NixOS · Jul 2, 2018 · Jul 4, 2018 · Jul 4, 2018 · Jul 9, 2018 · Jul 10, 2018
diff --git a/nixos/release-small.nix b/nixos/release-small.nix
@@ -38,7 +38,7 @@ in rec {
         login
         misc
         nat
-        nfs3
+        #nfs3  FIXME: temporarily disabled, see #43473
         openssh
         php-pcre
         predictable-interface-names

diff --git a/nixos/release.nix b/nixos/release.nix
@@ -334,8 +334,9 @@ in rec {
   tests.networking.scripted = callSubTests tests/networking.nix { networkd = false; };
   # TODO: put in networking.nix after the test becomes more complete
   tests.networkingProxy = callTest tests/networking-proxy.nix {};
-  tests.nfs3 = callTest tests/nfs.nix { version = 3; };
-  tests.nfs4 = callTest tests/nfs.nix { version = 4; };
+  # FIXME: temporarily disabled, see #43473
+  #tests.nfs3 = callTest tests/nfs.nix { version = 3; };
+  #tests.nfs4 = callTest tests/nfs.nix { version = 4; };
   tests.nginx = callTest tests/nginx.nix { };
   tests.nghttpx = callTest tests/nghttpx.nix { };
   tests.nix-ssh-serve = callTest tests/nix-ssh-serve.nix { };

diff --git a/pkgs/applications/kde/fetch.sh b/pkgs/applications/kde/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/applications/17.12.2/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/applications/17.12.3/ -A '*.tar.xz' )
diff --git a/pkgs/applications/kde/srcs.nix b/pkgs/applications/kde/srcs.nix
diff --git a/pkgs/applications/misc/dbeaver/default.nix b/pkgs/applications/misc/dbeaver/default.nix
@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation rec {
   name = "dbeaver-ce-${version}";
-  version = "5.1.2";
+  version = "5.1.3";
 
   desktopItem = makeDesktopItem {
     name = "dbeaver";
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://dbeaver.io/files/${version}/dbeaver-ce-${version}-linux.gtk.x86_64.tar.gz";
-    sha256 = "1p1klrasasc440qzxsn96lcgfib5qwhl508gvwrbslvmija6m6b2";
+    sha256 = "1znkr28pfpclq2gl2prllb3hwq9v9rj5xl7xarq0hsggzfg9n071";
   };
 
   installPhase = ''

diff --git a/pkgs/applications/networking/browsers/qutebrowser/default.nix b/pkgs/applications/networking/browsers/qutebrowser/default.nix
@@ -41,8 +41,13 @@ in python3Packages.buildPythonApplication rec {
   patches = fetchpatch {
     name = "CVE-2018-10895.patch";
     url = https://github.com/qutebrowser/qutebrowser/commit/c2ff32d92ba9bf40ff53498ee04a4124d4993c85.patch;
-    excludes = [ "tests/*" ];
-    sha256 = "0mdqa9w1p6cmli6976v4wi0sw9r4p5prkj7lzfd1877wk11c9c73";
+    excludes = [
+      "tests/end2end/data/misc/qutescheme_csrf.html"
+      "tests/end2end/features/qutescheme.feature"
+      "tests/end2end/test_invocations.py"
+      "tests/unit/browser/webkit/network/test_filescheme.py"
+    ];
+    sha256 = "0mf0b7659xfvg1v45v6kv8cb1cjzb9y30rvikn76bi3w10j9dysv";
   };
 
   # Needs tox

diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/beta.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/beta.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, dpkg, gnome2, atk, cairo, gdk_pixbuf, glib, freetype,
-fontconfig, dbus, libX11, xlibs, libXi, libXcursor, libXdamage, libXrandr,
+fontconfig, dbus, libX11, xorg, libXi, libXcursor, libXdamage, libXrandr,
 libXcomposite, libXext, libXfixes, libXrender, libXtst, libXScrnSaver, nss,
 nspr, alsaLib, cups, expat, udev
 }:
@@ -33,7 +33,7 @@ let
     nss
     stdenv.cc.cc
     udev
-    xlibs.libxcb
+    xorg.libxcb
   ];
 
 in

diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@@ -1,8 +1,10 @@
-{ stdenv, lib, fetchurl, dpkg, gnome2, atk, cairo, gdk_pixbuf, glib, freetype,
-fontconfig, dbus, libX11, xlibs, libXi, libXcursor, libXdamage, libXrandr,
-libXcomposite, libXext, libXfixes, libXrender, libXtst, libXScrnSaver, nss,
-nspr, alsaLib, cups, expat, udev
+{ stdenv, lib, fetchurl, dpkg, wrapGAppsHook
+, gnome3, gtk3, atk, cairo, pango, gdk_pixbuf, glib, freetype, fontconfig
+, dbus, libX11, xorg, libXi, libXcursor, libXdamage, libXrandr, libXcomposite
+, libXext, libXfixes, libXrender, libXtst, libXScrnSaver, nss, nspr, alsaLib
+, cups, expat, udev
 }:
+
 let
   rpath = lib.makeLibraryPath [
     alsaLib
@@ -15,9 +17,9 @@ let
     freetype
     gdk_pixbuf
     glib
-    gnome2.GConf
-    gnome2.gtk
-    gnome2.pango
+    gnome3.gconf
+    gtk3
+    pango
     libX11
     libXScrnSaver
     libXcomposite
@@ -33,57 +35,59 @@ let
     nss
     stdenv.cc.cc
     udev
-    xlibs.libxcb
+    xorg.libxcb
   ];
 
