about summary refs log tree commit diff
path: root/pkgs
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs')
-rw-r--r--pkgs/applications/audio/reaper/default.nix8
-rw-r--r--pkgs/applications/editors/gnome-latex/default.nix4
-rw-r--r--pkgs/applications/graphics/avocode/default.nix4
-rw-r--r--pkgs/applications/misc/cheat/default.nix5
-rw-r--r--pkgs/applications/misc/clight/clightd.nix4
-rw-r--r--pkgs/applications/misc/ikiwiki/default.nix8
-rw-r--r--pkgs/applications/misc/sleepyhead/default.nix20
-rw-r--r--pkgs/applications/misc/systembus-notify/default.nix30
-rwxr-xr-xpkgs/applications/networking/instant-messengers/ripcord/default.nix4
-rw-r--r--pkgs/applications/networking/lieer/default.nix6
-rw-r--r--pkgs/applications/networking/p2p/transmission/default.nix112
-rw-r--r--pkgs/applications/networking/sniffers/sngrep/default.nix4
-rw-r--r--pkgs/applications/office/gnumeric/default.nix4
-rw-r--r--pkgs/applications/science/logic/lean/default.nix4
-rw-r--r--pkgs/applications/science/misc/snakemake/default.nix4
-rw-r--r--pkgs/applications/version-management/bazaar/CVE-2017-14176.patch149
-rw-r--r--pkgs/applications/version-management/bazaar/add_certificates.patch11
-rw-r--r--pkgs/applications/version-management/bazaar/default.nix36
-rw-r--r--pkgs/applications/version-management/bazaar/tools.nix20
-rw-r--r--pkgs/applications/version-management/cvs2svn/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/default.nix2
-rw-r--r--pkgs/applications/version-management/git-and-tools/gitin/default.nix33
-rw-r--r--pkgs/applications/version-management/git-and-tools/gitin/deps.nix121
-rw-r--r--pkgs/applications/version-management/gitlab/gitaly/default.nix11
-rw-r--r--pkgs/applications/version-management/reposurgeon/default.nix4
-rw-r--r--pkgs/applications/virtualization/cri-o/wrapper.nix53
-rw-r--r--pkgs/applications/virtualization/podman/wrapper.nix4
-rw-r--r--pkgs/applications/virtualization/qboot/default.nix12
-rw-r--r--pkgs/applications/window-managers/picom/default.nix4
-rwxr-xr-xpkgs/build-support/docker/nix-prefetch-docker7
-rwxr-xr-xpkgs/build-support/docker/store-path-to-layer.sh7
-rw-r--r--pkgs/build-support/fetchbzr/default.nix4
-rw-r--r--pkgs/build-support/fetchgitlab/default.nix3
-rw-r--r--pkgs/data/fonts/tamzen/default.nix47
-rw-r--r--pkgs/data/misc/osinfo-db/default.nix4
-rw-r--r--pkgs/data/themes/matcha/default.nix4
-rw-r--r--pkgs/data/themes/plano/default.nix37
-rw-r--r--pkgs/data/themes/yaru/default.nix4
-rw-r--r--pkgs/desktops/lxqt/lxqt-panel/default.nix66
-rw-r--r--pkgs/development/compilers/fpc/lazarus.nix9
-rw-r--r--pkgs/development/compilers/jsonnet/default.nix4
-rw-r--r--pkgs/development/libraries/apache-activemq/default.nix4
-rw-r--r--pkgs/development/libraries/biblesync/default.nix6
-rw-r--r--pkgs/development/libraries/comedilib/default.nix55
-rw-r--r--pkgs/development/libraries/libfprint/default.nix54
-rw-r--r--pkgs/development/libraries/libosinfo/default.nix9
-rw-r--r--pkgs/development/libraries/libpam-wrapper/default.nix33
-rw-r--r--pkgs/development/libraries/libuchardet/default.nix4
-rw-r--r--pkgs/development/libraries/libxsmm/default.nix6
-rw-r--r--pkgs/development/libraries/lyra/default.nix4
-rw-r--r--pkgs/development/libraries/qgnomeplatform/default.nix4
-rw-r--r--pkgs/development/libraries/qtstyleplugin-kvantum-qt4/default.nix4
-rw-r--r--pkgs/development/libraries/sqlcipher/default.nix16
-rw-r--r--pkgs/development/ocaml-modules/afl-persistent/default.nix39
-rw-r--r--pkgs/development/python-modules/Wand/default.nix4
-rw-r--r--pkgs/development/python-modules/codespell/default.nix4
-rw-r--r--pkgs/development/python-modules/mpv/default.nix4
-rw-r--r--pkgs/development/python-modules/nuitka/default.nix4
-rw-r--r--pkgs/development/python-modules/opt-einsum/default.nix4
-rw-r--r--pkgs/development/python-modules/parsel/default.nix7
-rw-r--r--pkgs/development/python-modules/pdf2image/default.nix4
-rw-r--r--pkgs/development/python-modules/pyftdi/default.nix4
-rw-r--r--pkgs/development/python-modules/python-utils/default.nix4
-rw-r--r--pkgs/development/python-modules/stripe/default.nix4
-rw-r--r--pkgs/development/python-modules/trimesh/default.nix4
-rw-r--r--pkgs/development/python-modules/unidiff/default.nix4
-rw-r--r--pkgs/development/tools/buildah/wrapper.nix52
-rw-r--r--pkgs/development/tools/cloudflare-wrangler/default.nix6
-rw-r--r--pkgs/development/tools/flatpak-builder/default.nix4
-rw-r--r--pkgs/development/tools/just/default.nix6
-rw-r--r--pkgs/development/tools/misc/circleci-cli/default.nix4
-rw-r--r--pkgs/development/tools/misc/hydra/common.nix6
-rw-r--r--pkgs/development/tools/misc/uncrustify/default.nix4
-rw-r--r--pkgs/development/tools/omnisharp-roslyn/default.nix7
-rw-r--r--pkgs/development/tools/spring-boot-cli/default.nix4
-rw-r--r--pkgs/development/tools/vcstool/default.nix4
-rw-r--r--pkgs/games/factorio/default.nix11
-rw-r--r--pkgs/games/katago/default.nix20
-rw-r--r--pkgs/misc/vim-plugins/generated.nix12
-rw-r--r--pkgs/misc/vim-plugins/vim-plugin-names1
-rw-r--r--pkgs/os-specific/linux/libfabric/default.nix4
-rw-r--r--pkgs/os-specific/linux/usbguard/default.nix4
-rw-r--r--pkgs/servers/dns/knot-dns/default.nix4
-rw-r--r--pkgs/servers/monitoring/loki/default.nix4
-rw-r--r--pkgs/servers/monitoring/sensu-go/default.nix4
-rw-r--r--pkgs/servers/monitoring/telegraf/default.nix4
-rw-r--r--pkgs/servers/web-apps/engelsystem/default.nix52
-rw-r--r--pkgs/servers/xmpp/prosody/default.nix9
-rw-r--r--pkgs/shells/zsh/oh-my-zsh/default.nix6
-rw-r--r--pkgs/tools/backup/bup/default.nix4
-rw-r--r--pkgs/tools/backup/monolith/default.nix14
-rw-r--r--pkgs/tools/graphics/imgurbash2/default.nix4
-rw-r--r--pkgs/tools/misc/jdupes/default.nix4
-rw-r--r--pkgs/tools/misc/osinfo-db-tools/default.nix10
-rw-r--r--pkgs/tools/misc/zoxide/default.nix6
-rw-r--r--pkgs/tools/networking/amass/default.nix4
-rw-r--r--pkgs/tools/networking/ofono/0001-Search-connectors-in-OFONO_PLUGIN_PATH.patch2
-rw-r--r--pkgs/tools/package-management/nix-prefetch-scripts/default.nix4
-rw-r--r--pkgs/tools/security/fprintd/default.nix104
-rw-r--r--pkgs/tools/security/hcxdumptool/default.nix4
-rw-r--r--pkgs/tools/security/tpm2-tools/default.nix4
-rw-r--r--pkgs/tools/security/yara/default.nix28
-rw-r--r--pkgs/tools/system/disk-filltest/default.nix38
-rw-r--r--pkgs/tools/system/stress-ng/default.nix4
-rw-r--r--pkgs/tools/text/mdcat/default.nix6
-rw-r--r--pkgs/top-level/aliases.nix2
-rw-r--r--pkgs/top-level/all-packages.nix46
-rw-r--r--pkgs/top-level/ocaml-packages.nix2
-rw-r--r--pkgs/top-level/python-packages.nix20
109 files changed, 1097 insertions, 615 deletions
diff --git a/pkgs/applications/audio/reaper/default.nix b/pkgs/applications/audio/reaper/default.nix
index 2e63a3e8c7cda..9de70d83ee5ef 100644
--- a/pkgs/applications/audio/reaper/default.nix
+++ b/pkgs/applications/audio/reaper/default.nix
@@ -1,16 +1,16 @@
 { stdenv, fetchurl, autoPatchelfHook, makeWrapper
-, alsaLib, xorg
+, alsaLib, xorg, libjack2
 , gtk3, pango, gdk-pixbuf, cairo, glib, freetype
 , libpulseaudio, xdg_utils
 }:
 
 stdenv.mkDerivation rec {
   pname = "reaper";
-  version = "5.987";
+  version = "6.10";
 
   src = fetchurl {
     url = "https://www.reaper.fm/files/${stdenv.lib.versions.major version}.x/reaper${builtins.replaceStrings ["."] [""] version}_linux_x86_64.tar.xz";
-    sha256 = "040k5inzj7mmi75fc6hr0ym18y5xss1675bl5rmhn4sq535m289k";
+    sha256 = "1p54phmsa6xbqxb5cpgwnz7ny4famb8zi25y3cmxwgr4pfy94b2p";
   };
 
   nativeBuildInputs = [ autoPatchelfHook makeWrapper ];
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
     rm $out/opt/REAPER/uninstall-reaper.sh
 
     wrapProgram $out/opt/REAPER/reaper \
-      --prefix LD_LIBRARY_PATH : ${libpulseaudio}/lib
+      --prefix LD_LIBRARY_PATH : "${stdenv.lib.makeLibraryPath [ libpulseaudio libjack2 ]}"
 
     mkdir $out/bin
     ln -s $out/opt/REAPER/reaper $out/bin/
diff --git a/pkgs/applications/editors/gnome-latex/default.nix b/pkgs/applications/editors/gnome-latex/default.nix
index 33a321329341f..695a13eecabdd 100644
--- a/pkgs/applications/editors/gnome-latex/default.nix
+++ b/pkgs/applications/editors/gnome-latex/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchurl, wrapGAppsHook, gsettings-desktop-schemas, gspell, gtksourceview4, libgee
 , tepl, amtk, gnome3, glib, pkgconfig, intltool, itstool, libxml2 }:
 let
-  version = "3.32.0";
+  version = "3.36.0";
   pname = "gnome-latex";
 in stdenv.mkDerivation {
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1jdca9yhm7mm1aijd1a5amphgn15142kngky3id2am379ixrq1hg";
+    sha256 = "1869kr1zhcp04mzbi67lwgk497w840dbbc7427i9yh9b9s7j6mqn";
   };
 
   NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
diff --git a/pkgs/applications/graphics/avocode/default.nix b/pkgs/applications/graphics/avocode/default.nix
index 9981e8a439ee3..d72d52f3c2ff3 100644
--- a/pkgs/applications/graphics/avocode/default.nix
+++ b/pkgs/applications/graphics/avocode/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "avocode";
-  version = "4.6.2";
+  version = "4.6.3";
 
   src = fetchurl {
     url = "https://media.avocode.com/download/avocode-app/${version}/avocode-${version}-linux.zip";
-    sha256 = "1ldvscxfvwpsir8vr1ca9ra0841m6xy331ys31dngcp77nwncjqc";
+    sha256 = "1s8i82963fdx5q4wgh0cn211h0p1r1mzyss0g99bplp8d9ll40kw";
   };
 
   libPath = stdenv.lib.makeLibraryPath (with xorg; [
diff --git a/pkgs/applications/misc/cheat/default.nix b/pkgs/applications/misc/cheat/default.nix
index 3a8aea913cafd..ec4d71a0dce8e 100644
--- a/pkgs/applications/misc/cheat/default.nix
+++ b/pkgs/applications/misc/cheat/default.nix
@@ -3,13 +3,13 @@
 
 buildGoModule rec {
   pname = "cheat";
-  version = "3.10.0";
+  version = "3.10.1";
 
   src = fetchFromGitHub {
     owner = "cheat";
     repo = "cheat";
     rev = version;
-    sha256 = "1rrhll1i5ibxdchpdifajvsm697pilf82rbq7arn4f4pw5izrhy6";
+    sha256 = "0indvycj972wng979mvia8mrb7bwdfay7wxq3lnj05qyxqafj5h2";
   };
 
   subPackages = [ "cmd/cheat" ];
@@ -17,6 +17,7 @@ buildGoModule rec {
   nativeBuildInputs = [ installShellFiles ];
 
   postInstall = ''
+    installManPage doc/cheat.1
     installShellCompletion scripts/cheat.{bash,fish,zsh}
   '';
 
diff --git a/pkgs/applications/misc/clight/clightd.nix b/pkgs/applications/misc/clight/clightd.nix
index bfa6f2ea8555b..c5083f2379c6d 100644
--- a/pkgs/applications/misc/clight/clightd.nix
+++ b/pkgs/applications/misc/clight/clightd.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "clightd";
-  version = "4.0";
+  version = "4.1";
 
   src = fetchFromGitHub {
     owner = "FedeDP";
     repo = "Clightd";
     rev = version;
-    sha256 = "0cskxy3xsy187in5vg8xcs3kwcx2s160qv009v0ahkcalp29ghz4";
+    sha256 = "0pqnn52nn22k49f5cw4jcr8vcbff28n56i8fizg1mmfshy8pn891";
   };
 
   # dbus-1.pc has datadir=/etc
diff --git a/pkgs/applications/misc/ikiwiki/default.nix b/pkgs/applications/misc/ikiwiki/default.nix
index 1515b4b0f99d3..0c2abbd9f588c 100644
--- a/pkgs/applications/misc/ikiwiki/default.nix
+++ b/pkgs/applications/misc/ikiwiki/default.nix
@@ -2,7 +2,7 @@
 , gitSupport ? false, git ? null
 , docutilsSupport ? false, python ? null, docutils ? null
 , monotoneSupport ? false, monotone ? null
-, bazaarSupport ? false, bazaar ? null
+, bazaarSupport ? false, breezy ? null
 , cvsSupport ? false, cvs ? null, cvsps ? null
 , subversionSupport ? false, subversion ? null
 , mercurialSupport ? false, mercurial ? null
@@ -12,7 +12,7 @@
 assert docutilsSupport -> (python != null && docutils != null);
 assert gitSupport -> (git != null);
 assert monotoneSupport -> (monotone != null);
-assert bazaarSupport -> (bazaar != null);
+assert bazaarSupport -> (breezy != null);
 assert cvsSupport -> (cvs != null && cvsps != null && perlPackages.Filechdir != null);
 assert subversionSupport -> (subversion != null);
 assert mercurialSupport -> (mercurial != null);
@@ -39,7 +39,7 @@ stdenv.mkDerivation {
     ++ lib.optionals docutilsSupport [python docutils]
     ++ lib.optionals gitSupport [git]
     ++ lib.optionals monotoneSupport [monotone]
-    ++ lib.optionals bazaarSupport [bazaar]
+    ++ lib.optionals bazaarSupport [breezy]
     ++ lib.optionals cvsSupport [cvs cvsps perlPackages.Filechdir]
     ++ lib.optionals subversionSupport [subversion]
     ++ lib.optionals mercurialSupport [mercurial];
@@ -64,7 +64,7 @@ stdenv.mkDerivation {
       wrapProgram $a --suffix PERL5LIB : $PERL5LIB --prefix PATH : ${perlPackages.perl}/bin:$out/bin \
       ${lib.optionalString gitSupport ''--prefix PATH : ${git}/bin \''}
       ${lib.optionalString monotoneSupport ''--prefix PATH : ${monotone}/bin \''}
-      ${lib.optionalString bazaarSupport ''--prefix PATH : ${bazaar}/bin \''}
+      ${lib.optionalString bazaarSupport ''--prefix PATH : ${breezy}/bin \''}
       ${lib.optionalString cvsSupport ''--prefix PATH : ${cvs}/bin \''}
       ${lib.optionalString cvsSupport ''--prefix PATH : ${cvsps}/bin \''}
       ${lib.optionalString subversionSupport ''--prefix PATH : ${subversion.out}/bin \''}
diff --git a/pkgs/applications/misc/sleepyhead/default.nix b/pkgs/applications/misc/sleepyhead/default.nix
index 0753045cc4be7..17c5ec9be2657 100644
--- a/pkgs/applications/misc/sleepyhead/default.nix
+++ b/pkgs/applications/misc/sleepyhead/default.nix
@@ -1,9 +1,9 @@
-{ stdenv, fetchgit, qt5, zlib, libGLU, libX11 }:
+{ lib, stdenv, mkDerivation, fetchgit, zlib, libGLU, libX11, qtbase, qtwebkit, qtserialport, wrapQtAppsHook }:
 
 let
   name = "sleepyhead-${version}";
   version = "1.0.0-beta-git";
-in stdenv.mkDerivation {
+in mkDerivation {
   inherit name;
 
   src = fetchgit {
@@ -13,21 +13,30 @@ in stdenv.mkDerivation {
   };
 
   buildInputs = [
-    qt5.qtbase qt5.qtwebkit qt5.qtserialport
+    qtbase qtwebkit qtserialport
     zlib
     libGLU
     libX11
   ];
 
+  nativeBuildInputs = [ wrapQtAppsHook ];
+
   patchPhase = ''
     patchShebangs configure
   '';
-
-  installPhase = ''
+  
+  installPhase = if stdenv.isDarwin then ''
+    mkdir -p $out/Applications
+    cp -r sleepyhead/SleepyHead.app $out/Applications
+  '' else ''
     mkdir -p $out/bin
     cp sleepyhead/SleepyHead $out/bin
   '';
 
+  postFixup = stdenv.lib.optionalString stdenv.isDarwin ''
+    wrapQtApp "$out/Applications/SleepyHead.app/Contents/MacOS/SleepyHead"
+  '';
+
   meta = with stdenv.lib; {
     homepage = "https://sleepyhead.jedimark.net/";
     description = "Review and explore data produced by CPAP and related machines";
@@ -37,7 +46,6 @@ in stdenv.mkDerivation {
     license = licenses.gpl3;
     platforms = platforms.all;
     maintainers = [ maintainers.krav ];
-    broken = true;
   };
 
