qt4 != null) "-Dbuild_wizard=YES";
 
   NIX_CFLAGS_COMPILE =
-    stdenv.lib.optional stdenv.isDarwin "-mmacosx-version-min=10.9";
+    stdenv.lib.optionalString stdenv.isDarwin "-mmacosx-version-min=10.9";
 
   enableParallelBuilding = true;
   doCheck = false; # fails
diff --git a/pkgs/development/tools/erlang/cuter/default.nix b/pkgs/development/tools/erlang/cuter/default.nix
index 736640eba8e..dccf4a55831 100644
--- a/pkgs/development/tools/erlang/cuter/default.nix
+++ b/pkgs/development/tools/erlang/cuter/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook makeWrapper which ];
   buildInputs = [ python python.pkgs.setuptools z3.python erlang ];
 
-  buildFlags = "PWD=$(out)/lib/erlang/lib/cuter-${version} cuter_target";
+  buildFlags = [ "PWD=$(out)/lib/erlang/lib/cuter-${version}" "cuter_target" ];
   configurePhase = ''
     autoconf
     ./configure --prefix $out
diff --git a/pkgs/development/tools/imatix_gsl/default.nix b/pkgs/development/tools/imatix_gsl/default.nix
index 549a4d1b826..c4d290bf967 100644
--- a/pkgs/development/tools/imatix_gsl/default.nix
+++ b/pkgs/development/tools/imatix_gsl/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
 
   postPatch = "sed -e 's,/usr/bin/install,install,g' -i src/Makefile";
   preBuild = "cd src";
-  installFlags = "DESTDIR=$(out)";
+  installFlags = [ "DESTDIR=$(out)" ];
 
   meta = with stdenv.lib; {
     license = licenses.gpl3Plus;
diff --git a/pkgs/development/tools/literate-programming/noweb/default.nix b/pkgs/development/tools/literate-programming/noweb/default.nix
index 43cb6e6c2c7..7a2252c6b27 100644
--- a/pkgs/development/tools/literate-programming/noweb/default.nix
+++ b/pkgs/development/tools/literate-programming/noweb/default.nix
@@ -39,7 +39,7 @@ let noweb = stdenv.mkDerivation rec {
     mkdir -p "$tex/tex/latex/noweb"
   '';
 
-  installTargets = "install-code install-tex install-elisp";
+  installTargets = [ "install-code" "install-tex" "install-elisp" ];
 
   postInstall = ''
     substituteInPlace "$out/bin/cpif" --replace "PATH=/bin:/usr/bin" ""
@@ -57,7 +57,7 @@ let noweb = stdenv.mkDerivation rec {
 
     # HACK: This is ugly, but functional.
     PATH=$out/bin:$PATH make -BC xdoc
-    make $installFlags install-man
+    make "''${installFlags[@]}" install-man
 
     ln -s "$tex" "$out/share/texmf"
   '';
diff --git a/pkgs/development/tools/misc/ddd/default.nix b/pkgs/development/tools/misc/ddd/default.nix
index c51a5f50474..1ff96918766 100644
--- a/pkgs/development/tools/misc/ddd/default.nix
+++ b/pkgs/development/tools/misc/ddd/default.nix
@@ -11,6 +11,8 @@ stdenv.mkDerivation rec {
 
   patches = [ ./gcc44.patch ];
 
+  NIX_CFLAGS_COMPILE = "-fpermissive";
+
   meta = {
     homepage = https://www.gnu.org/software/ddd;
     description = "Graphical front-end for command-line debuggers";
diff --git a/pkgs/development/tools/misc/dialog/default.nix b/pkgs/development/tools/misc/dialog/default.nix
index 378cc4683b4..b82429cdac5 100644
--- a/pkgs/development/tools/misc/dialog/default.nix
+++ b/pkgs/development/tools/misc/dialog/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     "--with-libtool-opts=${stdenv.lib.optionalString enableShared "-shared"}"
   ];
 
-  installTargets = "install${stdenv.lib.optionalString withLibrary "-full"}";
+  installTargets = [ "install${stdenv.lib.optionalString withLibrary "-full"}" ];
 
   meta = {
     homepage = https://invisible-island.net/dialog/dialog.html;
diff --git a/pkgs/development/tools/misc/doclifter/default.nix b/pkgs/development/tools/misc/doclifter/default.nix
index 9975f0f5465..fe86a22b7f4 100644
--- a/pkgs/development/tools/misc/doclifter/default.nix
+++ b/pkgs/development/tools/misc/doclifter/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation {
   };
   buildInputs = [ python ];
   
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
   
   preInstall = ''
     mkdir -p $out/bin
diff --git a/pkgs/development/tools/misc/hydra/default.nix b/pkgs/development/tools/misc/hydra/default.nix
index e0ebba4c051..3e5c12e183a 100644
--- a/pkgs/development/tools/misc/hydra/default.nix
+++ b/pkgs/development/tools/misc/hydra/default.nix
@@ -102,7 +102,7 @@ in stdenv.mkDerivation rec {
 
   configureFlags = [ "--with-docbook-xsl=${docbook_xsl}/xml/xsl/docbook" ];
 
-  NIX_CFLAGS_COMPILE = [ "-pthread" ];
+  NIX_CFLAGS_COMPILE = "-pthread";
 
   shellHook = ''
     PATH=$(pwd)/src/script:$(pwd)/src/hydra-eval-jobs:$(pwd)/src/hydra-queue-runner:$(pwd)/src/hydra-evaluator:$PATH
diff --git a/pkgs/development/tools/misc/intel-gpu-tools/default.nix b/pkgs/development/tools/misc/intel-gpu-tools/default.nix
index 12197c2de40..a56ab127235 100644
--- a/pkgs/development/tools/misc/intel-gpu-tools/default.nix
+++ b/pkgs/development/tools/misc/intel-gpu-tools/default.nix
@@ -16,6 +16,8 @@ stdenv.mkDerivation rec {
     libXext libXv libXrandr glib bison libunwind python3 procps
     gtk-doc openssl peg ];
 
+  NIX_CFLAGS_COMPILE = [ "-Wno-error=array-bounds" ];
+
   preConfigure = ''
     ./autogen.sh
   '';
diff --git a/pkgs/development/tools/misc/openocd/default.nix b/pkgs/development/tools/misc/openocd/default.nix
index 169c1afd55d..7e141270904 100644
--- a/pkgs/development/tools/misc/openocd/default.nix
+++ b/pkgs/development/tools/misc/openocd/default.nix
@@ -34,12 +34,13 @@ stdenv.mkDerivation rec {
     "--enable-remote-bitbang"
   ];
 
-  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isGNU [
+  NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.cc.isGNU [
     "-Wno-implicit-fallthrough"
     "-Wno-format-truncation"
     "-Wno-format-overflow"
     "-Wno-error=tautological-compare"
-  ];
+    "-Wno-error=array-bounds"
+  ]);
 
   postInstall = lib.optionalString stdenv.isLinux ''
     mkdir -p "$out/etc/udev/rules.d"
diff --git a/pkgs/development/tools/misc/sipp/default.nix b/pkgs/development/tools/misc/sipp/default.nix
index 004975f10d8..eec1f32b4df 100644
--- a/pkgs/development/tools/misc/sipp/default.nix
+++ b/pkgs/development/tools/misc/sipp/default.nix
@@ -1,21 +1,17 @@
-{stdenv, fetchFromGitHub, autoreconfHook, ncurses, libpcap }:
+{stdenv, fetchurl, ncurses, libpcap }:
 
 stdenv.mkDerivation rec {
-  version = "3.5.1";
+  version = "3.6.0";
 
   pname = "sipp";
 
-  src = fetchFromGitHub {
-    owner = "SIPp";
-    repo = "sipp";
-    rev = "v${version}";
-    sha256 = "179a1fvqyk3jpxbi28l1xfw22cw9vgvxrn19w5f38w74x0jwqg5k";
+  src = fetchurl {
+    url = "https://github.com/SIPp/${pname}/releases/download/v${version}/${pname}-${version}.tar.gz";
+    sha256 = "1fx1iy2n0m2kr91n1ii30frbscq375k3lqihdgvrqxn0zq8pnzp4";
   };
 
-  patchPhase = ''
+  postPatch = ''
     sed -i "s@pcap/\(.*\).pcap@$out/share/pcap/\1.pcap@g" src/scenario.cpp
-    sed -i -e "s|AC_CHECK_LIB(curses|AC_CHECK_LIB(ncurses|" configure.ac
-    echo "#define SIPP_VERSION \"v${version}\"" > include/version.h
   '';
 
   configureFlags = [
@@ -29,8 +25,6 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ncurses libpcap];
 
-  nativeBuildInputs = [ autoreconfHook ];
-
   meta = with stdenv.lib; {
     homepage = http://sipp.sf.net;
     description = "The SIPp testing tool";
diff --git a/pkgs/development/tools/misc/sloccount/default.nix b/pkgs/development/tools/misc/sloccount/default.nix
index 965f0ed096c..4d63e2c6a15 100644
--- a/pkgs/development/tools/misc/sloccount/default.nix
+++ b/pkgs/development/tools/misc/sloccount/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  makeFlags = "PREFIX=$(out) CC=cc";
+  makeFlags = [ "PREFIX=$(out)" "CC=cc" ];
 
   doCheck = true;
   checkPhase = ''HOME="$TMPDIR" PATH="$PWD:$PATH" make test'';
diff --git a/pkgs/development/tools/misc/srecord/default.nix b/pkgs/development/tools/misc/srecord/default.nix
index a76a180741e..fd810555296 100644
--- a/pkgs/development/tools/misc/srecord/default.nix
+++ b/pkgs/development/tools/misc/srecord/default.nix
@@ -10,9 +10,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ boost libtool groff ghostscript libgcrypt ];
 
-  configureFlags = [
-    (stdenv.lib.optional (libgcrypt == null) "--without-gcrypt")
-  ];
+  configureFlags = stdenv.lib.optional (libgcrypt == null) "--without-gcrypt";
 
   meta = with stdenv.lib; {
     description = "Collection of powerful tools for manipulating EPROM load files";
diff --git a/pkgs/development/tools/misc/texinfo/common.nix b/pkgs/development/tools/misc/texinfo/common.nix
index 40dafe27da2..56ae48b7133 100644
--- a/pkgs/development/tools/misc/texinfo/common.nix
+++ b/pkgs/development/tools/misc/texinfo/common.nix
@@ -40,10 +40,8 @@ stdenv.mkDerivation {
   configureFlags = [ "PERL=${buildPackages.perl}/bin/perl" ]
     ++ stdenv.lib.optional stdenv.isSunOS "AWK=${gawk}/bin/awk";
 
-  preInstall = ''
-    installFlags="TEXMF=$out/texmf-dist";
-    installTargets="install install-tex";
-  '';
+  installFlags = [ "TEXMF=$(out)/texmf-dist" ];
+  installTargets = [ "install" "install-tex" ];
 
   checkInputs = [ procps ];
 
diff --git a/pkgs/development/tools/misc/trv/default.nix b/pkgs/development/tools/misc/trv/default.nix
index 44744413138..2e056306db4 100644
--- a/pkgs/development/tools/misc/trv/default.nix
+++ b/pkgs/development/tools/misc/trv/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
   createFindlibDestdir = true;
   dontStrip = true;
 
-  installFlags = "SEMVER=${version} PREFIX=$(out)";
+  installFlags = [ "SEMVER=${version}" "PREFIX=$(out)" ];
 
   meta = with stdenv.lib; {
     homepage = https://github.com/afiniate/trv;
diff --git a/pkgs/development/tools/misc/watson-ruby/default.nix b/pkgs/development/tools/misc/watson-ruby/default.nix
index e1726efc40c..64e04455abe 100644
--- a/pkgs/development/tools/misc/watson-ruby/default.nix
+++ b/pkgs/development/tools/misc/watson-ruby/default.nix
@@ -1,20 +1,19 @@
 { stdenv, bundlerEnv, ruby, bundlerUpdateScript }:
 
-
 stdenv.mkDerivation rec {
   pname = "watson-ruby";
   version = (import ./gemset.nix).watson-ruby.version;
 
-  env = bundlerEnv {
-    name = "watson-ruby-gems-${version}";
-    inherit ruby;
-    # expects Gemfile, Gemfile.lock and gemset.nix in the same directory
-    gemdir = ./.;
-  };
-
   phases = [ "installPhase" ];
 
-  installPhase = ''
+  installPhase = let
+    env = bundlerEnv {
+      name = "watson-ruby-gems-${version}";
+      inherit ruby;
+      # expects Gemfile, Gemfile.lock and gemset.nix in the same directory
+      gemdir = ./.;
+    };
+  in ''
     mkdir -p $out/bin
     ln -s ${env}/bin/watson $out/bin/watson
   '';
diff --git a/pkgs/development/tools/nrpl/default.nix b/pkgs/development/tools/nrpl/default.nix
index 068028c7da9..d8dab6b0358 100644
--- a/pkgs/development/tools/nrpl/default.nix
+++ b/pkgs/development/tools/nrpl/default.nix
@@ -21,9 +21,7 @@ stdenv.mkDerivation {
     })
   ];
 
-  NIX_LDFLAGS = [
-    "-lpcre"
-  ];
+  NIX_LDFLAGS = "-lpcre";
 
   buildPhase = ''
     HOME=$TMPDIR
diff --git a/pkgs/development/tools/nsis/default.nix b/pkgs/development/tools/nsis/default.nix
index 0539e8de92b..f8beae4d527 100644
--- a/pkgs/development/tools/nsis/default.nix
+++ b/pkgs/development/tools/nsis/default.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
   '';
 
   prefixKey = "PREFIX=";
-  installTargets = "install-compiler";
+  installTargets = [ "install-compiler" ];
 
   meta = with stdenv.lib; {
     description = "NSIS is a free scriptable win32 installer/uninstaller system that doesn't suck and isn't huge";
diff --git a/pkgs/development/tools/ocaml/camlp4/default.nix b/pkgs/development/tools/ocaml/camlp4/default.nix
index 6b471560fa9..de5da5674a2 100644
--- a/pkgs/development/tools/ocaml/camlp4/default.nix
+++ b/pkgs/development/tools/ocaml/camlp4/default.nix
@@ -55,9 +55,9 @@ stdenv.mkDerivation rec {
     --replace +camlp4 $out/lib/ocaml/${ocaml.version}/site-lib/camlp4
   '';
 
-  makeFlags = "all";
+  makeFlags = [ "all" ];
 
-  installTargets = "install install-META";
+  installTargets = [ "install" "install-META" ];
 
   dontStrip = true;
 
diff --git a/pkgs/development/tools/ocaml/camlp5/default.nix b/pkgs/development/tools/ocaml/camlp5/default.nix
index 1531408e498..c3fbb586349 100644
--- a/pkgs/development/tools/ocaml/camlp5/default.nix
+++ b/pkgs/development/tools/ocaml/camlp5/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
   preConfigure = "configureFlagsArray=(--strict" +
                   " --libdir $out/lib/ocaml/${ocaml.version}/site-lib)";
 
-  buildFlags = "world.opt";
+  buildFlags = [ "world.opt" ];
 
   dontStrip = true;
 
diff --git a/pkgs/development/tools/ocaml/cppo/default.nix b/pkgs/development/tools/ocaml/cppo/default.nix
index 8aa446081b7..fc5f2e4a688 100644
--- a/pkgs/development/tools/ocaml/cppo/default.nix
+++ b/pkgs/development/tools/ocaml/cppo/default.nix
@@ -18,7 +18,7 @@ let param =
     sha256 = "1xqldjz9risndnabvadw41fdbi5sa2hl4fnqls7j9xfbby1izbg8";
     extra = {
       createFindlibDestdir = true;
-      makeFlags = "PREFIX=$(out)";
+      makeFlags = [ "PREFIX=$(out)" ];
       preBuild = ''
         mkdir $out/bin
       '';
diff --git a/pkgs/development/tools/ocaml/dune/default.nix b/pkgs/development/tools/ocaml/dune/default.nix
index 075020eef5c..ef0f5c4fabd 100644
--- a/pkgs/development/tools/ocaml/dune/default.nix
+++ b/pkgs/development/tools/ocaml/dune/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ ocaml findlib ];
 
-  buildFlags = "release";
+  buildFlags = [ "release" ];
 
   dontAddPrefix = true;
 
diff --git a/pkgs/development/tools/ocaml/ocamlscript/default.nix b/pkgs/development/tools/ocaml/ocamlscript/default.nix
index 28efaf4cf3d..33b729f938d 100644
--- a/pkgs/development/tools/ocaml/ocamlscript/default.nix
+++ b/pkgs/development/tools/ocaml/ocamlscript/default.nix
@@ -10,8 +10,8 @@ stdenv.mkDerivation {
 
   patches = [ ./Makefile.patch ];
 
-  buildFlags = "PREFIX=$(out)";
-  installFlags = "PREFIX=$(out)";
+  buildFlags = [ "PREFIX=$(out)" ];
+  installFlags = [ "PREFIX=$(out)" ];
 
   preInstall = "mkdir $out/bin";
   createFindlibDestdir = true;
diff --git a/pkgs/development/tools/ocaml/omake/0.9.8.6-rc1.nix b/pkgs/development/tools/ocaml/omake/0.9.8.6-rc1.nix
index 1ea1cd4ab38..6a3c0c20d85 100644
--- a/pkgs/development/tools/ocaml/omake/0.9.8.6-rc1.nix
+++ b/pkgs/development/tools/ocaml/omake/0.9.8.6-rc1.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
     url = "https://src.fedoraproject.org/repo/pkgs/ocaml-omake/${pname}-${version}.tar.gz/fe39a476ef4e33b7ba2ca77a6bcaded2/${pname}-${version}.tar.gz";
     sha256 = "1sas02pbj56m7wi5vf3vqrrpr4ynxymw2a8ybvfj2dkjf7q9ii13";
   };
-  patchFlags = "-p0";
+  patchFlags = [ "-p0" ];
   patches = [ ./warn.patch ];
 
   buildInputs = [ ocaml makeWrapper ncurses ];
@@ -32,7 +32,7 @@ stdenv.mkDerivation {
 #
 #  configureFlags = if transitional then "--transitional" else "--strict";
 #
-#  buildFlags = "world.opt";		
+#  buildFlags = [ "world.opt" ];		
 
   meta = {
     description = "Omake build system";
diff --git a/pkgs/development/tools/parsing/ragel/default.nix b/pkgs/development/tools/parsing/ragel/default.nix
index 2f4db7982b7..12c9b9d57f8 100644
--- a/pkgs/development/tools/parsing/ragel/default.nix
+++ b/pkgs/development/tools/parsing/ragel/default.nix
@@ -21,7 +21,7 @@ let
 
       configureFlags = [ "--with-colm=${colm}" ];
 
-      NIX_CFLAGS_COMPILE = stdenv.lib.optional stdenv.cc.isGNU "-std=gnu++98";
+      NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isGNU "-std=gnu++98";
 
       doCheck = true;
 
diff --git a/pkgs/development/tools/simavr/default.nix b/pkgs/development/tools/simavr/default.nix
index c7bc96871f8..a455f9e5fc7 100644
--- a/pkgs/development/tools/simavr/default.nix
+++ b/pkgs/development/tools/simavr/default.nix
@@ -22,6 +22,8 @@ stdenv.mkDerivation rec {
     "AVR=avr-"
   ];
 
+  NIX_CFLAGS_COMPILE = [ "-Wno-error=stringop-truncation" ];
+
   nativeBuildInputs = [ which pkgconfig avrgcc ];
   buildInputs = [ libelf freeglut libGLU libGL ]
     ++ stdenv.lib.optional stdenv.isDarwin GLUT;
diff --git a/pkgs/development/tools/spirv-tools/default.nix b/pkgs/development/tools/spirv-tools/default.nix
index 9958cb197ca..f6702229374 100644
--- a/pkgs/development/tools/spirv-tools/default.nix
+++ b/pkgs/development/tools/spirv-tools/default.nix
@@ -1,9 +1,12 @@
 { stdenv, fetchFromGitHub, cmake, python3, spirv-headers }:
+let
+  # Update spirv-headers rev in lockstep according to DEPs file
+  version = "2019.4";
+in
 
 stdenv.mkDerivation rec {
   pname = "spirv-tools";
-  # Update spirv-headers rev in lockstep according to DEPs file
-  version = "2019.4";
+  inherit version;
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
@@ -13,7 +16,7 @@ stdenv.mkDerivation rec {
   };
   enableParallelBuilding = true;
 
-  buildInputs = [ cmake python3 ];
+  nativeBuildInputs = [ cmake python3 ];
 
   cmakeFlags = [ "-DSPIRV-Headers_SOURCE_DIR=${spirv-headers.src}" ];
 
diff --git a/pkgs/development/tools/sslmate/default.nix b/pkgs/development/tools/sslmate/default.nix
index 8683c75a696..9fbdc2e2e87 100644
--- a/pkgs/development/tools/sslmate/default.nix
+++ b/pkgs/development/tools/sslmate/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "0vhppvy5vphipbycfilzxdly7nw12brscz4biawf3bl376yp7ljm";
   };
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   buildInputs = [ perlPackages.perl makeWrapper ];
 
diff --git a/pkgs/development/tools/stagit/default.nix b/pkgs/development/tools/stagit/default.nix
index f1a1ceb9bb1..8f4ee7ce6e5 100644
--- a/pkgs/development/tools/stagit/default.nix
+++ b/pkgs/development/tools/stagit/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "0gh28spkry9wbmdj0hmvz3680fvbyzab9cifhj1p76f4fz27rnv9";
   };
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   buildInputs = [ libgit2 ];
 
diff --git a/pkgs/development/tools/tora/default.nix b/pkgs/development/tools/tora/default.nix
index 931c00ecce5..213c926521f 100644
--- a/pkgs/development/tools/tora/default.nix
+++ b/pkgs/development/tools/tora/default.nix
@@ -40,14 +40,9 @@ mkDerivation {
   ];
 
   # these libraries are only searched for at runtime so we need to force-link them
-  NIX_LDFLAGS = [
-    "-lgvc"
-    "-lmysqlclient"
-    "-lecpg"
-    "-lssl"
-  ];
+  NIX_LDFLAGS = "-lgvc -lmysqlclient -lecpg -lssl";
 
-  NIX_CFLAGS_COMPILE = [ "-L${libmysqlclient}/lib/mysql" "-I${libmysqlclient}/include/mysql" ];
+  NIX_CFLAGS_COMPILE = "-L${libmysqlclient}/lib/mysql -I${libmysqlclient}/include/mysql";
 
   qtWrapperArgs = [
     ''--prefix PATH : ${lib.getBin graphviz}/bin''
diff --git a/pkgs/development/tools/tychus/default.nix b/pkgs/development/tools/tychus/default.nix
index 01531d23c78..5908ceb0f80 100644
--- a/pkgs/development/tools/tychus/default.nix
+++ b/pkgs/development/tools/tychus/default.nix
@@ -17,7 +17,7 @@ buildGoPackage rec {
 
   buildInputs = stdenv.lib.optionals stdenv.hostPlatform.isDarwin [ CoreFoundation ];
 
-  buildFlags = "--tags release";
+  buildFlags = [ "--tags" "release" ];
 
   meta = {
     description = "Command line utility to live-reload your application.";
diff --git a/pkgs/development/web/wml/default.nix b/pkgs/development/web/wml/default.nix
index 841a6ebecb0..6208bff15bc 100644
--- a/pkgs/development/web/wml/default.nix
+++ b/pkgs/development/web/wml/default.nix
@@ -53,7 +53,7 @@ perlPackages.buildPerlPackage {
 
   enableParallelBuilding = false;
 
-  installTargets = "install";
+  installTargets = [ "install" ];
 
   meta = with stdenv.lib; {
     homepage = "https://www.shlomifish.org/open-source/projects/website-meta-language/";
diff --git a/pkgs/games/0ad/game.nix b/pkgs/games/0ad/game.nix
index 8102235d88e..42464f71ae3 100644
--- a/pkgs/games/0ad/game.nix
+++ b/pkgs/games/0ad/game.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     nvidia-texture-tools libsodium
   ] ++ lib.optional withEditor wxGTK;
 
-  NIX_CFLAGS_COMPILE = [
+  NIX_CFLAGS_COMPILE = toString [
     "-I${xorgproto}/include/X11"
     "-I${libX11.dev}/include/X11"
     "-I${libXcursor.dev}/include/X11"
diff --git a/pkgs/games/airstrike/default.nix b/pkgs/games/airstrike/default.nix
index 19d2a01b472..408f2817854 100644
--- a/pkgs/games/airstrike/default.nix
+++ b/pkgs/games/airstrike/default.nix
@@ -11,9 +11,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ makeWrapper SDL SDL_image ];
 
-  NIX_LDFLAGS = [
-    "-lm"
-  ];
+  NIX_LDFLAGS = "-lm";
 
   installPhase = ''
     ls -l
diff --git a/pkgs/games/angband/default.nix b/pkgs/games/angband/default.nix
index 46eb054bc8e..309ea244d71 100644
--- a/pkgs/games/angband/default.nix
+++ b/pkgs/games/angband/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ ncurses5 ];
-  installFlags = "bindir=$(out)/bin";
+  installFlags = [ "bindir=$(out)/bin" ];
 
   meta = with stdenv.lib; {
     homepage = http://rephial.org/;
diff --git a/pkgs/games/armagetronad/default.nix b/pkgs/games/armagetronad/default.nix
index edb739125c0..57373d39b54 100644
--- a/pkgs/games/armagetronad/default.nix
+++ b/pkgs/games/armagetronad/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation {
     sha256 = "157pp84wf0q3bdb72rnbm3ck0czwx2ply6lyhj8z7kfdc7csdbr3";
   };
 
-  NIX_LDFLAGS = [ "-lSDL_image" ];
+  NIX_LDFLAGS = "-lSDL_image";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/games/cataclysm-dda/default.nix b/pkgs/games/cataclysm-dda/default.nix
index b1d8a27b5a2..ced19bffb31 100644
--- a/pkgs/games/cataclysm-dda/default.nix
+++ b/pkgs/games/cataclysm-dda/default.nix
@@ -25,6 +25,8 @@ stdenv.mkDerivation (common // rec {
     substituteInPlace lua/autoexec.lua --replace "/usr/share" "$out/share"
   '';
 
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isGNU "-Wno-error=deprecated-copy";
+
   makeFlags = common.makeFlags ++ [
     "LUA=1"
   ];
diff --git a/pkgs/games/eboard/default.nix b/pkgs/games/eboard/default.nix
index 206ed02e69c..af6bc4be393 100644
--- a/pkgs/games/eboard/default.nix
+++ b/pkgs/games/eboard/default.nix
@@ -19,11 +19,8 @@ stdenv.mkDerivation {
     patchShebangs ./configure
   '';
 
-  NIX_CFLAGS_COMPILE = [ "-fpermissive" ];
-
-  NIX_LDFLAGS = [
-    "-ldl"
-  ];
+  NIX_CFLAGS_COMPILE = "-fpermissive";
+  NIX_LDFLAGS = "-ldl";
 
   meta = {
     homepage = http://www.bergo.eng.br/eboard/;
diff --git a/pkgs/games/eduke32/default.nix b/pkgs/games/eduke32/default.nix
index e305505d62c..242e0930db3 100644
--- a/pkgs/games/eduke32/default.nix
+++ b/pkgs/games/eduke32/default.nix
@@ -41,10 +41,7 @@ in stdenv.mkDerivation {
     done
   '';
 
-  NIX_CFLAGS_COMPILE = [
-    "-I${SDL2.dev}/include/SDL2"
-    "-I${SDL2_mixer}/include/SDL2"
-  ];
+  NIX_CFLAGS_COMPILE = "-I${SDL2.dev}/include/SDL2 -I${SDL2_mixer}/include/SDL2";
 
   makeFlags = [
     "SDLCONFIG=${SDL2}/bin/sdl2-config"
diff --git a/pkgs/games/egoboo/default.nix b/pkgs/games/egoboo/default.nix
index 3cd2dc5827b..c8a5f380900 100644
--- a/pkgs/games/egoboo/default.nix
+++ b/pkgs/games/egoboo/default.nix
@@ -44,9 +44,7 @@ stdenv.mkDerivation rec {
     '';
   */
 
-  NIX_LDFLAGS = [
-    "-lm"
-  ];
+  NIX_LDFLAGS = "-lm";
 
   meta = {
     description = "3D dungeon crawling adventure";
diff --git a/pkgs/games/exult/default.nix b/pkgs/games/exult/default.nix
index 58fdaeb8f74..07f84d7a151 100644
--- a/pkgs/games/exult/default.nix
+++ b/pkgs/games/exult/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "DESTDIR=$(out)" ];
 
-  NIX_LDFLAGS = [ "-lX11" ];
+  NIX_LDFLAGS = "-lX11";
 
   postInstall =
     ''
diff --git a/pkgs/games/globulation/default.nix b/pkgs/games/globulation/default.nix
index b953aad606d..45c5013705f 100644
--- a/pkgs/games/globulation/default.nix
+++ b/pkgs/games/globulation/default.nix
@@ -41,9 +41,7 @@ stdenv.mkDerivation rec {
     sconsFlags+=" DATADIR=$out/share/globulation2/glob2"
   '';
 
-  NIX_LDFLAGS = [
-    "-lboost_system"
-  ];
+  NIX_LDFLAGS = "-lboost_system";
 
   meta = with stdenv.lib; {
     description = "RTS without micromanagement";
diff --git a/pkgs/games/gmad/default.nix b/pkgs/games/gmad/default.nix
index 78936ec1949..e51c326da19 100644
--- a/pkgs/games/gmad/default.nix
+++ b/pkgs/games/gmad/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     else if stdenv.isDarwin then "gmad_osx"
     else "gmad";
 
-  premakeFlags = "--bootil_lib=${bootil}/lib --bootil_inc=${bootil}/include";
+  premakeFlags = [ "--bootil_lib=${bootil}/lib" "--bootil_inc=${bootil}/include" ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/games/gnujump/default.nix b/pkgs/games/gnujump/default.nix
index 4bf460836d9..af2e924960a 100644
--- a/pkgs/games/gnujump/default.nix
+++ b/pkgs/games/gnujump/default.nix
@@ -9,9 +9,7 @@ stdenv.mkDerivation rec {
   };
   buildInputs = [ SDL SDL_image SDL_mixer ];
 
-  NIX_LDFLAGS = [
-    "-lm"
-  ];
+  NIX_LDFLAGS = "-lm";
 
   meta = with stdenv.lib; {
     homepage = https://jump.gnu.sinusoid.es/index.php?title=Main_Page;
diff --git a/pkgs/games/gzdoom/default.nix b/pkgs/games/gzdoom/default.nix
index 288d3369dfb..5cafe045fa6 100644
--- a/pkgs/games/gzdoom/default.nix
+++ b/pkgs/games/gzdoom/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_LINK = [ "-lopenal" "-lfluidsynth" ];
+  NIX_CFLAGS_LINK = "-lopenal -lfluidsynth";
 
   preConfigure = ''
     sed -i \
diff --git a/pkgs/games/macopix/default.nix b/pkgs/games/macopix/default.nix
index 2639765c5d1..7879b68c857 100644
--- a/pkgs/games/macopix/default.nix
+++ b/pkgs/games/macopix/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_LDFLAGS = [ "-lX11" ];
+  NIX_LDFLAGS = "-lX11";
 
   meta = {
     description = "Mascot Constructive Pilot for X";
diff --git a/pkgs/games/minetest/default.nix b/pkgs/games/minetest/default.nix
index 4654456bd6c..f286c359e6f 100644
--- a/pkgs/games/minetest/default.nix
+++ b/pkgs/games/minetest/default.nix
@@ -40,7 +40,7 @@ let
       "-DOpenGL_GL_PREFERENCE=GLVND"
     ];
 
-    NIX_CFLAGS_COMPILE = [ "-DluaL_reg=luaL_Reg" ]; # needed since luajit-2.1.0-beta3
+    NIX_CFLAGS_COMPILE = "-DluaL_reg=luaL_Reg"; # needed since luajit-2.1.0-beta3
 
     nativeBuildInputs = [ cmake doxygen graphviz ];
 
@@ -48,7 +48,7 @@ let
       irrlicht luajit jsoncpp gettext freetype sqlite curl bzip2 ncurses
     ] ++ optionals buildClient [
       libpng libjpeg libGLU libGL openal libogg libvorbis xorg.libX11 libXxf86vm
-    ] ++ optional buildServer [
+    ] ++ optionals buildServer [
       leveldb postgresql hiredis
     ];
 
diff --git a/pkgs/games/onscripter-en/default.nix b/pkgs/games/onscripter-en/default.nix
index 618e78553a5..2ad23a72368 100644
--- a/pkgs/games/onscripter-en/default.nix
+++ b/pkgs/games/onscripter-en/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
   configureFlags = [ "--no-werror" ];
 
   # Without this libvorbisfile.so is not getting linked properly for some reason.
-  NIX_CFLAGS_LINK = [ "-lvorbisfile" ];
+  NIX_CFLAGS_LINK = "-lvorbisfile";
 
   preBuild = ''
     sed -i 's/.dll//g' Makefile
diff --git a/pkgs/games/opendungeons/default.nix b/pkgs/games/opendungeons/default.nix
index d59afc330a7..f6841abb1d0 100644
--- a/pkgs/games/opendungeons/default.nix
+++ b/pkgs/games/opendungeons/default.nix
@@ -15,9 +15,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ cmake ogre cegui boost sfml openal ois ];
-  NIX_LDFLAGS = [
-    "-lpthread"
-  ];
+  NIX_LDFLAGS = "-lpthread";
 
   meta = with stdenv.lib; {
     description = "An open source, real time strategy game sharing game elements with the Dungeon Keeper series and Evil Genius.";
diff --git a/pkgs/games/openra/common.nix b/pkgs/games/openra/common.nix
index b0d1f2a5455..51f94177177 100644
--- a/pkgs/games/openra/common.nix
+++ b/pkgs/games/openra/common.nix
@@ -69,7 +69,7 @@ in {
       python
     ];
 
