NixOS · Nov 23, 2018 · Nov 23, 2018 · Nov 23, 2018 · Nov 23, 2018 · Nov 23, 2018
diff --git a/nixos/modules/installer/cd-dvd/sd-image.nix b/nixos/modules/installer/cd-dvd/sd-image.nix
@@ -134,7 +134,9 @@ in
         ${config.sdImage.populateBootCommands}
 
         # Copy the populated /boot into the SD image
-        (cd boot; mcopy -bpsvm -i ../bootpart.img ./* ::)
+        (cd boot; mcopy -psvm -i ../bootpart.img ./* ::)
+        # Verify the FAT partition before copying it.
+        fsck.vfat -vn bootpart.img
         dd conv=notrunc if=bootpart.img of=$img seek=$START count=$SECTORS
       '';
     }) {};

diff --git a/nixos/modules/profiles/base.nix b/nixos/modules/profiles/base.nix
@@ -46,7 +46,7 @@
   ];
 
   # Include support for various filesystems.
-  boot.supportedFilesystems = [ "btrfs" "reiserfs" "vfat" "f2fs" "xfs" "ntfs" "cifs" ];
+  boot.supportedFilesystems = [ "btrfs" "reiserfs" "vfat" "f2fs" "xfs" "zfs" "ntfs" "cifs" ];
 
   # Configure host id for ZFS to work
   networking.hostId = lib.mkDefault "8425e349";

diff --git a/nixos/modules/services/databases/postgresql.nix b/nixos/modules/services/databases/postgresql.nix
@@ -247,6 +247,8 @@ in
             # Give Postgres a decent amount of time to clean up after
             # receiving systemd's SIGINT.
             TimeoutSec = 120;
+
+            Type = if versionAtLeast postgresqlPackage.psqlSchema "9.6" then "notify" else "simple";
           };
 
         # Wait for PostgreSQL to be ready to accept connections.

diff --git a/nixos/tests/gitlab.nix b/nixos/tests/gitlab.nix
@@ -16,6 +16,7 @@ import ./make-test.nix ({ pkgs, lib, ...} : with lib; {
 
       services.nginx = {
         enable = true;
+        recommendedProxySettings = true;
         virtualHosts = {
           "localhost" = {
             locations."/".proxyPass = "http://unix:/run/gitlab/gitlab-workhorse.socket";
@@ -75,7 +76,8 @@ import ./make-test.nix ({ pkgs, lib, ...} : with lib; {
     $gitlab->waitForUnit("gitlab.service");
     $gitlab->waitForUnit("gitlab-sidekiq.service");
     $gitlab->waitForFile("/var/gitlab/state/tmp/sockets/gitlab.socket");
-    $gitlab->waitUntilSucceeds("curl -sSf http://localhost/users/sign_in");
+    $gitlab->waitUntilSucceeds("curl -sSf http://gitlab/users/sign_in");
+    $gitlab->succeed("curl -isSf http://gitlab  | grep -i location | grep -q http://gitlab/users/sign_in");
     $gitlab->succeed("${pkgs.sudo}/bin/sudo -u gitlab -H gitlab-rake gitlab:check 1>&2")
   '';
 })
diff --git a/pkgs/applications/kde/marble.nix b/pkgs/applications/kde/marble.nix
@@ -14,4 +14,7 @@ mkDerivation {
     qtscript qtsvg qtquickcontrols qtwebkit shared-mime-info krunner kparts
     knewstuff gpsd
   ];
+  preConfigure = ''
+    cmakeFlags+=" -DINCLUDE_INSTALL_DIR=''${!outputDev}/include"
+  '';
 }
diff --git a/pkgs/applications/networking/instant-messengers/riot/riot-web.nix b/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
@@ -3,11 +3,11 @@
 let configFile = writeText "riot-config.json" conf; in
 stdenv.mkDerivation rec {
   name= "riot-web-${version}";
-  version = "0.16.5";
+  version = "0.17.6";
 
   src = fetchurl {
     url = "https://github.com/vector-im/riot-web/releases/download/v${version}/riot-v${version}.tar.gz";
-    sha256 = "1b82d82pfv4kjdxghc8y78zwmnc89hi7arvql2bx0zyfhzxj6drl";
+    sha256 = "1y38fq0r9cxmazh9rjc5qy7fzwy81ad35k538d6rsfwz1y88ipdm";
   };
 
   installPhase = ''

diff --git a/pkgs/applications/networking/seafile-client/default.nix b/pkgs/applications/networking/seafile-client/default.nix
@@ -5,14 +5,14 @@
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
-  version = "6.2.4";
+  version = "6.2.7";
   name = "seafile-client-${version}";
 
   src = fetchFromGitHub {
     owner = "haiwen";
     repo = "seafile-client";
     rev = "v${version}";
-    sha256 = "0z5li1d7ipsm1mp0lk6mls220v4vlmsqm8ym8kxlkinqbmkky0hz";
+    sha256 = "16ikl6vkp9v16608bq2sfg48idn2p7ik3q8n6j866zxkmgdvkpsg";
   };
 
   nativeBuildInputs = [ pkgconfig cmake makeWrapper ];

diff --git a/pkgs/applications/science/math/sage/default.nix b/pkgs/applications/science/math/sage/default.nix
@@ -91,6 +91,7 @@ let
     # https://trac.sagemath.org/ticket/25674
     R = nixpkgs.R.overrideAttrs (attrs: rec {
       name = "R-3.4.4";
+      doCheck = false;
       src = fetchurl {
         url = "http://cran.r-project.org/src/base/R-3/${name}.tar.gz";
         sha256 = "0dq3jsnwsb5j3fhl0wi3p5ycv8avf8s5j1y4ap3d2mkjmcppvsdk";

diff --git a/pkgs/applications/version-management/gitea/default.nix b/pkgs/applications/version-management/gitea/default.nix
@@ -39,7 +39,7 @@ buildGoPackage rec {
 
   postInstall = ''
     mkdir $data
-    cp -R $src/{public,templates} $data
+    cp -R $src/{public,templates,options} $data
     mkdir -p $out
     cp -R $src/options/locale $out/locale
 

diff --git a/pkgs/applications/version-management/gitlab-shell/remove-hardcoded-locations.patch b/pkgs/applications/version-management/gitlab-shell/remove-hardcoded-locations.patch
diff --git a/pkgs/applications/version-management/gitlab-workhorse/deterministic-build.patch b/pkgs/applications/version-management/gitlab-workhorse/deterministic-build.patch
diff --git a/pkgs/applications/version-management/gitlab/data.json b/pkgs/applications/version-management/gitlab/data.json
@@ -0,0 +1,32 @@
+{
+  "ce": {
+    "version": "11.5.0",
+    "repo_hash": "0cjkkap3n9g9zahrxk99a330ahyb6cvx97dsnrxcdsn0cbrsxsrb",
+    "deb_hash": "0kn7mg1lk4gvc3x76z4rbh0j03b0wk6x1p5938wx8sc50k0bgrcp",
+    "deb_url": "https://packages.gitlab.com/gitlab/gitlab-ce/packages/debian/stretch/gitlab-ce_11.5.0-ce.0_amd64.deb/download.deb",
+    "owner": "gitlab-org",
+    "repo": "gitlab-ce",
+    "rev": "v11.5.0",
+    "passthru": {
+      "GITALY_SERVER_VERSION": "0.129.0",
+      "GITLAB_PAGES_VERSION": "1.3.0",
+      "GITLAB_SHELL_VERSION": "8.4.1",
+      "GITLAB_WORKHORSE_VERSION": "7.1.0"
+    }
+  },
+  "ee": {
+    "version": "11.5.0",
+    "repo_hash": "1s2jr7vhbpklpcfjxgxnmq0zq14hh2aa6akdsb7ld7fj5lmzp00z",
+    "deb_hash": "108mgmlf947h200qrwg71ilhq5ihr4awxns6lqs2wa90ph9yq25c",
+    "deb_url": "https://packages.gitlab.com/gitlab/gitlab-ee/packages/debian/stretch/gitlab-ee_11.5.0-ee.0_amd64.deb/download.deb",
+    "owner": "gitlab-org",
+    "repo": "gitlab-ee",
+    "rev": "v11.5.0-ee",
+    "passthru": {
+      "GITALY_SERVER_VERSION": "0.129.0",
+      "GITLAB_PAGES_VERSION": "1.3.0",
+      "GITLAB_SHELL_VERSION": "8.4.1",
+      "GITLAB_WORKHORSE_VERSION": "7.1.0"
+    }
+  }
+}
diff --git a/pkgs/applications/version-management/gitlab/default.nix b/pkgs/applications/version-management/gitlab/default.nix
@@ -11,32 +11,22 @@ let
     groups = [ "default" "unicorn" "ed25519" "metrics" ];
   };
 
-  version = "11.4.4";
+  flavour = if gitlabEnterprise then "ee" else "ce";
+  data = (builtins.fromJSON (builtins.readFile ./data.json)).${flavour};
 
-  sources = if gitlabEnterprise then {
-    gitlabDeb = fetchurl {
-      url = "https://packages.gitlab.com/gitlab/gitlab-ee/packages/debian/stretch/gitlab-ee_${version}-ee.0_amd64.deb/download.deb";
-      sha256 = "15lpcdjcw6lpmzlhqnpd6pgaxh7wvx2mldjd1vqr414r4bcnhgy4";
-    };
+  version = data.version;
+  sources = {
     gitlab = fetchFromGitLab {
-      owner = "gitlab-org";
-      repo = "gitlab-ee";
-      rev = "v${version}-ee";
-      sha256 = "046hchr7q4jnx3j4yxg3rdixfzlva35al3ci26pf9vxrbbl5y8cg";
+      owner = data.owner;
+      repo = data.repo;
+      rev = data.rev;
+      sha256 = data.repo_hash;
     };
-  } else {
     gitlabDeb = fetchurl {
-      url = "https://packages.gitlab.com/gitlab/gitlab-ce/packages/debian/stretch/gitlab-ce_${version}-ce.0_amd64.deb/download.deb";
-      sha256 = "02p7azyjgb984bk491q6f4zk1mikbcd38rif08kl07bjjzzkir81";
-    };
-    gitlab = fetchFromGitLab {
-      owner = "gitlab-org";
-      repo = "gitlab-ce";
-      rev = "v${version}";
-      sha256 = "1hq9iyp0xrxwmncn61ja3pdj9h2hmdy1l63d1ic3r1dyacybaf2g";
+      url = data.deb_url;
+      sha256 = data.deb_hash;
     };
   };
-
 in
 
 stdenv.mkDerivation rec {
@@ -101,6 +91,10 @@ stdenv.mkDerivation rec {
   passthru = {
     inherit rubyEnv;
     ruby = rubyEnv.wrappedRuby;
+    GITALY_SERVER_VERSION = data.passthru.GITALY_SERVER_VERSION;
+    GITLAB_PAGES_VERSION = data.passthru.GITLAB_PAGES_VERSION;
+    GITLAB_SHELL_VERSION = data.passthru.GITLAB_SHELL_VERSION;
+    GITLAB_WORKHORSE_VERSION = data.passthru.GITLAB_WORKHORSE_VERSION;
   };
 
   meta = with lib; {

diff --git a/...cations/version-management/gitaly/Gemfile → .../version-management/gitlab/gitaly/Gemfile b/...cations/version-management/gitaly/Gemfile → .../version-management/gitlab/gitaly/Gemfile
@@ -1,25 +1,30 @@
 source 'https://rubygems.org'
 
