diff --git a/nixos/modules/services/networking/kresd.nix b/nixos/modules/services/networking/kresd.nix
index ca34ff9df4ef..fc516c01230a 100644
--- a/nixos/modules/services/networking/kresd.nix
+++ b/nixos/modules/services/networking/kresd.nix
@@ -80,8 +80,11 @@ in
         # Syntax depends on being IPv6 or IPv4.
         (iface: if elem ":" (stringToCharacters iface) then "[${iface}]:53" else "${iface}:53")
         cfg.interfaces;
-      socketConfig.ListenDatagram = listenStreams;
-      socketConfig.FreeBind = true;
+      socketConfig = {
+        ListenDatagram = listenStreams;
+        FreeBind = true;
+        FileDescriptorName = "dns";
+      };
     };
 
     systemd.sockets.kresd-tls = mkIf (cfg.listenTLS != []) rec {
diff --git a/pkgs/applications/misc/electrum/default.nix b/pkgs/applications/misc/electrum/default.nix
index 30cc73f3c0b0..efa6e64fb61a 100644
--- a/pkgs/applications/misc/electrum/default.nix
+++ b/pkgs/applications/misc/electrum/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, fetchFromGitHub, python3, python3Packages, zbar, secp256k1 }:
 
 let
-  version = "3.3.6";
+  version = "3.3.7";
 
   qdarkstyle = python3Packages.buildPythonPackage rec {
     pname = "QDarkStyle";
@@ -18,7 +18,7 @@ let
     owner = "spesmilo";
     repo = "electrum";
     rev = version;
-    sha256 = "0s8i6fn1jwk80d036n4c7csv4qnx2k15f6347kr4mllglcpa9hb3";
+    sha256 = "1g2kbbsi6k105q6s0la20h12gz8dzka5kdcjbdhs12jqsjfx3lr0";
 
     extraPostFetch = ''
       mv $out ./all
@@ -33,7 +33,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchurl {
     url = "https://download.electrum.org/${version}/Electrum-${version}.tar.gz";
-    sha256 = "0am5ki3z0yvhrz16vp2jjy5fkxxqph0mj9qqpbw3kpql65shykwz";
+    sha256 = "13ahc4zqpgzmck2r663sqqgz86xsd83r5qqi26mh2vazy1i6pykz";
   };
 
   postUnpack = ''
diff --git a/pkgs/applications/networking/browsers/firefox/packages.nix b/pkgs/applications/networking/browsers/firefox/packages.nix
index c02fa01db81a..67a55dd57357 100644
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@@ -237,16 +237,16 @@ in rec {
   };
 
   tor-browser-8-5 = tbcommon rec {
-    ffversion = "60.7.0esr";
-    tbversion = "8.5.2";
+    ffversion = "60.8.0esr";
+    tbversion = "8.5.4";
 
     # FIXME: fetchFromGitHub is not ideal, unpacked source is >900Mb
     src = fetchFromGitHub {
       owner = "SLNOS";
       repo  = "tor-browser";
-      # branch "tor-browser-60.7.0esr-8.5-2-slnos"
-      rev   = "b8216328bf6bf1996fcd794d4531689a7c373a2f";
-      sha256 = "0zmqam3c91iww33jpfyl6q6wacj20nqkfzyqryalfvnvx3zi0i1q";
+      # branch "tor-browser-60.8.0esr-8.5-1-slnos"
+      rev   = "9ec7e4832a68ba3a77f5e8e21dc930a25757f55d";
+      sha256 = "10x9h2nm1p8cs0qnd8yjp7ly5raxagqyfjn4sj2y3i86ya5zygb9";
     };
   };
 
diff --git a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
index 6bfe31a803ba..4eeb65826721 100644
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@@ -89,7 +89,7 @@ let
   fteLibPath = makeLibraryPath [ stdenv.cc.cc gmp ];
 
   # Upstream source
-  version = "8.5.3";
+  version = "8.5.4";
 
   lang = "en-US";
 
@@ -99,7 +99,7 @@ let
         "https://github.com/TheTorProject/gettorbrowser/releases/download/v${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
         "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
       ];
-      sha256 = "15ml0azc7imlfc2h88yxpxsyrf6pxxcd1si33bfbsjh17zw1282g";
+      sha256 = "0nnzynk3nlnd847c8jjghs9anmr5a2hv7nk1qxigigxqa5vqy96z";
     };
 