 }
diff --git a/pkgs/applications/misc/systembus-notify/default.nix b/pkgs/applications/misc/systembus-notify/default.nix
new file mode 100644
index 0000000000000..28c1be4219d68
--- /dev/null
+++ b/pkgs/applications/misc/systembus-notify/default.nix
@@ -0,0 +1,30 @@
+{ stdenv, fetchFromGitHub, systemd }:
+
+stdenv.mkDerivation rec {
+  pname = "systembus-notify";
+  version = "1.0";
+
+  src = fetchFromGitHub {
+    owner = "rfjakob";
+    repo = "systembus-notify";
+    rev = "v${version}";
+    sha256 = "11zq84qfmbyl51d3r6294l2bjhlgwa9bx7d263g9fkqrwsg0si0y";
+  };
+
+  buildInputs = [ systemd ];
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 systembus-notify -t $out/bin
+    install -Dm644 systembus-notify.desktop -t $out/etc/xdg/autostart
+    runHook postInstall
+  '';
+
+  meta = with stdenv.lib; {
+    description = "System bus notification daemon";
+    homepage = "https://github.com/rfjakob/systembus-notify";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [];
+  };
+}
diff --git a/pkgs/applications/networking/instant-messengers/ripcord/default.nix b/pkgs/applications/networking/instant-messengers/ripcord/default.nix
index 16cf7f5fc7791..f003bbec222f9 100755
--- a/pkgs/applications/networking/instant-messengers/ripcord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/ripcord/default.nix
@@ -5,12 +5,12 @@
 
 mkDerivation rec {
   pname = "ripcord";
-  version = "0.4.24";
+  version = "0.4.25";
 
   src = let
     appimage = fetchurl {
       url = "https://cancel.fm/dl/Ripcord-${version}-x86_64.AppImage";
-      sha256 = "0rscmnwxvbdl0vfx1pz7x5gxs9qsjk905zmcad4f330j5l5m227z";
+      sha256 = "17s4fxqirmzdw0sn9s9zyk90gr00ivsmz4s6i6knsq354zhy5fda";
       name = "${pname}-${version}.AppImage";
     };
   in appimageTools.extract {
diff --git a/pkgs/applications/networking/lieer/default.nix b/pkgs/applications/networking/lieer/default.nix
index fc5214f0d01fd..700ad011dff33 100644
--- a/pkgs/applications/networking/lieer/default.nix
+++ b/pkgs/applications/networking/lieer/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "lieer";
-  version = "1.1";
+  version = "1.2";
 
   src = fetchFromGitHub {
     owner = "gauteh";
     repo = "lieer";
     rev = "v${version}";
-    sha256 = "19jx3sm925nrzl26km1bxbp6y5gk1mzwadd79vip2jl70b3xk9f8";
+    sha256 = "0qp8sycclzagkiszqk1pw2fr8s8s195bzy8r27dj7f5zx350nxk5";
   };
 
   propagatedBuildInputs = with python3Packages; [
@@ -30,6 +30,6 @@ python3Packages.buildPythonApplication rec {
     homepage         = "https://lieer.gaute.vetsj.com/";
     repositories.git = "https://github.com/gauteh/lieer.git";
     license          = licenses.gpl3Plus;
-    maintainers      = with maintainers; [ kaiha ];
+    maintainers      = with maintainers; [ flokli kaiha ];
   };
 }
diff --git a/pkgs/applications/networking/p2p/transmission/default.nix b/pkgs/applications/networking/p2p/transmission/default.nix
index 0e80e1397faf9..d59cdff34fd99 100644
--- a/pkgs/applications/networking/p2p/transmission/default.nix
+++ b/pkgs/applications/networking/p2p/transmission/default.nix
@@ -1,47 +1,81 @@
-{ stdenv, fetchurl, pkgconfig, intltool, file, wrapGAppsHook
-, openssl, curl, libevent, inotify-tools, systemd, zlib
-, enableGTK3 ? false, gtk3
+{ stdenv
+, lib
+, fetchFromGitHub
+, cmake
+, pkgconfig
+, openssl
+, curl
+, libevent
+, inotify-tools
+, systemd
+, zlib
+, pcre
+  # Build options
+, enableGTK3 ? false
+, gnome3
+, xorg
+, wrapGAppsHook
+, enableQt ? false
+, qt5
 , enableSystemd ? stdenv.isLinux
 , enableDaemon ? true
 , enableCli ? true
 }:
 
-let inherit (stdenv.lib) optional optionals optionalString; in
+let
+  version = "3.00";
 
-stdenv.mkDerivation rec {
-  name = "transmission-" + optionalString enableGTK3 "gtk-" + version;
-  version = "2.94";
+in stdenv.mkDerivation {
+  pname = "transmission";
+  inherit version;
 
-  src = fetchurl {
-    url = "https://github.com/transmission/transmission-releases/raw/master/transmission-2.94.tar.xz";
-    sha256 = "0zbbj7rlm6m7vb64x68a64cwmijhsrwx9l63hbwqs7zr9742qi1m";
+  src = fetchFromGitHub {
+    owner = "transmission";
+    repo = "transmission";
+    rev = version;
+    sha256 = "0ccg0km54f700x9p0jsnncnwvfnxfnxf7kcm7pcx1cj0vw78924z";
+    fetchSubmodules = true;
   };
 
-  nativeBuildInputs = [ pkgconfig ]
-    ++ optionals enableGTK3 [ wrapGAppsHook ];
-  buildInputs = [ intltool file openssl curl libevent zlib ]
-    ++ optionals enableGTK3 [ gtk3 ]
-    ++ optionals enableSystemd [ systemd ]
-    ++ optionals stdenv.isLinux [ inotify-tools ];
-
-  postPatch = ''
-    substituteInPlace ./configure \
-      --replace "libsystemd-daemon" "libsystemd" \
-      --replace "/usr/bin/file"     "${file}/bin/file" \
-      --replace "test ! -d /Developer/SDKs/MacOSX10.5.sdk" "false"
-  '';
-
-  configureFlags = [
-      ("--enable-cli=" + (if enableCli then "yes" else "no"))
-      ("--enable-daemon=" + (if enableDaemon then "yes" else "no"))
-      "--disable-mac" # requires xcodebuild
-    ]
-    ++ optional enableSystemd "--with-systemd-daemon"
-    ++ optional enableGTK3 "--with-gtk";
-
-  NIX_LDFLAGS = optionalString stdenv.isDarwin "-framework CoreFoundation";
-
-  meta = with stdenv.lib; {
+  cmakeFlags =
+    let
+      mkFlag = opt: if opt then "ON" else "OFF";
+    in
+    [
+      "-DENABLE_MAC=OFF" # requires xcodebuild
+      "-DENABLE_GTK=${mkFlag enableGTK3}"
+      "-DENABLE_QT=${mkFlag enableQt}"
+      "-DENABLE_DAEMON=${mkFlag enableDaemon}"
+      "-DENABLE_CLI=${mkFlag enableCli}"
+    ];
+
+  nativeBuildInputs = [
+    pkgconfig
+    cmake
+  ]
+  ++ lib.optionals enableGTK3 [ wrapGAppsHook ]
+  ++ lib.optionals enableQt [ qt5.wrapQtAppsHook ]
+  ;
+
+  buildInputs = [
+    openssl
+    curl
+    libevent
+    zlib
+    pcre
+  ]
+  ++ lib.optionals enableQt [ qt5.qttools qt5.qtbase ]
+  ++ lib.optionals enableGTK3 [ gnome3.gtk xorg.libpthreadstubs ]
+  ++ lib.optionals enableSystemd [ systemd ]
+  ++ lib.optionals stdenv.isLinux [ inotify-tools ]
+  ;
+
+  NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-framework CoreFoundation";
+
+  # Reduce the risk of collisions
+  postInstall = "rm -r $out/share/doc";
+
+  meta = {
     description = "A fast, easy and free BitTorrent client";
     longDescription = ''
       Transmission is a BitTorrent client which features a simple interface
@@ -55,9 +89,9 @@ stdenv.mkDerivation rec {
         * Full encryption, DHT, and PEX support
     '';
     homepage = "http://www.transmissionbt.com/";
-    license = licenses.gpl2; # parts are under MIT
-    maintainers = with maintainers; [ astsmtl vcunat wizeman ];
-    platforms = platforms.unix;
+    license = lib.licenses.gpl2; # parts are under MIT
+    maintainers = with lib.maintainers; [ astsmtl vcunat wizeman ];
+    platforms = lib.platforms.unix;
   };
-}
 
+}
diff --git a/pkgs/applications/networking/sniffers/sngrep/default.nix b/pkgs/applications/networking/sniffers/sngrep/default.nix
index 5c536b8aec232..b48edd69837a5 100644
--- a/pkgs/applications/networking/sniffers/sngrep/default.nix
+++ b/pkgs/applications/networking/sniffers/sngrep/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sngrep";
-  version = "1.4.6";
+  version = "1.4.7";
 
   src = fetchFromGitHub {
     owner = "irontec";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0fj13pim5bfm3a2nr05apspraf29klpmcnhmycklfmrlncq5xqdf";
+    sha256 = "1dx5l48m4634y0zi6wjky412g80lfxqq1nphv7pi1kwvm1k5m5ri";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/office/gnumeric/default.nix b/pkgs/applications/office/gnumeric/default.nix
index 67618e0e4f991..40351ba64a18f 100644
--- a/pkgs/applications/office/gnumeric/default.nix
+++ b/pkgs/applications/office/gnumeric/default.nix
@@ -7,11 +7,11 @@ let
   inherit (python3Packages) python pygobject3;
 in stdenv.mkDerivation rec {
   pname = "gnumeric";
-  version = "1.12.46";
+  version = "1.12.47";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "9fdc67377af52dfe69a7db4f533938024a75f454fc5d25ab43b8e6739be0b5e1";
+    sha256 = "1khrf72kiq50y8b5prbj2207k9shn36h2b2i588cc4wa28s9y5a0";
   };
 
   configureFlags = [ "--disable-component" ];
diff --git a/pkgs/applications/science/logic/lean/default.nix b/pkgs/applications/science/logic/lean/default.nix
index ed077b039087e..2f5943dfa9b5a 100644
--- a/pkgs/applications/science/logic/lean/default.nix
+++ b/pkgs/applications/science/logic/lean/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lean";
-  version = "3.13.1";
+  version = "3.14.0";
 
   src = fetchFromGitHub {
     owner  = "leanprover-community";
     repo   = "lean";
     rev    = "v${version}";
-    sha256 = "1ak5l40h5yjlbzz92l724l6bm5q341cg6k1yk13sbwn42l8szsar";
+    sha256 = "1dlzap3j26rh93ick1lqb7g3jkqjpd33gl4gqfcbx22v62258y5b";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/science/misc/snakemake/default.nix b/pkgs/applications/science/misc/snakemake/default.nix
index 741330e4ad292..63a727f9c88ab 100644
--- a/pkgs/applications/science/misc/snakemake/default.nix
+++ b/pkgs/applications/science/misc/snakemake/default.nix
@@ -2,7 +2,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "snakemake";
-  version = "5.16.0";
+  version = "5.17.0";
 
   propagatedBuildInputs = with python3Packages; [
     appdirs
@@ -22,7 +22,7 @@ python3Packages.buildPythonApplication rec {
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "0jlf3y8b1gdv5xz37yk9b5g2b65zkk45p15x0ypvd2blpzy80537";
+    sha256 = "0y652i3saqq2z61yvk0i6q3lnq2xfrygcxms5gygspj71q2n4f7k";
   };
 
   doCheck = false; # Tests depend on Google Cloud credentials at ${HOME}/gcloud-service-key.json
diff --git a/pkgs/applications/version-management/bazaar/CVE-2017-14176.patch b/pkgs/applications/version-management/bazaar/CVE-2017-14176.patch
deleted file mode 100644
index a34ab0c6eb10b..0000000000000
--- a/pkgs/applications/version-management/bazaar/CVE-2017-14176.patch
+++ /dev/null
@@ -1,149 +0,0 @@
-diff --git a/bzrlib/tests/test_ssh_transport.py b/bzrlib/tests/test_ssh_transport.py
-index 9e37c3b..fe9f219 100644
---- a/bzrlib/tests/test_ssh_transport.py
-+++ b/bzrlib/tests/test_ssh_transport.py
-@@ -22,6 +22,7 @@ from bzrlib.transport.ssh import (
-     SSHCorpSubprocessVendor,
-     LSHSubprocessVendor,
-     SSHVendorManager,
-+    StrangeHostname,
-     )
- 
- 
-@@ -161,6 +162,19 @@ class SSHVendorManagerTests(TestCase):
- 
- class SubprocessVendorsTests(TestCase):
- 
-+    def test_openssh_command_tricked(self):
-+        vendor = OpenSSHSubprocessVendor()
-+        self.assertEqual(
-+            vendor._get_vendor_specific_argv(
-+                "user", "-oProxyCommand=blah", 100, command=["bzr"]),
-+            ["ssh", "-oForwardX11=no", "-oForwardAgent=no",
-+                "-oClearAllForwardings=yes",
-+                "-oNoHostAuthenticationForLocalhost=yes",
-+                "-p", "100",
-+                "-l", "user",
-+                "--",
-+                "-oProxyCommand=blah", "bzr"])
-+
-     def test_openssh_command_arguments(self):
-         vendor = OpenSSHSubprocessVendor()
-         self.assertEqual(
-@@ -171,6 +185,7 @@ class SubprocessVendorsTests(TestCase):
-                 "-oNoHostAuthenticationForLocalhost=yes",
-                 "-p", "100",
-                 "-l", "user",
-+                "--",
-                 "host", "bzr"]
-             )
- 
-@@ -184,9 +199,16 @@ class SubprocessVendorsTests(TestCase):
-                 "-oNoHostAuthenticationForLocalhost=yes",
-                 "-p", "100",
-                 "-l", "user",
--                "-s", "host", "sftp"]
-+                "-s", "--", "host", "sftp"]
-             )
- 
-+    def test_openssh_command_tricked(self):
-+        vendor = SSHCorpSubprocessVendor()
-+        self.assertRaises(
-+            StrangeHostname,
-+            vendor._get_vendor_specific_argv,
-+                "user", "-oProxyCommand=host", 100, command=["bzr"])
-+
-     def test_sshcorp_command_arguments(self):
-         vendor = SSHCorpSubprocessVendor()
-         self.assertEqual(
-@@ -209,6 +231,13 @@ class SubprocessVendorsTests(TestCase):
-                 "-s", "sftp", "host"]
-             )
- 
-+    def test_lsh_command_tricked(self):
-+        vendor = LSHSubprocessVendor()
-+        self.assertRaises(
-+            StrangeHostname,
-+            vendor._get_vendor_specific_argv,
-+                "user", "-oProxyCommand=host", 100, command=["bzr"])
-+
-     def test_lsh_command_arguments(self):
-         vendor = LSHSubprocessVendor()
-         self.assertEqual(
-@@ -231,6 +260,13 @@ class SubprocessVendorsTests(TestCase):
-                 "--subsystem", "sftp", "host"]
-             )
- 
-+    def test_plink_command_tricked(self):
-+        vendor = PLinkSubprocessVendor()
-+        self.assertRaises(
-+            StrangeHostname,
-+            vendor._get_vendor_specific_argv,
-+                "user", "-oProxyCommand=host", 100, command=["bzr"])
-+
-     def test_plink_command_arguments(self):
-         vendor = PLinkSubprocessVendor()
-         self.assertEqual(
-diff --git a/bzrlib/transport/ssh.py b/bzrlib/transport/ssh.py
-index eecaa26..6f22341 100644
---- a/bzrlib/transport/ssh.py
-+++ b/bzrlib/transport/ssh.py
-@@ -46,6 +46,10 @@ else:
-     from paramiko.sftp_client import SFTPClient
- 
- 
-+class StrangeHostname(errors.BzrError):
-+    _fmt = "Refusing to connect to strange SSH hostname %(hostname)s"
-+
-+
- SYSTEM_HOSTKEYS = {}
- BZR_HOSTKEYS = {}
- 
-@@ -360,6 +364,11 @@ class SubprocessVendor(SSHVendor):
-     # tests, but beware of using PIPE which may hang due to not being read.
-     _stderr_target = None
- 
-+    @staticmethod
-+    def _check_hostname(arg):
-+        if arg.startswith('-'):
-+            raise StrangeHostname(hostname=arg)
-+
-     def _connect(self, argv):
-         # Attempt to make a socketpair to use as stdin/stdout for the SSH
-         # subprocess.  We prefer sockets to pipes because they support
-@@ -424,9 +433,9 @@ class OpenSSHSubprocessVendor(SubprocessVendor):
-         if username is not None:
-             args.extend(['-l', username])
-         if subsystem is not None:
--            args.extend(['-s', host, subsystem])
-+            args.extend(['-s', '--', host, subsystem])
-         else:
--            args.extend([host] + command)
-+            args.extend(['--', host] + command)
-         return args
- 
- register_ssh_vendor('openssh', OpenSSHSubprocessVendor())
-@@ -439,6 +448,7 @@ class SSHCorpSubprocessVendor(SubprocessVendor):
- 
-     def _get_vendor_specific_argv(self, username, host, port, subsystem=None,
-                                   command=None):
-+        self._check_hostname(host)
-         args = [self.executable_path, '-x']
-         if port is not None:
-             args.extend(['-p', str(port)])
-@@ -460,6 +470,7 @@ class LSHSubprocessVendor(SubprocessVendor):
- 
-     def _get_vendor_specific_argv(self, username, host, port, subsystem=None,
-                                   command=None):
-+        self._check_hostname(host)
-         args = [self.executable_path]
-         if port is not None:
-             args.extend(['-p', str(port)])
-@@ -481,6 +492,7 @@ class PLinkSubprocessVendor(SubprocessVendor):
- 
-     def _get_vendor_specific_argv(self, username, host, port, subsystem=None,
-                                   command=None):
-+        self._check_hostname(host)
-         args = [self.executable_path, '-x', '-a', '-ssh', '-2', '-batch']
-         if port is not None:
-             args.extend(['-P', str(port)])
diff --git a/pkgs/applications/version-management/bazaar/add_certificates.patch b/pkgs/applications/version-management/bazaar/add_certificates.patch
deleted file mode 100644
index 18fac36daec5f..0000000000000
--- a/pkgs/applications/version-management/bazaar/add_certificates.patch
+++ /dev/null
@@ -1,11 +0,0 @@
-diff -ru orig/bzrlib/transport/http/_urllib2_wrappers.py bzr-2.7.0/bzrlib/transport/http/_urllib2_wrappers.py
---- orig/bzr-2.7.0/bzrlib/transport/http/_urllib2_wrappers.py	2016-02-01 20:49:17.000000000 +0100
-+++ bzr-2.7.0/bzrlib/transport/http/_urllib2_wrappers.py	2016-06-18 23:15:21.089511349 +0200
-@@ -95,6 +95,7 @@
-     u"/usr/local/share/certs/ca-root-nss.crt",  # FreeBSD
-     # XXX: Needs checking, can't trust the interweb ;) -- vila 2012-01-25
-     u'/etc/openssl/certs/ca-certificates.crt',  # Solaris
-+    u'@certPath@',
- ]
-
-
diff --git a/pkgs/applications/version-management/bazaar/default.nix b/pkgs/applications/version-management/bazaar/default.nix
deleted file mode 100644
index fa0009d3ef03b..0000000000000
--- a/pkgs/applications/version-management/bazaar/default.nix
+++ /dev/null
@@ -1,36 +0,0 @@
-{ stdenv, fetchurl, python2Packages
-, withSFTP ? true
- }:
-
-python2Packages.buildPythonApplication rec {
-  version = "2.7";
-  release = ".0";
-  name = "bazaar-${version}${release}";
-
-  src = fetchurl {
-    url = "https://launchpad.net/bzr/${version}/${version}${release}/+download/bzr-${version}${release}.tar.gz";
-    sha256 = "1cysix5k3wa6y7jjck3ckq3abls4gvz570s0v0hxv805nwki4i8d";
-  };
-
-  doCheck = false;
-
-  propagatedBuildInputs = []
-  ++ stdenv.lib.optionals withSFTP [ python2Packages.paramiko ];
-
-  patches = [
-    # Bazaar can't find the certificates alone
-    ./add_certificates.patch
-    ./CVE-2017-14176.patch
-  ];
-  postPatch = ''
-    substituteInPlace bzrlib/transport/http/_urllib2_wrappers.py \
-      --subst-var-by certPath /etc/ssl/certs/ca-certificates.crt
-  '';
-
-  meta = with stdenv.lib; {
-    homepage = "http://bazaar-vcs.org/";
-    description = "A distributed version control system that Just Works";
-    platforms = platforms.unix;
-    license = licenses.gpl2Plus;
-  };
-}
diff --git a/pkgs/applications/version-management/bazaar/tools.nix b/pkgs/applications/version-management/bazaar/tools.nix
deleted file mode 100644
index d76260ad4be7e..0000000000000
--- a/pkgs/applications/version-management/bazaar/tools.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-{ stdenv, fetchurl, python2Packages }:
-
-python2Packages.buildPythonApplication rec {
-  pname = "bzr-tools";
-  version = "2.6.0";
-
-  src = fetchurl {
-    url = "https://launchpad.net/bzrtools/stable/${version}/+download/bzrtools-${version}.tar.gz";
-    sha256 = "0n3zzc6jf5866kfhmrnya1vdr2ja137a45qrzsz8vz6sc6xgn5wb";
-  };
-
-  doCheck = false;
-
-  meta = with stdenv.lib; {
-    description = "Bazaar plugins";
-    homepage = "http://wiki.bazaar.canonical.com/BzrTools";
-    platforms = platforms.unix;
-    license = licenses.gpl2;
-  };
-}
diff --git a/pkgs/applications/version-management/cvs2svn/default.nix b/pkgs/applications/version-management/cvs2svn/default.nix
index 68c4e72e53192..ae1929565b6ef 100644
--- a/pkgs/applications/version-management/cvs2svn/default.nix
+++ b/pkgs/applications/version-management/cvs2svn/default.nix
@@ -1,6 +1,6 @@
 { lib, fetchurl, makeWrapper
 , python2Packages
-, cvs, subversion, git, bazaar
+, cvs, subversion, git, breezy
 }:
 
 python2Packages.buildPythonApplication  rec {
@@ -14,7 +14,7 @@ python2Packages.buildPythonApplication  rec {
 
   buildInputs = [ makeWrapper ];
 
