about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--README.md135
-rw-r--r--maintainers/scripts/luarocks-packages.csv2
-rw-r--r--nixos/doc/manual/release-notes/rl-1909.xml5
-rw-r--r--nixos/lib/utils.nix112
-rw-r--r--nixos/modules/services/databases/postgresql.nix2
-rw-r--r--nixos/modules/services/hardware/upower.nix53
-rw-r--r--nixos/modules/services/misc/gitlab.nix333
-rw-r--r--nixos/modules/services/misc/gitlab.xml56
-rw-r--r--nixos/modules/services/search/kibana.nix2
-rw-r--r--nixos/modules/services/torrent/deluge.nix1
-rw-r--r--nixos/tests/gitlab.nix42
-rw-r--r--pkgs/applications/audio/strawberry/default.nix8
-rw-r--r--pkgs/applications/editors/kdevelop5/kdev-php.nix4
-rw-r--r--pkgs/applications/editors/kdevelop5/kdev-python.nix4
-rw-r--r--pkgs/applications/editors/kdevelop5/kdevelop.nix4
-rw-r--r--pkgs/applications/misc/lutris/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/signal-desktop/default.nix8
-rw-r--r--pkgs/applications/networking/irc/weechat/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/hub/default.nix4
-rw-r--r--pkgs/applications/version-management/gitea/default.nix6
-rw-r--r--pkgs/applications/window-managers/i3/status.nix16
-rw-r--r--pkgs/desktops/plasma-5/fetch.sh2
-rw-r--r--pkgs/desktops/plasma-5/srcs.nix360
-rw-r--r--pkgs/development/haskell-modules/configuration-common.nix16
-rw-r--r--pkgs/development/haskell-modules/configuration-hackage2nix.yaml4
-rw-r--r--pkgs/development/haskell-modules/hackage-packages.nix658
-rw-r--r--pkgs/development/interpreters/php/default.nix4
-rw-r--r--pkgs/development/interpreters/ruby/default.nix14
-rw-r--r--pkgs/development/interpreters/ruby/patchsets.nix9
-rw-r--r--pkgs/development/libraries/libgap/default.nix25
-rw-r--r--pkgs/development/libraries/qt-4.x/4.8/default.nix6
-rw-r--r--pkgs/development/lua-modules/generated-packages.nix40
-rw-r--r--pkgs/development/lua-modules/overrides.nix6
-rw-r--r--pkgs/development/perl-modules/mhonarc.patch26
-rw-r--r--pkgs/development/python-modules/colorcet/default.nix4
-rw-r--r--pkgs/development/python-modules/django/1_11.nix4
-rw-r--r--pkgs/development/python-modules/elasticsearch-curator/default.nix4
-rw-r--r--pkgs/development/python-modules/httpretty/default.nix1
-rw-r--r--pkgs/development/python-modules/pybind11/default.nix2
-rw-r--r--pkgs/development/python-modules/pytest-mpl/default.nix4
-rw-r--r--pkgs/development/python-modules/rfc6555/default.nix28
-rw-r--r--pkgs/development/python-modules/rfc6555/disable_network_tests.patch31
-rw-r--r--pkgs/development/python-modules/sphinx/default.nix2
-rw-r--r--pkgs/development/tools/analysis/tflint/default.nix6
-rw-r--r--pkgs/development/tools/misc/kibana/6.x.nix8
-rw-r--r--pkgs/development/tools/misc/kibana/7.x.nix12
-rw-r--r--pkgs/development/tools/misc/kibana/disable-nodejs-version-check-7.patch19
-rw-r--r--pkgs/development/tools/misc/luarocks/default.nix12
-rw-r--r--pkgs/development/tools/repository-managers/nexus/default.nix4
-rw-r--r--pkgs/games/mudlet/default.nix72
-rw-r--r--pkgs/games/mudlet/libs.patch13
-rw-r--r--pkgs/misc/logging/beats/6.x.nix2
-rw-r--r--pkgs/misc/logging/beats/7.x.nix2
-rw-r--r--pkgs/os-specific/linux/firmware/fwupd/default.nix162
-rw-r--r--pkgs/os-specific/linux/upower/default.nix41
-rw-r--r--pkgs/servers/dns/powerdns/default.nix6
-rw-r--r--pkgs/servers/http/unit/default.nix3
-rw-r--r--pkgs/servers/search/elasticsearch/6.x.nix4
-rw-r--r--pkgs/servers/search/elasticsearch/7.x.nix10
-rw-r--r--pkgs/servers/sql/postgresql/default.nix8
-rwxr-xr-xpkgs/servers/web-apps/cryptpad/generate.sh2
-rw-r--r--pkgs/servers/web-apps/cryptpad/node-packages-generated.nix18
-rw-r--r--pkgs/servers/web-apps/cryptpad/node-packages.json2
-rw-r--r--pkgs/tools/misc/html-proofer/Gemfile.lock4
-rw-r--r--pkgs/tools/misc/html-proofer/gemset.nix16
-rw-r--r--pkgs/tools/misc/logstash/6.x.nix4
-rw-r--r--pkgs/tools/misc/logstash/7.x.nix4
-rw-r--r--pkgs/tools/misc/starship/default.nix6
-rw-r--r--pkgs/tools/nix/nixpkgs-fmt/default.nix6
-rw-r--r--pkgs/tools/security/gnome-keysign/default.nix73
-rw-r--r--pkgs/tools/security/sequoia/default.nix6
-rw-r--r--pkgs/top-level/aliases.nix6
-rw-r--r--pkgs/top-level/all-packages.nix41
-rw-r--r--pkgs/top-level/perl-packages.nix15
-rw-r--r--pkgs/top-level/python-packages.nix2
75 files changed, 1846 insertions, 798 deletions
diff --git a/README.md b/README.md
index d589b953d1823..b34438e41a8fb 100644
--- a/README.md
+++ b/README.md
@@ -1,48 +1,113 @@
-[<img src="https://nixos.org/logo/nixos-hires.png" width="500px" alt="logo" />](https://nixos.org/nixos)
+<p align="center">
+  <a href="https://nixos.org/nixos"><img src="https://nixos.org/logo/nixos-hires.png" width="500px" alt="NixOS logo" /></a>
+</p>
 
-[![Code Triagers Badge](https://www.codetriage.com/nixos/nixpkgs/badges/users.svg)](https://www.codetriage.com/nixos/nixpkgs)
-[![Open Collective supporters](https://opencollective.com/nixos/tiers/supporter/badge.svg?label=Supporter&color=brightgreen)](https://opencollective.com/nixos)
+<p align="center">
+  <a href="https://www.codetriage.com/nixos/nixpkgs"><img src="https://www.codetriage.com/nixos/nixpkgs/badges/users.svg" alt="Code Triagers badge" /></a>
+  <a href="https://opencollective.com/nixos"><img src="https://opencollective.com/nixos/tiers/supporter/badge.svg?label=Supporter&color=brightgreen" alt="Open Collective supporters" /></a>
+</p>
 
-Nixpkgs is a collection of packages for the [Nix](https://nixos.org/nix/) package
-manager. It is periodically built and tested by the [Hydra](https://hydra.nixos.org/)
-build daemon as so-called channels. To get channel information via git, add
-[nixpkgs-channels](https://github.com/NixOS/nixpkgs-channels.git) as a remote:
+[Nixpkgs](https://github.com/nixos/nixpkgs) is a collection of over
+40,000 software packages that can be installed with the
+[Nix](https://nixos.org/nix/) package manager. It also implements
+[NixOS](https://nixos.org/nixos/), a purely-functional Linux distribution.
 
-```
-% git remote add channels https://github.com/NixOS/nixpkgs-channels.git
-```
+# Manuals
 
-For stability and maximum binary package support, it is recommended to maintain
-custom changes on top of one of the channels, e.g. `nixos-19.03` for the latest
-release and `nixos-unstable` for the latest successful build of master:
+* [NixOS Manual](https://nixos.org/nixos/manual) - how to install, configure, and maintain a purely-functional Linux distribution
+* [Nixpkgs Manual](https://nixos.org/nixpkgs/manual/) - contributing to Nixpkgs and using programming-language-specific Nix expressions
+* [Nix Package Manager Manual](https://nixos.org/nix/manual) - how to write Nix expresssions (programs), and how to use Nix command line tools
 
-```
-% git remote update channels
-% git rebase channels/nixos-19.03
-```
+# Community
 
-For pull requests, please rebase onto nixpkgs `master`.
+* [Discourse Forum](https://discourse.nixos.org/)
+* [IRC - #nixos on freenode.net](irc://irc.freenode.net/#nixos)
+* [NixOS Weekly](https://weekly.nixos.org/)
+* [Community-maintained wiki](https://nixos.wiki/)
+
+# Other Project Repositories
+
+The sources of all offical Nix-related projects are in the [NixOS
+organization on GitHub](https://github.com/NixOS/). Here are some of
+the main ones:
+
+* [Nix](https://github.com/NixOS/nix) - the purely functional package manager
+* [NixOps](https://github.com/NixOS/nixops) - the tool to remotely deploy NixOS machines
+* [Nix RFCs](https://github.com/NixOS/rfcs) - the formal process for making substantial changes to the community
+* [NixOS homepage](https://github.com/NixOS/nixos-homepage) - the [NixOS.org](https://nixos.org) website
+* [hydra](https://github.com/NixOS/hydra) - our continuous integration system
+* [NixOS Artwork](https://github.com/NixOS/nixos-artwork) - NixOS artwork
 
-[NixOS](https://nixos.org/nixos/) Linux distribution source code is located inside
-`nixos/` folder.
+# Continuous Integration and Distribution
+
+Nixpkgs and NixOS are built and tested by our continuous integration
+system, [Hydra](https://hydra.nixos.org/).
 
-* [NixOS installation instructions](https://nixos.org/nixos/manual/#ch-installation)
-* [Documentation (Nix Expression Language chapter)](https://nixos.org/nix/manual/#ch-expression-language)
-* [Manual (How to write packages for Nix)](https://nixos.org/nixpkgs/manual/)
-* [Manual (NixOS)](https://nixos.org/nixos/manual/)
-* [Community maintained wiki](https://nixos.wiki/)
 * [Continuous package builds for unstable/master](https://hydra.nixos.org/jobset/nixos/trunk-combined)
-* [Continuous package builds for 19.03 release](https://hydra.nixos.org/jobset/nixos/release-19.03)
+* [Continuous package builds for the NixOS 19.03 release](https://hydra.nixos.org/jobset/nixos/release-19.03)
 * [Tests for unstable/master](https://hydra.nixos.org/job/nixos/trunk-combined/tested#tabs-constituents)
-* [Tests for 19.03 release](https://hydra.nixos.org/job/nixos/release-19.03/tested#tabs-constituents)
+* [Tests for the NixOS 19.03 release](https://hydra.nixos.org/job/nixos/release-19.03/tested#tabs-constituents)
 
-Communication:
+Artifacts successfully built with Hydra are published to cache at
+https://cache.nixos.org/. When successful build and test criteria are
+met, the Nixpkgs expressions are distributed via [Nix
+channels](https://nixos.org/nix/manual/#sec-channels). The channels
+are provided via a read-only mirror of the Nixpkgs repository called
+[nixpkgs-channels](https://github.com/NixOS/nixpkgs-channels).
 
-* [Discourse Forum](https://discourse.nixos.org/)
-* [IRC - #nixos on freenode.net](irc://irc.freenode.net/#nixos)
+# Contributing
+
+Nixpkgs is among the most active projects on GitHub. While thousands
+of open issues and pull requests might seem a lot at first, it helps
+consider it in the context of the scope of the project. Nixpkgs
+describes how to build over 40,000 pieces of software and implements a
+Linux distribution. The [GitHub Insights](https://github.com/NixOS/nixpkgs/pulse)
+page gives a sense of the project activity.
+
+Community contributions are always welcome through GitHub Issues and
+Pull Requests. When pull requests are made, our tooling automation bot,
+[OfBorg](https://github.com/NixOS/ofborg) will perform various checks
+to help ensure expression quality.
+
+The *Nixpkgs maintainers* are people who have assigned themselves to
+maintain specific individual packages. We encourage people who care
+about a package to assign themselves as a maintainer. When a pull
+request is made against a package, OfBorg will notify the appropriate
+maintainer(s). The *Nixpkgs committers* are people who have been given
+permission to merge.
+
+Most contributions are based on and merged into these branches:
+
+* `master` is the main branch where all small contributions go
+* `staging` is branched from master, changes that have a big impact on
+  Hydra builds go to this branch
+* `staging-next` is branched from staging and only fixes to stabilize
+  and security fixes with a big impact on Hydra builds should be
+  contributed to this branch. This branch is merged into master when
+  deemed of sufficiently high quality
+
+For more information about contributing to the project, please visit
+the [contributing page](https://github.com/NixOS/nixpkgs/blob/master/.github/CONTRIBUTING.md).
+
+# Donations
+
+The infrastructure for NixOS and related projects is maintained by a
+nonprofit organization, the [NixOS
+Foundation](https://nixos.org/nixos/foundation.html). To ensure the
+continuity and expansion of the NixOS infrastructure, we are looking
+for donations to our organization.
+
+You can donate to the NixOS foundation by using Open Collective:
+
+<a href="https://opencollective.com/nixos#support"><img src="https://opencollective.com/nixos/tiers/supporter.svg?width=890" /></a>
+
+# License
+
+Nixpkgs is licensed under the [MIT License](COPYING).
 
-Note: MIT license does not apply to the packages built by Nixpkgs, merely to
-the package descriptions (Nix expressions, build scripts, and so on). It also
-might not apply to patches included in Nixpkgs, which may be derivative works
-of the packages to which they apply. The aforementioned artifacts are all
-covered by the licenses of the respective packages.
+Note: MIT license does not apply to the packages built by Nixpkgs,
+merely to the files in this repository (the Nix expressions, build
+scripts, NixOS modules, etc.). It also might not apply to patches
+included in Nixpkgs, which may be derivative works of the packages to
+which they apply. The aforementioned artifacts are all covered by the
+licenses of the respective packages.
diff --git a/maintainers/scripts/luarocks-packages.csv b/maintainers/scripts/luarocks-packages.csv
index 0ec9ff3d84d9e..a6fbcd5a0beb6 100644
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@@ -52,7 +52,9 @@ luasocket,,,,,
 luasql-sqlite3,,,,,vyp
 luassert,,,,,
 luasystem,,,,,
+luautf8,,,,,pstn
 luazip,,,,,
+lua-yajl,,,,,pstn
 luuid,,,,,
 luv,,,,,
 markdown,,,,,
diff --git a/nixos/doc/manual/release-notes/rl-1909.xml b/nixos/doc/manual/release-notes/rl-1909.xml
index ee3b035815299..db46294430022 100644
--- a/nixos/doc/manual/release-notes/rl-1909.xml
+++ b/nixos/doc/manual/release-notes/rl-1909.xml
@@ -206,6 +206,11 @@
    </listitem>
    <listitem>
     <para>
+     PostgreSQL 9.4 is scheduled EOL during the 19.09 life cycle and has been removed.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
      The options <option>services.prometheus.alertmanager.user</option> and
      <option>services.prometheus.alertmanager.group</option> have been removed
      because the alertmanager service is now using systemd's <link
diff --git a/nixos/lib/utils.nix b/nixos/lib/utils.nix
index 3297cf06108b7..6ab4c3927955b 100644
--- a/nixos/lib/utils.nix
+++ b/nixos/lib/utils.nix
@@ -24,4 +24,116 @@ pkgs: with pkgs.lib;
       throw "${shell} is not a shell package"
     else
       shell;
+
+  /* Recurse into a list or an attrset, searching for attrs named like
+     the value of the "attr" parameter, and return an attrset where the
+     names are the corresponding jq path where the attrs were found and
+     the values are the values of the attrs.
+
+     Example:
+       recursiveGetAttrWithJqPrefix {
+         example = [
+           {
+             irrelevant = "not interesting";
+           }
+           {
+             ignored = "ignored attr";
+             relevant = {
+               secret = {
+                 _secret = "/path/to/secret";
+               };
+             };
+           }
+         ];
+       } "_secret" -> { ".example[1].relevant.secret" = "/path/to/secret"; }
+  */
+  recursiveGetAttrWithJqPrefix = item: attr:
+    let
+      recurse = prefix: item:
+        if item ? ${attr} then
+          nameValuePair prefix item.${attr}
+        else if isAttrs item then
+          map (name: recurse (prefix + "." + name) item.${name}) (attrNames item)
+        else if isList item then
+          imap0 (index: item: recurse (prefix + "[${toString index}]") item) item
+        else
+          [];
+    in listToAttrs (flatten (recurse "" item));
+
+  /* Takes an attrset and a file path and generates a bash snippet that
+     outputs a JSON file at the file path with all instances of
+
+     { _secret = "/path/to/secret" }
+
+     in the attrset replaced with the contents of the file
+     "/path/to/secret" in the output JSON.
+
+     When a configuration option accepts an attrset that is finally
+     converted to JSON, this makes it possible to let the user define
+     arbitrary secret values.
+
+     Example:
+       If the file "/path/to/secret" contains the string
+       "topsecretpassword1234",
+
+       genJqSecretsReplacementSnippet {
+         example = [
+           {
+             irrelevant = "not interesting";
+           }
+           {
+             ignored = "ignored attr";
+             relevant = {
+               secret = {
+                 _secret = "/path/to/secret";
+               };
+             };
+           }
+         ];
+       } "/path/to/output.json"
+
+       would generate a snippet that, when run, outputs the following
+       JSON file at "/path/to/output.json":
+
+       {
+         "example": [
+           {
+             "irrelevant": "not interesting"
+           },
+           {
+             "ignored": "ignored attr",
+             "relevant": {
+               "secret": "topsecretpassword1234"
+             }
+           }
+         ]
+       }
+  */
+  genJqSecretsReplacementSnippet = genJqSecretsReplacementSnippet' "_secret";
+
+  # Like genJqSecretsReplacementSnippet, but allows the name of the
+  # attr which identifies the secret to be changed.
+  genJqSecretsReplacementSnippet' = attr: set: output:
+    let
+      secrets = recursiveGetAttrWithJqPrefix set attr;
+    in ''
+      if [[ -h '${output}' ]]; then
+        rm '${output}'
+      fi
+    ''
+    + concatStringsSep
+        "\n"
+        (imap1 (index: name: "export secret${toString index}=$(<'${secrets.${name}}')")
+               (attrNames secrets))
+    + "\n"
+    + "${pkgs.jq}/bin/jq >'${output}' '"
+    + concatStringsSep
+      " | "
+      (imap1 (index: name: ''${name} = $ENV.secret${toString index}'')
+             (attrNames secrets))
+    + ''
+      ' <<'EOF'
+      ${builtins.toJSON set}
+      EOF
+    '';
 }
diff --git a/nixos/modules/services/databases/postgresql.nix b/nixos/modules/services/databases/postgresql.nix
index 1ed4d3290ced3..7bba4dacddcca 100644
--- a/nixos/modules/services/databases/postgresql.nix
+++ b/nixos/modules/services/databases/postgresql.nix
@@ -228,7 +228,7 @@ in
       # systems!
       mkDefault (if versionAtLeast config.system.stateVersion "17.09" then pkgs.postgresql_9_6
             else if versionAtLeast config.system.stateVersion "16.03" then pkgs.postgresql_9_5
-            else pkgs.postgresql_9_4);
+            else throw "postgresql_9_4 was removed, please upgrade your postgresql version.");
 
     services.postgresql.dataDir =
       mkDefault (if versionAtLeast config.system.stateVersion "17.09" then "/var/lib/postgresql/${config.services.postgresql.package.psqlSchema}"
diff --git a/nixos/modules/services/hardware/upower.nix b/nixos/modules/services/hardware/upower.nix
index 1da47349c0771..5e7ac7a6e6591 100644
--- a/nixos/modules/services/hardware/upower.nix
+++ b/nixos/modules/services/hardware/upower.nix
@@ -5,8 +5,11 @@
 with lib;
 
 let
+
   cfg = config.services.upower;
+
 in
+
 {
 
   ###### interface
@@ -49,55 +52,7 @@ in
 
     services.udev.packages = [ cfg.package ];
 
-    systemd.services.upower =
-      { description = "Power Management Daemon";
-        path = [ pkgs.glib.out ]; # needed for gdbus
-        serviceConfig =
-          { Type = "dbus";
-            BusName = "org.freedesktop.UPower";
-            ExecStart = "@${cfg.package}/libexec/upowerd upowerd";
-            Restart = "on-failure";
-            # Upstream lockdown:
-            # Filesystem lockdown
-            ProtectSystem = "strict";
-            # Needed by keyboard backlight support
-            ProtectKernelTunables = false;
-            ProtectControlGroups = true;
-            ReadWritePaths = "/var/lib/upower";
-            ProtectHome = true;
-            PrivateTmp = true;
-
-            # Network
-            # PrivateNetwork=true would block udev's netlink socket
-            RestrictAddressFamilies = "AF_UNIX AF_NETLINK";
-
-            # Execute Mappings
-            MemoryDenyWriteExecute = true;
-
-            # Modules
-            ProtectKernelModules = true;
-
-            # Real-time
-            RestrictRealtime = true;
-
-            # Privilege escalation
-            NoNewPrivileges = true;
-          };
-      };
-
-    system.activationScripts.upower =
-      ''
-        mkdir -m 0755 -p /var/lib/upower
-      '';
-
-    # The upower daemon seems to get stuck after doing a suspend
-    # (i.e. subsequent suspend requests will say "Sleep has already
-    # been requested and is pending").  So as a workaround, restart
-    # the daemon.
-    powerManagement.resumeCommands =
-      ''
-        ${config.systemd.package}/bin/systemctl try-restart upower
-      '';
+    systemd.packages = [ cfg.package ];
 
   };
 
diff --git a/nixos/modules/services/misc/gitlab.nix b/nixos/modules/services/misc/gitlab.nix
index 3b39dde341b53..caef4ad4ea80c 100644
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, utils, ... }:
 
 # TODO: support non-postgresql
 
@@ -12,14 +12,12 @@ let
   gitlabSocket = "${cfg.statePath}/tmp/sockets/gitlab.socket";
   gitalySocket = "${cfg.statePath}/tmp/sockets/gitaly.socket";
   pathUrlQuote = url: replaceStrings ["/"] ["%2F"] url;
-  pgSuperUser = config.services.postgresql.superUser;
 
   databaseConfig = {
     production = {
       adapter = "postgresql";
       database = cfg.databaseName;
       host = cfg.databaseHost;
-      password = cfg.databasePassword;
       username = cfg.databaseUsername;
       encoding = "utf8";
       pool = cfg.databasePool;
@@ -66,13 +64,6 @@ let
 
   redisConfig.production.url = "redis://localhost:6379/";
 
-  secretsConfig.production = {
-    secret_key_base = cfg.secrets.secret;
-    otp_key_base = cfg.secrets.otp;
-    db_key_base = cfg.secrets.db;
-    openid_connect_signing_key = cfg.secrets.jws;
-  };
-
   gitlabConfig = {
     # These are the default settings from config/gitlab.example.yml
     production = flip recursiveUpdate cfg.extraConfig {
@@ -180,10 +171,11 @@ let
         address: "${cfg.smtp.address}",
         port: ${toString cfg.smtp.port},
         ${optionalString (cfg.smtp.username != null) ''user_name: "${cfg.smtp.username}",''}
-        ${optionalString (cfg.smtp.password != null) ''password: "${cfg.smtp.password}",''}
+        ${optionalString (cfg.smtp.passwordFile != null) ''password: "@smtpPassword@",''}
         domain: "${cfg.smtp.domain}",
         ${optionalString (cfg.smtp.authentication != null) "authentication: :${cfg.smtp.authentication},"}
         enable_starttls_auto: ${toString cfg.smtp.enableStartTLSAuto},
+        ca_file: "/etc/ssl/certs/ca-certificates.crt",
         openssl_verify_mode: '${cfg.smtp.opensslVerifyMode}'
       }
     end
@@ -244,13 +236,33 @@ in {
 
       databaseHost = mkOption {
         type = types.str;
-        default = "127.0.0.1";
-        description = "Gitlab database hostname.";
+        default = "";
+        description = ''
+          Gitlab database hostname. An empty string means <quote>use
+          local unix socket connection</quote>.
+        '';
       };
 
-      databasePassword = mkOption {
-        type = types.str;
-        description = "Gitlab database user password.";
+      databasePasswordFile = mkOption {
+        type = with types; nullOr path;
+        default = null;
+        description = ''
+          File containing the Gitlab database user password.
+
+          This should be a string, not a nix path, since nix paths are
+          copied into the world-readable nix store.
+        '';
+      };
+
+      databaseCreateLocally = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Whether a database should be automatically created on the
+          local host. Set this to <literal>false</literal> if you plan
+          on provisioning a local database yourself or use an external
+          one.
+        '';
       };
 
       databaseName = mkOption {
@@ -338,10 +350,15 @@ in {
         '';
       };
 
-      initialRootPassword = mkOption {
-        type = types.str;
+      initialRootPasswordFile = mkOption {
+        type = with types; nullOr path;
+        default = null;
         description = ''
-          Initial password of the root account if this is a new install.
+          File containing the initial password of the root account if
+          this is a new install.
+
+          This should be a string, not a nix path, since nix paths are
+          copied into the world-readable nix store.
         '';
       };
 
@@ -365,15 +382,20 @@ in {
         };
 
         username = mkOption {
-          type = types.nullOr types.str;
+          type = with types; nullOr str;
           default = null;
           description = "Username of the SMTP server for Gitlab.";
         };
 
-        password = mkOption {
-          type = types.nullOr types.str;
+        passwordFile = mkOption {
+          type = types.nullOr types.path;
           default = null;
-          description = "Password of the SMTP server for Gitlab.";
+          description = ''
+            File containing the password of the SMTP server for Gitlab.
+
+            This should be a string, not a nix path, since nix paths
+            are copied into the world-readable nix store.
+          '';
         };
 
         domain = mkOption {
@@ -383,7 +405,7 @@ in {
         };
 
         authentication = mkOption {
-          type = types.nullOr types.str;
+          type = with types; nullOr str;
           default = null;
           description = "Authentitcation type to use, see http://api.rubyonrails.org/classes/ActionMailer/Base.html";
         };
@@ -401,68 +423,125 @@ in {
         };
       };
 
-      secrets.secret = mkOption {
-        type = types.str;
+      secrets.secretFile = mkOption {
+        type = with types; nullOr path;
+        default = null;
         description = ''
-          The secret is used to encrypt variables in the DB. If
-          you change or lose this key you will be unable to access variables
-          stored in database.
+          A file containing the secret used to encrypt variables in
+          the DB. If you change or lose this key you will be unable to
+          access variables stored in database.
 
           Make sure the secret is at least 30 characters and all random,
           no regular words or you'll be exposed to dictionary attacks.
+
+          This should be a string, not a nix path, since nix paths are
+          copied into the world-readable nix store.
         '';
       };
 
-      secrets.db = mkOption {
-        type = types.str;
+      secrets.dbFile = mkOption {
+        type = with types; nullOr path;
+        default = null;
         description = ''
-          The secret is used to encrypt variables in the DB. If
-          you change or lose this key you will be unable to access variables
-          stored in database.
+          A file containing the secret used to encrypt variables in
+          the DB. If you change or lose this key you will be unable to
+          access variables stored in database.
 
           Make sure the secret is at least 30 characters and all random,
           no regular words or you'll be exposed to dictionary attacks.
+
+          This should be a string, not a nix path, since nix paths are
+          copied into the world-readable nix store.
         '';
       };
 
-      secrets.otp = mkOption {
-        type = types.str;
+      secrets.otpFile = mkOption {
+        type = with types; nullOr path;
+        default = null;
         description = ''
-          The secret is used to encrypt secrets for OTP tokens. If
-          you change or lose this key, users which have 2FA enabled for login
-          won't be able to login anymore.
+          A file containing the secret used to encrypt secrets for OTP
+          tokens. If you change or lose this key, users which have 2FA
+          enabled for login won't be able to login anymore.
 
