NixOS · May 1, 2020 · May 1, 2020 · Jun 16, 2020 · Jun 18, 2020 · Jun 20, 2020
diff --git a/pkgs/applications/gis/qgis/unwrapped.nix b/pkgs/applications/gis/qgis/unwrapped.nix
@@ -10,15 +10,15 @@ let
     [ qscintilla-qt5 gdal jinja2 numpy psycopg2
       chardet dateutil pyyaml pytz requests urllib3 pygments pyqt5 sip owslib six ];
 in mkDerivation rec {
-  version = "3.10.4";
+  version = "3.10.7";
   pname = "qgis";
   name = "${pname}-unwrapped-${version}";
 
   src = fetchFromGitHub {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings ["."] ["_"] version}";
-    sha256 = "0d1rsgjgnnq6jgms5bgppz8lkh4518nf90fk0qvxajdfi9j4jn12";
+    sha256 = "0z593n5g3zwhlzhs0z7nlpblz6z2rl3y7y3j1wf1rdx76i8p3qgf";
   };
 
   passthru = {

diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@@ -1,18 +1,18 @@
 # This file is autogenerated from update.sh in the same directory.
 {
   beta = {
-    sha256 = "0wsqxq8xxcafmjxsjkagysrcbr6qryiyqn6m3ysp256aam7z3d88";
-    sha256bin64 = "03jff1sdv05hbn37cw0ij0r4rils0q11lnnhxg52igg633jzwyc1";
-    version = "84.0.4147.45";
+    sha256 = "1s49qxg0gfmhm1lf5big6hprral21dbzjx0f1cp3xfvag9y61i7h";
+    sha256bin64 = "1sjvi3qmpwpr51442324a853k6s0k59k4809k8j5sjv7h6arw0sm";
+    version = "84.0.4147.56";
   };
   dev = {
-    sha256 = "16rmzyzjmxmhmr5yqbzqbwf5sq94iqcwlm04fkafiwcycd17nyhs";
-    sha256bin64 = "0wjmc1wdmwiq9d1f5gk4c9jkj1p116kaz9nb0hvhjf01iv07xl2m";
-    version = "85.0.4168.2";
+    sha256 = "1gxa0jg7xff87z7wvllp84a3ii1ypgy4vfzgxs4k7kzg5x0412vi";
+    sha256bin64 = "0swmn37rmvjvvdcrd002qg1wcvna06y14s3kx34bfr4zxhqk3lby";
+    version = "85.0.4173.0";
   };
   stable = {
-    sha256 = "0bvy17ymlih87n4ymnzvyn0m34ghmr1yasvy7gxv02qbw6i57lfg";
-    sha256bin64 = "00hjr5y0cczs6h2pxrigpmjiv24456948v32q7mr7x5ysr5kxpn6";
-    version = "83.0.4103.106";
+    sha256 = "1hravbi1lazmab2mih465alfzji1kzy38zya1visbwz9zs6pw35v";
+    sha256bin64 = "1ggyv2b50sclnqph0r40lb8p9h3pq9aq4fj1wdszhwc4rb0cj746";
+    version = "83.0.4103.116";
   };
 }
diff --git a/pkgs/applications/networking/gns3/gui.nix b/pkgs/applications/networking/gns3/gui.nix
@@ -1,9 +1,8 @@
 { stable, branch, version, sha256Hash, mkOverride }:
 
-{ lib, stdenv, python3, fetchFromGitHub }:
+{ lib, stdenv, python3, pkgs, fetchFromGitHub }:
 
 let
-  # TODO: This package requires qt5Full to launch
   defaultOverrides = [
     (mkOverride "psutil" "5.6.3"
       "1wv31zly44qj0rp2acg58xbnc7bf6ffyadasq093l455q30qafl6")
@@ -29,6 +28,7 @@ in python.pkgs.buildPythonPackage rec {
     raven psutil jsonschema # tox for check
     # Runtime dependencies
     sip (pyqt5.override { withWebSockets = true; }) distro setuptools
+    pkgs.qt5Full
   ];
 