-    makeFlags = "prefix=$(out)";
+    makeFlags = [ "prefix=$(out)" ];
 
     doCheck = true;
 
diff --git a/pkgs/games/openspades/default.nix b/pkgs/games/openspades/default.nix
index de05e1944f3..b00524461a4 100644
--- a/pkgs/games/openspades/default.nix
+++ b/pkgs/games/openspades/default.nix
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_LINK = [ "-lopenal" ];
+  NIX_CFLAGS_LINK = "-lopenal";
 
   meta = with stdenv.lib; {
     description = "A compatible client of Ace of Spades 0.75";
diff --git a/pkgs/games/openttd/default.nix b/pkgs/games/openttd/default.nix
index d0828b8811b..704ef3c327e 100644
--- a/pkgs/games/openttd/default.nix
+++ b/pkgs/games/openttd/default.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
     "--without-liblzo2"
   ];
 
-  makeFlags = "INSTALL_PERSONAL_DIR=";
+  makeFlags = [ "INSTALL_PERSONAL_DIR=" ];
 
   postInstall = ''
     mv $out/games/ $out/bin
diff --git a/pkgs/games/pingus/default.nix b/pkgs/games/pingus/default.nix
index 640a4d761f4..628493a34b1 100644
--- a/pkgs/games/pingus/default.nix
+++ b/pkgs/games/pingus/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
       sha256 = "0nqyhznnnvpgfa6rfv8rapjfpw99b67n97jfqp9r3hpib1b3ja6p";
     })
   ];
-  makeFlags = "PREFIX=${placeholder "out"}";
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
   dontUseSconsInstall = true;
   meta = {
     inherit (s) version;
diff --git a/pkgs/games/pokerth/default.nix b/pkgs/games/pokerth/default.nix
index e32bc06b8f5..2e4ce270b82 100644
--- a/pkgs/games/pokerth/default.nix
+++ b/pkgs/games/pokerth/default.nix
@@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
     "pokerth.pro"
   ];
 
-  NIX_CFLAGS_COMPILE = [ "-I${SDL.dev}/include/SDL" ];
+  NIX_CFLAGS_COMPILE = "-I${SDL.dev}/include/SDL";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/games/rogue/default.nix b/pkgs/games/rogue/default.nix
index c8af2331b08..1e27d67eb03 100644
--- a/pkgs/games/rogue/default.nix
+++ b/pkgs/games/rogue/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
   buildInputs = [ ncurses ];
 
   # Fix build for recent ncurses versions
-  NIX_CFLAGS_COMPILE = [ "-DNCURSES_INTERNALS=1" ];
+  NIX_CFLAGS_COMPILE = "-DNCURSES_INTERNALS=1";
 
   meta = with stdenv.lib; {
     homepage = http://rogue.rogueforge.net/rogue-5-4/;
diff --git a/pkgs/games/scorched3d/default.nix b/pkgs/games/scorched3d/default.nix
index a2859c11712..c86df396ff1 100644
--- a/pkgs/games/scorched3d/default.nix
+++ b/pkgs/games/scorched3d/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--with-fftw=${fftwSinglePrec.dev}" ];
 
-  NIX_LDFLAGS = [ "-lopenal" ];
+  NIX_LDFLAGS = "-lopenal";
 
   meta = with stdenv.lib; {
     homepage = http://scorched3d.co.uk/;
diff --git a/pkgs/games/stockfish/default.nix b/pkgs/games/stockfish/default.nix
index eea92b43b52..07ca9223bb0 100644
--- a/pkgs/games/stockfish/default.nix
+++ b/pkgs/games/stockfish/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
 
   postUnpack = "sourceRoot+=/src";
   makeFlags = [ "PREFIX=$(out)" "ARCH=${arch}" ];
-  buildFlags = "build ";
+  buildFlags = [ "build" ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/games/tdm/default.nix b/pkgs/games/tdm/default.nix
index fef3350a061..949f5a3e2ab 100644
--- a/pkgs/games/tdm/default.nix
+++ b/pkgs/games/tdm/default.nix
@@ -91,7 +91,7 @@ EOF
 
   enableParallelBuilding = true;
   sconsFlags = [ "BUILD=release" "TARGET_ARCH=x64" ];
-  NIX_CFLAGS_COMPILE = ["-Wno-error=format-security"];
+  NIX_CFLAGS_COMPILE = "-Wno-error=format-security";
   meta = with stdenv.lib; {
     description = "The Dark Mod - stealth FPS inspired by the Thief series";
     homepage = "http://www.thedarkmod.com";
diff --git a/pkgs/games/tome4/default.nix b/pkgs/games/tome4/default.nix
index 2d9ef45a9e0..b31b53922ff 100644
--- a/pkgs/games/tome4/default.nix
+++ b/pkgs/games/tome4/default.nix
@@ -41,11 +41,7 @@ in stdenv.mkDerivation rec {
   # disable parallel building as it caused sporadic build failures
   enableParallelBuilding = false;
 
-  NIX_CFLAGS_COMPILE = [
-    "-I${SDL2.dev}/include/SDL2"
-    "-I${SDL2_image}/include/SDL2"
-    "-I${SDL2_ttf}/include/SDL2"
-  ];
+  NIX_CFLAGS_COMPILE = "-I${SDL2.dev}/include/SDL2 -I${SDL2_image}/include/SDL2 -I${SDL2_ttf}/include/SDL2";
 
   makeFlags = [ "config=release" ];
 
diff --git a/pkgs/games/tremulous/default.nix b/pkgs/games/tremulous/default.nix
index fc9bc985c00..7ea83f80fef 100644
--- a/pkgs/games/tremulous/default.nix
+++ b/pkgs/games/tremulous/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     cd ..
   '';
   patches = [ ./parse.patch ];
-  patchFlags = "-p 0";
+  patchFlags = [ "-p" "0" ];
   NIX_LD_FLAGS = ''
     -rpath ${stdenv.cc}/lib
     -rpath ${stdenv.cc}/lib64
diff --git a/pkgs/games/vitetris/default.nix b/pkgs/games/vitetris/default.nix
index 7f552bdd5d6..fdc28d3a539 100644
--- a/pkgs/games/vitetris/default.nix
+++ b/pkgs/games/vitetris/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
-  makeFlags = "INSTALL=install";
+  makeFlags = [ "INSTALL=install" ];
 
   meta = {
     description = "Terminal-based Tetris clone by Victor Nilsson";
diff --git a/pkgs/games/xbill/default.nix b/pkgs/games/xbill/default.nix
index 119cd8f0876..8a6d4cf14cd 100644
--- a/pkgs/games/xbill/default.nix
+++ b/pkgs/games/xbill/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libX11 libXpm libXt motif ];
 
-  NIX_CFLAGS_LINK = [ "-lXpm" ];
+  NIX_CFLAGS_LINK = "-lXpm";
 
   configureFlags = [
     "--with-x"
diff --git a/pkgs/games/xpilot/bloodspilot-client.nix b/pkgs/games/xpilot/bloodspilot-client.nix
index 257b0010245..4a1c25ee12e 100644
--- a/pkgs/games/xpilot/bloodspilot-client.nix
+++ b/pkgs/games/xpilot/bloodspilot-client.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     libX11 SDL SDL_ttf SDL_image libGLU libGL expat zlib
   ];
 
-  NIX_LDFLAGS = [ "-lX11" ];
+  NIX_LDFLAGS = "-lX11";
 
   meta = {
     description = ''A multiplayer space combat game (client part)'';
diff --git a/pkgs/games/xskat/default.nix b/pkgs/games/xskat/default.nix
index 383bdb88284..086aaded9aa 100644
--- a/pkgs/games/xskat/default.nix
+++ b/pkgs/games/xskat/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation {
       -e "s|.* BINDIR .*|   BINDIR = $out/bin|" \
       -e "s|.* MANPATH .*|  MANPATH = $out/man|"
   '';
-  installTargets = "install install.man";
+  installTargets = [ "install" "install.man" ];
   meta = {
     inherit (s) version;
     description = ''Famous german card game'';
diff --git a/pkgs/games/zoom/default.nix b/pkgs/games/zoom/default.nix
index 449d7ae6e2d..827fb351f1d 100644
--- a/pkgs/games/zoom/default.nix
+++ b/pkgs/games/zoom/default.nix
@@ -4,21 +4,15 @@
 
 stdenv.mkDerivation rec {
   name = "zoom-1.1.5";
-  
+
   src = fetchurl {
     url = "https://www.logicalshift.co.uk/unix/zoom/${name}.tar.gz";
     sha256 = "1g6van7f7sg3zfcz80mncnnbccyg2hnm0hq4x558vpsm0lf7z5pj";
   };
-  
+
   buildInputs = [ perl expat xlibsWrapper freetype ];
-  
-  NIX_CFLAGS_COMPILE = [
-    # Zoom doesn't add the right directory in the include path.
-    "-I" (freetype + "/include/freetype2")
 
-    # for gcc5; c11 inline semantics breaks the build
-    "-fgnu89-inline"
-  ];
+  NIX_CFLAGS_COMPILE = "-I${freetype}/include/freetype2 -fgnu89-inline";
 
   meta = with stdenv.lib; {
     description = "Player for Z-Code, TADS and HUGO stories or games";
diff --git a/pkgs/misc/beep/default.nix b/pkgs/misc/beep/default.nix
index ce097bd5f23..b98560992e3 100644
--- a/pkgs/misc/beep/default.nix
+++ b/pkgs/misc/beep/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
     sha256 = "0bgch6jq5cahakk3kbr9549iysf2dik09afixxy5brbxk1xfzb2r";
   };
 
-  makeFlags = "INSTALL_DIR=\${out}/bin/ MAN_DIR=\${out}/man/man1/";
+  makeFlags = [ "INSTALL_DIR=\${out}/bin/" "MAN_DIR=\${out}/man/man1/" ];
 
   preInstall = ''
     mkdir -p $out/bin
diff --git a/pkgs/misc/cups/drivers/cups-bjnp/default.nix b/pkgs/misc/cups/drivers/cups-bjnp/default.nix
index f38ed7f0309..0c91b782117 100644
--- a/pkgs/misc/cups/drivers/cups-bjnp/default.nix
+++ b/pkgs/misc/cups/drivers/cups-bjnp/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   preConfigure = ''configureFlags="--with-cupsbackenddir=$out/lib/cups/backend"'';
 
   buildInputs = [cups];
-  NIX_CFLAGS_COMPILE = "-include stdio.h";
+  NIX_CFLAGS_COMPILE = [ "-include stdio.h" "-Wno-error=stringop-truncation" ];
 
   meta = {
     description = "CUPS back-end for Canon printers";
diff --git a/pkgs/misc/drivers/epkowa/default.nix b/pkgs/misc/drivers/epkowa/default.nix
index 29586f3fb55..13bb63ca709 100644
--- a/pkgs/misc/drivers/epkowa/default.nix
+++ b/pkgs/misc/drivers/epkowa/default.nix
@@ -245,7 +245,7 @@ stdenv.mkDerivation rec {
     })
     ./firmware_location.patch
     ];
-  patchFlags = "-p0";
+  patchFlags = [ "-p0" ];
 
   configureFlags = [ "--enable-dependency-reduction" "--disable-frontend"];
 
diff --git a/pkgs/misc/drivers/foomatic-filters/default.nix b/pkgs/misc/drivers/foomatic-filters/default.nix
index d4f15992e74..9bee05bfb25 100644
--- a/pkgs/misc/drivers/foomatic-filters/default.nix
+++ b/pkgs/misc/drivers/foomatic-filters/default.nix
@@ -24,13 +24,12 @@ stdenv.mkDerivation rec {
       substituteInPlace foomaticrip.c --replace /bin/bash ${stdenv.shell}
     '';
 
-  installTargets = "install-cups";
+  installTargets = [ "install-cups" ];
 
-  installFlags =
-    ''
-      CUPS_FILTERS=$(out)/lib/cups/filter
-      CUPS_BACKENDS=$(out)/lib/cups/backend
-    '';
+  installFlags = [
+    "CUPS_FILTERS=$(out)/lib/cups/filter"
+    "CUPS_BACKENDS=$(out)/lib/cups/backend"
+  ];
 
   meta = {
     description = "Foomatic printing filters";
diff --git a/pkgs/misc/drivers/utsushi/default.nix b/pkgs/misc/drivers/utsushi/default.nix
index 8a8556b63df..ad7659d060a 100644
--- a/pkgs/misc/drivers/utsushi/default.nix
+++ b/pkgs/misc/drivers/utsushi/default.nix
@@ -26,11 +26,7 @@ stdenv.mkDerivation rec {
     libusb.dev
   ];
 
-  NIX_CFLAGS_COMPILE = [
-    "-Wno-error=deprecated-declarations"
-    "-Wno-error=parentheses"
-    "-Wno-error=unused-variable"
-  ];
+  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations -Wno-error=parentheses -Wno-error=unused-variable";
 
   postPatch = ''
     # remove vendored dependencies
diff --git a/pkgs/misc/drivers/xboxdrv/default.nix b/pkgs/misc/drivers/xboxdrv/default.nix
index 8ca83c2c93d..e2f2bcc2f24 100644
--- a/pkgs/misc/drivers/xboxdrv/default.nix
+++ b/pkgs/misc/drivers/xboxdrv/default.nix
@@ -12,7 +12,7 @@ in stdenv.mkDerivation {
     sha256 = "0jx2wqmc7602dxyj19n3h8x0cpy929h7c0h39vcc5rf0q74fh3id";
   };
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ scons libX11 libusb1 boost glib dbus-glib ];
   dontUseSconsInstall = true;
diff --git a/pkgs/misc/emulators/blastem/default.nix b/pkgs/misc/emulators/blastem/default.nix
index 39a7e38e034..0d4c7ab7216 100644
--- a/pkgs/misc/emulators/blastem/default.nix
+++ b/pkgs/misc/emulators/blastem/default.nix
@@ -11,7 +11,7 @@ let
         rev = "244f8bbbdf64ae603f9f6c09a3067943837459ec";
         sha256 = "0x4y5q7ygxfjfy2wxijkps9khsjjfb169sbda410vaw0m88wqj5p";
       };
-      makeFlags = "CPU=m68k SYNTAX=mot";
+      makeFlags = [ "CPU=m68k" "SYNTAX=mot" ];
       installPhase = ''
         mkdir -p $out/bin
         cp vasmm68k_mot $out/bin
diff --git a/pkgs/misc/emulators/citra/default.nix b/pkgs/misc/emulators/citra/default.nix
index d8717b46eef..ca6ad37b5aa 100644
--- a/pkgs/misc/emulators/citra/default.nix
+++ b/pkgs/misc/emulators/citra/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchgit, cmake, SDL2, qtbase, qtmultimedia, boost }:
 
-stdenv.mkDerivation { 
+stdenv.mkDerivation {
   pname = "citra";
-  version = "2019-05-25";
+  version = "2019-10-05";
 
   # Submodules
   src = fetchgit {
     url = "https://github.com/citra-emu/citra";
-    rev = "186ffc235f744dad315a603a98cce4597ef0f65f";
-    sha256 = "0w24an80yjmkfcxjzdvsbpahx46bmd90liq5m6qva5pgnpmxx7pn";
+    rev = "35690e3ac7a340d941d3bf56080cf5aa6187c5c3";
+    sha256 = "11a4mdjabn3qrh0nn4pjl5fxs9nhf1k27wd486csfx88q2q9jvq8";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/misc/emulators/dlx/default.nix b/pkgs/misc/emulators/dlx/default.nix
index 358cc59d3db..ad111a61514 100644
--- a/pkgs/misc/emulators/dlx/default.nix
+++ b/pkgs/misc/emulators/dlx/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ unzip ];
 
-  makeFlags = "LINK=gcc CFLAGS=-O2";
+  makeFlags = [ "LINK=gcc" "CFLAGS=-O2" ];
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/misc/emulators/emulationstation/default.nix b/pkgs/misc/emulators/emulationstation/default.nix
index 668d1804544..722f6b25429 100644
--- a/pkgs/misc/emulators/emulationstation/default.nix
+++ b/pkgs/misc/emulators/emulationstation/default.nix
@@ -1,5 +1,6 @@
 { stdenv, fetchFromGitHub, pkgconfig, cmake, curl, boost, eigen
-, freeimage, freetype, libGLU, libGL, SDL2, alsaLib, libarchive }:
+, freeimage, freetype, libGLU, libGL, SDL2, alsaLib, libarchive
+, fetchpatch }:
 
 stdenv.mkDerivation {
   pname = "emulationstation";
@@ -12,14 +13,22 @@ stdenv.mkDerivation {
     sha256 = "0cm0sq2wri2l9cvab1l0g02za59q7klj0h3p028vr96n6njj4w9v";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ cmake alsaLib boost curl eigen freeimage freetype libarchive libGLU libGL SDL2 ];
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/Aloshi/EmulationStation/commit/49ccd8fc7a7b1dfd974fc57eb13317c42842f22c.patch";
+      sha256 = "1v5d81l7bav0k5z4vybrc3rjcysph6lkm5pcfr6m42wlz7jmjw0p";
+    })
+  ];
+
+  nativeBuildInputs = [ pkgconfig cmake ];
+  buildInputs = [ alsaLib boost curl eigen freeimage freetype libarchive libGLU libGL SDL2 ];
 
-  buildPhase = "cmake . && make";
   installPhase = ''
     install -D ../emulationstation $out/bin/emulationstation
   '';
 
+  enableParallelBuilding = true;
+
   meta = {
     description = "A flexible emulator front-end supporting keyboardless navigation and custom system themes";
     homepage = https://emulationstation.org;
diff --git a/pkgs/misc/emulators/hatari/default.nix b/pkgs/misc/emulators/hatari/default.nix
index 74e35379137..278d8d8dc5f 100644
--- a/pkgs/misc/emulators/hatari/default.nix
+++ b/pkgs/misc/emulators/hatari/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
   };
 
   # For pthread_cancel
-  cmakeFlags = "-DCMAKE_EXE_LINKER_FLAGS=-lgcc_s";
+  cmakeFlags = [ "-DCMAKE_EXE_LINKER_FLAGS=-lgcc_s" ];
 
   buildInputs = [ zlib SDL cmake ];
 
diff --git a/pkgs/misc/emulators/retroarch/cores.nix b/pkgs/misc/emulators/retroarch/cores.nix
index c8171f6c233..45ed31168f0 100644
--- a/pkgs/misc/emulators/retroarch/cores.nix
+++ b/pkgs/misc/emulators/retroarch/cores.nix
@@ -720,7 +720,7 @@ in with stdenv.lib.licenses;
     license = gpl2;
     extraBuildInputs = [ cmake libGLU libGL ffmpeg python37 xorg.libX11 ];
   }).override {
-    cmakeFlags = "-DLIBRETRO=ON";
+    cmakeFlags = [ "-DLIBRETRO=ON" ];
     makefile = "Makefile";
     buildPhase = ''
       make \
diff --git a/pkgs/misc/emulators/retroarch/default.nix b/pkgs/misc/emulators/retroarch/default.nix
index 34e3961250c..3f14258b0c0 100644
--- a/pkgs/misc/emulators/retroarch/default.nix
+++ b/pkgs/misc/emulators/retroarch/default.nix
@@ -39,11 +39,11 @@ in stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkgconfig ]
-                      ++ optional withVulkan [ makeWrapper ];
+                      ++ optional withVulkan makeWrapper;
 
   buildInputs = [ ffmpeg freetype libxml2 libGLU libGL python3 SDL2 which ]
                 ++ optional enableNvidiaCgToolkit nvidia_cg_toolkit
-                ++ optional withVulkan [ vulkan-loader ]
+                ++ optional withVulkan vulkan-loader
                 ++ optionals stdenv.isDarwin [ libobjc AppKit Foundation ]
                 ++ optionals stdenv.isLinux [ alsaLib libdrm libpulseaudio libv4l libX11
                                               libXdmcp libXext libXxf86vm mesa udev ];
diff --git a/pkgs/misc/emulators/wine/base.nix b/pkgs/misc/emulators/wine/base.nix
index 057615a79a1..0b6eab70263 100644
--- a/pkgs/misc/emulators/wine/base.nix
+++ b/pkgs/misc/emulators/wine/base.nix
@@ -71,12 +71,12 @@ stdenv.mkDerivation ((lib.optionalAttrs (buildScript != null) {
   # Wine locates a lot of libraries dynamically through dlopen().  Add
   # them to the RPATH so that the user doesn't have to set them in
   # LD_LIBRARY_PATH.
-  NIX_LDFLAGS = map (path: "-rpath " + path) (
+  NIX_LDFLAGS = toString (map (path: "-rpath " + path) (
       map (x: "${lib.getLib x}/lib") ([ stdenv.cc.cc ] ++ buildInputs)
       # libpulsecommon.so is linked but not found otherwise
       ++ lib.optionals supportFlags.pulseaudioSupport (map (x: "${lib.getLib x}/lib/pulseaudio")
           (toBuildInputs pkgArches (pkgs: [ pkgs.libpulseaudio ])))
-    );
+    ));
 
   # Don't shrink the ELF RPATHs in order to keep the extra RPATH
   # elements specified above.
diff --git a/pkgs/misc/ghostscript/default.nix b/pkgs/misc/ghostscript/default.nix
index 541fbea1dd4..37974e41080 100644
--- a/pkgs/misc/ghostscript/default.nix
+++ b/pkgs/misc/ghostscript/default.nix
@@ -76,15 +76,19 @@ stdenv.mkDerivation rec {
     sed "s@^ZLIBDIR=.*@ZLIBDIR=${zlib.dev}/include@" -i configure.ac
 
     autoconf
-  '' + lib.optionalString cupsSupport ''
-    configureFlags="$configureFlags --with-cups-serverbin=$out/lib/cups --with-cups-serverroot=$out/etc/cups --with-cups-datadir=$out/share/cups"
   '';
 
-  configureFlags =
-    [ "--with-system-libtiff"
-      "--enable-dynamic"
-    ] ++ lib.optional x11Support "--with-x"
-      ++ lib.optional cupsSupport "--enable-cups";
+  configureFlags = [
+    "--with-system-libtiff"
+    "--enable-dynamic"
+  ]
+  ++ lib.optional x11Support "--with-x"
+  ++ lib.optionals cupsSupport [
+    "--enable-cups"
+    "--with-cups-serverbin=$(out)/lib/cups"
+    "--with-cups-serverroot=$(out)/etc/cups"
+    "--with-cups-datadir=$(out)/share/cups"
+  ];
 
   doCheck = true;
 
diff --git a/pkgs/misc/screensavers/slock/default.nix b/pkgs/misc/screensavers/slock/default.nix
index f5e8b60cea0..9dadd085067 100644
--- a/pkgs/misc/screensavers/slock/default.nix
+++ b/pkgs/misc/screensavers/slock/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ xorgproto libX11 libXext libXrandr ];
 
-  installFlags = "DESTDIR=\${out} PREFIX=";
+  installFlags = [ "DESTDIR=\${out}" "PREFIX=" ];
 
   postPatch = "sed -i '/chmod u+s/d' Makefile";
 
diff --git a/pkgs/misc/screensavers/xautolock/default.nix b/pkgs/misc/screensavers/xautolock/default.nix
index 4d4e1c1fc41..cefcdbc75a3 100644
--- a/pkgs/misc/screensavers/xautolock/default.nix
+++ b/pkgs/misc/screensavers/xautolock/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     "MANPATH=$(out)/share/man"
   ];
 
-  installTargets = "install install.man";
+  installTargets = [ "install" "install.man" ];
 
   meta = with stdenv.lib; {
     description = "Launch a given program when your X session has been idle for a given time.";
diff --git a/pkgs/misc/uboot/default.nix b/pkgs/misc/uboot/default.nix
index 24e131b1272..06a5c7c441c 100644
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@@ -314,7 +314,7 @@ in {
     defconfig = "cm_fx6_defconfig";
     extraMeta.platforms = ["armv7l-linux"];
     filesToInstall = ["u-boot-with-nand-spl.imx"];
-    buildFlags = "u-boot-with-nand-spl.imx";
+    buildFlags = [ "u-boot-with-nand-spl.imx" ];
     extraConfig = ''
       CONFIG_CMD_SETEXPR=y
     '';
diff --git a/pkgs/os-specific/darwin/apple-sdk/default.nix b/pkgs/os-specific/darwin/apple-sdk/default.nix
index 8456d64a451..c3914777c6d 100644
--- a/pkgs/os-specific/darwin/apple-sdk/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk/default.nix
@@ -18,7 +18,6 @@ let
 
     buildInputs = [ xar cpio python pbzx ];
 
-    phases = [ "unpackPhase" "installPhase" "fixupPhase" ];
     outputs = [ "out" "dev" "man" ];
 
     unpackPhase = ''
@@ -52,7 +51,7 @@ let
   framework = name: deps: stdenv.mkDerivation {
     name = "apple-framework-${name}";
 
-    phases = [ "installPhase" "fixupPhase" ];
+    dontUnpack = true;
 
     # because we copy files from the system
     preferLocalBuild = true;
@@ -137,7 +136,7 @@ in rec {
   libs = {
     xpc = stdenv.mkDerivation {
       name   = "apple-lib-xpc";
-      phases = [ "installPhase" "fixupPhase" ];
+      dontUnpack = true;
 
       installPhase = ''
         mkdir -p $out/include
@@ -150,7 +149,7 @@ in rec {
 
     Xplugin = stdenv.mkDerivation {
       name   = "apple-lib-Xplugin";
-      phases = [ "installPhase" "fixupPhase" ];
+      dontUnpack = true;
 
       # Not enough
       __propagatedImpureHostDeps = [ "/usr/lib/libXplugin.1.dylib" ];
@@ -168,7 +167,7 @@ in rec {
 
     utmp = stdenv.mkDerivation {
       name   = "apple-lib-utmp";
-      phases = [ "installPhase" "fixupPhase" ];
+      dontUnpack = true;
 
       installPhase = ''
         mkdir -p $out/include
diff --git a/pkgs/os-specific/darwin/apple-source-releases/PowerManagement/default.nix b/pkgs/os-specific/darwin/apple-source-releases/PowerManagement/default.nix
index 2d5520b9bf9..5685d09e54f 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/PowerManagement/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/PowerManagement/default.nix
@@ -3,7 +3,7 @@
 appleDerivation {
   nativeBuildInputs = [ xcbuildHook ];
   buildInputs = [ IOKit ];
-  xcbuildFlags = "-target caffeinate";
+  xcbuildFlags = [ "-target" "caffeinate" ];
   installPhase = ''
     install -D Products/Deployment/caffeinate $out/bin/caffeinate
   '';
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Security/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Security/default.nix
index f335a6c1154..f1b5e19feb2 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Security/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/Security/default.nix
@@ -5,7 +5,7 @@ appleDerivation {
   # buildInputs = [ Foundation xpc darling ];
   buildInputs = [ xpc xnu ];
 
-  xcbuildFlags = "-target Security_frameworks_osx";
+  xcbuildFlags = [ "-target" "Security_frameworks_osx" ];
 
   # NIX_CFLAGS_COMPILE = "-Wno-error -I${xnu}/include/libkern -DPRIVATE -I${xnu}/Library/Frameworks/System.framework/Headers";
 
diff --git a/pkgs/os-specific/darwin/apple-source-releases/dtrace/default.nix b/pkgs/os-specific/darwin/apple-source-releases/dtrace/default.nix
index 8706d22be19..3e7e89642c2 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/dtrace/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/dtrace/default.nix
@@ -6,7 +6,7 @@ appleDerivation {
   buildInputs = [ CoreSymbolication darling xnu ];
   NIX_CFLAGS_COMPILE = "-DCTF_OLD_VERSIONS -DPRIVATE -DYYDEBUG=1 -I${xnu}/Library/Frameworks/System.framework/Headers -Wno-error=implicit-function-declaration";
   NIX_LDFLAGS = "-L./Products/Release";
-  xcbuildFlags = "-target dtrace_frameworks -target dtrace";
+  xcbuildFlags = [ "-target" "dtrace_frameworks" "-target" "dtrace" ];
 
   doCheck = false;
   checkPhase = "xcodebuild -target dtrace_tests";
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libutil/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libutil/default.nix
index 8bd45aa008b..2b196e46ef4 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libutil/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libutil/default.nix
@@ -11,7 +11,7 @@ appleDerivation {
       --replace '#include <xpc/xpc.h>' ""
   '';
 
-  xcbuildFlags = "-target util";
+  xcbuildFlags = [ "-target" "util" ];
 
   installPhase = ''
     mkdir -p $out/include
diff --git a/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix b/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
index aaa3a1ebe32..afa5dc1c08c 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
@@ -81,8 +81,8 @@ appleDerivation ({
     export DSTROOT=$out
   '';
 
-  buildFlags = lib.optionalString headersOnly "exporthdrs";
-  installTargets = lib.optionalString headersOnly "installhdrs";
+  buildFlags = lib.optional headersOnly "exporthdrs";
+  installTargets = lib.optional headersOnly "installhdrs";
 
   postInstall = lib.optionalString headersOnly ''
     mv $out/usr/include $out
diff --git a/pkgs/os-specific/darwin/libtapi/default.nix b/pkgs/os-specific/darwin/libtapi/default.nix
index cac2d97482a..2af1c5db2e3 100644
--- a/pkgs/os-specific/darwin/libtapi/default.nix
+++ b/pkgs/os-specific/darwin/libtapi/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
 
   cmakeFlags = [ "-DLLVM_INCLUDE_TESTS=OFF" ];
 
-  buildFlags = "libtapi";
+  buildFlags = [ "libtapi" ];
 
   installTarget = "install-libtapi";
 
diff --git a/pkgs/os-specific/darwin/reattach-to-user-namespace/default.nix b/pkgs/os-specific/darwin/reattach-to-user-namespace/default.nix
index 9f5f8aa4422..d4f20ede2ef 100644
--- a/pkgs/os-specific/darwin/reattach-to-user-namespace/default.nix
+++ b/pkgs/os-specific/darwin/reattach-to-user-namespace/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "00mjyj8yicrpnlm46rlbkvxgl5381l8xawh7rmjk10p3zrm56jbv";
   };
 
-  buildFlags = "ARCHES=x86_64";
+  buildFlags = [ "ARCHES=x86_64" ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/os-specific/linux/alsa-oss/default.nix b/pkgs/os-specific/linux/alsa-oss/default.nix
index d3e7dd5fa5d..77b351a1998 100644
--- a/pkgs/os-specific/linux/alsa-oss/default.nix
+++ b/pkgs/os-specific/linux/alsa-oss/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--disable-xmlto" ];
 
-  installFlags = "ASOUND_STATE_DIR=$(TMPDIR)/dummy";
+  installFlags = [ "ASOUND_STATE_DIR=$(TMPDIR)/dummy" ];
 
   meta = with stdenv.lib; {
     homepage = http://www.alsa-project.org/;
diff --git a/pkgs/os-specific/linux/alsa-utils/default.nix b/pkgs/os-specific/linux/alsa-utils/default.nix
index 8b1faf788e5..7b356746861 100644
--- a/pkgs/os-specific/linux/alsa-utils/default.nix
+++ b/pkgs/os-specific/linux/alsa-utils/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--disable-xmlto" "--with-udev-rules-dir=$(out)/lib/udev/rules.d" ];
 
-  installFlags = "ASOUND_STATE_DIR=$(TMPDIR)/dummy";
+  installFlags = [ "ASOUND_STATE_DIR=$(TMPDIR)/dummy" ];
 
   meta = with stdenv.lib; {
     homepage = http://www.alsa-project.org/;
diff --git a/pkgs/os-specific/linux/brillo/default.nix b/pkgs/os-specific/linux/brillo/default.nix
index 6d51907ea16..1262260664c 100644
--- a/pkgs/os-specific/linux/brillo/default.nix
+++ b/pkgs/os-specific/linux/brillo/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "PREFIX=$(out)" "AADIR=$(out)/etc/apparmor.d" ];
 
-  installTargets = "install-dist";
+  installTargets = [ "install-dist" ];
 
   meta = with stdenv.lib; {
     description = "Backlight and Keyboard LED control tool";
diff --git a/pkgs/os-specific/linux/broadcom-sta/default.nix b/pkgs/os-specific/linux/broadcom-sta/default.nix
index 93ac3fe5b74..e24171dfefe 100644
--- a/pkgs/os-specific/linux/broadcom-sta/default.nix
+++ b/pkgs/os-specific/linux/broadcom-sta/default.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation {
     ./gcc.patch
   ];
 
-  makeFlags = "KBASE=${kernel.dev}/lib/modules/${kernel.modDirVersion}";
+  makeFlags = [ "KBASE=${kernel.dev}/lib/modules/${kernel.modDirVersion}" ];
 
   unpackPhase = ''
     sourceRoot=broadcom-sta
diff --git a/pkgs/os-specific/linux/cifs-utils/default.nix b/pkgs/os-specific/linux/cifs-utils/default.nix
index ea6a6e77572..1ee7ece0537 100644
--- a/pkgs/os-specific/linux/cifs-utils/default.nix
+++ b/pkgs/os-specific/linux/cifs-utils/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ kerberos keyutils pam talloc ];
 
-  makeFlags = "root_sbindir=$(out)/sbin";
+  makeFlags = [ "root_sbindir=$(out)/sbin" ];
 
   meta = with stdenv.lib; {
     homepage = http://www.samba.org/linux-cifs/cifs-utils/;
diff --git a/pkgs/os-specific/linux/consoletools/default.nix b/pkgs/os-specific/linux/consoletools/default.nix
index 8ea3e3445cc..c46af5fba85 100644
--- a/pkgs/os-specific/linux/consoletools/default.nix
+++ b/pkgs/os-specific/linux/consoletools/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "DESTDIR=$(out)"];
 
