about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--doc/builders/images/appimagetools.xml2
-rw-r--r--doc/languages-frameworks/python.section.md2
-rw-r--r--doc/languages-frameworks/ruby.xml4
-rw-r--r--doc/old/cross.txt4
-rw-r--r--doc/release-notes.xml2
-rw-r--r--doc/stdenv/stdenv.xml2
-rw-r--r--lib/licenses.nix30
-rw-r--r--maintainers/maintainer-list.nix12
-rw-r--r--nixos/modules/hardware/opengl.nix26
-rw-r--r--nixos/modules/module-list.nix1
-rw-r--r--nixos/modules/profiles/hardened.nix39
-rw-r--r--nixos/modules/security/acme.nix7
-rw-r--r--nixos/modules/services/databases/cockroachdb.nix2
-rw-r--r--nixos/modules/services/mail/rss2email.nix2
-rw-r--r--nixos/modules/services/misc/redmine.nix4
-rw-r--r--nixos/modules/services/monitoring/tuptime.nix84
-rw-r--r--nixos/modules/services/networking/ntp/chrony.nix14
-rw-r--r--nixos/modules/services/security/bitwarden_rs/default.nix2
-rw-r--r--nixos/modules/services/web-apps/wordpress.nix4
-rw-r--r--nixos/modules/system/boot/systemd.nix14
-rw-r--r--nixos/modules/virtualisation/containers.nix18
-rw-r--r--nixos/release-combined.nix3
-rw-r--r--nixos/tests/acme.nix102
-rw-r--r--nixos/tests/all-tests.nix6
-rw-r--r--nixos/tests/cockroachdb.nix28
-rw-r--r--nixos/tests/common/acme/client/default.nix15
-rw-r--r--nixos/tests/common/acme/server/default.nix (renamed from nixos/tests/common/letsencrypt/default.nix)34
-rw-r--r--nixos/tests/common/acme/server/mkcerts.nix (renamed from nixos/tests/common/letsencrypt/mkcerts.nix)5
-rwxr-xr-xnixos/tests/common/acme/server/mkcerts.sh (renamed from nixos/tests/common/letsencrypt/mkcerts.sh)0
-rw-r--r--nixos/tests/common/acme/server/snakeoil-certs.nix171
-rw-r--r--nixos/tests/common/letsencrypt/common.nix12
-rw-r--r--nixos/tests/common/letsencrypt/snakeoil-certs.nix254
-rw-r--r--nixos/tests/common/resolver.nix2
-rw-r--r--nixos/tests/containers-custom-pkgs.nix42
-rw-r--r--nixos/tests/gnome3-xorg.nix6
-rw-r--r--nixos/tests/gnome3.nix6
-rw-r--r--nixos/tests/hardened.nix11
-rw-r--r--nixos/tests/installed-tests/default.nix1
-rw-r--r--nixos/tests/installed-tests/libjcat.nix5
-rw-r--r--nixos/tests/tuptime.nix29
-rw-r--r--pkgs/applications/accessibility/contrast/default.nix6
-rw-r--r--pkgs/applications/audio/gnome-podcasts/default.nix3
-rw-r--r--pkgs/applications/audio/lollypop/default.nix4
-rw-r--r--pkgs/applications/audio/lsp-plugins/default.nix4
-rw-r--r--pkgs/applications/audio/musescore/default.nix2
-rw-r--r--pkgs/applications/audio/polyphone/default.nix2
-rw-r--r--pkgs/applications/audio/spotifyd/default.nix8
-rw-r--r--pkgs/applications/blockchains/go-ethereum.nix7
-rw-r--r--pkgs/applications/editors/android-studio/default.nix12
-rw-r--r--pkgs/applications/editors/gnome-builder/default.nix2
-rw-r--r--pkgs/applications/editors/micro/default.nix8
-rw-r--r--pkgs/applications/editors/micro/deps.nix336
-rw-r--r--pkgs/applications/editors/vscode/vscodium.nix2
-rw-r--r--pkgs/applications/graphics/gnome-photos/default.nix2
-rw-r--r--pkgs/applications/kde/konsole.nix2
-rw-r--r--pkgs/applications/kde/okular.nix2
-rw-r--r--pkgs/applications/misc/alacritty/default.nix6
-rw-r--r--pkgs/applications/misc/almanah/default.nix2
-rw-r--r--pkgs/applications/misc/glom/default.nix3
-rw-r--r--pkgs/applications/misc/gnome-firmware-updater/default.nix3
-rw-r--r--pkgs/applications/misc/gnome-multi-writer/default.nix2
-rw-r--r--pkgs/applications/misc/gnome-recipes/default.nix2
-rw-r--r--pkgs/applications/misc/gnome-usage/default.nix2
-rw-r--r--pkgs/applications/misc/joplin-desktop/default.nix8
-rw-r--r--pkgs/applications/misc/keepassx/community.nix22
-rw-r--r--pkgs/applications/misc/keepassx/darwin.patch4
-rw-r--r--pkgs/applications/misc/krusader/default.nix2
-rw-r--r--pkgs/applications/misc/lutris/chrootenv.nix2
-rw-r--r--pkgs/applications/misc/orca/default.nix2
-rw-r--r--pkgs/applications/misc/termpdf.py/default.nix2
-rw-r--r--pkgs/applications/networking/browsers/brave/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/chromium/common.nix17
-rw-r--r--pkgs/applications/networking/browsers/chromium/default.nix19
-rw-r--r--pkgs/applications/networking/browsers/chromium/patches/enable-vdpau-support-for-nvidia.patch (renamed from pkgs/applications/networking/browsers/chromium/patches/vaapi-fix.patch)0
-rw-r--r--pkgs/applications/networking/browsers/chromium/patches/enable-video-acceleration-on-linux.patch48
-rw-r--r--pkgs/applications/networking/browsers/chromium/plugins.nix4
-rw-r--r--pkgs/applications/networking/browsers/firefox/wrapper.nix1
-rw-r--r--pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix10
-rw-r--r--pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix6
-rw-r--r--pkgs/applications/networking/cluster/terraform/default.nix8
-rw-r--r--pkgs/applications/networking/ids/zeek/default.nix6
-rw-r--r--pkgs/applications/networking/lieer/default.nix (renamed from pkgs/applications/networking/gmailieer/default.nix)12
-rw-r--r--pkgs/applications/networking/maestral/default.nix5
-rw-r--r--pkgs/applications/office/elementary-planner/0001-Revert-Add-patch.patch84
-rw-r--r--pkgs/applications/office/elementary-planner/default.nix14
-rw-r--r--pkgs/applications/office/libreoffice/default.nix5
-rw-r--r--pkgs/applications/office/libreoffice/src-fresh/download.nix8
-rw-r--r--pkgs/applications/office/libreoffice/src-fresh/primary.nix10
-rw-r--r--pkgs/applications/science/logic/beluga/default.nix38
-rw-r--r--pkgs/applications/science/logic/lean/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/delta/default.nix11
-rw-r--r--pkgs/applications/version-management/git-and-tools/git/default.nix6
-rw-r--r--pkgs/applications/version-management/redmine/Gemfile4
-rw-r--r--pkgs/applications/version-management/redmine/Gemfile.lock121
-rw-r--r--pkgs/applications/version-management/redmine/default.nix6
-rw-r--r--pkgs/applications/version-management/redmine/gemset.nix308
-rw-r--r--pkgs/applications/video/plex-media-player/default.nix41
-rw-r--r--pkgs/applications/video/plex-media-player/deps.nix28
-rwxr-xr-xpkgs/applications/video/plex-media-player/update.sh71
-rw-r--r--pkgs/applications/virtualization/conmon/default.nix6
-rw-r--r--pkgs/applications/virtualization/docker/default.nix4
-rw-r--r--pkgs/applications/virtualization/qtemu/default.nix45
-rw-r--r--pkgs/build-support/alternatives/blas/default.nix2
-rw-r--r--pkgs/common-updater/generic-updater.nix4
-rw-r--r--pkgs/data/documentation/gnome-user-docs/default.nix2
-rw-r--r--pkgs/data/fonts/fira/default.nix4
-rw-r--r--pkgs/desktops/gnome-3/apps/accerciser/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/apps/cheese/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/apps/evolution/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/apps/file-roller/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/apps/gedit/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/apps/ghex/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/apps/glade/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/apps/gnome-books/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/apps/gnome-boxes/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/apps/gnome-calendar/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/apps/gnome-characters/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/apps/gnome-clocks/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/apps/gnome-documents/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/apps/gnome-getting-started-docs/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/apps/gnome-logs/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/apps/gnome-maps/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/apps/gnome-music/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/apps/gnome-nettool/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/apps/gnome-notes/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/apps/gnome-power-manager/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/apps/gnome-sound-recorder/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/apps/gnome-todo/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/apps/gnome-weather/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/apps/polari/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/apps/seahorse/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/apps/vinagre/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/adwaita-icon-theme/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/baobab/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/caribou/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/dconf-editor/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/empathy/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/eog/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/epiphany/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/evince/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/evolution-data-server/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/gdm/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-backgrounds/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-bluetooth/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-calculator/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-color-manager/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-common/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-contacts/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-control-center/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-desktop/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-dictionary/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-disk-utility/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-font-viewer/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-initial-setup/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-keyring/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-online-miners/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-remote-desktop/default.nix4
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-screenshot/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-session/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-settings-daemon/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-shell-extensions/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-shell/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-software/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-system-monitor/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-terminal/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-themes-extra/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-tour/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-user-share/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/gucharmap/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/mutter/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/nautilus/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/rygel/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/simple-scan/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/sushi/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/totem/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/yelp-xsl/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/yelp/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/zenity/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/default.nix4
-rw-r--r--pkgs/desktops/gnome-3/devtools/devhelp/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/devtools/gnome-devel-docs/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/extensions/chrome-gnome-shell/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/games/aisleriot/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/games/atomix/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/games/five-or-more/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/games/four-in-a-row/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/games/gnome-chess/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/games/gnome-klotski/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/games/gnome-mahjongg/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/games/gnome-mines/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/games/gnome-nibbles/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/games/gnome-robots/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/games/gnome-sudoku/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/games/gnome-taquin/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/games/gnome-tetravex/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/games/hitori/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/games/iagno/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/games/lightsoff/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/games/quadrapassel/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/games/swell-foop/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/games/tali/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/misc/geary/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/misc/gnome-applets/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/misc/gnome-autoar/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/misc/gnome-flashback/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/misc/gnome-packagekit/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/misc/gnome-panel/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/misc/gnome-tweaks/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/misc/gpaste/default.nix3
-rw-r--r--pkgs/desktops/gnome-3/misc/gtkhtml/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/misc/libgnome-games-support/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/misc/metacity/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/misc/nautilus-python/default.nix2
-rw-r--r--pkgs/desktops/xfce/applications/gigolo/default.nix4
-rw-r--r--pkgs/desktops/xfce/applications/parole/default.nix4
-rw-r--r--pkgs/desktops/xfce/applications/xfburn/default.nix4
-rw-r--r--pkgs/desktops/xfce/applications/xfce4-dict/default.nix4
-rw-r--r--pkgs/desktops/xfce/applications/xfce4-notifyd/default.nix4
-rw-r--r--pkgs/desktops/xfce/applications/xfce4-screenshooter/default.nix4
-rw-r--r--pkgs/desktops/xfce/applications/xfce4-taskmanager/default.nix4
-rw-r--r--pkgs/desktops/xfce/applications/xfce4-terminal/default.nix4
-rw-r--r--pkgs/desktops/xfce/applications/xfdashboard/default.nix4
-rw-r--r--pkgs/desktops/xfce/art/xfce4-icon-theme.nix12
-rw-r--r--pkgs/desktops/xfce/core/exo/default.nix21
-rw-r--r--pkgs/desktops/xfce/core/thunar/default.nix4
-rw-r--r--pkgs/desktops/xfce/core/tumbler/default.nix4
-rw-r--r--pkgs/desktops/xfce/core/xfce4-panel/default.nix4
-rw-r--r--pkgs/desktops/xfce/core/xfce4-power-manager/default.nix4
-rw-r--r--pkgs/desktops/xfce/core/xfce4-session/default.nix4
-rw-r--r--pkgs/desktops/xfce/core/xfce4-settings/default.nix4
-rw-r--r--pkgs/desktops/xfce/core/xfdesktop/default.nix4
-rw-r--r--pkgs/desktops/xfce/default.nix4
-rw-r--r--pkgs/desktops/xfce/panel-plugins/xfce4-battery-plugin/default.nix4
-rw-r--r--pkgs/desktops/xfce/panel-plugins/xfce4-clipman-plugin/default.nix4
-rw-r--r--pkgs/desktops/xfce/panel-plugins/xfce4-cpugraph-plugin.nix30
-rw-r--r--pkgs/desktops/xfce/panel-plugins/xfce4-dict-plugin.nix32
-rw-r--r--pkgs/desktops/xfce/panel-plugins/xfce4-embed-plugin.nix20
-rw-r--r--pkgs/desktops/xfce/panel-plugins/xfce4-eyes-plugin.nix26
-rw-r--r--pkgs/desktops/xfce/panel-plugins/xfce4-fsguard-plugin.nix26
-rw-r--r--pkgs/desktops/xfce/panel-plugins/xfce4-genmon-plugin.nix25
-rw-r--r--pkgs/desktops/xfce/panel-plugins/xfce4-hardware-monitor-plugin.nix2
-rw-r--r--pkgs/desktops/xfce/panel-plugins/xfce4-mailwatch-plugin.nix27
-rw-r--r--pkgs/desktops/xfce/panel-plugins/xfce4-mpc-plugin.nix29
-rw-r--r--pkgs/desktops/xfce/panel-plugins/xfce4-netload-plugin/default.nix5
-rw-r--r--pkgs/desktops/xfce/panel-plugins/xfce4-notes-plugin.nix29
-rw-r--r--pkgs/desktops/xfce/panel-plugins/xfce4-pulseaudio-plugin/default.nix6
-rw-r--r--pkgs/desktops/xfce/panel-plugins/xfce4-sensors-plugin.nix10
-rw-r--r--pkgs/desktops/xfce/panel-plugins/xfce4-systemload-plugin.nix24
-rw-r--r--pkgs/desktops/xfce/panel-plugins/xfce4-timer-plugin.nix26
-rw-r--r--pkgs/desktops/xfce/panel-plugins/xfce4-vala-panel-appmenu-plugin/default.nix4
-rw-r--r--pkgs/desktops/xfce/panel-plugins/xfce4-weather-plugin.nix25
-rw-r--r--pkgs/desktops/xfce/panel-plugins/xfce4-windowck-plugin.nix28
-rw-r--r--pkgs/development/compilers/ghc/8.8.3.nix6
-rw-r--r--pkgs/development/compilers/go/1.14.nix4
-rw-r--r--pkgs/development/compilers/graalvm/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/10/clang/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/10/libc++/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/10/libc++abi.nix4
-rw-r--r--pkgs/development/compilers/llvm/10/lld.nix2
-rw-r--r--pkgs/development/compilers/llvm/10/lldb.nix2
-rw-r--r--pkgs/development/compilers/llvm/10/llvm.nix2
-rw-r--r--pkgs/development/compilers/llvm/10/openmp.nix2
-rw-r--r--pkgs/development/compilers/llvm/5/clang/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/5/libc++/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/5/libc++abi.nix4
-rw-r--r--pkgs/development/compilers/llvm/5/lld.nix2
-rw-r--r--pkgs/development/compilers/llvm/5/lldb.nix2
-rw-r--r--pkgs/development/compilers/llvm/5/llvm.nix2
-rw-r--r--pkgs/development/compilers/llvm/5/openmp.nix2
-rw-r--r--pkgs/development/compilers/llvm/6/clang/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/6/libc++/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/6/libc++abi.nix4
-rw-r--r--pkgs/development/compilers/llvm/6/lld.nix2
-rw-r--r--pkgs/development/compilers/llvm/6/lldb.nix2
-rw-r--r--pkgs/development/compilers/llvm/6/llvm.nix2
-rw-r--r--pkgs/development/compilers/llvm/6/openmp.nix2
-rw-r--r--pkgs/development/compilers/llvm/7/clang/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/7/libc++/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/7/libc++abi.nix4
-rw-r--r--pkgs/development/compilers/llvm/7/lld.nix2
-rw-r--r--pkgs/development/compilers/llvm/7/lldb.nix2
-rw-r--r--pkgs/development/compilers/llvm/7/llvm.nix2
-rw-r--r--pkgs/development/compilers/llvm/7/openmp.nix2
-rw-r--r--pkgs/development/compilers/llvm/8/clang/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/8/libc++/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/8/libc++abi.nix4
-rw-r--r--pkgs/development/compilers/llvm/8/lld.nix2
-rw-r--r--pkgs/development/compilers/llvm/8/lldb.nix2
-rw-r--r--pkgs/development/compilers/llvm/8/llvm.nix2
-rw-r--r--pkgs/development/compilers/llvm/8/openmp.nix2
-rw-r--r--pkgs/development/compilers/llvm/9/clang/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/9/libc++/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/9/libc++abi.nix4
-rw-r--r--pkgs/development/compilers/llvm/9/lld.nix2
-rw-r--r--pkgs/development/compilers/llvm/9/lldb.nix2
-rw-r--r--pkgs/development/compilers/llvm/9/llvm.nix2
-rw-r--r--pkgs/development/compilers/llvm/9/openmp.nix2
-rw-r--r--pkgs/development/compilers/tinygo/default.nix6
-rw-r--r--pkgs/development/haskell-modules/configuration-tensorflow.nix4
-rw-r--r--pkgs/development/interpreters/j/default.nix43
-rw-r--r--pkgs/development/interpreters/perl/default.nix12
-rw-r--r--pkgs/development/interpreters/wasmtime/default.nix2
-rw-r--r--pkgs/development/libraries/at-spi2-atk/default.nix2
-rw-r--r--pkgs/development/libraries/at-spi2-core/default.nix2
-rw-r--r--pkgs/development/libraries/biblesync/default.nix2
-rw-r--r--pkgs/development/libraries/dconf/default.nix2
-rw-r--r--pkgs/development/libraries/dnnl/bash-to-sh.patch13
-rw-r--r--pkgs/development/libraries/dnnl/default.nix24
-rw-r--r--pkgs/development/libraries/folks/default.nix2
-rw-r--r--pkgs/development/libraries/gcab/default.nix2
-rw-r--r--pkgs/development/libraries/gcr/default.nix2
-rw-r--r--pkgs/development/libraries/gd/default.nix4
-rw-r--r--pkgs/development/libraries/gdl/default.nix2
-rw-r--r--pkgs/development/libraries/geocode-glib/default.nix2
-rw-r--r--pkgs/development/libraries/gexiv2/default.nix2
-rw-r--r--pkgs/development/libraries/gfbgraph/default.nix2
-rw-r--r--pkgs/development/libraries/gjs/default.nix2
-rw-r--r--pkgs/development/libraries/glib-networking/default.nix2
-rw-r--r--pkgs/development/libraries/gnome-online-accounts/default.nix2
-rw-r--r--pkgs/development/libraries/gnome-video-effects/default.nix2
-rw-r--r--pkgs/development/libraries/gnutls/default.nix4
-rw-r--r--pkgs/development/libraries/gobject-introspection/default.nix8
-rw-r--r--pkgs/development/libraries/gom/default.nix2
-rw-r--r--pkgs/development/libraries/graphene-hardened-malloc/default.nix2
-rw-r--r--pkgs/development/libraries/grilo-plugins/default.nix2
-rw-r--r--pkgs/development/libraries/grilo/default.nix2
-rw-r--r--pkgs/development/libraries/gsettings-desktop-schemas/default.nix2
-rw-r--r--pkgs/development/libraries/gsound/default.nix2
-rw-r--r--pkgs/development/libraries/gspell/default.nix2
-rw-r--r--pkgs/development/libraries/gtk/3.x.nix10
-rw-r--r--pkgs/development/libraries/gtksourceview/3.x.nix2
-rw-r--r--pkgs/development/libraries/gtksourceview/4.x.nix2
-rw-r--r--pkgs/development/libraries/gtksourceviewmm/4.x.nix2
-rw-r--r--pkgs/development/libraries/gvfs/default.nix2
-rw-r--r--pkgs/development/libraries/jsonrpc-glib/default.nix2
-rw-r--r--pkgs/development/libraries/libchamplain/default.nix2
-rw-r--r--pkgs/development/libraries/libdazzle/default.nix2
-rw-r--r--pkgs/development/libraries/libepc/default.nix2
-rw-r--r--pkgs/development/libraries/libgda/default.nix2
-rw-r--r--pkgs/development/libraries/libgdamm/default.nix2
-rw-r--r--pkgs/development/libraries/libgdata/default.nix2
-rw-r--r--pkgs/development/libraries/libgee/default.nix2
-rw-r--r--pkgs/development/libraries/libgepub/default.nix2
-rw-r--r--pkgs/development/libraries/libgit2-glib/default.nix2
-rw-r--r--pkgs/development/libraries/libgnomekbd/default.nix2
-rw-r--r--pkgs/development/libraries/libgrss/default.nix2
-rw-r--r--pkgs/development/libraries/libgtop/default.nix2
-rw-r--r--pkgs/development/libraries/libgudev/default.nix2
-rw-r--r--pkgs/development/libraries/libgweather/default.nix2
-rw-r--r--pkgs/development/libraries/libgxps/default.nix2
-rw-r--r--pkgs/development/libraries/libhttpseverywhere/default.nix2
-rw-r--r--pkgs/development/libraries/libjcat/default.nix91
-rw-r--r--pkgs/development/libraries/libjcat/installed-tests-path.patch24
-rw-r--r--pkgs/development/libraries/libmanette/default.nix2
-rw-r--r--pkgs/development/libraries/libmediaart/default.nix2
-rw-r--r--pkgs/development/libraries/libnotify/default.nix2
-rw-r--r--pkgs/development/libraries/libpeas/default.nix2
-rw-r--r--pkgs/development/libraries/libqmi/default.nix2
-rw-r--r--pkgs/development/libraries/librest/default.nix2
-rw-r--r--pkgs/development/libraries/librsvg/default.nix2
-rw-r--r--pkgs/development/libraries/libsass/default.nix4
-rw-r--r--pkgs/development/libraries/libtxc_dxtn/default.nix23
-rw-r--r--pkgs/development/libraries/libtxc_dxtn_s2tc/default.nix25
-rw-r--r--pkgs/development/libraries/libzapojit/default.nix2
-rw-r--r--pkgs/development/libraries/mm-common/default.nix2
-rw-r--r--pkgs/development/libraries/openssl/default.nix4
-rw-r--r--pkgs/development/libraries/rarian/default.nix2
-rw-r--r--pkgs/development/libraries/silgraphite/graphite2.nix4
-rw-r--r--pkgs/development/libraries/template-glib/default.nix2
-rw-r--r--pkgs/development/libraries/totem-pl-parser/default.nix2
-rw-r--r--pkgs/development/libraries/tracker-miners/default.nix2
-rw-r--r--pkgs/development/libraries/tracker/default.nix2
-rw-r--r--pkgs/development/libraries/vte/default.nix2
-rw-r--r--pkgs/development/libraries/webkitgtk/default.nix7
-rw-r--r--pkgs/development/node-packages/node-packages-v10.nix178
-rw-r--r--pkgs/development/node-packages/node-packages-v12.nix8
-rw-r--r--pkgs/development/node-packages/node-packages-v13.nix4
-rw-r--r--pkgs/development/ocaml-modules/bistro/default.nix8
-rw-r--r--pkgs/development/ocaml-modules/dune-build-info/default.nix17
-rw-r--r--pkgs/development/ocaml-modules/janestreet/0.13.nix503
-rw-r--r--pkgs/development/ocaml-modules/janestreet/async_ssl.nix17
-rw-r--r--pkgs/development/ocaml-modules/janestreet/janePackage_0_13.nix19
-rw-r--r--pkgs/development/ocaml-modules/linenoise/default.nix4
-rw-r--r--pkgs/development/ocaml-modules/phylogenetics/default.nix6
-rw-r--r--pkgs/development/ocaml-modules/rpclib/default.nix4
-rw-r--r--pkgs/development/ocaml-modules/sedlex/2.nix6
-rw-r--r--pkgs/development/python-modules/click/default.nix22
-rw-r--r--pkgs/development/python-modules/cryptography/default.nix21
-rw-r--r--pkgs/development/python-modules/cryptography/vectors.nix2
-rw-r--r--pkgs/development/python-modules/howdoi/default.nix4
-rw-r--r--pkgs/development/python-modules/pdfposter/default.nix20
-rw-r--r--pkgs/development/python-modules/publicsuffix2/default.nix26
-rw-r--r--pkgs/development/python-modules/pyopengl/default.nix2
-rw-r--r--pkgs/development/python-modules/pytesseract/default.nix4
-rw-r--r--pkgs/development/python-modules/requests_download/default.nix2
-rw-r--r--pkgs/development/python-modules/secretstorage/default.nix3
-rw-r--r--pkgs/development/tools/bazelisk/default.nix6
-rw-r--r--pkgs/development/tools/build-managers/cmake/default.nix4
-rw-r--r--pkgs/development/tools/buildah/default.nix23
-rw-r--r--pkgs/development/tools/misc/automake/automake-1.16.x.nix6
-rw-r--r--pkgs/development/tools/misc/help2man/default.nix4
-rw-r--r--pkgs/development/tools/misc/itstool/default.nix10
-rw-r--r--pkgs/development/tools/ocaml/dune/2.nix4
-rw-r--r--pkgs/development/tools/parsing/bison/default.nix4
-rw-r--r--pkgs/development/tools/profiling/sysprof/default.nix2
-rw-r--r--pkgs/development/tools/skopeo/default.nix23
-rw-r--r--pkgs/games/cataclysm-dda/default.nix18
-rw-r--r--pkgs/games/cataclysm-dda/patches/fix_locale_dir.patch12
-rw-r--r--pkgs/misc/cups/drivers/brlaser/default.nix22
-rw-r--r--pkgs/misc/emulators/wine/default.nix2
-rw-r--r--pkgs/misc/emulators/wine/staging.nix4
-rw-r--r--pkgs/os-specific/linux/alsa-lib/default.nix16
-rw-r--r--pkgs/os-specific/linux/alsa-tools/default.nix4
-rw-r--r--pkgs/os-specific/linux/alsa-topology-conf/default.nix36
-rw-r--r--pkgs/os-specific/linux/alsa-ucm-conf/default.nix36
-rw-r--r--pkgs/os-specific/linux/bbswitch/default.nix14
-rw-r--r--pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch86
-rw-r--r--pkgs/os-specific/linux/firmware/fwupd/default.nix75
-rw-r--r--pkgs/os-specific/linux/firmware/fwupd/installed-tests-path.patch27
-rw-r--r--pkgs/os-specific/linux/gogoclient/default.nix2
-rw-r--r--pkgs/os-specific/linux/kernel/anthraxx.asc325
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix3
-rw-r--r--pkgs/os-specific/linux/kernel/hardened-config.nix43
-rw-r--r--pkgs/os-specific/linux/kernel/hardened-patches.json27
-rw-r--r--pkgs/os-specific/linux/kernel/patches.nix17
-rwxr-xr-xpkgs/os-specific/linux/kernel/update-hardened.py200
-rwxr-xr-xpkgs/os-specific/linux/kernel/update.sh3
-rw-r--r--pkgs/os-specific/linux/lxc/default.nix4
-rw-r--r--pkgs/servers/asterisk/default.nix4
-rw-r--r--pkgs/servers/dns/https-dns-proxy/default.nix34
-rw-r--r--pkgs/servers/http/apache-httpd/2.4.nix4
-rw-r--r--pkgs/tools/admin/pebble/default.nix8
-rw-r--r--pkgs/tools/filesystems/fuse-overlayfs/default.nix8
-rw-r--r--pkgs/tools/misc/3mux/default.nix24
-rw-r--r--pkgs/tools/misc/patdiff/default.nix2
-rw-r--r--pkgs/tools/misc/statserial/default.nix44
-rw-r--r--pkgs/tools/networking/curl/default.nix4
-rw-r--r--pkgs/tools/networking/ferm/default.nix10
-rw-r--r--pkgs/tools/networking/gupnp-tools/default.nix2
-rw-r--r--pkgs/tools/networking/httpie/default.nix4
-rw-r--r--pkgs/tools/networking/mitmproxy/default.nix50
-rw-r--r--pkgs/tools/networking/mitmproxy/pytest5.patch31
-rw-r--r--pkgs/tools/networking/modem-manager/default.nix2
-rw-r--r--pkgs/tools/networking/mu/default.nix19
-rw-r--r--pkgs/tools/networking/rshijack/default.nix23
-rw-r--r--pkgs/tools/networking/sniffglue/default.nix27
-rw-r--r--pkgs/tools/security/age/default.nix8
-rw-r--r--pkgs/tools/security/gnome-keysign/default.nix2
-rw-r--r--pkgs/tools/system/plan9port/default.nix9
-rw-r--r--pkgs/tools/system/plan9port/tmpdir.patch41
-rw-r--r--pkgs/tools/system/tuptime/default.nix35
-rw-r--r--pkgs/top-level/aliases.nix8
-rw-r--r--pkgs/top-level/all-packages.nix47
-rw-r--r--pkgs/top-level/ocaml-packages.nix19
-rw-r--r--pkgs/top-level/perl-packages.nix2
-rw-r--r--pkgs/top-level/python-packages.nix4
456 files changed, 4232 insertions, 1860 deletions
diff --git a/doc/builders/images/appimagetools.xml b/doc/builders/images/appimagetools.xml
index 0767a509a43db..45c5619abd97d 100644
--- a/doc/builders/images/appimagetools.xml
+++ b/doc/builders/images/appimagetools.xml
@@ -63,7 +63,7 @@ type2.AppImage: ELF 64-bit LSB executable, x86-64, version 1 (SYSV) (Lepton 3.x)
 appimageTools.wrapType2 { # or wrapType1
   name = "patchwork"; <co xml:id='ex-appimageTools-wrapping-1' />
   src = fetchurl { <co xml:id='ex-appimageTools-wrapping-2' />
-    url = https://github.com/ssbc/patchwork/releases/download/v3.11.4/Patchwork-3.11.4-linux-x86_64.AppImage;
+    url = "https://github.com/ssbc/patchwork/releases/download/v3.11.4/Patchwork-3.11.4-linux-x86_64.AppImage";
     sha256 =  "1blsprpkvm0ws9b96gb36f0rbf8f5jgmw4x6dsb1kswr4ysf591s";
   };
   extraPkgs = pkgs: with pkgs; [ ]; <co xml:id='ex-appimageTools-wrapping-3' />
diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md
index 650ed34285843..f8884785e90dd 100644
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -412,7 +412,7 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "A pythonic wrapper around FFTW, the FFT library, presenting a unified interface for all the supported transforms";
-    homepage = http://hgomersall.github.com/pyFFTW;
+    homepage = "http://hgomersall.github.com/pyFFTW";
     license = with licenses; [ bsd2 bsd3 ];
     maintainers = with maintainers; [ fridh ];
   };
diff --git a/doc/languages-frameworks/ruby.xml b/doc/languages-frameworks/ruby.xml
index b28745fd6e275..9b36801fb9667 100644
--- a/doc/languages-frameworks/ruby.xml
+++ b/doc/languages-frameworks/ruby.xml
@@ -32,7 +32,7 @@ bundlerEnv rec {
 
   meta = with lib; {
     description = "A monitoring framework that aims to be simple, malleable, and scalable";
-    homepage    = http://sensuapp.org/;
+    homepage    = "http://sensuapp.org/";
     license     = with licenses; mit;
     maintainers = with maintainers; [ theuni ];
     platforms   = platforms.unix;
@@ -69,7 +69,7 @@ bundlerApp {
 
   meta = with lib; {
     description = "Tool and libraries for maintaining Ruby gems.";
-    homepage    = https://github.com/nyarly/corundum;
+    homepage    = "https://github.com/nyarly/corundum";
     license     = licenses.mit;
     maintainers = [ maintainers.nyarly ];
     platforms   = platforms.unix;
diff --git a/doc/old/cross.txt b/doc/old/cross.txt
index ff9fefb04a860..9dd5b4c9993b9 100644
--- a/doc/old/cross.txt
+++ b/doc/old/cross.txt
@@ -60,7 +60,7 @@ stdenv.mkDerivation {
   name = "binutils-2.16.1-arm";
   builder = ./builder.sh;
   src = fetchurl {
-    url = http://ftp.nluug.nl/gnu/binutils/binutils-2.16.1.tar.bz2;
+    url = "http://ftp.nluug.nl/gnu/binutils/binutils-2.16.1.tar.bz2";
     sha256 = "1ian3kwh2vg6hr3ymrv48s04gijs539vzrq62xr76bxbhbwnz2np";
   };
   inherit noSysDirs;
@@ -84,7 +84,7 @@ stdenv.mkDerivation {
   name = "linux-headers-2.6.13.1-arm";
   builder = ./builder.sh;
   src = fetchurl {
-    url = http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.13.1.tar.bz2;
+    url = "http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.13.1.tar.bz2";
     sha256 = "12qxmc827fjhaz53kjy7vyrzsaqcg78amiqsb3qm20z26w705lma";
   };
 }
diff --git a/doc/release-notes.xml b/doc/release-notes.xml
index b85f61da079c0..7575289e7559b 100644
--- a/doc/release-notes.xml
+++ b/doc/release-notes.xml
@@ -190,7 +190,7 @@ preConfigure = "configureFlagsArray=(\"CFLAGS=-O0 -g\")";</programlisting>
       The function <function>fetchurl</function> now has support for two different kinds of mirroring of files. First, it has support for <emphasis>content-addressable mirrors</emphasis>. For example, given the <function>fetchurl</function> call
 <programlisting>
 fetchurl {
-  url = http://releases.mozilla.org/<replaceable>...</replaceable>/firefox-2.0.0.6-source.tar.bz2;
+  url = "http://releases.mozilla.org/<replaceable>...</replaceable>/firefox-2.0.0.6-source.tar.bz2";
   sha1 = "eb72f55e4a8bf08e8c6ef227c0ade3d068ba1082";
 }</programlisting>
       <function>fetchurl</function> will first try to download this file from <link
diff --git a/doc/stdenv/stdenv.xml b/doc/stdenv/stdenv.xml
index b589952743c32..e4cbdd4abb57b 100644
--- a/doc/stdenv/stdenv.xml
+++ b/doc/stdenv/stdenv.xml
@@ -14,7 +14,7 @@
 stdenv.mkDerivation {
   name = "libfoo-1.2.3";
   src = fetchurl {
-    url = http://example.org/libfoo-1.2.3.tar.bz2;
+    url = "http://example.org/libfoo-1.2.3.tar.bz2";
     sha256 = "0x2g1jqygyr5wiwg4ma1nd7w4ydpy82z9gkcv8vh2v8dn3y58v5m";
   };
 }</programlisting>
diff --git a/lib/licenses.nix b/lib/licenses.nix
index 81976a769c090..94bcd777f0d15 100644
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@@ -2,7 +2,7 @@
 let
 
   spdx = lic: lic // {
-    url = "http://spdx.org/licenses/${lic.spdxId}.html";
+    url = "https://spdx.org/licenses/${lic.spdxId}.html";
   };
 
 in
@@ -40,13 +40,13 @@ lib.mapAttrs (n: v: v // { shortName = n; }) {
 
   amazonsl = {
     fullName = "Amazon Software License";
-    url = "http://aws.amazon.com/asl/";
+    url = "https://aws.amazon.com/asl/";
     free = false;
   };
 
   amd = {
     fullName = "AMD License Agreement";
-    url = "http://developer.amd.com/amd-license-agreement/";
+    url = "https://developer.amd.com/amd-license-agreement/";
     free = false;
   };
 
@@ -230,7 +230,7 @@ lib.mapAttrs (n: v: v // { shortName = n; }) {
 
   eapl = {
     fullName = "EPSON AVASYS PUBLIC LICENSE";
-    url = "http://avasys.jp/hp/menu000000700/hpg000000603.htm";
+    url = "https://avasys.jp/hp/menu000000700/hpg000000603.htm";
     free = false;
   };
 
@@ -293,7 +293,7 @@ lib.mapAttrs (n: v: v // { shortName = n; }) {
 
   ffsl = {
     fullName = "Floodgap Free Software License";
-    url = "http://www.floodgap.com/software/ffsl/license.html";
+    url = "https://www.floodgap.com/software/ffsl/license.html";
     free = false;
   };
 
@@ -370,7 +370,7 @@ lib.mapAttrs (n: v: v // { shortName = n; }) {
   # Intel's license, seems free
   iasl = {
     fullName = "iASL";
-    url = "http://www.calculate-linux.org/packages/licenses/iASL";
+    url = "https://old.calculate-linux.org/packages/licenses/iASL";
   };
 
   ijg = spdx {
@@ -385,13 +385,13 @@ lib.mapAttrs (n: v: v // { shortName = n; }) {
 
   inria-compcert = {
     fullName  = "INRIA Non-Commercial License Agreement for the CompCert verified compiler";
-    url       = "http://compcert.inria.fr/doc/LICENSE";
+    url       = "http://compcert.inria.fr/doc/LICENSE"; # https is broken
     free      = false;
   };
 
   inria-icesl = {
     fullName = "INRIA Non-Commercial License Agreement for IceSL";
-    url      = "http://shapeforge.loria.fr/icesl/EULA_IceSL_binary.pdf";
+    url      = "http://shapeforge.loria.fr/icesl/EULA_IceSL_binary.pdf"; # https is broken
     free     = false;
   };
 
@@ -469,7 +469,7 @@ lib.mapAttrs (n: v: v // { shortName = n; }) {
 
   llgpl21 = {
     fullName = "Lisp LGPL; GNU Lesser General Public License version 2.1 with Franz Inc. preamble for clarification of LGPL terms in context of Lisp";
-    url = "http://opensource.franz.com/preamble.html";
+    url = "https://opensource.franz.com/preamble.html";
   };
 
   lppl12 = spdx {
@@ -493,7 +493,7 @@ lib.mapAttrs (n: v: v // { shortName = n; }) {
   };
 
   # spdx.org does not (yet) differentiate between the X11 and Expat versions
-  # for details see http://en.wikipedia.org/wiki/MIT_License#Various_versions
+  # for details see https://en.wikipedia.org/wiki/MIT_License#Various_versions
   mit = spdx {
     spdxId = "MIT";
     fullName = "MIT License";
@@ -596,7 +596,7 @@ lib.mapAttrs (n: v: v // { shortName = n; }) {
   psfl = spdx {
     spdxId = "Python-2.0";
     fullName = "Python Software Foundation License version 2";
-    #url = http://docs.python.org/license.html;
+    url = "https://docs.python.org/license.html";
   };
 
   publicDomain = {
@@ -620,7 +620,7 @@ lib.mapAttrs (n: v: v // { shortName = n; }) {
 
   qwt = {
     fullName = "Qwt License, Version 1.0";
-    url = "http://qwt.sourceforge.net/qwtlicense.html";
+    url = "https://qwt.sourceforge.io/qwtlicense.html";
   };
 
   ruby = spdx {
@@ -646,7 +646,7 @@ lib.mapAttrs (n: v: v // { shortName = n; }) {
   smail = {
     shortName = "smail";
     fullName = "SMAIL General Public License";
-    url = "http://metadata.ftp-master.debian.org/changelogs/main/d/debianutils/debianutils_4.8.1_copyright";
+    url = "https://sources.debian.org/copyright/license/debianutils/4.9.1/";
   };
 
   sspl = {
@@ -663,7 +663,7 @@ lib.mapAttrs (n: v: v // { shortName = n; }) {
 
   ufl = {
     fullName = "Ubuntu Font License 1.0";
-    url = "http://font.ubuntu.com/ufl/ubuntu-font-licence-1.0.txt";
+    url = "https://ubuntu.com/legal/font-licence";
   };
 
   unfree = {
@@ -740,7 +740,7 @@ lib.mapAttrs (n: v: v // { shortName = n; }) {
 
   xfig = {
     fullName = "xfig";
-    url = "http://mcj.sourceforge.net/authors.html#xfig";
+    url = "http://mcj.sourceforge.net/authors.html#xfig"; # https is broken
   };
 
   zlib = spdx {
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 4dd1b222d55e3..dcf96307c3b7e 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -6478,6 +6478,12 @@
       fingerprint = "92B2 904F D293 C94D C4C9  3E6B BFBA F4C9 75F7 6450";
     }];
   };
+  roastiek = {
+    email = "r.dee.b.b@gmail.com";
+    github = "roastiek";
+    githubId = 422802;
+    name = "Rostislav Beneš";
+  };
   rob = {
     email = "rob.vermaas@gmail.com";
     github = "rbvermaa";
@@ -7810,6 +7816,12 @@
     githubId = 563054;
     name = "Thomas Tuegel";
   };
+  turion = {
+    email = "programming@manuelbaerenz.de";
+    github = "turion";
+    githubId = 303489;
+    name = "Manuel Bärenz";
+  };
   tv = {
     email = "tv@krebsco.de";
     github = "4z3";
diff --git a/nixos/modules/hardware/opengl.nix b/nixos/modules/hardware/opengl.nix
index 28cddea8b79cf..061528f4b1b53 100644
--- a/nixos/modules/hardware/opengl.nix
+++ b/nixos/modules/hardware/opengl.nix
@@ -10,14 +10,6 @@ let
 
   videoDrivers = config.services.xserver.videoDrivers;
 
-  makePackage = p: pkgs.buildEnv {
-    name = "mesa-drivers+txc-${p.mesa.version}";
-    paths =
-      [ p.mesa.drivers
-        (if cfg.s3tcSupport then p.libtxc_dxtn else p.libtxc_dxtn_s2tc)
-      ];
-  };
-
   package = pkgs.buildEnv {
     name = "opengl-drivers";
     paths = [ cfg.package ] ++ cfg.extraPackages;
@@ -34,6 +26,9 @@ in
 
   imports = [
     (mkRenamedOptionModule [ "services" "xserver" "vaapiDrivers" ] [ "hardware" "opengl" "extraPackages" ])
+    (mkRemovedOptionModule [ "hardware" "opengl" "s3tcSupport" ] ''
+      S3TC support is now always enabled in Mesa.
+    '')
   ];
 
   options = {
@@ -74,17 +69,6 @@ in
         '';
       };
 
-      s3tcSupport = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Make S3TC(S3 Texture Compression) via libtxc_dxtn available
-          to OpenGL drivers instead of the patent-free S2TC replacement.
-
-          Using this library may require a patent license depending on your location.
-        '';
-      };
-
       package = mkOption {
         type = types.package;
         internal = true;
@@ -166,8 +150,8 @@ in
     environment.sessionVariables.LD_LIBRARY_PATH = mkIf cfg.setLdLibraryPath
       ([ "/run/opengl-driver/lib" ] ++ optional cfg.driSupport32Bit "/run/opengl-driver-32/lib");
 
-    hardware.opengl.package = mkDefault (makePackage pkgs);
-    hardware.opengl.package32 = mkDefault (makePackage pkgs.pkgsi686Linux);
+    hardware.opengl.package = mkDefault pkgs.mesa.drivers;
+    hardware.opengl.package32 = mkDefault pkgs.pkgsi686Linux.mesa.drivers;
 
     boot.extraModulePackages = optional (elem "virtualbox" videoDrivers) kernelPackages.virtualboxGuestAdditions;
   };
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 41304988a5967..df08ac2959ed4 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -546,6 +546,7 @@
   ./services/monitoring/teamviewer.nix
   ./services/monitoring/telegraf.nix
   ./services/monitoring/thanos.nix
+  ./services/monitoring/tuptime.nix
   ./services/monitoring/ups.nix
   ./services/monitoring/uptime.nix
   ./services/monitoring/vnstat.nix
diff --git a/nixos/modules/profiles/hardened.nix b/nixos/modules/profiles/hardened.nix
index 35743d83134bd..ef8c0d74f0628 100644
--- a/nixos/modules/profiles/hardened.nix
+++ b/nixos/modules/profiles/hardened.nix
@@ -7,7 +7,7 @@ with lib;
 
 {
   meta = {
-    maintainers = [ maintainers.joachifm ];
+    maintainers = [ maintainers.joachifm maintainers.emily ];
   };
 
   boot.kernelPackages = mkDefault pkgs.linuxPackages_hardened;
@@ -21,8 +21,6 @@ with lib;
 
   security.lockKernelModules = mkDefault true;
 
-  security.allowUserNamespaces = mkDefault false;
-
   security.protectKernelImage = mkDefault true;
 
   security.allowSimultaneousMultithreading = mkDefault false;
@@ -37,15 +35,9 @@ with lib;
     # Slab/slub sanity checks, redzoning, and poisoning
     "slub_debug=FZP"
 
-    # Disable slab merging to make certain heap overflow attacks harder
-    "slab_nomerge"
-
     # Overwrite free'd memory
     "page_poison=1"
 
-    # Disable legacy virtual syscalls
-    "vsyscall=none"
-
     # Enable page allocator randomization
     "page_alloc.shuffle=1"
   ];
@@ -82,38 +74,12 @@ with lib;
   # (e.g., parent/child)
   boot.kernel.sysctl."kernel.yama.ptrace_scope" = mkOverride 500 1;
 
-  # Restrict access to kernel ring buffer (information leaks)
-  boot.kernel.sysctl."kernel.dmesg_restrict" = mkDefault true;
-
   # Hide kptrs even for processes with CAP_SYSLOG
   boot.kernel.sysctl."kernel.kptr_restrict" = mkOverride 500 2;
 
-  # Unprivileged access to bpf() has been used for privilege escalation in
-  # the past
-  boot.kernel.sysctl."kernel.unprivileged_bpf_disabled" = mkDefault true;
-
   # Disable bpf() JIT (to eliminate spray attacks)
   boot.kernel.sysctl."net.core.bpf_jit_enable" = mkDefault false;
 
-  # ... or at least apply some hardening to it
-  boot.kernel.sysctl."net.core.bpf_jit_harden" = mkDefault true;
-
-  # Raise ASLR entropy for 64bit & 32bit, respectively.
-  #
-  # Note: mmap_rnd_compat_bits may not exist on 64bit.
-  boot.kernel.sysctl."vm.mmap_rnd_bits" = mkDefault 32;
-  boot.kernel.sysctl."vm.mmap_rnd_compat_bits" = mkDefault 16;
-
-  # Allowing users to mmap() memory starting at virtual address 0 can turn a
-  # NULL dereference bug in the kernel into code execution with elevated
-  # privilege.  Mitigate by enforcing a minimum base addr beyond the NULL memory
-  # space.  This breaks applications that require mapping the 0 page, such as
-  # dosemu or running 16bit applications under wine.  It also breaks older
-  # versions of qemu.
-  #
-  # The value is taken from the KSPP recommendations (Debian uses 4096).
-  boot.kernel.sysctl."vm.mmap_min_addr" = mkDefault 65536;
-
   # Disable ftrace debugging
   boot.kernel.sysctl."kernel.ftrace_enabled" = mkDefault false;
 
@@ -140,7 +106,4 @@ with lib;
   # Ignore outgoing ICMP redirects (this is ipv4 only)
   boot.kernel.sysctl."net.ipv4.conf.all.send_redirects" = mkDefault false;
   boot.kernel.sysctl."net.ipv4.conf.default.send_redirects" = mkDefault false;
-
-  # Restrict userfaultfd syscalls to processes with the SYS_PTRACE capability
-  boot.kernel.sysctl."vm.unprivileged_userfaultfd" = mkDefault false;
 }
diff --git a/nixos/modules/security/acme.nix b/nixos/modules/security/acme.nix
index d5fb9b58f2ef3..39976380e3b45 100644
--- a/nixos/modules/security/acme.nix
+++ b/nixos/modules/security/acme.nix
@@ -343,7 +343,9 @@ in
 
                           # Test that existing cert is older than new cert
                           KEY=${spath}/certificates/${keyName}.key
+                          KEY_CHANGED=no
                           if [ -e $KEY -a $KEY -nt key.pem ]; then
+                            KEY_CHANGED=yes
                             cp -p ${spath}/certificates/${keyName}.key key.pem
                             cp -p ${spath}/certificates/${keyName}.crt fullchain.pem
                             cp -p ${spath}/certificates/${keyName}.issuer.crt chain.pem
@@ -354,7 +356,10 @@ in
                           chmod ${fileMode} *.pem
                           chown '${data.user}:${data.group}' *.pem
 
-                          ${data.postRun}
+                          if [ "$KEY_CHANGED" = "yes" ]; then
+                            : # noop in case postRun is empty
+                            ${data.postRun}
+                          fi
                         '';
                       in
                         "+${script}";
diff --git a/nixos/modules/services/databases/cockroachdb.nix b/nixos/modules/services/databases/cockroachdb.nix
index b6f94a4881a06..35fb46d69d8e5 100644
--- a/nixos/modules/services/databases/cockroachdb.nix
+++ b/nixos/modules/services/databases/cockroachdb.nix
@@ -153,7 +153,7 @@ in
         defaultText = "pkgs.cockroachdb";
         description = ''
           The CockroachDB derivation to use for running the service.
-          
+
           This would primarily be useful to enable Enterprise Edition features
           in your own custom CockroachDB build (Nixpkgs CockroachDB binaries
           only contain open source features and open source code).
diff --git a/nixos/modules/services/mail/rss2email.nix b/nixos/modules/services/mail/rss2email.nix
index c1e5964c4536d..7f8d2adac648a 100644
--- a/nixos/modules/services/mail/rss2email.nix
+++ b/nixos/modules/services/mail/rss2email.nix
@@ -91,6 +91,8 @@ in {
       };
     };
 
+    environment.systemPackages = with pkgs; [ rss2email ];
+
     services.rss2email.config.to = cfg.to;
 
     systemd.tmpfiles.rules = [
diff --git a/nixos/modules/services/misc/redmine.nix b/nixos/modules/services/misc/redmine.nix
index 3b8c14d196f88..1febdba0c8f92 100644
--- a/nixos/modules/services/misc/redmine.nix
+++ b/nixos/modules/services/misc/redmine.nix
@@ -132,7 +132,7 @@ in
         example = literalExample ''
           {
             dkuk-redmine_alex_skin = builtins.fetchurl {
-              url = https://bitbucket.org/dkuk/redmine_alex_skin/get/1842ef675ef3.zip;
+              url = "https://bitbucket.org/dkuk/redmine_alex_skin/get/1842ef675ef3.zip";
               sha256 = "0hrin9lzyi50k4w2bd2b30vrf1i4fi1c0gyas5801wn8i7kpm9yl";
             };
           }
@@ -146,7 +146,7 @@ in
         example = literalExample ''
           {
             redmine_env_auth = builtins.fetchurl {
-              url = https://github.com/Intera/redmine_env_auth/archive/0.6.zip;
+              url = "https://github.com/Intera/redmine_env_auth/archive/0.6.zip";
               sha256 = "0yyr1yjd8gvvh832wdc8m3xfnhhxzk2pk3gm2psg5w9jdvd6skak";
             };
           }
diff --git a/nixos/modules/services/monitoring/tuptime.nix b/nixos/modules/services/monitoring/tuptime.nix
new file mode 100644
index 0000000000000..731260a5c20af
--- /dev/null
+++ b/nixos/modules/services/monitoring/tuptime.nix
@@ -0,0 +1,84 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+  cfg = config.services.tuptime;
+
+in {
+
+  options.services.tuptime = {
+
+    enable = mkEnableOption "the total uptime service";
+
+    timer = {
+      enable = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Whether to regularly log uptime to detect bad shutdowns.";
+      };
+
+      period = mkOption {
+        type = types.str;
+        default = "*:0/5";
+        description = "systemd calendar event";
+      };
+    };
+  };
+
+
+  config = mkIf cfg.enable {
+
+    environment.systemPackages = [ pkgs.tuptime ];
+
+    users.users.tuptime.description = "tuptime database owner";
+
+    systemd = {
+      services = {
+
+        tuptime = {
+          description = "the total uptime service";
+          documentation = [ "man:tuptime(1)" ];
+          after = [ "time-sync.target" ];
+          wantedBy = [ "multi-user.target" ];
+          serviceConfig = {
+            StateDirectory = "tuptime";
+            Type = "oneshot";
+            User = "tuptime";
+            RemainAfterExit = true;
+            ExecStart = "${pkgs.tuptime}/bin/tuptime -x";
+            ExecStop = "${pkgs.tuptime}/bin/tuptime -xg";
+          };
+        };
+
+        tuptime-oneshot = mkIf cfg.timer.enable {
+          description = "the tuptime scheduled execution unit";
+          serviceConfig = {
+            StateDirectory = "tuptime";
+            Type = "oneshot";
+            User = "tuptime";
+            ExecStart = "${pkgs.tuptime}/bin/tuptime -x";
+          };
+        };
+      };
+
+      timers.tuptime = mkIf cfg.timer.enable {
+        description = "the tuptime scheduled execution timer";
+        # this timer should be started if the service is started
+        # even if the timer was previously stopped
+        wantedBy = [ "tuptime.service" "timers.target" ];
+        # this timer should be stopped if the service is stopped
+        partOf = [ "tuptime.service" ];
+        timerConfig = {
+          OnBootSec = "1min";
+          OnCalendar = cfg.timer.period;
+          Unit = "tuptime-oneshot.service";
+        };
+      };
+    };
+  };
+
+  meta.maintainers = [ maintainers.evils ];
+
+}
diff --git a/nixos/modules/services/networking/ntp/chrony.nix b/nixos/modules/services/networking/ntp/chrony.nix
index da9d960cc142c..f1062edaa05ba 100644
--- a/nixos/modules/services/networking/ntp/chrony.nix
+++ b/nixos/modules/services/networking/ntp/chrony.nix
@@ -92,6 +92,11 @@ in
 
     systemd.services.systemd-timedated.environment = { SYSTEMD_TIMEDATED_NTP_SERVICES = "chronyd.service"; };
 
+    systemd.tmpfiles.rules = [
+      "d ${stateDir} 0755 chrony chrony - -"
+      "f ${keyFile} 0640 chrony chrony -"
+    ];
+
     systemd.services.chronyd =
       { description = "chrony NTP daemon";
 
@@ -103,13 +108,6 @@ in
 
         path = [ pkgs.chrony ];
 
-        preStart = ''
-          mkdir -m 0755 -p ${stateDir}
-          touch ${keyFile}
-          chmod 0640 ${keyFile}
-          chown chrony:chrony ${stateDir} ${keyFile}
-        '';
-
         unitConfig.ConditionCapability = "CAP_SYS_TIME";
         serviceConfig =
           { Type = "simple";
@@ -118,7 +116,7 @@ in
             ProtectHome = "yes";
             ProtectSystem = "full";
             PrivateTmp = "yes";
-
+            StateDirectory = "chrony";
           };
 
       };
diff --git a/nixos/modules/services/security/bitwarden_rs/default.nix b/nixos/modules/services/security/bitwarden_rs/default.nix
index a63be0ee766e9..903a532703774 100644
--- a/nixos/modules/services/security/bitwarden_rs/default.nix
+++ b/nixos/modules/services/security/bitwarden_rs/default.nix
@@ -58,7 +58,7 @@ in {
       default = {};
       example = literalExample ''
         {
-          domain = https://bw.domain.tld:8443;
+          domain = "https://bw.domain.tld:8443";
           signupsAllowed = true;
           rocketPort = 8222;
           rocketLog = "critical";
diff --git a/nixos/modules/services/web-apps/wordpress.nix b/nixos/modules/services/web-apps/wordpress.nix
index c48a44097372e..5fbe53221ae87 100644
--- a/nixos/modules/services/web-apps/wordpress.nix
+++ b/nixos/modules/services/web-apps/wordpress.nix
@@ -105,7 +105,7 @@ let
               name = "embed-pdf-viewer-plugin";
               # Download the theme from the wordpress site
               src = pkgs.fetchurl {
-                url = https://downloads.wordpress.org/plugin/embed-pdf-viewer.2.0.3.zip;
+                url = "https://downloads.wordpress.org/plugin/embed-pdf-viewer.2.0.3.zip";
                 sha256 = "1rhba5h5fjlhy8p05zf0p14c9iagfh96y91r36ni0rmk6y891lyd";
               };
               # We need unzip to build this package
@@ -132,7 +132,7 @@ let
               name = "responsive-theme";
               # Download the theme from the wordpress site
               src = pkgs.fetchurl {
-                url = https://downloads.wordpress.org/theme/responsive.3.14.zip;
+                url = "https://downloads.wordpress.org/theme/responsive.3.14.zip";
                 sha256 = "0rjwm811f4aa4q43r77zxlpklyb85q08f9c8ns2akcarrvj5ydx3";
               };
               # We need unzip to build this package
diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index 7f207e6c7ef49..518d875841bd7 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -894,6 +894,13 @@ in
       "sysctl.d/50-coredump.conf".source = "${systemd}/example/sysctl.d/50-coredump.conf";
       "sysctl.d/50-default.conf".source = "${systemd}/example/sysctl.d/50-default.conf";
 
+      "tmpfiles.d/00-nixos.conf".text = ''
+        # This file is created automatically and should not be modified.
+        # Please change the option ‘systemd.tmpfiles.rules’ instead.
+
+        ${concatStringsSep "\n" cfg.tmpfiles.rules}
+      '';
+
       "tmpfiles.d/home.conf".source = "${systemd}/example/tmpfiles.d/home.conf";
       "tmpfiles.d/journal-nocow.conf".source = "${systemd}/example/tmpfiles.d/journal-nocow.conf";
       "tmpfiles.d/portables.conf".source = "${systemd}/example/tmpfiles.d/portables.conf";
@@ -906,13 +913,6 @@ in
       "tmpfiles.d/var.conf".source = "${systemd}/example/tmpfiles.d/var.conf";
       "tmpfiles.d/x11.conf".source = "${systemd}/example/tmpfiles.d/x11.conf";
 
-      "tmpfiles.d/nixos.conf".text = ''
-        # This file is created automatically and should not be modified.
-        # Please change the option ‘systemd.tmpfiles.rules’ instead.
-
-        ${concatStringsSep "\n" cfg.tmpfiles.rules}
-      '';
-
       "systemd/system-generators" = { source = hooks "generators" cfg.generators; };
       "systemd/system-shutdown" = { source = hooks "shutdown" cfg.shutdown; };
     });
diff --git a/nixos/modules/virtualisation/containers.nix b/nixos/modules/virtualisation/containers.nix
index dad211ef55bae..2db5c117aa7f3 100644
--- a/nixos/modules/virtualisation/containers.nix
+++ b/nixos/modules/virtualisation/containers.nix
@@ -463,10 +463,15 @@ in
                 A specification of the desired configuration of this
                 container, as a NixOS module.
               '';
-              type = lib.mkOptionType {
+              type = let
+                confPkgs = if config.pkgs == null then pkgs else config.pkgs;
+              in lib.mkOptionType {
                 name = "Toplevel NixOS config";
-                merge = loc: defs: (import ../../lib/eval-config.nix {
+                merge = loc: defs: (import (confPkgs.path + "/nixos/lib/eval-config.nix") {
                   inherit system;
+                  pkgs = confPkgs;
+                  baseModules = import (confPkgs.path + "/nixos/modules/module-list.nix");
+                  inherit (confPkgs) lib;
                   modules =
                     let
                       extraConfig = {
@@ -515,6 +520,15 @@ in
               '';
             };
 
+            pkgs = mkOption {
+              type = types.nullOr types.attrs;
+              default = null;
+              example = literalExample "pkgs";
+              description = ''
+                Customise which nixpkgs to use for this container.
+              '';
+            };
+
             ephemeral = mkOption {
               type = types.bool;
               default = false;
diff --git a/nixos/release-combined.nix b/nixos/release-combined.nix
index 02f19610f8a6d..87783c6609535 100644
--- a/nixos/release-combined.nix
+++ b/nixos/release-combined.nix
@@ -75,6 +75,7 @@ in rec {
         (onFullSupported "nixos.tests.fontconfig-default-fonts")
         (onFullSupported "nixos.tests.gnome3")
         (onFullSupported "nixos.tests.gnome3-xorg")
+        (onFullSupported "nixos.tests.hardened")
         (onSystems ["x86_64-linux"] "nixos.tests.hibernate")
         (onFullSupported "nixos.tests.i3wm")
         (onSystems ["x86_64-linux"] "nixos.tests.installer.btrfsSimple")
@@ -96,6 +97,8 @@ in rec {
         (onFullSupported "nixos.tests.keymap.dvp")
         (onFullSupported "nixos.tests.keymap.neo")
         (onFullSupported "nixos.tests.keymap.qwertz")
+        (onFullSupported "nixos.tests.latestKernel.hardened")
+        (onFullSupported "nixos.tests.latestKernel.login")
         (onFullSupported "nixos.tests.lightdm")
         (onFullSupported "nixos.tests.login")
         (onFullSupported "nixos.tests.misc")
diff --git a/nixos/tests/acme.nix b/nixos/tests/acme.nix
index 638601cd75f3f..693f02962f452 100644
--- a/nixos/tests/acme.nix
+++ b/nixos/tests/acme.nix
@@ -1,5 +1,5 @@
 let
-  commonConfig = ./common/letsencrypt/common.nix;
+  commonConfig = ./common/acme/client;
 
   dnsScript = {writeScript, dnsAddress, bash, curl}: writeScript "dns-hook.sh" ''
     #!${bash}/bin/bash
@@ -16,8 +16,8 @@ in import ./make-test-python.nix {
   name = "acme";
 
   nodes = rec {
-    letsencrypt = { nodes, lib, ... }: {
-      imports = [ ./common/letsencrypt ];
+    acme = { nodes, lib, ... }: {
+      imports = [ ./common/acme/server ];
       networking.nameservers = lib.mkForce [
         nodes.dnsserver.config.networking.primaryIPAddress
       ];
@@ -33,8 +33,7 @@ in import ./make-test-python.nix {
         serviceConfig = {
           ExecStart = "${pkgs.pebble}/bin/pebble-challtestsrv -dns01 ':53' -defaultIPv6 '' -defaultIPv4 '${nodes.webserver.config.networking.primaryIPAddress}'";
           # Required to bind on privileged ports.
-          User = "root";
-          Group = "root";
+          AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
         };
       };
     };
@@ -45,19 +44,16 @@ in import ./make-test-python.nix {
         nodes.dnsserver.config.networking.primaryIPAddress
       ];
       networking.firewall.allowedTCPPorts = [ 80 ];
-      security.acme = {
-        server = "https://acme-v02.api.letsencrypt.org/dir";
-        certs."standalone.com" = {
-            webroot = "/var/lib/acme/acme-challenges";
-        };
+      security.acme.certs."standalone.test" = {
+        webroot = "/var/lib/acme/acme-challenges";
       };
-      systemd.targets."acme-finished-standalone.com" = {};
-      systemd.services."acme-standalone.com" = {
-        wants = [ "acme-finished-standalone.com.target" ];
-        before = [ "acme-finished-standalone.com.target" ];
+      systemd.targets."acme-finished-standalone.test" = {};
+      systemd.services."acme-standalone.test" = {
+        wants = [ "acme-finished-standalone.test.target" ];
+        before = [ "acme-finished-standalone.test.target" ];
       };
       services.nginx.enable = true;
-      services.nginx.virtualHosts."standalone.com" = {
+      services.nginx.virtualHosts."standalone.test" = {
         locations."/.well-known/acme-challenge".root = "/var/lib/acme/acme-challenges";
       };
     };
@@ -71,16 +67,16 @@ in import ./make-test-python.nix {
 
       # A target remains active. Use this to probe the fact that
       # a service fired eventhough it is not RemainAfterExit
-      systemd.targets."acme-finished-a.example.com" = {};
-      systemd.services."acme-a.example.com" = {
-        wants = [ "acme-finished-a.example.com.target" ];
-        before = [ "acme-finished-a.example.com.target" ];
+      systemd.targets."acme-finished-a.example.test" = {};
+      systemd.services."acme-a.example.test" = {
+        wants = [ "acme-finished-a.example.test.target" ];
+        before = [ "acme-finished-a.example.test.target" ];
         after = [ "nginx.service" ];
       };
 
       services.nginx.enable = true;
 
-      services.nginx.virtualHosts."a.example.com" = {
+      services.nginx.virtualHosts."a.example.test" = {
         enableACME = true;
         forceSSL = true;
         locations."/".root = pkgs.runCommand "docroot" {} ''
@@ -89,16 +85,16 @@ in import ./make-test-python.nix {
         '';
       };
 
-      security.acme.server = "https://acme-v02.api.letsencrypt.org/dir";
+      security.acme.server = "https://acme.test/dir";
 
       specialisation.second-cert.configuration = {pkgs, ...}: {
-        systemd.targets."acme-finished-b.example.com" = {};
-        systemd.services."acme-b.example.com" = {
-          wants = [ "acme-finished-b.example.com.target" ];
-          before = [ "acme-finished-b.example.com.target" ];
+        systemd.targets."acme-finished-b.example.test" = {};
+        systemd.services."acme-b.example.test" = {
+          wants = [ "acme-finished-b.example.test.target" ];
+          before = [ "acme-finished-b.example.test.target" ];
           after = [ "nginx.service" ];
         };
-        services.nginx.virtualHosts."b.example.com" = {
+        services.nginx.virtualHosts."b.example.test" = {
           enableACME = true;
           forceSSL = true;
           locations."/".root = pkgs.runCommand "docroot" {} ''
@@ -108,8 +104,8 @@ in import ./make-test-python.nix {
         };
       };
       specialisation.dns-01.configuration = {pkgs, config, nodes, lib, ...}: {
-        security.acme.certs."example.com" = {
-          domain = "*.example.com";
+        security.acme.certs."example.test" = {
+          domain = "*.example.test";
           dnsProvider = "exec";
           dnsPropagationCheck = false;
           credentialsFile = with pkgs; writeText "wildcard.env" ''
@@ -118,17 +114,17 @@ in import ./make-test-python.nix {
           user = config.services.nginx.user;
           group = config.services.nginx.group;
         };
-        systemd.targets."acme-finished-example.com" = {};
-        systemd.services."acme-example.com" = {
-          wants = [ "acme-finished-example.com.target" ];
-          before = [ "acme-finished-example.com.target" "nginx.service" ];
+        systemd.targets."acme-finished-example.test" = {};
+        systemd.services."acme-example.test" = {
+          wants = [ "acme-finished-example.test.target" ];
+          before = [ "acme-finished-example.test.target" "nginx.service" ];
           wantedBy = [ "nginx.service" ];
         };
-        services.nginx.virtualHosts."c.example.com" = {
+        services.nginx.virtualHosts."c.example.test" = {
           forceSSL = true;
-          sslCertificate = config.security.acme.certs."example.com".directory + "/cert.pem";
-          sslTrustedCertificate = config.security.acme.certs."example.com".directory + "/full.pem";
-          sslCertificateKey = config.security.acme.certs."example.com".directory + "/key.pem";
+          sslCertificate = config.security.acme.certs."example.test".directory + "/cert.pem";
+          sslTrustedCertificate = config.security.acme.certs."example.test".directory + "/full.pem";
+          sslCertificateKey = config.security.acme.certs."example.test".directory + "/key.pem";
           locations."/".root = pkgs.runCommand "docroot" {} ''
             mkdir -p "$out"
             echo hello world > "$out/index.html"
@@ -159,46 +155,44 @@ in import ./make-test-python.nix {
       client.start()
       dnsserver.start()
 
-      letsencrypt.wait_for_unit("default.target")
+      acme.wait_for_unit("default.target")
       dnsserver.wait_for_unit("pebble-challtestsrv.service")
       client.succeed(
-          'curl --data \'{"host": "acme-v02.api.letsencrypt.org", "addresses": ["${nodes.letsencrypt.config.networking.primaryIPAddress}"]}\' http://${nodes.dnsserver.config.networking.primaryIPAddress}:8055/add-a'
+          'curl --data \'{"host": "acme.test", "addresses": ["${nodes.acme.config.networking.primaryIPAddress}"]}\' http://${nodes.dnsserver.config.networking.primaryIPAddress}:8055/add-a'
       )
       client.succeed(
-          'curl --data \'{"host": "standalone.com", "addresses": ["${nodes.acmeStandalone.config.networking.primaryIPAddress}"]}\' http://${nodes.dnsserver.config.networking.primaryIPAddress}:8055/add-a'
+          'curl --data \'{"host": "standalone.test", "addresses": ["${nodes.acmeStandalone.config.networking.primaryIPAddress}"]}\' http://${nodes.dnsserver.config.networking.primaryIPAddress}:8055/add-a'
       )
 
-      letsencrypt.start()
+      acme.start()
       acmeStandalone.start()
 
-      letsencrypt.wait_for_unit("default.target")
-      letsencrypt.wait_for_unit("pebble.service")
+      acme.wait_for_unit("default.target")
+      acme.wait_for_unit("pebble.service")
 
       with subtest("can request certificate with HTTPS-01 challenge"):
           acmeStandalone.wait_for_unit("default.target")
-          acmeStandalone.succeed("systemctl start acme-standalone.com.service")
-          acmeStandalone.wait_for_unit("acme-finished-standalone.com.target")
+          acmeStandalone.succeed("systemctl start acme-standalone.test.service")
+          acmeStandalone.wait_for_unit("acme-finished-standalone.test.target")
 
       client.wait_for_unit("default.target")
 
-      client.succeed("curl https://acme-v02.api.letsencrypt.org:15000/roots/0 > /tmp/ca.crt")
-      client.succeed(
-          "curl https://acme-v02.api.letsencrypt.org:15000/intermediate-keys/0 >> /tmp/ca.crt"
-      )
+      client.succeed("curl https://acme.test:15000/roots/0 > /tmp/ca.crt")
+      client.succeed("curl https://acme.test:15000/intermediate-keys/0 >> /tmp/ca.crt")
 
       with subtest("Can request certificate for nginx service"):
-          webserver.wait_for_unit("acme-finished-a.example.com.target")
+          webserver.wait_for_unit("acme-finished-a.example.test.target")
           client.succeed(
-              "curl --cacert /tmp/ca.crt https://a.example.com/ | grep -qF 'hello world'"
+              "curl --cacert /tmp/ca.crt https://a.example.test/ | grep -qF 'hello world'"
           )
 
       with subtest("Can add another certificate for nginx service"):
           webserver.succeed(
               "/run/current-system/specialisation/second-cert/bin/switch-to-configuration test"
           )
-          webserver.wait_for_unit("acme-finished-b.example.com.target")
+          webserver.wait_for_unit("acme-finished-b.example.test.target")
           client.succeed(
-              "curl --cacert /tmp/ca.crt https://b.example.com/ | grep -qF 'hello world'"
+              "curl --cacert /tmp/ca.crt https://b.example.test/ | grep -qF 'hello world'"
           )
 
       with subtest("Can request wildcard certificates using DNS-01 challenge"):
@@ -208,9 +202,9 @@ in import ./make-test-python.nix {
           webserver.succeed(
               "/run/current-system/specialisation/dns-01/bin/switch-to-configuration test"
           )
-          webserver.wait_for_unit("acme-finished-example.com.target")
+          webserver.wait_for_unit("acme-finished-example.test.target")
           client.succeed(
-              "curl --cacert /tmp/ca.crt https://c.example.com/ | grep -qF 'hello world'"
+              "curl --cacert /tmp/ca.crt https://c.example.test/ | grep -qF 'hello world'"
           )
     '';
 }
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 5adfd6afd6a7a..30229a3a5b2f4 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -22,7 +22,7 @@ let
 in
 {
   _3proxy = handleTest ./3proxy.nix {};
-  acme = handleTestOn ["x86_64-linux"] ./acme.nix {};
+  acme = handleTest ./acme.nix {};
   atd = handleTest ./atd.nix {};
   automysqlbackup = handleTest ./automysqlbackup.nix {};
   avahi = handleTest ./avahi.nix {};
@@ -51,7 +51,9 @@ in
   cloud-init = handleTest ./cloud-init.nix {};
   codimd = handleTest ./codimd.nix {};
   consul = handleTest ./consul.nix {};
+  cockroachdb = handleTestOn ["x86_64-linux"] ./cockroachdb.nix {};
   containers-bridge = handleTest ./containers-bridge.nix {};
+  containers-custom-pkgs.nix = handleTest ./containers-custom-pkgs.nix {};
   containers-ephemeral = handleTest ./containers-ephemeral.nix {};
   containers-extra_veth = handleTest ./containers-extra_veth.nix {};
   containers-hosts = handleTest ./containers-hosts.nix {};
@@ -160,6 +162,7 @@ in
   # kubernetes.e2e should eventually replace kubernetes.rbac when it works
   #kubernetes.e2e = handleTestOn ["x86_64-linux"] ./kubernetes/e2e.nix {};
   kubernetes.rbac = handleTestOn ["x86_64-linux"] ./kubernetes/rbac.nix {};
+  latestKernel.hardened = handleTest ./hardened.nix { latestKernel = true; };
   latestKernel.login = handleTest ./login.nix { latestKernel = true; };
   ldap = handleTest ./ldap.nix {};
   leaps = handleTest ./leaps.nix {};
@@ -311,6 +314,7 @@ in
   trilium-server = handleTestOn ["x86_64-linux"] ./trilium-server.nix {};
   trezord = handleTest ./trezord.nix {};
   trickster = handleTest ./trickster.nix {};
+  tuptime = handleTest ./tuptime.nix {};
   udisks2 = handleTest ./udisks2.nix {};
   upnp = handleTest ./upnp.nix {};
   uwsgi = handleTest ./uwsgi.nix {};
diff --git a/nixos/tests/cockroachdb.nix b/nixos/tests/cockroachdb.nix
index 496283fddc7b0..d0cc5e19837c6 100644
--- a/nixos/tests/cockroachdb.nix
+++ b/nixos/tests/cockroachdb.nix
@@ -1,7 +1,7 @@
 # This performs a full 'end-to-end' test of a multi-node CockroachDB cluster
 # using the built-in 'cockroach workload' command, to simulate a semi-realistic
 # test load. It generally takes anywhere from 3-5 minutes to run and 1-2GB of
-# RAM (though each of 3 workers gets 1GB allocated)
+# RAM (though each of 3 workers gets 2GB allocated)
 #
 # CockroachDB requires synchronized system clocks within a small error window
 # (~500ms by default) on each node in order to maintain a multi-node cluster.
@@ -55,7 +55,7 @@ let
 
     {
       # Bank/TPC-C benchmarks take some memory to complete
-      virtualisation.memorySize = 1024;
+      virtualisation.memorySize = 2048;
 
       # Install the KVM PTP "Virtualized Clock" driver. This allows a /dev/ptp0
       # device to appear as a reference clock, synchronized to the host clock.
@@ -88,6 +88,8 @@ let
       services.cockroachdb.listen.address = myAddr;
       services.cockroachdb.join = lib.mkIf (joinNode != null) joinNode;
 
+      systemd.services.chronyd.unitConfig.ConditionPathExists = "/dev/ptp0";
+
       # Hold startup until Chrony has performed its first measurement (which
       # will probably result in a full timeskip, thanks to makestep)
       systemd.services.cockroachdb.preStart = ''
@@ -95,7 +97,7 @@ let
       '';
     };
 
-in import ./make-test.nix ({ pkgs, ...} : {
+in import ./make-test-python.nix ({ pkgs, ...} : {
   name = "cockroachdb";
   meta.maintainers = with pkgs.stdenv.lib.maintainers;
     [ thoughtpolice ];
@@ -110,17 +112,13 @@ in import ./make-test.nix ({ pkgs, ...} : {
   # there's otherwise no way to guarantee that node1 will start before the others try
   # to join it.
   testScript = ''
-    $node1->start;
-    $node1->waitForUnit("cockroachdb");
-
-    $node2->start;
-    $node2->waitForUnit("cockroachdb");
-
-    $node3->start;
-    $node3->waitForUnit("cockroachdb");
-
-    $node1->mustSucceed("cockroach sql --host=192.168.1.1 --insecure -e 'SHOW ALL CLUSTER SETTINGS' 2>&1");
-    $node1->mustSucceed("cockroach workload init bank 'postgresql://root\@192.168.1.1:26257?sslmode=disable'");
-    $node1->mustSucceed("cockroach workload run bank --duration=1m 'postgresql://root\@192.168.1.1:26257?sslmode=disable'");
+    for node in node1, node2, node3:
+        node.start()
+        node.wait_for_unit("cockroachdb")
+    node1.succeed(
+        "cockroach sql --host=192.168.1.1 --insecure -e 'SHOW ALL CLUSTER SETTINGS' 2>&1",
+        "cockroach workload init bank 'postgresql://root@192.168.1.1:26257?sslmode=disable'",
+        "cockroach workload run bank --duration=1m 'postgresql://root@192.168.1.1:26257?sslmode=disable'",
+    )
   '';
 })
diff --git a/nixos/tests/common/acme/client/default.nix b/nixos/tests/common/acme/client/default.nix
new file mode 100644
index 0000000000000..80893da025244
--- /dev/null
+++ b/nixos/tests/common/acme/client/default.nix
@@ -0,0 +1,15 @@
+{ lib, nodes, pkgs, ... }:
+
+let
+  acme-ca = nodes.acme.config.test-support.acme.caCert;
+in
+
+{
+  security.acme = {
+    server = "https://acme.test/dir";
+    email = "hostmaster@example.test";
+    acceptTerms = true;
+  };
+
+  security.pki.certificateFiles = [ acme-ca ];
+}
diff --git a/nixos/tests/common/letsencrypt/default.nix b/nixos/tests/common/acme/server/default.nix
index 110a2520971d0..1a0ee882572ce 100644
--- a/nixos/tests/common/letsencrypt/default.nix
+++ b/nixos/tests/common/acme/server/default.nix
@@ -1,27 +1,27 @@
 # The certificate for the ACME service is exported as:
 #
-#   config.test-support.letsencrypt.caCert
+#   config.test-support.acme.caCert
 #
 # This value can be used inside the configuration of other test nodes to inject
 # the snakeoil certificate into security.pki.certificateFiles or into package
 # overlays.
 #
 # Another value that's needed if you don't use a custom resolver (see below for
-# notes on that) is to add the letsencrypt node as a nameserver to every node
+# notes on that) is to add the acme node as a nameserver to every node
 # that needs to acquire certificates using ACME, because otherwise the API host
-# for letsencrypt.org can't be resolved.
+# for acme.test can't be resolved.
 #
 # A configuration example of a full node setup using this would be this:
 #
 # {
-#   letsencrypt = import ./common/letsencrypt;
+#   acme = import ./common/acme/server;
 #
 #   example = { nodes, ... }: {
 #     networking.nameservers = [
-#       nodes.letsencrypt.config.networking.primaryIPAddress
+#       nodes.acme.config.networking.primaryIPAddress
 #     ];
 #     security.pki.certificateFiles = [
-#       nodes.letsencrypt.config.test-support.letsencrypt.caCert
+#       nodes.acme.config.test-support.acme.caCert
 #     ];
 #   };
 # }
@@ -33,9 +33,9 @@
 # override networking.nameservers like this:
 #
 # {
-#   letsencrypt = { nodes, ... }: {
-#     imports = [ ./common/letsencrypt ];
-#     networking.nameservers = [
+#   acme = { nodes, lib, ... }: {
+#     imports = [ ./common/acme/server ];
+#     networking.nameservers = lib.mkForce [
 #       nodes.myresolver.config.networking.primaryIPAddress
 #     ];
 #   };
@@ -55,16 +55,16 @@
 let
   snakeOilCerts = import ./snakeoil-certs.nix;
 
-  wfeDomain = "acme-v02.api.letsencrypt.org";
+  wfeDomain = "acme.test";
   wfeCertFile = snakeOilCerts.${wfeDomain}.cert;
   wfeKeyFile = snakeOilCerts.${wfeDomain}.key;
 
-  siteDomain = "letsencrypt.org";
+  siteDomain = "acme.test";
   siteCertFile = snakeOilCerts.${siteDomain}.cert;
   siteKeyFile = snakeOilCerts.${siteDomain}.key;
   pebble = pkgs.pebble;
   resolver = let
-    message = "You need to define a resolver for the letsencrypt test module.";
+    message = "You need to define a resolver for the acme test module.";
     firstNS = lib.head config.networking.nameservers;
   in if config.networking.nameservers == [] then throw message else firstNS;
 
@@ -76,15 +76,16 @@ let
     httpPort = 80;
     tlsPort = 443;
     ocspResponderURL = "http://0.0.0.0:4002";
+    strict = true;
   };
 
   pebbleConfFile = pkgs.writeText "pebble.conf" (builtins.toJSON pebbleConf);
   pebbleDataDir = "/root/pebble";
 
 in {
-  imports = [ ../resolver.nix ];
+  imports = [ ../../resolver.nix ];
 
-  options.test-support.letsencrypt.caCert = lib.mkOption {
+  options.test-support.acme.caCert = lib.mkOption {
     type = lib.types.path;
     description = ''
       A certificate file to use with the <literal>nodes</literal> attribute to
@@ -98,7 +99,7 @@ in {
       resolver.enable = let
         isLocalResolver = config.networking.nameservers == [ "127.0.0.1" ];
       in lib.mkOverride 900 isLocalResolver;
-      letsencrypt.caCert = snakeOilCerts.ca.cert;
+      acme.caCert = snakeOilCerts.ca.cert;
     };
 
     # This has priority 140, because modules/testing/test-instrumentation.nix
@@ -126,8 +127,7 @@ in {
         '';
         serviceConfig = {
           # Required to bind on privileged ports.
-          User = "root";
-          Group = "root";
+          AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
         };
       };
     };
diff --git a/nixos/tests/common/letsencrypt/mkcerts.nix b/nixos/tests/common/acme/server/mkcerts.nix
index e7ac2bae46bd2..2474019cbac3b 100644
--- a/nixos/tests/common/letsencrypt/mkcerts.nix
+++ b/nixos/tests/common/acme/server/mkcerts.nix
@@ -1,10 +1,9 @@
 { pkgs ? import <nixpkgs> {}
 , lib ? pkgs.lib
-
-, domains ? [ "acme-v02.api.letsencrypt.org" "letsencrypt.org" ]
+, domains ? [ "acme.test" ]
 }:
 