           Make sure the secret is at least 30 characters and all random,
           no regular words or you'll be exposed to dictionary attacks.
+
+          This should be a string, not a nix path, since nix paths are
+          copied into the world-readable nix store.
         '';
       };
 
-      secrets.jws = mkOption {
-        type = types.str;
+      secrets.jwsFile = mkOption {
+        type = with types; nullOr path;
+        default = null;
         description = ''
-          The secret is used to encrypt session keys. If you change or lose
-          this key, users will be disconnected.
+          A file containing the secret used to encrypt session
+          keys. If you change or lose this key, users will be
+          disconnected.
 
           Make sure the secret is an RSA private key in PEM format. You can
           generate one with
 
           openssl genrsa 2048
+
+          This should be a string, not a nix path, since nix paths are
+          copied into the world-readable nix store.
         '';
       };
 
       extraConfig = mkOption {
         type = types.attrs;
         default = {};
-        example = {
-          gitlab = {
-            default_projects_features = {
-              builds = false;
+        example = literalExample ''
+          {
+            gitlab = {
+              default_projects_features = {
+                builds = false;
+              };
+            };
+            omniauth = {
+              enabled = true;
+              auto_sign_in_with_provider = "openid_connect";
+              allow_single_sign_on = ["openid_connect"];
+              block_auto_created_users = false;
+              providers = [
+                {
+                  name = "openid_connect";
+                  label = "OpenID Connect";
+                  args = {
+                    name = "openid_connect";
+                    scope = ["openid" "profile"];
+                    response_type = "code";
+                    issuer = "https://keycloak.example.com/auth/realms/My%20Realm";
+                    discovery = true;
+                    client_auth_method = "query";
+                    uid_field = "preferred_username";
+                    client_options = {
+                      identifier = "gitlab";
+                      secret = { _secret = "/var/keys/gitlab_oidc_secret"; };
+                      redirect_uri = "https://git.example.com/users/auth/openid_connect/callback";
+                    };
+                  };
+                }
+              ];
             };
           };
-        };
+        '';
         description = ''
-          Extra options to be merged into config/gitlab.yml as nix
-          attribute set.
+          Extra options to be added under
+          <literal>production</literal> in
+          <filename>config/gitlab.yml</filename>, as a nix attribute
+          set.
+
+          Options containing secret data should be set to an attribute
+          set containing the attribute <literal>_secret</literal> - a
+          string pointing to a file containing the value the option
+          should be set to. See the example to get a better picture of
+          this: in the resulting
+          <filename>config/gitlab.yml</filename> file, the
+          <literal>production.omniauth.providers[0].args.client_options.secret</literal>
+          key will be set to the contents of the
+          <filename>/var/keys/gitlab_oidc_secret</filename> file.
         '';
       };
     };
@@ -470,12 +549,66 @@ in {
 
   config = mkIf cfg.enable {
 
+    assertions = [
+      {
+        assertion = cfg.databaseCreateLocally -> (cfg.user == cfg.databaseUsername);
+        message = "For local automatic database provisioning services.gitlab.user and services.gitlab.databaseUsername should be identical.";
+      }
+      {
+        assertion = (cfg.databaseHost != "") -> (cfg.databasePasswordFile != null);
+        message = "When services.gitlab.databaseHost is customized, services.gitlab.databasePasswordFile must be set!";
+      }
+      {
+        assertion = cfg.initialRootPasswordFile != null;
+        message = "services.gitlab.initialRootPasswordFile must be set!";
+      }
+      {
+        assertion = cfg.secrets.secretFile != null;
+        message = "services.gitlab.secrets.secretFile must be set!";
+      }
+      {
+        assertion = cfg.secrets.dbFile != null;
+        message = "services.gitlab.secrets.dbFile must be set!";
+      }
+      {
+        assertion = cfg.secrets.otpFile != null;
+        message = "services.gitlab.secrets.otpFile must be set!";
+      }
+      {
+        assertion = cfg.secrets.jwsFile != null;
+        message = "services.gitlab.secrets.jwsFile must be set!";
+      }
+    ];
+
     environment.systemPackages = [ pkgs.git gitlab-rake gitlab-rails cfg.packages.gitlab-shell ];
 
     # Redis is required for the sidekiq queue runner.
     services.redis.enable = mkDefault true;
+
     # We use postgres as the main data store.
-    services.postgresql.enable = mkDefault true;
+    services.postgresql = optionalAttrs cfg.databaseCreateLocally {
+      enable = true;
+      ensureUsers = singleton { name = cfg.databaseUsername; };
+    };
+    # The postgresql module doesn't currently support concepts like
+    # objects owners and extensions; for now we tack on what's needed
+    # here.
+    systemd.services.postgresql.postStart = mkAfter (optionalString cfg.databaseCreateLocally ''
+      $PSQL -tAc "SELECT 1 FROM pg_database WHERE datname = '${cfg.databaseName}'" | grep -q 1 || $PSQL -tAc 'CREATE DATABASE "${cfg.databaseName}" OWNER "${cfg.databaseUsername}"'
+      current_owner=$($PSQL -tAc "SELECT pg_catalog.pg_get_userbyid(datdba) FROM pg_catalog.pg_database WHERE datname = '${cfg.databaseName}'")
+      if [[ "$current_owner" != "${cfg.databaseUsername}" ]]; then
+          $PSQL -tAc 'ALTER DATABASE "${cfg.databaseName}" OWNER TO "${cfg.databaseUsername}"'
+          if [[ -e "${config.services.postgresql.dataDir}/.reassigning_${cfg.databaseName}" ]]; then
+              echo "Reassigning ownership of database ${cfg.databaseName} to user ${cfg.databaseUsername} failed on last boot. Failing..."
+              exit 1
+          fi
+          touch "${config.services.postgresql.dataDir}/.reassigning_${cfg.databaseName}"
+          $PSQL "${cfg.databaseName}" -tAc "REASSIGN OWNED BY \"$current_owner\" TO \"${cfg.databaseUsername}\""
+          rm "${config.services.postgresql.dataDir}/.reassigning_${cfg.databaseName}"
+      fi
+      $PSQL '${cfg.databaseName}' -tAc "CREATE EXTENSION IF NOT EXISTS pg_trgm"
+    '');
+
     # Use postfix to send out mails.
     services.postfix.enable = mkDefault true;
 
@@ -527,14 +660,9 @@ in {
 
       "L+ /run/gitlab/shell-config.yml - - - - ${pkgs.writeText "config.yml" (builtins.toJSON gitlabShellConfig)}"
 
-      "L+ ${cfg.statePath}/config/gitlab.yml - - - - ${pkgs.writeText "gitlab.yml" (builtins.toJSON gitlabConfig)}"
-      "L+ ${cfg.statePath}/config/database.yml - - - - ${pkgs.writeText "database.yml" (builtins.toJSON databaseConfig)}"
-      "L+ ${cfg.statePath}/config/secrets.yml - - - - ${pkgs.writeText "secrets.yml" (builtins.toJSON secretsConfig)}"
       "L+ ${cfg.statePath}/config/unicorn.rb - - - - ${./defaultUnicornConfig.rb}"
-
       "L+ ${cfg.statePath}/config/initializers/extra-gitlab.rb - - - - ${extraGitlabRb}"
-    ] ++ optional cfg.smtp.enable
-      "L+ ${cfg.statePath}/config/initializers/smtp_settings.rb - - - - ${smtpSettings}" ;
+    ];
 
     systemd.services.gitlab-sidekiq = {
       after = [ "network.target" "redis.service" "gitlab.service" ];
@@ -626,46 +754,75 @@ in {
         gnupg
       ];
       preStart = ''
-        ${pkgs.sudo}/bin/sudo -u ${cfg.user} cp -f ${cfg.packages.gitlab}/share/gitlab/VERSION ${cfg.statePath}/VERSION
-        ${pkgs.sudo}/bin/sudo -u ${cfg.user} rm -rf ${cfg.statePath}/db/*
-        ${pkgs.sudo}/bin/sudo -u ${cfg.user} cp -rf --no-preserve=mode ${cfg.packages.gitlab}/share/gitlab/config.dist/* ${cfg.statePath}/config
-        ${pkgs.sudo}/bin/sudo -u ${cfg.user} cp -rf --no-preserve=mode ${cfg.packages.gitlab}/share/gitlab/db/* ${cfg.statePath}/db
-
-        ${pkgs.openssl}/bin/openssl rand -hex 32 > ${cfg.statePath}/gitlab_shell_secret
-
-        ${pkgs.sudo}/bin/sudo -u ${cfg.user} ${cfg.packages.gitlab-shell}/bin/install
-
-        if ! test -e "${cfg.statePath}/db-created"; then
-          if [ "${cfg.databaseHost}" = "127.0.0.1" ]; then
-            ${pkgs.sudo}/bin/sudo -u ${pgSuperUser} psql postgres -c "CREATE ROLE ${cfg.databaseUsername} WITH LOGIN NOCREATEDB NOCREATEROLE ENCRYPTED PASSWORD '${cfg.databasePassword}'"
-            ${pkgs.sudo}/bin/sudo -u ${pgSuperUser} ${config.services.postgresql.package}/bin/createdb --owner ${cfg.databaseUsername} ${cfg.databaseName}
-
-            # enable required pg_trgm extension for gitlab
-            ${pkgs.sudo}/bin/sudo -u ${pgSuperUser} psql ${cfg.databaseName} -c "CREATE EXTENSION IF NOT EXISTS pg_trgm"
+        cp -f ${cfg.packages.gitlab}/share/gitlab/VERSION ${cfg.statePath}/VERSION
+        rm -rf ${cfg.statePath}/db/*
+        cp -rf --no-preserve=mode ${cfg.packages.gitlab}/share/gitlab/config.dist/* ${cfg.statePath}/config
+        cp -rf --no-preserve=mode ${cfg.packages.gitlab}/share/gitlab/db/* ${cfg.statePath}/db
+
+        ${cfg.packages.gitlab-shell}/bin/install
+
+        ${optionalString cfg.smtp.enable ''
+          install -m u=rw ${smtpSettings} ${cfg.statePath}/config/initializers/smtp_settings.rb
+          ${optionalString (cfg.smtp.passwordFile != null) ''
+            smtp_password=$(<'${cfg.smtp.passwordFile}')
+            ${pkgs.replace}/bin/replace-literal -e '@smtpPassword@' "$smtp_password" '${cfg.statePath}/config/initializers/smtp_settings.rb'
+          ''}
+        ''}
+
+        (
+          umask u=rwx,g=,o=
+
+          ${pkgs.openssl}/bin/openssl rand -hex 32 > ${cfg.statePath}/gitlab_shell_secret
+
+          ${if cfg.databasePasswordFile != null then ''
+              export db_password="$(<'${cfg.databasePasswordFile}')"
+
+              if [[ -z "$db_password" ]]; then
+                >&2 echo "Database password was an empty string!"
+                exit 1
+              fi
+
+              ${pkgs.jq}/bin/jq <${pkgs.writeText "database.yml" (builtins.toJSON databaseConfig)} \
+                                '.production.password = $ENV.db_password' \
+                                >'${cfg.statePath}/config/database.yml'
+            ''
+            else ''
+              ${pkgs.jq}/bin/jq <${pkgs.writeText "database.yml" (builtins.toJSON databaseConfig)} \
+                                >'${cfg.statePath}/config/database.yml'
+            ''
+          }
+
+          ${utils.genJqSecretsReplacementSnippet
+              gitlabConfig
+              "${cfg.statePath}/config/gitlab.yml"
+          }
+
+          if [[ -h '${cfg.statePath}/config/secrets.yml' ]]; then
+            rm '${cfg.statePath}/config/secrets.yml'
           fi
 
-          ${pkgs.sudo}/bin/sudo -u ${cfg.user} -H ${gitlab-rake}/bin/gitlab-rake db:schema:load
-
-          ${pkgs.sudo}/bin/sudo -u ${cfg.user} touch "${cfg.statePath}/db-created"
-        fi
-
-        # Always do the db migrations just to be sure the database is up-to-date
-        ${pkgs.sudo}/bin/sudo -u ${cfg.user} -H ${gitlab-rake}/bin/gitlab-rake db:migrate
-
-        if ! test -e "${cfg.statePath}/db-seeded"; then
-          ${pkgs.sudo}/bin/sudo -u ${cfg.user} ${gitlab-rake}/bin/gitlab-rake db:seed_fu \
-            GITLAB_ROOT_PASSWORD='${cfg.initialRootPassword}' GITLAB_ROOT_EMAIL='${cfg.initialRootEmail}'
-          ${pkgs.sudo}/bin/sudo -u ${cfg.user} touch "${cfg.statePath}/db-seeded"
-        fi
+          export secret="$(<'${cfg.secrets.secretFile}')"
+          export db="$(<'${cfg.secrets.dbFile}')"
+          export otp="$(<'${cfg.secrets.otpFile}')"
+          export jws="$(<'${cfg.secrets.jwsFile}')"
+          ${pkgs.jq}/bin/jq -n '{production: {secret_key_base: $ENV.secret,
+                                              otp_key_base: $ENV.db,
+                                              db_key_base: $ENV.otp,
+                                              openid_connect_signing_key: $ENV.jws}}' \
+                            > '${cfg.statePath}/config/secrets.yml'
+        )
+
+        initial_root_password="$(<'${cfg.initialRootPasswordFile}')"
+        ${gitlab-rake}/bin/gitlab-rake gitlab:db:configure GITLAB_ROOT_PASSWORD="$initial_root_password" \
+                                                           GITLAB_ROOT_EMAIL='${cfg.initialRootEmail}'
 
         # We remove potentially broken links to old gitlab-shell versions
         rm -Rf ${cfg.statePath}/repositories/**/*.git/hooks
 
-        ${pkgs.sudo}/bin/sudo -u ${cfg.user} -H ${pkgs.git}/bin/git config --global core.autocrlf "input"
+        ${pkgs.git}/bin/git config --global core.autocrlf "input"
       '';
 
       serviceConfig = {
-        PermissionsStartOnly = true; # preStart must be run as root
         Type = "simple";
         User = cfg.user;
         Group = cfg.group;
diff --git a/nixos/modules/services/misc/gitlab.xml b/nixos/modules/services/misc/gitlab.xml
index 5ff570a442f69..b6171a9a194c1 100644
--- a/nixos/modules/services/misc/gitlab.xml
+++ b/nixos/modules/services/misc/gitlab.xml
@@ -54,8 +54,8 @@
 <programlisting>
 services.gitlab = {
   <link linkend="opt-services.gitlab.enable">enable</link> = true;
-  <link linkend="opt-services.gitlab.databasePassword">databasePassword</link> = "eXaMpl3";
-  <link linkend="opt-services.gitlab.initialRootPassword">initialRootPassword</link> = "UseNixOS!";
+  <link linkend="opt-services.gitlab.databasePasswordFile">databasePasswordFile</link> = "/var/keys/gitlab/db_password";
+  <link linkend="opt-services.gitlab.initialRootPasswordFile">initialRootPasswordFile</link> = "/var/keys/gitlab/root_password";
   <link linkend="opt-services.gitlab.https">https</link> = true;
   <link linkend="opt-services.gitlab.host">host</link> = "git.example.com";
   <link linkend="opt-services.gitlab.port">port</link> = 443;
@@ -67,38 +67,10 @@ services.gitlab = {
     <link linkend="opt-services.gitlab.smtp.port">port</link> = 25;
   };
   secrets = {
-    <link linkend="opt-services.gitlab.secrets.db">db</link> = "uPgq1gtwwHiatiuE0YHqbGa5lEIXH7fMsvuTNgdzJi8P0Dg12gibTzBQbq5LT7PNzcc3BP9P1snHVnduqtGF43PgrQtU7XL93ts6gqe9CBNhjtaqUwutQUDkygP5NrV6";
-    <link linkend="opt-services.gitlab.secrets.secret">secret</link> = "devzJ0Tz0POiDBlrpWmcsjjrLaltyiAdS8TtgT9YNBOoUcDsfppiY3IXZjMVtKgXrFImIennFGOpPN8IkP8ATXpRgDD5rxVnKuTTwYQaci2NtaV1XxOQGjdIE50VGsR3";
-    <link linkend="opt-services.gitlab.secrets.otp">otp</link> = "e1GATJVuS2sUh7jxiPzZPre4qtzGGaS22FR50Xs1TerRVdgI3CBVUi5XYtQ38W4xFeS4mDqi5cQjExE838iViSzCdcG19XSL6qNsfokQP9JugwiftmhmCadtsnHErBMI";
-    <link linkend="opt-services.gitlab.secrets.jws">jws</link> = ''
-      -----BEGIN RSA PRIVATE KEY-----
-      MIIEpAIBAAKCAQEArrtx4oHKwXoqUbMNqnHgAklnnuDon3XG5LJB35yPsXKv/8GK
-      ke92wkI+s1Xkvsp8tg9BIY/7c6YK4SR07EWL+dB5qwctsWR2Q8z+/BKmTx9D99pm
-      hnsjuNIXTF7BXrx3RX6BxZpH5Vzzh9nCwWKT/JCFqtwH7afNGGL7aMf+hdaiUg/Q
-      SD05yRObioiO4iXDolsJOhrnbZvlzVHl1ZYxFJv0H6/Snc0BBA9Fl/3uj6ANpbjP
-      eXF1SnJCqT87bj46r5NdVauzaRxAsIfqHroHK4UZ98X5LjGQFGvSqTvyjPBS4I1i
-      s7VJU28ObuutHxIxSlH0ibn4HZqWmKWlTS652wIDAQABAoIBAGtPcUTTw2sJlR3x
-      4k2wfAvLexkHNbZhBdKEa5JiO5mWPuLKwUiZEY2CU7Gd6csG3oqNWcm7/IjtC7dz
-      xV8p4yp8T4yq7vQIJ93B80NqTLtBD2QTvG2RCMJEPMzJUObWxkVmyVpLQyZo7KOd
-      KE/OM+aj94OUeEYLjRkSCScz1Gvq/qFG/nAy7KPCmN9JDHuhX26WHo2Rr1OnPNT/
-      7diph0bB9F3b8gjjNTqXDrpdAqVOgR/PsjEBz6DMY+bdyMIn87q2yfmMexxRofN6
-      LulpzSaa6Yup8N8H6PzVO6KAkQuf1aQRj0sMwGk1IZEnj6I0KbuHIZkw21Nc6sf2
-      ESFySDECgYEA1PnCNn5tmLnwe62Ttmrzl20zIS3Me1gUVJ1NTfr6+ai0I9iMYU21
-      5czuAjJPm9JKQF2vY8UAaCj2ZoObtHa/anb3xsCd8NXoM3iJq5JDoXI1ldz3Y+ad
-      U/bZUg1DLRvAniTuXmw9iOTwTwPxlDIGq5k+wG2Xmi1lk7zH8ezr9BMCgYEA0gfk
-      EhgcmPH8Z5cU3YYwOdt6HSJOM0OyN4k/5gnkv+HYVoJTj02gkrJmLr+mi1ugKj46
-      7huYO9TVnrKP21tmbaSv1dp5hS3letVRIxSloEtVGXmmdvJvBRzDWos+G+KcvADi
-      fFCz6w8v9NmO40CB7y/3SxTmSiSxDQeoi9LhDBkCgYEAsPgMWm25sfOnkY2NNUIv
-      wT8bAlHlHQT2d8zx5H9NttBpR3P0ShJhuF8N0sNthSQ7ULrIN5YGHYcUH+DyLAWU
-      TuomP3/kfa+xL7vUYb269tdJEYs4AkoppxBySoz8qenqpz422D0G8M6TpIS5Y5Qi
-      GMrQ6uLl21YnlpiCaFOfSQMCgYEAmZxj1kgEQmhZrnn1LL/D7czz1vMMNrpAUhXz
-      wg9iWmSXkU3oR1sDIceQrIhHCo2M6thwyU0tXjUft93pEQocM/zLDaGoVxtmRxxV
-      J08mg8IVD3jFoyFUyWxsBIDqgAKRl38eJsXvkO+ep3mm49Z+Ma3nM+apN3j2dQ0w
-      3HLzXaECgYBFLMEAboVFwi5+MZjGvqtpg2PVTisfuJy2eYnPwHs+AXUgi/xRNFjI
-      YHEa7UBPb5TEPSzWImQpETi2P5ywcUYL1EbN/nqPWmjFnat8wVmJtV4sUpJhubF4
-      Vqm9LxIWc1uQ1q1HDCejRIxIN3aSH+wgRS3Kcj8kCTIoXd1aERb04g==
-      -----END RSA PRIVATE KEY-----
-    '';
+    <link linkend="opt-services.gitlab.secrets.dbFile">dbFile</link> = "/var/keys/gitlab/db";
+    <link linkend="opt-services.gitlab.secrets.secretFile">secretFile</link> = "/var/keys/gitlab/secret";
+    <link linkend="opt-services.gitlab.secrets.otpFile">otpFile</link> = "/var/keys/gitlab/otp";
+    <link linkend="opt-services.gitlab.secrets.jwsFile">jwsFile</link> = "/var/keys/gitlab/jws";
   };
   <link linkend="opt-services.gitlab.extraConfig">extraConfig</link> = {
     gitlab = {
@@ -113,12 +85,16 @@ services.gitlab = {
   </para>
 
   <para>
-   If you're setting up a new Gitlab instance, generate new secrets. You for
-   instance use <literal>tr -dc A-Za-z0-9 &lt; /dev/urandom | head -c
-   128</literal> to generate a new secret. Gitlab encrypts sensitive data
-   stored in the database. If you're restoring an existing Gitlab instance, you
-   must specify the secrets secret from <literal>config/secrets.yml</literal>
-   located in your Gitlab state folder.
+   If you're setting up a new Gitlab instance, generate new
+   secrets. You for instance use <literal>tr -dc A-Za-z0-9 &lt;
+   /dev/urandom | head -c 128 &gt; /var/keys/gitlab/db</literal> to
+   generate a new db secret. Make sure the files can be read by, and
+   only by, the user specified by <link
+   linkend="opt-services.gitlab.user">services.gitlab.user</link>. Gitlab
+   encrypts sensitive data stored in the database. If you're restoring
+   an existing Gitlab instance, you must specify the secrets secret
+   from <literal>config/secrets.yml</literal> located in your Gitlab
+   state folder.
   </para>
 
   <para>
diff --git a/nixos/modules/services/search/kibana.nix b/nixos/modules/services/search/kibana.nix
index 75871a9df949f..43a63aa8fdc2a 100644
--- a/nixos/modules/services/search/kibana.nix
+++ b/nixos/modules/services/search/kibana.nix
@@ -9,7 +9,7 @@ let
   lt6_6 = builtins.compareVersions cfg.package.version "6.6" < 0;
 
   cfgFile = pkgs.writeText "kibana.json" (builtins.toJSON (
-    (filterAttrsRecursive (n: v: v != null) ({
+    (filterAttrsRecursive (n: v: v != null && v != []) ({
       server.host = cfg.listenAddress;
       server.port = cfg.port;
       server.ssl.certificate = cfg.cert;
diff --git a/nixos/modules/services/torrent/deluge.nix b/nixos/modules/services/torrent/deluge.nix
index e1c5e052a12f7..0c72505395ddb 100644
--- a/nixos/modules/services/torrent/deluge.nix
+++ b/nixos/modules/services/torrent/deluge.nix
@@ -178,6 +178,7 @@ in {
       "d '${cfg.dataDir}/.config' 0770 ${cfg.user} ${cfg.group}"
       "d '${cfg.dataDir}/.config/deluge' 0770 ${cfg.user} ${cfg.group}"
     ]
+    ++ optional (cfg.config ? download_location)
       "d '${cfg.config.download_location}' 0770 ${cfg.user} ${cfg.group}"
     ++ optional (cfg.config ? torrentfiles_location)
       "d '${cfg.config.torrentfiles_location}' 0770 ${cfg.user} ${cfg.group}"
diff --git a/nixos/tests/gitlab.nix b/nixos/tests/gitlab.nix
index 29978824870c5..be0b3c8746a99 100644
--- a/nixos/tests/gitlab.nix
+++ b/nixos/tests/gitlab.nix
@@ -29,44 +29,14 @@ import ./make-test.nix ({ pkgs, lib, ...} : with lib; {
 
       services.gitlab = {
         enable = true;
-        databasePassword = "dbPassword";
-        inherit initialRootPassword;
+        databasePasswordFile = pkgs.writeText "dbPassword" "xo0daiF4";
+        initialRootPasswordFile = pkgs.writeText "rootPassword" initialRootPassword;
         smtp.enable = true;
         secrets = {
-          secret = "secret";
-          otp = "otpsecret";
-          db = "dbsecret";
-
-          # nix-shell -p openssl --run "openssl genrsa 2048"
-          jws = ''
-            -----BEGIN RSA PRIVATE KEY-----
-            MIIEpAIBAAKCAQEA13/qEio76OWUtWO0WIz9lWnsTWOU8Esv4sQHDq9PCEFsLt21
-            PAXrlWhLjjWcxGfsrDwnh7YErGHYL62BMSxMdFJolaknlQK/O/V8UETDe45VoHM+
-            Znk270RfUcfYFgiihnXUZXVmL0om9TsQSk646wCcjCY9LxtxUyKNhvT7KjgYw2aX
-            z34aw7M+Js3T2p1TjZPSC82GtmtKkJEKFMi5EjprLTDE7EdcUzr9Xuw+kQ+gRm9k
-            7FE+JQqSoprwE3Q0v2OAn3UhLMgg0gNFRnsc5l6IAshDzV+H22RPqKKlJjVjjfPY
-            0TQSvYLVApigHbDPH0BoCXfjFfQazbbP3OUHrwIDAQABAoIBAQCMU+tkcMQaYIV5
-            qLdjgkwO467QpivyXcOM8wF1eosIYTHFQvIlZ+WEoSmyLQ8shlADyBgls01Pw1c3
-            lNAv6RzQEmmwKzpvOh61OKH+0whIiOMRXHoh2IUBQZCgfHYlwvGyhUAN4WjtGmhM
-            AG4XNTQNM5S9Xpkw97nP3Qwz+YskbbkrfqtCEVy9ro+4nhbjqPsuO3adbnkva4zR
-            cyurRhrHgHU6LPjn5NHnHH4qw2faY2oAsL8pmpkTbO5IqWDvOcbjNfjVPgVoq26O
-            bbaa1qs4nmc80qQgMjRPJef535xyf3eLsSlDvpf6O8sPrJzVR1zaqEqixpQCZDac
-            +kRiSBrhAoGBAOwHiq0PuyJh6VzBu7ybqX6+gF/wA4Jkwzx6mbfaBgurvU1aospp
-            kisIonAkxSbxllZMnjbkShZEdATYKeT9o5NEhnU4YnHfc5bJZbiWOZAzYGLcY7g8
-            vDQ31pBItyY4pFgPbSpNlbUvUsoPVJ45RasRADDTNCzMzdjFQQXst2V9AoGBAOm7
-            sSpzYfFPLEAhieAkuhtbsX58Boo46djiKVfzGftfp6F9aHTOfzGORU5jrZ16mSbS
-            qkkC6BEFrATX2051dzzXC89fWoJYALrsffE5I3KlKXsCAWSnCP1MMxOfH+Ls61Mr
-            7pK/LKfvJt53mUH4jIdbmmFUDwbg18oBEH+x9PmbAoGAS/+JqXu9N67rIxDGUE6W
-            3tacI0f2+U9Uhe67/DTZaXyc8YFTlXU0uWKIWy+bw5RaYeM9tlL/f/f+m2i25KK+
-            vrZ7zNag7CWU5GJovGyykDnauTpZaYM03mN0VPT08/uc/zXIYqyknbhlIeaZynCK
-            fDB3LUF0NVCknz20WCIGU0kCgYEAkxY0ZXx61Dp4pFr2wwEZxQGs7uXpz64FKyEX
-            12r6nMATY4Lh6y/Px0W6w5vis8lk+5Ny6cNUevHQ0LNuJS+yu6ywl+1vrbrnqroM
-            f3LvpcPeGLSoX8jl1VDQi7aFgG6LoKly1xJLbdsH4NPutB9PgBbbTghx9GgmI88L
-            rPA2M6UCgYBOmkYJocNgxg6B1/n4Tb9fN1Q/XuJrFDE6NxVUoke+IIyMPRH7FC3m
-            VMYzu+b7zTVJjaBb1cmJemxl/xajziWDofJYPefhdbOVU7HXtmJFY0IG3pVxU1zW
-            3bmDj5QAtCUDpuuNa6GEIT0YR4+D/V7o3DmlZ0tVIwKJmVJoQ2f5dw==
-            -----END RSA PRIVATE KEY-----
-          '';
+          secretFile = pkgs.writeText "secret" "Aig5zaic";
+          otpFile = pkgs.writeText "otpsecret" "Riew9mue";
+          dbFile = pkgs.writeText "dbsecret" "we2quaeZ";
+          jwsFile = pkgs.runCommand "oidcKeyBase" {} "${pkgs.openssl}/bin/openssl genrsa 2048 > $out";
         };
       };
     };
diff --git a/pkgs/applications/audio/strawberry/default.nix b/pkgs/applications/audio/strawberry/default.nix
index 60da75d3c7ed7..83455460123cb 100644
--- a/pkgs/applications/audio/strawberry/default.nix
+++ b/pkgs/applications/audio/strawberry/default.nix
@@ -14,6 +14,7 @@
 , libpthreadstubs
 , libtasn1
 , libXdmcp
+, ninja
 , pcre
 , protobuf
 , sqlite
@@ -72,15 +73,20 @@ mkDerivation rec {
     gstreamer
     gst-plugins-base
     gst-plugins-good
+    gst-plugins-ugly
   ])
   ++ lib.optional withVlc vlc;
 