   doCheck = false; # Failing

diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@@ -23,7 +23,7 @@ let
       else "");
 in stdenv.mkDerivation rec {
   pname = "signal-desktop";
-  version = "1.34.2"; # Please backport all updates to the stable channel.
+  version = "1.34.3"; # Please backport all updates to the stable channel.
   # All releases have a limited lifetime and "expire" 90 days after the release.
   # When releases "expire" the application becomes unusable until an update is
   # applied. The expiration date for the current release can be extracted with:
@@ -33,7 +33,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "0l0i6v6n6iyq1zb2rlgfjnsk37kzjqgglk824vl5kp8qbq0li6b6";
+    sha256 = "1723h8fwclv07n5lcsqw3snmfhpigkrj609fayg0aycxgi3321h6";
   };
 
   nativeBuildInputs = [

diff --git a/pkgs/applications/networking/mailreaders/neomutt/default.nix b/pkgs/applications/networking/mailreaders/neomutt/default.nix
@@ -5,14 +5,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "20200619";
+  version = "20200626";
   pname = "neomutt";
 
   src = fetchFromGitHub {
     owner  = "neomutt";
     repo   = "neomutt";
     rev    = version;
-    sha256 = "0dhdpd0wdk5bam0q7cvjy4f451ai0mapmyrar7r7m5dnn6lcwvfv";
+    sha256 = "0r16fy02z61dbjdxc28yzj5i4f6r7aakh453gaqc8ilm1nsxhmnp";
   };
 
   buildInputs = [

diff --git a/pkgs/development/interpreters/php/default.nix b/pkgs/development/interpreters/php/default.nix
@@ -263,23 +263,23 @@ let
 
 in {
   php72 = generic {
-    version = "7.2.29";
-    sha256 = "08xry2fgqgg8s0ym1hh11wkbr36av3zq1bn4krbciw1b7x8gb8ga";
+    version = "7.2.31";
+    sha256 = "0057x1s43f9jidmrl8daka6wpxclxc1b1pm5cjbz616p8nbmb9qv";
 
     # https://bugs.php.net/bug.php?id=76826
     extraPatches = optional stdenv.isDarwin ./php72-darwin-isfinite.patch;
   };
 
   php73 = generic {
-    version = "7.3.16";
-    sha256 = "0bh499v9dfgh9k51w4rird1slb9rh9whp5h37fb84c98d992s1xq";
+    version = "7.3.19";
+    sha256 = "199l1lr7ima92icic7b1bqlb036md78m305lc3v6zd4zw8qix70d";
 
     # https://bugs.php.net/bug.php?id=76826
     extraPatches = optional stdenv.isDarwin ./php73-darwin-isfinite.patch;
   };
 
   php74 = generic {
-    version = "7.4.6";
-    sha256 = "0j133pfwa823d4jhx2hkrrzjl4hswvz00b1z58r5c82xd5sr9vd6";
+    version = "7.4.7";
+    sha256 = "0ynq4fz54jpzh9nxvbgn3vrdad2clbac0989ai0yrj2ryc0hs3l0";
   };
 }
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
@@ -27,7 +27,7 @@
 with stdenv.lib;
 
 let
-  version = "19.3.3";
+  version = "19.3.5";
   branch  = versions.major version;
 in
 
@@ -42,7 +42,7 @@ stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
       "https://mesa.freedesktop.org/archive/mesa-${version}.tar.xz"
     ];
-    sha256 = "02czqdqf64i3az5p1allnxycyjad3x35cj0hz0017mi5pc84ikl1";
+    sha256 = "1dn6975sj25kx6a6x5054ql27lqlshkp5m8cg8nwhwdranq9b600";
   };
 
   prePatch = "patchShebangs .";