-in
-  stdenv.mkDerivation rec {
-    name = "signal-desktop-${version}";
+in stdenv.mkDerivation rec {
+  name = "signal-desktop-${version}";
+  version = "1.14.1";
 
-    version = "1.11.0";
+  src = fetchurl {
+    url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
+    sha256 = "1f54azqdfqa2yrzlp9b7pz7nswl5n3pgln38yxcvb3y5k6x0ljqp";
+  };
 
-    src =
-      if stdenv.system == "x86_64-linux" then
-        fetchurl {
-          url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-          sha256 = "0s3qlzm7iy9qxca2hlh1hq0dnjr7y5wxad1ssqgmyhxsif0nqm96";
-        }
-      else
-        throw "Signal for Desktop is not currently supported on ${stdenv.system}";
+  phases = [ "unpackPhase" "installPhase" ];
 
-    phases = [ "unpackPhase" "installPhase" ];
-    nativeBuildInputs = [ dpkg ];
-    unpackPhase = "dpkg-deb -x $src .";
-    installPhase = ''
-      mkdir -p $out
-      cp -R opt $out
+  nativeBuildInputs = [ dpkg wrapGAppsHook ];
 
-      mv ./usr/share $out/share
-      mv $out/opt/Signal $out/libexec
-      rmdir $out/opt
+  unpackPhase = "dpkg-deb -x $src .";
 
-      chmod -R g-w $out
+  installPhase = ''
+    mkdir -p $out
+    cp -R opt $out
 
-      # Patch signal
-      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-               --set-rpath ${rpath}:$out/libexec $out/libexec/signal-desktop
+    mv ./usr/share $out/share
+    mv $out/opt/Signal $out/libexec
+    rmdir $out/opt
 
-      # Symlink to bin
-      mkdir -p $out/bin
-      ln -s $out/libexec/signal-desktop $out/bin/signal-desktop
+    chmod -R g-w $out
 
-      # Fix the desktop link
-      substituteInPlace $out/share/applications/signal-desktop.desktop \
-        --replace /opt/Signal/signal-desktop $out/bin/signal-desktop
-    '';
+    # Patch signal
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+             --set-rpath ${rpath}:$out/libexec $out/libexec/signal-desktop
+    wrapProgram $out/libexec/signal-desktop \
+      --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.name}/" \
+      "''${gappsWrapperArgs[@]}"
+
+    # Symlink to bin
+    mkdir -p $out/bin
+    ln -s $out/libexec/signal-desktop $out/bin/signal-desktop
 
-    meta = {
-      description = "Signal Private Messenger for the Desktop.";
-      homepage    = https://signal.org/;
-      license     = lib.licenses.gpl3;
-      maintainers = with lib.maintainers; [ ixmatus primeos ];
-      platforms   = [
-        "x86_64-linux"
-      ];
-    };
-  }
+    # Fix the desktop link
+    substituteInPlace $out/share/applications/signal-desktop.desktop \
+      --replace /opt/Signal/signal-desktop $out/bin/signal-desktop
+  '';
+
+  meta = {
+    description = "Private, simple, and secure messenger";
+    longDescription = ''
+      Signal Desktop is an Electron application that links with your
+      "Signal Android" or "Signal iOS" app.
+    '';
+    homepage    = https://signal.org/;
+    license     = lib.licenses.gpl3;
+    maintainers = with lib.maintainers; [ ixmatus primeos ];
+    platforms   = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/applications/video/vlc/default.nix b/pkgs/applications/video/vlc/default.nix
@@ -1,88 +1,93 @@
-{ stdenv, fetchurl, xz, bzip2, perl, xorg, libdvdnav, libbluray
+{ stdenv, fetchurl, autoreconfHook
+, libarchive, perl, xorg, libdvdnav, libbluray
 , zlib, a52dec, libmad, faad2, ffmpeg, alsaLib
 , pkgconfig, dbus, fribidi, freefont_ttf, libebml, libmatroska
-, libvorbis, libtheora, speex, lua5, libgcrypt, libupnp
+, libvorbis, libtheora, speex, lua5, libgcrypt, libgpgerror, libupnp
 , libcaca, libpulseaudio, flac, schroedinger, libxml2, librsvg
-, mpeg2dec, udev, gnutls, avahi, libcddb, libjack2, SDL, SDL_image
+, mpeg2dec, systemd, gnutls, avahi, libcddb, libjack2, SDL, SDL_image
 , libmtp, unzip, taglib, libkate, libtiger, libv4l, samba, liboggz
-, libass, libva, libdvbpsi, libdc1394, libraw1394, libopus
-, libvdpau, libsamplerate, live555, fluidsynth
+, libass, libva-full, libdvbpsi, libdc1394, libraw1394, libopus
+, libvdpau, libsamplerate, live555, fluidsynth, wayland, wayland-protocols
 , onlyLibVLC ? false
-, qt4 ? null
-, withQt5 ? false, qtbase ? null, qtx11extras ? null
+, withQt5 ? true, qtbase ? null, qtsvg ? null, qtx11extras ? null
 , jackSupport ? false
 , fetchpatch
 }:
 
 with stdenv.lib;
 