-gem 'rugged', '~> 0.27.4'
+# Require bundler >= 1.16.5 to avoid this bug: https://github.com/bundler/bundler/issues/6537
+gem 'bundler', '>= 1.16.5'
+
+gem 'rugged', '~> 0.27'
 gem 'github-linguist', '~> 6.1', require: 'linguist'
 gem 'gitlab-markup', '~> 1.6.4'
-gem 'gitaly-proto', '~> 0.116.0', require: 'gitaly'
+gem 'gitaly-proto', '~> 0.123.0', require: 'gitaly'
 gem 'activesupport', '~> 5.0.2'
 gem 'rdoc', '~> 4.2'
 gem 'gitlab-gollum-lib', '~> 4.2', require: false
 gem 'gitlab-gollum-rugged_adapter', '~> 0.4.4', require: false
-gem 'grpc', '~> 1.11.0'
+gem 'grpc', '~> 1.15.0'
 gem 'sentry-raven', '~> 2.7.2', require: false
 gem 'faraday', '~> 0.12'
 
 # Detects the open source license the repository includes
 # This version needs to be in sync with GitLab CE/EE
 gem 'licensee', '~> 8.9.0'
 
-# Locked until https://github.com/google/protobuf/issues/4210 is closed
-gem 'google-protobuf', '= 3.5.1'
+gem 'google-protobuf', '~> 3.6'
 
 group :development, :test do
-  gem 'gitlab-styles', '~> 2.0.0', require: false
+  gem 'rubocop', '~> 0.50', require: false
   gem 'rspec', require: false
+  gem 'rspec-parameterized', require: false
+  gem 'timecop', require: false
+  gem 'factory_bot', require: false
 end
diff --git a/...ns/version-management/gitaly/Gemfile.lock → ...ion-management/gitlab/gitaly/Gemfile.lock b/...ns/version-management/gitaly/Gemfile.lock → ...ion-management/gitlab/gitaly/Gemfile.lock
@@ -1,26 +1,37 @@
 GEM
   remote: https://rubygems.org/
   specs:
+    abstract_type (0.0.7)
     activesupport (5.0.6)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (~> 0.7)
       minitest (~> 5.1)
       tzinfo (~> 1.1)
-    addressable (2.5.2)
-      public_suffix (>= 2.0.2, < 4.0)
-    ast (2.3.0)
+    adamantium (0.2.0)
+      ice_nine (~> 0.11.0)
+      memoizable (~> 0.4.0)
+    ast (2.4.0)
+    binding_of_caller (0.8.0)
+      debug_inspector (>= 0.0.1)
     charlock_holmes (0.7.6)
+    coderay (1.1.2)
+    concord (0.1.5)
+      adamantium (~> 0.2.0)
+      equalizer (~> 0.0.9)
     concurrent-ruby (1.0.5)
     crass (1.0.4)
+    debug_inspector (0.0.3)
     diff-lcs (1.3)
+    equalizer (0.0.11)
     escape_utils (1.2.1)
-    faraday (0.12.2)
+    factory_bot (4.11.1)
+      activesupport (>= 3.0.0)
+    faraday (0.15.3)
       multipart-post (>= 1.2, < 3)
     gemojione (3.3.0)
       json
-    gitaly-proto (0.116.0)
-      google-protobuf (~> 3.1)
-      grpc (~> 1.10)
+    gitaly-proto (0.123.0)
+      grpc (~> 1.0)
     github-linguist (6.2.0)
       charlock_holmes (~> 0.7.6)
       escape_utils (~> 1.2.0)
@@ -44,60 +55,44 @@ GEM
       mime-types (>= 1.16)
       posix-spawn (~> 0.3)
     gitlab-markup (1.6.4)
-    gitlab-styles (2.0.0)
-      rubocop (~> 0.49)
-      rubocop-gitlab-security (~> 0.1.0)
-      rubocop-rspec (~> 1.15)
     gollum-grit_adapter (1.0.1)
       gitlab-grit (~> 2.7, >= 2.7.1)
-    google-protobuf (3.5.1)
-    googleapis-common-protos-types (1.0.1)
+    google-protobuf (3.6.1)
+    googleapis-common-protos-types (1.0.2)
       google-protobuf (~> 3.0)
-    googleauth (0.6.2)
-      faraday (~> 0.12)
-      jwt (>= 1.4, < 3.0)
-      logging (~> 2.0)
-      memoist (~> 0.12)
-      multi_json (~> 1.11)
-      os (~> 0.9)
-      signet (~> 0.7)
-    grpc (1.11.0)
+    grpc (1.15.0)
       google-protobuf (~> 3.1)
       googleapis-common-protos-types (~> 1.0.0)
-      googleauth (>= 0.5.1, < 0.7)
     i18n (0.8.1)
+    ice_nine (0.11.2)
     json (2.1.0)
-    jwt (2.1.0)
     licensee (8.9.2)
       rugged (~> 0.24)
-    little-plugger (1.1.4)
-    logging (2.2.2)
-      little-plugger (~> 1.1)
-      multi_json (~> 1.10)
-    memoist (0.16.0)
+    memoizable (0.4.2)
+      thread_safe (~> 0.3, >= 0.3.1)
     mime-types (3.2.2)
       mime-types-data (~> 3.2015)
     mime-types-data (3.2018.0812)
     mini_portile2 (2.3.0)
     minitest (5.9.1)
-    multi_json (1.13.1)
     multipart-post (2.0.0)
     nokogiri (1.8.4)
       mini_portile2 (~> 2.3.0)
     nokogumbo (1.5.0)
       nokogiri
-    os (0.9.6)
-    parallel (1.12.0)
-    parser (2.4.0.0)
-      ast (~> 2.2)
+    parallel (1.12.1)
+    parser (2.5.1.2)
+      ast (~> 2.4.0)
     posix-spawn (0.3.13)
-    powerpack (0.1.1)
-    public_suffix (3.0.2)
-    rainbow (2.2.2)
-      rake
-    rake (12.1.0)
+    powerpack (0.1.2)
+    proc_to_ast (0.1.0)
+      coderay
+      parser
+      unparser
+    procto (0.0.3)
+    rainbow (3.0.0)
     rdoc (4.3.0)
-    rouge (3.2.1)
+    rouge (3.3.0)
     rspec (3.7.0)
       rspec-core (~> 3.7.0)
       rspec-expectations (~> 3.7.0)
@@ -110,56 +105,66 @@ GEM
     rspec-mocks (3.7.0)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.7.0)
+    rspec-parameterized (0.4.0)
+      binding_of_caller
+      parser
+      proc_to_ast
+      rspec (>= 2.13, < 4)
+      unparser
     rspec-support (3.7.1)
-    rubocop (0.50.0)
+    rubocop (0.54.0)
       parallel (~> 1.10)
-      parser (>= 2.3.3.1, < 3.0)
+      parser (>= 2.5)
       powerpack (~> 0.1)
-      rainbow (>= 2.2.2, < 3.0)
+      rainbow (>= 2.2.2, < 4.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (~> 1.0, >= 1.0.1)
-    rubocop-gitlab-security (0.1.0)
-      rubocop (>= 0.47.1)
-    rubocop-rspec (1.17.0)
-      rubocop (>= 0.50.0)
-    ruby-progressbar (1.8.3)
-    rugged (0.27.4)
+    ruby-progressbar (1.10.0)
+    rugged (0.27.5)
     sanitize (4.6.6)
       crass (~> 1.0.2)
       nokogiri (>= 1.4.4)
       nokogumbo (~> 1.4)
     sentry-raven (2.7.2)
       faraday (>= 0.7.6, < 1.0)
-    signet (0.8.1)
-      addressable (~> 2.3)
-      faraday (~> 0.9)
-      jwt (>= 1.5, < 3.0)
-      multi_json (~> 1.10)
     stringex (2.8.4)
     thread_safe (0.3.6)
+    timecop (0.9.1)
     tzinfo (1.2.2)
       thread_safe (~> 0.1)
-    unicode-display_width (1.3.0)
+    unicode-display_width (1.4.0)
+    unparser (0.2.8)
+      abstract_type (~> 0.0.7)
+      adamantium (~> 0.2.0)
+      concord (~> 0.1.5)
+      diff-lcs (~> 1.3)
+      equalizer (~> 0.0.9)
+      parser (>= 2.3.1.2, < 2.6)
+      procto (~> 0.0.2)
 
 PLATFORMS
   ruby
 
 DEPENDENCIES
   activesupport (~> 5.0.2)
+  bundler (>= 1.16.5)
+  factory_bot
   faraday (~> 0.12)
-  gitaly-proto (~> 0.116.0)
+  gitaly-proto (~> 0.123.0)
   github-linguist (~> 6.1)
   gitlab-gollum-lib (~> 4.2)
   gitlab-gollum-rugged_adapter (~> 0.4.4)
   gitlab-markup (~> 1.6.4)
-  gitlab-styles (~> 2.0.0)
-  google-protobuf (= 3.5.1)
-  grpc (~> 1.11.0)
+  google-protobuf (~> 3.6)
+  grpc (~> 1.15.0)
   licensee (~> 8.9.0)
   rdoc (~> 4.2)
   rspec
-  rugged (~> 0.27.4)
+  rspec-parameterized
+  rubocop (~> 0.50)
+  rugged (~> 0.27)
   sentry-raven (~> 2.7.2)
+  timecop
 