-pkgs.runCommand "letsencrypt-snakeoil-ca" {
+pkgs.runCommand "acme-snakeoil-ca" {
   nativeBuildInputs = [ pkgs.openssl ];
 } ''
   addpem() {
diff --git a/nixos/tests/common/letsencrypt/mkcerts.sh b/nixos/tests/common/acme/server/mkcerts.sh
index cc7f8ca650dd4..cc7f8ca650dd4 100755
--- a/nixos/tests/common/letsencrypt/mkcerts.sh
+++ b/nixos/tests/common/acme/server/mkcerts.sh
diff --git a/nixos/tests/common/acme/server/snakeoil-certs.nix b/nixos/tests/common/acme/server/snakeoil-certs.nix
new file mode 100644
index 0000000000000..fd537c3260f1d
--- /dev/null
+++ b/nixos/tests/common/acme/server/snakeoil-certs.nix
@@ -0,0 +1,171 @@
+# Generated via mkcert.sh in the same directory.
+{
+  ca.key = builtins.toFile "ca.key" ''
+    -----BEGIN PRIVATE KEY-----
+    MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQDCnVZGEn68ezXl
+    DWE5gjsCPqutR4nxw/wvIbAxB2Vk2WeQ6HGvt2Jdrz5qer2IXd76YtpQeqd+ffet
+    aLtMeFTr+Xy9yqEpx2AfvmEEcLnuiWbsUGZzsHwW7/4kPgAFBy9TwJn/k892lR6u
+    QYa0QS39CX85kLMZ/LZXUyClIBa+IxT1OovmGqMOr4nGASRQP6d/nnyn41Knat/d
+    tpyaa5zgfYwA6YW6UxcywvBSpMOXM0/82BFZGyALt3nQ+ffmrtKcvMjsNLBFaslV
+    +zYO1PMbLbTCW8SmJTjhzuapXtBHruvoe24133XWlvcP1ylaTx0alwiQWJr1XEOU
+    WLEFTgOTeRyiVDxDunpz+7oGcwzcdOG8nCgd6w0aYaECz1zvS3FYTQz+MiqmEkx6
+    s4bj1U90I0kwUJbeWjjrGO7Y9Qq4i19GafDg7cAMn9eHCiNbNrPj6t/gfaVbCrbk
+    m3ZVjkvLTQ2mb2lv7+tVii45227iNPuNS6lx2FVlr/DXiRrOVfghPvoOxUfXzogJ
+    hZLV4Zki+ycbGQa5w8YMDYCv4c08dKA7AatVhNS60c1zgQNjuWF3BvocSySyGUon
+    VT6h1DYlJ9YAqgqNpedgNR9kpp034SMhB7dj9leB6LRMA+c1fG/T+1lDbkA+vope
+    pt4+30oDcCTYfEifl1HwqNw/bXDm1wIDAQABAoICABPbd/UYaAQVUk93yQbUKe81
+    s9CvbvzTMYUhm9e02Hyszitz/D2gqZHDksvMkFA8u8aylXIGwdZfRglUmV/ZG1kk
+    kLzQ0xbvN/ilNUL9uYsETBMqtPly9YZloHnUNa5NqF+UVGJGk7GWz5WaLANybx3V
+    fTzDbfLl3TkVy0vt9UQbUkUfXyzwZNjXwmgIr8rcY9vasP90a3eXqRX3Tw1Wk6A4
+    TzO8oB994O0WBO150Fc6Lhwvc72yzddENlLDXq8UAXtqq9mmGqJKnhZ+1mo3AkMw
+    q7P1JyCIxcAMm26GtRvLVljXV0x5640kxDrCin6jeeW/qWkJEW6dpmuZjR5scmLI
+    /9n8H+fGzdZH8bOPPotMy12doj3vJqvew3p0eIkmVctYMJKD0j/CWjvKJNE3Yx4O
+    Ls47X/dEypX6anR1HQUXcpd6JfRWdIJANo2Duaz+HYbyA88bHcJL9shFYcjLs3sX
+    R/TvnnKHvw/ud7XBgvLGwGAf/cDEuLI2tv+V7tkMGrMUv+gUJNZaJaCpdt+1iUwO
+    QFq8APyBNn6FFw54TwXWfSjfSNh3geIMLHuErYVu9MIXvB7Yhh+ZvLcfLbmckhAX
+    wb39RRHnCWvnw5Bm9hnsDhqfDsIoP+2wvUkViyHOmrKi8nSJhSk19C8AuQtSVcJg
+    5op+epEmjt70GHt52nuBAoIBAQD2a4Ftp4QxWE2d6oAFI6WPrX7nAwI5/ezCbO/h
+    yoYAn6ucTVnn5/5ITJ8V4WTWZ4lkoZP3YSJiCyBhs8fN63J+RaJ/bFRblHDns1HA
+    2nlMVdNLg6uOfjgUJ8Y6xVM0J2dcFtwIFyK5pfZ7loxMZfvuovg74vDOi2vnO3dO
+    16DP3zUx6B/yIt57CYn8NWTq+MO2bzKUnczUQRx0yEzPOfOmVbcqGP8f7WEdDWXm
+    7scjjN53OPyKzLOVEhOMsUhIMBMO25I9ZpcVkyj3/nj+fFLf/XjOTM00M/S/KnOj
+    RwaWffx6mSYS66qNc5JSsojhIiYyiGVEWIznBpNWDU35y/uXAoIBAQDKLj0dyig2
+    kj1r3HvdgK4sRULqBQFMqE9ylxDmpJxAj6/A8hJ0RCBR57vnIIZMzK4+6K0l3VBJ
+    ukzXJHJLPkZ0Uuo2zLuRLkyjBECH6KYznyTkUVRn50Oq6IoP6WTCfd3Eg+7AKYY1
+    VFo2iR8sxeSQQ+AylFy6QcQ1xPIW30Jj1/LFjrRdRggapPEekpJec0pEqhasT8rR
+    UFhRL2NdZnL5b7ZlsJc7gZKEJgNfxgzaCzloqLcjCgGpOhLKx0fFsNOqHcbIGMwG
+    6wQCOyNghQJ6AZtRD5TYCJow92FchWjoTIaMJ8RjMKQmxpiwM6wQG4J78Hd3mbhf
+    q0hiQhPHaNbBAoIBAFeIeMFq8BpXM7sUwcURlI4lIx8Mgo33FVM7PzsFpfQyw9MR
+    5w3p6vnjvd8X4aoHvVZxzw3hA0WwjiAmrKMJL/KK6d45rP2bDUBBAplvAgeLtTLt
+    4tMLIwCF4HSgA55TIPQlaqO1FDC+M4BTSiMZVxS970/WnZPBEuNgzFDFZ+pvb4X6
+    3t40ZLNwAAQHM4IEPAFiHqWMKGZ9eo5BWIeEHnjHmfjqSDYfLJAVYk1WJIcMUzom
+    lA76CBC8CxW/I94AtcRhWuFUv/Z5/+OYEYLUxtuqPm+J+JrCmf4OJmWppT1wI2+p
+    V00BSeRVWXTm1piieM8ahF5y1hp6y3uV3k0NmKECggEBAMC42Ms3s6NpPSE+99eJ
+    3P0YPJOkl7uByNGbTKH+kW89SDRsy8iGVCSe9892gm5cwU/4LWyljO3qp2qBNG2i
+    /DfP/bCk8bqPXsAZwoWK8DrO3bTCDepJWYhlx40pVkHLBwVXGdOVAXh+YswPY2cj
+    cB9QhDrSj52AKU9z36yLvtY7uBA3Wph6tCjpx2n0H4/m6AmR9LDmEpf5tWYV/OrA
+    SKKaqUw/y7kOZyKOtbKqr/98qYmpIYFF/ZVZZSZkVXcNeoZzgdOlR37ksVqLEsrj
+    nxu7wli/uItBj/FTLjyqcvjUUYDyO1KtwBuyPUPgzYhBIN2Rt9+K6WRQelwnToFL
+    30ECggEBALzozykZj2sr3z8tQQRZuXLGotUFGsQCB8ikeqoeB8FbNNkC+qgflQGv
+    zLRB2KWOvnboc94wVgBJH43xG0HBibZnBhUO8/HBI/WlmyEj9KQ/ZskUK4GVZkB6
+    r/81ASLwH+P/rqrLEjcp1SIPPevjzCWD9VYR5m/qPHLNxStwGSrPjtPzgaFxhq84
+    Jl+YVmNqVlrOKYYfIPh8exPLiTti3wfM61pVYFv56PI2gd5ysMWYnuN+vK0sbmZh
+    cIWwykcKlODIngI7IzYqt8NuIJI0jrYyHgtUw4jaJzdF4mEOplGONxdz15jAGHtg
+    JUsBXFNz132nP4iIr3UKrPedQZijSi4=
+    -----END PRIVATE KEY-----
+  '';
+  ca.cert = builtins.toFile "ca.cert" ''
+    -----BEGIN CERTIFICATE-----
+    MIIFDzCCAvegAwIBAgIUTRDYSWJvmlhwIR3pzVrIQfnboLEwDQYJKoZIhvcNAQEL
+    BQAwFjEUMBIGA1UEAwwLU25ha2VvaWwgQ0EwIBcNMjAwMzIyMjI1NjE3WhgPMjEy
+    MDAyMjcyMjU2MTdaMBYxFDASBgNVBAMMC1NuYWtlb2lsIENBMIICIjANBgkqhkiG
+    9w0BAQEFAAOCAg8AMIICCgKCAgEAwp1WRhJ+vHs15Q1hOYI7Aj6rrUeJ8cP8LyGw
+    MQdlZNlnkOhxr7diXa8+anq9iF3e+mLaUHqnfn33rWi7THhU6/l8vcqhKcdgH75h
+    BHC57olm7FBmc7B8Fu/+JD4ABQcvU8CZ/5PPdpUerkGGtEEt/Ql/OZCzGfy2V1Mg
+    pSAWviMU9TqL5hqjDq+JxgEkUD+nf558p+NSp2rf3bacmmuc4H2MAOmFulMXMsLw
+    UqTDlzNP/NgRWRsgC7d50Pn35q7SnLzI7DSwRWrJVfs2DtTzGy20wlvEpiU44c7m
+    qV7QR67r6HtuNd911pb3D9cpWk8dGpcIkFia9VxDlFixBU4Dk3kcolQ8Q7p6c/u6
+    BnMM3HThvJwoHesNGmGhAs9c70txWE0M/jIqphJMerOG49VPdCNJMFCW3lo46xju
+    2PUKuItfRmnw4O3ADJ/XhwojWzaz4+rf4H2lWwq25Jt2VY5Ly00Npm9pb+/rVYou
+    Odtu4jT7jUupcdhVZa/w14kazlX4IT76DsVH186ICYWS1eGZIvsnGxkGucPGDA2A
+    r+HNPHSgOwGrVYTUutHNc4EDY7lhdwb6HEskshlKJ1U+odQ2JSfWAKoKjaXnYDUf
+    ZKadN+EjIQe3Y/ZXgei0TAPnNXxv0/tZQ25APr6KXqbePt9KA3Ak2HxIn5dR8Kjc
+    P21w5tcCAwEAAaNTMFEwHQYDVR0OBBYEFCIoeYSYjtMiPrmxfHmcrsZkyTpvMB8G
+    A1UdIwQYMBaAFCIoeYSYjtMiPrmxfHmcrsZkyTpvMA8GA1UdEwEB/wQFMAMBAf8w
+    DQYJKoZIhvcNAQELBQADggIBAHPdwOgAxyhIhbqFObNftW8K3sptorB/Fj6jwYCm
+    mHleFueqQnjTHMWsflOjREvQp1M307FWooGj+KQkjwvAyDc/Hmy7WgJxBg9p3vc+
+    /Xf/e7ZfBl8rv7vH8VXW/BC1vVsILdFncrgTrP8/4psV50/cl1F4+nPBiekvvxwZ
+    k+R7SgeSvcWT7YlOG8tm1M3al4F4mWzSRkYjkrXmwRCKAiya9xcGSt0Bob+LoM/O
+    mpDGV/PMC1WAoDc1mMuXN2hSc0n68xMcuFs+dj/nQYn8uL5pzOxpX9560ynKyLDv
+    yOzQlM2VuZ7H2hSIeYOFgrtHJJwhDtzjmUNDQpQdp9Fx+LONQTS1VLCTXND2i/3F
+    10X6PkdnLEn09RiPt5qy20pQkICxoEydmlwpFs32musYfJPdBPkZqZWrwINBv2Wb
+    HfOmEB4xUvXufZ5Ju5icgggBkyNA3PCLo0GZFRrMtvA7i9IXOcXNR+njhKa9246V
+    QQfeWiz05RmIvgShJYVsnZWtael8ni366d+UXypBYncohimyNlAD1n+Bh3z0PvBB
+    +FK4JgOSeouM4SuBHdwmlZ/H0mvfUG81Y8Jbrw0yuRHtuCtX5HpN5GKpZPHDE7aQ
+    fEShVB/GElC3n3DvgK9OJBeVVhYQgUEfJi4rsSxt3cdEI0NrdckUoZbApWVJ3CBc
+    F8Y7
+    -----END CERTIFICATE-----
+  '';
+  "acme.test".key = builtins.toFile "acme.test.key" ''
+    -----BEGIN RSA PRIVATE KEY-----
+    MIIJKAIBAAKCAgEAlgQTZjKfs3aHw0J993k7jFAs+hVRPf//zHMAiUkPKUYPTSl1
+    TxS/bPbhWzSoom00j4SLhGGGhbd+lnvTg0uvKbxskgATfw5clbm1ZN+gx4DuxwjL
+    V3xIxpeSY+PKzs5z8w/k+AJh+zOPyXwH3ut3C+ogp1S/5IhmzV3a/yU/6k0zpGxj
+    N6ZPRTXFrz93I1pPeCkJz90l7tj+2uFc9xtM20NQX52f0Y2oShcG8fKdNZVzuHHk
+    ZXkrZIhou55/nRy2jKgFeD3GQQfa9rwPWrVybQ6tKMMkoazB/Unky9xcTI2LJarf
+    xgHDO9v9yFBvmR4UM8B3kM82NHoENtHaZ2mmiMGZzTEQlf8xwYyHFrqBFIVRWEUr
+    7rr/O5Qr9gIN0T4u367HCexVYAKzbO2P9h75czzjMMoGkbXze9SMQ/ikrxEmwAHg
+    r1Xxh6iQYmgPNk8AR3d9+o2I7WJZMUYZARLnuhVr9BNXv510iqZTqX8lcyL5fEj3
+    ST4Ab+H7rfevZt6NU26iJLBYAjrA2mSvH+wvkboxrgSS8xYPkOW8NLNEbbodzofI
+    pB+SaK53OIk0bj9c1YAgrSNER/TDTgDXrWUNrlfVZ/M7+AEdeU06wi7sVhVif6OB
+    D3OpgKSNjeE6TuJH80Pi5MWugSFBr792Xb6uhVoPiVOFN+qiGB6UkwBgSKkCAwEA
+    AQKCAgAmN7OZfZwh5DiCDhZ5TXFWNba/n16rJOTN+R5R20L5iNetGLrCAs8hu2N+
+    ENRFTPzu8x14BEB5IF4niDRCZq2hPFeMemh9HfOIUV9c63vSV459NkhXaVpA/axV
+    tlqchQwVCB+U70Z28JPZCLgYmnQhnOvktTqNxhIqj5aTGbJGxpQ5d0Nvkfbv8tsB
+    4nE/mGpWel39jqFzT+Tdbjx414Ok+GkpcsacZDJTbbpfOSfD1uc8PgepskzTt8y2
+    v5JTPFVlUAjUsSgouQ+XfCGNQlx8XBjRIaXbal+hX4niRald91FTr0yC7UAHp+vn
+    dFZ586fB526OfbuZctxP+vZhEhFSseQKxHQ0tB8me81xH44daVNr9PPUM69FDT3j
+    ygJaUJjNEG3vVzePCDzhmxTmz2/rAClp77WTWziBWDoA6YWDDzhgNPrXWzLIbZIx
+    ue9ZbGEOh/u5ZzrEXxKCz9FjDe9wQu3TeYUe0M+ejzwWgn7zdWDvjjmtLUUuun2Y
+    wW7WANpu32qvB/V+qssw4O63tbRiwneRCnb8AF2ixgyWr6xyZwch4kacv1KMiixf
+    gO/5GTj7ba5GcdGoktJb29cUEgz13yPd106RsHK4vcggFxfMbOVauNRIo6ddLwyS
+    8UMxLf2i2cToOLkHZrIb8FgimmzRoBd3yYzwVJBydiVcsrHQAQKCAQEAxlzFYCiQ
+    hjEtblGnrkOC7Hx6HvqMelViOkGN8Y9VczG4GhwntmSE2nbpaAKhFBGdLfuSI3tJ
+    Lf24f0IGgAhzPmpo2TjbxPO3YSKFTH71fznVBhtQ1iSxwZ1InXktnuhot6VSDx6A
+    sbHSy1hMFy3nj+Zj5+fQ89tclzBzG9bCShaauO39KrPMwKi6CYoYdGhXBC3+OpHY
+    zBNvmDTxG2kW8L42rlf14EH4pAlgKs4eeZbpcbZ6fXURP2hToHJ8swyKw/1p12WA
+    cc19BKFJXL8nNP4uCf/fI0mVYpytz5KwUzG+z+umDqk+RRCH4mNB28xvEEuEyp/e
+    /C5Is+WrlDAA6QKCAQEAwZsK4AJ/w4Xf4Q/SsnZJO9bfP1ejJjzKElt8rG28JXeb
+    +FjykZZ6vw2gt2Boest2n9N4fBwaRkaHVtVS4iAmaDXozTlcvCLs2rVjPSguuQtW
+    80CKg6+dux+6gFN8IGzDCiX3pWUnhhiXvCcRYEcvgpH6GA5vuCNrXrjH0JFC0kef
+    aaDMGMTbzhc2IIRztmWU4v8YJSSy5KOkIQLWO+7u9aGx9IqT5/z3gx3XrItyl0Bk
+    aQmZEh7JOSyhmGhhf5LdeTLu2YgRw3/tzS+lPMX3+UPw99k9MdTOFn2pww5AdRmg
+    aBIzV+/LBYG0pPRl0D8/6yzGVBPuUDQpmK9Z3gsxwQKCAQEAnNkMZN2Ocd1+6+V7
+    LmtJog9HTSmWXMEZG7FsOJ661Yxx44txx2IyPsCaDNlPXxwSaiKrSo0Yr1oZQd8G
+    XsTPw4HGiETSWijQTulJ99PH8SLck6iTwdBgEhV5LrN75FQnQVdizHu1DUzrvkiC
+    Wi29FWb6howiCEDjNNVln5SwKn83NpVQgyyK8ag4+oQMlDdQ3wgzJ0Ld53hS3Eq4
+    f5EYR6JQgIki7YGcxrB3L0GujTxMONMuhfdEfRvUTGFawwVe0FyYDW7AIrx2Z2vV
+    I5YuvVNjOhrt6OwtSD1VnnWCITaLh8LwmlUu3NOWbudHUzKSe5MLXGEPo95BNKad
+    hl5yyQKCAQBNo0gMJtRnawMpdLfwewDJL1SdSR6S0ePS0r8/Qk4l1D5GrByyB183
+    yFY/0zhyra7nTt1NH9PlhJj3WFqBdZURSzUNP0iR5YuH9R9Twg5ihEqdB6/EOSOO
+    i521okTvl83q/ui9ecAMxUXr3NrZ+hHyUWmyRe/FLub6uCzg1a+vNauWpzXRZPgk
+    QCijh5oDdd7r3JIpKvtWNs01s7aHmDxZYjtDrmK7sDTtboUzm0QbpWXevUuV+aSF
+    +gDfZlRa3WFVHfisYSWGeYG6O7YOlfDoE7fJHGOu3QC8Ai6Wmtt8Wgd6VHokdHO8
+    xJPVZnCBvyt5up3Zz5hMr25S3VazdVfBAoIBAHVteqTGqWpKFxekGwR0RqE30wmN
+    iIEwFhgOZ8sQ+6ViZJZUR4Nn2fchn2jVwF8V8J1GrJbTknqzAwdXtO3FbgfmmyF2
+    9VbS/GgomXhA9vJkM4KK3Iwo/y/nE9hRhtzuVE0QPudz2fyfaDgnWjcNM59064tH
+    88361LVJm3ixyWSBD41UZ7NgWWJX1y2f073vErsfcPpavF5lhn1oSkQnOlgMJsnl
+    24qeuzAgTWu/2rFpIA2EK30Bgvsl3pjJxHwyNDAgklV7C783LIoAHi7VO7tzZ6iF
+    dmD5XLfcUZc3eaB7XehNQKBXDGLJeI5AFmjsHka5GUoitkU2PFrg/3+nJmg=
+    -----END RSA PRIVATE KEY-----
+  '';
+  "acme.test".cert = builtins.toFile "acme.test.cert" ''
+    -----BEGIN CERTIFICATE-----
+    MIIEoTCCAokCAgKaMA0GCSqGSIb3DQEBCwUAMBYxFDASBgNVBAMMC1NuYWtlb2ls
+    IENBMCAXDTIwMDMyMjIyNTYxOFoYDzIxMjAwMjI3MjI1NjE4WjAUMRIwEAYDVQQD
+    DAlhY21lLnRlc3QwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCWBBNm
+    Mp+zdofDQn33eTuMUCz6FVE9///McwCJSQ8pRg9NKXVPFL9s9uFbNKiibTSPhIuE
+    YYaFt36We9ODS68pvGySABN/DlyVubVk36DHgO7HCMtXfEjGl5Jj48rOznPzD+T4
+    AmH7M4/JfAfe63cL6iCnVL/kiGbNXdr/JT/qTTOkbGM3pk9FNcWvP3cjWk94KQnP
+    3SXu2P7a4Vz3G0zbQ1BfnZ/RjahKFwbx8p01lXO4ceRleStkiGi7nn+dHLaMqAV4
+    PcZBB9r2vA9atXJtDq0owyShrMH9SeTL3FxMjYslqt/GAcM72/3IUG+ZHhQzwHeQ
+    zzY0egQ20dpnaaaIwZnNMRCV/zHBjIcWuoEUhVFYRSvuuv87lCv2Ag3RPi7frscJ
+    7FVgArNs7Y/2HvlzPOMwygaRtfN71IxD+KSvESbAAeCvVfGHqJBiaA82TwBHd336
+    jYjtYlkxRhkBEue6FWv0E1e/nXSKplOpfyVzIvl8SPdJPgBv4fut969m3o1TbqIk
+    sFgCOsDaZK8f7C+RujGuBJLzFg+Q5bw0s0Rtuh3Oh8ikH5Jornc4iTRuP1zVgCCt
+    I0RH9MNOANetZQ2uV9Vn8zv4AR15TTrCLuxWFWJ/o4EPc6mApI2N4TpO4kfzQ+Lk
+    xa6BIUGvv3Zdvq6FWg+JU4U36qIYHpSTAGBIqQIDAQABMA0GCSqGSIb3DQEBCwUA
+    A4ICAQBCDs0V4z00Ze6Ask3qDOLAPo4k85QCfItlRZmwl2XbPZq7kbe13MqF2wxx
+    yiLalm6veK+ehU9MYN104hJZnuce5iEcZurk+8A+Pwn1Ifz+oWKVbUtUP3uV8Sm3
+    chktJ2H1bebXtNJE5TwvdHiUkXU9ywQt2FkxiTSl6+eac7JKEQ8lVN/o6uYxF5ds
+    +oIZplb7bv2XxsRCzq55F2tJX7fIzqXrSa+lQTnfLGmDVMAQX4TRB/lx0Gqd1a9y
+    qGfFnZ7xVyW97f6PiL8MoxPfd2I2JzrzGyP/igNbFOW0ho1OwfxVmvZeS7fQSc5e
+    +qu+nwnFfl0S4cHRif3G3zmz8Ryx9LM5TYkH41qePIHxoEO2sV0DgWJvbSjysV2S
+    EU2a31dJ0aZ+z6YtZVpHlujKMVzxVTrqj74trS4LvU5h/9hv7e1gjYdox1TO0HMK
+    mtDfgBevB21Tvxpz67Ijf31HvfTmCerKJEOjGnbYmyYpMeMNSONRDcToWk8sUwvi
+    OWa5jlUFRAxgXNM09vCTPi9aRUhcFqACqfAd6I1NqGVlfplLWrc7SWaSa+PsLfBf
+    4EOZfk8iEKBVeYXNjg+CcD8j8yk/oEs816/jpihIk8haCDRWYWGKyyGnwn6OQb8d
+    MdRO2b7Oi/AAmEF3jMlICqv286GIYK5qTKk2/CKHlOLPnsWEuA==
+    -----END CERTIFICATE-----
+  '';
+}
diff --git a/nixos/tests/common/letsencrypt/common.nix b/nixos/tests/common/letsencrypt/common.nix
deleted file mode 100644
index bd559c8dacc54..0000000000000
--- a/nixos/tests/common/letsencrypt/common.nix
+++ /dev/null
@@ -1,12 +0,0 @@
-{ lib, nodes, pkgs, ... }: let
-  letsencrypt-ca = nodes.letsencrypt.config.test-support.letsencrypt.caCert;
-in {
-  networking.nameservers = [
-    nodes.letsencrypt.config.networking.primaryIPAddress
-  ];
-
-  security.acme.acceptTerms = true;
-  security.acme.email = "webmaster@example.com";
-
-  security.pki.certificateFiles = [ letsencrypt-ca ];
-}
diff --git a/nixos/tests/common/letsencrypt/snakeoil-certs.nix b/nixos/tests/common/letsencrypt/snakeoil-certs.nix
deleted file mode 100644
index ca4f71ae688a4..0000000000000
--- a/nixos/tests/common/letsencrypt/snakeoil-certs.nix
+++ /dev/null
@@ -1,254 +0,0 @@
-# Generated via mkcert.sh in the same directory.
-{
-  ca.key = builtins.toFile "ca.key" ''
-    -----BEGIN PRIVATE KEY-----
-    MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQDQ0b23I1srJZwR
-    2MMdvSJK5pcwLfrXU+4gEZEnWNyT8yeVweya+8vmNNOlvK3zxf+ZiY/7aQ0RZJMO
-    h2+VdlgHmr2QKhQTf1HwfZA/06FolD3/DcS+DMJMSTVr179/XLndeVVZUqU7tjvB
-    AWKSIS8H2hSF1UOPi9gBDR8MwCP6Qgj8WYhbkt9q47/lO96qAmm6U1F+Q7RYM9ZQ
-    IWI81N0Ms5wJocg7n6S19iV66ePh7APapZFYup61gFGWfahmA217ELIZd56n8yjO
-    F0epb9sC0XpYCDRrYKBWLqPiv+6wvdZtZvALItyIv08ZwXlBkFg3LbAAhPnf0Vxz
-    pYysQmyyyzkgy252n+Sie0kx+B4qm6fOkpfgYlPSVTb2dXx/be/SE08u0a9FO0fZ
-    pkByWEZJUUwngsJgLUa7MorQf3avxozfC25XqvzbieZfSXlA7mOUclZbC/WUFpyj
-    MlyJU2eCQ8wSwsPXl91oxcYlOkuVLgd41gr9pGXQSuKIkrgbfkftjg2tDC+7g7O8
-    qrdF42FjbZjIx/74AasmsGh4GTQtiSkvEnTstioC6aCV44DlJWbBIMvkyawubjUl
-    Ppij0H66Y9Q4tEc/ktc7oGQfqqluyLb43TeobTPHALsNeAYb39rMtBo5DDCUc81s
-    fuDMhMr/oYXKrFstUsg5AY6mJaRG0QIDAQABAoICAF5ZVfmoPOoKzTB3GvmV2iez
-    dj4rmDmwT1gn98iqasdiRtFwVGJWQHNcDQDGdmY9YNZThD2Y4nGoWpVm9jC2zuFo
-    thusF3QTw8cARKvCCBzDVhumce1YwHVNYpi+W2TFValOyBRathN7rBXxdUMHQUOv
-    8jPh/uudyNP4xL2zFs5dBchW/7g4bT/TdYGyglGYU4L/YEPHfXWYvk1oOAW6O8Ig
-    aPElKt5drEMW2yplATSzua4RvtEzSMBDIRn43pxxEgdXrNC67nF9+ULc2+Efi/oD
-    Ad9CncSiXO9zlVK/W655p6e4qd6uOqyCm8/MTegkuub7eplRe8D3zGjoNN4kCQ4S
-    rckVvIDDb6vZk7PKx9F7GWIqaG/YvFFFKO1MrAZg7SguFA6PtGOYAFocT03P6KXT
-    l2SnZQWKyxUAlh4tOBGlRFgGCx/krRIKbgNYn/qk/ezcRl8c7GpOPh+b7Icoq7u3
-    l4tIVBBHqS8uGgtyi+YwuJeht2MV1aEcSkykKLh2ipp8tb6spORJUkhjawDjvxeQ
-    GztN30Xh2riTXYZ0HExVTtJa8jyvFyp/97ptPIJXaVt2A2KIS3sBFHKnpY+/OrQg
-    uUauYgi13WFHsKOxZL9GYGk7Ujd8bw4CEcJFxKY7bhpGVI6Du7NRkUDWN0+0yusI
-    2szCJ7+ZqJkrc1+GrI/RAoIBAQDseAEggOLYZkpU2Pht15ZbxjM9ayT2ANq1+RTu
-    LjJx4gv2/o/XJCfMZCL0b9TJqtYeH+N6G9oDRJ99VIhUPedhWSYdj9Qj+rPd++TS
-    bp+MoSjmfUfxLTDrmFHL7ppquAE65aDy3B5c+OCb0I4X6CILUf0LynBzgl4kdrzN
-    U6BG3Mt0RiGPojlPV82B9ZUF/09YAz7BIz9X3KMhze1Gps5OeGuUnc9O2IAJYkrj
-    ur9H2YlNS4w+IjRLAXSXUqC8bqPZp6WTo1G/rlyAkIRXCGN90uk5JQvXoj9immFO
-    WaylbdcNG3YcGutreYeZL/UIWF6zCdc6pYG0cCBJS6S/RN7FAoIBAQDiERrLuUbV
-    3fx/a8uMeZop6hXtQpF7jlFxqUmza7QSvBuwks4QVJF+qMSiSvKDkCKqZD4qVf4N
-    TMxEj5vNR0PbnmDshyKJNGVjEauKJSb65CFDUcL1eR/A/oJvxiIdN1Z4cPrpnRux
-    /zIfPuYfYHpdz52buxxmlD7bfwYmVKVpnzjB9z0I1CasZ5uqB0Z8H0OLyUu8S4ju
-    RfkKBDMgVl2q96i8ZvX4C1b7XuimIUqv4WHq5+ejcYirgrYtUbBIaDU3/LORcJdy
-    /K76L1/up70RTDUYYm/HKaRy+vMTpUsZJ7Qbh0hrvQkUvNQ1HXjprW2AePIYi33N
-    h3mb1ulqw4idAoIBAQCsn0YjVjNDShkFK4bfmLv4rw2Ezoyi0SjYIsb2wN6uaBfX
-    7SlQIuKywH8L9f9eYMoCH8FNyLs0G4paUbVb2fzpAc1jUzXINiHL8TCvtXXfkV5s
-    NBSqqRTHR+CegMZVFZJATpVZ9PptYHmHBY5VQW5o2SdizhudFxRmhg95zIx6boBP
-    l0q0sfYoR66MKpzpTeG8HFJZZ8O7/iNQcCXAp9B/VEUkrrdBlaaSMyD8cb1lVBZ5
-    SKdOTGXkQ2G7feQ86n/OSiYDSvxIc56vc9BIQKVwmuEKiFLGzXh8ILrcGXaBJVgS
-    B3QHPFeTk5o7Z9j2iJxJEuv9sginkhrfpsrTnhEJAoIBACkrUkTtjd/e2F/gIqaH
-    crLVZX7a06G7rktTuA9LuvR6e1Rxt8Mzk3eMhprDqVyaQCXlsYiGNoj3hm+p84az
-    xsDVG/OXPIveFeSv0ByNXYbtSr12w1lu4ICGGP0ACTBm5oFymc83hFarEdas3r2y
-    FTbGW36D2c04jCXvARCz85fDnlN8kgnskMpu5+NUBdsO2n83fmphGyPBbHQNhb4K
-    3G4JQhplab/tWL7YbufqQi67jdh4uS+Duo75c/HW4ZKeH6r9gzomVf5j0/3N6NuO
-    gpkG1tiE/LQ5ejBSUTgvrvh6yYsF3QN53pB/PuoZXu63Xay62ePsa1GlrVjbD5EY
-    4OUCggEAJFr7F7AQLMJTAxHFLCsZZ0ZZ+tXYclBC4eHPkZ6sD5jvL3KIpW3Q7jXk
-    oIoD/XEX4B+Qe5M3jQJ/Y5ZJETHcgfcHZbDpCKN2WHQgldQbAJiFd4GY1OegdVsr
-    7TC8jh3Q2eYjzL8u4z7LSNI6aQSv1eWE7S1Q5j/sX/YYDR4W3CBMeIUpqoDWpn87
-    czbIRyA/4L0Y/HLpg/ZCbvtJZbsQwYXhyqfbjlm4BRQ6JiC5uEBKvuDRUXToBJta
-    JU8XMm+Ae5Ogrw7P6hg68dWpagfjb7UZ7Zxv+VDsbrU6KsDcyGCAwrrRZou/6KUG
-    Eq4OVTSu/s8gmY94tgbjeOaLUPEPmg==
-    -----END PRIVATE KEY-----
-  '';
-  ca.cert = builtins.toFile "ca.cert" ''
-    -----BEGIN CERTIFICATE-----
-    MIIFDzCCAvegAwIBAgIUU9rbCLTuvaI6gjSsFsJJjfLWIX8wDQYJKoZIhvcNAQEL
-    BQAwFjEUMBIGA1UEAwwLU25ha2VvaWwgQ0EwIBcNMTkxMDE4MDc1NDEyWhgPMjEx
-    OTA5MjQwNzU0MTJaMBYxFDASBgNVBAMMC1NuYWtlb2lsIENBMIICIjANBgkqhkiG
-    9w0BAQEFAAOCAg8AMIICCgKCAgEA0NG9tyNbKyWcEdjDHb0iSuaXMC3611PuIBGR
-    J1jck/MnlcHsmvvL5jTTpbyt88X/mYmP+2kNEWSTDodvlXZYB5q9kCoUE39R8H2Q
-    P9OhaJQ9/w3EvgzCTEk1a9e/f1y53XlVWVKlO7Y7wQFikiEvB9oUhdVDj4vYAQ0f
-    DMAj+kII/FmIW5LfauO/5TveqgJpulNRfkO0WDPWUCFiPNTdDLOcCaHIO5+ktfYl
-    eunj4ewD2qWRWLqetYBRln2oZgNtexCyGXeep/MozhdHqW/bAtF6WAg0a2CgVi6j
-    4r/usL3WbWbwCyLciL9PGcF5QZBYNy2wAIT539Fcc6WMrEJssss5IMtudp/kontJ
-    MfgeKpunzpKX4GJT0lU29nV8f23v0hNPLtGvRTtH2aZAclhGSVFMJ4LCYC1GuzKK
-    0H92r8aM3wtuV6r824nmX0l5QO5jlHJWWwv1lBacozJciVNngkPMEsLD15fdaMXG
-    JTpLlS4HeNYK/aRl0EriiJK4G35H7Y4NrQwvu4OzvKq3ReNhY22YyMf++AGrJrBo
-    eBk0LYkpLxJ07LYqAumgleOA5SVmwSDL5MmsLm41JT6Yo9B+umPUOLRHP5LXO6Bk
-    H6qpbsi2+N03qG0zxwC7DXgGG9/azLQaOQwwlHPNbH7gzITK/6GFyqxbLVLIOQGO
-    piWkRtECAwEAAaNTMFEwHQYDVR0OBBYEFAZcEiVphGxBT4OWXbM6lKu96dvbMB8G
-    A1UdIwQYMBaAFAZcEiVphGxBT4OWXbM6lKu96dvbMA8GA1UdEwEB/wQFMAMBAf8w
-    DQYJKoZIhvcNAQELBQADggIBAGJ5Jnxq1IQ++IRYxCE7r7BqzzF+HTx0EWKkSOmt
-    eSPqeOdhC26hJlclgGZXAF/Xosmn8vkSQMHhj/jr4HI0VF9IyvDUJm8AKsnOgu/7
-    DUey3lEUdOtJpTG9NyTOcrzxToMJ+hWlFLZKxx2dk4FLIvTLjmo1VHM97Bat7XYW
-    IrL9RRIZ25V+eCYtlR7XYjceGFQ0rCdp8SFIQwC6C/AH2tV3b1AJFsND9PcoLu7c
-    //fH+WUQCcD/N0grdC/QCX7AFWzd4rKQ8gjfND4TSYFTSDwW10Mud4kAVhY2P1sY
-    Y3ZpnxWrCHbIZMbszlbMyD+cjsCBnNvOtYGm7pDut/371rllVcB/uOWYWMCtKPoj
-    0elPrwNMrK+P+wceNBCRQO+9gwzB589F2morFTtsob/qtpAygW8Sfl8M+iLWXeYS
-    c3LBLnj0TpgXKRWg7wgIWKSZx9v6pgy70U0qvkjNS1XseUCPf7hfAbxT3xF+37Dw
-    zZRwF4WAWqdnJoOey21mgc+a2DQzqtykA6KfHgCqNFfDbQXPXvNy25DDThbk+paX
-    G2M2EWtr+Nv9s/zm7Xv/pOXlgMFavaj+ikqZ4wfJf6c/sMOdZJtMA4TsYtAJgbc8
-    ts+0eymTq4v5S8/fW51Lbjw6hc1Kcm8k7NbHSi9sEjBfxFLTZNQ5eb4NGr9Od3sU
-    kgwJ
-    -----END CERTIFICATE-----
-  '';
-  "acme-v02.api.letsencrypt.org".key = builtins.toFile "acme-v02.api.letsencrypt.org.key" ''
-    -----BEGIN RSA PRIVATE KEY-----
-    MIIJKQIBAAKCAgEApny0WhfDwEXe6WDTCw8qBuMAPDr88pj6kbhQWfzAW2c0TggJ
-    Etjs9dktENeTpSl14nnLVMiSYIJPYY3KbOIFQH1qDaOuQ7NaOhj9CdMTm5r9bl+C
-    YAyqLIMQ9AAZDhUcQjOy3moiL7ClFHlkFYuEzZBO9DF7hJpfUFIs0Idg50mNoZh/
-    K/fb4P2skNjfCjjomTRUmZHxT6G00ImSTtSaYbN/WHut1xXwJvOoT1nlEA/PghKm
-    JJ9ZuRMSddUJmjL+sT09L8LVkK8CKeHi4r58DHM0D0u8owIFV9qsXd5UvZHaNgvQ
-    4OAWGukMX+TxRuqkUZkaj84vnNL+ttEMl4jedw0ImzNtCOYehDyTPRkfng5PLWMS
-    vWbwyP8jDd2578mSbx5BF7ypYX366+vknjIFyZ5WezcC1pscIHxLoEwuhuf+knN+
-    kFkLOHeYbqQrU6mxSnu9q0hnNvGUkTP0a/1aLOGRfQ5C/pxpE/Rebi8qfM/OJFd4
-    mSxGL93JUTXWAItiIeBnQpIne65/Ska9dWynOEfIb0okdet3kfmNHz3zc17dZ5g4
-    AdOSCgHAlQgFt/Qd8W6xXUe4C5Mfv2ctxRrfQhDwtB6rMByPwzImnciC2h3vCwD3
-    vS/vjUyWICyhZyi2LZDUQz+sCKBXCYYcYh8ThFO40j5x1OnYMq7XQvyl8QkCAwEA
-    AQKCAgBSAfdssWwRF9m3p6QNPIj9H3AMOxpB/azffqTFzsSJwYp4LWkayZPfffy+
-    4RGvN38D8e6ActP3ifjEGu3tOGBR5fUJhujeHEiDea+a2Ug9S9kuNwmnelWQ23bM
-    Wgf9cdSbn4+qEymHyEFolmsAWdsuzri1fHJVXR06GWBNz4GiLA8B3HY4GD1M1Gfe
-    aZVkGagpXyeVBdiR2xuP5VQWVI8/NQWzdiipW/sRlNABVkyI3uDeN4VzYLL3gTeE
-    p021kQz4DSxIjHZacHpmWwhBnIbKMy0fo7TlrqcnIWXqTwv63Q9Zs/RN8NOyqb0Y
-    t1NKFWafcwUsdOnrG9uv/cVwF1FNE8puydaOi8rL1zAeK89JH8NRQ02wohR9w8qy
-    b2tB6DyGMtuqBt8Il6GA16ZoEuaXeayvlsvDEmG1cS9ZwBvfgrVPAmlm2AYdIf5B
-    RHIJu4BJC6Nn2ehVLqxx1QDhog3SOnAsCmcfg5g/fCwxcVMLIhODFoiKYGeMitDG
-    Q4e5JKcOg+RR8PT/n4eY4rUDBGtsR+Nw8S2DWgXmSufyfDtKCjZB4IuLWPS29tNh
-    zF6iYfoiTWzrSs/yqPSKIFpv+PWZwkKSvjdxia6lSBYYEON4W2QICEtiEs+SvcG4
-    0eIqWM+rRmPnJyMfGqX6GCs3rHDQB2VNJPBCYPQalJ/KwZumAQKCAQEA0ezM6qPJ
-    1JM/fddgeQ50h0T9TRXVUTCISxXza+l4NuFt1NdqUOdHsGtbL1JR4GaQUG8qD1/P
-    R39YgnQEQimxpmYLCZkobkwPxTZm9oiMXpcJrlN4PB5evaWShRSv3mgigpt3Wzml
-    Td+2R9RoA/hvF/wEyIvaWznYOyugBC7GXs20dNnZDULhUapeQu7r6JvgmxBOby7S
-    0FbhGplBiSDETzZURqzH/GMJKaJtNgyyVf3Hbg4mZAQDWoBRr+8HxsNbDkxP6e91
-    QrPHy2VZFiaTmJfoxRhyMTn7/JZaLJaUHDOniOsdMj/V7vMCgpfBqh5vR8bKzuPy
-    ZINggpcFPp1IYQKCAQEAywc7AQoktMBCru/3vzBqUveXbR3RKzNyZCTH5CMm3UNH
-    zmblFgqF2nxzNil21GqAXzSwZk5FyHbkeD3yvEZm+bXzsZTDNokAwoiTgyrr2tf8
-    GLMlCHHl5euIh1xHuyg/oKajVGOoXUXK8piqiDpQKd3Zwc6u2oyQlh+gYTPKh+7i
-    ilipkYawoE6teb6JUGpvU+d27INgNhB2oDEXY3pG2PbV+wv229ykSZxh1sJUdDwT
-    a8eTg+3pCGXtOZiJoQTFwKUlD2WYTGqS4Gx6dIJco5k+ZikGNST1JGE64Jl4MZdI
-    rtyvpcYblh5Q14sJGvp4kWYS9tjEM8pA+4Z9th3JqQKCAQEAkidH0+UM1A9gmQCm
-    jiHeR39ky5Jz3f7oJT63J15479yrVxBTWNhtNQrJhXzOvGkr+JQsuF+ANMsYmFql
-    zFqy8KMC9D/JwmD6adeif+o5sHF/r/s1LsYGOAtao4TvnOzrefs7ciwERt+GTSQ4
-    9uq0jgJMYkPcVr9DKI8K7V6ThdW52dECKRVzQiRXVEp7vIsqKUuFECuNYrfaKWai
-    FhLWGkA9FKee5L0e1/naB1N3ph72Bk2btO6GVzAXr2HADEZe0umWiczJ2xLH+3go
-    Oh/JiufYi8ClYFh6dDVJutlrbOcZsV3gCegfzikqijmWABcIavSgpsJVNF2zh7gV
-    Uq62gQKCAQAdO2FHeQpn6/at8WceY/4rC/MFhvGC4tlpidIuCtGhsfo4wZ/iWImF
-    N73u4nF1jBAHpTJwyHxLrLKgjWrRqOFSutvniZ/BzmAJolh63kcvL0Hg3IpMePm8
-    7PivZJ3/WIAwxU1m7SJkq5PY8ho7mwnHvWWI/hU26l42/z68QBS9FawQd0uS5G2x
-    5yIbEU/8ABcfYYhB7XiA0EYEMo1HiWeB/ag5iTN13ILbBmUf4sL+KVgygH3A1RRk
-    XSiWzluij2lZn22ClgIjnoSfQ38uH0bvVzUgyG9YX4XcQxOTGwWvPjT82FGB8NAw
-    ARVqs14QQFfzt1qrp/I38rsAfBDFk+xhAoIBAQCEKNk/oJcy9t/jMIbLcn6z3aCc
-    Fn8GBPSXtFj0t6weN5lHof+cggw4owMFWQQyAXxo/K6NnKNydMPZ5qjtLsHNpbpQ
-    aT1Or0/1YR1bJ8Lo82B4QM++7F761GWQPvE/tyrfPkfkWl92ITIpmnlw4wycRlkq
-    9anI2fnj1nIZwixzE2peb6PcsZU2HOs9uZ5RRd9wia696I7IpNibs4O4J2WTm4va
-    +NeYif3V2g9qwgT0Va0c9/Jlg3b58R0vA8j/VCU5I0TyXpkB3Xapx+pvEdZ3viUL
-    mXZaVotmWjgBXGDtd2VQg2ZiAMXHn3RzXSgV4Z+A/XacRs75h9bNw0ZJYrz1
-    -----END RSA PRIVATE KEY-----
-  '';
-  "acme-v02.api.letsencrypt.org".cert = builtins.toFile "acme-v02.api.letsencrypt.org.cert" ''
-    -----BEGIN CERTIFICATE-----
-    MIIEtDCCApwCAgKaMA0GCSqGSIb3DQEBCwUAMBYxFDASBgNVBAMMC1NuYWtlb2ls
-    IENBMCAXDTE5MTAxODA3NTQxM1oYDzIxMTkwOTI0MDc1NDEzWjAnMSUwIwYDVQQD
-    DBxhY21lLXYwMi5hcGkubGV0c2VuY3J5cHQub3JnMIICIjANBgkqhkiG9w0BAQEF
-    AAOCAg8AMIICCgKCAgEApny0WhfDwEXe6WDTCw8qBuMAPDr88pj6kbhQWfzAW2c0
-    TggJEtjs9dktENeTpSl14nnLVMiSYIJPYY3KbOIFQH1qDaOuQ7NaOhj9CdMTm5r9
-    bl+CYAyqLIMQ9AAZDhUcQjOy3moiL7ClFHlkFYuEzZBO9DF7hJpfUFIs0Idg50mN
-    oZh/K/fb4P2skNjfCjjomTRUmZHxT6G00ImSTtSaYbN/WHut1xXwJvOoT1nlEA/P
-    ghKmJJ9ZuRMSddUJmjL+sT09L8LVkK8CKeHi4r58DHM0D0u8owIFV9qsXd5UvZHa
-    NgvQ4OAWGukMX+TxRuqkUZkaj84vnNL+ttEMl4jedw0ImzNtCOYehDyTPRkfng5P
-    LWMSvWbwyP8jDd2578mSbx5BF7ypYX366+vknjIFyZ5WezcC1pscIHxLoEwuhuf+
-    knN+kFkLOHeYbqQrU6mxSnu9q0hnNvGUkTP0a/1aLOGRfQ5C/pxpE/Rebi8qfM/O
-    JFd4mSxGL93JUTXWAItiIeBnQpIne65/Ska9dWynOEfIb0okdet3kfmNHz3zc17d
-    Z5g4AdOSCgHAlQgFt/Qd8W6xXUe4C5Mfv2ctxRrfQhDwtB6rMByPwzImnciC2h3v
-    CwD3vS/vjUyWICyhZyi2LZDUQz+sCKBXCYYcYh8ThFO40j5x1OnYMq7XQvyl8QkC
-    AwEAATANBgkqhkiG9w0BAQsFAAOCAgEAkx0GLPuCvKSLTHxVLh5tP4jxSGG/zN37
-    PeZLu3QJTdRdRc8bgeOGXAVEVFbqOLTNTsuY1mvpiv2V6wxR6nns+PIHeLY/UOdc
-    mOreKPtMU2dWPp3ybec2Jwii6PhAXZJ26AKintmug1psMw7662crR3SCnn85/CvW
-    192vhr5gM1PqLBIlbsX0tAqxAwBe1YkxBb9vCq8NVghJlKme49xnwGULMTGs15MW
-    hIPx6sW93zwrGiTsDImH49ILGF+NcX1AgAq90nG0j/l5zhDgXGJglX+K1xP99X1R
-    de3I4uoufPa5q+Pjmhy7muL+o4Qt0D0Vm86RqqjTkNPsr7gAJtt66A7TJrYiIoKn
-    GTIBsgM6egeFLLYQsT0ap/59HJismO2Pjx4Jk/jHOkC8TJsXQNRq1Km76VMBnuc0
-    2CMoD9pb38GjUUH94D4hJK4Ls/gJMF3ftKUyR8Sr/LjE6qU6Yj+ZpeEQP4kW9ANq
-    Lv9KSNDQQpRTL4LwGLTGomksLTQEekge7/q4J2TQRZNYJ/mxnrBKRcv9EAMgBMXq
-    Q+7GHtKDv9tJVlMfG/MRD3CMuuSRiT3OVbvMMkFzsPkqxYAP1CqE/JGvh67TzKI+
-    MUfXKehA6TKuxrTVqCtoFIfGaqA9IWyoRTtugYq/xssB9ESeEYGeaM1A9Yueqz+h
-    KkBZO00jHSE=
-    -----END CERTIFICATE-----
-  '';
-  "letsencrypt.org".key = builtins.toFile "letsencrypt.org.key" ''
-    -----BEGIN RSA PRIVATE KEY-----
-    MIIJKgIBAAKCAgEA9dpdPEyzD3/BBds7tA/51s+WmLFyWuFrq4yMd2R+vi5gvK7n
-    lLNVKhYgiTmK2Um+UEpGucJqZHcTSZA1Bz4S/8ND/AI9I6EmwvBinY5/PubxEALk
-    9YiDA+IzH8ZGFM8wXg7fMbbJAsyv+SHAtr2jmCsggrpuD5fgzs2p+F2q0+oVoeFw
-    MAOUdAf2jNtNLEj2Q6MiR5Xq+wFOcRtXlNlXWIX3NrmubO/xOpDNpsyjyYC5Ld+W
-    06MS5bTHSdv56AkUg2PugMChj15TOddEJIK8zPXFTlMYye9SKwjhNUZovfe4xXCa
-    Tj2nmzrcuMKLz+S3sKQeTWjiRcY3w4zTlAbhtGXDjXjhMObrHoWM8e3cTL4NJMvt
-    tNStXficxbeTbIiYu+7dtF0q+iWaZqexc6PdAaIpFZ0XSw+i5iLdQZmBwzY7NLlH
-    pQupfh6ze0qDUVZAMDubo4JKUTBzH6QTuhHx+uUm7Lc8YdNArn7o/vMZDQym1Eia
-    xKxZuCGaqFvq8ZK4nBVsHfcXbhF/XD2HMid3t7ImbREVu9qnc+En+acU/SJaaL3r
-    jMW6HLVMr6+vQrCzYkvLzKYpoUm9D1Kcn6d8Ofxl2iCaY9CkMr5/6J1p1wcTdcN7
-    IVQ/DFBeTDauyWbyZkO/lPoZoakWyXOx9S9tgClzhFmNgRkZv9wN+QguNDcCAwEA
-    AQKCAgEA0ndlacGfaJ1NeN39dmBW2XZMzdrassJXkjx34528gsLhPaXdyobbWXQn
-    1lHUc7+VlNaBRXUR73+gm1FAlDqnuRxIjuy7ukyzCh8PzSG3/PlnVPWlXCzJPAHh
-    EkqCpD3agirpF34LBsKDwxsKB2bBLft9kWxX3DGA2olmAKDvJQs4CaUcjX4DEHHg
-    tyTmJAsyByUYq3/D8a1koZ9ukpadF8NXpxm+ILQoJqLf6vM1I8N2w7atP/BStSLV
-    mH0gq2tajEB4ZPCDXmC5jsKiKz9gsXWUu0CX8AdYqE6pvRnRgQ8Ytq1265QMb+8s
-    FV82oXqDZkyZRFuNmX3fLyDX39kkTcVS37S56Gzk4EzDWE/u2RXCAPeWla2zUFYI
-    hg8X4ZAwbZRODtK2cZTuCZEILM/iKmtSgHC+aQhp18EUAefa7WGrRD4AvbTxH4VF
-    ek60bwISBk5Mhf39MwqIiQxGOFmfLsQReZvzH4jI5zfDXf/0yZ/1SdGeu6+Walt0
-    V81Ua/DB6zshHpeSP74HMuJHZ4DOQfcV/ndyzvoP84pAjenSx6O034OwQTkpoMI/
-    f/2rK8kdzYSL4f//kFMuRLqmAwOmAFYB2oMo0/YaIoQ4vgTHDKTSxj5mbno56GdT
-    huMAVMKskaCSVbyMB/xyQG7senLItVv+HafVk6ChMUbkIjv9zgECggEBAP+ux1RG
-    cETGjK2U3CRoHGxR7FwaX6hkSokG+aFdVLer+WUrZmR8Ccvh2ALpm8K1G6TTk/5X
-    ZeVX4+1VFYDeTHMN8g20usS5mw3v2GF3fGxGLe4q56l4/4kKMZOrSBuWH4niiIKD
-    0QogdzWkpQJ93nMbZxZ5lk+lRZVf3qSm6nzyP468ndrfI57Ov5OUIWZ7KhTUH9IK
-    8/urUk+lEvyzQmNTlt5ZZXRz7cR01K8chx1zevVAyynzSuGjTysaBN7LTT0v3yVu
-    96yKNsxJvuIz2+4qSjhbnN4jH+feN0VsdF3+Qkru0lBmLVgJl4X67XFaAKMDU9yv
-    3alS53Pkol+Dy1cCggEBAPYodofHC1ydoOmCvUAq4oJNtyI4iIOY/ch3sxVhkNyi
-    KBscQqbay/DiXFiNl+NsemzB1PrHzvCaqKcBKw537XzeKqUgYuVLkFGubf9bDhXi
-    wSRcYbU/oNTgiTgXPW8wH60uIoLaiNi1/YjO2zh4GEY/kFqSuD54Y91iFmcC75bv
-    OjCNugnRdpRjOFhaeNx75tdverR37w3APVZuBSv3bJlMPCtaf+fEAKxJxeqCs3Oq
-    rtsw2TQ4TqfE8/w9qPCVv3bQbMbO48SwjxAz47qH2h3qGu3Ov8badeARe+Ou7nuI
-    U13gPuPOhPXIQP/MYOyamPJdFyng1b8vyNsfjOcWMiECggEAEkMgl6NkV3U7DRbp
-    1mvdQ9tiH33+wR9Qt5LY966b43aUHKbJ7Hlzla1u6V5YMsMO02oNUwhZDdWGQShn
-    ncnC+iDP3iy/flenfIpaETQgnfcxRqan31H2Joqk2eBNCTNi001r5K6XmrqQ6TL2
-    WkQ1RFF7vn42vz+VxcKQO4B0lTIUWhSczcpMWAZ6ZocZD6HScqRoFW+U16/39Bpd
-    TdFb944742vNNFEndXXGzy8hc3gRGz1ihX+MJKuuduyn1mX9AVbPAHR5mkhQ+6x0
-    xuFfXxaEMJxSiwdFOyGDHyFM+n2zrHh8ayOxL22X9gjjNspv6zTMo6GoGnUCdSOq
-    eVoHhwKCAQEAot5O3rOB/vuEljwcv7IgQJrvCsNg/8FgWR1p7kGpuXHJG3btWrz1
-    pyH+e9DjqGQD9KWjJ3LAp02NPUJ2nJIZHj9Y8/yjspb2nDTPLt+uSCjKJibBt0ys
-    O219HRGzYjfzHYCi8PVrCggQAk7rmUdMuF4iQutE4ICDgtz9eZbls3YBiFKdvxVK
-    Yg/sHflucmPAbtah13prPyvs6ZzN6zNANYXNYdn1OwHieBwvyWRFG8jY/MorTHPd
-    BwA3drPNbbGHBzQMZNZKub8gSVYr3SU52gUlYCclmIq+50xqLlF2FWIz1q8irVPd
-    gUnIR/eQQbxgaivRwbGze1ZAjUsozVVQQQKCAQEA9uAKU3O06bEUGj+L0G+7R7r/
-    bi2DNi2kLJ7jyq+n0OqcHEQ1zFK4LAPaXY0yMYXieUzhivMGLSNDiubGO2/KxkFF
-    REXUFgYWZYMwrKsUuscybB64cQDwzD0oXrhvEa2PHecdG6AZ63iLcHaaDzyCPID/
-    wtljekLO2jbJ5esXZd016lykFfUd/K4KP1DGyI2Dkq6q0gTc/Y36gDAcPhIWtzna
-    UujYCe3a8DWCElH4geKXaB5ABbV1eJ8Lch599lXJ9Hszem6QNosFsPaHDCcqLS9H
-    yy2WA6CY2LVU7kONN+O0kxs2fVbxIkI+d/LZyX/yIGlkXcAzL07llIlrTAYebQ==
-    -----END RSA PRIVATE KEY-----
-  '';
-  "letsencrypt.org".cert = builtins.toFile "letsencrypt.org.cert" ''
-    -----BEGIN CERTIFICATE-----
-    MIIEpzCCAo8CAgKaMA0GCSqGSIb3DQEBCwUAMBYxFDASBgNVBAMMC1NuYWtlb2ls
-    IENBMCAXDTE5MTAxODA3NTQxNVoYDzIxMTkwOTI0MDc1NDE1WjAaMRgwFgYDVQQD
-    DA9sZXRzZW5jcnlwdC5vcmcwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoIC
-    AQD12l08TLMPf8EF2zu0D/nWz5aYsXJa4WurjIx3ZH6+LmC8rueUs1UqFiCJOYrZ
-    Sb5QSka5wmpkdxNJkDUHPhL/w0P8Aj0joSbC8GKdjn8+5vEQAuT1iIMD4jMfxkYU
-    zzBeDt8xtskCzK/5IcC2vaOYKyCCum4Pl+DOzan4XarT6hWh4XAwA5R0B/aM200s
-    SPZDoyJHler7AU5xG1eU2VdYhfc2ua5s7/E6kM2mzKPJgLkt35bToxLltMdJ2/no
-    CRSDY+6AwKGPXlM510QkgrzM9cVOUxjJ71IrCOE1Rmi997jFcJpOPaebOty4wovP
-    5LewpB5NaOJFxjfDjNOUBuG0ZcONeOEw5usehYzx7dxMvg0ky+201K1d+JzFt5Ns
-    iJi77t20XSr6JZpmp7Fzo90BoikVnRdLD6LmIt1BmYHDNjs0uUelC6l+HrN7SoNR
-    VkAwO5ujgkpRMHMfpBO6EfH65Sbstzxh00Cufuj+8xkNDKbUSJrErFm4IZqoW+rx
-    kricFWwd9xduEX9cPYcyJ3e3siZtERW72qdz4Sf5pxT9IlpoveuMxboctUyvr69C
-    sLNiS8vMpimhSb0PUpyfp3w5/GXaIJpj0KQyvn/onWnXBxN1w3shVD8MUF5MNq7J
-    ZvJmQ7+U+hmhqRbJc7H1L22AKXOEWY2BGRm/3A35CC40NwIDAQABMA0GCSqGSIb3
-    DQEBCwUAA4ICAQBbJwE+qc0j6JGHWe0TGjv1viJU3WuyJkMRi+ejx0p/k7Ntp5An
-    2wLC7b/lVP/Nh+PKY/iXWn/BErv2MUo4POc1g8svgxsmMMh5KGGieIfGs7xT+JMH
-    dzZZM+pUpIB5fEO5JfjiOEOKDdAvRSs0mTAVYZEokGkXSNWyylvEaA16mHtMgPjo
-    Lm75d0O66RfJDdd/hTl8umGpF7kEGW1qYk2QmuPr7AqOa8na7olL5fMPh6Q7yRqx
-    GIS9JKQ0fWl8Ngk09WfwUN/kEMcp9Jl5iunNRkbpUJIM/lHFkSA7yOFFL+dVWzd4
-    2r+ddJXTFzW8Rwt65l8SV2MEhijEamKva3mqKLIRWxDsfFVT1T04LWFtnzMW4Z29
-    UHF9Pi7XSyKz0Y/Lz31mNTkjJYbOvbnwok8lc3wFWHc+lummZk8IkCq8xfqzwmwX
-    Ow6EV+Q6VaQpOHumQZ12pBBLtL8DyDhWaRUgVy2vYpwYsMYa5BFMcKCynjlSewo9
-    G2hNoW45cQZP1qHltRR9Xad7SaP7iTETDCiR7AWOqSpDipSh9eMfVW97ZbSfz+vl
-    xl8PZEZMTRIIRVXsPP+E8gtDUhUQp2+Vcz8r6q71qslXM09xl/501uaNjCc3hH2R
-    iw2N77Lho1F3FrBbHdML3RYHZI55eC9iQw6R4S+R4b+iWLJoHzHrW61itg==
-    -----END CERTIFICATE-----
-  '';
-}
diff --git a/nixos/tests/common/resolver.nix b/nixos/tests/common/resolver.nix
index 6be8d1d18e622..09a74de20faae 100644
--- a/nixos/tests/common/resolver.nix
+++ b/nixos/tests/common/resolver.nix
@@ -18,7 +18,7 @@
       defining this option needs to be explicitly imported.
 
       The reason this option exists is for the
-      <filename>nixos/tests/common/letsencrypt</filename> module, which
+      <filename>nixos/tests/common/acme/server</filename> module, which
       needs that option to disable the resolver once the user has set its own
       resolver.
     '';
diff --git a/nixos/tests/containers-custom-pkgs.nix b/nixos/tests/containers-custom-pkgs.nix
new file mode 100644
index 0000000000000..397a4a905e6d9
--- /dev/null
+++ b/nixos/tests/containers-custom-pkgs.nix
@@ -0,0 +1,42 @@
+# Test for NixOS' container support.
+
+import ./make-test-python.nix ({ pkgs, lib, ...} : let
+
+  customPkgs = pkgs // {
+    hello = pkgs.hello.overrideAttrs(old: {
+      name = "custom-hello";
+    });
+  };
+
+in {
+  name = "containers-hosts";
+  meta = with lib.maintainers; {
+    maintainers = [ adisbladis ];
+  };
+
+  machine =
+    { ... }:
+    {
+      virtualisation.memorySize = 256;
+      virtualisation.vlans = [];
+
+      containers.simple = {
+        autoStart = true;
+        pkgs = customPkgs;
+        config = {pkgs, config, ... }: {
+          environment.systemPackages = [
+            pkgs.hello
+          ];
+        };
+      };
+
+    };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("default.target")
+    machine.succeed(
+        "test $(nixos-container run simple -- readlink -f /run/current-system/sw/bin/hello) = ${customPkgs.hello}/bin/hello"
+    )
+  '';
+})
diff --git a/nixos/tests/gnome3-xorg.nix b/nixos/tests/gnome3-xorg.nix
index f793bb922ad76..b59badcd5de40 100644
--- a/nixos/tests/gnome3-xorg.nix
+++ b/nixos/tests/gnome3-xorg.nix
@@ -1,7 +1,7 @@
-import ./make-test-python.nix ({ pkgs, ...} : {
+import ./make-test-python.nix ({ pkgs, lib, ...} : {
   name = "gnome3-xorg";
-  meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = pkgs.gnome3.maintainers;
+  meta = with lib; {
+    maintainers = teams.gnome.members;
   };
 
   machine = { nodes, ... }: let
diff --git a/nixos/tests/gnome3.nix b/nixos/tests/gnome3.nix
index 486c146d8dc39..17e72c5f65103 100644
--- a/nixos/tests/gnome3.nix
+++ b/nixos/tests/gnome3.nix
@@ -1,7 +1,7 @@
-import ./make-test-python.nix ({ pkgs, ...} : {
+import ./make-test-python.nix ({ pkgs, lib, ...} : {
   name = "gnome3";
-  meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = pkgs.gnome3.maintainers;
+  meta = with lib; {
+    maintainers = teams.gnome.members;
   };
 
   machine =
diff --git a/nixos/tests/hardened.nix b/nixos/tests/hardened.nix
index cbf76f9e55877..5ed0dfcf9ab8f 100644
--- a/nixos/tests/hardened.nix
+++ b/nixos/tests/hardened.nix
@@ -1,4 +1,4 @@
-import ./make-test.nix ({ pkgs, ...} : {
+import ./make-test.nix ({ pkgs, latestKernel ? false, ... } : {
   name = "hardened";
   meta = with pkgs.stdenv.lib.maintainers; {
     maintainers = [ joachifm ];
@@ -10,6 +10,8 @@ import ./make-test.nix ({ pkgs, ...} : {
     { users.users.alice = { isNormalUser = true; extraGroups = [ "proc" ]; };
       users.users.sybil = { isNormalUser = true; group = "wheel"; };
       imports = [ ../modules/profiles/hardened.nix ];
+      boot.kernelPackages =
+        lib.mkIf latestKernel pkgs.linuxPackages_latest_hardened;
       environment.memoryAllocator.provider = "graphene-hardened";
       nix.useSandbox = false;
       virtualisation.emptyDiskImages = [ 4096 ];
@@ -23,7 +25,9 @@ import ./make-test.nix ({ pkgs, ...} : {
           options = [ "noauto" ];
         };
       };
-      boot.extraModulePackages = [ config.boot.kernelPackages.wireguard ];
+      boot.extraModulePackages =
+        optional (versionOlder config.boot.kernelPackages.kernel.version "5.6")
+          config.boot.kernelPackages.wireguard;
       boot.kernelModules = [ "wireguard" ];
     };
 
@@ -76,7 +80,8 @@ import ./make-test.nix ({ pkgs, ...} : {
 
       # Test userns
       subtest "userns", sub {
-          $machine->fail("unshare --user");
+          $machine->succeed("unshare --user true");
+          $machine->fail("su -l alice -c 'unshare --user true'");
       };
 
       # Test dmesg restriction
diff --git a/nixos/tests/installed-tests/default.nix b/nixos/tests/installed-tests/default.nix
index a189ef63f2224..b6bdfea227701 100644
--- a/nixos/tests/installed-tests/default.nix
+++ b/nixos/tests/installed-tests/default.nix
@@ -91,6 +91,7 @@ in
   ibus = callInstalledTest ./ibus.nix {};
   libgdata = callInstalledTest ./libgdata.nix {};
   glib-testing = callInstalledTest ./glib-testing.nix {};
+  libjcat = callInstalledTest ./libjcat.nix {};
   libxmlb = callInstalledTest ./libxmlb.nix {};
   malcontent = callInstalledTest ./malcontent.nix {};
   ostree = callInstalledTest ./ostree.nix {};
diff --git a/nixos/tests/installed-tests/libjcat.nix b/nixos/tests/installed-tests/libjcat.nix
new file mode 100644
index 0000000000000..41493a730890a
--- /dev/null
+++ b/nixos/tests/installed-tests/libjcat.nix
@@ -0,0 +1,5 @@
+{ pkgs, makeInstalledTest, ... }:
+
+makeInstalledTest {
+  tested = pkgs.libjcat;
+}
diff --git a/nixos/tests/tuptime.nix b/nixos/tests/tuptime.nix
new file mode 100644
index 0000000000000..36ce2b1ae1923
--- /dev/null
+++ b/nixos/tests/tuptime.nix
@@ -0,0 +1,29 @@
+import ./make-test-python.nix ({ pkgs, ...} : {
+  name = "tuptime";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ evils ];
+  };
+
+  machine = { pkgs, ... }: {
+    imports = [ ../modules/profiles/minimal.nix ];
+    services.tuptime.enable = true;
+  };
+
+  testScript =
+    ''
+      # see if it starts
+      start_all()
+      machine.wait_for_unit("multi-user.target")
+      machine.succeed("tuptime | grep 'System startups:[[:blank:]]*1'")
+      machine.succeed("tuptime | grep 'System uptime:[[:blank:]]*100.0%'")
+      machine.shutdown()
+
+      # restart machine and see if it correctly reports the reboot
+      machine.start()
+      machine.wait_for_unit("multi-user.target")
+      machine.succeed("tuptime | grep 'System startups:[[:blank:]]*2'")
+      machine.succeed("tuptime | grep 'System shutdowns:[[:blank:]]*1 ok'")
+      machine.shutdown()
+    '';
+})
+
diff --git a/pkgs/applications/accessibility/contrast/default.nix b/pkgs/applications/accessibility/contrast/default.nix
index 673c8071d4b2c..192bf041c64e6 100644
--- a/pkgs/applications/accessibility/contrast/default.nix
+++ b/pkgs/applications/accessibility/contrast/default.nix
@@ -19,7 +19,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "contrast";
-  version = "0.0.2";
+  version = "0.0.3";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
@@ -27,10 +27,10 @@ rustPlatform.buildRustPackage rec {
     owner = "design";
     repo = "contrast";
     rev = version;
-    sha256 = "0rm705zrk9rfv31pwbqxrswi5v6vhnghxa8dgxjmcrh00l8dm6j9";
+    sha256 = "0kk3mv7a6y258109xvgicmsi0lw0rcs00gfyivl5hdz7qh47iccy";
   };
 
-  cargoSha256 = "0qj0vmxa1d6war1vb3zgkf1drvk7awm970fw6692hd9msa9c1kkf";
+  cargoSha256 = "0vi8nv4hkhsgqgz36xacwkk5cxirg6li44nbmk3x7vx7c64hzybq";
 
   nativeBuildInputs = [
     desktop-file-utils
diff --git a/pkgs/applications/audio/gnome-podcasts/default.nix b/pkgs/applications/audio/gnome-podcasts/default.nix
index e24bd61693e71..d5bec0c09e5fa 100644
--- a/pkgs/applications/audio/gnome-podcasts/default.nix
+++ b/pkgs/applications/audio/gnome-podcasts/default.nix
@@ -9,7 +9,6 @@
 , rustc
 , python3
 , pkgconfig
-, gnome3
 , glib
 , libhandy
 , gtk3
@@ -76,7 +75,7 @@ rustPlatform.buildRustPackage rec {
     description = "Listen to your favorite podcasts";
     homepage = "https://wiki.gnome.org/Apps/Podcasts";
     license = licenses.gpl3;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/applications/audio/lollypop/default.nix b/pkgs/applications/audio/lollypop/default.nix
index a3580ce3b522d..e4b8b906fa64f 100644
--- a/pkgs/applications/audio/lollypop/default.nix
+++ b/pkgs/applications/audio/lollypop/default.nix
@@ -23,7 +23,7 @@
 
 python3.pkgs.buildPythonApplication rec  {
   pname = "lollypop";
-  version = "1.2.32";
+  version = "1.2.35";
 
   format = "other";
   doCheck = false;
@@ -32,7 +32,7 @@ python3.pkgs.buildPythonApplication rec  {
     url = "https://gitlab.gnome.org/World/lollypop";
     rev = "refs/tags/${version}";
     fetchSubmodules = true;
-    sha256 = "03x6qihd349pq5lmgahb77sys60g16v5v6qkdlzf8k88451k8p7n";
+    sha256 = "19nw9qh17yyi9ih1nwngbbwjx1vr26haqhmzsdqf0yjgsgf9vldx";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/audio/lsp-plugins/default.nix b/pkgs/applications/audio/lsp-plugins/default.nix
index a8aa101ab4de6..d530aff9faa68 100644
--- a/pkgs/applications/audio/lsp-plugins/default.nix
+++ b/pkgs/applications/audio/lsp-plugins/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lsp-plugins";
-  version = "1.1.15";
+  version = "1.1.19";
 
   src = fetchFromGitHub {
     owner = "sadko4u";
     repo = pname;
     rev = "${pname}-${version}";
-    sha256 = "0lynyjs5zp27gnzcv8a23pvb7c1ghzc2dspypca3ciq40bfpfzik";
+    sha256 = "1wiph3vxhydc6mr9hn2c6crd4cx592l2zv0wrzgmpnlm1lflzpbg";
   };
 
   nativeBuildInputs = [ pkgconfig php makeWrapper ];
diff --git a/pkgs/applications/audio/musescore/default.nix b/pkgs/applications/audio/musescore/default.nix
index bd4b2db380a3f..063a05a72f3a8 100644
--- a/pkgs/applications/audio/musescore/default.nix
+++ b/pkgs/applications/audio/musescore/default.nix
@@ -33,7 +33,7 @@ mkDerivation rec {
     description = "Music notation and composition software";
     homepage = "https://musescore.org/";
     license = licenses.gpl2;
-    maintainers = with maintainers; [ vandenoever ];
+    maintainers = with maintainers; [ vandenoever turion ];
     platforms = platforms.linux;
     repositories.git = "https://github.com/musescore/MuseScore";
   };
diff --git a/pkgs/applications/audio/polyphone/default.nix b/pkgs/applications/audio/polyphone/default.nix
index 404ed9fb77695..270d51840d788 100644
--- a/pkgs/applications/audio/polyphone/default.nix
+++ b/pkgs/applications/audio/polyphone/default.nix
@@ -41,7 +41,7 @@ mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "A soundfont editor for creating musical instruments";
-    homepage = https://www.polyphone-soundfonts.com/;
+    homepage = "https://www.polyphone-soundfonts.com/";
     license = licenses.gpl3;
     maintainers = [ maintainers.maxdamantus ];
     platforms = platforms.linux;
diff --git a/pkgs/applications/audio/spotifyd/default.nix b/pkgs/applications/audio/spotifyd/default.nix
index 263fe986df317..121f9cbc960f8 100644
--- a/pkgs/applications/audio/spotifyd/default.nix
+++ b/pkgs/applications/audio/spotifyd/default.nix
@@ -2,6 +2,9 @@
 , withALSA ? true, alsaLib ? null
 , withPulseAudio ? false, libpulseaudio ? null
 , withPortAudio ? false, portaudio ? null
+, withMpris ? false
+, withKeyring ? false
+, dbus ? null
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,7 +23,7 @@ rustPlatform.buildRustPackage rec {
   cargoBuildFlags = [
     "--no-default-features"
     "--features"
-    "${stdenv.lib.optionalString withALSA "alsa_backend,"}${stdenv.lib.optionalString withPulseAudio "pulseaudio_backend,"}${stdenv.lib.optionalString withPortAudio "portaudio_backend,"}"
+    "${stdenv.lib.optionalString withALSA "alsa_backend,"}${stdenv.lib.optionalString withPulseAudio "pulseaudio_backend,"}${stdenv.lib.optionalString withPortAudio "portaudio_backend,"}${stdenv.lib.optionalString withMpris "dbus_mpris,"}${stdenv.lib.optionalString withKeyring "dbus_keyring,"}"
   ];
 
   nativeBuildInputs = [ pkgconfig ];
@@ -28,7 +31,8 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ openssl ]
     ++ stdenv.lib.optional withALSA alsaLib
     ++ stdenv.lib.optional withPulseAudio libpulseaudio
-    ++ stdenv.lib.optional withPortAudio portaudio;
+    ++ stdenv.lib.optional withPortAudio portaudio
+    ++ stdenv.lib.optional (withMpris || withKeyring) dbus;
 
   doCheck = false;
 
diff --git a/pkgs/applications/blockchains/go-ethereum.nix b/pkgs/applications/blockchains/go-ethereum.nix
index 980b485b95680..6a443571d0f28 100644
--- a/pkgs/applications/blockchains/go-ethereum.nix
+++ b/pkgs/applications/blockchains/go-ethereum.nix
@@ -2,18 +2,19 @@
 
 buildGoModule rec {
   pname = "go-ethereum";
-  version = "1.9.12";
+  version = "1.9.13";
 
   src = fetchFromGitHub {
     owner = "ethereum";
     repo = pname;
     rev = "v${version}";
-    sha256 = "143imiphyzk3009cfnqj7q013pb1wva13zq63byfj3d204b58cg6";
+    sha256 = "1yqqflp73yvjy6bp05xd1nv5fc6p1nx7g4spbssxf3ws96pdh425";
   };
 
-  modSha256 = "15a8if5gx361nrqgv201jy8saq1ir1g18rpqzdmavg4ic75si5x1";
+  modSha256 = "07xrw3fivfpbkg4mp8ghrj1bishfas82dbd780fymgs2h74iigf3";
 
   subPackages = [
+    "cmd/abidump"
     "cmd/abigen"
     "cmd/bootnode"
     "cmd/checkpoint-admin"
diff --git a/pkgs/applications/editors/android-studio/default.nix b/pkgs/applications/editors/android-studio/default.nix
index fd15876f51145..a6b99e5835189 100644
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -8,9 +8,9 @@ let
     inherit (gnome2) GConf gnome_vfs;
   };
   stableVersion = {
-    version = "3.6.2.0"; # "Android Studio 3.6.2"
-    build = "192.6308749";
-    sha256Hash = "04r4iwlmns1lf3wfd32cqmndbdz9rf7hfbi5r6qmvpi8j83fghvr";
+    version = "3.6.3.0"; # "Android Studio 3.6.3"
+    build = "192.6392135";
+    sha256Hash = "0apxmp341m7mbpm2df3qvsbaifwy6yqq746kbhbwlw8bn9hrzv1k";
   };
   betaVersion = {
     version = "4.0.0.13"; # "Android Studio 4.0 Beta 4"
@@ -18,9 +18,9 @@ let
     sha256Hash = "0lchi3l50826n1af1z24yclpf27v2q5p1zjbvcmn37wz46d4s4g2";
   };
   latestVersion = { # canary & dev
-    version = "4.1.0.5"; # "Android Studio 4.1 Canary 5"
-    build = "193.6362631";
-    sha256Hash = "1q9wbqnwpq0mz8rz4c0v7mfaazymq6xv20dv4fll6p2q63qk71qp";
+    version = "4.1.0.6"; # "Android Studio 4.1 Canary 6"
+    build = "193.6381907";
+    sha256Hash = "0sa5plr96m90wv5hi9bqwa11j6k8k9wa0ji8qmlimdhnpyzhsdrx";
   };
 in {
   # Attributes are named by their corresponding release channels
diff --git a/pkgs/applications/editors/gnome-builder/default.nix b/pkgs/applications/editors/gnome-builder/default.nix
index b9f06e44a8756..c58d12a58f89c 100644
--- a/pkgs/applications/editors/gnome-builder/default.nix
+++ b/pkgs/applications/editors/gnome-builder/default.nix
@@ -151,7 +151,7 @@ stdenv.mkDerivation rec {
     '';
     homepage = "https://wiki.gnome.org/Apps/Builder";
     license = licenses.gpl3Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/editors/micro/default.nix b/pkgs/applications/editors/micro/default.nix
index f9e7b38cbe0c7..6a1ee5d196ee7 100644
--- a/pkgs/applications/editors/micro/default.nix
+++ b/pkgs/applications/editors/micro/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage  rec {
   pname = "micro";
-  version = "1.4.1";
+  version = "2.0.3";
 
   goPackagePath = "github.com/zyedidia/micro";
 
@@ -10,13 +10,15 @@ buildGoPackage  rec {
     owner = "zyedidia";
     repo = "micro";
     rev = "v${version}";
-    sha256 = "0m9p6smb5grdazsgr3m1x4rry9ihhlgl9ildhvfp53czrifbx0m5";
+    sha256 = "017m9kb3gfrgzd06f1nma1i3m5rb0hzpgdikb86lsyv8ik18y12z";
     fetchSubmodules = true;
   };
 
   subPackages = [ "cmd/micro" ];
 
