NixOS · Apr 4, 2019 · Apr 4, 2019 · Apr 4, 2019 · Apr 5, 2019 · Apr 5, 2019
diff --git a/nixos/doc/manual/release-notes/rl-1903.xml b/nixos/doc/manual/release-notes/rl-1903.xml
@@ -79,27 +79,31 @@
       the runtime closure of the service.
      </para>
    </listitem>
+   <listitem>
+     <para>
+       A UEFI installer image for Aarch64 is now
+       <link xlink:href="https://hydra.nixos.org/job/nixos/release-19.03/nixos.iso_minimal.aarch64-linux/latest">
+         built by Hydra</link>.
+       It should work on all devices with a UEFI implementation
+       such as upstream u-boot.
+     </para>
+   </listitem>
   </itemizedlist>
  </section>
 
  <section xmlns="http://docbook.org/ns/docbook"
          xmlns:xlink="http://www.w3.org/1999/xlink"
          xmlns:xi="http://www.w3.org/2001/XInclude"
          version="5.0"
-         xml:id="sec-release-19.03-new-services">
-  <title>New Services</title>
-
+         xml:id="sec-release-19.03-new-modules">
+  <title>New Modules</title>
   <para>
-   The following new services were added since the last release:
+   The following new modules were added since the last release:
   </para>
 
   <itemizedlist>
    <listitem>
-    <para>
-     <literal>./programs/nm-applet.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
+    <para><filename>security/google_oslogin.nix</filename></para>
     <para>
      There is a new <varname>security.googleOsLogin</varname> module for using
      <link xlink:href="https://cloud.google.com/compute/docs/instances/managing-instance-access">OS
@@ -109,28 +113,21 @@
      <literal>nixos/modules/virtualisation/google-compute-config.nix</literal>.
     </para>
    </listitem>
+
    <listitem>
-    <para>
-     <literal>./services/misc/beanstalkd.nix</literal>
-    </para>
-   </listitem>
-   <listitem>
+    <para><filename>services/misc/beanstalkd.nix</filename></para>
     <para>
      There is a new <varname>services.cockroachdb</varname> module for running
      CockroachDB databases. NixOS now ships with CockroachDB 2.1.x as well,
      available on <literal>x86_64-linux</literal> and
      <literal>aarch64-linux</literal>.
     </para>
    </listitem>
-  </itemizedlist>
 
-  <itemizedlist>
    <listitem>
     <para>
-     <literal>./security/duosec.nix</literal>
+     <filename>security/duosec.nix</filename>
     </para>
-   </listitem>
-   <listitem>
     <para>
      The <link xlink:href="https://duo.com/docs/duounix">PAM module for Duo
      Security</link> has been enabled for use. One can configure it using the
@@ -139,6 +136,39 @@
      <option>security.pam.services.&lt;name?&gt;.duoSecurity.enable</option>.
     </para>
    </listitem>
+   <listitem><para><filename>config/appstream.nix</filename></para></listitem>
+   <listitem><para><filename>config/xdg/sounds.nix</filename></para></listitem>
+   <listitem><para><filename>hardware/acpilight.nix</filename></para></listitem>
+   <listitem><para><filename>hardware/ledger.nix</filename></para></listitem>
+   <listitem><para><filename>programs/dmrconfig.nix</filename></para></listitem>
+   <listitem><para><filename>programs/iotop.nix</filename></para></listitem>
+   <listitem><para><filename>programs/mininet.nix</filename></para></listitem>
+   <listitem><para><filename>programs/nm-applet.nix</filename></para></listitem>
+   <listitem><para><filename>programs/wavemon.nix</filename></para></listitem>
+   <listitem><para><filename>security/google_oslogin.nix</filename></para></listitem>
+   <listitem><para><filename>security/misc.nix</filename></para></listitem>
+   <listitem><para><filename>services/desktops/gnome3/rygel.nix</filename></para></listitem>
+   <listitem><para><filename>services/desktops/gsignond.nix</filename></para></listitem>
+   <listitem><para><filename>services/hardware/bolt.nix</filename></para></listitem>
+   <listitem><para><filename>services/hardware/lirc.nix</filename></para></listitem>
+   <listitem><para><filename>services/hardware/ratbagd.nix</filename></para></listitem>
+   <listitem><para><filename>services/hardware/triggerhappy.nix</filename></para></listitem>
+   <listitem><para><filename>services/hardware/vdr.nix</filename></para></listitem>
+   <listitem><para><filename>services/mail/davmail.nix</filename></para></listitem>
+   <listitem><para><filename>services/mail/roundcube.nix</filename></para></listitem>
+   <listitem><para><filename>services/mail/rss2email.nix</filename></para></listitem>
+   <listitem><para><filename>services/misc/beanstalkd.nix</filename></para></listitem>
+   <listitem><para><filename>services/misc/bees.nix</filename></para></listitem>
+   <listitem><para><filename>services/misc/headphones.nix</filename></para></listitem>
+   <listitem><para><filename>services/misc/lidarr.nix</filename></para></listitem>
+   <listitem><para><filename>services/misc/sickbeard.nix</filename></para></listitem>
+   <listitem><para><filename>services/misc/weechat.nix</filename></para></listitem>
+   <listitem><para><filename>services/misc/zoneminder.nix</filename></para></listitem>
+   <listitem><para><filename>services/monitoring/alerta.nix</filename></para></listitem>
+   <listitem><para><filename>services/monitoring/kapacitor.nix</filename></para></listitem>
+   <listitem><para><filename>services/networking/iperf3.nix</filename></para></listitem>
+   <listitem><para><filename>services/networking/knot.nix</filename></para></listitem>
+
   </itemizedlist>
  </section>
 
@@ -295,7 +325,7 @@
    <listitem>
     <para>
      The versioned <varname>postgresql</varname> have been renamed to use
-     underscore number seperators. For example, <varname>postgresql96</varname>
+     underscore number separators. For example, <varname>postgresql96</varname>
      has been renamed to <varname>postgresql_9_6</varname>.
     </para>
    </listitem>
@@ -450,7 +480,7 @@
      account module verification was exited prematurely in case a nss module
      provided the account name to <literal>pam_unix</literal>. The LDAP and
      SSSD NixOS modules already add their NSS modules when enabled. In case
-     your setup breaks due to some later PAM account module previosuly
+     your setup breaks due to some later PAM account module previously
      shadowed, or failing NSS lookups, please file a bug. You can get back the
      old behaviour by manually setting <literal>
 <![CDATA[security.pam.services.<name?>.text]]>
@@ -534,6 +564,13 @@
       Same applies to the new <literal>users.ldap.daemon.rootpwmodpwFile</literal> option.
     </para>
    </listitem>
+   <listitem>
+     <para>
+       <literal>nodejs-6_x</literal> is end-of-life.
+       <literal>nodejs-6_x</literal>, <literal>nodejs-slim-6_x</literal> and
+       <literal>nodePackages_6_x</literal> are removed.
+     </para>
+   </listitem>
   </itemizedlist>
  </section>
 
@@ -703,7 +740,7 @@
    </listitem>
    <listitem>
     <para>
-     Note that the default value of
+     The default value of
      <varname>services.kubernetes.apiserver.bindAddress</varname> has changed
      from 127.0.0.1 to 0.0.0.0, allowing the apiserver to be accessible from
      outside the master node itself. If the apiserver insecurePort is enabled,
@@ -721,7 +758,7 @@
    </listitem>
    <listitem>
     <para>
-     The kubernetes module does no longer add the kubernetes package to
+     The kubernetes module no longer adds the kubernetes package to
      <varname>environment.systemPackages</varname> implicitly.
     </para>
    </listitem>
@@ -732,16 +769,17 @@
      drivers</link>. The <literal>modesetting</literal> driver should take over
      automatically, it is better maintained upstream and has less problems with
      advanced X11 features. This can lead to a change in the output names used
-     by <literal>xrandr</literal>. Some performance regressions on some GPU
+     by <command>xrandr</command>. Some performance regressions on some GPU
      models might happen. Some OpenCL and VA-API applications might also break
      (Beignet seems to provide OpenCL support with
      <literal>modesetting</literal> driver, too). Kernel mode setting API does
-     not support backlight control, so <literal>xbacklight</literal> tool will
+     not support backlight control, so <command>xbacklight</command> tool will
      not work; backlight level can be controlled directly via
-     <literal>/sys/</literal> or with <literal>brightnessctl</literal>. Users
+     <filename>/sys/</filename> or with <command>brightnessctl</command> or
+     <command>light</command>. Users
      who need this functionality more than multi-output XRandR are advised to
-     add `intel` to `videoDrivers` and report an issue (or provide additional
-     details in an existing one)
+     add <literal>intel</literal> to <varname>videoDrivers</varname> and report
+     an issue (or provide additional details in an existing one).
     </para>
    </listitem>
    <listitem>
@@ -751,6 +789,8 @@
      those symbols. An upgrade guide can be found
      <link xlink:href="https://www.open-mpi.org/faq/?category=mpi-removed">here</link>.
     </para>
+   </listitem>
+   <listitem>
     <para>
      The nginx package now relies on OpenSSL 1.1 and supports TLS 1.3 by
      default. You can set the protocols used by the nginx service using
@@ -762,6 +802,20 @@
      A new subcommand <command>nixos-rebuild edit</command> was added.
     </para>
    </listitem>
+   <listitem>
+     <para>
+       <function>stdenv.mkDerivation</function> may now be passed
+       <varname>pname</varname> and <varname>version</varname> attributes
+       instead of <varname>name</varname>, and will now automatically
+       construct the package name by joining them with a dash.
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       The Sway tiling Wayland compositor has been updated to version 1.0, and the
+       corresponding NixOS module has been refined to fix some bugs.
+     </para>
+   </listitem>
   </itemizedlist>
  </section>
 </section>
diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
@@ -32,7 +32,7 @@ let
     cd ${pkgs.nextcloud}
     exec /run/wrappers/bin/sudo -u nextcloud \
       NEXTCLOUD_CONFIG_DIR="${cfg.home}/config" \
-      ${config.services.phpfpm.phpPackage}/bin/php \
+      ${phpPackage}/bin/php \
       -c ${pkgs.writeText "php.ini" phpOptionsStr}\
       occ $*
   '';
@@ -360,7 +360,7 @@ in {
           environment.NEXTCLOUD_CONFIG_DIR = "${cfg.home}/config";
           serviceConfig.Type = "oneshot";
           serviceConfig.User = "nextcloud";
-          serviceConfig.ExecStart = "${pkgs.php}/bin/php -f ${pkgs.nextcloud}/cron.php";
+          serviceConfig.ExecStart = "${phpPackage}/bin/php -f ${pkgs.nextcloud}/cron.php";
         };
       };
 

diff --git a/pkgs/applications/misc/qtpass/default.nix b/pkgs/applications/misc/qtpass/default.nix
@@ -1,26 +1,21 @@
 { stdenv, fetchFromGitHub, git, gnupg, pass, qtbase, qtsvg, qttools, qmake, makeWrapper }:
 
 stdenv.mkDerivation rec {
-  name = "qtpass-${version}";
-  version = "1.2.1";
+  pname = "qtpass";
+  version = "1.2.3";
 
   src = fetchFromGitHub {
     owner  = "IJHack";
     repo   = "QtPass";
     rev    = "v${version}";
-    sha256 = "0pp38b3fifkfwqcb6vi194ccgb8j3zc8j8jq8ww5ib0wvhldzsg8";
+    sha256 = "1vfhfyccrxq9snyvayqfzm5rqik8ny2gysyv7nipc91kvhq3bhky";
   };
 