-  nativeBuildInputs = [ cmake pkgconfig qttools ];
+  nativeBuildInputs = [ cmake ninja pkgconfig qttools ];
 
   cmakeFlags = [
     "-DUSE_SYSTEM_TAGLIB=ON"
   ];
 
+  postInstall = ''
+    qtWrapperArgs+=(--prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0")
+  '';
+
   meta = with lib; {
     description = "Music player and music collection organizer";
     license = licenses.gpl2;
diff --git a/pkgs/applications/editors/kdevelop5/kdev-php.nix b/pkgs/applications/editors/kdevelop5/kdev-php.nix
index 54e99b35b5eb1..e367b586f3072 100644
--- a/pkgs/applications/editors/kdevelop5/kdev-php.nix
+++ b/pkgs/applications/editors/kdevelop5/kdev-php.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "kdev-php";
-  version = "5.4.1";
+  version = "5.4.2";
 
   src = fetchurl {
     url = "https://github.com/KDE/${pname}/archive/v${version}.tar.gz";
-    sha256 = "07j06k2f5rbwgknwcbj70wwn831a54is4kiwlpfd4la2c05slmy5";
+    sha256 = "1ilazq2y671wifcrh7pa0zf9yqymqxwj1m2kd389ik2p6wm68jx8";
   };
 
   nativeBuildInputs = [ cmake extra-cmake-modules ];
diff --git a/pkgs/applications/editors/kdevelop5/kdev-python.nix b/pkgs/applications/editors/kdevelop5/kdev-python.nix
index 8763905fbfd8d..1052c5e1ba342 100644
--- a/pkgs/applications/editors/kdevelop5/kdev-python.nix
+++ b/pkgs/applications/editors/kdevelop5/kdev-python.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "kdev-python";
-  version = "5.4.1";
+  version = "5.4.2";
 
   src = fetchurl {
     url = "https://github.com/KDE/${pname}/archive/v${version}.tar.gz";
-    sha256 = "1dazd77bkjs11h318q4ia6ijk0d0s04v0zm8lwqlgcj271sqrfqb";
+    sha256 = "1nnspa1mixdb5z0a8m4nbpsk6c4s81iwrirhrl7091hsw02bsx3f";
   };
 
   cmakeFlags = [
diff --git a/pkgs/applications/editors/kdevelop5/kdevelop.nix b/pkgs/applications/editors/kdevelop5/kdevelop.nix
index be80587ef3a60..4c2011b5b0356 100644
--- a/pkgs/applications/editors/kdevelop5/kdevelop.nix
+++ b/pkgs/applications/editors/kdevelop5/kdevelop.nix
@@ -9,11 +9,11 @@
 
 mkDerivation rec {
   pname = "kdevelop";
-  version = "5.4.1";
+  version = "5.4.2";
 
   src = fetchurl {
     url = "mirror://kde/stable/${pname}/${version}/src/${pname}-${version}.tar.xz";
-    sha256 = "12iqgmhaxm9q085h50dzkswcmsp02jzm4jjgrhkx4jlzmf4w4jb8";
+    sha256 = "1i665m4jd1r5bl77pcfybpn9szxzccrajs4m0prqwhlj93d57qjj";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/lutris/default.nix b/pkgs/applications/misc/lutris/default.nix
index 5435080e8318c..c9ea146f063b6 100644
--- a/pkgs/applications/misc/lutris/default.nix
+++ b/pkgs/applications/misc/lutris/default.nix
@@ -31,13 +31,13 @@ let
 
 in buildPythonApplication rec {
   pname = "lutris-original";
-  version = "0.5.2.1";
+  version = "0.5.3";
 
   src = fetchFromGitHub {
     owner = "lutris";
     repo = "lutris";
     rev = "v${version}";
-    sha256 = "023yqnzmnkfpq21r6ky6jzwbjxjcw1a5zqrrdl6fwwlr78fdhgpv";
+    sha256 = "0n6xa3pnwvsvfipinrkbhxwjzfbw2cjpc9igv97nffcmpydmn5xv";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
index c5f4468df5aa6..f217084585a24 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@@ -58,7 +58,13 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "signal-desktop";
-  version = "1.27.2";
+  version = "1.27.2"; # Please backport all updates to the stable channel.
+  # All releases have a limited lifetime and "expire" 90 days after the release.
+  # When releases "expire" the application becomes unusable until an update is
+  # applied. The expiration date for the current release can be extracted with:
+  # $ grep -a "^{\"buildExpiration" "${signal-desktop}/libexec/resources/app.asar"
+  # (Alternatively we could try to patch the asar archive, but that requires a
+  # few additional steps and might not be the best idea.)
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
diff --git a/pkgs/applications/networking/irc/weechat/default.nix b/pkgs/applications/networking/irc/weechat/default.nix
index 31f2a7e6a2763..ec806c86ebd22 100644
--- a/pkgs/applications/networking/irc/weechat/default.nix
+++ b/pkgs/applications/networking/irc/weechat/default.nix
@@ -27,12 +27,12 @@ let
   in
     assert lib.all (p: p.enabled -> ! (builtins.elem null p.buildInputs)) plugins;
     stdenv.mkDerivation rec {
-      version = "2.5";
+      version = "2.6";
       pname = "weechat";
 
       src = fetchurl {
         url = "https://weechat.org/files/src/weechat-${version}.tar.bz2";
-        sha256 = "14giv8j1phmpg3i9whx45nmskan501lwcq352ps9z52rkja2qxsc";
+        sha256 = "1narazk28m7lmn1vqi7bhyvnr8apjrmaa4w1hbadn64hwr8ya1hb";
       };
 
       outputs = [ "out" "man" ] ++ map (p: p.name) enabledPlugins;
diff --git a/pkgs/applications/version-management/git-and-tools/hub/default.nix b/pkgs/applications/version-management/git-and-tools/hub/default.nix
index f1950923415f4..cd38be2b977aa 100644
--- a/pkgs/applications/version-management/git-and-tools/hub/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/hub/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "hub";
-  version = "2.12.3";
+  version = "2.12.4";
 
   goPackagePath = "github.com/github/hub";
 
@@ -13,7 +13,7 @@ buildGoPackage rec {
     owner = "github";
     repo = pname;
     rev = "v${version}";
-    sha256 = "13l4nc3k6vl9x1x0153mwi351j3z266wx0fp7xw2851avrgkk9zg";
+    sha256 = "1d4cn4pgx520psrfac92h3m7azxnpj1plrrqmxryar85f3y363bq";
   };
 
   nativeBuildInputs = [ groff utillinux ];
diff --git a/pkgs/applications/version-management/gitea/default.nix b/pkgs/applications/version-management/gitea/default.nix
index 00f344597bb47..9c7d83a05fd99 100644
--- a/pkgs/applications/version-management/gitea/default.nix
+++ b/pkgs/applications/version-management/gitea/default.nix
@@ -8,13 +8,13 @@ with stdenv.lib;
 
 buildGoPackage rec {
   pname = "gitea";
-  version = "1.9.2";
+  version = "1.9.3";
 
   src = fetchFromGitHub {
     owner = "go-gitea";
     repo = "gitea";
     rev = "v${version}";
-    sha256 = "1i7h6scycwzil87fcx1a19w5pl0986g5ax7y030w0wgmrq3zj53a";
+    sha256 = "0g6ch85dq4vazxnr6g78wgqrnfa955395y1zws0a50h0wfxpdjis";
     # Required to generate the same checksum on MacOS due to unicode encoding differences
     # More information: https://github.com/NixOS/nixpkgs/pull/48128
     extraPostFetch = ''
@@ -62,7 +62,7 @@ buildGoPackage rec {
 
   meta = {
     description = "Git with a cup of tea";
-    homepage = https://gitea.io;
+    homepage = "https://gitea.io";
     license = licenses.mit;
     maintainers = with maintainers; [ disassembler kolaente ];
   };
diff --git a/pkgs/applications/window-managers/i3/status.nix b/pkgs/applications/window-managers/i3/status.nix
index 17b147da1b2f2..e963259b62474 100644
--- a/pkgs/applications/window-managers/i3/status.nix
+++ b/pkgs/applications/window-managers/i3/status.nix
@@ -1,21 +1,25 @@
-{ fetchurl, stdenv, libconfuse, yajl, alsaLib, libpulseaudio, libnl, pkgconfig
-  }:
+{ fetchurl, stdenv, libconfuse, yajl, alsaLib, libpulseaudio, libnl, pkgconfig, asciidoc, xmlto, docbook_xml_dtd_45, docbook_xsl }:
 
 stdenv.mkDerivation rec {
-  name = "i3status-2.12";
+  name = "i3status-2.13";
 
   src = fetchurl {
     url = "https://i3wm.org/i3status/${name}.tar.bz2";
-    sha256 = "06krpbijv4yi33nypg6qcn4hilcrdyarsdpd9fmr2cq46qaqiikg";
+    sha256 = "0rhlzb96mw64z2jnhwz9nibc7pxg549626lz5642xxk5hpzwk2ff";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig asciidoc xmlto docbook_xml_dtd_45 docbook_xsl ];
   buildInputs = [ libconfuse yajl alsaLib libpulseaudio libnl ];
 
   makeFlags = [ "all" "PREFIX=$(out)" ];
 
+  # This hack is needed because for unknown reasons configure generates a broken makefile on the 2.13 release under nixos
+  preBuild = ''
+    sed -i -e 's/\$(TEST_LOGS) \$(TEST_LOGS/\$(TEST_LOGS)/g' Makefile
+  '';
+
   meta = {
-    description = "A tiling window manager";
+    description = "Generates a status line for i3bar, dzen2, xmobar or lemonbar";
     homepage = https://i3wm.org;
     maintainers = [ ];
     license = stdenv.lib.licenses.bsd3;
diff --git a/pkgs/desktops/plasma-5/fetch.sh b/pkgs/desktops/plasma-5/fetch.sh
index 4efd493a3dd7a..e2e6da6f07c28 100644
--- a/pkgs/desktops/plasma-5/fetch.sh
+++ b/pkgs/desktops/plasma-5/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/plasma/5.16.4/ )
+WGET_ARGS=( https://download.kde.org/stable/plasma/5.16.5/ )
diff --git a/pkgs/desktops/plasma-5/srcs.nix b/pkgs/desktops/plasma-5/srcs.nix
index 21dd5c36d78f8..f299ed953de27 100644
--- a/pkgs/desktops/plasma-5/srcs.nix
+++ b/pkgs/desktops/plasma-5/srcs.nix
@@ -3,363 +3,363 @@
 
 {
   bluedevil = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/bluedevil-5.16.4.tar.xz";
-      sha256 = "36eaff3da49104fb4ca8de32c2cd42657af7cde94f54c95bacf5abd6c1d39521";
-      name = "bluedevil-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/bluedevil-5.16.5.tar.xz";
+      sha256 = "60ac3471d30cb113b1959eacdaa1f4898f04f779f94a35dbca00993cda4ea464";
+      name = "bluedevil-5.16.5.tar.xz";
     };
   };
   breeze = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/breeze-5.16.4.tar.xz";
-      sha256 = "84fea0c31a41521983698ad2aed603b5e2c6e4f6e8723e2c64c66c37eb2a5395";
-      name = "breeze-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/breeze-5.16.5.tar.xz";
+      sha256 = "09225021a2cf396e74cabe692b0a5dcf9a12f0b47f02fb14df6ccc9db01f2e6b";
+      name = "breeze-5.16.5.tar.xz";
     };
   };
   breeze-grub = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/breeze-grub-5.16.4.tar.xz";
-      sha256 = "c36b2183fff7d559ae944881443e0caa03c63bcc81af9f6b21b722109d2e34db";
-      name = "breeze-grub-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/breeze-grub-5.16.5.tar.xz";
+      sha256 = "ce73297350e7b79b04aa8ba44594e8eca2d37c0342eb331bd5d31679f3887878";
+      name = "breeze-grub-5.16.5.tar.xz";
     };
   };
   breeze-gtk = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/breeze-gtk-5.16.4.tar.xz";
-      sha256 = "8c954a8754bc75b2d8edff70a7b322c559da6e23dc75e1ed616ac926fbe186eb";
-      name = "breeze-gtk-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/breeze-gtk-5.16.5.tar.xz";
+      sha256 = "d9849ecf6c2fc85fde76912410ab36c46ca65b96d80b4e51819ca35015a88098";
+      name = "breeze-gtk-5.16.5.tar.xz";
     };
   };
   breeze-plymouth = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/breeze-plymouth-5.16.4.tar.xz";
-      sha256 = "7556c8f6bff771f3439036f843309b45594c5e903fc11a3275cc2c38346dec9f";
-      name = "breeze-plymouth-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/breeze-plymouth-5.16.5.tar.xz";
+      sha256 = "bb10d2f0185181e6f2fe8e3b85415dfcce6069595e0074b182688c6f567dd0b0";
+      name = "breeze-plymouth-5.16.5.tar.xz";
     };
   };
   discover = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/discover-5.16.4.tar.xz";
-      sha256 = "0e07a49d3ee93434452d69330b11653546a2104601ec08518be111ba7967f1b0";
-      name = "discover-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/discover-5.16.5.tar.xz";
+      sha256 = "26c47a5c0f59a31f37da85e894a926c76805b66f91dde8ba6d2de8015842d5c1";
+      name = "discover-5.16.5.tar.xz";
     };
   };
   drkonqi = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/drkonqi-5.16.4.tar.xz";
-      sha256 = "9d030a59a6d1d732241f8c54a54291ac60584d542ea0b891ca4b2bcb958bd51f";
-      name = "drkonqi-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/drkonqi-5.16.5.tar.xz";
+      sha256 = "b4ae1518108c2d3ccbc533708801b52b83b7e9efd6eed9f1ee9d67936b9e78ff";
+      name = "drkonqi-5.16.5.tar.xz";
     };
   };
   kactivitymanagerd = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/kactivitymanagerd-5.16.4.tar.xz";
-      sha256 = "a287fc9624390c8493a35a5440e2161d1bb67252b6986231acb6268440bb4770";
-      name = "kactivitymanagerd-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/kactivitymanagerd-5.16.5.tar.xz";
+      sha256 = "e35dbf7aae8a7b7f21b2304935cad96881af558a7c9d947f0114093038b1c4bc";
+      name = "kactivitymanagerd-5.16.5.tar.xz";
     };
   };
   kde-cli-tools = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/kde-cli-tools-5.16.4.tar.xz";
-      sha256 = "56c7c2566217704a9d613757767c3b8ee8d1bc4601b9414a44acb50aaaaedc0d";
-      name = "kde-cli-tools-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/kde-cli-tools-5.16.5.tar.xz";
+      sha256 = "bc82b159d3c9a23f0ecb47a8314b645041b01692887a3be0ef0582d54f926de2";
+      name = "kde-cli-tools-5.16.5.tar.xz";
     };
   };
   kdecoration = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/kdecoration-5.16.4.tar.xz";
-      sha256 = "aa77507dcf357243cca9002764f8c8d1c8404d7e5b7249ad0d0f900f0a47ace4";
-      name = "kdecoration-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/kdecoration-5.16.5.tar.xz";
+      sha256 = "2b8c7b7cf114d0eff4ec842009cda264d8cf1254ec4bf65868b6d26f263829bb";
+      name = "kdecoration-5.16.5.tar.xz";
     };
   };
   kde-gtk-config = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/kde-gtk-config-5.16.4.tar.xz";
-      sha256 = "c271b1caebac0837483af7ae11d2e4786a7770ff85753f1a3da4c8d28681111c";
-      name = "kde-gtk-config-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/kde-gtk-config-5.16.5.tar.xz";
+      sha256 = "f78abf129aaa7afac2c7a71105b36b9553a975bbcb89ec65a0166099d1cca8c1";
+      name = "kde-gtk-config-5.16.5.tar.xz";
     };
   };
   kdeplasma-addons = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/kdeplasma-addons-5.16.4.tar.xz";
-      sha256 = "4c0884dcb8413fa836d7e390b1c12fc71127c0e5e6fa278a338c253d1539f4a1";
-      name = "kdeplasma-addons-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/kdeplasma-addons-5.16.5.tar.xz";
+      sha256 = "a4737a54b75143053a9f8a5bc28c608f843c524872c665d4e5a65bd2853e1e00";
+      name = "kdeplasma-addons-5.16.5.tar.xz";
     };
   };
   kgamma5 = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/kgamma5-5.16.4.tar.xz";
-      sha256 = "18c01c6a9d73f2450da24ac7a52c00b9d355a1ba41bd346eb71fbe271de85f46";
-      name = "kgamma5-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/kgamma5-5.16.5.tar.xz";
+      sha256 = "838fabf4312f022ee3df5bba940c0c73e26260cfee39235c1ba8da8a2e61bfa0";
+      name = "kgamma5-5.16.5.tar.xz";
     };
   };
   khotkeys = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/khotkeys-5.16.4.tar.xz";
-      sha256 = "a8646ab20cd067a515d4a9318c814760be0030f27856f155edf11920caeddd0d";
-      name = "khotkeys-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/khotkeys-5.16.5.tar.xz";
+      sha256 = "e7b866b5249ff7c5860a5a222dca79691ca1f09af176f786021fbbadbd718c8c";
+      name = "khotkeys-5.16.5.tar.xz";
     };
   };
   kinfocenter = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/kinfocenter-5.16.4.tar.xz";
-      sha256 = "30e4df2d641c4faa385a718c772d893900eca99591ffee5787d6563fe5130426";
-      name = "kinfocenter-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/kinfocenter-5.16.5.tar.xz";
+      sha256 = "e3bbc5e2baedf35dc8750c99e18c115b651f2665218a105c08177bc5250eb9b1";
+      name = "kinfocenter-5.16.5.tar.xz";
     };
   };
   kmenuedit = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/kmenuedit-5.16.4.tar.xz";
-      sha256 = "f749ca062d9c7bfd2033c4016e8a3dcc9f849f83f941dd9a60fd5b0232d023a2";
-      name = "kmenuedit-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/kmenuedit-5.16.5.tar.xz";
+      sha256 = "8e95b81b910e5e78689fc7d4427c813ba7d39426df24cf8606adb850913a19a4";
+      name = "kmenuedit-5.16.5.tar.xz";
     };
   };
   kscreen = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/kscreen-5.16.4.tar.xz";
-      sha256 = "40c29ad2236459a267eed3cad4a6fc64b5e3f12df8567fcf8869ba770c2e2328";
-      name = "kscreen-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/kscreen-5.16.5.tar.xz";
+      sha256 = "ce35f554014cee819767180f0c9381d539e497edfb9c290b279fa78e9dea4bb0";
+      name = "kscreen-5.16.5.tar.xz";
     };
   };
   kscreenlocker = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/kscreenlocker-5.16.4.tar.xz";
-      sha256 = "92a858f1f4bd6f209f328ca6456dfadc6b542e2a1e3d04ecdcc70f70c1cc2f6f";
-      name = "kscreenlocker-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/kscreenlocker-5.16.5.tar.xz";
+      sha256 = "5ed6fdeac9aaba014edf67c5f782fc210d58310d083afaa589d0ff1bb3e8e02d";
+      name = "kscreenlocker-5.16.5.tar.xz";
     };
   };
   ksshaskpass = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/ksshaskpass-5.16.4.tar.xz";
-      sha256 = "e3ff91e5c160b8e83b48215fca5d70f4baeef95b6c3b32e8cfc749183b0ec97c";
-      name = "ksshaskpass-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/ksshaskpass-5.16.5.tar.xz";
+      sha256 = "78eaa38ebbf888a8905e9385173e7161335041d6d07720283ce6f3fa06426a33";
+      name = "ksshaskpass-5.16.5.tar.xz";
     };
   };
   ksysguard = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/ksysguard-5.16.4.tar.xz";
-      sha256 = "10abf3bfa676275b6fded5e49979466a011e0552b9357c1b8923f01184c029d5";
-      name = "ksysguard-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/ksysguard-5.16.5.tar.xz";
+      sha256 = "5558977389cb1fac4a5ce52c9430b27d9d1ee92705ae1995d92bed5340477282";
+      name = "ksysguard-5.16.5.tar.xz";
     };
   };
   kwallet-pam = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/kwallet-pam-5.16.4.tar.xz";
-      sha256 = "7332dd9729c55f4b24260b3ec1266f72284f834eed66ce76badd4ac5af3dd429";
-      name = "kwallet-pam-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/kwallet-pam-5.16.5.tar.xz";
+      sha256 = "4a12a8ed51973f9ea318a39a699523bcc99ae4e1cac932fccd19dedd45e758a8";
+      name = "kwallet-pam-5.16.5.tar.xz";
     };
   };
   kwayland-integration = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/kwayland-integration-5.16.4.tar.xz";
-      sha256 = "f15ae33af1d9ff999ec45d00752f202242f71fc022ae72b9522e5bf3a20edace";
-      name = "kwayland-integration-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/kwayland-integration-5.16.5.tar.xz";
+      sha256 = "63724ecfb6db053ee949273979b393192309dbeed45b59bc193a605f90232282";
+      name = "kwayland-integration-5.16.5.tar.xz";
     };
   };
   kwin = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/kwin-5.16.4.tar.xz";
-      sha256 = "71b96f1efef0b3f4974900373285a08d425a63628404fe9e89c27f61119383e6";
-      name = "kwin-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/kwin-5.16.5.tar.xz";
+      sha256 = "7ff0e114e323ff7e10d78a157f8242b1d3cfa03967898d9e3fd3c039b7c9918b";
+      name = "kwin-5.16.5.tar.xz";
     };
   };
   kwrited = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/kwrited-5.16.4.tar.xz";
-      sha256 = "c3011ee1c7a431b25797e12fa0b16e6d92277c8fe5dc1e656121a135ad156c0f";
-      name = "kwrited-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/kwrited-5.16.5.tar.xz";
+      sha256 = "4b122099b0a362fc409b50b7523689ba8a112508dad26f58753c6b648e7c5313";
+      name = "kwrited-5.16.5.tar.xz";
     };
   };
   libkscreen = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/libkscreen-5.16.4.tar.xz";
-      sha256 = "f20f33a2f32b3db39e94ca9d10e240591650357d03c1a2f8eb6c5faa4d1bf723";
-      name = "libkscreen-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/libkscreen-5.16.5.tar.xz";
+      sha256 = "fd2d1e849315ac745ecfe757d6b2c5cc6486e0be5397f686dae3916c0252c938";
+      name = "libkscreen-5.16.5.tar.xz";
     };
   };
   libksysguard = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/libksysguard-5.16.4.tar.xz";
-      sha256 = "b9a8166bf808a54dd80eb8f760047c63989f1f10a9a7f649c8298c9a5031368f";
-      name = "libksysguard-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/libksysguard-5.16.5.tar.xz";
+      sha256 = "f09b99737a937df890ecdd2a33720b6cba3c79fc8bc17ef1470572748a6e1976";
+      name = "libksysguard-5.16.5.tar.xz";
     };
   };
   milou = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/milou-5.16.4.tar.xz";
-      sha256 = "de9addbc504135839b1735742938d340cb191827606aa390f4b6ce1625c1ed89";
-      name = "milou-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/milou-5.16.5.tar.xz";
+      sha256 = "bfcdba29262dda9f386ee99132053ad5751194b2df8219899fcbb0b3699afcd5";
+      name = "milou-5.16.5.tar.xz";
     };
   };
   oxygen = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/oxygen-5.16.4.tar.xz";
-      sha256 = "7ba8a18a0b44d2bf48c96679328f698a9bfd4d041724b960095fed67f228f2e1";
-      name = "oxygen-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/oxygen-5.16.5.tar.xz";
+      sha256 = "0e85dcd874d2e69aaa2d4eefc379289c7dd572437f53e42f1d6d260d97c2f8a2";
+      name = "oxygen-5.16.5.tar.xz";
     };
   };
   plasma-browser-integration = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/plasma-browser-integration-5.16.4.tar.xz";
-      sha256 = "a097b90dd47cdd01f6b7207cb9439c7f6e0ce68555272172f8b3b8e2086199ef";
-      name = "plasma-browser-integration-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/plasma-browser-integration-5.16.5.tar.xz";
+      sha256 = "99269c7e27fddb0c075bff28a5afba41298dc8d28297d69f35f6bc30f3af1d35";
+      name = "plasma-browser-integration-5.16.5.tar.xz";
     };
   };
   plasma-desktop = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/plasma-desktop-5.16.4.tar.xz";
-      sha256 = "990e93eed2753053ac732ce5d1d45e7c9a52daa660b41b0d48955428e4834344";
-      name = "plasma-desktop-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/plasma-desktop-5.16.5.tar.xz";
+      sha256 = "49dc4c9eff5742eb52fc0d12c139c194eda837945389cd09f498a0c4c352a20f";
+      name = "plasma-desktop-5.16.5.tar.xz";
     };
   };
   plasma-integration = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/plasma-integration-5.16.4.tar.xz";
-      sha256 = "d4c5022ea91f9727cfebab821cb6b8e7b52671a6508cd7450e05bf51e248452d";
-      name = "plasma-integration-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/plasma-integration-5.16.5.tar.xz";
+      sha256 = "635f109e7b59bb440c6be0c7a4baae70d2f44e659ab0522e170693b664e6d709";
+      name = "plasma-integration-5.16.5.tar.xz";
     };
   };
   plasma-nm = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/plasma-nm-5.16.4.tar.xz";
-      sha256 = "2da834873d4fa471ad87ee8ce18a871dfb2acdf0bdc0b764789e8e26ebc2ca09";
-      name = "plasma-nm-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/plasma-nm-5.16.5.tar.xz";
+      sha256 = "b519429bd784ff2ede0bf10e1e943822ef08ea5cf85e901363fda36d32907460";
+      name = "plasma-nm-5.16.5.tar.xz";
     };
   };
   plasma-pa = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/plasma-pa-5.16.4.tar.xz";
-      sha256 = "9b166e11f7115576181c17f0ced51b9a7ec689334d4b15ebb55d4e6e7ff6cbd4";
-      name = "plasma-pa-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/plasma-pa-5.16.5.tar.xz";
+      sha256 = "e029563d50cc6266a4a3e22574c33fef4670e1aaab18630eb30769e2167acc96";
+      name = "plasma-pa-5.16.5.tar.xz";
     };
   };
   plasma-sdk = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/plasma-sdk-5.16.4.tar.xz";
-      sha256 = "ce8152ad6044e2cf430834bf97bb4542e69e168a4b7350e313d148a9bd3b9403";
-      name = "plasma-sdk-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/plasma-sdk-5.16.5.tar.xz";
+      sha256 = "1b05f0501309099f241ebae857c24b31bc4e61fde8bfc33e854d3a1dd3d37385";
+      name = "plasma-sdk-5.16.5.tar.xz";
     };
   };
   plasma-tests = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/plasma-tests-5.16.4.tar.xz";
-      sha256 = "9e0f8fcef080fc1b0ffae01f6b3caa17eccac27445e312243221fcace56d1097";
-      name = "plasma-tests-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/plasma-tests-5.16.5.tar.xz";
+      sha256 = "236a83c2caa99801b6db1debce53a6c7390087115899410a8139ad3b7268b7f7";
+      name = "plasma-tests-5.16.5.tar.xz";
     };
   };
   plasma-vault = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/plasma-vault-5.16.4.tar.xz";
-      sha256 = "8d01b80079477fd7ea48a4cc3ff59728ae7dac3a5f6e552092dd5e67d72148f6";
-      name = "plasma-vault-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/plasma-vault-5.16.5.tar.xz";
+      sha256 = "2bb40a80c35f3eaedc729013a8b6b76641cc74eca4fd171f1cda99237f83198c";
+      name = "plasma-vault-5.16.5.tar.xz";
     };
   };
   plasma-workspace = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/plasma-workspace-5.16.4.tar.xz";
-      sha256 = "5cd9366ef3d0b68159d9dee2f14886d1f81d1ccf7aedceed1ae5cf8e32d243f1";
-      name = "plasma-workspace-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/plasma-workspace-5.16.5.tar.xz";
+      sha256 = "43364fe4e7ea10ad7b5b1d7af4f1baa1d8796b60692f2dfc0d58693f63e458ff";
+      name = "plasma-workspace-5.16.5.tar.xz";
     };
   };
   plasma-workspace-wallpapers = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/plasma-workspace-wallpapers-5.16.4.tar.xz";
-      sha256 = "052f6d978b1230706821f67574a7d053fadfb25de65227ffc8389a8570ac6003";
-      name = "plasma-workspace-wallpapers-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/plasma-workspace-wallpapers-5.16.5.tar.xz";
+      sha256 = "ff6e0eac42c540c72556439e6477fb78be2dab456386218813cce021f82d42d9";
+      name = "plasma-workspace-wallpapers-5.16.5.tar.xz";
     };
   };
   plymouth-kcm = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/plymouth-kcm-5.16.4.tar.xz";
-      sha256 = "cf9d3e6f14d012617cc8a5c3381295449e68b1b13209436b561417232d21863f";
-      name = "plymouth-kcm-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/plymouth-kcm-5.16.5.tar.xz";
+      sha256 = "db839c5fe9f6df882b95f436983c129cd553dd50e6cf1065c4410a91b20f1dcc";
+      name = "plymouth-kcm-5.16.5.tar.xz";
     };
   };
   polkit-kde-agent = {
-    version = "1-5.16.4";
+    version = "1-5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/polkit-kde-agent-1-5.16.4.tar.xz";
-      sha256 = "917b31f194fcf5d56d465bd4a3a1cc8d0a30e302be63b9048b1b85b6746b46a0";
-      name = "polkit-kde-agent-1-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/polkit-kde-agent-1-5.16.5.tar.xz";
+      sha256 = "6f7a17990d72bb25c93acae919b764f95ac226754209b2e177075fbe9251f95f";
+      name = "polkit-kde-agent-1-5.16.5.tar.xz";
     };
   };
   powerdevil = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/powerdevil-5.16.4.tar.xz";
-      sha256 = "40885869890366f7ea92946ed0f8d251546fb14228eddd2ad128e3be8f88d2ed";
-      name = "powerdevil-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/powerdevil-5.16.5.tar.xz";
+      sha256 = "ac868f31df8c6bcc6b1c850efa0640695ba698caabefcb21fc0b0c3405712139";
+      name = "powerdevil-5.16.5.tar.xz";
     };
   };
   sddm-kcm = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/sddm-kcm-5.16.4.tar.xz";
-      sha256 = "340034c5475d751c19c96a75445fa50877fad1c4de3422bc02f4b95e8f14bd68";
-      name = "sddm-kcm-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/sddm-kcm-5.16.5.tar.xz";
+      sha256 = "4220d18f1a04c767649bffee1aed6c2b2c12c60cd7d6ca6fabc3dbec1ec3f127";
+      name = "sddm-kcm-5.16.5.tar.xz";
     };
   };
   systemsettings = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/systemsettings-5.16.4.tar.xz";
-      sha256 = "73b78c3c5177aa3ba0ffe970a83cb8bea1ba8ac54420a6c8379d6e86cabda31e";
-      name = "systemsettings-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/systemsettings-5.16.5.tar.xz";
+      sha256 = "57944cf3f566cf5e25d5859f5716b2ad5dbd87de259f8d77efdfdd50a16fe1ec";
+      name = "systemsettings-5.16.5.tar.xz";
     };
   };
   user-manager = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/user-manager-5.16.4.tar.xz";
-      sha256 = "3dd29a6abf8c15014ed87a448b13190516e16d8dc3a67d56f05f62d1f2e1b745";
-      name = "user-manager-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/user-manager-5.16.5.tar.xz";
+      sha256 = "e9df3ec2718de68b0b46d0b86f993fe450b236e13dda6219f350121f08f4c468";
+      name = "user-manager-5.16.5.tar.xz";
     };
   };
   xdg-desktop-portal-kde = {
-    version = "5.16.4";
+    version = "5.16.5";
     src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/xdg-desktop-portal-kde-5.16.4.tar.xz";
-      sha256 = "3b8aa78451cfc97ef316f1632f6a255ccebbe383ec8389ffc74d44540fc05052";
-      name = "xdg-desktop-portal-kde-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/xdg-desktop-portal-kde-5.16.5.tar.xz";
+      sha256 = "4884652b642fb6e8db791a04e9d42b5fec53f28cc0f0d26f49eb2bdaaa1709df";
+      name = "xdg-desktop-portal-kde-5.16.5.tar.xz";
     };
   };
 }
diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index decf430d78f91..c4cca42309dbe 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -77,13 +77,6 @@ self: super: {
     hinotify = if pkgs.stdenv.isLinux then self.hinotify else self.fsnotify;
   };
 
