NixOS · Feb 8, 2016 · Feb 8, 2016 · Feb 8, 2016 · Feb 8, 2016 · Feb 8, 2016
Showing 738 changed files with 10,527 additions and 8,136 deletions.
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
@@ -193,3 +193,6 @@
 /nixos/modules/virtualisation/cri-o.nix      @NixOS/podman
 /nixos/modules/virtualisation/podman.nix     @NixOS/podman
 /nixos/tests/podman.nix                      @NixOS/podman
+
+# Blockchains
+/pkgs/applications/blockchains  @mmahut
diff --git a/README.md b/README.md
@@ -34,6 +34,7 @@ the main ones:
 
 * [Nix](https://github.com/NixOS/nix) - the purely functional package manager
 * [NixOps](https://github.com/NixOS/nixops) - the tool to remotely deploy NixOS machines
+* [nixos-hardware](https://github.com/NixOS/nixos-hardware) - NixOS profiles to optimize settings for different hardware
 * [Nix RFCs](https://github.com/NixOS/rfcs) - the formal process for making substantial changes to the community
 * [NixOS homepage](https://github.com/NixOS/nixos-homepage) - the [NixOS.org](https://nixos.org) website
 * [hydra](https://github.com/NixOS/hydra) - our continuous integration system

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
@@ -139,6 +139,12 @@
     githubId = 1517066;
     name = "Aiken Cairncross";
   };
+  aciceri = {
+    name = "Andrea Ciceri";
+    email = "andrea.ciceri@autistici.org";
+    github = "aciceri";
+    githubId = 2318843;
+  };
   acowley = {
     email = "acowley@gmail.com";
     github = "acowley";
@@ -313,6 +319,12 @@
     githubId = 2387841;
     name = "Alexander Bakker";
   };
+  alexbiehl = {
+    email = "alexbiehl@gmail.com";
+    github = "alexbiehl";
+    githubId = 1876617;
+    name = "Alex Biehl";
+  };
   alexchapman = {
     email = "alex@farfromthere.net";
     github = "AJChapman";
@@ -3524,6 +3536,12 @@
     githubId = 117874;
     name = "Jeroen de Haas";
   };
+  jduan = {
+    name = "Jingjing Duan";
+    email = "duanjingjing@gmail.com";
+    github = "jduan";
+    githubId = 452450;
+  };
   jefdaj = {
     email = "jefdaj@gmail.com";
     github = "jefdaj";
@@ -3686,6 +3704,12 @@
     githubId = 1102396;
     name = "Jussi Maki";
   };
+  jobojeha = {
+    email = "jobojeha@jeppener.de";
+    github = "jobojeha";
+    githubId = 60272884;
+    name = "Jonathan Jeppener-Haltenhoff";
+  };
   joelburget = {
     email = "joelburget@gmail.com";
     github = "joelburget";
@@ -5008,6 +5032,10 @@
     github = "mdlayher";
     githubId = 1926905;
     name = "Matt Layher";
+    keys = [{
+      longkeyid = "rsa2048/0x77BFE531397EDE94";
+      fingerprint = "D709 03C8 0BE9 ACDC 14F0  3BFB 77BF E531 397E DE94";
+    }];
   };
   meditans = {
     email = "meditans@gmail.com";

diff --git a/nixos/doc/manual/release-notes/rl-2009.xml b/nixos/doc/manual/release-notes/rl-2009.xml
@@ -490,6 +490,11 @@ systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];
      <link xlink:href="https://github.com/NixOS/nixpkgs/issues/89205">#89205</link>.
     </para>
    </listitem>
+   <listitem>
+    <para>
+     In the <literal>resilio</literal> module, <xref linkend="opt-services.resilio.httpListenAddr"/> has been changed to listen to <literal>[::1]</literal> instead of <literal>0.0.0.0</literal>.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 
@@ -642,6 +647,16 @@ systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];
       <package>netbeans</package> was upgraded to 12.0 and now defaults to OpenJDK 11. This might cause problems if your projects depend on packages that were removed in Java 11.
     </para>
    </listitem>
+   <listitem>
+    <para>
+     <package>nextcloud</package> has been updated to <link xlink:href="https://nextcloud.com/blog/nextcloud-hub-brings-productivity-to-home-office/">v19</link>.
+    </para>
+    <para>
+     If you have an existing installation, please make sure that you're on
+     <package>nextcloud18</package> before upgrading to <package>nextcloud19</package>
+     since Nextcloud doesn't support upgrades across multiple major versions.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 </section>
diff --git a/nixos/lib/make-ext4-fs.nix b/nixos/lib/make-ext4-fs.nix
@@ -43,7 +43,7 @@ pkgs.stdenv.mkDerivation {
       # Make a crude approximation of the size of the target image.
       # If the script starts failing, increase the fudge factors here.
       numInodes=$(find $storePaths ./files | wc -l)
-      numDataBlocks=$(du -s -c -B 4096 --apparent-size $storePaths ./files | tail -1 | awk '{ print int($1 * 1.03) }')
+      numDataBlocks=$(du -s -c -B 4096 --apparent-size $storePaths ./files | tail -1 | awk '{ print int($1 * 1.10) }')
       bytes=$((2 * 4096 * $numInodes + 4096 * $numDataBlocks))
       echo "Creating an EXT4 image of $bytes bytes (numInodes=$numInodes, numDataBlocks=$numDataBlocks)"
 

diff --git a/nixos/modules/hardware/printers.nix b/nixos/modules/hardware/printers.nix
@@ -84,7 +84,7 @@ in {
             model = mkOption {
               type = types.str;
               example = literalExample ''
-                gutenprint.''${lib.version.majorMinor (lib.getVersion pkgs.cups)}://brother-hl-5140/expert
+                gutenprint.''${lib.versions.majorMinor (lib.getVersion pkgs.gutenprint)}://brother-hl-5140/expert
               '';
               description = ''
                 Location of the ppd driver file for the printer.

diff --git a/nixos/modules/installer/cd-dvd/sd-image-raspberrypi4.nix b/nixos/modules/installer/cd-dvd/sd-image-raspberrypi4.nix
@@ -18,13 +18,20 @@
 
   sdImage = {
     firmwareSize = 128;
+    firmwarePartitionName = "NIXOS_BOOT";
     # This is a hack to avoid replicating config.txt from boot.loader.raspberryPi
     populateFirmwareCommands =
       "${config.system.build.installBootLoader} ${config.system.build.toplevel} -d ./firmware";
     # As the boot process is done entirely in the firmware partition.
     populateRootCommands = "";
   };
 
+  fileSystems."/boot/firmware" = {
+    # This effectively "renames" the loaOf entry set in sd-image.nix
+    mountPoint = "/boot";
+    neededForBoot = true;
+  };
+
   # the installation media is also the installation target,
   # so we don't want to provide the installation configuration.nix.
   installer.cloneConfig = false;

diff --git a/nixos/modules/installer/cd-dvd/sd-image.nix b/nixos/modules/installer/cd-dvd/sd-image.nix
@@ -63,6 +63,14 @@ in
       '';
     };
 
+    firmwarePartitionName = mkOption {
+      type = types.str;
+      default = "FIRMWARE";
+      description = ''
+        Name of the filesystem which holds the boot firmware.
+      '';
+    };
+
     rootPartitionUUID = mkOption {
       type = types.nullOr types.str;
       default = null;
@@ -114,7 +122,7 @@ in
   config = {
     fileSystems = {
       "/boot/firmware" = {
-        device = "/dev/disk/by-label/FIRMWARE";
+        device = "/dev/disk/by-label/${config.sdImage.firmwarePartitionName}";
         fsType = "vfat";
         # Alternatively, this could be removed from the configuration.
         # The filesystem is not needed at runtime, it could be treated
@@ -178,7 +186,7 @@ in
         # Create a FAT32 /boot/firmware partition of suitable size into firmware_part.img
         eval $(partx $img -o START,SECTORS --nr 1 --pairs)
         truncate -s $((SECTORS * 512)) firmware_part.img
-        faketime "1970-01-01 00:00:00" mkfs.vfat -i ${config.sdImage.firmwarePartitionID} -n FIRMWARE firmware_part.img
+        faketime "1970-01-01 00:00:00" mkfs.vfat -i ${config.sdImage.firmwarePartitionID} -n ${config.sdImage.firmwarePartitionName} firmware_part.img
 
         # Populate the files intended for /boot/firmware
         mkdir firmware

diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
@@ -757,6 +757,7 @@
   ./services/networking/v2ray.nix
   ./services/networking/vsftpd.nix
   ./services/networking/wakeonlan.nix
+  ./services/networking/wasabibackend.nix
   ./services/networking/websockify.nix
   ./services/networking/wg-quick.nix
   ./services/networking/wicd.nix

diff --git a/nixos/modules/services/audio/mpd.nix b/nixos/modules/services/audio/mpd.nix
@@ -21,6 +21,12 @@ let
 
     ${optionalString (cfg.network.listenAddress != "any") ''bind_to_address "${cfg.network.listenAddress}"''}
     ${optionalString (cfg.network.port != 6600)  ''port "${toString cfg.network.port}"''}
+    ${optionalString (cfg.fluidsynth) ''
+      decoder {
+              plugin "fluidsynth"
+              soundfont "${pkgs.soundfont-fluid}/share/soundfonts/FluidR3_GM2-2.sf2"
+      }
+    ''}
 
     ${cfg.extraConfig}
   '';
@@ -133,6 +139,14 @@ in {
           parameter is omitted from the configuration.
         '';
       };
+
+      fluidsynth = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          If set, add fluidsynth soundfont and configure the plugin.
+        '';
+      };
     };
 
   };

diff --git a/nixos/modules/services/mail/mailman.nix b/nixos/modules/services/mail/mailman.nix
diff --git a/nixos/modules/services/mail/mailman.xml b/nixos/modules/services/mail/mailman.xml
@@ -0,0 +1,59 @@
+<chapter xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="module-services-mailman">
+  <title>Mailman</title>
+  <para>
+    <link xlink:href="https://www.list.org">Mailman</link> is free
+    software for managing electronic mail discussion and e-newsletter
+    lists. Mailman and its web interface can be configured using the
+    corresponding NixOS module. Note that this service is best used with
+    an existing, securely configured Postfix setup, as it does not automatically configure this.
+  </para>
+
+  <section xml:id="module-services-mailman-basic-usage">
+    <title>Basic usage</title>
+    <para>
+      For a basic configuration, the following settings are suggested:
+      <programlisting>{ config, ... }: {
+  services.postfix = {
+    enable = true;
+    relayDomains = ["hash:/var/lib/mailman/data/postfix_domains"];
+    sslCert = config.security.acme.certs."lists.example.org".directory + "/full.pem";
+    sslKey = config.security.acme.certs."lists.example.org".directory + "/key.pem";
+    config = {
+      transport_maps = ["hash:/var/lib/mailman/data/postfix_lmtp"];
+      local_recipient_maps = ["hash:/var/lib/mailman/data/postfix_lmtp"];
+    };
+  };
+  services.mailman = {
+    <link linkend="opt-services.mailman.enable">enable</link> = true;
+    <link linkend="opt-services.mailman.serve.enable">serve.enable</link> = true;
+    <link linkend="opt-services.mailman.hyperkitty.enable">hyperkitty.enable</link> = true;
+    <link linkend="opt-services.mailman.hyperkitty.enable">webHosts</link> = ["lists.example.org"];
+    <link linkend="opt-services.mailman.hyperkitty.enable">siteOwner</link> = "mailman@example.org";
+  };
+  <link linkend="opt-services.nginx.virtualHosts._name_.enableACME">services.nginx.virtualHosts."lists.example.org".enableACME</link> = true;
+  <link linkend="opt-services.mailman.hyperkitty.enable">networking.firewall.allowedTCPPorts</link> = [ 25 80 443 ];
+}</programlisting>
+    </para>
+    <para>
+      DNS records will also be required:
+      <itemizedlist>
+        <listitem><para><literal>AAAA</literal> and <literal>A</literal> records pointing to the host in question, in order for browsers to be able to discover the address of the web server;</para></listitem>
+        <listitem><para>An <literal>MX</literal> record pointing to a domain name at which the host is reachable, in order for other mail servers to be able to deliver emails to the mailing lists it hosts.</para></listitem>
+      </itemizedlist>
+    </para>
+    <para>
+      After this has been done and appropriate DNS records have been
+      set up, the Postorius mailing list manager and the Hyperkitty
+      archive browser will be available at
+      https://lists.example.org/. Note that this setup is not
+      sufficient to deliver emails to most email providers nor to
+      avoid spam -- a number of additional measures for authenticating
+      incoming and outgoing mails, such as SPF, DMARC and DKIM are
+      necessary, but outside the scope of the Mailman module.
+    </para>
+  </section>
+</chapter>
diff --git a/nixos/modules/services/misc/home-assistant.nix b/nixos/modules/services/misc/home-assistant.nix
@@ -240,6 +240,7 @@ in {
       '');
       serviceConfig = {
         ExecStart = "${package}/bin/hass --config '${cfg.configDir}'";
+        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
         User = "hass";
         Group = "hass";
         Restart = "on-failure";

diff --git a/nixos/modules/services/monitoring/tuptime.nix b/nixos/modules/services/monitoring/tuptime.nix
@@ -32,7 +32,10 @@ in {
 
     environment.systemPackages = [ pkgs.tuptime ];
 
-    users.users.tuptime.description = "tuptime database owner";
+    users = {
+      groups._tuptime.members = [ "_tuptime" ];
+      users._tuptime.description = "tuptime database owner";
+    };
 
     systemd = {
       services = {
@@ -45,7 +48,7 @@ in {
           serviceConfig = {
             StateDirectory = "tuptime";
             Type = "oneshot";
-            User = "tuptime";
+            User = "_tuptime";
             RemainAfterExit = true;
             ExecStart = "${pkgs.tuptime}/bin/tuptime -x";
             ExecStop = "${pkgs.tuptime}/bin/tuptime -xg";
@@ -57,7 +60,7 @@ in {
           serviceConfig = {
             StateDirectory = "tuptime";
             Type = "oneshot";
-            User = "tuptime";
+            User = "_tuptime";
             ExecStart = "${pkgs.tuptime}/bin/tuptime -x";
           };
         };

diff --git a/nixos/modules/services/networking/resilio.nix b/nixos/modules/services/networking/resilio.nix
@@ -109,8 +109,8 @@ in
 
       httpListenAddr = mkOption {
         type = types.str;
-        default = "0.0.0.0";
-        example = "1.2.3.4";
+        default = "[::1]";
+        example = "0.0.0.0";
         description = ''
           HTTP address to bind to.
         '';
@@ -206,16 +206,16 @@ in
 
           If you would like to be able to modify the contents of this
           directories, it is recommended that you make your user a
-          member of the <literal>resilio</literal> group.
+          member of the <literal>rslsync</literal> group.
 