diff --git a/pkgs/development/libraries/mp4v2/default.nix b/pkgs/development/libraries/mp4v2/default.nix
@@ -1,39 +1,39 @@
-{ stdenv, lib, fetchurl }:
+{ stdenv, lib, fetchFromGitHub, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "mp4v2-2.0.0";
-
-  src = fetchurl {
-    url = "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/mp4v2/${name}.tar.bz2";
-    sha256 = "0f438bimimsvxjbdp4vsr8hjw2nwggmhaxgcw07g2z361fkbj683";
+  pname = "mp4v2";
+  version = "4.1.3";
+
+  src = fetchFromGitHub {
+    # 2020-06-20: THE current upstream, maintained and used in distros fork.
+    owner = "TechSmith";
+    repo = "mp4v2";
+    rev = "Release-ThirdParty-MP4v2-${version}";
+    sha256 = "053a0lgy819sbz92cfkq0vmkn2ky39bva554pj4ypky1j6vs04fv";
   };
 
   patches = [
     (fetchurl {
-      name = "gcc-7.patch";
-      url = "https://src.fedoraproject.org/cgit/rpms/libmp4v2.git/plain/"
-          + "0004-Fix-GCC7-build.patch?id=d7aeedabb";
+      # 2020-06-19: NOTE: # Fix build with C++11
+      # Close when https://github.com/TechSmith/mp4v2/pull/36 merged/closed.
+      url = "https://git.archlinux.org/svntogit/packages.git/plain/trunk/libmp4v2-c++11.patch?id=203f5a72bc97ffe089b424c47b07dd9eaea35713";
       sha256 = "0sbn0il7lmk77yrjyb4f0a3z3h8gsmdkscvz5n9hmrrrhrwf672w";
     })
   ];
 
-  buildFlags = [ "CXXFLAGS=-std=c++03" ];
-
   # `faac' expects `mp4.h'.
   postInstall = "ln -s mp4v2/mp4v2.h $out/include/mp4.h";
 
-  hardeningDisable = [ "format" ];
-
   enableParallelBuilding = true;
 
   meta = {
-    description = "Abandoned library. Provides functions to read, create, and modify mp4 files";
+    description = "Provides functions to read, create, and modify mp4 files";
     longDescription = ''
       MP4v2 library provides an API to work with mp4 files
       as defined by ISO-IEC:14496-1:2001 MPEG-4 Systems.
       This container format is derived from Apple's QuickTime format.
     '';
-    homepage = https://code.google.com/archive/p/mp4v2/;
+    homepage = "https://github.com/TechSmith/mp4v2";
     maintainers = [ lib.maintainers.Anton-Latukha ];
     platforms = lib.platforms.unix;
     license = lib.licenses.mpl11;

diff --git a/pkgs/development/python-modules/django/2_2.nix b/pkgs/development/python-modules/django/2_2.nix
@@ -6,13 +6,13 @@
 
 buildPythonPackage rec {
   pname = "Django";
-  version = "2.2.10";
+  version = "2.2.13";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "16h7lw9vnmwarl4pjwc7xnkwmcjq1c79prvfwv8fzixiw65ic9hj";
+    sha256 = "103db5gmny6bkq9jgr2m6gdfy1n29bj2v87184y1zgpdmkv71ww4";
   };
 
   patches = stdenv.lib.optional withGdal

diff --git a/pkgs/development/tools/misc/hydra/default.nix b/pkgs/development/tools/misc/hydra/default.nix
@@ -1,4 +1,4 @@
-{ fetchFromGitHub, nixStable, callPackage, nixFlakes, fetchpatch, nixosTests }:
+{ fetchFromGitHub, nixStable, callPackage, nixFlakes, nixosTests }:
 
 {
   # Package for phase-1 of the db migration for Hydra.
@@ -24,22 +24,15 @@
   # so when having an older version, `pkgs.hydra-migration` should be deployed first.
 
   hydra-unstable = callPackage ./common.nix {
-    version = "2020-06-01";
+    version = "2020-06-23";
     src = fetchFromGitHub {
       owner = "NixOS";
       repo = "hydra";
-      rev = "750e2e618ac6d3df02c57a2cf8758bc66a27c40a";
-      sha256 = "1szfzf9kw5cj6yn57gfxrffbdkdf8v3xy9914924blpn5qll31g4";
+      rev = "bb32aafa4a9b027c799e29b1bcf68727e3fc5f5b";
+      sha256 = "0kl9h70akwxpik3xf4dbbh7cyqn06023kshfvi14mygdlb84djgx";
     };
     nix = nixFlakes;
 