-  checkInputs = [ subversion git bazaar ];
+  checkInputs = [ subversion git breezy ];
 
   checkPhase = "python run-tests.py";
 
diff --git a/pkgs/applications/version-management/git-and-tools/default.nix b/pkgs/applications/version-management/git-and-tools/default.nix
index c591ef554ee42..9c0e0d74d2215 100644
--- a/pkgs/applications/version-management/git-and-tools/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/default.nix
@@ -171,6 +171,8 @@ let
 
   gitflow = callPackage ./gitflow { };
 
+  gitin = callPackage ./gitin { };
+
   gitstatus = callPackage ./gitstatus { };
 
   gitui = callPackage ./gitui {
diff --git a/pkgs/applications/version-management/git-and-tools/gitin/default.nix b/pkgs/applications/version-management/git-and-tools/gitin/default.nix
new file mode 100644
index 0000000000000..5964af6c0f0cf
--- /dev/null
+++ b/pkgs/applications/version-management/git-and-tools/gitin/default.nix
@@ -0,0 +1,33 @@
+{ stdenv
+, buildGoPackage
+, fetchFromGitHub
+, pkgconfig
+, libgit2_0_27
+}:
+
+buildGoPackage rec {
+  version = "0.2.3";
+  pname = "gitin";
+
+  goPackagePath = "github.com/isacikgoz/gitin";
+
+  src = fetchFromGitHub {
+    owner = "isacikgoz";
+    repo = "gitin";
+    rev = "v${version}";
+    sha256 = "00z6i0bjk3hdxbc0cy12ss75b41yvzyl5pm6rdrvsjhzavry2fa3";
+  };
+
+  goDeps = ./deps.nix;
+
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libgit2_0_27 ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/isacikgoz/gitin";
+    description = "Text-based user interface for git";
+    platforms = platforms.all;
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ kimat ];
+  };
+}
diff --git a/pkgs/applications/version-management/git-and-tools/gitin/deps.nix b/pkgs/applications/version-management/git-and-tools/gitin/deps.nix
new file mode 100644
index 0000000000000..908665693b81d
--- /dev/null
+++ b/pkgs/applications/version-management/git-and-tools/gitin/deps.nix
@@ -0,0 +1,121 @@
+# This file was generated by https://github.com/kamilchm/go2nix v1.3.0
+[
+  {
+    goPackagePath = "github.com/alecthomas/template";
+    fetch = {
+      type = "git";
+      url = "https://github.com/alecthomas/template";
+      rev = "fb15b899a75114aa79cc930e33c46b577cc664b1";
+      sha256 = "1vlasv4dgycydh5wx6jdcvz40zdv90zz1h7836z7lhsi2ymvii26";
+    };
+  }
+  {
+    goPackagePath = "github.com/alecthomas/units";
+    fetch = {
+      type = "git";
+      url = "https://github.com/alecthomas/units";
+      rev = "f65c72e2690dc4b403c8bd637baf4611cd4c069b";
+      sha256 = "04jyqm7m3m01ppfy1f9xk4qvrwvs78q9zml6llyf2b3v5k6b2bbc";
+    };
+  }
+  {
+    goPackagePath = "github.com/fatih/color";
+    fetch = {
+      type = "git";
+      url = "https://github.com/fatih/color";
+      rev = "daf2830f2741ebb735b21709a520c5f37d642d85";
+      sha256 = "086z8ssmr1fn9ba4mqnw7pnccfpys6l5yfhvycv1gdrsk7n27mvs";
+    };
+  }
+  {
+    goPackagePath = "github.com/isacikgoz/gia";
+    fetch = {
+      type = "git";
+      url = "https://github.com/isacikgoz/gia";
+      rev = "00556493579ec25f4e199b85ee1e2a73c98d15bb";
+      sha256 = "16nqi4z1pgybcw05wbp3qnbbq407smcr56hq7npnhkirngc5j822";
+    };
+  }
+  {
+    goPackagePath = "github.com/jroimartin/gocui";
+    fetch = {
+      type = "git";
+      url = "https://github.com/jroimartin/gocui";
+      rev = "c055c87ae801372cd74a0839b972db4f7697ae5f";
+      sha256 = "1b1cbjg925l1c5v3ls8amni9716190yzf847cqs9wjnj82z8qa47";
+    };
+  }
+  {
+    goPackagePath = "github.com/justincampbell/timeago";
+    fetch = {
+      type = "git";
+      url = "https://github.com/justincampbell/timeago";
+      rev = "027f40306f1dbe89d24087611680ef95543bf876";
+      sha256 = "1p3va1cn9x5pyvq7k64mnvbxp5zy7h9z49syjyglixgg6avdbp1v";
+    };
+  }
+  {
+    goPackagePath = "github.com/kelseyhightower/envconfig";
+    fetch = {
+      type = "git";
+      url = "https://github.com/kelseyhightower/envconfig";
+      rev = "0b417c4ec4a8a82eecc22a1459a504aa55163d61";
+      sha256 = "1a7b35njpqz94gbd7wvsl3wjzpd5y1fj1lrg2sdh00yq0nax1qj9";
+    };
+  }
+  {
+    goPackagePath = "github.com/mattn/go-runewidth";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mattn/go-runewidth";
+      rev = "14e809f6d78fcf9f48ff9b70981472b64c05f754";
+      sha256 = "1mvlxcdwr0vwp8b2wqs6y7hk72y28sqh03dz5x0xkg48d4y9cplj";
+    };
+  }
+  {
+    goPackagePath = "github.com/nsf/termbox-go";
+    fetch = {
+      type = "git";
+      url = "https://github.com/nsf/termbox-go";
+      rev = "38ba6e5628f1d70bac606cfd210b9ad1a16c3027";
+      sha256 = "03xx5vbnavklsk6wykcc7qhmhvn2074sx0ql06b51vqsxwsa6zw2";
+    };
+  }
+  {
+    goPackagePath = "github.com/sahilm/fuzzy";
+    fetch = {
+      type = "git";
+      url = "https://github.com/sahilm/fuzzy";
+      rev = "d88f8cb825ddd46a2ce86b60382e11645220ee33";
+      sha256 = "0nl4l02s3961p11aj1vgajfy28rqlya2z6af2xjncra59gfhqvlq";
+    };
+  }
+  {
+    goPackagePath = "github.com/waigani/diffparser";
+    fetch = {
+      type = "git";
+      url = "https://github.com/waigani/diffparser";
+      rev = "7391f219313d9175703f67561b222fd2a81bca30";
+      sha256 = "0h3y3ivlghdvkyqsh5lcidqdajhc9g7m1xqm73j9a0ayby0sx1ql";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/alecthomas/kingpin.v2";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/alecthomas/kingpin.v2";
+      rev = "947dcec5ba9c011838740e680966fd7087a71d0d";
+      sha256 = "0mndnv3hdngr3bxp7yxfd47cas4prv98sqw534mx7vp38gd88n5r";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/libgit2/git2go.v27";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/libgit2/git2go.v27";
+      rev = "6cc7d3dc6aec2781fe0239315da215f49c76e2f8";
+      sha256 = "0b2m4rjadngyd675bi1k21pyi9r91dsxngzd4mikacpd7yshgvaq";
+    };
+  }
+]
+
diff --git a/pkgs/applications/version-management/gitlab/gitaly/default.nix b/pkgs/applications/version-management/gitlab/gitaly/default.nix
index 7c84acc8f05f6..298897d67017b 100644
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitLab, fetchFromGitHub, buildGoPackage, ruby,
-  bundlerEnv, pkgconfig, libgit2 }:
+  bundlerEnv, pkgconfig, libgit2_0_27 }:
 
 let
   rubyEnv = bundlerEnv rec {
@@ -18,15 +18,6 @@ let
         };
       };
   };
-  libgit2_0_27 = libgit2.overrideAttrs (oldAttrs: rec {
-    version = "0.27.8";
-    src = fetchFromGitHub {
-      owner = "libgit2";
-      repo = "libgit2";
-      rev = "v${version}";
-      sha256 = "0wzx8nkyy9m7mx6cks58chjd4289vjsw97mxm9w6f1ggqsfnmbr9";
-    };
-  });
 in buildGoPackage rec {
   version = "12.8.10";
   pname = "gitaly";
diff --git a/pkgs/applications/version-management/reposurgeon/default.nix b/pkgs/applications/version-management/reposurgeon/default.nix
index fb5b72be4eb80..f52fd30d8391f 100644
--- a/pkgs/applications/version-management/reposurgeon/default.nix
+++ b/pkgs/applications/version-management/reposurgeon/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, makeWrapper, python27Packages, git
 , docbook_xml_dtd_412, docbook_xsl, asciidoc, xmlto, pypy
-, bazaar ? null, cvs ? null, darcs ? null, fossil ? null
+, breezy ? null, cvs ? null, darcs ? null, fossil ? null
 , mercurial ? null, monotone ? null, rcs ? null
 , subversion ? null, cvs_fast_export ? null }:
 
@@ -42,7 +42,7 @@ in mkDerivation rec {
     let
       binpath = makeBinPath (
         filter (x: x != null)
-        [ out git bazaar cvs darcs fossil mercurial
+        [ out git breezy cvs darcs fossil mercurial
           monotone rcs src subversion cvs_fast_export ]
       );
       pythonpath = makeSearchPathOutput "lib" python.sitePackages (
diff --git a/pkgs/applications/virtualization/cri-o/wrapper.nix b/pkgs/applications/virtualization/cri-o/wrapper.nix
new file mode 100644
index 0000000000000..1578eaf4f585c
--- /dev/null
+++ b/pkgs/applications/virtualization/cri-o/wrapper.nix
@@ -0,0 +1,53 @@
+{ cri-o-unwrapped
+, runCommand
+, makeWrapper
+, lib
+, extraPackages ? []
+, cri-o
+, runc # Default container runtime
+, crun # Container runtime (default with cgroups v2 for podman/buildah)
+, conmon # Container runtime monitor
+, utillinux # nsenter
+, cni-plugins # not added to path
+, iptables
+, socat
+}:
+
+let
+  cri-o = cri-o-unwrapped;
+
+  binPath = lib.makeBinPath ([
+    runc
+    crun
+    conmon
+    utillinux
+    iptables
+    socat
+  ] ++ extraPackages);
+
+in runCommand cri-o.name {
+  name = "${cri-o.pname}-wrapper-${cri-o.version}";
+  inherit (cri-o) pname version;
+
+  meta = builtins.removeAttrs cri-o.meta [ "outputsToInstall" ];
+
+  outputs = [
+    "out"
+    "man"
+  ];
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+} ''
+  ln -s ${cri-o.man} $man
+
+  mkdir -p $out/bin
+  ln -s ${cri-o-unwrapped}/share $out/share
+
+  for p in ${cri-o-unwrapped}/bin/*; do
+    makeWrapper $p $out/bin/''${p##*/} \
+      --prefix PATH : ${binPath}
+  done
+''
diff --git a/pkgs/applications/virtualization/podman/wrapper.nix b/pkgs/applications/virtualization/podman/wrapper.nix
index d7fb6fa1072fa..d97d182496a4e 100644
--- a/pkgs/applications/virtualization/podman/wrapper.nix
+++ b/pkgs/applications/virtualization/podman/wrapper.nix
@@ -5,12 +5,12 @@
 , extraPackages ? []
 , podman # Docker compat
 , runc # Default container runtime
-, crun # Default container runtime (cgroups v2)
+, crun # Container runtime (default with cgroups v2 for podman/buildah)
 , conmon # Container runtime monitor
 , slirp4netns # User-mode networking for unprivileged namespaces
 , fuse-overlayfs # CoW for images, much faster than default vfs
 , utillinux # nsenter
-, cni-plugins
+, cni-plugins # not added to path
 , iptables
 }:
 
diff --git a/pkgs/applications/virtualization/qboot/default.nix b/pkgs/applications/virtualization/qboot/default.nix
index d770308239f82..800d601c76e64 100644
--- a/pkgs/applications/virtualization/qboot/default.nix
+++ b/pkgs/applications/virtualization/qboot/default.nix
@@ -1,18 +1,20 @@
-{ stdenv, fetchFromGitHub }:
+{ stdenv, meson, ninja, fetchFromGitHub }:
 
 stdenv.mkDerivation {
-  name = "qboot-20170330";
+  name = "qboot-20200423";
 
   src = fetchFromGitHub {
     owner = "bonzini";
     repo = "qboot";
-    rev = "ac9488f26528394856b94bda0797f5bd9c69a26a";
-    sha256 = "0l83nbjndin1cbcimkqkiqr5df8d76cnhyk26rd3aygb2bf7cspy";
+    rev = "de50b5931c08f5fba7039ddccfb249a5b3b0b18d";
+    sha256 = "1d0h29zz535m0pq18k3aya93q7lqm2858mlcp8mlfkbq54n8c5d8";
   };
 
+  nativeBuildInputs = [ meson ninja ];
+
   installPhase = ''
     mkdir -p $out
-    cp bios.bin* $out/.
+    cp bios.bin bios.bin.elf $out/.
   '';
 
   hardeningDisable = [ "stackprotector" "pic" ];
diff --git a/pkgs/applications/window-managers/picom/default.nix b/pkgs/applications/window-managers/picom/default.nix
index ad5f73ab17394..8ea724aa694a9 100644
--- a/pkgs/applications/window-managers/picom/default.nix
+++ b/pkgs/applications/window-managers/picom/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "picom";
-  version = "7.5";
+  version = "8";
 
   src = fetchFromGitHub {
     owner  = "yshui";
     repo   = "picom";
     rev    = "v${version}";
-    sha256 = "1l48fxl04vkzr4r94sl37nbbw7a621rn8sxmkbdv4252i1gjxd4z";
+    sha256 = "04svbv7v73q8yn9la69451rda6l2pgxcphv2zlkdqaxxdbp69195";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/build-support/docker/nix-prefetch-docker b/pkgs/build-support/docker/nix-prefetch-docker
index bf01384ccdb49..1b6785189c28d 100755
--- a/pkgs/build-support/docker/nix-prefetch-docker
+++ b/pkgs/build-support/docker/nix-prefetch-docker
@@ -12,7 +12,6 @@ finalImageTag=
 hashType=$NIX_HASH_ALGO
 hashFormat=$hashFormat
 format=nix
-skopeoCmd="skopeo --insecure-policy --tmpdir=$TMPDIR"
 
 usage(){
     echo  >&2 "syntax: nix-prefetch-docker [options] [IMAGE_NAME [IMAGE_TAG|IMAGE_DIGEST]]
@@ -39,7 +38,7 @@ get_image_digest(){
         imageTag="latest"
     fi
 
-    "$skopeoCmd" inspect "docker://$imageName:$imageTag" | jq '.Digest' -r
+    skopeo --insecure-policy --tmpdir=$TMPDIR inspect "docker://$imageName:$imageTag" | jq '.Digest' -r
 }
 
 get_name() {
@@ -128,9 +127,9 @@ trap "rm -rf \"$tmpPath\"" EXIT
 tmpFile="$tmpPath/$(get_name $finalImageName $finalImageTag)"
 
 if test -z "$QUIET"; then
-    "$skopeoCmd" --override-os ${os} --override-arch ${arch} copy "$sourceUrl" "docker-archive://$tmpFile:$finalImageName:$finalImageTag"
+    skopeo --insecure-policy --tmpdir=$TMPDIR --override-os ${os} --override-arch ${arch} copy "$sourceUrl" "docker-archive://$tmpFile:$finalImageName:$finalImageTag"
 else
-    "$skopeoCmd" --override-os ${os} --override-arch ${arch} copy "$sourceUrl" "docker-archive://$tmpFile:$finalImageName:$finalImageTag" > /dev/null
+    skopeo --insecure-policy --tmpdir=$TMPDIR --override-os ${os} --override-arch ${arch} copy "$sourceUrl" "docker-archive://$tmpFile:$finalImageName:$finalImageTag" > /dev/null
 fi
 
