Merge remote-tracking branch 'upstream/master'

2024-09-23 21:55:53 +02:00 · 2018-06-20 15:25:26 -04:00 · 2018-06-20 15:25:26 -04:00 · 5e95dd3026
parent 89678fc87d b717ca8e45
commit 5e95dd3026
261 changed files with 5213 additions and 3178 deletions
--- a/doc/languages-frameworks/haskell.section.md
+++ b/doc/languages-frameworks/haskell.section.md
@ -312,7 +312,7 @@ For example, installing the following environment
 allows one to browse module documentation index [not too dissimilar to
 this](https://downloads.haskell.org/~ghc/latest/docs/html/libraries/index.html)
 for all the specified packages and their dependencies by directing a browser of
-choice to `~/.nix-profiles/share/doc/hoogle/index.html` (or
+choice to `~/.nix-profile/share/doc/hoogle/index.html` (or
 `/run/current-system/sw/share/doc/hoogle/index.html` in case you put it in
 `environment.systemPackages` in NixOS).

--- a/doc/reviewing-contributions.xml
+++ b/doc/reviewing-contributions.xml
@ -6,18 +6,22 @@
 <title>Reviewing contributions</title>
 <warning>
  <para>
-   The following section is a draft and reviewing policy is still being
-   discussed.
+   The following section is a draft, and the policy for reviewing is still being
+   discussed in issues such as <link
+	   xlink:href="https://github.com/NixOS/nixpkgs/issues/11166">#11166
+   </link> and <link
+	   xlink:href="https://github.com/NixOS/nixpkgs/issues/20836">#20836
+   </link>.
  </para>
 </warning>
 <para>
-  The nixpkgs projects receives a fairly high number of contributions via
+  The nixpkgs project receives a fairly high number of contributions via
  GitHub pull-requests. Reviewing and approving these is an important task and
  a way to contribute to the project.
 </para>
 <para>
-  The high change rate of nixpkgs make any pull request that is open for long
-  enough subject to conflicts that will require extra work from the submitter
+  The high change rate of nixpkgs makes any pull request that remains open for
+  too long subject to conflicts that will require extra work from the submitter
  or the merger. Reviewing pull requests in a timely manner and being
  responsive to the comments is the key to avoid these. GitHub provides sort
  filters that can be used to see the
@ -33,34 +37,34 @@
 <para>
  When reviewing a pull request, please always be nice and polite.
  Controversial changes can lead to controversial opinions, but it is important
-  to respect every community members and their work.
+  to respect every community member and their work.
 </para>
 <para>
-  GitHub provides reactions, they are a simple and quick way to provide
+  GitHub provides reactions as a simple and quick way to provide
  feedback to pull-requests or any comments. The thumb-down reaction should be
-  used with care and if possible accompanied with some explanations so the
-  submitter has directions to improve his contribution.
+  used with care and if possible accompanied with some explanation so the
+  submitter has directions to improve their contribution.
 </para>
 <para>
-  Pull-requests reviews should include a list of what has been reviewed in a
+  Pull-request reviews should include a list of what has been reviewed in a
  comment, so other reviewers and mergers can know the state of the review.
 </para>
 <para>
  All the review template samples provided in this section are generic and
  meant as examples. Their usage is optional and the reviewer is free to adapt
-  them to his liking.
+  them to their liking.
 </para>
 <section>
  <title>Package updates</title>

  <para>
   A package update is the most trivial and common type of pull-request. These
-   pull-requests mainly consist in updating the version part of the package
+   pull-requests mainly consist of updating the version part of the package
   name and the source hash.
  </para>

  <para>
-   It can happen that non trivial updates include patches or more complex
+   It can happen that non-trivial updates include patches or more complex
   changes.
  </para>

@ -84,12 +88,12 @@
   </listitem>
   <listitem>
    <para>
-     Ensure that the package versioning is fitting the guidelines.
+     Ensure that the package versioning fits the guidelines.
    </para>
   </listitem>
   <listitem>
    <para>
-     Ensure that the commit text is fitting the guidelines.
+     Ensure that the commit text fits the guidelines.
    </para>
   </listitem>
   <listitem>
@ -99,7 +103,7 @@
    <itemizedlist>
     <listitem>
      <para>
-       mention-bot usually notify GitHub users based on the submitted changes,
+       mention-bot usually notifies GitHub users based on the submitted changes,
       but it can happen that it misses some of the package maintainers.
      </para>
     </listitem>
@ -107,13 +111,13 @@
   </listitem>
   <listitem>
    <para>
-     Ensure that the meta field contains correct information.
+     Ensure that the meta field information is correct.
    </para>
    <itemizedlist>
     <listitem>
      <para>
-       License can change with version updates, so it should be checked to be
-       fitting upstream license.
+       License can change with version updates, so it should be checked to match
+       the upstream license.
      </para>
     </listitem>
     <listitem>
@ -137,9 +141,9 @@
    <itemizedlist>
     <listitem>
      <para>
-       Pull-requests are often targeted to the master or staging branch so
-       building the pull-request locally as it is submitted can trigger a large
-       amount of source builds.
+       Pull-requests are often targeted to the master or staging branch, and
+       building the pull-request locally when it is submitted can trigger
+       many source builds.
      </para>
      <para>
       It is possible to rebase the changes on nixos-unstable or
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -33,6 +33,11 @@
    github = "Anton-Latukha";
    name = "Anton Latukha";
  };
+  ariutta = {
+    email = "anders.riutta@gmail.com";
+    github = "ariutta";
+    name = "Anders Riutta";
+  };
  Baughn = {
    email = "sveina@gmail.com";
    github = "Baughn";
@ -78,6 +83,11 @@
    github = "DmitryTsygankov";
    name = "Dmitry Tsygankov";
  };
+  Dje4321 = {
+    email = "dje4321@gmail.com";
+    github = "dje4321";
+    name = "Dje4321";
+  };
  Esteth = {
    email = "adam.copp@gmail.com";
    name = "Adam Copp";
@ -2453,6 +2463,11 @@
    github = "meisternu";
    name = "Matt Miemiec";
  };
+  melsigl = {
+    email = "melanie.bianca.sigl@gmail.com";
+    github = "melsigl";
+    name = "Melanie B. Sigl";
+  };
  metabar = {
    email = "softs@metabarcoding.org";
    name = "Celine Mercier";
--- a/maintainers/scripts/nixpkgs-lint.pl
+++ b/maintainers/scripts/nixpkgs-lint.pl
@ -1,4 +1,5 @@
-#! /run/current-system/sw/bin/perl -w
+#! /usr/bin/env nix-shell
+#! nix-shell -i perl -p perl perlPackages.XMLSimple

 use strict;
 use List::Util qw(min);
--- a/nixos/doc/manual/release-notes/rl-1809.xml
+++ b/nixos/doc/manual/release-notes/rl-1809.xml
@ -306,6 +306,22 @@ inherit (pkgs.nixos {
     was not used and thus has been removed.
    </para>
   </listitem>
+   <listitem>
+    <para>
+     The option <varname>services.kubernetes.addons.dashboard.enableRBAC</varname>
+     was renamed to <varname>services.kubernetes.addons.dashboard.rbac.enable</varname>.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     The Kubernetes Dashboard now has only minimal RBAC permissions by default.
+     If dashboard cluster-admin rights are desired,
+     set <varname>services.kubernetes.addons.dashboard.rbac.clusterAdmin</varname> to true.
+     On existing clusters, in order for the revocation of privileges to take effect,
+     the current ClusterRoleBinding for kubernetes-dashboard must be manually removed:
+     <literal>kubectl delete clusterrolebinding kubernetes-dashboard</literal>
+    </para>
+   </listitem>
  </itemizedlist>
 </section>
 </section>
--- a/nixos/modules/hardware/brightnessctl.nix
+++ b/nixos/modules/hardware/brightnessctl.nix
@ -0,0 +1,30 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+  cfg = config.hardware.brightnessctl;
+in
+{
+
+  options = {
+
+    hardware.brightnessctl = {
+
+      enable = mkOption {
+        default = false;
+        type = types.bool;
+        description = ''
+          Enable brightnessctl in userspace.
+          This will allow brightness control from users in the video group.
+        '';
+
+      };
+    };
+  };
+
+
+  config = mkIf cfg.enable {
+    services.udev.packages = with pkgs; [ brightnessctl ];
+  };
+
+}
--- a/nixos/modules/hardware/video/uvcvideo/default.nix
+++ b/nixos/modules/hardware/video/uvcvideo/default.nix
@ -0,0 +1,64 @@
+
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+  cfg = config.services.uvcvideo;
+
+  uvcdynctrl-udev-rules = packages: pkgs.callPackage ./uvcdynctrl-udev-rules.nix {
+    drivers = packages;
+    udevDebug = false;
+  };
+
+in
+
+{
+
+  options = {
+    services.uvcvideo.dynctrl = {
+
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to enable <command>uvcvideo</command> dynamic controls.
+
+          Note that enabling this brings the <command>uvcdynctrl</command> tool
+          into your environement and register all dynamic controls from
+          specified <command>packages</command> to the <command>uvcvideo</command> driver.
+        '';
+      };
+
+      packages = mkOption {
+        type = types.listOf types.path;
+        example = literalExample "[ pkgs.tiscamera ]";
+        description = ''
+          List of packages containing <command>uvcvideo</command> dynamic controls
+          rules. All files found in
+          <filename><replaceable>pkg</replaceable>/share/uvcdynctrl/data</filename>
+          will be included.
+
+          Note that these will serve as input to the <command>libwebcam</command>
+          package which through its own <command>udev</command> rule will register
+          the dynamic controls from specified packages to the <command>uvcvideo</command>
+          driver.
+        '';
+        apply = map getBin;
+      };
+    };
+  };
+
+  config = mkIf cfg.dynctrl.enable {
+
+    services.udev.packages = [
+      (uvcdynctrl-udev-rules cfg.dynctrl.packages)
+    ];
+
+    environment.systemPackages = [
+      pkgs.libwebcam
+    ];
+
+  };
+}
--- a/nixos/modules/hardware/video/uvcvideo/uvcdynctrl-udev-rules.nix
+++ b/nixos/modules/hardware/video/uvcvideo/uvcdynctrl-udev-rules.nix
@ -0,0 +1,46 @@
+{ lib
+, stdenv
+, buildEnv
+, libwebcam
+, makeWrapper
+, runCommand
+, drivers ? []
+, udevDebug ? false
+}:
+
+let
+  version = "0.0.0";
+
+  dataPath = buildEnv {
+    name = "uvcdynctrl-with-drivers-data-path";
+    paths = drivers ++ [ libwebcam ];
+    pathsToLink = [ "/share/uvcdynctrl/data" ];
+    ignoreCollisions = false;
+  };
+
+  dataDir = "${dataPath}/share/uvcdynctrl/data";
+  udevDebugVarValue = if udevDebug then "1" else "0";
+in
+
+runCommand "uvcdynctrl-udev-rules-${version}"
+{
+  inherit dataPath;
+  buildInputs = [
+    makeWrapper
+    libwebcam
+  ];
+  dontPatchELF = true;
+  dontStrip = true;
+}
+''
+  mkdir -p "$out/lib/udev"
+  makeWrapper "${libwebcam}/lib/udev/uvcdynctrl" "$out/lib/udev/uvcdynctrl" \
+    --set NIX_UVCDYNCTRL_DATA_DIR "${dataDir}" \
+    --set NIX_UVCDYNCTRL_UDEV_DEBUG "${udevDebugVarValue}"
+
+  mkdir -p "$out/lib/udev/rules.d"
+  cat "${libwebcam}/lib/udev/rules.d/80-uvcdynctrl.rules" | \
+    sed -r "s#RUN\+\=\"([^\"]+)\"#RUN\+\=\"$out/lib/udev/uvcdynctrl\"#g" > \
+    "$out/lib/udev/rules.d/80-uvcdynctrl.rules"
+''
+
--- a/nixos/modules/installer/scan/not-detected.nix
+++ b/nixos/modules/installer/scan/not-detected.nix
@ -1,9 +1,6 @@
-# List all devices which are _not_ detected by nixos-generate-config.
-# Common devices are enabled by default.
-{ config, lib, pkgs, ... }:
-
-with lib;
+# Enables non-free firmware on devices not recognized by `nixos-generate-config`.
+{ lib, ... }:

 {
-  hardware.enableRedistributableFirmware = true;
+  hardware.enableRedistributableFirmware = lib.mkDefault true;
 }
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -29,6 +29,7 @@
  ./config/vpnc.nix
  ./config/zram.nix
  ./hardware/all-firmware.nix
+  ./hardware/brightnessctl.nix
  ./hardware/ckb.nix
  ./hardware/cpu/amd-microcode.nix
  ./hardware/cpu/intel-microcode.nix
@ -50,6 +51,7 @@
  ./hardware/video/bumblebee.nix
  ./hardware/video/displaylink.nix
  ./hardware/video/nvidia.nix
+  ./hardware/video/uvcvideo/default.nix
  ./hardware/video/webcam/facetimehd.nix
  ./i18n/input-method/default.nix
  ./i18n/input-method/fcitx.nix
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@ -34,6 +34,7 @@ with lib;
    (mkRenamedOptionModule [ "services" "kubernetes" "apiserver" "admissionControl" ] [ "services" "kubernetes" "apiserver" "enableAdmissionPlugins" ])
    (mkRenamedOptionModule [ "services" "kubernetes" "apiserver" "address" ] ["services" "kubernetes" "apiserver" "bindAddress"])
    (mkRemovedOptionModule [ "services" "kubernetes" "apiserver" "publicAddress" ] "")
+    (mkRenamedOptionModule [ "services" "kubernetes" "addons" "dashboard" "enableRBAC" ] [ "services" "kubernetes" "addons" "dashboard" "rbac" "enable" ])
    (mkRenamedOptionModule [ "services" "logstash" "address" ] [ "services" "logstash" "listenAddress" ])
    (mkRenamedOptionModule [ "services" "mpd" "network" "host" ] [ "services" "mpd" "network" "listenAddress" ])
    (mkRenamedOptionModule [ "services" "neo4j" "host" ] [ "services" "neo4j" "listenAddress" ])
--- a/nixos/modules/services/cluster/kubernetes/dashboard.nix
+++ b/nixos/modules/services/cluster/kubernetes/dashboard.nix
@ -8,10 +8,25 @@ in {
  options.services.kubernetes.addons.dashboard = {
    enable = mkEnableOption "kubernetes dashboard addon";