-  buildFlagsArray = [ "-ldflags=" "-X main.Version=${version}" ];
+  buildFlagsArray = [ "-ldflags=" "-X ${goPackagePath}/internal/util.Version=${version}" ];
+
+  goDeps = ./deps.nix;
 
   meta = with stdenv.lib; {
     homepage = "https://micro-editor.github.io";
diff --git a/pkgs/applications/editors/micro/deps.nix b/pkgs/applications/editors/micro/deps.nix
new file mode 100644
index 0000000000000..e8ed69a9088b3
--- /dev/null
+++ b/pkgs/applications/editors/micro/deps.nix
@@ -0,0 +1,336 @@
+# file generated from go.mod using vgo2nix (https://github.com/adisbladis/vgo2nix)
+[
+  {
+    goPackagePath = "github.com/blang/semver";
+    fetch = {
+      type = "git";
+      url = "https://github.com/blang/semver";
+      rev = "v3.5.1";
+      sha256 = "13ws259bwcibkclbr82ilhk6zadm63kxklxhk12wayklj8ghhsmy";
+    };
+  }
+  {
+    goPackagePath = "github.com/chzyer/logex";
+    fetch = {
+      type = "git";
+      url = "https://github.com/chzyer/logex";
+      rev = "v1.1.10";
+      sha256 = "08pbjj3wx9acavlwyr055isa8a5hnmllgdv5k6ra60l5y1brmlq4";
+    };
+  }
+  {
+    goPackagePath = "github.com/chzyer/readline";
+    fetch = {
+      type = "git";
+      url = "https://github.com/chzyer/readline";
+      rev = "2972be24d48e";
+      sha256 = "104q8dazj8yf6b089jjr82fy9h1g80zyyzvp3g8b44a7d8ngjj6r";
+    };
+  }
+  {
+    goPackagePath = "github.com/chzyer/test";
+    fetch = {
+      type = "git";
+      url = "https://github.com/chzyer/test";
+      rev = "a1ea475d72b1";
+      sha256 = "0rns2aqk22i9xsgyap0pq8wi4cfaxsri4d9q6xxhhyma8jjsnj2k";
+    };
+  }
+  {
+    goPackagePath = "github.com/davecgh/go-spew";
+    fetch = {
+      type = "git";
+      url = "https://github.com/davecgh/go-spew";
+      rev = "v1.1.1";
+      sha256 = "0hka6hmyvp701adzag2g26cxdj47g21x6jz4sc6jjz1mn59d474y";
+    };
+  }
+  {
+    goPackagePath = "github.com/dustin/go-humanize";
+    fetch = {
+      type = "git";
+      url = "https://github.com/dustin/go-humanize";
+      rev = "v1.0.0";
+      sha256 = "1kqf1kavdyvjk7f8kx62pnm7fbypn9z1vbf8v2qdh3y7z7a0cbl3";
+    };
+  }
+  {
+    goPackagePath = "github.com/gdamore/encoding";
+    fetch = {
+      type = "git";
+      url = "https://github.com/gdamore/encoding";
+      rev = "v1.0.0";
+      sha256 = "1vmm5zll92i2fm4ajqx0gyx0p9j36496x5nabi3y0x7h0inv0pk9";
+    };
+  }
+  {
+    goPackagePath = "github.com/go-errors/errors";
+    fetch = {
+      type = "git";
+      url = "https://github.com/go-errors/errors";
+      rev = "v1.0.1";
+      sha256 = "0rznpknk19rxkr7li6dqs52c26pjazp69lh493l4ny4sxn5922lp";
+    };
+  }
+  {
+    goPackagePath = "github.com/kballard/go-shellquote";
+    fetch = {
+      type = "git";
+      url = "https://github.com/kballard/go-shellquote";
+      rev = "95032a82bc51";
+      sha256 = "1rspvmnsikdq95jmx3dykxd4k1rmgl98ryjrysvl0cf18hl1vq80";
+    };
+  }
+  {
+    goPackagePath = "github.com/kr/pretty";
+    fetch = {
+      type = "git";
+      url = "https://github.com/kr/pretty";
+      rev = "v0.1.0";
+      sha256 = "18m4pwg2abd0j9cn5v3k2ksk9ig4vlwxmlw9rrglanziv9l967qp";
+    };
+  }
+  {
+    goPackagePath = "github.com/kr/pty";
+    fetch = {
+      type = "git";
+      url = "https://github.com/kr/pty";
+      rev = "v1.1.1";
+      sha256 = "0383f0mb9kqjvncqrfpidsf8y6ns5zlrc91c6a74xpyxjwvzl2y6";
+    };
+  }
+  {
+    goPackagePath = "github.com/kr/text";
+    fetch = {
+      type = "git";
+      url = "https://github.com/kr/text";
+      rev = "v0.1.0";
+      sha256 = "1gm5bsl01apvc84bw06hasawyqm4q84vx1pm32wr9jnd7a8vjgj1";
+    };
+  }
+  {
+    goPackagePath = "github.com/lucasb-eyer/go-colorful";
+    fetch = {
+      type = "git";
+      url = "https://github.com/lucasb-eyer/go-colorful";
+      rev = "v1.0.3";
+      sha256 = "12bgz6dxbb2ki1g3x7fg9ipsjgfkd58fp7cdpv63h4kvlj2n7j69";
+    };
+  }
+  {
+    goPackagePath = "github.com/mattn/go-isatty";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mattn/go-isatty";
+      rev = "v0.0.11";
+      sha256 = "0h671sv7hfprja495kavazkalkx7xzaqksjh13brcnwq67ijrali";
+    };
+  }
+  {
+    goPackagePath = "github.com/mattn/go-runewidth";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mattn/go-runewidth";
+      rev = "v0.0.7";
+      sha256 = "1snr8mk63vz2h44knq26dm81p83887v7kb09iywqmx0nqzngih66";
+    };
+  }
+  {
+    goPackagePath = "github.com/mitchellh/go-homedir";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mitchellh/go-homedir";
+      rev = "v1.1.0";
+      sha256 = "0ydzkipf28hwj2bfxqmwlww47khyk6d152xax4bnyh60f4lq3nx1";
+    };
+  }
+  {
+    goPackagePath = "github.com/pmezard/go-difflib";
+    fetch = {
+      type = "git";
+      url = "https://github.com/pmezard/go-difflib";
+      rev = "v1.0.0";
+      sha256 = "0c1cn55m4rypmscgf0rrb88pn58j3ysvc2d0432dp3c6fqg6cnzw";
+    };
+  }
+  {
+    goPackagePath = "github.com/robertkrimen/otto";
+    fetch = {
+      type = "git";
+      url = "https://github.com/robertkrimen/otto";
+      rev = "c382bd3c16ff";
+      sha256 = "043y6l647snsz71mdy84s2d3kn22aj6rbqd6c1vd8absvamqhlxa";
+    };
+  }
+  {
+    goPackagePath = "github.com/sergi/go-diff";
+    fetch = {
+      type = "git";
+      url = "https://github.com/sergi/go-diff";
+      rev = "v1.1.0";
+      sha256 = "0ir8ali2vx0j7pipmlfd6k8c973akyy2nmbjrf008fm800zcp7z2";
+    };
+  }
+  {
+    goPackagePath = "github.com/stretchr/objx";
+    fetch = {
+      type = "git";
+      url = "https://github.com/stretchr/objx";
+      rev = "v0.1.0";
+      sha256 = "19ynspzjdynbi85xw06mh8ad5j0qa1vryvxjgvbnyrr8rbm4vd8w";
+    };
+  }
+  {
+    goPackagePath = "github.com/stretchr/testify";
+    fetch = {
+      type = "git";
+      url = "https://github.com/stretchr/testify";
+      rev = "v1.4.0";
+      sha256 = "187i5g88sxfy4vxpm7dw1gwv29pa2qaq475lxrdh5livh69wqfjb";
+    };
+  }
+  {
+    goPackagePath = "github.com/yuin/gopher-lua";
+    fetch = {
+      type = "git";
+      url = "https://github.com/yuin/gopher-lua";
+      rev = "ab39c6098bdb";
+      sha256 = "13b0rrpv3988qw8rq6z7npajn1my059ybhafi5mxff9jw09k9sja";
+    };
+  }
+  {
+    goPackagePath = "github.com/zyedidia/clipboard";
+    fetch = {
+      type = "git";
+      url = "https://github.com/zyedidia/clipboard";
+      rev = "241f98e9b197";
+      sha256 = "1glc8w30sijpbppcvaf3503rmx5nxqkcgw87dr2pr3q3vv1bg3zi";
+    };
+  }
+  {
+    goPackagePath = "github.com/zyedidia/glob";
+    fetch = {
+      type = "git";
+      url = "https://github.com/zyedidia/glob";
+      rev = "dd4023a66dc3";
+      sha256 = "1vqw4xbqq6j8p5m7mwxvb448w69vjvgzx0ndsfzdh2cxfirwp3y7";
+    };
+  }
+  {
+    goPackagePath = "github.com/zyedidia/highlight";
+    fetch = {
+      type = "git";
+      url = "https://github.com/zyedidia/highlight";
+      rev = "201131ce5cf5";
+      sha256 = "0blaynf32swmqddx2hcrifrfssj9c04kwnbdy42h3kzxihrwz4ps";
+    };
+  }
+  {
+    goPackagePath = "github.com/zyedidia/json5";
+    fetch = {
+      type = "git";
+      url = "https://github.com/zyedidia/json5";
+      rev = "2da050b1a98d";
+      sha256 = "1sgydazf3npr788b4w17ydmlh3fd1zmpriv9b69967ww90ckh2kz";
+    };
+  }
+  {
+    goPackagePath = "github.com/zyedidia/poller";
+    fetch = {
+      type = "git";
+      url = "https://github.com/zyedidia/poller";
+      rev = "v1.0.1";
+      sha256 = "10cjrqfk1j0l55bdbpm7kv4mqc665pngc8avai0p9chq03y2654g";
+    };
+  }
+  {
+    goPackagePath = "github.com/zyedidia/pty";
+    fetch = {
+      type = "git";
+      url = "https://github.com/zyedidia/pty";
+      rev = "v2.0.0";
+      sha256 = "1n946ld8y2v2wfbwsxv8rfaicxbw3w8pk11ryc8iybmw7hkmmf79";
+    };
+  }
+  {
+    goPackagePath = "github.com/zyedidia/tcell";
+    fetch = {
+      type = "git";
+      url = "https://github.com/zyedidia/tcell";
+      rev = "v1.4.4";
+      sha256 = "0d62a9csab15b64y09jcbvq71065wliw4bd5m7lfpl5k8rmrrdyi";
+    };
+  }
+  {
+    goPackagePath = "github.com/zyedidia/terminal";
+    fetch = {
+      type = "git";
+      url = "https://github.com/zyedidia/terminal";
+      rev = "533c623e2415";
+      sha256 = "16l628f3zgl5yp9z5zkfy2hyl2sckw4d6mg3iqv2jjvh4i8yhrsm";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/sys";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/sys";
+      rev = "33540a1f6037";
+      sha256 = "0fjcv0vzvi6za0b4xmnk3932pr9f9gczzf03y0kgq3ry9rqg169y";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/text";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/text";
+      rev = "v0.3.2";
+      sha256 = "0flv9idw0jm5nm8lx25xqanbkqgfiym6619w575p7nrdh0riqwqh";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/tools";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/tools";
+      rev = "90fa682c2a6e";
+      sha256 = "03ic2xsy51jw9749wl7gszdbz99iijbd2bckgygl6cm9w5m364ak";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/check.v1";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/check.v1";
+      rev = "41f04d3bba15";
+      sha256 = "0vfk9czmlxmp6wndq8k17rhnjxal764mxfhrccza7nwlia760pjy";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/sourcemap.v1";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/sourcemap.v1";
+      rev = "v1.0.5";
+      sha256 = "08rf2dl13hbnm3fq2cm0nnsspy9fhf922ln23cz5463cv7h62as4";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/yaml.v2";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/yaml.v2";
+      rev = "v2.2.7";
+      sha256 = "0k5xcwkd3wmcx54isk7ck9cwp8fapfhyqdz3f13kxp77cxqizazj";
+    };
+  }
+  {
+    goPackagePath = "layeh.com/gopher-luar";
+    fetch = {
+      type = "git";
+      url = "https://github.com/layeh/gopher-luar";
+      rev = "v1.0.7";
+      sha256 = "1rdbni3q7zajmiy62ccvbfgqjzppk5212wpwks2ba726hvyf85mj";
+    };
+  }
+]
diff --git a/pkgs/applications/editors/vscode/vscodium.nix b/pkgs/applications/editors/vscode/vscodium.nix
index edc63b1c2f852..63e6cc920bf34 100644
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@@ -54,7 +54,7 @@ in
       homepage = "https://github.com/VSCodium/vscodium";
       downloadPage = "https://github.com/VSCodium/vscodium/releases";
       license = licenses.mit;
-      maintainers = with maintainers; [ synthetica ];
+      maintainers = with maintainers; [ synthetica turion ];
       platforms = [ "x86_64-linux" "x86_64-darwin" ];
     };
   }
diff --git a/pkgs/applications/graphics/gnome-photos/default.nix b/pkgs/applications/graphics/gnome-photos/default.nix
index 3d0397528bce6..46be8d145320c 100644
--- a/pkgs/applications/graphics/gnome-photos/default.nix
+++ b/pkgs/applications/graphics/gnome-photos/default.nix
@@ -119,7 +119,7 @@ stdenv.mkDerivation rec {
     description = "Access, organize and share your photos";
     homepage = "https://wiki.gnome.org/Apps/Photos";
     license = licenses.gpl3Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/kde/konsole.nix b/pkgs/applications/kde/konsole.nix
index 1be5b0b4a8945..ed26dc08bb6c3 100644
--- a/pkgs/applications/kde/konsole.nix
+++ b/pkgs/applications/kde/konsole.nix
@@ -11,7 +11,7 @@ mkDerivation {
   name = "konsole";
   meta = {
     license = with lib.licenses; [ gpl2 lgpl21 fdl12 ];
-    maintainers = [ lib.maintainers.ttuegel ];
+    maintainers = with lib.maintainers; [ ttuegel turion ];
   };
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [
diff --git a/pkgs/applications/kde/okular.nix b/pkgs/applications/kde/okular.nix
index c399335c4a876..f07df73a25564 100644
--- a/pkgs/applications/kde/okular.nix
+++ b/pkgs/applications/kde/okular.nix
@@ -21,7 +21,7 @@ mkDerivation {
   meta = with lib; {
     homepage = "http://www.kde.org";
     license = with licenses; [ gpl2 lgpl21 fdl12 bsd3 ];
-    maintainers = with maintainers; [ ttuegel ];
+    maintainers = with maintainers; [ ttuegel turion ];
     platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/applications/misc/alacritty/default.nix b/pkgs/applications/misc/alacritty/default.nix
index b6248b8f6f131..c5d7b19618fde 100644
--- a/pkgs/applications/misc/alacritty/default.nix
+++ b/pkgs/applications/misc/alacritty/default.nix
@@ -104,6 +104,12 @@ rustPlatform.buildRustPackage rec {
     '' else ''
       install -D extra/linux/Alacritty.desktop -t $out/share/applications/
       install -D extra/logo/alacritty-term.svg $out/share/icons/hicolor/scalable/apps/Alacritty.svg
+
+      # patchelf generates an ELF that binutils' "strip" doesn't like:
+      #    strip: not enough room for program headers, try linking with -N
+      # As a workaround, strip manually before running patchelf.
+      strip -S $out/bin/alacritty
+
       patchelf --set-rpath "${lib.makeLibraryPath rpathLibs}" $out/bin/alacritty
     ''
   ) + ''
diff --git a/pkgs/applications/misc/almanah/default.nix b/pkgs/applications/misc/almanah/default.nix
index 8b7234239a713..f554d36a0c6ac 100644
--- a/pkgs/applications/misc/almanah/default.nix
+++ b/pkgs/applications/misc/almanah/default.nix
@@ -67,6 +67,6 @@ stdenv.mkDerivation rec {
     homepage = "https://wiki.gnome.org/Apps/Almanah_Diary";
     license = licenses.gpl3Plus;
     platforms = platforms.unix;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
   };
 }
diff --git a/pkgs/applications/misc/glom/default.nix b/pkgs/applications/misc/glom/default.nix
index 1f70111c92efd..d576d2b5b4760 100644
--- a/pkgs/applications/misc/glom/default.nix
+++ b/pkgs/applications/misc/glom/default.nix
@@ -28,7 +28,6 @@
 , isocodes
 , gtksourceviewmm4
 , postgresql
-, gnome3
 , gobject-introspection
 , yelp-tools
 , wrapGAppsHook
@@ -127,7 +126,7 @@ in stdenv.mkDerivation rec {
     description = "An easy-to-use database designer and user interface";
     homepage = "http://www.glom.org/";
     license = [ licenses.lgpl2 licenses.gpl2 ];
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/misc/gnome-firmware-updater/default.nix b/pkgs/applications/misc/gnome-firmware-updater/default.nix
index f05c5fd210c4f..f007f0ae52e16 100644
--- a/pkgs/applications/misc/gnome-firmware-updater/default.nix
+++ b/pkgs/applications/misc/gnome-firmware-updater/default.nix
@@ -6,7 +6,6 @@
 , fwupd
 , gettext
 , glib
-, gnome3
 , gtk3
 , libsoup
 , libxmlb
@@ -70,7 +69,7 @@ stdenv.mkDerivation rec {
     homepage = "https://gitlab.gnome.org/hughsie/gnome-firmware-updater";
     description = "Tool for installing firmware on devices";
     license = licenses.gpl2Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/misc/gnome-multi-writer/default.nix b/pkgs/applications/misc/gnome-multi-writer/default.nix
index 7975ee1f299f1..06bc0024995d8 100644
--- a/pkgs/applications/misc/gnome-multi-writer/default.nix
+++ b/pkgs/applications/misc/gnome-multi-writer/default.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
     description = "Tool for writing an ISO file to multiple USB devices at once";
     homepage = "https://wiki.gnome.org/Apps/MultiWriter";
     license = licenses.gpl2Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/misc/gnome-recipes/default.nix b/pkgs/applications/misc/gnome-recipes/default.nix
index da39a440f3352..cb9d10377cb8d 100644
--- a/pkgs/applications/misc/gnome-recipes/default.nix
+++ b/pkgs/applications/misc/gnome-recipes/default.nix
@@ -72,7 +72,7 @@ in stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     description = "Recipe management application for GNOME";
     homepage = "https://wiki.gnome.org/Apps/Recipes";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl3;
     platforms = platforms.unix;
   };
diff --git a/pkgs/applications/misc/gnome-usage/default.nix b/pkgs/applications/misc/gnome-usage/default.nix
index 7484998ab2053..17aa7e9aa060d 100644
--- a/pkgs/applications/misc/gnome-usage/default.nix
+++ b/pkgs/applications/misc/gnome-usage/default.nix
@@ -60,6 +60,6 @@ stdenv.mkDerivation rec {
     description = "A nice way to view information about use of system resources, like memory and disk space";
     license = licenses.gpl3;
     platforms = platforms.linux;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
   };
 }
diff --git a/pkgs/applications/misc/joplin-desktop/default.nix b/pkgs/applications/misc/joplin-desktop/default.nix
index 8c066ddf0b824..5787836487b4a 100644
--- a/pkgs/applications/misc/joplin-desktop/default.nix
+++ b/pkgs/applications/misc/joplin-desktop/default.nix
@@ -2,7 +2,7 @@
 
 let
   pname = "joplin-desktop";
-  version = "1.0.179";
+  version = "1.0.200";
   desktopItem = makeDesktopItem {
      name = "Joplin";
      exec = "joplin-desktop";
@@ -13,7 +13,7 @@ in appimageTools.wrapType2 rec {
   name = "${pname}-${version}";
   src = fetchurl {
     url = "https://github.com/laurent22/joplin/releases/download/v${version}/Joplin-${version}.AppImage";
-    sha256 = "0v7d5wzwiznl755pl6jfg33g6jxr1cbm9j13jpbmfi497hj8w82k";
+    sha256 = "14gwv8i6dprvl96mifadq0zj77a82rww8xd5bmzm8ql6sidi2216";
   };
 
 
@@ -40,9 +40,9 @@ in appimageTools.wrapType2 rec {
       applications directly or from your own text editor. The notes are in
       Markdown format.
     '';
-    homepage = "https://joplin.cozic.net/";
+    homepage = "https://joplinapp.org";
     license = licenses.mit;
-    maintainers = with maintainers; [ rafaelgg raquelgb ];
+    maintainers = with maintainers; [ hugoreeves rafaelgg raquelgb ];
     platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/applications/misc/keepassx/community.nix b/pkgs/applications/misc/keepassx/community.nix
index 0ed1cd27be059..469b4cf5ea6d7 100644
--- a/pkgs/applications/misc/keepassx/community.nix
+++ b/pkgs/applications/misc/keepassx/community.nix
@@ -1,4 +1,10 @@
-{ stdenv, fetchFromGitHub, cmake, makeWrapper, qttools, darwin
+{ stdenv
+, fetchFromGitHub
+, fetchpatch
+, cmake
+, makeWrapper
+, qttools
+, darwin
 
 , curl
 , glibcLocales
@@ -33,13 +39,13 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "keepassxc";
-  version = "2.5.2";
+  version = "2.5.4";
 
   src = fetchFromGitHub {
     owner = "keepassxreboot";
     repo = "keepassxc";
     rev = version;
-    sha256 = "0z5bd17qaq7zpv96gw6qwv6rb4xx7xjq86ss6wm5zskcrraf7r7n";
+    sha256 = "1xih9q1pxszalc0l29fmjxwn1vrrrrbnhc8gmi8brw5sclhbs6bh";
   };
 
   NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang [
@@ -57,6 +63,11 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./darwin.patch
+    # use wl-copy on Wayland - can be dropped with the next version update
+    (fetchpatch {
+      url = "https://github.com/keepassxreboot/keepassxc/commit/6128e5d58294f26411160f44da91087ebe7f4b07.patch";
+      sha256 = "16q0h7kijqjdbskmk4ar6p3g8vcxr0bq1zrlq2bk16pk10nv4bh1";
+    })
   ];
 
   cmakeFlags = [
@@ -79,7 +90,8 @@ stdenv.mkDerivation rec {
     export LC_ALL="en_US.UTF-8"
     export QT_QPA_PLATFORM=offscreen
     export QT_PLUGIN_PATH="${qtbase.bin}/${qtbase.qtPluginPrefix}"
-    make test ARGS+="-E testgui --output-on-failure"
+    # testcli and testgui are flaky - skip them both
+    make test ARGS+="-E 'testcli|testgui' --output-on-failure"
   '';
 
   nativeBuildInputs = [ cmake wrapQtAppsHook qttools ];
@@ -116,7 +128,7 @@ stdenv.mkDerivation rec {
     longDescription = "A community fork of KeePassX, which is itself a port of KeePass Password Safe. The goal is to extend and improve KeePassX with new features and bugfixes to provide a feature-rich, fully cross-platform and modern open-source password manager. Accessible via native cross-platform GUI, CLI, and browser integration with the KeePassXC Browser Extension (https://github.com/keepassxreboot/keepassxc-browser).";
     homepage = "https://keepassxc.org/";
     license = licenses.gpl2;
-    maintainers = with maintainers; [ jonafato ];
+    maintainers = with maintainers; [ jonafato turion ];
     platforms = platforms.linux ++ platforms.darwin;
   };
 }
diff --git a/pkgs/applications/misc/keepassx/darwin.patch b/pkgs/applications/misc/keepassx/darwin.patch
index 6232d1118a7b9..95ca5d4587fea 100644
--- a/pkgs/applications/misc/keepassx/darwin.patch
+++ b/pkgs/applications/misc/keepassx/darwin.patch
@@ -6,10 +6,10 @@ index 74b1a7ff..0a713a32 100644
      set(PLUGIN_INSTALL_DIR ".")
      set(DATA_INSTALL_DIR "share")
  elseif(APPLE AND WITH_APP_BUNDLE)
-+	set(CMAKE_INSTALL_PREFIX "${CMAKE_INSTALL_PREFIX}/Applications")
++    set(CMAKE_INSTALL_PREFIX "${CMAKE_INSTALL_PREFIX}/Applications")
+     set(BUNDLE_INSTALL_DIR "${PROGNAME}.app/Contents")
      set(CMAKE_INSTALL_MANDIR "${PROGNAME}.app/Contents/Resources/man")
      set(CLI_INSTALL_DIR "${PROGNAME}.app/Contents/MacOS")
-     set(PROXY_INSTALL_DIR "${PROGNAME}.app/Contents/MacOS")
 @@ -369,12 +370,6 @@ set(CMAKE_AUTORCC ON)
  
  if(APPLE)
diff --git a/pkgs/applications/misc/krusader/default.nix b/pkgs/applications/misc/krusader/default.nix
index 4ae8a99b35a68..ab13c4989d9a9 100644
--- a/pkgs/applications/misc/krusader/default.nix
+++ b/pkgs/applications/misc/krusader/default.nix
@@ -20,7 +20,7 @@ in mkDerivation rec {
     description = "Norton/Total Commander clone for KDE";
     license = licenses.gpl2;
     homepage = "http://www.krusader.org";
-    maintainers = with maintainers; [ sander ];
+    maintainers = with maintainers; [ sander turion ];
   };
 
   nativeBuildInputs = [ extra-cmake-modules kdoctools wrapGAppsHook ];
diff --git a/pkgs/applications/misc/lutris/chrootenv.nix b/pkgs/applications/misc/lutris/chrootenv.nix
index 6f8d690779be5..2861991cc41c4 100644
--- a/pkgs/applications/misc/lutris/chrootenv.nix
+++ b/pkgs/applications/misc/lutris/chrootenv.nix
@@ -94,7 +94,7 @@ in buildFHSUserEnv {
     libsndfile libtheora libogg libvorbis libopus libGLU libpcap libpulseaudio
     libao libusb libevdev udev libgcrypt libxml2 libusb libpng libmpeg2 libv4l
     libjpeg libxkbcommon libass libcdio libjack2 libsamplerate libzip libmad libaio
-    libcap libtiff libva libgphoto2 libxslt libtxc_dxtn libsndfile giflib zlib glib
+    libcap libtiff libva libgphoto2 libxslt libsndfile giflib zlib glib
     alsaLib zziplib bash dbus keyutils zip cabextract freetype unzip coreutils
     readline gcc SDL SDL2 curl graphite2 gtk2 gtk3 udev ncurses wayland libglvnd
     vulkan-loader xdg_utils sqlite gnutls libbsd
diff --git a/pkgs/applications/misc/orca/default.nix b/pkgs/applications/misc/orca/default.nix
index c19e71e10ddbf..c9fc0ff30fc0d 100644
--- a/pkgs/applications/misc/orca/default.nix
+++ b/pkgs/applications/misc/orca/default.nix
@@ -110,7 +110,7 @@ buildPythonApplication rec {
 
       Needs `services.gnome3.at-spi2-core.enable = true;` in `configuration.nix`.
     '';
-    maintainers = with maintainers; [ berce ] ++ gnome3.maintainers;
+    maintainers = with maintainers; [ berce ] ++ teams.gnome.members;
     license = licenses.lgpl21;
     platforms = platforms.linux;
   };
diff --git a/pkgs/applications/misc/termpdf.py/default.nix b/pkgs/applications/misc/termpdf.py/default.nix
index 83eef6f24e431..5988f569109b0 100644
--- a/pkgs/applications/misc/termpdf.py/default.nix
+++ b/pkgs/applications/misc/termpdf.py/default.nix
@@ -44,7 +44,7 @@ buildPythonApplication {
       A graphical pdf (and epub, cbz, ...) reader that works
       inside the kitty terminal.
     '';
-    homepage = https://github.com/dsanson/termpdf.py;
+    homepage = "https://github.com/dsanson/termpdf.py";
     maintainers = with maintainers; [ teto ];
     license = licenses.mit;
   };
diff --git a/pkgs/applications/networking/browsers/brave/default.nix b/pkgs/applications/networking/browsers/brave/default.nix
index bab24d014567f..151ce5edc3557 100644
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@@ -82,11 +82,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "brave";
-  version = "1.5.123";
+  version = "1.7.92";
 
   src = fetchurl {
     url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    sha256 = "1yv6hfjqzcd60b0bjpfbj8d4s2yf10swanxhbmnslcqp6ajb2nqr";
+    sha256 = "1f262xh88c83m6ixqxc69z8kvkl3qbjc6jnv2g8n0flw8s70hs7z";
   };
 
   dontConfigure = true;
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 585a5f49df376..fdb8584f08e8b 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -24,8 +24,13 @@
 , libdrm ? null, wayland ? null, mesa_drivers ? null, libxkbcommon ? null # useOzone
 
 # package customization
-, useVaapi ? false
 , useOzone ? false
+, useVaapi ? !(useOzone || stdenv.isAarch64) # Built if supported, but disabled in the wrapper
+# VA-API TODOs:
+# - Ozone: M81 fails to build due to "ozone_platform_gbm = false"
+#   - Possible solutions: Write a patch to fix the build (wrong gn dependencies)
+#     or build with minigbm
+# - AArch64: Causes serious regressions (https://github.com/NixOS/nixpkgs/pull/85253#issuecomment-614405879)
 , gnomeSupport ? false, gnome ? null
 , gnomeKeyringSupport ? false, libgnome-keyring3 ? null
 , proprietaryCodecs ? true
@@ -127,10 +132,10 @@ let
       libXScrnSaver libXcursor libXtst libGLU libGL
       pciutils protobuf speechd libXdamage at-spi2-core
       jre
-    ] ++ optional gnomeKeyringSupport libgnome-keyring3
+    ] ++ optional useVaapi libva
+      ++ optional gnomeKeyringSupport libgnome-keyring3
       ++ optionals gnomeSupport [ gnome.GConf libgcrypt ]
       ++ optionals cupsSupport [ libgcrypt cups ]
-      ++ optional useVaapi libva
       ++ optional pulseSupport libpulseaudio
       ++ optionals useOzone [ libdrm wayland mesa_drivers libxkbcommon ];
 
@@ -149,9 +154,9 @@ let
       #
       # ++ optionals (channel == "dev") [ ( githubPatch "<patch>" "0000000000000000000000000000000000000000000000000000000000000000" ) ]
       # ++ optional (versionRange "68" "72") ( githubPatch "<patch>" "0000000000000000000000000000000000000000000000000000000000000000" )
-    ] ++ optionals (useVaapi) ([
-      # source: https://aur.archlinux.org/cgit/aur.git/tree/vaapi-fix.patch?h=chromium-vaapi
-      ./patches/vaapi-fix.patch
+    ] ++ optionals (useVaapi) ([ # Fixes for the VA-API build:
+      ./patches/enable-vdpau-support-for-nvidia.patch # https://aur.archlinux.org/cgit/aur.git/tree/vdpau-support.patch?h=chromium-vaapi
+      ./patches/enable-video-acceleration-on-linux.patch # Can be controlled at runtime (i.e. without rebuilding Chromium)
     ] ++ optionals (versionRange "81" "82") [
       (githubPatch "5b2ff215473e0526b5b24aeff4ad90d369b21c75" "0n00vh8wfpn2ay5fqsxcsx0zadnv7mihm72bcvnrfzh75nzbg902")
       (githubPatch "98e343ab369e4262511b5fce547728e3e5eefba8" "00wwp653jk0k0yvix00vr7ymgck9dj7fxjwx4nc67ynn84dh6064")
diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix
index c66acac12c386..25ef76f331ba4 100644
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@@ -6,13 +6,15 @@
 , lib
 
 # package customization
+# Note: enable* flags should not require full rebuilds (i.e. only affect the wrapper)
 , channel ? "stable"
 , gnomeSupport ? false, gnome ? null
 , gnomeKeyringSupport ? false
 , proprietaryCodecs ? true
 , enablePepperFlash ? false
 , enableWideVine ? false
-, useVaapi ? false # test video on radeon, before enabling this
+, useVaapi ? false # Deprecated, use enableVaapi instead!
+, enableVaapi ? false # Disabled by default due to unofficial support and issues on radeon
 , useOzone ? false
 , cupsSupport ? true
 , pulseSupport ? config.pulseaudio or stdenv.isLinux
@@ -33,7 +35,7 @@ let
     upstream-info = (callPackage ./update.nix {}).getChannel channel;
 
     mkChromiumDerivation = callPackage ./common.nix ({
-      inherit gnome gnomeSupport gnomeKeyringSupport proprietaryCodecs cupsSupport pulseSupport useVaapi useOzone;
+      inherit gnome gnomeSupport gnomeKeyringSupport proprietaryCodecs cupsSupport pulseSupport useOzone;
       gnChromium = gn;
     } // lib.optionalAttrs (channel != "stable") {
       # TODO: Remove after we can update gn for the stable channel (backward incompatible changes):
@@ -127,6 +129,14 @@ let
         cp -a ${widevineCdm}/WidevineCdm $out/libexec/chromium/
       ''
     else browser;
+
+  optionalVaapiFlags = if useVaapi # TODO: Remove after 20.09:
+    then throw ''
+      Chromium's useVaapi was replaced by enableVaapi and you don't need to pass
+      "--ignore-gpu-blacklist" anymore (also no rebuilds are required anymore).
+    '' else lib.optionalString
+      (!enableVaapi)
+      "--add-flags --disable-accelerated-video-decode --add-flags --disable-accelerated-video-encode";
 in stdenv.mkDerivation {
   name = "chromium${suffix}-${version}";
   inherit version;
@@ -146,15 +156,14 @@ in stdenv.mkDerivation {
   buildCommand = let
     browserBinary = "${chromiumWV}/libexec/chromium/chromium";
     getWrapperFlags = plugin: "$(< \"${plugin}/nix-support/wrapper-flags\")";
-    libPath = stdenv.lib.makeLibraryPath ([]
-      ++ stdenv.lib.optional useVaapi libva
-    );
+    libPath = stdenv.lib.makeLibraryPath [ libva ];
 
   in with stdenv.lib; ''
     mkdir -p "$out/bin"
 
     eval makeWrapper "${browserBinary}" "$out/bin/chromium" \
       --add-flags ${escapeShellArg (escapeShellArg commandLineArgs)} \
+      ${optionalVaapiFlags} \
       ${concatMapStringsSep " " getWrapperFlags chromium.plugins.enabled}
 
     ed -v -s "$out/bin/chromium" << EOF
diff --git a/pkgs/applications/networking/browsers/chromium/patches/vaapi-fix.patch b/pkgs/applications/networking/browsers/chromium/patches/enable-vdpau-support-for-nvidia.patch
index b5372d1a25565..b5372d1a25565 100644
--- a/pkgs/applications/networking/browsers/chromium/patches/vaapi-fix.patch
+++ b/pkgs/applications/networking/browsers/chromium/patches/enable-vdpau-support-for-nvidia.patch
diff --git a/pkgs/applications/networking/browsers/chromium/patches/enable-video-acceleration-on-linux.patch b/pkgs/applications/networking/browsers/chromium/patches/enable-video-acceleration-on-linux.patch
new file mode 100644
index 0000000000000..bd278633f67e0
--- /dev/null
+++ b/pkgs/applications/networking/browsers/chromium/patches/enable-video-acceleration-on-linux.patch
@@ -0,0 +1,48 @@
+From b2144fd28e09cd52e7a88a62a9d9b54cf9922f9f Mon Sep 17 00:00:00 2001
+From: Michael Weiss <dev.primeos@gmail.com>
+Date: Tue, 14 Apr 2020 14:16:10 +0200
+Subject: [PATCH] Enable accelerated video decode on Linux
+
+This will enable accelerated video decode on Linux by default (i.e.
+without "--ignore-gpu-blacklist"), but on NixOS we'll provide
+"--disable-accelerated-video-decode" and
+"--disable-accelerated-video-encode" by default to avoid regressions
+(e.g. VA-API doesn't work properly for some radeon drivers).
+
+Video acceleration can then be enabled via:
+chromium.override { enableVaapi = true; }
+without rebuilding Chromium.
+---
+ gpu/config/software_rendering_list.json | 16 ----------------
+ 1 file changed, 16 deletions(-)
+
+diff --git a/gpu/config/software_rendering_list.json b/gpu/config/software_rendering_list.json
+index 22712bdbf38f..a06dd19a50e4 100644
+--- a/gpu/config/software_rendering_list.json
++++ b/gpu/config/software_rendering_list.json
+@@ -336,22 +336,6 @@
+       ]
+     },
+     {
+-      "id": 48,
+-      "description": "Accelerated video decode is unavailable on Linux",
+-      "cr_bugs": [137247, 1032907],
+-      "os": {
+-        "type": "linux"
+-      },
+-      "exceptions": [
+-        {
+-          "machine_model_name": ["Chromecast"]
+-        }
+-      ],
+-      "features": [
+-        "accelerated_video_decode"
+-      ]
+-    },
+-    {
+       "id": 50,
+       "description": "Disable VMware software renderer on older Mesa",
+       "cr_bugs": [145531, 332596, 571899, 629434],
+-- 
+2.11.0
+
diff --git a/pkgs/applications/networking/browsers/chromium/plugins.nix b/pkgs/applications/networking/browsers/chromium/plugins.nix
index 434bd77b6d185..1dd9baa628ab5 100644
--- a/pkgs/applications/networking/browsers/chromium/plugins.nix
+++ b/pkgs/applications/networking/browsers/chromium/plugins.nix
@@ -45,11 +45,11 @@ let
 
   flash = stdenv.mkDerivation rec {
     pname = "flashplayer-ppapi";
-    version = "32.0.0.344";
+    version = "32.0.0.363";
 
     src = fetchzip {
       url = "https://fpdownload.adobe.com/pub/flashplayer/pdc/${version}/flash_player_ppapi_linux.x86_64.tar.gz";
-      sha256 = "05ijlgsby9zxx0qs6f3vav1z0p6xr1cg6idl4akxvfmsl6hn6hkq";
+      sha256 = "0znk8an892mykgbz56hyv3gz65vc9mhb3vn96c6bsvicwl1fn460";
       stripRoot = false;
     };
 
diff --git a/pkgs/applications/networking/browsers/firefox/wrapper.nix b/pkgs/applications/networking/browsers/firefox/wrapper.nix
index 73d2303bfc187..0afa8ca7b8345 100644
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@@ -46,7 +46,6 @@ let
             "icedtea"
             "enableGoogleTalkPlugin"
             "enableFriBIDPlugin"
-            "enableGnomeExtensions"
             "enableBluejeans"
             "enableAdobeReader"
           ];
diff --git a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
index 0cf73512fcb13..6672a75d574d7 100644
--- a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
@@ -74,7 +74,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "flashplayer";
-  version = "32.0.0.344";
+  version = "32.0.0.363";
 
   src = fetchurl {
     url =
@@ -85,14 +85,14 @@ stdenv.mkDerivation rec {
     sha256 =
       if debug then
         if arch == "x86_64" then
-          "1kkwijxlcs1rlqxr1vj51h95fwwrp5m0c9lngqpncgmmhh8v9dyr"
+          "06711k4vbn6mqfd8gvx2snsxyalhw15hn5b64sja8726z5rxvzy7"
         else
-          "0r47s19fw7gsph73rd5jb2zfsjwz7mjawm6c49rir9rsa0zxrsks"
+          "0v584aqhy4xk08afi3ypkq4mqjq57y136z82i5ixyim88dqbaf4f"
       else
         if arch == "x86_64" then
-          "1ki3i7zw0q48xf01xjfm1mpizc5flk768p9hqxpg881r4h65dh6b"
+          "1g1ijxypm8a8mfc1x58gksmaakqpp7xmf277wiir8zqjn3vd6c64"
         else
-          "1v527i60sljwyvv4l1kg9ml05skjgm3naynlswd35hsz258jnxl4";
+          "13nbxmqmbxqvdhdwdqimim2f9fz3y2vrsx6b3pck6352m4i4wzh8";
   };
 
   nativeBuildInputs = [ unzip ];
diff --git a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
index 64dd87c4ace2e..3661f6edb530f 100644
--- a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
@@ -50,7 +50,7 @@
 
 stdenv.mkDerivation {
   pname = "flashplayer-standalone";
-  version = "32.0.0.344";
+  version = "32.0.0.363";
 
   src = fetchurl {
     url =
@@ -60,9 +60,9 @@ stdenv.mkDerivation {
         "https://fpdownload.macromedia.com/pub/flashplayer/updaters/32/flash_player_sa_linux.x86_64.tar.gz";
     sha256 =
       if debug then
-        "1ymsk07xmnanyv86r58ar1l4wgjarlq0fc111ajc76pp8dsxnfx8"
+        "03zhza8lvc1nvz3racwfsajfd6rnbw3g56dp5wvr1qmaps8xaaqg"
       else
-        "0wiwpn4a0jxslw4ahalq74rksn82y0aqa3lrjr9qs7kdcak74vky";
+        "0bhp7jv2l2agfzr8m564k749a5g75dw1390phlwvf49n1h8ldap2";
   };
 
   nativeBuildInputs = [ unzip ];
diff --git a/pkgs/applications/networking/cluster/terraform/default.nix b/pkgs/applications/networking/cluster/terraform/default.nix
index b9c82f97c4fd7..ee27422a1391c 100644
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, buildEnv, buildGoPackage, fetchFromGitHub, makeWrapper
+{ stdenv, lib, buildEnv, buildGoPackage, fetchFromGitHub, makeWrapper, coreutils
 , runCommand, writeText, terraform-providers }:
 
 let
@@ -18,6 +18,12 @@ let
         inherit sha256;
       };
 
+      postPatch = ''
+        # speakeasy hardcodes /bin/stty https://github.com/bgentry/speakeasy/issues/22
+        substituteInPlace vendor/github.com/bgentry/speakeasy/speakeasy_unix.go \
+          --replace "/bin/stty" "${coreutils}/bin/stty"
+      '';
+
       postInstall = ''
         # remove all plugins, they are part of the main binary now
         for i in $bin/bin/*; do
diff --git a/pkgs/applications/networking/ids/zeek/default.nix b/pkgs/applications/networking/ids/zeek/default.nix
index 6faacf2e67e69..8fe856f9773f7 100644
--- a/pkgs/applications/networking/ids/zeek/default.nix
+++ b/pkgs/applications/networking/ids/zeek/default.nix
@@ -5,11 +5,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "zeek";
-  version = "3.1.1";
+  version = "3.1.2";
 
   src = fetchurl {
-    url = "https://old.zeek.org/downloads/zeek-${version}.tar.gz";
-    sha256 = "0siybzdp8w62jqk5vdi5fxwvj6cn4r6c2d4z2axd4rj5vhv5zvx2";
+    url = "https://download.zeek.org/zeek-${version}.tar.gz";
+    sha256 = "18aa4pfwav8m6vq7cr4bhfg243da54ak933rqbriljnhsrgp4n0q";
   };
 
   nativeBuildInputs = [ cmake flex bison file ];
diff --git a/pkgs/applications/networking/gmailieer/default.nix b/pkgs/applications/networking/lieer/default.nix
index 2acc838e4a4f0..fc5214f0d01fd 100644
--- a/pkgs/applications/networking/gmailieer/default.nix
+++ b/pkgs/applications/networking/lieer/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, python3Packages }:
 
 python3Packages.buildPythonApplication rec {
-  name = "gmailieer-${version}";
-  version = "1.0";
+  pname = "lieer";
+  version = "1.1";
 
   src = fetchFromGitHub {
     owner = "gauteh";
-    repo = "gmailieer";
+    repo = "lieer";
     rev = "v${version}";
-    sha256 = "1zzylv8xbcrh34bz0s29dawzcyx39lai8y8wk0bl4x75v1jfynvf";
+    sha256 = "19jx3sm925nrzl26km1bxbp6y5gk1mzwadd79vip2jl70b3xk9f8";
   };
 
   propagatedBuildInputs = with python3Packages; [
@@ -27,8 +27,8 @@ python3Packages.buildPythonApplication rec {
       tags in the notmuch database may be pushed back remotely to your
       GMail account.
     '';
-    homepage         = "https://github.com/gauteh/gmailieer";
-    repositories.git = "https://github.com/gauteh/gmailieer.git";
+    homepage         = "https://lieer.gaute.vetsj.com/";
+    repositories.git = "https://github.com/gauteh/lieer.git";
     license          = licenses.gpl3Plus;
     maintainers      = with maintainers; [ kaiha ];
   };
diff --git a/pkgs/applications/networking/maestral/default.nix b/pkgs/applications/networking/maestral/default.nix
index 49348610be572..62be1a4118c0a 100644
--- a/pkgs/applications/networking/maestral/default.nix
+++ b/pkgs/applications/networking/maestral/default.nix
@@ -8,7 +8,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "maestral${lib.optionalString withGui "-gui"}";
-  version = "0.6.1";
+  version = "0.6.3";
 
   disabled = python3.pkgs.pythonOlder "3.6";
 
@@ -16,7 +16,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "SamSchott";
     repo = "maestral-dropbox";
     rev = "v${version}";
-    sha256 = "06i3c7i85x879np158156mba7kxz2cwh75390sc9gwwngc95d9h9";
+    sha256 = "0h1vbx00mps2msdhsab1yz64c8sprwrg38nkqyj86mkb6jkirq92";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
@@ -27,6 +27,7 @@ python3.pkgs.buildPythonApplication rec {
     keyring
     keyrings-alt
     lockfile
+    pathspec
     Pyro5
     requests
     u-msgpack-python
diff --git a/pkgs/applications/office/elementary-planner/0001-Revert-Add-patch.patch b/pkgs/applications/office/elementary-planner/0001-Revert-Add-patch.patch
new file mode 100644
index 0000000000000..ede3bc7a6ad31
--- /dev/null
+++ b/pkgs/applications/office/elementary-planner/0001-Revert-Add-patch.patch
@@ -0,0 +1,84 @@
+From a6d8bd67416c848f9bf52f4746bda34216ae9993 Mon Sep 17 00:00:00 2001
+From: worldofpeace <worldofpeace@protonmail.ch>
+Date: Sun, 19 Apr 2020 12:48:59 -0400
+Subject: [PATCH] Revert "Add patch"
+
+This reverts commit c44127936b785afda0e914da4c1dc1e66a0ac97b.
+---
+ src/Application.vala | 49 --------------------------------------------
+ 1 file changed, 49 deletions(-)
+
+diff --git a/src/Application.vala b/src/Application.vala
+index 43d52fbc..82a9ebe5 100644
+--- a/src/Application.vala
++++ b/src/Application.vala
+@@ -127,66 +127,17 @@ public class Planner : Gtk.Application {
+ 
+         utils.apply_theme_changed ();
+ 
+-        // Set Theme and Icon
+         Gtk.Settings.get_default ().set_property ("gtk-icon-theme-name", "elementary");
+         Gtk.Settings.get_default ().set_property ("gtk-theme-name", "elementary");
+ 
+-        // Path Theme
+-        var command = new Granite.Services.SimpleCommand (".", "echo $DESKTOP_SESSION");
+-        command.run ();
+-        command.output_changed.connect ((text) => {
+-            print ("DESKTOP_SESSION: %s\n".printf (text));
+-        });
+-
+-        if (get_os_info ("PRETTY_NAME") == null || get_os_info ("PRETTY_NAME").index_of ("elementary") == -1) {
+-            string CSS = """
+-                window decoration {
+-                    box-shadow: none;
+-                    margin: 1px;
+-                }
+-            """;
+-
+-            var _provider = new Gtk.CssProvider ();
+-            _provider.load_from_data (CSS, CSS.length);
+-
+-            Gtk.StyleContext.add_provider_for_screen (
+-                Gdk.Screen.get_default (), _provider,
+-                Gtk.STYLE_PROVIDER_PRIORITY_APPLICATION
+-            );
+-        }
+-
+         // Set shortcut
+         string quick_add_shortcut = settings.get_string ("quick-add-shortcut");
+         if (quick_add_shortcut == "") {
+             quick_add_shortcut = "<Primary>Tab";
+             settings.set_string ("quick-add-shortcut", quick_add_shortcut);
+         }
+-
+         utils.set_quick_add_shortcut (quick_add_shortcut);
+     }
+-    
+-    public string get_os_info (string field) {
+-        string return_value = "";
+-        var file = File.new_for_path ("/etc/os-release");
+-        try {
+-            var osrel = new Gee.HashMap<string, string> ();
+-            var dis = new DataInputStream (file.read ());
+-            string line;
+-            // Read lines until end of file (null) is reached
+-            while ((line = dis.read_line (null)) != null) {
+-                var osrel_component = line.split ("=", 2);
+-                if (osrel_component.length == 2) {
+-                    osrel[osrel_component[0]] = osrel_component[1].replace ("\"", "");
+-                }
+-            }
+-
+-            return_value = osrel[field];
+-        } catch (Error e) {
+-            warning ("Couldn't read os-release file, assuming elementary OS");
+-        }
+-        
+-        return return_value;
+-    }
+ 
+     public override int command_line (ApplicationCommandLine command_line) {
+         bool silence_mode = false;
+-- 
+2.25.1
+
diff --git a/pkgs/applications/office/elementary-planner/default.nix b/pkgs/applications/office/elementary-planner/default.nix
index def44b40e809a..b01c34d5a0edc 100644
--- a/pkgs/applications/office/elementary-planner/default.nix
+++ b/pkgs/applications/office/elementary-planner/default.nix
@@ -15,15 +15,25 @@
 
 stdenv.mkDerivation rec {
   pname = "elementary-planner";
-  version = "2.2.14";
+  version = "2.3.2";
 
   src = fetchFromGitHub {
     owner = "alainm23";
     repo = "planner";
     rev = version;
-    sha256 = "14k5kiknr0d3my17p4v20iiqzifpz3y80gdzj8vdxic8yk2yr1ap";
+    sha256 = "1kjk1zafx71zmax3whzpx6mzl037wlxri30bl2k9y9rg3fd09arr";
   };
 
+  patches = [
+    # Revert a patch the works around some stylesheet issues:
+    # https://github.com/alainm23/planner/issues/268
+    # https://github.com/alainm23/planner/issues/303
+    # The don't seem to be a problem with Pantheon on NixOS
+    # and for some reason produce the opposite effect with
+    # pantheon's stylesheet.
+    ./0001-Revert-Add-patch.patch
+  ];
+
   nativeBuildInputs = [
     desktop-file-utils
     meson
diff --git a/pkgs/applications/office/libreoffice/default.nix b/pkgs/applications/office/libreoffice/default.nix
index 7625ba3bea82c..976fc0fcd2d74 100644
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@@ -62,6 +62,11 @@ in (stdenv.mkDerivation rec {
 
   patches = [
     ./xdg-open-brief.patch
+    (fetchpatch {
+      url = "https://git.pld-linux.org/gitweb.cgi?p=packages/libreoffice.git;a=blob_plain;f=poppler-0.86.patch;h=76b8356d5f22ef537a83b0f9b0debab591f152fe;hb=a2737a61353e305a9ee69640fb20d4582c218008";
+      name = "poppler-0.86.patch";
+      sha256 = "0q6k4l8imgp8ailcv0qx5l83afyw44hah24fi7gjrm9xgv5sbb8j";
+    })
   ];
 
   tarballPath = "external/tarballs";
diff --git a/pkgs/applications/office/libreoffice/src-fresh/download.nix b/pkgs/applications/office/libreoffice/src-fresh/download.nix
index bc329e5a8f89f..f4b14870eb791 100644
--- a/pkgs/applications/office/libreoffice/src-fresh/download.nix
+++ b/pkgs/applications/office/libreoffice/src-fresh/download.nix
@@ -728,11 +728,11 @@
     md5name = "a754c02f7051c2f21e52f8669a421b50485afcde9a581674d6106326b189d126-postgresql-9.2.24.tar.bz2";
   }
   {
-    name = "Python-3.7.6.tar.xz";
-    url = "http://dev-www.libreoffice.org/src/Python-3.7.6.tar.xz";
-    sha256 = "55a2cce72049f0794e9a11a84862e9039af9183603b78bc60d89539f82cf533f";
+    name = "Python-3.7.7.tar.xz";
+    url = "http://dev-www.libreoffice.org/src/Python-3.7.7.tar.xz";
+    sha256 = "06a0a9f1bf0d8cd1e4121194d666c4e28ddae4dd54346de6c343206599f02136";
     md5 = "";
-    md5name = "55a2cce72049f0794e9a11a84862e9039af9183603b78bc60d89539f82cf533f-Python-3.7.6.tar.xz";
+    md5name = "06a0a9f1bf0d8cd1e4121194d666c4e28ddae4dd54346de6c343206599f02136-Python-3.7.7.tar.xz";
   }
   {
     name = "QR-Code-generator-1.4.0.tar.gz";
diff --git a/pkgs/applications/office/libreoffice/src-fresh/primary.nix b/pkgs/applications/office/libreoffice/src-fresh/primary.nix
index fb21d1292d6d5..5b62b0df95449 100644
--- a/pkgs/applications/office/libreoffice/src-fresh/primary.nix
+++ b/pkgs/applications/office/libreoffice/src-fresh/primary.nix
@@ -8,8 +8,8 @@ rec {
 
   major = "6";
   minor = "4";
-  patch = "1";
-  tweak = "1";
+  patch = "3";
+  tweak = "2";
 
   subdir = "${major}.${minor}.${patch}";
 
@@ -17,13 +17,13 @@ rec {
 
   src = fetchurl {
     url = "https://download.documentfoundation.org/libreoffice/src/${subdir}/libreoffice-${version}.tar.xz";
-    sha256 = "03fqpkilz4yi35l447hb9r8gjwj23l61bpdkwg21jm8blm8kkvyj";
+    sha256 = "1cmbrhha7mlflnlbpla8fix07cxcgkdb7krnrgs1bylf31y5855w";
   };
 
   # FIXME rename
   translations = fetchSrc {
     name = "translations";
-    sha256 = "0a7arjlxxy7hjm1brxwd124bf1gkbl92bgygi3sbbhbsv07pjdcr";
+    sha256 = "06z9hz4m3kdcljjc6y5s18001axjibj9xiyakdndkl9pmnnhn9h3";
   };
 
   # the "dictionaries" archive is not used for LO build because we already build hunspellDicts packages from
@@ -31,6 +31,6 @@ rec {
 
   help = fetchSrc {
     name = "help";
-    sha256 = "1hfllrdyxrg5mgqry3dcrhjbdrd0d27k5mvv4sfj7nwjlmjh8rqq";
+    sha256 = "0mpgrwg8z1q38j03l6m1sdpcplyjd5nz1nqaa13vfkryj2lflw45";
   };
 }
diff --git a/pkgs/applications/science/logic/beluga/default.nix b/pkgs/applications/science/logic/beluga/default.nix
index 55cee9b7e17c1..44478a032b38a 100644
--- a/pkgs/applications/science/logic/beluga/default.nix
+++ b/pkgs/applications/science/logic/beluga/default.nix
@@ -1,34 +1,40 @@
-{ stdenv, fetchFromGitHub, ocamlPackages, omake }:
+{ lib, fetchFromGitHub, ocamlPackages, rsync }:
 
-stdenv.mkDerivation {
-  name = "beluga-20180403";
+ocamlPackages.buildDunePackage {
+  pname = "beluga";
+  version = "unstable-2020-03-11";
 
   src = fetchFromGitHub {
     owner  = "Beluga-lang";
     repo   = "Beluga";
-    rev    = "046aa59f008be70a7c4700b723bed0214ea8b687";
-    sha256 = "0m68y0r0wdw3mg2jks68bihaww7sg305zdfnic1rkndq2cxv0mld";
+    rev    = "6133b2f572219333f304bb4f77c177592324c55b";
+    sha256 = "0sy6mi50z3mvs5z7dx38piydapk89all81rh038x3559b5fsk68q";
   };
 
-  nativeBuildInputs = with ocamlPackages; [ findlib ocamlbuild omake ];
-  buildInputs = with ocamlPackages; [ ocaml ulex ocaml_extlib ];
+  useDune2 = true;
 
-  installPhase = ''
-    mkdir -p $out
-    cp -r bin $out/
+  buildInputs = with ocamlPackages; [
+    gen sedlex_2 ocaml_extlib dune-build-info linenoise
+  ];
 
-    mkdir -p $out/share/beluga
-    cp -r tools/ examples/ $out/share/beluga
+  postPatch = ''
+    patchShebangs ./TEST ./run_harpoon_test.sh
+  '';
+
+  checkPhase = "./TEST";
+  checkInputs = [ rsync ];
+  doCheck = true;
 
+  postInstall = ''
     mkdir -p $out/share/emacs/site-lisp/beluga/
     cp -r tools/beluga-mode.el $out/share/emacs/site-lisp/beluga
   '';
 
-  meta = {
+  meta = with lib; {
     description = "A functional language for reasoning about formal systems";
     homepage    = "http://complogic.cs.mcgill.ca/beluga/";
-    license     = stdenv.lib.licenses.gpl3Plus;
-    maintainers = [ stdenv.lib.maintainers.bcdarwin ];
-    platforms   = stdenv.lib.platforms.unix;
+    license     = licenses.gpl3Plus;
+    maintainers = [ maintainers.bcdarwin ];
+    platforms   = platforms.unix;
   };
 }
diff --git a/pkgs/applications/science/logic/lean/default.nix b/pkgs/applications/science/logic/lean/default.nix
index 594f596b5ef75..36df6ae0658f8 100644
--- a/pkgs/applications/science/logic/lean/default.nix
+++ b/pkgs/applications/science/logic/lean/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lean";
-  version = "3.8.0";
+  version = "3.9.0";
 
   src = fetchFromGitHub {
     owner  = "leanprover-community";
     repo   = "lean";
     rev    = "v${version}";
-    sha256 = "0frs2vhxlzdliyydb462c1886dn585zd7yp7hdxzsri2v6gdh89g";
+    sha256 = "0sklw211cmqp4y0c6nycfavpdxdpfwhq9a4sbwdlqd5agyf85h1j";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/version-management/git-and-tools/delta/default.nix b/pkgs/applications/version-management/git-and-tools/delta/default.nix
index dff06d384dc77..7bdeae65899c9 100644
--- a/pkgs/applications/version-management/git-and-tools/delta/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/delta/default.nix
@@ -1,17 +1,20 @@
-{ lib, fetchFromGitHub, rustPlatform }:
+{ lib, fetchFromGitHub, rustPlatform, llvmPackages }:
 
 rustPlatform.buildRustPackage rec {
   pname = "delta";
-  version = "0.0.17";
+  version = "0.0.18";
 
   src = fetchFromGitHub {
     owner = "dandavison";
     repo = pname;
     rev = version;
-    sha256 = "1j01h60snciqp4psyxf67j3gbmi02c1baprsg9frzjacawbx8cz7";
+    sha256 = "0cpd60861k9nd2gbzyb2hg5npnkgvsnyrvv7mlm30vb1833gz94z";
   };
 
-  cargoSha256 = "176bfd57gc9casvk0p10ilvzw3q3rkkv7qflja778vrwr9zrmkzq";
+  LLVM_CONFIG_PATH = "${llvmPackages.llvm}/bin/llvm-config";
+  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
+
+  cargoSha256 = "12gl50q5hf6nq571fqxfv61z4mwfjyw4jb2yqyqbsinwj2frwaxn";
 
   meta = with lib; {
     homepage = "https://github.com/dandavison/delta";
diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index 6169c2d0296b2..ef6ebbe6813b9 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -21,7 +21,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.25.1";
+  version = "2.26.1";
   svn = subversionClient.override { perlBindings = perlSupport; };
 
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
@@ -33,7 +33,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "09lzwa183nblr6l8ib35g2xrjf9wm9yhk3szfvyzkwivdv69c9r2";
+    sha256 = "0s03ix9j1h0yychkh1l1cgpr1l9lwzn3rprl08rk8ii5ix02i0l8";
   };
 
   outputs = [ "out" ];
@@ -189,7 +189,7 @@ stdenv.mkDerivation {
       ln -s $out/libexec/git-core/git-http-backend $out/bin/git-http-backend
     '' + stdenv.lib.optionalString perlSupport ''
       # wrap perl commands
-      makeWrapper "$out/share/git/contrib/credential/netrc/git-credential-netrc" $out/bin/git-credential-netrc \
+      makeWrapper "$out/share/git/contrib/credential/netrc/git-credential-netrc.perl" $out/bin/git-credential-netrc \
                   --set PERL5LIB   "$out/${perlPackages.perl.libPrefix}:${perlPackages.makePerlPath perlLibs}"
       wrapProgram $out/libexec/git-core/git-cvsimport \
                   --set GITPERLLIB "$out/${perlPackages.perl.libPrefix}:${perlPackages.makePerlPath perlLibs}"
diff --git a/pkgs/applications/version-management/redmine/Gemfile b/pkgs/applications/version-management/redmine/Gemfile
index b1c651695c796..beff147c374a0 100644
--- a/pkgs/applications/version-management/redmine/Gemfile
+++ b/pkgs/applications/version-management/redmine/Gemfile
@@ -1,8 +1,10 @@
 source 'https://rubygems.org'
 
+ruby '>= 2.3.0', '< 2.7.0' if Bundler::VERSION >= '1.12.0'
 gem "bundler", ">= 1.5.0"
 
-gem "rails", "5.2.4.1"
+gem 'rails', '5.2.4.2'
+gem 'sprockets', '~> 3.7.2' if RUBY_VERSION < '2.5'
 gem "rouge", "~> 3.12.0"
 gem "request_store", "~> 1.4.1"
 gem "mini_mime", "~> 1.0.1"
diff --git a/pkgs/applications/version-management/redmine/Gemfile.lock b/pkgs/applications/version-management/redmine/Gemfile.lock
index 66326b282358d..60aed5e17922a 100644
--- a/pkgs/applications/version-management/redmine/Gemfile.lock
+++ b/pkgs/applications/version-management/redmine/Gemfile.lock
@@ -1,19 +1,19 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    actioncable (5.2.4.1)
-      actionpack (= 5.2.4.1)
+    actioncable (5.2.4.2)
+      actionpack (= 5.2.4.2)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
-    actionmailer (5.2.4.1)
-      actionpack (= 5.2.4.1)
-      actionview (= 5.2.4.1)
-      activejob (= 5.2.4.1)
+    actionmailer (5.2.4.2)
+      actionpack (= 5.2.4.2)
+      actionview (= 5.2.4.2)
+      activejob (= 5.2.4.2)
       mail (~> 2.5, >= 2.5.4)
       rails-dom-testing (~> 2.0)
-    actionpack (5.2.4.1)
-      actionview (= 5.2.4.1)
-      activesupport (= 5.2.4.1)
+    actionpack (5.2.4.2)
+      actionview (= 5.2.4.2)
+      activesupport (= 5.2.4.2)
       rack (~> 2.0, >= 2.0.8)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.0)
@@ -21,26 +21,26 @@ GEM
     actionpack-xml_parser (2.0.1)
       actionpack (>= 5.0)
       railties (>= 5.0)
-    actionview (5.2.4.1)
-      activesupport (= 5.2.4.1)
+    actionview (5.2.4.2)
+      activesupport (= 5.2.4.2)
       builder (~> 3.1)
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.0, >= 1.0.3)
-    activejob (5.2.4.1)
-      activesupport (= 5.2.4.1)
+    activejob (5.2.4.2)
+      activesupport (= 5.2.4.2)
       globalid (>= 0.3.6)
-    activemodel (5.2.4.1)
-      activesupport (= 5.2.4.1)
-    activerecord (5.2.4.1)
-      activemodel (= 5.2.4.1)
-      activesupport (= 5.2.4.1)
+    activemodel (5.2.4.2)
+      activesupport (= 5.2.4.2)
+    activerecord (5.2.4.2)
+      activemodel (= 5.2.4.2)
+      activesupport (= 5.2.4.2)
       arel (>= 9.0)
-    activestorage (5.2.4.1)
-      actionpack (= 5.2.4.1)
-      activerecord (= 5.2.4.1)
+    activestorage (5.2.4.2)
+      actionpack (= 5.2.4.2)
+      activerecord (= 5.2.4.2)
       marcel (~> 0.3.1)
-    activesupport (5.2.4.1)
+    activesupport (5.2.4.2)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 0.7, < 2)
       minitest (~> 5.1)
@@ -59,8 +59,8 @@ GEM
       regexp_parser (~> 1.5)
       xpath (~> 3.2)
     childprocess (3.0.0)
-    concurrent-ruby (1.1.5)
-    crass (1.0.5)
+    concurrent-ruby (1.1.6)
+    crass (1.0.6)
     css_parser (1.7.1)
       addressable
     csv (3.1.2)
@@ -73,58 +73,58 @@ GEM
       concurrent-ruby (~> 1.0)
     jaro_winkler (1.5.4)
     json (2.3.0)
-    loofah (2.4.0)
+    loofah (2.5.0)
       crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
     mail (2.7.1)
       mini_mime (>= 0.1.1)
     marcel (0.3.3)
       mimemagic (~> 0.3.2)
-    method_source (0.9.2)
-    mimemagic (0.3.3)
+    method_source (1.0.0)
+    mimemagic (0.3.4)
     mini_magick (4.9.5)
     mini_mime (1.0.2)
     mini_portile2 (2.4.0)
-    minitest (5.13.0)
-    mocha (1.11.1)
+    minitest (5.14.0)
+    mocha (1.11.2)
     mysql2 (0.5.3)
     net-ldap (0.16.2)
     nio4r (2.5.2)
-    nokogiri (1.10.7)
+    nokogiri (1.10.9)
       mini_portile2 (~> 2.4.0)
     parallel (1.19.1)
-    parser (2.6.5.0)
+    parser (2.7.1.0)
       ast (~> 2.4.0)
     pg (1.1.4)
-    public_suffix (4.0.1)
-    puma (3.12.2)
-    rack (2.0.8)
+    public_suffix (4.0.4)
+    puma (3.12.4)
+    rack (2.2.2)
     rack-openid (1.4.2)
       rack (>= 1.1.0)
       ruby-openid (>= 2.1.8)
     rack-test (1.1.0)
       rack (>= 1.0, < 3)
-    rails (5.2.4.1)
-      actioncable (= 5.2.4.1)
-      actionmailer (= 5.2.4.1)
-      actionpack (= 5.2.4.1)
-      actionview (= 5.2.4.1)
-      activejob (= 5.2.4.1)
-      activemodel (= 5.2.4.1)
-      activerecord (= 5.2.4.1)
-      activestorage (= 5.2.4.1)
-      activesupport (= 5.2.4.1)
+    rails (5.2.4.2)
+      actioncable (= 5.2.4.2)
+      actionmailer (= 5.2.4.2)
+      actionpack (= 5.2.4.2)
+      actionview (= 5.2.4.2)
+      activejob (= 5.2.4.2)
+      activemodel (= 5.2.4.2)
+      activerecord (= 5.2.4.2)
+      activestorage (= 5.2.4.2)
+      activesupport (= 5.2.4.2)
       bundler (>= 1.3.0)
-      railties (= 5.2.4.1)
+      railties (= 5.2.4.2)
       sprockets-rails (>= 2.0.0)
     rails-dom-testing (2.0.3)
       activesupport (>= 4.2.0)
       nokogiri (>= 1.6)
     rails-html-sanitizer (1.3.0)
       loofah (~> 2.3)
-    railties (5.2.4.1)
-      actionpack (= 5.2.4.1)
-      activesupport (= 5.2.4.1)
+    railties (5.2.4.2)
+      actionpack (= 5.2.4.2)
+      activesupport (= 5.2.4.2)
       method_source
       rake (>= 0.8.7)
       thor (>= 0.19.0, < 2.0)
@@ -135,15 +135,15 @@ GEM
       rbpdf-font (~> 1.19.0)
     rbpdf-font (1.19.1)
     redcarpet (3.5.0)
-    regexp_parser (1.6.0)
+    regexp_parser (1.7.0)
     request_store (1.4.1)
       rack (>= 1.4)
-    roadie (3.5.1)
+    roadie (4.0.0)
       css_parser (~> 1.4)
       nokogiri (~> 1.8)
-    roadie-rails (2.1.0)
+    roadie-rails (2.1.1)
       railties (>= 5.1, < 6.1)
-      roadie (~> 3.1)
+      roadie (>= 3.1, < 5.0)
     rouge (3.12.0)
     rubocop (0.76.0)
       jaro_winkler (~> 1.5.1)
@@ -152,15 +152,15 @@ GEM
       rainbow (>= 2.2.2, < 4.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 1.4.0, < 1.7)
-    rubocop-performance (1.5.1)
+    rubocop-performance (1.5.2)
       rubocop (>= 0.71.0)
     rubocop-rails (2.3.2)
       rack (>= 1.1)
       rubocop (>= 0.72.0)
     ruby-openid (2.9.2)
     ruby-progressbar (1.10.1)
-    rubyzip (2.0.0)
-    selenium-webdriver (3.142.6)
+    rubyzip (2.3.0)
+    selenium-webdriver (3.142.7)
       childprocess (>= 0.5, < 4.0)
       rubyzip (>= 1.2.2)
     simplecov (0.17.1)
@@ -177,15 +177,15 @@ GEM
       sprockets (>= 3.0.0)
     thor (1.0.1)
     thread_safe (0.3.6)
-    tzinfo (1.2.5)
+    tzinfo (1.2.7)
       thread_safe (~> 0.1)
-    unicode-display_width (1.6.0)
+    unicode-display_width (1.6.1)
     websocket-driver (0.7.1)
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.4)
     xpath (3.2.0)
       nokogiri (~> 1.8)
-    yard (0.9.20)
+    yard (0.9.24)
 
 PLATFORMS
   ruby
@@ -208,7 +208,7 @@ DEPENDENCIES
   pg (~> 1.1.4)
   puma (~> 3.7)
   rack-openid
-  rails (= 5.2.4.1)
+  rails (= 5.2.4.2)
   rails-dom-testing
   rbpdf (~> 1.20.0)
   redcarpet (~> 3.5.0)
@@ -224,5 +224,8 @@ DEPENDENCIES
   tzinfo-data
   yard
 
+RUBY VERSION
+   ruby 2.6.6p146
+
 BUNDLED WITH
    2.1.4
diff --git a/pkgs/applications/version-management/redmine/default.nix b/pkgs/applications/version-management/redmine/default.nix
index 8a85f19216330..2344e8dbd4b88 100644
--- a/pkgs/applications/version-management/redmine/default.nix
+++ b/pkgs/applications/version-management/redmine/default.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchurl, bundlerEnv, ruby }:
 
 let
-  version = "4.1.0";
+  version = "4.1.1";
   rubyEnv = bundlerEnv {
     name = "redmine-env-${version}";
 
     inherit ruby;
     gemdir = ./.;
-    groups = [ "ldap" "openid" ];
+    groups = [ "development" "ldap" "markdown" "minimagick" "openid" "test" ];
   };
 in
   stdenv.mkDerivation rec {
@@ -16,7 +16,7 @@ in
 
     src = fetchurl {
       url = "https://www.redmine.org/releases/${pname}-${version}.tar.gz";
-      sha256 = "1fxc0xql54cfvj4g8v31vsv19jbij326qkgdz2h5xlp09r821wli";
+      sha256 = "1nndy5hz8zvfglxf1f3bsb1pkrfwinfxzkdan1vjs3rkckkszyh5";
     };
 
     buildInputs = [ rubyEnv rubyEnv.wrappedRuby rubyEnv.bundler ];
diff --git a/pkgs/applications/version-management/redmine/gemset.nix b/pkgs/applications/version-management/redmine/gemset.nix
index e69cbb0e1c23f..9a4deb7e155af 100644
--- a/pkgs/applications/version-management/redmine/gemset.nix
+++ b/pkgs/applications/version-management/redmine/gemset.nix
@@ -1,33 +1,41 @@
 {
   actioncable = {
     dependencies = ["actionpack" "nio4r" "websocket-driver"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1yz5mcjl4is99650vq6rkv539xccq8mp5zsbvzh43wqzfga1llwm";
+      sha256 = "0q4by8d41n972j8cdcddrwsh7qphcki50xvgm1syrawyck6w1f5v";
       type = "gem";
     };
-    version = "5.2.4.1";
+    version = "5.2.4.2";
   };
   actionmailer = {
     dependencies = ["actionpack" "actionview" "activejob" "mail" "rails-dom-testing"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1dbw3q3yyh7m7wgc4196hc3v86v123z0xz40llmic8iwx3d9vnda";
+      sha256 = "0kg2nayy8wmxhfp52217h80yqr0mcg793xw3cjlfg9lkvdh0nb5z";
       type = "gem";
     };
-    version = "5.2.4.1";
+    version = "5.2.4.2";
   };
   actionpack = {
     dependencies = ["actionview" "activesupport" "rack" "rack-test" "rails-dom-testing" "rails-html-sanitizer"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0f5pm62y08j679k3vhcml8436f92kripd6j3v5dyvn760kwzz72z";
+      sha256 = "1w1l9i6q9xns4yl41l582pyc5i1xi40yyyq802drm58gwylv3wax";
       type = "gem";
     };
-    version = "5.2.4.1";
+    version = "5.2.4.2";
   };
   actionpack-xml_parser = {
     dependencies = ["actionpack" "railties"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1rnm6jrw3mzcf2g3q498igmhsn0kfkxq79w0nm532iclx4g4djs0";
@@ -37,60 +45,74 @@
   };
   actionview = {
     dependencies = ["activesupport" "builder" "erubi" "rails-dom-testing" "rails-html-sanitizer"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0hnkyx268czfb6ljv6ipcnz9dbgsb1z9n1gcr6279z9wx9550zij";
+      sha256 = "0fp3my6216lb9gp800s46y0404jwfl6xb3j9rvx4zf087497q8lp";
       type = "gem";
     };
-    version = "5.2.4.1";
+    version = "5.2.4.2";
   };
   activejob = {
     dependencies = ["activesupport" "globalid"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0k4j3fcfc8m4hxwhs8xnbxazra760j3amn5r2zm2d5r1a1nqfh91";
+      sha256 = "1qsvb89rwqrp779mvpn67qbzidg2q6d1fa8kwybvpc93nzb9zpvi";
       type = "gem";
     };
-    version = "5.2.4.1";
+    version = "5.2.4.2";
   };
   activemodel = {
     dependencies = ["activesupport"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0sg1yyz710pxhq9z0jsbpbgn666y8iv4aj7pywglydipp4i0bpx1";
+      sha256 = "0jcfdv00kmifj86d0z347nw55q1f8vwzr1aa9jrfnwz47ndi22di";
       type = "gem";
     };
-    version = "5.2.4.1";
+    version = "5.2.4.2";
   };
   activerecord = {
     dependencies = ["activemodel" "activesupport" "arel"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1p35d6pj1370mnlppqq9lhr7m1ck82xvv621wq6hy12v41qfdnrg";
+      sha256 = "1yaqrh23c8krrjw6rvxv7pvnkpp46nk5aq9z2daby640si4xpmp5";
       type = "gem";
     };
-    version = "5.2.4.1";
+    version = "5.2.4.2";
   };
   activestorage = {
     dependencies = ["actionpack" "activerecord" "marcel"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0dd8k91b88b875mypwqific2jilgzj5bx1637cwmzi4c0cy1v17f";
+      sha256 = "1d51zp17c9k4brivm8y46rszcz07s5rb75gmkm0dpzg3rz3v38s9";
       type = "gem";
     };
-    version = "5.2.4.1";
+    version = "5.2.4.2";
   };
   activesupport = {
     dependencies = ["concurrent-ruby" "i18n" "minitest" "tzinfo"];
+    groups = ["default" "test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0lmlnx79sv18xv1ddm4vq7z3mwdfa4468mq5186av0k8n1k471sp";
+      sha256 = "0y1397g5xxinjyxjsdmp8c92yn0y3bd2hl4wbmmrpd08bggy6flc";
       type = "gem";
     };
-    version = "5.2.4.1";
+    version = "5.2.4.2";
   };
   addressable = {
     dependencies = ["public_suffix"];
+    groups = ["default" "test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1fvchp2rhp2rmigx7qglf69xvjqvzq7x0g49naliw29r2bz656sy";
@@ -99,6 +121,8 @@
     version = "2.7.0";
   };
   arel = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1jk7wlmkr61f6g36w9s2sn46nmdg6wn2jfssrhbhirv5x9n95nk0";
@@ -107,6 +131,8 @@
     version = "9.0.0";
   };
   ast = {
+    groups = ["default" "test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "184ssy3w93nkajlz2c70ifm79jp3j737294kbc5fjw69v1w0n9x7";
@@ -115,6 +141,8 @@
     version = "2.4.0";
   };
   builder = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "045wzckxpwcqzrjr353cxnyaxgf0qg22jh00dcx7z38cys5g1jlr";
@@ -124,6 +152,8 @@
   };
   capybara = {
     dependencies = ["addressable" "mini_mime" "nokogiri" "rack" "rack-test" "regexp_parser" "xpath"];
+    groups = ["test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1bq1y3gy98rqgw8z69b42isc2klb75fvlwvpi36vycf1yk0sfmmx";
@@ -132,6 +162,8 @@
     version = "3.25.0";
   };
   childprocess = {
+    groups = ["default" "test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1ic028k8xgm2dds9mqnvwwx3ibaz32j8455zxr9f4bcnviyahya5";
@@ -140,23 +172,29 @@
     version = "3.0.0";
   };
   concurrent-ruby = {
+    groups = ["default" "test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1x07r23s7836cpp5z9yrlbpljcxpax14yw4fy4bnp6crhr6x24an";
+      sha256 = "094387x4yasb797mv07cs3g6f08y56virc2rjcpb1k79rzaj3nhl";
       type = "gem";
     };
-    version = "1.1.5";
+    version = "1.1.6";
   };
   crass = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "030sc98kjrb36rh7g21qsbdfxrj6knsjkx0mn3b7gig8zknwhp2f";
+      sha256 = "0pfl5c0pyqaparxaqxi6s4gfl21bdldwiawrc0aknyvflli60lfw";
       type = "gem";
     };
-    version = "1.0.5";
+    version = "1.0.6";
   };
   css_parser = {
     dependencies = ["addressable"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "04c4dl8cm5rjr50k9qa6yl9r05fk9zcb1zxh0y0cdahxlsgcydfw";
@@ -165,6 +203,8 @@
     version = "1.7.1";
   };
   csv = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "00szzw96bqz59r0kaab4p75qb0wq54iahmq37wpdg96bxc8y80f5";
@@ -173,6 +213,8 @@
     version = "3.1.2";
   };
   docile = {
+    groups = ["default" "test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0qrwiyagxzl8zlx3dafb0ay8l14ib7imb2rsmx70i5cp420v8gif";
@@ -181,6 +223,8 @@
     version = "1.3.2";
   };
   erubi = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1nwzxnqhr31fn7nbqmffcysvxjdfl3bhxi0bld5qqhcnfc1xd13x";
@@ -190,6 +234,8 @@
   };
   globalid = {
     dependencies = ["activesupport"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1zkxndvck72bfw235bd9nl2ii0lvs5z88q14706cmn702ww2mxv1";
@@ -198,6 +244,8 @@
     version = "0.4.2";
   };
   htmlentities = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1nkklqsn8ir8wizzlakncfv42i32wc0w9hxp00hvdlgjr7376nhj";
@@ -207,6 +255,8 @@
   };
   i18n = {
     dependencies = ["concurrent-ruby"];
+    groups = ["default" "test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1hfxnlyr618s25xpafw9mypa82qppjccbh292c4l3bj36az7f6wl";
@@ -215,6 +265,8 @@
     version = "1.6.0";
   };
   jaro_winkler = {
+    groups = ["default" "test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1y8l6k34svmdyqxya3iahpwbpvmn3fswhwsvrz0nk1wyb8yfihsh";
@@ -223,6 +275,8 @@
     version = "1.5.4";
   };
   json = {
+    groups = ["default" "test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0nrmw2r4nfxlfgprfgki3hjifgrcrs3l5zvm3ca3gb4743yr25mn";
@@ -232,15 +286,19 @@
   };
   loofah = {
     dependencies = ["crass" "nokogiri"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1g7ps9m3s14cajhxrfgbzahv9i3gy47s4hqrv3mpybpj5cyr0srn";
+      sha256 = "0jk9fgn5ayzbqvzqm11gbkqvas77zdbpkvynlylyiwynclgrn040";
       type = "gem";
     };
-    version = "2.4.0";
+    version = "2.5.0";
   };
   mail = {
     dependencies = ["mini_mime"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "00wwz6ys0502dpk8xprwcqfwyf3hmnx6lgxaiq6vj43mkx43sapc";
@@ -250,6 +308,8 @@
   };
   marcel = {
     dependencies = ["mimemagic"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1nxbjmcyg8vlw6zwagf17l9y2mwkagmmkg95xybpn4bmf3rfnksx";
@@ -258,22 +318,28 @@
     version = "0.3.3";
   };
   method_source = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1pviwzvdqd90gn6y7illcdd9adapw8fczml933p5vl739dkvl3lq";
+      sha256 = "1pnyh44qycnf9mzi1j6fywd5fkskv3x7nmsqrrws0rjn5dd4ayfp";
       type = "gem";
     };
-    version = "0.9.2";
+    version = "1.0.0";
   };
   mimemagic = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "04cp5sfbh1qx82yqxn0q75c7hlcx8y1dr5g3kyzwm4mx6wi2gifw";
+      sha256 = "0frrfvz52fh4v1sb2xr9pyxhrxm5f7jppqxagpmd7c5ific66l9p";
       type = "gem";
     };
-    version = "0.3.3";
+    version = "0.3.4";
   };
   mini_magick = {
+    groups = ["minimagick"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0qy09qrd5bwh8mkbj514n5vcw9ni73218h9s3zmvbpmdwrnzi8j4";
@@ -282,6 +348,8 @@
     version = "4.9.5";
   };
   mini_mime = {
+    groups = ["default" "test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1axm0rxyx3ss93wbmfkm78a6x03l8y4qy60rhkkiq0aza0vwq3ha";
@@ -290,6 +358,8 @@
     version = "1.0.2";
   };
   mini_portile2 = {
+    groups = ["default" "test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "15zplpfw3knqifj9bpf604rb3wc1vhq6363pd6lvhayng8wql5vy";
@@ -298,22 +368,36 @@
     version = "2.4.0";
   };
   minitest = {
+    groups = ["default" "test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0w16p7cvslh3hxd3cia8jg4pd85z7rz7xqb16vh42gj4rijn8rmi";
+      sha256 = "0g73x65hmjph8dg1h3rkzfg7ys3ffxm35hj35grw75fixmq53qyz";
       type = "gem";
     };
-    version = "5.13.0";
+    version = "5.14.0";
   };
   mocha = {
+    groups = ["test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "06i2q5qjr9mvjgjc8w41pdf3qalw340y33wjvzc0rp4a1cbbb7pp";
+      sha256 = "0hxmkm8qxd04vwj8mqnpyrf2dwy7g1k9zipdfhl4y71cw7ijm9n4";
       type = "gem";
     };
-    version = "1.11.1";
+    version = "1.11.2";
   };
   mysql2 = {
+    groups = ["default"];
+    platforms = [{
+      engine = "maglev";
+    } {
+      engine = "mingw";
+    } {
+      engine = "mingw";
+    } {
+      engine = "ruby";
+    }];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0d14pcy5m4hjig0zdxnl9in5f4izszc7v9zcczf2gyi5kiyxk8jw";
@@ -322,6 +406,8 @@
     version = "0.5.3";
   };
   net-ldap = {
+    groups = ["ldap"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1vzfhivjfr9q65hkln7xig3qcba6fw9y4kb4384fpm7d7ww0b7xg";
@@ -330,6 +416,8 @@
     version = "0.16.2";
   };
   nio4r = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0gnmvbryr521r135yz5bv8354m7xn6miiapfgpg1bnwsvxz8xj6c";
@@ -339,14 +427,18 @@
   };
   nokogiri = {
     dependencies = ["mini_portile2"];
+    groups = ["default" "test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0r0qpgf80h764k176yr63gqbs2z0xbsp8vlvs2a79d5r9vs83kln";
+      sha256 = "12j76d0bp608932xkzmfi638c7aqah57l437q8494znzbj610qnm";
       type = "gem";
     };
-    version = "1.10.7";
+    version = "1.10.9";
   };
   parallel = {
+    groups = ["default" "test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "12jijkap4akzdv11lm08dglsc8jmc87xcgq6947i1s3qb69f4zn2";
@@ -356,14 +448,26 @@
   };
   parser = {
     dependencies = ["ast"];
+    groups = ["default" "test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "09davv4ld6caqlczw64vhwf8hr41apys3cj8v2h96yxs4qg1m2iw";
+      sha256 = "07awrcwm2xibglrh7qwpj24vwzn9p64m7bmfr9xbrlffaznr0ii7";
       type = "gem";
     };
-    version = "2.6.5.0";
+    version = "2.7.1.0";
   };
   pg = {
+    groups = ["default"];
+    platforms = [{
+      engine = "maglev";
+    } {
+      engine = "mingw";
+    } {
+      engine = "mingw";
+    } {
+      engine = "ruby";
+    }];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0fmnyxcyrvgdbgq7m09whgn9i8rwfybk0w8aii1nc4g5kqw0k2jy";
@@ -372,31 +476,39 @@
     version = "1.1.4";
   };
   public_suffix = {
+    groups = ["default" "test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0xnfv2j2bqgdpg2yq9i2rxby0w2sc9h5iyjkpaas2xknwrgmhdb0";
+      sha256 = "1l1kqw75asziwmzrig8rywxswxz8l91sc3pvns02ffsqac1a3wiz";
       type = "gem";
     };
-    version = "4.0.1";
+    version = "4.0.4";
   };
   puma = {
+    groups = ["test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "07sb9xqc9bn5lvl9ia25w8x1fwzk52p5vgysnvjlc3hvn0r00ysj";
+      sha256 = "0mg8yh478mh55pg7pv8z7xyvk35ra98hy61z9lwkfr8fzyyz57zs";
       type = "gem";
     };
-    version = "3.12.2";
+    version = "3.12.4";
   };
   rack = {
+    groups = ["default" "openid" "test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1id0jsslx1ipv0pbqjfn7mjbb2vx2xybk7qypq59a17163xp30gr";
+      sha256 = "10mp9s48ssnw004aksq90gvhdvwczh8j6q82q2kqiqq92jd1zxbp";
       type = "gem";
     };
-    version = "2.0.8";
+    version = "2.2.2";
   };
   rack-openid = {
     dependencies = ["rack" "ruby-openid"];
+    groups = ["openid"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0sg85yn981j3a0iri3ch4znzdwscvz29l7vrk3dafqw4fdg31llc";
@@ -406,6 +518,8 @@
   };
   rack-test = {
     dependencies = ["rack"];
+    groups = ["default" "test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0rh8h376mx71ci5yklnpqqn118z3bl67nnv5k801qaqn1zs62h8m";
@@ -415,15 +529,19 @@
   };
   rails = {
     dependencies = ["actioncable" "actionmailer" "actionpack" "actionview" "activejob" "activemodel" "activerecord" "activestorage" "activesupport" "railties" "sprockets-rails"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1198azwbhlhq2n9xmpb19709d6smkanimip9cagvnlihagw80b20";
+      sha256 = "1x8k6n4yziwf386prhvr9d9plc9fwv0j8spw2bnmkwhf54v2ias4";
       type = "gem";
     };
-    version = "5.2.4.1";
+    version = "5.2.4.2";
   };
   rails-dom-testing = {
     dependencies = ["activesupport" "nokogiri"];
+    groups = ["test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1lfq2a7kp2x64dzzi5p4cjcbiv62vxh9lyqk2f0rqq3fkzrw8h5i";
@@ -433,6 +551,8 @@
   };
   rails-html-sanitizer = {
     dependencies = ["loofah"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1icpqmxbppl4ynzmn6dx7wdil5hhq6fz707m9ya6d86c7ys8sd4f";
@@ -442,14 +562,18 @@
   };
   railties = {
     dependencies = ["actionpack" "activesupport" "method_source" "rake" "thor"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1iqsqyyjscwnj2d3i0zl2k9apgsm7bb92l5h4wv1zbpdbb30wsqb";
+      sha256 = "1p2rnd1xdqlk19k3m5gd058yzvwjj25k5hwn4km683b5dhylpd16";
       type = "gem";
     };
-    version = "5.2.4.1";
+    version = "5.2.4.2";
   };
   rainbow = {
+    groups = ["default" "test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0bb2fpjspydr6x0s8pn1pqkzmxszvkfapv0p4627mywl7ky4zkhk";
@@ -458,6 +582,8 @@
     version = "3.0.0";
   };
   rake = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0w6qza25bq1s825faaglkx1k6d59aiyjjk3yw3ip5sb463mhhai9";
@@ -467,6 +593,8 @@
   };
   rbpdf = {
     dependencies = ["htmlentities" "rbpdf-font"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0sdj8frakpdms820rwlil38h9bh3p24xmwnjrxsjc1p9irc3za71";
@@ -475,6 +603,8 @@
     version = "1.20.1";
   };
   rbpdf-font = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0pxlr0l4vf785qpy55m439dyii63a26l0sd0yyhbwwcy9zm9hd1v";
@@ -483,6 +613,8 @@
     version = "1.19.1";
   };
   redcarpet = {
+    groups = ["markdown"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0skcyx1h8b5ms0rp2zm3ql6g322b8c1adnkwkqyv7z3kypb4bm7k";
@@ -491,15 +623,19 @@
     version = "3.5.0";
   };
   regexp_parser = {
+    groups = ["default" "test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1l44ml30jvqpdi3707x1n1dinq7fx9887pv3q2ywyfmi4kja7yf2";
+      sha256 = "0l2vcj9qffj5b3v9jsyi4k994bdj3rjz7l9ql8x04lndqxfrrrv2";
       type = "gem";
     };
-    version = "1.6.0";
+    version = "1.7.0";
   };
   request_store = {
     dependencies = ["rack"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1963330z03fk382fi8y231ygcbnh86m91dqlp5rh1mwy9ihzzl6d";
@@ -509,23 +645,29 @@
   };
   roadie = {
     dependencies = ["css_parser" "nokogiri"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1zihd316bkbnrinz5s1s7pg7s0cadhhj6qs7wmc713j0g6ai1k9r";
+      sha256 = "01kld3drqfiih5x8c13cvr6dpvdl7jml0v9bcw4fsy322lax3kn0";
       type = "gem";
     };
-    version = "3.5.1";
+    version = "4.0.0";
   };
   roadie-rails = {
     dependencies = ["railties" "roadie"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0hdkmnxrmw31dn9jq43xiypz2v6rbvg4x2yd2hgl2xbl3lm1ln7i";
+      sha256 = "1fmn7kkbpgipjsx65rw7hqa3bwinlqykx5qf1x28ya9ag8v2q0ph";
       type = "gem";
     };
-    version = "2.1.0";
+    version = "2.1.1";
   };
   rouge = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "08fpnxbhqv5sqpnfjasl1ysxafssyq4q1yhcqamqqzmb9czj1czw";
@@ -535,6 +677,8 @@
   };
   rubocop = {
     dependencies = ["jaro_winkler" "parallel" "parser" "rainbow" "ruby-progressbar" "unicode-display_width"];
+    groups = ["test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "07x51ixlx76y194xsszh5lbkaqakz44ykbrjxg3qaggbs18790q0";
@@ -544,15 +688,19 @@
   };
   rubocop-performance = {
     dependencies = ["rubocop"];
+    groups = ["test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1kn6rb0ma32gjp5qdvrbbb9ckh66rm6xpfrw8h3kr7svirsww2h8";
+      sha256 = "1fk9nd3b24avgsqp726hy2pl1iyfjrh6jni97wkky6kqy0lq6zq2";
       type = "gem";
     };
-    version = "1.5.1";
+    version = "1.5.2";
   };
   rubocop-rails = {
     dependencies = ["rack" "rubocop"];
+    groups = ["test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1q7ffsq1cjm4m949nh935kjzv4zf1pacnrl00siwh8flhcn3mmjf";
@@ -561,6 +709,8 @@
     version = "2.3.2";
   };
   ruby-openid = {
+    groups = ["openid"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "190p1m0bxd9xkfk1j6cpcv3x5c367g36nsglg4m1fcwqdd13k3kz";
@@ -569,6 +719,8 @@
     version = "2.9.2";
   };
   ruby-progressbar = {
+    groups = ["default" "test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1k77i0d4wsn23ggdd2msrcwfy0i376cglfqypkk2q77r2l3408zf";
@@ -577,24 +729,30 @@
     version = "1.10.1";
   };
   rubyzip = {
+    groups = ["default" "test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1gz0ri0pa2xr7b6bf66yjc2wfvk51f4gi6yk7bklwl1nr65zc4gz";
+      sha256 = "0590m2pr9i209pp5z4mx0nb1961ishdiqb28995hw1nln1d1b5ji";
       type = "gem";
     };
-    version = "2.0.0";
+    version = "2.3.0";
   };
   selenium-webdriver = {
     dependencies = ["childprocess" "rubyzip"];
+    groups = ["test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "11abil34dr8p1kw7hlaqd6kr430v4srmhzf72zzqvhcimlfvm4yb";
+      sha256 = "0adcvp86dinaqq3nhf8p3m0rl2g6q0a4h52k0i7kdnsg1qz9k86y";
       type = "gem";
     };
-    version = "3.142.6";
+    version = "3.142.7";
   };
   simplecov = {
     dependencies = ["docile" "json" "simplecov-html"];
+    groups = ["test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1135k46nik05sdab30yxb8264lqiz01c8v000g16cl9pjc4mxrdw";
@@ -603,6 +761,8 @@
     version = "0.17.1";
   };
   simplecov-html = {
+    groups = ["default" "test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1lihraa4rgxk8wbfl77fy9sf0ypk31iivly8vl3w04srd7i0clzn";
@@ -612,6 +772,8 @@
   };
   sprockets = {
     dependencies = ["concurrent-ruby" "rack"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0jm37zpvvm1arxjwrd6am0wrdbfhrhc5y0l4p2i3p11z04bsvgap";
@@ -621,6 +783,8 @@
   };
   sprockets-rails = {
     dependencies = ["actionpack" "activesupport" "sprockets"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0ab42pm8p5zxpv3sfraq45b9lj39cz9mrpdirm30vywzrwwkm5p1";
@@ -629,6 +793,8 @@
     version = "3.2.1";
   };
   thor = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1xbhkmyhlxwzshaqa7swy2bx6vd64mm0wrr8g3jywvxy7hg0cwkm";
@@ -637,6 +803,8 @@
     version = "1.0.1";
   };
   thread_safe = {
+    groups = ["default" "test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0nmhcgq6cgz44srylra07bmaw99f5271l0dpsvl5f75m44l0gmwy";
@@ -646,23 +814,29 @@
   };
   tzinfo = {
     dependencies = ["thread_safe"];
+    groups = ["default" "test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1fjx9j327xpkkdlxwmkl3a8wqj7i4l4jwlrv3z13mg95z9wl253z";
+      sha256 = "1i3jh086w1kbdj3k5l60lc3nwbanmzdf8yjj3mlrx9b2gjjxhi9r";
       type = "gem";
     };
-    version = "1.2.5";
+    version = "1.2.7";
   };
   unicode-display_width = {
+    groups = ["default" "test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "08kfiniak1pvg3gn5k6snpigzvhvhyg7slmm0s2qx5zkj62c1z2w";
+      sha256 = "1pppclzq4qb26g321553nm9xqca3zgllvpwb2kqxsdadwj51s09x";
       type = "gem";
     };
-    version = "1.6.0";
+    version = "1.6.1";
   };
   websocket-driver = {
     dependencies = ["websocket-extensions"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1bxamwqldmy98hxs5pqby3andws14hl36ch78g0s81gaz9b91nj2";
@@ -671,6 +845,8 @@
     version = "0.7.1";
   };
   websocket-extensions = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "00i624ng1nvkz1yckj3f8yxxp6hi7xaqf40qh9q3hj2n1l9i8g6m";
@@ -680,6 +856,8 @@
   };
   xpath = {
     dependencies = ["nokogiri"];
+    groups = ["default" "test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0bh8lk9hvlpn7vmi6h4hkcwjzvs2y0cmkk3yjjdr8fxvj6fsgzbd";
@@ -688,11 +866,13 @@
     version = "3.2.0";
   };
   yard = {
+    groups = ["development"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0rxqwry3h2hjz069f0kfr140wgx1khgljnqf112dk5x9rm4l0xny";
+      sha256 = "1g0bw2qcl48fxawrdf68l229508z53mrqisavji2lkxzv4w4j2pp";
       type = "gem";
     };
-    version = "0.9.20";
+    version = "0.9.24";
   };
 }
\ No newline at end of file
diff --git a/pkgs/applications/video/plex-media-player/default.nix b/pkgs/applications/video/plex-media-player/default.nix
index 8b7aa3b551cc0..d08a4a8524288 100644
--- a/pkgs/applications/video/plex-media-player/default.nix
+++ b/pkgs/applications/video/plex-media-player/default.nix
@@ -5,45 +5,20 @@ let
   # During compilation, a CMake bundle is downloaded from `artifacts.plex.tv`,
   # which then downloads a handful of web client-related files. To enable
   # sandboxed builds, we manually download them and save them so these files
-  # are fetched ahead-of-time instead of during the CMake build. Whenever
-  # plex-media-player is updated, the versions for these files are changed,
-  # so the build IDs (and SHAs) below will need to be updated!
-  depSrcs = rec {
-    webClientBuildId = "141-4af71961b12c68";
-    webClientDesktopBuildId = "3.104.2-1b12c68";
-    webClientTvBuildId = "4.3.0-4af7196";
-
-    webClient = fetchurl {
-      url = "https://artifacts.plex.tv/web-client-pmp/${webClientBuildId}/buildid.cmake";
-      sha256 = "0fpkd1s49dbiqqlijxbillqd71a78p8y2sc23mwp0lvcmxrg265p";
-    };
-    webClientDesktopHash = fetchurl {
-      url = "https://artifacts.plex.tv/web-client-pmp/${webClientBuildId}/web-client-desktop-${webClientDesktopBuildId}.tar.xz.sha1";
-      sha256 = "0sb0j44lwqz9zbm98nba4x6c1jxdzvs36ynwfg527avkxxna0f8f";
-    };
-    webClientDesktop = fetchurl {
-      url = "https://artifacts.plex.tv/web-client-pmp/${webClientBuildId}/web-client-desktop-${webClientDesktopBuildId}.tar.xz";
-      sha256 = "0dxa0ka0igfsryzda4r5clwdl47ah78nmlmgj9d5pgsvyvzjp87z";
-    };
-    webClientTvHash = fetchurl {
-      url = "https://artifacts.plex.tv/web-client-pmp/${webClientBuildId}/web-client-tv-${webClientTvBuildId}.tar.xz.sha1";
-      sha256 = "086w1bavk2aqsyhv9zi5fynk31zf61sl91r6gjrdrz656wfk5bxa";
-    };
-    webClientTv = fetchurl {
-      url = "https://artifacts.plex.tv/web-client-pmp/${webClientBuildId}/web-client-tv-${webClientTvBuildId}.tar.xz";
-      sha256 = "12vbgsfnj0j2y5jd73dpi08hqsr9888sma41nvd4ydsd7qblm455";
-    };
-  };
+  # are fetched ahead-of-time instead of during the CMake build. To update
+  # plex-media-player use the update.sh script, so the versions and hashes
+  # for these files are are also updated!
+  depSrcs = import ./deps.nix { inherit fetchurl; };
 in mkDerivation rec {
   pname = "plex-media-player";
-  version = "2.40.0.1007";
-  vsnHash = "5482132c";
+  version = "2.55.0.1069";
+  vsnHash = "2369bed9";
 
   src = fetchFromGitHub {
     owner = "plexinc";
     repo = "plex-media-player";
     rev = "v${version}-${vsnHash}";
-    sha256 = "0ibdh5g8x32iy74q97jfsmxd08wnyrzs3gfiwjfgc10vaa1qdhli";
+    sha256 = "1jq4592sgaia0xy2h7n3vh5i7c84sdh4l64fdc774r4i0bmg66qi";
   };
 
   nativeBuildInputs = [ pkgconfig cmake python3 ];
@@ -61,6 +36,8 @@ in mkDerivation rec {
 
   cmakeFlags = [ "-DCMAKE_BUILD_TYPE=RelWithDebInfo" "-DQTROOT=${qtbase}" ];
 