-  patches = [ ./hidpi.patch ];
-
   buildInputs = [ git gnupg pass qtbase qtsvg qttools ];
 
   nativeBuildInputs = [ makeWrapper qmake ];
 
-  postPatch = ''
-    substituteInPlace qtpass.pro --replace "SUBDIRS += src tests main" "SUBDIRS += src main"
-    substituteInPlace qtpass.pro --replace "main.depends = tests" "main.depends = src"
-  '';
+  enableParallelBuilding = true;
 
   postInstall = ''
     install -D qtpass.desktop $out/share/applications/qtpass.desktop

diff --git a/pkgs/applications/misc/qtpass/hidpi.patch b/pkgs/applications/misc/qtpass/hidpi.patch
diff --git a/pkgs/applications/networking/nextcloud-client/default.nix b/pkgs/applications/networking/nextcloud-client/default.nix
@@ -1,35 +1,22 @@
 { stdenv, fetchgit, cmake, pkgconfig, qtbase, qtwebkit, qtkeychain, qttools, sqlite
 , inotify-tools, makeWrapper, openssl_1_1, pcre, qtwebengine, libsecret, fetchpatch
+, libcloudproviders
 }:
 
 stdenv.mkDerivation rec {
   name = "nextcloud-client-${version}";
-  version = "2.5.1";
+  version = "2.5.2";
 
   src = fetchgit {
     url = "git://github.com/nextcloud/desktop.git";
     rev = "refs/tags/v${version}";
-    sha256 = "0r6jj3vbmwh7ipv83c8w1b25pbfq3mzrjgcijdw2gwfxwx9pfq7d";
+    sha256 = "1brpxdgyy742dqw6cyyv2257d6ihwiqhbzfk2hb8zjgbi6p9lhsr";
     fetchSubmodules = true;
   };
 
-  # Patches contained in next (>2.5.1) release
-  patches = [
-    (fetchpatch {
-     name = "fix-qt-5.12-build";
-     url = "https://github.com/nextcloud/desktop/commit/071709ab5e3366e867dd0b0ea931aa7d6f80f528.patch";
-     sha256 = "14k635jwm8hz6i22lz88jj2db8v5czwa3zg0667i4hwhkqqmy61n";
-     })
-     (fetchpatch {
-       name = "fix-qtwebengine-crash";
-       url = "https://patch-diff.githubusercontent.com/raw/nextcloud/desktop/pull/959.patch";
-       sha256 = "00qx976az2rb1gwl1rxapm8gqj42yzqp8k2fasn3h7b30lnxdyr0";
-     })
-  ];
-
   nativeBuildInputs = [ pkgconfig cmake makeWrapper ];
 
-  buildInputs = [ qtbase qtwebkit qtkeychain qttools qtwebengine sqlite openssl_1_1.out pcre inotify-tools ];
+  buildInputs = [ qtbase qtwebkit qtkeychain qttools qtwebengine sqlite openssl_1_1.out pcre inotify-tools libcloudproviders ];
 
   enableParallelBuilding = true;
 

diff --git a/pkgs/applications/virtualization/virt-manager/default.nix b/pkgs/applications/virtualization/virt-manager/default.nix
@@ -23,10 +23,11 @@ python3Packages.buildPythonApplication rec {
     gobject-introspection # for setup hook populating GI_TYPELIB_PATH
   ];
 
-  buildInputs =
-    [ libvirt-glib vte dconf gtk-vnc gnome3.adwaita-icon-theme avahi
-      gsettings-desktop-schemas libosinfo gtk3
-    ] ++ optional spiceSupport spice-gtk;
+  buildInputs = [
+    libvirt-glib vte dconf gtk-vnc gnome3.adwaita-icon-theme avahi
+    gsettings-desktop-schemas libosinfo gtk3
+    gobject-introspection # Temporary fix, see https://github.com/NixOS/nixpkgs/issues/56943
+  ] ++ optional spiceSupport spice-gtk;
 
   propagatedBuildInputs = with python3Packages;
     [

diff --git a/pkgs/desktops/deepin/dbus-factory/default.nix b/pkgs/desktops/deepin/dbus-factory/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     go-dbus-generator
   ];
 
-  makeFlags = [ "GOPATH=$(out)/share/go" ];
+  makeFlags = [ "GOPATH=${placeholder ''out''}/share/go" ];
 
   postPatch = ''
     sed -i -e 's:/share/gocode:/share/go:' Makefile

diff --git a/pkgs/desktops/deepin/dde-api/default.nix b/pkgs/desktops/deepin/dde-api/default.nix
@@ -1,57 +1,105 @@
 { stdenv, buildGoPackage, fetchFromGitHub, pkgconfig,
-  deepin-gettext-tools, go-dbus-factory, go-gir-generator, go-lib,
-  alsaLib, glib, gtk3, libcanberra, libgudev, librsvg, poppler,
-  pulseaudio, go, deepin }:
+  alsaLib,
+  bc,
+  blur-effect,
+  coreutils,
+  dbus-factory,
+  deepin,
+  deepin-gettext-tools,
+  fontconfig,
+  glib,
+  go,
+  go-dbus-factory,
+  go-gir-generator,
+  go-lib,
+  grub2,
+  gtk3,
+  libcanberra,
+  libgudev,
+  librsvg,
+  poppler,
+  pulseaudio,
+  rfkill,
+  xcur2png
+}:
 
 buildGoPackage rec {
   name = "${pname}-${version}";
   pname = "dde-api";
-  version = "3.5.0";
+  version = "3.18.1";
 
   goPackagePath = "pkg.deepin.io/dde/api";
 
   src = fetchFromGitHub {
     owner = "linuxdeepin";
     repo = pname;
     rev = version;
-    sha256 = "1g3s0i5wa6qyv00yksz4r4cy2vhiknq8v0yx7aribvwm3gxf7jw3";
+    sha256 = "0y8v18f6l3ycysdn4qi7c93z805q7alji8wix4j4qh9x9r35d728";
   };
 
   goDeps = ./deps.nix;
 
+  outputs = [ "out" ];
+
   nativeBuildInputs = [
     pkgconfig
-    deepin-gettext-tools
-    go-dbus-factory
-    go-gir-generator
-    go-lib
+    deepin-gettext-tools # build
+    dbus-factory         # build
+    go-dbus-factory      # needed
+    go-gir-generator     # needed
+    go-lib               # build
+    deepin.setupHook
   ];
 
   buildInputs = [
-    alsaLib
-    glib
-    gtk3
-    libcanberra
-    libgudev
-    librsvg
-    poppler
-    pulseaudio
-  ];
+    alsaLib     # needed
+    bc          # run (to adjust grub theme?)
+    blur-effect # run (is it really needed?)
+    coreutils   # run (is it really needed?)
+    fontconfig  # run (is it really needed?)
+    #glib        # ? arch
+    grub2       # run (is it really needed?)
+    gtk3        # build run
+    libcanberra # build run
+    libgudev    # needed
+    librsvg     # build run
+    poppler     # build run
+    pulseaudio  # needed
+    rfkill      # run
+    xcur2png    # run
+    #locales     # run (locale-helper needs locale-gen, which is unavailable on NixOS?)
+ ];
 
   postPatch = ''
-    patchShebangs .
-    sed -i -e "s|/var|$bin/var|" Makefile
+    searchHardCodedPaths # debugging
+
+    sed -i -e "s|/var|$out/var|" Makefile
+
+    # TODO: confirm where to install grub themes
+    sed -i -e "s|/boot/grub|$out/boot/grub|" Makefile
+
+    fixPath $out /usr/lib/deepin-api \
+      lunar-calendar/main.go \
+      misc/services/com.deepin.api.CursorHelper.service \
+      misc/services/com.deepin.api.Graphic.service \
+      misc/services/com.deepin.api.LunarCalendar.service \
+      misc/services/com.deepin.api.Pinyin.service \
+      misc/system-services/com.deepin.api.Device.service \
+      misc/system-services/com.deepin.api.LocaleHelper.service \
+      misc/system-services/com.deepin.api.SoundThemePlayer.service \
+      misc/systemd/system/deepin-shutdown-sound.service \
+      theme_thumb/gtk/gtk.go \
+      thumbnails/gtk/gtk.go
   '';
 
   buildPhase = ''
     make -C go/src/${goPackagePath}
   '';
 
   installPhase = ''
-    make install PREFIX="$bin" SYSTEMD_LIB_DIR="$bin/lib" -C go/src/${goPackagePath}
-    mkdir -p $out/share
-    mv $bin/share/gocode $out/share/go
-    remove-references-to -t ${go} $bin/bin/* $bin/lib/deepin-api/*
+    make install PREFIX="$out" SYSTEMD_LIB_DIR="$out/lib" -C go/src/${goPackagePath}
+    mv $out/share/gocode $out/share/go
+    remove-references-to -t ${go} $out/bin/* $out/lib/deepin-api/*
   '';
 
   passthru.updateScript = deepin.updateScript { inherit name; };

diff --git a/pkgs/desktops/deepin/dde-api/deps.nix b/pkgs/desktops/deepin/dde-api/deps.nix
diff --git a/pkgs/desktops/deepin/dde-calendar/default.nix b/pkgs/desktops/deepin/dde-calendar/default.nix
@@ -19,6 +19,7 @@ stdenv.mkDerivation rec {
     qmake
     qttools
     deepin-gettext-tools
+    deepin.setupHook
   ];
 
   buildInputs = [
@@ -27,11 +28,14 @@ stdenv.mkDerivation rec {
   ];
 
   postPatch = ''
-    patchShebangs .
+    searchHardCodedPaths
+    patchShebangs translate_generation.sh
+    patchShebangs translate_desktop.sh
+
+    fixPath $out /usr com.deepin.Calendar.service
+
     sed -i translate_desktop.sh \
       -e "s,/usr/bin/deepin-desktop-ts-convert,deepin-desktop-ts-convert,"
-    sed -i com.deepin.Calendar.service \
-      -e "s,/usr,$out,"
   '';
 
   passthru.updateScript = deepin.updateScript { inherit name; };