           Directories in this list should be in the
-          <literal>resilio</literal> group, and that group must have
+          <literal>rslsync</literal> group, and that group must have
           write access to the directory. It is also recommended that
           <literal>chmod g+s</literal> is applied to the directory
           so that any sub directories created will also belong to
-          the <literal>resilio</literal> group. Also,
-          <literal>setfacl -d -m group:resilio:rwx</literal> and
-          <literal>setfacl -m group:resilio:rwx</literal> should also
+          the <literal>rslsync</literal> group. Also,
+          <literal>setfacl -d -m group:rslsync:rwx</literal> and
+          <literal>setfacl -m group:rslsync:rwx</literal> should also
           be applied so that the sub directories are writable by
           the group.
         '';

diff --git a/nixos/modules/services/networking/wasabibackend.nix b/nixos/modules/services/networking/wasabibackend.nix
@@ -0,0 +1,158 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.wasabibackend;
+
+  inherit (lib) mkEnableOption mkIf mkOption optionalAttrs optionalString types;
+
+  confOptions = {
+      BitcoinRpcConnectionString = "${cfg.rpc.user}:${cfg.rpc.password}";
+  } // optionalAttrs (cfg.network == "mainnet") {
+      Network = "Main";
+      MainNetBitcoinP2pEndPoint = "${cfg.endpoint.ip}:${toString cfg.endpoint.port}";
+      MainNetBitcoinCoreRpcEndPoint = "${cfg.rpc.ip}:${toString cfg.rpc.port}";
+  } // optionalAttrs (cfg.network == "testnet") {
+      Network = "TestNet";
+      TestNetBitcoinP2pEndPoint = "${cfg.endpoint.ip}:${toString cfg.endpoint.port}";
+      TestNetBitcoinCoreRpcEndPoint = "${cfg.rpc.ip}:${toString cfg.rpc.port}";
+  } // optionalAttrs (cfg.network == "regtest") {
+      Network = "RegTest";
+      RegTestBitcoinP2pEndPoint = "${cfg.endpoint.ip}:${toString cfg.endpoint.port}";
+      RegTestBitcoinCoreRpcEndPoint = "${cfg.rpc.ip}:${toString cfg.rpc.port}";
+  };
+
+	configFile = pkgs.writeText "wasabibackend.conf" (builtins.toJSON confOptions);
+
+in {
+
+  options = {
+
+    services.wasabibackend = {
+      enable = mkEnableOption "Wasabi backend service";
+
+      dataDir = mkOption {
+        type = types.path;
+        default = "/var/lib/wasabibackend";
+        description = "The data directory for the Wasabi backend node.";
+      };
+
+      customConfigFile = mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        description = "Defines the path to a custom configuration file that is copied to the user's directory. Overrides any config options.";
+      };
+
+      network = mkOption {
+        type = types.enum [ "mainnet" "testnet" "regtest" ];
+        default = "mainnet";
+        description = "The network to use for the Wasabi backend service.";
+      };
+
+      endpoint = {
+        ip = mkOption {
+          type = types.str;
+          default = "127.0.0.1";
+          description = "IP address for P2P connection to bitcoind.";
+        };
+
+        port = mkOption {
+          type = types.port;
+          default = 8333;
+          description = "Port for P2P connection to bitcoind.";
+        };
+      };
+
+      rpc = {
+        ip = mkOption {
+          type = types.str;
+          default = "127.0.0.1";
+          description = "IP address for RPC connection to bitcoind.";
+        };
+
+        port = mkOption {
+          type = types.port;
+          default = 8332;
+          description = "Port for RPC connection to bitcoind.";
+        };
+
+        user = mkOption {
+          type = types.str;
+          default = "bitcoin";
+          description = "RPC user for the bitcoin endpoint.";
+        };
+
+        password = mkOption {
+          type = types.str;
+          default = "password";
+          description = "RPC password for the bitcoin endpoint. Warning: this is stored in cleartext in the Nix store! Use <literal>configFile</literal> or <literal>passwordFile</literal> if needed.";
+        };
+
+        passwordFile = mkOption {
+          type = types.nullOr types.path;
+          default = null;
+          description = "File that contains the password of the RPC user.";
+        };
+      };
+
+      user = mkOption {
+        type = types.str;
+        default = "wasabibackend";
+        description = "The user as which to run the wasabibackend node.";
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = cfg.user;
+        description = "The group as which to run the wasabibackend node.";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    systemd.tmpfiles.rules = [
+      "d '${cfg.dataDir}' 0770 '${cfg.user}' '${cfg.group}' - -"
+    ];
+
+    systemd.services.wasabibackend = {
+      description = "wasabibackend server";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network-online.target" ];
+      environment = {
+        DOTNET_PRINT_TELEMETRY_MESSAGE = "false";
+        DOTNET_CLI_TELEMETRY_OPTOUT = "true";
+      };
+      preStart = ''
+        mkdir -p ${cfg.dataDir}/.walletwasabi/backend
+        ${if cfg.customConfigFile != null then ''
+          cp -v ${cfg.customConfigFile} ${cfg.dataDir}/.walletwasabi/backend/Config.json
+        '' else ''
+          cp -v ${configFile} ${cfg.dataDir}/.walletwasabi/backend/Config.json
+          ${optionalString (cfg.rpc.passwordFile != null) ''
+            CONFIGTMP=$(mktemp)
+            cat ${cfg.dataDir}/.walletwasabi/backend/Config.json | ${pkgs.jq}/bin/jq --arg rpconnection "${cfg.rpc.user}:$(cat "${cfg.rpc.passwordFile}")" '. + { BitcoinRpcConnectionString: $rpconnection }' > $CONFIGTMP
+            mv $CONFIGTMP ${cfg.dataDir}/.walletwasabi/backend/Config.json
+          ''}
+        ''}
+        chmod ug+w ${cfg.dataDir}/.walletwasabi/backend/Config.json
+      '';
+      serviceConfig = {
+        User = cfg.user;
+        Group = cfg.group;
+        ExecStart = "${pkgs.wasabibackend}/bin/WasabiBackend";
+        ProtectSystem = "full";
+      };
+    };
+
+    users.users.${cfg.user} = {
+      name = cfg.user;
+      group = cfg.group;
+      description = "wasabibackend daemon user";
+      home = cfg.dataDir;
+      isSystemUser = true;
+    };
+
+    users.groups.${cfg.group} = {};
+
+  };
+}
diff --git a/nixos/modules/services/web-apps/gerrit.nix b/nixos/modules/services/web-apps/gerrit.nix
@@ -17,6 +17,10 @@ let
     lib.generators.toGitINI cfg.settings
   );
 
+  replicationConfig = pkgs.writeText "replication.conf" (
+    lib.generators.toGitINI cfg.replicationSettings
+  );
+
   # Wrap the gerrit java with all the java options so it can be called
   # like a normal CLI app
   gerrit-cli = pkgs.writeShellScriptBin "gerrit" ''
@@ -106,6 +110,15 @@ in
         '';
       };
 
+      replicationSettings = mkOption {
+        type = gitIniType;
+        default = {};
+        description = ''
+          Replication configuration. This will be generated to the
+          <literal>etc/replication.config</literal> file.
+        '';
+      };
+
       plugins = mkOption {
         type = types.listOf types.package;
         default = [];
@@ -138,6 +151,13 @@ in
 
   config = mkIf cfg.enable {
 
+    assertions = [
+      {
+        assertion = cfg.replicationSettings != {} -> elem "replication" cfg.builtinPlugins;
+        message = "Gerrit replicationSettings require enabling the replication plugin";
+      }
+    ];
+
     services.gerrit.settings = {
       cache.directory = "/var/cache/gerrit";
       container.heapLimit = cfg.jvmHeapLimit;
@@ -194,6 +214,7 @@ in
 
         # copy the config, keep it mutable because Gerrit
         ln -sfv ${gerritConfig} etc/gerrit.config
+        ln -sfv ${replicationConfig} etc/replication.config
 
         # install the plugins
         rm -rf plugins

diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
@@ -69,7 +69,7 @@ in {
     package = mkOption {
       type = types.package;
       description = "Which package to use for the Nextcloud instance.";
-      relatedPackages = [ "nextcloud17" "nextcloud18" ];
+      relatedPackages = [ "nextcloud17" "nextcloud18" "nextcloud19" ];
     };
 
     maxUploadSize = mkOption {
@@ -303,6 +303,14 @@ in {
         '';
       };
     };
+    occ = mkOption {
+      type = types.package;
+      default = occ;
+      internal = true;
+      description = ''
+        The nextcloud-occ program preconfigured to target this Nextcloud instance.
+      '';
+    };
   };
 
   config = mkIf cfg.enable (mkMerge [
@@ -336,7 +344,16 @@ in {
              server, and wait until the upgrade to 17 is finished.
 
           Then, set `services.nextcloud.package` to `pkgs.nextcloud18` to upgrade to
-          Nextcloud version 18.
+          Nextcloud version 18. Please note that Nextcloud 19 is already out and it's
+          recommended to upgrade to nextcloud19 after that.
+        '')
+        ++ (optional (versionOlder cfg.package.version "19") ''
+          A legacy Nextcloud install (from before NixOS 20.09/unstable) may be installed.
+
+          If/After nextcloud18 is installed successfully, you can safely upgrade to
+          nextcloud19. If not, please upgrade to nextcloud18 first since Nextcloud doesn't
+          support upgrades that skip multiple versions (i.e. an upgrade from 17 to 19 isn't
+          possible, but an upgrade from 18 to 19).
         '');
 
       services.nextcloud.package = with pkgs;
@@ -348,7 +365,8 @@ in {
               `pkgs.nextcloud`.
             ''
           else if versionOlder stateVersion "20.03" then nextcloud17
-          else nextcloud18
+          else if versionOlder stateVersion "20.09" then nextcloud18
+          else nextcloud19
         );
     }
 
@@ -360,6 +378,11 @@ in {
       };
 
       systemd.services = {
+        # When upgrading the Nextcloud package, Nextcloud can report errors such as
+        # "The files of the app [all apps in /var/lib/nextcloud/apps] were not replaced correctly"
+        # Restarting phpfpm on Nextcloud package update fixes these issues (but this is a workaround).
+        phpfpm-nextcloud.restartTriggers = [ cfg.package ];
+
         nextcloud-setup = let
           c = cfg.config;
           writePhpArrary = a: "[${concatMapStringsSep "," (val: ''"${toString val}"'') a}]";

diff --git a/nixos/modules/services/web-apps/nextcloud.xml b/nixos/modules/services/web-apps/nextcloud.xml
@@ -161,5 +161,11 @@
   };
 }</programlisting>
   </para>
+
+  <para>
+   Ideally we should make sure that it's possible to jump two NixOS versions forward:
+   i.e. the warnings and the logic in the module should guard a user to upgrade from a
+   Nextcloud on e.g. 19.09 to a Nextcloud on 20.09.
+  </para>
  </section>
 </chapter>
diff --git a/nixos/modules/services/web-servers/traefik.nix b/nixos/modules/services/web-servers/traefik.nix
@@ -20,10 +20,10 @@ let
     in valueType;
   dynamicConfigFile = if cfg.dynamicConfigFile == null then
     pkgs.runCommand "config.toml" {
-      buildInputs = [ pkgs.remarshal ];
+      buildInputs = [ pkgs.yj ];
       preferLocalBuild = true;
     } ''
-      remarshal -if json -of toml \
+      yj -jt -i \
         < ${
           pkgs.writeText "dynamic_config.json"
           (builtins.toJSON cfg.dynamicConfigOptions)

diff --git a/nixos/modules/system/boot/loader/raspberrypi/raspberrypi-builder.sh b/nixos/modules/system/boot/loader/raspberrypi/raspberrypi-builder.sh
@@ -1,4 +1,7 @@
-#! @bash@/bin/sh -e
+#! @bash@/bin/sh
+
+# This can end up being called disregarding the shebang.
+set -e
 
 shopt -s nullglob
 

diff --git a/nixos/modules/tasks/filesystems/btrfs.nix b/nixos/modules/tasks/filesystems/btrfs.nix
@@ -128,7 +128,10 @@ in
             Nice = 19;
             IOSchedulingClass = "idle";
             ExecStart = "${pkgs.btrfs-progs}/bin/btrfs scrub start -B ${fs}";
-            ExecStop  = "${pkgs.btrfs-progs}/bin/btrfs scrub cancel ${fs}";
+            # if the service is stopped before scrub end, cancel it
+            ExecStop  = pkgs.writeShellScript "btrfs-scrub-maybe-cancel" ''
+              (${pkgs.btrfs-progs}/bin/btrfs scrub status ${fs} | ${pkgs.gnugrep}/bin/grep finished) || ${pkgs.btrfs-progs}/bin/btrfs scrub cancel ${fs}
+            '';
           };
         };
       in listToAttrs (map scrubService cfgScrub.fileSystems);

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
@@ -236,6 +236,7 @@ in
   nginx-pubhtml = handleTest ./nginx-pubhtml.nix {};
   nginx-sandbox = handleTestOn ["x86_64-linux"] ./nginx-sandbox.nix {};
   nginx-sso = handleTest ./nginx-sso.nix {};
+  nginx-variants = handleTest ./nginx-variants.nix {};
   nix-ssh-serve = handleTest ./nix-ssh-serve.nix {};
   nixos-generate-config = handleTest ./nixos-generate-config.nix {};
   novacomd = handleTestOn ["x86_64-linux"] ./novacomd.nix {};
@@ -345,6 +346,7 @@ in
   vault = handleTest ./vault.nix {};
   victoriametrics = handleTest ./victoriametrics.nix {};
   virtualbox = handleTestOn ["x86_64-linux"] ./virtualbox.nix {};
+  wasabibackend = handleTest ./wasabibackend.nix {};
   wireguard = handleTest ./wireguard {};
   wordpress = handleTest ./wordpress.nix {};
   xandikos = handleTest ./xandikos.nix {};

diff --git a/nixos/tests/docker-tools.nix b/nixos/tests/docker-tools.nix
@@ -42,6 +42,20 @@ import ./make-test-python.nix ({ pkgs, ... }: {
             "docker rmi ${examples.nix.imageName}",
         )
 
+    with subtest("The nix binary symlinks are intact"):
+        docker.succeed(
+            "docker load --input='${examples.nix}'",
+            "docker run --rm ${examples.nix.imageName} ${pkgs.bash}/bin/bash -c 'test nix == $(readlink ${pkgs.nix}/bin/nix-daemon)'",
+            "docker rmi ${examples.nix.imageName}",
+        )
+
+    with subtest("The nix binary symlinks are intact when the image is layered"):
+        docker.succeed(
+            "docker load --input='${examples.nixLayered}'",
+            "docker run --rm ${examples.nixLayered.imageName} ${pkgs.bash}/bin/bash -c 'test nix == $(readlink ${pkgs.nix}/bin/nix-daemon)'",
+            "docker rmi ${examples.nixLayered.imageName}",
+        )
+
     with subtest("The pullImage tool works"):
         docker.succeed(
             "docker load --input='${examples.nixFromDockerHub}'",

diff --git a/nixos/tests/home-assistant.nix b/nixos/tests/home-assistant.nix
@@ -2,69 +2,53 @@ import ./make-test-python.nix ({ pkgs, ... }:
 
 let
   configDir = "/var/lib/foobar";
-  apiPassword = "some_secret";
-  mqttPassword = "another_secret";
-  hassCli = "hass-cli --server http://hass:8123 --password '${apiPassword}'";
+  mqttPassword = "secret";
 in {
   name = "home-assistant";
   meta = with pkgs.stdenv.lib; {
     maintainers = with maintainers; [ dotlambda ];
   };
 