 BUNDLED WITH
-   1.16.4
+   1.17.1
diff --git a/...ons/version-management/gitaly/default.nix → ...sion-management/gitlab/gitaly/default.nix b/...ons/version-management/gitaly/default.nix → ...sion-management/gitlab/gitaly/default.nix
@@ -7,14 +7,14 @@ let
     gemdir = ./.;
   };
 in buildGoPackage rec {
-  version = "0.125.1";
+  version = "0.129.0";
   name = "gitaly-${version}";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitaly";
     rev = "v${version}";
-    sha256 = "0vbxjqjs1r5c350r67812andasby5zk25xlaqp201lmlvamiv0ni";
+    sha256 = "0lidqa0w0vy87p5xfmqrfvbyzvl9wj2p918qs2f5rc7shzm38rn6";
   };
 
   goPackagePath = "gitlab.com/gitlab-org/gitaly";

diff --git a/...ions/version-management/gitaly/gemset.nix → ...rsion-management/gitlab/gitaly/gemset.nix b/...ions/version-management/gitaly/gemset.nix → ...rsion-management/gitlab/gitaly/gemset.nix
diff --git a/...rsion-management/gitlab-shell/default.nix → ...anagement/gitlab/gitlab-shell/default.nix b/...rsion-management/gitlab-shell/default.nix → ...anagement/gitlab/gitlab-shell/default.nix
@@ -1,14 +1,14 @@
 { stdenv, ruby, bundler, fetchFromGitLab, go }:
 
 stdenv.mkDerivation rec {
-  version = "8.3.3";
+  version = "8.4.1";
   name = "gitlab-shell-${version}";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-shell";
     rev = "v${version}";
-    sha256 = "1qapw0yvlw1nxjik7jpbbbl3yx299sfvdx67zsd5ai7bhk1gd8xl";
+    sha256 = "00jzrpdfqgrba2qi5ngc0g07p7gmip7my563hw542gg8l88d27xq";
   };
 
   buildInputs = [ ruby bundler go ];

diff --git a/pkgs/applications/version-management/gitlab/gitlab-shell/remove-hardcoded-locations.patch b/pkgs/applications/version-management/gitlab/gitlab-shell/remove-hardcoded-locations.patch
@@ -0,0 +1,58 @@
+diff --git a/go/internal/config/config.go b/go/internal/config/config.go
+index 435cb29..078c1df 100644
+--- a/go/internal/config/config.go
++++ b/go/internal/config/config.go
+@@ -2,7 +2,6 @@ package config
+
+ import (
+ 	"io/ioutil"
+-	"os"
+ 	"path"
+
+ 	yaml "gopkg.in/yaml.v2"
+@@ -26,16 +25,13 @@ type Config struct {
+ }
+
+ func New() (*Config, error) {
+-	dir, err := os.Getwd()
+-	if err != nil {
+-		return nil, err
+-	}
++	dir := "/run/gitlab"
+
+ 	return NewFromDir(dir)
+ }
+
+ func NewFromDir(dir string) (*Config, error) {
+-	return newFromFile(path.Join(dir, configFile))
++	return newFromFile(path.Join(dir, "shell-config.yml"))
+ }
+
+ func newFromFile(filename string) (*Config, error) {
+diff --git a/lib/gitlab_shell.rb b/lib/gitlab_shell.rb
+index 57c70f5..700569b 100644
+--- a/lib/gitlab_shell.rb
++++ b/lib/gitlab_shell.rb
+@@ -187,7 +187,8 @@ class GitlabShell # rubocop:disable Metrics/ClassLength
+
+     args = [executable, gitaly_address, json_args]
+     # We use 'chdir: ROOT_PATH' to let the next executable know where config.yml is.
+-    Kernel.exec(env, *args, unsetenv_others: true, chdir: ROOT_PATH)
++    # Except we don't, because we're already in the right directory on nixos!
++    Kernel.exec(env, *args, unsetenv_others: true)
+   end
+
+   def api
+diff --git a/lib/gitlab_keys.rb b/lib/gitlab_keys.rb
+index 0600a18..6814f0a 100644
+--- a/lib/gitlab_keys.rb
++++ b/lib/gitlab_keys.rb
+@@ -10,7 +10,7 @@ class GitlabKeys # rubocop:disable Metrics/ClassLength
+   attr_accessor :auth_file, :key
+
+   def self.command(whatever)
+-    "#{ROOT_PATH}/bin/gitlab-shell #{whatever}"
++    "/run/current-system/sw/bin/gitlab-shell #{whatever}"
+   end
+
+   def self.command_key(key_id)
diff --git a/...n-management/gitlab-workhorse/default.nix → ...ement/gitlab/gitlab-workhorse/default.nix b/...n-management/gitlab-workhorse/default.nix → ...ement/gitlab/gitlab-workhorse/default.nix
@@ -3,18 +3,18 @@
 stdenv.mkDerivation rec {
   name = "gitlab-workhorse-${version}";
 
-  version = "7.0.0";
+  version = "7.1.0";
 
-  srcs = fetchFromGitLab {
+  src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-workhorse";
     rev = "v${version}";
-    sha256 = "1mmfb7h5sbva2kv9h9cxfg7dyksxrwwikq7jwggfawqaadzwm677";
+    sha256 = "1jq28z2kf58wnbv8jkwfx2bm8ki22hpm9ssdy2ymza22gq0zx00g";
   };
 
   buildInputs = [ git go ];
 
-  patches = [ ./remove-hardcoded-paths.patch ./deterministic-build.patch ];
+  patches = [ ./remove-hardcoded-paths.patch ];
 
   makeFlags = [ "PREFIX=$(out)" "VERSION=${version}" ];
 

diff --git a/...ab-workhorse/remove-hardcoded-paths.patch → ...ab-workhorse/remove-hardcoded-paths.patch b/...ab-workhorse/remove-hardcoded-paths.patch → ...ab-workhorse/remove-hardcoded-paths.patch
diff --git a/pkgs/build-support/rust/default.nix b/pkgs/build-support/rust/default.nix
@@ -94,8 +94,8 @@ in stdenv.mkDerivation (args // {
   installPhase = args.installPhase or ''
     runHook preInstall
     mkdir -p $out/bin $out/lib
-    find target/release -maxdepth 1 -type f -executable ! \( -regex ".*.\(so.[0-9.]+\|so\|a\|dylib\)" \) -print0 | xargs -r -0 cp -t $out/bin
-    find target/release -maxdepth 1 -regex ".*.\(so.[0-9.]+\|so\|a\|dylib\)" -print0 | xargs -r -0 cp -t $out/lib
+    find target/release -maxdepth 1 -type f -executable ! \( -regex ".*\.\(so.[0-9.]+\|so\|a\|dylib\)" \) -print0 | xargs -r -0 cp -t $out/bin
+    find target/release -maxdepth 1 -regex ".*\.\(so.[0-9.]+\|so\|a\|dylib\)" -print0 | xargs -r -0 cp -t $out/lib
     rmdir --ignore-fail-on-non-empty $out/lib $out/bin
     runHook postInstall
   '';

diff --git a/pkgs/desktops/gnome-3/core/gnome-keyring/default.nix b/pkgs/desktops/gnome-3/core/gnome-keyring/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     patchShebangs build
   '';
 
-  doCheck = true;
+  doCheck = !stdenv.isi686; # https://github.com/NixOS/nixpkgs/issues/51121
   # In 3.20.1, tests do not support Python 3
   checkInputs = [ dbus python2 ];
 

diff --git a/pkgs/development/compilers/elm/default.nix b/pkgs/development/compilers/elm/default.nix
@@ -51,46 +51,17 @@
 # that the default of ~/.elm isn't used.
 
 let
-  makeDotElm = ver: deps:
-    let versionsDat = ./versions.dat;
-        cmds = lib.mapAttrsToList (name: info: let
-                 pkg = stdenv.mkDerivation {
-
-                   name = lib.replaceChars ["/"] ["-"] name + "-${info.version}";
-
-                   src = fetchurl {
-                     url = "https://github.com/${name}/archive/${info.version}.tar.gz";
-                     meta.homepage = "https://github.com/${name}/";
-                     inherit (info) sha256;
-                   };
-
-                   phases = [ "unpackPhase" "installPhase" ];
-
-                   installPhase = ''
-                     mkdir -p $out
-                     cp -r * $out
-                   '';
-
-                 };
-               in ''
-                 mkdir -p .elm/${ver}/package/${name}
-                 cp -R ${pkg} .elm/${ver}/package/${name}/${info.version}
-               '') deps;
-    in (lib.concatStrings cmds) + ''
-      mkdir -p .elm/${ver}/package;
-      cp ${versionsDat} .elm/${ver}/package/versions.dat;
-      chmod -R +w .elm
-    '';
-
+  fetchElmDeps = import ./fetchElmDeps.nix { inherit stdenv lib fetchurl; };
   hsPkgs = haskell.packages.ghc822.override {
     overrides = self: super: with haskell.lib;
       let elmPkgs = {
             elm = overrideCabal (self.callPackage ./packages/elm.nix { }) (drv: {
               # sadly with parallelism most of the time breaks compilation
               enableParallelBuilding = false;
-              preConfigure = ''
-                export ELM_HOME=`pwd`/.elm
-              '' + (makeDotElm "0.19.0" (import ./packages/elm-elm.nix));
+              preConfigure = fetchElmDeps {
+                elmPackages = (import ./packages/elm-elm.nix);
+                versionsDat = ./versions.dat;
+              };
               buildTools = drv.buildTools or [] ++ [ makeWrapper ];
               patches = [
                 (fetchpatch {
@@ -111,6 +82,7 @@ let
             `pacakge/nix/build.sh`
             */
             elm-format = self.callPackage ./packages/elm-format.nix {};
+            inherit fetchElmDeps;
           };
       in elmPkgs // {
         inherit elmPkgs;

diff --git a/pkgs/development/compilers/elm/fetchElmDeps.nix b/pkgs/development/compilers/elm/fetchElmDeps.nix
@@ -0,0 +1,11 @@
+{stdenv, lib, fetchurl}:
+
+{elmPackages, versionsDat}:
+
+let
+  makeDotElm = import ./makeDotElm.nix {inherit stdenv lib fetchurl versionsDat;};
+
+in
+''
+  export ELM_HOME=`pwd`/.elm
+'' + (makeDotElm "0.19.0" elmPackages)
diff --git a/pkgs/development/compilers/elm/makeDotElm.nix b/pkgs/development/compilers/elm/makeDotElm.nix
@@ -0,0 +1,30 @@
+{stdenv, lib, fetchurl, versionsDat}:
+
+ver: deps:
+  let cmds = lib.mapAttrsToList (name: info: let
+               pkg = stdenv.mkDerivation {
+                 name = lib.replaceChars ["/"] ["-"] name + "-${info.version}";
+
+                 src = fetchurl {
+                   url = "https://github.com/${name}/archive/${info.version}.tar.gz";
+                   meta.homepage = "https://github.com/${name}/";
+                   inherit (info) sha256;
+                 };
+
+                 phases = [ "unpackPhase" "installPhase" ];
+
+                 installPhase = ''
+                   mkdir -p $out
+                   cp -r * $out
+                 '';
+
+               };
+             in ''
+               mkdir -p .elm/${ver}/package/${name}
+               cp -R ${pkg} .elm/${ver}/package/${name}/${info.version}
+             '') deps;
+  in (lib.concatStrings cmds) + ''
+    mkdir -p .elm/${ver}/package;
+    cp ${versionsDat} .elm/${ver}/package/versions.dat;
+    chmod -R +w .elm
+  ''
diff --git a/pkgs/development/haskell-modules/configuration-hackage2nix.yaml b/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
@@ -1,6 +1,6 @@
 # pkgs/development/haskell-modules/configuration-hackage2nix.yaml
 