diff --git a/pkgs/desktops/deepin/dde-daemon/default.nix b/pkgs/desktops/deepin/dde-daemon/default.nix
@@ -1,29 +1,30 @@
 { stdenv, buildGoPackage, fetchFromGitHub, fetchpatch, pkgconfig,
   dbus-factory, go-dbus-factory, go-gir-generator, go-lib,
-  deepin-gettext-tools, dde-api, alsaLib, glib, gtk3, libinput, libnl,
-  librsvg, linux-pam, networkmanager, pulseaudio, xorg, gnome3,
-  python3Packages, hicolor-icon-theme, go, deepin }:
+  deepin-gettext-tools, dde-api, deepin-desktop-schemas,
+  deepin-wallpapers, deepin-desktop-base, alsaLib, glib, gtk3,
+  libgudev, libinput, libnl, librsvg, linux-pam, networkmanager,
+  pulseaudio, xorg, python3, hicolor-icon-theme, glibc, tzdata, go,
+  deepin, makeWrapper, wrapGAppsHook }:
 
 buildGoPackage rec {
   name = "${pname}-${version}";
   pname = "dde-daemon";
-  version = "3.6.0";
+  version = "3.24.1";
 
   goPackagePath = "pkg.deepin.io/dde/daemon";
 
   src = fetchFromGitHub {
     owner = "linuxdeepin";
     repo = pname;
     rev = version;
-    sha256 = "0gn2zp34wg79lvzdfla6yb4gs3f9ll83kj765zvig1wpx51nq1aj";
+    sha256 = "1qxj0mqnl10qj8qidpc1sv8gm4gj5965i07d003yxlxcw9cqwx7y";
   };
 
   patches = [
     # https://github.com/linuxdeepin/dde-daemon/issues/51
     (fetchpatch {
-      name = "dde-daemon_3.2.3.patch";
-      url = https://github.com/jouyouyun/tap-gesture-patches/raw/master/patches/dde-daemon_3.2.3.patch;
-      sha256 = "0a3xb15czpfl2vajpf7ycw37vr7fbw2png1a67mvjjkgx7d1k7dg";
+      url = https://github.com/jouyouyun/tap-gesture-patches/raw/master/patches/dde-daemon_3.8.0.patch;
+      sha256 = "1ampdsp9zlg263flswdw9gj10n7gxh7zi6w6z9jgh29xlai05pvh";
     })
   ];
 
@@ -38,46 +39,70 @@ buildGoPackage rec {
     go-gir-generator
     go-lib
     deepin-gettext-tools
-    dde-api
     linux-pam
     networkmanager
     networkmanager.dev
-    python3Packages.python
+    python3
+    makeWrapper
+    wrapGAppsHook
+    deepin.setupHook
   ];
 
   buildInputs = [
     alsaLib
+    dde-api
+    deepin-desktop-base
+    deepin-desktop-schemas
+    deepin-wallpapers
     glib
-    gnome3.libgudev
+    libgudev
     gtk3
     hicolor-icon-theme
     libinput
     libnl
     librsvg
     pulseaudio
+    tzdata
   ];
 
   postPatch = ''
-    patchShebangs .
+    searchHardCodedPaths
+    patchShebangs network/nm_generator/gen_nm_consts.py
 
-    sed -i network/nm_generator/Makefile -e 's,/usr/share/gir-1.0/NM-1.0.gir,${networkmanager.dev}/share/gir-1.0/NM-1.0.gir,'
+    fixPath $out /usr/share/dde/data launcher/manager.go dock/dock_manager_init.go
+    fixPath ${networkmanager.dev} /usr/share/gir-1.0/NM-1.0.gir network/nm_generator/Makefile
+    fixPath ${glibc.bin} /usr/bin/getconf systeminfo/utils.go
+    fixPath ${deepin-desktop-base} /etc/deepin-version systeminfo/version.go accounts/deepinversion.go
+    fixPath ${tzdata} /usr/share/zoneinfo timedate/zoneinfo/zone.go
+    fixPath ${dde-api} /usr/lib/deepin-api grub2/modify_manger.go accounts/image_blur.go
+    fixPath ${deepin-wallpapers} /usr/share/wallpapers appearance/background/list.go accounts/user.go
 
     sed -i -e "s|{DESTDIR}/etc|{DESTDIR}$out/etc|" Makefile
     sed -i -e "s|{DESTDIR}/var|{DESTDIR}$out/var|" Makefile
     sed -i -e "s|{DESTDIR}/lib|{DESTDIR}$out/lib|" Makefile
 
     find -type f -exec sed -i -e "s,/usr/lib/deepin-daemon,$out/lib/deepin-daemon," {} +
+
+    searchHardCodedPaths
   '';
 
   buildPhase = ''
-    make -C go/src/${goPackagePath}
     # compilation of the nm module is failing
     #make -C go/src/${goPackagePath}/network/nm_generator gen-nm-code
+    make -C go/src/${goPackagePath}
   '';
 
   installPhase = ''
     make install PREFIX="$out" -C go/src/${goPackagePath}
     remove-references-to -t ${go} $out/lib/deepin-daemon/*
+    searchHardCodedPaths $out
+  '';
+
+  postFixup = ''
+    # wrapGAppsHook does not work with binaries outside of $out/bin or $out/libexec
+    for binary in $out/lib/deepin-daemon/*; do
+      wrapProgram $binary "''${gappsWrapperArgs[@]}"
+    done
   '';
 
   passthru.updateScript = deepin.updateScript { inherit name; };

diff --git a/pkgs/desktops/deepin/dde-daemon/deps.nix b/pkgs/desktops/deepin/dde-daemon/deps.nix
diff --git a/pkgs/desktops/deepin/dde-qt-dbus-factory/default.nix b/pkgs/desktops/deepin/dde-qt-dbus-factory/default.nix
@@ -1,25 +1,28 @@
-{ stdenv, fetchFromGitHub, pkgconfig, qmake, python, deepin }:
+{ stdenv, fetchFromGitHub, pkgconfig, qmake, python3, deepin }:
 
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "dde-qt-dbus-factory";
-  version = "1.0.5";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "linuxdeepin";
     repo = pname;
     rev = version;
-    sha256 = "0cz55hsbhy1ab1mndv0sp6xnqrhz2y66w7pcxy8v9k87ii32czf8";
+    sha256 = "1b2i5m6fzkga72hbl85v2rng3qq53di39p7jj2f119wmlfbyp2vg";
   };
 
   nativeBuildInputs = [
     qmake
-    python
+    python3
+    deepin.setupHook
   ];
 
   postPatch = ''
-    sed -i libdframeworkdbus/{DFrameworkdbusConfig.in,libdframeworkdbus.pro} \
-      -e "s,/usr,$out,"
+    searchHardCodedPaths
+    fixPath $out /usr \
+      libdframeworkdbus/DFrameworkdbusConfig.in \
+      libdframeworkdbus/libdframeworkdbus.pro
   '';
 
   enableParallelBuilding = true;

diff --git a/pkgs/desktops/deepin/dde-session-ui/default.nix b/pkgs/desktops/deepin/dde-session-ui/default.nix
@@ -1,25 +1,27 @@
 { stdenv, fetchFromGitHub, pkgconfig, qmake, qtsvg, qttools,
   qtx11extras, xkeyboard_config, xorg, lightdm_qt, gsettings-qt,
   dde-qt-dbus-factory, deepin-gettext-tools, dtkcore, dtkwidget,
-  hicolor-icon-theme, deepin }:
+  deepin-desktop-schemas, deepin, hicolor-icon-theme, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "dde-session-ui";
-  version = "4.6.2";
+  version = "4.9.0";
 
   src = fetchFromGitHub {
     owner = "linuxdeepin";
     repo = pname;
     rev = version;
-    sha256 = "1fxlrj7vv7nqllwpwc8mxiv9bfqcj9b2qwkpjaq326pfmg5p5lhq";
+    sha256 = "1bh7wbkzikcnka94nzqzl87cs2m6bslrv9r2hdsvqqr3aaad5za3";
   };
 
   nativeBuildInputs = [
     pkgconfig
     qmake
     qttools
     deepin-gettext-tools
+    wrapGAppsHook
+    deepin.setupHook
   ];
 
   buildInputs = [
@@ -35,10 +37,13 @@ stdenv.mkDerivation rec {
     xorg.libXtst
     xkeyboard_config
     hicolor-icon-theme
+    deepin-desktop-schemas
   ];
 
   postPatch = ''
-    patchShebangs .
+    searchHardCodedPaths
+    patchShebangs translate_generation.sh
+    patchShebangs translate_desktop.sh
     sed -i translate_desktop.sh -e "s,/usr/bin/deepin-desktop-ts-convert,deepin-desktop-ts-convert,"
     find -type f -exec sed -i -e "s,path = /etc,path = $out/etc," {} +
     find -type f -exec sed -i -e "s,path = /usr,path = $out," {} +

diff --git a/pkgs/desktops/deepin/deepin-desktop-base/default.nix b/pkgs/desktops/deepin/deepin-desktop-base/default.nix
@@ -3,34 +3,40 @@
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "deepin-desktop-base";
-  version = "2018.10.29";
+  version = "2019.03.29";
 
   src = fetchFromGitHub {
     owner = "linuxdeepin";
     repo = pname;
     rev = version;
-    sha256 = "0l2zb7rpag2q36lqsgvirhjgmj7w243nsi1rywkypf2xm7g2v235";
+    sha256 = "1d016h95nsn5yay9f4c13hixfxj0q01hpxwj2x84i6qpx63dxdwq";
   };
 
+  nativeBuildInputs = [ deepin.setupHook ];
+
   buildInputs = [ deepin-wallpapers ];
 
+  # TODO: Fedora recommended dependencies:
+  #   deepin-wallpapers
+  #   plymouth-theme-deepin
+
   postPatch = ''
-    sed -i Makefile -e "s:/usr:$out:" -e "s:/etc:$out/etc:"
-  '';
+    searchHardCodedPaths
 
-  postInstall = ''
-    # Remove Deepin distro's lsb-release
-    rm $out/etc/lsb-release
+    fixPath $out /etc Makefile
+    fixPath $out /usr Makefile
 
+    # Remove Deepin distro's lsb-release
     # Don't override systemd timeouts
-    rm -r $out/etc/systemd
-
     # Remove apt-specific templates
-    rm -r $out/share/python-apt
-
-    # Remove empty backgrounds directory
-    rm -r $out/share/backgrounds
+    echo ----------------------------------------------------------------
+    echo grep --color=always -E 'lsb-release|systemd|python-apt|backgrounds' Makefile
+    grep --color=always -E 'lsb-release|systemd|python-apt|backgrounds' Makefile
+    echo ----------------------------------------------------------------
+    sed -i -E '/lsb-release|systemd|python-apt|backgrounds/d' Makefile
+  '';
 