-  nodes = {
-    hass =
-      { pkgs, ... }:
-      {
-        environment.systemPackages = with pkgs; [
-          mosquitto home-assistant-cli
-        ];
-        services.home-assistant = {
-          inherit configDir;
-          enable = true;
-          package = pkgs.home-assistant.override {
-            extraPackages = ps: with ps; [ hbmqtt ];
-          };
-          config = {
-            homeassistant = {
-              name = "Home";
-              time_zone = "UTC";
-              latitude = "0.0";
-              longitude = "0.0";
-              elevation = 0;
-              auth_providers = [
-                {
-                  type = "legacy_api_password";
-                  api_password = apiPassword;
-                }
-              ];
-            };
-            frontend = { };
-            mqtt = { # Use hbmqtt as broker
-              password = mqttPassword;
-            };
-            binary_sensor = [
-              {
-                platform = "mqtt";
-                state_topic = "home-assistant/test";
-                payload_on = "let_there_be_light";
-                payload_off = "off";
-              }
-            ];
-          };
-          lovelaceConfig = {
-            title = "My Awesome Home";
-            views = [ {
-              title = "Example";
-              cards = [ {
-                type = "markdown";
-                title = "Lovelace";
-                content = "Welcome to your **Lovelace UI**.";
-              } ];
-            } ];
-          };
-          lovelaceConfigWritable = true;
+  nodes.hass = { pkgs, ... }: {
+    environment.systemPackages = with pkgs; [ mosquitto ];
+    services.home-assistant = {
+      inherit configDir;
+      enable = true;
+      config = {
+        homeassistant = {
+          name = "Home";
+          time_zone = "UTC";
+          latitude = "0.0";
+          longitude = "0.0";
+          elevation = 0;
         };
+        frontend = {};
+        # uses embedded mqtt broker
+        mqtt.password = mqttPassword;
+        binary_sensor = [{
+          platform = "mqtt";
+          state_topic = "home-assistant/test";
+          payload_on = "let_there_be_light";
+          payload_off = "off";
+        }];
+        logger = {
+          default = "info";
+          logs."homeassistant.components.mqtt" = "debug";
+        };
+      };
+      lovelaceConfig = {
+        title = "My Awesome Home";
+        views = [{
+          title = "Example";
+          cards = [{
+            type = "markdown";
+            title = "Lovelace";
+            content = "Welcome to your **Lovelace UI**.";
+          }];
+        }];
       };
+      lovelaceConfigWritable = true;
+    };
   };
 
   testScript = ''
@@ -77,28 +61,13 @@ in {
     with subtest("Check that Home Assistant's web interface and API can be reached"):
         hass.wait_for_open_port(8123)
         hass.succeed("curl --fail http://localhost:8123/lovelace")
-        assert "API running" in hass.succeed(
-            "curl --fail -H 'x-ha-access: ${apiPassword}' http://localhost:8123/api/"
-        )
     with subtest("Toggle a binary sensor using MQTT"):
-        assert '"state": "off"' in hass.succeed(
-            "curl http://localhost:8123/api/states/binary_sensor.mqtt_binary_sensor -H 'x-ha-access: ${apiPassword}'"
-        )
+        # wait for broker to become available
         hass.wait_until_succeeds(
-            "mosquitto_pub -V mqttv311 -t home-assistant/test -u homeassistant -P '${mqttPassword}' -m let_there_be_light"
-        )
-        assert '"state": "on"' in hass.succeed(
-            "curl http://localhost:8123/api/states/binary_sensor.mqtt_binary_sensor -H 'x-ha-access: ${apiPassword}'"
-        )
-    with subtest("Toggle a binary sensor using hass-cli"):
-        assert '"state": "on"' in hass.succeed(
-            "${hassCli} --output json state get binary_sensor.mqtt_binary_sensor"
+            "mosquitto_sub -V mqttv311 -t home-assistant/test -u homeassistant -P '${mqttPassword}' -W 1 -t '*'"
         )
         hass.succeed(
-            "${hassCli} state edit binary_sensor.mqtt_binary_sensor --json='{\"state\": \"off\"}'"
-        )
-        assert '"state": "off"' in hass.succeed(
-            "curl http://localhost:8123/api/states/binary_sensor.mqtt_binary_sensor -H 'x-ha-access: ${apiPassword}'"
+            "mosquitto_pub -V mqttv311 -t home-assistant/test -u homeassistant -P '${mqttPassword}' -m let_there_be_light"
         )
     with subtest("Print log to ease debugging"):
         output_log = hass.succeed("cat ${configDir}/home-assistant.log")
@@ -107,5 +76,9 @@ in {
 
     with subtest("Check that no errors were logged"):
         assert "ERROR" not in output_log
+
+    # example line: 2020-06-20 10:01:32 DEBUG (MainThread) [homeassistant.components.mqtt] Received message on home-assistant/test: b'let_there_be_light'
+    with subtest("Check we received the mosquitto message"):
+        assert "let_there_be_light" in output_log
   '';
 })
diff --git a/nixos/tests/nextcloud/basic.nix b/nixos/tests/nextcloud/basic.nix
@@ -26,7 +26,9 @@ in {
       };
     };
 
-    nextcloud = { config, pkgs, ... }: {
+    nextcloud = { config, pkgs, ... }: let
+      cfg = config;
+    in {
       networking.firewall.allowedTCPPorts = [ 80 ];
 
       services.nextcloud = {
@@ -42,6 +44,8 @@ in {
           startAt = "20:00";
         };
       };
+
+      environment.systemPackages = [ cfg.services.nextcloud.occ ];
     };
   };
 
@@ -67,6 +71,8 @@ in {
   in ''
     start_all()
     nextcloud.wait_for_unit("multi-user.target")
+    # This is just to ensure the nextcloud-occ program is working
+    nextcloud.succeed("nextcloud-occ status")
     nextcloud.succeed("curl -sSf http://nextcloud/login")
     nextcloud.succeed(
         "${withRcloneEnv} ${copySharedFile}"

diff --git a/nixos/tests/nginx-variants.nix b/nixos/tests/nginx-variants.nix
@@ -0,0 +1,33 @@
+{ system ? builtins.currentSystem,
+  config ? {},
+  pkgs ? import ../.. { inherit system config; }
+}:
+
+with import ../lib/testing-python.nix { inherit system pkgs; };
+
+builtins.listToAttrs (
+  builtins.map
+    (nginxName:
+      {
+        name = nginxName;
+        value = makeTest {
+          name = "nginx-variant-${nginxName}";
+
+          machine = { pkgs, ... }: {
+            services.nginx = {
+              enable = true;
+              virtualHosts.localhost.locations."/".return = "200 'foo'";
+              package = pkgs."${nginxName}";
+            };
+          };
+
+          testScript = ''
+            machine.wait_for_unit("nginx")
+            machine.wait_for_open_port(80)
+            machine.succeed('test "$(curl -fvvv http://localhost/)" = foo')
+          '';
+        };
+      }
+    )
+    [ "nginxStable" "nginxUnstable" "nginxShibboleth" "openresty" "tengine" ]
+)
diff --git a/nixos/tests/wasabibackend.nix b/nixos/tests/wasabibackend.nix
@@ -0,0 +1,38 @@
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "wasabibackend";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ mmahut ];
+  };
+
+  nodes = {
+    machine = { ... }: {
+      services.wasabibackend = {
+        enable = true;
+        network = "testnet";
+        rpc = {
+          user = "alice";
+          port = 18332;
+        };
+      };
+      services.bitcoind = {
+        enable = true;
+        testnet = true;
+        rpc.users = {
+          alice.passwordHMAC = "e7096bc21da60b29ecdbfcdb2c3acc62$f948e61cb587c399358ed99c6ed245a41460b4bf75125d8330c9f6fcc13d7ae7";
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("wasabibackend.service")
+    machine.wait_until_succeeds(
+        "grep 'Wasabi Backend started' /var/lib/wasabibackend/.walletwasabi/backend/Logs.txt"
+    )
+    machine.sleep(5)
+    machine.succeed(
+        "grep 'Config is successfully initialized' /var/lib/wasabibackend/.walletwasabi/backend/Logs.txt"
+    )
+  '';
+})
diff --git a/pkgs/applications/audio/librespot/default.nix b/pkgs/applications/audio/librespot/default.nix
@@ -0,0 +1,49 @@
+{ stdenv, fetchFromGitHub, rustPlatform, pkgconfig, openssl
+, withRodio ? true
+, withALSA ? true, alsaLib ? null
+, withPulseAudio ? false, libpulseaudio ? null
+, withPortAudio ? false, portaudio ? null
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "librespot";
+  version = "0.1.1";
+
+  src = fetchFromGitHub {
+    owner = "librespot-org";
+    repo = "librespot";
+    rev = "v${version}";
+    sha256 = "1sdbjv8w2mfpv82rx5iy4s532l1767vmlrg9d8khnvh8vrm2lshy";
+  };
+
+  cargoSha256 = "0zi50imjvalwl6pxl35qrmbg74j5xdfaws8v69am4g9agbfjvlms";
+
+  cargoBuildFlags = with stdenv.lib; [
+    "--no-default-features"
+    "--features"
+    (concatStringsSep "," (filter (x: x != "") [
+      (optionalString withRodio "rodio-backend")
+      (optionalString withALSA "alsa-backend")
+      (optionalString withPulseAudio "pulseaudio-backend")
+      (optionalString withPortAudio "portaudio-backend")
+
+    ]))
+  ];
+
+  nativeBuildInputs = [ pkgconfig ];
+
+  buildInputs = [ openssl ]
+    ++ stdenv.lib.optional withALSA alsaLib
+    ++ stdenv.lib.optional withPulseAudio libpulseaudio
+    ++ stdenv.lib.optional withPortAudio portaudio;
+
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "Open Source Spotify client library and playback daemon";
+    homepage = "https://github.com/librespot-org/librespot";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ bennofs ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/applications/audio/mpg123/default.nix b/pkgs/applications/audio/mpg123/default.nix
@@ -3,11 +3,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "mpg123-1.25.13";
+  name = "mpg123-1.26.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/mpg123/${name}.tar.bz2";
-    sha256 = "02l915jq0ymndb082g6w89bpf66z04ifa1lr7ga3yycw6m46hc4h";
+    sha256 = "0cp01wdy77ggzqzzasxd5jd9iypcly5m4c89idc9mpgknyd65mkl";
   };
 
   buildInputs = stdenv.lib.optional (!stdenv.isDarwin) alsaLib;

diff --git a/pkgs/applications/blockchains/bitcoin-knots.nix b/pkgs/applications/blockchains/bitcoin-knots.nix
@@ -0,0 +1,41 @@
+{ stdenv
+, fetchFromGitHub
+, pkgconfig
+, autoreconfHook
+, db5
+, openssl
+, boost
+, zlib
+, miniupnpc
+, libevent
+, protobuf
+, utillinux
+}:
+
+stdenv.mkDerivation rec {
+  pname = "bitcoind-knots";
+  version = "0.20.0";
+  versionDate = "20200614";
+
+  src = fetchFromGitHub {
+    owner = "bitcoinknots";
+    repo = "bitcoin";
+    rev = "v${version}.knots${versionDate}";
+    sha256 = "0c8k1154kcwz6q2803wx0zigvqaij1fi5akgfqlj3yl57jjw48jj";
+  };
+
+  nativeBuildInputs = [ pkgconfig autoreconfHook ];
+  buildInputs = [ openssl db5 openssl utillinux
+                  protobuf boost zlib miniupnpc libevent ];
+
+  configureFlags = [ "--with-incompatible-bdb"
+                     "--with-boost-libdir=${boost.out}/lib" ];
+
+  meta = with stdenv.lib; {
+    description = "An enhanced Bitcoin node software";
+    homepage = "https://bitcoinknots.org/";
+    license = licenses.mit;
+    maintainers = [ maintainers.mmahut ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/applications/blockchains/monero-gui/default.nix b/pkgs/applications/blockchains/monero-gui/default.nix
@@ -4,21 +4,21 @@
 , qtmultimedia, qtxmlpatterns
 , qtquickcontrols, qtquickcontrols2
 , monero, unbound, readline, boost, libunwind
-, libsodium, pcsclite, zeromq, cppzmq
+, libsodium, pcsclite, zeromq, libgcrypt, libgpgerror
 , hidapi, libusb-compat-0_1, protobuf, randomx
 }:
 
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "monero-gui";
-  version = "0.15.0.4";
+  version = "0.16.0.0";
 
   src = fetchFromGitHub {
     owner  = "monero-project";
     repo   = "monero-gui";
     rev    = "v${version}";
-    sha256 = "12m5fgnxkr11q2arx1m5ccpxqm5ljcvm6l547dwqn297zs5jim4z";
+    sha256 = "06vdrsj5y9k0zn32hspyxc7sw1kkyrvi3chzkdbnxk9jvyj8k4ld";
   };
 
   nativeBuildInputs = [ qmake pkgconfig wrapQtAppsHook ];
@@ -27,9 +27,9 @@ stdenv.mkDerivation rec {
     qtbase qtdeclarative qtgraphicaleffects
     qtmultimedia qtquickcontrols qtquickcontrols2
     qtxmlpatterns
-    monero unbound readline
+    monero unbound readline libgcrypt libgpgerror
     boost libunwind libsodium pcsclite zeromq
-    cppzmq hidapi libusb-compat-0_1 protobuf randomx
+    hidapi libusb-compat-0_1 protobuf randomx
   ];
 
   NIX_CFLAGS_COMPILE = [ "-Wno-error=format-security" ];
@@ -52,6 +52,10 @@ stdenv.mkDerivation rec {
   preBuild = ''
     sed -i s#/opt/monero-wallet-gui##g Makefile
     make -C src/zxcvbn-c
+
+    # use nixpkgs monero sources
+    rmdir monero
+    ln -s "${monero.src}" monero
   '';
 
   desktopItem = makeDesktopItem {

diff --git a/pkgs/applications/blockchains/monero/default.nix b/pkgs/applications/blockchains/monero/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub
 , cmake, pkgconfig
-, boost, miniupnpc, openssl, unbound, cppzmq
+, boost, miniupnpc, openssl, unbound
 , zeromq, pcsclite, readline, libsodium, hidapi
 , pythonProtobuf, randomx, rapidjson, libusb-compat-0_1
 , CoreData, IOKit, PCSC
@@ -10,27 +10,28 @@ assert stdenv.isDarwin -> IOKit != null;
 
 stdenv.mkDerivation rec {
   pname = "monero";
-  version = "0.15.0.1";
+  version = "0.16.0.0";
 
   src = fetchFromGitHub {
     owner = "monero-project";
     repo = "monero";
     rev = "v${version}";
-    sha256 = "0sypa235lf2bbib4b71xpaw39h9304slgsvnsz8wmy9fq1zx009m";
+    sha256 = "0x74h5z0nxxxip97ibc854pqmrgd8r4d6w62m424f66i8gbzfskh";
     fetchSubmodules = true;
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];
 
   buildInputs = [
     boost miniupnpc openssl unbound
-    cppzmq zeromq pcsclite readline
+    zeromq pcsclite readline
     libsodium hidapi randomx rapidjson
     pythonProtobuf libusb-compat-0_1
   ] ++ stdenv.lib.optionals stdenv.isDarwin [ IOKit CoreData PCSC ];
 
   cmakeFlags = [
     "-DCMAKE_BUILD_TYPE=Release"
+    "-DUSE_DEVICE_TREZOR=ON"
     "-DBUILD_GUI_DEPS=ON"
     "-DReadline_ROOT_DIR=${readline.dev}"
   ] ++ stdenv.lib.optional stdenv.isDarwin "-DBoost_USE_MULTITHREADED=OFF";

