ffmpeg_2_8: 2.8.14 -> 2.8.15

(cherry picked from commit c13f1a508d)

lib/strings.nix

@@ -236,6 +236,26 @@ rec {
     in lenContent >= lenSuffix &&
        substring (lenContent - lenSuffix) lenContent content == suffix;
 
+  /* Determine whether a string contains the given infix
+
+    Type: hasInfix :: string -> string -> bool
+
+    Example:
+      hasInfix "bc" "abcd"
+      => true
+      hasInfix "ab" "abcd"
+      => true
+      hasInfix "cd" "abcd"
+      => true
+      hasInfix "foo" "abcd"
+      => false
+  */
+  hasInfix = infix: content:
+    let
+      drop = x: substring 1 (stringLength x) x;
+    in hasPrefix infix content
+      || content != "" && hasInfix infix (drop content);
+
   /* Convert a string to a list of characters (i.e. singleton strings).
      This allows you to, e.g., map a function over each character.  However,
      note that this will likely be horribly inefficient; Nix is not a

lib/systems/platforms.nix

@@ -258,7 +258,6 @@ rec {
     name = "armeabi";
     gcc = {
       arch = "armv5te";
-      float = "soft";
       float-abi = "soft";
     };
   };
@@ -268,7 +267,6 @@ rec {
     name = "armeabi-v7a";
     gcc = {
       arch = "armv7-a";
-      float = "hard";
       float-abi = "softfp";
       fpu = "vfpv3-d16";
     };

nixos/modules/config/users-groups.nix

@@ -564,7 +564,10 @@ in {
       };
     }) (filterAttrs (_: u: u.packages != []) cfg.users));
 
-    environment.profiles = [ "/etc/profiles/per-user/$USER" ];
+    environment.profiles = [
+      "$HOME/.nix-profile"
+      "/etc/profiles/per-user/$USER"
+    ];
 
     assertions = [
       { assertion = !cfg.enforceIdUniqueness || (uidsAreUnique && gidsAreUnique);

nixos/modules/programs/browserpass.nix

@@ -4,15 +4,34 @@ with lib;
 
 {
 
-  ###### interface
-  options = {
-    programs.browserpass.enable = mkEnableOption "the NativeMessaging configuration for Chromium, Chrome, and Vivaldi.";
-  };
+  options.programs.browserpass.enable = mkEnableOption "Browserpass native messaging host";
 
-  ###### implementation
   config = mkIf config.programs.browserpass.enable {
-    environment.systemPackages = [ pkgs.browserpass ];
-    environment.etc = {
+    environment.etc = let
+      appId = "com.github.browserpass.native.json";
+      source = part: "${pkgs.browserpass}/lib/browserpass/${part}/${appId}";
+    in {
+      # chromium
+      "chromium/native-messaging-hosts/${appId}".source = source "hosts/chromium";
+      "chromium/policies/managed/${appId}".source = source "policies/chromium";
+
+      # chrome
+      "opt/chrome/native-messaging-hosts/${appId}".source = source "hosts/chromium";
+      "opt/chrome/policies/managed/${appId}".source = source "policies/chromium";
+
+      # vivaldi
+      "opt/vivaldi/native-messaging-hosts/${appId}".source = source "hosts/chromium";
+      "opt/vivaldi/policies/managed/${appId}".source = source "policies/chromium";
+
+      # brave
+      "opt/brave/native-messaging-hosts/${appId}".source = source "hosts/chromium";
+      "opt/brave/policies/managed/${appId}".source = source "policies/chromium";
+    }
+    # As with the v2 backwards compatibility in the pkgs.browserpass
+    # declaration, this part can be removed once the browser extension
+    # auto-updates to v3 (planned 2019-04-13, see
+    # https://github.com/browserpass/browserpass-native/issues/31)
+    // {
       "chromium/native-messaging-hosts/com.dannyvankooten.browserpass.json".source = "${pkgs.browserpass}/etc/chrome-host.json";
       "chromium/policies/managed/com.dannyvankooten.browserpass.json".source = "${pkgs.browserpass}/etc/chrome-policy.json";
       "opt/chrome/native-messaging-hosts/com.dannyvankooten.browserpass.json".source = "${pkgs.browserpass}/etc/chrome-host.json";

nixos/modules/programs/environment.nix

@@ -23,9 +23,8 @@ in
         XCURSOR_PATH = [ "$HOME/.icons" ];
       };
 
-    environment.profiles =
-      [ "$HOME/.nix-profile"
-        "/nix/var/nix/profiles/default"
+    environment.profiles = mkAfter
+      [ "/nix/var/nix/profiles/default"
         "/run/current-system/sw"
       ];
 

nixos/tests/gitea.nix

@@ -42,7 +42,7 @@ with pkgs.lib;
       {
         services.gitea.enable = true;
         services.gitea.database.type = "postgres";
-        services.gitea.database.password = "secret";
+        services.gitea.database.passwordFile = pkgs.writeText "db-password" "secret";
       };
 
     testScript = ''

pkgs/applications/editors/neovim/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, gettext, msgpack, libtermkey, libiconv
+{ stdenv, fetchFromGitHub, fetchpatch, cmake, gettext, msgpack, libtermkey, libiconv
 , libuv, luaPackages, ncurses, pkgconfig
 , unibilium, xsel, gperf
 , libvterm-neovim
@@ -20,6 +20,15 @@ let
       sha256 = "19jy9nr2ffscli6wsysqkdvqvh7sgkkwhzkw3yypfrvg4pj9rl56";
     };
 
+    patches = [
+      # Arbitrary code execution fix
+      # https://github.com/numirias/security/blob/cf4f74e0c6c6e4bbd6b59823aa1b85fa913e26eb/doc/2019-06-04_ace-vim-neovim.md
+      (fetchpatch {
+        url = "https://github.com/neovim/neovim/pull/10082.patch";
+        sha256 = "0g4knlpaabbq6acqgqm765b1knqv981nk2gf84fmknqnv4sgbsq2";
+      })
+    ];
+
     enableParallelBuilding = true;
 
     buildInputs = [

pkgs/applications/editors/vim/0001-source-command-doesnt-check-for-the-sandbox-5357552.patch

@@ -0,0 +1,31 @@
+From 53575521406739cf20bbe4e384d88e7dca11f040 Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Wed, 22 May 2019 22:38:25 +0200
+Subject: [PATCH] patch 8.1.1365: source command doesn't check for the sandbox
+
+Problem:    Source command doesn't check for the sandbox. (Armin Razmjou)
+Solution:   Check for the sandbox when sourcing a file.
+---
+ src/getchar.c               | 6 ++++++
+ src/testdir/test_source.vim | 9 +++++++++
+ src/version.c               | 2 ++
+ 3 files changed, 17 insertions(+)
+
+diff --git a/src/getchar.c b/src/getchar.c
+index 9379a6a8d4..debad7efd2 100644
+--- a/src/getchar.c
++++ b/src/getchar.c
+@@ -1407,6 +1407,12 @@ openscript(
+ 	emsg(_(e_nesting));
+ 	return;
+     }
++
++    // Disallow sourcing a file in the sandbox, the commands would be executed
++    // later, possibly outside of the sandbox.
++    if (check_secure())
++	return;
++
+ #ifdef FEAT_EVAL
+     if (ignore_script)
+ 	/* Not reading from script, also don't open one.  Warning message? */
+diff --git a/src/testdir/test_source.vim b/src/testdir/test_source.vim

pkgs/applications/editors/vim/common.nix

@@ -13,6 +13,12 @@ rec {
 
   hardeningDisable = [ "fortify" ];
 
+  patches = [
+    # Arbitrary code execution fix
+    # https://github.com/numirias/security/blob/cf4f74e0c6c6e4bbd6b59823aa1b85fa913e26eb/doc/2019-06-04_ace-vim-neovim.md
+    ./0001-source-command-doesnt-check-for-the-sandbox-5357552.patch
+  ];
+
   postPatch =
     # Use man from $PATH; escape sequences are still problematic.
     ''

pkgs/applications/editors/vim/configurable.nix

@@ -75,7 +75,9 @@ in stdenv.mkDerivation rec {
     "default" = common.src; # latest release
   };
 
-  patches = [ ./cflags-prune.diff ] ++ stdenv.lib.optional ftNixSupport ./ft-nix-support.patch;
+  patches = common.patches or []
+    ++ [ ./cflags-prune.diff ]
+    ++ stdenv.lib.optional ftNixSupport ./ft-nix-support.patch;
 
   configureFlags = [
     "--enable-gui=${guiSupport}"

pkgs/applications/editors/vim/default.nix

@@ -15,7 +15,7 @@ in
 stdenv.mkDerivation rec {
   name = "vim-${version}";
 
-  inherit (common) version src postPatch hardeningDisable enableParallelBuilding meta;
+  inherit (common) version src patches postPatch hardeningDisable enableParallelBuilding meta;
 
   nativeBuildInputs = [ gettext pkgconfig ];
   buildInputs = [ ncurses ]

pkgs/applications/misc/gollum/Gemfile.lock

@@ -29,17 +29,17 @@ GEM
       sanitize (~> 2.1.1, >= 2.1.1)
       stringex (~> 2.6)
       twitter-text (= 1.14.7)
-    json (2.1.0)
+    json (2.2.0)
     kramdown (1.9.0)
     mime-types (3.2.2)
       mime-types-data (~> 3.2015)
-    mime-types-data (3.2018.0812)
-    mini_portile2 (2.3.0)
+    mime-types-data (3.2019.0331)
+    mini_portile2 (2.4.0)
     mustache (0.99.8)
-    nokogiri (1.8.4)
-      mini_portile2 (~> 2.3.0)
+    nokogiri (1.10.2)
+      mini_portile2 (~> 2.4.0)
     posix-spawn (0.3.13)
-    rack (1.6.10)
+    rack (1.6.11)
     rack-protection (1.5.5)
       rack
     rouge (2.2.1)
@@ -49,8 +49,8 @@ GEM
       rack (~> 1.5)
       rack-protection (~> 1.4)
       tilt (>= 1.3, < 3)
-    stringex (2.8.4)
-    tilt (2.0.8)
+    stringex (2.8.5)
+    tilt (2.0.9)
     twitter-text (1.14.7)
       unf (~> 0.1.0)
     unf (0.1.4)
@@ -65,4 +65,4 @@ DEPENDENCIES
   gollum
 
 BUNDLED WITH
-   1.16.3
+   1.17.2

pkgs/applications/misc/gollum/gemset.nix

@@ -1,5 +1,7 @@
 {
   charlock_holmes = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1nf1l31n10yaark2rrg5qzyzcx9w80681449s3j09qmnipsl8rl5";
@@ -8,6 +10,8 @@
     version = "0.7.6";
   };
   diff-lcs = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "18w22bjz424gzafv6nzv98h0aqkwz3d9xhm7cbr1wfbyas8zayza";
@@ -17,6 +21,8 @@
   };
   gemojione = {
     dependencies = ["json"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0ayk8r147k1s38nj18pwk76npx1p7jhi86silk800nj913pjvrhj";
@@ -25,6 +31,8 @@
     version = "3.3.0";
   };
   github-markup = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "17g6g18gdjg63k75sfwiskjzl9i0hfcnrkcpb4fwrnb20v3jgswp";
@@ -34,6 +42,8 @@
   };
   gitlab-grit = {
     dependencies = ["charlock_holmes" "diff-lcs" "mime-types" "posix-spawn"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0xgs3l81ghlc5nm75n0pz7b2cj3hpscfq5iy27c483nnjn2v5mc4";
@@ -43,6 +53,8 @@
   };
   gollum = {
     dependencies = ["gemojione" "gollum-lib" "kramdown" "mustache" "sinatra" "useragent"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0ik1b0f73lcxfwfml1h84dp6br79g0z9v6x54wvl46n9d1ndrhl7";
@@ -52,6 +64,8 @@
   };
   gollum-grit_adapter = {
     dependencies = ["gitlab-grit"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0fcibm63v1afc0fj5rki0mm51m7nndil4cjcjjvkh3yigfn4nr4b";
@@ -61,6 +75,8 @@
   };
   gollum-lib = {
     dependencies = ["gemojione" "github-markup" "gollum-grit_adapter" "nokogiri" "rouge" "sanitize" "stringex" "twitter-text"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1699wiir6f2a8yawk3qg0xn3zdc10mz783v53ri1ivfnzdrm3dvf";
@@ -69,14 +85,18 @@
     version = "4.2.10";
   };
   json = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "01v6jjpvh3gnq6sgllpfqahlgxzj50ailwhj9b3cd20hi2dx0vxp";
+      sha256 = "0sx97bm9by389rbzv8r1f43h06xcz8vwi3h5jv074gvparql7lcx";
       type = "gem";
     };
-    version = "2.1.0";
+    version = "2.2.0";
   };
   kramdown = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "12sral2xli39mnr4b9m2sxdlgam4ni0a1mkxawc5311z107zj3p0";
@@ -86,6 +106,8 @@
   };
   mime-types = {
     dependencies = ["mime-types-data"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0fjxy1jm52ixpnv3vg9ld9pr9f35gy0jp66i1njhqjvmnvq0iwwk";
@@ -94,22 +116,28 @@
     version = "3.2.2";
   };
   mime-types-data = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "07wvp0aw2gjm4njibb70as6rh5hi1zzri5vky1q6jx95h8l56idc";
+      sha256 = "1m00pg19cm47n1qlcxgl91ajh2yq0fszvn1vy8fy0s1jkrp9fw4a";
       type = "gem";
     };
-    version = "3.2018.0812";
+    version = "3.2019.0331";
   };
   mini_portile2 = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "13d32jjadpjj6d2wdhkfpsmy68zjx90p49bgf8f7nkpz86r1fr11";
+      sha256 = "15zplpfw3knqifj9bpf604rb3wc1vhq6363pd6lvhayng8wql5vy";
       type = "gem";
     };
-    version = "2.3.0";
+    version = "2.4.0";
   };
   mustache = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1g5hplm0k06vwxwqzwn1mq5bd02yp0h3rym4zwzw26aqi7drcsl2";
@@ -119,14 +147,18 @@
   };
   nokogiri = {
     dependencies = ["mini_portile2"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1h9nml9h3m0mpvmh8jfnqvblnz5n5y3mmhgfc38avfmfzdrq9bgc";
+      sha256 = "0sy96cc8i5y4p67fhf4d9c6sg8ymrrva21zyvzw55l0pa1582wx2";
       type = "gem";
     };
-    version = "1.8.4";
+    version = "1.10.2";
   };
   posix-spawn = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1pmxmpins57qrbr31bs3bm7gidhaacmrp4md6i962gvpq4gyfcjw";
@@ -135,15 +167,19 @@
     version = "0.3.13";
   };
   rack = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0in0amn0kwvzmi8h5zg6ijrx5wpsf8h96zrfmnk1kwh2ql4sxs2q";
+      sha256 = "1g9926ln2lw12lfxm4ylq1h6nl0rafl10za3xvjzc87qvnqic87f";
       type = "gem";
     };
-    version = "1.6.10";
+    version = "1.6.11";
   };
   rack-protection = {
     dependencies = ["rack"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0my0wlw4a5l3hs79jkx2xzv7djhajgf8d28k8ai1ddlnxxb0v7ss";
@@ -152,6 +188,8 @@
     version = "1.5.5";
   };
   rouge = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "02kpahk5nkc33yxnn75649kzxaz073wvazr2zyg491nndykgnvcs";
@@ -161,6 +199,8 @@
   };
   sanitize = {
     dependencies = ["nokogiri"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "12ip1d80r0dgc621qn7c32bk12xxgkkg3w6q21s1ckxivcd7r898";
@@ -170,6 +210,8 @@
   };
   sinatra = {
     dependencies = ["rack" "rack-protection" "tilt"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0byxzl7rx3ki0xd7aiv1x8mbah7hzd8f81l65nq8857kmgzj1jqq";
@@ -178,23 +220,29 @@
     version = "1.4.8";
   };
   stringex = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0c5dfrjzkskzfsdvwsviq4111rwwpbk9022nxwdidz014mky5vi1";
+      sha256 = "15ns7j5smw04w6w7bqd5mm2qcl7w9lhwykyb974i4isgg9yc23ys";
       type = "gem";
     };
-    version = "2.8.4";
+    version = "2.8.5";
   };
   tilt = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0020mrgdf11q23hm1ddd6fv691l51vi10af00f137ilcdb2ycfra";
+      sha256 = "0ca4k0clwf0rkvy7726x4nxpjxkpv67w043i39saxgldxd97zmwz";
       type = "gem";
     };
-    version = "2.0.8";
+    version = "2.0.9";
   };
   twitter-text = {
     dependencies = ["unf"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1732h7hy1k152w8wfvjsx7b79alk45i5imwd37ia4qcx8hfm3gvg";
@@ -204,6 +252,8 @@
   };
   unf = {
     dependencies = ["unf_ext"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0bh2cf73i2ffh4fcpdn9ir4mhq8zi50ik0zqa1braahzadx536a9";
@@ -212,6 +262,8 @@
     version = "0.1.4";
   };
   unf_ext = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "06p1i6qhy34bpb8q8ms88y6f2kz86azwm098yvcc0nyqk9y729j1";
@@ -220,6 +272,8 @@
     version = "0.0.7.5";
   };
   useragent = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1fv5kvq494swy0p17h9qya9r50w15xsi9zmvhzb8gh55kq6ki50p";

pkgs/applications/networking/browsers/chromium/plugins.nix

@@ -100,11 +100,11 @@ let
 
   flash = stdenv.mkDerivation rec {
     name = "flashplayer-ppapi-${version}";
-    version = "32.0.0.142";
+    version = "32.0.0.171";
 
     src = fetchzip {
       url = "https://fpdownload.adobe.com/pub/flashplayer/pdc/${version}/flash_player_ppapi_linux.x86_64.tar.gz";
-      sha256 = "1mifgrfcvz1mc5w9s0df498z2dma50yq3vqw3pz82wxynmk28gq9";
+      sha256 = "1rqf1kidpf2jqf20dw3hscrapdpm2j751742i6xnvj9mp66nczyg";
       stripRoot = false;
     };
 

pkgs/applications/networking/browsers/firefox/packages.nix

@@ -21,10 +21,10 @@ rec {
   firefox = common rec {
     pname = "firefox";
 