+  postInstall = ''
     # Make a symlink for deepin-version
     ln -s ../lib/deepin/desktop-version $out/etc/deepin-version
   '';
@@ -39,6 +45,14 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Base assets and definitions for Deepin Desktop Environment";
+    # TODO: revise
+    longDescription = ''
+      This package provides some components for Deepin desktop environment.
+      - deepin logo
+      - deepin desktop version
+      - login screen background image
+      - language information
+    '';
     homepage = https://github.com/linuxdeepin/deepin-desktop-base;
     license = licenses.gpl3;
     platforms = platforms.linux;

diff --git a/pkgs/desktops/deepin/deepin-desktop-schemas/default.nix b/pkgs/desktops/deepin/deepin-desktop-schemas/default.nix
@@ -1,21 +1,22 @@
-{ stdenv, fetchFromGitHub, python, deepin-gtk-theme,
-  deepin-icon-theme, deepin-sound-theme, deepin-wallpapers, gnome3,
-  deepin }:
+{ stdenv, fetchFromGitHub, python3, gnome3, glib, deepin-gtk-theme,
+  deepin-icon-theme, deepin-sound-theme, deepin-wallpapers, deepin }:
 
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "deepin-desktop-schemas";
-  version = "3.4.0";
+  version = "3.13.0";
 
   src = fetchFromGitHub {
     owner = "linuxdeepin";
     repo = pname;
     rev = version;
-    sha256 = "10x0rh9z925yzyp8h0vgmg4313smvran06lvr12c3931qkmkzwgq";
+    sha256 = "0bamjcpmsl8xhw3ksgl11wv5xwcdhrkl1namikfzc4an03sk1rdq";
   };
 
   nativeBuildInputs = [
-    python
+    python3
+    glib.dev
+    deepin.setupHook
   ];
 
   buildInputs = [
@@ -27,12 +28,34 @@ stdenv.mkDerivation rec {
   ];
 
   postPatch = ''
+    searchHardCodedPaths
+
     # fix default background url
-    sed -i '/picture-uri/s|/usr/share/backgrounds/default_background.jpg|$out/share/backgrounds/deepin/default.png|' \
+    sed -i -e 's,/usr/share/backgrounds/default_background.jpg,/usr/share/backgrounds/deepin/desktop.jpg,' \
+      overrides/common/com.deepin.wrap.gnome.desktop.override
+      
+    fixPath ${deepin-wallpapers} /usr/share/backgrounds \
       overrides/common/com.deepin.wrap.gnome.desktop.override
+
+    fixPath ${deepin-wallpapers} /usr/share/wallpapers/deepin \
+      schemas/com.deepin.dde.appearance.gschema.xml
+
+    # still hardcoded paths:
+    #   /etc/gnome-settings-daemon/xrandr/monitors.xml                                ? gnome3.gnome-settings-daemon
+    #   /usr/share/backgrounds/gnome/adwaita-lock.jpg                                 ? gnome3.gnome-backgrounds
+    #   /usr/share/backgrounds/gnome/adwaita-timed.xml                                gnome3.gnome-backgrounds
+    #   /usr/share/desktop-directories
   '';
 
-  makeFlags = [ "PREFIX=$(out)" ];
+  makeFlags = [ "PREFIX=${placeholder ''out''}" ];
+
+  doCheck = true;
+  checkTarget = "test";
+
+  postInstall = ''
+    glib-compile-schemas --strict $out/share/glib-2.0/schemas
+    searchHardCodedPaths $out
+  '';
 
   passthru.updateScript = deepin.updateScript { inherit name; };
 

diff --git a/pkgs/desktops/deepin/deepin-gettext-tools/default.nix b/pkgs/desktops/deepin/deepin-gettext-tools/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     python3Packages.python
   ];
 
-  makeFlags = [ "PREFIX=$(out)" ];
+  makeFlags = [ "PREFIX=${placeholder ''out''}" ];
 
   postPatch = ''
     sed -e 's/sudo cp/cp/' -i src/generate_mo.py

diff --git a/pkgs/desktops/deepin/deepin-gtk-theme/default.nix b/pkgs/desktops/deepin/deepin-gtk-theme/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   propagatedUserEnvPkgs = [ gtk-engine-murrine ];
 
-  makeFlags = [ "PREFIX=$(out)" ];
+  makeFlags = [ "PREFIX=${placeholder ''out''}" ];
 
   passthru.updateScript = deepin.updateScript { inherit name; };
 

diff --git a/pkgs/desktops/deepin/deepin-icon-theme/default.nix b/pkgs/desktops/deepin/deepin-icon-theme/default.nix
@@ -1,29 +1,39 @@
-{ stdenv, fetchFromGitHub, gtk3, papirus-icon-theme, deepin }:
+{ stdenv, fetchFromGitHub, gtk3, xcursorgen, papirus-icon-theme, deepin }:
 
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "deepin-icon-theme";
-  version = "15.12.64";
+  version = "15.12.68";
 
   src = fetchFromGitHub {
     owner = "linuxdeepin";
     repo = pname;
     rev = version;
-    sha256 = "0z1yrp6yg2hb67azrbd9ac743jjh83vxdf2j0mmv2lfpd4fqw8qc";
+    sha256 = "12jgz81s5qggmnkfg9m5f799r10p43qmh4zqxl1kjvlrqgvsc9rf";
   };
 
-  nativeBuildInputs = [ gtk3 papirus-icon-theme ];
+  nativeBuildInputs = [ gtk3 xcursorgen ];
 
-  postPatch = ''
-    patchShebangs .
+  buildInputs = [ papirus-icon-theme ];
 
-    # install in $out
-    sed -i -e "s|/usr|$out|g" Makefile tools/hicolor.links
+  postPatch = ''
+    patchShebangs tools/hicolor.links
+    patchShebangs tools/display_unused_links.sh
+    patchShebangs cursors-src/cursors/bitmaps/make.sh
+    patchShebangs cursors-src/render-cursors.sh
 
     # keep icon-theme.cache
     sed -i -e 's|\(-rm -f .*/icon-theme.cache\)|# \1|g' Makefile
   '';
 
+  buildTargets = "all hicolor-links";
+  installTargets = "install-icons install-cursors";
+  installFlags = [ "PREFIX=${placeholder ''out''}" ];
+
+  postInstall = ''
+    cp -a ./Sea ./usr/share/icons/hicolor "$out"/share/icons/
+  '';
+
   passthru.updateScript = deepin.updateScript { inherit name; };
 
   meta = with stdenv.lib; {

diff --git a/pkgs/desktops/deepin/deepin-image-viewer/default.nix b/pkgs/desktops/deepin/deepin-image-viewer/default.nix
@@ -6,19 +6,20 @@
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "deepin-image-viewer";
-  version = "1.3.1";
+  version = "1.3.10";
 
   src = fetchFromGitHub {
     owner = "linuxdeepin";
     repo = pname;
     rev = version;
-    sha256 = "0dxdvm6hzj6izfxka35za8y7vacd06nksfgzx6xsv7ywzagri4k5";
+    sha256 = "0paanw9sd67ic9yrbzqhrwi4bf4lpvsk16jynx99n76j3jgyijkk";
   };
 
   nativeBuildInputs = [
     pkgconfig
     qmake
     qttools
+    deepin.setupHook
   ];
 
   buildInputs = [
@@ -33,12 +34,12 @@ stdenv.mkDerivation rec {
   ];
 
   postPatch = ''
-    patchShebangs .
+    searchHardCodedPaths
+    patchShebangs viewer/generate_translations.sh
+    fixPath $out /usr viewer/com.deepin.ImageViewer.service
     sed -i qimage-plugins/freeimage/freeimage.pro \
            qimage-plugins/libraw/libraw.pro \
       -e "s,\$\$\[QT_INSTALL_PLUGINS\],$out/$qtPluginPrefix,"
-    sed -i viewer/com.deepin.ImageViewer.service \
-      -e "s,/usr,$out,"
   '';
 
   passthru.updateScript = deepin.updateScript { inherit name; };

diff --git a/pkgs/desktops/deepin/deepin-menu/default.nix b/pkgs/desktops/deepin/deepin-menu/default.nix
@@ -16,6 +16,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     pkgconfig
     qmake
+    deepin.setupHook
   ];
 
   buildInputs = [
@@ -25,7 +26,11 @@ stdenv.mkDerivation rec {
   ];
 
   postPatch = ''
-    sed -i deepin-menu.pro -e "s,/usr,$out,"
+    searchHardCodedPaths
+    fixPath $out /usr \
+      data/com.deepin.menu.service \
+      deepin-menu.desktop \
+      deepin-menu.pro
   '';
 
   enableParallelBuilding = true;

diff --git a/pkgs/desktops/deepin/deepin-metacity/default.nix b/pkgs/desktops/deepin/deepin-metacity/default.nix
@@ -1,31 +1,32 @@
-{ stdenv, fetchFromGitHub, pkgconfig, intltool, libtool, gnome3, bamf,
-  json-glib, libcanberra-gtk3, libxkbcommon, libstartup_notification,
-  deepin-wallpapers, deepin-desktop-schemas, deepin }:
+{ stdenv, fetchFromGitHub, pkgconfig, intltool, libtool, gnome3, glib,
+  gtk3, libgtop, bamf, json-glib, libcanberra-gtk3, libxkbcommon,
+  libstartup_notification, deepin-wallpapers, deepin-desktop-schemas,
+  deepin }:
 
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "deepin-metacity";
-  version = "3.22.22";
+  version = "3.22.24";
 
   src = fetchFromGitHub {
     owner = "linuxdeepin";
     repo = pname;
     rev = version;
-    sha256 = "0gr10dv8vphla6z7zqiyyg3n3ag4rrlz43c4kr7fd5xwx2bfvp3d";
+    sha256 = "1im0wz1zlxiag4kpp5d4hv0aa0ybr4bizarr3903hrqv0lp46hyx";
   };
 
   nativeBuildInputs = [
     pkgconfig
     intltool
     libtool
+    glib.dev
     gnome3.gnome-common
-    gnome3.glib.dev
   ];
 
   buildInputs = [
     gnome3.dconf
-    gnome3.gtk
-    gnome3.libgtop
+    gtk3
+    libgtop
     gnome3.zenity
     bamf
     json-glib
@@ -41,7 +42,7 @@ stdenv.mkDerivation rec {
       -e 's;/usr/share/backgrounds/default_background.jpg;${deepin-wallpapers}/share/backgrounds/deepin/desktop.jpg;'
   '';
 