-  installFlags = ''PREFIX=""'';
+  installFlags = [ "PREFIX=\"\"" ];
 
   meta = with stdenv.lib; {
     homepage = https://sourceforge.net/projects/linuxconsole/;
diff --git a/pkgs/os-specific/linux/dmidecode/default.nix b/pkgs/os-specific/linux/dmidecode/default.nix
index a4ec902f762..55dcba378ca 100644
--- a/pkgs/os-specific/linux/dmidecode/default.nix
+++ b/pkgs/os-specific/linux/dmidecode/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "1pcfhcgs2ifdjwp7amnsr3lq95pgxpr150bjhdinvl505px0cw07";
   };
 
-  makeFlags = "prefix=$(out)";
+  makeFlags = [ "prefix=$(out)" ];
 
   meta = with stdenv.lib; {
     homepage = https://www.nongnu.org/dmidecode/;
diff --git a/pkgs/os-specific/linux/drbd/default.nix b/pkgs/os-specific/linux/drbd/default.nix
index 0e35f45f042..74f3430c2d8 100644
--- a/pkgs/os-specific/linux/drbd/default.nix
+++ b/pkgs/os-specific/linux/drbd/default.nix
@@ -31,9 +31,13 @@ stdenv.mkDerivation rec {
       substituteInPlace scripts/drbd.rules --replace /usr/sbin/drbdadm $out/sbin/drbdadm
     '';
 
-  makeFlags = "SHELL=${stdenv.shell}";
+  makeFlags = [ "SHELL=${stdenv.shell}" ];
 
-  installFlags = "localstatedir=$(TMPDIR)/var sysconfdir=$(out)/etc INITDIR=$(out)/etc/init.d";
+  installFlags = [
+    "localstatedir=$(TMPDIR)/var"
+    "sysconfdir=$(out)/etc"
+    "INITDIR=$(out)/etc/init.d"
+  ];
 
   meta = with stdenv.lib; {
     homepage = http://www.drbd.org/;
diff --git a/pkgs/os-specific/linux/dropwatch/default.nix b/pkgs/os-specific/linux/dropwatch/default.nix
index 061dce04860..69acfa9682b 100644
--- a/pkgs/os-specific/linux/dropwatch/default.nix
+++ b/pkgs/os-specific/linux/dropwatch/default.nix
@@ -16,10 +16,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ libbfd libnl ncurses readline zlib ];
 
   # To avoid running into https://sourceware.org/bugzilla/show_bug.cgi?id=14243 we need to define:
-  NIX_CFLAGS_COMPILE = [
-    "-DPACKAGE=${pname}"
-    "-DPACKAGE_VERSION=${version}"
-  ];
+  NIX_CFLAGS_COMPILE = "-DPACKAGE=${pname} -DPACKAGE_VERSION=${version}";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/os-specific/linux/extrace/default.nix b/pkgs/os-specific/linux/extrace/default.nix
index 6aaaaec1b13..0d00eaa3ac8 100644
--- a/pkgs/os-specific/linux/extrace/default.nix
+++ b/pkgs/os-specific/linux/extrace/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "0acspj3djspfvgr3ng5b61qws6v2md6b0lc5qkby10mqnfpkvq85";
   };
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   postInstall = ''
     install -dm755 "$out/share/licenses/extrace/"
diff --git a/pkgs/os-specific/linux/firmware/fwupdate/default.nix b/pkgs/os-specific/linux/firmware/fwupdate/default.nix
index 70a0bdbe240..c14e04dc344 100644
--- a/pkgs/os-specific/linux/firmware/fwupdate/default.nix
+++ b/pkgs/os-specific/linux/firmware/fwupdate/default.nix
@@ -13,7 +13,7 @@ in stdenv.mkDerivation {
     ./do-not-create-sharedstatedir.patch
   ];
 
-  NIX_CFLAGS_COMPILE = [ "-I${gnu-efi}/include/efi" ];
+  NIX_CFLAGS_COMPILE = "-I${gnu-efi}/include/efi -Wno-error=address-of-packed-member";
 
   # TODO: Just apply the disable to the efi subdir
   hardeningDisable = [ "stackprotector" ];
diff --git a/pkgs/os-specific/linux/jool/cli.nix b/pkgs/os-specific/linux/jool/cli.nix
index fe5436625e8..58b1b53d52f 100644
--- a/pkgs/os-specific/linux/jool/cli.nix
+++ b/pkgs/os-specific/linux/jool/cli.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
   buildInputs = [ libnl iptables ];
 
-  makeFlags = "-C src/usr";
+  makeFlags = [ "-C" "src/usr" ];
 
   prePatch = ''
     sed -e 's%^XTABLES_SO_DIR = .*%XTABLES_SO_DIR = '"$out"'/lib/xtables%g' -i src/usr/iptables/Makefile
diff --git a/pkgs/os-specific/linux/kernel/perf.nix b/pkgs/os-specific/linux/kernel/perf.nix
index 37b728bde88..9f32e3e37dd 100644
--- a/pkgs/os-specific/linux/kernel/perf.nix
+++ b/pkgs/os-specific/linux/kernel/perf.nix
@@ -46,22 +46,19 @@ stdenv.mkDerivation {
 
   # Note: we don't add elfutils to buildInputs, since it provides a
   # bad `ld' and other stuff.
-  NIX_CFLAGS_COMPILE =
-    [ "-Wno-error=cpp"
-      "-Wno-error=bool-compare"
-      "-Wno-error=deprecated-declarations"
-      "-DOBJDUMP_PATH=\"${binutils}/bin/objdump\""
-    ]
-    # gcc before 6 doesn't know these options
-    ++ stdenv.lib.optionals (hasPrefix "gcc-6" stdenv.cc.cc.name) [
-      "-Wno-error=unused-const-variable" "-Wno-error=misleading-indentation"
-    ];
+  NIX_CFLAGS_COMPILE = toString [
+    "-Wno-error=cpp"
+    "-Wno-error=bool-compare"
+    "-Wno-error=deprecated-declarations"
+    "-DOBJDUMP_PATH=\"${binutils}/bin/objdump\""
+    "-Wno-error=stringop-truncation"
+  ];
 
   doCheck = false; # requires "sparse"
   doInstallCheck = false; # same
 
   separateDebugInfo = true;
-  installFlags = "install install-man ASCIIDOC8=1 prefix=$(out)";
+  installFlags = [ "install" "install-man" "ASCIIDOC8=1" "prefix=$(out)" ];
 
   preFixup = ''
     wrapProgram $out/bin/perf \
diff --git a/pkgs/os-specific/linux/ldm/default.nix b/pkgs/os-specific/linux/ldm/default.nix
index 96bb91175dc..ce76e31a920 100644
--- a/pkgs/os-specific/linux/ldm/default.nix
+++ b/pkgs/os-specific/linux/ldm/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     sed '16i#include <sys/stat.h>' -i ldm.c
   '';
 
-  buildFlags = "ldm";
+  buildFlags = [ "ldm" ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/os-specific/linux/libaio/default.nix b/pkgs/os-specific/linux/libaio/default.nix
index 090bf6a566a..792568e8b57 100644
--- a/pkgs/os-specific/linux/libaio/default.nix
+++ b/pkgs/os-specific/linux/libaio/default.nix
@@ -22,7 +22,9 @@ stdenv.mkDerivation rec {
       --replace "-Werror" ""
   '';
 
-  makeFlags = "prefix=$(out)";
+  makeFlags = [
+    "prefix=${placeholder ''out''}"
+  ];
 
   hardeningDisable = stdenv.lib.optional (stdenv.isi686) "stackprotector";
 
diff --git a/pkgs/os-specific/linux/libcap/default.nix b/pkgs/os-specific/linux/libcap/default.nix
index 9c730bb9659..174f1be99db 100644
--- a/pkgs/os-specific/linux/libcap/default.nix
+++ b/pkgs/os-specific/linux/libcap/default.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
       --replace 'man_prefix=$(prefix)' "man_prefix=$doc"
   '';
 
-  installFlags = "RAISE_SETFCAP=no";
+  installFlags = [ "RAISE_SETFCAP=no" ];
 
   postInstall = ''
     rm "$lib"/lib/*.a
diff --git a/pkgs/os-specific/linux/libselinux/default.nix b/pkgs/os-specific/linux/libselinux/default.nix
index d8a2298f3d3..39e97f8473c 100644
--- a/pkgs/os-specific/linux/libselinux/default.nix
+++ b/pkgs/os-specific/linux/libselinux/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   # command-line>:0:0: error: "_FORTIFY_SOURCE" redefined [-Werror]
   hardeningDisable = [ "fortify" ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error" ];
+  NIX_CFLAGS_COMPILE = "-Wno-error";
 
   makeFlags = [
     "PREFIX=$(out)"
diff --git a/pkgs/os-specific/linux/libsepol/default.nix b/pkgs/os-specific/linux/libsepol/default.nix
index 03bd0252c5c..b31554d6cee 100644
--- a/pkgs/os-specific/linux/libsepol/default.nix
+++ b/pkgs/os-specific/linux/libsepol/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     "SHLIBDIR=$(out)/lib"
   ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error" ];
+  NIX_CFLAGS_COMPILE = "-Wno-error";
 
   passthru = { inherit se_release se_url; };
 
diff --git a/pkgs/os-specific/linux/lttng-modules/default.nix b/pkgs/os-specific/linux/lttng-modules/default.nix
index d4b3f374c5b..46c8dec8889 100644
--- a/pkgs/os-specific/linux/lttng-modules/default.nix
+++ b/pkgs/os-specific/linux/lttng-modules/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "pic" ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=implicit-function-declaration" ];
+  NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
 
   preConfigure = ''
     export KERNELDIR="${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
diff --git a/pkgs/os-specific/linux/lvm2/default.nix b/pkgs/os-specific/linux/lvm2/default.nix
index 9c48caaa243..7eac8fad64c 100644
--- a/pkgs/os-specific/linux/lvm2/default.nix
+++ b/pkgs/os-specific/linux/lvm2/default.nix
@@ -65,7 +65,7 @@ stdenv.mkDerivation {
   doCheck = false; # requires root
 
   # To prevent make install from failing.
-  preInstall = "installFlags=\"OWNER= GROUP= confdir=$out/etc\"";
+  installFlags = [ "OWNER=" "GROUP=" "confdir=$(out)/etc" ];
 
   # Install systemd stuff.
   #installTargets = "install install_systemd_generators install_systemd_units install_tmpfiles_configuration";
diff --git a/pkgs/os-specific/linux/mmc-utils/default.nix b/pkgs/os-specific/linux/mmc-utils/default.nix
index 297faa2a604..16c73377cb4 100644
--- a/pkgs/os-specific/linux/mmc-utils/default.nix
+++ b/pkgs/os-specific/linux/mmc-utils/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
     sha256 = "1mak9rqjp6yvqk2h5hfil5a9gfx138h62n3cryckfbhr6fmaylm7";
   };
 
-  makeFlags = "CC=${stdenv.cc.targetPrefix}cc";
+  makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
 
   installPhase = ''
     make install prefix=$out
diff --git a/pkgs/os-specific/linux/mstpd/default.nix b/pkgs/os-specific/linux/mstpd/default.nix
index 492a9321a21..4a7c6282d4c 100644
--- a/pkgs/os-specific/linux/mstpd/default.nix
+++ b/pkgs/os-specific/linux/mstpd/default.nix
@@ -1,16 +1,24 @@
-{ stdenv, fetchFromGitHub, autoreconfHook }:
+{ stdenv, fetchFromGitHub, fetchpatch, autoreconfHook }:
 
 stdenv.mkDerivation rec {
   pname = "mstpd";
-  version = "0.0.7";
+  version = "0.0.8";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "01majib6d1rixngf8c8vcrj1akf8nsqpxhdfdxxi2xwg23vx8f1a";
+    sha256 = "1xkfydxljdnj49p5r3mirk4k146428b6imfc9bkfps9yjn64mkgb";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "fix-strncpy-gcc9.patch";
+      url = "https://github.com/mstpd/mstpd/commit/d27d7e93485d881d8ff3a7f85309b545edbe1fc6.patch";
+      sha256 = "19456daih8l3y6m9kphjr7pj7slrqzbj6yacnlgznpxyd8y4d86y";
+    })
+  ];
+
   nativeBuildInputs = [ autoreconfHook ];
 
   configureFlags = [
diff --git a/pkgs/os-specific/linux/numad/default.nix b/pkgs/os-specific/linux/numad/default.nix
index ed84c41001b..0d5dd118798 100644
--- a/pkgs/os-specific/linux/numad/default.nix
+++ b/pkgs/os-specific/linux/numad/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     substituteInPlace Makefile --replace "install -m" "install -Dm"
   '';
 
-  makeFlags = "prefix=$(out)";
+  makeFlags = [ "prefix=$(out)" ];
 
   meta = with stdenv.lib; {
     description = "A user-level daemon that monitors NUMA topology and processes resource consumption to facilitate good NUMA resource access";
diff --git a/pkgs/os-specific/linux/nvme-cli/default.nix b/pkgs/os-specific/linux/nvme-cli/default.nix
index 76257f94fe7..cb7f3c9510c 100644
--- a/pkgs/os-specific/linux/nvme-cli/default.nix
+++ b/pkgs/os-specific/linux/nvme-cli/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   # To omit the hostnqn and hostid files that are impure and should be unique
   # for each target host:
-  installTargets = "install-spec";
+  installTargets = [ "install-spec" ];
 
   meta = with lib; {
     inherit (src.meta) homepage;
diff --git a/pkgs/os-specific/linux/open-isns/default.nix b/pkgs/os-specific/linux/open-isns/default.nix
index 7b34c1029ba..6a0273afbdd 100644
--- a/pkgs/os-specific/linux/open-isns/default.nix
+++ b/pkgs/os-specific/linux/open-isns/default.nix
@@ -17,8 +17,8 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--enable-shared" ];
 
-  installFlags = "etcdir=$(out)/etc vardir=$(out)/var/lib/isns";
-  installTargets = "install install_hdrs install_lib";
+  installFlags = [ "etcdir=$(out)/etc" "vardir=$(out)/var/lib/isns" ];
+  installTargets = [ "install" "install_hdrs" "install_lib" ];
 
   meta = {
     description = "iSNS server and client for Linux";
diff --git a/pkgs/os-specific/linux/pam_mount/default.nix b/pkgs/os-specific/linux/pam_mount/default.nix
index 29ed9375c2e..4bda93baddc 100644
--- a/pkgs/os-specific/linux/pam_mount/default.nix
+++ b/pkgs/os-specific/linux/pam_mount/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     sh autogen.sh --prefix=$out
     '';
 
-  makeFlags = "DESTDIR=$(out)";
+  makeFlags = [ "DESTDIR=$(out)" ];
 
   # Probably a hack, but using DESTDIR and PREFIX makes everything work!
   postInstall = ''
diff --git a/pkgs/os-specific/linux/paxtest/default.nix b/pkgs/os-specific/linux/paxtest/default.nix
index e01f84576ce..6bd59e1e7fd 100644
--- a/pkgs/os-specific/linux/paxtest/default.nix
+++ b/pkgs/os-specific/linux/paxtest/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   makefile     = "Makefile.psm";
   makeFlags    = [ "PAXBIN=${paxctl}/bin/paxctl" "BINDIR=$(out)/bin" "RUNDIR=$(out)/lib/paxtest" ];
-  installFlags = ''DESTDIR=""'';
+  installFlags = [ "DESTDIR=\"\"" ];
 
   meta = with stdenv.lib; {
     description = "Test various memory protection measures";
diff --git a/pkgs/os-specific/linux/pcmciautils/default.nix b/pkgs/os-specific/linux/pcmciautils/default.nix
index aeb4d78d0ec..75c32577a00 100644
--- a/pkgs/os-specific/linux/pcmciautils/default.nix
+++ b/pkgs/os-specific/linux/pcmciautils/default.nix
@@ -31,8 +31,8 @@ stdenv.mkDerivation rec {
     ln -sf ${configOpts} ./config/config.opts'')
   ;
 
-  makeFlags = "LEX=flex";
-  installFlags = ''INSTALL=install DESTDIR=''${out}'';
+  makeFlags = [ "LEX=flex" ];
+  installFlags = [ "INSTALL=install" "DESTDIR=${placeholder "out"}" ];
   postInstall =
     lib.concatMapStrings (path: ''
       for f in : $(find ${path} -type f); do
diff --git a/pkgs/os-specific/linux/pktgen/default.nix b/pkgs/os-specific/linux/pktgen/default.nix
index 171e5d3b43a..3312f230247 100644
--- a/pkgs/os-specific/linux/pktgen/default.nix
+++ b/pkgs/os-specific/linux/pktgen/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   RTE_SDK = dpdk;
   GUI = stdenv.lib.optionalString withGtk "true";
 
-  NIX_CFLAGS_COMPILE = [ "-msse3" ];
+  NIX_CFLAGS_COMPILE = "-msse3";
 
   patches = [ ./configure.patch ];
 
diff --git a/pkgs/os-specific/linux/procps-ng/default.nix b/pkgs/os-specific/linux/procps-ng/default.nix
index 1f39a99ea0b..62a6b645c2c 100644
--- a/pkgs/os-specific/linux/procps-ng/default.nix
+++ b/pkgs/os-specific/linux/procps-ng/default.nix
@@ -14,12 +14,12 @@
 
 stdenv.mkDerivation rec {
   pname = "procps";
-  version = "3.3.15";
+  version = "3.3.16";
 
   # The project's releases are on SF, but git repo on gitlab.
   src = fetchurl {
     url = "mirror://sourceforge/procps-ng/procps-ng-${version}.tar.xz";
-    sha256 = "0r84kwa5fl0sjdashcn4vh7hgfm7ahdcysig3mcjvpmkzi7p9g8h";
+    sha256 = "1br0g93ysqhlv13i1k4lfbimsgxnpy5rgs4lxfc9rkzdbpbaqplj";
   };
 
   buildInputs = [ ncurses ]
diff --git a/pkgs/os-specific/linux/rdma-core/default.nix b/pkgs/os-specific/linux/rdma-core/default.nix
index 2162db25c86..b16b230ce27 100644
--- a/pkgs/os-specific/linux/rdma-core/default.nix
+++ b/pkgs/os-specific/linux/rdma-core/default.nix
@@ -4,7 +4,7 @@
 } :
 
 let
-  version = "26.1";
+  version = "27.0";
 
 in stdenv.mkDerivation {
   pname = "rdma-core";
@@ -14,7 +14,7 @@ in stdenv.mkDerivation {
     owner = "linux-rdma";
     repo = "rdma-core";
     rev = "v${version}";
-    sha256 = "1zb1y70ff8yy7rdl4gh2jx1gpja5hrbsh8gfi9fsxkz2rv1234r0";
+    sha256 = "04mhcrcmbwxcjhswlkhnr6m5nl2389jgjv6aqhd4v0x555cwnfvw";
   };
 
   nativeBuildInputs = [ cmake pkgconfig pandoc docutils makeWrapper ];
diff --git a/pkgs/os-specific/linux/rfkill/default.nix b/pkgs/os-specific/linux/rfkill/default.nix
index 6b6bef29cc3..80b5ce01243 100644
--- a/pkgs/os-specific/linux/rfkill/default.nix
+++ b/pkgs/os-specific/linux/rfkill/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "01zs7p9kd92pxgcgwl5w46h3iyx4acfg6m1j5fgnflsaa350q5iy";
   };
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with stdenv.lib; {
     homepage = http://wireless.kernel.org/en/users/Documentation/rfkill;
diff --git a/pkgs/os-specific/linux/rtkit/default.nix b/pkgs/os-specific/linux/rtkit/default.nix
index 78bcd925aea..4ad454437f5 100644
--- a/pkgs/os-specific/linux/rtkit/default.nix
+++ b/pkgs/os-specific/linux/rtkit/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ dbus libcap ];
-  NIX_LDFLAGS = [ "-lrt" ];
+  NIX_LDFLAGS = "-lrt";
 
   meta = with stdenv.lib; {
     homepage = http://0pointer.de/blog/projects/rtkit;
diff --git a/pkgs/os-specific/linux/rtl8192eu/default.nix b/pkgs/os-specific/linux/rtl8192eu/default.nix
index 57544659e86..f24921c7ce6 100644
--- a/pkgs/os-specific/linux/rtl8192eu/default.nix
+++ b/pkgs/os-specific/linux/rtl8192eu/default.nix
@@ -19,7 +19,7 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
-  makeFlags = "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
+  makeFlags = [ "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/os-specific/linux/rtl8723bs/default.nix b/pkgs/os-specific/linux/rtl8723bs/default.nix
index b1e01f705dc..f468196dc73 100644
--- a/pkgs/os-specific/linux/rtl8723bs/default.nix
+++ b/pkgs/os-specific/linux/rtl8723bs/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ nukeReferences ];
 
-  makeFlags = concatStringsSep " " [
+  makeFlags = [
     "ARCH=${stdenv.hostPlatform.platform.kernelArch}" # Normally not needed, but the Makefile sets ARCH in a broken way.
     "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" # Makefile uses $(uname -r); breaks us.
   ];
diff --git a/pkgs/os-specific/linux/rtlwifi_new/default.nix b/pkgs/os-specific/linux/rtlwifi_new/default.nix
index 94ba31d59e1..403f0a40010 100644
--- a/pkgs/os-specific/linux/rtlwifi_new/default.nix
+++ b/pkgs/os-specific/linux/rtlwifi_new/default.nix
@@ -19,7 +19,7 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
-  makeFlags = "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
+  makeFlags = [ "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/os-specific/linux/sysdig/default.nix b/pkgs/os-specific/linux/sysdig/default.nix
index 0d85e6e3a57..61a51afa3a7 100644
--- a/pkgs/os-specific/linux/sysdig/default.nix
+++ b/pkgs/os-specific/linux/sysdig/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake perl ];
   buildInputs = [
     zlib luajit ncurses jsoncpp libb64 openssl curl jq gcc elfutils tbb c-ares protobuf grpc
-  ] ++ optional (kernel != null) kernel.moduleBuildDependencies;
+  ] ++ optionals (kernel != null) kernel.moduleBuildDependencies;
 
   hardeningDisable = [ "pic" ];
 
@@ -28,10 +28,7 @@ stdenv.mkDerivation rec {
   ] ++ optional (kernel == null) "-DBUILD_DRIVER=OFF";
 
   # needed since luajit-2.1.0-beta3
-  NIX_CFLAGS_COMPILE = [
-    "-DluaL_reg=luaL_Reg"
-    "-DluaL_getn(L,i)=((int)lua_objlen(L,i))"
-  ];
+  NIX_CFLAGS_COMPILE = "-DluaL_reg=luaL_Reg -DluaL_getn(L,i)=((int)lua_objlen(L,i))";
 
   preConfigure = ''
     cmakeFlagsArray+=(-DCMAKE_EXE_LINKER_FLAGS="-ltbb -lcurl")
diff --git a/pkgs/os-specific/linux/sysklogd/default.nix b/pkgs/os-specific/linux/sysklogd/default.nix
index 513503ff98e..213394e5ecc 100644
--- a/pkgs/os-specific/linux/sysklogd/default.nix
+++ b/pkgs/os-specific/linux/sysklogd/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
 
   NIX_CFLAGS_COMPILE = "-DSYSV";
 
-  installFlags = "BINDIR=$(out)/sbin MANDIR=$(out)/share/man INSTALL=install";
+  installFlags = [ "BINDIR=$(out)/sbin" "MANDIR=$(out)/share/man" "INSTALL=install" ];
 
   preConfigure =
     ''
diff --git a/pkgs/os-specific/linux/sysstat/default.nix b/pkgs/os-specific/linux/sysstat/default.nix
index ba6aff4e8bc..2ad7b21d451 100644
--- a/pkgs/os-specific/linux/sysstat/default.nix
+++ b/pkgs/os-specific/linux/sysstat/default.nix
@@ -17,8 +17,8 @@ stdenv.mkDerivation rec {
     export SYSTEMCTL=systemctl
   '';
 
-  makeFlags = "SYSCONFIG_DIR=$(out)/etc IGNORE_FILE_ATTRIBUTES=y CHOWN=true";
-  installTargets = "install_base install_nls install_man";
+  makeFlags = [ "SYSCONFIG_DIR=$(out)/etc" "IGNORE_FILE_ATTRIBUTES=y" "CHOWN=true" ];
+  installTargets = [ "install_base" "install_nls" "install_man" ];
 
   patches = [ ./install.patch ];
 
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 3cc976a909d..3462801c07c 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -180,18 +180,18 @@ in stdenv.mkDerivation {
       --replace "SYSTEMD_CGROUP_AGENT_PATH" "_SYSTEMD_CGROUP_AGENT_PATH"
   '';
 
-  NIX_CFLAGS_COMPILE =
-    [ # Can't say ${polkit.bin}/bin/pkttyagent here because that would
-      # lead to a cyclic dependency.
-      "-UPOLKIT_AGENT_BINARY_PATH" "-DPOLKIT_AGENT_BINARY_PATH=\"/run/current-system/sw/bin/pkttyagent\""
+  NIX_CFLAGS_COMPILE = toString [
+    # Can't say ${polkit.bin}/bin/pkttyagent here because that would
+    # lead to a cyclic dependency.
+    "-UPOLKIT_AGENT_BINARY_PATH" "-DPOLKIT_AGENT_BINARY_PATH=\"/run/current-system/sw/bin/pkttyagent\""
 
-      # Set the release_agent on /sys/fs/cgroup/systemd to the
-      # currently running systemd (/run/current-system/systemd) so
-      # that we don't use an obsolete/garbage-collected release agent.
-      "-USYSTEMD_CGROUP_AGENT_PATH" "-DSYSTEMD_CGROUP_AGENT_PATH=\"/run/current-system/systemd/lib/systemd/systemd-cgroups-agent\""
+    # Set the release_agent on /sys/fs/cgroup/systemd to the
+    # currently running systemd (/run/current-system/systemd) so
+    # that we don't use an obsolete/garbage-collected release agent.
+    "-USYSTEMD_CGROUP_AGENT_PATH" "-DSYSTEMD_CGROUP_AGENT_PATH=\"/run/current-system/systemd/lib/systemd/systemd-cgroups-agent\""
 
-      "-USYSTEMD_BINARY_PATH" "-DSYSTEMD_BINARY_PATH=\"/run/current-system/systemd/lib/systemd/systemd\""
-    ];
+    "-USYSTEMD_BINARY_PATH" "-DSYSTEMD_BINARY_PATH=\"/run/current-system/systemd/lib/systemd/systemd\""
+  ];
 
   doCheck = false; # fails a bunch of tests
 
diff --git a/pkgs/os-specific/linux/tiptop/default.nix b/pkgs/os-specific/linux/tiptop/default.nix
index 47b89f138c5..bfcf58a3530 100644
--- a/pkgs/os-specific/linux/tiptop/default.nix
+++ b/pkgs/os-specific/linux/tiptop/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ flex bison ];
   buildInputs = [ libxml2 ncurses ];
 
-  NIX_CFLAGS_COMPILE = [ "-I${libxml2.dev}/include/libxml2" ];
+  NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
 
   meta = with stdenv.lib; {
     description = "Performance monitoring tool for Linux";
diff --git a/pkgs/os-specific/linux/untie/default.nix b/pkgs/os-specific/linux/untie/default.nix
index d4f83eb8caf..9ca1c37e11b 100644
--- a/pkgs/os-specific/linux/untie/default.nix
+++ b/pkgs/os-specific/linux/untie/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "1334ngvbi4arcch462mzi5vxvxck4sy1nf0m58116d9xmx83ak0m";
   };
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with stdenv.lib; {
     description = "A tool to run processes untied from some of the namespaces";
diff --git a/pkgs/os-specific/linux/usbip/default.nix b/pkgs/os-specific/linux/usbip/default.nix
index 61f2c454046..f927eaefb4e 100644
--- a/pkgs/os-specific/linux/usbip/default.nix
+++ b/pkgs/os-specific/linux/usbip/default.nix
@@ -1,18 +1,22 @@
-{ stdenv, kernel, udev, autoconf, automake, libtool }:
+{ lib, stdenv, kernel, udev, autoconf, automake, libtool }:
 
 stdenv.mkDerivation {
   name = "usbip-${kernel.name}";
 
   src = kernel.src;
 
-  patches = [
+  patches = lib.optionals (lib.versionAtLeast "5.4" kernel.version) [
     # fixes build with gcc8
     ./fix-snprintf-truncation.patch
+    # fixes build with gcc9
+    ./fix-strncpy-truncation.patch
   ];
 
   nativeBuildInputs = [ autoconf automake libtool ];
   buildInputs = [ udev ];
 
+  NIX_CFLAGS_COMPILE = [ "-Wno-error=address-of-packed-member" ];
+
   preConfigure = ''
     cd tools/usb/usbip
     ./autogen.sh
diff --git a/pkgs/os-specific/linux/usbip/fix-strncpy-truncation.patch b/pkgs/os-specific/linux/usbip/fix-strncpy-truncation.patch
new file mode 100644
index 00000000000..a5c4c97bbc0
--- /dev/null
+++ b/pkgs/os-specific/linux/usbip/fix-strncpy-truncation.patch
@@ -0,0 +1,37 @@
+diff --git a/tools/usb/usbip/libsrc/usbip_common.c b/tools/usb/usbip/libsrc/usbip_common.c
+index bb424638d75b..2fc5837e609a 100644
+--- a/tools/usb/usbip/libsrc/usbip_common.c
++++ b/tools/usb/usbip/libsrc/usbip_common.c
+@@ -226,8 +226,8 @@ int read_usb_device(struct udev_device *sdev, struct usbip_usb_device *udev)
+ 	path = udev_device_get_syspath(sdev);
+ 	name = udev_device_get_sysname(sdev);
+ 
+-	strncpy(udev->path,  path,  SYSFS_PATH_MAX);
+-	strncpy(udev->busid, name, SYSFS_BUS_ID_SIZE);
++	strncpy(udev->path,  path,  SYSFS_PATH_MAX-1);
++	strncpy(udev->busid, name, SYSFS_BUS_ID_SIZE-1);
+ 
+ 	sscanf(name, "%u-%u", &busnum, &devnum);
+ 	udev->busnum = busnum;
+diff --git a/tools/usb/usbip/libsrc/usbip_device_driver.c b/tools/usb/usbip/libsrc/usbip_device_driver.c
+index 5a3726eb44ab..95b416af8b99 100644
+--- a/tools/usb/usbip/libsrc/usbip_device_driver.c
++++ b/tools/usb/usbip/libsrc/usbip_device_driver.c
+@@ -91,7 +91,7 @@ int read_usb_vudc_device(struct udev_device *sdev, struct usbip_usb_device *dev)
+ 	copy_descr_attr16(dev, &descr, idProduct);
+ 	copy_descr_attr16(dev, &descr, bcdDevice);
+ 
+-	strncpy(dev->path, path, SYSFS_PATH_MAX);
++	strncpy(dev->path, path, SYSFS_PATH_MAX-1);
+ 
+ 	dev->speed = USB_SPEED_UNKNOWN;
+ 	speed = udev_device_get_sysattr_value(sdev, "current_speed");
+@@ -110,7 +110,7 @@ int read_usb_vudc_device(struct udev_device *sdev, struct usbip_usb_device *dev)
+ 	dev->busnum = 0;
+ 
+ 	name = udev_device_get_sysname(plat);
+-	strncpy(dev->busid, name, SYSFS_BUS_ID_SIZE);
++	strncpy(dev->busid, name, SYSFS_BUS_ID_SIZE-1);
+ 	return 0;
+ err:
+ 	fclose(fd);
diff --git a/pkgs/os-specific/linux/usermount/default.nix b/pkgs/os-specific/linux/usermount/default.nix
index 5cb49485c5b..ec58d513b09 100644
--- a/pkgs/os-specific/linux/usermount/default.nix
+++ b/pkgs/os-specific/linux/usermount/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ dbus libnotify udisks2 gdk-pixbuf ];
 
-  NIX_CFLAGS_COMPILE = [ "-DENABLE_NOTIFICATIONS" ];
+  NIX_CFLAGS_COMPILE = "-DENABLE_NOTIFICATIONS";
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/os-specific/windows/jom/default.nix b/pkgs/os-specific/windows/jom/default.nix
index ee8f0079075..0ddec9282e6 100644
--- a/pkgs/os-specific/windows/jom/default.nix
+++ b/pkgs/os-specific/windows/jom/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
 
   QTDIR = qt48;
 
-  # cmakeFlags = "-DWIN32=1 -DCMAKE_SYSTEM_NAME=Windows -DCMAKE_RC_COMPILER=${stdenv.cc.targetPrefix}windres";
+  # cmakeFlags = [ "-DWIN32=1" "-DCMAKE_SYSTEM_NAME=Windows" "-DCMAKE_RC_COMPILER=${stdenv.cc.targetPrefix}windres" ];
 
   preBuild = stdenv.lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
     export NIX_CROSS_CFLAGS_COMPILE=-fpermissive
diff --git a/pkgs/servers/amqp/qpid-cpp/default.nix b/pkgs/servers/amqp/qpid-cpp/default.nix
index 086256cf093..02c2e03d90f 100644
--- a/pkgs/servers/amqp/qpid-cpp/default.nix
+++ b/pkgs/servers/amqp/qpid-cpp/default.nix
@@ -2,11 +2,11 @@
 
 let
   name = "qpid-cpp-${version}";
-  version = "1.38.0";
+  version = "1.39.0";
 
   src = fetchurl {
     url = "mirror://apache/qpid/cpp/${version}/${name}.tar.gz";
-    sha256 = "1q7nsl9g8xv81ymhpkdp9mlw3gkzba62gggp3b72f0ywpc3kc3cz";
+    sha256 = "088dx1l6myrksbhpr15bs09j6qm8vdliqwjp2ja5amym47md103r";
   };
 
   meta = with stdenv.lib; {
@@ -33,14 +33,16 @@ let
       sed -i '/management/d' CMakeLists.txt
     '';
 
