NixOS · Nov 27, 2019 · Mar 12, 2020 · Apr 5, 2020 · Apr 14, 2020 · Apr 15, 2020
diff --git a/nixos/doc/manual/release-notes/rl-2009.xml b/nixos/doc/manual/release-notes/rl-2009.xml
@@ -266,6 +266,25 @@ environment.systemPackages = [
 </programlisting>
     </para>
    </listitem>
+   <listitem>
+    <para>
+     The httpd web server previously started its main process as root
+     privileged, then ran worker processes as a less privileged identity user.
+     This was changed to start all of httpd as a less privileged user (defined by
+     <xref linkend="opt-services.httpd.user"/> and
+     <xref linkend="opt-services.httpd.group"/>). As a consequence, all files that
+     are needed for httpd to run (included configuration fragments, SSL
+     certificates and keys, etc.) must now be readable by this less privileged
+     user/group.
+    </para>
+    <para>
+     The default value for <xref linkend="opt-services.httpd.mpm"/>
+     has been changed from <literal>prefork</literal> to <literal>event</literal>. Along with
+     this change the default value for
+     <link linkend="opt-services.httpd.virtualHosts">services.httpd.virtualHosts.&lt;name&gt;.http2</link>
+     has been set to <literal>true</literal>.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 

diff --git a/nixos/modules/i18n/input-method/ibus.nix b/nixos/modules/i18n/input-method/ibus.nix
@@ -64,7 +64,7 @@ in
     # Without dconf enabled it is impossible to use IBus
     programs.dconf.enable = true;
 
-    programs.dconf.packages = [ ibusPackage ];
+    programs.dconf.profiles.ibus = "${ibusPackage}/etc/dconf/profile/ibus";
 
     services.dbus.packages = [
       ibusAutostart

diff --git a/nixos/modules/profiles/docker-container.nix b/nixos/modules/profiles/docker-container.nix
@@ -2,6 +2,8 @@
 
 with lib;
 
+let inherit (pkgs) writeScript; in
+
 let
  pkgs2storeContents = l : map (x: { object = x; symlink = "none"; }) l;
 
@@ -30,7 +32,12 @@ in {
     ];
 
     # Some container managers like lxc need these
-    extraCommands = "mkdir -p proc sys dev";
+    extraCommands =
+      let script = writeScript "extra-commands.sh" ''
+            rm etc
+            mkdir -p proc sys dev etc
+          '';
+      in script;
   };
 
   boot.isContainer = true;

diff --git a/nixos/modules/programs/dconf.nix b/nixos/modules/programs/dconf.nix
@@ -4,24 +4,13 @@ with lib;
 
 let
   cfg = config.programs.dconf;
-  cfgDir = pkgs.symlinkJoin {
-    name = "dconf-system-config";
-    paths = map (x: "${x}/etc/dconf") cfg.packages;
-    postBuild = ''
-      mkdir -p $out/profile
-      mkdir -p $out/db
-    '' + (
-      concatStringsSep "\n" (
-        mapAttrsToList (
-          name: path: ''
-            ln -s ${path} $out/profile/${name}
-          ''
-        ) cfg.profiles
-      )
-    ) + ''
-      ${pkgs.dconf}/bin/dconf update $out/db
-    '';
-  };
+
+  mkDconfProfile = name: path:
+    {
+      name = "dconf/profile/${name}";
+      value.source = path; 
+    };
+
 in
 {
   ###### interface
@@ -33,22 +22,18 @@ in
       profiles = mkOption {
         type = types.attrsOf types.path;
         default = {};
-        description = "Set of dconf profile files, installed at <filename>/etc/dconf/profiles/<replaceable>name</replaceable></filename>.";
+        description = "Set of dconf profile files.";
         internal = true;
       };
 
-      packages = mkOption {
-        type = types.listOf types.package;
-        default = [];
-        description = "A list of packages which provide dconf profiles and databases in <filename>/etc/dconf</filename>.";
-      };
     };
   };
 
   ###### implementation
 
   config = mkIf (cfg.profiles != {} || cfg.enable) {
-    environment.etc.dconf.source = mkIf (cfg.profiles != {} || cfg.packages != []) cfgDir;
+    environment.etc = optionalAttrs (cfg.profiles != {})
+      (mapAttrs' mkDconfProfile cfg.profiles);
 
     services.dbus.packages = [ pkgs.dconf ];
 

diff --git a/nixos/modules/services/cluster/k3s/default.nix b/nixos/modules/services/cluster/k3s/default.nix
@@ -81,8 +81,8 @@ in
       after = mkIf cfg.docker [ "docker.service" ];
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
-        # Taken from https://github.com/rancher/k3s/blob/v1.17.4+k3s1/contrib/ansible/roles/k3s/node/templates/k3s.service.j2
-        Type = "notify";
+        # See: https://github.com/rancher/k3s/blob/dddbd16305284ae4bd14c0aade892412310d7edc/install.sh#L197
+        Type = if cfg.role == "agent" then "exec" else "notify";
         KillMode = "process";
         Delegate = "yes";
         Restart = "always";

diff --git a/nixos/modules/services/system/nscd.nix b/nixos/modules/services/system/nscd.nix
@@ -24,7 +24,11 @@ in
       enable = mkOption {
         type = types.bool;
         default = true;
-        description = "Whether to enable the Name Service Cache Daemon.";
+        description = ''
+          Whether to enable the Name Service Cache Daemon.
+          Disabling this is strongly discouraged, as this effectively disables NSS Lookups
+          from all non-glibc NSS modules, including the ones provided by systemd.
+        '';
       };
 
       config = mkOption {

diff --git a/nixos/modules/services/web-servers/apache-httpd/default.nix b/nixos/modules/services/web-servers/apache-httpd/default.nix
@@ -41,9 +41,9 @@ let
       "mime" "autoindex" "negotiation" "dir"
       "alias" "rewrite"
       "unixd" "slotmem_shm" "socache_shmcb"
-      "mpm_${cfg.multiProcessingModule}"
+      "mpm_${cfg.mpm}"
     ]
-    ++ (if cfg.multiProcessingModule == "prefork" then [ "cgi" ] else [ "cgid" ])
+    ++ (if cfg.mpm == "prefork" then [ "cgi" ] else [ "cgid" ])
     ++ optional enableHttp2 "http2"
     ++ optional enableSSL "ssl"
     ++ optional enableUserDir "userdir"
@@ -264,7 +264,7 @@ let
 
     PidFile ${runtimeDir}/httpd.pid
 
-    ${optionalString (cfg.multiProcessingModule != "prefork") ''
+    ${optionalString (cfg.mpm != "prefork") ''
       # mod_cgid requires this.
       ScriptSock ${runtimeDir}/cgisock
     ''}
@@ -350,6 +350,7 @@ in
   imports = [
     (mkRemovedOptionModule [ "services" "httpd" "extraSubservices" ] "Most existing subservices have been ported to the NixOS module system. Please update your configuration accordingly.")
     (mkRemovedOptionModule [ "services" "httpd" "stateDir" ] "The httpd module now uses /run/httpd as a runtime directory.")
+    (mkRenamedOptionModule [ "services" "httpd" "multiProcessingModule" ] [ "services" "httpd" "mpm" ])
 
     # virtualHosts options
     (mkRemovedOptionModule [ "services" "httpd" "documentRoot" ] "Please define a virtual host using `services.httpd.virtualHosts`.")
@@ -454,15 +455,21 @@ in
         type = types.str;
         default = "wwwrun";
         description = ''
-          User account under which httpd runs.
+          User account under which httpd children processes run.
+
+          If you require the main httpd process to run as
+          <literal>root</literal> add the following configuration:
+          <programlisting>
+          systemd.services.httpd.serviceConfig.User = lib.mkForce "root";
+          </programlisting>
         '';
       };
 
       group = mkOption {
         type = types.str;
         default = "wwwrun";
         description = ''
-          Group under which httpd runs.
+          Group under which httpd children processes run.
         '';
       };
 
@@ -539,20 +546,19 @@ in
         '';
       };
 
-      multiProcessingModule = mkOption {
+      mpm = mkOption {
         type = types.enum [ "event" "prefork" "worker" ];
-        default = "prefork";
+        default = "event";
         example = "worker";
         description =
           ''
             Multi-processing module to be used by Apache. Available
-            modules are <literal>prefork</literal> (the default;
-            handles each request in a separate child process),
-            <literal>worker</literal> (hybrid approach that starts a
-            number of child processes each running a number of
-            threads) and <literal>event</literal> (a recent variant of
-            <literal>worker</literal> that handles persistent
-            connections more efficiently).
+            modules are <literal>prefork</literal> (handles each
+            request in a separate child process), <literal>worker</literal>
+            (hybrid approach that starts a number of child processes
+            each running a number of threads) and <literal>event</literal>
+            (the default; a recent variant of <literal>worker</literal>
+            that handles persistent connections more efficiently).
           '';
       };
 
@@ -652,7 +658,7 @@ in
     services.httpd.phpOptions =
       ''
         ; Needed for PHP's mail() function.
-        sendmail_path = sendmail -t -i
+        sendmail_path = ${pkgs.system-sendmail}/bin/sendmail -t -i
 
         ; Don't advertise PHP
         expose_php = off
@@ -703,9 +709,7 @@ in
         wants = concatLists (map (hostOpts: [ "acme-${hostOpts.hostName}.service" "acme-selfsigned-${hostOpts.hostName}.service" ]) vhostsACME);
         after = [ "network.target" "fs.target" ] ++ map (hostOpts: "acme-selfsigned-${hostOpts.hostName}.service") vhostsACME;
 
-        path =
-          [ pkg pkgs.coreutils pkgs.gnugrep ]
-          ++ optional cfg.enablePHP pkgs.system-sendmail; # Needed for PHP's mail() function.
+        path = [ pkg pkgs.coreutils pkgs.gnugrep ];
 
         environment =
           optionalAttrs cfg.enablePHP { PHPRC = phpIni; }
@@ -725,14 +729,15 @@ in
           ExecStart = "@${pkg}/bin/httpd httpd -f ${httpdConf}";
           ExecStop = "${pkg}/bin/httpd -f ${httpdConf} -k graceful-stop";
           ExecReload = "${pkg}/bin/httpd -f ${httpdConf} -k graceful";
-          User = "root";
+          User = cfg.user;
           Group = cfg.group;
           Type = "forking";
           PIDFile = "${runtimeDir}/httpd.pid";
           Restart = "always";
           RestartSec = "5s";
           RuntimeDirectory = "httpd httpd/runtime";
           RuntimeDirectoryMode = "0750";
+          AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
         };
       };
 

diff --git a/nixos/modules/services/web-servers/apache-httpd/vhost-options.nix b/nixos/modules/services/web-servers/apache-httpd/vhost-options.nix
@@ -137,7 +137,7 @@ in
 
     http2 = mkOption {
       type = types.bool;
-      default = false;
+      default = true;
       description = ''
         Whether to enable HTTP 2. HTTP/2 is supported in all multi-processing modules that come with httpd. <emphasis>However, if you use the prefork mpm, there will
         be severe restrictions.</emphasis> Refer to <link xlink:href="https://httpd.apache.org/docs/2.4/howto/http2.html#mpm-config"/> for details.

diff --git a/nixos/modules/virtualisation/ec2-amis.nix b/nixos/modules/virtualisation/ec2-amis.nix
@@ -291,21 +291,24 @@ let self = {
   "19.03".sa-east-1.hvm-ebs = "ami-0c6a43c6e0ad1f4e2";
   "19.03".ap-south-1.hvm-ebs = "ami-0303deb1b5890f878";
 
-  # 19.09.981.205691b7cbe
-  "19.09".eu-west-1.hvm-ebs = "ami-0ebd3156e21e9642f";
-  "19.09".eu-west-2.hvm-ebs = "ami-02a2b5480a79084b7";
-  "19.09".eu-west-3.hvm-ebs = "ami-09aa175c7588734f7";
-  "19.09".eu-central-1.hvm-ebs = "ami-00a7fafd7e237a330";
-  "19.09".us-east-1.hvm-ebs = "ami-00a8eeaf232a74f84";
-  "19.09".us-east-2.hvm-ebs = "ami-093efd3a57a1e03a8";
-  "19.09".us-west-1.hvm-ebs = "ami-0913e9a2b677fac30";
-  "19.09".us-west-2.hvm-ebs = "ami-02d9a19f77b47882a";
-  "19.09".ca-central-1.hvm-ebs = "ami-0627dd3f7b3627a29";
-  "19.09".ap-southeast-1.hvm-ebs = "ami-083614e4d08f2164d";
-  "19.09".ap-southeast-2.hvm-ebs = "ami-0048c704185ded6dc";
-  "19.09".ap-northeast-1.hvm-ebs = "ami-0329e7fc2d7f60bd0";
-  "19.09".ap-northeast-2.hvm-ebs = "ami-03d4ae7d0b5fc364f";
-  "19.09".ap-south-1.hvm-ebs = "ami-0b599690b35aeef23";
+  # 19.09.2243.84af403f54f
+  "19.09".eu-west-1.hvm-ebs = "ami-071082f0fa035374f";
+  "19.09".eu-west-2.hvm-ebs = "ami-0d9dc33c54d1dc4c3";
+  "19.09".eu-west-3.hvm-ebs = "ami-09566799591d1bfed";
+  "19.09".eu-central-1.hvm-ebs = "ami-015f8efc2be419b79";
+  "19.09".eu-north-1.hvm-ebs = "ami-07fc0a32d885e01ed";
+  "19.09".us-east-1.hvm-ebs = "ami-03330d8b51287412f";
+  "19.09".us-east-2.hvm-ebs = "ami-0518b4c84972e967f";
+  "19.09".us-west-1.hvm-ebs = "ami-06ad07e61a353b4a6";
+  "19.09".us-west-2.hvm-ebs = "ami-0e31e30925cf3ce4e";
+  "19.09".ca-central-1.hvm-ebs = "ami-07df50fc76702a36d";
+  "19.09".ap-southeast-1.hvm-ebs = "ami-0f71ae5d4b0b78d95";
+  "19.09".ap-southeast-2.hvm-ebs = "ami-057bbf2b4bd62d210";
+  "19.09".ap-northeast-1.hvm-ebs = "ami-02a62555ca182fb5b";
+  "19.09".ap-northeast-2.hvm-ebs = "ami-0219dde0e6b7b7b93";
+  "19.09".ap-south-1.hvm-ebs = "ami-066f7f2a895c821a1";
+  "19.09".ap-east-1.hvm-ebs = "ami-055b2348db2827ff1";
+  "19.09".sa-east-1.hvm-ebs = "ami-018aab68377227e06";
 
   latest = self."19.09";
 }; in self
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
@@ -287,6 +287,7 @@ in
   snapper = handleTest ./snapper.nix {};
   solr = handleTest ./solr.nix {};
   spacecookie = handleTest ./spacecookie.nix {};
+  spike = handleTest ./spike.nix {};
   sonarr = handleTest ./sonarr.nix {};
   strongswan-swanctl = handleTest ./strongswan-swanctl.nix {};
   sudo = handleTest ./sudo.nix {};

diff --git a/nixos/tests/installed-tests/ibus.nix b/nixos/tests/installed-tests/ibus.nix
@@ -5,12 +5,16 @@ makeInstalledTest {
 
   testConfig = {
     i18n.inputMethod.enabled = "ibus";
-    systemd.user.services.ibus-daemon = {
-      serviceConfig.ExecStart = "${pkgs.ibus}/bin/ibus-daemon --xim --verbose";
-      wantedBy = [ "graphical-session.target" ];
-      partOf = [ "graphical-session.target" ];
-    };
   };
 