-compiler: ghc-8.4.3
+compiler: ghc-8.4.4
 
 core-packages:
   - array-0.5.2.0
@@ -12,12 +12,12 @@ core-packages:
   - deepseq-1.4.3.0
   - directory-1.3.1.5
   - filepath-1.4.2
-  - ghc-8.4.3
-  - ghc-boot-8.4.3
-  - ghc-boot-th-8.4.3
+  - ghc-8.4.4
+  - ghc-boot-8.4.4
+  - ghc-boot-th-8.4.4
   - ghc-compact-0.1.0.0
   - ghc-prim-0.5.2.0
-  - ghci-8.4.3
+  - ghci-8.4.4
   - haskeline-0.7.4.2
   - hpc-0.6.0.3
   - integer-gmp-1.0.2.0
@@ -26,10 +26,10 @@ core-packages:
   - pretty-1.1.3.6
   - process-1.6.3.0
   - rts-1.0
-  - stm-2.4.5.0
+  - stm-2.4.5.1
   - template-haskell-2.13.0.0
   - terminfo-0.4.1.1
-  - text-1.2.3.0
+  - text-1.2.3.1
   - time-1.8.0.2
   - transformers-0.5.5.0
   - unix-2.7.2.2

diff --git a/pkgs/development/interpreters/php/default.nix b/pkgs/development/interpreters/php/default.nix
@@ -1,5 +1,5 @@
 # pcre functionality is tested in nixos/tests/php-pcre.nix
-{ lib, stdenv, fetchurl, flex, bison
+{ lib, stdenv, fetchurl, flex, bison, autoconf
 , mysql, libxml2, readline, zlib, curl, postgresql, gettext
 , openssl, pcre, pkgconfig, sqlite, config, libjpeg, libpng, freetype
 , libxslt, libmcrypt, bzip2, icu, openldap, cyrus_sasl, libmhash, freetds
@@ -12,6 +12,7 @@ let
   generic =
   { version
   , sha256
+  , extraPatches ? []
   , imapSupport ? config.php.imap or (!stdenv.isDarwin)
   , ldapSupport ? config.php.ldap or true
   , mhashSupport ? config.php.mhash or true
@@ -65,7 +66,7 @@ let
 
       enableParallelBuilding = true;
 
-      nativeBuildInputs = [ pkgconfig ];
+      nativeBuildInputs = [ pkgconfig autoconf ];
       buildInputs = [ flex bison pcre ]
         ++ optional stdenv.isLinux systemd
         ++ optionals imapSupport [ uwimap openssl pam ]
@@ -182,6 +183,8 @@ let
 
         configureFlags+=(--with-config-file-path=$out/etc \
           --includedir=$dev/include)
+
+        ./buildconf --force
       '';
 
       postInstall = ''
@@ -210,7 +213,7 @@ let
         outputsToInstall = [ "out" "dev" ];
       };
 
-      patches = [ ./fix-paths-php7.patch ];
+      patches = [ ./fix-paths-php7.patch ] ++ extraPatches;
 
       postPatch = optional stdenv.isDarwin ''
         substituteInPlace configure --replace "-lstdc++" "-lc++"
@@ -223,35 +226,19 @@ let
     };
 
 in {
-  # Because of an upstream bug: https://bugs.php.net/bug.php?id=76826
-  # We can't update the darwin versions because they simply don't compile at
-  # all due to a bug in the intl extensions.
-  #
-  # The bug so far is present in 7.1.21, 7.1.22, 7.2.9, 7.2.10.
+  php71 = generic {
+    version = "7.1.24";
+    sha256 = "02qy76krbdhlbkzs9k1sa5mgmj0qnbb8gcf1j3q0cq3z7kkj9pk6";
+
+    # https://bugs.php.net/bug.php?id=76826
+    extraPatches = optional stdenv.isDarwin ./php71-darwin-isfinite.patch;
+  };
 
-  php71 = generic (
-    if stdenv.isDarwin then
-      {
-        version = "7.1.20";
-        sha256 = "0i8xd6p4zdg8fl6f0j430raanlshsshr3s3jlm72b0gvi1n4f6rs";
-      }
-    else
-      {
-        version = "7.1.22";
-        sha256 = "0qz74qdlk19cw478f42ckyw5r074y0fg73r2bzlhm0dar0cizsf8";
-      }
-  );
+  php72 = generic {
+    version = "7.2.12";
+    sha256 = "1dpnbsv4bdlc5v40ddddi971f456jp1qrn89w5di1dj70g1c895p";
 
-  php72 = generic (
-    if stdenv.isDarwin then
-      {
-        version = "7.2.8";
-        sha256 = "1rky321gcvjm0npbfd4bznh36an0y14viqcvn4yzy3x643sni00z";
-      }
-    else
-      {
-        version = "7.2.10";
-        sha256 = "17fsvdi6ihjghjsz9kk2li2rwrknm2ccb6ys0xmn789116d15dh1";
-      }
-  );
+    # https://bugs.php.net/bug.php?id=76826
+    extraPatches = optional stdenv.isDarwin ./php72-darwin-isfinite.patch;
+  };
 }
diff --git a/pkgs/development/interpreters/php/fix-paths-php7.patch b/pkgs/development/interpreters/php/fix-paths-php7.patch
@@ -1,16 +1,8 @@
---- php-7.0.0beta1/configure	    2015-07-10 12:11:41.810045613 +0000
-+++ php-7.0.0beta1-new/configure	2015-07-17 16:10:21.775528267 +0000
-@@ -6172,7 +6172,7 @@
-     as_fn_error $? "Please note that Apache version >= 2.0.44 is required" "$LINENO" 5
-   fi
-
--  APXS_LIBEXECDIR='$(INSTALL_ROOT)'`$APXS -q LIBEXECDIR`
-+  APXS_LIBEXECDIR="$prefix/modules"
-   if test -z `$APXS -q SYSCONFDIR`; then
-     INSTALL_IT="\$(mkinstalldirs) '$APXS_LIBEXECDIR' && \
-                  $APXS -S LIBEXECDIR='$APXS_LIBEXECDIR' \
-@@ -37303,9 +37303,7 @@
-
+diff -ru a/ext/gettext/config.m4 b/ext/gettext/config.m4
+--- a/ext/gettext/config.m4	2018-11-07 15:35:26.000000000 +0000
++++ b/ext/gettext/config.m4	2018-11-27 00:33:07.000000000 +0000
+@@ -6,9 +6,7 @@
+ [  --with-gettext[=DIR]      Include GNU gettext support])
 
  if test "$PHP_GETTEXT" != "no"; then
 -  for i in $PHP_GETTEXT /usr/local /usr; do
@@ -19,5 +11,16 @@
 +  GETTEXT_DIR=$PHP_GETTEXT
 