 # Compute the hash.
diff --git a/pkgs/build-support/docker/store-path-to-layer.sh b/pkgs/build-support/docker/store-path-to-layer.sh
index d834716e4b219..7437da51cc4a4 100755
--- a/pkgs/build-support/docker/store-path-to-layer.sh
+++ b/pkgs/build-support/docker/store-path-to-layer.sh
@@ -30,12 +30,13 @@ mkdir -p nix/store
 # store path to the absolute store path.
 tarhash=$(
   basename -a "$@" |
-    tar -cp nix \
-      -C /nix/store --verbatim-files-from --files-from - \
+    tar --create --preserve-permissions --absolute-names nix \
+      --directory /nix/store --verbatim-files-from --files-from - \
       --hard-dereference --sort=name \
       --mtime="@$SOURCE_DATE_EPOCH" \
       --owner=0 --group=0 \
-      --transform 's,^nix(/|$),/nix/,' \
+      --transform 's,^nix$,/\0,' \
+      --transform 's,^nix/store$,/\0,' \
       --transform 's,^[^/],/nix/store/\0,rS' |
     tee "$layerPath/layer.tar" |
     tarsum
diff --git a/pkgs/build-support/fetchbzr/default.nix b/pkgs/build-support/fetchbzr/default.nix
index f9250de4ee07e..2cf169de7a527 100644
--- a/pkgs/build-support/fetchbzr/default.nix
+++ b/pkgs/build-support/fetchbzr/default.nix
@@ -1,11 +1,11 @@
-{ stdenvNoCC, bazaar }:
+{ stdenvNoCC, breezy }:
 { url, rev, sha256 }:
 
 stdenvNoCC.mkDerivation {
   name = "bzr-export";
 
   builder = ./builder.sh;
-  nativeBuildInputs = [ bazaar ];
+  nativeBuildInputs = [ breezy ];
 
   outputHashAlgo = "sha256";
   outputHashMode = "recursive";
diff --git a/pkgs/build-support/fetchgitlab/default.nix b/pkgs/build-support/fetchgitlab/default.nix
index 6c4d52a05337e..f1850fbaa1ea7 100644
--- a/pkgs/build-support/fetchgitlab/default.nix
+++ b/pkgs/build-support/fetchgitlab/default.nix
@@ -12,10 +12,11 @@ let
     ((optional (group != null) group) ++ [ owner repo ]);
 
   escapedSlug = replaceStrings ["." "/"] ["%2E" "%2F"] slug;
+  escapedRev = replaceStrings ["+"] ["%2B"] rev;
 in
 
 fetchzip ({
   inherit name;
-  url = "https://${domain}/api/v4/projects/${escapedSlug}/repository/archive.tar.gz?sha=${rev}";
+  url = "https://${domain}/api/v4/projects/${escapedSlug}/repository/archive.tar.gz?sha=${escapedRev}";
   meta.homepage = "https://${domain}/${slug}/";
 } // removeAttrs args [ "domain" "owner" "group" "repo" "rev" ]) // { inherit rev; }
diff --git a/pkgs/data/fonts/tamzen/default.nix b/pkgs/data/fonts/tamzen/default.nix
new file mode 100644
index 0000000000000..c4a2be00d9445
--- /dev/null
+++ b/pkgs/data/fonts/tamzen/default.nix
@@ -0,0 +1,47 @@
+{ fetchFromGitHub, fontforge, mkfontscale, stdenv }:
+
+stdenv.mkDerivation rec {
+  pname = "tamzen-font";
+  version = "1.11.4";
+
+  src = fetchFromGitHub {
+    owner = "sunaku";
+    repo = "tamzen-font";
+    rev = "Tamzen-${version}";
+    sha256 = "17kgmvg6q32mqhx9g44hjvzv0si0mnpprga4z7na930g2zdd8846";
+  };
+
+  nativeBuildInputs = [ fontforge mkfontscale ];
+
+  installPhase = ''
+    # convert pcf fonts to otb
+    for i in pcf/*.pcf; do
+      name=$(basename "$i" .pcf)
+      fontforge -lang=ff -c "Open(\"$i\"); Generate(\"$name.otb\")"
+    done
+
+    install -m 644 -D pcf/*.pcf -t "$out/share/fonts/misc"
+    install -m 644 -D psf/*.psf -t "$out/share/consolefonts"
+    install -m 644 -D *.otb     -t "$otb/share/fonts/misc"
+    mkfontdir "$out/share/fonts/misc"
+    mkfontdir "$otb/share/fonts/misc"
+  '';
+
+  outputs = [ "out" "otb" ];
+
+  meta = with stdenv.lib; {
+    description = "Bitmapped programming font based on Tamsyn";
+    longDescription = ''
+    Tamzen is a monospace bitmap font. It is programatically forked
+    from Tamsyn version 1.11, which backports glyphs from older
+    versions while deleting deliberately empty glyphs to allow
+    secondary/fallback fonts to provide real glyphs at those codepoints.
+    Tamzen also has fonts that additionally provide the Powerline
+    symbols.
+    '';
+    homepage = "https://github.com/sunaku/tamzen-font";
+    license = licenses.free;
+    maintainers = with maintainers; [ wishfort36 ];
+  };
+}
+
diff --git a/pkgs/data/misc/osinfo-db/default.nix b/pkgs/data/misc/osinfo-db/default.nix
index 7fb2aa2f81178..4460e7b40d7c0 100644
--- a/pkgs/data/misc/osinfo-db/default.nix
+++ b/pkgs/data/misc/osinfo-db/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "osinfo-db";
-  version = "20200214";
+  version = "20200515";
 
   src = fetchurl {
     url = "https://releases.pagure.org/libosinfo/${pname}-${version}.tar.xz";
-    sha256 = "1fpdb8r8kzwp1k5dc9xyy9jr2jr3haq7n9b6spamm599zvzf8nb6";
+    sha256 = "1m9idmmb1sjf24lp9lgng2m1jj09mn9fa9pnz36fdv5q0lskgscj";
   };
 
   nativeBuildInputs = [ osinfo-db-tools intltool libxml2 ];
diff --git a/pkgs/data/themes/matcha/default.nix b/pkgs/data/themes/matcha/default.nix
index e54d2354139ab..f0617e56d789c 100644
--- a/pkgs/data/themes/matcha/default.nix
+++ b/pkgs/data/themes/matcha/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "matcha-gtk-theme";
-  version = "2020-05-09";
+  version = "2020-05-24";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = pname;
     rev = version;
-    sha256 = "0fp3ijynyvncy2byjjyba573p81x2pl2hdzv17mg40r8d5mjlkww";
+    sha256 = "186ypnkyaqjw671ny363xmixw6zdvrgj9xvmsrdgr8i0h3z8qwr8";
   };
 
   buildInputs = [ gdk-pixbuf librsvg ];
diff --git a/pkgs/data/themes/plano/default.nix b/pkgs/data/themes/plano/default.nix
index ff1825f63410d..7ac245b920f2a 100644
--- a/pkgs/data/themes/plano/default.nix
+++ b/pkgs/data/themes/plano/default.nix
@@ -1,27 +1,40 @@
-{ stdenv, fetchFromGitHub, gdk-pixbuf, gtk_engines, gtk-engine-murrine, librsvg }:
+{ stdenv
+, fetchFromGitHub
+, meson
+, ninja
+, gdk-pixbuf
+, gtk_engines
+, gtk-engine-murrine
+, librsvg
+, sassc
+}:
 
 stdenv.mkDerivation rec {
   pname = "plano-theme";
-  version = "3.34-2";
+  version = "3.36-1";
 
   src = fetchFromGitHub {
     owner = "lassekongo83";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0spbyvzb47vyfhcn3gr0z1gdb5xrprynm6442y1z32znai2bgpnd";
+    sha256 = "1rngn5a7hwjqpznbg5kvgs237d2q1anywg37k1cz153ipa96snrv";
   };
 
-  buildInputs = [ gdk-pixbuf gtk_engines librsvg ];
+  nativeBuildInputs = [
+    meson
+    ninja
+    sassc
+  ];
 
-  propagatedUserEnvPkgs = [ gtk-engine-murrine ];
+  buildInputs = [
+    gdk-pixbuf
+    gtk_engines
+    librsvg
+  ];
 
-  dontBuild = true;
-
-  installPhase = ''
-    install -dm 755 $out/share/themes/Plano
-    cp -a * $out/share/themes/Plano/
-    rm $out/share/themes/Plano/{LICENSE,README.md}
-  '';
+  propagatedUserEnvPkgs = [
+    gtk-engine-murrine
+  ];
 
   meta = with stdenv.lib; {
     description = "Flat theme for GNOME and Xfce";
diff --git a/pkgs/data/themes/yaru/default.nix b/pkgs/data/themes/yaru/default.nix
index 665452a91d853..b63d70b3c69a7 100644
--- a/pkgs/data/themes/yaru/default.nix
+++ b/pkgs/data/themes/yaru/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "yaru";
-  version = "20.04.6";
+  version = "20.04.7";
 
   src = fetchFromGitHub {
     owner = "ubuntu";
     repo = "yaru";
     rev = version;
-    sha256 = "04z16bcv1xdq4acnchd6cq9a8j46zl2bjp50cj90qmd6plpiiz50";
+    sha256 = "05fpr928kgyly7ac3zf6hfw9wqgc7fjn6980ih54iqc2qffcglsk";
   };
 
   nativeBuildInputs = [ meson sassc pkg-config glib ninja python3 ];
diff --git a/pkgs/desktops/lxqt/lxqt-panel/default.nix b/pkgs/desktops/lxqt/lxqt-panel/default.nix
index 705d6aec7930e..a0bdd9bfae611 100644
--- a/pkgs/desktops/lxqt/lxqt-panel/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-panel/default.nix
@@ -3,40 +3,40 @@
 , fetchFromGitHub
 , cmake
 , pkgconfig
-, lxqt-build-tools
-, qtbase
-, qttools
-, qtx11extras
-, qtsvg
-, libdbusmenu
-, kwindowsystem
-, solid
+, alsaLib
 , kguiaddons
+, kwindowsystem
+, libXdamage
+, libdbusmenu
 , liblxqt
+, libpulseaudio
 , libqtxdg
-, lxqt-globalkeys
-, libsysstat
-, xorg
 , libstatgrab
+, libsysstat
 , lm_sensors
-, libpulseaudio
-, alsaLib
-, menu-cache
 , lxmenu-data
-, pcre
-, libXdamage
+, lxqt-build-tools
+, lxqt-globalkeys
 , lxqtUpdateScript
+, menu-cache
+, pcre
+, qtbase
+, qtsvg
+, qttools
+, qtx11extras
+, solid
+, xorg
 }:
 
 mkDerivation rec {
   pname = "lxqt-panel";
-  version = "0.15.0";
+  version = "0.15.1";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "0k2gqf9f4g8fpny8p5m1anzk7mdxm9dgh6xlngz25nj4mshnq3xs";
+    sha256 = "0f3sjzkria61nz342daxps2w57wnx6laq9iww8hha7rbi24yw2sd";
   };
 
   nativeBuildInputs = [
@@ -46,28 +46,28 @@ mkDerivation rec {
   ];
 
   buildInputs = [
-    qtbase
-    qttools
-    qtx11extras
-    qtsvg
-    libdbusmenu
-    kwindowsystem
-    solid
+    alsaLib
     kguiaddons
+    kwindowsystem
+    libXdamage
+    libdbusmenu
     liblxqt
+    libpulseaudio
     libqtxdg
-    lxqt-globalkeys
-    libsysstat
-    xorg.libpthreadstubs
-    xorg.libXdmcp
     libstatgrab
+    libsysstat
     lm_sensors
-    libpulseaudio
-    alsaLib
-    menu-cache
     lxmenu-data
+    lxqt-globalkeys
+    menu-cache
     pcre
-    libXdamage
+    qtbase
+    qtsvg
+    qttools
+    qtx11extras
+    solid
+    xorg.libXdmcp
+    xorg.libpthreadstubs
   ];
 
   passthru.updateScript = lxqtUpdateScript { inherit pname version src; };
diff --git a/pkgs/development/compilers/fpc/lazarus.nix b/pkgs/development/compilers/fpc/lazarus.nix
index 5947b572cec07..701dcae2fcfec 100644
--- a/pkgs/development/compilers/fpc/lazarus.nix
+++ b/pkgs/development/compilers/fpc/lazarus.nix
@@ -1,6 +1,7 @@
 { stdenv, fetchurl, makeWrapper
 , fpc, gtk2, glib, pango, atk, gdk-pixbuf
 , libXi, xorgproto, libX11, libXext
+, gdb, gnumake, binutils
 }:
 stdenv.mkDerivation rec {
   pname = "lazarus";
@@ -34,8 +35,12 @@ stdenv.mkDerivation rec {
   '';
 
   postInstall = ''
-    wrapProgram $out/bin/startlazarus --prefix NIX_LDFLAGS ' ' "'$NIX_LDFLAGS'" \
-      --prefix LCL_PLATFORM ' ' "'$LCL_PLATFORM'"
+    wrapProgram $out/bin/startlazarus --prefix NIX_LDFLAGS ' ' \
+      "$(echo "$NIX_LDFLAGS" | sed -re 's/-rpath [^ ]+//g')" \
+      --prefix NIX_${binutils.infixSalt}_LDFLAGS ' ' \
+      "$(echo "$NIX_LDFLAGS" | sed -re 's/-rpath [^ ]+//g')" \
+      --prefix LCL_PLATFORM ' ' "$LCL_PLATFORM" \
+      --prefix PATH ':' "${fpc}/bin:${gdb}/bin:${gnumake}/bin:${binutils}/bin"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/compilers/jsonnet/default.nix b/pkgs/development/compilers/jsonnet/default.nix
index 2d28954b2210d..510fca1838ec1 100644
--- a/pkgs/development/compilers/jsonnet/default.nix
+++ b/pkgs/development/compilers/jsonnet/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "jsonnet";
-  version = "0.15.0";
+  version = "0.16.0";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "google";
     repo = "jsonnet";
-    sha256 = "06imnpbc5mn1dis051f54q6nq80dbm51nhxmba61rdyhf1131ml8";
+    sha256 = "0wxhc0ghjk88zrrn9a18h979ipkia2rx12489515gzhlplfx6724";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/apache-activemq/default.nix b/pkgs/development/libraries/apache-activemq/default.nix
index b2323d62dfc55..7ea38b6472b86 100644
--- a/pkgs/development/libraries/apache-activemq/default.nix
+++ b/pkgs/development/libraries/apache-activemq/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "apache-activemq";
-  version = "5.14.5";
+  version = "5.15.12";
 
   src = fetchurl {
-    sha256 = "0vm8z7rxb9n10xg5xjahy357704fw3q477hmpb83kd1zrc633g54";
+    sha256 = "14v117r9zqvrqr79h66r0dm9lyxq3104rcdizcnvk0syz0zbwps1";
     url = "mirror://apache/activemq/${version}/${pname}-${version}-bin.tar.gz";
   };
 
diff --git a/pkgs/development/libraries/biblesync/default.nix b/pkgs/development/libraries/biblesync/default.nix
index 814ecf986e9b2..27c6637d9fee6 100644
--- a/pkgs/development/libraries/biblesync/default.nix
+++ b/pkgs/development/libraries/biblesync/default.nix
@@ -3,20 +3,20 @@
 stdenv.mkDerivation rec {
 
   pname = "biblesync";
-  version = "2.0.1";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "karlkleinpaste";
     repo = "biblesync";
     rev = version;
-    sha256 = "1baq2fwf6132i514xrvq05p2gy98mkg1rn5whf9q5k475q81nrlr";
+    sha256 = "0prmd12jq2cjdhsph5v89y38j7hhd51dr3r1hivgkhczr3m5hf4s";
   };
 
   nativeBuildInputs = [ pkgconfig cmake ];
   buildInputs = [ libuuid ];
 
   meta = with stdenv.lib; {
-    homepage = "http://www.crosswire.org/wiki/BibleSync";
+    homepage = "https://wiki.crosswire.org/BibleSync";
     description = "A multicast protocol to Bible software shared conavigation";
     longDescription = ''
       BibleSync is a multicast protocol to support Bible software shared
diff --git a/pkgs/development/libraries/comedilib/default.nix b/pkgs/development/libraries/comedilib/default.nix
new file mode 100644
index 0000000000000..f011c04d88560
--- /dev/null
+++ b/pkgs/development/libraries/comedilib/default.nix
@@ -0,0 +1,55 @@
+{ stdenv
+, fetchFromGitHub
+, autoreconfHook
+, flex
+, yacc
+, xmlto
+, docbook_xsl
+, docbook_xml_dtd_44
+, swig
+, perl
+, python3
+}:
+
+stdenv.mkDerivation rec {
+  pname = "comedilib";
+  version = "0.11.0";
+
+  src = fetchFromGitHub {
+    owner = "Linux-Comedi";
+    repo = "comedilib";
+    rev = "r${stdenv.lib.replaceStrings [ "." ] [ "_" ] version}";
+    sha256 = "159sv4jdgmcaqz76vazkyxxb85ni7pg14p1qv7y94hib3kspc195";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    flex
+    yacc
+    swig
+    xmlto
+    docbook_xml_dtd_44
+    docbook_xsl
+    python3
+    perl
+  ];
+
+  preConfigure = ''
+    patchShebangs --build doc/mkref doc/mkdr perl/Comedi.pm
+  '';
+
+  configureFlags = [
+    "--with-udev-hotplug=${placeholder "out"}/lib"
+    "--sysconfdir=${placeholder "out"}/etc"
+  ];
+
+  outputs = [ "out" "dev" "man" "doc" ];
+
+  meta = with stdenv.lib; {
+    description = "The Linux Control and Measurement Device Interface Library";
+    homepage = "https://github.com/Linux-Comedi/comedilib";
+    license = licenses.lgpl21;
+    maintainers = [ maintainers.doronbehar ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/development/libraries/libfprint/default.nix b/pkgs/development/libraries/libfprint/default.nix
index e886baa479763..e2552ba713e07 100644
--- a/pkgs/development/libraries/libfprint/default.nix
+++ b/pkgs/development/libraries/libfprint/default.nix
@@ -1,41 +1,31 @@
-{ thinkpad ? false
-, stdenv
-, fetchFromGitHub
-, fetchurl
+{ stdenv
+, fetchFromGitLab
 , pkgconfig
 , meson
 , ninja
-, libusb1
+, gusb
 , pixman
 , glib
 , nss
-, gtk3
+, gobject-introspection
 , coreutils
 , gtk-doc
 , docbook_xsl
 , docbook_xml_dtd_43
-, openssl ? null
 }:
 
-assert thinkpad -> openssl != null;
-
 stdenv.mkDerivation rec {
-  pname = "libfprint" + stdenv.lib.optionalString thinkpad "-thinkpad";
-  version = "1.0";
-
-  src = {
-    libfprint-thinkpad =
-      fetchFromGitHub {
-        owner = "3v1n0";
-        repo = "libfprint";
-        rev = "2e2e3821717e9042e93a995bdbd3d00f2df0be9c";
-        sha256 = "1vps1wrp7hskf13f7jrv0dwry2fcid76x2w463wplngp63cj7b3b";
-      };
-    libfprint = fetchurl {
-      url = "https://gitlab.freedesktop.org/libfprint/libfprint/uploads/aff93e9921d1cff53d7c070944952ff9/libfprint-${version}.tar.xz";
-      sha256 = "0v84pd12v016m8iimhq39fgzamlarqccsr7d98cvrrwrzrgcixrd";
-    };
-  }.${pname};
+  pname = "libfprint";
+  version = "1.90.1";
+  outputs = [ "out" "devdoc" ];
+
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "libfprint";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0fdaak7qjr9b4482g7fhhqpyfdqpxq5kpmyzkp7f5i7qq2ynb78a";
+  };
 
   nativeBuildInputs = [
     pkgconfig
@@ -44,28 +34,20 @@ stdenv.mkDerivation rec {
     gtk-doc
     docbook_xsl
     docbook_xml_dtd_43
+    gobject-introspection
   ];
 
   buildInputs = [
-    libusb1 # drop in 2.0 for gusb
+    gusb
     pixman
     glib
     nss
-    gtk3
-  ]
-  ++ stdenv.lib.optional thinkpad openssl
-  ;
+  ];
 
   mesonFlags = [
     "-Dudev_rules_dir=${placeholder "out"}/lib/udev/rules.d"
-    "-Dx11-examples=false"
   ];
 
-  postPatch = ''
-    substituteInPlace libfprint/meson.build \
-      --replace /bin/echo ${coreutils}/bin/echo
-  '';
-
   meta = with stdenv.lib; {
     homepage = "https://fprint.freedesktop.org/";
     description = "A library designed to make it easy to add support for consumer fingerprint readers";
diff --git a/pkgs/development/libraries/libosinfo/default.nix b/pkgs/development/libraries/libosinfo/default.nix
index 79bd53ab03b37..39a3bf6b2c558 100644
--- a/pkgs/development/libraries/libosinfo/default.nix
+++ b/pkgs/development/libraries/libosinfo/default.nix
@@ -68,10 +68,11 @@ stdenv.mkDerivation rec {
     "-Denable-gtk-doc=true"
   ];
 