+  preTestScript = ''
+    # ibus has ibus-desktop-testing-runner but it tries to manage desktop session so we just spawn ibus-daemon ourselves
+    machine.succeed("ibus-daemon --daemonize --verbose")
+  '';
+
   withX11 = true;
+
+  # TODO: ibus-daemon is currently crashing or something
+  # maybe make ibus systemd service that auto-restarts?
+  meta.broken = true;
 }
diff --git a/pkgs/applications/audio/clementine/default.nix b/pkgs/applications/audio/clementine/default.nix
@@ -91,7 +91,7 @@ let
     '';
 
     meta = with stdenv.lib; {
-      homepage = "http://www.clementine-player.org";
+      homepage = "https://www.clementine-player.org";
       description = "A multiplatform music player";
       license = licenses.gpl3Plus;
       platforms = platforms.linux;
@@ -130,7 +130,7 @@ let
     '';
     enableParallelBuilding = true;
     meta = with stdenv.lib; {
-      homepage = "http://www.clementine-player.org";
+      homepage = "https://www.clementine-player.org";
       description = "Spotify integration for Clementine";
       # The blob itself is Apache-licensed, although libspotify is unfree.
       license = licenses.asl20;

diff --git a/pkgs/applications/editors/android-studio/default.nix b/pkgs/applications/editors/android-studio/default.nix
@@ -13,14 +13,14 @@ let
     sha256Hash = "0apxmp341m7mbpm2df3qvsbaifwy6yqq746kbhbwlw8bn9hrzv1k";
   };
   betaVersion = {
-    version = "4.0.0.13"; # "Android Studio 4.0 Beta 4"
-    build = "193.6348893";
-    sha256Hash = "0lchi3l50826n1af1z24yclpf27v2q5p1zjbvcmn37wz46d4s4g2";
+    version = "4.0.0.14"; # "Android Studio 4.0 Beta 5"
+    build = "193.6401094";
+    sha256Hash = "11fmpf58z44i78ldkapzivz6md65744vqczzbwv8mkjkv9nz95rs";
   };
   latestVersion = { # canary & dev
-    version = "4.1.0.6"; # "Android Studio 4.1 Canary 6"
-    build = "193.6381907";
-    sha256Hash = "0sa5plr96m90wv5hi9bqwa11j6k8k9wa0ji8qmlimdhnpyzhsdrx";
+    version = "4.1.0.7"; # "Android Studio 4.1 Canary 7"
+    build = "193.6401718";
+    sha256Hash = "1xa61rhi7dgxm0y6yl5dxd09x530mzyxvx9bp1jprzfwvc7s0byh";
   };
 in {
   # Attributes are named by their corresponding release channels

diff --git a/pkgs/applications/editors/typora/default.nix b/pkgs/applications/editors/typora/default.nix
@@ -62,7 +62,7 @@ stdenv.mkDerivation rec {
     description = "A minimal Markdown reading & writing app";
     homepage = "https://typora.io";
     license = licenses.unfree;
-    maintainers = with maintainers; [ jensbin worldofpeace ];
+    maintainers = with maintainers; [ jensbin ];
     platforms = [ "x86_64-linux"];
   };
 }
diff --git a/pkgs/applications/misc/dmenu/wayland.nix b/pkgs/applications/misc/dmenu/wayland.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dmenu-wayland-unstable";
-  version = "2020-02-28";
+  version = "2020-04-03";
 
   src = fetchFromGitHub {
     owner = "nyyManni";
     repo = "dmenu-wayland";
-    rev = "68e08e8bcde10a10ac3290431f173c6c7fce4238";
-    sha256 = "10b1v2brgpgb6wkzn62haj56zmkf3aq6fs3p9rp6bxiw8bs2nvlm";
+    rev = "550a7c39f3f925b803d51c616609c8cb6c0ea543";
+    sha256 = "0az3w1csn4x6mjyacg6lf70kykdfqamic3hbr57mj83i5jjv0jlv";
   };
 
   outputs = [ "out" "man" ];

diff --git a/pkgs/applications/misc/playonlinux/default.nix b/pkgs/applications/misc/playonlinux/default.nix
@@ -9,7 +9,7 @@
 , imagemagick
 , netcat-gnu
 , p7zip
-, python2Packages
+, python2
 , unzip
 , wget
 , wine
@@ -27,25 +27,25 @@
 let
   version = "4.3.4";
 
-  binpath = stdenv.lib.makeBinPath
-    [ cabextract
-      python2Packages.python
-      gettext
-      glxinfo
-      gnupg
-      icoutils
-      imagemagick
-      netcat-gnu
-      p7zip
-      unzip
-      wget
-      wine
-      xdg-user-dirs
-      xterm
-      which
-      curl
-      jq
-    ];
+  binpath = stdenv.lib.makeBinPath [ 
+    cabextract
+    python
+    gettext
+    glxinfo
+    gnupg
+    icoutils
+    imagemagick
+    netcat-gnu
+    p7zip
+    unzip
+    wget
+    wine
+    xdg-user-dirs
+    xterm
+    which
+    curl
+    jq
+  ];
 
   ld32 =
     if stdenv.hostPlatform.system == "x86_64-linux" then "${stdenv.cc}/nix-support/dynamic-linker-m32"
@@ -54,6 +54,11 @@ let
   ld64 = "${stdenv.cc}/nix-support/dynamic-linker";
   libs = pkgs: stdenv.lib.makeLibraryPath [ xorg.libX11 libGL ];
 
+  python = python2.withPackages(ps: with ps; [
+    wxPython
+    setuptools
+  ]);
+
 in stdenv.mkDerivation {
   pname = "playonlinux";
   inherit version;
@@ -65,15 +70,13 @@ in stdenv.mkDerivation {
 
   nativeBuildInputs = [ makeWrapper ];
 
-  buildInputs =
-    [ python2Packages.python
-      python2Packages.wxPython
-      python2Packages.setuptools
-      xorg.libX11
-      libGL
-    ];
+  buildInputs = [ 
+    xorg.libX11
+    libGL
+    python
+  ];
 
-  patchPhase = ''
+  postPatch = ''
     patchShebangs python tests/python
     sed -i "s/ %F//g" etc/PlayOnLinux.desktop
   '';
@@ -85,7 +88,6 @@ in stdenv.mkDerivation {
     install -D -m644 etc/PlayOnLinux.desktop $out/share/applications/playonlinux.desktop
 
     makeWrapper $out/share/playonlinux/playonlinux $out/bin/playonlinux \
-      --prefix PYTHONPATH : $PYTHONPATH:$(toPythonPath "$out") \
       --prefix PATH : ${binpath}
 
     bunzip2 $out/share/playonlinux/bin/check_dd_x86.bz2

diff --git a/pkgs/applications/networking/instant-messengers/jackline/default.nix b/pkgs/applications/networking/instant-messengers/jackline/default.nix
@@ -4,19 +4,19 @@ assert stdenv.lib.versionAtLeast ocamlPackages.ocaml.version "4.07";
 
 stdenv.mkDerivation {
   pname = "jackline";
-  version = "unstable-2020-03-22";
+  version = "unstable-2020-04-24";
 
   src = fetchFromGitHub {
     owner  = "hannesm";
     repo   = "jackline";
-    rev    = "52f84525c74c43e8d03fb1e6ff025ccb2699e4aa";
-    sha256 = "0wir573ah1w16xzdn9rfwk3569zq4ff5frp0ywq70va4gdlb679c";
+    rev    = "885b97b90d565f5f7c2b5f66f5edf14a82251b87";
+    sha256 = "1mdn413ya2g0a1mrdbh1b65gnygrxb08k99z5lmidhh34kd1llsj";
   };
 
   buildInputs = with ocamlPackages; [
                   ocaml ocamlbuild findlib topkg ppx_sexp_conv ppx_deriving
                   erm_xmpp tls mirage-crypto mirage-crypto-pk x509 domain-name
-                  ocaml_lwt otr astring ptime mtime notty sexplib hex uutf
+                  ocaml_lwt otr astring ptime notty sexplib hex uutf
                   dns-client base64
                 ];
 

diff --git a/pkgs/applications/networking/instant-messengers/rambox/default.nix b/pkgs/applications/networking/instant-messengers/rambox/default.nix
@@ -41,7 +41,7 @@ in stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Free and Open Source messaging and emailing app that combines common web applications into one";
-    homepage = "http://rambox.pro";
+    homepage = "https://rambox.pro";
     license = licenses.mit;
     maintainers = with maintainers; [ gnidorah ma27 ];
     platforms = ["i686-linux" "x86_64-linux"];

diff --git a/pkgs/applications/networking/msmtp/default.nix b/pkgs/applications/networking/msmtp/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, fetchpatch, autoreconfHook, pkgconfig, texinfo
+{ stdenv, lib, fetchurl, autoreconfHook, pkgconfig, texinfo
 , netcat-gnu, gnutls, gsasl, libidn2, Security
 , withKeyring ? true, libsecret ? null
 , systemd ? null }:
@@ -9,20 +9,15 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "msmtp";
-  version = "1.8.8";
+  version = "1.8.10";
 
   src = fetchurl {
     url = "https://marlam.de/${pname}/releases/${pname}-${version}.tar.xz";
-    sha256 = "1rarck61mz3mwg0l30vjj6j9fq6gc7gic0r1c1ppwpq2izj57jzc";
+    sha256 = "041g921rdjiv8bapp61gp4rylq8cckfkcwzyh8bs7xwxs4wpzfna";
   };
 
-  # the 2nd patch should go when 1.8.9 is released
   patches = [
     ./paths.patch
-    (fetchpatch {
-      url = "https://github.com/marlam/msmtp-mirror/commit/c78f24347ec996c7a3830b48403bf3736afca071.patch";
-      sha256 = "0d4sc2f5838jriv65wahpgvwckkzqhdk3hs660fyg80si2i0l1bx";
-    })
   ];
 
   buildInputs = [ gnutls gsasl libidn2 ]

diff --git a/pkgs/applications/office/gnucash/default.nix b/pkgs/applications/office/gnucash/default.nix
@@ -25,11 +25,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gnucash";
-  version = "3.9";
+  version = "3.10";
 
   src = fetchurl {
     url = "mirror://sourceforge/gnucash/${pname}-${version}.tar.bz2";
-    sha256 = "1zxrgrjbs13vgr002rvl734w9f7zzxfq4xxmyhj777dwgkfds0ld";
+    sha256 = "05kgg7mhizndwn7icnarqk3c19xrzfawf90y9nb3jdm6fv1741xn";
   };
 
   nativeBuildInputs = [ pkgconfig makeWrapper cmake gtest ];
@@ -69,7 +69,6 @@ stdenv.mkDerivation rec {
   '';
 
   # TODO: The following tests FAILED:
-  #   61 - test-gnc-timezone (Failed)
   #   70 - test-load-c (Failed)
   #   71 - test-modsysver (Failed)
   #   72 - test-incompatdep (Failed)

diff --git a/pkgs/applications/office/scribus/unstable.nix b/pkgs/applications/office/scribus/unstable.nix
@@ -116,7 +116,7 @@ mkDerivation rec {
     ];
     platforms = platforms.linux;
     description = "Desktop Publishing (DTP) and Layout program for Linux";
-    homepage = "http://www.scribus.net";
+    homepage = "https://www.scribus.net";
     # There are a lot of licenses... https://github.com/scribusproject/scribus/blob/20508d69ca4fc7030477db8dee79fd1e012b52d2/COPYING#L15-L19
     license = with licenses; [
       bsd3

diff --git a/pkgs/applications/science/misc/rink/default.nix b/pkgs/applications/science/misc/rink/default.nix
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage rec {
 
   meta = with stdenv.lib; {
     description = "Unit-aware calculator";
-    homepage = "http://rink.tiffnix.com";
+    homepage = "https://rink.tiffnix.com";
     license = with licenses; [ mpl20 gpl3 ];
     maintainers = with maintainers; [ sb0 filalex77 ];
   };

diff --git a/pkgs/applications/science/misc/snakemake/default.nix b/pkgs/applications/science/misc/snakemake/default.nix
@@ -2,7 +2,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "snakemake";
-  version = "5.13.0";
+  version = "5.15.0";
 
   propagatedBuildInputs = with python3Packages; [
     appdirs
@@ -22,13 +22,13 @@ python3Packages.buildPythonApplication rec {
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "11snr7sgv70d3y63s5svijfx8f4xpggh96g8chr6lccl4mi1s9x9";
+    sha256 = "10cd1k5vg8ra5fnpqpdbl04qwx6h2mmmqbn71pl8j69w9110dkys";
   };
 
   doCheck = false; # Tests depend on Google Cloud credentials at ${HOME}/gcloud-service-key.json
 
   meta = with stdenv.lib; {
-    homepage = "http://snakemake.bitbucket.io";
+    homepage = "https://snakemake.readthedocs.io";
     license = licenses.mit;
     description = "Python-based execution environment for make-like workflows";
     longDescription = ''

diff --git a/pkgs/applications/science/robotics/mavproxy/default.nix b/pkgs/applications/science/robotics/mavproxy/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonApplication rec {
   pname = "MAVProxy";
-  version = "1.8.18";
+  version = "1.8.19";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1fi4m3591wws5cq43q8aljf91mzs6i9yhn9rimhpfrskbyf9knvm";
+    sha256 = "1rbq2nm01212rp5xbl8p8kjl2mpgfppkwjsq3lnfw1v6g0m4359h";
   };
 
   propagatedBuildInputs = [

diff --git a/pkgs/applications/version-management/arch/default.nix b/pkgs/applications/version-management/arch/default.nix
@@ -1,18 +1,19 @@
 { stdenv, fetchurl, which, diffutils, gnupatch, gnutar }:
 
 stdenv.mkDerivation rec {
-  name = "tla-1.3.5";
-
+  pname = "tla";
+  version = "1.3.5";
+
   src = fetchurl {
-    url = "ftp://ftp.gnu.org/old-gnu/gnu-arch/" + name + ".tar.gz";
+    url = "https://ftp.gnu.org/old-gnu/gnu-arch/tla-${version}.tar.gz";
     sha256 = "01mfzj1i6p4s8191cgd5850hds1zls88hkf9rb6qx1vqjv585aj0";
   };
 
   patches = [ ./configure-tmpdir.patch ];
 
-  buildInputs = [which];
-  
-  propagatedBuildInputs = [diffutils gnupatch gnutar];
+  buildInputs = [ which ];
+
+  propagatedBuildInputs = [ diffutils gnupatch gnutar ];
 
   # Instead of GNU Autoconf, tla uses Tom Lord's now
   # defunct `package-framework'.

diff --git a/pkgs/applications/video/obs-studio/0001-find-ObsPluginHelpers.cmake-in-the-obs-src.patch b/pkgs/applications/video/obs-studio/0001-find-ObsPluginHelpers.cmake-in-the-obs-src.patch
diff --git a/pkgs/applications/video/obs-studio/v4l2sink.nix b/pkgs/applications/video/obs-studio/v4l2sink.nix
@@ -1,42 +1,55 @@
-{ stdenv, fetchFromGitHub
-, cmake, pkgconfig, wrapQtAppsHook
-, obs-studio }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, cmake
+, qtbase
+, obs-studio
+}:
 
