NixOS · Nov 23, 2018 · Nov 23, 2018 · Nov 23, 2018 · Nov 23, 2018 · Nov 23, 2018
diff --git a/nixos/modules/services/web-servers/nginx/vhost-options.nix b/nixos/modules/services/web-servers/nginx/vhost-options.nix
@@ -69,7 +69,7 @@ with lib;
     acmeRoot = mkOption {
       type = types.str;
       default = "/var/lib/acme/acme-challenge";
-      description = "Directory to store certificates and keys managed by the ACME service.";
+      description = "Directory for the acme challenge which is PUBLIC, don't put certs or keys in here";
     };
 
     acmeFallbackHost = mkOption {

diff --git a/nixos/release.nix b/nixos/release.nix
@@ -329,7 +329,7 @@ in rec {
   tests.plotinus = callTest tests/plotinus.nix {};
   tests.keymap = callSubTests tests/keymap.nix {};
   tests.initrdNetwork = callTest tests/initrd-network.nix {};
-  tests.kafka = callSubTests tests/kafka.nix {};
+  #tests.kafka = callSubTests tests/kafka.nix {}; # broken since openjdk: 8u181 -> 8u192
   tests.kernel-latest = callTest tests/kernel-latest.nix {};
   tests.kernel-lts = callTest tests/kernel-lts.nix {};
   tests.kubernetes.dns = callSubTestsOnMatchingSystems ["x86_64-linux"] tests/kubernetes/dns.nix {};

diff --git a/pkgs/applications/misc/dbeaver/default.nix b/pkgs/applications/misc/dbeaver/default.nix
@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation rec {
   name = "dbeaver-ce-${version}";
-  version = "5.2.5";
+  version = "5.3.0";
 
   desktopItem = makeDesktopItem {
     name = "dbeaver";
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://dbeaver.io/files/${version}/dbeaver-ce-${version}-linux.gtk.x86_64.tar.gz";
-    sha256 = "0xjggjq2brhi9x3i4d7hqfi18cd8czs6rzvihvspfxaqilsai0dm";
+    sha256 = "1gn52bffjn2fw9yhi1rv4iy9dfdn5qxc51gv6qri5g0c8pblvh7m";
   };
 
   installPhase = ''

diff --git a/pkgs/applications/misc/gnss-sdr/default.nix b/pkgs/applications/misc/gnss-sdr/default.nix
@@ -47,6 +47,7 @@ stdenv.mkDerivation rec {
   cmakeFlags = [
     "-DGFlags_ROOT_DIR=${google-gflags}/lib"
     "-DGLOG_INCLUDE_DIR=${glog}/include"
+    "-DENABLE_UNIT_TESTING=OFF"
 
     # gnss-sdr doesn't truly depend on BLAS or LAPACK, as long as
     # armadillo is built using both, so skip checking for them.

diff --git a/pkgs/applications/networking/browsers/google-chrome/default.nix b/pkgs/applications/networking/browsers/google-chrome/default.nix
@@ -4,7 +4,7 @@
 , glib, fontconfig, freetype, pango, cairo, libX11, libXi, atk, gconf, nss, nspr
 , libXcursor, libXext, libXfixes, libXrender, libXScrnSaver, libXcomposite, libxcb
 , alsaLib, libXdamage, libXtst, libXrandr, expat, cups
-, dbus, gtk2, gtk3, gdk_pixbuf, gcc-unwrapped, at-spi2-atk
+, dbus, gtk2, gtk3, gdk_pixbuf, gcc-unwrapped, at-spi2-atk, at-spi2-core
 , kerberos
 