-    patches = [
-      (fetchpatch {
-        url = "https://github.com/NixOS/hydra/commit/d4822a5f4b57dff26bdbf436723a87dd62bbcf30.patch";
-        sha256 = "1n6hyjz1hzvka4wi78d4wg0sg2wanrdmizqy23vmp7pmv8s3gz8w";
-      })
-    ];
-
     tests = {
       db-migration = nixosTests.hydra-db-migration.mig;
       basic = nixosTests.hydra.hydra-unstable;

diff --git a/pkgs/development/tools/parsing/re2c/default.nix b/pkgs/development/tools/parsing/re2c/default.nix
@@ -1,16 +1,24 @@
-{ stdenv, fetchFromGitHub, autoreconfHook }:
+{ stdenv, fetchFromGitHub, fetchpatch, autoreconfHook }:
 
 stdenv.mkDerivation rec {
   pname = "re2c";
-  version = "1.2.1";
+  version = "1.3";
 
   src = fetchFromGitHub {
     owner  = "skvadrik";
     repo   = "re2c";
     rev    = version;
-    sha256 = "1qj0ck9msb9h8g9qb1lr57jmlj8x68ini3y3ccdifjjahhhr0hd4";
+    sha256 = "0aqlf2h6i2m3dq11dkq89p4w4c9kp4x66s5rhp84gmpz5xqv1x5h";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2020-11958.patch";
+      url = "https://github.com/skvadrik/re2c/commit/c4603ba5ce229db83a2a4fb93e6d4b4e3ec3776a.patch";
+      sha256 = "1d95ahxk92g7k87sda9gxgmr3blyfzwd2y7h9jxj8zkd74knd9zh";
+    })
+  ];
+
   nativeBuildInputs = [ autoreconfHook ];
 
   doCheck = true;

diff --git a/pkgs/development/tools/rust/cargo-make/Cargo.lock b/pkgs/development/tools/rust/cargo-make/Cargo.lock
diff --git a/pkgs/development/tools/rust/cargo-make/default.nix b/pkgs/development/tools/rust/cargo-make/default.nix
@@ -2,15 +2,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-make";
-  version = "0.31.0";
+  version = "0.31.1";
 
   src =
     let
       source = fetchFromGitHub {
         owner = "sagiegurari";
         repo = pname;
         rev = version;
-        sha256 = "0svb3avmmkgwsv1dvzgzixp5fvcl93hn8xb3zx729jq8a47l2vsi";
+        sha256 = "0hxfysbrdc9f20v0nbvb1sxhyr86iwmf70x0xpkpkzp33i7ssdig";
       };
     in
     runCommand "source" {} ''
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ openssl ]
     ++ stdenv.lib.optionals stdenv.isDarwin [ Security ];
 
-  cargoSha256 = "1n97j008rqzb96kh53r3fpvjlxy5m89fac5fvf2ka4nf68z5w0y5";
+  cargoSha256 = "0izify2q080gb5da3qg3kjkvj1y2fnl2brh7qjlyvgy09l07ld3f";
 
   # Some tests fail because they need network access.
   # However, Travis ensures a proper build.

diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -193,8 +193,8 @@ let
       B43_PHY_HT            = option yes;
       BCMA_HOST_PCI         = option yes;
       RTW88                 = whenAtLeast "5.2" module;
-      RTW88_8822BE          = whenAtLeast "5.2" yes;
-      RTW88_8822CE          = whenAtLeast "5.2" yes;
+      RTW88_8822BE          = mkMerge [ (whenBetween "5.2" "5.8" yes) (whenAtLeast "5.8" module) ];
+      RTW88_8822CE          = mkMerge [ (whenBetween "5.2" "5.8" yes) (whenAtLeast "5.8" module) ];
     };
 