-stdenv.mkDerivation {
-  pname = "obs-v4l2sink-unstable";
-  version = "20181012";
+stdenv.mkDerivation rec {
+  pname = "obs-v4l2sink";
+  version = "0.1.0";
 
   src = fetchFromGitHub {
     owner = "CatxFish";
     repo = "obs-v4l2sink";
-    rev = "1ec3c8ada0e1040d867ce567f177be55cd278378";
-    sha256 = "03ah91cm1qz26k90mfx51l0d598i9bcmw39lkikjs1msm4c9dfxx";
+    rev = version;
+    sha256 = "0l4lavaywih5lzwgxcbnvdrxhpvkrmh56li06s3aryikngxwsk3z";
   };
 
-  nativeBuildInputs = [ cmake pkgconfig wrapQtAppsHook ];
-  buildInputs = [ obs-studio ];
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ qtbase obs-studio ];
 
   patches = [
-    ./0001-find-ObsPluginHelpers.cmake-in-the-obs-src.patch
+    # Fixes the segfault when stopping the plugin
+    (fetchpatch {
+      url = "https://github.com/CatxFish/obs-v4l2sink/commit/6604f01796d1b84a95714730ea51a6b8ac0e450b.diff";
+      sha256 = "0crcvw02dj0aqy7hnhizjdsnhiw03zmg6cbdkasxz2mrrbyc3s88";
+    })
   ];
 
-  cmakeFlags = [
-    "-DLIBOBS_INCLUDE_DIR=${obs-studio}/include/obs"
-    "-DLIBOBS_LIBRARIES=${obs-studio}/lib"
-    "-DCMAKE_CXX_FLAGS=-I${obs-studio.src}/UI/obs-frontend-api"
-    "-DOBS_SRC=${obs-studio.src}"
+  cmakeFlags = with lib; [
+    "-DLIBOBS_INCLUDE_DIR=${obs-studio.src}/libobs"
   ];
 
-  installPhase = ''
-    mkdir -p $out/share/obs/obs-plugins/v4l2sink/bin/64bit
-    cp ./v4l2sink.so $out/share/obs/obs-plugins/v4l2sink/bin/64bit/
+  # obs-studio expects the shared object to be located in bin/32bit or bin/64bit
+  # https://github.com/obsproject/obs-studio/blob/d60c736cb0ec0491013293c8a483d3a6573165cb/libobs/obs-nix.c#L48
+  postInstall = let
+    pluginPath = {
+      i686-linux = "bin/32bit";
+      x86_64-linux = "bin/64bit";
+    }.${stdenv.targetPlatform.system} or (throw "Unsupported system: ${stdenv.targetPlatform.system}");
+  in ''
+    mkdir -p $out/share/obs/obs-plugins/v4l2sink/${pluginPath}
+    ln -s $out/lib/obs-plugins/v4l2sink.so $out/share/obs/obs-plugins/v4l2sink/${pluginPath}
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "obs studio output plugin for Video4Linux2 device";
     homepage = "https://github.com/CatxFish/obs-v4l2sink";
-    maintainers = with maintainers; [ colemickens ];
+    maintainers = with maintainers; [ colemickens peelz ];
     license = licenses.gpl2;
-    platforms = [ "x86_64-linux" ];
+    platforms = [ "x86_64-linux" "i686-linux" ];
   };
 }
diff --git a/pkgs/applications/video/tartube/default.nix b/pkgs/applications/video/tartube/default.nix
@@ -0,0 +1,68 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, gdk-pixbuf
+, gobject-introspection
+, gtk3
+, libnotify
+, pango
+, python3Packages
+, wrapGAppsHook
+, youtube-dl
+, glib
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "tartube";
+  version = "2.0.016";
+
+  src = fetchFromGitHub {
+    owner = "axcore";
+    repo = "tartube";
+    rev = "v${version}";
+    sha256 = "1y77ykihyi4v6xlsm5xldbs9lzq229l574rxz6qfvrjcbbwajfj9";
+  };
+
+  nativeBuildInputs = [
+    gobject-introspection
+    wrapGAppsHook
+  ];
+
+  strictDeps = false;
+
+  propagatedBuildInputs = with python3Packages; [
+    moviepy
+    pygobject3
+    pyxdg
+    requests
+  ];
+
+  buildInputs = [
+    gdk-pixbuf
+    gtk3
+    glib
+    libnotify
+    pango
+  ];
+
+  postInstall = ''
+    mkdir -p $out/share/{man/man1,applications,pixmaps}
+    cp pack/tartube.1 $out/share/man/man1
+    cp pack/tartube.desktop $out/share/applications
+    cp pack/tartube.{png,xpm} $out/share/pixmaps
+  '';
+
+  doCheck = false;
+
+  makeWrapperArgs = [
+    "--prefix PATH : ${stdenv.lib.makeBinPath [ youtube-dl ]}"
+  ];
+
+  meta = with lib; {
+    description = "A GUI front-end for youtube-dl";
+    license = licenses.gpl3;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ mkg20001 luc65r ];
+    homepage = "https://tartube.sourceforge.io/";
+  };
+}
diff --git a/pkgs/applications/virtualization/spike/default.nix b/pkgs/applications/virtualization/spike/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchgit, dtc }:
+{ stdenv, fetchgit, dtc, nixosTests }:
 
 stdenv.mkDerivation rec {
   pname = "spike";
@@ -20,6 +20,10 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
+  passthru.tests = {
+    can-run-hello-world = nixosTests.spike;
+  };
+
   meta = with stdenv.lib; {
     description = "A RISC-V ISA Simulator";
     homepage = "https://github.com/riscv/riscv-isa-sim";

diff --git a/pkgs/build-support/alternatives/lapack/default.nix b/pkgs/build-support/alternatives/lapack/default.nix
@@ -54,10 +54,6 @@ stdenv.mkDerivation {
 '' + (if stdenv.hostPlatform.parsed.kernel.execFormat.name == "elf" then ''
   patchelf --set-soname liblapack${canonicalExtension} $out/lib/liblapack${canonicalExtension}
   patchelf --set-rpath "$(patchelf --print-rpath $out/lib/liblapack${canonicalExtension}):${lapackProvider}/lib" $out/lib/liblapack${canonicalExtension}
-'' else if stdenv.hostPlatform.isDarwin then ''
-  install_name_tool -id liblapack${canonicalExtension} \
-                    -add_rpath ${lib.getLib lapackProvider}/lib \
-                    $out/lib/liblapack${canonicalExtension}
 '' else "") + ''
 
   if [ "$out/lib/liblapack${canonicalExtension}" != "$out/lib/liblapack${stdenv.hostPlatform.extensions.sharedLibrary}" ]; then
@@ -87,10 +83,6 @@ EOF
 '' + (if stdenv.hostPlatform.parsed.kernel.execFormat.name == "elf" then ''
   patchelf --set-soname liblapacke${canonicalExtension} $out/lib/liblapacke${canonicalExtension}
   patchelf --set-rpath "$(patchelf --print-rpath $out/lib/liblapacke${canonicalExtension}):${lib.getLib lapackProvider}/lib" $out/lib/liblapacke${canonicalExtension}
-'' else if stdenv.hostPlatform.isDarwin then ''
-  install_name_tool -id liblapacke${canonicalExtension} \
-                    -add_rpath ${lib.getLib lapackProvider}/lib \
-                    $out/lib/liblapacke${canonicalExtension}
 '' else "") + ''
 
   if [ -f "$out/lib/liblapacke.so.3" ]; then

diff --git a/pkgs/build-support/trivial-builders.nix b/pkgs/build-support/trivial-builders.nix
@@ -4,7 +4,8 @@ let
 
   runCommand' = runLocal: stdenv: name: env: buildCommand:
     stdenv.mkDerivation ({
-      inherit name buildCommand;
+      name = lib.strings.sanitizeDerivationName name;
+      inherit buildCommand;
       passAsFile = [ "buildCommand" ];
     }
     // (lib.optionalAttrs runLocal {

diff --git a/pkgs/common-updater/scripts.nix b/pkgs/common-updater/scripts.nix
@@ -1,4 +1,4 @@
-{ stdenv, makeWrapper, coreutils, gnused, gnugrep, diffutils, nix, git }:
+{ stdenv, makeWrapper, coreutils, gnused, gnugrep, diffutils, nix, git, jq }:
 
 stdenv.mkDerivation {
   name = "common-updater-scripts";
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
     cp ${./scripts}/* $out/bin
 
     for f in $out/bin/*; do
-      wrapProgram $f --prefix PATH : ${stdenv.lib.makeBinPath [ coreutils gnused gnugrep nix diffutils git ]}
+      wrapProgram $f --prefix PATH : ${stdenv.lib.makeBinPath [ coreutils gnused gnugrep nix diffutils git jq ]}
     done
   '';
 }
diff --git a/pkgs/common-updater/scripts/mark-broken b/pkgs/common-updater/scripts/mark-broken
@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+set -e
+
+scriptName=mark-broken # do not use the .wrapped name
+
+die() {
+    echo "$scriptName: error: $1" >&2
+    exit 1
+}
+
+usage() {
+    echo "Usage: $scriptName <attr> [--new-value=<new-value>]"
+}
+
+args=()
+
+for arg in "$@"; do
+    case $arg in
+        --new-value=*)
+            newValue="${arg#*=}"
+        ;;
+        --help)
+            usage
+            exit 0
+        ;;
+        --*)
+            echo "$scriptName: Unknown argument: $arg"
+            usage
+            exit 1
+        ;;
+        *)
+            args["${#args[*]}"]=$arg
+        ;;
+    esac
+done
+
+attr=${args[0]}
+
+if (( "${#args[*]}" < 1 )); then
+    echo "$scriptName: Too few arguments"
+    usage
+    exit 1
+fi
+
+if (( "${#args[*]}" > 1 )); then
+    echo "$scriptName: Too many arguments"
+    usage
+    exit 1
+fi
+
+if [ -z $newValue ]; then
+  newValue="true"
+fi
+
+nixFile=$(nix-instantiate --eval --json -E "with import ./. {}; (builtins.unsafeGetAttrPos \"description\" $attr.meta).file" | jq -r .)
+if [[ ! -f "$nixFile" ]]; then
+    die "Couldn't evaluate 'builtins.unsafeGetAttrPos \"description\" $attr.meta' to locate the .nix file!"
+fi
+
+# Insert broken attribute
+sed -i.bak "$nixFile" -r \
+  -e "/^\s*broken\s*=.*$/d" \
+  -e "s/(\s*)meta\s*=.*\{/&\n\1  broken = $newValue;/"
+
+if cmp -s "$nixFile" "$nixFile.bak"; then
+    mv "$nixFile.bak" "$nixFile"
+    die "Failed to mark the package as broken! Does it have a meta attribute?"
+fi
+
+if [[ "$newValue" == "true" ]]; then
+    # broken should evaluate to true in any case now
+    markedSuccessfully=$(nix-instantiate --eval -E "with import ./. {}; $attr.meta.broken" || true)
+    if [[ ! "$markedSuccessfully" == "true" ]]; then
+        mv "$nixFile.bak" "$nixFile"
+        die "Couldn't verify the broken attribute to be set correctly, restoring backup!"
+    fi
+else
+    # we can not check if broken evaluates to the correct value, but we can check that it does evaluate
+    if ! nix-instantiate --eval -E "with import ./. {}; $attr.meta.broken" >/dev/null; then
+        mv "$nixFile.bak" "$nixFile"
+        die "Couldn't verify the broken attribute to be set correctly, restoring backup!"
+    fi
+fi
+
+rm -f "$nixFile.bak"
+rm -f "$attr.fetchlog"
diff --git a/pkgs/desktops/gnome-3/core/mutter/3.34/default.nix b/pkgs/desktops/gnome-3/core/mutter/3.34/default.nix
@@ -43,13 +43,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mutter";
-  version = "3.34.4";
+  version = "3.34.5";
 
   outputs = [ "out" "dev" "man" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/mutter/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "18hbw98p4h3d4qz57415smwmfg72s9a0nk8mb04ds1gn2lsm2d01";
+    sha256 = "1i3r51ghfld1rf1rczzi3jhybz3mhywqcj2jyiqhfcyp1svlklfi";
   };
 
   mesonFlags = [
@@ -111,6 +111,13 @@ stdenv.mkDerivation rec {
       sha256 = "0imy2j8af9477jliwdq4jc40yw1cifsjjf196gnmwxr9rkj0hbrd";
     })
 
+    # gnome-3-34 2020-04-24
+    # also fixes https://mail.gnome.org/archives/distributor-list/2020-April/msg00001.html
+    (fetchpatch {
+      url = "https://github.com/GNOME/mutter/compare/3.34.5..3bafd234248fdcd84bc62fef5e31c29fbb613909.patch";
+      sha256 = "1a7krbdfmvx204p6av44rbp4ckp6ddg1mms8wkixxh2p871zq1pi";
+    })
+
     # Drop inheritable cap_sys_nice, to prevent the ambient set from leaking
     # from mutter/gnome-shell, see https://github.com/NixOS/nixpkgs/issues/71381
     ./drop-inheritable.patch

diff --git a/pkgs/desktops/gnome-3/find-latest-version.py b/pkgs/desktops/gnome-3/find-latest-version.py
@@ -1,10 +1,13 @@
 import argparse
+import math
 import json
 import requests
 import sys
 
+
 def version_to_list(version):
-    return list(map(int, version.split('.')))
+    return list(map(int, version.split(".")))
+
 
 def odd_unstable(version_str, selected):
     version = version_to_list(version_str)
@@ -14,47 +17,58 @@ def odd_unstable(version_str, selected):
     even = version[1] % 2 == 0
     prerelease = (version[1] >= 90 and version[1] < 100) or (version[1] >= 900 and version[1] < 1000)
     stable = even and not prerelease
-    if selected == 'stable':
+    if selected == "stable":
         return stable
     else:
         return True
 
+
 def no_policy(version, selected):
     return True
 
+
 version_policies = {
-    'odd-unstable': odd_unstable,
-    'none': no_policy,
+    "odd-unstable": odd_unstable,
+    "none": no_policy,
 }
 
-def make_version_policy(version_predicate, selected):
-    return lambda version: version_predicate(version, selected)
 
-parser = argparse.ArgumentParser(description='Find latest version for a GNOME package by crawling their release server.')
-parser.add_argument('package-name', help='Name of the directory in https://ftp.gnome.org/pub/GNOME/sources/ containing the package.')
-parser.add_argument('version-policy', help='Policy determining which versions are considered stable. For most GNOME packages, odd minor versions are unstable but there are exceptions.', choices=version_policies.keys(), nargs='?', default='odd-unstable')
-parser.add_argument('requested-release', help='Most of the time, we will want to update to stable version but sometimes it is useful to test.', choices=['stable', 'unstable'], nargs='?', default='stable')
+def make_version_policy(version_predicate, selected, upper_bound):
+    if not upper_bound:
+        upper_bound = [math.inf, math.inf]
+    else:
+        upper_bound = version_to_list(upper_bound)
+
+    return lambda version: version_predicate(version, selected) and version_to_list(version) < upper_bound
+
+
+parser = argparse.ArgumentParser(description="Find latest version for a GNOME package by crawling their release server.")
+parser.add_argument("package-name", help="Name of the directory in https://ftp.gnome.org/pub/GNOME/sources/ containing the package.")
+parser.add_argument("version-policy", help="Policy determining which versions are considered stable. For most GNOME packages, odd minor versions are unstable but there are exceptions.", choices=version_policies.keys(), nargs="?", default="odd-unstable")
+parser.add_argument("requested-release", help="Most of the time, we will want to update to stable version but sometimes it is useful to test.", choices=["stable", "unstable"], nargs="?", default="stable")
+parser.add_argument("--upper-bound", dest="upper-bound", help="Only look for versions older than this one (useful for pinning dependencies).")
 