     "i686-linux" = fetchurl {
@@ -107,7 +107,7 @@ let
         "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
         "https://github.com/TheTorProject/gettorbrowser/releases/download/v${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
       ];
-      sha256 = "1zvcy44qx353qa5h90g0qigbp9xgaiq8s7a5wmhnfrfd2iw4ph7d";
+      sha256 = "1b34skl3hwvpy0r4l5ykgnnwhbz7cvly2gi9ib4h7lijjfafiys1";
     };
   };
 in
diff --git a/pkgs/desktops/pantheon/desktop/wingpanel-indicators/session/default.nix b/pkgs/desktops/pantheon/desktop/wingpanel-indicators/session/default.nix
index a46e001e7a0e..0b4a6f5e8f02 100644
--- a/pkgs/desktops/pantheon/desktop/wingpanel-indicators/session/default.nix
+++ b/pkgs/desktops/pantheon/desktop/wingpanel-indicators/session/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wingpanel-indicator-session";
-  version = "2.2.3";
+  version = "2.2.4";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = pname;
     rev = version;
-    sha256 = "1y0blff02p3w23sv17yg7fq0yq0g2k8j7vjmk92k664fx72kjjzh";
+    sha256 = "1x2p2sjal42bspmqcg9lzixv6rnihvgmwk92gfcccrmvk8j4bx6s";
   };
 
   passthru = {
diff --git a/pkgs/development/compilers/llvm/7/llvm.nix b/pkgs/development/compilers/llvm/7/llvm.nix
index 34f8a5478d1b..44bb13897ae0 100644
--- a/pkgs/development/compilers/llvm/7/llvm.nix
+++ b/pkgs/development/compilers/llvm/7/llvm.nix
@@ -15,7 +15,9 @@
 , debugVersion ? false
 , enableManpages ? false
 , enableSharedLibraries ? true
-, enablePFM ? !stdenv.isDarwin
+, enablePFM ? !(stdenv.isDarwin
+  || stdenv.isAarch64 # broken for Ampere eMAG 8180 (c2.large.arm on Packet) #56245
+  )
 , enablePolly ? false
 }:
 
diff --git a/pkgs/development/python-modules/aiorpcx/default.nix b/pkgs/development/python-modules/aiorpcx/default.nix
index a5f54d8e96cf..6350e3f0441a 100644
--- a/pkgs/development/python-modules/aiorpcx/default.nix
+++ b/pkgs/development/python-modules/aiorpcx/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "aiorpcx";
-  version = "0.17.0";
+  version = "0.18.3";
 
   src = fetchPypi {
     inherit version;
     pname = "aiorpcX";
-    sha256 = "14np5r75rs0v45vsv20vbzmnv3qisvm9mdllj1j9s1633cvcik0k";
+    sha256 = "0k545hc7wl6sh1svydzbv6x7sx5pig2pqkl3yxs9riwmvzawx9xp";
   };
 
   propagatedBuildInputs = [ attrs ];
diff --git a/pkgs/development/python-modules/mautrix-appservice/default.nix b/pkgs/development/python-modules/mautrix-appservice/default.nix
index 8f59d7ce7b5e..ba96e7d734be 100644
--- a/pkgs/development/python-modules/mautrix-appservice/default.nix
+++ b/pkgs/development/python-modules/mautrix-appservice/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "mautrix-appservice";
-  version = "0.3.10.dev1";
+  version = "0.3.11";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ed827ff2a50b43f8125268145991d51b4a32ea4fbdd95b589ea15019b72a0bc3";
+    sha256 = "60192920cff75afdd096eea3a43276e33ec15f4f00bd04d2d1dda616c84f22a5";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/telethon/default.nix b/pkgs/development/python-modules/telethon/default.nix
index 09d944c80883..334163114a18 100644
--- a/pkgs/development/python-modules/telethon/default.nix
+++ b/pkgs/development/python-modules/telethon/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "telethon";
-  version = "1.6.2";
+  version = "1.9.0";
 