-    NIX_CFLAGS_COMPILE = [
+    NIX_CFLAGS_COMPILE = toString ([
       "-Wno-error=deprecated-declarations"
       "-Wno-error=int-in-bool-context"
       "-Wno-error=maybe-uninitialized"
       "-Wno-error=unused-function"
       "-Wno-error=ignored-qualifiers"
       "-Wno-error=catch-value"
-    ];
+    ] ++ stdenv.lib.optionals stdenv.cc.isGNU [
+      "-Wno-error=deprecated-copy"
+    ]);
   };
 
   python-frontend = buildPythonPackage {
diff --git a/pkgs/servers/amqp/rabbitmq-server/default.nix b/pkgs/servers/amqp/rabbitmq-server/default.nix
index a25bf48f8dd..f1838f2a2cb 100644
--- a/pkgs/servers/amqp/rabbitmq-server/default.nix
+++ b/pkgs/servers/amqp/rabbitmq-server/default.nix
@@ -20,8 +20,8 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "man" "doc" ];
 
-  installFlags = "PREFIX=$(out) RMQ_ERLAPP_DIR=$(out)";
-  installTargets = "install install-man";
+  installFlags = [ "PREFIX=$(out)" "RMQ_ERLAPP_DIR=$(out)" ];
+  installTargets = [ "install" "install-man" ];
 
   runtimePath = stdenv.lib.makeBinPath [getconf erlang socat];
   postInstall = ''
diff --git a/pkgs/servers/computing/torque/default.nix b/pkgs/servers/computing/torque/default.nix
index 5e78fe742ac..8eb12a1b811 100644
--- a/pkgs/servers/computing/torque/default.nix
+++ b/pkgs/servers/computing/torque/default.nix
@@ -25,9 +25,7 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   # added to fix build with gcc7
-  NIX_CFLAGS_COMPILE = [
-    "-Wno-error" "-fpermissive"
-  ];
+  NIX_CFLAGS_COMPILE = "-Wno-error -fpermissive";
 
   postPatch = ''
     substituteInPlace Makefile.am \
diff --git a/pkgs/servers/fileshare/default.nix b/pkgs/servers/fileshare/default.nix
index 357237e1e29..42f280eed23 100644
--- a/pkgs/servers/fileshare/default.nix
+++ b/pkgs/servers/fileshare/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig git ];
   buildInputs = [ libmicrohttpd ];
 
-  makeFlags = "BUILD=release";
+  makeFlags = [ "BUILD=release" ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/servers/gpsd/default.nix b/pkgs/servers/gpsd/default.nix
index f205b600dd9..a05b37e9d2c 100644
--- a/pkgs/servers/gpsd/default.nix
+++ b/pkgs/servers/gpsd/default.nix
@@ -67,7 +67,7 @@ stdenv.mkDerivation rec {
   preInstall = ''
     mkdir -p "$out/lib/udev/rules.d"
   '';
-  installTargets = "install udev-install";
+  installTargets = [ "install" "udev-install" ];
 
   postFixup = ''
     wrapPythonProgramsIn $out/bin "$out $pythonPath"
diff --git a/pkgs/servers/http/apache-httpd/2.4.nix b/pkgs/servers/http/apache-httpd/2.4.nix
index 63861714145..d5da6df8d68 100644
--- a/pkgs/servers/http/apache-httpd/2.4.nix
+++ b/pkgs/servers/http/apache-httpd/2.4.nix
@@ -44,10 +44,6 @@ stdenv.mkDerivation rec {
   # Required for ‘pthread_cancel’.
   NIX_LDFLAGS = stdenv.lib.optionalString (!stdenv.isDarwin) "-lgcc_s";
 
-  preConfigure = ''
-    configureFlags="$configureFlags --includedir=$dev/include"
-  '';
-
   configureFlags = [
     "--with-apr=${apr.dev}"
     "--with-apr-util=${aprutil.dev}"
@@ -60,6 +56,7 @@ stdenv.mkDerivation rec {
     "--enable-cern-meta"
     "--enable-imagemap"
     "--enable-cgi"
+    "--includedir=${placeholder "dev"}/include"
     (stdenv.lib.enableFeature proxySupport "proxy")
     (stdenv.lib.enableFeature sslSupport "ssl")
     (stdenv.lib.withFeatureAs libxml2Support "libxml2" "${libxml2.dev}/include/libxml2")
diff --git a/pkgs/servers/http/apache-modules/mod_python/default.nix b/pkgs/servers/http/apache-modules/mod_python/default.nix
index f947bf535cc..6aed1481ddf 100644
--- a/pkgs/servers/http/apache-modules/mod_python/default.nix
+++ b/pkgs/servers/http/apache-modules/mod_python/default.nix
@@ -16,8 +16,9 @@ stdenv.mkDerivation rec {
         --replace '-$GIT' ""
   '';
 
+  installFlags = [ "LIBEXECDIR=${placeholder "out"}/modules" ];
+
   preInstall = ''
-    installFlags="LIBEXECDIR=$out/modules $installFlags"
     mkdir -p $out/modules $out/bin
   '';
 
diff --git a/pkgs/servers/http/nginx/generic.nix b/pkgs/servers/http/nginx/generic.nix
index 2c0dbc7d665..990d7c5cf13 100644
--- a/pkgs/servers/http/nginx/generic.nix
+++ b/pkgs/servers/http/nginx/generic.nix
@@ -53,15 +53,15 @@ stdenv.mkDerivation {
     "--with-http_stub_status_module"
     "--with-threads"
     "--with-pcre-jit"
-  ] ++ optional withDebug [
+  ] ++ optionals withDebug [
     "--with-debug"
-  ] ++ optional withStream [
+  ] ++ optionals withStream [
     "--with-stream"
     "--with-stream_geoip_module"
     "--with-stream_realip_module"
     "--with-stream_ssl_module"
     "--with-stream_ssl_preread_module"
-  ] ++ optional withMail [
+  ] ++ optionals withMail [
     "--with-mail"
     "--with-mail_ssl_module"
   ] ++ optional (perl != null) [
@@ -73,10 +73,10 @@ stdenv.mkDerivation {
     ++ optional (with stdenv.hostPlatform; isLinux || isFreeBSD) "--with-file-aio"
     ++ map (mod: "--add-module=${mod.src}") modules;
 
-  NIX_CFLAGS_COMPILE = [
+  NIX_CFLAGS_COMPILE = toString ([
     "-I${libxml2.dev}/include/libxml2"
     "-Wno-error=implicit-fallthrough"
-  ] ++ optional stdenv.isDarwin "-Wno-error=deprecated-declarations";
+  ] ++ optional stdenv.isDarwin "-Wno-error=deprecated-declarations");
 
   configurePlatforms = [];
 
diff --git a/pkgs/servers/http/openresty/default.nix b/pkgs/servers/http/openresty/default.nix
index 53773302963..328db9ec986 100644
--- a/pkgs/servers/http/openresty/default.nix
+++ b/pkgs/servers/http/openresty/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ openssl zlib pcre libxml2 libxslt gd geoip postgresql ];
   nativeBuildInputs = [ perl ];
 
-  NIX_CFLAGS_COMPILE = ["-I${libxml2.dev}/include/libxml2"];
+  NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
 
   preConfigure = ''
     patchShebangs .
diff --git a/pkgs/servers/http/tengine/default.nix b/pkgs/servers/http/tengine/default.nix
index 379a5c242f7..1eeb5a8c4dd 100644
--- a/pkgs/servers/http/tengine/default.nix
+++ b/pkgs/servers/http/tengine/default.nix
@@ -53,23 +53,23 @@ stdenv.mkDerivation rec {
     "--with-poll_module"
     "--with-google_perftools_module"
     "--with-jemalloc"
-  ] ++ optional withDebug [
+  ] ++ optionals withDebug [
     "--with-debug"
-  ] ++ optional withMail [
+  ] ++ optionals withMail [
     "--with-mail"
     "--with-mail_ssl_module"
-  ] ++ optional (!withMail) [
+  ] ++ optionals (!withMail) [
     "--without-mail_pop3_module"
     "--without-mail_imap_module"
     "--without-mail_smtp_module"
-  ] ++ optional withStream [
+  ] ++ optionals withStream [
     "--with-stream"
     "--with-stream_ssl_module"
     "--with-stream_realip_module"
     "--with-stream_geoip_module"
     "--with-stream_ssl_preread_module"
     "--with-stream_sni"
-  ] ++ optional (!withStream) [
+  ] ++ optionals (!withStream) [
     "--without-stream_limit_conn_module"
     "--without-stream_access_module"
     "--without-stream_geo_module"
@@ -84,10 +84,8 @@ stdenv.mkDerivation rec {
     ++ optional (with stdenv.hostPlatform; isLinux || isFreeBSD) "--with-file-aio"
     ++ map (mod: "--add-module=${mod.src}") modules;
 
-  NIX_CFLAGS_COMPILE = [
-    "-I${libxml2.dev}/include/libxml2"
-    "-Wno-error=implicit-fallthrough"
-  ] ++ optional stdenv.isDarwin "-Wno-error=deprecated-declarations";
+  NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2 -Wno-error=implicit-fallthrough"
+    + optionalString stdenv.isDarwin " -Wno-error=deprecated-declarations";
 
   preConfigure = (concatMapStringsSep "\n" (mod: mod.preConfigure or "") modules);
 
diff --git a/pkgs/servers/http/unit/default.nix b/pkgs/servers/http/unit/default.nix
index 71ccbb2c15a..d210fcefc85 100644
--- a/pkgs/servers/http/unit/default.nix
+++ b/pkgs/servers/http/unit/default.nix
@@ -49,9 +49,9 @@ stdenv.mkDerivation rec {
     "--pid=/run/unit/unit.pid"
     "--user=unit"
     "--group=unit"
-  ] ++ optional withSSL     [ "--openssl" ]
-    ++ optional (!withIPv6) [ "--no-ipv6" ]
-    ++ optional withDebug   [ "--debug" ];
+  ] ++ optional withSSL     "--openssl"
+    ++ optional (!withIPv6) "--no-ipv6"
+    ++ optional withDebug   "--debug";
 
   postConfigure = ''
     ${optionalString withPython2    "./configure python --module=python2  --config=${python2}/bin/python2-config  --lib-path=${python2}/lib"}
diff --git a/pkgs/servers/mail/archiveopteryx/default.nix b/pkgs/servers/mail/archiveopteryx/default.nix
index 5a318c311af..55cc4c121f0 100644
--- a/pkgs/servers/mail/archiveopteryx/default.nix
+++ b/pkgs/servers/mail/archiveopteryx/default.nix
@@ -20,10 +20,11 @@ stdenv.mkDerivation rec {
     sed -i 's:READMEDIR = $(PREFIX):READMEDIR = '$out'/share/doc/archiveopteryx:' ./Jamsettings
   '';
 
-  # fix build on gcc7
-  NIX_CFLAGS_COMPILE = [
+  # fix build on gcc7+
+  NIX_CFLAGS_COMPILE = builtins.toString [
     "-Wno-error=builtin-declaration-mismatch"
     "-Wno-error=implicit-fallthrough"
+    "-Wno-error=deprecated-copy"
   ];
 
   buildPhase = ''jam "-j$NIX_BUILD_CORES" '';
diff --git a/pkgs/servers/mail/opensmtpd/extras.nix b/pkgs/servers/mail/opensmtpd/extras.nix
index f7ed6382a7b..14d36ad6554 100644
--- a/pkgs/servers/mail/opensmtpd/extras.nix
+++ b/pkgs/servers/mail/opensmtpd/extras.nix
@@ -48,39 +48,38 @@ stdenv.mkDerivation rec {
     "--with-scheduler-ram"
     "--with-scheduler-stub"
 
-  ] ++ stdenv.lib.optional enablePython [
+  ] ++ stdenv.lib.optionals enablePython [
     "--with-python=${python2}"
     "--with-filter-python"
     "--with-queue-python"
     "--with-table-python"
     "--with-scheduler-python"
 
-  ] ++ stdenv.lib.optional enableLua [
+  ] ++ stdenv.lib.optionals enableLua [
     "--with-lua=${pkgconfig}"
     "--with-filter-lua"
 
-  ] ++ stdenv.lib.optional enablePerl [
+  ] ++ stdenv.lib.optionals enablePerl [
     "--with-perl=${perl}"
     "--with-filter-perl"
 
-  ] ++ stdenv.lib.optional enableMysql [
+  ] ++ stdenv.lib.optionals enableMysql [
     "--with-table-mysql"
 
-  ] ++ stdenv.lib.optional enablePostgres [
+  ] ++ stdenv.lib.optionals enablePostgres [
     "--with-table-postgres"
 
-  ] ++ stdenv.lib.optional enableSqlite [
+  ] ++ stdenv.lib.optionals enableSqlite [
     "--with-table-sqlite"
 
-  ] ++ stdenv.lib.optional enableRedis [
+  ] ++ stdenv.lib.optionals enableRedis [
     "--with-table-redis"
   ];
 
-  NIX_CFLAGS_COMPILE =
-    stdenv.lib.optional enableRedis
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString enableRedis
       "-I${hiredis}/include/hiredis -lhiredis"
-    ++ stdenv.lib.optional enableMysql
-      "-L${libmysqlclient}/lib/mysql";
+    + stdenv.lib.optionalString enableMysql
+      " -L${libmysqlclient}/lib/mysql";
 
   meta = with stdenv.lib; {
     homepage = https://www.opensmtpd.org/;
diff --git a/pkgs/servers/mail/postfix/default.nix b/pkgs/servers/mail/postfix/default.nix
index b3345f9420c..c0e6252a551 100644
--- a/pkgs/servers/mail/postfix/default.nix
+++ b/pkgs/servers/mail/postfix/default.nix
@@ -79,7 +79,7 @@ in stdenv.mkDerivation rec {
     make makefiles CCARGS='${ccargs}' AUXLIBS='${auxlibs}'
   '';
 
-  NIX_LDFLAGS = lib.optional withLDAP "-llber";
+  NIX_LDFLAGS = lib.optionalString withLDAP "-llber";
 
   installTargets = [ "non-interactive-package" ];
 
diff --git a/pkgs/servers/mail/postfix/pfixtools.nix b/pkgs/servers/mail/postfix/pfixtools.nix
index 8a92843e43e..9fb441a92de 100644
--- a/pkgs/servers/mail/postfix/pfixtools.nix
+++ b/pkgs/servers/mail/postfix/pfixtools.nix
@@ -42,12 +42,9 @@ stdenv.mkDerivation {
                       --replace /bin/bash ${bash}/bin/bash;
   '';
 
-  NIX_CFLAGS_COMPILE = [
-    "-Wno-error=unused-result" "-Wno-error=nonnull-compare"
-    "-Wno-error=format-truncation"
-  ];
+  NIX_CFLAGS_COMPILE = "-Wno-error=unused-result -Wno-error=nonnull-compare -Wno-error=format-truncation";
 
-  makeFlags = "DESTDIR=$(out) prefix=";
+  makeFlags = [ "DESTDIR=$(out)" "prefix=" ];
 
   meta = {
     description = "A collection of postfix-related tools";
diff --git a/pkgs/servers/mail/spamassassin/default.nix b/pkgs/servers/mail/spamassassin/default.nix
index f3032bfc86a..274f45d5b2d 100644
--- a/pkgs/servers/mail/spamassassin/default.nix
+++ b/pkgs/servers/mail/spamassassin/default.nix
@@ -20,9 +20,9 @@ perlPackages.buildPerlPackage rec {
 
   # Enabling 'taint' mode is desirable, but that flag disables support
   # for the PERL5LIB environment variable. Needs further investigation.
-  makeFlags = "PERL_BIN=${perlPackages.perl}/bin/perl PERL_TAINT=no";
+  makeFlags = [ "PERL_BIN=${perlPackages.perl}/bin/perl" "PERL_TAINT=no" ];
 
-  makeMakerFlags = "CONFDIR=/homeless/shelter LOCALSTATEDIR=/var/lib/spamassassin";
+  makeMakerFlags = [ "CONFDIR=/homeless/shelter" "LOCALSTATEDIR=/var/lib/spamassassin" ];
 
   doCheck = false;
 
diff --git a/pkgs/servers/monitoring/munin/default.nix b/pkgs/servers/monitoring/munin/default.nix
index d978cb003c7..46e1460d795 100644
--- a/pkgs/servers/monitoring/munin/default.nix
+++ b/pkgs/servers/monitoring/munin/default.nix
@@ -92,16 +92,16 @@ stdenv.mkDerivation rec {
   # DESTDIR shouldn't be needed (and shouldn't have worked), but munin
   # developers have forgotten to use PREFIX everywhere, so we use DESTDIR to
   # ensure that everything is installed in $out.
-  makeFlags = ''
-    PREFIX=$(out)
-    DESTDIR=$(out)
-    PERLLIB=$(out)/${perlPackages.perl.libPrefix}
-    PERL=${perlPackages.perl.outPath}/bin/perl
-    PYTHON=${python.outPath}/bin/python
-    RUBY=${ruby.outPath}/bin/ruby
-    JAVARUN=${jre.outPath}/bin/java
-    PLUGINUSER=munin
-  '';
+  makeFlags = [
+    "PREFIX=$(out)"
+    "DESTDIR=$(out)"
+    "PERLLIB=$(out)/${perlPackages.perl.libPrefix}"
+    "PERL=${perlPackages.perl.outPath}/bin/perl"
+    "PYTHON=${python.outPath}/bin/python"
+    "RUBY=${ruby.outPath}/bin/ruby"
+    "JAVARUN=${jre.outPath}/bin/java"
+    "PLUGINUSER=munin"
+  ];
 
   postFixup = ''
     echo "Removing references to /usr/{bin,sbin}/ from munin plugins..."
diff --git a/pkgs/servers/monitoring/nagios/default.nix b/pkgs/servers/monitoring/nagios/default.nix
index 042450941d2..006d91ef74e 100644
--- a/pkgs/servers/monitoring/nagios/default.nix
+++ b/pkgs/servers/monitoring/nagios/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ php perl gd libpng zlib unzip ];
 
   configureFlags = [ "--localstatedir=/var/lib/nagios" ];
-  buildFlags = "all";
+  buildFlags = [ "all" ];
 
   # Do not create /var directories
   preInstall = ''
diff --git a/pkgs/servers/nosql/aerospike/default.nix b/pkgs/servers/nosql/aerospike/default.nix
index d3b80aa00fe..b7b43edc1cd 100644
--- a/pkgs/servers/nosql/aerospike/default.nix
+++ b/pkgs/servers/nosql/aerospike/default.nix
@@ -15,7 +15,12 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoconf automake libtool ];
   buildInputs = [ openssl zlib ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=format-truncation";
+  NIX_CFLAGS_COMPILE = [
+    "-Wno-error=format-truncation"
+    "-Wno-error=address-of-packed-member"
+    "-Wno-error=format-overflow"
+    "-Wno-error=stringop-truncation"
+  ];
 
   preBuild = ''
     patchShebangs build/gen_version
diff --git a/pkgs/servers/nosql/arangodb/default.nix b/pkgs/servers/nosql/arangodb/default.nix
index ef75dad9151..e41930a2f48 100644
--- a/pkgs/servers/nosql/arangodb/default.nix
+++ b/pkgs/servers/nosql/arangodb/default.nix
@@ -17,7 +17,7 @@ let
 
     # prevent failing with "cmake-3.13.4/nix-support/setup-hook: line 10: ./3rdParty/rocksdb/RocksDBConfig.cmake.in: No such file or directory"
     dontFixCmake       =                     lib.versionAtLeast version "3.5";
-    NIX_CFLAGS_COMPILE = lib.optionals      (lib.versionAtLeast version "3.5") [ "-Wno-error" ];
+    NIX_CFLAGS_COMPILE = lib.optionalString (lib.versionAtLeast version "3.5") "-Wno-error";
     preConfigure       = lib.optionalString (lib.versionAtLeast version "3.5") "patchShebangs utils";
 
     postPatch = ''
diff --git a/pkgs/servers/nosql/mongodb/default.nix b/pkgs/servers/nosql/mongodb/default.nix
index 4c4ac4c5cb6..c2ae83f3e8a 100644
--- a/pkgs/servers/nosql/mongodb/default.nix
+++ b/pkgs/servers/nosql/mongodb/default.nix
@@ -66,7 +66,7 @@ in stdenv.mkDerivation {
       --replace 'engine("wiredTiger")' 'engine("mmapv1")'
   '';
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optional stdenv.cc.isClang "-Wno-unused-command-line-argument";
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-unused-command-line-argument";
 
   sconsFlags = [
     "--release"
diff --git a/pkgs/servers/nosql/redis/default.nix b/pkgs/servers/nosql/redis/default.nix
index 4b1003db284..278ba8d13c5 100644
--- a/pkgs/servers/nosql/redis/default.nix
+++ b/pkgs/servers/nosql/redis/default.nix
@@ -23,7 +23,8 @@ stdenv.mkDerivation rec {
   # Note: this enables libc malloc as a temporary fix for cross-compiling.
   # Due to hardcoded configure flags in jemalloc, we can't cross-compile vendored jemalloc properly, and so we're forced to use libc allocator.
   # It's weird that the build isn't failing because of failure to compile dependencies, it's from failure to link them!
-  makeFlags = "PREFIX=$(out)" + stdenv.lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) " AR=${stdenv.cc.targetPrefix}ar RANLIB=${stdenv.cc.targetPrefix}ranlib MALLOC=libc";
+  makeFlags = [ "PREFIX=$(out)" ]
+    ++ stdenv.lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [ "AR=${stdenv.cc.targetPrefix}ar" "RANLIB=${stdenv.cc.targetPrefix}ranlib" "MALLOC=libc" ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/servers/osrm-backend/default.nix b/pkgs/servers/osrm-backend/default.nix
index c0018529ea8..b744c58d4fb 100644
--- a/pkgs/servers/osrm-backend/default.nix
+++ b/pkgs/servers/osrm-backend/default.nix
@@ -11,6 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1m4hf26mgfvvx9z37qww8v8w4mhzyfl554ymdnzl99pr5ild093s";
   };
 
+  NIX_CFLAGS_COMPILE = [ "-Wno-error=pessimizing-move" "-Wno-error=redundant-move" ];
+
   nativeBuildInputs = [ cmake pkgconfig ];
   buildInputs = [ bzip2 libxml2 libzip boost lua luabind tbb expat ];
 
diff --git a/pkgs/servers/sql/cockroachdb/default.nix b/pkgs/servers/sql/cockroachdb/default.nix
index ba395c5e7f6..6637a75ea2f 100644
--- a/pkgs/servers/sql/cockroachdb/default.nix
+++ b/pkgs/servers/sql/cockroachdb/default.nix
@@ -13,15 +13,17 @@ let
 in
 buildGoPackage rec {
   pname = "cockroach";
-  version = "19.1.4";
+  version = "19.1.5";
 
   goPackagePath = "github.com/cockroachdb/cockroach";
 
   src = fetchurl {
     url = "https://binaries.cockroachdb.com/cockroach-v${version}.src.tgz";
-    sha256 = "1bqzs844ildvyh4332vapsqhfkwcvjmgkkmn3i8ndd89q5yic6fq";
+    sha256 = "1pnzzmxxb7qxiiy8qpl2sifk4qrijjbhmzy47bnjj5ssdsjjjcqy";
   };
 
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionals stdenv.cc.isGNU [ "-Wno-error=deprecated-copy" "-Wno-error=redundant-move" "-Wno-error=pessimizing-move" ];
+
   inherit nativeBuildInputs buildInputs;
 
   buildPhase = ''
diff --git a/pkgs/servers/sql/percona/5.6.x.nix b/pkgs/servers/sql/percona/5.6.x.nix
index 7f8f0786e03..860c1f8e94f 100644
--- a/pkgs/servers/sql/percona/5.6.x.nix
+++ b/pkgs/servers/sql/percona/5.6.x.nix
@@ -38,6 +38,7 @@ stdenv.mkDerivation rec {
     "-DINSTALL_SHAREDIR=share/mysql"
   ];
 
+  NIX_CFLAGS_COMPILE = [ "-Wno-error=address-of-packed-member" ];
   NIX_LDFLAGS = "-lgcc_s";
 
   prePatch = ''
diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 440375db841..3f05b3e36c1 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -44,7 +44,7 @@ let
 
     buildFlags = [ "world" ];
 
-    NIX_CFLAGS_COMPILE = [ "-I${libxml2.dev}/include/libxml2" ];
+    NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
 
     # Otherwise it retains a reference to compiler and fails; see #44767.  TODO: better.
     preConfigure = "CC=${stdenv.cc.targetPrefix}cc";
diff --git a/pkgs/servers/tvheadend/default.nix b/pkgs/servers/tvheadend/default.nix
index 7fad204a018..9a01bf3eed6 100644
--- a/pkgs/servers/tvheadend/default.nix
+++ b/pkgs/servers/tvheadend/default.nix
@@ -25,7 +25,7 @@ in stdenv.mkDerivation {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=format-truncation";
+  NIX_CFLAGS_COMPILE = [ "-Wno-error=format-truncation" "-Wno-error=stringop-truncation" ];
 
   # disable dvbscan, as having it enabled causes a network download which
   # cannot happen during build.
diff --git a/pkgs/servers/uhub/default.nix b/pkgs/servers/uhub/default.nix
index 6483973546c..11dd5449b4b 100644
--- a/pkgs/servers/uhub/default.nix
+++ b/pkgs/servers/uhub/default.nix
@@ -44,10 +44,10 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  cmakeFlags = ''
-    -DSYSTEMD_SUPPORT=ON
-    ${if tlsSupport then "-DSSL_SUPPORT=ON" else "-DSSL_SUPPORT=OFF"}
-  '';
+  cmakeFlags = [
+    "-DSYSTEMD_SUPPORT=ON"
+    (if tlsSupport then "-DSSL_SUPPORT=ON" else "-DSSL_SUPPORT=OFF")
+  ];
 
   meta = with stdenv.lib; {
     description = "High performance peer-to-peer hub for the ADC network";
diff --git a/pkgs/servers/uwsgi/default.nix b/pkgs/servers/uwsgi/default.nix
index 556c44b61a7..7669053d229 100644
--- a/pkgs/servers/uwsgi/default.nix
+++ b/pkgs/servers/uwsgi/default.nix
@@ -89,7 +89,7 @@ stdenv.mkDerivation rec {
     ${lib.concatMapStringsSep "\n" (x: x.install or "") needed}
   '';
 
-  NIX_CFLAGS_LINK = lib.optional withSystemd "-lsystemd" ++ lib.concatMap (x: x.NIX_CFLAGS_LINK or []) needed;
+  NIX_CFLAGS_LINK = toString (lib.optional withSystemd "-lsystemd" ++ lib.concatMap (x: x.NIX_CFLAGS_LINK or []) needed);
 
   meta = with stdenv.lib; {
     homepage = https://uwsgi-docs.readthedocs.org/en/latest/;
diff --git a/pkgs/servers/varnish/default.nix b/pkgs/servers/varnish/default.nix
index 8af11183c69..8d49846cbc0 100644
--- a/pkgs/servers/varnish/default.nix
+++ b/pkgs/servers/varnish/default.nix
@@ -19,7 +19,7 @@ let
         pcre libxslt groff ncurses readline libedit makeWrapper python3
       ];
 
-      buildFlags = "localstatedir=/var/spool";
+      buildFlags = [ "localstatedir=/var/spool" ];
 
       postInstall = ''
         wrapProgram "$out/sbin/varnishd" --prefix PATH : "${stdenv.lib.makeBinPath [ stdenv.cc ]}"
diff --git a/pkgs/servers/web-apps/fileshelter/default.nix b/pkgs/servers/web-apps/fileshelter/default.nix
index 47184fe9c96..928d80b1297 100644
--- a/pkgs/servers/web-apps/fileshelter/default.nix
+++ b/pkgs/servers/web-apps/fileshelter/default.nix
@@ -16,9 +16,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
   buildInputs = [ libzip boost wt4 libconfig ];
 
-  NIX_LDFLAGS = [
-    "-lpthread"
-  ];
+  NIX_LDFLAGS = "-lpthread";
 
   postInstall = ''
     ln -s ${wt4}/share/Wt/resources $out/share/fileshelter/docroot/resources
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 1e891092f7c..c01bca007dc 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -63,10 +63,10 @@ self: super:
     x11BuildHook = ./imake.sh;
     patches = [./imake.patch ./imake-cc-wrapper-uberhack.patch];
     setupHook = ./imake-setup-hook.sh;
-    CFLAGS = [ ''-DIMAKE_COMPILETIME_CPP='"${if stdenv.isDarwin
+    CFLAGS = "-DIMAKE_COMPILETIME_CPP='\"${if stdenv.isDarwin
       then "${tradcpp}/bin/cpp"
-      else "gcc"}"' ''
-    ];
+      else "gcc"}\"'";
+
     inherit tradcpp;
   });
 
@@ -123,9 +123,7 @@ self: super:
     outputs = [ "out" "dev" ];
     propagatedBuildInputs = [ freetype ]; # propagate link reqs. like bzip2
     # prevents "misaligned_stack_error_entering_dyld_stub_binder"
-    configureFlags = lib.optionals isDarwin [
-      "CFLAGS=-O0"
-    ];
+    configureFlags = lib.optional isDarwin "CFLAGS=-O0";
   });
 
   libXxf86vm = super.libXxf86vm.overrideAttrs (attrs: {
@@ -207,9 +205,8 @@ self: super:
   libXi = super.libXi.overrideAttrs (attrs: {
     outputs = [ "out" "dev" "man" "doc" ];
     propagatedBuildInputs = [ self.libXfixes ];
-    configureFlags = stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-      "xorg_cv_malloc0_returns_null=no"
-    ];
+    configureFlags = stdenv.lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
+      "xorg_cv_malloc0_returns_null=no";
   });
 
   libXinerama = super.libXinerama.overrideAttrs (attrs: {
@@ -220,7 +217,7 @@ self: super:
 
   libXmu = super.libXmu.overrideAttrs (attrs: {
     outputs = [ "out" "dev" "doc" ];
-    buildFlags = ''BITMAP_DEFINES=-DBITMAPDIR=\"/no-such-path\"'';
+    buildFlags = [ "BITMAP_DEFINES='-DBITMAPDIR=\"/no-such-path\"'" ];
   });
 
   libXrandr = super.libXrandr.overrideAttrs (attrs: {
@@ -342,32 +339,43 @@ self: super:
   xf86inputevdev = super.xf86inputevdev.overrideAttrs (attrs: {
     outputs = [ "out" "dev" ]; # to get rid of xorgserver.dev; man is tiny
     preBuild = "sed -e '/motion_history_proc/d; /history_size/d;' -i src/*.c";
-    installFlags = "sdkdir=\${out}/include/xorg";
+    installFlags = [
+      "sdkdir=${placeholder ''out''}/include/xorg"
+    ];
   });
 
   xf86inputmouse = super.xf86inputmouse.overrideAttrs (attrs: {
-    installFlags = "sdkdir=\${out}/include/xorg";
+    installFlags = [
+      "sdkdir=${placeholder ''out''}/include/xorg"
+    ];
   });
 
   xf86inputjoystick = super.xf86inputjoystick.overrideAttrs (attrs: {
-    installFlags = "sdkdir=\${out}/include/xorg";
+    installFlags = [
+      "sdkdir=${placeholder ''out''}/include/xorg"
+    ];
   });
 
   xf86inputlibinput = super.xf86inputlibinput.overrideAttrs (attrs: {
     outputs = [ "out" "dev" ];
-    installFlags = "sdkdir=\${dev}/include/xorg";
+    installFlags = [
+      "sdkdir=${placeholder ''dev''}/include/xorg"
+    ];
   });
 
   xf86inputsynaptics = super.xf86inputsynaptics.overrideAttrs (attrs: {
     outputs = [ "out" "dev" ]; # *.pc pulls xorgserver.dev
-    installFlags = "sdkdir=\${out}/include/xorg configdir=\${out}/share/X11/xorg.conf.d";
+    installFlags = [
+      "sdkdir=${placeholder ''out''}/include/xorg"
+      "configdir=${placeholder ''out''}/share/X11/xorg.conf.d"
+    ];
   });
 
   xf86inputvmmouse = super.xf86inputvmmouse.overrideAttrs (attrs: {
     configureFlags = [
-      "--sysconfdir=$(out)/etc"
-      "--with-xorg-conf-dir=$(out)/share/X11/xorg.conf.d"
-      "--with-udev-rules-dir=$(out)/lib/udev/rules.d"
+      "--sysconfdir=${placeholder ''out''}/etc"
+      "--with-xorg-conf-dir=${placeholder ''out''}/share/X11/xorg.conf.d"
+      "--with-udev-rules-dir=${placeholder ''out''}/lib/udev/rules.d"
     ];
 
     meta = attrs.meta // {
@@ -388,6 +396,10 @@ self: super:
   xf86videovoodoo  = super.xf86videovoodoo.overrideAttrs  (attrs: { meta = attrs.meta // { broken = true; }; });
   xf86videowsfb    = super.xf86videowsfb.overrideAttrs    (attrs: { meta = attrs.meta // { broken = true; }; });
 
+  xf86videoomap    = super.xf86videoomap.overrideAttrs (attrs: {
+    NIX_CFLAGS_COMPILE = [ "-Wno-error=format-overflow" ];
+  });
+
   xf86videoamdgpu = super.xf86videoamdgpu.overrideAttrs (attrs: {
     configureFlags = [ "--with-xorg-conf-dir=$(out)/share/X11/xorg.conf.d" ];
   });
diff --git a/pkgs/shells/bash/4.4.nix b/pkgs/shells/bash/4.4.nix
index e5e33c76d20..121368abf4c 100644
--- a/pkgs/shells/bash/4.4.nix
+++ b/pkgs/shells/bash/4.4.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
     -DSSH_SOURCE_BASHRC
   '';
 
-  patchFlags = "-p0";
+  patchFlags = [ "-p0" ];
 
   patches = upstreamPatches
     ++ optional stdenv.hostPlatform.isCygwin ./cygwin-bash-4.4.11-2.src.patch
diff --git a/pkgs/shells/bash/5.0.nix b/pkgs/shells/bash/5.0.nix
index b78282ab6e4..a06b08a5599 100644
--- a/pkgs/shells/bash/5.0.nix
+++ b/pkgs/shells/bash/5.0.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
     -DSSH_SOURCE_BASHRC
   '';
 