 
-if __name__ == '__main__':
+if __name__ == "__main__":
     args = parser.parse_args()
 
-    package_name = getattr(args, 'package-name')
-    requested_release = getattr(args, 'requested-release')
-    version_predicate = version_policies[getattr(args, 'version-policy')]
-    version_policy = make_version_policy(version_predicate, requested_release)
+    package_name = getattr(args, "package-name")
+    requested_release = getattr(args, "requested-release")
+    upper_bound = getattr(args, "upper-bound")
+    version_predicate = version_policies[getattr(args, "version-policy")]
+    version_policy = make_version_policy(version_predicate, requested_release, upper_bound)
 
     # The structure of cache.json: https://gitlab.gnome.org/Infrastructure/sysadmin-bin/blob/master/ftpadmin#L762
-    cache = json.loads(requests.get('https://ftp.gnome.org/pub/GNOME/sources/{}/cache.json'.format(package_name)).text)
+    cache = json.loads(requests.get(f"https://ftp.gnome.org/pub/GNOME/sources/{package_name}/cache.json").text)
     if type(cache) != list or cache[0] != 4:
-        print('Unknown format of cache.json file.', file=sys.stderr)
+        print("Unknown format of cache.json file.", file=sys.stderr)
         sys.exit(1)
 
     versions = cache[2][package_name]
     versions = sorted(filter(version_policy, versions), key=version_to_list)
 
     if len(versions) == 0:
-        print('No versions matched.', file=sys.stderr)
+        print("No versions matched.", file=sys.stderr)
         sys.exit(1)
 
     print(versions[-1])
diff --git a/pkgs/desktops/gnome-3/update.nix b/pkgs/desktops/gnome-3/update.nix
@@ -1,16 +1,26 @@
-{ stdenv, lib, writeScript, python3, common-updater-scripts }:
-{ packageName, attrPath ? packageName, versionPolicy ? "odd-unstable" }:
+{ stdenv, pkgs, lib, writeScript, python3, common-updater-scripts }:
+{ packageName, attrPath ? packageName, versionPolicy ? "odd-unstable", freeze ? false }:
 
 let
   python = python3.withPackages (p: [ p.requests ]);
+  upperBoundFlag =
+    let
+      package = lib.attrByPath (lib.splitString "." attrPath) (throw "Cannot find attribute ‘${attrPath}’.") pkgs;
+      packageVersion = lib.getVersion package;
+      versionComponents = lib.versions.splitVersion packageVersion;
+      minorVersion = lib.versions.minor packageVersion;
+      minorAvailable = builtins.length versionComponents > 1 && builtins.match "[0-9]+" minorVersion != null;
+      nextMinor = builtins.fromJSON minorVersion + 1;
+      upperBound = "${lib.versions.major packageVersion}.${builtins.toString nextMinor}";
+    in lib.optionalString (freeze && minorAvailable) ''--upper-bound="${upperBound}"'';
   updateScript = writeScript "gnome-update-script" ''
     #!${stdenv.shell}
     set -o errexit
     package_name="$1"
     attr_path="$2"
     version_policy="$3"
     PATH=${lib.makeBinPath [ common-updater-scripts python ]}
-    latest_tag=$(python "${./find-latest-version.py}" "$package_name" "$version_policy" "stable")
+    latest_tag=$(python "${./find-latest-version.py}" "$package_name" "$version_policy" "stable" ${upperBoundFlag})
     update-source-version "$attr_path" "$latest_tag"
   '';
 in [ updateScript packageName attrPath versionPolicy ]
diff --git a/pkgs/desktops/pantheon/apps/switchboard-plugs/pantheon-shell/default.nix b/pkgs/desktops/pantheon/apps/switchboard-plugs/pantheon-shell/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "switchboard-plug-pantheon-shell";
-  version = "2.8.3";
+  version = "2.8.4";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = pname;
     rev = version;
-    sha256 = "0ypyppxx51l3r3fgxrvjdwnz33lpbfh1bf27fww9fx9520wixnx8";
+    sha256 = "1nnsv745inbdqk3xnbcaqmj87vr3kzh5hazbh8v3ib33cpi7wy88";
   };
 
   passthru = {

diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-whiskermenu-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-whiskermenu-plugin/default.nix
@@ -1,15 +1,20 @@
-{ mkXfceDerivation, gtk3, glib, cmake, exo, garcon, libxfce4ui, libxfce4util, xfce4-panel, xfconf }:
+{ mkXfceDerivation, gettext, gtk3, glib, cmake, exo, garcon, libxfce4ui, libxfce4util, xfce4-panel, xfconf }:
 
 mkXfceDerivation {
   category = "panel-plugins";
   pname = "xfce4-whiskermenu-plugin";
-  version = "2.4.3";
+  version = "2.4.4";
   rev-prefix = "v";
-  sha256 = "1cs3fps1bj0dd5az7fwrvw1xl3y621qk4dma3n73p7rr19j7fpsn";
+  sha256 = "08b82j9xp3vzjlc740s9svcjkbsal71ggp23y7dvjqppch7sdxzw";
 
   nativeBuildInputs = [ cmake ];
 
-  buildInputs = [ exo garcon gtk3 glib libxfce4ui libxfce4util xfce4-panel xfconf ];
+  buildInputs = [ gettext exo garcon gtk3 glib libxfce4ui libxfce4util xfce4-panel xfconf ];
+
+  postPatch = ''
+    substituteInPlace panel-plugin/xfce4-popup-whiskermenu.in \
+      --replace gettext ${gettext}/bin/gettext
+  '';
 
   postInstall = ''
     substituteInPlace $out/bin/xfce4-popup-whiskermenu \

diff --git a/pkgs/development/compilers/elm/packages/elm-instrument.nix b/pkgs/development/compilers/elm/packages/elm-instrument.nix
@@ -28,7 +28,7 @@ mkDerivation {
     quickcheck-io split tasty tasty-golden tasty-hunit tasty-quickcheck
     text
   ];
-  homepage = "http://elm-lang.org";
+  homepage = "https://elm-lang.org";
   description = "Instrumentation library for Elm";
   license = stdenv.lib.licenses.bsd3;
 }
diff --git a/pkgs/development/compilers/unison/default.nix b/pkgs/development/compilers/unison/default.nix
@@ -4,18 +4,18 @@
 
 stdenv.mkDerivation rec {
   pname = "unison-code-manager";
-  milestone_id = "M1h";
+  milestone_id = "M1j";
   version = "1.0.${milestone_id}-alpha";
 
   src = if (stdenv.isDarwin) then
     fetchurl {
       url = "https://github.com/unisonweb/unison/releases/download/release/${milestone_id}/unison-osx.tar.gz";
-      sha256 = "0iivm5gmbk0fq0zr3lvck6p1c2i7i54l3rf70z677529w9irzchp";
+      sha256 = "1pvdjmasgl22inbr8nlizsg8s5zagn8bzwhaxqmwafkpsskz0hsg";
     }
   else
     fetchurl {
       url = "https://github.com/unisonweb/unison/releases/download/release/${milestone_id}/unison-linux64.tar.gz";
-      sha256 = "0fb84c1yn8pidflh7kq696j3v4blkvbk1fsqp36h30p7vv676yci";
+      sha256 = "1xpblx405cp3mv0vrhcqwjlxvrhgmc77mxbvcy93srxja3qai1af";
     };
 
   # The tarball is just the prebuilt binary, in the archive root.

diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
@@ -1457,11 +1457,8 @@ self: super: {
   cryptonite = dontCheck super.cryptonite;
 
   # The test suite depends on an impure cabal-install installation in
-  # $HOME, which we don't have in our build sandbox, and it is keeping
-  # up with the most recent Cabal version.
-  cabal-install-parsers = dontCheck (super.cabal-install-parsers.overrideScope (self: super: {
-    Cabal = self.Cabal_3_2_0_0;
-  }));
+  # $HOME, which we don't have in our build sandbox.
+  cabal-install-parsers = dontCheck super.cabal-install-parsers;
 
   # haskell-ci-0.8 needs cabal-install-parsers ==0.1, but we have 0.2.
   haskell-ci = doJailbreak super.haskell-ci;

diff --git a/pkgs/development/haskell-modules/configuration-ghc-8.10.x.nix b/pkgs/development/haskell-modules/configuration-ghc-8.10.x.nix
@@ -49,23 +49,28 @@ self: super: {
   async = doJailbreak super.async;
   ChasingBottoms = doJailbreak super.ChasingBottoms;
   hashable = doJailbreak super.hashable;
+  pandoc = doJailbreak super.pandoc;
   parallel = doJailbreak super.parallel;
   regex-base = doJailbreak super.regex-base;
   regex-compat = doJailbreak super.regex-compat;
   regex-pcre-builtin = doJailbreak super.regex-pcre-builtin;
   regex-posix = doJailbreak super.regex-posix;
   regex-tdfa = doJailbreak super.regex-tdfa;
   split = doJailbreak super.split;
+  system-fileio = doJailbreak super.system-fileio;
   tar = doJailbreak super.tar;
   tasty-expected-failure = doJailbreak super.tasty-expected-failure;
   unliftio-core = doJailbreak super.unliftio-core;
   vector = doJailbreak super.vector;
   zlib = doJailbreak super.zlib;
 
   # Use the latest version to fix the build.
+  dhall = self.dhall_1_31_1;
+  ghc-lib-parser-ex = self.ghc-lib-parser-ex_8_10_0_4;
+  lens = self.lens_4_19_2;
   optics-core = self.optics-core_0_3;
   repline = self.repline_0_3_0_0;
-  ghc-lib-parser-ex = self.ghc-lib-parser-ex_8_10_0_4;
+  singletons = self.singletons_2_7;
   th-desugar = self.th-desugar_1_11;
 
   # `ghc-lib-parser-ex` (see conditionals in its `.cabal` file) does not need
@@ -77,14 +82,17 @@ self: super: {
 
   # Jailbreak to fix the build.
   aeson-diff = doJailbreak super.aeson-diff;
+  brick = doJailbreak super.brick;
   cborg = doJailbreak super.cborg;
   cborg-json = doJailbreak super.cborg-json;
   exact-pi = doJailbreak super.exact-pi;
+  policeman = doJailbreak super.policeman;
   relude = dontCheck (doJailbreak super.relude);
   serialise = doJailbreak super.serialise;
   setlocale = doJailbreak super.setlocale;
   shellmet = doJailbreak super.shellmet;
-  brick = doJailbreak super.brick;
+  weeder = doJailbreak super.weeder;    # https://github.com/ocharles/weeder/issues/15
+  xmobar = doJailbreak super.xmobar;
 
   # The shipped Setup.hs file is broken.
   csv = overrideCabal super.csv (drv: { preCompileBuildDriver = "rm Setup.hs"; });
@@ -98,4 +106,18 @@ self: super: {
 
   # Only 0.8 is compatible with ghc 8.10 https://hackage.haskell.org/package/apply-refact/changelog
   apply-refact = super.apply-refact_0_8_0_0;
+
+  # Apply patch to fix the build.
+  cabal-plan = appendPatch super.cabal-plan (pkgs.fetchpatch {
+    name = "cabal-plan-fix-for-ghc-8.10.x.patch";
+    url = "https://github.com/haskell-hvr/cabal-plan/pull/55.patch";
+    sha256 = "0lhs4vx5qg5ldhnyb9z7k0jmxhmd2f34x4xbwv6vsljs9vr02pd8";
+  });
+  dbus = appendPatch super.dbus ./patches/fix-dbus-for-ghc-8.10.x.patch;
+
+  # https://github.com/ndmitchell/hlint/issues/959
+  hlint = super.hlint.override {
+    ghc-lib-parser-ex = addBuildDepend super.ghc-lib-parser-ex super.ghc-lib-parser;
+  };
+
 }
diff --git a/pkgs/development/haskell-modules/configuration-ghc-8.8.x.nix b/pkgs/development/haskell-modules/configuration-ghc-8.8.x.nix
@@ -102,4 +102,8 @@ self: super: {
 
   # Only 0.7 is compatible with ghc 8.7 https://hackage.haskell.org/package/apply-refact/changelog
   apply-refact = super.apply-refact_0_7_0_0;
+
+  # The package needs the latest Cabal version.
+  cabal-install-parsers = super.cabal-install-parsers.overrideScope (self: super: { Cabal = self.Cabal_3_2_0_0; });
+
 }
diff --git a/pkgs/development/haskell-modules/configuration-nix.nix b/pkgs/development/haskell-modules/configuration-nix.nix
@@ -720,10 +720,9 @@ self: super: builtins.intersectAttrs super {
   # break infinite recursion with base-orphans
   primitive = dontCheck super.primitive;
 
-  # dhall-1.29.0 tests access the network.  This override can be removed when
-  # dhall_1_29_0 is no longer used, since more recent versions of dhall don't
-  # access the network in checks.
+  # dhall's tests access the network.
   dhall_1_29_0 = dontCheck super.dhall_1_29_0;
+  dhall_1_31_1 = dontCheck super.dhall_1_31_1;
 
   cut-the-crap =
     let path = pkgs.stdenv.lib.makeBinPath [ pkgs.ffmpeg ];