-    enableRBAC = mkOption {
-      description = "Whether to enable role based access control is enabled for kubernetes dashboard";
-      type = types.bool;
-      default = elem "RBAC" config.services.kubernetes.apiserver.authorizationMode;
+    rbac = mkOption {
+      description = "Role-based access control (RBAC) options";
+      type = types.submodule {
+
+        options = {
+          enable = mkOption {
+            description = "Whether to enable role based access control is enabled for kubernetes dashboard";
+            type = types.bool;
+            default = elem "RBAC" config.services.kubernetes.apiserver.authorizationMode;
+          };
+
+          clusterAdmin = mkOption {
+            description = "Whether to assign cluster admin rights to the kubernetes dashboard";
+            type = types.bool;
+            default = false;
+          };
+          
+        };
+      };
    };

    version = mkOption {
@ -202,29 +217,106 @@ in {
          namespace = "kube-system";
        };
      };
-    } // (optionalAttrs cfg.enableRBAC {
-      kubernetes-dashboard-crb = {
-        apiVersion = "rbac.authorization.k8s.io/v1";
-        kind = "ClusterRoleBinding";
-        metadata = {
-          name = "kubernetes-dashboard";
-          labels = {
-            k8s-app = "kubernetes-dashboard";
-            k8s-addon = "kubernetes-dashboard.addons.k8s.io";
-            "addonmanager.kubernetes.io/mode" = "Reconcile";
-          };
-        };
-        roleRef = {
-          apiGroup = "rbac.authorization.k8s.io";
-          kind = "ClusterRole";
-          name = "cluster-admin";
-        };
+    } // (optionalAttrs cfg.rbac.enable
+      (let
        subjects = [{
          kind = "ServiceAccount";
          name = "kubernetes-dashboard";
          namespace = "kube-system";
        }];
-      };
-    });
+        labels = {
+          k8s-app = "kubernetes-dashboard";
+          k8s-addon = "kubernetes-dashboard.addons.k8s.io";
+          "addonmanager.kubernetes.io/mode" = "Reconcile";
+        };
+      in
+        (if cfg.rbac.clusterAdmin then {
+          kubernetes-dashboard-crb = {
+            apiVersion = "rbac.authorization.k8s.io/v1";
+            kind = "ClusterRoleBinding";
+            metadata = {
+              name = "kubernetes-dashboard";
+              inherit labels;
+            };
+            roleRef = {
+              apiGroup = "rbac.authorization.k8s.io";
+              kind = "ClusterRole";
+              name = "cluster-admin";
+            };
+            inherit subjects;
+          };
+        }
+        else
+        {
+          # Upstream role- and rolebinding as per:
+          # https://raw.githubusercontent.com/kubernetes/dashboard/master/src/deploy/alternative/kubernetes-dashboard.yaml
+          kubernetes-dashboard-role = {
+            apiVersion = "rbac.authorization.k8s.io/v1";
+            kind = "Role";
+            metadata = {
+              name = "kubernetes-dashboard-minimal";
+              namespace = "kube-system";
+              inherit labels;
+            };
+            rules = [
+              # Allow Dashboard to create 'kubernetes-dashboard-key-holder' secret.
+              {
+                apiGroups = [""];
+                resources = ["secrets"];
+                verbs = ["create"];
+              }
+              # Allow Dashboard to create 'kubernetes-dashboard-settings' config map.
+              {
+                apiGroups = [""];
+                resources = ["configmaps"];
+                verbs = ["create"];
+              }
+              # Allow Dashboard to get, update and delete Dashboard exclusive secrets.
+              {
+                apiGroups = [""];
+                resources = ["secrets"];
+                resourceNames = ["kubernetes-dashboard-key-holder"];
+                verbs = ["get" "update" "delete"];
+              }
+              # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
+              {
+                apiGroups = [""];
+                resources = ["configmaps"];
+                resourceNames = ["kubernetes-dashboard-settings"];
+                verbs = ["get" "update"];
+              }
+              # Allow Dashboard to get metrics from heapster.
+              {
+                apiGroups = [""];
+                resources = ["services"];
+                resourceNames = ["heapster"];
+                verbs = ["proxy"];
+              }
+              {
+                apiGroups = [""];
+                resources = ["services/proxy"];
+                resourceNames = ["heapster" "http:heapster:" "https:heapster:"];
+                verbs = ["get"];
+              }
+            ];
+          };
+
+          kubernetes-dashboard-rb = {
+            apiVersion = "rbac.authorization.k8s.io/v1";
+            kind = "RoleBinding";
+            metadata = {
+              name = "kubernetes-dashboard-minimal";
+              namespace = "kube-system";
+              inherit labels;
+            };
+            roleRef = {
+              apiGroup = "rbac.authorization.k8s.io";
+              kind = "Role";
+              name = "kubernetes-dashboard-minimal";
+            };
+            inherit subjects;
+          };
+        })
+    ));
  };
 }
--- a/nixos/modules/services/cluster/kubernetes/default.nix
+++ b/nixos/modules/services/cluster/kubernetes/default.nix
@ -332,11 +332,11 @@ in {

      authorizationMode = mkOption {
        description = ''
-          Kubernetes apiserver authorization mode (AlwaysAllow/AlwaysDeny/ABAC/RBAC). See
+          Kubernetes apiserver authorization mode (AlwaysAllow/AlwaysDeny/ABAC/Webhook/RBAC/Node). See
          <link xlink:href="https://kubernetes.io/docs/reference/access-authn-authz/authorization/"/>
        '';
        default = ["RBAC" "Node"];
-        type = types.listOf (types.enum ["AlwaysAllow" "AlwaysDeny" "ABAC" "RBAC" "Node"]);
+        type = types.listOf (types.enum ["AlwaysAllow" "AlwaysDeny" "ABAC" "Webhook" "RBAC" "Node"]);
      };

      authorizationPolicy = mkOption {
@ -348,6 +348,15 @@ in {
        type = types.listOf types.attrs;
      };

+      webhookConfig = mkOption {
+        description = ''
+          Kubernetes apiserver Webhook config file. It uses the kubeconfig file format.
+          See <link xlink:href="https://kubernetes.io/docs/reference/access-authn-authz/webhook/"/>
+        '';
+        default = null;
+        type = types.nullOr types.path;
+      };
+
      allowPrivileged = mkOption {
        description = "Whether to allow privileged containers on Kubernetes.";
        default = true;
@ -943,6 +952,9 @@ in {
                (concatMapStringsSep "\n" (l: builtins.toJSON l) cfg.apiserver.authorizationPolicy)
              }"
            } \
+            ${optionalString (elem "Webhook" cfg.apiserver.authorizationMode)
+              "--authorization-webhook-config-file=${cfg.apiserver.webhookConfig}"
+            } \
            --secure-port=${toString cfg.apiserver.securePort} \
            --service-cluster-ip-range=${cfg.apiserver.serviceClusterIpRange} \
            ${optionalString (cfg.apiserver.runtimeConfig != "")
--- a/nixos/modules/services/databases/postgresql.nix
+++ b/nixos/modules/services/databases/postgresql.nix
@ -24,14 +24,13 @@ let

  postgresql = postgresqlAndPlugins cfg.package;

-  flags = optional cfg.enableTCPIP "-i";
-
  # The main PostgreSQL configuration file.
  configFile = pkgs.writeText "postgresql.conf"
    ''
      hba_file = '${pkgs.writeText "pg_hba.conf" cfg.authentication}'
      ident_file = '${pkgs.writeText "pg_ident.conf" cfg.identMap}'
      log_destination = 'stderr'
+      listen_addresses = '${if cfg.enableTCPIP then "*" else "localhost"}'
      port = ${toString cfg.port}
      ${cfg.extraConfig}
    '';
@ -229,7 +228,7 @@ in
                "${cfg.dataDir}/recovery.conf"
            ''}

-             exec postgres ${toString flags}
+             exec postgres
          '';

        serviceConfig =
--- a/nixos/modules/services/logging/journaldriver.nix
+++ b/nixos/modules/services/logging/journaldriver.nix
@ -0,0 +1,112 @@
+# This module implements a systemd service for running journaldriver,
+# a log forwarding agent that sends logs from journald to Stackdriver
+# Logging.
+#
+# It can be enabled without extra configuration when running on GCP.
+# On machines hosted elsewhere, the other configuration options need
+# to be set.
+#
+# For further information please consult the documentation in the
+# upstream repository at: https://github.com/aprilabank/journaldriver/
+
+{ config, lib, pkgs, ...}:
+
+with lib; let cfg = config.services.journaldriver;
+in {
+  options.services.journaldriver = {
+    enable = mkOption {
+      type        = types.bool;
+      default     = false;
+      description = ''
+        Whether to enable journaldriver to forward journald logs to
+        Stackdriver Logging.
+      '';
+    };
+
+    logLevel = mkOption {
+      type        = types.str;
+      default     = "info";
+      description = ''
+        Log level at which journaldriver logs its own output.
+      '';
+    };
+
+    logName = mkOption {
+      type        = with types; nullOr str;
+      default     = null;
+      description = ''
+        Configures the name of the target log in Stackdriver Logging.
+        This option can be set to, for example, the hostname of a
+        machine to improve the user experience in the logging
+        overview.
+      '';
+    };
+
+    googleCloudProject = mkOption {
+      type        = with types; nullOr str;
+      default     = null;
+      description = ''
+        Configures the name of the Google Cloud project to which to
+        forward journald logs.
+
+        This option is required on non-GCP machines, but should not be
+        set on GCP instances.
+      '';
+    };
+
+    logStream = mkOption {
+      type        = with types; nullOr str;
+      default     = null;
+      description = ''
+        Configures the name of the Stackdriver Logging log stream into
+        which to write journald entries.
+
+        This option is required on non-GCP machines, but should not be
+        set on GCP instances.
+      '';
+    };
+
+    applicationCredentials = mkOption {
+      type        = with types; nullOr path;
+      default     = null;
+      description = ''
+        Path to the service account private key (in JSON-format) used
+        to forward log entries to Stackdriver Logging on non-GCP
+        instances.
+
+        This option is required on non-GCP machines, but should not be
+        set on GCP instances.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.journaldriver = {
+      description = "Stackdriver Logging journal forwarder";
+      script      = "${pkgs.journaldriver}/bin/journaldriver";
+      after       = [ "network-online.target" ];
+      wantedBy    = [ "multi-user.target" ];
+
+      serviceConfig = {
+        Restart        = "always";
+        DynamicUser    = true;
+
+        # This directive lets systemd automatically configure
+        # permissions on /var/lib/journaldriver, the directory in
+        # which journaldriver persists its cursor state.
+        StateDirectory = "journaldriver";
+
+        # This group is required for accessing journald.
+        SupplementaryGroups = "systemd-journal";
+      };
+
+      environment = {
+        RUST_LOG                       = cfg.logLevel;
+        LOG_NAME                       = cfg.logName;
+        LOG_STREAM                     = cfg.logStream;
+        GOOGLE_CLOUD_PROJECT           = cfg.googleCloudProject;
+        GOOGLE_APPLICATION_CREDENTIALS = cfg.applicationCredentials;
+      };
+    };
+  };
+}
--- a/nixos/modules/services/mail/opensmtpd.nix
+++ b/nixos/modules/services/mail/opensmtpd.nix
@ -10,7 +10,7 @@ let

  sendmail = pkgs.runCommand "opensmtpd-sendmail" {} ''
    mkdir -p $out/bin
-    ln -s ${pkgs.opensmtpd}/sbin/smtpctl $out/bin/sendmail
+    ln -s ${cfg.package}/sbin/smtpctl $out/bin/sendmail
  '';

 in {
@ -27,6 +27,13 @@ in {
        description = "Whether to enable the OpenSMTPD server.";
      };

+      package = mkOption {
+        type = types.package;
+        default = pkgs.opensmtpd;
+        defaultText = "pkgs.opensmtpd";
+        description = "The OpenSMTPD package to use.";
+      };
+
      addSendmailToSystemPath = mkOption {
        type = types.bool;
        default = true;
@ -97,7 +104,7 @@ in {
    systemd.services.opensmtpd = let
      procEnv = pkgs.buildEnv {
        name = "opensmtpd-procs";
-        paths = [ pkgs.opensmtpd ] ++ cfg.procPackages;
+        paths = [ cfg.package ] ++ cfg.procPackages;
        pathsToLink = [ "/libexec/opensmtpd" ];
      };
    in {
@ -115,7 +122,7 @@ in {
        chown smtpq.root /var/spool/smtpd/purge
        chmod 700 /var/spool/smtpd/purge
      '';
-      serviceConfig.ExecStart = "${pkgs.opensmtpd}/sbin/smtpd -d -f ${conf} ${args}";
+      serviceConfig.ExecStart = "${cfg.package}/sbin/smtpd -d -f ${conf} ${args}";
      environment.OPENSMTPD_PROC_PATH = "${procEnv}/libexec/opensmtpd";
    };

--- a/nixos/modules/services/misc/xmr-stak.nix
+++ b/nixos/modules/services/misc/xmr-stak.nix
@ -10,9 +10,6 @@ let
    inherit (cfg) openclSupport cudaSupport;
  };

-  xmrConfArg = optionalString (cfg.configText != "") ("-c " +
-    pkgs.writeText "xmr-stak-config.txt" cfg.configText);
-
 in

 {
@ -29,22 +26,34 @@ in
        description = "List of parameters to pass to xmr-stak.";
      };

-      configText = mkOption {
-        type = types.lines;
-        default = "";
-        example = ''
-          "currency" : "monero",
-          "pool_list" :
-            [ { "pool_address" : "pool.supportxmr.com:5555",
-                "wallet_address" : "<long-hash>",
-                "pool_password" : "minername",
-                "pool_weight" : 1,
-              },
-            ],
+      configFiles = mkOption {
+        type = types.attrsOf types.str;
+        default = {};
+        example = literalExample ''
+          {
+            "config.txt" = '''
+              "verbose_level" : 4,
+              "h_print_time" : 60,
+              "tls_secure_algo" : true,
+            ''';
+            "pools.txt" = '''
+              "currency" : "monero7",
+              "pool_list" :
+              [ { "pool_address" : "pool.supportxmr.com:443",
+                  "wallet_address" : "my-wallet-address",
+                  "rig_id" : "",
+                  "pool_password" : "nixos",
+                  "use_nicehash" : false,
+                  "use_tls" : true,
+                  "tls_fingerprint" : "",
+                  "pool_weight" : 23
+                },
+              ],
+            ''';
+          }
        '';
        description = ''
-          Verbatim xmr-stak config.txt. If empty, the <literal>-c</literal>
-          parameter will not be added to the xmr-stak command.
+          Content of config files like config.txt, pools.txt or cpu.txt.
        '';
      };
    };
@ -58,10 +67,13 @@ in
      environment = mkIf cfg.cudaSupport {
        LD_LIBRARY_PATH = "${pkgs.linuxPackages_latest.nvidia_x11}/lib";
      };
-      script = ''
-        exec ${pkg}/bin/xmr-stak ${xmrConfArg} ${concatStringsSep " " cfg.extraArgs}
-      '';
+
+      preStart = concatStrings (flip mapAttrsToList cfg.configFiles (fn: content: ''
+        ln -sf '${pkgs.writeText "xmr-stak-${fn}" content}' '${fn}'
+      ''));
+
      serviceConfig = let rootRequired = cfg.openclSupport || cfg.cudaSupport; in {
+        ExecStart = "${pkg}/bin/xmr-stak ${concatStringsSep " " cfg.extraArgs}";
        # xmr-stak generates cpu and/or gpu configuration files
        WorkingDirectory = "/tmp";
        PrivateTmp = true;
@ -70,4 +82,12 @@ in
      };
    };
  };
+
+  imports = [
+    (mkRemovedOptionModule ["services" "xmr-stak" "configText"] ''
+      This option was removed in favour of `services.xmr-stak.configFiles`
+      because the new config file `pools.txt` was introduced. You are
+      now able to define all other config files like cpu.txt or amd.txt.
+    '')
+  ];
 }
--- a/nixos/modules/services/networking/networkmanager.nix
+++ b/nixos/modules/services/networking/networkmanager.nix
@ -38,6 +38,8 @@ let

    [device]
    wifi.scan-rand-mac-address=${if cfg.wifi.scanRandMacAddress then "yes" else "no"}
+
+    ${cfg.extraConfig}
  '';

  /*
@ -120,6 +122,14 @@ in {
        '';
      };

+      extraConfig = mkOption {
+        type = types.lines;
+        default = "";
+        description = ''
+          Configuration appended to the generated NetworkManager.conf.
+        '';
+      };
+
      unmanaged = mkOption {
        type = types.listOf types.string;
        default = [];
--- a/nixos/modules/services/networking/xrdp.nix
+++ b/nixos/modules/services/networking/xrdp.nix
@ -97,6 +97,7 @@ in
    # xrdp can run X11 program even if "services.xserver.enable = false"
    environment.pathsToLink =
      [ "/etc/xdg" "/share/xdg" "/share/applications" "/share/icons" "/share/pixmaps" ];
+    fonts.enableDefaultFonts = mkDefault true;

    systemd = {
      services.xrdp = {
--- a/nixos/modules/services/security/oauth2_proxy.nix
+++ b/nixos/modules/services/security/oauth2_proxy.nix
@ -72,6 +72,7 @@ let

  mapConfig = key: attr:
  if (!isNull attr && attr != []) then (
+    if isDerivation attr then mapConfig key (toString attr) else
    if (builtins.typeOf attr) == "set" then concatStringsSep " "
      (mapAttrsToList (name: value: mapConfig (key + "-" + name) value) attr) else
    if (builtins.typeOf attr) == "list" then concatMapStringsSep " " (mapConfig key) attr else
--- a/nixos/modules/services/security/tor.nix
+++ b/nixos/modules/services/security/tor.nix
@ -360,7 +360,7 @@ in

                <important>
                  <para>
-                    WARNING: THE FOLLOWING PARAGRAPH IS NOT LEGAL ADVISE.
+                    WARNING: THE FOLLOWING PARAGRAPH IS NOT LEGAL ADVICE.
                    Consult with your lawer when in doubt.
                  </para>

--- a/nixos/modules/services/web-apps/mattermost.nix
+++ b/nixos/modules/services/web-apps/mattermost.nix
@ -203,11 +203,11 @@ in
          Group = cfg.group;
          ExecStart = "${pkgs.mattermost}/bin/mattermost-platform";
          WorkingDirectory = "${cfg.statePath}";
-          JoinsNamespaceOf = mkIf cfg.localDatabaseCreate "postgresql.service";
          Restart = "always";
          RestartSec = "10";
          LimitNOFILE = "49152";
        };
+        unitConfig.JoinsNamespaceOf = mkIf cfg.localDatabaseCreate "postgresql.service";
      };
    })
    (mkIf cfg.matterircd.enable {
--- a/nixos/modules/services/web-apps/nexus.nix
+++ b/nixos/modules/services/web-apps/nexus.nix
@ -13,6 +13,12 @@ in
    services.nexus = {
      enable = mkEnableOption "Sonatype Nexus3 OSS service";