   src = fetchPypi {
     inherit version;
     pname = "Telethon";
-    sha256 = "074h5gj0c330rb1nxzpqm31fp1vw7calh1cdkapbjx90j769iz18";
+    sha256 = "a8797ad5bfee2b350cfc9b73cbb30fc19c8f73c0db42471e0df1371b1a269edc";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
index c75baf454b34..a93b791f7e6a 100644
--- a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
@@ -1,16 +1,16 @@
 { lib, buildGoPackage, fetchFromGitLab, fetchurl }:
 
 let
-  version = "11.9.2";
+  version = "12.0.2";
   # Gitlab runner embeds some docker images these are prebuilt for arm and x86_64
   docker_x86_64 = fetchurl {
     url = "https://gitlab-runner-downloads.s3.amazonaws.com/v${version}/helper-images/prebuilt-x86_64.tar.xz";
-    sha256 = "10zmaywq1vzch4a6zdvnm9kgil9ankc9napix9s9fw45wc0lw01p";
+    sha256 = "0b1xkksd4rgqvjahp5bf53sk887z2fxwr7rf8vqs9j9aw54zm5cn";
   };
 
   docker_arm = fetchurl {
     url = "https://gitlab-runner-downloads.s3.amazonaws.com/v${version}/helper-images/prebuilt-arm.tar.xz";
-    sha256 = "0845ylhb3i3jmi5q6aaix4hw9zdb83v5fhvif0xvvi2m7irg06lf";
+    sha256 = "1cjl64g3ymnrs9c3fl28aydfzf18ik4vnjcvijv28c3gm1i6chs0";
   };
 in
 buildGoPackage rec {
@@ -29,7 +29,7 @@ buildGoPackage rec {
     owner = "gitlab-org";
     repo = "gitlab-runner";
     rev = "v${version}";
-    sha256 = "00k4myca2djd6h3i83vjndahm5q1rnlkq0p69dhl5jbldwy614ph";
+    sha256 = "0cbh11libcyfdgrvnl1aa11x90ac7zgn1d9myc4dwmqzfdm4kdlb";
   };
 
   patches = [ ./fix-shell-path.patch ];
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index 30750c9f5d66..d3d2e2728a2d 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.14.132";
+  version = "4.14.133";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0c7k5yl2h929kvbzqij0p56myp9v14im4s72wky5d9idfadg71ns";
+    sha256 = "005pg4f8l2qz8g6hd71pj567z91hwjwdwb37h4dbb3fj6kjl965y";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index f38196fef7d1..b9d05c9fe6e8 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.19.57";
+  version = "4.19.58";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "11rz1pfphc4zkn3fbfavn1764g3ymp4b1bfnr7b630w8smcmfz1j";
+    sha256 = "1waqk2ggnnaqa5pxhdbvxkkchvxxz9pbkqnr5pn5rj6h2v5644az";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index a80e578c75b0..1e3da9085196 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.184";
+  version = "4.4.185";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1jn3mwnfcvhnn0bqiyabkqii3rd6w5b982w3i085qj42q0pj6hv5";
+    sha256 = "1ll694m5193dmwn8ys4sf2p6a6njd5pm38v862ih1iw7l3vj0l3s";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index 4f054dcc6657..d611e4cf71e6 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.184";
+  version = "4.9.185";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1bwzmmpc7k9n7p2s383pipdjc3hvqfbbacaxk7gdw9856pai8c83";
+    sha256 = "16z3ijfzffpkp4mj42j3j8zbnpba1a67kd5cdqwb28spf32a66vc";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.1.nix b/pkgs/os-specific/linux/kernel/linux-5.1.nix
index 85dc12c6b044..e0e64fdc5d4e 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.1.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.1.16";
+  version = "5.1.17";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0gms4zkx97njzk1czsnih6jj9f6knismixxndn1h11vq7sz5agla";
+    sha256 = "0gf4jqmq6b66jrlygmvn2z8xif3n83yq85jldbm3r257crww6dar";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/servers/dns/knot-resolver/default.nix b/pkgs/servers/dns/knot-resolver/default.nix
index 02f52903fa91..8cc87191c853 100644
--- a/pkgs/servers/dns/knot-resolver/default.nix
+++ b/pkgs/servers/dns/knot-resolver/default.nix
@@ -1,76 +1,78 @@
-{ stdenv, fetchurl, fetchpatch, runCommand, pkgconfig, hexdump, which
-, knot-dns, luajit, libuv, lmdb, gnutls, nettle
-, cmocka, systemd, dns-root-data, makeWrapper
+{ stdenv, fetchurl
+# native deps.
+, runCommand, pkgconfig, meson, ninja, makeWrapper
+# build+runtime deps.
+, knot-dns, luajitPackages, libuv, gnutls, lmdb, systemd, dns-root-data
+# test-only deps.
+, cmocka, which, cacert
 , extraFeatures ? false /* catch-all if defaults aren't enough */
-, luajitPackages
 }:
 let # un-indented, over the whole file
 