    if test -z "$GETTEXT_DIR"; then
-     as_fn_error $? "Cannot locate header file libintl.h" "$LINENO" 5
-
+     AC_MSG_ERROR(Cannot locate header file libintl.h)
+diff -ru a/sapi/apache2handler/config.m4 b/sapi/apache2handler/config.m4
+--- a/sapi/apache2handler/config.m4	2018-11-07 15:35:23.000000000 +0000
++++ b/sapi/apache2handler/config.m4	2018-11-27 00:32:28.000000000 +0000
+@@ -66,7 +66,7 @@
+     AC_MSG_ERROR([Please note that Apache version >= 2.0.44 is required])
+   fi
+
+-  APXS_LIBEXECDIR='$(INSTALL_ROOT)'`$APXS -q LIBEXECDIR`
++  APXS_LIBEXECDIR="$prefix/modules"
+   if test -z `$APXS -q SYSCONFDIR`; then
+     INSTALL_IT="\$(mkinstalldirs) '$APXS_LIBEXECDIR' && \
+                  $APXS -S LIBEXECDIR='$APXS_LIBEXECDIR' \
diff --git a/pkgs/development/interpreters/php/php71-darwin-isfinite.patch b/pkgs/development/interpreters/php/php71-darwin-isfinite.patch
@@ -0,0 +1,60 @@
+diff -ru a/Zend/configure.in b/Zend/configure.in
+--- a/Zend/configure.in	2018-11-07 15:35:26.000000000 +0000
++++ b/Zend/configure.in	2018-11-27 00:28:48.000000000 +0000
+@@ -70,7 +70,7 @@
+ #endif
+
+ #ifndef zend_isnan
+-#if HAVE_DECL_ISNAN && (!defined(__cplusplus) || __cplusplus < 201103L)
++#if HAVE_DECL_ISNAN && (defined(__APPLE__) || defined(__APPLE_CC__) || !defined(__cplusplus) || __cplusplus < 201103L)
+ #define zend_isnan(a) isnan(a)
+ #elif defined(HAVE_FPCLASS)
+ #define zend_isnan(a) ((fpclass(a) == FP_SNAN) || (fpclass(a) == FP_QNAN))
+@@ -79,7 +79,7 @@
+ #endif
+ #endif
+
+-#if HAVE_DECL_ISINF && (!defined(__cplusplus) || __cplusplus < 201103L)
++#if HAVE_DECL_ISINF && (defined(__APPLE__) || defined(__APPLE_CC__) || !defined(__cplusplus) || __cplusplus < 201103L)
+ #define zend_isinf(a) isinf(a)
+ #elif defined(INFINITY)
+ /* Might not work, but is required by ISO C99 */
+@@ -90,7 +90,7 @@
+ #define zend_isinf(a) 0
+ #endif
+
+-#if HAVE_DECL_ISFINITE && (!defined(__cplusplus) || __cplusplus < 201103L)
++#if HAVE_DECL_ISFINITE && (defined(__APPLE__) || defined(__APPLE_CC__) || !defined(__cplusplus) || __cplusplus < 201103L)
+ #define zend_finite(a) isfinite(a)
+ #elif defined(HAVE_FINITE)
+ #define zend_finite(a) finite(a)
+diff -ru a/configure.in b/configure.in
+--- a/configure.in	2018-11-07 15:35:26.000000000 +0000
++++ b/configure.in	2018-11-27 00:28:48.000000000 +0000
+@@ -75,7 +75,7 @@
+ #endif
+
+ #ifndef zend_isnan
+-#if HAVE_DECL_ISNAN && (!defined(__cplusplus) || __cplusplus < 201103L)
++#if HAVE_DECL_ISNAN && (defined(__APPLE__) || defined(__APPLE_CC__) || !defined(__cplusplus) || __cplusplus < 201103L)
+ #define zend_isnan(a) isnan(a)
+ #elif defined(HAVE_FPCLASS)
+ #define zend_isnan(a) ((fpclass(a) == FP_SNAN) || (fpclass(a) == FP_QNAN))
+@@ -84,7 +84,7 @@
+ #endif
+ #endif
+
+-#if HAVE_DECL_ISINF && (!defined(__cplusplus) || __cplusplus < 201103L)
++#if HAVE_DECL_ISINF && (defined(__APPLE__) || defined(__APPLE_CC__) || !defined(__cplusplus) || __cplusplus < 201103L)
+ #define zend_isinf(a) isinf(a)
+ #elif defined(INFINITY)
+ /* Might not work, but is required by ISO C99 */
+@@ -95,7 +95,7 @@
+ #define zend_isinf(a) 0
+ #endif
+
+-#if HAVE_DECL_ISFINITE && (!defined(__cplusplus) || __cplusplus < 201103L)
++#if HAVE_DECL_ISFINITE && (defined(__APPLE__) || defined(__APPLE_CC__) || !defined(__cplusplus) || __cplusplus < 201103L)
+ #define zend_finite(a) isfinite(a)
+ #elif defined(HAVE_FINITE)
+ #define zend_finite(a) finite(a)
diff --git a/pkgs/development/interpreters/php/php72-darwin-isfinite.patch b/pkgs/development/interpreters/php/php72-darwin-isfinite.patch
@@ -0,0 +1,62 @@
+diff --git a/Zend/configure.ac b/Zend/configure.ac
+index b95c1360b8..fe16c86007 100644
+--- a/Zend/configure.ac
++++ b/Zend/configure.ac
+@@ -60,7 +60,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
+ #include <math.h>
+
+ #ifndef zend_isnan
+-#if HAVE_DECL_ISNAN && (!defined(__cplusplus) || __cplusplus < 201103L)
++#if HAVE_DECL_ISNAN && (defined(__APPLE__) || defined(__APPLE_CC__) || !defined(__cplusplus) || __cplusplus < 201103L)
+ #define zend_isnan(a) isnan(a)
+ #elif defined(HAVE_FPCLASS)
+ #define zend_isnan(a) ((fpclass(a) == FP_SNAN) || (fpclass(a) == FP_QNAN))
+@@ -69,7 +69,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
+ #endif
+ #endif
+
+-#if HAVE_DECL_ISINF && (!defined(__cplusplus) || __cplusplus < 201103L)
++#if HAVE_DECL_ISINF && (defined(__APPLE__) || defined(__APPLE_CC__) || !defined(__cplusplus) || __cplusplus < 201103L)
+ #define zend_isinf(a) isinf(a)
+ #elif defined(INFINITY)
+ /* Might not work, but is required by ISO C99 */
+@@ -80,7 +80,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
+ #define zend_isinf(a) 0
+ #endif
+
+-#if HAVE_DECL_ISFINITE && (!defined(__cplusplus) || __cplusplus < 201103L)
++#if HAVE_DECL_ISFINITE && (defined(__APPLE__) || defined(__APPLE_CC__) || !defined(__cplusplus) || __cplusplus < 201103L)
+ #define zend_finite(a) isfinite(a)
+ #elif defined(HAVE_FINITE)
+ #define zend_finite(a) finite(a)
+diff --git a/configure.ac b/configure.ac
+index d3f3cacd07..ddbf712ba2 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -68,7 +68,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
+ #include <math.h>
+
+ #ifndef zend_isnan
+-#if HAVE_DECL_ISNAN && (!defined(__cplusplus) || __cplusplus < 201103L)
++#if HAVE_DECL_ISNAN && (defined(__APPLE__) || defined(__APPLE_CC__) || !defined(__cplusplus) || __cplusplus < 201103L)
+ #define zend_isnan(a) isnan(a)
+ #elif defined(HAVE_FPCLASS)
+ #define zend_isnan(a) ((fpclass(a) == FP_SNAN) || (fpclass(a) == FP_QNAN))
+@@ -77,7 +77,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
+ #endif
+ #endif
+
+-#if HAVE_DECL_ISINF && (!defined(__cplusplus) || __cplusplus < 201103L)
++#if HAVE_DECL_ISINF && (defined(__APPLE__) || defined(__APPLE_CC__) || !defined(__cplusplus) || __cplusplus < 201103L)
+ #define zend_isinf(a) isinf(a)
+ #elif defined(INFINITY)
+ /* Might not work, but is required by ISO C99 */
+@@ -88,7 +88,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
+ #define zend_isinf(a) 0
+ #endif
+
+-#if HAVE_DECL_ISFINITE && (!defined(__cplusplus) || __cplusplus < 201103L)
++#if HAVE_DECL_ISFINITE && (defined(__APPLE__) || defined(__APPLE_CC__) || !defined(__cplusplus) || __cplusplus < 201103L)
+ #define zend_finite(a) isfinite(a)
+ #elif defined(HAVE_FINITE)
+ #define zend_finite(a) finite(a)
diff --git a/pkgs/development/interpreters/python/cpython/3.6/default.nix b/pkgs/development/interpreters/python/cpython/3.6/default.nix
@@ -26,7 +26,7 @@ with stdenv.lib;
 
 let
   majorVersion = "3.6";
-  minorVersion = "6";
+  minorVersion = "7";
   minorVersionSuffix = "";
   version = "${majorVersion}.${minorVersion}${minorVersionSuffix}";
   libPrefix = "python${majorVersion}";
@@ -51,7 +51,7 @@ in stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.python.org/ftp/python/${majorVersion}.${minorVersion}/Python-${version}.tar.xz";
-    sha256 = "0vz1wqg50zq6g15givdx1s2rq5752y5g2f1978bs6wvf8mfw36yp";
+    sha256 = "0zgp8nvz3rkiz5cxd42vgpah4rvw3kmg9qz9lfq36rfnm40i9zc1";
   };
 
   NIX_LDFLAGS = optionalString stdenv.isLinux "-lgcc_s";

diff --git a/pkgs/development/interpreters/python/cpython/3.7/default.nix b/pkgs/development/interpreters/python/cpython/3.7/default.nix
@@ -26,7 +26,7 @@ with stdenv.lib;
 
 let
   majorVersion = "3.7";
-  minorVersion = "0";
+  minorVersion = "1";
   minorVersionSuffix = "";
   version = "${majorVersion}.${minorVersion}${minorVersionSuffix}";
   libPrefix = "python${majorVersion}";
@@ -48,7 +48,7 @@ in stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.python.org/ftp/python/${majorVersion}.${minorVersion}/Python-${version}.tar.xz";
-    sha256 = "0j9mic5c9lbd2b20wka7hily7szz740wy9ilfrczxap63rnrk0h3";
+    sha256 = "0v9x4h22rh5cwpsq1mwpdi3c9lc9820lzp2nmn9g20llij72nzps";
   };
 
   NIX_LDFLAGS = optionalString stdenv.isLinux "-lgcc_s";

diff --git a/pkgs/development/libraries/libmtp/default.nix b/pkgs/development/libraries/libmtp/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, pkgconfig, libusb1, libiconv }:
 
 stdenv.mkDerivation rec {
-  name = "libmtp-1.1.15";
+  name = "libmtp-1.1.16";
 
   src = fetchurl {
     url = "mirror://sourceforge/libmtp/${name}.tar.gz";
-    sha256 = "089h79nkz7wcr3lbqi7025l8p75hbp0aigxk3wdk2zkm8q5r0h6h";
+    sha256 = "185vh9bds6dcy00ycggg69g4v7m3api40zv8vrcfb3fk3vfzjs2v";
   };
 
   outputs = [ "bin" "dev" "out" ];

diff --git a/pkgs/development/libraries/libtiff/default.nix b/pkgs/development/libraries/libtiff/default.nix
@@ -1,28 +1,22 @@
-{ stdenv, fetchurl, pkgconfig, zlib, libjpeg, xz }:
+{ stdenv
+, fetchurl
+
+, pkgconfig
+
+, zlib
+, libjpeg
+, xz
+}:
 
-let
-  version = "4.0.9";
-in
 stdenv.mkDerivation rec {
+  version = "4.0.10";
   name = "libtiff-${version}";
 
   src = fetchurl {
     url = "https://download.osgeo.org/libtiff/tiff-${version}.tar.gz";
-    sha256 = "1kfg4q01r4mqn7dj63ifhi6pmqzbf4xax6ni6kkk81ri5kndwyvf";
+    sha256 = "1r4np635gr6zlc0bic38dzvxia6iqzcrary4n1ylarzpr8fd2lic";
   };
 
-  prePatch = let
-      debian = fetchurl {
-        # When the URL disappears, it typically means that Debian has new patches
-        # (probably security) and updating to new tarball will apply them as well.
-        url = http://http.debian.net/debian/pool/main/t/tiff/tiff_4.0.9-6.debian.tar.xz;
-        sha256 = "10yk5npchxscgsnd7ihd3bbbw2fxkl7ni0plm43c9q4nwp6ms52f";
-      };
-    in ''
-      tar xf ${debian}
-      patches="$patches $(sed 's|^|debian/patches/|' < debian/patches/series)"
-    '';
-
   outputs = [ "bin" "dev" "out" "man" "doc" ];
 
   nativeBuildInputs = [ pkgconfig ];

diff --git a/pkgs/development/python-modules/autobahn/default.nix b/pkgs/development/python-modules/autobahn/default.nix
@@ -1,7 +1,6 @@
-{ stdenv, buildPythonPackage, fetchPypi, isPy3k, isPy33,
-  unittest2, mock, pytest, trollius, asyncio,
-  pytest-asyncio, futures, cffi,
-  six, twisted, txaio, zope_interface
+{ lib, buildPythonPackage, fetchPypi, isPy3k, isPy33,
+  six, txaio, twisted, zope_interface, cffi, asyncio, trollius, futures,
+  mock, pytest
 }:
 buildPythonPackage rec {
   pname = "autobahn";
@@ -12,19 +11,18 @@ buildPythonPackage rec {
     sha256 = "b69858e0be4bff8437b0bd82a0db1cbef7405e16bd9354ba587c043d6d5e1ad9";
   };
 
-  # Upstream claim python2 support, but tests require pytest-asyncio which
-  # is pythn3 only. Therefore, tests are skipped for python2.
-  doCheck = isPy3k;
-  checkInputs = stdenv.lib.optionals isPy3k [ unittest2 mock pytest pytest-asyncio ];
-  propagatedBuildInputs = [ cffi six twisted zope_interface txaio ] ++
-    (stdenv.lib.optional isPy33 asyncio) ++
-    (stdenv.lib.optionals (!isPy3k) [ trollius futures ]);
+  propagatedBuildInputs = [ six txaio twisted zope_interface cffi ] ++
+    (lib.optional isPy33 asyncio) ++
+    (lib.optionals (!isPy3k) [ trollius futures ]);
 