-  # compatibility with servant-0.16.2. Remove with the next release
-  cachix = appendPatch super.cachix (pkgs.fetchpatch {
-    url = "https://github.com/cachix/cachix/commit/051679a99cd56e2497c0f05310035b6649129a13.patch";
-    sha256 = "198n5byp9mfiymgzpvyd42l6vqy6hfy9kdi7svfx7mcwsy7sg7kp";
-    stripLen = 1;
-  });
-
   # Fix test trying to access /home directory
   shell-conduit = overrideCabal super.shell-conduit (drv: {
     postPatch = "sed -i s/home/tmp/ test/Spec.hs";
@@ -1226,4 +1219,13 @@ self: super: {
   # https://github.com/elliottt/hsopenid/issues/15
   openid = markBroken super.openid;
 
+  # The test suite needs the packages's executables in $PATH to succeed.
+  arbtt = overrideCabal super.arbtt (drv: {
+    preCheck = ''
+      for i in $PWD/dist/build/*; do
+        export PATH="$i:$PATH"
+      done
+    '';
+  });
+
 } // import ./configuration-tensorflow.nix {inherit pkgs haskellLib;} self super
diff --git a/pkgs/development/haskell-modules/configuration-hackage2nix.yaml b/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
index 996120c6f1d0a..9cbc4c21aed5f 100644
--- a/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
@@ -3097,7 +3097,6 @@ broken-packages:
   - arbor-monad-metric
   - arbor-monad-metric-datadog
   - arbor-postgres
-  - arbtt
   - archiver
   - archlinux
   - archlinux-web
@@ -3598,7 +3597,6 @@ broken-packages:
   - cabin
   - cabocha
   - cached
-  - cachix
   - cacophony
   - caffegraph
   - cairo-core
@@ -5935,8 +5933,6 @@ broken-packages:
   - hmt-diagrams
   - hmumps
   - hnetcdf
-  - hnix
-  - hnix-store-remote
   - HNM
   - hnormalise
   - ho-rewriting
diff --git a/pkgs/development/haskell-modules/hackage-packages.nix b/pkgs/development/haskell-modules/hackage-packages.nix
index e963d1831890b..bb00b7c1fbabd 100644
--- a/pkgs/development/haskell-modules/hackage-packages.nix
+++ b/pkgs/development/haskell-modules/hackage-packages.nix
@@ -22515,8 +22515,8 @@ self: {
        pname = "active";
        version = "0.2.0.13";
        sha256 = "1yw029rh0gb63bhwwjynbv173mny14is4cyjkrlvzvxwb0fi96jx";
-       revision = "8";
-       editedCabalFile = "1j771jblfaygc3qf8iaw9b87yrqxhkq79mdi9zyhvlr2vcac362s";
+       revision = "9";
+       editedCabalFile = "1xq08xn26v3zi3fz1y5lhb1q2xv1d413wdg4pibi98n98nc2ypxz";
        libraryHaskellDepends = [
          base lens linear semigroupoids semigroups vector
        ];
@@ -23313,8 +23313,8 @@ self: {
      }:
      mkDerivation {
        pname = "aeson-injector";
-       version = "1.1.1.0";
-       sha256 = "04hg0vdrfb7x6qxwcifsayc6z5vhc1l96ahvswg8q5wddc00ypzp";
+       version = "1.1.2.0";
+       sha256 = "05506d6nkw7q924l2ww5mg1ahzs9122vj02mgscdh7g72n3krdd4";
        libraryHaskellDepends = [
          aeson base bifunctors deepseq hashable lens servant-docs swagger2
          text unordered-containers
@@ -28682,6 +28682,8 @@ self: {
        pname = "ansi-wl-pprint";
        version = "0.6.9";
        sha256 = "1b2fg8px98dzbaqyns10kvs8kn6cl1hdq5wb9saz40izrpkyicm7";
+       revision = "1";
+       editedCabalFile = "0bb5fzjjc00932pny1fql40dmpmikfqzbrbmpwr09bfw9aynvzgn";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [ ansi-terminal base ];
@@ -30458,8 +30460,6 @@ self: {
        ];
        description = "Automatic Rule-Based Time Tracker";
        license = stdenv.lib.licenses.gpl2;
-       hydraPlatforms = stdenv.lib.platforms.none;
-       broken = true;
      }) {};
 
   "arcgrid" = callPackage
@@ -31827,6 +31827,8 @@ self: {
        pname = "assoc";
        version = "1";
        sha256 = "0i1jj6lrabl0fhh1iya4nxr2hw1s4xmhca5qnim93ng5znziv9n2";
+       revision = "1";
+       editedCabalFile = "0hcpyypnj9qwbpk079h6lnm8aa3mp3fzjilk9qwibkmnnqwwwcld";
        libraryHaskellDepends = [ base bifunctors ];
        description = "swap and assoc: Symmetric and Semigroupy Bifunctors";
        license = stdenv.lib.licenses.bsd3;
@@ -33618,8 +33620,8 @@ self: {
        pname = "avers";
        version = "0.0.17.1";
        sha256 = "1x96fvx0z7z75c39qcggw70qvqnw7kzjf0qqxb3jwg3b0fmdhi8v";
-       revision = "31";
-       editedCabalFile = "03nzgni96r6yfmn196iya6akrzh46njqzd2873aj341ynfaqjyy1";
+       revision = "32";
+       editedCabalFile = "0p4jhc8rxvm82cp3zaibazb5jnjs33vl4f71pvgvzf31xd7immyy";
        libraryHaskellDepends = [
          aeson attoparsec base bytestring clock containers cryptonite
          filepath inflections memory MonadRandom mtl network network-uri
@@ -35469,6 +35471,18 @@ self: {
        license = stdenv.lib.licenses.mit;
      }) {};
 
+  "base-compat_0_11_0" = callPackage
+    ({ mkDerivation, base, unix }:
+     mkDerivation {
+       pname = "base-compat";
+       version = "0.11.0";
+       sha256 = "0svswi3nby9cabai2l9mkcx0c9zqw9y8js50sh09cms1s2jjly26";
+       libraryHaskellDepends = [ base unix ];
+       description = "A compatibility layer for base";
+       license = stdenv.lib.licenses.mit;
+       hydraPlatforms = stdenv.lib.platforms.none;
+     }) {};
+
   "base-compat-batteries" = callPackage
     ({ mkDerivation, base, base-compat, hspec, hspec-discover
      , QuickCheck
@@ -35486,6 +35500,22 @@ self: {
        license = stdenv.lib.licenses.mit;
      }) {};
 
+  "base-compat-batteries_0_11_0" = callPackage
+    ({ mkDerivation, base, base-compat, hspec, hspec-discover
+     , QuickCheck
+     }:
+     mkDerivation {
+       pname = "base-compat-batteries";
+       version = "0.11.0";
+       sha256 = "0r9p14ks2fspbhj61b2gi4ixipkhhkzpcx0y35nf4yypcqv5262h";
+       libraryHaskellDepends = [ base base-compat ];
+       testHaskellDepends = [ base hspec QuickCheck ];
+       testToolDepends = [ hspec-discover ];
+       description = "base-compat with extra batteries";
+       license = stdenv.lib.licenses.mit;
+       hydraPlatforms = stdenv.lib.platforms.none;
+     }) {};
+
   "base-compat-migrate" = callPackage
     ({ mkDerivation, base, base-compat }:
      mkDerivation {
@@ -40248,6 +40278,8 @@ self: {
        pname = "blank-canvas";
        version = "0.7";
        sha256 = "11blkr9yhag4l8lyg5gyi2wzcnapkgihkh01mp9lm28f3bb1v1z7";
+       revision = "1";
+       editedCabalFile = "11jqhxcr8vynlknpw73s0nmg1a7n9rsbyifyhaxi3aq7hzvb0qai";
        enableSeparateDataOutput = true;
        libraryHaskellDepends = [
          aeson base base-compat-batteries base64-bytestring bytestring
@@ -45712,6 +45744,28 @@ self: {
        pname = "cabal2spec";
        version = "2.2.2.1";
        sha256 = "0jv335b6vz1y6jp381hhrb2miniyqzkn18ansc67as04yf3ngmay";
+       revision = "1";
+       editedCabalFile = "09bkjwnr01mgn1yf861p3dai18kgpm5mvw8nmh5zvdr8sgqi207v";
+       isLibrary = true;
+       isExecutable = true;
+       libraryHaskellDepends = [ base Cabal filepath time ];
+       executableHaskellDepends = [
+         base Cabal filepath optparse-applicative
+       ];
+       testHaskellDepends = [ base Cabal filepath tasty tasty-golden ];
+       description = "Convert Cabal files into rpm spec files";
+       license = stdenv.lib.licenses.gpl3;
+       maintainers = with stdenv.lib.maintainers; [ peti ];
+     }) {};
+
+  "cabal2spec_2_3" = callPackage
+    ({ mkDerivation, base, Cabal, filepath, optparse-applicative, tasty
+     , tasty-golden, time
+     }:
+     mkDerivation {
+       pname = "cabal2spec";
+       version = "2.3";
+       sha256 = "1hjxsmfgf3p919d6zr3gwkzizxg4lmqyga84a917qywp9b5g3mfi";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [ base Cabal filepath time ];
@@ -45721,6 +45775,7 @@ self: {
        testHaskellDepends = [ base Cabal filepath tasty tasty-golden ];
        description = "Convert Cabal files into rpm spec files";
        license = stdenv.lib.licenses.gpl3;
+       hydraPlatforms = stdenv.lib.platforms.none;
        maintainers = with stdenv.lib.maintainers; [ peti ];
      }) {};
 
@@ -45981,8 +46036,6 @@ self: {
        ];
        description = "Command line client for Nix binary cache hosting https://cachix.org";
        license = stdenv.lib.licenses.asl20;
-       hydraPlatforms = stdenv.lib.platforms.none;
-       broken = true;
      }) {inherit (pkgs) nix;};
 
   "cachix-api" = callPackage
@@ -49408,12 +49461,12 @@ self: {
        license = stdenv.lib.licenses.bsd3;
      }) {};
 
-  "checkers_0_5_1" = callPackage
+  "checkers_0_5_2" = callPackage
     ({ mkDerivation, array, base, QuickCheck, random, semigroupoids }:
      mkDerivation {
        pname = "checkers";
-       version = "0.5.1";
-       sha256 = "0jvr9xa0fwcib7nnfydqbcwkfm2c053l248pagrgymdih24dsk8x";
+       version = "0.5.2";
+       sha256 = "1mqfy6lrivc36kxbfr9zyp70pyq3k2xrmavkadznh999d54x11kq";
        libraryHaskellDepends = [
          array base QuickCheck random semigroupoids
        ];
@@ -53157,6 +53210,8 @@ self: {
        pname = "coercible-utils";
        version = "0.0.0";
        sha256 = "164cn0cs7fjfm599v2z8wsgsz599f97wky4h7vycf460rn34jqia";
+       revision = "1";
+       editedCabalFile = "1xbnkv6fqf4mizqkha8b073p0r84l1rx1kzdsd6nh8b0adrp6i4d";
        libraryHaskellDepends = [ base ];
        testHaskellDepends = [ base ];
        benchmarkHaskellDepends = [ base gauge ];
@@ -57082,18 +57137,18 @@ self: {
        license = stdenv.lib.licenses.bsd2;
      }) {};
 
-  "constraints_0_11_1" = callPackage
+  "constraints_0_11_2" = callPackage
     ({ mkDerivation, base, binary, deepseq, ghc-prim, hashable, hspec
      , hspec-discover, mtl, semigroups, transformers
-     , transformers-compat
+     , transformers-compat, type-equality
      }:
      mkDerivation {
        pname = "constraints";
-       version = "0.11.1";
-       sha256 = "15768bcd8z70wq0b2igvz8mrl62bqaqad6cpdp9p4awyylba37y6";
+       version = "0.11.2";
+       sha256 = "10mnhg7p5gk4i3bzldl07qkrihnvmfkgsp32w7p9i7x8cmj5akjq";
        libraryHaskellDepends = [
          base binary deepseq ghc-prim hashable mtl semigroups transformers
-         transformers-compat
+         transformers-compat type-equality
        ];
        testHaskellDepends = [ base hspec ];
        testToolDepends = [ hspec-discover ];
@@ -59728,6 +59783,8 @@ self: {
        pname = "criterion";
        version = "1.5.5.0";
        sha256 = "1a5i9ghy4hr3355ml4b0rc3b94fa2ijfflh398ncn9sw1ivmx8pa";
+       revision = "2";
+       editedCabalFile = "03b2a257spl0ckjw8mx5sf173nfmfqacllvyfskqpn0q1j4aj0qk";
        isLibrary = true;
        isExecutable = true;
        enableSeparateDataOutput = true;
@@ -59750,6 +59807,44 @@ self: {
        license = stdenv.lib.licenses.bsd3;
      }) {};
 
+  "criterion_1_5_6_0" = callPackage
+    ({ mkDerivation, aeson, ansi-wl-pprint, base, base-compat
+     , base-compat-batteries, binary, binary-orphans, bytestring
+     , cassava, code-page, containers, criterion-measurement, deepseq
+     , directory, exceptions, filepath, Glob, HUnit, js-flot, js-jquery
+     , microstache, mtl, mwc-random, optparse-applicative, parsec
+     , QuickCheck, statistics, tasty, tasty-hunit, tasty-quickcheck
+     , text, time, transformers, transformers-compat, vector
+     , vector-algorithms
+     }:
+     mkDerivation {
+       pname = "criterion";
+       version = "1.5.6.0";
+       sha256 = "1p8rw70k69bz33a8amn1ibdf6104hjphglyjlzsxa4w949d0ahp2";
+       isLibrary = true;
+       isExecutable = true;
+       enableSeparateDataOutput = true;
+       libraryHaskellDepends = [
+         aeson ansi-wl-pprint base base-compat-batteries binary
+         binary-orphans bytestring cassava code-page containers
+         criterion-measurement deepseq directory exceptions filepath Glob
+         js-flot js-jquery microstache mtl mwc-random optparse-applicative
+         parsec statistics text time transformers transformers-compat vector
+         vector-algorithms
+       ];
+       executableHaskellDepends = [
+         base base-compat-batteries optparse-applicative
+       ];
+       testHaskellDepends = [
+         aeson base base-compat base-compat-batteries bytestring deepseq
+         directory HUnit QuickCheck statistics tasty tasty-hunit
+         tasty-quickcheck vector
+       ];
+       description = "Robust, reliable performance measurement and analysis";
+       license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+     }) {};
+
   "criterion-compare" = callPackage
     ({ mkDerivation, base, bytestring, cassava, Chart, Chart-diagrams
      , clay, colour, containers, data-default, filepath, lens, lucid
@@ -67472,6 +67567,8 @@ self: {
        pname = "dhall";
        version = "1.25.0";
        sha256 = "0d8qx4fawvxykig628jfgqpa660mzzicysa7g3mda6zni9j4yq0h";
+       revision = "1";
+       editedCabalFile = "0pbhm350am7qxb92lr7fz5s9znsm9ngfra7w8b93zbabh5hf6mm3";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -70750,6 +70847,23 @@ self: {
        license = stdenv.lib.licenses.bsd3;
      }) {};
 
+  "distributive_0_6_1" = callPackage
+    ({ mkDerivation, base, base-orphans, Cabal, cabal-doctest, doctest
+     , generic-deriving, hspec, hspec-discover, tagged, transformers
+     }:
+     mkDerivation {
+       pname = "distributive";
+       version = "0.6.1";
+       sha256 = "1wnayzzb4vk8rhh9gzhdpd9f64366k4vmbhximavmqqmp3cv2jbp";
+       setupHaskellDepends = [ base Cabal cabal-doctest ];
+       libraryHaskellDepends = [ base base-orphans tagged transformers ];
+       testHaskellDepends = [ base doctest generic-deriving hspec ];
+       testToolDepends = [ hspec-discover ];
+       description = "Distributive functors -- Dual to Traversable";
+       license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+     }) {};
+
   "ditto" = callPackage
     ({ mkDerivation, base, containers, mtl, semigroups, text, torsor }:
      mkDerivation {
@@ -76465,6 +76579,21 @@ self: {
        license = stdenv.lib.licenses.bsd3;
      }) {};
 
+  "entropy_0_4_1_5" = callPackage
+    ({ mkDerivation, base, bytestring, Cabal, directory, filepath
+     , process, unix
+     }:
+     mkDerivation {
+       pname = "entropy";
+       version = "0.4.1.5";
+       sha256 = "0szf8hi1pi8g0kxnkcymh65gk1b0niyl1nnkckzdqyar87qal0jm";
+       setupHaskellDepends = [ base Cabal directory filepath process ];
+       libraryHaskellDepends = [ base bytestring unix ];
+       description = "A platform independent entropy source";
+       license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+     }) {};
+
   "entwine" = callPackage
     ({ mkDerivation, async, base, clock, containers, criterion
      , directory, exceptions, monad-loops, process, QuickCheck
@@ -82825,6 +82954,8 @@ self: {
        pname = "fin";
        version = "0.1";
        sha256 = "17nv26cznhslrfb1ajcgxa9g3zacvk3prmncr7f8d7rvh42g2gnn";
+       revision = "1";
+       editedCabalFile = "0kdhmjpifbl1r44jy2spj82gdadd849zz6i0y7mw1ii25w91yb50";
        libraryHaskellDepends = [ base dec deepseq hashable ];
        testHaskellDepends = [ base inspection-testing tagged ];
        description = "Nat and Fin: peano naturals and finite numbers";
@@ -85807,11 +85938,29 @@ self: {
        pname = "foundation";
        version = "0.0.24";
        sha256 = "1yygliyg5dh06n7iyyrvy4iz2328hgb5igjp832wxrfa529pwqdk";
+       revision = "1";
+       editedCabalFile = "1p8q1324dfg3w81dv29hc3wgvg43qsfps1c156xmml566jwvf1l2";
+       libraryHaskellDepends = [ base basement ghc-prim ];
+       testHaskellDepends = [ base basement ];
+       benchmarkHaskellDepends = [ base basement gauge ];
+       description = "Alternative prelude with batteries and no dependencies";
+       license = stdenv.lib.licenses.bsd3;
+     }) {};
+
+  "foundation_0_0_25" = callPackage
+    ({ mkDerivation, base, basement, gauge, ghc-prim }:
+     mkDerivation {
+       pname = "foundation";
+       version = "0.0.25";
+       sha256 = "0q6kx57ygmznlpf8n499hid4x6mj3180paijx0a8dgi9hh7man61";
+       revision = "1";
+       editedCabalFile = "1ps5sk50sf4b5hd87k3jqykqrwcw2wzyp50rcy6pghd61h83cjg2";
        libraryHaskellDepends = [ base basement ghc-prim ];
        testHaskellDepends = [ base basement ];
        benchmarkHaskellDepends = [ base basement gauge ];
        description = "Alternative prelude with batteries and no dependencies";
        license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
      }) {};
 
   "foundation-edge" = callPackage
@@ -89971,6 +90120,8 @@ self: {
        pname = "generics-sop-lens";
        version = "0.2";
        sha256 = "0cm3xnz5h1pxhvbgl8mm16fg8y339m6wvm6nlqmsm0jh37gvqc2a";
+       revision = "1";
+       editedCabalFile = "1ghgh91wd764firxc2s083jzr38w51fg0ry2b7s1wn71mnvzb893";
        libraryHaskellDepends = [ base generics-sop lens ];
        description = "Lenses for types in generics-sop";
        license = stdenv.lib.licenses.bsd3;
@@ -94062,8 +94213,8 @@ self: {
      }:
      mkDerivation {
        pname = "git-brunch";
-       version = "1.0.5.0";
-       sha256 = "0bnag71l6vjygn5bbfav229pk44xn491jzj13n7m8xdc7nvh7zz1";
+       version = "1.0.6.0";
+       sha256 = "1zhmzw1vhdxcx69l97xlm8ylfk79f95g83c3nhp39g2lj7z0wqi0";
        isLibrary = false;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -103844,6 +103995,36 @@ self: {
        broken = true;
      }) {};
 
+  "hadolint_1_17_2" = callPackage
+    ({ mkDerivation, aeson, base, bytestring, containers, directory
+     , filepath, gitrev, hspec, HsYAML, HUnit, language-docker
+     , megaparsec, mtl, optparse-applicative, ShellCheck, split, text
+     , void
+     }:
+     mkDerivation {
+       pname = "hadolint";
+       version = "1.17.2";
+       sha256 = "0s9q0016j3y56sblkq12mai1j58h8w8cy8k2x1bzvhb95zpg1va9";
+       isLibrary = true;
+       isExecutable = true;
+       libraryHaskellDepends = [
+         aeson base bytestring containers directory filepath HsYAML
+         language-docker megaparsec mtl ShellCheck split text void
+       ];
+       executableHaskellDepends = [
+         base containers gitrev language-docker megaparsec
+         optparse-applicative text
+       ];
+       testHaskellDepends = [
+         aeson base bytestring hspec HsYAML HUnit language-docker megaparsec
+         ShellCheck split text
+       ];
+       description = "Dockerfile Linter JavaScript API";
+       license = stdenv.lib.licenses.gpl3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
+     }) {};
+
   "hadoop-formats" = callPackage
     ({ mkDerivation, attoparsec, base, bytestring, filepath, snappy
      , text, vector
@@ -106377,21 +106558,21 @@ self: {
 