 result = if extraFeatures then wrapped-full else unwrapped;
 
-inherit (stdenv.lib) optional concatStringsSep;
+inherit (stdenv.lib) optional optionals concatStringsSep;
+lua = luajitPackages;
+
+# FIXME: remove these usages once resolving
+# https://github.com/NixOS/nixpkgs/pull/63108#issuecomment-508670438
+exportLuaPathsFor = luaPkgs: ''
+  export LUA_PATH='${ concatStringsSep ";" (map lua.getLuaPath  luaPkgs)}'
+  export LUA_CPATH='${concatStringsSep ";" (map lua.getLuaCPath luaPkgs)}'
+'';
 
 unwrapped = stdenv.mkDerivation rec {
   name = "knot-resolver-${version}";
-  version = "3.2.1";
+  version = "4.1.0";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/knot-resolver/${name}.tar.xz";
-    sha256 = "d1396888ec3a63f19dccdf2b7dbcb0d16a5d8642766824b47f4c21be90ce362b";
+    sha256 = "2fe470f9bb1007667cdd448f758087244b7195a0234c2b100a9beeed0a2d3e68";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "support-libzscanner-2.8.diff";
-      url = "https://gitlab.labs.nic.cz/knot/knot-resolver/commit/186f263.diff";
-      sha256 = "19zqigvc7m2a4j6bk9whx7gj0v009568rz5qwk052z7pzfikr8mk";
-    })
-  ];
-
-  # Short-lived cross fix, as upstream is migrating to meson anyway.
-  postPatch = ''
-    substituteInPlace platform.mk --replace "objdump" "$OBJDUMP"
-  '';
-
   outputs = [ "out" "dev" ];
 
-  configurePhase = "patchShebangs scripts/";
+  preConfigure = ''
+    patchShebangs scripts/
+  ''
+    + stdenv.lib.optionalString doInstallCheck (exportLuaPathsFor [ lua.cqueues lua.basexx ]);
 
-  nativeBuildInputs = [ pkgconfig which hexdump ];
+  nativeBuildInputs = [ pkgconfig meson ninja ];
 
   # http://knot-resolver.readthedocs.io/en/latest/build.html#requirements
-  buildInputs = [ knot-dns luajit libuv gnutls nettle lmdb ]
-    ++ optional stdenv.isLinux systemd # sd_notify
+  buildInputs = [ knot-dns lua.lua libuv gnutls lmdb ]
+    ++ optional stdenv.isLinux systemd # passing sockets, sd_notify
     ## optional dependencies; TODO: libedit, dnstap
     ;
 
-  checkInputs = [ cmocka ];
-
-  makeFlags = [
-    "PREFIX=$(out)"
-    "ROOTHINTS=${dns-root-data}/root.hints"
-    "KEYFILE_DEFAULT=${dns-root-data}/root.ds"
+  mesonFlags = [
+    "-Dkeyfile_default=${dns-root-data}/root.ds"
+    "-Droot_hints=${dns-root-data}/root.hints"
+    "-Dinstall_kresd_conf=disabled" # not really useful; examples are inside share/doc/
+    "--default-library=static" # not used by anyone
+  ]
+  ++ optionals doInstallCheck [
+    "-Dunit_tests=enabled"
+    #"-Dconfig_tests=enabled" #FIXME: check-no-ca-store.diff - as gnutls isn't patched
+    #"-Dextra_tests=enabled" # not suitable as in-distro tests; many deps, too.
   ];
-  CFLAGS = [ "-O2" "-DNDEBUG" ];
-
-  enableParallelBuilding = true;
-
-  doCheck = true;
-  doInstallCheck = false; # FIXME
-  preInstallCheck = ''
-    patchShebangs tests/config/runtest.sh
-  '';
 