-    version = "66.0.1";
+    version = "66.0.3";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "3nh42a9s8hzs3823mddqdcrhjb2nrphaz9v94mmp4xx4vra18mhsyddszk6xg5mx33wamvlalicws6l9h1d4i4dnnpchh2l6ch8m9kc";
+      sha512 = "31pfzgys4dv4fskaasz47fviksjj9xp60r875q0i7z1n6kx25fzkpsg18a98fkqm3g8qmljccy93w68ysywnh1zzrv8djsaza7l0mz8";
     };
 
     patches = nixpkgsPatches ++ [

pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix

@@ -74,7 +74,7 @@ let
 in
 stdenv.mkDerivation rec {
   name = "flashplayer-${version}";
-  version = "32.0.0.142";
+  version = "32.0.0.171";
 
   src = fetchurl {
     url =
@@ -85,14 +85,14 @@ stdenv.mkDerivation rec {
     sha256 =
       if debug then
         if arch == "x86_64" then
-          "1g3c0hzpf6lwfvlh8h3fl1vwfxc909nkpvrymwlc3vi3zpqwv4r7"
+          "0dl2kxsn4wh3243qkwyq13ikbmz6ljg95a1v02cylz36kpfl51iv"
         else
-          "14pyhynmjb88n5r9ds7v59vsrlzxfkr8zqnzgf6bj0h0x9grzhdv"
+          "1v9imcyml55qlvp0cibi5r5kl0rcivzvmnqgw8ph3xjm1yrxw3fr"
       else
         if arch == "x86_64" then
-          "102ixxh2sq7bmasnifm9arvlqqvmmm4bazzdppib3pz2yh4yy7m2"
+          "1f3nl4qkws16q2yw940vvb0zmmwxks1blm4ida65hlda6f9zfq3h"
         else
-          "1hg03fb4xc7h7lbx57wn1xvkhq096aijaxkb4b60wna04p62bdim";
+          "0df9nbxyn4wl4ap333mgnnmy994xj7i5hz07sw83pszlz3pjkc0m";
   };
 
   nativeBuildInputs = [ unzip ];

pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix

@@ -50,7 +50,7 @@
 
 stdenv.mkDerivation rec {
   name = "flashplayer-standalone-${version}";
-  version = "32.0.0.142";
+  version = "32.0.0.171";
 
   src = fetchurl {
     url =
@@ -60,9 +60,9 @@ stdenv.mkDerivation rec {
         "https://fpdownload.macromedia.com/pub/flashplayer/updaters/32/flash_player_sa_linux.x86_64.tar.gz";
     sha256 =
       if debug then
-        "1vp1nfys9pjmh3fmyp95yymmyvwrbmwjsmjhl5rnpwv5a0xn9nc6"
+        "0z4fkqbq1s63lpzfkyxllwx2wpizbabr4zim1dn7n59ld75vjxq8"
       else
-        "05r1z87zpllyb2hvj0fbps39hvkx5jzsqafyg62am8qm9khzs2qh";
+        "0nvgcdmgvgbj6axrh0yzkk437bxwsaxl0mvfkcyyz1hxnq51dvvg";
   };
 
   nativeBuildInputs = [ unzip ];

pkgs/applications/networking/mailreaders/thunderbird/default.nix

@@ -24,11 +24,11 @@ let
   gcc = if stdenv.cc.isGNU then stdenv.cc.cc else stdenv.cc.cc.gcc;
 in stdenv.mkDerivation rec {
   name = "thunderbird-${version}";
-  version = "60.5.1";
+  version = "60.6.0";
 
   src = fetchurl {
     url = "mirror://mozilla/thunderbird/releases/${version}/source/thunderbird-${version}.source.tar.xz";
-    sha512 = "1y8r96rzp1rv6ycn98l2c1bpa26gszhbijhrwk6llw8aq33xhx9dpqpbgfsnrsbn4a5ff14h8m9g82snqysrzb7ldd2i5lbas0pryys";
+    sha512 = "2s8h6z3rkylrclng1cpmj5dvsbhqymrdwvjy3g2s8rq66xca13wkyswdhgh8671d0dw9bmminikk53d2xqg7lqvvd1rdsminwscln4z";
   };
 
   # from firefox, but without sound libraries

pkgs/applications/version-management/gitea/default.nix

@@ -6,14 +6,14 @@
 with stdenv.lib;
 
 buildGoPackage rec {
-  name = "gitea-${version}";
-  version = "1.6.4";
+  name = "gitea";
+  version = "1.7.6";
 
   src = fetchFromGitHub {
     owner = "go-gitea";
     repo = "gitea";
     rev = "v${version}";
-    sha256 = "09h8nbzsxm34rlfnvbsf4cs02igids806927xpxf7g563cdapcnl";
+    sha256 = "155lnp98dx80aqds91kw2kf6lss6jzk5nljaqmmzsvn701fh922q";
     # Required to generate the same checksum on MacOS due to unicode encoding differences
     # More information: https://github.com/NixOS/nixpkgs/pull/48128
     extraPostFetch = ''

pkgs/applications/version-management/gitlab/data.json

@@ -1,32 +1,32 @@
 {
   "ce": {
-    "version": "11.9.1",
-    "repo_hash": "11dx931n79ynw8j6vbjsb832dkkp2s4vzji53km4ib9njn5nja0l",
-    "deb_hash": "133qjxmrn2rl9avi0nwcdbky53vgxbzp4g3vcgwg21xyfr8k8s4n",
-    "deb_url": "https://packages.gitlab.com/gitlab/gitlab-ce/packages/debian/stretch/gitlab-ce_11.9.1-ce.0_amd64.deb/download.deb",
+    "version": "11.9.8",
+    "repo_hash": "10xlabp7ziw1vpyy9dvhaiwf5l340d3yzvlh2aq6ly3xlqr5ip07",
+    "deb_hash": "0apw0w5grhpfxwl76w7as5xb6injr7ka8wwk2azllamrxrnn30dv",
+    "deb_url": "https://packages.gitlab.com/gitlab/gitlab-ce/packages/debian/stretch/gitlab-ce_11.9.8-ce.0_amd64.deb/download.deb",
     "owner": "gitlab-org",
     "repo": "gitlab-ce",
-    "rev": "v11.9.1",
+    "rev": "v11.9.8",
     "passthru": {
       "GITALY_SERVER_VERSION": "1.27.1",
       "GITLAB_PAGES_VERSION": "1.5.0",
       "GITLAB_SHELL_VERSION": "8.7.1",
-      "GITLAB_WORKHORSE_VERSION": "8.3.1"
+      "GITLAB_WORKHORSE_VERSION": "8.3.3"
     }
   },
   "ee": {
-    "version": "11.9.1",
-    "repo_hash": "13d6vg505rifgxpks9b7x2zq65b41naj7znkzm5i1kdvklfygqpd",
-    "deb_hash": "1z5i04cxwgcmx55yzhpw0ss1rwaqz1jl6hwpgbyly6prrbl5h59x",
-    "deb_url": "https://packages.gitlab.com/gitlab/gitlab-ee/packages/debian/stretch/gitlab-ee_11.9.1-ee.0_amd64.deb/download.deb",
+    "version": "11.9.8",
+    "repo_hash": "0h6lpaiwsvyn5cdga08zbgr6cwp3k6xi5jpb7n37hc6y4c7b36ry",
+    "deb_hash": "1bsy8qrr2sjvavzv4nslx14x4cx5xjx55d2v7zz6fvjzmgb98hgv",
+    "deb_url": "https://packages.gitlab.com/gitlab/gitlab-ee/packages/debian/stretch/gitlab-ee_11.9.8-ee.0_amd64.deb/download.deb",
     "owner": "gitlab-org",
     "repo": "gitlab-ee",
-    "rev": "v11.9.1-ee",
+    "rev": "v11.9.8-ee",
     "passthru": {
       "GITALY_SERVER_VERSION": "1.27.1",
       "GITLAB_PAGES_VERSION": "1.5.0",
       "GITLAB_SHELL_VERSION": "8.7.1",
-      "GITLAB_WORKHORSE_VERSION": "8.3.1"
+      "GITLAB_WORKHORSE_VERSION": "8.3.3"
     }
   }
 }

pkgs/applications/version-management/gitlab/gitaly/default.nix

@@ -27,7 +27,14 @@ in buildGoPackage rec {
 
   postInstall = ''
     mkdir -p $ruby
-    cp -rv $src/ruby/{bin,lib} $ruby
+    cp -rv $src/ruby/{bin,lib,git-hooks,vendor} $ruby
+
+    # gitlab-shell will try to read its config relative to the source
+    # code by default which doesn't work in nixos because it's a
+    # read-only filesystem
+    substituteInPlace $ruby/vendor/gitlab-shell/lib/gitlab_config.rb --replace \
+       "File.join(ROOT_PATH, 'config.yml')" \
+       "'/run/gitlab/shell-config.yml'"
   '';
 
   outputs = [ "bin" "out" "ruby" ];

pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix

@@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
   name = "gitlab-workhorse-${version}";
 
-  version = "8.3.1";
+  version = "8.3.3";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-workhorse";
     rev = "v${version}";
-    sha256 = "14zmxajzx6r2wrsxkmqp7j94yxnq4qpg27wih5l8lhf1imzgnk3j";
+    sha256 = "08v5ga9qbrs1xciw4cjhsjpqcp6cxzymc2y39la2a4lgb2cgyi10";
   };
 
   buildInputs = [ git go ];

pkgs/applications/version-management/gitlab/rubyEnv-ce/Gemfile

@@ -204,6 +204,9 @@ gem 'connection_pool', '~> 2.0'
 # Discord integration
 gem 'discordrb-webhooks-blackst0ne', '~> 3.3', require: false
 
+# HipChat integration
+gem 'hipchat', '~> 1.5.0'
+
 # JIRA integration
 gem 'jira-ruby', '~> 1.4'
 

pkgs/applications/version-management/gitlab/rubyEnv-ce/Gemfile.lock

@@ -364,6 +364,9 @@ GEM
       hashie (>= 3.0)
     health_check (2.6.0)
       rails (>= 4.0)
+    hipchat (1.5.2)
+      httparty
+      mimemagic
     html-pipeline (2.8.4)
       activesupport (>= 2)
       nokogiri (>= 1.4)
@@ -1041,6 +1044,7 @@ DEPENDENCIES
   hangouts-chat (~> 0.0.5)
   hashie-forbidden_attributes
   health_check (~> 2.6.0)
+  hipchat (~> 1.5.0)
   html-pipeline (~> 2.8)
   html2text
   httparty (~> 0.13.3)

pkgs/applications/version-management/gitlab/rubyEnv-ce/gemset.nix

@@ -1354,6 +1354,17 @@
     };
     version = "2.6.0";
   };
+  hipchat = {
+    dependencies = ["httparty" "mimemagic"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0hgy5jav479vbzzk53lazhpjj094dcsqw6w1d6zjn52p72bwq60k";
+      type = "gem";
+    };
+    version = "1.5.2";
+  };
   html-pipeline = {
     dependencies = ["activesupport" "nokogiri"];
     source = {

pkgs/applications/version-management/gitlab/rubyEnv-ee/Gemfile

@@ -214,6 +214,9 @@ gem 'connection_pool', '~> 2.0'
 # Discord integration
 gem 'discordrb-webhooks-blackst0ne', '~> 3.3', require: false
 
+# HipChat integration
+gem 'hipchat', '~> 1.5.0'
+
 # JIRA integration
 gem 'jira-ruby', '~> 1.4'
 

pkgs/applications/version-management/gitlab/rubyEnv-ee/Gemfile.lock

@@ -391,6 +391,9 @@ GEM
       hashie (>= 3.0)
     health_check (2.6.0)
       rails (>= 4.0)
+    hipchat (1.5.2)
+      httparty
+      mimemagic
     html-pipeline (2.8.4)
       activesupport (>= 2)
       nokogiri (>= 1.4)
@@ -1078,6 +1081,7 @@ DEPENDENCIES
   hangouts-chat (~> 0.0.5)
   hashie-forbidden_attributes
   health_check (~> 2.6.0)
+  hipchat (~> 1.5.0)
   html-pipeline (~> 2.8)
   html2text
   httparty (~> 0.13.3)

pkgs/applications/version-management/gitlab/rubyEnv-ee/gemset.nix

@@ -1459,6 +1459,17 @@
     };
     version = "2.6.0";
   };
+  hipchat = {
+    dependencies = ["httparty" "mimemagic"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0hgy5jav479vbzzk53lazhpjj094dcsqw6w1d6zjn52p72bwq60k";
+      type = "gem";
+    };
+    version = "1.5.2";
+  };
   html-pipeline = {
     dependencies = ["activesupport" "nokogiri"];
     source = {

pkgs/applications/version-management/redmine/Gemfile

@@ -2,7 +2,7 @@ source 'https://rubygems.org'
 
 gem "bundler", ">= 1.5.0", "< 2.0.0"
 
-gem "rails", "4.2.11"
+gem "rails", "4.2.11.1"
 gem "addressable", "2.4.0" if RUBY_VERSION < "2.0"
 if RUBY_VERSION < "2.1"
   gem "public_suffix", (RUBY_VERSION < "2.0" ? "~> 1.4" : "~> 2.0.5")

pkgs/applications/version-management/redmine/Gemfile.lock

@@ -1,38 +1,38 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    actionmailer (4.2.11)
-      actionpack (= 4.2.11)
-      actionview (= 4.2.11)
-      activejob (= 4.2.11)
+    actionmailer (4.2.11.1)
+      actionpack (= 4.2.11.1)
+      actionview (= 4.2.11.1)
+      activejob (= 4.2.11.1)
       mail (~> 2.5, >= 2.5.4)
       rails-dom-testing (~> 1.0, >= 1.0.5)
-    actionpack (4.2.11)
-      actionview (= 4.2.11)
-      activesupport (= 4.2.11)
+    actionpack (4.2.11.1)
+      actionview (= 4.2.11.1)
+      activesupport (= 4.2.11.1)
       rack (~> 1.6)
       rack-test (~> 0.6.2)
       rails-dom-testing (~> 1.0, >= 1.0.5)
       rails-html-sanitizer (~> 1.0, >= 1.0.2)
     actionpack-xml_parser (1.0.2)
       actionpack (>= 4.0.0, < 5)
-    actionview (4.2.11)
-      activesupport (= 4.2.11)
+    actionview (4.2.11.1)
+      activesupport (= 4.2.11.1)
       builder (~> 3.1)
       erubis (~> 2.7.0)
       rails-dom-testing (~> 1.0, >= 1.0.5)
       rails-html-sanitizer (~> 1.0, >= 1.0.3)
-    activejob (4.2.11)
-      activesupport (= 4.2.11)
+    activejob (4.2.11.1)
+      activesupport (= 4.2.11.1)
       globalid (>= 0.3.0)
-    activemodel (4.2.11)
-      activesupport (= 4.2.11)
+    activemodel (4.2.11.1)
+      activesupport (= 4.2.11.1)
       builder (~> 3.1)
-    activerecord (4.2.11)
-      activemodel (= 4.2.11)
-      activesupport (= 4.2.11)
+    activerecord (4.2.11.1)
+      activemodel (= 4.2.11.1)
+      activesupport (= 4.2.11.1)
       arel (~> 6.0)
-    activesupport (4.2.11)
+    activesupport (4.2.11.1)
       i18n (~> 0.7)
       minitest (~> 5.1)
       thread_safe (~> 0.3, >= 0.3.4)
@@ -51,7 +51,7 @@ GEM
     childprocess (0.9.0)
       ffi (~> 1.0, >= 1.0.11)
     coderay (1.1.2)
-    concurrent-ruby (1.1.4)
+    concurrent-ruby (1.1.5)
     crass (1.0.4)
     css_parser (1.7.0)
       addressable
@@ -73,7 +73,7 @@ GEM
     metaclass (0.0.4)
     mime-types (3.2.2)
       mime-types-data (~> 3.2015)
-    mime-types-data (3.2018.0812)
+    mime-types-data (3.2019.0331)
     mimemagic (0.3.3)
     mini_mime (1.0.1)
     mini_portile2 (2.3.0)
@@ -95,16 +95,16 @@ GEM
       ruby-openid (>= 2.1.8)
     rack-test (0.6.3)
       rack (>= 1.0)
-    rails (4.2.11)
-      actionmailer (= 4.2.11)
-      actionpack (= 4.2.11)
-      actionview (= 4.2.11)
-      activejob (= 4.2.11)
-      activemodel (= 4.2.11)
-      activerecord (= 4.2.11)
-      activesupport (= 4.2.11)
+    rails (4.2.11.1)
+      actionmailer (= 4.2.11.1)
+      actionpack (= 4.2.11.1)
+      actionview (= 4.2.11.1)
+      activejob (= 4.2.11.1)
+      activemodel (= 4.2.11.1)
+      activerecord (= 4.2.11.1)
+      activesupport (= 4.2.11.1)
       bundler (>= 1.3.0, < 2.0)
-      railties (= 4.2.11)
+      railties (= 4.2.11.1)
       sprockets-rails
     rails-deprecated_sanitizer (1.0.3)
       activesupport (>= 4.2.0.alpha)
@@ -114,9 +114,9 @@ GEM
       rails-deprecated_sanitizer (>= 1.0.1)
     rails-html-sanitizer (1.0.4)
       loofah (~> 2.2, >= 2.2.2)
-    railties (4.2.11)
-      actionpack (= 4.2.11)
-      activesupport (= 4.2.11)
+    railties (4.2.11.1)
+      actionpack (= 4.2.11.1)
+      activesupport (= 4.2.11.1)
       rake (>= 0.8.7)
       thor (>= 0.18.1, < 2.0)
     rake (12.3.2)
@@ -161,7 +161,7 @@ GEM
     websocket (1.2.8)
     xpath (3.2.0)
       nokogiri (~> 1.8)
-    yard (0.9.18)
+    yard (0.9.19)
 
 PLATFORMS
   ruby
@@ -184,7 +184,7 @@ DEPENDENCIES
   pg (~> 0.18.1)
   protected_attributes
   rack-openid
-  rails (= 4.2.11)
+  rails (= 4.2.11.1)
   rails-dom-testing
   rails-html-sanitizer (>= 1.0.3)
   rbpdf (~> 1.19.6)

pkgs/applications/version-management/redmine/default.nix

@@ -1,7 +1,7 @@
 { stdenv, fetchurl, bundlerEnv, ruby }:
 
 let
-  version = "3.4.9";
+  version = "3.4.10";
   rubyEnv = bundlerEnv {
     name = "redmine-env-${version}";
 
@@ -15,7 +15,7 @@ in
 
     src = fetchurl {
       url = "https://www.redmine.org/releases/${name}.tar.gz";
-      sha256 = "1f7sgyka21cjkvmdqkkwrx1hn0b38yq4b7283vw858fccp0l2vy2";
+      sha256 = "08clfg7wgp4wnajawdn7qgrv7r8lk8d8haqkl7iz77ygdi3mpyrh";
     };
 
     buildInputs = [ rubyEnv rubyEnv.wrappedRuby rubyEnv.bundler ];