-  patchFlags = "-p0";
+  patchFlags = [ "-p0" ];
 
   patches = upstreamPatches;
 
diff --git a/pkgs/shells/ksh/default.nix b/pkgs/shells/ksh/default.nix
index 80059e448c9..108d1a58758 100644
--- a/pkgs/shells/ksh/default.nix
+++ b/pkgs/shells/ksh/default.nix
@@ -1,16 +1,24 @@
-{ stdenv, meson, ninja, fetchFromGitHub, which, python, libiconv }:
+{ stdenv, meson, ninja, fetchFromGitHub, which, python, fetchpatch
+, libiconv }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "ksh";
-  version = "93v";
+  version = "2020.0.0";
 
   src = fetchFromGitHub {
     owner  = "att";
     repo   = "ast";
-    rev    = "b8d88244ae87857e7bbd6da230ffbbc51165df70";
-    sha256 = "12kf14n8vz36hnsy3wp6lnyv1841p7hcq25y1d78w532dil69lx9";
+    rev    = version;
+    sha256 = "0cdxz0nhpq03gb9rd76fn0x1yzs2c8q289b7vcxnzlsrz1imz65j";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/att/ast/commit/11983a71f5e29df578b7e2184400728b4e3f451d.patch";
+      sha256 = "1n9558c4v2qpgpjb1vafs29n3qn3z0770wr1ayc0xjf5z5j4g3kv";
+    })
+  ];
+
   nativeBuildInputs = [ meson ninja which python ];
 
   buildInputs = [ libiconv ];
diff --git a/pkgs/shells/zsh/grml-zsh-config/default.nix b/pkgs/shells/zsh/grml-zsh-config/default.nix
index 80f51dbb763..d23999abf3d 100644
--- a/pkgs/shells/zsh/grml-zsh-config/default.nix
+++ b/pkgs/shells/zsh/grml-zsh-config/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [ zsh coreutils txt2tags procps ]
-    ++ optional stdenv.isLinux [ inetutils ];
+    ++ optional stdenv.isLinux inetutils;
 
   buildPhase = ''
     cd doc
diff --git a/pkgs/shells/zsh/zsh-syntax-highlighting/default.nix b/pkgs/shells/zsh/zsh-syntax-highlighting/default.nix
index 741587ef960..0dbfba52c0f 100644
--- a/pkgs/shells/zsh/zsh-syntax-highlighting/default.nix
+++ b/pkgs/shells/zsh/zsh-syntax-highlighting/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ zsh ];
 
-  installFlags = "PREFIX=$(out)";
+  installFlags = [ "PREFIX=$(out)" ];
 
   meta = with stdenv.lib; {
     description = "Fish shell like syntax highlighting for Zsh";
diff --git a/pkgs/tools/X11/hsetroot/default.nix b/pkgs/tools/X11/hsetroot/default.nix
index 239dfa0963b..6bae355812c 100644
--- a/pkgs/tools/X11/hsetroot/default.nix
+++ b/pkgs/tools/X11/hsetroot/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   patches = [ underlinkingPatch ];
 
-  patchFlags = "-p0";
+  patchFlags = [ "-p0" ];
 
   preConfigure = "./autogen.sh";
 
diff --git a/pkgs/tools/X11/setroot/default.nix b/pkgs/tools/X11/setroot/default.nix
index bb113c90849..a9b5f17af83 100644
--- a/pkgs/tools/X11/setroot/default.nix
+++ b/pkgs/tools/X11/setroot/default.nix
@@ -18,9 +18,9 @@ stdenv.mkDerivation rec {
   buildInputs = [ libX11 imlib2 ]
     ++ stdenv.lib.optional enableXinerama libXinerama;
 
-  buildFlags = "CC=cc " + (if enableXinerama then "xinerama=1" else "xinerama=0");
+  buildFlags = [ "CC=cc" (if enableXinerama then "xinerama=1" else "xinerama=0") ] ;
 
-  installFlags = "DESTDIR=$(out) PREFIX=";
+  installFlags = [ "DESTDIR=$(out)" "PREFIX=" ];
 
   meta = with stdenv.lib; {
     description = "Simple X background setter inspired by imlibsetroot and feh";
diff --git a/pkgs/tools/X11/srandrd/default.nix b/pkgs/tools/X11/srandrd/default.nix
index af9394a84fa..6d5fa0f3d98 100644
--- a/pkgs/tools/X11/srandrd/default.nix
+++ b/pkgs/tools/X11/srandrd/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libX11 libXrandr libXinerama ];
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with stdenv.lib; {
     homepage = "https://github.com/jceb/srandrd";
diff --git a/pkgs/tools/X11/xbrightness/default.nix b/pkgs/tools/X11/xbrightness/default.nix
index 2857ea6c7be..e196411ce41 100644
--- a/pkgs/tools/X11/xbrightness/default.nix
+++ b/pkgs/tools/X11/xbrightness/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
   buildInputs = [ libX11 libXaw libXext libXmu libXpm libXxf86vm ];
 
   makeFlags = [ "BINDIR=$(out)/bin" "MANPATH=$(out)/share/man" ];
-  installTargets = "install install.man";
+  installTargets = [ "install" "install.man" ];
 
   meta = {
     description = "X11 brigthness and gamma software control";
diff --git a/pkgs/tools/X11/xcwd/default.nix b/pkgs/tools/X11/xcwd/default.nix
index 48cab6529cc..d50a7c006c8 100644
--- a/pkgs/tools/X11/xcwd/default.nix
+++ b/pkgs/tools/X11/xcwd/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ libX11 ];
 
-  makeFlags = "prefix=$(out)";
+  makeFlags = [ "prefix=$(out)" ];
 
   installPhase = ''
     install -D xcwd "$out/bin/xcwd"
diff --git a/pkgs/tools/X11/xdotool/default.nix b/pkgs/tools/X11/xdotool/default.nix
index d20714befba..6fa185dfeab 100644
--- a/pkgs/tools/X11/xdotool/default.nix
+++ b/pkgs/tools/X11/xdotool/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     mkdir -p $out/lib
   '';
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   meta = {
     homepage = https://www.semicomplete.com/projects/xdotool/;
diff --git a/pkgs/tools/X11/xnee/default.nix b/pkgs/tools/X11/xnee/default.nix
index b5350ebecf7..f8f48ea4cdb 100644
--- a/pkgs/tools/X11/xnee/default.nix
+++ b/pkgs/tools/X11/xnee/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
 
   # `cnee' is linked without `-lXi' and as a consequence has a RUNPATH that
   # lacks libXi.
-  makeFlags = "LDFLAGS=-lXi";
+  makeFlags = [ "LDFLAGS=-lXi" ];
 
   # XXX: Actually tests require an X server.
   doCheck = true;
diff --git a/pkgs/tools/X11/xpointerbarrier/default.nix b/pkgs/tools/X11/xpointerbarrier/default.nix
index dfac2cf88a5..4dbe31df03c 100644
--- a/pkgs/tools/X11/xpointerbarrier/default.nix
+++ b/pkgs/tools/X11/xpointerbarrier/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ xorg.libX11 xorg.libXfixes xorg.libXrandr ];
 
-  makeFlags = "prefix=$(out)";
+  makeFlags = [ "prefix=$(out)" ];
 
   meta = {
     homepage = https://uninformativ.de/git/xpointerbarrier;
diff --git a/pkgs/tools/X11/xpra/default.nix b/pkgs/tools/X11/xpra/default.nix
index ffede7d58b2..da7bfb445a9 100644
--- a/pkgs/tools/X11/xpra/default.nix
+++ b/pkgs/tools/X11/xpra/default.nix
@@ -60,10 +60,8 @@ in buildPythonApplication rec {
     ipaddress idna
   ];
 
-  NIX_CFLAGS_COMPILE = [
     # error: 'import_cairo' defined but not used
-    "-Wno-error=unused-function"
-  ];
+  NIX_CFLAGS_COMPILE = "-Wno-error=unused-function";
 
   setupPyBuildFlags = [
     "--with-Xdummy"
diff --git a/pkgs/tools/X11/xzoom/default.nix b/pkgs/tools/X11/xzoom/default.nix
index 31f2c014557..ed7828f37e2 100644
--- a/pkgs/tools/X11/xzoom/default.nix
+++ b/pkgs/tools/X11/xzoom/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     "BINDIR=$(out)/bin"
     "MANPATH=$(out)/share/man"
   ];
-  installTargets = "install install.man";
+  installTargets = [ "install" "install.man" ];
 
   meta = {
     inherit version;
diff --git a/pkgs/tools/admin/aws_shell/default.nix b/pkgs/tools/admin/aws_shell/default.nix
index 95f1df39576..b9169691808 100644
--- a/pkgs/tools/admin/aws_shell/default.nix
+++ b/pkgs/tools/admin/aws_shell/default.nix
@@ -23,6 +23,11 @@ buildPythonPackage rec {
     pyyaml
   ];
 
+  postPatch = ''
+    substituteInPlace setup.py \
+     --replace "prompt-toolkit>=1.0.0,<1.1.0" "prompt-toolkit"
+  '';
+
   #Checks are failing due to missing TTY, which won't exist.
   doCheck = false;
   preCheck = ''
diff --git a/pkgs/tools/admin/awscli/default.nix b/pkgs/tools/admin/awscli/default.nix
index b3af7f9bd6e..f38d4cd1a1d 100644
--- a/pkgs/tools/admin/awscli/default.nix
+++ b/pkgs/tools/admin/awscli/default.nix
@@ -7,20 +7,30 @@
 let
   py = python3.override {
     packageOverrides = self: super: {
-      colorama = super.colorama.overridePythonAttrs (oldAttrs: rec {
-        version = "0.4.1";
+      rsa = super.rsa.overridePythonAttrs (oldAttrs: rec {
+        version = "3.4.2";
         src = oldAttrs.src.override {
           inherit version;
-          sha256 = "05eed71e2e327246ad6b38c540c4a3117230b19679b875190486ddd2d721422d";
+          sha256 = "25df4e10c263fb88b5ace923dd84bf9aa7f5019687b5e55382ffcdb8bede9db5";
         };
       });
-      rsa = super.rsa.overridePythonAttrs (oldAttrs: rec {
-        version = "3.4.2";
+
+      pyyaml = super.pyyaml.overridePythonAttrs (oldAttrs: rec {
+        version = "5.1.2";
         src = oldAttrs.src.override {
           inherit version;
-          sha256 = "25df4e10c263fb88b5ace923dd84bf9aa7f5019687b5e55382ffcdb8bede9db5";
+          sha256 = "1r5faspz73477hlbjgilw05xsms0glmsa371yqdd26znqsvg1b81";
         };
       });
+
+      colorama = super.colorama.overridePythonAttrs (oldAttrs: rec {
+        version = "0.4.1";
+        src = oldAttrs.src.override {
+          inherit version;
+          sha256 = "0ba247bx5pc60hcpbf3rjsqk0whilg241i9qdfnlcwij5qgdgvh5";
+        };
+      });
+
     };
   };
 
diff --git a/pkgs/tools/admin/azure-cli/default.nix b/pkgs/tools/admin/azure-cli/default.nix
index b28ef88ad99..69eae818c3b 100644
--- a/pkgs/tools/admin/azure-cli/default.nix
+++ b/pkgs/tools/admin/azure-cli/default.nix
@@ -1,12 +1,12 @@
 { stdenv, lib, python, fetchFromGitHub, installShellFiles }:
 
 let
-  version = "2.0.77";
+  version = "2.0.78";
   src = fetchFromGitHub {
     owner = "Azure";
     repo = "azure-cli";
     rev = "azure-cli-${version}";
-    sha256 = "1qd6di8cqwhpcsqcx6g3scmwj90m15r695y5977q6a3qy13knisv";
+    sha256 = "095dk5jbri3ydizs0fhfw1lhamvvxwx5smw8mj1bj78b2qsl5xh3";
   };
 
   # put packages that needs to be overriden in the py package scope
diff --git a/pkgs/tools/admin/azure-cli/python-packages.nix b/pkgs/tools/admin/azure-cli/python-packages.nix
index 529bc4d50d3..01355d48d5c 100644
--- a/pkgs/tools/admin/azure-cli/python-packages.nix
+++ b/pkgs/tools/admin/azure-cli/python-packages.nix
@@ -114,8 +114,8 @@ let
       azure-mgmt-recoveryservicesbackup = overrideAzureMgmtPackage super.azure-mgmt-recoveryservicesbackup "0.4.0" "zip"
         "0zssvzdip23yzaxlac9rlzg9mlyjl97fwr0gj8y27z8j58pwj72i";
 
-      azure-mgmt-resource = overrideAzureMgmtPackage super.azure-mgmt-resource "4.0.0" "zip"
-        "0gy89bi89ikg5hps8rvnq28r33lixci3sk2m86jvziv9fh9rz41b";
+      azure-mgmt-resource = overrideAzureMgmtPackage super.azure-mgmt-resource "6.0.0" "zip"
+        "08n6r6ja7p20qlhb9pp51nwwxz2mal19an98zry276i8z5x8ckp0";
 
       azure-mgmt-compute = overrideAzureMgmtPackage super.azure-mgmt-compute "10.0.0" "zip"
         "1s3bx6knxw5dxycp43yimvgrh0i19drzd09asglcwz2x5mr3bpyg";
@@ -150,12 +150,18 @@ let
       azure-mgmt-network = overrideAzureMgmtPackage super.azure-mgmt-network "7.0.0" "zip"
         "0ss5yc9k3dh78lb88nfh3z98yz1pcd8d7d7cfjlxmv4n3dlr1kij";
 
+      azure-mgmt-media = overrideAzureMgmtPackage super.azure-mgmt-media "1.1.1" "zip"
+        "16wk0ksycrscsn3n14qk4vvf7i567vq6f96lwf5dwbc81wx6n32x";
+
       azure-mgmt-msi = overrideAzureMgmtPackage super.azure-mgmt-msi "0.2.0" "zip"
         "0rvik03njz940x2hvqg6iiq8k0d88gyygsr86w8s0sa12sdbq8l6";
 
       azure-mgmt-web = overrideAzureMgmtPackage super.azure-mgmt-web "0.42.0" "zip"
         "0vp40i9aaw5ycz7s7qqir6jq7327f7zg9j9i8g31qkfl1h1c7pdn";
 
+      azure-mgmt-redis = overrideAzureMgmtPackage super.azure-mgmt-redis "7.0.0rc1" "zip"
+        "086wk31wsl8dx14qpd0g1bly8i9a8fix007djlj9cybva2f2bk6k";
+
       azure-mgmt-reservations = overrideAzureMgmtPackage super.azure-mgmt-reservations "0.6.0" "zip"
         "16ycni3cjl9c0mv419gy5rgbrlg8zp0vnr6aj8z8p2ypdw6sgac3";
 
@@ -177,6 +183,9 @@ let
       azure-mgmt-keyvault = overrideAzureMgmtPackage super.azure-mgmt-keyvault "1.1.0" "zip"
         "16a0d3j5dilbp7pd7gbwf8jr46vzbjim1p9alcmisi12m4km7885";
 
+      azure-mgmt-cdn = overrideAzureMgmtPackage super.azure-mgmt-cdn "3.1.0" "zip"
+        "1qvnksmvsg8cw1ac6vbdxjdqsm7s1sak27k8xy24hm7c9a8y1nqc";
+
       azure-mgmt-containerregistry = overrideAzureMgmtPackage super.azure-mgmt-containerregistry "3.0.0rc7" "zip"
         "1bzfpbz186dhnxn0blgr20xxnk67gkr8ysn2b3f1r41bq9hz97xp";
 
@@ -230,6 +239,24 @@ let
         };
       });
 
+      azure-keyvault = super.azure-keyvault.overrideAttrs(oldAttrs: rec {
+        version = "1.1.0";
+        src = super.fetchPypi {
+          inherit (oldAttrs) pname;
+          inherit version;
+          extension = "zip";
+          sha256 = "0jfxm8lx8dzs3v2b04ljizk8gfckbm5l2v86rm7k0npbfvryba1p";
+        };
+
+        propagatedBuildInputs = with self; [
+          azure-common azure-nspkg msrest msrestazure cryptography
+        ];
+        postInstall = ''
+          rm -f $out/${self.python.sitePackages}/azure/__init__.py
+        '';
+        pythonImportsCheck = [ ];
+      });
+
       # part of azure.mgmt.datalake namespace
       azure-mgmt-datalake-analytics = super.azure-mgmt-datalake-analytics.overrideAttrs(oldAttrs: rec {
         version = "0.2.1";
diff --git a/pkgs/tools/admin/bubblewrap/default.nix b/pkgs/tools/admin/bubblewrap/default.nix
index e4b27d98dff..8e2ef7c87e1 100644
--- a/pkgs/tools/admin/bubblewrap/default.nix
+++ b/pkgs/tools/admin/bubblewrap/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bubblewrap";
-  version = "0.3.3";
+  version = "0.4.0";
 
   src = fetchurl {
     url = "https://github.com/projectatomic/bubblewrap/releases/download/v${version}/${pname}-${version}.tar.xz";
-    sha256 = "1zsd6rxryg97dkkhibr0fvq16x3s75qj84rvhdv8p42ag58mz966";
+    sha256 = "08r0f4c3fjkb4zjrb4kkax1zfcgcgic702vb62sjjw5xfhppvzp5";
   };
 
   nativeBuildInputs = [ libcap libxslt docbook_xsl ];
diff --git a/pkgs/tools/admin/fastlane/default.nix b/pkgs/tools/admin/fastlane/default.nix
index afb044ad583..1cdc969ea2e 100644
--- a/pkgs/tools/admin/fastlane/default.nix
+++ b/pkgs/tools/admin/fastlane/default.nix
@@ -6,15 +6,15 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ makeWrapper ];
 
-  env = bundlerEnv {
-    name = "${pname}-${version}-gems";
-    inherit pname ruby;
-    gemdir = ./.;
-  };
-
   phases = [ "installPhase" ];
 
-  installPhase = ''
+  installPhase = let
+    env = bundlerEnv {
+      name = "${pname}-${version}-gems";
+      inherit pname ruby;
+      gemdir = ./.;
+    };
+  in ''
     mkdir -p $out/bin
     makeWrapper ${env}/bin/fastlane $out/bin/fastlane \
      --set FASTLANE_SKIP_UPDATE_CHECK 1
diff --git a/pkgs/tools/admin/salt/default.nix b/pkgs/tools/admin/salt/default.nix
index 13bba0860c4..c94686c93c1 100644
--- a/pkgs/tools/admin/salt/default.nix
+++ b/pkgs/tools/admin/salt/default.nix
@@ -24,7 +24,7 @@ pythonPackages.buildPythonApplication rec {
     pyzmq
     requests
     tornado_4
-  ] ++ stdenv.lib.optional (!pythonPackages.isPy3k) [
+  ] ++ stdenv.lib.optionals (!pythonPackages.isPy3k) [
     futures
   ] ++ extraInputs;
 
diff --git a/pkgs/tools/archivers/afio/default.nix b/pkgs/tools/archivers/afio/default.nix
index 13da95a28b5..8d1e28fed29 100644
--- a/pkgs/tools/archivers/afio/default.nix
+++ b/pkgs/tools/archivers/afio/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
    */
   patches = [ ./0001-makefile-fix-installation.patch ];
 
-  installFlags = "DESTDIR=$(out)";
+  installFlags = [ "DESTDIR=$(out)" ];
 
   meta = {
     homepage = http://members.chello.nl/~k.holtman/afio.html;
diff --git a/pkgs/tools/archivers/undmg/default.nix b/pkgs/tools/archivers/undmg/default.nix
index 9d072c9bb19..72be49d9792 100644
--- a/pkgs/tools/archivers/undmg/default.nix
+++ b/pkgs/tools/archivers/undmg/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   setupHook = ./setup-hook.sh;
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with stdenv.lib; {
     homepage = https://github.com/matthewbauer/undmg;
diff --git a/pkgs/tools/archivers/unzip/default.nix b/pkgs/tools/archivers/unzip/default.nix
index 7bbcc906292..b8f649fbdcb 100644
--- a/pkgs/tools/archivers/unzip/default.nix
+++ b/pkgs/tools/archivers/unzip/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
 
   hardeningDisable = [ "format" ];
 
-  patchFlags = "-p1 -F3";
+  patchFlags = [ "-p1" "-F3" ];
 
   patches = [
     ./CVE-2014-8139.diff
@@ -53,15 +53,21 @@ stdenv.mkDerivation {
 
   makefile = "unix/Makefile";
 
-  NIX_LDFLAGS = [ "-lbz2" ] ++ stdenv.lib.optional enableNLS "-lnatspec";
+  NIX_LDFLAGS = "-lbz2" + stdenv.lib.optionalString enableNLS " -lnatspec";
 
-  buildFlags = "generic D_USE_BZ2=-DUSE_BZIP2 L_BZ2=-lbz2";
+  buildFlags = [
+    "generic"
+    "D_USE_BZ2=-DUSE_BZIP2"
+    "L_BZ2=-lbz2"
+  ];
 
   preConfigure = ''
     sed -i -e 's@CF="-O3 -Wall -I. -DASM_CRC $(LOC)"@CF="-O3 -Wall -I. -DASM_CRC -DLARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 $(LOC)"@' unix/Makefile
   '';
 
-  installFlags = "prefix=$(out)";
+  installFlags = [
+    "prefix=${placeholder ''out''}"
+  ];
 
   setupHook = ./setup-hook.sh;
 
diff --git a/pkgs/tools/archivers/zip/default.nix b/pkgs/tools/archivers/zip/default.nix
index 20d85405bba..09ba6510707 100644
--- a/pkgs/tools/archivers/zip/default.nix
+++ b/pkgs/tools/archivers/zip/default.nix
@@ -19,8 +19,11 @@ stdenv.mkDerivation {
   hardeningDisable = [ "format" ];
 
   makefile = "unix/Makefile";
-  buildFlags = if stdenv.isCygwin then "cygwin" else "generic";
-  installFlags = "prefix=$(out) INSTALL=cp";
+  buildFlags = if stdenv.isCygwin then [ "cygwin" ] else [ "generic" ];
+  installFlags = [
+    "prefix=${placeholder ''out''}"
+    "INSTALL=cp"
+  ];
 
   patches = if (enableNLS && !stdenv.isCygwin) then [ ./natspec-gentoo.patch.bz2 ] else [];
 
diff --git a/pkgs/tools/audio/gvolicon/default.nix b/pkgs/tools/audio/gvolicon/default.nix
index c66c6bc1f7e..9029eb38b06 100644
--- a/pkgs/tools/audio/gvolicon/default.nix
+++ b/pkgs/tools/audio/gvolicon/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
 
   makeFlags = [ "PREFIX=$(out)" ];
 
-  NIX_CFLAGS_COMPILE = [ "-D_POSIX_C_SOURCE" ];
+  NIX_CFLAGS_COMPILE = "-D_POSIX_C_SOURCE";
 
   meta = {
     description = "A simple and lightweight volume icon that sits in your system tray";
diff --git a/pkgs/tools/audio/trx/default.nix b/pkgs/tools/audio/trx/default.nix
index 5d31193ee8d..1d052adbba9 100644
--- a/pkgs/tools/audio/trx/default.nix
+++ b/pkgs/tools/audio/trx/default.nix
@@ -1,13 +1,12 @@
-{ stdenv, fetchgit, alsaLib, libopus, ortp, bctoolbox }:
+{ stdenv, fetchurl, alsaLib, libopus, ortp, bctoolbox }:
 
-stdenv.mkDerivation {
-  pname = "trx-unstable";
-  version = "2018-01-23";
+stdenv.mkDerivation rec {
+  pname = "trx";
+  version = "0.4";
 
-  src = fetchgit {
-    url = "http://www.pogo.org.uk/~mark/trx.git";
-    rev = "66b4707a24172751a131e24d2a800496c699137f";
-    sha256 = "0w0960p25944b30lkc8n4lj14xgsf0fjpmxqwlz2r8wl642bqnfm";
+  src = fetchurl {
+    url = "https://www.pogo.org.uk/~mark/trx/releases/${pname}-${version}.tar.gz";
+    sha256 = "1wsrkbqc090px8i9p8awz38znxjcqjb1dzjjdd8xkjmiprayjhkl";
   };
 
   buildInputs = [ alsaLib libopus ortp bctoolbox ];
diff --git a/pkgs/tools/backup/lvmsync/default.nix b/pkgs/tools/backup/lvmsync/default.nix
index 8c23d804d0b..a52c6bf1ba7 100644
--- a/pkgs/tools/backup/lvmsync/default.nix
+++ b/pkgs/tools/backup/lvmsync/default.nix
@@ -1,27 +1,22 @@
 { stdenv, bundlerEnv, ruby, bundlerUpdateScript, makeWrapper }:
 
-let
-
+stdenv.mkDerivation rec {
   pname = "lvmsync";
   version = (import ./gemset.nix).${pname}.version;
 
-in stdenv.mkDerivation rec {
-
-  name = "${pname}-${version}";
-
-  env = bundlerEnv {
-    name = "${pname}-${version}-gems";
-    ruby = ruby;
-    gemfile  = ./Gemfile;
-    lockfile = ./Gemfile.lock;
-    gemset   = ./gemset.nix;
-  };
-
   buildInputs = [ makeWrapper ];
 
   phases = ["installPhase"];
 
-  installPhase = ''
+  installPhase = let
+    env = bundlerEnv {
+      name = "${pname}-${version}-gems";
+      ruby = ruby;
+      gemfile  = ./Gemfile;
+      lockfile = ./Gemfile.lock;
+      gemset   = ./gemset.nix;
+    };
+  in ''
     mkdir -p $out/bin
     makeWrapper ${env}/bin/lvmsync $out/bin/lvmsync
   '';
diff --git a/pkgs/tools/cd-dvd/cdrdao/default.nix b/pkgs/tools/cd-dvd/cdrdao/default.nix
index a17b0302503..908808b79f3 100644
--- a/pkgs/tools/cd-dvd/cdrdao/default.nix
+++ b/pkgs/tools/cd-dvd/cdrdao/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation {
     sha256 = "0pmpgx91j984snrsxbq1dgf3ximks2dfh1sqqmic72lrls7wp4w1";
   };
 
-  makeFlags = "RM=rm LN=ln MV=mv";
+  makeFlags = [ "RM=rm" "LN=ln" "MV=mv" ];
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libvorbis libmad libao ];
diff --git a/pkgs/tools/cd-dvd/cdrkit/default.nix b/pkgs/tools/cd-dvd/cdrkit/default.nix
index 81bd4f60f43..7de086dba60 100644
--- a/pkgs/tools/cd-dvd/cdrkit/default.nix
+++ b/pkgs/tools/cd-dvd/cdrkit/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     ln -s $out/bin/wodim $out/bin/cdrecord
   '';
 
-  makeFlags = "PREFIX=\$(out)";
+  makeFlags = [ "PREFIX=\$(out)" ];
 
   meta = {
     description = "Portable command-line CD/DVD recorder software, mostly compatible with cdrtools";
diff --git a/pkgs/tools/cd-dvd/isomd5sum/default.nix b/pkgs/tools/cd-dvd/isomd5sum/default.nix
index 90315540aba..3bc1f886ccd 100644
--- a/pkgs/tools/cd-dvd/isomd5sum/default.nix
+++ b/pkgs/tools/cd-dvd/isomd5sum/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   makeFlags = [ "DESTDIR=${placeholder "out"}" ];
 
   # we don't install python stuff as it borks up directories
-  installTargets = "install-bin install-devel";
+  installTargets = [ "install-bin" "install-devel" ];
 
   meta = with stdenv.lib; {
     homepage = https://github.com/rhinstaller/isomd5sum;
diff --git a/pkgs/tools/cd-dvd/vobcopy/default.nix b/pkgs/tools/cd-dvd/vobcopy/default.nix
index f181ab71edf..48a58c0c7d1 100644
--- a/pkgs/tools/cd-dvd/vobcopy/default.nix
+++ b/pkgs/tools/cd-dvd/vobcopy/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [libdvdread libdvdcss];
-  makeFlags   = "DESTDIR=$(out) PREFIX=/";
+  makeFlags   = [ "DESTDIR=$(out)" "PREFIX=/" ];
 
   meta = {
     description = "Copies DVD .vob files to harddisk, decrypting them on the way";
diff --git a/pkgs/tools/compression/pbzip2/default.nix b/pkgs/tools/compression/pbzip2/default.nix
index 94ca5eb58b1..3314544084f 100644
--- a/pkgs/tools/compression/pbzip2/default.nix
+++ b/pkgs/tools/compression/pbzip2/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   preBuild = "substituteInPlace Makefile --replace g++ c++";
 
-  installFlags = "PREFIX=$(out)";
+  installFlags = [ "PREFIX=$(out)" ];
 
   NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-error=reserved-user-defined-literal";
 
diff --git a/pkgs/tools/filesystems/bees/default.nix b/pkgs/tools/filesystems/bees/default.nix
index 94573bcd201..c6bb07e7b87 100644
--- a/pkgs/tools/filesystems/bees/default.nix
+++ b/pkgs/tools/filesystems/bees/default.nix
@@ -2,8 +2,8 @@
 
 let
 
-  version = "0.6.1";
-  sha256 = "0h7idclmhyp14mq6786x7f2237vqpn70gyi88ik4g70xl84yfgyh";
+  version = "0.6.2";
+  sha256 = "05niv9rivd3j3cwcx3n3vjr85wr0l5i76giq9n54d2vdwmn8qjib";
 
   bees = stdenv.mkDerivation {
     pname = "bees";
diff --git a/pkgs/tools/filesystems/blobfuse/default.nix b/pkgs/tools/filesystems/blobfuse/default.nix
index 6fc0e3a7f21..3c6f6228329 100644
--- a/pkgs/tools/filesystems/blobfuse/default.nix
+++ b/pkgs/tools/filesystems/blobfuse/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "1qh04z1fsj1l6l12sz9yl2sy9hwlrnzac54hwrr7wvsgv90n9gbp";
   };
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=catch-value" ];
+  NIX_CFLAGS_COMPILE = "-Wno-error=catch-value";
 
   buildInputs = [ curl gnutls libgcrypt libuuid fuse ];
   nativeBuildInputs = [ cmake pkgconfig ];
diff --git a/pkgs/tools/filesystems/ciopfs/default.nix b/pkgs/tools/filesystems/ciopfs/default.nix
index 4a8c767e44a..533bb2322e7 100644
--- a/pkgs/tools/filesystems/ciopfs/default.nix
+++ b/pkgs/tools/filesystems/ciopfs/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ fuse glib attr ];
 
-  makeFlags = "DESTDIR=$(out) PREFIX=";
+  makeFlags = [ "DESTDIR=$(out)" "PREFIX=" ];
 
   meta = {
     homepage = http://www.brain-dump.org/projects/ciopfs/;
diff --git a/pkgs/tools/filesystems/glusterfs/default.nix b/pkgs/tools/filesystems/glusterfs/default.nix
index f9960722e82..b5fc12024b1 100644
--- a/pkgs/tools/filesystems/glusterfs/default.nix
+++ b/pkgs/tools/filesystems/glusterfs/default.nix
@@ -94,7 +94,7 @@ stdenv.mkDerivation
     ''--localstatedir=/var''
     ];
 
-  makeFlags = "DESTDIR=$(out)";
+  makeFlags = [ "DESTDIR=$(out)" ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/tools/filesystems/irods/default.nix b/pkgs/tools/filesystems/irods/default.nix
index 56fc2e40ba2..b6099c099f3 100644
--- a/pkgs/tools/filesystems/irods/default.nix
+++ b/pkgs/tools/filesystems/irods/default.nix
@@ -30,11 +30,8 @@ in rec {
     #                         but we don't use /usr with nix, so remove only 2 items.
     patches = [ ./irods_root_path.patch ];
 
-    NIX_CFLAGS_COMPILE = [
-      # fix build with recent llvm versions
-      "-Wno-deprecated-register"
-      "-Wno-deprecated-declarations"
-    ];
+    # fix build with recent llvm versions
+    NIX_CFLAGS_COMPILE = "-Wno-deprecated-register -Wno-deprecated-declarations";
 
     preConfigure = common.preConfigure + ''
       patchShebangs ./test
diff --git a/pkgs/tools/filesystems/nixpart/0.4/lvm2.nix b/pkgs/tools/filesystems/nixpart/0.4/lvm2.nix
index 7c92dc95268..804b052b61a 100644
--- a/pkgs/tools/filesystems/nixpart/0.4/lvm2.nix
+++ b/pkgs/tools/filesystems/nixpart/0.4/lvm2.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation {
   #patches = [ ./purity.patch ];
 
   # To prevent make install from failing.
-  preInstall = "installFlags=\"OWNER= GROUP= confdir=$out/etc\"";
+  installFlags = [ "OWNER=" "GROUP=" "confdir=${placeholder "out"}/etc" ];
 
   # Install systemd stuff.
   #installTargets = "install install_systemd_generators install_systemd_units install_tmpfiles_configuration";
diff --git a/pkgs/tools/filesystems/sasquatch/default.nix b/pkgs/tools/filesystems/sasquatch/default.nix
index c393c65a720..36ac3630e54 100644
--- a/pkgs/tools/filesystems/sasquatch/default.nix
+++ b/pkgs/tools/filesystems/sasquatch/default.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     cd squashfs-tools
   '';
 
-  installFlags = "INSTALL_DIR=\${out}/bin";
+  installFlags = [ "INSTALL_DIR=\${out}/bin" ];
 
   makeFlags = [ "XZ_SUPPORT=1" ]
     ++ stdenv.lib.optional lz4Support "LZ4_SUPPORT=1";
diff --git a/pkgs/tools/filesystems/squashfs/default.nix b/pkgs/tools/filesystems/squashfs/default.nix
index 15a535eed3b..f02a913bc25 100644
--- a/pkgs/tools/filesystems/squashfs/default.nix
+++ b/pkgs/tools/filesystems/squashfs/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation {
 
   preBuild = "cd squashfs-tools";
 