     fb = {
@@ -259,7 +259,7 @@ let
       SND_SOC_SOF_ELKHARTLAKE_SUPPORT   = yes;
       SND_SOC_SOF_GEMINILAKE_SUPPORT    = yes;
       SND_SOC_SOF_HDA_AUDIO_CODEC       = yes;
-      SND_SOC_SOF_HDA_COMMON_HDMI_CODEC = yes;
+      SND_SOC_SOF_HDA_COMMON_HDMI_CODEC = whenOlder "5.7" yes;
       SND_SOC_SOF_HDA_LINK              = yes;
       SND_SOC_SOF_ICELAKE_SUPPORT       = yes;
       SND_SOC_SOF_INTEL_TOPLEVEL        = yes;

diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.14.185";
+  version = "4.14.186";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1iixxwidp53s2i2br58wbx5s69f2jcllb116z73pv7fmd06b2czk";
+    sha256 = "0q52fmkiqa9hpdkf0wlpcqnc6wqssqz6cgfk1ix1anq0h5hl4ns4";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.19.129";
+  version = "4.19.130";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0p0apfviv699mda5zmqphymfybcm932s5yffhvrpqvy2fpas0yx8";
+    sha256 = "03zhsizj53ngwxn7d4mzix9xbxxd5lhbzrvawvbb91f83pkc14m6";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.4.48";
+  version = "5.4.49";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0lqxryxn0bfly337ddhl7m7qdwblxg8i1fsl8v9i9h84rnpxs85z";
+    sha256 = "0g2psjf2q10mfc3vv6brjn6s2nkg73ll1s04gpshw907d9irpn2m";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.7.nix b/pkgs/os-specific/linux/kernel/linux-5.7.nix
@@ -0,0 +1,18 @@
+{ stdenv, buildPackages, fetchurl, perl, buildLinux, modDirVersionArg ? null, ... } @ args:
+
+with stdenv.lib;
+
+buildLinux (args // rec {
+  version = "5.7.6";
+
+  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
+  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
+
+  # branchVersion needs to be x.y
+  extraMeta.branch = versions.majorMinor version;
+
+  src = fetchurl {
+    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
+    sha256 = "1rhhys2fvfrfsc6lk0qkq59p83qhwvns4jhk0jlyylyzqqywkm4z";
+  };
+} // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -3,15 +3,15 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.5-rc7";
-  extraMeta.branch = "5.5";
+  version = "5.8-rc1";
+  extraMeta.branch = "5.1";
 
   # modDirVersion needs to be x.y.z, will always add .0
   modDirVersion = if (modDirVersionArg == null) then builtins.replaceStrings ["-"] [".0-"] version else modDirVersionArg;
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "10fjk4bw73x5xpb4q83ngni7slw489wdxhdwmyrkfqqy5chgm290";
+    sha256 = "1gb7g2vrgg0zz281lv1ir1r0535spc40j65p0azmdxlk24fkfxfc";
   };
 
   # Should the testing kernels ever be built on Hydra?

diff --git a/pkgs/os-specific/linux/rtl8821ce/default.nix b/pkgs/os-specific/linux/rtl8821ce/default.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchFromGitHub, kernel, bc }:
 stdenv.mkDerivation rec {
   name = "rtl8821ce-${kernel.version}-${version}";
-  version = "5.2.5_1.26055.20180108";
+  version = "5.5.2_34066.20200325";
 
   src = fetchFromGitHub {
     owner = "tomaspinho";
     repo = "rtl8821ce";
-    rev = "ab6154e150bbc7d12b0525d4cc1298ae196e45de";
-    sha256 = "1my0hidqnv4s7hi5897m81pq0sjw05np0g27hlkg9fwb83b5kzsg";
+    rev = "69765eb288a8dfad3b055b906760b53e02ab1dea";
+    sha256 = "17jiw25k74kv5lnvgycvj2g1n06hbrpjz6p4znk4a62g136rhn4s";
   };
 
   hardeningDisable = [ "pic" ];

diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
@@ -42,6 +42,26 @@ in stdenv.mkDerivation {
     sha256 = "0haj3iff3y13pm4w5dbqj1drp5wryqfad58jbbmnb6zdgis56h8f";
   };
 