   "harg" = callPackage
     ({ mkDerivation, aeson, barbies, base, bytestring, directory
-     , higgledy, markdown-unlit, optparse-applicative, text, yaml
+     , higgledy, markdown-unlit, optparse-applicative, split, text, yaml
      }:
      mkDerivation {
        pname = "harg";
-       version = "0.1.0.1";
-       sha256 = "11qkyx9axd8vybkb1kq7vs5v5xf594wgkbpbfpvj0hah7iw9wb95";
+       version = "0.2.0.0";
+       sha256 = "0zdngzz1p73dpfx4klxf59yhk4qf0r4ming2nw4yqfsyxqfwgw1i";
        libraryHaskellDepends = [
          aeson barbies base bytestring directory higgledy
-         optparse-applicative text yaml
+         optparse-applicative split text yaml
        ];
        testHaskellDepends = [
          aeson barbies base higgledy optparse-applicative
        ];
        testToolDepends = [ markdown-unlit ];
-       description = "Haskell program configuration from multiple sources";
+       description = "Haskell program configuration using higher kinded data";
        license = stdenv.lib.licenses.bsd3;
        hydraPlatforms = stdenv.lib.platforms.none;
        broken = true;
@@ -106608,8 +106789,8 @@ self: {
      }:
      mkDerivation {
        pname = "hasbolt-extras";
-       version = "0.0.0.19";
-       sha256 = "11g6rlgyxi57bvmr862ly7yfwiiph1kckr056b5khz8v8k6fhhpv";
+       version = "0.0.0.20";
+       sha256 = "0xqi3hb1xgbkkj8wmrvp39sh7zcj75v55xbha87nmkl2g56kaxw2";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -115874,8 +116055,8 @@ self: {
      }:
      mkDerivation {
        pname = "hie-bios";
-       version = "0.1.0";
-       sha256 = "0589g8rgd9bdjjx6cxsskqdlbq6gwnb9nsjrgbp7mxnspwjcb72y";
+       version = "0.1.1";
+       sha256 = "119rqh12bq5gq5y708hxr0zci1dq8wf44xzxgxhhx4sb5zgj1l2p";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -115888,6 +116069,42 @@ self: {
        license = stdenv.lib.licenses.bsd3;
      }) {};
 
+  "hie-core" = callPackage
+    ({ mkDerivation, aeson, async, base, binary, bytestring, containers
+     , data-default, deepseq, directory, extra, filepath, ghc, ghc-boot
+     , ghc-boot-th, ghc-paths, hashable, haskell-lsp, haskell-lsp-types
+     , hie-bios, lens, lsp-test, mtl, network-uri, optparse-applicative
+     , parser-combinators, prettyprinter, prettyprinter-ansi-terminal
+     , rope-utf16-splay, safe-exceptions, shake, sorted-list, stm, syb
+     , tasty, tasty-hunit, text, time, transformers, unix
+     , unordered-containers, utf8-string
+     }:
+     mkDerivation {
+       pname = "hie-core";
+       version = "0.0.1";
+       sha256 = "1fdg5vz5qr9y9xmqqb2qcxss8byz3m38d7zcfybq783fxqrcyfsc";
+       isLibrary = true;
+       isExecutable = true;
+       libraryHaskellDepends = [
+         aeson async base binary bytestring containers data-default deepseq
+         directory extra filepath ghc ghc-boot ghc-boot-th hashable
+         haskell-lsp haskell-lsp-types mtl network-uri prettyprinter
+         prettyprinter-ansi-terminal rope-utf16-splay safe-exceptions shake
+         sorted-list stm syb text time transformers unix
+         unordered-containers utf8-string
+       ];
+       executableHaskellDepends = [
+         base containers data-default directory extra filepath ghc ghc-paths
+         haskell-lsp hie-bios optparse-applicative shake text
+       ];
+       testHaskellDepends = [
+         base containers extra filepath haskell-lsp-types lens lsp-test
+         parser-combinators tasty tasty-hunit text
+       ];
+       description = "The core of an IDE";
+       license = stdenv.lib.licenses.asl20;
+     }) {};
+
   "hieraclus" = callPackage
     ({ mkDerivation, base, containers, HUnit, mtl, multiset }:
      mkDerivation {
@@ -118818,8 +119035,6 @@ self: {
        ];
        description = "Haskell implementation of the Nix language";
        license = stdenv.lib.licenses.bsd3;
-       hydraPlatforms = stdenv.lib.platforms.none;
-       broken = true;
      }) {};
 
   "hnix-store-core" = callPackage
@@ -118870,8 +119085,6 @@ self: {
        ];
        description = "Remote hnix store";
        license = stdenv.lib.licenses.asl20;
-       hydraPlatforms = stdenv.lib.platforms.none;
-       broken = true;
      }) {};
 
   "hnn" = callPackage
@@ -125163,6 +125376,30 @@ self: {
        license = stdenv.lib.licenses.mit;
      }) {};
 
+  "hspec-wai_0_10_0" = callPackage
+    ({ mkDerivation, base, base-compat, bytestring, case-insensitive
+     , hspec, hspec-core, hspec-expectations, http-types, QuickCheck
+     , text, transformers, wai, wai-extra
+     }:
+     mkDerivation {
+       pname = "hspec-wai";
+       version = "0.10.0";
+       sha256 = "1gw0z9wwvwzhxxkqp4snx77k956zq0wwdq3mjiznng0pa2xc0fhf";
+       libraryHaskellDepends = [
+         base base-compat bytestring case-insensitive hspec-core
+         hspec-expectations http-types QuickCheck text transformers wai
+         wai-extra
+       ];
+       testHaskellDepends = [
+         base base-compat bytestring case-insensitive hspec hspec-core
+         hspec-expectations http-types QuickCheck text transformers wai
+         wai-extra
+       ];
+       description = "Experimental Hspec support for testing WAI applications";
+       license = stdenv.lib.licenses.mit;
+       hydraPlatforms = stdenv.lib.platforms.none;
+     }) {};
+
   "hspec-wai-json" = callPackage
     ({ mkDerivation, aeson, aeson-qq, base, bytestring
      , case-insensitive, hspec, hspec-wai, template-haskell
@@ -125180,6 +125417,24 @@ self: {
        license = stdenv.lib.licenses.mit;
      }) {};
 
+  "hspec-wai-json_0_10_0" = callPackage
+    ({ mkDerivation, aeson, aeson-qq, base, bytestring
+     , case-insensitive, hspec, hspec-wai, template-haskell
+     }:
+     mkDerivation {
+       pname = "hspec-wai-json";
+       version = "0.10.0";
+       sha256 = "1hbmwsl1vsjsqgbdgrs6210cj1zh437smdsnmsmvnyfc0xpr9pcy";
+       libraryHaskellDepends = [
+         aeson aeson-qq base bytestring case-insensitive hspec-wai
+         template-haskell
+       ];
+       testHaskellDepends = [ base hspec hspec-wai ];
+       description = "Testing JSON APIs with hspec-wai";
+       license = stdenv.lib.licenses.mit;
+       hydraPlatforms = stdenv.lib.platforms.none;
+     }) {};
+
   "hspec-webdriver" = callPackage
     ({ mkDerivation, aeson, base, data-default, hashable, hspec
      , hspec-core, HUnit, lifted-base, stm, text, transformers
@@ -133936,6 +134191,8 @@ self: {
        pname = "insert-ordered-containers";
        version = "0.2.2";
        sha256 = "1ikjhg0pdfpnx1d645r92k2dwlk7y935j1w5lcsk23nzpwhbkxja";
+       revision = "1";
+       editedCabalFile = "1hlinc8nnjlzc6ds3wf8jvkihpcbhz2dk0rqxq1ns0c5zbbhnylq";
        libraryHaskellDepends = [
          aeson base base-compat hashable lens semigroupoids semigroups text
          transformers unordered-containers
@@ -138081,6 +138338,8 @@ self: {
        pname = "jsaddle-dom";
        version = "0.9.3.2";
        sha256 = "1qc135w1y4f2mbky36dmb0ggcbwkv1vnmszw5lkhkxhkcag2sf07";
+       revision = "1";
+       editedCabalFile = "0vhqqbcpbrsnbmix0wkkm1d21qwrpicbzjwy42p48g7whg0lf0d5";
        setupHaskellDepends = [ base Cabal ];
        libraryHaskellDepends = [
          base base-compat exceptions jsaddle lens text transformers
@@ -142587,8 +142846,8 @@ self: {
      }:
      mkDerivation {
        pname = "lambdabot-xmpp";
-       version = "0.1.0.2";
-       sha256 = "1dbnps2fcxi4wky4q9kv69vz74cbxzm91q3k65s95ldilya5730b";
+       version = "0.1.0.3";
+       sha256 = "0nixz3g2invajirvhkqwl3cnqiimjfjfsm82b59yyzpdk26c5fmi";
        isLibrary = false;
        isExecutable = true;
        executableHaskellDepends = [
@@ -145532,6 +145791,47 @@ self: {
        license = stdenv.lib.licenses.bsd2;
      }) {};
 
+  "lens_4_18" = callPackage
+    ({ mkDerivation, array, base, base-orphans, bifunctors, bytestring
+     , Cabal, cabal-doctest, call-stack, comonad, containers
+     , contravariant, criterion, deepseq, directory, distributive
+     , doctest, exceptions, filepath, free, generic-deriving, ghc-prim
+     , hashable, HUnit, kan-extensions, mtl, nats, parallel, profunctors
+     , QuickCheck, reflection, semigroupoids, semigroups, simple-reflect
+     , tagged, template-haskell, test-framework, test-framework-hunit
+     , test-framework-quickcheck2, test-framework-th, text
+     , th-abstraction, transformers, transformers-compat, type-equality
+     , unordered-containers, vector
+     }:
+     mkDerivation {
+       pname = "lens";
+       version = "4.18";
+       sha256 = "0wldr36bmlxddc6d874lfl4hwnh5bq5k89v437d7xw5ldj0fgws6";
+       setupHaskellDepends = [ base Cabal cabal-doctest filepath ];
+       libraryHaskellDepends = [
+         array base base-orphans bifunctors bytestring call-stack comonad
+         containers contravariant distributive exceptions filepath free
+         ghc-prim hashable kan-extensions mtl parallel profunctors
+         reflection semigroupoids tagged template-haskell text
+         th-abstraction transformers transformers-compat type-equality
+         unordered-containers vector
+       ];
+       testHaskellDepends = [
+         base bytestring containers deepseq directory doctest filepath
+         generic-deriving HUnit mtl nats parallel QuickCheck semigroups
+         simple-reflect test-framework test-framework-hunit
+         test-framework-quickcheck2 test-framework-th text transformers
+         unordered-containers vector
+       ];
+       benchmarkHaskellDepends = [
+         base bytestring comonad containers criterion deepseq
+         generic-deriving transformers unordered-containers vector
+       ];
+       description = "Lenses, Folds and Traversals";
+       license = stdenv.lib.licenses.bsd2;
+       hydraPlatforms = stdenv.lib.platforms.none;
+     }) {};
+
   "lens-accelerate" = callPackage
     ({ mkDerivation, accelerate, base, lens }:
      mkDerivation {
@@ -145587,6 +145887,28 @@ self: {
        license = stdenv.lib.licenses.mit;
      }) {};
 
+  "lens-aeson_1_1" = callPackage
+    ({ mkDerivation, aeson, attoparsec, base, bytestring, Cabal
+     , cabal-doctest, doctest, generic-deriving, lens, scientific
+     , semigroups, simple-reflect, text, unordered-containers, vector
+     }:
+     mkDerivation {
+       pname = "lens-aeson";
+       version = "1.1";
+       sha256 = "03n9dkdyqkkf15h8k4c4bjwgjcbbs2an2cf6z8x54nvkjmprrg7p";
+       setupHaskellDepends = [ base Cabal cabal-doctest ];
+       libraryHaskellDepends = [
+         aeson attoparsec base bytestring lens scientific text
+         unordered-containers vector
+       ];
+       testHaskellDepends = [
+         base doctest generic-deriving semigroups simple-reflect
+       ];
+       description = "Law-abiding lenses for aeson";
+       license = stdenv.lib.licenses.mit;
+       hydraPlatforms = stdenv.lib.platforms.none;
+     }) {};
+
   "lens-datetime" = callPackage
     ({ mkDerivation, base, lens, time }:
      mkDerivation {
@@ -148879,6 +149201,17 @@ self: {
        broken = true;
      }) {};
 
+  "list-singleton" = callPackage
+    ({ mkDerivation, base }:
+     mkDerivation {
+       pname = "list-singleton";
+       version = "1.0.0.0";
+       sha256 = "0xc6vkbvsd7sbccb6pwgmvx34qpnh4ppv6fd5qp0xcylmw4gbvyv";
+       libraryHaskellDepends = [ base ];
+       description = "Easily and clearly create lists with only one element in them";
+       license = stdenv.lib.licenses.isc;
+     }) {};
+
   "list-t" = callPackage
     ({ mkDerivation, base, base-prelude, HTF, mmorph, monad-control
      , mtl, mtl-prelude, transformers, transformers-base
@@ -151421,8 +151754,8 @@ self: {
        pname = "lrucaching";
        version = "0.3.3";
        sha256 = "192a2zap1bmxa2y48n48rmngf18fr8k0az4a230hziv3g795yzma";
-       revision = "8";
-       editedCabalFile = "11ad87kg09s9md9lqzhbcw19kmzvii4v97nw49q0wb0rs0qizpki";
+       revision = "9";
+       editedCabalFile = "0rzrj9ziwly33lhkamf9rkrc3jqhid3adl0dv9621n4zzd6dnkb6";
        libraryHaskellDepends = [
          base base-compat deepseq hashable psqueues vector
        ];
@@ -154328,6 +154661,31 @@ self: {
        broken = true;
      }) {};
 
+  "massiv_0_4_1_0" = callPackage
+    ({ mkDerivation, base, bytestring, Cabal, cabal-doctest
+     , data-default-class, deepseq, doctest, exceptions
+     , mersenne-random-pure64, primitive, QuickCheck, random, scheduler
+     , splitmix, template-haskell, unliftio-core, vector
+     }:
+     mkDerivation {
+       pname = "massiv";
+       version = "0.4.1.0";
+       sha256 = "0h6rr5fx3kj5qs30zyfzmmvqnwn43fl4smjfd7qx4fhp48bq89nw";
+       setupHaskellDepends = [ base Cabal cabal-doctest ];
+       libraryHaskellDepends = [
+         base bytestring data-default-class deepseq exceptions primitive
+         scheduler unliftio-core vector
+       ];
+       testHaskellDepends = [
+         base doctest mersenne-random-pure64 QuickCheck random splitmix
+         template-haskell
+       ];
+       description = "Massiv (Массив) is an Array Library";
+       license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
+     }) {};
+
   "massiv-io" = callPackage
     ({ mkDerivation, base, bytestring, data-default, deepseq, directory
      , filepath, JuicyPixels, massiv, netpbm, process, vector
@@ -159283,6 +159641,8 @@ self: {
        pname = "monad-chronicle";
        version = "1";
        sha256 = "03x19683pm99zcw7gkipmdkrqwaspcyvy7yv68nlh6g4swl31a0l";
+       revision = "1";
+       editedCabalFile = "059qa4kb6x3vqw0pahbkp3i6v33cyaiizzkgxd1n36l9ybchwr4l";
        libraryHaskellDepends = [
          base data-default-class mtl semigroupoids these transformers
          transformers-compat
@@ -170818,6 +171178,27 @@ self: {
        broken = true;
      }) {};
 
+  "oeis2_1_0_3" = callPackage
+    ({ mkDerivation, aeson, base, containers, hspec, http-conduit, lens
+     , lens-aeson, QuickCheck, text, vector
+     }:
+     mkDerivation {
+       pname = "oeis2";
+       version = "1.0.3";
+       sha256 = "04dbly6ggadmy1bi10x9bbsa6dvynb5g1m5hdrlzv3mpyfahxvwp";
+       libraryHaskellDepends = [
+         aeson base containers http-conduit lens lens-aeson text vector
+       ];
+       testHaskellDepends = [
+         aeson base containers hspec http-conduit lens lens-aeson QuickCheck
+         text vector
+       ];
+       description = "Interface for Online Encyclopedia of Integer Sequences (OEIS)";
+       license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
+     }) {};
+
   "off-simple" = callPackage
     ({ mkDerivation, base, parsec3, vector }:
      mkDerivation {
@@ -172501,6 +172882,8 @@ self: {
        pname = "optics";
        version = "0.1";
        sha256 = "1xkccyshhzbf8c7v1vi7cw4k1a1gfgw9yl2wfma4q36bv96qq2lk";
+       revision = "1";
+       editedCabalFile = "01hbhb642f596a8dwx6rxq53cqhf40vgr6c3xrbvs025by890mpi";
        libraryHaskellDepends = [
          array base containers mtl optics-core optics-extra optics-th
          transformers
@@ -172536,6 +172919,8 @@ self: {
        pname = "optics-extra";
        version = "0.1";
        sha256 = "1z0blxm9gxbzqxxcm9bkj8jvf9apgn8abh0wdc4f220rs32c3v7g";
+       revision = "1";
+       editedCabalFile = "03n8pk423ckyk5rz8z8x9g0amxqpd75lsr90bjsjcp16qak4zjc7";
        libraryHaskellDepends = [
          array base bytestring containers hashable mtl optics-core text
          transformers unordered-containers vector
@@ -172552,8 +172937,8 @@ self: {
        pname = "optics-th";
        version = "0.1";
        sha256 = "1fqaxp7divk2wj7mvnsyzclly99l895dss1ssk6dzfgdijjjipk6";
-       revision = "1";
-       editedCabalFile = "034563mm7rdck8xhwjpqig3kj9rzk91s292rwcargbgbpma5ailv";
+       revision = "2";
+       editedCabalFile = "1m5wcl6h83hhiyic7khw6lylmb4rvbaskvpssrd52b2a73gpzm69";
        libraryHaskellDepends = [
          base containers mtl optics-core template-haskell th-abstraction
          transformers
@@ -172569,6 +172954,8 @@ self: {
        pname = "optics-vl";
        version = "0.1";
        sha256 = "03khw0aqv7wdlym5maasm1l20gj4y1jzci89y592hx3y07mzvapl";
+       revision = "1";
+       editedCabalFile = "06x99059qi5qhsq7cql2l0pk0d1kh8is320xsnxw6qjp2c4hild2";
        libraryHaskellDepends = [ base optics-core profunctors ];
        description = "Utilities for compatibility with van Laarhoven optics";
        license = stdenv.lib.licenses.bsd3;
@@ -176528,8 +176915,8 @@ self: {
      }:
      mkDerivation {
        pname = "patat";
-       version = "0.8.2.5";
-       sha256 = "1hss18gb71xrjgncjr4g5935k7kcwxpxxb6j52i32ans43xavhiv";
+       version = "0.8.3.0";
+       sha256 = "1dldaqa1qbwdia6rcf0sb6bnqldcpgrimd3yx00idyjy0msl0xh6";
        isLibrary = false;
        isExecutable = true;
        executableHaskellDepends = [
@@ -180913,6 +181300,8 @@ self: {
        pname = "pipes-extras";
        version = "1.0.15";
        sha256 = "1cyb05bv5xkarab3090ikpjiqm79lr46n3nalplliz8jr4x67a82";
+       revision = "1";
+       editedCabalFile = "0xrd5zwkr1c7lswzi91gxl3ndra8y9g2b4j00sszyy3w187a2zwi";
        libraryHaskellDepends = [ base foldl lens pipes transformers ];
        testHaskellDepends = [
          base HUnit pipes test-framework test-framework-hunit transformers
@@ -181394,6 +181783,23 @@ self: {
        license = stdenv.lib.licenses.bsd3;
      }) {};
 
+  "pipes-safe_2_3_2" = callPackage
+    ({ mkDerivation, base, containers, exceptions, monad-control, mtl
+     , pipes, primitive, transformers, transformers-base
+     }:
+     mkDerivation {
+       pname = "pipes-safe";
+       version = "2.3.2";
+       sha256 = "10m6f52nahxwnl2zvgnbilllcvd3lpi0dxl3j6fk20lryjzmhyqc";
+       libraryHaskellDepends = [
+         base containers exceptions monad-control mtl pipes primitive
+         transformers transformers-base
+       ];
+       description = "Safety for the pipes ecosystem";
+       license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+     }) {};
+
   "pipes-shell" = callPackage
     ({ mkDerivation, async, base, bytestring, directory, hspec, pipes
      , pipes-bytestring, pipes-safe, process, stm, stm-chans, text
@@ -184806,8 +185212,8 @@ self: {
        pname = "postmaster";
        version = "0.3.3";
        sha256 = "05608xvaig1d67j3h8ykw7a11yr1mqkw98p0ii7gbp4mp3d9kncd";
-       revision = "1";
-       editedCabalFile = "00rp6mdds4kssvcyc9n6iz1asgkhv96050x50jwvg3wp3pp69fg2";
+       revision = "2";
+       editedCabalFile = "0jchzy502czxfm34v9b1jyfzzaiphvfqm5vdk9fz9d0vhqwr7jjg";
        isLibrary = false;
        isExecutable = true;
        executableHaskellDepends = [
@@ -187379,14 +187785,14 @@ self: {
        license = stdenv.lib.licenses.bsd3;
      }) {};
 
-  "profunctors_5_4" = callPackage
+  "profunctors_5_5" = callPackage
     ({ mkDerivation, base, base-orphans, bifunctors, comonad
      , contravariant, distributive, tagged, transformers
      }:
      mkDerivation {
        pname = "profunctors";
-       version = "5.4";
-       sha256 = "1b5hidvd3rd8ilzr5ipzw0mg0a2x0ldrrcx6bacalafg7407bfhh";
+       version = "5.5";
+       sha256 = "0z7kf8hkfk5wfxw80zs9jsh22mk3mjzfvqbdkihrw1wiyw4xkjfl";
        libraryHaskellDepends = [
          base base-orphans bifunctors comonad contravariant distributive
          tagged transformers
@@ -195887,6 +196293,8 @@ self: {
        pname = "regex-dfa";
        version = "0.91";
        sha256 = "1f846d86wg7yha29qinchpi3r5gv9795f384pqahbyc13wfky7dp";
+       revision = "1";
+       editedCabalFile = "089gzj8yih2f4ijyk9c49zyq6cws68z2rnklhiww9f3nb75lg6a9";
        libraryHaskellDepends = [ base mtl parsec regex-base ];
        description = "Replaces/Enhances Text.Regex";
        license = stdenv.lib.licenses.bsd3;
@@ -196009,6 +196417,8 @@ self: {
        pname = "regex-parsec";
        version = "0.90";
        sha256 = "0zf5cr10mxlxxd8fp4q4ix6ibxc5xx3ml3k043kx28f9vfdh2xnx";
+       revision = "1";
+       editedCabalFile = "19y0kgmqpcz4k0l3cfjbxirq844zqm71gaz7117pm399x8bz1df7";
        libraryHaskellDepends = [ base parsec regex-base ];
        description = "Replaces/Enhances Text.Regex";
        license = stdenv.lib.licenses.bsd3;
@@ -196226,6 +196636,8 @@ self: {
        pname = "regex-tre";
        version = "0.91";
        sha256 = "1b7x0y8q1fvipnzh06by48f8l9l5ypm6yblpl35fzf641z3m9b7j";
+       revision = "1";
+       editedCabalFile = "1xxxn1i6pgmba4p15hjw8achaiy4lfbib9gl0xz9z0jz9fmvfdab";
        libraryHaskellDepends = [ base regex-base ];
        librarySystemDepends = [ tre ];
        description = "Replaces/Enhances Text.Regex";
@@ -200369,15 +200781,16 @@ self: {
   "ron" = callPackage
     ({ mkDerivation, aeson, attoparsec, base, binary, bytestring
      , containers, criterion, deepseq, hashable, integer-gmp, mtl
-     , scientific, template-haskell, text, time, unordered-containers
+     , scientific, template-haskell, text, time, transformers
+     , unordered-containers
      }:
      mkDerivation {
        pname = "ron";
-       version = "0.8";
-       sha256 = "1j5agf0367ldn3jb1jwgi9x9r4sss4jb93j6sgw5w9yzgqj23i8w";
+       version = "0.9";
+       sha256 = "0brjqb6lrcs711g5aqw3d5nidikmvjyyps8hcifzwpjanq0l8cvg";
        libraryHaskellDepends = [
          aeson attoparsec base binary bytestring containers hashable
-         integer-gmp mtl scientific template-haskell text time
+         integer-gmp mtl scientific template-haskell text time transformers
          unordered-containers
        ];
        benchmarkHaskellDepends = [ base criterion deepseq integer-gmp ];
@@ -200391,8 +200804,8 @@ self: {
      }:
      mkDerivation {
        pname = "ron-rdt";
-       version = "0.8";
-       sha256 = "1k8xyxi5s3c1q45j51s7ssghqq5m5ka3hn29z4wb7inyzllz6ifx";
+       version = "0.9.1";
+       sha256 = "1kx858d3pyj2dlpznd9n0aw6yhkq4ac9789kkan9yi8mf0vdbn3i";
        libraryHaskellDepends = [
          base containers Diff hashable integer-gmp mtl ron text time
          transformers unordered-containers
@@ -200408,8 +200821,8 @@ self: {
      }:
      mkDerivation {
        pname = "ron-schema";
-       version = "0.8";
-       sha256 = "1hqf9wpiwckaj25ljfyfl6dkp53jg31x3wyryc0vwfdy269v8lfb";
+       version = "0.9.1";
+       sha256 = "0pw398dq30bq554yfc9c6x43ng3bv5qx7mdw18ira92zlf5yh3qc";
        libraryHaskellDepends = [
          base bytestring containers hedn integer-gmp megaparsec mtl ron
          ron-rdt template-haskell text transformers
@@ -200421,15 +200834,15 @@ self: {
   "ron-storage" = callPackage
     ({ mkDerivation, base, bytestring, containers, directory, filepath
      , integer-gmp, mtl, network-info, ron, ron-rdt, stm, text
-     , transformers
+     , tf-random, transformers
      }:
      mkDerivation {
        pname = "ron-storage";
-       version = "0.9";
-       sha256 = "0bvmy5mya2v64cj3sxvr0mlfp4zc0xy4q33qr6hk3r6k5jwdfqwx";
+       version = "0.10.1";
+       sha256 = "1wck9d188kinfzmz7ff8vw39ff5garfy6nw0cwkr4k3qdvcajj1r";
        libraryHaskellDepends = [
          base bytestring containers directory filepath integer-gmp mtl
-         network-info ron ron-rdt stm text transformers
+         network-info ron ron-rdt stm text tf-random transformers
        ];
        description = "RON Storage";
        license = stdenv.lib.licenses.bsd3;
@@ -203964,8 +204377,8 @@ self: {
        pname = "scotty";
        version = "0.11.4";
        sha256 = "13z0zmginaa1y5iywbbygvb9q3cmfgjkv6n2drs8gfbv3sirrf7i";
-       revision = "1";
-       editedCabalFile = "1kzp19ff7mh30y6mdqrxngyv7ph3rc95sahlnjzv9wj8j2fb66vn";
+       revision = "2";
+       editedCabalFile = "168wg4kbqfg907gwyyxj159rk3ayfjcmyfbfsf97lxqic72vcff9";
        libraryHaskellDepends = [
          aeson base blaze-builder bytestring case-insensitive
          data-default-class exceptions fail http-types monad-control mtl
@@ -203981,6 +204394,34 @@ self: {
        license = stdenv.lib.licenses.bsd3;
      }) {};
 
+  "scotty_0_11_5" = callPackage
+    ({ mkDerivation, aeson, async, base, blaze-builder, bytestring
+     , case-insensitive, data-default-class, directory, exceptions, fail
+     , hspec, hspec-discover, hspec-wai, http-types, lifted-base
+     , monad-control, mtl, nats, network, regex-compat, text
+     , transformers, transformers-base, transformers-compat, wai
+     , wai-extra, warp
+     }:
+     mkDerivation {
+       pname = "scotty";
+       version = "0.11.5";
+       sha256 = "1pyj7j3zk80lv1c62ccna7nrsql5wf7pi5jscmypr2zd5xgfffvg";
+       libraryHaskellDepends = [
+         aeson base blaze-builder bytestring case-insensitive
+         data-default-class exceptions fail http-types monad-control mtl
+         nats network regex-compat text transformers transformers-base
+         transformers-compat wai wai-extra warp
+       ];
+       testHaskellDepends = [
+         async base bytestring data-default-class directory hspec hspec-wai
+         http-types lifted-base network text wai
+       ];
+       testToolDepends = [ hspec-discover ];
+       description = "Haskell web framework inspired by Ruby's Sinatra, using WAI and Warp";
+       license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+     }) {};
+
   "scotty-binding-play" = callPackage
     ({ mkDerivation, base, bytestring, hspec, http-client, HUnit, mtl
      , scotty, template-haskell, text, transformers
@@ -205414,6 +205855,8 @@ self: {
        pname = "semialign";
        version = "1";
        sha256 = "004x0a80sqqdgvsyk4z0nasxpi6z3g1d8kgwj804bj9ka8dlc75m";
+       revision = "1";
+       editedCabalFile = "0qnqnyfng4kwy2h2anrcy5id2ijnawava3zcc5h5b8ri1y6ks6zi";
        libraryHaskellDepends = [
          base base-compat containers hashable semigroupoids tagged these
          transformers unordered-containers vector
@@ -205430,11 +205873,13 @@ self: {
        pname = "semialign-indexed";
        version = "1";
        sha256 = "0m37c4bfvph7w241cgr2adp3x13ffgnw2l66wyn7y9rdvm2983k2";
+       revision = "1";
+       editedCabalFile = "1m08sj2xd97ix5bkm5hpyyb7inqfqic9m5dmy5jyg0ws41077frg";
        libraryHaskellDepends = [
          base containers hashable lens semialign these unordered-containers
          vector
        ];
-       description = "SemialignWithIndex, i.e. izip and ialign";
+       description = "SemialignWithIndex, i.e. izipWith and ialignWith";
        license = stdenv.lib.licenses.bsd3;
      }) {};
 