-  # FIXME: fails two new tests added in 1.7.1:
-  # libosinfo:symbols / check-symfile
-  # 3/24 libosinfo:symbols / check-symsorting
-  doCheck = false;
+  preCheck = ''
+    patchShebangs ../osinfo/check-symfile.pl ../osinfo/check-symsorting.pl
+  '';
+
+  doCheck = true;
 
   meta = with stdenv.lib; {
     description = "GObject based library API for managing information about operating systems, hypervisors and the (virtual) hardware devices they can support";
diff --git a/pkgs/development/libraries/libpam-wrapper/default.nix b/pkgs/development/libraries/libpam-wrapper/default.nix
new file mode 100644
index 0000000000000..f8359cded93a3
--- /dev/null
+++ b/pkgs/development/libraries/libpam-wrapper/default.nix
@@ -0,0 +1,33 @@
+{ stdenv
+, fetchgit
+, cmake
+, linux-pam
+, enablePython ? false
+, python ? null
+}:
+
+assert enablePython -> python != null;
+
+stdenv.mkDerivation rec {
+  pname = "libpam-wrapper";
+  version = "1.1.3";
+
+  src = fetchgit {
+    url = "git://git.samba.org/pam_wrapper.git";
+    rev = "pam_wrapper-${version}";
+    sha256 = "00mqhsashx7njrvxz085d0b88nizhdy7m3x17ip5yhvwsl63km6p";
+  };
+
+  nativeBuildInputs = [ cmake ] ++ stdenv.lib.optional enablePython [ python ];
+
+  # We must use linux-pam, using openpam will result in broken fprintd.
+  buildInputs = [ linux-pam ];
+
+  meta = with stdenv.lib; {
+    description = "Wrapper for testing PAM modules";
+    homepage = "https://cwrap.org/pam_wrapper.html";
+    license = licenses.gpl3Plus;
+    maintainers = [ maintainers.elyhaka ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/development/libraries/libuchardet/default.nix b/pkgs/development/libraries/libuchardet/default.nix
index 7b6a85cec07f6..43fa300f1076b 100644
--- a/pkgs/development/libraries/libuchardet/default.nix
+++ b/pkgs/development/libraries/libuchardet/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "uchardet";
-  version = "0.0.6";
+  version = "0.0.7";
 
   outputs = [ "bin" "out" "man" "dev" ];
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/${pname}/releases/${pname}-${version}.tar.xz";
-    sha256 = "0q9c02b6nmw41yfsiqsnphgc3f0yg3fj31wkccp47cmwvy634lc3";
+    sha256 = "1ca51sryhryqz82v4d0graaiqqq5w2f33a9gj83b910xmq499irz";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/libxsmm/default.nix b/pkgs/development/libraries/libxsmm/default.nix
index b89c57534bec8..25c85948608a1 100644
--- a/pkgs/development/libraries/libxsmm/default.nix
+++ b/pkgs/development/libraries/libxsmm/default.nix
@@ -3,7 +3,7 @@
 }:
 
 let
-  version = "1.13";
+  version = "1.15";
 in stdenv.mkDerivation {
   pname = "libxsmm";
   inherit version;
@@ -12,7 +12,7 @@ in stdenv.mkDerivation {
     owner = "hfp";
     repo = "libxsmm";
     rev = "refs/tags/${version}";
-    sha256 = "1c15ccy7vbmvxkfnc7sn26wnf6gr6gxgkmilpgpycm1fhi8ikd6w";
+    sha256 = "1406qk7k2k4qfqy4psqk55iihsrx91w8kjgsa82jxj50nl9nw5nj";
   };
 
   buildInputs = [
@@ -33,7 +33,7 @@ in stdenv.mkDerivation {
   meta = with stdenv.lib; {
     description = "Library targeting Intel Architecture for specialized dense and sparse matrix operations, and deep learning primitives";
     license = licenses.bsd3;
-    homepage = https://github.com/hfp/libxsmm ;
+    homepage = "https://github.com/hfp/libxsmm";
     platforms = platforms.linux;
     maintainers = with stdenv.lib.maintainers; [ chessai ];
     inherit version;
diff --git a/pkgs/development/libraries/lyra/default.nix b/pkgs/development/libraries/lyra/default.nix
index e7227ac63885f..c0220e6e21db3 100644
--- a/pkgs/development/libraries/lyra/default.nix
+++ b/pkgs/development/libraries/lyra/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lyra";
-  version = "1.3";
+  version = "1.4";
 
   src = fetchFromGitHub {
     owner = "bfgroup";
     repo = "lyra";
     rev = version;
-    sha256 = "0rpk1hadfcvjps5k307sddv23q73m2918wclfxfi6mj8l7gwkcn9";
+    sha256 = "08g6kqaj079aq7i6c1pwj778lrr3yk188wn1byxdd6zqpwrsv71q";
   };
 
   nativeBuildInputs = [ meson ninja ];
diff --git a/pkgs/development/libraries/qgnomeplatform/default.nix b/pkgs/development/libraries/qgnomeplatform/default.nix
index 434b3ab84f9ce..a82d048b32b20 100644
--- a/pkgs/development/libraries/qgnomeplatform/default.nix
+++ b/pkgs/development/libraries/qgnomeplatform/default.nix
@@ -14,13 +14,13 @@
 
 mkDerivation rec {
   pname = "qgnomeplatform";
-  version = "0.6.0";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "FedoraQt";
     repo = "QGnomePlatform";
     rev = version;
-    sha256 = "0fb1mzs6sx76bl7f0z2xhc0jq6y1c55jrw1v3na8577is6g5ji0a";
+    sha256 = "1mwqg2zk0sfjq54vz2jjahbgi5sxw8rb71h6mgg459wp99mhlqi0";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/qtstyleplugin-kvantum-qt4/default.nix b/pkgs/development/libraries/qtstyleplugin-kvantum-qt4/default.nix
index 7c2a99804c4d8..f17165b5ed34c 100644
--- a/pkgs/development/libraries/qtstyleplugin-kvantum-qt4/default.nix
+++ b/pkgs/development/libraries/qtstyleplugin-kvantum-qt4/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qtstyleplugin-kvantum-qt4";
-  version = "0.11.2";
+  version = "0.15.2";
 
   src = fetchFromGitHub {
     owner = "tsujan";
     repo = "Kvantum";
     rev = "V${version}";
-    sha256 = "1jcfv96ws6sm3kc2q8zriwqhry24qbq3zbp8gkqw75wssbv82rmc";
+    sha256 = "0cv0lxyi2sr0k7f03rsh1j28avdxd0l0480jsa95ca3d2lq392g3";
   };
 
   nativeBuildInputs = [ qmake4Hook ];
diff --git a/pkgs/development/libraries/sqlcipher/default.nix b/pkgs/development/libraries/sqlcipher/default.nix
index 66d30e26a0d89..f40c80391a236 100644
--- a/pkgs/development/libraries/sqlcipher/default.nix
+++ b/pkgs/development/libraries/sqlcipher/default.nix
@@ -1,18 +1,20 @@
-{ stdenv, lib, fetchFromGitHub, openssl, tcl, readline ? null, ncurses ? null }:
+{ stdenv, lib, fetchFromGitHub, openssl, tcl, installShellFiles, readline ? null, ncurses ? null }:
 
 assert readline != null -> ncurses != null;
 
 stdenv.mkDerivation rec {
   pname = "sqlcipher";
-  version = "4.3.0";
+  version = "4.4.0";
 
   src = fetchFromGitHub {
     owner = "sqlcipher";
     repo = "sqlcipher";
     rev = "v${version}";
-    sha256 = "0s1aiwl61nl3b4ym4v050wlbbx0iypknqsj3ar12dw5hljlzx6f8";
+    sha256 = "0mx0n5n3s39r25b31sdkrd4psxjqqgcv6rpm9d57w5rlk75g2fiv";
   };
 
+  nativeBuildInputs = [ installShellFiles ];
+
   buildInputs = [ readline ncurses openssl tcl ];
 
   configureFlags = [ "--enable-threadsafe" "--disable-tcl" ];
@@ -22,9 +24,13 @@ stdenv.mkDerivation rec {
 
   doCheck = false; # fails. requires tcl?
 
+  postInstall = ''
+    installManPage sqlcipher.1
+  '';
+
   meta = with stdenv.lib; {
-    homepage = "http://sqlcipher.net/";
-    description = "Full Database Encryption for SQLite";
+    homepage = "https://www.zetetic.net/sqlcipher/";
+    description = "SQLite extension that provides 256 bit AES encryption of database files";
     platforms = platforms.unix;
     license = licenses.bsd3;
   };
diff --git a/pkgs/development/ocaml-modules/afl-persistent/default.nix b/pkgs/development/ocaml-modules/afl-persistent/default.nix
new file mode 100644
index 0000000000000..5ac352e0762c1
--- /dev/null
+++ b/pkgs/development/ocaml-modules/afl-persistent/default.nix
@@ -0,0 +1,39 @@
+{ stdenv, fetchFromGitHub, ocaml, findlib, opaline }:
+
+stdenv.mkDerivation rec {
+  pname = "afl-persistent";
+  version = "1.3";
+  name = "ocaml${ocaml.version}-${pname}-${version}";
+
+  src = fetchFromGitHub {
+    owner  = "stedolan";
+    repo   = "ocaml-${pname}";
+    rev    = "v${version}";
+    sha256 = "06yyds2vcwlfr2nd3gvyrazlijjcrd1abnvkfpkaadgwdw3qam1i";
+  };
+
+  buildInputs = [ ocaml findlib ];
+
+  # don't run tests in buildPhase
+  # don't overwrite test binary
+  postPatch = ''
+    sed -i 's/ && \.\/test$//' build.sh
+    sed -i '/^ocamlopt.*test.ml -o test$/ s/$/2/' build.sh
+    patchShebangs build.sh
+  '';
+
+  buildPhase = "./build.sh";
+  installPhase = ''
+    ${opaline}/bin/opaline -prefix $out -libdir $out/lib/ocaml/${ocaml.version}/site-lib/ ${pname}.install
+  '';
+
+  doCheck = true;
+  checkPhase = "./_build/test && ./_build/test2";
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/stedolan/ocaml-afl-persistent";
+    description = "persistent-mode afl-fuzz for ocaml";
+    license = licenses.mit;
+    maintainers = [ maintainers.sternenseemann ];
+  };
+}
diff --git a/pkgs/development/python-modules/Wand/default.nix b/pkgs/development/python-modules/Wand/default.nix
index 872cda33b5921..e71d072428764 100644
--- a/pkgs/development/python-modules/Wand/default.nix
+++ b/pkgs/development/python-modules/Wand/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "Wand";
-  version = "0.5.9";
+  version = "0.6.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0a4v5cwnwsjxril7514ssvdqxsad227v5w7hcfqjkqzvaf7agb3f";
+    sha256 = "1wg7dlz6mhjp7mkqm5f8a2ak87p1zn46b6i754ys8f29nnqq01yz";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/codespell/default.nix b/pkgs/development/python-modules/codespell/default.nix
index dc531c77fb5d3..70c6347376358 100644
--- a/pkgs/development/python-modules/codespell/default.nix
+++ b/pkgs/development/python-modules/codespell/default.nix
@@ -1,11 +1,11 @@
 { lib, buildPythonApplication, fetchPypi, pytest, chardet }:
 buildPythonApplication rec {
   pname = "codespell";
-  version = "1.16.0";
+  version = "1.17.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1s9dl07ib77gq0iq26mrdpl1c46nkfm7nlhqwxpx5vvs6a1pqfxz";
+    sha256 = "08ydpw8pim7rhg1x2n711hxf2y6553nx0c0aqhfi3p4wdgcfr8i5";
   };
 
   checkInputs = [ pytest chardet ];
diff --git a/pkgs/development/python-modules/mpv/default.nix b/pkgs/development/python-modules/mpv/default.nix
index a74150f971b0c..e79f16b1c3b74 100644
--- a/pkgs/development/python-modules/mpv/default.nix
+++ b/pkgs/development/python-modules/mpv/default.nix
@@ -4,14 +4,14 @@
 
 buildPythonPackage rec {
   pname = "mpv";
-  version = "0.4.5";
+  version = "0.4.6";
   disabled = isPy27;
 
   src = fetchFromGitHub {
     owner = "jaseg";
     repo = "python-mpv";
     rev = "v${version}";
-    sha256 = "1y80c2k4s42lzvm5dz8wi186i7rsn1vs1wn30hp6v6vs62fb91fi";
+    sha256 = "1fh0fdv0k2yz7l6a62hf2svpgz34dzn84sh8fnv2x7wrkwd6r8qn";
   };
 
   buildInputs = [ mpv ];
diff --git a/pkgs/development/python-modules/nuitka/default.nix b/pkgs/development/python-modules/nuitka/default.nix
index 5eef92a2879e7..f65f5079b2c87 100644
--- a/pkgs/development/python-modules/nuitka/default.nix
+++ b/pkgs/development/python-modules/nuitka/default.nix
@@ -12,13 +12,13 @@ let
   # Therefore we create a separate env for it.
   scons = pkgs.python27.withPackages(ps: [ pkgs.scons ]);
 in buildPythonPackage rec {
-  version = "0.6.7";
+  version = "0.6.8.1";
   pname = "Nuitka";
 
   # Latest version is not yet on PyPi
   src = fetchurl {
     url = "https://github.com/kayhayen/Nuitka/archive/${version}.tar.gz";
-    sha256 = "09mrm7iz2wdrd7y2csbcidg6bkskjignx2pnifh4i8zlh0vm61bg";
+    sha256 = "1rn6i2mcljhb9nmh8qj3slcmqzs9jx8s7j8r2b7685n7751h5ipj";
   };
 
   checkInputs = [ vmprof pyqt4 ];
diff --git a/pkgs/development/python-modules/opt-einsum/default.nix b/pkgs/development/python-modules/opt-einsum/default.nix
index 85753ffa0714d..6bf0e451f040a 100644
--- a/pkgs/development/python-modules/opt-einsum/default.nix
+++ b/pkgs/development/python-modules/opt-einsum/default.nix
@@ -1,12 +1,12 @@
 { buildPythonPackage, fetchPypi, lib, numpy, pytest_4 }:
 
 buildPythonPackage rec {
-  version = "3.1.0";
+  version = "3.2.1";
   pname = "opt_einsum";
 
   src = fetchPypi {
     inherit version pname;
-    sha256 = "edfada4b1d0b3b782ace8bc14e80618ff629abf53143e1e6bbf9bd00b11ece77";
+    sha256 = "165r7rsl5j94kna4q3vsaq71z23lgxd9b20dgb6abrlas6c6mdw3";
   };
 
   propagatedBuildInputs = [ numpy ];
diff --git a/pkgs/development/python-modules/parsel/default.nix b/pkgs/development/python-modules/parsel/default.nix
index daaf845cdf0bb..319f83f727552 100644
--- a/pkgs/development/python-modules/parsel/default.nix
+++ b/pkgs/development/python-modules/parsel/default.nix
@@ -8,19 +8,20 @@
 , w3lib
 , lxml
 , cssselect
+, isPy27
 }:
 
 buildPythonPackage rec {
   pname = "parsel";
-  version = "1.5.2";
+  version = "1.6.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "08v76s6s4li7asnyz8a7gbp9vz522rv5apranyv76mb0lhmjd92d";
+    sha256 = "0yawf9r3r863lwxj0n89i7h3n8xjbsl5b7n6xg76r68scl5yzvvh";
   };
 
   checkInputs = [ pytest pytestrunner ];
-  propagatedBuildInputs = [ functools32 six w3lib lxml cssselect ];
+  propagatedBuildInputs = [ six w3lib lxml cssselect ] ++ lib.optionals isPy27 [ functools32 ];
 
   checkPhase = ''
     py.test
diff --git a/pkgs/development/python-modules/pdf2image/default.nix b/pkgs/development/python-modules/pdf2image/default.nix
index def036d271c9a..5fc61f6442387 100644
--- a/pkgs/development/python-modules/pdf2image/default.nix
+++ b/pkgs/development/python-modules/pdf2image/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "pdf2image";
-  version = "1.10.0";
+  version = "1.13.1";
 
   propagatedBuildInputs = [ pillow poppler_utils ];
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0bpprn5wcz414pqpvwjpd5cc0838shkw2cfvrwfiilhr09bhxbhb";
+    sha256 = "1l3jic687vnji952f4dp66jwiprpxskja9v4ffw3bpr6gxgq4syz";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/python-modules/pyftdi/default.nix b/pkgs/development/python-modules/pyftdi/default.nix
index d73ee24f58477..4cb6138d5ebb4 100644
--- a/pkgs/development/python-modules/pyftdi/default.nix
+++ b/pkgs/development/python-modules/pyftdi/default.nix
@@ -2,14 +2,14 @@
 
 buildPythonPackage rec {
   pname = "pyftdi";
-  version = "0.49.0";
+  version = "0.51.2";
   disabled = pythonOlder "3.5";
 
   src = fetchFromGitHub {
     owner = "eblot";
     repo = pname;
     rev = "v${version}";
-    sha256 = "063kwvgw7g4nn09pyqwqy72vnhzw0aajg23bi32vr0k49g8fx27s";
+    sha256 = "14mkwk44bgm6s4kqagz7nm6p6gsygmksl2628jaqh7ppblxca9as";
   };
 
   propagatedBuildInputs = [ pyusb pyserial ];
diff --git a/pkgs/development/python-modules/python-utils/default.nix b/pkgs/development/python-modules/python-utils/default.nix
index 67fbd4e24ebe1..936a1eb2e3ed5 100644
--- a/pkgs/development/python-modules/python-utils/default.nix
+++ b/pkgs/development/python-modules/python-utils/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "python-utils";
-  version = "2.3.0";
+  version = "2.4.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "34aaf26b39b0b86628008f2ae0ac001b30e7986a8d303b61e1357dfcdad4f6d3";
+    sha256 = "12c0glzkm81ljgf6pwh0d4rmdm1r7vvgg3ifzp8yp9cfyngw07zj";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/stripe/default.nix b/pkgs/development/python-modules/stripe/default.nix
index 109a5f6c76954..d675a1fd350d9 100644
--- a/pkgs/development/python-modules/stripe/default.nix
+++ b/pkgs/development/python-modules/stripe/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonPackage rec {
   pname = "stripe";
-  version = "2.47.0";
+  version = "2.48.0";
 
   # Tests require network connectivity and there's no easy way to disable
   # them. ~ C.
@@ -10,7 +10,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "14skddrf2nl25bvcyys0bgibjqkcivvfdywzldqjzyqvbwr4mkal";
+    sha256 = "1w9ns4jjj0p50im9vbjn084zph1g2sfa6l01ydl98qsyj76f4psi";
   };
 
   propagatedBuildInputs = [ requests ];
diff --git a/pkgs/development/python-modules/trimesh/default.nix b/pkgs/development/python-modules/trimesh/default.nix
index a65ea1e98ba5d..be135f651213c 100644
--- a/pkgs/development/python-modules/trimesh/default.nix
+++ b/pkgs/development/python-modules/trimesh/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "trimesh";
-  version = "3.6.36";
+  version = "3.6.38";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1m8dqqyzazrjk4d32cqn4d8gvbfcwgs2qbmgvpi2f2mi5vnp6d85";
+    sha256 = "0rdffk6a1jlfanb4i0prvy68qya8waa390yyw2kix4ja8fk7y6sx";
   };
 
   propagatedBuildInputs = [ numpy ];
diff --git a/pkgs/development/python-modules/unidiff/default.nix b/pkgs/development/python-modules/unidiff/default.nix
index 25ea689e9a2f7..d1e18111db318 100644
--- a/pkgs/development/python-modules/unidiff/default.nix
+++ b/pkgs/development/python-modules/unidiff/default.nix
@@ -2,14 +2,14 @@
 
 buildPythonPackage rec {
   pname = "unidiff";
-  version = "0.5.5";
+  version = "0.6.0";
 