+  # with the bump to 245.x, nixpkgs moved away from the custom fork to
+  # downstream patches, as the fork model was very error-prone
+  # (see https://github.com/NixOS/nixpkgs/pull/85334)
+  # This `patches` section is only there to carry security patches for 20.03,
+  # as it'd be much more ugly to push commits to the (abandoned) systemd fork.
+  patches = [
+    # pick the `safe_atou32` introduction in src/basic/parse-util.h
+    # used by CVE-2020-13776.patch
+    (fetchpatch {
+      url = "https://github.com/systemd/systemd/commit/b934ac3d6e7dcad114776ef30ee9098693e7ab7e.patch";
+      includes = ["src/basic/parse-util.h"];
+      sha256 = "1q9nggh19nk4bi2amg0dfziahfvl2931i9r79kdi9gmf79wxz0yc";
+    })
+    (fetchpatch {
+      name = "CVE-2020-13776.patch";
+      url = "https://github.com/systemd/systemd/commit/156a5fd297b61bce31630d7a52c15614bf784843.patch";
+      sha256 = "1g1spb78mqywp97mxsgqaaq5zn3s5qk2k0w02xnp92v76h5y0sgl";
+    })
+  ];
+
   outputs = [ "out" "lib" "man" "dev" ];
 
   nativeBuildInputs =

diff --git a/pkgs/os-specific/linux/wireguard/default.nix b/pkgs/os-specific/linux/wireguard/default.nix
@@ -7,11 +7,11 @@ assert stdenv.lib.versionOlder kernel.version "5.6";
 
 stdenv.mkDerivation rec {
   pname = "wireguard";
-  version = "1.0.20200611";
+  version = "1.0.20200623";
 
   src = fetchzip {
     url = "https://git.zx2c4.com/wireguard-linux-compat/snapshot/wireguard-linux-compat-${version}.tar.xz";
-    sha256 = "0a8xsjxp8krmm2px07x9qw8nhvp5ispf4mnc6k59p0qp26qbva5d";
+    sha256 = "1siybpd14la9c5diigniwis1q9f5fhq2ris9bvgzhh8g8vr3xmqh";
   };
 
   hardeningDisable = [ "pic" ];

diff --git a/pkgs/servers/web-apps/wordpress/default.nix b/pkgs/servers/web-apps/wordpress/default.nix
@@ -1,19 +1,23 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchurl, nixosTests }:
 
 stdenv.mkDerivation rec {
   pname = "wordpress";
-  version = "5.3.3";
+  version = "5.3.4";
 
   src = fetchurl {
     url = "https://wordpress.org/${pname}-${version}.tar.gz";
-    sha256 = "13x3qny45g5gx2rqhvkfmh8n43hq3hz5bm5n3n9l46ifmcvhwpnq";
+    sha256 = "1zff0c8igcx045ikvy65zk34q5y8g5fq5ydsz3cxy7h5sqsyp3ja";
   };
 
   installPhase = ''
     mkdir -p $out/share/wordpress
     cp -r . $out/share/wordpress
   '';
 
+  passthru.tests = {
+    inherit (nixosTests) wordpress;
+  };
+
   meta = with stdenv.lib; {
     homepage = "https://wordpress.org";
     description = "WordPress is open source software you can use to create a beautiful website, blog, or app";