pkgs/applications/version-management/redmine/gemset.nix

@@ -3,19 +3,19 @@
     dependencies = ["actionpack" "actionview" "activejob" "mail" "rails-dom-testing"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0zkklsh7ymhvdm5p9fr5ycd39d5caassag8yq0dga9cbk7fps74m";
+      sha256 = "18wwlj4f7jffv3vxm80d2z36nwza95l5xfcqc401hvvrls4xzhsy";
       type = "gem";
     };
-    version = "4.2.11";
+    version = "4.2.11.1";
   };
   actionpack = {
     dependencies = ["actionview" "activesupport" "rack" "rack-test" "rails-dom-testing" "rails-html-sanitizer"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "13xkil3y7gjj0m4ky14asi4m08x69wwv63wfn0h95wli4x8h8w7r";
+      sha256 = "0rmldsk3a4lwxk0lrp6x1nz1v1r2xmbm3300l4ghgfygv3grdwjh";
       type = "gem";
     };
-    version = "4.2.11";
+    version = "4.2.11.1";
   };
   actionpack-xml_parser = {
     dependencies = ["actionpack"];
@@ -30,46 +30,46 @@
     dependencies = ["activesupport" "builder" "erubis" "rails-dom-testing" "rails-html-sanitizer"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "09vwq0xgxxhssxxh8fa7l2pv6a56smw3v6gvb9l1mycmf8vprd4b";
+      sha256 = "0x7vjn8q6blzyf7j3kwg0ciy7vnfh28bjdkd1mp9k4ghp9jn0g9p";
       type = "gem";
     };
-    version = "4.2.11";
+    version = "4.2.11.1";
   };
   activejob = {
     dependencies = ["activesupport" "globalid"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "12yqs22f4lz20nw6djsrkhii3p3nfpd51nw0lhvnczx0q8kl0nyk";
+      sha256 = "0jy1c1r6syjqpa0sh9f1p4iaxzvp6qg4n6zs774j9z27q7h407mj";
       type = "gem";
     };
-    version = "4.2.11";
+    version = "4.2.11.1";
   };
   activemodel = {
     dependencies = ["activesupport" "builder"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "11aqvabf5c1pgb404f5bqp1i7mxkyhzmwk6y8zm5w6rf4nq095mq";
+      sha256 = "1c1x0rd6wnk1f0gsmxs6x3gx7yf6fs9qqkdv7r4hlbcdd849in33";
       type = "gem";
     };
-    version = "4.2.11";
+    version = "4.2.11.1";
   };
   activerecord = {
     dependencies = ["activemodel" "activesupport" "arel"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1sw0m19cnasbr4cabvc302hjddc3s6fja3fr0gbj9h2n8b3633i5";
+      sha256 = "07ixiwi0zzs9skqarvpfamsnay7npfswymrn28ngxaf8hi279q5p";
       type = "gem";
     };
-    version = "4.2.11";
+    version = "4.2.11.1";
   };
   activesupport = {
     dependencies = ["i18n" "minitest" "thread_safe" "tzinfo"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0pqr25wmhvvlg8av7bi5p5c7r5464clhhhhv45j63bh7xw4ad6n4";
+      sha256 = "1vbq7a805bfvyik2q3kl9s3r418f5qzvysqbz2cwy4hr7m2q4ir6";
       type = "gem";
     };
-    version = "4.2.11";
+    version = "4.2.11.1";
   };
   addressable = {
     dependencies = ["public_suffix"];
@@ -125,10 +125,10 @@
   concurrent-ruby = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ixcx9pfissxrga53jbdpza85qd5f6b5nq1sfqa9rnfq82qnlbp1";
+      sha256 = "1x07r23s7836cpp5z9yrlbpljcxpax14yw4fy4bnp6crhr6x24an";
       type = "gem";
     };
-    version = "1.1.4";
+    version = "1.1.5";
   };
   crass = {
     source = {
@@ -243,10 +243,10 @@
   mime-types-data = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "07wvp0aw2gjm4njibb70as6rh5hi1zzri5vky1q6jx95h8l56idc";
+      sha256 = "1m00pg19cm47n1qlcxgl91ajh2yq0fszvn1vy8fy0s1jkrp9fw4a";
       type = "gem";
     };
-    version = "3.2018.0812";
+    version = "3.2019.0331";
   };
   mimemagic = {
     source = {
@@ -377,10 +377,10 @@
     dependencies = ["actionmailer" "actionpack" "actionview" "activejob" "activemodel" "activerecord" "activesupport" "railties" "sprockets-rails"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0rhp1l5klw8alqnzji2p4w01x7ygsfnzc7mf87ncr2jlizmgy4nx";
+      sha256 = "1ywvis59dd3v8qapi9ix6743zgk07l21x1cd6nb1ddpahxhm7dml";
       type = "gem";
     };
-    version = "4.2.11";
+    version = "4.2.11.1";
   };
   rails-deprecated_sanitizer = {
     dependencies = ["activesupport"];
@@ -413,10 +413,10 @@
     dependencies = ["actionpack" "activesupport" "rake" "thor"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "09x32zkxs0vfi4y0bjrqd61821kx2azwhdxvk2ygqj4yvxfh11i1";
+      sha256 = "1bjf21z9maiiazc1if56nnh9xmgbkcqlpznv34f40a1hsvgk1d1m";
       type = "gem";
     };
-    version = "4.2.11";
+    version = "4.2.11.1";
   };
   rake = {
     source = {
@@ -607,9 +607,9 @@
   yard = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "07fykkfyrwqkfnxx9i5w6adyiadz00h497c516n96rgvs7alc74f";
+      sha256 = "1w0i13a0vsw4jmlj59xn64rdsqcsl9r3rmjjgdca5i51m1q4ix6v";
       type = "gem";
     };
-    version = "0.9.18";
+    version = "0.9.19";
   };
 }

pkgs/applications/version-management/subversion/default.nix

@@ -121,14 +121,14 @@ in {
   };
 
   subversion_1_10 = common {
-    version = "1.10.2";
-    sha256 = "127dysfc31q4dhbbxaznh9kqixy9jd44kgwji2gdwj6rb2lf6dav";
+    version = "1.10.4";
+    sha256 = "18c1vdq32nil76w678lxmp73jsbqha3dmzgmfrj76nc0xjmywql2";
     extraBuildInputs = [ lz4 utf8proc ];
   };
 
   subversion_1_11 = common {
-    version = "1.11.0";
-    sha256 = "0miyz3xsxxp56iczxv6yqd8p06av3vxpb5nasyg2xb3ln1247i47";
+    version = "1.11.1";
+    sha256 = "1fv0psjxx5nxb4zmddyrma2bnv1bfff4p8ii6j8fqwjdr982gzcy";
     extraBuildInputs = [ lz4 utf8proc ];
   };
 }

pkgs/applications/virtualization/containerd/default.nix

@@ -5,13 +5,13 @@ with lib;
 
 stdenv.mkDerivation rec {
   name = "containerd-${version}";
-  version = "1.1.2";
+  version = "1.1.7";
 
   src = fetchFromGitHub {
     owner = "containerd";
     repo = "containerd";
     rev = "v${version}";
-    sha256 = "1rp015cm5fw9kfarcmfhfkr1sh0iz7kvqls6f8nfhwrrz5armd5v";
+    sha256 = "1qnfsp7wyrnz3q5bqfl0s34r85gki3j6w4x0ny3vpvhs30cz97yg";
   };
 
   hardeningDisable = [ "fortify" ];

pkgs/applications/virtualization/qemu/default.nix

@@ -73,6 +73,11 @@ stdenv.mkDerivation rec {
   patches = [
     ./no-etc-install.patch
     ./fix-qemu-ga.patch
+    (fetchpatch {
+      name = "CVE-2019-3812.patch";
+      url = "https://git.qemu.org/?p=qemu.git;a=patch;h=b05b267840515730dbf6753495d5b7bd8b04ad1c";
+      sha256 = "03a5vc5wvirbyi5r8kb2r4m2w6f1zmh9bqsr2psh4pblwar0nf55";
+    })
   ] ++ optional nixosTestRunner ./force-uid0-on-9p.patch
     ++ optional pulseSupport ./fix-hda-recording.patch
     ++ optionals stdenv.hostPlatform.isMusl [

pkgs/development/compilers/go/1.11.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, tzdata, iana-etc, go_bootstrap, runCommand, writeScriptBin
+{ stdenv, fetchurl, tzdata, iana-etc, go_bootstrap, runCommand, writeScriptBin
 , perl, which, pkgconfig, patch, procps
 , pcre, cacert, llvm
 , Security, Foundation
@@ -25,13 +25,11 @@ in
 
 stdenv.mkDerivation rec {
   name = "go-${version}";
-  version = "1.11.5";
+  version = "1.11.6";
 
-  src = fetchFromGitHub {
-    owner = "golang";
-    repo = "go";
-    rev = "go${version}";
-    sha256 = "0d45057rc0bngq0nja847cagxji42qmlywr68f0dkg51im8nyr9y";
+  src = fetchurl {
+    url = "https://dl.google.com/go/go${version}.src.tar.gz";
+    sha256 = "0cz1sdhxf9283p1p4jxb020pym0ncd0qlfh36r3hkv6bbm1a2vd9";
   };
 
   GOCACHE = "off";
@@ -117,7 +115,7 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./remove-tools-1.11.patch
-    ./ssl-cert-file-1.9.patch
+    ./ssl-cert-file-1.12.1.patch
     ./remove-test-pie.patch
     ./creds-test.patch
     ./go-1.9-skip-flaky-19608.patch

pkgs/development/compilers/go/ssl-cert-file-1.12.1.patch

@@ -0,0 +1,59 @@
+diff -Naur a/src/crypto/x509/root_cgo_darwin.go b/src/crypto/x509/root_cgo_darwin.go
+--- a/src/crypto/x509/root_cgo_darwin.go	2019-03-15 11:33:55.920232337 -0700
++++ b/src/crypto/x509/root_cgo_darwin.go	2019-03-15 11:34:53.323180897 -0700
+@@ -270,11 +270,20 @@
+ import "C"
+ import (
+	"errors"
++	"io/ioutil"
++	"os"
+	"unsafe"
+ )
+
+ func loadSystemRoots() (*CertPool, error) {
+	roots := NewCertPool()
++	if file := os.Getenv("NIX_SSL_CERT_FILE"); file != "" {
++		data, err := ioutil.ReadFile(file)
++		if err == nil {
++			roots.AppendCertsFromPEM(data)
++			return roots, nil
++		}
++	}
+
+	var data C.CFDataRef = 0
+	var untrustedData C.CFDataRef = 0
+diff -Naur a/src/crypto/x509/root_darwin.go b/src/crypto/x509/root_darwin.go
+--- a/src/crypto/x509/root_darwin.go	2019-03-15 11:33:55.920232337 -0700
++++ b/src/crypto/x509/root_darwin.go	2019-03-15 11:36:21.205123541 -0700
+@@ -92,6 +92,14 @@
+		verifyCh    = make(chan rootCandidate)
+	)
+
++	if file := os.Getenv("NIX_SSL_CERT_FILE"); file != "" {
++		data, err := ioutil.ReadFile(file)
++		if err == nil {
++			roots.AppendCertsFromPEM(data)
++			return roots, nil
++		}
++	}
++
+	// Using 4 goroutines to pipe into verify-cert seems to be
+	// about the best we can do. The verify-cert binary seems to
+	// just RPC to another server with coarse locking anyway, so
+diff -Naur a/src/crypto/x509/root_unix.go b/src/crypto/x509/root_unix.go
+--- a/src/crypto/x509/root_unix.go	2019-03-15 11:33:55.920232337 -0700
++++ b/src/crypto/x509/root_unix.go	2019-03-15 11:37:15.737326340 -0700
+@@ -38,6 +38,13 @@
+
+ func loadSystemRoots() (*CertPool, error) {
+	roots := NewCertPool()
++	if file := os.Getenv("NIX_SSL_CERT_FILE"); file != "" {
++		data, err := ioutil.ReadFile(file)
++		if err == nil {
++			roots.AppendCertsFromPEM(data)
++			return roots, nil
++		}
++	}
+
+	files := certFiles
+	if f := os.Getenv(certFileEnv); f != "" {

pkgs/development/compilers/openjdk/8.nix

@@ -21,45 +21,45 @@ let
     else
       throw "openjdk requires i686-linux or x86_64 linux";
 
-  update = "202";
+  update = "212";
   build = "ga";
   baseurl = "http://hg.openjdk.java.net/jdk8u/jdk8u";
   repover = "jdk8u${update}-${build}";
   paxflags = if stdenv.isi686 then "msp" else "m";
   jdk8 = fetchurl {
              url = "${baseurl}/archive/${repover}.tar.gz";
-             sha256 = "0asx7qkhmrlfmhrljck5gb3yp4v0aa8k35y4xfcph41x0m0mvrdb";
+             sha256 = "00rl33h4cl4b4p3hcid765h38x2jdkb14ylh8k1zhnd0ka76crgg";
           };
   langtools = fetchurl {
              url = "${baseurl}/langtools/archive/${repover}.tar.gz";
-             sha256 = "07q6l3slmi5fgwjnsk6bd8miv8glmw15w5f6yyvp8nlp2d54l33n";
+             sha256 = "0va6g2dccf1ph6mpwxswbks5axp7zz258cl89qq9r8jn4ni04agw";
           };
   hotspot = fetchurl {
              url = "${baseurl}/hotspot/archive/${repover}.tar.gz";
-             sha256 = "01k4pwhn3nmkzdhdj1v58dgir4iwsj9mm2ml1541z31s53g037cq";
+             sha256 = "0sgr9df10hs49pjld6c6kr374v4zwd9s52pc3drz68zrlk71ja4s";
           };
   corba = fetchurl {
              url = "${baseurl}/corba/archive/${repover}.tar.gz";
-             sha256 = "0v39kl2iiyh74p3cp6bjhshkwxpgbffza9abzjgp7cpdfhcc73p0";
+             sha256 = "1hq0sr4k4k4iv815kg72i9lvd7n7mn5pmw96ckk9p1rnyagn9z03";
           };
   jdk = fetchurl {
              url = "${baseurl}/jdk/archive/${repover}.tar.gz";
-             sha256 = "0z1cy6aq09j25jyryj47rms15h5175p2h23fg5pv035zapf8nb1b";
+             sha256 = "1fc59jrbfq8l067mggzy5dnrvni7lwaqd7hahs4nqv87kyrfg545";
           };
   jaxws = fetchurl {
              url = "${baseurl}/jaxws/archive/${repover}.tar.gz";
-             sha256 = "0y0mk4sra9d29kgx842m5y4bz9gczc9ypkajv6m5igjv7sizzsv7";
+             sha256 = "1ka2fvyxdmpfhk814s314gx53yvdr19vpsqygx283v9nbq90l1yg";
           };
   jaxp = fetchurl {
              url = "${baseurl}/jaxp/archive/${repover}.tar.gz";
-             sha256 = "07ssrjhffkdncxxhsbid21hlg51y7js3x7sb4g474vmmi3qj6vmb";
+             sha256 = "15vlgs5v2ax8sqwh7bg50fnlrwlpnkp0myzrvpqs1mcza8pyasp8";
           };
   nashorn = fetchurl {
              url = "${baseurl}/nashorn/archive/${repover}.tar.gz";
-             sha256 = "0r0b8ra0ibzbdpxz6nv6i2zrzh2j5sxgprpnl6gf4d9h0i29ickj";
+             sha256 = "1jzn0yi0v6lda5y8ib07g1p6zymnbcx9yy6iz8niggpm7205y93h";
           };
   openjdk8 = stdenv.mkDerivation {
-    name = "openjdk-8u${update}b${build}";
+    name = "openjdk-8u${update}-${build}";
 
     srcs = [ jdk8 langtools hotspot corba jdk jaxws jaxp nashorn ];
     sourceRoot = ".";

pkgs/development/interpreters/php/default.nix

@@ -227,16 +227,16 @@ let
 
 in {
   php71 = generic {
-    version = "7.1.27";
-    sha256 = "0jzcyilvdy05w30vz5ln46lqm9hi36h5bibiwhl1b4a1179yrmys";
+    version = "7.1.30";
+    sha256 = "1czcf5qwk727sdzx5n4wvsxvl50jx6d5x8ws1dqx46fa9xvm0j36";
 
     # https://bugs.php.net/bug.php?id=76826
     extraPatches = optional stdenv.isDarwin ./php71-darwin-isfinite.patch;
   };
 
   php72 = generic {
-    version = "7.2.16";
-    sha256 = "0f3zkv803banqdrhj5ixfg973fnrsvn4hcij2k6r91nmac0d22ic";
+    version = "7.2.19";
+    sha256 = "16d0j0d4563bcrxlw5yysldscxpgyp917hmc4m4ys1zyfprv3l7b";
 
     # https://bugs.php.net/bug.php?id=76826
     extraPatches = optional stdenv.isDarwin ./php72-darwin-isfinite.patch;

pkgs/development/interpreters/ruby/default.nix

@@ -210,18 +210,18 @@ in {
   };
 
   ruby_2_4 = generic {
-    version = rubyVersion "2" "4" "5" "";
+    version = rubyVersion "2" "4" "9" "";
     sha256 = {
-      src = "162izk7c72y73vmdgcbsh8kqihrbm65xvp53r1s139pzwqd78dv7";
-      git = "181za4h6bd2bkyzyknxc18i5gq0pnqag60ybc17p0ixw3q7pdj43";
+      src = "1bn6n5b920qy3lsx99jr8495jkc3sg89swgb96d5fgd579g6p6zr";
+      git = "066kb1iki7mx7qkm10xhj5b6v8s47wg68v43l3nc36y2hyim1w2c";
     };
   };
 
   ruby_2_5 = generic {
-    version = rubyVersion "2" "5" "3" "";
+    version = rubyVersion "2" "5" "7" "";
     sha256 = {
-      src = "0v4442aqqlzxwc792kbkfs2k61qg97r680is6gx20z63a8wd0a4q";
-      git = "0r9mgvqk6gj8pc9q6qmy7j2kbln7drc8wy67sb2ij8ciclcw9nn2";
+      src = "1m6nmnj9shifp8g3yh7aimac01vl035bzcc19x2spdji6ig0sb8b";
+      git = "0wppf82c9ccdbnvj30mppr5a3mc7sxm05diahjdw7hhk29n43knp";
     };
   };
 }

pkgs/development/interpreters/ruby/patchsets.nix

@@ -6,12 +6,12 @@ rec {
     "${patchSet}/patches/ruby/2.3/head/railsexpress/02-improve-gc-stats.patch"
     "${patchSet}/patches/ruby/2.3/head/railsexpress/03-display-more-detailed-stack-trace.patch"
   ];
-  "2.4.5" = ops useRailsExpress [
+  "2.4.9" = ops useRailsExpress [
     "${patchSet}/patches/ruby/2.4/head/railsexpress/01-skip-broken-tests.patch"
     "${patchSet}/patches/ruby/2.4/head/railsexpress/02-improve-gc-stats.patch"
     "${patchSet}/patches/ruby/2.4/head/railsexpress/03-display-more-detailed-stack-trace.patch"
   ];
-  "2.5.3" = ops useRailsExpress [
+  "2.5.7" = ops useRailsExpress [
     "${patchSet}/patches/ruby/2.5/head/railsexpress/01-fix-broken-tests-caused-by-ad.patch"
     "${patchSet}/patches/ruby/2.5/head/railsexpress/02-improve-gc-stats.patch"
     "${patchSet}/patches/ruby/2.5/head/railsexpress/03-more-detailed-stacktrace.patch"

pkgs/development/libraries/arrow-cpp/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, symlinkJoin, fetchurl, boost, brotli, cmake, flatbuffers, gtest, gflags, lz4, python, rapidjson, snappy, zlib, zstd }:
+{ stdenv, symlinkJoin, fetchurl, fixDarwinDylibNames, boost, brotli, cmake, flatbuffers, gtest, gflags, lz4, python, rapidjson, snappy, zlib, zstd }:
 
 stdenv.mkDerivation rec {
   name = "arrow-cpp-${version}";
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
 
   sourceRoot = "apache-arrow-${version}/cpp";
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [ cmake ]
+    ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
   buildInputs = [ boost python.pkgs.python python.pkgs.numpy ];
 
   preConfigure = ''

pkgs/development/libraries/boost/darwin-1.55-no-system-python.patch

@@ -0,0 +1,45 @@
+diff --git a/tools/build/src/tools/python.jam b/tools/build/src/tools/python.jam
+index 273b28a..2d2031e 100644
+--- a/tools/build/v2/tools/python.jam
++++ b/tools/build/v2/tools/python.jam
+@@ -428,13 +428,7 @@ local rule windows-installed-pythons ( version ? )
+ 
+ local rule darwin-installed-pythons ( version ? )
+ {
+-    version ?= $(.version-countdown) ;
+-
+-    local prefix
+-      = [ GLOB /System/Library/Frameworks /Library/Frameworks
+-          : Python.framework ] ;
+-
+-    return $(prefix)/Versions/$(version)/bin/python ;
++    return ;
+ }
+ 
+ 
+@@ -890,25 +884,6 @@ local rule configure ( version ? : cmd-or-prefix ? : includes * : libraries ? :
+ 
+     # See if we can find a framework directory on darwin.
+     local framework-directory ;
+-    if $(target-os) = darwin
+-    {
+-        # Search upward for the framework directory.
+-        local framework-directory = $(libraries[-1]) ;
+-        while $(framework-directory:D=) && $(framework-directory:D=) != Python.framework
+-        {
+-            framework-directory = $(framework-directory:D) ;
+-        }
+-
+-        if $(framework-directory:D=) = Python.framework
+-        {
+-            debug-message framework directory is \"$(framework-directory)\" ;
+-        }
+-        else
+-        {
+-            debug-message "no framework directory found; using library path" ;
+-            framework-directory = ;
+-        }
+-    }
+ 
+     local dll-path = $(libraries) ;
+ 

pkgs/development/libraries/boost/generic.nix

@@ -103,7 +103,10 @@ stdenv.mkDerivation {
 
   patchFlags = optionalString (stdenv.hostPlatform.libc == "msvcrt") "-p0";
   patches = patches
-    ++ optional stdenv.isDarwin ./darwin-no-system-python.patch
+    ++ optional stdenv.isDarwin (
+      if version == "1.55.0"
+      then ./darwin-1.55-no-system-python.patch
+      else ./darwin-no-system-python.patch)
     ++ optional (stdenv.hostPlatform.libc == "msvcrt") (fetchurl {
       url = "https://svn.boost.org/trac/boost/raw-attachment/tickaet/7262/"
           + "boost-mingw.patch";