@@ -206053,8 +206498,8 @@ self: {
      }:
      mkDerivation {
        pname = "sequence-formats";
-       version = "1.4.0";
-       sha256 = "1wd4lfp5dynvz3gmf5ql2278mlzfaxiyrjnhv96brjf7j45nj5az";
+       version = "1.4.0.1";
+       sha256 = "1inw4agbm722zjbxi1ys73pssx76k8pg1s3cyxl5v1czqlyjxppy";
        libraryHaskellDepends = [
          attoparsec base bytestring containers errors exceptions foldl
          lens-family pipes pipes-attoparsec pipes-bytestring pipes-safe
@@ -218042,8 +218487,8 @@ self: {
      }:
      mkDerivation {
        pname = "sproxy2";
-       version = "1.97.0";
-       sha256 = "1in8sb41bl46xwk49904xkm3k5s59xikvmyyani1p60l0zfrb2jk";
+       version = "1.97.1";
+       sha256 = "1rbklqbmp0j9wy60j03bccbc0czd4s4ki8bl3l93p8mvkv55hcx4";
        isLibrary = false;
        isExecutable = true;
        executableHaskellDepends = [
@@ -228258,8 +228703,8 @@ self: {
        pname = "tdigest";
        version = "0.2.1";
        sha256 = "0kmqmzjcs406hv2fv9bkfayxpsd41dbry8bpkhy4y1jdgh33hvnl";
-       revision = "2";
-       editedCabalFile = "1q517siz4l55l7ssrbc3rm0szf41k7wy4p26lch03i57lzldf2hf";
+       revision = "3";
+       editedCabalFile = "1gdmfh1xhwg18lq9awpmcn2zzirxspi31fa7y3nzh6mkzyz5dz5r";
        setupHaskellDepends = [ base Cabal cabal-doctest ];
        libraryHaskellDepends = [
          base base-compat binary deepseq reducers semigroupoids transformers
@@ -230876,6 +231321,8 @@ self: {
        pname = "text-show";
        version = "3.8.2";
        sha256 = "0n46q5gjlxz3g4flj5mn8s78dpdfd65fjl7b5174pykanwqsqqwz";
+       revision = "1";
+       editedCabalFile = "0fdlba9rmjk7irf376rglyyi9rbz49mhm5zyx112ah8nqgh50myi";
        libraryHaskellDepends = [
          array base base-compat-batteries bifunctors bytestring
          bytestring-builder containers contravariant generic-deriving
@@ -232091,6 +232538,8 @@ self: {
        pname = "these";
        version = "1.0.1";
        sha256 = "1k0pi65g7cm9hzdw6my6bzz2zvddkmj1qs45ymqmi316bpiixk3r";
+       revision = "1";
+       editedCabalFile = "0923r86fnmgpx0msm68aszirh2n19nn5bccgjxfh2146jw4z7w3z";
        libraryHaskellDepends = [
          aeson assoc base base-compat binary deepseq hashable QuickCheck
          semigroupoids unordered-containers
@@ -232105,6 +232554,8 @@ self: {
        pname = "these-lens";
        version = "1";
        sha256 = "144ly13qng95mwnfis8dm7n3843z3w2vp4212qawbpw8hw921c7y";
+       revision = "1";
+       editedCabalFile = "1lrpq5a8ldddmsi7ckaqinamn2f7kkijq5jq05yzdx818b2563wn";
        libraryHaskellDepends = [ base base-compat lens these ];
        description = "Lenses for These";
        license = stdenv.lib.licenses.bsd3;
@@ -232116,6 +232567,8 @@ self: {
        pname = "these-optics";
        version = "1";
        sha256 = "0gmsykzcjx5h6dbfny4dw3jrm33ykcw6rpngf5awwdpg3a4cfgi7";
+       revision = "1";
+       editedCabalFile = "1fvi4m04xy3mj22ajgi95bsbr7jhm5f8dnan6hihkplqbjgrjma3";
        libraryHaskellDepends = [ base optics-core these ];
        description = "Optics for These";
        license = stdenv.lib.licenses.bsd3;
@@ -236437,6 +236890,8 @@ self: {
        pname = "tree-diff";
        version = "0.1";
        sha256 = "1156nbqn0pn9lp4zjsy4vv5g5wmy4zxwmbqdgvq349rydynh3ng3";
+       revision = "1";
+       editedCabalFile = "1nxwbn3z4a2102r45yhk0i6vb8fyc5mb894daai7l3l16rjzkp5a";
        libraryHaskellDepends = [
          aeson ansi-terminal ansi-wl-pprint base base-compat bytestring
          bytestring-builder containers hashable parsec parsers pretty
@@ -236474,17 +236929,17 @@ self: {
      }) {};
 
   "tree-sitter" = callPackage
-    ({ mkDerivation, aeson, base, bytestring, directory, filepath
-     , fused-effects, hedgehog, hspec, split, template-haskell, text
-     , unordered-containers
+    ({ mkDerivation, aeson, base, bytestring, containers, directory
+     , filepath, fused-effects, hedgehog, hspec, split, template-haskell
+     , text, unordered-containers
      }:
      mkDerivation {
        pname = "tree-sitter";
-       version = "0.1.0.0";
-       sha256 = "16yanr4k3zc55xgm5yajka7wgy475x2aq9lfv4j5lmxk0z7m9n9m";
+       version = "0.2.0.0";
+       sha256 = "03xdyvmnpjswh0rkn718n1w8kqvly86s6k3cwqgb6r1ygd6kqmim";
        libraryHaskellDepends = [
-         aeson base bytestring directory filepath fused-effects hedgehog
-         split template-haskell text unordered-containers
+         aeson base bytestring containers directory filepath fused-effects
+         hedgehog split template-haskell text unordered-containers
        ];
        testHaskellDepends = [ base hedgehog hspec ];
        description = "Unstable bindings for the tree-sitter parsing library";
@@ -236566,17 +237021,18 @@ self: {
      }) {};
 
   "tree-sitter-python" = callPackage
-    ({ mkDerivation, aeson, base, directory, filepath, template-haskell
-     , tree-sitter
+    ({ mkDerivation, aeson, base, bytestring, directory, filepath
+     , hedgehog, template-haskell, tree-sitter
      }:
      mkDerivation {
        pname = "tree-sitter-python";
-       version = "0.1.0.1";
-       sha256 = "0pq4cl4fb14x9dfnc83glpvzq65li4bvl0jidbsji34v9hzkr2x1";
+       version = "0.2.0.0";
+       sha256 = "1grkz8i3d37cci1w4i1lvdr2bjp7ddhq1fbyf240132rbhx67pg8";
        enableSeparateDataOutput = true;
        libraryHaskellDepends = [
          aeson base directory filepath template-haskell tree-sitter
        ];
+       testHaskellDepends = [ base bytestring hedgehog tree-sitter ];
        doHaddock = false;
        description = "Tree-sitter grammar/parser for Python";
        license = stdenv.lib.licenses.bsd3;
@@ -236884,6 +237340,32 @@ self: {
        license = stdenv.lib.licenses.bsd3;
      }) {};
 
+  "trifecta_2_1" = callPackage
+    ({ mkDerivation, ansi-terminal, array, base, blaze-builder
+     , blaze-html, blaze-markup, bytestring, Cabal, cabal-doctest
+     , charset, comonad, containers, deepseq, doctest, fingertree
+     , ghc-prim, hashable, lens, mtl, parsers, prettyprinter
+     , prettyprinter-ansi-terminal, profunctors, QuickCheck, reducers
+     , semigroups, transformers, unordered-containers, utf8-string
+     }:
+     mkDerivation {
+       pname = "trifecta";
+       version = "2.1";
+       sha256 = "0fr326lzf38m20h2g4189nsyml9w3128924zbd3cd93cgfqcc9bs";
+       setupHaskellDepends = [ base Cabal cabal-doctest ];
+       libraryHaskellDepends = [
+         ansi-terminal array base blaze-builder blaze-html blaze-markup
+         bytestring charset comonad containers deepseq fingertree ghc-prim
+         hashable lens mtl parsers prettyprinter prettyprinter-ansi-terminal
+         profunctors reducers semigroups transformers unordered-containers
+         utf8-string
+       ];
+       testHaskellDepends = [ base doctest parsers QuickCheck ];
+       description = "A modern parser combinator library with convenient diagnostics";
+       license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+     }) {};
+
   "trigger" = callPackage
     ({ mkDerivation, aeson, ansi-terminal, base, clock, directory
      , exceptions, filepath, formatting, fsnotify, Glob, hspec, process
@@ -242284,6 +242766,22 @@ self: {
        broken = true;
      }) {};
 
+  "urbit-hob" = callPackage
+    ({ mkDerivation, base, bytestring, cereal, containers, murmur3
+     , text
+     }:
+     mkDerivation {
+       pname = "urbit-hob";
+       version = "0.1.0";
+       sha256 = "01mrj3irlsqfxvswm00k893n6wybc6wxcqddd645wb9q5mpzdsqi";
+       libraryHaskellDepends = [
+         base bytestring cereal containers murmur3 text
+       ];
+       testHaskellDepends = [ base ];
+       description = "Hoon-style atom manipulation and printing functions";
+       license = stdenv.lib.licenses.mit;
+     }) {};
+
   "ureader" = callPackage
     ({ mkDerivation, ansi-wl-pprint, async, base, bytestring
      , containers, curl, data-default, deepseq, directory, download-curl
@@ -244400,6 +244898,8 @@ self: {
        pname = "vec";
        version = "0.1.1.1";
        sha256 = "0gzypyi4vv5ajysbmnpicm8r2qh95nmmrj9l6hp30b95i36cb5as";
+       revision = "1";
+       editedCabalFile = "137f3zjj0fwn3dmynvjg7k4v7k9h24a1gzqfma36hd2svksg8c3d";
        libraryHaskellDepends = [
          adjunctions base base-compat deepseq distributive fin hashable lens
          semigroupoids transformers
@@ -244533,6 +245033,8 @@ self: {
        pname = "vector-binary-instances";
        version = "0.2.5.1";
        sha256 = "04n5cqm1v95pw1bp68l9drjkxqiy2vswxdq0fy1rqcgxisgvji9r";
+       revision = "1";
+       editedCabalFile = "1p7cbxdpix0rakvggnnb06kcrb787fyyqlzric6i4s3rn34547q8";
        libraryHaskellDepends = [ base binary vector ];
        testHaskellDepends = [ base binary tasty tasty-quickcheck vector ];
        benchmarkHaskellDepends = [
diff --git a/pkgs/development/interpreters/php/default.nix b/pkgs/development/interpreters/php/default.nix
index 06adbdae802af..9a82868b7b3d3 100644
--- a/pkgs/development/interpreters/php/default.nix
+++ b/pkgs/development/interpreters/php/default.nix
@@ -254,8 +254,8 @@ let
 
 in {
   php72 = generic {
-    version = "7.2.21";
-    sha256 = "1vqldc2namfblwyv87fgpfffkjpzawfpcp48f40nfdl3pshq6c9l";
+    version = "7.2.22";
+    sha256 = "12phn0rrd5r1j6xlz83h7v6gszmj4lb5gwj927psbbc6nn1rh2n1";
 
     # https://bugs.php.net/bug.php?id=76826
     extraPatches = optional stdenv.isDarwin ./php72-darwin-isfinite.patch;
diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index 9ddd2028d910a..3494c8dee243d 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -1,5 +1,5 @@
 { stdenv, buildPackages, lib
-, fetchurl, fetchFromSavannah, fetchFromGitHub
+, fetchurl, fetchpatch, fetchFromSavannah, fetchFromGitHub
 , zlib, openssl, gdbm, ncurses, readline, groff, libyaml, libffi, autoreconfHook, bison
 , autoconf, libiconv, libobjc, libunwind, Foundation
 , buildEnv, bundler, bundix
@@ -34,7 +34,7 @@ let
     };
     self = lib.makeOverridable (
       { stdenv, buildPackages, lib
-      , fetchurl, fetchFromSavannah, fetchFromGitHub
+      , fetchurl, fetchpatch, fetchFromSavannah, fetchFromGitHub
       , useRailsExpress ? true
       , rubygemsSupport ? true
       , zlib, zlibSupport ? true
@@ -90,7 +90,7 @@ let
 
         patches =
           (import ./patchsets.nix {
-            inherit patchSet useRailsExpress ops;
+            inherit patchSet useRailsExpress ops fetchpatch;
             patchLevel = ver.patchLevel;
           }).${ver.majMinTiny};
 
@@ -211,14 +211,6 @@ let
     ) args; in self;
 
 in {
-  ruby_2_3 = generic {
-    version = rubyVersion "2" "3" "8" "";
-    sha256 = {
-      src = "1gwsqmrhpx1wanrfvrsj3j76rv888zh7jag2si2r14qf8ihns0dm";
-      git = "0158fg1sx6l6applbq0831kl8kzx5jacfl9lfg0shfzicmjlys3f";
-    };
-  };
-
   ruby_2_4 = generic {
     version = rubyVersion "2" "4" "7" "";
     sha256 = {
diff --git a/pkgs/development/interpreters/ruby/patchsets.nix b/pkgs/development/interpreters/ruby/patchsets.nix
index 62d8f53b3d3b4..56164de5b5f2b 100644
--- a/pkgs/development/interpreters/ruby/patchsets.nix
+++ b/pkgs/development/interpreters/ruby/patchsets.nix
@@ -1,4 +1,4 @@
-{ patchSet, useRailsExpress, ops, patchLevel }:
+{ patchSet, useRailsExpress, ops, patchLevel, fetchpatch }:
 
 {
   "2.3.8" = ops useRailsExpress [
@@ -16,7 +16,12 @@
     "${patchSet}/patches/ruby/2.5/head/railsexpress/02-improve-gc-stats.patch"
     "${patchSet}/patches/ruby/2.5/head/railsexpress/03-more-detailed-stacktrace.patch"
   ];
-  "2.6.4" = ops useRailsExpress [
+  "2.6.4" = [
+    (fetchpatch {
+      url = "https://git.ruby-lang.org/ruby.git/patch/?id=ade1283ca276f7d589ffd3539fbc7b9817f682d5";
+      sha256 = "1vgrckmzz0ykyxgzyp8fcifa93xz2hvyfil79bw1gc3xx94wnnxd";
+    })
+  ] ++ ops useRailsExpress [
     "${patchSet}/patches/ruby/2.6/head/railsexpress/01-fix-broken-tests-caused-by-ad.patch"
     "${patchSet}/patches/ruby/2.6/head/railsexpress/02-improve-gc-stats.patch"
     "${patchSet}/patches/ruby/2.6/head/railsexpress/03-more-detailed-stacktrace.patch"
diff --git a/pkgs/development/libraries/libgap/default.nix b/pkgs/development/libraries/libgap/default.nix
deleted file mode 100644
index b6a8ae3c8dfe2..0000000000000
--- a/pkgs/development/libraries/libgap/default.nix
+++ /dev/null
@@ -1,25 +0,0 @@
-{ stdenv
-, fetchurl
-, gmp
-}:
-# will probably be obsolte (or at leat built from the upstream gap sources) soon (gap 4.9?). See
-# - https://github.com/gap-system/gap/projects/5#card-6239828
-# - https://github.com/markuspf/gap/issues/2
-# - https://trac.sagemath.org/ticket/22626
-stdenv.mkDerivation rec {
-  pname = "libgap";
-  # Has to be the same version as "gap"
-  version = "4.8.6";
-  src = fetchurl {
-    url = "mirror://sageupstream/libgap/libgap-${version}.tar.gz";
-    sha256 = "1h5fx5a55857w583ql7ly2jl49qyx9mvs7j5abys00ra9gzrpn5v";
-  };
-  buildInputs = [gmp];
-  meta = {
-    inherit version;
-    description = ''A library-packaged fork of the GAP kernel'';
-    license = stdenv.lib.licenses.gpl3Plus;
-    maintainers = [stdenv.lib.maintainers.raskin];
-    platforms = stdenv.lib.platforms.linux;
-  };
-}
diff --git a/pkgs/development/libraries/qt-4.x/4.8/default.nix b/pkgs/development/libraries/qt-4.x/4.8/default.nix
index 8c1c76db8f47e..530b500f9d8b8 100644
--- a/pkgs/development/libraries/qt-4.x/4.8/default.nix
+++ b/pkgs/development/libraries/qt-4.x/4.8/default.nix
@@ -91,6 +91,12 @@ stdenv.mkDerivation rec {
       #})
       ./qt4-gcc6.patch
       ./qt4-openssl-1.1.patch
+      (fetchpatch {
+        name = "qt4-gcc8.diff";
+        url = "https://aur.archlinux.org/cgit/aur.git/plain/qt4-gcc8.patch?h=qt4&id=3ac369b8";
+        sha256 = "0zcdrlmanczr9cbrnc6f3nz6ldmj7rw5irlvndk89fl6fvj8zkwy";
+        extraPrefix = "./";
+      })
     ]
     ++ lib.optional gtkStyle (substituteAll ({
         src = ./dlopen-gtkstyle.diff;
diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index 4b8369456b75b..5adc239793938 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -1106,6 +1106,26 @@ luasystem = buildLuarocksPackage {
     };
   };
 };
+luautf8 = buildLuarocksPackage {
+  pname = "luautf8";
+  version = "0.1.1-1";
+
+  src = fetchurl {
+    url    = https://luarocks.org/luautf8-0.1.1-1.src.rock;
+    sha256 = "1832ilrlddh4h7ayx4l9j7z1p8c2hk5yr96cpxjjrmirkld23aji";
+  };
+  disabled = (luaOlder "5.1");
+  propagatedBuildInputs = [ lua ];
+
+  meta = with stdenv.lib; {
+    homepage = "http://github.com/starwing/luautf8";
+    description = "A UTF-8 support module for Lua";
+    maintainers = with maintainers; [ pstn ];
+    license = {
+      fullName = "MIT";
+    };
+  };
+};
 luazip = buildLuarocksPackage {
   pname = "luazip";
   version = "1.2.7-1";
@@ -1125,6 +1145,26 @@ luazip = buildLuarocksPackage {
     };
   };
 };
+lua-yajl = buildLuarocksPackage {
+  pname = "lua-yajl";
+  version = "2.0-1";
+
+  src = fetchurl {
+    url    = https://luarocks.org/lua-yajl-2.0-1.src.rock;
+    sha256 = "0bsm519vs53rchcdf8g96ygzdx2bz6pa4vffqlvc7ap49bg5np4f";
+  };
+  disabled = (luaOlder "5.1");
+  propagatedBuildInputs = [ lua ];
+
+  meta = with stdenv.lib; {
+    homepage = "http://github.com/brimworks/lua-yajl";
+    description = "Integrate the yajl JSON library with Lua.";
+    maintainers = with maintainers; [ pstn ];
+    license = {
+      fullName = "MIT/X11";
+    };
+  };
+};
 luuid = buildLuarocksPackage {
   pname = "luuid";
   version = "20120509-2";
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index a4c1c7fa324ef..233503c2eca86 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -235,6 +235,12 @@ with super;
     ];
   });
 
+  lua-yajl = super.lua-yajl.override({
+    buildInputs = [
+      pkgs.yajl
+    ];
+  });
+
   luuid = super.luuid.override(old: {
     externalDeps = [
       { name = "LIBUUID"; dep = pkgs.libuuid; }
diff --git a/pkgs/development/perl-modules/mhonarc.patch b/pkgs/development/perl-modules/mhonarc.patch
new file mode 100644
index 0000000000000..12b8cc2931b6f
--- /dev/null
+++ b/pkgs/development/perl-modules/mhonarc.patch
@@ -0,0 +1,26 @@
+diff --git a/lib/mhamain.pl b/lib/mhamain.pl
+index 80980a2..c1259ce 100644
+--- a/lib/mhamain.pl
++++ b/lib/mhamain.pl
+@@ -1562,7 +1562,7 @@ sub signal_catch {
+ ##
+ sub defineIndex2MsgId {
+     no warnings qw(deprecated);
+-    if (!defined(%Index2MsgId)) {
++    unless (%Index2MsgId) {
+ 	foreach (keys %MsgId) {
+ 	    $Index2MsgId{$MsgId{$_}} = $_;
+ 	}
+diff --git a/lib/mhopt.pl b/lib/mhopt.pl
+index 02fb05e..939109b 100644
+--- a/lib/mhopt.pl
++++ b/lib/mhopt.pl
+@@ -865,7 +865,7 @@ sub update_data_1_to_2 {
+ sub update_data_2_1_to_later {
+     no warnings qw(deprecated);
+     # we can preserve filter arguments
+-    if (defined(%main::MIMEFiltersArgs)) {
++    if (%main::MIMEFiltersArgs) {
+ 	warn qq/         preserving MIMEARGS...\n/;
+ 	%readmail::MIMEFiltersArgs = %main::MIMEFiltersArgs;
+ 	$IsDefault{'MIMEARGS'} = 0;
diff --git a/pkgs/development/python-modules/colorcet/default.nix b/pkgs/development/python-modules/colorcet/default.nix
index f92f8004ac00e..b877c4cabd5f7 100644
--- a/pkgs/development/python-modules/colorcet/default.nix
+++ b/pkgs/development/python-modules/colorcet/default.nix
@@ -34,9 +34,9 @@ buildPythonPackage rec {
     export HOME=$(mktemp -d)
     mkdir -p $HOME/.config/matplotlib
     echo "backend: ps" > $HOME/.config/matplotlib/matplotlibrc
+    ln -s $HOME/.config/matplotlib $HOME/.matplotlib
 
-    # disable matplotlib tests on darwin, because it requires a framework build of Python
-    pytest ${stdenv.lib.optionalString stdenv.isDarwin "--ignore=colorcet/tests/test_matplotlib.py"} colorcet
+    pytest colorcet
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/python-modules/django/1_11.nix b/pkgs/development/python-modules/django/1_11.nix
index 8b60155b50a0f..cfe0b89b92bf2 100644
--- a/pkgs/development/python-modules/django/1_11.nix
+++ b/pkgs/development/python-modules/django/1_11.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "Django";
-  version = "1.11.23";
+  version = "1.11.24";
 
   src = fetchurl {
     url = "https://www.djangoproject.com/m/releases/1.11/${pname}-${version}.tar.gz";
-    sha256 = "1qb9npkpvyafd1f4yjqyzhj78wp1ifg3awj41bd04v83idznv9jj";
+    sha256 = "1qw97zcsnbnn9dqad1kps48vfaifdkvqb8c3vld6nnvp7x2jfp11";
   };
 
   patches = stdenv.lib.optionals withGdal [
diff --git a/pkgs/development/python-modules/elasticsearch-curator/default.nix b/pkgs/development/python-modules/elasticsearch-curator/default.nix
index d517af949d472..e95d1aaba0223 100644
--- a/pkgs/development/python-modules/elasticsearch-curator/default.nix
+++ b/pkgs/development/python-modules/elasticsearch-curator/default.nix
@@ -45,6 +45,10 @@ buildPythonPackage rec {
     funcsigs
   ];
 
+  postPatch = ''
+    sed -i s/pyyaml==3.12/pyyaml==${pyyaml.version}/ setup.cfg setup.py
+  '';
+
   meta = with stdenv.lib; {
     homepage = https://github.com/elastic/curator;
     description = "Curate, or manage, your Elasticsearch indices and snapshots";
diff --git a/pkgs/development/python-modules/httpretty/default.nix b/pkgs/development/python-modules/httpretty/default.nix
index cf78a6185365e..3a76bd9f148b0 100644
--- a/pkgs/development/python-modules/httpretty/default.nix
+++ b/pkgs/development/python-modules/httpretty/default.nix
@@ -36,6 +36,7 @@ buildPythonPackage rec {
   NOSE_EXCLUDE = stdenv.lib.concatStringsSep "," [
     "tests.functional.test_httplib2.test_callback_response"
     "tests.functional.test_requests.test_streaming_responses"
+    "tests.functional.test_httplib2.test_callback_response"
   ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/python-modules/pybind11/default.nix b/pkgs/development/python-modules/pybind11/default.nix
index 25ef662edef96..37e55617023c7 100644
--- a/pkgs/development/python-modules/pybind11/default.nix
+++ b/pkgs/development/python-modules/pybind11/default.nix
@@ -33,6 +33,8 @@ buildPythonPackage rec {
     })
   ];
 
+  dontUseCmakeConfigure = true;
+
   checkInputs = [ pytest cmake ]
     ++ (lib.optional (numpy != null) numpy)
     ++ (lib.optional (eigen != null) eigen)
diff --git a/pkgs/development/python-modules/pytest-mpl/default.nix b/pkgs/development/python-modules/pytest-mpl/default.nix
index 37ba58977e151..edf0450366c5d 100644
--- a/pkgs/development/python-modules/pytest-mpl/default.nix
+++ b/pkgs/development/python-modules/pytest-mpl/default.nix
@@ -26,13 +26,11 @@ buildPythonPackage rec {
     pytest
   ];
 
-  # disable tests on darwin, because it requires a framework build of Python
-  doCheck = !stdenv.isDarwin;
-
   checkPhase = ''
     export HOME=$(mktemp -d)
     mkdir -p $HOME/.config/matplotlib
     echo "backend: ps" > $HOME/.config/matplotlib/matplotlibrc
+    ln -s $HOME/.config/matplotlib $HOME/.matplotlib
 
     pytest
   '';
diff --git a/pkgs/development/python-modules/rfc6555/default.nix b/pkgs/development/python-modules/rfc6555/default.nix
new file mode 100644
index 0000000000000..0bd7b0ca686c9
--- /dev/null
+++ b/pkgs/development/python-modules/rfc6555/default.nix
@@ -0,0 +1,28 @@
+{ stdenv, buildPythonPackage, fetchPypi, pythonPackages }:
+
+buildPythonPackage rec {
+  pname = "rfc6555";
+  version = "0.0.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "05sjrd6jc0sdvx0z7d3llk82rx366jlmc7ijam0nalsv66hbn70r";
+  };
+
+  propagatedBuildInputs = with pythonPackages; [ selectors2 ];
+
+  checkInputs = with pythonPackages; [ mock pytest ];
+  # disabling tests that require a functional DNS IPv{4,6} stack to pass.
+  patches = [ ./disable_network_tests.patch ];
+  # default doCheck = true; is not enough, apparently
+  postCheck = ''
+    py.test tests/
+  '';
+
+  meta = {
+    description = "Python implementation of the Happy Eyeballs Algorithm";
+    homepage = "https://pypi.org/project/rfc6555";
+    license = stdenv.lib.licenses.asl20;
+    maintainers = with stdenv.lib.maintainers; [ endocrimes ];
+  };
+}
diff --git a/pkgs/development/python-modules/rfc6555/disable_network_tests.patch b/pkgs/development/python-modules/rfc6555/disable_network_tests.patch
new file mode 100644
index 0000000000000..dc59111ac43f0
--- /dev/null
+++ b/pkgs/development/python-modules/rfc6555/disable_network_tests.patch
@@ -0,0 +1,31 @@
+diff --git a/tests/test_create_connection.py b/tests/test_create_connection.py
+index fe38026..cdb26b4 100644
+--- a/tests/test_create_connection.py
++++ b/tests/test_create_connection.py
+@@ -6,10 +6,12 @@ from .test_utils import requires_network
+ 
+ 
+ class _BasicCreateConnectionTests(object):
++
+     @requires_network
+     def test_create_connection_google(self):
+         sock = rfc6555.create_connection(('www.google.com', 80))
+ 
++    @requires_network
+     @pytest.mark.parametrize('timeout', [None, 5.0])
+     def test_create_connection_has_proper_timeout(self, timeout):
+         sock = rfc6555.create_connection(('www.google.com', 80), timeout=timeout)
+diff --git a/tests/test_ipv6.py b/tests/test_ipv6.py
+index 3ee8564..f0db28e 100644
+--- a/tests/test_ipv6.py
++++ b/tests/test_ipv6.py
+@@ -2,7 +2,9 @@ import socket
+ import mock
+ import rfc6555
+ 
++from .test_utils import requires_network
+ 
++@requires_network
+ def test_ipv6_available():
+     assert rfc6555._detect_ipv6()
+ 
diff --git a/pkgs/development/python-modules/sphinx/default.nix b/pkgs/development/python-modules/sphinx/default.nix
index 4bea277a95b3d..1e69692eac1e7 100644
--- a/pkgs/development/python-modules/sphinx/default.nix
+++ b/pkgs/development/python-modules/sphinx/default.nix
@@ -22,6 +22,7 @@
 , requests
 , sphinxcontrib-websupport
 , typing
+, setuptools
 }:
 
 buildPythonPackage rec {
@@ -46,6 +47,7 @@ buildPythonPackage rec {
     pygments
     alabaster
     Babel
+    setuptools
     snowballstemmer
     six
     sqlalchemy
diff --git a/pkgs/development/tools/analysis/tflint/default.nix b/pkgs/development/tools/analysis/tflint/default.nix
index 5099505cc5b09..7dca029d557e2 100644
--- a/pkgs/development/tools/analysis/tflint/default.nix
+++ b/pkgs/development/tools/analysis/tflint/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "tflint";
-  version = "0.10.3";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "wata727";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1p4w1ddgb4nqibbrvix0p0gdlj6ann5lkyvlcsbkn25z8ha3qa39";
+    sha256 = "0aff7ckl245cyjs2rbgczkqlp2x6g4g458p4li0k1agk3m9bbq35";
   };
 