-  installFlags = "INSTALL_DIR=\${out}/bin";
+  installFlags = [ "INSTALL_DIR=\${out}/bin" ];
 
   makeFlags = [ "XZ_SUPPORT=1" "ZSTD_SUPPORT=1" ]
     ++ stdenv.lib.optional lz4Support "LZ4_SUPPORT=1";
diff --git a/pkgs/tools/filesystems/sshfs-fuse/default.nix b/pkgs/tools/filesystems/sshfs-fuse/default.nix
index 33fc5ce2ab6..af7ef8b8215 100644
--- a/pkgs/tools/filesystems/sshfs-fuse/default.nix
+++ b/pkgs/tools/filesystems/sshfs-fuse/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ fuse3 glib ];
   checkInputs = [ which python3Packages.pytest ];
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optional
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString
     (stdenv.hostPlatform.system == "i686-linux")
     "-D_FILE_OFFSET_BITS=64";
 
diff --git a/pkgs/tools/graphics/appleseed/default.nix b/pkgs/tools/graphics/appleseed/default.nix
index d7603c42fca..cafe0bb7b11 100644
--- a/pkgs/tools/graphics/appleseed/default.nix
+++ b/pkgs/tools/graphics/appleseed/default.nix
@@ -24,7 +24,7 @@ in stdenv.mkDerivation rec {
     osl seexpr makeWrapper
   ];
 
-  NIX_CFLAGS_COMPILE = [
+  NIX_CFLAGS_COMPILE = toString [
     "-I${openexr.dev}/include/OpenEXR"
     "-I${ilmbase.dev}/include/OpenEXR"
     "-I${openimageio.dev}/include/OpenImageIO"
@@ -33,6 +33,7 @@ in stdenv.mkDerivation rec {
     "-Wno-error=class-memaccess"
     "-Wno-error=maybe-uninitialized"
     "-Wno-error=catch-value"
+    "-Wno-error=stringop-truncation"
   ];
 
   cmakeFlags = [
diff --git a/pkgs/tools/graphics/argyllcms/default.nix b/pkgs/tools/graphics/argyllcms/default.nix
index 160b77229b3..1326d045459 100644
--- a/pkgs/tools/graphics/argyllcms/default.nix
+++ b/pkgs/tools/graphics/argyllcms/default.nix
@@ -94,9 +94,11 @@ stdenv.mkDerivation rec {
     libXrender libXScrnSaver libXdmcp libXau openssl
   ];
 
-  buildFlags = "PREFIX=$(out) all";
+  buildFlags = [ "all" ];
 
-  installFlags = "PREFIX=$(out)";
+  makeFlags = [
+    "PREFIX=${placeholder ''out''}"
+  ];
 
   # Install udev rules, but remove lines that set up the udev-acl
   # stuff, since that is handled by udev's own rules (70-udev-acl.rules)
diff --git a/pkgs/tools/graphics/asymptote/default.nix b/pkgs/tools/graphics/asymptote/default.nix
index 14b15686d72..31bdba26783 100644
--- a/pkgs/tools/graphics/asymptote/default.nix
+++ b/pkgs/tools/graphics/asymptote/default.nix
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
     "--with-context=$out/share/texmf/tex/context/third"
   ];
 
-  NIX_CFLAGS_COMPILE = [ "-I${boehmgc.dev}/include/gc" ];
+  NIX_CFLAGS_COMPILE = "-I${boehmgc.dev}/include/gc";
 
   postInstall = ''
     mv $out/share/info/asymptote/*.info $out/share/info/
diff --git a/pkgs/tools/graphics/dpic/default.nix b/pkgs/tools/graphics/dpic/default.nix
index d28f73dd91c..62fa83800cb 100644
--- a/pkgs/tools/graphics/dpic/default.nix
+++ b/pkgs/tools/graphics/dpic/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   phases = [ "unpackPhase" "buildPhase" "installPhase" ];
 
-  makeFlags = "CC=${stdenv.cc.outPath}/bin/cc";
+  makeFlags = [ "CC=${stdenv.cc.outPath}/bin/cc" ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/tools/graphics/fim/default.nix b/pkgs/tools/graphics/fim/default.nix
index 296ba43a5ed..3fc82a9c72a 100644
--- a/pkgs/tools/graphics/fim/default.nix
+++ b/pkgs/tools/graphics/fim/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     ++ optional jpegSupport libjpeg
     ++ optional pngSupport libpng;
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optional x11Support "-lSDL";
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString x11Support "-lSDL";
 
   meta = with stdenv.lib; {
     description = "A lightweight, highly customizable and scriptable image viewer";
diff --git a/pkgs/tools/graphics/gifsicle/default.nix b/pkgs/tools/graphics/gifsicle/default.nix
index 79b2708cb2b..9b3836b9dec 100644
--- a/pkgs/tools/graphics/gifsicle/default.nix
+++ b/pkgs/tools/graphics/gifsicle/default.nix
@@ -11,12 +11,11 @@ stdenv.mkDerivation rec {
     sha256 = "0rffpzxcak19k6cngpxn73khvm3z1gswrqs90ycdzzb53p05ddas";
   };
 
-  buildInputs = optional gifview [ xorgproto libXt libX11 ];
+  buildInputs = optionals gifview [ xorgproto libXt libX11 ];
 
-  configureFlags = []
-    ++ optional (!gifview) [ "--disable-gifview" ];
+  configureFlags = optional (!gifview) "--disable-gifview";
 
-  LDFLAGS = optional static "-static";
+  LDFLAGS = optionalString static "-static";
 
   doCheck = true;
   checkPhase = ''
diff --git a/pkgs/tools/graphics/graphviz/base.nix b/pkgs/tools/graphics/graphviz/base.nix
index 700bed237bd..3b9d8a4cca5 100644
--- a/pkgs/tools/graphics/graphviz/base.nix
+++ b/pkgs/tools/graphics/graphviz/base.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation {
   configureFlags = [
     "--with-ltdl-lib=${libtool.lib}/lib"
     "--with-ltdl-include=${libtool}/include"
-  ] ++ stdenv.lib.optional (xorg == null) [ "--without-x" ];
+  ] ++ stdenv.lib.optional (xorg == null) "--without-x";
 
   inherit patches;
 
diff --git a/pkgs/tools/graphics/kst/default.nix b/pkgs/tools/graphics/kst/default.nix
index 24d678e1142..480ae328cd3 100644
--- a/pkgs/tools/graphics/kst/default.nix
+++ b/pkgs/tools/graphics/kst/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake pkgconfig ];
   buildInputs = [ qtbase gsl getdata netcdf muparser matio ];
 
-  cmakeFlags = "-Dkst_qt5=1 -Dkst_release=1";
+  cmakeFlags = [ "-Dkst_qt5=1" "-Dkst_release=1" ];
 
   postInstall = ''
     mkdir -p $out
diff --git a/pkgs/tools/graphics/pfstools/default.nix b/pkgs/tools/graphics/pfstools/default.nix
index 6dafbfe2f9f..6a0385614e8 100644
--- a/pkgs/tools/graphics/pfstools/default.nix
+++ b/pkgs/tools/graphics/pfstools/default.nix
@@ -14,9 +14,7 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" "man"];
 
-  cmakeFlags = ''
-    -DWITH_MATLAB=false 
-  '';
+  cmakeFlags = [ "-DWITH_MATLAB=false" ];
 
   preConfigure = ''
     rm cmake/FindNETPBM.cmake
diff --git a/pkgs/tools/graphics/pngcheck/default.nix b/pkgs/tools/graphics/pngcheck/default.nix
index 6814a06e3b9..f7bd8d520c8 100644
--- a/pkgs/tools/graphics/pngcheck/default.nix
+++ b/pkgs/tools/graphics/pngcheck/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   hardeningDisable = [ "format" ];
 
   makefile = "Makefile.unx";
-  makeFlags = "ZPATH=${zlib.static}/lib";
+  makeFlags = [ "ZPATH=${zlib.static}/lib" ];
 
   buildInputs = [ zlib ];
 
diff --git a/pkgs/tools/graphics/quirc/default.nix b/pkgs/tools/graphics/quirc/default.nix
index 9891ea5e52b..4b610ebbfef 100644
--- a/pkgs/tools/graphics/quirc/default.nix
+++ b/pkgs/tools/graphics/quirc/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation {
     mkdir -p "$out"/{bin,lib,include}
     find . -maxdepth 1 -type f -perm -0100 -exec cp '{}' "$out"/bin ';'
   '';
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
   meta = {
     inherit (s) version;
     description = ''A small QR code decoding library'';
diff --git a/pkgs/tools/graphics/zbar/default.nix b/pkgs/tools/graphics/zbar/default.nix
index 9a071e6150f..7610b4e56fb 100644
--- a/pkgs/tools/graphics/zbar/default.nix
+++ b/pkgs/tools/graphics/zbar/default.nix
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
   ];
 
   # Disable assertions which include -dev QtBase file paths.
-  NIX_CFLAGS_COMPILE = [ "-DQT_NO_DEBUG" ];
+  NIX_CFLAGS_COMPILE = "-DQT_NO_DEBUG";
 
   configureFlags = [
     "--without-python"
diff --git a/pkgs/tools/misc/automirror/default.nix b/pkgs/tools/misc/automirror/default.nix
index 3bfb2d656d9..84778fb1c2d 100644
--- a/pkgs/tools/misc/automirror/default.nix
+++ b/pkgs/tools/misc/automirror/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ git ronn ];
 
-  installFlags = "DESTDIR=$(out)";
+  installFlags = [ "DESTDIR=$(out)" ];
 
   meta = with stdenv.lib; {
     homepage = https://github.com/schlomo/automirror;
diff --git a/pkgs/tools/misc/bibtool/default.nix b/pkgs/tools/misc/bibtool/default.nix
index 7664b96563b..df7564a4b84 100644
--- a/pkgs/tools/misc/bibtool/default.nix
+++ b/pkgs/tools/misc/bibtool/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   # Perl for running test suite.
   buildInputs = [ perl ];
 
-  installTargets = "install install.man";
+  installTargets = [ "install" "install.man" ];
 
   doCheck = true;
 
diff --git a/pkgs/tools/misc/bonfire/default.nix b/pkgs/tools/misc/bonfire/default.nix
index a5e4a42ef3c..12b0ad2abf1 100644
--- a/pkgs/tools/misc/bonfire/default.nix
+++ b/pkgs/tools/misc/bonfire/default.nix
@@ -3,9 +3,8 @@
 with python3Packages;
 
 buildPythonApplication rec {
-  version = "2017-01-19";
   pname = "bonfire";
-  name = "${pname}-unstable-${version}";
+  version = "unstable-2017-01-19";
 
   # use latest git version with --endpoint flag
   # https://github.com/blue-yonder/bonfire/pull/18
@@ -25,7 +24,7 @@ buildPythonApplication rec {
     # pip fails when encountering the git hash for the package version
     substituteInPlace setup.py \
       --replace "version=version," "version='${version}',"
-    # remove extraneous files  
+    # remove extraneous files
     substituteInPlace setup.cfg \
       --replace "data_files = *.rst, *.txt" ""
   '';
@@ -45,6 +44,6 @@ buildPythonApplication rec {
     license = licenses.bsd3;
     maintainers = [ maintainers.womfoo ];
     platforms = platforms.linux;
+    broken = true; # no longer compatible with new arrow package
   };
-
 }
diff --git a/pkgs/tools/misc/dylibbundler/default.nix b/pkgs/tools/misc/dylibbundler/default.nix
index 6bb9924ddd0..c4209442de8 100644
--- a/pkgs/tools/misc/dylibbundler/default.nix
+++ b/pkgs/tools/misc/dylibbundler/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
     sha256 = "1mpd43hvpfp7pskfrjnd6vcmfii9v3p97q0ws50krkdvshp0bv2h";
   };
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with stdenv.lib; {
     description = "Small command-line program that aims to make bundling .dylibs as easy as possible";
diff --git a/pkgs/tools/misc/fdupes/default.nix b/pkgs/tools/misc/fdupes/default.nix
index 8c303dd1e0c..af9a7c9a133 100644
--- a/pkgs/tools/misc/fdupes/default.nix
+++ b/pkgs/tools/misc/fdupes/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "19b6vqblddaw8ccw4sn0qsqzbswlhrz8ia6n4m3hymvcxn8skpz9";
   };
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with stdenv.lib; {
     description = "Identifies duplicate files residing within specified directories";
diff --git a/pkgs/tools/misc/file/default.nix b/pkgs/tools/misc/file/default.nix
index a06b38c0ec7..9dd3970bbb2 100644
--- a/pkgs/tools/misc/file/default.nix
+++ b/pkgs/tools/misc/file/default.nix
@@ -26,8 +26,7 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  makeFlags = if stdenv.hostPlatform.isWindows then "FILE_COMPILE=file"
-              else null;
+  makeFlags = stdenv.lib.optional stdenv.hostPlatform.isWindows "FILE_COMPILE=file";
 
   meta = with stdenv.lib; {
     homepage = https://darwinsys.com/file;
diff --git a/pkgs/tools/misc/fondu/default.nix b/pkgs/tools/misc/fondu/default.nix
index 33efd2bd614..772ae236764 100644
--- a/pkgs/tools/misc/fondu/default.nix
+++ b/pkgs/tools/misc/fondu/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "152prqad9jszjmm4wwqrq83zk13ypsz09n02nrk1gg0fcxfm7fr2";
   };
 
-  makeFlags = "DESTDIR=$(out)";
+  makeFlags = [ "DESTDIR=$(out)" ];
 
   hardeningDisable = [ "fortify" ];
 
diff --git a/pkgs/tools/misc/fontforge/default.nix b/pkgs/tools/misc/fontforge/default.nix
index e012d40271b..6239e839598 100644
--- a/pkgs/tools/misc/fontforge/default.nix
+++ b/pkgs/tools/misc/fontforge/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   '';
 
   # do not use x87's 80-bit arithmetic, rouding errors result in very different font binaries
-  NIX_CFLAGS_COMPILE = lib.optionals stdenv.isi686 [ "-msse2" "-mfpmath=sse" ];
+  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isi686 "-msse2 -mfpmath=sse";
 
   nativeBuildInputs = [ pkgconfig autoconf automake gnum4 libtool perl gettext ];
   buildInputs = [
diff --git a/pkgs/tools/misc/fzy/default.nix b/pkgs/tools/misc/fzy/default.nix
index 5b05ce534d7..24daa7fc81f 100644
--- a/pkgs/tools/misc/fzy/default.nix
+++ b/pkgs/tools/misc/fzy/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "1gkzdvj73f71388jvym47075l9zw61v6l8wdv2lnc0mns6dxig0k";
   };
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with stdenv.lib; {
     description = "A better fuzzy finder";
diff --git a/pkgs/tools/misc/ldmtool/default.nix b/pkgs/tools/misc/ldmtool/default.nix
index d1d3996bd62..2ec68348495 100644
--- a/pkgs/tools/misc/ldmtool/default.nix
+++ b/pkgs/tools/misc/ldmtool/default.nix
@@ -3,15 +3,15 @@
 , fetchpatch }:
 
 stdenv.mkDerivation rec {
-   pname = "ldmtool";
-   version = "0.2.4";
+  pname = "ldmtool";
+  version = "0.2.4";
 
-   src = fetchFromGitHub {
-     owner = "mdbooth";
-     repo = "libldm";
-     rev = "libldm-${version}";
-     sha256 = "1fy5wbmk8kwl86lzswq0d1z2j5y023qzfm2ppm8knzv9c47kniqk";
-   };
+  src = fetchFromGitHub {
+    owner = "mdbooth";
+    repo = "libldm";
+    rev = "libldm-${version}";
+    sha256 = "1fy5wbmk8kwl86lzswq0d1z2j5y023qzfm2ppm8knzv9c47kniqk";
+  };
 
   patches = [
     # Remove useage of deprecrated G_PARAM_PRIVATE
@@ -21,26 +21,26 @@ stdenv.mkDerivation rec {
     })
   ];
 
-   preConfigure = ''
-     sed -i docs/reference/ldmtool/Makefile.am \
-       -e 's|-nonet http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl|--nonet ${docbook_xsl}/xml/xsl/docbook/manpages/docbook.xsl|g'
-   '';
+  preConfigure = ''
+    sed -i docs/reference/ldmtool/Makefile.am \
+      -e 's|-nonet http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl|--nonet ${docbook_xsl}/xml/xsl/docbook/manpages/docbook.xsl|g'
+  '';
 
-   # glib-2.62 deprecations
-   NIX_CFLAGS_COMPILE = [ "-DGLIB_DISABLE_DEPRECATION_WARNINGS" ];
+  # glib-2.62 deprecations
+  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
-   configureScript = "sh autogen.sh";
+  configureScript = "sh autogen.sh";
 
-   nativeBuildInputs = [ pkgconfig ];
-   buildInputs = [ autoconf automake gtk-doc lvm2 libxslt.bin
-     libtool readline gobject-introspection json-glib libuuid
-   ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ autoconf automake gtk-doc lvm2 libxslt.bin
+    libtool readline gobject-introspection json-glib libuuid
+  ];
 
-   meta = with stdenv.lib; {
-     description = "Tool and library for managing Microsoft Windows Dynamic Disks";
-     homepage = https://github.com/mdbooth/libldm;
-     maintainers = with maintainers; [ jensbin ];
-     license = licenses.gpl3;
-     platforms = platforms.linux;
-   };
+  meta = with stdenv.lib; {
+    description = "Tool and library for managing Microsoft Windows Dynamic Disks";
+    homepage = https://github.com/mdbooth/libldm;
+    maintainers = with maintainers; [ jensbin ];
+    license = licenses.gpl3;
+    platforms = platforms.linux;
+  };
 }
diff --git a/pkgs/tools/misc/lf/default.nix b/pkgs/tools/misc/lf/default.nix
index 61e115e71eb..c2f281ecb17 100644
--- a/pkgs/tools/misc/lf/default.nix
+++ b/pkgs/tools/misc/lf/default.nix
@@ -15,8 +15,8 @@ buildGoModule rec {
 
   # TODO: Setting buildFlags probably isn't working properly. I've tried a few
   # variants, e.g.:
-  # - buildFlags = "-ldflags \"-s -w -X 'main.gVersion=${version}'\"";
-  # - buildFlags = "-ldflags \\\"-X ${goPackagePath}/main.gVersion=${version}\\\"";
+  # - buildFlags = [ "-ldflags" "\"-s" "-w"" ""-X 'main.gVersion=${version}'\"" ];
+  # - buildFlags = [ "-ldflags" "\\\"-X" "${goPackagePath}/main.gVersion=${version}\\\"" ];
   # Override the build phase (to set buildFlags):
   buildPhase = ''
     runHook preBuild
diff --git a/pkgs/tools/misc/memtest86+/default.nix b/pkgs/tools/misc/memtest86+/default.nix
index 48f048b3abf..57cf5bb97e2 100644
--- a/pkgs/tools/misc/memtest86+/default.nix
+++ b/pkgs/tools/misc/memtest86+/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation {
 
   hardeningDisable = [ "all" ];
 
-  buildFlags = "memtest.bin";
+  buildFlags = [ "memtest.bin" ];
 
   doCheck = false; # fails
 
diff --git a/pkgs/tools/misc/mktorrent/default.nix b/pkgs/tools/misc/mktorrent/default.nix
index b2f7fdf2a90..c88f12c74d1 100644
--- a/pkgs/tools/misc/mktorrent/default.nix
+++ b/pkgs/tools/misc/mktorrent/default.nix
@@ -11,13 +11,11 @@ stdenv.mkDerivation rec {
     sha256 = "17pdc5mandl739f8q26n5is8ga56s83aqcrwhlnnplbxwx2inidr";
   };
 
-  makeFlags = "USE_PTHREADS=1 USE_OPENSSL=1 USE_LONG_OPTIONS=1"
-    + stdenv.lib.optionalString stdenv.isi686 " USE_LARGE_FILES=1"
-    + stdenv.lib.optionalString stdenv.isLinux "CFLAGS=-lgcc_s";
+  makeFlags = [ "USE_PTHREADS=1" "USE_OPENSSL=1" "USE_LONG_OPTIONS=1" ]
+    ++ stdenv.lib.optional stdenv.isi686 "USE_LARGE_FILES=1"
+    ++ stdenv.lib.optional stdenv.isLinux "CFLAGS=-lgcc_s";
 
-  preInstall = ''
-    installFlags=PREFIX=$out
-  '';
+  installFlags = [ "PREFIX=${placeholder "out"}" ];
 
   buildInputs = [ openssl ];
 
diff --git a/pkgs/tools/misc/moreutils/default.nix b/pkgs/tools/misc/moreutils/default.nix
index 336d673f7ec..44f791e5b8a 100644
--- a/pkgs/tools/misc/moreutils/default.nix
+++ b/pkgs/tools/misc/moreutils/default.nix
@@ -20,8 +20,8 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = with perlPackages; [ perl IPCRun TimeDate TimeDuration ];
 
-  buildFlags = "CC=cc";
-  installFlags = "PREFIX=$(out)";
+  buildFlags = [ "CC=cc" ];
+  installFlags = [ "PREFIX=$(out)" ];
 
   postInstall = ''
     wrapProgram $out/bin/chronic --prefix PERL5LIB : $PERL5LIB
diff --git a/pkgs/tools/misc/multitail/default.nix b/pkgs/tools/misc/multitail/default.nix
index 92945004cb0..6ca0c6e8e08 100644
--- a/pkgs/tools/misc/multitail/default.nix
+++ b/pkgs/tools/misc/multitail/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ ncurses ];
 
-  makeFlags = stdenv.lib.optionalString stdenv.isDarwin "-f makefile.macosx";
+  makeFlags = stdenv.lib.optionals stdenv.isDarwin [ "-f" "makefile.macosx" ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/tools/misc/osm2pgsql/default.nix b/pkgs/tools/misc/osm2pgsql/default.nix
index 007ae348bc2..54da1a16401 100644
--- a/pkgs/tools/misc/osm2pgsql/default.nix
+++ b/pkgs/tools/misc/osm2pgsql/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ expat proj bzip2 zlib boost postgresql lua ];
 
-  NIX_CFLAGS_COMPILE = [ "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H" ];
+  NIX_CFLAGS_COMPILE = "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H";
 
   meta = with stdenv.lib; {
     description = "OpenStreetMap data to PostgreSQL converter";
diff --git a/pkgs/tools/misc/pal/default.nix b/pkgs/tools/misc/pal/default.nix
index be96dd9d3d3..85bad70edc9 100644
--- a/pkgs/tools/misc/pal/default.nix
+++ b/pkgs/tools/misc/pal/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sed -i -e 's,/etc/pal\.conf,'$out/etc/pal.conf, src/input.c
   '';
 
-  makeFlags = "prefix=$(out)";
+  makeFlags = [ "prefix=$(out)" ];
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ glib gettext readline ];
diff --git a/pkgs/tools/misc/parcellite/default.nix b/pkgs/tools/misc/parcellite/default.nix
index 8dcaed706c1..46606e3b43b 100644
--- a/pkgs/tools/misc/parcellite/default.nix
+++ b/pkgs/tools/misc/parcellite/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook intltool pkgconfig wrapGAppsHook ];
   buildInputs = [ gtk2 hicolor-icon-theme ];
-  NIX_LDFLAGS = [ "-lgio-2.0" ];
+  NIX_LDFLAGS = "-lgio-2.0";
 
   preFixup = ''
     # Need which and xdotool on path to fix auto-pasting.
diff --git a/pkgs/tools/misc/pws/default.nix b/pkgs/tools/misc/pws/default.nix
index d5f2fd4afd4..50952435dd7 100644
--- a/pkgs/tools/misc/pws/default.nix
+++ b/pkgs/tools/misc/pws/default.nix
@@ -3,19 +3,19 @@
 stdenv.mkDerivation rec {
   name = "pws-${(import ./gemset.nix).pws.version}";
 
-  env = bundlerEnv {
-    name = "${name}-gems";
-
-    inherit ruby;
-
-    gemdir = ./.;
-  };
-
   buildInputs = [ makeWrapper ];
 
   phases = ["installPhase"];
 
-  installPhase = ''
+  installPhase = let
+    env = bundlerEnv {
+      name = "${name}-gems";
+
+      inherit ruby;
+
+      gemdir = ./.;
+    };
+  in ''
     mkdir -p $out/bin
     makeWrapper ${env}/bin/pws $out/bin/pws \
       --set PATH '"${xsel}/bin/:$PATH"'
diff --git a/pkgs/tools/misc/qjoypad/default.nix b/pkgs/tools/misc/qjoypad/default.nix
index 4428bf1e625..3e7e3870959 100644
--- a/pkgs/tools/misc/qjoypad/default.nix
+++ b/pkgs/tools/misc/qjoypad/default.nix
@@ -7,7 +7,7 @@ stdenv.mkDerivation rec {
   };
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libX11 libXtst qt4 ];
-  NIX_LDFLAGS = [ "-lX11" ];
+  NIX_LDFLAGS = "-lX11";
   patchPhase = ''
     cd src
     substituteInPlace config --replace /bin/bash ${stdenv.shell}
diff --git a/pkgs/tools/misc/snapper/default.nix b/pkgs/tools/misc/snapper/default.nix
index ee47c17065f..466a5f3faf1 100644
--- a/pkgs/tools/misc/snapper/default.nix
+++ b/pkgs/tools/misc/snapper/default.nix
@@ -49,9 +49,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = [
-    "-I${libxml2.dev}/include/libxml2"
-  ];
+  NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
 
   postInstall = ''
     rm -r $out/etc/cron.*
diff --git a/pkgs/tools/misc/svtplay-dl/default.nix b/pkgs/tools/misc/svtplay-dl/default.nix
index b530193258c..66ed0a11fd9 100644
--- a/pkgs/tools/misc/svtplay-dl/default.nix
+++ b/pkgs/tools/misc/svtplay-dl/default.nix
@@ -26,7 +26,7 @@ in stdenv.mkDerivation rec {
       --replace 'PYTHONPATH=lib' 'PYTHONPATH=lib:$PYTHONPATH'
   '';
 
-  makeFlags = "PREFIX=$(out) SYSCONFDIR=$(out)/etc PYTHON=${python.interpreter}";
+  makeFlags = [ "PREFIX=$(out)" "SYSCONFDIR=$(out)/etc" "PYTHON=${python.interpreter}" ];
 
   postInstall = ''
     wrapProgram "$out/bin/svtplay-dl" \
diff --git a/pkgs/tools/misc/teleconsole/default.nix b/pkgs/tools/misc/teleconsole/default.nix
index 4cac9befe16..b8e984e90c4 100644
--- a/pkgs/tools/misc/teleconsole/default.nix
+++ b/pkgs/tools/misc/teleconsole/default.nix
@@ -16,7 +16,7 @@ buildGoPackage rec {
   goDeps = ./deps.nix;
 
   CGO_ENABLED = 1;
-  buildFlags = "-ldflags";
+  buildFlags = [ "-ldflags" ];
 
   meta = with stdenv.lib; {
     homepage = "https://www.teleconsole.com/";
diff --git a/pkgs/tools/misc/timidity/default.nix b/pkgs/tools/misc/timidity/default.nix
index 318ad6e3a9d..c307c96199f 100644
--- a/pkgs/tools/misc/timidity/default.nix
+++ b/pkgs/tools/misc/timidity/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
 
   configureFlags = [ "--enable-audio=oss,alsa,jack" "--enable-alsaseq" "--with-default-output=alsa" "--enable-ncurses" ];
 
-  NIX_LDFLAGS = ["-ljack -L${libjack2}/lib"];
+  NIX_LDFLAGS = "-ljack -L${libjack2}/lib";
 
   instruments = fetchurl {
     url = http://www.csee.umbc.edu/pub/midia/instruments.tar.gz;
diff --git a/pkgs/tools/misc/tmpwatch/default.nix b/pkgs/tools/misc/tmpwatch/default.nix
index 59aa3861510..006cef6f102 100644
--- a/pkgs/tools/misc/tmpwatch/default.nix
+++ b/pkgs/tools/misc/tmpwatch/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation {
     sha256 = "1m5859ngwx61l1i4s6fja2avf1hyv6w170by273w8nsin89825lk";
   };
 
-  configureFlags="--with-fuser=${psmisc}/bin/fuser";
+  configureFlags = [ "--with-fuser=${psmisc}/bin/fuser" ];
 
   meta = with stdenv.lib; {
     homepage = https://fedorahosted.org/tmpwatch/;
diff --git a/pkgs/tools/misc/toybox/default.nix b/pkgs/tools/misc/toybox/default.nix
index ccf8113e1a5..b863786145c 100644
--- a/pkgs/tools/misc/toybox/default.nix
+++ b/pkgs/tools/misc/toybox/default.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "PREFIX=$(out)/bin" ] ++ lib.optional enableStatic "LDFLAGS=--static";
 
-  installTargets = "install_flat";
+  installTargets = [ "install_flat" ];
 
   # tests currently (as of 0.8.0) get stuck in an infinite loop...
   # ...this is fixed in latest git, so doCheck can likely be enabled for next release
diff --git a/pkgs/tools/misc/tty-clock/default.nix b/pkgs/tools/misc/tty-clock/default.nix
index edaa9b662e7..b261f0ef841 100644
--- a/pkgs/tools/misc/tty-clock/default.nix
+++ b/pkgs/tools/misc/tty-clock/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ ncurses ];
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with stdenv.lib; {
     homepage = https://github.com/xorg62/tty-clock;
diff --git a/pkgs/tools/misc/vmtouch/default.nix b/pkgs/tools/misc/vmtouch/default.nix
index e5bb23016ae..fda442a6729 100644
--- a/pkgs/tools/misc/vmtouch/default.nix
+++ b/pkgs/tools/misc/vmtouch/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [perl];
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   meta = {
     description = "Portable file system cache diagnostics and control";
diff --git a/pkgs/tools/misc/wyrd/default.nix b/pkgs/tools/misc/wyrd/default.nix
index ec516555273..6a5ec867222 100644
--- a/pkgs/tools/misc/wyrd/default.nix
+++ b/pkgs/tools/misc/wyrd/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "0zlrg602q781q8dij62lwdprpfliyy9j1rqfqcz8p2wgndpivddj";
   };
 
-  NIX_CFLAGS_COMPILE = [ "-DNCURSES_INTERNALS=1" ];
+  NIX_CFLAGS_COMPILE = "-DNCURSES_INTERNALS=1";
 
   preConfigure = ''
     substituteInPlace curses/curses.ml --replace 'pp gcc' "pp $CC"
diff --git a/pkgs/tools/misc/xdo/default.nix b/pkgs/tools/misc/xdo/default.nix
index f042b9e209f..77a2ef763a9 100644
--- a/pkgs/tools/misc/xdo/default.nix
+++ b/pkgs/tools/misc/xdo/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
      sha256 = "1h3jrygcjjbavdbkpx2hscsf0yf97gk487lzjdlvymd7dxdv9hy9";
    };
 
-   makeFlags = "PREFIX=$(out)";
+   makeFlags = [ "PREFIX=$(out)" ];
 
    buildInputs = [ libxcb xcbutilwm xcbutil ];
 
diff --git a/pkgs/tools/misc/xsel/default.nix b/pkgs/tools/misc/xsel/default.nix
index 3d2fb50371e..4c39babc317 100644
--- a/pkgs/tools/misc/xsel/default.nix
+++ b/pkgs/tools/misc/xsel/default.nix
@@ -3,13 +3,13 @@
 stdenv.mkDerivation {
   pname = "xsel-unstable";
 
-  version = "2018-01-10";
+  version = "2019-08-21";
 
   src = fetchFromGitHub {
     owner = "kfish";
     repo = "xsel";
-    rev = "9bfc13d64b5acb92c6648c696a9d9260fcbecc65";
-    sha256 = "05ms34by5hxznnpvmvhgp6llvlkz0zw4sq6c4bgwr82lj140lscm";
+    rev = "ef01f3c72a195dbce682184c842b81b17d7d7ad1";
+    sha256 = "191qa6022b7nww3bicfxpgp4d9x6c8s3sgixi780383ghkxds08c";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/tools/networking/altermime/default.nix b/pkgs/tools/networking/altermime/default.nix
index e9091086ed9..b1481b2208c 100644
--- a/pkgs/tools/networking/altermime/default.nix
+++ b/pkgs/tools/networking/altermime/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "15zxg6spcmd35r6xbidq2fgcg2nzyv1sbbqds08lzll70mqx4pj7";
   };
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=format"
+  NIX_CFLAGS_COMPILE = toString [
+    "-Wno-error=format"
     "-Wno-error=format-truncation"
     "-Wno-error=pointer-compare"
     "-Wno-error=memset-elt-size"
diff --git a/pkgs/tools/networking/atinout/default.nix b/pkgs/tools/networking/atinout/default.nix
index 175ba3960ee..16b3ee668da 100644
--- a/pkgs/tools/networking/atinout/default.nix
+++ b/pkgs/tools/networking/atinout/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
   name = "atinout-${version}";
   version = "0.9.2-alpha";
 
-  NIX_CFLAGS_COMPILE = [ "-Werror=implicit-fallthrough=0" ];
+  NIX_CFLAGS_COMPILE = "-Werror=implicit-fallthrough=0";
   LANG = "C.UTF-8";
   nativeBuildInputs = [ ronn mount ];
 
diff --git a/pkgs/tools/networking/bwm-ng/default.nix b/pkgs/tools/networking/bwm-ng/default.nix
index 4637a39e6e9..8e766cdeeb5 100644
--- a/pkgs/tools/networking/bwm-ng/default.nix
+++ b/pkgs/tools/networking/bwm-ng/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
      void sigint(int sig) FUNCATTR_NORETURN;
     -inline void init(void);
     +static inline void init(void);
-     
+
      /* clear stuff and exit */
     --- a/src/options.c
     +++ b/src/options.c
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
 