pkgs/development/libraries/ffmpeg-full/default.nix

@@ -96,7 +96,7 @@
 , libxcbshapeExtlib ? true # X11 grabbing shape rendering
 , libXv ? null # Xlib support
 , lzma ? null # xz-utils
-, nvenc ? false, nvidia-video-sdk ? null # NVIDIA NVENC support
+, nvenc ? false # NVIDIA NVENC support
 , callPackage # needed for NVENC to access external ffmpeg nvidia headers
 , openal ? null # OpenAL 1.1 capture support
 #, opencl ? null # OpenCL code
@@ -228,7 +228,6 @@ assert libxcbxfixesExtlib -> libxcb != null;
 assert libxcbshapeExtlib -> libxcb != null;
 assert openglExtlib -> libGLU_combined != null;
 assert opensslExtlib -> gnutls == null && openssl != null && nonfreeLicensing;
-assert nvenc -> nvidia-video-sdk != null && nonfreeLicensing;
 
 stdenv.mkDerivation rec {
   name = "ffmpeg-full-${version}";
@@ -417,7 +416,7 @@ stdenv.mkDerivation rec {
     ++ optionals nonfreeLicensing [ fdk_aac openssl ]
     ++ optional ((isLinux || isFreeBSD) && libva != null) libva
     ++ optionals isLinux [ alsaLib libraw1394 libv4l ]
-    ++ optionals nvenc [ nvidia-video-sdk nv-codec-headers ]
+    ++ optional nvenc nv-codec-headers
     ++ optionals stdenv.isDarwin [ Cocoa CoreServices CoreAudio AVFoundation
                                    MediaToolbox VideoDecodeAcceleration
                                    libiconv ];

pkgs/development/libraries/ffmpeg-full/nv-codec-headers.nix

@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "ffmpeg nvidia headers for NVENC";
     homepage = http://ffmpeg.org/;
-    license = stdenv.lib.licenses.gpl3Plus;
+    license = stdenv.lib.licenses.mit;
     maintainers = [ stdenv.lib.maintainers.MP2E ];
     platforms = stdenv.lib.platforms.all;
   };

pkgs/development/libraries/ffmpeg/2.8.nix

@@ -1,7 +1,7 @@
 { callPackage, ... } @ args:
 
 callPackage ./generic.nix (args // rec {
-  version = "${branch}.14";
+  version = "${branch}.15";
   branch = "2.8";
-  sha256 = "1g6x3lyjl1zlfksizj1ys61kj97yg0xf4dlr6sr5acpbja3a26yn";
+  sha256 = "08gf493a1ici1rn6gda6bxkcsk3fqbs6pdr0phcifjkd3xn7yr1m";
 })

pkgs/development/libraries/flatpak/default.nix

@@ -4,7 +4,7 @@
 , libsoup, lzma, ostree, polkit, python3, systemd, xorg, valgrind, glib-networking, makeWrapper, gnome3 }:
 
 let
-  version = "1.0.5";
+  version = "1.0.8";
   desktop_schemas = gnome3.gsettings-desktop-schemas;
 in stdenv.mkDerivation rec {
   name = "flatpak-${version}";
@@ -14,7 +14,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://github.com/flatpak/flatpak/releases/download/${version}/${name}.tar.xz";
-    sha256 = "1wj88lp23bzz0c5n1i84nr2xff572i5cc10fqd9xh7qhj3ivk1w0";
+    sha256 = "0g3cfhnn5wmsbg0jk5sjx8n41zl5nl72yi5nisqpb3if7fg426qv";
   };
 
   patches = [
@@ -30,6 +30,7 @@ in stdenv.mkDerivation rec {
     # patch taken from gtk_doc
     ./respect-xml-catalog-files-var.patch
     ./use-flatpak-from-path.patch
+    ./unset-env-vars.patch
   ];
 
   nativeBuildInputs = [

pkgs/development/libraries/flatpak/unset-env-vars.patch

@@ -0,0 +1,10 @@
+--- a/common/flatpak-run.c
++++ b/common/flatpak-run.c
+@@ -1192,6 +1192,7 @@ static const ExportData default_exports[] = {
+   {"PERLLIB", NULL},
+   {"PERL5LIB", NULL},
+   {"XCURSOR_PATH", NULL},
++  {"GDK_PIXBUF_MODULE_FILE", NULL},
+ };
+ 
+ static const ExportData no_ld_so_cache_exports[] = {

pkgs/development/libraries/gettext/CVE-2018-18751-bison.patch

@@ -1,323 +0,0 @@
-This patch was generated by re-running Bison 3.0.4 on pro-gram-gen.y after
-applying CVE-2018-18751.patch. This patch removes the need to add bison to
-nativeBuildInputs.
-
---- a/gettext-tools/src/po-gram-gen.c
-+++ b/gettext-tools/src/po-gram-gen.c
-@@ -568,9 +568,9 @@ static const yytype_uint8 yytranslate[] =
- static const yytype_uint16 yyrline[] =
- {
-        0,   169,   169,   171,   172,   173,   174,   179,   187,   195,
--     216,   240,   249,   258,   269,   278,   292,   301,   315,   321,
--     332,   338,   350,   361,   372,   376,   391,   414,   422,   434,
--     442
-+     216,   237,   246,   255,   266,   275,   289,   298,   312,   318,
-+     329,   335,   347,   358,   369,   373,   388,   411,   419,   431,
-+     439
- };
- #endif
-
-@@ -1419,14 +1419,11 @@ yyreduce:
-                   check_obsolete ((yyvsp[-3].message_intro), (yyvsp[-1].string));
-                   check_obsolete ((yyvsp[-3].message_intro), (yyvsp[0].rhs));
-                   if (!(yyvsp[-3].message_intro).obsolete || pass_obsolete_entries)
--                    {
--                      do_callback_message ((yyvsp[-3].message_intro).ctxt, string2, &(yyvsp[-3].message_intro).pos, (yyvsp[-1].string).string,
--                                           (yyvsp[0].rhs).rhs.msgstr, (yyvsp[0].rhs).rhs.msgstr_len, &(yyvsp[0].rhs).pos,
--                                           (yyvsp[-3].message_intro).prev_ctxt,
--                                           (yyvsp[-3].message_intro).prev_id, (yyvsp[-3].message_intro).prev_id_plural,
--                                           (yyvsp[-3].message_intro).obsolete);
--                      free ((yyvsp[-1].string).string);
--                    }
-+                    do_callback_message ((yyvsp[-3].message_intro).ctxt, string2, &(yyvsp[-3].message_intro).pos, (yyvsp[-1].string).string,
-+                                         (yyvsp[0].rhs).rhs.msgstr, (yyvsp[0].rhs).rhs.msgstr_len, &(yyvsp[0].rhs).pos,
-+                                         (yyvsp[-3].message_intro).prev_ctxt,
-+                                         (yyvsp[-3].message_intro).prev_id, (yyvsp[-3].message_intro).prev_id_plural,
-+                                         (yyvsp[-3].message_intro).obsolete);
-                   else
-                     {
-                       free_message_intro ((yyvsp[-3].message_intro));
-@@ -1435,11 +1432,11 @@ yyreduce:
-                       free ((yyvsp[0].rhs).rhs.msgstr);
-                     }
-                 }
--#line 1439 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1436 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 11:
--#line 241 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 238 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-2].message_intro), (yyvsp[-1].stringlist));
-                   check_obsolete ((yyvsp[-2].message_intro), (yyvsp[0].string));
-@@ -1448,11 +1445,11 @@ yyreduce:
-                   string_list_destroy (&(yyvsp[-1].stringlist).stringlist);
-                   free ((yyvsp[0].string).string);
-                 }
--#line 1452 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1449 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 12:
--#line 250 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 247 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-2].message_intro), (yyvsp[-1].stringlist));
-                   check_obsolete ((yyvsp[-2].message_intro), (yyvsp[0].rhs));
-@@ -1461,22 +1458,22 @@ yyreduce:
-                   string_list_destroy (&(yyvsp[-1].stringlist).stringlist);
-                   free ((yyvsp[0].rhs).rhs.msgstr);
-                 }
--#line 1465 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1462 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 13:
--#line 259 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 256 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-1].message_intro), (yyvsp[0].stringlist));
-                   po_gram_error_at_line (&(yyvsp[-1].message_intro).pos, _("missing 'msgstr' section"));
-                   free_message_intro ((yyvsp[-1].message_intro));
-                   string_list_destroy (&(yyvsp[0].stringlist).stringlist);
-                 }
--#line 1476 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1473 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 14:
--#line 270 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 267 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   (yyval.message_intro).prev_ctxt = NULL;
-                   (yyval.message_intro).prev_id = NULL;
-@@ -1485,11 +1482,11 @@ yyreduce:
-                   (yyval.message_intro).pos = (yyvsp[0].string).pos;
-                   (yyval.message_intro).obsolete = (yyvsp[0].string).obsolete;
-                 }
--#line 1489 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1486 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 15:
--#line 279 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 276 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-1].prev), (yyvsp[0].string));
-                   (yyval.message_intro).prev_ctxt = (yyvsp[-1].prev).ctxt;
-@@ -1499,11 +1496,11 @@ yyreduce:
-                   (yyval.message_intro).pos = (yyvsp[0].string).pos;
-                   (yyval.message_intro).obsolete = (yyvsp[0].string).obsolete;
-                 }
--#line 1503 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1500 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 16:
--#line 293 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 290 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-1].string), (yyvsp[0].stringlist));
-                   (yyval.prev).ctxt = (yyvsp[-1].string).string;
-@@ -1512,11 +1509,11 @@ yyreduce:
-                   (yyval.prev).pos = (yyvsp[-1].string).pos;
-                   (yyval.prev).obsolete = (yyvsp[-1].string).obsolete;
-                 }
--#line 1516 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1513 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 17:
--#line 302 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 299 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-2].string), (yyvsp[-1].stringlist));
-                   check_obsolete ((yyvsp[-2].string), (yyvsp[0].string));
-@@ -1526,21 +1523,21 @@ yyreduce:
-                   (yyval.prev).pos = (yyvsp[-2].string).pos;
-                   (yyval.prev).obsolete = (yyvsp[-2].string).obsolete;
-                 }
--#line 1530 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1527 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 18:
--#line 316 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 313 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   (yyval.string).string = NULL;
-                   (yyval.string).pos = (yyvsp[0].pos).pos;
-                   (yyval.string).obsolete = (yyvsp[0].pos).obsolete;
-                 }
--#line 1540 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1537 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 19:
--#line 322 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 319 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-2].pos), (yyvsp[-1].stringlist));
-                   check_obsolete ((yyvsp[-2].pos), (yyvsp[0].pos));
-@@ -1548,21 +1545,21 @@ yyreduce:
-                   (yyval.string).pos = (yyvsp[0].pos).pos;
-                   (yyval.string).obsolete = (yyvsp[0].pos).obsolete;
-                 }
--#line 1552 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1549 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 20:
--#line 333 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 330 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   (yyval.string).string = NULL;
-                   (yyval.string).pos = (yyvsp[0].pos).pos;
-                   (yyval.string).obsolete = (yyvsp[0].pos).obsolete;
-                 }
--#line 1562 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1559 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 21:
--#line 339 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 336 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-2].pos), (yyvsp[-1].stringlist));
-                   check_obsolete ((yyvsp[-2].pos), (yyvsp[0].pos));
-@@ -1570,11 +1567,11 @@ yyreduce:
-                   (yyval.string).pos = (yyvsp[0].pos).pos;
-                   (yyval.string).obsolete = (yyvsp[0].pos).obsolete;
-                 }
--#line 1574 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1571 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 22:
--#line 351 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 348 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-1].pos), (yyvsp[0].stringlist));
-                   plural_counter = 0;
-@@ -1582,30 +1579,30 @@ yyreduce:
-                   (yyval.string).pos = (yyvsp[-1].pos).pos;
-                   (yyval.string).obsolete = (yyvsp[-1].pos).obsolete;
-                 }
--#line 1586 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1583 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 23:
--#line 362 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 359 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-1].pos), (yyvsp[0].stringlist));
-                   (yyval.string).string = string_list_concat_destroy (&(yyvsp[0].stringlist).stringlist);
-                   (yyval.string).pos = (yyvsp[-1].pos).pos;
-                   (yyval.string).obsolete = (yyvsp[-1].pos).obsolete;
-                 }
--#line 1597 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1594 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 24:
--#line 373 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 370 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   (yyval.rhs) = (yyvsp[0].rhs);
-                 }
--#line 1605 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1602 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 25:
--#line 377 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 374 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-1].rhs), (yyvsp[0].rhs));
-                   (yyval.rhs).rhs.msgstr = XNMALLOC ((yyvsp[-1].rhs).rhs.msgstr_len + (yyvsp[0].rhs).rhs.msgstr_len, char);
-@@ -1617,11 +1614,11 @@ yyreduce:
-                   (yyval.rhs).pos = (yyvsp[-1].rhs).pos;
-                   (yyval.rhs).obsolete = (yyvsp[-1].rhs).obsolete;
-                 }
--#line 1621 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1618 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 26:
--#line 392 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 389 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-4].pos), (yyvsp[-3].pos));
-                   check_obsolete ((yyvsp[-4].pos), (yyvsp[-2].number));
-@@ -1640,11 +1637,11 @@ yyreduce:
-                   (yyval.rhs).pos = (yyvsp[-4].pos).pos;
-                   (yyval.rhs).obsolete = (yyvsp[-4].pos).obsolete;
-                 }
--#line 1644 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1641 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 27:
--#line 415 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 412 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   string_list_init (&(yyval.stringlist).stringlist);
-                   string_list_append (&(yyval.stringlist).stringlist, (yyvsp[0].string).string);
-@@ -1652,11 +1649,11 @@ yyreduce:
-                   (yyval.stringlist).pos = (yyvsp[0].string).pos;
-                   (yyval.stringlist).obsolete = (yyvsp[0].string).obsolete;
-                 }
--#line 1656 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1653 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 28:
--#line 423 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 420 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-1].stringlist), (yyvsp[0].string));
-                   (yyval.stringlist).stringlist = (yyvsp[-1].stringlist).stringlist;
-@@ -1665,11 +1662,11 @@ yyreduce:
-                   (yyval.stringlist).pos = (yyvsp[-1].stringlist).pos;
-                   (yyval.stringlist).obsolete = (yyvsp[-1].stringlist).obsolete;
-                 }
--#line 1669 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1666 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 29:
--#line 435 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 432 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   string_list_init (&(yyval.stringlist).stringlist);
-                   string_list_append (&(yyval.stringlist).stringlist, (yyvsp[0].string).string);
-@@ -1677,11 +1674,11 @@ yyreduce:
-                   (yyval.stringlist).pos = (yyvsp[0].string).pos;
-                   (yyval.stringlist).obsolete = (yyvsp[0].string).obsolete;
-                 }
--#line 1681 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1678 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 30:
--#line 443 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 440 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-1].stringlist), (yyvsp[0].string));
-                   (yyval.stringlist).stringlist = (yyvsp[-1].stringlist).stringlist;
-@@ -1690,11 +1687,11 @@ yyreduce:
-                   (yyval.stringlist).pos = (yyvsp[-1].stringlist).pos;
-                   (yyval.stringlist).obsolete = (yyvsp[-1].stringlist).obsolete;
-                 }
--#line 1694 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1691 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-
--#line 1698 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1695 "po-gram-gen.c" /* yacc.c:1646  */
-       default: break;
-     }
-   /* User semantic actions sometimes alter yychar, and that requires

pkgs/development/libraries/gettext/default.nix

@@ -1,6 +1,5 @@
-{ stdenv, lib, fetchurl, libiconv, xz, bison, automake115x, autoconf }:
+{ stdenv, lib, fetchurl, libiconv, xz }:
 
-let allowBisonDependency = !stdenv.isDarwin; in
 stdenv.mkDerivation rec {
   name = "gettext-${version}";
   version = "0.19.8.1";
@@ -9,17 +8,7 @@ stdenv.mkDerivation rec {
     url = "mirror://gnu/gettext/${name}.tar.gz";
     sha256 = "0hsw28f9q9xaggjlsdp2qmbp2rbd1mp0njzan2ld9kiqwkq2m57z";
   };
-  patches = [
-    ./absolute-paths.diff
-    (fetchurl {
-      name = "CVE-2018-18751.patch";
-      url = "https://git.savannah.gnu.org/gitweb/?p=gettext.git;a=patch;h=dce3a16e5e9368245735e29bf498dcd5e3e474a4";
-      sha256 = "1lpjwwcjr1sb879faj0xyzw02kma0ivab6xwn3qciy13qy6fq5xn";
-    })
-  ] ++ lib.optionals (!allowBisonDependency) [
-    # Only necessary for CVE-2018-18751.patch:
-    ./CVE-2018-18751-bison.patch
-  ];
+  patches = [ ./absolute-paths.diff ];
 
   outputs = [ "out" "man" "doc" "info" ];
 
@@ -51,18 +40,7 @@ stdenv.mkDerivation rec {
     sed -i -e "s/\(libgettextsrc_la_LDFLAGS = \)/\\1..\/gnulib-lib\/libxml_rpl.la /" gettext-tools/src/Makefile.in
   '';
 
-  nativeBuildInputs = [
-    xz
-    xz.bin
-  ]
-  # Only necessary for CVE-2018-18751.patch (unless CVE-2018-18751-bison.patch
-  # is also applied):
-  ++ lib.optional allowBisonDependency bison
-  ++ [
-    # Only necessary for CVE-2018-18751.patch:
-    automake115x
-    autoconf
-  ];
+  nativeBuildInputs = [ xz xz.bin ];
   # HACK, see #10874 (and 14664)
   buildInputs = stdenv.lib.optional (!stdenv.isLinux && !stdenv.hostPlatform.isCygwin) libiconv;
 

pkgs/development/libraries/leptonica/CVE-2018-3836.patch

@@ -0,0 +1,95 @@
+--- a/src/allheaders.h
++++ b/src/allheaders.h
+@@ -2600,6 +2600,7 @@
+ LEPT_DLL extern char * stringReverse ( const char *src );
+ LEPT_DLL extern char * strtokSafe ( char *cstr, const char *seps, char **psaveptr );
+ LEPT_DLL extern l_int32 stringSplitOnToken ( char *cstr, const char *seps, char **phead, char **ptail );
++LEPT_DLL extern l_int32 stringCheckForChars ( const char *src, const char *chars, l_int32 *pfound );
+ LEPT_DLL extern char * stringRemoveChars ( const char *src, const char *remchars );
+ LEPT_DLL extern l_int32 stringFindSubstr ( const char *src, const char *sub, l_int32 *ploc );
+ LEPT_DLL extern char * stringReplaceSubstr ( const char *src, const char *sub1, const char *sub2, l_int32 *pfound, l_int32 *ploc );
+--- a/src/gplot.c
++++ b/src/gplot.c
+@@ -141,9 +141,10 @@
+             const char  *xlabel,
+             const char  *ylabel)
+ {
+-char   *newroot;
+-char    buf[L_BUF_SIZE];
+-GPLOT  *gplot;
++char    *newroot;
++char     buf[L_BUF_SIZE];
++l_int32  badchar;
++GPLOT   *gplot;
+ 
+     PROCNAME("gplotCreate");
+ 
+@@ -152,6 +153,9 @@
+     if (outformat != GPLOT_PNG && outformat != GPLOT_PS &&
+         outformat != GPLOT_EPS && outformat != GPLOT_LATEX)
+         return (GPLOT *)ERROR_PTR("outformat invalid", procName, NULL);
++    stringCheckForChars(rootname, "`;&|><\"?*", &badchar);
++    if (badchar)  /* danger of command injection */
++        return (GPLOT *)ERROR_PTR("invalid rootname", procName, NULL);
+ 
+     if ((gplot = (GPLOT *)LEPT_CALLOC(1, sizeof(GPLOT))) == NULL)
+         return (GPLOT *)ERROR_PTR("gplot not made", procName, NULL);
+--- a/src/utils2.c
++++ b/src/utils2.c
+@@ -42,6 +42,7 @@
+  *           l_int32    stringSplitOnToken()
+  *
+  *       Find and replace string and array procs
++ *           l_int32    stringCheckForChars()
+  *           char      *stringRemoveChars()
+  *           l_int32    stringFindSubstr()
+  *           char      *stringReplaceSubstr()
+@@ -701,6 +702,48 @@
+ /*--------------------------------------------------------------------*
+  *                       Find and replace procs                       *
+  *--------------------------------------------------------------------*/
++/*!
++ * \brief   stringCheckForChars()
++ *
++ * \param[in]    src      input string; can be of zero length
++ * \param[in]    chars    string of chars to be searched for in %src
++ * \param[out]   pfound   1 if any characters are found; 0 otherwise
++ * \return  0 if OK, 1 on error
++ *
++ * <pre>
++ * Notes:
++ *      (1) This can be used to sanitize an operation by checking for
++ *          special characters that don't belong in a string.
++ * </pre>
++ */
++l_int32
++stringCheckForChars(const char  *src,
++                    const char  *chars,
++                    l_int32     *pfound)
++{
++char     ch;
++l_int32  i, n;
++
++    PROCNAME("stringCheckForChars");
++
++    if (!pfound)
++        return ERROR_INT("&found not defined", procName, 1);
++    *pfound = FALSE;
++    if (!src || !chars)
++        return ERROR_INT("src and chars not both defined", procName, 1);
++
++    n = strlen(src);
++    for (i = 0; i < n; i++) {
++        ch = src[i];
++        if (strchr(chars, ch)) {
++            *pfound = TRUE;
++            break;
++        }
++    }
++    return 0;
++}
++
++
+ /*!
+  * \brief   stringRemoveChars()
+  *

pkgs/development/libraries/leptonica/default.nix

@@ -1,5 +1,5 @@
 { stdenv, fetchurl, fetchpatch, autoreconfHook, pkgconfig
-, giflib, libjpeg, libpng, libtiff, libwebp, openjpeg, zlib
+, giflib, libjpeg, libpng, libtiff, libwebp, openjpeg, zlib, which, gnuplot
 }:
 
 stdenv.mkDerivation rec {
@@ -11,12 +11,34 @@ stdenv.mkDerivation rec {
     sha256 = "0qpcidvv6igybrrhj0m6j47g642c8sk1qn4dpj82mgd38xx52skl";
   };
 