 # command line arguments which are always set e.g "--disable-gpu"
@@ -57,7 +57,7 @@ let
     libexif
     liberation_ttf curl utillinux xdg_utils wget
     flac harfbuzz icu libpng opusWithCustomModes snappy speechd
-    bzip2 libcap at-spi2-atk
+    bzip2 libcap at-spi2-atk at-spi2-core
     kerberos
   ] ++ optional pulseSupport libpulseaudio
     ++ [ gtk ];

diff --git a/pkgs/applications/networking/dropbox/default.nix b/pkgs/applications/networking/dropbox/default.nix
@@ -36,7 +36,7 @@ buildFHSUserEnv {
     libICE libSM libX11 libXcomposite libXdamage libXext libXfixes libXrender
     libXxf86vm libxcb xkeyboardconfig
     curl dbus firefox-bin fontconfig freetype gcc glib gnutar libxml2 libxslt
-    procps zlib
+    procps zlib mesa libxshmfence libpthreadstubs
   ];
 
   extraInstallCommands = ''

diff --git a/pkgs/data/misc/tzdata/default.nix b/pkgs/data/misc/tzdata/default.nix
@@ -2,16 +2,16 @@
 
 stdenv.mkDerivation rec {
   name = "tzdata-${version}";
-  version = "2018e";
+  version = "2018g";
 
   srcs =
     [ (fetchurl {
-        url = "http://www.iana.org/time-zones/repository/releases/tzdata${version}.tar.gz";
-        sha256 = "0bk97fv2i5ns42prpmlaadsswdjwv0ifi7whj2s4q6l44rcqwa3b";
+        url = "https://data.iana.org/time-zones/releases/tzdata${version}.tar.gz";
+        sha256 = "05kayi3w9pvhj6ljx1hvwd0r8mxfzn436fjmwhx53xkj919xxpq2";
       })
       (fetchurl {
-        url = "http://www.iana.org/time-zones/repository/releases/tzcode${version}.tar.gz";
-        sha256 = "1kpb02631s58i068mwq63xlamcv1ffj4p6y4wpb9kdl01vr0qd6a";
+        url = "https://data.iana.org/time-zones/releases/tzcode${version}.tar.gz";
+        sha256 = "09y44fzcdq3c06saa8iqqa0a59cyw6ni3p31ps0j1w3hcpxz8lxa";
       })
     ];
 

diff --git a/pkgs/development/libraries/libpng/default.nix b/pkgs/development/libraries/libpng/default.nix
@@ -3,20 +3,20 @@
 assert zlib != null;
 
 let
-  patchVersion = "1.6.34";
+  patchVersion = "1.6.35";
   patch_src = fetchurl {
     url = "mirror://sourceforge/libpng-apng/libpng-${patchVersion}-apng.patch.gz";
-    sha256 = "1ha4npf9mfrzp0srg8a5amks5ww84xzfpjbsj8k3yjjpai798qg6";
+    sha256 = "011fq5wgyz07pfrqs9albixbiksx3agx5nkcf3535gbvhlwv5khq";
   };
   whenPatched = stdenv.lib.optionalString apngSupport;
 
 in stdenv.mkDerivation rec {
   name = "libpng" + whenPatched "-apng" + "-${version}";
-  version = "1.6.34";
+  version = "1.6.35";
 
   src = fetchurl {
     url = "mirror://sourceforge/libpng/libpng-${version}.tar.xz";
-    sha256 = "1xjr0v34fyjgnhvaa1zixcpx5yvxcg4zwvfh0fyklfyfj86rc7ig";
+    sha256 = "1mxwjf5cdzk7g0y51gl9w3f0j5ypcls05i89kgnifjaqr742x493";
   };
   postPatch = whenPatched "gunzip < ${patch_src} | patch -Np1";
 

diff --git a/pkgs/development/libraries/ncurses/default.nix b/pkgs/development/libraries/ncurses/default.nix
@@ -12,17 +12,18 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "6.1";
+  version = "6.1-20181027";
   name = "ncurses-${version}" + lib.optionalString (abiVersion == "5") "-abi5-compat";
 
   src = fetchurl {
-    url = "mirror://gnu/ncurses/ncurses-${version}.tar.gz";
-    sha256 = "05qdmbmrrn88ii9f66rkcmcyzp1kb1ymkx7g040lfkd1nkp7w1da";
+    urls = [
+      "https://invisible-mirror.net/archives/ncurses/current/ncurses-${version}.tgz"
+      "ftp://ftp.invisible-island.net/ncurses/current/ncurses-${version}.tgz"
+    ];
+    sha256 = "1xn6wpi22jc61158w4ifq6s1fvilhmsy1in2srn3plk8pm0d4902";
   };
 