-  modSha256 = "1snanz4cpqkfgxp8k52w3x4i49k6d5jffcffrcx8xya8yvx2wxy3";
+  modSha256 = "1facqppgpmmz2j7j77fa3mnjv2nzjxz4ya6xvyvyy92ma0ybclgh";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/development/tools/misc/kibana/6.x.nix b/pkgs/development/tools/misc/kibana/6.x.nix
index 635be9e087680..f7da3521aa1e4 100644
--- a/pkgs/development/tools/misc/kibana/6.x.nix
+++ b/pkgs/development/tools/misc/kibana/6.x.nix
@@ -18,12 +18,12 @@ let
   shas =
     if enableUnfree
     then {
-      x86_64-linux  = "1i3zmzxihplwd8n994lfxhhgygdg3qxjqgrj1difa8w3vss0zbfn";
-      x86_64-darwin = "09a96ms9id77infxd9xxfs6r7j01mn0rz5yw3g9sl92j9ri7r52c";
+      "x86_64-linux"  = "1xwklhqxk5rmdrgy2simwvijzq29kyq5w2w3hy53xh2i1zlnyvq3";
+      "x86_64-darwin" = "1qpdn28mrpggd55khzqqld6r89l0hb870rigxcw2i8p2yx3jv106";
     }
     else {
-      x86_64-linux  = "166rhxr0qlv1yarj2mg1c3b8mxvhl70jhz53azq7ic6laj55q7fk";
-      x86_64-darwin = "0ngngkbl036p2mzwhp8qafi3aqzk398a218w12srfqny5n630vdk";
+      "x86_64-linux"  = "1wpnwal2rq5v2bsp5qil9j6dplif7ql5394sy4ia5ghp2fzifxmf";
+      "x86_64-darwin" = "12z8i0wbw10c097glbpdy350p0h3957433f51qfx2p0ghgkzkhzv";
     };
 
 in stdenv.mkDerivation rec {
diff --git a/pkgs/development/tools/misc/kibana/7.x.nix b/pkgs/development/tools/misc/kibana/7.x.nix
index 2fc0242c014b6..fb4dca8d5490a 100644
--- a/pkgs/development/tools/misc/kibana/7.x.nix
+++ b/pkgs/development/tools/misc/kibana/7.x.nix
@@ -18,12 +18,12 @@ let
   shas =
     if enableUnfree
     then {
-      x86_64-linux  = "1mzycd0ljnkslz9p9jhq279bkpk35r7svhngxjnmsh11ampsvxb8";
-      x86_64-darwin = "1bz409njdpmsagh5dg062114wpa96w7pmxwfjsizwksqyyjdwdv7";
+      "x86_64-linux"  = "0sc5709k3z7lb8qcjpj49s6vfv69ds2wc8319ag9x776nyz1pqxi";
+      "x86_64-darwin" = "0zh4q46vfdwaihs838ck8fap92i3b4x10wbpmx8mcwyfk5v0fkch";
     }
     else {
-      x86_64-linux  = "1x3gjc9xa03m4jfnl5vjxigzcnb8ysnhxgd8618v85x4l0010v38";
-      x86_64-darwin = "1nsbmrswv2jv2z7686i2sf6rrmxysbqi5ih6jjrbrqnk64xi18j2";
+      "x86_64-linux"  = "1pq17fasryharvw4byybvmcf5172hcmy6cp0m8bxhkxagwilprba";
+      "x86_64-darwin" = "11crpx2qs2nzkzv6fvs1gqn9v4zalxkzsc5br0fy1y02lzm26zbm";
     };
 
 in stdenv.mkDerivation rec {
@@ -32,14 +32,14 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://artifacts.elastic.co/downloads/kibana/${name}-${plat}-${arch}.tar.gz";
-    sha256 = shas.${stdenv.hostPlatform.system} or (throw "Unknown architecture");
+    sha256 = shas."${stdenv.hostPlatform.system}" or (throw "Unknown architecture");
   };
 
   patches = [
     # Kibana specifies it specifically needs nodejs 10.15.2 but nodejs in nixpkgs is at 10.15.3.
     # The <nixpkgs/nixos/tests/elk.nix> test succeeds with this newer version so lets just
     # disable the version check.
-    ./disable-nodejs-version-check.patch
+    ./disable-nodejs-version-check-7.patch
   ];
 
   buildInputs = [ makeWrapper ];
diff --git a/pkgs/development/tools/misc/kibana/disable-nodejs-version-check-7.patch b/pkgs/development/tools/misc/kibana/disable-nodejs-version-check-7.patch
new file mode 100644
index 0000000000000..ef4c207764c1f
--- /dev/null
+++ b/pkgs/development/tools/misc/kibana/disable-nodejs-version-check-7.patch
@@ -0,0 +1,19 @@
+diff --git a/src/setup_node_env/node_version_validator.js b/src/setup_node_env/node_version_validator.js
+index 3f611e5a..f5c60c85 100644
+--- a/src/setup_node_env/node_version_validator.js
++++ b/src/setup_node_env/node_version_validator.js
+@@ -25,11 +25,11 @@ var pkg = require('../../package.json'); // Note: This is written in ES5 so we c
+ var currentVersion = process && process.version || null;
+ var rawRequiredVersion = pkg && pkg.engines && pkg.engines.node || null;
+ var requiredVersion = rawRequiredVersion ? 'v' + rawRequiredVersion : rawRequiredVersion;
+-var isVersionValid = !!currentVersion && !!requiredVersion && currentVersion === requiredVersion; // Validates current the NodeJS version compatibility when Kibana starts.
++var isVersionValid = !!currentVersion && !!requiredVersion; // Validates current the NodeJS version compatibility when Kibana starts.
+ 
+ if (!isVersionValid) {
+   var errorMessage = 'Kibana does not support the current Node.js version ' + currentVersion + '. Please use Node.js ' + requiredVersion + '.'; // Actions to apply when validation fails: error report + exit.
+ 
+   console.error(errorMessage);
+   process.exit(1);
+-}
+\ No newline at end of file
++}
diff --git a/pkgs/development/tools/misc/luarocks/default.nix b/pkgs/development/tools/misc/luarocks/default.nix
index 2e0eec5ae57d5..fa19b2494076c 100644
--- a/pkgs/development/tools/misc/luarocks/default.nix
+++ b/pkgs/development/tools/misc/luarocks/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl
+{stdenv, fetchFromGitHub
 , curl, makeWrapper, which, unzip
 , lua
 # for 'luarocks pack'
@@ -9,11 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "luarocks";
-  version = "3.1.3";
+  version = "3.2.1";
 
-  src = fetchurl {
-    url="http://luarocks.org/releases/luarocks-${version}.tar.gz";
-    sha256="04q5k6drypsnbp1wspr9ns72k8kjf62a787a6jg1bb2s95gl6wy5";
+  src = fetchFromGitHub {
+    owner = "luarocks";
+    repo = "luarocks";
+    rev = "v${version}";
+    sha256 = "0viiafmb8binksda79ah828q1dfnb6jsqlk7vyndl2xvx9yfn4y2";
   };
 
   patches = [ ./darwin-3.1.3.patch ];
diff --git a/pkgs/development/tools/repository-managers/nexus/default.nix b/pkgs/development/tools/repository-managers/nexus/default.nix
index 44654e052d1b3..acf9d03843d08 100644
--- a/pkgs/development/tools/repository-managers/nexus/default.nix
+++ b/pkgs/development/tools/repository-managers/nexus/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "nexus";
-  version = "3.16.1-02";
+  version = "3.18.1-01";
 
   src = fetchurl {
     url = "https://sonatype-download.global.ssl.fastly.net/nexus/3/nexus-${version}-unix.tar.gz";
-    sha256 = "0nfcpsb7byykiwrdz01c99a6hr5ww2d4471spzpgs9i64kbjj7ln";
+    sha256 = "0z3hb1ha0yvi09hrndrzzh95g3m42pfsi0gzw7hfx9r0n8r2qgkd";
   };
 
   sourceRoot = "${pname}-${version}";
diff --git a/pkgs/games/mudlet/default.nix b/pkgs/games/mudlet/default.nix
index 4dcc7a6262f07..dc29c3d5f744f 100644
--- a/pkgs/games/mudlet/default.nix
+++ b/pkgs/games/mudlet/default.nix
@@ -1,46 +1,62 @@
-{ fetchurl, unzip, stdenv, makeWrapper, qtbase, yajl, libzip, hunspell
-, boost, lua5_1, luafilesystem, luazip, lrexlib-pcre, luasql-sqlite3, qmake }:
+{ fetchFromGitHub, fetchpatch, stdenv, wrapQtAppsHook, pcre, pugixml, qtbase, qtmultimedia, qttools, yajl, libzip, hunspell
+, boost, libGLU, lua, cmake,  which, }:
 
+let
+  luaEnv = lua.withPackages(ps: with ps; [ luazip luafilesystem lrexlib-pcre luasql-sqlite3 lua-yajl luautf8 ]);
+in
 stdenv.mkDerivation rec {
   pname = "mudlet";
-  version = "3.0.0-delta";
-
-  src = fetchurl {
-    url = "https://github.com/Mudlet/Mudlet/archive/Mudlet-${version}.tar.gz";
-    sha256 = "08fhqd323kgz5s17ac5z9dhkjxcmwvcmvhzy0x1vw4rayhijfrd7";
+  version = "4.0.3";
+
+  src = fetchFromGitHub {
+    owner = "Mudlet";
+    repo = "Mudlet";
+    rev = "Mudlet-${version}";
+    fetchSubmodules = true;
+    sha256 = "18bl4k0qgh47d9k5ipfvypfj1il678c0ws64a8adn8k21jajzkik";
   };
 
-  nativeBuildInputs = [ makeWrapper qmake ];
+  patches = [
+    ( fetchpatch {
+      url = "https://github.com/Mudlet/Mudlet/commit/3c8f12b6d757894d92ec2e2c9b12b91f69e8a3b6.patch";
+      name = "hunspell-1.7";
+      sha256 = "09qggls4pzpd8h9h10fbpfd7x3kr7fjp9axdwz98igpwy714n98j";
+    })
+  ];
+
+  nativeBuildInputs = [ cmake wrapQtAppsHook qttools which ];
   buildInputs = [
-    unzip qtbase lua5_1 hunspell libzip yajl boost
-    luafilesystem luazip lrexlib-pcre luasql-sqlite3
+    pcre pugixml qtbase qtmultimedia luaEnv libzip libGLU yajl boost hunspell
   ];
 
-  preConfigure = "cd src";
+  WITH_FONTS = "NO";
+  WITH_UPDATER = "NO";
+
+  enableParallelBuilding = true;
 
-  installPhase = let
-    luaZipPath = "${luazip}/lib/lua/5.1/?.so";
-    luaFileSystemPath = "${luafilesystem}/lib/lua/5.1/?.so";
-    lrexlibPath = "${lrexlib-pcre}/lib/lua/5.1/?.so";
-    luasqlitePath = "${luasql-sqlite3}/lib/lua/5.1/?.so";
-  in ''
+  installPhase =  ''
     mkdir -pv $out/bin
-    cp mudlet $out
-    cp -r mudlet-lua $out
+    cp src/mudlet $out
+    mkdir -pv $out/share/mudlet
+    cp -r ../src/mudlet-lua/lua $out/share/mudlet/
 
-    makeWrapper $out/mudlet $out/bin/mudlet \
-      --set LUA_CPATH "${luaFileSystemPath};${luaZipPath};${lrexlibPath};${luasqlitePath}" \
+    mkdir -pv $out/share/applications
+    cp ../mudlet.desktop $out/share/applications/
+
+    mkdir -pv $out/share/pixmaps
+    cp -r ../mudlet.png $out/share/pixmaps/
+
+    makeQtWrapper $out/mudlet $out/bin/mudlet \
+      --set LUA_CPATH "${luaEnv}/lib/lua/${lua.luaversion}/?.so" \
+      --prefix LUA_PATH : "$NIX_LUA_PATH" \
       --run "cd $out";
   '';
 
-  patches = [ ./libs.patch ];
-
-  meta = {
+  meta = with stdenv.lib; {
     description = "Crossplatform mud client";
     homepage = http://mudlet.org/;
-    maintainers = [ stdenv.lib.maintainers.wyvie ];
-    platforms = stdenv.lib.platforms.linux;
-    license = stdenv.lib.licenses.gpl2;
-    broken = true;
+    maintainers = [ maintainers.wyvie maintainers.pstn ];
+    platforms = platforms.linux;
+    license = licenses.gpl2;
   };
 }
diff --git a/pkgs/games/mudlet/libs.patch b/pkgs/games/mudlet/libs.patch
deleted file mode 100644
index 45b693828ff22..0000000000000
--- a/pkgs/games/mudlet/libs.patch
+++ /dev/null
@@ -1,13 +0,0 @@
---- a/src/src.pro	2014-09-05 12:51:09.000000000 +0400
-+++ b/src/src.pro	2014-09-15 16:54:34.812560065 +0400
-@@ -85,8 +85,8 @@
- # Again according to FHS /usr/local/share/games is the corresponding place for locally built games documentation:
-     isEmpty( DOCDIR ) DOCDIR = $${DATAROOTDIR}/doc/mudlet
-     LIBS += -lpcre \
--        -llua5.1 \
--        -lhunspell \
-+        -llua \
-+        -lhunspell-1.6 \
-         -L/usr/local/lib/ \
-         -lyajl \
-         -lGLU \
diff --git a/pkgs/misc/logging/beats/6.x.nix b/pkgs/misc/logging/beats/6.x.nix
index 2f7e38692eb1a..fe1f655246efd 100644
--- a/pkgs/misc/logging/beats/6.x.nix
+++ b/pkgs/misc/logging/beats/6.x.nix
@@ -8,7 +8,7 @@ let beat = package : extraArgs : buildGoPackage (rec {
         owner = "elastic";
         repo = "beats";
         rev = "v${version}";
-        sha256 = "0if08dxibdnqpsxs8f6hvw147j0j8bavhcm11scn28j9id65absq";
+        sha256 = "0jkiz5dfdi9zsji04ipcmcj7pml9294v455y7s2c22k24gyzbaw8";
       };
 
       goPackagePath = "github.com/elastic/beats";
diff --git a/pkgs/misc/logging/beats/7.x.nix b/pkgs/misc/logging/beats/7.x.nix
index 12e08dfeec699..7d0feef386828 100644
--- a/pkgs/misc/logging/beats/7.x.nix
+++ b/pkgs/misc/logging/beats/7.x.nix
@@ -8,7 +8,7 @@ let beat = package : extraArgs : buildGoPackage (rec {
         owner = "elastic";
         repo = "beats";
         rev = "v${version}";
-        sha256 = "1ca6a4zm062jpqwhmd8ivvzha1cvrw7mg5342vnmn99xdlr1pk9j";
+        sha256 = "0715fgqw6mqms4zld8wyf6appvvpfb1hglcmcn852c66a8zwr2r2";
       };
 
       goPackagePath = "github.com/elastic/beats";
diff --git a/pkgs/os-specific/linux/firmware/fwupd/default.nix b/pkgs/os-specific/linux/firmware/fwupd/default.nix
index b4d5d54137cd1..c688d8c6ab393 100644
--- a/pkgs/os-specific/linux/firmware/fwupd/default.nix
+++ b/pkgs/os-specific/linux/firmware/fwupd/default.nix
@@ -1,18 +1,68 @@
-{ stdenv, fetchurl, substituteAll, gtk-doc, pkgconfig, gobject-introspection, intltool
-, libgudev, polkit, libxmlb, gusb, sqlite, libarchive, glib-networking
-, libsoup, help2man, gpgme, libxslt, elfutils, libsmbios, efivar, gnu-efi
-, libyaml, valgrind, meson, libuuid, colord, docbook_xml_dtd_43, docbook_xsl
-, ninja, gcab, gnutls, python3, wrapGAppsHook, json-glib, bash-completion
-, shared-mime-info, umockdev, vala, makeFontsConf, freefont_ttf
-, cairo, freetype, fontconfig, pango
-, bubblewrap, efibootmgr, flashrom, tpm2-tools
-}:
-
 # Updating? Keep $out/etc synchronized with passthru.filesInstalledToEtc
 
+{ stdenv
+, fetchurl
+, substituteAll
+, gtk-doc
+, pkgconfig
+, gobject-introspection
+, intltool
+, libgudev
+, polkit
+, libxmlb
+, gusb
+, sqlite
+, libarchive
+, glib-networking
+, libsoup
+, help2man
+, gpgme
+, libxslt
+, elfutils
+, libsmbios
+, efivar
+, gnu-efi
+, libyaml
+, valgrind
+, meson
+, libuuid
+, colord
+, docbook_xml_dtd_43
+, docbook_xsl
+, ninja
+, gcab
+, gnutls
+, python3
+, wrapGAppsHook
+, json-glib
+, bash-completion
+, shared-mime-info
+, umockdev
+, vala
+, makeFontsConf
+, freefont_ttf
+, cairo
+, freetype
+, fontconfig
+, pango
+, bubblewrap
+, efibootmgr
+, flashrom
+, tpm2-tools
+, nixosTests
+}:
+
 let
-  python = python3.withPackages (p: with p; [ pygobject3 pycairo pillow ]);
-  installedTestsPython = python3.withPackages (p: with p; [ pygobject3 requests ]);
+  python = python3.withPackages (p: with p; [
+    pygobject3
+    pycairo
+    pillow
+  ]);
+
+  installedTestsPython = python3.withPackages (p: with p; [
+    pygobject3
+    requests
+  ]);
 
   fontsConf = makeFontsConf {
     fontDirectories = [ freefont_ttf ];
@@ -26,30 +76,70 @@ let
   # only redfish for x86_64
   haveRedfish = stdenv.isx86_64;
 
-  # Currently broken on Aarch64
-  haveFlashrom = isx86;
+  # # Currently broken on Aarch64
+  # haveFlashrom = isx86;
+  # Experimental in 1.2.10
+  haveFlashrom = false;
 
-in stdenv.mkDerivation rec {
+in
+
+stdenv.mkDerivation rec {
   pname = "fwupd";
-  version = "1.2.8";
+  version = "1.2.10";
 
   src = fetchurl {
     url = "https://people.freedesktop.org/~hughsient/releases/fwupd-${version}.tar.xz";
-    sha256 = "0qbvq52c0scn1h99i1rf2la6rrhckin6gb02k7l0v3g07mxs20wc";
+    sha256 = "0inngs7i48akm9c7fmdsf9zjif595rkaba69rl76jfwfv8r21vjb";
   };
 
   outputs = [ "out" "lib" "dev" "devdoc" "man" "installedTests" ];
 
   nativeBuildInputs = [
-    meson ninja gtk-doc pkgconfig gobject-introspection intltool shared-mime-info
-    valgrind gcab docbook_xml_dtd_43 docbook_xsl help2man libxslt python wrapGAppsHook vala
+    meson
+    ninja
+    gtk-doc
+    pkgconfig
+    gobject-introspection
+    intltool
+    shared-mime-info
+    valgrind
+    gcab
+    docbook_xml_dtd_43
+    docbook_xsl
+    help2man
+    libxslt
+    python
+    wrapGAppsHook
+    vala
   ];
 
   buildInputs = [
-    polkit libxmlb gusb sqlite libarchive libsoup elfutils gnu-efi libyaml
-    libgudev colord gpgme libuuid gnutls glib-networking json-glib umockdev
-    bash-completion cairo freetype fontconfig pango efivar
-  ] ++ stdenv.lib.optionals haveDell [ libsmbios ];
+    polkit
+    libxmlb
+    gusb
+    sqlite
+    libarchive
+    libsoup
+    elfutils
+    gnu-efi
+    libyaml
+    libgudev
+    colord
+    gpgme
+    libuuid
+    gnutls
+    glib-networking
+    json-glib
+    umockdev
+    bash-completion
+    cairo
+    freetype
+    fontconfig
+    pango
+    efivar
+  ] ++ stdenv.lib.optionals haveDell [
+    libsmbios
+  ];
 
   patches = [
     ./fix-paths.patch
@@ -65,7 +155,12 @@ in stdenv.mkDerivation rec {
   ];
 
   postPatch = ''
-    patchShebangs .
+    patchShebangs \
+      libfwupd/generate-version-script.py \
+      meson_post_install.sh \
+      po/make-images \
+      po/make-images.sh \
+      po/test-deps
 
     # we cannot use placeholder in substituteAll
     # https://github.com/NixOS/nix/issues/1846
@@ -85,9 +180,12 @@ in stdenv.mkDerivation rec {
   # doCheck = true;
 
   preFixup = let
-    binPath = [ efibootmgr bubblewrap tpm2-tools ] ++ stdenv.lib.optional haveFlashrom flashrom;
-  in
-  ''
+    binPath = [
+      efibootmgr
+      bubblewrap
+      tpm2-tools
+    ] ++ stdenv.lib.optional haveFlashrom flashrom;
+  in ''
     gappsWrapperArgs+=(
       --prefix XDG_DATA_DIRS : "${shared-mime-info}/share"
       # See programs reached with fu_common_find_program_in_path in source
@@ -128,6 +226,10 @@ in stdenv.mkDerivation rec {
 
   FONTCONFIG_FILE = fontsConf; # Fontconfig error: Cannot load default config file
 
+  # error: “PolicyKit files are missing”
+  # https://github.com/NixOS/nixpkgs/pull/67625#issuecomment-525788428
+  PKG_CONFIG_POLKIT_GOBJECT_1_ACTIONDIR = "/run/current-system/sw/share/polkit-1/actions";
+
   # TODO: wrapGAppsHook wraps efi capsule even though it is not elf
   dontWrapGApps = true;
   # so we need to wrap the executables manually
@@ -157,11 +259,15 @@ in stdenv.mkDerivation rec {
       "pki/fwupd-metadata/GPG-KEY-Linux-Vendor-Firmware-Service"
       "pki/fwupd-metadata/LVFS-CA.pem"
     ];
+
+    tests = {
+      installedTests = nixosTests.fwupd;
+    };
   };
 
   meta = with stdenv.lib; {
     homepage = https://fwupd.org/;
-    maintainers = with maintainers; [];
+    maintainers = with maintainers; [ jtojnar ];
     license = [ licenses.gpl2 ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/upower/default.nix b/pkgs/os-specific/linux/upower/default.nix
index 59e39f72f5100..d787acae61b46 100644
--- a/pkgs/os-specific/linux/upower/default.nix
+++ b/pkgs/os-specific/linux/upower/default.nix
@@ -1,53 +1,58 @@
 { stdenv
 , fetchurl
 , pkgconfig
-, dbus-glib
-, intltool
 , libxslt
 , docbook_xsl
 , udev
 , libgudev
 , libusb1
+, glib
 , gobject-introspection
-, useSystemd ? true, systemd
+, gettext
+, systemd
+, useIMobileDevice ? true
+, libimobiledevice
 }:
 
 stdenv.mkDerivation {
   pname = "upower";
-  version = "0.99.10";
+  version = "0.99.11";
+
+  outputs = [ "out" "dev" ];
 
   src = fetchurl {
-    url = https://gitlab.freedesktop.org/upower/upower/uploads/c438511024b9bc5a904f8775cfc8e4c4/upower-0.99.10.tar.xz;
-    sha256 = "17d2bclv5fgma2y3g8bsn9pdvspn1zrzismzdnzfivc0f2wm28k4";
+    url = https://gitlab.freedesktop.org/upower/upower/uploads/93cfe7c8d66ed486001c4f3f55399b7a/upower-0.99.11.tar.xz;
+    sha256 = "1vxxvmz2cxb1qy6ibszaz5bskqdy9nd9fxspj9fv3gfmrjzzzdb4";
   };
 
   nativeBuildInputs = [
+    docbook_xsl
+    gettext
+    gobject-introspection
+    libxslt
     pkgconfig
   ];
 
   buildInputs = [
-    dbus-glib
-    intltool
-    libxslt
-    docbook_xsl
-    udev
     libgudev
     libusb1
-    gobject-introspection
+    udev
+    systemd
   ]
-  ++ stdenv.lib.optional useSystemd systemd
+  ++ stdenv.lib.optional useIMobileDevice libimobiledevice
   ;
 
+  propagatedBuildInputs = [
+    glib
+  ];
+
   configureFlags = [
-    "--with-backend=linux"
     "--localstatedir=/var"
-  ]
-  ++ stdenv.lib.optional useSystemd [
+    "--with-backend=linux"
     "--with-systemdsystemunitdir=${placeholder "out"}/etc/systemd/system"
     "--with-systemdutildir=${placeholder "out"}/lib/systemd"
     "--with-udevrulesdir=${placeholder "out"}/lib/udev/rules.d"
-  ]
-  ;
+  ];
 
   doCheck = false; # fails with "env: './linux/integration-test': No such file or directory"
 
diff --git a/pkgs/servers/dns/powerdns/default.nix b/pkgs/servers/dns/powerdns/default.nix
index 76c346180cdbb..1b23f65202152 100644
--- a/pkgs/servers/dns/powerdns/default.nix
+++ b/pkgs/servers/dns/powerdns/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, pkgconfig
-, boost, libyamlcpp, libsodium, sqlite, protobuf, botan2, libressl
+, boost, libyamlcpp, libsodium, sqlite, protobuf, botan2, openssl
 , mysql57, postgresql, lua, openldap, geoip, curl, opendbx, unixODBC
 }:
 
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
     boost mysql57.connector-c postgresql lua openldap sqlite protobuf geoip
-    libyamlcpp libsodium curl opendbx unixODBC botan2 libressl
+    libyamlcpp libsodium curl opendbx unixODBC botan2 openssl
   ];
 