+  passthru.updateScript = ./update.sh;
+
   meta = with stdenv.lib; {
     description = "Streaming media player for Plex";
     license = licenses.gpl2;
diff --git a/pkgs/applications/video/plex-media-player/deps.nix b/pkgs/applications/video/plex-media-player/deps.nix
new file mode 100644
index 0000000000000..26b57532615aa
--- /dev/null
+++ b/pkgs/applications/video/plex-media-player/deps.nix
@@ -0,0 +1,28 @@
+{ fetchurl }:
+
+rec {
+  webClientBuildId = "180-afec74de50e175";
+  webClientDesktopBuildId = "4.29.2-e50e175";
+  webClientTvBuildId = "4.29.3-afec74d";
+
+  webClient = fetchurl {
+    url = "https://artifacts.plex.tv/web-client-pmp/${webClientBuildId}/buildid.cmake";
+    sha256 = "0rabrg3lk9vgpswk8npa54hzqf2v8ghqqnysxpwn12wrp1pc2rr9";
+  };
+  webClientDesktopHash = fetchurl {
+    url = "https://artifacts.plex.tv/web-client-pmp/${webClientBuildId}/web-client-desktop-${webClientDesktopBuildId}.tar.xz.sha1";
+    sha256 = "02b5yq4yc411qlg2dkw5j9lrr3cn2y4d27sin0skf6qza180473g";
+  };
+  webClientDesktop = fetchurl {
+    url = "https://artifacts.plex.tv/web-client-pmp/${webClientBuildId}/web-client-desktop-${webClientDesktopBuildId}.tar.xz";
+    sha256 = "0l3xv48kr2rx878a40zrgwif2ga2ikv6fdcbq9pylycnmm41pxmh";
+  };
+  webClientTvHash = fetchurl {
+    url = "https://artifacts.plex.tv/web-client-pmp/${webClientBuildId}/web-client-tv-${webClientTvBuildId}.tar.xz.sha1";
+    sha256 = "0wq115y2xrgwqrzr43nhkq8ba237z20yfp426ki2kdypsq8fjqka";
+  };
+  webClientTv = fetchurl {
+    url = "https://artifacts.plex.tv/web-client-pmp/${webClientBuildId}/web-client-tv-${webClientTvBuildId}.tar.xz";
+    sha256 = "1wax1qslm226l2w53m2fnl849jw349qhg3rjghx7vip5pmb43vw9";
+  };
+}
diff --git a/pkgs/applications/video/plex-media-player/update.sh b/pkgs/applications/video/plex-media-player/update.sh
new file mode 100755
index 0000000000000..a8493a16c9897
--- /dev/null
+++ b/pkgs/applications/video/plex-media-player/update.sh
@@ -0,0 +1,71 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl common-updater-scripts nix-prefetch-scripts jq
+
+set -xeuo pipefail
+
+nixpkgs="$(git rev-parse --show-toplevel)"
+
+oldVersion="$(nix-instantiate --eval -E "with import $nixpkgs {}; plex-media-player.version or (builtins.parseDrvName plex-media-player.name).version" | tr -d '"')"
+latestTag="$(curl -s https://api.github.com/repos/plexinc/plex-media-player/tags  | jq -r '.[] | .name' | sort --version-sort | tail -1)"
+latestVersion="$(expr $latestTag : 'v\(.*\)-.*')"
+latestHash="$(expr $latestTag : 'v.*-\(.*\)')"
+
+if [ ! "$oldVersion" = "$latestVersion" ]; then
+  # update default.nix with the new version and hash
+  expectedHash=$(nix-prefetch-git --url https://github.com/plexinc/plex-media-player.git --rev $latestTag --quiet | jq -r '.sha256')
+  update-source-version plex-media-player --version-key=vsnHash "${latestHash}" 0000
+  update-source-version plex-media-player "${latestVersion}" $expectedHash
+
+  # extract the webClientBuildId from the source folder
+  src="$(nix-build --no-out-link $nixpkgs -A plex-media-player.src)"
+  webClientBuildId="$(grep 'set(WEB_CLIENT_BUILD_ID' $src/CMakeModules/WebClient.cmake | cut -d' ' -f2 | tr -d ')')"
+
+  # retreive the included cmake file and hash
+  { read -r webClientBuildIdHash; read -r webClientBuildIdPath; } < \
+    <(nix-prefetch-url --print-path "https://artifacts.plex.tv/web-client-pmp/${webClientBuildId}/buildid.cmake")
+  webClientDesktopBuildId="$(grep 'set(DESKTOP_VERSION' $webClientBuildIdPath | cut -d' ' -f2 | tr -d ')')"
+  webClientTvBuildId="$(grep 'set(TV_VERSION' $webClientBuildIdPath | cut -d' ' -f2 | tr -d ')')"
+
+  # get the hashes for the other files
+  webClientDesktopHash="$(nix-prefetch-url "https://artifacts.plex.tv/web-client-pmp/${webClientBuildId}/web-client-desktop-${webClientDesktopBuildId}.tar.xz.sha1")"
+  webClientDesktop="$(nix-prefetch-url "https://artifacts.plex.tv/web-client-pmp/${webClientBuildId}/web-client-desktop-${webClientDesktopBuildId}.tar.xz")"
+  webClientTvHash="$(nix-prefetch-url "https://artifacts.plex.tv/web-client-pmp/${webClientBuildId}/web-client-tv-${webClientTvBuildId}.tar.xz.sha1")"
+  webClientTv="$(nix-prefetch-url "https://artifacts.plex.tv/web-client-pmp/${webClientBuildId}/web-client-tv-${webClientTvBuildId}.tar.xz")"
+
+  # update deps.nix
+  cat > $nixpkgs/pkgs/applications/video/plex-media-player/deps.nix <<EOF
+{ fetchurl }:
+
+rec {
+  webClientBuildId = "${webClientBuildId}";
+  webClientDesktopBuildId = "${webClientDesktopBuildId}";
+  webClientTvBuildId = "${webClientTvBuildId}";
+
+  webClient = fetchurl {
+    url = "https://artifacts.plex.tv/web-client-pmp/\${webClientBuildId}/buildid.cmake";
+    sha256 = "${webClientBuildIdHash}";
+  };
+  webClientDesktopHash = fetchurl {
+    url = "https://artifacts.plex.tv/web-client-pmp/\${webClientBuildId}/web-client-desktop-\${webClientDesktopBuildId}.tar.xz.sha1";
+    sha256 = "${webClientDesktopHash}";
+  };
+  webClientDesktop = fetchurl {
+    url = "https://artifacts.plex.tv/web-client-pmp/\${webClientBuildId}/web-client-desktop-\${webClientDesktopBuildId}.tar.xz";
+    sha256 = "${webClientDesktop}";
+  };
+  webClientTvHash = fetchurl {
+    url = "https://artifacts.plex.tv/web-client-pmp/\${webClientBuildId}/web-client-tv-\${webClientTvBuildId}.tar.xz.sha1";
+    sha256 = "${webClientTvHash}";
+  };
+  webClientTv = fetchurl {
+    url = "https://artifacts.plex.tv/web-client-pmp/\${webClientBuildId}/web-client-tv-\${webClientTvBuildId}.tar.xz";
+    sha256 = "${webClientTv}";
+  };
+}
+EOF
+
+  git add "$nixpkgs"/pkgs/applications/video/plex-media-player/{default,deps}.nix
+  git commit -m "plex-media-player: ${oldVersion} -> ${latestVersion}"
+else
+  echo "plex-media-player is already up-to-date"
+fi
diff --git a/pkgs/applications/virtualization/conmon/default.nix b/pkgs/applications/virtualization/conmon/default.nix
index b09911cf6e502..bfe9f1d34865f 100644
--- a/pkgs/applications/virtualization/conmon/default.nix
+++ b/pkgs/applications/virtualization/conmon/default.nix
@@ -18,10 +18,10 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ glib systemd ] ++
-    stdenv.lib.optionals (!stdenv.hostPlatform.isMusl) [ glibc glibc.static ];
+  buildInputs = [ glib systemd ]
+  ++ stdenv.lib.optionals (!stdenv.hostPlatform.isMusl) [ glibc glibc.static ];
 
-  installPhase = "install -Dm755 bin/${pname} $out/bin/${pname}";
+  installFlags = [ "PREFIX=$(out)" ];
 
   meta = with stdenv.lib; {
     homepage = "https://github.com/containers/conmon";
diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index 131d6d7675ed6..f1b3475d9bcae 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -1,7 +1,7 @@
 { stdenv, lib, fetchFromGitHub, makeWrapper, removeReferencesTo, pkgconfig
 , go-md2man, go, containerd, runc, docker-proxy, tini, libtool
 , sqlite, iproute, lvm2, systemd
-, btrfs-progs, iptables, e2fsprogs, xz, utillinux, xfsprogs
+, btrfs-progs, iptables, e2fsprogs, xz, utillinux, xfsprogs, git
 , procps, libseccomp
 }:
 
@@ -123,7 +123,7 @@ rec {
 
     outputs = ["out" "man"];
 
-    extraPath = optionals (stdenv.isLinux) (makeBinPath [ iproute iptables e2fsprogs xz xfsprogs procps utillinux ]);
+    extraPath = optionals (stdenv.isLinux) (makeBinPath [ iproute iptables e2fsprogs xz xfsprogs procps utillinux git ]);
 
     installPhase = optionalString (stdenv.isLinux) ''
       install -Dm755 ./components/engine/bundles/dynbinary-daemon/dockerd $out/libexec/docker/dockerd
diff --git a/pkgs/applications/virtualization/qtemu/default.nix b/pkgs/applications/virtualization/qtemu/default.nix
new file mode 100644
index 0000000000000..29f0004be830b
--- /dev/null
+++ b/pkgs/applications/virtualization/qtemu/default.nix
@@ -0,0 +1,45 @@
+{ stdenv, mkDerivation, fetchFromGitLab, pkgconfig, qmake, qtbase, qemu, makeWrapper }:
+
+mkDerivation rec {
+  pname = "qtemu";
+  version = "2.1";
+
+  src = fetchFromGitLab {
+    owner = "qtemu";
+    repo = "gui";
+    rev = version;
+    sha256 = "1555178mkfw0gwmw8bsxmg4339j2ifp0yb4b2f39nxh9hwshg07j";
+  };
+
+  nativeBuildInputs = [
+    qmake
+    pkgconfig
+  ];
+
+  buildInputs = [
+    qtbase
+    qemu
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    # upstream lacks an install method
+    install -D -t $out/share/applications qtemu.desktop
+    install -D -t $out/share/pixmaps qtemu.png
+    install -D -t $out/bin qtemu
+
+    # make sure that the qemu-* executables are found
+    wrapProgram $out/bin/qtemu --prefix PATH : ${stdenv.lib.makeBinPath [ qemu ]}
+
+    runHook postInstall
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Qt-based front-end for QEMU emulator";
+    homepage = "https://qtemu.org";
+    license = licenses.gpl2;
+    platforms = with platforms; linux;
+    maintainers = with maintainers; [ romildo ];
+  };
+}
diff --git a/pkgs/build-support/alternatives/blas/default.nix b/pkgs/build-support/alternatives/blas/default.nix
index b1dadf23c0781..36708ce8841a4 100644
--- a/pkgs/build-support/alternatives/blas/default.nix
+++ b/pkgs/build-support/alternatives/blas/default.nix
@@ -81,7 +81,7 @@ stdenv.mkDerivation {
   patchelf --set-rpath "$(patchelf --print-rpath $out/lib/libblas${canonicalExtension}):${lib.getLib blasProvider}/lib" $out/lib/libblas${canonicalExtension}
 '' else if stdenv.hostPlatform.isDarwin then ''
   install_name_tool \
-    -id libblas${canonicalExtension}
+    -id libblas${canonicalExtension} \
     -add_rpath ${lib.getLib blasProvider}/lib \
     $out/lib/libblas${canonicalExtension}
 '' else "") + ''
diff --git a/pkgs/common-updater/generic-updater.nix b/pkgs/common-updater/generic-updater.nix
index 8e8153d9a332b..e54363a1dda59 100644
--- a/pkgs/common-updater/generic-updater.nix
+++ b/pkgs/common-updater/generic-updater.nix
@@ -5,8 +5,8 @@
 , attrPath ? pname
 , versionLister
 , rev-prefix ? ""
-, odd-unstable ? true
-, patchlevel-unstable ? true
+, odd-unstable ? false
+, patchlevel-unstable ? false
 }:
 
 let
diff --git a/pkgs/data/documentation/gnome-user-docs/default.nix b/pkgs/data/documentation/gnome-user-docs/default.nix
index 07381a13e8008..36735ff99ae43 100644
--- a/pkgs/data/documentation/gnome-user-docs/default.nix
+++ b/pkgs/data/documentation/gnome-user-docs/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     description = "User and system administration help for the GNOME desktop";
     homepage = "https://help.gnome.org/users/gnome-help/";
     license = licenses.cc-by-30;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/data/fonts/fira/default.nix b/pkgs/data/fonts/fira/default.nix
index 23baee7cb9d9e..039c5099b56ea 100644
--- a/pkgs/data/fonts/fira/default.nix
+++ b/pkgs/data/fonts/fira/default.nix
@@ -1,7 +1,7 @@
 { lib, fetchFromGitHub }:
 
 let
-  version = "4.106";
+  version = "4.202";
 in fetchFromGitHub {
   name = "fira-${version}";
 
@@ -15,7 +15,7 @@ in fetchFromGitHub {
     cp otf/*.otf $out/share/fonts/opentype
   '';
 
-  sha256 = "0c97nmihcq0ki7ywj8zn048a2bgrszc61lb9p0djfi65ar52jab4";
+  sha256 = "1iwxbp7kw5kghh5nbycb05zby7p2ib61mywva3h6giv2wd4lpxnz";
 
   meta = with lib; {
     homepage = "https://mozilla.github.io/Fira/";
diff --git a/pkgs/desktops/gnome-3/apps/accerciser/default.nix b/pkgs/desktops/gnome-3/apps/accerciser/default.nix
index 05c5b96242cfc..f068d1994ec4d 100644
--- a/pkgs/desktops/gnome-3/apps/accerciser/default.nix
+++ b/pkgs/desktops/gnome-3/apps/accerciser/default.nix
@@ -66,7 +66,7 @@
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Accerciser";
     description = "Interactive Python accessibility explorer";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.bsd3;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/apps/cheese/default.nix b/pkgs/desktops/gnome-3/apps/cheese/default.nix
index 8143532a5f292..05a1cdbc088e4 100644
--- a/pkgs/desktops/gnome-3/apps/cheese/default.nix
+++ b/pkgs/desktops/gnome-3/apps/cheese/default.nix
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Cheese";
     description = "Take photos and videos with your webcam, with fun graphical effects";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl3;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/apps/evolution/default.nix b/pkgs/desktops/gnome-3/apps/evolution/default.nix
index 8429b060bea6e..c1901110b5854 100644
--- a/pkgs/desktops/gnome-3/apps/evolution/default.nix
+++ b/pkgs/desktops/gnome-3/apps/evolution/default.nix
@@ -127,7 +127,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Evolution";
     description = "Personal information management application that provides integrated mail, calendaring and address book functionality";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.lgpl2Plus;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/apps/file-roller/default.nix b/pkgs/desktops/gnome-3/apps/file-roller/default.nix
index 9e8dcf2a54707..1243d5fa5cb62 100644
--- a/pkgs/desktops/gnome-3/apps/file-roller/default.nix
+++ b/pkgs/desktops/gnome-3/apps/file-roller/default.nix
@@ -36,6 +36,6 @@ stdenv.mkDerivation rec {
     description = "Archive manager for the GNOME desktop environment";
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
   };
 }
diff --git a/pkgs/desktops/gnome-3/apps/gedit/default.nix b/pkgs/desktops/gnome-3/apps/gedit/default.nix
index dd73f6b11ed81..c6b28e86ab83b 100644
--- a/pkgs/desktops/gnome-3/apps/gedit/default.nix
+++ b/pkgs/desktops/gnome-3/apps/gedit/default.nix
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Gedit";
     description = "Official text editor of the GNOME desktop environment";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.unix;
   };
diff --git a/pkgs/desktops/gnome-3/apps/ghex/default.nix b/pkgs/desktops/gnome-3/apps/ghex/default.nix
index 4a3b6068c1373..7de5ffc1add05 100644
--- a/pkgs/desktops/gnome-3/apps/ghex/default.nix
+++ b/pkgs/desktops/gnome-3/apps/ghex/default.nix
@@ -79,6 +79,6 @@ stdenv.mkDerivation rec {
     description = "Hex editor for GNOME desktop environment";
     platforms = platforms.unix;
     license = licenses.gpl2Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
   };
 }
diff --git a/pkgs/desktops/gnome-3/apps/glade/default.nix b/pkgs/desktops/gnome-3/apps/glade/default.nix
index 7449e22d69d6f..23f5410e1eaa6 100644
--- a/pkgs/desktops/gnome-3/apps/glade/default.nix
+++ b/pkgs/desktops/gnome-3/apps/glade/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Glade";
     description = "User interface designer for GTK applications";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.lgpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/apps/gnome-books/default.nix b/pkgs/desktops/gnome-3/apps/gnome-books/default.nix
index 448c352fe0d30..7432e8e96ed23 100644
--- a/pkgs/desktops/gnome-3/apps/gnome-books/default.nix
+++ b/pkgs/desktops/gnome-3/apps/gnome-books/default.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Books";
     description = "An e-book manager application for GNOME";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/apps/gnome-boxes/default.nix b/pkgs/desktops/gnome-3/apps/gnome-boxes/default.nix
index 396ce9aad9349..3d6832316cdca 100644
--- a/pkgs/desktops/gnome-3/apps/gnome-boxes/default.nix
+++ b/pkgs/desktops/gnome-3/apps/gnome-boxes/default.nix
@@ -136,6 +136,6 @@ stdenv.mkDerivation rec {
     homepage = "https://wiki.gnome.org/Apps/Boxes";
     license = licenses.gpl3;
     platforms = platforms.linux;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
   };
 }
diff --git a/pkgs/desktops/gnome-3/apps/gnome-calendar/default.nix b/pkgs/desktops/gnome-3/apps/gnome-calendar/default.nix
index 5db617b76af7e..213b4f6167217 100644
--- a/pkgs/desktops/gnome-3/apps/gnome-calendar/default.nix
+++ b/pkgs/desktops/gnome-3/apps/gnome-calendar/default.nix
@@ -34,7 +34,7 @@ in stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Calendar";
     description = "Simple and beautiful calendar application for GNOME";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl3;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/apps/gnome-characters/default.nix b/pkgs/desktops/gnome-3/apps/gnome-characters/default.nix
index fa9a7b003c3cf..987fa594ae527 100644
--- a/pkgs/desktops/gnome-3/apps/gnome-characters/default.nix
+++ b/pkgs/desktops/gnome-3/apps/gnome-characters/default.nix
@@ -78,7 +78,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Design/Apps/CharacterMap";
     description = "Simple utility application to find and insert unusual characters";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/apps/gnome-clocks/default.nix b/pkgs/desktops/gnome-3/apps/gnome-clocks/default.nix
index 3cd3c3146d9ec..7494d66cc0d9b 100644
--- a/pkgs/desktops/gnome-3/apps/gnome-clocks/default.nix
+++ b/pkgs/desktops/gnome-3/apps/gnome-clocks/default.nix
@@ -79,7 +79,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Clocks";
     description = "Clock application designed for GNOME 3";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/apps/gnome-documents/default.nix b/pkgs/desktops/gnome-3/apps/gnome-documents/default.nix
index 5aa39e09cd6fa..8d5501537a0ff 100644
--- a/pkgs/desktops/gnome-3/apps/gnome-documents/default.nix
+++ b/pkgs/desktops/gnome-3/apps/gnome-documents/default.nix
@@ -102,7 +102,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Documents";
     description = "Document manager application designed to work with GNOME 3";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/apps/gnome-getting-started-docs/default.nix b/pkgs/desktops/gnome-3/apps/gnome-getting-started-docs/default.nix
index 2e0b1593b91c3..5d31a42301e4b 100644
--- a/pkgs/desktops/gnome-3/apps/gnome-getting-started-docs/default.nix
+++ b/pkgs/desktops/gnome-3/apps/gnome-getting-started-docs/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://live.gnome.org/DocumentationProject";
     description = "Help a new user get started in GNOME";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.cc-by-sa-30;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/apps/gnome-logs/default.nix b/pkgs/desktops/gnome-3/apps/gnome-logs/default.nix
index c254c1d60603f..7eda4a706cab9 100644
--- a/pkgs/desktops/gnome-3/apps/gnome-logs/default.nix
+++ b/pkgs/desktops/gnome-3/apps/gnome-logs/default.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Logs";
     description = "A log viewer for the systemd journal";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl3;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/apps/gnome-maps/default.nix b/pkgs/desktops/gnome-3/apps/gnome-maps/default.nix
index 18251cad24201..b00c6f5dd4ebb 100644
--- a/pkgs/desktops/gnome-3/apps/gnome-maps/default.nix
+++ b/pkgs/desktops/gnome-3/apps/gnome-maps/default.nix
@@ -50,7 +50,7 @@ in stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Maps";
     description = "A map application for GNOME 3";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/apps/gnome-music/default.nix b/pkgs/desktops/gnome-3/apps/gnome-music/default.nix
index 2a4c5026ed294..9de452404ce02 100644
--- a/pkgs/desktops/gnome-3/apps/gnome-music/default.nix
+++ b/pkgs/desktops/gnome-3/apps/gnome-music/default.nix
@@ -103,7 +103,7 @@ python3.pkgs.buildPythonApplication rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Music";
     description = "Music player and management application for the GNOME desktop environment";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/apps/gnome-nettool/default.nix b/pkgs/desktops/gnome-3/apps/gnome-nettool/default.nix
index 37401af3ce602..88072912b6630 100644
--- a/pkgs/desktops/gnome-3/apps/gnome-nettool/default.nix
+++ b/pkgs/desktops/gnome-3/apps/gnome-nettool/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://gitlab.gnome.org/GNOME/gnome-nettool";
     description = "A collection of networking tools";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/apps/gnome-notes/default.nix b/pkgs/desktops/gnome-3/apps/gnome-notes/default.nix
index 5ae1ed1220b9e..03edd5c9bfe9f 100644
--- a/pkgs/desktops/gnome-3/apps/gnome-notes/default.nix
+++ b/pkgs/desktops/gnome-3/apps/gnome-notes/default.nix
@@ -83,7 +83,7 @@ stdenv.mkDerivation {
     description = "Note editor designed to remain simple to use";
     homepage = "https://wiki.gnome.org/Apps/Notes";
     license = licenses.gpl3;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/desktops/gnome-3/apps/gnome-power-manager/default.nix b/pkgs/desktops/gnome-3/apps/gnome-power-manager/default.nix
index 141eb79e5f046..4a92052763efa 100644
--- a/pkgs/desktops/gnome-3/apps/gnome-power-manager/default.nix
+++ b/pkgs/desktops/gnome-3/apps/gnome-power-manager/default.nix
@@ -53,7 +53,7 @@ in stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://projects-old.gnome.org/gnome-power-manager/";
     description = "View battery and power statistics provided by UPower";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/apps/gnome-sound-recorder/default.nix b/pkgs/desktops/gnome-3/apps/gnome-sound-recorder/default.nix
index 354fc75004e66..f4a72fdfb482d 100644
--- a/pkgs/desktops/gnome-3/apps/gnome-sound-recorder/default.nix
+++ b/pkgs/desktops/gnome-3/apps/gnome-sound-recorder/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     description = "A simple and modern sound recorder";
     homepage = "https://wiki.gnome.org/Apps/SoundRecorder";
     license = licenses.gpl2Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/desktops/gnome-3/apps/gnome-todo/default.nix b/pkgs/desktops/gnome-3/apps/gnome-todo/default.nix
index a26f328b45f4f..d837ce3968e49 100644
--- a/pkgs/desktops/gnome-3/apps/gnome-todo/default.nix
+++ b/pkgs/desktops/gnome-3/apps/gnome-todo/default.nix
@@ -83,7 +83,7 @@ stdenv.mkDerivation rec {
     description = "Personal task manager for GNOME";
     homepage = "https://wiki.gnome.org/Apps/Todo";
     license = licenses.gpl3Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/desktops/gnome-3/apps/gnome-weather/default.nix b/pkgs/desktops/gnome-3/apps/gnome-weather/default.nix
index 989521d95dcd0..407f25165327b 100644
--- a/pkgs/desktops/gnome-3/apps/gnome-weather/default.nix
+++ b/pkgs/desktops/gnome-3/apps/gnome-weather/default.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Weather";
     description = "Access current weather conditions and forecasts";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/apps/polari/default.nix b/pkgs/desktops/gnome-3/apps/polari/default.nix
index 0f5326ea0055b..394ee86d15a73 100644
--- a/pkgs/desktops/gnome-3/apps/polari/default.nix
+++ b/pkgs/desktops/gnome-3/apps/polari/default.nix
@@ -47,7 +47,7 @@ in stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Polari";
     description = "IRC chat client designed to integrate with the GNOME desktop";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/apps/seahorse/default.nix b/pkgs/desktops/gnome-3/apps/seahorse/default.nix
index 6789aded2e55c..ec6791e323111 100644
--- a/pkgs/desktops/gnome-3/apps/seahorse/default.nix
+++ b/pkgs/desktops/gnome-3/apps/seahorse/default.nix
@@ -78,7 +78,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Seahorse";
     description = "Application for managing encryption keys and passwords in the GnomeKeyring";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/apps/vinagre/default.nix b/pkgs/desktops/gnome-3/apps/vinagre/default.nix
index 18e180305fca4..e04238b4b16fb 100644
--- a/pkgs/desktops/gnome-3/apps/vinagre/default.nix
+++ b/pkgs/desktops/gnome-3/apps/vinagre/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     description = "Remote desktop viewer for GNOME";
     homepage = "https://wiki.gnome.org/Apps/Vinagre";
     license = licenses.gpl2Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/desktops/gnome-3/core/adwaita-icon-theme/default.nix b/pkgs/desktops/gnome-3/core/adwaita-icon-theme/default.nix
index 1fe5b6fb89712..6eafa874b8361 100644
--- a/pkgs/desktops/gnome-3/core/adwaita-icon-theme/default.nix
+++ b/pkgs/desktops/gnome-3/core/adwaita-icon-theme/default.nix
@@ -29,6 +29,6 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     platforms = with platforms; linux ++ darwin;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
   };
 }
diff --git a/pkgs/desktops/gnome-3/core/baobab/default.nix b/pkgs/desktops/gnome-3/core/baobab/default.nix
index a33a7cd55cc48..af39d3a3c053e 100644
--- a/pkgs/desktops/gnome-3/core/baobab/default.nix
+++ b/pkgs/desktops/gnome-3/core/baobab/default.nix
@@ -28,7 +28,7 @@ in stdenv.mkDerivation rec {
     description = "Graphical application to analyse disk usage in any GNOME environment";
     homepage = "https://wiki.gnome.org/Apps/DiskUsageAnalyzer";
     license = licenses.gpl2;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/desktops/gnome-3/core/caribou/default.nix b/pkgs/desktops/gnome-3/core/caribou/default.nix
index 5a44cac3fdf14..b9da1ab1c163a 100644
--- a/pkgs/desktops/gnome-3/core/caribou/default.nix
+++ b/pkgs/desktops/gnome-3/core/caribou/default.nix
@@ -48,7 +48,7 @@ in stdenv.mkDerivation rec {
     description = "An input assistive technology intended for switch and pointer users";
     homepage = "https://wiki.gnome.org/Projects/Caribou";
     license = licenses.lgpl21;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/desktops/gnome-3/core/dconf-editor/default.nix b/pkgs/desktops/gnome-3/core/dconf-editor/default.nix
index 45c3185bc2979..ba8a85352fd07 100644
--- a/pkgs/desktops/gnome-3/core/dconf-editor/default.nix
+++ b/pkgs/desktops/gnome-3/core/dconf-editor/default.nix
@@ -33,6 +33,6 @@ in stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     platforms = platforms.linux;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
   };
 }
diff --git a/pkgs/desktops/gnome-3/core/empathy/default.nix b/pkgs/desktops/gnome-3/core/empathy/default.nix
index fed6c747f1991..83c1f5d4a56f4 100644
--- a/pkgs/desktops/gnome-3/core/empathy/default.nix
+++ b/pkgs/desktops/gnome-3/core/empathy/default.nix
@@ -140,7 +140,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Empathy";
     description = "Messaging program which supports text, voice, video chat, and file transfers over many different protocols";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = [ licenses.gpl2 ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/core/eog/default.nix b/pkgs/desktops/gnome-3/core/eog/default.nix
index 65fefbd23c323..d7a4b32f785cc 100644
--- a/pkgs/desktops/gnome-3/core/eog/default.nix
+++ b/pkgs/desktops/gnome-3/core/eog/default.nix
@@ -45,7 +45,7 @@ in stdenv.mkDerivation rec {
     description = "GNOME image viewer";
     homepage = "https://wiki.gnome.org/Apps/EyeOfGnome";
     license = licenses.gpl2Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/desktops/gnome-3/core/epiphany/default.nix b/pkgs/desktops/gnome-3/core/epiphany/default.nix
index 33fdb05172f8f..5ede0184d219d 100644
--- a/pkgs/desktops/gnome-3/core/epiphany/default.nix
+++ b/pkgs/desktops/gnome-3/core/epiphany/default.nix
@@ -103,7 +103,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Epiphany";
     description = "WebKit based web browser for GNOME";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/core/evince/default.nix b/pkgs/desktops/gnome-3/core/evince/default.nix
index 40bee972fe5dc..2852c816e4b5c 100644
--- a/pkgs/desktops/gnome-3/core/evince/default.nix
+++ b/pkgs/desktops/gnome-3/core/evince/default.nix
@@ -128,6 +128,6 @@ stdenv.mkDerivation rec {
 
     license = stdenv.lib.licenses.gpl2Plus;
     platforms = platforms.linux;
-    maintainers = gnome3.maintainers ++ [ maintainers.vcunat ];
+    maintainers = teams.gnome.members ++ [ maintainers.vcunat ];
   };
 }
diff --git a/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix b/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix
index 1a511cc9d39fd..f5d60ee917ce3 100644
--- a/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix
+++ b/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix
@@ -58,7 +58,7 @@ stdenv.mkDerivation rec {
     description = "Unified backend for programs that work with contacts, tasks, and calendar information";
     homepage = "https://wiki.gnome.org/Apps/Evolution";
     license = licenses.lgpl2;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/desktops/gnome-3/core/gdm/default.nix b/pkgs/desktops/gnome-3/core/gdm/default.nix
index 5ead4539ff188..58c898a5f0dd9 100644
--- a/pkgs/desktops/gnome-3/core/gdm/default.nix
+++ b/pkgs/desktops/gnome-3/core/gdm/default.nix
@@ -97,7 +97,7 @@ stdenv.mkDerivation rec {
     description = "A program that manages graphical display servers and handles graphical user logins";
     homepage = "https://wiki.gnome.org/Projects/GDM";
     license = licenses.gpl2Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/desktops/gnome-3/core/gnome-backgrounds/default.nix b/pkgs/desktops/gnome-3/core/gnome-backgrounds/default.nix
index 518b86adf7f95..e8463c5b704ec 100644
--- a/pkgs/desktops/gnome-3/core/gnome-backgrounds/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-backgrounds/default.nix
@@ -17,6 +17,6 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     platforms = platforms.unix;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
   };
 }
diff --git a/pkgs/desktops/gnome-3/core/gnome-bluetooth/default.nix b/pkgs/desktops/gnome-3/core/gnome-bluetooth/default.nix
index 79c2505de7b75..ed647bb87d812 100644
--- a/pkgs/desktops/gnome-3/core/gnome-bluetooth/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-bluetooth/default.nix
@@ -45,7 +45,7 @@ in stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://help.gnome.org/users/gnome-bluetooth/stable/index.html.en";
     description = "Application that let you manage Bluetooth in the GNOME destkop";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/core/gnome-calculator/default.nix b/pkgs/desktops/gnome-3/core/gnome-calculator/default.nix
index 7705f43aae93f..e14d8d136cd86 100644
--- a/pkgs/desktops/gnome-3/core/gnome-calculator/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-calculator/default.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Calculator";
     description = "Application that solves mathematical equations and is suitable as a default application in a Desktop environment";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl3;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/core/gnome-color-manager/default.nix b/pkgs/desktops/gnome-3/core/gnome-color-manager/default.nix
index 341fd13bfa739..69655e2364d30 100644
--- a/pkgs/desktops/gnome-3/core/gnome-color-manager/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-color-manager/default.nix
@@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     description = "A set of graphical utilities for color management to be used in the GNOME desktop";
     license = licenses.gpl2Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/desktops/gnome-3/core/gnome-common/default.nix b/pkgs/desktops/gnome-3/core/gnome-common/default.nix
index f2eb65e50bbf9..fb0b0f875440f 100644
--- a/pkgs/desktops/gnome-3/core/gnome-common/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-common/default.nix
@@ -22,6 +22,6 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs = [ which autoconf automake ]; # autogen.sh which is using gnome-common tends to require which
 
   meta = with stdenv.lib; {
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
   };
 }
diff --git a/pkgs/desktops/gnome-3/core/gnome-contacts/default.nix b/pkgs/desktops/gnome-3/core/gnome-contacts/default.nix
index ac51b33fee85e..97abd746e1b9b 100644
--- a/pkgs/desktops/gnome-3/core/gnome-contacts/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-contacts/default.nix
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Contacts";
     description = "GNOME’s integrated address book";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/core/gnome-control-center/default.nix b/pkgs/desktops/gnome-3/core/gnome-control-center/default.nix
index 00f5ff5cd7a6b..e4efcae889a4f 100644
--- a/pkgs/desktops/gnome-3/core/gnome-control-center/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-control-center/default.nix
@@ -178,7 +178,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     description = "Utilities to configure the GNOME desktop";
     license = licenses.gpl2Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/desktops/gnome-3/core/gnome-desktop/default.nix b/pkgs/desktops/gnome-3/core/gnome-desktop/default.nix
index 213cb890ef6d6..3f84d0ccd559f 100644
--- a/pkgs/desktops/gnome-3/core/gnome-desktop/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-desktop/default.nix
@@ -48,6 +48,6 @@ stdenv.mkDerivation rec {
     description = "Library with common API for various GNOME modules";
     license = with licenses; [ gpl2 lgpl2 ];
     platforms = platforms.linux;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
   };
 }
diff --git a/pkgs/desktops/gnome-3/core/gnome-dictionary/default.nix b/pkgs/desktops/gnome-3/core/gnome-dictionary/default.nix
index 5869adeca7162..a19f0b6a276e6 100644
--- a/pkgs/desktops/gnome-3/core/gnome-dictionary/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-dictionary/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Dictionary";
     description = "Dictionary is the GNOME application to look up definitions";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/core/gnome-disk-utility/default.nix b/pkgs/desktops/gnome-3/core/gnome-disk-utility/default.nix
index 13261aece4837..a7f66e68eeff0 100644
--- a/pkgs/desktops/gnome-3/core/gnome-disk-utility/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-disk-utility/default.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://en.wikipedia.org/wiki/GNOME_Disks";
     description = "A udisks graphical front-end";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/core/gnome-font-viewer/default.nix b/pkgs/desktops/gnome-3/core/gnome-font-viewer/default.nix
index 0589dfe728540..d0ceef61c25a2 100644
--- a/pkgs/desktops/gnome-3/core/gnome-font-viewer/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-font-viewer/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Program that can preview fonts and create thumbnails for fonts";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/core/gnome-initial-setup/default.nix b/pkgs/desktops/gnome-3/core/gnome-initial-setup/default.nix
index 67d5c11ae9f9c..e5277b07ad5c9 100644
--- a/pkgs/desktops/gnome-3/core/gnome-initial-setup/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-initial-setup/default.nix
@@ -103,6 +103,6 @@ stdenv.mkDerivation rec {
     homepage = "https://gitlab.gnome.org/GNOME/gnome-initial-setup";
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
   };
 }
diff --git a/pkgs/desktops/gnome-3/core/gnome-keyring/default.nix b/pkgs/desktops/gnome-3/core/gnome-keyring/default.nix
index 49fba3cf65935..9ffd32e85f704 100644
--- a/pkgs/desktops/gnome-3/core/gnome-keyring/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-keyring/default.nix
@@ -67,7 +67,7 @@ stdenv.mkDerivation rec {
     description = "Collection of components in GNOME that store secrets, passwords, keys, certificates and make them available to applications";
     homepage = "https://wiki.gnome.org/Projects/GnomeKeyring";
     license = licenses.gpl2;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/desktops/gnome-3/core/gnome-online-miners/default.nix b/pkgs/desktops/gnome-3/core/gnome-online-miners/default.nix
index f238b695990e0..ede2f2792483c 100644
--- a/pkgs/desktops/gnome-3/core/gnome-online-miners/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-online-miners/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Projects/GnomeOnlineMiners";
     description = "A set of crawlers that go through your online content and index them locally in Tracker";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/core/gnome-remote-desktop/default.nix b/pkgs/desktops/gnome-3/core/gnome-remote-desktop/default.nix
index 42e029e72d43a..a77aee4b890cc 100644
--- a/pkgs/desktops/gnome-3/core/gnome-remote-desktop/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-remote-desktop/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitLab, meson, ninja, pkgconfig, python3, wrapGAppsHook
-, glib, pipewire, systemd, libvncserver, libsecret, libnotify, gdk-pixbuf, gnome3 }:
+, glib, pipewire, systemd, libvncserver, libsecret, libnotify, gdk-pixbuf }:
 
 stdenv.mkDerivation rec {
   pname = "gnome-remote-desktop";
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Projects/Mutter/RemoteDesktop";
     description = "GNOME Remote Desktop server";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/core/gnome-screenshot/default.nix b/pkgs/desktops/gnome-3/core/gnome-screenshot/default.nix
index 66dd5ad5effd9..2eacfc2de7771 100644
--- a/pkgs/desktops/gnome-3/core/gnome-screenshot/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-screenshot/default.nix
@@ -36,7 +36,7 @@ in stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://en.wikipedia.org/wiki/GNOME_Screenshot";
     description = "Utility used in the GNOME desktop environment for taking screenshots";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/core/gnome-session/default.nix b/pkgs/desktops/gnome-3/core/gnome-session/default.nix
index 697919991eedd..b25688ea5a9d0 100644
--- a/pkgs/desktops/gnome-3/core/gnome-session/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-session/default.nix
@@ -73,7 +73,7 @@ stdenv.mkDerivation rec {
     description = "GNOME session manager";
     homepage = "https://wiki.gnome.org/Projects/SessionManagement";
     license = licenses.gpl2Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/desktops/gnome-3/core/gnome-settings-daemon/default.nix b/pkgs/desktops/gnome-3/core/gnome-settings-daemon/default.nix
index c4b1ab867c7d5..6ff33660dc2b2 100644
--- a/pkgs/desktops/gnome-3/core/gnome-settings-daemon/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-settings-daemon/default.nix
@@ -118,7 +118,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     license = licenses.gpl2Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/desktops/gnome-3/core/gnome-shell-extensions/default.nix b/pkgs/desktops/gnome-3/core/gnome-shell-extensions/default.nix
index cb12402dcf8e3..c298d8b337fbf 100644
--- a/pkgs/desktops/gnome-3/core/gnome-shell-extensions/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-shell-extensions/default.nix
@@ -58,7 +58,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Projects/GnomeShell/Extensions";
     description = "Modify and extend GNOME Shell functionality and behavior";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/core/gnome-shell/default.nix b/pkgs/desktops/gnome-3/core/gnome-shell/default.nix
index bcb72cb95b691..864dd45aad202 100644
--- a/pkgs/desktops/gnome-3/core/gnome-shell/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-shell/default.nix
@@ -119,7 +119,7 @@ in stdenv.mkDerivation rec {
     description = "Core user interface for the GNOME 3 desktop";
     homepage = "https://wiki.gnome.org/Projects/GnomeShell";
     license = licenses.gpl2Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 
diff --git a/pkgs/desktops/gnome-3/core/gnome-software/default.nix b/pkgs/desktops/gnome-3/core/gnome-software/default.nix
index acf6210d91624..46201629ce7ab 100644
--- a/pkgs/desktops/gnome-3/core/gnome-software/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-software/default.nix
@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
     description = "Software store that lets you install and update applications and system extensions";
     homepage = "https://wiki.gnome.org/Apps/Software";
     license = licenses.gpl2;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/desktops/gnome-3/core/gnome-system-monitor/default.nix b/pkgs/desktops/gnome-3/core/gnome-system-monitor/default.nix
index 63df741b9eb75..82ec3c9a9d766 100644
--- a/pkgs/desktops/gnome-3/core/gnome-system-monitor/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-system-monitor/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/SystemMonitor";
     description = "System Monitor shows you what programs are running and how much processor time, memory, and disk space are being used";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/core/gnome-terminal/default.nix b/pkgs/desktops/gnome-3/core/gnome-terminal/default.nix
index 720976091bde1..6a90bb7657ac1 100644
--- a/pkgs/desktops/gnome-3/core/gnome-terminal/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-terminal/default.nix
@@ -45,6 +45,6 @@ stdenv.mkDerivation rec {
     homepage = "https://wiki.gnome.org/Apps/Terminal";
     platforms = platforms.linux;
     license = licenses.gpl3Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
   };
 }
diff --git a/pkgs/desktops/gnome-3/core/gnome-themes-extra/default.nix b/pkgs/desktops/gnome-3/core/gnome-themes-extra/default.nix
index 5cd8f24948157..9cbac8c742772 100644
--- a/pkgs/desktops/gnome-3/core/gnome-themes-extra/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-themes-extra/default.nix
@@ -27,6 +27,6 @@ in stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     platforms = platforms.linux;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
   };
 }
diff --git a/pkgs/desktops/gnome-3/core/gnome-tour/default.nix b/pkgs/desktops/gnome-3/core/gnome-tour/default.nix
index 108ff9afca701..719e97647f7a5 100644
--- a/pkgs/desktops/gnome-3/core/gnome-tour/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-tour/default.nix
@@ -74,7 +74,7 @@ rustPlatform.buildRustPackage rec {
   meta = with stdenv.lib; {
     homepage = "https://gitlab.gnome.org/GNOME/gnome-tour";
     description = "GNOME Greeter & Tour";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/core/gnome-user-share/default.nix b/pkgs/desktops/gnome-3/core/gnome-user-share/default.nix
index 9e7f5bb6319b9..90acee076a342 100644
--- a/pkgs/desktops/gnome-3/core/gnome-user-share/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-user-share/default.nix
@@ -89,7 +89,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://help.gnome.org/users/gnome-user-share/3.8";
     description = "Service that exports the contents of the Public folder in your home directory on the local network";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/core/gucharmap/default.nix b/pkgs/desktops/gnome-3/core/gucharmap/default.nix
index b6e8b4c11c03f..927d70345e77f 100644
--- a/pkgs/desktops/gnome-3/core/gucharmap/default.nix
+++ b/pkgs/desktops/gnome-3/core/gucharmap/default.nix
@@ -102,7 +102,7 @@ in stdenv.mkDerivation rec {
     description = "GNOME Character Map, based on the Unicode Character Database";
     homepage = "https://wiki.gnome.org/Apps/Gucharmap";
     license = licenses.gpl3;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/desktops/gnome-3/core/mutter/default.nix b/pkgs/desktops/gnome-3/core/mutter/default.nix
index e33e17568c8fb..9edb36156d197 100644
--- a/pkgs/desktops/gnome-3/core/mutter/default.nix
+++ b/pkgs/desktops/gnome-3/core/mutter/default.nix
@@ -142,7 +142,7 @@ stdenv.mkDerivation rec {
     description = "A window manager for GNOME";
     homepage = "https://gitlab.gnome.org/GNOME/mutter";
     license = licenses.gpl2;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/desktops/gnome-3/core/nautilus/default.nix b/pkgs/desktops/gnome-3/core/nautilus/default.nix
index db7460ce60dca..9914489ad2571 100644
--- a/pkgs/desktops/gnome-3/core/nautilus/default.nix
+++ b/pkgs/desktops/gnome-3/core/nautilus/default.nix
@@ -102,6 +102,6 @@ stdenv.mkDerivation rec {
     homepage = "https://wiki.gnome.org/Apps/Files";
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
   };
 }
diff --git a/pkgs/desktops/gnome-3/core/rygel/default.nix b/pkgs/desktops/gnome-3/core/rygel/default.nix
index f36bf5a6c28b6..1ace6a5f77726 100644
--- a/pkgs/desktops/gnome-3/core/rygel/default.nix
+++ b/pkgs/desktops/gnome-3/core/rygel/default.nix
@@ -100,7 +100,7 @@ stdenv.mkDerivation rec {
     description = "A home media solution (UPnP AV MediaServer) that allows you to easily share audio, video and pictures to other devices";
     homepage = "https://wiki.gnome.org/Projects/Rygel";
     license = licenses.lgpl21Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/desktops/gnome-3/core/simple-scan/default.nix b/pkgs/desktops/gnome-3/core/simple-scan/default.nix
index 8af5084701020..99e5975eb5dea 100644
--- a/pkgs/desktops/gnome-3/core/simple-scan/default.nix
+++ b/pkgs/desktops/gnome-3/core/simple-scan/default.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
     '';
     homepage = "https://gitlab.gnome.org/GNOME/simple-scan";
     license = licenses.gpl3Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/desktops/gnome-3/core/sushi/default.nix b/pkgs/desktops/gnome-3/core/sushi/default.nix
index 2d6d398fb4597..4bdc409d81664 100644
--- a/pkgs/desktops/gnome-3/core/sushi/default.nix
+++ b/pkgs/desktops/gnome-3/core/sushi/default.nix
@@ -79,7 +79,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://en.wikipedia.org/wiki/Sushi_(software)";
     description = "A quick previewer for Nautilus";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/core/totem/default.nix b/pkgs/desktops/gnome-3/core/totem/default.nix
index efe11c967bb4f..50ab50e58b2c9 100644
--- a/pkgs/desktops/gnome-3/core/totem/default.nix
+++ b/pkgs/desktops/gnome-3/core/totem/default.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Videos";
     description = "Movie player for the GNOME desktop based on GStreamer";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/core/yelp-xsl/default.nix b/pkgs/desktops/gnome-3/core/yelp-xsl/default.nix
index 05699586f8281..09019e6758c1c 100644
--- a/pkgs/desktops/gnome-3/core/yelp-xsl/default.nix
+++ b/pkgs/desktops/gnome-3/core/yelp-xsl/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Yelp";
     description = "Yelp's universal stylesheets for Mallard and DocBook";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = [licenses.gpl2 licenses.lgpl2];
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/core/yelp/default.nix b/pkgs/desktops/gnome-3/core/yelp/default.nix
index 2c9f6e5a243dd..1235447c032a1 100644
--- a/pkgs/desktops/gnome-3/core/yelp/default.nix
+++ b/pkgs/desktops/gnome-3/core/yelp/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Yelp";
     description = "The help viewer in Gnome";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/core/zenity/default.nix b/pkgs/desktops/gnome-3/core/zenity/default.nix
index 16ef06d8d9dfe..5750fa0d001c4 100644
--- a/pkgs/desktops/gnome-3/core/zenity/default.nix
+++ b/pkgs/desktops/gnome-3/core/zenity/default.nix
@@ -45,6 +45,6 @@ stdenv.mkDerivation rec {
     description = "Tool to display dialogs from the commandline and shell scripts";
     homepage = "https://wiki.gnome.org/Projects/Zenity";
     platforms = platforms.linux;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
   };
 }
diff --git a/pkgs/desktops/gnome-3/default.nix b/pkgs/desktops/gnome-3/default.nix
index 25a8ba6573ab1..9d34fc0f40c63 100644
--- a/pkgs/desktops/gnome-3/default.nix
+++ b/pkgs/desktops/gnome-3/default.nix
@@ -18,8 +18,6 @@ lib.makeScope pkgs.newScope (self: with self; {
     in
       lib.filter (x: !(builtins.elem (lib.getName x) namesToRemove)) packages;
 
-  maintainers = lib.teams.gnome.members;
-
   libsoup = pkgs.libsoup.override { gnomeSupport = true; };
   libchamplain = pkgs.libchamplain.override { libsoup = libsoup; };
   gnome3 = self // { recurseForDerivations = false; };
@@ -358,5 +356,7 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   gnome-screensaver = throw "gnome-screensaver is deprecated. If you are using GNOME Flashback, it now has a built-in lock screen. If you are using it elsewhere, you can try xscreenlock or other alternatives."; # added 2020-03-19
 
+  maintainers = lib.teams.gnome.members;
+
   mutter328 = throw "Removed as Pantheon is upgraded to mutter334.";
 })
diff --git a/pkgs/desktops/gnome-3/devtools/devhelp/default.nix b/pkgs/desktops/gnome-3/devtools/devhelp/default.nix
index 1a6acbd461360..fa53b05c44b60 100644
--- a/pkgs/desktops/gnome-3/devtools/devhelp/default.nix
+++ b/pkgs/desktops/gnome-3/devtools/devhelp/default.nix
@@ -74,7 +74,7 @@ stdenv.mkDerivation rec {
     description = "API documentation browser for GNOME";
     homepage = "https://wiki.gnome.org/Apps/Devhelp";
     license = licenses.gpl3Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/desktops/gnome-3/devtools/gnome-devel-docs/default.nix b/pkgs/desktops/gnome-3/devtools/gnome-devel-docs/default.nix
index 0bb1fbc79ffb8..3a53e592b5fc6 100644
--- a/pkgs/desktops/gnome-3/devtools/gnome-devel-docs/default.nix
+++ b/pkgs/desktops/gnome-3/devtools/gnome-devel-docs/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://github.com/GNOME/gnome-devel-docs";
     description = "Developer documentation for GNOME";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.fdl12;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/extensions/chrome-gnome-shell/default.nix b/pkgs/desktops/gnome-3/extensions/chrome-gnome-shell/default.nix
index edaced3579d28..1e3815705cd38 100644
--- a/pkgs/desktops/gnome-3/extensions/chrome-gnome-shell/default.nix
+++ b/pkgs/desktops/gnome-3/extensions/chrome-gnome-shell/default.nix
@@ -38,7 +38,7 @@ in stdenv.mkDerivation rec {
       To use the integration, install the <link xlink:href="https://wiki.gnome.org/Projects/GnomeShellIntegrationForChrome/Installation">browser extension</link>, and then set <option>services.gnome3.chrome-gnome-shell.enable</option> to <literal>true</literal>.
     '';
     license = licenses.gpl3;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/desktops/gnome-3/games/aisleriot/default.nix b/pkgs/desktops/gnome-3/games/aisleriot/default.nix
index ff463b104e227..e4de15c79b292 100644
--- a/pkgs/desktops/gnome-3/games/aisleriot/default.nix
+++ b/pkgs/desktops/gnome-3/games/aisleriot/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Aisleriot";
     description = "A collection of patience games written in guile scheme";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/games/atomix/default.nix b/pkgs/desktops/gnome-3/games/atomix/default.nix
index 688aa0832cdda..28cc020b2d805 100644
--- a/pkgs/desktops/gnome-3/games/atomix/default.nix
+++ b/pkgs/desktops/gnome-3/games/atomix/default.nix
@@ -31,7 +31,7 @@ in stdenv.mkDerivation rec {
     description = "Puzzle game where you move atoms to build a molecule";
     homepage = "https://wiki.gnome.org/Apps/Atomix";
     license = licenses.gpl2Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/desktops/gnome-3/games/five-or-more/default.nix b/pkgs/desktops/gnome-3/games/five-or-more/default.nix
index 9bb1286c8d929..ca69395eb2359 100644
--- a/pkgs/desktops/gnome-3/games/five-or-more/default.nix
+++ b/pkgs/desktops/gnome-3/games/five-or-more/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Five_or_more";
     description = "Remove colored balls from the board by forming lines";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/games/four-in-a-row/default.nix b/pkgs/desktops/gnome-3/games/four-in-a-row/default.nix
index 66d174b25c4e5..0d73e3b3744bc 100644
--- a/pkgs/desktops/gnome-3/games/four-in-a-row/default.nix
+++ b/pkgs/desktops/gnome-3/games/four-in-a-row/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Four-in-a-row";
     description = "Make lines of the same color to win";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/games/gnome-chess/default.nix b/pkgs/desktops/gnome-3/games/gnome-chess/default.nix
index c1d9a137aaca9..21348370579d5 100644
--- a/pkgs/desktops/gnome-3/games/gnome-chess/default.nix
+++ b/pkgs/desktops/gnome-3/games/gnome-chess/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Chess";
     description = "Play the classic two-player boardgame of chess";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/games/gnome-klotski/default.nix b/pkgs/desktops/gnome-3/games/gnome-klotski/default.nix
index f46f4b98cb241..372c12022deb8 100644
--- a/pkgs/desktops/gnome-3/games/gnome-klotski/default.nix
+++ b/pkgs/desktops/gnome-3/games/gnome-klotski/default.nix
@@ -36,7 +36,7 @@ in stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Klotski";
     description = "Slide blocks to solve the puzzle";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/games/gnome-mahjongg/default.nix b/pkgs/desktops/gnome-3/games/gnome-mahjongg/default.nix
index f20f4c5f2c007..701008f0c36d1 100644
--- a/pkgs/desktops/gnome-3/games/gnome-mahjongg/default.nix
+++ b/pkgs/desktops/gnome-3/games/gnome-mahjongg/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Mahjongg";
     description = "Disassemble a pile of tiles by removing matching pairs";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/games/gnome-mines/default.nix b/pkgs/desktops/gnome-3/games/gnome-mines/default.nix
index 6e13540935961..f49634c6ada09 100644
--- a/pkgs/desktops/gnome-3/games/gnome-mines/default.nix
+++ b/pkgs/desktops/gnome-3/games/gnome-mines/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Mines";
     description = "Clear hidden mines from a minefield";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl3;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/games/gnome-nibbles/default.nix b/pkgs/desktops/gnome-3/games/gnome-nibbles/default.nix
index ddac0775fa8ff..9dcc8744d2e2b 100644
--- a/pkgs/desktops/gnome-3/games/gnome-nibbles/default.nix
+++ b/pkgs/desktops/gnome-3/games/gnome-nibbles/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
     description = "Guide a worm around a maze";
     homepage = "https://wiki.gnome.org/Apps/Nibbles";
     license = licenses.gpl2;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/desktops/gnome-3/games/gnome-robots/default.nix b/pkgs/desktops/gnome-3/games/gnome-robots/default.nix
index 0f85e10511cb5..2ba6d4e7044c8 100644
--- a/pkgs/desktops/gnome-3/games/gnome-robots/default.nix
+++ b/pkgs/desktops/gnome-3/games/gnome-robots/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Robots";
     description = "Avoid the robots and make them crash into each other";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/games/gnome-sudoku/default.nix b/pkgs/desktops/gnome-3/games/gnome-sudoku/default.nix
index 890fea6ad9bef..0a84e1065f3aa 100644
--- a/pkgs/desktops/gnome-3/games/gnome-sudoku/default.nix
+++ b/pkgs/desktops/gnome-3/games/gnome-sudoku/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Sudoku";
     description = "Test your logic skills in this number grid puzzle";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/games/gnome-taquin/default.nix b/pkgs/desktops/gnome-3/games/gnome-taquin/default.nix
index 449b4ec71feb3..f50969eb52e49 100644
--- a/pkgs/desktops/gnome-3/games/gnome-taquin/default.nix
+++ b/pkgs/desktops/gnome-3/games/gnome-taquin/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Taquin";
     description = "Move tiles so that they reach their places";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl3;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/games/gnome-tetravex/default.nix b/pkgs/desktops/gnome-3/games/gnome-tetravex/default.nix
index 5c98acf922908..4fe68a4f8a740 100644
--- a/pkgs/desktops/gnome-3/games/gnome-tetravex/default.nix
+++ b/pkgs/desktops/gnome-3/games/gnome-tetravex/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Tetravex";
     description = "Complete the puzzle by matching numbered tiles";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/games/hitori/default.nix b/pkgs/desktops/gnome-3/games/hitori/default.nix
index c0c9cac39061e..8d1c9e3dd65b7 100644
--- a/pkgs/desktops/gnome-3/games/hitori/default.nix
+++ b/pkgs/desktops/gnome-3/games/hitori/default.nix
@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Hitori";
     description = "GTK application to generate and let you play games of Hitori";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/games/iagno/default.nix b/pkgs/desktops/gnome-3/games/iagno/default.nix
index d6d88b688d094..5db02c8dfa411 100644
--- a/pkgs/desktops/gnome-3/games/iagno/default.nix
+++ b/pkgs/desktops/gnome-3/games/iagno/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Iagno";
     description = "Computer version of the game Reversi, more popularly called Othello";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/games/lightsoff/default.nix b/pkgs/desktops/gnome-3/games/lightsoff/default.nix
index 3ce928f2ce518..fd44bbece9963 100644
--- a/pkgs/desktops/gnome-3/games/lightsoff/default.nix
+++ b/pkgs/desktops/gnome-3/games/lightsoff/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Lightsoff";
     description = "Puzzle game, where the objective is to turn off all of the tiles on the board";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/games/quadrapassel/default.nix b/pkgs/desktops/gnome-3/games/quadrapassel/default.nix
index 9c757cef85fd9..474ee5823a7fa 100644
--- a/pkgs/desktops/gnome-3/games/quadrapassel/default.nix
+++ b/pkgs/desktops/gnome-3/games/quadrapassel/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     description = "Classic falling-block game, Tetris";
     homepage = "https://wiki.gnome.org/Apps/Quadrapassel";
     license = licenses.gpl2;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/desktops/gnome-3/games/swell-foop/default.nix b/pkgs/desktops/gnome-3/games/swell-foop/default.nix
index 85272c39de5e0..4b12609d3f3d9 100644
--- a/pkgs/desktops/gnome-3/games/swell-foop/default.nix
+++ b/pkgs/desktops/gnome-3/games/swell-foop/default.nix
@@ -30,7 +30,7 @@ in stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Swell%20Foop";
     description = "Puzzle game, previously known as Same GNOME";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/games/tali/default.nix b/pkgs/desktops/gnome-3/games/tali/default.nix
index 6af84b59b9a55..62df1cd1e3da9 100644
--- a/pkgs/desktops/gnome-3/games/tali/default.nix
+++ b/pkgs/desktops/gnome-3/games/tali/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Tali";
     description = "Sort of poker with dice and less money";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/misc/geary/default.nix b/pkgs/desktops/gnome-3/misc/geary/default.nix
index 748f559779723..bbde1fa36793a 100644
--- a/pkgs/desktops/gnome-3/misc/geary/default.nix
+++ b/pkgs/desktops/gnome-3/misc/geary/default.nix
@@ -80,7 +80,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Geary";
     description = "Mail client for GNOME 3";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.lgpl21Plus;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/misc/gnome-applets/default.nix b/pkgs/desktops/gnome-3/misc/gnome-applets/default.nix
index a212d4112c847..bc2afb5197994 100644
--- a/pkgs/desktops/gnome-3/misc/gnome-applets/default.nix
+++ b/pkgs/desktops/gnome-3/misc/gnome-applets/default.nix
@@ -78,7 +78,7 @@ in stdenv.mkDerivation rec {
     description = "Applets for use with the GNOME panel";
     homepage = "https://wiki.gnome.org/Projects/GnomeApplets";
     license = licenses.gpl2Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/desktops/gnome-3/misc/gnome-autoar/default.nix b/pkgs/desktops/gnome-3/misc/gnome-autoar/default.nix
index 8f1d193a6d367..baa43bdedb3e5 100644
--- a/pkgs/desktops/gnome-3/misc/gnome-autoar/default.nix
+++ b/pkgs/desktops/gnome-3/misc/gnome-autoar/default.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     platforms = platforms.linux;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.lgpl21;
     description = "Library to integrate compressed files management with GNOME";
   };
diff --git a/pkgs/desktops/gnome-3/misc/gnome-flashback/default.nix b/pkgs/desktops/gnome-3/misc/gnome-flashback/default.nix
index 0920d2f2df3fb..1fea28d24de03 100644
--- a/pkgs/desktops/gnome-3/misc/gnome-flashback/default.nix
+++ b/pkgs/desktops/gnome-3/misc/gnome-flashback/default.nix
@@ -191,7 +191,7 @@ let
       description = "GNOME 2.x-like session for GNOME 3";
       homepage = "https://wiki.gnome.org/Projects/GnomeFlashback";
       license = licenses.gpl2;
-      maintainers = gnome3.maintainers;
+      maintainers = teams.gnome.members;
       platforms = platforms.linux;
     };
   };
diff --git a/pkgs/desktops/gnome-3/misc/gnome-packagekit/default.nix b/pkgs/desktops/gnome-3/misc/gnome-packagekit/default.nix
index 5e8348ee0af11..63a6512588232 100644
--- a/pkgs/desktops/gnome-3/misc/gnome-packagekit/default.nix
+++ b/pkgs/desktops/gnome-3/misc/gnome-packagekit/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://www.freedesktop.org/software/PackageKit/";
     platforms = platforms.linux;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     description = "Tools for installing software on the GNOME desktop using PackageKit";
   };
diff --git a/pkgs/desktops/gnome-3/misc/gnome-panel/default.nix b/pkgs/desktops/gnome-3/misc/gnome-panel/default.nix
index 80e75561e3cb2..d390a5b27a288 100644
--- a/pkgs/desktops/gnome-3/misc/gnome-panel/default.nix
+++ b/pkgs/desktops/gnome-3/misc/gnome-panel/default.nix
@@ -93,7 +93,7 @@ in stdenv.mkDerivation rec {
     description = "Component of Gnome Flashback that provides panels and default applets for the desktop";
     homepage = "https://wiki.gnome.org/Projects/GnomePanel";
     license = licenses.gpl2Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/desktops/gnome-3/misc/gnome-tweaks/default.nix b/pkgs/desktops/gnome-3/misc/gnome-tweaks/default.nix
index 0cd8301e199c7..0271992b6407d 100644
--- a/pkgs/desktops/gnome-3/misc/gnome-tweaks/default.nix
+++ b/pkgs/desktops/gnome-3/misc/gnome-tweaks/default.nix
@@ -47,7 +47,7 @@ in stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/action/show/Apps/GnomeTweakTool";
     description = "A tool to customize advanced GNOME 3 options";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl3;
     platforms = platforms.linux;
   };
diff --git a/pkgs/desktops/gnome-3/misc/gpaste/default.nix b/pkgs/desktops/gnome-3/misc/gpaste/default.nix
index 1ee9e5b933b6e..b6a88e5864b4c 100644
--- a/pkgs/desktops/gnome-3/misc/gpaste/default.nix
+++ b/pkgs/desktops/gnome-3/misc/gpaste/default.nix
@@ -5,7 +5,6 @@
 , clutter
 , gjs
 , glib
-, gnome3
 , gobject-introspection
 , gtk3
 , meson
@@ -77,6 +76,6 @@ stdenv.mkDerivation rec {
     description = "Clipboard management system with GNOME 3 integration";
     license = licenses.gpl3;
     platforms = platforms.linux;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
   };
 }
diff --git a/pkgs/desktops/gnome-3/misc/gtkhtml/default.nix b/pkgs/desktops/gnome-3/misc/gtkhtml/default.nix
index a607a6eb6a078..9550de32fbeaa 100644
--- a/pkgs/desktops/gnome-3/misc/gtkhtml/default.nix
+++ b/pkgs/desktops/gnome-3/misc/gtkhtml/default.nix
@@ -22,6 +22,6 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     platforms = platforms.linux;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
   };
 }
diff --git a/pkgs/desktops/gnome-3/misc/libgnome-games-support/default.nix b/pkgs/desktops/gnome-3/misc/libgnome-games-support/default.nix
index dae6046c19e77..1f9afefd2e486 100644
--- a/pkgs/desktops/gnome-3/misc/libgnome-games-support/default.nix
+++ b/pkgs/desktops/gnome-3/misc/libgnome-games-support/default.nix
@@ -30,7 +30,7 @@ in stdenv.mkDerivation rec {
     description = "Small library intended for internal use by GNOME Games, but it may be used by others";
     homepage = "https://wiki.gnome.org/Apps/Games";
     license = licenses.lgpl3;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/desktops/gnome-3/misc/metacity/default.nix b/pkgs/desktops/gnome-3/misc/metacity/default.nix
index ed21f00878cd4..e62c6fe7fee3a 100644
--- a/pkgs/desktops/gnome-3/misc/metacity/default.nix
+++ b/pkgs/desktops/gnome-3/misc/metacity/default.nix
@@ -64,7 +64,7 @@ in stdenv.mkDerivation rec {
     description = "Window manager used in Gnome Flashback";
     homepage = "https://wiki.gnome.org/Projects/Metacity";
     license = licenses.gpl2;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/desktops/gnome-3/misc/nautilus-python/default.nix b/pkgs/desktops/gnome-3/misc/nautilus-python/default.nix
index 96731e87cfd62..e8c523277e182 100644
--- a/pkgs/desktops/gnome-3/misc/nautilus-python/default.nix
+++ b/pkgs/desktops/gnome-3/misc/nautilus-python/default.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
     description = "Python bindings for the Nautilus Extension API";
     homepage = "https://wiki.gnome.org/Projects/NautilusPython";
     license = licenses.gpl2Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/desktops/xfce/applications/gigolo/default.nix b/pkgs/desktops/xfce/applications/gigolo/default.nix
index 7b643bd0dc888..251866528e641 100644
--- a/pkgs/desktops/xfce/applications/gigolo/default.nix
+++ b/pkgs/desktops/xfce/applications/gigolo/default.nix
@@ -3,10 +3,10 @@
 mkXfceDerivation {
   category = "apps";
   pname = "gigolo";
-  version = "0.5.0";
+  version = "0.5.1";
   odd-unstable = false;
 
-  sha256 = "1lqsxb0d5i8p9vbzx8s4p3rga7va5h1q146xgmsa41j5v40wrlw6";
+  sha256 = "11a35z5apr26nl6fpmbsvvv3xf5w61sgzcb505plavrchpfbdxjn";
 
   nativeBuildInputs = [ exo ];
   buildInputs = [ gtk3 glib gvfs ];
diff --git a/pkgs/desktops/xfce/applications/parole/default.nix b/pkgs/desktops/xfce/applications/parole/default.nix
index 20b899165f095..bfb8651844873 100644
--- a/pkgs/desktops/xfce/applications/parole/default.nix
+++ b/pkgs/desktops/xfce/applications/parole/default.nix
@@ -7,9 +7,9 @@
 mkXfceDerivation {
   category = "apps";
   pname = "parole";
-  version = "1.0.4";
+  version = "1.0.5";
 
-  sha256 = "18j4bmny37crryh4pvxcjjvj99mln6ljq2vy69awxhvrjx9ljv13";
+  sha256 = "0qgis2gnkcvg7xwp76cbi0ihqdjprvvw2d66hk7klhrafp7c0v13";
 
   postPatch = ''
     substituteInPlace src/plugins/mpris2/Makefile.am \
diff --git a/pkgs/desktops/xfce/applications/xfburn/default.nix b/pkgs/desktops/xfce/applications/xfburn/default.nix
index 08f2bd511a872..8aff25df49436 100644
--- a/pkgs/desktops/xfce/applications/xfburn/default.nix
+++ b/pkgs/desktops/xfce/applications/xfburn/default.nix
@@ -3,9 +3,9 @@
 mkXfceDerivation {
   category = "apps";
   pname = "xfburn";
-  version = "0.6.1";
+  version = "0.6.2";
 
-  sha256 = "0a1ly79x7j5pgr3vbsabb4i0jd5rryaigj9z8iqzr8p9miypx20v";
+  sha256 = "02axhsbbsvd31jb0xs1d2qxr614qb29pajv0sm2p1n1c2cv2fjh1";
 
   nativeBuildInputs = [ libxslt docbook_xsl ];
   buildInputs = [ exo gtk3 libburn libisofs libxfce4ui ];
diff --git a/pkgs/desktops/xfce/applications/xfce4-dict/default.nix b/pkgs/desktops/xfce/applications/xfce4-dict/default.nix
index b2682080216ca..7e582abc05f73 100644
--- a/pkgs/desktops/xfce/applications/xfce4-dict/default.nix
+++ b/pkgs/desktops/xfce/applications/xfce4-dict/default.nix
@@ -3,9 +3,9 @@
 mkXfceDerivation {
   category = "apps";
   pname = "xfce4-dict";
-  version = "0.8.2";
+  version = "0.8.3";
 
-  sha256 = "1zbb0k0984ny7wy4gbk6ymkh87rbfakpim54yq4r3h5ymslx7iv7";
+  sha256 = "0p7k2ffknr23hh3j17dhh5q8adn736p2piwx0sg8f5dvvhhc5whz";
 
   patches = [ ./configure-gio.patch ];
 
diff --git a/pkgs/desktops/xfce/applications/xfce4-notifyd/default.nix b/pkgs/desktops/xfce/applications/xfce4-notifyd/default.nix
index a991e8c81807a..40d9c188fa3d2 100644
--- a/pkgs/desktops/xfce/applications/xfce4-notifyd/default.nix
+++ b/pkgs/desktops/xfce/applications/xfce4-notifyd/default.nix
@@ -4,9 +4,9 @@
 mkXfceDerivation {
   category = "apps";
   pname = "xfce4-notifyd";
-  version = "0.4.4";
+  version = "0.6.0";
 
-  sha256 = "1lmm9h3ych8dz9jpjkxg91f9ln14xs527nxjxsryks00kmqk4kai";
+  sha256 = "03lw7zil6pwvx537ibqrynxjz7d6iq6in7vdskrnnn16kfg6hjg2";
 
   buildInputs = [ exo gtk3 glib libnotify libxfce4ui libxfce4util xfce4-panel xfconf ];
 
diff --git a/pkgs/desktops/xfce/applications/xfce4-screenshooter/default.nix b/pkgs/desktops/xfce/applications/xfce4-screenshooter/default.nix
index 1db6fb016a157..8c0fa3e3edb6e 100644
--- a/pkgs/desktops/xfce/applications/xfce4-screenshooter/default.nix
+++ b/pkgs/desktops/xfce/applications/xfce4-screenshooter/default.nix
@@ -3,10 +3,10 @@
 mkXfceDerivation {
   category = "apps";
   pname = "xfce4-screenshooter";
-  version = "1.9.5";
+  version = "1.9.7";
   odd-unstable = false;
 
-  sha256 = "1h14sywvk9l06p3z1cpb79911j8w2wqbk03ldknjkia2rfymjk06";
+  sha256 = "14vbd7iigaw57hl47rnixk873c20q5clqynzkm9zzpqc568dxixd";
 
   buildInputs = [ exo gtk3 libsoup libxfce4ui libxfce4util xfce4-panel glib-networking ];
 
diff --git a/pkgs/desktops/xfce/applications/xfce4-taskmanager/default.nix b/pkgs/desktops/xfce/applications/xfce4-taskmanager/default.nix
index e3d8b4b87d94e..9a923025c94df 100644
--- a/pkgs/desktops/xfce/applications/xfce4-taskmanager/default.nix
+++ b/pkgs/desktops/xfce/applications/xfce4-taskmanager/default.nix
@@ -3,9 +3,9 @@
 mkXfceDerivation {
   category = "apps";
   pname = "xfce4-taskmanager";
-  version = "1.2.2";
+  version = "1.2.3";
 
-  sha256 = "03js0pmhrybxa7hrp3gx4rm7j061ansv0bp2dwhnbrdpmzjysysc";
+  sha256 = "0818chns7vkvjqakgz8z790adkygcq4jlw59dv6kyzk17hxq6cxv";
 
   nativeBuildInputs = [ exo ];
   buildInputs = [ gtk3 libwnck3 libXmu ];
diff --git a/pkgs/desktops/xfce/applications/xfce4-terminal/default.nix b/pkgs/desktops/xfce/applications/xfce4-terminal/default.nix
index 3b9cd268d55ae..56de8d3bfb834 100644
--- a/pkgs/desktops/xfce/applications/xfce4-terminal/default.nix
+++ b/pkgs/desktops/xfce/applications/xfce4-terminal/default.nix
@@ -3,9 +3,9 @@
 mkXfceDerivation {
   category = "apps";
   pname = "xfce4-terminal";
-  version = "0.8.8";
+  version = "0.8.9.2";
 
-  sha256 = "0sg9vwyvhh7pjp83biv7gvf42423a7ly4dc7q2gn28kp6bds2qcp";
+  sha256 = "1vlpfsrdalqmsd86aj0kvvam5skzn6xngigjziwli6q6il6lb9fj";
 
   buildInputs = [ gtk3 libxfce4ui vte xfconf pcre2 ];
 
diff --git a/pkgs/desktops/xfce/applications/xfdashboard/default.nix b/pkgs/desktops/xfce/applications/xfdashboard/default.nix
index f3db9c2446b81..a9610125b5b53 100644
--- a/pkgs/desktops/xfce/applications/xfdashboard/default.nix
+++ b/pkgs/desktops/xfce/applications/xfdashboard/default.nix
@@ -17,11 +17,11 @@
 mkXfceDerivation {
   category = "apps";
   pname = "xfdashboard";
-  version = "0.7.5";
+  version = "0.7.7";
   rev-prefix = "";
   odd-unstable = false;
 
-  sha256 = "0d0kg90h3li41bs75z3xldljsglkz220pba39c54qznnzb8v8a2i";
+  sha256 = "0b9pl3k8wl7svwhb9knhvr86gjg2904n788l8cbczwy046ql7pyc";
 
   buildInputs = [
     clutter
diff --git a/pkgs/desktops/xfce/art/xfce4-icon-theme.nix b/pkgs/desktops/xfce/art/xfce4-icon-theme.nix
index 089b7cc27f875..e614bb1db921c 100644
--- a/pkgs/desktops/xfce/art/xfce4-icon-theme.nix
+++ b/pkgs/desktops/xfce/art/xfce4-icon-theme.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, intltool, gtk2, xfce }:
+{ stdenv, fetchurl, pkgconfig, intltool, gtk3, xfce }:
 
 let
   category = "art";
@@ -13,9 +13,12 @@ stdenv.mkDerivation rec {
     sha256 = "1yk6rx3zr9grm4jwpjvqdkl13pisy7qn1wm5cqzmd2kbsn96cy6l";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ intltool gtk2 ];
-  
+  nativeBuildInputs = [
+    pkgconfig
+    intltool
+    gtk3
+  ];
+
   passthru.updateScript = xfce.updateScript {
     inherit pname version;
     attrPath = "xfce.${pname}";
@@ -25,6 +28,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://www.xfce.org/";
     description = "Icons for Xfce";
+    license = licenses.gpl2Plus;
     platforms = platforms.linux;
     maintainers = [ maintainers.eelco ];
   };
diff --git a/pkgs/desktops/xfce/core/exo/default.nix b/pkgs/desktops/xfce/core/exo/default.nix
index 59ab5823314ee..ee58c76ea02be 100644
--- a/pkgs/desktops/xfce/core/exo/default.nix
+++ b/pkgs/desktops/xfce/core/exo/default.nix
@@ -1,15 +1,26 @@
-{ mkXfceDerivation, docbook_xsl, glib, libxslt, perlPackages, gtk3
+{ mkXfceDerivation, docbook_xsl, glib, libxslt, perlPackages, gtk2, gtk3
 , libxfce4ui, libxfce4util }:
 
 mkXfceDerivation {
   category = "xfce";
   pname = "exo";
-  version = "0.12.8";
+  version = "0.12.11";
 
-  sha256 = "013am7q4pwfncf4hk2a3hv7yx2vxgzb5xm8qsi9mxkj29xdhrvs5";
+  sha256 = "1db7w6jk3i501x4qw0hs0ydrm1fjdkxmahzbv5iag859wnnlg0pd";
 
-  nativeBuildInputs = [ libxslt perlPackages.URI docbook_xsl ];
-  buildInputs = [ gtk3 glib libxfce4ui libxfce4util ];
+  nativeBuildInputs = [
+    libxslt
+    perlPackages.URI
+    docbook_xsl
+  ];
+
+  buildInputs = [
+    gtk2 # some xfce plugins still uses gtk2
+    gtk3
+    glib
+    libxfce4ui
+    libxfce4util
+  ];
 
   # Workaround https://bugzilla.xfce.org/show_bug.cgi?id=15825
   NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
diff --git a/pkgs/desktops/xfce/core/thunar/default.nix b/pkgs/desktops/xfce/core/thunar/default.nix
index 11220141d2a01..24df606e24667 100644
--- a/pkgs/desktops/xfce/core/thunar/default.nix
+++ b/pkgs/desktops/xfce/core/thunar/default.nix
@@ -21,9 +21,9 @@
 let unwrapped = mkXfceDerivation {
   category = "xfce";
   pname = "thunar";
-  version = "1.8.9";
+  version = "1.8.14";
 
-  sha256 = "01w60csbs2nq1bhb8n1bnmjmx48fm0va3qbnq84z0h2dxpr80b1w";
+  sha256 = "1ph9bcqfm2nccliagl8zdl1dizh62qnr8m5hacri3cs2jhc0jjpy";
 
   nativeBuildInputs = [
     docbook_xsl
diff --git a/pkgs/desktops/xfce/core/tumbler/default.nix b/pkgs/desktops/xfce/core/tumbler/default.nix
index b795007ca7c1d..1a615b8f66a50 100644
--- a/pkgs/desktops/xfce/core/tumbler/default.nix
+++ b/pkgs/desktops/xfce/core/tumbler/default.nix
@@ -14,9 +14,9 @@
 mkXfceDerivation {
   category = "xfce";
   pname = "tumbler";
-  version = "0.2.7";
+  version = "0.2.8";
 
-  sha256 = "14ql3fcxyz81qr9s0vcwh6j2ks5fl8jf9scwnkilv5jy0ii9l0ry";
+  sha256 = "1y9sphaz3izal96v53lps692xxzp5pad1d09kxsmmpm7pic4n1r2";
 
   buildInputs = [
     ffmpegthumbnailer
diff --git a/pkgs/desktops/xfce/core/xfce4-panel/default.nix b/pkgs/desktops/xfce/core/xfce4-panel/default.nix
index f4d86247c6cdf..ffd42e4a2c5b5 100644
--- a/pkgs/desktops/xfce/core/xfce4-panel/default.nix
+++ b/pkgs/desktops/xfce/core/xfce4-panel/default.nix
@@ -3,9 +3,9 @@
 mkXfceDerivation {
   category = "xfce";
   pname = "xfce4-panel";
-  version = "4.14.0";
+  version = "4.14.3";
 
-  sha256 = "1v3f2xjz9gwa8maqqvv9w2dh1cgy03v89a9ny7nrv0cjsxwwrr15";
+  sha256 = "0h8cqs2bghmyp0jihjm2wc7j14k271j178vllin271xrl7kzmvzv";
 
   nativeBuildInputs = [ gobject-introspection ];
   buildInputs = [ exo garcon gtk2 gtk3 glib glib-networking libxfce4ui libxfce4util libwnck3 xfconf ];
diff --git a/pkgs/desktops/xfce/core/xfce4-power-manager/default.nix b/pkgs/desktops/xfce/core/xfce4-power-manager/default.nix
index fb3f05b36646e..9f9a552b8cc6a 100644
--- a/pkgs/desktops/xfce/core/xfce4-power-manager/default.nix
+++ b/pkgs/desktops/xfce/core/xfce4-power-manager/default.nix
@@ -4,9 +4,9 @@
 mkXfceDerivation {
   category = "xfce";
   pname = "xfce4-power-manager";
-  version = "1.6.5";
+  version = "1.6.6";
 