-  NIX_CFLAGS_COMPILE = "-I${gnome3.glib.dev}/include/gio-unix-2.0";
+  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   configureFlags = [ "--disable-themes-documentation" ];
 

diff --git a/pkgs/desktops/deepin/deepin-movie-reborn/default.nix b/pkgs/desktops/deepin/deepin-movie-reborn/default.nix
@@ -5,13 +5,13 @@
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "deepin-movie-reborn";
-  version = "3.2.14";
+  version = "3.2.21";
 
   src = fetchFromGitHub {
     owner = "linuxdeepin";
     repo = pname;
     rev = version;
-    sha256 = "1i9sdg2p6qp57rqzrnjbxnqj3mg1qggzyq3yykw271vs8h85a707";
+    sha256 = "09a4sirbdxnrwj9ww2v7b1s9ylsincqzpqm2zisny9zxy22fm8s9";
   };
 
   nativeBuildInputs = [

diff --git a/pkgs/desktops/deepin/deepin-mutter/default.nix b/pkgs/desktops/deepin/deepin-mutter/default.nix
@@ -1,45 +1,52 @@
-{ stdenv, fetchFromGitHub, pkgconfig, intltool, libtool, gnome3, xorg,
-  libcanberra-gtk3, upower, xkeyboard_config, libxkbcommon,
-  libstartup_notification, libinput, cogl, clutter, systemd, deepin }:
+{ stdenv, fetchFromGitHub, pkgconfig, intltool, libtool, gnome3, gtk3,
+  xorg, libcanberra-gtk3, upower, xkeyboard_config, libxkbcommon,
+  libstartup_notification, libinput, libgudev, cogl, clutter, systemd,
+  gsettings-desktop-schemas, deepin-desktop-schemas, wrapGAppsHook,
+  deepin }:
 
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "deepin-mutter";
-  version = "3.20.35";
+  version = "3.20.38";
 
   src = fetchFromGitHub {
     owner = "linuxdeepin";
     repo = pname;
     rev = version;
-    sha256 = "0mwk06kgw8qp8rg1j6px1zlya4x5rr9llax0qks59j56b3m9yim7";
+    sha256 = "1aq7606sgn2c6n8wfgxdryw3lprc4va0zjc0r65798w5656fdi31";
   };
 
   nativeBuildInputs = [
     pkgconfig
     intltool
     libtool
     gnome3.gnome-common
+    wrapGAppsHook
+    deepin.setupHook
   ];
 
   buildInputs = [
-    gnome3.gtk
+    clutter
+    cogl
+    deepin-desktop-schemas
     gnome3.gnome-desktop
-    gnome3.gsettings-desktop-schemas
-    gnome3.libgudev
     gnome3.zenity
-    upower
-    xorg.libxkbfile
-    libxkbcommon
+    gsettings-desktop-schemas
+    gtk3
     libcanberra-gtk3
-    libstartup_notification
+    libgudev
     libinput
-    xkeyboard_config
-    cogl
-    clutter
+    libstartup_notification
+    libxkbcommon
     systemd
+    upower
+    xkeyboard_config
+    xorg.libxkbfile
   ];
 
-  enableParallelBuilding = true;
+  postPatch = ''
+    searchHardCodedPaths
+  '';
 
   configureFlags = [
     "--enable-native-backend"
@@ -50,6 +57,8 @@ stdenv.mkDerivation rec {
     NOCONFIGURE=1 ./autogen.sh
   '';
 
+  enableParallelBuilding = true;
+
   passthru.updateScript = deepin.updateScript { inherit name; };
 
   meta = with stdenv.lib; {

diff --git a/pkgs/desktops/deepin/deepin-sound-theme/default.nix b/pkgs/desktops/deepin/deepin-sound-theme/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "1sw4nrn7q7wk1hpicm05apyc0mihaw42iqm52wb8ib8gm1qiylr9";
   };
 
-  makeFlags = [ "PREFIX=$(out)" ];
+  makeFlags = [ "PREFIX=${placeholder ''out''}" ];
 
   passthru.updateScript = deepin.updateScript { inherit name; };
 

diff --git a/pkgs/desktops/deepin/deepin-terminal/default.nix b/pkgs/desktops/deepin/deepin-terminal/default.nix
@@ -1,19 +1,19 @@
 { stdenv, fetchurl, fetchFromGitHub, pkgconfig, cmake, ninja, vala,
-  gettext, gobject-introspection, at-spi2-core, dbus, epoxy, expect,
-  gtk3, json-glib, libXdmcp, libgee, libpthreadstubs, librsvg,
-  libsecret, libtasn1, libxcb, libxkbcommon, p11-kit, pcre, vte, wnck,
-  deepin-menu, deepin-shortcut-viewer, deepin }:
+  gettext, at-spi2-core, dbus, epoxy, expect, gtk3, json-glib,
+  libXdmcp, libgee, libpthreadstubs, librsvg, libsecret, libtasn1,
+  libxcb, libxkbcommon, p11-kit, pcre, vte, wnck, libselinux,
+  libsepol, utillinux, deepin-menu, deepin-shortcut-viewer, deepin }:
 
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "deepin-terminal";
-  version = "3.0.10.2";
+  version = "3.2.1.2";
 
   src = fetchFromGitHub {
     owner = "linuxdeepin";
     repo = "deepin-terminal";
     rev = version;
-    sha256 = "0ylhp8q9kfdq9l69drawjaf0q8vcqyflb2a3zfnwbnf06dlpvkz6";
+    sha256 = "0dj386csbiw0yqz9nj6ij0s4d0ak9lpq2bmsfs17bjkgdp0ayp90";
   };
 
   nativeBuildInputs = [
@@ -22,7 +22,8 @@ stdenv.mkDerivation rec {
     ninja
     vala
     gettext
-    gobject-introspection # For setup hook
+    libselinux libsepol utillinux # required by gio
+    deepin.setupHook
   ];
 
   buildInputs = [
@@ -49,15 +50,19 @@ stdenv.mkDerivation rec {
   ];
 
   postPatch = ''
-    patchShebangs .
+    searchHardCodedPaths
   '';
 
-  enableParallelBuilding = true;
+  cmakeFlags = [
+    "-DTEST_BUILD=OFF"
+    "-DUSE_VENDOR_LIB=OFF"
+    "-DVERSION=${version}"
+  ];
 
   passthru.updateScript = deepin.updateScript { inherit name; };
 
   meta = with stdenv.lib; {
-    description = "The default terminal emulation for Deepin";
+    description = "Default terminal emulator for Deepin";
     longDescription = ''
       Deepin terminal, it sharpens your focus in the world of command line!
       It is an advanced terminal emulator with workspace, multiple

diff --git a/pkgs/desktops/deepin/deepin-wallpapers/default.nix b/pkgs/desktops/deepin/deepin-wallpapers/default.nix
@@ -3,19 +3,21 @@
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "deepin-wallpapers";
-  version = "1.7.5";
+  version = "1.7.7";
 
   src = fetchFromGitHub {
     owner = "linuxdeepin";
     repo = "deepin-wallpapers";
     rev = version;
-    sha256 = "0mfjkh81ci0gjwmgycrh32by7v9b73nyvyjbqd29ccpb8bpyyakn";
+    sha256 = "09cfnxbpms98ibqbi4xd51181q3az5n8rmndcdr9w12kyzniz7xv";
   };
 
-  nativeBuildInputs = [ dde-api.bin ];
+  nativeBuildInputs = [ dde-api deepin.setupHook ];
 
   postPatch = ''
-    sed -i -e "s:/usr/lib/deepin-api:${dde-api.bin}/lib/deepin-api:" Makefile
+    searchHardCodedPaths # debugging
+
+    sed -i -e "s:/usr/lib/deepin-api:${dde-api}/lib/deepin-api:" Makefile
     sed -i -e "s:/usr/share/wallpapers:$out/share/wallpapers:" Makefile
   '';
 

diff --git a/pkgs/desktops/deepin/deepin-wm/default.nix b/pkgs/desktops/deepin/deepin-wm/default.nix
@@ -1,49 +1,55 @@
 { stdenv, fetchFromGitHub, pkgconfig, intltool, libtool, vala, gnome3,
-  bamf, clutter-gtk, pantheon, libcanberra-gtk3, libwnck3,
-  deepin-mutter, deepin-wallpapers, deepin-desktop-schemas,
-  hicolor-icon-theme, deepin }:
+  bamf, clutter-gtk, pantheon, libgee, libcanberra-gtk3, libwnck3,
+  deepin-menu, deepin-mutter, deepin-wallpapers,
+  deepin-desktop-schemas, wrapGAppsHook, deepin }:
 
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "deepin-wm";
-  version = "1.9.34";
+  version = "1.9.37";
 
   src = fetchFromGitHub {
     owner = "linuxdeepin";
     repo = pname;
     rev = version;
-    sha256 = "13hydcalifdc6723k8l4pk905y9sxic5x1fqww0fyx7j6b3hm13f";
+    sha256 = "1xd2x0kyav2cxnk0bybl7lrmak1r2468slxz5a6anrdriw9l10gi";
   };
 
   nativeBuildInputs = [
     pkgconfig
     intltool
     libtool
-    gnome3.gnome-common
     vala
+    gnome3.gnome-common
+    wrapGAppsHook
+    deepin.setupHook
   ];
 
   buildInputs = [
-    gnome3.gnome-desktop
-    gnome3.libgee
     bamf
     clutter-gtk
-    pantheon.granite
-    libcanberra-gtk3
-    libwnck3
+    deepin-desktop-schemas
+    deepin-menu
     deepin-mutter
     deepin-wallpapers
-    deepin-desktop-schemas
-    hicolor-icon-theme
+    gnome3.gnome-desktop
+    libcanberra-gtk3
+    libgee
+    libwnck3
+    pantheon.granite
   ];
 
   postPatch = ''
-    sed -i src/Background/BackgroundSource.vala \
-      -e 's;/usr/share/backgrounds/default_background.jpg;${deepin-wallpapers}/share/backgrounds/deepin/desktop.jpg;'
+    searchHardCodedPaths
+    fixPath ${deepin-wallpapers} /usr/share/backgrounds src/Background/BackgroundSource.vala
+    # fix background path
+    sed -i 's|default_background.jpg|deepin/desktop.jpg|' src/Background/BackgroundSource.vala
   '';
 