diff --git a/pkgs/applications/blockchains/wasabibackend/create_deps.sh b/pkgs/applications/blockchains/wasabibackend/create_deps.sh
@@ -0,0 +1,98 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i bash -p dotnet-sdk_3 nixfmt
+
+# Run this script to generate deps.nix
+# ./create_deps.sh /path/to/package/source/checkout > deps.nix
+
+# TODO: consolidate with other dotnet deps generation scripts by which
+#       this script is inspired:
+#       - pkgs/servers/nosql/eventstore/create-deps.sh
+#       - pkgs/development/dotnet-modules/python-language-server/create_deps.sh
+
+URLBASE="https://www.nuget.org/api/v2/package"
+
+DEPS_HEADER="
+{ fetchurl }:
+let
+  nugetUrlBase = \"$URLBASE\";
+  fetchNuGet = { name, version, sha256 }: fetchurl {
+    inherit sha256;
+    url = \"\${nugetUrlBase}/\${name}/\${version}\";
+  };
+in ["
+
+DEPS_FOOTER="]"
+
+DEPS_TEMPLATE="
+(fetchNuGet {
+  name = \"%s\";
+  version = \"%s\";
+  sha256 = \"%s\";
+})"
+
+
+function generate_restore_log() {
+  checkout_path=$1
+  >&2 echo "generating restore log for $checkout_path..."
+  cd $checkout_path
+  dotnet nuget locals all --clear
+  dotnet restore -v normal --no-cache WalletWasabi.Backend -r linux-x64
+  cd -
+}
+
+function process_restore_log() {
+  restore_log=$1
+  >&2 echo "processing restore log..."
+  while read line; do
+    if echo $line | grep -q "^[[:space:]]*Installing"; then
+      l=$(echo $line | xargs)
+      l=${l#Installing }
+      l=${l%.}
+      echo $l
+    fi
+  done < $restore_log
+}
+
+function prefetch_deps() {
+  processed_log=$1
+  >&2 echo "prefetching deps..."
+  while read line; do
+    name=$(echo $line | cut -d' ' -f1)
+    >&2 echo "prefetching '$name' version: $version"
+    version=$(echo $line | cut -d' ' -f2)
+    hash=$(nix-prefetch-url "$URLBASE/$name/$version" 2>/dev/null)
+    echo "$name $version $hash"
+  done < $processed_log
+}
+
+function generate_deps_expression() {
+  packages=$1
+  >&2 echo "generating deps nix-expression..."
+  echo $DEPS_HEADER
+  while read line; do
+    name=$(echo $line | cut -d' ' -f1)
+    version=$(echo $line | cut -d' ' -f2)
+    hash=$(echo $line | cut -d' ' -f3)
+    printf "$DEPS_TEMPLATE" $name $version $hash
+  done < $packages
+  echo $DEPS_FOOTER
+}
+
+function main() {
+  checkout_path=$1
+  tmpdir=$(mktemp -d)
+  generate_restore_log $checkout_path > $tmpdir/restore.log
+  process_restore_log $tmpdir/restore.log > $tmpdir/processed.log
+  prefetch_deps $tmpdir/processed.log > $tmpdir/prefetched.log
+  generate_deps_expression $tmpdir/prefetched.log > $tmpdir/deps.nix
+  nixfmt $tmpdir/deps.nix
+  cat $tmpdir/deps.nix
+  rm -rf $tmpdir
+}
+
+if [ ! -d "$1" ]; then
+    >&2 echo "First argument must be a directory, the path to the package source checkout"
+    exit 1
+fi
+
+main $@
diff --git a/pkgs/applications/blockchains/wasabibackend/default.nix b/pkgs/applications/blockchains/wasabibackend/default.nix
@@ -0,0 +1,100 @@
+{ stdenv
+, fetchFromGitHub
+, fetchurl
+, makeWrapper
+, Nuget
+, dotnetCorePackages
+, openssl
+, zlib
+}:
+
+let
+  deps = import ./deps.nix { inherit fetchurl; };
+
+  dotnet-sdk = dotnetCorePackages.sdk_3_1;
+  dotnet-aspnetcore = dotnetCorePackages.aspnetcore_3_1;
+
+  nugetSource = stdenv.mkDerivation {
+    pname = "${pname}-nuget-deps";
+    inherit version;
+
+    dontUnpack = true;
+    dontInstall = true;
+
+    nativeBuildInputs = [ Nuget ];
+
+    buildPhase = ''
+      export HOME=$(mktemp -d)
+      mkdir -p $out/lib
+
+      nuget sources Disable -Name "nuget.org"
+      for package in ${toString deps}; do
+        nuget add $package -Source $out/lib
+      done
+    '';
+  };
+
+  pname = "WasabiBackend";
+  version = "1.1.11.1";
+
+  projectName = "WalletWasabi.Backend";
+  projectConfiguration = "Release";
+  projectRuntime = "linux-x64";
+in
+
+stdenv.mkDerivation rec {
+  inherit pname version;
+
+  src = fetchFromGitHub {
+    owner = "zkSNACKs";
+    repo = "WalletWasabi";
+    rev = "v${version}";
+    sha256 = "0kxww8ywhld00b0qsv5jh5s19jqpahnb9mvshmjnp3cb840j12a7";
+  };
+
+  buildInputs = [
+    Nuget
+    dotnet-sdk
+    makeWrapper
+  ];
+
+  buildPhase = ''
+    export HOME=$(mktemp -d)
+    export DOTNET_CLI_TELEMETRY_OPTOUT=1
+    export DOTNET_SKIP_FIRST_TIME_EXPERIENCE=1
+    export DOTNET_ROOT="${dotnet-sdk}/bin"
+
+    nuget sources Disable -Name "nuget.org"
+
+    dotnet restore \
+      --source ${nugetSource}/lib \
+      --runtime ${projectRuntime} \
+      ${projectName}
+
+    dotnet publish \
+      --no-restore \
+      --runtime ${projectRuntime} \
+      --configuration ${projectConfiguration} \
+      ${projectName}
+  '';
+
+  installPhase = ''
+    mkdir -p $out
+    cp -r ${projectName}/bin/${projectConfiguration}/netcoreapp3.1/${projectRuntime}/publish $out/lib
+    mkdir -p $out/bin
+    makeWrapper $out/lib/WalletWasabi.Backend $out/bin/${pname} \
+      --prefix LD_LIBRARY_PATH : ${stdenv.lib.makeLibraryPath [ openssl zlib ]} \
+      --run "cd $out/lib"
+  '';
+
+  # If we don't disable stripping the executable fails to start with segfault
+  dontStrip = true;
+
+  meta = with stdenv.lib; {
+    description = "Backend for the Wasabi Wallet";
+    homepage = "https://wasabiwallet.io/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ mmahut ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/applications/blockchains/wasabibackend/deps.nix b/pkgs/applications/blockchains/wasabibackend/deps.nix
diff --git a/pkgs/applications/editors/eclipse/default.nix b/pkgs/applications/editors/eclipse/default.nix
@@ -8,15 +8,15 @@
 
 assert stdenv ? glibc;
 
-# http://download.eclipse.org/eclipse/downloads/ is the main place to
+# https://download.eclipse.org/eclipse/downloads/ is the main place to
 # find the downloads needed for new versions
 
 let
   platform_major = "4";
-  platform_minor = "15";
+  platform_minor = "16";
   year = "2020";
-  month = "03";
-  timestamp = "${year}${month}050155";
+  month = "06";
+  timestamp = "${year}${month}040540";
   gtk = gtk3;
 in rec {
 
@@ -33,8 +33,8 @@ in rec {
     description = "Eclipse IDE for C/C++ Developers";
     src =
       fetchurl {
-        url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/${year}-${month}/R/eclipse-cpp-${year}-${month}-R-incubation-linux-gtk-x86_64.tar.gz";
-        sha512 = "2wy4a3p347fajr9zsfz1zlvz6jpy3vficdry27m5fs0azfmxmy2cfns5hh18sin4xqq3jvqppfqxh41rzcpcmiq12zhc6cz42brqgxw";
+        url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/${year}-${month}/R/eclipse-cpp-${year}-${month}-R-linux-gtk-x86_64.tar.gz";
+        sha512 = "0vfxzsvfv9zmd0ckrdpziijzskh13g8kgk8ibkwmhmqmj14a3visk6yvn5q2s0knkswl1zy9arinw0mxvqh72dfj63vwc01vhp06lyr";
       };
   };
 
@@ -46,7 +46,7 @@ in rec {
     src =
       fetchurl {
         url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/${year}-${month}/R/eclipse-modeling-${year}-${month}-R-linux-gtk-x86_64.tar.gz";
-        sha512 = "0qccsclay9000sqrymm8hkg70a4jcvd70vymw1kkxsklcs7dnrhch55an98gbzf9r0jgd1ap62a4hyxlnm6hdqqniwcgdza0i4nwwgj";
+        sha512 = "29nr1x3fgdw5ygrppfma6yi1iaqvad24jyb58sag735z1nz4ymajcwakg52mlv3s19d4w8cxpskh1r459mwz7j769qplymspqifvlkd";
       };
   };
 
@@ -58,7 +58,7 @@ in rec {
     src =
       fetchurl {
         url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops${platform_major}/R-${platform_major}.${platform_minor}-${timestamp}/eclipse-platform-${platform_major}.${platform_minor}-linux-gtk-x86_64.tar.gz";
-        sha512 = "01rv5x7qqm0a2p30828z2snms3nb2kjx9si63sr5rdkdgr3vbh6xq8n8fn757dqazmpz9zskmwxxmbxnwycfllhgb8msb77pcy3fpg7";
+        sha512 = "2pm4xam0jn9x34k1hr5rn67fpvc6snlkpcfn4bzdcf2xjv9f3dr2039mkcrhri5nv2bj6fkbai6aga6fmmrb3na33b7ir7sqlqqn61b";
       };
   };
 
@@ -83,7 +83,7 @@ in rec {
     src =
       fetchurl {
         url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops${platform_major}/R-${platform_major}.${platform_minor}-${timestamp}/eclipse-SDK-${platform_major}.${platform_minor}-linux-gtk-x86_64.tar.gz";
-        sha512 = "33ra8qslwz73240xzjvr751lpl94drlcf425a7kxngq1qla2cda7gxr71bxlr9fm2hrqq0h097ihmg0ix9hv2dmwnc76gp4hwwrlk41";
+        sha512 = "195c07yabmi2a42qxfmpbv6ychpj15bbpgyp40s1pcdb3p875vcqjinq9dqy2sixzwjhfdrggpvwihav87rkih9arzmk2s4cm31mjqd";
       };
   };
 
@@ -95,7 +95,7 @@ in rec {
     src =
       fetchurl {
         url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/${year}-${month}/R/eclipse-java-${year}-${month}-R-linux-gtk-x86_64.tar.gz";
-        sha512 = "0ffa1q19z31j8i552mp9zg4v0p4iv002cvlzh49ia8hi0hgk75pbkp6vxlr75jz0as03n71f0ww8xbflji31qgwfmy6rs1rzqihfff9";
+        sha512 = "3n8jllgxarrxgz16n7zb4bgaqxk0m9frcxrgdxvy25ar2iw8js4q4ir3cc20y4ri3ii74rf3jy6n4ndhm57miwqh4p2wqzhfjlinirb";
       };
   };
 

diff --git a/pkgs/applications/editors/eclipse/plugins.nix b/pkgs/applications/editors/eclipse/plugins.nix
@@ -254,12 +254,13 @@ rec {
 
   cdt = buildEclipseUpdateSite rec {
     name = "cdt-${version}";
-    version = "9.11.0";
+    # find current version at https://www.eclipse.org/cdt/downloads.php
+    version = "9.11.1";
 
     src = fetchzip {
       stripRoot = false;
       url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/tools/cdt/releases/9.11/${name}/${name}.zip";
-      sha256 = "1730w6rbv649nzfalfd10p2ph0z9rbrrcflga0n1dpmg181xh9lk";
+      sha256 = "00cpaal6jm9xb4nbkljrf381r3lf1rb1p06vrbn4l0lxnbckb9df";
     };
 
     meta = with stdenv.lib; {
@@ -474,12 +475,12 @@ rec {
 
   jdt = buildEclipseUpdateSite rec {
     name = "jdt-${version}";
-    version = "4.15";
+    version = "4.16";
 
     src = fetchzip {
       stripRoot = false;
-      url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-${version}-202003050155/org.eclipse.jdt-${version}.zip";
-      sha256 = "1dm4qgfb6rm7w0dk8br071c7wy0ybp7zrwvr3i02c2bxzy2psz7q";
+      url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-${version}-202006040540/org.eclipse.jdt-${version}.zip";
+      sha256 = "0g349hg2nv1y628daxf84396wpf33z52wxv0gawlgrirbbizaznd";
     };
 
     meta = with stdenv.lib; {

diff --git a/pkgs/applications/editors/kdevelop5/kdev-php.nix b/pkgs/applications/editors/kdevelop5/kdev-php.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "kdev-php";
-  version = "5.5.1";
+  version = "5.5.2";
 
   src = fetchurl {
     url = "https://github.com/KDE/${pname}/archive/v${version}.tar.gz";
-    sha256 = "1z3mmlg5srzff0y1pjd4wfdf9k4rzk7gfdvbvzizkiy395qw1phv";
+    sha256 = "0z32x0297g078jk3jhzb4vrf8jhw0qprvqzm9p097h8x0026w42l";
   };
 
   nativeBuildInputs = [ cmake extra-cmake-modules ];

diff --git a/pkgs/applications/editors/vim/configurable.nix b/pkgs/applications/editors/vim/configurable.nix
@@ -104,6 +104,8 @@ in stdenv.mkDerivation rec {
   ++ stdenv.lib.optionals luaSupport [
     "--with-lua-prefix=${lua}"
     "--enable-luainterp"
+  ] ++ stdenv.lib.optional lua.pkgs.isLuaJIT [
+    "--with-luajit"
   ]
   ++ stdenv.lib.optionals pythonSupport [
     "--enable-python${if isPython3 then "3" else ""}interp=yes"

diff --git a/pkgs/applications/gis/whitebox-tools/default.nix b/pkgs/applications/gis/whitebox-tools/default.nix
@@ -1,25 +1,22 @@
 { stdenv, rustPlatform , fetchFromGitHub, Security }:
 rustPlatform.buildRustPackage rec {
   pname = "whitebox_tools";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "jblindsay";
     repo = "whitebox-tools";
     rev = "v${version}";
-    sha256 = "0zi32d0wrbl2763dcllv2g0liwacsfiza5lkx52620prjjbhby8i";
+    sha256 = "0c9jmfjz6ys65y65zlllv9xvaaavr9jpqc1dc217iywhj07j8k2v";
   };
 
   buildInputs = stdenv.lib.optional stdenv.isDarwin Security;
 
-  cargoSha256 = "13k21akyfqgamywj39bw73sldby1s02vyvxfglxbaqq1x96xcy4i";
-
-  # failures: structures::polyline::test::test_polyline_split
-  doCheck = false;
+  cargoSha256 = "05w2jimmygg7dc93i8bpjpjc5yj5xfpfkjnbbgw2sq4kh06r5ii4";
 
   meta = with stdenv.lib; {
     description = "An advanced geospatial data analysis platform";
-    homepage = "http://www.uoguelph.ca/~hydrogeo/WhiteboxTools/index.html";
+    homepage = "https://jblindsay.github.io/ghrg/WhiteboxTools/index.html";
     license = licenses.mit;
     maintainers = [ maintainers.mpickering ];
     platforms = platforms.all;

diff --git a/pkgs/applications/graphics/evilpixie/default.nix b/pkgs/applications/graphics/evilpixie/default.nix
@@ -0,0 +1,59 @@
+{ mkDerivation
+, lib
+, fetchFromGitHub
+, makeDesktopItem
+, qmake
+, qtbase
+, libpng
+, giflib
+, impy
+}:
+
+let
+  desktopItem = makeDesktopItem {
+    name = "EvilPixie";
+    desktopName = "EvilPixie";
+    exec = "evilpixie %F";
+    icon = "evilpixie";
+    genericName = "Image Editor";
+    categories = "Graphics;2DGraphics;RasterGraphics;";
+    mimeType = "image/bmp;image/gif;image/jpeg;image/jpg;image/png;image/x-pcx;image/x-targa;image/x-tga;";
+  };
+
+in mkDerivation rec {
+  pname = "evilpixie";
+  version = "0.2";
+
+  src = fetchFromGitHub {
+    owner = "bcampbell";
+    repo = "evilpixie";
+    rev = "v${version}";
+    sha256 = "1yg4ic3kcxqmr7k5bbvrv5iavlnhpdx6510z5wha9k9k5q9c4dvh";
+  };
+
+  nativeBuildInputs = [
+    qmake
+  ];
+
+  buildInputs = [
+    qtbase
+    libpng
+    giflib
+    impy
+  ];
+
+  postInstall = ''
+    ln -s ${desktopItem}/share/applications $out/share
+    install -Dm 444 icon_128x128.png $out/share/icons/hicolor/128x128/apps/evilpixie.png
+  '';
+
+  meta = with lib; {
+    description = "Pixel-oriented paint program, modelled on Deluxe Paint";
+    homepage = "http://evilpixie.scumways.com/";
+    downloadPage = "https://github.com/bcampbell/evilpixie/releases";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ fgaz ];
+    platforms = platforms.all;
+  };
+}
+
diff --git a/pkgs/applications/misc/alacritty/default.nix b/pkgs/applications/misc/alacritty/default.nix
@@ -90,8 +90,6 @@ rustPlatform.buildRustPackage rec {
       --replace xdg-open ${xdg_utils}/bin/xdg-open
   '';
 