-  sha256 = "0zazm2cgkz5xj7rvy9gbh4kaay2anfcmawg4gj38pnq3a8zcwwd5";
+  sha256 = "0lyp3dp4ijbpf21vanrvgm6rmfp8v0zyqxibdj5gxnadmvcq38iy";
 
   nativeBuildInputs = [ automakeAddFlags exo ];
   buildInputs = [ gtk3 libnotify libxfce4ui libxfce4util upower xfconf ];
diff --git a/pkgs/desktops/xfce/core/xfce4-session/default.nix b/pkgs/desktops/xfce/core/xfce4-session/default.nix
index 0ab362aa21d07..c7442a01957a6 100644
--- a/pkgs/desktops/xfce/core/xfce4-session/default.nix
+++ b/pkgs/desktops/xfce/core/xfce4-session/default.nix
@@ -3,9 +3,9 @@
 mkXfceDerivation {
   category = "xfce";
   pname = "xfce4-session";
-  version = "4.14.0";
+  version = "4.14.2";
 
-  sha256 = "0v0xzkdr5rgv6219c1dy96cghgw8bqnb313jccxihfgddf363104";
+  sha256 = "1gr6j96l792v33lbh7rqpbdjmy8m68hy14bsndx6bykv10zvmgx2";
 
   buildInputs = [ exo gtk3 glib libxfce4ui libxfce4util libwnck3 xfconf polkit iceauth ];
 
diff --git a/pkgs/desktops/xfce/core/xfce4-settings/default.nix b/pkgs/desktops/xfce/core/xfce4-settings/default.nix
index 74ab96ed1bcd4..9b263e5ee7334 100644
--- a/pkgs/desktops/xfce/core/xfce4-settings/default.nix
+++ b/pkgs/desktops/xfce/core/xfce4-settings/default.nix
@@ -5,9 +5,9 @@
 mkXfceDerivation {
   category = "xfce";
   pname = "xfce4-settings";
-  version = "4.14.0";
+  version = "4.14.3";
 
-  sha256 = "13gmxd4sfgd6wky7s03bar58w9vl4i6jv2wncd6iajww791y5akn";
+  sha256 = "1zzngdj7mp2r6rcs8gvda1218zlz5gpnc6gsp20z32l69psp3yld";
 
   postPatch = ''
     for f in $(find . -name \*.c); do
diff --git a/pkgs/desktops/xfce/core/xfdesktop/default.nix b/pkgs/desktops/xfce/core/xfdesktop/default.nix
index afcd0d19dc33f..75e9fc8cb653a 100644
--- a/pkgs/desktops/xfce/core/xfdesktop/default.nix
+++ b/pkgs/desktops/xfce/core/xfdesktop/default.nix
@@ -3,9 +3,9 @@
 mkXfceDerivation {
   category = "xfce";
   pname = "xfdesktop";
-  version = "4.14.1";
+  version = "4.14.2";
 
-  sha256 = "006w4xwmpwp34q2qkkixr3xz0vb0kny79pw64yj4304wsb5jr14g";
+  sha256 = "04fhm1pf9290sy3ymrmnfnm2x6fq5ldzvj5bjd9kz6zkx0nsq1za";
 
   buildInputs = [
     exo
diff --git a/pkgs/desktops/xfce/default.nix b/pkgs/desktops/xfce/default.nix
index 0eb66b170aa1a..579e863bf9c89 100644
--- a/pkgs/desktops/xfce/default.nix
+++ b/pkgs/desktops/xfce/default.nix
@@ -117,8 +117,6 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   xfce4-datetime-plugin = callPackage ./panel-plugins/xfce4-datetime-plugin { };
 
-  xfce4-dict-plugin = callPackage ./panel-plugins/xfce4-dict-plugin.nix { };
-
   xfce4-dockbarx-plugin = callPackage ./panel-plugins/xfce4-dockbarx-plugin.nix { };
 
   xfce4-embed-plugin = callPackage ./panel-plugins/xfce4-embed-plugin.nix { };
@@ -187,7 +185,6 @@ lib.makeScope pkgs.newScope (self: with self; {
   xfce4_cpufreq_plugin = xfce4-cpufreq-plugin;
   xfce4_cpugraph_plugin = xfce4-cpugraph-plugin;
   xfce4_datetime_plugin = xfce4-datetime-plugin;
-  xfce4_dict_plugin = xfce4-dict-plugin;
   xfce4_dockbarx_plugin = xfce4-dockbarx-plugin;
   xfce4_embed_plugin = xfce4-embed-plugin;
   xfce4_eyes_plugin = xfce4-eyes-plugin;
@@ -211,6 +208,7 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   xfce4-mixer = throw "deprecated 2019-08-18: obsoleted by xfce4-pulseaudio-plugin"; # added 2019-08-18
   gtk-xfce-engine = throw "deprecated 2019-09-17: Xfce 4.14 deprecated gtk-xfce-engine"; # added 2019-09-17
+  xfce4-dict-plugin = throw "deprecated 2020-04-19: xfce4-dict-plugin is now part of xfce4-dict."; # added 2020-04-19
 
   # added 2019-11-04
   libxfce4ui_gtk3 = libxfce4ui;
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-battery-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-battery-plugin/default.nix
index 0120cea0886fa..0d047447e0c2b 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-battery-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-battery-plugin/default.nix
@@ -3,10 +3,10 @@
 mkXfceDerivation {
   category = "panel-plugins";
   pname = "xfce4-battery-plugin";
-  version = "1.1.2";
+  version = "1.1.3";
   rev-prefix = "";
   odd-unstable = false;
-  sha256 = "0329miiclc8da6j0sz495p99hyrf9fjhvpmdl0556fphybz5agc0";
+  sha256 = "0ligdiasrfc3170kd7sif2ml6lvlpp11lbxz3xdvklqkv7p3323y";
 
   buildInputs = [ gtk3 libxfce4ui libxfce4util xfce4-panel xfconf ];
 
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-clipman-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-clipman-plugin/default.nix
index f814850561a61..2349b4bf3e8d6 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-clipman-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-clipman-plugin/default.nix
@@ -3,8 +3,8 @@
 mkXfceDerivation {
   category = "panel-plugins";
   pname = "xfce4-clipman-plugin";
-  version = "1.4.3";
-  sha256 = "1xk79xh1zk0x4r1z9m1dakp79pip0zh3naviybvl1dnpwwfc03gq";
+  version = "1.6.1";
+  sha256 = "03akijvry1n1fkziyvxwcksl4vy4lmnpgd5izjs8jai5sndhsszl";
 
   buildInputs = [ exo gtk3 libXtst libxfce4ui libxfce4util xfce4-panel xfconf ];
 
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-cpugraph-plugin.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-cpugraph-plugin.nix
index 22a019e56bc6c..38ad759e700cc 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-cpugraph-plugin.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-cpugraph-plugin.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, intltool, glib, exo, libXtst, xorgproto, libxfce4util, xfce4-panel, libxfce4ui, xfconf, gtk2, hicolor-icon-theme, xfce }:
+{ stdenv, fetchurl, pkgconfig, intltool, glib, exo, libXtst, xorgproto, libxfce4util, xfce4-panel, libxfce4ui, xfconf, gtk3, hicolor-icon-theme, xfce }:
 
 let
   category = "panel-plugins";
@@ -6,16 +6,31 @@ in
 
 stdenv.mkDerivation rec {
   pname  = "xfce4-cpugraph-plugin";
-  version = "1.0.5";
+  version = "1.1.0";
 
   src = fetchurl {
     url = "mirror://xfce/src/${category}/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
-    sha256 = "1izl53q95m5xm2fiq7385vb1i9nwgjizxkmgpgh33zdckb40xnl5";
+    sha256 = "193bj1p54l4zrvgdjj0pvjn161d6dn82jh9invcy09sqwlj0mkiy";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ intltool glib exo libXtst xorgproto libxfce4util libxfce4ui xfce4-panel xfconf gtk2 hicolor-icon-theme ];
-  
+  nativeBuildInputs = [
+    pkgconfig
+    intltool
+  ];
+
+  buildInputs = [
+    glib
+    exo
+    libXtst
+    xorgproto
+    libxfce4util
+    libxfce4ui
+    xfce4-panel
+    xfconf
+    gtk3
+    hicolor-icon-theme
+  ];
+
   passthru.updateScript = xfce.updateScript {
     inherit pname version;
     attrPath = "xfce.${pname}";
@@ -23,8 +38,9 @@ stdenv.mkDerivation rec {
   };
 
   meta = with stdenv.lib; {
-    homepage = "https://goodies.xfce.org/projects/panel-plugins/${pname}";
+    homepage = "https://docs.xfce.org/panel-plugins/xfce4-cpugraph-plugin";
     description = "CPU graph show for Xfce panel";
+    license = licenses.gpl2Plus;
     platforms = platforms.linux;
     maintainers = [ maintainers.AndersonTorres ];
   };
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-dict-plugin.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-dict-plugin.nix
deleted file mode 100644
index ae6141bd66273..0000000000000
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-dict-plugin.nix
+++ /dev/null
@@ -1,32 +0,0 @@
-{ stdenv, fetchurl, pkgconfig, intltool, libxfce4util, xfce4-panel, libxfce4ui, xfconf, gtk2, xfce }:
-
-let
-  category = "panel-plugins";
-in
-
-stdenv.mkDerivation rec {
-  pname  = "xfce4-dict-plugin";
-  version = "0.3.0";
-
-  src = fetchurl {
-    url = "mirror://xfce/src/${category}/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
-    sha256 = "1x0imfnsdfq7fbhka8bc0yjjspkcljc1jafhrwzb08qi9bk2wbar";
-  };
-
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ intltool libxfce4util libxfce4ui xfce4-panel xfconf gtk2 ];
-  
-  passthru.updateScript = xfce.updateScript {
-    inherit pname version;
-    attrPath = "xfce.${pname}";
-    versionLister = xfce.archiveLister category pname;
-  };
-
-  meta =with stdenv.lib; {
-    homepage = "https://goodies.xfce.org/projects/panel-plugins/${pname}";
-    description = "Dictionary plugin for Xfce panel";
-    platforms = platforms.linux;
-    maintainers = [ maintainers.AndersonTorres ];
-    broken = true; # see https://goodies.xfce.org/projects/panel-plugins/xfce4-dict-plugin
-  };
-}
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-embed-plugin.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-embed-plugin.nix
index 3cd8471466354..2b2027bcf4bcb 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-embed-plugin.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-embed-plugin.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, intltool, libxfce4util, xfce4-panel, libxfce4ui, xfconf, gtk2, xfce }:
+{ stdenv, fetchurl, pkgconfig, intltool, libxfce4util, xfce4-panel, libxfce4ui, gtk2, xfce }:
 
 let
   category = "panel-plugins";
@@ -14,9 +14,18 @@ stdenv.mkDerivation rec {
     sha256 = "0a72kqsjjh45swimqlpyrahdnplp0383v0i4phr4n6g8c1ixyry7";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ intltool libxfce4util libxfce4ui xfce4-panel xfconf gtk2 ];
-  
+  nativeBuildInputs = [
+    pkgconfig
+    intltool
+  ];
+
+  buildInputs = [
+    libxfce4util
+    libxfce4ui
+    xfce4-panel
+    gtk2
+  ];
+
   passthru.updateScript = xfce.updateScript {
     inherit pname version;
     attrPath = "xfce.${pname}";
@@ -24,8 +33,9 @@ stdenv.mkDerivation rec {
   };
 
   meta = {
-    homepage = "https://goodies.xfce.org/projects/panel-plugins/${pname}";
+    homepage = "https://docs.xfce.org/panel-plugins/xfce4-embed-plugin";
     description = "Embed arbitrary app windows on Xfce panel";
+    license = licenses.gpl2Plus;
     platforms = platforms.linux;
     maintainers = [ maintainers.AndersonTorres ];
   };
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-eyes-plugin.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-eyes-plugin.nix
index 687bcf59859e9..220e250685825 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-eyes-plugin.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-eyes-plugin.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, intltool, libxfce4util, xfce4-panel, libxfce4ui, xfconf, gtk2, xfce }:
+{ stdenv, fetchurl, pkgconfig, intltool, libxfce4util, xfce4-panel, libxfce4ui, xfconf, gtk3, xfce }:
 
 let
   category = "panel-plugins";
@@ -6,15 +6,25 @@ in
 
 stdenv.mkDerivation rec {
   pname  = "xfce4-eyes-plugin";
-  version = "4.4.4";
+  version = "4.5.0";
 
   src = fetchurl {
     url = "mirror://xfce/src/${category}/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
-    sha256 = "1jh02hylvsvfpxrx0bq6fzgy6vnxf9qakgpbfvr63lfkd1dyh314";
+    sha256 = "17gj6fbvvrdzvz61czmia8hqynllsnmhk61fs4aml443cc1h1bpx";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ intltool libxfce4util libxfce4ui xfce4-panel xfconf gtk2 ];
+  nativeBuildInputs = [
+    pkgconfig
+    intltool
+  ];
+  
+  buildInputs = [
+    libxfce4util
+    libxfce4ui
+    xfce4-panel
+    xfconf
+    gtk3
+  ];
   
   passthru.updateScript = xfce.updateScript {
     inherit pname version;
@@ -23,10 +33,10 @@ stdenv.mkDerivation rec {
   };
 
   meta = with stdenv.lib; {
-    homepage = "https://goodies.xfce.org/projects/panel-plugins/${pname}";
-    description = "Eyes following you!";
+    homepage = "https://docs.xfce.org/panel-plugins/xfce4-eyes-plugin";
+    description = "Rolling eyes (following mouse pointer) plugin for the Xfce panel";
+    license = licenses.gpl2Plus;
     platforms = platforms.linux;
     maintainers = [ maintainers.AndersonTorres ];
-    broken = true;
   };
 }
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-fsguard-plugin.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-fsguard-plugin.nix
index adab2f033ac2f..b67e63f5c6449 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-fsguard-plugin.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-fsguard-plugin.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, intltool, libxfce4util, xfce4-panel, libxfce4ui, xfconf, gtk2, xfce }:
+{ stdenv, fetchurl, pkgconfig, intltool, libxfce4util, xfce4-panel, libxfce4ui, xfconf, gtk3, xfce }:
 
 let
   category = "panel-plugins";
@@ -6,15 +6,25 @@ in
 
 stdenv.mkDerivation rec {
   pname  = "xfce4-fsguard-plugin";
-  version = "1.0.2";
+  version = "1.1.1";
 
   src = fetchurl {
     url = "mirror://xfce/src/${category}/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
-    sha256 = "1bj021h4q68bc03f32pkyqy4gfd1sz6s21nxdg7j6gdfhs9xbj52";
+    sha256 = "05nmfkrmifm76bsywqmbjd1qdvzagv5cbvnwbkb57156j055vl6n";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ intltool libxfce4util libxfce4ui xfce4-panel xfconf gtk2 ];
+  nativeBuildInputs = [
+    pkgconfig
+    intltool
+  ];
+
+  buildInputs = [
+    libxfce4util
+    libxfce4ui
+    xfce4-panel
+    xfconf
+    gtk3
+  ];
   
   passthru.updateScript = xfce.updateScript {
     inherit pname version;
@@ -23,10 +33,10 @@ stdenv.mkDerivation rec {
   };
 
   meta = with stdenv.lib; {
-    homepage = "https://goodies.xfce.org/projects/panel-plugins/${pname}";
-    description = "Filesystem monitor";
+    homepage = "https://docs.xfce.org/panel-plugins/xfce4-fsguard-plugin";
+    description = "Filesystem usage monitor plugin for the Xfce panel";
+    license = licenses.bsd2;
     platforms = platforms.linux;
     maintainers = [ maintainers.AndersonTorres ];
-    broken = true;
   };
 }
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-genmon-plugin.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-genmon-plugin.nix
index 65dc61a4b393c..417001fed53be 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-genmon-plugin.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-genmon-plugin.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, intltool, libxfce4util, xfce4-panel, libxfce4ui, xfconf, gtk2, xfce }:
+{ stdenv, fetchurl, pkgconfig, intltool, libxfce4util, xfce4-panel, libxfce4ui, gtk3, xfce }:
 
 let
   category = "panel-plugins";
@@ -6,15 +6,24 @@ in
 
 stdenv.mkDerivation rec {
   pname  = "xfce4-genmon-plugin";
-  version = "3.4.0";
+  version = "4.0.2";
 
   src = fetchurl {
     url = "mirror://xfce/src/${category}/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
-    sha256 = "11q3g6lmgz3d5lyh6614mxkd9cblfdyf9jgki7f26mn895xk79dh";
+    sha256 = "1ai3pwgv61nv7i2dyrvncnc63r8kdjbkp40vp51vzak1dx924v15";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ intltool libxfce4util libxfce4ui xfce4-panel xfconf gtk2 ];
+  nativeBuildInputs = [
+    pkgconfig
+    intltool
+  ];
+
+  buildInputs = [
+    libxfce4util
+    libxfce4ui
+    xfce4-panel
+    gtk3
+  ];
   
   passthru.updateScript = xfce.updateScript {
     inherit pname version;
@@ -23,10 +32,10 @@ stdenv.mkDerivation rec {
   };
 
   meta = with stdenv.lib; {
-    homepage = "https://goodies.xfce.org/projects/panel-plugins/${pname}";
-    description = "Cyclically spawns a command and captures its output";
+    homepage = "https://docs.xfce.org/panel-plugins/xfce4-genmon-plugin";
+    description = "Generic monitor plugin for the Xfce panel";
+    license = licenses.gpl2Plus;
     platforms = platforms.linux;
     maintainers = [ maintainers.AndersonTorres ];
-    broken = true;
   };
 }
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-hardware-monitor-plugin.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-hardware-monitor-plugin.nix
index 83084b6266126..d8775c4b7045a 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-hardware-monitor-plugin.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-hardware-monitor-plugin.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   meta = with stdenv.lib; {
-    homepage = "https://goodies.xfce.org/projects/panel-plugins/${pname}";
+    homepage = "https://goodies.xfce.org/projects/panel-plugins/xfce4-hardware-monitor-plugin";
     description = "Hardware monitor plugin for the XFCE4 panel";
     license = licenses.gpl3;
     platforms = platforms.unix;
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-mailwatch-plugin.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-mailwatch-plugin.nix
index b63224f87086d..3d60d8b18f9a4 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-mailwatch-plugin.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-mailwatch-plugin.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, pkgconfig, intltool, libxfce4util, xfce4-panel, libxfce4ui,
-  xfconf, gtk2, exo, gnutls, libgcrypt, xfce }:
+  gtk2, exo, gnutls, libgcrypt, xfce }:
 
 let
   category = "panel-plugins";
@@ -14,10 +14,21 @@ stdenv.mkDerivation rec {
     sha256 = "1bfw3smwivr9mzdyq768biqrl4aq94zqi3xjzq6kqnd8561cqjk2";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ intltool libxfce4util libxfce4ui xfce4-panel
-    xfconf gtk2 exo gnutls libgcrypt ];
-  
+  nativeBuildInputs = [
+    intltool
+    pkgconfig
+  ];
+
+  buildInputs = [
+    libxfce4util
+    libxfce4ui
+    xfce4-panel
+    gtk2
+    exo # needs exo with gtk2 support
+    gnutls
+    libgcrypt
+  ];
+
   passthru.updateScript = xfce.updateScript {
     inherit pname version;
     attrPath = "xfce.${pname}";
@@ -25,10 +36,10 @@ stdenv.mkDerivation rec {
   };
 
   meta = with stdenv.lib; {
-    homepage = "https://goodies.xfce.org/projects/panel-plugins/${pname}";
-    description = "Mailwatch plugin for Xfce panel";
+    homepage = "https://docs.xfce.org/panel-plugins/xfce4-mailwatch-plugin";
+    description = "Mail watcher plugin for Xfce panel";
+    license = licenses.gpl2;
     platforms = platforms.linux;
     maintainers = [ ];
-    broken = true;
   };
 }
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-mpc-plugin.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-mpc-plugin.nix
index 7d7b1981c52ac..bb56e875c865a 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-mpc-plugin.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-mpc-plugin.nix
@@ -1,5 +1,5 @@
-{ stdenv, fetchurl, pkgconfig, intltool, libxfce4util, xfce4-panel, libxfce4ui,
- xfconf, gtk2, exo, xfce }:
+{ stdenv, fetchurl, pkgconfig, intltool, libxfce4util, xfce4-panel,
+  libxfce4ui, gtk3, exo, xfce }:
 
 let
   category = "panel-plugins";
@@ -7,17 +7,26 @@ in
 
 stdenv.mkDerivation rec {
   pname  = "xfce4-mpc-plugin";
-  version = "0.4.5";
+  version = "0.5.2";
 
   src = fetchurl {
     url = "mirror://xfce/src/${category}/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
-    sha256 = "1kvgq1pq7cykqdc3227dq0izad093ppfw3nfsrcp9i8mi6i5f7z7";
+    sha256 = "0q3pysdp85b3c7g3b59y3c69g4nw6bvbf518lnri4lxrnsvpizpf";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ intltool libxfce4util libxfce4ui xfce4-panel
-    xfconf gtk2 exo ];
-  
+  nativeBuildInputs = [
+    pkgconfig
+    intltool
+  ];
+
+  buildInputs = [
+    libxfce4util
+    libxfce4ui
+    xfce4-panel
+    gtk3
+    exo
+  ];
+
   passthru.updateScript = xfce.updateScript {
     inherit pname version;
     attrPath = "xfce.${pname}";
@@ -25,10 +34,10 @@ stdenv.mkDerivation rec {
   };
 
   meta = with stdenv.lib; {
-    homepage = "https://goodies.xfce.org/projects/panel-plugins/${pname}";
+    homepage = "https://docs.xfce.org/panel-plugins/xfce4-mpc-plugin";
     description = "MPD plugin for Xfce panel";
     platforms = platforms.linux;
+    license = licenses.bsd2;
     maintainers = [ ];
-    broken = true;
   };
 }
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-netload-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-netload-plugin/default.nix
index 09e686a9536c1..8d258220175b9 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-netload-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-netload-plugin/default.nix
@@ -3,9 +3,10 @@
 mkXfceDerivation {
   category = "panel-plugins";
   pname = "xfce4-netload-plugin";
-  version = "1.3.1";
+  version = "1.3.2";
   rev-prefix = "version-";
-  sha256 = "0nm8advafw4jpc9p1qszyfqa56194sz51z216rdh4c6ilcrrpy1h";
+  odd-unstable = false;
+  sha256 = "1py1l4z5ah4nlq8l2912k47ffsa5z7p1gbvlk7nw6b9r1x4ykdfl";
 
   buildInputs = [ gtk3 libxfce4ui libxfce4util xfce4-panel xfconf ];
 
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-notes-plugin.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-notes-plugin.nix
index 1b7e66936fab1..d6910d367a632 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-notes-plugin.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-notes-plugin.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, intltool, libxfce4util, xfce4-panel, libxfce4ui, xfconf, gtk2, libunique, xfce }:
+{ stdenv, fetchurl, fetchpatch, pkgconfig, intltool, libxfce4util, xfce4-panel, libxfce4ui, xfconf, gtk2, libunique, xfce }:
 
 let
   category = "panel-plugins";
@@ -6,16 +6,29 @@ in
 
 stdenv.mkDerivation rec {
   pname  = "xfce4-notes-plugin";
-  version = "1.7.7";
+  version = "1.8.1";
 
   src = fetchurl {
     url = "mirror://xfce/src/${category}/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
-    sha256 = "05sjbwgch1j93m3r23ksbjnpfk11sf7xjmbb9pm5vl3snc2s3fm7";
+    sha256 = "1cjlvvcsigyh40xa26b2vc5zylgss0nlaw72sablzhii2kkw7907";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ intltool libxfce4util libxfce4ui xfce4-panel xfconf gtk2 libunique ];
-  
+  nativeBuildInputs = [
+    pkgconfig
+    intltool
+  ];
+
+  buildInputs = [
+    libxfce4util
+    libxfce4ui
+    xfce4-panel
+    xfconf
+    gtk2
+    libunique
+  ];
+
+  hardeningDisable = [ "format" ];
+
   passthru.updateScript = xfce.updateScript {
     inherit pname version;
     attrPath = "xfce.${pname}";
@@ -23,10 +36,10 @@ stdenv.mkDerivation rec {
   };
 
   meta = with stdenv.lib; {
-    homepage = "https://goodies.xfce.org/projects/panel-plugins/${pname}";
+    homepage = "https://docs.xfce.org/panel-plugins/xfce4-notes-plugin";
     description = "Sticky notes plugin for Xfce panel";
+    license = licenses.gpl2Plus;
     platforms = platforms.linux;
     maintainers = [ maintainers.AndersonTorres ];
-    broken = true;
   };
 }
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-pulseaudio-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-pulseaudio-plugin/default.nix
index 64916f92a6ff0..10850974bb7d3 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-pulseaudio-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-pulseaudio-plugin/default.nix
@@ -2,6 +2,7 @@
 , automakeAddFlags
 , dbus-glib
 , dbus
+, exo
 , gtk3
 , libpulseaudio
 , libnotify
@@ -16,8 +17,8 @@
 mkXfceDerivation {
   category = "panel-plugins";
   pname = "xfce4-pulseaudio-plugin";
-  version = "0.4.2";
-  sha256 = "1s996mcniskq42vv7cb9i165pmrfp9c95p5f9rx14hqq8in9mvc5";
+  version = "0.4.3";
+  sha256 = "1rfw2w8gl95iawiy57qlvz958dqjc8bmxnc3dma4rqzm6g46jkgq";
 
   nativeBuildInputs = [
     automakeAddFlags
@@ -30,6 +31,7 @@ mkXfceDerivation {
   '';
 
   buildInputs = [
+    exo
     glib
     gtk3
     keybinder3
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-sensors-plugin.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-sensors-plugin.nix
index 14cab3d932e82..8b8dbf3e022cb 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-sensors-plugin.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-sensors-plugin.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, intltool, gtk2, libxfce4ui,
+{ stdenv, fetchurl, pkgconfig, intltool, gtk3, libxfce4ui,
   libxfce4util, xfce4-panel, libnotify, lm_sensors, hddtemp, netcat-gnu, xfce
 }:
 
@@ -8,11 +8,11 @@ in
 
 stdenv.mkDerivation rec {
   pname  = "xfce4-sensors-plugin";
-  version = "1.2.6";
+  version = "1.3.92";
 
   src = fetchurl {
     url = "mirror://xfce/src/${category}/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
-    sha256 = "1h0vpqxcziml3gwrbvd8xvy1mwh9mf2a68dvxsy03rs5pm1ghpi3";
+    sha256 = "04jibw23ibi61f19gc9xy400yhcdiya4px6zp8c7fjq65hyn9iix";
   };
 
   nativeBuildInputs = [
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    gtk2
+    gtk3
     libxfce4ui
     libxfce4util
     xfce4-panel
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with stdenv.lib; {
-    homepage = "https://goodies.xfce.org/projects/panel-plugins/${pname}";
+    homepage = "https://docs.xfce.org/panel-plugins/xfce4-sensors-plugin";
     description = "A panel plug-in for different sensors using acpi, lm_sensors and hddtemp";
     license = licenses.gpl2;
     platforms = platforms.unix;
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-systemload-plugin.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-systemload-plugin.nix
index 1ff0bc2efbae4..52da6a29ea42f 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-systemload-plugin.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-systemload-plugin.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, intltool, libxfce4util, xfce4-panel, libxfce4ui, gtk2, xfce }:
+{ stdenv, fetchurl, pkgconfig, intltool, libxfce4util, xfce4-panel, libxfce4ui, gtk3, xfce }:
 
 let
   category = "panel-plugins";
@@ -6,16 +6,25 @@ in
 
 stdenv.mkDerivation rec {
   pname  = "xfce4-systemload-plugin";
-  version = "1.1.2";
+  version = "1.2.3";
 
   src = fetchurl {
     url = "mirror://xfce/src/${category}/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
-    sha256 = "0z4as6sxdz93d4jpgv0665dg4sykfvc5068mc689phlfl2rvcsdl";
+    sha256 = "0x87a8h5l3ashz1ksfaxcpn9a392jzlsbx5n5pga8g90fp2hf905";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ intltool libxfce4util libxfce4ui xfce4-panel gtk2 ];
-  
+  nativeBuildInputs = [
+    pkgconfig
+    intltool
+  ];
+
+  buildInputs = [
+    libxfce4util
+    libxfce4ui
+    xfce4-panel
+    gtk3
+  ];
+
   passthru.updateScript = xfce.updateScript {
     inherit pname version;
     attrPath = "xfce.${pname}";
@@ -23,8 +32,9 @@ stdenv.mkDerivation rec {
   };
 
   meta = with stdenv.lib; {
-    homepage = "https://goodies.xfce.org/projects/panel-plugins/${pname}";
+    homepage = "https://docs.xfce.org/panel-plugins/xfce4-systemload-plugin";
     description = "System load plugin for Xfce panel";
+    license = licenses.bsd2;
     platforms = platforms.linux;
     maintainers = [ maintainers.AndersonTorres ];
   };
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-timer-plugin.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-timer-plugin.nix
index ae08fd3aeaeef..00b497c918d8f 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-timer-plugin.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-timer-plugin.nix
@@ -1,5 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, intltool, libxfce4util, xfce4-panel
-, libxfce4ui, xfconf, gtk2, hicolor-icon-theme, xfce }:
+{ stdenv, fetchurl, pkgconfig, intltool, libxfce4util, xfce4-panel, libxfce4ui, gtk3, hicolor-icon-theme, xfce }:
 
 let
   category = "panel-plugins";
@@ -7,17 +6,25 @@ in
 
 stdenv.mkDerivation rec {
   pname  = "xfce4-timer-plugin";
-  version = "1.6.0";
+  version = "1.7.0";
 
   src = fetchurl {
     url = "mirror://xfce/src/${category}/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
-    sha256 = "0z46gyw3ihcd1jf0m5z1dsc790xv1cpi8mk1dagj3i4v14gx5mrr";
+    sha256 = "16vypwwjwfk7nn4n16rfgn0z78jqrmbgxmc1r46269lrwd1m6kif";
   };
 
-  buildInputs = [ intltool libxfce4util libxfce4ui xfce4-panel xfconf
-    gtk2 hicolor-icon-theme ];
+  nativeBuildInputs = [
+    pkgconfig
+    intltool
+  ];
 
-  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [
+    libxfce4util
+    libxfce4ui
+    xfce4-panel
+    gtk3
+    hicolor-icon-theme
+  ];
 
   hardeningDisable = [ "format" ];
   
@@ -28,11 +35,10 @@ stdenv.mkDerivation rec {
   };
 
   meta = with stdenv.lib; {
-    homepage = "https://goodies.xfce.org/projects/panel-plugins/${pname}";
-    description = "A simple XFCE panel plugin that lets the user run an alarm at a specified time or at the end of a specified countdown period";
+    homepage = "https://docs.xfce.org/panel-plugins/xfce4-timer-plugin";
+    description = "Simple countdown and alarm plugin for the Xfce panel";
     platforms = platforms.linux;
     license = licenses.gpl2;
     maintainers = [ ];
-    broken = true;
   };
 }
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-vala-panel-appmenu-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-vala-panel-appmenu-plugin/default.nix
index bd0db543cf662..525bd6e5fd7d6 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-vala-panel-appmenu-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-vala-panel-appmenu-plugin/default.nix
@@ -4,7 +4,7 @@
 
 stdenv.mkDerivation rec {
   pname = "xfce4-vala-panel-appmenu-plugin";
-  version = "0.6.94";
+  version = "0.7.3";
 
   src = fetchFromGitHub {
     owner = "rilian-la-te";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     rev = version;
     fetchSubmodules = true;
 
-    sha256 = "0xxn3zs60a9nfix8wrdp056wviq281cm1031hznzf1l38lp3wr5p";
+    sha256 = "06rykdr2c9rnzxwinwdynd73v9wf0gjkx6qfva7sx2n94ajsdnaw";
   };
 
   nativeBuildInputs = [ pkgconfig cmake vala libxml2.bin ];
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-weather-plugin.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-weather-plugin.nix
index f32efb01edd11..cff2ef251ad4b 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-weather-plugin.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-weather-plugin.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, intltool, gtk2, libxml2, libsoup, upower,
+{ stdenv, fetchurl, pkgconfig, intltool, gtk3, libxml2, libsoup, upower,
   libxfce4ui, libxfce4util, xfce4-panel, hicolor-icon-theme, xfce }:
 
 let
@@ -7,17 +7,28 @@ in
 
 stdenv.mkDerivation rec {
   pname  = "xfce4-weather-plugin";
-  version = "0.8.10";
+  version = "0.10.1";
 
   src = fetchurl {
     url = "mirror://xfce/src/${category}/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
-    sha256 = "1f7ac2zr5s5w6krdpgsq252wxhhmcblia3j783132ilh8k246vgf";
+    sha256 = "12bs2rfmmy021087i10vxibdbbvd5vld0vk3h5hymhpz7rgszcmg";
   };
 
-  nativeBuildInputs = [ pkgconfig intltool ];
+  nativeBuildInputs = [
+    pkgconfig
+    intltool
+  ];
 
-  buildInputs = [ gtk2 libxml2 libsoup upower libxfce4ui libxfce4util
-   xfce4-panel hicolor-icon-theme ];
+  buildInputs = [
+    gtk3
+    libxml2
+    libsoup
+    upower
+    libxfce4ui
+    libxfce4util
+    xfce4-panel
+    hicolor-icon-theme
+  ];
 
   enableParallelBuilding = true;
   
@@ -28,7 +39,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with stdenv.lib; {
-    homepage = "https://goodies.xfce.org/projects/panel-plugins/${pname}";
+    homepage = "https://docs.xfce.org/panel-plugins/xfce4-weather-plugin";
     description = "Weather plugin for the Xfce desktop environment";
     license = licenses.gpl2Plus;
     platforms = platforms.unix;
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-windowck-plugin.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-windowck-plugin.nix
index ceeac724cf38b..e629a08c5537e 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-windowck-plugin.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-windowck-plugin.nix
@@ -3,18 +3,32 @@
 
 stdenv.mkDerivation rec {
   pname  = "xfce4-windowck-plugin";
-  version = "0.4.4";
+  version = "0.4.6";
 
   src = fetchFromGitHub {
     owner = "cedl38";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0c6a1ibh39dpq9x0dha5lsg0vzmgaf051fgwz0nlky0s94nwzvgv";
+    sha256 = "1gwrbjfv4cnlsqh05h42w41z3xs15yjj6j8y9gxvvvvlgzzp4p3g";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ intltool python3 imagemagick libwnck gtk2
-    exo libxfce4ui libxfce4util xfce4-panel xfconf xfce4-dev-tools ];
+  nativeBuildInputs = [
+    pkgconfig
+    intltool
+  ];
+
+  buildInputs = [
+    python3
+    imagemagick
+    libwnck
+    gtk2
+    exo
+    libxfce4ui
+    libxfce4util
+    xfce4-panel
+    xfconf
+    xfce4-dev-tools
+  ];
 
   preConfigure = ''
     ./autogen.sh
@@ -31,8 +45,8 @@ stdenv.mkDerivation rec {
   };
 
   meta = with stdenv.lib; {
-    homepage = "https://goodies.xfce.org/projects/panel-plugins/${pname}";
-    description = "Set of two plugins which allows you to put the maximized window title and windows buttons on the panel";
+    homepage = "https://goodies.xfce.org/projects/panel-plugins/xfce4-windowck-plugin";
+    description = "Xfce plugins which allows to put the maximized window title and buttons on the panel";
     license = licenses.gpl2Plus;
     platforms = platforms.unix;
     maintainers = [ maintainers.volth ];
diff --git a/pkgs/development/compilers/ghc/8.8.3.nix b/pkgs/development/compilers/ghc/8.8.3.nix
index 9462835cbdb3d..692ac9f0a1225 100644
--- a/pkgs/development/compilers/ghc/8.8.3.nix
+++ b/pkgs/development/compilers/ghc/8.8.3.nix
@@ -73,7 +73,7 @@ let
   '';
 
   # Splicer will pull out correct variations
-  libDeps = platform: stdenv.lib.optional enableTerminfo [ ncurses ]
+  libDeps = platform: stdenv.lib.optional enableTerminfo ncurses
     ++ [libffi]
     ++ stdenv.lib.optional (!enableIntegerSimple) gmp
     ++ stdenv.lib.optional (platform.libc != "glibc" && !targetPlatform.isWindows) libiconv;
@@ -160,10 +160,10 @@ stdenv.mkDerivation (rec {
     "--with-system-libffi"
     "--with-ffi-includes=${targetPackages.libffi.dev}/include"
     "--with-ffi-libraries=${targetPackages.libffi.out}/lib"
-  ] ++ stdenv.lib.optional (targetPlatform == hostPlatform && !enableIntegerSimple) [
+  ] ++ stdenv.lib.optionals (targetPlatform == hostPlatform && !enableIntegerSimple) [
     "--with-gmp-includes=${targetPackages.gmp.dev}/include"
     "--with-gmp-libraries=${targetPackages.gmp.out}/lib"
-  ] ++ stdenv.lib.optional (targetPlatform == hostPlatform && hostPlatform.libc != "glibc" && !targetPlatform.isWindows) [
+  ] ++ stdenv.lib.optionals (targetPlatform == hostPlatform && hostPlatform.libc != "glibc" && !targetPlatform.isWindows) [
     "--with-iconv-includes=${libiconv}/include"
     "--with-iconv-libraries=${libiconv}/lib"
   ] ++ stdenv.lib.optionals (targetPlatform != hostPlatform) [
diff --git a/pkgs/development/compilers/go/1.14.nix b/pkgs/development/compilers/go/1.14.nix
index 475f03689ca93..cf5c878d9c8b7 100644
--- a/pkgs/development/compilers/go/1.14.nix
+++ b/pkgs/development/compilers/go/1.14.nix
@@ -30,11 +30,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.14";
+  version = "1.14.1";
 
   src = fetchurl {
     url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "12a3nzj4k4p5ica447sjfva9pvvj84a03b4xlg3mhl2nmm33wr3d";
+    sha256 = "0xkna02clggcdgl5xxwani62krnf64x6p3hk9k5v9ldh2lhmglia";
   };
 
   # perl is used for testing go vet
diff --git a/pkgs/development/compilers/graalvm/default.nix b/pkgs/development/compilers/graalvm/default.nix
index 960f292646746..244ee4c010ea9 100644
--- a/pkgs/development/compilers/graalvm/default.nix
+++ b/pkgs/development/compilers/graalvm/default.nix
@@ -150,7 +150,7 @@ let
                                                                           ];
 
   graal-mxcache = jvmci8-mxcache ++ [
-    # rec { sha1 = "5001adab652fc4eb35e30cdefbb0765442f8b7db"; name = "LLVM_ORG_LIBCXX_SRC_${sha1}/llvm-org-libcxx-src.tar.gz";                          url = https://lafo.ssw.uni-linz.ac.at/pub/llvm-org/compiler-rt-llvmorg-8.0.0-4-gd563e33a79-bgae3b177eaa-linux-amd64.tar.gz; }
+    # rec { sha1 = "5001adab652fc4eb35e30cdefbb0765442f8b7db"; name = "LLVM_ORG_LIBCXX_SRC_${sha1}/llvm-org-libcxx-src.tar.gz";                          url = "https://lafo.ssw.uni-linz.ac.at/pub/llvm-org/compiler-rt-llvmorg-8.0.0-4-gd563e33a79-bgae3b177eaa-linux-amd64.tar.gz"; }
     rec { sha1 = "5001adab652fc4eb35e30cdefbb0765442f8b7db"; name = "LLVM_ORG_COMPILER_RT_LINUX_${sha1}/llvm-org-compiler-rt-linux.tar.gz";            url = "https://lafo.ssw.uni-linz.ac.at/pub/llvm-org/compiler-rt-llvmorg-8.0.0-4-gd563e33a79-bgae3b177eaa-linux-amd64.tar.gz"; }
     rec { sha1 = "a990b2dba1c706f5c43c56fedfe70bad9a695852"; name = "LLVM_WRAPPER_${sha1}/llvm-wrapper.jar";                                           url = "mirror://maven/org/bytedeco/javacpp-presets/llvm/6.0.1-1.4.2/llvm-6.0.1-1.4.2.jar"; }
     rec { sha1 = "decbd95d46092fa9afaf2523b5b23d07ad7ad6bc"; name = "LLVM_WRAPPER_${sha1}/llvm-wrapper.sources.jar";                                   url = "mirror://maven/org/bytedeco/javacpp-presets/llvm/6.0.1-1.4.2/llvm-6.0.1-1.4.2-sources.jar"; }
diff --git a/pkgs/development/compilers/llvm/10/clang/default.nix b/pkgs/development/compilers/llvm/10/clang/default.nix
index 51c0cd9ccc32e..10026ca4eb19a 100644
--- a/pkgs/development/compilers/llvm/10/clang/default.nix
+++ b/pkgs/development/compilers/llvm/10/clang/default.nix
@@ -95,7 +95,7 @@ let
 
     meta = {
       description = "A c, c++, objective-c, and objective-c++ frontend for the llvm compiler";
-      homepage    = "http://llvm.org/";
+      homepage    = "https://llvm.org/";
       license     = stdenv.lib.licenses.ncsa;
       platforms   = stdenv.lib.platforms.all;
     };
diff --git a/pkgs/development/compilers/llvm/10/libc++/default.nix b/pkgs/development/compilers/llvm/10/libc++/default.nix
index f7064bdc452b5..ed76ce77a8bb3 100644
--- a/pkgs/development/compilers/llvm/10/libc++/default.nix
+++ b/pkgs/development/compilers/llvm/10/libc++/default.nix
@@ -47,7 +47,7 @@ stdenv.mkDerivation {
   ];
 
   meta = {
-    homepage = "http://libcxx.llvm.org/";
+    homepage = "https://libcxx.llvm.org/";
     description = "A new implementation of the C++ standard library, targeting C++11";
     license = with stdenv.lib.licenses; [ ncsa mit ];
     platforms = stdenv.lib.platforms.all;
diff --git a/pkgs/development/compilers/llvm/10/libc++abi.nix b/pkgs/development/compilers/llvm/10/libc++abi.nix
index b3b90687a2ab1..ab45f27d24f42 100644
--- a/pkgs/development/compilers/llvm/10/libc++abi.nix
+++ b/pkgs/development/compilers/llvm/10/libc++abi.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation {
         # this should be done in CMake, but having trouble figuring out
         # the magic combination of necessary CMake variables
         # if you fancy a try, take a look at
-        # http://www.cmake.org/Wiki/CMake_RPATH_handling
+        # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
         install_name_tool -id $out/$file $file
       done
       make install
@@ -58,7 +58,7 @@ stdenv.mkDerivation {
     '';
 
   meta = {
-    homepage = "http://libcxxabi.llvm.org/";
+    homepage = "https://libcxxabi.llvm.org/";
     description = "A new implementation of low level support for a standard C++ library";
     license = with stdenv.lib.licenses; [ ncsa mit ];
     maintainers = with stdenv.lib.maintainers; [ vlstill ];
diff --git a/pkgs/development/compilers/llvm/10/lld.nix b/pkgs/development/compilers/llvm/10/lld.nix
index 8c66697c67e91..6a0032de2ac4c 100644
--- a/pkgs/development/compilers/llvm/10/lld.nix
+++ b/pkgs/development/compilers/llvm/10/lld.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "The LLVM Linker";
-    homepage    = "http://lld.llvm.org/";
+    homepage    = "https://lld.llvm.org/";
     license     = stdenv.lib.licenses.ncsa;
     platforms   = stdenv.lib.platforms.all;
   };
diff --git a/pkgs/development/compilers/llvm/10/lldb.nix b/pkgs/development/compilers/llvm/10/lldb.nix
index a4816a635e413..90716f67f836f 100644
--- a/pkgs/development/compilers/llvm/10/lldb.nix
+++ b/pkgs/development/compilers/llvm/10/lldb.nix
@@ -71,7 +71,7 @@ stdenv.mkDerivation (rec {
 
   meta = with stdenv.lib; {
     description = "A next-generation high-performance debugger";
-    homepage = "http://lldb.llvm.org";
+    homepage = "https://lldb.llvm.org";
     license = licenses.ncsa;
     platforms = platforms.all;
   };
diff --git a/pkgs/development/compilers/llvm/10/llvm.nix b/pkgs/development/compilers/llvm/10/llvm.nix
index f36f58d82038b..648c9fdefc34c 100644
--- a/pkgs/development/compilers/llvm/10/llvm.nix
+++ b/pkgs/development/compilers/llvm/10/llvm.nix
@@ -161,7 +161,7 @@ in stdenv.mkDerivation (rec {
 
   meta = {
     description = "Collection of modular and reusable compiler and toolchain technologies";
-    homepage    = "http://llvm.org/";
+    homepage    = "https://llvm.org/";
     license     = stdenv.lib.licenses.ncsa;
     maintainers = with stdenv.lib.maintainers; [ lovek323 raskin dtzWill ];
     platforms   = stdenv.lib.platforms.all;
diff --git a/pkgs/development/compilers/llvm/10/openmp.nix b/pkgs/development/compilers/llvm/10/openmp.nix
index 940f53f4cf751..624c99bc86835 100644
--- a/pkgs/development/compilers/llvm/10/openmp.nix
+++ b/pkgs/development/compilers/llvm/10/openmp.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Components required to build an executable OpenMP program";
-    homepage    = "http://openmp.llvm.org/";
+    homepage    = "https://openmp.llvm.org/";
     license     = stdenv.lib.licenses.mit;
     platforms   = stdenv.lib.platforms.all;
   };
diff --git a/pkgs/development/compilers/llvm/5/clang/default.nix b/pkgs/development/compilers/llvm/5/clang/default.nix
index 0317271f003ad..1016398992fbb 100644
--- a/pkgs/development/compilers/llvm/5/clang/default.nix
+++ b/pkgs/development/compilers/llvm/5/clang/default.nix
@@ -83,7 +83,7 @@ let
 
     meta = {
       description = "A c, c++, objective-c, and objective-c++ frontend for the llvm compiler";
-      homepage    = "http://llvm.org/";
+      homepage    = "https://llvm.org/";
       license     = stdenv.lib.licenses.ncsa;
       platforms   = stdenv.lib.platforms.all;
     };
diff --git a/pkgs/development/compilers/llvm/5/libc++/default.nix b/pkgs/development/compilers/llvm/5/libc++/default.nix
index 5bd3cde2329ee..88ad3c29c3e28 100644
--- a/pkgs/development/compilers/llvm/5/libc++/default.nix
+++ b/pkgs/development/compilers/llvm/5/libc++/default.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation {
   ];
 
   meta = {
-    homepage = "http://libcxx.llvm.org/";
+    homepage = "https://libcxx.llvm.org/";
     description = "A new implementation of the C++ standard library, targeting C++11";
     license = with stdenv.lib.licenses; [ ncsa mit ];
     platforms = stdenv.lib.platforms.unix;
diff --git a/pkgs/development/compilers/llvm/5/libc++abi.nix b/pkgs/development/compilers/llvm/5/libc++abi.nix
index e3ffc473c34da..96d6e78e01e4a 100644
--- a/pkgs/development/compilers/llvm/5/libc++abi.nix
+++ b/pkgs/development/compilers/llvm/5/libc++abi.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
         # this should be done in CMake, but having trouble figuring out
         # the magic combination of necessary CMake variables
         # if you fancy a try, take a look at
-        # http://www.cmake.org/Wiki/CMake_RPATH_handling
+        # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
         install_name_tool -id $out/$file $file
       done
       make install
@@ -42,7 +42,7 @@ stdenv.mkDerivation {
     '';
 
   meta = {
-    homepage = "http://libcxxabi.llvm.org/";
+    homepage = "https://libcxxabi.llvm.org/";
     description = "A new implementation of low level support for a standard C++ library";
     license = with stdenv.lib.licenses; [ ncsa mit ];
     maintainers = with stdenv.lib.maintainers; [ vlstill ];
diff --git a/pkgs/development/compilers/llvm/5/lld.nix b/pkgs/development/compilers/llvm/5/lld.nix
index 7ab02c1d35c1e..3d9ed6ee66358 100644
--- a/pkgs/development/compilers/llvm/5/lld.nix
+++ b/pkgs/development/compilers/llvm/5/lld.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "The LLVM Linker";
-    homepage    = "http://lld.llvm.org/";
+    homepage    = "https://lld.llvm.org/";
     license     = stdenv.lib.licenses.ncsa;
     platforms   = stdenv.lib.platforms.all;
     badPlatforms = [ "x86_64-darwin" ];
diff --git a/pkgs/development/compilers/llvm/5/lldb.nix b/pkgs/development/compilers/llvm/5/lldb.nix
index 4a0d678cc2a17..e0698e1dcf3dd 100644
--- a/pkgs/development/compilers/llvm/5/lldb.nix
+++ b/pkgs/development/compilers/llvm/5/lldb.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation {
 
   meta = with stdenv.lib; {
     description = "A next-generation high-performance debugger";
-    homepage    = "http://llvm.org/";
+    homepage    = "https://llvm.org/";
     license     = licenses.ncsa;
     platforms   = platforms.all;
   };
diff --git a/pkgs/development/compilers/llvm/5/llvm.nix b/pkgs/development/compilers/llvm/5/llvm.nix
index 1bf86115bc26f..987e6258527ac 100644
--- a/pkgs/development/compilers/llvm/5/llvm.nix
+++ b/pkgs/development/compilers/llvm/5/llvm.nix
@@ -151,7 +151,7 @@ stdenv.mkDerivation ({
   requiredSystemFeatures = [ "big-parallel" ];
   meta = {
     description = "Collection of modular and reusable compiler and toolchain technologies";
-    homepage    = "http://llvm.org/";
+    homepage    = "https://llvm.org/";
     license     = stdenv.lib.licenses.ncsa;
     maintainers = with stdenv.lib.maintainers; [ lovek323 raskin dtzWill ];
     platforms   = stdenv.lib.platforms.all;
diff --git a/pkgs/development/compilers/llvm/5/openmp.nix b/pkgs/development/compilers/llvm/5/openmp.nix
index 34e6bc64bfdf8..da328de24d137 100644
--- a/pkgs/development/compilers/llvm/5/openmp.nix
+++ b/pkgs/development/compilers/llvm/5/openmp.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Components required to build an executable OpenMP program";
-    homepage    = "http://openmp.llvm.org/";
+    homepage    = "https://openmp.llvm.org/";
     license     = stdenv.lib.licenses.mit;
     platforms   = stdenv.lib.platforms.all;
   };
diff --git a/pkgs/development/compilers/llvm/6/clang/default.nix b/pkgs/development/compilers/llvm/6/clang/default.nix
index 7139e15d1dc39..e2f7166354ae5 100644
--- a/pkgs/development/compilers/llvm/6/clang/default.nix
+++ b/pkgs/development/compilers/llvm/6/clang/default.nix
@@ -83,7 +83,7 @@ let
 
     meta = {
       description = "A c, c++, objective-c, and objective-c++ frontend for the llvm compiler";
-      homepage    = "http://llvm.org/";
+      homepage    = "https://llvm.org/";
       license     = stdenv.lib.licenses.ncsa;
       platforms   = stdenv.lib.platforms.all;
     };
diff --git a/pkgs/development/compilers/llvm/6/libc++/default.nix b/pkgs/development/compilers/llvm/6/libc++/default.nix
index 40f91c4d6aefd..57f1431f4711e 100644
--- a/pkgs/development/compilers/llvm/6/libc++/default.nix
+++ b/pkgs/development/compilers/llvm/6/libc++/default.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation {
   ];
 
   meta = {
-    homepage = "http://libcxx.llvm.org/";
+    homepage = "https://libcxx.llvm.org/";
     description = "A new implementation of the C++ standard library, targeting C++11";
     license = with stdenv.lib.licenses; [ ncsa mit ];
     platforms = stdenv.lib.platforms.unix;
diff --git a/pkgs/development/compilers/llvm/6/libc++abi.nix b/pkgs/development/compilers/llvm/6/libc++abi.nix
index f8d0d2e0cee89..246bc6153e599 100644
--- a/pkgs/development/compilers/llvm/6/libc++abi.nix
+++ b/pkgs/development/compilers/llvm/6/libc++abi.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
         # this should be done in CMake, but having trouble figuring out
         # the magic combination of necessary CMake variables
         # if you fancy a try, take a look at
-        # http://www.cmake.org/Wiki/CMake_RPATH_handling
+        # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
         install_name_tool -id $out/$file $file
       done
       make install
@@ -42,7 +42,7 @@ stdenv.mkDerivation {
     '';
 
   meta = {
-    homepage = "http://libcxxabi.llvm.org/";
+    homepage = "https://libcxxabi.llvm.org/";
     description = "A new implementation of low level support for a standard C++ library";
     license = with stdenv.lib.licenses; [ ncsa mit ];
     maintainers = with stdenv.lib.maintainers; [ vlstill ];
diff --git a/pkgs/development/compilers/llvm/6/lld.nix b/pkgs/development/compilers/llvm/6/lld.nix
index e00b71bc33e4b..81b94df311940 100644
--- a/pkgs/development/compilers/llvm/6/lld.nix
+++ b/pkgs/development/compilers/llvm/6/lld.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "The LLVM Linker";
-    homepage    = "http://lld.llvm.org/";
+    homepage    = "https://lld.llvm.org/";
     license     = stdenv.lib.licenses.ncsa;
     platforms   = stdenv.lib.platforms.all;
   };
diff --git a/pkgs/development/compilers/llvm/6/lldb.nix b/pkgs/development/compilers/llvm/6/lldb.nix
index 0445dfed47f5e..80e298eaf8c0c 100644
--- a/pkgs/development/compilers/llvm/6/lldb.nix
+++ b/pkgs/development/compilers/llvm/6/lldb.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation {
 
   meta = with stdenv.lib; {
     description = "A next-generation high-performance debugger";
-    homepage    = "http://llvm.org/";
+    homepage    = "https://llvm.org/";
     license     = licenses.ncsa;
     platforms   = platforms.all;
   };
diff --git a/pkgs/development/compilers/llvm/6/llvm.nix b/pkgs/development/compilers/llvm/6/llvm.nix
index e1e40c8456d5d..9f3b5e5ba0d09 100644
--- a/pkgs/development/compilers/llvm/6/llvm.nix
+++ b/pkgs/development/compilers/llvm/6/llvm.nix
@@ -149,7 +149,7 @@ stdenv.mkDerivation ({
 
   meta = {
     description = "Collection of modular and reusable compiler and toolchain technologies";
-    homepage    = "http://llvm.org/";
+    homepage    = "https://llvm.org/";
     license     = stdenv.lib.licenses.ncsa;
     maintainers = with stdenv.lib.maintainers; [ lovek323 raskin dtzWill ];
     platforms   = stdenv.lib.platforms.all;
diff --git a/pkgs/development/compilers/llvm/6/openmp.nix b/pkgs/development/compilers/llvm/6/openmp.nix
index efc5553b1d664..c1a4480a5524c 100644
--- a/pkgs/development/compilers/llvm/6/openmp.nix
+++ b/pkgs/development/compilers/llvm/6/openmp.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Components required to build an executable OpenMP program";
-    homepage    = "http://openmp.llvm.org/";
+    homepage    = "https://openmp.llvm.org/";
     license     = stdenv.lib.licenses.mit;
     platforms   = stdenv.lib.platforms.all;
   };
diff --git a/pkgs/development/compilers/llvm/7/clang/default.nix b/pkgs/development/compilers/llvm/7/clang/default.nix
index 3a43b6b8aeef6..18ea46ea39c40 100644
--- a/pkgs/development/compilers/llvm/7/clang/default.nix
+++ b/pkgs/development/compilers/llvm/7/clang/default.nix
@@ -93,7 +93,7 @@ let
 
     meta = {
       description = "A c, c++, objective-c, and objective-c++ frontend for the llvm compiler";
-      homepage    = "http://llvm.org/";
+      homepage    = "https://llvm.org/";
       license     = stdenv.lib.licenses.ncsa;
       platforms   = stdenv.lib.platforms.all;
     };
diff --git a/pkgs/development/compilers/llvm/7/libc++/default.nix b/pkgs/development/compilers/llvm/7/libc++/default.nix
index 7c2f1e238bab7..96cb671fa431f 100644
--- a/pkgs/development/compilers/llvm/7/libc++/default.nix
+++ b/pkgs/development/compilers/llvm/7/libc++/default.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation {
   ];
 
   meta = {
-    homepage = "http://libcxx.llvm.org/";
+    homepage = "https://libcxx.llvm.org/";
     description = "A new implementation of the C++ standard library, targeting C++11";
     license = with stdenv.lib.licenses; [ ncsa mit ];
     platforms = stdenv.lib.platforms.unix;
diff --git a/pkgs/development/compilers/llvm/7/libc++abi.nix b/pkgs/development/compilers/llvm/7/libc++abi.nix
index 608351e0eb952..97141a0bd402a 100644
--- a/pkgs/development/compilers/llvm/7/libc++abi.nix
+++ b/pkgs/development/compilers/llvm/7/libc++abi.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation {
         # this should be done in CMake, but having trouble figuring out
         # the magic combination of necessary CMake variables
         # if you fancy a try, take a look at
-        # http://www.cmake.org/Wiki/CMake_RPATH_handling
+        # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
         install_name_tool -id $out/$file $file
       done
       make install
@@ -45,7 +45,7 @@ stdenv.mkDerivation {
     '';
 
   meta = {
-    homepage = "http://libcxxabi.llvm.org/";
+    homepage = "https://libcxxabi.llvm.org/";
     description = "A new implementation of low level support for a standard C++ library";
     license = with stdenv.lib.licenses; [ ncsa mit ];
     maintainers = with stdenv.lib.maintainers; [ vlstill ];
diff --git a/pkgs/development/compilers/llvm/7/lld.nix b/pkgs/development/compilers/llvm/7/lld.nix
index 3921e70b3e305..bee9202ed6c18 100644
--- a/pkgs/development/compilers/llvm/7/lld.nix
+++ b/pkgs/development/compilers/llvm/7/lld.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "The LLVM Linker";
-    homepage    = "http://lld.llvm.org/";
+    homepage    = "https://lld.llvm.org/";
     license     = stdenv.lib.licenses.ncsa;
     platforms   = stdenv.lib.platforms.all;
   };
diff --git a/pkgs/development/compilers/llvm/7/lldb.nix b/pkgs/development/compilers/llvm/7/lldb.nix
index 81ad067583906..8fadd3cf7849e 100644
--- a/pkgs/development/compilers/llvm/7/lldb.nix
+++ b/pkgs/development/compilers/llvm/7/lldb.nix
@@ -61,7 +61,7 @@ stdenv.mkDerivation {
 
   meta = with stdenv.lib; {
     description = "A next-generation high-performance debugger";
-    homepage    = "http://llvm.org/";
+    homepage    = "https://llvm.org/";
     license     = licenses.ncsa;
     platforms   = platforms.all;
   };
diff --git a/pkgs/development/compilers/llvm/7/llvm.nix b/pkgs/development/compilers/llvm/7/llvm.nix
index 0ea517e81f460..55485418e4f14 100644
--- a/pkgs/development/compilers/llvm/7/llvm.nix
+++ b/pkgs/development/compilers/llvm/7/llvm.nix
@@ -170,7 +170,7 @@ in stdenv.mkDerivation ({
 
   meta = {
     description = "Collection of modular and reusable compiler and toolchain technologies";
-    homepage    = "http://llvm.org/";
+    homepage    = "https://llvm.org/";
     license     = stdenv.lib.licenses.ncsa;
     maintainers = with stdenv.lib.maintainers; [ lovek323 raskin dtzWill ];
     platforms   = stdenv.lib.platforms.all;
diff --git a/pkgs/development/compilers/llvm/7/openmp.nix b/pkgs/development/compilers/llvm/7/openmp.nix
index 69ee58679c42a..898d49dce834e 100644
--- a/pkgs/development/compilers/llvm/7/openmp.nix
+++ b/pkgs/development/compilers/llvm/7/openmp.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Components required to build an executable OpenMP program";
-    homepage    = "http://openmp.llvm.org/";
+    homepage    = "https://openmp.llvm.org/";
     license     = stdenv.lib.licenses.mit;
     platforms   = stdenv.lib.platforms.all;
   };
diff --git a/pkgs/development/compilers/llvm/8/clang/default.nix b/pkgs/development/compilers/llvm/8/clang/default.nix
index e549713cecaa6..3b398628e567c 100644
--- a/pkgs/development/compilers/llvm/8/clang/default.nix
+++ b/pkgs/development/compilers/llvm/8/clang/default.nix
@@ -103,7 +103,7 @@ let
 
     meta = {
       description = "A c, c++, objective-c, and objective-c++ frontend for the llvm compiler";
-      homepage    = "http://llvm.org/";
+      homepage    = "https://llvm.org/";
       license     = stdenv.lib.licenses.ncsa;
       platforms   = stdenv.lib.platforms.all;
     };
diff --git a/pkgs/development/compilers/llvm/8/libc++/default.nix b/pkgs/development/compilers/llvm/8/libc++/default.nix
index 97293464645a9..24bca6aafcd1c 100644
--- a/pkgs/development/compilers/llvm/8/libc++/default.nix
+++ b/pkgs/development/compilers/llvm/8/libc++/default.nix
@@ -51,7 +51,7 @@ stdenv.mkDerivation {
   ];
 
   meta = {
-    homepage = "http://libcxx.llvm.org/";
+    homepage = "https://libcxx.llvm.org/";
     description = "A new implementation of the C++ standard library, targeting C++11";
     license = with stdenv.lib.licenses; [ ncsa mit ];
     platforms = stdenv.lib.platforms.all;
diff --git a/pkgs/development/compilers/llvm/8/libc++abi.nix b/pkgs/development/compilers/llvm/8/libc++abi.nix
index d8c64f51ee079..590872aaab649 100644
--- a/pkgs/development/compilers/llvm/8/libc++abi.nix
+++ b/pkgs/development/compilers/llvm/8/libc++abi.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation {
         # this should be done in CMake, but having trouble figuring out
         # the magic combination of necessary CMake variables
         # if you fancy a try, take a look at
-        # http://www.cmake.org/Wiki/CMake_RPATH_handling
+        # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
         install_name_tool -id $out/$file $file
       done
       make install
@@ -58,7 +58,7 @@ stdenv.mkDerivation {
     '';
 
   meta = {
-    homepage = "http://libcxxabi.llvm.org/";
+    homepage = "https://libcxxabi.llvm.org/";
     description = "A new implementation of low level support for a standard C++ library";
     license = with stdenv.lib.licenses; [ ncsa mit ];
     maintainers = with stdenv.lib.maintainers; [ vlstill ];
diff --git a/pkgs/development/compilers/llvm/8/lld.nix b/pkgs/development/compilers/llvm/8/lld.nix
index da5649ef5a233..ba9cf3c57d773 100644
--- a/pkgs/development/compilers/llvm/8/lld.nix
+++ b/pkgs/development/compilers/llvm/8/lld.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "The LLVM Linker";
-    homepage    = "http://lld.llvm.org/";
+    homepage    = "https://lld.llvm.org/";
     license     = stdenv.lib.licenses.ncsa;
     platforms   = stdenv.lib.platforms.all;
   };
diff --git a/pkgs/development/compilers/llvm/8/lldb.nix b/pkgs/development/compilers/llvm/8/lldb.nix
index 5df6f760a07dc..298ce737fc73e 100644
--- a/pkgs/development/compilers/llvm/8/lldb.nix
+++ b/pkgs/development/compilers/llvm/8/lldb.nix
@@ -54,7 +54,7 @@ stdenv.mkDerivation {
 
   meta = with stdenv.lib; {
     description = "A next-generation high-performance debugger";
-    homepage    = "http://llvm.org/";
+    homepage    = "https://llvm.org/";
     license     = licenses.ncsa;
     platforms   = platforms.all;
   };
diff --git a/pkgs/development/compilers/llvm/8/llvm.nix b/pkgs/development/compilers/llvm/8/llvm.nix
index 9bf835027aef4..43615fc675dce 100644
--- a/pkgs/development/compilers/llvm/8/llvm.nix
+++ b/pkgs/development/compilers/llvm/8/llvm.nix
@@ -145,7 +145,7 @@ in stdenv.mkDerivation ({
 
   meta = {
     description = "Collection of modular and reusable compiler and toolchain technologies";
-    homepage    = "http://llvm.org/";
+    homepage    = "https://llvm.org/";
     license     = stdenv.lib.licenses.ncsa;
     maintainers = with stdenv.lib.maintainers; [ lovek323 raskin dtzWill ];
     platforms   = stdenv.lib.platforms.all;
diff --git a/pkgs/development/compilers/llvm/8/openmp.nix b/pkgs/development/compilers/llvm/8/openmp.nix
index 74ec8076e435a..42cc7adf4f00d 100644
--- a/pkgs/development/compilers/llvm/8/openmp.nix
+++ b/pkgs/development/compilers/llvm/8/openmp.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Components required to build an executable OpenMP program";
-    homepage    = "http://openmp.llvm.org/";
+    homepage    = "https://openmp.llvm.org/";
     license     = stdenv.lib.licenses.mit;
     platforms   = stdenv.lib.platforms.all;
   };
diff --git a/pkgs/development/compilers/llvm/9/clang/default.nix b/pkgs/development/compilers/llvm/9/clang/default.nix
index 51399ea45988d..c938a01f8979e 100644
--- a/pkgs/development/compilers/llvm/9/clang/default.nix
+++ b/pkgs/development/compilers/llvm/9/clang/default.nix
@@ -98,7 +98,7 @@ let
 
     meta = {
       description = "A c, c++, objective-c, and objective-c++ frontend for the llvm compiler";
-      homepage    = "http://llvm.org/";
+      homepage    = "https://llvm.org/";
       license     = stdenv.lib.licenses.ncsa;
       platforms   = stdenv.lib.platforms.all;
     };
diff --git a/pkgs/development/compilers/llvm/9/libc++/default.nix b/pkgs/development/compilers/llvm/9/libc++/default.nix
index 05aaa9fc8e5b0..f3081d1f26991 100644
--- a/pkgs/development/compilers/llvm/9/libc++/default.nix
+++ b/pkgs/development/compilers/llvm/9/libc++/default.nix
@@ -47,7 +47,7 @@ stdenv.mkDerivation {
   ];
 
   meta = {
-    homepage = "http://libcxx.llvm.org/";
+    homepage = "https://libcxx.llvm.org/";
     description = "A new implementation of the C++ standard library, targeting C++11";
     license = with stdenv.lib.licenses; [ ncsa mit ];
     platforms = stdenv.lib.platforms.all;
diff --git a/pkgs/development/compilers/llvm/9/libc++abi.nix b/pkgs/development/compilers/llvm/9/libc++abi.nix
index 583a47da3ffc5..5b63560282c04 100644
--- a/pkgs/development/compilers/llvm/9/libc++abi.nix
+++ b/pkgs/development/compilers/llvm/9/libc++abi.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation {
         # this should be done in CMake, but having trouble figuring out
         # the magic combination of necessary CMake variables
         # if you fancy a try, take a look at
-        # http://www.cmake.org/Wiki/CMake_RPATH_handling
+        # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
         install_name_tool -id $out/$file $file
       done
       make install
@@ -58,7 +58,7 @@ stdenv.mkDerivation {
     '';
 
   meta = {
-    homepage = "http://libcxxabi.llvm.org/";
+    homepage = "https://libcxxabi.llvm.org/";
     description = "A new implementation of low level support for a standard C++ library";
     license = with stdenv.lib.licenses; [ ncsa mit ];
     maintainers = with stdenv.lib.maintainers; [ vlstill ];
diff --git a/pkgs/development/compilers/llvm/9/lld.nix b/pkgs/development/compilers/llvm/9/lld.nix
index a746b96f30d54..488870e729a52 100644
--- a/pkgs/development/compilers/llvm/9/lld.nix
+++ b/pkgs/development/compilers/llvm/9/lld.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "The LLVM Linker";
-    homepage    = "http://lld.llvm.org/";
+    homepage    = "https://lld.llvm.org/";
     license     = stdenv.lib.licenses.ncsa;
     platforms   = stdenv.lib.platforms.all;
   };
diff --git a/pkgs/development/compilers/llvm/9/lldb.nix b/pkgs/development/compilers/llvm/9/lldb.nix
index 1ba0339d6390b..a8e193c27b173 100644
--- a/pkgs/development/compilers/llvm/9/lldb.nix
+++ b/pkgs/development/compilers/llvm/9/lldb.nix
@@ -65,7 +65,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "A next-generation high-performance debugger";
-    homepage = "http://llvm.org/";
+    homepage = "https://llvm.org/";
     license = licenses.ncsa;
     platforms = platforms.all;
   };
diff --git a/pkgs/development/compilers/llvm/9/llvm.nix b/pkgs/development/compilers/llvm/9/llvm.nix
index 49ea3be34da66..f69f45b858b7e 100644
--- a/pkgs/development/compilers/llvm/9/llvm.nix
+++ b/pkgs/development/compilers/llvm/9/llvm.nix
@@ -162,7 +162,7 @@ in stdenv.mkDerivation (rec {
 
   meta = {
     description = "Collection of modular and reusable compiler and toolchain technologies";
-    homepage    = "http://llvm.org/";
+    homepage    = "https://llvm.org/";
     license     = stdenv.lib.licenses.ncsa;
     maintainers = with stdenv.lib.maintainers; [ lovek323 raskin dtzWill ];
     platforms   = stdenv.lib.platforms.all;
diff --git a/pkgs/development/compilers/llvm/9/openmp.nix b/pkgs/development/compilers/llvm/9/openmp.nix
index b5699cd1af027..84f898ec06a13 100644
--- a/pkgs/development/compilers/llvm/9/openmp.nix
+++ b/pkgs/development/compilers/llvm/9/openmp.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Components required to build an executable OpenMP program";
-    homepage    = "http://openmp.llvm.org/";
+    homepage    = "https://openmp.llvm.org/";
     license     = stdenv.lib.licenses.mit;
     platforms   = stdenv.lib.platforms.all;
   };
diff --git a/pkgs/development/compilers/tinygo/default.nix b/pkgs/development/compilers/tinygo/default.nix
index 412dfa53feb16..069ef69dc7ef6 100644
--- a/pkgs/development/compilers/tinygo/default.nix
+++ b/pkgs/development/compilers/tinygo/default.nix
@@ -3,16 +3,16 @@
 
 buildGoModule rec {
   pname = "tinygo";
-  version = "0.12.0";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "tinygo-org";
     repo = "tinygo";
     rev = "v${version}";
-    sha256 = "0dw3kxf55p617pb0bj3knsqcfvap5scxlvhh3a9g9ia92kann4v1";
+    sha256 = "0x59j56y704m2hfkg78illgw9f6czrx265x887jfd989lnxphyqa";
   };
 
-  modSha256 = "1bjq4vaf38hi204lr9w3r3wcy1rzj06ygi5gzfa7dl3kx10hw6p0";
+  modSha256 = "0y8n4mcr4jhas29ahvk8k4zbj1iz65fdpsgq61qa8kcsm8m5kqa6";
   enableParallelBuilding = true;
   subPackages = [ "." ];
   buildInputs = [ llvm clang-unwrapped makeWrapper ];
diff --git a/pkgs/development/haskell-modules/configuration-tensorflow.nix b/pkgs/development/haskell-modules/configuration-tensorflow.nix
index ba0acd6b6d693..aab416b9a87b6 100644
--- a/pkgs/development/haskell-modules/configuration-tensorflow.nix
+++ b/pkgs/development/haskell-modules/configuration-tensorflow.nix
@@ -55,12 +55,12 @@ in
   haskell-src-exts_1_19_1 = appendPatches (doJailbreak super.haskell-src-exts_1_19_1) [
     # Adapt to the Semigroup–Monoid Proposal (enables building on GHC >= 8.4)
     (pkgs.fetchpatch {
-        url = https://github.com/haskell-suite/haskell-src-exts/commit/258e072fe9e37f94360b7488b58ea2832843bbb8.patch;
+        url = "https://github.com/haskell-suite/haskell-src-exts/commit/258e072fe9e37f94360b7488b58ea2832843bbb8.patch";
         sha256 = "0ja6ai41v9plinlhjwja282m6ahn6mw4xi79np0jxqk83cg0z1ff";
     })
     # Adapt to MonadFail proposal (enables building on GHC >= 8.8)
     (pkgs.fetchpatch {
-        url = https://gist.githubusercontent.com/mikesperber/0f2addaf3fbe97ffb4a5234d8711ba41/raw/e09e20998283c7195e82d546ba9266d290eb000d/gistfile1.txt;
+        url = "https://gist.githubusercontent.com/mikesperber/0f2addaf3fbe97ffb4a5234d8711ba41/raw/e09e20998283c7195e82d546ba9266d290eb000d/gistfile1.txt";
         sha256 = "18clvli7vpqsqlf2f3qidn71738j9zdlpana6wha3x0dxwan5ly0";
     }) ];
 
diff --git a/pkgs/development/interpreters/j/default.nix b/pkgs/development/interpreters/j/default.nix
index f7500c169e6db..c3d5221d42a7a 100644
--- a/pkgs/development/interpreters/j/default.nix
+++ b/pkgs/development/interpreters/j/default.nix
@@ -2,13 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "j";
-  version = "807";
-  jtype = "release";
+  version = "901";
+  jtype = "release-e";
   src = fetchFromGitHub {
     owner = "jsoftware";
     repo = "jsource";
     rev = "j${version}-${jtype}";
-    sha256 = "1qciw2yg9x996zglvj2461qby038x89xcmfb3qyrh3myn8m1nq2n";
+    sha256 = "13ky37rrl6mc66fckrdnrw64gmvq1qlv6skzd513lab4d0wigshw";
+    name = "jsource";
   };
 
   buildInputs = [ readline libedit bc ];
@@ -26,57 +27,33 @@ stdenv.mkDerivation rec {
     export HOME=$TMPDIR
     export JLIB=$SOURCE_DIR/jlibrary
 
-    export jbld=$HOME/bld
-    export jplatform=${platform}
-    export jmake=$SOURCE_DIR/make
-    export jgit=$SOURCE_DIR
-    export JBIN=$jbld/j${bits}/bin
-    mkdir -p $JBIN
-
     echo $OUT_DIR
 
-    cd make
+    cd make2
 
     patchShebangs .
-    sed -i jvars.sh -e "
-      s@~/git/jsource@$SOURCE_DIR@;
-      s@~/jbld@$HOME@;
-      "
-
     sed -i $JLIB/bin/profile.ijs -e "s@'/usr/share/j/.*'@'$out/share/j'@;"
 
-    # For future versions, watch
-    # https://github.com/jsoftware/jsource/pull/4
-    cp ./jvars.sh $HOME
+    ./build_all.sh
 
-    echo '
-      #define jversion   "${version}"
-      #define jplatform  "${platform}"
-      #define jtype      "${jtype}"         // release,beta,...
-      #define jlicense   "GPL3"
-      #define jbuilder   "nixpkgs"  // website or email
-      ' > ../jsrc/jversion.h
-
-    ./build_jconsole.sh j${bits}
-    ./build_libj.sh j${bits}
+    cp $SOURCE_DIR/bin/${platform}/j${bits}*/* "$JLIB/bin"
   '';
 
   checkPhase = ''
-    echo 'i. 5' | $JBIN/jconsole | fgrep "0 1 2 3 4"
+
+    echo 'i. 5' | $JLIB/bin/jconsole | fgrep "0 1 2 3 4"
 
     # Now run the real tests
     cd $SOURCE_DIR/test
     for f in *.ijs
     do
       echo $f
-      $JBIN/jconsole < $f > /dev/null || echo FAIL && echo PASS
+      $JLIB/bin/jconsole < $f > /dev/null || echo FAIL && echo PASS
     done
   '';
 
   installPhase = ''
     mkdir -p "$out"
-    cp -r $JBIN "$out/bin"
-    rm $out/bin/*.txt # Remove logs from the bin folder
 
     mkdir -p "$out/share/j"
     cp -r $JLIB/{addons,system} "$out/share/j"
diff --git a/pkgs/development/interpreters/perl/default.nix b/pkgs/development/interpreters/perl/default.nix
index 99a3104b21d36..cc43a7d2f858c 100644
--- a/pkgs/development/interpreters/perl/default.nix
+++ b/pkgs/development/interpreters/perl/default.nix
@@ -170,11 +170,11 @@ let
       priority = 6; # in `buildEnv' (including the one inside `perl.withPackages') the library files will have priority over files in `perl`
     };
   } // optionalAttrs (stdenv.buildPlatform != stdenv.hostPlatform) rec {
-    crossVersion = "ba90816ef2c24dc06fd6cd2c854abcfa1aae00a3"; # Nov 22, 2019
+    crossVersion = "1.3.2"; # Mar 21, 2020
 
     perl-cross-src = fetchurl {
       url = "https://github.com/arsv/perl-cross/archive/${crossVersion}.tar.gz";
-      sha256 = "19jq5fz6l64s0v6j64n5mkk5v2srpyfn9sc09hwbpkp9n74q82j4";
+      sha256 = "1283crdjsyi45mgdiak4jmy907mqn09frxzxp21b18hvxmfn4smq";
     };
 
     depsBuildBuild = [ buildPackages.stdenv.cc makeWrapper ];
@@ -202,15 +202,15 @@ in {
   perl530 = common {
     perl = pkgs.perl530;
     buildPerl = buildPackages.perl530;
-    version = "5.30.1";
-    sha256 = "0r7r8a7pkgxp3w5lza559ahxczw6hzpwvhkpc4c99vpi3xbjagdz";
+    version = "5.30.2";
+    sha256 = "128nfdxcvxfn5kq55qcfrx2851ys8hv794dcdxbyny8rm7w7vnv6";
   };
 
   # the latest Devel version
   perldevel = common {
     perl = pkgs.perldevel;
     buildPerl = buildPackages.perldevel;
-    version = "5.31.6";
-    sha256 = "08n3c8xm1brxpckqy8i1xgjrpl4afrhcva9bhxswr938n675x71k";
+    version = "5.31.10";
+    sha256 = "1gvv5zs54gzb947x7ryjkaalm9rbqf8l8hwjwdm9lbfgkpg07kny";
   };
 }
diff --git a/pkgs/development/interpreters/wasmtime/default.nix b/pkgs/development/interpreters/wasmtime/default.nix
index 6bb17e70958c5..79222749dc4b8 100644
--- a/pkgs/development/interpreters/wasmtime/default.nix
+++ b/pkgs/development/interpreters/wasmtime/default.nix
@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage rec {
     fetchSubmodules = true;
   };
 
-  cargoSha256 = "0wqd2yy6ih1rcz1fq7x3aiqq1ma2nmif1w8r8x0vpxjxk395zil9";
+  cargoSha256 = "0vyxp74jlnrisk0kblsbj9d9a54wcgzbyjm7iqav1k4ns3syrnmh";
 
   nativeBuildInputs = [ python cmake clang ];
   buildInputs = [ llvmPackages.libclang ] ++
diff --git a/pkgs/development/libraries/at-spi2-atk/default.nix b/pkgs/development/libraries/at-spi2-atk/default.nix
index f16b38e3fd84a..6a1ca6d24d36c 100644
--- a/pkgs/development/libraries/at-spi2-atk/default.nix
+++ b/pkgs/development/libraries/at-spi2-atk/default.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     description = "D-Bus bridge for Assistive Technology Service Provider Interface (AT-SPI) and Accessibility Toolkit (ATK)";
     homepage = "https://gitlab.gnome.org/GNOME/at-spi2-atk";
     license = licenses.lgpl21Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/at-spi2-core/default.nix b/pkgs/development/libraries/at-spi2-core/default.nix
index fa7dd13b84f88..32667bf66e0ff 100644
--- a/pkgs/development/libraries/at-spi2-core/default.nix
+++ b/pkgs/development/libraries/at-spi2-core/default.nix
@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
     description = "Assistive Technology Service Provider Interface protocol definitions and daemon for D-Bus";
     homepage = "https://gitlab.gnome.org/GNOME/at-spi2-core";
     license = licenses.lgpl21Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/biblesync/default.nix b/pkgs/development/libraries/biblesync/default.nix
index 54a4fa7a686e3..814ecf986e9b2 100644
--- a/pkgs/development/libraries/biblesync/default.nix
+++ b/pkgs/development/libraries/biblesync/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ libuuid ];
 
   meta = with stdenv.lib; {
-    homepage = http://www.crosswire.org/wiki/BibleSync;
+    homepage = "http://www.crosswire.org/wiki/BibleSync";
     description = "A multicast protocol to Bible software shared conavigation";
     longDescription = ''
       BibleSync is a multicast protocol to support Bible software shared
diff --git a/pkgs/development/libraries/dconf/default.nix b/pkgs/development/libraries/dconf/default.nix
index 8c3a2965484f3..d4e303b67af70 100644
--- a/pkgs/development/libraries/dconf/default.nix
+++ b/pkgs/development/libraries/dconf/default.nix
@@ -41,6 +41,6 @@ stdenv.mkDerivation rec {
     homepage = "https://wiki.gnome.org/Projects/dconf";
     license = licenses.lgpl21Plus;
     platforms = platforms.linux ++ platforms.darwin;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
   };
 }
diff --git a/pkgs/development/libraries/dnnl/bash-to-sh.patch b/pkgs/development/libraries/dnnl/bash-to-sh.patch
deleted file mode 100644
index 063d9ef952be8..0000000000000
--- a/pkgs/development/libraries/dnnl/bash-to-sh.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
-index f6810246..e1d2a1f1 100644
---- a/tests/CMakeLists.txt
-+++ b/tests/CMakeLists.txt
-@@ -72,7 +72,7 @@ if(UNIX OR MINGW)
-     set(test_c_symbols "${CMAKE_CURRENT_BINARY_DIR}/test_c_symbols.c")
-     add_custom_command(
-         OUTPUT ${test_c_symbols}
--        COMMAND /bin/bash ${CMAKE_CURRENT_SOURCE_DIR}/generate_c_symbols_refs.sh
-+        COMMAND @bash@/bin/bash ${CMAKE_CURRENT_SOURCE_DIR}/generate_c_symbols_refs.sh
-         ${CMAKE_CURRENT_SOURCE_DIR}/.. ${test_c_symbols} ${include_dirs}
-     )
-     register_exe(test_c_symbols-c ${test_c_symbols} "test")
diff --git a/pkgs/development/libraries/dnnl/default.nix b/pkgs/development/libraries/dnnl/default.nix
index 40d9030b9534d..0d29c6eae8bf3 100644
--- a/pkgs/development/libraries/dnnl/default.nix
+++ b/pkgs/development/libraries/dnnl/default.nix
@@ -1,23 +1,20 @@
 { stdenv, lib, fetchFromGitHub, substituteAll, cmake, bash }:
 
+# This was originally called mkl-dnn, then it was renamed to dnnl, and it has
+# just recently been renamed again to oneDNN. In a follow-up, let's move the
+# attr and alias dnnl -> oneDNN. See here for details:
+# https://github.com/oneapi-src/oneDNN#oneapi-deep-neural-network-library-onednn
 stdenv.mkDerivation rec {
   pname = "dnnl";
-  version = "1.2.2";
+  version = "1.4";
 
   src = fetchFromGitHub {
-    owner = "intel";
-    repo = "mkl-dnn";
+    owner = "oneapi-src";
+    repo = "oneDNN";
     rev = "v${version}";
-    sha256 = "0ydy7ibm6sh1awrikyj938n26cpg5magnxraz2d0pj76irv4vj5m";
+    sha256 = "162fb0c7klahz2irchhyxympi4fq4yp284apc53cadbss41mzld9";
   };
 