   # PyPI tarball doesn't ship tests
   src = fetchFromGitHub {
     owner = "matiasb";
     repo = "python-unidiff";
     rev = "v${version}";
-    sha256 = "1nvi7s1nn5p7j6aql1nkn2kiadnfby98yla5m3jq8xwsx0aplwdm";
+    sha256 = "0farwkw0nbb5h4369pq3i6pp4047hav0h88ba55rzz5k7mr25rgi";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/tools/buildah/wrapper.nix b/pkgs/development/tools/buildah/wrapper.nix
new file mode 100644
index 0000000000000..bdc48bd6b1f7e
--- /dev/null
+++ b/pkgs/development/tools/buildah/wrapper.nix
@@ -0,0 +1,52 @@
+{ buildah-unwrapped
+, runCommand
+, makeWrapper
+, lib
+, extraPackages ? []
+, buildah
+, runc # Default container runtime
+, crun # Container runtime (default with cgroups v2 for podman/buildah)
+, conmon # Container runtime monitor
+, slirp4netns # User-mode networking for unprivileged namespaces
+, fuse-overlayfs # CoW for images, much faster than default vfs
+, utillinux # nsenter
+, cni-plugins # not added to path
+, iptables
+}:
+
+let
+  buildah = buildah-unwrapped;
+
+  binPath = lib.makeBinPath ([
+    runc
+    crun
+    conmon
+    slirp4netns
+    fuse-overlayfs
+    utillinux
+    iptables
+  ] ++ extraPackages);
+
+in runCommand buildah.name {
+  name = "${buildah.pname}-wrapper-${buildah.version}";
+  inherit (buildah) pname version;
+
+  meta = builtins.removeAttrs buildah.meta [ "outputsToInstall" ];
+
+  outputs = [
+    "out"
+    "man"
+  ];
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+} ''
+  ln -s ${buildah.man} $man
+
+  mkdir -p $out/bin
+  ln -s ${buildah-unwrapped}/share $out/share
+  makeWrapper ${buildah-unwrapped}/bin/buildah $out/bin/buildah \
+    --prefix PATH : ${binPath}
+''
diff --git a/pkgs/development/tools/cloudflare-wrangler/default.nix b/pkgs/development/tools/cloudflare-wrangler/default.nix
index a6db838870f0a..623afc3e7431b 100644
--- a/pkgs/development/tools/cloudflare-wrangler/default.nix
+++ b/pkgs/development/tools/cloudflare-wrangler/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cloudflare-wrangler";
-  version = "1.9.0";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = "wrangler";
     rev = "v${version}";
-    sha256 = "1iqy45isrf103yaf1xa1ksxp566fr9jh29aakv95rrx6ayz2cw9c";
+    sha256 = "09rq6lnv9993ah49jxqaqqhv5xxj51gxlqdi99wkj217cxp9gqqn";
   };
 
-  cargoSha256 = "0a0zyx5f46x0qfwkji1wffvk69qamaiqa85ix7mfa96r7ksrs3z3";
+  cargoSha256 = "0vlb1g4pki84n2zf6w3bisa7jpv0ws8nb3lgr0bkjrirf60a9xsk";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/development/tools/flatpak-builder/default.nix b/pkgs/development/tools/flatpak-builder/default.nix
index 32519594e4f01..85b68cff20d81 100644
--- a/pkgs/development/tools/flatpak-builder/default.nix
+++ b/pkgs/development/tools/flatpak-builder/default.nix
@@ -15,7 +15,7 @@
 , xmlto
 
 , acl
-, bazaar
+, breezy
 , binutils
 , bzip2
 , coreutils
@@ -89,7 +89,7 @@ in stdenv.mkDerivation rec {
     ./respect-xml-catalog-files-var.patch
     (substituteAll {
       src = ./fix-paths.patch;
-      bzr = "${bazaar}/bin/bzr";
+      bzr = "${breezy}/bin/bzr";
       cp = "${coreutils}/bin/cp";
       patch = "${patch}/bin/patch";
       tar = "${gnutar}/bin/tar";
diff --git a/pkgs/development/tools/just/default.nix b/pkgs/development/tools/just/default.nix
index 8ba536e3b5f5a..5fa2b12e9c39a 100644
--- a/pkgs/development/tools/just/default.nix
+++ b/pkgs/development/tools/just/default.nix
@@ -3,16 +3,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "just";
-  version = "0.5.10";
+  version = "0.5.11";
 
   src = fetchFromGitHub {
     owner = "casey";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0s8np28glzn3kmh59dwk86yc9fb2lm9fq2325kzmy7rkb5jsdcl1";
+    sha256 = "0li5lspxfrim8gymqzzd5djjfbfi7jh1m234qlzy5vkx2q9qg0xv";
   };
 
-  cargoSha256 = "05mrzav3aydvwac9jjckdmlxvxnlcncmkfsdb9z7zvxia4k89w1l";
+  cargoSha256 = "1sp8xrh3gmgmphh1bv050p1ybjybk9x8kswyxz2rd93q3zb5hpzz";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/misc/circleci-cli/default.nix b/pkgs/development/tools/misc/circleci-cli/default.nix
index e924f1b8251c9..7144c2bd0ae57 100644
--- a/pkgs/development/tools/misc/circleci-cli/default.nix
+++ b/pkgs/development/tools/misc/circleci-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "circleci-cli";
-  version = "0.1.7523";
+  version = "0.1.7868";
 
   src = fetchFromGitHub {
     owner = "CircleCI-Public";
     repo = pname;
     rev = "v${version}";
-    sha256 = "13rj9snz9z7hc2qzfyany7kmsssin1ixnni8yq43gz9kbxkqc49f";
+    sha256 = "1a9gnqrkvifrwr8wpv5f6zv8xs8myzbzlhn5w72xxzh2gxdaflwg";
   };
 
   vendorSha256 = "0y35ps2pw9z7gi4z50byd1py87bf2jdvj7l7w2gxpppmhi83myc9";
diff --git a/pkgs/development/tools/misc/hydra/common.nix b/pkgs/development/tools/misc/hydra/common.nix
index 75a9689267a19..4e9daab9bf1c5 100644
--- a/pkgs/development/tools/misc/hydra/common.nix
+++ b/pkgs/development/tools/misc/hydra/common.nix
@@ -1,6 +1,6 @@
 { stdenv, nix, perlPackages, buildEnv, fetchFromGitHub
 , makeWrapper, autoconf, automake, libtool, unzip, pkgconfig, sqlite, libpqxx
-, gitAndTools, mercurial, darcs, subversion, bazaar, openssl, bzip2, libxslt
+, gitAndTools, mercurial, darcs, subversion, breezy, openssl, bzip2, libxslt
 , guile, perl, postgresql, nukeReferences, git, boehmgc, nlohmann_json
 , docbook_xsl, openssh, gnused, coreutils, findutils, gzip, lzma, gnutar
 , rpm, dpkg, cdrkit, pixz, lib, boost, autoreconfHook, src ? null, version ? null
@@ -79,7 +79,7 @@ in stdenv.mkDerivation rec {
 
   buildInputs =
     [ makeWrapper autoconf automake libtool unzip nukeReferences sqlite libpqxx
-      gitAndTools.top-git mercurial /*darcs*/ subversion bazaar openssl bzip2 libxslt
+      gitAndTools.top-git mercurial /*darcs*/ subversion breezy openssl bzip2 libxslt
       perlDeps perl nix
       postgresql # for running the tests
       nlohmann_json
@@ -88,7 +88,7 @@ in stdenv.mkDerivation rec {
 
   hydraPath = lib.makeBinPath (
     [ sqlite subversion openssh nix coreutils findutils pixz
-      gzip bzip2 lzma gnutar unzip git gitAndTools.top-git mercurial /*darcs*/ gnused bazaar
+      gzip bzip2 lzma gnutar unzip git gitAndTools.top-git mercurial /*darcs*/ gnused breezy
     ] ++ lib.optionals stdenv.isLinux [ rpm dpkg cdrkit ] );
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
diff --git a/pkgs/development/tools/misc/uncrustify/default.nix b/pkgs/development/tools/misc/uncrustify/default.nix
index d13212085ef77..587896fce6802 100644
--- a/pkgs/development/tools/misc/uncrustify/default.nix
+++ b/pkgs/development/tools/misc/uncrustify/default.nix
@@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
   name = "${product}-${version}";
   product = "uncrustify";
-  version = "0.70.1";
+  version = "0.71.0";
 
   src = fetchFromGitHub {
     owner = product;
     repo = product;
     rev = name;
-    sha256 = "0zr3vxhd947zdvwccw3cj0vsriaawcpfjq3x94v9887hsi8fk87b";
+    sha256 = "1wyhkhn000yad94fnjj61h7lyvan6hig8wh7jxlnyp5wxdwki0pj";
   };
 
   nativeBuildInputs = [ cmake python ];
diff --git a/pkgs/development/tools/omnisharp-roslyn/default.nix b/pkgs/development/tools/omnisharp-roslyn/default.nix
index a81b7133e92f9..973f777d8cb9e 100644
--- a/pkgs/development/tools/omnisharp-roslyn/default.nix
+++ b/pkgs/development/tools/omnisharp-roslyn/default.nix
@@ -7,11 +7,11 @@
 stdenv.mkDerivation rec {
 
   pname = "omnisharp-roslyn";
-  version = "1.35.0";
-  
+  version = "1.35.1";
+
   src = fetchurl {
     url = "https://github.com/OmniSharp/omnisharp-roslyn/releases/download/v${version}/omnisharp-mono.tar.gz";
-    sha256 = "191jiyw6kx1rw241bg9nv5splfpz6ny90g9yf28cd0xwpx978p83";
+    sha256 = "0gx87qc9r3lhqn6q95y74z67sjcxnazkkdi9zswmaqyvjn8x7vf4";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -33,6 +33,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "OmniSharp based on roslyn workspaces";
+    homepage = "https://github.com/OmniSharp/omnisharp-roslyn";
     platforms = platforms.linux;
     license = licenses.mit;
     maintainers = with maintainers; [ tesq0 ];
diff --git a/pkgs/development/tools/spring-boot-cli/default.nix b/pkgs/development/tools/spring-boot-cli/default.nix
index 865c655e67f8f..b59ef341dffe5 100644
--- a/pkgs/development/tools/spring-boot-cli/default.nix
+++ b/pkgs/development/tools/spring-boot-cli/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "spring-boot-cli";
-  version = "2.2.6";
+  version = "2.3.0";
 
   src = fetchzip {
     url = "https://repo.spring.io/release/org/springframework/boot/${pname}/${version}.RELEASE/${pname}-${version}.RELEASE-bin.zip";
-    sha256 = "1rb21a8nr4mcdsfv3c3xh45kcpdwllhjfb26w9xsdgfh1j4mhb81";
+    sha256 = "1zjbgs1qx75jgxc46x9380iqh8pfgacih38ad3qxd0106a8lcp5h";
   };
 
   nativeBuildInputs = [ makeWrapper installShellFiles ];
diff --git a/pkgs/development/tools/vcstool/default.nix b/pkgs/development/tools/vcstool/default.nix
index bab3ebd57573f..c4a1cf7398701 100644
--- a/pkgs/development/tools/vcstool/default.nix
+++ b/pkgs/development/tools/vcstool/default.nix
@@ -1,5 +1,5 @@
 { stdenv, python3Packages
-, git, bazaar, subversion }:
+, git, breezy, subversion }:
 
 with python3Packages;
 
@@ -14,7 +14,7 @@ buildPythonApplication rec {
 
   propagatedBuildInputs = [ pyyaml setuptools ];
 
-  makeWrapperArgs = ["--prefix" "PATH" ":" (stdenv.lib.makeBinPath [ git bazaar subversion ])];
+  makeWrapperArgs = ["--prefix" "PATH" ":" (stdenv.lib.makeBinPath [ git breezy subversion ])];
 
   doCheck = false; # requires network
 
diff --git a/pkgs/games/factorio/default.nix b/pkgs/games/factorio/default.nix
index 691140b5bb8d7..19ed6ccab372e 100644
--- a/pkgs/games/factorio/default.nix
+++ b/pkgs/games/factorio/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, makeWrapper
 , alsaLib, libpulseaudio, libX11, libXcursor, libXinerama, libXrandr, libXi, libGL
-, factorio-utils
+, libSM, libICE, libXext, factorio-utils
 , releaseType
 , mods ? []
 , username ? "", token ? "" # get/reset token at https://factorio.com/profile
@@ -53,11 +53,11 @@ let
     x86_64-linux = let bdist = bdistForArch { inUrl = "linux64"; inTar = "x64"; }; in {
       alpha = {
         stable        = bdist { sha256 = "1fg2wnia6anzya4m53jf2xqwwspvwskz3awdb3j0v3fzijps94wc"; version = "0.17.79"; withAuth = true; };
-        experimental  = bdist { sha256 = "1fg2wnia6anzya4m53jf2xqwwspvwskz3awdb3j0v3fzijps94wc"; version = "0.17.79"; withAuth = true; };
+        experimental  = bdist { sha256 = "1ypq9qxry2b9a74p2i20f1yl20yf37xr4kvflbg1cn5nb8vvznxq"; version = "0.18.26"; withAuth = true; };
       };
       headless = {
         stable        = bdist { sha256 = "1pr39nm23fj83jy272798gbl9003rgi4vgsi33f2iw3dk3x15kls"; version = "0.17.79"; };
-        experimental  = bdist { sha256 = "1pr39nm23fj83jy272798gbl9003rgi4vgsi33f2iw3dk3x15kls"; version = "0.17.79"; };
+        experimental  = bdist { sha256 = "1srlzncwp1gcdy6ih8cc1ml5ggvg6xkw5jc2q95qjb9gpjv29mnl"; version = "0.18.26"; };
       };
       demo = {
         stable        = bdist { sha256 = "07qknasaqvzl9vy1fglm7xmdi7ynhmslrb0a209fhbfs0s7qqlgi"; version = "0.17.79"; };
@@ -166,7 +166,7 @@ let
       '';
       homepage = "https://www.factorio.com/";
       license = stdenv.lib.licenses.unfree;
-      maintainers = with stdenv.lib.maintainers; [ Baughn elitak ];
+      maintainers = with stdenv.lib.maintainers; [ Baughn elitak erictapen ];
       platforms = [ "i686-linux" "x86_64-linux" ];
     };
   };
@@ -186,6 +186,9 @@ let
         libXrandr
         libXi
         libGL
+        libSM
+        libICE
+        libXext
       ];
 
       installPhase = base.installPhase + ''
diff --git a/pkgs/games/katago/default.nix b/pkgs/games/katago/default.nix
index cbbdb538513cf..0a9ebd9e3eb40 100644
--- a/pkgs/games/katago/default.nix
+++ b/pkgs/games/katago/default.nix
@@ -6,6 +6,7 @@
 , cmake
 , makeWrapper
 , fetchFromGitHub
+, fetchpatch
 , cudnn ? null
 , cudatoolkit ? null
 , libGL_driver ? null
@@ -34,15 +35,30 @@ let
 
 in env.mkDerivation rec {
   pname = "katago";
-  version = "1.3.5";
+  version = "1.4.2";
 
   src = fetchFromGitHub {
     owner = "lightvector";
     repo = "katago";
     rev = "v${version}";
-    sha256 = "1625s3fh0xc2ldgyl6sjdjmpliyys7rzzkcys6h9x6k828g8n0lq";
+    sha256 = "0qdc9hgbzd175b2xkjs62dy6gyybcn9lf1mifiyhjbzjpgv192h4";
   };
 
+  # To workaround CMake 3.17.0's new buggy behavior wrt CUDA Compiler testing
+  # See the following tracking issues:
+  # KataGo:
+  #  - Issue #225: https://github.com/lightvector/KataGo/issues/225
+  #  - PR #227: https://github.com/lightvector/KataGo/pull/227
+  # CMake:
+  #  - Issue #20708: https://gitlab.kitware.com/cmake/cmake/-/issues/20708
+  patches = [
+    (fetchpatch {
+      name = "227.patch";
+      url = "https://patch-diff.githubusercontent.com/raw/lightvector/KataGo/pull/227.patch";
+      sha256 = "03f1vmdjhb79mpj95sijcwla8acy32clrjgrn4xqw5h90zdgj511";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
     makeWrapper
diff --git a/pkgs/misc/vim-plugins/generated.nix b/pkgs/misc/vim-plugins/generated.nix
index f0d93572de590..3094a3244c085 100644
--- a/pkgs/misc/vim-plugins/generated.nix
+++ b/pkgs/misc/vim-plugins/generated.nix
@@ -4631,6 +4631,18 @@ let
     meta.homepage = "https://github.com/rhysd/vim-grammarous/";
   };
 
+  vim-graphql = buildVimPluginFrom2Nix {
+    pname = "graphql";
+    version = "2020-03-30";
+    src = fetchFromGitHub {
+      owner = "jparise";
+      repo = "vim-graphql";
+      rev = "a3ff39f955e60baeddd8c3c4d1cab291ce37d66e";
+      sha256 = "0d98b0zpbyjcafp0q25c3qsx13q74nszxsi5jxxjnpz1wv6s83x1";
+    };
+    meta.homepage = "https://github.com/jparise/vim-graphql/";
+  };
+
   vim-grepper = buildVimPluginFrom2Nix {
     pname = "vim-grepper";
     version = "2019-12-09";
diff --git a/pkgs/misc/vim-plugins/vim-plugin-names b/pkgs/misc/vim-plugins/vim-plugin-names
index 4af22bd833eeb..cbb60707adffa 100644
--- a/pkgs/misc/vim-plugins/vim-plugin-names
+++ b/pkgs/misc/vim-plugins/vim-plugin-names
@@ -175,6 +175,7 @@ jonsmithers/vim-html-template-literals
 joonty/vim-xdebug
 josa42/coc-go
 jpalardy/vim-slime
+jparise/vim-graphql
 jparise/vim-phabricator
 jreybert/vimagit
 jsfaint/gen_tags.vim
diff --git a/pkgs/os-specific/linux/libfabric/default.nix b/pkgs/os-specific/linux/libfabric/default.nix
index 6383832a7e735..40f92f38d1642 100644
--- a/pkgs/os-specific/linux/libfabric/default.nix
+++ b/pkgs/os-specific/linux/libfabric/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libfabric";
-  version = "1.10.0";
+  version = "1.10.1";
 
   enableParallelBuilding = true;
 
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     owner = "ofiwg";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0amgc5w7qg96r9a21jl92m6jzn4z2j3iyk7jf7kwyzfi4jhlkv89";
+    sha256 = "0nf5x4v9rhyd67r6f6q3dw4sraaja8jfdkhhg9g8x41czmx4d456";
   };
 
   nativeBuildInputs = [ pkgconfig autoreconfHook ] ;
diff --git a/pkgs/os-specific/linux/usbguard/default.nix b/pkgs/os-specific/linux/usbguard/default.nix
index 3b4c1c4b6655c..ad751b9cfe061 100644
--- a/pkgs/os-specific/linux/usbguard/default.nix
+++ b/pkgs/os-specific/linux/usbguard/default.nix
@@ -12,14 +12,14 @@ with stdenv.lib;
 assert libgcrypt != null -> libsodium == null;
 
 stdenv.mkDerivation rec {
-  version = "0.7.6";
+  version = "0.7.8";
   pname = "usbguard";
 
   repo = "https://github.com/USBGuard/usbguard";
 
   src = fetchurl {
     url = "${repo}/releases/download/${pname}-${version}/${pname}-${version}.tar.gz";
-    sha256 = "0gzhs8s4aka86mkcjib36z54si939ki4bmk46p6v8kln1fixad3j";
+    sha256 = "1il5immqfxh2cj8wn1bfk7l42inflzgjf07yqprpz7r3lalbxc25";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/dns/knot-dns/default.nix b/pkgs/servers/dns/knot-dns/default.nix
index d76b51bcc661f..3dc6fd3e2c73e 100644
--- a/pkgs/servers/dns/knot-dns/default.nix
+++ b/pkgs/servers/dns/knot-dns/default.nix
@@ -8,11 +8,11 @@ let inherit (stdenv.lib) optional optionals; in
 # Note: ATM only the libraries have been tested in nixpkgs.
 stdenv.mkDerivation rec {
   pname = "knot-dns";
-  version = "2.9.4";
+  version = "2.9.5";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/knot-dns/knot-${version}.tar.xz";
-    sha256 = "57f3c93a1b40dfa0431508203f559b7ea257afab79078c38bcddf960d5a4a501";
+    sha256 = "1109a8ba212ff8ddfdbaf44a6f8fc13a2b880a98a9e54c19112ba72a1aacbf76";
   };
 
   outputs = [ "bin" "out" "dev" ];
diff --git a/pkgs/servers/monitoring/loki/default.nix b/pkgs/servers/monitoring/loki/default.nix
index e8804702f0dd4..668695aa8df2e 100644
--- a/pkgs/servers/monitoring/loki/default.nix
+++ b/pkgs/servers/monitoring/loki/default.nix
@@ -1,7 +1,7 @@
 { stdenv, buildGoPackage, fetchFromGitHub, makeWrapper, systemd }:
 
 buildGoPackage rec {
-  version = "1.4.0";
+  version = "1.5.0";
   pname = "grafana-loki";
   goPackagePath = "github.com/grafana/loki";
 