-  postBuild = lib.optionalString stdenv.isDarwin "make app";
-
   installPhase = ''
     runHook preInstall
 
@@ -100,7 +98,8 @@ rustPlatform.buildRustPackage rec {
   '' + (
     if stdenv.isDarwin then ''
       mkdir $out/Applications
-      cp -r $releaseDir/osx/Alacritty.app $out/Applications/Alacritty.app
+      cp -r extra/osx/Alacritty.app $out/Applications
+      ln -s $out/bin $out/Applications/Alacritty.app/Contents/MacOS
     '' else ''
       install -D extra/linux/Alacritty.desktop -t $out/share/applications/
       install -D extra/logo/compat/alacritty-term.svg $out/share/icons/hicolor/scalable/apps/Alacritty.svg

diff --git a/pkgs/applications/misc/gollum/Gemfile.lock b/pkgs/applications/misc/gollum/Gemfile.lock
@@ -1,12 +1,12 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    backports (3.17.0)
+    backports (3.17.2)
     concurrent-ruby (1.1.6)
     crass (1.0.6)
     execjs (2.7.0)
-    ffi (1.12.2)
-    gemojione (4.3.2)
+    ffi (1.13.1)
+    gemojione (4.3.3)
       json
     github-markup (3.0.4)
     gollum (5.0.1)
@@ -25,28 +25,28 @@ GEM
       therubyrhino (~> 2.1.0)
       uglifier (~> 3.2)
       useragent (~> 0.16.2)
-    gollum-lib (5.0.3)
+    gollum-lib (5.0.4)
       gemojione (~> 4.1)
       github-markup (~> 3.0)
-      gollum-rugged_adapter (~> 0.99.4, >= 0.99.4)
+      gollum-rugged_adapter (~> 1.0)
       loofah (~> 2.3)
       nokogiri (~> 1.8)
       octicons (~> 8.5)
       rouge (~> 3.1)
       twitter-text (= 1.14.7)
-    gollum-rugged_adapter (0.99.4)
+    gollum-rugged_adapter (1.0)
       mime-types (>= 1.15)
       rugged (~> 0.99)
     json (2.3.0)
     kramdown (2.1.0)
     kramdown-parser-gfm (1.0.1)
       kramdown (~> 2.0)
-    loofah (2.5.0)
+    loofah (2.6.0)
       crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
     mime-types (3.3.1)
       mime-types-data (~> 3.2015)
-    mime-types-data (3.2019.1009)
+    mime-types-data (3.2020.0512)
     mini_portile2 (2.4.0)
     multi_json (1.14.1)
     mustache (0.99.8)
@@ -56,14 +56,14 @@ GEM
       mini_portile2 (~> 2.4.0)
     octicons (8.5.0)
       nokogiri (>= 1.6.3.1)
-    rack (2.2.2)
+    rack (2.2.3)
     rack-protection (2.0.8.1)
       rack
-    rb-fsevent (0.10.3)
+    rb-fsevent (0.10.4)
     rb-inotify (0.10.1)
       ffi (~> 1.0)
     rexml (3.2.4)
-    rouge (3.17.0)
+    rouge (3.20.0)
     rss (0.2.9)
       rexml
     ruby2_keywords (0.0.2)
@@ -88,7 +88,7 @@ GEM
     sprockets (3.7.2)
       concurrent-ruby (~> 1.0)
       rack (> 1, < 3)
-    sprockets-helpers (1.2.3)
+    sprockets-helpers (1.3.0)
       sprockets (>= 2.2)
     therubyrhino (2.1.2)
       therubyrhino_jar (>= 1.7.4, < 1.7.9)

diff --git a/pkgs/applications/misc/gollum/gemset.nix b/pkgs/applications/misc/gollum/gemset.nix
@@ -4,10 +4,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "13ywgyyxzlgks7nb17gwqjmdqjjmhc8si3iliv8jhf51lb3s865v";
+      sha256 = "0rg58rd3hgk8wz4fbapn3szwgymk1q9lv4ywg37bkbcflsbi70iy";
       type = "gem";
     };
-    version = "3.17.0";
+    version = "3.17.2";
   };
   concurrent-ruby = {
     groups = ["default"];
@@ -44,21 +44,21 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "10lfhahnnc91v63xpvk65apn61pib086zha3z5sp1xk9acfx12h4";
+      sha256 = "12lpwaw82bb0rm9f52v1498bpba8aj2l2q359mkwbxsswhpga5af";
       type = "gem";
     };
-    version = "1.12.2";
+    version = "1.13.1";
   };
   gemojione = {
     dependencies = ["json"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "097mrsahv1h67kjrk1cpiqc1cbrfgvlp2rqwmzdzxrq0kx50461w";
+      sha256 = "0fwd523pgr72w3w6jwpz9i6sggvz52d7831a1s4y3lv8m50j6ima";
       type = "gem";
     };
-    version = "4.3.2";
+    version = "4.3.3";
   };
   github-markup = {
     groups = ["default"];
@@ -87,21 +87,21 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0r59fyf7i4rlp6wj9ilnqd9pmgpkafv0yl4jmrxa6hr2p4cmnf1g";
+      sha256 = "0pr3djmawqpmifyadw1vfzdkq720dsaqih1wf8k2vksw0lr9la74";
       type = "gem";
     };
-    version = "5.0.3";
+    version = "5.0.4";
   };
   gollum-rugged_adapter = {
     dependencies = ["mime-types" "rugged"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0016yfac3b3sy34k9wrqg422mjm8cpd1jd1m4gdn4x2d4jxhxkzq";
+      sha256 = "0ln12976vm1ks74yyrssdx576b1z0hs8r82fivr366knv5hlcrdm";
       type = "gem";
     };
-    version = "0.99.4";
+    version = "1.0";
   };
   json = {
     groups = ["default"];
@@ -140,10 +140,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0jk9fgn5ayzbqvzqm11gbkqvas77zdbpkvynlylyiwynclgrn040";
+      sha256 = "1s9hq8bpn6g5vqr3nzyirn3agn7x8agan6151zvq5vmkf6rvmyb2";
       type = "gem";
     };
-    version = "2.5.0";
+    version = "2.6.0";
   };
   mime-types = {
     dependencies = ["mime-types-data"];
@@ -161,10 +161,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "18x61fc36951vw7f74gq8cyybdpxvyg5d0azvqhrs82ddw3v16xh";
+      sha256 = "1z75svngyhsglx0y2f9rnil2j08f9ab54b3l95bpgz67zq2if753";
       type = "gem";
     };
-    version = "3.2019.1009";
+    version = "3.2020.0512";
   };
   mini_portile2 = {
     groups = ["default"];
@@ -234,10 +234,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "10mp9s48ssnw004aksq90gvhdvwczh8j6q82q2kqiqq92jd1zxbp";
+      sha256 = "0i5vs0dph9i5jn8dfc6aqd6njcafmb20rwqngrf759c9cvmyff16";
       type = "gem";
     };
-    version = "2.2.2";
+    version = "2.2.3";
   };
   rack-protection = {
     dependencies = ["rack"];
@@ -255,10 +255,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1lm1k7wpz69jx7jrc92w3ggczkjyjbfziq5mg62vjnxmzs383xx8";
+      sha256 = "1k9bsj7ni0g2fd7scyyy1sk9dy2pg9akniahab0iznvjmhn54h87";
       type = "gem";
     };
-    version = "0.10.3";
+    version = "0.10.4";
   };
   rb-inotify = {
     dependencies = ["ffi"];
@@ -286,10 +286,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0xl7k5paf66p57sphm4nfa4k86yf93lhdzzr0cv0l4divq12g2pr";
+      sha256 = "1r5npy9a95qh5v74lw7ir3nhaq4xrzyhfdixd7c5xy295i92nnic";
       type = "gem";
     };
-    version = "3.17.0";
+    version = "3.20.0";
   };
   rss = {
     dependencies = ["rexml"];
@@ -383,10 +383,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1hy67dwz76n5db00d9n3qy59ici96c2g25c9xpmp2nh8ilvha338";
+      sha256 = "14iq8v16l31bfq7pikfmgcv5x6pkc5lbdmwwg6zlzcy1bibcliar";
       type = "gem";
     };
-    version = "1.2.3";
+    version = "1.3.0";
   };
   therubyrhino = {
     dependencies = ["therubyrhino_jar"];

diff --git a/pkgs/applications/misc/khard/default.nix b/pkgs/applications/misc/khard/default.nix
@@ -22,6 +22,11 @@ python3.pkgs.buildPythonApplication rec {
     install -D misc/zsh/_khard $out/share/zsh/site-functions/_khard
   '';
 
+  preCheck = ''
+    # see https://github.com/scheibler/khard/issues/263
+    export COLUMNS=80
+  '';
+
   meta = {
     homepage = "https://github.com/scheibler/khard";
     description = "Console carddav client";

diff --git a/pkgs/applications/misc/kitty/default.nix b/pkgs/applications/misc/kitty/default.nix
@@ -3,7 +3,7 @@
   libstartup_notification, libGL, libX11, libXrandr, libXinerama, libXcursor,
   libxkbcommon, libXi, libXext, wayland-protocols, wayland,
   installShellFiles,
-  which, dbus,
+  dbus,
   Cocoa,
   CoreGraphics,
   Foundation,
@@ -20,14 +20,14 @@
 with python3Packages;
 buildPythonApplication rec {
   pname = "kitty";
-  version = "0.17.4";
+  version = "0.18.0";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "kovidgoyal";
     repo = "kitty";
     rev = "v${version}";
-    sha256 = "1rbyj84y8r6h7qd6w7cw58v2abspippignj458ihv2m26i4als2x";
+    sha256 = "15i4ld65a5rfbaxxdh6kgg9h0ih73iqjskk82h8j72qgzkc6g3hf";
   };
 
   buildInputs = [
@@ -50,7 +50,7 @@ buildPythonApplication rec {
   ];
 
   nativeBuildInputs = [
-    pkgconfig which sphinx ncurses
+    pkgconfig sphinx ncurses
   ] ++ stdenv.lib.optionals stdenv.isDarwin [
     imagemagick
     libicns  # For the png2icns tool.
@@ -63,25 +63,30 @@ buildPythonApplication rec {
 
   patches = [
     ./fix-paths.patch
-  ] ++ stdenv.lib.optionals stdenv.isLinux [
-    (substituteAll {
-      src = ./library-paths.patch;
-      libstartup_notification = "${libstartup_notification}/lib/libstartup-notification-1.so";
-      libcanberra = "${libcanberra}/lib/libcanberra.so";
-      libEGL = "${stdenv.lib.getLib libGL}/lib/libEGL.so.1";
-    })
   ] ++ stdenv.lib.optionals stdenv.isDarwin [
     ./no-lto.patch
   ];
 
   # Causes build failure due to warning
   hardeningDisable = stdenv.lib.optional stdenv.isDarwin "strictoverflow";
 
+  dontConfigure = true;
+
   buildPhase = if stdenv.isDarwin then ''
     ${python.interpreter} setup.py kitty.app --update-check-interval=0
     make man
   '' else ''
-    ${python.interpreter} setup.py linux-package --update-check-interval=0
+    ${python.interpreter} setup.py linux-package \
+    --update-check-interval=0 \
+    --egl-library='${stdenv.lib.getLib libGL}/lib/libEGL.so.1' \
+    --startup-notification-library='${libstartup_notification}/lib/libstartup-notification-1.so' \
+    --canberra-library='${libcanberra}/lib/libcanberra.so'
+  '';
+
+  checkInputs = [ pillow ];
+
+  checkPhase = ''
+    ${python.interpreter} test.py
   '';
 
   installPhase = ''
@@ -100,8 +105,6 @@ buildPythonApplication rec {
     wrapProgram "$out/bin/kitty" --prefix PATH : "$out/bin:${stdenv.lib.makeBinPath [ imagemagick xsel ncurses.dev ]}"
     runHook postInstall
 
-    # ZSH completions need to be invoked with `source`:
-    # https://github.com/kovidgoyal/kitty/blob/8ceb941051b89b7c50850778634f0b6137aa5e6e/docs/index.rst#zsh
     mkdir -p "$out/share/"{bash-completion/completions,fish/vendor_completions.d,zsh/site-functions}
     "$out/bin/kitty" + complete setup fish > "$out/share/fish/vendor_completions.d/kitty.fish"
     "$out/bin/kitty" + complete setup bash > "$out/share/bash-completion/completions/kitty.bash"
@@ -125,6 +128,7 @@ buildPythonApplication rec {
     homepage = "https://github.com/kovidgoyal/kitty";
     description = "A modern, hackable, featureful, OpenGL based terminal emulator";
     license = licenses.gpl3;
+    changelog = "https://sw.kovidgoyal.net/kitty/changelog.html";
     platforms = platforms.darwin ++ platforms.linux;
     maintainers = with maintainers; [ tex rvolosatovs ma27 Luflosi ];
   };

diff --git a/pkgs/applications/misc/kitty/library-paths.patch b/pkgs/applications/misc/kitty/library-paths.patch
diff --git a/pkgs/applications/misc/kitty/no-lto.patch b/pkgs/applications/misc/kitty/no-lto.patch
@@ -1,6 +1,6 @@
 --- a/setup.py
 +++ b/setup.py
-@@ -277,10 +277,6 @@ def init_env(
+@@ -287,10 +287,6 @@ def init_env(
      cppflags += shlex.split(os.environ.get('CPPFLAGS', ''))
      cflags += shlex.split(os.environ.get('CFLAGS', ''))
      ldflags += shlex.split(os.environ.get('LDFLAGS', ''))