-  # Generic fix merged upstream in https://github.com/intel/mkl-dnn/pull/631
-  # Delete after next release
-  patches = [ (substituteAll {
-    src = ./bash-to-sh.patch;
-    inherit bash;
-  }) ];
-
   outputs = [ "out" "dev" "doc" ];
 
   nativeBuildInputs = [ cmake ];
@@ -36,8 +33,9 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    description = "Deep Neural Network Library (DNNL)";
-    homepage = "https://intel.github.io/mkl-dnn/dev_guide_transition_to_dnnl.html";
+    description = "oneAPI Deep Neural Network Library (oneDNN)";
+    homepage = "https://01.org/dnnl";
+    changelog = "https://github.com/oneapi-src/oneDNN/releases/tag/v${version}";
     license = licenses.asl20;
     platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ alexarice bhipple ];
diff --git a/pkgs/development/libraries/folks/default.nix b/pkgs/development/libraries/folks/default.nix
index ca66e03dfa4dc..e9df0ef4016b5 100644
--- a/pkgs/development/libraries/folks/default.nix
+++ b/pkgs/development/libraries/folks/default.nix
@@ -108,7 +108,7 @@ stdenv.mkDerivation rec {
     description = "A library that aggregates people from multiple sources to create metacontacts";
     homepage = "https://wiki.gnome.org/Projects/Folks";
     license = licenses.lgpl2Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.gnu ++ platforms.linux;  # arbitrary choice
   };
 }
diff --git a/pkgs/development/libraries/gcab/default.nix b/pkgs/development/libraries/gcab/default.nix
index 9946ebc05a548..0034f7ed63333 100644
--- a/pkgs/development/libraries/gcab/default.nix
+++ b/pkgs/development/libraries/gcab/default.nix
@@ -77,7 +77,7 @@ stdenv.mkDerivation rec {
     description = "GObject library to create cabinet files";
     homepage = "https://gitlab.gnome.org/GNOME/gcab";
     license = licenses.lgpl21Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/development/libraries/gcr/default.nix b/pkgs/development/libraries/gcr/default.nix
index f3625a0e35583..55827b1ad0bcc 100644
--- a/pkgs/development/libraries/gcr/default.nix
+++ b/pkgs/development/libraries/gcr/default.nix
@@ -89,7 +89,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     platforms = platforms.linux;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     description = "GNOME crypto services (daemon and tools)";
     homepage = "https://gitlab.gnome.org/GNOME/gcr";
     license = licenses.lgpl2Plus;
diff --git a/pkgs/development/libraries/gd/default.nix b/pkgs/development/libraries/gd/default.nix
index be1e8f433f358..4a0d918cabeab 100644
--- a/pkgs/development/libraries/gd/default.nix
+++ b/pkgs/development/libraries/gd/default.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gd";
-  version = "2.2.5";
+  version = "2.3.0";
 
   src = fetchurl {
     url = "https://github.com/libgd/libgd/releases/download/${pname}-${version}/libgd-${version}.tar.xz";
-    sha256 = "0lfy5f241sbv8s3splm2zqiaxv7lxrcshh875xryryk7yk5jqc4c";
+    sha256 = "0n5czhxzinvjvmhkf5l9fwjdx5ip69k5k7pj6zwb6zs1k9dibngc";
   };
 
   hardeningDisable = [ "format" ];
diff --git a/pkgs/development/libraries/gdl/default.nix b/pkgs/development/libraries/gdl/default.nix
index 45739de8a9c11..32cf4ac2a7b6c 100644
--- a/pkgs/development/libraries/gdl/default.nix
+++ b/pkgs/development/libraries/gdl/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     description = "Gnome docking library";
     homepage = "https://developer.gnome.org/gdl/";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/development/libraries/geocode-glib/default.nix b/pkgs/development/libraries/geocode-glib/default.nix
index 89c00308dd742..ec9bf2e5cb991 100644
--- a/pkgs/development/libraries/geocode-glib/default.nix
+++ b/pkgs/development/libraries/geocode-glib/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     description = "A convenience library for the geocoding and reverse geocoding using Nominatim service";
     license = licenses.lgpl2Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/development/libraries/gexiv2/default.nix b/pkgs/development/libraries/gexiv2/default.nix
index 670533e723119..14b19bf5a09b7 100644
--- a/pkgs/development/libraries/gexiv2/default.nix
+++ b/pkgs/development/libraries/gexiv2/default.nix
@@ -32,6 +32,6 @@ stdenv.mkDerivation rec {
     description = "GObject wrapper around the Exiv2 photo metadata library";
     license = licenses.gpl2;
     platforms = platforms.unix;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
   };
 }
diff --git a/pkgs/development/libraries/gfbgraph/default.nix b/pkgs/development/libraries/gfbgraph/default.nix
index 465e4fd3b7551..9fd26b1dfe8e5 100644
--- a/pkgs/development/libraries/gfbgraph/default.nix
+++ b/pkgs/development/libraries/gfbgraph/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Projects/GFBGraph";
     description = "GLib/GObject wrapper for the Facebook Graph API";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.lgpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/development/libraries/gjs/default.nix b/pkgs/development/libraries/gjs/default.nix
index 171016388c18c..1f25abd2cf380 100644
--- a/pkgs/development/libraries/gjs/default.nix
+++ b/pkgs/development/libraries/gjs/default.nix
@@ -122,7 +122,7 @@ in stdenv.mkDerivation rec {
     description = "JavaScript bindings for GNOME";
     homepage = "https://gitlab.gnome.org/GNOME/gjs/blob/master/doc/Home.md";
     license = licenses.lgpl2Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/development/libraries/glib-networking/default.nix b/pkgs/development/libraries/glib-networking/default.nix
index 360a72bbc9de1..f635b789e16b7 100644
--- a/pkgs/development/libraries/glib-networking/default.nix
+++ b/pkgs/development/libraries/glib-networking/default.nix
@@ -87,7 +87,7 @@ stdenv.mkDerivation rec {
     description = "Network-related giomodules for glib";
     homepage = "https://gitlab.gnome.org/GNOME/glib-networking";
     license = licenses.lgpl21Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/gnome-online-accounts/default.nix b/pkgs/development/libraries/gnome-online-accounts/default.nix
index 8631cdee8cf3f..7b254b922bcc7 100644
--- a/pkgs/development/libraries/gnome-online-accounts/default.nix
+++ b/pkgs/development/libraries/gnome-online-accounts/default.nix
@@ -100,6 +100,6 @@ stdenv.mkDerivation rec {
     description = "Single sign-on framework for GNOME";
     platforms = platforms.linux;
     license = licenses.lgpl2Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
   };
 }
diff --git a/pkgs/development/libraries/gnome-video-effects/default.nix b/pkgs/development/libraries/gnome-video-effects/default.nix
index 04e7a59fdc2e4..dfbb2c3b1e67c 100644
--- a/pkgs/development/libraries/gnome-video-effects/default.nix
+++ b/pkgs/development/libraries/gnome-video-effects/default.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
     description = "A collection of GStreamer effects to be used in different GNOME Modules";
     homepage = "https://wiki.gnome.org/Projects/GnomeVideoEffects";
     platforms = platforms.linux;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
   };
 }
diff --git a/pkgs/development/libraries/gnutls/default.nix b/pkgs/development/libraries/gnutls/default.nix
index f5a0b8a9f31dc..4e7e19d9ff04c 100644
--- a/pkgs/development/libraries/gnutls/default.nix
+++ b/pkgs/development/libraries/gnutls/default.nix
@@ -8,7 +8,7 @@
 
 assert guileBindings -> guile != null;
 let
-  version = "3.6.12";
+  version = "3.6.13";
 
   # XXX: Gnulib's `test-select' fails on FreeBSD:
   # http://hydra.nixos.org/build/2962084/nixlog/1/raw .
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "mirror://gnupg/gnutls/v3.6/gnutls-${version}.tar.xz";
-    sha256 = "0jvca1qahn9lrwv6f5kfs95icirc15b2a8x9fzczyj996ipg3b5z";
+    sha256 = "0f1gnm0756qms5cpx6yn6xb8d3imc2gkqmygf12n9x6r8zs1s11j";
   };
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
diff --git a/pkgs/development/libraries/gobject-introspection/default.nix b/pkgs/development/libraries/gobject-introspection/default.nix
index b9303bd5731eb..31e6d7b76c70d 100644
--- a/pkgs/development/libraries/gobject-introspection/default.nix
+++ b/pkgs/development/libraries/gobject-introspection/default.nix
@@ -62,10 +62,10 @@ stdenv.mkDerivation rec {
     # We are using a symlink that we will delete before installation.
     mkdir -p $out/lib
     ln -s $PWD/tests/scanner/libregress-1.0${stdenv.targetPlatform.extensions.sharedLibrary} $out/lib/libregress-1.0${stdenv.targetPlatform.extensions.sharedLibrary}
-    cleanLibregressSymlink() {
-      rm $out/lib/libregress-1.0${stdenv.targetPlatform.extensions.sharedLibrary}
-    }
-    preInstallPhases="$preInstallPhases cleanLibregressSymlink"
+  '';
+
+  preInstall = ''
+    rm $out/lib/libregress-1.0${stdenv.targetPlatform.extensions.sharedLibrary}
   '';
 
   passthru = {
diff --git a/pkgs/development/libraries/gom/default.nix b/pkgs/development/libraries/gom/default.nix
index de526edf8d9a4..7d3365f563166 100644
--- a/pkgs/development/libraries/gom/default.nix
+++ b/pkgs/development/libraries/gom/default.nix
@@ -58,6 +58,6 @@ stdenv.mkDerivation rec {
     homepage = "https://wiki.gnome.org/Projects/Gom";
     license = licenses.lgpl21Plus;
     platforms = platforms.linux;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
   };
 }
diff --git a/pkgs/development/libraries/graphene-hardened-malloc/default.nix b/pkgs/development/libraries/graphene-hardened-malloc/default.nix
index 0d2b02489efb8..c60b09144929c 100644
--- a/pkgs/development/libraries/graphene-hardened-malloc/default.nix
+++ b/pkgs/development/libraries/graphene-hardened-malloc/default.nix
@@ -52,6 +52,6 @@ stdenv.mkDerivation rec {
     '';
     license = licenses.mit;
     maintainers = with maintainers; [ ris ];
-    platforms = [ "x86_64-linux" ];
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
   };
 }
diff --git a/pkgs/development/libraries/grilo-plugins/default.nix b/pkgs/development/libraries/grilo-plugins/default.nix
index 81adab05e03d1..3dced2d621166 100644
--- a/pkgs/development/libraries/grilo-plugins/default.nix
+++ b/pkgs/development/libraries/grilo-plugins/default.nix
@@ -94,7 +94,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Projects/Grilo";
     description = "A collection of plugins for the Grilo framework";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.lgpl21;
     platforms = platforms.linux;
   };
diff --git a/pkgs/development/libraries/grilo/default.nix b/pkgs/development/libraries/grilo/default.nix
index 105b860c2b587..12f069891e88c 100644
--- a/pkgs/development/libraries/grilo/default.nix
+++ b/pkgs/development/libraries/grilo/default.nix
@@ -38,7 +38,7 @@ in stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Projects/Grilo";
     description = "Framework that provides access to various sources of multimedia content, using a pluggable system";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.lgpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/development/libraries/gsettings-desktop-schemas/default.nix b/pkgs/development/libraries/gsettings-desktop-schemas/default.nix
index a23027946a491..c1fa8af1271c5 100644
--- a/pkgs/development/libraries/gsettings-desktop-schemas/default.nix
+++ b/pkgs/development/libraries/gsettings-desktop-schemas/default.nix
@@ -42,6 +42,6 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig python3 meson ninja glib ];
 
   meta = with stdenv.lib; {
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
   };
 }
diff --git a/pkgs/development/libraries/gsound/default.nix b/pkgs/development/libraries/gsound/default.nix
index 9ac296f6f0256..bae1b17e5322e 100644
--- a/pkgs/development/libraries/gsound/default.nix
+++ b/pkgs/development/libraries/gsound/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Projects/GSound";
     description = "Small library for playing system sounds";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/development/libraries/gspell/default.nix b/pkgs/development/libraries/gspell/default.nix
index 0f17a826b8ab3..17e98b8e40927 100644
--- a/pkgs/development/libraries/gspell/default.nix
+++ b/pkgs/development/libraries/gspell/default.nix
@@ -29,7 +29,7 @@ in stdenv.mkDerivation rec {
     description = "A spell-checking library for GTK applications";
     homepage = "https://wiki.gnome.org/Projects/gspell";
     license = licenses.lgpl21Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/development/libraries/gtk/3.x.nix b/pkgs/development/libraries/gtk/3.x.nix
index fc3d79891e44c..812f4faa2341e 100644
--- a/pkgs/development/libraries/gtk/3.x.nix
+++ b/pkgs/development/libraries/gtk/3.x.nix
@@ -48,7 +48,7 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "gtk+3";
-  version = "3.24.14";
+  version = "3.24.17";
 
   outputs = [ "out" "dev" ] ++ optional withGtkDoc "devdoc";
   outputBin = "dev";
@@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtk+/${stdenv.lib.versions.majorMinor version}/gtk+-${version}.tar.xz";
-    sha256 = "120yz5gxqbv7sgdbcy4i0b6ixm8jpjzialdrqs0gv15q7bwnjk8w";
+    sha256 = "1h5snvqz8f6zgwpmq7pblvfwj5dphfckj8bv7vdz1c0w49dja47j";
   };
 
   patches = [
@@ -70,11 +70,7 @@ stdenv.mkDerivation rec {
       url = "https://bug757142.bugzilla-attachments.gnome.org/attachment.cgi?id=344123";
       sha256 = "0g6fhqcv8spfy3mfmxpyji93k8d4p4q4fz1v9a1c1cgcwkz41d7p";
     })
-    # https://gitlab.gnome.org/GNOME/gtk/-/merge_requests/1528
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gtk/-/commit/3c28751dee115e969a58a733f2f19e71062b9d2d.patch";
-      sha256 = "1rqrmymwd22dsiy7agjw13mcyic3by6020rxyaw7zslnmyzfiwc3";
-    })
+
     # https://gitlab.gnome.org/GNOME/gtk/merge_requests/1002
     ./patches/01-build-Fix-path-handling-in-pkgconfig.patch
   ] ++ optionals stdenv.isDarwin [
diff --git a/pkgs/development/libraries/gtksourceview/3.x.nix b/pkgs/development/libraries/gtksourceview/3.x.nix
index 0ab3bcb90d485..d882d3b1a6c1e 100644
--- a/pkgs/development/libraries/gtksourceview/3.x.nix
+++ b/pkgs/development/libraries/gtksourceview/3.x.nix
@@ -53,6 +53,6 @@ stdenv.mkDerivation rec {
     homepage = "https://wiki.gnome.org/Projects/GtkSourceView";
     platforms = with platforms; linux ++ darwin;
     license = licenses.lgpl21;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
   };
 }
diff --git a/pkgs/development/libraries/gtksourceview/4.x.nix b/pkgs/development/libraries/gtksourceview/4.x.nix
index 1ecd1ce2ae526..1a80a1b6fac94 100644
--- a/pkgs/development/libraries/gtksourceview/4.x.nix
+++ b/pkgs/development/libraries/gtksourceview/4.x.nix
@@ -49,6 +49,6 @@ stdenv.mkDerivation rec {
     homepage = "https://wiki.gnome.org/Projects/GtkSourceView";
     platforms = with platforms; linux ++ darwin;
     license = licenses.lgpl21;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
   };
 }
diff --git a/pkgs/development/libraries/gtksourceviewmm/4.x.nix b/pkgs/development/libraries/gtksourceviewmm/4.x.nix
index 4299f6e1d0f90..1607a5819961d 100644
--- a/pkgs/development/libraries/gtksourceviewmm/4.x.nix
+++ b/pkgs/development/libraries/gtksourceviewmm/4.x.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     homepage = "https://developer.gnome.org/gtksourceviewmm/";
     description = "C++ wrapper for gtksourceview";
     license = licenses.lgpl2;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
   };
 }
 
diff --git a/pkgs/development/libraries/gvfs/default.nix b/pkgs/development/libraries/gvfs/default.nix
index 1caed4cacf7aa..cff6569be50b2 100644
--- a/pkgs/development/libraries/gvfs/default.nix
+++ b/pkgs/development/libraries/gvfs/default.nix
@@ -126,6 +126,6 @@ stdenv.mkDerivation rec {
     description = "Virtual Filesystem support library" + optionalString gnomeSupport " (full GNOME support)";
     license = licenses.lgpl2Plus;
     platforms = platforms.linux;
-    maintainers = [ maintainers.lethalman ] ++ gnome3.maintainers;
+    maintainers = [ maintainers.lethalman ] ++ teams.gnome.members;
   };
 }
diff --git a/pkgs/development/libraries/jsonrpc-glib/default.nix b/pkgs/development/libraries/jsonrpc-glib/default.nix
index 71bf2d92f8dd1..b641a54730233 100644
--- a/pkgs/development/libraries/jsonrpc-glib/default.nix
+++ b/pkgs/development/libraries/jsonrpc-glib/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     description = "A library to communicate using the JSON-RPC 2.0 specification";
     homepage = "https://gitlab.gnome.org/GNOME/jsonrpc-glib";
     license = licenses.lgpl21Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/libchamplain/default.nix b/pkgs/development/libraries/libchamplain/default.nix
index c24fc0eda9368..6a74941a3a0f7 100644
--- a/pkgs/development/libraries/libchamplain/default.nix
+++ b/pkgs/development/libraries/libchamplain/default.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
        OpenCycleMap, OpenAerialMap, and Maps for free.
     '';
 
-     maintainers = gnome3.maintainers;
+     maintainers = teams.gnome.members;
      platforms = platforms.gnu ++ platforms.linux;  # arbitrary choice
   };
 }
diff --git a/pkgs/development/libraries/libdazzle/default.nix b/pkgs/development/libraries/libdazzle/default.nix
index ebe053920ab07..5351b2c9fcbd5 100644
--- a/pkgs/development/libraries/libdazzle/default.nix
+++ b/pkgs/development/libraries/libdazzle/default.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
     '';
     homepage = "https://wiki.gnome.org/Apps/Builder";
     license = licenses.gpl3Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/libepc/default.nix b/pkgs/development/libraries/libepc/default.nix
index 7b12c39fc70fa..b8b28f49d1d53 100644
--- a/pkgs/development/libraries/libepc/default.nix
+++ b/pkgs/development/libraries/libepc/default.nix
@@ -41,7 +41,7 @@ in stdenv.mkDerivation rec {
     description = "Easy Publish and Consume Library";
     homepage = "https://wiki.gnome.org/Projects/libepc";
     license = licenses.lgpl21Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/development/libraries/libgda/default.nix b/pkgs/development/libraries/libgda/default.nix
index 4f5dede3c1445..a46b2aa741187 100644
--- a/pkgs/development/libraries/libgda/default.nix
+++ b/pkgs/development/libraries/libgda/default.nix
@@ -47,7 +47,7 @@ assert postgresSupport -> postgresql != null;
     description = "Database access library";
     homepage = "https://www.gnome-db.org/";
     license = [ licenses.lgpl2 licenses.gpl2 ];
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux ++ platforms.darwin;
   };
 }
diff --git a/pkgs/development/libraries/libgdamm/default.nix b/pkgs/development/libraries/libgdamm/default.nix
index 2f0fb8fd8c87e..be3e2e469ade5 100644
--- a/pkgs/development/libraries/libgdamm/default.nix
+++ b/pkgs/development/libraries/libgdamm/default.nix
@@ -33,7 +33,7 @@ in stdenv.mkDerivation rec {
     description = "C++ bindings for libgda";
     homepage = "https://www.gnome-db.org/";
     license = licenses.lgpl21Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/development/libraries/libgdata/default.nix b/pkgs/development/libraries/libgdata/default.nix
index 91bb9869f3c6e..162b5d2339519 100644
--- a/pkgs/development/libraries/libgdata/default.nix
+++ b/pkgs/development/libraries/libgdata/default.nix
@@ -79,7 +79,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     description = "GData API library";
     homepage = "https://wiki.gnome.org/Projects/libgdata";
-    maintainers = with maintainers; [ raskin lethalman ] ++ gnome3.maintainers;
+    maintainers = with maintainers; [ raskin lethalman ] ++ teams.gnome.members;
     platforms = platforms.linux;
     license = licenses.lgpl21Plus;
   };
diff --git a/pkgs/development/libraries/libgee/default.nix b/pkgs/development/libraries/libgee/default.nix
index 2a36357f8bbd7..c2d1c197fe960 100644
--- a/pkgs/development/libraries/libgee/default.nix
+++ b/pkgs/development/libraries/libgee/default.nix
@@ -30,6 +30,6 @@ stdenv.mkDerivation rec {
     homepage = "https://wiki.gnome.org/Projects/Libgee";
     license = licenses.lgpl21Plus;
     platforms = platforms.unix;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
   };
 }
diff --git a/pkgs/development/libraries/libgepub/default.nix b/pkgs/development/libraries/libgepub/default.nix
index 70ec222f88fb4..cf62e0cabc9d2 100644
--- a/pkgs/development/libraries/libgepub/default.nix
+++ b/pkgs/development/libraries/libgepub/default.nix
@@ -26,6 +26,6 @@ stdenv.mkDerivation rec {
     description = "GObject based library for handling and rendering epub documents";
     license = licenses.lgpl21Plus;
     platforms = platforms.linux;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
   };
 }
diff --git a/pkgs/development/libraries/libgit2-glib/default.nix b/pkgs/development/libraries/libgit2-glib/default.nix
index f3e07b509176c..9a05a01bee61d 100644
--- a/pkgs/development/libraries/libgit2-glib/default.nix
+++ b/pkgs/development/libraries/libgit2-glib/default.nix
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
     description = "A glib wrapper library around the libgit2 git access library";
     homepage = "https://wiki.gnome.org/Projects/Libgit2-glib";
     license = licenses.lgpl21;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/development/libraries/libgnomekbd/default.nix b/pkgs/development/libraries/libgnomekbd/default.nix
index f35f3f87fbeb1..c02fd503eb0d8 100644
--- a/pkgs/development/libraries/libgnomekbd/default.nix
+++ b/pkgs/development/libraries/libgnomekbd/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Keyboard management library";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/development/libraries/libgrss/default.nix b/pkgs/development/libraries/libgrss/default.nix
index 0945b9219ff02..fdad5369813f5 100644
--- a/pkgs/development/libraries/libgrss/default.nix
+++ b/pkgs/development/libraries/libgrss/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation {
     description = "Glib abstaction to handle feeds in RSS, Atom and other formats";
     homepage = "https://wiki.gnome.org/Projects/Libgrss";
     license = licenses.lgpl3Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/libgtop/default.nix b/pkgs/development/libraries/libgtop/default.nix
index fe7986bf21aa8..65f5e2750e518 100644
--- a/pkgs/development/libraries/libgtop/default.nix
+++ b/pkgs/development/libraries/libgtop/default.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     description = "A library that reads information about processes and the running system";
     license = licenses.gpl2Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/libgudev/default.nix b/pkgs/development/libraries/libgudev/default.nix
index 3fcc549e8ed16..439dd3827ec33 100644
--- a/pkgs/development/libraries/libgudev/default.nix
+++ b/pkgs/development/libraries/libgudev/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     description = "A library that provides GObject bindings for libudev";
     homepage = "https://wiki.gnome.org/Projects/libgudev";
-    maintainers = [ maintainers.eelco ] ++ gnome3.maintainers;
+    maintainers = [ maintainers.eelco ] ++ teams.gnome.members;
     platforms = platforms.linux;
     license = licenses.lgpl2Plus;
   };
diff --git a/pkgs/development/libraries/libgweather/default.nix b/pkgs/development/libraries/libgweather/default.nix
index 5b4f4fa5b9617..51ee70f070c68 100644
--- a/pkgs/development/libraries/libgweather/default.nix
+++ b/pkgs/development/libraries/libgweather/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     description = "A library to access weather information from online services for numerous locations";
     homepage = "https://wiki.gnome.org/Projects/LibGWeather";
     license = licenses.gpl2Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/development/libraries/libgxps/default.nix b/pkgs/development/libraries/libgxps/default.nix
index 3a098b0006264..095b5c8f61cf7 100644
--- a/pkgs/development/libraries/libgxps/default.nix
+++ b/pkgs/development/libraries/libgxps/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     description = "A GObject based library for handling and rendering XPS documents";
     homepage = "https://wiki.gnome.org/Projects/libgxps";
     license = licenses.lgpl21Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/libhttpseverywhere/default.nix b/pkgs/development/libraries/libhttpseverywhere/default.nix
index b138aab8e78ae..2de7e08fb0258 100644
--- a/pkgs/development/libraries/libhttpseverywhere/default.nix
+++ b/pkgs/development/libraries/libhttpseverywhere/default.nix
@@ -44,6 +44,6 @@ in stdenv.mkDerivation rec {
     homepage = "https://gitlab.gnome.org/GNOME/libhttpseverywhere";
     license = licenses.lgpl3;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ sternenseemann ] ++ gnome3.maintainers;
+    maintainers = with maintainers; [ sternenseemann ] ++ teams.gnome.members;
   };
 }
diff --git a/pkgs/development/libraries/libjcat/default.nix b/pkgs/development/libraries/libjcat/default.nix
new file mode 100644
index 0000000000000..dc95f9199326a
--- /dev/null
+++ b/pkgs/development/libraries/libjcat/default.nix
@@ -0,0 +1,91 @@
+{ stdenv
+, fetchFromGitHub
+, fetchpatch
+, docbook_xml_dtd_43
+, docbook-xsl-nons
+, glib
+, json-glib
+, gnutls
+, gpgme
+, gobject-introspection
+, vala
+, help2man
+, gtk-doc
+, meson
+, ninja
+, pkg-config
+, python3
+, nixosTests
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libjcat";
+  version = "0.1.1";
+
+  outputs = [ "bin" "out" "dev" "devdoc" "man" "installedTests" ];
+
+  src = fetchFromGitHub {
+    owner = "hughsie";
+    repo = "libjcat";
+    rev = version;
+    sha256 = "hWJUzpQvy2V4pS8C/nW7Xrs9U9LQWMsGuTVOnm5UJc0=";
+  };
+
+  patches = [
+    # Installed tests are installed to different output
+    ./installed-tests-path.patch
+
+    # Fix version file generation
+    (fetchpatch {
+      url = "https://github.com/hughsie/libjcat/commit/cf2d9298a5fab7278ee040bc0b4be384a7b5538e.patch";
+      sha256 = "3749qih+wfhU8ECklh5BvReJ7pS+Ao1Q7YueZ1tT0Is=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    docbook_xml_dtd_43
+    docbook-xsl-nons
+    gobject-introspection
+    vala
+    help2man
+    gtk-doc
+    (python3.withPackages (pkgs: with pkgs; [
+      setuptools
+    ]))
+  ];
+
+  buildInputs = [
+    glib
+    json-glib
+    gnutls
+    gpgme
+  ];
+
+  mesonFlags = [
+    "-Dgtkdoc=true"
+    "-Dinstalled_test_prefix=${placeholder "installedTests"}"
+  ];
+
+  postPatch = ''
+    patchShebangs contrib/generate-version-script.py
+  '';
+
+  doCheck = true;
+
+  passthru = {
+    tests = {
+      installed-tests = nixosTests.installed-tests.libjcat;
+    };
+  };
+
+  meta = with stdenv.lib; {
+    description = "Library for reading and writing Jcat files";
+    homepage = "https://github.com/hughsie/libjcat";
+    license = licenses.lgpl21Plus;
+    maintainers = with maintainers; [ jtojnar ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/development/libraries/libjcat/installed-tests-path.patch b/pkgs/development/libraries/libjcat/installed-tests-path.patch
new file mode 100644
index 0000000000000..d199f91385f5b
--- /dev/null
+++ b/pkgs/development/libraries/libjcat/installed-tests-path.patch
@@ -0,0 +1,24 @@
+diff --git a/meson.build b/meson.build
+index f69968d..d1d6c6e 100644
+--- a/meson.build
++++ b/meson.build
+@@ -114,8 +114,8 @@ else
+   datadir = join_paths(prefix, get_option('datadir'))
+   localstatedir = join_paths(prefix, get_option('localstatedir'))
+   libexecdir = join_paths(prefix, get_option('libexecdir'))
+-  installed_test_bindir = join_paths(libexecdir, 'installed-tests', meson.project_name())
+-  installed_test_datadir = join_paths(datadir, 'installed-tests', meson.project_name())
++  installed_test_bindir = join_paths(get_option('installed_test_prefix'), 'libexec', 'installed-tests', meson.project_name())
++  installed_test_datadir = join_paths(get_option('installed_test_prefix'), 'share', 'installed-tests', meson.project_name())
+ endif
+ mandir = join_paths(prefix, get_option('mandir'))
+ localedir = join_paths(prefix, get_option('localedir'))
+diff --git a/meson_options.txt b/meson_options.txt
+index 4784300..d382fc1 100644
+--- a/meson_options.txt
++++ b/meson_options.txt
+@@ -1,3 +1,4 @@
++option('installed_test_prefix', type: 'string', value: '', description: 'Prefix for installed tests')
+ option('gtkdoc', type : 'boolean', value : false, description : 'enable developer documentation')
+ option('introspection', type : 'boolean', value : true, description : 'generate GObject Introspection data')
+ option('tests', type : 'boolean', value : true, description : 'enable tests')
diff --git a/pkgs/development/libraries/libmanette/default.nix b/pkgs/development/libraries/libmanette/default.nix
index 93bf193a972b3..67ee59b61071b 100644
--- a/pkgs/development/libraries/libmanette/default.nix
+++ b/pkgs/development/libraries/libmanette/default.nix
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
     description = "A simple GObject game controller library";
     homepage = "https://gitlab.gnome.org/aplazas/libmanette";
     license = licenses.lgpl21Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/libmediaart/default.nix b/pkgs/development/libraries/libmediaart/default.nix
index 20a63fd6eb03c..38adebb2a4877 100644
--- a/pkgs/development/libraries/libmediaart/default.nix
+++ b/pkgs/development/libraries/libmediaart/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Library tasked with managing, extracting and handling media art caches";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/development/libraries/libnotify/default.nix b/pkgs/development/libraries/libnotify/default.nix
index 9bf786c50922b..01a89f16c2a15 100644
--- a/pkgs/development/libraries/libnotify/default.nix
+++ b/pkgs/development/libraries/libnotify/default.nix
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
     homepage = "https://developer.gnome.org/notification-spec/";
     description = "A library that sends desktop notifications to a notification daemon";
     platforms = platforms.unix;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.lgpl21;
   };
 }
diff --git a/pkgs/development/libraries/libpeas/default.nix b/pkgs/development/libraries/libpeas/default.nix
index 61b774ac7b744..6c2276a08ccb8 100644
--- a/pkgs/development/libraries/libpeas/default.nix
+++ b/pkgs/development/libraries/libpeas/default.nix
@@ -31,6 +31,6 @@ stdenv.mkDerivation rec {
     homepage = "https://wiki.gnome.org/Projects/Libpeas";
     license = licenses.gpl2Plus;
     platforms = platforms.unix;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
   };
 }
diff --git a/pkgs/development/libraries/libqmi/default.nix b/pkgs/development/libraries/libqmi/default.nix
index 396706b88e637..b1504fc95404e 100644
--- a/pkgs/development/libraries/libqmi/default.nix
+++ b/pkgs/development/libraries/libqmi/default.nix
@@ -26,6 +26,8 @@ stdenv.mkDerivation rec {
     libmbim
   ];
 
+  enableParallelBuilding = true;
+
   doCheck = true;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/librest/default.nix b/pkgs/development/libraries/librest/default.nix
index aee41e37ec65e..e1d7b336273db 100644
--- a/pkgs/development/libraries/librest/default.nix
+++ b/pkgs/development/libraries/librest/default.nix
@@ -26,6 +26,6 @@ stdenv.mkDerivation rec {
     homepage = "https://wiki.gnome.org/Projects/Librest";
     license = licenses.lgpl21;
     platforms = platforms.linux;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
   };
 }
diff --git a/pkgs/development/libraries/librsvg/default.nix b/pkgs/development/libraries/librsvg/default.nix
index 911286efb7fc5..a63b773e3bb5f 100644
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@@ -82,7 +82,7 @@ stdenv.mkDerivation rec {
     description = "A small library to render SVG images to Cairo surfaces";
     homepage = "https://wiki.gnome.org/Projects/LibRsvg";
     license = licenses.lgpl2Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/libsass/default.nix b/pkgs/development/libraries/libsass/default.nix
index a6756f4e2d5c9..99cd2fb1c5310 100644
--- a/pkgs/development/libraries/libsass/default.nix
+++ b/pkgs/development/libraries/libsass/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libsass";
-  version = "3.6.1";
+  version = "3.6.3";
 
   src = fetchFromGitHub {
     owner = "sass";
     repo = pname;
     rev = version;
-    sha256 = "1599j2lbsygy3883x9si7rbad1pkjhl6y72aimaapcv90ga5kxkm";
+    sha256 = "1q6lvd8sj5k5an32qir918pa5khhcb8h08dzrg1bcxmw7a23j514";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
     extraPostFetch = ''
diff --git a/pkgs/development/libraries/libtxc_dxtn/default.nix b/pkgs/development/libraries/libtxc_dxtn/default.nix
deleted file mode 100644
index 4e65e457110fc..0000000000000
--- a/pkgs/development/libraries/libtxc_dxtn/default.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-{ stdenv, fetchurl, autoreconfHook, libGL, libGLU }:
-
-let version = "1.0.1"; in
-
-stdenv.mkDerivation rec {
-  pname = "libtxc_dxtn";
-  inherit version;
-
-  src = fetchurl {
-    url = "https://people.freedesktop.org/~cbrill/libtxc_dxtn/${pname}-${version}.tar.bz2";
-    sha256 = "0q5fjaknl7s0z206dd8nzk9bdh8g4p23bz7784zrllnarl90saa5";
-  };
-
-  nativeBuildInputs = [ autoreconfHook ];
-  buildInputs = [ libGL libGLU ];
-
-  meta = with stdenv.lib; {
-    homepage = "http://dri.freedesktop.org/wiki/S3TC";
-    repositories.git = "git://people.freedesktop.org/~mareko/libtxc_dxtn";
-    license = licenses.mit;
-    platforms = platforms.unix;
-  };
-}
diff --git a/pkgs/development/libraries/libtxc_dxtn_s2tc/default.nix b/pkgs/development/libraries/libtxc_dxtn_s2tc/default.nix
deleted file mode 100644
index bb69c0dec0a0a..0000000000000
--- a/pkgs/development/libraries/libtxc_dxtn_s2tc/default.nix
+++ /dev/null
@@ -1,25 +0,0 @@
-{ stdenv, fetchurl, autoreconfHook, libGL, libGLU }:
-
-let version = "1.0"; in
-
-stdenv.mkDerivation {
-  pname = "libtxc_dxtn_s2tc";
-  inherit version;
-
-  src = fetchurl {
-    url = "https://github.com/divVerent/s2tc/archive/v${version}.tar.gz";
-    sha256 = "0ibfdib277fhbqvxzan0bmglwnsl1y1rw2g8skvz82l1sfmmn752";
-  };
-
-  nativeBuildInputs = [ autoreconfHook ];
-  buildInputs = [ libGL libGLU ];
-
-  meta = {
-    description = "A patent-free S3TC compatible implementation";
-    homepage = "https://github.com/divVerent/s2tc";
-    repositories.git = "https://github.com/divVerent/s2tc.git";
-    license = stdenv.lib.licenses.mit;
-    platforms = stdenv.lib.platforms.linux;
-    maintainers = [ stdenv.lib.maintainers.cpages ];
-  };
-}
diff --git a/pkgs/development/libraries/libzapojit/default.nix b/pkgs/development/libraries/libzapojit/default.nix
index 187c163a6f1af..4341b1e20412f 100644
--- a/pkgs/development/libraries/libzapojit/default.nix
+++ b/pkgs/development/libraries/libzapojit/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     description = "GObject wrapper for the SkyDrive and Hotmail REST APIs";
     homepage = "https://wiki.gnome.org/Projects/Zapojit";
     license = licenses.lgpl21Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/development/libraries/mm-common/default.nix b/pkgs/development/libraries/mm-common/default.nix
index 9a789a58ccac1..890ab6fca11cb 100644
--- a/pkgs/development/libraries/mm-common/default.nix
+++ b/pkgs/development/libraries/mm-common/default.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     '';
     homepage = "https://www.gtkmm.org";
     license = licenses.gpl2Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 25cf73e874aba..d821a6c8f5121 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -155,8 +155,8 @@ in {
   };
 
   openssl_1_1 = common {
-    version = "1.1.1d";
-    sha256 = "1whinyw402z3b9xlb3qaxv4b9sk4w1bgh9k0y8df1z4x3yy92fhy";
+    version = "1.1.1f";
+    sha256 = "186c6bfe6ecfba7a5b48c47f8a1673d0f3b0e5ba2e25602dd23b629975da3f35";
     patches = [
       ./1.1/nix-ssl-cert-file.patch
 
diff --git a/pkgs/development/libraries/rarian/default.nix b/pkgs/development/libraries/rarian/default.nix
index 1a97174380c98..1e2d954fa942b 100644
--- a/pkgs/development/libraries/rarian/default.nix
+++ b/pkgs/development/libraries/rarian/default.nix
@@ -25,7 +25,7 @@ in stdenv.mkDerivation rec {
     description = "Documentation metadata library based on the proposed Freedesktop.org spec";
     homepage = "https://rarian.freedesktop.org/";
     license = licenses.lgpl21Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/development/libraries/silgraphite/graphite2.nix b/pkgs/development/libraries/silgraphite/graphite2.nix
index 6b1c4ca97ba6b..564c32bf10dbe 100644
--- a/pkgs/development/libraries/silgraphite/graphite2.nix
+++ b/pkgs/development/libraries/silgraphite/graphite2.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchurl, pkgconfig, freetype, cmake, python }:
 
 stdenv.mkDerivation rec {
-  version = "1.3.13";
+  version = "1.3.14";
   pname = "graphite2";
 
   src = fetchurl {
     url = "https://github.com/silnrsi/graphite/releases/download/"
       + "${version}/graphite2-${version}.tgz";
-    sha256 = "01jzhwnj1c3d68dmw15jdxly0hwkmd8ja4kw755rbkykn1ly2qyx";
+    sha256 = "1790ajyhk0ax8xxamnrk176gc9gvhadzy78qia4rd8jzm89ir7gr";
   };
 
   nativeBuildInputs = [ pkgconfig cmake ];
diff --git a/pkgs/development/libraries/template-glib/default.nix b/pkgs/development/libraries/template-glib/default.nix
index 3fd6be73a7067..385b198a755a3 100644
--- a/pkgs/development/libraries/template-glib/default.nix
+++ b/pkgs/development/libraries/template-glib/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation {
     description = "A library for template expansion which supports calling into GObject Introspection from templates";
     homepage = "https://gitlab.gnome.org/GNOME/template-glib";
     license = licenses.lgpl21Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/totem-pl-parser/default.nix b/pkgs/development/libraries/totem-pl-parser/default.nix
index 2a6c8c28d1a6e..266538d43c251 100644
--- a/pkgs/development/libraries/totem-pl-parser/default.nix
+++ b/pkgs/development/libraries/totem-pl-parser/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Apps/Videos";
     description = "Simple GObject-based library to parse and save a host of playlist formats";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.lgpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/development/libraries/tracker-miners/default.nix b/pkgs/development/libraries/tracker-miners/default.nix
index 2e69524e9c76d..0428728232845 100644
--- a/pkgs/development/libraries/tracker-miners/default.nix
+++ b/pkgs/development/libraries/tracker-miners/default.nix
@@ -132,7 +132,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Projects/Tracker";
     description = "Desktop-neutral user information store, search tool and indexer";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
   };
diff --git a/pkgs/development/libraries/tracker/default.nix b/pkgs/development/libraries/tracker/default.nix
index 8274a3799733c..50eb56ce2d1ea 100644
--- a/pkgs/development/libraries/tracker/default.nix
+++ b/pkgs/development/libraries/tracker/default.nix
@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Projects/Tracker";
     description = "Desktop-neutral user information store, search tool and indexer";
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/development/libraries/vte/default.nix b/pkgs/development/libraries/vte/default.nix
index 901f4fca8e20a..897d3433f19e2 100644
--- a/pkgs/development/libraries/vte/default.nix
+++ b/pkgs/development/libraries/vte/default.nix
@@ -92,7 +92,7 @@ stdenv.mkDerivation rec {
       the system's terminfo database.
     '';
     license = licenses.lgpl2;
-    maintainers = with maintainers; [ astsmtl antono lethalman ] ++ gnome3.maintainers;
+    maintainers = with maintainers; [ astsmtl antono lethalman ] ++ teams.gnome.members;
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/webkitgtk/default.nix b/pkgs/development/libraries/webkitgtk/default.nix
index 2011e5279d1f0..f1a5ddfd4a0a0 100644
--- a/pkgs/development/libraries/webkitgtk/default.nix
+++ b/pkgs/development/libraries/webkitgtk/default.nix
@@ -50,7 +50,6 @@
 , libseccomp
 , xdg-dbus-proxy
 , substituteAll
-, gnome3
 , glib
 }:
 
@@ -62,13 +61,13 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "webkitgtk";
-  version = "2.28.0";
+  version = "2.28.1";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://webkitgtk.org/releases/${pname}-${version}.tar.xz";
-    sha256 = "12qfs9w93c5kiyi14ynm4rf4ad3c213dvzmdrc9c3ab2iwbks7rn";
+    sha256 = "rLwmo+1cE/OeRodc9EepwFQbbPsX+eeIQyNDHLMn89g=";
   };
 
   patches = optionals stdenv.isLinux [
@@ -180,6 +179,6 @@ stdenv.mkDerivation rec {
     license = licenses.bsd2;
     platforms = platforms.linux;
     hydraPlatforms = [];
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
   };
 }
diff --git a/pkgs/development/node-packages/node-packages-v10.nix b/pkgs/development/node-packages/node-packages-v10.nix
index 9fd4e96ad72dd..9740c66c9744e 100644
--- a/pkgs/development/node-packages/node-packages-v10.nix
+++ b/pkgs/development/node-packages/node-packages-v10.nix
@@ -15293,7 +15293,7 @@ let
       version = "1.0.1";
       src = fetchurl {
         name = "emitter-1.0.1.tar.gz";
-        url = https://codeload.github.com/component/emitter/tar.gz/1.0.1;
+        url = "https://codeload.github.com/component/emitter/tar.gz/1.0.1";
         sha256 = "0eae744826723877457f7a7ac7f31d68a5a060673b3a883f6a8e325bf48f313d";
       };
     };
@@ -19632,7 +19632,7 @@ let
       version = "2.0.1";
       src = fetchurl {
         name = "global-2.0.1.tar.gz";
-        url = https://codeload.github.com/component/global/tar.gz/v2.0.1;
+        url = "https://codeload.github.com/component/global/tar.gz/v2.0.1";
         sha256 = "42be02b7148745447f6ba21137c972ca82d2cad92d30d63bd4fc310623901785";
       };
     };
@@ -31657,7 +31657,7 @@ let
       version = "0.9.15";
       src = fetchurl {
         name = "oauth-0.9.15.tar.gz";
-        url = https://codeload.github.com/ciaranj/node-oauth/legacy.tar.gz/master;
+        url = "https://codeload.github.com/ciaranj/node-oauth/legacy.tar.gz/master";
         sha256 = "9341c28772841acde618c778e85e381976f425824b816100792f697e68aec947";
       };
     };
@@ -48868,7 +48868,7 @@ let
       version = "1.5.0";
       src = fetchurl {
         name = "xmlhttprequest-1.5.0.tar.gz";
-        url = https://codeload.github.com/LearnBoost/node-XMLHttpRequest/tar.gz/0f36d0b5ebc03d85f860d42a64ae9791e1daa433;
+        url = "https://codeload.github.com/LearnBoost/node-XMLHttpRequest/tar.gz/0f36d0b5ebc03d85f860d42a64ae9791e1daa433";
         sha256 = "28dd0394d85befe8be4e9cd9f6803102780c62cbb09298cb174b52ff9777624f";
       };
     };
@@ -49891,7 +49891,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "CLI tool for Angular";
-      homepage = https://github.com/angular/angular-cli;
+      homepage = "https://github.com/angular/angular-cli";
       license = "MIT";
     };
     production = true;
@@ -49935,7 +49935,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "The command line interface for Antora.";
-      homepage = https://antora.org/;
+      homepage = "https://antora.org/";
       license = "MPL-2.0";
     };
     production = true;
@@ -50264,7 +50264,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "The default site generator pipeline for producing and publishing static documentation sites with Antora.";
-      homepage = https://antora.org/;
+      homepage = "https://antora.org/";
       license = "MPL-2.0";
     };
     production = true;
@@ -50427,7 +50427,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "A secure and free password manager for all of your devices.";
-      homepage = https://bitwarden.com/;
+      homepage = "https://bitwarden.com/";
       license = "GPL-3.0";
     };
     production = true;
@@ -52016,7 +52016,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Command line interface for rapid Vue.js development";
-      homepage = https://cli.vuejs.org/;
+      homepage = "https://cli.vuejs.org/";
       license = "MIT";
     };
     production = true;
@@ -52378,7 +52378,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Creating Electron app packages";
-      homepage = https://github.com/electron/asar;
+      homepage = "https://github.com/electron/asar";
       license = "MIT";
     };
     production = true;
@@ -52536,7 +52536,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "The browser package manager";
-      homepage = http://bower.io/;
+      homepage = "http://bower.io/";
       license = "MIT";
     };
     production = true;
@@ -52666,7 +52666,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Generate nix expressions to fetch bower dependencies";
-      homepage = https://github.com/rvl/bower2nix;
+      homepage = "https://github.com/rvl/bower2nix";
       license = "GPL-3.0";
     };
     production = true;
@@ -53275,7 +53275,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "A well-tested CSS minifier";
-      homepage = https://github.com/jakubpawlowicz/clean-css;
+      homepage = "https://github.com/jakubpawlowicz/clean-css";
       license = "MIT";
     };
     production = true;
@@ -56498,7 +56498,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Unfancy JavaScript";
-      homepage = http://coffeescript.org/;
+      homepage = "http://coffeescript.org/";
       license = "MIT";
     };
     production = true;
@@ -57893,7 +57893,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Create React Native apps with no build configuration.";
-      homepage = https://github.com/expo/create-react-native-app;
+      homepage = "https://github.com/expo/create-react-native-app";
       license = "BSD-3-Clause";
     };
     production = true;
@@ -57915,7 +57915,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "CSSLint";
-      homepage = http://csslint.net/;
+      homepage = "http://csslint.net/";
       license = "MIT";
     };
     production = true;
@@ -58570,7 +58570,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Dat is the package manager for data. Easily share and version control data.";
-      homepage = https://datproject.org/;
+      homepage = "https://datproject.org/";
       license = "BSD-3-Clause";
     };
     production = true;
@@ -58591,7 +58591,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "A DHCP server written in JavaScript";
-      homepage = https://github.com/infusion/node-dhcp;
+      homepage = "https://github.com/infusion/node-dhcp";
       license = "MIT OR GPL-2.0";
     };
     production = true;
@@ -58736,7 +58736,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "A blockchain-based DNS + HTTPS server that fixes HTTPS security, and more!";
-      homepage = https://github.com/okTurtles/dnschain;
+      homepage = "https://github.com/okTurtles/dnschain";
       license = "MPL-2.0";
     };
     production = true;
@@ -59269,7 +59269,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "EmojiOne is a complete set of emojis designed for the web. It includes libraries to easily convert unicode characters to shortnames (:smile:) and shortnames to our custom emoji images. PNG formats provided for the emoji images.";
-      homepage = https://www.emojione.com/;
+      homepage = "https://www.emojione.com/";
     };
     production = true;
     bypassCache = true;
@@ -59445,7 +59445,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "An AST-based pattern checker for JavaScript.";
-      homepage = https://eslint.org/;
+      homepage = "https://eslint.org/";
       license = "MIT";
     };
     production = true;
@@ -59627,7 +59627,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Makes eslint the fastest linter on the planet";
-      homepage = https://github.com/mantoni/eslint_d.js;
+      homepage = "https://github.com/mantoni/eslint_d.js";
       license = "MIT";
     };
     production = true;
@@ -60652,7 +60652,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "git hosting on secure-scuttlebutt (ssb)";
-      homepage = https://git-ssb.celehner.com/%25n92DiQh7ietE%2BR%2BX%2FI403LQoyf2DtR3WQfCkDKlheQU%3D.sha256;
+      homepage = "https://git-ssb.celehner.com/%25n92DiQh7ietE%2BR%2BX%2FI403LQoyf2DtR3WQfCkDKlheQU%3D.sha256";
       license = "Fair";
     };
     production = true;
@@ -62504,7 +62504,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "The streaming build system.";
-      homepage = https://gulpjs.com/;
+      homepage = "https://gulpjs.com/";
       license = "MIT";
     };
     production = true;
@@ -62849,7 +62849,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Command line interface for gulp";
-      homepage = http://gulpjs.com/;
+      homepage = "http://gulpjs.com/";
       license = "MIT";
     };
     production = true;
@@ -62880,7 +62880,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Highly configurable, well-tested, JavaScript-based HTML minifier.";
-      homepage = https://kangax.github.io/html-minifier/;
+      homepage = "https://kangax.github.io/html-minifier/";
       license = "MIT";
     };
     production = true;
@@ -63250,7 +63250,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "High precision scientific calculator with support for physical units";
-      homepage = https://github.com/sharkdp/insect;
+      homepage = "https://github.com/sharkdp/insect";
       license = "MIT";
     };
     production = true;
@@ -63571,7 +63571,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "A tool for creating and developing Ionic Framework mobile apps.";
-      homepage = https://ionicframework.com/;
+      homepage = "https://ionicframework.com/";
       license = "MIT";
     };
     production = true;
@@ -64112,7 +64112,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Implementation of the Language Server Protocol for JavaScript and TypeScript";
-      homepage = https://github.com/sourcegraph/javascript-typescript-langserver;
+      homepage = "https://github.com/sourcegraph/javascript-typescript-langserver";
       license = "Apache-2.0";
     };
     production = true;
@@ -64962,7 +64962,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "beautifier.io for node";
-      homepage = https://beautifier.io/;
+      homepage = "https://beautifier.io/";
       license = "MIT";
     };
     production = true;
@@ -64985,7 +64985,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "YAML 1.2 parser and serializer";
-      homepage = https://github.com/nodeca/js-yaml;
+      homepage = "https://github.com/nodeca/js-yaml";
       license = "MIT";
     };
     production = true;
@@ -65081,7 +65081,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Static analysis tool for JavaScript";
-      homepage = http://jshint.com/;
+      homepage = "http://jshint.com/";
       license = "(MIT AND JSON)";
     };
     production = true;
@@ -65124,7 +65124,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "JSON diff";
-      homepage = https://github.com/andreyvit/json-diff;
+      homepage = "https://github.com/andreyvit/json-diff";
     };
     production = true;
     bypassCache = true;
@@ -65179,7 +65179,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Various utilities for JSON References (http://tools.ietf.org/html/draft-pbryan-zyp-json-ref-03).";
-      homepage = https://github.com/whitlockjc/json-refs;
+      homepage = "https://github.com/whitlockjc/json-refs";
       license = "MIT";
     };
     production = true;
@@ -65460,7 +65460,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Get a full fake REST API with zero coding in less than 30 seconds";
-      homepage = https://github.com/typicode/json-server;
+      homepage = "https://github.com/typicode/json-server";
       license = "MIT";
     };
     production = true;
@@ -65487,7 +65487,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Validate JSON";
-      homepage = http://zaach.github.com/jsonlint/;
+      homepage = "http://zaach.github.com/jsonlint/";
     };
     production = true;
     bypassCache = true;
@@ -65687,7 +65687,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Spectacular Test Runner for JavaScript.";
-      homepage = http://karma-runner.github.io/;
+      homepage = "http://karma-runner.github.io/";
       license = "MIT";
     };
     production = true;
@@ -65781,7 +65781,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Merges multiple lcov results into one";
-      homepage = https://github.com/mweibel/lcov-result-merger;
+      homepage = "https://github.com/mweibel/lcov-result-merger";
       license = "MIT";
     };
     production = true;
@@ -67083,7 +67083,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Leaner CSS";
-      homepage = http://lesscss.org/;
+      homepage = "http://lesscss.org/";
       license = "Apache-2.0";
     };
     production = true;
@@ -67108,7 +67108,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "clean-css plugin for less.js";
-      homepage = http://lesscss.org/;
+      homepage = "http://lesscss.org/";
     };
     production = true;
     bypassCache = true;
@@ -67949,7 +67949,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Live Markdown previews for your favourite editor.";
-      homepage = https://github.com/shime/livedown;
+      homepage = "https://github.com/shime/livedown";
       license = "MIT";
     };
     production = true;
@@ -69107,7 +69107,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Madoko is a fast scholarly Markdown processor written in Koka";
-      homepage = http://madoko.codeplex.com/;
+      homepage = "http://madoko.codeplex.com/";
     };
     production = true;
     bypassCache = true;
@@ -69247,7 +69247,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Meeting room kiosk app for displaying meeting room schedules and booking rooms in your organization. Built against Google Apps, but other sources can be defined.";
-      homepage = https://bitbucket.org/aahmed/meat;
+      homepage = "https://bitbucket.org/aahmed/meat";
     };
     production = true;
     bypassCache = true;
@@ -70105,7 +70105,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "simple, flexible, fun test framework";
-      homepage = https://mochajs.org/;
+      homepage = "https://mochajs.org/";
       license = "MIT";
     };
     production = true;
@@ -70229,7 +70229,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Neovim client API and neovim remote plugin provider";
-      homepage = https://github.com/neovim/node-client;
+      homepage = "https://github.com/neovim/node-client";
       license = "MIT";
     };
     production = true;
@@ -70388,7 +70388,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Build tool and bindings loader for node-gyp that supports prebuilds";
-      homepage = https://github.com/prebuild/node-gyp-build;
+      homepage = "https://github.com/prebuild/node-gyp-build";
       license = "MIT";
     };
     production = true;
@@ -70684,7 +70684,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Web Inspector based nodeJS debugger";
-      homepage = http://github.com/node-inspector/node-inspector;
+      homepage = "http://github.com/node-inspector/node-inspector";
     };
     production = true;
     bypassCache = true;
@@ -71251,7 +71251,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Low-code programming for event-driven applications";
-      homepage = http://nodered.org/;
+      homepage = "http://nodered.org/";
       license = "Apache-2.0";
     };
     production = true;
@@ -71441,7 +71441,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Generate Nix expressions to build NPM packages";
-      homepage = https://github.com/svanderburg/node2nix;
+      homepage = "https://github.com/svanderburg/node2nix";
       license = "MIT";
     };
     production = true;
@@ -71605,7 +71605,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Simple monitor script for use during development of a node.js app.";
-      homepage = http://nodemon.io/;
+      homepage = "http://nodemon.io/";
       license = "MIT";
     };
     production = true;
@@ -71623,7 +71623,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "a package manager for JavaScript";
-      homepage = https://docs.npmjs.com/;
+      homepage = "https://docs.npmjs.com/";
       license = "Artistic-2.0";
     };
     production = true;
@@ -71919,7 +71919,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Find newer versions of dependencies than what your package.json or bower.json allows";
-      homepage = https://github.com/tjunnone/npm-check-updates;
+      homepage = "https://github.com/tjunnone/npm-check-updates";
       license = "Apache-2.0";
     };
     production = true;
@@ -72093,7 +72093,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Generate nix expressions to build npm packages";
-      homepage = https://github.com/NixOS/npm2nix;
+      homepage = "https://github.com/NixOS/npm2nix";
     };
     production = true;
     bypassCache = true;
@@ -72134,7 +72134,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "OCaml language server";
-      homepage = https://github.com/freebroccolo/ocaml-language-server;
+      homepage = "https://github.com/freebroccolo/ocaml-language-server";
       license = "Apache-2.0";
     };
     production = true;
@@ -73695,7 +73695,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Streaming torrent client for Node.js";
-      homepage = https://github.com/mafintosh/peerflix;
+      homepage = "https://github.com/mafintosh/peerflix";
       license = "MIT";
     };
     production = true;
@@ -74084,7 +74084,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Fast, disk space efficient package manager";
-      homepage = https://pnpm.js.org/;
+      homepage = "https://pnpm.js.org/";
       license = "MIT";
     };
     production = true;
@@ -74261,7 +74261,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Prettier is an opinionated code formatter";
-      homepage = https://prettier.io/;
+      homepage = "https://prettier.io/";
       license = "MIT";
     };
     production = true;
@@ -74648,7 +74648,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "A build system for PureScript projects";
-      homepage = https://github.com/purescript-contrib/pulp;
+      homepage = "https://github.com/purescript-contrib/pulp";
       license = "LGPL-3.0+";
     };
     production = true;
@@ -74820,7 +74820,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "A set of complementary tools to React, including the JSX transformer.";
-      homepage = https://facebook.github.io/react;
+      homepage = "https://facebook.github.io/react";
       license = "BSD-3-Clause";
     };
     production = true;
@@ -74838,7 +74838,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "The HTML Presentation Framework";
-      homepage = http://revealjs.com/;
+      homepage = "http://revealjs.com/";
       license = "MIT";
     };
     production = true;
@@ -76486,7 +76486,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Serverless Framework - Build web, mobile and IoT applications with serverless architectures using AWS Lambda, Azure Functions, Google CloudFunctions & more";
-      homepage = https://serverless.com/framework/docs/;
+      homepage = "https://serverless.com/framework/docs/";
       license = "MIT";
     };
     production = true;
@@ -78588,7 +78588,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "network protocol layer for secure-scuttlebutt";
-      homepage = https://github.com/ssbc/ssb-server;
+      homepage = "https://github.com/ssbc/ssb-server";
       license = "MIT";
     };
     production = true;
@@ -78606,7 +78606,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Send metric data from statsd to Stackdriver";
-      homepage = https://www.stackdriver.com/;
+      homepage = "https://www.stackdriver.com/";
       license = "MIT";
     };
     production = true;
@@ -79525,7 +79525,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Nodejs-based tool for optimizing SVG vector graphics files";
-      homepage = https://github.com/svg/svgo;
+      homepage = "https://github.com/svg/svgo";
       license = "MIT";
     };
     production = true;
@@ -80560,7 +80560,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "The pluggable linting tool for text and markdown.";
-      homepage = https://github.com/textlint/textlint/;
+      homepage = "https://github.com/textlint/textlint/";
       license = "MIT";
     };
     production = true;
@@ -80582,7 +80582,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Latex plugin for [textlint](https://github.com/textlint/textlint &#34;textlint&#34;).";
-      homepage = https://github.com/elzup/textlint-plugin-latex;
+      homepage = "https://github.com/elzup/textlint-plugin-latex";
       license = "MIT";
     };
     production = true;
@@ -80621,7 +80621,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "textlint rule check that abbreviations within parentheses.";
-      homepage = https://github.com/azu/textlint-rule-abbr-within-parentheses;
+      homepage = "https://github.com/azu/textlint-rule-abbr-within-parentheses";
       license = "MIT";
     };
     production = true;
@@ -80935,7 +80935,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "textlint rule for alex";
-      homepage = https://github.com/textlint-rule/textlint-rule-alex;
+      homepage = "https://github.com/textlint-rule/textlint-rule-alex";
       license = "MIT";
     };
     production = true;
@@ -80960,7 +80960,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "textlint rule to check common misspellings";
-      homepage = https://github.com/io-monad/textlint-rule-common-misspellings;
+      homepage = "https://github.com/io-monad/textlint-rule-common-misspellings";
       license = "GPL-3.0";
     };
     production = true;
@@ -80982,7 +80982,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Textlint rule to check correct usage of diacritics";
-      homepage = https://github.com/sapegin/textlint-rule-diacritics;
+      homepage = "https://github.com/sapegin/textlint-rule-diacritics";
       license = "MIT";
     };
     production = true;
@@ -81019,7 +81019,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "textlint rule that specify the maximum word count of a sentence.";
-      homepage = https://github.com/azu/textlint-rule-en-max-word-count;
+      homepage = "https://github.com/azu/textlint-rule-en-max-word-count";
       license = "MIT";
     };
     production = true;
@@ -81112,7 +81112,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "textlint rule that check no start with duplicated conjunction.";
-      homepage = https://github.com/textlint-rule/textlint-rule-no-start-duplicated-conjunction;
+      homepage = "https://github.com/textlint-rule/textlint-rule-no-start-duplicated-conjunction";
       license = "MIT";
     };
     production = true;
@@ -81153,7 +81153,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "textlint rule that check with or without period in list item.";
-      homepage = https://github.com/textlint-rule/textlint-rule-period-in-list-item;
+      homepage = "https://github.com/textlint-rule/textlint-rule-period-in-list-item";
       license = "MIT";
     };
     production = true;
@@ -81183,7 +81183,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Textlint rule to find filler words, buzzwords and chiches";
-      homepage = https://github.com/sapegin/textlint-rule-stop-words;
+      homepage = "https://github.com/sapegin/textlint-rule-stop-words";
       license = "MIT";
     };
     production = true;
@@ -81213,7 +81213,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "TextLint rule to check correct terms spelling";
-      homepage = https://github.com/sapegin/textlint-rule-terminology;
+      homepage = "https://github.com/sapegin/textlint-rule-terminology";
       license = "MIT";
     };
     production = true;
@@ -81253,7 +81253,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "textlint rule that check unexpanded acronym word.";
-      homepage = https://github.com/textlint-rule/textlint-rule-unexpanded-acronym;
+      homepage = "https://github.com/textlint-rule/textlint-rule-unexpanded-acronym";
       license = "MIT";
     };
     production = true;
@@ -81293,7 +81293,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "textlint rule to check your English style with write good";
-      homepage = https://github.com/textlint-rule/textlint-rule-write-good;
+      homepage = "https://github.com/textlint-rule/textlint-rule-write-good";
       license = "MIT";
     };
     production = true;
@@ -81728,7 +81728,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "The self-hosted Web IRC client";
-      homepage = https://thelounge.chat/;
+      homepage = "https://thelounge.chat/";
       license = "MIT";
     };
     production = true;
@@ -81746,7 +81746,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "JavaScript 3D library";
-      homepage = https://threejs.org/;
+      homepage = "https://threejs.org/";
       license = "MIT";
     };
     production = true;
@@ -82087,7 +82087,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Joyent Triton CLI and client (https://www.joyent.com/triton)";
-      homepage = https://github.com/joyent/node-triton;
+      homepage = "https://github.com/joyent/node-triton";
       license = "MPL-2.0";
     };
     production = true;
@@ -82136,7 +82136,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "TSUN: a repl for TypeScript Upgraded Node";
-      homepage = https://github.com/HerringtonDarkholme/typescript-repl;
+      homepage = "https://github.com/HerringtonDarkholme/typescript-repl";
       license = "MIT";
     };
     production = true;
@@ -82177,7 +82177,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "TypeScript is a language for application scale JavaScript development";
-      homepage = https://www.typescriptlang.org/;
+      homepage = "https://www.typescriptlang.org/";
       license = "Apache-2.0";
     };
     production = true;
@@ -83941,7 +83941,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "vue-language-server";
-      homepage = https://github.com/vuejs/vetur/tree/master/server;
+      homepage = "https://github.com/vuejs/vetur/tree/master/server";
       license = "MIT";
     };
     production = true;
@@ -85040,7 +85040,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "A command line tool to help build, run, and test web extensions";
-      homepage = https://github.com/mozilla/web-ext;
+      homepage = "https://github.com/mozilla/web-ext";
       license = "MPL-2.0";
     };
     production = true;
@@ -85516,7 +85516,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Packs CommonJs/AMD modules for the browser. Allows to split your codebase into multiple bundles, which can be loaded on demand. Support loaders to preprocess files, i.e. json, jsx, es7, css, less, ... and your custom stuff.";
-      homepage = https://github.com/webpack/webpack;
+      homepage = "https://github.com/webpack/webpack";
       license = "MIT";
     };
     production = true;
@@ -86581,7 +86581,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Copy files && directories with webpack";
-      homepage = https://github.com/webpack-contrib/copy-webpack-plugin;
+      homepage = "https://github.com/webpack-contrib/copy-webpack-plugin";
       license = "MIT";
     };
     production = true;
@@ -86878,7 +86878,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "WebTorrent, the streaming torrent client. For the command line.";
-      homepage = https://webtorrent.io/;
+      homepage = "https://webtorrent.io/";
       license = "MIT";
     };
     production = true;
@@ -87917,11 +87917,11 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "CLI tool for running Yeoman generators";
-      homepage = http://yeoman.io/;
+      homepage = "http://yeoman.io/";
       license = "BSD-2-Clause";
     };
     production = true;
     bypassCache = true;
     reconstructLock = true;
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/development/node-packages/node-packages-v12.nix b/pkgs/development/node-packages/node-packages-v12.nix
index 701c5d84a25e7..52465b099a5b6 100644
--- a/pkgs/development/node-packages/node-packages-v12.nix
+++ b/pkgs/development/node-packages/node-packages-v12.nix
@@ -2475,7 +2475,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Unfancy JavaScript";
-      homepage = http://coffeescript.org/;
+      homepage = "http://coffeescript.org/";
       license = "MIT";
     };
     production = true;
@@ -2953,7 +2953,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Generate Nix expressions to build NPM packages";
-      homepage = https://github.com/svanderburg/node2nix;
+      homepage = "https://github.com/svanderburg/node2nix";
       license = "MIT";
     };
     production = true;
@@ -3090,7 +3090,7 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Build tool and bindings loader for node-gyp that supports prebuilds";
-      homepage = https://github.com/prebuild/node-gyp-build;
+      homepage = "https://github.com/prebuild/node-gyp-build";
       license = "MIT";
     };
     production = true;
@@ -3182,4 +3182,4 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/development/node-packages/node-packages-v13.nix b/pkgs/development/node-packages/node-packages-v13.nix
index d70195210c74b..77517655c50ed 100644
--- a/pkgs/development/node-packages/node-packages-v13.nix
+++ b/pkgs/development/node-packages/node-packages-v13.nix
@@ -1441,11 +1441,11 @@ in
     buildInputs = globalBuildInputs;
     meta = {
       description = "Generate Nix expressions to build NPM packages";
-      homepage = https://github.com/svanderburg/node2nix;
+      homepage = "https://github.com/svanderburg/node2nix";
       license = "MIT";
     };
     production = true;
     bypassCache = true;
     reconstructLock = true;
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/development/ocaml-modules/bistro/default.nix b/pkgs/development/ocaml-modules/bistro/default.nix
index b141244f8c5b9..9603f283ee4fa 100644
--- a/pkgs/development/ocaml-modules/bistro/default.nix
+++ b/pkgs/development/ocaml-modules/bistro/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, buildDunePackage
+{ lib, fetchFromGitHub, fetchpatch, buildDunePackage
 , base64, bos, core, lwt_react, ocamlgraph, rresult, tyxml
 }:
 
@@ -12,6 +12,12 @@ buildDunePackage rec {
     sha256 = "114gq48cpj2mvycypa9lfyqqb26wa2gkdfwkcqhnx7m6sdwv9a38";
   };
 
+  # The following patch adds support for core.v0.13
+  patches = [(fetchpatch {
+    url = "https://github.com/pveber/bistro/commit/0931db43a146ad7829dff5120161a775f732a878.patch";
+    sha256 = "06y0sxbbab1mssc1xfjjv12lpv4rny5iqv9qkdqyzrvzpl1bdvnd";
+  })];
+
   propagatedBuildInputs = [ base64 bos core lwt_react ocamlgraph rresult tyxml ];
 
   minimumOCamlVersion = "4.07";
diff --git a/pkgs/development/ocaml-modules/dune-build-info/default.nix b/pkgs/development/ocaml-modules/dune-build-info/default.nix
new file mode 100644
index 0000000000000..3c828ebdcdb94
--- /dev/null
+++ b/pkgs/development/ocaml-modules/dune-build-info/default.nix
@@ -0,0 +1,17 @@
+{ lib, buildDunePackage, dune_2 }:
+
+buildDunePackage rec {
+  pname = "dune-build-info";
+  inherit (dune_2) src version;
+
+  useDune2 = true;
+
+  dontAddPrefix = true;
+
+  meta = with lib; {
+    inherit (dune_2.meta) homepage;
+    description = "Embed build information inside executables";
+    maintainers = [ maintainers.bcdarwin ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/development/ocaml-modules/janestreet/0.13.nix b/pkgs/development/ocaml-modules/janestreet/0.13.nix
new file mode 100644
index 0000000000000..4682a744d6f5d
--- /dev/null
+++ b/pkgs/development/ocaml-modules/janestreet/0.13.nix
@@ -0,0 +1,503 @@
+{ janePackage
+, ctypes
+, num
+, octavius
+, ppxlib
+, re
+, openssl
+}:
+
+rec {
+
+  ocaml-compiler-libs = janePackage {
+    pname = "ocaml-compiler-libs";
+    version = "0.12.1";
+    hash = "0hpk54fcsfcjp536fgwr80mjjf88hjk58q7jwnyrhk2ljd8xzgiv";
+    meta.description = "OCaml compiler libraries repackaged";
+  };
+
+  sexplib0 = janePackage {
+    pname = "sexplib0";
+    hash = "1b1bk0xs1hqa12qs5y4h1yl3mq6xml4ya2570dyhdn1j0fbw4g3y";
+    meta.description = "Library containing the definition of S-expressions and some base converters";
+  };
+
+  base = janePackage {
+    pname = "base";
+    version = "0.13.1";
+    hash = "08a5aymcgr5svvm8v0v20msd5cad64m6maakfbhz4172g7kd9jzw";
+    meta.description = "Full standard library replacement for OCaml";
+    propagatedBuildInputs = [ sexplib0 ];
+  };
+
+  stdio = janePackage {
+    pname = "stdio";
+    hash = "1hkj9vh8n8p3n5pvx7053xis1pfmqd8p7shjyp1n555xzimfxzgh";
+    meta.description = "Standard IO library for OCaml";
+    propagatedBuildInputs = [ base ];
+  };
+
+  ppx_sexp_conv = janePackage {
+    pname = "ppx_sexp_conv";
+    hash = "0jkhwmkrfq3ss6bv6i3m871alcr4xpngs6ci6bmzv3yfl7s8bwdf";
+    meta.description = "[@@deriving] plugin to generate S-expression conversion functions";
+    propagatedBuildInputs = [ ppxlib ];
+  };
+
+  ppx_here = janePackage {
+    pname = "ppx_here";
+    hash = "1ahidrrjsyi0al06bhv5h6aqmdk7ryz8dybfhqjsn1zp9q056q35";
+    meta.description = "Expands [%here] into its location";
+    propagatedBuildInputs = [ ppxlib ];
+  };
+
+  ppx_compare = janePackage {
+    pname = "ppx_compare";
+    hash = "14pnqa47gsvq93z1b8wb5pyq8zw90aaw71j4pwlyid4s86px454j";
+    meta.description = "Generation of comparison functions from types";
+    propagatedBuildInputs = [ ppxlib ];
+  };
+
+  ppx_cold = janePackage {
+    pname = "ppx_cold";
+    hash = "0wnfwsgbzk4i5aqjlcaqp6lkvrq5345vazryvx2klbbrd4759h9f";
+    meta.description = "Expands [@cold] into [@inline never][@specialise never][@local never]";
+    propagatedBuildInputs = [ ppxlib ];
+  };
+
+  ppx_assert = janePackage {
+    pname = "ppx_assert";
+    hash = "08dada2xcp3w5mir90z56qrdyd317lygml4qlfssj897534bwiqr";
+    meta.description = "Assert-like extension nodes that raise useful errors on failure";
+    propagatedBuildInputs = [ ppx_cold ppx_compare ppx_here ppx_sexp_conv ];
+  };
+
+  ppx_inline_test = janePackage {
+    pname = "ppx_inline_test";
+    hash = "135qzbhqy33lmigbq1rakr9i3y59y3pczh4laanqjyss9b9kfs60";
+    meta.description = "Syntax extension for writing in-line tests in ocaml code";
+    propagatedBuildInputs = [ ppxlib ];
+  };
+
+  ppx_custom_printf = janePackage {
+    pname = "ppx_custom_printf";
+    hash = "0kvfkdk4wg2z8x705bajvl1f8wiyy3aya203wdzc9425h73nqm5p";
+    meta.description = "Printf-style format-strings for user-defined string conversion";
+    propagatedBuildInputs = [ ppx_sexp_conv ];
+  };
+
+  fieldslib = janePackage {
+    pname = "fieldslib";
+    hash = "0nsl0i9vjk73pr70ksxqa65rd5v84jzdaazryfdy6i4a5sfg7bxa";
+    meta.description = "Syntax extension to define first class values representing record fields, to get and set record fields, iterate and fold over all fields of a record and create new record values";
+    propagatedBuildInputs = [ base ];
+  };
+
+  ppx_fields_conv = janePackage {
+    pname = "ppx_fields_conv";
+    hash = "0biw0fgphj522bj9wgjk263i2w92vnpaabzr5zn0grihp4yqy8w4";
+    meta.description = "Generation of accessor and iteration functions for ocaml records";
+    propagatedBuildInputs = [ fieldslib ppxlib ];
+  };
+
+  variantslib = janePackage {
+    pname = "variantslib";
+    hash = "04nps65v1n0nv9n1c1kj5k9jyqsfsxb6h2w3vf6cibhjr5m7z8xc";
+    meta.description = "Part of Jane Street's Core library";
+    propagatedBuildInputs = [ base ];
+  };
+
+  ppx_variants_conv = janePackage {
+    pname = "ppx_variants_conv";
+    hash = "1ssinizz11bws06qzjky486cj1zrflij1f7hi16d02j40qmyjz7b";
+    meta.description = "Generation of accessor and iteration functions for ocaml variant types";
+    propagatedBuildInputs = [ variantslib ppxlib ];
+  };
+
+  ppx_expect = janePackage {
+    pname = "ppx_expect";
+    hash = "1hhcga960wjvhcx5pk7rcywl1p9n2ycvqa294n24m8dhzqia6i47";
+    meta.description = "Cram like framework for OCaml";
+    propagatedBuildInputs = [ ppx_assert ppx_custom_printf ppx_fields_conv ppx_inline_test ppx_variants_conv re ];
+  };
+
+  ppx_enumerate = janePackage {
+    pname = "ppx_enumerate";
+    hash = "0hsg6f2nra1mb35jdgym5rf7spm642bs6qqifbikm9hg8f7z3ql4";
+    meta.description = "Generate a list containing all values of a finite type";
+    propagatedBuildInputs = [ ppxlib ];
+  };
+
+  ppx_hash = janePackage {
+    pname = "ppx_hash";
+    hash = "1f7mfyx4wgk67hchi57w3142m61ka3vgy1969cbkwr3akv6ifly2";
+    meta.description = "A ppx rewriter that generates hash functions from type expressions and definitions";
+    propagatedBuildInputs = [ ppx_compare ppx_sexp_conv ];
+  };
+
+  ppx_js_style = janePackage {
+    pname = "ppx_js_style";
+    hash = "1zlhcn0an5k9xjymk5z5m2vqi8zajy6nvcbl5sdn19pjl3zv645x";
+    meta.description = "Code style checker for Jane Street Packages";
+    propagatedBuildInputs = [ octavius ppxlib ];
+  };
+
+  ppx_base = janePackage {
+    pname = "ppx_base";
+    hash = "0dkqc85x7bgbb6lgx9rghvj1q4dpdgy9qgjl88ywi4c8l9rgnnkz";
+    meta.description = "Base set of ppx rewriters";
+    propagatedBuildInputs = [ ppx_cold ppx_enumerate ppx_hash ppx_js_style ];
+  };
+
+  ppx_bench = janePackage {
+    pname = "ppx_bench";
+    hash = "0snmy05d3jgihmppixx3dzamkykijqa2v43vpd7q4z8dpnip620g";
+    meta.description = "Syntax extension for writing in-line benchmarks in ocaml code";
+    propagatedBuildInputs = [ ppx_inline_test ];
+  };
+
+  ppx_sexp_message = janePackage {
+    pname = "ppx_sexp_message";
+    hash = "03jhx3ajcv22iwxkg1jf1jjvd14gyrwi1yc6c5ryqi5ha0fywfw6";
+    meta.description = "A ppx rewriter for easy construction of s-expressions";
+    propagatedBuildInputs = [ ppx_here ppx_sexp_conv ];
+  };
+
+  splittable_random = janePackage {
+    pname = "splittable_random";
+    hash = "1kgcd6k31vsd7638g8ip77bp1b7vzgkbvgvij4jm2igl09132r85";
+    meta.description = "PRNG that can be split into independent streams";
+    propagatedBuildInputs = [ base ppx_assert ppx_bench ppx_sexp_message ];
+  };
+
+  ppx_let = janePackage {
+    pname = "ppx_let";
+    hash = "0qplsvbv10h7kwf6dhhgvi001gfphv1v66s83zjr5zbypyaarg5y";
+    meta.description = "Monadic let-bindings";
+    propagatedBuildInputs = [ ppxlib ];
+  };
+
+  base_quickcheck = janePackage {
+    pname = "base_quickcheck";
+    hash = "0ik8llm01m2xap4gia0vpsh7yq311hph7a2kf5109ag4988s8p0w";
+    meta.description = "Randomized testing framework, designed for compatibility with Base";
+    propagatedBuildInputs = [ ppx_base ppx_fields_conv ppx_let splittable_random ];
+  };
+
+  ppx_stable = janePackage {
+    pname = "ppx_stable";
+    hash = "0h7ls1bs0bsd8c4na4aj0nawwhvfy50ybm7sza7yz3qli9jammjk";
+    meta.description = "Stable types conversions generator";
+    propagatedBuildInputs = [ ppxlib ];
+  };
+
+  bin_prot = janePackage {
+    pname = "bin_prot";
+    hash = "1nnr21rljlfglmhiji27d7c1d6gg5fk4cc5rl3750m98w28mfdjw";
+    meta.description = "A binary protocol generator";
+    propagatedBuildInputs = [ ppx_compare ppx_custom_printf ppx_fields_conv ppx_variants_conv ];
+  };
+
+  ppx_bin_prot = janePackage {
+    pname = "ppx_bin_prot";
+    hash = "14nfjgqisdqqg8wg4qzvc859zil82y0qpr8fm4nhq05mgxp37iyc";
+    meta.description = "Generation of bin_prot readers and writers from types";
+    propagatedBuildInputs = [ bin_prot ppx_here ];
+  };
+
+  ppx_fail = janePackage {
+    pname = "ppx_fail";
+    hash = "165mikjg4a1lahq3n9q9y2h36jbln5g3l2hapx17irvf0l0c3vn5";
+    meta.description = "Add location to calls to failwiths";
+    propagatedBuildInputs = [ ppx_here ];
+  };
+
+  jst-config = janePackage {
+    pname = "jst-config";
+    hash = "15lj6f83hz555xhjy9aayl3adqwgl1blcjnja693a1ybi3ca8w0y";
+    meta.description = "Compile-time configuration for Jane Street libraries";
+    buildInputs = [ ppx_assert ];
+  };
+
+  ppx_optcomp = janePackage {
+    pname = "ppx_optcomp";
+    hash = "13db395swqf7v87pgl9qiyj4igmvj57hpl8blx3kkrzj6ddh38a8";
+    meta.description = "Optional compilation for OCaml";
+    propagatedBuildInputs = [ ppxlib ];
+  };
+
+  jane-street-headers = janePackage {
+    pname = "jane-street-headers";
+    hash = "1qjg2ari0xn40dlbk0h9xkwr37k97ldkxpkv792fbl6wc2jlv3x5";
+    meta.description = "Jane Street C header files";
+  };
+
+  time_now = janePackage {
+    pname = "time_now";
+    hash = "1if234kz1ssmv22c0vh1cwhbivab6yy3xvy37ny1q4k5ibjc3v0n";
+    meta.description = "Reports the current time";
+    buildInputs = [ jst-config ppx_optcomp ];
+    propagatedBuildInputs = [ jane-street-headers base ppx_base ];
+  };
+
+  ppx_module_timer = janePackage {
+    pname = "ppx_module_timer";
+    hash = "13kv5fzwf41wsaksj41hnvcpx8pnbmzcainlq6f5shj9671hpnhb";
+    meta.description = "Ppx rewriter that records top-level module startup times";
+    propagatedBuildInputs = [ time_now ];
+  };
+
+  ppx_optional = janePackage {
+    pname = "ppx_optional";
+    hash = "1nwb9jvmszxddj9wxgv9g02qhr10yymm2q1w1gjfqd97m2m1mx4n";
+    meta.description = "Pattern matching on flat options";
+    propagatedBuildInputs = [ ppxlib ];
+  };
+
+  ppx_pipebang = janePackage {
+    pname = "ppx_pipebang";
+    hash = "0ybj0flsi95pf13ayzz1lcrqhqvkv1lm2dz6y8w49f12583496mc";
+    meta.description = "A ppx rewriter that inlines reverse application operators `|>` and `|!`";
+    propagatedBuildInputs = [ ppxlib ];
+  };
+
+  ppx_sexp_value = janePackage {
+    pname = "ppx_sexp_value";
+    hash = "18k5015awv9yjl44cvdmp3pn894cgsxmn5s7picxapm9675xqcg9";
+    meta.description = "A ppx rewriter that simplifies building s-expressions from ocaml values";
+    propagatedBuildInputs = [ ppx_here ppx_sexp_conv ];
+  };
+
+  typerep = janePackage {
+    pname = "typerep";
+    hash = "116hlifww2cqq1i9vwpl7ziwkc1na7p9icqi9srpdxnvn8ibcsas";
+    meta.description = "Typerep is a library for runtime types";
+    propagatedBuildInputs = [ base ];
+  };
+
+  ppx_typerep_conv = janePackage {
+    pname = "ppx_typerep_conv";
+    hash = "1jlmga9i79inr412l19n4vvmgafzp1bznqxwhy42x309wblbhxx9";
+    meta.description = "Generation of runtime types from type declarations";
+    propagatedBuildInputs = [ ppxlib typerep ];
+  };
+
+  ppx_jane = janePackage {
+    pname = "ppx_jane";
+    hash = "1a86rvnry8lvjhsg2k73f5bgz7l2962k5i49yzmzn8w66kj0yz60";
+    meta.description = "Standard Jane Street ppx rewriters";
+    propagatedBuildInputs = [ base_quickcheck ppx_bench ppx_bin_prot ppx_expect ppx_fail ppx_module_timer ppx_optcomp ppx_optional ppx_pipebang ppx_sexp_value ppx_stable ppx_typerep_conv ];
+  };
+
+  base_bigstring = janePackage {
+    pname = "base_bigstring";
+    hash = "1i3zr8bn71l442vl5rrvjpwphx20frp2vaw1qc05d348j76sxfp7";
+    meta.description = "String type based on [Bigarray], for use in I/O and C-bindings";
+    propagatedBuildInputs = [ ppx_jane ];
+  };
+
+  parsexp = janePackage {
+    pname = "parsexp";
+    hash = "0fsxy5lpsvfadj8m2337j8iprs294dfikqxjcas7si74nskx6l38";
+    meta.description = "S-expression parsing library";
+    propagatedBuildInputs = [ base sexplib0 ];
+  };
+
+  sexplib = janePackage {
+    pname = "sexplib";
+    hash = "059ypcyirw00x6dqa33x49930pwxcr3i72qz5pf220js2ai2nzhn";
+    meta.description = "Library for serializing OCaml values to and from S-expressions";
+    propagatedBuildInputs = [ num parsexp ];
+  };
+
+  core_kernel = janePackage {
+    version = "0.13.1";
+    pname = "core_kernel";
+    hash = "1ynyz6jkf23q0cwbn6kv06mgyjd644qxb0qkrydq0cglcaa4kjhp";
+    meta.description = "System-independent part of Core";
+    buildInputs = [ jst-config ];
+    propagatedBuildInputs = [ base_bigstring sexplib ];
+  };
+
+  spawn = janePackage {
+    pname = "spawn";
+    hash = "1w003k1kw1lmyiqlk58gkxx8rac7dchiqlz6ah7aj7bh49b36ppf";
+    meta.description = "Spawning sub-processes";
+    buildInputs = [ ppx_expect ];
+  };
+
+  core = janePackage {
+    pname = "core";
+    hash = "1i5z9myl6i7axd8dz4b71gdsz9la6k07ib9njr4bn12yn0y76b1m";
+    meta.description = "System-independent part of Core";
+    buildInputs = [ jst-config ];
+    propagatedBuildInputs = [ core_kernel spawn ];
+  };
+
+  async_kernel = janePackage {
+    pname = "async_kernel";
+    hash = "1rrbyy3pyh31qwv0jiarhpgdyq2z2gx6axmaplgpxshk4qx6gsld";
+    meta.description = "Monadic concurrency library";
+    propagatedBuildInputs = [ core_kernel ];
+  };
+
+  protocol_version_header = janePackage {
+    pname = "protocol_version_header";
+    hash = "19wscd81jlj355f9din1sg21m3af456a0id2a37bx38r390wrghc";
+    meta.description = "Protocol versioning";
+    propagatedBuildInputs = [ core_kernel ];
+  };
+
+  async_rpc_kernel = janePackage {
+    pname = "async_rpc_kernel";
+    hash = "1k3f2psyd1xcf7nkk0q1fq57yyhfqbzyynsz821n7mrnm37simac";
+    meta.description = "Platform-independent core of Async RPC library";
+    propagatedBuildInputs = [ async_kernel protocol_version_header ];
+  };
+
+  async_unix = janePackage {
+    pname = "async_unix";
+    hash = "0n3jz3qjlphyhkqgnbjbwf2fqxaksws82dx1mk4m4wnw3275gdi5";
+    meta.description = "Monadic concurrency library";
+    propagatedBuildInputs = [ async_kernel core ];
+  };
+
+  async_extra = janePackage {
+    pname = "async_extra";
+    hash = "06q1farx7dwi4h490xi1azq7ym57ih2d23sq17g2jfvw889kf4n1";
+    meta.description = "Monadic concurrency library";
+    propagatedBuildInputs = [ async_rpc_kernel async_unix ];
+  };
+
+  textutils = janePackage {
+    pname = "textutils";
+    hash = "1wnyqj9dzfgl0kddmdl4n9rkl16hwy432dd2i4ksvk2z5g9kkb0d";
+    meta.description = "Text output utilities";
+    propagatedBuildInputs = [ core ];
+  };
+
+  async = janePackage {
+    pname = "async";
+    hash = "002j9yxpw0ghi12a84163vaqa3n9h8j35f4i72nbxnilxwvy95sr";
+    meta.description = "Monadic concurrency library";
+    propagatedBuildInputs = [ async_rpc_kernel async_unix textutils ];
+  };
+
+  async_find = janePackage {
+    pname = "async_find";
+    hash = "0l8cfhyrx2rb2avdcfx5m70aj6rx2d57qxqvfycad5afqz4xx2n9";
+    meta.description = "Directory traversal with Async";
+    propagatedBuildInputs = [ async ];
+  };
+
+  re2 = janePackage {
+    pname = "re2";
+    hash = "0hmizznlzilynn5kh6149bbpkfw2l0xi7zi1y1fxfww2ma3wpim0";
+    meta.description = "OCaml bindings for RE2, Google's regular expression library";
+    propagatedBuildInputs = [ core_kernel ];
+    prePatch = ''
+      substituteInPlace src/re2_c/dune --replace 'CXX=g++' 'CXX=c++'
+      substituteInPlace src/dune --replace '(cxx_flags (:standard \ -pedantic) (-I re2_c/libre2))' '(cxx_flags (:standard \ -pedantic) (-I re2_c/libre2) (-x c++))'
+    '';
+  };
+
+  shell = janePackage {
+    pname = "shell";
+    hash = "190ymhm0z9b7hngbcpg88wwrfxwfcdh339d7rd2xhmrhi4z99r18";
+    meta.description = "Yet another implementation of fork&exec and related functionality";
+    buildInputs = [ jst-config ];
+    propagatedBuildInputs = [ re2 textutils ];
+  };
+
+  async_shell = janePackage {
+    pname = "async_shell";
+    hash = "0bfxyvdmyv23zfr49pb4c3bgfkjr4s3nb3z07xrw6szia3j1kp4j";
+    meta.description = "Shell helpers for Async";
+    propagatedBuildInputs = [ async shell ];
+  };
+
+  core_bench = janePackage {
+    pname = "core_bench";
+    hash = "1nk0i3z8rqrljbf4bc7ljp71g0a4361nh85s2ang0lgxri74zacm";
+    meta.description = "Benchmarking library";
+    propagatedBuildInputs = [ textutils ];
+  };
+
+  core_extended = janePackage {
+    pname = "core_extended";
+    hash = "0zh1wwkg5cxkz633dl9zbbl65aksvzb5mss1q8f7w6i1sv3n0135";
+    meta.description = "Extra components that are not as closely vetted or as stable as Core";
+    propagatedBuildInputs = [ core ];
+  };
+
+  sexp_pretty = janePackage {
+    pname = "sexp_pretty";
+    hash = "1a59xc9frmvi7n0i32dzs8gpf5ral80xkwv97a13zv5cyg8l6216";
+    meta.description = "S-expression pretty-printer";
+    propagatedBuildInputs = [ ppx_base re sexplib ];
+  };
+
+  expect_test_helpers_kernel = janePackage {
+    pname = "expect_test_helpers_kernel";
+    hash = "11m0i7mj6b1cmqnwhmsrqdc814s0lk3sip8rh97k75grngazmjvn";
+    meta.description = "Helpers for writing expectation tests";
+    buildInputs = [ ppx_jane ];
+    propagatedBuildInputs = [ core_kernel sexp_pretty ];
+  };
+
+  expect_test_helpers = janePackage {
+    pname = "expect_test_helpers";
+    hash = "0sw9yam8d9hdam8p194q0hgc4i26vvwj5qi2cba1jxfhdzhy8jdd";
+    meta.description = "Async helpers for writing expectation tests";
+    propagatedBuildInputs = [ async expect_test_helpers_kernel ];
+  };
+
+  patience_diff = janePackage {
+    pname = "patience_diff";
+    hash = "012rlbnw21yq2lsbfk3f7l4m4qq3jdx238146z36v54vnhhs6r2r";
+    meta.description = "Diff library using Bram Cohen's patience diff algorithm";
+    propagatedBuildInputs = [ core_kernel ];
+  };
+
+  ecaml = janePackage {
+    pname = "ecaml";
+    hash = "0jmmsi1m7d4cl5mnw6v9h4ng29anwxy73a6qfi28lgpzafn452bc";
+    meta.description = "Library for writing Emacs plugin in OCaml";
+    propagatedBuildInputs = [ async expect_test_helpers_kernel ];
+  };
+
+  ### Packages at version 0.11, with dependencies at version 0.12
+
+  configurator = janePackage {
+    pname = "configurator";
+    version = "0.11.0";
+    hash = "0h686630cscav7pil8c3w0gbh6rj4b41dvbnwmicmlkc746q5bfk";
+    propagatedBuildInputs = [ stdio ];
+    meta.description = "Helper library for gathering system configuration";
+  };
+
+  ppx_core = janePackage {
+    pname = "ppx_core";
+    version = "0.11.0";
+    hash = "11hgm9mxig4cm3c827f6dns9mjv3pf8g6skf10x0gw9xnp1dmzmx";
+    propagatedBuildInputs = [ ppxlib ];
+    meta.description = "Deprecated (see ppxlib)";
+  };
+
+  ppx_driver = janePackage {
+    pname = "ppx_driver";
+    version = "0.11.0";
+    hash = "00kfx6js2kxk57k4v7hiqvwk7h35whgjihnxf75m82rnaf4yzvfi";
+    propagatedBuildInputs = [ ppxlib ];
+    meta.description = "Deprecated (see ppxlib)";
+  };
+
+  ppx_type_conv = janePackage {
+    pname = "ppx_type_conv";
+    version = "0.11.0";
+    hash = "04dbrglqqhkas25cpjz8xhjcbpk141c35qggzw66bn69izczfmaf";
+    propagatedBuildInputs = [ ppxlib ];
+    meta.description = "Deprecated (see ppxlib)";
+  };
+
+}
diff --git a/pkgs/development/ocaml-modules/janestreet/async_ssl.nix b/pkgs/development/ocaml-modules/janestreet/async_ssl.nix
deleted file mode 100644
index c13f9a34fb769..0000000000000
--- a/pkgs/development/ocaml-modules/janestreet/async_ssl.nix
+++ /dev/null
@@ -1,17 +0,0 @@
-{ stdenv, buildOcamlJane, async, comparelib, core, ctypes
-, openssl, fieldslib, herelib, pipebang, sexplib, ocaml_oasis
-}:
-
-buildOcamlJane {
-  name = "async_ssl";
-  version = "113.33.07";
-  hash = "0bhzpnmlx6dy4fli3i7ipjwqbsdi7fq171jrila5dr3ciy3841xs";
-  propagatedBuildInputs = [ ctypes async comparelib core fieldslib
-                            herelib pipebang sexplib openssl ocaml_oasis ];
-  meta = with stdenv.lib; {
-    homepage = "https://github.com/janestreet/async_ssl";
-    description = "Async wrappers for ssl";
-    license = licenses.asl20;
-    maintainers = [ maintainers.ericbmerritt ];
-  };
-}
diff --git a/pkgs/development/ocaml-modules/janestreet/janePackage_0_13.nix b/pkgs/development/ocaml-modules/janestreet/janePackage_0_13.nix
new file mode 100644
index 0000000000000..b92bcead95c3e
--- /dev/null
+++ b/pkgs/development/ocaml-modules/janestreet/janePackage_0_13.nix
@@ -0,0 +1,19 @@
+{ lib, fetchFromGitHub, buildDunePackage, defaultVersion ? "0.13.0" }:
+
+{ pname, version ? defaultVersion, hash, ...}@args:
+
+buildDunePackage (args // {
+  inherit version;
+
+  minimumOCamlVersion = "4.08";
+
+  src = fetchFromGitHub {
+    owner = "janestreet";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = hash;
+  };
+
+  meta.license = lib.licenses.mit;
+  meta.homepage = "https://github.com/janestreet/${pname}";
+})
diff --git a/pkgs/development/ocaml-modules/linenoise/default.nix b/pkgs/development/ocaml-modules/linenoise/default.nix
index b6b9b4163ff94..0ad277f4a07f6 100644
--- a/pkgs/development/ocaml-modules/linenoise/default.nix
+++ b/pkgs/development/ocaml-modules/linenoise/default.nix
@@ -2,7 +2,7 @@
 
 buildDunePackage rec {
   pname = "linenoise";
-  version = "1.1.0";
+  version = "1.3.0";
 
   minimumOCamlVersion = "4.02";
 