+      package = mkOption {
+        type = types.package;
+        default = pkgs.nexus;
+        description = "Package which runs Nexus3";
+      };
+
      user = mkOption {
        type = types.str;
        default = "nexus";
@ -55,10 +61,10 @@ in
          -XX:LogFile=${cfg.home}/nexus3/log/jvm.log
          -XX:-OmitStackTraceInFastThrow
          -Djava.net.preferIPv4Stack=true
-          -Dkaraf.home=${pkgs.nexus}
-          -Dkaraf.base=${pkgs.nexus}
-          -Dkaraf.etc=${pkgs.nexus}/etc/karaf
-          -Djava.util.logging.config.file=${pkgs.nexus}/etc/karaf/java.util.logging.properties
+          -Dkaraf.home=${cfg.package}
+          -Dkaraf.base=${cfg.package}
+          -Dkaraf.etc=${cfg.package}/etc/karaf
+          -Djava.util.logging.config.file=${cfg.package}/etc/karaf/java.util.logging.properties
          -Dkaraf.data=${cfg.home}/nexus3
          -Djava.io.tmpdir=${cfg.home}/nexus3/tmp
          -Dkaraf.startLocalConsole=false
@ -112,7 +118,7 @@ in
        fi
      '';

-      script = "${pkgs.nexus}/bin/nexus run";
+      script = "${cfg.package}/bin/nexus run";

      serviceConfig = {
        User = cfg.user;
--- a/nixos/modules/services/x11/display-managers/lightdm-greeters/mini.nix
+++ b/nixos/modules/services/x11/display-managers/lightdm-greeters/mini.nix
@ -0,0 +1,100 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+  dmcfg = config.services.xserver.displayManager;
+  ldmcfg = dmcfg.lightdm;
+  cfg = ldmcfg.greeters.mini;
+
+  xgreeters = pkgs.linkFarm "lightdm-mini-greeter-xgreeters" [{
+    path = "${pkgs.lightdm-mini-greeter}/share/xgreeters/lightdm-mini-greeter.desktop";
+    name = "lightdm-mini-greeter.desktop";
+  }];
+
+  miniGreeterConf = pkgs.writeText "lightdm-mini-greeter.conf"
+    ''
+    [greeter]
+    user = ${cfg.user}
+    show-password-label = true
+    password-label-text = Password:
+    show-input-cursor = true
+
+    [greeter-hotkeys]
+    mod-key = meta
+    shutdown-key = s
+    restart-key = r
+    hibernate-key = h
+    suspend-key = u
+
+    [greeter-theme]
+    font = Sans
+    font-size = 1em
+    text-color = "#080800"
+    error-color = "#F8F8F0"
+    background-image = "${ldmcfg.background}"
+    background-color = "#1B1D1E"
+    window-color = "#F92672"
+    border-color = "#080800"
+    border-width = 2px
+    layout-space = 15
+    password-color = "#F8F8F0"
+    password-background-color = "#1B1D1E"
+
+    ${cfg.extraConfig}
+    '';
+
+in
+{
+  options = {
+
+    services.xserver.displayManager.lightdm.greeters.mini = {
+
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to enable lightdm-mini-greeter as the lightdm greeter.
+
+          Note that this greeter starts only the default X session.
+          You can configure the default X session by
+          <option>services.xserver.desktopManager.default</option> and
+          <option>services.xserver.windowManager.default</option>.
+        '';
+      };
+
+      user = mkOption {
+        type = types.str;
+        default = "root";
+        description = ''
+          The user to login as.
+        '';
+      };
+
+      extraConfig = mkOption {
+        type = types.lines;
+        default = "";
+        description = ''
+          Extra configuration that should be put in the lightdm-mini-greeter.conf
+          configuration file.
+        '';
+      };
+
+    };
+
+  };
+
+  config = mkIf (ldmcfg.enable && cfg.enable) {
+
+    services.xserver.displayManager.lightdm.greeters.gtk.enable = false;
+
+    services.xserver.displayManager.lightdm.greeter = mkDefault {
+      package = xgreeters;
+      name = "lightdm-mini-greeter";
+    };
+
+    environment.etc."lightdm/lightdm-mini-greeter.conf".source = miniGreeterConf;
+
+  };
+}
--- a/nixos/modules/services/x11/display-managers/lightdm.nix
+++ b/nixos/modules/services/x11/display-managers/lightdm.nix
@ -72,6 +72,7 @@ in
  # preferred.
  imports = [
    ./lightdm-greeters/gtk.nix
+    ./lightdm-greeters/mini.nix
  ];

  options = {
--- a/nixos/modules/system/boot/loader/grub/grub.nix
+++ b/nixos/modules/system/boot/loader/grub/grub.nix
@ -385,8 +385,9 @@ in
      };

      default = mkOption {
-        default = 0;
-        type = types.int;
+        default = "0";
+        type = types.either types.int types.str;
+        apply = toString;
        description = ''
          Index of the default menu item to be booted.
        '';
--- a/nixos/modules/system/boot/loader/grub/install-grub.pl
+++ b/nixos/modules/system/boot/loader/grub/install-grub.pl
@ -54,7 +54,7 @@ my $splashImage = get("splashImage");
 my $configurationLimit = int(get("configurationLimit"));
 my $copyKernels = get("copyKernels") eq "true";
 my $timeout = int(get("timeout"));
-my $defaultEntry = int(get("default"));
+my $defaultEntry = get("default");
 my $fsIdentifier = get("fsIdentifier");
 my $grubEfi = get("grubEfi");
 my $grubTargetEfi = get("grubTargetEfi");
--- a/nixos/modules/system/boot/stage-1-init.sh
+++ b/nixos/modules/system/boot/stage-1-init.sh
@ -251,6 +251,9 @@ checkFS() {
    # Skip fsck for bcachefs - not implemented yet.
    if [ "$fsType" = bcachefs ]; then return 0; fi

+    # Skip fsck for nilfs2 - not needed by design and no fsck tool for this filesystem.
+    if [ "$fsType" = nilfs2 ]; then return 0; fi
+
    # Skip fsck for inherently readonly filesystems.
    if [ "$fsType" = squashfs ]; then return 0; fi

--- a/nixos/modules/system/boot/stage-1.nix
+++ b/nixos/modules/system/boot/stage-1.nix
@ -56,6 +56,12 @@ let
      left=("''${left[@]:3}")
      if [ -z ''${seen[$next]+x} ]; then
        seen[$next]=1
+
+        # Ignore the dynamic linker which for some reason appears as a DT_NEEDED of glibc but isn't in glibc's RPATH.
+        case "$next" in
+          ld*.so.?) continue;;
+        esac
+
        IFS=: read -ra paths <<< $rpath
        res=
        for path in "''${paths[@]}"; do
--- a/nixos/modules/tasks/filesystems/zfs.nix
+++ b/nixos/modules/tasks/filesystems/zfs.nix
@ -431,6 +431,7 @@ in
          {
            requires = services;
            after = services;
+            wantedBy = [ "zfs.target" ];
          };

      systemd.targets."zfs".wantedBy = [ "multi-user.target" ];
--- a/pkgs/applications/altcoins/bitcoin.nix
+++ b/pkgs/applications/altcoins/bitcoin.nix
@ -5,13 +5,13 @@
 with stdenv.lib;
 stdenv.mkDerivation rec{
  name = "bitcoin" + (toString (optional (!withGui) "d")) + "-" + version;
-  version = "0.16.0";
+  version = "0.16.1";

  src = fetchurl {
    urls = [ "https://bitcoincore.org/bin/bitcoin-core-${version}/bitcoin-${version}.tar.gz"
             "https://bitcoin.org/bin/bitcoin-core-${version}/bitcoin-${version}.tar.gz"
           ];
-    sha256 = "0h7flgsfjzbqajwv8ih686yyxxljhf8krhm8jxranb4kglww1glc";
+    sha256 = "1zkqp93yircd3pbxczxfnibkpq0sgcv5r7wg6d196b9pwgr9zd39";
  };

  nativeBuildInputs = [ pkgconfig autoreconfHook ];
--- a/pkgs/applications/audio/elisa/default.nix
+++ b/pkgs/applications/audio/elisa/default.nix
@ -7,13 +7,13 @@

 mkDerivation rec {
  name = "elisa-${version}";
-  version = "0.1";
+  version = "0.1.80";

  src = fetchFromGitHub {
    owner  = "KDE";
    repo   = "elisa";
-    rev    = version;
-    sha256 = "13i0fkpwrskric3gfalh7mcpp4l2knwnq7jpq391lgh6krq04r4w";
+    rev    = "v${version}";
+    sha256 = "1kyvdxbsfi692zazw8vjy6mwyy0sa4r1cim8gsiv9pphfh5bpxb1";
  };

  nativeBuildInputs = [ extra-cmake-modules kdoctools wrapGAppsHook ];
--- a/pkgs/applications/audio/gpodder/default.nix
+++ b/pkgs/applications/audio/gpodder/default.nix
@ -5,7 +5,7 @@

 python3Packages.buildPythonApplication rec {
  name = "gpodder-${version}";
-  version = "3.10.1";
+  version = "3.10.2";

  format = "other";

@ -13,7 +13,7 @@ python3Packages.buildPythonApplication rec {
    owner = "gpodder";
    repo = "gpodder";
    rev = version;
-    sha256 = "1cqhm5h0kkdb2m691dbj8i3bixl7bw0iww2pl6k1jkz8mgafyd9d";
+    sha256 = "0nbhyh44cympslcf4miwc2n1gccm5ghjf9slg0r8xnpvg921jv04";
  };

  postPatch = with stdenv.lib; ''
--- a/pkgs/applications/audio/lollypop/default.nix
+++ b/pkgs/applications/audio/lollypop/default.nix
@ -0,0 +1,58 @@
+{ stdenv, fetchgit, meson, ninja, pkgconfig, wrapGAppsHook
+, appstream-glib, desktop-file-utils, gobjectIntrospection
+, python36Packages, gnome3, glib, gst_all_1 }:
+
+stdenv.mkDerivation rec  {  
+  version = "0.9.514";
+  name = "lollypop-${version}";
+
+  src = fetchgit {
+    url = "https://gitlab.gnome.org/World/lollypop";
+    rev = "refs/tags/${version}";
+    fetchSubmodules = true;
+    sha256 = "0ny8c5apldhhrcjl3wz01pbyjvf60b7xy39mpvbshvdpnqlnqsca";
+  };
+
+  nativeBuildInputs = with python36Packages; [
+    desktop-file-utils
+    meson
+    ninja
+    pkgconfig
+    wrapGAppsHook
+    wrapPython
+  ];
+
+  buildInputs = [
+    appstream-glib glib gobjectIntrospection
+  ] ++ (with gnome3; [
+    easytag gsettings_desktop_schemas gtk3 libsecret libsoup totem-pl-parser
+  ]) ++ (with gst_all_1; [
+    gst-libav gst-plugins-bad gst-plugins-base gst-plugins-good gst-plugins-ugly
+    gstreamer
+  ]);
+
+  pythonPath = with python36Packages; [
+    beautifulsoup4
+    gst-python
+    pillow
+    pycairo
+    pydbus
+    pygobject3
+    pylast
+  ];
+
+  postFixup = "wrapPythonPrograms";
+
+  postPatch = ''
+    chmod +x ./meson_post_install.py
+    patchShebangs ./meson_post_install.py
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A modern music player for GNOME";
+    homepage    = https://wiki.gnome.org/Apps/Lollypop;
+    license     = licenses.gpl3Plus;
+    maintainers = with maintainers; [ worldofpeace ];
+    platforms   = platforms.linux;
+  };
+}
--- a/pkgs/applications/audio/qjackctl/default.nix
+++ b/pkgs/applications/audio/qjackctl/default.nix
@ -1,14 +1,14 @@
 { stdenv, fetchurl, pkgconfig, alsaLib, libjack2, dbus, qtbase, qttools, qtx11extras }:

 stdenv.mkDerivation rec {
-  version = "0.5.1";
+  version = "0.5.2";
  name = "qjackctl-${version}";

  # some dependencies such as killall have to be installed additionally

  src = fetchurl {
    url = "mirror://sourceforge/qjackctl/${name}.tar.gz";
-    sha256 = "0jw1s4qh4qjxnysddjv3j2lchwlslj9p4iisv9i89d3m7pf1svs4";
+    sha256 = "0nqr5f82lry3i4if8wdmrqsw84m45ijyj4psll30plxx5732zzaz";
  };

  buildInputs = [
--- a/pkgs/applications/audio/spectrojack/default.nix
+++ b/pkgs/applications/audio/spectrojack/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "spectrojack-${version}";
-  version = "0.4";
+  version = "0.4.1";

  src = fetchurl {
    url = "http://sed.free.fr/spectrojack/${name}.tar.gz";
-    sha256 = "0p5aa55hnazv5djw0431mza068h7mjkb9pnglxfpqkx5z0czisdx";
+    sha256 = "1kiwx0kag7kq7rhg0bvckfm8r7pqmbk76ppa39cq2980jb5v8rfp";
  };
  nativeBuildInputs = [ pkgconfig ];
  buildInputs = [ libjack2 fftwFloat gtk2 ];
--- a/pkgs/applications/backup/deja-dup/default.nix
+++ b/pkgs/applications/backup/deja-dup/default.nix
@ -19,8 +19,13 @@ stdenv.mkDerivation rec {
      src = ./fix-paths.patch;
      inherit coreutils;
    })
+    ./hardcode-gsettings.patch
  ];

+  postPatch = ''
+    substituteInPlace deja-dup/nautilus/NautilusExtension.c --subst-var-by DEJA_DUP_GSETTINGS_PATH $out/share/gsettings-schemas/${name}/glib-2.0/schemas
+  '';
+
  nativeBuildInputs = [
    meson ninja pkgconfig vala_0_40 gettext itstool
    appstream-glib desktop-file-utils libxml2 wrapGAppsHook
--- a/pkgs/applications/backup/deja-dup/hardcode-gsettings.patch
+++ b/pkgs/applications/backup/deja-dup/hardcode-gsettings.patch
@ -0,0 +1,38 @@
+--- a/deja-dup/nautilus/NautilusExtension.c
+++ b/deja-dup/nautilus/NautilusExtension.c
+@@ -24,6 +24,8 @@
+ #include <glib/gi18n-lib.h>
+ 
+ GList *dirs = NULL;
+GSettingsSchemaSource *schema_source = NULL;
+GSettingsSchema *schema = NULL;
+ GSettings *settings = NULL;
+ 
+ // This will treat a < b iff a is 'lower' in the file tree than b
+@@ -313,7 +315,13 @@
+   bindtextdomain(GETTEXT_PACKAGE, LOCALE_DIR);
+   bind_textdomain_codeset(GETTEXT_PACKAGE, "UTF-8");
+ 
+-  settings = g_settings_new("org.gnome.DejaDup");
+  schema_source = g_settings_schema_source_new_from_directory ("@DEJA_DUP_GSETTINGS_PATH@",
+    g_settings_schema_source_get_default (), TRUE, NULL);
+
+  schema = g_settings_schema_source_lookup (schema_source,
+                                            "org.gnome.DejaDup", FALSE);
+
+  settings = g_settings_new_full (schema, NULL, NULL);
+   g_signal_connect(settings, "changed::include-list",
+                    update_include_excludes, NULL);
+   g_signal_connect(settings, "changed::exclude-list",
+@@ -329,7 +337,11 @@
+ 
+ void nautilus_module_shutdown(void)
+ {
+  g_settings_schema_source_unref(schema_source);
+  g_settings_schema_unref(schema);
+   g_object_unref(settings);
+  schema_source = NULL;
+  schema = NULL;
+   settings = NULL;
+ 
+   update_include_excludes(); /* will clear it now that settings is NULL */
--- a/pkgs/applications/display-managers/lightdm-mini-greeter/default.nix
+++ b/pkgs/applications/display-managers/lightdm-mini-greeter/default.nix
@ -0,0 +1,32 @@
+{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, lightdm, gtk3 }:
+
+stdenv.mkDerivation rec {
+  name = "lightdm-mini-greeter-${version}";
+  version = "0.3.2";
+
+  src = fetchFromGitHub {
+    owner = "prikhi";
+    repo = "lightdm-mini-greeter";
+    rev = version;
+    sha256 = "1g3lrh034w38hiq96b0xmghmlf87hcycwdh06dwkdksr0hl08wxy";
+  };
+
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ lightdm gtk3 ];
+
+  configureFlags = [ "--sysconfdir=/etc" ];
+  makeFlags = [ "configdir=$(out)/etc" ];
+
+  postInstall = ''
+    substituteInPlace "$out/share/xgreeters/lightdm-mini-greeter.desktop" \
+      --replace "Exec=lightdm-mini-greeter" "Exec=$out/bin/lightdm-mini-greeter"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A minimal, configurable, single-user GTK3 LightDM greeter";
+    homepage = https://github.com/prikhi/lightdm-mini-greeter;
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ mnacamura ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/editors/eclipse/plugins.nix
+++ b/pkgs/applications/editors/eclipse/plugins.nix
@ -532,11 +532,12 @@ rec {