-assert (withQt5 -> qtbase != null && qtx11extras != null);
-assert (!withQt5 -> qt4 != null);
+assert (withQt5 -> qtbase != null && qtsvg != null && qtx11extras != null);
 
 stdenv.mkDerivation rec {
   name = "vlc-${version}";
-  version = "2.2.8";
+  version = "3.0.3";
 
   src = fetchurl {
     url = "http://get.videolan.org/vlc/${version}/${name}.tar.xz";
-    sha256 = "1v32snw46rkgbdqdy3dssl2y13i8p2cr1cw1i18r6vdmiy24dw4v";
+    sha256 = "0lavzly8l0ll1d9iris9cnirgcs77g48lxj14058dxqkvd5v1a4v";
   };
 
-  # Comment-out the Qt 5.5 version check, as we do apply the relevant patch.
-  # https://trac.videolan.org/vlc/ticket/16497
-  postPatch = if (!withQt5) then null else
-    "sed '/I78ef29975181ee22429c9bd4b11d96d9e68b7a9c/s/^/: #/' -i configure";
-
-  buildInputs =
-    [ xz bzip2 perl zlib a52dec libmad faad2 ffmpeg alsaLib libdvdnav libdvdnav.libdvdread
-      libbluray dbus fribidi libvorbis libtheora speex lua5 libgcrypt
-      libupnp libcaca libpulseaudio flac schroedinger libxml2 librsvg mpeg2dec
-      udev gnutls avahi libcddb SDL SDL_image libmtp unzip taglib
-      libkate libtiger libv4l samba liboggz libass libdvbpsi libva
-      xorg.xlibsWrapper xorg.libXv xorg.libXvMC xorg.libXpm xorg.xcbutilkeysyms
-      libdc1394 libraw1394 libopus libebml libmatroska libvdpau libsamplerate live555
-      fluidsynth
-    ]
-    ++ [(if withQt5 then qtbase else qt4)]
-    ++ optional withQt5 qtx11extras
+  # VLC uses a *ton* of libraries for various pieces of functionality, many of
+  # which are not included here for no other reason that nobody has mentioned
+  # needing them
+  buildInputs = [
+    zlib a52dec libmad faad2 ffmpeg alsaLib libdvdnav libdvdnav.libdvdread
+    libbluray dbus fribidi libvorbis libtheora speex lua5 libgcrypt libgpgerror
+    libupnp libcaca libpulseaudio flac schroedinger libxml2 librsvg mpeg2dec
+    systemd gnutls avahi libcddb SDL SDL_image libmtp unzip taglib libarchive
+    libkate libtiger libv4l samba liboggz libass libdvbpsi libva-full
+    xorg.xlibsWrapper xorg.libXv xorg.libXvMC xorg.libXpm xorg.xcbutilkeysyms
+    libdc1394 libraw1394 libopus libebml libmatroska libvdpau libsamplerate live555
+    fluidsynth wayland wayland-protocols
+  ] ++ optionals withQt5    [ qtbase qtsvg qtx11extras ]
     ++ optional jackSupport libjack2;
 
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ autoreconfHook perl pkgconfig ];
+
+  enableParallelBuilding = true;
 
   LIVE555_PREFIX = live555;
 
-  preConfigure = ''
-    sed -e "s@/bin/echo@echo@g" -i configure
-  '' + optionalString withQt5 ''
-    # Make sure we only *add* "-std=c++11" to CXXFLAGS instead of overriding the
-    # values figured out by configure (for example "-g -O2").
-    sed -i -re '/^ *CXXFLAGS=("[^$"]+")? *$/s/CXXFLAGS="?/&-std=c++11 /' \
-      configure
-  '';
+  # vlc depends on a c11-gcc wrapper script which we don't have so we need to
+  # set the path to the compiler
+  BUILDCC = "${stdenv.cc}/bin/gcc";
 
-  configureFlags =
-    [ "--enable-alsa"
-      "--with-kde-solid=$out/share/apps/solid/actions"
-      "--enable-dc1394"
-      "--enable-ncurses"
-      "--enable-vdpau"
-      "--enable-dvdnav"
-      "--enable-samplerate"
-    ]
-    ++ optional onlyLibVLC  "--disable-vlc";
+  patches = [
+    (fetchpatch {
+      name = "vlc-qt5.11.patch";
+      url = "https://git.archlinux.org/svntogit/packages.git/plain/trunk/vlc-qt5.11.patch?h=packages/vlc";
+      sha256 = "0yh65bhhaz876cazhagnafs1dr61184lpj3y0m3y7k37bswykj8p";
+    })
+    (fetchpatch {
+      url = "https://github.com/videolan/vlc/commit/26e2d3906658c30f2f88f4b1bc9630ec43bf5525.patch";
+      sha256 = "0sm73cbzxva8sww526bh5yin1k2pdkvj826wdlmqnj7xf0f3mki4";
+    })
+  ];
 