 
   # This code uses inline in the gnu89 sense: see http://clang.llvm.org/compatibility.html#inline
-  NIX_CFLAGS_COMPILE = if stdenv.cc.isClang then "-std=gnu89" else null;
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-std=gnu89";
 
   meta = with stdenv.lib; {
     description = "A small and simple console-based live network and disk io bandwidth monitor";
diff --git a/pkgs/tools/networking/chrony/default.nix b/pkgs/tools/networking/chrony/default.nix
index c0c3281431f..2ec16aa430a 100644
--- a/pkgs/tools/networking/chrony/default.nix
+++ b/pkgs/tools/networking/chrony/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   hardeningEnable = [ "pie" ];
 
   configureFlags = [ "--chronyvardir=$(out)/var/lib/chrony" ]
-    ++ stdenv.lib.optional stdenv.isLinux [ "--enable-scfilter" ];
+    ++ stdenv.lib.optional stdenv.isLinux "--enable-scfilter";
 
   meta = with stdenv.lib; {
     description = "Sets your computer's clock from time servers on the Net";
diff --git a/pkgs/tools/networking/cjdns/default.nix b/pkgs/tools/networking/cjdns/default.nix
index f9dc3de7735..df94de882be 100644
--- a/pkgs/tools/networking/cjdns/default.nix
+++ b/pkgs/tools/networking/cjdns/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
     # for flock
     stdenv.lib.optional stdenv.isLinux utillinux;
 
-  CFLAGS = "-O2";
+  CFLAGS = "-O2 -Wno-error=stringop-truncation";
   buildPhase =
     stdenv.lib.optionalString stdenv.isAarch32 "Seccomp_NO=1 "
     + "bash do";
diff --git a/pkgs/tools/networking/dhcp/default.nix b/pkgs/tools/networking/dhcp/default.nix
index bcf0743b7b9..c5d650f52bb 100644
--- a/pkgs/tools/networking/dhcp/default.nix
+++ b/pkgs/tools/networking/dhcp/default.nix
@@ -36,12 +36,14 @@ stdenv.mkDerivation rec {
     "--enable-early-chroot"
     "--sysconfdir=/etc"
     "--localstatedir=/var"
-    (lib.optional stdenv.isLinux "--with-randomdev=/dev/random")
-  ] ++ stdenv.lib.optionals (openldap != null) [ "--with-ldap" "--with-ldapcrypto" ];
+  ] ++ lib.optional stdenv.isLinux "--with-randomdev=/dev/random"
+    ++ stdenv.lib.optionals (openldap != null) [ "--with-ldap" "--with-ldapcrypto" ];
 
-  NIX_CFLAGS_COMPILE = [
+  NIX_CFLAGS_COMPILE = builtins.toString [
     "-Wno-error=pointer-compare"
     "-Wno-error=format-truncation"
+    "-Wno-error=stringop-truncation"
+    "-Wno-error=format-overflow"
   ];
 
   installFlags = [ "DESTDIR=\${out}" ];
diff --git a/pkgs/tools/networking/iodine/default.nix b/pkgs/tools/networking/iodine/default.nix
index 5aa0c01e848..44bf52c9933 100644
--- a/pkgs/tools/networking/iodine/default.nix
+++ b/pkgs/tools/networking/iodine/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   NIX_CFLAGS_COMPILE = "-DIFCONFIGPATH=\"${nettools}/bin/\"";
 
-  installFlags = "prefix=\${out}";
+  installFlags = [ "prefix=\${out}" ];
 
   meta = {
     homepage = http://code.kryo.se/iodine/;
diff --git a/pkgs/tools/networking/ipv6calc/default.nix b/pkgs/tools/networking/ipv6calc/default.nix
index 5de4b8cecb7..35aeb23a9a8 100644
--- a/pkgs/tools/networking/ipv6calc/default.nix
+++ b/pkgs/tools/networking/ipv6calc/default.nix
@@ -30,13 +30,9 @@ stdenv.mkDerivation rec {
     "--disable-bundled-md5"
     "--disable-dynamic-load"
     "--enable-shared"
-  ] ++ stdenv.lib.optional (libmaxminddb != null ) [
-    "--enable-mmdb"
-  ] ++ stdenv.lib.optional (geolite-legacy != null) [
-    "--with-geoip-db=${geolite-legacy}/share/GeoIP"
-  ] ++ stdenv.lib.optional (ip2location-c != null ) [
-    "--enable-ip2location"
-  ];
+  ] ++ stdenv.lib.optional (libmaxminddb != null) "--enable-mmdb"
+    ++ stdenv.lib.optional (geolite-legacy != null) "--with-geoip-db=${geolite-legacy}/share/GeoIP"
+    ++ stdenv.lib.optional (ip2location-c != null) "--enable-ip2location";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/tools/networking/libreswan/default.nix b/pkgs/tools/networking/libreswan/default.nix
index 0f043c58a18..4c8b926b582 100644
--- a/pkgs/tools/networking/libreswan/default.nix
+++ b/pkgs/tools/networking/libreswan/default.nix
@@ -26,11 +26,12 @@ stdenv.mkDerivation {
   };
 
   # These flags were added to compile v3.18. Try to lift them when updating.
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=redundant-decls" "-Wno-error=format-nonliteral"
+  NIX_CFLAGS_COMPILE = toString [ "-Wno-error=redundant-decls" "-Wno-error=format-nonliteral"
     # these flags were added to build with gcc7
     "-Wno-error=implicit-fallthrough"
     "-Wno-error=format-truncation"
     "-Wno-error=pointer-compare"
+    "-Wno-error=stringop-truncation"
   ];
 
   nativeBuildInputs = [ makeWrapper pkgconfig ];
diff --git a/pkgs/tools/networking/maphosts/default.nix b/pkgs/tools/networking/maphosts/default.nix
index e54a2b21d9f..dd9886a65ee 100644
--- a/pkgs/tools/networking/maphosts/default.nix
+++ b/pkgs/tools/networking/maphosts/default.nix
@@ -1,13 +1,13 @@
 { stdenv, lib, bundlerEnv, ruby, bundlerUpdateScript }:
 
-stdenv.mkDerivation rec {
-  name = "maphosts-${env.gems.maphosts.version}";
-
+let
   env = bundlerEnv {
     name = "maphosts-gems";
     inherit ruby;
     gemdir = ./.;
   };
+in stdenv.mkDerivation {
+  name = "maphosts-${env.gems.maphosts.version}";
 
   phases = ["installPhase"];
 
diff --git a/pkgs/tools/networking/network-manager/iodine/default.nix b/pkgs/tools/networking/network-manager/iodine/default.nix
index 1b41a176723..29c0d550fe2 100644
--- a/pkgs/tools/networking/network-manager/iodine/default.nix
+++ b/pkgs/tools/networking/network-manager/iodine/default.nix
@@ -30,7 +30,7 @@ in stdenv.mkDerivation {
   nativeBuildInputs = [ intltool pkgconfig ];
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = [ "-DGLIB_DISABLE_DEPRECATION_WARNINGS" ];
+  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   configureFlags = [
     "--without-libnm-glib"
diff --git a/pkgs/tools/networking/network-manager/strongswan.nix b/pkgs/tools/networking/network-manager/strongswan.nix
index 8d16f71c4af..843985bfa3e 100644
--- a/pkgs/tools/networking/network-manager/strongswan.nix
+++ b/pkgs/tools/networking/network-manager/strongswan.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ intltool pkgconfig ];
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = [ "-DGLIB_DISABLE_DEPRECATION_WARNINGS" ];
+  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   configureFlags = [
     "--without-libnm-glib"
diff --git a/pkgs/tools/networking/nfstrace/default.nix b/pkgs/tools/networking/nfstrace/default.nix
index 50654da54e4..72a0ea3682b 100644
--- a/pkgs/tools/networking/nfstrace/default.nix
+++ b/pkgs/tools/networking/nfstrace/default.nix
@@ -22,9 +22,9 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake ];
 
   # To build with GCC 8+ it needs:
-  CXXFLAGS = [ "-Wno-class-memaccess" "-Wno-ignored-qualifiers" ];
+  CXXFLAGS = "-Wno-class-memaccess -Wno-ignored-qualifiers";
   # CMake can't find json_c without:
-  NIX_CFLAGS_COMPILE = [ "-I${json_c.dev}/include/json-c" ];
+  NIX_CFLAGS_COMPILE = "-I${json_c.dev}/include/json-c";
 
   doCheck = false; # requires network access
 
diff --git a/pkgs/tools/networking/ntopng/default.nix b/pkgs/tools/networking/ntopng/default.nix
index 0c693ac6288..68f80106031 100644
--- a/pkgs/tools/networking/ntopng/default.nix
+++ b/pkgs/tools/networking/ntopng/default.nix
@@ -54,8 +54,8 @@ stdenv.mkDerivation rec {
     sed 's|LIBS += -lstdc++.6||' -i Makefile
   '';
 
-  NIX_CFLAGS_COMPILE = [ "-fpermissive" ]
-    ++ stdenv.lib.optional stdenv.cc.isClang "-Wno-error=reserved-user-defined-literal";
+  NIX_CFLAGS_COMPILE = "-fpermissive"
+    + stdenv.lib.optionalString stdenv.cc.isClang " -Wno-error=reserved-user-defined-literal";
 
   meta = with stdenv.lib; {
     description = "High-speed web-based traffic analysis and flow collection tool";
diff --git a/pkgs/tools/networking/openresolv/default.nix b/pkgs/tools/networking/openresolv/default.nix
index 190c903d9c1..423282aa8c1 100644
--- a/pkgs/tools/networking/openresolv/default.nix
+++ b/pkgs/tools/networking/openresolv/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
       EOF
     '';
 
-  installFlags = "SYSCONFDIR=$(out)/etc";
+  installFlags = [ "SYSCONFDIR=$(out)/etc" ];
 
   postInstall = ''
     wrapProgram "$out/sbin/resolvconf" --set PATH "${coreutils}/bin"
diff --git a/pkgs/tools/networking/packetdrill/default.nix b/pkgs/tools/networking/packetdrill/default.nix
index 2041d935c94..623645efc0c 100644
--- a/pkgs/tools/networking/packetdrill/default.nix
+++ b/pkgs/tools/networking/packetdrill/default.nix
@@ -11,7 +11,11 @@ stdenv.mkDerivation {
   setSourceRoot = ''
     export sourceRoot=$(realpath */gtests/net/packetdrill)
   '';
-  NIX_CFLAGS_COMPILE = "-Wno-error=unused-result";
+  NIX_CFLAGS_COMPILE = [
+    "-Wno-error=unused-result"
+    "-Wno-error=stringop-truncation"
+    "-Wno-error=address-of-packed-member"
+  ];
   nativeBuildInputs = [ bison flex ];
   patches = [ ./nix.patch ];
   enableParallelBuilding = true;
diff --git a/pkgs/tools/networking/ratools/default.nix b/pkgs/tools/networking/ratools/default.nix
index cf8c370c522..f5353db6803 100644
--- a/pkgs/tools/networking/ratools/default.nix
+++ b/pkgs/tools/networking/ratools/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "07m45bn9lzgbfihmxic23wqp73nxg5ihrvkigr450jq6gzvgwawq";
   };
 
-  makeFlags = "-C src";
+  makeFlags = [ "-C" "src" ];
 
   installPhase = ''
     install -vD bin/* -t $out/bin
diff --git a/pkgs/tools/networking/shadowfox/default.nix b/pkgs/tools/networking/shadowfox/default.nix
index 8a2dee19b95..f2ae143e1b9 100644
--- a/pkgs/tools/networking/shadowfox/default.nix
+++ b/pkgs/tools/networking/shadowfox/default.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
 
   modSha256 = "0hcc87mzacqwbw10l49kx0sxl4mivdr88c40wh6hdfvrbam2w86r";
 
-  buildFlags = "--tags release";
+  buildFlags = [ "--tags" "release" ];
 
   meta = with stdenv.lib; {
     description = ''
diff --git a/pkgs/tools/networking/snabb/default.nix b/pkgs/tools/networking/snabb/default.nix
index ba05ee8e8b5..9471efa92d7 100644
--- a/pkgs/tools/networking/snabb/default.nix
+++ b/pkgs/tools/networking/snabb/default.nix
@@ -17,6 +17,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ makeWrapper ];
 
+  NIX_CFLAGS_COMPILE = [ "-Wno-error=stringop-truncation" ];
+
   patchPhase = ''
     patchShebangs .
 
diff --git a/pkgs/tools/networking/ssmtp/default.nix b/pkgs/tools/networking/ssmtp/default.nix
index ebe31dc8b5a..81da427a52c 100644
--- a/pkgs/tools/networking/ssmtp/default.nix
+++ b/pkgs/tools/networking/ssmtp/default.nix
@@ -30,13 +30,13 @@ stdenv.mkDerivation {
         --replace '$(INSTALL) -s' '$(INSTALL) -s --strip-program $(STRIP)'
     '';
 
-  installFlags = "etcdir=$(out)/etc";
+  installFlags = [ "etcdir=$(out)/etc" ];
 
   installTargets = [ "install" "install-sendmail" ];
 
   buildInputs = stdenv.lib.optional tlsSupport openssl;
 
-  NIX_LDFLAGS = stdenv.lib.optional tlsSupport [ "-lcrypto" ];
+  NIX_LDFLAGS = stdenv.lib.optionalString tlsSupport "-lcrypto";
 
   meta = with stdenv.lib; {
     platforms = platforms.linux;
diff --git a/pkgs/tools/networking/tracebox/default.nix b/pkgs/tools/networking/tracebox/default.nix
index 4062fc0fd58..1d3c4190e38 100644
--- a/pkgs/tools/networking/tracebox/default.nix
+++ b/pkgs/tools/networking/tracebox/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--with-lua=yes" ];
 
-  NIX_LDFLAGS = [ "${libpcap}/lib/libpcap.so" "${libcrafter}/lib/libcrafter.so" ];
+  NIX_LDFLAGS = "${libpcap}/lib/libpcap.so ${libcrafter}/lib/libcrafter.so";
 
   preAutoreconf = ''
     substituteInPlace Makefile.am --replace "noinst" ""
diff --git a/pkgs/tools/networking/traceroute/default.nix b/pkgs/tools/networking/traceroute/default.nix
index af8f5cafb89..8591db4e016 100644
--- a/pkgs/tools/networking/traceroute/default.nix
+++ b/pkgs/tools/networking/traceroute/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "3669d22a34d3f38ed50caba18cd525ba55c5c00d5465f2d20d7472e5d81603b6";
   };
 
-  makeFlags = "prefix=$(out) LDFLAGS=-lm";
+  makeFlags = [ "prefix=$(out)" "LDFLAGS=-lm" ];
 
   preConfigure = ''
     sed -i 's@LIBS := \(.*\) -lm \(.*\)@LIBS := \1 \2@' Make.rules
diff --git a/pkgs/tools/networking/vde2/default.nix b/pkgs/tools/networking/vde2/default.nix
index 4ea09cd7f00..e43c174ab3f 100644
--- a/pkgs/tools/networking/vde2/default.nix
+++ b/pkgs/tools/networking/vde2/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
     }
   );
 
-  configureFlags = stdenv.lib.optional (!withPython) [ "--disable-python" ];
+  configureFlags = stdenv.lib.optional (!withPython) "--disable-python";
 
   buildInputs = [ openssl libpcap ]
     ++ stdenv.lib.optional withPython python2;
diff --git a/pkgs/tools/networking/wrk/default.nix b/pkgs/tools/networking/wrk/default.nix
index 9c8f46bef07..98705430c2f 100644
--- a/pkgs/tools/networking/wrk/default.nix
+++ b/pkgs/tools/networking/wrk/default.nix
@@ -22,13 +22,13 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  NIX_CFLAGS_COMPILE = [ "-DluaL_reg=luaL_Reg" ]; # needed since luajit-2.1.0-beta3
-  
+  NIX_CFLAGS_COMPILE = "-DluaL_reg=luaL_Reg"; # needed since luajit-2.1.0-beta3
+
   installPhase = ''
     mkdir -p $out/bin
     cp wrk $out/bin
   '';
-  
+
   meta = with stdenv.lib; {
     description = "HTTP benchmarking tool";
     homepage = https://github.com/wg/wrk;
diff --git a/pkgs/tools/package-management/clib/default.nix b/pkgs/tools/package-management/clib/default.nix
index eb8f5ef186f..75c47dda0c4 100644
--- a/pkgs/tools/package-management/clib/default.nix
+++ b/pkgs/tools/package-management/clib/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "fortify" ];
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   buildInputs = [ curl ];
 
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index e2ec35d0ad0..33ec396e5d2 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -94,9 +94,9 @@ common =
            # RISC-V support in progress https://github.com/seccomp/libseccomp/pull/50
         ++ lib.optional (!withLibseccomp) "--disable-seccomp-sandboxing";
 
-      makeFlags = "profiledir=$(out)/etc/profile.d";
+      makeFlags = [ "profiledir=$(out)/etc/profile.d" ];
 
-      installFlags = "sysconfdir=$(out)/etc";
+      installFlags = [ "sysconfdir=$(out)/etc" ];
 
       doInstallCheck = true; # not cross
 
diff --git a/pkgs/tools/package-management/xbps/default.nix b/pkgs/tools/package-management/xbps/default.nix
index 2be1db764e1..7ff079c0116 100644
--- a/pkgs/tools/package-management/xbps/default.nix
+++ b/pkgs/tools/package-management/xbps/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./cert-paths.patch ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=unused-result" ];
+  NIX_CFLAGS_COMPILE = "-Wno-error=unused-result";
 
   postPatch = ''
     # fix unprefixed ranlib (needed on cross)
diff --git a/pkgs/tools/security/aws-okta/default.nix b/pkgs/tools/security/aws-okta/default.nix
index f960245e2b3..66a9f61eefb 100644
--- a/pkgs/tools/security/aws-okta/default.nix
+++ b/pkgs/tools/security/aws-okta/default.nix
@@ -15,7 +15,7 @@ buildGoPackage rec {
 
   goDeps = ./deps.nix;
 
-  buildFlags = "--tags release";
+  buildFlags = [ "--tags" "release" ];
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libusb1  libiconv ];
diff --git a/pkgs/tools/security/crunch/default.nix b/pkgs/tools/security/crunch/default.nix
index 57943a31406..259ee38c68f 100644
--- a/pkgs/tools/security/crunch/default.nix
+++ b/pkgs/tools/security/crunch/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation  rec {
       --replace 'sudo ' ""
   '';
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with stdenv.lib; {
     description = "Wordlist generator";
diff --git a/pkgs/tools/security/fwknop/default.nix b/pkgs/tools/security/fwknop/default.nix
index 4579136add2..a9f69c8b96e 100644
--- a/pkgs/tools/security/fwknop/default.nix
+++ b/pkgs/tools/security/fwknop/default.nix
@@ -19,8 +19,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ libpcap texinfo ]
-    ++ stdenv.lib.optional gnupgSupport [ gnupg gpgme.dev ]
-    ++ stdenv.lib.optional wgetSupport [ wget ];
+    ++ stdenv.lib.optionals gnupgSupport [ gnupg gpgme.dev ]
+    ++ stdenv.lib.optionals wgetSupport [ wget ];
 
   configureFlags = [
     "--sysconfdir=/etc"
diff --git a/pkgs/tools/security/gpgstats/default.nix b/pkgs/tools/security/gpgstats/default.nix
index 34e8c7bd679..c3a14f62c76 100644
--- a/pkgs/tools/security/gpgstats/default.nix
+++ b/pkgs/tools/security/gpgstats/default.nix
@@ -16,8 +16,8 @@ stdenv.mkDerivation rec {
     cp gpgstats $out/bin
   '';
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionals (!stdenv.is64bit)
-    [ "-D_FILE_OFFSET_BITS=64" "-DLARGEFILE_SOURCE=1" ];
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString (!stdenv.is64bit)
+    "-D_FILE_OFFSET_BITS=64 -DLARGEFILE_SOURCE=1";
 
   meta = with stdenv.lib; {
     description = "Calculates statistics on the keys in your gpg key-ring";
diff --git a/pkgs/tools/security/meo/default.nix b/pkgs/tools/security/meo/default.nix
index 19f51775ff2..d10c1659964 100644
--- a/pkgs/tools/security/meo/default.nix
+++ b/pkgs/tools/security/meo/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
     sha256 = "0ifg7y28s89i9gwda6fyj1jbrykbcvq8bf1m6rxmdcv5afi3arbq";
   };
 
-  buildFlags = "QMAKE=qmake";
+  buildFlags = [ "QMAKE=qmake" ];
 
   buildInputs = [ openssl pcre-cpp qt4 boost pkcs11helper ];
 
diff --git a/pkgs/tools/security/monkeysphere/default.nix b/pkgs/tools/security/monkeysphere/default.nix
index 97d032045b3..1e585136d88 100644
--- a/pkgs/tools/security/monkeysphere/default.nix
+++ b/pkgs/tools/security/monkeysphere/default.nix
@@ -36,10 +36,10 @@ in stdenv.mkDerivation rec {
       ([ gnupg opensshUnsafe which socat cpio hexdump procps lockfileProgs ] ++
       (with perlPackages; [ CryptOpenSSLRSA CryptOpenSSLBignum ]));
 
-  makeFlags = ''
-    PREFIX=/
-    DESTDIR=$(out)
-  '';
+  makeFlags = [
+    "PREFIX=/"
+    "DESTDIR=$(out)"
+  ];
 
   # The tests should be run (and succeed) when making changes to this package
   # but they aren't enabled by default because they "drain" entropy (GnuPG
diff --git a/pkgs/tools/security/nitrokey-app/default.nix b/pkgs/tools/security/nitrokey-app/default.nix
index 33a873f73da..48df486ef0a 100644
--- a/pkgs/tools/security/nitrokey-app/default.nix
+++ b/pkgs/tools/security/nitrokey-app/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     pkgconfig
     wrapQtAppsHook
   ];
-  cmakeFlags = "-DCMAKE_BUILD_TYPE=Release";
+  cmakeFlags = [ "-DCMAKE_BUILD_TYPE=Release" ];
 
   meta = with stdenv.lib; {
     description      = "Provides extra functionality for the Nitrokey Pro and Storage";
diff --git a/pkgs/tools/security/pass/extensions/genphrase.nix b/pkgs/tools/security/pass/extensions/genphrase.nix
index 187852e8b55..208012e2f88 100644
--- a/pkgs/tools/security/pass/extensions/genphrase.nix
+++ b/pkgs/tools/security/pass/extensions/genphrase.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   dontBuild = true;
 
-  installTargets = "globalinstall";
+  installTargets = [ "globalinstall" ];
 
   installFlags = [ "PREFIX=$(out)" ];
 
diff --git a/pkgs/tools/security/pbis/default.nix b/pkgs/tools/security/pbis/default.nix
index ee1282e9a13..176ef7f7616 100644
--- a/pkgs/tools/security/pbis/default.nix
+++ b/pkgs/tools/security/pbis/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     mkdir release
     cd release
     if [ $CC = gcc ]; then
-            NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -Wno-error=format-overflow"
+            NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -Wno-error=format-overflow -Wno-error=address-of-packed-member"
     fi
     NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -isystem ${stdenv.lib.getDev libxml2}/include/libxml2 -Wno-error=array-bounds -Wno-error=pointer-sign -Wno-error=deprecated-declarations -Wno-error=unused-variable"
   '';
diff --git a/pkgs/tools/security/phrasendrescher/default.nix b/pkgs/tools/security/phrasendrescher/default.nix
index 93dc75c1f32..71a9824bb62 100644
--- a/pkgs/tools/security/phrasendrescher/default.nix
+++ b/pkgs/tools/security/phrasendrescher/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ openssl libssh2 gpgme ];
 
-  configureFlags = "--with-plugins";
+  configureFlags = [ "--with-plugins" ];
 
   meta = with stdenv.lib; {
     description = "A modular and multi processing pass phrase cracking tool";
diff --git a/pkgs/tools/security/rarcrack/default.nix b/pkgs/tools/security/rarcrack/default.nix
index 65158b3c5fe..68e5df80937 100644
--- a/pkgs/tools/security/rarcrack/default.nix
+++ b/pkgs/tools/security/rarcrack/default.nix
@@ -12,8 +12,8 @@ stdenv.mkDerivation {
   };
 
   buildInputs = [ libxml2 file p7zip unrar unzip ];
-  buildFlags = if stdenv.cc.isClang then [ "CC=clang" ] else null;
-  installFlags = "PREFIX=\${out}";
+  buildFlags = stdenv.lib.optional stdenv.cc.isClang "CC=clang";
+  installFlags = [ "PREFIX=\${out}" ];
 
   patchPhase = ''
    substituteInPlace rarcrack.c --replace "file -i" "${file}/bin/file -i"
diff --git a/pkgs/tools/security/rhash/default.nix b/pkgs/tools/security/rhash/default.nix
index ad606af9562..863b03a117c 100644
--- a/pkgs/tools/security/rhash/default.nix
+++ b/pkgs/tools/security/rhash/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, which }:
 
 stdenv.mkDerivation rec {
-  version = "1.3.8";
+  version = "1.3.9";
   pname = "rhash";
 
   src = fetchFromGitHub {
     owner = "rhash";
     repo = "RHash";
     rev = "v${version}";
-    sha256 = "0i00wl63hn80g0s9gdi772gchbghwgkvn4nbb5227y2wwy30yyi2";
+    sha256 = "06i49x1l21h2q7pfnf4crbmjyg8b9ad0qs10ywyyn5sjpi0c21wq";
   };
 
   nativeBuildInputs = [ which ];
@@ -23,8 +23,9 @@ stdenv.mkDerivation rec {
   installTargets = [ "install" "install-lib-shared" "install-lib-so-link" "install-lib-headers" ];
 
   meta = with stdenv.lib; {
-    homepage = http://rhash.anz.ru;
+    homepage = "http://rhash.sourceforge.net/";
     description = "Console utility and library for computing and verifying hash sums of files";
+    license = licenses.bsd0;
     platforms = platforms.all;
     maintainers = [ maintainers.andrewrk ];
   };
diff --git a/pkgs/tools/security/sudo/default.nix b/pkgs/tools/security/sudo/default.nix
index a0922f4df73..71a71be9147 100644
--- a/pkgs/tools/security/sudo/default.nix
+++ b/pkgs/tools/security/sudo/default.nix
@@ -5,14 +5,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "sudo-1.8.29";
+  pname = "sudo";
+  version = "1.8.30";
 
   src = fetchurl {
-    urls =
-      [ "ftp://ftp.sudo.ws/pub/sudo/${name}.tar.gz"
-        "ftp://ftp.sudo.ws/pub/sudo/OLD/${name}.tar.gz"
-      ];
-    sha256 = "0z4wyadh9cks17gdpfgx4kvbrlnyb6nai2sd6chk7qh4jsngylyf";
+    url = "ftp://ftp.sudo.ws/pub/sudo/${pname}-${version}.tar.gz";
+    sha256 = "1rvrqlqrrjsd06dczgj9cwjdkpkqil5zzlwh87h06ms6qzfx6nm3";
   };
 
   prePatch = ''
diff --git a/pkgs/tools/security/super/default.nix b/pkgs/tools/security/super/default.nix
index 1f00d42f277..716973a3e2e 100644
--- a/pkgs/tools/security/super/default.nix
+++ b/pkgs/tools/security/super/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     "--localstatedir=/var"
   ];
 
-  installFlags = "sysconfdir=$(out)/etc localstatedir=$(TMPDIR)";
+  installFlags = [ "sysconfdir=$(out)/etc" "localstatedir=$(TMPDIR)" ];
 
   meta = {
     homepage = "https://www.ucolick.org/~will/#super";
diff --git a/pkgs/tools/security/tboot/default.nix b/pkgs/tools/security/tboot/default.nix
index f5184b98562..062bf40b7d6 100644
--- a/pkgs/tools/security/tboot/default.nix
+++ b/pkgs/tools/security/tboot/default.nix
@@ -17,6 +17,8 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "pic" "stackprotector" ];
 
+  NIX_CFLAGS_COMPILE = [ "-Wno-error=address-of-packed-member" ];
+
   configurePhase = ''
     for a in lcptools utils tb_polgen; do
       substituteInPlace $a/Makefile --replace /usr/sbin /sbin
@@ -24,7 +26,7 @@ stdenv.mkDerivation rec {
     substituteInPlace docs/Makefile --replace /usr/share /share
   '';
 
-  installFlags = "DESTDIR=$(out)";
+  installFlags = [ "DESTDIR=$(out)" ];
 
   meta = with stdenv.lib; {
     description = "A pre-kernel/VMM module that uses Intel(R) TXT to perform a measured and verified launch of an OS kernel/VMM";
diff --git a/pkgs/tools/system/clinfo/default.nix b/pkgs/tools/system/clinfo/default.nix
index 5653c70d431..dd6e3d4a84b 100644
--- a/pkgs/tools/system/clinfo/default.nix
+++ b/pkgs/tools/system/clinfo/default.nix
@@ -13,6 +13,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ ocl-icd opencl-headers ];
 
+  NIX_CFLAGS_COMPILE = [ "-Wno-error=stringop-truncation" ];
+
   makeFlags = [ "PREFIX=${placeholder "out"}" ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/system/daemon/default.nix b/pkgs/tools/system/daemon/default.nix
index 9bc6ecc6ddf..76f53b55f3d 100644
--- a/pkgs/tools/system/daemon/default.nix
+++ b/pkgs/tools/system/daemon/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation {
     url = http://libslack.org/daemon/download/daemon-0.6.4.tar.gz;
     sha256 = "18aw0f8k3j30xqwv4z03962kdpqd10nf1w9liihylmadlx5fmff4";
   };
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
   buildInputs = [ perl ];
 
   meta = {
diff --git a/pkgs/tools/system/efivar/default.nix b/pkgs/tools/system/efivar/default.nix
index 365cfeab058..f02923de349 100644
--- a/pkgs/tools/system/efivar/default.nix
+++ b/pkgs/tools/system/efivar/default.nix
@@ -18,6 +18,16 @@ stdenv.mkDerivation rec {
       url = "https://patch-diff.githubusercontent.com/raw/rhboot/efivar/pull/133.patch";
       sha256 = "038cwldb8sqnal5l6mhys92cqv8x7j8rgsl8i4fiv9ih9znw26i6";
     })
+    (fetchurl {
+      name = "fix-misaligned-pointer.patch";
+      url = "https://github.com/rhboot/efivar/commit/b98ba8921010d03f46704a476c69861515deb1ca.patch";
+      sha256 = "0ni9mz7y40a2wf1d1q5n9y5dhcbydxvfdhqic7zsmgnaxs3a0p27";
+    })
+    (fetchurl {
+      name = "fix-gcc9-error.patch";
+      url = "https://github.com/rhboot/efivar/commit/c3c553db85ff10890209d0fe48fb4856ad68e4e0.patch";
+      sha256 = "0lc38npydp069nlcga25wzzm204ww9l6mpjfn6wmhdfhn0pgjwky";
+    })
   ];
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/tools/system/facter/default.nix b/pkgs/tools/system/facter/default.nix
index cc9b95d06c6..86aa5adb6f8 100644
--- a/pkgs/tools/system/facter/default.nix
+++ b/pkgs/tools/system/facter/default.nix
@@ -14,11 +14,13 @@ stdenv.mkDerivation rec {
   CXXFLAGS = "-fpermissive -Wno-error=catch-value";
   NIX_LDFLAGS = "-lblkid";
 
-  cmakeFlags = [ 
+  cmakeFlags = [
     "-DFACTER_RUBY=${ruby}/lib/libruby.so"
     "-DRUBY_LIB_INSTALL=${placeholder "out"}/lib/ruby"
   ];
 
+  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-copy";
+
   nativeBuildInputs = [ cmake ];
   buildInputs = [ boost cpp-hocon curl leatherman libwhereami libyamlcpp openssl ruby utillinux ];
 
diff --git a/pkgs/tools/system/fcron/default.nix b/pkgs/tools/system/fcron/default.nix
index 6ef39a647f7..3dd84aa8a9c 100644
--- a/pkgs/tools/system/fcron/default.nix
+++ b/pkgs/tools/system/fcron/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
       "--disable-checks"
     ];
 
-  installTargets = "install-staged"; # install does also try to change permissions of /etc/* files
+  installTargets = [ "install-staged" ]; # install does also try to change permissions of /etc/* files
 
   # fcron tries to install pid into system directory on install
   installFlags = [
diff --git a/pkgs/tools/system/gdmap/default.nix b/pkgs/tools/system/gdmap/default.nix
index 0c254bb2854..4adc8160829 100644
--- a/pkgs/tools/system/gdmap/default.nix
+++ b/pkgs/tools/system/gdmap/default.nix
@@ -15,9 +15,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
-  NIX_LDFLAGS = [
-    "-lm"
-  ];
+  NIX_LDFLAGS = "-lm";
 
   meta = with stdenv.lib; {
     homepage = http://gdmap.sourceforge.net;
diff --git a/pkgs/tools/system/ioping/default.nix b/pkgs/tools/system/ioping/default.nix
index b4ab0f04d1c..5cd3a707dde 100644
--- a/pkgs/tools/system/ioping/default.nix
+++ b/pkgs/tools/system/ioping/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "0cv2496jplka55yqdcf3ln78r8yggy4lgmgf06l6fbljjrdx7pgq";
   };
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with stdenv.lib; {
     description = "Disk I/O latency measuring tool";
diff --git a/pkgs/tools/system/lr/default.nix b/pkgs/tools/system/lr/default.nix
index 74bc177023f..0600209723f 100644
--- a/pkgs/tools/system/lr/default.nix
+++ b/pkgs/tools/system/lr/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "0mpaqn0zfhxdf9wzs1wgdd29bjcyl3rgfdlqbwhiwcy2h3vy2h8s";
   };
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with stdenv.lib; {
     homepage = https://github.com/chneukirchen/lr;
diff --git a/pkgs/tools/system/netdata/default.nix b/pkgs/tools/system/netdata/default.nix
index 0d09d385cda..4f8cfb966e8 100644
--- a/pkgs/tools/system/netdata/default.nix
+++ b/pkgs/tools/system/netdata/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     ./no-files-in-etc-and-var.patch
   ];
 