  spotbugs = buildEclipseUpdateSite rec {
    name = "spotbugs-${version}";
-    version = "3.1.3";
+    version = "3.1.5";

    src = fetchzip {
+      stripRoot = false;
      url = "https://github.com/spotbugs/spotbugs/releases/download/${version}/eclipsePlugin.zip";
-      sha256 = "01zrmk497bxzqgwgbpsvi5iz5qk9b4q949h4918abm54zvkgndlg";
+      sha256 = "0fxdirz6ik9rqykm2lcr720apsaqgngr4c7q793rjb9b3bn30c85";
    };

    meta = with stdenv.lib; {
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@ -237,119 +237,119 @@ in

  clion = buildClion rec {
    name = "clion-${version}";
-    version = "2018.1.3";
+    version = "2018.1.5"; /* updated by script */
    description  = "C/C++ IDE. New. Intelligent. Cross-platform";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/cpp/CLion-${version}.tar.gz";
-      sha256 = "0daj1ha7d9kxgb60mx2yzyj01m6ahw5d6wzs0vvwp5fh5qf4mpw5";
+      sha256 = "0hd58i531schyjlm99vff9bi5gjskdbsljd367k9zafjfh53z91l"; /* updated by script */
    };
    wmClass = "jetbrains-clion";
-    update-channel = "CLion_Release"; # channel's id as in http://www.jetbrains.com/updates/updates.xml
+    update-channel = "CLion Release"; # channel's id as in http://www.jetbrains.com/updates/updates.xml
  };

  datagrip = buildDataGrip rec {
    name = "datagrip-${version}";
-    version = "2018.1.3"; /* updated by script */
+    version = "2018.1.4"; /* updated by script */
    description = "Your Swiss Army Knife for Databases and SQL";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/datagrip/${name}.tar.gz";
-      sha256 = "0y959p9jsfqlf6cnj2k5m4bxc85yn5lv549rbacwicx4f0g6zp6r"; /* updated by script */
+      sha256 = "1m0qckq645jw7cj40m5vfgr212b8hji539skavch2j5s5fbqy3ln"; /* updated by script */
    };
    wmClass = "jetbrains-datagrip";
-    update-channel = "datagrip_2018_1";
+    update-channel = "DataGrip 2018.1";
  };

  goland = buildGoland rec {
    name = "goland-${version}";
-    version = "2018.1.3"; /* updated by script */
+    version = "2018.1.4"; /* updated by script */
    description = "Up and Coming Go IDE";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/go/${name}.tar.gz";
-      sha256 = "02nl6dssf2r4lk0fy40cvgm1m0nnfvaz2k6yygwzr35qmbsw2xjq"; /* updated by script */
+      sha256 = "1ipib91443sb27snnqik8rm3bm9w6gb5niildbd538lhc9agc9xb"; /* updated by script */
    };
    wmClass = "jetbrains-goland";
-    update-channel = "goland_release";
+    update-channel = "GoLand Release";
  };

  idea-community = buildIdea rec {
    name = "idea-community-${version}";
-    version = "2018.1.4"; /* updated by script */
+    version = "2018.1.5"; /* updated by script */
    description = "Integrated Development Environment (IDE) by Jetbrains, community edition";
    license = stdenv.lib.licenses.asl20;
    src = fetchurl {
      url = "https://download.jetbrains.com/idea/ideaIC-${version}.tar.gz";
-      sha256 = "1qb425wg4690474g348yizhkcqcgigz2synp4blcfv4p0pg79ri6"; /* updated by script */
+      sha256 = "0bhajghwh5r5mdv3lbnq0xlr6669hid5kyzlsxnsfzc2z737zwc5"; /* updated by script */
    };
    wmClass = "jetbrains-idea-ce";
-    update-channel = "IDEA_Release";
+    update-channel = "IntelliJ IDEA Release";
  };

  idea-ultimate = buildIdea rec {
    name = "idea-ultimate-${version}";
-    version = "2018.1.4"; /* updated by script */
+    version = "2018.1.5"; /* updated by script */
    description = "Integrated Development Environment (IDE) by Jetbrains, requires paid license";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/idea/ideaIU-${version}-no-jdk.tar.gz";
-      sha256 = "0jn771z09bscnk283kwrki0zyzhh4v4n6mr2swbd0ccs9v12dx71"; /* updated by script */
+      sha256 = "046wyvk2f7vbh4zam1bbri4yxzb34q43rjpk6i6npxrb25jv6clx"; /* updated by script */
    };
    wmClass = "jetbrains-idea";
-    update-channel = "IDEA_Release";
+    update-channel = "IntelliJ IDEA Release";
  };

  phpstorm = buildPhpStorm rec {
    name = "phpstorm-${version}";
-    version = "2018.1.4"; /* updated by script */
+    version = "2018.1.6"; /* updated by script */
    description = "Professional IDE for Web and PHP developers";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/webide/PhpStorm-${version}.tar.gz";
-      sha256 = "0rrcsn44va942nrznldjkxymir45q8gq1lf3f8vg1w3k87cfk1zp"; /* updated by script */
+      sha256 = "0v07sfg7ywawk6wb52zhr3753hscpxw3m53ppgw4n50dcdwx0kdn"; /* updated by script */
    };
    wmClass = "jetbrains-phpstorm";
-    update-channel = "PS2018.1";
+    update-channel = "PhpStorm 2018.1";
  };

  pycharm-community = buildPycharm rec {
    name = "pycharm-community-${version}";
-    version = "2018.1.3"; /* updated by script */
+    version = "2018.1.4"; /* updated by script */
    description = "PyCharm Community Edition";
    license = stdenv.lib.licenses.asl20;
    src = fetchurl {
      url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "1cwrqdcp6hwr8wd234g120bblc4bjmhwxwsgj9mmxblj31c7c6an"; /* updated by script */
+      sha256 = "0frzasqh3jx7wcip4dnwdl9ap2g1nkx7anapwd416cxv4jj3r5ch"; /* updated by script */
    };
    wmClass = "jetbrains-pycharm-ce";
-    update-channel = "PyCharm_Release";
+    update-channel = "PyCharm Release";
  };

  pycharm-professional = buildPycharm rec {
    name = "pycharm-professional-${version}";
-    version = "2018.1.3"; /* updated by script */
+    version = "2018.1.4"; /* updated by script */
    description = "PyCharm Professional Edition";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "1chri4cknfvvqhxy973dyf7dl5linqdxc97zshrzdqhmwq6y7580"; /* updated by script */
+      sha256 = "1kv1d5y2ph36aq91sq08lbz8hvfp765xi7m0hdwkhqdi2wkrpnkc"; /* updated by script */
    };
    wmClass = "jetbrains-pycharm";
-    update-channel = "PyCharm_Release";
+    update-channel = "PyCharm Release";
  };

  rider = buildRider rec {
    name = "rider-${version}";
-    version = "2018.1"; /* updated by script */
+    version = "2018.1.2"; /* updated by script */
    description = "A cross-platform .NET IDE based on the IntelliJ platform and ReSharper";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/rider/JetBrains.Rider-${version}.tar.gz";
-      sha256 = "0jhzfi9r18hy6mig8rrrr2n55lrfn5ysa7h347w5yv2dm7kx09ib"; /* updated by script */
+      sha256 = "1jsj0g4mv7fci3jgwx9skaz2m40g3ray2n17djaln08731rls5cc"; /* updated by script */
    };
    wmClass = "jetbrains-rider";
-    update-channel = "rider_2018_1";
+    update-channel = "Rider 2018.1.2";
  };

  ruby-mine = buildRubyMine rec {
@ -362,20 +362,20 @@ in
      sha256 = "033rjsx6zjrfbl89i513ms14iw53ip56h4bkilrij32hshb7c2c5"; /* updated by script */
    };
    wmClass = "jetbrains-rubymine";
-    update-channel = "rm2018.1";
+    update-channel = "RubyMine 2018.1";
  };

  webstorm = buildWebStorm rec {
    name = "webstorm-${version}";
-    version = "2018.1.3"; /* updated by script */
+    version = "2018.1.5"; /* updated by script */
    description = "Professional IDE for Web and JavaScript development";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/webstorm/WebStorm-${version}.tar.gz";
-      sha256 = "03nhs4vmqbm5s4ykjz475nvcbwvp2hb0bq5ijfjxwayj3jgv0zbm"; /* updated by script */
+      sha256 = "1mqms8gzmsaqvwzfk821vj1z1cxdgjw5nnwq63mag6rly04h60n6"; /* updated by script */
    };
    wmClass = "jetbrains-webstorm";
-    update-channel = "WS_Release";
+    update-channel = "WebStorm Release";
  };

 }
--- a/pkgs/applications/editors/jetbrains/update.pl
+++ b/pkgs/applications/editors/jetbrains/update.pl
@ -17,7 +17,7 @@ sub get_latest_versions {
  my @channels = get("http://www.jetbrains.com/updates/updates.xml") =~ /(<channel .+?<\/channel>)/gs;
  my %h = {};
  for my $ch (@channels) {
-    my ($id) = $ch =~ /^<channel id="([^"]+)"/;
+    my ($id) = $ch =~ /^<channel id="[^"]+" name="([^"]+)"/;
    my @builds = $ch =~ /(<build .+?<\/build>)/gs;
    my $latest_build = reduce {
      my ($aversion) = $a =~ /^<build [^>]*version="([^"]+)"/; die "no version in $a" unless $aversion;
--- a/pkgs/applications/graphics/inkscape/default.nix
+++ b/pkgs/applications/graphics/inkscape/default.nix
@ -17,6 +17,12 @@ stdenv.mkDerivation rec {
    sha256 = "1chng2yw8dsjxc9gf92aqv7plj11cav8ax321wmakmv5bb09cch6";
  };

+  # Inkscape hits the ARGMAX when linking on macOS. It appears to be
+  # CMake’s ARGMAX check doesn’t offer enough padding for NIX_LDFLAGS.
+  # Setting strictDeps it avoids duplicating some dependencies so it
+  # will leave us under ARGMAX.
+  strictDeps = true;
+
  unpackPhase = ''
    cp $src ${name}.tar.bz2
    tar xvjf ${name}.tar.bz2 > /dev/null
@ -33,19 +39,19 @@ stdenv.mkDerivation rec {
      --replace '"python-interpreter", "python"' '"python-interpreter", "${python2Env}/bin/python"'
  '';

-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig cmake makeWrapper python2Env perl perlXMLParser ];
  buildInputs = [
-    perl perlXMLParser libXft libpng zlib popt boehmgc
+    libXft libpng zlib popt boehmgc
    libxml2 libxslt glib gtkmm2 glibmm libsigcxx lcms boost gettext
-    makeWrapper gsl poppler imagemagick libwpg librevenge
-    libvisio libcdr libexif potrace cmake python2Env
+    gsl poppler imagemagick libwpg librevenge
+    libvisio libcdr libexif potrace
  ];

  enableParallelBuilding = true;

  postInstall = ''
    # Make sure PyXML modules can be found at run-time.
-    rm "$out/share/icons/hicolor/icon-theme.cache"
+    rm -f "$out/share/icons/hicolor/icon-theme.cache"
  '' + stdenv.lib.optionalString stdenv.isDarwin ''
    install_name_tool -change $out/lib/libinkscape_base.dylib $out/lib/inkscape/libinkscape_base.dylib $out/bin/inkscape
    install_name_tool -change $out/lib/libinkscape_base.dylib $out/lib/inkscape/libinkscape_base.dylib $out/bin/inkview
--- a/pkgs/applications/graphics/mozjpeg/default.nix
+++ b/pkgs/applications/graphics/mozjpeg/default.nix
@ -1,19 +1,17 @@
-{ stdenv, fetchurl, file, pkgconfig, libpng, nasm }:
+{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, libpng, nasm }:

 stdenv.mkDerivation rec {
-  version = "3.2";
+  version = "3.3.1";
  name = "mozjpeg-${version}";

-  src = fetchurl {
-    url = "https://github.com/mozilla/mozjpeg/releases/download/v${version}/mozjpeg-${version}-release-source.tar.gz";
-    sha256 = "0wvv5qh1jasz8apq93c3j9d5wd22j7lld9dr06p76yj4mpnc3v4a";
+  src = fetchFromGitHub {
+    owner = "mozilla";
+    repo = "mozjpeg";
+    rev = "v${version}";
+    sha256 = "1na68860asn8b82ny5ilwbhh4nyl9gvx2yxmm4wr2v1v95v51fky";
  };

-  postPatch = ''
-    sed -i -e "s!/usr/bin/file!${file}/bin/file!g" configure
-  '';
-
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
  buildInputs = [ libpng nasm ];

  meta = {
--- a/pkgs/applications/graphics/pencil/default.nix
+++ b/pkgs/applications/graphics/pencil/default.nix
@ -2,7 +2,7 @@
  # build dependencies
  alsaLib, atk, cairo, cups, dbus, expat, fontconfig,
  freetype, gdk_pixbuf, glib, gnome2, nspr, nss, xorg,
-  glibc, udev
+  glibc, systemd
 }:

 stdenv.mkDerivation rec {
@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
    ar p "$src" data.tar.xz | tar xJ
  '';

-  buildPhase = ":";
+  dontBuild = true;

  nativeBuildInputs = [ makeWrapper ];

@ -89,7 +89,7 @@ stdenv.mkDerivation rec {
    chmod a+x $out/opt/Pencil/libffmpeg.so

    # fix missing libudev
-    ln -s ${udev}/lib/systemd/libsystemd-shared.so $out/opt/Pencil/libudev.so.1
+    ln -s ${systemd.lib}/lib/libudev.so.1 $out/opt/Pencil/libudev.so.1
    wrapProgram $out/opt/Pencil/pencil \
      --prefix LD_LIBRARY_PATH : $out/opt/Pencil
  '';
--- a/pkgs/applications/graphics/tesseract/default.nix
+++ b/pkgs/applications/graphics/tesseract/default.nix
@ -1,10 +1,38 @@
 { stdenv, fetchFromGitHub, autoreconfHook, pkgconfig
 , leptonica, libpng, libtiff, icu, pango, opencl-headers
-
 # Supported list of languages or `null' for all available languages
 , enableLanguages ? null
+# if you want just a specific list of languages, optionally specify a hash
+# to make tessdata a fixed output derivation.
+, enableLanguagesHash ? (if enableLanguages == null # all languages
+                         then "1h48xfzabhn0ldbx5ib67cp9607pr0zpblsy8z6fs4knn0zznfnw"
+                         else null)
 }:

+let tessdata = stdenv.mkDerivation ({
+  name = "tessdata";
+  src = fetchFromGitHub {
+    owner = "tesseract-ocr";
+    repo = "tessdata";
+    rev = "3cf1e2df1fe1d1da29295c9ef0983796c7958b7d";
+    # when updating don't forget to update the default value fo enableLanguagesHash
+    sha256 = "1v4b63v5nzcxr2y3635r19l7lj5smjmc9vfk0wmxlryxncb4vpg7";
+  };
+  buildCommand = ''
+    cd $src;
+    for lang in ${if enableLanguages==null then "*.traineddata" else stdenv.lib.concatMapStringsSep " " (x: x+".traineddata") enableLanguages} ; do
+      install -Dt $out/share/tessdata $src/$lang ;
+    done;
+  '';
+  preferLocalBuild = true;
+  } // (stdenv.lib.optionalAttrs (enableLanguagesHash != null) {
+  # when a hash is given, we make this a fixed output derivation.
+  outputHashMode = "recursive";
+  outputHashAlgo = "sha256";
+  outputHash = enableLanguagesHash;
+  }));
+in
+
 stdenv.mkDerivation rec {
  name = "tesseract-${version}";
  version = "3.05.00";
@ -16,41 +44,17 @@ stdenv.mkDerivation rec {
    sha256 = "11wrpcfl118wxsv2c3w2scznwb48c4547qml42s2bpdz079g8y30";
  };