-  enableParallelBuilding = true;
+  postPatch = ''
+    substituteInPlace configure \
+      --replace /bin/echo echo
 
-  preBuild = ''
-    substituteInPlace modules/text_renderer/freetype.c --replace \
-      /usr/share/fonts/truetype/freefont/FreeSerifBold.ttf \
-      ${freefont_ttf}/share/fonts/truetype/FreeSerifBold.ttf
+    substituteInPlace modules/text_renderer/freetype/platform_fonts.h --replace \
+      /usr/share/fonts/truetype/freefont ${freefont_ttf}/share/fonts/truetype
   '';
 
+  # https://github.com/NixOS/nixpkgs/pull/35124#issuecomment-370552830
+  postFixup = ''
+    find $out/lib/vlc/plugins -exec touch -d @1 '{}' ';'
+    $out/lib/vlc/vlc-cache-gen $out/vlc/plugins
+  '';
+
+  # Most of the libraries are auto-detected so we don't need to set a bunch of
+  # "--enable-foo" flags here
+  configureFlags = [
+    "--with-kde-solid=$out/share/apps/solid/actions"
+  ] ++ optional onlyLibVLC "--disable-vlc";
+
   meta = with stdenv.lib; {
     description = "Cross-platform media player and streaming server";
     homepage = http://www.videolan.org/vlc/;
-    platforms = platforms.linux;
     license = licenses.lgpl21Plus;
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/video/vlc/plugin.nix b/pkgs/applications/video/vlc/plugin.nix
@@ -5,7 +5,7 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "vlc-plugin-${version}";
-  version = "2.2.2"; # This 2.2.2 builds fine with vlc 2.2.4
+  version = "2.2.2"; # This 2.2.2 builds fine with vlc 3.0.3
 
   src = fetchgit {
     url = "https://code.videolan.org/videolan/npapi-vlc.git";

diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
@@ -197,27 +197,15 @@ rec {
   # Get revisions from
   # https://github.com/docker/docker-ce/tree/v${version}/components/engine/hack/dockerfile/install/*
 
-  docker_18_03 = dockerGen rec {
-    version = "18.03.1-ce";
-    rev = "9ee9f402cd1eba817c5591a64f1d770c87c421a4"; # git commit
-    sha256 = "1jm3jmcbkvvy3s8pi3xcpir6mwxjfbad46lbif4bnpjfd2r5irrx";
-    runcRev = "4fc53a81fb7c994640722ac585fa9ca548971871";
-    runcSha256 = "1ikqw39jn8dzb4snc4pcg3z85jb67ivskdhx028k17ss29bf4062";
-    containerdRev = "773c489c9c1b21a6d78b5c538cd395416ec50f88";
-    containerdSha256 = "0k1zjn0mpd7q3p5srxld2fr4k6ijzbk0r34r6w69sh0d0rd2fvbs";
-    tiniRev = "949e6facb77383876aeff8a6944dde66b3089574";
-    tiniSha256 = "0zj4kdis1vvc6dwn4gplqna0bs7v6d1y2zc8v80s3zi018inhznw";
-  };
-
-  docker_18_05 = dockerGen rec {
-    version = "18.05.0-ce";
-    rev = "f150324782643a5268a04e7d1a675587125da20e"; # git commit
-    sha256 = "0vgh03qwlfm25sm3yaa6vf5ap2ag575f814ccgcrp5zlcal13r0z";
-    runcRev = "4fc53a81fb7c994640722ac585fa9ca548971871";
-    runcSha256 = "1ikqw39jn8dzb4snc4pcg3z85jb67ivskdhx028k17ss29bf4062";
-    containerdRev = "773c489c9c1b21a6d78b5c538cd395416ec50f88";
-    containerdSha256 = "0k1zjn0mpd7q3p5srxld2fr4k6ijzbk0r34r6w69sh0d0rd2fvbs";
-    tiniRev = "949e6facb77383876aeff8a6944dde66b3089574";
-    tiniSha256 = "0zj4kdis1vvc6dwn4gplqna0bs7v6d1y2zc8v80s3zi018inhznw";
+  docker_18_06 = dockerGen rec {
+    version = "18.06.0-ce";
+    rev = "0ffa8257ec673ed6849b73b03fb01b0cac90fdb3"; # git commit
+    sha256 = "1w6jgqbc53pkgfkf2p6z5g316q1r5jvnw4lq11j4qdkw7vy8q5d9";
+    runcRev = "69663f0bd4b60df09991c08812a60108003fa340";
+    runcSha256 = "1l37r97l3ra4ph069w190d05r0a43s76nn9jvvlkbwrip1cp6gyq";
+    containerdRev = "d64c661f1d51c48782c9cec8fda7604785f93587";
+    containerdSha256 = "0pk1kii8bmlvziblrqwb88w5cd486pmb7vw8p7kcyn9lqsw32ria";
+    tiniRev = "fec3683b971d9c3ef73f284f176672c44b448662";
+    tiniSha256 = "1h20i3wwlbd8x4jr2gz68hgklh0lb0jj7y5xk1wvr8y58fip1rdn";
   };
 }
diff --git a/pkgs/applications/virtualization/virtualbox/default.nix b/pkgs/applications/virtualization/virtualbox/default.nix
@@ -21,10 +21,10 @@ let
   buildType = "release";
   # Manually sha256sum the extensionPack file, must be hex!
   # Do not forget to update the hash in ./guest-additions/default.nix!
-  extpack = "4c36d129f17dcab2bb37292022f1b1adfefa5f32a3161b0d5d40784bc8acf4d0";
-  extpackRev = "122591";
-  main = "0n1lip8lkz4qqq5ml47xldsx41919ncfh060i7yj51bhas604q6s";
-  version = "5.2.12";
+  extpack = "d90c1b0c89de19010f7c7fe7a675ac744067baf29a9966b034e97b5b2053b37e";
+  extpackRev = "123301";
+  main = "ee3af129a581ec4c1a3e777e98247f8943e976ce6edd24962bcaa5c53ed1f644";
+  version = "5.2.14";
 