-  # The patch st-0.7.patch needs to be removed, if ncurses is upgraded in the future.
-  # It is necessary for the 6.1 version of ncurses.
-  patches = [ ./st-0.7.patch ] ++ lib.optional (!stdenv.cc.isClang) ./clang.patch;
+  patches = lib.optional (!stdenv.cc.isClang) ./clang.patch;
 
   outputs = [ "out" "dev" "man" ];
   setOutputFlags = false; # some aren't supported
@@ -32,6 +33,7 @@ stdenv.mkDerivation rec {
     "--without-debug"
     "--enable-pc-files"
     "--enable-symlinks"
+    "--with-manpage-format=normal"
   ] ++ lib.optional unicode "--enable-widec"
     ++ lib.optional (!withCxx) "--without-cxx"
     ++ lib.optional (abiVersion == "5") "--with-abi-version=5"

diff --git a/pkgs/development/libraries/ncurses/st-0.7.patch b/pkgs/development/libraries/ncurses/st-0.7.patch
diff --git a/pkgs/development/libraries/nss/default.nix b/pkgs/development/libraries/nss/default.nix
@@ -8,11 +8,11 @@ let
 
 in stdenv.mkDerivation rec {
   name = "nss-${version}";
-  version = "3.39";
+  version = "3.40";
 
   src = fetchurl {
-    url = "mirror://mozilla/security/nss/releases/NSS_3_39_RTM/src/${name}.tar.gz";
-    sha256 = "0jw6qlfl2g47hhx056nvnj6h92bk3sn46hy3ig61a911dzblvrkb";
+    url = "mirror://mozilla/security/nss/releases/NSS_3_40_RTM/src/${name}.tar.gz";
+    sha256 = "1p9jidi3nysirf3lhkrqkjjrf2cw3y2wz2jgjvsjn1ysidxhhqh5";
   };
 
   buildInputs = [ perl zlib sqlite ]

diff --git a/pkgs/development/libraries/sqlite/analyzer.nix b/pkgs/development/libraries/sqlite/analyzer.nix
@@ -6,11 +6,11 @@ in
 
 stdenv.mkDerivation rec {
   name = "sqlite-analyzer-${version}";
-  version = "3.24.0";
+  version = "3.25.3";
 
   src = assert version == sqlite.version; fetchurl {
     url = "https://sqlite.org/2018/sqlite-src-${archiveVersion version}.zip";
-    sha256 = "19ck2sg13i6ga5vapxak42jn6050vpfid0zrmah7jh32mksh58vj";
+    sha256 = "08b4fs9mrah5gxl1865smlqs2ba6g7k7d6pfa084i6d78342p4n7";
   };
 
   nativeBuildInputs = [ unzip ];

diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
@@ -10,12 +10,12 @@ in
 
 stdenv.mkDerivation rec {
   name = "sqlite-${version}";
-  version = "3.24.0";
+  version = "3.25.3";
 
   # NB! Make sure to update analyzer.nix src (in the same directory).
   src = fetchurl {
     url = "https://sqlite.org/2018/sqlite-autoconf-${archiveVersion version}.tar.gz";
-    sha256 = "0jmprv2vpggzhy7ma4ynmv1jzn3pfiwzkld0kkg6hvgvqs44xlfr";
+    sha256 = "1pgkja0d13qp5p79ik9kh9lm5y79cwyxwwfc80cr8a1rw5xzksq0";
   };
 
   outputs = [ "bin" "dev" "out" ];

diff --git a/pkgs/development/python-modules/pylint/default.nix b/pkgs/development/python-modules/pylint/default.nix
@@ -23,8 +23,8 @@ buildPythonPackage rec {
 
   checkPhase = ''
     pytest pylint/test -k "not ${lib.concatStringsSep " and not " (
-      # Broken test
-      [ "test_good_comprehension_checks" ] ++
+      # Broken tests
+      [ "test_good_comprehension_checks" "missing_final_newline" ] ++
       # Disable broken darwin tests
       lib.optionals stdenv.isDarwin [
         "test_parallel_execution"