+  NIX_CFLAGS_COMPILE = "-DWNCK_I_KNOW_THIS_IS_UNSTABLE";
+
   preConfigure = ''
-    ./autogen.sh
+    NOCONFIGURE=1 ./autogen.sh
   '';
 
   enableParallelBuilding = true;

diff --git a/pkgs/desktops/deepin/default.nix b/pkgs/desktops/deepin/default.nix
@@ -2,6 +2,8 @@
 
 let
   packages = self: with self; {
+    setupHook = ./setup-hook.sh;
+
     updateScript = callPackage ./update.nix { };
 
     dbus-factory = callPackage ./dbus-factory { };
@@ -23,7 +25,6 @@ let
     deepin-shortcut-viewer = callPackage ./deepin-shortcut-viewer { };
     deepin-sound-theme = callPackage ./deepin-sound-theme { };
     deepin-terminal = callPackage ./deepin-terminal {
-      inherit (pkgs.gnome3) libgee;
       wnck = pkgs.libwnck3;
     };
     deepin-wallpapers = callPackage ./deepin-wallpapers { };

diff --git a/pkgs/desktops/deepin/dtkcore/default.nix b/pkgs/desktops/deepin/dtkcore/default.nix
@@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "dtkcore";
-  version = "2.0.9.8";
+  version = "2.0.10";
 
   src = fetchFromGitHub {
     owner = "linuxdeepin";
     repo = pname;
     rev = version;
-    sha256 = "06jj5gpy2qbmc21nf0fnbvgw7nbjjgvzx7m2vg9byw5il8l4g22h";
+    sha256 = "0dwpq6c38gaa95mgjnwj3vjz57n0cz6jfk950xi6s9ww2f4g6kq7";
   };
 
   nativeBuildInputs = [

diff --git a/pkgs/desktops/deepin/dtkwidget/default.nix b/pkgs/desktops/deepin/dtkwidget/default.nix
@@ -5,13 +5,13 @@
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "dtkwidget";
-  version = "2.0.9.10";
+  version = "2.0.10";
 
   src = fetchFromGitHub {
     owner = "linuxdeepin";
     repo = pname;
     rev = version;
-    sha256 = "0757dzy82bfv97b1gzkwa9zx3jzfbap20v3r1h7lkfcfw95410iw";
+    sha256 = "11a7yirfkcj3rq7va9av4m1pr22mq1yx1j9k18xrqv36n0rlbrr6";
   };
 
   nativeBuildInputs = [

diff --git a/pkgs/desktops/deepin/go-dbus-factory/default.nix b/pkgs/desktops/deepin/go-dbus-factory/default.nix
@@ -3,16 +3,16 @@
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "go-dbus-factory";
-  version = "0.0.7.1";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "linuxdeepin";
     repo = pname;
     rev = version;
-    sha256 = "0gj2xxv45gh7wr5ry3mcsi46kdsyq9nbd7znssn34kapiv40ixcx";
+    sha256 = "1i1ymi2qpcbf4d6rnfzrbq5n2vwnn8dvbq9xlw7jls3jpr3d5r00";
   };
 
-  makeFlags = [ "PREFIX=$(out)" ];
+  makeFlags = [ "PREFIX=${placeholder ''out''}" ];
 
   postPatch = ''
     sed -i -e 's:/share/gocode:/share/go:' Makefile

diff --git a/pkgs/desktops/deepin/go-dbus-generator/default.nix b/pkgs/desktops/deepin/go-dbus-generator/default.nix
@@ -18,8 +18,8 @@ stdenv.mkDerivation rec {
   ];
 
   makeFlags = [
-    "PREFIX=$(out)"
-    "GOCACHE=off"
+    "PREFIX=${placeholder ''out''}"
+    "GOCACHE=$(TMPDIR)/go-cache"
   ];
 
   passthru.updateScript = deepin.updateScript { inherit name; };

diff --git a/pkgs/desktops/deepin/go-gir-generator/default.nix b/pkgs/desktops/deepin/go-gir-generator/default.nix
@@ -4,23 +4,15 @@
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "go-gir-generator";
-  version = "1.1.0";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "linuxdeepin";
     repo = pname;
     rev = version;
-    sha256 = "0grp4ffy3vmlknzmymnxq1spwshff2ylqsw82pj4y2v2fcvnqfvb";
+    sha256 = "0d93qzp3dlia5d1yxw0rwca76qk3jyamj9xzmk13vzig8zw0jx16";
   };
 
-  patches = [
-    # fix: dde-api build error with gobject-introspection 1.58+
-    (fetchurl {
-      url = https://github.com/linuxdeepin/go-gir-generator/commit/a7ab229201e28d1be727f5021b3588fa4a1acf5f.patch;
-      sha256 = "13ywalwkjg8wwvd0pvmc2rv1h38airyvimdn9jfb5wis9xm48401";
-    })
-  ];
-
   nativeBuildInputs = [
     pkgconfig
     go
@@ -36,8 +28,8 @@ stdenv.mkDerivation rec {
   '';
 
   makeFlags = [
-    "PREFIX=$(out)"
-    "GOCACHE=off"
+    "PREFIX=${placeholder ''out''}"
+    "GOCACHE=$(TMPDIR)/go-cache"
   ];
 
   passthru.updateScript = deepin.updateScript { inherit name; };

diff --git a/pkgs/desktops/deepin/go-lib/default.nix b/pkgs/desktops/deepin/go-lib/default.nix
@@ -4,13 +4,13 @@
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "go-lib";
-  version = "1.3.0";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "linuxdeepin";
     repo = pname;
     rev = version;
-    sha256 = "0g84v1adnnyqc1mv45n3wlvnivkm1fi8ywszzgwx8irl3iddfvxv";
+    sha256 = "090l33y79gdj2xy1bhk2ksl6hvmsfhmx0bhygm4y4d0iqckf2x2m";
   };
 
   buildInputs = [
@@ -21,10 +21,12 @@ stdenv.mkDerivation rec {
     mobile-broadband-provider-info
   ];
 
-  makeFlags = [
-    "PREFIX=$(out)"
-    "GOSITE_DIR=$(out)/share/go"
-  ];
+  installPhase = ''
+    mkdir -p $out/share/go/src/pkg.deepin.io/lib
+    cp -a * $out/share/go/src/pkg.deepin.io/lib
+
+    rm -r $out/share/go/src/pkg.deepin.io/lib/debian
+  '';
 
   passthru.updateScript = deepin.updateScript { inherit name; };
 

diff --git a/pkgs/desktops/deepin/qt5dxcb-plugin/default.nix b/pkgs/desktops/deepin/qt5dxcb-plugin/default.nix
@@ -4,13 +4,13 @@
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "qt5dxcb-plugin";
-  version = "1.1.13";
+  version = "1.1.25";
 
   src = fetchFromGitHub {
     owner = "linuxdeepin";
     repo = pname;
     rev = version;
-    sha256 = "12lvh3agw3qdviqf32brmzba5kscnj5al5jhc08lq69a9kmip05x";
+    sha256 = "1nadmj1hdpw4n3kpk3dlx22bmxdli66abhjl73hwrbvszmmcm9vp";
   };
 
   nativeBuildInputs = [

diff --git a/pkgs/desktops/deepin/qt5integration/default.nix b/pkgs/desktops/deepin/qt5integration/default.nix
@@ -5,13 +5,13 @@
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "qt5integration";
-  version = "0.3.6";
+  version = "0.3.8";
 
   src = fetchFromGitHub {
     owner = "linuxdeepin";
     repo = pname;
     rev = version;
-    sha256 = "1v9whlqn07c5c8xnaiicdshj9n88a667gfbn8y8bk5bfylilfzcy";
+    sha256 = "12d6iv2x0q2n73rscma30q31nh7h26gmhlf665gkgl2j825hlx5n";
   };
 
   nativeBuildInputs = [

diff --git a/pkgs/desktops/deepin/setup-hook.sh b/pkgs/desktops/deepin/setup-hook.sh
@@ -0,0 +1,53 @@
+# Helper functions for deepin packaging
+
+searchHardCodedPaths() {
+    # looks for ocurrences of hard coded paths in given (current)
+    # directory and command invocations for the purpose of debugging a
+    # derivation
+
+    local dir=$1
+
+    echo ----------- looking for command invocations
+    grep --color=always -r -E '\<(ExecStart|Exec|startDetached|execute|exec\.(Command|LookPath))\>' $dir || true
+
+    echo ----------- looking for hard coded paths
+    grep --color=always -r -E '/(usr|bin|sbin|etc|var|opt)\>' $dir || true
+
+    echo ----------- done
+}
+
+fixPath() {
+    # Usage:
+    #
+    #   fixPath <parent dir> <path> <files>
+    #
+    # replaces occurences of <path> by <parent_dir><path> in <files>
+    # removing /usr from the start of <path> if present
+
+    local parentdir=$1
+    local path=$2
+    local newpath=$parentdir$(echo $path | sed "s,^/usr,,")
+    local files=("${@:3}")
+    echo ======= grep --color=always "${path}" "${files[@]}"
+    grep --color=always "${path}" "${files[@]}"
+    echo +++++++ sed -i -e "s,$path,$newpath,g" "${files[@]}"
+    sed -i -e "s,$path,$newpath,g" "${files[@]}"
+}
+
+searchForUnresolvedDLL() {
+    # Usage:
+    #
+    #   searchForUnresolvedDLL <dir>
+    #
+    # looks in <dir> for executables with unresolved dynamic library paths
+
+    local dir="$1"
+    echo ======= Looking for executables with unresolved dynamic library dependencies
+    echo $dir
+    for f in $(find -L "$dir" -type f -executable); do
+      if (ldd $f | grep -q "not found"); then
+        echo $f
+        ldd $f | grep --color=always "not found"
+      fi
+    done
+}
diff --git a/pkgs/development/libraries/flatpak/default.nix b/pkgs/development/libraries/flatpak/default.nix
@@ -5,14 +5,14 @@
 
 stdenv.mkDerivation rec {
   pname = "flatpak";
-  version = "1.2.3";
+  version = "1.2.4";
 
   # TODO: split out lib once we figure out what to do with triggerdir
   outputs = [ "out" "man" "doc" "installedTests" ];
 
   src = fetchurl {
     url = "https://github.com/flatpak/flatpak/releases/download/${version}/${pname}-${version}.tar.xz";
-    sha256 = "0i0dn3w3545lvmjlzqj3j70lk8yrq64r9frp1rk6a161gwq20ixv";
+    sha256 = "1qf3ys84fzv11z6f6li59rxjdjbyrv7cyi9539k73r9i9pckjr8v";
   };
 
   patches = [

diff --git a/pkgs/development/libraries/libssh2/default.nix b/pkgs/development/libraries/libssh2/default.nix
@@ -1,11 +1,12 @@
 { stdenv, fetchurl, openssl, zlib, windows }:
 
 stdenv.mkDerivation rec {
-  name = "libssh2-1.8.0";
+  pname = "libssh2";
+  version = "1.8.1";
 
   src = fetchurl {
-    url = "${meta.homepage}/download/${name}.tar.gz";
-    sha256 = "1m3n8spv79qhjq4yi0wgly5s5rc8783jb1pyra9bkx1md0plxwrr";
+    url = "${meta.homepage}/download/${pname}-${version}.tar.gz";
+    sha256 = "0ngif3ynk6xqzy5nlfjs7bsmfm81g9f145av0z86kf0vbgrigda0";
   };
 
   outputs = [ "out" "dev" "devdoc" ];

diff --git a/pkgs/development/node-packages/composition-v6.nix b/pkgs/development/node-packages/composition-v6.nix
diff --git a/pkgs/development/node-packages/generate.sh b/pkgs/development/node-packages/generate.sh
@@ -4,6 +4,5 @@
 set -eu -o pipefail
 
 rm -f node-env.nix
-node2nix -6 -i node-packages-v6.json -o node-packages-v6.nix -c composition-v6.nix
 node2nix -8 -i node-packages-v8.json -o node-packages-v8.nix -c composition-v8.nix
 node2nix --nodejs-10 -i node-packages-v10.json -o node-packages-v10.nix -c composition-v10.nix
diff --git a/pkgs/development/web/nodejs/v6.nix b/pkgs/development/web/nodejs/v6.nix
diff --git a/pkgs/development/web/remarkjs/generate.sh b/pkgs/development/web/remarkjs/generate.sh
@@ -1,3 +1,3 @@
 #!/bin/sh -e
 