+  checkInputs = [ mock pytest ];
   checkPhase = ''
+    runHook preCheck
     USE_TWISTED=true py.test $out
+    runHook postCheck
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "WebSocket and WAMP in Python for Twisted and asyncio.";
     homepage    = "https://crossbar.io/autobahn";
     license     = licenses.mit;

diff --git a/pkgs/development/python-modules/bootstrapped-pip/default.nix b/pkgs/development/python-modules/bootstrapped-pip/default.nix
@@ -3,26 +3,26 @@
 let
   wheel_source = fetchPypi {
     pname = "wheel";
-    version = "0.31.1";
+    version = "0.32.1";
     format = "wheel";
-    sha256 = "80044e51ec5bbf6c894ba0bc48d26a8c20a9ba629f4ca19ea26ecfcf87685f5f";
+    sha256 = "15hizylh761jcaz8zfdc3wg30jf33izaakyv1p82ppx2y5rgg8cz";
   };
   setuptools_source = fetchPypi {
     pname = "setuptools";
-    version = "40.2.0";
+    version = "40.4.3";
     format = "wheel";
-    sha256 = "ea3796a48a207b46ea36a9d26de4d0cc87c953a683a7b314ea65d666930ea8e6";
+    sha256 = "1zzryv1fqx4nk7hzv4afxpl8k7f60lc0qkhxlc8sqjs4igakfhff";
   };
 
 in stdenv.mkDerivation rec {
   pname = "pip";
-  version = "18.0";
+  version = "18.1";
   name = "${python.libPrefix}-bootstrapped-${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
     format = "wheel";
-    sha256 = "070e4bf493c7c2c9f6a08dd797dd3c066d64074c38e9e8a0fb4e6541f266d96c";
+    sha256 = "7909d0a0932e88ea53a7014dfd14522ffef91a464daaaf5c573343852ef98550";
   };
 
   unpackPhase = ''

diff --git a/pkgs/development/python-modules/numpy/default.nix b/pkgs/development/python-modules/numpy/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchPypi, python, buildPythonPackage, isPyPy, gfortran, pytest, blas }:
+{ stdenv, lib, fetchPypi, fetchpatch, python, buildPythonPackage, isPyPy, gfortran, pytest, blas }:
 
 buildPythonPackage rec {
   pname = "numpy";
@@ -14,7 +14,14 @@ buildPythonPackage rec {
   nativeBuildInputs = [ gfortran pytest ];
   buildInputs = [ blas ];
 
-  patches = lib.optionals (python.hasDistutilsCxxPatch or false) [
+  patches = [
+    # fix a bug with high cpu count (https://github.com/numpy/numpy/issues/12087)
+    (fetchpatch {
+      name = "limit-default-for-get_num_build_jobs-to-8.patch";
+      url = "https://github.com/numpy/numpy/commit/4c05fed01c68a305abf62135695bc61606746683.patch";
+      sha256 = "1j2jlaibbx1fjszxzkgxrz7k8id34kg3gbc2fh4ib6y7hfnbqqz5";
+    })
+  ] ++ lib.optionals (python.hasDistutilsCxxPatch or false) [
     # We patch cpython/distutils to fix https://bugs.python.org/issue1222585
     # Patching of numpy.distutils is needed to prevent it from undoing the
     # patch to distutils.

diff --git a/pkgs/development/python-modules/pip/default.nix b/pkgs/development/python-modules/pip/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "pip";
-  version = "18.0";
+  version = "18.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a0e11645ee37c90b40c46d607070c4fd583e2cd46231b1c06e389c5e814eed76";
+    sha256 = "c0a292bd977ef590379a3f05d7b7f65135487b67470f6281289a94e015650ea1";
   };
 
   # pip detects that we already have bootstrapped_pip "installed", so we need

diff --git a/pkgs/development/python-modules/pytest/default.nix b/pkgs/development/python-modules/pytest/default.nix
@@ -30,9 +30,11 @@ buildPythonPackage rec {
 
   # Remove .pytest_cache when using py.test in a Nix build
   setupHook = writeText "pytest-hook" ''
-    postFixupHooks+=(
-        'find $out -name .pytest_cache -type d -exec rm -rf {} +'
-    )
+    pytestcachePhase() {
+        find $out -name .pytest_cache -type d -exec rm -rf {} +
+    }
+
+    preDistPhases+=" pytestcachePhase"
   '';
 
   meta = with stdenv.lib; {

diff --git a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
@@ -1,16 +1,16 @@
 { lib, buildGoPackage, fetchFromGitLab, fetchurl }:
 
 let
-  version = "11.2.0";
+  version = "11.5.0";
   # Gitlab runner embeds some docker images these are prebuilt for arm and x86_64
   docker_x86_64 = fetchurl {
     url = "https://gitlab-runner-downloads.s3.amazonaws.com/v${version}/helper-images/prebuilt-x86_64.tar.xz";
-    sha256 = "1dphrws6118l0ryvgny0z5h9fsdbwckm4x21bh8hwb6bxdbqr0yn";
+    sha256 = "1siiws19qzfv2nnyp9fy215yd08iv70x830b61kr1742ywc0jcbn";
   };
 
   docker_arm = fetchurl {
     url = "https://gitlab-runner-downloads.s3.amazonaws.com/v${version}/helper-images/prebuilt-arm.tar.xz";
-    sha256 = "162lzbi7z9afp470w0qkcja728jyb48s7krzinmvg45fb3fb0lfn";
+    sha256 = "0d7wnpry4861dcmpspbaar97mkf0jf2bcxvr4nph9xnkw8w7fs2z";
   };
 in
 buildGoPackage rec {
@@ -29,7 +29,7 @@ buildGoPackage rec {
     owner = "gitlab-org";
     repo = "gitlab-runner";
     rev = "v${version}";
-    sha256 = "1y4fb5jbks6xab7zim10s112h11bq04hh3lddmhm4f2nyqcmlrqh";
+    sha256 = "028bl249yfccdnwskbn6sxzf1xsg94chbm107n2h83j7a81cz8kw";
   };
 
   patches = [ ./fix-shell-path.patch ];

diff --git a/pkgs/games/minetest/default.nix b/pkgs/games/minetest/default.nix
@@ -4,19 +4,19 @@
 }:
 
 let
-  version = "0.4.16";
+  version = "0.4.17.1";
   sources = {
     src = fetchFromGitHub {
       owner = "minetest";
       repo = "minetest";
       rev = "${version}";
-      sha256 = "048m8as01bw4pnwfxx04wfnyljxq7ivk88l214zi18prrrkfamj3";
+      sha256 = "19sfblgh9mchkgw32n7gdvm7a8a9jxsl9cdlgmxn9bk9m939a2sg";
     };
     data = fetchFromGitHub {
       owner = "minetest";
       repo = "minetest_game";
       rev = "${version}";
-      sha256 = "0alikzyjvj9hd8s3dd6ghpz0y982w2j0yd2zgd7a047mxw21hrcn";
+      sha256 = "1g8iw2pya32ifljbdx6z6rpcinmzm81i9minhi2bi1d500ailn7s";
     };
   };
 in stdenv.mkDerivation {

diff --git a/pkgs/games/steam/runtime-wrapped.nix b/pkgs/games/steam/runtime-wrapped.nix
@@ -14,6 +14,7 @@ let
     gcc.cc
     nss
     nspr
+    xorg.libxcb
   ]);
 
   allPkgs = overridePkgs ++ [ steam-runtime ];

diff --git a/pkgs/misc/seafile-shared/default.nix b/pkgs/misc/seafile-shared/default.nix
@@ -1,14 +1,14 @@
 {stdenv, fetchFromGitHub, which, autoreconfHook, pkgconfig, curl, vala, python, intltool, fuse, ccnet}:
 
 stdenv.mkDerivation rec {
-  version = "6.2.4";
+  version = "6.2.7";
   name = "seafile-shared-${version}";
 
   src = fetchFromGitHub {
     owner = "haiwen";
     repo = "seafile";
     rev = "v${version}";
-    sha256 = "0v6wvw8x3zfcapi0lk71mg89gy3gw2qmdiq6mhw6qbbrzvqprlmr";
+    sha256 = "0f8h7x6q830q4pw6f6bbykiyj3lkdlgvjzg2sdaqm4bhj2c4k1n0";
   };
 
   nativeBuildInputs = [ pkgconfig which autoreconfHook vala intltool ];

diff --git a/pkgs/os-specific/linux/batman-adv/alfred.nix b/pkgs/os-specific/linux/batman-adv/alfred.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchurl, pkgconfig, gpsd, libcap, libnl }:
 
 let
-  ver = "2018.2";
+  ver = "2018.4";
 in
 stdenv.mkDerivation rec {
   name = "alfred-${ver}";
 
   src = fetchurl {
     url = "https://downloads.open-mesh.org/batman/releases/batman-adv-${ver}/${name}.tar.gz";
-    sha256 = "0640p9zy1511pl30i5yybqa0s1yqz83291vw1z22jrcsq57rrgib";
+    sha256 = "0n6cw6inkzlgz8p6jcc83npqjmvhxp4qsh2dhbiv88ax3lh9arcd";
   };
 
   nativeBuildInputs = [ pkgconfig ];

diff --git a/pkgs/os-specific/linux/batman-adv/batctl.nix b/pkgs/os-specific/linux/batman-adv/batctl.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchurl, pkgconfig, libnl }:
 
 let
-  ver = "2018.2";
+  ver = "2018.4";
 in
 stdenv.mkDerivation rec {
   name = "batctl-${ver}";
 
   src = fetchurl {
     url = "https://downloads.open-mesh.org/batman/releases/batman-adv-${ver}/${name}.tar.gz";
-    sha256 = "09bxh4yifqiphn0ljc3msbxid62ynd9kk3vn82h13gcpfnyckw6z";
+    sha256 = "0mv2vlzcqfh5yavg2sqncca9iqgxi6llv83wwwsf3d38x2jjff74";
   };
 
   nativeBuildInputs = [ pkgconfig ];

diff --git a/pkgs/os-specific/linux/batman-adv/default.nix b/pkgs/os-specific/linux/batman-adv/default.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchurl, kernel }:
 