-  patches = stdenv.lib.singleton (fetchpatch {
-    # configure: Support pkg-config
-    url = "https://github.com/DanBloomberg/leptonica/commit/"
-        + "4476d162cc191a0fefb2ce434153e12bbf188664.patch";
-    sha256 = "1razzp2g49shfaravfqpxm3ivcd1r92lvqysll6nnf6d1wp9865s";
-  });
+  patches = [
+    (fetchpatch {
+      # configure: Support pkg-config
+      url = "https://github.com/DanBloomberg/leptonica/commit/"
+          + "4476d162cc191a0fefb2ce434153e12bbf188664.patch";
+      sha256 = "1razzp2g49shfaravfqpxm3ivcd1r92lvqysll6nnf6d1wp9865s";
+    })
+    # stripped down copy of upstream commit b88c821f8d347bce0aea86d606c710303919f3d2
+    ./CVE-2018-3836.patch
+    (fetchpatch {
+      # CVE-2018-7186
+      url = "https://github.com/DanBloomberg/leptonica/commit/"
+          + "ee301cb2029db8a6289c5295daa42bba7715e99a.patch";
+      sha256 = "0cgb7mvz2px1rg5i80wk1wxxjvzjga617d8q6j7qygkp7jm6495d";
+    })
+    (fetchpatch {
+      # CVE-2018-7247
+      url = "https://github.com/DanBloomberg/leptonica/commit/"
+          + "c1079bb8e77cdd426759e466729917ca37a3ed9f.patch";
+      sha256 = "1z4iac5gwqggh7aa8cvyp6nl9fwd1v7wif26caxc9y5qr3jj34qf";
+    })
+    (fetchpatch {
+      # CVE-2018-7440
+      url = "https://github.com/DanBloomberg/leptonica/commit/"
+          + "49ecb6c2dfd6ed5078c62f4a8eeff03e3beced3b.patch";
+      sha256 = "1hjmva98iaw9xj7prg7aimykyayikcwnk4hk0380007hqb35lqmy";
+    })
+  ];
 
   postPatch = ''
     # Remove the AC_SUBST() macros on *_LIBS, because the *_LIBS variables will
@@ -34,6 +56,9 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
   buildInputs = [ giflib libjpeg libpng libtiff libwebp openjpeg zlib ];
 
+  checkInputs = [ which gnuplot ];
+  doCheck = true;
+
   meta = {
     description = "Image processing and analysis library";
     homepage = http://www.leptonica.org/;

pkgs/development/libraries/libelf/default.nix

@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
   name = "libelf-0.8.13";
 
   src = fetchurl {
-    url = "http://www.mr511.de/software/${name}.tar.gz";
+    url = "https://fossies.org/linux/misc/old/${name}.tar.gz";
     sha256 = "0vf7s9dwk2xkmhb79aigqm0x0yfbw1j0b9ksm51207qwr179n6jr";
   };
 

pkgs/development/libraries/libseccomp/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "libseccomp-${version}";
-  version = "2.4.0";
+  version = "2.3.3";
 
   src = fetchurl {
     url = "https://github.com/seccomp/libseccomp/releases/download/v${version}/libseccomp-${version}.tar.gz";
-    sha256 = "0paj1szszpf8plykrd66jqg1x3kmqs395rbjskahld2bnplcfx1f";
+    sha256 = "0mdiyfljrkfl50q1m3ws8yfcyfjwf1zgkvcva8ffcwncji18zhkz";
   };
 
   outputs = [ "out" "lib" "dev" "man" ];

pkgs/development/libraries/libssh2/default.nix

@@ -1,11 +1,13 @@
 { stdenv, fetchurlBoot, openssl, zlib, windows }:
 
 stdenv.mkDerivation rec {
-  name = "libssh2-1.8.0";
+  name = "${pname}-${version}";
+  pname = "libssh2";
+  version = "1.8.1";
 
   src = fetchurlBoot {
-    url = "${meta.homepage}/download/${name}.tar.gz";
-    sha256 = "1m3n8spv79qhjq4yi0wgly5s5rc8783jb1pyra9bkx1md0plxwrr";
+    url = "${meta.homepage}/download/${pname}-${version}.tar.gz";
+    sha256 = "0ngif3ynk6xqzy5nlfjs7bsmfm81g9f145av0z86kf0vbgrigda0";
   };
 
   outputs = [ "out" "dev" "devdoc" ];

pkgs/development/libraries/physics/rivet/default.nix

@@ -17,12 +17,16 @@ stdenv.mkDerivation rec {
     scheme-basic
     collection-pstricks
     collection-fontsrecommended
+    l3kernel
+    l3packages
     mathastext
     pgf
     relsize
     sfmath
+    siunitx
     xcolor
     xkeyval
+    xstring
     ;};
   buildInputs = [ hepmc imagemagick python2 latex makeWrapper ];
   propagatedBuildInputs = [ fastjet ghostscript gsl yoda ];

pkgs/development/libraries/qt-5/5.11/default.nix

@@ -60,7 +60,14 @@ let
     qtscript = [ ./qtscript.patch ];
     qtserialport = [ ./qtserialport.patch ];
     qttools = [ ./qttools.patch ];
-    qtwebengine = optional stdenv.needsPax ./qtwebengine-paxmark-mksnapshot.patch;
+    qtwebengine = [ ./qtwebengine-no-build-skip.patch ]
+      ++ optional stdenv.needsPax ./qtwebengine-paxmark-mksnapshot.patch
+      ++ optional stdenv.cc.isClang ./qtwebengine-clang-fix.patch
+      ++ optionals stdenv.isDarwin [
+        ./qtwebengine-darwin-no-platform-check.patch
+        ./qtwebengine-darwin-sdk-10.10.patch
+        ./qtwebengine-darwin-old-sdk.patch
+      ];
     qtwebkit = [ ./qtwebkit.patch ];
   };
 

pkgs/development/libraries/qt-5/5.11/qtwebengine-clang-fix.patch

@@ -0,0 +1,30 @@
+Fix a following build error:
+
+In file included from ../../3rdparty/chromium/device/bluetooth/bluetooth_remote_gatt_characteristic_mac.mm:7:
+../../3rdparty/chromium/base/bind.h:59:3: error: static_assert failed "Bound argument |i| of type |Arg| cannot be forwarded as |Unwrapped| to the bound functor, which declares it as |Param|."
+  static_assert(
+  ^
+../../3rdparty/chromium/base/bind.h:91:7: note: in instantiation of template class 'base::internal::AssertConstructible<1, long, long, const long &, NSError *>' requested here
+    : AssertConstructible<Ns, Args, std::decay_t<Args>, Unwrapped, Params>... {
+      ^
+../../3rdparty/chromium/base/bind.h:213:27: note: in instantiation of template class 'base::internal::AssertBindArgsValidity<std::__1::integer_sequence<unsigned long, 0, 1>, base::internal::TypeList<base::WeakPtr<device::BluetoothRemoteGattCharacteristicMac>, long>, base::internal::TypeList<device::BluetoothRemoteGattCharacteristicMac *, const long &>, base::internal::TypeList<device::BluetoothRemoteGattCharacteristicMac *, NSError *> >' requested here
+  static_assert(internal::AssertBindArgsValidity<
+                          ^
+../../3rdparty/chromium/base/bind.h:242:16: note: in instantiation of function template specialization 'base::BindRepeating<void (device::BluetoothRemoteGattCharacteristicMac::*)(NSError *), base::WeakPtr<device::BluetoothRemoteGattCharacteristicMac>, long>' requested here
+  return base::BindRepeating(std::forward<Functor>(functor),
+               ^
+../../3rdparty/chromium/device/bluetooth/bluetooth_remote_gatt_characteristic_mac.mm:211:15: note: in instantiation of function template specialization 'base::Bind<void (device::BluetoothRemoteGattCharacteristicMac::*)(NSError *), base::WeakPtr<device::BluetoothRemoteGattCharacteristicMac>, long>' requested here
+        base::Bind(&BluetoothRemoteGattCharacteristicMac::DidWriteValue,
+              ^
+
+--- a/src/3rdparty/chromium/device/bluetooth/bluetooth_remote_gatt_characteristic_mac.mm
++++ b/src/3rdparty/chromium/device/bluetooth/bluetooth_remote_gatt_characteristic_mac.mm
+@@ -209,7 +209,7 @@ void BluetoothRemoteGattCharacteristicMac::WriteRemoteCharacteristic(
+     base::ThreadTaskRunnerHandle::Get()->PostTask(
+         FROM_HERE,
+         base::Bind(&BluetoothRemoteGattCharacteristicMac::DidWriteValue,
+-                   weak_ptr_factory_.GetWeakPtr(), nil));
++                   weak_ptr_factory_.GetWeakPtr(), nullptr));
+   }
+ }
+ 

pkgs/development/libraries/qt-5/5.11/qtwebengine-darwin-no-platform-check.patch

@@ -0,0 +1,37 @@
+diff --git a/mkspecs/features/platform.prf b/mkspecs/features/platform.prf
+--- a/mkspecs/features/platform.prf
++++ b/mkspecs/features/platform.prf
+@@ -38,10 +38,6 @@ defineTest(isPlatformSupported) {
+          return(false)
+     }
+   } else:osx {
+-    !isMinXcodeVersion(7, 3) {
+-      skipBuild("Using Xcode version $$QMAKE_XCODE_VERSION, but at least version 7.3 is required to build Qt WebEngine.")
+-      return(false)
+-    }
+     !clang|intel_icc {
+         skipBuild("Qt WebEngine on macOS requires Clang.")
+         return(false)
+@@ -52,10 +48,6 @@ defineTest(isPlatformSupported) {
+       skipBuild("Building Qt WebEngine requires macOS version 10.11 or newer.")
+       return(false)
+     }
+-    !isMinOSXSDKVersion(10, 10): {
+-      skipBuild("Building Qt WebEngine requires a macOS SDK version of 10.11 or newer. Current version is $${WEBENGINE_OSX_SDK_PRODUCT_VERSION}.")
+-      return(false)
+-    }
+   } else {
+     skipBuild("Unknown platform. Qt WebEngine only supports Linux, Windows, and macOS.")
+     return(false)
+diff --git a/src/core/config/mac_osx.pri b/src/core/config/mac_osx.pri
+--- a/src/core/config/mac_osx.pri
++++ b/src/core/config/mac_osx.pri
+@@ -5,8 +5,6 @@ load(functions)
+ # otherwise query for it.
+ QMAKE_MAC_SDK_VERSION = $$eval(QMAKE_MAC_SDK.$${QMAKE_MAC_SDK}.SDKVersion)
+ isEmpty(QMAKE_MAC_SDK_VERSION) {
+-     QMAKE_MAC_SDK_VERSION = $$system("/usr/bin/xcodebuild -sdk $${QMAKE_MAC_SDK} -version SDKVersion 2>/dev/null")
+-     isEmpty(QMAKE_MAC_SDK_VERSION): error("Could not resolve SDK version for \'$${QMAKE_MAC_SDK}\'")
+ }
+ 
+ QMAKE_CLANG_DIR = "/usr"

pkgs/development/libraries/qt-5/5.11/qtwebengine-darwin-old-sdk.patch

@@ -0,0 +1,21 @@
+diff --git a/src/3rdparty/chromium/third_party/webrtc/sdk/objc/Framework/Classes/Common/RTCFieldTrials.mm b/src/3rdparty/chromium/third_party/webrtc/sdk/objc/Framework/Classes/Common/RTCFieldTrials.mm
+--- a/src/3rdparty/chromium/third_party/webrtc/sdk/objc/Framework/Classes/Common/RTCFieldTrials.mm
++++ b/src/3rdparty/chromium/third_party/webrtc/sdk/objc/Framework/Classes/Common/RTCFieldTrials.mm
+@@ -45,7 +45,7 @@ NSString *RTCFieldTrialTrendlineFilterValue(
+   return [NSString stringWithFormat:format, windowSize, smoothingCoeff, thresholdGain];
+ }
+ 
+-void RTCInitFieldTrialDictionary(NSDictionary<NSString *, NSString *> *fieldTrials) {
++void RTCInitFieldTrialDictionary(NSDictionary *fieldTrials) {
+   if (!fieldTrials) {
+     RTCLogWarning(@"No fieldTrials provided.");
+     return;
+diff --git a/src/3rdparty/chromium/third_party/webrtc/sdk/objc/Framework/Headers/WebRTC/RTCFieldTrials.h b/src/3rdparty/chromium/third_party/webrtc/sdk/objc/Framework/Headers/WebRTC/RTCFieldTrials.h
+--- a/src/3rdparty/chromium/third_party/webrtc/sdk/objc/Framework/Headers/WebRTC/RTCFieldTrials.h
++++ b/src/3rdparty/chromium/third_party/webrtc/sdk/objc/Framework/Headers/WebRTC/RTCFieldTrials.h
+@@ -40,4 +40,4 @@ RTC_EXTERN NSString *RTCFieldTrialTrendlineFilterValue(
+  *  Must be called before any other call into WebRTC. See:
+  *  webrtc/system_wrappers/include/field_trial_default.h
+  */
+-RTC_EXTERN void RTCInitFieldTrialDictionary(NSDictionary<NSString *, NSString *> *fieldTrials);
++RTC_EXTERN void RTCInitFieldTrialDictionary(NSDictionary *fieldTrials);

pkgs/development/libraries/qt-5/5.11/qtwebengine-darwin-sdk-10.10.patch

@@ -0,0 +1,160 @@
+Fix build against 10.10 SDK
+
+The SecKey part perhaps could be fixed by implementing a revert to
+https://chromium.googlesource.com/chromium/src.git/+/8418e098b9cbedf884878b61dcd3292c515845cf%5E%21/#F0
+
+--- a/src/3rdparty/chromium/content/browser/renderer_host/input/web_input_event_builders_mac.mm
++++ b/src/3rdparty/chromium/content/browser/renderer_host/input/web_input_event_builders_mac.mm
+@@ -1,3 +1,4 @@
++#define NSEventTypeScrollWheel 22
+ // Copyright 2015 The Chromium Authors. All rights reserved.
+ // Use of this source code is governed by a BSD-style license that can be
+ // found in the LICENSE file.
+--- a/src/3rdparty/chromium/net/ssl/ssl_platform_key_mac.cc
++++ b/src/3rdparty/chromium/net/ssl/ssl_platform_key_mac.cc
+@@ -48,21 +48,6 @@ namespace net {
+ 
+ namespace {
+ 
+-// TODO(davidben): Remove this when we switch to building to the 10.13
+-// SDK. https://crbug.com/780980
+-#if !defined(MAC_OS_X_VERSION_10_13) || \
+-    MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_13
+-API_AVAILABLE(macosx(10.13))
+-const SecKeyAlgorithm kSecKeyAlgorithmRSASignatureDigestPSSSHA256 =
+-    CFSTR("algid:sign:RSA:digest-PSS:SHA256:SHA256:32");
+-API_AVAILABLE(macosx(10.13))
+-const SecKeyAlgorithm kSecKeyAlgorithmRSASignatureDigestPSSSHA384 =
+-    CFSTR("algid:sign:RSA:digest-PSS:SHA384:SHA384:48");
+-API_AVAILABLE(macosx(10.13))
+-const SecKeyAlgorithm kSecKeyAlgorithmRSASignatureDigestPSSSHA512 =
+-    CFSTR("algid:sign:RSA:digest-PSS:SHA512:SHA512:64");
+-#endif
+-
+ class ScopedCSSM_CC_HANDLE {
+  public:
+   ScopedCSSM_CC_HANDLE() : handle_(0) {}
+@@ -187,109 +172,6 @@ class SSLPlatformKeyCSSM : public ThreadedSSLPrivateKey::Delegate {
+   DISALLOW_COPY_AND_ASSIGN(SSLPlatformKeyCSSM);
+ };
+ 
+-// Returns the corresponding SecKeyAlgorithm or nullptr if unrecognized.
+-API_AVAILABLE(macosx(10.12))
+-SecKeyAlgorithm GetSecKeyAlgorithm(uint16_t algorithm) {
+-  switch (algorithm) {
+-    case SSL_SIGN_RSA_PKCS1_SHA512:
+-      return kSecKeyAlgorithmRSASignatureDigestPKCS1v15SHA512;
+-    case SSL_SIGN_RSA_PKCS1_SHA384:
+-      return kSecKeyAlgorithmRSASignatureDigestPKCS1v15SHA384;
+-    case SSL_SIGN_RSA_PKCS1_SHA256:
+-      return kSecKeyAlgorithmRSASignatureDigestPKCS1v15SHA256;
+-    case SSL_SIGN_RSA_PKCS1_SHA1:
+-      return kSecKeyAlgorithmRSASignatureDigestPKCS1v15SHA1;
+-    case SSL_SIGN_RSA_PKCS1_MD5_SHA1:
+-      return kSecKeyAlgorithmRSASignatureDigestPKCS1v15Raw;
+-    case SSL_SIGN_ECDSA_SECP521R1_SHA512:
+-      return kSecKeyAlgorithmECDSASignatureDigestX962SHA512;
+-    case SSL_SIGN_ECDSA_SECP384R1_SHA384:
+-      return kSecKeyAlgorithmECDSASignatureDigestX962SHA384;
+-    case SSL_SIGN_ECDSA_SECP256R1_SHA256:
+-      return kSecKeyAlgorithmECDSASignatureDigestX962SHA256;
+-    case SSL_SIGN_ECDSA_SHA1:
+-      return kSecKeyAlgorithmECDSASignatureDigestX962SHA1;
+-  }
+-
+-  if (base::mac::IsAtLeastOS10_13()) {
+-    switch (algorithm) {
+-      case SSL_SIGN_RSA_PSS_SHA512:
+-        return kSecKeyAlgorithmRSASignatureDigestPSSSHA512;
+-      case SSL_SIGN_RSA_PSS_SHA384:
+-        return kSecKeyAlgorithmRSASignatureDigestPSSSHA384;
+-      case SSL_SIGN_RSA_PSS_SHA256:
+-        return kSecKeyAlgorithmRSASignatureDigestPSSSHA256;
+-    }
+-  }
+-
+-  return nullptr;
+-}
+-
+-class API_AVAILABLE(macosx(10.12)) SSLPlatformKeySecKey
+-    : public ThreadedSSLPrivateKey::Delegate {
+- public:
+-  SSLPlatformKeySecKey(int type, size_t max_length, SecKeyRef key)
+-      : key_(key, base::scoped_policy::RETAIN) {
+-    // Determine the algorithms supported by the key.
+-    for (uint16_t algorithm : SSLPrivateKey::DefaultAlgorithmPreferences(
+-             type, true /* include PSS */)) {
+-      SecKeyAlgorithm sec_algorithm = GetSecKeyAlgorithm(algorithm);
+-      if (sec_algorithm &&
+-          SecKeyIsAlgorithmSupported(key_.get(), kSecKeyOperationTypeSign,
+-                                     sec_algorithm)) {
+-        preferences_.push_back(algorithm);
+-      }
+-    }
+-  }
+-
+-  ~SSLPlatformKeySecKey() override {}
+-
+-  std::vector<uint16_t> GetAlgorithmPreferences() override {
+-    return preferences_;
+-  }
+-
+-  Error Sign(uint16_t algorithm,
+-             base::span<const uint8_t> input,
+-             std::vector<uint8_t>* signature) override {
+-    SecKeyAlgorithm sec_algorithm = GetSecKeyAlgorithm(algorithm);
+-    if (!sec_algorithm) {
+-      NOTREACHED();
+-      return ERR_FAILED;
+-    }
+-
+-    const EVP_MD* md = SSL_get_signature_algorithm_digest(algorithm);
+-    uint8_t digest[EVP_MAX_MD_SIZE];
+-    unsigned digest_len;
+-    if (!md || !EVP_Digest(input.data(), input.size(), digest, &digest_len, md,
+-                           nullptr)) {
+-      return ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED;
+-    }
+-
+-    base::ScopedCFTypeRef<CFDataRef> digest_ref(CFDataCreateWithBytesNoCopy(
+-        kCFAllocatorDefault, digest, base::checked_cast<CFIndex>(digest_len),
+-        kCFAllocatorNull));
+-
+-    base::ScopedCFTypeRef<CFErrorRef> error;
+-    base::ScopedCFTypeRef<CFDataRef> signature_ref(SecKeyCreateSignature(
+-        key_, sec_algorithm, digest_ref, error.InitializeInto()));
+-    if (!signature_ref) {
+-      LOG(ERROR) << error;
+-      return ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED;
+-    }
+-
+-    signature->assign(
+-        CFDataGetBytePtr(signature_ref),
+-        CFDataGetBytePtr(signature_ref) + CFDataGetLength(signature_ref));
+-    return OK;
+-  }
+-
+- private:
+-  std::vector<uint16_t> preferences_;
+-  base::ScopedCFTypeRef<SecKeyRef> key_;
+-
+-  DISALLOW_COPY_AND_ASSIGN(SSLPlatformKeySecKey);
+-};
+-
+ scoped_refptr<SSLPrivateKey> CreateSSLPrivateKeyForSecKey(
+     const X509Certificate* certificate,
+     SecKeyRef private_key) {
+@@ -298,13 +180,6 @@ scoped_refptr<SSLPrivateKey> CreateSSLPrivateKeyForSecKey(
+   if (!GetClientCertInfo(certificate, &key_type, &max_length))
+     return nullptr;
+ 
+-  if (base::mac::IsAtLeastOS10_12()) {
+-    return base::MakeRefCounted<ThreadedSSLPrivateKey>(
+-        std::make_unique<SSLPlatformKeySecKey>(key_type, max_length,
+-                                               private_key),
+-        GetSSLPlatformKeyTaskRunner());
+-  }
+-
+   const CSSM_KEY* cssm_key;
+   OSStatus status = SecKeyGetCSSMKey(private_key, &cssm_key);
+   if (status != noErr) {