-node2nix -6 -i pkgs.json -c nodepkgs.nix -e ../../node-packages/node-env.nix
+node2nix -8 -i pkgs.json -c nodepkgs.nix -e ../../node-packages/node-env.nix
diff --git a/pkgs/development/web/remarkjs/node-packages.nix b/pkgs/development/web/remarkjs/node-packages.nix
diff --git a/pkgs/development/web/remarkjs/nodepkgs.nix b/pkgs/development/web/remarkjs/nodepkgs.nix
@@ -2,7 +2,7 @@
 
 {pkgs ? import <nixpkgs> {
     inherit system;
-  }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs-6_x"}:
+  }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs-8_x"}:
 
 let
   nodeEnv = import ../../node-packages/node-env.nix {

diff --git a/pkgs/misc/base16-builder/default.nix b/pkgs/misc/base16-builder/default.nix
@@ -1,14 +1,6 @@
 { stdenv, pkgs }:
 
 let
-  # node-packages*.nix generated via:
-  #
-  # % node2nix --input node-packages.json \
-  #            --output node-packages-generated.nix \
-  #            --composition node-packages.nix \
-  #            --node-env ./../../development/node-packages/node-env.nix \
-  #            --pkg-name nodejs-6_x
-  #
   nodePackages = import ./node-packages.nix {
     inherit pkgs;
     inherit (stdenv.hostPlatform) system;

diff --git a/pkgs/misc/base16-builder/generate.sh b/pkgs/misc/base16-builder/generate.sh
@@ -0,0 +1,7 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i bash -p nodePackages.node2nix
+exec node2nix -8 \
+     --input node-packages.json \
+     --output node-packages-generated.nix \
+     --composition node-packages.nix \
+     --node-env ./../../development/node-packages/node-env.nix \
diff --git a/pkgs/misc/base16-builder/node-packages-generated.nix b/pkgs/misc/base16-builder/node-packages-generated.nix
diff --git a/pkgs/misc/base16-builder/node-packages.nix b/pkgs/misc/base16-builder/node-packages.nix
diff --git a/pkgs/os-specific/linux/fuse/fuse3-install.patch b/pkgs/os-specific/linux/fuse/fuse3-install.patch
@@ -32,3 +32,13 @@
 -fi
 -
 -
+diff --git a/util/meson.build b/util/meson.build
+index aa0e734..06d4378 100644
+--- a/util/meson.build
++++ b/util/meson.build
+@@ -1,4 +1,4 @@
+-fuseconf_path = join_paths(get_option('prefix'), get_option('sysconfdir'), 'fuse.conf')
++fuseconf_path = join_paths('/', get_option('sysconfdir'), 'fuse.conf')
+
+ executable('fusermount3', ['fusermount.c', '../lib/mount_util.c'],
+            include_directories: include_dirs,
diff --git a/pkgs/servers/nextcloud/default.nix b/pkgs/servers/nextcloud/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "nextcloud-${version}";
-  version = "15.0.5";
+  version = "15.0.6";
 
   src = fetchurl {
     url = "https://download.nextcloud.com/server/releases/${name}.tar.bz2";
-    sha256 = "125ra0rdgk17d8s80i54w0s58dqvjgkdpcxbczchqd3sg6dqcqa6";
+    sha256 = "1k1c0wlrhdpkvwf7iq8yjxd8gqmmj7dyd913rqzrg9jbnvz5jc82";
   };
 
   installPhase = ''

diff --git a/pkgs/servers/web-apps/codimd/CodeMirror/default.nix b/pkgs/servers/web-apps/codimd/CodeMirror/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, pkgs, buildEnv, fetchFromGitHub, nodejs-6_x, phantomjs2, which }:
+{ stdenv, pkgs, buildEnv, fetchFromGitHub, nodejs-8_x, phantomjs2, which }:
 
 let
   nodePackages = import ./node.nix {
@@ -22,7 +22,7 @@ stdenv.mkDerivation {
   };
 
   nativeBuildInputs = [ which ];
-  buildInputs = [ nodejs-6_x phantomjs-prebuilt ] ++ (stdenv.lib.attrVals [
+  buildInputs = [ nodejs-8_x phantomjs-prebuilt ] ++ (stdenv.lib.attrVals [
     "blint-^1"
     "node-static-0.6.0"
     "rollup-^0.41.0"

diff --git a/pkgs/servers/web-apps/codimd/CodeMirror/generate.sh b/pkgs/servers/web-apps/codimd/CodeMirror/generate.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env nix-shell
 #! nix-shell -i bash -p nodePackages.node2nix
 
-node2nix -6 -i deps.json \
+node2nix -8 -i deps.json \
   -e ../../../../development/node-packages/node-env.nix \
   --no-copy-node-env \
   -c node.nix
diff --git a/pkgs/servers/web-apps/codimd/CodeMirror/node-packages.nix b/pkgs/servers/web-apps/codimd/CodeMirror/node-packages.nix
diff --git a/pkgs/servers/web-apps/codimd/CodeMirror/node.nix b/pkgs/servers/web-apps/codimd/CodeMirror/node.nix
@@ -2,7 +2,7 @@
 
 {pkgs ? import <nixpkgs> {
     inherit system;
-  }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs-6_x"}:
+  }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs-8_x"}:
 
 let
   nodeEnv = import ../../../../development/node-packages/node-env.nix {
@@ -14,4 +14,4 @@ in
 import ./node-packages.nix {
   inherit (pkgs) fetchurl fetchgit;
   inherit nodeEnv;
-}
+}
diff --git a/pkgs/servers/web-apps/codimd/default.nix b/pkgs/servers/web-apps/codimd/default.nix
@@ -1,9 +1,26 @@
 { stdenv, pkgs, buildEnv, fetchFromGitHub, makeWrapper
-, fetchpatch, nodejs-6_x, phantomjs2, runtimeShell }:
+, fetchpatch, nodejs-8_x, phantomjs2, runtimeShell }:
 let
-  nodePackages = import ./node.nix {
-    inherit pkgs;
-    system = stdenv.system;
+  nodePackages = let
+    # Some packages fail to install with ENOTCACHED due to a mistakenly added
+    # package-lock.json that bundles optional dependencies not resolved with `node2nix.
+    # See also https://github.com/svanderburg/node2nix/issues/134
+    dontInstall = n: v:
+      if builtins.match ".*babel.*" n == null
+      then v
+      else v.override { dontNpmInstall = true; };
+
+    packages = stdenv.lib.mapAttrs (dontInstall) (
+      import ./node.nix {
+        inherit pkgs;
+        system = stdenv.system;
+      }
+    );
+  in packages // {
+    "js-url-^2.3.0" = packages."js-url-^2.3.0".overrideAttrs (_: {
+      # Don't download chromium (this isn't needed anyway for our case).
+      PUPPETEER_SKIP_CHROMIUM_DOWNLOAD = "1";
+    });
   };
 
   addPhantomjs = (pkgs:
@@ -14,12 +31,17 @@ let
   drvName = drv: (builtins.parseDrvName drv).name;
 
   linkNodeDeps = ({ pkg, deps, name ? "" }:
-    nodePackages.${pkg}.override (oldAttrs: {
-      postInstall = stdenv.lib.concatStringsSep "\n" (map (dep: ''
-        ln -s ${nodePackages.${dep}}/lib/node_modules/${drvName dep} \
-          $out/lib/node_modules/${if name != "" then name else drvName pkg}/node_modules
-      '') deps
-      );
+    let
+      targetModule = if name != "" then name else drvName pkg;
+    in nodePackages.${pkg}.override (oldAttrs: {
+      postInstall = ''
+        mkdir -p $out/lib/node_modules/${targetModule}/node_modules
+        ${stdenv.lib.concatStringsSep "\n" (map (dep: ''
+          ln -s ${nodePackages.${dep}}/lib/node_modules/${drvName dep} \
+            $out/lib/node_modules/${targetModule}/node_modules/${drvName dep}
+        '') deps
+        )}
+      '';
     })
   );
 
@@ -43,8 +65,6 @@ let
     linkNodeDeps args ) [
     { pkg = "select2-^3.5.2-browserify";
       deps = [ "url-loader-^0.5.7" ]; }
-    { pkg = "js-sequence-diagrams-^1000000.0.6";
-      deps = [ "lodash-^4.17.4" ]; }
     { pkg = "ionicons-~2.0.1";
       deps = [ "url-loader-^0.5.7" "file-loader-^0.9.0" ]; }
     { pkg = "font-awesome-^4.7.0";
@@ -66,18 +86,34 @@ let
     name = "codimd-env";
     paths = pkgsWithPhantomjs ++ pkgsWithExtraDeps ++ [
       codemirror
+
+      # `js-sequence-diagrams` has been removed from the registry
+      # and replaced by a security holding package (the tarballs weren't published by
+      # upstream as upstream only supports bower,
+      # see https://github.com/bramp/js-sequence-diagrams/issues/212).
+      #
+      # As the tarballs are still there, we build this manually for now until codimd's upstream
+      # has resolved the issue.
+      (import ./js-sequence-diagrams {
+        inherit pkgs;
+        nodejs = nodejs-8_x;
+        extraNodePackages = {
+          lodash = nodePackages."lodash-^4.17.4";
+          eve = nodePackages."eve-^0.5.4";
+        };
+      })
    ] ++ filterNodePackagesToList [
      "bootstrap"
      "codemirror-git+https://github.com/hackmdio/CodeMirror.git"
      "font-awesome"
      "ionicons"
-     "js-sequence-diagrams"
      "js-url"
      "markdown-it"
      "markdown-pdf"
-"node-uuid"
+     "node-uuid"
      "raphael-git+https://github.com/dmitrybaranovskiy/raphael"
      "select2-browserify"
+     "url-loader"
    ] nodePackages;
   };
 
@@ -107,7 +143,7 @@ stdenv.mkDerivation rec {
   inherit name version src;
 
   nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ nodejs-6_x ];
+  buildInputs = [ nodejs-8_x ];
 
   NODE_PATH = "${nodeEnv}/lib/node_modules";
 