diff --git a/pkgs/applications/misc/openrgb/default.nix b/pkgs/applications/misc/openrgb/default.nix
@@ -0,0 +1,36 @@
+{ mkDerivation, lib, fetchFromGitHub, qmake, libusb1, hidapi }:
+
+mkDerivation rec {
+  pname = "openrgb";
+  version = "0.2";
+
+  src = fetchFromGitHub {
+    owner = "CalcProgrammer1";
+    repo = "OpenRGB";
+    rev = "release_${version}";
+    sha256 = "0b1mkp4ca4gdzk020kp6dkd3i9a13h4ikrn3417zscsvv5y9kv0s";
+  };
+
+  nativeBuildInputs = [ qmake ];
+  buildInputs = [ libusb1 hidapi ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp OpenRGB $out/bin
+  '';
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    $out/bin/OpenRGB --help > /dev/null
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    description = "Open source RGB lighting control";
+    homepage = "https://gitlab.com/CalcProgrammer1/OpenRGB";
+    maintainers = with maintainers; [ jonringer ];
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/applications/misc/tellico/default.nix b/pkgs/applications/misc/tellico/default.nix
@@ -0,0 +1,67 @@
+{ lib
+, fetchurl
+, mkDerivation
+, kdeApplications
+, kinit
+, kdelibs4support
+, solid
+, kxmlgui
+, karchive
+, kfilemetadata
+, khtml
+, knewstuff
+, libksane
+, cmake
+, exempi
+, extra-cmake-modules
+, libcdio
+, poppler
+, makeWrapper
+, kdoctools
+}:
+
+mkDerivation rec {
+  name = "tellico";
+  version = "3.3.0";
+
+  src = fetchurl {
+    url = "https://tellico-project.org/files/tellico-${lib.versions.majorMinor version}.tar.xz";
+    sha256 = "1digkpvzrsbv5znf1cgzs6zkmysfz6lzs12n12mrrpgkcdxc426y";
+  };
+
+  patches = [
+    ./hex.patch
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    extra-cmake-modules
+    kdoctools
+    makeWrapper
+  ];
+
+  buildInputs = [
+    kdelibs4support
+    solid
+    kxmlgui
+    karchive
+    kfilemetadata
+    khtml
+    knewstuff
+    libksane
+    cmake
+    exempi
+    extra-cmake-modules
+    libcdio
+    kdeApplications.libkcddb
+    poppler
+  ];
+
+  meta = {
+    description = "Collection management software, free and simple";
+    homepage = "https://tellico-project.org/";
+    maintainers = with lib.maintainers; [ numkem ];
+    license = with lib.licenses; [ gpl2 gpl3 ];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/applications/misc/tellico/hex.patch b/pkgs/applications/misc/tellico/hex.patch
@@ -0,0 +1,15 @@
+index 7ea81c7..0c19767 100644
+--- a/src/utils/iso5426converter.cpp
++++ b/src/utils/iso5426converter.cpp
+@@ -1211,7 +1211,11 @@ QChar Iso5426Converter::getCombiningChar(uint c) {
+     return 0x1EF1; // SMALL LETTER U WITH HORN AND DOT BELOW
+
+   default:
++#if (QT_VERSION < QT_VERSION_CHECK(5, 14, 0))
++    myDebug() << "no match for" << hex << c;
++#else
+     myDebug() << "no match for" << Qt::hex << c;
++#endif
+     return QChar();
+   }
+ }
diff --git a/pkgs/applications/networking/browsers/firefox-bin/default.nix b/pkgs/applications/networking/browsers/firefox-bin/default.nix
@@ -8,7 +8,6 @@
 , dbus
 , fontconfig
 , freetype
-, gconf
 , gdk-pixbuf
 , glib
 , glibc
@@ -27,9 +26,7 @@
 , libXinerama
 , libXrender
 , libXt
-, libcanberra-gtk2
-, libgnome
-, libgnomeui
+, libcanberra
 , libnotify
 , gnome3
 , libGLU, libGL
@@ -103,7 +100,6 @@ stdenv.mkDerivation {
       dbus
       fontconfig
       freetype
-      gconf
       gdk-pixbuf
       glib
       glibc
@@ -122,9 +118,7 @@ stdenv.mkDerivation {
       libXinerama
       libXrender
       libXt
-      libcanberra-gtk2
-      libgnome
-      libgnomeui
+      libcanberra
       libnotify
       libGLU libGL
       nspr

diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -2,7 +2,7 @@
 , src, unpackPhase ? null, patches ? []
 , extraNativeBuildInputs ? [], extraConfigureFlags ? [], extraMakeFlags ? [] }:
 
-{ lib, stdenv, pkgconfig, pango, perl, python2, python3, zip, libIDL
+{ lib, stdenv, pkgconfig, pango, perl, python2, python3, zip
 , libjpeg, zlib, dbus, dbus-glib, bzip2, xorg
 , freetype, fontconfig, file, nspr, nss, libnotify
 , yasm, libGLU, libGL, sqlite, unzip, makeWrapper
@@ -104,7 +104,7 @@ stdenv.mkDerivation ({
   patchFlags = [ "-p1" "-l" ];
 
   buildInputs = [
-    gtk2 perl zip libIDL libjpeg zlib bzip2
+    gtk2 perl zip libjpeg zlib bzip2
     dbus dbus-glib pango freetype fontconfig xorg.libXi xorg.libXcursor
     xorg.libX11 xorg.libXrender xorg.libXft xorg.libXt file
     libnotify xorg.pixman yasm libGLU libGL

diff --git a/pkgs/applications/networking/gns3/gui.nix b/pkgs/applications/networking/gns3/gui.nix
@@ -5,8 +5,8 @@
 let
   # TODO: This package requires qt5Full to launch
   defaultOverrides = commonOverrides ++ [
-    (mkOverride "jsonschema" "2.6.0"
-      "00kf3zmpp9ya4sydffpifn0j0mzm342a2vzh82p6r0vh10cg7xbg")
+    (mkOverride "jsonschema" "3.2.0"
+      "0ykr61yiiizgvm3bzipa3l73rvj49wmrybbfwhvpgk3pscl5pa68")
   ];
 
   python = python3.override {

diff --git a/pkgs/applications/networking/gns3/server.nix b/pkgs/applications/networking/gns3/server.nix
@@ -4,8 +4,10 @@
 
 let
   defaultOverrides = commonOverrides ++ [
-    (mkOverride "jsonschema" "2.6.0"
-      "00kf3zmpp9ya4sydffpifn0j0mzm342a2vzh82p6r0vh10cg7xbg")
+    (mkOverride "jsonschema" "3.2.0"
+      "0ykr61yiiizgvm3bzipa3l73rvj49wmrybbfwhvpgk3pscl5pa68")
+    (mkOverride "aiofiles" "0.4.0"
+      "1vmvq9qja3wahv8m1adkyk00zm7j0x64pk3f2ry051ja66xa07h2")
   ];
 
   python = python3.override {

diff --git a/pkgs/applications/networking/instant-messengers/pantalaimon/default.nix b/pkgs/applications/networking/instant-messengers/pantalaimon/default.nix
@@ -1,6 +1,7 @@
 { lib, stdenv, buildPythonApplication, fetchFromGitHub, pythonOlder,
   attrs, aiohttp, appdirs, click, keyring, Logbook, peewee, janus,
   prompt_toolkit, matrix-nio, dbus-python, pydbus, notify2, pygobject3,
+  setuptools,
 
   pytest, faker, pytest-aiohttp, aioresponses,
 
@@ -9,7 +10,7 @@
 
 buildPythonApplication rec {
   pname = "pantalaimon";
-  version = "0.6.1";
+  version = "0.6.3";
 
   disabled = pythonOlder "3.6";
 
@@ -18,7 +19,7 @@ buildPythonApplication rec {
     owner = "matrix-org";
     repo = pname;
     rev = version;
-    sha256 = "0hn3731jh6xwyjayzdf41skhpdx002qs7n5l7ffh4dplhnv9vbxx";
+    sha256 = "1h1z701sj1qgcqlsk3pnzifnbcg9fshl7v6271h9x54hm3d6hg8a";
   };
 
   propagatedBuildInputs = [
@@ -32,6 +33,7 @@ buildPythonApplication rec {
     matrix-nio
     peewee
     prompt_toolkit
+    setuptools
   ] ++ lib.optional enableDbusUi [
       dbus-python
       notify2

diff --git a/pkgs/applications/networking/instant-messengers/rambox/pro.nix b/pkgs/applications/networking/instant-messengers/rambox/pro.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "rambox-pro";
-  version = "1.3.1";
+  version = "1.3.2";
 
   dontBuild = true;
   dontStrip = true;
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://github.com/ramboxapp/download/releases/download/v${version}/RamboxPro-${version}-linux-x64.tar.gz";
-    sha256 = "1cy4h2yzrpr3gxd16p4323w06i67d82jjlyx737c3ngzw7aahmq1";
+    sha256 = "010v5i8lxfz77cb5cn9va5cbnfa28nzdymk5k2fcpi65jldw1pxx";
   };
 
   installPhase = ''

diff --git a/pkgs/applications/networking/ipfs/default.nix b/pkgs/applications/networking/ipfs/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "ipfs";
-  version = "0.5.1";
+  version = "0.6.0";
   rev = "v${version}";
 
   # go-ipfs makes changes to it's source tarball that don't match the git source.
   src = fetchurl {
     url = "https://github.com/ipfs/go-ipfs/releases/download/${rev}/go-ipfs-source.tar.gz";
-    sha256 = "0lpilycjbc1g9adp4d5kryfprixj18hg3235fnivakmv7fy2akkm";
+    sha256 = "14bgq2j2bjjy0pspy2lsj5dm3w9rmfha0l8kyq5ig86yhc4nzn80";
   };
 
   # tarball contains multiple files/directories

diff --git a/pkgs/applications/networking/mailreaders/mutt/default.nix b/pkgs/applications/networking/mailreaders/mutt/default.nix
@@ -27,11 +27,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "mutt";
-  version = "1.14.3";
+  version = "1.14.4";
 
   src = fetchurl {
     url = "http://ftp.mutt.org/pub/mutt/${pname}-${version}.tar.gz";
-    sha256 = "0wd4cv1c9hqymvml979g607nh3xxmlyx1ifc4r4qf39v6grnsmdi";
+    sha256 = "1hykkq3m7kqic5r7vzg45xaww7415fv5i2d03slzykqb47w5d3na";
   };
 
   patches = optional smimeSupport (fetchpatch {

diff --git a/pkgs/applications/networking/mailreaders/neomutt/default.nix b/pkgs/applications/networking/mailreaders/neomutt/default.nix
@@ -1,18 +1,18 @@
 { stdenv, fetchFromGitHub, gettext, makeWrapper, tcl, which, writeScript
 , ncurses, perl , cyrus_sasl, gss, gpgme, kerberos, libidn, libxml2, notmuch, openssl
-, lmdb, libxslt, docbook_xsl, docbook_xml_dtd_42, mailcap, runtimeShell, sqlite, zlib
+, lmdb, libxslt, docbook_xsl, docbook_xml_dtd_42, elinks, mailcap, runtimeShell, sqlite, zlib
 , glibcLocales
 }:
 
 stdenv.mkDerivation rec {
-  version = "20200501";
+  version = "20200619";
   pname = "neomutt";
 
   src = fetchFromGitHub {
     owner  = "neomutt";
     repo   = "neomutt";
     rev    = version;
-    sha256 = "1xrs2bagrcg489zp7g39l3rrpgz8n1ji9cbr21wrnasfbhqcsmnx";
+    sha256 = "0dhdpd0wdk5bam0q7cvjy4f451ai0mapmyrar7r7m5dnn6lcwvfv";
   };
 
   buildInputs = [
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [
-    docbook_xsl docbook_xml_dtd_42 gettext libxml2 libxslt.bin makeWrapper tcl which zlib
+    docbook_xsl docbook_xml_dtd_42 gettext libxml2 libxslt.bin makeWrapper tcl which zlib elinks
   ];
 
   enableParallelBuilding = true;
@@ -42,12 +42,10 @@ stdenv.mkDerivation rec {
     # and use a far more comprehensive list than the one shipped with neomutt
     substituteInPlace sendlib.c \
       --replace /etc/mime.types ${mailcap}/etc/mime.types
+  '';
 
-    # The string conversion tests all fail with the first version of neomutt
-    # that has tests (20180223) as well as 20180716 so we disable them for now.
-    # I don't know if that is related to the tests or our build environment.
-    # Try again with a later release.
-    sed -i '/rfc2047/d' test/Makefile.autosetup test/main.c
+  preBuild = ''
+    export HOME=$(mktemp -d)
   '';
 
   configureFlags = [
@@ -60,6 +58,9 @@ stdenv.mkDerivation rec {
     "--sasl"
     "--with-homespool=mailbox"
     "--with-mailpath="
+    # To make it not reference .dev outputs. See:
+    # https://github.com/neomutt/neomutt/pull/2367
+    "--disable-include-path-in-cflags"
     # Look in $PATH at runtime, instead of hardcoding /usr/bin/sendmail
     "ac_cv_path_SENDMAIL=sendmail"
     "--zlib"
@@ -80,16 +81,15 @@ stdenv.mkDerivation rec {
     cp -r ${fetchFromGitHub {
       owner = "neomutt";
       repo = "neomutt-test-files";
-      rev = "1ee274e9ae1330fb901eb7b8275b3079d7869222";
-      sha256 = "0dhilz4rr7616jh8jcvh50a3rr09in43nsv72mm6f3vfklcqincp";
+      rev = "8629adab700a75c54e8e28bf05ad092503a98f75";
+      sha256 = "1ci04nqkab9mh60zzm66sd6mhsr6lya8wp92njpbvafc86vvwdlr";
     }} $(pwd)/test-files
+    chmod -R +w test-files
     (cd test-files && ./setup.sh)
 
     export NEOMUTT_TEST_DIR=$(pwd)/test-files
-    export LC_ALL="en_US.UTF-8"
   '';
 
-  checkInputs = [ glibcLocales ];
   checkTarget = "test";
   postCheck = "unset NEOMUTT_TEST_DIR";
 

diff --git a/pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix b/pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix
@@ -1,5 +1,4 @@
 { stdenv, fetchurl, config, makeWrapper
-, gconf
 , alsaLib
 , at-spi2-atk
 , atk
@@ -13,8 +12,6 @@
 , gdk-pixbuf
 , glib
 , glibc
-, gst-plugins-base
-, gstreamer
 , gtk2
 , gtk3
 , kerberos
@@ -30,9 +27,7 @@
 , libXrender
 , libXt
 , libxcb
-, libcanberra-gtk2
-, libgnome
-, libgnomeui
+, libcanberra
 , gnome3
 , libGLU, libGL
 , nspr
@@ -82,7 +77,6 @@ stdenv.mkDerivation {
 
   libPath = stdenv.lib.makeLibraryPath
     [ stdenv.cc.cc
-      gconf
       alsaLib
       at-spi2-atk
       atk
@@ -96,8 +90,6 @@ stdenv.mkDerivation {
       gdk-pixbuf
       glib
       glibc
-      gst-plugins-base
-      gstreamer
       gtk2
       gtk3
       kerberos
@@ -113,9 +105,7 @@ stdenv.mkDerivation {
       libXrender
       libXt
       libxcb
-      libcanberra-gtk2
-      libgnome
-      libgnomeui
+      libcanberra
       libGLU libGL
       nspr
       nss

diff --git a/pkgs/applications/networking/mailreaders/thunderbird/default.nix b/pkgs/applications/networking/mailreaders/thunderbird/default.nix
@@ -18,7 +18,6 @@
 , lib
 , libGL
 , libGLU
-, libIDL
 , libevent
 , libjpeg
 , libnotify
@@ -113,7 +112,6 @@ stdenv.mkDerivation rec {
     jemalloc
     libGL
     libGLU
-    libIDL
     libevent
     libjpeg
     libnotify

diff --git a/pkgs/applications/science/astronomy/gildas/default.nix b/pkgs/applications/science/astronomy/gildas/default.nix
@@ -7,16 +7,16 @@ let
 in
 
 stdenv.mkDerivation rec {
-  srcVersion = "feb20a";
-  version = "20200201_a";
+  srcVersion = "jun20b";
+  version = "20200601_b";
   pname = "gildas";
 
   src = fetchurl {
     # For each new release, the upstream developers of Gildas move the
     # source code of the previous release to a different directory
     urls = [ "http://www.iram.fr/~gildas/dist/gildas-src-${srcVersion}.tar.xz"
       "http://www.iram.fr/~gildas/dist/archive/gildas/gildas-src-${srcVersion}.tar.xz" ];
-    sha256 = "05f34kpi3pfgf4dsyka7mkcln26yzb2mixnnc306krq0isjm7m26";
+    sha256 = "190na9p9kaif4hviraksig6hsq35i1q3nlrm50l00kpj2n8knisk";
   };
 