pkgs/development/libraries/qt-5/5.11/qtwebengine-no-build-skip.patch

@@ -0,0 +1,12 @@
+diff --git a/qtwebengine.pro b/qtwebengine.pro
+--- a/qtwebengine.pro
++++ b/qtwebengine.pro
+@@ -5,7 +5,7 @@ runConfigure()
+ 
+ !isEmpty(skipBuildReason) {
+     SUBDIRS =
+-    log($${skipBuildReason}$${EOL})
++    error($${skipBuildReason}$${EOL})
+     log(QtWebEngine will not be built.$${EOL})
+ }
+ 

pkgs/development/libraries/qt-5/5.9/default.nix

@@ -42,7 +42,10 @@ let
     qtscript = [ ./qtscript.patch ];
     qtserialport = [ ./qtserialport.patch ];
     qttools = [ ./qttools.patch ];
-    qtwebengine = optional stdenv.needsPax ./qtwebengine-paxmark-mksnapshot.patch;
+    qtwebengine = [ ./qtwebengine-no-build-skip.patch ]
+      ++ optional stdenv.needsPax ./qtwebengine-paxmark-mksnapshot.patch
+      ++ optional stdenv.cc.isClang ./qtwebengine-clang-fix.patch
+      ++ optional stdenv.isDarwin ./qtwebengine-darwin-no-platform-check.patch;
     qtwebkit = [ ./qtwebkit.patch ];
     qtvirtualkeyboard = [
       (fetchpatch {

pkgs/development/libraries/qt-5/5.9/qtwebengine-clang-fix.patch

@@ -0,0 +1,38 @@
+Fix a following build error:
+
+In file included from ../../3rdparty/chromium/device/bluetooth/bluetooth_remote_gatt_characteristic_mac.mm:7:
+In file included from ../../3rdparty/chromium/base/bind.h:8:
+../../3rdparty/chromium/base/bind_internal.h:214:31: error: cannot initialize a parameter of type 'NSError *' with an lvalue of type 'const long'
+    return (receiver.*method)(std::forward<RunArgs>(args)...);
+                              ^~~~~~~~~~~~~~~~~~~~~~~~~~~
+../../3rdparty/chromium/base/bind_internal.h:285:20: note: in instantiation of function template specialization 'base::internal::FunctorTraits<void (device::BluetoothRemoteGat
+tCharacteristicMac::*)(NSError *), void>::Invoke<device::BluetoothRemoteGattCharacteristicMac *, const long &>' requested here
+    return Traits::Invoke(std::forward<Functor>(functor),
+                   ^
+../../3rdparty/chromium/base/bind_internal.h:361:43: note: in instantiation of function template specialization 'base::internal::InvokeHelper<false, void>::MakeItSo<void (devi
+ce::BluetoothRemoteGattCharacteristicMac::*const &)(NSError *), device::BluetoothRemoteGattCharacteristicMac *, const long &>' requested here
+    return InvokeHelper<is_weak_call, R>::MakeItSo(
+                                          ^
+../../3rdparty/chromium/base/bind_internal.h:339:12: note: in instantiation of function template specialization 'base::internal::Invoker<base::internal::BindState<void (device::BluetoothRemoteGattCharacteristicMac::*)(NSError *), base::internal::UnretainedWrapper<device::BluetoothRemoteGattCharacteristicMac>, long>, void ()>::RunImpl<void (device::BluetoothRemoteGattCharacteristicMac::*const &)(NSError *), const std::__1::tuple<base::internal::UnretainedWrapper<device::BluetoothRemoteGattCharacteristicMac>, long> &, 0, 1>' requested here
+    return RunImpl(storage->functor_,
+           ^
+../../3rdparty/chromium/base/bind.h:62:45: note: in instantiation of member function 'base::internal::Invoker<base::internal::BindState<void (device::BluetoothRemoteGattCharacteristicMac::*)(NSError *), base::internal::UnretainedWrapper<device::BluetoothRemoteGattCharacteristicMac>, long>, void ()>::Run' requested here
+  PolymorphicInvoke invoke_func = &Invoker::Run;
+                                            ^
+../../3rdparty/chromium/base/bind.h:77:10: note: in instantiation of function template specialization 'base::BindRepeating<void (device::BluetoothRemoteGattCharacteristicMac::*)(NSError *), base::internal::UnretainedWrapper<device::BluetoothRemoteGattCharacteristicMac>, long>' requested here
+  return BindRepeating(std::forward<Functor>(functor),
+         ^
+../../3rdparty/chromium/device/bluetooth/bluetooth_remote_gatt_characteristic_mac.mm:241:15: note: in instantiation of function template specialization 'base::Bind<void (device::BluetoothRemoteGattCharacteristicMac::*)(NSError *), base::internal::UnretainedWrapper<device::BluetoothRemoteGattCharacteristicMac>, long>' requested here
+        base::Bind(&BluetoothRemoteGattCharacteristicMac::DidWriteValue,
+
+--- a/src/3rdparty/chromium/device/bluetooth/bluetooth_remote_gatt_characteristic_mac.mm
++++ b/src/3rdparty/chromium/device/bluetooth/bluetooth_remote_gatt_characteristic_mac.mm
+@@ -239,7 +239,7 @@ void BluetoothRemoteGattCharacteristicMac::WriteRemoteCharacteristic(
+     base::ThreadTaskRunnerHandle::Get()->PostTask(
+         FROM_HERE,
+         base::Bind(&BluetoothRemoteGattCharacteristicMac::DidWriteValue,
+-                   base::Unretained(this), nil));
++                   base::Unretained(this), nullptr));
+   }
+ }
+ 

pkgs/development/libraries/qt-5/5.9/qtwebengine-darwin-no-platform-check.patch

@@ -0,0 +1,50 @@
+diff --git a/mkspecs/features/configure.prf b/mkspecs/features/configure.prf
+--- a/mkspecs/features/configure.prf
++++ b/mkspecs/features/configure.prf
+@@ -194,9 +194,6 @@ defineTest(runConfigure) {
+         } else {
+             log("Native Spellchecker .............. Not enabled         (Default, enable with WEBENGINE_CONFIG+=use_native_spellchecker)$${EOL}")
+         }
+-        !isMinOSXSDKVersion(10, 10, 3) {
+-            log("  Force Touch API usage .............. Not enabled         (Because the OS X SDK version to be used \"$${WEBENGINE_OSX_SDK_PRODUCT_VERSION}\" is lower than the required \"10.10.3\")$${EOL}")
+-        }
+     }
+ }
+ 
+diff --git a/mkspecs/features/functions.prf b/mkspecs/features/functions.prf
+--- a/mkspecs/features/functions.prf
++++ b/mkspecs/features/functions.prf
+@@ -38,10 +38,6 @@ defineTest(isPlatformSupported) {
+       return(false)
+     }
+   } else:osx {
+-    !isMinXcodeVersion(5, 1) {
+-      skipBuild("Using XCode version $$QMAKE_XCODE_VERSION, but at least version 5.1 is required to build Qt WebEngine.")
+-      return(false)
+-    }
+     !clang|intel_icc {
+         skipBuild("Qt WebEngine on macOS requires Clang.")
+         return(false)
+@@ -52,10 +48,6 @@ defineTest(isPlatformSupported) {
+       skipBuild("Qt WebEngine requires OS X version 10.10 or newer.")
+       return(false)
+     }
+-    !isMinOSXSDKVersion(10, 10): {
+-      skipBuild("Qt WebEngine requires an OS X SDK version of 10.10 or newer. Current version is $${WEBENGINE_OSX_SDK_PRODUCT_VERSION}.")
+-      return(false)
+-    }
+   } else {
+     skipBuild("Unknown platform. Qt WebEngine only supports Linux, Windows, and OS X.")
+     return(false)
+diff --git a/src/core/config/mac_osx.pri b/src/core/config/mac_osx.pri
+--- a/src/core/config/mac_osx.pri
++++ b/src/core/config/mac_osx.pri
+@@ -5,8 +5,6 @@ load(functions)
+ # otherwise query for it.
+ QMAKE_MAC_SDK_VERSION = $$eval(QMAKE_MAC_SDK.$${QMAKE_MAC_SDK}.SDKVersion)
+ isEmpty(QMAKE_MAC_SDK_VERSION) {
+-     QMAKE_MAC_SDK_VERSION = $$system("/usr/bin/xcodebuild -sdk $${QMAKE_MAC_SDK} -version SDKVersion 2>/dev/null")
+-     isEmpty(QMAKE_MAC_SDK_VERSION): error("Could not resolve SDK version for \'$${QMAKE_MAC_SDK}\'")
+ }
+ 
+ QMAKE_CLANG_DIR = "/usr"

pkgs/development/libraries/qt-5/5.9/qtwebengine-no-build-skip.patch

@@ -0,0 +1,12 @@
+diff --git a/qtwebengine.pro b/qtwebengine.pro
+--- a/qtwebengine.pro
++++ b/qtwebengine.pro
+@@ -5,7 +5,7 @@ runConfigure()
+ 
+ !isEmpty(skipBuildReason) {
+     SUBDIRS =
+-    log($${skipBuildReason}$${EOL})
++    error($${skipBuildReason}$${EOL})
+     log(QtWebEngine will not be built.$${EOL})
+ }
+ 

pkgs/development/libraries/qt-5/modules/qtwebengine.nix

@@ -12,7 +12,8 @@
 , pciutils
 , systemd
 , enableProprietaryCodecs ? true
-, gn, darwin, openbsm
+, gn
+, cups, darwin, openbsm, runCommand, xcbuild
 , ffmpeg ? null
 , lib, stdenv # lib.optional, needsPax
 }:
@@ -26,7 +27,7 @@ qtModule {
   qtInputs = [ qtdeclarative qtquickcontrols qtlocation qtwebchannel ];
   nativeBuildInputs = [
     bison coreutils flex git gperf ninja pkgconfig python2 which gn
-  ];
+  ] ++ optional stdenv.isDarwin xcbuild;
   doCheck = true;
   outputs = [ "bin" "dev" "out" ];
 
@@ -66,33 +67,26 @@ qtModule {
       sed -i -e '/libpci_loader.*Load/s!"\(libpci\.so\)!"${pciutils}/lib/\1!' \
         src/3rdparty/chromium/gpu/config/gpu_info_collector_linux.cc
     ''
-    + optionalString stdenv.isDarwin ''
-      # Remove annoying xcode check
-      substituteInPlace mkspecs/features/platform.prf \
-        --replace "lessThan(QMAKE_XCODE_VERSION, 7.3)" false
+    + optionalString stdenv.isDarwin (''
       substituteInPlace src/core/config/mac_osx.pri \
-        --replace /usr ${stdenv.cc} \
-        --replace "isEmpty(QMAKE_MAC_SDK_VERSION)" false
-
-    # FIXME Needed with old Apple SDKs
-    # Abandon all hope ye who try to make sense of this.
-    substituteInPlace src/3rdparty/chromium/base/mac/foundation_util.mm \
-      --replace "NSArray<NSString*>*" "NSArray*"
-    substituteInPlace src/3rdparty/chromium/base/mac/sdk_forward_declarations.h \
-      --replace "NSDictionary<VNImageOption, id>*" "NSDictionary*" \
-      --replace "NSArray<VNRequest*>*" "NSArray*" \
-      --replace "typedef NSString* VNImageOption NS_STRING_ENUM" "typedef NSString* VNImageOption"
+        --replace /usr ${stdenv.cc}
+    ''
+    + (optionalString (lib.versionAtLeast qtCompatVersion "5.11") ''
+      substituteInPlace src/3rdparty/chromium/third_party/crashpad/crashpad/util/BUILD.gn \
+        --replace '$sysroot/usr' "${darwin.xnu}"
+    '')
+    + ''
 
     cat <<EOF > src/3rdparty/chromium/build/mac/find_sdk.py
 #!/usr/bin/env python
+print("${darwin.apple_sdk.sdk}")
 print("10.10.0")
-print("")
 EOF
 
     cat <<EOF > src/3rdparty/chromium/build/config/mac/sdk_info.py
 #!/usr/bin/env python
-print('xcode_version="9.1"')
-print('xcode_version_int=9')
+print('xcode_version="0910"')
+print('xcode_version_int=910')
 print('xcode_build="9B55"')
 print('machine_os_build="17E199"')
 print('sdk_path=""')
@@ -104,9 +98,26 @@ EOF
     # Apple has some secret stuff they don't share with OpenBSM
     substituteInPlace src/3rdparty/chromium/base/mac/mach_port_broker.mm \
       --replace "audit_token_to_pid(msg.trailer.msgh_audit)" "msg.trailer.msgh_audit.val[5]"
-    '';
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-DMAC_OS_X_VERSION_MAX_ALLOWED=MAC_OS_X_VERSION_10_10 -DMAC_OS_X_VERSION_MIN_REQUIRED=MAC_OS_X_VERSION_10_10";
+    substituteInPlace src/3rdparty/chromium/sandbox/mac/BUILD.gn \
+      --replace 'libs = [ "sandbox" ]' 'libs = [ "/usr/lib/libsandbox.1.dylib" ]'
+    '');
+
+  NIX_CFLAGS_COMPILE =
+    lib.optionalString stdenv.isDarwin [
+      "-DMAC_OS_X_VERSION_MAX_ALLOWED=MAC_OS_X_VERSION_10_10"
+      "-DMAC_OS_X_VERSION_MIN_REQUIRED=MAC_OS_X_VERSION_10_10"
+
+      #
+      # Prevent errors like
+      # /nix/store/xxx-apple-framework-CoreData/Library/Frameworks/CoreData.framework/Headers/NSEntityDescription.h:51:7:
+      # error: pointer to non-const type 'id' with no explicit ownership
+      #     id** _kvcPropertyAccessors;
+      #
+      # TODO remove when new Apple SDK is in
+      #
+      "-fno-objc-arc"
+    ];
 
   preConfigure = ''
     export NINJAFLAGS=-j$NIX_BUILD_CORES
@@ -161,7 +172,10 @@ EOF
 
     # frameworks
     ApplicationServices
+    AVFoundation
     Foundation
+    ForceFeedback
+    GameController
     AppKit
     ImageCaptureCore
     CoreBluetooth
@@ -174,8 +188,28 @@ EOF
     libunwind
   ]);
 