   postInstall = ''
-    rm "$out"/etc/knot-resolver/root.hints # using system-wide instead
+    rm "$out"/lib/libkres.a
+  '';
+
+  # aarch64: see https://github.com/wahern/cqueues/issues/223
+  doInstallCheck = with stdenv; hostPlatform == buildPlatform && !hostPlatform.isAarch64;
+  installCheckInputs = [ cmocka which ];
+  installCheckPhase = ''
+    meson test --print-errorlogs
   '';
 
   meta = with stdenv.lib; {
     description = "Caching validating DNS resolver, from .cz domain registry";
     homepage = https://knot-resolver.cz;
     license = licenses.gpl3Plus;
-    # Platforms using negative pointers for stack won't work ATM due to LuaJIT impl.
-    platforms = filter (p: p != "aarch64-linux") platforms.unix;
+    platforms = platforms.unix;
     maintainers = [ maintainers.vcunat /* upstream developer */ ];
   };
 };
@@ -88,17 +90,18 @@ wrapped-full = with luajitPackages; let
     preferLocalBuild = true;
     allowSubstitutes = false;
   }
-  ''
+  (exportLuaPathsFor luaPkgs
+  + ''
     mkdir -p "$out/sbin" "$out/share"
     makeWrapper '${unwrapped}/sbin/kresd' "$out"/sbin/kresd \
-      --set LUA_PATH  '${concatStringsSep ";" (map getLuaPath  luaPkgs)}' \
-      --set LUA_CPATH '${concatStringsSep ";" (map getLuaCPath luaPkgs)}'
+      --set LUA_PATH  "$LUA_PATH" \
+      --set LUA_CPATH "$LUA_CPATH"
     ln -sr '${unwrapped}/share/man' "$out"/share/
     ln -sr "$out"/{sbin,bin}
 
     echo "Checking that 'http' module loads, i.e. lua search paths work:"
     echo "modules.load('http')" > test-http.lua
     echo -e 'quit()' | env -i "$out"/bin/kresd -a 127.0.0.1#53535 -c test-http.lua
-  '';
+  '');
 
 in result
diff --git a/pkgs/servers/mautrix-telegram/default.nix b/pkgs/servers/mautrix-telegram/default.nix
index d7ffba12a21c..eae547db8b0d 100644
--- a/pkgs/servers/mautrix-telegram/default.nix
+++ b/pkgs/servers/mautrix-telegram/default.nix
@@ -4,11 +4,11 @@ with python3.pkgs;
 
 buildPythonPackage rec {
   pname = "mautrix-telegram";
-  version = "0.5.2";
+  version = "0.6.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "03dbd389e05aa08c52ef36ca362fcc9aa103f6c6173bb093ed03a96e05e8d43d";
+    sha256 = "fbed41838e1ef7e43f6e47ff38f9906cb311cfc5b3b6bc6f704babd7c83b193d";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/servers/mautrix-whatsapp/default.nix b/pkgs/servers/mautrix-whatsapp/default.nix
index f6526ab1f715..824f8ea20259 100644
--- a/pkgs/servers/mautrix-whatsapp/default.nix
+++ b/pkgs/servers/mautrix-whatsapp/default.nix
@@ -2,15 +2,15 @@
 
 buildGoPackage rec {
   name = "mautrix-unstable-${version}";
-  version = "2019-02-24";
+  version = "2019-07-04";
 
   goPackagePath = "maunium.net/go/mautrix-whatsapp";
 
   src = fetchFromGitHub {
     owner = "tulir";
     repo = "mautrix-whatsapp";
-    rev = "485acf6de654b8fb70007876c074fb004eb9717b";
-    sha256 = "1v7h3s8h0aiq6g06h9j1sidw8y5aiw24sgdh9knr1c90pvvc7pmv";
+    rev = "29f5ae45c4b22f463003b23e355b951831f08b3e";
+    sha256 = "12209m3x01i7bnnkg57ag1ivsk6n6pqaqfin7y02irgi3i3rm31r";
   };
 