@@ -10,7 +10,7 @@ buildDunePackage rec {
     owner = "fxfactorial";
     repo = "ocaml-${pname}";
     rev = "v${version}";
-    sha256 = "1h6rqfgmhmd7p5z8yhk6zkbrk4yzw1v2fgwas2b7g3hqs6y0xj0q";
+    sha256 = "0m9mm1arsawi5w5aqm57z41sy1wfxvhfgbdiw7hzy631i391144g";
   };
 
   propagatedBuildInputs = [ result ];
diff --git a/pkgs/development/ocaml-modules/phylogenetics/default.nix b/pkgs/development/ocaml-modules/phylogenetics/default.nix
index 916be9b3d3863..1873a4e0c583b 100644
--- a/pkgs/development/ocaml-modules/phylogenetics/default.nix
+++ b/pkgs/development/ocaml-modules/phylogenetics/default.nix
@@ -3,15 +3,15 @@
 
 buildDunePackage rec {
   pname = "phylogenetics";
-  version = "unstable-2020-01-05";
+  version = "unstable-2020-01-25";
 
   useDune2 = true;
 
   src = fetchFromGitHub {
     owner  = "biocaml";
     repo   = pname;
-    rev    = "b55ef7d7322bd822be26d21339945d45487fb547";
-    sha256 = "0hzfjhs5w3a7hlzxs739k5ik3k1xn3dzyzziid765s74f638n4hj";
+    rev    = "752a7d0324709ba919ef43630a270afd45d6b734";
+    sha256 = "1zsxpl1yjbw6y6n1q7qk3h0l7c0lxhh8yp8bkxlwnpzlkqq28ycg";
   };
 
   minimumOCamlVersion = "4.08";  # e.g., uses Float.min
diff --git a/pkgs/development/ocaml-modules/rpclib/default.nix b/pkgs/development/ocaml-modules/rpclib/default.nix
index a4134f592b36f..9216a489248b9 100644
--- a/pkgs/development/ocaml-modules/rpclib/default.nix
+++ b/pkgs/development/ocaml-modules/rpclib/default.nix
@@ -2,7 +2,7 @@
 
 buildDunePackage rec {
   pname = "rpclib";
-  version = "6.0.0";
+  version = "7.0.0";
 
   minimumOCamlVersion = "4.04";
 
@@ -10,7 +10,7 @@ buildDunePackage rec {
     owner = "mirage";
     repo = "ocaml-rpc";
     rev = "v${version}";
-    sha256 = "0bmr20sj7kybjjlwd42irj0f5zlnxcw7mxa1mdgxkki9bmhsqr51";
+    sha256 = "0d8nb272mjxkq5ddn65cy9gjpa8yvd0v3jv3wp5xfh9gj29wd2jj";
   };
 
   buildInputs = [ alcotest cmdliner yojson ];
diff --git a/pkgs/development/ocaml-modules/sedlex/2.nix b/pkgs/development/ocaml-modules/sedlex/2.nix
index 7b751ba03037d..b1a892d5b804a 100644
--- a/pkgs/development/ocaml-modules/sedlex/2.nix
+++ b/pkgs/development/ocaml-modules/sedlex/2.nix
@@ -38,9 +38,9 @@ buildDunePackage rec {
     sha256 = "05f6qa8x3vhpdz1fcnpqk37fpnyyq13icqsk2gww5idjnh6kng26";
   };
 
-  buildInputs = [ ppx_tools_versioned ocaml-migrate-parsetree ];
-
-  propagatedBuildInputs = [ gen uchar ];
+  propagatedBuildInputs = [
+    gen uchar ocaml-migrate-parsetree ppx_tools_versioned
+  ];
 
   preBuild = ''
     ln -s ${DerivedCoreProperties} src/generator/data/DerivedCoreProperties.txt
diff --git a/pkgs/development/python-modules/click/default.nix b/pkgs/development/python-modules/click/default.nix
index abf1ea58c8f17..ac96ef32618c9 100644
--- a/pkgs/development/python-modules/click/default.nix
+++ b/pkgs/development/python-modules/click/default.nix
@@ -1,31 +1,23 @@
-{ lib, buildPythonPackage, fetchPypi, locale, pytest }:
+{ lib, buildPythonPackage, fetchPypi, locale, pytestCheckHook }:
 
 buildPythonPackage rec {
   pname = "click";
-  version = "7.0";
+  version = "7.1.1";
 
   src = fetchPypi {
-    pname = "Click";
-    inherit version;
-    sha256 = "5b94b49521f6456670fdb30cd82a4eca9412788a93fa6dd6df72c94d5a8ff2d7";
+    inherit pname version;
+    sha256 = "1k60i2fvxf8rxazlv04mnsmlsjrj5i5sda3x1ifhr0nqi7mb864a";
   };
 
   postPatch = ''
-    substituteInPlace click/_unicodefun.py \
+    substituteInPlace src/click/_unicodefun.py \
       --replace "'locale'" "'${locale}/bin/locale'"
   '';
 
-  buildInputs = [ pytest ];
-
-  checkPhase = ''
-    py.test tests
-  '';
-
-  # https://github.com/pallets/click/issues/823
-  doCheck = false;
+  checkInputs = [ pytestCheckHook ];
 
   meta = with lib; {
-    homepage = "http://click.pocoo.org/";
+    homepage = "https://click.palletsprojects.com/";
     description = "Create beautiful command line interfaces in Python";
     longDescription = ''
       A Python package for creating beautiful command line interfaces in a
diff --git a/pkgs/development/python-modules/cryptography/default.nix b/pkgs/development/python-modules/cryptography/default.nix
index f3a3955571dfd..9b14f4a6fc7d0 100644
--- a/pkgs/development/python-modules/cryptography/default.nix
+++ b/pkgs/development/python-modules/cryptography/default.nix
@@ -2,14 +2,14 @@
 , buildPythonPackage
 , fetchPypi
 , fetchpatch
+, isPy27
+, ipaddress
 , openssl
 , cryptography_vectors
 , darwin
 , packaging
 , six
 , pythonOlder
-, enum34
-, ipaddress
 , isPyPy
 , cffi
 , pytest
@@ -17,15 +17,16 @@
 , iso8601
 , pytz
 , hypothesis
+, enum34
 }:
 
 buildPythonPackage rec {
   pname = "cryptography";
-  version = "2.8"; # Also update the hash in vectors.nix
+  version = "2.9"; # Also update the hash in vectors.nix
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0l8nhw14npknncxdnp7n4hpmjyscly6g7fbivyxkjwvlv071zniw";
+    sha256 = "0vlqy2pki0fh1h6l6cbb43z3g2n9fv0849dzb5gqwjv0bkpx7b0c";
   };
 
   outputs = [ "out" "dev" ];
@@ -35,9 +36,8 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     packaging
     six
-  ] ++ stdenv.lib.optional (pythonOlder "3.4") enum34
-  ++ stdenv.lib.optional (pythonOlder "3.3") ipaddress
-  ++ stdenv.lib.optional (!isPyPy) cffi;
+  ] ++ stdenv.lib.optional (!isPyPy) cffi
+  ++ stdenv.lib.optionals isPy27 [ ipaddress enum34 ];
 
   checkInputs = [
     cryptography_vectors
@@ -48,9 +48,8 @@ buildPythonPackage rec {
     pytz
   ];
 
-  # remove when https://github.com/pyca/cryptography/issues/4998 is fixed
   checkPhase = ''
-    py.test --disable-pytest-warnings tests -k 'not load_ecdsa_no_named_curve'
+    py.test --disable-pytest-warnings tests
   '';
 
   # IOKit's dependencies are inconsistent between OSX versions, so this is the best we
@@ -64,9 +63,11 @@ buildPythonPackage rec {
       common cryptographic algorithms such as symmetric ciphers, message
       digests, and key derivation functions.
       Our goal is for it to be your "cryptographic standard library". It
-      supports Python 2.7, Python 3.4+, and PyPy 5.3+.
+      supports Python 2.7, Python 3.5+, and PyPy 5.4+.
     '';
     homepage = "https://github.com/pyca/cryptography";
+    changelog = "https://cryptography.io/en/latest/changelog/#v"
+      + replaceStrings [ "." ] [ "-" ] version;
     license = with licenses; [ asl20 bsd3 psfl ];
     maintainers = with maintainers; [ primeos ];
   };
diff --git a/pkgs/development/python-modules/cryptography/vectors.nix b/pkgs/development/python-modules/cryptography/vectors.nix
index 7c994ef6a4707..6fd8259d78fc4 100644
--- a/pkgs/development/python-modules/cryptography/vectors.nix
+++ b/pkgs/development/python-modules/cryptography/vectors.nix
@@ -7,7 +7,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "05pi3shqz0fgvy0d5yazza67bbnam8fkrx2ayrrclgkaqms23lvc";
+    sha256 = "1h7dcgwrjxqk1bzkangbvlhhlgyqd7cfi894dv1cd5m2sp7csblc";
   };
 
   # No tests included
diff --git a/pkgs/development/python-modules/howdoi/default.nix b/pkgs/development/python-modules/howdoi/default.nix
index 9b1fb75b46180..c98192e9b0ab1 100644
--- a/pkgs/development/python-modules/howdoi/default.nix
+++ b/pkgs/development/python-modules/howdoi/default.nix
@@ -5,6 +5,8 @@
 , requests-cache
 , pygments
 , pyquery
+, cachelib
+, appdirs
 }:
 
 buildPythonPackage rec {
@@ -16,7 +18,7 @@ buildPythonPackage rec {
     sha256 = "3b322668606d29d8a841c3b28c0574851f512b55c33a7ceb982b6a98d82fa3e3";
   };
 
-  propagatedBuildInputs = [ six requests-cache pygments pyquery ];
+  propagatedBuildInputs = [ six requests-cache pygments pyquery cachelib appdirs ];
 
   preCheck = ''
     export HOME=$(mktemp -d)
diff --git a/pkgs/development/python-modules/pdfposter/default.nix b/pkgs/development/python-modules/pdfposter/default.nix
new file mode 100644
index 0000000000000..43e2f1f57f752
--- /dev/null
+++ b/pkgs/development/python-modules/pdfposter/default.nix
@@ -0,0 +1,20 @@
+{ stdenv, buildPythonPackage, fetchPypi, pypdf2 }:
+
+buildPythonPackage rec {
+  pname = "pdftools.pdfposter";
+  version = "0.7.post1";
+
+  propagatedBuildInputs = [ pypdf2 ];
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0c1avpbr9q53yzq5ar2x485rmp9d0l3z27aham32bg7gplzd7w0j";
+  };
+
+  meta = with stdenv.lib; {
+    description = "Split large pages of a PDF into smaller ones for poster printing";
+    homepage = "https://pdfposter.readthedocs.io";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ wamserma ];
+  };
+}
diff --git a/pkgs/development/python-modules/publicsuffix2/default.nix b/pkgs/development/python-modules/publicsuffix2/default.nix
new file mode 100644
index 0000000000000..fe360168aa5ab
--- /dev/null
+++ b/pkgs/development/python-modules/publicsuffix2/default.nix
@@ -0,0 +1,26 @@
+{ stdenv, buildPythonPackage, fetchFromGitHub, requests }:
+
+buildPythonPackage rec {
+  pname = "publicsuffix2";
+  version = "2.20191221";
+
+  # Tests are missing in the sdist
+  # See: https://github.com/nexB/python-publicsuffix2/issues/12
+  src = fetchFromGitHub {
+    owner = "nexB";
+    repo = "python-publicsuffix2";
+    rev = "release-2.2019-12-21";
+    sha256 = "1dkvfvl0izq9hqzilnw8ipkbgjs9xyad9p21i3864hzinbh0wp9r";
+  };
+
+  nativeBuildInputs = [ requests ];
+
+  meta = with stdenv.lib; {
+    description = ''
+      Get a public suffix for a domain name using the Public Suffix
+      List. Forked from and using the same API as the publicsuffix package.
+    '';
+    homepage = "https://pypi.python.org/pypi/publicsuffix2/";
+    license = licenses.mpl20;
+  };
+}
diff --git a/pkgs/development/python-modules/pyopengl/default.nix b/pkgs/development/python-modules/pyopengl/default.nix
index fddc27ee1913b..2a3b90733c46f 100644
--- a/pkgs/development/python-modules/pyopengl/default.nix
+++ b/pkgs/development/python-modules/pyopengl/default.nix
@@ -15,7 +15,7 @@ buildPythonPackage rec {
     sha256 = "0bdf5ed600df30c8830455702338902528717c0af85ac5914f1dc5aa0bfa6eee";
   };
 
-  propagatedBuildInputs = [ pkgs.libGLU pkgs.libGL pkgs.freeglut pillow ];
+  propagatedBuildInputs = [ pillow ];
 
   patchPhase = let
     ext = stdenv.hostPlatform.extensions.sharedLibrary; in ''
diff --git a/pkgs/development/python-modules/pytesseract/default.nix b/pkgs/development/python-modules/pytesseract/default.nix
index 496a163cb5feb..0111695ca73f7 100644
--- a/pkgs/development/python-modules/pytesseract/default.nix
+++ b/pkgs/development/python-modules/pytesseract/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "pytesseract";
-  version = "0.3.3";
+  version = "0.3.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0lml55jrvdzy9fm31zpw64fqc4d6p5djg1ax2kgnimzfscxghh8h";
+    sha256 = "16l9b9f5v0a9j5jfgpd8irk9yhc9byzirrzv1rlkapdbz36sbn5g";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/requests_download/default.nix b/pkgs/development/python-modules/requests_download/default.nix
index 3c265a5955edc..b31573a91ca0b 100644
--- a/pkgs/development/python-modules/requests_download/default.nix
+++ b/pkgs/development/python-modules/requests_download/default.nix
@@ -11,7 +11,7 @@ buildPythonPackage rec {
   format = "wheel";
 
   #src = pkgs.fetchurl {
-  #  url = https://files.pythonhosted.org/packages/60/af/10f899f0574a81cbc511124c08d7c7dc46c20d4f956a6a3c793ad4330bb4/requests_download-0.1.2-py2.py3-none-any.whl;
+  #  url = "https://files.pythonhosted.org/packages/60/af/10f899f0574a81cbc511124c08d7c7dc46c20d4f956a6a3c793ad4330bb4/requests_download-0.1.2-py2.py3-none-any.whl";
   #  sha256 = "1ballx1hljpdpyvqzqn79m0dc21z2smrnxk2ylb6dbpg5crrskcr";
   #};
 
diff --git a/pkgs/development/python-modules/secretstorage/default.nix b/pkgs/development/python-modules/secretstorage/default.nix
index 9e2b5df845e6b..d10ea9c8be2b1 100644
--- a/pkgs/development/python-modules/secretstorage/default.nix
+++ b/pkgs/development/python-modules/secretstorage/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchPypi, buildPythonPackage, pythonOlder, cryptography, jeepney, pygobject3 }:
+{ lib, fetchPypi, buildPythonPackage, pythonOlder, cryptography, jeepney }:
 
 buildPythonPackage rec {
   pname = "secretstorage";
@@ -15,7 +15,6 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     cryptography
     jeepney
-    pygobject3
   ];
 
   # Needs a D-Bus Sesison
diff --git a/pkgs/development/tools/bazelisk/default.nix b/pkgs/development/tools/bazelisk/default.nix
index 5780cf4382a7d..80ec4c4f448d2 100644
--- a/pkgs/development/tools/bazelisk/default.nix
+++ b/pkgs/development/tools/bazelisk/default.nix
@@ -2,17 +2,19 @@
 
 buildGoModule rec {
   pname = "bazelisk";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "bazelbuild";
     repo = pname;
     rev = "v${version}";
-    sha256 = "15h4mbsfjwby4wq57rdj4dzsf595qjfgi3v5zw62yycn3m2w922p";
+    sha256 = "14zp0bi0p1rfbx1pxi5y28ndxwbqbvfx0pvy3jh1mnx5qsii1gcq";
   };
 
   modSha256 = "1w8k659ifapcxbbim0nf7wd7w10bhlagc33q08izh84gcgsh0yyz";
 
+  buildFlagsArray = [ "-ldflags=-s -w -X main.BazeliskVersion=${version}" ];
+
   meta = with stdenv.lib; {
     description = "A user-friendly launcher for Bazel";
     longDescription = ''
diff --git a/pkgs/development/tools/build-managers/cmake/default.nix b/pkgs/development/tools/build-managers/cmake/default.nix
index 0a6335a3eb722..ac41394e6a83e 100644
--- a/pkgs/development/tools/build-managers/cmake/default.nix
+++ b/pkgs/development/tools/build-managers/cmake/default.nix
@@ -19,12 +19,12 @@ stdenv.mkDerivation rec {
           + lib.optionalString useNcurses "-cursesUI"
           + lib.optionalString withQt5 "-qt5UI"
           + lib.optionalString useQt4 "-qt4UI";
-  version = "3.16.5";
+  version = "3.17.0";
 
   src = fetchurl {
     url = "${meta.homepage}files/v${lib.versions.majorMinor version}/cmake-${version}.tar.gz";
     # compare with https://cmake.org/files/v${lib.versions.majorMinor version}/cmake-${version}-SHA-256.txt
-    sha256 = "1z4bb8z6b4dvq5hrvajrf1hyybqay3xybyimf71w1jgcp180nxjz";
+    sha256 = "0iq8y1rb5dqnzrwy4lssr76hbnnvh54q2ympl97wrshma6shak5p";
   };
 
   patches = [
diff --git a/pkgs/development/tools/buildah/default.nix b/pkgs/development/tools/buildah/default.nix
index 7fbb21ffb120a..84b2863130820 100644
--- a/pkgs/development/tools/buildah/default.nix
+++ b/pkgs/development/tools/buildah/default.nix
@@ -1,5 +1,14 @@
-{ stdenv, buildGoPackage, fetchFromGitHub
-, gpgme, libgpgerror, lvm2, btrfs-progs, pkg-config, libselinux, libseccomp
+{ stdenv
+, buildGoPackage
+, fetchFromGitHub
+, installShellFiles
+, pkg-config
+, gpgme
+, libgpgerror
+, lvm2
+, btrfs-progs
+, libselinux
+, libseccomp
 }:
 
 buildGoPackage rec {
@@ -7,9 +16,9 @@ buildGoPackage rec {
   version = "1.14.8";
 
   src = fetchFromGitHub {
-    owner  = "containers";
-    repo   = "buildah";
-    rev    = "v${version}";
+    owner = "containers";
+    repo = "buildah";
+    rev = "v${version}";
     sha256 = "187cvb3i5cwm7cwxmzpl2ca7900yb6v6b6cybyz5mnd5ccy5ff1q";
   };
 
@@ -18,7 +27,7 @@ buildGoPackage rec {
   goPackagePath = "github.com/containers/buildah";
   excludedPackages = [ "tests" ];
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ installShellFiles pkg-config ];
   buildInputs = [ gpgme libgpgerror lvm2 btrfs-progs libselinux libseccomp ];
 
   patches = [ ./disable-go-module-mode.patch ];
@@ -27,7 +36,7 @@ buildGoPackage rec {
     pushd go/src/${goPackagePath}
     make GIT_COMMIT="unknown"
     install -Dm755 buildah $bin/bin/buildah
-    install -Dm444 contrib/completions/bash/buildah $bin/share/bash-completion/completions/buildah
+    installShellCompletion --bash contrib/completions/bash/buildah
   '';
 
   postBuild = ''
diff --git a/pkgs/development/tools/misc/automake/automake-1.16.x.nix b/pkgs/development/tools/misc/automake/automake-1.16.x.nix
index 4b62257319340..d6353fc0b9cfd 100644
--- a/pkgs/development/tools/misc/automake/automake-1.16.x.nix
+++ b/pkgs/development/tools/misc/automake/automake-1.16.x.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, perl, autoconf }:
 
 stdenv.mkDerivation rec {
-  name = "automake-1.16.1";
+  name = "automake-1.16.2";
 
   src = fetchurl {
     url = "mirror://gnu/automake/${name}.tar.xz";
-    sha256 = "08g979ficj18i1w6w5219bgmns7czr03iadf20mk3lrzl8wbn1ax";
+    sha256 = "1l7dkqbsmbf94ax29jj1jf6a0r6ikc8jybg1p5m0c3ki7pg5ki6c";
   };
 
   nativeBuildInputs = [ autoconf perl ];
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
   dontPatchShebangs = true;
 
   meta = {
-    branch = "1.15";
+    branch = "1.16";
     homepage = "https://www.gnu.org/software/automake/";
     description = "GNU standard-compliant makefile generator";
     license = stdenv.lib.licenses.gpl2Plus;
diff --git a/pkgs/development/tools/misc/help2man/default.nix b/pkgs/development/tools/misc/help2man/default.nix
index 6231f0ccbe5f6..47af57dfb3d63 100644
--- a/pkgs/development/tools/misc/help2man/default.nix
+++ b/pkgs/development/tools/misc/help2man/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, perlPackages, gettext }:
 
 stdenv.mkDerivation rec {
-  name = "help2man-1.47.12";
+  name = "help2man-1.47.13";
 
   src = fetchurl {
     url = "mirror://gnu/help2man/${name}.tar.xz";
-    sha256 = "0q5ixbxz1v7wqnpg4bq7k7nbv9ssnmcvdbqsq5ycjvniz56ac2vx";
+    sha256 = "08q5arxz4j4pyx5q4712c2rn7p7dw7as9xg38yvmsh1c3ynvpy5p";
   };
 
   nativeBuildInputs = [ gettext perlPackages.LocaleGettext ];
diff --git a/pkgs/development/tools/misc/itstool/default.nix b/pkgs/development/tools/misc/itstool/default.nix
index daa06acb28990..d46256f039aa4 100644
--- a/pkgs/development/tools/misc/itstool/default.nix
+++ b/pkgs/development/tools/misc/itstool/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, python3 }:
+{ stdenv, lib, fetchurl, python3 }:
 
 stdenv.mkDerivation rec {
   name = "itstool-2.0.6";
@@ -8,7 +8,13 @@ stdenv.mkDerivation rec {
     sha256 = "1acjgf8zlyk7qckdk19iqaca4jcmywd7vxjbcs1mm6kaf8icqcv2";
   };
 
-  buildInputs = [ (python3.withPackages(ps: with ps; [ libxml2 ])) ];
+  pythonPath = [ python3.pkgs.libxml2 ];
+  buildInputs = [ python3 python3.pkgs.libxml2 ];
+  nativeBuildInputs = [ python3.pkgs.wrapPython ];
+
+  postFixup = ''
+    wrapPythonPrograms
+  '';
 
   meta = {
     homepage = "http://itstool.org/";
diff --git a/pkgs/development/tools/ocaml/dune/2.nix b/pkgs/development/tools/ocaml/dune/2.nix
index 510dd183f00d6..37f277686702c 100644
--- a/pkgs/development/tools/ocaml/dune/2.nix
+++ b/pkgs/development/tools/ocaml/dune/2.nix
@@ -6,11 +6,11 @@ else
 
 stdenv.mkDerivation rec {
   pname = "dune";
-  version = "2.5.0";
+  version = "2.5.1";
 
   src = fetchurl {
     url = "https://github.com/ocaml/dune/releases/download/${version}/dune-${version}.tbz";
-    sha256 = "1nnpg0fvmp4vf5mk203xk83pkkm953pgip3yhs1x2g8pkcdndhcw";
+    sha256 = "0az5ih18wadsp3ljagvws1i7vf0vpg24h75ariy0v3i0gyld6xwg";
   };
 
   buildInputs = [ ocaml findlib ];
diff --git a/pkgs/development/tools/parsing/bison/default.nix b/pkgs/development/tools/parsing/bison/default.nix
index d638170856e8d..0fbf6a49b2f53 100644
--- a/pkgs/development/tools/parsing/bison/default.nix
+++ b/pkgs/development/tools/parsing/bison/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bison";
-  version = "3.5.1";
+  version = "3.5.2";
 
   src = fetchurl {
     url = "mirror://gnu/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "09bg544pavpsivwh175ghgm7y3mkvdxfbwq41lfbwlb7v4i27vsc";
+    sha256 = "1ylls1ba8y62q78vnzawy4ajpjkk5580crgi8krvfk8g13fvdnxl";
   };
 
   nativeBuildInputs = [ m4 perl ] ++ stdenv.lib.optional stdenv.isSunOS help2man;
diff --git a/pkgs/development/tools/profiling/sysprof/default.nix b/pkgs/development/tools/profiling/sysprof/default.nix
index e2a769c30b101..fc4e51801df5a 100644
--- a/pkgs/development/tools/profiling/sysprof/default.nix
+++ b/pkgs/development/tools/profiling/sysprof/default.nix
@@ -63,7 +63,7 @@ stdenv.mkDerivation rec {
       be restarted.
     '';
     license = licenses.gpl2Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/development/tools/skopeo/default.nix b/pkgs/development/tools/skopeo/default.nix
index 4425640828cc9..7d4e4e0c69ede 100644
--- a/pkgs/development/tools/skopeo/default.nix
+++ b/pkgs/development/tools/skopeo/default.nix
@@ -1,5 +1,4 @@
 { stdenv
-, lib
 , buildGoPackage
 , fetchFromGitHub
 , runCommand
@@ -10,10 +9,9 @@
 , pkg-config
 , libselinux
 , go-md2man
+, installShellFiles
 }:
 
-with stdenv.lib;
-
 let
   version = "0.2.0";
 
@@ -28,6 +26,8 @@ let
 
   goPackagePath = "github.com/containers/skopeo";
 
+  vendorPath = "${goPackagePath}/vendor/github.com/containers/image/v5";
+
 in
 buildGoPackage {
   pname = "skopeo";
@@ -36,26 +36,23 @@ buildGoPackage {
 
   outputs = [ "bin" "man" "out" ];
 
-  excludedPackages = "integration";
+  excludedPackages = [ "integration" ];
 
-  nativeBuildInputs = [ pkg-config (lib.getBin go-md2man) ];
-  buildInputs = [ gpgme ] ++ lib.optionals stdenv.isLinux [ libgpgerror lvm2 btrfs-progs libselinux ];
+  nativeBuildInputs = [ pkg-config go-md2man installShellFiles ];
+  buildInputs = [ gpgme ]
+  ++ stdenv.lib.optionals stdenv.isLinux [ libgpgerror lvm2 btrfs-progs libselinux ];
 
   buildFlagsArray = ''
     -ldflags=
-    -X github.com/containers/skopeo/vendor/github.com/containers/image/v5/signature.systemDefaultPolicyPath=${defaultPolicyFile}
-    -X github.com/containers/skopeo/vendor/github.com/containers/image/v5/internal/tmpdir.unixTempDirForBigFiles=/tmp
-  '';
-
-  preBuild = ''
-    export CGO_CFLAGS="$CFLAGS"
-    export CGO_LDFLAGS="$LDFLAGS"
+    -X ${vendorPath}/signature.systemDefaultPolicyPath=${defaultPolicyFile}
+    -X ${vendorPath}/internal/tmpdir.unixTempDirForBigFiles=/tmp
   '';
 
   postBuild = ''
     # depends on buildGoPackage not changing …
     pushd ./go/src/${goPackagePath}
     make install-docs MANINSTALLDIR="$man/share/man"
+    installShellCompletion --bash completions/bash/skopeo
     popd
   '';
 
diff --git a/pkgs/games/cataclysm-dda/default.nix b/pkgs/games/cataclysm-dda/default.nix
index ced19bffb31a0..ad1a9c409d572 100644
--- a/pkgs/games/cataclysm-dda/default.nix
+++ b/pkgs/games/cataclysm-dda/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, callPackage, lua, CoreFoundation
+{ stdenv, callPackage, CoreFoundation
 , tiles ? true, Cocoa
 , debug ? false
 }:
@@ -9,28 +9,16 @@ let
 in
 
 stdenv.mkDerivation (common // rec {
-  version = "0.D";
+  version = "0.E";
   name = "cataclysm-dda-${version}";
 
   src = fetchFromCleverRaven {
     rev = version;
-    sha256 = "00zzhx1mh1qjq668cga5nbrxp2qk6b82j5ak65skhgnlr6ii4ysc";
+    sha256 = "0pbi0fw37zimzdklfj58s1ql0wlqq7dy6idkcsib3hn910ajaxan";
   };
 
-  buildInputs = common.buildInputs ++ [ lua ];
-
   patches = [ ./patches/fix_locale_dir.patch ];
 
-  postPatch = common.postPatch + ''
-    substituteInPlace lua/autoexec.lua --replace "/usr/share" "$out/share"
-  '';
-
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isGNU "-Wno-error=deprecated-copy";
-
-  makeFlags = common.makeFlags ++ [
-    "LUA=1"
-  ];
-
   meta = with stdenv.lib.maintainers; common.meta // {
     maintainers = common.meta.maintainers ++ [ skeidel ];
   };
diff --git a/pkgs/games/cataclysm-dda/patches/fix_locale_dir.patch b/pkgs/games/cataclysm-dda/patches/fix_locale_dir.patch
index 60a3dc457453a..5bfff892d2af0 100644
--- a/pkgs/games/cataclysm-dda/patches/fix_locale_dir.patch
+++ b/pkgs/games/cataclysm-dda/patches/fix_locale_dir.patch
@@ -1,15 +1,13 @@
-diff --git a/src/translations.cpp b/src/translations.cpp
-index 2585b7ec56..7bb005823c 100644
 --- a/src/translations.cpp
 +++ b/src/translations.cpp
-@@ -195,14 +195,12 @@ void set_language()
+@@ -212,14 +212,12 @@ void set_language()
      auto env = getenv( "LANGUAGE" );
-     locale_dir = std::string( FILENAMES["base_path"] + "lang/mo/" + ( env ? env : "none" ) +
+     locale_dir = std::string( PATH_INFO::base_path() + "lang/mo/" + ( env ? env : "none" ) +
                                "/LC_MESSAGES/cataclysm-dda.mo" );
--#elif (defined __linux__ || (defined MACOSX && !defined TILES))
+-#elif (defined(__linux__) || (defined(MACOSX) && !defined(TILES)))
 +#else
-     if( !FILENAMES["base_path"].empty() ) {
-         locale_dir = FILENAMES["base_path"] + "share/locale";
+     if( !PATH_INFO::base_path().empty() ) {
+         locale_dir = PATH_INFO::base_path() + "share/locale";
      } else {
          locale_dir = "lang/mo";
      }
diff --git a/pkgs/misc/cups/drivers/brlaser/default.nix b/pkgs/misc/cups/drivers/brlaser/default.nix
index 5e44c8dc49386..141e3f9e6123f 100644
--- a/pkgs/misc/cups/drivers/brlaser/default.nix
+++ b/pkgs/misc/cups/drivers/brlaser/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "brlaser";
-  version = "5";
+  version = "6";
 
   src = fetchFromGitHub {
     owner = "pdewacht";
     repo = "brlaser";
     rev = "v${version}";
-    sha256 = "133fx49wkg1v8r4kcishd035hlsscv8kc2q4jnln5qmyhpyygjyy";
+    sha256 = "1995s69ksq1fz0vb34v0ndiqncrinbrlpmp70rkl6az7kag99s80";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -34,13 +34,19 @@ stdenv.mkDerivation rec {
            Brother DCP-7065DN
            Brother DCP-7080
            Brother DCP-L2500D
+           Brother DCP-L2520D
            Brother DCP-L2540DW
-           Brother HL-1110 series
-           Brother HL-1200 series
-           Brother HL-L2300D series
-           Brother HL-L2320D series
-           Brother HL-L2340D series
-           Brother HL-L2360D series
+           Brother HL-1110
+           Brother HL-1200
+           Brother HL-2030
+           Brother HL-2140
+           Brother HL-2220
+           Brother HL-2270DW
+           Brother HL-5030
+           Brother HL-L2300D
+           Brother HL-L2320D
+           Brother HL-L2340D
+           Brother HL-L2360D
            Brother MFC-1910W
            Brother MFC-7240
            Brother MFC-7360N
diff --git a/pkgs/misc/emulators/wine/default.nix b/pkgs/misc/emulators/wine/default.nix
index 727eb2700671e..368e2845ca406 100644
--- a/pkgs/misc/emulators/wine/default.nix
+++ b/pkgs/misc/emulators/wine/default.nix
@@ -9,7 +9,6 @@
 { lib, stdenv, callPackage,
   wineRelease ? "stable",
   wineBuild ? if stdenv.hostPlatform.system == "x86_64-linux" then "wineWow" else "wine32",
-  libtxc_dxtn_Name ? "libtxc_dxtn_s2tc",
   pngSupport ? false,
   jpegSupport ? false,
   tiffSupport ? false,
@@ -63,7 +62,6 @@ let wine-build = build: release:
 
 in if wineRelease == "staging" then
   callPackage ./staging.nix {
-    inherit libtxc_dxtn_Name;
     wineUnstable = wine-build wineBuild "unstable";
   }
 else
diff --git a/pkgs/misc/emulators/wine/staging.nix b/pkgs/misc/emulators/wine/staging.nix
index df979c68a47fe..5c2469f8f44e0 100644
--- a/pkgs/misc/emulators/wine/staging.nix
+++ b/pkgs/misc/emulators/wine/staging.nix
@@ -1,4 +1,4 @@
-{ stdenv, callPackage, wineUnstable, libtxc_dxtn_Name }:
+{ stdenv, callPackage, wineUnstable }:
 
 with callPackage ./util.nix {};
 
@@ -8,7 +8,7 @@ let patch = (callPackage ./sources.nix {}).staging;
 in assert stdenv.lib.getVersion wineUnstable == patch.version;
 
 stdenv.lib.overrideDerivation wineUnstable (self: {
-  buildInputs = build-inputs [ "perl" "utillinux" "autoconf" libtxc_dxtn_Name ] self.buildInputs;
+  buildInputs = build-inputs [ "perl" "utillinux" "autoconf" ] self.buildInputs;
 
   name = "${self.name}-staging";
 
diff --git a/pkgs/os-specific/linux/alsa-lib/default.nix b/pkgs/os-specific/linux/alsa-lib/default.nix
index 9518946528444..335ae204833dd 100644
--- a/pkgs/os-specific/linux/alsa-lib/default.nix
+++ b/pkgs/os-specific/linux/alsa-lib/default.nix
@@ -1,25 +1,27 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchurl, alsa-ucm-conf, alsa-topology-conf }:
 
 stdenv.mkDerivation rec {
-  name = "alsa-lib-1.1.9";
+  name = "alsa-lib-1.2.2";
 
   src = fetchurl {
     url = "mirror://alsa/lib/${name}.tar.bz2";
-    sha256 = "0jwr9g4yxg9gj6xx0sb2r6wrdl8amrjd19hilkrq4rirynp770s8";
+    sha256 = "1v5kb8jyvrpkvvq7dq8hfbmcj68lml97i4s0prxpfx2mh3c57s6q";
   };
 
   patches = [
     ./alsa-plugin-conf-multilib.patch
   ];
 
+  enableParallelBuilding = true;
+
   # Fix pcm.h file in order to prevent some compilation bugs
-  # 2: see http://stackoverflow.com/questions/3103400/how-to-overcome-u-int8-t-vs-uint8-t-issue-efficiently
   postPatch = ''
     sed -i -e 's|//int snd_pcm_mixer_element(snd_pcm_t \*pcm, snd_mixer_t \*mixer, snd_mixer_elem_t \*\*elem);|/\*int snd_pcm_mixer_element(snd_pcm_t \*pcm, snd_mixer_t \*mixer, snd_mixer_elem_t \*\*elem);\*/|' include/pcm.h
+  '';
 
-
-    sed -i -e '1i#include <stdint.h>' include/pcm.h
-    sed -i -e 's/u_int\([0-9]*\)_t/uint\1_t/g' include/pcm.h
+  postInstall = ''
+    ln -s ${alsa-ucm-conf}/share/alsa/{ucm,ucm2} $out/share/alsa
+    ln -s ${alsa-topology-conf}/share/alsa/topology $out/share/alsa
   '';
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/os-specific/linux/alsa-tools/default.nix b/pkgs/os-specific/linux/alsa-tools/default.nix
index 151549aa67bd0..2fef5e07c63cd 100644
--- a/pkgs/os-specific/linux/alsa-tools/default.nix
+++ b/pkgs/os-specific/linux/alsa-tools/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "alsa-tools";
-  version = "1.1.7";
+  version = "1.2.2";
 
   src = fetchurl {
     url = "mirror://alsa/tools/${pname}-${version}.tar.bz2";
-    sha256 = "1xjfghr9s0j6n91kgs95cc4r6qrjsgc4yj2w0nir3xpnm0l36950";
+    sha256 = "0jbkjmq038zapj66a7nkppdf644v2mwj581xbmh6k4i8w6mcglxz";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/os-specific/linux/alsa-topology-conf/default.nix b/pkgs/os-specific/linux/alsa-topology-conf/default.nix
new file mode 100644
index 0000000000000..26febf0daa7a5
--- /dev/null
+++ b/pkgs/os-specific/linux/alsa-topology-conf/default.nix
@@ -0,0 +1,36 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  name = "alsa-topology-conf-${version}";
+  version = "1.2.2";
+
+  src = fetchurl {
+    url = "mirror://alsa/lib/${name}.tar.bz2";
+    sha256 = "09cls485ckdjsp4azhv3nw7chyg3r7zrqgald6yp70f7cysxcwml";
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/alsa
+    cp -r topology $out/share/alsa
+
+    runHook postInstall
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = http://www.alsa-project.org/;
+    description = "ALSA topology configuration files";
+
+    longDescription = ''
+      The Advanced Linux Sound Architecture (ALSA) provides audio and
+      MIDI functionality to the Linux-based operating system.
+    '';
+
+    license = licenses.bsd3;
+    maintainers = [ maintainers.roastiek ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/alsa-ucm-conf/default.nix b/pkgs/os-specific/linux/alsa-ucm-conf/default.nix
new file mode 100644
index 0000000000000..6f2766ef9ff2e
--- /dev/null
+++ b/pkgs/os-specific/linux/alsa-ucm-conf/default.nix
@@ -0,0 +1,36 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  name = "alsa-ucm-conf-${version}";
+  version = "1.2.2";
+
+  src = fetchurl {
+    url = "mirror://alsa/lib/${name}.tar.bz2";
+    sha256 = "0364fgzdm2qrsqvgqri25gzscbma7yqlv31wz8b1z9c5phlxkgvy";
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/alsa
+    cp -r ucm ucm2 $out/share/alsa
+
+    runHook postInstall
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = http://www.alsa-project.org/;
+    description = "ALSA Use Case Manager configuration";
+
+    longDescription = ''
+      The Advanced Linux Sound Architecture (ALSA) provides audio and
+      MIDI functionality to the Linux-based operating system.
+    '';
+
+    license = licenses.bsd3;
+    maintainers = [ maintainers.roastiek ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/bbswitch/default.nix b/pkgs/os-specific/linux/bbswitch/default.nix
index eea8d31f24db1..67cbc6e5c5e62 100644
--- a/pkgs/os-specific/linux/bbswitch/default.nix
+++ b/pkgs/os-specific/linux/bbswitch/default.nix
@@ -15,10 +15,16 @@ stdenv.mkDerivation {
     sha256 = "0xql1nv8dafnrcg54f3jsi3ny3cd2ca9iv73pxpgxd2gfczvvjkn";
   };
 
-  patches = [ (fetchpatch {
-    url = "https://github.com/Bumblebee-Project/bbswitch/pull/102.patch";
-    sha256 = "1lbr6pyyby4k9rn2ry5qc38kc738d0442jhhq57vmdjb6hxjya7m";
-  }) ];
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/Bumblebee-Project/bbswitch/pull/102.patch";
+      sha256 = "1lbr6pyyby4k9rn2ry5qc38kc738d0442jhhq57vmdjb6hxjya7m";
+    })
+    (fetchpatch {
+      url = "https://github.com/Bumblebee-Project/bbswitch/pull/196.patch";
+      sha256 = "02ihy3piws7783qbm9q0mb9s18ipn5ckdy1iar74xn31qjrsn99n";
+    })
+  ];
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
diff --git a/pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch b/pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch
index a13251476de3e..a727e5f4a85bf 100644
--- a/pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch
+++ b/pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch
@@ -1,5 +1,5 @@
 diff --git a/data/meson.build b/data/meson.build
-index 0667bd78..92d6c7b9 100644
+index bb749fd4..b611875b 100644
 --- a/data/meson.build
 +++ b/data/meson.build
 @@ -17,7 +17,7 @@ endif
@@ -12,41 +12,38 @@ index 0667bd78..92d6c7b9 100644
  endif
  
 diff --git a/data/pki/meson.build b/data/pki/meson.build
-index eefcc914..dc801fa1 100644
+index 94bb0b6f..1ea6a9ac 100644
 --- a/data/pki/meson.build
 +++ b/data/pki/meson.build
-@@ -4,14 +4,14 @@ if get_option('gpg')
-       'GPG-KEY-Linux-Foundation-Firmware',
-       'GPG-KEY-Linux-Vendor-Firmware-Service',
-     ],
--    install_dir : join_paths(sysconfdir, 'pki', 'fwupd')
-+    install_dir : join_paths(sysconfdir_install, 'pki', 'fwupd')
-   )
- 
-   install_data([
-       'GPG-KEY-Linux-Foundation-Metadata',
-       'GPG-KEY-Linux-Vendor-Firmware-Service',
-     ],
--    install_dir : join_paths(sysconfdir, 'pki', 'fwupd-metadata')
-+    install_dir : join_paths(sysconfdir_install, 'pki', 'fwupd-metadata')
-   )
- endif
+@@ -3,24 +3,23 @@ install_data([
+     'GPG-KEY-Linux-Foundation-Firmware',
+     'GPG-KEY-Linux-Vendor-Firmware-Service',
+   ],
+-  install_dir : join_paths(sysconfdir, 'pki', 'fwupd')
++  install_dir : join_paths(sysconfdir_install, 'pki', 'fwupd')
+ )
  
-@@ -19,12 +19,12 @@ if get_option('pkcs7')
-   install_data([
-       'LVFS-CA.pem',
-     ],
--    install_dir : join_paths(sysconfdir, 'pki', 'fwupd')
-+    install_dir : join_paths(sysconfdir_install, 'pki', 'fwupd')
-   )
-   install_data([
-       'LVFS-CA.pem',
-     ],
--    install_dir : join_paths(sysconfdir, 'pki', 'fwupd-metadata')
-+    install_dir : join_paths(sysconfdir_install, 'pki', 'fwupd-metadata')
-   )
- endif
+ install_data([
+     'GPG-KEY-Linux-Foundation-Metadata',
+     'GPG-KEY-Linux-Vendor-Firmware-Service',
+   ],
+-  install_dir : join_paths(sysconfdir, 'pki', 'fwupd-metadata')
++  install_dir : join_paths(sysconfdir_install, 'pki', 'fwupd-metadata')
+ )
  
+ install_data([
+     'LVFS-CA.pem',
+   ],
+-  install_dir : join_paths(sysconfdir, 'pki', 'fwupd')
++  install_dir : join_paths(sysconfdir_install, 'pki', 'fwupd')
+ )
+ install_data([
+     'LVFS-CA.pem',
+   ],
+-  install_dir : join_paths(sysconfdir, 'pki', 'fwupd-metadata')
++  install_dir : join_paths(sysconfdir_install, 'pki', 'fwupd-metadata')
+ )
+-
 diff --git a/data/remotes.d/meson.build b/data/remotes.d/meson.build
 index 826a3c1d..b78db663 100644
 --- a/data/remotes.d/meson.build
@@ -76,10 +73,10 @@ index 826a3c1d..b78db663 100644
 +  install_dir: join_paths(sysconfdir_install, 'fwupd', 'remotes.d'),
  )
 diff --git a/meson.build b/meson.build
-index b1a523d2..aacb8e0a 100644
+index 87ea67e5..3a4374db 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -169,6 +169,12 @@ endif
+@@ -175,6 +175,12 @@ endif
  mandir = join_paths(prefix, get_option('mandir'))
  localedir = join_paths(prefix, get_option('localedir'))
  
@@ -93,10 +90,10 @@ index b1a523d2..aacb8e0a 100644
  gio = dependency('gio-2.0', version : '>= 2.45.8')
  giounix = dependency('gio-unix-2.0', version : '>= 2.45.8', required: false)
 diff --git a/meson_options.txt b/meson_options.txt
-index be0adfef..73983333 100644
+index 3da9b6c4..6c80275b 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
-@@ -26,6 +26,7 @@ option('plugin_coreboot', type : 'boolean', value : true, description : 'enable
+@@ -24,6 +24,7 @@ option('plugin_coreboot', type : 'boolean', value : true, description : 'enable
  option('systemd', type : 'boolean', value : true, description : 'enable systemd support')
  option('systemdunitdir', type: 'string', value: '', description: 'Directory for systemd units')
  option('elogind', type : 'boolean', value : false, description : 'enable elogind support')
@@ -104,6 +101,19 @@ index be0adfef..73983333 100644
  option('tests', type : 'boolean', value : true, description : 'enable tests')
  option('udevdir', type: 'string', value: '', description: 'Directory for udev rules')
  option('efi-cc', type : 'string', value : 'gcc', description : 'the compiler to use for EFI modules')
+diff --git a/plugins/ata/meson.build b/plugins/ata/meson.build
+index 8444bb8a..fa4a8ad1 100644
+--- a/plugins/ata/meson.build
++++ b/plugins/ata/meson.build
+@@ -7,7 +7,7 @@ install_data([
+ )
+ 
+ install_data(['ata.conf'],
+-  install_dir:  join_paths(sysconfdir, 'fwupd')
++  install_dir:  join_paths(sysconfdir_install, 'fwupd')
+ )
+ 
+ shared_module('fu_plugin_ata',
 diff --git a/plugins/dell-esrt/meson.build b/plugins/dell-esrt/meson.build
 index ed4eee70..76dbdb1d 100644
 --- a/plugins/dell-esrt/meson.build
@@ -142,10 +152,10 @@ index 06ab34ee..297a9182 100644
  # we use functions from 2.52 in the tests
  if get_option('tests') and umockdev.found() and gio.version().version_compare('>= 2.52')
 diff --git a/plugins/uefi/meson.build b/plugins/uefi/meson.build
-index 7252580d..7188d1c5 100644
+index 5838cecc..9ba3d5cd 100644
 --- a/plugins/uefi/meson.build
 +++ b/plugins/uefi/meson.build
-@@ -104,7 +104,7 @@ if get_option('man')
+@@ -101,7 +101,7 @@ if get_option('man')
  endif
  
  install_data(['uefi.conf'],
diff --git a/pkgs/os-specific/linux/firmware/fwupd/default.nix b/pkgs/os-specific/linux/firmware/fwupd/default.nix
index 86a2bfbcc9e8f..13f4f71c3c14b 100644
--- a/pkgs/os-specific/linux/firmware/fwupd/default.nix
+++ b/pkgs/os-specific/linux/firmware/fwupd/default.nix
@@ -2,6 +2,7 @@
 
 { stdenv
 , fetchurl
+, fetchpatch
 , substituteAll
 , gtk-doc
 , pkgconfig
@@ -16,7 +17,7 @@
 , glib-networking
 , libsoup
 , help2man
-, gpgme
+, libjcat
 , libxslt
 , elfutils
 , libsmbios
@@ -31,7 +32,6 @@
 , docbook_xsl
 , ninja
 , gcab
-, gnutls
 , python3
 , wrapGAppsHook
 , json-glib
@@ -87,11 +87,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "fwupd";
-  version = "1.3.9";
+  version = "1.4.0";
 
   src = fetchurl {
     url = "https://people.freedesktop.org/~hughsient/releases/fwupd-${version}.tar.xz";
-    sha256 = "ZuRG+UN8ebXv5Z8fOYWT0eCtHykGXoB8Ysu3wAeqx0A=";
+    sha256 = "V131/l05FKYFavRMXRaiW1bQkTCEn7MTyyD+bqYClU4=";
   };
 
   # libfwupd goes to lib
@@ -130,9 +130,8 @@ stdenv.mkDerivation rec {
     libyaml
     libgudev
     colord
-    gpgme
+    libjcat
     libuuid
-    gnutls
     glib-networking
     json-glib
     umockdev
@@ -151,15 +150,43 @@ stdenv.mkDerivation rec {
     ./fix-paths.patch
     ./add-option-for-installation-sysconfdir.patch
 
-    # install plug-ins and libfwupdplugin to out,
-    # they are not really part of the library
+    # Install plug-ins and libfwupdplugin to out,
+    # they are not really part of the library.
     ./install-fwupdplugin-to-out.patch
 
-    # installed tests are installed to different output
-    # we also cannot have fwupd-tests.conf in $out/etc since it would form a cycle
+    # Make it easier to patch installed-tests directory.
+    # https://github.com/fwupd/fwupd/pull/2002
+    (fetchpatch {
+      url = "https://github.com/fwupd/fwupd/commit/2f12e38e61d982dea63778736e2b71d16f0e9925.patch";
+      sha256 = "goTyDj0v50FOQYCS+LhPjo0AEugubr6aBIGfO9ztZOA=";
+    })
+
+    # Install systemd files to our prefix.
+    # https://github.com/fwupd/fwupd/pull/2006
+    (fetchpatch {
+      url = "https://github.com/fwupd/fwupd/commit/463db5162fe4f6fea417973ff95a44ed51ec6402.patch";
+      sha256 = "I0TIfnCca83QpINABUINtl8nIB78dG8OR9MC/hP2hg8=";
+    })
+
+    # Fix installed tests.
+    # https://github.com/fwupd/fwupd/issues/2007
+    (fetchpatch {
+      url = "https://github.com/fwupd/fwupd/commit/c727742df3702fc934e2d9488c883dcbdfa59e9c.patch";
+      sha256 = "b9D2Xblf1VbpS5XZpHtwEJhzuq7+840l7skW5w0NMBU=";
+    })
+
+    # Fix build with bash-completion 2.10
+    # https://github.com/fwupd/fwupd/pull/2014
+    (fetchpatch {
+      url = "https://github.com/fwupd/fwupd/commit/0f035013dfb150c2c3fc7f51090103ba84bd1c06.patch";
+      sha256 = "VXRf5N3inaWThudk6pc4mtp6cMEIyybkdfqKin+9XSw=";
+    })
+
+    # Installed tests are installed to different output
+    # we also cannot have fwupd-tests.conf in $out/etc since it would form a cycle.
     (substituteAll {
       src = ./installed-tests-path.patch;
-      # needs a different set of modules than po/make-images
+      # Needs a different set of modules than po/make-images.
       inherit installedTestsPython;
     })
   ];
@@ -172,14 +199,6 @@ stdenv.mkDerivation rec {
       po/make-images \
       po/make-images.sh \
       po/test-deps
-
-    # we cannot use placeholder in substituteAll
-    # https://github.com/NixOS/nix/issues/1846
-    substituteInPlace data/installed-tests/meson.build --subst-var installedTests
-
-    substituteInPlace data/meson.build --replace \
-      "install_dir: systemd.get_pkgconfig_variable('systemdshutdowndir')" \
-      "install_dir: '${placeholder "out"}/lib/systemd/system-shutdown'"
   '';
 
   # /etc/os-release not available in sandbox
@@ -203,7 +222,8 @@ stdenv.mkDerivation rec {
     "-Dgtkdoc=true"
     "-Dplugin_dummy=true"
     "-Dudevdir=lib/udev"
-    "-Dsystemdunitdir=lib/systemd/system"
+    "-Dsystemd_root_prefix=${placeholder "out"}"
+    "-Dinstalled_test_prefix=${placeholder "installedTests"}"
     "-Defi-libdir=${gnu-efi}/lib"
     "-Defi-ldsdir=${gnu-efi}/lib"
     "-Defi-includedir=${gnu-efi}/include/efi"
@@ -225,23 +245,19 @@ stdenv.mkDerivation rec {
     "-Dplugin_flashrom=true"
   ];
 
-  postInstall = ''
-    moveToOutput share/installed-tests "$installedTests"
-    wrapProgram $installedTests/share/installed-tests/fwupd/hardware.py \
-      --prefix GI_TYPELIB_PATH : "$out/lib/girepository-1.0:${libsoup}/lib/girepository-1.0"
-  '';
-
   FONTCONFIG_FILE = fontsConf; # Fontconfig error: Cannot load default config file
 
   # error: “PolicyKit files are missing”
   # https://github.com/NixOS/nixpkgs/pull/67625#issuecomment-525788428
   PKG_CONFIG_POLKIT_GOBJECT_1_ACTIONDIR = "/run/current-system/sw/share/polkit-1/actions";
 
-  # cannot install to systemd prefix
-  PKG_CONFIG_SYSTEMD_SYSTEMDSYSTEMPRESETDIR = "${placeholder "out"}/lib/systemd/system-preset";
-
   # TODO: wrapGAppsHook wraps efi capsule even though it is not elf
   dontWrapGApps = true;
+
+  preCheck = ''
+    addToSearchPath XDG_DATA_DIRS "${shared-mime-info}/share"
+  '';
+
   # so we need to wrap the executables manually
   postFixup = ''
     find -L "$out/bin" "$out/libexec" -type f -executable -print0 \
@@ -256,6 +272,7 @@ stdenv.mkDerivation rec {
   # /etc/fwupd/uefi.conf is created by the services.hardware.fwupd NixOS module
   passthru = {
     filesInstalledToEtc = [
+      "fwupd/ata.conf"
       # "fwupd/daemon.conf" # already created by the module
       "fwupd/redfish.conf"
       "fwupd/remotes.d/dell-esrt.conf"
diff --git a/pkgs/os-specific/linux/firmware/fwupd/installed-tests-path.patch b/pkgs/os-specific/linux/firmware/fwupd/installed-tests-path.patch
index 6c4b6b62a0cd8..432056cbe7fe6 100644
--- a/pkgs/os-specific/linux/firmware/fwupd/installed-tests-path.patch
+++ b/pkgs/os-specific/linux/firmware/fwupd/installed-tests-path.patch
@@ -1,5 +1,5 @@
---- a/data/installed-tests/hardware.py
-+++ b/data/installed-tests/hardware.py
+--- a/data/device-tests/hardware.py
++++ b/data/device-tests/hardware.py
 @@ -1,4 +1,4 @@
 -#!/usr/bin/python3
 +#!@installedTestsPython@/bin/python3
@@ -8,18 +8,23 @@
  # Copyright (C) 2017 Richard Hughes <richard@hughsie.com>
 --- a/data/installed-tests/meson.build
 +++ b/data/installed-tests/meson.build
-@@ -1,6 +1,6 @@
- con2 = configuration_data()
- con2.set('installedtestsdir',
--         join_paths(datadir, 'installed-tests', 'fwupd'))
-+         join_paths('@installedTests@', 'share', 'installed-tests', 'fwupd'))
- con2.set('bindir', bindir)
+@@ -1,4 +1,4 @@
+-installed_test_datadir = join_paths(datadir, 'installed-tests', 'fwupd')
++installed_test_datadir = join_paths(get_option('installed_test_prefix'), 'share', 'installed-tests', 'fwupd')
  
- configure_file(
-@@ -52,5 +52,5 @@
+ con2 = configuration_data()
+ con2.set('installedtestsdir', installed_test_datadir)
+@@ -52,5 +52,5 @@ configure_file(
    output : 'fwupd-tests.conf',
    configuration : con2,
    install: true,
 -  install_dir: join_paths(sysconfdir, 'fwupd', 'remotes.d'),
-+  install_dir: join_paths('@installedTests@', 'etc', 'fwupd', 'remotes.d'),
++  install_dir: join_paths(get_option('installed_test_prefix'), 'etc', 'fwupd', 'remotes.d'),
  )
+--- a/meson_options.txt
++++ b/meson_options.txt
+@@ -1,3 +1,4 @@
++option('installed_test_prefix', type: 'string', value: '', description: 'Prefix for installed tests')
+ option('build', type : 'combo', choices : ['all', 'standalone', 'library'], value : 'all', description : 'build type')
+ option('agent', type : 'boolean', value : true, description : 'enable the fwupd agent')
+ option('consolekit', type : 'boolean', value : true, description : 'enable ConsoleKit support')
diff --git a/pkgs/os-specific/linux/gogoclient/default.nix b/pkgs/os-specific/linux/gogoclient/default.nix
index a4584304f586a..d107f18c8da25 100644
--- a/pkgs/os-specific/linux/gogoclient/default.nix
+++ b/pkgs/os-specific/linux/gogoclient/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
   name = "${baseName}-${version}";
 