   nativeBuildInputs = [ pkgconfig groff perl getopt gfortran which ];

diff --git a/pkgs/applications/science/astronomy/gildas/wrapper.patch b/pkgs/applications/science/astronomy/gildas/wrapper.patch
@@ -1,12 +1,13 @@
 diff --new-file -r -u gildas-src-feb17d.orig/admin/wrapper.sh gildas-src-feb17d/admin/wrapper.sh
 --- gildas-src-feb17d.orig/admin/wrapper.sh	1970-01-01 01:00:00.000000000 +0100
 +++ gildas-src-feb17d/admin/wrapper.sh	2017-05-18 21:00:01.660778782 +0200
-@@ -0,0 +1,15 @@
+@@ -0,0 +1,16 @@
 +#!/bin/sh -e
 +
 +export GAG_ROOT_DIR="%%OUT%%"
 +export GAG_PATH="${GAG_ROOT_DIR}/etc"
 +export GAG_EXEC_SYSTEM="libexec"
++export GAG_GAG="${HOME}/.gag"
 +export PYTHONHOME="%%PYTHONHOME%%"
 +if [ -z "\$PYTHONPATH" ]; then
 +  PYTHONPATH="${GAG_ROOT_DIR}/${GAG_EXEC_SYSTEM}/python"

diff --git a/pkgs/applications/science/logic/coq/default.nix b/pkgs/applications/science/logic/coq/default.nix
@@ -35,6 +35,7 @@ let
    "8.11.0" = "1rfdic6mp7acx2zfwz7ziqk12g95bl9nyj68z4n20a5bcjv2pxpn";
    "8.11.1" = "0qriy9dy36dajsv5qmli8gd6v55mah02ya334nw49ky19v7518m0";
    "8.11.2" = "0f77ccyxdgbf1nrj5fa8qvrk1cyfy06fv8gj9kzfvlcgn0cf48sa";
+   "8.12+beta1" = "0jbm8am9j926s0h4fi0cjl95l37l6p7i03spcryyrd4sg5xrddr7";
   }.${version};
   coq-version = stdenv.lib.versions.majorMinor version;
   versionAtLeast = stdenv.lib.versionAtLeast coq-version;

diff --git a/pkgs/applications/science/misc/root/5.nix b/pkgs/applications/science/misc/root/5.nix
@@ -1,31 +1,25 @@
 { stdenv, fetchurl, fetchpatch, cmake, pcre, pkgconfig, python2
-, libX11, libXpm, libXft, libXext, libGLU, libGL, zlib, libxml2, lzma, gsl_1
+, libX11, libXpm, libXft, libXext, libGLU, libGL, zlib, libxml2, lz4, lzma, gsl_1, xxHash
 , Cocoa, OpenGL, noSplash ? false }:
 
 stdenv.mkDerivation rec {
   pname = "root";
-  version = "5.34.36";
+  version = "5.34.38";
 
   src = fetchurl {
     url = "https://root.cern.ch/download/root_v${version}.source.tar.gz";
-    sha256 = "1kbx1jxc0i5xfghpybk8927a0wamxyayij9c74zlqm0595gqx1pw";
+    sha256 = "1ln448lszw4d6jmbdphkr2plwxxlhmjkla48vmmq750xc1lxlfrc";
   };
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ cmake pcre python2 zlib libxml2 lzma gsl_1 ]
+  buildInputs = [ cmake pcre python2 zlib libxml2 lz4 lzma gsl_1 xxHash ]
     ++ stdenv.lib.optionals (!stdenv.isDarwin) [ libX11 libXpm libXft libXext libGLU libGL ]
     ++ stdenv.lib.optionals (stdenv.isDarwin) [ Cocoa OpenGL ]
     ;
 
   patches = [
     ./sw_vers_root5.patch
 
-    (fetchpatch {
-      name = "enable_new_gcc.patch";
-      url = "https://aur.archlinux.org/cgit/aur.git/plain/enable_new_gcc.patch?h=root5&id=91c50876081a0af36f84ec4f0f9dba869107fa4f";
-      sha256 = "1rnp0xlw0yqi7mjs4w145njd79i8kkir1qik7zwicdik9axf8ygm";
-    })
-
     # prevents rootcint from looking in /usr/includes and such
     ./purify_include_paths_root5.patch
 

diff --git a/pkgs/applications/version-management/gitea/default.nix b/pkgs/applications/version-management/gitea/default.nix
@@ -1,6 +1,5 @@
 { stdenv, buildGoPackage, fetchurl, makeWrapper
 , git, bash, gzip, openssh, pam
-, fetchpatch
 , sqliteSupport ? true
 , pamSupport ? true
 }:
@@ -9,11 +8,11 @@ with stdenv.lib;
 
 buildGoPackage rec {
   pname = "gitea";
-  version = "1.11.6";
+  version = "1.12.0";
 
   src = fetchurl {
     url = "https://github.com/go-gitea/gitea/releases/download/v${version}/gitea-src-${version}.tar.gz";
-    sha256 = "11nyq5faq0hy1pi3yhmc6y8is7jyiyfrb162fq9l33pkyw6qihqs";
+    sha256 = "1nsi7d2jackkjvinp5wglrzb61f2hihrn6qgwlp1zb185k2qpd23";
   };
 
   unpackPhase = ''
@@ -25,10 +24,6 @@ buildGoPackage rec {
 
   patches = [
     ./static-root-path.patch
-    (fetchpatch {
-      url = "https://github.com/go-gitea/gitea/commit/1830d0ed5f4a67e3360ecbb55933b5540b6affce.patch";
-      sha256 = "163531pcki28qfs56l64vv4xxaavxgksf038da1sn21j5l2jm81i";
-    })
   ];
 
   postPatch = ''

diff --git a/pkgs/applications/virtualization/cri-o/default.nix b/pkgs/applications/virtualization/cri-o/default.nix
@@ -14,13 +14,13 @@
 
 buildGoModule rec {
   pname = "cri-o";
-  version = "1.18.1";
+  version = "1.18.2";
 
   src = fetchFromGitHub {
     owner = "cri-o";
     repo = "cri-o";
     rev = "v${version}";
-    sha256 = "1fd7ix329kqimysqfh8yl29c0hwrddlirq9bnz95mrllhsgn8kw2";
+    sha256 = "0p6gprbs54v3n09fjpyfxnzxs680ms8924wdim4q9qw52wc6sbdz";
   };
   vendorSha256 = null;
   outputs = [ "out" "man" ];

diff --git a/pkgs/build-support/buildenv/builder.pl b/pkgs/build-support/buildenv/builder.pl
@@ -129,6 +129,15 @@ sub findFiles {
         return;
     }
 
+    # If target already exists and both targets resolves to the same path, skip
+    if (defined $oldTarget && $oldTarget ne "" && abs_path($target) eq abs_path($oldTarget)) {
+        # Prefer the target that is not a symlink, if any
+        if (-l $oldTarget && ! -l $target) {
+            $symlinks{$relName} = [$target, $priority];
+        }
+        return;
+    }
+
     # If target already exists as a symlink to a file (not a
     # directory) in a higher-priority package, skip.
     if (defined $oldTarget && $priority > $oldPriority && $oldTarget ne "" && ! -d $oldTarget) {

diff --git a/pkgs/build-support/docker/examples.nix b/pkgs/build-support/docker/examples.nix
@@ -121,6 +121,7 @@ rec {
       # the image env variable NIX_PAGER.
       pkgs.coreutils
       pkgs.nix
+      pkgs.bash
     ];
     config = {
       Env = [
@@ -313,4 +314,25 @@ rec {
       )
     ];
   };
+
+  nixLayered = pkgs.dockerTools.buildLayeredImageWithNixDb {
+    name = "nix-layered";
+    tag = "latest";
+    contents = [
+      # nix-store uses cat program to display results as specified by
+      # the image env variable NIX_PAGER.
+      pkgs.coreutils
+      pkgs.nix
+      pkgs.bash
+    ];
+    config = {
+      Env = [
+        "NIX_PAGER=cat"
+        # A user is required by nix
+        # https://github.com/NixOS/nix/blob/9348f9291e5d9e4ba3c4347ea1b235640f54fd79/src/libutil/util.cc#L478
+        "USER=nobody"
+      ];
+    };
+  };
+
 }
diff --git a/pkgs/build-support/docker/store-path-to-layer.sh b/pkgs/build-support/docker/store-path-to-layer.sh
@@ -16,7 +16,11 @@ mkdir -p "$layerPath"
 # when there are other things being added to the
 # nix store, tar could fail, saying,
 # "tar: /nix/store: file changed as we read it"
-mkdir -p nix/store
+#
+# In addition, we use `__Nix__` instead of `nix` to avoid renaming
+# relative symlink destinations like
+# /nix/store/...-nix-2.3.4/bin/nix-daemon -> nix
+mkdir -p __Nix__/store
 
 # Then we change into the /nix/store in order to
 # avoid a similar "file changed as we read it" error
@@ -35,8 +39,8 @@ tarhash=$(
       --hard-dereference --sort=name \
       --mtime="@$SOURCE_DATE_EPOCH" \
       --owner=0 --group=0 \
-      --transform 's,^nix$,/\0,' \
-      --transform 's,^nix/store$,/\0,' \
+      --transform 's,^__Nix__$,/nix,' \
+      --transform 's,^__Nix__/store$,/nix/store,' \
       --transform 's,^[^/],/nix/store/\0,rS' |
     tee "$layerPath/layer.tar" |
     tarsum

diff --git a/pkgs/data/misc/hackage/default.nix b/pkgs/data/misc/hackage/default.nix
@@ -1,6 +1,6 @@
 { fetchurl }:
 
 fetchurl {
-  url = "https://github.com/commercialhaskell/all-cabal-hashes/archive/e8df5568f80e6230e29c2381e842db35fe11cd71.tar.gz";
-  sha256 = "1fz4iax88pmlqpb4zp3l6mb6bmkzzha0q6mm3xasabh5yl83dbhy";
+  url = "https://github.com/commercialhaskell/all-cabal-hashes/archive/65a280e01c4f90470959f0423a5450d2831f845a.tar.gz";
+  sha256 = "0m5zg7hswch702gprlfsjmp2xk6hs828c1489d1c85w9kxiyqkdq";
 }
diff --git a/pkgs/desktops/lxqt/pcmanfm-qt/default.nix b/pkgs/desktops/lxqt/pcmanfm-qt/default.nix
@@ -42,6 +42,10 @@ mkDerivation rec {
 
   passthru.updateScript = lxqtUpdateScript { inherit pname version src; };
 
+  postPatch = ''
+    substituteInPlace config/pcmanfm-qt/lxqt/settings.conf.in --replace @LXQT_SHARE_DIR@ /run/current-system/sw/share/lxqt
+  '';
+
   meta = with lib; {
     description = "File manager and desktop icon manager (Qt port of PCManFM and libfm)";
     homepage = "https://github.com/lxqt/pcmanfm-qt";

diff --git a/pkgs/development/compilers/go/1.14.nix b/pkgs/development/compilers/go/1.14.nix
@@ -2,6 +2,7 @@
 , perl, which, pkgconfig, patch, procps, pcre, cacert, Security, Foundation
 , mailcap, runtimeShell
 , buildPackages, pkgsTargetTarget
+, fetchpatch
 }:
 
 let
@@ -30,11 +31,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.14.3";
+  version = "1.14.4";
 
   src = fetchurl {
     url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "0mmgf74snprdiajgh99jjliwjl5im71qcgm5qrxpnyfisiw3f0lk";
+    sha256 = "1105qk2l4kfy1ki9n9gh8j4gfqrfgfwapa1fp38hih9aphxsy4bh";
   };
 
   # perl is used for testing go vet
@@ -137,6 +138,12 @@ stdenv.mkDerivation rec {
     ./go-1.9-skip-flaky-20072.patch
     ./skip-external-network-tests.patch
     ./skip-nohup-tests.patch
+
+    # fix rare TestDontCacheBrokenHTTP2Conn failure
+    (fetchpatch {
+      url = "https://github.com/golang/go/commit/ea1437a8cdf6bb3c2d2447833a5d06dbd75f7ae4.patch";
+      sha256 = "1lyzy4nf8c34a966vw45j3j7hzpvncq2gqspfxffzkyh17xd8sgy";
+    })
   ] ++ [
     # breaks under load: https://github.com/golang/go/issues/25628
     (if stdenv.isAarch32

diff --git a/pkgs/development/compilers/nextpnr/default.nix b/pkgs/development/compilers/nextpnr/default.nix
@@ -14,14 +14,14 @@ let
 in
 with stdenv; mkDerivation rec {
   pname = "nextpnr";
-  version = "2020.03.25";
+  version = "2020.06.12";
 
   srcs = [
     (fetchFromGitHub {
       owner  = "YosysHQ";
       repo   = "nextpnr";
-      rev    = "a3ede0293a50c910e7d96319b2084d50f2501a6b";
-      sha256 = "0ikfjva4gqmlx6y7mjamg03ad7x9gnz32ahqv798ynd87svq10aq";
+      rev    = "c9e7d1448eaa4644d18073316e30586f2cb1d75a";
+      sha256 = "13jyg9d8q9xs1gpb8mz315hcyi3npr4kbfi31x2laz4zmki6ibai";
       name   = "nextpnr";
     })
     (fetchFromGitHub {

diff --git a/pkgs/development/compilers/yosys/default.nix b/pkgs/development/compilers/yosys/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname   = "yosys";
-  version = "2020.06.16";
+  version = "2020.06.19";
 
   src = fetchFromGitHub {
     owner  = "YosysHQ";
     repo   = "yosys";
-    rev    = "39ba90a8b84d740b670a9f1df5148b824d441c63";
-    sha256 = "1ncscbhyq4f07d28l32j37y5d84vyqxfx0fbzhb7nzfhplk8hh0s";
+    rev    = "338ecbe02f8bb3cc4d69de1445c7f398a814b4e4";
+    sha256 = "0j5jwyxrq8rmwpyyidid6yp6g5bq7jwnhmn2ycj82kdj787p9vvs";
   };
 
   enableParallelBuilding = true;

diff --git a/pkgs/development/coq-modules/coquelicot/default.nix b/pkgs/development/coq-modules/coquelicot/default.nix
@@ -3,9 +3,9 @@
 let param =
   if stdenv.lib.versionAtLeast coq.coq-version "8.8"
   then {
-    version = "3.0.3";
-    uid = "38105";
-    sha256 = "0y52lqx1jphv6fwf0d702vzprxmfmxggnh1hy3fznxyl4isfpg4j";
+    version = "3.1.0";
+    uid = "38287";
+    sha256 = "07436wkvnq9jyf7wyhp77bpl157s3qhba1ay5xrkxdi26qdf3h14";
   } else {
     version = "3.0.2";
     uid = "37523";
@@ -37,7 +37,7 @@ stdenv.mkDerivation {
   };
 
   passthru = {
-    compatibleCoqVersions = v: builtins.elem v [ "8.5" "8.6" "8.7" "8.8" "8.9" "8.10" ];
+    compatibleCoqVersions = v: builtins.elem v [ "8.5" "8.6" "8.7" "8.8" "8.9" "8.10" "8.11" "8.12" ];
   };
 