diff --git a/pkgs/development/python-modules/sqlalchemy/default.nix b/pkgs/development/python-modules/sqlalchemy/default.nix
@@ -1,5 +1,6 @@
 { lib
 , fetchPypi
+, fetchpatch
 , buildPythonPackage
 , pytest
 , mock
@@ -9,13 +10,23 @@
 
 buildPythonPackage rec {
   pname = "SQLAlchemy";
-  version = "1.2.11";
+  version = "1.2.13";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ef6569ad403520ee13e180e1bfd6ed71a0254192a934ec1dbd3dbf48f4aa9524";
+    sha256 = "84412de3794acee05630e7788f25e80e81f78eb4837e7b71d0499129f660486a";
   };
 
+  patches = [
+    # fix for failing doc tests
+    # https://bitbucket.org/zzzeek/sqlalchemy/issues/4370/sqlite-325x-docs-tutorialrst-doctests-fail
+    (fetchpatch {
+      name = "doc-test-fixes.patch";
+      url = https://bitbucket.org/zzzeek/sqlalchemy/commits/63279a69e2b9277df5e97ace161fa3a1bb4f29cd/raw;
+      sha256 = "1x25aj5hqmgjdak4hllya0rf0srr937k1hwaxb24i9ban607hjri";
+    })
+  ];
+
   checkInputs = [
     pytest
     mock
@@ -32,4 +43,4 @@ buildPythonPackage rec {
     description = "A Python SQL toolkit and Object Relational Mapper";
     license = licenses.mit;
   };
-}
+}
diff --git a/pkgs/development/tools/geckodriver/default.nix b/pkgs/development/tools/geckodriver/default.nix
@@ -1,24 +1,26 @@
 { lib
 , fetchFromGitHub
 , rustPlatform
+, stdenv
+, darwin
 }:
 
 with rustPlatform; 
 
 buildRustPackage rec {
-  version = "unstable-2018-02-24";
+  version = "0.22.0";
   name = "geckodriver-${version}";
 
   src = fetchFromGitHub {
     owner = "mozilla";
-    repo = "gecko-dev";
-    rev = "ecb86060b4c5a9808798b81a57e79e821bb47082";
-    sha256 = "1am84a60adw0bb12rlhdqbiwyywhza4qp5sf4f4fmssjl2qcr6nl";
+    repo = "geckodriver";
+    rev = "v${version}";
+    sha256 = "12m95lfqwdxs2m5kjh3yrpm9w2li5m8n3fw46a2nkxyfw6c94l4b";
   };
 
-  sourceRoot = "${src.name}/testing/geckodriver";
+  buildInputs = lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];
 
-  cargoSha256 = "0dvcvdb623jla29i93glx20nf8pbpfw6jj548ii6brzkcpafxxm8";
+  cargoSha256 = "1a8idl6falz0n9irh1p8hv5w2pmiknzsfnxl70k1psnznrpk2y8n";
 
   meta = with lib; {
     description = "Proxy for using W3C WebDriver-compatible clients to interact with Gecko-based browsers";

diff --git a/pkgs/development/tools/misc/elfutils/default.nix b/pkgs/development/tools/misc/elfutils/default.nix
@@ -3,11 +3,11 @@
 # TODO: Look at the hardcoded paths to kernel, modules etc.
 stdenv.mkDerivation rec {
   name = "elfutils-${version}";
-  version = "0.173";
+  version = "0.175";
 
   src = fetchurl {
     url = "https://sourceware.org/elfutils/ftp/${version}/${name}.tar.bz2";
-    sha256 = "1zq0l12k64hrbjmdjc4llrad96c25i427hpma1id9nk87w9qqvdp";
+    sha256 = "0nx6nzbk0rw3pxbzxsfvrjjh37hibzd2gjz5bb8wccpf85ar5vzp";
   };
 
   patches = [ ./debug-info-from-env.patch ];