   # See https://github.com/NixOS/nixpkgs/issues/672 for details
   extensionPack = requireFile rec {

diff --git a/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix b/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "http://download.virtualbox.org/virtualbox/${version}/VBoxGuestAdditions_${version}.iso";
-    sha256 = "b81d283d9ef88a44e7ac8983422bead0823c825cbfe80417423bd12de91b8046";
+    sha256 = "e149ff0876242204fe924763f9272f691242d6a6ad4538a128fb7dba770781de";
   };
 
   KERN_DIR = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";

diff --git a/pkgs/desktops/gnome-3/misc/geary/default.nix b/pkgs/desktops/gnome-3/misc/geary/default.nix
@@ -6,14 +6,14 @@
 
 let
   pname = "geary";
-  version = "0.12.2";
+  version = "0.12.3";
 in
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "09j5gh4zm49fcg2ycvy00dkkw69rfppqwc3lqdi4994hry4jivx9";
+    sha256 = "18zzjzs075zja00xpnyvjrrdzm54icdhfw4ywhpr6rqfcpnzifw7";
   };
 
   nativeBuildInputs = [ vala_0_38 intltool pkgconfig wrapGAppsHook cmake ninja desktop-file-utils gnome-doc-utils gobjectIntrospection ];

diff --git a/pkgs/desktops/plasma-5/fetch.sh b/pkgs/desktops/plasma-5/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/plasma/5.12.5/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/plasma/5.12.6/ -A '*.tar.xz' )
diff --git a/pkgs/desktops/plasma-5/srcs.nix b/pkgs/desktops/plasma-5/srcs.nix
diff --git a/pkgs/development/compilers/go/1.10.nix b/pkgs/development/compilers/go/1.10.nix
@@ -34,6 +34,8 @@ stdenv.mkDerivation rec {
     sha256 = "1wqwy52ibb343a4v7b9q26xa6r5jk4khfxd90wbpcayws8cxly8m";
   };
 
+  GOCACHE = "off";
+
   # perl is used for testing go vet
   nativeBuildInputs = [ perl which pkgconfig patch makeWrapper ]
     ++ optionals stdenv.isLinux [ procps ];

diff --git a/pkgs/development/compilers/oraclejdk/jdk8cpu-linux.nix b/pkgs/development/compilers/oraclejdk/jdk8cpu-linux.nix
@@ -1,11 +1,11 @@
 import ./jdk-linux-base.nix {
   productVersion = "8";
-  patchVersion = "171";
+  patchVersion = "181";
   downloadUrl = http://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html;
-  sha256.i686-linux = "0dh5r02v40pinway952fflw2r0i1xi67hmyb87c278qfp4jn929p";
-  sha256.x86_64-linux = "10jr4z0bw9wcws5xgc4qkw101cadfx5bkyvcnc4l3v5axwvjipdn";
-  sha256.armv7l-linux = "1bqivmp1wfnypgg5bsfzi25yzl7vd2xncfap9mi8jn63aj633dw0";
-  sha256.aarch64-linux = "1016lf3g1syjsl29m58s2s2w9nkj4jkvxhqg4s35vy41cs2v77j7";
+  sha256.i686-linux = "0159q5wrlp24v8rc6m1cr3kq8nddpdjdprj3vsmf8z7vpwx052np";
+  sha256.x86_64-linux = "1lwiz44vlxn4hc5b43r9arad15lpjfbr7l6h5vafpgxzjmq5ci8q";
+  sha256.armv7l-linux = "0zpgb1hqf9zazic66c7nim036ac6ld3dhnsanx4ijlrl7kd3fbn7";
+  sha256.aarch64-linux = "191r926501cm6mz8p93ljdfxi0dgzw7ljjsrzsbmmxn4k0q2j0ad";
   jceName = "jce_policy-8.zip";
   jceDownloadUrl = http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html;
   sha256JCE = "0n8b6b8qmwb14lllk2lk1q1ahd3za9fnjigz5xn65mpg48whl0pk";

diff --git a/pkgs/development/haskell-modules/hackage-packages.nix b/pkgs/development/haskell-modules/hackage-packages.nix
@@ -147432,18 +147432,13 @@ self: {
      }) {};
 