 }
diff --git a/pkgs/development/coq-modules/mathcomp/default.nix b/pkgs/development/coq-modules/mathcomp/default.nix
@@ -76,8 +76,8 @@ let
     };
     # versions of coq compatible with released mathcomp versions
     coq-versions     = {
-      "1.11.0"       = flip elem [ "8.7" "8.8" "8.9" "8.10" "8.11" ];
-      "1.11+beta1"   = flip elem [ "8.7" "8.8" "8.9" "8.10" "8.11" ];
+      "1.11.0"       = flip elem [ "8.7" "8.8" "8.9" "8.10" "8.11" "8.12" ];
+      "1.11+beta1"   = flip elem [ "8.7" "8.8" "8.9" "8.10" "8.11" "8.12" ];
       "1.10.0"       = flip elem [ "8.7" "8.8" "8.9" "8.10" "8.11" ];
       "1.9.0"        = flip elem [ "8.7" "8.8" "8.9" "8.10" ];
       "1.8.0"        = flip elem [ "8.7" "8.8" "8.9" ];

diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
@@ -26,6 +26,12 @@ self: super: {
   # successfully with recent versions of the compiler).
   bin-package-db = null;
 
+  # waiting for release: https://github.com/jwiegley/c2hsc/issues/41
+  c2hsc = appendPatch super.c2hsc (pkgs.fetchpatch {
+    url = "https://github.com/jwiegley/c2hsc/commit/490ecab202e0de7fc995eedf744ad3cb408b53cc.patch";
+    sha256 = "1c7knpvxr7p8c159jkyk6w29653z5yzgjjqj11130bbb8mk9qhq7";
+  });
+
   # Some Hackage packages reference this attribute, which exists only in the
   # GHCJS package set. We provide a dummy version here to fix potential
   # evaluation errors.
@@ -346,7 +352,6 @@ self: super: {
   pwstore-cli = dontCheck super.pwstore-cli;
   quantities = dontCheck super.quantities;
   redis-io = dontCheck super.redis-io;
-  reflex = dontCheck super.reflex; # test suite uses hlint, which has different haskell-src-exts version
   rethinkdb = dontCheck super.rethinkdb;
   Rlang-QQ = dontCheck super.Rlang-QQ;
   safecopy = dontCheck super.safecopy;
@@ -1027,6 +1032,7 @@ self: super: {
   # 2020-06-04: HACK: dontCheck - The test suite attempts to use the network.
   # Should be solved when: https://github.com/dhall-lang/dhall-haskell/issues/1837
   dhall = generateOptparseApplicativeCompletion "dhall" (dontCheck super.dhall);
+  dhall_1_30_0 = dontCheck super.dhall_1_30_0;
 
   dhall-json =
     generateOptparseApplicativeCompletions ["dhall-to-json" "dhall-to-yaml"]
@@ -1045,8 +1051,7 @@ self: super: {
 
   # Generate shell completion.
   cabal2nix = generateOptparseApplicativeCompletion "cabal2nix" super.cabal2nix;
-  stack = generateOptparseApplicativeCompletion "stack" (super.stack.overrideScope (self: super: { http-download = self.http-download_0_2_0_0; }));
-  http-download_0_2_0_0 = dontCheck super.http-download_0_2_0_0;
+  stack = generateOptparseApplicativeCompletion "stack" super.stack;
 
   # musl fixes
   # dontCheck: use of non-standard strptime "%s" which musl doesn't support; only used in test
@@ -1115,8 +1120,12 @@ self: super: {
   # });
   libnix = dontCheck super.libnix;
 
+  # Jailbreak: https://github.com/jaor/xmobar/issues/463
   # The test suite tries to mess with ALSA, which doesn't work in the build sandbox.
-  xmobar = dontCheck super.xmobar;
+  xmobar = appendPatch (dontCheck super.xmobar) (pkgs.fetchpatch {
+    url = "https://github.com/jaor/xmobar/pull/464.patch";
+    sha256 = "0y1dd878yzy1cx0cjj0ijd3dmywr7jdmk68vxdjimxzblrdw1al6";
+  });
 
   # https://github.com/mgajda/json-autotype/issues/25
   json-autotype = dontCheck super.json-autotype;
@@ -1244,9 +1253,6 @@ self: super: {
     ];
   });
 
-  # Needs the corresponding version of haskell-src-exts.
-  haskell-src-exts-simple = super.haskell-src-exts-simple.override { haskell-src-exts = self.haskell-src-exts_1_23_1; };
-
   # https://github.com/Daniel-Diaz/HaTeX/issues/144
   HaTeX = dontCheck super.HaTeX;
 
@@ -1411,11 +1417,6 @@ self: super: {
   # haskell-ci-0.8 needs cabal-install-parsers ==0.1, but we have 0.2.
   haskell-ci = doJailbreak super.haskell-ci;
 
-  # Needs the latest version of vty.
-  matterhorn = super.matterhorn.overrideScope (self: super: {
-    vty = self.vty_5_28_2;
-  });
-
   # Test suite requires database
   persistent-mysql = dontCheck super.persistent-mysql;
   persistent-postgresql = dontCheck super.persistent-postgresql;
@@ -1440,16 +1441,11 @@ self: super: {
     sha256 = "097wqn8hxsr50b9mhndg5pjim5jma2ym4ylpibakmmb5m98n17zp";
   });
 
-  # Needs a version that's newer than LTS-15.x provides.
-  weeder = super.weeder.override { generic-lens = self.generic-lens_2_0_0_0;  };
-
+  # polysemy-plugin 0.2.5.0 has constraint ghc-tcplugins-extra (==0.3.*)
+  # This upstream issue is relevant:
+  # https://github.com/polysemy-research/polysemy/issues/322
   polysemy-plugin = super.polysemy-plugin.override {
-    # polysemy-plugin 0.2.5.0 has constraint ghc-tcplugins-extra (==0.3.*)
-    # This upstream issue is relevant:
-    # https://github.com/polysemy-research/polysemy/issues/322
     ghc-tcplugins-extra = self.ghc-tcplugins-extra_0_3_2;
-    # version of Polysemy the plugin goes with
-    polysemy = self.polysemy_1_3_0_0;
   };
 
   # Test suite requires running a database server. Testing is done upstream.
@@ -1465,38 +1461,9 @@ self: super: {
     sha256 = "0xbfhzhzg94b4r5qy5dg1c40liswwpqarrc2chcwgfbfnrmwkfc2";
   });
 
-  # Depends on selective >= 0.4, but the default of selective is 0.3
-  headed-megaparsec = super.headed-megaparsec.override {
-    selective = self.selective_0_4_1;
-  };
-
-  # Needed for ghcide
-  haskell-lsp_0_22_0_0 = super.haskell-lsp_0_22_0_0.override {
-    haskell-lsp-types = self.haskell-lsp-types_0_22_0_0;
-  };
-
   # this will probably need to get updated with every ghcide update,
   # we need an override because ghcide is tracking haskell-lsp closely.
-  ghcide = dontCheck (super.ghcide.override rec {
-    haskell-lsp-types = self.haskell-lsp-types_0_22_0_0;
-    haskell-lsp = self.haskell-lsp_0_22_0_0;
-    hie-bios = self.hie-bios_0_5_0;
-    ghc-check = self.ghc-check_0_3_0_1;
-  });
-
-  # stackage right now is not new enough for hlint-3.0
-  ghc-lib-parser-ex_8_10_0_13 = super.ghc-lib-parser-ex_8_10_0_13.override {
-    ghc-lib-parser = self.ghc-lib-parser_8_10_1_20200523;
-  };
-
-  hlint = super.hlint.override {
-    ghc-lib-parser = self.ghc-lib-parser_8_10_1_20200523;
-    ghc-lib-parser-ex = self.ghc-lib-parser-ex_8_10_0_13;
-    extra = self.extra_1_7_3;
-    filepattern = self.filepattern.override {
-      extra = self.extra_1_7_3;
-    };
-  };
+  ghcide = dontCheck (super.ghcide.override { ghc-check = self.ghc-check_0_3_0_1; });
 
   # hasn‘t bumped upper bounds
   # upstream: https://github.com/obsidiansystems/which/pull/6
@@ -1506,4 +1473,88 @@ self: super: {
   # through $PATH but they aren't in $PATH
   dhall-lsp-server = dontCheck super.dhall-lsp-server;
 
+  # https://github.com/ocharles/weeder/issues/15
+  weeder = doJailbreak super.weeder;
+
+  # Requested version bump on upstream https://github.com/obsidiansystems/constraints-extras/issues/32
+  constraints-extras = doJailbreak super.constraints-extras;
+  # Requested version bump on upstream https://github.com/srid/rib/issues/160
+  rib = doJailbreak (super.rib.override {
+    dhall = self.dhall_1_30_0;
+  });
+  # Necessary for neuron 0.4.0
+  neuron = super.neuron.override {
+    dhall = self.dhall_1_30_0;
+  };
+
+  # Necessary for stack
+  # x509-validation test suite hangs: upstream https://github.com/vincenthz/hs-certificate/issues/120
+  # tls test suite fails: upstream https://github.com/vincenthz/hs-tls/issues/434
+  x509-validation = dontCheck super.x509-validation;
+  tls = dontCheck super.tls;
+
+  # Upstream PR: https://github.com/bgamari/monoidal-containers/pull/62
+  # Bump these version bound
+  monoidal-containers = appendPatch super.monoidal-containers (pkgs.fetchpatch {
+    url = "https://github.com/bgamari/monoidal-containers/pull/62/commits/715093b22a015398a1390f636be6f39a0de83254.patch";
+    sha256="1lfxvwp8g55ljxvj50acsb0wjhrvp2hvir8y0j5pfjkd1kq628ng";
+  });
+
+  patch = appendPatches super.patch [
+    # Upstream PR: https://github.com/reflex-frp/patch/pull/20
+    # Makes tests work with hlint 3
+    (pkgs.fetchpatch {
+      url = "https://github.com/reflex-frp/patch/pull/20/commits/3ed23a4e4049ee17e64a1a5bbebf1990cdbe033a.patch";
+      sha256 ="1hfa980wln8kzbqw1lr8ddszgcibw25xf12ki2jb9xkl464aynzf";
+    })
+    # Upstream PR: https://github.com/reflex-frp/patch/pull/17
+    # Bumps version dependencies
+    (pkgs.fetchpatch {
+      url = "https://github.com/reflex-frp/patch/pull/17/commits/a191ed9ded708ed7ff0cf53ad6dafaf54db5b95a.patch";
+      sha256 ="1x9w5fimhk3a0l2aa5z91nqaa6s2irz1775iidd0191m6w25vszp";
+    })
+  ];
+
+  reflex = appendPatches super.reflex [
+    # Upstream PR: https://github.com/reflex-frp/reflex/pull/434
+    # Bump version bounds
+    (pkgs.fetchpatch {
+      url = "https://github.com/reflex-frp/reflex/pull/434/commits/e6104bdfd7f664f524b6765275490722e376df4d.patch";
+      sha256 ="1awp5p4640cnhfd50dplsvp0kzy6h8r0hpbw1s40blni74r3dhzr";
+    })
+    # Upstream PR: https://github.com/reflex-frp/reflex/pull/436
+    # Fix build with newest dependent-map version
+    (pkgs.fetchpatch {
+      url = "https://github.com/reflex-frp/reflex/pull/436/commits/dc3bf44d822d70594e3c474fe3869261776c3554.patch";
+      sha256 ="0rbjfj9b8p6zkvd5j4pak5kpgard6cyfvzk750s4xwpc1v84iiqd";
+    })
+    # Upstream PR: https://github.com/reflex-frp/reflex/pull/437
+    # Fix tests with newer dep versions
+    (pkgs.fetchpatch {
+      url = "https://github.com/reflex-frp/reflex/pull/437/commits/87c74a1b9d9098eae8a56148c59ed4963a5232c2.patch";
+      sha256 ="0qhjjgd6n4fms1hpbblny78c95bfh74izhx9dvrdlnhz6q7xlm9q";
+    })
+  ];
+
+  # Tests disabled and broken override needed because of missing lib chrome-test-utils: https://github.com/reflex-frp/reflex-dom/issues/392
+  # Tests disabled because of very old dep: https://github.com/reflex-frp/reflex-dom/issues/393
+  reflex-dom-core = unmarkBroken (dontCheck (appendPatches super.reflex-dom-core [
+    # Upstream PR: https://github.com/reflex-frp/reflex-dom/pull/388
+    # Fix upper bounds
+    (pkgs.fetchpatch {
+      url = "https://github.com/reflex-frp/reflex-dom/pull/388/commits/5ef04d8e478f410d2c63603b84af052c9273a533.patch";
+      sha256 ="0d0b819yh8mqw8ih5asdi9qcca2kmggfsi8gf22akfw1n7xvmavi";
+      stripLen = 2;
+      extraPrefix = "";
+    })
+    # Upstream PR: https://github.com/reflex-frp/reflex-dom/pull/394
+    # Bump dependent-map
+    (pkgs.fetchpatch {
+      url = "https://github.com/reflex-frp/reflex-dom/pull/394/commits/695bd17d5dcdb1bf321ee8858670731637f651db.patch";
+      sha256 ="0llky3i37rakgsw9vqaqmwryv7s91w8ph8xjkh83nxjs14p5zfyk";
+      stripLen = 2;
+      extraPrefix = "";
+    })
+  ]));
+
 } // import ./configuration-tensorflow.nix {inherit pkgs haskellLib;} self super
diff --git a/pkgs/development/haskell-modules/configuration-ghc-8.10.x.nix b/pkgs/development/haskell-modules/configuration-ghc-8.10.x.nix
@@ -62,6 +62,7 @@ self: super: {
 
   # Jailbreak to fix the build.
   async = doJailbreak super.async;
+  base-noprelude = doJailbreak super.base-noprelude;
   ChasingBottoms = doJailbreak super.ChasingBottoms;
   ed25519 = doJailbreak super.ed25519;
   email-validate = doJailbreak super.email-validate;  # https://github.com/Porges/email-validate-hs/issues/51
@@ -84,8 +85,6 @@ self: super: {
   zlib = doJailbreak super.zlib;
 
   # Use the latest version to fix the build.
-  dhall = self.dhall_1_32_0;
-  ghc-lib-parser-ex = self.ghc-lib-parser-ex_8_10_0_4;
   lens = self.lens_4_19_2;
   optics-core = self.optics-core_0_3;
   repline = self.repline_0_3_0_0;
@@ -97,7 +96,7 @@ self: super: {
   # multiple verions of `ghc-lib-parser(-ex)` available, and the default ones
   # are older ones, those older ones will complain. Because we have a newer
   # GHC, we can just set the dependency to `null` as it is not used.
-  ghc-lib-parser-ex_8_10_0_4 = super.ghc-lib-parser-ex_8_10_0_4.override { ghc-lib-parser = null; };
+  ghc-lib-parser-ex = super.ghc-lib-parser-ex.override { ghc-lib-parser = null; };
 
   # Jailbreak to fix the build.
   aeson-diff = doJailbreak super.aeson-diff;
@@ -111,8 +110,6 @@ self: super: {
   serialise = doJailbreak super.serialise;
   setlocale = doJailbreak super.setlocale;
   shellmet = doJailbreak super.shellmet;
-  weeder = doJailbreak super.weeder;    # https://github.com/ocharles/weeder/issues/15
-  xmobar = doJailbreak super.xmobar;
 
   # The shipped Setup.hs file is broken.
   csv = overrideCabal super.csv (drv: { preCompileBuildDriver = "rm Setup.hs"; });

diff --git a/pkgs/development/haskell-modules/configuration-ghc-8.8.x.nix b/pkgs/development/haskell-modules/configuration-ghc-8.8.x.nix
@@ -74,7 +74,6 @@ self: super: {
   # TODO: remove when upstream accepts https://github.com/snapframework/io-streams-haproxy/pull/17
   io-streams-haproxy = doJailbreak super.io-streams-haproxy; # base >=4.5 && <4.13
   snap-server = doJailbreak super.snap-server;
-  xmobar = doJailbreak super.xmobar;
   exact-pi = doJailbreak super.exact-pi;
   time-compat = doJailbreak super.time-compat;
   http-media = doJailbreak super.http-media;