-let base = "batman-adv-2018.2"; in
+let base = "batman-adv-2018.4"; in
 
 stdenv.mkDerivation rec {
   name = "${base}-${kernel.version}";
 
   src = fetchurl {
     url = "http://downloads.open-mesh.org/batman/releases/${base}/${base}.tar.gz";
-    sha256 = "1jdqlbn8mp9rycbnkgjsb98pb2c7jzw9mm30d3iga69ycwk5dqyq";
+    sha256 = "0ka80l3ajfzi9plq50m79d2qpm1rlir4js5hy3g1mkj1gnyb801m";
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;

diff --git a/pkgs/os-specific/linux/kbd/default.nix b/pkgs/os-specific/linux/kbd/default.nix
@@ -25,6 +25,19 @@ stdenv.mkDerivation rec {
       # Add Neo keymap subdirectory
       sed -i -e 's,^KEYMAPSUBDIRS *= *,&i386/neo ,' data/Makefile.am
 
+      # Renaming keymaps with name clashes, because loadkeys just picks
+      # the first keymap it sees. The clashing names lead to e.g.
+      # "loadkeys no" defaulting to a norwegian dvorak map instead of
+      # the much more common qwerty one.
+      pushd data/keymaps/i386
+      mv qwertz/cz{,-qwertz}.map
+      mv olpc/es{,-olpc}.map
+      mv olpc/pt{,-olpc}.map
+      mv dvorak/{no.map,dvorak-no.map}
+      mv fgGIod/trf{,-fgGIod}.map
+      mv colemak/{en-latin9,colemak}.map
+      popd
+
       # Fix the path to gzip/bzip2.
       substituteInPlace src/libkeymap/findfile.c \
         --replace gzip ${gzip}/bin/gzip \

diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.14.83";
+  version = "4.14.84";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "081zxc7ikcn1hy22pw5af0dql9pq24h2anfgnykc83jfjbg2h5vh";
+    sha256 = "0653fg6p0wg81i4mj8n4lghn8h8jx3pkbyp6sm22p2b1rwpgj893";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.19.4";
+  version = "4.19.5";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1aj7zwrjwrjb3m3nfccykmcvhrrjsk1zchc5g4f63xd1pc35d3x3";
+    sha256 = "0xggarlff54l9zxm5qr14nzd514xxg8i1akyxzlb0znfkk19x0wc";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.164";
+  version = "4.4.165";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "041w65dxsdcdpf7isis2r4xabfm9pbhfgxxx7n9d1nv7grss3d4v";
+    sha256 = "19zmigb1avq63n0cbvsqaw9ygddwx13mrvl80p92abw7ns26b2va";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.140";
+  version = "4.9.141";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0hzrha3rh90jwxjmrh4npd0q56pf512nmb8i2p484k9cikssx27q";
+    sha256 = "09mc5sxzzxmks20vslimaaaw0aamjcc3lvpyjydmr78s25q5zfsp";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -30,11 +30,11 @@ rec {
 
 
   legacy_340 = generic {
-    version = "340.104";
-    sha256_32bit = "1l8w95qpxmkw33c4lsf5ar9w2fkhky4x23rlpqvp1j66wbw1b473";
-    sha256_64bit = "18k65gx6jg956zxyfz31xdp914sq3msn665a759bdbryksbk3wds";
-    settingsSha256 = "1vvpqimvld2iyfjgb9wvs7ca0b0f68jzfdpr0icbyxk4vhsq7sxk";
-    persistencedSha256 = "0zqws2vsrxbxhv6z0nn2galnghcsilcn3s0f70bpm6jqj9wzy7x8";
+    version = "340.107";
+    sha256_32bit = "0mh83affz6bim26ws7kkwwcfj2s6vkdy4d45hifsbshr82qd52wd";
+    sha256_64bit = "0pv9yv3x0kg9hfkmc50xb54ahxkbnyy2vyy4hj2h0s6m9sb5kqz3";
+    settingsSha256 = "1rgaa24acdyqa1rqrx56293vxpskr792njqqpigqmps04llsx703";
+    persistencedSha256 = "0nwv6kh4gxgy80x1zs6gcg5hy3amg25xhsfa2v4mwqa36sblxz6l";
     useGLVND = false;
 
     patches = maybePatch_drm_legacy ++ [ ./vm_operations_struct-fault.patch ];

diff --git a/pkgs/os-specific/linux/sssd/default.nix b/pkgs/os-specific/linux/sssd/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgs, glibc, augeas, dnsutils, c-ares, curl,
+{ stdenv, fetchurl, fetchpatch, pkgs, glibc, augeas, dnsutils, c-ares, curl,
   cyrus_sasl, ding-libs, libnl, libunistring, nss, samba, nfs-utils, doxygen,
   python, python3, pam, popt, talloc, tdb, tevent, pkgconfig, ldb, openldap,
   pcre, kerberos, cifs-utils, glib, keyutils, dbus, fakeroot, libxslt, libxml2,
@@ -18,6 +18,14 @@ stdenv.mkDerivation rec {
     sha256 = "032ppk57qs1lnvz7pb7lw9ldwm9i1yagh9fzgqgn6na3bg61ynzy";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "duplicate-case-value.diff";
+      url = "https://github.com/SSSD/sssd/commit/1ee12b05570fcfb8.diff";
+      sha256 = "01y8i8cfs2gydn84097cl5fynx0db8b0vr345gh57ypp84in3ixw";
+    })
+  ];
+
   # Something is looking for <libxml/foo.h> instead of <libxml2/libxml/foo.h>
   NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
 

diff --git a/pkgs/servers/dns/pdns-recursor/default.nix b/pkgs/servers/dns/pdns-recursor/default.nix
@@ -8,11 +8,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "pdns-recursor-${version}";
-  version = "4.1.7";
+  version = "4.1.8";
 
   src = fetchurl {
     url = "https://downloads.powerdns.com/releases/pdns-recursor-${version}.tar.bz2";
-    sha256 = "0syvxlfxy3h2x1kvqkj7qqk8k85y42qjq30pcqqmy69v3pymq14s";
+    sha256 = "1xg5swappik8v5mjyl7magw7picf5cqp6rbhckd6ijssz16qzy38";
   };
 
   nativeBuildInputs = [ pkgconfig ];

diff --git a/pkgs/servers/jackett/default.nix b/pkgs/servers/jackett/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "jackett-${version}";
-  version = "0.10.434";
+  version = "0.10.471";
 
   src = fetchurl {
     url = "https://github.com/Jackett/Jackett/releases/download/v${version}/Jackett.Binaries.Mono.tar.gz";
-    sha256 = "1vnkppmv7mw2p9bjcfmfxg66g02dq0020ad4z07gbp4dvixpzsnm";
+    sha256 = "0la05akvpvfg9jdgfd39wnc87zi7axzx7499w9m3py7qqqyvgyin";
   };
 
   buildInputs = [ makeWrapper ];

diff --git a/pkgs/servers/matrix-synapse/default.nix b/pkgs/servers/matrix-synapse/default.nix
@@ -1,47 +1,54 @@
-{ lib, stdenv, python2Packages, fetchurl, fetchFromGitHub
+{ lib, stdenv, python2
 , enableSystemd ? true
 }:
+
+with python2.pkgs;
+
 let
-  matrix-angular-sdk = python2Packages.buildPythonPackage rec {
-    name = "matrix-angular-sdk-${version}";
+  matrix-angular-sdk = buildPythonPackage rec {
+    pname = "matrix-angular-sdk";
     version = "0.6.8";
 
-    src = fetchurl {
-      url = "mirror://pypi/m/matrix-angular-sdk/matrix-angular-sdk-${version}.tar.gz";
+    src = fetchPypi {
+      inherit pname version;
       sha256 = "0gmx4y5kqqphnq3m7xk2vpzb0w2a4palicw7wfdr1q2schl9fhz2";
     };
+
+    # no checks from Pypi but as this is abandonware, there will be no
+    # new version anyway
+    doCheck = false;
   };
-  matrix-synapse-ldap3 = python2Packages.buildPythonPackage rec {
+
+  matrix-synapse-ldap3 = buildPythonPackage rec {
     pname = "matrix-synapse-ldap3";
     version = "0.1.3";
 
-    src = fetchFromGitHub {
-      owner = "matrix-org";
-      repo = "matrix-synapse-ldap3";
-      rev = "v${version}";
-      sha256 = "0ss7ld3bpmqm8wcs64q1kb7vxlpmwk9lsgq0mh21a9izyfc7jb2l";
+    src = fetchPypi {
+      inherit pname version;
+      sha256 = "0a0d1y9yi0abdkv6chbmxr3vk36gynnqzrjhbg26q4zg06lh9kgn";
     };
 
-    propagatedBuildInputs = with python2Packages; [ service-identity ldap3 twisted ];
+    propagatedBuildInputs = [ service-identity ldap3 twisted ];
 
-    checkInputs = with python2Packages; [ ldaptor mock ];
+    # ldaptor is not ready for py3 yet
+    doCheck = !isPy3k;
+    checkInputs = [ ldaptor mock ];
   };
-in python2Packages.buildPythonApplication rec {
-  name = "matrix-synapse-${version}";
-  version = "0.33.8";
 
-  src = fetchFromGitHub {
-    owner = "matrix-org";
-    repo = "synapse";
-    rev = "v${version}";
-    sha256 = "122ba09xkc1x35qaajcynkjikg342259rgy81m8abz0l8mcg4mkm";
+in buildPythonApplication rec {
+  pname = "matrix-synapse";
+  version = "0.33.9";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1wdpywqi1xd6dy3hxnnjnh2amlmhljf8s0bff9v55jyh42bj1vpn";
   };
 
   patches = [
     ./matrix-synapse.patch
   ];
 
-  propagatedBuildInputs = with python2Packages; [
+  propagatedBuildInputs = [
     bcrypt
     bleach
     canonicaljson
@@ -75,12 +82,12 @@ in python2Packages.buildPythonApplication rec {
     unpaddedbase64
   ] ++ lib.optional enableSystemd systemd;
 
+  # tests fail under py3 for now, but version 0.34.0 will use py3 by default
+  # https://github.com/matrix-org/synapse/issues/4036
   doCheck = true;
   checkPhase = "python -m twisted.trial test";
 