   "network" = callPackage
-    ({ mkDerivation, base, bytestring, directory, doctest, HUnit
-     , test-framework, test-framework-hunit, unix
-     }:
+    ({ mkDerivation, base, bytestring, doctest, hspec, HUnit, unix }:
      mkDerivation {
        pname = "network";
-       version = "2.6.3.4";
-       sha256 = "1yswp78fg7i1w1inn6p07vhz7lmfs33niavxhq60z6yv0qx2c3dw";
+       version = "2.6.3.6";
+       sha256 = "198mam7ahny48p9fajznbqq16a8ya2gw0xm3gnm1si1rmc4hdplv";
        libraryHaskellDepends = [ base bytestring unix ];
-       testHaskellDepends = [
-         base bytestring directory doctest HUnit test-framework
-         test-framework-hunit
-       ];
+       testHaskellDepends = [ base bytestring doctest hspec HUnit ];
        homepage = "https://github.com/haskell/network";
        description = "Low-level networking interface";
        license = stdenv.lib.licenses.bsd3;

diff --git a/pkgs/development/libraries/ffmpeg-full/default.nix b/pkgs/development/libraries/ffmpeg-full/default.nix
@@ -231,11 +231,11 @@ assert nvenc -> nvidia-video-sdk != null && nonfreeLicensing;
 
 stdenv.mkDerivation rec {
   name = "ffmpeg-full-${version}";
-  version = "3.4.2";
+  version = "3.4.3";
 
   src = fetchurl {
     url = "https://www.ffmpeg.org/releases/ffmpeg-${version}.tar.xz";
-    sha256 = "0h6prjn1ijkzzhkyj8mazp0wpx7m0n9ycadjxagf9czqirbyk4ib";
+    sha256 = "0p45s3h7mg7v0jm77bymw2617i08f086dlcdmaylnk7795yind3b";
   };
 
   prePatch = ''

diff --git a/pkgs/development/libraries/ffmpeg/3.4.nix b/pkgs/development/libraries/ffmpeg/3.4.nix
@@ -6,7 +6,7 @@
 
 callPackage ./generic.nix (args // rec {
   version = "${branch}";
-  branch = "3.4.2";
-  sha256 = "0nkq4451masmzlx3p4vprqwc0sl2iwqxbzjrngmvj29q4azp00zb";
+  branch = "3.4.3";
+  sha256 = "0s2p2bcrywlya4wjlyzi1382vngkiijjvjr6ms64xww5jplwmhmk";
   darwinFrameworks = [ Cocoa CoreMedia ];
 })
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -163,9 +163,15 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  # ffmpeg 3+ generates pkg-config (.pc) files that don't have the
+  # form automatically handled by the multiple-outputs hooks.
   postFixup = ''
     moveToOutput bin "$bin"
     moveToOutput share/ffmpeg/examples "$doc"
+    for pc in ''${!outputDev}/lib/pkgconfig/*.pc; do
+      substituteInPlace $pc \
+        --replace "includedir=$out" "includedir=''${!outputInclude}"
+    done
   '';
 
   /* Cross-compilation is untested, consider this an outline, more work

diff --git a/pkgs/development/libraries/nghttp2/CVE-2018-1000168.patch b/pkgs/development/libraries/nghttp2/CVE-2018-1000168.patch
@@ -0,0 +1,22 @@
+From b1bd6035e884b3d83748914a3b5f2a8e52a78a2f Mon Sep 17 00:00:00 2001
+From: Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
+Date: Sat, 7 Apr 2018 00:27:55 +0900
+Subject: [PATCH] Fix frame handling
+
+---
+source: https://github.com/nghttp2/nghttp2/commit/b1bd6035e884b3d83748914a3b5f2a8e52a78a2f
+
+diff --git a/lib/nghttp2_frame.c b/lib/nghttp2_frame.c
+index 210df0584..fa7cb6953 100644
+--- a/lib/nghttp2_frame.c
++++ b/lib/nghttp2_frame.c
+@@ -215,6 +215,9 @@ void nghttp2_frame_altsvc_free(nghttp2_extension *frame, nghttp2_mem *mem) {
+   nghttp2_ext_altsvc *altsvc;
+
+   altsvc = frame->payload;
++  if (altsvc == NULL) {
++    return;
++  }
+   /* We use the same buffer for altsvc->origin and
+      altsvc->field_value. */
+   nghttp2_mem_free(mem, altsvc->origin);
diff --git a/pkgs/development/libraries/nghttp2/default.nix b/pkgs/development/libraries/nghttp2/default.nix
@@ -24,6 +24,10 @@ stdenv.mkDerivation rec {
     sha256 = "18ys6p39yvm9wjjzhhlw35c9m8f5gf4dk9jbshibj19q4js1pnv9";
   };
 