-  tessdata = fetchFromGitHub {
-    owner = "tesseract-ocr";
-    repo = "tessdata";
-    rev = "3cf1e2df1fe1d1da29295c9ef0983796c7958b7d";
-    sha256 = "1v4b63v5nzcxr2y3635r19l7lj5smjmc9vfk0wmxlryxncb4vpg7";
-  };
+  enableParallelBuilding = true;

  nativeBuildInputs = [ pkgconfig autoreconfHook ];
  buildInputs = [ leptonica libpng libtiff icu pango opencl-headers ];

  LIBLEPT_HEADERSDIR = "${leptonica}/include";

-  # Copy the .traineddata files of the languages specified in enableLanguages
-  # into `$out/share/tessdata' and check afterwards if copying was successful.
-  postInstall = let
-    mkArg = lang: "-iname ${stdenv.lib.escapeShellArg "${lang}.traineddata"}";
-    mkFindArgs = stdenv.lib.concatMapStringsSep " -o " mkArg;
-    findLangArgs = if enableLanguages != null
-                   then "\\( ${mkFindArgs enableLanguages} \\)"
-                   else "-iname '*.traineddata'";
-  in ''
-    numLangs="$(find "$tessdata" -mindepth 1 -maxdepth 1 -type f \
-      ${findLangArgs} -exec cp -t "$out/share/tessdata" {} + -print | wc -l)"
-
-    ${if enableLanguages != null then ''
-      expected=${toString (builtins.length enableLanguages)}
-    '' else ''
-      expected="$(ls -1 "$tessdata/"*.traineddata | wc -l)"
-    ''}
-
-    if [ "$numLangs" -ne "$expected" ]; then
-      echo "Expected $expected languages, but $numLangs" \
-           "were copied to \`$out/share/tessdata'" >&2
-      exit 1
-    fi
+  postInstall = ''
+    for i in ${tessdata}/share/tessdata/*; do
+      ln -s $i $out/share/tessdata;
+    done
  '';

  meta = {
--- a/pkgs/applications/misc/calibre/default.nix
+++ b/pkgs/applications/misc/calibre/default.nix
@ -5,12 +5,12 @@
 }:

 stdenv.mkDerivation rec {
-  version = "3.25.0";
+  version = "3.26.1";
  name = "calibre-${version}";

  src = fetchurl {
    url = "https://download.calibre-ebook.com/${version}/${name}.tar.xz";
-    sha256 = "018gxjbj5rak4ys5nyx6749rj9vszlf9k1wdcpl60ap3l83kxdnd";
+    sha256 = "0i53095g6wl3ghhpzfrvizj24b8zxbxs1c7bvcj3fpkf43wd45j0";
  };

  patches = [
--- a/pkgs/applications/misc/chirp/default.nix
+++ b/pkgs/applications/misc/chirp/default.nix
@ -3,11 +3,11 @@

 stdenv.mkDerivation rec {
  name = "chirp-daily-${version}";
-  version = "20180606";
+  version = "20180611";

  src = fetchurl {
    url = "https://trac.chirp.danplanet.com/chirp_daily/daily-${version}/${name}.tar.gz";
-    sha256 = "1v1s02675gyghhxasp4pxjrifkgshc82p99haxph1yzkq7gsf03w";
+    sha256 = "1569gnbs4jb53n58wdkdjrxx9nrayljn5v0wqacn5zfr87s16zxf";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/misc/copyq/default.nix
+++ b/pkgs/applications/misc/copyq/default.nix
@ -1,22 +1,23 @@
-{ stdenv, fetchFromGitHub, cmake, qtbase, qtscript, qtwebkit, libXfixes, libXtst, git
+{ stdenv, fetchFromGitHub, cmake, qtbase, qtscript, qtwebkit, libXfixes, libXtst
+, qtx11extras, git
 , webkitSupport ? true
 }:

 stdenv.mkDerivation rec {
  name = "CopyQ-${version}";
-  version = "3.3.1";
+  version = "3.5.0";

  src  = fetchFromGitHub {
    owner = "hluk";
    repo = "CopyQ";
    rev = "v${version}";
-    sha256 = "1jjb979dwdnkjca95yxzapbjpd6hr97hxz7sn614whvdv4vvpnyc";
+    sha256 = "0hzdv6rhjpq9yrfafnkc6d8m5pzw9qr520vsjf2gn1819gdybmr0";
  };

  nativeBuildInputs = [ cmake ];

  buildInputs = [
-    git qtbase qtscript libXfixes libXtst
+    git qtbase qtscript libXfixes libXtst qtx11extras
  ] ++ stdenv.lib.optional webkitSupport qtwebkit;

  meta = with stdenv.lib; {
--- a/pkgs/applications/misc/dbeaver/default.nix
+++ b/pkgs/applications/misc/dbeaver/default.nix
@ -7,7 +7,7 @@

 stdenv.mkDerivation rec {
  name = "dbeaver-ce-${version}";
-  version = "5.1.0";
+  version = "5.1.1";

  desktopItem = makeDesktopItem {
    name = "dbeaver";
@ -30,7 +30,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://dbeaver.io/files/${version}/dbeaver-ce-${version}-linux.gtk.x86_64.tar.gz";
-    sha256 = "041wqlipkwk4xp3qa4rrwyw6rgsn1ppv25qb4h2mkhrsjcjagqhj";
+    sha256 = "1ll1q585b7yca9jrgg7iw7i6xhyy1wc9q8hjqj1g3gzdagbrf396";
  };

  installPhase = ''
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@ -2,7 +2,7 @@

 buildGoPackage rec {
  name = "hugo-${version}";
-  version = "0.40.3";
+  version = "0.42.1";

  goPackagePath = "github.com/gohugoio/hugo";

@ -10,11 +10,15 @@ buildGoPackage rec {
    owner  = "gohugoio";
    repo   = "hugo";
    rev    = "v${version}";
-    sha256 = "08d4y6x19cd4qy9pf80zrqarcyarbzxph0yp8mfb1sp2bvq42308";
+    sha256 = "17m8bkldvnd7yyzxi4rc8vv3qfypjzik38bjy4qavb7sjdjmfij9";
  };

  goDeps = ./deps.nix;

+  postInstall = ''
+    rm $bin/bin/generate
+  '';
+
  meta = with stdenv.lib; {
    description = "A fast and modern static website engine.";
    homepage = https://gohugo.io;
--- a/pkgs/applications/misc/hugo/deps.nix
+++ b/pkgs/applications/misc/hugo/deps.nix
@ -32,8 +32,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/alecthomas/chroma";
-      rev = "222a1f0fc811afd47471d4a4e32f3aa09b6f9cdf";
-      sha256 = "090yb9f9gld4l0r6x8y2a6a3ghiqbyh19fgmjcjfq8qlv0vj5n4s";
+      rev = "d7b2ed20a4989ab604703f61f86523560f8a6a87";
+      sha256 = "0ni2ncck787sxk9gl14xnyjnw4y27ipypjf4kc00g635fvc64ik6";
    };
  }
  {
@ -86,8 +86,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/disintegration/imaging";
-      rev = "bbcee2f5c9d5e94ca42c8b50ec847fec64a6c134";
-      sha256 = "0dzwqy1xcm0d481z1fa2r60frdlf5fzjligpiqh5g8lhqskk2lx8";
+      rev = "5e63c9a565d0a3260d23d060a795783dab90fefe";
+      sha256 = "1mmiz439lygi30dj1rbps57iqh762jkinnpb4wfl382v4h136qvp";
    };
  }
  {
@ -122,8 +122,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/gobuffalo/envy";
-      rev = "ef60bfc50c8f92d1ee64674d8ce7a48f1f67625e";
-      sha256 = "15qrmw3l2achpd3hz8fkkz7yzpbvldm1pf1vsr250q24nsh6x7iz";
+      rev = "2d0f467653f3d961ce9ada4d32a230bdcb3bfe11";
+      sha256 = "0p9raqrsqg2z1hq2kbvbq5qcwqihjqf28xnfh62214p7ak9b9x8n";
    };
  }
  {
@ -140,8 +140,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/gorilla/websocket";
-      rev = "21ab95fa12b9bdd8fecf5fa3586aad941cc98785";
-      sha256 = "1ygg6cr84461d6k3nzbja0dxhcgf5zvry2w10f6i7291ghrcwhyy";
+      rev = "5ed622c449da6d44c3c8329331ff47a9e5844f71";
+      sha256 = "1yhcwraijdk6lx7f6m9p6i1b3zfh2hq80l1nfpnckfn10gh72aw7";
    };
  }
  {
@ -203,8 +203,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/magiconair/properties";
-      rev = "2c9e9502788518c97fe44e8955cd069417ee89df";
-      sha256 = "1w0rl9rla61m0qbha75jg48yiq1vs91sfy96rgqa6nags9v9b1rl";
+      rev = "c2353362d570a7bfa228149c62842019201cfb71";
+      sha256 = "1a10362wv8a8qwb818wygn2z48lgzch940hvpv81hv8gc747ajxn";
    };
  }
  {
@ -212,8 +212,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/markbates/inflect";
-      rev = "fbc6b23ce49e2578f572d2e72bb72fa03c7145de";
-      sha256 = "10rf7kfqnic8x4z8c29whb76w9v847y63wh5b2kfx6rqhrjfilis";
+      rev = "84854b5b4c0dbb0c107480d480a71f7db1fc7dae";
+      sha256 = "0b7shs0mxhkl7v7mwp799n7jgjsdbgi81f5hbaz2b936gbxksw7d";
    };
  }
  {
@ -239,8 +239,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/mitchellh/mapstructure";
-      rev = "00c29f56e2386353d58c599509e8dc3801b0d716";
-      sha256 = "1vw8fvhax0d567amgvxr7glcl12lvzg2sbzs007q5k5bbwn1szyb";
+      rev = "bb74f1db0675b241733089d5a1faa5dd8b0ef57b";
+      sha256 = "1aqk9qr46bwgdc5j7n7als61xvssvyjf4qzfsvhacl4izpygqnw7";
    };
  }
  {
@ -257,8 +257,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/nicksnyder/go-i18n";
-      rev = "8c6996ea1058153460146b16c341a4ae611f7cf7";
-      sha256 = "1k8ai8mdi5cqbcxihzx727z3gg46lpkw0s1byb3lrdnmp31l7p9r";
+      rev = "f6ac3d9cf0c4b6a32527779e992ebde26bd3d948";
+      sha256 = "1vg25khaf7lr90xwf97bsyn873cdi1j7nxh68s80jrg2a86zw0ff";
    };
  }
  {
@ -275,8 +275,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/pelletier/go-toml";
-      rev = "66540cf1fcd2c3aee6f6787dfa32a6ae9a870f12";
-      sha256 = "1n8na0yg90gm0rpifmzrby5r385vvd62cdam3ls7ssy02bjvfw15";
+      rev = "c01d1270ff3e442a8a57cddc1c92dc1138598194";
+      sha256 = "1fjzpcjng60mc3a4b2ql5a00d5gah84wj740dabv9kq67mpg8fxy";
    };
  }
  {
@ -302,8 +302,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/spf13/afero";
-      rev = "63644898a8da0bc22138abf860edaf5277b6102e";
-      sha256 = "13piahaq4vw1y1sklq5scrsflqx0a8hzmdqfz1fy4871kf2gl8qw";
+      rev = "787d034dfe70e44075ccc060d346146ef53270ad";
+      sha256 = "0138rjiacl71h7kvhzinviwvy6qa2m6rflpv9lgqv15hnjvhwvg1";
    };
  }
  {
@ -320,8 +320,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/spf13/cobra";
-      rev = "ef82de70bb3f60c65fb8eebacbb2d122ef517385";
-      sha256 = "1q1nsx05svyv9fv3fy6xv6gs9ffimkyzsfm49flvl3wnvf1ncrkd";
+      rev = "1e58aa3361fd650121dceeedc399e7189c05674a";
+      sha256 = "1d6dy60dw7i2mcab10yp99wi5w28jzhzzf16w4ys6bna7ymndiin";
    };
  }
  {
@ -356,8 +356,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/spf13/pflag";
-      rev = "583c0c0531f06d5278b7d917446061adc344b5cd";
-      sha256 = "0nr4mdpfhhk94hq4ymn5b2sxc47b29p1akxd8b0hx4dvdybmipb5";
+      rev = "3ebe029320b2676d667ae88da602a5f854788a8a";
+      sha256 = "11yxs0wqy70wj106fkz8r923yg4ncnc2mbw33v48zmlg4a1rasgp";
    };
  }
  {
@ -383,8 +383,8 @@
    fetch = {
      type = "git";
      url = "https://go.googlesource.com/image";
-      rev = "f315e440302883054d0c2bd85486878cb4f8572c";
-      sha256 = "010pc6qjppqd9c7rramiwz7myvip9vhridfxy7wc2qj1kr92b4dc";
+      rev = "af66defab954cb421ca110193eed9477c8541e2a";
+      sha256 = "0dgi7svwzs37c7m5dz2jig3xr45fyjihhr8cg0x8nc8sc8fsyq4h";
    };
  }
  {
@ -392,8 +392,8 @@
    fetch = {
      type = "git";
      url = "https://go.googlesource.com/net";
-      rev = "f73e4c9ed3b7ebdd5f699a16a880c2b1994e50dd";
-      sha256 = "1mvnpln6vm0y1i5bb0ycswds49hyapg3jz643lmlw6d183jdcg0q";
+      rev = "db08ff08e8622530d9ed3a0e8ac279f6d4c02196";
+      sha256 = "1f6q8kbijnrfy6wjqxrzgjf38ippckc5w34lhqsjs7kq045aar9a";
    };
  }
  {
@ -410,8 +410,8 @@
    fetch = {
      type = "git";
      url = "https://go.googlesource.com/sys";
-      rev = "64746a42f36bf0832f86b76004f1699dbeb33e4f";
-      sha256 = "1hbk7cnbywiwxdzbx7lqw6iym9dpwvdyacg06gchxpfw7nfa9r27";
+      rev = "6c888cc515d3ed83fc103cf1d84468aad274b0a7";
+      sha256 = "18anqrdajp4p015v3f5y641k3lmgp2jr0lfyx0pb3ia0qvn93mrp";
    };
  }
  {
@ -419,8 +419,8 @@
    fetch = {
      type = "git";
      url = "https://go.googlesource.com/text";
-      rev = "7922cc490dd5a7dbaa7fd5d6196b49db59ac042f";
-      sha256 = "06sicjc24hv7v9p1l6psaq87w4lycx3mjixd6gsd1wnd4jhqvlnr";
+      rev = "5c1cf69b5978e5a34c5f9ba09a83e56acc4b7877";
+      sha256 = "03br8p1sb1ffr02l8hyrgcyib7ms0z06wy3v4r1dj2l6q4ghwzfs";
    };
  }
  {
--- a/pkgs/applications/misc/jgmenu/default.nix
+++ b/pkgs/applications/misc/jgmenu/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  name = "jgmenu-${version}";
-  version = "0.9";
+  version = "1.0";

  src = fetchFromGitHub {
    owner = "johanmalm";
    repo = "jgmenu";
    rev = "v${version}";
-    sha256 = "17xxz5qyz92sjppsvzjl2v012yb3s5p519cv8xf2hd41j7sh9ym1";
+    sha256 = "068mm0b2npz6qh9j8m9xd8sbznjp5g195vfav8a6016wgm6fhrx7";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/lyx/default.nix
+++ b/pkgs/applications/misc/lyx/default.nix
@ -1,4 +1,4 @@
-{ fetchurl, stdenv, pkgconfig, python, file, bc
+{ fetchurl, stdenv, pkgconfig, python, file, bc, fetchpatch
 , qtbase, qtsvg, hunspell, makeWrapper #, mythes, boost
 }:

@ -35,6 +35,13 @@ stdenv.mkDerivation rec {
      --prefix PATH : '${python}/bin'
  '';