diff --git a/pkgs/development/haskell-modules/patches/fix-dbus-for-ghc-8.10.x.patch b/pkgs/development/haskell-modules/patches/fix-dbus-for-ghc-8.10.x.patch
@@ -0,0 +1,383 @@
+Only in dbus-1.2.13-new: .codeclimate.yml
+diff -ur dbus-1.2.13-old/dbus.cabal dbus-1.2.13-new/dbus.cabal
+--- dbus-1.2.13-old/dbus.cabal	2020-04-25 19:29:27.372272952 +0200
++++ dbus-1.2.13-new/dbus.cabal	2020-04-25 19:26:36.140991920 +0200
+@@ -1,172 +1,180 @@
+-cabal-version: >=1.8
+ name: dbus
+ version: 1.2.13
+ license: Apache-2.0
+ license-file: license.txt
+-maintainer: Andrey Sverdlichenko <blaze@ruddy.ru>
+ author: John Millikin <john@john-millikin.com>
++maintainer: Andrey Sverdlichenko <blaze@ruddy.ru>
++build-type: Simple
++cabal-version: >= 1.8
++category: Network, Desktop
+ stability: experimental
+ homepage: https://github.com/rblaze/haskell-dbus#readme
++
+ synopsis: A client library for the D-Bus IPC system.
+ description:
+-    D-Bus is a simple, message-based protocol for inter-process
+-    communication, which allows applications to interact with other parts of
+-    the machine and the user's session using remote procedure calls.
+-    .
+-    D-Bus is a essential part of the modern Linux desktop, where it replaces
+-    earlier protocols such as CORBA and DCOP.
+-    .
+-    This library is an implementation of the D-Bus protocol in Haskell. It
+-    can be used to add D-Bus support to Haskell applications, without the
+-    awkward interfaces common to foreign bindings.
+-    .
+-    Example: connect to the session bus, and get a list of active names.
+-    .
+-    @
+-    &#x7b;-\# LANGUAGE OverloadedStrings \#-&#x7d;
+-    .
+-    import Data.List (sort)
+-    import DBus
+-    import DBus.Client
+-    .
+-    main = do
+-    &#x20;   client <- connectSession
+-    &#x20;   //
+-    &#x20;   \-- Request a list of connected clients from the bus
+-    &#x20;   reply <- call_ client (methodCall \"\/org\/freedesktop\/DBus\" \"org.freedesktop.DBus\" \"ListNames\")
+-    &#x20;       &#x7b; methodCallDestination = Just \"org.freedesktop.DBus\"
+-    &#x20;       &#x7d;
+-    &#x20;   //
+-    &#x20;   \-- org.freedesktop.DBus.ListNames() returns a single value, which is
+-    &#x20;   \-- a list of names (here represented as [String])
+-    &#x20;   let Just names = fromVariant (methodReturnBody reply !! 0)
+-    &#x20;   //
+-    &#x20;   \-- Print each name on a line, sorted so reserved names are below
+-    &#x20;   \-- temporary names.
+-    &#x20;   mapM_ putStrLn (sort names)
+-    @
+-    .
+-    >$ ghc --make list-names.hs
+-    >$ ./list-names
+-    >:1.0
+-    >:1.1
+-    >:1.10
+-    >:1.106
+-    >:1.109
+-    >:1.110
+-    >ca.desrt.dconf
+-    >org.freedesktop.DBus
+-    >org.freedesktop.Notifications
+-    >org.freedesktop.secrets
+-    >org.gnome.ScreenSaver
+-category: Network, Desktop
+-build-type: Simple
++  D-Bus is a simple, message-based protocol for inter-process
++  communication, which allows applications to interact with other parts of
++  the machine and the user's session using remote procedure calls.
++  .
++  D-Bus is a essential part of the modern Linux desktop, where it replaces
++  earlier protocols such as CORBA and DCOP.
++  .
++  This library is an implementation of the D-Bus protocol in Haskell. It
++  can be used to add D-Bus support to Haskell applications, without the
++  awkward interfaces common to foreign bindings.
++  .
++  Example: connect to the session bus, and get a list of active names.
++  .
++  @
++  &#x7b;-\# LANGUAGE OverloadedStrings \#-&#x7d;
++  .
++  import Data.List (sort)
++  import DBus
++  import DBus.Client
++  .
++  main = do
++  &#x20;   client <- connectSession
++  &#x20;
++  &#x20;   -- Request a list of connected clients from the bus
++  &#x20;   reply <- call_ client (methodCall \"\/org\/freedesktop\/DBus\" \"org.freedesktop.DBus\" \"ListNames\")
++  &#x20;       &#x7b; methodCallDestination = Just \"org.freedesktop.DBus\"
++  &#x20;       &#x7d;
++  &#x20;
++  &#x20;   -- org.freedesktop.DBus.ListNames() returns a single value, which is
++  &#x20;   -- a list of names (here represented as [String])
++  &#x20;   let Just names = fromVariant (methodReturnBody reply !! 0)
++  &#x20;
++  &#x20;   -- Print each name on a line, sorted so reserved names are below
++  &#x20;   -- temporary names.
++  &#x20;   mapM_ putStrLn (sort names)
++  @
++  .
++  >$ ghc --make list-names.hs
++  >$ ./list-names
++  >:1.0
++  >:1.1
++  >:1.10
++  >:1.106
++  >:1.109
++  >:1.110
++  >ca.desrt.dconf
++  >org.freedesktop.DBus
++  >org.freedesktop.Notifications
++  >org.freedesktop.secrets
++  >org.gnome.ScreenSaver
++
++
+ extra-source-files:
+-    examples/dbus-monitor.hs
+-    examples/export.hs
+-    examples/introspect.hs
+-    examples/list-names.hs
+-    idlxml/dbus.xml
++  examples/dbus-monitor.hs
++  examples/export.hs
++  examples/introspect.hs
++  examples/list-names.hs
++  idlxml/dbus.xml
+
+ source-repository head
+-    type: git
+-    location: https://github.com/rblaze/haskell-dbus
++  type: git
++  location: https://github.com/rblaze/haskell-dbus
+
+ library
+-    exposed-modules:
+-        DBus
+-        DBus.Client
+-        DBus.Generation
+-        DBus.Internal.Address
+-        DBus.Internal.Message
+-        DBus.Internal.Types
+-        DBus.Internal.Wire
+-        DBus.Introspection
+-        DBus.Introspection.Parse
+-        DBus.Introspection.Render
+-        DBus.Introspection.Types
+-        DBus.Socket
+-        DBus.TH
+-        DBus.Transport
+-    hs-source-dirs: lib
+-    ghc-options: -W -Wall
+-    build-depends:
+-        base ==4.*,
+-        bytestring <0.11,
+-        cereal <0.6,
+-        conduit >=1.3.0 && <1.4,
+-        containers <0.7,
+-        deepseq <1.5,
+-        exceptions <0.11,
+-        filepath <1.5,
+-        lens <4.20,
+-        network >=3.0.1.0 && <3.2,
+-        parsec <3.2,
+-        random <1.2,
+-        split <0.3,
+-        template-haskell <2.16.0.0,
+-        text <1.3,
+-        th-lift <0.9,
+-        transformers <0.6,
+-        unix <2.8,
+-        vector <0.13,
+-        xml-conduit >=1.9.0.0 && <1.10.0.0,
+-        xml-types <0.4
++  ghc-options: -W -Wall
++  hs-source-dirs: lib
++
++  build-depends:
++      base >=4 && <5
++    , bytestring
++    , cereal
++    , conduit >= 1.3.0
++    , containers
++    , deepseq
++    , exceptions
++    , filepath
++    , lens < 4.20
++    , network >= 3.0.1.0 && < 3.2
++    , parsec
++    , random
++    , split
++    , template-haskell < 2.17.0.0
++    , text
++    , th-lift < 0.9
++    , transformers
++    , unix
++    , vector
++    , xml-conduit >= 1.9.0.0 && < 1.10.0.0
++    , xml-types
++
++  exposed-modules:
++    DBus
++    DBus.Client
++    DBus.Generation
++    DBus.Internal.Address
++    DBus.Internal.Message
++    DBus.Internal.Types
++    DBus.Internal.Wire
++    DBus.Introspection
++    DBus.Introspection.Parse
++    DBus.Introspection.Render
++    DBus.Introspection.Types
++    DBus.Socket
++    DBus.TH
++    DBus.Transport
+
+ test-suite dbus_tests
+-    type: exitcode-stdio-1.0
+-    main-is: DBusTests.hs
+-    hs-source-dirs: tests
+-    other-modules:
+-        DBusTests.Address
+-        DBusTests.BusName
+-        DBusTests.Client
+-        DBusTests.ErrorName
+-        DBusTests.Generation
+-        DBusTests.Integration
+-        DBusTests.InterfaceName
+-        DBusTests.Introspection
+-        DBusTests.MemberName
+-        DBusTests.Message
+-        DBusTests.ObjectPath
+-        DBusTests.Serialization
+-        DBusTests.Signature
+-        DBusTests.Socket
+-        DBusTests.TH
+-        DBusTests.Transport
+-        DBusTests.Util
+-        DBusTests.Variant
+-        DBusTests.Wire
+-    ghc-options: -W -Wall -fno-warn-orphans
+-    build-depends:
+-        dbus -any,
+-        base ==4.*,
+-        bytestring <0.11,
+-        cereal <0.6,
+-        containers <0.7,
+-        directory <1.4,
+-        extra <1.8,
+-        filepath <1.5,
+-        network >=3.0.1.0 && <3.2,
+-        parsec <3.2,
+-        process <1.7,
+-        QuickCheck <2.15,
+-        random <1.2,
+-        resourcet <1.3,
+-        tasty <1.3,
+-        tasty-hunit <0.11,
+-        tasty-quickcheck <0.11,
+-        text <1.3,
+-        transformers <0.6,
+-        unix <2.8,
+-        vector <0.13
++  type: exitcode-stdio-1.0
++  main-is: DBusTests.hs
++  hs-source-dirs: tests
++  ghc-options: -W -Wall -fno-warn-orphans
++
++  build-depends:
++      dbus
++    , base >=4 && <5
++    , bytestring
++    , cereal
++    , containers
++    , directory
++    , extra < 1.8
++    , filepath
++    , network >= 3.0.1.0 && < 3.2
++    , parsec
++    , process
++    , QuickCheck < 2.15
++    , random
++    , resourcet
++    , tasty
++    , tasty-hunit
++    , tasty-quickcheck
++    , text
++    , transformers
++    , unix
++    , vector
++
++  other-modules:
++    DBusTests.Address
++    DBusTests.BusName
++    DBusTests.Client
++    DBusTests.ErrorName
++    DBusTests.Generation
++    DBusTests.Integration
++    DBusTests.InterfaceName
++    DBusTests.Introspection
++    DBusTests.MemberName
++    DBusTests.Message
++    DBusTests.ObjectPath
++    DBusTests.Serialization
++    DBusTests.Signature
++    DBusTests.Socket
++    DBusTests.TH
++    DBusTests.Transport
++    DBusTests.Util
++    DBusTests.Variant
++    DBusTests.Wire
+
+ benchmark dbus_benchmarks
+-    type: exitcode-stdio-1.0
+-    main-is: DBusBenchmarks.hs
+-    hs-source-dirs: benchmarks
+-    ghc-options: -Wall -fno-warn-orphans
+-    build-depends:
+-        dbus -any,
+-        base ==4.*,
+-        criterion <1.6
++  type: exitcode-stdio-1.0
++  main-is: DBusBenchmarks.hs
++  hs-source-dirs: benchmarks
++  ghc-options: -Wall -fno-warn-orphans
++
++  build-depends:
++      dbus
++    , base >=4 && <5
++    , criterion
+Only in dbus-1.2.13-new: .git
+Only in dbus-1.2.13-new: .gitignore
+diff -ur dbus-1.2.13-old/lib/DBus/Generation.hs dbus-1.2.13-new/lib/DBus/Generation.hs
+--- dbus-1.2.13-old/lib/DBus/Generation.hs	2019-02-14 16:37:47.000000000 +0100
++++ dbus-1.2.13-new/lib/DBus/Generation.hs	2020-04-25 19:26:36.144991997 +0200
+@@ -1,3 +1,4 @@
++{-# LANGUAGE CPP #-}
+ {-# LANGUAGE OverloadedStrings #-}
+ {-# LANGUAGE TemplateHaskell #-}
+ module DBus.Generation where
+@@ -26,6 +27,13 @@
+ import           Prelude hiding (mapM)
+ import           System.Posix.Types (Fd(..))
+
++-- | Compatibility helper to create (total) tuple expressions
++mkTupE :: [Exp] -> Exp
++mkTupE = TupE
++#if MIN_VERSION_template_haskell(2,16,0)
++         . map Just
++#endif
++
+ type ClientBusPathR a = ReaderT (Client, T.BusName, T.ObjectPath) IO a
+
+ dbusInvoke :: (Client -> T.BusName -> T.ObjectPath -> a) -> ClientBusPathR a
+@@ -232,8 +240,8 @@
+     finalOutputNames <- buildOutputNames
+     let variantListExp = map makeToVariantApp methodArgNames
+         mapOrHead' = mapOrHead outputLength
+-        fromVariantExp = mapOrHead' makeFromVariantApp fromVariantOutputNames TupE
+-        finalResultTuple = mapOrHead' VarE finalOutputNames TupE
++        fromVariantExp = mapOrHead' makeFromVariantApp fromVariantOutputNames mkTupE
++        finalResultTuple = mapOrHead' VarE finalOutputNames mkTupE
+         maybeExtractionPattern = mapOrHead' makeJustPattern finalOutputNames TupP
+         getMethodCallDefDec = [d|
+                $( varP methodCallDefN ) =
+@@ -432,7 +440,7 @@
+                      }
+                  |]
+     let mapOrHead' = mapOrHead argCount
+-        fromVariantExp = mapOrHead' makeFromVariantApp fromVariantOutputNames TupE
++        fromVariantExp = mapOrHead' makeFromVariantApp fromVariantOutputNames mkTupE
+         maybeExtractionPattern = mapOrHead' makeJustPattern toHandlerOutputNames TupP
+         applyToName toApply n = AppE toApply $ VarE n
+         finalApplication = foldl applyToName (VarE handlerArgN)
diff --git a/pkgs/development/interpreters/python/tests.nix b/pkgs/development/interpreters/python/tests.nix
@@ -38,21 +38,22 @@ let
       is_nixenv = "False";
     };
 
+  } // lib.optionalAttrs (python.pythonAtLeast "3.8") {
     # Venv built using Python Nix environment (python.buildEnv)
     # TODO: Cannot create venv from a  nix env
     # Error: Command '['/nix/store/ddc8nqx73pda86ibvhzdmvdsqmwnbjf7-python3-3.7.6-venv/bin/python3.7', '-Im', 'ensurepip', '--upgrade', '--default-pip']' returned non-zero exit status 1.
-    # nixenv-venv = rec {
-    #   env = runCommand "${python.name}-venv" {} ''
-    #     ${pythonEnv.interpreter} -m venv $out
-    #   '';
-    #   interpreter = "${env}/bin/${pythonEnv.executable}";
-    #   is_venv = "True";
-    #   is_nixenv = "True";
-    # };
+    nixenv-venv = rec {
+      env = runCommand "${python.name}-venv" {} ''
+        ${pythonEnv.interpreter} -m venv $out
+      '';
+      interpreter = "${env}/bin/${pythonEnv.executable}";
+      is_venv = "True";
+      is_nixenv = "True";
+    };
   };
 
   # All PyPy package builds are broken at the moment
-  integrationTests = lib.optionalAttrs (python.isPy3k  && (!python.isPyPy)) rec {
+  integrationTests = lib.optionalAttrs (python.pythonAtLeast "3.7"  && (!python.isPyPy)) rec {
     # Before the addition of NIX_PYTHONPREFIX mypy was broken with typed packages
     nix-pythonprefix-mypy = callPackage ./tests/test_nix_pythonprefix {
       interpreter = python;

diff --git a/pkgs/development/interpreters/python/tests/test_nix_pythonprefix/typeddep/default.nix b/pkgs/development/interpreters/python/tests/test_nix_pythonprefix/typeddep/default.nix
@@ -1,4 +1,4 @@
-{ buildPythonPackage }:
+{ buildPythonPackage, pythonOlder }:
 
 
 buildPythonPackage {
@@ -8,4 +8,6 @@ buildPythonPackage {
 
   src = ./.;
 