   # nix destroy with-modules arguments, when using configureFlags
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
       "--with-modules=bind gmysql geoip godbc gpgsql gsqlite3 ldap lua mydns opendbx pipe random remote"
       --with-sqlite3
       --with-socketdir=/var/lib/powerdns
-      --with-libcrypto=${libressl.dev}
+      --with-libcrypto=${openssl.dev}
       --enable-libsodium
       --enable-botan
       --enable-tools
diff --git a/pkgs/servers/http/unit/default.nix b/pkgs/servers/http/unit/default.nix
index 0c0f118d0b91e..1dbf7eb2388b1 100644
--- a/pkgs/servers/http/unit/default.nix
+++ b/pkgs/servers/http/unit/default.nix
@@ -4,7 +4,6 @@
 , withPHP73 ? false, php73
 , withPerl ? true, perl
 , withPerldevel ? false, perldevel
-, withRuby_2_3 ? false, ruby_2_3
 , withRuby_2_4 ? false, ruby_2_4
 , withRuby ? true, ruby
 , withSSL ? true, openssl ? null
@@ -33,7 +32,6 @@ stdenv.mkDerivation rec {
     ++ optional withPHP73 php73
     ++ optional withPerl perl
     ++ optional withPerldevel perldevel
-    ++ optional withRuby_2_3 ruby_2_3
     ++ optional withRuby_2_4 ruby_2_4
     ++ optional withRuby ruby
     ++ optional withSSL openssl;
@@ -53,7 +51,6 @@ stdenv.mkDerivation rec {
     ${optionalString withPHP73      "./configure php     --module=php73     --config=${php73.dev}/bin/php-config  --lib-path=${php73}/lib"}
     ${optionalString withPerl       "./configure perl    --module=perl      --perl=${perl}/bin/perl"}
     ${optionalString withPerldevel  "./configure perl    --module=perl529   --perl=${perldevel}/bin/perl"}
-    ${optionalString withRuby_2_3   "./configure ruby    --module=ruby23    --ruby=${ruby_2_3}/bin/ruby"}
     ${optionalString withRuby_2_4   "./configure ruby    --module=ruby24    --ruby=${ruby_2_4}/bin/ruby"}
     ${optionalString withRuby       "./configure ruby    --module=ruby      --ruby=${ruby}/bin/ruby"}
   '';
diff --git a/pkgs/servers/search/elasticsearch/6.x.nix b/pkgs/servers/search/elasticsearch/6.x.nix
index fffc84b2d2815..04e81fe150a9d 100644
--- a/pkgs/servers/search/elasticsearch/6.x.nix
+++ b/pkgs/servers/search/elasticsearch/6.x.nix
@@ -19,8 +19,8 @@ stdenv.mkDerivation (rec {
     url = "https://artifacts.elastic.co/downloads/elasticsearch/${name}.tar.gz";
     sha256 =
       if enableUnfree
-      then "1a88yyl0x4bsx92m3wjsz1fgm76gbfdzcd4bzp2x652rha667vfh"
-      else "04fa0fk25d5yxcjdj0bwqvdrswgwj31fwjvbq4gpg66c6bqwzcn6";
+      then "09dy3iyzk460vra6na6vk7d3mzpbv4cl0pl7kjmybxy947j7hh42"
+      else "0s04xz3j4psyhawvy503sp2nl5s0gswmpd9wfvwnavgcrr23wk39";
   };
 
   patches = [ ./es-home-6.x.patch ];
diff --git a/pkgs/servers/search/elasticsearch/7.x.nix b/pkgs/servers/search/elasticsearch/7.x.nix
index b94a736a4ca8f..34494c76dedb8 100644
--- a/pkgs/servers/search/elasticsearch/7.x.nix
+++ b/pkgs/servers/search/elasticsearch/7.x.nix
@@ -17,12 +17,12 @@ let
   shas =
     if enableUnfree
     then {
-      x86_64-linux  = "1jkfllafcjqhfydsy90jx2ghpv5cmm6gabv206niwg9qc6y6r1ik";
-      x86_64-darwin = "1lgyxq3yahdww0wpqmpc1mz57kmk5hy2drb1dha69k9l0ibmjf18";
+      "x86_64-linux"  = "0x1ws6iqflvzphg2srvdrn4xrr5wd5fnykkc9h006mj9rb5lp1k9";
+      "x86_64-darwin" = "0yjzgsbsgwa6gbp270fqfm1klm6f8n4s2xmay62gdgvnsj543cxz";
     }
     else {
-      x86_64-linux  = "0pg22wi2xcjla44azfvn9c58r4xq3x9jiwh7qb0d8f3nv30vfd10";
-      x86_64-darwin = "0d9xg3bf06mr7mw2bd16gb2xrfjncrhj19846rrj4j5gb2qjz0x2";
+      "x86_64-linux"  = "1nl6yic1j422l2c7mf8wv0ylfx6marrwm7d181z9nzdswq509kpg";
+      "x86_64-darwin" = "1sy4an9d1faifr3n2y45kalrd22yb68dnpjhi9h8q73c21gp8pzf";
     };
 in
 stdenv.mkDerivation (rec {
@@ -31,7 +31,7 @@ stdenv.mkDerivation (rec {
 
   src = fetchurl {
     url = "https://artifacts.elastic.co/downloads/elasticsearch/${name}-${plat}-${arch}.tar.gz";
-    sha256 = shas.${stdenv.hostPlatform.system} or (throw "Unknown architecture");
+    sha256 = shas."${stdenv.hostPlatform.system}" or (throw "Unknown architecture");
   };
 
   patches = [ ./es-home-6.x.patch ];
diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 5dcbe5106d65c..0ca6f35ae7ad6 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -168,14 +168,6 @@ let
 
 in self: {
 
-  postgresql_9_4 = self.callPackage generic {
-    version = "9.4.24";
-    psqlSchema = "9.4";
-    sha256 = "0acl1wmah3r1a0qjjmpc256glccrjnzq4pkwklx4d9s6vmkks9aj";
-    this = self.postgresql_9_4;
-    inherit self;
-  };
-
   postgresql_9_5 = self.callPackage generic {
     version = "9.5.19";
     psqlSchema = "9.5";
diff --git a/pkgs/servers/web-apps/cryptpad/generate.sh b/pkgs/servers/web-apps/cryptpad/generate.sh
index fd3c933689122..8abf47409d4ef 100755
--- a/pkgs/servers/web-apps/cryptpad/generate.sh
+++ b/pkgs/servers/web-apps/cryptpad/generate.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#! nix-shell -i bash -p nodePackages.node2nix nodePackages.bower2nix
+#! nix-shell -i bash  -I nixpkgs=../../../.. -p nodePackages.node2nix nodePackages.bower2nix
 set -euo pipefail
 
 node2nix -6 \
diff --git a/pkgs/servers/web-apps/cryptpad/node-packages-generated.nix b/pkgs/servers/web-apps/cryptpad/node-packages-generated.nix
index 6189bfdf4cb8c..9fb93c0208542 100644
--- a/pkgs/servers/web-apps/cryptpad/node-packages-generated.nix
+++ b/pkgs/servers/web-apps/cryptpad/node-packages-generated.nix
@@ -49,13 +49,13 @@ let
         sha1 = "d32815404d689699f85a4ea4fa8755dd13a96048";
       };
     };
-    "chainpad-server-3.0.3" = {
+    "chainpad-server-3.0.5" = {
       name = "chainpad-server";
       packageName = "chainpad-server";
-      version = "3.0.3";
+      version = "3.0.5";
       src = fetchurl {
-        url = "https://registry.npmjs.org/chainpad-server/-/chainpad-server-3.0.3.tgz";
-        sha512 = "NRfV7FFBEYy4ZVX7h0P5znu55X8v5K4iGWeMGihkfWZLKu70GmCPUTwpBCP79dUvnCToKEa4/e8aoSPcvZC8pA==";
+        url = "https://registry.npmjs.org/chainpad-server/-/chainpad-server-3.0.5.tgz";
+        sha512 = "USKOMSHsNjnme81Qy3nQ+ji9eCkBPokYH4T82LVHAI0aayTSCXcTPUDLVGDBCRqe8NsXU4io1WPXn1KiZwB8fA==";
       };
     };
     "content-disposition-0.5.2" = {
@@ -619,14 +619,14 @@ let
   };
 in
 {
-  "cryptpad-git+https://github.com/xwiki-labs/cryptpad.git#3.0.0" = nodeEnv.buildNodePackage {
+  "cryptpad-git+https://github.com/xwiki-labs/cryptpad.git#3.0.1" = nodeEnv.buildNodePackage {
     name = "cryptpad";
     packageName = "cryptpad";
-    version = "3.0.0";
+    version = "3.0.1";
     src = fetchgit {
       url = "https://github.com/xwiki-labs/cryptpad.git";
-      rev = "166ab65cd47a64e020528089244ed5be34f6e3c8";
-      sha256 = "35a3b733b5c128b7c7e1c0e7473f4a6a446d663f4c787745b36b1071205c1fd7";
+      rev = "4e5f6edac4f9a3a7a4756eb543d29dc9d1eef32a";
+      sha256 = "f32a93316b717246d1563baec70f9e1e7e5ec1be4f325a473cc37e656afa13cd";
     };
     dependencies = [
       sources."accepts-1.3.7"
@@ -634,7 +634,7 @@ in
       sources."async-limiter-1.0.1"
       sources."body-parser-1.18.3"
       sources."bytes-3.0.0"
-      sources."chainpad-server-3.0.3"
+      sources."chainpad-server-3.0.5"
       sources."content-disposition-0.5.2"
       sources."content-type-1.0.4"
       sources."cookie-0.3.1"
diff --git a/pkgs/servers/web-apps/cryptpad/node-packages.json b/pkgs/servers/web-apps/cryptpad/node-packages.json
index b370e09931b6b..c0c86f9848a6e 100644
--- a/pkgs/servers/web-apps/cryptpad/node-packages.json
+++ b/pkgs/servers/web-apps/cryptpad/node-packages.json
@@ -1,3 +1,3 @@
 [
-  { "cryptpad": "git+https://github.com/xwiki-labs/cryptpad.git#3.0.0" }
+  { "cryptpad": "git+https://github.com/xwiki-labs/cryptpad.git#3.0.1" }
 ]
diff --git a/pkgs/tools/misc/html-proofer/Gemfile.lock b/pkgs/tools/misc/html-proofer/Gemfile.lock
index 46c6ffb924259..be01c0118b3de 100644
--- a/pkgs/tools/misc/html-proofer/Gemfile.lock
+++ b/pkgs/tools/misc/html-proofer/Gemfile.lock
@@ -6,13 +6,12 @@ GEM
     ethon (0.12.0)
       ffi (>= 1.3.0)
     ffi (1.11.1)
-    html-proofer (3.12.0)
+    html-proofer (3.12.2)
       addressable (~> 2.3)
       mercenary (~> 0.3)
       nokogiri (~> 1.10)
       parallel (~> 1.3)
       rainbow (~> 3.0)
-      timerizer (~> 0.3)
       typhoeus (~> 1.3)
       yell (~> 2.0)
     mercenary (0.3.6)
@@ -22,7 +21,6 @@ GEM
     parallel (1.17.0)
     public_suffix (4.0.1)
     rainbow (3.0.0)
-    timerizer (0.3.2)
     typhoeus (1.3.1)
       ethon (>= 0.9.0)
     yell (2.2.0)
diff --git a/pkgs/tools/misc/html-proofer/gemset.nix b/pkgs/tools/misc/html-proofer/gemset.nix
index 46c6734c02508..2deda655d995d 100644
--- a/pkgs/tools/misc/html-proofer/gemset.nix
+++ b/pkgs/tools/misc/html-proofer/gemset.nix
@@ -32,15 +32,15 @@
     version = "1.11.1";
   };
   html-proofer = {
-    dependencies = ["addressable" "mercenary" "nokogiri" "parallel" "rainbow" "timerizer" "typhoeus" "yell"];
+    dependencies = ["addressable" "mercenary" "nokogiri" "parallel" "rainbow" "typhoeus" "yell"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1a5h5ijrngfd4ri36g7bs5lcg4001i5xx7nlk35rsg34xpy8mp04";
+      sha256 = "0xkcchgvlqkk3xgn11vw8n42bhavj6nn6vqsbycbx1rqxgiljlhy";
       type = "gem";
     };
-    version = "3.12.0";
+    version = "3.12.2";
   };
   mercenary = {
     groups = ["default"];
@@ -103,16 +103,6 @@
     };
     version = "3.0.0";
   };
-  timerizer = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "06zk04kprgj0abws15wqrk4q29f3wcx7z2jj3v25nnb2517lk66c";
-      type = "gem";
-    };
-    version = "0.3.2";
-  };
   typhoeus = {
     dependencies = ["ethon"];
     groups = ["default"];
diff --git a/pkgs/tools/misc/logstash/6.x.nix b/pkgs/tools/misc/logstash/6.x.nix
index be26aee03b987..c926d220b05de 100644
--- a/pkgs/tools/misc/logstash/6.x.nix
+++ b/pkgs/tools/misc/logstash/6.x.nix
@@ -16,8 +16,8 @@ stdenv.mkDerivation rec {
     url = "https://artifacts.elastic.co/downloads/logstash/${name}.tar.gz";
     sha256 =
       if enableUnfree
-      then "178shgxwc9kw9w9vwsvwxp8m8r6lssaw1i32vvmx9na01b4w5m4p"
-      else "0gyq97qsg7fys9cc5yj4kpcf3xxvdd5qgzal368yg9swps37g5yj";
+      then "00pwi7clgdflzzg15bh3y30gzikvvy7p5fl88fww7xhhy47q8053"
+      else "0spxgqsyh72n0l0xh6rljp0lbqz46xmr02sqz25ybycr4qkxdhgk";
   };
 
   dontBuild         = true;
diff --git a/pkgs/tools/misc/logstash/7.x.nix b/pkgs/tools/misc/logstash/7.x.nix
index aa768e532b80c..9eff84e67dc52 100644
--- a/pkgs/tools/misc/logstash/7.x.nix
+++ b/pkgs/tools/misc/logstash/7.x.nix
@@ -16,8 +16,8 @@ stdenv.mkDerivation rec {
     url = "https://artifacts.elastic.co/downloads/logstash/${name}.tar.gz";
     sha256 =
       if enableUnfree
-      then "0ls7ia4ldyb7kslmjqhszb30bkammdm5nydc5y7r41zl1zjlhfgc"
-      else "1mpmfnc57vpjk8x3vibamz8lgq163msf20m1bail4hbwhwsmms9i";
+      then "1mw053bx2zh5320p545ax8fnydzqj28r239l7a4m1d2shi89w6s8"
+      else "0d57ahak4chxmd0pmgkbmig2wacprv120pwmjlx63sxf5vw72yap";
   };
 
   dontBuild         = true;
diff --git a/pkgs/tools/misc/starship/default.nix b/pkgs/tools/misc/starship/default.nix
index 487858e618726..c51bf998b3223 100644
--- a/pkgs/tools/misc/starship/default.nix
+++ b/pkgs/tools/misc/starship/default.nix
@@ -2,19 +2,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "starship";
-  version = "0.13.1";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "starship";
     repo = "starship";
     rev = "v${version}";
-    sha256 = "0y6ixl3i1brak226hh02da1zzlcv41f0kb648dqii6dzyhrwhrld";
+    sha256 = "164qxbzlzg53xicp2n5kg9qbmvlckc6rk78n69s82d2d09mbq1ks";
   };
 
   buildInputs = [ openssl ] ++ stdenv.lib.optionals stdenv.isDarwin [ libiconv darwin.apple_sdk.frameworks.Security ];
   nativeBuildInputs = [ pkgconfig ];
 
-  cargoSha256 = "1xk4ngxhgww921fk40d4ziprnzgp927lhdwwzcifcb0hdyl0854p";
+  cargoSha256 = "192lq0wf8c2p3s4n6c0xr02hwyswypxypimbghi4m8f3fgj2l3ig";
   checkPhase = "cargo test -- --skip directory::home_directory --skip directory::directory_in_root";
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/nix/nixpkgs-fmt/default.nix b/pkgs/tools/nix/nixpkgs-fmt/default.nix
index 51e4e22bc5b60..7ac73fac39e53 100644
--- a/pkgs/tools/nix/nixpkgs-fmt/default.nix
+++ b/pkgs/tools/nix/nixpkgs-fmt/default.nix
@@ -1,16 +1,16 @@
 { lib, rustPlatform, fetchFromGitHub }:
 rustPlatform.buildRustPackage rec {
   pname = "nixpkgs-fmt";
-  version = "0.3.1";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0nz4njmrwacizz9z89ligxr2gyggk65vq9cmd6s4hn133gajf2n1";
+    sha256 = "07hnyx616dk03md00pmgpb5c2sp9w0n5l94s82arair0kpi0ncy0";
   };
 
-  cargoSha256 = "0p3qa1asdvw2npav4281lzndjczrzac6fr8z4y61m7rbn363s8sa";
+  cargoSha256 = "0wfx7shsdqrwbnzr2a0fnly1kd93mxbm96zjq5pzrq94lphkhqhz";
 
   meta = with lib; {
     description = "Nix code formatter for nixpkgs";
diff --git a/pkgs/tools/security/gnome-keysign/default.nix b/pkgs/tools/security/gnome-keysign/default.nix
new file mode 100644
index 0000000000000..04fa923ce2cc1
--- /dev/null
+++ b/pkgs/tools/security/gnome-keysign/default.nix
@@ -0,0 +1,73 @@
+{ stdenv
+, fetchFromGitLab
+, python3
+, wrapGAppsHook
+, gobject-introspection
+, gtk3
+, glib
+, gnome3
+, gst_all_1
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "gnome-keysign";
+  version = "1.0.1";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "GNOME";
+    repo = pname;
+    rev = version;
+    sha256 = "0iy70dskd7wly37lpb2ypd9phhyml5j3c7rzajii4f2s7zgb3abg";
+  };
+
+  nativeBuildInputs = [
+    wrapGAppsHook
+    gobject-introspection
+  ] ++ (with python3.pkgs; [
+    Babel
+    lxml
+  ]);
+
+  buildInputs = [
+    # TODO: add avahi support
+    gtk3
+    glib
+    gst_all_1.gstreamer
+    gst_all_1.gst-plugins-base
+    (gst_all_1.gst-plugins-good.override { gtkSupport = true; })
+    gst_all_1.gst-plugins-bad # for zbar plug-in
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    dbus-python
+    future
+    gpgme
+    magic-wormhole
+    pygobject3
+    pybluez
+    qrcode
+    requests
+    twisted
+  ];
+
+  passthru = {
+    updateScript = gnome3.updateScript {
+      packageName = pname;
+    };
+  };
+
+  # https://github.com/NixOS/nixpkgs/issues/56943
+  strictDeps = false;
+
+  # bunch of linting
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "GTK/GNOME application to use GnuPG for signing other peoples’ keys";
+    homepage = https://wiki.gnome.org/Apps/Keysign;
+    license = licenses.gpl3Plus;
+    maintainers = gnome3.maintainers;
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/tools/security/sequoia/default.nix b/pkgs/tools/security/sequoia/default.nix
index 5848f7d92af52..9d6928abf86ff 100644
--- a/pkgs/tools/security/sequoia/default.nix
+++ b/pkgs/tools/security/sequoia/default.nix
@@ -9,16 +9,16 @@ assert pythonSupport -> pythonPackages != null;
 
 rustPlatform.buildRustPackage rec {
   pname = "sequoia";
-  version = "0.9.0";
+  version = "0.10.0";
 
   src = fetchFromGitLab {
     owner = "sequoia-pgp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "13dzwdzz33dy2lgnznsv8wqnw2501f2ggrkfwpqy5x6d1kgms8rj";
+    sha256 = "0gvczghyik56jlnb8cz7jg2l3nbm519gf19g7l5blxci3009v23d";
   };
 
-  cargoSha256 = "1zcnkpzcar3a2fk2rn3i3nb70b59ds9fpfa44f15r3aaxajsdhdi";
+  cargoSha256 = "0dk9sjcbmygbdpwqnah5krli1p9j5hahgiqrca9c0kfpfiwgx62q";
 
   nativeBuildInputs = [
     pkgconfig
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index abdbdc1167931..046c6bc9acc3c 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -265,7 +265,6 @@ mapAliases ({
   plexpy = tautulli; # plexpy got renamed to tautulli, added 2019-02-22
   pmtools = acpica-tools; # added 2018-11-01
   poppler_qt5 = libsForQt5.poppler;  # added 2015-12-19
-  postgresql94 = postgresql_9_4;
   postgresql95 = postgresql_9_5;
   postgresql96 = postgresql_9_6;
   postgresql100 = throw "deprecated 2018-10-21: use postgresql_10 instead";
@@ -303,8 +302,9 @@ mapAliases ({
   rssglx = rss-glx; #added 2015-03-25
   ruby_2_0_0 = throw "deprecated 2018-0213: use a newer version of ruby";
   ruby_2_1_0 = throw "deprecated 2018-0213: use a newer version of ruby";
-  ruby_2_2_9 = throw "deprecated 2018-0213: use ruby_2_2 instead";
-  ruby_2_3_6 = throw "deprecated 2018-0213: use ruby_2_3 instead";
+  ruby_2_2_9 = throw "deprecated 2018-0213: use a newer version of ruby";
+  ruby_2_3_6 = throw "deprecated 2018-0213: use a newer version of ruby";
+  ruby_2_3 = throw "deprecated 2019-09-06: use a newer version of ruby";
   ruby_2_4_3 = throw "deprecated 2018-0213: use ruby_2_4 instead";
   ruby_2_5_0 = throw "deprecated 2018-0213: use ruby_2_5 instead";
   rubygems = throw "deprecated 2016-03-02: rubygems is now bundled with ruby";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index dfbc59352388f..d47121eaf08ef 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1066,22 +1066,14 @@ in
 
   bchunk = callPackage ../tools/cd-dvd/bchunk { };
 
-  inherit (callPackages ../misc/logging/beats/6.x.nix {
-    # XXX: this is failing with Go 1.12. Error is related to cgo, an
-    # update to this package might fix it.
-    buildGoPackage = buildGo111Package;
-  })
+  inherit (callPackages ../misc/logging/beats/6.x.nix { })
     filebeat6
     heartbeat6
     metricbeat6
     packetbeat6
     journalbeat6;
 
-  inherit (callPackages ../misc/logging/beats/7.x.nix {
-    # XXX: this is failing with Go 1.12. Error is related to cgo, an
-    # update to this package might fix it.
-    buildGoPackage = buildGo111Package;
-  })
+  inherit (callPackages ../misc/logging/beats/7.x.nix { })
     filebeat7
     heartbeat7
     metricbeat7
@@ -2873,8 +2865,8 @@ in
   evemu = callPackage ../tools/system/evemu { };
 
   # The latest version used by elasticsearch, logstash, kibana and the the beats from elastic.
-  elk6Version = "6.7.2";
-  elk7Version = "7.0.1";
+  elk6Version = "6.8.3";
+  elk7Version = "7.3.1";
 
   elasticsearch6 = callPackage ../servers/search/elasticsearch/6.x.nix {
     utillinux = utillinuxMinimal;
@@ -2914,13 +2906,7 @@ in
           sha256 = "f15516df478d5a56180fbf80e68f206010e6d160fc39fa508b65e035fd75130b";
         };
       });
-      pyyaml = super.pyyaml.overridePythonAttrs (oldAttrs: rec {
-        version = "3.12";
-        src = oldAttrs.src.override {
-          inherit version;
-          sha256 = "1aqjl8dk9amd4zr99n8v2qxzgmr2hdvqfma4zh7a41rj6336c9sr";
-        };
-      });
+      pyyaml = super.pyyaml_3;
     };
   }).pkgs; toPythonApplication elasticsearch-curator;
 
@@ -3443,6 +3429,8 @@ in
 
   gnome-builder = callPackage ../applications/editors/gnome-builder { };
 
+  gnome-keysign = callPackage ../tools/security/gnome-keysign { };
+
   gnome-podcasts = callPackage ../applications/audio/gnome-podcasts { };
 
   gnome-photos = callPackage ../applications/graphics/gnome-photos {
@@ -4342,6 +4330,8 @@ in
 
   memtester = callPackage ../tools/system/memtester { };
 
+  mhonarc = perlPackages.MHonArc;
+
   minergate = callPackage ../applications/misc/minergate { };
 
   minergate-cli = callPackage ../applications/misc/minergate-cli { };
@@ -8950,14 +8940,12 @@ in
     inherit (darwin) libiconv libobjc libunwind;
     inherit (darwin.apple_sdk.frameworks) Foundation;
   })
-    ruby_2_3
     ruby_2_4
     ruby_2_5
     ruby_2_6;
 
   ruby = ruby_2_6;
 
-  rubyPackages_2_3 = recurseIntoAttrs ruby_2_3.gems;
   rubyPackages_2_4 = recurseIntoAttrs ruby_2_4.gems;
   rubyPackages_2_5 = recurseIntoAttrs ruby_2_5.gems;
   rubyPackages_2_6 = recurseIntoAttrs ruby_2_6.gems;
@@ -14999,8 +14987,6 @@ in
 
   pgbouncer = callPackage ../servers/sql/pgbouncer { };
 
-  pgpool94 = pgpool.override { postgresql = postgresql_9_4; };
-
   pgpool = callPackage ../servers/sql/pgpool {
     pam = if stdenv.isLinux then pam else null;
     libmemcached = null; # Detection is broken upstream
@@ -15011,7 +14997,6 @@ in
   timescaledb-tune = callPackage ../development/tools/database/timescaledb-tune { };
 
   inherit (import ../servers/sql/postgresql pkgs)
-    postgresql_9_4
     postgresql_9_5
     postgresql_9_6
     postgresql_10
@@ -16279,7 +16264,7 @@ in
 
   semodule-utils = callPackage ../os-specific/linux/semodule-utils { };
 
-  powerdns = callPackage ../servers/dns/powerdns { libressl = libressl_2_8; };
+  powerdns = callPackage ../servers/dns/powerdns { };
 
   dnsdist = callPackage ../servers/dns/dnsdist { };
 
@@ -20438,9 +20423,7 @@ in
 
   wavebox = callPackage ../applications/networking/instant-messengers/wavebox { };
 
-  sonic-pi = callPackage ../applications/audio/sonic-pi {
-    ruby = ruby_2_3;
-  };
+  sonic-pi = callPackage ../applications/audio/sonic-pi { };
 
   st = callPackage ../applications/misc/st {
     conf = config.st.conf or null;
@@ -22144,7 +22127,7 @@ in
   mrrescue = callPackage ../games/mrrescue { };
 
   mudlet = libsForQt5.callPackage ../games/mudlet {
-    inherit (lua51Packages) luafilesystem lrexlib-pcre luazip luasql-sqlite3;
+    lua = lua5_1;
   };
 
   n2048 = callPackage ../games/n2048 {};
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index afd86f8583c9d..5dda58b8d64c7 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -10661,23 +10661,26 @@ let
     };
   };
 
-  MHonArc = buildPerlPackage {
+  MHonArc = buildPerlPackage rec {
     pname = "MHonArc";
-    version = "2.6.18";
+    version = "2.6.19";
 
     src = fetchurl {
-      url    = "http://dcssrv1.oit.uci.edu/indiv/ehood/release/MHonArc/tar/MHonArc-2.6.18.tar.gz";
-      sha256 = "1xmf26dfwr8achprc3n1pxgl0mkiyr6pf25wq3dqgzqkghrrsxa2";
+      url = "https://www.mhonarc.org/release/MHonArc/tar/MHonArc-${version}.tar.gz";
+      sha256 = "0ll3v93yji334zqp6xfzfxc0127pmjcznmai1l5q6dzawrs2igzq";
     };
+
+    patches = [ ../development/perl-modules/mhonarc.patch ];
+
     outputs = [ "out" "dev" ]; # no "devdoc"
 
     installTargets = "install";
 
     meta = with stdenv.lib; {
-      homepage    = http://dcssrv1.oit.uci.edu/indiv/ehood/mhonarch.html;
+      homepage = "https://www.mhonarc.org/";
       description = "A mail-to-HTML converter";
       maintainers = with maintainers; [ lovek323 ];
-      license     = licenses.gpl2;
+      license = licenses.gpl2;
     };
   };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 9ea1c5b44d3a0..dfef738603bbc 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4661,6 +4661,8 @@ in {
     inherit (pkgs) pkgconfig; # use normal pkgconfig, not the python package
   };
 
+  rfc6555 = callPackage ../development/python-modules/rfc6555 { };
+
   qdarkstyle = callPackage ../development/python-modules/qdarkstyle { };
 
   quamash = callPackage ../development/python-modules/quamash { };