@@ -11,7 +11,7 @@ buildGoPackage rec {
     rev = "v${version}";
     owner = "grafana";
     repo = "loki";
-    sha256 = "0dz0icbkwpmysl5jyljmj783xdzrbbxbfxfkizw7gcs8jjxbqvfl";
+    sha256 = "137lnd69p8qfg2z8l32dr1mrk2lhrxjx392xfij11sy5i9blfc3n";
   };
 
   postPatch = ''
diff --git a/pkgs/servers/monitoring/sensu-go/default.nix b/pkgs/servers/monitoring/sensu-go/default.nix
index d7a1296a7daae..5f9f3b80f8007 100644
--- a/pkgs/servers/monitoring/sensu-go/default.nix
+++ b/pkgs/servers/monitoring/sensu-go/default.nix
@@ -4,7 +4,7 @@ let
   generic = { subPackages, pname, postInstall ? "" }:
     buildGoModule rec {
       inherit pname;
-      version = "5.20.0";
+      version = "5.20.1";
       shortRev = "3a1ac58"; # for internal version info
 
       goPackagePath = "github.com/sensu/sensu-go";
@@ -13,7 +13,7 @@ let
         owner = "sensu";
         repo = "sensu-go";
         rev = "v${version}";
-        sha256 = "0hnsgd6ryrl1y2prkavm7psqjnppkkfd891xkzbdfzblxsafs8cw";
+        sha256 = "0wrcchz878sq7zhkb8p0s93k92xppihv5yyvkl363xs6519xzm7m";
       };
 
       inherit subPackages postInstall;
diff --git a/pkgs/servers/monitoring/telegraf/default.nix b/pkgs/servers/monitoring/telegraf/default.nix
index 28516e0be5956..adc42173f8e5c 100644
--- a/pkgs/servers/monitoring/telegraf/default.nix
+++ b/pkgs/servers/monitoring/telegraf/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "telegraf";
-  version = "1.14.2";
+  version = "1.14.3";
 
   goPackagePath = "github.com/influxdata/telegraf";
 
@@ -14,7 +14,7 @@ buildGoModule rec {
     owner = "influxdata";
     repo = "telegraf";
     rev = "v${version}";
-    sha256 = "009m9hysih55dn4p21vr7jfgc6l5jywyl98q3k068z5skrd8xqdb";
+    sha256 = "11rd54brdbxb5ari6zan7gyr0fa1m0rmwcn5a8h8dla3xprw30wp";
   };
 
   vendorSha256 = "05nj99hl5f5l0a2aswy19wmbm94hd1h03r227gmn419dkzc5hpah";
diff --git a/pkgs/servers/web-apps/engelsystem/default.nix b/pkgs/servers/web-apps/engelsystem/default.nix
new file mode 100644
index 0000000000000..8ef6a9afa0e8f
--- /dev/null
+++ b/pkgs/servers/web-apps/engelsystem/default.nix
@@ -0,0 +1,52 @@
+{ stdenv, fetchzip, php, writeText, nixosTests }:
+
+let
+  phpExt = php.withExtensions
+    ({ enabled, all }: with all; [ json filter mysqlnd mysqli pdo pdo_mysql ]);
+in stdenv.mkDerivation rec {
+  pname = "engelsystem";
+  version = "3.1.0";
+
+  src = fetchzip {
+    url =
+      "https://github.com/engelsystem/engelsystem/releases/download/v3.1.0/engelsystem-v3.1.0.zip";
+    sha256 = "01wra7li7n5kn1l6xkrmw4vlvvyqh089zs43qzn98hj0mw8gw7ai";
+    # This is needed, because the zip contains a directory with world write access, which is not allowed in nix
+    extraPostFetch = "chmod -R a-w $out";
+  };
+
+  buildInputs = [ phpExt ];
+
+  installPhase = ''
+    runHook preInstall
+
+    # prepare
+    rm -r ./storage/
+    rm -r ./docker/
+
+    ln -sf /etc/engelsystem/config.php ./config/config.php
+    ln -sf /var/lib/engelsystem/storage/ ./storage
+
+    mkdir -p $out/share/engelsystem
+    mkdir -p $out/bin
+    cp -r . $out/share/engelsystem
+
+    echo $(command -v php)
+    # The patchShebangAuto function always used the php without extensions, so path the shebang manually
+    sed -i -e "1 s|.*|#\!${phpExt}/bin/php|" "$out/share/engelsystem/bin/migrate"
+    ln -s "$out/share/engelsystem/bin/migrate" "$out/bin/migrate"
+
+    runHook postInstall
+  '';
+
+  passthru.tests = nixosTests.engelsystem;
+
+  meta = with stdenv.lib; {
+    description =
+      "Coordinate your helpers in teams, assign them to work shifts or let them decide for themselves when and where they want to help with what";
+    license = licenses.gpl2;
+    homepage = "https://engelsystem.de";
+    maintainers = with maintainers; [ kloenk ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/servers/xmpp/prosody/default.nix b/pkgs/servers/xmpp/prosody/default.nix
index 702da004b4209..05e276f0b9892 100644
--- a/pkgs/servers/xmpp/prosody/default.nix
+++ b/pkgs/servers/xmpp/prosody/default.nix
@@ -1,5 +1,6 @@
 { stdenv, fetchurl, lib, libidn, openssl, makeWrapper, fetchhg
 , lua5, luasocket, luasec, luaexpat, luafilesystem, luabitop
+, nixosTests
 , withLibevent ? true, luaevent ? null
 , withDBI ? true, luadbi ? null
 # use withExtraLibs to add additional dependencies of community modules
@@ -71,7 +72,13 @@ stdenv.mkDerivation rec {
         --prefix LUA_CPATH ';' "$LUA_CPATH"
     '';
 
-  passthru.communityModules = withCommunityModules;
+  passthru = {
+    communityModules = withCommunityModules;
+    tests = {
+      main = nixosTests.prosody;
+      mysql = nixosTests.prosodyMysql;
+    };
+  };
 
   meta = {
     description = "Open-source XMPP application server written in Lua";
diff --git a/pkgs/shells/zsh/oh-my-zsh/default.nix b/pkgs/shells/zsh/oh-my-zsh/default.nix
index dce9b82d026dd..845d0fa438977 100644
--- a/pkgs/shells/zsh/oh-my-zsh/default.nix
+++ b/pkgs/shells/zsh/oh-my-zsh/default.nix
@@ -4,13 +4,13 @@
 { stdenv, fetchgit }:
 
 stdenv.mkDerivation rec {
-  version = "2020-05-21";
+  version = "2020-05-24";
   pname = "oh-my-zsh";
-  rev = "b721053c87b4662c65452117a8db35af0154a29d";
+  rev = "5ea25e6736430ab5b8439d11b2e9a837a803771b";
 
   src = fetchgit { inherit rev;
     url = "https://github.com/ohmyzsh/ohmyzsh";
-    sha256 = "02y6mhvsxamsvfx2bcdrfbbl7g8v1cq8qycjbffn4w3d6aprq5c6";
+    sha256 = "047vdx7c5fsli6yh35kmp25nxs2bgji21837iq5dwq8nvyq42a9i";
   };
 
   pathsToLink = [ "/share/oh-my-zsh" ];
diff --git a/pkgs/tools/backup/bup/default.nix b/pkgs/tools/backup/bup/default.nix
index 182e37283dfd5..57ab854a33cbd 100644
--- a/pkgs/tools/backup/bup/default.nix
+++ b/pkgs/tools/backup/bup/default.nix
@@ -5,7 +5,7 @@
 
 assert par2Support -> par2cmdline != null;
 
-let version = "0.30"; in
+let version = "0.30.1"; in
 
 with stdenv.lib;
 
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
     repo = "bup";
     owner = "bup";
     rev = version;
-    sha256 = "0kzi9mzgmx1kjv3aldawapz7bk73f02bysiwh8rngqnirmm0vxdp";
+    sha256 = "0z9rpmmi6mbm48ynd6izr0f8l3cklfyar6gjy0c8z9zal1ac9r55";
   };
 
   buildInputs = [
diff --git a/pkgs/tools/backup/monolith/default.nix b/pkgs/tools/backup/monolith/default.nix
index f3bcf82e54575..261267b809a1e 100644
--- a/pkgs/tools/backup/monolith/default.nix
+++ b/pkgs/tools/backup/monolith/default.nix
@@ -3,25 +3,27 @@
 , fetchFromGitHub
 , pkg-config
 , openssl
+, Security
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "monolith";
-  version = "2.2.5";
+  version = "2.2.6";
 
   src = fetchFromGitHub {
     owner = "Y2Z";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0w19szxzhwxbgnv4k618p8v29dhbar1fn433bsz1cr1apnrahmkn";
+    sha256 = "0ifv1h16xrs40gw5wx7kwj7hirnzpgfrznskz2igsslk7ycjlbr1";
   };
 
-  cargoSha256 = "06gc3cpx1m2f6fwrm8brw5nidg1v02q1qwqfxvv3xzmmczbw4345";
+  cargoSha256 = "1plx9p265jcc6wg3bhcdk1f77md8ann08kkv3g2706d82kxy2c1i";
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ openssl ];
+  nativeBuildInputs = stdenv.lib.optionals stdenv.isLinux [ pkg-config ];
+  buildInputs = stdenv.lib.optionals stdenv.isLinux [ openssl ]
+    ++ stdenv.lib.optionals stdenv.isDarwin [ Security ];
 
-  checkPhase = "cargo test -- --skip tests::cli";
+  checkFlagsArray = [ "--skip=tests::cli" ];
 
   meta = with stdenv.lib; {
     description = "Bundle any web page into a single HTML file";
diff --git a/pkgs/tools/graphics/imgurbash2/default.nix b/pkgs/tools/graphics/imgurbash2/default.nix
index 14761e7763ce6..ea3b1ed9b02de 100644
--- a/pkgs/tools/graphics/imgurbash2/default.nix
+++ b/pkgs/tools/graphics/imgurbash2/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "imgurbash2";
-  version = "3.1";
+  version = "3.2";
 
   src = fetchFromGitHub {
     owner = "ram-on";
     repo = "imgurbash2";
     rev = version;
-    sha256 = "1hqghlk8c6svfszhmp02bhkc791lqhqffgiypf05giqmr5d8b9a9";
+    sha256 = "10zs6p17psl1vq5vpkfkf9nrlmibk6v1ds3yxbf1rip1zaqlwxg6";
   };
 
   installPhase = ''
diff --git a/pkgs/tools/misc/jdupes/default.nix b/pkgs/tools/misc/jdupes/default.nix
index 2898cfb679827..ae0b32d2120dd 100644
--- a/pkgs/tools/misc/jdupes/default.nix
+++ b/pkgs/tools/misc/jdupes/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "jdupes";
-  version = "1.14.0";
+  version = "1.15.0";
 
   src = fetchFromGitHub {
     owner = "jbruchon";
     repo  = "jdupes";
     rev   = "v${version}";
-    sha256 = "18hn25f7cdz1li0vvx74al7a8z2220xhzjp9j6idhldsmjnscgq8";
+    sha256 = "05q2ys7ii6mqiddl9ixzqhbvk4xy5ckh3yfz26vycxiyh9cp7yls";
     # Unicode file names lead to different checksums on HFS+ vs. other
     # filesystems because of unicode normalisation. The testdir
     # directories have such files and will be removed.
diff --git a/pkgs/tools/misc/osinfo-db-tools/default.nix b/pkgs/tools/misc/osinfo-db-tools/default.nix
index 3e678b1d378a1..a93ec0ab573ff 100644
--- a/pkgs/tools/misc/osinfo-db-tools/default.nix
+++ b/pkgs/tools/misc/osinfo-db-tools/default.nix
@@ -1,17 +1,17 @@
-{ stdenv, fetchurl, pkgconfig, gettext, glib, libxml2, perl
+{ stdenv, fetchurl, pkgconfig, meson, ninja, gettext, glib, libxml2, perl, python3
 , libxslt, libarchive, bzip2, lzma, json-glib, libsoup
 }:
 
 stdenv.mkDerivation rec {
   pname = "osinfo-db-tools";
-  version = "1.6.0";
+  version = "1.7.0";
 
   src = fetchurl {
-    url = "https://releases.pagure.org/libosinfo/${pname}-${version}.tar.gz";
-    sha256 = "0x155d4hqz7mabgqvgydqjm9d8aabc78vr0v0pnsp9vkdlcv3mfh";
+    url = "https://releases.pagure.org/libosinfo/${pname}-${version}.tar.xz";
+    sha256 = "08x8mrafphyll0d35xdc143rip3ahrz6bmzhc85nwhq7yk2vxpab";
   };
 
-  nativeBuildInputs = [ pkgconfig gettext perl ];
+  nativeBuildInputs = [ meson ninja pkgconfig gettext perl python3 ];
   buildInputs = [ glib json-glib libxml2 libxslt libarchive bzip2 lzma libsoup ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/zoxide/default.nix b/pkgs/tools/misc/zoxide/default.nix
index d2abd143ce457..ab8633c499046 100644
--- a/pkgs/tools/misc/zoxide/default.nix
+++ b/pkgs/tools/misc/zoxide/default.nix
@@ -6,20 +6,20 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "zoxide";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "ajeetdsouza";
     repo = "zoxide";
     rev = "v${version}";
-    sha256 = "1qkvmjrkcivfzbm6swl5lgvpqz9av9jxcn9i8ms3wz4vfsibmlxv";
+    sha256 = "1zfk9y5f12h2d5zwf2z8c95xwhbhc6ayv971875fbxgz1nd8vqb6";
   };
 
   buildInputs = [
     fzf
   ];
 
-  cargoSha256 = "1w921f7b6kzc1mjzff1bcs3mg4cp9h48698w2zlv5jzjs7nwgb8n";
+  cargoSha256 = "0z0p3cxxazw19bmk3zw7z2q93p00ywsa2cz1jhy78mn5pq1v95rd";
 
   meta = with lib; {
     description = "A fast cd command that learns your habits";
diff --git a/pkgs/tools/networking/amass/default.nix b/pkgs/tools/networking/amass/default.nix
index 5fe28d6fd90d9..ebe67b27e7c75 100644
--- a/pkgs/tools/networking/amass/default.nix
+++ b/pkgs/tools/networking/amass/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "amass";
-  version = "3.6.1";
+  version = "3.6.2";
 
   src = fetchFromGitHub {
     owner = "OWASP";
     repo = "Amass";
     rev = "v${version}";
-    sha256 = "0lpnsp4bj87pkfcgwq95v6rd2gas0nk0s57jbby8jvlcacgf5bas";
+    sha256 = "1ih681790sp0lqfbsl153dpr5vzxp1jjza28pajrqjzs7zyjmkgs";
   };
 
   vendorSha256 = "1f8za3z5pv1pznbd91fk5j4y8qg93qk5zvnchjl7inyirciawdf6";
diff --git a/pkgs/tools/networking/ofono/0001-Search-connectors-in-OFONO_PLUGIN_PATH.patch b/pkgs/tools/networking/ofono/0001-Search-connectors-in-OFONO_PLUGIN_PATH.patch
index eb97209a693e4..c1174e1093a80 100644
--- a/pkgs/tools/networking/ofono/0001-Search-connectors-in-OFONO_PLUGIN_PATH.patch
+++ b/pkgs/tools/networking/ofono/0001-Search-connectors-in-OFONO_PLUGIN_PATH.patch
@@ -98,7 +98,7 @@ index 924a45ec..f05055c3 100644
 +
 +	plugin_path = g_getenv ("OFONO_PLUGIN_PATH");
 +
-+	if (!plugin_path) {
++	if (plugin_path) {
 +		gchar **plugin_path_list;
 +		gsize i;
 +
diff --git a/pkgs/tools/package-management/nix-prefetch-scripts/default.nix b/pkgs/tools/package-management/nix-prefetch-scripts/default.nix
index 2c5781a95b8c7..bab12ca8e8df3 100644
--- a/pkgs/tools/package-management/nix-prefetch-scripts/default.nix
+++ b/pkgs/tools/package-management/nix-prefetch-scripts/default.nix
@@ -1,5 +1,5 @@
 { stdenv, makeWrapper, buildEnv,
-  bazaar, coreutils, cvs, findutils, gawk, git, gnused, mercurial, nix, subversion
+  breezy, coreutils, cvs, findutils, gawk, git, gnused, mercurial, nix, subversion
 }:
 
 let mkPrefetchScript = tool: src: deps:
@@ -26,7 +26,7 @@ let mkPrefetchScript = tool: src: deps:
     };
   };
 in rec {
-  nix-prefetch-bzr = mkPrefetchScript "bzr" ../../../build-support/fetchbzr/nix-prefetch-bzr [ bazaar ];
+  nix-prefetch-bzr = mkPrefetchScript "bzr" ../../../build-support/fetchbzr/nix-prefetch-bzr [ breezy ];
   nix-prefetch-cvs = mkPrefetchScript "cvs" ../../../build-support/fetchcvs/nix-prefetch-cvs [ cvs ];
   nix-prefetch-git = mkPrefetchScript "git" ../../../build-support/fetchgit/nix-prefetch-git [ coreutils findutils gawk git ];
   nix-prefetch-hg  = mkPrefetchScript "hg"  ../../../build-support/fetchhg/nix-prefetch-hg   [ mercurial ];
diff --git a/pkgs/tools/security/fprintd/default.nix b/pkgs/tools/security/fprintd/default.nix
index b119a6ed29ff8..62f5dda17f67f 100644
--- a/pkgs/tools/security/fprintd/default.nix
+++ b/pkgs/tools/security/fprintd/default.nix
@@ -1,42 +1,70 @@
-{ thinkpad ? false
-, stdenv
-, fetchurl
+{ stdenv
+, fetchFromGitLab
 , fetchpatch
 , pkgconfig
-, intltool
-, libfprint-thinkpad ? null
-, libfprint ? null
+, meson
+, ninja
+, perl
+, gettext
+, cairo
+, gtk-doc
+, libxslt
+, docbook-xsl-nons
+, docbook_xml_dtd_412
 , glib
+, dbus
 , dbus-glib
 , polkit
 , nss
 , pam
 , systemd
-, autoreconfHook
-, gtk-doc
+, libfprint
+, python3
 }:
 
 stdenv.mkDerivation rec {
-  pname = "fprintd" + stdenv.lib.optionalString thinkpad "-thinkpad";
-  version = "0.9.0";
+  pname = "fprintd";
+  version = "1.90.1";
+  outputs = [ "out" "devdoc" ];
 