@@ -118,6 +154,12 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  postPatch = ''
+    # due to the `dontNpmInstall` workaround, `node_modules/.bin` isn't created anymore.
+    substituteInPlace package.json \
+      --replace "webpack --config" "${nodejs-8_x}/bin/node ./node_modules/webpack/bin/webpack.js --config"
+  '';
+
   buildPhase = ''
     ln -s ${nodeEnv}/lib/node_modules node_modules
     npm run build
@@ -127,7 +169,7 @@ stdenv.mkDerivation rec {
     mkdir -p $out/bin
     cat > $out/bin/codimd <<EOF
       #!${runtimeShell}
-      ${nodejs-6_x}/bin/node $out/app.js
+      ${nodejs-8_x}/bin/node $out/app.js
     EOF
     cp -R {app.js,bin,lib,locales,package.json,public} $out/
   '';
@@ -150,7 +192,7 @@ stdenv.mkDerivation rec {
     description = "Realtime collaborative markdown notes on all platforms";
     license = licenses.agpl3;
     homepage = https://github.com/hackmdio/codimd;
-    maintainers = with maintainers; [ willibutz ];
+    maintainers = with maintainers; [ willibutz ma27 ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/servers/web-apps/codimd/deps.json b/pkgs/servers/web-apps/codimd/deps.json
@@ -71,7 +71,6 @@
 , { "jquery-mousewheel": "^3.1.13" }
 , { "jquery-ui": "^1.12.1" }
 , { "js-cookie": "^2.1.3" }
-, { "js-sequence-diagrams": "^1000000.0.6" }
 , { "js-url": "^2.3.0" }
 , { "js-yaml": "^3.7.0" }
 , { "jsdom-nogyp": "^0.8.3" }

diff --git a/pkgs/servers/web-apps/codimd/generate.sh b/pkgs/servers/web-apps/codimd/generate.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env nix-shell
 #! nix-shell -i bash -p nodePackages.node2nix
 
-node2nix -6 -i deps.json \
+node2nix -8 -i deps.json \
   -e ../../../development/node-packages/node-env.nix \
   --no-copy-node-env \
   -c node.nix
diff --git a/pkgs/servers/web-apps/codimd/js-sequence-diagrams/default.nix b/pkgs/servers/web-apps/codimd/js-sequence-diagrams/default.nix
@@ -0,0 +1,31 @@
+{ pkgs, nodejs, extraNodePackages }:
+
+let
+  nodeEnv = import ../../../../development/node-packages/node-env.nix {
+    inherit (pkgs) stdenv python2 utillinux runCommand writeTextFile;
+    inherit nodejs;
+    libtool = if pkgs.stdenv.isDarwin then pkgs.darwin.cctools else null;
+  };
+in
+  nodeEnv.buildNodePackage {
+    name = "js-sequence-diagrams";
+    packageName = "js-sequence-diagrams";
+    version = "1000000.0.6";
+    src = pkgs.fetchurl {
+      url = "https://registry.npmjs.org/js-sequence-diagrams/-/js-sequence-diagrams-1000000.0.6.tgz";
+      sha1 = "e95db01420479c5ccbc12046af1da42fde649e5c";
+    };
+    dependencies = [ ];
+    dontNpmInstall = true;
+    meta = {
+      description = "Fucks NPM and draws simple SVG sequence diagrams from textual representation of the diagram";
+      homepage = "https://github.com/Moeditor/js-sequence-diagrams#readme";
+      license = "BSD-2-Clause";
+    };
+    production = true;
+    bypassCache = true;
+
+    postInstall = builtins.concatStringsSep "\n" (pkgs.lib.mapAttrsToList (
+      name: pkg: "ln -s ${pkg}/lib/node_modules/${name} $out/lib/node_modules/${name}"
+    ) extraNodePackages);
+  }
diff --git a/pkgs/servers/web-apps/codimd/node-packages.nix b/pkgs/servers/web-apps/codimd/node-packages.nix
diff --git a/pkgs/servers/web-apps/codimd/node.nix b/pkgs/servers/web-apps/codimd/node.nix
@@ -2,7 +2,7 @@
 
 {pkgs ? import <nixpkgs> {
     inherit system;
-  }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs-6_x"}:
+  }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs-8_x"}:
 
 let
   nodeEnv = import ../../../development/node-packages/node-env.nix {
@@ -14,4 +14,4 @@ in
 import ./node-packages.nix {
   inherit (pkgs) fetchurl fetchgit;
   inherit nodeEnv;
-}
+}
diff --git a/pkgs/tools/graphics/blur-effect/default.nix b/pkgs/tools/graphics/blur-effect/default.nix
@@ -0,0 +1,33 @@
+{ stdenv, fetchFromGitHub, pkgconfig, cmake, gdk_pixbuf, libGL, mesa }:
+
+stdenv.mkDerivation rec {
+  pname = "blur-effect";
+  version = "1.1.3";
+
+  src = fetchFromGitHub {
+    owner = "sonald";
+    repo = pname;
+    rev = version;
+    sha256 = "0cjw7iz0p7x1bi4vmwrivfidry5wlkgfgdl9wly88cm3z9ib98jj";
+  };
+
+  nativeBuildInputs = [
+    pkgconfig
+    cmake
+  ];
+
+  buildInputs = [
+    gdk_pixbuf
+    libGL
+    mesa
+  ];
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/sonald/blur-effect;
+    description = "Off-screen image blurring utility using OpenGL ES 3.0";
+    license = licenses.gpl3;
+    platforms = platforms.unix;
+    broken = stdenv.hostPlatform.isDarwin; # packages 'libdrm' and 'gbm' not found
+    maintainers = with maintainers; [ romildo ];
+  };
+}
diff --git a/pkgs/tools/graphics/xcur2png/default.nix b/pkgs/tools/graphics/xcur2png/default.nix
@@ -0,0 +1,32 @@
+{ stdenv, fetchFromGitHub, pkgconfig, libpng, xorg }:
+
+stdenv.mkDerivation rec {
+  pname = "xcur2png";
+  version = "0.7.1";
+
+  src = fetchFromGitHub {
+    owner = "eworm-de";
+    repo = pname;
+    rev = version;
+    sha256 = "0858wn2p14bxpv9lvaz2bz1rk6zk0g8zgxf8iy595m8fqv4q2fya";
+  };
+
+  nativeBuildInputs = [
+    pkgconfig
+  ];
+
+  buildInputs = [
+    libpng
+    xorg.libX11
+    xorg.libXcursor
+    xorg.xorgproto
+  ];
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/eworm-de/xcur2png/releases;
+    description = "Convert X cursors to PNG images";
+    license = licenses.gpl3;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ romildo ];
+  };
+}
diff --git a/pkgs/tools/networking/airfield/deps.sh b/pkgs/tools/networking/airfield/deps.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env nix-shell
 #! nix-shell -i bash -p nodePackages.node2nix
 
-node2nix -6 -i deps.json \
+node2nix -8 -i deps.json \
   --no-copy-node-env \
   -e ../../../development/node-packages/node-env.nix -c node.nix
diff --git a/pkgs/tools/networking/airfield/node-packages.nix b/pkgs/tools/networking/airfield/node-packages.nix
diff --git a/pkgs/tools/networking/airfield/node.nix b/pkgs/tools/networking/airfield/node.nix
@@ -2,7 +2,7 @@
 
 {pkgs ? import <nixpkgs> {
     inherit system;
-  }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs-6_x"}:
+  }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs-8_x"}:
 
 let
   nodeEnv = import ../../../development/node-packages/node-env.nix {

diff --git a/pkgs/tools/package-management/nixui/generate.sh b/pkgs/tools/package-management/nixui/generate.sh
@@ -1,4 +1,4 @@
 #!/usr/bin/env nix-shell
 #! nix-shell -i bash -p nodePackages.node2nix
 
-exec node2nix -6 -i pkg.json -c nixui.nix -e ../../../development/node-packages/node-env.nix --no-copy-node-env
+exec node2nix -8 -i pkg.json -c nixui.nix -e ../../../development/node-packages/node-env.nix --no-copy-node-env
diff --git a/pkgs/tools/package-management/nixui/nixui.nix b/pkgs/tools/package-management/nixui/nixui.nix
@@ -2,7 +2,7 @@
 
 {pkgs ? import <nixpkgs> {
     inherit system;
-  }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs-6_x"}:
+  }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs-8_x"}:
 
 let
   nodeEnv = import ../../../development/node-packages/node-env.nix {

diff --git a/pkgs/tools/package-management/nixui/node-packages.nix b/pkgs/tools/package-management/nixui/node-packages.nix
diff --git a/pkgs/tools/security/bitwarden-cli/generate.sh b/pkgs/tools/security/bitwarden-cli/generate.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i bash -p nodePackages.node2nix
+
+exec node2nix -8 \
+    --input node-packages.json \
+    --output node-packages-generated.nix \
+    --composition node-packages.nix \
+    --node-env ./../../../development/node-packages/node-env.nix
diff --git a/pkgs/tools/security/bitwarden-cli/node-packages-generated.nix b/pkgs/tools/security/bitwarden-cli/node-packages-generated.nix
diff --git a/pkgs/tools/security/bitwarden-cli/node-packages.nix b/pkgs/tools/security/bitwarden-cli/node-packages.nix
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
@@ -960,6 +960,8 @@ in
 
   bluemix-cli = callPackage ../tools/admin/bluemix-cli { };
 
+  blur-effect = callPackage ../tools/graphics/blur-effect { };
+
   charles = charles4;
   inherit (callPackage ../applications/networking/charles {})
     charles3
@@ -3903,10 +3905,7 @@ in
 
   nodejs = hiPrio nodejs-8_x;
 
-  nodejs-slim = nodejs-slim-6_x;
-
-  nodejs-6_x = callPackage ../development/web/nodejs/v6.nix {};
-  nodejs-slim-6_x = callPackage ../development/web/nodejs/v6.nix { enableNpm = false; };
+  nodejs-slim = nodejs-slim-8_x;
 
   nodejs-8_x = callPackage ../development/web/nodejs/v8.nix {};
   nodejs-slim-8_x = callPackage ../development/web/nodejs/v8.nix { enableNpm = false; };
@@ -3934,10 +3933,6 @@ in
     nodejs = pkgs.nodejs-8_x;
   });
 
-  nodePackages_6_x = dontRecurseIntoAttrs (callPackage ../development/node-packages/default-v6.nix {
-    nodejs = pkgs.nodejs-6_x;
-  });
-
   nodePackages = nodePackages_10_x;
 
   npm2nix = nodePackages.npm2nix;
@@ -6396,6 +6391,8 @@ in
 
   xclip = callPackage ../tools/misc/xclip { };
 
+  xcur2png = callPackage ../tools/graphics/xcur2png { };
+
   xcwd = callPackage ../tools/X11/xcwd { };
 
   xtitle = callPackage ../tools/misc/xtitle { };