-  NIX_CFLAGS_COMPILE = optional withDebug "-O1 -ggdb -DNETDATA_INTERNAL_CHECKS=1";
+  NIX_CFLAGS_COMPILE = optionalString withDebug "-O1 -ggdb -DNETDATA_INTERNAL_CHECKS=1";
 
   postInstall = optionalString (!stdenv.isDarwin) ''
     # rename this plugin so netdata will look for setuid wrapper
diff --git a/pkgs/tools/system/nq/default.nix b/pkgs/tools/system/nq/default.nix
index 1d8eeff209e..89c84c8c9ca 100644
--- a/pkgs/tools/system/nq/default.nix
+++ b/pkgs/tools/system/nq/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     rev = "v${version}";
     sha256 = "1db96ykz35r273jyhf7cdknqk4p2jj9l8gbz7pjy1hq4pb6ffk99";
   };
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
   postPatch = ''
     sed -i tq \
       -e 's|\bfq\b|'$out'/bin/fq|g' \
diff --git a/pkgs/tools/system/opencl-info/default.nix b/pkgs/tools/system/opencl-info/default.nix
index 60175d27f15..d1c3d0ec6c0 100644
--- a/pkgs/tools/system/opencl-info/default.nix
+++ b/pkgs/tools/system/opencl-info/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ opencl-clhpp ocl-icd ];
 
-  NIX_LDFLAGS = [ "-lOpenCL" ];
+  NIX_LDFLAGS = "-lOpenCL";
 
   installPhase = ''
     install -Dm755 opencl-info $out/bin/opencl-info
diff --git a/pkgs/tools/system/pciutils/default.nix b/pkgs/tools/system/pciutils/default.nix
index 22154796b31..b773529a0d7 100644
--- a/pkgs/tools/system/pciutils/default.nix
+++ b/pkgs/tools/system/pciutils/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     "DNS=yes"
   ];
 
-  installTargets = "install install-lib";
+  installTargets = [ "install" "install-lib" ];
 
   # Get rid of update-pciids as it won't work.
   postInstall = "rm $out/sbin/update-pciids $out/man/man8/update-pciids.8";
diff --git a/pkgs/tools/system/rowhammer-test/default.nix b/pkgs/tools/system/rowhammer-test/default.nix
index 5a3ba8b6619..64c184a6122 100644
--- a/pkgs/tools/system/rowhammer-test/default.nix
+++ b/pkgs/tools/system/rowhammer-test/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
     sha256 = "1fbfcnm5gjish47wdvikcsgzlb5vnlfqlzzm6mwiw2j5qkq0914i";
   };
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optional stdenv.isi686 "-Wno-error=format";
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isi686 "-Wno-error=format";
 
   buildPhase = "sh -e make.sh";
 
diff --git a/pkgs/tools/system/rsyslog/default.nix b/pkgs/tools/system/rsyslog/default.nix
index d12411d6145..7c5b9a18966 100644
--- a/pkgs/tools/system/rsyslog/default.nix
+++ b/pkgs/tools/system/rsyslog/default.nix
@@ -30,8 +30,6 @@ stdenv.mkDerivation rec {
   ] ++ stdenv.lib.optional (libmysqlclient != null) libmysqlclient
     ++ stdenv.lib.optional stdenv.isLinux systemd;
 
-  hardeningDisable = [ "format" ];
-
   configureFlags = [
     "--sysconfdir=/etc"
     "--localstatedir=/var"
@@ -95,9 +93,7 @@ stdenv.mkDerivation rec {
     (mkFlag (hadoop != null)          "omhdfs")
     (mkFlag (rdkafka != null)         "omkafka")
     (mkFlag (libmongo-client != null) "ommongodb")
-    (mkFlag (czmq != null)            "imzmq3")
     (mkFlag (czmq != null)            "imczmq")
-    (mkFlag (czmq != null)            "omzmq3")
     (mkFlag (czmq != null)            "omczmq")
     (mkFlag (rabbitmq-c != null)      "omrabbitmq")
     (mkFlag (hiredis != null)         "omhiredis")
diff --git a/pkgs/tools/system/setserial/default.nix b/pkgs/tools/system/setserial/default.nix
index 036e3a83cf2..68ea32e1e8a 100644
--- a/pkgs/tools/system/setserial/default.nix
+++ b/pkgs/tools/system/setserial/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ groff ];
 
-  installFlags = ''DESTDIR=$(out)'';
+  installFlags = [ "DESTDIR=$(out)" ];
 
   postConfigure = ''
     sed -e s@/usr/man/@/share/man/@ -i Makefile
diff --git a/pkgs/tools/system/stress-ng/default.nix b/pkgs/tools/system/stress-ng/default.nix
index c8748efc302..7d3e62d7beb 100644
--- a/pkgs/tools/system/stress-ng/default.nix
+++ b/pkgs/tools/system/stress-ng/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     "BASHDIR=${placeholder "out"}/share/bash-completion/completions"
   ];
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optional stdenv.hostPlatform.isMusl "-D_LINUX_SYSINFO_H=1";
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.hostPlatform.isMusl "-D_LINUX_SYSINFO_H=1";
 
   # Won't build on i686 because the binary will be linked again in the
   # install phase without checking the dependencies. This will prevent
diff --git a/pkgs/tools/system/testdisk/default.nix b/pkgs/tools/system/testdisk/default.nix
index 9cec99145b9..ad11cd2e3b6 100644
--- a/pkgs/tools/system/testdisk/default.nix
+++ b/pkgs/tools/system/testdisk/default.nix
@@ -37,7 +37,7 @@ assert enableQt -> qwt != null;
   ]
   ++ stdenv.lib.optional enableNtfs ntfs3g
   ++ stdenv.lib.optional enableExtFs e2fsprogs
-  ++ stdenv.lib.optional enableQt [ qtbase qttools qwt ];
+  ++ stdenv.lib.optionals enableQt [ qtbase qttools qwt ];
 
   nativeBuildInputs = [ pkgconfig ];
 
diff --git a/pkgs/tools/system/vboot_reference/default.nix b/pkgs/tools/system/vboot_reference/default.nix
index bce6d0c4185..1391a2a5ed2 100644
--- a/pkgs/tools/system/vboot_reference/default.nix
+++ b/pkgs/tools/system/vboot_reference/default.nix
@@ -19,6 +19,9 @@ stdenv.mkDerivation rec {
 
   patches = [ ./dont_static_link.patch ];
 
+  # fix build with gcc9
+  NIX_CFLAGS_COMPILE = [ "-Wno-error" ];
+
   postPatch = ''
     substituteInPlace Makefile \
       --replace "ar qc" '${stdenv.cc.bintools.targetPrefix}ar qc'
diff --git a/pkgs/tools/system/xe/default.nix b/pkgs/tools/system/xe/default.nix
index 02e36dbc31c..62423ff594f 100644
--- a/pkgs/tools/system/xe/default.nix
+++ b/pkgs/tools/system/xe/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "04jr8f6jcijr0bsmn8ajm0aj35qh9my3xjsaq64h8lwg5bpyn29x";
   };
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with lib; {
     description = "Simple xargs and apply replacement";
diff --git a/pkgs/tools/text/ansifilter/default.nix b/pkgs/tools/text/ansifilter/default.nix
index 7437d2765a9..bc265c5a5ae 100644
--- a/pkgs/tools/text/ansifilter/default.nix
+++ b/pkgs/tools/text/ansifilter/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     description = "Tool to convert ANSI to other formats";
     longDescription = ''
-      Tool to remove ANSI or convert them to another format 
+      Tool to remove ANSI or convert them to another format
       (HTML, TeX, LaTeX, RTF, Pango or BBCode)
     '';
     homepage = "http://www.andre-simon.de/doku/ansifilter/en/ansifilter.php";
diff --git a/pkgs/tools/text/gawk/default.nix b/pkgs/tools/text/gawk/default.nix
index 7a5f6c8dd81..0d5a50570f5 100644
--- a/pkgs/tools/text/gawk/default.nix
+++ b/pkgs/tools/text/gawk/default.nix
@@ -41,7 +41,9 @@ stdenv.mkDerivation rec {
     (if interactive then "--with-readline=${readline.dev}" else "--without-readline")
   ];
 
-  makeFlags = "AR=${stdenv.cc.targetPrefix}ar";
+  makeFlags = [
+    "AR=${stdenv.cc.targetPrefix}ar"
+  ];
 
   inherit doCheck;
 
diff --git a/pkgs/tools/text/mdcat/default.nix b/pkgs/tools/text/mdcat/default.nix
index 4139771b5cb..626963bc601 100644
--- a/pkgs/tools/text/mdcat/default.nix
+++ b/pkgs/tools/text/mdcat/default.nix
@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage rec {
   };
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ (stdenv.lib.optional stdenv.isDarwin Security) openssl ];
+  buildInputs = [ openssl ] ++ stdenv.lib.optional stdenv.isDarwin Security;
 
   cargoSha256 = "1hxsfls6fpllc9yg5ib3qz6pa62j1y1va8a6356j6812csk4ifnn";
 
diff --git a/pkgs/tools/text/multitran/libmtquery/default.nix b/pkgs/tools/text/multitran/libmtquery/default.nix
index 8b2032dcaba..baccdfdedba 100644
--- a/pkgs/tools/text/multitran/libmtquery/default.nix
+++ b/pkgs/tools/text/multitran/libmtquery/default.nix
@@ -9,9 +9,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ libmtsupport libfacet libbtree multitrandata ];
 
-  NIX_LDFLAGS = [
-    "-lbtree"
-  ];
+  NIX_LDFLAGS = "-lbtree";
 
   patchPhase = ''
     sed -i -e 's@\$(DESTDIR)/usr@'$out'@' \
diff --git a/pkgs/tools/text/reckon/default.nix b/pkgs/tools/text/reckon/default.nix
index 25e9c07f351..261149229b6 100644
--- a/pkgs/tools/text/reckon/default.nix
+++ b/pkgs/tools/text/reckon/default.nix
@@ -4,17 +4,17 @@ stdenv.mkDerivation rec {
   pname = "reckon";
   version = (import ./gemset.nix).reckon.version;
 
-  env = bundlerEnv {
-    name = "${pname}-${version}-gems";
-
-    gemdir = ./.;
-  };
-
   phases = [ "installPhase" ];
 
   buildInputs = [ makeWrapper ];
 
-  installPhase = ''
+  installPhase = let
+    env = bundlerEnv {
+      name = "${pname}-${version}-gems";
+
+      gemdir = ./.;
+    };
+  in ''
     mkdir -p $out/bin
     makeWrapper ${env}/bin/reckon $out/bin/reckon
   '';
diff --git a/pkgs/tools/text/replace/default.nix b/pkgs/tools/text/replace/default.nix
index 9242014cdca..3549e7c1c94 100644
--- a/pkgs/tools/text/replace/default.nix
+++ b/pkgs/tools/text/replace/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
 
   outputs = [ "out" "man" ];
 
-  makeFlags = "TREE=\$(out) MANTREE=\$(TREE)/share/man";
+  makeFlags = [ "TREE=\$(out)" "MANTREE=\$(TREE)/share/man" ];
 
   preBuild = ''
     sed -e "s@/bin/mv@$(type -P mv)@" -i replace.h
diff --git a/pkgs/tools/text/sgml/jade/default.nix b/pkgs/tools/text/sgml/jade/default.nix
index b7f8bd6df38..2cc40510121 100644
--- a/pkgs/tools/text/sgml/jade/default.nix
+++ b/pkgs/tools/text/sgml/jade/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ gnum4 ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-deprecated" ];
+  NIX_CFLAGS_COMPILE = "-Wno-deprecated";
 
   preInstall = ''
     install -d -m755 "$out"/lib
diff --git a/pkgs/tools/text/untex/default.nix b/pkgs/tools/text/untex/default.nix
index 923adf8571d..f9c7e3cdfc6 100644
--- a/pkgs/tools/text/untex/default.nix
+++ b/pkgs/tools/text/untex/default.nix
@@ -12,8 +12,8 @@ stdenv.mkDerivation rec {
   hardeningDisable = [ "format" ];
 
   unpackPhase = "tar xf $src";
-  installTargets = "install install.man";
-  installFlags = "BINDIR=$(out)/bin MANDIR=$(out)/share/man/man1";
+  installTargets = [ "install" "install.man" ];
+  installFlags = [ "BINDIR=$(out)/bin" "MANDIR=$(out)/share/man/man1" ];
   preBuild = ''
     sed -i '1i#include <stdlib.h>\n#include <string.h>' untex.c
     mkdir -p $out/bin $out/share/man/man1
diff --git a/pkgs/tools/text/zimreader/default.nix b/pkgs/tools/text/zimreader/default.nix
index 15e5ddf2f19..177f9326dd2 100644
--- a/pkgs/tools/text/zimreader/default.nix
+++ b/pkgs/tools/text/zimreader/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
     sha256 = "0x529137rxy6ld64xqa6xmn93121ripxvkf3sc7hv3wg6km182sw";
   };
 
-  patchFlags = "-p2";
+  patchFlags = [ "-p2" ];
   patches = [
     (fetchpatch {
       name = "zimreader_tntnet221.patch";
diff --git a/pkgs/tools/typesetting/asciidoc/default.nix b/pkgs/tools/typesetting/asciidoc/default.nix
index 83aa667f58f..44c5f6d1f24 100644
--- a/pkgs/tools/typesetting/asciidoc/default.nix
+++ b/pkgs/tools/typesetting/asciidoc/default.nix
@@ -259,7 +259,7 @@ stdenv.mkDerivation rec {
   '';
 
   preInstall = "mkdir -p $out/etc/vim";
-  makeFlags = if stdenv.isCygwin then "DESTDIR=/." else null;
+  makeFlags = stdenv.lib.optional stdenv.isCygwin "DESTDIR=/.";
 
   meta = with stdenv.lib; {
     description = "Text-based document generation system";
diff --git a/pkgs/tools/typesetting/hevea/default.nix b/pkgs/tools/typesetting/hevea/default.nix
index aa32d52dfc6..2a126ac5c83 100644
--- a/pkgs/tools/typesetting/hevea/default.nix
+++ b/pkgs/tools/typesetting/hevea/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = with ocamlPackages; [ ocaml ocamlbuild ];
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with stdenv.lib; {
     description = "A quite complete and fast LATEX to HTML translator";
diff --git a/pkgs/tools/video/mjpegtools/default.nix b/pkgs/tools/video/mjpegtools/default.nix
index 31d26a6c72a..3e72d8b8af5 100644
--- a/pkgs/tools/video/mjpegtools/default.nix
+++ b/pkgs/tools/video/mjpegtools/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ libdv libjpeg libpng ]
               ++ lib.optionals (!withMinimal) [ gtk2 libX11 SDL SDL_gfx ];
 
-  NIX_CFLAGS_COMPILE = lib.optional (!withMinimal) "-I${SDL.dev}/include/SDL";
+  NIX_CFLAGS_COMPILE = lib.optionalString (!withMinimal) "-I${SDL.dev}/include/SDL";
 
   postPatch = ''
     sed -i -e '/ARCHFLAGS=/s:=.*:=:' configure
diff --git a/pkgs/tools/video/vncrec/default.nix b/pkgs/tools/video/vncrec/default.nix
index c09da3dd231..857524661bf 100644
--- a/pkgs/tools/video/vncrec/default.nix
+++ b/pkgs/tools/video/vncrec/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation {
     "BINDIR=${placeholder "out"}/bin"
     "MANDIR=${placeholder "out"}/share/man"
   ];
-  installTargets = "install install.man";
+  installTargets = [ "install" "install.man" ];
 
   meta = {
     description = "VNC recorder";
diff --git a/pkgs/tools/video/yamdi/default.nix b/pkgs/tools/video/yamdi/default.nix
index 8fca318529f..b9b16e4d8ec 100644
--- a/pkgs/tools/video/yamdi/default.nix
+++ b/pkgs/tools/video/yamdi/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     sha256 = "4a6630f27f6c22bcd95982bf3357747d19f40bd98297a569e9c77468b756f715";
   };
 
-  buildFlags = "CC=cc";
+  buildFlags = [ "CC=cc" ];
 
   installPhase = ''
     install -D {,$out/bin/}yamdi
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 049d0bfab9f..cc877490a9d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -631,7 +631,9 @@ in
 
   arandr = callPackage ../tools/X11/arandr { };
 
-  inherit (callPackages ../servers/nosql/arangodb { }) arangodb_3_3 arangodb_3_4 arangodb_3_5;
+  inherit (callPackages ../servers/nosql/arangodb {
+    stdenv = gcc8Stdenv;
+  }) arangodb_3_3 arangodb_3_4 arangodb_3_5;
   arangodb = arangodb_3_4;
 
   arcanist = callPackage ../development/tools/misc/arcanist {};
@@ -758,11 +760,6 @@ in
 
   apg = callPackage ../tools/security/apg { };
 
-  apt = callPackage ../tools/package-management/apt {
-    # include/c++/6.4.0/cstdlib:75:25: fatal error: stdlib.h: No such file or directory
-    stdenv = gcc5Stdenv;
-  };
-
   apt-dater = callPackage ../tools/package-management/apt-dater { };
 
   autorevision = callPackage ../tools/misc/autorevision { };
@@ -2081,7 +2078,6 @@ in
 
   rsyslog = callPackage ../tools/system/rsyslog {
     hadoop = null; # Currently Broken
-    czmq = czmq3;
   };
 
   rsyslog-light = rsyslog.override {
@@ -3072,7 +3068,7 @@ in
 
   enscript = callPackage ../tools/text/enscript { };
 
-  ensemble-chorus = callPackage ../applications/audio/ensemble-chorus { };
+  ensemble-chorus = callPackage ../applications/audio/ensemble-chorus { stdenv = gcc8Stdenv; };
 
   entr = callPackage ../tools/misc/entr { };
 
@@ -3192,9 +3188,7 @@ in
 
   fcitx-configtool = callPackage ../tools/inputmethods/fcitx/fcitx-configtool.nix { };
 
-  fcppt = callPackage ../development/libraries/fcppt {
-    stdenv = gcc8Stdenv;
-  };
+  fcppt = callPackage ../development/libraries/fcppt { };
 
   fcrackzip = callPackage ../tools/security/fcrackzip { };
 
@@ -3225,7 +3219,6 @@ in
   flatpak-builder = callPackage ../development/tools/flatpak-builder { };
 
   fltrdr = callPackage ../tools/misc/fltrdr {
-    stdenv = gcc8Stdenv;
     icu = icu63;
   };
 
@@ -4035,7 +4028,9 @@ in
 
   hwinfo = callPackage ../tools/system/hwinfo { };
 
-  hybridreverb2 = callPackage ../applications/audio/hybridreverb2 { };
+  hybridreverb2 = callPackage ../applications/audio/hybridreverb2 {
+    stdenv = gcc8Stdenv;
+  };
 
   hylafaxplus = callPackage ../servers/hylafaxplus { };
 
@@ -7835,8 +7830,8 @@ in
   gerbil = callPackage ../development/compilers/gerbil { stdenv = gccStdenv; };
   gerbil-unstable = callPackage ../development/compilers/gerbil/unstable.nix { stdenv = gccStdenv; };
 
-  gccFun = callPackage (if stdenv.targetPlatform.isVc4 then ../development/compilers/gcc/6 else ../development/compilers/gcc/8);
-  gcc = if stdenv.targetPlatform.isVc4 then gcc6 else gcc8;
+  gccFun = callPackage (if stdenv.targetPlatform.isVc4 then ../development/compilers/gcc/6 else ../development/compilers/gcc/9);
+  gcc = if stdenv.targetPlatform.isVc4 then gcc6 else gcc9;
   gcc-unwrapped = gcc.cc;
 
   gccStdenv = if stdenv.cc.isGNU then stdenv else stdenv.override {
@@ -8038,7 +8033,7 @@ in
     isl = isl_0_17;
   }));
 
-  gfortran = gfortran8;
+  gfortran = gfortran9;
 
   gfortran48 = wrapCC (gcc48.cc.override {
     name = "gfortran";
@@ -8088,6 +8083,14 @@ in
     profiledCompiler = false;
   });
 
+  gfortran9 = wrapCC (gcc9.cc.override {
+    name = "gfortran";
+    langFortran = true;
+    langCC = false;
+    langC = false;
+    profiledCompiler = false;
+  });
+
   gcj = gcj6;
   gcj6 = wrapCC (gcc6.cc.override {
     name = "gcj";
@@ -8222,13 +8225,19 @@ in
       inherit (darwin.apple_sdk.frameworks) Security;
     };
 
-  go_1_12 = callPackage ../development/compilers/go/1.12.nix {
+  go_1_12 = callPackage ../development/compilers/go/1.12.nix ({
     inherit (darwin.apple_sdk.frameworks) Security Foundation;
-  };
+  } // lib.optionalAttrs stdenv.isAarch64 {
+    stdenv = gcc8Stdenv;
+    buildPackages = buildPackages // { stdenv = gcc8Stdenv; };
+  });
 
-  go_1_13 = callPackage ../development/compilers/go/1.13.nix {
+  go_1_13 = callPackage ../development/compilers/go/1.13.nix ({
     inherit (darwin.apple_sdk.frameworks) Security Foundation;
-  };
+  } // lib.optionalAttrs stdenv.isAarch64 {
+    stdenv = gcc8Stdenv;
+    buildPackages = buildPackages // { stdenv = gcc8Stdenv; };
+  });
 
   go = go_1_13;
 
@@ -8653,17 +8662,17 @@ in
     inherit (darwin) apple_sdk;
   };
 
-  rust_1_39_0 = callPackage ../development/compilers/rust/1_39_0.nix {
+  rust_1_40_0 = callPackage ../development/compilers/rust/1_40_0.nix {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
   };
   rust_1_38_0 = callPackage ../development/compilers/rust/1_38_0.nix {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
   };
-  rust = rust_1_39_0;
+  rust = rust_1_40_0;
 
-  rustPackages_1_39_0 = rust_1_39_0.packages.stable;
+  rustPackages_1_40_0 = rust_1_40_0.packages.stable;
   rustPackages_1_38_0 = rust_1_38_0.packages.stable;
-  rustPackages = rustPackages_1_39_0;
+  rustPackages = rustPackages_1_40_0;
 
   inherit (rustPackages) cargo rustc rustPlatform;
   inherit (rust) makeRustPlatform;
@@ -10835,7 +10844,9 @@ in
     inherit (llvmPackages_6) llvm clang-unwrapped;
   };
 
-  belle-sip = callPackage ../development/libraries/belle-sip { };
+  belle-sip = callPackage ../development/libraries/belle-sip {
+    stdenv = gcc8Stdenv;
+  };
 
   libbfd = callPackage ../development/libraries/libbfd { };
 
@@ -10920,8 +10931,6 @@ in
 
   ccrtp = callPackage ../development/libraries/ccrtp { };
 
-  ccrtp_1_8 = callPackage ../development/libraries/ccrtp/1.8.nix { };
-
   cctz = callPackage ../development/libraries/cctz { };
 
   celt = callPackage ../development/libraries/celt {};
@@ -11000,8 +11009,6 @@ in
 
   cointop = callPackage ../applications/misc/cointop { };
 
-  commoncpp2 = callPackage ../development/libraries/commoncpp2 { };
-
   ctl = callPackage ../development/libraries/ctl { };
 
   ctpp2 = callPackage ../development/libraries/ctpp2 { };
@@ -11104,8 +11111,6 @@ in
     fltk = fltk13;
   };
 
-  dirac = callPackage ../development/libraries/dirac { };
-
   directfb = callPackage ../development/libraries/directfb { };
 
   discord-rpc = callPackage ../development/libraries/discord-rpc {
@@ -11936,9 +11941,11 @@ in
 
   isso = callPackage ../servers/isso { };
 
-  itk4 = callPackage ../development/libraries/itk/4.x.nix { };
+  itk4 = callPackage ../development/libraries/itk/4.x.nix { stdenv = gcc8Stdenv; };
 
-  itk = callPackage ../development/libraries/itk { };
+  itk = callPackage ../development/libraries/itk {
+    stdenv = gcc8Stdenv;
+  };
 
   jasper = callPackage ../development/libraries/jasper { };
 
@@ -13450,11 +13457,6 @@ in
 
   ois = callPackage ../development/libraries/ois {};
 
-  opal = callPackage ../development/libraries/opal {
-    ffmpeg = ffmpeg_2;
-    stdenv = gcc6Stdenv;
-  };
-
   openh264 = callPackage ../development/libraries/openh264 { };
 
   openjpeg_1 = callPackage ../development/libraries/openjpeg/1.x.nix { };
@@ -13630,8 +13632,6 @@ in
 
   pstreams = callPackage ../development/libraries/pstreams {};
 
-  ptlib = callPackage ../development/libraries/ptlib {};
-
   pugixml = callPackage ../development/libraries/pugixml { };
 
   pybind11 = pythonPackages.pybind11;
@@ -14480,6 +14480,7 @@ in
   vte_290 = callPackage ../development/libraries/vte/2.90.nix { };
 
   vtk = callPackage ../development/libraries/vtk {
+    stdenv = gcc8Stdenv;
     inherit (darwin) libobjc;
     inherit (darwin.apple_sdk.libs) xpc;
     inherit (darwin.apple_sdk.frameworks) Cocoa CoreServices DiskArbitration
@@ -14696,13 +14697,7 @@ in
 
   cppzmq = callPackage ../development/libraries/cppzmq {};
 
-  czmq3 = callPackage ../development/libraries/czmq/3.x.nix {};
-  czmq4 = callPackage ../development/libraries/czmq/4.x.nix {};
-  czmq = czmq4;
-
-  czmqpp = callPackage ../development/libraries/czmqpp {
-    czmq = czmq3;
-  };
+  czmq = callPackage ../development/libraries/czmq/default.nix {};
 
   zmqpp = callPackage ../development/libraries/zmqpp { };
 
@@ -15693,8 +15688,6 @@ in
 
   sickrage = callPackage ../servers/sickbeard/sickrage.nix { };
 
-  sipcmd = callPackage ../applications/networking/sipcmd { };
-
   sipwitch = callPackage ../servers/sip/sipwitch { };
 
   slimserver = callPackage ../servers/slimserver { };
@@ -18105,7 +18098,7 @@ in
 
   bevelbar = callPackage ../applications/window-managers/bevelbar { };
 
-  bibletime = callPackage ../applications/misc/bibletime { };
+  bibletime = libsForQt5.callPackage ../applications/misc/bibletime { };
 
   bino3d = libsForQt5.callPackage ../applications/video/bino3d {
     ffmpeg = ffmpeg_4;
@@ -20192,7 +20185,7 @@ in
 
   clerk = callPackage ../applications/audio/clerk { };
 
-  nbstripout = callPackage ../applications/version-management/nbstripout { };
+  nbstripout = callPackage ../applications/version-management/nbstripout { python = python3; };
 
   ncmpc = callPackage ../applications/audio/ncmpc { };
 
@@ -20368,7 +20361,9 @@ in
     libmlt = mlt;
   };
 
-  shogun = callPackage ../applications/science/machine-learning/shogun { };
+  shogun = callPackage ../applications/science/machine-learning/shogun {
+    stdenv = gcc8Stdenv;
+  };
 
   sky = callPackage ../applications/networking/instant-messengers/sky {};
 
@@ -20553,9 +20548,7 @@ in
 
   openfx = callPackage ../development/libraries/openfx {};
 
-  openimageio = callPackage ../applications/graphics/openimageio {
-    stdenv = gcc6Stdenv;
-  };
+  openimageio = callPackage ../applications/graphics/openimageio { };
 
   openimageio2 = callPackage ../applications/graphics/openimageio/2.x.nix { };
 
@@ -20868,7 +20861,9 @@ in
 
   qmapshack = libsForQt5.callPackage ../applications/misc/qmapshack { };
 
-  qmediathekview = libsForQt5.callPackage ../applications/video/qmediathekview { };
+  qmediathekview = libsForQt5.callPackage ../applications/video/qmediathekview {
+    boost = boost17x;
+  };
 
   qmetro = callPackage ../applications/misc/qmetro { };
 
@@ -23618,7 +23613,9 @@ in
 
   alliance = callPackage ../applications/science/electronics/alliance { };
 
-  ants = callPackage ../applications/science/biology/ants { };
+  ants = callPackage ../applications/science/biology/ants {
+    stdenv = gcc8Stdenv;
+  };
 
   aragorn = callPackage ../applications/science/biology/aragorn { };
 
@@ -24091,7 +24088,6 @@ in
   mcrl2 = callPackage ../applications/science/logic/mcrl2 { };
 
   minisat = callPackage ../applications/science/logic/minisat {};
-  minisatUnstable = callPackage ../applications/science/logic/minisat/unstable.nix {};
 
   monosat = callPackage ../applications/science/logic/monosat {};
 
@@ -24355,7 +24351,7 @@ in
 
   root5 = lowPrio (callPackage ../applications/science/misc/root/5.nix {
     inherit (darwin.apple_sdk.frameworks) Cocoa OpenGL;
-    stdenv = if stdenv.cc.isClang then llvmPackages_5.stdenv else stdenv;
+    stdenv = if stdenv.cc.isClang then llvmPackages_5.stdenv else gcc8Stdenv;
   });
 
   rink = callPackage ../applications/science/misc/rink { };
@@ -24556,15 +24552,9 @@ in
 
   dpkg = callPackage ../tools/package-management/dpkg { };
 
-  ekiga = callPackage ../applications/networking/instant-messengers/ekiga {
-    boost = boost167;
-  };
-
   dumb = callPackage ../misc/dumb { };
 
-  emulationstation = callPackage ../misc/emulators/emulationstation {
-    stdenv = gcc5Stdenv;
-  };
+  emulationstation = callPackage ../misc/emulators/emulationstation { };
 
   electricsheep = callPackage ../misc/screensavers/electricsheep { };
 
@@ -24644,7 +24634,9 @@ in
 
   hatari = callPackage ../misc/emulators/hatari { };
 
-  helm = callPackage ../applications/audio/helm { };
+  helm = callPackage ../applications/audio/helm {
+    stdenv = gcc8Stdenv;
+  };
 
   helmfile = callPackage ../applications/networking/cluster/helmfile { };
 
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index a9571032053..94ef3224998 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -11242,7 +11242,7 @@ let
 
     outputs = [ "out" "dev" ]; # no "devdoc"
 
-    installTargets = "install";
+    installTargets = [ "install" ];
 
     meta = with stdenv.lib; {
       homepage = "https://www.mhonarc.org/";
@@ -19245,7 +19245,7 @@ let
       sha256 = "0avk50kia78kxryh2whmaj5l18q2wvmkdyqyjsf6kwr4kgy6x3i7";
     };
     # https://rt.cpan.org/Public/Bug/Display.html?id=124815
-    NIX_CFLAGS_COMPILE = [ "-DHAS_VPRINTF" ];
+    NIX_CFLAGS_COMPILE = "-DHAS_VPRINTF";
   };
 
   TextUnidecode = buildPerlPackage {
@@ -20332,7 +20332,7 @@ let
     AUTOMATED_TESTING = false;
     buildInputs = [ pkgs.xorg.libxcb pkgs.xorg.xcbproto pkgs.xorg.xcbutil pkgs.xorg.xcbutilwm ExtUtilsDepends ExtUtilsPkgConfig TestDeep TestException XSObjectMagic ];
     propagatedBuildInputs = [ DataDump MouseXNativeTraits XMLDescent XMLSimple ];
-    NIX_CFLAGS_LINK = [ "-lxcb" "-lxcb-util" "-lxcb-xinerama" "-lxcb-icccm" ];
+    NIX_CFLAGS_LINK = "-lxcb -lxcb-util -lxcb-xinerama -lxcb-icccm";
     doCheck = false; # requires an X server
     meta = {
       description = "XCB bindings for X";
@@ -20609,7 +20609,7 @@ let
      };
      propagatedBuildInputs = [ XMLParser XMLSAX ];
      # Avoid creating perllocal.pod, which contains a timestamp
-     installTargets = "pure_install";
+     installTargets = [ "pure_install" ];
      meta = {
        description = "SAX Driver for Expat";
        license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 11ead718270..704e53928dc 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -268,6 +268,8 @@ in {
 
   azure-batch = callPackage ../development/python-modules/azure-batch { };
 
+  azure-core = callPackage ../development/python-modules/azure-core { };
+
   azure-cosmosdb-nspkg = callPackage ../development/python-modules/azure-cosmosdb-nspkg { };
 
   azure-cosmosdb-table = callPackage ../development/python-modules/azure-cosmosdb-table { };
@@ -282,6 +284,10 @@ in {
 
   azure-keyvault = callPackage ../development/python-modules/azure-keyvault { };
 
+  azure-keyvault-keys = callPackage ../development/python-modules/azure-keyvault-keys { };
+
+  azure-keyvault-secrets = callPackage ../development/python-modules/azure-keyvault-secrets { };
+
   azure-loganalytics = callPackage ../development/python-modules/azure-loganalytics { };
 
   azure-servicebus = callPackage ../development/python-modules/azure-servicebus { };
@@ -3725,8 +3731,10 @@ in {
 
   ipyparallel = callPackage ../development/python-modules/ipyparallel { };
 
-  ipython = if pythonOlder "3.5" then
+  ipython = if isPy27 then
       callPackage ../development/python-modules/ipython/5.nix { }
+    else if isPy35 then
+      callPackage ../development/python-modules/ipython/7.9.nix { }
     else
       callPackage ../development/python-modules/ipython { };
 
@@ -4265,7 +4273,9 @@ in {
 
   numba = callPackage ../development/python-modules/numba { };
 
-  numcodecs = callPackage ../development/python-modules/numcodecs { };
+  numcodecs = callPackage ../development/python-modules/numcodecs {
+    inherit (pkgs) gcc8;
+  };
 
   numexpr = callPackage ../development/python-modules/numexpr { };
 
@@ -4349,6 +4359,8 @@ in {
 
   cachetools = callPackage ../development/python-modules/cachetools {};
 
+  cma = callPackage ../development/python-modules/cma { };
+
   cmd2 = callPackage ../development/python-modules/cmd2 {};
 
   warlock = callPackage ../development/python-modules/warlock { };