+  patches = [
+    ./CVE-2018-1000168.patch
+  ];
+
   outputs = [ "bin" "out" "dev" "lib" ];
 
   nativeBuildInputs = [ pkgconfig ];

diff --git a/pkgs/development/libraries/phonon/backends/vlc.nix b/pkgs/development/libraries/phonon/backends/vlc.nix
@@ -1,21 +1,22 @@
 { stdenv, lib, fetchurl, cmake, phonon, pkgconfig, vlc
 , extra-cmake-modules, qtbase ? null, qtx11extras ? null, qt4 ? null
-, withQt5 ? false
+, withQt4 ? false
 , debug ? false
 }:
 
 with lib;
 
 let
-  v = "0.9.0";
+  v = "0.10.1";
   pname = "phonon-backend-vlc";
 in
 
-assert withQt5 -> qtbase != null;
-assert withQt5 -> qtx11extras != null;
+assert withQt4 -> qt4 != null;
+assert !withQt4 -> qtbase != null;
+assert !withQt4 -> qtx11extras != null;
 
 stdenv.mkDerivation rec {
-  name = "${pname}-${if withQt5 then "qt5" else "qt4"}-${v}";
+  name = "${pname}-${if withQt4 then "qt4" else "qt5"}-${v}";
 
   meta = with stdenv.lib; {
     homepage = https://phonon.kde.org/;
@@ -25,16 +26,16 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://kde/stable/phonon/${pname}/${v}/${pname}-${v}.tar.xz";
-    sha256 = "1gnd1j305mqajw5gxm42vg6ajkvi8611bxgc3qhj5k0saz5dgkn0";
+    sha256 = "0b87mzkw9fdkrwgnh1kw5i5wnrd05rl42hynlykb7cfymsk6v5h9";
   };
 
   buildInputs =
     [ phonon vlc ]
-    ++ (if withQt5 then [ qtbase qtx11extras ] else [ qt4 ]);
+    ++ (if withQt4 then [ qt4 ] else [ qtbase qtx11extras ]);
 
-  nativeBuildInputs = [ cmake pkgconfig ] ++ optional withQt5 extra-cmake-modules;
+  nativeBuildInputs = [ cmake pkgconfig ] ++ optional (!withQt4) extra-cmake-modules;
 
   cmakeFlags =
     [ "-DCMAKE_BUILD_TYPE=${if debug then "Debug" else "Release"}" ]
-    ++ optional withQt5 "-DPHONON_BUILD_PHONON4QT5=ON";
+    ++ optional (!withQt4) "-DPHONON_BUILD_PHONON4QT5=ON";
 }
diff --git a/pkgs/development/python-modules/simpy/default.nix b/pkgs/development/python-modules/simpy/default.nix
@@ -0,0 +1,18 @@
+{ buildPythonPackage, fetchPypi, lib }:
+
+buildPythonPackage rec {
+  pname = "simpy";
+  version = "3.0.11";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0hqgxk3lggf21jq9lh8838cdl24mdkdnpzh0w4m28d0zn2wjb5nh";
+  };
+
+  meta = with lib; {
+    homepage = https://simpy.readthedocs.io/en/latest/;
+    description = "A process-based discrete-event simulation framework based on standard Python.";
+    license = [ licenses.mit ];
+    maintainers = with maintainers; [ shlevy ];
+  };
+}
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.14.55";
+  version = "4.14.56";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1mq23s990bi8nmz9rgkiln6zfxzbhcjg0hh512flp36scgi32r47";
+    sha256 = "0b647c9zs7srrxhk48aaln0q92kq7xhq9gvjc6g38fnlqvx6rxfl";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.17.nix b/pkgs/os-specific/linux/kernel/linux-4.17.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.17.6";
+  version = "4.17.8";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "15b3k79cjlgrc4q39p1laxz2p102d6a7bpfq0mh9724qs64xd795";
+    sha256 = "0hkqypjgvr8lyskwk8z3dac8pyi4wappnk25508vs3fy08365h0k";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.140";
+  version = "4.4.142";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1fy7hq438sqxcdgac5dw71qbb9g38z7bdqjyl79a1b0cvqy8yk0q";
+    sha256 = "0zyxlqjnxrr1a1wlg3hzk8sx77ysmy66wb34kp77iv04xr9p9kai";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.112";
+  version = "4.9.113";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1pphyrqi20w8k9rg5mjkl0g3f2152c4gqzhgdi4hz8mad972kv30";
+    sha256 = "0yxwsaxnz0k03b1zj1l95ls8qm2rra9hygnjzh9z60sax56myn63";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
@@ -85,6 +85,8 @@ in with py.pkgs; buildPythonApplication rec {
   makeWrapperArgs = lib.optional skipPip "--add-flags --skip-pip";
 
   meta = with lib; {
+    # home-assistant should be installed from unstable channel anyway
+    knownVulnerabilities = [ "https://www.home-assistant.io/blog/2018/07/16/release-73-2/" ];
     homepage = https://home-assistant.io/;
     description = "Open-source home automation platform running on Python 3";
     license = licenses.asl20;

diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
@@ -220,7 +220,6 @@ isScript() {
     local fn="$1"
     local fd
     local magic
-    if ! [ -x /bin/sh ]; then return 0; fi
     exec {fd}< "$fn"
     read -r -n 2 -u "$fd" magic
     exec {fd}<&-

diff --git a/pkgs/tools/security/keybase-gui/default.nix b/pkgs/tools/security/keybase-gui/default.nix
@@ -70,10 +70,9 @@ stdenv.mkDerivation rec {
       checkFailed
     fi
 