   goDeps = ./deps.nix;
diff --git a/pkgs/servers/mautrix-whatsapp/deps.nix b/pkgs/servers/mautrix-whatsapp/deps.nix
index 8624889e3468..2dd35846bf5d 100644
--- a/pkgs/servers/mautrix-whatsapp/deps.nix
+++ b/pkgs/servers/mautrix-whatsapp/deps.nix
@@ -1,21 +1,22 @@
+# NOTE: this file isn't entirely generated, while performing the bump
+# from 2019-02-24 to 2019-06-01, a lot of stuff broke during `vgo2nix` as the
+# tool is unable to parse `replace` statements atm.
+#
+# The following sources were altered manually:
+# * github.com/Rhymen/go-whatsapp -> github.com/tulir/go-whatsapp (at 36ed380bdc18)
+# * github.com/golang/protobuf: v1.2.0 -> v1.3.1
+# * maunium.net/go/mautrix: v0.1.0-alpha3 -> ca5d9535b6cc
+# * maunium.net/go/mautrix-appservice: v0.1.0-alpha3 -> 6e6c9bb47548
+
 # file generated from go.mod using vgo2nix (https://github.com/adisbladis/vgo2nix)
 [
-  {
-    goPackagePath = "github.com/Baozisoftware/qrcode-terminal-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/Baozisoftware/qrcode-terminal-go";
-      rev = "c0650d8dff0f";
-      sha256 = "166h9zy9y7ygayhybg7d080hpdcf1mvkf3rwnq5lqg8i3cg71s7b";
-    };
-  }
   {
     goPackagePath = "github.com/Rhymen/go-whatsapp";
     fetch = {
       type = "git";
-      url = "https://github.com/Rhymen/go-whatsapp";
-      rev = "c1173899de99";
-      sha256 = "1f46zpbfgv3k38lgdrcwqf4cm34dgqxlfs9qzg380in61460lcri";
+      url = "https://github.com/tulir/go-whatsapp";
+      rev = "36ed380bdc188e35fe804d6dd4809ee170136670";
+      sha256 = "1ida4j5hgqc5djwfsaqp8g6iynn150rwj42kqk9q2srwz5075n4p";
     };
   }
   {
@@ -32,8 +33,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/golang/protobuf";
-      rev = "v1.2.0";
-      sha256 = "0kf4b59rcbb1cchfny2dm9jyznp8ri2hsb14n8iak1q8986xa0ab";
+      rev = "v1.3.1";
+      sha256 = "15am4s4646qy6iv0g3kkqq52rzykqjhm4bf08dk0fy2r58knpsyl";
     };
   }
   {
@@ -41,8 +42,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/gorilla/mux";
-      rev = "v1.7.0";
-      sha256 = "09cn5v1gxrrrydzyllp1asbhgm5xsawb92as7cg9jqg6iyqajvlc";
+      rev = "v1.6.2";
+      sha256 = "0pvzm23hklxysspnz52mih6h1q74vfrdhjfm1l3sa9r8hhqmmld2";
     };
   }
   {
@@ -54,13 +55,22 @@
       sha256 = "00i4vb31nsfkzzk7swvx3i75r2d960js3dri1875vypk3v2s0pzk";
     };
   }
+  {
+    goPackagePath = "github.com/lib/pq";
+    fetch = {
+      type = "git";
+      url = "https://github.com/lib/pq";
+      rev = "v1.1.1";
+      sha256 = "0g64wlg1l1ybq4x44idksl4pgm055s58jxc6r6x4qhqm5q76h0km";
+    };
+  }
   {
     goPackagePath = "github.com/mattn/go-colorable";
     fetch = {
       type = "git";
       url = "https://github.com/mattn/go-colorable";
-      rev = "v0.1.1";
-      sha256 = "0l640974j804c1yyjfgyxqlsivz0yrzmbql4mhcw2azryigkp08p";
+      rev = "v0.0.9";
+      sha256 = "1nwjmsppsjicr7anq8na6md7b1z84l9ppnlr045hhxjvbkqwalvx";
     };
   }
   {
@@ -68,8 +78,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/mattn/go-isatty";