+  patches = [
+    (fetchpatch {
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/app-office/lyx/files/lyx-2.3.0-qt-5.11.patch?id=07e82fd1fc07bf055c78b81eaa128f8f837da80d";
+      sha256 = "1bnx0il2iv36lnrnyb370wyvww0rd8bphcy6z8d7zmvd3pwhyfql";
+    })
+  ];
+
  meta = with stdenv.lib; {
    description = "WYSIWYM frontend for LaTeX, DocBook";
    homepage = http://www.lyx.org;
--- a/pkgs/applications/misc/mlterm/default.nix
+++ b/pkgs/applications/misc/mlterm/default.nix
@ -7,11 +7,11 @@

 stdenv.mkDerivation rec {
  name = "mlterm-${version}";
-  version = "3.8.4";
+  version = "3.8.6";

  src = fetchurl {
    url = "mirror://sourceforge/project/mlterm/01release/${name}/${name}.tar.gz";
-    sha256 = "07ih7953pr1jr99rayjn57ba5a0cr3niqkmvy9n59lcc1qwcrwf9";
+    sha256 = "06zylbinh84s9v79hrlvv44rd57z7kvgz9afbps3rjcbncxcmivd";
  };

  nativeBuildInputs = [ pkgconfig autoconf ];
--- a/pkgs/applications/misc/mupdf/default.nix
+++ b/pkgs/applications/misc/mupdf/default.nix
@ -24,7 +24,7 @@ in stdenv.mkDerivation rec {

  patches = [
    (fetchpatch {
-      # CVE-2018-10289
+      name = "CVE-2018-10289.patch";
      url = "https://bugs.ghostscript.com/attachment.cgi?id=15230";
      sha256 = "0jmpacxd9930g6k57kda9jrcrbk75whdlv8xwmqg5jwn848qvy4q";
    })
--- a/pkgs/applications/misc/slic3r/prusa3d.nix
+++ b/pkgs/applications/misc/slic3r/prusa3d.nix
@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, makeWrapper, which, cmake, perl, perlPackages,
  boost, tbb, wxGTK30, pkgconfig, gtk3, fetchurl, gtk2, bash, libGLU,
-  glew, eigen }:
+  glew, eigen, curl }:
 let
  AlienWxWidgets = perlPackages.buildPerlPackage rec {
    name = "Alien-wxWidgets-0.69";
@ -33,12 +33,13 @@ let
 in
 stdenv.mkDerivation rec {
  name = "slic3r-prusa-edition-${version}";
-  version = "1.39.2";
+  version = "1.40.0";

  enableParallelBuilding = true;

  buildInputs = [
    cmake
+    curl
    perl
    makeWrapper
    eigen
@ -73,6 +74,8 @@ stdenv.mkDerivation rec {

  prePatch = ''
    sed -i 's|"/usr/include/asm-generic/ioctls.h"|<asm-generic/ioctls.h>|g' xs/src/libslic3r/GCodeSender.cpp
+    sed -i "s|\''${PERL_VENDORARCH}|$out/lib/slic3r-prusa3d|g" xs/CMakeLists.txt
+    sed -i "s|\''${PERL_VENDORLIB}|$out/lib/slic3r-prusa3d|g" xs/CMakeLists.txt
  '';

  postInstall = ''
@ -82,14 +85,14 @@ stdenv.mkDerivation rec {

    # it seems we need to copy the icons...
    mkdir -p $out/bin/var
-    cp ../resources/icons/* $out/bin/var/
+    cp -r ../resources/icons/* $out/bin/var/
    cp -r ../resources $out/bin/
  '';

  src = fetchFromGitHub {
    owner = "prusa3d";
    repo = "Slic3r";
-    sha256 = "0vbqkmd2yqi469ijqm4wyzjmq9w1kwiy8av1kchm4429z5hpmxcd";
+    sha256 = "1cisplrfv6y9ijgl5bs46bxxmid5hl71hjzl73bay2i2bl8hid2f";
    rev = "version_${version}";
  };

--- a/pkgs/applications/misc/tilix/default.nix
+++ b/pkgs/applications/misc/tilix/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  name = "tilix-${version}";
-  version = "1.7.1";
+  version = "1.8.1";

  src = fetchFromGitHub {
    owner = "gnunn1";
    repo = "tilix";
    rev = "${version}";
-    sha256 = "0x0bnb26hjvxmvvd7c9k8fw97gcm3z5ssr6r8x90xbyyw6h58hhh";
+    sha256 = "19dx3hlj40cqwph98pcifkm6axfszfr0v9k6sr3caw4ycml84ci1";
  };

  nativeBuildInputs = [
@ -20,7 +20,10 @@ stdenv.mkDerivation rec {
  buildInputs = [ gnome3.dconf gettext gsettings-desktop-schemas gtkd dbus ];

  preBuild = ''
-    makeFlagsArray=(PERL5LIB="${perlPackages.Po4a}/lib/perl5")
+    makeFlagsArray=(
+      PERL5LIB="${perlPackages.Po4a}/lib/perl5"
+      DCFLAGS='-O -inline -release -version=StdLoggerDisableTrace'
+    )
  '';

  postInstall = with gnome3; ''
--- a/pkgs/applications/misc/toot/default.nix
+++ b/pkgs/applications/misc/toot/default.nix
@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, python3Packages }:

 python3Packages.buildPythonApplication rec {
-  version = "0.17.1";
+  version = "0.18.0";
  name    = "toot-${version}";

  src = fetchFromGitHub {
    owner  = "ihabunek";
    repo   = "toot";
    rev    = "${version}";
-    sha256 = "05fzsakm089bn03z8gip6yp4xfmwa054v40x2f3gqpl04r504gis";
+    sha256 = "0snvxn7ifbkrdnml66pdna7vny3qa0s6gcjjz69s7scc0razwrh8";
  };

  checkInputs = with python3Packages; [ pytest ];
--- a/pkgs/applications/misc/udiskie/default.nix
+++ b/pkgs/applications/misc/udiskie/default.nix
@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, asciidoc-full, gettext
-, gobjectIntrospection, gtk3, hicolor-icon-theme, libnotify, librsvg
+, gobjectIntrospection, gtk3, hicolor-icon-theme, libappindicator-gtk3, libnotify, librsvg
 , udisks2, wrapGAppsHook
 , buildPythonApplication
 , docopt
@ -27,7 +27,7 @@ buildPythonApplication rec {

  propagatedBuildInputs = [
    gettext gobjectIntrospection gtk3 libnotify docopt
-    pygobject3 pyyaml udisks2
+    pygobject3 pyyaml udisks2 libappindicator-gtk3
  ];

  postBuild = "make -C doc";
--- a/pkgs/applications/misc/vym/default.nix
+++ b/pkgs/applications/misc/vym/default.nix
@ -1,18 +1,18 @@
-{ stdenv, fetchurl, pkgconfig, qt4, qmake4Hook }:
+{ stdenv, fetchurl, pkgconfig, qmake, qtsvg }:

 stdenv.mkDerivation rec {
  name = "vym-${version}";
-  version = "2.2.4";
+  version = "2.6.11";

  src = fetchurl {
-    url = "mirror://sourceforge/project/vym/${version}/${name}.tar.bz2";
-    sha256 = "1x4qp6wpszscbbs4czkfvskm7qjglvxm813nqv281bpy4y1hhvgs";
+    url = "mirror://sourceforge/project/vym/2.6.0/${name}.tar.bz2";
+    sha256 = "1yznlb47jahd662a2blgh1ccwpl5dp5rjz9chsxjzhj3vbkzx3nl";
  };

  hardeningDisable = [ "format" ];

-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ qt4 qmake4Hook ];
+  nativeBuildInputs = [ pkgconfig qmake ];
+  buildInputs = [ qtsvg ];

  meta = with stdenv.lib; {
    description = "A mind-mapping software";
--- a/pkgs/applications/misc/xmrig/default.nix
+++ b/pkgs/applications/misc/xmrig/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  name = "xmrig-${version}";
-  version = "2.6.2";
+  version = "2.6.3";

  src = fetchFromGitHub {
    owner = "xmrig";
    repo = "xmrig";
    rev = "v${version}";
-    sha256 = "09dcjvnm74j1d26mvdiz0sl1qwns5xfkdwx46nqd4xlgvg9x4rpx";
+    sha256 = "1ssiq2yv8b3xg4kfp2cfzl41m5apjw2r2k74lh3fz0g0ix3cq55b";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@ -22,7 +22,6 @@

 # package customization
 , enableNaCl ? false
-, enableHotwording ? false
 , enableWideVine ? false
 , gnomeSupport ? false, gnome ? null
 , gnomeKeyringSupport ? false, libgnome-keyring3 ? null
@ -215,11 +214,8 @@ let
      proprietary_codecs = false;
      use_sysroot = false;
      use_gnome_keyring = gnomeKeyringSupport;
-      ## FIXME remove use_gconf after chromium 65 has become stable
-      use_gconf = gnomeSupport;
      use_gio = gnomeSupport;
      enable_nacl = enableNaCl;
-      enable_hotwording = enableHotwording;
      enable_widevine = enableWideVine;
      use_cups = cupsSupport;

@ -259,7 +255,10 @@ let
      libExecPath="${libExecPath}"
      python build/linux/unbundle/replace_gn_files.py \
        --system-libraries ${toString gnSystemLibraries}
-      gn gen --args=${escapeShellArg gnFlags} out/Release
+      gn gen --args=${escapeShellArg gnFlags} out/Release | tee gn-gen-outputs.txt
+
+      # Fail if `gn gen` contains a WARNING.
+      grep -o WARNING gn-gen-outputs.txt && echo "Found gn WARNING, exiting nix build" && exit 1

      runHook postConfigure
    '';
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@ -4,7 +4,6 @@
 # package customization
 , channel ? "stable"
 , enableNaCl ? false
-, enableHotwording ? false
 , gnomeSupport ? false, gnome ? null
 , gnomeKeyringSupport ? false
 , proprietaryCodecs ? true
@ -22,7 +21,7 @@ let
    upstream-info = (callPackage ./update.nix {}).getChannel channel;

    mkChromiumDerivation = callPackage ./common.nix {
-      inherit enableNaCl enableHotwording gnomeSupport gnome
+      inherit enableNaCl gnomeSupport gnome
              gnomeKeyringSupport proprietaryCodecs cupsSupport pulseSupport
              enableWideVine;
    };
--- a/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
--- a/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
--- a/pkgs/applications/networking/browsers/opera/default.nix
+++ b/pkgs/applications/networking/browsers/opera/default.nix
@ -11,7 +11,7 @@
 , freetype
 , gdk_pixbuf
 , glib
-, gnome2
+, gnome3
 , gtk3
 , libX11
 , libxcb
@ -32,12 +32,13 @@
 , pango
 , stdenv
 , systemd
+, at-spi2-atk
 }:

 let

  mirror = https://get.geo.opera.com/pub/opera/desktop;
-  version = "50.0.2762.45";
+  version = "53.0.2907.99";

  rpath = stdenv.lib.makeLibraryPath [

@ -54,7 +55,7 @@ let
    freetype.out
    gdk_pixbuf.out
    glib.out
-    gnome2.GConf.out
+    gnome3.gconf
    gtk3.out
    libX11.out
    libXScrnSaver.out
@ -81,6 +82,8 @@ let

    # Works fine without this except there is no sound.
    libpulseaudio.out
+
+    at-spi2-atk
  ];

 in stdenv.mkDerivation {
@ -89,7 +92,7 @@ in stdenv.mkDerivation {

  src = fetchurl {
    url = "${mirror}/${version}/linux/opera-stable_${version}_amd64.deb";
-    sha256 = "1ajdr6yzqc9xkvdcgkps6j5996n60ibjhj518gmminx90da6x5dy";
+    sha256 = "0fih5047xv275rmbcr2drji81wxi6p0kyp172mmn328g3pzddmwx";
  };

  unpackCmd = "${dpkg}/bin/dpkg-deb -x $curSrc .";
--- a/pkgs/applications/networking/browsers/qutebrowser/default.nix
+++ b/pkgs/applications/networking/browsers/qutebrowser/default.nix
@ -29,13 +29,13 @@ let
 in python3Packages.buildPythonApplication rec {
  name = "qutebrowser-${version}${versionPostfix}";
  namePrefix = "";
-  version = "1.3.1";
+  version = "1.3.2";
  versionPostfix = "";

  # the release tarballs are different from the git checkout!
  src = fetchurl {
    url = "https://github.com/qutebrowser/qutebrowser/releases/download/v${version}/${name}.tar.gz";
-    sha256 = "121fz549vlxdasw0lcx6v394x8g34nadvrfs4svw3b65n0shv1ky";
+    sha256 = "0zy2cm85qq095hk94d8jk6yqpyy0f31vb2pfbdpgg93b9vvzajzz";
  };

  # Needs tox
--- a/pkgs/applications/networking/cluster/helm/default.nix
+++ b/pkgs/applications/networking/cluster/helm/default.nix
@ -5,10 +5,10 @@ let
         then "linux-amd64"
         else "darwin-amd64";
  checksum = if isLinux
-             then "0bnjpiivhsxhl45ab32vzf6crv4z8nbq5kcjkvlbcbswdbgp0pq6"
-             else "0smwhj4pmd4k7csz82akbkrkb0j2jxnmb33ifhkqw7n33jhl3aqp";
+             then "1fk6w6sajdi6iphxrzi9r7xfyaf923nxcqnl01s6x3f611fjvbjn"
+             else "1jzgy641hm3khj0bakfbr5wd5zl3s7w5jb622fjv2jxwmnv7dxiv";
  pname = "helm";
-  version = "2.9.0";
+  version = "2.9.1";
 in
 stdenv.mkDerivation {
  name = "${pname}-${version}";
@ -45,6 +45,6 @@ stdenv.mkDerivation {
    description = "A package manager for kubernetes";
    license = licenses.asl20;
    maintainers = [ maintainers.rlupton20 ];
-    platforms = platforms.linux ++ platforms.darwin;
+    platforms = [ "x86_64-linux" ] ++ platforms.darwin;
  };
 }
--- a/pkgs/applications/networking/cluster/helmfile/default.nix
+++ b/pkgs/applications/networking/cluster/helmfile/default.nix
@ -1,6 +1,6 @@
-{ lib, buildGoPackage, fetchFromGitHub, ... }:
+{ lib, buildGoPackage, fetchFromGitHub, makeWrapper, kubernetes-helm, ... }:

-let version = "0.16.0"; in
+let version = "0.19.0"; in

 buildGoPackage {
  name = "helmfile-${version}";
@ -9,11 +9,19 @@ buildGoPackage {
    owner = "roboll";
    repo = "helmfile";
    rev = "v${version}";
-    sha256 = "12gxlan89h0r83aaacshh58nd1pi26gx5gkna0ksll9wsfvraj4d";
+    sha256 = "0wjzzaygdnnvyi5a78bhmz2sxc4gykdl00h78dkgvj7aaw05s9yd";
  };

  goPackagePath = "github.com/roboll/helmfile";