   src = fetchurl {
-    #url = http://gogo6.com/downloads/gogoc-1_2-RELEASE.tar.gz;
+    #url = "http://gogo6.com/downloads/gogoc-1_2-RELEASE.tar.gz";
     url = "https://src.fedoraproject.org/repo/pkgs/gogoc/gogoc-1_2-RELEASE.tar.gz/41177ed683cf511cc206c7782c37baa9/gogoc-1_2-RELEASE.tar.gz";
     sha256 = "a0ef45c0bd1fc9964dc8ac059b7d78c12674bf67ef641740554e166fa99a2f49";
   };
diff --git a/pkgs/os-specific/linux/kernel/anthraxx.asc b/pkgs/os-specific/linux/kernel/anthraxx.asc
new file mode 100644
index 0000000000000..101ccfbf0f2b3
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/anthraxx.asc
@@ -0,0 +1,325 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v2
+
+mQINBE64OEUBEADPS1v+zoCdKA6zyfUtVIaBoIwMhCibqurXi30tVoC9LgM6W1ve
+HwPFukWq7DAS0mZUPE3mSV63JFLaTy0bY/6GO1D4wLdWZx4ppH7XKNCvKCbsi70k
+UozFykNVf+83WEskuF1oYzXlF3aB5suz2IWJl7ey1EXgIpehwQaTJUA5JIWYFp9A
+566LRNJefYMzUR33xc4dRKj6Etg0xdLVq7/vZoo8HpLCBGNWiP0AKqFWEwTg0xQL
+7nsJA5tfJJdwAJvrzjpFsvb63PKG6waAtdHhON4q7E2Udak9fz2tRjxA5l9l2zXk
+aqsysUzkxPhNjwMENoQ04KZg4aT+ZhhBzTowSWLp3KV2uaZ66kdPUO3s+/1bPp5/
+N/IlykaUwyL773iYOZ5dOY/9hIuX/zssihcrGEMW6yIyZR5uKhzYdaM9ExTXP637
+UccgNS9/pskPGPx/xK23NDCfeHzL9YHS5KokA2wb/b9hqpwvLaeblbMl2pt79F1R
+ac+rZlrRyX3NvlTQP4hqM9Ei2YBAU7QFDJEjH8pVIceL7grxi1Ju1iD5QiSK+je5
+Jj5EAikfwSeAttSzsqNvaXJHfABrv5mkkVt1z3icP3HIHTYnG+uj+t8kvW+o9/1i
+pD6e6LUh4w5v1aY9kaK/M3+eBH59yNYI99crPUKUBVfW4gv4DBUJAQTWRQARAQAB
+tDVMZXZlbnRlIFBvbHlhayAoYW50aHJheHgpIDxsZXZlbnRlQGxldmVudGVwb2x5
+YWsubmV0PokCQQQTAQIAKwIbAwYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4ACGQEF
+AlSXU9QFCQfATw8ACgkQ/BtUfI2BcsjPbxAAs+UR/bJz/HeYTpPy+HnKwDJgI9GP
+AZlNvp+QSIhOTtKCYkQ/Iu+5scY5J0Qyv0pcJW5Rxjx+l7KGovw84jzVznnYsJoy
+UQ5H3Ev9T2xW1nrZT3abJ7j6ZIck+Q+WFHu5Plsq6doSXOXmJNoehvT3BVolvc6w
+S1+CAoyA5Wm1yfocZgVOvWPWQaa1T4XA7OwxFWrvNWEZwAzTSjkGHkwmji+DxdBd
+RPam9+qm/rcN1IJTu6xJPr38a9LydWonsUpTR2Qn7Bo4EJp8yHJLaiLEMV/Nmgrr
+1orBYw/OzDzhbdMl+2zzwEBLUMPABdgnPM6ZCZ5PWyWnCU4jsBGyVd0IC5xEu3Eg
+a0EtIdvx2lXiLfh2dulpMn52uJY5iNwaTleO+z9CENQVhh5R4FuN9H0BLiyAxf1+
+MkD3jLT+DGl02hQghtxz18iTkRk7KOw/NFn4z0is+TRl4/ocNt1LiWQXt8dr7qdx
+zvUpDnxCSYZkeutzopo1TA4lKpnsS2mHabx6CbrUmF+wOIr8gHUfpBFeEQ8BHebU
+5X0JrFF5mjeNl4uK9l9lD9ng74rsSpKPr15DU41jIuQDHJYd6H3TXQ4K1z7Ciivy
+r4vgsruAFX/GduKseOx1obWW3GfIQzLAIuVdjldgREl61GWoLiGFqlcveiAIkN5p
+Bxc20hSrHgZP9ZyIRgQQEQIABgUCTrg/KAAKCRC+dA9BPyK7GTK7AKC8Sd1ndNvc
+1ispBaECbHT/JPfGrQCgvkfGBsFn/KBrgC5hTm0mSxdy942JAkEEEwECACsCGwMF
+CQIchwAGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheABQJOuD2qAhkBAAoJEPwbVHyN
+gXLIXL4QAJtbs62EpOIFld0N+tTEFn1qQPPaExAXmH/RF5Epf+0rSS6B0OXEZBXz
+cWtMPbHxoLjN1iY8o0QC1ex7/KDfYq8Ho18M9P+Lf6XfW0sJ9d021U5MJWGPs4zA
+lNFXJqeMgfJZAno2N6dO/azcYHq1wmSgUbTb9Oyi1PHfn3g0UAW59dfkB8d2jEvY
+Yed1X0mBPPXcbgnYNZ514JQtm9wuDdVWrh/Si9EhKg6+MPcbv18G4lpPGR+yNq9y
+3Jze4vmmWen0ceDJEp06IAeTfJzzD80Oui2WXtLfaQxgf9uuZtGjrMX5l+mq7rBS
+VH/dsHP1VYI0efKIs7qbmiLcMRVWYIGix9I1C3UYr3ImYiCGlBG/uQ929xbjWAHa
+hy4W6rzruUWjyi/Kz7QRnyBgtHfhDO7hYziTr5hoGhd4VeUpcbxL+MegXFZsWJlE
+kz8TOOsZ/4XxXHVoalg8fYOcA7j/aoszsPMQUOL/5jsVRhyP3evtVxb3m1EwvYDK
+Lii4IkVxGztlBOIgeT4kwXgoJEASSZHgcd6tDv9q7o33n2I1DGL8X3axcHES2/C7
+cP+li3KL3Hc9vjgaJ9HfcQLuMcHqfoHn+YzVfbG5XeFcxhgQpwpYsZv3MTbXAQwI
+fRHXRuIfOiFwqUXahi5N1WSIXNBGSyI7pu9ht5I7gIIOINE+VS7FiQJBBBMBAgAr
+AhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAIZAQUCUNol8QUJA/yTqwAKCRD8
+G1R8jYFyyIqUD/9yWw7WBQiWyIMpVuX9c2Ov1fAkDya43fDm0gqIgNsdaxCt5ATh
+XaXZ/p2jglWwon5jDLDNsVR0/Q/t8ugdcP3bcwRtW2YYQ2F1PaNjfr5WsuPEadyc
+J62DIobY4IzqBpDuqGLYdbzZeKr49VwbRRvIJpphrk3+CekFvdIs1ofEpA2Kn2oA
+DXfYuaWoVBF7fTwAZmc3hYPOI1jK7nrFZbCnAT4WZPzZ4IY9lsaNTF/4mQ8vV1xF
+De6HjfslHURlZWsWtQIKhIPBKoZC1nP5VRK3IHYgKw8toq780kalLH8ofv9BkSrs
+t98JOoJX4etdmE8Ta/+Wg5C9EzR+909tQfdWdkaRbhvbtl/x7X76HU4ItefLR5pW
+d0OSo488QZMQjCUWlzgPMsmnYMQm6ckNOp0B/RtMfbJV7t5H+JE3PLfFG55jcz3w
+uNGhfZyl/ZhV9fvGLU/sPyhIW7ewuIwd+7i12fH9r4NAGB/mkSKK+tHGcTZvXxux
+5QMKE+a9u6NMJRrbsIiTFwhrCLMgzLYL0mtX8FZXNFFZzGFYkiXymBR0ze4LKzRo
+dMFpyP/w/IIjYBhVpgboT2EMMIgJHSsMJDCdDjI+9cAykVF6ccSiUQ11devHL6Pv
+WwlT2Ub4TP4yCScHDPyfWq+tfdQlWFVRZMRJ7kmq0VagqomdRHgLPyPgDYkCHAQQ
+AQIABgUCUtgrXgAKCRBH1QFsQv98LACcEACFq3Oz8nHAa6KsyspIWo0+HjzCtTv0
+G6TB+svf3fl24C93IfFhpSyxNf8XVa9h9kCU5ZImYN+LaoUGiz3lcYxjdOeFYDc4
+GU5TFrJwY9eOYYCsr+z+NLn7wlLZEO772lGUDPJMWxSGqR9yOGhQCTIADLLcp6mt
+07zdejESYxMT6IjYR+rX6miWG5Hr9/lBdh/X4XhGpHEY64IL8vVB3C+FQfG3hiMB
+bHbvJ4/S/cjfNM1T9oKiA0H6jklRHIdstj+2eeWA7lS+GE3Mpkra+8KmkEjV4O03
+izcRpMm1yTGoTjp9UddTNYErb/sha5YigYAqK8bj3gh6tTFNJHbN4RWgtPDyc5Va
+1u+sH2ob6JS5tez8/Z6pMarGpTQujIGAlntP4igi0Q4hxyLof6Vtc6XF80uSwTvN
+RRmQrcq+kLPwX0NbyZCBCI+kjBPu2b932JDTfVBKwJCLF3e1zvQqN0C7EZnIzveX
+r7VtJ4WHIfSyi/HQP7xm5L0uQj+KRr+/LMaxkCDgrlqoWTgAoxCAPYH1XCvBoJRc
+DHjNikyEAS8WUGl9ZHQyAoFngi/jqH6WoDAmfBUKRoBMR2hXLOKUBmObw0DHgauM
+kk4kD6CW4UEy0SM/i9JD7sk9KiKoHMip1jguKRJkHJ1WSkNl7nZpeo+KG0WbGHXN
+b7hnrQsNyqJkUokCQQQTAQIAKwIbAwYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AC
+GQEFAlLV0QIFCQXdHmsACgkQ/BtUfI2Bcsj8DA//b8wZrFY/Fj/iR5ZaO0AjmMV1
+hM7lAFWLfDiLyYofuiGLUg9rqFWj+Ks2kedVN7+22Bjgi5fvpXv3Uy4trZKKw8Xs
+FJ/s8HQ6jzIv6pFdIYPLFQBqS2tEgfsanPZWIqJI9fbhOrRGN7WV5tXiksCaRO+u
+rLjIhAYmsDb//BD2xqsY54ouRdrz5nRG3qG2odq2Lw8XquW6srouGaSm+BI3sow6
+l2eAW8UjbxwICQg2ZPZYCBc9ArbgLS1ha+yPhp65nGpVbqDA8rUKC11op1ArAbY3
+Yt6xzLg+RCuCHBa1gNPpDoYV9V8Zve03mEIcsK10X0RhJQ+z4INvrjtelPRCOLpN
+179JmsyxwOzwAPg773SK1Z31jSirsiEke/q8j13PGNDBCb4ZKpm/KOht+4d0jJLK
+GLqD85cv3/uAeSh2zWkoKcVW6uVZpiz3KA3i4YMWnteOlrlZH28nIrDXevPzkOxo
+pZlhuLboCD6g6yuZI4Wm9fEiga8xmRDw4RrOIuDXWjNW6IVaeFGvnYaNf0wnmBD+
+FE1SMWwcmqgB1yIylmKqH0lYce8SVAMLkkOlaijhWrfCO5iS7zjWaVz98HCqFfwR
+gHuJTxOwwlf9Qb6cyC3bGsfILBUuE0L5vUAZUAc61H+6Sv88CDDUO1EOKaqAAYhR
+plvoyYZ3xiSMgzYKGZ+0OkxldmVudGUgUG9seWFrIChKYWJiZXIvWE1QUCBvbmx5
+KSA8YW50aHJheHhAamFiYmVyLmNjYy5kZT6JAj4EEwECACgCGwMGCwkIBwMCBhUI
+AgkKCwQWAgMBAh4BAheABQJUl1PaBQkHwE8PAAoJEPwbVHyNgXLIQokQAKxJB9/F
+TfBae6eqcT+izxGSnsvbc2bcrtsmKkhu9HwpsJ4IDutphXFB0wFalI40BL0o1k54
+Wlfv5GHbq7Ju3kW2dmTMP0WpfFytV7rr2yqSmik+skJw27BDk74rP0v4TNOHaTrP
+nokfTnlaKuv1bqlwbIwV7rJ5jbAtw5hueeN4jghGU8SGlCOEZ/xGxYYsvtyPhZhn
+kmsAzcPr/BpW4NkSb2SnRIO8KzcPnzxz7JDdeIusq/YW7P5OlhDx4ejdh0Wg6ISl
+zxB5VoqFqNuKTBQNz4HHpqDVQqEDE4JngMerDr+4qAiDYI4w6kN3Ce2LqciRyMVh
+YYnTqyyjXYY3C1WwXIa1tZb2Cw2DorshNFdACr7wKQMOoJtAFpdd3d/DRKQWCc3x
+jkBERqZ+55unTY0/0uyNPoK0noAcGydiU8WGh6wyi+Do+Zxq4QJEcqL/FHrhlaiw
+LTmgDS+XDl7zRtQia7ykpi/xqe74ujOHcJO8tpY0ZCdR2A13xiOi+11wndbOkBFv
+dQ0vgih9ROzwe3hBbBQQOdF4hkA9vEd2Ks4gF8IR+5ixWAIyZAVbnDiLelWgQgnE
+aeEwTtfcXRNAxuj+MgMPQhXQ2/cK0dPD4z51DchVRIf9G3hAuBT/CEhTqNkkm5F0
+og7azwd75+vh5RxwVld3ES6CMXKaiV4csQkdiEYEEBECAAYFAk64PygACgkQvnQP
+QT8iuxlligCeNgfNE4w1AQuOC4ef3HNNY0GXgVMAnjmtCVIUJv/w6PDimvf20rgF
+GVHxiQI+BBMBAgAoBQJOuD0KAhsDBQkCHIcABgsJCAcDAgYVCAIJCgsEFgIDAQIe
+AQIXgAAKCRD8G1R8jYFyyPv3D/wJ+sYXqSxoo8OriGMUzG5LXs2Hf1YULdlysGa8
+mxWTwCIEMSSx8AoOKf/FyXglDVl9msfOgv6jRiN+UyNCQEv+6a5ZCL7BlAVU0Q4W
+w2/UUlOUlLMC1QAodGcC3kiPSy41jnDVswKYRrICuiW1Pqgad3h7u7caqvqG1D/A
+YOR2Q8JjY15j6Qf62Xx+YANx2tPWKeDyPUAN/x1W6RrEDbN5F+1qOpPFuTnpPmqH
+q4zxm4Dz4szypmAKsN+5/q8T6DJtSnP7COtsY467oX2XtNTTuCIsU79lBVo/yan9
+ofB6hu12KyXwJIl1OK34g9VEP5suU3hcEw7uVAvxyMYJQlxORUCG0DAFc/oPm3d0
+ypRdbxXJMjoS3pmCf7kwnEA9PIAjZDYuVHGZkAdmYYInTIH6ipjkVxDHEF1en0h2
+zHJEZC7NIYgPyzHXmH7Xy3VZVhhKKKM12VDOuIOOecQPuFIw3hG7dymjn5e9dMzv
++DMkbEZzoFahLYkbVGG1FGzhE6Uvb/IG0UJCC4nDz0pzZpV++QHvgEvbY/HLbHJ4
+o3CT5aVE0YIhTP+zqXNFMOao8yZy+AzdMzdX+Y3ADZfY0oiZ+JH1Zo++rdrgXUhg
+Y98QgMwVwESbwaBKjsC0JnlmWyNivhIOS6NRyqR75E7j7JSvgJdxhvpQXXkQ/BzL
+FM1Ej4kCPgQTAQIAKAIbAwYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AFAlDaJfoF
+CQP8k6sACgkQ/BtUfI2BcsiEahAArZfD1yJK385eqgCZ5LryVLRXrocuF1zlHl/6
+ugRy2TEe43ex4eTOY+mv4ZJVSxbDzUqMbBv0m3IETbM0CSESjGD+i5I7K3IToZO9
+ZgIXDbpoy9x2KWjU+R5oaxCTmZ9jk1p+f4zHxc8lJdgOXPwcIIT5Euwk4LAFN+wn
+CUHkO/D0xzP2ivTrM+VHNWqSUcNInAGRx+R0NvdSryIAsdA/5E3ql786WQhPy6L6
+1d7cmxaLsfAKIOf8ydNyoiqmJkT62omLLnqyERfLZRa9RKt5EgnxX6kR2BA+h/Gn
+KVV18bCIJjF3Gjnh3qjJehKRaw9nmzrB9KtGQAHdIp8ivNvjMitc1ijRIECfidWd
+lGxgmuI/gX58eaV3scjbs5YUFmGhcZIgjCxWWxFSwmzJTUVT5XqBpXFQB4dokj9m
+NNMpM3YH8T9QaaS/m9j7cmCJ4gxp7i1bJsqsVG5BjRLiZv701eVKVmU6vqhubR0R
+eSZghqho9e44ZMbn4rJ5kTQhGc7ZGNsIyChMSaYVreB8IBLDC7rg8dB/umg1OYOp
+8EqRLJyXdtpa4DN3X0e4WcWb0Toj4QuyCh/es1CtBldhdqHr0aLZYCX4i/KuGTXI
+kA8LTOJmZsE+K+/NCux1VHK9DADKcNjhSV0QTf+8ntGlNW6i2Mlt34thZK5eeB6W
+Bbo1zl6JAhwEEAECAAYFAlLYK14ACgkQR9UBbEL/fCyyQBAA0931q8dBD/6COmat
+8S+JSgcuIpylukFxU2vySBWSGRHFmFzwbokUE4bbNyutwNO2cNBa9zcxRPrkIg+7
+d65QjdZNDV2zWTjv5GwzEMjWxhP7VpTwTouYgx9j2d2KpFo2jfhTtZ7OU7DDF9YT
+FsaRiZHHZT+W/JHuB9Lxc55HkSagu00yTaZURc0olBui5c/hqBte1b3OWTjCmysG
+mwDL2FwdmFi9mbEm77sdD8PSVfkZaBv5rIaet+Xe/JMZoz0WUkZRCFXMr6B7aOdS
+WeB7kUsPh2J5dhf4x4YaxKLOHod9JQF/DGJsdexKqMTqM/xOMSQ1FTUMCQ5SBWJc
+3PywqMB/0eqlteHydlk7bb9HLCT3M6vVxTkpj834wGRsoVXPqWKzAHPpO2kjxXtc
+4DBh7T88YGE2k5rxdJHb3MjWVJQzHGhrO5Ji8CQaHjUJ4BTyim++RDisDi4C/QJ4
+qPOrafw/+KyJoWyfmAUpxplPvY/LKJlvKaKxmpwlildYjH7HjoYvCjagbSCUOnzo
+uM//YIJ8/o8QdxEDdYiTd7cwskYWphrAlV8+vCl/Y0lepRf+hsUS+uZi/NX4qYMx
+CTsewnnqJQduuehQl9/RnoBX9T04kS64cWNaPZ4dxZUYJm3us5QFcQJMysZ4tT1Y
+A0oEUX1KUTDzTQXT/kFi8MtmXauJAj4EEwECACgCGwMGCwkIBwMCBhUIAgkKCwQW
+AgMBAh4BAheABQJS1dELBQkF3R5rAAoJEPwbVHyNgXLIV98P/jcu/DiP/muH2Qsy
+FtjscyLu1NzBbSFB9q1jMVfx3VbaIT22Ly6BIQNHF7L2fpjf36EWpdJzpfR+Glp5
+1+KqZgIMAW5CGguSy8v7iHs6Rh5hzChiF48wCqxUmMdQ0ITTrnAXIYq6H6s8ytKF
+Y31znXmne1XYBg8e4yb3pcBhkzIPeVU7rMz9PjPB0+Q2jWCpqPA4eUSV8rL2TxFR
+KbEt8XlkZ6yuCLnkN84aLZFxfZA1tIGifi0PpeaO2z/IwOmftbQRiljMdnsPye49
+j4wlJS7yRIpnH3nH9Zku/MrDV/M0z7BVwKfF2F95/2QX4Tdyd/UESTdLqGtXpX4c
+axahZKrOhNr+k60qSBxoBqKauZkSbZunRnbYmVa3nA2kQuIPF9/QmoZgDUfdkKZJ
+u1RjwcRUGKd1XV19QjUvBMD3oHA4G6Jbi5vWKQZ40KVcL78YIL7C8dUOiPIasA45
+olaGpCSsGsfrMp5ngegxM+uh9Tc2kTFC9bTqp17VYI96cAqGrEBUQrmLmZLk0HUm
+a6MNZO/+vKN4UTlgjpjxZon+/yK8bsmT/VNie5hzqZim6tfztl3rpJ9jPUeLgr5x
+oGePYV02inapzNHdWFHk0L9zR/3KKfJ3IRJwUXp00Eya28hEepIvdxgLYcN1UqVn
+VuFuMY8zYSl/VXtPxySCLENJHxvdtClMZXZlbnRlIFBvbHlhayA8bGV2ZW50ZUBs
+ZXZlbnRlcG9seWFrLmRlPokCPgQTAQIAKAIbAwYLCQgHAwIGFQgCCQoLBBYCAwEC
+HgECF4AFAlSXU9oFCQfATw8ACgkQ/BtUfI2BcsiPxw//X2xUctIrd1O7UOk7LHBX
+/xI7xXoWQcA7l/1XMuZhM8yC8yIoAgvFrWBP1a29I0P3/yigkQXs+eTDTdvb0QP2
+q72q7Azt852v5u8+dHzoOXDpbo+4lfX+0OBDWimwJuChD8LQH7b7jO0oqWIV0AzM
+vegFJVp3cDbyqw08lBz3xZ79A9JtBeewf6PLpXKjEVS8bEAZjZKjsjAY+5ShtJAf
+PsD8r353dmkaHgC5Aji74ijZeY3PUCvGVVCGeN9isLnRpTEn7qUvN2DfHJU4w6aw
+sXu7m7zidISo6dQLUzo54dHKWPGFy6INNkzXPOgrlbYnjt7v0Ou21/R6HrhdmsSw
+lt7GALJcgAUxrcT/ljB3SZhSB0BdH0DXPcUziEdfhgMhhrXYpMjwH2XFBD1MLusW
+GaVDbpPrSoEnmPVePcDUonDHePcuLjfOl13mOER1Kf6WFapOCa+4HCLakfKcPnGY
+eyfD7Dbz3/046MmfQ8/Iyf8ipFXN6tI2WkRKj8uq9IFYrX3yoCBxZJN837DM3Grq
+h48/T3pYU1f9LiekxbsgXmcHoGNdXX5+EsuO+QILZPttlG5QLuqFdJHei77uvW+B
+4u8mgzi1Zhh0hRLm4K6UaJ/fBJ87BZSHShPKI9PI073U1O/CcYXnb8cdPLu3UgSQ
+FM/bxT70TSYKI01Dt4KXRfWIRgQQEQIABgUCTrg/KAAKCRC+dA9BPyK7GT9FAJ47
+X5+0dQaOFkfy3WnMgX3AmIXJYQCfR4XL47rZ9a66jWaD0IbcXMK4oE2JAj4EEwEC
+ACgFAk64PJ4CGwMFCQIchwAGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEPwb
+VHyNgXLI2U8QAJGKPv1gWLn7P1KeHVsKkfRf+zgdsoY4mF3bUjX/03z1h1OKp+S7
+gZD/ZI80ckw/ElgFt9sr8J+pOgHk+aGHW+V0cZNgDHXCINb17s+Ra7SA/SWeJOrr
+d4IpvTnjGc88C/j+bzRFagfnGXU601PeJdXIe6H75xVGIb0DgQBfPB9m+7p3sq/R
+6UigzLwwhIQRW/l77hq79v5Rm77e0GTfcYHSuKu2Itim8p5OYCNchr4ZpBzrv5cF
+/nH+HyD0AnM1q4a3mT9y4abNgtxJMGJBoIUEDT5vaTRpPowVHIGg9QroHkrYkMWA
+ffIBzoq38WLnPjvjNtTncyP7sjbP8KS7NfjxZ6RAcNO6m6BTDYG/lM9jwCcOma90
+RZDVYD8hy+z1hXWFfB7zB+5TYuuKV5SXZpS9/JUR1BuI44WkY0hLHUa7inpqLlqc
+b9O7KYikgyaeUKAN5LkF8A7rMVzuhrSItNzJVOs7WLnNAe9+Frzqx/jZ9aU04avS
+r5OlWLdL7k9JNDnsLFqNtG/XQ7Hc8CPl0HvY3YXYGD3xwW6Ua6+ykxZGmQGPB68W
+6a7G5EX+MEWKZgMQYsl1HgU49/sOD6QnCG3m2IB7bRAf5Kd527BnSgAaYHjVug8G
++X9opDwUW1b73Ut5tWfZJqQ4XBjl0Hc7Zi7OtlqdBeKGu/65QU+N9x33iQI+BBMB
+AgAoAhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAUCUNol+gUJA/yTqwAKCRD8
+G1R8jYFyyPv+D/9lA9yMXPBROLaCRab8Ca2QJBEtpT6lGVlkQ5Am2C8xdoLGiuJF
+E7Cn/lS1j4RSVDK6DELeaBMXaY2g1eun8g2ERJIUGC98zrPjZXs/ZtCZtX8vYr1X
+Bf9U8Ty6N3rKgt1XHc1oMgzkKLUc72RC+P/fkDsiAg62nVcmOFFykyTXnpM/5Ux/
+9kaahjf4LwGeRqkDIoLrXdZ7FHPjei8VlKSiHTkl4F+UCzEySxiInV+BWAhL5Lvb
+zHxHaNDCquOb2zbgafVKON3oa8nCZoUw3iwpjrEy/JT+1BG6vxyT/LX7wPG3SKEw
+8QTl8YBF8wvHS0JHW4KTc4grCMNWDwfkrlXnp6ZzTpy4JXZfYs/ltR4FH3atDG2C
+xRCSAWXkGyTPMZkougdDbJ3jjViYcWO6B//LE1qDjeC05O9G3MXVxu16M5U8nVA2
+B3bo5cVv7+ECBTKaAvG3ZV6eOaeJ63gHRY8qI7y5OgzuNfxUXMTIAjHfO2mvSy5M
+qFgDI10F8rYevGOKxvPVE1F8aiD1uRAOMCcLTy3oUKHIdaskSytL1D/bT9WqWzii
+OXhLhSjMzkdPSUWVABeC6KM+Jcll0A0sHTkKWS3mavx3dUacB+O4efuTKNhSvo7n
+XhUvSOOikRityipE5Ma5WlXBiu54DdIMGFzANHFdb5GmC7da9F1aALkshokCHAQQ
+AQIABgUCUtgrXgAKCRBH1QFsQv98LMmaD/9W2qJyFlZAsjOWgNQPwUU4vV9/Ursj
+kt4RI/oS0Gzovw2bmL0a+Q/dp6wM4PBMuYQXCepF8V+o4uKzL2OjVZDVtU/KqGCY
+rEigiAhG0gHxgF1ukc9JQzhShFeq7/wkY+FQ4MOhuhuUsSMlvFzAd1hY+xlvckol
+DEeS54loDspUh4EwxsWlopaA1rs5dzVXrYcinz9iDzLj6ujb6uJzCQVogk9w3dv8
+smKn81TVhtR4RFecqL9mURZcGnj7NV3n2Lrl2Pe0u/DiTtpavCkzVx7v9qiB/2Di
+dqWR7OtYcywUr6lZeZsNabNwntPxSP7V6EcNXF3Qpi2IkAcwdJKb+aIG1v7/Wx77
+GhpBhbtdgKEebttzO4EVVeE8a2kmgqc8VXeAeqI89egU53dUdAinejFVDyemxHnJ
+L4L6uVnSxbk/vRzu+fr6EaPyBsqORGXj2OuwxlWcnWs/N9XzNaiq6funedUSYtbP
+trdpt7ogvzrQew7wetcwfxSB3IWcVwA9QvGDIBHTWPrb87jKV153w9I+cSfz9jg8
+qTIOw4qad7VOC4L1oaoRsLq6VFgnoW5DLsuhaVd6fgdY/byL6H5q2FPYJ+F8ovhR
+2yPlQm8UYIFwmnwzpnuGBaPtU0bP7C+SNMK+G/9+b5q4psh1MnK8sg1RfSr1w7sw
+b+Tur045QrUDu4kCPgQTAQIAKAIbAwYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AF
+AlLV0QsFCQXdHmsACgkQ/BtUfI2BcsitRA/7BbFuuAXPJMA4XtPhlYbfhNkYQ7+v
+vx9HIZ1SgJfhpYwt/vbNTVclO79XD65v5JSWx+0gVJfHNolP5umB0++giIw9NCIx
+uVa5eh3kS5NFfJ0YHrYgpFDdZPHRA9wI+oZgJBC/Cm40kafgTUoPFqXb0Sdlcz3R
+hciLZBgYXV/uYubczfmAaJpmrVI1UuUWYrdPnmUkgitp9e6IePYiKVDeIGhBW8Bc
+7Nbs2hc9yH1zwv3Affs8m+4tQQiwQHsB29WEZcmBuFllTbA5g5bvTvhfCRmYVgWC
+Ti4SW+uA0B05a/aVP8fDXk82qCQ4cRB1BOwVNn+1/Aqcw+Zh8KKzH8gpPcsKGGP6
+uNg9uinuxYDneEY8cG7FSpm3XsXu4q4N6j5R63U6hz39pY/5Ib8mzYMEoLEZOLPu
+CkVH9OOQc8zuiRL/wGc0pbMiGPEp13rAI0WbIFahrWS60bwtM1YEM5Ep8vD3TLl1
+pTWlF/zWpM/uJ6n/4nDXGQsGzKQn5D5Nsu7+55C0du0d1VRvYd8oG3AaNqhtM46V
+C4eOqxH8XZtkJ3WMxhsHnV9acuDTpn5E5JKL7vEq0btN2UQ69lpKv7PmV/TgOJhf
+KKvHZ0dh6KYY7iKW7NUCouLGibBoxDa+K4reh0i0M5UcsNiPkCqDIHUAIxW6FrvQ
+xBr7NgCls+B9Kwu0JExldmVudGUgUG9seWFrIDxaM3IwLjB4MDBAZ21haWwuY29t
+PokCPgQTAQIAKAIbAwYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AFAlSXU9oFCQfA
+Tw8ACgkQ/BtUfI2Bcsg4cw/5Af5/cxr5s8qiPvcGDglJyzFj8VBk0d7hpgdxcOi3
+VCOJY4YRoliu8WKThwxt7sD03fSZurFDDx+X27y3zPtgH/qBohmcr51jbSNom4mH
+Gf8gpViFqbQlFh7tYz4kSQExgmpFx/FIaxmwFoEqiVrp6VpM2DZ6kg//4M+Ka2Mt
+nuzV3C631A0eoMCJhPWPTgkGGknURvzhw6m2aGFWC/HE1yzf7Ej7fQeaqIxIG4Wy
+Fk3lMV9rxMxGuUZTqIhvcU85JSriHowfX1VsAI2LXJYQ9c0jI737FcLwHv8VCa5s
+NKDkLkb5S83/4Ep8e9M+a7u4WvkAqzmPfSna7bLxdsTS5gKGqEtMvMP2YGWWQxSR
+GRSttiMmIC8Cnd45S8cASA2mR/ebNcrYOpa48cjYpBKDG2BIYU7oSLNulsM1qbxL
+WJ0QM/g7iKHcrXhyIBaI22GS9hvmYcS960cox9oPCvNZcOKA6FBklnUg/ReJ3JTj
+6D6v9SUxOOfXPQIon8EzB7BNKGedHxCFgniZnl10k+pP34YGyphMZTYGdhtAm6zq
+T7PlraHQaFgQ3ba78lJcn3cWVZYpbCNJiH+Nna/Akm3/qQKTst3eW1lqopffCs1m
+F6G6wjiHCw2bio5uX1c/gDr4Peh0E28heAqKopjultPXPZbSZL4D3fJIGP2j6e1B
+wvmIRgQQEQIABgUCTrg/KAAKCRC+dA9BPyK7GcYrAKCgKW+qFwbMNeh4ikFg9fJx
+4/lH9wCdGevT7dwBzPe6L+aWZxipEXYmjx6JAj4EEwECACgFAk64PN0CGwMFCQIc
+hwAGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEPwbVHyNgXLIThYP/AnoLpQl
+whEEKaIhOSOKXegfdUHK6cL4cHRACzRIbBk/S4G2Vg/bnUW8tvWZDQLZ3CGL8Z0F
+tNQ6GusUxt7mcYdSj7xynbi7bZiurgYp7B7hh1hVG3pAXEwlDnJgfoc0YZHrHZwt
+HnNVYOfGEQF4zyplmUUxDyp/ZMYcXMr3PVJkYBJhYKCHOkMUtzzNjSSginaqZY1p
+fgbP+Gou/9qgotkYiH84oUG9yTSKLIO5x0WzQYuoPNJyOdSHaLPfEqCC435vCYT5
+YLZB1YI5xzQiGsAL//cUCe267oiFmO9Ioky/azeX1Ouy2DH8uEDQPQFTJYXt3CbL
+i10HkoBWdmncPC6+b0IJjDUo8Iv4yk0xFt2/DGkGK3h6jJxJ9pzx5KBT46iLfU50
+iTWMTguXn9ud/UJV0MpKgKjvO9hB4fae60n2UootknzEw6Y5W55PfGkT14WcrGGo
+WHLSbpR6+gA9apU1cdoOC8nXlf3Eb2No6LP3X7RJXqiRsdP0s6QXkZGfR/qyNXI9
+S5j6wIyqNFU0cX21UgI9oJSKEKIKEFacgyD9za0gswEI+DZr8/p3cJE89ZX8ySgO
+FG148wgaakTNGyGwR6aogGZ8IAHc83bnwGCgTeK6ZPSKNLSE/sImcTOrxIN1/x39
+r8o0TxuZjqFH+zKWfpdHX+sJLyi8Gs29CsUhiQI+BBMBAgAoAhsDBgsJCAcDAgYV
+CAIJCgsEFgIDAQIeAQIXgAUCUNol+gUJA/yTqwAKCRD8G1R8jYFyyLl/EACG6QRV
+kKVBoI2Ycr4UISk2+gCD2r4xSK/QLEhDFcZRgMctvPVnhod3uJOsMGJCk3aPGu91
+Jtwuj0CkeURa/cVzOjC+f7baveTuWQaAqW+r70m6F4gYHU0aDD/uQ75rTCcrsmt2
+pnZCyA9jLJxQGG11AvbOcV+7K7BuIvXs4iAactZ0hRvDVuGXuup2LnUbxyBU2oj7
+OWCXKTpZcJ0KGTWapMf8ClYYsEgS0wvMWotJzAov7ijkoP2DyEQVOPTnGWcfjsTk
+QgbyqiFeBl+3IT4+xSzkPsd75dCYhsHBvCoT8cfUH4wvDXzU2CwpC1CDfHit6Hw5
+UigvZ8HXyn00Bm0UjLHGW+haS3kyOoz+z09gVFYd33cpjSnFr5is8ZMBPW31PE15
+q9/l6G/o6OGJCtOax3Yi6ttqn+KbDXIooZoRPZlayOSghyjoD40+ErevmqZPfJ3E
+o1kHz62B1YpoXmhUm2Ihf2SbjWJRaW9Hp2nd81kAAXjr+8k4yvOuHxwYPFnpBjfV
+cfYNQ3Zf5xF4nfszFuZMc5JYrIR3EYVgEk+n8VpulAqd0rXUEODwGy7rPjdxLY7w
+DhUEZMQN3xweIb4vjPDBb0Ax3ACyfWKIdT0kC3rGOy9xyCzxWO2CjHMjrbxy4jL7
+B0WIQ5fpRcV2+wozs2WYgJKVKJgJZGYsW8dDLYkCHAQQAQIABgUCUtgrXgAKCRBH
+1QFsQv98LIX0EADVefJUEMGKiTFLwUmWNF2X4oCzEZEMsQ6NliiQFvtNkKrT+OzZ
+zggxfINUr0XEKgjjoGZ03Hmm7xAFc1Y51QZEr25H18PuSixz2YSHPqYwwVgLUh0v
+u2AqaP0mQckssK+ZAQVvoZ7ZOI22ZXIZ6CPEPY6aJawHov8Strlm8oTbFgLfZ5Wo
+3NCxMkkq3NFNHuwesccelNPefgnFZWhwr1mkUeX+rCAbQF/QHYEAi7KjfKyY+XKs
+ccjYS+RWxpte21ejngp7pRYli3M8cZoaWKCzLTrD8gKztlo3op9Zc2+hjOY9gZtG
+CaXkN8lchJ1yMyWju61ZO++AJq6S2OdBVxgsj9xPm+x91RbZRHQmUuq8mefUzaEm
+NHE29udVFfuV//Fpabi04IrOuabkrSvP27eX9FT1y25tKFHuJdL5fDUFGnNnTvcR
+X51lJmvnuIKJQ+Lthup7npS0L06+dPIDoqyxF8hmdu3RtwEsvkboPaxx5XTB5d8y
+3wzBFWd4ePwBIumrY1YHSzdJCvyyLRXZbSOsHXgZfhfQ1LVgxxebP7E+stWqGLLC
+Fry0WGG8f/UUgVr1QpluT6NjioUnuI/ZmKR/aKewqVYWAnr54fF+np4VdxPfYwci
+lpbXpkamORZqPfq/nyoWgnp+y4AptDdDkSWnFxfcJ1wnFFcrHVUSFQ1wBYkCPgQT
+AQIAKAIbAwYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AFAlLV0QsFCQXdHmsACgkQ
+/BtUfI2BcsjV6w/9Fe1+3Mc6wG3R9VbxiYo13/JV4t+tA9/tcJ1R/Y96eAqVajoK
+c2ZQ7FrimmlzvLIvxpH4Z76h3NmPWfOQ6qEumZQ5BM3QwBfQQ3Tmj10gfiL5vOZJ
+6dUaJjwXgjz0Qyk1G3gw7K1xmtnXgBPyGT9T9q3OAhHHdV2b6xS9dWoNKhUV8GUn
+HfIKwq+87aZqexjFE7ubZdOAe+5nrqnlMEfJKgDjXbazES9IYvPQiSjwR3xaIPOa
+ma5WfQV0SHg3Vkhtv2PjuoYWNfNy17N7u+dfg7nAtKLIQCPht45uKk66BYWYBoDI
+VQfg6zcFLpdNcFzzwmgrYRZvEvBf5aSG3KFD7UReT0695/lHheRxEAA3thsx8gaM
+CCavtVxbVUluEfYZ7TgXLMuIO9OBKhi7MwB3iL5qacrNShMB+1J5FxieJBmWXdla
++kCdCdS+9kIZH+mnQ8daGEJ5R9mNcVwcWasI0o9NObqIZwhKw4obrC5Q7m2NfXL6
+FUScfA7yn7+/icdQB9fH2ZXGJVuNm1b8OBN6Nbz0QauaCystWzKXKwpVb/5M623v
+Vw75RfnqCFiAf4tX58nL/QalJc4C0E+TvQ2pXC47VQvHmiAB31vKvU0nbo+lzi64
+hAPWJnhr2pmTvglquTFzLwEsWfO4zDtUwFo8KM1XFsonaoX5UzGTXPmIN5+0J0xl
+dmVudGUgUG9seWFrIDxhbnRocmF4eEBhcmNobGludXgub3JnPokCPwQTAQIAKQIb
+AwcLCQgHAwIBBhUIAgkKCwQWAgMBAh4BAheABQJUl1PbBQkHwE8PAAoJEPwbVHyN
+gXLIdGAP/0ch1NeFyXWszqA5ow+itBn6iyUaplXB5I56Q77cTIFB6LqJ5+2kdUuO
+UqPvOilGS3dxbyDsSdWDLs+bHRFG4uqZyGUDhmu2mvS+uDqPFwcKJUNDlgdccxph
+sA5HJFGg1ca0TWWg8vjwANdU4sL9Ujbaw93v0Mx/1+aSIxyEJBNxc6DJWEfCjpSy
+R9JB8WTHgvxEAImVNsT1OGNTvd2DN+17WBhxBktLHDocIGJ/fttzFgKkv6NTPwt+
+y4QyP3UgeYRZR21B6MVckk2/UuCuCY7gAGruTFVoINa/Wqn2YPPZhJYrTX7ysDaV
+QLObxlepeo0UWC7wFEiuqu5OM75MWLUX8j/1OAIE6my85vrlcWSf0Z3jOAgPTjJw
+VT5h7T/7NPP2azoIlOE2bh5UcKXFkT0xDYPcMr2hV2Ih+jU+Ygiyg/1yIIxearmm
+PFjfIHMLepa+7RPtTlHwu4fpNPXzL13W6PXSoCTTi/suGlYmSyLtOwxq15GGT3vg
+1Xh8wfkuWwbWJnBKXtt8HkteQRgDngDnRSJwsO2nnQ7+sr+F8J3rQDdlVdVcolic
+ekup8ZgSjJYinfcpF+H+qy2kK2jOYyyHI/+zHQtwy1R7MbLwPJe7WNWrBmEvmazB
+2//Iu5EVIfFX3flPjeRQbKX4B/SuXF48uo0/8WfdgaMW8glRWJnbiQI/BBMBAgAp
+BQJUSwOnAhsDBQkF3R5rBwsJCAcDAgEGFQgCCQoLBBYCAwECHgECF4AACgkQ/BtU
+fI2Bcsj5ihAAg0d0A8OUsNWG7TiPQTuC/D4e/5JTkJARmQ5xO6gMPxTpjSZCyWEl
+7gQOg/liU8nz5HZGaJgg4HuBwTs6euqdnVi6zhW1c1wye2thGTQ7DeSPJnhju3Qe
+mPS1jEdC34lXCo6eGjdKnGb7TV7hkptHKHh7XCU9n6qcXQ2cNQQbdqSCRsfVm1XD
++p+mM/FGOz8uFOrhERAUl99WkVZ4NKTdws8U6FXulbdWrWwI4eRggIdwI/Tl7zuy
+ja7KxBCCeJ/gFY6g+iOYmIo6//bJITgmAG60hFHJ9JigcN6xglYFI28TCdNqM0+C
+hgbZUner0vLmaxRNoXqV9Xw8ihNMQa7fUFYkX8VrXOdLdVvee7OaeLuWWE8x6usQ
+NzgLDQQx9fmxtrQY+dC6Y25IPMm094z0nrbM1wtfG2+8Vw4mQ2U099fT5t3Yl7fE
+PlanhgQxRZE78PxezyYxms4HV+wqvrhlBzFnWAd6H27uDPfUfO9cLgbmFTUlwFhg
+gsDeIFRFx8+h4/0xAIPqUODmTiN0mj5sLRW7zvqZW6zhsGIMdPd+IkhHiGjeJqme
+Ai0iOjpV3tRteoW51/+/ajPmyUBbvOxiFJNADHH2NvqoBMU1pkTvpc7Wy+2J9VcF
+4TFdWBbwjU8BoC3ZgixTrT0zCSwabnKriglOhA5Ik/n5HsR7S76V13y0KExldmVu
+dGUgUG9seWFrIDxhbnRocmF4eEBoYW1idXJnLmNjYy5kZT6JAj0EEwEIACcFAlSX
+VHICGwMFCQfATw8FCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQ/BtUfI2Bcsia
+Wg//SKLFNUTEBQG11cV/AljxmI2s8y+cPKs3VqlwEjiuRMu4DRkFVaZNEuPq0b8q
+8pwcHIJ5/nZvOticm9M/g7TrTp3pOxmSYf7WG31vVrprig22dz8WxQAy76srNn1z
+stg0TFO7nKNVjZOFz5D0RpWazwnXyDed3l2/7RZ1CMv7ue/rZez8FnDHN7Di3daX
+AJ5XkvDAsD6AITYQd+4XEbh2rt9p8G6qUUjwzoVU/aGVgo1CGZydYMJQVccNL7kv
+fumnwkAED8u9j0ZI+xfaD3c1rP98bnqk9u8rJPCAeIkA4ppisDb7noz0NaO7dDyM
+ywBK4OR478fw5h7GfiIwZdVAHkCoEHNvF1ON8JnYgyplLvZvxZ0dtYGDYDiFdORN
+gVgGMU12kemPws4hEx3WMgUu/BBkF58XyQyqcwt7q+WGI2lQ88UzZ/FAsu8i8r/J
+jkV8FsiCJ2rSHEMddmOHoaTM+6oB2i9kZo7KmToSZu7DxuemlHpuOO3kG/iRga2y
+NeancRJwbxgZhNGBbhrA/7k5UOcXkmfW74oBkbCci0ncVhHu12dsJXhk+eprkOXv
+nD1vEIeuzL4V/SMDar3SxFlfLFwQk4cn9+pdeP3LxwHKBn74pABsbEBhEY4IjUEL
+YOTEVoP6s+Ou1NcLxFl3elmniwL2+GV5rDM8pctkKNemtZa5Ag0ETrg4RQEQALfu
+qEihKS+DTVlWUujzSq5zK/5oQ1ZL8AiTUTZuVtrRWCq0HE8tWaVxEP3Vt9FCo7yF
+afXigokChzHOgzczg80tctrlv+vbFyaZnjGQH20Nlz8EnZP102zudx/RdFXG/up8
+PX50Eck2lH+IvvosMLdvrZTkFJ4SgqMGSoAgMhJHZdZB5N0y8yPPAjcEnSXp8L2A
+mo9e0egCrEuqBrCZld00nIoipyDlYNZkLjPf0JRgFPO/AWWgBZLvLlteLu0emq8N
+96bT3QTdXpRVPM0qeX94+2gIj+0V1uQ9+k5Xkslbbii9TnOzMnLRO6dBAONVTTb3
+ajzdXK71iv2a8Y9lKShxhYWP9JNOFlXkAp+ZoD7EZex4dgu6giV3PrTDJLyWSu41
+WfqOz6cJGpJSTacrenC542ynAaSVKXH+1plqB9kq/M7HtE/P4GveQXIVT9Sho394
+4hwkuETo20KwCgFPMmiNaBysnOykIcDsDutBOyygdovzdGEyHVsM8/kz007QFgJf
+hKy91H6O/Cg7VH+yaUKllRZ+kFsoSy8/E0IqLzqBHG3sUGM6lJ0Q9fgSnpzIZsdE
+jRhczNCvlovGLa/kBHcEUWQ2zrjnfjsLkxvamKJ8N6LLIXIDRv5dE2smpdi3oiVg
+XdOKshyXB+obhRFlWtirK4udX5yYzUpcB0zBoo1hABEBAAGJAiUEGAECAA8CGwwF
+AlSXVAEFCQfATzwACgkQ/BtUfI2Bcsj0Tw//dyDYwcnh0BIb+nDCXFC91KiPUILa
+f+wI5w6c9YYEo6TR89q6Wsq8EDiqcqSJcztuNvw3MZGHWA25nNB/0046CGM/tUBd
+Jyudd3TxQBi6XMMSTbG1EMtSN1UMV4guuUfYcAGW38oZ+YJACCBFFz/Kt0aa/hhi
+/hBNyvI73vZfQ/fsScFDewkxikUEspRsLVmX6gaEmumOxOhJP3HBoxeBCM4Z3IXo
+dON2SiiMxt9BPIPJOyKNkFQGQ3dqJIag3GnsZ1s0CEoi8iqF7uS4RjC7uOJtvn74
+CODxg1Ibl1IweyAuBEA80wUh9DGLAdRJpxWy1B2fDhIROvpcg0R5p6j9UX0b0esc
+jKLQEiE1wRswjXhWpZhe7Pjl38KhwqMyaeR3OnDtP7JXazIG6HiBIp4cx4k5A2TT
+X+LhvG3NHCeuxIyjLTRTWgv241kf7uAu+qgjHDSKXQqpjvo+cUYQgSxQZZXnmlz0
+sz/tEeiWl+i8kW/RNKQvNNR8ghWDW3YRak/zS+WFNoLZchecIzMj+je1vSg411o4
+Xd3LHDur6boCetaq7ZkqoS+NcX9n8MnKhHKYJblvXyc1h67s90+wSwhlumA8WqlM
+yqn99m13aF8GuGZbw5B2/x/Cd7WW5wZV6ioola/yqDXB1XtDFBy2Hxr/VMRlE3Cu
+kekzzVjVTZxOgZE=
+=yRuG
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 2c8b8de65b319..34e142e90db27 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -244,6 +244,7 @@ let
       SND_HDA_RECONFIG    = yes; # Support reconfiguration of jack functions
       # Support configuring jack functions via fw mechanism at boot
       SND_HDA_PATCH_LOADER = yes;
+      SND_HDA_CODEC_CA0132_DSP = whenOlder "5.8" yes; # Enable DSP firmware loading on Creative Soundblaster Z/Zx/ZxR/Recon
       SND_OSSEMUL         = yes;
       SND_USB_CAIAQ_INPUT = yes;
       # Enable PSS mixer (Beethoven ADSP-16 and other compatible)
@@ -607,6 +608,8 @@ let
       MODULE_COMPRESS_XZ = yes;
       KERNEL_XZ          = yes;
 
+      SYSVIPC            = yes;  # System-V IPC
+
       UNIX               = yes;  # Unix domain sockets.
 
       MD                 = yes;     # Device mapper (RAID, LVM, etc.)
diff --git a/pkgs/os-specific/linux/kernel/hardened-config.nix b/pkgs/os-specific/linux/kernel/hardened-config.nix
index 3010d87a178a1..95510fe218e33 100644
--- a/pkgs/os-specific/linux/kernel/hardened-config.nix
+++ b/pkgs/os-specific/linux/kernel/hardened-config.nix
@@ -16,32 +16,10 @@ with (stdenv.lib.kernel.whenHelpers version);
 
 assert (versionAtLeast version "4.9");
 
-optionalAttrs (stdenv.hostPlatform.platform.kernelArch == "x86_64") {
-  DEFAULT_MMAP_MIN_ADDR = freeform "65536";  # Prevent allocation of first 64K of memory
-
-  # Reduce attack surface by disabling X32
-  X86_X32            = no;
-  # Note: this config depends on EXPERT y and so will not take effect, hence
-  # it is left "optional" for now.
-  MODIFY_LDT_SYSCALL = option no;
-  VMAP_STACK         = yes; # Catch kernel stack overflows
-
-  # Randomize position of kernel and memory.
-  RANDOMIZE_BASE   = yes;
-  RANDOMIZE_MEMORY = yes;
-
-  # Disable legacy virtual syscalls by default (modern glibc use vDSO instead).
-  #
-  # Note that the vanilla default is to *emulate* the legacy vsyscall mechanism,
-  # which is supposed to be safer than the native variant (wrt. ret2libc), so
-  # disabling it mainly helps reduce surface.
-  LEGACY_VSYSCALL_NONE = yes;
-} // {
+{
   # Report BUG() conditions and kill the offending process.
   BUG = yes;
 
-  BUG_ON_DATA_CORRUPTION = whenAtLeast "4.10" yes;
-
   # Safer page access permissions (wrt. code injection).  Default on >=4.11.
   DEBUG_RODATA          = whenOlder "4.11" yes;
   DEBUG_SET_MODULE_RONX = whenOlder "4.11" yes;
@@ -57,32 +35,17 @@ optionalAttrs (stdenv.hostPlatform.platform.kernelArch == "x86_64") {
   SECURITY_SELINUX_DISABLE = whenAtLeast "4.12" no;
   SECURITY_WRITABLE_HOOKS  = whenAtLeast "4.12" (option no);
 
-  DEBUG_WX = yes; # boot-time warning on RWX mappings
   STRICT_KERNEL_RWX = whenAtLeast "4.11" yes;
 
-  # Stricter /dev/mem
-  STRICT_DEVMEM    = option yes;
-  IO_STRICT_DEVMEM = option yes;
-
   # Perform additional validation of commonly targeted structures.
   DEBUG_CREDENTIALS     = yes;
   DEBUG_NOTIFIERS       = yes;
-  DEBUG_LIST            = yes;
   DEBUG_PI_LIST         = yes; # doesn't BUG()
   DEBUG_SG              = yes;
   SCHED_STACK_END_CHECK = yes;
 
   REFCOUNT_FULL = whenAtLeast "4.13" yes;
 
-  # Perform usercopy bounds checking.
-  HARDENED_USERCOPY = yes;
-  HARDENED_USERCOPY_FALLBACK = whenAtLeast "4.16" no; # for full whitelist enforcement
-
-  # Randomize allocator freelists.
-  SLAB_FREELIST_RANDOM = yes;
-
-  SLAB_FREELIST_HARDENED = whenAtLeast "4.14" yes;
-
   # Randomize page allocator when page_alloc.shuffle=1
   SHUFFLE_PAGE_ALLOCATOR = whenAtLeast "5.2" yes;
 
@@ -98,7 +61,6 @@ optionalAttrs (stdenv.hostPlatform.platform.kernelArch == "x86_64") {
   SECURITY_SAFESETID = whenAtLeast "5.1" yes;
 
   # Reboot devices immediately if kernel experiences an Oops.
-  PANIC_ON_OOPS = yes;
   PANIC_TIMEOUT = freeform "-1";
 
   GCC_PLUGINS = yes; # Enable gcc plugin options
@@ -120,7 +82,4 @@ optionalAttrs (stdenv.hostPlatform.platform.kernelArch == "x86_64") {
   CC_STACKPROTECTOR_REGULAR = whenOlder "4.18" no;
   CC_STACKPROTECTOR_STRONG  = whenOlder "4.18" yes;
 
-  # Enable compile/run-time buffer overflow detection ala glibc's _FORTIFY_SOURCE
-  FORTIFY_SOURCE = whenAtLeast "4.13" yes;
-
 }
diff --git a/pkgs/os-specific/linux/kernel/hardened-patches.json b/pkgs/os-specific/linux/kernel/hardened-patches.json
new file mode 100644
index 0000000000000..24c44dd1ed1f3
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/hardened-patches.json
@@ -0,0 +1,27 @@
+{
+    "4.14.176": {
+        "sha256": "0pr3m2j63mc746fcbzg1hlwv85im9f87qkl6r4033gwnpa9brcgk",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.176.a/linux-hardened-4.14.176.a.patch",
+        "version_suffix": "a"
+    },
+    "4.19.116": {
+        "sha256": "1f54g0xw708kxha07nsb979h5vwxjrkbwa5h04zny2kq702x1h13",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.115.a/linux-hardened-4.19.115.a.patch",
+        "version_suffix": "NixOS-a"
+    },
+    "5.4.33": {
+        "sha256": "154iz7i9l0hihjrmfk6rjh7hhqwyhsdjr2c74m3dhadrlm5hwy89",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.32.a/linux-hardened-5.4.32.a.patch",
+        "version_suffix": "NixOS-a"
+    },
+    "5.5.17": {
+        "sha256": "1lms090kkk4vlvfssqsm7r3j88hlf8smrnpcgq24v9rq9pbr0fyw",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.5.17.a/linux-hardened-5.5.17.a.patch",
+        "version_suffix": "a"
+    },
+    "5.6.4": {
+        "sha256": "05wkzh7927n71x4cl69mclc44grqpnx6i65hli470q1rg1qrk26n",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.6.4.a/linux-hardened-5.6.4.a.patch",
+        "version_suffix": "a"
+    }
+}
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index 2b718551cc78e..69b0197d4e681 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -1,4 +1,4 @@
-{ fetchpatch }:
+{ lib, fetchpatch, fetchurl }:
 
 {
   bridge_stp_helper =
@@ -38,6 +38,21 @@
     patch = ./tag-hardened.patch;
   };
 
+  hardened = let
+    mkPatch = kernelVersion: patch: let
+      fullVersion = "${kernelVersion}.${patch.version_suffix}";
+      name = "linux-hardened-${fullVersion}";
+    in {
+      inherit name;
+      patch = fetchurl {
+        name = "${name}.patch";
+        inherit (patch) url sha256;
+        meta.maintainers = with lib.maintainers; [ emily ];
+      };
+    };
+    patches = builtins.fromJSON (builtins.readFile ./hardened-patches.json);
+  in lib.mapAttrs mkPatch patches;
+
   # https://bugzilla.kernel.org/show_bug.cgi?id=197591#c6
   iwlwifi_mvm_support_version_7_scan_req_umac_fw_command = rec {
     name = "iwlwifi_mvm_support_version_7_scan_req_umac_fw_command";
diff --git a/pkgs/os-specific/linux/kernel/update-hardened.py b/pkgs/os-specific/linux/kernel/update-hardened.py
new file mode 100755
index 0000000000000..089e991d06bcb
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/update-hardened.py
@@ -0,0 +1,200 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i python -p "python3.withPackages (ps: [ps.PyGithub])" git gnupg
+
+# This is automatically called by ./update.sh.
+
+import re
+import json
+import sys
+import os.path
+from glob import glob
+import subprocess
+from tempfile import TemporaryDirectory
+
+from github import Github
+
+HERE = os.path.dirname(os.path.realpath(__file__))
+HARDENED_GITHUB_REPO = 'anthraxx/linux-hardened'
+HARDENED_TRUSTED_KEY = os.path.join(HERE, 'anthraxx.asc')
+HARDENED_PATCHES_PATH = os.path.join(HERE, 'hardened-patches.json')
+MIN_KERNEL = (4, 14)
+
+HARDENED_VERSION_RE = re.compile(r'''
+    (?P<kernel_version> [\d.]+) \.
+    (?P<version_suffix> [a-z]+)
+''', re.VERBOSE)
+
+def parse_version(version):
+    match = HARDENED_VERSION_RE.fullmatch(version)
+    if match:
+        return match.groups()
+
+def run(*args, **kwargs):
+    try:
+        return subprocess.run(
+            args, **kwargs,
+            check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
+        )
+    except subprocess.CalledProcessError as err:
+        print(
+            f'error: `{err.cmd}` failed unexpectedly\n'
+            f'status code: {err.returncode}\n'
+            f'stdout:\n{err.stdout.decode("utf-8").strip()}\n'
+            f'stderr:\n{err.stderr.decode("utf-8").strip()}',
+            file=sys.stderr,
+        )
+        sys.exit(1)
+
+def nix_prefetch_url(url):
+    output = run('nix-prefetch-url', '--print-path', url).stdout
+    return output.decode('utf-8').strip().split('\n')
+
+def verify_openpgp_signature(*, name, trusted_key, sig_path, data_path):
+    with TemporaryDirectory(suffix='.nixpkgs-gnupg-home') as gnupg_home:
+        run('gpg', '--homedir', gnupg_home, '--import', trusted_key)
+        keyring = os.path.join(gnupg_home, 'pubring.kbx')
+        try:
+            subprocess.run(
+                ('gpgv', '--keyring', keyring, sig_path, data_path),
+                check=True, stderr=subprocess.PIPE,
+            )
+            return True
+        except subprocess.CalledProcessError as err:
+            print(
+                f'error: signature for {name} failed to verify!',
+                file=sys.stderr,
+            )
+            print(err.stderr.decode('utf-8'), file=sys.stderr, end='')
+            return False
+
+def fetch_patch(*, name, release):
+    def find_asset(filename):
+        try:
+            return next(
+                asset.browser_download_url
+                for asset in release.get_assets()
+                if asset.name == filename
+            )
+        except StopIteration:
+            raise KeyError(filename)
+
+    try:
+        patch_url = find_asset(f'{name}.patch')
+        sig_url = find_asset(f'{name}.patch.sig')
+    except KeyError:
+        print(f'error: {name}.patch{{,sig}} not present', file=sys.stderr)
+        return None
+
+    sha256, patch_path = nix_prefetch_url(patch_url)
+    _, sig_path = nix_prefetch_url(sig_url)
+    sig_ok = verify_openpgp_signature(
+        name=name,
+        trusted_key=HARDENED_TRUSTED_KEY,
+        sig_path=sig_path,
+        data_path=patch_path,
+    )
+    if not sig_ok:
+        return None
+
+    return {
+        'url': patch_url,
+        'sha256': sha256,
+    }
+
+def commit_patches(*, kernel_version, message):
+    with open(HARDENED_PATCHES_PATH + '.new', 'w') as new_patches_file:
+        json.dump(patches, new_patches_file, indent=4, sort_keys=True)
+        new_patches_file.write('\n')
+    os.rename(HARDENED_PATCHES_PATH + '.new', HARDENED_PATCHES_PATH)
+    message = f'linux/hardened-patches/{kernel_version}: {message}'
+    print(message)
+    if os.environ.get('COMMIT'):
+        run(
+            'git', '-C', HERE, 'commit', f'--message={message}',
+            'hardened-patches.json',
+        )
+
+# Load the existing patches.
+with open(HARDENED_PATCHES_PATH) as patches_file:
+    patches = json.load(patches_file)
+
+NIX_VERSION_RE = re.compile(r'''
+    \s* version \s* =
+    \s* " (?P<version> [^"]*) "
+    \s* ; \s* \n
+''', re.VERBOSE)
+
+# Get the set of currently packaged kernel versions.
+kernel_versions = set()
+for filename in os.listdir(HERE):
+    filename_match = re.fullmatch(r'linux-(\d+)\.(\d+)\.nix', filename)
+    if filename_match:
+        if tuple(int(v) for v in filename_match.groups()) < MIN_KERNEL:
+            continue
+        with open(os.path.join(HERE, filename)) as nix_file:
+            for nix_line in nix_file:
+                match = NIX_VERSION_RE.fullmatch(nix_line)
+                if match:
+                    kernel_versions.add(match.group('version'))
+
+# Remove patches for old kernel versions.
+for kernel_version in patches.keys() - kernel_versions:
+    del patches[kernel_version]
+    commit_patches(kernel_version=kernel_version, message='remove')
+
+g = Github(os.environ.get('GITHUB_TOKEN'))
+repo = g.get_repo(HARDENED_GITHUB_REPO)
+releases = repo.get_releases()
+
+found_kernel_versions = set()
+failures = False
+
+for release in releases:
+    remaining_kernel_versions = kernel_versions - found_kernel_versions
+
+    if not remaining_kernel_versions:
+        break
+
+    version = release.tag_name
+    name = f'linux-hardened-{version}'
+    version_info = parse_version(version)
+    if not version_info:
+        continue
+    kernel_version, version_suffix = version_info
+
+    if kernel_version in remaining_kernel_versions:
+        found_kernel_versions.add(kernel_version)
+        try:
+            old_version_suffix = patches[kernel_version]['version_suffix']
+            old_version = f'{kernel_version}.{old_version_suffix}'
+            update = old_version_suffix < version_suffix
+        except KeyError:
+            update = True
+            old_version = None
+
+        if update:
+            patch = fetch_patch(name=name, release=release)
+            if patch is None:
+                failures = True
+            else:
+                patch['version_suffix'] = version_suffix
+                patches[kernel_version] = patch
+                if old_version:
+                    message = f'{old_version} -> {version}'
+                else:
+                    message = f'init at {version}'
+                commit_patches(kernel_version=kernel_version, message=message)
+
+missing_kernel_versions = kernel_versions - patches.keys()
+
+if missing_kernel_versions:
+    print(
+        f'warning: no patches for kernel versions ' +
+        ', '.join(missing_kernel_versions) +
+        '\nwarning: consider manually backporting older patches (bump '
+        'JSON key, set version_suffix to "NixOS-a")',
+        file=sys.stderr,
+    )
+
+if failures:
+    sys.exit(1)
diff --git a/pkgs/os-specific/linux/kernel/update.sh b/pkgs/os-specific/linux/kernel/update.sh
index c7fcc07ea0a8b..c483661b6f5d4 100755
--- a/pkgs/os-specific/linux/kernel/update.sh
+++ b/pkgs/os-specific/linux/kernel/update.sh
@@ -60,3 +60,6 @@ done
 
 # Update linux-libre
 COMMIT=1 $NIXPKGS/pkgs/os-specific/linux/kernel/update-libre.sh
+
+# Update linux-hardened
+COMMIT=1 $NIXPKGS/pkgs/os-specific/linux/kernel/update-hardened.py
diff --git a/pkgs/os-specific/linux/lxc/default.nix b/pkgs/os-specific/linux/lxc/default.nix
index d8aff40eefd5b..cc25f90f2481c 100644
--- a/pkgs/os-specific/linux/lxc/default.nix
+++ b/pkgs/os-specific/linux/lxc/default.nix
@@ -9,11 +9,11 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
   pname = "lxc";
-  version = "4.0.1";
+  version = "4.0.2";
 
   src = fetchurl {
     url = "https://linuxcontainers.org/downloads/lxc/lxc-${version}.tar.gz";
-    sha256 = "178kqjz0n5nnjw0z8ac5lbfpqprna9xfd9ckakp34zq9vz0smfvh";
+    sha256 = "1c2wbbcvs58slyq0skxizx61q1lb4yvak28x4gzsbzh3yg6nscya";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/asterisk/default.nix b/pkgs/servers/asterisk/default.nix
index a5934827a2002..9683d2c44d055 100644
--- a/pkgs/servers/asterisk/default.nix
+++ b/pkgs/servers/asterisk/default.nix
@@ -141,11 +141,11 @@ in rec {
   #    # provided here verbatim for the convenience of anyone wanting to build
   #    # Asterisk from other sources. Include in externals.
   #    "sounds/asterisk-core-sounds-en-gsm-1.5.tar.gz" = fetchurl {
-  #      url = http://downloads.asterisk.org/pub/telephony/sounds/releases/asterisk-core-sounds-en-gsm-1.5.tar.gz;
+  #      url = "http://downloads.asterisk.org/pub/telephony/sounds/releases/asterisk-core-sounds-en-gsm-1.5.tar.gz";
   #      sha256 = "01xzbg7xy0c5zg7sixjw5025pvr4z64kfzi9zvx19im0w331h4cd";
   #    };
   #    "sounds/asterisk-moh-opsound-wav-2.03.tar.gz" = fetchurl {
-  #      url = http://downloads.asterisk.org/pub/telephony/sounds/releases/asterisk-moh-opsound-wav-2.03.tar.gz;
+  #      url = "http://downloads.asterisk.org/pub/telephony/sounds/releases/asterisk-moh-opsound-wav-2.03.tar.gz";
   #      sha256 = "449fb810d16502c3052fedf02f7e77b36206ac5a145f3dacf4177843a2fcb538";
   #    };
   #    # TODO: Sounds for other languages could be added here
diff --git a/pkgs/servers/dns/https-dns-proxy/default.nix b/pkgs/servers/dns/https-dns-proxy/default.nix
new file mode 100644
index 0000000000000..6f2cb5048034d
--- /dev/null
+++ b/pkgs/servers/dns/https-dns-proxy/default.nix
@@ -0,0 +1,34 @@
+{ stdenv, fetchFromGitHub, cmake, gtest, c-ares, curl, libev }:
+
+stdenv.mkDerivation rec {
+  pname = "https-dns-proxy";
+  # there are no stable releases (yet?)
+  version = "unstable-20200419";
+
+  src = fetchFromGitHub {
+    owner = "aarond10";
+    repo = "https_dns_proxy";
+    rev = "79fc7b085e3b1ad64c8332f7115dfe2bf5f1f3e4";
+    sha256 = "1cdfswfjby4alp6gy7yyjm76kfyclh5ax0zadnqs2pyigg9plh0b";
+  };
+
+  nativeBuildInputs = [ cmake gtest ];
+
+  buildInputs = [ c-ares curl libev ];
+
+  installPhase = ''
+    install -Dm555 -t $out/bin https_dns_proxy
+    install -Dm444 -t $out/share/doc/${pname} ../{LICENSE,README}.*
+  '';
+
+  # upstream wants to add tests and the gtest framework is in place, so be ready
+  # for when that happens despite there being none as of right now
+  doCheck = true;
+
+  meta = with stdenv.lib; {
+    description = "DNS to DNS over HTTPS (DoH) proxy";
+    license = licenses.mit;
+    maintainers = with maintainers; [ peterhoeg ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/servers/http/apache-httpd/2.4.nix b/pkgs/servers/http/apache-httpd/2.4.nix
index c84790ba10603..8d8a0fceefb40 100644
--- a/pkgs/servers/http/apache-httpd/2.4.nix
+++ b/pkgs/servers/http/apache-httpd/2.4.nix
@@ -16,12 +16,12 @@ assert ldapSupport -> aprutil.ldapSupport && openldap != null;
 assert http2Support -> nghttp2 != null;
 
 stdenv.mkDerivation rec {
-  version = "2.4.41";
+  version = "2.4.43";
   pname = "apache-httpd";
 
   src = fetchurl {
     url = "mirror://apache/httpd/httpd-${version}.tar.bz2";
-    sha256 = "0h7a31yxwyh7h521frnmlppl0h7sh9icc3ka6vlmlcg5iwllhg8k";
+    sha256 = "0hqgw47r3p3521ygkkqs8s30s5crm683081avj6330gwncm6b5x4";
   };
 
   # FIXME: -dev depends on -doc
diff --git a/pkgs/tools/admin/pebble/default.nix b/pkgs/tools/admin/pebble/default.nix
index 5aa220fd89e68..efd9bfe059641 100644
--- a/pkgs/tools/admin/pebble/default.nix
+++ b/pkgs/tools/admin/pebble/default.nix
@@ -4,7 +4,7 @@
 }:
 
 let
-  version = "v2.2.2";
+  version = "v2.3.0";
   pname = "pebble";
 in buildGoPackage {
   inherit pname version;
@@ -14,13 +14,13 @@ in buildGoPackage {
     owner = "letsencrypt";
     repo = pname;
     rev = version;
-    sha256 = "10g6ivdxxp3632wk0gvmp75v9x668kchhmlczbsq8qnsc8sb8pwf";
+    sha256 = "1piwzzfqsdx6s2niczzp4mf4r3qn9nfdgpn7882g52cmmm0vzks2";
   };
 
   meta = {
-    homepage = "https://github.com/letsencrypt/boulder";
+    homepage = "https://github.com/letsencrypt/pebble";
     description = "A miniature version of Boulder, Pebble is a small RFC 8555 ACME test server not suited for a production CA";
     license = [ lib.licenses.mpl20 ];
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ emily ];
   };
 }
diff --git a/pkgs/tools/filesystems/fuse-overlayfs/default.nix b/pkgs/tools/filesystems/fuse-overlayfs/default.nix
index 0234794478829..4c8012de4f14d 100644
--- a/pkgs/tools/filesystems/fuse-overlayfs/default.nix
+++ b/pkgs/tools/filesystems/fuse-overlayfs/default.nix
@@ -1,21 +1,21 @@
-{ stdenv, lib, fetchFromGitHub, autoreconfHook, pkg-config, fuse3 }:
+{ stdenv, fetchFromGitHub, autoreconfHook, pkg-config, fuse3 }:
 
 stdenv.mkDerivation rec {
   pname = "fuse-overlayfs";
-  version = "0.7.8";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = "v${version}";
-    sha256 = "10wsssf9mxgkgcqks3z02y9ya8xh4wd45lsb1jrvw31wmz9zpalc";
+    sha256 = "0h1ay2l7zyiqplh8whanw68mcfri79lc03wjjrhqji5ddwznv6fa";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
 
   buildInputs = [ fuse3 ];
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "FUSE implementation for overlayfs";
     longDescription = "An implementation of overlay+shiftfs in FUSE for rootless containers.";
     license = licenses.gpl3;
diff --git a/pkgs/tools/misc/3mux/default.nix b/pkgs/tools/misc/3mux/default.nix
new file mode 100644
index 0000000000000..3371b79562374
--- /dev/null
+++ b/pkgs/tools/misc/3mux/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "3mux";
+  version = "0.2.0";
+
+  src = fetchFromGitHub {
+    owner = "aaronjanse";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "02ry066psvlqdyhimci7nskw4sfb70dw5z7ag7s7rz36gmx1vnmr";
+  };
+
+  modSha256 = "1ag9lx8xcp2z9lrg404914zin45n8f4s08365yk71q5vyiwxjj3i";
+
+  meta = with stdenv.lib; {
+    description = "Terminal multiplexer inspired by i3";
+    homepage = "https://github.com/aaronjanse/3mux";
+    license = licenses.mit;
+    maintainers = with maintainers; [ aaronjanse filalex77 ];
+    # TODO: fix modules build on darwin
+    broken = stdenv.isDarwin;
+  };
+}
diff --git a/pkgs/tools/misc/patdiff/default.nix b/pkgs/tools/misc/patdiff/default.nix
index 1c5e5b0447414..e0b54e56081dd 100644
--- a/pkgs/tools/misc/patdiff/default.nix
+++ b/pkgs/tools/misc/patdiff/default.nix
@@ -4,7 +4,7 @@ with ocamlPackages;
 
 janePackage {
   pname = "patdiff";
-  hash = "04krzn6rj2r81z55pms5ayk6bxhlxrm006cbhy0m6rc69a0h00lh";
+  hash = "1yqvxdmkgcwgx3npgncpdqwkpdxiqr1q41wci7589s8z7xi5nwyz";
   buildInputs = [ core_extended expect_test_helpers patience_diff ocaml_pcre shell ];
   meta = {
     description = "File Diff using the Patience Diff algorithm";
diff --git a/pkgs/tools/misc/statserial/default.nix b/pkgs/tools/misc/statserial/default.nix
new file mode 100644
index 0000000000000..66ae899b9c5a3
--- /dev/null
+++ b/pkgs/tools/misc/statserial/default.nix
@@ -0,0 +1,44 @@
+{ stdenv, fetchurl, ncurses, glibc }:
+
+stdenv.mkDerivation rec {
+  pname = "statserial";
+  version = "1.1";
+
+  src = fetchurl {
+    url = "http://www.ibiblio.org/pub/Linux/system/serial/${pname}-${version}.tar.gz";
+    sha256 = "0rrrmxfba5yn836zlgmr8g9xnrpash7cjs7lk2m44ac50vakpks0";
+  };
+
+  postPatch = ''
+    substituteInPlace Makefile \
+      --replace '-lcurses' '-lncurses'
+
+    substituteInPlace Makefile \
+      --replace 'LDFLAGS = -s -N' '#LDFLAGS = -s -N'
+  '';
+
+  buildInputs = [ ncurses glibc stdenv ];
+
+  installPhase = ''
+  mkdir -p $out/bin
+  cp statserial $out/bin
+
+  mkdir -p $out/share/man/man1
+  cp statserial.1 $out/share/man/man1
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "https://sites.google.com/site/tranter/software";
+    description = "Display serial port modem status lines.";
+    license = licenses.gpl2;
+
+    longDescription =
+      '' Statserial displays a table of the signals on a standard 9-pin or
+      25-pin serial port, and indicates the status of the handshaking lines. It
+      can be useful for debugging problems with serial ports or modems.
+      '';
+
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ rps ];
+  };
+}
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index d173b42dfc4ab..ba54b2c5671c1 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -28,14 +28,14 @@ assert brotliSupport -> brotli != null;
 assert gssSupport -> libkrb5 != null;
 
 stdenv.mkDerivation rec {
-  name = "curl-7.68.0";
+  name = "curl-7.69.1";
 
   src = fetchurl {
     urls = [
       "https://curl.haxx.se/download/${name}.tar.bz2"
       "https://github.com/curl/curl/releases/download/${lib.replaceStrings ["."] ["_"] name}/${name}.tar.bz2"
     ];
-    sha256 = "1fgf4f33wj25jk6lkpxmrvmfnnxvc66z3k3561rxr8nngn8m8zr0";
+    sha256 = "1s2ddjjif1wkp69vx25nzxklhimgqzaazfzliyl6mpvsa2yybx9g";
   };
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
diff --git a/pkgs/tools/networking/ferm/default.nix b/pkgs/tools/networking/ferm/default.nix
index dcd3fc6ae99fa..8fcdeb234ec36 100644
--- a/pkgs/tools/networking/ferm/default.nix
+++ b/pkgs/tools/networking/ferm/default.nix
@@ -1,12 +1,14 @@
 { stdenv, fetchurl, makeWrapper, perl, ebtables, ipset, iptables, nixosTests }:
 
-stdenv.mkDerivation rec {
-  version = "2.4.1";
+let
+  inherit (stdenv.lib.versions) majorMinor;
+in stdenv.mkDerivation rec {
+  version = "2.5";
   pname = "ferm";
 
   src = fetchurl {
-    url = "http://ferm.foo-projects.org/download/2.4/ferm-${version}.tar.xz";
-    sha256 = "1fv8wk513yysp4q0i65rl2m0hg2lxwwgk9ppprsca1xcxrdpsvwa";
+    url = "http://ferm.foo-projects.org/download/${majorMinor version}/ferm-${version}.tar.xz";
+    sha256 = "0lxqcpirphihpvdqrh5kq0621aqq0h2vdy9q2v85gqdhd52js20p";
   };
 
   buildInputs = [ perl ipset ebtables iptables makeWrapper ];
diff --git a/pkgs/tools/networking/gupnp-tools/default.nix b/pkgs/tools/networking/gupnp-tools/default.nix
index 21857b0f79fb1..c93873caa07f3 100644
--- a/pkgs/tools/networking/gupnp-tools/default.nix
+++ b/pkgs/tools/networking/gupnp-tools/default.nix
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
     description = "Set of utilities and demos to work with UPnP";
     homepage = "https://wiki.gnome.org/Projects/GUPnP";
     license = licenses.gpl2Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/networking/httpie/default.nix b/pkgs/tools/networking/httpie/default.nix
index f97d868d7bd2e..01986bf932192 100644
--- a/pkgs/tools/networking/httpie/default.nix
+++ b/pkgs/tools/networking/httpie/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "httpie";
-  version = "2.0.0";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "jakubroztocil";
     repo = "httpie";
     rev = version;
-    sha256 = "0d0rsn5i973l9y0ws3xmnzaw4jwxdlryyjbasnlddph5mvkf7dq0";
+    sha256 = "1vwjlzx830q4dcm3r7j9cl8yzka37dw42rl1r05m5ysb1081cbj2";
   };
 
   outputs = [ "out" "doc" "man" ];
diff --git a/pkgs/tools/networking/mitmproxy/default.nix b/pkgs/tools/networking/mitmproxy/default.nix
index 7a623ab69a68b..b9d873fad6af4 100644
--- a/pkgs/tools/networking/mitmproxy/default.nix
+++ b/pkgs/tools/networking/mitmproxy/default.nix
@@ -4,47 +4,15 @@ with python3Packages;
 
 buildPythonPackage rec {
   pname = "mitmproxy";
-  version = "4.0.4";
+  version = "5.1.1";
 
   src = fetchFromGitHub {
     owner  = pname;
     repo   = pname;
     rev    = "v${version}";
-    sha256 = "14i9dkafvyl15rq2qa8xldscn5lmkk2g52kbi2hl63nzx9yibx6r";
+    sha256 = "1lirlckpvd3c6s6q3p32w4k4yfna5mlgr1x9g39lhzzq0sdiz3lk";
   };
 
-  patches = [
-    (fetchpatch {
-      # Tests failed due to expired test certificates,
-      # https://github.com/mitmproxy/mitmproxy/issues/3316
-      # TODO: remove on next update
-      name = "test-certificates.patch";
-      url = "https://github.com/mitmproxy/mitmproxy/commit/1b6a8d6acd3d70f9b9627ad4ae9def08103f8250.patch";
-      sha256 = "03y79c25yir7d8xj79czdc81y3irqq1i3ks9ca0mv1az8b7xsvfv";
-    })
-    (fetchpatch {
-      # 0.13 <= wsproto < 0.14 patch
-      # https://github.com/mitmproxy/mitmproxy/issues/3459
-      # TODO: remove on next update
-      name = "wsproto-0.13.patch";
-      url = "https://github.com/mitmproxy/mitmproxy/commit/70777a1b6ed64af9cafcdef223a8a260ecc96864.patch";
-      sha256 = "1ddxdr7js510kzyq3gyks4k5k1n8zb1i9amxw7wzmi1dcg8kqw9a";
-      # We strip these bounds anyway
-      excludes = [ "setup.py" ];
-    })
-    (fetchpatch {
-      # Fix for newer pytest disallowing calling fixtures
-      # https://github.com/mitmproxy/mitmproxy/issues/3403
-      # TODO: remove on next update
-      name = "dont-call-fixtures.patch";
-      url = "https://github.com/mitmproxy/mitmproxy/commit/ce28721458c8cc71de86513a5110676e9763041b.patch";
-      sha256 = "05pljr28lx7l1xgswqr9sz8dnhvc7npzh8xg2p9hignf159kd54d";
-      # Irrelevant in nixpkgs
-      excludes = [ "setup.py" "setup.cfg" "release/docker/*" ];
-    })
-    ./pytest5.patch
-  ];
-
   postPatch = ''
     # remove dependency constraints
     sed 's/>=\([0-9]\.\?\)\+\( \?, \?<\([0-9]\.\?\)\+\)\?//' -i setup.py
@@ -61,17 +29,21 @@ buildPythonPackage rec {
   '';
 
   propagatedBuildInputs = [
-    blinker click certifi cryptography
-    h2 hyperframe kaitaistruct passlib
-    pyasn1 pyopenssl pyparsing pyperclip
-    ruamel_yaml tornado urwid brotlipy
-    sortedcontainers ldap3 wsproto setuptools
+    blinker brotli certifi cffi
+    click cryptography flask h11
+    h2 hpack hyperframe itsdangerous
+    jinja2 kaitaistruct ldap3 markupsafe
+    passlib protobuf publicsuffix2 pyasn1
+    pycparser pyopenssl pyparsing pyperclip
+    ruamel_yaml setuptools six sortedcontainers
+    tornado urwid werkzeug wsproto zstandard
   ];
 
   checkInputs = [
     beautifulsoup4 flask pytest
     requests glibcLocales
     asynctest parver pytest-asyncio
+    hypothesis
   ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/networking/mitmproxy/pytest5.patch b/pkgs/tools/networking/mitmproxy/pytest5.patch
deleted file mode 100644
index bfbf7253b9c40..0000000000000
--- a/pkgs/tools/networking/mitmproxy/pytest5.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-diff --git a/test/mitmproxy/net/test_tls.py b/test/mitmproxy/net/test_tls.py
-index 489bf89f..c78472e3 100644
---- a/test/mitmproxy/net/test_tls.py
-+++ b/test/mitmproxy/net/test_tls.py
-@@ -87,14 +87,16 @@ def test_get_client_hello():
-     rfile = io.BufferedReader(io.BytesIO(
-         FULL_CLIENT_HELLO_NO_EXTENSIONS[:30]
-     ))
--    with pytest.raises(exceptions.TlsProtocolException, message="Unexpected EOF"):
-+    with pytest.raises(exceptions.TlsProtocolException):
-         tls.get_client_hello(rfile)
-+        pytest.fail("Unexpected EOF")
- 
-     rfile = io.BufferedReader(io.BytesIO(
-         b"GET /"
-     ))
--    with pytest.raises(exceptions.TlsProtocolException, message="Expected TLS record"):
-+    with pytest.raises(exceptions.TlsProtocolException):
-         tls.get_client_hello(rfile)
-+        pytest.fail("Expected TLS record")
- 
- 
- class TestClientHello:
-@@ -153,5 +155,6 @@ class TestClientHello:
-             b"\x01\x00\x00\x03" +  # handshake header
-             b"foo"
-         ))
--        with pytest.raises(exceptions.TlsProtocolException, message='Cannot parse Client Hello'):
-+        with pytest.raises(exceptions.TlsProtocolException):
-             tls.ClientHello.from_file(rfile)
-+            pytest.fail('Cannot parse Client Hello')
diff --git a/pkgs/tools/networking/modem-manager/default.nix b/pkgs/tools/networking/modem-manager/default.nix
index e9d925fb930c5..badfddd6d50c2 100644
--- a/pkgs/tools/networking/modem-manager/default.nix
+++ b/pkgs/tools/networking/modem-manager/default.nix
@@ -30,6 +30,8 @@ stdenv.mkDerivation rec {
     export G_TEST_DBUS_DAEMON="${dbus.daemon}/bin/dbus-daemon"
   '';
 
+  enableParallelBuilding = true;
+
   doCheck = true;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/networking/mu/default.nix b/pkgs/tools/networking/mu/default.nix
index 2e6a401350cdc..ae1ca3f776113 100644
--- a/pkgs/tools/networking/mu/default.nix
+++ b/pkgs/tools/networking/mu/default.nix
@@ -5,20 +5,15 @@
 
 stdenv.mkDerivation rec {
   pname = "mu";
-  version = "1.2";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner  = "djcb";
     repo   = "mu";
     rev    = version;
-    sha256 = "0yhjlj0z23jw3cf2wfnl98y8q6gikvmhkb8vdm87bd7jw0bdnrfz";
+    sha256 = "0q2ik7fj5k9i76js4ijyxbgrwqff437lass0sd5if2r40rqh0as0";
   };
 
-  # test-utils coredumps so don't run those
-  postPatch = ''
-    sed -i -e '/test-utils/d' lib/parser/Makefile.am
-  '';
-
   buildInputs = [
     sqlite xapian glib gmime3 texinfo emacs guile libsoup icu
   ] ++ stdenv.lib.optionals withMug [ gtk3 webkitgtk ];
@@ -27,19 +22,17 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  preConfigure = "./autogen.sh";
+
   preBuild = ''
     # Fix mu4e-builddir (set it to $out)
     substituteInPlace mu4e/mu4e-meta.el.in \
       --replace "@abs_top_builddir@" "$out"
-
-    # We install msg2pdf to bin/msg2pdf, fix its location in elisp
-    substituteInPlace mu4e/mu4e-actions.el \
-      --replace "/toys/msg2pdf/" "/bin/"
   '';
 
-  # Install mug and msg2pdf
+  # Install mug
   postInstall = stdenv.lib.optionalString withMug ''
-    for f in msg2pdf mug ; do
+    for f in mug ; do
       install -m755 toys/$f/$f $out/bin/$f
     done
   '';
diff --git a/pkgs/tools/networking/rshijack/default.nix b/pkgs/tools/networking/rshijack/default.nix
new file mode 100644
index 0000000000000..59558028c01e7
--- /dev/null
+++ b/pkgs/tools/networking/rshijack/default.nix
@@ -0,0 +1,23 @@
+{ lib, fetchFromGitHub, rustPlatform }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "rshijack";
+  version = "0.3.0";
+
+  src = fetchFromGitHub {
+    owner = "kpcyrd";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0y01hi3jpfawqlqs8ka0vwfhjw5j5gkhk2nz5m13ns2h27bw20v7";
+  };
+
+  cargoSha256 = "0l1kavacnjvi22l6pawgkqqxnjaizi3pddqkhwjshw4pzzixzvli";
+
+  meta = with lib; {
+    description = "TCP connection hijacker";
+    homepage = "https://github.com/kpcyrd/rshijack";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ xrelkd ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/tools/networking/sniffglue/default.nix b/pkgs/tools/networking/sniffglue/default.nix
new file mode 100644
index 0000000000000..83f1e372aa585
--- /dev/null
+++ b/pkgs/tools/networking/sniffglue/default.nix
@@ -0,0 +1,27 @@
+{ lib, fetchFromGitHub, rustPlatform, libpcap, libseccomp, pkgconfig }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "sniffglue";
+  version = "0.10.1";
+
+  src = fetchFromGitHub {
+    owner = "kpcyrd";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0vyxlqwh90shihp80fk0plnkjix9i37n2dnypzyz6nx44xd5737s";
+  };
+
+  cargoSha256 = "162p3a696k281cygqpl6gg4makwk2v0g2jnf1gd108dnz4jya11l";
+
+  nativeBuildInputs = [ pkgconfig ];
+
+  buildInputs = [ libpcap libseccomp ];
+
+  meta = with lib; {
+    description = "Secure multithreaded packet sniffer";
+    homepage = "https://github.com/kpcyrd/sniffglue";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ xrelkd ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/tools/security/age/default.nix b/pkgs/tools/security/age/default.nix
index bde597ba9f30f..c8b4f069f7955 100644
--- a/pkgs/tools/security/age/default.nix
+++ b/pkgs/tools/security/age/default.nix
@@ -2,9 +2,9 @@
 
 buildGoModule rec {
   pname = "age";
-  version = "1.0.0-beta2";
+  version = "unstable-2020-03-25";
   goPackagePath = "github.com/FiloSottile/age";
-  modSha256 = "0kwdwhkxgqjd8h1p7pm4h4xidp2vk840h1j4qya4qz8bjf9vskl9";
+  modSha256 = "00yhn1894ni8bvkqm1vr0rqkky52pkhvdzbi2sqx3czlgb5ibw3h";
 
   subPackages = [
     "cmd/age"
@@ -14,8 +14,8 @@ buildGoModule rec {
   src = fetchFromGitHub {
     owner = "FiloSottile";
     repo = "age";
-    rev = "v${version}";
-    sha256 = "1n1ww8yjw0mg00dvnfmggww9kwp1hls0a85iv6vx9k89mzv8mdrq";
+    rev = "f0f8092d60bb96737fa096c29ec6d8adb5810390";
+    sha256 = "079kfc8d1pr39hr4qnx48kviyzwg4p8m4pz0bdkypns4aq8ppbfk";
   };
 
   meta = with lib; {
diff --git a/pkgs/tools/security/gnome-keysign/default.nix b/pkgs/tools/security/gnome-keysign/default.nix
index 9f87684cae31f..c2f6da9812f72 100644
--- a/pkgs/tools/security/gnome-keysign/default.nix
+++ b/pkgs/tools/security/gnome-keysign/default.nix
@@ -84,7 +84,7 @@ python3.pkgs.buildPythonApplication rec {
     description = "GTK/GNOME application to use GnuPG for signing other peoples’ keys";
     homepage = "https://wiki.gnome.org/Apps/Keysign";
     license = licenses.gpl3Plus;
-    maintainers = gnome3.maintainers;
+    maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/system/plan9port/default.nix b/pkgs/tools/system/plan9port/default.nix
index db206fa0b3383..54e88f5d06994 100644
--- a/pkgs/tools/system/plan9port/default.nix
+++ b/pkgs/tools/system/plan9port/default.nix
@@ -11,17 +11,16 @@
 
 stdenv.mkDerivation {
   pname = "plan9port";
-  version = "2019-02-25";
+  version = "2020-01-08";
 
   src =  fetchFromGitHub {
     owner = "9fans";
     repo = "plan9port";
-    rev = "047fd921744f39a82a86d9370e03f7af511e6e84";
-    sha256 = "1lp17948q7vpl8rc2bf5a45bc8jqyj0s3zffmks9r25ai42vgb43";
+    rev = "cc3d97d52a72d7eaceb5b636bcdf81c3e19f7a2e";
+    sha256 = "0gb55kj0gzx1kdhiwcrbr7xcgz1im21dyxgxhfhh6d0q9rw0c17g";
   };
 
   patches = [
-    ./tmpdir.patch
     ./darwin-sw_vers.patch
     ./darwin-cfframework.patch
   ];
@@ -90,7 +89,7 @@ stdenv.mkDerivation {
     license = licenses.lpl-102;
     maintainers = with maintainers; [ AndersonTorres bbarker
                                       ftrvxmtrx kovirobi ];
-    platforms = platforms.unix;
+    platforms = remove "aarch64-linux" platforms.unix;
   };
 }
 # TODO: investigate the mouse chording support patch
diff --git a/pkgs/tools/system/plan9port/tmpdir.patch b/pkgs/tools/system/plan9port/tmpdir.patch
deleted file mode 100644
index e8200a177a274..0000000000000
--- a/pkgs/tools/system/plan9port/tmpdir.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From c762625549ff367b54bcd8281d1ce248a69b4401 Mon Sep 17 00:00:00 2001
-From: Jason Felice <jason.m.felice@gmail.com>
-Date: Mon, 1 Jul 2019 15:01:21 -0400
-Subject: [PATCH] Use $TMPDIR if available
-
-NixOS sandboxed builds (at least on Mac) don't have access to /tmp,
-and this should be better POSIX.
----
- bin/9c | 2 +-
- bin/9l | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/bin/9c b/bin/9c
-index 3ffb716c..88c47887 100755
---- a/bin/9c
-+++ b/bin/9c
-@@ -133,7 +133,7 @@ case "$tag" in
- esac
- 
- # N.B. Must use temp file to avoid pipe; pipe loses status.
--xtmp=/tmp/9c.$$.$USER.out
-+xtmp=${TMPDIR-/tmp}/9c.$$.$USER.out
- $cc -DPLAN9PORT -I$PLAN9/include $cflags "$@" 2>$xtmp
- status=$?
- quiet $xtmp
-diff --git a/bin/9l b/bin/9l
-index 6195815f..717a540a 100755
---- a/bin/9l
-+++ b/bin/9l
-@@ -346,7 +346,7 @@ then
- 	echo $ld -L$PLAN9/lib "$@" $libsl $extralibs $frameworks
- fi
- 
--xtmp=/tmp/9l.$$.$USER.out
-+xtmp="${TMPDIR-/tmp}/9l.$$.$USER.out"
- xxout() {
- 	sed 's/.*: In function `[^:]*: *//' $xtmp | egrep . | 
- 	egrep -v 'is (often|almost always) misused|is dangerous, better use|text-based stub' 
--- 
-2.21.0
-
diff --git a/pkgs/tools/system/tuptime/default.nix b/pkgs/tools/system/tuptime/default.nix
new file mode 100644
index 0000000000000..acc96998952d8
--- /dev/null
+++ b/pkgs/tools/system/tuptime/default.nix
@@ -0,0 +1,35 @@
+{ stdenv, fetchFromGitHub, python3 }:
+
+stdenv.mkDerivation rec {
+  pname = "tuptime";
+  version = "4.1.0";
+
+  src = fetchFromGitHub {
+    owner = "rfrail3";
+    repo = "tuptime";
+    rev = version;
+    sha256 = "0p5v1jp6bl0hjv04q3gh11q6dx9z0x61h6svcbvwp5ni0h1bkz1a";
+  };
+
+  buildInputs = [ python3 ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    install -m 755 src/tuptime $out/bin/
+
+    mkdir -p $out/share/man/man1
+    cp src/man/tuptime.1 $out/share/man/man1/
+
+    # upstream only ships this, there are more scripts there...
+    mkdir -p $out/usr/share/doc/tuptime/contrib
+    cp misc/scripts/uptimed-to-tuptime.py $out/usr/share/doc/tuptime/contrib/
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Total uptime & downtime statistics utility";
+    homepage = "https://github.com/rfrail3/tuptime";
+    license = licenses.gpl2;
+    platforms = platforms.all;
+    maintainers = [ maintainers.evils ];
+  };
+}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 73e2ee3a20743..4b2b36eb352c8 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -152,6 +152,7 @@ mapAliases ({
   gettextWithExpat = gettext; # 2016-02-19
   git-hub = gitAndTools.git-hub; # added 2016-04-29
   glib_networking = glib-networking; # added 2018-02-25
+  gmailieer = lieer; # added 2020-04-19
   gnome-mpv = celluloid; # added 2019-08-22
   gnome15 = throw "gnome15 has been removed from nixpkgs, as it's unmaintained and depends on deprecated libraries."; # added 2019-12-10
   gmic_krita_qt = gmic-qt-krita; # added 2019-09-07
@@ -245,11 +246,18 @@ mapAliases ({
   librecad2 = librecad;  # backwards compatibility alias, added 2015-10
   libsysfs = sysfsutils; # added 2018-04-25
   libtidy = html-tidy;  # added 2014-12-21
+  libtxc_dxtn = throw "removed 2020-03-16, now integrated in Mesa";
+  libtxc_dxtn_s2tc = throw "removed 2020-03-16, now integrated in Mesa";
   libudev = udev; # added 2018-04-25
   libsexy = throw "libsexy has been removed from nixpkgs, as it's abandoned and no package needed it."; # 2019-12-10
   links = links2; # added 2016-01-31
   linux_rpi0 = linux_rpi1;
   linuxPackages_rpi0 = linuxPackages_rpi1;
+
+  # added 2020-04-04
+  linuxPackages_testing_hardened = throw "linuxPackages_testing_hardened has been removed, please use linuxPackages_latest_hardened";
+  linux_testing_hardened = throw "linux_testing_hardened has been removed, please use linux_latest_hardened";
+
   loadcaffe = throw "loadcaffe has been removed, as the upstream project has been abandoned"; # added 2020-03-28
   lttngTools = lttng-tools;  # added 2014-07-31
   lttngUst = lttng-ust;  # added 2014-07-31
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ef8ea2a268c72..4181f6470fe05 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -510,6 +510,8 @@ in
 
   _3llo = callPackage ../tools/misc/3llo { };
 
+  _3mux = callPackage ../tools/misc/3mux { };
+
   _1password = callPackage ../applications/misc/1password { };
 
   _6tunnel = callPackage ../tools/networking/6tunnel { };
@@ -2141,6 +2143,8 @@ in
 
   stagit = callPackage ../development/tools/stagit { };
 
+  statserial = callPackage ../tools/misc/statserial { };
+
   step-ca = callPackage ../tools/security/step-ca { };
 
   step-cli = callPackage ../tools/security/step-cli { };
@@ -6343,6 +6347,8 @@ in
 
   rrdtool = callPackage ../tools/misc/rrdtool { };
 
+  rshijack = callPackage ../tools/networking/rshijack { };
+
   rsibreak = libsForQt5.callPackage ../applications/misc/rsibreak { };
 
   rss2email = callPackage ../applications/networking/feedreaders/rss2email {
@@ -6633,6 +6639,8 @@ in
     libpng = libpng12;
   };
 
+  sniffglue = callPackage ../tools/networking/sniffglue { };
+
   snort = callPackage ../applications/networking/ids/snort { };
 
   soapui = callPackage ../applications/networking/soapui { };
@@ -7108,6 +7116,8 @@ in
 
   tuir = callPackage ../applications/misc/tuir { };
 
+  tuptime = callPackage ../tools/system/tuptime { };
+
   turses = callPackage ../applications/networking/instant-messengers/turses { };
 
   oysttyer = callPackage ../applications/networking/instant-messengers/oysttyer { };
@@ -9139,7 +9149,7 @@ in
   tinycc = callPackage ../development/compilers/tinycc { };
 
   tinygo = callPackage ../development/compilers/tinygo {
-    inherit (llvmPackages_9) llvm clang-unwrapped lld;
+    inherit (llvmPackages_10) llvm clang-unwrapped lld;
     avrgcc = pkgsCross.avr.buildPackages.gcc;
   };
 
@@ -12984,6 +12994,8 @@ in
 
   libiptcdata = callPackage ../development/libraries/libiptcdata { };
 
+  libjcat = callPackage ../development/libraries/libjcat { };
+
   libjpeg_original = callPackage ../development/libraries/libjpeg { };
   libjpeg_turbo = callPackage ../development/libraries/libjpeg-turbo { };
   libjpeg_drop = callPackage ../development/libraries/libjpeg-drop { };
@@ -13266,10 +13278,6 @@ in
 
   libtsm = callPackage ../development/libraries/libtsm { };
 
-  libtxc_dxtn = callPackage ../development/libraries/libtxc_dxtn { };
-
-  libtxc_dxtn_s2tc = callPackage ../development/libraries/libtxc_dxtn_s2tc { };
-
   libgeotiff = callPackage ../development/libraries/libgeotiff { };
 
   libu2f-host = callPackage ../development/libraries/libu2f-host { };
@@ -15517,6 +15525,8 @@ in
 
   home-assistant-cli = callPackage ../servers/home-assistant/cli.nix { };
 
+  https-dns-proxy = callPackage ../servers/dns/https-dns-proxy { };
+
   hydron = callPackage ../servers/hydron { };
 
   icingaweb2 = callPackage ../servers/icingaweb2 { };
@@ -16272,6 +16282,10 @@ in
   alsaOss = callPackage ../os-specific/linux/alsa-oss { };
   alsaTools = callPackage ../os-specific/linux/alsa-tools { };
 
+  alsa-ucm-conf = callPackage ../os-specific/linux/alsa-ucm-conf { };
+
+  alsa-topology-conf = callPackage ../os-specific/linux/alsa-topology-conf { };
+
   inherit (callPackage ../misc/arm-trusted-firmware {})
     buildArmTrustedFirmware
     armTrustedFirmwareTools
@@ -16459,8 +16473,6 @@ in
 
   gfxtablet = callPackage ../os-specific/linux/gfxtablet {};
 
-  gmailieer = callPackage ../applications/networking/gmailieer {};
-
   gmailctl = callPackage ../applications/networking/gmailctl {};
 
   gpm = callPackage ../servers/gpm {
@@ -16567,6 +16579,8 @@ in
 
   libnl = callPackage ../os-specific/linux/libnl { };
 
+  lieer = callPackage ../applications/networking/lieer {};
+
   linuxConsoleTools = callPackage ../os-specific/linux/consoletools { };
 
   openelec-dvb-firmware = callPackage ../os-specific/linux/firmware/openelec-dvb-firmware { };
@@ -16979,7 +16993,10 @@ in
       inherit stdenv;
       inherit (kernel) version;
     };
-    kernelPatches = kernel.kernelPatches ++ [ kernelPatches.tag_hardened ];
+    kernelPatches = kernel.kernelPatches ++ [
+      kernelPatches.tag_hardened
+      kernelPatches.hardened.${kernel.version}
+    ];
     modDirVersionArg = kernel.modDirVersion + "-hardened";
   });
 
@@ -16989,9 +17006,6 @@ in
   linuxPackages_latest_hardened = recurseIntoAttrs (hardenedLinuxPackagesFor pkgs.linux_latest);
   linux_latest_hardened = linuxPackages_latest_hardened.kernel;
 
-  linuxPackages_testing_hardened = recurseIntoAttrs (hardenedLinuxPackagesFor pkgs.linux_testing);
-  linux_testing_hardened = linuxPackages_testing_hardened.kernel;
-
   linuxPackages_xen_dom0_hardened = recurseIntoAttrs (hardenedLinuxPackagesFor (pkgs.linux.override { features.xen_dom0=true; }));
 
   linuxPackages_latest_xen_dom0_hardened = recurseIntoAttrs (hardenedLinuxPackagesFor (pkgs.linux_latest.override { features.xen_dom0=true; }));
@@ -21425,6 +21439,8 @@ in
 
   qtchan = libsForQt5.callPackage ../applications/networking/browsers/qtchan { };
 
+  qtemu = libsForQt5.callPackage ../applications/virtualization/qtemu { };
+
   qtox = libsForQt5.callPackage ../applications/networking/instant-messengers/qtox { };
 
   qtpass = libsForQt5.callPackage ../applications/misc/qtpass { };
@@ -23599,10 +23615,7 @@ in
 
   openclonk = callPackage ../games/openclonk { };
 
-  openjk = callPackage ../games/openjk {
-    # segfaults when built with gcc9
-    stdenv = gcc8Stdenv;
-  };
+  openjk = callPackage ../games/openjk { };
 
   openmw = libsForQt5.callPackage ../games/openmw { };
 
@@ -25830,7 +25843,9 @@ in
 
   sanoid = callPackage ../tools/backup/sanoid { };
 
-  satysfi = callPackage ../tools/typesetting/satysfi { };
+  satysfi = callPackage ../tools/typesetting/satysfi {
+    ocamlPackages = ocaml-ng.ocamlPackages_4_07;
+  };
 
   sc-controller = pythonPackages.callPackage ../misc/drivers/sc-controller {
     inherit libusb1; # Shadow python.pkgs.libusb1.
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index b976d36c73094..b5d8abade0909 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -234,6 +234,8 @@ let
 
     dune_2 = callPackage ../development/tools/ocaml/dune/2.nix { };
 
+    dune-build-info = callPackage ../development/ocaml-modules/dune-build-info { };
+
     dune-configurator = callPackage ../development/ocaml-modules/dune-configurator { };
 
     dune-private-libs = callPackage ../development/ocaml-modules/dune-private-libs { };
@@ -978,12 +980,20 @@ let
     # Jane Street
 
     janePackage =
-      if lib.versionOlder "4.07" ocaml.version
+      if lib.versionOlder "4.08" ocaml.version
+      then callPackage ../development/ocaml-modules/janestreet/janePackage_0_13.nix {}
+      else if lib.versionOlder "4.07" ocaml.version
       then callPackage ../development/ocaml-modules/janestreet/janePackage_0_12.nix {}
       else callPackage ../development/ocaml-modules/janestreet/janePackage.nix {};
 
     janeStreet =
-    if lib.versionOlder "4.07" ocaml.version
+    if lib.versionOlder "4.08" ocaml.version
+    then import ../development/ocaml-modules/janestreet/0.13.nix {
+      inherit ctypes janePackage num octavius re;
+      inherit (pkgs) openssl;
+      ppxlib = ppxlib.override { version = "0.12.0"; };
+    }
+    else if lib.versionOlder "4.07" ocaml.version
     then import ../development/ocaml-modules/janestreet/0.12.nix {
       inherit ctypes janePackage num octavius ppxlib re;
       inherit (pkgs) openssl;
@@ -1232,11 +1242,6 @@ let
       then callPackage ../development/ocaml-modules/janestreet/async.nix {}
       else async_p4;
 
-    async_ssl =
-      if lib.versionOlder "4.03" ocaml.version
-      then janeStreet.async_ssl
-      else callPackage ../development/ocaml-modules/janestreet/async_ssl.nix { };
-
     # Apps / from all-packages
 
     ocamlnat = callPackage  ../development/ocaml-modules/ocamlnat { };
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 94c5387e0e716..d3e9ca144fc34 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -16811,7 +16811,7 @@ let
       sha256 = "f98a10c625640170cdda408cccc72bdd7f66f8ebe5f59dec1b96185171ef11d0";
     };
     meta = {
-      #homepage = http://web-cpan.berlios.de/modules/Statistics-Descriptive/; # berlios shut down; I found no replacement
+      #homepage = "http://web-cpan.berlios.de/modules/Statistics-Descriptive/"; # berlios shut down; I found no replacement
       description = "Module of basic descriptive statistical functions";
       license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
     };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index ac6b5f592208e..6a8c5a3d56a84 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1025,6 +1025,8 @@ in {
 
   pdfminer = callPackage ../development/python-modules/pdfminer_six { };
 
+  pdfposter = callPackage ../development/python-modules/pdfposter { };
+
   pdftotext = callPackage ../development/python-modules/pdftotext { };
 
   pdfx = callPackage ../development/python-modules/pdfx { };
@@ -5036,6 +5038,8 @@ in {
 
   publicsuffix = callPackage ../development/python-modules/publicsuffix {};
 
+  publicsuffix2 = callPackage ../development/python-modules/publicsuffix2 {};
+
   py = callPackage ../development/python-modules/py { };
 
   pyacoustid = callPackage ../development/python-modules/pyacoustid { };