+  buildInputs = optionals stdenv.isDarwin (with darwin; [
+    cups
+
+    # For sandbox.h include
+    (runCommand "MacOS_SDK_sandbox.h" {} ''
+      install -Dm444 "${lib.getDev darwin.apple_sdk.sdk}"/include/sandbox.h "$out"/include/sandbox.h
+    '')
+
+    # For:
+    # _NSDefaultRunLoopMode
+    # _OBJC_CLASS_$_NSDate
+    # _OBJC_CLASS_$_NSDictionary
+    # _OBJC_CLASS_$_NSRunLoop
+    # _OBJC_CLASS_$_NSURL
+    darwin.cf-private
+  ]);
+
+  __impureHostDeps = optional stdenv.isDarwin "/usr/lib/libsandbox.1.dylib";
+
   dontUseNinjaBuild = true;
   dontUseNinjaInstall = true;
+  dontUseXcbuild = true;
 
   postInstall = lib.optionalString stdenv.isLinux ''
     cat > $out/libexec/qt.conf <<EOF

pkgs/development/mobile/androidenv/androidndk-pkgs.nix

@@ -91,8 +91,7 @@ rec {
           $out/bin/${stdenv.targetPlatform.config}-c++ \
           $out/bin/${stdenv.targetPlatform.config}-gcc \
           $out/bin/${stdenv.targetPlatform.config}-g++ \
-          -e '130i    extraBefore+=(-Wl,--fix-cortex-a8)' \
-          -e 's|^(extraBefore=)\(\)$|\1(${builtins.toString flags})|'
+          -e 's|^(extraBefore=)\((.*)\)$|\1(\2 -Wl,--fix-cortex-a8 ${builtins.toString flags})|'
       '')
       # GCC 4.9 is the first relase with "-fstack-protector"
       + lib.optionalString (lib.versionOlder targetInfo.gccVer "4.9") ''

pkgs/development/tools/misc/automake/automake-1.15.x.nix

@@ -1,43 +0,0 @@
-{ stdenv, fetchurl, perl, autoconf }:
-
-stdenv.mkDerivation rec {
-  name = "automake-1.15";
-
-  src = fetchurl {
-    url = "mirror://gnu/automake/${name}.tar.xz";
-    sha256 = "0dl6vfi2lzz8alnklwxzfz624b95hb1ipjvd3mk177flmddcf24r";
-  };
-
-  nativeBuildInputs = [ autoconf perl ];
-  buildInputs = [ autoconf ];
-
-  setupHook = ./setup-hook.sh;
-
-  # Disable indented log output from Make, otherwise "make.test" will
-  # fail.
-  preCheck = "unset NIX_INDENT_MAKE";
-  doCheck = false; # takes _a lot_ of time, fails 3 out of 2698 tests, all seem to be related to paths
-  doInstallCheck = false; # runs the same thing, fails the same tests
-
-  # The test suite can run in parallel.
-  enableParallelBuilding = true;
-
-  # Don't fixup "#! /bin/sh" in Libtool, otherwise it will use the
-  # "fixed" path in generated files!
-  dontPatchShebangs = true;
-
-  meta = {
-    branch = "1.15";
-    homepage = https://www.gnu.org/software/automake/;
-    description = "GNU standard-compliant makefile generator";
-    license = stdenv.lib.licenses.gpl2Plus;
-
-    longDescription = ''
-      GNU Automake is a tool for automatically generating
-      `Makefile.in' files compliant with the GNU Coding
-      Standards.  Automake requires the use of Autoconf.
-    '';
-
-    platforms = stdenv.lib.platforms.all;
-  };
-}

pkgs/development/tools/xcbuild/toolchains.nix

@@ -67,5 +67,6 @@ runCommand "Toolchains" {} (''
   done
 
   ln -s ${buildPackages.darwin.bootstrap_cmds}/bin/mig $toolchain/bin
+  ln -s ${buildPackages.darwin.bootstrap_cmds}/libexec/migcom $toolchain/libexec
   ln -s ${mkdep-darwin-src} $toolchain/bin/mkdep
 '')

pkgs/misc/cups/default.nix

@@ -29,6 +29,13 @@ stdenv.mkDerivation rec {
       sha256 = "1ddgdlg9s0l2ph6l8lx1m1lx6k50gyxqi3qiwr44ppq1rxs80ny5";
     })
     ./cups-clean-dirty.patch
+    (fetchpatch {
+      name = "CVE-2018-4700.patch";
+      url = "https://github.com/apple/cups/commit/"
+          + "feb4c62b211bfbd78dc10d737d873439ccdfa58c.patch";
+      sha256 = "1g1626sl4vdwbj9jdzpxmxl8gwyykmxr6i4vr2ba3vn140wnv088";
+      includes = [ "cgi-bin/var.c" ];
+    })
   ];
 
   postPatch = ''

pkgs/os-specific/linux/kbd/keymaps.nix

@@ -24,7 +24,8 @@
 
     src = fetchurl {
       name = "neo.map";
-      url = "https://svn.neo-layout.org/linux/console/neo.map?r=${version}";
+      url = "https://raw.githubusercontent.com/neo-layout/neo-layout/"
+          + "a0dee06fed824abfad658b7f10e6d907b270be0a/linux/console/neo.map";
       sha256 = "19mfrd31vzpsjiwc7pshxm0b0sz5dd17xrz6k079cy4im1vf0r4g";
     };
 

pkgs/os-specific/linux/kernel/linux-4.14.nix

@@ -3,16 +3,15 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.14.109";
+  version = "4.14.120";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-  modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
 
   # branchVersion needs to be x.y
   extraMeta.branch = concatStrings (intersperse "." (take 2 (splitString "." version)));
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1q4fv07kl07yyi8173fdx7m98pdn3mz8z3a6y52qfmkryxjz2r1p";
+    sha256 = "0k6bphnwwbgj06v8a4xafb23ysrvh8kg0imwhbvm6vsyyrnfif6x";
   };
 } // (args.argsOverride or {}))

pkgs/os-specific/linux/kernel/linux-4.19.nix

@@ -3,16 +3,15 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.19.32";
+  version = "4.19.44";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-  modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
 
   # branchVersion needs to be x.y
   extraMeta.branch = concatStrings (intersperse "." (take 2 (splitString "." version)));
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1ng730lz7riiq7ja4k3x17njs9779jy49b15kbfy7bi48cax29m3";
+    sha256 = "125jlsy42qlprg6yhinsm87ir7x4iw2v2fd0myjihmkpjgll4xkh";
   };
 } // (args.argsOverride or {}))

pkgs/os-specific/linux/kernel/linux-4.4.nix

@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.177";
+  version = "4.4.180";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1gy0xm9hpfl8x3rxgm461yd4pnigbsgyxjb69bdpl3sqgz2225sj";
+    sha256 = "0ykai953rpy9zkb4qxb63y6pwwbwlnvx69nhb797zfw1scbh4i8s";
   };
 } // (args.argsOverride or {}))

pkgs/os-specific/linux/kernel/linux-4.9.nix

@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.166";
+  version = "4.9.177";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1sxs7525432cbnzrf5i4dli213bwwk3w1qfaamfx6ddwgh47ry5q";
+    sha256 = "1vl7g21538ndlygpjsbjnayi9f37zi8s2g37gcznany3phz1wfy7";
   };
 } // (args.argsOverride or {}))

pkgs/os-specific/linux/kernel/linux-libre.nix

@@ -1,8 +1,11 @@
 { stdenv, lib, fetchsvn, linux
 , scripts ? fetchsvn {
-    url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/tags/";
-    rev = "r15295";
-    sha256 = "03kqbjy7w9zg6ry86h9sxa33z0rblznhba109lwmjwy0wx7yk1cs";
+    url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
+
+    # Update this if linux_latest-libre fails to build.
+    # $ curl https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/ | grep -Eo 'Revision [0-9]+'
+    rev = "16791";
+    sha256 = "1lpaka4hs7yrpnrzfybd6radjylwvw2p4aly68pypykqs2srvm7j";
   }
 , ...
 }:
@@ -22,7 +25,7 @@ in linux.override {
       name = "${linux.name}-libre-src";
       src = linux.src;
       buildPhase = ''
-        ${scripts}/${majorMinor}-gnu/deblob-${majorMinor} \
+        ${scripts}/${majorMinor}/deblob-${majorMinor} \
             ${major} ${minor} ${patch}
       '';
       checkPhase = ''

pkgs/servers/dns/bind/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl
+{ stdenv, lib, fetchurl, fetchpatch
 , perl
 , libcap, libtool, libxml2, openssl
 , enablePython ? false, python3 ? null
@@ -8,19 +8,29 @@
 assert enableSeccomp -> libseccomp != null;
 assert enablePython -> python3 != null;
 
-let version = "9.12.3-P4"; in
+let version = "9.12.4-P1"; in
 
 stdenv.mkDerivation rec {
   name = "bind-${version}";
 
   src = fetchurl {
     url = "https://ftp.isc.org/isc/bind9/${version}/${name}.tar.gz";
-    sha256 = "01pj47z5582rd538dmbzf1msw4jc8j4zr0zx4ciy88r6qr9l80fi";
+    sha256 = "1if7zc5gzrfd28csc63v9bjwrc0rgvm1x9yx058946hc5gp5lyp2";
   };
 
   outputs = [ "out" "lib" "dev" "man" "dnsutils" "host" ];
 
   patches = [ ./dont-keep-configure-flags.patch ./remove-mkdir-var.patch ] ++
+    [
+      # Workaround for missing atomic operations on aarch64. Upstream added the
+      # below patch after the release. Can probably be dropped with the next
+      # version.
+      (fetchpatch {
+        name = "client-atomics-as-refcount.patch";
+        url = https://gitlab.isc.org/isc-projects/bind9/commit/d72f436b7d7c697b262968c48c2d7643069ab17f.diff;
+        sha256 = "0sidlab9wcv21751fbq3h9m4wy6hk7frag9ar2jndw8rn3axr2qy";
+      })
+    ] ++
     stdenv.lib.optional stdenv.isDarwin ./darwin-openssl-linking-fix.patch;
 
   nativeBuildInputs = [ perl ];

pkgs/servers/http/apache-httpd/2.4.nix

@@ -16,12 +16,12 @@ assert ldapSupport -> aprutil.ldapSupport && openldap != null;
 assert http2Support -> nghttp2 != null;
 
 stdenv.mkDerivation rec {
-  version = "2.4.35";
+  version = "2.4.39";
   name = "apache-httpd-${version}";
 
   src = fetchurl {
     url = "mirror://apache/httpd/httpd-${version}.tar.bz2";
-    sha256 = "0mlvwsm7hmpc7db6lfc2nx3v4cll3qljjxhjhgsw6aniskywc1r6";
+    sha256 = "18ngvsjq65qxk3biggnkhkq8jlll9dsg9n3csra9p99sfw2rvjml";
   };
 
   # FIXME: -dev depends on -doc

pkgs/servers/mail/dovecot/default.nix

@@ -53,6 +53,11 @@ stdenv.mkDerivation rec {
       url = https://github.com/dovecot/core/compare/578cf77e84b3d25e2f95f08133a2b0b212aa77cc~1..696320b0f3644e928a9d0c71c063f603c3792dbb.patch;
       sha256 = "101d757gid0dn3mxqqpa59igkgkq7bwffsklh3nimaav0v2zb018";
     })
+    (fetchpatch {
+      name = "CVE-2019-10691.patch";
+      url = https://github.com/dovecot/core/commit/973769d74433de3c56c4ffdf4f343cb35d98e4f7.patch;
+      sha256 = "1rp0nfq2qkrx59l6rf8i0v3a8svijmkpnimcpa7vz3b93krk50bp";
+    })
   ];
 
   configureFlags = [

pkgs/servers/mail/exim/default.nix

@@ -1,4 +1,4 @@
-{ coreutils, db, fetchurl, openssl, pcre, perl, pkgconfig, stdenv
+{ coreutils, db, fetchurl, openssl, pcre, perl, pkgconfig, stdenv, fetchpatch
 , enableLDAP ? false, openldap
 , enableMySQL ? false, mysql, zlib
 , enableAuthDovecot ? false, dovecot
@@ -13,6 +13,16 @@ stdenv.mkDerivation rec {
     sha256 = "066ip7a5lqfn9rcr14j4nm0kqysw6mzvbbb0ip50lmfm0fqsqmzc";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2019-10149.patch";
+      url = https://git.exim.org/exim.git/patch/d740d2111f189760593a303124ff6b9b1f83453d;
+      stripLen = 1;
+      includes = ["src/deliver.c"];
+      sha256 = "0va872q2d3nizr001hfs1yaa4w5lffppk4hkim2ywcpq8ap5kxfk";
+    })
+  ];
+
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ coreutils db openssl perl pcre ]
     ++ stdenv.lib.optional enableLDAP openldap

pkgs/servers/mail/postfix/default.nix

@@ -25,11 +25,11 @@ in stdenv.mkDerivation rec {
 
   name = "postfix-${version}";
 
-  version = "3.3.3";
+  version = "3.3.4";
 
   src = fetchurl {
     url = "ftp://ftp.cs.uu.nl/mirror/postfix/postfix-release/official/${name}.tar.gz";
-    sha256 = "0ni82fl2vi84llvq60fd714cqbnmk2vzcb0r8iwfw03m0djsnh47";
+    sha256 = "1lwvr65cnzfq5iw8c05vpcsx0ssx1crhc0m30cryimyhhaxihy44";
   };
 
   nativeBuildInputs = [ makeWrapper m4 ];

pkgs/tools/misc/html-proofer/Gemfile.lock

@@ -1,42 +1,42 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (5.2.0)
+    activesupport (5.2.3)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 0.7, < 2)
       minitest (~> 5.1)
       tzinfo (~> 1.1)
-    addressable (2.5.2)
+    addressable (2.6.0)
       public_suffix (>= 2.0.2, < 4.0)
     colorize (0.8.1)
-    concurrent-ruby (1.0.5)
-    ethon (0.11.0)
+    concurrent-ruby (1.1.5)
+    ethon (0.12.0)
       ffi (>= 1.3.0)
-    ffi (1.9.23)
-    html-proofer (3.8.0)
+    ffi (1.10.0)
+    html-proofer (3.10.2)
       activesupport (>= 4.2, < 6.0)
       addressable (~> 2.3)
       colorize (~> 0.8)
       mercenary (~> 0.3.2)
-      nokogiri (~> 1.8.1)
+      nokogiri (~> 1.9)
       parallel (~> 1.3)
       typhoeus (~> 1.3)
       yell (~> 2.0)
-    i18n (1.0.1)
+    i18n (1.6.0)
       concurrent-ruby (~> 1.0)
     mercenary (0.3.6)
-    mini_portile2 (2.3.0)
+    mini_portile2 (2.4.0)
     minitest (5.11.3)
-    nokogiri (1.8.2)
-      mini_portile2 (~> 2.3.0)
-    parallel (1.12.1)
-    public_suffix (3.0.2)
+    nokogiri (1.10.2)
+      mini_portile2 (~> 2.4.0)
+    parallel (1.17.0)
+    public_suffix (3.0.3)
     thread_safe (0.3.6)
-    typhoeus (1.3.0)
+    typhoeus (1.3.1)
       ethon (>= 0.9.0)
     tzinfo (1.2.5)
       thread_safe (~> 0.1)
-    yell (2.0.7)
+    yell (2.1.0)
 
 PLATFORMS
   ruby
@@ -45,4 +45,4 @@ DEPENDENCIES
   html-proofer
 
 BUNDLED WITH
-   1.14.6
+   1.17.2

pkgs/tools/misc/html-proofer/gemset.nix

@@ -1,23 +1,29 @@
 {
   activesupport = {
     dependencies = ["concurrent-ruby" "i18n" "minitest" "tzinfo"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1nkzg31x501l8d1hbygyh1lr4c3vnw88a3c1rxz5ifvvzb10i6zm";
+      sha256 = "110vp4frgkw3mpzlmshg2f2ig09cknls2w68ym1r1s39d01v0mi8";
       type = "gem";
     };
-    version = "5.2.0";
+    version = "5.2.3";
   };
   addressable = {
     dependencies = ["public_suffix"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0viqszpkggqi8hq87pqp0xykhvz60g99nwmkwsb0v45kc2liwxvk";
+      sha256 = "0bcm2hchn897xjhqj9zzsxf3n9xhddymj4lsclz508f4vw3av46l";
       type = "gem";
     };
-    version = "2.5.2";
+    version = "2.6.0";
   };
   colorize = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "133rqj85n400qk6g3dhf2bmfws34mak1wqihvh3bgy9jhajw580b";
@@ -26,49 +32,61 @@
     version = "0.8.1";
   };
   concurrent-ruby = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "183lszf5gx84kcpb779v6a2y0mx9sssy8dgppng1z9a505nj1qcf";
+      sha256 = "1x07r23s7836cpp5z9yrlbpljcxpax14yw4fy4bnp6crhr6x24an";
       type = "gem";
     };
-    version = "1.0.5";
+    version = "1.1.5";
   };
   ethon = {
     dependencies = ["ffi"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0y70szwm2p0b9qfvpqrzjrgm3jz0ig65vlbfr6ppc3z0m1h7kv48";
+      sha256 = "0gggrgkcq839mamx7a8jbnp2h7x2ykfn34ixwskwb0lzx2ak17g9";
       type = "gem";
     };
-    version = "0.11.0";
+    version = "0.12.0";
   };
   ffi = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0zw6pbyvmj8wafdc7l5h7w20zkp1vbr2805ql5d941g2b20pk4zr";
+      sha256 = "0j8pzj8raxbir5w5k6s7a042sb5k02pg0f8s4na1r5lan901j00p";
       type = "gem";
     };
-    version = "1.9.23";
+    version = "1.10.0";
   };
   html-proofer = {
     dependencies = ["activesupport" "addressable" "colorize" "mercenary" "nokogiri" "parallel" "typhoeus" "yell"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "06ggsx2fhsis1iw0sw12a709h99ksbs9kbmv0j05kvbak7b9m51a";
+      sha256 = "0qwy5cdl5l6rl9cqpcydl4126rwv1f4l9ixf3z6j2rdy979l2jaf";
       type = "gem";
     };
-    version = "3.8.0";
+    version = "3.10.2";
   };
   i18n = {
     dependencies = ["concurrent-ruby"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1milplpsdpxlvn23q6pvir4jgxsphq2ps2jgdb3i29kzpc55gm7y";
+      sha256 = "1hfxnlyr618s25xpafw9mypa82qppjccbh292c4l3bj36az7f6wl";
       type = "gem";
     };
-    version = "1.0.1";
+    version = "1.6.0";
   };
   mercenary = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "10la0xw82dh5mqab8bl0dk21zld63cqxb1g16fk8cb39ylc4n21a";
@@ -77,14 +95,18 @@
     version = "0.3.6";
   };
   mini_portile2 = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "13d32jjadpjj6d2wdhkfpsmy68zjx90p49bgf8f7nkpz86r1fr11";
+      sha256 = "15zplpfw3knqifj9bpf604rb3wc1vhq6363pd6lvhayng8wql5vy";
       type = "gem";
     };
-    version = "2.3.0";
+    version = "2.4.0";
   };
   minitest = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0icglrhghgwdlnzzp4jf76b0mbc71s80njn5afyfjn4wqji8mqbq";
@@ -94,30 +116,38 @@
   };
   nokogiri = {
     dependencies = ["mini_portile2"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "05fm3xh462glvs0rwnfmc1spmgl4ljg2giifynbmwwqvl42zaaiq";
+      sha256 = "0sy96cc8i5y4p67fhf4d9c6sg8ymrrva21zyvzw55l0pa1582wx2";
       type = "gem";
     };
-    version = "1.8.2";
+    version = "1.10.2";
   };
   parallel = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "01hj8v1qnyl5ndrs33g8ld8ibk0rbcqdpkpznr04gkbxd11pqn67";
+      sha256 = "1x1gzgjrdlkm1aw0hfpyphsxcx90qgs3y4gmp9km3dvf4hc4qm8r";
       type = "gem";
     };
-    version = "1.12.1";
+    version = "1.17.0";
   };
   public_suffix = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1x5h1dh1i3gwc01jbg01rly2g6a1qwhynb1s8a30ic507z1nh09s";
+      sha256 = "08q64b5br692dd3v0a9wq9q5dvycc6kmiqmjbdxkxbfizggsvx6l";
       type = "gem";
     };
-    version = "3.0.2";
+    version = "3.0.3";
   };
   thread_safe = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0nmhcgq6cgz44srylra07bmaw99f5271l0dpsvl5f75m44l0gmwy";
@@ -127,15 +157,19 @@
   };
   typhoeus = {
     dependencies = ["ethon"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "01pd16n6bvknyip42r1r7js0j8x8ly37gmr72z3695zcczh1blyq";
+      sha256 = "0cni8b1idcp0dk8kybmxydadhfpaj3lbs99w5kjibv8bsmip2zi5";
       type = "gem";
     };
-    version = "1.3.0";
+    version = "1.3.1";
   };
   tzinfo = {
     dependencies = ["thread_safe"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1fjx9j327xpkkdlxwmkl3a8wqj7i4l4jwlrv3z13mg95z9wl253z";
@@ -144,11 +178,13 @@
     version = "1.2.5";
   };
   yell = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1m3q1l33sznrl86myjhd2l7chma1wdcdrdmnf2fi7aydapwd4vib";
+      sha256 = "161kfwyv7aq983m2gd90c67sqcs0p1z6nhjall2mdr7iz0gqf9wn";
       type = "gem";
     };
-    version = "2.0.7";
+    version = "2.1.0";
   };
 }

pkgs/tools/misc/thin-provisioning-tools/default.nix

@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
       #    dynamically using sysconf(_SC_PAGE_SIZE) instead of hardcoded value that hopefully is correct.
       # [1] http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/limits.h.html
       # [2] http://www.openwall.com/lists/musl/2015/09/11/8
-      url = "https://raw.githubusercontent.com/voidlinux/void-packages/a0ece13ad7ab2aae760e09e41e0459bd999a3695/srcpkgs/thin-provisioning-tools/patches/musl.patch";
+      url = "https://raw.githubusercontent.com/void-linux/void-packages/a0ece13ad7ab2aae760e09e41e0459bd999a3695/srcpkgs/thin-provisioning-tools/patches/musl.patch";
       sha256 = "1m8r3vhrnsy8drgs0svs3fgpi3mmxzdcqsv6bmvc0j52cvfqvhvy";
       extraPrefix = ""; # empty means add 'a/' and 'b/'
     })

pkgs/tools/misc/youtube-dl/default.nix

@@ -19,11 +19,11 @@ buildPythonPackage rec {
   # The websites youtube-dl deals with are a very moving target. That means that
   # downloads break constantly. Because of that, updates should always be backported
   # to the latest stable release.
-  version = "2019.03.18";
+  version = "2019.04.07";
 
   src = fetchurl {
     url = "https://yt-dl.org/downloads/${version}/${pname}-${version}.tar.gz";
-    sha256 = "0r31q7j3gg2zfw3b45jancxl7mmr2gin8dyfx5dgyyp92ss8hih7";
+    sha256 = "1krx4y8nzpaqpq9qs8dnv2y988jpdccyfl9sdx9wrb0baycl119k";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/tools/networking/dnsperf/default.nix