+  nativeBuildInputs = [ makeWrapper ];
+
+  postInstall = ''
+    wrapProgram $bin/bin/helmfile \
+      --prefix PATH : ${lib.makeBinPath [ kubernetes-helm ]}
+  '';
+
+
  meta = {
    description = "Deploy Kubernetes Helm charts";
    homepage = https://github.com/roboll/helmfile;
--- a/pkgs/applications/networking/dropbox/default.nix
+++ b/pkgs/applications/networking/dropbox/default.nix
@ -7,7 +7,7 @@ assert lib.elem stdenv.system platforms;
 # Dropbox client to bootstrap installation.
 # The client is self-updating, so the actual version may be newer.
 let
-  version = "40.4.46";
+  version = "52.3.56";

  arch = {
    "x86_64-linux" = "x86_64";
--- a/pkgs/applications/networking/esniper/default.nix
+++ b/pkgs/applications/networking/esniper/default.nix
@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub, openssl, curl, coreutils, gawk, bash, which }:

 stdenv.mkDerivation rec {
-  name = "esniper-2.33.0.2017-11-06";
+  name = "esniper-2.35.0";

  src = fetchFromGitHub {
    owner = "yhfudev";
--- a/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
@ -3,11 +3,11 @@
 let configFile = writeText "riot-config.json" conf; in
 stdenv.mkDerivation rec {
  name= "riot-web-${version}";
-  version = "0.15.4";
+  version = "0.15.5";

  src = fetchurl {
    url = "https://github.com/vector-im/riot-web/releases/download/v${version}/riot-v${version}.tar.gz";
-    sha256 = "1c0b9717xmzvzzxj006hqxafvcpvnnrsifxjnbxxla58jmnwr9v5";
+    sha256 = "04sij99njkiiwc1q23gwa8z6h4z0riw6yb9z3ds7v2qiyi4sshdz";
  };

  installPhase = ''
--- a/pkgs/applications/networking/instant-messengers/slack/default.nix
+++ b/pkgs/applications/networking/instant-messengers/slack/default.nix
@ -5,7 +5,7 @@

 let

-  version = "3.2.0-beta25a7a50e";
+  version = "3.2.1";

  rpath = stdenv.lib.makeLibraryPath [
    alsaLib
@ -47,7 +47,7 @@ let
    if stdenv.system == "x86_64-linux" then
      fetchurl {
        url = "https://downloads.slack-edge.com/linux_releases/slack-desktop-${version}-amd64.deb";
-        sha256 = "0497794a7f0e5ac00a9421e6b1875dcc576ed93efc4a7d8c6465db641c234064";
+        sha256 = "095dpkwvvnwlxsglyg6wi9126wpalzi736b6g6j3bd6d93z9afah";
      }
    else
      throw "Slack is not supported on ${stdenv.system}";
--- a/pkgs/applications/networking/mailreaders/balsa/default.nix
+++ b/pkgs/applications/networking/mailreaders/balsa/default.nix
@ -6,11 +6,11 @@

 stdenv.mkDerivation rec {
  name = "balsa-${version}";
-  version = "2.5.5";
+  version = "2.5.6";

  src = fetchurl {
    url = "https://pawsa.fedorapeople.org/balsa/${name}.tar.bz2";
-    sha256 = "0p4w81wvdxqhynkninzglsgqk6920x1zif2zmw8bml410lav2azz";
+    sha256 = "17k6wcsl8gki7cskr3hhmfj6n54rha8ca3b6fzd8blsl5shsankx";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/p2p/ktorrent/default.nix
+++ b/pkgs/applications/networking/p2p/ktorrent/default.nix
@ -28,6 +28,16 @@ stdenv.mkDerivation rec {
      url = "https://cgit.kde.org/ktorrent.git/patch/?id=672c5076de7e3a526d9bdbb484a69e9386bc49f8";
      sha256 = "1cn4rnbhadrsxqx50fawpd747azskavbjraygr6s11rh1wbfrxid";
    })
+
+    # Fix build against Qt 5.11
+    (fetchpatch {
+      url = "https://cgit.kde.org/ktorrent.git/patch/?id=7876857d204188016a135a25938d9f8530fba4e8";
+      sha256 = "1wnmfzkhf6y7fd0z2djwphs6i9lsg7fcrj8fqmbyi0j57dvl9gxl";
+    })
+    (fetchpatch {
+      url = "https://cgit.kde.org/ktorrent.git/patch/?id=36d112e56e56541d439326a267eb906da8b3ee60";
+      sha256 = "1d41pqniljhwqs6awa644s6ks0zwm9sr0hpfygc63wyxnpcrsw2y";
+    })
  ];

  enableParallelBuilding = true;
--- a/pkgs/applications/networking/remote/remmina/default.nix
+++ b/pkgs/applications/networking/remote/remmina/default.nix
@ -1,16 +1,16 @@
-{ stdenv, fetchFromGitHub, cmake, pkgconfig, wrapGAppsHook
+{ stdenv, fetchFromGitLab, cmake, pkgconfig, wrapGAppsHook
 , glib, gtk3, gettext, libxkbfile, libgnome-keyring, libX11
 , freerdp, libssh, libgcrypt, gnutls, makeDesktopItem
 , pcre, webkitgtk, libdbusmenu-gtk3, libappindicator-gtk3
 , libvncserver, libpthreadstubs, libXdmcp, libxkbcommon
 , libsecret, spice-protocol, spice-gtk, epoxy, at-spi2-core
-, openssl, gsettings-desktop-schemas
+, openssl, gsettings-desktop-schemas, json-glib
 # The themes here are soft dependencies; only icons are missing without them.
 , hicolor-icon-theme, adwaita-icon-theme
 }:

 let
-  version = "1.2.0-rcgit.24";
+  version = "1.2.30.1";

  desktopItem = makeDesktopItem {
    name = "remmina";
@ -25,11 +25,11 @@ let
 in stdenv.mkDerivation {
  name = "remmina-${version}";

-  src = fetchFromGitHub {
-    owner  = "FreeRDP";
+  src = fetchFromGitLab {
+    owner  = "Remmina";
    repo   = "Remmina";
    rev    = "v${version}";
-    sha256 = "1x7kygl9a5nh7rf2gfrk0wwv23mbw7rrjms402l3zp1w53hrhwmg";
+    sha256 = "1jz20yv84a8m9gm9fsz0jii8ag90v1scmbkkx9gk38ax5il7ilvn";
  };

  nativeBuildInputs = [ pkgconfig ];
@ -39,7 +39,7 @@ in stdenv.mkDerivation {
                  pcre webkitgtk libdbusmenu-gtk3 libappindicator-gtk3
                  libvncserver libpthreadstubs libXdmcp libxkbcommon
                  libsecret spice-protocol spice-gtk epoxy at-spi2-core
-                  openssl hicolor-icon-theme adwaita-icon-theme ];
+                  openssl hicolor-icon-theme adwaita-icon-theme json-glib ];

  cmakeFlags = [
    "-DWITH_VTE=OFF"
@ -64,9 +64,9 @@ in stdenv.mkDerivation {

  meta = with stdenv.lib; {
    license = stdenv.lib.licenses.gpl2;
-    homepage = http://remmina.sourceforge.net/;
+    homepage = https://gitlab.com/Remmina/Remmina;
    description = "Remote desktop client written in GTK+";
-    maintainers = [];
+    maintainers = with maintainers; [ melsigl ryantm ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/networking/sniffers/etherape/default.nix
+++ b/pkgs/applications/networking/sniffers/etherape/default.nix
@ -1,16 +1,16 @@
-{ stdenv, fetchurl, pkgconfig, libtool, gtk2, libpcap, libglade,
-libgnomecanvas, popt, itstool }:
+{ stdenv, fetchurl, pkgconfig, libtool, gtk3, libpcap, goocanvas2,
+popt, itstool, libxml2 }:

 stdenv.mkDerivation rec {
-  name = "etherape-0.9.17";
+  name = "etherape-0.9.18";
  src = fetchurl {
    url = "mirror://sourceforge/etherape/${name}.tar.gz";
-    sha256 = "1n66dw9nsl7zz0qfkb74ncgch3lzms2ssw8dq2bzbk3q1ilad3p6";
+    sha256 = "0y9cfc5iv5zy82j165i9agf45n1ixka064ykdvpdhb07sr3lzhmv";
  };

-  nativeBuildInputs = [ itstool pkgconfig ];
+  nativeBuildInputs = [ itstool pkgconfig (stdenv.lib.getBin libxml2) ];
  buildInputs = [
-    libtool gtk2 libpcap libglade libgnomecanvas popt
+    libtool gtk3 libpcap goocanvas2 popt
  ];

  meta = with stdenv.lib; {
--- a/pkgs/applications/networking/sniffers/wireshark/default.nix
+++ b/pkgs/applications/networking/sniffers/wireshark/default.nix
@ -12,7 +12,7 @@ assert withQt  -> !withGtk && qt5  != null;
 with stdenv.lib;

 let
-  version = "2.4.7";
+  version = "2.6.1";
  variant = if withGtk then "gtk" else if withQt then "qt" else "cli";

 in stdenv.mkDerivation {
@ -20,7 +20,7 @@ in stdenv.mkDerivation {

  src = fetchurl {
    url = "http://www.wireshark.org/download/src/all-versions/wireshark-${version}.tar.xz";
-    sha256 = "0i2ggkkx7fphsk7kv9kygsf5pcaf4vgnqgi8mj1rrf2gfdl3rjsy";
+    sha256 = "126dvd6myjbxjr69dy9vzzdda2lmjy1wwwc6gcs5djb46jy5nvmb";
  };

  cmakeFlags = [
@ -52,6 +52,10 @@ in stdenv.mkDerivation {
    })
    ++ stdenv.lib.optional stdenv.isDarwin ./cmake.patch;

+  preBuild = ''
+    export LD_LIBRARY_PATH="$PWD/run"
+  '';
+
  postInstall = if stdenv.isDarwin then ''
    ${optionalString withQt ''
      mkdir -p $out/Applications
@ -72,6 +76,8 @@ in stdenv.mkDerivation {
    ''}
    ${optionalString withQt ''
      install -Dm644 -t $out/share/applications ../wireshark.desktop
+      wrapProgram $out/bin/wireshark \
+        --set QT_PLUGIN_PATH ${qt5.qtbase.bin}/${qt5.qtbase.qtPluginPrefix}
    ''}

    substituteInPlace $out/share/applications/*.desktop \
--- a/pkgs/applications/networking/soapui/default.nix
+++ b/pkgs/applications/networking/soapui/default.nix
@ -0,0 +1,51 @@
+{ fetchurl, stdenv, writeText, jdk, maven, makeWrapper }:
+
+stdenv.mkDerivation rec {
+  name = "soapui-${version}";
+  version = "5.4.0";
+
+  src = fetchurl {
+    url = "https://s3.amazonaws.com/downloads.eviware/soapuios/${version}/SoapUI-${version}-linux-bin.tar.gz";
+    sha256 = "1yqx1fsh8mr5zf36df7pi25dysb28gfscr1667jzd5s0k9jl42xd";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jdk maven ];
+
+  installPhase = ''
+    mkdir -p $out/share/java
+    cp -R bin lib $out/share/java
+
+    makeWrapper $out/share/java/bin/soapui.sh $out/bin/soapui --set SOAPUI_HOME $out/share/java
+  '';
+
+  patches = [
+    (writeText "soapui-${version}.patch" ''
+      --- a/bin/soapui.sh
+      +++ b/bin/soapui.sh
+      @@ -34,7 +34,7 @@ SOAPUI_CLASSPATH=$SOAPUI_HOME/bin/soapui-${version}.jar:$SOAPUI_HOME/lib/*
+       export SOAPUI_CLASSPATH
+
+       JAVA_OPTS="-Xms128m -Xmx1024m -XX:MinHeapFreeRatio=20 -XX:MaxHeapFreeRatio=40 -Dsoapui.properties=soapui.properties -Dsoapui.home=$SOAPUI_HOME/bin -splash:SoapUI-Spashscreen.png"
+      -JFXRTPATH=`java -cp $SOAPUI_CLASSPATH com.eviware.soapui.tools.JfxrtLocator`
+      +JFXRTPATH=`${jdk}/bin/java -cp $SOAPUI_CLASSPATH com.eviware.soapui.tools.JfxrtLocator`
+       SOAPUI_CLASSPATH=$JFXRTPATH:$SOAPUI_CLASSPATH
+
+       if $darwin
+      @@ -69,4 +69,4 @@ echo = SOAPUI_HOME = $SOAPUI_HOME
+       echo =
+       echo ================================
+
+      -java $JAVA_OPTS -cp $SOAPUI_CLASSPATH com.eviware.soapui.SoapUI "$@"
+      +${jdk}/bin/java $JAVA_OPTS -cp $SOAPUI_CLASSPATH com.eviware.soapui.SoapUI "$@"
+    '')
+  ];
+
+  meta = with stdenv.lib; {
+    description = "The Most Advanced REST & SOAP Testing Tool in the World";
+    homepage = https://www.soapui.org/;
+    license = "SoapUI End User License Agreement";
+    maintainers = with maintainers; [ gerschtli ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/applications/networking/ssb/patchwork-classic/default.nix
+++ b/pkgs/applications/networking/ssb/patchwork-classic/default.nix
@ -0,0 +1,106 @@
+{ stdenv, fetchurl, lib, makeWrapper,
+  # build dependencies
+  alsaLib, atk, cairo, cups, dbus, expat, fontconfig,
+  freetype, gdk_pixbuf, glib, gnome2, nspr, nss, xorg,
+  glibc, systemd
+}:
+
+stdenv.mkDerivation rec {
+
+  version = "2.12.0";
+
+  name = "patchwork-clasic-${version}";
+
+  src = fetchurl {
+    url    = "https://github.com/ssbc/patchwork-classic-electron/releases/download/v2.12.0/ssb-patchwork-electron_2.12.0_linux-amd64.deb";
+    sha256 = "1rvp07cgqwv7ac319p0qwpfxd7l8f53m1rlvvig7qf7q23fnmbsj";
+  };
+
+  sourceRoot = ".";
+
+  unpackCmd = ''
+    ar p "$src" data.tar.xz | tar xJ
+  '';
+
+  dontBuild = true;
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp -R usr/share opt $out/
+
+    # fix the path in the desktop file
+    substituteInPlace \
+      $out/share/applications/ssb-patchwork-electron.desktop \
+      --replace /opt/ $out/opt/
+
+    # symlink the binary to bin/
+    ln -s $out/opt/ssb-patchwork-electron/ssb-patchwork-electron $out/bin/patchwork-classic
+  '';
+
+
+  preFixup = let
+    packages = [
+      alsaLib
+      atk
+      cairo
+      cups
+      dbus
+      expat
+      fontconfig
+      freetype
+      gdk_pixbuf
+      glib
+      gnome2.GConf
+      gnome2.gtk
+      gnome2.pango
+      nspr
+      nss
+      xorg.libX11
+      xorg.libXScrnSaver
+      xorg.libXcomposite
+      xorg.libXcursor
+      xorg.libXdamage
+      xorg.libXext
+      xorg.libXfixes
+      xorg.libXi
+      xorg.libXrandr
+      xorg.libXrender
+      xorg.libXtst
+      stdenv.cc.cc.lib
+      stdenv.cc.cc
+      glibc
+    ];
+    libPathNative = lib.makeLibraryPath packages;
+    libPath64 = lib.makeSearchPathOutput "lib" "lib64" packages;
+    libPath = "${libPathNative}:${libPath64}";
+  in ''
+    # patch executable
+    patchelf \
+      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --set-rpath "${libPath}:$out/opt/ssb-patchwork-electron" \
+      $out/opt/ssb-patchwork-electron/ssb-patchwork-electron
+
+    # patch libnode
+    patchelf \
+      --set-rpath "${libPath}" \
+      $out/opt/ssb-patchwork-electron/libnode.so
+
+    # libffmpeg is for some reason  not executable
+    chmod a+x $out/opt/ssb-patchwork-electron/libffmpeg.so
+
+    # fix missing libudev
+    ln -s ${systemd.lib}/lib/libudev.so.1 $out/opt/ssb-patchwork-electron/libudev.so.1
+    wrapProgram $out/opt/ssb-patchwork-electron/ssb-patchwork-electron \
+      --prefix LD_LIBRARY_PATH : $out/opt/ssb-patchwork-electron
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Electron wrapper for Patchwork Classic: run as a desktop app outside the browser";
+    homepage    = "https://github.com/ssbc/patchwork-classic-electron";
+    license     = licenses.gpl3; 
+    maintainers = with maintainers; [ mrVanDalo ];
+    platforms   = platforms.linux;
+  };
+}
--- a/pkgs/applications/office/libreoffice/default-primary-src.nix
+++ b/pkgs/applications/office/libreoffice/default-primary-src.nix
@ -3,7 +3,7 @@
 rec {
  major = "6";
  minor = "0";
-  patch = "3";
+  patch = "4";
  tweak = "2";

  subdir = "${major}.${minor}.${patch}";
@ -12,6 +12,6 @@ rec {

  src = fetchurl {
    url = "https://download.documentfoundation.org/libreoffice/src/${subdir}/libreoffice-${version}.tar.xz";
-    sha256 = "16w5f8jbicby9jgsrpaj7g9c0wzymcmk1qk1fqdxaykrgpss5f0j";
+    sha256 = "1xqh4l1nrvgara4ni9zk8pqywz3gbq4a8sw9v0ggxsch409zp0ch";
  };
 }
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@ -12,7 +12,7 @@
 , libatomic_ops, graphite2, harfbuzz, libodfgen, libzmf
 , librevenge, libe-book, libmwaw, glm, glew, gst_all_1
 , gdb, commonsLogging, librdf_rasqal, wrapGAppsHook
-, defaultIconTheme, glib, ncurses, xmlsec, epoxy, gpgme
+, defaultIconTheme, glib, ncurses, epoxy, gpgme
 , langs ? [ "ca" "de" "en-GB" "en-US" "eo" "es" "fr" "hu" "it" "nl" "pl" "ru" "sl" ]
 , withHelp ? true
 , kdeIntegration ? false
@ -42,14 +42,14 @@ let

    translations = fetchSrc {
      name = "translations";
-      sha256 = "1cx537akvil4ci4lc9gnz83xmhxyjjrpv9xcibkif6vhdck539la";
+      sha256 = "0bjl3hdckd5bcgskh46xqna1hpxjjx0ycgpnilyk7j8l6407hpw6";
    };

    # TODO: dictionaries

    help = fetchSrc {
      name = "help";
-      sha256 = "00a7iqknww28z0ifcjrx529p2nxqsa4gjavk75rwykvcfyn9x686";
+      sha256 = "1z21bk5lwd5gxsyjdwh0fmgkys4lhnx7flbjd6dbn9d99paz1w6f";
    };