-  buildInputs = with python2Packages; [
-    mock setuptoolsTrial
-  ];
+  checkInputs = [ mock setuptoolsTrial ];
 
   meta = with stdenv.lib; {
     homepage = https://matrix.org;

diff --git a/pkgs/servers/sql/mariadb/default.nix b/pkgs/servers/sql/mariadb/default.nix
@@ -180,11 +180,11 @@ everything = stdenv.mkDerivation (common // {
 
 connector-c = stdenv.mkDerivation rec {
   name = "mariadb-connector-c-${version}";
-  version = "2.3.6";
+  version = "2.3.7";
 
   src = fetchurl {
     url = "https://downloads.mariadb.org/interstitial/connector-c-${version}/mariadb-connector-c-${version}-src.tar.gz/from/http%3A//nyc2.mirrors.digitalocean.com/mariadb/";
-    sha256 = "15iy5iqp0njbwbn086x2dq8qnbkaci7ydvi84cf5z8fxvljis9vb";
+    sha256 = "13izi35vvxhiwl2dsnqrz75ciisy2s2k30giv7hrm01qlwnmiycl";
     name   = "mariadb-connector-c-${version}-src.tar.gz";
   };
 

diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
@@ -1,4 +1,6 @@
-{ lib, stdenv, glibc, fetchurl, zlib, readline, libossp_uuid, openssl, libxml2, makeWrapper, tzdata }:
+{ stdenv, lib, fetchurl, makeWrapper
+, glibc, zlib, readline, libossp_uuid, openssl, libxml2, tzdata, systemd
+}:
 
 let
 
@@ -16,7 +18,8 @@ let
 
     buildInputs =
       [ zlib readline openssl libxml2 makeWrapper ]
-      ++ lib.optionals (!stdenv.isDarwin) [ libossp_uuid ];
+      ++ lib.optionals (!stdenv.isDarwin) [ libossp_uuid ]
+      ++ lib.optionals (atLeast "9.6" && !stdenv.isDarwin) [ systemd ];
 
     enableParallelBuilding = true;
 
@@ -33,6 +36,7 @@ let
       "--sysconfdir=/etc"
       "--libdir=$(lib)/lib"
       "--with-system-tzdata=${tzdata}/share/zoneinfo"
+      (lib.optionalString (atLeast "9.6" && !stdenv.isDarwin) "--with-systemd")
       (if stdenv.isDarwin then "--with-uuid=e2fs" else "--with-ossp-uuid")
     ];
 

diff --git a/pkgs/tools/filesystems/mtools/default.nix b/pkgs/tools/filesystems/mtools/default.nix
@@ -1,26 +1,24 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "mtools-4.0.18";
+  name = "mtools-4.0.21";
 
   src = fetchurl {
     url = "mirror://gnu/mtools/${name}.tar.bz2";
-    sha256 = "119gdfnsxc6hzicnsf718k0fxgy2q14pxn7557rc96aki20czsar";
+    sha256 = "1kybydx74qgbwpnjvjn49msf8zipchl43d4cq8zzwcyvfkdzw7h2";
   };
 
-  # Prevents errors such as "mainloop.c:89:15: error: expected ')'"
-  # Upstream issue https://lists.gnu.org/archive/html/info-mtools/2014-02/msg00000.html
   patches = stdenv.lib.optional stdenv.isDarwin ./UNUSED-darwin.patch;
 
   # fails to find X on darwin
   configureFlags = stdenv.lib.optional stdenv.isDarwin "--without-x";
 
   doCheck = true;
 
-  meta = {
-    homepage = http://www.gnu.org/software/mtools/;
+  meta = with stdenv.lib; {
+    homepage = https://www.gnu.org/software/mtools/;
     description = "Utilities to access MS-DOS disks";
-    platforms = stdenv.lib.platforms.unix;
-    maintainers = [ ];
+    platforms = platforms.unix;
+    license = licenses.gpl3;
   };
 }
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
@@ -34,6 +34,11 @@ stdenv.mkDerivation rec {
     sha256 = "084niy7cin13ba65p8x38w2xcyc54n3fgzbin40fa2shfr0ca0kq";
   };
 
+  patches = [
+    # Cherry picked fix for https://github.com/curl/curl/issues/3218
+    ./fix-ipv6-url-parsing.patch
+  ];
+
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
   separateDebugInfo = stdenv.isLinux;
 

diff --git a/pkgs/tools/networking/curl/fix-ipv6-url-parsing.patch b/pkgs/tools/networking/curl/fix-ipv6-url-parsing.patch
@@ -0,0 +1,54 @@
+From b28094833a971870fd8c07960b3b12bf6fbbaad3 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Fri, 2 Nov 2018 15:11:16 +0100
+Subject: [PATCH] URL: fix IPv6 numeral address parser
+
+Regression from 46e164069d1a52. Extended test 1560 to verify.
+
+Reported-by: tpaukrt on github
+Fixes #3218
+Closes #3219
+---
+ lib/urlapi.c            | 8 ++++++--
+ tests/libtest/lib1560.c | 9 +++++++++
+ 2 files changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/lib/urlapi.c b/lib/urlapi.c
+index c53e523434..18a6076fff 100644
+--- a/lib/urlapi.c
++++ b/lib/urlapi.c
+@@ -499,8 +499,12 @@ static CURLUcode parse_port(struct Curl_URL *u, char *hostname)
+      (']' == endbracket)) {
+     /* this is a RFC2732-style specified IP-address */
+     portptr = &hostname[len];
+-    if (*portptr != ':')
+-      return CURLUE_MALFORMED_INPUT;
++    if(*portptr) {
++      if(*portptr != ':')
++        return CURLUE_MALFORMED_INPUT;
++    }
++    else
++      portptr = NULL;
+   }
+   else
+     portptr = strchr(hostname, ':');
+diff --git a/tests/libtest/lib1560.c b/tests/libtest/lib1560.c
+index e0faa12b29..57469a9063 100644
+--- a/tests/libtest/lib1560.c
++++ b/tests/libtest/lib1560.c
+@@ -128,6 +128,15 @@ struct querycase {
+ };
+
+ static struct testcase get_parts_list[] ={
++  {"http://[fd00:a41::50]:8080",
++   "http | [11] | [12] | [13] | [fd00:a41::50] | 8080 | / | [16] | [17]",
++   CURLU_DEFAULT_SCHEME, 0, CURLUE_OK},
++  {"http://[fd00:a41::50]/",
++   "http | [11] | [12] | [13] | [fd00:a41::50] | [15] | / | [16] | [17]",
++   CURLU_DEFAULT_SCHEME, 0, CURLUE_OK},
++  {"http://[fd00:a41::50]",
++   "http | [11] | [12] | [13] | [fd00:a41::50] | [15] | / | [16] | [17]",
++   CURLU_DEFAULT_SCHEME, 0, CURLUE_OK},
+   {"https://[::1%252]:1234",
+    "https | [11] | [12] | [13] | [::1%252] | 1234 | / | [16] | [17]",
+    CURLU_DEFAULT_SCHEME, 0, CURLUE_OK},
diff --git a/pkgs/tools/package-management/nixops/generic.nix b/pkgs/tools/package-management/nixops/generic.nix
@@ -26,6 +26,7 @@ python2Packages.buildPythonApplication {
       datadog
       digital-ocean
       libvirt
+      typing
     ];
 
   doCheck = false;

diff --git a/pkgs/tools/package-management/nixops/unstable.nix b/pkgs/tools/package-management/nixops/unstable.nix
@@ -5,9 +5,9 @@
 # Then copy the URL to the tarball.
 
 callPackage ./generic.nix (rec {
-  version = "1.6.1pre2622_f10999a";
+  version = "1.6.1pre2706_d5ad09c";
   src = fetchurl {
-    url = "https://hydra.nixos.org/build/73716350/download/2/nixops-${version}.tar.bz2";
-    sha256 = "08886b6vxhjc3cp0ikxp920zap7wp6r92763fp785rvxrmb00rbd";
+    url = "https://hydra.nixos.org/build/84098258/download/2/nixops-${version}.tar.bz2";
+    sha256 = "0lr963a0bjrblv0d1nfl4d0p76jkq6l9xj3vxgzg38q0ld5qw345";
   };
 })
diff --git a/pkgs/tools/security/browserpass/default.nix b/pkgs/tools/security/browserpass/default.nix
@@ -3,7 +3,7 @@
 
 buildGoPackage rec {
   name = "browserpass-${version}";
-  version = "2.0.18";
+  version = "2.0.22";
 
   goPackagePath = "github.com/dannyvankooten/browserpass";
 
@@ -13,7 +13,7 @@ buildGoPackage rec {
     repo = "browserpass";
     owner = "dannyvankooten";
     rev = version;
-    sha256 = "0wszjpxfa0krr2zdx7a33vl1r86k74dpy5c940r6ww1zbgqzcibg";
+    sha256 = "05cacrx08k99c5zra7ksdik9xxn3vih3x6in7536zs5gm55mkbfx";
   };
 
   postPatch = ''

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
@@ -2760,11 +2760,11 @@ with pkgs;
   gitlab-runner = callPackage ../development/tools/continuous-integration/gitlab-runner { };
   gitlab-runner_1_11 = callPackage ../development/tools/continuous-integration/gitlab-runner/v1.nix { };
 
-  gitlab-shell = callPackage ../applications/version-management/gitlab-shell { };
+  gitlab-shell = callPackage ../applications/version-management/gitlab/gitlab-shell { };
 
-  gitlab-workhorse = callPackage ../applications/version-management/gitlab-workhorse { };
+  gitlab-workhorse = callPackage ../applications/version-management/gitlab/gitlab-workhorse { };
 
-  gitaly = callPackage ../applications/version-management/gitaly { };
+  gitaly = callPackage ../applications/version-management/gitlab/gitaly { };
 
   gitstats = callPackage ../applications/version-management/gitstats { };
 
@@ -4516,6 +4516,10 @@ with pkgs;
   pandoc = haskell.lib.overrideCabal (haskell.lib.justStaticExecutables haskellPackages.pandoc) (drv: {
     configureFlags = drv.configureFlags or [] ++ ["-fembed_data_files"];
     buildDepends = drv.buildDepends or [] ++ [haskellPackages.file-embed];
+    postInstall = ''
+      mkdir -p $out/share/man/man1
+      cp man/pandoc.1 $out/share/man/man1/
+    '';
   });
 
   pamtester = callPackage ../tools/security/pamtester { };
@@ -6717,7 +6721,7 @@ with pkgs;
 
   haskell = callPackage ./haskell-packages.nix { };
 
-  haskellPackages = haskell.packages.ghc843.override {
+  haskellPackages = haskell.packages.ghc844.override {
     overrides = config.haskellPackageOverrides or haskell.packageOverrides;
   };
 

diff --git a/pkgs/top-level/haskell-packages.nix b/pkgs/top-level/haskell-packages.nix
@@ -108,7 +108,7 @@ in {
       stage0 = ../development/compilers/ghcjs-ng/8.2/stage0.nix;
     };
     ghcjs84 = callPackage ../development/compilers/ghcjs-ng {
-      bootPkgs = packages.ghc843;
+      bootPkgs = packages.ghc844;
       ghcjsSrcJson = ../development/compilers/ghcjs-ng/8.4/git.json;
       stage0 = ../development/compilers/ghcjs-ng/8.4/stage0.nix;
       ghcjsDepOverrides = callPackage ../development/compilers/ghcjs-ng/8.4/dep-overrides.nix {};
-Original file line number
+Diff line change
@@ @@ -14,6 +14,7 @@ let @@
         gcc.cc
         nss
         nspr
+        xorg.libxcb
       ]);
       allPkgs = overridePkgs ++ [ steam-runtime ];