@@ -10,6 +10,15 @@ stdenv.mkDerivation rec {
     sha256 = "03kfc65s5a9csa5i7xjsv0psq144k8d9yw7xlny61bg1h2kg1db4";
   };
 
+  # Almost the same as https://github.com/DNS-OARC/dnsperf/pull/12
+  postPatch = ''
+    find . -name '*.h' -o -name '*.c' | xargs sed \
+      -e 's/\<isc_boolean_t\>/bool/g' -e 's/\<ISC_TRUE\>/true/g' -e 's/\<ISC_FALSE\>/false/g' \
+      -e 's/\<isc_uint/uint/g' -e 's/\<ISC_UINT/UINT/g' -e 's/\<isc_int/int/g' \
+      -e 's/\<ISC_PRINT_QUADFORMAT\>/PRIu64/g' -e 's/\<ISC_TF\>//g' \
+      -i --
+  '';
+
   outputs = [ "out" "man" "doc" ];
 
   buildInputs = [ bind zlib openssl ]

pkgs/tools/networking/wget/default.nix

@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   name = "wget-${version}";
-  version = "1.20.1";
+  version = "1.20.3";
 
   src = fetchurl {
     url = "mirror://gnu/wget/${name}.tar.lz";
-    sha256 = "0a29qsqxkk8145vkyy35q5a1wc7qzwx3qj3gmfrkmi9xs96yhqqg";
+    sha256 = "1frajd86ds8vz2hprq30wq8ya89z9dcxnwm8nwk12bbc47l7qq39";
   };
 
   patches = [

pkgs/tools/security/browserpass/2.nix

@@ -0,0 +1,43 @@
+# This file was generated by https://github.com/kamilchm/go2nix v1.2.1
+{ stdenv, buildGoPackage, fetchFromGitHub, gnupg }:
+
+buildGoPackage rec {
+  name = "browserpass-${version}";
+  version = "2.0.22";
+
+  goPackagePath = "github.com/dannyvankooten/browserpass";
+
+  goDeps = ./2deps.nix;
+
+  src = fetchFromGitHub {
+    repo = "browserpass";
+    owner = "dannyvankooten";
+    rev = version;
+    sha256 = "05cacrx08k99c5zra7ksdik9xxn3vih3x6in7536zs5gm55mkbfx";
+  };
+
+  postPatch = ''
+    substituteInPlace browserpass.go                                           \
+      --replace /usr/local/bin/gpg ${gnupg}/bin/gpg
+  '';
+
+  postInstall = ''
+      host_file="$bin/bin/browserpass"
+      mkdir -p "$bin/etc"
+
+      sed -e "s!%%replace%%!$host_file!" go/src/${goPackagePath}/chrome/host.json > chrome-host.json
+      sed -e "s!%%replace%%!$host_file!" go/src/${goPackagePath}/firefox/host.json > firefox-host.json
+
+      install chrome-host.json $bin/etc/
+      install -D firefox-host.json $bin/lib/mozilla/native-messaging-hosts/com.dannyvankooten.browserpass.json
+      install go/src/${goPackagePath}/chrome/policy.json $bin/etc/chrome-policy.json
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A Chrome & Firefox extension for zx2c4's pass";
+    homepage = https://github.com/dannyvankooten/browserpass;
+    license = licenses.mit;
+    platforms = with platforms; linux ++ darwin ++ openbsd;
+    maintainers = with maintainers; [ rvolosatovs ];
+  };
+}

pkgs/tools/security/browserpass/2deps.nix

@@ -0,0 +1,39 @@
+# This file was generated by https://github.com/kamilchm/go2nix v1.2.1
+[
+  {
+    goPackagePath = "github.com/gokyle/twofactor";
+    fetch = {
+      type = "git";
+      url = "https://github.com/gokyle/twofactor";
+      rev = "eaad1884d40f9cabff98a57a524c17afd00c9fe7";
+      sha256 = "07kvga6f2b56kpy52a3xk16garvlqz950s350dax97x7cayba95g";
+    };
+  }
+  {
+    goPackagePath = "github.com/mattn/go-zglob";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mattn/go-zglob";
+      rev = "4959821b481786922ac53e7ef25c61ae19fb7c36";
+      sha256 = "0rwkdw143kphpmingsrw1zp030zf3p08f64h347jpdm4lz8z5449";
+    };
+  }
+  {
+    goPackagePath = "github.com/sahilm/fuzzy";
+    fetch = {
+      type = "git";
+      url = "https://github.com/sahilm/fuzzy";
+      rev = "a154b19bb758dcdd6ede58dc11ea53c2950527b2";
+      sha256 = "0jkw6474d5ik2fq2zznqxj4y3p42z47r7mbg856ln5wyara2sg0l";
+    };
+  }
+  {
+    goPackagePath = "rsc.io/qr";
+    fetch = {
+      type = "git";
+      url = "https://github.com/rsc/qr";
+      rev = "48b2ede4844e13f1a2b7ce4d2529c9af7e359fc5";
+      sha256 = "1npxy32glnkvsp0871972jzjzgkwaqmbv6jsj9wgqsa1s2jr004p";
+    };
+  }
+]

pkgs/tools/security/browserpass/default.nix

@@ -1,43 +1,66 @@
-# This file was generated by https://github.com/kamilchm/go2nix v1.2.1
-{ stdenv, buildGoPackage, fetchFromGitHub, gnupg }:
-
-buildGoPackage rec {
-  name = "browserpass-${version}";
-  version = "2.0.22";
-
-  goPackagePath = "github.com/dannyvankooten/browserpass";
-
-  goDeps = ./deps.nix;
+{ lib, callPackage, buildGoPackage, fetchFromGitHub, makeWrapper, gnupg }:
+let
+  # For backwards compatibility with v2 of the browser extension, we embed v2
+  # of the native host in v3. Because the extension will auto-update when it
+  # is released, this code can be removed from that point on.
+  # Don't forget to remove v2 references down below and the v2 files in this
+  # folder
+  v2 = callPackage ./2.nix {};
+in buildGoPackage rec {
+  name = "${pname}-${version}";
+  pname = "browserpass";
+  version = "3.0.1";
 
   src = fetchFromGitHub {
-    repo = "browserpass";
-    owner = "dannyvankooten";
+    owner = "browserpass";
+    repo = "browserpass-native";
     rev = version;
-    sha256 = "05cacrx08k99c5zra7ksdik9xxn3vih3x6in7536zs5gm55mkbfx";
+    sha256 = "1i3xxysiiapz9y2v0gp13inx7j0d7n0khpmcsy9k95pzn53526dx";
   };
 
+  nativeBuildInputs = [ makeWrapper ];
+
+  goPackagePath = "github.com/browserpass/browserpass-native";
+  goDeps = ./deps.nix;
+
   postPatch = ''
-    substituteInPlace browserpass.go                                           \
-      --replace /usr/local/bin/gpg ${gnupg}/bin/gpg
+    # Because this Makefile will be installed to be used by the user, patch
+    # variables to be valid by default
+    substituteInPlace Makefile \
+      --replace "PREFIX ?= /usr" ""
   '';
 
-  postInstall = ''
-      host_file="$bin/bin/browserpass"
-      mkdir -p "$bin/etc"
+  DESTDIR = placeholder "bin";
 
-      sed -e "s!%%replace%%!$host_file!" go/src/${goPackagePath}/chrome/host.json > chrome-host.json
-      sed -e "s!%%replace%%!$host_file!" go/src/${goPackagePath}/firefox/host.json > firefox-host.json
-
-      install chrome-host.json $bin/etc/
-      install -D firefox-host.json $bin/lib/mozilla/native-messaging-hosts/com.dannyvankooten.browserpass.json
-      install go/src/${goPackagePath}/chrome/policy.json $bin/etc/chrome-policy.json
+  postConfigure = ''
+    cd "go/src/$goPackagePath"
+    make configure
   '';
 
-  meta = with stdenv.lib; {
-    description = "A Chrome & Firefox extension for zx2c4's pass";
-    homepage = https://github.com/dannyvankooten/browserpass;
-    license = licenses.mit;
-    platforms = with platforms; linux ++ darwin ++ openbsd;
-    maintainers = with maintainers; [ rvolosatovs ];
+  buildPhase = ''
+    make
+  '';
+
+  installPhase = ''
+    make install
+
+    wrapProgram $bin/bin/browserpass \
+      --suffix PATH : ${lib.makeBinPath [ gnupg ]}
+
+    # This path is used by our firefox wrapper for finding native messaging hosts
+    mkdir -p $bin/lib/mozilla/native-messaging-hosts
+    ln -s $bin/lib/browserpass/hosts/firefox/*.json $bin/lib/mozilla/native-messaging-hosts
+
+    # These can be removed too, see comment up top
+    ln -s ${lib.getBin v2}/etc $bin/etc
+    ln -s ${lib.getBin v2}/lib/mozilla/native-messaging-hosts/* $bin/lib/mozilla/native-messaging-hosts
+  '';
+
+  meta = with lib; {
+    description = "Browserpass native client app";
+    homepage = https://github.com/browserpass/browserpass-native;
+    license = licenses.isc;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ rvolosatovs infinisil ];
   };
 }

pkgs/tools/security/browserpass/deps.nix

@@ -1,12 +1,21 @@
-# This file was generated by https://github.com/kamilchm/go2nix v1.2.1
+# file generated from go.mod using vgo2nix (https://github.com/adisbladis/vgo2nix)
 [
   {
-    goPackagePath = "github.com/gokyle/twofactor";
+    goPackagePath = "github.com/davecgh/go-spew";
     fetch = {
       type = "git";
-      url = "https://github.com/gokyle/twofactor";
-      rev = "eaad1884d40f9cabff98a57a524c17afd00c9fe7";
-      sha256 = "07kvga6f2b56kpy52a3xk16garvlqz950s350dax97x7cayba95g";
+      url = "https://github.com/davecgh/go-spew";
+      rev = "v1.1.1";
+      sha256 = "0hka6hmyvp701adzag2g26cxdj47g21x6jz4sc6jjz1mn59d474y";
+    };
+  }
+  {
+    goPackagePath = "github.com/konsorten/go-windows-terminal-sequences";
+    fetch = {
+      type = "git";
+      url = "https://github.com/konsorten/go-windows-terminal-sequences";
+      rev = "v1.0.2";
+      sha256 = "09mn209ika7ciy87xf2x31dq5fnqw39jidgaljvmqxwk7ff1hnx7";
     };
   }
   {
@@ -14,26 +23,71 @@
     fetch = {
       type = "git";
       url = "https://github.com/mattn/go-zglob";
-      rev = "4959821b481786922ac53e7ef25c61ae19fb7c36";
-      sha256 = "0rwkdw143kphpmingsrw1zp030zf3p08f64h347jpdm4lz8z5449";
+      rev = "v0.0.1";
+      sha256 = "1sncdyq5fbd42al4amyy91h7vlzm3wm6c9vl8za2pjgfgsd581fz";
     };
   }
   {
-    goPackagePath = "github.com/sahilm/fuzzy";
+    goPackagePath = "github.com/pmezard/go-difflib";
     fetch = {
       type = "git";
-      url = "https://github.com/sahilm/fuzzy";
-      rev = "a154b19bb758dcdd6ede58dc11ea53c2950527b2";
-      sha256 = "0jkw6474d5ik2fq2zznqxj4y3p42z47r7mbg856ln5wyara2sg0l";
+      url = "https://github.com/pmezard/go-difflib";
+      rev = "v1.0.0";
+      sha256 = "0c1cn55m4rypmscgf0rrb88pn58j3ysvc2d0432dp3c6fqg6cnzw";
     };
   }
   {
-    goPackagePath = "rsc.io/qr";
+    goPackagePath = "github.com/rifflock/lfshook";
     fetch = {
       type = "git";
-      url = "https://github.com/rsc/qr";
-      rev = "48b2ede4844e13f1a2b7ce4d2529c9af7e359fc5";
-      sha256 = "1npxy32glnkvsp0871972jzjzgkwaqmbv6jsj9wgqsa1s2jr004p";
+      url = "https://github.com/rifflock/lfshook";
+      rev = "b9218ef580f5";
+      sha256 = "0wxqjcjfg8c0klmdgmbw3ckagby3wg9rkga9ihd4fsf05x5scxrc";
+    };
+  }
+  {
+    goPackagePath = "github.com/sirupsen/logrus";
+    fetch = {
+      type = "git";
+      url = "https://github.com/sirupsen/logrus";
+      rev = "v1.4.0";
+      sha256 = "1y1qjcg19z7q9sy32rhc148kdql2aw7xkcm9d6r1blrl0mdgpx0w";
+    };
+  }
+  {
+    goPackagePath = "github.com/stretchr/objx";
+    fetch = {
+      type = "git";
+      url = "https://github.com/stretchr/objx";
+      rev = "v0.1.1";
+      sha256 = "0iph0qmpyqg4kwv8jsx6a56a7hhqq8swrazv40ycxk9rzr0s8yls";
+    };
+  }
+  {
+    goPackagePath = "github.com/stretchr/testify";
+    fetch = {
+      type = "git";
+      url = "https://github.com/stretchr/testify";
+      rev = "v1.3.0";
+      sha256 = "0wjchp2c8xbgcbbq32w3kvblk6q6yn533g78nxl6iskq6y95lxsy";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/crypto";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/crypto";
+      rev = "c2843e01d9a2";
+      sha256 = "01xgxbj5r79nmisdvpq48zfy8pzaaj90bn6ngd4nf33j9ar1dp8r";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/sys";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/sys";
+      rev = "fead79001313";
+      sha256 = "12vwl6sv6w7q0dyvynjhbp67242rhh77d6nlsb22ajr8rf17c63i";
     };
   }
 ]

pkgs/tools/security/notary/default.nix

@@ -30,7 +30,7 @@ buildGoPackage rec {
     runHook postInstall
   '';
 
-  doCheck = true;
+  #doCheck = true; # broken by tzdata: 2018g -> 2019a
   checkPhase = ''
     make test PKGS=github.com/theupdateframework/notary/cmd/notary
   '';

pkgs/tools/security/pinentry/default.nix

@@ -24,7 +24,8 @@ stdenv.mkDerivation rec {
 
   patches = lib.optionals (gtk2 != null) [
     (fetchpatch {
-      url = https://sources.debian.org/data/main/p/pinentry/1.1.0-1/debian/patches/0007-gtk2-When-X11-input-grabbing-fails-try-again-over-0..patch;
+      url = "https://salsa.debian.org/debian/pinentry/raw/debian/1.1.0-1/debian/patches/"
+          + "0007-gtk2-When-X11-input-grabbing-fails-try-again-over-0..patch";
       sha256 = "15r1axby3fdlzz9wg5zx7miv7gqx2jy4immaw4xmmw5skiifnhfd";
     })
   ];

pkgs/tools/security/spectre-meltdown-checker/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "spectre-meltdown-checker-${version}";
-  version = "0.39";
+  version = "0.41";
 
   src = fetchFromGitHub {
     owner = "speed47";
     repo = "spectre-meltdown-checker";
     rev = "v${version}";
-    sha256 = "1llp6iyvbykn9w7vnz1jklmy6gmbksk234b46mzjfvg7mvg91dc5";
+    sha256 = "0byjp7ph7g9di9xlg1fvspgq995a3b2yajq7sc8qap46ywvqr899";
   };
 
   prePatch = ''

pkgs/tools/typesetting/tex/texlive/bin.nix

@@ -2,7 +2,7 @@
 , texlive
 , zlib, libiconv, libpng, libX11
 , freetype, gd, libXaw, icu, ghostscript, libXpm, libXmu, libXext
-, perl, pkgconfig, autoreconfHook
+, perl, perlPackages, pkgconfig, autoreconfHook
 , poppler, libpaper, graphite2, zziplib, harfbuzz, potrace, gmp, mpfr
 , cairo, pixman, xorg, clisp, biber
 , makeWrapper
@@ -271,6 +271,33 @@ dvipng = stdenv.mkDerivation {
 };
 
 
+latexindent = perlPackages.buildPerlPackage rec {
+  inherit (src) name version;
+
+  src = stdenv.lib.head (builtins.filter (p: p.tlType == "run") texlive.latexindent.pkgs);
+
+  outputs = [ "out" ];
+
+  propagatedBuildInputs = with perlPackages; [ FileHomeDir LogDispatch LogLog4perl UnicodeLineBreak YAMLTiny ];
+
+  postPatch = ''
+    substituteInPlace scripts/latexindent/LatexIndent/GetYamlSettings.pm \
+      --replace '$FindBin::RealBin/defaultSettings.yaml' ${src}/scripts/latexindent/defaultSettings.yaml
+  '';
+
+  # Dirty hack to apply perlFlags, but do no build
+  preConfigure = ''
+    touch Makefile.PL
+  '';
+  buildPhase = ":";
+  installPhase = ''
+    install -D ./scripts/latexindent/latexindent.pl "$out"/bin/latexindent
+    mkdir -p "$out"/${perl.libPrefix}
+    cp -r ./scripts/latexindent/LatexIndent "$out"/${perl.libPrefix}/
+  '';
+};
+
+
 inherit biber;
 bibtexu = bibtex8;
 bibtex8 = stdenv.mkDerivation {

pkgs/top-level/all-packages.nix

@@ -8021,8 +8021,6 @@ with pkgs;
 
   automake111x = callPackage ../development/tools/misc/automake/automake-1.11.x.nix { };
 
-  automake115x = callPackage ../development/tools/misc/automake/automake-1.15.x.nix { };
-
   automake116x = callPackage ../development/tools/misc/automake/automake-1.16.x.nix { };
 
   automoc4 = callPackage ../development/tools/misc/automoc4 { };

pkgs/top-level/python-packages.nix

@@ -6114,13 +6114,13 @@ in {
 
   hetzner = buildPythonPackage rec {
     name = "hetzner-${version}";
-    version = "0.8.1";
+    version = "0.8.2";
 
     src = pkgs.fetchFromGitHub {
       repo = "hetzner";
       owner = "aszlig";
       rev = "v${version}";
-      sha256 = "1xd1klvjskv0pg8ginih597jkk491a55b8dq80dsm61m5sbsx3vq";
+      sha256 = "152fklxff08s71v0b78yp5ajwpqyszm3sd7j0qsrwa2x9ik4968h";
     };
 
     meta = {