-      rev = "v0.0.5";
-      sha256 = "114d5xm8rfxplzd7nxz97gfngb4bhqy102szl084d1afcxsvm4aa";
+      rev = "v0.0.4";
+      sha256 = "0zs92j2cqaw9j8qx1sdxpv3ap0rgbs0vrvi72m40mg8aa36gd39w";
     };
   }
   {
@@ -82,7 +92,16 @@
     };
   }
   {
-    goPackagePath = "github.com/russross/blackfriday";
+    goPackagePath = "github.com/pkg/errors";
+    fetch = {
+      type = "git";
+      url = "https://github.com/pkg/errors";
+      rev = "v0.8.1";
+      sha256 = "0g5qcb4d4fd96midz0zdk8b9kz8xkzwfa8kr1cliqbg8sxsy5vd1";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/russross/blackfriday.v2";
     fetch = {
       type = "git";
       url = "https://github.com/russross/blackfriday";
@@ -113,8 +132,8 @@
     fetch = {
       type = "git";
       url = "https://go.googlesource.com/crypto";
-      rev = "ffb98f73852f";
-      sha256 = "0hil543q2zq8wxsz6ljrfnrhhxg5j0mrjfwskf2x6q0ppqizsa4h";
+      rev = "b8fe1690c613";
+      sha256 = "1mbfpbrirsz8fsdkibm9l4sccpm774p9201mpmfh4hxshz3girq3";
     };
   }
   {
@@ -135,15 +154,6 @@
       sha256 = "1bb0mw6ckb1k7z8v3iil2qlqwfj408fvvp8m1cik2b46p7snyjhm";
     };
   }
-  {
-    goPackagePath = "golang.org/x/sys";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sys";
-      rev = "cd391775e71e";
-      sha256 = "12wk5ylx0jjajipr68yn50wcd0c9shzhq9y4an40ldnv4bsdp2rj";
-    };
-  }
   {
     goPackagePath = "gopkg.in/check.v1";
     fetch = {
@@ -185,8 +195,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/tulir/mautrix-go.git";
-      rev = "v0.1.0-alpha.3";
-      sha256 = "12nlyij57ss2a5d1f1k1vsmjjvxp1fannlrbnp2jsj6rrsq0d2wr";
+      rev = "ca5d9535b6ccee8fdf473f9cc935932ef3e53ae7";
+      sha256 = "1qrh77c8vh2k6ffwf0cymjmhcp7d0rdad1ixqx5r1xig27f7v0qg";
     };
   }
   {
@@ -194,8 +204,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/tulir/mautrix-appservice-go.git";
-      rev = "v0.1.0-alpha.3";
-      sha256 = "17y11wgqbrafbq6bnn4rp2lzd50fjz9d6f8j3382jsara7ps95vr";
+      rev = "6e6c9bb4754849443cb3c64d9510f8d2eb3e668d";
+      sha256 = "1zwsfvgxs2zbc6yvgnk16w2wkh891kihrzar3qzz9cvsgjznlyvy";
     };
   }
 ]
diff --git a/pkgs/tools/misc/youtube-dl/default.nix b/pkgs/tools/misc/youtube-dl/default.nix
index f51d7374e82c..c9211d473d0b 100644
--- a/pkgs/tools/misc/youtube-dl/default.nix
+++ b/pkgs/tools/misc/youtube-dl/default.nix
@@ -19,11 +19,11 @@ buildPythonPackage rec {
   # The websites youtube-dl deals with are a very moving target. That means that
   # downloads break constantly. Because of that, updates should always be backported
   # to the latest stable release.
-  version = "2019.07.02";
+  version = "2019.07.12";
 
   src = fetchurl {
     url = "https://yt-dl.org/downloads/${version}/${pname}-${version}.tar.gz";
-    sha256 = "1ci09m2fg23vk92sk3wkg0b2jkph8d06spyn2s3fgr1rwzwazgir";
+    sha256 = "1mf8nh972hjpxj01q37jghj32rv21y91fpbwwsqmbmh65dr4k1dn";
   };
 
   nativeBuildInputs = [ makeWrapper ];