-    ${utillinuxMinimal}/bin/mountpoint /keybase &>/dev/null
-    if [ "\$?" -ne "0" ]; then
-      echo "Keybase is not mounted to /keybase." >&2
-      echo "You might need to run: kbfsfuse /keybase" >&2
+    if [ -z "\$(keybase status | grep kbfsfuse)" ]; then
+      echo "Could not find kbfsfuse client in keybase status." >&2
+      echo "You might need to run: kbfsfuse" >&2
       checkFailed
     fi
 

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
@@ -7287,7 +7287,9 @@ with pkgs;
   spidermonkey_1_8_5 = callPackage ../development/interpreters/spidermonkey/1.8.5.nix { };
   spidermonkey_17 = callPackage ../development/interpreters/spidermonkey/17.nix { };
   spidermonkey_31 = callPackage ../development/interpreters/spidermonkey/31.nix { };
-  spidermonkey_38 = callPackage ../development/interpreters/spidermonkey/38.nix { };
+  spidermonkey_38 = callPackage ../development/interpreters/spidermonkey/38.nix ((stdenv.lib.optionalAttrs (stdenv.cc.isGNU && stdenv.hostPlatform.isi686) {
+      stdenv = overrideCC stdenv gcc6; # with gcc-7: undefined reference to `__divmoddi4'
+  }));
   spidermonkey_52 = callPackage ../development/interpreters/spidermonkey/52.nix { };
   spidermonkey = spidermonkey_31;
 
@@ -11177,9 +11179,7 @@ with pkgs;
       withQt5 = true;
     };
 
-    phonon-backend-vlc = callPackage ../development/libraries/phonon/backends/vlc.nix {
-      withQt5 = true;
-    };
+    phonon-backend-vlc = callPackage ../development/libraries/phonon/backends/vlc.nix { };
 
     polkit-qt = callPackage ../development/libraries/polkit-qt-1/qt-5.nix { };
 
@@ -11213,11 +11213,7 @@ with pkgs;
 
     telepathy = callPackage ../development/libraries/telepathy/qt { };
 
-    vlc = lowPrio (callPackage ../applications/video/vlc {
-      qt4 = null;
-      withQt5 = true;
-      ffmpeg = ffmpeg_2;
-    });
+    vlc = callPackage ../applications/video/vlc { };
 
     qtwebkit-plugins = callPackage ../development/libraries/qtwebkit-plugins { };
 
@@ -15133,13 +15129,11 @@ with pkgs;
   dmtx-utils = callPackage (callPackage ../tools/graphics/dmtx-utils) {
   };
 
-  # go 1.9 pin until https://github.com/moby/moby/pull/35739
-  inherit (callPackage ../applications/virtualization/docker { go = go_1_9; })
-    docker_18_03
-    docker_18_05;
+  inherit (callPackage ../applications/virtualization/docker {})
+    docker_18_06;
 
-  docker = docker_18_03;
-  docker-edge = docker_18_05;
+  docker = docker_18_06;
+  docker-edge = docker_18_06;
 
   docker-proxy = callPackage ../applications/virtualization/docker/proxy.nix { };
 
@@ -18173,16 +18167,13 @@ with pkgs;
 
   vkeybd = callPackage ../applications/audio/vkeybd {};
 
-  vlc = callPackage ../applications/video/vlc {
-    ffmpeg = ffmpeg_2;
-    libva = libva-full; # also wants libva-x11
-  };
+  vlc =  libsForQt5.vlc;
 
   vlc_npapi = callPackage ../applications/video/vlc/plugin.nix {
     gtk = gtk2;
   };
 
-  vlc_qt5 = libsForQt5.vlc;
+  vlc_qt5 = vlc;
 
   vmpk = callPackage ../applications/audio/vmpk { };
 

diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
@@ -20466,6 +20466,8 @@ EOF
   h11 = callPackage ../development/python-modules/h11 { };
 
   prometheus_client = callPackage ../development/python-modules/prometheus_client { };
+
+  simpy = callPackage ../development/python-modules/simpy { };
 });
 
 in fix' (extends overrides packages)
Original file line number	Diff line number	Diff line change
		@@ -1 +1 @@
		WGET_ARGS=( https://download.kde.org/stable/applications/17.12.2/ -A '*.tar.xz' )
		WGET_ARGS=( https://download.kde.org/stable/applications/17.12.3/ -A '*.tar.xz' )