+  disabled = pythonOlder "3.7";
+
 }
diff --git a/pkgs/development/libraries/agda/agda-stdlib/default.nix b/pkgs/development/libraries/agda/agda-stdlib/default.nix
@@ -19,7 +19,7 @@ agda.mkDerivation (self: rec {
   topSourceDirectories = [ "src" ];
 
   meta = with stdenv.lib; {
-    homepage = "http://wiki.portal.chalmers.se/agda/pmwiki.php?n=Libraries.StandardLibrary";
+    homepage = "https://wiki.portal.chalmers.se/agda/pmwiki.php?n=Libraries.StandardLibrary";
     description = "A standard library for use with the Agda compiler";
     license = stdenv.lib.licenses.mit;
     platforms = stdenv.lib.platforms.unix;

diff --git a/pkgs/development/libraries/aspell/default.nix b/pkgs/development/libraries/aspell/default.nix
@@ -8,17 +8,18 @@ let
   # dictionary like Debian does.
   devaMapsSource = fetchzip {
     name = "aspell-u-deva";
-    url = "ftp://ftp.gnu.org/gnu/aspell/dict/mr/aspell6-mr-0.10-0.tar.bz2";
+    url = "https://ftp.gnu.org/gnu/aspell/dict/mr/aspell6-mr-0.10-0.tar.bz2";
     sha256 = "1v8cdl8x2j1d4vbvsq1xrqys69bbccd6mi03fywrhkrrljviyri1";
   };
 
 in
 
 stdenv.mkDerivation rec {
-  name = "aspell-0.60.8";
+  pname = "aspell";
+  version = "0.60.8";
 
   src = fetchurl {
-    url = "mirror://gnu/aspell/${name}.tar.gz";
+    url = "mirror://gnu/aspell/aspell-${version}.tar.gz";
     sha256 = "1wi60ankalmh8ds7nplz434jd7j94gdvbahdwsr539rlad8pxdzr";
   };
 

diff --git a/pkgs/development/libraries/audio/lv2/default.nix b/pkgs/development/libraries/audio/lv2/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ gtk2 libsndfile python3 ];
 
   meta = with stdenv.lib; {
-    homepage = "http://lv2plug.in";
+    homepage = "https://lv2plug.in";
     description = "A plugin standard for audio systems";
     license = licenses.mit;
     maintainers = [ maintainers.goibhniu ];

diff --git a/pkgs/development/libraries/goocanvasmm/default.nix b/pkgs/development/libraries/goocanvasmm/default.nix
@@ -18,6 +18,7 @@ stdenv.mkDerivation rec {
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = pname;
+      attrPath = "goocanvasmm2";
     };
   };
 

diff --git a/pkgs/development/libraries/libpgf/default.nix b/pkgs/development/libraries/libpgf/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
 # configureFlags = optional static "--enable-static --disable-shared";
 
   meta = {
-    homepage = "http://www.libpgf.org/";
+    homepage = "https://www.libpgf.org/";
     description = "Progressive Graphics Format";
     license = stdenv.lib.licenses.lgpl21Plus;
     platforms = stdenv.lib.platforms.unix;

diff --git a/pkgs/development/libraries/lirc/default.nix b/pkgs/development/libraries/lirc/default.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Allows to receive and send infrared signals";
-    homepage = "http://www.lirc.org/";
+    homepage = "https://www.lirc.org/";
     license = licenses.gpl2;
     platforms = platforms.linux;
     maintainers = with maintainers; [ pSub ];

diff --git a/pkgs/development/libraries/pcg-c/default.nix b/pkgs/development/libraries/pcg-c/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "A family of better random number generators";
-    homepage = "http://www.pcg-random.org/";
+    homepage = "https://www.pcg-random.org/";
     license = stdenv.lib.licenses.asl20;
     longDescription = ''
       PCG is a family of simple fast space-efficient statistically good

diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
@@ -1,5 +1,6 @@
 { stdenv
 , fetchFromGitLab
+, fetchpatch
 , meson
 , ninja
 , pkgconfig
@@ -72,6 +73,13 @@ stdenv.mkDerivation rec {
     vulkan-loader
     xorg.libX11
   ];
+  patches = [
+      # fix SIGILL in fmt-ops: https://gitlab.freedesktop.org/pipewire/pipewire/-/issues/227
+      (fetchpatch {
+        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/1b3aaba206f48e75bb34ff0cd00321bd3d6db2b4.patch";
+        sha256 = "08bmr9k2r0q4r7vhhm28k558nk3mz3jfnqswvq9mcj7p0srmfb4x";
+      })
+  ];
 
   mesonFlags = [
     "-Ddocs=true"

diff --git a/pkgs/development/ocaml-modules/cow/default.nix b/pkgs/development/ocaml-modules/cow/default.nix
@@ -1,30 +1,29 @@
-{ stdenv, fetchFromGitHub, ocaml, findlib
-, ocamlbuild, topkg
+{ lib, fetchurl, buildDunePackage, alcotest
 , uri, xmlm, omd, ezjsonm }:
 
-stdenv.mkDerivation rec {
-  version = "2.2.0";
-  pname = "ocaml-cow";
+buildDunePackage rec {
+  minimumOCamlVersion = "4.02.3";
 
-  src = fetchFromGitHub {
-    owner  = "mirage";
-    repo   = "ocaml-cow";
-    rev    = "v${version}";
-    sha256 = "0snhabg7rfrrcq2ksr3qghiawd61cw3y4kp6rl7vs87j4cnk3kr2";
+  version = "2.4.0";
+  pname = "cow";
+
+  src = fetchurl {
+    url = "https://github.com/mirage/ocaml-cow/releases/download/v${version}/cow-v${version}.tbz";
+    sha256 = "1x77lwpskda4zyikwxh500xjn90pgdwz6jm7ca7f36pyav4vl6zx";
   };
 
-  buildInputs = [ ocaml ocamlbuild findlib topkg ];
   propagatedBuildInputs = [ xmlm uri ezjsonm omd ];
+  checkInputs = [ alcotest ];
+  doCheck = true;
 
-  inherit (topkg) buildPhase installPhase;
-
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Caml on the Web";
     longDescription = ''
-      Caml on the Web (COW) is a set of parsers and syntax extensions to let you manipulate HTML, CSS, XML, JSON and Markdown directly from OCaml code.
+      Writing web-applications requires a lot of skills: HTML, XML, JSON and
+      Markdown, to name but a few! This library provides OCaml combinators
+      for these web formats.
     '';
     license = licenses.isc;
     maintainers = [ maintainers.sternenseemann ];
-    inherit (ocaml.meta) platforms;
   };
 }
diff --git a/pkgs/development/ocaml-modules/dns/client.nix b/pkgs/development/ocaml-modules/dns/client.nix
@@ -1,10 +1,14 @@
-{ lib, buildDunePackage, dns, ocaml_lwt, mirage-clock, mirage-random, mirage-stack, mtime, randomconv }:
+{ lib, buildDunePackage, dns, ocaml_lwt, mirage-clock, mirage-time
+, mirage-random, mirage-stack, mirage-crypto-rng, mtime, randomconv }:
 
 buildDunePackage {
   pname = "dns-client";
   inherit (dns) src version;
 
-  propagatedBuildInputs = [ dns mtime ocaml_lwt mirage-clock mirage-random mirage-stack randomconv ];
+  useDune2 = true;
+
+  propagatedBuildInputs = [ dns mtime ocaml_lwt randomconv mirage-clock mirage-time
+                            mirage-random mirage-stack mirage-crypto-rng ];
 
   meta = dns.meta // {
     description = "Pure DNS resolver API";

diff --git a/pkgs/development/ocaml-modules/dns/default.nix b/pkgs/development/ocaml-modules/dns/default.nix
@@ -4,13 +4,13 @@
 
 buildDunePackage rec {
   pname = "dns";
-  version = "4.4.1";
+  version = "4.5.0";
 
   minimumOCamlVersion = "4.07";
 
   src = fetchurl {
     url = "https://github.com/mirage/ocaml-dns/releases/download/v${version}/dns-v${version}.tbz";
-    sha256 = "18c09jf0kicv2xz40n367y774rg8qs07rr1vdk8bx8f7hnaa9cn8";
+    sha256 = "10jrnnxvp06rvzk285wibyi9hn15qhjnqjy9xsfbwl8yhmzzqnq0";
   };
 
   propagatedBuildInputs = [ cstruct domain-name duration gmap ipaddr logs lru metrics ptime rresult ];

diff --git a/pkgs/development/ocaml-modules/mirage-time/default.nix b/pkgs/development/ocaml-modules/mirage-time/default.nix
@@ -0,0 +1,22 @@
+{ lib, buildDunePackage, fetchurl, ocaml_lwt }:
+
+buildDunePackage rec {
+  minimumOCamlVersion = "4.06";
+
+  pname = "mirage-time";
+  version = "2.0.1";
+
+  src = fetchurl {
+    url = "https://github.com/mirage/mirage-time/releases/download/v${version}/mirage-time-v${version}.tbz";
+    sha256 = "1w6mm4g7fc19cs0ncs0s9fsnb1k1s04qqzs9bsqvq8ngsb90cbh0";
+  };
+
+  propagatedBuildInputs = [ ocaml_lwt ];
+
+  meta = with lib; {
+    homepage = "https://github.com/mirage/mirage-time";
+    description = "Time operations for MirageOS";
+    license = licenses.isc;
+    maintainers = with maintainers; [ sternenseemann ];
+  };
+}
diff --git a/pkgs/development/ocaml-modules/mirage-time/unix.nix b/pkgs/development/ocaml-modules/mirage-time/unix.nix
@@ -0,0 +1,13 @@
+{ buildDunePackage, fetchurl, mirage-time, ocaml_lwt, duration }:
+
+buildDunePackage {
+  pname = "mirage-time-unix";
+
+  inherit (mirage-time) src version minimumOCamlVersion;
+
+  propagatedBuildInputs = [ mirage-time ocaml_lwt duration ];
+
+  meta = mirage-time.meta // {
+    description = "Time operations for MirageOS on Unix";
+  };
+}
diff --git a/pkgs/development/python-modules/asttokens/default.nix b/pkgs/development/python-modules/asttokens/default.nix
@@ -1,27 +1,19 @@
-{ lib, fetchPypi, buildPythonPackage, fetchpatch, astroid, six, coverage
-, lazy-object-proxy, nose, wrapt
+{ lib, fetchPypi, buildPythonPackage,
+  setuptools_scm, toml, six, astroid, pytest
 }:
 
 buildPythonPackage rec {
   pname = "asttokens";
-  version = "1.1.13";
+  version = "2.0.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1vd4djlxmgznz84gzakkv45avnrcpgl1kir92l1pxyp0z5c0dh2m";
+    sha256 = "0a2ixiz04aw4p0aivxh47k3fa9ql804l3y5iv5gcih9aizi5fbm4";
   };
 
-  patches = [
-    # Fix tests for astroid 2.2 in python 3. Remove with the next release
-    (fetchpatch {
-      url = "https://github.com/gristlabs/asttokens/commit/21caaaa74105c410b3d84c3d8ff0dc2f612aac9a.patch";
-      sha256 = "182xfr0cx4pxx0dv1l50a1c281h8ywir8vvd1zh5iicflivim1nv";
-    })
-  ];
+  propagatedBuildInputs = [ setuptools_scm toml six astroid ];
 
-  propagatedBuildInputs = [ lazy-object-proxy six wrapt astroid ];
-
-  checkInputs = [ coverage nose ];
+  checkInputs = [ pytest ];
 
   meta = with lib; {
     homepage = "https://github.com/gristlabs/asttokens";

diff --git a/pkgs/development/python-modules/certifi/default.nix b/pkgs/development/python-modules/certifi/default.nix
@@ -13,7 +13,7 @@ buildPythonPackage rec {
   };
 
   meta = {
-    homepage = "http://certifi.io/";
+    homepage = "https://certifi.io/";
     description = "Python package for providing Mozilla's CA Bundle";
     license = lib.licenses.isc;
     maintainers = with lib.maintainers; [ koral ];

diff --git a/pkgs/development/python-modules/evernote/default.nix b/pkgs/development/python-modules/evernote/default.nix
@@ -19,7 +19,7 @@ buildPythonPackage rec {
 
    meta = with stdenv.lib; {
     description = "Evernote SDK for Python";
-    homepage = "http://dev.evernote.com";
+    homepage = "https://dev.evernote.com";
     license = licenses.asl20;
     maintainers = with maintainers; [ hbunke ];
    };

diff --git a/pkgs/development/python-modules/geopandas/default.nix b/pkgs/development/python-modules/geopandas/default.nix
@@ -30,7 +30,7 @@ buildPythonPackage rec {
 
   meta = with stdenv.lib; {
     description = "Python geospatial data analysis framework";
-    homepage = "http://geopandas.org";
+    homepage = "https://geopandas.org";
     license = licenses.bsd3;
     maintainers = with maintainers; [ knedlsepp ];
   };

diff --git a/pkgs/development/python-modules/pymavlink/default.nix b/pkgs/development/python-modules/pymavlink/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "pymavlink";
-  version = "2.4.6";
+  version = "2.4.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1c8bxbm18h4idfdxqgklcz4n5bgsyl9y14gl9314fpflwa2c7ds8";
+    sha256 = "1djzr6cg3l19icwplmpii7zzr8gms9qcc2lfr8yc05siqzclk5xk";
   };
 
   propagatedBuildInputs = [ future lxml ];

diff --git a/pkgs/development/python-modules/scikitlearn/0.20.nix b/pkgs/development/python-modules/scikitlearn/0.20.nix
@@ -31,7 +31,7 @@ buildPythonPackage rec {
 
   meta = with stdenv.lib; {
     description = "A set of python modules for machine learning and data mining";
-    homepage = "http://scikit-learn.org";
+    homepage = "https://scikit-learn.org";
     license = licenses.bsd3;
     maintainers = with maintainers; [ ];
   };

diff --git a/pkgs/development/python-modules/scikitlearn/default.nix b/pkgs/development/python-modules/scikitlearn/default.nix
@@ -61,7 +61,7 @@ buildPythonPackage rec {
 
   meta = with stdenv.lib; {
     description = "A set of python modules for machine learning and data mining";
-    homepage = "http://scikit-learn.org";
+    homepage = "https://scikit-learn.org";
     license = licenses.bsd3;
     maintainers = with maintainers; [ ];
   };

diff --git a/pkgs/development/python-modules/scrapy/default.nix b/pkgs/development/python-modules/scrapy/default.nix
@@ -26,7 +26,7 @@
 }:
 
 buildPythonPackage rec {
-  version = "2.0.1";
+  version = "2.1.0";
   pname = "Scrapy";
 
   disabled = isPy27;
@@ -78,7 +78,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "85581a01f4160a103ca9906ffa4e44474f4ecd1685f0934728892c58ebf111f6";
+    sha256 = "640aea0f9be9b055f5cfec5ab78ee88bb37a5be3809b138329bd2af51392ec7f";
   };
 
   postInstall = ''

diff --git a/pkgs/development/python-modules/snitun/default.nix b/pkgs/development/python-modules/snitun/default.nix
@@ -1,4 +1,6 @@
-{ lib, stdenv, buildPythonPackage, python, fetchFromGitHub, attrs, cryptography, async-timeout, pytest-aiohttp, pytest }:
+{ lib, stdenv, buildPythonPackage, python, fetchFromGitHub
+, attrs, cryptography, async-timeout, pytest-aiohttp, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "snitun";
@@ -13,12 +15,14 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ attrs cryptography async-timeout ];
 
-  checkInputs = [ pytest pytest-aiohttp ];
+  checkInputs = [ pytestCheckHook pytest-aiohttp ];
 
-  checkPhase = ''
-    # https://github.com/NabuCasa/snitun/issues/61
-    pytest ${lib.optionalString stdenv.isDarwin "-k 'not test_multiplexer_data_channel_abort_full'"} tests/
-  '';
+  disabledTests = lib.optionals stdenv.isDarwin [
+    "test_multiplexer_data_channel_abort_full" # https://github.com/NabuCasa/snitun/issues/61
+    # port binding conflicts
+    "test_snitun_single_runner_timeout"
+    "test_snitun_single_runner_throttling"
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/nabucasa/snitun";

diff --git a/pkgs/development/python-modules/subdownloader/default.nix b/pkgs/development/python-modules/subdownloader/default.nix
@@ -59,7 +59,7 @@ buildPythonPackage rec {
 
   meta = with stdenv.lib; {
     description = "Tool for automatic download/upload subtitles for videofiles using fast hashing";
-    homepage = "http://www.subdownloader.net";
+    homepage = "https://www.subdownloader.net";
     license = licenses.gpl3;
   };
 

diff --git a/pkgs/development/python-modules/untangle/default.nix b/pkgs/development/python-modules/untangle/default.nix
@@ -18,7 +18,7 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Convert XML documents into Python objects";
-    homepage = "http://github.com/stchris/untangle";
+    homepage = "https://github.com/stchris/untangle";
     license = licenses.mit;
     maintainers = [ maintainers.arnoldfarkas ];
   };

diff --git a/pkgs/development/tools/analysis/tflint/default.nix b/pkgs/development/tools/analysis/tflint/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "tflint";
-  version = "0.15.4";
+  version = "0.15.5";
 
   src = fetchFromGitHub {
     owner = "terraform-linters";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1z98zy04dj4hj94k9c9r1sfw167s3ywpxnjbylj7nsyxdlvwj37j";
+    sha256 = "0mdxs019vzpfxaqkw4nb79p3rydril0ihbn55n4yyh0fznv6zzxi";
   };
 