-  src = fetchurl {
-    url = "https://gitlab.freedesktop.org/libfprint/fprintd/uploads/9dec4b63d1f00e637070be1477ce63c0/fprintd-${version}.tar.xz";
-    sha256 = "182gcnwb6zjwmk0dn562rjmpbk7ac7dhipbfdhfic2sn1jzis49p";
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "libfprint";
+    repo = pname;
+    rev = version;
+    sha256 = "0mbzk263x7f58i9cxhs44mrngs7zw5wkm62j5r6xlcidhmfn03cg";
   };
 
   patches = [
+    # Fixes issue with ":" when there is multiple paths (might be the case on NixOS)
+    # https://gitlab.freedesktop.org/libfprint/fprintd/-/merge_requests/50
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/libfprint/fprintd/-/commit/d7fec03f24d10f88d34581c72f0eef201f5eafac.patch";
+      sha256 = "QNN05WF4YZ0XiTwm5NkfqZDuQpyXlnrh+RJF9SNsCDk=";
+    })
+
+    # Fix locating libpam_wrapper for tests
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/libfprint/fprintd/-/merge_requests/40.patch";
+      sha256 = "43uPihK6HhygHw1Qplwci80Wseq/S77VUp+OdEECHmM=";
+    })
     (fetchpatch {
-      url = "https://gitlab.freedesktop.org/libfprint/fprintd/merge_requests/16.patch";
-      sha256 = "1y39zsmxjll9hip8464qwhq5qg06c13pnafyafgxdph75lvhdll7";
+      url = "https://gitlab.freedesktop.org/libfprint/fprintd/-/commit/f401f399a85dbeb2de165b9b9162eb552ab6eea7.patch";
+      sha256 = "Pga+/QEkln8DOwGZfKM1r2urJX4Y3X0bozWWxKZ5ia0=";
     })
   ];
 
   nativeBuildInputs = [
-    intltool
     pkgconfig
-    autoreconfHook # Drop with above patch
-    gtk-doc # Drop with above patch
+    meson
+    ninja
+    perl
+    gettext
+    gtk-doc
+    libxslt
+    dbus
+    docbook-xsl-nons
+    docbook_xml_dtd_412
   ];
 
   buildInputs = [
@@ -46,23 +74,43 @@ stdenv.mkDerivation rec {
     nss
     pam
     systemd
-  ]
-  ++ stdenv.lib.optional thinkpad libfprint-thinkpad
-  ++ stdenv.lib.optional (!thinkpad) libfprint
-  ;
+    libfprint
+  ];
+
+  checkInputs = with python3.pkgs; [
+    python-dbusmock
+    dbus-python
+    pygobject3
+    pycairo
+    pypamtest
+  ];
 
-  configureFlags = [
-    # is hardcoded to /var/lib/fprint, this is for the StateDirectory install target
-    "--localstatedir=${placeholder "out"}/var"
-    "--sysconfdir=${placeholder "out"}/etc"
-    "--with-systemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
+  mesonFlags = [
+    "-Dgtk_doc=true"
+    "-Dpam_modules_dir=${placeholder "out"}/lib/security"
+    "-Dsysconfdir=${placeholder "out"}/etc"
+    "-Ddbus_service_dir=${placeholder "out"}/share/dbus-1/system-services"
+    "-Dsystemd_system_unit_dir=${placeholder "out"}/lib/systemd/system"
   ];
 
+  PKG_CONFIG_DBUS_1_INTERFACES_DIR = "${placeholder "out"}/share/dbus-1/interfaces";
+  PKG_CONFIG_POLKIT_GOBJECT_1_POLICYDIR = "${placeholder "out"}/share/polkit-1/actions";
+  PKG_CONFIG_DBUS_1_DATADIR = "${placeholder "out"}/share";
+
+  # FIXME: Ugly hack for tests to find libpam_wrapper.so
+  LIBRARY_PATH = stdenv.lib.makeLibraryPath [ python3.pkgs.pypamtest ];
+
+  doCheck = true;
+
+  postPatch = ''
+    patchShebangs po/check-translations.sh
+  '';
+
   meta = with stdenv.lib; {
     homepage = "https://fprint.freedesktop.org/";
     description = "D-Bus daemon that offers libfprint functionality over the D-Bus interprocess communication bus";
     license = licenses.gpl2;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ abbradar ];
+    maintainers = with maintainers; [ abbradar elyhaka ];
   };
 }
diff --git a/pkgs/tools/security/hcxdumptool/default.nix b/pkgs/tools/security/hcxdumptool/default.nix
index 6a2eee4714329..c7a5a99855521 100644
--- a/pkgs/tools/security/hcxdumptool/default.nix
+++ b/pkgs/tools/security/hcxdumptool/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hcxdumptool";
-  version = "6.0.5";
+  version = "6.0.6";
 
   src = fetchFromGitHub {
     owner = "ZerBea";
     repo = "hcxdumptool";
     rev = version;
-    sha256 = "0rh19lblz8wp8q2x123nlwvxq1pjq9zw12w18z83v2l2knjbc524";
+    sha256 = "1b4d543y64ib92w9gcmiyjn5hz2vyjqmxk3f3yr1zk04fhw16gmf";
   };
 
   buildInputs = [ openssl ];
diff --git a/pkgs/tools/security/tpm2-tools/default.nix b/pkgs/tools/security/tpm2-tools/default.nix
index 06826173e3408..282b1df299cfe 100644
--- a/pkgs/tools/security/tpm2-tools/default.nix
+++ b/pkgs/tools/security/tpm2-tools/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tpm2-tools";
-  version = "4.1.1";
+  version = "4.1.2";
 
   src = fetchurl {
     url = "https://github.com/tpm2-software/${pname}/releases/download/${version}/${pname}-${version}.tar.gz";
-    sha256 = "1cd74nd57wmms2yrnzs64xki29rf4kx61kd30fyd56wlicyjdfa0";
+    sha256 = "0di97zmxdh04m2ibyshcgvillwxx6rnd0543scm7q10y7nv74m0p";
   };
 
   nativeBuildInputs = [ pandoc pkgconfig makeWrapper ];
diff --git a/pkgs/tools/security/yara/default.nix b/pkgs/tools/security/yara/default.nix
index a470ad11caff8..8a11953502341 100644
--- a/pkgs/tools/security/yara/default.nix
+++ b/pkgs/tools/security/yara/default.nix
@@ -1,30 +1,28 @@
-{ stdenv, fetchFromGitHub, fetchpatch, autoconf, automake, libtool, pcre
+{ stdenv
+, fetchFromGitHub
+, autoreconfHook
+, pcre
+, pkg-config
+, protobufc
 , withCrypto ? true, openssl
 , enableMagic ? true, file
 , enableCuckoo ? true, jansson
 }:
 
 stdenv.mkDerivation rec {
-  version = "3.11.0";
+  version = "4.0.1";
   pname = "yara";
 
   src = fetchFromGitHub {
     owner = "VirusTotal";
     repo = "yara";
     rev = "v${version}";
-    sha256 = "0mx3xm2a70fx8vlynkavq8gfd9w5yjcix5rx85444i2s1h6kcd0j";
+    sha256 = "0dy8jf0pdn0wilxy1pj6pqjxg7icxkwax09w54np87gl9p00f5rk";
   };
 
-  # See: https://github.com/VirusTotal/yara/issues/1036
-  # TODO: This patch should not be necessary in the next release
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/VirusTotal/yara/commit/04df811fa61fa54390b274bfcf56d7403c184404.patch";
-      sha256 = "0hsbc2k7nmk2kskll971draz0an4rmcs5v0iql47mz596vqvkzmb";
-    })
-  ];
+  nativeBuildInputs = [ autoreconfHook pkg-config ];
 
-  buildInputs = [ autoconf automake libtool pcre ]
+  buildInputs = [ pcre protobufc ]
     ++ stdenv.lib.optionals withCrypto [ openssl ]
     ++ stdenv.lib.optionals enableMagic [ file ]
     ++ stdenv.lib.optionals enableCuckoo [ jansson ]
@@ -40,8 +38,8 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "The pattern matching swiss knife for malware researchers";
-    homepage    = "http://Virustotal.github.io/yara/";
-    license     = licenses.asl20;
-    platforms   = stdenv.lib.platforms.all;
+    homepage = "http://Virustotal.github.io/yara/";
+    license = licenses.asl20;
+    platforms = platforms.all;
   };
 }
diff --git a/pkgs/tools/system/disk-filltest/default.nix b/pkgs/tools/system/disk-filltest/default.nix
new file mode 100644
index 0000000000000..074b06aa4e666
--- /dev/null
+++ b/pkgs/tools/system/disk-filltest/default.nix
@@ -0,0 +1,38 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  pname = "disk-filltest";
+  version = "0.8.1";
+
+  src = fetchFromGitHub {
+    owner = "bingmann";
+    repo = "disk-filltest";
+    rev = "v${version}";
+    sha256 = "1vcb43hdln7xlklz1n0fsfp5x1j9pn829wbad4b110hrc7nwrnvm";
+  };
+
+  preBuild = ''
+    substituteInPlace Makefile --replace 'prefix = /usr/local' 'prefix = $(out)'
+  '';
+
+  postInstall = ''
+    install -D -m0644 -t $out/share/doc COPYING README
+    mkdir -p $out/share/man; mv $out/man1 $out/share/man
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Simple program to detect bad disks by filling them with random data";
+    longDescription = ''
+      disk-filltest is a tool to check storage disks for coming
+      failures by write files with pseudo-random data to the current
+      directory until the disk is full, read the files again
+      and verify the sequence written. It also can measure
+      read/write speed while filling the disk.
+    '';
+    homepage = "https://panthema.net/2013/disk-filltest";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ caadar ];
+    platforms = platforms.all;
+  };
+
+}
diff --git a/pkgs/tools/system/stress-ng/default.nix b/pkgs/tools/system/stress-ng/default.nix
index 883305b1d54fb..5e50c3c875313 100644
--- a/pkgs/tools/system/stress-ng/default.nix
+++ b/pkgs/tools/system/stress-ng/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "stress-ng";
-  version = "0.11.08";
+  version = "0.11.10";
 
   src = fetchurl {
     url = "https://kernel.ubuntu.com/~cking/tarballs/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1xy5m5r4icc10h957ank0amnh46v2v47z4n1z43d9s7lmvahw287";
+    sha256 = "0x46shnwllv5knpbxj1vj2aqmxgnfhz582crlacwsinc22n1j18i";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/text/mdcat/default.nix b/pkgs/tools/text/mdcat/default.nix
index f6612caa3ad4a..38ef6561ac6a7 100644
--- a/pkgs/tools/text/mdcat/default.nix
+++ b/pkgs/tools/text/mdcat/default.nix
@@ -2,19 +2,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdcat";
-  version = "0.17.0";
+  version = "0.17.1";
 
   src = fetchFromGitHub {
     owner = "lunaryorn";
     repo = pname;
     rev = "mdcat-${version}";
-    sha256 = "04kmlsg13mqlcpi5as760ycrqmznaaj7840hzxkri29mj05mgzq0";
+    sha256 = "0kkpacb31d0rg4774a63x3njifn3813d8r8vc8skzv4ki7gvhxkr";
   };
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ openssl ] ++ stdenv.lib.optional stdenv.isDarwin Security;
 
-  cargoSha256 = "1lpivksjiyyg5ap97ccpq30q4n09sf259ds0hj49wihjrgd0h0c7";
+  cargoSha256 = "1pljgnckardy3j81im6k5dssz794c7vjx1dfr7950ndhrzwv7p22";
 
   checkInputs = [ ansi2html ];
   checkPhase = ''
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 5eb7c2011832d..a01f5a9a34086 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -50,6 +50,8 @@ mapAliases ({
   bar-xft = lemonbar-xft;  # added 2015-01-16
   bashCompletion = bash-completion; # Added 2016-09-28
   batti = throw "batti has been removed from nixpkgs, as it was unmaintained"; # added 2019-12-10
+  bazaar = throw "bazaar has been deprecated by breezy."; # added 2020-04-19
+  bazaarTools = throw "bazaar has been deprecated by breezy."; # added 2020-04-19
   beegfs = throw "beegfs has been removed."; # added 2019-11-24
   bluezFull = bluez; # Added 2019-12-03
   bridge_utils = bridge-utils;  # added 2015-02-20
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 7bd1772db8380..bc6c8e13f961f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -173,6 +173,8 @@ in
 
   colorz = callPackage ../tools/misc/colorz { };
 
+  comedilib = callPackage ../development/libraries/comedilib {  };
+
   cpu-x = callPackage ../applications/misc/cpu-x { };
 
   dhallToNix = callPackage ../build-support/dhall-to-nix.nix {
@@ -1367,7 +1369,8 @@ in
 
   btfs = callPackage ../os-specific/linux/btfs { };
 
-  buildah = callPackage ../development/tools/buildah { };
+  buildah = callPackage ../development/tools/buildah/wrapper.nix { };
+  buildah-unwrapped = callPackage ../development/tools/buildah { };
 
   buildkit = callPackage ../development/tools/buildkit { };
 
@@ -1673,6 +1676,8 @@ in
 
   discount = callPackage ../tools/text/discount { };
 
+  disk-filltest = callPackage ../tools/system/disk-filltest { };
+
   diskscan = callPackage ../tools/misc/diskscan { };
 
   disorderfs = callPackage ../tools/filesystems/disorderfs {
@@ -3526,9 +3531,6 @@ in
   fprot = callPackage ../tools/security/fprot { };
 
   fprintd = callPackage ../tools/security/fprintd { };
-  fprintd-thinkpad = fprintd.override {
-    thinkpad = true;
-  };
 
   franz = callPackage ../applications/networking/instant-messengers/franz { };
 
@@ -5264,7 +5266,9 @@ in
 
   monit = callPackage ../tools/system/monit { };
 
-  monolith = callPackage ../tools/backup/monolith { };
+  monolith = callPackage ../tools/backup/monolith {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   moreutils = callPackage ../tools/misc/moreutils {
     docbook-xsl = docbook_xsl;
@@ -6656,7 +6660,7 @@ in
 
   sleuthkit = callPackage ../tools/system/sleuthkit {};
 
-  sleepyhead = callPackage ../applications/misc/sleepyhead {};
+  sleepyhead = libsForQt5.callPackage ../applications/misc/sleepyhead {};
 
   slirp4netns = callPackage ../tools/networking/slirp4netns/default.nix { };
 
@@ -6903,6 +6907,8 @@ in
     libxml2 = libxml2Python;
    };
 
+  systembus-notify = callPackage ../applications/misc/systembus-notify { };
+
   stricat = callPackage ../tools/security/stricat { };
 
   staruml = callPackage ../tools/misc/staruml { inherit (gnome2) GConf; libgcrypt = libgcrypt_1_5; };
@@ -11854,6 +11860,16 @@ in
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
+  libgit2_0_27 = libgit2.overrideAttrs (oldAttrs: rec {
+    version = "0.27.10";
+    src = fetchFromGitHub {
+      owner = "libgit2";
+      repo = "libgit2";
+      rev = "v${version}";
+      sha256 = "09jz2fzv0zl5058s0g1cpnw87a2rgg8wnjwlygi18i2n9nn6m0ad";
+    };
+  });
+
   libgit2-glib = callPackage ../development/libraries/libgit2-glib { };
 
   glbinding = callPackage ../development/libraries/glbinding { };
@@ -12817,9 +12833,6 @@ in
   };
 
   libfprint = callPackage ../development/libraries/libfprint { };
-  libfprint-thinkpad = libfprint.override {
-    thinkpad = true;
-  };
 
   libfpx = callPackage ../development/libraries/libfpx { };
 
@@ -13305,6 +13318,8 @@ in
 
   libp11 = callPackage ../development/libraries/libp11 { };
 
+  libpam-wrapper = callPackage ../development/libraries/libpam-wrapper { };
+
   libpar2 = callPackage ../development/libraries/libpar2 { };
 
   libpcap = callPackage ../development/libraries/libpcap { };
@@ -15577,6 +15592,8 @@ in
 
   dspam = callPackage ../servers/mail/dspam { };
 
+  engelsystem = callPackage ../servers/web-apps/engelsystem { };
+
   etcd = callPackage ../servers/etcd { };
   etcd_3_4 = callPackage ../servers/etcd/3.4.nix { };
 
@@ -18374,6 +18391,8 @@ in
 
   tamsyn = callPackage ../data/fonts/tamsyn { inherit (buildPackages.xorg) mkfontscale; };
 
+  tamzen = callPackage ../data/fonts/tamzen { inherit (buildPackages.xorg) mkfontscale; };
+
   tango-icon-theme = callPackage ../data/icons/tango-icon-theme {
     gtk = res.gtk2;
   };
@@ -18715,11 +18734,6 @@ in
 
   baudline = callPackage ../applications/audio/baudline { };
 
-
-  bazaar = callPackage ../applications/version-management/bazaar { };
-
-  bazaarTools = callPackage ../applications/version-management/bazaar/tools.nix { };
-
   bb =  callPackage ../applications/misc/bb { };
 
   berry = callPackage ../applications/window-managers/berry { };
@@ -22335,6 +22349,7 @@ in
 
   transmission = callPackage ../applications/networking/p2p/transmission { };
   transmission-gtk = transmission.override { enableGTK3 = true; };
+  transmission-qt = transmission.override { enableQt = true; };
 
   transmission-remote-cli = callPackage ../applications/networking/p2p/transmission-remote-cli {};
   transmission-remote-gtk = callPackage ../applications/networking/p2p/transmission-remote-gtk {};
@@ -23426,7 +23441,8 @@ in
 
   crispyDoom = callPackage ../games/crispy-doom { };
 
-  cri-o = callPackage ../applications/virtualization/cri-o { };
+  cri-o = callPackage ../applications/virtualization/cri-o/wrapper.nix { };
+  cri-o-unwrapped = callPackage ../applications/virtualization/cri-o { };
 
   ckan = callPackage ../games/ckan { };
 
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 76082efda8f5e..6c45b77abb776 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -16,6 +16,8 @@ let
 
     buildDunePackage = callPackage ../build-support/ocaml/dune.nix {};
 
+    afl-persistent = callPackage ../development/ocaml-modules/afl-persistent { };
+
     alcotest = callPackage ../development/ocaml-modules/alcotest {};
 
     alcotest-lwt = callPackage ../development/ocaml-modules/alcotest/lwt.nix {};
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 86339e361cb3d..61467b1fc43e6 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5472,21 +5472,6 @@ in {
 
   pyyaml = callPackage ../development/python-modules/pyyaml { };
 
-  pyyaml_3 = (callPackage ../development/python-modules/pyyaml { }).overridePythonAttrs (oldAttrs: rec {
-    version = "3.13";
-    src = oldAttrs.src.override {
-      inherit version;
-      sha256 = "3ef3092145e9b70e3ddd2c7ad59bdd0252a94dfe3949721633e41344de00a6bf";
-    };
-    # https://github.com/yaml/pyyaml/issues/298#issuecomment-511990948
-    patches = singleton (pkgs.fetchpatch {
-      url = "https://github.com/yaml/pyyaml/commit/c5b135fe39d41cffbdc006f28ccb2032df6005e0.patch";
-      sha256 = "0x1v45rkmj194c41d1nqi3ihj9z4rsy8zvpfcd8p960g1fia7fhn";
-    });
-    # https://github.com/yaml/pyyaml/issues/298#issuecomment-511990948
-    doCheck = false;
-  });
-
   rabbitpy = callPackage ../development/python-modules/rabbitpy { };
 
   rasterio = callPackage ../development/python-modules/rasterio {
@@ -7055,6 +7040,11 @@ in {
 
   pytoml = callPackage ../development/python-modules/pytoml { };
 
+  pypamtest = pkgs.libpam-wrapper.override {
+    enablePython = true;
+    inherit python;
+  };
+
   pypandoc = callPackage ../development/python-modules/pypandoc { };
 
   yamllint = callPackage ../development/python-modules/yamllint { };