diff --git a/pkgs/tools/admin/nomachine-client/default.nix b/pkgs/tools/admin/nomachine-client/default.nix
@@ -1,8 +1,8 @@
 { stdenv, file, fetchurl, makeWrapper,
   autoPatchelfHook, jsoncpp, libpulseaudio }:
 let
-  versionMajor = "6.10";
-  versionMinor = "12";
+  versionMajor = "6.11";
+  versionMinor = "2";
   versionBuild_x86_64 = "1";
   versionBuild_i686 = "1";
 in
@@ -17,15 +17,15 @@ in
             "https://download.nomachine.com/download/${versionMajor}/Linux/nomachine_${version}_${versionBuild_x86_64}_x86_64.tar.gz"
             "https://web.archive.org/web/https://download.nomachine.com/download/${versionMajor}/Linux/nomachine_${version}_${versionBuild_x86_64}_x86_64.tar.gz"
           ];
-          sha256 = "17yb377ry7i7cmkb72xmhyqkfggv1ygqlz55ymvmrs7psbh7ql01";
+          sha256 = "1b6r9bwkr8mhaljma19ikxpkmlx8iy5r1vf5hlv27bja2zz1r8xr";
         }
       else if stdenv.hostPlatform.system == "i686-linux" then
         fetchurl {
           urls = [
             "https://download.nomachine.com/download/${versionMajor}/Linux/nomachine_${version}_${versionBuild_i686}_i686.tar.gz"
             "https://web.archive.org/web/https://download.nomachine.com/download/${versionMajor}/Linux/nomachine_${version}_${versionBuild_i686}_i686.tar.gz"
           ];
-          sha256 = "0k6dspmwdkm0zf0c2zqlqy0jya8qgsg90wwv9wa12fn4chp66gqg";
+          sha256 = "0dl138ry9n1qh651zh0zvp88qhgxrs2kvvnq329jw0py5v70b9pm";
         }
       else
         throw "NoMachine client is not supported on ${stdenv.hostPlatform.system}";

diff --git a/pkgs/tools/filesystems/ceph/default.nix b/pkgs/tools/filesystems/ceph/default.nix
@@ -106,6 +106,12 @@ in rec {
 
     patches = [
       ./0000-fix-SPDK-build-env.patch
+      (fetchurl {
+        # Remove for Ceph > v15.2.3; https://www.openwall.com/lists/oss-security/2020/06/25/5
+        name = "CVE-2020-10753.patch";
+        url = "https://github.com/ceph/ceph/pull/35773/commits/1524d3c0c5cb11775313ea1e2bb36a93257947f2.patch";
+        sha256 = "1c04kirijp4c8a5pgwqx17dzdnzvd29nl2nr3qdvf4fkqwnlf48s";
+      })
     ];
 
     nativeBuildInputs = [

diff --git a/pkgs/tools/typesetting/tex/texlive/combine.nix b/pkgs/tools/typesetting/tex/texlive/combine.nix
@@ -49,6 +49,10 @@ in buildEnv {
 
   ignoreCollisions = false;
   paths = pkgList.nonbin;
+  pathsToLink = [
+    "/"
+    "/tex/generic/config" # make it a real directory for scheme-infraonly
+  ];
 
   buildInputs = [ makeWrapper ] ++ pkgList.extraInputs;
 

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
@@ -16540,6 +16540,14 @@ in
     ];
   };
 
+  linux_5_7 = callPackage ../os-specific/linux/kernel/linux-5.7.nix {
+    kernelPatches = [
+      kernelPatches.bridge_stp_helper
+      kernelPatches.request_key_helper
+      kernelPatches.export_kernel_fpu_functions."5.3"
+    ];
+  };
+
   linux_testing = callPackage ../os-specific/linux/kernel/linux-testing.nix {
     kernelPatches = [
       kernelPatches.bridge_stp_helper
@@ -16747,7 +16755,7 @@ in
   linux = linuxPackages.kernel;
 
   # Update this when adding the newest kernel major version!
-  linuxPackages_latest = linuxPackages_5_6;
+  linuxPackages_latest = linuxPackages_5_7;
   linux_latest = linuxPackages_latest.kernel;
 
   # Build the kernel modules for the some of the kernels.
@@ -16762,6 +16770,7 @@ in
   linuxPackages_4_19 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_4_19);
   linuxPackages_5_4 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_5_4);
   linuxPackages_5_6 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_5_6);
+  linuxPackages_5_7 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_5_7);
 
   # Kernels removed on release-20.03
   linuxPackages_5_5 = throw ''