-  modSha256 = "1j6vflvg2k544r0kkdiw64n6v467c0kr7l2m39h8yjbyjbmwl5xz";
+  modSha256 = "0ksblhra7ln4ryggr2x8fzl8a7ljz5zdjgdxz82c75wd7wdbw8f5";
 
   subPackages = [ "." ];
 

diff --git a/pkgs/development/tools/cloud-nuke/default.nix b/pkgs/development/tools/cloud-nuke/default.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "cloud-nuke";
-  version = "0.1.7";
+  version = "0.1.18";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = pname;
     rev = "v${version}";
-    sha256 = "054z6v13x55x9l5xnixxxszj8k2wa09b5ld2wq4gm4hc273s2m4k";
+    sha256 = "1amk9bjrc9svvgllif2vr6xx7kc3xmwjbyb8prnm5zp82hymk5f1";
   };
 
   goPackagePath = "github.com/gruntwork-io/cloud-nuke";

diff --git a/pkgs/development/tools/cloud-nuke/deps.nix b/pkgs/development/tools/cloud-nuke/deps.nix
diff --git a/pkgs/development/tools/jazzy/Gemfile.lock b/pkgs/development/tools/jazzy/Gemfile.lock
@@ -12,10 +12,10 @@ GEM
       json (>= 1.5.1)
     atomos (0.1.3)
     claide (1.0.3)
-    cocoapods (1.8.4)
+    cocoapods (1.9.1)
       activesupport (>= 4.0.2, < 5)
       claide (>= 1.0.2, < 2.0)
-      cocoapods-core (= 1.8.4)
+      cocoapods-core (= 1.9.1)
       cocoapods-deintegrate (>= 1.0.3, < 2.0)
       cocoapods-downloader (>= 1.2.2, < 2.0)
       cocoapods-plugins (>= 1.0.0, < 2.0)
@@ -30,13 +30,15 @@ GEM
       molinillo (~> 0.6.6)
       nap (~> 1.0)
       ruby-macho (~> 1.4)
-      xcodeproj (>= 1.11.1, < 2.0)
-    cocoapods-core (1.8.4)
+      xcodeproj (>= 1.14.0, < 2.0)
+    cocoapods-core (1.9.1)
       activesupport (>= 4.0.2, < 6)
       algoliasearch (~> 1.0)
       concurrent-ruby (~> 1.1)
       fuzzy_match (~> 2.0.4)
       nap (~> 1.0)
+      netrc (~> 0.11)
+      typhoeus (~> 1.0)
     cocoapods-deintegrate (1.0.4)
     cocoapods-downloader (1.3.0)
     cocoapods-plugins (1.0.0)
@@ -46,18 +48,20 @@ GEM
     cocoapods-trunk (1.4.1)
       nap (>= 0.8, < 2.0)
       netrc (~> 0.11)
-    cocoapods-try (1.1.0)
+    cocoapods-try (1.2.0)
     colored2 (3.1.2)
-    concurrent-ruby (1.1.5)
+    concurrent-ruby (1.1.6)
     escape (0.0.4)
-    ffi (1.11.3)
+    ethon (0.12.0)
+      ffi (>= 1.3.0)
+    ffi (1.12.2)
     fourflusher (2.3.1)
     fuzzy_match (2.0.4)
     gh_inspector (1.1.3)
     httpclient (2.8.3)
     i18n (0.9.5)
       concurrent-ruby (~> 1.0)
-    jazzy (0.13.1)
+    jazzy (0.13.3)
       cocoapods (~> 1.5)
       mustache (~> 1.1)
       open4
@@ -68,25 +72,27 @@ GEM
       xcinvoke (~> 0.3.0)
     json (2.3.0)
     liferaft (0.0.6)
-    minitest (5.13.0)
+    minitest (5.14.0)
     molinillo (0.6.6)
     mustache (1.1.1)
     nanaimo (0.2.6)
     nap (1.1.0)
     netrc (0.11.0)
     open4 (1.3.4)
     redcarpet (3.5.0)
-    rouge (3.14.0)
+    rouge (3.18.0)
     ruby-macho (1.4.0)
-    sassc (2.2.1)
+    sassc (2.3.0)
       ffi (~> 1.9)
     sqlite3 (1.4.2)
     thread_safe (0.3.6)
-    tzinfo (1.2.6)
+    typhoeus (1.3.1)
+      ethon (>= 0.9.0)
+    tzinfo (1.2.7)
       thread_safe (~> 0.1)
     xcinvoke (0.3.0)
       liferaft (~> 0.0.6)
-    xcodeproj (1.14.0)
+    xcodeproj (1.16.0)
       CFPropertyList (>= 2.3.3, < 4.0)
       atomos (~> 0.1.3)
       claide (>= 1.0.2, < 2.0)

diff --git a/pkgs/development/tools/jazzy/gemset.nix b/pkgs/development/tools/jazzy/gemset.nix
@@ -57,21 +57,21 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "007ssx75588ji2d8l8s6c95dng1c7b6yacng8nngpy7maijzjgzc";
+      sha256 = "0wxr81qy4jsbxl066nlfp8zlqk31i6fsmd7f01xmi9bv04990hrs";
       type = "gem";
     };
-    version = "1.8.4";
+    version = "1.9.1";
   };
   cocoapods-core = {
-    dependencies = ["activesupport" "algoliasearch" "concurrent-ruby" "fuzzy_match" "nap"];
+    dependencies = ["activesupport" "algoliasearch" "concurrent-ruby" "fuzzy_match" "nap" "netrc" "typhoeus"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0zcisqb404828n5d3lbk9y2yyx8v2yr6rk1l8y9a4i1hp743fiad";
+      sha256 = "0c1679fkyp06dwsh93r0ldzly9vc74g0br4jdngwvdl4g0j4fyzc";
       type = "gem";
     };
-    version = "1.8.4";
+    version = "1.9.1";
   };
   cocoapods-deintegrate = {
     groups = ["default"];
@@ -132,12 +132,14 @@
     version = "1.4.1";
   };
   cocoapods-try = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1gf2zjmcjhh9psq15yfy82wz5jnlihf5bcw79f8hlv4cnqyspncj";
+      sha256 = "1znyp625rql37ivb5rk9fk9564cmax8icxfr041ysivpdrn98nql";
       type = "gem";
     };
-    version = "1.1.0";
+    version = "1.2.0";
   };
   colored2 = {
     source = {
@@ -152,10 +154,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1x07r23s7836cpp5z9yrlbpljcxpax14yw4fy4bnp6crhr6x24an";
+      sha256 = "094387x4yasb797mv07cs3g6f08y56virc2rjcpb1k79rzaj3nhl";
       type = "gem";
     };
-    version = "1.1.5";
+    version = "1.1.6";
   };
   escape = {
     source = {
@@ -165,15 +167,26 @@
     };
     version = "0.0.4";
   };
+  ethon = {
+    dependencies = ["ffi"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0gggrgkcq839mamx7a8jbnp2h7x2ykfn34ixwskwb0lzx2ak17g9";
+      type = "gem";
+    };
+    version = "0.12.0";
+  };
   ffi = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "10ay35dm0lkcqprsiya6q2kwvyid884102ryipr4vrk790yfp8kd";
+      sha256 = "10lfhahnnc91v63xpvk65apn61pib086zha3z5sp1xk9acfx12h4";
       type = "gem";
     };
-    version = "1.11.3";
+    version = "1.12.2";
   };
   fourflusher = {
     groups = ["default"];
@@ -230,10 +243,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0917v3dk9ks0apr0srk9sm6agk47iyh5bzfxqpkhd4dfgb4vpvjx";
+      sha256 = "1iv98hfmxf1vib63bq8l0wgx5n8kw2kmsj55y2vs04f2kcav3n4n";
       type = "gem";
     };
-    version = "0.13.1";
+    version = "0.13.3";
   };
   json = {
     groups = ["default"];
@@ -258,10 +271,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0w16p7cvslh3hxd3cia8jg4pd85z7rz7xqb16vh42gj4rijn8rmi";
+      sha256 = "0g73x65hmjph8dg1h3rkzfg7ys3ffxm35hj35grw75fixmq53qyz";
       type = "gem";
     };
-    version = "5.13.0";
+    version = "5.14.0";
   };
   molinillo = {
     groups = ["default"];
@@ -332,10 +345,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0k5jrp0qc9p61mfcwyn1a7dajmkw04z6y76wa8a0axh1v2wrw8ld";
+      sha256 = "1n9h0ls2a2zq0bcsw31wxci1wdxb8s3vglfadxpcs6b04vkf6nqq";
       type = "gem";
     };
-    version = "3.14.0";
+    version = "3.18.0";
   };
   ruby-macho = {
     groups = ["default"];
@@ -353,10 +366,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "09bnid7r5z5hcin5hykvpvv8xig27wbbckxwis60z2aaxq4j9siz";
+      sha256 = "1qzfnvb8khvc6w2sn3k91mndc2w50xxx5c84jkr6xdxlmaq1a3kg";
       type = "gem";
     };
-    version = "2.2.1";
+    version = "2.3.0";
   };
   sqlite3 = {
     groups = ["default"];
@@ -376,16 +389,27 @@
     };
     version = "0.3.6";
   };
+  typhoeus = {
+    dependencies = ["ethon"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0cni8b1idcp0dk8kybmxydadhfpaj3lbs99w5kjibv8bsmip2zi5";
+      type = "gem";
+    };
+    version = "1.3.1";
+  };
   tzinfo = {
     dependencies = ["thread_safe"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "04f18jdv6z3zn3va50rqq35nj3izjpb72fnf21ixm7vanq6nc4fp";
+      sha256 = "1i3jh086w1kbdj3k5l60lc3nwbanmzdf8yjj3mlrx9b2gjjxhi9r";
       type = "gem";
     };
-    version = "1.2.6";
+    version = "1.2.7";
   };
   xcinvoke = {
     dependencies = ["liferaft"];
@@ -402,9 +426,9 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1h9iba53mrb663qdqzpfbdwkwzqv7hndd0df71yr2kj2hzwjmkvb";
+      sha256 = "1bkk8y6lzd86w9yx72hd1nil3fkk5f0v3il9vm554gzpl6dhc2bi";
       type = "gem";
     };
-    version = "1.14.0";
+    version = "1.16.0";
   };
 }
diff --git a/pkgs/development/tools/micronaut/default.nix b/pkgs/development/tools/micronaut/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "micronaut";
-  version = "1.3.2";
+  version = "1.3.4";
 
   src = fetchzip {
     url = "https://github.com/micronaut-projects/micronaut-core/releases/download/v${version}/${pname}-${version}.zip";
-    sha256 = "0jwvbymwaz4whw08n9scz6vk57sx7l3qddh4m5dlv2cxishwf7n3";
+    sha256 = "0mddr6jw7bl8k4iqfq3sfpxq8fffm2spi9xwdr4cskkw4qdgrrpz";
   };
 
   nativeBuildInputs = [ makeWrapper installShellFiles ];

diff --git a/pkgs/development/tools/misc/remarkable/remarkable-toolchain/default.nix b/pkgs/development/tools/misc/remarkable/remarkable-toolchain/default.nix
@@ -0,0 +1,36 @@
+{ stdenv, fetchurl, libarchive, python3, file }:
+
+stdenv.mkDerivation rec {
+  pname = "remarkable-toolchain";
+  version = "1.8-23.9.2019";
+
+  src = fetchurl {
+    url = "https://remarkable.engineering/oecore-x86_64-cortexa9hf-neon-toolchain-zero-gravitas-${version}.sh";
+    sha256 = "6299955721bcd9bef92a87ad3cfe4d31df8e2da95b0c4b2cdded4431aa6748b0";
+  };
+
+  nativeBuildInputs = [
+    libarchive
+    python3
+    file
+  ];
+
+  unpackCmd = "mkdir src; install $curSrc src/install-toolchain.sh";
+
+  dontBuild = true;
+
+  installPhase = ''
+    patchShebangs install-toolchain.sh
+    sed -i -e '3,9d' install-toolchain.sh # breaks PATH
+    sed -i 's|PYTHON=.*$|PYTHON=${python3}/bin/python|' install-toolchain.sh
+    ./install-toolchain.sh -D -y -d $out
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A toolchain for cross-compiling to reMarkable tablets";
+    homepage = "https://remarkable.engineering/";
+    license = licenses.gpl2;
+    maintainers = [ maintainers.nickhu ];
+    platforms = platforms.x86_64;
+  };
+}
diff --git a/pkgs/development/web/remarkjs/default.nix b/pkgs/development/web/remarkjs/default.nix
@@ -60,7 +60,7 @@ in stdenv.mkDerivation rec {
   '';
 
   meta = {
-    homepage = "http://remarkjs.com";
+    homepage = "https://remarkjs.com";
     description = "A simple, in-browser, markdown-driven slideshow tool";
     maintainers = [];
     platforms = stdenv.lib.platforms.linux;

diff --git a/pkgs/games/chocolate-doom/default.nix b/pkgs/games/chocolate-doom/default.nix
@@ -1,17 +1,22 @@
-{ stdenv, autoreconfHook, pkgconfig, SDL, SDL_mixer, SDL_net, fetchurl }:
+{ stdenv, autoreconfHook, pkgconfig, SDL2, SDL2_mixer, SDL2_net, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
-  name = "chocolate-doom-2.3.0";
-  src = fetchurl {
-    url = "https://github.com/chocolate-doom/chocolate-doom/archive/${name}.tar.gz";
-    sha256 = "0i57smxmbhxj0wgvxq845ba9zsn5nx5wmzkl71rdchyd4q5jmida";
+  pname = "chocolate-doom";
+  version = "3.0.0";
+
+  src = fetchFromGitHub {
+    owner = "chocolate-doom";
+    repo = pname;
+    rev = "${pname}-${version}";
+    sha256 = "0ajzb767wyj8vzhjpsmgslw42b0155ji4alk26shxl7k5ijbzn0j";
   };
-  nativeBuildInputs = [ autoreconfHook pkgconfig ];
-  buildInputs = [ SDL SDL_mixer SDL_net ];
-  patchPhase = ''
+
+  postPatch = ''
     sed -e 's#/games#/bin#g' -i src{,/setup}/Makefile.am
   '';
 