  };
@ -241,6 +241,7 @@ in stdenv.mkDerivation rec {
    "--without-system-mdds"
    # https://github.com/NixOS/nixpkgs/commit/5c5362427a3fa9aefccfca9e531492a8735d4e6f
    "--without-system-orcus"
+    "--without-system-xmlsec"
  ];

  checkPhase = ''
@ -261,7 +262,7 @@ in stdenv.mkDerivation rec {
      python3 sablotron sane-backends unzip vigra which zip zlib
      mdds bluez5 glibc libcmis libwps libabw libzmf libtool
      libxshmfence libatomic_ops graphite2 harfbuzz gpgme utillinux
-      librevenge libe-book libmwaw glm glew ncurses xmlsec epoxy
+      librevenge libe-book libmwaw glm glew ncurses epoxy
      libodfgen CoinMP librdf_rasqal defaultIconTheme gettext
      gdb
    ]
--- a/pkgs/applications/science/biology/picard-tools/default.nix
+++ b/pkgs/applications/science/biology/picard-tools/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "picard-tools-${version}";
-  version = "2.18.5";
+  version = "2.18.7";

  src = fetchurl {
    url = "https://github.com/broadinstitute/picard/releases/download/${version}/picard.jar";
-    sha256 = "1lk1qnwc2gwjh8js3rx4qayan5157an6yzxnhija6kqgrxv58f11";
+    sha256 = "00p5wmd3kb7pr3yvsqz660fsk845dwgj76bllwjfrbiscjdyhy9f";
  };

  buildInputs = [ jre makeWrapper ];
--- a/pkgs/applications/science/biology/raxml/default.nix
+++ b/pkgs/applications/science/biology/raxml/default.nix
@ -7,14 +7,14 @@

 stdenv.mkDerivation rec {
  pname = "RAxML";
-  version = "8.2.11";
+  version = "8.2.12";
  name = "${pname}-${version}";

  src = fetchFromGitHub {
    owner = "stamatak";
    repo = "standard-${pname}";
    rev = "v${version}";
-    sha256 = "08fmqrr7y5a2fmmrgfz2p0hmn4mn71l5yspxfcwwsqbw6vmdfkhg";
+    sha256 = "1jqjzhch0rips0vp04prvb8vmc20c5pdmsqn8knadcf91yy859fh";
  };

  buildInputs = if mpi then [ pkgs.openmpi ] else [];
--- a/pkgs/applications/science/electronics/verilator/default.nix
+++ b/pkgs/applications/science/electronics/verilator/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name    = "verilator-${version}";
-  version = "3.922";
+  version = "3.924";

  src = fetchurl {
    url    = "http://www.veripool.org/ftp/${name}.tgz";
-    sha256 = "1srv8d1w3mwblfydznl3frswg98i3dkylx8x18c4807wsjk8vflg";
+    sha256 = "0xarifraycmdzjxs0lscpwvrwr59z84p8g8dkyjssc463dqikjvx";
  };

  enableParallelBuilding = true;
--- a/pkgs/applications/science/math/geogebra/default.nix
+++ b/pkgs/applications/science/math/geogebra/default.nix
@ -2,16 +2,16 @@

 stdenv.mkDerivation rec {
  name = "geogebra-${version}";
-  version = "5-0-444-0";
+  version = "5-0-472-0";

  preferLocalBuild = true;

  src = fetchurl {
    urls = [
      "https://download.geogebra.org/installers/5.0/GeoGebra-Linux-Portable-${version}.tar.bz2"
-      "http://web.archive.org/web/20180325075100/http://download.geogebra.org/installers/5.0/GeoGebra-Linux-Portable-${version}.tar.bz2"
+      "http://web.archive.org/https://download.geogebra.org/installers/5.0/GeoGebra-Linux-Portable-${version}.tar.bz2"
    ];
-    sha256 = "1x2h40m62zbhmy42hln5gjj3fwk4b6803v3k9agpv5c6j468sq0p";
+    sha256 = "1f56k5r5wf2l27sgp2vjpvx7wl72gizwxs0a6hngk15nzzka87v9";
  };

  srcIcon = fetchurl {
--- a/pkgs/applications/version-management/git-and-tools/git-secret/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-secret/default.nix
@ -1,7 +1,7 @@
 { stdenv, lib, fetchFromGitHub, makeWrapper, git, gnupg }:

 let
-  version = "0.2.3";
+  version = "0.2.4";
  repo = "git-secret";

 in stdenv.mkDerivation {
@ -11,7 +11,7 @@ in stdenv.mkDerivation {
    inherit repo;
    owner = "sobolevn";
    rev = "v${version}";
-    sha256 = "1swgw91zzs9n582500a34cppyngrqrqrnl80d1vd7i93xx1lkmv6";
+    sha256 = "0lx2rjyhy3xh6ik755lbbl40v7a7ayyqk68jj8mnv42f2vhd66xl";
  };

  buildInputs = [ makeWrapper ];
--- a/pkgs/applications/version-management/gitea/default.nix
+++ b/pkgs/applications/version-management/gitea/default.nix
@ -7,13 +7,13 @@ with stdenv.lib;

 buildGoPackage rec {
  name = "gitea-${version}";
-  version = "1.4.1";
+  version = "1.4.2";

  src = fetchFromGitHub {
    owner = "go-gitea";
    repo = "gitea";
    rev = "v${version}";
-    sha256 = "1mid67c4021m7mi4ablx1w5v43831gzn8xpg8n30a4zmr70781wm";
+    sha256 = "15iqvfvijg46444pybi7vg7xhl2x0pr5p1416qlc2nakkn3drpi1";
  };

  patches = [ ./static-root-path.patch ];
--- a/pkgs/applications/version-management/gource/default.nix
+++ b/pkgs/applications/version-management/gource/default.nix
@ -3,12 +3,12 @@
 }:

 stdenv.mkDerivation rec {
-  version = "0.48";
+  version = "0.49";
  name = "gource-${version}";

  src = fetchurl {
    url = "https://github.com/acaudwell/Gource/releases/download/${name}/${name}.tar.gz";
-    sha256 = "04qxcm05qiyr9rg2kv6abfy7kkzqr8ziw4iyp1d14lniv93m61dp";
+    sha256 = "12hf5ipcsp9dxsqn84n4kr63xaiskrnf5a084wr29qk171lj7pd9";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/applications/video/avidemux/default.nix
+++ b/pkgs/applications/video/avidemux/default.nix
@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, fetchpatch, cmake, pkgconfig, lndir
+{ stdenv, lib, fetchurl, cmake, pkgconfig, lndir
 , zlib, gettext, libvdpau, libva, libXv, sqlite
 , yasm, freetype, fontconfig, fribidi
 , makeWrapper, libXext, libGLU, qttools, qtbase
@ -25,21 +25,16 @@ assert !withQT -> default != "qt5";

 stdenv.mkDerivation rec {
  name = "avidemux-${version}";
-  version = "2.7.0";
+  version = "2.7.1";

  src = fetchurl {
    url = "mirror://sourceforge/avidemux/avidemux/${version}/avidemux_${version}.tar.gz";
-    sha256 = "1bf4l9qwxq3smc1mx5pybydc742a4qqsk17z50j9550d9iwnn7gy";
+    sha256 = "15g9h791qbnmycabbbl7s2b3n3xpvygm88qrfk35g2cw6957ik9w";
  };

  patches = [
    ./dynamic_install_dir.patch
    ./bootstrap_logging.patch
-    # glibc 2.27 compat
-    (fetchpatch {
-      url = https://github.com/mean00/avidemux2/commit/afdd9c4b876d77a4974d3fa7d9f25caeffbdf13d.patch;
-      sha256 = "0mf8vpfdqybziqsfyvxwcdm3zsmnp64293icinhvfpq9xp5b6vn6";
-    })
  ];

  nativeBuildInputs = [ yasm cmake pkgconfig ];
@ -58,7 +53,10 @@ stdenv.mkDerivation rec {
    ++ lib.optionals withQT [ qttools qtbase ]
    ++ lib.optional withVPX libvpx;

-  buildCommand = ''
+  buildCommand = let
+    qtVersion = "5.${stdenv.lib.versions.minor qtbase.version}";
+    wrapProgram = f: "wrapProgram ${f} --set ADM_ROOT_DIR $out --prefix LD_LIBRARY_PATH : ${libXext}/lib";
+  in ''
    unpackPhase
    cd "$sourceRoot"
    patchPhase
@ -73,11 +71,13 @@ stdenv.mkDerivation rec {
    mkdir $out
    cp -R install/usr/* $out

-    for i in $out/bin/*; do
-      wrapProgram $i \
-        --set ADM_ROOT_DIR $out \
-        --prefix LD_LIBRARY_PATH ":" "${libXext}/lib"
-    done
+    ${wrapProgram "$out/bin/avidemux3_cli"}
+
+    ${stdenv.lib.optionalString withQT ''
+      ${wrapProgram "$out/bin/avidemux3_qt5"} --prefix QT_PLUGIN_PATH : ${qtbase}/lib/qt-${qtVersion}/plugins
+      ${wrapProgram "$out/bin/avidemux3_jobs_qt5"} --prefix QT_PLUGIN_PATH : ${qtbase}/lib/qt-${qtVersion}/plugins
+    ''}
+
    ln -s "$out/bin/avidemux3_${default}" "$out/bin/avidemux"

    fixupPhase
--- a/pkgs/applications/video/obs-studio/linuxbrowser.nix
+++ b/pkgs/applications/video/obs-studio/linuxbrowser.nix
@ -10,12 +10,12 @@

 stdenv.mkDerivation rec {
  name = "obs-linuxbrowser-${version}";
-  version = "0.3.1";
+  version = "0.4.0";
  src = fetchFromGitHub {
    owner = "bazukas";
    repo = "obs-linuxbrowser";
    rev = version;
-    sha256 = "0dql7wxyhksqa08j1dn5d09v2jwhgywc1p7psifhhvh97rkp4z7j";
+    sha256 = "1nqi04ici9n1xjliy1gaqy2bq8zj1z32dffk890x2hi7ml688y9h";
  };
  nativeBuildInputs = [ cmake ];
  buildInputs = [ obs-studio ];
--- a/pkgs/applications/video/vlc/default.nix
+++ b/pkgs/applications/video/vlc/default.nix
@ -58,6 +58,10 @@ stdenv.mkDerivation rec {
      url = "https://git.archlinux.org/svntogit/packages.git/plain/trunk/vlc-qt5.11.patch?h=packages/vlc";
      sha256 = "0yh65bhhaz876cazhagnafs1dr61184lpj3y0m3y7k37bswykj8p";
    })
+    (fetchpatch {
+      url = "https://github.com/videolan/vlc/commit/26e2d3906658c30f2f88f4b1bc9630ec43bf5525.patch";
+      sha256 = "0sm73cbzxva8sww526bh5yin1k2pdkvj826wdlmqnj7xf0f3mki4";
+    })
  ];

  postPatch = ''
--- a/pkgs/applications/video/xawtv/default.nix
+++ b/pkgs/applications/video/xawtv/default.nix
@ -2,10 +2,10 @@
 , libFS, fontsproto, libXaw, libXpm, libXext, libSM, libICE, perl, xextproto, linux}:

 stdenv.mkDerivation rec {
-  name = "xawtv-3.103";
+  name = "xawtv-3.104";
  src = fetchurl {
    url = "http://linuxtv.org/downloads/xawtv/${name}.tar.bz2";
-    sha256 = "0lnxr3xip80g0rz7h6n14n9d1qy0cm56h0g1hsyr982rbldskwrc";
+    sha256 = "0jnvbahxmx9jw8g2519wmc1dq9afnlqcrzc876fcbf2x1iz39qxr";
  };

  preConfigure = ''
--- a/pkgs/applications/virtualization/looking-glass-client/default.nix
+++ b/pkgs/applications/virtualization/looking-glass-client/default.nix
@ -1,24 +1,24 @@
 { stdenv, fetchFromGitHub
 , pkgconfig, SDL2, SDL, SDL2_ttf, openssl, spice-protocol, fontconfig
-, libX11, freefont_ttf
+, libX11, freefont_ttf, nettle, libconfig
 }:

 stdenv.mkDerivation rec {
  name = "looking-glass-client-${version}";
-  version = "a10";
+  version = "a11";

  src = fetchFromGitHub {
    owner = "gnif";
    repo = "LookingGlass";
    rev = version;
-    sha256 = "10jxnkrvskjzkg86iz3hnb5v91ykzx6pvcnpy1v4436g5f2d62wn";
+    sha256 = "0q4isn86pl5wddf6h8qd62fw3577ns2sd2myzw969sbl796bwcil";
  };

  nativeBuildInputs = [ pkgconfig ];

  buildInputs = [
    SDL SDL2 SDL2_ttf openssl spice-protocol fontconfig
-    libX11 freefont_ttf
+    libX11 freefont_ttf nettle libconfig
  ];

  enableParallelBuilding = true;
--- a/pkgs/applications/window-managers/dwm/dwm-status.nix
+++ b/pkgs/applications/window-managers/dwm/dwm-status.nix
@ -1,29 +1,25 @@
 { stdenv, lib, rustPlatform, fetchFromGitHub, dbus, gdk_pixbuf, libnotify, makeWrapper, pkgconfig, xorg, alsaUtils }:

-let
-  runtimeDeps = [ xorg.xsetroot ]
-    ++ lib.optional (alsaUtils != null) alsaUtils;
-in
-
 rustPlatform.buildRustPackage rec {
  name = "dwm-status-${version}";
-  version = "0.4.0";
+  version = "0.5.1";

  src = fetchFromGitHub {
    owner = "Gerschtli";
    repo = "dwm-status";
    rev = version;
-    sha256 = "0nw0iz78mnrmgpc471yjv7yzsaf7346mwjp6hm5kbsdclvrdq9d7";
+    sha256 = "1mppj57h5yr0azypf5d2cgz2wv3k52mg3k4npyfhbmfy1393qbjs";
  };

  nativeBuildInputs = [ makeWrapper pkgconfig ];
-  buildInputs = [ dbus gdk_pixbuf libnotify ];
+  buildInputs = [ dbus gdk_pixbuf libnotify xorg.libX11 ];

-  cargoSha256 = "0169k91pb7ipvi0m71cmkppp1klgp5ghampa7x0fxkyrvrf0dvqg";
+  cargoSha256 = "0qr999hwrqn7a4n4kvbrpli7shxp9jchj8csxzsw951qmzq32qwv";

-  postInstall = ''
+  # needed because alsaUtils is an optional runtime dependency
+  postInstall = lib.optionalString (alsaUtils != null) ''
    wrapProgram $out/bin/dwm-status \
-      --prefix "PATH" : "${stdenv.lib.makeBinPath runtimeDeps}"
+      --prefix "PATH" : "${alsaUtils}/bin"
  '';

  meta = with stdenv.lib; {
--- a/pkgs/build-support/fetchgit/nix-prefetch-git
+++ b/pkgs/build-support/fetchgit/nix-prefetch-git
@ -356,7 +356,7 @@ print_results() {
  "rev": "$(json_escape "$fullRev")",
  "date": "$(json_escape "$commitDateStrict8601")",
  "$(json_escape "$hashType")": "$(json_escape "$hash")",
-  "fetchSubmodules": $([[ -n "fetchSubmodules" ]] && echo true || echo false)
+  "fetchSubmodules": $([[ -n "$fetchSubmodules" ]] && echo true || echo false)
 }
 EOF
    fi
--- a/pkgs/build-support/singularity-tools/default.nix
+++ b/pkgs/build-support/singularity-tools/default.nix
@ -96,7 +96,7 @@ rec {
            echo creating
            singularity image.create -s $((1 + size * 4 / 1024 + ${toString extraSpace})) $out
            echo importing
-            mkdir -p /var/singularity/mnt/container
+            mkdir -p /var/singularity/mnt/{container,final,overlay,session,source}
            tar -c . | singularity image.import $out
          '');

--- a/pkgs/build-support/vsenv/build-solution.nix
+++ b/pkgs/build-support/vsenv/build-solution.nix
@ -1,18 +0,0 @@
-{stdenv, vs}:
-{ name
-, src
-, slnFile
-, baseDir ? "."
-, extraBuildInputs ? []
-}:
-
-stdenv.mkDerivation {
-  inherit name src;
-  installPhase = ''
-    cd ${baseDir}
-    vcbuild.exe /rebuild ${slnFile}
-    mkdir -p $out
-    cp Debug/* $out
-  '';
-  buildInputs = [ vs ] ++ extraBuildInputs;
-}
--- a/pkgs/build-support/vsenv/default.nix
+++ b/pkgs/build-support/vsenv/default.nix
@ -1,7 +0,0 @@
-{stdenv, vs}:
-
-{
-  buildSolution = import ./build-solution.nix {
-    inherit stdenv vs;
-  };  
-}
--- a/Show more
+++ b/Show more