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ SDL2 SDL2_mixer SDL2_net ];
   enableParallelBuilding = true;
 
   meta = {

diff --git a/pkgs/misc/drivers/epson-escpr2/default.nix b/pkgs/misc/drivers/epson-escpr2/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "epson-inkjet-printer-escpr2";
-  version = "1.1.1";
+  version = "1.1.11";
 
   src = fetchurl {
     # To find new versions, visit
@@ -11,10 +11,10 @@ stdenv.mkDerivation rec {
     # version.  
     # NOTE: Don't forget to update the webarchive link too!
     urls = [ 
-      "https://download3.ebz.epson.net/dsc/f/03/00/09/72/04/c6d928e83e558c4ba1e7e8bcb5c1fe080b8095eb/epson-inkjet-printer-escpr2-1.1.1-1lsb3.2.src.rpm"
-      "https://web.archive.org/web/https://download3.ebz.epson.net/dsc/f/03/00/09/72/04/c6d928e83e558c4ba1e7e8bcb5c1fe080b8095eb/epson-inkjet-printer-escpr2-1.1.1-1lsb3.2.src.rpm"
+      "https://download3.ebz.epson.net/dsc/f/03/00/11/01/98/8ff121831d0a6be76e86b87c78178f3c93df6d0f/epson-inkjet-printer-escpr2-1.1.11-1lsb3.2.src.rpm"
+      "https://web.archive.org/web/20200425154102/https://download3.ebz.epson.net/dsc/f/03/00/11/01/98/8ff121831d0a6be76e86b87c78178f3c93df6d0f/epson-inkjet-printer-escpr2-1.1.11-1lsb3.2.src.rpm"
     ];
-    sha256 = "02vdlhvinsx6vsjq172b2c1vrfzkg0w9j5lbsnjvj6yq3yqz5b5q";
+    sha256 = "1gcdzmqli7jycljm66mdssivb3lk223ih6zg0l3lyn7hj2gbkinm";
   };
 
   patches = [ ./cups-filter-ppd-dirs.patch ];
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
       Refer to the description of epson-escpr for usage.
     '';
     license = licenses.gpl2;
-    maintainers = with maintainers; [ ma9e ];
+    maintainers = with maintainers; [ ma9e ma27 ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/misc/emulators/snes9x-gtk/default.nix b/pkgs/misc/emulators/snes9x-gtk/default.nix
@@ -1,25 +1,22 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, wrapGAppsHook, intltool, pkgconfig
-, SDL2, zlib, gtk3, libxml2, libXv, epoxy, minizip, portaudio }:
+{ stdenv, fetchFromGitHub, meson, ninja, pkgconfig
+, SDL2, zlib, gtk3, libxml2, libXv, epoxy, minizip, pulseaudio, portaudio }:
 
 stdenv.mkDerivation rec {
   pname = "snes9x-gtk";
-  version = "1.57";
+  version = "1.60";
 
   src = fetchFromGitHub {
     owner = "snes9xgit";
     repo = "snes9x";
     rev = version;
-    sha256 = "1jcvj2l03b98iz6aq4x747vfz7i6h6j339z4brj4vz71s11vn31a";
+    sha256 = "12hpn7zcdvp30ldpw2zf115yjqv55n1ldjbids7vx0lvbpr06dm1";
   };
 
   enableParallelBuilding = true;
-  nativeBuildInputs = [ autoreconfHook wrapGAppsHook intltool pkgconfig ];
-  buildInputs = [ SDL2 zlib gtk3 libxml2 libXv epoxy minizip portaudio ];
+  nativeBuildInputs = [ meson ninja pkgconfig ];
+  buildInputs = [ SDL2 zlib gtk3 libxml2 libXv epoxy minizip pulseaudio portaudio ];
 
-  preAutoreconf = ''
-    cd gtk
-    intltoolize
-  '';
+  preConfigure = "cd gtk";
 
   meta = with stdenv.lib; {
     homepage = "http://www.snes9x.com";

diff --git a/pkgs/misc/vim-plugins/generated.nix b/pkgs/misc/vim-plugins/generated.nix
diff --git a/pkgs/misc/vim-plugins/update.py b/pkgs/misc/vim-plugins/update.py
@@ -414,6 +414,7 @@ def generate_nix(plugins: List[Tuple[str, str, Plugin]], outfile: str):
       rev = "{plugin.commit}";
       sha256 = "{plugin.sha256}";{submodule_attr}
     }};
+    meta.homepage = "https://github.com/{owner}/{repo}/";
   }};
 """
             )

diff --git a/pkgs/os-specific/linux/ell/default.nix b/pkgs/os-specific/linux/ell/default.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation rec {
   pname = "ell";
-  version = "0.30";
+  version = "0.31";
 
   outputs = [ "out" "dev" ];
 
   src = fetchgit {
      url = "https://git.kernel.org/pub/scm/libs/${pname}/${pname}.git";
      rev = version;
-     sha256 = "0kiglgc02a6hqi1nhnl4d8lxax8b1fljp50pvqswrnbh7pgb5676";
+     sha256 = "1qlpc906xd78fzxvvj2kxi3aikgnw0c0h3x620s131apax4qrnqa";
   };
 
   patches = [

diff --git a/pkgs/os-specific/linux/hostapd/default.nix b/pkgs/os-specific/linux/hostapd/default.nix
@@ -17,7 +17,13 @@ stdenv.mkDerivation rec {
       # Note: fetchurl seems to be unhappy with openwrt git
       # server's URLs containing semicolons. Using the github mirror instead.
       url = "https://raw.githubusercontent.com/openwrt/openwrt/master/package/network/services/hostapd/patches/300-noscan.patch";
-      sha256 = "04wg4yjc19wmwk6gia067z99gzzk9jacnwxh5wyia7k5wg71yj5k";})
+      sha256 = "04wg4yjc19wmwk6gia067z99gzzk9jacnwxh5wyia7k5wg71yj5k";
+    })
+    (fetchurl {
+      name = "CVE-2019-16275.patch";
+      url = "https://w1.fi/security/2019-7/0001-AP-Silently-ignore-management-frame-from-unexpected-.patch";
+      sha256 = "15xjyy7crb557wxpx898b5lnyblxghlij0xby5lmj9hpwwss34dz";
+    })
   ];
 
   outputs = [ "out" "man" ];

diff --git a/pkgs/os-specific/linux/iwd/default.nix b/pkgs/os-specific/linux/iwd/default.nix
@@ -13,12 +13,12 @@
 
 stdenv.mkDerivation rec {
   pname = "iwd";
-  version = "1.6";
+  version = "1.7";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/network/wireless/iwd.git";
     rev = version;
-    sha256 = "0c38c7a234cwdd5y1brq4w56xszs8zlp57rr3nvgp8z8djcy1qvx";
+    sha256 = "1qi25qav1rv8gm5lbrip8ayq5vwynmyv2q4ar7bbmnjh6cglvyh2";
   };
 
   nativeBuildInputs = [

diff --git a/pkgs/servers/home-assistant/0001-setup.py-relax-dependencies.patch b/pkgs/servers/home-assistant/0001-setup.py-relax-dependencies.patch
@@ -1,4 +1,4 @@
-From 80f39643bb4d25f8ffcbd92804844961b303f4d0 Mon Sep 17 00:00:00 2001
+From 679364e1cd95dc7179dbd3114ec35b282fbcb0af Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
 Date: Thu, 9 Apr 2020 07:20:46 +0100
 Subject: [PATCH] setup.py: relax dependencies
@@ -8,11 +8,11 @@ Content-Transfer-Encoding: 8bit
 
 Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
 ---
- setup.py | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
+ setup.py | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
 
 diff --git a/setup.py b/setup.py
-index f53af0ee1..ff4227487 100755
+index e0daacd98b..7166f1f228 100755
 --- a/setup.py
 +++ b/setup.py
 @@ -32,10 +32,10 @@ PROJECT_URLS = {
@@ -28,7 +28,12 @@ index f53af0ee1..ff4227487 100755
      "bcrypt==3.1.7",
      "certifi>=2019.11.28",
      "ciso8601==2.1.3",
-@@ -47,9 +47,9 @@ REQUIRES = [
+@@ -43,13 +43,13 @@ REQUIRES = [
+     "jinja2>=2.11.1",
+     "PyJWT==1.7.1",
+     # PyJWT has loose dependency. We want the latest one.
+-    "cryptography==2.8",
++    "cryptography>=2.8",
      "pip>=8.0.3",
      "python-slugify==4.0.0",
      "pytz>=2019.03",
@@ -42,5 +47,5 @@ index f53af0ee1..ff4227487 100755
      "voluptuous-serialize==2.3.0",
  ]
 -- 
-2.25.1
+2.26.1
 
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "0.108.2";
+  version = "0.108.7";
   components = {
     "abode" = ps: with ps; [ ]; # missing inputs: abodepy
     "acer_projector" = ps: with ps; [ pyserial];

diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
@@ -67,7 +67,7 @@ let
   extraBuildInputs = extraPackages py.pkgs;
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "0.108.2";
+  hassVersion = "0.108.7";
 
 in with py.pkgs; buildPythonApplication rec {
   pname = "homeassistant";
@@ -86,7 +86,7 @@ in with py.pkgs; buildPythonApplication rec {
     owner = "home-assistant";
     repo = "home-assistant";
     rev = version;
-    sha256 = "0v4i1ak7pkpycas0mzdmxgc42xgfymwx2b0a2a4h13c4z46pbs2l";
+    sha256 = "0nk1615ms6nlmhgmsgsknc6m7b19baan8m4kr4s97njngiardxm7";
   };
 
   propagatedBuildInputs = [

diff --git a/pkgs/servers/home-assistant/frontend.nix b/pkgs/servers/home-assistant/frontend.nix
@@ -4,11 +4,11 @@ buildPythonPackage rec {
   # the frontend version corresponding to a specific home-assistant version can be found here
   # https://github.com/home-assistant/home-assistant/blob/master/homeassistant/components/frontend/manifest.json
   pname = "home-assistant-frontend";
-  version = "20200407.2";
+  version = "20200418.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0krwn67bkybjb69daik6dki5hm36xs4nbfwqkh0q7ami1xr1f56d";
+    sha256 = "12px8znc6nw5ndg4f28lvfpqsnzi00b5qgpdj9jwny0fss4aglnb";
   };
 
   # no Python tests implemented

diff --git a/pkgs/servers/monitoring/prometheus/default.nix b/pkgs/servers/monitoring/prometheus/default.nix
@@ -1,13 +1,13 @@
 { lib, go, buildGoPackage, fetchFromGitHub, mkYarnPackage }:
 
 let
-  version = "2.17.1";
+  version = "2.17.2";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "prometheus";
     repo = "prometheus";
-    sha256 = "0ai9l7gx25x5m07617c0cjzwxknywwq822fn2q5b850hvs48whyv";
+    sha256 = "1q89c98rdypfcw8sqzipwlmxg8vrm4b9vdryygnacxv4am7bxsia";
   };
 
   webui = mkYarnPackage {

diff --git a/pkgs/servers/serviio/default.nix b/pkgs/servers/serviio/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    homepage = "http://serviio.org";
+    homepage = "https://serviio.org";
     description = "UPnP Media Streaming Server";
     longDescription = ''
       Serviio is a free media server. It allows you to stream your media files (music, video or images)

diff --git a/pkgs/servers/web-apps/restya-board/default.nix b/pkgs/servers/web-apps/restya-board/default.nix
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     description = "Web-based kanban board";
     license = licenses.osl3;
-    homepage = "http://restya.com";
+    homepage = "https://restya.com";
     maintainers = with maintainers; [ tstrobel ];
     platforms = platforms.linux;
   };

diff --git a/pkgs/tools/admin/awsweeper/default.nix b/pkgs/tools/admin/awsweeper/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "awsweeper";
-  version = "0.6.0";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "cloudetc";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0sbd1jgzz3rxxwgbni885zvvcznfc51imaxwv7f064290iqlbrv4";
+    sha256 = "1ybrrpnp6rh7rcwihww43cvhfhzzyy51rdk1hwy9ljpkg37k4y28";
   };
 
-  modSha256 = "14yvf0svh7xqpc2y7xr94pc6r7d3iv2nsr8qs3f5q29hdc5hv3fs";
+  modSha256 = "07zz6wf9cq3wylihi9fx0rd85iybnq5z5c9gqw1lhpvqcrad4491";
 
   meta = with lib; {
     description = "A tool to clean out your AWS account";

diff --git a/pkgs/tools/filesystems/ciopfs/default.nix b/pkgs/tools/filesystems/ciopfs/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   makeFlags = [ "DESTDIR=$(out)" "PREFIX=" ];
 
   meta = {
-    homepage = "http://www.brain-dump.org/projects/ciopfs/";
+    homepage = "https://www.brain-dump.org/projects/ciopfs/";
     description = "A case-insensitive filesystem layered on top of any other filesystem";
     license = stdenv.lib.licenses.gpl2;
     platforms = stdenv.lib.platforms.linux;

diff --git a/pkgs/tools/filesystems/darling-dmg/default.nix b/pkgs/tools/filesystems/darling-dmg/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   CXXFLAGS = [ "-DU_USING_ICU_NAMESPACE=1" ];
 
   meta = {
-    homepage = "http://www.darlinghq.org/";
+    homepage = "https://www.darlinghq.org/";
     description = "Darling lets you open macOS dmgs on Linux";
     platforms = stdenv.lib.platforms.linux;
     license = stdenv.lib.licenses.gpl3;

diff --git a/pkgs/tools/graphics/pgf/default.nix b/pkgs/tools/graphics/pgf/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation {
 # configureFlags = optional static "--enable-static --disable-shared";
 
   meta = {
-    homepage = "http://www.libpgf.org/";
+    homepage = "https://www.libpgf.org/";
     description = "Progressive Graphics Format command line program";
     license = stdenv.lib.licenses.lgpl21Plus;
     platforms = stdenv.lib.platforms.linux;

diff --git a/pkgs/tools/inputmethods/ibus/default.nix b/pkgs/tools/inputmethods/ibus/default.nix
@@ -16,7 +16,6 @@
 , gtk2
 , gtk3
 , gtk-doc
-, runCommand
 , isocodes
 , cldr-emoji-annotation
 , unicode-character-database
@@ -48,14 +47,6 @@ let
       makeWrapper ${glib.dev}/bin/glib-mkenums $out/bin/glib-mkenums --unset PYTHONPATH
     '';
   };
-  # make-dconf-override-db.sh needs to execute dbus-launch in the sandbox,
-  # it will fail to read /etc/dbus-1/session.conf unless we add this flag
-  dbus-launch = runCommand "sandbox-dbus-launch" {
-    nativeBuildInputs = [ makeWrapper ];
-  } ''
-      makeWrapper ${dbus}/bin/dbus-launch $out/bin/dbus-launch \
-        --add-flags --config-file=${dbus.daemon}/share/dbus-1/session.conf
-  '';
 in
 
 stdenv.mkDerivation rec {
@@ -80,7 +71,7 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "dev" "installedTests" ];
 
   postPatch = ''
-    patchShebangs --build data/dconf/make-dconf-override-db.sh
+    echo \#!${runtimeShell} > data/dconf/make-dconf-override-db.sh
     cp ${buildPackages.gtk-doc}/share/gtk-doc/data/gtk-doc.make .
   '';
 
@@ -114,7 +105,6 @@ stdenv.mkDerivation rec {
     python3BuildEnv
     vala
     wrapGAppsHook
-    dbus-launch
   ];
 
   propagatedBuildInputs = [

diff --git a/pkgs/tools/misc/diffoscope/default.nix b/pkgs/tools/misc/diffoscope/default.nix
@@ -9,13 +9,15 @@
 # Note: when upgrading this package, please run the list-missing-tools.sh script as described below!
 python3Packages.buildPythonApplication rec {
   pname = "diffoscope";
-  version = "138";
+  version = "142";
 
   src = fetchurl {
     url    = "https://diffoscope.org/archive/diffoscope-${version}.tar.bz2";
-    sha256 = "171nz5n4dayr7bj04h0x282vdk92kp7lgarnb3x0md91m2i9x997";
+    sha256 = "0c6lvppghw9ynjg2radr8z3fc6lpgmgwr6kxyih7q4rxqf4gfv6i";
   };
 
+  outputs = [ "out" "man" ];
+
   patches = [
     ./ignore_links.patch
   ];